From 81ff1dc14802184e99189be32fe36073ee47e109 Mon Sep 17 00:00:00 2001
From: CSXFanMeng <105690322+CSXFanMeng@users.noreply.github.com>
Date: Mon, 2 Nov 2026 23:47:32 +0800
Subject: [PATCH] =?UTF-8?q?feat(plugin):=20=E6=94=AF=E6=8C=81=E7=BB=8F?=
 =?UTF-8?q?=E5=AE=BF=E4=B8=BB=E7=A1=AE=E8=AE=A4=E6=89=93=E5=BC=80=E5=A3=B0?=
 =?UTF-8?q?=E6=98=8E=E7=AB=99=E7=82=B9=E7=9A=84=E5=A4=96=E9=83=A8=E7=BD=91?=
 =?UTF-8?q?=E5=9D=80=20(#14089)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat(plugin): open declared external URLs with host consent

* style(test): format saved SQL sync callback for CI
---
 .../plugins/PluginOpenUrlDialog.spec.ts       | 102 ++++++++++++++++++
 .../plugins/PluginOpenUrlDialog.vue           |  80 ++++++++++++++
 .../plugins/PluginWorkbenchHost.vue           |   5 +
 apps/desktop/src/i18n/locales/az.ts           |   2 +
 apps/desktop/src/i18n/locales/en.ts           |   2 +
 apps/desktop/src/i18n/locales/es.ts           |   2 +
 apps/desktop/src/i18n/locales/id.ts           |   2 +
 apps/desktop/src/i18n/locales/it.ts           |   2 +
 apps/desktop/src/i18n/locales/ja.ts           |   2 +
 apps/desktop/src/i18n/locales/ko.ts           |   2 +
 apps/desktop/src/i18n/locales/pl.ts           |   2 +
 apps/desktop/src/i18n/locales/pt-BR.ts        |   2 +
 apps/desktop/src/i18n/locales/ru.ts           |   2 +
 apps/desktop/src/i18n/locales/th.ts           |   2 +
 apps/desktop/src/i18n/locales/tr.ts           |   2 +
 apps/desktop/src/i18n/locales/zh-CN.ts        |   2 +
 apps/desktop/src/i18n/locales/zh-TW.ts        |   2 +
 .../src/lib/plugins/pluginHostBridge.ts       |  11 ++
 .../src/lib/plugins/pluginOpenUrl.spec.ts     |  58 ++++++++++
 apps/desktop/src/lib/plugins/pluginOpenUrl.ts |  32 ++++++
 .../src/plugins/manifest.rs                   |  80 +++++++++++++-
 docs/content/docs/plugin-development.cn.mdx   |  16 +++
 docs/content/docs/plugin-development.mdx      |  16 +++
 .../issue-14017-open-url-mobile.png           | Bin 0 -> 21055 bytes
 docs/screenshots/issue-14017-open-url.png     | Bin 0 -> 25444 bytes
 plugins/manifest.schema.json                  |   3 +-
 plugins/sdk/dev-host/browser-bridge.mjs       |   1 +
 .../dev-host/tests/browser-bridge.test.mjs    |  16 +++
 28 files changed, 445 insertions(+), 3 deletions(-)
 create mode 100644 apps/desktop/src/components/plugins/PluginOpenUrlDialog.spec.ts
 create mode 100644 apps/desktop/src/components/plugins/PluginOpenUrlDialog.vue
 create mode 100644 apps/desktop/src/lib/plugins/pluginOpenUrl.spec.ts
 create mode 100644 apps/desktop/src/lib/plugins/pluginOpenUrl.ts
 create mode 100644 docs/screenshots/issue-14017-open-url-mobile.png
 create mode 100644 docs/screenshots/issue-14017-open-url.png

diff --git a/apps/desktop/src/components/plugins/PluginOpenUrlDialog.spec.ts b/apps/desktop/src/components/plugins/PluginOpenUrlDialog.spec.ts
new file mode 100644
index 0000000000..5e041c6924
--- /dev/null
+++ b/apps/desktop/src/components/plugins/PluginOpenUrlDialog.spec.ts
@@ -0,0 +1,102 @@
+// @vitest-environment happy-dom
+import { createApp, h, nextTick, reactive, type App } from "vue";
+import { createI18n } from "vue-i18n";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import PluginOpenUrlDialog from "./PluginOpenUrlDialog.vue";
+const shell = vi.hoisted(() => ({ open: vi.fn(), native: false }));
+vi.mock("@/lib/backend/tauriRuntime", () => ({ isTauriRuntime: () => shell.native }));
+vi.mock("@tauri-apps/plugin-shell", () => ({ open: shell.open }));
+let app: App;
+let host: HTMLElement;
+afterEach(() => {
+  app?.unmount();
+  host?.remove();
+  vi.clearAllMocks();
+  shell.native = false;
+});
+async function mount() {
+  const props = reactive({ pluginId: "bookmarks", pluginName: "Bookmarks", permissions: ["host.openUrl:https://example.com"] });
+  let dialog!: InstanceType<typeof PluginOpenUrlDialog>;
+  host = document.createElement("div");
+  document.body.append(host);
+  app = createApp({
+    render: () =>
+      h(PluginOpenUrlDialog, {
+        ...props,
+        ref: (value) => {
+          dialog = value as typeof dialog;
+        },
+      }),
+  });
+  app.use(createI18n({ legacy: false, locale: "en", messages: { en: { pluginPlatform: { openUrlTitle: "Open external URL", openUrlPrompt: "Plugin {name} wants to open this URL." }, common: { cancel: "Cancel" }, grid: { openUrl: "Open in browser" } } } }));
+  app.mount(host);
+  await nextTick();
+  return { props, dialog };
+}
+describe("PluginOpenUrlDialog", () => {
+  it("shows host-owned identity and full destination; cancel and unmount never navigate", async () => {
+    const { dialog } = await mount();
+    const decision = dialog.request("https://example.com/path?q=visible");
+    await nextTick();
+    expect(document.body.textContent).toContain("Plugin Bookmarks");
+    expect(document.body.textContent).toContain("https://example.com/path?q=visible");
+    const link = document.querySelector<HTMLAnchorElement>('a[target="_blank"]')!;
+    expect(link.rel).toBe("noopener noreferrer");
+    expect(link.getAttribute("referrerpolicy")).toBe("no-referrer");
+    await expect(dialog.request("https://example.com/second")).rejects.toThrow("already awaiting");
+    [...document.querySelectorAll("button")].find((b) => b.textContent === "Cancel")!.click();
+    await expect(decision).resolves.toEqual({ opened: false });
+    expect(shell.open).not.toHaveBeenCalled();
+    const pending = dialog.request("https://example.com/again");
+    app.unmount();
+    await expect(pending).resolves.toEqual({ opened: false });
+  });
+  it("does not call the native shell until explicit approval and keeps failures retryable", async () => {
+    shell.native = true;
+    shell.open.mockRejectedValueOnce(new Error("Browser unavailable")).mockResolvedValueOnce(undefined);
+    const { dialog } = await mount();
+    const result = dialog.request("https://example.com/path");
+    await nextTick();
+    expect(shell.open).not.toHaveBeenCalled();
+    document.querySelector<HTMLAnchorElement>('a[target="_blank"]')!.click();
+    await vi.waitFor(() => expect(document.querySelector('[role="alert"]')?.textContent).toBe("Browser unavailable"));
+    document.querySelector<HTMLAnchorElement>('a[target="_blank"]')!.click();
+    await expect(result).resolves.toEqual({ opened: true });
+    expect(shell.open).toHaveBeenCalledTimes(2);
+    expect(shell.open).toHaveBeenLastCalledWith("https://example.com/path");
+  });
+  it("cancels pending consent when plugin identity or permissions change", async () => {
+    const { dialog, props } = await mount();
+    const result = dialog.request("https://example.com/path");
+    props.permissions = [];
+    await nextTick();
+    await expect(result).resolves.toEqual({ opened: false });
+    expect(() => dialog.request("https://example.com/path")).toThrow("not declared");
+  });
+  it("does not let a late native opening settle a subsequent request", async () => {
+    shell.native = true;
+    let finish!: () => void;
+    shell.open.mockImplementationOnce(
+      () =>
+        new Promise<void>((resolve) => {
+          finish = resolve;
+        }),
+    );
+    const { dialog } = await mount();
+    const first = dialog.request("https://example.com/first");
+    await nextTick();
+    document.querySelector<HTMLAnchorElement>('a[target="_blank"]')!.click();
+    await vi.waitFor(() => expect(shell.open).toHaveBeenCalled());
+    dialog.cancel();
+    await expect(first).resolves.toEqual({ opened: false });
+    await expect(dialog.request("https://example.com/second")).rejects.toThrow("already awaiting");
+    finish();
+    await nextTick();
+    await nextTick();
+    const second = dialog.request("https://example.com/second");
+    await nextTick();
+    expect(document.body.textContent).toContain("https://example.com/second");
+    dialog.cancel();
+    await expect(second).resolves.toEqual({ opened: false });
+  });
+});
diff --git a/apps/desktop/src/components/plugins/PluginOpenUrlDialog.vue b/apps/desktop/src/components/plugins/PluginOpenUrlDialog.vue
new file mode 100644
index 0000000000..c6bb5f669b
--- /dev/null
+++ b/apps/desktop/src/components/plugins/PluginOpenUrlDialog.vue
@@ -0,0 +1,80 @@
+<script setup lang="ts">
+import { onBeforeUnmount, ref, watch } from "vue";
+import { useI18n } from "vue-i18n";
+import { ExternalLink } from "@lucide/vue";
+import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from "@/components/ui/dialog";
+import { Button } from "@/components/ui/button";
+import { isTauriRuntime } from "@/lib/backend/tauriRuntime";
+import { permittedPluginUrl } from "@/lib/plugins/pluginOpenUrl";
+
+const props = defineProps<{ pluginId: string; pluginName: string; permissions?: readonly string[] }>();
+const { t } = useI18n();
+const url = ref("");
+const open = ref(false);
+const error = ref("");
+const opening = ref(false);
+let settle: ((result: { opened: boolean }) => void) | undefined;
+function cancel() {
+  open.value = false;
+  const resolve = settle;
+  settle = undefined;
+  resolve?.({ opened: false });
+}
+function request(value: string): Promise<{ opened: boolean }> {
+  if (settle || opening.value) return Promise.reject(new Error("A plugin URL request is already awaiting consent or opening"));
+  url.value = permittedPluginUrl(value, props.permissions);
+  error.value = "";
+  open.value = true;
+  return new Promise((resolve) => {
+    settle = resolve;
+  });
+}
+async function approve(event: MouseEvent) {
+  const resolve = settle;
+  try {
+    const target = permittedPluginUrl(url.value, props.permissions);
+    if (isTauriRuntime()) {
+      event.preventDefault();
+      opening.value = true;
+      const { open } = await import("@tauri-apps/plugin-shell");
+      if (!resolve || settle !== resolve) return;
+      await open(permittedPluginUrl(target, props.permissions));
+    }
+    // Web navigation stays on this trusted anchor click, preserving activation.
+    if (!resolve || settle !== resolve) return;
+    settle = undefined;
+    open.value = false;
+    resolve?.({ opened: true });
+  } catch (cause) {
+    event.preventDefault();
+    if (settle === resolve) error.value = cause instanceof Error ? cause.message : String(cause);
+  } finally {
+    opening.value = false;
+  }
+}
+watch(() => JSON.stringify([props.pluginId, props.permissions]), cancel);
+watch(open, (value) => {
+  if (!value) cancel();
+});
+onBeforeUnmount(cancel);
+defineExpose({ request, cancel });
+</script>
+
+<template>
+  <Dialog v-model:open="open">
+    <DialogContent class="w-[calc(100vw-2rem)] max-w-lg">
+      <DialogHeader
+        ><DialogTitle>{{ t("pluginPlatform.openUrlTitle") }}</DialogTitle
+        ><DialogDescription class="break-words">{{ t("pluginPlatform.openUrlPrompt", { name: pluginName }) }}</DialogDescription></DialogHeader
+      >
+      <p class="max-h-48 overflow-auto whitespace-pre-wrap break-all rounded border bg-muted/30 p-3 font-mono text-sm" dir="ltr">{{ url }}</p>
+      <p v-if="error" class="break-words text-sm text-destructive" role="alert">{{ error }}</p>
+      <DialogFooter>
+        <Button variant="outline" :disabled="opening" @click="cancel">{{ t("common.cancel") }}</Button>
+        <Button as-child :disabled="opening"
+          ><a :href="url" target="_blank" rel="noopener noreferrer" referrerpolicy="no-referrer" :aria-disabled="opening" @click="opening ? $event.preventDefault() : approve($event)"><ExternalLink class="h-4 w-4" />{{ t("grid.openUrl") }}</a></Button
+        >
+      </DialogFooter>
+    </DialogContent>
+  </Dialog>
+</template>
diff --git a/apps/desktop/src/components/plugins/PluginWorkbenchHost.vue b/apps/desktop/src/components/plugins/PluginWorkbenchHost.vue
index dc8ff4cac0..4edb19c860 100644
--- a/apps/desktop/src/components/plugins/PluginWorkbenchHost.vue
+++ b/apps/desktop/src/components/plugins/PluginWorkbenchHost.vue
@@ -1,5 +1,6 @@
 <script setup lang="ts">
 import { mysqlDataCharsetEnabled } from "@/lib/connection/mysqlDataCharset";
+import PluginOpenUrlDialog from "./PluginOpenUrlDialog.vue";
 import { computed, inject, nextTick, onBeforeUnmount, onMounted, ref, watch } from "vue";
 import { AlertTriangle, Loader2 } from "@lucide/vue";
 import * as api from "@/lib/backend/api";
@@ -59,6 +60,7 @@ const emit = defineEmits<{
 const { t, locale: appLocale } = useI18n();
 const { isDark, themeRevision } = useTheme();
 const settingsStore = useSettingsStore();
+const urlDialog = ref<InstanceType<typeof PluginOpenUrlDialog>>();
 const openAiConversation = inject(OPEN_PLUGIN_AI_CONVERSATION, undefined);
 // Per-plugin grant for `script-src 'unsafe-eval'`; flipping it rebuilds the
 // sandbox document (and must not reuse a doc cached under the other setting).
