From 68055064500db2a415f887d41bd20794c868cc16 Mon Sep 17 00:00:00 2001 From: k2safe Date: Thu, 17 Sep 2026 16:28:58 +0800 Subject: [PATCH] feat: add durable schedule management and multi-node crash recovery --- README.md | 6 +- cmd/orbit-admin/main.go | 1 + cmd/orbit/main.go | 29 +- docs/05-production-acceptance.md | 2 +- docs/07-data-model.md | 4 +- docs/08-development-plan.md | 5 +- docs/README.md | 6 +- docs/api/README.md | 2 +- docs/api/authentication.md | 2 + docs/api/retries.md | 2 +- docs/api/schedules.md | 219 ++++++++++ docs/examples/README.md | 11 +- docs/reports/phase-3-schedules.md | 96 +++++ docs/sdk/README.md | 9 +- go.mod | 1 + go.sum | 2 + internal/storage/mysql/bootstrap.go | 14 +- .../migrations/000006_schedule_runtime.up.sql | 18 + internal/storage/mysql/schedule_history.go | 139 ++++++ .../mysql/schedule_integration_test.go | 400 ++++++++++++++++++ internal/storage/mysql/schedule_store.go | 294 +++++++++++++ internal/storage/mysql/schedule_tick.go | 225 ++++++++++ internal/storage/mysql/task_store.go | 2 +- internal/timezone/LICENSE | 27 ++ internal/timezone/zone.go | 61 +++ internal/timezone/zone_test.go | 38 ++ internal/timezone/zoneinfo.zip | Bin 0 -> 408467 bytes internal/transport/httpserver/schedules.go | 106 +++++ platform/auth/token.go | 2 +- pulse/model/occurrence.go | 6 +- pulse/model/schedule.go | 8 +- pulse/model/schedule_version.go | 6 +- pulse/schedule/planner.go | 135 ++++++ pulse/schedule/planner_test.go | 56 +++ pulse/schedule/rule.go | 173 ++++++++ pulse/schedule/rule_test.go | 107 +++++ pulse/schedule/service.go | 207 +++++++++ scripts/test-mysql.sh | 4 +- sdk/go/examples/schedules/main.go | 149 +++++++ sdk/go/schedule_integration_test.go | 134 ++++++ sdk/go/schedule_types.go | 110 +++++ sdk/go/schedules.go | 83 ++++ sdk/go/worker_process_integration_test.go | 80 ++++ 43 files changed, 2952 insertions(+), 29 deletions(-) create mode 100644 docs/api/schedules.md create mode 100644 docs/reports/phase-3-schedules.md create mode 100644 internal/storage/mysql/migrations/000006_schedule_runtime.up.sql create mode 100644 internal/storage/mysql/schedule_history.go create mode 100644 internal/storage/mysql/schedule_integration_test.go create mode 100644 internal/storage/mysql/schedule_store.go create mode 100644 internal/storage/mysql/schedule_tick.go create mode 100644 internal/timezone/LICENSE create mode 100644 internal/timezone/zone.go create mode 100644 internal/timezone/zone_test.go create mode 100644 internal/timezone/zoneinfo.zip create mode 100644 internal/transport/httpserver/schedules.go create mode 100644 pulse/schedule/planner.go create mode 100644 pulse/schedule/planner_test.go create mode 100644 pulse/schedule/rule.go create mode 100644 pulse/schedule/rule_test.go create mode 100644 pulse/schedule/service.go create mode 100644 sdk/go/examples/schedules/main.go create mode 100644 sdk/go/schedule_integration_test.go create mode 100644 sdk/go/schedule_types.go create mode 100644 sdk/go/schedules.go diff --git a/README.md b/README.md index 704e32a..fe12566 100644 --- a/README.md +++ b/README.md @@ -8,9 +8,9 @@ Orbit 是面向多个业务项目的通用任务调度与流程编排平台， ## 当前进度 -已完成 P0–P2 阶段验收：32 个数据模型、版本化迁移、凭据及范围校验、队列与任务 API、WSS 执行、独立 SDK、自动 Worker 和 [执行尝试/证据查询](docs/api/execution-history.md)。[Worker Schema](docs/api/worker-schema.md) 与真实进程强杀恢复回归已通过；[安全重试](docs/api/retries.md) 已接入服务端和 SDK，调度器和流程引擎按 [持续开发计划](docs/08-development-plan.md) 继续实现。 +已完成 P0–P2 阶段验收：32 个数据模型、版本化迁移、凭据及范围校验、队列与任务 API、WSS 执行、独立 SDK、自动 Worker 和 [执行尝试/证据查询](docs/api/execution-history.md)。[Worker Schema](docs/api/worker-schema.md) 与真实进程强杀恢复回归已通过；[安全重试](docs/api/retries.md) 与 [定时计划](docs/api/schedules.md) 已接入服务端和 SDK，剩余 Pulse 能力与流程引擎按 [持续开发计划](docs/08-development-plan.md) 继续实现。 -readiness 只表示数据库与迁移记录可用，不表示完整平台已具备生产服务能力。验证证据见 [P0](docs/reports/phase-0.md)、[P1](docs/reports/phase-1.md) 与 [P2 阶段验收](docs/reports/phase-2.md)，后者汇总服务端、SDK、执行历史及故障验证的详细记录。P3 的当前进展见 [安全重试报告](docs/reports/phase-3-safe-retry.md)。 +readiness 只表示数据库与迁移记录可用，不表示完整平台已具备生产服务能力。验证证据见 [P0](docs/reports/phase-0.md)、[P1](docs/reports/phase-1.md) 与 [P2 阶段验收](docs/reports/phase-2.md)，后者汇总服务端、SDK、执行历史及故障验证的详细记录。P3 的当前进展见 [安全重试报告](docs/reports/phase-3-safe-retry.md) 和 [计划调度报告](docs/reports/phase-3-schedules.md)。 ## 目录 @@ -25,6 +25,8 @@ pulse/model/ 任务、尝试、队列、计划和执行许可 pulse/service/ 任务与队列应用契约、输入校验 pulse/worker/ 会话、开始、续租、结果和恢复契约 pulse/retry/ 冻结策略、有限退避与未知效果决策 +pulse/schedule/ Cron/间隔、漏跑、版本及计划接口 +internal/timezone/ 随计划冻结的内置时区数据快照 weave/model/ 定义、实例、步骤、信号和查询轮次 internal/config/ 配置校验 internal/storage/mysql/ 连接、事务、迁移及集成测试 diff --git a/cmd/orbit-admin/main.go b/cmd/orbit-admin/main.go index 5a51896..b233e20 100644 --- a/cmd/orbit-admin/main.go +++ b/cmd/orbit-admin/main.go @@ -33,6 +33,7 @@ func run() error { flags.StringVar(&in.Queue, "queue", "", "initial queue name") flags.StringVar(&output, "output", "", "new private credentials JSON file") flags.BoolVar(&in.WorkerAccess, "worker-access", false, "also grant Worker connect and consume actions for development") + flags.BoolVar(&in.ScheduleAccess, "schedule-access", false, "also grant schedule read and manage actions for development") if err := flags.Parse(os.Args[2:]); err != nil { return err } diff --git a/cmd/orbit/main.go b/cmd/orbit/main.go index 2148fa4..e153666 100644 --- a/cmd/orbit/main.go +++ b/cmd/orbit/main.go @@ -15,6 +15,7 @@ import ( "git.yuntuo.hk/k2safe/orbit/internal/storage/mysql" "git.yuntuo.hk/k2safe/orbit/internal/transport/httpserver" core "git.yuntuo.hk/k2safe/orbit/model" + "git.yuntuo.hk/k2safe/orbit/pulse/schedule" "git.yuntuo.hk/k2safe/orbit/pulse/service" "git.yuntuo.hk/k2safe/orbit/pulse/worker" ) @@ -61,6 +62,32 @@ func run() error { } hub := httpserver.NewWorkerHub(root, worker.New(executions)) httpserver.RegisterWorkers(server, hub) + schedules, err := mysql.NewScheduleStore(db, node) + if err != nil { + return err + } + httpserver.RegisterSchedules(server, schedule.New(schedules)) + scheduleCtx, stopSchedules := context.WithCancel(root) + scheduleDone := make(chan struct{}) + go func() { + defer close(scheduleDone) + ticker := time.NewTicker(time.Second) + defer ticker.Stop() + for { + select { + case <-scheduleCtx.Done(): + return + case <-ticker.C: + call, cancel := context.WithTimeout(scheduleCtx, 5*time.Second) + _, err := schedules.Tick(call, 100) + cancel() + if err != nil && scheduleCtx.Err() == nil { + slog.Error("schedule batch failed", "node_id", node) + } + } + } + }() + defer func() { stopSchedules(); <-scheduleDone }() defer func() { ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second) defer cancel() @@ -93,7 +120,7 @@ func run() error { } done := make(chan error, 1) go func() { done <- server.Serve(listener) }() - slog.Info("Orbit HTTP server starting", "address", listener.Addr().String(), "scope", "health, task, queue and Worker APIs", "node_id", node) + slog.Info("Orbit HTTP server starting", "address", listener.Addr().String(), "scope", "health, task, queue, schedule and Worker APIs", "node_id", node) select { case err := <-done: if errors.Is(err, http.ErrServerClosed) { diff --git a/docs/05-production-acceptance.md b/docs/05-production-acceptance.md index 0ba444f..9e33a93 100644 --- a/docs/05-production-acceptance.md +++ b/docs/05-production-acceptance.md @@ -1,6 +1,6 @@ # Orbit 生产验收与发布门槛 -> 版本 0.2 · 2026-09-17。本文是全平台生产发布门槛。P0–P2 已积累阶段证据，见 [开发计划](08-development-plan.md) 与 [P2 验收](reports/phase-2.md)；未覆盖的场景继续实施，尚无全平台生产验收或容量结论。 +> 版本 0.2 · 2026-09-17。本文是全平台生产发布门槛。P0–P2 已积累阶段证据，见 [开发计划](08-development-plan.md) 与 [P2 验收](reports/phase-2.md)；P3 新增 [计划调度证据](reports/phase-3-schedules.md)。未覆盖的场景继续实施，尚无全平台生产验收或容量结论。 ## 1. 验收对象与证据 diff --git a/docs/07-data-model.md b/docs/07-data-model.md index d680c8e..14c745a 100644 --- a/docs/07-data-model.md +++ b/docs/07-data-model.md @@ -1,6 +1,6 @@ # 数据模型与实现基线 -更新：2026-09-17。当前为基础实现阶段，完整调度与编排引擎仍在开发计划中。 +更新：2026-09-17。当前已实现任务执行、安全重试与计划调度；剩余资源控制、订阅及流程编排继续开发。 ## 1. 模块与依赖 @@ -113,4 +113,6 @@ P2 服务端已新增会话隔离、两步派发、租约、并发许可、结 000005_safe_retry 增加任务 EffectUncertain、尝试与证据 Retryable 字段，Go 与 SQL 均附中文说明；实体数仍为 32。跨尝试的不确定效果必须保留，历史 NEEDS_REVIEW 保守回填 true，旧状态、版本和冻结策略不变。回执增加 `(namespace_id, attempt_id, operation, request_digest)` 索引，换消息身份重报结果也返回原已应用回执。字段语义、升级策略启用与限制见 [安全重试](api/retries.md)，升级回归见 [阶段报告](reports/phase-3-safe-retry.md)。 +000006_schedule_runtime 增加 Schedule.QueueID / ProcessingVersion / CheckAt 以及 ScheduleVersion.CatchupWindowMS / GraceMS。字段、单位、可空语义均有中文注释；CoveredUntil 明确为合并或跳过范围的排除边界。实体数不变，增加扫描、列表和任务来源索引。时间规则 JSON 冻结 CalendarVersion，服务内置相应时区快照。调度记录、生成任务、事件和进度同事务写入，旧版本积压不会被新发布覆盖；详见 [计划契约](api/schedules.md)。 + 命令与验证记录见 [开发计划](08-development-plan.md)、[基础阶段验证报告](reports/phase-0.md) 与 [执行历史回归](reports/phase-2-execution-history.md)。 diff --git a/docs/08-development-plan.md b/docs/08-development-plan.md index cc3f6d2..e22261d 100644 --- a/docs/08-development-plan.md +++ b/docs/08-development-plan.md @@ -27,7 +27,7 @@ | P0 基础与数据模型 | Go workspace、独立 SDK module、公共/Pulse/Weave 模型、MySQL 迁移、配置、健康检查 | 编译/竞态/静态检查；真实 MySQL 建表、隔离、唯一性、预算、不可变版本、迁移失败防护；SDK 健康调用 | 已完成并通过阶段回归（见 P0 报告） | | P1 任务受理闭环 | 应用凭据与作用域权限、队列、幂等提交、查询、待执行取消、受理事件；SDK 客户端 | API/SDK 创建查询闭环；重复键与内容冲突、响应未确认重报、跨命名空间拒绝、参数边界 | 已完成并通过阶段回归（见 P1 报告；真实断路/提交 ACK 丢失注入留后续故障阶段） | | P2 Worker 执行闭环 | WSS 接入、能力/容量、领取与开始、租约、续租、结果确认、排空与恢复；Worker SDK | 真 Worker 执行；失联/重连/重复确认/旧尝试拒绝；业务效果未知转核查；节点故障接管 | 已完成并通过阶段回归：服务端、自动 SDK、历史查询、完整 Schema 与真实进程强杀恢复；测试拓扑和剩余生产故障矩阵见 P2 验收报告 | -| P3 Pulse 完整能力 | 安全重试、延时、Cron/固定间隔、漏跑策略、计划版本、并发许可、配额/背压、可靠结果订阅 | 多实例领取/触发竞争、重试上限、取消竞争、队列隔离、积压恢复、事件重复交付 | 进行中：安全重试、退避、未知效果保留、升级回填及 SDK 场景已通过回归；Cron/固定间隔、计划管理、运行中取消、配额/背压和订阅待开发 | +| P3 Pulse 完整能力 | 安全重试、延时、Cron/固定间隔、漏跑策略、计划版本、并发许可、配额/背压、可靠结果订阅 | 多实例领取/触发竞争、重试上限、取消竞争、队列隔离、积压恢复、事件重复交付 | 进行中：安全重试、Cron/固定间隔、版本、暂停恢复、有限漏跑/重叠策略和 SDK 场景已实现并回归；运行中取消、配额/背压和可靠订阅待开发 | | P4 Weave 主流程 | SDK 定义构建与发布校验、实例、顺序/分支/结构化并行汇合、信号/定时等待、版本绑定 | 重启接续、早到/重复信号、并行竞争、内部事件重放、发布版本兼容；端到端通用流程 | 待开发 | | P5 Weave 恢复与查询 | 有界查询、暂停继续、取消、人工核查恢复、控制门控与审计 | 轮次与尝试独立预算；暂停/开始/回执/超时竞争；恢复保留预算；未知结果不盲目重复 | 待开发 | | P6 生产验证与运维 | 完整监控、凭据轮换、备份恢复、滚动升级、运行手册、可复现负载和故障工具 | 对照生产验收清单执行，报告环境/指标/遗留项；容量、RPO/RTO 按真实拓扑验证 | 待开发 | @@ -42,7 +42,7 @@ SDK、文档与示例随 P1–P5 同步开发，P7 是全量核对，不是最 | 健康检查 | 创建客户端 → 存活/就绪查询 | P0 | | 文件转换任务 | 提交幂等任务 → Worker 处理 → 查询结果 | P1–P2 | | 有限安全重试 | 明确失败 → 持久化退避 → 新尝试 → 查询完整历史 | P3，已实现完整示例 | -| 定期数据同步 | 发布计划 → 触发任务 → 暂停/恢复 → 查看触发记录 | P3 | +| 定期数据同步 | 发布计划 → 触发任务 → 暂停/恢复 → 查看触发记录 | P3，已实现通用快照示例 | | 并行生成结果 | 发布流程 → 并行执行 → 汇合 → 完成 | P4 | | 审核与外部回执 | 提交流程 → 等待信号 → 授权信号注入 → 继续 | P4 | | 外部作业轮询 | 提交一次 → 有界查询处理中状态 → 回执或最终结果 → 超限核查 | P5 | @@ -77,6 +77,7 @@ SDK、文档与示例随 P1–P5 同步开发，P7 是全量核对，不是最 - [P1 验证记录](reports/phase-1.md) - [P2 阶段验收与进程故障记录](reports/phase-2.md) - [P3 安全重试阶段记录](reports/phase-3-safe-retry.md) +- [P3 计划调度阶段记录](reports/phase-3-schedules.md) - [P2 服务端阶段记录](reports/phase-2-server.md) - [P2 SDK 协议阶段记录](reports/phase-2-sdk-protocol.md) - [P2 自动 Worker 运行器记录](reports/phase-2-worker-runtime.md) diff --git a/docs/README.md b/docs/README.md index a99e78e..08d112f 100644 --- a/docs/README.md +++ b/docs/README.md @@ -2,7 +2,7 @@ - 文档版本：0.2 - 整理日期：2026-09-17 -- 阶段：P0–P2 已通过阶段验收，包括协议 Schema 与真实进程故障恢复；P3 安全重试已通过回归，P3–P7 继续推进，尚未完成全平台生产验收 +- 阶段：P0–P2 已通过阶段验收，包括协议 Schema 与真实进程故障恢复；P3 安全重试与计划调度已通过回归，P3–P7 继续推进，尚未完成全平台生产验收 - 适用范围：Orbit 统一平台，包含 Pulse 任务调度模块、Weave 流程编排模块与公共能力。平台面向多个业务系统复用。 ## 阅读顺序 @@ -58,7 +58,7 @@ Orbit 不内置特定行业规则；Pulse 管理执行，Weave 管理步骤依 | Weave 技术细则 | 功能范围已确认；SDK/定义 Schema、暂停门控与计时、查询预算、并行失败策略、人工恢复身份仍需评审 | [流程](06-workflow-spec.md) | | WS 库及后续依赖版本 | 当前基础使用 Go 1.27.1、MySQL 8.4+ 与显式 SQL；WS 已锁定 coder/websocket v1.8.15，后续依赖需单独验证 | [模型基线](07-data-model.md) | | 人工重试的任务身份 | 建议创建关联的新任务，自动重试保持原任务 ID | [功能](01-functional-spec.md) | -| Cron、固定间隔与夏令时细节 | 建议五段 Cron、固定间隔首版采用 fixed-rate；夏令时行为需明确 | [功能](01-functional-spec.md) | +| Cron、固定间隔与夏令时细节 | 已实现五段 Cron、fixed-rate；缺失时刻跳过、重复时刻按 UTC 分开；时区快照随版本冻结 | [计划接口](api/schedules.md) | | 批量大小、消息上限、心跳、租约、扫描周期 | 均需设置有限上限；数值通过原型与压测确定 | [验收](05-production-acceptance.md) | | 幂等、事件、审计的保留周期 | 按恢复与业务追溯要求确定，不能仅随任务清理 | [数据](04-reliability-and-data.md) | | 数据库高可用与恢复目标 | 明确故障模型、复制确认、RPO / RTO 及运维责任 | [验收](05-production-acceptance.md) | @@ -79,4 +79,4 @@ Orbit 不内置特定行业规则；Pulse 管理执行，Weave 管理步骤依 2026-09-17，文档更新至 0.2：用户确认研发定义发布流程及 Weave 首版功能，明确纳入有界重复查询和暂停/继续等生产管理能力。技术细则与参数继续按建议或待定标注，未将功能确认等同于实现或验收通过。 -持续开发目标已建立。当前实现和验收进度以 [开发计划](08-development-plan.md)、[P0 报告](reports/phase-0.md)、[P1 报告](reports/phase-1.md) 与 [P2 阶段验收](reports/phase-2.md) 和 [P3 安全重试报告](reports/phase-3-safe-retry.md) 为准；早期设计稿中的“未实现”描述保留其编写阶段语境。 +持续开发目标已建立。当前实现和验收进度以 [开发计划](08-development-plan.md)、[P0 报告](reports/phase-0.md)、[P1 报告](reports/phase-1.md) 与 [P2 阶段验收](reports/phase-2.md) 、[P3 安全重试报告](reports/phase-3-safe-retry.md) 和 [P3 计划调度报告](reports/phase-3-schedules.md) 为准；早期设计稿中的“未实现”描述保留其编写阶段语境。 diff --git a/docs/api/README.md b/docs/api/README.md index 8659919..8dfb8bb 100644 --- a/docs/api/README.md +++ b/docs/api/README.md @@ -15,7 +15,7 @@ | 凭据校验与初始化 CLI | P1 已实现 | [鉴权](authentication.md) | | `/v1/worker/connect` | P2 已实现并通过阶段验收 | [Worker 契约](worker.md)、[Schema](worker-schema.md) | | 任务冻结策略与 Worker `retryable` | P3 安全重试已实现 | [安全重试](retries.md) | -| `/v1/schedules` 与计划管理 | 计划 P3，尚未实现 | [协议草案](../03-http-websocket-protocol.md) | +| `/v1/schedules`、不可变版本、暂停/恢复及触发查询 | P3 已实现 | [计划接口与 SDK 场景](schedules.md) | | `/v1/events/connect` | 计划 P3，尚未实现 | [协议草案](../03-http-websocket-protocol.md) | | `/v1/workflows` 与流程管理 | 计划 P4–P5，尚未实现 | [流程接口规划](workflows.md) | diff --git a/docs/api/authentication.md b/docs/api/authentication.md index 1a48053..56bd4e2 100644 --- a/docs/api/authentication.md +++ b/docs/api/authentication.md @@ -52,4 +52,6 @@ actions 不支持通配符；queues 可列出队列 ID，星号仅表示当前 SDK 使用 `orbit.Options{Token: token}`。健康查询不发送凭据。当前不启用业务权限缓存，撤销校验不依赖缓存过期。 +P3 增加 schedules:read 和 schedules:manage。bootstrap 显式传 --schedule-access 才授予；创建/发布计划还需要 tasks:submit 与队列范围。已有计划属于命名空间，创建凭据到期或撤销不自动暂停计划；停止新触发应暂停计划，或禁用应用/命名空间。详见 [计划接口](schedules.md)。 + P2 增加 workers:connect 和 workers:consume。bootstrap 只有显式提供 --worker-access 时才同时授予这两项开发权限；现有凭据不自动变化。Worker 还需独立的进程恢复秘密和尝试秘密，见 [Worker 契约](worker.md)。 diff --git a/docs/api/retries.md b/docs/api/retries.md index 87728ff..b4588dc 100644 --- a/docs/api/retries.md +++ b/docs/api/retries.md @@ -1,6 +1,6 @@ # 安全重试 v1 -状态：P3 的安全重试已实现。使用现有任务提交与 Worker 结果接口，无独立的自动重试路由；Cron、运行中取消、人工恢复与可靠结果订阅继续按 [计划](../08-development-plan.md) 开发。验证证据见 [本阶段报告](../reports/phase-3-safe-retry.md)。 +状态：P3 的安全重试已实现。使用现有任务提交与 Worker 结果接口，无独立的自动重试路由；[Cron/固定间隔计划](schedules.md) 已接入；运行中取消、人工恢复与可靠结果订阅继续按 [计划](../08-development-plan.md) 开发。验证证据见 [本阶段报告](../reports/phase-3-safe-retry.md)。 ## 1. 三种不同的重报 diff --git a/docs/api/schedules.md b/docs/api/schedules.md new file mode 100644 index 0000000..f0fb032 --- /dev/null +++ b/docs/api/schedules.md @@ -0,0 +1,219 @@ +# 调度计划接口 v1 + +状态：已实现五段 Cron、fixed-rate、不可变版本、暂停/恢复、三种漏跑与重叠策略、触发历史及独立 SDK。调度记录、任务创建、事件与进度同事务提交。当前实际验证与边界见 [阶段报告](../reports/phase-3-schedules.md)，整体仍按 [开发计划](../08-development-plan.md) 推进。 + +## 1. 权限与生命周期 + +| 接口 | 权限 | SDK | +| --- | --- | --- | +| POST /v1/schedules | schedules:manage + tasks:submit + 模板队列范围 | CreateSchedule | +| GET /v1/schedules?queue_id=… | schedules:read + 队列范围 | ListSchedules | +| GET /v1/schedules/{id} | schedules:read + 计划队列范围 | GetSchedule | +| PATCH /v1/schedules/{id} | schedules:manage + tasks:submit + 计划队列范围 | PublishSchedule | +| POST /v1/schedules/{id}:pause | schedules:manage + 计划队列范围 | PauseSchedule | +| POST /v1/schedules/{id}:resume | schedules:manage + 计划队列范围 | ResumeSchedule | +| GET /v1/schedules/{id}/versions/{version} | schedules:read + 计划队列范围 | GetScheduleVersion | +| GET /v1/schedules/{id}/occurrences | schedules:read + 计划队列范围 | ListScheduleOccurrences | + +计划终身绑定一个队列。发布完整新定义时可以改变时间、参数和策略，不能更换队列。计划属于命名空间；创建凭据后续到期/撤销不自动撤销已创建的计划。停止计划使用暂停接口，禁用应用或命名空间会阻止后台继续创建任务。每次管理与查询仍重新校验当前凭据。 + +计划暂停只停止产生新的任务，已经受理的任务继续执行。队列暂停只停止任务派发，不停止计划受理，可能形成积压。SERIAL 策略将 WAITING、LEASED、RUNNING、NEEDS_REVIEW 都视为未完成；未知效果未处理时不能开始下一轮。 + +请求使用 Bearer、application/json 和稳定的 Idempotency-Key，沿用 [任务接口](tasks.md) 的 512 KiB 请求、严格 JSON、命名空间隔离和精确数字规则。ID 为 32 位小写十六进制，revision/version 为十进制字符串，时间为 UTC RFC 3339 微秒精度。 + +## 2. 创建与定义字段 + +CreateScheduleRequest：name、definition 必填；paused 默认 false。name 为命名空间内唯一的 1–128 位 ASCII 名称，字符规则同任务处理器。definition 包含 rule、policy、task，三者均需明确提供。 + +| rule 字段 | 含义与边界 | +| --- | --- | +| kind | CRON 或 FIXED_RATE | +| timezone | 必填 IANA 名称，如 UTC、Asia/Shanghai；不接受 Local 或文件路径 | +| calendar_version | 可省略，v1 固定默认 `go1.27.1-b2d18a7c8fa8`；规范化后写入版本快照，其他未支持值拒绝 | +| start_at | 必填基准，包含边界；年份 2000–9998，最多微秒 | +| end_at | 可选排除边界，必须晚于 start_at；达到后不再产生新触发点 | +| cron | CRON 必填五段表达式，最多 256 字符；不接受秒段、@every 等描述符或内嵌 TZ= | +| interval_ms | FIXED_RATE 必填，1000–2592000000 毫秒；此时不能设置 cron | + +新计划的第一个点不早于数据库创建时刻；start_at 在过去时只用作规则基准，不追溯生成计划存在前的任务。创建时必须还有未来触发点。新发布版本可以设置已经结束的规则，此时先处理旧积压，再结束后续调度。 + +Cron 段顺序为分钟、小时、月日、月、星期；支持 `*`、列表、范围、步长、月份/星期名称，星期为 0–6（周日为 0）。月日与星期均受限时按 OR 匹配，有通配段时按标准组合规则匹配。采用 [robfig/cron v3.0.1 的解析器](https://github.com/robfig/cron/tree/v3.0.1)，Orbit 自行按时区偏移区间转换 UTC 触发点，不启动该库的内存调度器。 + +时区快照内置于服务二进制，不读取宿主机时区文件或 ZONEINFO。快照来自 Go 1.27.1 的 zoneinfo.zip，完整 SHA-256 为 `b2d18a7c8fa8142097a48c99609fb3c92db5ee98bc740294e57eab8ae9f94779`。升级时必须保留旧快照可读能力和 v1 默认语义，不能把旧计划静默换成新的时区规则。 + +- 夏令时缺失的本地时刻跳过；重复的本地时刻按两个不同 UTC 时间分别触发。 +- 半小时跳变、整天跳过、非整点时区和世纪闰日都有测试。 +- fixed-rate 始终按 `start_at + n × interval_ms` 的实际经过时间计算，不跟随上一任务的完成时间漂移。 +- 无解日期规则、混合字段和无效时区在发布前拒绝。无后续触发点与计算错误分开处理，错误不能静默当作完成。 + +| policy 字段 | 要求 | +| --- | --- | +| misfire | 必填：SKIP、COALESCE、CATCH_UP | +| overlap | 必填：PARALLEL、SERIAL、SKIP | +| catchup_limit | 必填 1–100，每批最多生成任务数；大参数批次还受约 1 MiB 参数复制量限制 | +| catchup_window_ms | 必填 1000–2592000000，未处理触发点最多保留的时间窗口 | +| grace_ms | 必填 1000–60000，正常派发允许延迟；不能超过 catchup_window_ms | + +所有任务策略在 task 内冻结，字段同 SubmitTaskRequest；payload 最大 256 KiB，数字文本保持精确。task 中禁止绝对 available_at / start_deadline_at，每次生成时立即可受理，task_timeout_ms 从本次实际创建时间计算。计划结束不取消已经生成的任务，也不缩短其任务时限。 + +创建请求示例，ID 和未来时间替换为实际值： + +```json +{ + "name":"object-snapshot", + "paused":true, + "definition":{ + "rule":{"kind":"FIXED_RATE","timezone":"UTC","start_at":"2026-10-01T00:00:00Z","interval_ms":60000}, + "policy":{"misfire":"COALESCE","overlap":"SERIAL","catchup_limit":10,"catchup_window_ms":86400000,"grace_ms":5000}, + "task":{"queue_id":"11111111111111111111111111111111","handler":"object.snapshot","handler_version":"v1","payload_version":"v1","payload":{"source_ref":"objects/sample","sequence":9007199254740993},"task_timeout_ms":30000,"retry":{"max_attempts":1,"attempt_timeout_ms":5000}} + } +} +``` + +```sh +curl "$ORBIT_URL/v1/schedules" \ + -H "Authorization: Bearer $ORBIT_TOKEN" \ + -H 'Content-Type: application/json' -H 'Idempotency-Key: snapshot-plan-001' \ + --data-binary @schedule.json +``` + +将上方 JSON 保存为 schedule.json。首次返回 201，同键同内容返回 200；均不表示已有任务完成。响应示例： + +```json +{ + "request_id":"44444444444444444444444444444444", + "data":{ + "deduplicated":false, + "schedule":{ + "id":"22222222222222222222222222222222","namespace_id":"33333333333333333333333333333333", + "queue_id":"11111111111111111111111111111111","name":"object-snapshot", + "revision":"1","current_version":"1","processing_version":"1","paused":true, + "next_fire_at":"2026-10-01T00:00:00Z","check_at":"2026-10-01T00:00:00Z", + "created_at":"2026-09-17T08:00:00Z","updated_at":"2026-09-17T08:00:00Z", + "current":{ + "version":"1","effective_at":"2026-09-17T08:00:00Z", + "definition":{ + "rule":{"calendar_version":"go1.27.1-b2d18a7c8fa8","kind":"FIXED_RATE","timezone":"UTC","start_at":"2026-10-01T00:00:00Z","interval_ms":60000}, + "policy":{"misfire":"COALESCE","overlap":"SERIAL","catchup_limit":10,"catchup_window_ms":86400000,"grace_ms":5000}, + "task":{"queue_id":"11111111111111111111111111111111","handler":"object.snapshot","handler_version":"v1","payload_version":"v1","payload":{"source_ref":"objects/sample","sequence":9007199254740993},"task_timeout_ms":30000,"recovery_safety":"RECONCILE_ONLY","retry":{"max_attempts":1,"initial_delay_ms":0,"max_delay_ms":0,"attempt_timeout_ms":5000}} + } + } + } + } +} +``` + +GetSchedule 的 data 直接为 schedule 对象。列表 Items 省略 current/大参数，其他字段相同。next_fire_at 是下一原计划时间，积压时可能在过去；check_at 是平台下次允许扫描时间，并不保证届时执行。next_fire_at 为空时，可能尚待初始化某个版本的首个触发点，也可能已经结束；即使 processing_version 等于 current_version，也必须结合 check_at 判断。check_at 非空表示仍有扫描工作，为空且处理到最新版本表示已无后续触发。 + +## 3. 漏跑、重叠与有限补偿 + +先处理超过 catchup_window_ms 的范围并记录 CATCHUP_WINDOW_EXCEEDED，再应用漏跑规则： + +| 策略 | 行为 | +| --- | --- | +| SKIP | 早于 now − grace_ms 的点合为跳过范围；容差内的点仍可受理 | +| COALESCE | 若最早积压点超过 grace_ms，将当前版本内本轮所有已到期点合为一个任务 | +| CATCH_UP | 按原时间逐点创建，单批不超过 catchup_limit，剩余进度保留到下一批 | +| PARALLEL | 可以产生多条未完成任务，实际执行仍受队列与 Worker 并发许可限制 | +| SERIAL | 有任一先前计划任务未终结时保留游标等待；没有未完成任务时本批最多创建一条 | +| SKIP 重叠策略 | 有先前未终结任务时跳过本轮已到期范围；否则本批最多创建一条 | + +SERIAL 等待也受时间窗口约束，过旧范围会被记录为跳过，避免无界补偿。NEEDS_REVIEW 不属于明确终态，会持续阻止串行后续任务；取消或失败不能假装外部效果已消失。 + +每节点每秒扫描最多 100 个候选计划，每个计划单独事务。同一计划相邻批次的数据库决策时间至少间隔一秒，check_at 持久化，多节点不会各自补跑一份。每批最多创建一个历史版本的任务，跨版本也不绕过批量上限；空版本每批最多推进 16 个。当前是有界运行基线，不是已验证的生产吞吐承诺。 + +每个触发身份由命名空间、计划 ID、原 UTC scheduled_at 唯一确定。暂停、重连和发布新版本都不会改变旧身份。跳过/合并记录的覆盖区间为 `[scheduled_at, covered_until)`，结束边界不包含；范围不会跨越版本生效时间，也不会为范围内每个点额外创建任务。 + +## 4. 发布、暂停与恢复 + +PATCH 是完整发布，必须包含 expected_revision（非零十进制字符串）、reason（非空，最多 1024 字符）、definition（完整新定义）。发布后 current_version 增加一，新版本以事务读取的数据库时间立即生效。 + +尚未处理且早于新版本生效边界的点仍按旧规则、旧模板和旧策略决定。后续原时间由新版本计算，已生成任务保持原快照。数据库触发器禁止覆盖已发布版本。GET versions/{version} 返回 version、effective_at、definition；version 必须是无前导零的非零十进制数。 + +暂停/恢复请求体相同： + +```json +{"expected_revision":"1","reason":"start regular snapshots"} +``` + +成功返回 200，data 与创建回执结构相同。暂停不清空游标，恢复按冻结漏跑规则处理暂停期间的点。对已经处于目标暂停状态的计划换键操作返回 STATE_CONFLICT；原键原内容重报仍返回原回执。 + +- 管理操作、不可变版本、事件、审计和幂等回执同事务保存。后台触发持久化 occurrence、task.accepted、schedule.decided、schedule.advanced，记录执行节点。 +- 每次扫描也更新 revision。遇到明确 STATE_CONFLICT，先 GET 新状态，再用新的命令身份和新 expected_revision 操作；网络结果不明时必须复用原键和原版本核对。 +- 同键更改定义、reason 或 expected_revision 返回 IDEMPOTENCY_CONFLICT。原回执不表示计划当前仍是该状态。 +- 计划名称不能修改，暂无删除或单次手动触发接口。WAITING 的已生成计划任务可用任务取消接口取消，计划本身继续运行；流程归属任务仍由后续流程控制管理。 + +## 5. 列表与触发记录 + +ListSchedules 需要 queue_id；计划列表和 occurrences 均可用 limit（默认 20，1–100）、cursor（最多 1024 字符）。未知、重复查询参数或错误游标返回 400。详情接口不接受查询参数。 + +计划按 `(created_at DESC,id DESC)`，触发按 `(scheduled_at DESC,id DESC)` 分页，不使用 offset。游标绑定命名空间、队列或计划及查询类型。读取不承诺跨页快照；空列表为 items: []，有下一页才返回 next_cursor。 + +```json +{ + "request_id":"44444444444444444444444444444444", + "data":{"items":[{ + "id":"55555555555555555555555555555555","schedule_id":"22222222222222222222222222222222", + "schedule_version":"1","scheduled_at":"2026-10-01T00:00:00Z","decision":"COALESCED", + "task_id":"66666666666666666666666666666666","covered_until":"2026-10-01T00:03:00.000001Z", + "reason":"MISFIRE_COALESCED","created_at":"2026-10-01T00:03:00Z" + }]} +} +``` + +FIRED 表示已创建单点任务；COALESCED 表示范围已合并到 task_id；SKIPPED 没有 task_id。它们都不是业务执行结果，继续 GetTask 查询，再通过 [尝试与证据接口](execution-history.md) 核对执行。 + +## 6. SDK 与完整示例 + +所有方法首参数为 context.Context，写操作需要稳定 key。ListSchedules 的参数为 `(ctx, queueID, SchedulePageRequest)`；ListScheduleOccurrences 为 `(ctx, scheduleID, SchedulePageRequest)`。 + +在已有服务和当前迁移基础上，创建专用开发凭据： + +```sh +go run ./cmd/orbit-admin bootstrap \ + --application schedule-demo --namespace default --environment development \ + --queue snapshots --worker-access --schedule-access \ + --output .local/schedule.credentials.json +cd sdk/go +ORBIT_URL=http://127.0.0.1:8080 \ + ORBIT_CREDENTIALS_FILE=../../.local/schedule.credentials.json \ + go run ./examples/schedules +``` + +前置数据库与目录步骤见 [SDK 接入](../sdk/README.md)。源码：[完整调度示例](../../sdk/go/examples/schedules/main.go)。示例创建暂停的每秒计划，恢复后让自动 Worker 返回对象输入快照，查询两次完成，再暂停并排空。计划本身有十秒结束边界，任务与历史保留；重复运行生成独立身份，不调用外部业务系统。 + +```text +schedule=<计划ID> occurrence=<触发ID> task=<任务ID> version=1 state=SUCCEEDED +schedule=<计划ID> occurrence=<触发ID> task=<任务ID> version=1 state=SUCCEEDED +paused=true completed_tasks=2 current_version=1 +worker_drained=true running=0 +``` + +调度或查询有延迟时可能观察到更多已产生的任务。异常时非零退出，Worker 尝试有界收尾；暂停不回滚已产生任务。接入函数可直接用以下片段发布 Cron 版本： + +```go +current, err := client.GetSchedule(ctx, scheduleID) +if err != nil { return err } +definition := current.Current.Definition +definition.Rule.Kind = "CRON" +definition.Rule.Cron = "0 9 * * MON-FRI" +definition.Rule.IntervalMS = 0 +definition.Rule.Timezone = "Asia/Shanghai" +updated, err := client.PublishSchedule(ctx, scheduleID, operationKey, orbit.PublishScheduleRequest{ + ExpectedRevision: current.Revision, + Reason: "use weekday snapshot cadence", + Definition: definition, +}) +if err != nil { return err } +fmt.Println(updated.Schedule.CurrentVersion) +``` + +保留原 calendar_version，并核对 start_at/end_at 是否仍覆盖期望时间。发布时不会取消旧版本已创建任务。 + +## 7. 错误与升级 + +错误信封同 [任务接口](tasks.md)。400 表示字段、时间、时区快照、游标或队列变更非法；401 表示凭据/应用/命名空间不可用；403 表示缺少动作或列表/创建队列范围；404 隐藏不存在或单资源越权；409 表示名称、状态、版本或幂等内容冲突；503 时写操作可能已经提交，应保留原身份核对。 + +迁移 000006 增加绑定队列、历史处理版本、扫描时间、窗口与容差，以及调度/任务来源索引。此前只有结构、没有创建计划接口；原人工行的 queue_id/check_at 为 NULL，不自动启用。迁移不会猜测任务模板对应的授权队列；此类行需由管理员核查后通过正式接口建立受控计划。 + +服务仍只依赖 MySQL，不需要外部 Cron、消息队列或协调服务。生产跨主机、数据库切换、在线迁移、海量积压与公平性测试尚待 P6；当前计划能力不代表完整生产验收已通过。 diff --git a/docs/examples/README.md b/docs/examples/README.md index 7ad5e1f..3d795d4 100644 --- a/docs/examples/README.md +++ b/docs/examples/README.md @@ -54,12 +54,21 @@ - 异常：次数/时限耗尽停止重试；未知效果默认转核查。`Retryable=true` 需要明确的安全依据，不能用于普通网络超时。 - 清理：示例不调用外部业务系统，每次创建独立任务并保留历史；失败时非零退出并有界收尾。 +## 已可运行：周期对象快照 + +- 源码：[调度示例](../../sdk/go/examples/schedules/main.go)，[初始化、调用与输出](../api/schedules.md#6-sdk-与完整示例)。 +- 前置：当前迁移、服务，显式 --schedule-access 与 --worker-access 的专用开发凭据。 +- 步骤：创建暂停的有限每秒计划 → 恢复 → 自动 Worker 返回输入快照 → 查到至少两次任务成功 → 暂停并排空。 +- 预期：不同 occurrence/task 身份、相同计划版本、paused=true、running=0；精确整数保留。 +- 异常：串行前项未知时不新建后续任务；恢复按版本与漏跑策略处理，超过窗口记录跳过。暂停不撤销已生成任务。 +- 清理：计划最终暂停，自带十秒结束边界；失败非零退出，历史保留，无外部业务副作用。 + ## 计划场景与验收标准 | 场景 | 输入与步骤 | 预期结果 | 必测异常 | 状态 | | --- | --- | --- | --- | --- | | 文件转换 | 对象引用 → 提交任务 → Worker 转换 → 结果引用 | 同一操作获得一次业务结果，历史可查 | 重复提交、Worker 在结果上报前中断 | 受理与执行框架已实现，实际转换示例待补齐 | -| 定期同步 | 发布计划 → 周期触发 → 暂停 → 恢复 | 触发身份唯一，漏跑策略可追溯 | 多节点竞争、停机后补跑上限 | P3 待开发 | +| 定期同步 | 发布计划 → 周期触发 → 暂停 → 恢复 | 触发身份唯一，漏跑策略可追溯 | 多节点竞争、停机后补跑上限 | P3 通用快照示例已完成，业务同步由接入方处理器实现 | | 并行生成 | 输入对象 → 并行计算两份结果 → 汇合 | 两支满足条件后只创建一份后继工作 | 一支失败、重复结果、汇合竞争 | P4 待开发 | | 等待审核 | 校验 → 等待信号 → 发布结果 | 只接受授权、匹配当前操作的信号 | 早到、重复、过期与越权信号 | P4 待开发 | | 外部作业查询 | 提交一次 → 间隔查询 → 最终结果 | 处理中消耗轮次，请求失败消耗尝试 | 回执与查询竞争、预算耗尽、响应未知 | P5 待开发 | diff --git a/docs/reports/phase-3-schedules.md b/docs/reports/phase-3-schedules.md new file mode 100644 index 0000000..a732de0 --- /dev/null +++ b/docs/reports/phase-3-schedules.md @@ -0,0 +1,96 @@ +# P3 计划调度阶段记录 + +验证日期：2026-09-17。已交付计划管理与持久化调度闭环，P3 仍有运行中取消、配额/背压、可靠订阅待完成；本报告不替代全平台生产验收。 + +## 1. 已实现行为 + +- 五段 Cron 与 fixed-rate；显式时区、开始和结束边界，固定间隔保持基准，不按任务完成时间漂移。 +- 时区快照随定义冻结，服务从内置数据加载，不依赖宿主机或 ZONEINFO；兼容已有快照是后续升级约束。 +- 创建、队列分页、详情、完整版本发布、历史版本、暂停/恢复、触发历史。每个命令有当前权限校验、幂等回执与管理审计。 +- SKIP / COALESCE / CATCH_UP 漏跑策略与 PARALLEL / SERIAL / SKIP 重叠策略；明确补偿窗口、延迟容差、批量和扫描间隔。 +- 发布新版本保留旧生效边界前的积压；跳过和合并范围不越过版本边界。已产生任务保留当时模板。 +- 多节点用数据库锁与唯一触发身份竞争；触发决定、对应任务、事件及进度一起提交。 +- 实际 orbit 命令持续扫描，独立 SDK 与 [完整周期快照示例](../../sdk/go/examples/schedules/main.go) 同步交付。 +- 迁移 000006 增加运行字段与索引，实体仍为 32 个；新模型字段及 SQL COMMENT 均为中文；源码核对 32 个持久化模型、253 个直接声明的持久化字段均有中文说明。 + +完整字段、权限、状态与示例见 [接口手册](../api/schedules.md)。 + +## 2. 环境、命令及结果 + +macOS 本机，Go 1.27.1，Docker 单实例 MySQL 8.4.10。临时随机凭据、回环随机端口，运行结束清理容器；不使用业务数据库。 + +```sh +make fmt +make test vet build +make integration +cd sdk/go +GOWORK=off go test -race ./... +GOWORK=off go vet ./... +``` + +上述检查均已通过。未配置集成环境时，普通 go test 会跳过真实数据库/进程用例；实际证据来自 make integration。 + +最终完整集成输出： + +| 测试组 | 本次结果 | +| --- | --- | +| MySQL 全部集成 | PASS，44.712 秒 | +| 计划事务与管理子集 | PASS，31.62 秒 | +| SDK Worker 连接/运行器及安全重试 | PASS，62.912 秒 | +| SDK 计划生命周期 | PASS，4.43 秒，含包启动/竞态开销 5.675 秒 | +| 真实进程故障组 | PASS，21.487 秒 | +| 新增调度进程强杀恢复 | PASS，10.23 秒 | +| 七个可运行示例 | health / tasks / worker-protocol / worker / history / retry / schedules 全部通过 | + +时间为一次测试运行耗时，不能用作吞吐、延迟或容量指标。 + +## 3. 