From 5c3a8cefe109294995f73dd653be4dc2821dbab9 Mon Sep 17 00:00:00 2001
From: William Mantly <wmantly@gmail.com>
Date: Sun, 2 Aug 2026 18:15:28 -0400
Subject: [PATCH 1/4] fix: enforce pwdAccountLockedTime check in app and LDAP
 (#68)

---
 nodejs/config/inventory.sqlite | Bin 69632 -> 69632 bytes
 nodejs/models/user_ldap.js     |  11 +++++++++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/nodejs/config/inventory.sqlite b/nodejs/config/inventory.sqlite
index 7cc5e8e3d470e9ac5b8dbd369a0fff32a307ed40..13788ae8d8efa1c376fc32ac01d9e09b5a411292 100644
GIT binary patch
delta 3829
zcma)9OKe<M8NQB_j%WNBw{@U?#5S=@Q_^FdbMAR&K@<hlSZb=Y#T61%?z!jD*T_zl
zbdf~WB%88=J}&C6FBOr36h&ktKrH%Dw{_hvQXyCXVu1vU?vN0D@Sm|ga~<2m^~jQs
z{@>^OAK(A|XD+|F|MHvrUz+SAFHfE9Bfoike0<)}%yAkB%2>t`bAlsd7)AjH?K!r_
zV4c4<K6hGT#dykTy8Ptox%0?gunmv0OV3kG1;PqpI!oy>ERUt>f?{~~D8|Py-ou&?
zPuw+cd76=6HT-L^h*7DKp&tGs%1MzL>uH)VPRvz1(D{k6gU{RoMOiPXjx|a4A6Pm#
z_gHfK;$jkic<LP0)F7T(NIY1Bv~U@6#B#y|am?fVgR#Q}^x4Vr(8*D1-2=F5O_Kf}
zElu8QJHWzV%QFEbHr^p-89`ckg&ZbAWK1a;Wd6qFkpl21lT)=Wa6Y;|cB*?!#bz8y
zvhSU3DJnxPw}K(&HI&r`fwYkfg$!e&Q{^ZR`Sdr6DLy|nUPStIW^Aa7M0EcC)Lrw6
zc;N-+h-wa%6RAL%XBH6weNSmb<oOp<hnt<gEuVYpyhkhk+<EVIXN<(X+Ss)wN#75)
z<(Nrph|&Q?#vo=gjSS-grBYUdWSC)MSpLgH#UwvHG(OnLN{IZesXM#%6oPi@nf!Vi
zmggLr1a#+ELOnI5NRyN!;XDt{r-o{gpP4Q~U78;MP8W)$Jt!ksn!h_eF_#Jq*I9%e
z$)LKKLCOV&G~+&SZZzQL|DFET20a9kIKMVC0kO1aPb?6o_5=Z|B%9W!SKoUl{@$4V
z`AD;j3RI!?Gi7FW0H*8TWyY%lj%#ron*VPeZUfI>l%ewhaJ*E8p!>n`;Vts4?82T7
zdHTWg-ZHJ<cTfLPHI!)I4gC5@VY;t=_wK^!=C)J+@%e%cAHSz?dVHJhr`t|{D4tsX
zIDTk!fmN<0)qhp4RqwCAF#PObZQ#hzTK$iM>F|fO7weDJua7)Y8>^ljxL6CdzYRQ;
z-*@KQ1C_6bX9j;<`K<NmnbVc#k^ZGVLWBi|c_^46pwwIeF;#|03I-j#@+KA0(Grnr
zNhnG|#zA|yLB_%81SpVXj)BNI9vw5TVa32aSp_U-!h;S=2TG+fNu9xrIl`jjgTxw7
zSw>LMS|XM)57<5+<*C+LmSLl58a)MdOk)GG#0fYCk|NDPpi-F;4Fjbz?`iAe5C8n=
zybwC0f)eDUhA=4sF{Z*HrImt9zz@s(!u3;X^}VY*cNt$`J*KT~ZT;u^-|MAdZoEG>
zG;h7rg3=Ua!D$HHV+dV96&<shIT-Um@=w+d=BGcpbGWUqf-<?h8bbco`oflUiv=E+
z!~-2s;Dsg8&z2@<Ccj^uIRV6uKZ}bjV3l#>kPrbh$1Bhrs~EH-)={Na5z|JUSi57W
zfVvVvx1<z6X_V5fg%Qs*e`#%M-ecmNcNnsORxk;KfW@njm0Fq%wuQGbsiULatFsG_
zG@g6nmg{l6zK|3=IW}GypiHkqQitv@CZ#i2O;|xvR%1|WWkE;@L#Z)N<B&NbRXeHQ
ze_Sl3d+zLZSf=u4*9uuN#dEwqHRlwwCd)j+IskQojagxjJoh36>Uu}=)%DGRja|y$
zSjQ(jEn!0T(CMzV7F#r$By|R#7viUN`{l#+_B57ZOH{<S%QQGD;>9wpih}si17*s)
z4?K^Qs8j3fzclI_&xI{I$FP5L9$pN~XMqS$tt>;gc$XimD>2-#x5Ea3VyGwfc7k5V
z5NFyR`9D7&+)&pTL+h*0`$vxsoJ{Vh+)V1P)aOTjJ929HPs5F&XNJBS{BrQc!Ee=O
zYpv>y>h}gdtK1xTvPEXiZOto8RF=NEw6wTbMk(V<`dpdaTW0M>d1~%>iOXK^D%G)G
zVSF?0GQ!=Cd$*XHx4z$ZP43EQ1WTYuJ-`}m9}uS=KAla{4hRa+-1$|6?>%PlMWth{
z{Vcf~8V7hi8rO);je@zCPqVlOw}RRkQ>W}ZR|>?`u{PKyT$vr&Mr-bNp_ILzon31q
z-O8@SqTM~Y1MuZf@~D^1&Z}2)zA1DKx(QHbLGKO#_Y2vpqg&Q}82@gz*7w%~{{wnY
BuZREu

