From 1c1ef6593199f1d44d33af8f2394135854a9e695 Mon Sep 17 00:00:00 2001
From: ymq <ymq@opencomputing.net>
Date: Wed, 2 Sep 2026 12:09:16 +0800
Subject: [PATCH] =?UTF-8?q?feat(rag):=20=E6=9C=BA=E6=9E=84rags=E7=9B=AE?=
 =?UTF-8?q?=E5=BD=95+=E5=AE=B9=E9=87=8F=E6=A3=80=E6=9F=A5=E5=8F=82?=
 =?UTF-8?q?=E6=95=B0=E5=8C=96+KB=E7=BA=A7=E8=A7=92=E8=89=B2=E6=9D=83?=
 =?UTF-8?q?=E9=99=90?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 存储: 知识库文件存 {workspace_base}/{org}/rags/{kb}/ (机构目录下开设rags目录)
- 容量: rag_check_storage_quota 参数控制是否检查机构上限(默认不检查)
- 权限: rag_knowledge_bases 加 maintain_roles/search_roles; 空=同机构默认可用
  维护入口(upload/delete/rename/tree/tags)校验maintain; 检索入口(search/file_list/file_serve)校验search
- file_serve.dspy: 下载/预览走校验端点, 堵住/idfile/猜路径越权
- 机构隔离: 跨机构KB一律拒绝
---
 models/rag_knowledge_bases.json               |  16 ++
 rag/__pycache__/init.cpython-311.pyc          | Bin 0 -> 111446 bytes
 rag/init.py                                   | 242 ++++++++++++++++--
 wwwroot/knowledge_bases_list/add_tag.dspy     |   8 +
 wwwroot/knowledge_bases_list/create_kb.dspy   |  14 +-
 wwwroot/knowledge_bases_list/delete_file.dspy |   9 +
 wwwroot/knowledge_bases_list/delete_kb.dspy   |   9 +
 .../delete_tree_item.dspy                     |  14 +-
 wwwroot/knowledge_bases_list/file_list.dspy   |  23 +-
 wwwroot/knowledge_bases_list/new_kb_form.ui   |  20 +-
 .../knowledge_bases_list/new_tree_item.dspy   |   6 +
 wwwroot/knowledge_bases_list/rename_kb.dspy   |   9 +
 wwwroot/knowledge_bases_list/save_tags.dspy   |   9 +
 .../update_tree_item.dspy                     |   9 +
 14 files changed, 347 insertions(+), 41 deletions(-)
 create mode 100644 rag/__pycache__/init.cpython-311.pyc