@@ -685,6 +687,7 @@ function createBridge() {
       saveFile: (_pluginId, request, data) => savePluginFile(request, data),
       downloadFile: isTauriRuntime() ? downloadPluginFile : undefined,
       cancelDownload: isTauriRuntime() ? cancelPluginDownload : undefined,
+      openUrl: (url) => (urlDialog.value ? urlDialog.value.request(url) : Promise.reject(new Error("Host URL consent is unavailable"))),
       copyText: (_pluginId, text) => copyToClipboard(text),
       // Permission-gated in the bridge (host.clipboard:read); the helper
       // prefers the Tauri clipboard plugin and falls back to the Web Clipboard.
@@ -786,6 +789,7 @@ async function loadWorkbench() {
   // An identity rebuild swaps the plugin this component serves; retire the
   // previous plugin's handles first or they would outlive their owner.
   disposeLocalFileHandles();
+  urlDialog.value?.cancel();
   bridge?.dispose();
   bridge = undefined;
   loading.value = true;
@@ -931,6 +935,7 @@ onBeforeUnmount(() => {
 
 <template>
   <div class="relative flex size-full overflow-hidden" :class="hostSurfaceClass">
+    <PluginOpenUrlDialog ref="urlDialog" :plugin-id="plugin.manifest.id" :plugin-name="plugin.manifest.name" :permissions="plugin.manifest.permissions" />
     <div v-if="loading" class="absolute inset-0 z-10 flex items-center justify-center text-sm text-muted-foreground" :class="overlayClass">
       <Loader2 class="mr-2 size-4 animate-spin" />
       {{ t("pluginPlatform.loadingTitle", { title }) }}
diff --git a/apps/desktop/src/i18n/locales/az.ts b/apps/desktop/src/i18n/locales/az.ts
index f52a24fe65..3d2ecfef8a 100644
--- a/apps/desktop/src/i18n/locales/az.ts
+++ b/apps/desktop/src/i18n/locales/az.ts
@@ -82,6 +82,8 @@ export default withEnglishFallback({
   sidebarMenu,
   oracleIndex: { mixedDraft: "Oracle indeks dəyişikliklərini digər cədvəl quruluşu dəyişikliklərindən ayrıca tətbiq edin." },
   pluginPlatform: {
+    openUrlTitle: "Xarici URL aç",
+    openUrlPrompt: "{name} plagini bu URL-ni brauzerinizdə açmaq istəyir.",
     dataAccessConsent: '"{name}" "{connection}" bağlantısındakı məlumatları oxumaq istəyir. Bu bağlantı açıq olduqca plagin, Plagin Mərkəzində girişi ləğv edənə qədər orada yalnız oxuma sorğuları icra edə bilər. İcazə verilsin?',
     dataAccessConsentTitle: "Məlumat girişi sorğusu",
     mcpToolsBadge: "MCP alətləri",
diff --git a/apps/desktop/src/i18n/locales/en.ts b/apps/desktop/src/i18n/locales/en.ts
index 5950dda309..9c9943a4e6 100644
--- a/apps/desktop/src/i18n/locales/en.ts
+++ b/apps/desktop/src/i18n/locales/en.ts
@@ -805,6 +805,8 @@ export default {
   docs,
   dataDictionary,
   pluginPlatform: {
+    openUrlTitle: "Open external URL",
+    openUrlPrompt: "Plugin {name} wants to open this URL in your browser.",
     dataAccessConsent: '"{name}" wants to read data from the connection "{connection}". While that connection is open, the plugin can run read-only queries on it until you revoke access in the Plugin Center. Allow?',
     dataAccessConsentTitle: "Data Access Request",
     mcpToolsBadge: "MCP tools",
diff --git a/apps/desktop/src/i18n/locales/es.ts b/apps/desktop/src/i18n/locales/es.ts
index 4f6711a2e4..d5060e7640 100644
--- a/apps/desktop/src/i18n/locales/es.ts
+++ b/apps/desktop/src/i18n/locales/es.ts
@@ -610,6 +610,8 @@ export default withEnglishFallback({
   docs,
   dataDictionary,
   pluginPlatform: {
+    openUrlTitle: "Abrir URL externa",
+    openUrlPrompt: "El complemento {name} quiere abrir esta URL en tu navegador.",
     dataAccessConsent: '"{name}" quiere leer datos de la conexión "{connection}". Mientras esa conexión esté abierta, el plugin podrá ejecutar consultas de solo lectura en ella hasta que revoques el acceso en el Centro de plugins. ¿Permitir?',
     dataAccessConsentTitle: "Solicitud de acceso a datos",
     mcpToolsBadge: "Herramientas MCP",
diff --git a/apps/desktop/src/i18n/locales/id.ts b/apps/desktop/src/i18n/locales/id.ts
index a095299457..25d78097e4 100644
--- a/apps/desktop/src/i18n/locales/id.ts
+++ b/apps/desktop/src/i18n/locales/id.ts
@@ -121,6 +121,8 @@ export default withEnglishFallback({
   docs,
   dataDictionary,
   pluginPlatform: {
+    openUrlTitle: "Buka URL eksternal",
+    openUrlPrompt: "Plugin {name} ingin membuka URL ini di browser Anda.",
     dataAccessConsent: '"{name}" ingin membaca data dari koneksi "{connection}". Selama koneksi tersebut terbuka, plugin dapat menjalankan kueri read-only pada koneksi itu hingga Anda mencabut aksesnya di Plugin Center. Izinkan?',
     dataAccessConsentTitle: "Permintaan Akses Data",
     mcpToolsBadge: "Alat MCP",
diff --git a/apps/desktop/src/i18n/locales/it.ts b/apps/desktop/src/i18n/locales/it.ts
index 65822dafbb..30249aa654 100644
--- a/apps/desktop/src/i18n/locales/it.ts
+++ b/apps/desktop/src/i18n/locales/it.ts
@@ -607,6 +607,8 @@ export default withEnglishFallback({
   docs,
   dataDictionary,
   pluginPlatform: {
+    openUrlTitle: "Apri URL esterno",
+    openUrlPrompt: "Il plugin {name} vuole aprire questo URL nel browser.",
     dataAccessConsent: '"{name}" vuole leggere i dati della connessione "{connection}". Finché la connessione è aperta, il plugin potrà eseguire query di sola lettura su di essa finché non revochi l\'accesso nel Centro plugin. Consentire?',
     dataAccessConsentTitle: "Richiesta di accesso ai dati",
     mcpToolsBadge: "Strumenti MCP",
diff --git a/apps/desktop/src/i18n/locales/ja.ts b/apps/desktop/src/i18n/locales/ja.ts
index 3ad8de439d..b0290f6702 100644
--- a/apps/desktop/src/i18n/locales/ja.ts
+++ b/apps/desktop/src/i18n/locales/ja.ts
@@ -608,6 +608,8 @@ export default withEnglishFallback({
   docs,
   dataDictionary,
   pluginPlatform: {
+    openUrlTitle: "外部 URL を開く",
+    openUrlPrompt: "プラグイン {name} が次の URL をブラウザーで開こうとしています。",
     dataAccessConsent: "「{name}」が接続「{connection}」のデータの読み取りを要求しています。許可すると、プラグインセンターで取り消すまで、この接続が開いている間はプラグインが読み取り専用クエリを実行できます。許可しますか？",
     dataAccessConsentTitle: "データアクセスの要求",
     mcpToolsBadge: "MCP ツール",
diff --git a/apps/desktop/src/i18n/locales/ko.ts b/apps/desktop/src/i18n/locales/ko.ts
index a861c188a1..91caee0414 100644
--- a/apps/desktop/src/i18n/locales/ko.ts
+++ b/apps/desktop/src/i18n/locales/ko.ts
@@ -606,6 +606,8 @@ export default withEnglishFallback({
   docs,
   dataDictionary,
   pluginPlatform: {
+    openUrlTitle: "외부 URL 열기",
+    openUrlPrompt: "플러그인 {name}이 다음 URL을 브라우저에서 열려고 합니다.",
     dataAccessConsent: '"{name}" 플러그인이 "{connection}" 연결의 데이터 읽기를 요청합니다. 허용하면 플러그인 센터에서 취소할 때까지 이 연결이 열려 있는 동안 플러그인이 읽기 전용 쿼리를 실행할 수 있습니다. 허용하시겠습니까?',
     dataAccessConsentTitle: "데이터 액세스 요청",
     mcpToolsBadge: "MCP 도구",
diff --git a/apps/desktop/src/i18n/locales/pl.ts b/apps/desktop/src/i18n/locales/pl.ts
index 735b4941b9..6dfd6becf8 100644
--- a/apps/desktop/src/i18n/locales/pl.ts
+++ b/apps/desktop/src/i18n/locales/pl.ts
@@ -211,6 +211,8 @@ export default withEnglishFallback({
   docs,
   dataDictionary,
   pluginPlatform: {
+    openUrlTitle: "Otwórz zewnętrzny URL",
+    openUrlPrompt: "Wtyczka {name} chce otworzyć ten URL w przeglądarce.",
     mcpToolsBadge: "Narzędzia MCP",
     mcpToolsBadgeHint: "Ta wtyczka udostępnia narzędzia MCP. Włącz je i nadaj uprawnienia w Ustawienia → MCP → Możliwości.",
     mcpToolsFilter: "Tylko wtyczki z narzędziami MCP ({count})",
diff --git a/apps/desktop/src/i18n/locales/pt-BR.ts b/apps/desktop/src/i18n/locales/pt-BR.ts
index 8fbf9fe590..f9d980e1a5 100644
--- a/apps/desktop/src/i18n/locales/pt-BR.ts
+++ b/apps/desktop/src/i18n/locales/pt-BR.ts
@@ -608,6 +608,8 @@ export default withEnglishFallback({
   docs,
   dataDictionary,
   pluginPlatform: {
+    openUrlTitle: "Abrir URL externa",
+    openUrlPrompt: "O plugin {name} deseja abrir esta URL no seu navegador.",
     dataAccessConsent: '"{name}" quer ler dados da conexão "{connection}". Enquanto essa conexão estiver aberta, o plugin poderá executar consultas somente leitura nela até você revogar o acesso na Central de plugins. Permitir?',
     dataAccessConsentTitle: "Solicitação de acesso a dados",
     mcpToolsBadge: "Ferramentas MCP",
diff --git a/apps/desktop/src/i18n/locales/ru.ts b/apps/desktop/src/i18n/locales/ru.ts
index 7790af2b24..71a239559d 100644
--- a/apps/desktop/src/i18n/locales/ru.ts
+++ b/apps/desktop/src/i18n/locales/ru.ts
@@ -576,6 +576,8 @@ export default withEnglishFallback({
     },
   },
   pluginPlatform: {
+    openUrlTitle: "Открыть внешнюю ссылку",
+    openUrlPrompt: "Плагин {name} запрашивает открытие этой ссылки в браузере.",
     dataAccessConsent: "«{name}» запрашивает чтение данных подключения «{connection}». Пока подключение открыто, плагин сможет выполнять в нём запросы только на чтение, пока вы не отзовёте доступ в Центре плагинов. Разрешить?",
     dataAccessConsentTitle: "Запрос доступа к данным",
     mcpToolsBadge: "Инструменты MCP",
diff --git a/apps/desktop/src/i18n/locales/th.ts b/apps/desktop/src/i18n/locales/th.ts
index 783d3282ce..3641338a3a 100644
--- a/apps/desktop/src/i18n/locales/th.ts
+++ b/apps/desktop/src/i18n/locales/th.ts
@@ -664,6 +664,8 @@ export default withEnglishFallback({
     previewFailed: "ดูตัวอย่างไม่สำเร็จ: {error}",
   },
   pluginPlatform: {
+    openUrlTitle: "เปิด URL ภายนอก",
+    openUrlPrompt: "ปลั๊กอิน {name} ต้องการเปิด URL นี้ในเบราว์เซอร์ของคุณ",
     dataAccessConsent: '"{name}" ต้องการอ่านข้อมูลจากการเชื่อมต่อ "{connection}" ขณะที่การเชื่อมต่อนี้เปิดอยู่ Plugin จะเรียกใช้ Query แบบอ่านอย่างเดียวกับการเชื่อมต่อนี้ได้จนกว่าคุณจะเพิกถอนสิทธิ์ใน Plugin Center อนุญาตหรือไม่?',
     dataAccessConsentTitle: "คำขอเข้าถึงข้อมูล",
     mcpToolsBadge: "เครื่องมือ MCP",
diff --git a/apps/desktop/src/i18n/locales/tr.ts b/apps/desktop/src/i18n/locales/tr.ts
index 4f16b3c198..4f59aec2a2 100644
--- a/apps/desktop/src/i18n/locales/tr.ts
+++ b/apps/desktop/src/i18n/locales/tr.ts
@@ -82,6 +82,8 @@ export default withEnglishFallback({
   sidebarMenu,
   oracleIndex: { mixedDraft: "Oracle indeks değişikliklerini diğer tablo yapısı değişikliklerinden ayrı uygulayın." },
   pluginPlatform: {
+    openUrlTitle: "Harici URL aç",
+    openUrlPrompt: "{name} eklentisi bu URL'yi tarayıcınızda açmak istiyor.",
     dataAccessConsent: '"{name}", "{connection}" bağlantısındaki verileri okumak istiyor. Bu bağlantı açık olduğu sürece eklenti, Eklenti Merkezi\'nden erişimi iptal edene kadar bağlantıda salt okunur sorgular çalıştırabilir. İzin verilsin mi?',
     dataAccessConsentTitle: "Veri Erişim İsteği",
     mcpToolsBadge: "MCP araçları",
diff --git a/apps/desktop/src/i18n/locales/zh-CN.ts b/apps/desktop/src/i18n/locales/zh-CN.ts
index 839d596311..1c31dd934a 100644
--- a/apps/desktop/src/i18n/locales/zh-CN.ts
+++ b/apps/desktop/src/i18n/locales/zh-CN.ts
@@ -750,6 +750,8 @@ export default withEnglishFallback({
   docs,
   dataDictionary,
   pluginPlatform: {
+    openUrlTitle: "打开外部网址",
+    openUrlPrompt: "插件 {name} 请求在浏览器中打开以下网址。",
     dataAccessConsent: "「{name}」请求读取连接「{connection}」中的数据。在该连接打开期间，插件可以对它执行只读查询，直到你在插件中心撤销授权。是否允许？",