delta 2645
zcma)8U2GIp6yE8!v^(3~Ez(Nc-L?x|Z3*6b@16V0gV-2_CX(RK8WJUC?#vxTo3?}!
zLjemf`lNtk+$Xh0<6oi#HbLWqf%r--J{XNAg7LvbA9yoSe)P_kcDF=yCfQ_e=Hz_m
zeCNC0*<<s~$L5<)=B@Op!b4X2%$}Z}5|_ePQez;QWPm6q07?=M1Oib+2*$3j!#8^d
zyO~6gQ7ZBHvr`9VfOp87&_EqNTG^kry26gd&Pq0IwYJa^DQKAK?Ji*#6YY2qXdWm)
z9D;$X7z9cop9>8=NWE~ZcQCb*IUMcms=Sc4a!rg?uG?16sL94yaWjNlAWS5hTgqL7
zyAx~2#uCxvG8I5&(qf5C=|q~+wZNtcN&-Z+q=<zVIyW`|6!SfmBWcTSa_Rt19U%F1
zIlsxP15oWk20g%qAb@bHf#ApiE@IkM3i}Gn@a_C?1Hh$xp>i<-;BdJE!Qn~=O&_l6
zKv0CSL=-THT|lTIOEHN7_ceitQDkt#{<|AHI9lkb0a!HLzp!qZb3t)<zR+Fb*ryDe
z@iFc~lMq56sOtlwsqg#TcQsex^}@#WE1ZuX*f*oWq&_gCeKX7pW|)>!xn^6vhJ4|W
zmC~&zSC#HyqzpHvU`Lqz(qlmS904Sm>j$3aOD)6q`x;CCrmseRs)_Su0M6?GiH}zS
zD2$m1ga*=K9w5RoZwd<FaP30}62e>=?(A;_INZMkkmOj@*f(l4ui=;dy@S3hxbPex
zDKn$=9R!5K1n@jg6!QbB7!R-Yf0SYrN|W0W;U@#VHe_3%+yco63+D@+`TEh3w}^Re
z@^T{joh`neor`msQi+5$5a({R8HxW9N8_y~aKSZNo%=trt}&7C#SvYL2|OG}OwA_n
z@ntPc{+Ae%CUR4pp*9UA%c&s7yw1Y6vJF@7g9q+uIDNb7l-ycs_y)HQHJtXW`u57I
z(-)1W>aSb-I)?9Wn@yyCPi@P+l-ZxQ+ZS@*r=84K_KDo?-0AFIyE8T2Hfsm=&mrD<
zZ*yiK{Y-Vw&K<3%=D(}X?)vemlH+sCod5wX0&4E1KtK{l0-q4i^`#Maz`{ePxA#u|
zbOS@<Yew=A7jG#KjbH~>PGzm`HL&(x{qyuMxmZchp6_fgL8XmjY67$}wnivIKtY$7
zTkC7Bs7shq;iZMHaL2`UnWd}1p%|YEg7BTik@gk+3yEq~JYuefd0#P!Bq`?y@(-s5
zM$NRNXKc)Oj8h_P)_`=lF;Uk80tFl}PkNAJj|CFfAbS_?YHxs?j1bdxL>{hPT-Q(m
zr{T$kLP-UTpvX8~4h^4DNZ<;}07Y5|7jo%1QAe9Q>Z#SCCngT=y)8YhoXlE1wSH)Q
zAy{vie)_gG_Cr16qgqhln^^$@4VlU}PU8D!S1M`R323dK&%bV@&_6hR8=_M~ToW<q
zun;a5204Rf7efpJ6d3oG%4|$zjFltp63xx-@xrM^qurWEnZbl_FTw^&;F2`fM=9a*
z(y^m4bR-fvQtdAu$())0)S4SkmaRBah-~29I0KAqU^dPuA{Th<(KsA7naJT7j8y-=
zJdvAQp(N63RQAg=W~Gf!n?diJ97o(pVwtq@smZ9^;LZU{0*Oi;y>pNmXjI}rEh7Bw
zYPvp_>dmXkjt%y!iHu!L<X+2_vgfkfGe2Y|+MjQ~nZA)ek=|ez?P?Vj&$Zdd32H5`
zFPF#0!WVayDpzc)WqX`G5@&@}rfsXM@|SH5wH+t022&Zbt@|E~@z?BMYdGE!Wl5By
MEPbC9ZR<+QKVA}|JOBUy

diff --git a/nodejs/models/user_ldap.js b/nodejs/models/user_ldap.js
index 44cdf3e..03ee17b 100644
--- a/nodejs/models/user_ldap.js
+++ b/nodejs/models/user_ldap.js
@@ -773,7 +773,7 @@ User.setActive = async function(active) {
 				]);
 			} else {
 				await client.modify(this.dn, [
-					new Change({ operation: 'replace', modification: new Attribute({ type: 'pwdAccountLockedTime', values: ['000001010000Z'] }) }),
+					new Change({ operation: 'replace', modification: new Attribute({ type: 'pwdAccountLockedTime', values: ['00000101000000Z'] }) }),
 				]);
 			}
 		});
@@ -788,7 +788,7 @@ User.setActive = async function(active) {
 			throw e;
 		}
 	}
-	this.pwdAccountLockedTime = active ? undefined : '000001010000Z';
+	this.pwdAccountLockedTime = active ? undefined : '00000101000000Z';
 	this.isActive   = active ? 'active' : '';
 	this.isInactive = active ? '' : 'inactive';
 	cache.clear();
@@ -907,6 +907,13 @@ User.login = async function(data){
 		}
 		let user = await this.get(data.uid || data.username);
 
+		if (user.pwdAccountLockedTime) {
+			let error = new Error('Invalid Credentials, login failed.');
+			error.name = 'LDAPLoginFailed';
+			error.status = 401;
+			throw error;
+		}
+
 		const loginClient = makeClient();
 		try {
 			await loginClient.bind(user.dn, data.password);

From 1cb693a1ebd6fbe514dc55914147d93b64d94311 Mon Sep 17 00:00:00 2001
From: William Mantly <wmantly@gmail.com>
Date: Sun, 2 Aug 2026 18:45:16 -0400
Subject: [PATCH 2/4] fix: resolve discovery, plugins, and vault issues

---
 nodejs/models/plugin_instance.js     |  1 +
 nodejs/models/resource.js            |  4 ++-
 nodejs/plugins/discovery/nmap.js     |  6 +++++
 nodejs/plugins/discovery/proxmox.js  |  2 +-
 nodejs/routes/api_directory_admin.js | 10 ++++++++
 nodejs/routes/api_plugins.js         |  2 +-
 nodejs/routes/discovery.js           | 37 ++++++++++++++++++++++++++++
 nodejs/routes/index.js               |  3 ++-
 nodejs/services/scheduler.js         | 12 ++++++---
 nodejs/views/discovery.ejs           | 10 ++------
 nodejs/views/plugins.ejs             | 22 +++++++++++------
 11 files changed, 86 insertions(+), 23 deletions(-)

diff --git a/nodejs/models/plugin_instance.js b/nodejs/models/plugin_instance.js
index f3c0ec8..82032ef 100644
--- a/nodejs/models/plugin_instance.js
+++ b/nodejs/models/plugin_instance.js
@@ -58,6 +58,7 @@ class PluginInstance extends Model {
     lastRunAt: { type: 'integer' },
     lastStatus: { type: 'string' },
     lastError: { type: 'text' },
+    lastLog: { type: 'text' },
     // Audit stamps (set by the route handler, not by an ORM hook).
     created_by: { type: 'string' },
     created_on: { type: 'integer' },
diff --git a/nodejs/models/resource.js b/nodejs/models/resource.js
index 42d1998..92f296e 100644
--- a/nodejs/models/resource.js
+++ b/nodejs/models/resource.js
@@ -96,11 +96,13 @@ class Resource extends Model {
       return false;
     }
     
+    let maxUpdated = 0;
     resObjs.forEach(r => {
       r.metadata.isProduction = checkProd(r.id);
+      if (r.updated_on && r.updated_on > maxUpdated) maxUpdated = r.updated_on;
     });
 
-    return { resources: resObjs, edges };
+    return { resources: resObjs, edges, updated_on: maxUpdated || Date.now() };
   }
 
   // Stamp `resolvedAddress` on each resource: its own address/ip if it has one,
diff --git a/nodejs/plugins/discovery/nmap.js b/nodejs/plugins/discovery/nmap.js
index d0eba1e..2461bce 100644
--- a/nodejs/plugins/discovery/nmap.js
+++ b/nodejs/plugins/discovery/nmap.js
@@ -34,7 +34,13 @@ module.exports = {
       // OsAndPortScan requires root (for -O). NmapScan does a basic port scan (TCP connect if non-root).
       const scan = new nmap.NmapScan(targetRange);
       scan.command.push('-Pn');
+      scan.command.push('-F'); // fast scan, 100 top ports
+      scan.command.push('--min-rate', '100'); // speed up the scan
+      
+      if (config.log) config.log(`Starting nmap scan: ${scan.command.join(' ')}`);
+
       scan.on('complete', function(data) {
+        if (config.log) config.log(`Scan complete. Found ${data ? data.length : 0} hosts.`);
         const resources = [];
         const edges = [];
 
diff --git a/nodejs/plugins/discovery/proxmox.js b/nodejs/plugins/discovery/proxmox.js
index 8261bd0..e670116 100644
--- a/nodejs/plugins/discovery/proxmox.js
+++ b/nodejs/plugins/discovery/proxmox.js
@@ -35,7 +35,7 @@ module.exports = {
   },
 
   discover: async (config) => {
-    const { url, tokenId, tokenSecret } = config;
+    let { url, tokenId, tokenSecret } = config;
     if (!url || !tokenId || !tokenSecret) {
       throw new Error("Missing Proxmox config");
     }
diff --git a/nodejs/routes/api_directory_admin.js b/nodejs/routes/api_directory_admin.js
index 5b0c5de..bbf3c77 100644
--- a/nodejs/routes/api_directory_admin.js
+++ b/nodejs/routes/api_directory_admin.js
@@ -201,6 +201,16 @@ router.post('/resources/:id/rotate-secret', async (req, res, next) => {
     }
 });
 