diff --git a/models/rag_knowledge_bases.json b/models/rag_knowledge_bases.json
index 45171b3..105ef1d 100644
--- a/models/rag_knowledge_bases.json
+++ b/models/rag_knowledge_bases.json
@@ -84,6 +84,22 @@
             "nullable": "yes",
             "default": "active"
         },
+        {
+            "name": "maintain_roles",
+            "title": "维护角色",
+            "type": "str",
+            "length": 500,
+            "nullable": "yes",
+            "default": ""
+        },
+        {
+            "name": "search_roles",
+            "title": "检索角色",
+            "type": "str",
+            "length": 500,
+            "nullable": "yes",
+            "default": ""
+        },
         {
             "name": "created_by",
             "title": "创建人",
diff --git a/rag/__pycache__/init.cpython-311.pyc b/rag/__pycache__/init.cpython-311.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..1ee1b460688aa5a098917fdde17dac7045e30982
GIT binary patch
literal 111446
zcmce<33yw_l`e>tSO^dR!F`2DiWDe{6h%tZE|DT-$=a;dlDse=FGNA&<_k~@4cO|$
zNoYrjXhn%=MUG*&9W#y-v-8|-#!I3&c3O7)(iiIM76$Wi#`D^gr8hHQ%WdZyfBN3{
zdj3-v+XX>NcKjMFo?BJ7_NrTT>YP)jUNoDH3jE#=o<CCaKNX69B}eS1idsJVsZyah
zuiz916`Yb&^(y;R2USY4t9#Xbnu8i<*Ys-pG7e@iyS7)?r$4CgGaNK9cSf(VFY{m~
zv+H_I2Th2p>op%VvuD=9EcUb<v~c>z6bG%G0no-70kgSGKs#pw%;DB>S&u0X=5iLe
z@;EDCK4$|g;IaV=Is3sPZY`ICFvVOhd`h@Hz)~(Bu#77JEawUV9b6IMJgyk9f-3>6
z<VpdnxH7=`TsdGh=K!qX<^e9?)^U|c)yY-CRm-jCYT#PPEr6>I@0@Tg!m}37dOR26
z*??yqo{PCf2-V2d11{kj0GqhQfX!SZ;8Jc0;4-cWu!U;|T+S^8T)`~^T*<WnuHu#h
zuI5$%uHjY!uH{w%uH#k%uIF^S70%Y7P3SG-E?3WPH-F5{JKA^ObHK65)z9_1d9P!U
zV^`~4j%&fm>EC_p<H-xtPdt0$)En1-`=n!`<JynE`|%t9@bTmmAHNxFm>vn<c<OoM
z4eEKPGGaV5!1uX)o$eFea2ceeJNl2oVcq5K@pyf1e&bMox6d=s?^H#!oV#nNCt^Tw
z_aO6AMl3yUU#E9~@9ZAv_qk8_ws*&d73GnE|1<diY(2mhg%ZQehrt&69f{j9KvX>n
zPW_yc(_B<@S}x;d-Otnt#V_zL{m=;d?GXd->hZD`7}hSXZ>(SJv<_!BxCT89UZ2Z1
z<Q+CK$I-5aUX*^=!d%=ycf-(N?|_R-^5ERPZl60A+3n)H4@V=r`+Ge7Zf`8Chi~ZS
z-7bWUrUs8_WV4h!Jd$$rxq4y|r1#{J@;(}0N|4^Wyk1XF|FDfENFGD|Q7?PktIy4O
zT%C9sD;kCKvXVR15gj#)r`sLTVR(4aVd$rRZg9ZU@AKZEKG}#K%<%Mc?tWjy<nH$l
z@$OESx7*`^zvhS+5wzS;-=Np2iRgIuLql$_FJc&U@vc5^=h5R4jf?N`Mly~br>9qg
z1ReO@s%SVo(C2PA+4oSx@d5s51NtZa@9FpW>IY9ovZTK0JS+`Yz5tQU`1iI0T*u!j
z#Z;!{^vbZkY`o>BN}K1rsfYuuK0o88f`C<Fv5vWK+VrORpDF-8CxBPl`JW*jg>2wi
z;K2soE^Tb!`4vYf82be@28CY}j1Rw<KRthj|6jyCzJ+=5Vf8-6dG&WR0j&?I#eRMb
zr~DZj_80L1->mqSGAVS1KO-0)zOh*J<WwGoJf<ucU5_H5_v_jfqsj+P2Mn{OqUJPy
z!x8EU_Vc8aMwX`0ml+GEQ232ML(P8?uYDjB>CmUjeuGL*8!-7zT*gsWTi!_aVZ`Tj
zKhbddr&R%S|9tovlHMEGdn4XwviG@oZ%TS^ioZ9r_gcT{Ckif$?3{(OayI;BU(^J3
zu~H;IQ96ChjndhJhL|h)Det$GI63n64rHagzoRs{+@q|oc@>w}ujEVt3zyFoaD`kE
zSIm`grCiy?46dAW_;M5FLO$`9m$&*b0wMN1t^yNY<wX@&E{m5X56xBiEoia%PpetH
zLav&tiN;&NIk{So5;-rFrI0C4fyJwf#$FVUUC!0}&8faUDz4$8x<}0|<{G&rToc#K
zEtRF6H16cNq=cHK?%Xoew*~*pFJ|;8xfK^R0jpmhG$q<CVe?z%IVka6oc@7d?=77z
z23lezw~AX0d}8fI4Yh4*3LLHYw9dC)RQvT**MQAeoXGP?R?P0VacwVekdK~j6^B`Y
zOZ|r78=EPVirtDzMWf<dNq%0<an%X+0mX5pQgHxFA+RMD%2yW4OQEPz@Y@5~zIh2B
zuHB!Fe(&&ACj8_h{U?g2HL3MWUl(qptaq~Iu`qwgW`%Cm0hBP1{Ydui=<~SpxI(Id
z^RDd?HKzKA9ia1Q|G@EHH`n9t>~eYC-iVnzvFHx<VXg5-v`4!-JseM;jtBqiht>6s
zha#%G+JJ^w6>u$vYa3jc$|9;QZ4qVL5Vb!rmunYae*3lQi{qcX{<|R?yr!SOF#Xcm
zkKg)X+}AGmz3ZO6jtyHk-{aH_XLR+r7xgvW%6{m$yT57CvED`QzAiV%dHQ>XGrM~|
zgNu%Ne1{vGhs_khvCp$-(WXU>%@M^AO)u9jzI5Z;-~Z&TU-9$d@+g2tM>PA|22R|t
z!hM5A>aecz(BeZahYm$Fjmrj43}<z_c+P>8yN|lMdfmge#=#Q~??A7Ib5wGR-OYzu
zoEedf?&BWLcQ~T!KJ51N9QH+YT|M0cy#stiH|S!8i>SN3SZKQjc+Sm7G<$$l4ben=
z^O+xBa6~j+1HBxUdkrC55kvPOpj}?iu$yqXe&4+;O)Tg}<O0mhcXAL2!2m<nyhF59
zINpBEF+{7<CvUtutf^eSe7RH2H^I#}14Oh^Su~qaQ=k-su5L6J>bGR@M63{xIfiJh
zpx$}*Z;`~ZWy_+k&i>Yc#FkNFEtHtiJJcnW!yD0f-Mxp9Jhe{5FvRytFNSkmgM;-n
zUiw^~ehG;LegXt!u-Db?9<F4_M9Ki`By0*en9t?utsesZ!qX=d(P5nRyZYRyz8V=s
zG9=^$jjl#!5v}_ep*}_zLuXmbWcYy0xP1{#-vHX0%Iwr6%FnN+RJC2enY=@UP+Yt4
z&1>g_pFH!z^;f<#{rV44cbCg`gN7=)6=}P9L}zWe9DY)RW*m0)5@x4qT)cSx9(0@*
zW$_*6S5hp^ao#n!@#jjO#?-I@<)@mhblg(aIZ$4nAK;zY5nU%g)Zf{U?}~8kA>erf
zd=EY-S`#D6T@e*3r|xz4M~uD!pR2c%4F@&V%Nif?of1+T(RzKnXE371Bch?kie#Vz
zfGG0xdGXnlq@g2*-}AH_^E6tVcAma8K8FA;Z+sp=MD6ZBhTe=73F%@WYj}4zzIyr^
zyb&cI(PJv;WPS#+bq@^n`}lh)x}J*KNoC21mQT%j`XU;N8p+_@-l1M!MCtZY)`V@Q
z{P=uI#1d_`IC|L!-$ML*9r$b{^fGL;oo+a_;ihVyc2T&f^lH(<D@6-KMT^9uMM6%h
z88J-RD}qhq+K|0owAbHMlo(dd4JInXg(c7AUdR>7n<u(Lg)79u6@oq0jI@Vy@<uws
zxrH|sx#r4G35+Vk^QvCVeJ(fn=w$w-dGAzBT0-+SiSsrI#i?dgKUGp5)IYWD;<iyk
zxU}rz{X%K|_|8#d*j^eex?*1_*cXN?>c$U-Dq4i{b#XJgX>?OKw>;Q#CAU_{t)(FM
zhANtc^3`z@3(|Zgw?@dVp&)ynZ4k;=#0`b`sG?3Nhc6i<S=B6T?YyZ_Jfz&H!sCFd
zpB_a6QTYGC?p6IegYX|x9aDWykGs^&wT&KI)Z5eu=Tq%bBOpCKrN=%sLec|44yX^3
z>wx;G<Qk^OfO?oh7WwHF;Alp;+#!}X3gs;myRMe4y;8O|RJL9$TQ9Wlzf!heDBC~E
zjdH?+U8Cyo{DqfPmv;#VyM=xqlJYCJQi1oWJoIQe5{2Q41(PlB?!IjMAn*70y>nk^
z)jh%kokE{iX!4QC8G=EWx0)u8{btpht1dlyx%<+i^cPySPv~|dZJ}w1OwKVFgq+ws
zc}QsL2v^rl9)H(+dByJ^dFPSPy1l}_2Se)~6pr=@$NWM|fK0(7Ff81q6QOlGg!>;9
zdisQxeli6EFgLZTJ<5laHx;T}J_dE#6DqIrrb#h>;Y7>jOyL19t6K+E=U$ax^%sR=
zhk6&a-EQ?BYPH?!d#MR`sP~hL9thH{K14x!)Q8ElN8Lw3y4C&Uq6gk>R1YLQ?okbr
zEBYvVh#V3u<<&RM83kVW5FFLq%u?9$&YRAf#`c7)6{595uvWklwinz~D9xKyVQVhE
z9bYE2?-d^8gomgGk4R%{&0SOv36^alJ0OZ?+e~8$5I%t6O6TOh%ZG&fzaccc$PD;|
z+##5ejZ^mgb1TOVO)SM{8M3bs?JI7snE6?MN}u}YxBuSfo(<-H`^6Vu+$O+ZRw_)n
z=w0oi1ens>gzUyK7XZu)E1zBc{A$S_(k~J9O9cIrDU1E|@L0<W8^)E-ZhU^DfC<i0
zCtB(ReX2nbzQ7>TF2d8>hMDqvi#KN}-neVgrd8_83$kIqyvn#)t9wtYhW$OglI#X%
z&obU!t$wedRekq7_4~z2INqP91(a>RX<=fU?|R^T64mEFfAh_$0=n6@&VC)I_G{<d
zFzY$ZV+y~%J%t<)F!+)-pGVjR8MRe#TED?ZG>z!bZ;&I?Tn08fI{fQ>@vVhI@v=cq
z<NBI67S>p4q8kgNj~3GCk2Cs>*jQvHZwc;TW0Ai0CLiHP(O)WgVU~@B@ew22Sm2qo
zu`qAvX&*NH*zS(49UJyIY8@MQ?bzlZ3{gT62uD2R>G3-5-PEzG!y%ED*3=MIcg$Vm
zXx-lKSOEM8I}XR@-Hz>hw{CUp*yWIX)>J(#Spro~__lZKa<m<AMAIdVu+A~adj@!q
z@1&!>WA}zgh7`OzPAWmssL!b#KdS>cujo<u6%W_~%4E8xKV>WRr0O&_Q9mb=tA_J*
z`+ly9sOlH<91`%-w#eaNsLU<nYQq1z2l@ur4p&OW^2X4b`qjMy-L78mT3BL%Hc|qF
z`<_w=_FBmVl|O19vpsp&xx3<CJYhp1@9y2Op`)X{qa6sch95W%9E~B2C{2dcj3}MU
z=i2yl6+=iPI?jE_1r%%;lte}nUFqQOK~nrq0B0t@i|o4zFjO?d`%rJk33mdM<oD6L
z`v^QpAc0M0ro$%rP73r50xkd`lMnUsUF1AYpclYP^n@fVFp2@DG!=geq1I9GT(oWq
z259&y7@)?`jy2}?aH8_2N?|{s8reVyVbO)6;D&K5{ep9CsBoQFxK6OA8X$$N=Yo6C
zT_Jm|Xs;b<XRFnC@g?7f`wj>P9}Mm56!&!sYrjFJ%tdB!2+Q?))dpJma@uJv1jJeh
zc+-%+oS(Ate|`tGxRaXRc^J0fr7u!)B47N)_@BS*wXIgX(OTT*RKJ~<4g1?pV_TE%
z?ItzZmnq5K!tAS!?K$c{WVEW=E$Vj+N;uxJXaQx*9!-sG**lES;jdiwlrc(DK<ifq
zX^xoj<5H+vpp2^1)0^efdLU!g6jSI(cbuXwc~P7-bue}0bTs)A8PMNRDmu{X^uw5h
z=S<5WqjzikT7L>V3DogK8)GT-mL@OXN8)s7&H%QQk;~*vpthQ^fM>mIk>`v>Oc}_;
zzX?bVO@!<>OP^UewLCWH-!{Mbn1Vm(SKJ9*TUPEYf7TL3Q*uo#e#;TY@ufm=*-?6R
zEqvpYSiaJ4Nl$5&j}uu=naL>xOiD$+>hzjr3V){e6v~~JZaYV6R=<_!l4+EwG+yu?
zh**V{#-HIeb9TQK48ojmt7svUerPdef1BSLOhTt(?@;qx`PlL<nl)rzO2`7g75tFd
zzB$nQQ~D3Q?tl%YRQWUcLSK2J4E_v%rr+e(VB}%6{vwVl%G%ZDx7}vs70xyCz$wc1
z8`~8R3<T^3g^X?to`m1-xA_fR$wjps&6JfOCz-PB&+*$+>X+-!4iZ^t#?PP9#!AKM
z_DY4XIuQ`m?D9aK&zbPyO8s^qon`*KbX055o0WmQNAgY|mYxZ;(6=y=hJ0KF^3etb
zzD0@m{%qp!bB>qi$!m>PIv6PQ7tZo!R?PaQGWDBHX`v#2kw5>KlCSmW2Z<sz<L57u
zk1?gfUl1fF=!~DgFg4`q`}`UFUH$^TgJcu@1)S1vNd69HY*31QO^IYN`ZD~*@^+B*
zeu=+?FYql*iZLSxe@RMx3s@=i$)yOC`dX6G(D+N`ab$Ux%{J5e%VcvxnY=Az?^1Xd
zvUe%mO>RDTKy2pr5m`3+d%0TPD#Wiz8N1t4#%>LbT5f@FRV<BEUU9lHJxg7kz7>g7
z{3&x#+6@!?GT2&!FC_70IBSOpxBldfXFi@hb?t9Yee&va|MunuiFE?$kLei0WWn@L
ze%o;4ng7yo{l)Jz;I-57-@bF!5vLC`*S_{P_Pp`k?_c}DS!TWdyK~b&`RVqE7V-f6
zNuEA#iP(;<!(ivp8?@F$^dRoKdVAp{QZavw0HG|y+5H2KIPKoSm_sC~AQ5)G{0WMz
z>vMa(t{$Wg*G7H^;4RYz5+>>QE!so;3qv3FARZ9&L8w3E>2-fbyRkJlX!pdd4>NdQ
z#6T|@2OwgW#3DMQQXhpV2de<~fes3VZQj5!59j7?>9Dh0bd2l57APi3VFVAP*Uh*D
zk&I)o5KSA^-7=hofDS2~<7n5KVbw~9Y->ns7TX%u!*X7Ml@ZUGKN5D4e;*KTQKON)
z-2=RvH63^Y`w{Wy%82rWm+BkcA?jE6y85~}*V^G|Inr$pr4ZjkEN>3LDaC~HHSMpp
z6Frj;g%-Dpi(5}A*p_e)c7E!k?vvCbBsAjY_aZpsV92UPh%KuYZN{QI-nxJiizM7L
ze;kOa!I|FhnOSjpGhm;*h?;^G0W30U6iB1)Da6Od)Q3kzc{q97%n!kDxFXu+Q6ZCb
z+vOi3oVOVO+vS1>By-6&W+Te|*s<V4FAhC7G=5-G6{=Y!)~pH@t`-Yd#{;q!1Aphc
zh%b#?Feqr)M@&b%yq!|+ZjSd;Vf2zywqGtw+AmYz@&^GTYRKnA>|l?8QFsiz5H<)q
zkz!&S9nl?jyTG6F@=s8-`ze~9Mls{xfZO8Y*iIY#Ht@52-s50vMshm4hCIDoEWzk7
zHg>WPbqE4e5lbgNDX+T|W4iOO2YlKLa1@CX6yK|32M#7u26#F?H&{$yPx22?=2@Ks
z{k;&8LaBLI|IvuK6Fj8elQCx=C^fvN`*1Ap*yqj&0gRbcew*$8H>sXP*WkZJ;M<gG
z2IC@oqhC4EDfm(HH$_KDr^L~t)*!a2G+lHJa3>=M_UU(`2_kx$rdVawN5M7IQ{7R#
z!H9-D8Hs^7mEfgi4)uEwj|JxcmNHTwMhxO$McLY!QthSq+C!dxS8qfw)!fZ_2@y;p
zRHU;?#EUHXxaBV+;x_zyKLExk(JnrUaj*6$?}&I2wiTT(JzF|<JY=g8Z8d^z(fE?9
z*5)hL=8$!nXk9j<y?ux&t9^9y`E6&n1#8BagmUV|ocfTpL9{lEXs7IXqbJV?&IW=9
zCvqoke^(gFUnS<R3fWhS_SGZ$zho#17LGSf7$%p7@>|9HR>78PMl!+{P`H(bovJ9Q
z<8p;??|#93Qdm1ortD!DkT$lc?qL*;os7b<lTkQ!l8+fMLy=oJVhHCH0OXgQd-Q64
z?Unr6@wJmnLiuaO{Iw&daAw|Eosd}#6E3c}T3mOfxGq#&FBaDexv6GkW4Npe1POD|
z++dUogO{)(m~q8kE!eBan_pgoN4UE7MbC4dXOBLARB$w=n9<E)N7eIYJaP(0JHEJS
zP?XQVX;fIj2Q(PADnBZ8JX3O^<f*cYWrDpX#ehC!v4e+V-l}|BJ=Xq|;i4hfb|Gsl
z>!bV<6x6m=8O#~a8Ry2m<J`+d!n`IJG)cIy^qKMt<>NV_!g{d~JWLfrPWWDX^w*DG
z@`YNqiY;3uKa`A$=X}xpoO%4{<hqb!i|E)gx;fUmnO5qj`<3uv&#AH{6H6zZmktQ`
z>=yPO43*s{mfa^5q?(b<A6ba8W7se2Vf5S~Wh-^yy0!!?XJjl1?o!>$dVD|Y@%^mF
z_p=@c%us-Vst?=Ia7IH510!JS8q6(I^A?V8o;VS%m>({y371se)M?t3*=Qg@5WXtx
zpnFxI9W^DhgHb(5Pz5!?6BG7O{!%f2>8K`bEjVvEYYA#X*7>4!zQD{EQ+71H(u@Mc
zz?8L6C|Ww+1OPKJPkKsUn_yj*Vi^BLjkvJ<MX#{hA0IkBG@=RT6^vv~+49HqLUk+5
z<z~TlPsnzUXuAgmH&in)(i+aTpPzqr{+MRW^^E(1JGgPYEmYPZmNkU37mL}8L3*@g
zk5!F4I`U}PnsZ)%RzGHc(tOT5Y7SeAuUadvSSx~!@#=hmHZ|EO<(<mW`=n=>t&NwC
z3cKzTcHajmZoD7MV5r~$vEYG`%~Ov0aqmRO<cg4^Lv(ZqMX6?FOW1;sNNL`woGM#5
zzGc!dSukl3>)I}D36<R=mfbU&iCk?ZV;jfzj%^gJm6%cr8z$5fdqah*#KKjAJ=Kip
zr-`{0&YKr@EcpATi4%Xf=G8S*<rTr@PX#Up-s-+o{hOn29=)kn=57H)ltHbg*of)?
z=oN)!FL*%}wbo%ISnDtntaVh=x-b4>nuX-Jcx<PTy%^?&+Gp#YuaoQ{eWR#v6!eW>
zk<-RuR{!3H+8u?8KP+1Z_|DRdjwPyhR&8j3<8o65!IiCw&8t-JtyIGC-YVnWRoeHp
zxp$Xq-!Ia_=lyam`Bb$x!|_jr#(Nso|5VwkzNbztR4d^S>a>8}w8qAMgrL(R`k5aX
z`Ai9HKX5WR4#tF7RdMp8+OOgl`_;i@4oEC*$ZJCcRh5R1mWZ#Bi_8uxdld3*T|nF4
z2!YcK<dIzNcpm-?4g|};HV>fUns|~)7CA8i+tftKbutp78e|-_U_#he7FG`;gu$-`
ziNPH(CU5!t#sn!5<W!x!?wn2*Ryi}oAr%M<%F}f|TcXf@eKH@<Z{+ky7j2i2m6w;4
zFY+6LaiU-%9TEgikOk!>12N~2-vE9j`;(^!p~iSCB?&sl{n7|Js({rSh6t_OB_X<w
zEp3j??cS9R@1VQebI8+8J2N0>#HhnN@4ue<rjc-_YZqU?_S461TsZg1&)%TJ3~YmY
z{l&A_AOH3B-+lMm8_)mSn<G&KiXZ58dmSH7zW&M2UtcpldO8~Qjj`*$dVc!MD~S4U
zZ$6H68Gms*UxLE0{m$@~nXJb6rd5(?jPe>KX5gG`MSg&irEPM=lw2;SiSfwzJ@iIH
z3_Si3vg%_ZUDyM}tevbToj98z@y;m8NG9`zl$@^{!h;Cv^7(j%j<ZUD8<*goG0d4*
zXpDPCl30*n;~%ADbR??<-e^S2GKr`MhI|qqG971)e~}U)K>yxsd;k(g3LMW`KIRQ}
zge<k9rS_)6rp3BC7Z~pj6DpxI%uf=P@=flY=nECLi-qliJ=K5>mQyg6GgcJL4&_vd
zIaMPaBOO>c?B7s+8TQ(YM8XBd&zLTlp31tIC1h8pm=WDno^!l%{CFs@Ma*jvtf>aL
zbCz{P9k%7s5;Bj0k=7|o_Gsg|<)drI_>iSSv{Z~Q`K5Pa#l*Txs!+oQv0;Ny+b&qh
z0Hc_)6pbx?p=NyE_=A(XLKW-9iuEB&t7vJZHFI9rYCms0YaDC52yERUS{;Jb@dcLj
zo0T)0_fu-}&*yCSxqIaf-ZJ*x%&ZeJy+j>;YQwtrh3a<}8rzrZ-dU~$WFJ8{_Av2Z
z25f98x)ooFFl}o65GeF(gYjU=7JtfO0m`XzRLNKPRe<F_q!arciQ8vcMpC$CoU$+$
z^^TSXEKnJo3S5Vx*~$u$5*6r!ny1yNQ)&PEh^s~1jW~6p3?{cpybN3hr+Zm1pJ+J)
zXOvM{b+hG-#R&^^;zS4dGozqqCh=uJi&vA}dH-WE8E%v*bI$shX01;b;u6nl_O{5H
zHEuiFKpTwLJK6Fj+s2aIHZ$sPou&Soc>T3r6=wiN)jG?m6RkW=@F$ZOVVoQ2NkN@}
z5*Xr$lfiG`_29nP65|YKMv$K~dx*$vZA6}l5fc-1*hBn4pMzw(qXf%^4tDH|Q7y67
zT|50aD36Zm(I;<w_ssO0Kf3nAAKW<g_$R-3<&$sz2Fu$GLercXw>0%f277L40o^@t
z4E7W3@f-r|>Knw1<L<7(VcmV3x3%8YvGSJk0T#!1!gotu-^WozoCibTZtpQT4*U9g
z@nZ1gE$xu+(4yu1dgKDqWCoK^_HOqCEyz`a@O^_#fX7`F>ktIE;TY)YK}M~6+c)o6
z84c46Z`Uyog&#OZ@aQoF*|)j9W5>!Hf(`^=rGrsHod${Eq#A$#`JfAAExmWJ*TY2L
zwY>w!LFmcg+}$L+O++gkW5aPbkfWmHDb}h^BmYgj<6k2%N`Nhtv_?Yy1r6<m6!Qrm
z|15dvA$tRPZ&155AQySPgf%5dH;iDzzf5Tm_$~gu|Be=qQfW+Cr#iwq6J~L3Nmy?_
zV|v0gx;LaR7WKt~zW5`Z^;1QjHh1&@drW0nPxoBSD!Y<ZHg+<U<rK4=<MYI<x~o}B
zu4F9<Wi^Xg%~)nKu|~BEnPfgP+0JZzVyjTt5L^KunUHC*Xj&{V6E<6goOZ!X=B7qt
z&J7n;UM;G<QdB$MGPy!1stpx&h(#Tj+?RZp++xwzQC(E#a_rvteh@p{*!GqPG-e54
zBMAXc>{xTL8hk|AEEUXT?yOABf|*SCb``jpp+=!4Inc2KS4$UNDP1()GwBgZ7lleU
ziKUw^=U%S5oGX^@2wCqDt@jAb+^)RQ9j;QF14_z>?;}h0nG;W(7}Gxf=;=pKZJM%`
z0gu@qygOuT5N!=YW~w>W9?mNgGOI?KaqOsNq$Q{kG*#Xz^!@KwH@7t^-flFutyRCh
zMhW<bwM*I?74I|}+t;e!S)&A$35XD@n)W!K9m8Tpbo7AAuL!7Rl4I)RMNPgO@J*Z&
zJB-Bv4faa$<qqk^fBqB!4jfpd2_gFPYkjl?M}H}4LqsBg1)^Vhx=|KKJ$oFmyn)yI
z)hN@IK!z+<#vHYH!>>xe7lX8B+FEg{S>Is)DX)jzHETTWtZy>DVu~bdn!faU&LA(9