     dataAccessConsentTitle: "数据访问请求",
     mcpToolsBadge: "MCP 工具",
diff --git a/apps/desktop/src/i18n/locales/zh-TW.ts b/apps/desktop/src/i18n/locales/zh-TW.ts
index c59ae55683..0fc48fea86 100644
--- a/apps/desktop/src/i18n/locales/zh-TW.ts
+++ b/apps/desktop/src/i18n/locales/zh-TW.ts
@@ -590,6 +590,8 @@ export default withEnglishFallback({
   docs,
   dataDictionary,
   pluginPlatform: {
+    openUrlTitle: "開啟外部網址",
+    openUrlPrompt: "外掛程式 {name} 要求在瀏覽器中開啟以下網址。",
     dataAccessConsent: "「{name}」請求讀取連線「{connection}」中的資料。在該連線開啟期間，外掛可以對它執行唯讀查詢，直到你在外掛中心撤銷授權。是否允許？",
     dataAccessConsentTitle: "資料存取請求",
     mcpToolsBadge: "MCP 工具",
diff --git a/apps/desktop/src/lib/plugins/pluginHostBridge.ts b/apps/desktop/src/lib/plugins/pluginHostBridge.ts
index e25e734686..d4d496f107 100644
--- a/apps/desktop/src/lib/plugins/pluginHostBridge.ts
+++ b/apps/desktop/src/lib/plugins/pluginHostBridge.ts
@@ -1,4 +1,5 @@
 import { PLUGIN_AI_TASKS } from "./pluginAiCompletion";
+import { permittedPluginUrl } from "./pluginOpenUrl";
 import type { PluginAiProvider, PluginAiModel, PluginAiGenerateRequest, PluginAiStreamRequest, PluginAiStreamChunkEvent, PluginAiTask } from "./pluginAiCompletion";
 import type { InstalledPlugin, PluginBinaryEvent, PluginEvent, PluginUiAssetPayload, PluginUiContribution } from "@/types/database";
 import { clonePluginData, snapshotPluginWorkbenchContext } from "./pluginData";
@@ -161,6 +162,8 @@ export const MAX_PLUGIN_STORAGE_VALUE_BYTES = 256 * 1024;
 export const MAX_PLUGIN_STORAGE_KEY_CHARS = 256;
 
 export interface PluginHostBridgeApi {
+  /** Must display trusted host consent for every request; never launch directly. */
+  openUrl?(url: string): Promise<{ opened: boolean }>;
   invoke<T = unknown>(pluginId: string, method: string, params?: unknown, timeoutMs?: number): Promise<T>;
   notify(pluginId: string, method: string, params?: unknown): Promise<void>;
   sendBinary(pluginId: string, channel: string, dataBase64: string): Promise<void>;
@@ -505,6 +508,7 @@ export class PluginHostBridge {
       // Additive capability advertisement: an older host omits `planApi`, and a
       // plugin must treat the absence as "unsupported" rather than probing.
       capabilities: {
+        openUrl: !!this.api.openUrl,
         downloadFile: !!this.api.downloadFile,
         planApi: !!this.api.getPlanCapabilities && !!this.api.explainPlan,
         [PLUGIN_SCHEMA_METADATA_CAPABILITY]: !!this.api.getTableMetadata,
@@ -646,6 +650,12 @@ export class PluginHostBridge {
   }
 
   private async dispatch(method: string, params: unknown, binary?: ArrayBuffer): Promise<unknown> {
+    if (method === "host.openUrl") {
+      const input = requireRecord(params, "open URL params");
+      const url = permittedPluginUrl(input.url, this.plugin.manifest.permissions);
+      if (!this.api.openUrl) throw new Error("Host URL opening is unavailable");
+      return this.api.openUrl(url);
+    }
     if (method === "host.downloadFile") {
       if (!this.api.downloadFile) throw new Error("Streaming file downloads require the desktop host");
       const input = requireRecord(params, "download params");
@@ -1453,6 +1463,7 @@ export function pluginSdkSource(initialTheme?: PluginBridgeTheme): string {
         return request('backend.sendBinary', { channel }, { transfer: bytes });
       },
       readAsset: (path) => request('ui.readAsset', { path }),
+      openUrl: (url) => request('host.openUrl', { url }),
       readAssetUrl: async (path) => {
         const asset = await request('ui.readAsset', { path });
         return URL.createObjectURL(new Blob([decode(asset.dataBase64)], { type: asset.contentType }));
diff --git a/apps/desktop/src/lib/plugins/pluginOpenUrl.spec.ts b/apps/desktop/src/lib/plugins/pluginOpenUrl.spec.ts
new file mode 100644
index 0000000000..23fff3eb2d
--- /dev/null
+++ b/apps/desktop/src/lib/plugins/pluginOpenUrl.spec.ts
@@ -0,0 +1,58 @@
+// @vitest-environment happy-dom
+import { describe, expect, it, vi } from "vitest";
+import { permittedPluginUrl, pluginOpenUrlOrigins } from "./pluginOpenUrl";
+import { PluginHostBridge } from "./pluginHostBridge";
+import type { InstalledPlugin, PluginWorkbenchContribution } from "@/types/database";
+
+describe("plugin external URL permissions", () => {
+  const permissions = ["host.openUrl:https://docs.example.com", "host.openUrl:http://localhost:8080", "host.openUrl:https://[::1]:8443"];
+  it("matches only exact canonical HTTP(S) origins, independently of networking", () => {
+    expect(permittedPluginUrl("https://docs.example.com/guide?q=one#usage", permissions)).toBe("https://docs.example.com/guide?q=one#usage");
+    expect(permittedPluginUrl("http://localhost:8080/path", permissions)).toBe("http://localhost:8080/path");
+    expect(permittedPluginUrl("https://[::1]:8443/path", permissions)).toBe("https://[::1]:8443/path");
+    expect(pluginOpenUrlOrigins(["host.network:https://docs.example.com", "host.openUrl", "host.openUrl:*", "host.openUrl:https://docs.example.com/", "host.openUrl:https://docs.example.com:443", "host.openUrl:https://user@docs.example.com", "host.openUrl:https://*.example.com"])).toEqual([]);
+  });
+  it.each([
+    "javascript:alert(1)",
+    "data:text/html,test",
+    "file:///etc/passwd",
+    "mailto:user@example.com",
+    "https://docs.example.com.evil.test",
+    "https://evil.test/docs.example.com",
+    "http://docs.example.com",
+    "https://docs.example.com:8443",
+    "https://user:pass@docs.example.com/",
+    "//docs.example.com",
+    "https://docs.example.com/\nhttps://evil.test",
+    "https://docs.example.com\\@evil.test",
+    "https://docs.example.com/" + "a".repeat(4096),
+    null,
+    42,
+  ])("rejects disallowed input %s", (value) => expect(() => permittedPluginUrl(value, permissions)).toThrow());
+  it("bounds declaration lists and ignores malformed origins", () => {
+    expect(pluginOpenUrlOrigins(Array.from({ length: 10 }, (_, index) => `host.openUrl:https://site${index}.test`))).toHaveLength(8);
+  });
+  it("gates bridge calls, trusts neither message-supplied plugin IDs nor alien frames, and returns consent decisions", async () => {
+    const responses: any[] = [];
+    const target = { postMessage: (message: unknown) => responses.push(message) } as unknown as Window;
+    const openUrl = vi.fn().mockResolvedValueOnce({ opened: false }).mockResolvedValueOnce({ opened: true });
+    const plugin = { manifest: { id: "bookmarks", name: "Bookmarks", version: "1.0.0", permissions, drivers: [], contributions: [] }, compatibility: { compatible: true } } as InstalledPlugin;
+    const bridge = new PluginHostBridge(plugin, { type: "workbench", id: "bookmarks.main", label: "Bookmarks" } as PluginWorkbenchContribution, {}, () => target, { invoke: vi.fn(), notify: vi.fn(), sendBinary: vi.fn(), readAsset: vi.fn(), openUrl });
+    const send = (url: string, id: string, source = target) => bridge.handleWindowMessage({ source, data: { source: "dbx-plugin", version: 1, type: "request", id, method: "host.openUrl", params: { url, pluginId: "different-plugin" } } } as MessageEvent);
+    send("https://evil.test", "1");
+    await vi.waitFor(() => expect(responses).toHaveLength(1));
+    expect(openUrl).not.toHaveBeenCalled();
+    expect(responses[0].error).toContain("not declared");
+    send("https://docs.example.com/guide", "2", {} as Window);
+    await Promise.resolve();
+    expect(openUrl).not.toHaveBeenCalled();
+    send("https://docs.example.com/guide", "3");
+    await vi.waitFor(() => expect(responses).toHaveLength(2));
+    expect(responses[1].result).toEqual({ opened: false });
+    send("https://docs.example.com/guide", "4");
+    await vi.waitFor(() => expect(responses).toHaveLength(3));
+    expect(responses[2].result).toEqual({ opened: true });
+    expect(openUrl).toHaveBeenLastCalledWith("https://docs.example.com/guide");
+    bridge.dispose();
+  });
+});
diff --git a/apps/desktop/src/lib/plugins/pluginOpenUrl.ts b/apps/desktop/src/lib/plugins/pluginOpenUrl.ts
new file mode 100644
index 0000000000..bc3cb56f5b
--- /dev/null
+++ b/apps/desktop/src/lib/plugins/pluginOpenUrl.ts
@@ -0,0 +1,32 @@
+const PREFIX = "host.openUrl:";
+export const MAX_PLUGIN_OPEN_URL_ORIGINS = 8;
+export const MAX_PLUGIN_OPEN_URL_CHARS = 4096;
+
+export function pluginOpenUrlOrigins(permissions: readonly string[] = []): string[] {
+  const origins = new Set<string>();
+  for (const permission of permissions) {
+    if (!permission.startsWith(PREFIX)) continue;
+    const origin = permission.slice(PREFIX.length);
+    try {
+      const url = new URL(origin);
+      if ((url.protocol === "https:" || url.protocol === "http:") && url.origin === origin && !url.username && !url.password && !origin.includes("*") && !/[\s\\]/.test(origin)) origins.add(origin);
+    } catch {
+      /* Invalid declarations never grant access. */
+    }
+    if (origins.size >= MAX_PLUGIN_OPEN_URL_ORIGINS) break;
+  }
+  return [...origins];
+}
+
+export function permittedPluginUrl(value: unknown, permissions?: readonly string[]): string {
+  if (typeof value !== "string" || !value || value.length > MAX_PLUGIN_OPEN_URL_CHARS || [...value].some((char) => char.charCodeAt(0) <= 0x20 || char.charCodeAt(0) === 0x7f || char === "\\")) throw new Error("Invalid plugin URL");
+  let url: URL;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("Invalid plugin URL");
+  }
+  if ((url.protocol !== "https:" && url.protocol !== "http:") || url.username || url.password) throw new Error("Only HTTP(S) URLs without credentials are allowed");
+  if (!pluginOpenUrlOrigins(permissions).includes(url.origin)) throw new Error("Plugin URL origin is not declared in host.openUrl permissions");
+  return url.href;
+}
diff --git a/crates/dbx-plugin-runtime/src/plugins/manifest.rs b/crates/dbx-plugin-runtime/src/plugins/manifest.rs
index 9eca84f854..151e90dfba 100644
--- a/crates/dbx-plugin-runtime/src/plugins/manifest.rs
+++ b/crates/dbx-plugin-runtime/src/plugins/manifest.rs
@@ -44,6 +44,7 @@ pub const SUPPORTED_PLUGIN_PERMISSIONS: &[&str] = &[
 /// Cap the number of `host.network:<origin>` entries so a manifest cannot bloat
 /// the sandbox CSP or enumerate large origin lists.
 pub const MAX_PLUGIN_NETWORK_ORIGINS: usize = 8;
+pub const MAX_PLUGIN_OPEN_URL_ORIGINS: usize = 8;
 /// Bound the `visible_when` / `required_when` expression tree so a hostile
 /// manifest cannot make the host or the dialog evaluator do unbounded work.
 pub const MAX_PLUGIN_FIELD_CONDITION_DEPTH: usize = 8;
@@ -53,6 +54,24 @@ pub const MAX_PLUGIN_FIELD_CONDITION_NODES: usize = 64;
 pub const MAX_PLUGIN_PICKER_FILTERS: usize = 16;
 const HOST_NETWORK_PERMISSION_PREFIX: &str = "host.network:";
 
+/// External navigation is independent of sandbox networking. Exact canonical
+/// origins avoid wildcard, path, user-info, and default-port ambiguities.