+router.post('/resources/:id/service-token', async (req, res, next) => {
+    try {
+        const { ServiceToken } = require('../models/token');
+        const token = await ServiceToken.issue(req.params.id, req.user.uid);
+        res.json({ results: { token: token.token } });
+    } catch (err) {
+        next(err);
+    }
+});
+
 router.delete('/resources/:id', async (req, res, next) => {
   try {
     const r = await Resource.get(req.params.id);
diff --git a/nodejs/routes/api_plugins.js b/nodejs/routes/api_plugins.js
index 23301a2..8b4aabc 100644
--- a/nodejs/routes/api_plugins.js
+++ b/nodejs/routes/api_plugins.js
@@ -274,7 +274,7 @@ router.get('/:id/runs', async (req, res, next) => {
   try {
     const inst = await PluginInstance.get(req.params.id);
     if (!inst) return res.status(404).json({ error: 'Not found' });
-    res.json({ results: { lastRunAt: inst.lastRunAt, lastStatus: inst.lastStatus, lastError: inst.lastError } });
+    res.json({ results: { lastRunAt: inst.lastRunAt, lastStatus: inst.lastStatus, lastError: inst.lastError, lastLog: inst.lastLog } });
   } catch (err) { next(err); }
 });
 
diff --git a/nodejs/routes/discovery.js b/nodejs/routes/discovery.js
index 09507c0..2fb1279 100644
--- a/nodejs/routes/discovery.js
+++ b/nodejs/routes/discovery.js
@@ -62,6 +62,7 @@ router.get('/graph', async (req, res, next) => {
 		res.json(envelope({
 			resources: projectResources(graph.resources, { fullMetadata }),
 			edges: graph.edges,
+			updated_on: graph.updated_on
 		}));
 	} catch (err) { next(err); }
 });
@@ -98,6 +99,42 @@ router.get('/me', async (req, res, next) => {
 	} catch (err) { next(err); }
 });
 
+// GET /api/discovery/access/:uid[/:slug]
+// Answers per-user access for a machine caller (e.g. jump-host).
+router.get('/access/:uid/:slug?', async (req, res, next) => {
+	try {
+		const { fullMetadata } = await callerView(req);
+		if (!req.user || (!req.user.isMachine && !fullMetadata)) {
+			return res.status(403).json(envelope({ error: 'Only machine identities or admins may query access for other users.' }));
+		}
+		const { User } = require('../models/user_ldap');
+		const { groupCns } = require('../utils/user_groups');
+		
+		const targetUser = await User.get(req.params.uid).catch(() => null);
+		if (!targetUser) return res.status(404).json(envelope({ error: 'User not found' }));
+
+		const groups = await groupCns(targetUser);
+		const ids = new Set();
+		if (groups.length) {
+			const rgs = await ResourceGroup.list({ where: { groupCn: { in: groups } } });
+			for (const rg of rgs) ids.add(rg.resourceId);
+		}
+		
+		let all = await Resource.list();
+		if (req.params.slug) all = all.filter(r => r.slug === req.params.slug);
+
+		let accessible = all.filter(r => {
+			const isAuto = r.metadata?.discovery_sources?.length > 0 && !r.metadata.discovery_sources.includes('manual');
+			const isManaged = r.metadata?.managed === true;
+			if (isAuto && !isManaged) return false;
+			return ids.has(r.id) || (r.metadata && r.metadata.isPublic);
+		});
+		
+		accessible = await Resource.withResolvedAddress(accessible);
+		res.json(envelope(projectResources(accessible, { fullMetadata })));
+	} catch (err) { next(err); }
+});
+
 // POST /api/discovery/sync
 // Used by external agents (e.g. ldap-client) to push discovery data.
 router.post('/sync', async (req, res, next) => {
diff --git a/nodejs/routes/index.js b/nodejs/routes/index.js
index 212f6f3..f021c89 100755
--- a/nodejs/routes/index.js
+++ b/nodejs/routes/index.js
@@ -90,7 +90,8 @@ router.get('/plugins', function(req, res, next) {
   // 'app_sso_directory_admin','admin']) and the /api/plugins endpoints enforce
   // the same server-side. Same header-vs-navigation auth model as /conf and
   // /vault (auth-token is a client-set header, not a cookie).
-  res.render('plugins', {...values});
+  const registry = require('../services/plugin_registry');
+  res.render('plugins', {...values, pluginTypes: registry.types });
 });
 
 router.get('/vault', function(req, res) {
diff --git a/nodejs/services/scheduler.js b/nodejs/services/scheduler.js
index d183145..0611b49 100644
--- a/nodejs/services/scheduler.js
+++ b/nodejs/services/scheduler.js
@@ -71,17 +71,23 @@ async function runPluginJob(instanceId) {
   }
 
   console.log(`[Scheduler] Running plugin: ${instance.slug} (${instance.pluginType})`);
-  await instance.update({ lastRunAt: Date.now(), lastStatus: STATUS.RUNNING, lastError: null });
+  await instance.update({ lastRunAt: Date.now(), lastStatus: STATUS.RUNNING, lastError: null, lastLog: null });
+  let logs = [];
   try {
     const cfg = await pluginSecrets.mergeForRun(instance);
+    cfg.log = (msg) => {
+      logs.push(`[${new Date().toISOString()}] ${msg}`);
+      console.log(`[Plugin ${instance.slug}] ${msg}`);
+      if (logs.length > 1000) logs.shift();
+    };
     const payload = await runFn(cfg);
     if (instance.category === 'discovery') {
       await DiscoveryReconciler.reconcile(instance.slug, payload);
     }
-    await instance.update({ lastStatus: STATUS.OK, lastError: null });
+    await instance.update({ lastStatus: STATUS.OK, lastError: null, lastLog: logs.join('\n') });
   } catch (err) {
     console.error(`[Scheduler] Plugin ${instance.slug} failed:`, err.message);
-    await instance.update({ lastStatus: STATUS.ERROR, lastError: String(err.message || err) });
+    await instance.update({ lastStatus: STATUS.ERROR, lastError: String(err.message || err), lastLog: logs.join('\n') });
   }
 }
 
diff --git a/nodejs/views/discovery.ejs b/nodejs/views/discovery.ejs
index 2992eea..ba45a20 100644
--- a/nodejs/views/discovery.ejs
+++ b/nodejs/views/discovery.ejs
@@ -21,11 +21,6 @@
           </div>
           <div class="d-flex flex-wrap gap-2 align-items-center">
             <input type="text" id="search-filter" class="form-control form-control-sm shadow-sm" placeholder="Search resources..." onkeyup="renderTable()" style="width: 250px;">
-            <select id="filter-managed" class="form-select form-select-sm shadow-sm" onchange="renderTable()" style="width: 150px;">
-              <option value="all">All Resources</option>
-              <option value="unmanaged" selected>Unmanaged Only</option>
-              <option value="managed">Managed Only</option>
-            </select>
           </div>
         </div>
         <div class="card-header actionMessage" style="display:none"></div>
@@ -132,10 +127,9 @@
       // Name search
       if(search && !r.name.toLowerCase().includes(search) && !r.slug.toLowerCase().includes(search)) return false;
       