z+~rr!8q+xIo6OV$r1CT&GLW)(VL$iJ)LTyTaN|8h_ID7oPuih4hyp&)4?plC1{@%K
z)3I;|DB=$3e0YrO@i2xCe~ADS$fH#Z^DmBc;4lhpd8D&1G?DUS^iI!VpX2K9mRMR5
zeIIr$M7YO!8`zxM1iOiamni=K6EU6Ih|%Nq^haa!lp<r9{E2MDgK+Bj-;tfBaj8hG
za6g4JVx;|!2N~fgng)wSpBGC?Y#Nv5@Ly3h0w3ewyA~hGDaA*bW_;_J_EYUsI@@T~
z)0&X3RMeH?D6%#$Y+pv0KEwI*X!lY2Ou>bMVC7S#7fVO(p0X5<)xN-mEDJ@;LXcI>
zdExwdL_EwL)k4nNoQLg_DQ}c}x;>ORPt3%oAvzglVq&EO%oYYlG*g+m$)R)xOW0&R
zv*n2`n1aq9K6`k~7u@sW{^$0O9|n_Z{wi_)s!-l)F>iIapyV0-1${7YJm-~ymkK7F
z*jG5$i_Z0-f>yDhHCEi3@#a^SzqEYf?n}zh!ZvYXTc~h@Scuw`g-aaIY`U-s1pS=X
z3VvNMS$(M@)Yu_5c7#eciX|IwW@Z#-fe2lg^(iRPmd^<gP1^DWr20+PQ(G8wOg7h%
zAQYSH^5S!yY=%(IF+<b>5lsIr5zjIG8)y%Ze*<z?KqbpvHT$f_|5_%7ma=V-y-V4g
zM1`%+%IHQZ@iA8(xgRwMr~?{Vi8OPxM>CG9r?0ho);AhXD{le0%a3_GftYd`tI=Jj
zxBE4`MMjZISx<n#V!M_m=26hs=p&o)<8%<k(L>H1<xkMgu#LmfSEq4!ek(B!F#!=D
z5n3%61KjJtEX2Fn`A3?Cz?qc%CEhEWS}Z)&Hyoq6r8B`akC>t?Ip!r}VH5H1t8?c0
z49pM=Bjuk$Li`1QB(6Mv5$@q~85cB}|19z2bx0%1j}Ize)IO&T_D{G%j^(0b`Kc&B
zo_`t%IrY4PvP+ruNS2yZI)MAgV`__N4?&>?BqE4Ai>dSyUi0q~fVviN$UPCI*GoH1
zhQ3O(-mCPQ!2iI%_dftI>zOU5HqwN*@M&L2S0(De15;|ZD8sgr^W|sDg9YQOURn3j
zy2%xnx<U&#iwif0Y<G*cyGJr8PW97OAzitsE5~G@-K50PlZ<D#Jii4Ldf(rzcy+~<
zs?|c(>ZzR4u|uJp`C<-~HE0a$7<jyWq;=#WnmFe@y+<OM+*GK|>%z4QUzz{X{0ZHp
z?RUAa=L+lY5q9kkt=J>3*b}PVE7tBE)r{^uryI)(S!)Dq%}2{xgxa;goIj!b`GS`h
zj4znnDSsc<o6Z=XFbH|eVJ=mT7()8HMEzZY{;qJQWwvRH(J0<TE6yaB`)Epw{x~J%
zv4D{M4DMgVJX5BGlpQ1xCLm49-3l2|97JdN=fOzu>iAAlJsWA9!$+PTmEtl`Hr3o^
z8%CKq9l=y&0{hrR?$G#vv^1${1+*ak<4<04kcQ(iflS(>XW-+0GfBhLf)CUXb!8U1
z2xuVkJaDWBbP!M<GD)g8F^Lg9gH2-#sD+)T;o1%+hQOu}2MI+uV$6H&sU=Lr!M5A&
zZL+z7zM3Zdf7S~SljDA%VJ?9ec|X6Bk7WvRXa2Yu>=tMiQ35$z%n@>?mM|j1rM62m
z&2z9O%eve$tnP95yH5=AYlofb<t&nBo>)*bO+9Onl(bV7^4ej>8z+^&)4r~q<bIR+
zW+psFA38sDc4%x*aLJR8o_kaZlnmJ-FHz5j4@GI_9<Gj&CYab&)G8gMVZvB+zPB!V
zMyC#h3t)<Mj&7z+hwF6t5@&m2Jrg_DL#KDPI~Lqh*2%htrg7Fa&9KC~#y<Dyn`jf~
zkh+DRE4R}j92_s_acta&R3b_)xq*2L+UiR*Z4Nc<f<)7<*e$HseaZD!)#O9Jsd=*o
zjugXM@s`pls~7Fd*z&X-mh<=^ai%Dr2HX+2rC;*YlX|}BhpN*ByA}LH2#Hz|UM{U3
zUf7Z=hXY1*{75=rRD0Xu6Azn9m8?Kw5S+?xkW6qVDBjIa=Zv|Y%D<Q&_m&0;D*_E;
zcKDkK%s4Z6hP_Wv=?FVy3=sY=WFy=j%N`@lT!I}ZkJzrl%MJobTny&b=NgO(;{d_;
zQYvhD1CUm@zlRS`0J_K&-d6#n5kH-k{i7ynEKg|g4CS?pfcAFL-X6;85VJZ?VMTzv
zKnyXTwh&n$&fd^y7h~C)1Ax7eTX6p1*@HJ#N^?WFv6;|lspl`Z;2B!6TLf&}EjI4{
z6oiyL%J9AeWI3n|-}k_$T2)@B@^b}2>>sSRgCiQ^gMdHXFkS@^%5D&|8%A{CaVHlM
z+-~h+aJ!TJ=B~w;f6KT7X>u?rve24pEi^d+j3~odmNV`r+@tMd6^{>`9$=KM(VCI9
zBWuGYmB9@cw*nnF^7ytd*s{#d`~P0uYHFLOetVv=ZK3Y%dL`hDPljzU-bZ(ntR<&B
z3LE-ATZUMttjL^-Ry>d`u*OBhS0;y-eP&3L=`BhnGGJUKXziR<N^y=<)OV0dhLnm^
zx1Faijjtl$An+l9N&@o$@PU&c9Wn5R`Z-Ky%Kju&G-B*L)aUE$I*H9MUygE?;or+4
z!YM^qryptl=801$AV}2uRK~@Op#3S6V5=hkmTx|M>fxuGo*oMB4EmnkH@-7e-XNAY
zgo+o7#fvAJL&YsZPRmqg*7t`-ca9!^@<322A#I_|N-?uC$b~X%1x+pc_=ocvxQ0Q`
zpqoSlnNl!PBjWbT#1d$;!0@aSD4#TugD;>6!h7bA#75JK0L1Z%fO^)rnz^tWY(&)j
zHd&vmIc)-`09PjE>;#B!n!jn5;cqFMr1bnJIhM%jjxtOV+bzO2qQ6w~-EKvH9k>`Y
z%|(CgM1?kagURXrN^qSZe2`B1949K&0qrB&e!cWe$c-~%ka37+-s`Wt;eY@qiDx??
zHVJ)ij_c2kgV`WC*wWq*wI6f!4!OZ-__sGtBTU2fXHS1T`Tgl%jzLF{Br5LUq%)&n
zv=6U~A_>WHr6oU_jdX-JDH|Nn?GIErwr<|Gd5@!!r@^~DlCfdOHn`dTD`HAcj8UD2
zb0Na*VBB-|u9KB<!LZTkI0OYTZf>OmYtJL7DF06cm>B9ovOP$EmR`Jfk^O!G0RmkB
z5#=%I&?yCx))}_SM69Wq@l_~j1OB~)X-P}YO^rdjD!M3yP1~5b+=0svW6saJA5%R+
zEH~EM!4b_zS++Aro;WgA5CmJGTFj~z^l1zxPE56ivMFmmB*S)I)CJ2Xa-!m%tznCG
zB=CYgxbxY(=ks1Hd9LKyvggYtmRy;)RG7DPD!*u~@yTQ7j*XhX_+ly(1SzF<RRT=u
z%|h0SAO`?5;gX&q{Yp{4QkY?|9((~tfp!%!3No`#ZTA+S@g8f_w`D2b&N8;OsNXKg
zZCj##dx;iy*@R9X0-F-n!ZLH~MH9S?MuHD0A@PzdjYEj^&><uuNr2GVaW8aZ{^paP
z{A&8GA34@IK7Rd0D3qFh?S+rux(H#B8|PoeTa0&7V94ewCiUT%KJ(3MKbpW`|9J9y
z81ElX{y<7lN(T}qpS=DehIu4Q9&bBlXc`ZZ>`o}<+}+vMy1S#Zy<=nR-mQC_N;c4v
zCv2wFhl<ED<rg3((IdTes6Z5XvCRus3N<YsuGkW?Z53@>h0Ga7vz5)gvN@LK4Vq;>
zqp=Ugn}D%jLh)vL!jfO%OCsm^NiZqpNIR#Jg-9WD{Y-<-!N2rl9kLAehiQ%pG{g?!
zlWr$(!^3P_5I{>t<!jI-)8D>0{rZm_HH&Mgft8Dau_Gwx&^M6^|0w~6IMTOF%CIP1
zN%W=+K3=MI3@3~jkv`|)nLN!RwCo0IT{@s~N->>jKHYL=^%JYdG*5R2tAmTiH-yR-
zi)D)^s^6-dbpNLI&Dv0AhnU$RXgX%LFAZ4MzI$MiD>em@OzBt2g|fitq0rG^LSDhI
z=9Dj|PylFMVy(6l!9RKSS0DfG>A2dd=<s86E(Y!N=r5AT`6na)AO(m{((L@sCvQAG
z{mO5yzxK-XZy!U0Vi-bF{RD{fodZX)>7-U+EejI8>nOC0^3>FI<jcgFs7?7CYBuUp
znhB+O&>YnwDm5_Qh!C476dlGx<La|Vo5%8kxgmXxsINKII;F{YY|E%}tX<H|3u)$w
znt8B<Gfk&9No}h_wAhcP+;8FkvzL&dG#L;U(4zv&Oery*=D-(7EHRzPpf-u7G8?Xu
zkp^Fg$D@8B5k}A~9s~h5sXzT1PRHrxJ&vzN4;Gv}lp$@X48N9d#!0^=V2&lXL##a@
zGl5ke3?Z!YGvrI=j01g~a_R)A4W0c?;1$%y(I4=Nl7Q?KH)rzekk^d3z$ml<-6J|+
z6zrLTQJ9BzAjxabyzt4n@oOWmId-+RZg5EQdKjzp;S+Vh!v*Rerqe3{%*$_1zj;QQ
zUZr{Y+P7Z$__yEtc=FWs@4kvbOcQ|G)sI6;y#u6#f*bCPq7{67Jh?gtUr*^t*agYB
zk$9V9h<Dt*19SxD;2k@*!>67c9&Qa^4;q7nfWVWYz_aS%p+HqcIkcUhhjAA%#50ii
zTZA9nQr6#6)z=QwvLay}Or(y9)6pE0KsvNZNC)w(lJE_^gl~k%_X+{RH<%n=L^;6F
z9trc9xx@Xh6p+9U`qJ(LkQRxL%-N%x1ydPB5Tt!<ZrGADV!Ej^X_qB!O{>Dy&heJu
zgS6vZN*m6lwBMW^u$?A2=68UAWao|6j#YqNW~gBRQgOgVlw+&LRUzv_(YjEuHjeW#
z-(|pNtkt5mTCmoQS3s)W0_i}Nxn^`HdqkxGg37UjV+Vt+1Vh#ZqIH2_U66RUe++-I
zWU9ZonTfn(LfuL&SavbMkeKEPn~>EE6Vfjg^-F~rCWgE$W5|p3)K-SPoNg;^t5v*R
zYusQ}zula@AyfT_OfBp(c2|5Ypjq>~T4+-TbvSuP$kx!5uPKPIGk@4|z(29SoI!bI
zRAf#A$tA6yB+^u5m+d1IX~e7{orYO!Bkf=OYQ$1Q|0v>tfs`~qB}xNb4YE@33#1t?
zS?1~qZ8AG-M0*JGO^@kGAmC?6Xf~R7Ea%gAaZmu{%p9VPFGPPK&ck&=;3z7>E1g7T
z(!1Br{T3Syw$??ZdOvyU4WM$;9K#m6pVZXWuo%<d9>4J|Y+imcJ^Hihk*6RpCCxt5
zqu>AJ*T2P5+Hm941!(r1KK&a&OfE7Ul-4&!hkFo~=t;-g*$Kb$YQB;;8`)PL4yPO!
zMyYi;=1Dt|C@GTv3GB)AI_YF%d6MXF5^*=K1?UhuD!S$hSvw^&w)4_M|9JfE<G(-o
z&Pn);Jap#x6UQGvd72!OVQa25tyz)4o`|xRUk=Om8~=gdj8<tv(LQSf_>nSBcP*T~
zWgbr%>QNeO5z%1zY-9sWm<9;255h~OsV`%YcOUYch@x+&B$6JZ$CjmUf*5`KA!>mJ
zr1OO|84B6WFypPGjptXNT^-B_*=t0ctYW^&khQ@^aL*))3X?74i9ksQ`8alvl5e8I
zW<-pMSw51PG+HCNs3W2p;v-5Izn;oMODo|?j`dO{{!Dcwz|mU)mM_41V_oq=W$>s_
z4ZVe-isfR(@~ahVuT-p^^oA-nh!q>qRiUh%V%APMdD0iw8Ap0fJ#y+1Cek!zFpV4(
z%%x*XLWVNYP<E;<Y{oV&LyKcd0HD5QnnqP45MIL3wbAC$X1LF+d}8G&$Tr1dW-)CX
zOTxK%quw#qsQ27HsLQitC%4lCxkA~^BA}&Nv@~O8HJ60*i${H<KG5u}BTFR|j=rDR
zFHYi70HKMEnPBX#>?!{~u$N1yX3>DKgEpJ_n<LH~DsxCkH_cg+M1FH9$4P@2#^V7o
zgbEN&iwPCyRT2awAXUj5DP2Nc`^>W*vXGjY@1rCmEl55(&Tt4D1Z*9QQK<tk#S+@+
z`ZM67G01)pT(!jPr0~+8A{iiSZ-Y$8)!<JNN%rO?<*DK_nHqGQKtYMjOrKnqUk^mp
z^0b!9$64X8Bb(DU^m~*6r#`T0mS*H@Pk-yiQ=`{{&)#_HH0I$!H{Z9WhO_`ft#5yg
zzeW;Hq79&tzN9F5X~DozVkFf$`n)|(yo;XlU<X8?_yDr8M3DNspML!M52WQGx;Y|k
z2iLxL7CWJMg6tHDbY4VSI$~!=l2?}-Nh=UyZXaHLr>8|2I(alf&59_GGOW_6-ne~;
zWai^Lx;P0<5;3U8yNyFtfY3IKR=WPH-`zO>tLbn5!^dy@I7)%I@K`)D?b)O@8=@YE
zTIXv|JkPAsVHu|E83_$JC_&cdXs7G1ybw<Ty&(07<GvvpxeovvpML9y(~o~&@}}ak
z)p8Hyad#sC{{aD_DkL3H$%++2I=;daS)L)PY~G8VPjQhi?I$76iw@_%L2iZy69ybn
z9qr;f@VPUjIHK)!b-8=f>wGgqe|Gm#9F*^5=@2%24FBH80ipyry&}KpYF^EiyqZv+
zQ_OP;)>Lx}Cvx-8Z#}#9$?fO13t1H@29vHW=X}xGqOiX0((cRiFKq?&E_)YI?*K6e
znr;VAwSQzZpQ(MKc62{Zh8QbEV}+neV;J>Lscj5f77LceVS{<Zbvpl4+Z3kxC8t-6
ztQ%8>bj6~s_-Su&MR47ODpcMimN#9|H3_;V;Q6CnLeYA`vR=@y4_DTVue?&ZRH$4!
z(j{h<3t8opOWs^}>aMBm`N8h-mQZ$+nB63pQq8H3sm#35p|PG&X0@1!v!*KT5hcXJ
zf_GmjsTWG>NA;uniA^~DBIV`@YK0;X%%$Vflc2>T=sl>)X!hu?k=24Gf9Ag4j9xy2
z|IbEDiA5p7<or_ia>OU!xpbtZN+`^w{VY{viWG=?^OC3K#Pm()HB$Ao5LYR^6vG^g
zl^!=4%$|pSW*#yDExjB|hkDZFsa}&RddehA676P`P4*f;=nIgxz#^WY-6by$_hY9J
z$PAdEvkdgW)Ptjt{fMWWB>NHfOC$S{=`Eb4bu;~D2(hX-^UGOs=@0C5zFZ9nosa&K
zRh{D4B<>xN(`%CJDsR_dW-N{5r@UA1L<?GgZo>LHS}u#T9m72sd?uHTTS)8y>z8X4
zzcEN(;*1}c!{IE}oCp#$mhnZt(nM6;kYP_CJV)ZaBX2?6?=f4RdAH3o+n=41XSOU)
zYpgUWd0GrWCBK&Tw)zdUP4!!%dg*q|GH#(CPNq*S<?a$ngDWH`3uTd)n}sTx5h_Kc
zFbg%?H!?rgA_~Qk_!l4_uSarXVFLCqH+qt_v85{eP5y=gIbTof%e1@YK<X<){@n(0
z{W_q_+VtAj=x!eQ95PF|($sK)Jii?^C`+b!a3$34{yc(#d|zX%4bh`Z680lSF?+B$
zW=nqhbN%`9GI8Z{_flxJgO<3G<XAB~kaA!-2?`OrcW=h5f;l*o<nLzAySSk!J|<8X
zE!r;KI4!0+%0i~lgy=oTLizJqdlV+?Mg!_UPhO`$(U%)%v(6Y5&}@h;4)pFB{Ds^+
zzZQ4=q-<1@$00Unv&}tKNFf6n;!^l8^4MR`DCU%bVt)}=Ep6B^chhN5eUOmh89%Ou
zTkx_orS(dD>k<J$#VbJ@*k@m@1I1smwTt;Ye{p*51MW&n(F=)<pFL1IYr8J=L(?Ny
zH+Q@GOZoCyQ&@x)GPwG=Q}}v%rvGoi4OyRPTW~{sfimBQgb&x?FH6S_`I0R>+bF~>
zTYmdot8V%){L5opOv7f`BW2*;C<AyVxHq$`XG`#<>F|vd`HQ)xi#YY`qn&H?_j0p*
z9%ece*T>#QmCnoCaVfPUx6Id(2qj;Y(n+z*Qnn1)+?1j%G8J!Tw^^||GaZVux;tBj
zNbV9^5#u*yGJ*iOt`Kcu*7mmRznUQF0iq*ZfAMG2XPyLefBM@m;2xmu(kY~BB*6}t
z4jU!4gY`H`%2cJ_%3>^ToN0Jy$ist!Wr99JriPHIF{2fNzZ)}pgu>BwwiA~$dfeR4
zRV+F`f&h|c#7I84PMy-$*9*Ob(3{x#&=79@;cF2eH#aI9p{kG{a!1rBar#L$(C<+w
z)@Lxf!tkCb<zmB*)~!%(-?3o#-fauwV!F<{#ZE`-ZU^X`-0X6>5{o`bk3QoN4{wYn
z-RtS|M5WIXX;7S4VOfBfknfDdB6+cJtWtC@soM=LjYAb^0g^KM<~WG<H=cX?`agUd
zR0~pc$@GIvzxHbodmKYX1OxE`uMoyDL?|wtxI|3qTE{JALqyqmOL_kdVys0}$GdK2
zNJ0p=3P^>Wr`tu>nl=n{``o@o(9z*`^|^=uy?OiYj$L~olDuaJ@%<8)n>iMcL^JE&
zI}n6sjZNp6LB8_zxtYqkgm|>n9Le(0b&jDyI>$z`(oV;|)~$Oxb~_eSJq-S7Rh^?M
zDmlTdENRA4O*o0wDg})9a*~tEAvxn^A!iNU28Bz%YA6G#NaVeJ$Gr=j(T5YVx_i-p
z(zqX`rj&GVG8KH1m0dz5S=qsDLp&2{#PsaFr@eJg2W!n#Z7aJw_K>K)bW_xtxNTu$
z9Zm+tZn#>Lur926n6d+@P2%TDls6JK$2||Y>wsQLWo@ET|0{v@1U?49)m?{&`j2{t
zw<nb-A&yREkuFDAQ^O7PyU{Exe6(;?4@<G-c}p4dhcI$jLk;gpN;_R`laoxcqhcfu
zm#$V4lbDc);T%%uh_jnLxUn_PeI9N}$})X**y;V6<kYF$QqPhOS4hPXR>%Jj0@TZV
z7gfjwKo`kUc9OPB6Lpa^=S4MMIxAC^UD_x<tsVSJ1n4xABn3{CJBf@)LQ{+##(zd{
z8GVr!hlqyeq)2Ac<ibQ-;Xg#0YzQ_(J)`>slb&L7D6D@YngI;v6qzAhz=r!h+z}fl
zSs#?UcCv4SMlSz3WoGN74_vAq?#DgZ-!1X&iHt8@g?2mbmDDLxdoi5@QlnAQs)3{Y
zHflXJh}V%!X&PrUT_jVQ@K_c3!z>K6i{e^0PakW4>EdH1BE~dfLPjTI@VX8~_1zk9
z()OsN`c`=;qK9?|DEGuIbF8n-(aK1AI3?YxdTH2p_DgaG<tQF#>~sAjk)P~DSI0EZ
z@{gjpr}6LoF=%>GX@r=@%5U7E#!749dGlHGSWl1-S!+dWEeMS{rA+<g!f}5nXSJBK
z8d@GLB%EkiC0*upTv)JND8p?|D@FTC!L$-0@x>L-)Lp21s{UfVkh37gj2NOC30Fj;
zk7o&GEg}1I(Y{<TEuYTGA2Sdcc*KCyx;d4}_rEC(Os(8);Y8(>W6^l`MAM{payaC;
zTXftl6s4NSw~Vxnszx_JN-`zEPf@omL|jhsr#jzR0lr#D64{(3i;pZedey09ZH5NF
zv|A|KOlJQBg8jje{Xx<GpkR71O_LoZ0=eOK5KUH8`e9Y`#BO0F^hxdyRUHtk4hUtb
zCRB7#EIN3#=o?pxz7Z<w5{tU779GA)bU0LWL@YWovV~exo)@*|QP!Gr|2rwwUlS(U
zn&~qAC^JteY8En^Lz&Ic%>g}$_8e%r%C8Q3$2&s#OT_#oIDuhaJ2#l<4wsZabN7Y2
zg_^)kg`!o(u0PwN+Cy40*Q@rD;>^;0q&O20Uir6!xD?NxCs-T6TxbeD^!&2tS4qPE
zW14tI0|Gycqyo})Y`pR=mdPfT3A>Li|8_8%$(k3sp<T=Ma<y2yI#j(ztX?ygDHN>1
z$(7`4<K&8YEl#c^`_0`bU;ZuYr!+Z0FKf=ICuAuPF1%t{Bv=+r<rkkD7V6r=<s05T
zBJA87+PF{LxGz+`PdMNXmAgMY%nRN}LWds}4?h|ze-y2>LA8sT$FYlU-P^0`q)zyT
z%0qs8RY$1J=s_WH+n`!mc@zN{R4Im4kCIoxdR)9m5R(BQUfb5Ip(!*w?_AN7CFe>+
z+dLe=m0wb+G&It%ogLs)gEr2nfU8ijIK_-?rf(=II(<NmG#e%P&7H%Se;fT+QgfJw
zQkIkBPACMmtrBgkpe{JK3>tfbbyss*uH>{#swa1ca$3cl)~h+2ujFjLTm|X+P|hAP
zXAkKEE*e`h);hN2+}%Mt6vqWmhH@6;N>8)xM-}I4&exr-gR1Y7q3lL6yAcOl%*#dd
zaw>TFWNX-DK6BR-ca3finaV^{8Kmi`NpQG12B=BOsY#Oj5^oc>Xth#9ePl0&n6Xo+
zSTgPnl{JZFO(A>JL^tjud~3rc?QiaW^X`y+<7IouzV-6SkbOV2p61LCdW6O;p`5K^
z&ek+5Q>Fo;dvgKYOq!j0zV>V_&ZXHNP<@nNI<B4EEbMszYH}wIhs%~<+6)a9wjFfr
z4DeH()_xBrO@a{OGv6V!D(rcbN!WTaTv#!_SFkq0K*rEcGKO{%FErl{*k#rDlxp?)
zoK>5<;&<?t^^z=CDN>1|uyn*6&deFhxRO~G$}GF7vYES;;e5x{{F*EIHRHNTgOFbn
z%5M|%+eS50)ifaYTv~d$I#j(=tllX&Qq8D&y0{i9v9+P%WnwYp67{w<bA!psaO-xV
zeD7G`YWd<T<%=f@CL2TLYsB(30?eMhxPP^%^qJZVwc&!p;mU;*%Y=fJFlh4P)oAkK
z)oAkE+W{!*c0l$gcTKo#-ZMuo90`~7g)3?&_6jAdV31b%8l+W@qN)mS2h6f6eM&X_
z{PxwHyAkGo%eqgND+>>m%GrvXQd$tYF@_V6>1ZYyP%Obk(5<*sv@R8_OQ+;Lqq0$~
z+e36vtOIrmd-e+lzai{)K|G+in{W<5%m%r42-T_CeaZ@ew!g!|+)07&Bn)fP^qJz7
z^t-90CWRf!ldU<DQs%r8eD+b3S9#N{Bi+jcvLxNh79Htc2Kbx+X#s`q<?LB>FE<Bq
z)hWsEy>R5&-sgKIdt7AqE9zb*v5@bzmfq`B{NC9J_;&Gpz&|KTH#DgKP?}Bl2IGbm
zx<9N?lYO<4>}x3eJH>ef8(R$<P3m`7QqVt|j2rWGf6Swxe=Jmzy{Llht6P_D)~GKp
zp+N6xjGMD`?`2V-_iReCXSWu?@&2NEz&{n|ZB?uP)JQ=;P#d?Jbsv~1=m%CM*=?<B
z;rO#9Z+oNq&+|=WZ`5pGs{8X&3iRjYO0utLrJ@OzR_)Gebts3D3RN3-F4lz>Q>ajr
zlI+bC`--wvyH~6D=Zx0kJxywHUN#(JlX1@)ow!B~`-ci8>>nzbU86*d54Fa7)#?u|
z3-+y5f7nvKZ-Mq-^0Hz7mj%XsOAP<AL{0XkO0q9w_7z&h`j@p@#JZ}c*1hU99#E>U
zHnpnvuU3bbDd7mO)&j~Tr->5BBtl-rH6t-G!4!!QWqJ`nQ2$f-Hjo6-LYji4v7^5u
zap`7KR-H-}hBN_PZW8@L!Z}4Wj>$`8#7~XPuB8HJKhpBe6LBG+=Up&s$qcC_>sCR+
z1b=cK5Gelf6iM|mcx=W5?;V1ENnCw)_me)Mewxdi!7GZV#Uwin0V8fcGk6!yQc9CQ
zGyM&CcUachG<@K0x7)Ox$#3HKb2jK9F{R3u2h4sme>d(vv&DK5JV{6g_>*c5S&|&^
zkuVZu2L|J{2d9+I!z6Jw*m;<&WO)(DC}gGM0D+^D5y*NZ3mg^pOmI|E%9O|1x%}i(
zp~wHa5*2*e5<$mGS~(W3@OGn@#9L>HOZUtrwKZx5ao>chCvZ}e+IiMgO1_p<O8<&_
zl%W=&Ur9gNePSj#w>`PGTsiL6o1?zB|Ayl_a^kHtlV6V<vtlI+;D$&3KX8L%T+Sx;
zhMt^5URM6UbMx@kSc2B%P%%4KArC#{+p@~qAw@=jt31l)S^l*zH;2k3Us5Crl1EFx
z_Vu)$k0fcMzl1DIFfRQPdq+>)muTgx5;H0{AMWae8?Ks!OMb6oAbXaaa+7n2+5IUu