+pub fn parse_host_open_url_permission(permission: &str) -> Option<&str> {
+    let origin = permission.strip_prefix("host.openUrl:")?;
+    if origin.len() > 4096 || origin.contains('*') || origin.chars().any(|c| c.is_whitespace() || c == '\\') {
+        return None;
+    }
+    let url = reqwest::Url::parse(origin).ok()?;
+    if !matches!(url.scheme(), "http" | "https")
+        || !url.username().is_empty()
+        || url.password().is_some()
+        || url.origin().ascii_serialization() != origin
+    {
+        return None;
+    }
+    Some(origin)
+}
+
 /// Parse a `host.network:https://host[:port]` permission into the origin that
 /// may appear in the sandbox `connect-src`. Only https origins without path,
 /// query, or fragment parts are accepted.
@@ -1210,12 +1229,14 @@ impl PluginManifest {
 
         let mut seen_permissions = HashSet::new();
         let mut network_origins: HashSet<&str> = HashSet::new();
+        let mut open_url_origins: HashSet<&str> = HashSet::new();
         for permission in &self.permissions {
             let valid = SUPPORTED_PLUGIN_PERMISSIONS.contains(&permission.as_str())
-                || (permission.starts_with("host.network:") && parse_host_network_permission(permission).is_some());
+                || parse_host_network_permission(permission).is_some()
+                || parse_host_open_url_permission(permission).is_some();
             if !valid {
                 errors.push(format!(
-                    "Unsupported plugin Host API permission '{permission}' (network permissions must look like host.network:https://example.com)"
+                    "Unsupported plugin Host API permission '{permission}' (origins must look like host.network:https://example.com or host.openUrl:https://example.com)"
                 ));
             } else if !seen_permissions.insert(permission) {
                 errors.push(format!("Duplicate plugin permission '{permission}'"));
@@ -1225,6 +1246,9 @@ impl PluginManifest {
                     errors.push(format!("Duplicate plugin network origin '{origin}'"));
                 }
             }
+            if let Some(origin) = parse_host_open_url_permission(permission) {
+                open_url_origins.insert(origin);
+            }
         }
         if network_origins.len() > MAX_PLUGIN_NETWORK_ORIGINS {
             errors.push(format!(
@@ -1232,6 +1256,12 @@ impl PluginManifest {
                 network_origins.len()
             ));
         }
+        if open_url_origins.len() > MAX_PLUGIN_OPEN_URL_ORIGINS {
+            errors.push(format!(
+                "Plugin declares {} external URL origins; at most {MAX_PLUGIN_OPEN_URL_ORIGINS} are allowed",
+                open_url_origins.len()
+            ));
+        }
         validate_localizations(&self.localizations, &mut errors);
         validate_declared_icon(plugin_dir, "Plugin icon", self.icon.as_deref(), &mut errors);
         validate_contributions(
@@ -2217,6 +2247,29 @@ fn valid_locale_tag(value: &str) -> bool {
 
 #[cfg(test)]
 mod tests {
+    #[test]
+    fn external_url_permissions_require_exact_canonical_http_origins() {
+        for origin in ["https://example.com", "http://localhost:8080", "https://[::1]:8443"] {
+            assert_eq!(super::parse_host_open_url_permission(&format!("host.openUrl:{origin}")), Some(origin));
+        }
+        for permission in [
+            "host.openUrl",
+            "host.network:https://example.com",
+            "host.openUrl:*",
+            "host.openUrl:javascript:alert(1)",
+            "host.openUrl:file:///tmp/file",
+            "host.openUrl:https://example.com/path",
+            "host.openUrl:https://example.com/",
+            "host.openUrl:https://example.com:443",
+            "host.openUrl:https://*.example.com",
+            "host.openUrl:https://user@other.com",
+            "host.openUrl:https://example.com?token=secret",
+            "host.openUrl:https://example.com#fragment",
+            "host.openUrl:https://example.com\\@other.com",
+        ] {
+            assert_eq!(super::parse_host_open_url_permission(permission), None, "{permission}");
+        }
+    }
     use std::collections::BTreeMap;
 
     use super::{
@@ -2816,6 +2869,29 @@ mod tests {
         assert!(compatibility.errors.iter().any(|error| error.contains("host.network:http://api.vendor.com")));
     }
 
+    #[test]
+    fn manifest_accepts_external_url_origins_but_rejects_malformed_or_excess_grants() {
+        let dir = tempfile::tempdir().unwrap();
+        std::fs::create_dir_all(dir.path().join("ui")).unwrap();
+        std::fs::write(dir.path().join("ui/index.html"), "<!doctype html>").unwrap();
+        let mut manifest: PluginManifest = serde_json::from_value(serde_json::json!({
+            "manifest_version":1,"id":"io.dbx.bookmarks","name":"Bookmarks","version":"1.0.0","publisher":"example",
+            "engines":{"dbx":">=0.1.0","host_api":"^1.0"},"entrypoints":{"ui":{"root":"ui","entry":"ui/index.html"}},
+            "permissions":["host.openUrl:https://example.com","host.openUrl:http://localhost:8080"]
+        }))
+        .unwrap();
+        let valid = manifest.compatibility(dir.path(), "0.1.0");
+        assert!(valid.compatible, "{:?}", valid.errors);
+        manifest.permissions.push("host.openUrl:javascript:alert(1)".into());
+        assert!(manifest
+            .compatibility(dir.path(), "0.1.0")
+            .errors
+            .iter()
+            .any(|error| error.contains("Unsupported plugin Host API permission")));
+        manifest.permissions = (0..9).map(|index| format!("host.openUrl:https://site{index}.example.com")).collect();
+        assert!(manifest.compatibility(dir.path(), "0.1.0").errors.iter().any(|error| error.contains("at most 8")));
+    }
+
     #[test]
     fn accepts_read_only_host_permissions_and_still_rejects_unknown_permissions() {
         let dir = tempfile::tempdir().unwrap();
diff --git a/docs/content/docs/plugin-development.cn.mdx b/docs/content/docs/plugin-development.cn.mdx
index 0074b23bb2..7f7d5e6e3f 100644
--- a/docs/content/docs/plugin-development.cn.mdx
+++ b/docs/content/docs/plugin-development.cn.mdx
@@ -145,9 +145,25 @@ Manifest 中的路径相对于包根目录，不能以 `/` 开头、不能包含
 - `host.data:read` 允许 `window.dbxPlugin.queryData` 在用户授权给插件的连接上执行一条只读 SQL（见 [只读数据查询](#只读数据查询)）。每个连接都需要用户同意；它不会授予写入、DDL 或重连。
 - `host.connections:read` 允许通过 `window.dbxPlugin.getConnections()` 或 `window.dbxPlugin.connections.list()` 获取当前所有已配置连接的只读脱敏信息（见 [连接信息读取](#连接信息读取)）。
 - `host.network:https://host[:port]` 声明浏览器可访问的 HTTPS origin，DBX 将它加入 CSP 的 `connect-src`；最多 8 个，不允许路径、通配符或 Token。仍受目标服务 CORS 规则约束。该权限不是原生 Sidecar 的网络防火墙。
+- `host.openUrl:http(s)://host[:port]` 允许请求打开指定站点，最多 8 个精确 origin；与网络权限独立，不允许路径、凭据、通配符或尾部斜杠。使用标准化的 `URL.origin`（默认端口应省略）；IPv6 地址使用方括号。
+
 - `backend.transport` 默认是 `stdio-jsonl`；需要二进制帧时使用 `stdio-framed`，并同时声明 `host.binary`。
 - `backend.executable`、`ui.root` 和 `ui.entry` 必须指向包内文件；带原生后端的包必须为每个目标平台提供对应可执行文件。
 
+### 打开外部网址
+
+在 manifest 中声明例如 `"host.openUrl:https://dbxio.com"`，再调用：
+
+```js
+if (window.dbxPlugin.capabilities?.openUrl) {
+  const { opened } = await window.dbxPlugin.openUrl("https://dbxio.com/cn/docs/plugins");
+}
+```
+
+每次请求都由 DBX 显示插件名称和完整目标网址，只有用户在宿主确认后才打开。Web / Docker 通过宿主的可信链接点击打开新标签页，桌面端使用系统浏览器；取消或关闭工作台返回 `{ opened: false }`，非法网址或未声明站点会拒绝请求。同一工作台同时只接受一个待确认请求。`opened: true` 表示已发起打开，不代表目标网页成功加载。
+
+接口只接受不带用户名、密码的 HTTP / HTTPS URL，最长 4,096 字符；不支持 `javascript:`、`file:` 等协议。iframe 仍保留 `sandbox="allow-scripts"`，不会获得任意弹窗、顶层导航或网络访问能力。旧宿主可能在安装时拒绝新权限；宿主或 SDK Dev Host 没有 `capabilities.openUrl` 时应隐藏入口，不要探测调用。
+
 ### Connection Provider
 
 连接 Provider 负责声明连接表单，DBX 负责渲染表单和保存生命周期；插件只处理自己的连接协议。`binding` 决定字段语义：`config` 写入外部配置，`secret` 写入 Secret Store，`name`、`host`、`port`、`username`、`password`、`database` 映射到标准连接字段。
diff --git a/docs/content/docs/plugin-development.mdx b/docs/content/docs/plugin-development.mdx
index 479fe71496..2a3c882a2a 100644
--- a/docs/content/docs/plugin-development.mdx
+++ b/docs/content/docs/plugin-development.mdx
@@ -148,9 +148,25 @@ Manifest paths are relative to the package root. They cannot start with `/`, con
 - `host.data:read` allows `window.dbxPlugin.queryData` to run one read-only SQL statement on a connection the user granted to the plugin (see [Read-only Data Queries](#read-only-data-queries)). Every connection needs the user's consent; it never grants writes, DDL, or reconnects.
 - `host.connections:read` allows `window.dbxPlugin.getConnections()` or `window.dbxPlugin.connections.list()` to read secret-free summary metadata for all configured connections (see [Connection Enumeration](#connection-enumeration)).
 - `host.network:https://host[:port]` declares a browser-accessible HTTPS origin added to CSP `connect-src`; at most eight origins are allowed, with no paths, wildcards, or tokens. The service's CORS rules still apply. This permission is not a native Sidecar network firewall.
+- `host.openUrl:http(s)://host[:port]` permits requesting navigation to up to eight exact origins. It is independent of network access and rejects paths, credentials, wildcards, and trailing slashes. Use the canonical `URL.origin` (omit default ports); bracket IPv6 addresses.
+
 - `backend.transport` defaults to `stdio-jsonl`. Use `stdio-framed` for binary frames and declare `host.binary` as well.
 - `backend.executable`, `ui.root`, and `ui.entry` must point to package files. Native packages need a matching executable for every target.
 
+### Open External URLs
+
+Declare, for example, `"host.openUrl:https://dbxio.com"` in the manifest, then call:
+
+```js
+if (window.dbxPlugin.capabilities?.openUrl) {
+  const { opened } = await window.dbxPlugin.openUrl("https://dbxio.com/en/docs/plugins");
+}
+```
+
+Every request displays the plugin name and complete destination in trusted DBX UI. Only explicit host approval opens it. Web / Docker uses a trusted host link click to open a new tab; desktop uses the system browser. Cancellation or workbench teardown returns `{ opened: false }`; invalid URLs and undeclared origins reject. Only one pending consent request is allowed per workbench. `opened: true` acknowledges initiation, not successful page loading.