-      // Managed filter
+      // Always hide items that have been committed to the catalog (managed)
       const isManaged = !!(r.metadata && r.metadata.managed);
-      if(managedFilter === 'managed' && !isManaged) return false;
-      if(managedFilter === 'unmanaged' && isManaged) return false;
+      if(isManaged) return false;
       
       const isAuto = r.metadata && r.metadata.discovery_sources && r.metadata.discovery_sources.length > 0 && !r.metadata.discovery_sources.includes('manual');
       if(!isAuto) return false;
diff --git a/nodejs/views/plugins.ejs b/nodejs/views/plugins.ejs
index ab691f3..49bdefb 100644
--- a/nodejs/views/plugins.ejs
+++ b/nodejs/views/plugins.ejs
@@ -57,7 +57,7 @@
                   <button class="btn btn-sm btn-warning" title="Edit Secrets" onclick="openSecretsModal('{{id}}')"><i class="fa-solid fa-key"></i></button>
                   <button class="btn btn-sm btn-info" title="Test" onclick="testPlugin('{{id}}')"><i class="fa-solid fa-vial"></i></button>
                   <button class="btn btn-sm btn-success" title="Run now" onclick="runNow('{{id}}')"><i class="fa-solid fa-play"></i></button>
-                  {{#lastError}}<button class="btn btn-sm btn-secondary" title="View Logs" onclick="showLogs('{{id}}')"><i class="fa-solid fa-file-lines"></i></button>{{/lastError}}
+                  {{#lastRunAt}}<button class="btn btn-sm btn-secondary" title="View Logs" onclick="showLogs('{{id}}')"><i class="fa-solid fa-file-lines"></i></button>{{/lastRunAt}}
                   {{#enabled}}<button class="btn btn-sm btn-outline-danger" title="Unload" onclick="togglePlugin('{{id}}', false)">Unload</button>{{/enabled}}
                   {{^enabled}}<button class="btn btn-sm btn-outline-success" title="Load" onclick="togglePlugin('{{id}}', true)">Load</button>{{/enabled}}
                   <button class="btn btn-sm btn-outline-danger" title="Delete" onclick="deletePlugin('{{id}}')"><i class="fa-solid fa-trash"></i></button>
@@ -370,14 +370,20 @@
     }
   }
 
-  function showLogs(id) {
+  async function showLogs(id) {
     var p = pluginsById[id];
-    if (!p || !p.lastError) return;
-    app.modal.open({
-      title: 'Logs — ' + p.name,
-      bodyHtml: '<pre class="bg-dark text-white p-3 rounded" style="white-space: pre-wrap; font-size: 0.85em;">' + String(p.lastError).replace(/</g, '&lt;').replace(/>/g, '&gt;') + '</pre>',
-      footer: { buttonsHtml: '<button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>' }
-    });
+    if (!p) return;
+    try {
+      const res = await app.api.get('plugins/' + id + '/runs');
+      const logText = (res.results && res.results.lastLog) || (res.results && res.results.lastError) || 'No logs available.';
+      app.modal.open({
+        title: 'Logs — ' + p.name,
+        bodyHtml: '<pre class="bg-dark text-white p-3 rounded" style="white-space: pre-wrap; font-size: 0.85em;">' + String(logText).replace(/</g, '&lt;').replace(/>/g, '&gt;') + '</pre>',
+        footer: { buttonsHtml: '<button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>' }
+      });
+    } catch (err) {
+      app.messages.toast('Failed to load logs: ' + (err.message || err), 'danger');
+    }
   }
 
   async function togglePlugin(id, enable) {

From 7da5050ce3f34109b327eb50f40795e79dc65a0c Mon Sep 17 00:00:00 2001
From: William Mantly <wmantly@gmail.com>
Date: Sun, 2 Aug 2026 18:50:31 -0400
Subject: [PATCH 3/4] fix: correct path-to-regexp syntax

---
 nodejs/config/inventory.sqlite | Bin 69632 -> 69632 bytes
 nodejs/routes/discovery.js     |   2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/nodejs/config/inventory.sqlite b/nodejs/config/inventory.sqlite
index 13788ae8d8efa1c376fc32ac01d9e09b5a411292..255b0cba01b80cb71fc6606b1e8a02d8b766f5bf 100644
GIT binary patch
delta 848
zcma))PiqrF7{+&-h^Y#z*eWzzT1vozzA}GzX1s|63DSc|j}muwc0?#K(DtAgbMsmm
z(4#4S0I3!9J7|nY4<7sm`3B;w`RhU0+0)BD^FHtId8gN}_WISMdf0pw-wB&1k3N2B
z2ui8enu4)u4h%~T(h>taF+_@#8O(C`eX#0wzOG!rNGT-{Z9lcv9S`v`N4F5VNoDfp
zq!zBWX65E}RQw5o3frx3)SJs2w}bI%weo}ut`Z7FVgW423Uq1^AWAbr1T_?kzm98z
z%jf5gox-p-aY)>8d}ZpMD0ei78=1;-q8SDyl>{b?21RoTT&GA_%u;Xb``(CVJ@vB(
zdxwt~K^Xc6grONo_}YW4-(3W;sWl|C2B^&`Fe^A{jT9io7|If)uo{DW{<aXEIqVjW
zXD1}CA77n<VCB#-Zdi>IKR5@2eJqSv43bF#jEjs>ogtKEt~<O|n}WEvLptd}#F$`f
z+}@WHf^$Xu7lR;T(L?{ekA9q9>TN|Ywkx|~nKy98Uw>C-byY8XUS<~+FTB4~Cd4JL
z+%A*KhhKZqy=f}NBQ2(Wd64fPw7Y)OPdaTZBo}i<r<m6MSKvO4*5@hz9IefY)8C_|
F%|ErB-qQd8

delta 833
zcma))&1w@-6vt<p6j~Lcs0*9a7719;Th9HM`_Y|9ks@7)bRF;94=I!wuwAqpvud}M
zfp%%dC#V(l9W=%VaN!%|4a7UsCYg;ea~U|poH_sV`~RnZR_~wHkDD=m-+CJ3^H*QK
zw~e!k6GBnytwPK@Kq}z`QOk^CRuSTH_G@rA+x&6o21pj(G0}PBefDvP=RvGdzM4>e
zdOjE5TQADxM*wR8QB-4F&86o0{L+)?^4i#79%Pzmi#YcwVoqu#jbtd?3bdp~VqK^$
z3~pbas&&g^gcM@4L5z^>c+hG)z}7koVQEYe6OJH7v_wWIp;OKhXL5$ejmgAx|K-l!
z>+)2%oSGv5nIOa`0b%i389}9tQ;-3{C_qd}gQUd_QLU{4pIR(rf$;5T$uPUuE2%M=
zj2S|i!LZe~k{O+*4uSF{<Y00JaL6T&Q$YeAmRWE3aBj?yeHhX!{}~s>xchuHlvm4N
z%RRptMGY3tVSX-d^&d3et<<*SDxuGY&p%bks~#E;szgu=jW0H<_%{<eSE@Mj`Oi+{
y`Ph;CugteT+I4StJG~I_cDEDKNW`?Gn{Vs?+mL-7ElwT&JzAJNT>Kr)EdK+ycHTSy

diff --git a/nodejs/routes/discovery.js b/nodejs/routes/discovery.js
index 2fb1279..6185aa2 100644
--- a/nodejs/routes/discovery.js
+++ b/nodejs/routes/discovery.js
@@ -101,7 +101,7 @@ router.get('/me', async (req, res, next) => {
 
 // GET /api/discovery/access/:uid[/:slug]
 // Answers per-user access for a machine caller (e.g. jump-host).
-router.get('/access/:uid/:slug?', async (req, res, next) => {
+router.get(['/access/:uid', '/access/:uid/:slug'], async (req, res, next) => {
 	try {
 		const { fullMetadata } = await callerView(req);
 		if (!req.user || (!req.user.isMachine && !fullMetadata)) {

From a6c24850d415f24115853d6f6057b77be555a09a Mon Sep 17 00:00:00 2001
From: William Mantly <wmantly@gmail.com>
Date: Sun, 2 Aug 2026 18:57:13 -0400
Subject: [PATCH 4/4] chore: update sqlite test fixture schema