时钟与规则证据 + +[规则测试](../../pulse/schedule/rule_test.go) 验证：五段/分钟边界、亚洲时区、纽约缺失/重复小时、Lord Howe 半小时夏令时变更、Apia 整天跳过、2096→2104 世纪闰日、月日/星期 OR、固定间隔微秒和跨 292 年计算、结束排除边界、规则副本隔离及无解日期拒绝。 + +[时区测试](../../internal/timezone/zone_test.go) 核对内置快照完整 SHA-256、禁用外部 ZONEINFO 后仍能加载、精确名称及缓存，以及未知快照拒绝。快照来自 Go 1.27.1，附 Go 许可。Cron 库版本固定为 v3.0.1，只用于解析和 UTC 日历计算，运行不依赖外部调度服务；SDK 未新增该依赖。 + +[有限决策测试](../../pulse/schedule/planner_test.go) 覆盖补偿窗口截断、跳过、合并、有限逐点补跑、串行阻塞、重叠跳过、未来点不处理，以及合并不越过版本生效边界。计算器不自行读取系统当前时间，执行使用资源锁定后的数据库时间。 + +## 4. 实际数据库与 SDK 证据 + +[数据库用例](../../internal/storage/mysql/schedule_integration_test.go)： + +- 两个不同节点身份并发扫描同一到期计划，只创建本批三个唯一任务；再次扫描不能绕过持久化冷却时间。 +- 禁用命名空间后，即使计划已到期也不再产生任务。 +- 创建原键重报、同键不同内容冲突、暂停禁止触发、恢复原回执、跨命名空间/队列范围拒绝。 +- 暂停期间发布新模板，旧积压仍用旧版本；历史版本不可被新模板覆盖，旧点处理后游标推进到新版本。 +- 连续发布三个有限版本：第二版本尚待初始化时再次发布，仍保存其积压；空历史版本之后的末版全部处理完时，不重新扫描已完成触发点。新增用例先复现了漏掉中间版本和重复写入冲突，再验证修复。 +- 超过时间窗口的跳过范围、漏跑合并范围与任务关联实际落库，范围结束边界大于起点。 +- SERIAL 在待执行任务存在时等待；明确取消前项后继续；前项进入 UNKNOWN / NEEDS_REVIEW 后再次停止推进。 +- 通过测试触发器让 occurrence 写入失败，任务、触发记录及游标整体回滚；故障解除后正常提交。 +- 触发游标分页无重复，不能跨计划复用游标；任务模板中的大整数文本保留。 + +上述用例以真实时间等待形成积压，不把原触发时间改到计划创建前。少量用例将受控行 check_at 设为当前时间，以加速核对连续历史版本或阻塞状态；冷却限制另有未改写 check_at 的竞争测试。 + +[SDK 用例](../../sdk/go/schedule_integration_test.go) 连接实际服务，通过独立 SDK 创建暂停计划、幂等核对、恢复、自动 Worker 成功、暂停、发布 Cron 新版本、读取两个版本、原发布回执重报、列表及暂停期间不新增触发。业务结果中的 `9007199254740993` 保持精确。 + +## 5. 实际进程强杀恢复 + +新增 [TestIntegrationWorkerProcessScheduleRecovery](../../sdk/go/worker_process_integration_test.go) 使用构建后的 orbit 可执行文件和临时 MySQL： + +1. 节点 A 创建一个每秒触发、共八个原触发点的有限计划，CATCH_UP / PARALLEL，每批上限二。 +2. 观察到首个触发已经落库后，向 A 发送真实强杀并 Wait 确认退出。 +3. 保留三秒无 Orbit 服务的间隙形成漏跑，不修改数据库时钟或计划游标。 +4. 启动身份不同的 B、C 两个真实服务进程，从持久化进度竞争接续。 +5. 查询至计划结束，严格核对恰好八条 FIRED、八个不同 TaskID、原 scheduled_at 序列及相同版本；每条都有完整 WAITING 任务与原模板。 + +这证明了本地单 MySQL 下服务进程消失后的持久化接续与多进程触发去重。本用例不启动业务 Worker，不宣称验证外部副作用 exactly-once。原开始/完成 ACK 丢失后强杀接管、Worker 进程中断转核查等 P2 用例也同步通过。 + +## 6. 可运行场景与当前边界 + +周期快照示例输出两条不同的 occurrence/task 身份，均完成 SUCCEEDED，随后 `paused=true completed_tasks=2 current_version=1`、`worker_drained=true running=0`。示例不访问外部业务资源；计划有十秒结束边界，正常完成后暂停，历史保留。 + +仍需后续验证或开发： + +- 运行中任务取消、细粒度限流与队列配额、可靠结果订阅；流程引擎及人工核查控制。 +- 调度期间数据库故障切换、提交 ACK 丢失的专门故障矩阵、跨主机网络分区、备份恢复和混合版本升级。 +- 大表在线 DDL、历史人工计划行核查；000006 不自动启用旧的未绑定队列行。新建数据库与既有 v4 数据升级到当前结构的通用测试通过，但这不是旧人工计划内容的完整迁移验收。 +- 大规模公平性、行锁竞争、重试/补跑风暴、历史保留与清理、租户配额。当前批量、扫描间隔和参数复制限制只建立有界基线，没有百万租户容量结论。 + +后续继续 [持续计划](../08-development-plan.md)，不将本阶段闭环标为整个 P3 或最终目标完成。 diff --git a/docs/sdk/README.md b/docs/sdk/README.md index a45c950..054e7c7 100644 --- a/docs/sdk/README.md +++ b/docs/sdk/README.md @@ -1,6 +1,6 @@ # Go SDK 接入说明 -已实现健康查询、任务提交/查询/分页/待执行取消、队列创建/查询、[自动 Worker](worker-runtime.md)、[Worker 底层协议 SDK](worker.md) 和 [执行历史查询](../api/execution-history.md)。[安全重试](../api/retries.md) 已提供有限策略、WorkerFailure.Retryable、历史查询及完整例子。流程构建等后续接口按 [开发计划](../08-development-plan.md) 继续实现。 +已实现健康查询、任务提交/查询/分页/待执行取消、队列创建/查询、[自动 Worker](worker-runtime.md)、[Worker 底层协议 SDK](worker.md) 和 [执行历史查询](../api/execution-history.md)。[安全重试](../api/retries.md) 已提供有限策略、WorkerFailure.Retryable、历史查询及完整例子。[计划调度](../api/schedules.md) 已支持创建、查询、版本发布、暂停/恢复、触发历史与完整示例。流程构建等后续接口按 [开发计划](../08-development-plan.md) 继续实现。 module：`git.yuntuo.hk/k2safe/orbit/sdk/go`。SDK 使用独立 go.mod，依赖 Go 标准库与 `github.com/coder/websocket v1.8.15`，不引用服务端模型或数据库实现。 @@ -105,6 +105,9 @@ fmt.Println(cancelled.Task.State) | 方法 | 请求 / 返回 | 文档 | | --- | --- | --- | +| CreateSchedule / GetSchedule / ListSchedules | 计划受理、详情与队列分页 | [计划](../api/schedules.md) | +| PublishSchedule / GetScheduleVersion | 不可变发布与历史版本 | [计划](../api/schedules.md) | +| PauseSchedule / ResumeSchedule / ListScheduleOccurrences | 控制与触发记录 | [计划](../api/schedules.md) | | Liveness / Readiness | Health | [健康](../api/health.md) | | SubmitTask | SubmitTaskRequest / SubmitTaskResult | [任务](../api/tasks.md) | | GetTask | taskID / Task | [任务](../api/tasks.md) | @@ -117,7 +120,7 @@ fmt.Println(cancelled.Task.State) | ListAttemptEvidence | taskID、attemptID、HistoryPageRequest / AttemptEvidencePage | [执行历史](../api/execution-history.md) | | GetAttemptEvidence | taskID、attemptID、evidenceID / AttemptEvidence | [执行历史](../api/execution-history.md) | -所有方法第一个参数为 context.Context，返回值之外都返回 error。命令方法要求调用方提供稳定 key，不自动生成或重试。ListTasksRequest 接受 QueueID、State、Limit、Cursor。 +所有方法第一个参数为 context.Context，返回值之外都返回 error。计划方法的具体参数见对应手册。命令方法要求调用方提供稳定 key，不自动生成或重试。ListTasksRequest 接受 QueueID、State、Limit、Cursor。 Options.HTTPClient 可注入专用 HTTP 客户端。SDK 复制配置，不修改调用方实例；默认超时 10 秒，可用 context 缩短。禁止自动跟随重定向，避免凭据被转交其他地址。生产配置 HTTPS；SDK 不承担部署 TLS 终止。 @@ -176,4 +179,4 @@ task=<任务ID> state=SUCCEEDED attempts=1 evidence=1 reason=RESULT_CONFLICT dis ## 7. 后续交付 -P2 已提供底层协议、[自动 Worker 运行器及示例](worker-runtime.md) 与历史查询，并通过 [Schema 及进程故障阶段验收](../reports/phase-2.md)；P3 已实现 [安全重试与示例](../api/retries.md)，计划和结果订阅继续开发；P4–P5 提供流程构建发布、信号、等待、轮询与人工恢复。每项随实现同步交付可运行示例及异常回归。 +P2 已提供底层协议、[自动 Worker 运行器及示例](worker-runtime.md) 与历史查询，并通过 [Schema 及进程故障阶段验收](../reports/phase-2.md)；P3 已实现 [安全重试与示例](../api/retries.md) 和 [计划调度与示例](../api/schedules.md)，运行中取消、资源配额和结果订阅继续开发；P4–P5 提供流程构建发布、信号、等待、轮询与人工恢复。每项随实现同步交付可运行示例及异常回归。 diff --git a/go.mod b/go.mod index 401a109..d172120 100644 --- a/go.mod +++ b/go.mod @@ -5,6 +5,7 @@ go 1.27.1 require ( github.com/coder/websocket v1.8.15 github.com/go-sql-driver/mysql v1.10.1 + github.com/robfig/cron/v3 v3.0.1 github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 ) diff --git a/go.sum b/go.sum index f59ce3a..dec3d63 100644 --- a/go.sum +++ b/go.sum @@ -6,6 +6,8 @@ github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxK github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8= github.com/go-sql-driver/mysql v1.10.1 h1:arlSnNLq6a5yxGxV7qg9lF4j0C+KwD6NbQyKr9QL6ME= github.com/go-sql-driver/mysql v1.10.1/go.mod h1:M+cqaI7+xxXGG9swrdeUIoPG3Y3KCkF0pZej+SK+nWk= +github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs= +github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro= github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ= github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU= golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ= diff --git a/internal/storage/mysql/bootstrap.go b/internal/storage/mysql/bootstrap.go index 899b5c5..47bc132 100644 --- a/internal/storage/mysql/bootstrap.go +++ b/internal/storage/mysql/bootstrap.go @@ -14,11 +14,12 @@ import ( // BootstrapInput 仅供持有数据库管理权限的初始化命令使用，不暴露为公共 HTTP。 type BootstrapInput struct { - Application string // Application 应用名称，每次初始化创建独立应用。 - Namespace string // Namespace 命名空间名称。 - Environment string // Environment 环境名称，必须显式指定。 - Queue string // Queue 初始队列名称。 - WorkerAccess bool // WorkerAccess 显式增加开发用 Worker 接入及消费权限。 + Application string // Application 应用名称，每次初始化创建独立应用。 + Namespace string // Namespace 命名空间名称。 + Environment string // Environment 环境名称，必须显式指定。 + Queue string // Queue 初始队列名称。 + WorkerAccess bool // WorkerAccess 显式增加开发用 Worker 接入及消费权限。 + ScheduleAccess bool // ScheduleAccess 显式增加开发用计划查询及管理权限。 } // BootstrapResult 包含一次性交付的原始凭据，禁止记录到日志或提交到版本库。 @@ -60,6 +61,9 @@ func Bootstrap(ctx context.Context, db *sql.DB, in BootstrapInput, deliver func( if in.WorkerAccess { permissions.Actions = append(permissions.Actions, "workers:connect", "workers:consume") } + if in.ScheduleAccess { + permissions.Actions = append(permissions.Actions, "schedules:read", "schedules:manage") + } raw, err := json.Marshal(permissions) if err != nil { return err diff --git a/internal/storage/mysql/migrations/000006_schedule_runtime.up.sql b/internal/storage/mysql/migrations/000006_schedule_runtime.up.sql new file mode 100644 index 0000000..69665b4 --- /dev/null +++ b/internal/storage/mysql/migrations/000006_schedule_runtime.up.sql @@ -0,0 +1,18 @@ +-- 旧版本只定义了结构，没有公开创建计划的入口。未绑定队列的历史行不启用扫描。 +ALTER TABLE pulse_schedules + ADD COLUMN queue_id BINARY(16) NULL COMMENT '计划终身绑定队列；旧结构人工行为空，不允许执行', + ADD COLUMN processing_version BIGINT UNSIGNED NOT NULL DEFAULT 1 COMMENT '当前处理积压的不可变版本，不因发布新版本丢弃旧进度', + ADD COLUMN check_at DATETIME(6) NULL COMMENT '下一可扫描时间，UTC；补跑批次之间持久化至少一秒间隔，为空表示没有扫描工作', + ADD CONSTRAINT ck_schedule_cursor CHECK (processing_version>0 AND processing_version<=current_version), + ADD CONSTRAINT ck_schedule_enabled_scan CHECK (queue_id IS NOT NULL OR check_at IS NULL), + ADD CONSTRAINT fk_schedule_queue FOREIGN KEY(namespace_id,queue_id) REFERENCES pulse_queues(namespace_id,id) ON DELETE RESTRICT ON UPDATE RESTRICT, + ADD KEY ix_schedule_scan(paused,check_at,namespace_id,id), + ADD KEY ix_schedule_list(namespace_id,queue_id,created_at,id); +ALTER TABLE pulse_schedule_versions + ADD COLUMN catchup_window_ms BIGINT UNSIGNED NOT NULL DEFAULT 86400000 COMMENT '未处理触发点最大保留时长，单位毫秒，过旧范围记录跳过', + ADD COLUMN grace_ms BIGINT UNSIGNED NOT NULL DEFAULT 5000 COMMENT '正常派发允许延迟的毫秒数，超过后按漏跑策略处理', + ADD CONSTRAINT ck_schedule_window CHECK(catchup_window_ms BETWEEN 1000 AND 2592000000 AND grace_ms BETWEEN 1000 AND 60000 AND grace_ms<=catchup_window_ms); +ALTER TABLE pulse_schedule_occurrences + MODIFY COLUMN covered_until DATETIME(6) NULL COMMENT '合并或跳过范围的排除边界，范围为原计划时间至该边界，不包含边界', + ADD CONSTRAINT ck_occurrence_range CHECK(covered_until IS NULL OR covered_until>scheduled_at); +ALTER TABLE pulse_tasks ADD KEY ix_task_owner_state(namespace_id,owner_kind,owner_id,state,id); diff --git a/internal/storage/mysql/schedule_history.go b/internal/storage/mysql/schedule_history.go new file mode 100644 index 0000000..d2366de --- /dev/null +++ b/internal/storage/mysql/schedule_history.go @@ -0,0 +1,139 @@ +package mysql + +import ( + "bytes" + "context" + "database/sql" + "encoding/base64" + "encoding/json" + "time" + + "git.yuntuo.hk/k2safe/orbit/internal/fault" + "git.yuntuo.hk/k2safe/orbit/internal/jsonvalue" + core "git.yuntuo.hk/k2safe/orbit/model" + "git.yuntuo.hk/k2safe/orbit/platform/auth" + "git.yuntuo.hk/k2safe/orbit/pulse/schedule" +) + +type scheduleCursor struct { + Version int `json:"v"` + Kind string `json:"k"` + Namespace core.ID `json:"n"` + Parent core.ID `json:"p"` + At time.Time `json:"t"` + ID core.ID `json:"i"` +} + +func parseScheduleCursor(raw string, ns, parent core.ID, kind string) (scheduleCursor, error) { + var c scheduleCursor + b, err := base64.RawURLEncoding.Strict().DecodeString(raw) + if err != nil || len(b) > 768 { + return c, fault.Invalid("invalid schedule cursor") + } + if _, err := jsonvalue.Canonical(b); err != nil { + return c, fault.Invalid("invalid schedule cursor") + } + var fields map[string]json.RawMessage + if json.Unmarshal(b, &fields) != nil || len(fields) != 6 { + return c, fault.Invalid("invalid schedule cursor") + } + for _, key := range []string{"v", "k", "n", "p", "t", "i"} { + if _, ok := fields[key]; !ok { + return c, fault.Invalid("invalid schedule cursor") + } + } + d := json.NewDecoder(bytes.NewReader(b)) + d.DisallowUnknownFields() + if d.Decode(&c) != nil || c.Version != 1 || c.Namespace != ns || c.Parent != parent || c.Kind != kind || c.ID.Validate() != nil || c.At.Year() < 2000 || c.At.Year() > 9998 || c.At.Nanosecond()%1000 != 0 { + return c, fault.Invalid("cursor does not match schedule query") + } + return c, nil +} +func makeScheduleCursor(ns, parent core.ID, kind string, at time.Time, id core.ID) (string, error) { + b, err := json.Marshal(scheduleCursor{1, kind, ns, parent, at, id}) + return base64.RawURLEncoding.EncodeToString(b), err +} +func (s *ScheduleStore) List(ctx context.Context, t auth.Token, queue core.ID, in schedule.PageInput) (schedule.Page, error) { + out := schedule.Page{Items: []schedule.Summary{}} + err := s.transaction(ctx, t, "schedules:read", func(tx *sql.Tx, p auth.Permissions) error { + if !p.AllowsQueue(queue) { + return fault.Forbidden + } + q := `SELECT ` + scheduleColumns + ` FROM pulse_schedules WHERE namespace_id=? AND queue_id=?` + args := []any{t.NamespaceID, queue} + if in.Cursor != "" { + c, err := parseScheduleCursor(in.Cursor, t.NamespaceID, queue, "schedules") + if err != nil { + return err + } + q += ` AND (created_at in.Limit { + out.Items = out.Items[:in.Limit] + last := out.Items[len(out.Items)-1] + out.NextCursor, err = makeScheduleCursor(t.NamespaceID, queue, "schedules", last.CreatedAt, last.ID) + } + return err + }) + return out, err +} +func (s *ScheduleStore) Occurrences(ctx context.Context, t auth.Token, id core.ID, in schedule.PageInput) (schedule.OccurrencePage, error) { + out := schedule.OccurrencePage{Items: []schedule.OccurrenceView{}} + err := s.transaction(ctx, t, "schedules:read", func(tx *sql.Tx, p auth.Permissions) error { + if _, err := authorizeSchedule(ctx, tx, t.NamespaceID, id, p); err != nil { + return err + } + q := `SELECT id,schedule_id,schedule_version,scheduled_at,decision,task_id,covered_until,COALESCE(reason,''),created_at FROM pulse_schedule_occurrences WHERE namespace_id=? AND schedule_id=?` + args := []any{t.NamespaceID, id} + if in.Cursor != "" { + c, err := parseScheduleCursor(in.Cursor, t.NamespaceID, id, "occurrences") + if err != nil { + return err + } + q += ` AND (scheduled_at in.Limit { + out.Items = out.Items[:in.Limit] + last := out.Items[len(out.Items)-1] + out.NextCursor, err = makeScheduleCursor(t.NamespaceID, id, "occurrences", last.ScheduledAt, last.ID) + } + return err + }) + return out, err +} diff --git a/internal/storage/mysql/schedule_integration_test.go b/internal/storage/mysql/schedule_integration_test.go new file mode 100644 index 0000000..5ac1948 --- /dev/null +++ b/internal/storage/mysql/schedule_integration_test.go @@ -0,0 +1,400 @@ +package mysql + +import ( + "context" + "encoding/json" + "os" + "sync" + "testing" + "time" + + core "git.yuntuo.hk/k2safe/orbit/model" + "git.yuntuo.hk/k2safe/orbit/platform/auth" + "git.yuntuo.hk/k2safe/orbit/pulse/schedule" + "git.yuntuo.hk/k2safe/orbit/pulse/service" +) + +type scheduleFixture struct { + *executionFixture + store *ScheduleStore + api *schedule.Service +} + +func newScheduleFixture(t *testing.T, f *executionFixture) *scheduleFixture { + t.Helper() + raw, _ := json.Marshal(auth.Permissions{Actions: []string{"tasks:submit", "tasks:read", "tasks:cancel", "queues:read", "schedules:read", "schedules:manage", "workers:connect", "workers:consume"}, Queues: []string{"*"}}) + f.exec(`UPDATE orbit_credentials SET permissions=? WHERE namespace_id=? AND id=?`, string(raw), f.resources.NamespaceID, f.resources.CredentialID) + store, err := NewScheduleStore(f.db, executionID(t)) + if err != nil { + t.Fatal(err) + } + return &scheduleFixture{f, store, schedule.New(store)} +} +func (f *scheduleFixture) definition() schedule.Definition { + return schedule.Definition{Rule: schedule.Rule{Kind: "FIXED_RATE", Timezone: "UTC", StartAt: time.Now().UTC().Truncate(time.Microsecond).Add(-time.Hour), IntervalMS: 1000}, Policy: schedule.Policy{Misfire: "CATCH_UP", Overlap: "PARALLEL", CatchupLimit: 3, CatchupWindowMS: 30000, GraceMS: 1000}, Task: service.SubmitInput{QueueID: f.resources.QueueID, Handler: "object.prepare", HandlerVersion: "v1", PayloadVersion: "v1", Payload: json.RawMessage(`{"number":9007199254740993}`)}} +} +func (f *scheduleFixture) create(in schedule.Definition) schedule.View { + f.t.Helper() + out, err := f.api.Create(f.ctx, f.token, string(executionID(f.t)), schedule.CreateInput{Name: "plan-" + string(executionID(f.t)), Definition: in}) + if err != nil { + f.t.Fatal(err) + } + return out.Schedule +} +func (f *scheduleFixture) current(id core.ID) schedule.View { + f.t.Helper() + out, err := f.api.Get(f.ctx, f.token, id) + if err != nil { + f.t.Fatal(err) + } + return out +} +func (f *scheduleFixture) occurrences(id core.ID) []schedule.OccurrenceView { + f.t.Helper() + out, err := f.api.Occurrences(f.ctx, f.token, id, schedule.PageInput{Limit: 100}) + if err != nil { + f.t.Fatal(err) + } + return out.Items +} + +// 等待真实时间形成积压，不将游标改到计划实际生效之前。 +func (f *scheduleFixture) due(v schedule.View, age time.Duration) { + f.t.Helper() + if delay := time.Until(v.NextFireAt.Add(age)); delay > 0 { + timer := time.NewTimer(delay) + defer timer.Stop() + select { + case <-timer.C: + case <-f.ctx.Done(): + f.t.Fatal(f.ctx.Err()) + } + } + f.exec(`UPDATE pulse_schedules SET check_at=UTC_TIMESTAMP(6) WHERE namespace_id=? AND id=?`, f.resources.NamespaceID, v.ID) +} +func (f *scheduleFixture) tick() ScheduleStats { + f.t.Helper() + out, err := f.store.Tick(f.ctx, 100) + if err != nil { + f.t.Fatal(err) + } + return out +} +func TestIntegrationSchedules(t *testing.T) { + dsn := os.Getenv("ORBIT_TEST_MYSQL_DSN") + if dsn == "" { + t.Skip("requires disposable MySQL") + } + ctx, cancel := context.WithTimeout(context.Background(), 90*time.Second) + defer cancel() + db, err := Open(ctx, dsn, 32, 8) + if err != nil { + t.Fatal(err) + } + defer db.Close() + if err := Migrate(ctx, db); err != nil { + t.Fatal(err) + } + fixture := func(t *testing.T) *scheduleFixture { return newScheduleFixture(t, newExecutionFixture(t, ctx, db)) } + // 连续发布经过“下一版本尚待初始化”和空版本时，不能丢失积压或重新开始已结束版本。 + for _, emptyMiddle := range []bool{false, true} { + name := "publish_preserves_uninitialized_version" + if emptyMiddle { + name = "empty_version_then_finished_latest_stays_finished" + } + t.Run(name, func(t *testing.T) { + f := fixture(t) + finite := func(delay time.Duration) schedule.Definition { + in := f.definition() + in.Rule.StartAt = time.Now().UTC().Truncate(time.Microsecond).Add(delay) + end := in.Rule.StartAt.Add(time.Millisecond) + in.Rule.EndAt = &end + return in + } + publish := func(id core.ID, in schedule.Definition) schedule.View { + t.Helper() + current := f.current(id) + out, err := f.api.Publish(ctx, f.token, id, string(executionID(t)), schedule.PublishInput{ExpectedRevision: current.Revision, Reason: "version boundary regression", Definition: in}) + if err != nil { + t.Fatal(err) + } + return out.Schedule + } + waitUntil := func(at time.Time) { + t.Helper() + timer := time.NewTimer(time.Until(at.Add(10 * time.Millisecond))) + defer timer.Stop() + select { + case <-timer.C: + case <-ctx.Done(): + t.Fatal(ctx.Err()) + } + } + v := f.create(finite(300 * time.Millisecond)) + waitUntil(*v.NextFireAt) + delay := 300 * time.Millisecond + if emptyMiddle { + delay = 30 * time.Second + } + middle := finite(delay) + publish(v.ID, middle) + var latest schedule.Definition + if emptyMiddle { + latest = finite(300 * time.Millisecond) + publish(v.ID, latest) + } + f.tick() // 第一版本结束，第二版本尚未计算第一个触发点。 + pending := f.current(v.ID) + if pending.ProcessingVersion != 2 || pending.NextFireAt != nil || pending.CheckAt == nil { + t.Fatal("expected pending initialization of version 2") + } + if !emptyMiddle { + waitUntil(middle.Rule.StartAt) + latest = finite(300 * time.Millisecond) + published := publish(v.ID, latest) + if published.ProcessingVersion != 2 { + t.Fatal("publishing discarded an uninitialized version") + } + } + waitUntil(latest.Rule.StartAt) + for i := 0; i < 3 && f.current(v.ID).CheckAt != nil; i++ { + f.exec(`UPDATE pulse_schedules SET check_at=UTC_TIMESTAMP(6) WHERE namespace_id=? AND id=?`, f.resources.NamespaceID, v.ID) + f.tick() + } + finished := f.current(v.ID) + if finished.ProcessingVersion != 3 || finished.CheckAt != nil || finished.NextFireAt != nil { + t.Fatal("finished latest version retained scan work") + } + got := f.occurrences(v.ID) + want := map[uint64]time.Time{1: *v.NextFireAt, 3: latest.Rule.StartAt} + if !emptyMiddle { + want[2] = middle.Rule.StartAt + } + if len(got) != len(want) { + t.Fatalf("got %d occurrences, want %d", len(got), len(want)) + } + for _, o := range got { + at, ok := want[o.ScheduleVersion] + if !ok || !o.ScheduledAt.Equal(at) || o.Decision != "FIRED" || o.TaskID == nil { + t.Fatal("version occurrence lost or duplicated") + } + delete(want, o.ScheduleVersion) + } + f.tick() + if f.current(v.ID).Revision != finished.Revision { + t.Fatal("finished schedule advanced again") + } + }) + } + t.Run("multi_node_atomic_trigger_and_rate", func(t *testing.T) { + f := fixture(t) + v := f.create(f.definition()) + f.due(v, 5*time.Second) + other, err := NewScheduleStore(db, executionID(t)) + if err != nil { + t.Fatal(err) + } + var wg sync.WaitGroup + failures := make(chan error, 2) + for _, s := range []*ScheduleStore{f.store, other} { + wg.Add(1) + go func(s *ScheduleStore) { defer wg.Done(); _, err := s.Tick(ctx, 100); failures <- err }(s) + } + wg.Wait() + close(failures) + for err := range failures { + if err != nil { + t.Fatal(err) + } + } + got := f.occurrences(v.ID) + if len(got) != 3 || f.count("pulse_tasks", "owner_kind='schedule' AND owner_id=?", v.ID) != 3 { + t.Fatal("duplicate or partial trigger") + } + current := f.current(v.ID) + if current.CheckAt == nil || !current.CheckAt.After(current.UpdatedAt) { + t.Fatal("catchup rate not durable") + } + f.tick() + if len(f.occurrences(v.ID)) != 3 { + t.Fatal("repeat scan bypassed cooldown") + } + for _, o := range got { + if o.TaskID == nil || o.ScheduleVersion != 1 { + t.Fatal("missing ownership") + } + task := f.get(*o.TaskID) + if string(task.Payload) != `{"number":9007199254740993}` || task.AttemptCount != 0 { + t.Fatal("template snapshot damaged") + } + } + f.exec(`UPDATE orbit_namespaces SET enabled=FALSE WHERE id=?`, f.resources.NamespaceID) + f.exec(`UPDATE pulse_schedules SET check_at=UTC_TIMESTAMP(6) WHERE namespace_id=? AND id=?`, f.resources.NamespaceID, v.ID) + f.tick() + if f.count("pulse_tasks", "owner_kind='schedule' AND owner_id=?", v.ID) != 3 { + t.Fatal("disabled namespace generated tasks") + } + f.exec(`UPDATE orbit_namespaces SET enabled=TRUE WHERE id=?`, f.resources.NamespaceID) + }) + t.Run("idempotency_pause_scope_and_version", func(t *testing.T) { + f := fixture(t) + in := schedule.CreateInput{Name: "stable", Definition: f.definition(), Paused: true} + key := string(executionID(t)) + out, err := f.api.Create(ctx, f.token, key, in) + if err != nil { + t.Fatal(err) + } + again, err := f.api.Create(ctx, f.token, key, in) + if err != nil || !again.Deduplicated || again.Schedule.ID != out.Schedule.ID { + t.Fatal("creation replay") + } + in.Paused = false + _, err = f.api.Create(ctx, f.token, key, in) + expectWorkerCode(t, err, "IDEMPOTENCY_CONFLICT") + v := out.Schedule + f.due(v, 4*time.Second) + f.tick() + if len(f.occurrences(v.ID)) != 0 { + t.Fatal("paused schedule fired") + } + next := f.definition() + next.Task.Payload = json.RawMessage(`{"version":2}`) + published, err := f.api.Publish(ctx, f.token, v.ID, string(executionID(t)), schedule.PublishInput{ExpectedRevision: v.Revision, Reason: "new template", Definition: next}) + if err != nil { + t.Fatal(err) + } + if published.Schedule.ProcessingVersion != 1 || published.Schedule.CurrentVersion != 2 { + t.Fatal("publish erased old backlog") + } + old, err := f.api.Version(ctx, f.token, v.ID, 1) + if err != nil || string(old.Definition.Task.Payload) != `{"number":9007199254740993}` { + t.Fatal("old version changed") + } + resumeKey := string(executionID(t)) + resume := schedule.ControlInput{ExpectedRevision: published.Schedule.Revision, Reason: "resume work"} + resumed, err := f.api.Control(ctx, f.token, v.ID, resumeKey, resume, false) + if err != nil { + t.Fatal(err) + } + repeated, err := f.api.Control(ctx, f.token, v.ID, resumeKey, resume, false) + if err != nil || !repeated.Deduplicated || repeated.Schedule.Revision != resumed.Schedule.Revision { + t.Fatal("control replay") + } + f.tick() + for _, o := range f.occurrences(v.ID) { + if o.ScheduleVersion != 1 || !o.ScheduledAt.Before(published.Schedule.Current.EffectiveAt) { + t.Fatal("historical version boundary lost") + } + } + for i := 0; i < 3 && f.current(v.ID).ProcessingVersion == 1; i++ { + f.exec(`UPDATE pulse_schedules SET check_at=UTC_TIMESTAMP(6) WHERE namespace_id=? AND id=?`, f.resources.NamespaceID, v.ID) + f.tick() + } + if f.current(v.ID).ProcessingVersion != 2 { + t.Fatal("old backlog never advanced to published version") + } + for _, o := range f.occurrences(v.ID) { + if o.ScheduleVersion == 1 && !o.ScheduledAt.Before(published.Schedule.Current.EffectiveAt) { + t.Fatal("old version crossed effective boundary") + } + } + // 另一命名空间知道 ID 也不可读或管理。 + stranger := fixture(t) + _, err = stranger.api.Get(ctx, stranger.token, v.ID) + expectWorkerCode(t, err, "NOT_FOUND") + raw, _ := json.Marshal(auth.Permissions{Actions: []string{"schedules:read", "schedules:manage"}, Queues: []string{string(executionID(t))}}) + f.exec(`UPDATE orbit_credentials SET permissions=? WHERE namespace_id=? AND id=?`, string(raw), f.resources.NamespaceID, f.resources.CredentialID) + _, err = f.api.Get(ctx, f.token, v.ID) + expectWorkerCode(t, err, "NOT_FOUND") + }) + t.Run("persisted_skip_and_coalesce_ranges", func(t *testing.T) { + f := fixture(t) + in := f.definition() + in.Policy.CatchupWindowMS = 2000 + in.Policy.Misfire = "COALESCE" + coalesce := f.create(in) + in.Policy.Misfire = "SKIP" + skip := f.create(in) + f.due(coalesce, 4*time.Second) + f.tick() + for _, v := range []schedule.View{coalesce, skip} { + items := f.occurrences(v.ID) + skipped, merged := false, false + for _, o := range items { + if o.Decision == "SKIPPED" { + skipped = true + if o.TaskID != nil || o.CoveredUntil == nil || !o.CoveredUntil.After(o.ScheduledAt) { + t.Fatal("invalid skipped range") + } + } + if o.Decision == "COALESCED" { + merged = true + if o.TaskID == nil || o.CoveredUntil == nil { + t.Fatal("coalesced range lost task") + } + } + } + if !skipped || (v.ID == coalesce.ID && !merged) { + t.Fatal("misfire decisions not persisted") + } + } + }) + t.Run("overlap_serial_unknown_and_waiting_cancel", func(t *testing.T) { + f := fixture(t) + in := f.definition() + in.Policy.Overlap = "SERIAL" + v := f.create(in) + f.due(v, 5*time.Second) + f.tick() + items := f.occurrences(v.ID) + if len(items) != 1 || items[0].TaskID == nil { + t.Fatal("serial did not start one") + } + first := f.current(v.ID) + f.exec(`UPDATE pulse_schedules SET check_at=UTC_TIMESTAMP(6) WHERE namespace_id=? AND id=?`, f.resources.NamespaceID, v.ID) + f.tick() + if len(f.occurrences(v.ID)) != 1 || !f.current(v.ID).NextFireAt.Equal(*first.NextFireAt) { + t.Fatal("serial skipped waiting task") + } + task := f.get(*items[0].TaskID) + if _, err := f.tasks.CancelTask(ctx, f.token, task.ID, string(executionID(t)), service.CancelInput{ExpectedRevision: task.Revision, Reason: "cancel pending scheduled task"}); err != nil { + t.Fatal(err) + } + f.exec(`UPDATE pulse_schedules SET check_at=UTC_TIMESTAMP(6) WHERE namespace_id=? AND id=?`, f.resources.NamespaceID, v.ID) + f.tick() + if len(f.occurrences(v.ID)) != 2 { + t.Fatal("serial did not continue after terminal task") + } + retryFinish(t, f.executionFixture, retryStart(t, f.executionFixture), "UNKNOWN", false) + waiting := f.current(v.ID) + f.exec(`UPDATE pulse_schedules SET check_at=UTC_TIMESTAMP(6) WHERE namespace_id=? AND id=?`, f.resources.NamespaceID, v.ID) + f.tick() + if len(f.occurrences(v.ID)) != 2 || !f.current(v.ID).NextFireAt.Equal(*waiting.NextFireAt) { + t.Fatal("unknown outcome did not block serial schedule") + } + }) + t.Run("transaction_rollback_and_read_pagination", func(t *testing.T) { + f := fixture(t) + v := f.create(f.definition()) + f.due(v, 6*time.Second) + prior := f.current(v.ID) + f.exec(`CREATE TRIGGER orbit_test_schedule_event BEFORE INSERT ON pulse_schedule_occurrences FOR EACH ROW SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='controlled trigger failure'`) + _, err := f.store.Tick(ctx, 100) + f.exec(`DROP TRIGGER orbit_test_schedule_event`) + if err == nil || len(f.occurrences(v.ID)) != 0 || f.count("pulse_tasks", "owner_id=?", v.ID) != 0 || !f.current(v.ID).NextFireAt.Equal(*prior.NextFireAt) { + t.Fatal("partial schedule transaction") + } + f.tick() + page, err := f.api.Occurrences(ctx, f.token, v.ID, schedule.PageInput{Limit: 1}) + if err != nil || len(page.Items) != 1 || page.NextCursor == "" { + t.Fatal("missing page") + } + second, err := f.api.Occurrences(ctx, f.token, v.ID, schedule.PageInput{Limit: 1, Cursor: page.NextCursor}) + if err != nil || len(second.Items) != 1 || second.Items[0].ID == page.Items[0].ID { + t.Fatal("duplicate page") + } + another := f.create(f.definition()) + _, err = f.api.Occurrences(ctx, f.token, another.ID, schedule.PageInput{Cursor: page.NextCursor}) + expectWorkerCode(t, err, "INVALID_ARGUMENT") + }) +} diff --git a/internal/storage/mysql/schedule_store.go b/internal/storage/mysql/schedule_store.go new file mode 100644 index 0000000..c700ec8 --- /dev/null +++ b/internal/storage/mysql/schedule_store.go @@ -0,0 +1,294 @@ +package mysql + +import ( + "context" + "database/sql" + "encoding/json" + "errors" + "fmt" + "time" + + "git.yuntuo.hk/k2safe/orbit/internal/fault" + "git.yuntuo.hk/k2safe/orbit/internal/jsonwire" + core "git.yuntuo.hk/k2safe/orbit/model" + "git.yuntuo.hk/k2safe/orbit/platform/auth" + "git.yuntuo.hk/k2safe/orbit/pulse/schedule" + driver "github.com/go-sql-driver/mysql" +) + +// ScheduleStore 管理计划控制与扫描；共享任务存储的事务认证，不在事务外推进游标。 +type ScheduleStore struct { + *TaskStore + node core.ID +} + +func NewScheduleStore(db *sql.DB, node core.ID) (*ScheduleStore, error) { + if node.Validate() != nil { + return nil, errors.New("scheduler node id required") + } + return &ScheduleStore{TaskStore: NewTaskStore(db), node: node}, nil +} + +var _ schedule.Store = (*ScheduleStore)(nil) + +const scheduleColumns = `id,namespace_id,queue_id,name,revision,current_version,processing_version,paused,next_fire_at,check_at,created_at,updated_at` + +func scanSchedule(row scanner) (schedule.Summary, error) { + var v schedule.Summary + err := row.Scan(&v.ID, &v.NamespaceID, &v.QueueID, &v.Name, &v.Revision, &v.CurrentVersion, &v.ProcessingVersion, &v.Paused, &v.NextFireAt, &v.CheckAt, &v.CreatedAt, &v.UpdatedAt) + return v, err +} +func readSchedule(ctx context.Context, tx *sql.Tx, ns, id core.ID, lock bool) (schedule.Summary, error) { + q := `SELECT ` + scheduleColumns + ` FROM pulse_schedules WHERE namespace_id=? AND id=? AND queue_id IS NOT NULL` + if lock { + q += ` FOR UPDATE` + } + v, err := scanSchedule(tx.QueryRowContext(ctx, q, ns, id)) + if errors.Is(err, sql.ErrNoRows) { + err = fault.NotFound + } + return v, err +} +func readScheduleVersion(ctx context.Context, tx *sql.Tx, ns, id core.ID, version uint64) (schedule.VersionView, error) { + var v schedule.VersionView + var rule, task []byte + err := tx.QueryRowContext(ctx, `SELECT version,effective_at,specification,task_template,misfire_policy,overlap_policy,catchup_limit,catchup_window_ms,grace_ms FROM pulse_schedule_versions WHERE namespace_id=? AND schedule_id=? AND version=?`, ns, id, version).Scan(&v.Version, &v.EffectiveAt, &rule, &task, &v.Definition.Policy.Misfire, &v.Definition.Policy.Overlap, &v.Definition.Policy.CatchupLimit, &v.Definition.Policy.CatchupWindowMS, &v.Definition.Policy.GraceMS) + if errors.Is(err, sql.ErrNoRows) { + return v, fault.NotFound + } + if err != nil { + return v, err + } + if err = json.Unmarshal(rule, &v.Definition.Rule); err != nil { + return v, err + } + err = json.Unmarshal(task, &v.Definition.Task) + return v, err +} +func insertScheduleVersion(ctx context.Context, tx *sql.Tx, ns, id core.ID, v schedule.VersionView) error { + identity, err := core.NewID() + if err != nil { + return err + } + rule, err := json.Marshal(v.Definition.Rule) + if err != nil { + return err + } + task, err := jsonwire.Marshal(v.Definition.Task) + if err != nil { + return err + } + p := v.Definition.Policy + _, err = tx.ExecContext(ctx, `INSERT INTO pulse_schedule_versions(namespace_id,id,schedule_id,version,effective_at,timezone,specification,task_template,misfire_policy,overlap_policy,catchup_limit,catchup_window_ms,grace_ms) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)`, ns, identity, id, v.Version, v.EffectiveAt, v.Definition.Rule.Timezone, string(rule), string(task), p.Misfire, p.Overlap, p.CatchupLimit, p.CatchupWindowMS, p.GraceMS) + return err +} +func scheduleView(ctx context.Context, tx *sql.Tx, ns, id core.ID) (schedule.View, error) { + summary, err := readSchedule(ctx, tx, ns, id, false) + if err != nil { + return schedule.View{}, err + } + current, err := readScheduleVersion(ctx, tx, ns, id, summary.CurrentVersion) + return schedule.View{Summary: summary, Current: current}, err +} +func authorizeSchedule(ctx context.Context, tx *sql.Tx, ns, id core.ID, p auth.Permissions) (schedule.Summary, error) { + v, err := readSchedule(ctx, tx, ns, id, false) + if err != nil { + return v, err + } + if !p.AllowsQueue(v.QueueID) { + return v, fault.NotFound + } + return v, nil +} +func (s *ScheduleStore) Create(ctx context.Context, t auth.Token, key string, in schedule.CreateInput) (schedule.Result, error) { + var out schedule.Result + err := s.transaction(ctx, t, "schedules:manage", func(tx *sql.Tx, p auth.Permissions) error { + if !p.Allows("tasks:submit") || !p.AllowsQueue(in.Definition.Task.QueueID) { + return fault.Forbidden + } + id, err := core.NewID() + if err != nil { + return err + } + identity, cached, err := reserveIdentity(ctx, tx, t.NamespaceID, "schedule.create", "", key, "schedule", id, in) + if err != nil { + return err + } + if cached != nil { + if err := json.Unmarshal(cached, &out); err != nil { + return err + } + out.Deduplicated = true + return nil + } + var queue core.ID + err = tx.QueryRowContext(ctx, `SELECT id FROM pulse_queues WHERE namespace_id=? AND id=? FOR SHARE`, t.NamespaceID, in.Definition.Task.QueueID).Scan(&queue) + if errors.Is(err, sql.ErrNoRows) { + return fault.NotFound + } + if err != nil { + return err + } + now, err := dbNow(ctx, tx) + if err != nil { + return err + } + c, err := schedule.Compile(in.Definition.Rule) + if err != nil { + return err + } + next, err := c.AtOrAfter(now) + if err != nil { + return err + } + if next == nil { + return fault.Invalid("schedule has no future occurrence") + } + _, err = tx.ExecContext(ctx, `INSERT INTO pulse_schedules(namespace_id,id,queue_id,name,current_version,processing_version,paused,next_fire_at,check_at,created_at,updated_at) VALUES (?,?,?,?,1,1,?,?,?,?,?)`, t.NamespaceID, id, queue, in.Name, in.Paused, next, next, now, now) + var me *driver.MySQLError + if errors.As(err, &me) && me.Number == 1062 { + return fault.Conflict + } + if err != nil { + return err + } + if err := insertScheduleVersion(ctx, tx, t.NamespaceID, id, schedule.VersionView{Version: 1, EffectiveAt: now, Definition: in.Definition}); err != nil { + return err + } + out.Schedule, err = scheduleView(ctx, tx, t.NamespaceID, id) + if err != nil { + return err + } + if err := emitEvent(ctx, tx, t.NamespaceID, id, 1, "schedule", "schedule.created", map[string]any{"queue_id": queue, "version": "1", "paused": in.Paused}); err != nil { + return err + } + if err := appendAudit(ctx, tx, t, identity, id, "schedule", "schedule.create", "create schedule", nil, out.Schedule.Summary); err != nil { + return err + } + return saveIdentity(ctx, tx, t.NamespaceID, identity, out) + }) + return out, err +} +func (s *ScheduleStore) Get(ctx context.Context, t auth.Token, id core.ID) (schedule.View, error) { + var out schedule.View + err := s.transaction(ctx, t, "schedules:read", func(tx *sql.Tx, p auth.Permissions) error { + if _, err := authorizeSchedule(ctx, tx, t.NamespaceID, id, p); err != nil { + return err + } + var err error + out, err = scheduleView(ctx, tx, t.NamespaceID, id) + return err + }) + return out, err +} +func (s *ScheduleStore) Publish(ctx context.Context, t auth.Token, id core.ID, key string, in schedule.PublishInput) (schedule.Result, error) { + return s.mutate(ctx, t, id, key, "schedule.publish", in, in.ExpectedRevision, in.Reason, func(tx *sql.Tx, v schedule.Summary, now time.Time) error { + if in.Definition.Task.QueueID != v.QueueID { + return fault.Invalid("schedule queue cannot change") + } + last, err := readScheduleVersion(ctx, tx, t.NamespaceID, id, v.CurrentVersion) + if err != nil { + return err + } + if !now.After(last.EffectiveAt) { + return fault.Unavailable + } + if err := insertScheduleVersion(ctx, tx, t.NamespaceID, id, schedule.VersionView{Version: v.CurrentVersion + 1, EffectiveAt: now, Definition: in.Definition}); err != nil { + return err + } + cursor, next := v.ProcessingVersion, v.NextFireAt + // nil 游标也可能表示刚进入最新版本、尚未初始化；只有没有扫描工作才表示结束。 + if (next == nil && cursor == v.CurrentVersion && v.CheckAt == nil) || (next != nil && !next.Before(now)) { + c, err := schedule.Compile(in.Definition.Rule) + if err != nil { + return err + } + next, err = c.AtOrAfter(now) + if err != nil { + return err + } + cursor = v.CurrentVersion + 1 + } + check := &now + if next != nil && next.After(now) { + check = next + } else if next == nil && cursor == v.CurrentVersion+1 { + check = nil + } + _, err = tx.ExecContext(ctx, `UPDATE pulse_schedules SET current_version=current_version+1,processing_version=?,next_fire_at=?,check_at=?,revision=revision+1,updated_at=? WHERE namespace_id=? AND id=?`, cursor, next, check, now, t.NamespaceID, id) + return err + }) +} +func (s *ScheduleStore) Control(ctx context.Context, t auth.Token, id core.ID, key string, in schedule.ControlInput, paused bool) (schedule.Result, error) { + operation := "schedule.resume" + if paused { + operation = "schedule.pause" + } + return s.mutate(ctx, t, id, key, operation, in, in.ExpectedRevision, in.Reason, func(tx *sql.Tx, v schedule.Summary, now time.Time) error { + if v.Paused == paused { + return fault.Conflict + } + _, err := tx.ExecContext(ctx, `UPDATE pulse_schedules SET paused=?,revision=revision+1,updated_at=? WHERE namespace_id=? AND id=?`, paused, now, t.NamespaceID, id) + return err + }) +} +func (s *ScheduleStore) mutate(ctx context.Context, t auth.Token, id core.ID, key, operation string, input any, revision uint64, reason string, change func(*sql.Tx, schedule.Summary, time.Time) error) (schedule.Result, error) { + var out schedule.Result + err := s.transaction(ctx, t, "schedules:manage", func(tx *sql.Tx, p auth.Permissions) error { + if operation == "schedule.publish" && !p.Allows("tasks:submit") { + return fault.Forbidden + } + if _, err := authorizeSchedule(ctx, tx, t.NamespaceID, id, p); err != nil { + return err + } + identity, cached, err := reserveIdentity(ctx, tx, t.NamespaceID, operation, string(id), key, "schedule", id, input) + if err != nil { + return err + } + if cached != nil { + if err := json.Unmarshal(cached, &out); err != nil { + return err + } + out.Deduplicated = true + return nil + } + v, err := readSchedule(ctx, tx, t.NamespaceID, id, true) + if err != nil { + return err + } + if v.Revision != revision { + return fault.Conflict + } + now, err := dbNow(ctx, tx) + if err != nil { + return err + } + if err := change(tx, v, now); err != nil { + return err + } + out.Schedule, err = scheduleView(ctx, tx, t.NamespaceID, id) + if err != nil { + return err + } + if err := appendAudit(ctx, tx, t, identity, id, "schedule", operation, reason, v, out.Schedule.Summary); err != nil { + return err + } + if err := emitEvent(ctx, tx, t.NamespaceID, id, out.Schedule.Revision, "schedule", operation, map[string]any{"version": fmt.Sprint(out.Schedule.CurrentVersion), "paused": out.Schedule.Paused}); err != nil { + return err + } + return saveIdentity(ctx, tx, t.NamespaceID, identity, out) + }) + return out, err +} +func (s *ScheduleStore) Version(ctx context.Context, t auth.Token, id core.ID, version uint64) (schedule.VersionView, error) { + var out schedule.VersionView + err := s.transaction(ctx, t, "schedules:read", func(tx *sql.Tx, p auth.Permissions) error { + if _, err := authorizeSchedule(ctx, tx, t.NamespaceID, id, p); err != nil { + return err + } + var err error + out, err = readScheduleVersion(ctx, tx, t.NamespaceID, id, version) + return err + }) + return out, err +} diff --git a/internal/storage/mysql/schedule_tick.go b/internal/storage/mysql/schedule_tick.go new file mode 100644 index 0000000..4a95d5c --- /dev/null +++ b/internal/storage/mysql/schedule_tick.go @@ -0,0 +1,225 @@ +package mysql + +import ( + "context" + "database/sql" + "encoding/json" + "errors" + "fmt" + "time" + + "git.yuntuo.hk/k2safe/orbit/internal/fault" + core "git.yuntuo.hk/k2safe/orbit/model" + "git.yuntuo.hk/k2safe/orbit/pulse/schedule" +) + +// ScheduleStats 是本次已确认提交的批次计数，事务失败不计作成功。 +type ScheduleStats struct { + Examined int // Examined 已检查的候选计划数。 + Fired int // Fired 本轮创建的任务数，合并范围计一个。 + Skipped int // Skipped 本轮保存的跳过范围数，不是被覆盖触发点总数。 +} + +// Tick 按持久化 check_at 扫描，一次最多 100 个计划，每个计划独立短事务。 +func (s *ScheduleStore) Tick(ctx context.Context, limit int) (ScheduleStats, error) { + var out ScheduleStats + if limit < 1 || limit > 100 { + return out, fault.Invalid("schedule batch limit must be 1 to 100") + } + type candidate struct{ ns, id, queue core.ID } + candidates := []candidate{} + rows, err := s.db.QueryContext(ctx, `SELECT s.namespace_id,s.id,s.queue_id FROM pulse_schedules s JOIN orbit_namespaces n ON n.id=s.namespace_id JOIN orbit_applications a ON a.id=n.application_id WHERE s.paused=FALSE AND s.check_at<=UTC_TIMESTAMP(6) AND n.enabled=TRUE AND a.enabled=TRUE ORDER BY s.check_at,s.namespace_id,s.id LIMIT ?`, limit) + if err != nil { + return out, err + } + for rows.Next() { + var c candidate + if err := rows.Scan(&c.ns, &c.id, &c.queue); err != nil { + rows.Close() + return out, err + } + candidates = append(candidates, c) + } + err = rows.Err() + rows.Close() + if err != nil { + return out, err + } + var failures []error + for _, c := range candidates { + out.Examined++ + fired, skipped, err := s.tickOne(ctx, c.ns, c.id, c.queue) + if err != nil { + failures = append(failures, err) + if ctx.Err() != nil { + break + } + continue + } + out.Fired += fired + out.Skipped += skipped + } + return out, errors.Join(failures...) +} +func (s *ScheduleStore) tickOne(ctx context.Context, ns, id, queue core.ID) (int, int, error) { + fired, skipped := 0, 0 + err := WithTx(ctx, s.db, func(tx *sql.Tx) error { + var allowed core.ID + err := tx.QueryRowContext(ctx, `SELECT n.id FROM orbit_namespaces n JOIN orbit_applications a ON a.id=n.application_id WHERE n.id=? AND n.enabled=TRUE AND a.enabled=TRUE FOR SHARE`, ns).Scan(&allowed) + if errors.Is(err, sql.ErrNoRows) { + return nil + } + if err != nil { + return err + } + // 和任务执行一致先锁队列，再锁计划；其他扫描节点不等待同一计划所在队列。 + err = tx.QueryRowContext(ctx, `SELECT id FROM pulse_queues WHERE namespace_id=? AND id=? FOR UPDATE SKIP LOCKED`, ns, queue).Scan(&allowed) + if errors.Is(err, sql.ErrNoRows) { + return nil + } + if err != nil { + return err + } + v, err := readSchedule(ctx, tx, ns, id, true) + if err != nil { + return err + } + now, err := dbNow(ctx, tx) + if err != nil { + return err + } + if v.Paused || v.CheckAt == nil || v.CheckAt.After(now) { + return nil + } + if v.QueueID != queue { + return errors.New("schedule queue changed") + } + cursor, next := v.ProcessingVersion, v.NextFireAt + needsInitialization := false + // 单批最多跨过 16 个空历史版本，避免长事务；下次从已保存版本继续。 + for n := 0; n < 16; n++ { + version, err := readScheduleVersion(ctx, tx, ns, id, cursor) + if err != nil { + return err + } + c, err := schedule.Compile(version.Definition.Rule) + if err != nil { + return err + } + var before *time.Time + if cursor < v.CurrentVersion { + newer, err := readScheduleVersion(ctx, tx, ns, id, cursor+1) + if err != nil { + return err + } + before = &newer.EffectiveAt + } + needsInitialization = false + if next == nil { + next, err = c.AtOrAfter(version.EffectiveAt) + if err != nil { + return err + } + } + if next != nil && next.Before(version.EffectiveAt) { + return errors.New("schedule cursor predates its version") + } + if next == nil || (before != nil && !next.Before(*before)) { + next = nil + if cursor < v.CurrentVersion { + cursor++ + needsInitialization = true + continue + } + break + } + if next.After(now) { + break + } + var active bool + if version.Definition.Policy.Overlap != "PARALLEL" { + if err := tx.QueryRowContext(ctx, `SELECT EXISTS(SELECT 1 FROM pulse_tasks WHERE namespace_id=? AND owner_kind='schedule' AND owner_id=? AND state IN ('WAITING','LEASED','RUNNING','NEEDS_REVIEW'))`, ns, id).Scan(&active); err != nil { + return err + } + } + policy := version.Definition.Policy + // 大参数也要保持事务有界；每批复制的业务参数最多约 1 MiB。 + if size := len(version.Definition.Task.Payload); size > 0 { + if max := uint32((1 << 20) / size); max < policy.CatchupLimit { + policy.CatchupLimit = max + } + } + batch, err := schedule.Plan(c, policy, *next, now, before, active) + if err != nil { + return err + } + for _, decision := range batch.Decisions { + if err := s.saveOccurrence(ctx, tx, v, version, decision, now); err != nil { + return err + } + if decision.Kind == "SKIPPED" { + skipped++ + } else { + fired++ + } + } + next = batch.Next + if next == nil && cursor < v.CurrentVersion { + cursor++ + needsInitialization = true + } + break // 每计划每批只创建一个版本的有限任务，跨版本也不绕过速率上限。 + } + var check *time.Time + if next != nil || cursor < v.CurrentVersion || needsInitialization { + t := now.Add(time.Second) + check = &t + if next != nil && next.After(t) { + check = next + } + } + result, err := tx.ExecContext(ctx, `UPDATE pulse_schedules SET processing_version=?,next_fire_at=?,check_at=?,revision=revision+1,updated_at=? WHERE namespace_id=? AND id=? AND revision=?`, cursor, next, check, now, ns, id, v.Revision) + if err := exactlyOne(result, err); err != nil { + return err + } + return emitEvent(ctx, tx, ns, id, v.Revision+1, "schedule", "schedule.advanced", map[string]any{"node_id": s.node, "processing_version": fmt.Sprint(cursor), "next_fire_at": next, "fired": fired, "skipped": skipped}) + }) + if err != nil { + return 0, 0, err + } + return fired, skipped, nil +} +func (s *ScheduleStore) saveOccurrence(ctx context.Context, tx *sql.Tx, v schedule.Summary, version schedule.VersionView, d schedule.Decision, now time.Time) error { + id, err := core.NewID() + if err != nil { + return err + } + var task *core.ID + if d.Kind != "SKIPPED" { + value, err := core.NewID() + if err != nil { + return err + } + task = &value + in := version.Definition.Task + if in.QueueID != v.QueueID { + return errors.New("schedule template queue mismatch") + } + policy, err := json.Marshal(in.Retry) + if err != nil { + return err + } + _, err = tx.ExecContext(ctx, `INSERT INTO pulse_tasks(namespace_id,id,queue_id,handler,handler_version,payload_version,payload,policy_snapshot,recovery_safety,business_key,owner_kind,owner_id,available_at,deadline_at,attempt_timeout_ms,max_attempts,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,NULLIF(?,''),'schedule',?,?,?,?,?,?,?)`, v.NamespaceID, value, v.QueueID, in.Handler, in.HandlerVersion, in.PayloadVersion, string(in.Payload), string(policy), in.RecoverySafety, in.BusinessKey, v.ID, now, now.Add(time.Duration(in.TaskTimeoutMS)*time.Millisecond), in.Retry.AttemptTimeoutMS, in.Retry.MaxAttempts, now, now) + if err != nil { + return err + } + if err := emitEvent(ctx, tx, v.NamespaceID, value, 1, "task", "task.accepted", map[string]any{"schedule_id": v.ID, "occurrence_id": id, "schedule_version": fmt.Sprint(version.Version), "scheduled_at": d.ScheduledAt, "node_id": s.node}); err != nil { + return err + } + } + _, err = tx.ExecContext(ctx, `INSERT INTO pulse_schedule_occurrences(namespace_id,id,schedule_id,schedule_version,scheduled_at,decision,task_id,covered_until,reason,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?)`, v.NamespaceID, id, v.ID, version.Version, d.ScheduledAt, d.Kind, task, d.CoveredUntil, d.Reason, now, now) + if err != nil { + return err + } + return emitEvent(ctx, tx, v.NamespaceID, id, 1, "schedule_occurrence", "schedule.decided", map[string]any{"schedule_id": v.ID, "version": fmt.Sprint(version.Version), "scheduled_at": d.ScheduledAt, "decision": d.Kind, "covered_until": d.CoveredUntil, "reason": d.Reason, "task_id": task, "node_id": s.node}) +} diff --git a/internal/storage/mysql/task_store.go b/internal/storage/mysql/task_store.go index 56316d0..e110642 100644 --- a/internal/storage/mysql/task_store.go +++ b/internal/storage/mysql/task_store.go @@ -354,7 +354,7 @@ func (s *TaskStore) CancelTask(ctx context.Context, token auth.Token, id core.ID if err := tx.QueryRowContext(ctx, "SELECT owner_kind FROM pulse_tasks WHERE namespace_id=? AND id=?", token.NamespaceID, id).Scan(&owner); err != nil { return err } - if owner.Valid { + if owner.Valid && owner.String != "schedule" { return fault.Conflict } now, err := dbNow(ctx, tx) diff --git a/internal/timezone/LICENSE b/internal/timezone/LICENSE new file mode 100644 index 0000000..2a7cf70 --- /dev/null +++ b/internal/timezone/LICENSE @@ -0,0 +1,27 @@ +Copyright 2009 The Go Authors. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are +met: + + * Redistributions of source code must retain the above copyright +notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above +copyright notice, this list of conditions and the following disclaimer +in the documentation and/or other materials provided with the +distribution. + * Neither the name of Google LLC nor the names of its +contributors may be used to endorse or promote products derived from +this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/internal/timezone/zone.go b/internal/timezone/zone.go new file mode 100644 index 0000000..4b8a3e9 --- /dev/null +++ b/internal/timezone/zone.go @@ -0,0 +1,61 @@ +// Package timezone 提供随计划冻结的时区快照，禁止读取宿主机或 ZONEINFO 环境配置。 +package timezone + +import ( + "archive/zip" + "bytes" + _ "embed" + "errors" + "io" + "sync" + "time" +) + +// Version 标识 Go 1.27.1 附带的 IANA 快照及文件摘要；升级时须保留旧版本可读能力。 +const Version = "go1.27.1-b2d18a7c8fa8" + +//go:embed zoneinfo.zip +var data []byte +var zones sync.Map +var archive = sync.OnceValues(func() (*zip.Reader, error) { return zip.NewReader(bytes.NewReader(data), int64(len(data))) }) + +// Load 仅接受精确的内置名称，返回只读 Location；不接受 Local 或文件系统路径。 +func Load(name, version string) (*time.Location, error) { + if version != Version || name == "" || name == "Local" || len(name) > 64 { + return nil, errors.New("unsupported frozen timezone version or name") + } + if name == "UTC" { + return time.UTC, nil + } + if v, ok := zones.Load(name); ok { + return v.(*time.Location), nil + } + a, err := archive() + if err != nil { + return nil, err + } + for _, entry := range a.File { + if entry.Name != name { + continue + } + r, err := entry.Open() + if err != nil { + return nil, err + } + b, err := io.ReadAll(io.LimitReader(r, 1<<20)) + closeErr := r.Close() + if err != nil { + return nil, err + } + if closeErr != nil { + return nil, closeErr + } + loc, err := time.LoadLocationFromTZData(name, b) + if err != nil { + return nil, err + } + actual, _ := zones.LoadOrStore(name, loc) + return actual.(*time.Location), nil + } + return nil, errors.New("unknown IANA timezone") +} diff --git a/internal/timezone/zone_test.go b/internal/timezone/zone_test.go new file mode 100644 index 0000000..10b15db --- /dev/null +++ b/internal/timezone/zone_test.go @@ -0,0 +1,38 @@ +package timezone + +import ( + "crypto/sha256" + "fmt" + "testing" + "time" +) + +func TestFrozenSnapshot(t *testing.T) { + if got := fmt.Sprintf("%x", sha256.Sum256(data)); got != "b2d18a7c8fa8142097a48c99609fb3c92db5ee98bc740294e57eab8ae9f94779" { + t.Fatal("snapshot changed without a new version") + } + t.Setenv("ZONEINFO", t.TempDir()) + for _, name := range []string{"UTC", "Asia/Shanghai", "America/New_York", "Australia/Lord_Howe", "Pacific/Apia"} { + zone, err := Load(name, Version) + if err != nil || zone == nil { + t.Fatalf("load %s: %v", name, err) + } + again, err := Load(name, Version) + if err != nil || again != zone { + t.Fatal("cache changed") + } + } + zone, _ := Load("Asia/Shanghai", Version) + _, offset := time.Date(2026, 1, 1, 0, 0, 0, 0, zone).Zone() + if offset != 8*3600 { + t.Fatal("wrong frozen zone") + } + for _, name := range []string{"", "Local", "../UTC", "/etc/localtime"} { + if _, err := Load(name, Version); err == nil { + t.Fatal("accepted external timezone") + } + } + if _, err := Load("UTC", "unavailable-version"); err == nil { + t.Fatal("silently upgraded frozen version") + } +} diff --git a/internal/timezone/zoneinfo.zip b/internal/timezone/zoneinfo.zip new file mode 100644 index 0000000000000000000000000000000000000000..46c90a2b806a92fcd3291449fe448ce8db4d1753 GIT binary patch literal 408467 zcmeF42S60p*2f2tYQq9bQ4v(6$x2b|i+~hGQBkq)Du^foQfx808ly4KL@bF(Y*=D1 z*s$BoHFgvc zyVB%*dM8BplDqlzjE?9lj}7Y_-P>Igw#W@V(y-&t2kgQ@i;*+VrO%`rlLGZ}b675H3# zt31V%=((YwS!Be$Dm^ z2)|ChG4$)^m4SZ!wE@tlf9nhVhTTuW8>9AuH!XBT_|1W@5Pr+JZqR2qxk10RZwmCv z5EeMv^({pF<4 zA86kI;SY>$q~QB_?DFx!EYHtA5B-H^ODZv6{H8Sa&$7?@h51tCWU$Jx7x;4XJqUmK z=2V2g>hKc!t9$oDf8C@u^w$^VR4S(TQGfcyifjGRZy)4HRy<8lOk<{kU}Ve*%g9)- zG{zpR_$(7=J=zGgD zouzWc!(a4BQ$3J0LiIiZU6_+ZFyV{w@uM$)A4;qAo<+Omoh)&Z^yC9lP-#ig=hB6TTGsoqCXQeuU zQ)RzH&Q_F!oKw3TGwwKH9!2adn@hDF8@VE z>guAn0OE^6A@r}@qp$g5R^B@o&T`EjRVK@Acb9<=#tc0{d6+(>S-a7+lVD$qccu%Z z%&6v4;cYhLPMHrUU1y2Ar&r+#c+TpeKWEYb*lAs9GkJe`zc}5bUw(Y-@VF-3_!;S8 z^Q3eIU*Wy7W6kKwa&w<6CrrAaqt z+VJh(m=!gh<$>X5bldfFbF(8j|Dx}=x1DyNC&f3v+1s06RK0C~las2SC@?$iONvfR zlqc)vlGKIS+n6*xg-_NbN=}zTkp@>nQHL*@Dx!Q19C?a5|34j@`29`+*_9#pwnT0g zBaclQk`SqzD^Nca@e0bhNcdq)otk)?<Yn{?}VerY<*51*5C07(|txlF7h7#ZtrMOneuLSTCEjdd31t~ zvQGt_7R3p%2KV)rkR=>d_D)`-f_(WE3W|NN?}PX6xdlFOV7ZL-2QN8-4=ue6{o&n@ z!ABMG`C#G==pT0O1pT8#E9f6L91s1I_OrlGtCR<9uOLpXK@^ z{EJFrHSERZ{ot1`>O=o(`x}IReLe&H=J!$HoXrn$yxcMC=+@C^W{qqXdQpEUSQZ=6 zDW0W%P-PZEad{TlzGxjmyfLsu2AnX*t~Tp!dqBYK=_KOlfe~V z210KcKNoCy{wwIM9ybD8X9!@MlkxE!u<|TV7DAPEV)&|xC!5%dm?EpI%j)lHf<)_)aQS0VL1xqL4E3ni4reNpGD-hmgNg}HS z*X>uJuRVS~^lqu;RqQY6S2B}joe@t|EZu|efjxSh275YXg1wq<0M|8L1+G`?l#GH4 z^&TAwWm(@iT?To4CAh(@-@px5PX;&II}F@-ax%Ed!tUUvi5#(DxWxsfg1Ke4>)?>7>EKqL8Yu# z4>jH-$~wQVbHD(GzRIKYD8j{QItunEfR!>i@;3kTj)Vyucq-Tc2MO z=tE8O;w-t@%9SSG)I$~4nX0g4RuW7b(RY)A#?x8We_nJiM)@W=?dnKma*~dckTac` z0XYj!0>kUBMbemgDj7*<*6dgr`!6=Q4_n@-o{+V!*MM|9X#wf9%LvkW&2vbXd4E8*g}}QLrn`r@wCQ@ue(J%@~o%@_xDAY?LBv+X)K7#wd!6 zWQ;<#^&T_S$jcWVeM393(`tPC^^NWsmz?xD>^Bo19VZuUoqMhu8 zoc%Q?=PHqSO5SNW)jKs`v4(bGr**>vkv`0a ze~eYIJTkmZJQ+|a*Q?Z$!V2b<-r7#dXhW@5bOyEa;odDWq5AShp?1_+Wv{g;B(o2s z4lZ5Ug(>dlW%i?*?};Ff$~Jrr)XsjlMe<Dw0gT{BjhEf^WsH!c(8{0Mmn+WZoHx;UbO)rmyzJ$sUTykegaH*}gz@>k0 zituF?8OQ|sn2kwj!Y9l9QmfG>!vX z-rWto)q{Vj1o~KKwgB54?GLWJayY_!EBtL)FRN%3`q$P<0Uu6~mFIDA%~M8#6nkfp z4mm-h@$>FTy|Owkrwj)@j9!0@e^lG_)xENBE5g(>`;K1O4$J)Rt0T2mmfE6^JRvDASx1%o zf)Sgq;7i1Q8?ie*zxH7fyNZJE+TV-V%G#-a7E;i(h>nuSe2z9y#)HzK6nSkVd?(*KqY0&lK7*XS&R>rQKc(4_vgjF;Mr~N57ra7n^)hBuY*3cAB`vzO@A25 z!F|@^Sh6BV6xiQW%G6Io%YxoAx@SV<=j-eJb{;(sV-$(+eI6T*o>@4Gu9lrv$=x!p zzmDpR`QlET^X{(Xp;w)6IDJshC~9oLvx_BXO`<^Tw3_=ZljX4yI*RC2M#9vB0kr*t z>Q>@7GwFtcDzs#@>O)$gq$hvB_dfqL^icbsDIh!Tn33F*`qbr#eRPzws4oCR8wQ6| zLv?V@_g%920xXquGB|Z)G-%p!)aG)(&^q{y299Ob(L3K0NF<}(XUJ+sHQ)D|qKnmN zKJWKtjfYE4Z>YZIT4x(V)svn&8Wxc6c2Bx7#*gF6<5?LBzTL)+__XOmISa)X+-{ER zMdl`Do0dCK$n6f1$0sN0=mPSk&L5hc97rBjzUPyE@9my%d}-ed3dkOJu}Z*=>UXqd(rcR!`<8ZKr&X~H;o-o#YDlYZ z``ZiI6HXqLYpGBBJtzF4nUlqA3d_!n+}p-iNL-Yh#xeKN@x6x?I(~D+bH4ZM<{l1Z zd2@X58Cap6zT=A!t3}G>hRg|^TTL*Dx4!|TPW9iKs?Lx zHM3-hiKT5Axt!*_K*Y$R^@%6pb14liG54b_VA4*&=)8@!)m0L$+aDT776sQ< zaRYT!su!r1jK^c(4qUF56iX6MoD;?eRZF&+em{B{?ZZwhk++k_^$62hvw>3uJDhs= zMsFk>gC^bhQ9*t}=b-Pn;1jw!ZK9aOmMz0jP9o2Gu`hiJyEMwK3l7}So};IAWns}Y z?6qIg=ZQ@pF-fn-2=^{4C^E9sDpoNaBA#W{QTJplZR3N%)#ReV*RJgmu)UwYiuKh!i)FK{ zQKO!WWliaNuzRZqU=P2#2=D3DSH=3!8Nad++Jv1|uxuN>M)B61`qv>w~pN7hxUL!-MxGnprEh+cuAc#|JbDY144FvWAT*q-JES zfjDBeSyCzZ`-%gD1-}|MQ}}oMecza|Y;Ld*9AJM59B}UjWRU*0LOSj8^`cU@3H7#& z=c9-dy0~(IoD`3mCvj;WccF8)`a7nF4yP=OomQsPF*-J)Ph4a_-4w`Pbh_MCRFR)f z|F2pMW;yC@&z*KR5noqL!v!jquH*N}Sk{iV!QFBD`VU4y5|{(76J?-acCV!Zdo;fZ z_AL84h5fy1?gM*0$O6|hTmr6lR0;OJ@dLR2$~oW$yW_wOCyoX;T7lavG#=0!++;$m zz@Mg_zcFJejSFQV_%w(FH*4(<_O%KC`?*yB`@M7oH!uAZ-27Y#aKQ6&3ib%x;gG^I z==5U+%iy^t;1=sofm@FH6Ra8I+4B&%^`PIN4{f#r+(x#ZcNf~)O$4`-irGk5iREVO z-`@5s7DD?!#Q|^~g>K-E2NIwUS2YE9S`uc)#hRw0Ufp5;K1mfxii+yqJj#7c(E_G# z>f5KdMn2`a^+J95)EYyZm}`zj+JBb2%=6qw(VZP~rT&rPB=!ioj^b$;ojskdP>thf z)9r6yto?dy=kCl0#`$HkJZAqm9#S4EW%=@0`!tq0=>tMp<}M7A(lG?