+
+Only HTTP / HTTPS URLs without credentials are accepted, up to 4,096 characters. Protocols such as `javascript:` and `file:` are rejected. The iframe keeps `sandbox="allow-scripts"` without arbitrary popups, top navigation, or networking. Older hosts may reject the new permission during installation. Hide the action on hosts and SDK Dev Host where `capabilities.openUrl` is absent rather than probing the API.
+
 ### Connection Providers
 
 A connection provider declares a form; DBX renders the form and owns the connection lifecycle, while the plugin handles its protocol. `binding` gives a field its meaning: `config` is persisted as external configuration, `secret` goes to the Secret Store, and `name`, `host`, `port`, `username`, `password`, and `database` map to standard connection fields.
diff --git a/docs/screenshots/issue-14017-open-url-mobile.png b/docs/screenshots/issue-14017-open-url-mobile.png
new file mode 100644
index 0000000000000000000000000000000000000000..bcf914906909871f4878d6f18deded5bb072075a
GIT binary patch
literal 21055
zcmdSBXHZjd_~(lvq9~#wB3-Eh0@9_U7^?IHl&<v9q&ERY1?kdzCzJ$;^bR7@JA@KS
zK%|Gz2@nXm$Nlf_+})X-+4kbzx0%dIa(++wem~E15~ic2LQTa;MMg$Ot)}`?kBsb6
z2pJjqt815mSEg=ds*#c1CR2O)9PE>^HGloXy_NRvJxV$nMMbmAcOSl_pyLPKzWvk;
z{B;IQA^Rei4rWwcOcAjNGOp&UQLL#pgOpHQ=X>Ym*lrXq#xAKxBdbGx?XvEbOCbF{
z;*M;um59HUyTI_TowL2q@o2P^*Xrr;fvl*E|H%320X13uA2M>Xp@(r~&%UT$UcAkI
z{iD)1PO@8%{{Q{L^24fObnRvXPjZ0ctAlOw;hizD&6S!PtbVRh7Yi3#{DkTV$rv2J
z?XXefL`r_Edt#>DEF4`mDfX;_=-Qq6eZIQ2#F5%&*vQPJ^)k%8e_i57&>Htu#SgcX
z_4elc0}swa3!yWIO`eC|Mn0d-%giNQFw&NlBJRUGcjZ=iT!zx?9*ew5z7l&l5dyoh
zS|-lDX2qn&g`gkEsGA!Q<+;^#JSqR@H7~j*z))>*XV8IaO<>x>NW53-?_-w;%$sHl
zjNf?U=!Wgrq}OfF$3qe+n13j^RwRM<?e~&m5cvD!KYpW7GrlqB8WTK7L0Z2OtCg`8
zjN+u)Lb&drFL4jcb5A+u!VZ6ewWYkk?9Q=tWFwxb4fUKOWSGdTnVsuvwx-vN84@+C
zvBb{)2(Q$cAGkr^8~2`|1=`r63+DT8(EF2zrg>Ab1{5zvg#Wk|YFll``k=;kEvd|W
zokX2(Ef(o98BpVZ#hdycddJ@nWnn%&i&%1MYF408m?pdS{#l&#Vbf+@h<kFHe83FC
zNx#x#vRbGybHZw{NF}gHL!<L|Wp`j*;e5`xC<Y-L7rrV-_(e$wI&%-r%yNP|8vlvV
z*c#dP)L_^AMa6zc!s_=|b9e}3(ieP=yzV`q+kx}1i{50qJ~38khsBT&_sRE&4Q#og
z8W(7S7NeXEUonr3{->{j`QUM~i<^Dr?><%*ke*ojVa3Irp5#=%dEeGn-p#i=4uTvA
zaBA>%^8Mjg3A32<6g}^GE$M_Bv4=9vKRrU#(GNt3m9}o0MXAnI`QhUo_|khOf1vy)
zPW6#T-oNW)SaS;(-K`;T8y0Oxn*quyZaG6oMw_E&TxSQja81nh%@z;|7L4Nej#!Uh
z8@4THb?Edd+0&_s0HNvEKk7XW%js<gTNaH(r?7KUu(gu(3yCH;i+0wpFr|J%P-Vy~
z#_U;<RWKJ5mCayH%?~q<eH9OWmX^a$%?kol&90W{Ls(hcORq#o4aST%Kla+zf=TQ3
z9O6d}?W}+WH|vpv`PqfhZy|5cQIm8|W(VgSF)4K%`pe6Q(38W3b4lj8TH|bav`j>j
zps%^9RH$|K7;!zMkVs11G$zgM&?iBfBm$c|ANcDc*NMl?B-`3=<LHUMoBqgW!qBZv
zhK`~qB2H}zfm>)V`6C)w_!aQtVSw6EQ}#mJiW?+>swG?{!aX#~iIDs!rVPEm8N?AJ
zc|MfNGa=;H_<>NEIot-XN^=2eU<{+JmQDP=mYtPGiXYt1)KaJr(@Cq7=Nw{Wjz!y?
zHRd^Cc4r_+7wi;|Tej{V77@;289g*q{vNT>i1wD<O_cO_|2fZIA(I&{xN@_vUm_x0
z!f{~&Rhr_{jlhN6Y{+p}BG1W~^>$$!Dc|wM^<UVLTI6wQtA|+K+CG6HIpS}|(u;~U
zGuMfyXXd3cd}Yclf^3sj_T$_bEP}p#n)Q@4NfLa6E&Cb9VhqmsFf}Q}*T(R6*w6-B
zdCDK2JP^2e>P`Le;Z&Q>*kNR#+?LL9)md@q$%u19fRkkrvB9=l)D!u3icPcmZ1SQT
z6k;yqQ}Ni1=&V&hXMYRp7T0ze-7ppPfbJBzP(g>8cON(`v2;_XRQ3>JX?pudBUVZb
z7qGc^Rq;F4{4p9omN9l?w?DajZoaC!9bs;^2!RZwc~5?D=4){&kyfuQ^;?<P7d*I1
zP2)0Bw9^~Y(lX~5SYh!z#JAm{MqJ^n^sjo6PrwWdjX=$38HKW^h!y>EHmBOzPio0?
zAN-iO(%y)lHT0NjbmJ9BuUp?;1221V;>^Sc+sN8%eV_lqThjPAJEKiiHL?gQy2x?<
z)Q+sUIAr`;S69{;x8dkOI&zjaup$t+2NEXo-c$5nY2=~Z%xA=^s(v#8^qn2AgE&(*
z`ebTHeqk@o)@iy1?Mhn`Gokj=(`4;&t{vG^ySJPlMJi+DUy=ORdS$v+kdulXNer=O
ze+Gpv&IYfTN_JATwFFLE8_J)gsdXha3@751cfyYLFR`4hQ8+u4K6tEhM0~5Yj4zJN
zU_*x(BPLa54B2rt=VP_$RyN7vM_L0+s1+UZhrj=*`gyM=G{j11cVs-OBTY9!TM<4Q
zoVk^R7zS78WxW}CcXJ<W<3$$G0c*YG)`VmNM&PuwHVQNKEN(o{l+u3>5!fFe8rgI-
zRvZW?gi7wov}3)W{VD!w_&kl3h}-H(r|FmP_41iQ2IT};kA7)aI=D(BaCUXB{m4nK
zWaT)Nxy`YUNb<7{y>xr|J*Sf(<{kS)e0#E2`NH<rPNL_W815{8E(w!ZPhgOn5i8Tt
z<O|$6I-)E06(87|e$;ywr}d0DSF7n3=r)`mUp^>TuJ*MHlQnFp)ntFNbN_VDaDOwu
zqg%Gos;aFR*BKjP+;R0tsiu}doo?%6el(@nu@oE@<2yJqX^Za@G&6pElI%Kez(98C
z)-hKms%p4#WhdJkwEQC7eyqr4ILMay!|$dhx2v^6=!%vL-h5W6{O29>{e{gs7txb%
z-h{&lp>@*bXAHJS1iYH2p?2!iwNtfxZ}cr!WL3kTWLSIUN$%**Ngao0+fwTz7NM2{
zOz}5C^btOTSAXBoS%BEIp~h3^V|gm0o)vY2JIW8{sfAhjtfesOICp!4wa>B2|L;L;
ziAc0vp0lHr@9&n5K_Z;X-eNIiR(UqnF@@CEcfcO-s?2ywjU@ZMl{vaVxuv}EOr?nt
z=;IR#)+h5t39b7>e=WNQiFv<%3#75;+BZ`BFXsMP(SA5{zM!puha17zGY2mWJvai!
z0-NkZy+bWM5?$9SySI(2D@(mljXOPiO45>ZwRU|%tdAqVfO|uJ6|H$=Cv3X;kys?H
zwAhD(PHINGEHpvKKd6w=IpP&saoM2Pi8Nj7bXGeUl)n4gYReTTLj94f4p}emc>7>=
zHD5YIhrl9<{m9+0fZGs{VFddu{k?P)W0$qpp!T9U^o!W0=jr#jU%dUAM1z1JY5e}S
zS+ZAE76-SrXT8fWOa5BPE%B}WZR&yW$U@3ed3=J)&dlyqkJ623muwby=TxF|Hfm>_
zzS~rC5Q~GJWMVRJe$4SZSR0mf4)g1AtS&>?44IWrzW$uV!<_E=I>L%o-k9k5^dL)6
zelOTrATQ|$7H7?7<q`3r)4apMfWB@cC7@XO0y{xikUCnwA}WNgJZZ2sm*iQ=TFB>$
zNw~uI{%IW9R$G0*ga5w?OR1g$1VsO;wxAgIT1W{;Be!I#??acRyshWQbD8OHp~HP=
zp<0hi9rH3`PYt~V)1Nu?6znw!D7jyYxq{cWXH<hd=lDt+8gjWkWGE@vb!zZ6{b`da
zCcqo-@OB_6IEsMKv~gP1P2E>S>+SxG+wSP^us+DB$ls5+`LUqjEoa#`u-AFcUZS<m
zuttlzPQ={aX+tN4WK5O;fdJ=e`9cMHEdWWI)MOI(Fe>0nXt4T|XD@o6PT9tx`tVn+
z9QDTn*c(ptTt$?4jd!_d`_<U6p^~3WwqK2WYa0^ATMYO#-zZ(R)=C%l-6E9c)p+?#
z_HCoTI%tm0fMD?nhRNy&4w0#jvkqm{ANB0-tC`JrGa2oDocb&(g)AMSh3{Nx^w~!;
zWn|9_YOqN6<?rh>`9Uux3MW0-p1nNEufg7nkaIJp8%&XXoA9f6EkzA2>U6he%lr5+
zu-!R7@tAU9XC*-`0siyip%b#+lO;<bz$%)>KsZZY9Cfjo_d7Kq8Q12wR--hjJ;ZeW
z^X}Pxmy{(X4U4gkBUDp)8)U{*=7hLkcu?Xs=;r6ChR5}ll$?$it;VZNx4~?WYjIlp
zWl^ZleWXJn7rDO>?ZZuC**@im0-FSpywFs-l1QssXnr8<Yk%GHq|ud9lV(-Vio9Qj
z24?dOp0iINA1Y^U7!P7EeXkaaC|IOBejqpAUd-o&20_&<XNLNi=r(4Dq+nI(XZ=h}
zB|Z1<3z}3mnBz?R%;B9!%%Uw*{hw`}rkgic7`S<O5F=P!5wf@>8|pe$cSi#1?5Z_H
z8n*eQ&~!M%EB4Q119?jbcvzp@`>CfC2v_R)Rl@;>tJN|@H`}DeX|=qFzu|s0`oW0I
z?31+9SO30J0DjwvOKS*3UWH>z7p-y!BN$)j+7@}%nh6-SjiRDUACa?{fyB|3vqzCP
z>%g;55mD&Z_p(IB;xoNTeB=++378hAaGS`X^gE=L@(z`hrQo8LKS>M?hT4PFnv15F