---
 nodejs/config/inventory.sqlite | Bin 69632 -> 61440 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)

diff --git a/nodejs/config/inventory.sqlite b/nodejs/config/inventory.sqlite
index 255b0cba01b80cb71fc6606b1e8a02d8b766f5bf..9fe0fc79f641eecf4f0a52764865ad854fdc7e64 100644
GIT binary patch
delta 1123
zcma))&r1|x7{_Paac1`CSh{U#n+qLM>(!Zg-<fyDLl6?BwLz57P3Fft656V%L{hX-
zQAd{-GP-0K)G5+E<iUfNh$6E;po5pFn};qD5xu+auI?e&8D5xocpg5__xpYFi$Z=Y
zG~d3TYvDLfVW;|tg%f%Y``cUCiYvdkgs{fN|0?g5$1xIr7x@|Mk+&nOQbAr9)}+f)
zs;Fg<5V?OPCZ)Q&`A1{L7s3)RjXTpb=O;$#N%19pnwTqo6Z?32Sm`Ua$sc&p4vVSm
zF}j#INT-x^aV#1QMeZeeDV0w14{p=%;aANQH*(}U-4|}9g$Sk>#09Z0B&G(^<)-zR
zOxKjNMIryEb7fv=SrYP@y(du;75!a(*@!=){ddnbw+?r7rq9Tor>a^92VKiD0~bSJ
z>4pZ7j~w9m2m>7w-*z3_^Poz<Y$R#+Q!=VS3t<b5OauXazNyP*zi#vzI$T(m`Q(sM
zy=IQ9YQL&-T*zX;j?>}2z`#PDuUQZT0l@$T1OZpmEudi>7@F;CkiasqeWNW>1LjIR
zsSH3io!UqZR=({TtZAIVj%Mp%IwsIX9s$@UCP2311Ius`Q2oHNwZJE~i5Uzesv!5~
zrSaL(U2zE4iDTCqkAG5jvySIlh6f#20|s<-fD97?+tn~I9Y<3MF?|x4WpS&Ycir@7
zC-<mB3vXopK*daiP>siZWV}NIbv#q|G(=RE9<mwF#};s);Q|-xo~Ig)L0p$kZgxo(
zee~HT+DQ%CMme?ioz&R10*aJ&gRPH(ibpcH;>(M#`8!>qVZM<?X=bfUjRY*P!nsDm
z39-V9*+y(_VwGKu__4BeO&O}@%{I9-^url4Ju@=NqQ9CO(XeG;tyYmM4IBKofWF;6
OQnUB#c1O6{===j-0V0_I