#mv*5n^uDVr zWm#;n7g&ElTP1UGd7Dg@25mf*EDe1;z(#c}z(zmx2b-8Z2b(PWBb39LW}gF>P@RRo zn3p7aT~$qhRgt$kDd;$&}jtNJZL!BqP`ql(NPAj zWcRgFppT_VGq6>$9$+hHJ6ra*dKe0}zT%O_Y;(*VTzR`WxXP*u;HtBqfo%r{NGX_5 zZRA<7T?a?7ecz`N_OD*I1h_`<8E{SWyI=>WjbMjd6D0)`98IT#9kc!fJKY`*cFs5i zb~*lA8i#Y8xdL2!^)Rs8@QGl_f;|FKz@F{wz+Mgs;JO~g!S#&9 z=j&}#O~U(m-xQy3{nz^7274+Ye8cnC!Hv?y=i7MG9&nQs3nlN@blM`YG){cJKBIS~ zv46AH;`8;5SOE5O+pJ`Nf4^~H|3~+wls=0WGcbJDpOK02$NdSyk}F(|?c9^UBSX1e zlqlm7BJ@oaVe&DsBJr)Jip>{ zUnT1e+SCLa`qTg$)iDMe{UD|<6SLc3lV#_n9NskhAh?9;0K%6%`-g=6ODUIuOK&&; zF0*LAl>NnZM3-*PPVtF@@h#(YPbr(yJ$+NUPn2=Gr)_io<|P;=DDeAh>2IW|EH^yxg#X5@BwOZl-pj$~{(K2}!SZq%`(N153Hpn# z%;BFkEem|<;%{J8mEDA^-~Ls-y)0Yd;h42%;d;- zRi#If?_{PJ`CKLLG?dhXCNI%9I z<3uM!>c|$+n0}XAr|7*%n7*(j$AvkQCg54G`>L&!dA-#>#D(-K6Ts;w;-TMI@oOdP zH?Exv{if$Dq2K)TY3R3{y#{^8U{mO~ZmI;mvhxJ+wiz?P+Z*mc_#MMD5q_u5Q|Nce zibKCE#|ip9KJ}pAqgnypJ8}y2`$J|U{Qi4mpg$av3;p4=yWr!FUeKTLjQ~GxYz+P5 zSx>=F3}V1f-OZ$YJx_1ULip$9eW8E8=Q#8)9uI>4++f5#O#N8th3F|7gENp&3T z{A)*Bfj*kJztsuH4H#r1$_pc)4}3WX9JE<(%dOiF`^(n`)(7S0?(^hWz9Une#d2Kd zf|BCB8R9)UM|`Phbd`7_?sFO_JpQ-cd-kb1{#(;!XbL<{{P&e7(ZVbVx|$AKAo8zp z;fMbv^8eE!f3B1whw!11U%E+5EYg!Dl)RsIV)*#TUyKbu`UY$e%FW$QZ6#eqep@=t zLLz@$|G0>@(F5fXw0Mb*s#9N50HyeUe)j)AnF8)-xBXt7{aY510umzPdVZd$zYHb% zm(2gaJM-7h>?ukK|6a}KZRXEK0J8m0miZ?qb+%eXwSIOL3yu20v;vflM!qzpAJnSy zFUL^6FA@Jg9PynxD(Sfh4p+{js$T2f_fqB$t@UU}{Ew~WP(HqcP9Vn`^C7(>0OFvySe?7GE<#$)}+sR{l1k>bE-Hfm-P|aVt`Abay z2gUS%x0=6kmRQx%mq`EJst%=q{CWM(PnQU66dSs}KM}M{*43c$0*PS7nlFjqKbQ#K z{GQ5@)uCWLKfqea{slX1rA0;Z$*)s6e8BOxNCbfo21=QOR(pbjkB0Mb$PfHO+%Han z#mYYKMkT?vgP$%DbUJft*(oyiuq)i8AC}xJxxcOo0v^MyW$#%&?@Jo^52k@42Qz$J zl}A(8KX4RrU%Lv#Y2lNY_{DO8sznz*U1Ipx*XydNTfc=ThW0dNT>hE5c2|D)B{BRH z6T`=i?2&G0CE-Z_X$CjsuM9o^bWy*>*T(y&(rL0QMJ~_qud`+9sKmj*P%M%#xr&=N zNB5_{+zI4?p&5aEZOZhwqn1p0=q`;U6l+0x#e8J_~Pmwa0Z@w2?!P^pS?(iD>TUfSKvc95;8}t=lDxj}) zyBGA9=T}2-b?_G0I>Q@mv)mftE6<8S_$m`xLtj-f3wqo5QP5YDABWzqoe|jHFC1Lm zvmwIQ@M#FHX&wu`gW*=N!_zs?=XH_2HJTpTq7>-kyuk!|mnBOO-Zj1?_OCrY3wpQK z_rQ|aa?sbQ+Xvy@JJyEYqs%JkJ?oi)J)a+ezOKbXaNWy)LSOIc39$FJL*V+S)`1($ zUIA{nRlL4NE7nN_`ZOMp0)3MSzkr)|UM6LKY1~k-&wzX2W*$qizi*pNuwVHf!Txnt zf&CxFg9EG%D+T&!Du*xAz?#b8xk=y_+r<0XazQRQWOii<5%GO;7ijXd}$oMFU^+l zrP&hv+7wgz@+vSLyU2-;NxEA1iu(G#Onm$@@i9e8@j&=8@sTGzecp+Wty}cnvzY2{ z?6hl(&E$P_**MZnBl>x9KP+$i|9uLMX4=7)tErq8G$S&m{L7Zv>2|3!md^deNrNs* zu^@Ksz0;QcYp03@v0L-`;Q#cLo>sq!6~op+lWgBRf#+RQeCXX**SM7bn8`ge$9!k4 zeyzI&-5hnPj!50387-tquh!M!q#kZYU{cTT>u#YeU-7^ha$WBZDAU*bGzO=atP4(m zGbS5l{p|rV+E=I(HJWQ9G)2@x!O|n3H`uf7bFh~~Ah@pkIdDBAC$P8mGY(EuL`#C} zzd8$U@T6P{Z!}zY6x=Ay6x?{z3~-YPcfd`jjQ~sI4ugG0PgAf*v({-~--xfler}V% z{(e2c&C4W#1FHLg1D;Pbquqp{;`ZR6Gl}5fYX;yJ>FvQS50%g6a3Q}qvJhG=eFAPh zxCA(K{Aq9-xr2f|+Qw`ExAQRphqasrZg2Z1xP!~r;Euu}aJczz@wA%|u37=^^kf*g zvvMN1%gOHGu8Wp)FrnL8DY*N%6mXB9?7*_<1h9N~lWgAT8N?MALFm=pHk+$raQY+* z|0}u%oSQp?jzr%nT!$5Fa7$9vH8`%jg>b!%TnN|U$e9w)PT7GE4+{YwnKmDs8QE7x z`_h6=4^@y;#%HoDGZl4l!7M2jTz23U=*xwLg3I^Fm2tQVk|yFB*?B7yQI*-6?Om~r{0+Qjuw2&FK-@0yi{yp74cKHgz$e2hSErMQ|u0yLJOiJP# z_P<;ZzOx{pS)AiPHlrVRX5&3`ii7M*)7{iW{K%N-p*mW#p(p(gH{NJIdT#FI?q}0j z&YIN_(L2?@%^Bv|BPxUE)Q$~jp4&YaJg;;p`1dB_J8^%%=MG-rkR#)83l3KRFEUbr z7cF}VUVL*qc*)dqXE@x_J@dfJ20jKaUoZx|qQfb0+Soqem37m>tKvtic)!&azk%0; zitpfE^K=+^og@(Yb(ek(=Wyv}PT=&dUx7DdmjrK|)eXGqtfP#>Z647Syk$cPa7K@6 z;H|&h1uL8CgSQPn0^VM$>KWc|NBBzcPGddrF7L_UT{o|S_f%V<;&6NR>;mu8n+V>w zU;%jlo$+v%-&oFHM>WR{7iy=i^>Z5MPsXrP@*O)wVsMzoxeueBIp-eEsrI z;G5QR8Si&<+aU0*SH9psW_JSLK3@a;=l98HINY60M&P@BJA&{1_6PWWaD8z0Xag08 zd*EaZe%R|K_>svQ@MGV7;KzSl0zb810)BezbvW<$T>l5~^Ho{k7gyuJFDEI%uMUov zak$qBbHXXk3r0Q9%OE#ohO(?A7b`54mehOyD+>x%^JpoVf?h>4O#>uj@-q6>+}u?Q z-`YD&Vd)^VGub<6;d}bF5Y5Y8l*?;dJc=qg7w;eCbBL~kT?KNQ41`|<>)MW92&*e| zGiM>1dSds+^~q?Hn>#c8Tioth8!v`3ANcMHSQD*fcQfgp(T$@w`X%wL&@Sx6*}(K| z2IJS;B2T?UMq!2CbHAZems5equB`Uu$H{wih)&ei@VIL9Q(6Vz2o+yzdYO*dkZ)Qc zOWp9GnUr~B)+hxIknYEsZxSv$k3$xVty?DAFE;-V9ERP=YIlV{s4 zEEe61TOoeToFACVS2=5wc?!$aF;3vwzdZvlY~IqA{SS;Q3D%@#c_o4UUp`MZWBKY< zIQaFMj^Hw|L_lC76NzgU~G&>Ne>LMS%q4OoAGm4dmr+>-7pWiFww6)X*< zufRr%yO6+f%JqKJuH5>YpXSdScbZ?d4fJ<+f4KA}N72(Z({RUii z+$eClA(7zn(GlPZodUq-LCwJy^~E+`MaNp;N_PGV4q$0w3brcd0JeHqGll)Fub6;s zjv0e1Zxh>iRaV{xSDh`k@oWcH#{Shtifuf*_PJpDzBIUoKGnT0gKGqfZM>T1JHQT3 zDbPFQT*8K{qcn8;+--2teZVPrB9tD<6_5^?Ow)^gT zX8gMi&u?NOeCoEl|D#=I$bSr|N8z0-yZs$4RgtNk$PHXBvL`6Gi$ZMR(l^CxYWR|+ zgtjYjh89X?Rwy@isiPu-yhHqb4F9zmw<`Rj@9GG0W)=8xhwZFs?i5ih8k+^rBYNIyvQrf?iN9qoB zbfkY!*;M6K?D=#`q3pEFCQ7C8Gz~9-`y_NTL!%2_E&ZstYTwU`hk9}%{aaux64y2j{U%Y$`Zl%! z(6{Z?9^8%=Rbc-x-+JJ%KblLJJJ?%-JM60k4lni!9KOgD-08|iaOdytfV*VHDh2v< z?Q>Z2-o|s$My2;@$goI_2yH9N`luj+ zPjBm6(0dmw2%Z#IaQKGnwnN`&h1l?Hyy-`9lL=zOv+1;Wury9=c>0X~A)fbZ)>>?M z`bNZo{oF{lG7tO&zXT*kQ@YQGF7U^Qc^HX&$h8?;n zP(-1wy<)`+@88q*CCl9Mg<|=_Rt+jaG=sACC`HR08z#Br;8Mh&TQ`La#ajB~z494! zk?gpmEw5IWAn&ECzH5#`Y`wudM5D)ANx7()T*ajkOCHZlIw7FTB;4kXH5SEV{tHcG zk@5v^^WzJqfxdLXdz1oRCi-?ULbApdZKu*+ics4K`DFpZFKsqWx%`2vZ)zs2{IeGz zob6z=g~#W!%b&W3M8@js?Tb_%4jvm z(=IG(e9ll1*yVc&eWH8Odzy7q8(%?pi+)cW`rBPUCzY>Y=6n|gOZCv-)G?*Ovwu4u z&;D}`B+->oFY-6fvRTgaKL-8pz0QK?w>t~{0`sW|ztCe7cwx?J=ogot0bZQ-6L`s^ z5#Xg6gTTv<%fZWMb^@HmeG|Olh6=pNpt!)t*|d8*c=NRz;4Le%ve`dl=U(vE2}-cC^C|GQv_=TO zee`(nj@F~0-x(1L-sRRCygTH31s`WmnLzMf*BJ2L=aJZdf2mgB{bvHeg$=Rh{f{R< z!f{VX|HN@lwm%6zWqSyG+G{=djIaWH*8ErSS=B`Fxtz5MKF)b%BKShqRPe<`De>%| zl`#Z-Xr`oA+j=>k!`)w@Qn1XPwFCTM!glb(5x;{U#mxgh z?lBhpr1co^)27kjXKsDK&ue{~&Bu9BCK&wEI12pod6dBZuWki_U!MsAzuD^y&PjI$ z=PoQo*%5ty;f@{d>bMUsHt0TBe?Uo8L5j;uDA>aw^d8tydKYXY$pjny-~cu;TLm^* zHkX6b8!e`QOQ&vgeHb-BAD{s39uCnq1xa#b! zVB3M5Px1Qhv%z-lAAs%qZpr42>R!jeHG*e>YnrbGJ2;I5JLDWyu!o~*FR)|QYOvF7 zf3S1LPhgkhJ>xl?>&!vm+N=G*Zo@l)C6jA{-`}EWz=!$pmc(uq!Z$p>6zB7)TN3_{ z)(aohTFe_%rbp{`e9$iMYfAo2Jq>v{!HJlxQm|HutqC^fkdGO@^G)$UyW;IM4-6Hg zM#j5)O{TZEb68CUE4zHv?>^BqLzez^QxGw&VsLxg7vK&qG{lZR9fkAY zaPx%<=5W;(aHl8VgF7o{fxDcH0e4-r*^I+=TiXiUecViNkDnx9S+oKyA0EQNXnbr> zaIfxeV$&HD!nB*oAGA%Cy6JSn|L*YE`DsTD4^!-BXHI9QX-h{ZN5~_1ah!z6p}L9X zjp^sU#PXs>flvQEg=0(0Q(YA-Lxzn7w_4W(+`4NtIP_;*aGORgz-1Glqr1&6i2 z1`c~&2He4GH@L%f7c+rA;Z?4(5W;tr26xKY1@1gA8{8#p0l4evW8iKX<5;GWTxQz#Pl@(`(EF84N{#Gq%&)f2O;9WOVH)imcq+e?6Ap;uhQ5c)r@Tm9$%IY%waT#iqS# zIoE_V2|4b|TIK)W-_nvRr3gX23k_0Pe%`mVXx4W7)N7Tmyf|v`ExH_b<;dklcp95Y zt2gWFFwXg{-A8UvxZ&S#d5YVK*=(# z`ylYjL5-!%t9*n^maD_#p%AUazScl+h33D4&C5;|rM zv;)}kMpLlWN^h|Bk*-pKJ~k7rz?D}t0auBC4X!%D7Hm60U&7(4#T5hF)qe%HZ*>h^ z-SQ$>)0O;UE4b#v=SqP-4rgbBYdzZucHF)tjs2ZY&j<nFV%P{~g$M)JSmcseQq2 zJ$r#QUCGV-!S1qXsX!l(#-}ALJ*6$AEWJwjf$Nq^2iG$^iSXV+8L;;OW9aMu;jEj`eO}|Bfr}C|TdB;$Cp435UU*pDhM=iAw`_T@;1=yCn?+cONIl{~lr8!Ln#E z{>we3;GRKZ{O?t{n^d4rL@hD?M?5YLeeZH5as1vFt3e-iel#tGLEVOVv;QdTqb1;I z1-Q@oXGpVj;yI_?vPoUff}x*G2-G1--#lReMt@8jXh&JEtHcZabw$5E@5*m$U(KYO zz%E}+j9!+Pq^l_t`t)P$=$vVAdE@xaET^4n5zlhwi-z3P%*~y&Gp`CgfySG1Hvo?# z<#DALM_OR=O&X+Mb zpTKZR<4I#UJ?G7HdjAL<%Yg$^r&2^>moIZl=CKnx>ey2^bl?+W8sB8Xy@>qH)W52{c@_{-UOJqmC#&v%x6DW681kond@k54% zvaI0oGKHnN{hyE)1)ITK3M;VZnuC9QzJe~?^wPPZr_2w;RyuZ!T<&c%9&w{Kn zJ_WMsu#u3qF$s{>y7q#!YZ(S<-^d@bx=UTi8a57)HA_~4bTIHu;p00z@r0~(y#}P? zNef7)T}F`3Yo0^8%=-h!&+M^FZx+QIflte5O<;_--_ge62Leo8k7+JZbr4=iT z`CP;aOo^0bI5MTLf^VSDx$z{JxCoiJ;YeJXQmW=ZhuIbx^tfpN9KdGnY&Z8_XCw}B}vpVyjW##e15xr19*K03jc zxk9J*@HY<%16$M=ZQ2zb>w+uUwL^GIlS*K#Vxmpk>Y-<9ilf(zpv?pV5m_I9#*V8DQUte}VnnQo;Uy{lWf^j@wc&A;9%}>>qG^EjXxD z3^-`@RB-U!R^S%XSEo{Nvf}o|{vpGD0=HV%65P7$AaLlzzlMi4Y*Uzad78(Ip8i?Yr$PdtH9kdrh>aiYzOz4 z*)OUIw_H|26{q&Z4O8q0_xvP%0skTbrW|#s+1IwvOYKiU2=+>yl z#aSmB1jz5L??fGUooL!qCqMGw`YO+d;<{^L^;Tyy+1@2o>afdSLU4xB!#5!^vY&2j zx(x*FF)WRfygAv=Oy7d+LOl)gz&I;#UN#}xeowZ4fb8Ow?QOazxw)skj)Tt#2f=5} z*MiTgmV?jb9K~_YD^tK1vQ~pHE?Szx`)6hR1im!xN3d$g!}g-(e6!Y_`9{(9e)1Q#1z0<1rvRth~wnwH~` z%F;kDJB5;Hg+J+`KIS)f0k0Y$9-z3ODt?A#)Bp z?FOJX&m`{5x%w~B; zm<@jAkusk7)vbo$*Jm0)|7LGx6&+hJlwOKwX(ZV$gZ#k~Y+^PKY%0tJn`Vyzmr#8R zE_rs2io=&uMuAIj7!5A7=$mZzH~Y0Wxa_z{aJeCY;PTM{;0m3bz~(`YV2k=C!4(}# zfGgQK$^`mY8s7z56)OR@dT1KY{??c8f^Cl80axC31YBk1VQ|&iE5Wt{1?*pK9AMD_i2zJQX5zpZqP1}PVvwjCV-L40A&KL`JIUXjX zU^K!l8eDsIU9j8m7GTNbO5i$CQP~{MJ>ezTBOnOu+4cfhJ!ht_dj`0kQ7P!Xt zAqV@p4Fvo9`GWl)Eu;nMP{ZW~b3Vx*by?LAQ>nK7m{TcFXu-EQ1dS@H+;i_wWxGGG zGE8X~Q(I``-9ykaZ!f+vimr~G899xyBd&jRtj;<)_2`$1k)uo}H+SM=&z597-c5HC z*74$;`xLc6edU3dL#i226O)|w`T9rnkBilr`CCEfs>xu!%Q}n=_Ajdba zfliC7k(Mbei&}N$%k1tQ98-iZtB&+g@O|J_M_2~94r4(J=`R2WmFf--T0IUNd{+u? z@xL-wEGk;T7Zg!yN(#%!fEEhKy92>d4zA#+L*d|PqcY&=Wevc6Z#+=st48UnZkF#y z^3~v|vG-GI(bYB#<3NGHE4Q%qLS1>|d5?vS=15GtoxFx}V|HeAGt}9?e{@1}Y-GHS z26I%SU!vBfdS3i@$o|sH^hUO)8Eo+&G?cT!jaeyDmgl_pgU{WufV^P&CX@XyY)FRw z;;TCF&zklUeCgskuqv!I`0+2+2>--jDEO&T0sXVm4U~MG=WPPP&-Yx0{-xjPyYz->nqR~G%mq0y%Sdl?F`cw__D2Fz^TqZCk7^7KybHs-lve_gBVcJ*yr)9B~e zl_#fp!ZAJQEvy4+janVG>8XIu>oT5ua=tCGVEfwz70YT}r{Uu5hGu~68+{#$OQrQS zWqhG|gYLOD@U8(#JF~Ap=}14u&WsMNxxm=O$XI!Vj>gcBreD(32-Is$FB;N1o}ntHo&zpO`+#082Xr`vQ+n<82#W2HZeO4y~(nzwyZbJ zP6L-vt$@Dd*+U%jsEIcbTzbO_aG6ERZQ0-K*NNb=<5Ixoh9rW&^w0cv_0KdfGb)vz zXF&DVDUi=+*|H2OUI!d>W+XWHT6u7b#!D1je)Egw)q^kp1CmOQN$4ISGY^#>JTeEy zVJ#D}o>*(3T7tUoLv1EDB@b`19lyI7`BYk}|3b=u*=d(D&Epc1dbEm+(OEz01iJm2 ze7Jk#fnzz}_|hTrU)~{7M1E{+`)4XWZ$X_On+k`(U-DxG%9Ahsf5XZmZ`tzsi4UAv+)xPp%s$*A4)yB)*2M*GJ+#Q?@=LvVKu)?1ICnv=itYsstINq|p*Qxjie+IY=(ka- z&^Spp>9?!QQX7Sa5@8sNygK#e;>OVrB7L8OwJq{LgyT%%%u;Iodmvjv*A6-IuX62t5WilpX~eN!Eak zZC8U$%zg%&3O|8Ovj>Aqs0M*co}H2@(5IBL6S(w-f#5QWl2z<)_G>t}?6{8Lazh$` z%SYD-SLkE|HV?7}TX^SyE7p1gu4HE&D$vK$_!8Jk?+w`M!D|`&TVK8ewmF&wuDop< zxXMZ;xa#b=VB6$}Dhi%w*J^(PY~OcwCi_?SS_iHX{0+FK`7dAxr%13v&RQ7-qyE7F zuw&L#u+wcvuye)`u*>o0p&ZV2W*2bn)wRHG!yAJolTE>OqB^N481)a{0eb{A1benU z4EA!U46f^*2Cio)W}@EK2Qzs;?;Bz!TL0B@aD&}D5WeC06mX*zDjA1syeR?PWWsiE z(`jK~Y1}-p&*%Z69IjdGF<{?_c3?lZK45=8FR=fk-&CKtvOqcXK~8#kBebzix%fNZ zL_u$4dUtE?>lXtn?4qQ}t_)q8I>!!(i%9At@5!C`9_0O=4`ufPJN|sYE}bZt#wa{Z z(Fgnee;@o@r`uUGz7g&TYal%uZ-Vq}`!l3hE%?LfR9_dNy4T?$zxeIHKyW;K;_yQ$A(A zUh7!;G}iryLQMARvF=>@iqoysW8Jwkz`cn(eb;HiiQTKV#LcyiOGq6FHVY1cKmYC1 zqb`Pmz%E~b92b|U!vgsix`n3Xs&N6^y>X-JEN7+ z^9RO@L7l3;In@$0-rBy6wdpd zKelTx%L`da;ERj;L!Xt=0eop(Yp`mjH~4aN9q^UmR^Y2a<-ymwi7$}4Uh4_?MnI)A zeB7Jm%I;-(tL97atp|_5w+%0VZy!Ag{_{o#_|D4p;Jdq1!S}Xi1oHm(S8NGqnLR5N z{9wW?@WTnfaf*<#Y06%Hn3;eWcbMP}afAI5KJ@@i)o}cRneo>}2Do`(tTV%5T z%jdx=malHPf?uC;0l(Q>2Aq>#8l1b}K_e2d?Wr z1zgYYD%jgP?GEqfePb86{;Nsg2D=x48=g-BH(IfC7>8@TsROvlg!$m6)4ajbxbMI| zqua-DxMr>Uf_)?Ef&JWCg8lt0!TyhizvgfOu3p$b;J6GNRH`C4XmvAi@SPXn7SnrR z|CXmLuz$!fA8@M`GR!vCUh3YE-stjyf5t{1@n`Z8Vd=O=l>2q%qT=urE-Eg};}!Q0 z@5S~R-o9{#2b0ma8S0E^^YbuDYRuVi$7?I<5okqY30l#hvQ{*>O#L!XAD$+G*P6Yz zGI@1hP-c6oNV3zmAYtMC9%0D|I+`lck{+$5u@^nIiiGnTUa*v(`Io_#E#mn;{5KD_ zJuX#)9!U{)ebdOTNux$0R zx@>>LAW2?c_r1eBzwHozZj>Mn^UT+xOVHsM32yw6*;q5mGlEBX+VJJk#k_Nr=j9dC zN2*UZU!IXHkBE$kOV-uEr2J=m@^TuVF&@bK&Uoqf-?TeH*UBzm1v*)t6xm-Mqa!0H zPa&mzRWx$WnsNIAZ3{;2m&zay{hZ0t(q%B%^2jy178(e7`<{wrt-W2L_X}$)WA?Aw zLL7v{tqmGWR-GT!hY!R#v}54a)pQtk1#ZC*`GDl;7~Ks1XPW^#D#3DdX_+(BHP_8+ zR*C!sXN%XkMCSoF-oE#6Z7sg4b$z%DB>Og%fi#*5?>%fo<=wl-Qt25y8n>2?%1(P~ zR6z0&d903}u=?`wVt`4N%bPa}D>nOs(?+xhuUtMIysAZf8Xtf4kHf)hs&9gR zZLAEu&Rhxo`c}=r>Bbeo8>;`Id;#86`~Y~i!iM=yZ? zys-;>XJrQX!G!rTKJLR2<3d?Jiu(@yxJN(mlh%E~Pn(8-pSiUJKd%*y{l7F~zw|0_ zj{6VmRnW2zen7Wfp`F7YcZk0cIyZNxj0>kv-CJQ~GxN7@R7|qdE|ml219es^_oXPH zRq3de&Uwkwp4$~HS00~&ykk|8n1}D}(i?fl-s5egtl!@-5WIhLeX8V4aC&R- z(VZp0#~MBXAD?>{e8O5>mhhR(0Q*17{Tj!6(by0C;%YmDe|f$k_|<|j(7)cb2>fPj zA8<~(xC~@IMzK|8_v@mHjzCBxd~P?iQ>6_hLur8~ez7J*V` zW82@s#?QV|GMfrx!KT@LrOYK%(cqG2$0(UgDO-R`Z|DOqvuY05?CWV#)|YK_JCmhm zIl?*z!J6d=yNm*>mm{p$FaoSzj?mJ&IoMLY9O0{4V9j!b=S{(yNBokIC{yeglBROd-`->e7c z^>m5`)4ZO}wb(zer}G%X=k;`oJ=mI_&fZ-RKCdTpJUF0wMeG-FVG(4I{tHpA4uwAW z>UnUB>HQ&F9()G>kZ;F9w%XbXvh^SpWav*%L-STC{X}i*BHQLPw{kCMN2{nUTCgb) zSYXb9SKdwOx7(@WL`r@tAK&He{&50G&r`j~fTQ|3>v1?AVW(O+)v z)aQI3XJBygl2mSU@Jw>dAt&=8Pd(DSNV>os(;i($h5=1Sb5LwVH09lHZ)JR3Omw1d z8Xq<3SB=Ph8E3|k;lFyES#{g79?!`b!mdIgk*P&&oQ_(s-RRe-#r$z^mMZGaNB=Ev zIx09=@%GW@$WZ?7n~v0PHv00WqSq9a_$8*6@sR)FHx=a#GHrwN(Y(p$y{(A9@%A1A zDpu$%p8L5#$+J9Sn{42DV^g&!1!|8<{jm4$gt)bzRgWyw>?+bdR*!E|7ds*JR+3m< zy@t+-e(S}j8cq8 zJVQh*g%`aq+I&DBNv*%Sd5vdv)44!1(6-{ZuLn@0nVoqd5vW7tK)H@04>uG(S>#cd zzW;7%n3oOs%IN%P#g@F%O{+Ac*9)XcKfyElphRBkZeo0GO5p4YOXMA*V|(!nly%fj zcck0!$(~cem&?BQ<*&Lb_6olIb-+y2sy_7PukVXzdGRPO@pF87UvYvW$?g;mTuM#swg%X{gj9I36#DE2?os{c0|0)<7%qRS(Wi0VINe0s$w z(_4PzbHzt(`(z;|r7w2LMC4ZmTcLmV<=O>Xp&y>V`N}Bq=9QC0%*p=G%zxd#*(9zG z*(BL%_fH1JCJ&6((csrWx*M7?H7dha3cfv>^`<}j@(Pjs^FsOP2s4%yIt8#0%!9;9 zITrP~bf+BOu@>}|?EDqXmL}q)9IIjuV5^5UQ`q17iV4`}m@&BWwm-pDR*I8ys?I(H zwjEd*$E!AS1=y~AF4(^BL4iNjy)J`m1TP2IG~WUKvQS{&LV=p>SImY#bWr?)CH)+fiZbv(M9HtJEw(YvQA?n*sn(2)`rJM9r`K?CG5 z$+}u^IGCTQ!~Ff_e8yZ$q9Lx7-e`y`r8nBfKyse!LH)Ee*@Fz~l{oET&0y-M z1WugOmQeTH(~m6jDMOlX@Z1#-B)d;EZ1A@OJkW{Wdb<;L_G8xD}JqH|BY+sLci(x zO6WKLd>Z;KXRkq@G1wIPt(z)Auk1Vlylut|@b-o~5Prw-OoZQQ^A!4Bvf|M1%K3lx zW@e|3N_r-O!ZY zSCeCD)9r7Lviy3i`!1G6yzb|Y|=RfgcIv;P3w4y-TXaMea00NZu22HW?&Wy}86z21Op1n&pe zG`|FPa9Rp>$a$5<;T%nW1UqJ31Uuc12RmnM1-l#{pGv`K+Ujg@?bWehx8dJ_C6hzJ zb)r%w9L_z_9qbV>3hddg0@%wT0$kVqDY%|dbFjBfd0T-#-ZyK3>%V#eZm`D`-0=Kq zaHF)EX&kQcrVZdGDaPQY)24x?aks%fqt~ZWFq*b{5bPWAE7;F%IoRLtE3p5g%M!G2 z3xC6aq4?$jBNO9~`xAuYUvY(Dd*mFB78IX;GFxGMl zqHVlL3+qNw)q!6v#IG7szgWws1%Xcss!*8ncYWq}SLrWZ|6%7jD%#mu(+yDUefJMsdu(3fGrDiNxxZVKjc2*PR4WDKnE-H6 zJ^06yPh;%a@p&c)cP?iw_RCxIcPjYeq7>-=u5INnUAFbAWb^r{M*#d$Q2?vg9=rYY z3iyME^HdSfPy4kgeEj#>a6a|Ofd6FGj^d5*<+UsKv-v)J&eyJJj1+~8{!p8b-wyqF z+kKXw-Y$x#-L>}qZ5l-K+vl=F>st*AK1dZHc7jpPyW1udf+K;6g`rROfE392!)R%V{;4F zj6SFbUVD7AwwZ;;HTMW=rJJVEm!Zv6hxszJ`F}Gb{5LwI3(p+h<@Ye~ zIC532syggY+MS_L(z)tgOiI;-j-Cijc>PD+UHqp8kmL+E6x*7oid4e^Yo&ug8{ z&#Y)w?(9)k;F(jNX0d%~^@zs{(z>$yNyQTQJ6*5?s$PYAE?B(^cP3c93U}EeK>YkZ zc@^&ecs*=KJ^GG5y&m>~Q#S8s^hff-vc*kvkBa^?jf+b)pW3V!JTaKM)j}%yNgaBo&PIJ6CcVjl;%b& zrqZZY)W}jwQ`D8BsE(GS$&yRGf7}{A#p_**XC2C_TPZTRFgi7bBb7hxD%`z+g8h|M zw`M3gmMB~0Ix&Tx!#`=2YgNSbp&0P33e^8+)vd(~QN_oj1Sb!OPmK;u<)IE58t3r0 zm7}hX`F8vhDs8YSUXBW(6*v+#REum$0fEa>D0BSyORvEkQ~s|n$s$z@l5z}TZxWKt zs(~e1cs9rL8JuVMlto&u^jq20oW2e=#p@eGXl9OtbPX0uRYj@9OdAxnH`}(p&W}dh zH%-o3WsYYkYt8o0l+dHe;M(@5!L?Vl2V2IBld!whwji*z?>V?T?7Ii{iOdE2dL@GW z!jlx_ohHJJl5+=`iuA`_URbHQ2j%-^`dnwR2-BQUw>tWic~m;*xmEjcN2e*}NUbtQ*dckg}e3 z*#tg)yE62w!M$9zKf68w?&n^b!T$Wz+u#f57J!xE-rz@*tHb|etv=u zK0wCYsOoXJ+vM&5+x9#xRi#(&uiB@2noS%w)bo;wRSk|GsIMuWLcAR|QWF!B(=<~J z^|z%B^XvCMyn-Gko8lz_ninB0F)8u$bPaX9D7wL#{DmZD*4fEAZuVY3x(=asNRo`T zj#E9FZk?CJ-i_Br|0zK3$rY;L6;|h$*Qyo$Lro%gVx=D?>)Qsc{iEAz3WIEF(m{)= zib7)2V)`bhCTl1tO6XLopg4EUX*n^?+kc-$FzdZJpY<w(zC4>F!GQj?R;;6z_x;?=GjUC}0@NA^O zTVTby;J}md;5L_@f`dH9QtbM{KdK>~GnvCA#k2HsDTb}guT|A8nPb*J9aTI%V8-~O zZn1iF1?qSFMNC?sm?X^vQV%*4f5&?K?fxB;aq+WlQOSz$P;fDN%0hk8s)1c!o&vXg zEG~QFw&oDnJx3>te|T*C8SFXsHrQ+GFt9B7H?VicR0Ui3w95he#ti}c*^LML`$dCW z>861L8he8So{iI^-RKiA0|%b$2X1p&3mmjgtm_Is*oeIeA(LCcz3mcybb`=spaD2^ z%vEsv80Reh5!Q!#meSV2yFNHPn41A;Z2^f`*A-zi2HZ&y>$)QAE>N&Vq*AQwihBGF zxO46d?BC^BA8^-&VqI6a)osDuM~ih`(G#U$d7@a?6*DwM;H^hs4_setcRPVTWc6fd z;*@9~|G%(snmd2zKmQApr|lZwdCbo8g23jjG>F=Hk~OueB7fe+I)1O9&{QW0MTJ~$THr!1{}<{YBSzV3WX5=`7&X?T z6Vpd!%0@+#p~Wn6=Pvd>R4lAD`=97l02k z_+V{(kRg+~Hck-QE`AJdH?S%=bj%5G`xtWtTZHvl5ANVy1sonc72HvB3mjoH1l&nD z2#%~fC53jQEY~t{)Z@Y6&bi~jU5<4JcU`!Yy$Rh`%fQ`7XMv+9HUi5NQ^7GqJ@ffT zkHBznYK3^nkn_ab|wBRPq~2OP5JxDn8*LeD!6d^?jRW&5<{In zX?TnQ$CV`q#$YTAM#X&WfS9y6k7`O4bH6QM~{&1SD^3aj%T<&gK_`5`#(!E=gpH9JrLifLak>Qh!a(!r{Q z1&RjtzFAnnQpXkUs)Yq^8i7>{3mkEg3ACve7FcNrRxK~JXi^Vk>%_8hwk>@~F& zSeE=F*gGRuCeY^7ZXnn<&L8Y&*BR{ZXAbs%I41Ao%cImK^VdlJqW0u+Jbf&WQ+sLv zQ*|>fzE&~~JjRO2A0C>xj%f)3o42Z5l9OW7H1$c1rzfL|g}a;HK~GJ^{WXY1 zORkHx(cLAFW7&Ro@zXR`1c?RB7{UCU6>-*rncb0+o*Xs`6e_UM8N>l4doi6xE&i8XBw-e6y@2)F# zxqAg1?~28%P(E&H>rCCKcNynXtuysxH(0gK)bR!2JGP=Pjs$``z0t)B zVB~Vs4~q-N|5c zt9ZDZ7p#_(H>!UK09&4)1h%?q3I4|~o;*48ou1obJt5WoePo5G36h4z`@6@X56&L>eyYBqhRw^9V89Fj89FC*U)?`p7g0v znj_A)!VQNUw|vYJFSO79UIXJlGH3m%`DylFSUB?$hlls)skwAoGB^FcoOJGFq4GW| zd$M_}=7Yca{)ut%8tN_V&89M)g{h;m_F zbl6wQx_HMJOiHw5Wq-JDe6$+8Y3pk6=A)CqTV_lGZ(TJAoI7j~c-w?7;O)^}z&nNv zbm8Of^zs1j>ed;&yFml+9{n)z-pcM$_P5W(6uj@cDR}?4Gr$K;cY_a3>}kRNZdd&Z z``>=x48G&v27KqM;}Uj%T00f|^o0@lRe>k=fBmE;$`-V~zz)rVzfGuOB_46GZS2-Z7w99+{Y z2wZctZ4UdZZ9fa#a7Q@Y8<`K3u)W#L%WzkFO1L%{)+6W|_jL=J9!JrEqY(g)mT zuQfPmTC_}{EqFn7aL8b9aNEp#;C5Zjz@eX43uS-p-L=4Bp?AR@jIM#hrFr1+m-}Sp z%D*%JVFlRm;NeR2C;qQ23R`^49~Eb)^%?&uaic;F6=#0i%RSJj=MpUsOa&bJfA(a# zdMM@?)40{^O`o%q)9PrD5e%aG69+md)+)JkpX?v`uq6Zs2x_4C( zngV`me2j(`bY4tnQl)jNcL(0)U@(2%4=JoOHr$f4W@k3r%Q|z4ICt2r3EKJ0vpX)7 zvCbLQ4LsLkApFnk=>?u&t*w&X7qn^!UT|9q{>6A-3fup3ECl`+y;=lbyxI=D!Je2d_wI1NW7K9l@&tY{09#)&;LIuK`}`_7uEMJ0HBhN$q?- z|N5(k!5b?+25!fL705o~#WF4*d33$XQ; zOt8(7a5;ISs_%6rN|JwQ;qwh&^{ zQ(#{fH3sC<^P_3ct(2^F11-VzT&scWTUG_@H?owoyFukUV8ilN!DTaw{byzr6UTl0 zE5+_V*@xyf=>I2i8OLE9mvP@3YUBF2xXf`%z}`H{sck%0W51&x-#8JbUB~CG(u#OTlxU=fizohyD3% zKfms1@B+uh-~|P9;s2M~--CZSp9x;{Fa^ALOCos5kudPm=|SLSE1kf9S$5s%R0?0; zJK6Q!tK@9|cV*Z2KI??@?XNDw_3S_C3jV9J@u!p{@f?e?@n>@5!GBpczEd+CPnC^t zp$9I@#$QOG@Fi4|ZkI#nlsE{xfOSpJkula{o`~Z;1>syNeASjrltgbyZ1=jy?aKYJJ#LqX(lZ-zE3e(9oxFI*SgO5({CpJItZ|*U^4? ztg8B+m{1w>i^CmrSPRyD9?Dv{AY4Yr5QNDcLRrdv-CV|6exNhB!slVR%oStW=do(F zcgkhe_I3nUvabiO^j%+Y6}@NRDobvJvOk^t)8MMgQ*f_#>Zy$FtLJV6*I0iFth?|e z{OkR+5nOZh25_xGKZ9#0P6OA88V0T#I22sZH3nSYQV!N{G$dD`&7g`8*sy#w*syFt z3<*D%|J;HYZ_mwKg8qdSG1eq;Mm6p(|BnylPNe!c4=;3!MD`K>z3Y@l- zg>6ffI6V8O4`pkkNI!i=jJ387Jug#@F`Kutwlq^gQZEgSJ29tMNfAxaWIge59F*7T zx*^Q3d+m_Ly#9Vu3G0UQJ?UBSv?1Bx)3ev%sj_op@VviLa9+M9x(?O6-=7dkuP|HXovaDRF08Qfoeo1Dep zqRBpmgw=H5K5&C<^K52`<2G=^;aw!mjjC<{n?;t-W;XkyhaPK_7MHW3N7sW}JXr^J zSvLUedf}La-Cb{#!~Sl2@59|aS;%^;%vE~QRakg&8h>E-^LfnOC8dC=4yak48|l$7 z@8IcBqHp`!W^1f!SESAtWQwl`&^9?Wtyi>P%xB4IF?K%j>3w2)X=YH8obH)w8O4zy z-78kh;g>UgUQ4`$85=7pn6pP2gJ({;0seJ#HLyCt(5L&R1mjt{9_!2Nk>FP+JAq&C zZ3!+|=L#-dU`(f^ZL$#_e!0v7VEF;B!4*C?RIo+G7z4ZvtO*(-M6g@3m*8~Jd;Up;$;|HEB4et_*@ z96#X5d~jg(?%=?cqrq+N$iP9<=4SDa;Nx8t2;`c}Zqf+)?1>yZ&?>1EJ5WD9N`B}! zB|p4wD*qQp-P6#D9JVFM2`Tlg8l-4)<-aAhbJ)2VF5?@+-DLz#*aY+op z4sBv=4sBXZA8M}Uo5jaBf9wRcxY7h_d8{7PYF8zw^{Qu3n>jb2wi8Z6n`Qh8wM*Ls zmBuZB+IKsp$H#R@T?KXY*a&qB`w{AF@-wu#!$47A4}-cGO~~T?T+YRSU0?PGx7_Rt zb~_UZcApmw_1M@F>N(0A>NV9ED(h(m_0DkBb{&p z1kIwz9p^rEPM-?pX_(t|su}v^VQzm~G(NiJni-Y81vWLv6yUL(jlI`7>-NpO$*r)(|j?DvmP3-}eC9eQ`XAF~*cbfiV z0@yb$2CQD5&ll`Z?Z6d3Vg8S|hoNg}zs+<)+DaQyAl9t$Nb+*}wo<9s6PN1LFv@`H z*tj6gv(J27&)oaZP4;o!C7a@-3_@d4DI!Tt?4h9%w4790cViYVeSRP%<=5&`}&i`2I12 zJJv0lnomb%Q#`v6+ABFeDRH1?qMNF8GQL+tmY-UM_e2P85)^8;v5iT$6_*y# z%rmlm^Nik1uHGP&?{!+z=dZ|KFfeMB$7)#ao(y{bZYZnK#Y14@LwR76Z7ad1%U6IK z%$x|8jGF*f&uny5DbQxtdl^(coyIt@dOD4MVD)qw9l`49G+KbIw+xaCw5f+P`j=nDYUx~`eQ}-Z|`mg4oklZ?qFOK z9Nuv+IQ->9aD?+O;K-fSocAg7TTqvADF?nyejMy*loQQnPboZRvk&EPS2Voo<071d z{R!7b2;#7&x}?QFwCLoX(H&A^5;fE%lFRkTfY_T_u z#PJqbHPKDg%iz}XVelU|tYYp5OO?FRLN0yWB~wcAUD`^WC`l-7MNXsPwhOKY{sY54K#gXYrX))2>sqslM8d?StSiRCN=$(uI5A z$_2H-Rkj`i>zsQGuDal^ly(!UZ9W06{&gO>#?R})y1iC_^+p}bC2vB_))T((5f!~W_u{Sxl=?x%tEwY!1!4@H0tu6ltDm%D(Ce(x$1XfqyX2sT;f z2{ui61#U1_0+tM`AZ33Ilgon}xxNIOwY>~(Y;X?T#6`#zXlwF(E4b-{XJGSFGr<;5 zcY-aqZ_Z(VRww3xt!K>u+pPT>Y&&8&xY?xMV7nf%V5uTgCeUW@;}3R_CxRV4PDt6_ zNfrcluIdMFUVR<7h4wM{cM){KF27cWyXy_>T!FThzuW}7?W+!U|KgwZ8}Z+pmz3H^Kj53OJzV1aQE;@=~^MeZN0A za8ok4&7nwe&^iJBgO|4ihwQEd_qL%Uas}GjOp zqP)1vITJVrnOaVqTx9Bw4Ty@SuM;bZiWXJap6#Y!e>>V`QGl%@;kVw zL!FMW9IWn8_XAknp)MV)?oc;g;7#43E)A^iP!|EN6BPih8|VV9=V}S9Z)phCZ{)Aw z9|o0Cs1*#$n}ZD>=tGVEr~)-U^a5(K?H1H@`B`X#nFpbg{<;Eh4TmoSt5@hc0Q<(y zN1*Da?$uy(t1MAfi&Lb6)r(VvgRQqrRPYa*BPmeZ=>wq6R)#_ChDJf9KR7|v4I1^p zjscMZZ|V+pEy3yr4P&rsIjE}zVAXO^yOm&7hdR}YU_ZlNy&~8!uzE$XsS37GuLw2- zTyjM)RZ};nR@YEt*N1YvG@$%82Pvw(qo|WQ#8A}9^ZesKqD#yi&2@NOmq-2OKCZ9a z`3tS9n^U=hO&xj=MOntMn554VlcEEY`owE!z7VRJQ|F4WjY%RTiK+ z#)8%1(jTl2mpxMWcqQHe_DXJ;|^R@c6R!DzXG{T_<9a)gQwLe-##9 zK)b@HtUbK_$GD)OREx;w?e8IhdL3w{;=!42OPh>7XRSuP{sD~u)7LG_VlEofusXgS zvRrGVt(9!Q*54kyPR|Ogn#V7{8hB$3X$t#O&Et2s7I^des&cm9o?03E?})ht|2x~? z1n+YB0q(o)4}kYHTn6{OhBvVPKAi(_-}mBI@cx@i!KIC{I1)QXkI#3sL$bhntm7r{ zamiWm3FlqllfoA8sk-yQr?(*--Sc)v5bBfw|R&jp`bI9tsz7*&OzTDjwe8sXU_-a5KJwDF0TD}77b#oi=^#@JBx31=cZy!GbzO(zV zUMXMQ2YcgFAKITUbJn0_^9^k16qH#ImzgNml=D`H`Vvh#Ie|m{in0WH^!2D?u71gV z($h2)cfFMzIQDY5g3er)9VoGoZdrC<7QTzp7Va&UO)r+PmlCSp@liZGP=V_Ac`KRY z{#UaDrL_cwB_>Dvq{bv^s_wY~-9tq(Wi3JPyl(m|{+*Vfd--ACyl=7Eu;hN!|3O1d z2_Ez+IYmdMQ|h!OIh?YTEmk`N&*9mBYO&gq6MqYZGI~eCI}?AGvRG~L#c6rJ)-Pru zM;f>(M)L8UgT%#ZwWv;)epLWrnOcg%cKjua)$Yu{^0*V#c(N&8RnQ@ZTbBa+#q@~R z(EQm{X{^r27WJK7IH+9;fBnnuyDC`M^o#?qrOw*S>vSIEv;KPXJGiU*>ixVF_9u*@ z;P2$PRbW+>X>LF8+4C#2dH-_@7iY1a-!c(=Vf6Q4b$&1ftj-UHfz|mzC$Ks{*j|s1 zr_K*Lf^Sx;A?o3}P*whL`BO0G4|%`4<4!^EExVh=od5Yo@cprQ;0MFDK_4csfIfwQ{}?HfDa z12<{23EZ^qA+WjCbg+5Boow<(^EoTPmgj#5Tixsdw%)QFY;$C27W=cE{sXw#N;%kW zXgXN>gAdp~VZ4OA2@d@lgB=6Xz)l^s!OrFp;N}k3!7VDefL)BW^k_Gl1j7*Q`tlmM z>Kwj*v~E-?C;kX z+)8%@IG}MmaKN(}5`nhBiuT~Zlf%JnF4qPJc`Q=?d_;ss$qM!v6-NM9m zDV$1ax$M>`x>FlUOWBlsjfpV{$U!>tMSOVUg36o1%Eyd68$sSxIY{cMfgTwDEj=}k zoE@9XpViU&$E2)fJvPdEZ1C6rzusdbs{URnKZmHXzvZ%ae)%xQ_w(piU z7~Fld*kdU=ygOK)DE3&2agu?11d2VDVokcq1lr;(?!Bi+2$dx?*&XDaW20jTMWr9= z9>TqC-`6q3$d&i>1Z7J8gb-CkuPNpXr`$PK62I+Q7Yd;~e|<*f|dSd$!GoyVtk^u&mi(u=l8EV4wP8;mWuDcChc$LlW9u z@DJ&b16AJ1W(}x03hn`GCrX%ARWFkUfZLqTfd3$cShxz_&=VXYPtRumZKt#bw+j>t zSD_>0rEK3`;+oAG78?NWAQ*weeJ#P^H^jnKgjrQ^#6Gcb677|Jl8(!gmDGfd|s1voZuRS(4`r^ff|F{od9 zQXDsP{`Fbf&h$Vi4=s+BnyLua=O2s-RAs|H@xfNpY(eC-aw-oXpe6F3O4A&lf85nZ@Pgd8$U9veBA) zzwo$7nzHd@=U0eOOpw*0ssc9rt*H|HUWqBG$*~$*wIznm#IXRHMm~1LdMoi{;FjYK+?M?)?c+LLYu0;>fy>@b$`{H zV0C|06aI3F^;azfoAo}x)>L_V5v=a7x&y54uX-Vi{aNayvIv&vw}Gv0hJ&rQ%m%Cb zt9}Jm_g75-tNW{F=<$yKpC*7*-O_YmZ!`--5@ke6XXBz4$)qze^g-jz3^j_OvA7UMn>G%`tucHmKSye4a zG2$E+|8p%MWz&I6=o|SDP6u9ItMotZ%9TFtPY@2z=iob>x{actf^q`XI8maxVt5Lt zsACo7s1qUmHsN56W{WpX7SvktFU|q}`93SR<@7k&yj2gA7VQ&5Q!>WWER2IR(=n3U zG1%yFu-4>=%$vQm4@XoI1U8(2sG_p8=r+l{k~B0Lb0eLJvvLM}d)+;pZnIANy$3o0 z{XFL?MrTf6H*^f!&)9H$Fl+Xjug|j1bSVsGoi)**E9>lxSKv8mFTr!;&V%Q5uMhw8 z{c^zzJf4FWHl79k#pDclQN;}KqSu?ji!b*CFF7{@y!7CR1ALxkn}>sQmc)UV&zs(r z?N@x)3cPZZ0=%lP1$cGO9^f@0I^eaf{J`sMZiCl1Z3^B{uSzfL2;MS1qz}7q`CWSf>(E1n-Wi zxsLtsF_;M6D|-muSAK;B+wYeg1MmN10{DQi7OYBL)G>Z;ByQ6!u|Y~2=Il`?ZC?E zF5rua_TWE;8iFqc)&^hh_6mH(;xYJYfc{B7?zLJq_p)AZ`T~6Y{zLFh?X%#UhmL`7 zUEKn{y?ibB&hBjR-K|?%^ZxgiZH{EkpOFo|KXwNA!LSkFhsndikD}wikK4t9pLn$b zKeh7*KeOnumyh#Y*Btz!vLE=xGvAYJ|MGfM@T-$ez_0gK1{bWW1TLI^b1#J*L6~&o zBulx>1K{!leg#)ZxzU>KE6QndciOZHqUwU{2G#-Bb9oA` zZ}9}I->6P&K8``&05ZlQe^ z>|(U=GVkYdbqm<_<+tFLyR*S=XZnKOmu*gCe;ym#fj!600DDcf2g{O&gS|7_#<4%2 zcCldJI4RiA&L8aWR}1X_aKIz>7hu~A`v)9}0tZ&t0|%~j1Gl;T030+e68i@q*Tw!J zgIj{zE{j^A%G$q^CokqwqQXF1tAs_divNGZrP8PEOYP;qP2l{-**QFrjeb|A-zV`K zGc(ceYOtZS`Q~-8t3+GMW3;8AZM^OX)*taB3mvj?Z0RT^#}5}LHcZX0$*taON~FO- ziD_vXN`tv&s5}|Ey~4sDS~wlx<*=Rj&Z!CIgOkRTUwx>`MB0;0iR%qck4@B235c(i z%3ESb;l#{3IegvYukN9CL7MF*k1w45(<`IP$9f(-OJ8X#dS`Sl7+>_r-)izniw^IV z+*ebxP`vfb$31Exr)R!H@-ff6UeMw$MbEqzJ%wWVw1~u{SXwJUGa1p6PyPCvr;fQ1 zcTdJspIrQ@2YukF8=o}zIfb49o3}F50}^|tMf;|w(gYwHx{vzw%(!7wpRa$^>mQ*d zM;et@nRcW<_lx@1NAeW)q`XmIm%dV}+I-K*8n(YX?pL_0drmH)OQw{ZR#%~T^F7rh z)EqkHI=_VXS8;s$*qRZwzxZQ2osvy$GDY86czgl{?Sz;WIie#C-g z%2_3A!>&_9SsQ(^MagRBJ_PL7Z4B7&_};uX2}@z&Qg?nJ>T$?iAS@ali803|n%g^8 ze|lsOeUWU6*XD%xO7Ekgu|$pN9#nDJRK1P@&c=c3-BHlQ+tLq=G%iZU=i!4F}7T=YYL4J`ZJoKJ7+(;*Yk@un|!1z=u z-D{{=znC6_stF+V?!em|>Zh;!A%#`7aC>Gm*)oaU#+c@c|og&;03p(;9rdQrLg@k$3ozL(W^z^#jEYWOU`}=UOKTRc-f|8 z@L#rYdz0GveExS9ZvXu*uJ7+!xc#qQp#8Mtcs#G71=`QnP6PjC3$$D6;CQM9+G{n% z^D0}Q{Xz=!WpftK%jf6u-#cgVJzSrvTi4$(XYrq>BgK8ZCu3Dg>Qj8Lzv?&5 zE{*~xO)*8Km-TNZo#H|!*7akBhyDp!0s6i=?B%E~47PN&(_ zHB(-ov{{|cE*l9|HWG?srs}!lvRP}aU#7>ZyKt$5Rqv;9;F_bez_kYT1J_PW1=oq{ z2(B9#4zB0g0$ks+Iat3@hb)0MgDU!9!}8AHvXM|?XT7qKP#+vw^*4-!DqhlfD-Pym zgwr(CvAC?1L8Xn26(6J2p_&Ee@(J+fWqHU&Z`rvXymjmfaPFL`;BCnhz}qv1fOoX( z58fFU4c=uJ3EmwtIE70!dvsfZ_u6&`mz6S($oaY4TXq=FBY(zf@cpr?zz>E^0zXXt z5&S565cqMsf#4@zUBFN6I)k5C3{dj%p6j}UUsR3)zjzjz&-O2`yMbSwYzcn7*92U! z&KO)cU#!&-CKcp!T2U@jtkoz#KnbppQXpshvXxQ(!1GWqAFvbLq|G=bKcA*`%Ssvi z9Q^%!Y{tgAS*)dX<2%w{ zSHkW`y({an9_x4?d|Yx9e8Tw%_@r*}UJG+$`{)PaH7-{x2pL zO&k#gz7$wAafBQAiltK)ANOiNq=fZat)ht|T7s`XD4ICJ7<^MTaYO<5wrb)CC0IRi z#H(yRo_gYl^I-MF5xHRX#1XT=>WL#V!0L%3dV>E`6Gv2*+{&hRFI3U{EsIr0IG7F1 z&jD9eE(2FPbx@D(%Zf|O@jU*i6G!+zJR;%u9ANtm-gm%})!@MDeZYY$CxP4CX$uaT zwlbT%3&F>GXR(G1o|w(rc1x$D+q*}B!}{xiI~cox!#h3zhrcobM>rn^ zM_g$s5on7vy{`w|WekogI0EiGrvTjL{AzI53?;bRmPz35aofSs(+7d&A?LFN+F~*% zX0i6L&CO#&0De;sWBR&|GragwmTdc=)5UD2~$8Tfk3DznB*=o$aNnbzl@ z8#{Lu3oKL)(JHT9>978yeq_VrI15f)@hQrquJ~j_zo{LA{!<*n^9msLH9RwlbHN zt14L6QOfRx3&i;-gvl+W{LagLEjDqLA7}us@OkrWwyzi?&Of5nULUOOT|bBID@n!4 z{wjUf9$ZE5EZnOsIf(sr^0$DiDmTNu+Nm=V+KtNMGr%?0ZwBiw+ywu6Kg|Hw96cRe zYtV3T?L-B*PE;(oZeR~^Jy(BleM>*EexsOdfi{CGO~HoceZhuhLl`CeTwJbM;JLWI zd<<^6M+fY7<^@{^NSeASf?47YTo4iry!vkR7xSzm&c1ywj zeqVz9A6}HAhwTRjFjBVZQ*%v%@Y`_C6AdZH|0z#|!XOV}ES@u>-;^^VR|DjR-pUD4 zzs4Z$+!(|KL;ml|{NbJ-CjBplG^AV#o7!~qMOmY$_&$A-2Yi;KvGqL^bTU;n=hx?d zQ*y{H*~>b6^0+Lv&p!N>f_2t6*TJeO4tnng&vo7b_jw(z>9N20b?1T?IPL>4DA+Er zeQCY6i?6pp*M(lxtm-ATUS=_?m()53Rxhcw6|7!TYbIE|q}E8VI`z-i`v)KIs$h$d!I|K;Ydpd2x+a1{f0TgRy9a^8`j-cHFt!DUcf1S^ zf29kKaNZ4$xMHIx&=zTWiA9LqRRbJVunXLIPCmHH`T5|k8Hd5$wu}aMk6Q(fp8gqF z9+H>EKVmX76|6mMSAb&^62WoRCxGJvg23^2`hye9ZNUi#Bf*K4bis*BT7r9Dy{~wy zmhA6u_@e5!iP;?E{#C;w7L0t*qXEU?Z1e<*QE5i;)Y!Dd*cdzCn11mZ>MqU=RFp## zhddRS9#GJ4q0MP+32V^U{rRkI7fzF~w(~uR#~-QVreN+oN0+Zu=(4_!jJ4}`CJNSW zKl)2qyT^*3P4vKQcV>C;+ECV*$PwTkHa~%5UE;uTm6r?e)U)yqyixwYq99D6zKgsV zm9^AGu(r3SX?f_Er>#qgy3C0;wU6+*+3+P6dzgMP{S!4b-mMayN%b(VO_L$*coJ{{ zX-PrAB68-3TL%v(XwnNAbK8Z#fZO>#%`GS1K3ntFgA#K=prIIVZn*{BHZRI;Ep6dx z+oHrR@2zvzdou0B#(+%mTTbswU4i^MruI+lqp9&GeBb5CP`-nj5jXWmI(ptoE@!^x zUS2`>M$XvAWD6DX676|jC2M=Br>(uT#O+k~T2UvD4$7tu?N#h{LSkY+Pp9=IG*o5V zh0exzQ-iO3uvR_1#i_>z;*O?mvIA#luEL$2s3tB_`f~esuz$5;DD?Fnac2F3{y7Rh zPT_nv+`14kUco=gWtxD?do6=jNO4v0kBZfe!CIk4V67)E&`Nf%MLli^t)hED)YY$` zI`_6gtIptePvQCGd1&>aFQGNoi2d<3>ZEO#%->o0gA;np=v`&HT|Cu*IE=3jSevl)rykSNY%$1*`R{ zFIWVdC36+5wiCLt2+h9BRIu8md9n!7zG8}G->tKP*&$*Si{R+tu3&X)-iw8%j5AfR zHm}!)MQHw7P_VXmV#6Z1oc%+=>N@`hwB@FqP`9mCQ1`hP1>QVnR0Df{wFB%m^e$Ky zKNsxXJrC^Tp9%K$TmklLHXG`1Isw{BD+ulZm6nV8RD7?kul)cHJR!c+Atp!i zD2jbIntdxdeJ2wBNZ0Z>2mRv^&XIMwDjd$edC5R;?qaUPKPj*?*o4?iX?9wvI7zM4 z&ap%caH8#^Z~0}iK|cz0f*2ArpkK0vnxyz1Dv+T{<-)>0Bn}GtO_6pZSvl3+h0EWL zmz%5NWoJ)Y=MuLuu`3I2&`)ZL(toXl zE}je3xi?qNTy^>@aJ7@$pw)+-ht^m(8>-tq7pgb;D`-v6SkWd#=5tlO`4UHleN&aybsvC`XxD`VE#vAC9B1qU2;~-?b=FKtAq39 ztk#Rnpf*cJLv6p+f;Ri^GpJqfYfx$55U72deNcypM5RERqtzm?Q}ZCOv(9(m=JjmB z%^xm=ws@iobvg1a)b-eXXv>v-p>A7i$OYQme`p8xn4S;z>}L=58hRKk>)ICT-F+3* z$6X5b_52a)XIu;FZ#q!amye*W3OdU_GHib^P7vN~Yx2rf6odu20>XXU&J^U^cIIjY z{%>pVz&1QRwR7pge&Ux87Y?8gmraRa9~#rAucnqV52HKKB7?lzlgUevia)uk*;SS5 zOE=~4lhfDkmJ2-;0XDem1vXsn0yg@+tBl=^#~Ff6mU)6rQ(l1^jFo^T!zxJGU&G|` z;6|=5!DekQgBu&112=IIas}F&Jl_g#`rsMZ{M1aa#nYW&%k5%SrPYafVCz|8Ri(|^ zufet>hUW;hHJj8MY}X?eELCL6*xug9AM7Ac1Uq`1!10}AL15>qVpV1H>g&KQw2#5R zi=YesU!U_n(sxvjI(X77BOeTeYM&qcMFEsIu_Gf!Ia8jUW;vz=?^vE#)S$`CY2s5y zG7gyd)X}qK;=FtGQ~L}$3Y!wCT39m8Tb8QnZkc=w)yvx!6)JG;C{*xu^JJ~>UUQEX z%bwPzyJv&BA=DX)4$0|hy`n>tHB~y2)75H|sm+-R@3p}TSaVjbxX!w~eP$%W2e!rrqiXeDRIf+smXmbv|?d7I$L=%mB|P`)dSR* zOf1&_P}z`cv!tF<`tRUr>%fgplsB}qN8ylvmAn_ddXJR9&;i(#$R0){_e)FG(9GKO z0jW!cHzG$Xhy~jaSALvAv(@}D2txcYe<>HO0rao*`n&g(6YF;vw{jcp%BD8$?2XD_ zyWr%cghBB!sXYe8YpB5MPAB8rtHqyI@~oI=tW&GiN1Q(O*y()cX{VNEvHm<~HFWy= zEa;4kNzlDjK8GH-7Np1i4lb+@{%w{o`1kQn(7X{%podcHiMr-Tf&Cwj+@gTaYzO-z zu|`?UM}y3u$6OCdn2#k~6L~>D?04L975tyDF@&D1@+0(Ad2t2EQ#S_U71a*$gVu3; zkwy1POCj8X{x2rs+F`{b!d(CP6@1nDH!f#08=NtKyWxREu+gUexomH|I00%hEfQ)vCJ@?S za7(D9k2SPmS7T_S;ObB_w*qKm>wC~9MoMVYs)wNF6<^B)+RPu_g<4#`6UuBkaH6P3 z^I&haa~srp)e5N1oY_#@2@{~rGQNV^rS*qO;}W3u-Nxq%v^k{qg*tkqL7l?dL7hz^ zpv@iZMSbl8bunry6KHceX9%WZF}UTXS75g@wZQK444@tx9zi|7dI|NKavUm)KL_<5 z`5;%IEnc}>!pld!`&aS()}lxH@LD(K{i$h(LQ{{Fa+F4f%Y|zEUtD^E8+xdjhfH&P zlJ7|{mR0Y!B%3Np*yzx~#NgAnZ;Xc0iB5D5PA6yuELv%J_VGOWEoi3>QnFU6wkVXf za^n_q=$-R$*U{>&WY+n;7Tl{|y9cgzIvwuS_nFDbS*S67KUjC67FaKJG1z#?F|f&u zDqz#`ufYvQC_`yCL6Uj_+_1-XaHFtoV6!0c{Eg!_fty(8V*jQslELOxXMruM_EQS9 zS^Uuk`&(Y#0(Yxld&1p%V?5k#7PSW3P7MGz8@L*5mk|g5(#W~6w~uQDcJST~b@a1< zIyIaFb#AN!ZC-8^w8a-chhZ%!sOQKu zsMq9nP+4pQ)H~^kQlQNzI2G#a9t-ue35WW7+d*4ZYYq))SX0#7`p`g~W^#eHz+Yd0 z+uYOx2Q4}a4&L_w95UfKwC%#9&~|BOpkXV!hYGZHaGC)Q4_l>V?pS9yIKtsaaK!7M zp^>!)ih6DsH0nWTXy?r_&@PAFp5Tijj!=i^|ne{^%#D#pTKQ%$5UXq8|Mc_EtOlK&@AGgWAk#3$>l#1#Olg zh1#Vxgi7OTLG8PF$_3gSQVpPv9ulZi`lk(8!_UA->bs6en_*^N_=5ls7*!9I3 zaLY{#z;35EgWc!ugnDe40rmW99@J~faHuT)YpD0g>2iTKAAd38^o>=3{h9JA2{G{5HzqtQ&E4jg|@j=85*=y7aDxP0naPsyTTN#d|0kxi9apv5*8&r zh)muDVP2d-8`byIm%mfV$=I4aPR6LPP5;G$_mms~Q%qUgJ5ZMmCo+yjT{rBh%xCXV zqQNYDxPCx)3JYx1>DuRMG3lBK4i0n&+GO73w8XhNR?mJdBRdKPze!ouIjo1-%=$MT zN+LV#UY`j=Z-%O^7>4@o=POxtP@6f+p|%rd zL7Qd#0JTdSkNu=^Bcb-)mMR6>98yO^9X+z3PGO%xolV5_q`5-~xcO@_J#jJWEf;8W zIVYwkt}lbZEjNqliQ5@5J#nAs4114_VtV2^sy^6jikP0r;-7=PGioT&S+-*NxBs-t zi5BIw-uf-c_4IQktpD84F$15aG%g)#-z__j@7E#q zOQ@sA2&hw7H>k5o9JINEm#D8>L0ycxhVp(c=PbakFFnC6H|v1i&Pc%S^UR?h8_PpI zM^%A(O}Pw}#ovN@X9(17f@X_8aGA`q-?