zMQifU4b)6&o0~k;GF4vflsb^u?w9k6w5OB3Gjk=s9orQPRx{VD-Z$j0Ufc}vPF^*V
z*@EO4c?oJOmi0bv;*MpESFqUGEZyQ4`Po{E`46l4iRTj8`)jdRem;76mn`(Q8X5Bo
z&P)HRFD%XJb4favmW940SIrz4c%{#j5m7KR^OS7kTL{zt_ErDu7a5ZKRi?+k!zP{k
zbl1D7`D}Y@D(`$}DL7q4+Zanq6}K8YnM=Aj$+9e@+0nz#{HMfzYE4U49BkU;<up@m
ze}=~`d^m`@kUd?F*K|^CQw{H7NDcC|m3a`B*nTP{`HE$<=KSbCiij>@vzXFI<=tbB
zV?y&U-IhvF*MDIFr=mBmdhMBsq_4e7tI%@cjQI%HV{IYgXPsti2Zx5_cYl&=;?&MU
zjQ`bz_<i||XXO^|1BR5VDIg)_?u8xN1(j2p$Iy0M_(ZT?vaQ$@!(~bhT!X0Un-CkT
z+vID7k8LeTA_@+^k;J7!gw1BoM?<;!n>;tn&0hHGm#2t3IZb}Yeio1?>(%owdsAgo
zcx#Jeezt7ZCiRHTDU7jgKlMB><I|_YH*0q!55>O5A8-qb&~=d)Up``+@FVu954RTd
z-5Y$6DcNxg?%(A8b*k|e^O&=4LH60^(AAHY_`!5CR7<8p0Cc%ct>uOab!KJWIZS|}
z%`je|X+H1zF;aw#xyt3G-d@~SY^8rTbG~H{c1+M@t7sU`V_VwK>Vcc52c@~R7hhfs
z4q%UC515b>s!7J@JHBokVl(q4E&uZJ%@?ySIJKe5&Z_Dpd#^g9G6tO2CSs@|_xx%P
zmBeuB8#_0xy~Zd5*{9Dt=+Owr*x7{2sa0*h#}Z^2v03x8jaI7*Kj#H^S~vbGY1S$p
z*YdVRxB*2v7U9Uzzf&AJC;eUFZP(6?M)zZh#qj^sN6B>P`jdr_WiH>p?A93n4@e3p
z3y1wgLOV@q<k2snjjU2fpVOZde&c2}+Kb?DT`<$+XYE1EGZ;J{C}U#$8v#T?B#Q|_
zwWMbdCdm^t>*v}&sB|z#khjQidS%qC{m|_k)tO`v_~oVia)o%kgJdPhANR1-+MdWs
z#*!BQdAND7;Vn>{>3H7kslNrHn!Qd%nbpJCL-%W__M{X`1g+-cXk#p$gd}Q4+L1Q}
zQtRp3z2y&Wj*8upTAh0;4~gmH6ZG-Z#pn1pKH%gUWbX~y_4>2e<J{^`K;6Nd^pHDE
z(L@Sv^3x0TZOc7%+jTNCv)fn3>03_(qEBY-hjpP$l(#eW-J@iHi%M&xW?AZaajyR~
zPET|X2r1EswM8^m$3xi%*-QE-;FKlhdwnJ2p>@$<gDDELn;-gr`@|4qK9mRmEw*R$
zwr|p`k^B7OhqKDNgSVDZ2ALp%eBDz}Z0;D_!`*TB;3QZT0R)=TJiIUMYL}a7^Vu*o
zEkUm8FpAEgE65-1{+mO*l%_w6cUwSs^EFLW7;5x>VjyFDWe2~>1$2YT@Z9yv&J^t{
zpjBrzFRzY%ZRt;DI+qIZ$<C5Qc)}tC5u8_*lN6Ze1&e<i_hfvH$HhE*xr&xPf7><N
zwN3%*da`ADVV_Q=K=!t|DxsI*jYQ#jH%GO4vcX*ViLsHH+_5AlG$=9Po(BE>8mt@~
z)&@H^X$<t(aO`NadMl|j+xoQV1A>3Dw4X+_Y)n<O;t)1g7Cj&U<^4oCk-T%565*x9
zC^;8wd(~K@54j7jRsH&=+r#SV{)#baQBbqms7zHT?Y#>=V7zFC{M}58yWbpIC@!lA
zY*)Xcy#x8PJ9GO(zMM&ybuz5u%aQM~W(>2KG1Y3R7%^{Z(%)jWr^&dB;V;VvYYJYs
z*Yv5S%t2!{r&9u~sR{x0*Dv0^*sf8!ADx9CfSUwFVmj!$UK-@o|5Aav_ZbT#eQsvn
zO;k5~Wfh$&k1<|@P*8N5x`{U5ogHVBvff><C~RK8KbVpzY7cFV>QuFI=qoXGlsc9l
zxL;8#yc*2sY--iPGq->^|M^(%uC$7amX$MKhg71o{YJy1w!>p?cK;&JIU=1i=l#J4
zL^u267gl$s<`?)BPF1e^`C6&dJ57x&|4#eyfj73pVn0Fu9O>)KEYf>Mj2LvMGDtDu
zVWQsf>vU3Te>TfvCxcIV*%fea<C_2$6D<obbHaT0ilz4`6!~0U*1t1Jh}j$JX(=vx
zV_cov=TaThWMWt^R;e3H39ojt?yl>p>Goc`GhTF6s|{g>&whW~A+qd7!q>0IJ_}TR
zY;cB?&MP|`*S=O!NvMp;c6HFbpm|a^oJXaw*m?g2sU_3BW(e<l^HZ!5Tc?h%w<B69
zv?Wm&WSNs$+0UCxBU&F-asM8saVYsFeD{i#vF*m&m@CL%D=u0$xZIlh>QH#AC_dw)
zd6^1)a;A1ctPk|Za`Mi-9Ua~eT&ME(E-OTkzYIU7;6krCboWF3s0`BaF`r0knQ@YH
zY`U-2m~b5Xu&hV~)nJXcx4FF6t`4$HxLIX6(O~naCp$1k?uSI_FtfYo#?)m<cB4$4
z7Sn;Xf1|R?fZhD$y|M*6N8KkG8IsTN!{skuvSEP$pfJF0Z7t5up0<6z{U+3rR2-Ec
zC+Y+)2)<366)=`?77O&nSN9CuTyr@LXE1)i7adtT+(m6|oIEcf`ph?d;F%2nvxAfy
z;T4|G=~#~pA7!z#XSdM>X;>;ed5XE%*Sgsf+-vq$gFo<EVwjOfzk$=zD@KB>h9?f@
zKK!L!ys<j@^2SsPai5pNoyuHF+-+NYMedrezE^|M5q^o<dI!GiknpLMQ-x{5G!!v^
z=M7F*sR(ow^1Jby{%o>m-_WUG$)3c_<a(y(d$;h0Ha@YtrngJ%V!ny3u*YooHaw~^
z%#Kg8sp0e-0iQE-l$clixqn_VyYHPSA1<@M(8G*G<Q)#TWT>>qTkVA$(G9s^pfOKK
zEYjJyC0y2>pjSCdf5TAMg58UCYS6{eq_J?d<uwTi7QEi=L-pPxvj?FGE{*#wd!Q0?
zQ-VG2-b@!9BFz56GpTqm3@q@sdD+F@S5v~sE(kR7i=D4oay9gJ$yq7Cx!1B`TWK*!
zWit#yuQm*zqF0L>!_I2QO?6K7zwPR!I7}Ra)!q(BAAOzW%Q}{!fW=@<eS^?WE-P(H
z^bHC>s?VNmzK(JJe7KGyeY4rvAsCn-_RW=k(2!bwV;Vh?#HbQg`d5E`7aQ+1vw5d3
zE?C(G37+It-m>sN%Oh&G=w1+pQ}aA;MWJe6nJjxh;NoqL5~fd31zS!^SOsS*-8G)E
z{@6Inedfg0RP+vqd^Y@9Xqe!`_F~yXFNq$*%In`QLG#%~5>mPJsq#2PJ5WpQm`&42
ztlcG;!ufKKu=6)&bbe8Zi200c<h>&-yLR)TAPH2sE~T7|prjG^sxSRCX{}hResaa-
z*(T4g{GG!H*PZOf;cd~zghH<`l51+dqACJUf*MRQDYaGm9;d?zlBR|jg&Bt_4~bf&
z_n-CalC}%pw!6Zn3=Q5GOOMRrL$mPGv3^OqlFFxDHwET}VpDCusQ58?dQTWp3;!!o
zOJSa$VT>XigNtJw%9_7~rSf^ejWB_;dAZ(576@T_O!Yv86oD~!Weh`qR<==)15drx
zMBy%XnR_fJFKJAv8xq{PwFCn|bQw&q%$CCoOkuG$s8XMK8(|NYlmPdQJPz-xD5o9h
z5e%)*rLm(_0ekGGS-n2C9+<S>R4sn)?;fx&1@vcH#hNcWxbp2LxMcRB-ni3~7UQ*T
zaAJpQTO0#JD?iL@>Jfe~o89vm+$)CQg4An3)({(`@h`U}ZrzNDNmE?wIwb0<?bsmp
zWr**h(Z?tsCJmv@BDk53-?)+!n@!(J=Y^aBqA)UiF0W<>=bhEka=b-T!<2ydYNVGT
zvv?fbh~T=TMh1_}CMWx04or|9c>k01aoe%rK=QXwVndI<?!1_Ujq}Os-%(VD`E!D{
zy&Oa>J*;EoqEb!70~#NHG)gu*=1Np}&tH0&G%12}6B45sE<Z94p9}Ec6jeIdW=mDb
z`CtH|ha9oKBlF~!bGiJ@f5B_r4EK6?cG7=GJl`asfc5+RdjF=pB%ZbE{vhAZT|v4^
z8{gat?R(Ubx}c2>SN(w#4T+=$OYRF=m*Z`s4cUvaLx;Lpp8XX8Gx0o!Q@Jz#>|Pi5
zQIy5J?TY9PO&R@aFVom#GW7Zy4A~sC{)+tPBm3EwdC$e~N1tp7r9KwF2qT|w8@4$5
ztxcQjH9m5m5sj8-xvHo`kk8=UzZqJQ-$i$#a3tLF;&`O*j3-@xTNvAN)oAL^u@kc)
z;YoCOB_#vdw(8m%SE76aH$LA&(nmYSY~N#JK{#kVJcLO{?r3x3jDSVb$nGlY&yEpV
zId@KP;wmdSXxwhdg~@RoL(5ApdBW7<xsB_b#XTPiIH+02*nN{-nY@@OBf`q;_sVl9
z0>2A=0j@=@!s@#`>(W;C$!0KZ!r7Epz$Fp9y{wH)k%{eYI1+^^U~2`>n>ehIAtUd}
z;YDvdLb_SJ=L$8`Cz0l)LCFQXS5EVVzYqS61OM;2w>dkqg7p9U-tGUuRsL81_y758
zxP342|7S2SeZSb8K-g}+E(6_dAm2K;d+%UI9kHo0c1MMIwAz0B^DT9d+zrLXlLgX6
z9bg)@6^JOXhUaBiAd&FTr;g-2|JxNMo)O&0{INO*3RY7K`}O=Nkw)QMr=u_&&a7rs
zuwM+=z9>d<5whDkRDJD~Y;(=N2bnV7o5RNoL2YnI5}%3dSyw(jjs3gq<?kQaUp&vP
z|IrY8&J-WT8B}N#GUITS?5>{9W5KQW`y~lrP72$i3&$fi1~OIE=XaXV6Rr3ltZJj8
zc?wL5u)NRgsbDx~+>5HkRSq(U-o#C*ocn7OWTWr|PRKUq>PI;I>ozW>>R}2QSPc?i
zKxH`B!$CHo10$1q*#6`$4Y?u=&d4n*1kA7D?`ahwE;lJZ>NtbfxXIio6{&tlGCE%-
z(^-SA$vD^eBbI^q_QP*AxUH!Fjcg+kcNiELJge2yd>2{+a2$-m+?r_~D~X1T7Hzuu
z#$2@8rpBIJbW<U&#r1p~3HPYu-=FVw^KYD^;nksf4_$9%d1HL(&3yh$S6CA3UJ4l<
zpnS?8B3Px#hh+k<e=H8k>_oCE3|hir@L0VSo=Yey>-O@GzkdDF%9L(7#`rS^p8N@I
z^4QQbF>y2}w9^E>Kf~1--VEOUFD!tPXEIw#N-AB_WpdZprNwhOR%OPQ&tP>Z)1P=W
z1=N%xi-+=iziEy9`jZ5leg+(ls&q5EN1D<SXKS5|qpEkP%9O=4Ek1hGI?p$nlL%9}
zV7&*#WgdmzzCICgeFyE!#baCV^gv1!W*}nCl$n0o2_$CbXuD~r{B_0BQiKrxukt9Z
zyE;YQyT_7}Q>$r%FNqC~=t_e!qtkfavY8qOZ^A~=tb*-O#)e_=iwR)?)!rJQlK5a(
zE%NEUNm%uKH+F8|N>P`HVg0cCyzL=aTR=gmgz<oyQ5>33=26U7@C*4iO1K6W6LkJp
zQ*z#lL-|eqmd4WxzIRbfl7Z{Fp^=6ydb7C7e!&|C$b0PC@~6x5-V3;x=EE_KD0<~u
z=}92sflow()8zc|_C=YKjh+rNFsBt>W+x&)s_}}6*TJCVS;_KRY+fJO5Tazs)&S9?