literal 69632
zcmeHwU5sSMbzaZ@&CWk5ky=sIip?SE<%+z+`u}Nxv6sssxe`T5%biGyLJaHHt-BoZ
z?#ya_XssDO3@uA}v1R4KK=f!Eh+)AN6veUqWFUc&1c=`(ON#9vagwJ5d2$2;f~<Vi
zef#J3+-^1{29TXQy*odBs_UHdRn@6er%u&<@l((59ENtjw|~nWwt4HW*4$j{=i2R7
zYi_gEYTb?h{jVkba;E<We$I{jKH*o?vGLXava<SmYxT_6S_^-<_V3nyZTT-(pImxv
z`Pa|iv-aY-|FQPLGhbW%&g$1DRM5QLAkZN2|0M!nd~SLE!sW|z|MX*rE-k_*i=&%6
zyVrIP4&AOF`)lRu_020cHrqF@JoWr$`{ioUm)noNypz4$-rBnMbo-OnuYLT=_0P6H
zw)xq|+b`el)_LR3?eKE@A6~hB^|>q8A64RV`-M;3Xuq)a{PQT{-C?-7w|}R;K>O*<
zXRd5Lf1`aV+d1%iuZR6Rm++xocWb0Z%1EWk18|*C-PQ}&KDD)p8p3YW8B*W4_QGec
zy>R1EdU?Q$MzQwyc87H^DTf>e<t~x-hkLImli%CTcfj|fFMi^MVUai9jI_cX99}=#
zy>j?+8@x83-Mn7D`Qo8FJUXZ{DoLCB`+NJ4Z}T%ZV(t3@KxNzM2vAX~5mFR*So_iK
zY|;n%r0NGs4pGLZ(bhMveSCAYoyrf@k}tpY_~QJ9`|qFo;uGDj^y!ekvbXnI`D3Zt
zdCGUE^qOkxR<MV<NBcz;uTd$(>tXj0cvc(Xb1%h4I0#S?+VwkP3E$4a6@R$%I{MSZ
zuF!-2-Gl2FpE*B&;nJnKFZD*=74O5r!S(R@qi}Fo`D399U4=FUz@s=EN7WpK=;r?3
z(e0~~I(NjWrcVwk820SjVK>{^z1ba(dxsIeUQgZc=@GI|RQh8U{7x3Kr%v|Yl5(>6
z!Oq_93)QL*_Kx;_xYoBe*EgTpyuSIu)y)^%FJBKmVu{P;c6S&)zX`MT;%3j>#J9FS
z8GCp8>XjF-UU@oNf}f<{|Kifz{Dq4b=YDCY+wc1#^naeJHedhkDJ}Qf&hC_^n?5kA
zX0I}A+5@|ng#*98bNdj`4qEJ1ICL-;ZhYAEY}ZeK&*SaApWhApm9F@ByQ~nVYyx3#
zcWB4@w(3OTK4Dn+@>}9ucUXP#Ql&MXjUB#^efN*~`gZBkrZmpmjvUt=$j`$FO)*jX
zWk3C?>BM&a+=Y){nror!g)ba@zQA&2+Z`S5b^qS30Jlvmf1ZEqr8Dyv9(iQ$i*HsC
z-^^}?e!=+r*?PPqX$su?p>Vx^I?0sXcKa~*?=Fz9>=fC%TVrqLuAMmJbk>`vYsr`O
z*>e{@_Q=~cO~i57GV!l-YxlGsemkf3Bdg~weB$z?%Bw!!Hmm-<_K}r$@L^j0@ao#f
zTIZv5$<nzCSMHxALFp)L)AE<)wO{Fd%q~ppu$4)2n^yi@T>G0|6;GT#cj4;ANu2wA
zcboNpJM+Y;nLaQWAE%*SSH~6nGPnB2t<^tXc%}L}Erzd%M)TDm&>#>IIKI5Lx^?d(
z+pW8=UF#x}<(OJYMiVXwPlWV&V)L9OO32hviZ?uYW$)lH{!jcJUxXw*gfqQ;5GS+f
z7;RH+B-31KNfp^1E%?Tpj4+iDoiNj8v_ox&%MEUI`!PZ~giNO{e*MfhE3(ooH_V1K
z;WpQa&>3X0iYI}4>j|Njn{ipOP@7FwH$he-rpY>>Le{fe_dfK}09WdA8<bXw6Zj@v
zmL*PRK4B?IiB9ue2sXfVZ~yiyZujj)?UkD#shTS3fV%kg)1TYA|FR!Q%9TnT^CWRR
zvxx{MORS|XQF%@Sqq)kgJ_!4-?_ep_`;qJd)R0Y;w_0?9$V5#8cR*eI`l;WlfNQi3
z!elPtO87*WfKHoH^s+42EG2=349n!Q)6O7lx6k&<)l14On<D9uy7=|EzpY4`OP%>#
z*(6VCmWWJ~#2UdNE=%zhf(ty3r1*a(Scl~%NUF^=Ne5I&dZQvKrP5PpMM5)@Cc;XY
z7!8@d4H+|DN-BpPHrv?`{%~ps=wjL{H$hTvr%5`XE`GiB+Z9P6O`hesPpHx&5uTGI
zWhTJJ<f$V$(Zb0ArZY&|#eS-!luwg%Kz-}p`NggKpU^9BEnK_iWiZa=c_O*Ru+l~)
zCWn+FD502RoN`wVl8^7~B7oxZ!}e3?xX!=kZr|R%)qit4?Y;TN`oU2e1AgnB^=A>K
zTYr3g=Qe)FPgs|I#5wSX-`fwbVkN&D?riMs-vsUTTRT~=)a||fL;OZ9<t%>q;FJ4%
z*%2Z%d%NqM!~LTW-`o7cVc6ew#r5F)D>0C_-Z{R!P@OXzOEbxGnxrC?=+sIk&Iyv_
z1U63+?;Np%;Wv5C(8LJICF8YohDiu(Gu9!x!}*30q|yYFsMzMI&KX|vl;+-|HuM<5
zv`HKb_>G!OEAD(?d`#B5IiptA!JIKB4Xaw>NmR&MoiilQGT0J_F5`h~?p<P4mL?hX
z7=1a-L>SI*6X%REQLA%CRTgclLvRwc)f$^Klp|iI3Qg_;%$gSzW-XW`BNVfVFh=Jy
z&ly8`>*tIyp?G!9m_%*0#^(&oandUoj9}6HFv^K_upfEa^BgiJ^Fc?LIA;un?b^5M
zoG~T~oeJ)NibYIy&M-8npomOZG{Qo0m81dl990+voJA#u_H719N9LBkB_5NMOzW_E
zK!v2$IV08HQDgHYjwCoasfD{ERl+seUl2j469Y^qTH-NGtCqMbsZ!N>coG$^ZFSBF
zQlf9d7nMY#^(|uw%%DtE7G$0U?wD0?KW7Xjt(h~%WD(UlV-oc(Gq<*tJaV!1*0a$g
zKhrvsb44JOPvDhfB8GF8m@F5G6*A;fVv4rxX!n-ebvLnVk%j1(ZS_JO?dRb1>=juO
zL4RX?FU|<h@9Z9ZA)0&mm-}$`1K#}H8|$~62l2|4&Qniyu3qgt{d8w@v-8X|v0$83
zDA|ZFwf^QykFO6lh_-ui;8??YZv!g1f=`scKDCaraX)7JAOuV)ab3_wOi@i9U-!3<
zw&V1KPm6M0Fbay=prY!!j8Qc$XMk7t{^+;j|3$R&+}d|rYu`QbdTDL&>aKE{Zw&$s
z0u2HU0u2HU0u2HU0u2HU0u2HU0{>4Cc=Ytv+$<YQYgoWNFw3saD#ZN$EL$pZPxwz}
z+0j@=!QY%^A0eiWzcEV~e=%x3OK5Z<YCTI_GVXGJf0m%&eAIfDnB2Lp)-y!H&PJ_g
z2}H%L`s=gAf#SCP<ypcor!Jk|T9_pW(p&%kb!+XfSHFzce_Oi?uUql8dbIlMc>O58
zz_$5n5NHr+5NHr+5NHr+5NHr+5NHr+5NHti`-wnudVB8ebJNPiq!@$v*;z|F1S00{
zu9lv_ZI~<2%@irQ#kGGOx7yMU0f2FC-E7;j(!CU)7zFt5Rnf)@SMzIPEZ|>FE#DQq
zmtYd(0bib4cqGdt#svP+)WY4Gdx;(~E|5$uJd$g1YU%XFg?@rVlxc452l(E)d+i6S
zA6@y2mEGmvU%s~V=S#O1f3*13#fKJtZ{gYV-#h=>{14~9GXLPYZ=Ksb`<=5pXMS+z
zm(M(K`kSY(p8EFOpPsrocd?bnO6tFk#l!Pk7jOdi8nTW(@zy1|z&DYxEHNG_B`zR`
z40*^#D;X6#;5HS?<N*a^S`5#4l4_(#8RT`PT;?HAN}Q9FAulcU)F6cwNi>$GJYi0!
zOk1BRZ+q#{-82ZII>dB{-4LRm1~Hv_EFLPw)-m7DD%8&iQeR@4x79gP%QB{;5QO(K
zybl63K_M?SiFszokP66<@+?oB_EAV-XwC^@N8TEeNU%q`IKCMhwLnH7vWPi_4t0X@
zy2PD<QbTI-Af#@!u3bY~QEG!TiDpPM6G$ja3`gQDGLAeG4hhOWbip2Qqit$Blytb+
zFjkId3)WK6;*X$h!A>FjRar_CZ3L2Td<xx-p@~<lST9AIQYNBmQpe3ikt{utz&Ik(
zkXp1$ZY&^=jtlfLv<Whnkdtp6XGxapoKs_*P--GK!%p;)5pF|j@j%HfO_j}KI-FGo