~$WM@vHoV?=jw}hrp%bRjUeA&CZnPn_2b#Z z7ca&eR0gAXgJKVQPxOYWiB$s}V|=iqNAWjQgAP{ohCb^>uL#S2a!T_j8@*jsJ?Tdz zcV(~WlU|Y6{O&J$QH0J$9jT`cO4VfEqF7e@hfoBeIbs_A&(B-@RgwAMmAB9?nc2|R zD*B@@Mw-Kcmn#bqJG>`vffz*0>{3-?Q4WK18{EwCo;sWp@lDhF)1lc=Y$L`QJ~0Ws z;xrXwG^exB^^1{u;;7}QSDY>tOV{h*}V2pLGFycbyLQ2_6ge^*983Kiln4{|21y(pOgF2{b@(QG6($ zQIy|!SLvC};X_zv^INBHm%dsTnV6>eys7do`aa)N?R{W$r{_y(cQ(bo&t9o9nwk-W z(qep{XpP$cWuFNgWBy)0sx{dQ6~7suOV5E`Y#&B@7xqetHWd@;)@r<|!*}H20i0Zy zTAN=XbEW%r3UX|!(1DOt`_RbLk4SR)#GjZ-`_L}MGEx(fk-B!e8a}?d=0D}~G1aNT zK^b%X7v*wT^=}HftOjSCrL2YrzRG1a+B9CtYP@(PRAXWAv5uV2V{xTQ3ajPO7f`F6 zx1jdjPU*3|L#jCT$I*j77V0q__BGVmMEu5^JM;!OfBiYs#b}g*f4H3M0Cs)Z3*2(E zGuZ7+8?gJl_E3+FHc-z|j!>_uHK4Mdb)nuF)&g%n{!hWaahy#S1ivPy!2Z7Xz^$}4 zf&(<9b=wUa~ntlkMbx$(R^B3b%R zft#ApQDPV4suoB`-!u3nbMu|x`?M>YVt0_56qBx@-VMHV2dXeV^VpDAd)$vIcY`yW3*|7~1#GmbR}QoB;wY%ev^G%FF>cTX zgKeOaJ|@tHU28xa1rpV!ckLUDdWQS)V$c` zECmZTsxpsHd}3<4h9+T<(G}CB3)MM9M6B7qj&)Xitde#1mm^RHn$uPxXP)b|Dvxzu z6LYxFHy;LGVEGWd;MNNGzi#yv`1&JT@Xf00vH#6ua`?Y>`!?KfubBY%JHLMpzWb8_ z_+HLj_|N|$IFGJPs5q~?oK?$u09f0%f|B`@+cB3<3g!L&tR2(vQ8Oj`GdeU4=QBRm zL(XinA`knUu9>K0ZZM$&+$EFt$(b9bw}5-2*)~dMvre19jT55f%uQVG!GBZt)nIc& zGq_urTvxKY#mfk|TM2!^R=CzR zRrSKvJA%1h_}^_|qq}d-=TtYWaRyJ-q^3jdYPJrHMZLyoC=m@Q;$CAVM-xiBSs4{| z-%zIyiT!$g7O$ZWV@`D8s`TL(gQ0r-mH)r%zp-U@F24cGYb~U#Ry*fPSgrRMfNkbv zf^Fx$1UJh_1lx@|2bRVKf$e*Wm4gl;3E2W|jvk|t>2eB-*vsr}@)@|fgA2I%>kzPu zQAd0MF6ZpPt}k1FTW+oib~|GLcAwWQl8@uD;U(B}lpfe?$~mws{sGu~T!5#xn>MiSKQjjQ2edxNDvSpv zIxJxO!)di9qZ+>=y~41QbQmElkMB6B6&H*{A~|jC(o0+tr!_@3A!Gun37@Kd=}G9& zPg`eNZ?(jmTy*e))?IprY;@?D;$xthB{lR6eCQn7WDuv!Jo7x8?``$$U1Y_1&kiZ9 z_4G59to198!na!g`9?Xj{*4WAH#mJ)$!vJQ3v9G0IE&eMu?N&-S~IBWmI zwQ~~GdezrZn>mA^wi9|on`Lx?+NA|UrEwlm`)<9m_;?PfzEDSxHc+RqCQxS+8)$Qf zN}|550d+BItjGJgoXrQjzSIV{+;kZ1cKSNleeOM|$ANB(-f})#ih_g1m~75+4$b0VF*J+Yt;S@F@Q1+&5FSNW`l2SOCAMw_H5tj3G&6s#uGYJpA1)C4#9@)20_*+X!{F2})* zf{uaB+}42`TdxH-F`5EyTJP3B5iUzCi`~vQ(!Rm9mf>ndnGd#hn z!Rm1muxhY+h(`(^Uo}|WwgFf*SiO2VaLXGjv)P~9s>NBX?sFDpvwBSU9_*R%9oQ=^ z1uTn8278BxfqneigMFQxz5(27Z6j(9v6-06xh`kH*8rSv^t zrXa*|CW=cu^hW9Pqfe1O%Qxj7?i%Sz#s#0>d(tMW%d&-|siKZe4LVHG=a-c5d18`= zrtUPM^Kj7zW5Yt@do7vYw>>`=cGPGCc!&D)emVsnCcJt_(jC1qWgs#k!Pt%*Li;4pYQja^Btf4d4K3v(5H!G*Oxv2eHfpK)G_S0w3pj*Tt~E7+fFrmrX~3U$x%|eqGBqi{rhqx{mm7 za;?B`E2M$nUf%=GdD|TP?%-4G|33XR_`|9Q@W;J^l#i1;eoYo%7GVkUM?s}edKhD| z(S4+>s-6{KFCOp+tk!TAxP+^O&D6$~g!rZEwv#fKdYl7$8MO(FG*-Vc>}Buq(@f9w zmTlnj$HiXP3jI4He#P~JVOMYYE9{yt#TtlK`T(%@r53R3?0pWd*$@XhElp)aEOwcz&H<}ODGo5XWkKg%b#3emPKJg*#}}Z z(B{wrfiJ%xL?&=}80x}Q3(gxm%-t=8)_NaLeKunp?ZlfRuaE2*prl`MV6kvXt0=OGEZ&qWW9lr*H=hhrZJMgB+i6aO14H&4bVa}TL&D3a9=ZtK<)>!0d zf4g?^6VrVP>))eMK2rL9KhQS(m2qL++wG~mfo@dZ^D@n?I5$=6}87^MSNk8BOD)awJdayyw1 z$E)J4C1b5>eh^$u?|?tEMwOM|>Z&Wi)nAMUYu+3O)=CxgVC_SFz>0YmV`T!p6!R>C zz>0Ym9$>{h3q!Dco`rk_nwSSGMxd3&=NsgYe#xK7dj65WKrhAo3MKWUnGI9t&$0S2 z8fvXGJDS=0Y5>^g-4L+tURQ9_^iE*A)nX;yevd8KVZ1ZcaZwGZQ*S+}bCiubAJ3(k z8rU^Z2kfSQ7wqo(0o+XOIM_q)8rb8>9jK@30a4E!gSNQ20_wGCJ+$Si{n31U?`c!P ztu`zJw;nhU>@#&NxJ}2&(6%8#&~{BipuR0VpzW)-f_7+RDC!#%XvgHy$$b3Iuj+rh z5u%WM{Ex~Hs+6YII?tb==zT0KqyM5G(p=sT`T0njj++i%98aA+yvegWkAM-#{LT5} zzWw6Vo;QARC(*ZeQL&(CoY+?5#P;XCEn-=Zbv}z~#j%{#(BsyNkqDo<{SbP3!$*Xl zNvZ`sJAEuPdEH9rxu~C^DU&Zr`FN>8qKnh>A!QMM&#IR{hZo*epOeM*M>_@}{^PTw z!B6Hr2S1J77RL6h;rde6XEW}={=AFmQuW1PZP;HnoeKM__DjL9Yl_vkH&!W#|0dTR z$9t<;0`|ApPk?jY+Q9zKz{Q8pW2uo-WY7<>xTQ+Je&EksX0NobR^=}Je7;^TK)@ge913cz_mShz+R`v5*bAo^d#M3uiM20c74GS zoSy{MyLboj4IZ9F{Q8Niup8zlLF;P4E}x=2Nd+vg=J>5ceB+NK#ty0fh(j@M(9))`U`2oGEb9&Ef19N{(v99c02Jj7^C7RMX%^cV23@{_>B&IW>qKkg46vAG%e zr_QPPb zxJF08<1EGIhVd#Tr5rH+;1TRUK1WO~CsaF+_!DIJVV}5Q0C-|@n#iwqf+r=O1W)dr z2A;g;7do0COujH5JSAo$>{IQ>WO4Y^h^H*V)P38*ze=Y|nWt4XMEq%9b46Y<7xwA? zgTT|T&xJj@jsr&*qDKvbeTL^W@QgTnk)Qq!p4p=dc$RorVb-|yA|Guln+@=9IYxoxyYObM_zz^UU5N{=9yD!1GHsg?;{U4e$b?H|z_XD@ZwD z!ChV07j88JFT7L%yr{xY;6+Ds!HZ{B1utItlgPLAXm3IIZS{5Vl0mOwU-FZ9|1Q~c z0=#tmA=qOkH32URy_QA03CsPiu?Q<#9{{g3Y6)ItyaK#h^@WrJ)>Iq^UX!*6_O(y@ zfY-(U3|@aZDvaO!zR(Z6A+9%g;|OQ)ruogmo4bhLH+EP9@D^9G`D<&Za^P)xwWYkn z_9jojJ5*J{J8PH8;_#g}ZiC~5N8q@FN#Na=W+Q(5@3%ObuxC?K*b}CR_wU}Qo3QWe zzZUlWZGFIrUX#HG>c2t!1O7oG2hV{0V8amb!Q7?bLruy_IpC1zVDRCxtzbWVTKxV; z%5MiBF>DX}k(d3X9B_2Swk&9RZ5AP^bQ9Q<&bO2@9~&fr{n(acBH!17{rL9A;1eFl zz$Yd`gcB*2h<|dnI_#%vhJsJEze-0Fgi~9qgHI2B4*Thc8Q?RGqQGZni1+8&?iDGv zAe=oYUca+%pTV9yC>`<7**$~(+=7N8Coce}wAl+zt&s{&?LA-QHBQ+7yy;T#`S&|u zzhLha#&0e}h|l*$?F8_}jCrtMDzg!M$*aA{IZMEo6NZB?U-!-8H&<%EmqOE|u&1q> z15VrZUgW32;Pm*OVSiK{Ev7=wKfm?&#|QYw#SjFE51-#p3+O84soz5)RQhD7peOY? z@-UuHhYVUYwlKC7#|(;ZKO4YMursnOeGuBFnv*LwWzBujr4Lc1t*HB0Y<~OU?qglE zQWxjbrQ%I-#e#ZDqKYsE`BbGDqKYsF1`3SL73es5 zXJud?KQHnQuAFn?PM^c)1oLdh1^2>lJVEp8__v-&p9MYXH3%c=QerY;Pwg*u37wzS zDURb^aEY~My*Stwe96HXdbzQgsBdkcX%(u9dPN7C{`fUCBklwA>gmhS%;nnFe7tKr zUqNMK-b1g?J&qxtH(CdSZw~n#e9PDieA_Q+E$?@yq7nG6<2vx&Y|l6jzh7$#`2OXF z;0L(_zz^ffgCAXM4SqcDDfr2;kovse)1l|US!-K?pLN^@em>Cz{K6^On&Z9fTN(UH zvK9Q=<0bfw{wQ#EwE*y2HGlBiSFYfk+b-aDnSN{eIPcH&h-3Y*&l&u2lM^_1iQZbe zR@By9CyqsBlp46$z~W%l?svh(z3+h4Jc`%ncqN*sTCuam%K z?yLuwy|@ls?&wr-rA0R2%Ap}^`JVsN=@`vJ<3Tg>AvZkcf9OPR)1l|3GRB&E(Rfo{ zsk*sWM_-`@H|jL^`f?z7{ED6j@+Y700Ip?s#*B(P$p zRe!Kzrj<8XG1JNzET3uR?Iq;^`AjP#Bd~m?Rr!iw+xrJ%IbPH4@iDA+D|dtKXDZRtekh{L)VXTEujp`D^_8J?! zpt_6gpf#r&L2Hey36+FYgx2mRKk@%p1}{^f z^>3XsVKy8#T-5X15iXy3ynQZMKJ$3?FtB{)aYPreeCBcYAu$5I%);A1&FwouE!vtx zEp=_7R%X>i{ZIpHtz#w;=w+Sp5p46WD%dtb25y@68f>@f1JpkLGSp$*HK^mlc&Jm* z0jTrXi!lPdT-;ZHU3dpsEn^;GR4>X{&Di`P|;QCAh~>(}?^{nlUqfc<}eJ4wd8;gG2h>#;G8;NvP)z{gv>Li`hFq~Mb$ zH-S_7mjm zW#0Axm)-JF$^qrBi2Y{eSGEUNSS|LGRg7u^u9#iPhvR8Yip73f8L={Eojb`{tTm24 zh3YOcg}vs~!QfgW1EG?T_R!khnnCNdYy#D@s}HT)NDHc8L+pR8SN0uPK3(9IW*C1? zVUDaCZqI#J^Hn|EEnwtMS=o2J`=?N+-&?e~b|8yv>#gB=$MP^aD{q0Uh? zviNu|?)Sm2y*`57^iP7_U1i`uJ(O?y)oA{l?;gr$y-%Ive=(HLVF`}YA%7^}*~Wzo zrY$s^rnyO9nJ`*t^smLG#775ZSe?F{wo#3i(l+Wiq!g)v39l?g{6Q$dwb$ZUN=m1mJ_d$2|l@h z>_oPwba)cRddco+Db}>ydIIaq9s9@!1Z4nfs+39wO6ZvUpH2&9M)V2f6@sdrl+0H} z$y^gzK@C1Rd2YGPcp|vyD?*%;+tJfSC`13gSf#$PLszfg>F~VC6aN+g!vn%1m9=Cf zRhs#yi0fO$YaBqLpWJD8miW_`_obgsql)fP6#k7Ab=-V0qs#Xw$iKNgf|Gou}OlULAN1cgTq4hRVv@W=g#{L$!k{Qj;-A&_=aqYYh;;+C!eiyEi29Ohdx^kdz0d&q|8mus)VsxzxI=|+GM<-V39{FyMCn9b!&L6ZGRWOn&JlCu?zUhf8z>-sFj-SHOT?eFGwt zHT%tpzAGn^>iiSdw4Dn-lRH){Or|iZ6B|0QYG`(kWvyPSTOzb*sT+Sj5C62KZoVuZ zesh&JMRcqXFgtZ# zp8p(0?}eJ0Ce$WRS>k&p@tXK#Z$4?>KRXHi<@{@>iqC(~>3Vu^(NH4@V8Ml<0oxux(+i z3MIf(WB5j-%qwqk3hHh)6`i*=q-=|mvadLBE9l)(k@ALy^bb&0Yeq@>AzWPh|K!}U zrEJFV+mw#-MrSgw^c@~Bcwp%8fN*7X>hL|o`L>v(zb*ej

Z(CP)ptBP%AS%Q9m?*TI)EO@P5`;%Ykj))dAZkJOMXNFAla_ zT^4E|e+TL??lIJH;W4OF&{?SS*jurDJQw#ZVAozp!EXAq!0xVMhh#IgNU(>V*dgih zWCr4Ss)mSqW-zqH%~nvaP3@sAPxUw9<9knQ0`~Q~E&1W3LQ#C>cWRVSbma2L7yX)W z<3x`)B_MhJE&i~Nb9If!>+_qdD$yau3Tb3ONPu6<$N|)nr<@@voR#t>;b&o#Rr~d< zC$`;&o}A%_w$7C11F~peL1V@f49}s3eJHi@>%d_F-8t>- ziSDgF5_WUhN5W-IYWJ*+HbH9fq|<{I&vsOg7Z+x3@X=_w;F?d~jX5+RSV_L_>53|< z3TXkBQ54V!1#ap@_@g!DbsdM4t4=3?H+j2`cR;TIC3(&BpfAh0D+UUT3+_6NukJ~Y z$Smmd6EfCQ@8WUQPN#nKXFl`WDqPi+fDvKLsl&3Na&MGgzk@GEw9I1rCC7Hq%f@b^ zX6L}3R{nyhmouR0k9R>c;`TwWo_UbP`)4jogI?RY11cMn0KGnU9`r_QL+H&R!=bl~ z%R+Da%?;!I?^JjU{{J_`s~w(3#Skw`@ZV~P7n(@FYjxl+e5M!Ji>9Q9({1?mA}b20 z>>o70fa=O^rC;+ETIl1Wq*`{-<3o?v|89h2(c_c%2>nHm&n-V6&8JkS;Z0sD@eb${ z5U4EQ+%ELY%j-1jwX9+|z2326t&9_cY6eYwST!{JC$d&A)h`+PcBvDq=KUqGYo(Pc(Y7?yQdb>nW%^Lm z_o8nVZdD4@K7J$AVcd48LBVOYI^yEZc zl&5+029MGZgwQOC&;RK?SKCllreDeBW-c*{{)xqsG7VR7#-Ih~FPv@nyL)6rWh$`p zCNC{}2Mi1jQBr#-*FU)cs?I;J>h%m1fPUID!io97;+OcD2URq~m`~C;C+JkwEY@>g z-q4gSx1l#eY+%2!O&nfTei6#uLWS}3aeC@?*w1H4sJCUU=zLz@^P8Jn>mFMM_2vHx z@8sfX9&J92O@Wv#{iNkwDX^SRL!V1?gl?UY~9 zun@anzg*w1W~V~|?J1e(O`g=Z3hos;I9N$n+LTT#J(S`aVB||Mj?Z+FFTpbYd>-om zmwgFZKCF=Zqf^D`_NvvKzpP@a7e5&CfpDLC(%>bx%=1St7=P~cZt}wDHy7#F<4xXN z)GBmHX#dC&1A~+{F5Zd0y*#y9uPI67ROH{fLgT-$33WJMe`-Q?PyD>mNi02lqnD*% z@dADSZ4&udzW!o{%Y_SSETok52bN(p46D&8e}z(YIvAR!_#qe^+%s5d-3YGqN%Ci4 zS-KV$O8BQf0}Vg6;>$#98m@3+HJUve+Bj+))Hq@Yv}l#m7bbLigpRXLee>D)RvS*f z4Xc!TC-C9^)Z<}W>A~{+UbfP7FgzZu2mE)s*S0zB6!V6sI4{)yCM_&E8_aShb8{FxR0x!-{ehpiCx ze5MbX$xruHuwuR2{a~ZnvCzg*%b>;)GodDdW1*(qH^~HgnT1b+%GbMX+aD}n@7By4 z%^s?6J=MTMVC1bUD*V3QWcCV(4wP|`|e^$HImQedW>QIOA)uE0HpF^F3-a?(D zD#$Q3qhOhYRxIMbJQ3lO|8(P+)D`H(y->I(smMZu@TkZ_sWkm>=EH>;Yp4A2Ao)wg zbJwp}jr@vJdJokb=MK|Bd8RZR{%at4(m~6I z*u8C@H#ms=QlJ5;(D^)*57czoMMvjNaf*hMTZ-WU%Ie+b+kt+H=q7Q>rDu!zRL#7j zkZ9;j%ZNPBljMT88Z(N|Ie_}VjGCNj?#h3p-S;~`SKDG7AUV|E_ ziCLb(%lA0R^=}oHrJRMm;r2wRVhQ!-V8s&ZQDBq6NT_M|m}LGuv+$pw=JvlpE!uX6 zTIvQut;`%n{m=|*t<%ki_p`oQA8hl^0c^Xs47h2!1Z=n30BXOd7}Q~WX{h7ETTrK< zhfwDzA(@XCBs(hkGHc;3UNufT3i;!-wdqQHAKZk^eE327JZ}+8I(%DlX-6#Sd?iP@ zaAvVb{;erbJ=zQ(F+3zRJWxqZlb_w2<758b_vYtC|9{54*-htiOdiz9T#AoOF(L z+4I3|SWiBGkM5Fl3;Sg8<0%MTjQPOypY{{iX5?(0pS-rn#CcW9{DrFMJuN{0<(#au zmnK{vM@QjJ-UZY)cz8gdl3Z=^>7ef}&aJqhW3`Vp8a)}f*|y{t2CfNgTJ!L|v9!A;ZBz;>&yL+#_y z(k3{JI|O!IxCHvYn#w)ydLU5MlpkaIkBrE)*S!)mM1FbXG1*+G|GrEB5Cl$20cv1QBx#}G!r2pEHpgmJ5o6QydO*y`EKJ)!ngk@ zt9F>M@#iLP(3A~&DS6_?$}ZQU?@)@z8?}^)Re*NkL4gB<`iF)L|L^opt=BTY#pkVP zpya=IpyXfBI~84n9~de^eYI${_6NpCKFM-%$)yy4H+e10Hy}7HNJ%~n4C#y0w-(D( z5ofYA`EfYZ-c!n&;@cUTI^`#*d|rxs9f9o^TkaQgcf0-I%O!dvm%pO>9PzK*T>yK& zFRb)qr(w^KiO0RVUVuF_d@%OEwj&UB*~oEV`Mi|waX8-1p(kO#{sEx!v1KdBkYggyodeC{KMdcLfu0jps-|TW>V!oL~HwmkxXb2KVhBG*C&?u|6w(k1fq-_HVbiGz||d?186A zgxncbNH4Qk`u?j4URTi(p*JZud zLg?MJaz6ZRcI{K+z&Z&tWgK2(!&s>9 z;s|KXsX@?MBRfDPAs*1$-K?Q?S{g$2?6jeEpOlRz&;f4~Z` z(d_*GfX{~?<Ucyckg z!9LMbd&3RM*uT-z4%WP%(KJ=q8%rl4zHw+1*i8cV!fxu*4|X$`EZEJ>o`Nm(Bf*wc z^$_2xgy^Z=>Qx8Wo7~NS-TLBW*lmuh<9N2aD}tN;J_l^K&;{}BryfImho6SP?l|B* z>`vX*!S3AJ7|?O=}^#}U8zh1Q7gd88G%#jf*UuhnA^zvY6Gi0?gN2kfmz zG=;r&-+Qq8bR7tL8?OQ2w)QW;?HVmZeBW9Ih~K{adDuG$U10Cj>E*JmT_{v9`f16r7Yds@p7zgNTF)|5z7 zb5?=&t-|^xz8y}Ty7*}NPY;q~a~_#tYR$drG)ki?9w$vs*?rNf&tBH3vlst4r5B$k zVh1DhFWdJEI;K?Q!9gK@&O?HSaAl8E=0A9SUfKJDT>|NF+yYkQmy(i`BEOVJlKJ*3 z@=N(f%ID!9<(INw-P11@(vRXzkz@A_9?(-sGq9<=ipD=Uro3>cS_H9BJHQ)$&V0Ej zo9E}u*Z)&LXN3;6Ecg=?MPd30VSWELzoFR6O?@uVPv=eEnC=_ef4Gv|NKiRX(F7ZG za3!j%mmG?T`nWTyr;5h&rr`9FVl_H_qb^v{c%GXjpPNKpn5pmwFIJQja&?pQy%yA* ziNRU)?~B1%T_YC^%AZzI;KwViY0j0tp1gl&+3i+WxX}1dolwzeD{cleyvO9A>mhTVy_?J$s4&(A`I2XZAL1GQZdF=B(KGv-6DqzeD&|k4P$)(!wqC=B zqg0F@1H}q7KQ!N{;4Ef&+jaYXk+f)-5A}X3ZEz-iV@2`rzc!V5>+Y93^Ot*4r*D9f zy6r;(Xibp-<&D(jAwc|l)j1IupZcUFy{A>5GNM@vUs1;-jO{fx7)x0d4ht%Q6%Gqt zfE5l4E`Svd3wD7O4ht556%Gq_3jC^nOPmjFcz!-u;izB)SmCIk8(86}zyYjqRM17r z0cPIz`2Obhc3=ymT44DYhw>_5+xy#MIDXUZ8=_h5R{kEtYCn4#*dgjyuwz6R*eNg+ z?CjeX?Bdo2>}p{FcB^X+cGqpAF3_uewT0jgY5`%)9bSzDcf9Q?&iDTEY5PV9EqGwT zN1=Ir$a=UE7A6(fwGrKYi3=MP;^M2|{U;w9Pxs$IKbL@rP$dl%F1r2bf)(9u6c})p-8iUwY#0pGa}2;kjQjw8-@gQr3T(>zP&q#Ns25Ui*5(w_1sUt>E8yUy>Kh z8Q+ZW7RoJUgaRH#7!qeeValh54I zlpXt_+(kM*Z`39z7Hv8NQy&`5LQ>Lzjgs^^T+7Lubmig0kIT0vU9nxhAa0ugfk%&F zkg~rC4;J}z)35^d)h_1`!=MwIcLqWN0)uJxd_<^{CSp0$Cvo=x3U_NddvxdDxMRi6 zEDEE(DtCWY4b9=ntkp{mlR@8Z^kLP!zrmkXD@_Kw_9;`aPJ)A!!xe=;3ApCeyu#ne zVqi)C{KDTYa2>Dw!rxJF-G=#vzqR0cW%CPvM+ANuyxa+`e`|+2zcC!vT~v7?a1!hd zx91lE`-6>U=NAIK!Nw8!g+L58Cl9=Ng}`u2DMyeO0^3#x%L{@3z=5uX^~rvtR9Ud$ zpFQyYw1Q8XILeOF1xhI>U7(ag9DPTrM&5j`{FI^aRH1dO>izur@^k?4ndls##AQZ5 zc^;OfKj!HOktpMw=k;GPF7mcZQ!RxE*=s?Nt(EP;DS!fZIKzo_!1aOWYOVkz9= zV8v3nUBQZ_aP7hJrEtStqxrbFU+GGQ5d8)NKAK!bL4){NEUSIHO5U0!!U(N>=bIvba z*VD6+_dF=v)feKbzTjjXc>%aHPu3ZzoFR=|?dR>kI9F%k1I_dKD+|k8bUFu-H~ygT zU|KshTuCdzbJ>{-1eo!$$gi{kKlsZkZ(*Sf@q-iDC`0_*Pr!Z?4zK?9MGWhI&riUU zWd6K=>!eN>_tQT7`(1n8zjqv>Db7q7HC%w1Z;A znUB~3jtQkav6Rz-uMBT0Hpgh=;bP>bfHpE&H2gr`wnZ$ z3FB+h;P6A}7t7+#-iPqQmc{*FddlGM?c$#9&+6JMOUCM^zt^AD-8DtV+DvV!KdXn{ zb{X`^9;m14Tv5;b25oUuEYf>z8VzoFYL34^FYjpq;8q)k`WIFt%xlj7gOVW?L*n>| zGS%j~@I}*I{_+jX#HBQjYG5ukWolpn7 zWzt0G)-VTzZwp@u-R>iS?lS8OjjMP|)LhZ;>h7mU!3oFCtMm8W8+Qb{Z|P46-#>p1 zIB`*V=z(FApa=VofFA19A9~oab~NvQ#M&Et)OH&*snaopCtZ05J+Ash)Ms|k6E{Yy z^L{6Hgo^qoQD8nL?JH`Acs@?gX#@M|Lw%%dKNBvFbUt$=9mhEvX%73@4N=%Hx$QDh zSM7!UT>EOUpPSkn;VEWgMI9$zuhh=hVL$Jg0=;1K*oi;qqG2ZVlGa)1<-LXM5<)w#}foT$(^{ zo7IQjsiOtGtK;s($Gcb7O4N4-(EATHp%2naLm!^Vfj)|V2z|Uh1Nvm)Y3S3*`=D7P zHbbBFi-A7xbuy8U|Ds(2^rh=Y=qvLj(ARp?p>L{4q1mc~M19c{`u1kKM0#duxrfuy z&=>olnm0E?wNhiC+J|O9brSZfbG#ZGHbHe4FNM~e8V#*Aatu@w5)Q51trxUTOJAs- zojbH{BP*zW4FhPsa+**BHL=cO@X8{ZKd1g}vCd+6K?B_2h*)Q7XkS6X_J-TD5#FfQ zLG0gX<$bWx>@;ZOsFP6RhyRH*g(rVM2SL4|JZXIY%6RZ!#qhJS9DuS3e@CvT%0@XzB0`+sB(joPVFF<{P5_)wywsU?e?Gh9| zAW~VbF8t_|xLksgd+-F!W_Eko z$*iZBoCBXZS_OPIa=1T-CvP_KVLjKrD>!9(W$=YTeZdzi*dhLYP3(yd#tU$N~C zzH;~|I9+cn;-{}%3%;rv1il(I8Jv031AJ}3>SX@BJ0Yd9|J^3VlIb@Jr6k+@Sxc+W z^da0&ky`>0HTWQ@E0RHtEqhrPN7m^Iu)OTNXcL=bhh3C`_p0ZN(x~HP4A=t)}-7 zs!>H8?C`hC)AIAOAIZby8BL)X66GOuT9A|QsYD@}@)MNhITzuK135?;dS}A#^0N-p z{H)`%-k*c>T5a4+2jZ;?ZSsu6H6Sd=uR~CHppv?P`1|ulH?yK>e`?NR33E!sNOiIa zWvjoTRsa=Mn!fgufA>w9B4_2?l!xze&dI+$FT?!o_wA~%cffAC&3XIeR&N#%6dtOi z-zK52u1Z^Z{w-4mtn5VZ|E0GyUA=Go<>tO!%jbq(bT81Ij4S%%cX7e1j6Tf#;!m@H zqKnLD_q)sD|53X2txK#@?611W)!WV3c7WR4ctiVi{zYy z(B%Qy{8TS0SKS|aL0nF5@s&-{%)hPN0bQ~?8oD%U9`so0LC{loz0^70>2=k?XO_Ey z&(5@fCjX)jJr}Ma>dv{8?oo=^X`d9jtTn<@d+9_opZC&(Ua&bQVZPAkuE=Y}>BJWe zwz`t*A+%D+8r2`PY zfBph+;=)|$fnh&E5B3d#9_rK`df2gwl=nYk?Fc??dFWPN_zI0s*ePtdEeXTbJ`ld=aG+VWos4sk>Z*RKC z(laAeFPFn2RDTgGW!1d7462nn6RLe^EL10f3*6lH76a8?JOf&D>Mzj$THD)ylHV6v zJ^4xnreHf8zyIF9Puz`vwko|^iQL?*`dlBN|6GR>JQ|MPV`6JF zN_DwyjcW-F|D#&cfW7Md^Jf8lQuJsWG`xSmfFZ$38YAXLzm0#OI^Ua9{Kv+yE}l^n z&+2dICPp(a32!51U3x(k@nYJIgMHafE7(`s8Nj}BcLeN5y|rOavNw?Meo1N7V_A>a zbB%!>s)z8CCG^23H@HAgWt>L%>8W+WXA(Ap&xVu$Coi4>KIe50oHA}BG_~Og==q@O z(EOsxMfXAAOIq6`{JEF)+kr2?odZs*5GLxCq0sc()nU)r-5GrKj0H4vc_hNGZPEbC ze(4Cl{%bb)Mo$~?%>ilPTP`}_+ujM_JGDQ6?^<1k-Yct(@cSC^;QJ5WgCD$J41Rbb z6a46+*st_>eIoeDPJh^+PF@bqnk$~SXZ@nU&qw<~U$l!syqA8?;8*6qfL}Z6f!|aK z1ZUS$182Wz27deTE;uK(KKR`|Rp|Q!cgfd^BtIBNmF$Q9bg$8iTbsnjYJ$9uLhIm3E<#5q@q(987_-D zadjz&>csfZk3O~WV3H!8_`**9-LpMnt5JIcZ=aMC+mQ?QkRT3f=}){ z0zS1X7kt`kj0v9;tx6xAps5MSceS4#mN4tA4}`tOxz%9Z$<4qu*LFp`TK%k?IG$vp zJ-BuYO>mvQwZM9YIpDg@RlxeCGr;vsYnsq*LcRO@!1XH$;QA?Pi5za2bpzaBYXZ1o z@?mhJnM=S%v8%z2!=+&3=!syHwmre7!&k-%^fGHY+KJV?^LVg@P5{`_rZ3p?oh!JB zRts>GbbYY(+eToUJte`mR~jS>^lCcegpAehpob5u{h$ppR)^(=V8<@U{h6J9DGPSC z{T=KQ@EGi>{VUkbS@iqumJ(1RPpK8Pic=9FDUq8KZ_2o{?LxBn;IyL$$B2eG z7@1hmW`<@$bBE8XTAg+;44X)g4{w+<5;-`67Q_h-Fm`tJRn8cPc66HP(*#U5AFMGN z&&}di2c`U6EKV?{-$wNU-)*8M1tI*@t`5-CYdoN5V#I3x*$IYHI+masW&ea^ zgR`f=hNZ=FxZ&na;0E^xLmSRNA>}uXQl>+VhHZd0-Z}_s+-VxrWM(_)Up9_?&3zp2 zFL&77cm7_Yub9U$6 zD{dqy!~bcD3WuOsg!--;d0TK7))%cK(|eD)uz(&Q-jH=G9@)U4kbq!ibzJz;_opwP z|J+VN{`XU5)i6A_t&UHGCRkB=#LsWMs7WCRKeekn^z@om&@(Y3U_U#-WFns!)i5V$ z@$!15nALphfYn|*LQ9$y7xiLoXz7Y~MBS+hE%WpkwCqwzDc--_<=fEmql-Z+#3ey1 z_P7OApT7=T$>Aup@~|n;DmB+at9BY7>c`1Y4eQpT-d#PBkFQy~zolNz_ zH89*M>e*DNVd?pzo(!DG$8B(b1i0b+bKpiPbD>64>O&iE9R@Xya4*I2O=flhn|2R? znuXgz&Fx*G7Hw-nEp_#wR%U{zA4)>4b#zPdajY}$gKcth!L|t}!A;YygY8z`gWAU* zf;x;l0d-us3hETJ0qQ*Vz(hWti~BUNYcKJa*6WP&4Pa`Qif6&g>J|8SWbSt&t76i(>qv2iZJ6Gqtt~ z4Md>r(+AllJa}+VrA(sDn4`5(1|ET)Gb&l@tO zm6S?ST3G>UWnPg7Y2|;GU>2;be41d=_?@0X;mYb6Dyp&2H7%;Kyp{63UFZ@sMKzYf zYAo*0?{s-cc`|S6bP5&uvTI~`c(9TNBlVz9q7M}7D-n%_Tbvayx-bmw2l?#`zoof> zmq-JkOXKT7WBgsAKhh4t$A5S5SAq5Y)=|(8Nu8k|hs5G|xoeuzSE5%3v0qGOf-bO_ zqgWsR+q7e-w#N6CrwTVs!Qb7E(Z@i_JN&2Z81;(z;q&C}82R(^A796DqcPt!c(883i}&K zIf8uQsioz>@`a~HJps!Xp6Zbdc5$CTd(q@8hpk|@{C13*v%&IqjFMZF(SA{&jYAM7 zqlxX0%I4qGlyR)Bwhp&P@%CxL;1&=*R9P#nm7z~7(2y|`13mtVGPX)ZipY987%AY4gnDHP>PblsKKzFw3sN%^_5D$1AsL=$_cd0N};l(_I#p3bHs z{cYLYQ#rk2*7PylfTYE#>|l+d8T4ML`mwi+Rm0jT8+vy#iXWP_yQ6(fGbseDt>OsQ zUegM!bG0krHHDH6Yd%=dKCxHz&F9kQa-yhs?enJ=@uTjdxVXQ{OmVg^??FTmQBn6wy zYza2)-V$sU-WY6d-xzGsRvm1qs}8m@eGayI{~T_I@;%2ndn>zB(So;6+fiBu4-5<%pe%O|+$Jlpk%d2AexC33 z|7F87pYLz=bbh78!DWsq8+gY*Dgb|W(hH_3T+}L%rqG(~e$7LNDybf9O&?a2vJ|B( z|BaMo(e(rC@`sardXswxh4c)K3|E$8#m|~($7w1fY5D&;s6^xLQYk&;e|;0}P}IqU zKN?i>MPtmL9aNI<9I7tT+0#x39x^M|t-hMhZUdjRT_S0UA!SeRgzwbD(f{mx2HWIc9 z4Ug!noQL-Rf7|KVJtwrysA9w0r>DgyNNJ~q%R2I!O~h&q^ffJRl^KI#NP_5>>!j~l z3G>OMF$h1kD;#=yO|KZ*pW05}iMmr0s;$yf)HS1_hWgz^-F!kK(93<$erPkbK2Q(6 zkuel3csv;k^;GR4>Y1RJFES6V$AqA>UcSb;*kIC;$0T;7nr0dPZ)E*hHKyR8C2pBj zRAbsi1_ccqOit1Qm2>O;V}~sj9MJjc9g9gM$~l|9bnOasf)tJBr1K$Y7LDed$mgMG zH0O_x<}6r(R;P2QNEq7<4;-kh$w)CL~ahhf%9SW`5=U} zG}z^X5dOV|=z?9qpEia21`MW#aAnQi>_HbmQD7_@oP_)FFPmgl)Cr8|zNiye_!FJL z1>3SeO&U4`_oB7ul$A7mmZcXpWpmo_r?d2;rfej!|8LvH{<@~@f(<}4^PoUMykpQ{ zC5`F&_q6{MoMZKA`wy)O(<_t)Z7R!kM9~y0x|#Fmp%zWC`Wwtc{ToiP>hsEL(sF7! z=dCQ=Z!X~hBZ5PWoqL5VX>>|0`Vel1gge~1>&HiP3wd0{-U9SPw?x+6&wPAX<1?e3 zSktUefYTmnKr^&HBy+fY1%!8|2+v%UgZS63?gYzxTZ3QD*FpSOY9qj}6Q!`fsbHJP z$H{Kf9GsnW9rm0uPY^$6T~*lMJ*ory`zZ?&>AMTM$JhI?)*SXCk+oJ#n`Bmr`NKq3 zxvTNAx4_N)Md#(X|JUaWo~A=+)%L1wF?rq z+uT>d{!NcPgWWDvi2mmNptv(~bFWkH4ZEx2`{Jf7-zT)VqQcjmKK zZubCX6^pvkZ!B;#gm34I8duR%2L0fKi?I8dg$Z+fW`u+_&3Y3!?O_fyL+g4hhs)ic zy{m@s%tfL*vTIitf@Qwu*#Bjh(%@HWJ;1LM1Ho@9)Wqjyw`l~<)=pLVDLcfDU|jY#xe82#?4lP zO{BxYrn=sUZ`M(Q{mo1CgWbZ~7j}#617IsjEwI(uzKGxC^-;vPjvEKN&9$4b+fHu; zd(&gNu-k=J0NWp)0lP!1EU@E@k6@?9DPZUE*_ z$1$uPmBz#Fv1^Wmxp~fV*gfYB1-D3x0((hk#jw3)d~dL~e;L5A_ zaPD2;0Uzzg4^mu3(dTO1hgNv7c0Y4*;_&#)U+`e1Sto$g9+iS-Xgy72yWEHBJ3WMF zE)sp3Uc0&$Ec127{x9d3NBmc6A>h}E;jq7{&%mje4h;{J{-Cc{Pns zftxP6h)Ie0skG>pi&JR}2aC^o*h3S>nzp7Q5pR5M$!)T7x`2Dr!AsDl%_qOZ&TCkm zX288;^nG)4=ev1ISr?Vl4}*TEzwf1IvT@R5{8wf1e#=Jf!T!q|R|c;b(Gt4Satw4; z4?Wmd>sx}?7%YOWZJ+{OSMq03pIC(P@z&q<1OI->2f8828M^WK8tA4qdeF@=t;0Be z>;yINmP!4gTf=Dh!%lD_A(#i>(I>Skw!`Xj2U3;PY%3jb4Q?%8Y zD@M74)g!E+l>!Z*m3=j#MgG!h(Jfkp9e>5tzW?vXW`j^{suyYV6`}w1o?fNcvoHJl zC1306{9c?E!pq?B$`PWYbsD%ME`;*k-qsgotg}y}bbz;#^fBbZ$cnnZm6PUdrVrpW z2jjDQsD8vfy<~MGDc_SzQ@z~L*#zR6-;>7D}ns$N&XtJ__H zeNDA_h`-i+4|wgzZLqJe@*8-4<{a?vFGhnm>>CQ+m>K}yv_y15zImG~ICfN1*tab9 zlk(?o?b9iYb=yd1@OBSd@Q!YJ;GG6Fz`N|!z;Pu$f_LlO1@FEi1Mg8QF7R>o96bn5 zxOE4-cXMVIhwnQqrosECCxR2ZT!j5VtR3PXjG78Q)H(|G!-1mH_#?)>!AHF(OZhlS z6`O;P8HIq4Wd~vZ6XjchPh9o@pPcv+oTB#g;db^`0&CN;tL3~GY!R~Nt!=yqoNgV#5}5AWOnKe~7r z{P^f$@RR-5!#Lj4%`z!#*3v`ZXVVXYpO0Pzei6D7{L*g%_*Lui;Mb19;5Wv7!P)i4 zW$|&|R%`*zDb)v@lif$)@OSq-!S647fuw?5S+WVd=@<;f-t{4L}kKLaIv9J z!K#DGh4Gu>0cEAEYCccEC7d3EOPVBuOa5vAF0H;5TzcaQjxLnRnhh>1n+1EhE3sJ| zUOq7rTw(W2aK&{qIha;%ivU-e6alV0yaTvOa0hVJ&eq^+o;=rx8YykG!PO0sfC-v) znuKw2G{kz>TxL7{_yIy&UWs7z%bX zjsm;8wE?@o*d_cyfmN)Zs1}Gt%T9lPrR6V=nVY-uJU_&{$rD^|?(Z?&{6&pm)Vf3= z>iA!k=SK2)Eq23)6-PSKdmmnKM9j&)y(XNYZFQrGlqK=Tw-+x37f9}J^A_1rPByrP zK8WY!!FPi6+3zu&EG)d0naH~6VignCC2`~YS(nCN^=_kJSpxBKo}@Sfr) z!F$eWVE?^Bcf{ZOn5k4}RHwB4aRgrvwg%rARU3TM zQyYB8qn3>KyIWZ^nf0E53i#f$9Pon@H^C3iWq=>vIRbvPWgqz2^ws{n-}BLvd{|$E zP6WU7>kod_x*zzpqc`}CaZ7M^{b20>wqj#&PAM;NPIe0!ALrdYBk=pnjlds{RRn*G zs{qbj^DLR}aY2}uC1X*UkP0p~GzF|0mgU3Y#r>c9v#R-|fJ-=?1D7<}4lY`NbiRzw zPtgLTmbf3}3y}UuZlhZKf02#RLI89t7i|B*d&<7Zal1Mu_49NK%D9{<({koa>$?^* zb@U5cP=PWKY;L51KE4Ka`LR7>2u_HR^YAJ*_;L}QhA4GebJ$KALb=-%cQLN zRk?#PO~Lt9l|ri;6Z_I>qBORhe-`VHRyES8>dO12AM1ww|FWuvp=KB#S6N<~#cEK(|} z3ffY-ZUw3eVv$l&RS=7mr6gw&ue7>Yq%0$B0hh@Viu2PVNH@3RluXnj7eI=H;BRk@eH=49}`!@I%zr*8!(t`s{0 z4usAIAB_4L_Cu|QfDZ@yfsYt>0w47r8OFy=s%Q&7X4C_Ga$*)#QK}bntklR`*#ErK zRm8v0{wVmOWIyFNFaCZHnGCt1Rigw_fQk}s$*`2aD{N25#;P;np!5@z4fZu%Vh$+$|v>#SJ)i|uDEV&7Kf`Z=nbwkDF|G7cyn--U=MKB&JDoTJPpAb zHs!$84alpeA^wKKz7_42aELi(_nJ^C5x&9bj#?t!!5np@6*Yc1OXmJAWF zf9)}|z;)W+0PFSJEEDKe*YYq}zr_r2y=tq$1`P&-4L%+U<9LQ;+Jg-Y{(Gz43j?E^O{ zDK=VK>!is9dRgBQ8!c_#C4g;@ou*3o}=8esGeHc?yULfYP?ql5{*S%{~Zo^xF_AKwv$bk_7%5teH zr3*qCs@SbFG4l+b_$6_hqd7%bx~HU+HD>;d|6}hw0HV0oHarMO5p@-nW9%i6nQ@A!Y;JM6L|L^Rp_-g{Y? zefK%%%*>gYGp84DO7^$l)bDSC=f#(&`#{Y)gARb_JMM!0f=)LiY`(DieDEUs{oqCU zJK_G|6dkyi$LzuSFwgCB1@2B5pCd1E-q#?3RXsqK_k9i4u#x3`&w~r|zT3ftdEdEU zozt?s??iB=O|raiiiD3Z`AwGhodB*nI*g44-SALwweGUKZ(DE;XIb9Y9IRijAn&WC z4K^$%%lkG+;Nuv{^1j)c;95ImdEeXMI&)=t-&)we?s!?=_Z`?|kSyk%lqyE zn^`9CX{eg~B7RtC%ksWEz?QdVdEa^9Mme&)@3-K_Yh-!f0brY%4sm=u+X3+sR=Z)c zyl;Q7Lq}QO*9+XlPL}tz1UnfOS;BGMexj72==bn2kgCO3fSkKE7*6= zeC+RcqE{Rn_>Y+kZnxeA+`d;hIN)bvaEBJY;Ep58fjiZ-0(b6m72NqvWpG!=z2L6b z8c78D1lGR7A_VTK1n!={2izkq58U&@LU6D6Y;f;wQ^0*f*Mj>d4F(7KXC?5D;K`HY zSo>M628Rp?2ZvUi1rGD{1&7@m0Ulsx1s-rX5FD;i863X68F=cewm!@!g!5<0SUO>MoR;6!>6_%z5XfN=mxYeKHR)30H{V8tcwga>m6p2l54=kVE zRf9T-(WWcNiwo_-M)s!&HB@=CU2xE*27hrr&^|34P-d8Ov>#mwU02%mH>^n;$4+HU z{`15b)|B<%onxKr^v;hpb+$n-)_L)7z-h6s!Sh2efEV=9gZqW<8Q?`NUxF9cPX#Zj zbr!r-Egrn|?N;!ztNp>t&nJUd9G-B9&$DvtcyRjiQ1Ge+Nxj&7^^a}AYbM2k*A6iU zuj}6ryxw0MyrHc-cw?ix;7tu0fd8za<;Ta_T)E9T=+iskEf4C0x8@!OZ%guzVEb)H z%P(TxzHTKt8f0v=bzj-`VUvnXKn7#DdQ+9s>Id+q!};PH7L8COLsGh1-HJk2M5e@zw=j z?fnLP&HO3&x~KjrKJJaGRWey`Hh2ZT`S3CLcKLJQ+sAUjcdl;(-(9r@NU~S1a0O{JSm*SQnS7jz86CluHbsFe zFOEFL=91q!fU8Ui09PGt57rI016S)_9bDbJ8n}kjbFiNIGq8TWYF>OC1I<%lLzQP> z!-r1;+1%*TDR9kWC&9IL{0XkTY7@B5+&N(5;YXja`?}-%g|gP`vI=Z6DEc^aeaD$# zQ=g!#%nhm!2b)>80h{H|h-GsN?fPJg3$b9!+vULxw{-%S~G5BYeaMJj+qtb%eM`m#%doGO=S^BL>zfa+JX2EYAm{5Xy`=$yK+;)`UwxdM0 z9VNEyDA8@_P6pa!Vo%c+ljUDG(r-Rlf7%o(VDP3;YZnk465c;NL^h)OW@;P*ftw{amr6%Y0^mWrSNF*<+0tt zSG+rdul8vUzGmS7zU~=l%*VM=wS$E9rdc!a%}4g&+Zr{&x3jB*?_AFZ-(B?_d~dH5 ze1H0B@Pn0aQusJ|LpOsTPP+hpG;T)%n?H`q06*zF5B#)!D)?EeZ^6&4aqUQ9IR*j_*`eI13SiZt z=E$q61&bqk)H{e}hw`npQrNwQjaYWjG`<7Yl89voZQ(FjJ5MY-RFJL&>zqC;q1`Cv zpAN3HX(hPw;uXehF8OUbxXP3SaMjVnz`Efv;A-8wfUA3V2G?+I3f8k|0@knBDM6r* zftEhlu$&{<@R36bn;Tu$1J}&10j{;3*6Q5IJoPzX2t@20&72%K=;%HchAoO z_ejeJ_q?zU+$&xR?!E07aG%hf;J!(t!9o5PQUv-0PoAB?+RrK@g*9ZrNN{MyRB)JQ zcW~Ifc<=zT=HLN``-8(ZYJtO-dw~aCf5#)*{{50*sgl?Cl3gl0PDQfzM*=5h)8aTO zqu-R2(Kp31RGLIm7CnIIZTf0jr0lr!=TP6V_l4|#ILZ(Xie8)RQ39O2>eat5v_rU&?unqR7t1kqfmZpHuH9gXNgEHQvnFpgNnuUN(gDv+&5mO}IK>=XnB#IV zX7lIPBNA9;Ifxf~;t>;-rL<)!Erl`R|39VeCALq|TdiKMyv9HMM~T&VDr9oP#mU$B zXimQ9Hzi;6EkPni-Hj<(qa}tYL92xXtuFVZ=uQb*cS^*%Q-ao=6147IHbV+WT2kuP zyI$XJKI($NTNS#$ZUe(3!mQn*B4fiNsT-Qu3(cPI{9k`m$eK6)a6#@PyG$TwTq;A) z>F~+5_V7DD&BoJ%HL=&V0M_I&mtj6v7@EPH-e)9u)yS5v%&S`qS*&XUqhY_co&)w< z=bQ%n^{NA4zrpY%>^EFZg#AX@d=&eP!G~%_!u_F$8*ram+mC^@&p!oMSajcpb`x~Ao&;C?E(=`gk4@mp16PA3lX5f2nNY=R z7PxBv4PagK5#VZVe*;&qG9#Vc)oAcFxW>a+uzva8VEtoV!3Nh`felwVfsKy#auw)P zbGjk8)=C#}?dUh)I@657#^Y3N*j?SIa^QN-ufZnmu7c|uoClja2^j)?OkZvXH+b{{ zY<7As*!=l!u*J@;>Fmz(qm zaIk&LlQwMb;OYx@tl$oAQgI`=Y582ZcM>XtoepZk-uYI;41qq)mfQw6-(L~j;`>A3 zmWv*MT?VZHxBBiF*tOGvblOd5J#Y=Ujr}sPo7ZfxyY5e558KtQE;S{)A)9cv3+seBcY~Nik6Wo2;5pa*^OTay&(!sqJ55WGtW5 z-_Cu&LE&Qf4|Z?`_wyFRe@Ly~t^$2R%^##wUS3s2t(@#nwVbND8g2jL-@A8PH**9` z-xL9Fl1b4Zzqa!X~GuT9B32A^3yPI8Vqjl(#YSL+Vq=P+c}7fDf6!) z#fnyeWf16Ug#?Kxqio57PFPb zY#gS_Vm2kjY!sK3_@}1+5C6S;_uD9r#ps)2F={oZ_nc}zDE?YnF#4{bcM@W;CKQ7; zMQp~CSu}BJf~lzFv6!7a7PBi7i)qwM`n@;BV7$@4;5NLUl4hhDL`UZ{NI0GfpKQL7 zby>fiajdIyW(BaWj_r+{S!U1vSMS!N+!20B1LU z3eK5#4}9E6%sD;}Qpf(!-+hDQy=>_YetD%6+`l?2&W!bX;Uw6<*|Qk-Zzm4~=Wi5q zs_zzF$)IbX7R}39EGm=tWU!VSxf`q+ec6>+E$C7JtGZ*g4A%0lyTBSXyj+bu2e_B# z6iw{Grj7Ty@_r4fe-Ad(yPUynmcJ1Dn?KKnxy6MkV9S$h!40!8igCO})P%no4tmYZY1F4NY6TP1b|yY}x1^>7#Oi^t=sV9)w`aOZh$G1Oc2 zrKoEHVDEF~EZBF>5UAgw=P>vGb_%rJ_IA+rBc;%Q+0OzBS2`^*b}BjE`Xn2AKQlQ_ zTAjgh66K~SPNMvk4i{d%Xp@cp9CXetIZt zlAWe>aLzShlAYLAzq)fQk{DMvj&;+RTT_h>*Hu6+S*ly(bhHR}wtar{B3b?g?XP3Ur{ZST_(gmO+~ zKPkjgu&U95y+q%X_*mMgX!5)*yqa_+3D=j<94_Lbz7%{t(92hG3Kwk(k5+bU&OzC+ zv5mDomh|OcMau)nx7{$AO=sc_LAjHX=5C>DDxB;qe6rZk{lk;sn<_L*<+^BoLD%Wa ziar>j!`H@*BiwPh$O~xyyJuz=y%@Yv-#T{3eVdijl)sWrK-E-YrBNT%yaaw}k`~m) zOC%qFGf4o?{rxars?@N{;CU0pmo#nA3h;c#g|J`H=|CPIXJPdz;6?V!z>D(dOWAyh z?oZ$)7bb(3K8^-2+ZGO9p3@P$BFPuLa*a5&@E;q1V{|&2{qey7oV{y<*!PP|ST-<6Yx%4^HZL2P(?!bnp=@AI3C*2~t?_@^^r`4jDZgp1$|O$C{^_wf^Gz&j z)S`rlH%^Z{28@o5RZfx@M~CO!Kt+z~zuD@)lr?kaT0~iyufEP=-v8zS_`trK;DZOn zw)aC9Ex?DDU4s3Qy-&bLr}YPCEglU%79Rx8{(gA?AMa+9kRa$2EAZ_Ko4~hogW&$o z-B)>Re|Oywf%V?eap3#EJOV#RUlYydd819^SRYQm4*N$vy2JkQFhkfsX+9P9PrD?8 zpVh7ce%>S-?w`N&fcuyFD@aQ|-7db)M= zNis#$r83}F9Amk0-4V5^de>s4kwq84>J3xD<=v{ly@pP192;oX_kg|TeQxHaC{TSA z?6r@!h-0pB<1JWc)edmQ{kCvlX~t8w7Ah|Zg}o%!9QIXy_!ah5yYzy+Ze%TRwWgQA z)!PTaeGP+ZaIcp#6Rh{j3-$)l^S}mYzlOcxlNMm3Z34JvZgey|td;D*BGg_lx~~&A zAdcDimy@us8=S}})cdLz*u>o!T)&?g*wnOB92+!fu?uWgelqOMYdy>3ALcjyjAOMF z#PWvafmYy#msY}kqou>xTCm!A8SWcTT>yLQ6kREs+YHvpVznLjRLW}Sb02Kq_axZC zG7Ie3Y7@AL_G)lb^AkbjTxk0EXaK9T=Efjs&MI)To4-WLw)js zN)g#AB@UIHmqJq)_7fF>s31f|AS}rwFY+jsbR4Lp2!1|v56&yZpXAAa&(l~V9j*si3(L%=Nz?3Vf`a*7c^=Cy@vS$(;(QF54FYUA{jXx?*8F=*pDQDZF3$WE=3R8Cl@Zodb7M)j;eop9A-nfaA*Nz&+ay zET02+RX*I8I0x=mZ{c1(2X2Qnxc}H3xW~Pv*e|zsUARBdZW;JwBXj7f#y^SrayIl# zrD#zLmKQjCO)rJ-%ejL`V19o0OYnuYx1kqT)PT8k)*tSe%&KM)2vrYQ1TC-C460%Cy{Nb7wWg1jBtq28e5iI_ zJ7|T~hA9Glbh2!~6{o)eS4yu6t~~StSn^wAXq65b(5j;)P+i+pXtlscPpXc{S9F@4@nFs7nha>|S0CwPOlcUJW&OFj!sb?YHmUJbQB2Q06KTD%S{uZEiP3mDZX}(NCPeEAUf8 zoBvl|Ic~f;X(;)IH$`9BD%n@O6ba?nY;3VMfvro?C-_tKCeAVBC*HJalie*_W#6uM z?}i1D$82rbW41Ofwnd+##inh46zenP-?Fd(_8D%OE#0!B_w3qZr;uWOW~cOr+0B)G zW`}!b=VDv5`F8QwsY8nkWy<&16)A@@c+AGmrKrEc4&LfeoWJaqe#3IJ*k2{B%#rn~ zt$T6)a!|Uz_GPfY9Pn0txY)$;z{JPJ`O8u1{@Rqz{witlDzC(2YQ_1hiPHT=y&TA2 zO>n=cKSPl?KfdAb^^5aYQ>FWh`e2a1n!;aAU5bu1srO=)`z}btcvD+_UNyFU7W|1o%a!h=s5Nm=Y8ng#j0rL=Z%5urs6!N z?92}hIZj}Yaps4*#oNV#N99_LL$*WfWcCMr72y7dsAiaIoSh;lp^OlRU6)Vkc# zP_Al+2-ZZM#&@B)Cwj5YIlYlO{Bz6Jc4*QEldvA0;Q-B=U)9fE6er&*pPt2Jpu z8yhzHK8Wj_xq>(lTbRLd~(KtS~$r`K> za=i6fGE!)C`%mioUDCh?N^~M{Rk&d4(M^w(dURtz!h36Rmi~eD4zDu&1a-0IO))hX zMk~4u9;mFTVqEDes56B)IBJQ$M=ZxO>(VL&@YPi}`z?dDhW-&7Rz1zbuFzL1>8$#< zg$!1MvyQMgJoGKtXv+*Ko7Y@65n5|bEVTC2Fle1IU7^Mip3u6zoS^mmETASW459TK zRe+k-)Xo#=)1bm@sF}Lh&B*Mjel(j~9KRdHYPtIkxZ&D!&_-#8p;oiDK^w=5-HWVa zQ@}Q%)1kJ#x8(8ub}_#|?OP^69XgJNI@XGVHnHm|>f3%$C!0BvWXsL;>pBUjy1YzGfaDuZ_nouv}j$S?0J7b)LS)8)FVrwK366|eOLSl^*b~#nvd`QQxv$fU#%eKuFtDQe>j*&O+`&b zmA^jzr>de#m91#{rTPGh0@?;}b1)Ub$;`=Bd@s0`fXlsqQ7Bg&m4ggqL5?VPU|8fZ zx1u1%n?g$5CM=>qEjpu|P@PPnnxl23#D=}K4sx`f z*kC!j_avSWy91SVU;F>*zILES17zwC{L&qI@K|l=p^?p@hgS*EBSC=@er`t-E`zg* zEa`siwH@rU!}E>VT~3Gvo^R3aak*{YV*lKWQn;6OmphR!cKa&pE?3rFj^YZz;J>81 zoXw5;LTL(f@4KNqOu-+UtA0YC=ucl+lEzEETgSJYI?Qo_34M*Z{D8us8W#g)UF6!h zQ+ZIEd!Lbsymy?eyIhf`vrBF-=U$)!A8(cEs0D>SN@@ng1c!zxC#|VZC!*}1IMSp~ zi##umiw=}?l(Lq(B4e&Nt7CRM*91D2An(HY-!zi={Qy@i(M+LEeEn3Uq<}#|LK6dN zF*cY3LaEFDdYz`P*+E4~-W0OZZNg$Al(h&Dk9X$KT$LYuRBG@G)AZYHHJk~j< zS0FL^BW)ctX;T6;IsO-Drq)nssRK?-4GACj*!rIZ*6hG-anQN#VV)CWgyS9eHG$?j zA2VkA+yOU4UNj8*ov>I7_a_?}LQiS^3_V>=oWT0@tx*zwFuMNk&}#Ot5K!fPk^hH= z#J?YM#i+8h5hnEl|Bmk?1#Jo|6wIlg3k?maClR{85jDSzy1u;8< zKgZ32N)-_k-+-ts6K&hmVR=(b_+y3-8x|I!q^gtt96kIam2ur9f-VnGUTzbpo``816Vp=z8f!6bD3pHuM zw~bc&Xk-pGt;tPxJb;Zm_0s%F>W*>Hr`kcR=2u@s3maI@gBz|r0&SGG9cncz9ojfv z95-zpI|FPJDvq1B?Y%-O(8n(3YupFB{ZpkMHaL{j*rsSs1x@`?d?@;+$6q+F5+|S> zl8YT!{IMyNuKV_1noq%(H^t<0cxZ66(n7F1U4^{dJXmi!X21W`;!?`*yAd7F4IPc> zIW<}=zRdF%i!b{huM6Uk{?X`O)}i3HQ3%P|-|vs+{c-{p;JC+qtH&|tI`6{yY_Z>D;*xeA6F+Vg!^l@`3Y=(JvJYFqly%Kv$I%7dGq1U1b)oA{$_cs z)$GNY7OI;Zjb^T)n*r5RT_x({RH*)ynNWkAc&L2n=YMbu$NR;t&m)SHuJU~=EOxzD z;3|Dt%RSU&_d}{);_baxWmtIRfG{O36k$p}r?*{n!2%>AEJ{SwLSZnB?b7j@jJR1OgRXKxI|8^zV8=Q4>Wi~uC6Ku34C6Br0 zvgy!Tb0$D*PaOuWGbR*j9MJ_@w^v(eJ-?<K?AEh3H%8>sTRlD{V56sLXY*= z!99<^VPm0J3g<;=KIXL-pnb+&gZ7=30S)TA4;uWL%l>b9{hO7OkY*QW480BfH&q-~z73v|GE1Eat3Kqm} z{+--uffHYvp|bSzZO(Y3(=duMioDTjW#t_=>bn~`Fj#46pgo<6u3Jn4!zUeG%dyB% zod*uAiM6L9c1g_Lmc^Xu)-9U#qp^%E+gDJFo?TypY*^0dZza6{aiitn+&;^}vL@t{ zp8H{ba{EpR`Khc{TsBec$I{&Q?P&(ELwx(_n;z}^DX<#_+RsRV6{kqzn5v*O?moPq z(%OBd(`oq4ti~axY_6n7DSRKw=1MA?D~a9-p=_?CCP*Pn%jQb@x8_P}*)pxhZc0yh z<9lC_1bBw`iwTa14USPxH;`c**lEK=_mm3IMEzx54!@LCpsdSb$usm(n3c~Ur}tmH zkin-{9LhSx{Y4Ltzg~QZVmy>Ci|yt{WhctCl?Q@xB!K z@TO4hin><6<APjo)1zxB1uz=fBnA&fVLbjORjT!lvt4p&aPV?x)&SB9Pso&Ic)$njO$ zuqY$egGV}`BJfbgwIFg+ik=256WHB<-HJ``SF{x+%JGHqWz#p^%J+K_@PcBW)r(-{ zH!p|D271x3ZdtjD)?^Lq8`ZzBzp}>gzBkyb*U?k<91zL|dwm&mm6w&gN-lYEI4zqS z-7tk?qO!TsKW}dI&&!aMqGVgb0I<&*?DhIEKVrok3FShl;gU!Bptpr$`M0!#y)?Q> zj-^xT#hXIr!+Th4aAd#X5z5JY$ZGiv_}!(x7N=Mfet7yTYhmX#u@y2kEChwAd0$Tm zVEeRoambv^Z?!gyd4Z`J>=&Ai11~W*hy9XEZ^27nPJ#WhUAEXib9^iCeidEtexIjs zf8a^+c=<@NGn$6;@6pT}uZOb; zS_WglT3H9d+AsTnE3C?oV*{Pju3-6coeP$OWy^I|eo-ZW-5E?thq=MIbSbmZ^{hPB zntLBWYbDyk{-5geQFPu7^J`i-zQyrZ&=Tk0_+cXa^WQW7#{LAp&z>e1CD8lVq28)H zL_LxT^|>++>bqhI)bG&t1a|K~?L4&IvboUqk&&P^JN(gd_Oad4j5F+N1ZWH%jd0_ zu@+|o5vS)YX5P>VV}d%%YV;JEv3+PNxqqcTZ}h;H0!I;L+2}7L8(mhPx7?V+W7*O| z`NkaAlr1e(8BzYI7V zNZu4`aD0QQ?-X@!r#TdqldBG(>*F3&_4pN!O6`d$6bf_GN**~sW~7wQdu(<*a<8(* zJaf9Qmy(~ppdQF24OVIp$NrS}JkHewTkd`dZMgO}v{BkwsMV}P(8lpwq1Lf0pf;h& zP}|;OuG}tWfxw^tm7d3){TfCqRHRe+mtOM^Cc6BTZoC?lH58|_pyDq5rq`DG>GNoR zer@>;qpV>KWD}`VGWFK2{obGyc_pl@moDa+M^D`%^PU_TzkO_D>W<4>1$tx!Jzjjn z!$v6Qg*Bs-$Y0p5>-UB73$(;wA#`1u0bZm7ha009SyCJ1k;99kIe>k!UHpGEma_l; z=@-lP=MDiX~o|ZwfyYX6U9s`6s~G< z`0+(Cqci$-%aZ{PLI_Wv($jmIdAoKODM;}~rz{LsF;PkiSFPwQ+^0aF!_!