zyA5ea^;HG&@z%O5Y#aLS@9*bft)aHOZ|>cv;)bY0JgHj!W}WJI6%$R`W2a2qqr9{O
z16yqZcUq45P|DHFB~o^ye!bbRoU}Wa^tI)znNr#(VK9Or3?gOWvZr6N>I<fZoXt25
z;-)L|kvs%Fux4?%M=w|M375G*{l6$%A9>yZ9FjhG-gC+{u&RIZ9qKz+K$*lBa31Ni
z-LMv!YzGCC))YwBC!7;>X4E#zEBp0|?bB`u*8em&h^v+lqyaysx<r2>r^0uw@D}H{
z<a<P_^gev5ZB_%2=%2_bTX%om$emI7zN9$*_(?EFB4chZ>R}~0ABK2#JVjab@yFXD
zgIps$MxAsGcl{gK^Mhf-1Um{bx5?5sH2&`dO>4@4Ghy?~=hIOatXUNc`0?C(@{O&y
z-N;Y8FMlHVRF7Pfjy;g=(%H?n790PjC_@*K6206cunG;QF4}-Y6=q1{9^&{*{PAh&
zC-Nm{>yiy}gorgKRc6Y=+lnO$`l9)S0y&2CJ``VqZ5itKbK34N_Y$V?lBZx68Nz!0
z1hlF~c5s|TKTUb%EGC$!UMRsC|FmQsV*p*x3!Ex9)tpax=9>3TE4Dy+gp%z;&d<h8
zIO4^;<VD&vA-3h(gS(rPqc<T4qZYp!g)T3qdG}$tt_VIzN%h)2Z9+1_ewy;h>mLtM
zLCZyYEc40t1~;~yW{dtVFeKazC?puhf;SS{Z?X8_(1W??CdW5MC6vLVH~i)%49&~Z
zP(Zv|nzBJ~ysO4pK^LcykvET=7=HTlIgb+25{b}2bG<k{R5DnuFS*8Hirc(JZ(b!a
z`Sf6I%3wGeuF4|gRoxLmFO((eg2^VG+ZwY}MTyT!mDLvbWd<v_6sgB|eYiMXV>IY2
z^E%uABz<>hX~qnzF=H%GSm!XMzYzuIS7VvjOS2fIMTo$(imm&TxI_cqLDSHM8Cr~i
zUlBPuihtG@o=WsthSt0kkoGYj%X$78^;@5)@pt3&YFu)-YNh$&$O?X>(~T5i*=R=>
z&e{SRcd!zXguvC`H4P)c7oR05?cX#quD6N#9oo(2+!z|cbl;N;3gY*8qce38Ic2%B
z5OFVH&2Kl0yyWQY(Z^~7?LlTzOp3PAe)i9TptcKw1Kq{HR-c@p0zLZOBw?G+<Kff_
z7o!#LJ2$?xB}c`GhC}#|Zp)o*Rf!{^m!|7o^R>DtS$%Sdsl9%zXL`G#Jp4C#*wp-G
zd4bKOv#U&Mls>QAVt;eYk)awI2{Qs@DBl11wI#Jtj=5T=Sv-(Zr$9Mz06O71tee$;
zD@qdc6l2MX8=n!|3pk!nPEW@wGz+xPMjiWeYRm4u{I!xid`<)!-=DAaA-7okfTDDD
z?FV!M-Y?W9dssf-<gIYB__-+4D-DB?ls`i0E1dRfzbjX=<HCu$|0NQ>*~nOSMP3lk
zC~fIXlESpzF+ei~jzi2f^cKrI!50pBhC;0;OZhSK(yL?UzAK4UL(=^hCBtpNskWcm
z1()a-W%+M645o=!9rO+i98L|ED<0ae?5On1pUKvnw;q+bfZF;O@=}CSPnx(@n^t30
zSWox+g=k;7_dE){$t3ZL?b~FP``VDOx83_Uxr1RUOxDMs-9HkeGqp|#3bfLY`6UvB
zL>|-7hL<b}gcn4m56hnou;p7ydi>mYZ9i7fdz~j^F?meg8}dF`W&F7XbgQfmvxzFv
ze;kuHz8fvGy&JkVn7&4HmipL8n<at3T;9Cj$CLd*#79iwPen%n;ZSWiUOm~wEewO$
zXO@eSR}^5!kTb~>568JQlFoq>Y1nSWR!gZXbCuvDLYz{;3=wrYnzfE-5nL;fA8Qw?
zL2|f{^A32fptk8bVe#8S-dpTjH1=QgxLy0OIb*jn<@~({nr}p*c=UC2EEFn65{$x2
z>Vxv9Ol+TjUM^sdJEx5fM?}xK{_R5V;h#ofV)^K#N!VwTt*G8X8~r6vF&MizUQzsK
zQMZ^w&01SD?6myKnyvBR=*)})G4H`E2LB}@&Ls$|O$+B@*!dJclQHr}_izo669(lb
zzCbgc6&CJ~S*10}+nF?WIg&J?T{kI9)3Q?!N_%JwVGy->wLX_)I$rN;DKO7jaCt5d
zbmQ!C>-yu2wd>KNo2Q6e&{;ZzY0)*C49(QVxkI=z#%tE;;tfw@xh{2!|M6ts`cs7O
z(eEtPYI*$ks^^Z95*W*QV&4<(v+L?0&XSuaot}SweQp0dd?gx0cRll~$A{84RjZMr
zLnA54W`1fN7s5D0#k^rvCpqch7=;TT7D{RENbe8R9#v~=i}nTw)h@!lqfi7h#^-NT
z;QXx1*81x$bXAeTM9lnpodbV@e(qmPs~mWE-$6}cXXxO{LgGVZTtctd(;7Oz2?fcN
z%Dc{Y`S|$8ijtF)>pZcO_Tz;c<F|0%QffGH1~|<L;m<V%i%d$!%Tv5twLIhR5fTB{
z)-v3q@uq_u8~zJtS<%viDh`N%qL376N(tw=Vr>o?8Gk_4aKCq+Y@6x#i+G*@2GFPV
zlSYqI`*+Ps`fFnj<qgVBQm*E4u>J4Z*=^4A(i2^t`0+y(X4fybC=w}+ABeF*c0LEF
z8GXXd*3H&oA6NXbix+-oOV_#5pNxGrzIkf9F=EMc1UH>nR2?*r2W9u-a_#9+6P8PL
zBGte6NJ=3$_iW2Q9%ygnW<4BSb_qI5U-%g*r9I&xM!Aw1;^bqWpCIn1v3`A>F`tmY
zf_HHDYF-)`GVzpa@(5CZI;Txf(uyx4+tS;x*r1Cp|N3H5JZ$vvPKjBGsQ!T9<*2E(
z(tNEBJjwy#0|yf*%N8`OvEGF0iD10#HmOH*>FSxh5G=N!1Kgy-R(BP33%bzSg8vO@
zM+d~7wEJd?4!SmxKGU$t6Pt9tp`oG{!zu^ZJ(%+g0Z?~0+r=)W_<b?T%&YtX{>?*%
zx{jG2_Ir)g5(WJ^c{k4g4zRv5a)OL>#jx#2eoc5bqX^RT2yHZX0(am}*Rp8@`KObu
zW`&G`xD0=^nQMTz*AL|b2p%kZwaWJBcZ+qBmSba(qY-8?_ZHKyD%Z<>;i57G6^5mn
zs&g6v8&jcb`K~iHE&WLbNB9uy)4fKw7Y+~L#RRqzqAcwbP*M4B2#5j^%>}8j#50$K
zKIZ}Byvqu_K2553hechecgn(W*?RZXq(!kgx=iXT_#|WJ(FZubuhHticK>t`;jI_V
zi@`T82vcooC&`GrI(hcD(r}}!EX;`#%5iUp?fK~7@w5Em?L(GKRu|8a?8mF=E;Egv
zsW!Q_4Gath%8v!J))AJu1k2)B>-_Uk6*g+Rn`P5LP5-c2QUs-VCvnxO<(2yZ;%cqS
z*^iD}RTR9dtKIwp?W|Y}(~hqAz5=reEt(Zo*nIHw_JSLMm!H?_+4RYOvLNvI-WjLL
zw9ngc*MT||O|z1<b@XH_M$B$kOi^tKnXf<7Js5mw&%22+a5tKu%#50#&dp!Id%Pq$
z*QkFB>QOfTdNdp;j6`lIj)sA8?vRk0hneT%`~P%8&9H3lkWm{yY9~PQlZd5*T06$X
zzi(pnjfqKV+J|5Y3VxjYECch5;w*h(GI+CE1gLVNv*M${DEUe`>qLpG;uYmhES@Oc
z+U4TH`-GPLl&!gUUXGOBNd`jGD{NaYkAX|}<<M<nY7bCMls6yj;%8lW(8&dzT&;8u
z{c4Ev`@fTUKReQV#Qf`Ni{Ts14pVamvgZCc@v=zVf|#n&W@8=cY=JbR;F*EO%H)O^
zA2yx;u_DCXfATtqe5tf*hyd6Mu$zZZiKG!_)L`LlQ12K_gVuyfw{Zg^Fp9tR013~N
zXS5EToV$1y$J_M2a56Q@&{(5#ii%#qsGzPm=N9ub9qjEY{oe5MkS~I%vzJ|jq&99(
zY1Be<_5wLxtUMQx>4d2T8w@M-I&@ZFzApbdyNsfky-?&nl^?FuVxerG3lpF=nmq8=
z(`8l|Lddni-N0q~90y-PYox;aPJIiw+cdv(BGz&fz@hoKENiy522G>`t7Q&L;B|t8
zDd)pS>pw{Nx;CfV)<WkqW#$@VZ|^|sA?eXq+l-BPioF*C4DIuj#wA{z_c}seq!z!h
zYqB72;~uu<-m6N?jUHHhj$B%1bI*0a^znL57PIFUd^_cT#djSqV$f_9Cm=Oi=ln(j
z3!&aas&O%>@io@w*&=z?^Q%lXM)jeLxQ8;OsPQ+y6@pG$R3+wLxgB#+%)Sxk-8$zo
z2rJ|6K5H@1z!tV3b5OwP*d6DW1;X1A#S@Cb@hX?4v33VedRUZo^LQc){_ICooe~`y
zzaRXI|3pu9mr+%OCo-VR>>H=C#y;uhJgtsgdtnAXJ7{F~tv{kbZXax0(sjvJqjhha
zb)>y0h`3~HOa;vZpcPOl3OHslcVP<oh)2+$@U^_0oW)Ru^W4i~W&*qf?vLMfB=tqA
zhm7)CDAa0H{X=xV*~vLY2uXi)+S3t%aw+k|Safoxp2cl`b9z22{_1IJqo>E+eFdjB
zhdE>oFR#b<luAW4vmY4xIcr8dHlUVwQ|0Yp=ap<sUWXD}rWUz029LP$zT_LHKitr@
z#{U<R>y#GNoRnbE(B;6eQJH|de67Xma_TzGm&Pc_kxm&VkflAL^UG?^1|W4DouZZD
zW3IpNs9e#=X{k`Pec`|I45gOap(}pNc<_4kp}*OSOquIuRHF&)H-ZY^bw|0i*Gl6I
z`5lj|@DX?UrbX!p3BeO$6KBDm(oLye^<Fy|{Mp9&jc@G{4(+Q|Ej32jA7C}tooccd
z16Llub{M}RZI8x2D6|P~dd1cxe}yD^vvoNr1ul)gbe6l}UQ1-Uu-WE`BihT-2&w)T
z7N8c9ois-|T{tPVmSM@{(Ee`gIA<pmM}eXs6>(uHrjwxrhq{+{0bHWYx%d9=|6u<7
zzp?Aj32M{P)6=W8TpJSd-nk{OLI3d#08rjNxuL9>VqGHPNON8T#K{{Ye{u3xIf{`5
z(|me~Qb&k<tTzjgWjmNM_J8>3UV$Fp<rhaBE4rVrQulB?#1&7&cj4C%57Qfy!y|S4
z1yUDYUR``b_eaQ*c;a5B0qW2ss-R*%Ru{5oq(xiAUH)HRBP*f0AnpVK49u%Hj_V=?
zz&$~RCa#^<$)*N+dha#|@VHs;qGgR~$kF0w8n2D9l@1yOG4U!ucLTUYGfNg-FlYAW
zaLPQW#S?2lbhzD_t2)!*zUJL_HlKaI%p+_LNkxs)n(m7$|JB!dmna`}+HXDt98bAv
z6M<vlpO-N6+W^wwZL^B;#_K6%`*8`UnZq)d04y8nB(x+Cphqei%_mC{-nbcSlYO*p
z_F#t8L7avlpq`>iQYmiS|K|b$yG|2@#D^LjfX=qwqNgprVI>tC<3+Z%wxqq7AhB<8
z5;dF?I<0^{ZQJW&%H3nk-}9S538%{|oV3&2k}f_B69l;7;6EYlg_}8AAMHS;a>U5)
zZ&eNdli*BZb`~c4zitSXnl?#1f2$Rjr}^~&paD}n_ImuOAW6q*o$GnD9bf6q?4V)r
zq!z!UO-xJE^MreH{xb8t0RU!>wTzLgwH?m7P^Ifx%kp<VKiQKGN|Vk{MFdzeA9T{2
z7w7QB05;*7z9{q>HvYVW?Lr4>CKqqi`@~2{++p$+c_@olN(on{v}c-(clq-tLlbeR
zE&~qG%I<o8%mv^NN`#TE1UQrmxS=I{)9@$LeARphwFXFGMx-ImXO=g|@F-5*4UmiC
zdI53(E~`Bt?F5l#>s%H{XKkda@qf0eotqd!&4j9Y>b9&ZJ|64<BR>Y-bN1tH2LPj%
zV>0CYYoUThpB59SkO2L(UlDhA>H!R6FcNAE4mpZT(tG{duI_k1bhw$YiI})N;U9F|
zv|w#*ZO=uduER1whlkQ7cM9UQ#(a*P>_z!;i8`JZThkR@h@+&l?WSRgPvRH03TJP|
z3pK?rnh%D?ZPF?W`xe_ji?={;Z$24E@YS_5l$$iTO~4`0n$xdRtL$6yX;0q<*G@Sf
zIUrl^XT%ihx}N}&etjhOGfTc4j0g*>+4(1cxT_}iYPHhyjhqk$Wm~rY@Da4{O2lOQ
zIMTeWX}b|oqH^$R?sct9Pc6UF{H>XW3vP#lqetucKO*c*xThaZ_)L6tY2H(AS~tJg
zPxhj%j?ypEsxfx@=ge)gS4}ttjB6bMY^;$i2uZY>t9RwAn91bJlfL4arbpHMR|;EN
zB_blSI-LEV&jS>h8AC9k7cwi&3I=STUg$oqZlOG3bk1YMPLkhz>#z-oRba^RQ+*2B
z70Hl$s7sjyzs^@DU{rlg>lE-$CEp#6%z}uXPO8tJKi{2@a$h~)&<--Hc-I-mlXdc!