zsr5df%QA37&J@dY%Pd!VGPgm7SZ!krsKtj$Zpe$xxXF+<$^#PesQ2haNa?pCHw4Ek
z73n2q9@N#Rr|LGO78m>6EXJH57>P>c$Wrqmu}EIT*#V+NU`%S!8@Hp}REOz~6dP35
zwcAN*@xeZlP)rMzB^l3=y~j-+(_{^@_h=fJU=-u~1d@aL_=&7BwA)E)aev9p=RD_L
z(<Ij!bn_S{NFdb-$r;ay2dbi*GFm~hUmrP{OF6=ANG(24a??Nz;d+|56bW>~VSqSk
zL=rMBS;}Fu^km&|KBHz(4rCcni~CA$IkB)g(acyR_zU3~`U^&9F42FGPfeiu1SI)}
zCDlVFu%ZLqMybX7OKv91Jmbg=#zB~_^@HIPForV7Aaa;wX-;s10TaB#^#(ne@=Mz_
z)Z#+F-DoP2+N&^}b0p9@i){Opc^Dm%A@7e1G~Kvv!}{uMNe#7lU&)P;G}YQ_Xyni*
zWeTfeV8p#uIs`!!Q<HT=8t2J&8*m#^i+f9MS_YM;3UiI2_@*<Rq#37}R#*^7gqPZ#
zuqDI#*opk!5hQV%sFbC+r{tC@Y7Goj5(I;88XeOSC(zu~3Un8XHl2W^+CYNsMBPTI
z#e4g@VE{{wZlN{7u^xuWH1$Z)HUx7a8qaH!jc}_Te1d=#Zj-3RdrEE;M+LOQ@qs)b
z7aUVRPfWleB7lg4Sx5(V6{|c}AFa*-lc>erB{v(Vb{QNRDyE-X%snoqNo%LL$H*f=
z(22TnUQOPtavM^MyGm}H<Ma!$Df)&7l9od^g&Bt%mLZ2&QrOSQ+{WgBF>V8Du~u?Z
ziqb63?+kNlbb>GkxQyUbfOH;~DNXayIiOk}lU1uciCV1ok%X7$4MtgJ6i$4kIH+bU
z&yo<b3@0ZfQsujO(WO-$sgLmuHaJhxn~x?@i<OdFMsOO6!zyE7!Iq%*#6_RXSVt}T
zB~F`+j(}=?bn;<5$TFlB%Oy9V1Ir~GVC|7V-PO%exC<duB+sY|mXFRjW84N-zD_rc
z*#78VD!KWbkTlEFgu!J7Hwq*fg<pbsEzg)!CLOgUW8BEZc8j_VsKsK*&15#GFoub?
z8TzD;E(v2e7D)_EnS$GICUYY=<2d11Be)Hz$6^8O;(|i6EM+NNaUr6$q&Pxj3A_`E
zQ#6=wxW-YT?hpV3IH!WfrOw3#1%-DiU>1TxQn-<+^(vJ)&=8=6l%ib-78FKf@^m~$
zL%E!$nH~dOcPQUbW`da*qZa2&kYL(zm<^}xaE=p0DHB)$QJnqIf$}_Bdtt{wVr?or
zth;<steU`&2CJnO^ZgFMloSk(f57oBsNQuI!8heNSQjTX=wCGx-TH9S6e;ZRTF0BD
zmRg)Ex#1iD^Kh(_%%xE`3#Z#SoEmVs%mU3}Ge#%MzVwuKq=d_H!o2smjZt4cJ-_wd
z?ixo(ET;lXa6$=AcQ6Ls%>v2HrZ`ONfU|i1Ggk+##@a-}+vrHMp>++8HPqr%U$c~_
z7A{WWsYi#7ODT&*D|8GbVC@38W7Og3YSycd$PGekG^?Q&b0s$%Ze$t7DpJ9)Mu!8P
zG2m#i&R~)>mY1m=Gk{&)aMp{m4PA#LxQ$S;aJ%c_xc@Kaf2XzZKj(jE;n}q>t$coI
z@%*F9f3o)7CBE`+7r%lt0N+@>xp>dQ?eo8|m@od<^PgJzU#ow$^4#K+%imwVy!Z#_
z|KsW(F2AwzwS^C@-n;N`&i}^3KVSOYrC(b5&is#79$5Ov^MAJdn`=v}zq;I7{Rhj}
z&;Oq_Q6C>@-fa+Q5NHr+5NHr+5SWNSOpc^fc^vW!I4<fa{9OruN0>CBaA>{Fg9(nS
zSkO}i=Mru{kKPehqb_k7-0~c0ff^nsPM2mf7EG}aAr>b(y}=1dp|E(h8m_y=vVdid
z2$50IW$hh;Zz<wr7GV&P3atMGqDm$(i^X3`oMk)~R9Jml0+%n9aB)SBCAXD0e9Lu8
zEzV*ZtXf$th>KCQNO4RPK@_aIa@<4WGLI;S*GwV|PLww^7Id7X6#D^5js<&9YpgS{
z#$ZMv2818D6(SZi3b$>*=fn*RakY=TA+Y}Tx_cE19A8`vkcB5=K?L^FJcCa~g9bbl
z%UY|k1Vdzzqt5PXU?Uc^xClc>SKV=}tc8P@j+ECNYc;5mVmHD`p2UJU3af&|H5D1^
z#$sIJN`*{82!i-tMgmr0;qh2dI-VMQ49j#0WxU3E4C@qNq$rjgIWt;377IG%;=)rT
zSP7$`z&?VB(KUuE8dAKE03!Wxw;&deIG9Zm9yAyt_L~@o8)K+PlWT>o6s<0IWu)K<
zy|Jj)09;{jAg*c>iYrw_uDwn*eKZynaM=+l$KhUvEgIoHVhkGhufU1tI9nU}g-fv@
zd~CFT+{_4wWWr00_sKx5%;oWJ4lMR^_A{}d0^rVJZDk}bbPxn<1Kd7>mA%bPnu<K2
z!#olT&ay@HaF_KAn=%h|Sx?@W7;HMM$AYtLm^>H@&a$!4js<7g6L=sNoF$z9p>Dw$
zBJmfytY-+Ke=ruDCH{SXEI3Q(`UA1xEK%qCV!>Gg#_#XSI76)WLM%8-nD%|K;4Bf=
zdt<>_f}{6zYn&mj`QBJ?mXPFoV!>IWiFe0>vjhU~iUnth;jML9&k%lFjRj|koUO!y
zvjn}CW5HSCRZFqpETN|EiGo>zL<?QkGek<}W5HPhIOk)*S)w85VnJLJ_O^kH)7=_p
zh(dJp|7Qsx#IqiYi~qj0cD#0G^`ESKf93Pb|9d$s{pY3Yc(eIx5NHr+5NHr+5NHr+
z5NHs1hX@=$hF#IC7qCr<>=c1Whfa_MgVk?0Y{Ri<k1a=Ra#Jk{Zl$Wbv2fdExW%x0
zQT;5pA&%^GVZSi$;L#0Et7$xg9k($mGC`l&+Pn|aTAm}Uf`vb>B#f(n1ep-)K+FSo
zSP~U7qHQ`s+U_0mx5BM7?Ekp(GGrNzZ2}K=9O=f83VGMJo{Z?~?0CM5G_nxi4Wxe(
z6pt6MHNANsBzbpGtdnJk!F1~J8EiN|c>%IuOWAv+afv1;NR`FChza&bvHOk1L~c0(
zN!C?c^i}t|8|i#wj3|<}Hn7QC-%w-J<8#=F{@DnLL~e}51(N9Z4l%M6yPMcHg)H9S
zu3v*NpbvFojP$BHLHJk-(x8WT1sPJ0TiB$Q5f34?LLP3OWC(O25Qc~$wr?{86eTXd
z#oc?7cQ;qJ{j0c%Z68nenTQ3!Fp?Y4tQL!L>hY<w^IJM%f$IpliTmWKjyEbA1jKL=
zBqEpG;f`j9j1BJMuKcJ76LILV5reywt0;|Ak58YO-}*?z0a?jNc<~4WDn#zkEs(wH
z1JbM!43q>ZHb{)<3UPaX?+e?$IKrjH6QCIEWpiEwMGf`%EH?3<j8G6`Qcn;J3<MVv
zqcw0XYE1Sf61iYV3r5yJuQjSt)T1%rguARyHc1Wj4eakf7Qr9_F-~T|oJounBuK*S
zA@Ye#pqwHb)Mu=lma`4>cBj5SpnA$WoFZ+apNBKj6gAX0vE83U404O~aE1I#r3B*4
z=zz$1<vNkn=12y_<&ar7GrD9xQFpLsY=fwJ-N&hM|9^4yW^3&mYhS`n{ms?CTK&V-
zU&XG!z@>oASA#%<K!ZSoK!ZSoK!ZSoK!ZSoK!ZSoK!d<LLm=*3&k~sH?$*x|H|y@!
z&l1$?Zo<zJcIs~H&k`2u?$*x|yg3`So+ZF?CKj9}2GZUCpCwAsyZ>*7h(g@|Z{79I
z8nY?gAkZMtAkZMtAkZMtAkZMtAkZMtAkZMtAkZN2cME~I|KF_t|8BKeBW;5~gFu5o
zgFu5ogFu5ogFu5ogFu5ogFu78J4GPw|Ie*G*TTQ%t3jYaph2KPph2KPph2KPph2KP
zph2KPph2KP;B62%mUD|+k6eB7;=&m`2n{!`GF(KPWEu}Yz^#zDTbAL1TZ6};;bvT1
zeoOR?aB$fEbVy&>+k5Sm!^7L1C!Q$wyer~m3muEEC$ghkx9)syJ=;0(d$@n%&c<%|