z*zq~OWSO13*}`G2`bUg_cV`^|3*>#uPs~!PwDq4QY<{dX$<JBB(s}P0zhv1MdHLin
z&N)k}MKh9whd)JbN<N>?+8^m9a=vnZ%(7b6LfvXoPX3fxgj<N214wB?iidH}<!jLP
zfP4+AqZyxDlzeyK9dOTQ!G>hAI$83v%)~}w>m0b}DeIiGerN+aLt?Q`j|6W#^*rN}
zUz_~)C!^nq-6<%!a0y}3yLRciLBx?FOPnUgN8gDQZ&`@hfK!?=zIpWK29iBwT&i2d
zjbO@!9Q^~NtP~1SBoTVzrt`Z9>;{PP&h5#ZTQJdy>nA(sM5rPOMtxQb5Iy~6m1|*o
z#gMF%2`9O1F}+L5h(Wq!4JD4A=ZYx1XP)M&rb=<pUg*Q+Vo+4t>*muP>dM5b;+=<b
zK;=^DX331ZCU?GhAM9hUi$~+WOvsu)i=d<oo6-f(6L;tJvg_g0(33Q5r+W*fcX0;c
zEd!ckQ4jALJRH%o$8autqy`*rYVX+E0aoqCT|2hPxZlw>jB*gA&VpzFaS?~>QzPLz
zM~}~g8#*LzCS#c+FnfaQ$T*qH(ng|-<$4)oewN6?&eV9ZaS@BaIKr%4FD0=>({W;{
z7Tp*~zBPC4>Hvd!_nrlDuSJcJk&yAA<6#oa=tVJRGz*)=%uOVi<cZMW@RI078YZur
zche9iEhrNEx)ZkaBbL^S=!ngr5&H@bz+-gkqN9_k27@?>k4A}d@GFnX8XA@K{b5w*
ztdz_c^vJ<Bx-;%0jmU#2><taVN(zh?QY{FL;lBfLOW)w(i1XS2MV5GY*{z{C4H)M*
zN3x<UN@?6eXomVha>TgI(JK{6iB00V#Kc7_JmW1hcI+=H$b$qJANLWmF~%%oL{pox
z<A{7K*+>URD%Uu}<E3&&aOoqI*1Msh%)_$}Oy}x?&Ja>f-zl+@J0p5hN5Nj=N=0Z{
z@G`zJV{$v~vtND4`0OrLGJuF0_2ubgBjXwKJlPHbM2zuyM!K<(r{YJnP=14)j+5O0
z!IfUd0cNVS(y(=txVci3#^xgar%2%6@$Ws2mP+B~ZXj-M^m4%y<JlowooK6zU*@+u
z&X-*wl&uWeSBbdD%d~1*&Zk&lAY$|F;Y8&}g(d7}&POM5CXP*Hg$mb+h3f=+s=*C;
z_Iyy=%o~)9RTFFx>edSttrC6qrXhV+pRyu+eg_3fQ&^({=O`aKS2MB!jL&)X<HYh+
zziGI%GUV7UI<^Z%sV2ts4cl|6q}@_Ug}T+3?Lx&iGWWZL{H{=bmzdvmGxvW%k&6^y
z8ZNy6g+I$C3ob1amfsyJ-Xa!n5pq+_$VPC|tx$EXGp`A=r3cjI(#@gL&0^{1QDfK+
z+Nu`xYn3K<%~aWf@xqBs;ib!8J#cAQaPEQu5wv^{5kUb_*}^XaznCs2{j<5CHpjqJ
z!91a26{eVqRWPA~)nWlIWlc3in*_5acMU!DYFr4I=Li-<Pj>#L%6FW?@~xq~ZDQUw
z!J6L0?hu%9rQesi$`3cqNo)|IbeFLAfN-Bn*wYot?iRDV1ydRm<;)1BP!4skaNvIN
zK$oziJCx0d*_>cXW8x9^3i~?+7bm)o2=^WhW%r8Ny@Dx?iAUIky99UMd$~T8eL&1U
zAehn^(kRH7I5$-aTR??dnl6_9a`!~u&+mKrzDrH-tdN?Hcse`KxdcH`Hs2xKrc52u
zf7SQ*)xKI5i^j)n(f278xdrF8frm(1uuO*eV}(}>7hNe_G=4Z#*di8Ubigyr7QUe2
zMay%R33bTPEIOL8^o4R(ia9GsI_N5>rH>Dv9v<8I1nyu=VJ|3cD=@U@0F#wd)lCx{
zLe<N~>g9qX)!-UVwJbVVlC~B2*yc!b?hNnXEo-xxIZT(7UA*g=trxap3h0=e_v)s}
zLzmo_Ti-b>+_P8McdvNQ{!qyQvE;z0ValF+uI2pNvulISkiAZ{g9V_pIj3^+&TSs^
zgmM;$Oj_rQu$d{?pFg(ZYH`Dr;)V%hsCboF3}s{*!~Cg&qKi7Zxa);o&)@rE=X0HZ
zzw6a|U+esJ=ezquOSg+lw}<BM5a;g@cJ7~=U-SIESLZLiGJolWCp3S(IDb9nq{23u
zlK@9HPg`uKkDqzuiARvRWr1i}fZ~|vPg%3i8OEF;Yn5oN60BA1%E{n;lN&$WcL402
z&_0*A&m|P$sAX5k(k)uL1%3Ay(=<|4+C>R4r6=~q{|X+){|>C+dy96iQ~V|m;P;kg
zn^&se)@H;0c0sEejz1KW;}7-qu)kAU-o8fl&T1vu*BCo0weRY(JIb{07HZ-1Zkd*R
zDk;{xHDwz!RDaY`$UkNnH`ZzYXwBYOqy1wAh5TcUmVD~kR>Se$0?OdMmBza@y7x6|
z*x%PF$*ym8!ttlZysd@m4|EjhgF@rhO5F#Q6zGF$CE05_^5F=rGw#k;Uoo_*cW0~r
z*`$QypR=`qGOhqo<r!BX0xTq<|EX6I&=A$XS4sDVC3I*7GH{kcIg2Kf8JC2R25E2!
zk|_U)qw}1W%She*f=iH0SI5auIn6KS%1oT-3=)<(<A;kH4SqT`no2Q@U!90cBn{va
z%vLgEYRN!(zk>@J{f6Y*&Tv6x60IC(Nc6Y{GM-}^E<wC>j7z}IfBG}QC5Xqt8M8Qz
z0eYj%vvLXUq^!mxB*o2sIG3aeWcjmZp**M1Bl#B?hafBcIZQ5vzB7Z?X^~NDQYcHD
z{U|FDKYQQge6_xjouo`T*9B^5yzOzqlQuHZ-;p>yH<;9yvA3X%S^X9+H$kc7^5D)-
zxZx^DxKiktw*EI}ZSz7oorr(r%am%Cut_wpL=9#Mn{;k1DeQuTU0y!9iz}KX)$|nF
z6q;BHb<x&8`&cOcien*t565Z2iCPk+T3)v~W{r}sSek}JemLV>DxbA*J`tyKgK4R~
za++koo^Fns<8<O}XNfq^B>r`z;hAWIi2<Id2wiy_rzO+;B5%dyc@l5S0y(qHayYk^
zNXMTen>+0CG@)TDi4L473eN6fo1LKlra$YM%F*HGUDR?}FI(ij!Dz=T6KR8gxjm5U
zTa)nND*U;i9akowA(Z!1+LKr5=XkBJHIcGES6+{qqYboURUr3~T+oi$Gr=QuRt;T2
zN^w;ru_IXDyZ+W&4L6>9?D~r%IOG$(rYfp7hAE7pyMU9f2F58LqPZ+<j;e_vU15)Z
zAJ-x}+Ij~_B@87fDHAjjHDo&Y_aDD?#u1}IIX*dkQPPfi{U4ryjuhkx;;7dlY0``p
z>igF&yn5r}uRnR?DThS6B0VW*Ub_CRw?28}%(Y)WFWtg8edfo|6T`^R+fxYI{NJF%
z84;V0)3Et(lHU)}2&wdH{;#9<@!v<nX$XDnxC68u9-EW=ygiA~SI{CbGxpHLPT0n5
zk`pjN=;O~Iw_$Uai<1tvvC{`1Qmy24KYo;|`y>U<p^`x1H16df>OCtG7xnG)cyaw#
zk7J<UK_?p`D!z;V2E{yvBqLgvx7*`^+Ac;c93?Le9WP?!(ulfiS@W<dQOy{!a9$)s
z8Y2;Q7Ku)Lc%@S+cR)W(p%5~vVHz?a|062oj|rS7Fh<~q1o{Zj(U*v^XUOgKva?@2
zE4u*&cK5SeEFl}5Or|7;ghV#XOG`F<0f|P`oqax@U7a8&Ao3R|OF02CqB=ClUnGB`
z6Y@_Jc$fjo>2Jx_3!9gg9QsaX{-T7#MDxZ8hcuI|qG9uoKn9~Kcrp~)DnU~@(}ZIO
zM5@06MKMM4Io|*&#<>85V80epqHbm;pHjx3&zXB_*+3<V5)WgiMTm5`JmlCaI<^W$
zspiX(4lQ3x5v_{s+;gS48X#CP(iXPZ&IFzaK+&e9TC_kjkkQ<s46_*_*!JS4=QfS+
zes<gQ+b|u33R=X1mQn4L9h!umTzPI~P<eLk=-R2`@{22j$0sa8_4-h8t61E6v+(OE
z=3j~wm5V`vsc04}nuU^71G2*%6DURvVVnJY>Dkh;;gGFXwBbf`4Qd%r;FsAi=f6_^
zQu$liZ|485{PptxS`b>XOI(3l_I8U-oLjkn%DM36{Hx9tSDY&*D?-jSqH_&s4yEfr
zawuIlY8a(MMFl12hKV@cCRA()<+qFZ?Kf+_mUdX603{`rzCy*PlM5+1F8o?@tiw@+
zQBN=@WUCf!7!pdeV|-pXzu^3_v&Wu1aqfh4TP!|HykG!iDl@*5m^1Mr#U_!OqLGr`
zEs_=cD|~fd>Jz2FtR%8rr4M<r!fI!<qwb4+LK!sLhAc}&%aVyk(Xv#q&}~1s$I)V!
z1Y?Pa8qO)0!r?N_lbg?N4%-W_+AFWvD}%Uv#wpsJSM7_h*cVUa;|zdkUx9lTNphBe
z36irn%^B8m+_-4PnF9d4FqD7s7u>iACc=Lb&FN(<1V3D~JzMd6Wgfx&Wm^sEx6RqG
zzwKyM!|{hoa{OUg>wGxgEhfji^&6VtcyAs#-fM1#{rv@Ge}9z~_CICjZmHA$$zdXU
zoo35o!=DyYN`GonlD(PPTPXYo2IE${?gP7;?0HJE=eMqe<ImZ~9kuE|m$a&P%vb+Y
zxe|_lny&?v5s_&5r2o%e1^BWG@a0Ht^2Q)NnMsaJLrpohF-$ox>1l+DUS=o#kPzWy
zcJO9l*E2h=1&2MR%Mq8T0aea~)<n~AWji~iDq&TGvq)E#5qHr6=>f;K&D%N{gB2R~
zrch1({~+*x68H#USW|zZub2P7$o=2Qt;W^f@WkEL!`k|juD)J4P9j7TUgA>Kf1!X^
z34{s!Zv-L)i1>)0-eWxxt)~xq2XH$08ol_0z;yyQq#%9GE(CPBx`C$+ah?I-Y5$#G
z|K9}u9|Hd`1!Q-S_eHeFJe+#~5eB(K5$%BQu$z~u`Tuu{@EHJj!}pV&At_(LCe!lI
z4-oD`z(Xj=qj(Pu^hVR^nybd5E5@R+=8(}L8XZBKXso<ybY3w!L&k-oap9>A(4{J5
z9TIe8!j{~TW6Wcdpd%Bu<c%C>9_s`hnS@7+pd%CW7&-LKz^Q<gKxX!cgd59-BhduE
zh5ygqK@laICeu%)>Q(e911e>T4(C+Ob&SfWiOV9-ek&j-m}#}&C*o>wb0GfYdq~I@
z$3tLu9=p3Q?w4kdt%1r@rb9aU^MJ<tq+KI)^Q6^_e<ynKaH+IBrL?;9?<ggiZhMpo
zDof?`9PIY>ca)MITKYA99j}7kK303yhnc+@eY$`_30=2-gM2DDLK5!mhdfLHBSIi9
z^k!icB;;fRnf=)_WRSIxyVVCW4=DOI#}y~k2NcI~S+rjlj8jNsDbtfP%cm?zYiC`=
zL^2~)N5JGulIY_s>;@sL-;|C5fW5mWV0y$v{Vds%cJH>KzeUD$e-MdQx%){!Kcr{+
z4|!<weBm+N3PcyJy!oSRKl}j{cYN~Judp$9_jS2B(lF5=-PW44EstFxggfdM^bJ5T
z0kTwexSPns4!%paqwbTAYhyparrhbcHu7V~b|_^)s@E>QB;^1FE!dGyKk<|4zdLjN
zTy)dVw&S?<!Z_4F=<<4TVG9?%$nauRbBUB4O{;YdD8LvTfKJuUA-*?}X<Ym%rJj=D
zPSlfTXh=2rptYfOdwX1Sgsa=<Ip(f$?AX=bvCGkRz~S*il;x0XsMqIchc1>n#~|++
zfL?-=%o)1?DWdd6jERylZQT)5a`B*k8m)si`8njzdfdJZtnniSJ9ll~w|mzn-go%$
z@smeRHnuEVx^!7n(-NMfa&TjcKGwVueXM!;f55BZ0;wX7?n6D0yQA$qyF<ybU|8+M
zMM|cK8H!Tw8R~+rlzP6qng2D-yEMX+E;~2~XCx;P?ud7wUn&?siQsgHlhg-Pa3+-l
zu^K3o@C-8P9H*IWXCs+OZ7SvCqI|jta0Fhbyx*V{)!09?wE3UX3#y5<ktM#3Y!fT(
zUoGqgr&vcG>fzr;jFYr-JPZ)qycTG4!umQvZc;X%8Uq9t<^s~@v*<z*oxto@eq_rT
zJt|l$KGms<sy<f$-~?XI>|mt*rdpOf&PE#$QRX*y3BLSWhWn<;fzCz)DK``_J>s~V
zeAIUOt`X%_PB9ML`p0+Sq^+2<Sjbs6(RS6o=8Any$i7aruN%=zAszv;oU=sCSt8^t
zpXj=3Uw6g6E@W>N?X3u5$s2uW%o*GzabyKc{dn8etfg17mWHxg#H<$F7-%hEd5`U9
zkMYVxNp7mNhN7@(nIJde?BY@9lMBx+6tioE>`g-bCS2W~=NLT_v<JIGdH;WVZvq{~
zb*_u{s2((Qt6O7hppk?oG$6z%MxlWjGa3vSENB4&fuOqOL2fzR4A;VtW0~NC?2uT_
zb*|-e@QIQ*H;UsV*a(~CBykn5eCX&s&hkCaVEeuGPVlmQo>x}hTJQUJbyrtacS{W>
zxw&iIX7g*;v}^BOyXv3+zgo<x9#}cB@{1b|*0P5hlt3sapN<TyBnMy*rsMs>veC+)
z*8iyfQmHVzU7X#{Z`sK^c2TkJlCowQ%uE$50j33BKC+8<Ek_yKB>fev&7!rLw<6nx
zdms?`hvvV46RtT6e_5)&uNSt?)eTQ;&NTkYh1#2$_T~c1n*~Oy7wf4$%}n+3<|X)Z
zxxBR1t{b=MQ6IObwdNbga|~3^(^Eaafa-JYZPSe7%d*=%#w#8(>MF{F-d{$U`~z0M
zM46~^S0IX}8e6F}Q!F3FL3ks<!-_PsM(ARV@#DxP&SZSitj1m!HJ$+)9jggab+Rpt
z`GJg9<OKFvNkoW!wx}{7sQ1|~AaptQrbYMCdA@XDOao-=U>c&HLh3u)bmU`}45gr&
zqm+0$5KvsQ217w{$@^j{u6xspTALk^eM@vY^;1SXz?5N`dQncb&v{UD?lELV>bEcr
ztVOF^jYESJ!&gnAb@RC>Y<z6Cp@TXWx6ROReZtDL2l%U?Kis_}i2ZozS06ulMxr&m
zGIar(;66nEX<qHU`HeSj{?pIA_3|OVL~_U^1IUP*Fa7YN*S;U7KXyF`2|jYIM+lV-
zjC}Z*JSLE^<5Bi!!V-YQxu-Y45YV4e6|FP8^on7^%y2B&rDMl?1Anrt=<EQ&<7LR{
zPflgHF~W~HKfSp(a0o;|AG3AlPSJe~l3nWv>fGZ1B!`xNq;w~R=%<7d!`8nwiF0!J
zG^tQ0OH-|W8DU9W3vN`;jT2&h4tI-KxEs0xu{wt7dwY&i^3T0&2IE<`f1gn8T(ko_
zV#ivkj2K3_pFaGfhsTZx^Vf*;*I@6U;e5*3l)=XZXQ}8cmCs~qhrVp-Cejm^&Dy~R
z6D|i`)YWq+5I8=O-qPI#+w(1uxg)e&WOJ+Z@DPQ*2ZRUd&^aBAjiVaV2kfC5v1|x>
z&!p@BFX|IU&_$d`XQt6zkVx8poIMyk=0N9B$spHHT#HO~Fp7iw4{DCUc^djJ0VFEp
zrgPe`ad?;DY!ICdyj@$so~C91FPU8s!@@Algp`W(@3tWoyWF1Z?#gTK%F*2G4ei$&
z+OKZr8`_12jbg(_-d!oUH;L{|l#2;jcqaq=w)?}fyP^HV)fak3(}m(Cq1suao{M`g
z_41|bQ9=uvFST5?jc*VZY!1yQE3}HWWZp^8tjjC@L}$!f2Ma5LBs|3}rv@pyje2B4
zE}H(r1J6J3+^!3|_}ofOfg};JVHB-VY?vyF4WrnX%)Rd93PQ;7&Nr%N@e`U<#LAdz
zdMBU!$&a$0#NGkE_f?IfbAFK}R4x@Om-5c`LDPBbSu4`*xnu*jODiZ`KfPTeodAMk
zt%xn_+6cMgA}OK-7`akAGM#tTq6pSH(OSn_>)4tbutol%GmKDi;jh0FYx#S#TB~($
zx|Xzfjc+*%RxB~UHPc1)CH5AJ?Xty)`enPG>Zz=r;llZsz4n%B%jIe#)ob-suUmxr
zc(uLFWgMU5Zc8^_vFK61l5Pf6<+LQumr*MJ3LJgMlnP`f;Mol_rGiXYK2wwi=r<#y
zmKg%M9AJ37p|L-*4pZaEelw_@1Ua-4(I`I4MUAD;MNMpPHO+yX1qpnoNs_@R9HTEa
zIu6P`slxG^WK4*xZ$i2jqc0<R4WoY$5g+tV<`nb~tmop}x2feGD*DHIZzz|0(~8Re
z&8qbKRzF*;18V|Viz_buWAnKW>L;7|KA`M=d(ehVZ2RDApPHccEH(OtyhdT=6-*1{
zL|3M!$McZjC~d#tQNt0SCtw`6syB9ZyJ4HQ!efv<o>`r+H`!WAB=SV0Ek^5S_QS3W
zHi?YB%Zv62)+a^%=}Mazc)q8{qwknyNct1$?4309qo$zl@_HXcn=0xqA~729b@&hY
z_anTccYn`O*bsE>>+Y<jFqmPX(o`fKNsWlegF6q`aqNgh;Yp;NL(w8paDU2B?7%HP
zCeLf`ZK46*0e~ly)P`T8`%K(F)1j}@N#g($=0MMJ#990u?PY?A-&5^f0s?_2aneEj
zXFsAAeF$U;$)Aoh0rcgB$sFk>Q937s(K!+=vK-fP@6jdyLf|?9qKxAbHuRQ8U7@Nn
zB<e=)FBhV#8HvL(z!IIq{eb|{pRBj6W8D9SeG_mmd{mOO5EmiSJgg!SK0l_b2#~DP
zPdTiVgb%Ve)``wK-mWb&;giL9Wts2+IW*9BX4%QskR=b9WG!A4obhz<sUTli%hxXx
z9Lq(=a^$TvxFEhsjzUTy6h0YHP)NSvokDTFOdW+9nyzfQn*ZjW@jal4%C-?r1o-|W
z<dTJvOD0Ax5d;N5#LU#dniRQ|s%i*C3Xw~yeaYPGPOgxMl-MyCRZ|K@CXq|3eUs1n
zogZaAiM<1KrgaO(Ouz66wJl<83-4MxSa!bhY~|3xVL0eiiLNT%Rdv-hV0qt_J(&F+
z_s|2+6<;V8GArQQ=E|q^c<@00fH8zC>wNjy@}b;k>d(~=wA^sy50!q$FE~m?2g#$-
z7mesgw(y|HDwkek@F$I<5C3q{Ym1~U=?Gw`*!#kP=MV5R=8frv;wG`UX)tBb|4ix^
zka7)`^N#7fb$WzO(~6bqMjCim9g1MB7p?WYwLY;pX&+v^H%+rvnssl^X-;WPHNLf|
zprz7$Imd<i<w|?YY}@78Myk)%Q+*z*FLdF8@l<<jwq-oqNOj1PP|sg66C3ZC?JH}H
z?>Jm5D~#_{m{I4xj@#^4%41|*7b#%X_WR0w$ZCoKnj>Oq!#~hAn%Ej~s3No;`$P6;
zcmw#%adHR9vK8h7kge1&L2IUig`|bFA>Yy1g??3!NIUu{wbXx)=$U{b9t)y;q(sIN
z)WkJX(Najt7me!kZD@$18YaTApf60r3cXpRO~}Da@#&4A@eb)xqFfX`SKI-#4RmX%
zUHXe@lTnfVi0BjFPG7wul;cju*CCm6h+1jTDP?c5ayIDnrnEvPnq}&i=&Y*r-g3-Q
z3o?Z=Gsmv|o!*DLI=n1yx1=ufR#KpZ4_`f16}B8Dli|K|VdYdu9hpf&6;($fjia3q
z6Omr5j?xEsJN(|j(c@55?W-gEM(C`<S+I#5>W~s(_a2A5$-9p-V0YB94S2-wi)O%%
z?nDM`I+uLqnFgza<<*8t3$2lMj73zpgwJ8xC)(TRWMh$|Fu>-L6irboiAl3KqI@9I
zVuS>Vw4mu>ga&;%6iOr#y-cLR>mQ^Lx0eQoqy_{n;Q?}=&;=TThe%{Jc#H1)Apv%q
zt5jn*VM3e^x{yAK5}EUJs;vN+u=phb5hHc{@zqA$t8_YnUlT3!ZJCyNKO&a7VRxUJ
zc?L!WHyp)7{^2&kQ7t-POlCF1vu!dkvR_WpZAfp{!x=N*JF=2bn}hO+&6G0_5|11N
zjx;$F1JFDX1x>5|hO2-tTru(p0Load^jC1Th^`hsttFJ<8f-XoaKLywQ`Id5ZZzj0
zaN|_{oqRNtA7w~7_6`UL=qeuCf8o%GNyw}fGi&)&Z2{Gn?mV-Lx0el-UZ}($6cCDz
zoa>IVYmTy!?bmBpT&rDiHJ7hlA=GXXYd7(ZGQqJ~bZjPB$BfAVfB%D^7g@$&<4D<9
zF~52jzhL*^V!{2O=zb8`-G&Ax1AIqkD8J~1{O9wZE4Wa=yUR3%lu6nqU>Ikc0mHbM
z195L<j2#4GMViq-?199CH6(dAxmWCoCAvu6r@QFR9ray4ne}P1QTtcoMg7NR&5Mn1
zF1D{ovAku|175D2-d1ZIw|UyE=J8S&>Q}6gJK3(dj8xBt+{tz&ht+HCZSyTxn)HAw
z+J>TpeGUIVEeEyor142t961zaoikiCs&U{`u2U{QS>7PS9()QFw96@tcUr$mMG5I}
z9ABKMwFvN{951Zj49!bQ(9B&@wumIZ`0|lWw)9gT)7~wdSU49HSIT7PDf6H)xtC$U
zHDEjdjoa6)${an~du#PUKI;Vo5+f^U6d$ODphZ1fsxew|AH6RX_fgOt%D!svsUE$y
z2mL85;vYT9@Q+3OQ)SPDC!;Na%p#@V_JoZ^{KMa<!~)O34$2`tzRv8F3-Qb{lyj)=
zV}Gh@Mj(sxWd=b>O)@KKstibJ0n$)~f9mxDNmg2XiY<XA&z{8mxbAd*f_9432<s>N
zDWlH~9W0_ULQbSy2icG)r6(RSw4@ZNaq{Pud#C*hL<xIjaP{S>=Z<k5(YGx_xzd#~
zu2U}LB~-no>gNlY--6vZ-tS=0*`En7ONH(=^5me0&Oc=YC*lb@u>Opvkg`1JK;*d;
zUx9M<z$dTpg659OcLp-Og;<SKMiG@Q{p2ym(!)WM>Rr?5=2gcuGDcq!*`QSw_pZVC
zkTNTrrv|Dx@A0nVounp|Y2hX*wGN9A##D!_7KtFX0hUvgeTxOD`WS|Gx{sHmO$58L
zO97Qw${`Da^KjiA$62TxiI!IBOo_!}I@1NHJZlJRO>@{Iff42@6DA(aBTanJfT>q7
zeLnpKBQ&A87><G4g)b{iQn#TM?pXqj1Wo|J-Zen=RGb0Bq@(+!uKXGM{KVcuHg@u)
zBpd6+X5WmMgfsCprhmkE{cSk^i<3H#2Kh)55dnWFDjnK1Y`ksMl~oTTFyu%x!Li1x
zDOXSY*2d>=Mv0!yYD|NQQJh1A5}kY&wTYD8<8Z?Ys3wfM%qFZDm1p(g3A6R<PZ^?9
zg=w)f1u;#FGz-S)EHF2?u(|G?kNi^_c`0s=k@NX$q%zVmbpKHOQ2lTRL3y{N8D`<m
zq@l?2QtppvfxCk4^;szJ*|AP;!WxN5#vUHBvOzsBnY+Q#&A|N!JwUs^r<dE`Ng2Pe
z>og6I@fA<eL6g7Z;m$s{6gG|O^5x9Bu<xgd@`gnsr?Ko|6xT|TMNC@EObm=%Q$5E5
z=w*#pj`@VtVV!{v;{0$F7J7-ZgGud5DZavC)+nbJB(~DNaNE)b%&@7#(tK4-820Yx
z{v8trBX73CY4J)S$UdMMcoCZuMqGk7-~dg8Me3fP%~_RWB6Y7H+0+7i1D%fsBuO;W
ze_QEd;-4nWkh&l2jEbST&*=^t6+D@qOc?uM7Wf2e2%W`PIQF8^Vw4giA&n9O`AIR`
zChW4!hM)U3b<B#$cYA5FxL?r~-PB@6<gxE%5d)FCthc+Hb#=muB>=wDe;i(V6d6yt
zw1X~XuXFfI!-n-I8Vrp-5@YKjCiRxVa_JpEPNxyLLF@Ptu)1G-5te|b=M80zl#X(I
zdXtdeB&Ii=Y!9Vo;srGqkr;6LKtFFSyaAEq0WxAcxt4s0W(;o`DHn1Z#M}lxQ(I21
z0psY(I=LofK{ILQh8rX;Keg=4GUS~of9}YIBiB-^_|&RUe(CVK?{68&d2!cEyN1_^
z`3(bWZX0a2hWCq0VWz13xI{l3H!5HdAXF?CD;9&1$zKZ2B_Byz=xnno4@L?A1FJr_