>BIgYh# zI?kj#x+gUBV>I-?c{QnDjp@pucO12^d6MOuk;W{DCc0MCnz0;ic6!TtR9sc^qU{Q=BnbC8sN&XIc9Z%xd1(6s?-&<%Ee z(2bQdMSZsky6M3Z=$6b4dF;=v8^uA`+midjeEYB8!#v~nJm`*55zw6jdqZ~xwuA0& zr5?@u?{TsL?``%obYI{ynD0A%5xQSBThxcf&;ytI=-K@Pq31Srhn`;@ zpThfJNF5HnIHNyQI-wg>zFu@cXRv&|=r%@R`FhcH--6|pIu#6!`MB~n(c5pp^7Wz* zTmZ}0i(ZlemaiB6eJVKbtC`S;gW{o&LRO~maUXX|fj)7Y4t;7r0s72j81%VrDD;JD z7f~O#g}%JfG=<(7L1(EYi%>Dq2wLd}&J|JX(50$Uq z+$#huU%$D92Uxy-b4@d_eEnv1w*)?pZ2e~QYo=g%CCeTSuzdaIv|C{L`pxkN!SeN+ zLzjbj{pL@ak&-*yDsJx=%Sxt?Hcl4g6ja{5dmh49DsPgcav7D;C=#YJ8kNiFcMZ-V zU@91%9HyHGkvuo8O-43s_pu2not}nQl}$(~q4O0K%=`w?aI`_ekxH7Ftv;QJYH(yT zQa-)Pf&Y_dq?8Sb{GXqZvLcFL6fjT(`|KGh73aZLOzop+NeU&U_Q@0oC~qNll`ESD z`^y@cSk^PDtY;Lxn}U`k!Wf!a*0jU-!9u$-at-oa$F2Y3o>5Af2HXGIV&hhnSn)>v z59GOy;iJNa^otrEGe9|&!l863uDq+k*^T(r0-NTr5y^RFC!EOX}V`VYb`C{h3Y-0m|mQ*P( zUtujO9rsOfg*CpuviUD-Aa=6+8)cz_0!%?Ga;aLB&<<5{!RJF8%J}W3cacjn6bpzg zPgL6Bj3?T5<>j3BXP%Z9cuGI`u*YDNuH&h=!J9(9);~BjCR|DF#qH@D6>gb|xd{rE8=l;7m{;t5@aJSp5 z6?pd$BPpM6k8^Ag>%O`@;eOxKpJ0FR=>?b{nmrUOul-5Mjb`^p=UKr%D{ce$*u=`< z>>x45%<1cIIvJ$a%l-V|E&{CQpkp6~p!r~X$pSTkTd)X|XFYUz&)t9Gt!+)=9iWR`GH?4*HH*eNr|F^%1 z6~_73vS9vh!Wz7S!k*Q5)l~Y;2A7-D1FG6)BvkF&5wKTpI1^gl&>rR*+V!EDdNo8n z;{erqUM+#ckM_=rajX?iJOk^@eE_bw{uH><_+#M8KmQ4q1g`;C88HW3we@VUu18Oa zK%Z)st6Bahr;z;c75^tp=tU44^ySGizt^8J&z0iPOMX@bHH-eiG2vkYgNG=oLdk^A zMA?b5v6plYgyO2XKWxALVB%4wjJ@pUy=$B~#k0IAM(p8{!v-rSVt1!IK*^MB*3kpz z9Dyz|SmMMg?*h~(I*Yl)h*`Ftvv#>4I@TB06-c(i>Ob8D=zpniT|rkT^$&YGsmeP# z6?SeIPZGv>p1Vn8u$M^ z5d`;}Pwj;&y|Mp{Rtn#z1A0Aiz5|y#Bky-`c{uo^QQVY=aHm+I!a=&iW@i>^T$UBb zLXa0LTTrC*jmxD-b&HPMQY%;R_dyTe5*N3pI)}Ubq{`WHBt(@d+yfSo1C`RKo|PMo zQC2hJJRPrQB(F^=Xg>br^4g^xchsj+lFr+Ek*~ByUaiCA^ zTO0a^%cIfENtX9tLZ3T_vnI!P1E-vdxWz2%x;eMS0$1iV$&d_aOS^Q|`PB!C+ENwf z3u}7>usP=&=-gjiKA@zP*X8+wQQ`t79~}u=wi0_DKi}e3V&|8b-bs4>G}Oy$7W-Oi z6>t3E8>>yVgC>Yq>6>0w+sXX0nvCS%t$yL5=hX9_URml7N|WJGKT+yGO}(pYv587u zwiPgBlXDOL^w#?GDx|V5qP&PZXDP(~)W!7|tsS^4xC?cf=B*N4Zb9L!U3f^;uy7?+ zwAj*lD3%Z_TIP?ey^($w*8QEIk;Po$Rj8CzXWQNY*222KOR%pTZxqDllHu*aRYKl^ z3m5V+kg|O>`<>Xoy2%dM*U(J^>#5EI>ph+X*1z&C*dS*h*l^bXu+f(IEP*~Xmrazi z)|%5FTzhI5xXu_auyKSZxNa{?a6LZ@ut^IYaQ#LVz@|p`!3`?h1DmN=2oUIFCSSQz`3Hs|#ojr8-{hX$pcAOer{OaXKO&1@b99 z_vinju{(_dA8!f+LfQ|DP*T>l8Tnft`eN?akKoum(d>!q{c)!PGo zCdo_S<2|=74}PAPoxl&GY|Y2hl1~lAh3=_3lKR>sTSUQ`TcAF(s%ziVS!X)XA$U`$ z+X$elE+wt(7)IWf7sLkdPdv(@V|q|PSwW2M!^R@LtpC3XVwn-*>?t3OP1;|Q^7G3o zD}W(ZQ%3LJ&nSSQrL26p@}+MwL&=NY%n!?76uF4yFUrhODa`PL@|V2lE(&6$Z!c3^ zP+mf(F389QM1>BBiU|)f3QpC!<*j?5+4?2T&DmjDYZ7x@(Fqe0MJNy>*l2}7%mE{+qRXe?bmQ@U#mVB60ebCdPXq!uE zm|nlN{HW-=AiIW00KHWCmH&*cGPB1;N1vl)i#LUgTc_Y5!7)loyji|2C-W1J`XKi(sVnxa7oj-;KEhVCxQ!CL7yTO=p(N@?Kl`L zt2}LD=MQf3wlmbpXi$(qAE)z8z|ODzz|FSmgPWgi3~sT&5lU$n)Mb($wAJsApsryr zp{?U9Nd@|}@i+^13&{h!n{EYrxMhReswaazP1b@v?{9{BtNtwNkw2h5S4Kg7SB!%y zHf~Voha!J!DrzdU1VB;a;#iGKFO8oF^r6&{UI%KHp!AWND=2-W1`PVmb;X<-ic?uQ zkU9$5)S-3W!X-_ku)`XOn9V{YKF@aI!e(0v5uf+37v#r2h)FX zm%)k9V!s zq!**k3qEWesaV$j*zA%hfZ+Y>L`9CjsCX-`PgG3*$FpRa6U9>a;Hc<9N~&Wkk~MiS zkl(qotjXtQO{(d0VENlwlLpf!oeZFC32zGBIXXr4S60_JEAlqi#$ct=uIrD~=Wr0S z>k4KW{a75FCGU(>-H6XE3A%h1-MGR3+Bd#f( zNsTtFSJ*jM9Mv(V%dmbN3KgfvAU9=Q&SZXJQ=H&Qa zpmT+W(af~iC7O#e)7PPA(}BIe1hDx>qq5k8QaaZcl$|UoifRzY{*+fhmol6A_h+;( zzIC%jY|S7p)2OJaqu%y|{^ms+J4L2&smITkzv(x3JwZsN+z-WaR3@SF4Ru(eid?!4 zve~;kE4FdSvRI!rd-v_#P8WJnQ07e`!__%FCOA?_87?lhQLa+#gZ}dp2V}T1hfGGO zEgCuxZ@iVjcSqA)Y?RY{;1a~Ftv)Ibnl)6)TH#jvXjYxIUO}uCvj@Yz(kx4G<#e%8 zP71}E#VZb;8YseF^mV{{VP^k5G3&x=1oHy<4f-IBRj z%I>#r{2jV&(GSq=zm9=sd^ZHTV^kmL&VlWry8>OIyS;3odz|V)_nPZM_vx!aGq=nP z;^Q9}`AzAf?{*16bWLAS^sSx8{*euiYT)K4Wj0fHjDtQc5{=8-503`0ePR3IDsW-@ z;Y@I0`{8hKVf&$&)BImqn55mZnYf?rBZK(12?0}w$FX+kHU`=;q8qf6yq3Tj+(pk7 z+O?69sL$&`1FJg;{0Tg%7RTECsUeHdWBv6w)}F`Tun4_UI4&22-fJ&F`;5B=?K>+2 z8q`;87Y_dBTpSw&AN_`ECqA6j3PZUxH9q_+)y!8P9#3vUF^Umqo&>`uoWSaj5-Tvc zbyQ4XDe|HOmJ(h{U@4icjU*St!rdsDZG%dTf-Xez{Gx1>*QfLz8lHam%?nCqd6STT z3c3k*i5MLm88t##GcdHFGw~>eY8;9D$9FO)8$p>z&rU3jt*+r=k;+<2gNsV?cs?q%uQkW-pSm<@YP6w*_nYV5Gl4ZzYbdm6mDrI~H@K5e z!YprlssZz3<2;}_Ax7B$xUUH`*LfGrPgtylo@^wZkLRo8bVt|U44KAi_E|y9)lKds zu-4E$2mN0dTJ_$bKzYjZaZ{?b>cIEvZ>LTBpDx#z&B>scHibt-h7VWLKz4ibxI#VH zA$JaabK2JlV4eG|&#$bh55?uJ=Jg+i`l!rhN2A&NKzGY5){ll#o0d|(LtoB1o?l9{ z!XJ41N*XlfQdO6GbEv7Rqss_Q!Dv=qi{>oDi1sd3r#-0`HI-FejeUcBckjUOAGFMnL zR2*m_uPQ9AzmrS;wWLJKIq;^CSLqfUGb~t1Q@3@bt5E3Yl7(3Qw?$$s{;7GEl;78* z>^e7WD|Ep(W5m>9#05#IQib?GvEQ-TGmx5Of4>>~=k$9AmgimiEXVPR%e(M-PM6z} z0KGK|?rwI@#&K^xTpP#cw=T_x-ahs-^lr7EVSo3}HPCxY(xCT$pACI*yazPztC7%$ zYg<4c_2>?LJgYYJNwenAr{6S-7pQYAd!9d5 zHa66lN8c_sMFtZqE@n#QKf$w&ay*nw$EF;5*$SroTFTav+f+3$g?ZD16>U!Xg`dJEkZI2yXULs|;E-{aI1ytmm7 z=)S-cFyAMe3cW@HWX%u!(j9v6SZ(N`kzJSK1eUL3zUCF&%hxd;8rK*6*rz}AN#EAcr*$jB{#h#% z@N?k-_(dIc@C)fN@XP!g;8z)Iz^`wL_wCKsOTlmVZH}gQO;C;AYs{)<5eQWeSOhJv z)eNd(^S!9IYC_9aFttK*A)8sTYz0%QjN}|Q=e65Vnah)vr_k1>Up8d&v31iGlNV0( zJlj}#gvTf;k6o6=P~2Q}z0$HYrYw!&G`lQ~5oev$*I$G3yU17v|1ZFLurE2ZQpN4oF}KeanSbaq@qc7uy+>qVTeNP%L+h25237YwiETGGxSWQYNDPtf}Xwi40>+kTj=@2r=S;74W0P77uP?9O2@x} zUix{zIh$W@9}d1UVk!8lwJ-Qu-+hbN{(5CA@QqfB!8cxbZ)EdZb$$TfI@J(-``r-m zosAX2cQ3XF-}~hO_|Lb6NPc?IPSH7vL6RSpp>tKzEEx}slGr?NV_JOspF9BCL zu^6ngcPh9_qBFQ^RKz0g^6?4%kBaZ1BnX4G*+bEBTvsO9o^dNMa4^2TqocSu-7aHNtt<8##_*A{B>vzc*yhL;LG zD%=<{L}{_4#4+0@G_=LgETVeagI(c^c*PjZWDX1W~V!CZ$o#v znSId&&FsSX(GzJ8-W0=1)DUWWRIa!2rcQr+ERVcxjsgjHli~P?{3Cm|wCNxkr8_Zc2O6WlM34e;SG%?%l{sZkwWtQ?C3i{NhuMajHefp#hg$^O9u zl~m>Qo^Pj&(}*Vn`#0=e>Su)8`xi5tZCc%9nJntyaa3~OMudis2vbrxelPOqx;|N- z!}C4sUB7bV;eM07PTv%H(CtR#!As};#V!B&UdvzC&`!K5L>~UZ)aDthwEnQ_bhg4M zaGW~dMnPZwo-6chj16ny{Jzt~Mcf3z5f@0k!sr6IhZw&AV(jREH@BGi=XTp~tt5MC zxx26YDUFVbjr})*)%3?%`V_1z2l6$2^sOCjzJ8kQ6;SYQ$FSj%;Zgs_J3IZ5GrzN# zFrzeYfyUC8T^iA|#;w*P3)=JBD zH?me9JnPou{s0pd(LkQ_q}F5fqm~uU%|f5a5LEV9k3ksLEV;tgMIA4{hXw5AJVYD6Lo+4 zC%V2-W(}vNZwm0Oyg1Kq>%>zPQN%=DzA0kT=ZJ}?kfG#*G8Hr{IKB%f$|R`!~Dp;I?$ujCPK3oi`_hr#eW0N{$4C$=Y*xl z@$rsFRDk)(9yZ{U7X!hktapJ=*A4-nkvtdmP8Rg+S_kO4O)a74r9VP1tUVIP$Gw=g z9V-1{1k5jW70-WpTYs2eY0?+wSChQJ*J`u|Uysd$-l&od^P3Hpi+b}bzKw$Bm>;Cj zx9M4|TF-6=v1%`{2kYK?1FlxLC)DuOUZ~MekgY8;G!rtC?O^`qz2g7{WJ64$uc6_)1 z_D$6^kp9e|GgaHfT3F5$@Z^J_iT%X#@KXolnQTKaZ~3d)?ei(;KNYZUmt& zzwd(a3yxH%^DIRw)T&Q~BbqP+qx*d*I`O7DH*YG+db`sPZTe+pM@HO=>(JQ2+OA0> zs_$y-*tlrH#ndPFPA7^Pc;m_iA6jxlX{+YdpcBv~h|^DpPc|9LujkClYxBuW(D=~+ zw^>UfK3=Wmvv8ZW^CktceFf>au-7@ADrK&iF#ud?Q#`ox;)!rC`K>>=%9Jp0)zMyH z-EdEEweFVS>fRRM8qPXkJ&Oup{dyKb0(}fL#SsjK(M{=G zX|gXvoZyZJ@p#bV@ZhIGKZ=%T$~{>zAeYX<8^^Rh!O_af9C4*L<-o*Bg|MAz(R|lW zx|9?3UiUoaQ!ieDPakd$KC2;!y1W+j-1W=Q^HbmD$?LnQyvqj`rlxSNo2s>t>-M2b zMr9U#SveOe$345*+wv^!!W(wuHH9my=`yK$rkg95i56uP3^}p2 z6&l)dYVIsp+1k->OtE2W=R#EE4)h&o*K;MkZM^Z5_Y3bgT1ji%7}MeTeZ#z#b06)% ztg7cXuafXpUocsYtG_fV8+_?Tn3T=0S+|OYEfg46{Rfk=ZM_=A_BGdj1^ZgbdQ#@vGb>>KIuq^(F&jtwfa?a2l`_}scob~nt_rU2 zP%e+nO--8yu{Lns0JdxQ5Nz)*CJPRZgQRR9@W*c~0!PoR9mChg6@*w-dB~O3?ve@r z)63C|-BOz+-LFbCy8)tDbPAPs2<7p3;*>*0o@msTiMH)&Ki>F#@b^$sTTXvEIEUtf zS#mF4=jSwpa@nlEx_ig5ChC~t`6cF_$zz^#dPM^3A8G5LNkyitOg{3$hV4^==EMEm zv74irQyW(W&-=;`n&v3JCG-23z|k{f-&OHT$s zm+fl}UA})Ibj3mw=*pD#(d<5bvO0Lxl)=!|(S9jxz9wchbZtOm=sNEn#%#XcMglI{ zJ!a#(D=?RL!94K;+{?RQW?lx%yI>|yf%_7>U=I8a?&V!DTUo>X$GTu<`WRrpkB-qT zy0Tk4*95-4oawF-RvwK-&z?p%g+MF)U?^d(9Pa^^#5RFe2{nUO?W_+iTL}&G)rwP+ zm14GI`HaZ&Nz6(+2^vMVhWte6n_>d`P-;PO31!qMUXk!`6-<-N-ORfwPJr8ua|)#& z=(20$(!@MEJa33^l+||36|H*)D z()_?4QgGU|1@GOo!UlMKxO;9r0`6Xz&jP=!90-1;DVAjwZzdo2&8cn@*0-6>;68t& zGx*)2n&f5r{3fejxuNMLiL%Ua-?*_z;5JMMsMueuGc zGxspqctkDiUw8aUaJ???z$SwZ3H+(=cnNIkvjW_p`Yy1UWdhhN{~~@^XvcspF6;nX z-tG);xNRP|QBHIm8(1ZM3vRroBiMTE0I(aa0n z#O@5ZsfH!k$>=%lMJ2);I$-D5r@_tk-Ul~7yBXXfT|0q)wA}m$*k#&XaI3^|VArT4 z;MVbpact10eLC1J^c%3d^$f6wdtb1}<2@32rb<;!{!^B}`bU(agIUEz4TvC609K43 z{JGOfK@7mfU%SRORQ9!PZ2LjkcX!^kr`_mP=1oEu>mN2MJS57x4V6gRMa3wq1t6Zz zBrlT8Uw<>2-`B;X#mvvjht7x(*7pyE`38Dj*?yz;qdeAww||7aJf8St1OYtDPKbtWOeC~ocp5XlAWeIG4VcYB!){9eq0!x#^p_js=p_j+{La%stgkJ4q z1-)kB0KM+%BjNpTRP6x0Y1T;8NA}R$8kI!Nt`5C(Jr8<~)xwyblc4gQ_&${zRROFz)EwboE!ZrD?bSPo?^F5K zT3`(u@qN`M@^f0h)cnr8&_b%Y--krfUoSTC6ESiAz>vc*H=wqOz4>l|(#@~jI98%ca z=&~N{Yi8E~*V^$CTzl0EaGkkl!NwyR8k2LO?)a_XdR;4mO$MEjuz7vQ2Vhg5E#L;# zkAclBlfY*A_fp82V4)ocwzzN~5U`_HZ8pZd-W**t33n zu;+_pV}U;2YPMkSQ{%xtS9QU@Etke|+^I^lWGJOlu{0Hrs^utGHp7pjUdoSAu54Ny z=gR&_;9h_9O>Yi;W6llEodx_Kd*1;N)zSUC7Q`-g#S*NDieSU8R1pzG0b5j9V1=dZ zt_zD|LF_RxwrGqcioGkbwJ_x@() zPC3)(qCiV609t7QXoTTHbGYzjBRt1@?v%AKjD}JiVuUfmfd+lAe-9ph+Y;tR(L%q4E3*pV5#$+Ns@}Pexa25aYs`^zaO8QnCPondR|8!N| zzC?nQ^=i7Mp!?o$CDY=QzXoBS3zBK+__q~d-_4R~>2$0*KCbZlO)@S1t1#+dv}0gJ z8`J^g@1Rn2QA(zzYwSV7fo_s%3F@?*aIl?ZTDnOqu@v1El4)QNqovrH)DSO7}AHM)Nyabic)i!-QMD%AbN4T5a4- zxb+&TW71~Z1j216N*$ASvvh=AwdwS{+o+#)$aC*JpRh-SmawPOD8gQzT?n@?(T}iq z&Blbi-%1@5pZsMB`&>{d@YnH{H0tTQS?ZW{I#xOpulxNbbxizMz9QUtAaOoBR57hVx;Cv{A^)gMatyDOxQNsqEKb?8oy45?$%^VJZ-z0xPA z;Pvm%_9fhV*=mG}J{w#K_Z>HhaLBakghSO*$3&UjHWP1z`2^AZ@V<7LQmM$FH$RMu z;J^RQe{f=AQA>pb=R>f9fPak@gj`TOps;vgR~{~yuUHIQyXH-4Ffb@kBPjfP-eI^*wZd$DYH4cTTuKIDNrN!n-tE z3GW^`f$$#x*@X9o>j>{_kW6@gr=LU7odd-~2_LMlC4BJB&?vlq>e5VCcvnTC3ZF7a zuUtgB@Y6-1h>OhmNVw>QU8IX8Un5<7^8(T(`lge%`E4}ml5OXcE;TTcbm^+2NSEp1 zBk8Puq{}t0C+WK*Lly9=P_2Wc52#4n=BX>`CElbf-6%@B@>mDbRnni3t{Pc{^mnNz zNZYl4OuAaiTGG{>3uP$aS3`ZAbj=bEN!MzSCloF#YUgz)Y+vkFC_sh%&6*jg>pb2U zirQg!feh4jk1YvBU2jDV()Cx3BklN;73l^)$B=f4zDwFU&X07%j)zD$>ZZ<6z^`%L z6@;6(_!4ef_-Dc{bA})X4lyYw)WM zX#0ml+~8wf7ZmVYa}cLi=55BQm8I$U_r?=>iqjMtt)}$v1=Xm3FBls2?}e2qVwgNb zP~Wcw&Ro~`Yl5A4r^aT}FTd_<-@Z;hNKFuH@X5cIqelm~TpIoJ0uLbU(q0m`O`fBq z^7ZR>xc04l6}uIR@$jvDnaUTxLge4<%PABqK4QeK^u)}!t9PEluq?Mz&Ziw3Hfji~ z#~Lme+x^ejYf7(cT-M?Lzjmx7@pg=9G2Et5JRGq4 zO`SeJ1@*k7{F$f^_UudeP@#7^#D`A*sX%?i>PNbNWQZ%_Q?1$(KK;{Rdj5?2D#B;I zs?+^*opusF-+CwE3kCY=(4C7_p40Oe-G)$~s_NFRb`U1Tcj{Tx`LatMm5R8U&rrhE zBj?#6uHg_uxTg0=!nH~bvBB%L?Nx+pKkrMpjX0l8H%NDWwWM3#fDN8A}~N1uI{G}cXHFIb7|eCE%<`Qnb!Gf+8k1#-J5Lnk@Tgo z{LSH>qSIXaG}M06>t&$!A9^#C^rxRvQFk6tECY2wzbw*SLZ!i$uI)1j2f9jwEkU(+ z6Au1P8f@uSU?Jgd+0tN3_d8<<_qZ+%w)ET|MYz|_si6w^eZOWj>E27zG7$Hf7)iMA z4^s$-XnhEWMkQoO-=3teO`3h7S)oWv!Ndzu;JtIcwf4q=dwnsgrndwvYVl&|xMbMn{uxJ353@8+nY0Pz8CJq;kPsK4;SXWVuHZqi? znvnK>gZ;!E3-!Q;;+RoGu$>Lf#)H_w)e_)`{OWKDMnaS_E_eD3Uf>Y~{M#Ta#DU`5 zB*s5aV*C#qWIg(#g>nxhEeaG$rcfCSF}YKuuqA>;iUv-~+}PO!4N0;~?e(aCE4d&8 zb!v-unW*KBQKw24he={I+1c5xj{;jUp%eZK76se_iz1z}kYh&BguvEi;jpiEJ?tm^ z3eTfJOV0SVUds3c6|L}TjE;W!2W@W!3jQ#L{(+)_$MBVDXjwhhy&%5UmIJOop#F5S zwJYkZDeu!zXCFP54$mqS`YY6;&SMB5oY&QdaK7M1g!9|gBW%^SvnxCe9uy;NU1U39 z>+4Sm7tAV6xX{j%gbQDNMYzb)C(b}q6#er&;bK3WAYA~VEjc9(pDR~;FyV5~5(rl)(1&n^lidhcywi@b?H|nvSNf~B zs{($NC)*OPvZgKJs=AMaznf@B*lt)pXMC=jHZS4oEj|#g;r}<`nia1SuGL(Tu7F>y zcRLB!e*TuQ{l$5N>%7@Z*kSjdY4}{-^NR`Bn?ILu{Y^g*b{sLBaD(a5gq^~|2|K5Z zbydKxp}QC1MxkoLjoX}e#_LU7eF--$;z`)0*k;1b3Y?|qn=48XZhoX7-EVQfUb+H) zEtfwa-0Dy?hwEGnn&q)zi0V_gnLdrPPo^b z<%GZ2rV;MFERy(r5{3}&J5I{~Awhi!hpMIguWaH(KV5w?y%IscvZXRe@STDS%Un>$`0j&MwtBb+8E#8|@yE>4XaNz-EZmsuld&af5Jx`FjUVePe7KV@#M5-$(&X&mUD@@n^bj9}}e z8Lp(?A0=J!)SDBCZFgTvM_p;{MZ%TmZzo)3*6RSgUUkGA!ru+PK-ey3n=4+g_Wf4E z)qQ^_T%*-&!Zqs+BV4OeGU3`ql!R-42qkR)(1UQDzlWSqz|UcL7s7S#cOYC(+1T|n zqcsY}?^KaUO8{oVo@q=U+%Nm3R_G(UHse-;M<^vhXttpwUbo~IF=0`fgf!MhAaq!6$NRqq9~qcg#&NWq)Ht8Y9ZCD1>;#ix*@ z*zr(0P>OX+OPN23%J7&p%4Iv+Z8O0V7ru4tT$qaMzf_lD;&EGI~(ZUAiB%HJYw> zYjTKix0#&?_o#AP(t{e1?)m8e>0Z5TNPmBI8R_0Fo|Epge}AX~etj#RAslkens8{| zXSh)3^ZzLnOVWXdYic0XmZrK67*oxlQT8(=bAPzh1xlv9$R`oXFwrwTHwX?8bG-98GqD6BQ`R>p;? zrN(k2^y$k#jA0b~eMRZx5@c#Xhx~Bn=kOu;0>gFEQFo3oN`L`w(boJthn}Z=hsar| zGog1U&nf4Oj7%CO%e7-LXYqa;tD$^GjD6GALVCT}9 zMp+110T3F=DRX1rQS5jmyEt}2eWcm64AdtYjH3?Nqh>oG_Tf-om$!sJ%)-=w9!op> z@u;)&R3)6!T;>`Jx3U6D~SrED?+C zoSK3cimMjT^DRC4hSErq*_vQD1=^(vJ~)=zBjb(zK#X-f?j5dBgUcIcS#W5{8<+Y< z(PT9IEA|c9W3X+&T{-)}fzaAmL#*K|axVr4GXo0#zJh{tE0`A4JN$1s6Z>;f(NPuESE*`;z5eAC}bPCJ2G9@a8H z_Xmf!@V$U(64dj)C%Y89DDKa0!LY4}MC0e}gJMx6kIL!>*?Wbi(u9 zhc?H8KPcz0YiQ-c+&Z=P;3Ucx;z5+F6Xqr_gHWSz>8FkupvrwtU6Ap-LZ zCWy>4jGRD@SMXhBjc6_)CmhK-~p9gzKCI#Nib$lW!kJch8Nu-zj#uA!ecHW#N((00&joMe~s zKj7!Q(-OG448|B)cPF;RN&tfOl{Zz11SfaVW71O zl?tt9f%KEczc3XWHllx-8Ce)OY6Q#o;rK?_{bF3YZ&vwkdOCgoe((i_EtLLRL!2s? zmMNi8#e!KBBV@{}y$SHQqWB$YOtD0_ZRv<@_Df@mC7V5UMcgRWmoj$a3ZA;00S(C8 zm?0rQqk)B3`KmF&gu{bXQ-FoS8qfe31PH-@a;L>1XKFAm+1Z*l2T4!1`cM#0S^tBE z&O+YGW(YI&XH8DZ+r%qVA@C@y$q9gwj9fA~T;R*x_$wA)BH6{|5thjM7!XBr8TxmU ze8xR?{K2%e6;5(|U&75w9=K$?ZUO3qaHU$GO9wj2Z$LIBxmkmk7}}@B%9*g914^poXCt-TJyH%Ust)dp^4);a07)kDFM*!(y4N32uyB{P<2-3 z#+Le0I@qm5{ZGvjc~&+*PRqKV!3dZdg#Vg1Ql*h~Q}gt5YdqL79M*OOXf;Y*F4Ya# zTgSAd;xqMM9lp`zub3p)Wtd;(+ByJ^?FsSI>Q(V!xzrGm^B;X|rrX9|6ns_B0dJtd1W@V*1s7tonPyuzRq~Ug`OMf?=aG9Rrgv(?n5iZxli*UJn(|*I}DpXgd zl0G9CaQB??kH}5`SJMV15)rKD-T)koC3JUnu zh`wisx~5GQ;aVLJ6Rwq+LD;_TO2YOhc2|(roLWB2Podbh8BIoXbNpBOv{`(p0vgBg zQ8T&gi{=BGj>dK|EOHRmIIMB<*&7TAh{6`3K&3j@&h^ENkA2^q5yib%Fa?uc>eDWX z6D5DhMEu_|k|@MJ3?w$I31L_Kun_-EhUy0G7ana51qaMH{7VCg@*pA(D1K=mk!=mI zm1&?dPMb?5NHzsz0{*vJ0uOdwGJcPT%{@WNC>R&YopualRK@@Y1aF3pU_2Cl8vCK~ zbIkPE4!4lqT{Z;{9s>@b@B!8<2jo(8a{*3vDRmSs%x?k#zA4<*>`q|cLi$gkSVebN>Ch*bu%&@J$$CN00XkIwv_77#O|c;^ z*QP=G+**w$7oGoHEqZ-qYKWX8*>~u!jQKy&f`OyOF+a}!>ipR7ct{;Nyle^Tu8fUU z=h6qF%t}zfrEp6DZ=EEo=RQrSg8MeCTW{>d(JHAv7!{fSJ39(_K&XM zKKhY!R`-bjEcr8*);)oGR?+gIq`&fv?$ntZ!7#%PSCzDrb@9+4#6OsLjk*y3c((MY zt;9b$ZHf-vIrZZ<;-3!7CX8oGqZJC1pytc*VAJA=H7@UH-_)l2op#wLnSqf^KggT^4MpPtS zDyT5&(ta**7lwfwKO$VV##PegN*^a(KHpABzepop;nqCT6;DqgZM$bA=}OzzDDYQ# zWh&_^vnP|TI(`J{?}o&awu_A*U9ER8Y2&BFTYK5y1>>j0E87z`eoEZRV-nuCf7OI^ zo!hlYJDe>?y6!$}()HHAC0&2vebSCoFOhCA>IiA4gzcoABUX`a*yo~6&I-N%#OIET zHBjj^3@!W%H4vP24XwE1HaMmMA1i^%wz8cx&ea{dL(FOV(4wOw^*y{`Vi>REL4kD6 zi}a-u;h>im8b#D5=(C`J7f^il39tbpmlhaI03WabSHcX}w@uM1sHfbSKpAkBZ=4SC ztgHisXV3mX`u9U4>H3^xCk5W0yL@9N>eP@hxRb z&o8%nO4sGX^S}PE{OZJ8r~iTU`hfhTH#O=+dUJ_`lFr^jddt)0q_-d3l!@W|bMsQt zJLZPa^_{;-TjtYeX43Ut17k_=j_N~tPY-|6d)ry*kiW0FGvWO$e;No@C zhw`10^fNoshi`^uBJaqCu9AKvtwcYX;+uijk6w}D}UKmBn&>C8dDkbV|DiuCjFHL2+Si@;RUFFhuce${vc z>DM*lNxvx_LHcdJU`fAdPx{@hW~oqS6h&9mMWrYHh`;t@y$^KVb!+bgZR(yye$3|M95qoVD7}D|{1xPyr=MSs&I27SW-ziQAO7h8i(mrQ+Oxa5rYa*VrE!_Rz(>Pe=%dp0ykQJ{II z=-N4#ju3GG$MH>UFrOzJ&!kTS?FsftL3}ExC+UCtNRYcT$bMYPuB|}#E+0ImLwzMf za`)L`3=j3J{5-}rSp-M`sqGlk>UfFpGO@3xQV{%vQ;Zr-WZpYYvM zi|GEnybJ01doL~!|NgBDbpOHGqICb^z9Mx0(Z+Uk|M44XGx?L>B)j+Yq7&WEOnR$> zxKUVt?1oBF@bQm?3tb(Tg1GSUKQmF6yeu`0N(Eij;q>HJ{RhXD+(WXCX2M|12P$zm zx`ZZZ@oY%^XcQh^V)5XT13l{ZoC|paMamz(xzp{ymL=BvHkfWdozEPIddi)0Z&Bm4 zEb8;Bi4?ErpZp$**!1}<#|*@m&P(;?snjl*+!teF4kDtxmZn_BSYdMq?jn!)G3pt&uL*^T}! z=X+;4>F0~-2j8?8riWNH?g0~`2vozsiw=hBb0-xs&?t5oi^(p53s8?4Ihyp= zNdHNQ(+mF{iu&+6>3q*4lS2w3KGh+Pa(TJQPZTiFk{`}0fEgQQA8-%bh<0*uX z99d2HR7@elr{}jIe8wX$;j^8J5&xXS;1d|0^Yxw*zEG$S;fr~v)AJYawUpaGv?q6NomhiKeTL`}ldrJ6KQ~|=TziWO1;z&_I^NS9(b&Hvj{$N0;C{%F> z;X)^l5H9>qI+(Y}A6Y4Qq3A_dx^L{NE{1_R_{m+>5^qZeAg(wrjjmU`l9qwE(w!5T zs4MS(O1jFdhIGH`_;|wK4T&Ia7aL5vTJQFxt9NQfx<>0dq-)l%NV-<#!lY{#`9Rv< z%3g==+rO$ny3XxFq#e$@CtY{%L(=uuUm;z8;W5&VKaI>pUV~9<2s84duNV_!pUece!NH?!EP>0Vozv@Z2#fM&mTmD&_aI4F$ z3AbMCLAuShs-)YFsYSZoECp%Te%7SjMpe#4_uRei6ZQztBJ5e~2w^Xe48rZL4o$-6 zylY&yA^qeIX`g(%Bz^oK>5jJ+koH}@oOGw7J161ueiN^f_Fp-VbZ3o*?gxw?Nw`b* zA4zwORgn&CzJu-ub@C=0T;88_x3+U6{l=Me_rDs@UIODduRPxSc@0gr&)@vIJ79IB znZHV~8jSkyVCJCzPJMYCIEPP;(l@Mpz_fYcXRELa4<9iGp#xZ)VULsf`73i9{5?<$ zQH6q4cd$n;9nK1FQxyXt$6s)ehoUh2WB$$4rX{-+I0*qk!Kx@Y(8(=U86T5N6Bj|? z1or*eZbGR$&?4|9U!3|iC>g9?m z&kuD7=N)KIIA4FyG`yZ)>5-1ws!MIc1>9;8wr*IEu=UR&gbUd`AY5qGWmk9{K1_0y zaFL87bie4u`_6d1So$i$#kU+GTw>W_SG;aBV-?|&<5m(bl{ArXY4rrcWqS4}T-HZN zxLk`s!sQ*h60T5Po2GzY#X?O8+ve>;*tT978@z7&+?}v-rubA%!p526wFL+pXNnVB zI3v$EQ{1f*VdG43(@%uunc~`IuM;-T6lZ-%L%u`d33jBfT_s%ifsSy!9XkovKRrGb z?>o+!N4UW{4PmF`k%XOp2_W1sGSwNMYZTvzaAWTggqsAGA>7nHg0M@Y*Myr{OX=IZ za%npS{F>jD(znHjSA<(0C``|{x_q8+>oh5S+icrHxa}kBV8UK6Za8C8C$HJLOlD^_Sr;n!ul)y$$lpSzE;}BYq0-bM z?kd84y6`V79E%UdhBo{Sv)HiP2u8~%rsSzgf7ie!lpB~BH#jTa4L&I1)&W5WXkqrm zKd`Ck22D*xVf?oR;xB({WOe<8O%6esN5L5kD)%bb=aySv-jz#!H7vlUlHaQ@;v?fc zPoOrH`~WKH?@tA%;q|P|{R2>EFAZ{qz(UCn3_z9V2Nze=c?UKnoUeb^bj10UT~463 z>e3_~bpf}=gsmHvBW(S19N|JX((e31tL_KjbA>Z6(fuMB7wLY{i*H= z7ILTiws|FsWLvMg9bUJ69*~Z@(#^(cs4Jgpl#aT}?y`idt}R3OyLoR2+a-Ft;{9sF zFA}ca&4F-@=-1A8y{1bM!nHbHAY8lbW5V`zw-UC`E|d-M#@>?%HwmmxxT(FKuuJ3o zgqvAQ>D#<=HD}~CzbmD0i;wvTw>(gRo^N&eHsRK3Qu?;pc7Sl(N#)X!*KXD_!me5= zeceXwOT+8#ou%~kh*(0{(`kD;Uib1GN7(DdQ`g)n`73T>neP>b|EdB^i?ZQdHz@gV z1xh~r4Quk_L-7mEU&V~N+R2f@0w-05|qRl&vwycoB)=8i*6@ zX+k1HyyVMDMLlP6{S?%5w@SzKrj992c;3v*I=nvrNCIRW_`t}>H<_pxdYz*Ci^4Aw zUL1Il?k_1jot|IXcpKrRS?lQj^3uN(UVd#F;T1225nj1t0O3`qm4sK%=}CCaIuF8W z$*ly;~CA(7OiVjrNrZZ)$Btcyoa)!doicCA{TM2H|a1 z`4#BSw*9*aZ~yxa;Xl`0%f#zD_8ug>b7DH-^j_x(?@DV;&+i^Jp75T|qv-zL2o2$V zPW=e)_xmvg-8oRA1L1>?v4ju4RT2MiF@M5`FG$;3j{J~C*i-=(BHn4k3kAA!#`PiL zv%zNxpR+qg_ zf7N*m;n(fdgx@$t5q?`|bSC=yu0%(|?+Zo}e*ZR7f!9CW^CA54f)C+O2kQ~e+FXxt z_R?aRP)4Alhu#+a@{D~-IPZX`g!A<;s>46>D~qI{whDMcxPa?p!q(0w2wVSbPq>iH zTEc}^Ex^a2qMu5*NX9R8zv#uZOuSw!-9WhbmMMfwESrLtp^2YBxa7D5!ljbB5iYIn zMz~DR=7h`oG$&lHg)QOo4z`3VRBxukKPnddNZ2-SMZ&hvE2Q9sN;f_bu6*)6;VQeX z60Z8k6~f=m+ez3iu>?L275qHH)q|fAt`YrbCjL>g>1o2XI?g3ryX*$S_H~C7w$D15 zf)^YLhZA9sKIb@R0O1DfJPA7`_ayB6OKrmc@lRas&j4TX zVBVD!p8xbGuDo7s`noA4{0y`FAAELD{`3EW&dy$S1`Dz2=ma`U0a^`k#fJW+uS&^B zo#Q|Reo@K;+6welDY)_FmVs{L;6tThg%Jv7FK8Lyd1Q`0nh59)>>Ub#a}c-3iX)yC>MzJ%ATlU8Y@B|8%SV|EuEy1zEEV<_r%LmCra?_HnphTdff zZ?rE?cvGu4gf|z+B)p~4MZ#O|oFcp}|Eo-NXWRbugtz~Fp75V*PGsQq9ecMB-Z^nC z;q-;G2=CHPCA@poP{MmUClcNp5kh#MQxC%X{f6k!odYFW5DtD0|~!w_dVe^PQ3`ftur74-Fa6+ zYVp1=*pu-4w>>iP`iFb12!FiLlJKX4RS5r+Ny$4PgKE}%x~xzrLyG*NpUA{m1!NE| z;Ch{~wexPm);~)vl|nWP2^U&5mH34-#}F=(F`Aw)dU1Y+0)EBPBMBGZGKz4CWh3c% zn;HEGmmH@eTq>yp;nHev!ex5aC0y3WfpEDNMG2R8C_=bGb%#&|{3;fFOxQMW5yH05 z3+wQDr5le4S3dcOaFtzu5w7~jal+rt`-8AuqJsF0ZLM zI!-2ByX<1Z_I2Y4+h^_3;d2g!g9$raTSU0-gJy*5?HEhA{^_7lcnn%lYQhcHxe#_r z_9g86O9jFWBO^2Mxkmc;gd2PN5N^^{I;N|seLcc1jdsxeX4X>6xOt^Z89;-Ngi0;r z79X|~Zn^&?J>Tl`9Kx;FNG;){XK$T@bs^Mtu)%r@?5U-{p)Q0g(wT@**HN7Z?Itg5H+@yT z$DUGC2%-+!O&ws%hdP&bsbFgfYFMe-`)@g^r>5Q5#&7c}6euO7ILK)>ItC^vVZJ_h z2ABHe#Kpffi1N8k{{NIty?N{L!O6E|`v2Wdz1)fa)+zt*>Xe&IZWkTob7=MFbXxz> zjQ$%PRVy&A+1aZP|5In-bKQim>tePob2r~eFcBy?Fbt;BPaPhmj?As;rU2GJjQ+Fw z_t<8d(RwOW12En6nYOBVTl7QYN#pT(OKmMon15<36;>>u1pL-k`v14BBuyv5AzJ^T z|DXq13(M+?RGdUIZ_H4WMj8%+VIa0i1HJgKY}T-!J(bI<)}Tp%uY2T9Wv+yxWCbGi z=f85MXuc|I5|+&cqY6-&Ug(uUc;UpwDR}+JxT1uO{ZVBFdhU%=B3*x5N3sR)O7tN7 zzF;EVfB)8CgZvNodJz72p*!JE2U`-(+T4P0_R`8|0$_x?k`1anW3y1fag(12=j(5q zf;hjj;w02o0UuLP7jXSR*xLCTVe6lp5-wzuPWaomPp?yaI26`nbSWIJ?IK+FK@j13 zI~EYGe_EG<7aZq|Cfs0MSHe!ok%XOpX+pSREE4=|0PC*wX+~UJU!Y%hdA>8WnHo~pb3Qxj6+HCusaNCKG2)COxjIgWr zIAOO@vr_Pad*?L59uY$cdpb=a?By9k*z3hU(}ynqvBLj1dq!|F{8Y(^V2|i`Sba_> z#zT*2MXJ;z@&j|>2PVW1dPIKMBLdJ2E`E6=nf;<>&PZU+2I}0g977>O8OvdtjwSco zM>V&Rg?cve#3YQ5=fif9exY4U`en!h(yuyCCH=bHXwoLjINt_&Cd)XA@cXwT?eO}C zd;JK1yr3fd>0k%KS)08HXD^jXkm5H7J4hc`q$8D}yaS66&ey*V<@o$c`&7Jd)kP{n z1>6b|wsw|EkoC_VgbUe7C8*G>u1uBaE<#HEvN(B@&bkr3d6sP+YFMGHmwmtd_ z;Y!<6GZ9x_Ihk~o*&|5j-X4$gDd?ZWz@3u*r@bCicj)l>|9AF!tfKevuCbfq+55>M z(mweXO8WQ;(j9M&A?>^RXVRUHN@E&+6SRbbI#mh9V-)h|rLAFB1qzxila^+r3t7G_ zPgk3CVHo1B(E?){{)O_=a4a67P-6i8-EKPWF@tRvFw$JtSy5J@XdjTLB5lg3LK`%y z;avr7%D|)Mr~&JVt=K?M5MS7s(Udl6&~6QA()tSfGuU$#puoZo-dx(BF##OM(fn^m zDuD6$cBI0$BNea``F5m21skvl3j16<^XBW;zvT=p{6BM~0^2skR#>lG`=AP@-)9=D zcrL2x_pIRHu_FMY6gOSY`OB@JULCG_*>?N zhwGK*%qI0Kx1A2ppp;^GaBwcvcQP{~LLDFC7N!gn_Vp1sV!Z{RR3aMqf42 zhFEjz;kIWprU4Cwr}issqN?NLl?HR_Lx;AWi-3lLOF2!y+R!tQeT9?W5|Z>PbFyLf zb6fds`K(O*NG0c!_1{&@2Lm)9xCX)WTL7999WU=Ckepro9$__E+#!Ni0eHZl4n^T>K})?t90$h@y5p+%eHt0#Q;P;buM z8h*)b9=sz;8PmJMUnf|mK13BC5(wv~E91;v7=Gi*3pt_qT(ZE{ObZ(V&B;rO z_$-pieC`aaWFl(~;Ilb(!nI1b(;=2ocz^T2WJ=CEd&P#hDb)tS}4hm0x zQq@RquUDxOv;zcko^y*+)*iW<}Vw~VR&N{?Ax1uSF0QS?r0G0^vGoE zY8&Bc6h3dBsA(knD&uq((y7}j&!@7dd~D&|V@^8xMk)0P@I?jl5T`dteP}thmf4%g zF!LWPWUV$;+T@X`yuaP+FjP%^lrmn(TuZ8~3zw6aFHqJFMsg?oDx!IaYdlF0mA&Qd z$8CnG4%4eFn!PP2FDxAav5dke(e%0|kF{|^zIt=D=-eqlLg7o2dp#4;pwvVNFFS3} zvEW~UhQbFqo27<?>e_~bjy8hyV83_J>-)`87UWW8Fa6>a7(FQ*pS1w0hq>@{d<;u$x~7G-`* z0xi3ykI;&37ehiX+qDo&DCHSP;E?-nmYnGbeG0)C#aVk6KL!qI5R=FK3sN&PyKNrmYjjGgur*4V^tO!ED3dI zRkIvF}n;VwnN2jvvh$f^XG)By`V&#-Ay)CUrVZ zs&kN5D16=-6l2MqAVatzP7KaZLpN5H60Xu-qsFbQ7^j_A)i zW1;1Jv1+JS8yE{g;VqP>o}tDYG~sHk5S?Xq>6>RjW<}xIYZ4iDf;vVUBfkCT&GMfE zShm=%>+BnSU^zrR3je}sgH23#_zH)Rwdaiap^`ipRStq}`i)LDqlUOcYZk_61cMga zX4Q^zP=%rJuWcC4x}gt)%3olQcHHvzM_{7xf!{KMVXIZ0X`N4On>w?!#qdTaP=%?}J0M;#mkVe~;v?YEwTrmu!TqwrPA>T!$qkC%v<|#O;RFBEPb@uBD{>p`ux)!cpF)Ac$654vmaC2z-kYt-`1c+%iJ^X> z{<7M-c4|C$i~@r!%uoM|$psJi(z{+A5vhV~BiQ$f3U;a;3}vcPemqVPFp>Pm*LHbf{Ru%6PZ z2AMl?X2;zc@~iVsOk2Y^0nN_X5E#yZ(Jx`_jcwrYG0-QCbHY-y=8vl*2Hu1Gg2MN2 z{Gk9FV?YZ99hxFyTW#H%@9nx;!Ew+ad<^zm&+?O^lxp~HuKDZVoVnoxWH0KS@nOHa zg`q=h6F#+OP99dXZt7wvX()WQS-X`X8`Ku23@RojrdrOgqoDX0-y6n+!<9m|iP>Fj z;7+iPD10&R0CNE{*;A>3=4}iN3?&Ld&${!fBOEuQK;eVlVi)VefOzq>>)C`JTmd-_ zh4(#rpE)8EjqbxT;uT=}Z=@So@-x&eP zjl$QcO;0dnZJb(TA+J?Qyx~_3@)-)xzRj?`BI3088G7@8$EQ6otcL_c;n_{jnf&%r z>kS%}PROVaYVO*Z2BAhN4PyG0yTGtxadaCxB3dEd_GaFG)g1zk!h8RQbwCpj!yn?< z+H2QhaZ7=T!h1jDn#ue2_<2QtRjh?f!=9(Xm-FDi%^c{iOcG7>`jWk_{S7gP!k6>k z?(lqNtV--@_)R_FtAk>S!qZoP<&jH_cdRnpV!b-_U1FJiKtdF=lQT# ze$VnPru&UGvxm!M-t!|Y*`SP2#cB;=wq5z-$iOp@S5f$PANqmu+@MTQ#aS41Kei|F z7E}Y&mgDIuA31uGvOkP%n7?`+s~6)o03C(5Ghv@tdJ>%IV$OAFS>EvnNHG*X+B~vM z+zv2e-%mNvoNQfr&dfewT2Xk9-{#L_%x)c&i55IQ?7O3IUdZJre3TC_#Bf#mIBh%( z=LnSpThd?#iTSN7Y~tr^NOsE6IEp6pAlQA(yrEYV6J7GvXoYz2a|)i@EH8Y?4x~I2 z5?Gj4Qgi`6ZLiXZjifvm{Kw1n4L@k{YiZGu0969avRj%qy0F1_abXAu3f~J(f*zJ^ z1LTMaQpLuGc&HPEHnv^)aYOq<+Mw_)rmYo3XS%5p#b$c3$ML!b5DFANBz94sS1{Z3xB*h0pB2 zRbyQ+B&r4Dv@i9XRd?W_@TKfkO@`ZF8EX)0^I9FxJ`99ZK;g+rbxh=r@YWV8b9Ow9 z@9MpCV91t6(b^rVd}coc7=?e~bM;xOMkOvrxPJTRy_di$pzwo~2c1n^Ul{H*gvTT~ zb<)D9ki{9ce6~Y69)$p)@D5#WYQZ5tXp^YJAx{hTf-U8IEM~M|9D>pv;^S|gd-@-$ z+v*P}*eJZQvTDnaq4xkIfa+)={a1ySx{oVgQ2404!|-7kGC(PGU9y_Z8(RsI9;GPo zO~38!On!G##|gHb-IB$(X7ac(OdM#|M8W`xQ1aMRjCg9eRSNb=k9>w4P*4~0+i0DqRN!BKnjBv&4> zzdsv@D7?oDJM(0N5NP(jd5>eeuw1?eSwZWjX>6 zg^%iO_o^wf$S7WTdQG|T>hVXJjuB!qIN zS#kE=Ul3#zzEZd`ks(`{t={C=sGr=!PstS3)^z)zd z8HX@IVE90s4`92$e56LrXWTLvg!=t`)0&5mL-9f3BenZt6SH$Pv`r(0NM*++`7GFV znTZ?#eJHVtXB(Eh-6_4C<3?)K@Rd-Fu*mG$yDEpaL8PJZ`X3I|2fa z!nZMsuI1eb(e?`o)WP(;;KVE6age|Y6h01inK_{iaSIn$`c)e4xJ;gc;uGN)7zH!N z0j@p?>86T}5+adpFYpfdZ)6-WsL%x%9u^#MEj{ax-B2b`_}-24Ce{Hs$s@!KdY|IF zM7t2(jN(vxpzuMcx!vSKSBSkN2!VwG%WKy=6tjoYjKT*Y9M-4Eki*roM)=ALT6pf!{VX@q!s3iHpJY!tG;0PCn8noHUUGVa>NP z#0M5ZtAzS9fBi;LGa%oi@GoEfyqODn(PH+g9@4!dook zg)h3@uJLSbh$puB#6gqa+g-mT&jj*qm;KjSC$!MBGKihRippVyFF=Mx;p1=BEruQr z-{*@DOM+?p2y@%Pj`8y`u<0)2LX=vk*MJy@H`db*{c@S0LR5#c{fx?Gfk|D16*IePH+l)cq1dJPgoi)(B3FC_U)rZg_VT-rk=2XmTP* z6$!5o>!o!8FDwY(gq7P99!b}Iwl&H5y*abQ|qCUF*g%Ct2~)3Pek%L&byL{+dWF1pn|oJ z;<5|2dghDEknb42TBA|xR6--K{^jHqYr({z@UgbJritBC83P+#gq+Gw2lBaPdL4$0 zV{QXtG#2XSr6Zq*!5FIog%A6EM{oe@CVe;z+9{npl<{Ksa@vCer}sf2LE+ghP8{14 zRwW8%=3tpCZodH&g&%@;aOT+toX+$N)>|BfEY@yqnG+CsD11HfmUjjQqWZ%E1hr7+ z&ik+UNe&2~_ue<*0^+B%G#Neg*6I56(Le|QpMQ2iYTEUYxof71rPST+E- zD7^R2nsfXBWh^Y^$x7y{QsCaGZQ2`t?)kN&d_tEuI8 zF9dI3`dw}h4#cZrvuK1!tK6brt7z~OrHF|Ge~tB)X|ZuiaqeeLvG`S~kW)|!b3|Jh zAd~!yv#?00TgKgLcfm6h-ou-IG7qNRlZ5;gG`xa$Um&6I9zKT^*OG_*6U1qT%kMYr zhy)G_@8Q5e6Hgl^6h~F1uto#G9-;8HXTfeVF+M61R6W3r`j3UTg85so&pv?2m(Q)11t%5W} z;hD)0+d0fAy@hUZzOn0C-vj?p_*@qpVr0e$I~sm??J-KWbi9WVVMdxJ64tPq2X*Y9 zk2^gB&ro<~?QkPguYrcVIrBit8{c06778D)ZvAAY3YMG*iRs*@ZY8;h@Lsl8%S71U z6C*C}NvfFPKNI2t^!TPP;@^WKW;GppJ|5lxmr&Wh3W8=jk{kng2e4r z3SY*q!*B+@q^DZk`SW=Ev&nLWz`tSIFqsC+(}lceAOCAr4WuIq|Au{1j67ILrx7h? zpTKRURziJ%!e@im!*i(ZVT>@+U}3Ft_tm@4je$af!oTJ5(K%dirMQ}j%{_b(8$3CO zhHEv&)^?Rf1<(Bk3>2Q|_=`+bg+T|yJik6F7k5ftrpY%Gp3ISnFn<%J4)IfKgh6eu zLhl`|A$m~wD9WE|WNRWre4(m0_j&7ruw8Ny<)f(C0wXt3uu3D8t?TEYAMMKn} z?f1SbfQ7<)`qyeBGfAnla7IA+o3qz7g0Q0Sk-KP(Ooc6=@s0@WmzH z`W&vW(!z^o&hFRtJj5&t@8@9?FD^VvX<>Y(MbAyoU?GwMg^#3Tn~Z+KvR843u6vdJ zmE^+BGxKaQGO=+YG^2hB)CA3gcSPaCn`UArL_y0fLa4S`E}t|*w;Fv-ut*&lIn7Vb z_dL~Sn@k0p5|Jd%eXx}w|E_~~$W(1COt}hmTBnT3Nw*7CaFQ=ngAa(c_{nXtu8;>yv>12q5+-P1}m-Oq~#}%k3e6aWIG14Jv#d3aquuFG2 zam`HAJ|h!8BqFp_sCHJ{q3~H~&l#Bs zTa9B3gET4&_SZpIxrf}?<@4`BFgH~5<4)yxb(q>h{%u+E!F)OQ^VP-OOF8V$abmWw zegEWz{t#Xip7!FZOoK&C=CA6V@8-$9keVob`|+oY99lq>MjICrpb~4vz(vDVayyPU zN<(hQWL&icLxn;m_2aIp?wi0<6rMZxrp!&kjF zH|(7_8(PH*6h8a9|1I-ypN2+U@Obw4Y;T#$2lwh7nVK{xDORf&SD+joJ2*t1h~+b4 z()}DROrAw*#YW3t=f~c#ocH@akeTWvWrWaPVOu+VX)F3LhZv}|wEDoItdGwNh#nL^ zimE&^5}^kiD>lsr6!Wx}TcCUtwE{~+*&YtSh5Z~*UzlgZ13l{ZoC}r#g-_A5nKDZeH9J7ex;`(`nf<$8h-Zoo^K3RYgJgBc=o?!sQzCqc3+Q20T! zA+KbvUKOEH#b{%bEELu!neOh{@Tw?$@=Sr|9z|7<5{7$)K(D>otfw5u{QGWwZzN); zR-BeNT-vV~^g+4{h7L z`Ep)U1qTBqsuRs)IJ)MsmzMkBvkJ)6C_H%KOGN%P`$9uTidrD*#DhKZzFZx77OW8p zp9iZKl$qL?Bw+ydd&7+WvbpDZ-xV_QEMx+u+J8xyZ;*MPZwf0);QHdCKMZ*-Z`k9%>t*yhhZrx*(TVKC1FTql+>{ zw^%st1uA6=gS?&7^4*tfWIjukx6NVG1dCWHvzDKar`lDFOtAby$(i|}!Wp^q$LEd0 zRb`?I+Rktw2Xy1a1E%s$b6m9-3OWiOz9rU+XL!n z@#MAL)BRVifvkbTkHlv?ab%qeR_f@*eZ!lI{~5Ohd`97YzwXR9&|az1YlRHPlKITJ zuMtPKz-8wU__SW$gyD8nYC`;!7N!vF=Fh*`8&V5}kMvp17``9ua8ir&H*tU3#K_i* z_q|pdhTT<_6cY{8a6&t-gyX97qae;v_=R5WT^YVK`{S+B!W62I@C`dpKRgZiD0~>Q zI5!ePI>2fNao+jvUwzZcf<-~$V_=UP8wP0E#fsCAJ+{o${Qyi9-X<0B0yd0#LAx2} zVLXD&bL_-^$!BK(4TTT*mJS>hHkT=3g{(Qh@z!gnVTXwVh3Ajx#PZ$s>Uc{hS^asq z#;{f3H%eKEJk#&AAJ5l9lOUu6?6xuw0{ixS5Y}~Joq$pohRbZt`CiZO^m+*1qwsMb z6U^~pv4l8xda$c)r3Vmd6rMe*C(HI!>IaA|&iPli9&QOyhr$=x*}Yh{mmys2SAIU= z`FgYD4seu>Ug)!H8(-=Q14RlHKGReVW!arN_?X97yJ>%x@`4bf@G<@&jHALKO|Yj> zs2f;2+rC z{N>pM=aX!ghNHqd5207{*S5p9jUd)gc=81;OAdh5lmeM8Yy3oiv;Hi(i$SH*#6vYF zbW+&T&U^o(o^^q2o%xHiamMHLfJBa*1lR2aB%Xiro@qDD;fC7+1^i=udiX?GKJi7vs_x8n)Mz)tyd}DTl5l=ib!AP_e zRod+%8+L}a6AIW<<~L(fK81&uPyw-Lcfe9V=2r-|+IR#8xp;UAq|a{*E;t)V(7cL( z+AgQ1XP%nuawR?|{5ju9#s&Qr2AkORVLbQE5+fHQRHYZJ9=leFFMJnP8@YZtUo*) z(crTy%=pH9N!ZSxlU_XyF=97@UBt@|WV*t>9+>QkRXKU!2%QEJOdK3+*Ta6ouaFf{ zc&oAHxJ;Ll%g3U@WH*t66U=YeY2aHpW$Q@Y=!wgrN=4xdK-T$u_>m9u$Ypm}@PtE` zfDkAU*quFmi5Yg82u_Jy1~ip$^?slWz?L?;N)5_}wzEa3;eO{JZ_4dAMcXLYCLaJe%Bw zi#csny_q#F(_CJfd~0S-tNwPPlV#d*hSuDiHmc&fLY8U$UYUGrVNUyeZq72%9EI%l z#x{J9oK5)LJoUBFH%B3NT^#afvv|nKD12^qe8bQL@7At3>0_C9kmU*fy{Q;K+%hlx zE#se%EhmNg-?PliVtGQotUvflE6cnY?->7tjJdsHQhv+P+2p;6Cj@i$$G91mX~!6v z5XzW}t-DyJ_4{D*O$cPQbIAiN)3OI_n%Q(;9v<(S*{o zufoO;mT89>noxQ^R&?EBnHHX9^6iVIry%5M)9<5+Cgf(e%<-MM$=Nxc!3kKJ0q|jW z^Ww^Weub~G>Oq}{HCC`VX7YK`PMH+s@g<-5KnCW?@k#zH;FqX;tUS)4;#XtLS%<7s zZ#Y4{jl%aFM&tz#4SKCk<>VHJP1OkTQw-N09VFUOGe7Ump%v?T|hhPEO~NmG7@zm8NiQDJkq z8XBmH!r&F#-{LzJ$0{>)Lwr0O31%MbD_0I)p9cP-@CoHp%|tf98X`P=&zyb7x8Dkw zJyW3YUKg#&up^W@3uMoT8hf8X-a_HY&FmR+Jj`E;YsU{Rod0nXWNQ?j9PD5uL*D?{ z;@XiZAB)!0LXc7T2yfBAM25lv{b>t+v#nx2sn0tb>7Ir#3rXFk&BAhfA;>6vbYF5Y zQoZ4O4tOlG-aNXGuA4R77cw>q|I$ZWnb@!m7mkk;Mqh3p?6KqqL^TRe_H;LrVQ3m+ zEJmF28u~6?E>@+uEZWu6NQVBC3O6zPi6xp{&BuGbt0Tj=yq<5wkkBCcwfXp-17i$1 zW~?I|HzmGw=X%jo9cCnkkQkRk~AD=B% zktS+1WNG-|mtcTco6CFLUu|M*p{5Wlz2EI+cI}`npztN}vera33{=4~Y6~-jy<%!~ zgP}VG3h%Q|f{_k$MsTExc{E2Y>iB&s&`|gUdNqKdS~#7YEl7N1?HtT7VWJ>P87I7P zcb`4O>VTgpyuZhXn%HWMI1j5C{_=b;h$j^OW$lKWnD9v_aT7QDpu^4CYW-qjY9k_HfLL5%&(_3zJT;tVV&hj7g!(^hz@#%9;XP6KcXj&BNbL%H zWz8da+WI+n*Fk1L;fcj(nTQrnN|`oHr;|68@PU0W$4I2bN?-JoFLux7F;twZg}HfQ zvBC#!CUjwix|3I8Lbk(Wm2hmR;=7K^fnxlXCBr1elMoV;pSsZx7tLH(dwdwHSYWR};bW`R1|vHNKE?o34(6}>U~ltl zy@7|qzwQlaHsypl2&U7;$+6EjucEec)OZWgY)CuyQC|1Kzj3FXMsjd0EQ-`7ie`?j za{0`qhvP$XLLEFP3QDk6uo${9m`|o-(B#S?cT+|fgk$X3V#r7I+5HR?Hv$V0 z-OFmg`6&>|D11b(KWyT{x*oCaJoIW+1=&RM-u6GnP-8V}aZ^v8N2#^sRS$eTyPYs` zwXu;}OHG@$S-0oRf^vky2Rih$k=-2@rz?dz;gD~u19B|$)Y|8b)LzO+y-GNRmrY&1 z1Up@1sIXp9J18niD28mGf%kd*WfR>1wq5AwuSf|ujvey-{H0g(E7~h@&QNGHvrQXF zT;|vIT7HGMyLpjgpXWXK{cn8U@t?-bAu*U=o`*pC@_0Evl0R7@h-2mK00~d2@re8o z2P9bv)WghggGBk_C=5S@+5Rzj^0^V12fm{duY&U^{QF-4S_g6ZgWbr)kA_@&0t8ra z4bw=%7AE#PSbW-8KhLl5fm1mxOqU;gTE!|A!i7>A#PnN@Bsfh|sd2*n?HXLr1#9oj zbHu>3?q%d<-h7T7_QL3Z2lO+=qYi7vwmCH#JVfEkxBE+m3aud6_ad}}j;;OhdOR>u zcvJX_VQXRUfO(MZuMJNc2`m&o$SYo%{DrSAiQhZj?7QMG%R%n>+DP?P>7fAyYoN?M zR*sI=%51(VRP>FJ?Wc?q%)*wny;jPR%-0!PSz;_KjuhAX{rb4gZ|mSyQTS*c_LlJ# zj7ow9BfPiqpT*_K;thD{JBFPEAC(h=om6MzMEQMrZi)9sZdVn2Ax-Q#vFn-n(wUCj ze^|&20|?Bocos0?^-A&hCH8DzzRX1AwNiZMOkZ{lvK8YE>?zKNB%N4;zP{I|?qzrs zg|{4M@>?l<2PmUq-<-I1iv2nr@6$OeD@7-DSd!56Wk<_+W3$xSO5rC?&ax-S@q`LR zfgoBZ_Q)kZ&K!ynp_!jJIm;ed!)Le z*rP#t?w*Q9uD419tC@ucHG6IbUp>C8Y^Ct;WnRF4-PgXo-1+6B#vZ=r;NQ#9qk~(J zIf;!=KHnzP1QLvhMhjM#-BQ6P+VVP9ih!=d*gSg{F(0y^xeWO-*cf_!1=? zn_%(47&akzgE`8@TQRL0#54-;?YMRfw;wDhH>W?Y44L&rY}So3Lk0Tdvgv5nUify@{x9{gNX@kL^v%`oH6@6 z`-zW^m(ME4{21=%YT?7xH>)p!wvbIGTIy z=`wQOPryUry}sI+3Fe`yEJ@Lo?3VCd?I0pf1Ro2`1ikvDJh_9V88 ziR-U4h#zjAe9pP3ys?YVp8oI!EIFb5)#5N=oBVAT}hq3{u1HQ2-r08;>4wZwxgQ{E@CKC-TJ z^jLAW?R^P1E7^MTC2~$T#%FaxID9f%=o4Jq(8N*RF~vui3cjHvM|A+40BK>TA!~>D z2#e~$k~J_vX&%{{{1ubrH0CQ=+ny{JzP02hoxf@BLgiZv0)GVqhQder9ma*OO1&2B zfjBU{#>rZym7;5Bp%Kk)faVFs zv`FwZ_krEMT*&ky@YgY&l_KzSJD1tnWIhUB_P0{t*SEx(V0Oh0AGU*uRtgJCeAthH z^I_{T00@CjZn3!B+5DB*&)o9q8ZbDArh?X**ac?