z`Ry#czT?CCOSkSE1iv2+U)}qof6=>Op!<kB#^MeCT;dUT)dy)zqQ?FIIUMzGPW!)2
z12^Obfd+vFfd+vFfd+vFfd+vFfd+vFfd+vFfuBMIE}h<5m?aF+KmWh<qyFosP?<)g
z27v~F27v~F27v~F27v~F27v~FcLRarkDh(c*8LA$eD?eUSIYYEtN@P3$)zdBgDm6o
z87ZDFYH~ab0uS26qbc!32r5Fni2c^y7Y3V?-R;c1JU_&?=JxI4=;qGuHq}OIJkb(Q
z3nhFTMAH6n@Aby|(SEVsS&ti^2iW<%{d(vaLe%=3)xAtfI)rTCd7PDd-1~c(<J4B`
zw16`AZ!U}|6O`1_;=!WK#AlHPii`eTMiRogXH4@9PsgZNW_OA%yFacfs(LH@m?{Hm
zt95Dzsyy`ZQB^!{=4UCc#kbf<#trdVipS66aikKD1JyYd4w}}glHPd{Eizf19{tBv
zNswu+GoWIh`PaH#ZB(V)<r(vM9x2c9>{UF0R3><itW5}>mO{KD7EijbRVh2VJy{<R
ze_Ung)b<%rF;@Nql)3L}MVS<j+zm!18AS)f(^~Nu1!0f?Ahj194>%y+*DB*CtKxo4
zMVOw}Dnn}j{6Fsde+jQ|G<g8;hFNXuXb@-+Xb@-+Xb@-+Xb@-+Xb@-+Xb@-+`1^oB
zysdwh7};4U`x~>wpU$A*FU%6%IgNs!nk8m(3I!j{XNX4(*8iVgyVHB&lg(FyK!ZSo
zK!ZSoK!ZSoK!ZSoK!ZSoK!ZSoK!d<62t0WD*}2J^`bdR|v4Jm7DX|-40#mYSdMO(*
z9&lxHEy#n2fq(}lmvAemo@%YP{-(9|&(<DZ{e#tyuKdNy?(*+1Ut9X~rCW<XTKwwb
zLkqvR@a*~Toquiqhx1>VfAHM5&TXFk&e@$aKRENtXC65H&C^#;eS7XtPu-l$QOU%w
zWAX6()`hLDYuC8VJ@M8hxxhD(A+5-GrV@us5jfIxj8-yUfpEZWDwN3s3UU-go=%c#
z<h~fmeadAX0;R+`Nts7RkEck8F*Z*uO^@%2%v#f#72PtecOcM6W)e{yVmid)mIZn;
z_oaqfJQO7YH*G0rRzXfie1aSoo>-l`#AZxKWeE4At9~6fuGkcALu&D0$&DJD+Tcv0
znL<K}(RpIH;EDFmGdzxyIv=XsXq%c2B^_=yjFscuYN=@SN6@xVPEqNV#bp=Th%^yC
zRmfB_H1UcR>!nCj%0x6w>bRLGlBFk-T1G?~Qj2!UjfGS|WArhkt|h|eEU}I=B(~|C
zQ)8S^Y9cqoPBiWaw;{E7pyZaO%H~ds#43YSGmng>lz|(ejODpymMcA(8xhms9#D%9
zmE0Usr?|;v;&>3q((@koi{v`7A~%FdsR-i}x#_984XMS&J~xXoCkRHO5_uxfaS|)h
zz^Nrl1jeKmy>UC}xWGzvnC?iiL1kULoun2Y>>~-qw7`ui8P6pKzsZwSq$Z(?rh(x?
z6`isZx(({%yavgW)Z+e<o6mX9y{1X7Gw9|qOe}LcAvxnY@jz9K4ayPS2tSdWSW7KF
zP;%2ijAqCUb16fgbQmB`8j*xdOO|rwt)8qK8DyZ<;XI@k_m$joWYQT*V&@OgO?Za>
zg3*~v^dD^$f$9^G<QtagiAau8i}#n@OqO}ZgHO01FgPA8onUDqgA5{P+DdbR8_cEP
z9j-Shs~G_`)Z#+F-DrxGRCK~DM+PD6nM_Q|Jd6&>NJhCp(~avktgp_N)KH7}mE0If
zQ?0FrMh<;arm!l;ki=W1Ll8tUHCZ<@NP`?{w*j{ywYazBre#ohsxU_wif?$*agric
zHOT}ELd3*ccfyto>ti*2vW8mRQ*uicMNTQRNe~RWX>?3SoPgz`R-n5e&D2joQf*jS
zGf|Y>MybVn`?_HOOO0-!HBrcu#3Yz{B(oYKBtheOZL$$=8mYT&MmyAYFE(OTZj-3R
zdrEFp38kI2Ngh1Rm!Lc`A&ZzAf%(b^SFy@t_0j4aFo{~+U2?O`dn<!OLwO)+G50v1
zt3*4+Jw_f0f=<+p^XjEdRc=FSaaYL=dD<Zmo1$-cAZa;tQ<!nMVVRIhQrOSQ+{WgB
zF>V8Du~u?Ziqb63?+kNlbY3tAbW^FBbRM=RP4m$?pjsc3RjWLSTCDbwgqP<HMp<SQ
zve45kV1DCS5<-?`l1UScsMn404Mrz&t5A!Tl3PY>5FAz+0}HkUwI|NPvozLGi+-t?
z8yx{7(xW~kDOc>|Bx<o-auYhRT*3j?o}-sU-5iCx5HdybjJja?=!`Q~-`E^5iCQd`
z+<Z<*n&oMNi^yP=Qwk&*g<pbs4e8fTnRL{ajMYb`Aqj`I)Vx?MxtYx76vi;oHbbBE
z(IsIF$=$?I+=>Rb-%RF4Fw`F-G3&o)C#$jysmEdg?Baq#vn*vPTxcPpwWNY1mcToq
zHb~4jTnE+bCV&9x^JrY^TwG94c&7qpAt;OHmZ|kBl{wH5poEm7T?iHwMq~1HJV!&h
zoTix`6HIp~-%w_PnHZxM=Sz@a+Oa!}0}0&1Ulf_Z3Wy?=UkA$bXzhg^1Btb%?6B^t
zL$T^Q03g*;i}`*BU`h%G$3HN5Qi69~Met3z&U~EIpnr8Jb?bw{rDOwM>v)sYQj2pX
zH|`koaIBNerBOFrfoF|V3GkCypgC;D=tS9<p3;t#a5+wx_a3(~>Z_;cx8569R8&aE
z(6C8L(bGgQ2Hg$EBXnj{EvW;};`z^99kd#26A5plBh7}^H8|E#i&K5gQl474IEkko
z9Xc+hEEcWMF_3_@3*3%Thoh@muRbC-2(8hqhFZ*(+*q2jj0Tb@7}n@;pfd)aLo=8p
zEdojHm;vnShWr00+t775g4;NC<^0vwd*;90TmS#-)#q0J(@L@Y+VbBn{c!0kOAju#
z7r(XeFBhIZ|7Y{xKL5(Z<$XhF5NHr+5NHr+5co+DI2H<XU-arIRh|ks;aWKguTElC
z7dVGX;kJ332NPV+hj1*#VgP<S;zRJ*GKF}UgAbUK91bAy&JpV+hjRdDp0FG)BGV>u
z3_%K<Y|XUdh-D#4N8quN{&CEBhc4eR`b0p2waXiJN2$j`mSTGx0JIveHIE(%R)8*X
z87j_mg#O^=X+)U1j@B$9)v9)USL79g+f#TI-7;{Frj)75Q>(tLu4=}>8BiC0r5^yE
z(rQI)*{;7fYs=P(G-HbtqU4rhkwvVA$7XW)q6!OhtFbJxSn{yU5rM<ZBc5+nMXmdb
zn>tyB)PnbQ^A6F;6oEt>dB#FZV1X<U12chHtd3LS>{w`Tq(AACVU${G!AfolYkW)K
zSf?_cY|atbuu>rQrc-KF>I`B76LnL1TH_9>1u3~XPEv{;nIuQZq&Fh5(!(l`8HFeu
zeq^I7mM)SMuBh$^wSlAEl{Lg9>hkycT}gVcMT+5y@EX?RISz2U%p?BgbwNv!rj%il
z(v&DawwHjV#6YBz(Z*V8@kGhZ;6m>ltC@smF^&|_l^ldj6g+b*sZ!^&6L6Q@PA+Rk
z0T`tg8zncyozpyn%TI%bC86;Oag7K80^c|eFT0D?@x~o+LtJtq+;U?`Es~O(Wr#k<
z<*4I`9tnq)sL@#bh76r3#g3bkqf54`^xD=8lYuNlYVlaV-5gI1szjJdqAPigcm&qz
z=)DTJ1>`v{85mvIbh#m(NU$8W*h{GCxHVMFL*=#<<x&NyEW*Tb&&^7LaG63A5?4H4
ziZrE+G#LqqpqyyjA=5gmR6{L3Tyk^D#ekAX5a9v<I4KSQFd;D<<WKQFHU>^ur9pi}
z)iiDmwYc2phRBkao+LbIXpN1b#Nfh!gnG<P8duc|J+=vkbz~oIBCC;&YGVwk#iM;B
zDOwd>7hyY%fvd3l7~>`hWhue=ey>wKNjI}$b&Z`UWf`Rwmr8B|kp*n%$pkSGaPuCa
zP@Unb3YT-PNYuQx-MVoUIZ3xMYVk8AH^dWQ$`SLI0lPLB_W}D~=)#%HVcoIOs`C@}
zJxbrJZ!C^7Kyr*)JW_H~FagdX7-eLR^*=!{#boh94x5`a6?uT|A2$I5ZbF^da_hBf
Jm)nr~e*q%uvuFSS