z>kt#lHo9PJhfvfm7Pa%a+A^>z6nTyD;{IgrFWh50e>UxnX+q;_v2ita3HfWp{51pk
z7ctFiKsUm9NN%KM^Eve+%>XDu+AJ|`79Uf<9Z)<dTLb;I>T>ePWWsDN4`t<^Uv+lX
z(EY<L!<&a&F6<Jrs>G}+<Oji&tRCqbYrnLbU$jBUzfa7+k9TVe>=YNaTw3)zpRjO?
zxNr-fziTM(g~I0xhYydI2>Elx{JA{J1G@$?1~Me^t=>%TQDMN;>}3=irVK@}&Je9L
z_?QyzySZHIyOoI!8g3gbcs}{Xp&5+`-<7up<+j=A!Mp<utU-1dchS(Uk@C@M!L>wm
zE#cGRmwPg$xSMmDQoxa7ZigOYYB;k0Mp^Bv`$x;is)f2Xv93)hYZuGf$q0fPASk4H
z2bu+kchEl6qDWq{SO31pi?kak!_Cs)(Rr8JLV5X^{Or-P(QL7N{v}{ReP$aeVE{j|
znB48KNg+t~9Crj^>w)u)+95%UfuTZ;k>r4rnUrMCp|z0crcPaM3Ffr=m7a?|H}VRG
zHVAn$#k`rAiZlc!l7P9^PukQsmo^u-6zMJ(*;|dq%N4GcrN+xk&8UytnoHYibysTb
z?QY|h`L6a1<J%c#)ZfmZ*1k~p_Cov0X~uVqu9Y6+J03ID7c}RtE;0VP#J;-5^6Pp%
zAouU|t@|T@%4UOf0mSQmN;KPfP}sxRi2cFF6jw$$)_x=SDH9?Fn1e>p&c~S*1kQ;4
zsb$7=o?m|^U&TRdxnZJe!aq>$s{1l~3jGmwlq(=D1lyBBa5$O!o6l?qH=do)Dn!#4
ziml#nK6By@uQB;|U?!9357(;Vur!hd_1MXBqz^VWY7PvuUjlteA}beUA;3R9&5x2l
zQMU|kq%;U0k}7lG+$~)Y=5~4si%JxKC)b2P03gc<=hl*t*XMnt3xNTMr1wfWWB;VL
zGyeyPki$wMLc1B`mr_PDbvLbW?*GF+Bq(KM!fiVK3BZJ1Zr>j!S@!pGkT3_hzoT;q
zyZedWh@fu?dH<P?5y-;=_7|dZQulsl_Ib})&rqw7IUR|(fNawpK-?M5lPg2%xwmyT
zGpxx02K3>4Qm0m*S&a>claN?;C@qVy@*}4fpIQ8!(xHy$$}f})sovqHYfRi3$}Jvt
zKhr;aLddPWo>PAfC@!Z#%xNHF^!FV=1^V=gkTXZhmMA#OMQ1thEDz=6(g`68vlW~c
zvSvJ;{#5$lLBU!qT8nvW@%uzq7|gQ=ediCKJ^W1fxo)<3BNJBl=!NgOstZ-aJ4Y*o
z84HEXCNZ;#`Z}9|0p!JUJ-z;^^+RPtCx$bJcfMH6PpcO_vxKw;F|C1T1$4{F^^E$C
zZ&*$Qq)H8F2<rO5T_v-CvHbQh{>((5f&_+H#-NE7ppQW%iyk8w!qSNf($I%QEt<nE
zvKL?Z3Ppom;p0H2T&fn;Tm8l}dxOLP+xnJ<m;IWqV~0CtBfIcp>>a?X02&^?Hl*yJ
zm=_0nI7u_av^y{=WheM0UbfHh_~U(s{{Fu7#~&xN;W}UM(c^w{&gt)$!dzFSAX)~P
z8(O)`F(XoLRZ@<y^sAug|1Ubkn3y#5oTD!tbDIH0-_h+S23dLuq*vf$I-9^OdIg@u
zQHgqe-;{oGHT?^vXJYwh<(*%1cFi;E&aI<`<paJYcnWg6fi0oT-1Eg}i-%3a{uk{d
zTLo_ewBr6BE_iK$khxgQTnsIH_zcHrso<SEW){3lei3-1?`kQ<MP0T}Shi0D%-k<#
z?jK0O>Cx3jh$Zr)u73^xKRpHzU2T;3<${qt>ByO?zYzIo)U6P|D%yonAfhQlB@5d9
zA4yfkeo9dbp0A~^k?HqHT0x;qR64%Oqoh*9vt`jv0zKr?MryMv?lYR*Z=pf%Nz|&0
zefIi?8|o$ARjNzDZ=|{us+Yz3-tdY+vQs8@>J_u35tB7u6RF`l?8Tj#HY_4~@Os%}
zop9{k4|U{TVvnRGw=S%OCVIs8p~3JYo?bPU$8UOockM(uxi*xM|8&n&Jwv|XRYFFs
zm{EIj<&DgOq1A}(U>ZFrWG)pmm-4AG#k5rVFes)}clVD<<B4)tkE(z@s+ELoVjdRv
z1wE3lDjtcW9+O$ma8o^F_??O!Cwe=%$NDlAd%_Qi1Oyv62fblV0PXx|O7kyqnbH%;
z!fDN#Cs1B<se*s#5bx?jQ9gloA!DYPF;jX1Ye#ZN%f>81=5jG}IiDI+Ov~dx0eT{z
zZbnDX!@~!@JNP8Seh^j=up)qM>|q>{e(^uLkO~rQ7yccVUyY!Kl1s*0M$(GF>j!;`
z`rgn7U(pL%H8H=SIcT`3iO7iPWGSk?$^A^^(ehu>?mx<Ht7(_`Rt0)^JdyrCR$9t*
z{?^{rXl@JgM<3#Pj`j5Vz4U3Im(KfdC(j|s{&6IDCg}~5y!$)7n%5CxQYiLuu_OV4
z6a|Yzx1lea3;>$y>$`i<(joXRG%Z-LU|v+a&V59ym+TT>u}x&a7NEOpUmfL7pk&=7
z#+$Hg4sXdQVIoC}J~Uy$`IIqx!ra}{;q$X_MXy-2pOzG<RY`4*5cMY{l{w9Dn0S)D
zFgAHe+%$B4H6HAz{|`<A1!c<TBPC?79EKVf%G^q5a_!DDb=U3QYjD(ezdGk))2L6F
zxk#M3==#hR*JiE|X10nmTSL_g_@;Gy)p`g#Q>Q};kxBuH37%|u-{v?|eBCzfnhjnR
zBinh~G{H7kq$HVobH!MelsvBNg{tSPo|}1LW;mdY5y#jGQGiy>6=*c(K=c$=V_ex}
zXMO6zh~KO#Ur}g$tI)K<Yk8|w52)ggXjT8OHxZK{{r&=P;(D~Kd=sTF{}k_{;?tb`
z+qiJn!rAfOMlJ`h09Od$k9kp26{vtK#VK2`8aOXqFdaZeP?N6gY5f1xiE|_p2XSzv
zi3996u{gN$cUwMy3Vq=<#Hl$E0ZyKrnsX6TB0jN>FSqtw3wT)ri?OTVvlW^6;>Xxk
z=mC+5PxD1*S~#m5{X(S&26=|;dp=tXfhM2NBG*op-_DMR38~OZrd>=|j~(BCEB#aN
zg$0@1KH&nTrG3;sPraI>mU^&&v&Og5^JN6nfYU6&6rbaQHb#d|c~7N;LovIE<lxJM
z?ITt}RGO097{c~!^0?yQHuzye1FO(9Lvy|iT3lsB30Hh;{{;OttMsp$C>C*}Nm|KM
z0A4)oZ&d$Y<?bcT@Xdj5-~9ROQtU=aX;F^76E;Wy!0$uVGGRsXj=e;HbDMCauYhSs
zSU8=?0d3BqHH21)Qc@%o>U;gmt9O|0f`UdUR6V{<|9-?m2tY?Vxr(Qvg7i7EYG+oB
zw*vj|+#l%S9%F|jgFQM)8hcd3gBUwZvBUHzyJ>n-q*J6kECv=@5&48LPhFIH1%D-F
z6EtJ#iK8aoM>9kO8+U|2Hv!V!C=@-runDIFqD44bMO-!k@@SFNJFG`D=;K#Tpo0#m
zgBWs^bbwSj{sc}36Rv27<@khExavWCHU0k`l`w-7i9+Z`6hdddBvcvZ1ZTDAtcLSk
zR?+$OXV(wUjKnQ~1E#z1{F1XvhCK*&;GQMAXAM|G4i*z(m40XyXad_Ry_^Q6jW2E&
z+$%*l4Ea`S;zrnQtHC2r4M$6FdTUvN5%XA|;9Vnn*YF-~xw9C7w)l7bg!SgLB>EKF
zZ)kmTJm+>kv-{j`F?+^9yFzZiN6(Uuk3M=8DI|~?d>bNPxVM91BM9Y1dU6mNhpfDF
zO(O-DQuyMPD1v*H=w5X@``!;Gc6iC}VFY3PE-4%N;`5vYQQTs+LwA|+m|pMG%>}KC
zb#GSW5L`09waWO`92e@BEzJ&WjKd3Hv2MJ|-r8sxZ!}VUo}TLSS$(m+-E6#)GN)aK
zyvKUf-`1G{RrClEGmIW7zc=*A-){Ea1Rj_^TbCvhf>JO9*}jF#RZ<4(jJ>{8&`y}S
zD93vYR2pI<I54l_pOnYfmli|a$o4u(Q8(!<9+bi7xad^VF`x{lv=Kshx<up8oI2-f
z0=$nby|LImnZAUn6nXq{sFV~&rN~k8bvj0+sO;r@SuEm}hE7sPVN+05MrFJTZ8pc)
zaj<-eh?@l}C57T=DX5g}UP69SrbLNKsh2`bPgp3101&RE=wP&oGrUVfkU)uoq<k$~
zy%Omn$EJeK2TO<;F)&eNl_LWW3F%KKv<xH|HtC2<+bmC%QZGTv2yNw+3{Jus0Hxr}
z592Np`5=kKKt7}<CLb87@Gf<X5fXc-Mqd~y26B30qG2Xc1dLSJhtnrg_OfZw(hZDc
zNXH3bIfe8`l2$N^LF%JSG1Q{fhlyf%9Tg45-~`3sDmY(zwszPyGFx!fiLSZ<3rx|8
z23R7K08M=HBEh{_bT8)9kRPpNxN*cRxa&lB9dtyt`I7@F1sXy}@nyUCJ^Ogy5&pq$
zA^)hDf0TD?3(}yuvd>qatsdF|3dU7UF^|&Xl+e5;K6}Np+lRIePrtBz_#kMT?Ac=W
zY(9JTCBr~_BqnjnCA;8VD|*-R9&NcZYQqsb%ui_OpG`e}#q2oc)LMJ_eFykMJ$%P;
z!F57(o#4~r6lwk+9Vy_8=L+t5qI=$L_dV&y9d(*cW&}a(t)oNx;`6M(G%2tJOa63i
zn+1u30N!-0NNb%#$%3$PxvmlQ@#$0_pJQ)bY8hW@ME#0hkNOn@t6S{tPUDr#Iqj)N
zqzOX(?Nl?MiV%<m6aR{L<sJwo{znl4Q>CH@TOMDW4FSPa*IHrFfCNC$XVy{>fMF8+
z#r%+1f<AfdhdSw`BXwCof<Tf8X@xLW8aG8K+3SK<v|oPb?W4uixGh#BK;JNrr$j$7
zVumD$iKG#@R?Lv95;J53Q{x%vC+M$HC1yxf_d5XsPkjPWc!9w2SAoDCy#;tAHwVt&
zeDZZUbp^s*hSNn1KNFQYFaZO%i4ZPbv!U-RVZ2QSpJ4+`^5E<4*w+acJ_YMfdu55m
zRJnH<x{GGhWuAMIT_g)gsSpeFZC7-FMe!#gfuai)6;s?fl2cc6Pvk4@qR_oetgwLw
zOiVl+_aNNhPGjs!$pTYP_t}X{??!^u$%P7xDqyA^>bA8)g|x)<0TU_^eK29dJ^g?^
z`~8xRJd3)@C<BrmDJcVqFmOgXDU$__7}psh3toyP3$o)25+o79BAF~$z!xtR+)bjp
ziBD_NkOdjGmEen~hB9?<8wndX8$y|RLo;}%7a1BoCGZFHlt2Zal^7tfq*doBdI97`
z$k}xlSEuN*a|hZ&+3=6or+1^v1PApYXZHEDvuVT4FSU*~yf*)8=5Gu5)jRneJ9%Fh
zUvwBna2^qzh=EBZeEA-B`JOnJyZCL$c)c4%a6TwHALLnK6FE{a*2@<|$kHab+eLT#
z?V|XT_6eKJ&ytwZWTrj&a~SH6-z8-uUwmGifB+~NI>Eb2Py}nKXf5TfrFSU{Sc#Q=
zy0*0x1ONaCfVx(v@$wQEHpZRyR*z-eW2AbKp6bP{UTSZvF^<>HX{#_^nXX6uN`)Cv
zh4f)5CUO67-y7~fk%l2g8xdb0t(LXJ4lq%B@W4~^z_4y3jYSHw0?No2S?y$vHn>vC
z+lNm@RH6=^*c6`>Q1=7!09l?6&Yt*>@DExJo4OwwEeEmz#*efFZ#gq%?t{KU6C*)&
zH#<D8S`&;YEok?pM;)IOghq<yh)j0)GN6$#`<#dng)d*!h$=bVf|7qeoEn(}^;{jM
zZ!r5II#QysyMn1~^cIZYeL?dimE#95AOC5lp#{XzhX0v{fJ$y8Noz?wk<l>u!v@50
zDvIv$Wt05DmlK#4-KU-n5I36sB^*&oV0yHbq@)v8l1eZgids66tI(m`8h-M_SAVIX
zW=K=Ok>^yOrL=M1g4qY=Ng9+~Nen>=2^cv+76;Ho_%=v>FuN5r$Nrvf7`Vv-ivZ=>
zlB5(Gf`Sn-)Eej-Ns+<!^l%3uA;CVWf_MZ*se`O<J=8%GIxzXhR+xyARp3MlZbNbv
zx&IS3UoSjV$N)n!o9p|!R++<k#vF85$7<Nfh-gFqYrN9kC)dv?bTg45kS>O`AbH(H
z#t?D5L4O&I!{`;cvmA{Iq!kT?n~PU3I*z_H8d*d&!)>G!GZg}sopgz8>A?{vs0g&c
z?nRGNtFwtpUhrX`TKuBv?n879qqeM_kAl2|<(t&)Nd+*`fyk8B0*v)#qO=YHXaq1h
z2`H^RmaORhNFeF!j=F1(I>9kZbj%tsMU^~{Nf9?GLLyV&wCaaiNpyqA3GUo;O+%0H
zmCbzd3c=kXx>>*kPtkSH%xj*Rf~QvW)bd%{0v8gscqh$v5LC_75COuAyf5s0erL#e
zEaaIsk~NmkJ6ljd$rZOjQ9=;3T;5c0U=_T7C`h&;{h*ZlXJpr<RaZBSuN~jO?|vv$
zGiP+u#kFG1lB<X*t}oq8G#6m#p-yb(9n{0<1rSy*fVWfQcl;AJpwE&RR_xFbg(;De
z2m!Nli$=_&flHnI_J??92MXzl_A@=ve)QCso*Y!_i8gNK_xkwaP87j?Ky)9toqz8~
z6+6!4_b>`EewUPue1S|?f5n_X+wuCIZmw;&>fT&93-GO~=B&24L@#1v+}Z5H#+4G<
zxPq|a%Pd!x8Bu@Rphx{}Bdc5OE4{|IUCqXo1;%%>_1Ji)zznFO9!a$EH2!~j2(S5H
zUt|R8O{VYA3;CzU!JsG1veik7GWr0hH;wl-qu!!tQ=H5cxmiU8F{VJhQ4|C<9i_S#
zaz%d~v7KTf7uXVrHz@KFvtCig^M)l0zMN6*66hPmIMq_WU&G$W7$a7V%6)P4D@bGn
zD-gAQWdkxxlV&6QgB^<<^o>JF_o?SLE`1Z<V#uh{h-rMxwUjxF8E)>kKLMX)AN#8i
z-Z*;+Tg3`*Zk;-L>%yrRiieaiOnxJgG80zHbV8&7ynz|oBiyWVn5Jb-)9@)F(XhL8
zHAUr)nrWd9Rzmurj^!`?l;kS*%ga;Ec=&V|OmMiKNe<T$fs0Hlz!{#Cor1&EgnUr)
z1z1cJgdcZ|joe*ENSGut5fmKH75#UFk%?-6Ken3-mqT4c4HxE&WM0e}oBl?{dz-c*
zWTLpOL)f%W+_aC++D|2NGBZYIR2q!f8GUA=8Exl+Xtd8B=|d!OXMBZGl$6<utE7?9
zj7th5bWsOQ6FrB-RwfV8QKD0%h)_#uUKoi&+=)UG6cz+U`W2ZQZW%7POp{THiiSK%
zO+cP7Vk3bdD0Ig(hS7F_aO0FPngO$Kblasae&$9LA%ByYzlnEi3p7d6lRA0=k4$iL
zqMI9Njfh-;P+O>M-u_;Pk9PyJc8c!K+m`s9Kv-~e4#pl+b}^Y@B!3RWtW)3g3y=%(
zG3#uSz05}W{+bupy|hlM3)V)_+Q?fQ?@|u43hU~0ZA-rHXR`p_tZKHmq!{07bYbIi
zioL~Yx$HDj-L0p37OUsmTN{vMui4lNaZI@$8{;)*!1$=N9V_v#k4lx^Q9z3tmRu7+
zC1EgYN)#4EXrvgVC@cEORWiQF1=^4)uT6+J&4f7B-&i2Zd#T5e#TsEjfJKSUd}%=o
z5M{bD$n%##l=RID{}56McqS^cii;>y`Ylf&7a_D9_^Uva8NFp_Mlw^7&>~W5eE9my
zAN{9u($1UT_%Z6pr6DnQ<v3fC1~}+T+2zxkEYxXD3XXRAx;hv#4NCx|>mmjO#GUq)
zX)nS#5rF{{12D4&;`o7(Wd>Pdiz6ln5?gFnu*Ff1n6S0hM3In(WO86lj6oP5&X5N~
z8PrY$WrQsXXfzs&f@Zv)B4Lb-Sd3u@#>n)rB(#r?xP;6aF|!7)ZVn{-)Z1V?5avo3
z^2JSpdy(i~#HRs|s4NPM%&2f`2y`IX3h+hid2mVh@4otk;Mya)_V8(OihOd*CEwNd
zOM3*@R?)SUPm5E+SVCi@2joE3j#@~_VKqYz@s7rxf3Nn0k;7CsO^h7oPzZ-PDBnN)
zV)skkQeCjl6|Hl5>)bDg9IO!1w}AC>G`m;KHNI8i!p2*3?JJg9-dbiv{jx!i`eh@l
zTkWk#u>d}+wZJ%@t;fcAff-PR9AqhdAy(c!Kn{td>M>IKNhR<a-Ukx+MD3bm{0pqg
zPkBTZd{84Ry+c_(__2reTw?jZP5beL#lI}Yrr5eZO-4tC_EIB!RliLs`H!mj)gSt(
z6rL&YWyw1}F7glPLX!TI{5w64{9C?fLTNELGf47dQ6Bsse5o4r3$uX87!<srye|%K
z2$gw^hrk9zw^MouI7xNy%T%i5)iV*7H;gaMPf<o;3nru3PbGyuP#*iMKzXiSFQ)m!
zpFel=AI^U8i*MC`@cQc?eSNI{=6@Oe@b#bFI`u6rcZlSS5(<Nk8z~i89a3h78kqH7
zO;~gsJ&nRQ5!NI9zXnadV&w9Gt|v?fI`(%WF>Vihi2qa`z0`ZO*B|ii>m)lnX5?2-
zC)Ts`B<q4d{hd~b9ln}yrc#t0Z8Ww&cOcUy-M%EqJ}QNeLgq_l94YuEN5$E*fbu4c
zIB~*=la$r~6KQfcF)tGCMuy0)gU2E)U`7;oPZ;4ssSs&11U|XTK@^`)Wg^gmK60%D
zWb}?SUgR?}nTddl9;DP^nK#^sMm``+KY)scH+0444YP~SKX~@R;l-maA$yLPJ!ilk
z&)XoDM7ZH_4Ymz64L>@X!@Cy<j)kIQA<+yEL`B*6^Tpc*_YTp$gHPKLO3mhrn)p;I
zGFh>aFWw}$H;eAgeA;FWS&?Gf0PH<A94);88+{f8K+GzGZGc2%P~yvt5bzcb_l_RE
zn#b?FM*?2Rb=RQ??)9R3J#wYT?ImR$*Z>+M{?TMcb$9158e{64{*}|YlYZ#*3SDcX
z?ya<Zg5@~`7dK}T>5%Ti#<<tsT5TCedM4Cs^;EB8^+r4F|HhXz8{1Rh37{uqKm<Wb
zRnr>uHZqy+*RkyXc4>`R`r)8a%_=3N9^(5hswsgfd>7&Qmx6hU`T1-TEdw*WNwoS2
zv3ja6O-rMIjZMOHF=>6aB3dcz={JC;Ax0|vLq;jY%k^a_Wx#ih)6Gh$F*0gT&Bj_O
zCNI-xt77t2IeN(j`{vVsf9t;uNcdagTRHZvFUK*(2cIGB8Ixg0EmON&%b&`qEW)Km
zTLWV&VN9mTmi99qmSIn}Qz8lIM8cy`Z4=hy))H7pfN{9Ys6K;E?LDT#ldmX6r5ot{
zWEow1Vn#O(PLz-#@f8u4HxgDPOW7+K8E!#W{!GZwjfw^trUMy%8O*n4*g8_qyBh?@
zY|+6Y7Hy8=z5Dp$jZzv!K5df*tC`6Belj3)$)uRgFCAGmc0ccIMS)_L#g!vS+ScSC
zqBoKU+mOmC-4@#cO7INp_}BxJ_x6sCGVC<j9ln4^Uwpynyx|7kH4o)g`zvV|)1<m!
zoiAGF^Va!y$@{LxQaasS)l#8*b8ZgcTdDI}vW%DYF4Qk)*;|S&my3;5pRT8R39DDw
zTbCIxH-PzVLfSw*HpZLGfGXx!Mo7o7^!~aCNsD9-Y8bABD24@ySAX(in9X>qM@xiJ
zqvSRTPz<D`P(9k>s2-zNTYdHfs>k>Y7)-U0QcyEGpdJhTi(x0_`zY8+d0!lM(!$tD
zE$XprP!FjZ?+xlPsZdWcszys#)yV!T*hvRdHQsvR`yc(_d$(Q~l$c7`iK|qN8Z^W(
zP?$#~WWl`BBd9`)e4Yy1RRxgA1?(hC)k1$YHdYFhbTl9(go$V|y#dMzb2LyFMm*F~
zSQv|)2~k(%P!xMXlP9Apl{%Ct9TG`@N*cqkIy5&qbtn{_6mUC_6rEs>87mppWo{?@
z=0~HkYRqaHO?1=|JQPovSp+4kzY?vGGBd0RyL3XS%jC0GP>CFjDlfSu=s}-TeXlUb
z%5BE6$rO-Ltjc7_`_Kb!3I$}2`c9EiaXWA;2MwbE6%BTEB#T{%i3BR;-BppCHG13n
zC?Z|M7q1oE>qPfDK5d-_ky>nInKU(&l#sADzilvN!p1#C=P4Um#XIMsAjge|ke-Kd
za#msht983BYqK7Y<7z8_gxq7alY+ZdbhqAi#P8H6th1jb(dA@@mHasj>&EYrvXL)7
zcP7BS3x+rGt_3KsR=-knu|}#3)`g;VA#YuHm$-Kgmfq=RS4*Mp&Egz_bD9k;Hsf3K
zXxC+%y~S<0>^4$8M^E)!Rxh-Z4_P^oZ@qE6N>5H?^=3d7@+Dhm#tl9MH2l{^z6qtt
zaiZ0z5OrcHv<Bs>5p=&b;T@sYR3kw+fhD#yhg+AHi;F@28W}B<G^fePADL7J4cz;_
zbRh9WWI%?x_c2yRsc=<;l{8$*R`jO_?Fp>V9k8NKr<}p+@xhKM+M5htCi;;Pa|Z`9
zk`Qqg^9wrEeS=e53kVF?5q#b7kt{%T8+X)hy`Q4pWckvRk!R6s3$klCgPDEc8~dGS
ztjF>abEVXR;tIH&(G@|bzglUI6E(*1Wgmpqwl5bvx{50W!IMV+G;@Kyktah0k1r3i
z;f$FLmoGo=ez(sPcYhY1Pj=A79ZC3X3Vek@7giExEo!N+dNMh|9E^KSe{L{4{*&+(
z1#=G*m&bmn%Tf;1WtBGSvQGo*GNGolYsY@sR!lu>zTyiSB{iP++8|>6Cmh){jEo`&
zBpz8_Fb^YJ+Ml0rWZq!DVr2P;WjO}+le~caR3pewID+ZW!KhXOMzAcHHOUA{FoLW}
zN8ky1*a!*|j-WJHpcp}cVgv;VMo@5vBQSHPeQsY`x4Xa4SB6!X9kXhSunLQVMd;~<
z{%HxH*9>2IaGI|?`p!-|a&OR!_Ga`?4;IH?mFl*F(+|r|qP_|(6M`pEe&#-3C3=ru
zs-;oBs(54aRma;KEC$;|Y|hLJmj3KS--Tc{JE!J?$yXa7<G}FmVqJ_CW)feDM0dg0
zr~YogK4D3p{6&hxZowx6+PmsV-@^tgC4t)L9^b5B3D~WMKz($ddT#GPduLO<WhLr2
z2`feQW--gowEmJOO7JCRe--T3?B0dw&xb$%`pv<xr0>>$Ir-sh-}~bm&)+(8Dy(hu
zdq4Wsled2U(jVVAbMrrc^P?ZU`oYgmNvBCMUztFVp525+Vu}3R*Rb_5nWaMA*Adu%
zXfI_2=Ni#5t#_}A@c~61-wt#b2V#Hf3H(70$cfmKut$BKWCzMJ?r@9IBd}osoW%VY
z^;o{BoQ5O?6pnBY@pz&JVkYQ$gD3KAmdZ%xRsFk`-&lTaLrNjf=Anic=089GxrG-N
z%4bN7krOxW+Y#nVqx@r3%@}q4i85%DH~>ixK^BOHjc!R68h^5B;hxtW(gk%7Iumo5
z2MlKoXEL{hQxzE`SuoT4X&K5t*%tdd1C#-NY2S=Vr!R8ae44%K((Dzq@vMwB3~jow
zd!*rF6JIz_+65@h7?aZyZNt4sfC+cq$9g0gfS0W}TDyJ-gPHXANjhr)ApQiD;YgUx
zPT!4Y`;pZO$&hst`SgR-paE+pgIH>&ZDvac%r&i=3B%C<lQoBPHA$hOxn3OVOLFP7
z(BSDEqNNiKQ}*Kg;n~CfG1pk%wS}wsg{y}e0i?oa;7gCA9mAAffqkgmedk-1Pi`e&
zK;^}i!z)INV<neTUauLe8EP2=9ILrE{a$&G`rW4Jcj0QDl^3@UZys@v&AycT`jW9F
zLtDlG$Cj{u_Z?KY<H;caYP_sUGN*8rk}uSF{eg}^uU}~t5PgFqh6oW=2V_U9H+U;4
z$CMx13+@y?25gm8StRLDRD{z(hdK$cMNKy8eL+RP$m35H4*{KmwZmRH!4q`y@jDgC
z?iBv0X!^voEbNrW_R?6FR3JP70_j(9w2I(=$D~+tKPOTZAsM)2ddbW&{sP@(?N)HK