$nfyXN_hAxIuO0-md*&XptLJ%M zuN2~aW*s~G#Ub9X_8v<-Y=t}Ke22;0Q+5F|@9FGuMzVzk@ND~vkJPD?h}QuugIZ|Z zuph_aZNqPqiIx*g$3R#$A(m72V}*R0?3_k)KNv5DsX3wYVY{9@F=mED{LET?wmZqk z&*I;Sm{W0?$17{M`GR_7KJj2aPc+$|&)ZWM0PD*u(fDMjxey4STZQ(&hCGdoI_9(s zs4ZMKI27GK$OR8-uFC-4VHl1%+JfvAR4W|Tu`)mwxv_%td>B(0)0!RzhKoRP1_l6E C$dJAO literal 0 HcmV?d00001 diff --git a/internal/transport/httpserver/schedules.go b/internal/transport/httpserver/schedules.go new file mode 100644 index 0000000..8f7b509 --- /dev/null +++ b/internal/transport/httpserver/schedules.go @@ -0,0 +1,106 @@ +package httpserver + +import ( + "net/http" + "net/url" + "strconv" + "strings" + + "git.yuntuo.hk/k2safe/orbit/internal/fault" + core "git.yuntuo.hk/k2safe/orbit/model" + "git.yuntuo.hk/k2safe/orbit/platform/auth" + "git.yuntuo.hk/k2safe/orbit/pulse/schedule" +) + +// RegisterSchedules 接入同一 HTTP 信封、认证、大小和严格 JSON 边界。 +func RegisterSchedules(server *http.Server, s *schedule.Service) { + mux := server.Handler.(*http.ServeMux) + mux.HandleFunc("POST /v1/schedules", wrap(func(r *http.Request, t auth.Token) (any, int, error) { + var in schedule.CreateInput + if err := decodeBody(r, &in); err != nil { + return nil, 0, err + } + key, err := idempotencyKey(r) + if err != nil { + return nil, 0, err + } + out, err := s.Create(r.Context(), t, key, in) + return out, createdStatus(out.Deduplicated), err + })) + mux.HandleFunc("GET /v1/schedules", wrap(func(r *http.Request, t auth.Token) (any, int, error) { + q, err := url.ParseQuery(r.URL.RawQuery) + if err != nil { + return nil, 0, fault.Invalid("invalid query encoding") + } + for k, v := range q { + if len(v) != 1 || (k != "queue_id" && k != "limit" && k != "cursor") { + return nil, 0, fault.Invalid("invalid schedule query") + } + } + var in schedule.PageInput + in.Cursor = q.Get("cursor") + if q.Has("limit") { + in.Limit, err = strconv.Atoi(q.Get("limit")) + if err != nil || in.Limit < 1 { + return nil, 0, fault.Invalid("invalid limit") + } + } + out, err := s.List(r.Context(), t, core.ID(q.Get("queue_id")), in) + return out, 200, err + })) + mux.HandleFunc("GET /v1/schedules/{id}", wrap(func(r *http.Request, t auth.Token) (any, int, error) { + if _, err := historyQuery(r, false); err != nil { + return nil, 0, err + } + out, err := s.Get(r.Context(), t, core.ID(r.PathValue("id"))) + return out, 200, err + })) + mux.HandleFunc("PATCH /v1/schedules/{id}", wrap(func(r *http.Request, t auth.Token) (any, int, error) { + var in schedule.PublishInput + if err := decodeBody(r, &in); err != nil { + return nil, 0, err + } + key, err := idempotencyKey(r) + if err != nil { + return nil, 0, err + } + out, err := s.Publish(r.Context(), t, core.ID(r.PathValue("id")), key, in) + return out, 200, err + })) + mux.HandleFunc("POST /v1/schedules/{command}", wrap(func(r *http.Request, t auth.Token) (any, int, error) { + id, command, ok := strings.Cut(r.PathValue("command"), ":") + if !ok || (command != "pause" && command != "resume") { + return nil, 0, fault.NotFound + } + var in schedule.ControlInput + if err := decodeBody(r, &in); err != nil { + return nil, 0, err + } + key, err := idempotencyKey(r) + if err != nil { + return nil, 0, err + } + out, err := s.Control(r.Context(), t, core.ID(id), key, in, command == "pause") + return out, 200, err + })) + mux.HandleFunc("GET /v1/schedules/{id}/versions/{version}", wrap(func(r *http.Request, t auth.Token) (any, int, error) { + if _, err := historyQuery(r, false); err != nil { + return nil, 0, err + } + raw := r.PathValue("version") + version, err := strconv.ParseUint(raw, 10, 64) + if err != nil || version == 0 || strconv.FormatUint(version, 10) != raw { + return nil, 0, fault.Invalid("invalid version") + } + out, err := s.Version(r.Context(), t, core.ID(r.PathValue("id")), version) + return out, 200, err + })) + mux.HandleFunc("GET /v1/schedules/{id}/occurrences", wrap(func(r *http.Request, t auth.Token) (any, int, error) { + in, err := historyQuery(r, true) + if err != nil { + return nil, 0, err + } + out, err := s.Occurrences(r.Context(), t, core.ID(r.PathValue("id")), schedule.PageInput{Limit: in.Limit, Cursor: in.Cursor}) + return out, 200, err + })) +} diff --git a/platform/auth/token.go b/platform/auth/token.go index 00f54da..2be1e75 100644 --- a/platform/auth/token.go +++ b/platform/auth/token.go @@ -58,7 +58,7 @@ type Permissions struct { Queues []string `json:"queues"` } -var supported = map[string]bool{"tasks:submit": true, "tasks:read": true, "tasks:cancel": true, "queues:read": true, "queues:manage": true, "workers:connect": true, "workers:consume": true} +var supported = map[string]bool{"tasks:submit": true, "tasks:read": true, "tasks:cancel": true, "queues:read": true, "queues:manage": true, "workers:connect": true, "workers:consume": true, "schedules:read": true, "schedules:manage": true} func (p Permissions) Validate() error { if len(p.Actions) == 0 || len(p.Actions) > 32 || len(p.Queues) == 0 || len(p.Queues) > 128 { diff --git a/pulse/model/occurrence.go b/pulse/model/occurrence.go index daf6456..d523cd3 100644 --- a/pulse/model/occurrence.go +++ b/pulse/model/occurrence.go @@ -19,11 +19,11 @@ type Occurrence struct { ScheduledAt time.Time `db:"scheduled_at"` // Decision 触发处理决定：已触发、已跳过或已合并。 Decision string `db:"decision"` - // TaskID 关联的 Pulse 任务标识；可为空，表示尚未设置该关联或值。 + // TaskID 已触发或合并生成的 Pulse 任务标识；跳过时为空。 TaskID *core.ID `db:"task_id"` - // CoveredUntil 合并触发覆盖的结束边界；没有合并范围时为空。 + // CoveredUntil 合并或跳过范围的排除边界；单点处理时为空。 CoveredUntil *time.Time `db:"covered_until"` - // Reason 操作原因或处理说明，需要保留审计信息；可为空，表示尚未设置该关联或值。 + // Reason 稳定处理分类；新调度器始终写入，旧人工记录可为空。 Reason *string `db:"reason"` } diff --git a/pulse/model/schedule.go b/pulse/model/schedule.go index d600468..9644310 100644 --- a/pulse/model/schedule.go +++ b/pulse/model/schedule.go @@ -13,11 +13,17 @@ type Schedule struct { core.Record // Name 可读名称，唯一性范围由对应数据表约束。 Name string `db:"name"` + // QueueID 计划终身绑定的队列；旧结构人工行可为空，不允许参与扫描。 + QueueID *core.ID `db:"queue_id"` + // ProcessingVersion 当前积压处理所用版本；发布新版本不覆盖旧进度。 + ProcessingVersion uint64 `db:"processing_version"` + // CheckAt 下次允许扫描的 UTC 时间；为空表示当前没有扫描工作。 + CheckAt *time.Time `db:"check_at"` // CurrentVersion 当前生效的计划版本号，发布时与版本记录原子更新。 CurrentVersion uint64 `db:"current_version"` // Paused 暂停标记；停止新的受控工作，不表示在途请求已停止。 Paused bool `db:"paused"` - // NextFireAt 下一计划触发时间；没有后续触发时为空。 + // NextFireAt 下一原计划触发时间；版本刚切换尚待计算或已经结束时为空，需结合 CheckAt 判断。 NextFireAt *time.Time `db:"next_fire_at"` } diff --git a/pulse/model/schedule_version.go b/pulse/model/schedule_version.go index f753142..a251b65 100644 --- a/pulse/model/schedule_version.go +++ b/pulse/model/schedule_version.go @@ -27,8 +27,12 @@ type ScheduleVersion struct { MisfirePolicy string `db:"misfire_policy"` // OverlapPolicy 上次未完成时的策略：并行、串行或跳过。 OverlapPolicy string `db:"overlap_policy"` - // CatchupLimit 单次漏跑补偿上限；补跑策略必须配置正数。 + // CatchupLimit 每批生成任务数量上限，所有策略均要求 1–100。 CatchupLimit uint32 `db:"catchup_limit"` + // CatchupWindowMS 未处理触发点最多保留的毫秒数，过旧范围记录跳过。 + CatchupWindowMS uint64 `db:"catchup_window_ms"` + // GraceMS 正常派发允许延迟的毫秒数，超出后按漏跑策略处理。 + GraceMS uint64 `db:"grace_ms"` } func (ScheduleVersion) TableName() string { return "pulse_schedule_versions" } diff --git a/pulse/schedule/planner.go b/pulse/schedule/planner.go new file mode 100644 index 0000000..b5f0ae1 --- /dev/null +++ b/pulse/schedule/planner.go @@ -0,0 +1,135 @@ +package schedule + +import ( + "errors" + "time" +) + +// Policy 显式规定漏跑与重叠；窗口、批量和持久化扫描间隔共同限制补跑。 +type Policy struct { + Misfire string `json:"misfire"` // Misfire SKIP、COALESCE 或 CATCH_UP，必须明确提供。 + Overlap string `json:"overlap"` // Overlap PARALLEL、SERIAL 或 SKIP，必须明确提供。 + CatchupLimit uint32 `json:"catchup_limit"` // CatchupLimit 每批最多生成的任务数，1–100；串行最多一个。 + CatchupWindowMS uint64 `json:"catchup_window_ms"` // CatchupWindowMS 最多保留多久的未处理触发点，1000 毫秒–30 天。 + GraceMS uint64 `json:"grace_ms"` // GraceMS 允许正常派发延迟的毫秒数，1000–60000，不超过窗口。 +} + +func (p Policy) Validate() error { + if p.Misfire != "SKIP" && p.Misfire != "COALESCE" && p.Misfire != "CATCH_UP" { + return errors.New("explicit misfire policy required") + } + if p.Overlap != "PARALLEL" && p.Overlap != "SERIAL" && p.Overlap != "SKIP" { + return errors.New("explicit overlap policy required") + } + if p.CatchupLimit < 1 || p.CatchupLimit > 100 || p.CatchupWindowMS < 1000 || p.CatchupWindowMS > 2592000000 || p.GraceMS < 1000 || p.GraceMS > 60000 || p.GraceMS > p.CatchupWindowMS { + return errors.New("invalid bounded catchup policy") + } + return nil +} + +// Decision 描述单点或连续范围的处理；范围为 [ScheduledAt,CoveredUntil)，结束不包含。 +type Decision struct { + ScheduledAt time.Time // ScheduledAt 范围中的首个原触发点，作为唯一去重身份。 + CoveredUntil *time.Time // CoveredUntil 合并/跳过范围的排除边界；单点为空。 + Kind string // Kind FIRED、COALESCED 或 SKIPPED。 + Reason string // Reason 稳定处理分类，不包含业务参数。 +} + +// Batch 是同一个不可变版本的一批决定，必须与任务及进度原子持久化。 +type Batch struct { + Decisions []Decision // Decisions 有界决策，最多 CatchupLimit+2 条。 + Next *time.Time // Next 当前版本下一触发点；nil 表示版本区间结束。 + Blocked bool // Blocked SERIAL 正在等待已有非终态任务，不能跨越该点。 +} + +// Plan 不读取墙上时钟。now/active 由资源锁定后的数据库事实提供。 +// before 是下一版本的生效排除边界，旧积压仍按旧版本计算。 +func Plan(c *Calendar, p Policy, due, now time.Time, before *time.Time, active bool) (Batch, error) { + out := Batch{Decisions: []Decision{}} + if err := p.Validate(); err != nil { + return out, err + } + if due.IsZero() || now.IsZero() { + return out, errors.New("schedule facts required") + } + actual, err := c.AtOrAfter(due) + if err != nil { + return out, err + } + if actual == nil || !actual.Equal(due) { + return out, errors.New("cursor is not an occurrence") + } + if before != nil && !due.Before(*before) { + return out, nil + } + out.Next = &due + upper := now.Add(time.Microsecond) + if before != nil && before.Before(upper) { + upper = *before + } + advance := func(at time.Time) error { + next, e := c.AtOrAfter(at) + if e != nil { + return e + } + if next != nil && before != nil && !next.Before(*before) { + next = nil + } + out.Next = next + return nil + } + skip := func(until time.Time, reason string) error { + out.Decisions = append(out.Decisions, Decision{ScheduledAt: *out.Next, CoveredUntil: &until, Kind: "SKIPPED", Reason: reason}) + return advance(until) + } + cutoff := now.Add(-time.Duration(p.CatchupWindowMS) * time.Millisecond) + if upper.Before(cutoff) { + cutoff = upper + } + if out.Next.Before(cutoff) { + if err := skip(cutoff, "CATCHUP_WINDOW_EXCEEDED"); err != nil { + return out, err + } + } + if out.Next == nil || !out.Next.Before(upper) { + return out, nil + } + if p.Misfire == "SKIP" { + grace := now.Add(-time.Duration(p.GraceMS) * time.Millisecond) + if upper.Before(grace) { + grace = upper + } + if out.Next.Before(grace) { + if err := skip(grace, "MISFIRE_SKIPPED"); err != nil { + return out, err + } + } + } + if out.Next == nil || !out.Next.Before(upper) { + return out, nil + } + if active && p.Overlap == "SERIAL" { + out.Blocked = true + return out, nil + } + if active && p.Overlap == "SKIP" { + err := skip(upper, "OVERLAP_SKIPPED") + return out, err + } + if p.Misfire == "COALESCE" && out.Next.Before(now.Add(-time.Duration(p.GraceMS)*time.Millisecond)) { + out.Decisions = append(out.Decisions, Decision{ScheduledAt: *out.Next, CoveredUntil: &upper, Kind: "COALESCED", Reason: "MISFIRE_COALESCED"}) + err := advance(upper) + return out, err + } + for n := uint32(0); n < p.CatchupLimit && out.Next != nil && out.Next.Before(upper); n++ { + at := *out.Next + out.Decisions = append(out.Decisions, Decision{ScheduledAt: at, Kind: "FIRED", Reason: "SCHEDULED"}) + if err := advance(at.Add(time.Microsecond)); err != nil { + return out, err + } + if p.Overlap == "SERIAL" || p.Overlap == "SKIP" { + break + } + } + return out, nil +} diff --git a/pulse/schedule/planner_test.go b/pulse/schedule/planner_test.go new file mode 100644 index 0000000..47054b3 --- /dev/null +++ b/pulse/schedule/planner_test.go @@ -0,0 +1,56 @@ +package schedule + +import ( + "testing" + "time" +) + +func TestMisfireOverlapAndBoundedCatchup(t *testing.T) { + start := stamp("2026-09-17T00:00:00Z") + c, err := Compile(Rule{Kind: "FIXED_RATE", Timezone: "UTC", StartAt: start, IntervalMS: 1000}) + if err != nil { + t.Fatal(err) + } + base := Policy{Misfire: "CATCH_UP", Overlap: "PARALLEL", CatchupLimit: 3, CatchupWindowMS: 10000, GraceMS: 1000} + for _, tc := range []struct { + name, misfire, overlap string + active bool + kinds []string + next int + blocked bool + }{ + {"catchup", "CATCH_UP", "PARALLEL", false, []string{"SKIPPED", "FIRED", "FIRED", "FIRED"}, 13, false}, + {"coalesce", "COALESCE", "PARALLEL", false, []string{"SKIPPED", "COALESCED"}, 21, false}, + {"skip", "SKIP", "PARALLEL", false, []string{"SKIPPED", "SKIPPED", "FIRED", "FIRED"}, 21, false}, + {"serial_wait", "CATCH_UP", "SERIAL", true, []string{"SKIPPED"}, 10, true}, + {"serial_one", "CATCH_UP", "SERIAL", false, []string{"SKIPPED", "FIRED"}, 11, false}, + {"overlap_skip", "CATCH_UP", "SKIP", true, []string{"SKIPPED", "SKIPPED"}, 21, false}, + } { + t.Run(tc.name, func(t *testing.T) { + p := base + p.Misfire = tc.misfire + p.Overlap = tc.overlap + out, err := Plan(c, p, start, start.Add(20*time.Second), nil, tc.active) + if err != nil || out.Next == nil || !out.Next.Equal(start.Add(time.Duration(tc.next)*time.Second)) || out.Blocked != tc.blocked || len(out.Decisions) != len(tc.kinds) { + t.Fatalf("unexpected batch %+v %v", out, err) + } + for i, kind := range tc.kinds { + if out.Decisions[i].Kind != kind { + t.Fatal("wrong decision", out.Decisions) + } + } + }) + } + // 旧版本只覆盖生效边界之前，不能把新版本的时间合并进去。 + before := start.Add(15 * time.Second) + base.Misfire = "COALESCE" + out, err := Plan(c, base, start, start.Add(20*time.Second), &before, false) + if err != nil || out.Next != nil || len(out.Decisions) != 2 || !out.Decisions[1].CoveredUntil.Equal(before) { + t.Fatalf("version boundary lost: %+v %v", out, err) + } + // 未到期不产生记录；同一快照重算得到同一原触发点。 + out, err = Plan(c, base, start, start.Add(-time.Second), nil, false) + if err != nil || len(out.Decisions) != 0 || out.Next == nil || !out.Next.Equal(start) { + t.Fatal("future point processed") + } +} diff --git a/pulse/schedule/rule.go b/pulse/schedule/rule.go new file mode 100644 index 0000000..d5f3099 --- /dev/null +++ b/pulse/schedule/rule.go @@ -0,0 +1,173 @@ +// Package schedule 计算计划触发点和有限的漏跑决策；不运行内存 Cron 或业务处理器。 +package schedule + +import ( + "errors" + "strings" + "time" + + "git.yuntuo.hk/k2safe/orbit/internal/timezone" + + "github.com/robfig/cron/v3" +) + +// Rule 是不可变计划版本中的时间规则。所有边界精确到 UTC 微秒。 +type Rule struct { + CalendarVersion string `json:"calendar_version"` // CalendarVersion 冻结的时区快照版本；提交为空时采用 v1 固定默认快照，升级不能静默改变。 + Kind string `json:"kind"` // Kind CRON 或 FIXED_RATE；不支持以完成时间推进的 fixed-delay。 + Timezone string `json:"timezone"` // Timezone 显式 IANA 名称，禁止依赖节点 Local 设置。 + StartAt time.Time `json:"start_at"` // StartAt 包含此边界；固定间隔以此为唯一基准。 + EndAt *time.Time `json:"end_at,omitempty"` // EndAt 排除此边界；为空时运行至支持的日期上限。 + Cron string `json:"cron,omitempty"` // Cron 五段表达式：分钟、小时、月日、月、星期。 + IntervalMS uint64 `json:"interval_ms,omitempty"` // IntervalMS 固定间隔毫秒数，范围 1000–2592000000。 +} + +// Calendar 持有已验证且不可变的计算规则，可并发读取，不包含当前进度。 +type Calendar struct { + rule Rule + zone *time.Location + cron *cron.SpecSchedule +} + +func validTime(t time.Time) bool { + return t.Year() >= 2000 && t.Year() <= 9998 && t.Nanosecond()%1000 == 0 +} + +// Compile 规范化规则并拒绝无解、混合字段和隐式本地时区。 +func Compile(in Rule) (*Calendar, error) { + in.StartAt = in.StartAt.UTC() + if !validTime(in.StartAt) { + return nil, errors.New("start_at must use UTC-compatible microseconds and years 2000 to 9998") + } + if in.EndAt != nil { + end := in.EndAt.UTC() + if !validTime(end) || !end.After(in.StartAt) { + return nil, errors.New("end_at must be after start_at") + } + in.EndAt = &end + } + if in.Timezone == "" || in.Timezone == "Local" || len(in.Timezone) > 64 { + return nil, errors.New("explicit IANA timezone required") + } + if in.CalendarVersion == "" { + in.CalendarVersion = timezone.Version + } + zone, err := timezone.Load(in.Timezone, in.CalendarVersion) + if err != nil { + return nil, errors.New("invalid IANA timezone") + } + c := &Calendar{rule: in, zone: zone} + switch in.Kind { + case "FIXED_RATE": + if in.Cron != "" || in.IntervalMS < 1000 || in.IntervalMS > 2592000000 { + return nil, errors.New("fixed rate requires interval_ms 1000 to 2592000000 and no cron") + } + case "CRON": + fields := strings.Fields(in.Cron) + if in.IntervalMS != 0 || len(in.Cron) > 256 || len(fields) != 5 || strings.HasPrefix(fields[0], "@") || strings.Contains(fields[0], "=") { + return nil, errors.New("cron requires exactly five fields and no interval or embedded timezone") + } + c.rule.Cron = strings.Join(fields, " ") + parsed, err := cron.NewParser(cron.Minute | cron.Hour | cron.Dom | cron.Month | cron.Dow).Parse(c.rule.Cron) + if err != nil { + return nil, errors.New("invalid five-field cron") + } + c.cron = parsed.(*cron.SpecSchedule) + // 仅用上游计算 UTC 日历；实际时区转换由恒定偏移区间处理，避免非整小时夏令时跳变遗漏。 + c.cron.Location = time.UTC + default: + return nil, errors.New("rule kind must be CRON or FIXED_RATE") + } + first, err := c.AtOrAfter(in.StartAt) + if err != nil { + return nil, err + } + if first == nil { + return nil, errors.New("rule has no occurrence in its time bounds") + } + return c, nil +} + +// Rule 返回独立规则副本，不暴露内部可变时间指针。 +func (c *Calendar) Rule() Rule { + out := c.rule + if out.EndAt != nil { + v := *out.EndAt + out.EndAt = &v + } + return out +} + +// AtOrAfter 返回不早于指定时刻的第一个原计划触发点；无后续返回 nil。 +// DST 缺失时刻跳过，重复时刻分别按两个 UTC 身份触发；固定间隔按真实经过时间推进。 +func (c *Calendar) AtOrAfter(at time.Time) (*time.Time, error) { + at = at.UTC() + if at.Before(c.rule.StartAt) { + at = c.rule.StartAt + } + end := time.Date(9999, 1, 1, 0, 0, 0, 0, time.UTC) + if c.rule.EndAt != nil { + end = *c.rule.EndAt + } + if !at.Before(end) { + return nil, nil + } + if c.cron == nil { + // 使用微秒整数而非 time.Sub，避免跨越 292 年时 Duration 饱和。 + start := c.rule.StartAt.UnixMicro() + step := int64(c.rule.IntervalMS) * 1000 + delta := at.UnixMicro() - start + n := delta / step + if delta%step != 0 || at.Nanosecond()%1000 != 0 { + n++ + } + next := time.UnixMicro(start + n*step).UTC() + if !next.Before(end) { + return nil, nil + } + return &next, nil + } + // 五段 Gregorian 规则的最大日期间隔为世纪闰年边界的八年；十年是计算保护界。 + limit := at.AddDate(10, 0, 0) + if end.Before(limit) { + limit = end + } + for segment := 0; segment < 256 && at.Before(limit); segment++ { + local := at.In(c.zone) + _, offset := local.Zone() + _, until := local.ZoneBounds() + wall := at.Add(time.Duration(offset) * time.Second) + candidate := c.cron.Next(wall.Add(-time.Nanosecond)) + if candidate.IsZero() { + // 上游单次只查五年；2096→2104 等合法闰日规则需要第二个区间。 + candidate = c.cron.Next(wall.AddDate(5, 0, 0).Add(-time.Nanosecond)) + } + if candidate.IsZero() { + return nil, nil + } + candidate = candidate.Add(-time.Duration(offset) * time.Second).UTC() + if !until.IsZero() && !candidate.Before(until) { + if !until.After(at) { + return nil, errors.New("timezone interval did not advance") + } + at = until.UTC() + continue + } + if candidate.Before(at) { + return nil, errors.New("calendar moved backwards") + } + if !candidate.Before(limit) { + return nil, nil + } + return &candidate, nil + } + if at.Before(limit) { + return nil, errors.New("timezone transition budget exceeded") + } + return nil, nil +} + +// After 返回严格晚于该触发点的下一个 UTC 身份。 +func (c *Calendar) After(at time.Time) (*time.Time, error) { + return c.AtOrAfter(at.Add(time.Microsecond)) +} diff --git a/pulse/schedule/rule_test.go b/pulse/schedule/rule_test.go new file mode 100644 index 0000000..6034343 --- /dev/null +++ b/pulse/schedule/rule_test.go @@ -0,0 +1,107 @@ +package schedule + +import ( + "testing" + "time" +) + +func stamp(v string) time.Time { + t, err := time.Parse(time.RFC3339Nano, v) + if err != nil { + panic(err) + } + return t +} +func calendar(t *testing.T, expr, zone, start string) *Calendar { + t.Helper() + c, err := Compile(Rule{Kind: "CRON", Cron: expr, Timezone: zone, StartAt: stamp(start)}) + if err != nil { + t.Fatal(err) + } + return c +} +func TestCronCalendarUTCAndDST(t *testing.T) { + for _, tc := range []struct { + name, expr, zone, from string + want []string + }{ + {"five_fields", "*/15 9-10 * * MON-FRI", "Asia/Shanghai", "2026-09-18T00:59:59Z", []string{"2026-09-18T01:00:00Z", "2026-09-18T01:15:00Z"}}, + {"spring_missing", "30 2 * * *", "America/New_York", "2026-03-08T00:00:00Z", []string{"2026-03-09T06:30:00Z"}}, + {"autumn_repeated", "30 1 * * *", "America/New_York", "2026-11-01T00:00:00Z", []string{"2026-11-01T05:30:00Z", "2026-11-01T06:30:00Z", "2026-11-02T06:30:00Z"}}, + {"half_hour_spring", "45 2 * * *", "Australia/Lord_Howe", "2026-10-03T14:59:00Z", []string{"2026-10-03T15:45:00Z", "2026-10-04T15:45:00Z"}}, + {"half_hour_autumn", "45 1 * * *", "Australia/Lord_Howe", "2026-04-04T13:00:00Z", []string{"2026-04-04T14:45:00Z", "2026-04-04T15:15:00Z"}}, + {"skipped_date", "0 0 * * *", "Pacific/Apia", "2011-12-29T10:00:00Z", []string{"2011-12-29T10:00:00Z", "2011-12-30T10:00:00Z"}}, + {"century_leap", "0 0 29 2 *", "UTC", "2096-03-01T00:00:00Z", []string{"2104-02-29T00:00:00Z", "2108-02-29T00:00:00Z"}}, + {"day_or_weekday", "0 0 13 * MON", "UTC", "2026-09-12T00:00:00Z", []string{"2026-09-13T00:00:00Z", "2026-09-14T00:00:00Z"}}, + } { + t.Run(tc.name, func(t *testing.T) { + c := calendar(t, tc.expr, tc.zone, tc.from) + at := stamp(tc.from) + for _, want := range tc.want { + got, err := c.AtOrAfter(at) + if err != nil || got == nil || !got.Equal(stamp(want)) { + t.Fatalf("at %s got %v %v want %s", at, got, err, want) + } + at = got.Add(time.Microsecond) + } + }) + } +} +func TestRuleBoundsAndFixedRate(t *testing.T) { + start := stamp("2026-09-17T00:00:00.000001Z") + end := start.Add(3 * time.Second) + c, err := Compile(Rule{Kind: "FIXED_RATE", Timezone: "UTC", StartAt: start, EndAt: &end, IntervalMS: 1000}) + if err != nil { + t.Fatal(err) + } + for _, at := range []time.Time{start.Add(-time.Hour), start, start.Add(time.Nanosecond), start.Add(1500 * time.Millisecond), end} { + got, err := c.AtOrAfter(at) + if err != nil { + t.Fatal(err) + } + if at.Equal(end) { + if got != nil { + t.Fatal("end is inclusive") + } + continue + } + if got == nil || got.Before(at) || !got.Before(end) || (got.UnixMicro()-start.UnixMicro())%1000000 != 0 { + t.Fatal("fixed rate drift") + } + } + // 规则副本不能修改已编译日历。 + copy := c.Rule() + *copy.EndAt = start + if got, _ := c.AtOrAfter(start); got == nil { + t.Fatal("rule alias") + } + c, err = Compile(Rule{Kind: "FIXED_RATE", Timezone: "UTC", StartAt: stamp("2000-01-01T00:00:00Z"), IntervalMS: 1000}) + if err != nil { + t.Fatal(err) + } + if got, err := c.AtOrAfter(stamp("9998-12-31T23:59:59.000001Z")); err != nil || got != nil { + t.Fatal("calendar overflow") + } +} +func TestRuleRejectsAmbiguityAndImpossibleDates(t *testing.T) { + base := Rule{Kind: "CRON", Timezone: "UTC", StartAt: stamp("2026-01-01T00:00:00Z"), Cron: "* * * * *"} + for _, expr := range []string{"@every 1s", "0 0 0 * * *", "TZ=UTC 0 0 * * *", "0 0 31 2 *", "60 * * * *", "0 0 * * 7", "*/0 * * * *"} { + in := base + in.Cron = expr + if _, err := Compile(in); err == nil { + t.Fatalf("accepted %q", expr) + } + } + for _, zone := range []string{"", "Local", "../UTC", "Unknown/Zone"} { + in := base + in.Timezone = zone + if _, err := Compile(in); err == nil { + t.Fatalf("accepted zone %s", zone) + } + } + in := base + in.IntervalMS = 1000 + if _, err := Compile(in); err == nil { + t.Fatal("accepted mixed rule") + } +} diff --git a/pulse/schedule/service.go b/pulse/schedule/service.go new file mode 100644 index 0000000..44527a7 --- /dev/null +++ b/pulse/schedule/service.go @@ -0,0 +1,207 @@ +package schedule + +import ( + "context" + "strings" + "time" + "unicode/utf8" + + "git.yuntuo.hk/k2safe/orbit/internal/fault" + core "git.yuntuo.hk/k2safe/orbit/model" + "git.yuntuo.hk/k2safe/orbit/platform/auth" + "git.yuntuo.hk/k2safe/orbit/pulse/service" +) + +// Definition 是每次发布冻结的完整定义，业务内容仍由独立 Worker 解释。 +type Definition struct { + Rule Rule `json:"rule"` // Rule 时间规则；start_at 是基准，不允许追溯到版本生效前产生新任务。 + Policy Policy `json:"policy"` // Policy 明确的漏跑、重叠和补跑边界。 + Task service.SubmitInput `json:"task"` // Task 每次触发的模板，禁止绝对 available_at/start_deadline_at。 +} + +// CreateInput 创建持久化计划，暂停计划也保存完整的触发进度。 +type CreateInput struct { + Name string `json:"name"` // Name 命名空间内唯一的 ASCII 名称。 + Definition Definition `json:"definition"` // Definition 首个不可变版本。 + Paused bool `json:"paused"` // Paused 是否从暂停状态开始，恢复时处理期间漏跑。 +} + +// PublishInput 发布立即生效的新版本；旧积压仍按当时版本处理。 +type PublishInput struct { + ExpectedRevision uint64 `json:"expected_revision,string"` // ExpectedRevision 当前控制版本，必须非零。 + Reason string `json:"reason"` // Reason 必填操作原因，写入审计。 + Definition Definition `json:"definition"` // Definition 完整替换定义；队列不能更换。 +} + +// ControlInput 暂停/恢复计划，不能取消已产生的任务。 +type ControlInput struct { + ExpectedRevision uint64 `json:"expected_revision,string"` // ExpectedRevision 乐观并发版本。 + Reason string `json:"reason"` // Reason 必填操作原因，最多 1024 字符。 +} + +// VersionView 保留规则、模板和原生效时间，已生成任务不会采用后续版本。 +type VersionView struct { + Version uint64 `json:"version,string"` // Version 发布序号，从一递增。 + EffectiveAt time.Time `json:"effective_at"` // EffectiveAt 数据库事务内取得的生效边界，包含此时间。 + Definition Definition `json:"definition"` // Definition 已冻结内容。 +} + +// Summary 用于计划列表，不包含大任务参数。 +type Summary struct { + ID core.ID `json:"id"` // ID 计划稳定身份。 + NamespaceID core.ID `json:"namespace_id"` // NamespaceID 隔离范围。 + QueueID core.ID `json:"queue_id"` // QueueID 计划终身绑定队列。 + Name string `json:"name"` // Name 同命名空间内唯一名称。 + Revision uint64 `json:"revision,string"` // Revision 控制和进度变更版本。 + CurrentVersion uint64 `json:"current_version,string"` // CurrentVersion 最新发布版本。 + ProcessingVersion uint64 `json:"processing_version,string"` // ProcessingVersion 尚在处理积压的历史版本。 + Paused bool `json:"paused"` // Paused 为真时停止新触发。 + NextFireAt *time.Time `json:"next_fire_at,omitempty"` // NextFireAt 原计划时间；积压时可在过去，待初始化或结束时为空，需结合 CheckAt。 + CheckAt *time.Time `json:"check_at,omitempty"` // CheckAt 下次可扫描时间；为空表示没有扫描工作，非空也可能尚待初始化触发点。 + CreatedAt time.Time `json:"created_at"` // CreatedAt UTC 创建时间。 + UpdatedAt time.Time `json:"updated_at"` // UpdatedAt UTC 最近变更时间。 +} + +// View 返回控制状态和最新版本，历史版本通过专用查询读取。 +type View struct { + Summary + Current VersionView `json:"current"` // Current 最新完整发布版本，不一定是当前积压所用版本。 +} + +// Result 是幂等命令的原始回执，当前状态应使用 Get 查询。 +type Result struct { + Schedule View `json:"schedule"` // Schedule 本次命令提交时的快照。 + Deduplicated bool `json:"deduplicated"` // Deduplicated 是否取回原回执。 +} + +// OccurrenceView 描述一个已决定的触发点或不重叠范围。 +type OccurrenceView struct { + ID core.ID `json:"id"` // ID 触发记录标识。 + ScheduleID core.ID `json:"schedule_id"` // ScheduleID 所属计划。 + ScheduleVersion uint64 `json:"schedule_version,string"` // ScheduleVersion 当时适用的不可变版本。 + ScheduledAt time.Time `json:"scheduled_at"` // ScheduledAt 原时间，参与唯一去重。 + Decision string `json:"decision"` // Decision FIRED、SKIPPED 或 COALESCED。 + TaskID *core.ID `json:"task_id,omitempty"` // TaskID 已生成任务；跳过时为空。 + CoveredUntil *time.Time `json:"covered_until,omitempty"` // CoveredUntil 范围排除边界，不一定是触发点。 + Reason string `json:"reason"` // Reason 稳定决策分类。 + CreatedAt time.Time `json:"created_at"` // CreatedAt 数据库记录时间。 +} +type Page struct { + Items []Summary `json:"items"` // Items 当前页摘要，始终为数组。 + NextCursor string `json:"next_cursor,omitempty"` // NextCursor 不透明后续游标。 +} +type OccurrencePage struct { + Items []OccurrenceView `json:"items"` // Items 当前页触发历史。 + NextCursor string `json:"next_cursor,omitempty"` // NextCursor 原样用于相同父资源查询。 +} +type PageInput struct { + Limit int // Limit 默认 20，最大 100。 + Cursor string // Cursor 最长 1024 字符，不能作为权限证明。 +} + +// Store 必须原子执行命令授权、版本、游标、审计和幂等回执。 +type Store interface { + Create(context.Context, auth.Token, string, CreateInput) (Result, error) + Get(context.Context, auth.Token, core.ID) (View, error) + Publish(context.Context, auth.Token, core.ID, string, PublishInput) (Result, error) + Control(context.Context, auth.Token, core.ID, string, ControlInput, bool) (Result, error) + List(context.Context, auth.Token, core.ID, PageInput) (Page, error) + Version(context.Context, auth.Token, core.ID, uint64) (VersionView, error) + Occurrences(context.Context, auth.Token, core.ID, PageInput) (OccurrencePage, error) +} +type Service struct{ store Store } + +func New(store Store) *Service { return &Service{store: store} } +func Normalize(in Definition) (Definition, error) { + c, err := Compile(in.Rule) + if err != nil { + return in, fault.Invalid(err.Error()) + } + in.Rule = c.Rule() + if err := in.Policy.Validate(); err != nil { + return in, fault.Invalid(err.Error()) + } + if in.Task.AvailableAt != nil || in.Task.StartDeadlineAt != nil { + return in, fault.Invalid("schedule templates cannot contain absolute task times") + } + in.Task, err = service.NormalizeSubmit(in.Task) + return in, err +} +func control(id core.ID, key string, revision uint64, reason string) error { + if id.Validate() != nil || revision == 0 || !utf8.ValidString(reason) || strings.TrimSpace(reason) == "" || utf8.RuneCountInString(reason) > 1024 { + return fault.Invalid("valid schedule id, expected_revision and reason are required") + } + return service.ValidateKey(key) +} +func page(in PageInput) (PageInput, error) { + if in.Limit == 0 { + in.Limit = 20 + } + if in.Limit < 1 || in.Limit > 100 || len(in.Cursor) > 1024 { + return in, fault.Invalid("invalid schedule page") + } + return in, nil +} +func (s *Service) Create(ctx context.Context, t auth.Token, key string, in CreateInput) (Result, error) { + if err := service.ValidateKey(key); err != nil { + return Result{}, err + } + if !service.ValidName(in.Name, 128) { + return Result{}, fault.Invalid("schedule name is invalid") + } + var err error + in.Definition, err = Normalize(in.Definition) + if err != nil { + return Result{}, err + } + return s.store.Create(ctx, t, key, in) +} +func (s *Service) Get(ctx context.Context, t auth.Token, id core.ID) (View, error) { + if id.Validate() != nil { + return View{}, fault.Invalid("invalid schedule id") + } + return s.store.Get(ctx, t, id) +} +func (s *Service) Publish(ctx context.Context, t auth.Token, id core.ID, key string, in PublishInput) (Result, error) { + if err := control(id, key, in.ExpectedRevision, in.Reason); err != nil { + return Result{}, err + } + var err error + in.Definition, err = Normalize(in.Definition) + if err != nil { + return Result{}, err + } + return s.store.Publish(ctx, t, id, key, in) +} +func (s *Service) Control(ctx context.Context, t auth.Token, id core.ID, key string, in ControlInput, paused bool) (Result, error) { + if err := control(id, key, in.ExpectedRevision, in.Reason); err != nil { + return Result{}, err + } + return s.store.Control(ctx, t, id, key, in, paused) +} +func (s *Service) List(ctx context.Context, t auth.Token, queue core.ID, in PageInput) (Page, error) { + if queue.Validate() != nil { + return Page{}, fault.Invalid("queue_id is required") + } + in, err := page(in) + if err != nil { + return Page{}, err + } + return s.store.List(ctx, t, queue, in) +} +func (s *Service) Version(ctx context.Context, t auth.Token, id core.ID, version uint64) (VersionView, error) { + if id.Validate() != nil || version == 0 { + return VersionView{}, fault.Invalid("invalid schedule id or version") + } + return s.store.Version(ctx, t, id, version) +} +func (s *Service) Occurrences(ctx context.Context, t auth.Token, id core.ID, in PageInput) (OccurrencePage, error) { + if id.Validate() != nil { + return OccurrencePage{}, fault.Invalid("invalid schedule id") + } + in, err := page(in) + if err != nil { + return OccurrencePage{}, err + } + return s.store.Occurrences(ctx, t, id, in) +} diff --git a/scripts/test-mysql.sh b/scripts/test-mysql.sh index 3bd707a..ebef6d5 100755 --- a/scripts/test-mysql.sh +++ b/scripts/test-mysql.sh @@ -48,12 +48,14 @@ done if [ -z "$TASK_HTTP_PORT" ]; then printf '%s\n' 'Bootstrap HTTP server did not start.' >&2; exit 1; fi (cd sdk/go && ORBIT_URL="http://127.0.0.1:$TASK_HTTP_PORT" "$TASK_GO" run ./examples/health) (cd sdk/go && ORBIT_URL="http://127.0.0.1:$TASK_HTTP_PORT" ORBIT_CREDENTIALS_FILE="$TASK_TEST_DIR/sdk.credentials.json" "$TASK_GO" run ./examples/tasks) -ORBIT_MYSQL_DSN="$ORBIT_TEST_MYSQL_DSN" "$TASK_TEST_DIR/orbit-admin" bootstrap --application sdk-worker --namespace default --environment test --queue worker-examples --worker-access --output "$TASK_TEST_DIR/worker.credentials.json" +ORBIT_MYSQL_DSN="$ORBIT_TEST_MYSQL_DSN" "$TASK_TEST_DIR/orbit-admin" bootstrap --application sdk-worker --namespace default --environment test --queue worker-examples --worker-access --schedule-access --output "$TASK_TEST_DIR/worker.credentials.json" (cd sdk/go && ORBIT_TEST_WORKER_URL="http://127.0.0.1:$TASK_HTTP_PORT" ORBIT_TEST_WORKER_CREDENTIALS_FILE="$TASK_TEST_DIR/worker.credentials.json" "$TASK_GO" test -race -count=1 -run 'IntegrationWorker(Connection|Runtime)' -v .) +(cd sdk/go && ORBIT_TEST_WORKER_URL="http://127.0.0.1:$TASK_HTTP_PORT" ORBIT_TEST_WORKER_CREDENTIALS_FILE="$TASK_TEST_DIR/worker.credentials.json" "$TASK_GO" test -race -count=1 -run '^TestIntegrationSchedule' -v .) (cd sdk/go && ORBIT_URL="http://127.0.0.1:$TASK_HTTP_PORT" ORBIT_CREDENTIALS_FILE="$TASK_TEST_DIR/worker.credentials.json" "$TASK_GO" run ./examples/worker-protocol) (cd sdk/go && ORBIT_URL="http://127.0.0.1:$TASK_HTTP_PORT" ORBIT_CREDENTIALS_FILE="$TASK_TEST_DIR/worker.credentials.json" "$TASK_GO" run ./examples/worker) (cd sdk/go && ORBIT_URL="http://127.0.0.1:$TASK_HTTP_PORT" ORBIT_CREDENTIALS_FILE="$TASK_TEST_DIR/worker.credentials.json" "$TASK_GO" run ./examples/history) (cd sdk/go && ORBIT_URL="http://127.0.0.1:$TASK_HTTP_PORT" ORBIT_CREDENTIALS_FILE="$TASK_TEST_DIR/worker.credentials.json" "$TASK_GO" run ./examples/retry) +(cd sdk/go && ORBIT_URL="http://127.0.0.1:$TASK_HTTP_PORT" ORBIT_CREDENTIALS_FILE="$TASK_TEST_DIR/worker.credentials.json" "$TASK_GO" run ./examples/schedules) # 停止原服务后再做进程故障演练，避免其他恢复扫描器掩盖接管验证。 kill "$TASK_SERVER_PID" diff --git a/sdk/go/examples/schedules/main.go b/sdk/go/examples/schedules/main.go new file mode 100644 index 0000000..f9fb5c4 --- /dev/null +++ b/sdk/go/examples/schedules/main.go @@ -0,0 +1,149 @@ +// schedules 演示持久化周期任务：创建、恢复、Worker 执行、触发历史和暂停。 +package main + +import ( + "context" + "encoding/json" + "errors" + "fmt" + "os" + "time" + + orbit "git.yuntuo.hk/k2safe/orbit/sdk/go" +) + +func main() { + if err := run(); err != nil { + fmt.Fprintln(os.Stderr, err) + os.Exit(1) + } +} +func run() error { + token, queue := os.Getenv("ORBIT_TOKEN"), os.Getenv("ORBIT_QUEUE_ID") + if path := os.Getenv("ORBIT_CREDENTIALS_FILE"); path != "" { + raw, err := os.ReadFile(path) + if err != nil { + return fmt.Errorf("read private credentials: %w", err) + } + var credentials struct { + Token string `json:"token"` + QueueID string `json:"queue_id"` + } + if json.Unmarshal(raw, &credentials) != nil { + return errors.New("invalid credentials file") + } + if token == "" { + token = credentials.Token + } + if queue == "" { + queue = credentials.QueueID + } + } + client, err := orbit.NewClient(os.Getenv("ORBIT_URL"), orbit.Options{Token: token}) + if err != nil { + return err + } + + operation, err := orbit.NewWorkerMessageID() + if err != nil { + return err + } + handler := "object.snapshot." + operation + ctx, cancel := context.WithTimeout(context.Background(), 25*time.Second) + defer cancel() + worker, err := orbit.NewWorker(client, orbit.WorkerOptions{QueueID: queue, Capacity: 1, ShutdownTimeout: 5 * time.Second, Handlers: []orbit.WorkerHandler{{Capability: orbit.WorkerCapability{Handler: handler, HandlerVersion: "v1", PayloadVersion: "v1"}, Handle: func(ctx context.Context, e orbit.WorkerExecution) (json.RawMessage, error) { + if err := ctx.Err(); err != nil { + return nil, err + } + // 实际副作用应按 Task.ID 或业务操作键去重；此示例只返回输入快照。 + return e.Task.Payload, nil + }}}}) + if err != nil { + return err + } + start := time.Now().UTC().Truncate(time.Microsecond).Add(1500 * time.Millisecond) + end := start.Add(10 * time.Second) + created, err := client.CreateSchedule(ctx, "create-"+operation, orbit.CreateScheduleRequest{Name: handler, Paused: true, Definition: orbit.ScheduleDefinition{ + Rule: orbit.ScheduleRule{Kind: "FIXED_RATE", Timezone: "UTC", StartAt: start, EndAt: &end, IntervalMS: 1000}, + Policy: orbit.SchedulePolicy{Misfire: "COALESCE", Overlap: "SERIAL", CatchupLimit: 2, CatchupWindowMS: 30000, GraceMS: 1000}, + Task: orbit.SubmitTaskRequest{QueueID: queue, Handler: handler, HandlerVersion: "v1", PayloadVersion: "v1", Payload: json.RawMessage(`{"source_ref":"objects/sample","sequence":9007199254740993}`)}, + }}) + if err != nil { + return err + } + if _, err := client.ResumeSchedule(ctx, created.Schedule.ID, "resume-"+operation, orbit.ControlScheduleRequest{ExpectedRevision: created.Schedule.Revision, Reason: "start bounded example"}); err != nil { + return err + } + workerCtx, stop := context.WithCancel(ctx) + done := make(chan error, 1) + go func() { done <- worker.Run(workerCtx) }() + waited := false + defer func() { + stop() + if !waited { + <-done + } + }() + completed := map[string]bool{} + for len(completed) < 2 { + page, err := client.ListScheduleOccurrences(ctx, created.Schedule.ID, orbit.SchedulePageRequest{}) + if err != nil { + return err + } + for _, item := range page.Items { + if item.TaskID == nil || completed[*item.TaskID] { + continue + } + task, err := client.GetTask(ctx, *item.TaskID) + if err != nil { + return err + } + if task.State == orbit.TaskSucceeded { + completed[task.ID] = true + fmt.Printf("schedule=%s occurrence=%s task=%s version=%d state=%s\n", created.Schedule.ID, item.ID, task.ID, item.ScheduleVersion, task.State) + } + if task.State == orbit.TaskFailed || task.State == orbit.TaskNeedsReview { + return fmt.Errorf("scheduled task requires attention: %s", task.State) + } + } + if len(completed) >= 2 { + break + } + select { + case err := <-done: + waited = true + return fmt.Errorf("Worker stopped before completion: %v", err) + case <-ctx.Done(): + return ctx.Err() + case <-time.After(100 * time.Millisecond): + } + } + // 扫描也改变计划版本；遇到 CAS 冲突读取新状态，再以新操作身份重试暂停。 + for { + current, err := client.GetSchedule(ctx, created.Schedule.ID) + if err != nil { + return err + } + key, err := orbit.NewWorkerMessageID() + if err != nil { + return err + } + paused, err := client.PauseSchedule(ctx, current.ID, key, orbit.ControlScheduleRequest{ExpectedRevision: current.Revision, Reason: "example finished"}) + if err == nil { + fmt.Printf("paused=%t completed_tasks=%d current_version=%d\n", paused.Schedule.Paused, len(completed), paused.Schedule.CurrentVersion) + break + } + var apiErr *orbit.APIError + if !errors.As(err, &apiErr) || apiErr.Code != "STATE_CONFLICT" { + return err + } + } + stop() + err = <-done + waited = true + if err != nil { + return err + } + fmt.Printf("worker_drained=true running=%d\n", worker.Stats().Running) + return nil +} diff --git a/sdk/go/schedule_integration_test.go b/sdk/go/schedule_integration_test.go new file mode 100644 index 0000000..dbcb9b0 --- /dev/null +++ b/sdk/go/schedule_integration_test.go @@ -0,0 +1,134 @@ +package orbit + +import ( + "context" + "encoding/json" + "errors" + "testing" + "time" +) + +func TestIntegrationScheduleLifecycle(t *testing.T) { + api, queue, _ := integrationWorkerClient(t) + ctx, cancel := context.WithTimeout(context.Background(), 25*time.Second) + defer cancel() + name := "scheduled." + workerTestID(t) + w, err := NewWorker(api, WorkerOptions{QueueID: queue, Capacity: 1, Handlers: []WorkerHandler{runtimeHandler(name, func(ctx context.Context, e WorkerExecution) (json.RawMessage, error) { return e.Task.Payload, nil })}}) + if err != nil { + t.Fatal(err) + } + run, stop := context.WithCancel(ctx) + defer stop() + done := make(chan error, 1) + go func() { done <- w.Run(run) }() + ended := false + defer func() { + stop() + if !ended { + <-done + } + }() + start := time.Now().UTC().Truncate(time.Microsecond).Add(1500 * time.Millisecond) + in := CreateScheduleRequest{Name: name, Paused: true, Definition: ScheduleDefinition{Rule: ScheduleRule{Kind: "FIXED_RATE", Timezone: "UTC", StartAt: start, IntervalMS: 1000}, Policy: SchedulePolicy{Misfire: "COALESCE", Overlap: "SERIAL", CatchupLimit: 2, CatchupWindowMS: 60000, GraceMS: 1000}, Task: SubmitTaskRequest{QueueID: queue, Handler: name, HandlerVersion: "v1", PayloadVersion: "v1", Payload: json.RawMessage(`{"n":9007199254740993}`)}}} + key := "schedule-" + workerTestID(t) + accepted, err := api.CreateSchedule(ctx, key, in) + if err != nil { + t.Fatal(err) + } + duplicate, err := api.CreateSchedule(ctx, key, in) + if err != nil || !duplicate.Deduplicated || duplicate.Schedule.ID != accepted.Schedule.ID { + t.Fatal("schedule submit replay", err) + } + resumed, err := api.ResumeSchedule(ctx, accepted.Schedule.ID, workerTestID(t), ControlScheduleRequest{ExpectedRevision: accepted.Schedule.Revision, Reason: "run integration schedule"}) + if err != nil { + t.Fatal(err) + } + var occurrence ScheduleOccurrence + for occurrence.TaskID == nil { + page, err := api.ListScheduleOccurrences(ctx, resumed.Schedule.ID, SchedulePageRequest{}) + if err != nil { + t.Fatal(err) + } + for _, item := range page.Items { + if item.TaskID != nil { + occurrence = item + break + } + } + if occurrence.TaskID != nil { + break + } + select { + case <-ctx.Done(): + t.Fatal(ctx.Err()) + case <-time.After(80 * time.Millisecond): + } + } + task := waitRuntimeState(t, ctx, api, *occurrence.TaskID, TaskSucceeded) + if string(task.Result) != `{"n":9007199254740993}` || task.AttemptCount != 1 { + t.Fatal("scheduled Worker result corrupted") + } + var paused ScheduleResult + for { + current, err := api.GetSchedule(ctx, resumed.Schedule.ID) + if err != nil { + t.Fatal(err) + } + paused, err = api.PauseSchedule(ctx, current.ID, workerTestID(t), ControlScheduleRequest{ExpectedRevision: current.Revision, Reason: "publish next definition"}) + if err == nil { + break + } + var apiErr *APIError + if !errors.As(err, &apiErr) || apiErr.Code != "STATE_CONFLICT" { + t.Fatal(err) + } + } + in.Definition.Rule = ScheduleRule{Kind: "CRON", Timezone: "Australia/Lord_Howe", StartAt: start, Cron: "*/5 * * * *"} + publish := PublishScheduleRequest{ExpectedRevision: paused.Schedule.Revision, Reason: "test immutable cron version", Definition: in.Definition} + publishKey := workerTestID(t) + updated, err := api.PublishSchedule(ctx, paused.Schedule.ID, publishKey, publish) + if err != nil || updated.Schedule.CurrentVersion != 2 || !updated.Schedule.Paused { + t.Fatal("publish schedule", err) + } + old, err := api.GetScheduleVersion(ctx, paused.Schedule.ID, 1) + if err != nil || old.Definition.Rule.Kind != "FIXED_RATE" { + t.Fatal("old version lost", err) + } + current, err := api.GetScheduleVersion(ctx, paused.Schedule.ID, 2) + if err != nil || current.Definition.Rule.Kind != "CRON" { + t.Fatal("new cron version lost", err) + } + duplicate, err = api.PublishSchedule(ctx, paused.Schedule.ID, publishKey, publish) + if err != nil || !duplicate.Deduplicated || duplicate.Schedule.Revision != updated.Schedule.Revision { + t.Fatal("publish replay changed revision") + } + list, err := api.ListSchedules(ctx, queue, SchedulePageRequest{Limit: 100}) + if err != nil { + t.Fatal(err) + } + found := false + for _, v := range list.Items { + found = found || v.ID == updated.Schedule.ID + } + if !found { + t.Fatal("schedule missing from list") + } + before, err := api.ListScheduleOccurrences(ctx, updated.Schedule.ID, SchedulePageRequest{}) + if err != nil { + t.Fatal(err) + } + select { + case <-ctx.Done(): + t.Fatal(ctx.Err()) + case <-time.After(1200 * time.Millisecond): + } + after, err := api.ListScheduleOccurrences(ctx, updated.Schedule.ID, SchedulePageRequest{}) + if err != nil || len(after.Items) != len(before.Items) { + t.Fatal("paused version fired") + } + stop() + if err := <-done; err != nil { + t.Fatal(err) + } + ended = true +} diff --git a/sdk/go/schedule_types.go b/sdk/go/schedule_types.go new file mode 100644 index 0000000..c30c6b0 --- /dev/null +++ b/sdk/go/schedule_types.go @@ -0,0 +1,110 @@ +package orbit + +import "time" + +// ScheduleRule 是不可变计划版本中的时间规则。所有边界精确到 UTC 微秒。 +type ScheduleRule struct { + CalendarVersion string `json:"calendar_version,omitempty"` // CalendarVersion 留空时采用 v1 固定默认时区快照；读取后保留原值。 + Kind string `json:"kind"` // Kind CRON 或 FIXED_RATE；不支持以完成时间推进的 fixed-delay。 + Timezone string `json:"timezone"` // Timezone 显式 IANA 名称，禁止依赖节点 Local 设置。 + StartAt time.Time `json:"start_at"` // StartAt 包含此边界；固定间隔以此为唯一基准。 + EndAt *time.Time `json:"end_at,omitempty"` // EndAt 排除此边界；为空时运行至支持的日期上限。 + Cron string `json:"cron,omitempty"` // Cron 五段表达式：分钟、小时、月日、月、星期。 + IntervalMS uint64 `json:"interval_ms,omitempty"` // IntervalMS 固定间隔毫秒数，范围 1000–2592000000。 +} + +// SchedulePolicy 显式规定漏跑与重叠；窗口、批量和持久化扫描间隔共同限制补跑。 +type SchedulePolicy struct { + Misfire string `json:"misfire"` // Misfire SKIP、COALESCE 或 CATCH_UP，必须明确提供。 + Overlap string `json:"overlap"` // Overlap PARALLEL、SERIAL 或 SKIP，必须明确提供。 + CatchupLimit uint32 `json:"catchup_limit"` // CatchupLimit 每批最多生成的任务数，1–100；串行最多一个。 + CatchupWindowMS uint64 `json:"catchup_window_ms"` // CatchupWindowMS 最多保留多久的未处理触发点，1000 毫秒–30 天。 + GraceMS uint64 `json:"grace_ms"` // GraceMS 允许正常派发延迟的毫秒数，1000–60000，不超过窗口。 +} + +// ScheduleDefinition 是每次发布冻结的完整定义，业务内容仍由独立 Worker 解释。 +type ScheduleDefinition struct { + Rule ScheduleRule `json:"rule"` // Rule 时间规则；start_at 是基准，不允许追溯到版本生效前产生新任务。 + Policy SchedulePolicy `json:"policy"` // Policy 明确的漏跑、重叠和补跑边界。 + Task SubmitTaskRequest `json:"task"` // Task 每次触发的模板，禁止绝对 available_at/start_deadline_at。 +} + +// CreateScheduleRequest 创建持久化计划，暂停计划也保存完整的触发进度。 +type CreateScheduleRequest struct { + Name string `json:"name"` // Name 命名空间内唯一的 ASCII 名称。 + Definition ScheduleDefinition `json:"definition"` // Definition 首个不可变版本。 + Paused bool `json:"paused"` // Paused 是否从暂停状态开始，恢复时处理期间漏跑。 +} + +// PublishScheduleRequest 发布立即生效的新版本；旧积压仍按当时版本处理。 +type PublishScheduleRequest struct { + ExpectedRevision uint64 `json:"expected_revision,string"` // ExpectedRevision 当前控制版本，必须非零。 + Reason string `json:"reason"` // Reason 必填操作原因，写入审计。 + Definition ScheduleDefinition `json:"definition"` // Definition 完整替换定义；队列不能更换。 +} + +// ControlScheduleRequest 暂停/恢复计划，不能取消已产生的任务。 +type ControlScheduleRequest struct { + ExpectedRevision uint64 `json:"expected_revision,string"` // ExpectedRevision 乐观并发版本。 + Reason string `json:"reason"` // Reason 必填操作原因，最多 1024 字符。 +} + +// ScheduleVersion 保留规则、模板和原生效时间，已生成任务不会采用后续版本。 +type ScheduleVersion struct { + Version uint64 `json:"version,string"` // Version 发布序号，从一递增。 + EffectiveAt time.Time `json:"effective_at"` // EffectiveAt 数据库事务内取得的生效边界，包含此时间。 + Definition ScheduleDefinition `json:"definition"` // Definition 已冻结内容。 +} + +// ScheduleSummary 用于计划列表，不包含大任务参数。 +type ScheduleSummary struct { + ID string `json:"id"` // ID 计划稳定身份。 + NamespaceID string `json:"namespace_id"` // NamespaceID 隔离范围。 + QueueID string `json:"queue_id"` // QueueID 计划终身绑定队列。 + Name string `json:"name"` // Name 同命名空间内唯一名称。 + Revision uint64 `json:"revision,string"` // Revision 控制和进度变更版本。 + CurrentVersion uint64 `json:"current_version,string"` // CurrentVersion 最新发布版本。 + ProcessingVersion uint64 `json:"processing_version,string"` // ProcessingVersion 尚在处理积压的历史版本。 + Paused bool `json:"paused"` // Paused 为真时停止新触发。 + NextFireAt *time.Time `json:"next_fire_at,omitempty"` // NextFireAt 原计划时间；积压时可在过去，待初始化或结束时为空，需结合 CheckAt。 + CheckAt *time.Time `json:"check_at,omitempty"` // CheckAt 下次可扫描时间；为空表示没有扫描工作，非空也可能尚待初始化触发点。 + CreatedAt time.Time `json:"created_at"` // CreatedAt UTC 创建时间。 + UpdatedAt time.Time `json:"updated_at"` // UpdatedAt UTC 最近变更时间。 +} + +// Schedule 返回控制状态和最新版本，历史版本通过专用查询读取。 +type Schedule struct { + ScheduleSummary + Current ScheduleVersion `json:"current"` // Current 最新完整发布版本，不一定是当前积压所用版本。 +} + +// ScheduleResult 是幂等命令的原始回执，当前状态应使用 Get 查询。 +type ScheduleResult struct { + Schedule Schedule `json:"schedule"` // Schedule 本次命令提交时的快照。 + Deduplicated bool `json:"deduplicated"` // Deduplicated 是否取回原回执。 +} + +// ScheduleOccurrence 描述一个已决定的触发点或不重叠范围。 +type ScheduleOccurrence struct { + ID string `json:"id"` // ID 触发记录标识。 + ScheduleID string `json:"schedule_id"` // ScheduleID 所属计划。 + ScheduleVersion uint64 `json:"schedule_version,string"` // ScheduleVersion 当时适用的不可变版本。 + ScheduledAt time.Time `json:"scheduled_at"` // ScheduledAt 原时间，参与唯一去重。 + Decision string `json:"decision"` // Decision FIRED、SKIPPED 或 COALESCED。 + TaskID *string `json:"task_id,omitempty"` // TaskID 已生成任务；跳过时为空。 + CoveredUntil *time.Time `json:"covered_until,omitempty"` // CoveredUntil 范围排除边界，不一定是触发点。 + Reason string `json:"reason"` // Reason 稳定决策分类。 + CreatedAt time.Time `json:"created_at"` // CreatedAt 数据库记录时间。 +} +type SchedulePage struct { + Items []ScheduleSummary `json:"items"` // Items 当前页摘要，始终为数组。 + NextCursor string `json:"next_cursor,omitempty"` // NextCursor 不透明后续游标。 +} +type ScheduleOccurrencePage struct { + Items []ScheduleOccurrence `json:"items"` // Items 当前页触发历史。 + NextCursor string `json:"next_cursor,omitempty"` // NextCursor 原样用于相同父资源查询。 +} +type SchedulePageRequest struct { + Limit int // Limit 默认 20，最大 100。 + Cursor string // Cursor 最长 1024 字符，不能作为权限证明。 +} diff --git a/sdk/go/schedules.go b/sdk/go/schedules.go new file mode 100644 index 0000000..987dcb1 --- /dev/null +++ b/sdk/go/schedules.go @@ -0,0 +1,83 @@ +package orbit + +import ( + "context" + "errors" + "net/url" + "strconv" +) + +// CreateSchedule 使用稳定幂等键受理一个计划；回执不代表任何一次触发已经执行。 +func (c *Client) CreateSchedule(ctx context.Context, key string, in CreateScheduleRequest) (ScheduleResult, error) { + var out ScheduleResult + err := c.call(ctx, "POST", "/v1/schedules", key, in, &out) + return out, err +} +func (c *Client) GetSchedule(ctx context.Context, id string) (Schedule, error) { + var out Schedule + if !validID(id) { + return out, errors.New("invalid schedule id") + } + err := c.call(ctx, "GET", "/v1/schedules/"+id, "", nil, &out) + return out, err +} + +// PublishSchedule 发布完整新版本。保留原 key/revision 重报，不能重置原版本的积压身份。 +func (c *Client) PublishSchedule(ctx context.Context, id, key string, in PublishScheduleRequest) (ScheduleResult, error) { + var out ScheduleResult + if !validID(id) { + return out, errors.New("invalid schedule id") + } + err := c.call(ctx, "PATCH", "/v1/schedules/"+id, key, in, &out) + return out, err +} +func (c *Client) PauseSchedule(ctx context.Context, id, key string, in ControlScheduleRequest) (ScheduleResult, error) { + return c.controlSchedule(ctx, id, key, in, "pause") +} +func (c *Client) ResumeSchedule(ctx context.Context, id, key string, in ControlScheduleRequest) (ScheduleResult, error) { + return c.controlSchedule(ctx, id, key, in, "resume") +} +func (c *Client) controlSchedule(ctx context.Context, id, key string, in ControlScheduleRequest, action string) (ScheduleResult, error) { + var out ScheduleResult + if !validID(id) { + return out, errors.New("invalid schedule id") + } + err := c.call(ctx, "POST", "/v1/schedules/"+id+":"+action, key, in, &out) + return out, err +} +func (c *Client) ListSchedules(ctx context.Context, queue string, in SchedulePageRequest) (SchedulePage, error) { + var out SchedulePage + if !validID(queue) { + return out, errors.New("invalid queue id") + } + q := scheduleQuery(in) + q.Set("queue_id", queue) + err := c.call(ctx, "GET", "/v1/schedules?"+q.Encode(), "", nil, &out) + return out, err +} +func (c *Client) GetScheduleVersion(ctx context.Context, id string, version uint64) (ScheduleVersion, error) { + var out ScheduleVersion + if !validID(id) || version == 0 { + return out, errors.New("invalid schedule id or version") + } + err := c.call(ctx, "GET", "/v1/schedules/"+id+"/versions/"+strconv.FormatUint(version, 10), "", nil, &out) + return out, err +} +func (c *Client) ListScheduleOccurrences(ctx context.Context, id string, in SchedulePageRequest) (ScheduleOccurrencePage, error) { + var out ScheduleOccurrencePage + if !validID(id) { + return out, errors.New("invalid schedule id") + } + err := c.call(ctx, "GET", "/v1/schedules/"+id+"/occurrences?"+scheduleQuery(in).Encode(), "", nil, &out) + return out, err +} +func scheduleQuery(in SchedulePageRequest) url.Values { + q := url.Values{} + if in.Limit != 0 { + q.Set("limit", strconv.Itoa(in.Limit)) + } + if in.Cursor != "" { + q.Set("cursor", in.Cursor) + } + return q +} diff --git a/sdk/go/worker_process_integration_test.go b/sdk/go/worker_process_integration_test.go index 2bb6c8e..b8fc957 100644 --- a/sdk/go/worker_process_integration_test.go +++ b/sdk/go/worker_process_integration_test.go @@ -392,3 +392,83 @@ func TestIntegrationWorkerProcessCrashUnknown(t *testing.T) { t.Fatal("external work marker lost") } } + +// 在没有其他 Orbit 节点的间隙真实强杀调度进程，再由两个新进程从数据库接续。 +func TestIntegrationWorkerProcessScheduleRecovery(t *testing.T) { + a := startOrbitProcess(t) + _, queue, token := integrationWorkerClient(t) + apiA := processClient(t, a, token) + ctx, cancel := context.WithTimeout(context.Background(), 35*time.Second) + defer cancel() + name := "schedule-crash." + workerTestID(t) + start := time.Now().UTC().Truncate(time.Microsecond).Add(time.Second) + end := start.Add(8 * time.Second) + created, err := apiA.CreateSchedule(ctx, workerTestID(t), CreateScheduleRequest{Name: name, Definition: ScheduleDefinition{ + Rule: ScheduleRule{Kind: "FIXED_RATE", Timezone: "UTC", StartAt: start, EndAt: &end, IntervalMS: 1000}, + Policy: SchedulePolicy{Misfire: "CATCH_UP", Overlap: "PARALLEL", CatchupLimit: 2, CatchupWindowMS: 60000, GraceMS: 1000}, + Task: SubmitTaskRequest{QueueID: queue, Handler: name, HandlerVersion: "v1", PayloadVersion: "v1", Payload: json.RawMessage(`{"source_ref":"objects/recovery"}`)}, + }}) + if err != nil { + t.Fatal(err) + } + for { + page, err := apiA.ListScheduleOccurrences(ctx, created.Schedule.ID, SchedulePageRequest{}) + if err != nil { + t.Fatal(err) + } + if len(page.Items) > 0 { + break + } + select { + case <-ctx.Done(): + t.Fatal(ctx.Err()) + case <-time.After(50 * time.Millisecond): + } + } + a.kill(t) + // 三秒无服务形成真实漏跑，不改数据库时钟或游标。 + select { + case <-ctx.Done(): + t.Fatal(ctx.Err()) + case <-time.After(3 * time.Second): + } + b := startOrbitProcess(t) + c := startOrbitProcess(t) + if a.nodeID == b.nodeID || a.nodeID == c.nodeID || b.nodeID == c.nodeID { + t.Fatal("scheduler nodes reused identity") + } + apiB := processClient(t, b, token) + for { + current, err := apiB.GetSchedule(ctx, created.Schedule.ID) + if err != nil { + t.Fatal(err) + } + if current.CheckAt == nil && current.NextFireAt == nil { + break + } + select { + case <-ctx.Done(): + t.Fatal(ctx.Err()) + case <-time.After(80 * time.Millisecond): + } + } + page, err := apiB.ListScheduleOccurrences(ctx, created.Schedule.ID, SchedulePageRequest{Limit: 100}) + if err != nil { + t.Fatal(err) + } + if len(page.Items) != 8 { + t.Fatalf("expected eight durable occurrences, got %d", len(page.Items)) + } + seen := map[string]bool{} + for i, item := range page.Items { + want := start.Add(time.Duration(7-i) * time.Second) + if item.TaskID == nil || item.Decision != "FIRED" || item.ScheduleVersion != 1 || !item.ScheduledAt.Equal(want) || seen[*item.TaskID] { + t.Fatal("recovery duplicated, skipped, or retimed occurrence") + } + seen[*item.TaskID] = true + task, err := apiB.GetTask(ctx, *item.TaskID) + if err != nil || task.State != TaskWaiting || string(task.Payload) != `{"source_ref":"objects/recovery"}` { + t.Fatal("occurrence/task transaction lost", err) + } + } +}