zX5zmv(wFa`{N?lMq7;`;AAbEaf_l9E`0~M8l8uxsPNa87`{lc%_kNe+y|3KPvodmG
z?8K#<Hy*pX=GwCR`DOQyWCBP<T8Ay+=N*ZIAv=Xe)|EQe6!zkwhpj`s>sGH{z17>u
zq=FdCpYhFMdC63hlY+fW__!36@K@18XhAtS*ivNq!<IoYaYiPBEWm_?Lt8KbB&}Y2
zkL6{;vE_V%`tYTuk@C#?ThR<9`P0>|HYg!~f*Wlf^}V+8(xyufk3YaaxQE|+SbXpZ
zU)znMJX5Mq@{zi`wG#c#eyKtFlxt-RUr9w?EA7{oZRVG4rnN$UQSSLLqMzL_HH=Qh
zFsioktc>a}=`WR!+pccEwtOqUeCx<`0I9HH;5#^ur#oS$Z<&80g}u~LLK=zu+({^b
z(00V#mtlK(Z`ehK$ODNmLW~%$2Z{JP!)8+waThV0%8Qy!aYQ$2)xpj5@;^ZbSa_9D
zs<AaaNHw;m_sO4V3f#)RfRgv|0qSWkffwn(9s;Bu;>g;nsx+}a`Kxpiqp(xMW7vz>
z^o+`8BbPjKXvh;zi9`f8*}D&)>yCqx5_}(8m@q+U?w_zQ`l!>#rBOfg0Vb>rPtZY|
z^esk}W79aBdduRy(ASWAoG$66S}E0vP@Bl4E&&k+I^n%eNgw^;6oM2l=6O2p0D=F^
zE=4z3VoLASKZQxSn*Qc`aoaLlO5>P4jr4w%KE9<`oKUqn)6O3~dlV_`I3Z`Ym@|7I
z^@h_uxSGYUtr%$#vTDVwTEST-I_u!`EGyizh3xra_I#L{-ARa=B{qupGBt$6-{JX0
zw-|w8LX43ZIdZ*j*|oZ5myAMPt60|x=0Wgm7CoB>Eum71UK1)n#2RxZ^!NaSEuraU
zFMGb{3FUF2l8R9ypEm~u>i3d)aEmUP2jzQVVldbW6+>aW9+dVa6M#_ACKj{}wuZ9G
zu4m1>mNj#vRmf@(vl@6-LhhpB>}zh=5|oFE>qbt9#SMciLq)YC9V7cj_K8K5gD@Lm
z`v8XYp^~bR<`-uUS%xfdp3bg=a(`OMbDbAD*(G!mC3?@Efiv@_4L3ZOMrR_o6Lw}E
z*WW0ZcA;ss;Hrz?ag;AVh9VU7hy^{jE8@@TCv2`iOJc_3Je5ja!CF0t@sWc7f@h8B
zS%cYT#O=r<pm2qPm14olL2HQ7jiVOOk3!*Uv2gXEE#xW0scsKFjTOf5!?<nG<*zV=
z@{5Npd|o9zjB0uq)$}kD1NJbA@o@FoD~u9kbMr#R^BJS|OVh{8_>G&yjl1~6N5sRu
zKw!%a&4$nD&ssu)+YLKtYrA2u;d7m?$H37}zac<7{f4g?KB1k<jo6|;I9AylhB%VH
zf(`&;zYIg}0vgs<L#SlN%hlhjreSSo!?N;uRTx(3Obn}ZCWcj%7!0;yjUj0!hP4%4
zA{ZT3%2>x6zN^i@ZRhv<#Qn$7@n%CSb-c~cP91MEY@&`g8#dDx{h^L;2}A1mRyqJk
z9gjd5g;K}28A7GyFE@R!DcW%xpI42Jm(`%-Wi{w{abhsoP8~0!E^kBg1fw0djGcHR
zaCOsf@8^A;qVEJczQWK(ooF|#q#m`StLWYe!xq}2Kh$y7K|t#GHr8=!nd%Y@xe=Sd
znYl2ORmDe2h*658D?u>|mD@#ZWz7gpn?ATIG;J0}nf(C1GX#f>p^EC4`@Yu~D(naq
zO&@L?4!pFGFRaCIE9)`b%6bg9BrzCD!Ej3|G0=Q!lHgEtsIcsX`<}mV)IT=owZ|~r
z2l$%pC_>>5v2X{^3SMryz@(zZ9?`F&A%Q%@PysOqfFVZ6&``Drm0QHhEg^{{*bdS_
zsM;o0Z3|U3geq%8)eWKA`LI`=1}j~F!IcP%kXLxF578R7^A9}4AMfK!9!J3~)*3d_
zdf#bykZzc_hi(Xn8v@>bM1Su;7oS6A67I}qerp$Bau`L(JtF2Fx&8QG;C^vFSV@28
zm_9ZB6eyeh;`5+BfkO2!;>fcfbiwHruKTieZx!bdoU>x_eFo!|S+whI<0=C-es89Y
z-{<90y`Jjt8tnI_S>8=EQr)4ax|7wj?Hg;2?@ntrZmcx&C3<Y|m1aPdrj;}^Ow)Ql
zNQu8)O>06OX;MBuN!#egkJfb;9zK#GR05Y%ji-rLzo7Q`fq#%jGsv{I=@H!^{CyH>
zSu<FyD)QF>si@NBMXyfvIia_JzE&+B?nfpN=x-BfTGi)5>r%r6h8g{iU`EgeZ>Z9Q
zeM0Q+pd*eRNA3|^b<=%Web5Z{r=O`sFPuRe?$Fksfwt4o_A;eLHmb=|_bIAzM4uAP
zPj=7|_5sWA<;3xaQufIi?vwLOdjkDRF7(FfzPvcv-E<%RX`X?>r)ZrtCk?u<DfY$D
zuOM#;^ecIIU&B9UNu8<mVe;h%GofGcD5Hg`=j9IcD=8}dN~T($5?8;H-k<pdBt$;;
zSD{}i=-q%W-~7hN$4@?ebMVZqSHCY=v?;Bsp=*(xgFhJi=FJNuAD=w+!Pu(^w(-%6
zBQSh}(&g6EXK#Mv`?vmn^yc@zi#>|iVo{4I#_n#yz52=~@t=ws!?h6)w+cWd`@x6s
zudjdM_MjWFiWe4FgVMQ8rgnLPxWKU5C3`*3%5d|ghIi(_HUG_p;|sB8u;cu}vj?B)
zI@cu~24r#tj?^yU2(w!iQdEh-jtXpJR4!2s&E&@E+_r?%OU85ObzLNPbR^cee9Lgg
z8P&Hi@2YLMFjicai;?tAHebH3{gOWBYcyXZNPw;(XO2`xrVpMt_vmouOIh+RX@byw
zU0?N-#`>~+QIdnaM_pWvYq>Q9n47tzhM6#T_#kzeuyCD6dme`Pg@rAlM;sBpI2FPd
zjV(TtyO8mVBz$4HS~V_gYI%y}jqXY;RH125Xt9o>w-fe9I*uW~AY`U~MU)de4Wy3%
zb11lvYL5|MZtP_H5G&141VB+PVlGJ6(Nj1Lp^rv(;f*i4kR=b3I=RJ>W<;Fac=s&9
z(I7gA9k*?YS}1Pdi|-TM8%6g<K5gUFE^Z<AdW{rZuWGth)il;9R4o&$mf?L8ve%2*
z>j&%_BS*Jw7x;#$p={(Bavoq#17Z6{MCFBjBLMgmvTsZPVBeUc%bknGI}!j8a^{FR
zbCB4X@;ir$XS{Iq`J>PET<C!(eEM_-p0N)a2e*aXIYWnecO?pf$h=Vfd^JB~6Tfu_
zzjH6Y<sre-A$mIatT-i<RWNkonRSCJzX)Yz!(%TOty<EjF)(PPW)Jf287Majy%*Lz
zx9-9^v9M;aEqoJr_T}%;zdx;Pq<8EvC5qkG$>$wFLF~4IL*&^Hh;C*l39Y(p&(Nl4
z)(p0N5eYZb%WvAj7e9a^xOa-~owqCEKZ8%$v-vEECzQ-nO#U3kgT(KWvXL)7uS~##
z{6zxIY{YAPx_Q}3Cp;<g3C@@cc-hn9Y+qu0yV`|~x0l#gS}gBajHth3*Hb-})t&ZL
zmBx2G&Bj%w#;ZkoY+Nlh1FHB9`gk#Z<1Kuy<MSKJ6w07}HTGJJ`ZdVZuQ_OrAJf-o
zjFVp{dR+>_*5h9cRVJUI*B#3YQ)TkLI8>Pl)N@J<^=wH%BO*JWF9n$bW0HR}+Rl!-
z3I7;vr;7OtA3rN-JG(Lf%w5xVsY)k^pfw5F4!MP%Kn6d`G4zC0LEEMEK7cNN@cPRi
zzW%G5Kl|~`r$@cr-ABD3+lYR9`UfALBl^uNYhUY;V!Y$n5$~;$7jJ&|G|0S<U;G)u
z!+h||Z-4xaZ+`fTfBNv*GarBFdmoIQzIFN(MTn7t-z!NINx@5|G~JRax8r!nzOL@B
zKv$<<B3P&cQe;?32fd`CV}GFQ;m!)=nrUs@>|OBy3(2Y?`bY!86n-mE2`l^x6H_I4
z5;|pIHf-y^0}J5`WF%1prJu2v)EO9A`0pvG8kx3$3~W$;o#-y65{$1)s_r~?u<Kao
z-X50D&p#RY_W~i(`M4X%8OK(sT%A7HaqjTQ^o!+uMJvkarq^~#HG<AIDv@&~I)_M<
zSHh8S9zi`E-PWn@N5o5ki0mqxM5sjRkxcAm$>KFy9f=CDC8k0;=)!#j=++WNK`|_3
zib5hJa@3uPObT}r<irro!tXJw8gjyFuGL^<15-jw4V4&~KXmvLqu$dE)I<;@MAlRg
z7}==3$tOD619YBb7l7{X$(an<BxnkuU$^P87_J5Y1jkm<v30=2Tmpu7jg|49WhhrW
z<zu{c>lZgt5sl7Zu8o2lRs^>Bi+C9<$1*sbvm!<JVo|fx_)8aRZ#wPG9?P2^Bh`!a
zR4=YT{Vjw-D>lC6Y)1SuBgH~1HeSv*1FA3(ePtO2BAcK8`7sbIX^~n65|ZtR5l>&S
z@DDLwD4-g?LeVImNdID{L^8v8S7Lub>tQ*DCh94XGw3R8%Wa3Z>9uD+Y^Nw?GFq=|
zpCyi+^A4r6TvS?vU~Cq0GW6LmYJ3&qN<Zu>=?CK5;5(dthtiMi$T$$UU$#?+OQ0gU
zdN3JhK10}<kNs6(NJnog?(oqMetz>8-@19~o3W_y<{Qu6`qtk`=nn{^<9OHJBb|?V
zNf7ew@7@~v<*lK=Lz=fJGW=nfPY-_#CBrKTA4<5f^O)~=PZu)QBH?<CH{4#tAS=q#
zhp&eb&4DgCG@7DOW|CDQWA2KY3JG_ka`b4_P)XVhAF7I?SVc?Re<N&Hj%k=kkx()0
zr7qDvh6aC5HL~WKupH{})8HAy%zXtfs0Iz~KX7pG!A|6T;fPXYX0%mdemRPU-lap#
zFoE6UHERAR@;yxZdU}*`VB#^%lLP?mpvI%9%14`TQsaybrUfJ;t%z@X1Z{;oFQct*
zV0@IE(Z3KC4cf|xL0d+fpID+Pp^UaDe9AF>sOJQ9T^>JS9YA6rr-FpJwD+NqYt)8z
ze=<G#GUqVNmEfjUozsQT?3oC3XR<--2Qbil!<9cYedvJ^gW#Gex@PjOh7oR{C6wlT
zdhJtdNAwrdFExxW=3BP$TegK}l)toxpRsV1yR>P12jBJpIMEwrl_TyKSHHCSw%L$R
zYQg+^Ano*7n7wq|A_AbccV?aG`<uX!%~*4%b6RpD7!oxZLsC7AA)Du8<8qF@wa$3i
z3->#uaV^zjW4y`?s6vtCqQg++QXqu*C^Df!Mq_vn<Y0);psAUcelT)A<0OI9;`+8H
z>_v*2rAfLMiBrF5oQ;xhF>!c04cnD;i-{cuHQ`RsqCKg(w`l^>X;5#Bo1i^GjDU26
z?v59SRdyRea+XxC8wq6{QA^1vVL_?wxtTtP&)ID~YU@weBM7)Jv)g_&wLe3zGr$>8
zy=J1WWEiQd-+?pIgVvzqqFc?@_dAa{H1~vhN&3;OL&cP6L|LRlgJQ=9XTj_^Dk6Dg
z5EmT2`<`Rm>4|#J68k!pM9pDGr1zTna7OlHCKHV)CzuAM7X%R)RZ7qXhahdF1%(qP
zp1_n2N3xhio{Ly9NiZc%cifD-*^dxgtn1HIlBx<9$-H2uFCXNe=VF2S88Y&(Br?9R
zbCD}BBf5v&7D4_M1uCNZ)bn!($}dx(D%wiWrT&`4Req)QyPj|{=OX-7kblL!_oJl`
ze)XN3uMR0Gz5ny%S0j|(htEFu;VZ8%x%H!8L0WR_{L5ZYK!1GW+Yu3m_tw}q==jYa
zKK;?TUwrg~?|<~QU)+4^+h{<dp~}%dtUkwy2>Cw%5EV~Bo=w=WB~fQmkljTJ!c2|~
zC{uZ1`AogC3EBv^5T(}`Nykj^zY6LlET>tcP$5M|CmUyn@0*a`Bt=qxS=c_ifq5da
zWIR>+3F~o$D|)1d^Kn0=QT_}7ZYbZy!26!wwz0K&Ynzt>Q)uq6rERM>N*AN~qZD&c
zNgZR~KH3-VD>jeNW>{=g_BfmoYP?;3MB_cs(c2wZ(oo~=J?=y9AK%`Nz>*F3ZLh47
zy#;VF3%z8X&>x-9@8ecePnmTo>8tu~Y9lOaI?JLgDjp4Wlu3XlrRk%?Q}(k4#=TuV
zTvy<+$XJvf56UrAdGBvtx2<i9<a<G*We<V=9Fw-#{DkKvJcF2phFNq9n;td`avma!
zr2ir*7gtQ+G_4Lc7f(@*O$bwmg(LV|{fD|byP**aQ~H^ac>$&G?|8T~q7}<lXvKD7
zLbWEzPtZQ58GM6odx~!M3#yF~_$2|hWRp;rxf2Vj)J)4ndU)aNJ>K2XbxiU|>7b76
z1DG&!2>-}B!umkVRbmy+Q0ExGKq5y4zYwWP;;vlHRLG3O)42Y1VjRo>8pfdt>a$$$
z`Tn#0!w(9%jbd&ip9>22dd~7|Im?Bd6=Kecfz(iH4qv>PPo*M9azt3f1A_aY=sw7&
z9Smg^F%#fw$pDzoY8-W4cQ;*gBZf3(r5>;*aYla03q{Wt4L>I2H;DNSeE$5=&DZmm
zUdvl5<SiHTmJg&yGGSW<SC#0h;$3q`c3jU~d@XaakhxUMTsn}Vk=+&A7T?xQ24wCh
z<lG&~%o;?l$P(gz%831e)uJIQF<?40Cq!F$>5D@-o}q?w2hSZQWtJEAcA2w6S@U>x
z31uzi)g|O99jbb6=7pJ}XEyKI$j{pdTVzkkQ04HF(fz!qN$@m@o~FT;!It+u#X~19
zR9vX%J@q4-aaK<L`NL-qgK5j&qJQ60GLkoDyj0F_+`?yVMS)^0_kQBP0KrdX-VwCx
zG8=j4Y-I^Kn|O5z<xCswdgjQvBVtY+pR<miy$(ZfTFK|!H+X39&`|$qDW5Y>$eAbR
z%tPhs=0W2PWMw-1O!v8NF{d2oMh0NW?xYwkh0}(2jXr)g4=TUmRipFB+IbP=rrC==
zv6*uhf2IQ<bJVFoz3ORyLJ$A5Nmsz+>m!MyjOA3_Rl2B2m**W^%)93f&l}lst#s~y
zH6kTF#Cuj!xqlb$*ey7Ai;msAb$22$>B8X--n9_r)uvY#UtBEJ1#6RNZQ`v>cNvUj
zEj}ctn+>Z?x;HacG~v&<wPpUQOyfJtT-dmpX<t=fxmsYPda<7B)5=i)waLDw(D>_&
zX5*S%<8Lzc*!WGZ8BoOzk|dt7gXcgt|JB&RMDbKK(KC`}n-a5jn)u&Ix0sl<)5LX1
zx<zX+1=&O`{xwSSIA{uL5@R45hn(61@?4ugPnk#~D#fM57+rdw?V={aI5Lphe8wmX
zhAmTctKWk7>(=8I>@_R)T7%X}?von-K42eGx>Nd*F*Il;Vv%J6HGmDYB!~>-RFm3Z
zWX!%y$p>*z&pqsOF&jWL*fAHi#~2-15{(`54-62k+nArveKAXYkBiyrZN~0K=Qll=
zKCIBpMjJ#Qa;Ogoi<j%m^W}Hx59%=so(qOxD%cm5<XzpSO-I&@@ul!;mPPfX9aE<k
zk(n{M|FO*2y=f)r7zRxh`|}m5XY;teOPAoxBJG*bWjKRQZeGyoON*|&1XmZUujUGr
zapKi2_==;gsjmWaorZ`%nf}^DZ;&$5yf(rRW^$S`eo*{(AVJGs-*mFp{Eop_0){u<
zJ8Jfo$}4}t-`L783$J{{Xz^7XH25kphALk*W?<$8<NsR!(bPGUtp6JITKpff25S?p
zK6`>FI*Gokb$9$-HT#O?^<6p1SGGR9*76VjPw;h3_+6Z(e%jnp)%PmV*K}5w?x4m3
zDw%KNL7iHBroOlQ)mxU}+hqB&Up>S$OCk+cg1dWt4U>HtlWW^I8<c{MgSc~87WOK!
zm2bAMQ9VbXB@$!$IhyZXwQueP)8F=YF5ybles}&>SHZma-=^fAf7o_!QaXqUl?$V*
z0#<kT_q&vuf8Ts2R9>LWlCGxE;tG`&l&6v!SG`plp>ixOp?+ss1gn&=keU5e2$>i5
zZpSD-`qg(oKKcBulP}-;$?1=N@GM*^NS^%k;0Le2L^gO#R#?BU!{1rY1k3}s2LAr$
zPk#itbj0@H)Xk@#`C#nit&1;yc;SVc|McCDM!$v@qEcpsx}Icd8<;@3mt0bAUHFGc
zBWG@%AHMbDXQe(!LcLy!?f2muuiqSfCL(HOl3nh1B$gwiE$&?cI|)1q;Z~oe9+I{C
zhZ{aF#+BULwErD|zNPj4PVQmkxAE7@B5QyBQOIVyFuacLT6u5WofFn@$Pho*h=zMf
zk)oM3?l*KZ0bnAfr#EoCH^4#lq+{askFQd1NP5{z1f^0&?!9j<oK!yi`D-^{|F2%y
z_tEEq1zX}Mk4s-=wBM2>y*|+SXrMN>-kX98rMY94gCCyz5&QeW&z?i8U!_*Z3H%%N
zlBN~WME;rTzoj1Ak9Tm0e}f<dQsja@QUypiK?k`jbmFfGJdP`Sa{%P|QVoE+K_~qy
zf%gggcYr>d+)$rVNE_(%N9-|TGsu&buR>BQ(&n!Syhq?)2wW#XIua=r>vF2?AwUL4
zQc#Gb1+v^X=~0EKMRuzZYNCcVncVpgRHLC!m@sZX*F}f#Ob$z<mF2MKakr024!au~
zbB!FfS#NGkLJ<4c5wlWqce8Er&<^(JMqb5;ab%Z}w@}O@Ih3ZrTEd+JNnQGbQZo4A
z`Fu?~U&6#&xx0nj-D2);9@5q6Wy3pPnl@TGdib^a!9xS9LWNa);i8c(qxl#246F}1
z;BBtA-4}JVSil!AylUp%8wB?T(Y=9B+Yqwm3}n#1P+9G0x=^-+zYn6ZeJBH#kR$i$
zuRQgYA-~`#6&<AmruS2GhU%`RRtl+=AxGY@iFcHtgmMdpx`f<{K@)-`T+gk!mRmEr
z{rcQB*XFL_H*MkPt`X*L73Xf{b8Cd$ZDQ^=Sc#;=ZgDceKd>`YQ24^U=jRQV@l{<y
zNmr<0;iaAYmIwG<-TdaG{H9}kYY$&>90fkvx6Qi364;0oHbTT)*hs=z++a%Z{=BBp
z^cgSbe=q;Vf|m;Tf*MUh+yjfM5m?}4)<OWBRO?A}Al@mGwN30DjH>xUqKS0$M73}7
zDZTTftS52qVAo~mpI>!$)zA(ht6a<~=d)@?O0K&buDKgVYXtW)(Y=g!w_TczT*UQ_
zyleZIX>8LQmS3g5o_cAmuwbLOU?X-uTRP|?>HZL8-PI90p_%;s+vTN?R3Nzp=lX`{
zzuGctdS&&+)uX;q|ETZceSFE{t8@9>O+xM_F?SR1L~;=1*BmL}oA>b#K12|ucs~{H
z5#If%;C@teKgy>)3YE*y%xkGLgwz>dYWb$n@|_H*m+uy#WDAyWXi*Elg?aUCeu!`A
zKncxXdPzUp4Kt_8R<a5sn4+6G`?ifOXA>=F020yThEoHpZvLXF7IdnrnNO%y=mC;z
z|L)FX%P7trjH($#t}j~9s(q7B@|_=LJ&ALNj7b)Bm85H<Z}A;3$V<gYVMArFPfoVY
zr*$GI%XN3<HFxD`?)8TDYYpvJH}ehcLc>O}VI!Qtq_FtpfOHUxVrqzF?TFMfbmW=?
z;s2}T&*n&xP%`h*qx8Mpd6Zvr428awMz*x{w6p-Q=;+Z;2|`nUDb1=z@G+)^rP`Oo
zeeUQK_Bi9*Aw{=Azghq8j^FG+a$I5kgW~!J`5fP~`-jS2sC>Q>nxhpXa|F*U(KBl_
zQ}i@m_sqZMnLn0#3E_-ZiJnzL&T27dHIK622bEebBIxL$>tk_$h9CKfakTY^w%2T9
zWn+zFWv@B-^5s{1`GRdi!8WmA+igeu=S3cF2cbHQe{}MvjEn+OP!GOsKfkAgAWDgk
zivLkQ_c0;&F){bC+nMnj|1!6}ou$i~F=FD~H7KEiX)i2(elcIUkYBV`C|D;JtV2Ae
z2$ml42qle#q*sOJEgIW4y60*K)Qy#!u!IS|kELf}OV3D44*>XxmfqALC5f+^P1OvL
zBP~AFzGUunCs#<wF?IxYJgoDNo_%!KCgfI&xd^J1{NkB$@1Nl3<&lUmyZDk#R37T&
za}Nl)2gKY1<c}He8}p@>%w4T<=?!3W8ox`*S0w6>N#8HC1eo{B9jSFk=8UwA%z0@Y
z?+NE0<E^tb1s(bV*xB5Ozkae>Io*=`05VyXHUf_4Hc!W&D+{VuHX7e9Em-L^zrECj
z`a4ehN{{UwkCEy{da4(*`g9l0f2YyDa*5@gB}UY*>h!2z)vusdf0JK8aBi~>fBt!H
z?fORJZ%Yf-JI%jc>O%c@PWyU~?ROp{)r<60FJ^Vt>hBuu>z7!5$6EcpPLKNU_09Qc
z=-q-mf^%j8@@2ITWElll!KP(qq1Hw9W%kWB+cldJ^=oN*s;93=!G`FjzKZ1qsK2MD
z`g>W;25kIGZozhw`Cn$!)z?k-?HRV~8FcmaOg+_I%_eMwa_EXsRUYbpU|0Vk%l<&I
z<qyR)>OV}^Q@w=ME9|>0#y>PPr|vQsCl>3m@xL3)fcwE0%0KXTIx<@P^xsfBuM6Nw
zM1E>XP`^&;xvDva(4p~7aeev#vHanmS|W*9D2c8z1Qc4&q^~jt6q?MWuQCP5ApA~y
zXb#939pL5wPWd14U;0flu9Sdm#Ciu;SpstIg*&*)8pw+D=nk&31xRiZ{v|ywyE1Z1
z(pRMhJdr!yK@Zac3Ylio_exi09!UDCjDYtpdgut0+{IPSK-pbfl^H0%i>q9L%DcGA
zt;~Or^c-ddYVP7**@3#dxGE<wEAdr6<e90;-N1yG6BdNf>F)9eCM=Q}qM!Q~uAHz_
zH09po-8~&XsSZDE2plKuEDAVDXHoZcaeMc3oiLP@>fv*&w4b%ff}VuWuu`y@=-x<s
zv=>&tNaj6}M)gR_(g~KpG#Zd*LJFYL*}?5UG{M@UP$Lr=VdKfL1GT&zcEXx)XpAdW
zJ4nh`l}`~$bR0|IVC6awVlFy4j-=h(Q359kFp2P2NUr!@0;Kols_>!XY6&zFSU_MI
zfo1|532Y%i`PWz&S1BIKN!lczFplgyIT9{H<hvJlnJ{n%l(B&(99_q{0(;5i8B*`w
z?oRFpIC&O&>i@sdfs?u$cK4~7XJ(#kxnau}Yz3mN;N*&sDdowvUtK$B{Z5@=suE3A
zys0X(&-R^Vf@!8`n#r4HPPQ-JwQ27a&k{@xqN#y5HAF7{OYF42S6CyMYDH5mZ>pX2
zM#-NUx1SmBdFKeGxuR(<Z<-sv5kkzqSF%7bEfh@)dDFr>zJ2`b6YZV;UTKqHS|pkl
z@uo#`4^(?`07VK8ZP>t^D`65(pE~^cI{h(l|4ys%j{sH86PCRcm3Z&o30r_e4C#Fx
z`;Rc;`h=_F5PNI6I_Xd6v4`2hpYU`XKfbYdUw7C3y2$E3(0dG#6nc(HF9ochBPVqC
z9OQ_MVM6<fbpMI&9<I)}?>Jm7{Txv$k`mxH)rgjzFhOC{8TVy+na;UL;GYP*M&Ks|
zrqO6B2$T`1Bv4DBfxz$Rl;0D$k2W>0WDo6Q%837<Q+`a~RRYK9z@G_xOu$8NUKW9A
z1WF0qyVse$rc%&+(jPG^?>|`=OYiVf?x(mLI-&Ew3wjd_tRC@04SEy!41g4!embx7
zDoaRL$*W69H=kFRkgl4KS3<ffUR^@E0{%|Q?G&3Hv5IAoSE>g~ErWIXRN9t7;dVW3
zD`3EorFY-f$)K*3+Easd`fR=PwoV4K(r8l##ZKCkLAg<nh`TZ<)WMQj=enJeM)y&J
zVuOA?i9MsxZqT!Q%u#4J>C?fwM?i*4pLts+gK7tD%Am}xhmu7GHT&6c6>y!go$XS<
z&4!sYCo<TrPp6*Bz+0e)HM$HIXX;(Ibuy@w53o~k6w{{$l?$kS89a>HL<?##%R>8P
zkY&;@qd_Y{hDqOy$%=tai@t&`Re~(_COevyL*0<UY&UJnpeBztWiT(FHf69NgEnPQ
zl1`g4@MhDd3}!iLQwHTO+LS@{TJ``GaJNBTuWaSUEZR(JKn9gHv?+r<`c}QZ@wQF@
QHyHBtuxO73>_h$k1K?tb)&Kwi

literal 0
HcmV?d00001

diff --git a/rag/init.py b/rag/init.py
index 977e245..63955c5 100644
--- a/rag/init.py
+++ b/rag/init.py
@@ -165,15 +165,26 @@ async def search_handler(request, params_kw, *args, **kwargs):
 
 
 async def _resolve_search_kbs(env, userorgid, kb_id):
-    """Resolve KB IDs: specific or all org KBs"""
+    """Resolve KB IDs: specific or all org KBs。
+    机构隔离 + 检索角色过滤（search_roles 为空=同机构默认可检）。"""
     async with get_sor_context(env, 'rag') as sor:
         if kb_id:
             recs = await sor.R("rag_knowledge_bases", {"id": kb_id})
-            return [r.id for r in recs]
-        # All org KBs (global + org-specific)
-        sql = "SELECT id FROM rag_knowledge_bases WHERE org_id IS NULL OR org_id=${org_id}$"
-        recs = await sor.sqlExe(sql, {"org_id": userorgid})
-        return [r.id for r in recs]
+            cands = list(recs or [])
+        else:
+            # All org KBs (global + org-specific)
+            sql = "SELECT * FROM rag_knowledge_bases WHERE org_id IS NULL OR org_id=${org_id}$"
+            recs = await sor.sqlExe(sql, {"org_id": userorgid})
+            cands = list(recs or [])
+        user_id = await env.get_user()
+        roles = await _get_user_roles_for(sor, user_id)
+        out = []
+        for r in cands:
+            if str(r.org_id or '') not in ('', str(userorgid or '')):
+                continue  # 跨机构 KB 不可检
+            if _role_match(roles, getattr(r, 'search_roles', '')):
+                out.append(r.id)
+        return out
 
 
 async def _build_search_vector(query, file_data, file_name, env=None, kb_id=''):
@@ -278,6 +289,110 @@ def _fmt_bytes(n):
     return str(round(n/1048576, 1)) + 'MB'
 
 
+# ────────────────────────── 机构 rags 目录 + 容量参数 + KB 角色权限 ──────────────────────────
+# 2026-09-02 需求：
+#  1) 产线平台各机构目录下开设 rags/ 目录，rag 模块创建的知识库文件都存放在该目录
+#     （{workspace_base}/{org_id}/rags/{kb_id}/，workspace_base 与产线工作空间同参数）；
+#  2) 容量检查不独立硬查，由 appbase params 参数 rag_check_storage_quota 控制（默认不检查）；
+#  3) 每个知识库可独立设置维护角色(maintain_roles)/检索角色(search_roles)，
+#     用户实际操作（上传/删除/改名/检索/下载）按角色做权限控制。
+
+_RAGS_BASE_DEFAULT = '/d/pipeline/workspaces'
+
+
+async def _get_param_value(sor, name, default=""):
+    """读 appbase params 表（params_name/params_value），表/行不存在返回 default。"""
+    try:
+        recs = await sor.sqlExe(
+            "SELECT params_value FROM params WHERE params_name=${n}$ LIMIT 1", {"n": name})
+        await sor.sqlExe("COMMIT", {})
+        if recs:
+            v = getattr(recs[0], 'params_value', None)
+            if v is not None and str(v).strip() != '':
+                return str(v)
+    except Exception as e:
+        debug(f"rag _get_param_value({name}) failed: {e}")
+    return default
+
+
+async def get_rags_base(sor):
+    """机构 rags 根目录 = 产线工作空间根（workspace_base 参数）下，与机构目录同级。"""
+    return await _get_param_value(sor, 'workspace_base', _RAGS_BASE_DEFAULT)
+
+
+def kb_dir_for(base, org_id, kb_id):
+    """{base}/{org_id}/rags/{kb_id}。org_id 空兜底 '0'。"""
+    return os.path.join(base, str(org_id or '0'), 'rags', str(kb_id))
+
+
+def ensure_kb_dir(base, org_id, kb_id):
+    """确保知识库目录存在（含机构 rags 父目录），返回绝对路径。"""
+    d = kb_dir_for(base, org_id, kb_id)
+    os.makedirs(d, exist_ok=True)
+    return d
+
+
+async def _get_user_roles_for(sor, user_id):
+    """查用户 RBAC 角色（{orgtypeid}.{name} 格式，与产线惯例一致）。"""
+    roles = ['any', 'logined']
+    if not user_id:
+        return roles
+    try:
+        recs = await sor.sqlExe(
+            "SELECT r.orgtypeid, r.name FROM userrole ur JOIN role r ON ur.roleid=r.id "
+            "WHERE ur.userid=${u}$", {"u": user_id})
+        await sor.sqlExe("COMMIT", {})
+        for r in (recs or []):
+            o = getattr(r, 'orgtypeid', '') or ''
+            n = getattr(r, 'name', '') or ''
+            if o and n:
+                roles.append(f"{o}.{n}")
+                roles.append(f"{o}.*")
+    except Exception as e:
+        debug(f"rag _get_user_roles_for failed: {e}")
+    return roles
+
+
+def _role_match(user_roles, allowed_csv):
+    """allowed_csv 为空 → 默认放行（同机构登录用户）；'*' → 全部；否则按角色名精确/通配匹配。"""
+    allowed = [x.strip() for x in str(allowed_csv or '').split(',') if x.strip()]
+    if not allowed:
+        return True
+    if '*' in allowed:
+        return True
+    ur = set(user_roles or [])
+    for a in allowed:
+        if a in ur:
+            return True
+        if a.endswith('.*'):
+            prefix = a[:-1]
+            if any(r.startswith(prefix) for r in ur):
+                return True
+    return False
+
+
+async def check_kb_perm(env, sor, kb_id, perm):
+    """KB 级角色权限校验。perm='maintain'|'search'。
+    返回 (ok, kb, msg)。机构隔离：kb 不属于用户机构 → 拒绝。
+    角色为空 → 同机构登录用户默认放行。"""
+    userorgid = await env.get_userorgid()
+    user_id = await env.get_user()
+    recs = await sor.sqlExe(
+        "SELECT * FROM rag_knowledge_bases WHERE id=${k}$ LIMIT 1", {"k": kb_id})
+    await sor.sqlExe("COMMIT", {})
+    if not recs:
+        return False, None, "知识库不存在"
+    kb = recs[0]
+    if str(kb.org_id or '') != str(userorgid or ''):
+        return False, kb, "无权访问其他机构的知识库"
+    allowed = kb.maintain_roles if perm == 'maintain' else kb.search_roles
+    roles = await _get_user_roles_for(sor, user_id)
+    if not _role_match(roles, allowed):
+        label = '维护' if perm == 'maintain' else '检索'
+        return False, kb, f"无{label}权限：该知识库限角色 [{allowed}]，当前角色不匹配"
+    return True, kb, ""
+
+
 async def doc_upload_handler(request, params_kw, *args, **kwargs):
     """文件上传 → 保存 → DB记录 → 触发RAG入库"""
     env = request._run_ns
@@ -296,21 +411,37 @@ async def doc_upload_handler(request, params_kw, *args, **kwargs):
 
         file_size = len(file_data)
 
-        # ---- ORG STORAGE QUOTA CHECK (per-org limit, not global) ----
-        quota_limit = 104857600
-        used = 0
+        # ---- KB 级维护权限校验（机构隔离 + 角色） ----
         async with get_sor_context(env, 'rag') as sor:
-            rec = await sor.sqlExe("SELECT COALESCE(SUM(file_size),0) AS used FROM rag_documents WHERE org_id=${org_id}$", {"org_id": userorgid})
-            if rec: used = int(rec[0].used)
-            lim = await sor.sqlExe("SELECT limit_bytes FROM rag_org_storage_limits WHERE org_id=${org_id}$", {"org_id": userorgid})
-            if lim: quota_limit = int(lim[0].limit_bytes)
-        if used + file_size > quota_limit:
-            return json.dumps({"error": "storage_quota_exceeded",
-                "message": "存储配额超限：机构已用 " + _fmt_bytes(used) + "，限额 " + _fmt_bytes(quota_limit) + "，本文件 " + _fmt_bytes(file_size)}, ensure_ascii=False)
+            ok, kb, msg = await check_kb_perm(env, sor, kb_id, 'maintain')
+        if not ok:
+            return json.dumps({"error": "kb_perm_denied", "message": msg}, ensure_ascii=False)
 
-        # Save file via FileStorage (layered dir layout, returns web path e.g. /191/193/197/97/xxx.txt)
+        # ---- 机构存储容量检查（参数化：rag_check_storage_quota 默认不检查） ----
+        async with get_sor_context(env, 'rag') as sor:
+            check_quota = str(await _get_param_value(sor, 'rag_check_storage_quota', '0')).strip().lower()
+        if check_quota in ('1', 'true', 'yes', 'on'):
+            quota_limit = 104857600
+            used = 0
+            async with get_sor_context(env, 'rag') as sor:
+                rec = await sor.sqlExe("SELECT COALESCE(SUM(file_size),0) AS used FROM rag_documents WHERE org_id=${org_id}$", {"org_id": userorgid})
+                if rec: used = int(rec[0].used)
+                lim = await sor.sqlExe("SELECT limit_bytes FROM rag_org_storage_limits WHERE org_id=${org_id}$", {"org_id": userorgid})
+                if lim: quota_limit = int(lim[0].limit_bytes)
+            if used + file_size > quota_limit:
+                return json.dumps({"error": "storage_quota_exceeded",
+                    "message": "存储配额超限：机构已用 " + _fmt_bytes(used) + "，限额 " + _fmt_bytes(quota_limit) + "，本文件 " + _fmt_bytes(file_size)}, ensure_ascii=False)
+
+        # ---- 保存到机构 rags 目录：{workspace_base}/{org}/rags/{kb}/ ----
         doc_id = uuid.uuid4().hex
-        web_path = await env.save_file(file_data, file_name)
+        async with get_sor_context(env, 'rag') as sor:
+            rags_base = await get_rags_base(sor)
+        kb_dir = ensure_kb_dir(rags_base, userorgid, kb_id)
+        safe_name = (file_name or 'upload.bin').replace('/', '_').replace('\\', '_')
+        disk_name = doc_id[:8] + '_' + safe_name
+        with open(os.path.join(kb_dir, disk_name), 'wb') as f:
+            f.write(file_data)
+        web_path = '/rags/' + str(userorgid or '0') + '/' + str(kb_id) + '/' + disk_name
 
         file_type = _detect_file_type(file_name, "application/octet-stream")
 
@@ -379,6 +510,11 @@ async def doc_delete_handler(request, params_kw, *args, **kwargs):
                 return json.dumps({"error": "document not found"})
             doc = recs[0]
 
+            # KB 级维护权限校验（机构隔离 + 角色）
+            ok, kb, msg = await check_kb_perm(env, sor, doc.kb_id, 'maintain')
+            if not ok:
+                return json.dumps({"error": "kb_perm_denied", "message": msg}, ensure_ascii=False)
+
             # Get chunks to clean VDB
             chunks = await sor.R("rag_document_chunks", {"doc_id": doc_id})
 
@@ -409,9 +545,17 @@ async def doc_delete_handler(request, params_kw, *args, **kwargs):
                 "UPDATE rag_knowledge_bases SET doc_count=GREATEST(doc_count-1,0), total_size=GREATEST(total_size-${size}$,0), chunk_count=GREATEST(chunk_count-${n}$,0) WHERE id=${kb_id}$",
                 {"size": doc.file_size, "n": len(chunks), "kb_id": doc.kb_id})
 
-        # Delete file from disk
+        # Delete file from disk（/rags/{org}/{kb}/{disk} 新布局；旧 /idfile/ 兼容）
         file_path = doc.file_path
-        if file_path and file_path.startswith("/idfile/"):
+        if file_path and file_path.startswith("/rags/"):
+            parts = [p for p in file_path.split('/') if p]
+            if len(parts) >= 4:
+                async with get_sor_context(env, 'rag') as sor:
+                    rags_base = await get_rags_base(sor)
+                real_path = os.path.join(rags_base, parts[1], 'rags', parts[2], parts[3])
+                if os.path.isfile(real_path):
+                    os.remove(real_path)
+        elif file_path and file_path.startswith("/idfile/"):
             real_path = os.path.join(os.path.dirname(os.path.abspath(__file__)), "files",
                                      os.path.basename(file_path))
             if os.path.exists(real_path):
@@ -424,6 +568,52 @@ async def doc_delete_handler(request, params_kw, *args, **kwargs):
         return json.dumps({"error": str(e)})
 
 
+async def file_serve_handler(request, params_kw, *args, **kwargs):
+    """知识库文件下载/预览：search 角色校验 + 机构隔离，base64 返回（前端 Blob 下载）。
+    堵住 /idfile/ 猜路径越权：rags 目录文件不暴露给 idfile，只能经此端点取。"""
+    import base64, mimetypes as _mt
+    env = request._run_ns
+    try:
+        doc_id = params_kw.get("doc_id", "")
+        if not doc_id:
+            return json.dumps({"error": "doc_id required"})
+        async with get_sor_context(env, 'rag') as sor:
+            recs = await sor.R("rag_documents", {"id": doc_id})
+            if not recs:
+                return json.dumps({"error": "document not found"})
+            doc = recs[0]
+            ok, kb, msg = await check_kb_perm(env, sor, doc.kb_id, 'search')
+            if not ok:
+                return json.dumps({"error": "kb_perm_denied", "message": msg}, ensure_ascii=False)
+            fp = doc.file_path or ''
+            if fp.startswith('/rags/'):
+                parts = [p for p in fp.split('/') if p]
+                if len(parts) < 4:
+                    return json.dumps({"error": "bad file path"})
+                rags_base = await get_rags_base(sor)
+                real_path = os.path.join(rags_base, parts[1], 'rags', parts[2], parts[3])
+            elif fp.startswith('/idfile/'):
+                real_path = os.path.join(os.path.dirname(os.path.abspath(__file__)), "files",
+                                         os.path.basename(fp))
+            else:
+                return json.dumps({"error": "file path not served"})
+            if not os.path.isfile(real_path):
+                return json.dumps({"error": "file missing on disk"})
+            with open(real_path, 'rb') as f:
+                data = f.read()
+        mime = _mt.guess_type(doc.file_name or '')[0] or 'application/octet-stream'
+        return json.dumps({
+            "status": "SUCCEEDED",
+            "file_name": doc.file_name,
+            "mime": mime,
+            "size": len(data),
+            "b64": base64.b64encode(data).decode('ascii')
+        }, ensure_ascii=False)
+    except Exception as e:
+        exception(f"file_serve: {e}, {format_exc()}")
+        return json.dumps({"error": str(e)})
+
+
 def _detect_file_type(name, mime):
     """Detect file type from name and MIME"""
     ext = os.path.splitext(name)[1].lower()
@@ -678,6 +868,10 @@ async def dir_create_handler(request, params_kw, *args, **kwargs):
         if not kb_id or not dir_name:
             return json.dumps({"error": "kb_id and dir_name required"})
         async with get_sor_context(env, 'rag') as sor:
+            # KB 维护角色校验
+            ok, kb, msg = await check_kb_perm(env, sor, kb_id, 'maintain')
+            if not ok:
+                return json.dumps({"error": "kb_perm_denied", "message": msg}, ensure_ascii=False)
             dir_id = uuid.uuid4().hex
             await sor.sqlExe(
                 "INSERT INTO rag_document_chunks (id, doc_id, kb_id, chunk_index, chunk_type, content, description, created_at) "
@@ -697,6 +891,13 @@ async def dir_delete_handler(request, params_kw, *args, **kwargs):
         if not item_id:
             return json.dumps({"error": "item_id required"})
         async with get_sor_context(env, 'rag') as sor:
+            # KB 维护角色校验（按节点反查 kb_id）
+            recs = await sor.sqlExe("SELECT kb_id FROM rag_document_chunks WHERE id=${id}$", {"id": item_id})
+            await sor.sqlExe("COMMIT", {})
+            _kb_id = getattr(recs[0], 'kb_id', '') if recs else ''
+            ok, kb, msg = await check_kb_perm(env, sor, _kb_id, 'maintain')
+            if not ok:
+                return json.dumps({"error": "kb_perm_denied", "message": msg}, ensure_ascii=False)
             await sor.sqlExe("DELETE FROM rag_document_chunks WHERE id=${id}$ OR doc_id=${id}$", {"id": item_id})
             return json.dumps({"status": "SUCCEEDED"})
     except Exception as e:
@@ -1133,6 +1334,7 @@ def init_rag_module():
     rf.register("search", search_handler)
     rf.register("doc_upload", doc_upload_handler)
     rf.register("doc_delete", doc_delete_handler)
+    rf.register("file_serve", file_serve_handler)
     rf.register("dir_create", dir_create_handler)
     rf.register("dir_delete", dir_delete_handler)
     rf.register("dir_list", dir_list_handler)
diff --git a/wwwroot/knowledge_bases_list/add_tag.dspy b/wwwroot/knowledge_bases_list/add_tag.dspy
index 7507beb..ca862d1 100644
--- a/wwwroot/knowledge_bases_list/add_tag.dspy
+++ b/wwwroot/knowledge_bases_list/add_tag.dspy
@@ -4,6 +4,14 @@ tag = ns.get('tag', '').strip()
 kb_id = ns.get('kb_id', '')
 env = request._run_ns
 
+# KB 维护角色校验（机构隔离 + 角色）
+from rag.init import check_kb_perm
+db = DBPools()
+async with db.sqlorContext(get_module_dbname('rag')) as sor:
+    _ok, _kb, _msg = await check_kb_perm(env, sor, kb_id, 'maintain')
+if not _ok:
+    return json.dumps({"status": "error", "error": _msg}, ensure_ascii=False)
+
 if not doc_id or not tag:
     return json.dumps({"status": "error", "error": "doc_id and tag required"}, ensure_ascii=False)
 
diff --git a/wwwroot/knowledge_bases_list/create_kb.dspy b/wwwroot/knowledge_bases_list/create_kb.dspy
index 1444eb4..c742c38 100644
--- a/wwwroot/knowledge_bases_list/create_kb.dspy
+++ b/wwwroot/knowledge_bases_list/create_kb.dspy
@@ -11,10 +11,18 @@ async with db.sqlorContext(dbname) as sor:
     emb_type = ns.get("embedding_type", "") or ns.get("embedding_engine", "")
     if emb_type not in ("bge-m3", "clip-vith14", "qwen3-vl-embedding"):
         emb_type = "bge-m3"
+    # 知识库级角色权限：维护角色/检索角色（逗号分隔，空=同机构默认可用）
+    maintain_roles = ns.get("maintain_roles", "") or ""
+    search_roles = ns.get("search_roles", "") or ""
     await sor.sqlExe(
-        "INSERT INTO rag_knowledge_bases (id, name, description, org_id, embedding_engine, vdb_collection, doc_count, total_size, chunk_count, status, created_at) "
-        "VALUES (${id}$, ${name}$, ${desc}$, ${org_id}$, ${emb}$, 'rag_collection', 0, 0, 0, 'active', NOW())",
-        {"id": kb_id, "name": name, "desc": desc, "org_id": userorgid, "emb": emb_type})
+        "INSERT INTO rag_knowledge_bases (id, name, description, org_id, embedding_engine, vdb_collection, doc_count, total_size, chunk_count, status, maintain_roles, search_roles, created_at) "
+        "VALUES (${id}$, ${name}$, ${desc}$, ${org_id}$, ${emb}$, 'rag_collection', 0, 0, 0, 'active', ${mr}$, ${sr}$, NOW())",
+        {"id": kb_id, "name": name, "desc": desc, "org_id": userorgid, "emb": emb_type,
+         "mr": maintain_roles, "sr": search_roles})
+    # 机构 rags 目录下建知识库子目录：{workspace_base}/{org}/rags/{kb}/
+    from rag.init import get_rags_base, ensure_kb_dir
+    rags_base = await get_rags_base(sor)
+    ensure_kb_dir(rags_base, userorgid, kb_id)
     return {
         "widgettype": "urlwidget",
         "options": {"url": entire_url('/rag/knowledge_bases_list/index.ui')}
diff --git a/wwwroot/knowledge_bases_list/delete_file.dspy b/wwwroot/knowledge_bases_list/delete_file.dspy
index 7f23db9..32b6030 100644
--- a/wwwroot/knowledge_bases_list/delete_file.dspy
+++ b/wwwroot/knowledge_bases_list/delete_file.dspy
@@ -4,6 +4,15 @@ kb_id = ns.get('kb_id', '')
 folder_id = ns.get('folder_id', '')
 folder_label = ns.get('folder_label', '全部文件')
 
+# KB 维护角色校验（机构隔离 + 角色）
+from rag.init import check_kb_perm
+env = request._run_ns
+db = DBPools()
+async with db.sqlorContext(get_module_dbname('rag')) as sor:
+    _ok, _kb, _msg = await check_kb_perm(env, sor, kb_id, 'maintain')
+if not _ok:
+    return json.dumps({"status": "error", "error": _msg}, ensure_ascii=False)
+
 if not doc_id:
     return json.dumps({"status": "error", "error": "doc_id required"}, ensure_ascii=False)
 
diff --git a/wwwroot/knowledge_bases_list/delete_kb.dspy b/wwwroot/knowledge_bases_list/delete_kb.dspy
index d1a5c3e..c17c534 100644
--- a/wwwroot/knowledge_bases_list/delete_kb.dspy
+++ b/wwwroot/knowledge_bases_list/delete_kb.dspy
@@ -7,6 +7,15 @@ if not kb_id:
     return {"widgettype": "urlwidget",
             "options": {"url": entire_url('/rag/knowledge_bases_list/index.ui')}}
 
+# KB 维护角色校验（机构隔离 + 角色）
+from rag.init import check_kb_perm
+env = request._run_ns
+db = DBPools()
+async with db.sqlorContext(get_module_dbname('rag')) as sor:
+    _ok, _kb, _msg = await check_kb_perm(env, sor, kb_id, 'maintain')
+if not _ok:
+    return {"widgettype": "Text", "options": {"text": "⛔ " + _msg, "cfontsize": 13, "color": "#f56c6c", "halign": "center"}}
+
 env = request._run_ns
 userorgid = await env.get_userorgid()
 deleted = {"documents": 0, "chunks": 0, "tags": 0, "media_tags": 0,
diff --git a/wwwroot/knowledge_bases_list/delete_tree_item.dspy b/wwwroot/knowledge_bases_list/delete_tree_item.dspy
index 42ce8b8..ab1a21c 100644
--- a/wwwroot/knowledge_bases_list/delete_tree_item.dspy
+++ b/wwwroot/knowledge_bases_list/delete_tree_item.dspy
@@ -2,6 +2,16 @@ ns = params_kw.copy()
 db = DBPools()
 dbname = get_module_dbname('rag')
 async with db.sqlorContext(dbname) as sor:
-    await sor.sqlExe("DELETE FROM rag_document_chunks WHERE id=${id}$", {"id": ns.get("id","")})
-    return {"widgettype": "Message", "options": {"user_data": {"id": ns.get("id","")}}}
+    _id = ns.get("id", "")
+    # KB 维护角色校验（按节点反查 kb_id）
+    _recs = await sor.sqlExe("SELECT kb_id FROM rag_document_chunks WHERE id=${id}$", {"id": _id})
+    await sor.sqlExe("COMMIT", {})
+    _kb_id = getattr(_recs[0], 'kb_id', '') if _recs else ''
+    from rag.init import check_kb_perm
+    env = request._run_ns
+    _ok, _kb, _msg = await check_kb_perm(env, sor, _kb_id, 'maintain')
+    if not _ok:
+        return json.dumps({"status": "error", "error": _msg}, ensure_ascii=False)
+    await sor.sqlExe("DELETE FROM rag_document_chunks WHERE id=${id}$", {"id": _id})
+    return {"widgettype": "Message", "options": {"user_data": {"id": _id}}}
 return {"error": "failed"}
diff --git a/wwwroot/knowledge_bases_list/file_list.dspy b/wwwroot/knowledge_bases_list/file_list.dspy
index 574affc..e4c0aef 100644
--- a/wwwroot/knowledge_bases_list/file_list.dspy
+++ b/wwwroot/knowledge_bases_list/file_list.dspy
@@ -9,6 +9,14 @@ if folder_id == '__root__':
 db = DBPools()
 dbname = get_module_dbname('rag')
 
+# KB 检索角色校验（机构隔离 + 角色）：无 search 权限不列文件
+from rag.init import check_kb_perm
+env = request._run_ns
+async with db.sqlorContext(dbname) as sor:
+    _ok, _kb, _msg = await check_kb_perm(env, sor, kb_id, 'search')
+if not _ok:
+    return {"widgettype": "Text", "options": {"text": "⛔ " + _msg, "cfontsize": 13, "color": "#f56c6c", "halign": "center", "marginTop": "40px"}}
+
 rows = []
 try:
     async with db.sqlorContext(dbname) as sor:
@@ -69,6 +77,17 @@ else:
         file_url = f["file_path"]
         if not file_url.startswith("/idfile"):
             file_url = "/idfile" + file_url
+        # 查看/下载统一走 file_serve.dspy（search 角色校验），不再直连 /idfile/
+        serve_url = "/rag/knowledge_bases_list/file_serve.dspy?_webbricks_=1&doc_id=" + f["id"]
+        view_script = ("fetch(" + json.dumps(serve_url) + ").then(function(r){return r.json()}).then(function(d){"
+                       "if(d.error){alert(d.message||d.error);return}"
+                       "var bin=atob(d.b64);var arr=new Uint8Array(bin.length);for(var i=0;i<bin.length;i++)arr[i]=bin.charCodeAt(i);"
+                       "var u=URL.createObjectURL(new Blob([arr],{type:d.mime}));window.open(u,'_blank')})")
+        dl_script = ("fetch(" + json.dumps(serve_url) + ").then(function(r){return r.json()}).then(function(d){"
+                     "if(d.error){alert(d.message||d.error);return}"
+                     "var bin=atob(d.b64);var arr=new Uint8Array(bin.length);for(var i=0;i<bin.length;i++)arr[i]=bin.charCodeAt(i);"
+                     "var u=URL.createObjectURL(new Blob([arr],{type:d.mime}));var a=document.createElement('a');a.href=u;a.download=d.file_name||'file';"
+                     "document.body.appendChild(a);a.click();document.body.removeChild(a)})")
         del_url = "/rag/knowledge_bases_list/delete_file.dspy?_webbricks_=1&kb_id=" + kb_id + "&doc_id=" + f["id"] + "&folder_id=" + folder_id + "&folder_label=" + folder_label
         display_name = trunc_name(f["file_name"])
 
@@ -90,10 +109,10 @@ else:
                     "subwidgets": [
                         {"widgettype": "Text", "options": {"text": "👁", "cfontsize": 14, "css": "clickable", "color": "#4a90d9", "title": "查看"},
                          "binds": [{"wid": "self", "event": "click", "actiontype": "script", "target": "self",
-                             "script": "window.open(" + json.dumps(file_url) + ",'_blank')"}]},
+                             "script": view_script}]},
                         {"widgettype": "Text", "options": {"text": "⬇", "cfontsize": 14, "css": "clickable", "color": "#50b86c", "title": "下载"},
                          "binds": [{"wid": "self", "event": "click", "actiontype": "script", "target": "self",
-                             "script": "var a=document.createElement('a');a.href=" + json.dumps(file_url) + ";a.download='';document.body.appendChild(a);a.click();document.body.removeChild(a)"}]},
+                             "script": dl_script}]},
                         {"widgettype": "Text", "options": {"text": "🏷", "cfontsize": 14, "css": "clickable", "color": "#1565c0", "title": "添加标签"},
                          "binds": [{"wid": "self", "event": "click", "actiontype": "urlwidget", "target": "PopupWindow",
                              "popup_options": {"title": "为「" + display_name + "」添加标签", "width": "32%", "height": "auto",
diff --git a/wwwroot/knowledge_bases_list/new_kb_form.ui b/wwwroot/knowledge_bases_list/new_kb_form.ui
index 263289c..0dffb61 100644
--- a/wwwroot/knowledge_bases_list/new_kb_form.ui
+++ b/wwwroot/knowledge_bases_list/new_kb_form.ui
@@ -5,22 +5,14 @@
         "cols": 1,
         "title": "新建知识库",
         "padding": "16px",
+        "submit_url": "{{entire_url('./create_kb.dspy')}}",
+        "method": "POST",
         "fields": [
             {"name": "name", "label": "名称", "uitype": "str", "required": true},
             {"name": "description", "label": "描述", "uitype": "text"},
-            {"name": "embedding_type", "label": "向量引擎", "uitype": "code", "value": "clip-vith14", "dataurl": "{{entire_url('./embedding_options.dspy')}}"}
+            {"name": "maintain_roles", "label": "维护角色", "uitype": "str", "tip": "逗号分隔角色名（如 RBACorg.admin）；空=同机构登录用户均可维护；*=全部"},
+            {"name": "search_roles", "label": "检索角色", "uitype": "str", "tip": "逗号分隔角色名；空=同机构登录用户均可检索/下载；*=全部"},
+            {"name": "embedding_type", "label": "向量引擎", "uitype": "code", "value": "bge-m3", "dataurl": "{{entire_url('./embedding_options.dspy')}}", "valueField": "value", "textField": "text"}
         ]
-    },
-    "binds": [
-        {
-            "wid": "self",
-            "event": "submit",
-            "actiontype": "urlwidget",
-            "target": "app.rag_main_content",
-            "mode": "replace",
-            "options": {
-                "url": "{{entire_url('./create_kb.dspy')}}"
-            }
-        }
-    ]
+    }
 }
diff --git a/wwwroot/knowledge_bases_list/new_tree_item.dspy b/wwwroot/knowledge_bases_list/new_tree_item.dspy
index 06e2ffe..66e127b 100644
--- a/wwwroot/knowledge_bases_list/new_tree_item.dspy
+++ b/wwwroot/knowledge_bases_list/new_tree_item.dspy
@@ -6,6 +6,12 @@ async with db.sqlorContext(dbname) as sor:
     name = ns.get("name", "")
     parent_id = ns.get("parentid", "")
     kb_id = ns.get("kb_id", "")
+    # KB 维护角色校验
+    from rag.init import check_kb_perm
+    env = request._run_ns
+    _ok, _kb, _msg = await check_kb_perm(env, sor, kb_id, 'maintain')
+    if not _ok:
+        return json.dumps({"status": "error", "error": _msg}, ensure_ascii=False)
     await sor.sqlExe(
         "INSERT INTO rag_document_chunks (id, doc_id, kb_id, chunk_index, chunk_type, content, description, created_at) "
         "VALUES (${id}$, '', ${kb_id}$, 0, 'directory', ${name}$, ${parentid}$, NOW())",
diff --git a/wwwroot/knowledge_bases_list/rename_kb.dspy b/wwwroot/knowledge_bases_list/rename_kb.dspy
index 6276265..e3bdac4 100644
--- a/wwwroot/knowledge_bases_list/rename_kb.dspy
+++ b/wwwroot/knowledge_bases_list/rename_kb.dspy
@@ -6,6 +6,15 @@ desc = ns.get('description', '')
 if not kb_id or not name:
     return json.dumps({"status": "error", "error": "kb_id and name required"}, ensure_ascii=False)
 
+# KB 维护角色校验（机构隔离 + 角色）
+from rag.init import check_kb_perm
+env = request._run_ns
+db = DBPools()
+async with db.sqlorContext(get_module_dbname('rag')) as sor:
+    _ok, _kb, _msg = await check_kb_perm(env, sor, kb_id, 'maintain')
+if not _ok:
+    return json.dumps({"status": "error", "error": _msg}, ensure_ascii=False)
+
 env = request._run_ns
 userorgid = await env.get_userorgid()
 
diff --git a/wwwroot/knowledge_bases_list/save_tags.dspy b/wwwroot/knowledge_bases_list/save_tags.dspy
index b0dad12..ccc04e2 100644
--- a/wwwroot/knowledge_bases_list/save_tags.dspy
+++ b/wwwroot/knowledge_bases_list/save_tags.dspy
@@ -4,6 +4,15 @@ doc_id = ns.get('media_id', '')
 tag_ids_str = ns.get('tag_ids', '')
 result=''
 
+# KB 维护角色校验（机构隔离 + 角色）
+from rag.init import check_kb_perm
+env = request._run_ns
+db = DBPools()
+async with db.sqlorContext(get_module_dbname('rag')) as sor:
+    _ok, _kb, _msg = await check_kb_perm(env, sor, kb_id, 'maintain')
+if not _ok:
+    return json.dumps({"status": "error", "error": _msg}, ensure_ascii=False)
+
 close_btn = {"widgettype": "Button", "options": {"label": "\u5173\u95ed", "bgcolor": "#4a90d9", "color": "#fff", "padding": "5px 16px", "borderRadius": "6px"},
              "binds": [{"wid": "self", "event": "click", "actiontype": "script",
                         "script": "var pw=null;var w=this;while(w){if(w instanceof bricks.PopupWindow||w instanceof bricks.Popup){pw=w;break};w=w.parent};if(pw){pw.dismiss();pw.destroy()}"}]}
diff --git a/wwwroot/knowledge_bases_list/update_tree_item.dspy b/wwwroot/knowledge_bases_list/update_tree_item.dspy
index f05a928..fa263ad 100644
--- a/wwwroot/knowledge_bases_list/update_tree_item.dspy
+++ b/wwwroot/knowledge_bases_list/update_tree_item.dspy
@@ -4,6 +4,15 @@ dbname = get_module_dbname('rag')
 async with db.sqlorContext(dbname) as sor:
     id = ns.get("id", "")
     name = ns.get("name", "")
+    # KB 维护角色校验（按节点反查 kb_id）
+    _recs = await sor.sqlExe("SELECT kb_id FROM rag_document_chunks WHERE id=${id}$", {"id": id})
+    await sor.sqlExe("COMMIT", {})
+    _kb_id = getattr(_recs[0], 'kb_id', '') if _recs else ''
+    from rag.init import check_kb_perm
+    env = request._run_ns
+    _ok, _kb, _msg = await check_kb_perm(env, sor, _kb_id, 'maintain')
+    if not _ok:
+        return json.dumps({"status": "error", "error": _msg}, ensure_ascii=False)
     await sor.sqlExe("UPDATE rag_document_chunks SET content=${name}$ WHERE id=${id}$",
                      {"name": name, "id": id})
     return {"widgettype": "Message", "options": {"user_data": {"id": id, "label": name}}}