zjZ|M;tZKU$M$02lIzIsX%*p;rKfvZN0P;SDhC|;q{oy;$Wo*5l`~KfH7KF1LxC`kn
zt#4ekf9y-wBU|uBkafWN3ztoZPnqQ7SN(Tdimm{MB14yRdU{I8`B%#RbcCJ-aPjp@
z#|Q1UQ&O!1<W13GJ6Ss*ZYF$OOGcCW`|pS!NGMxLkG+tc2;GTAcXsVI02gB9sb-lc
z`TpUiG(CUZO0xN6sYje@^Tgi$GT5BQxF&Q8tKEdGNeyKS^l1he&rnE5tXpP_*^iL}
z_hdwgCKWzjk!zXbd$1}US@TDF`aId=15|VCIg?*<^oPt{565%BG8@7LjjB~S=mkxl
zK~ax01;jAUUtf%GjRQMzfJ&cU{TMBfIo?Xx<Ue9YOk+{Gw3S1^JoA>^p$;faPt8)y
z3^}tGD4<Lm`9S!^!Kh&K1p({1%NyhIn?HupZ_7AM%>J&4A9k|L(`x-G6>FjNFR-)c
zQ;KmOv$}PDWOE*9!4F#o-&&v0k&GWA@$~`*%P@D$Q|w6Fz92j``bB2^Ke~=+ED8_H
zoOZ6~y8!^Y_wTvkve2XIYZIOK*rjO@60wVq3U=B^t(C?+W`l1WU=$_oZUA7Xr>Doh
zEW?ed6de4pv5WC1<&WqA8Tg1lnojA0Jx}K7ufVTXzflmqJ)$PdufHfeaC1sgTnVJT
zHk3)U8<!uWbTCxQjuYt#g8Da?Y5lNckqu>bQ{{-k*NiP7$3a3fV}A-v^G{6zPglq(
zZ-Ji~{DuDlqN7A~Nhomd220?~t_4qmDXsrV2nMz{W9F23zl`WSOf7994wDZ8rFeaj
z+aHu4Y)~D0YkO=!9h3zU-D5i`+YAYB2O6Ho<6@CKskP;0J0!o5BbHbAD3d<`HFwZG
z?W~*Gl-C5J6H~wKe+wmDTu%Q10-=$y$hO*|*J6n<Vt~c;DZxzn{F2+Qu`D$%)&R8P
z3YQ8|KJ7Kv+(pUhY<RBx?ZH0ev*{bQfj1;sXUpzyqGIZ<^|RfAs6zI90p9{1KSbPw
z@7pPzLn>jCdj{Rc)#2svjG_#;@L+jSQT>gagYazlXas(0q}B95S5xA_@7{5~RK<mO
zw!yH|2t4J>F#K)@4Z>ie!cryRo>J(oG7m~vQvkk|lSPfs&FgiIH&>?SV-_}GsB{RV
zb{?T^|3%F^YMzvsF_p4kBOr!Z0XTD5G!3N5!>yJQHrbB!_|gn4FG^c^s#gcW1B!e%
z?ewd-P*HT6vr9rR*7P#JLzcli5t1$U3&ISMW-N?InwM2G6_%mIag15P>sR%=W6t6e
zZ$D=e_U^}~G=id~Rv&ooomhI*j)a^b3NGk_c7D%pUWqUOX_r}us~*`S`tk#CJJIVP
zV{`w=x*gQbL+$U7cO5<D@V%vBaB`*n&ySa&T5x!ISBX(DbTvJ|Xy#>{)*Wf}1a2VQ
zXBR8}I(aV+q>4_JzRBm9-f0`Tl$%*(xd(Ky55Rb3;+bBHDaXXp2s6q?w^L<Y5`Myz
zH99{l5rA6Ur_mgIX?nBWdGw*_97L!K7^mjKWDf>Jq1_bb5QVQ@{C`nN-~cn&FCQX(
zzDi7%h;_Ku-x<X=%O1>NK}ID=x1$#43kV21AV+H6pcZnI3JHGa6XRk=b&r%nPCzf(
zi&zhtoa>*n!0`F{%nrAp*NRmPc-|h-+DF<<1E5)_M$l+Li|7-f`jpK&JWUJV_(ehQ
zOx3*>QNRKpMlXc>7_+#H=0!gke94x>rw`ZT<wZqD)Y)moZ%}>4$4X~abNC%^<7`_l
zYdwNNYs_jg5AoAg-32zq0cA=cl|_I9=BUph1CRJw0yl+sWeRF`s=XbDpsy)EhtMvp
z7aWZ;i=}c;K1a|l1H;I-czb(VHR!>DTfe|29PDY7__}RDH!=C&AWE9i(N!-ynCeFt
zV!Bua`PZ0-K@({P$=vf$Tn7Ww74@2Vu;$2K^5WgrzR%@iU&mBJ^ZS&FjZsBLDXS&5
zSxI>vMx9;JQyW?<&oi-%$V9^?Z8@x0A~>V<xMjy)j?R|Rz_zSqsW7hO2o-{zEABAr
zfZ7#%*x!Ll^Y)-F6$I*d>SA%+^48_|i$DtiY-5qzT-9Mm$RgrjPlPr%%LeFdMniOI
z%=9AfBlQ(9>~{zHxLxc9Yt+?kk9anXFeOD<@K#om{J?+QQw>vm@kra|f^Jl=fv2V5
zjNYJzC~Aemlzf6hzb2oU4CXbU`DpOUUnlVm?%USZ*52Q4L<mB7Gt$tG?@G`?`oen0
zsBq3qYPm*nglYDV%+Hv-7%gnRmNJWxku9}@Q2Ggq5*e~q!Fm)0HP}=UJ*)QHWIQBY
zlSn82ak-4T2jJLvuk;cst^nBJrx}=;@zI^lSBQ=&)JM1~UpXK;#?fQZqoFw>`J#Vl
zwPkf9B;f@&Ca!rffT<-DmG#M`XAyD5BBgg7^!VHJJl`l8-X$F&gGy-nQFr}+77v?s
z7c2-R6@nK^mC;kYCTkadm+&x)h-c3R%HqO`ueSQ^z4I^1fa$P`+6=s9ts?2F8PFB3
zI#CAr!Cy>n2o(CejzUG@Gv$-1OWJE7NWOFPUe}`Tmn+{2UTz)zU3}ob_6cqNbvw0K
z!awLUnn~}6ohLWkw4^X&&kv32Yg!8D*9&s-OPi5oawdbCLK&T9Gp_v48Ui&C=LEuV
zI4F(rqelT?CXgF2_PAS8hdPo$rF4pM;4d_4y_RkIcho{9q16B<A66h`G~WI01$Kn^
zK)%pupZK)R#D#~(qX0DpG-a7;O|~GDs89s?bOg#wpQs9|4`~~TEx0Eqq{cMvXdYzq
z^kdrJ@c*-wbXCu+<Z9Qy%H(98InuGHW?y%5vc%JqzcHG0qwmT8j~~}AkdAqe$O1;n
zN5H%g-QZqy>AO6jg2gO;ew5j+?<jZ~&aUQr2z(q9*@p7OHDe$Bcy(TAeMz7dSwUF>
z-Jg3CadyZ{_5#+Rlx?T~&T8s;o8Mj9m_SScCDSpqs;Ua8r0##CB!Qv&O9A^G2f*8~
z=&*Y3VB|zatH$aEQiLsmiO8NAaYZP|w}V=8`Ym;-Q4MtQ=co4TfRbfB^9qt@tg`Bj
z0|u=SeW)J^Cm-cYA|6jAkN!^6BM~eQp@&VJn41Cudw|x8K89=aH?)dem%m+bhn*J&
z3~QxI*rWbIJ;0kD_3<Mg$0P}wHUcK^x2UeL{A!A2l8`y8OYl&p4C$~)0WxRjv-CU6
zrS)_bL~m*p$4^SD1nhvq8G86Uuhs7enr<iKwKZ}AID^%-wX<=D*Z;IsT3T4LOn5(_
zysD3YM+cg|e*NmyZ@0k~aHwl$mK7qd`QF*cwyc48`-xMl2#PzI1y8RF23G^4bYMQ-
zsa4{AY8-Vh|4))MG?Ulwp5ny=x~n9v&UiBjhv2F|M0UIWZ*+%hH}FRS|M7nTz%Mzq
z+?UPmRaaNP*bP-U+*w%gS?SAeGfh&@R9nw*AClTAh!;ceb+ZLw%j$;G#QTHPo_hh?
z2Be{U1-dJ_6C-)J2VAO$;lzQzq>{&Ps_kOiKzK;hp(QAS>8Zs>#vgq;`nG^uwOU&!
zP@~PH0i4r6hX=^$ev6$)ae6AQmi#Ys_X1frCVXPW`Yl5}vljkito2UIp2<Az*|Sdq
ze}JkJVdnRpy#yFXipK(jGJZcm?&m`@*{I-@QEUok?gr}_u3ZdX1^ZY)_Y%jmFT|YZ
zo(0KMJt0LIF|_;(Kt$^*vaJndG`n!VDmg5B5J`gaq5ZO1SfxGIfrSB7z6#CfmT=XX
z{$Sq%g^3SmfO?^Qg?wf=0Z)X#xX4xywRnHHg+3@^op^S>E4|;t(RRMC0ik-~eqiZv
zxIWsxM<aLmJ+q;*%OIKC?>vl7jH>iHE%!Q?04PG=VYHy?-)IidhQiac-wIlI6I8me
zhU!mSf*(ps8q%d&#Phvu&y^Tm?v1B=43v%Yn7~7h77e-ezQUC8Zb#cUwG4Jxk+j^r
zr(&NLqD9R*MzmbuT45!v>4xS3;x-dP)gdg>9@ivPqo!^iQocZ^O+Tk(v66|bw*O~z
zFHC+|d}=oXapJ^tWygM~r>O@9*8$=(Xu)@l#dGi~`7fdPO#-CEAgb5pqX%}<sptD6
zz(T3+)~MB>UIcU$mbP1meip6XD+uJ`$}fD=?Bn`aCE+2rRNxre&%C*I)-Hy{AnFy7
zaFIQl_?u5^vpD};6(SU8lNTj2ji_I$or>JQf&eu-CRq4+8X|&oK9w2Q@jc8Fk_yYd
z)pouj1X&c{Jsj6YARB>=1Gsc*U-6gj=COOt<cmT83IQ|}kSWC`&wyEel%WFEJY~+e
z(QtGu-$Aa1j~Blf%m&6E2}mxD?<&t{@+>HW1_J<}rNE#6Lth00FdCa5hIiEbqi{Ga
zw|8`lrKP3+Hrf!#R=CGIx_Q8=?EuI^3<KiwT-u&%5KZ;_GUE*}0m1tP%{tI&2dKIv
zodv12AR~iWCd#P>ZFRk{fZHI1FXf#77@mOk<r~fNS-KuCR<m<UYWe#*YefpM3R14+
z2caR}>+k8Y8_D@ZK%LuP9Ji4M`9y7pm|Hvsgu5SXLB!_9KI2Tw50hSKfDB19(AZ$L
zsM6KJbi~y|0H`QyZ%GD=9nfk$`*Sp9Zdf7tiT_<+CUBa)%EpIulCuG{jw_IvblQ2<
zS8<j5@!Ilg`!jP9K#+AYx!4gWlob5&TU}91h)W1nqx$!62R0H_%!7zE<*YLbiOmbd
zZEtNEoY>hKP<=c`btV))ODl825`yx*29ocZJ7{DHHZmXs3lem_>-!2`s6Wb6tt@NM
z@s8ovw<iI)glt$%yThRjl%264-q*rv`>h3y7XF!$-bnlX9l``M5GF8D^tR3@H@`g3
zr^U0gv$M$y2OTR2BkCK^*SVOJAWl1g!PRExrTA8W8l?y%MdNO-#Ll>exiIb%Pr4QG
zGS&iZ{<F1NVs*fJ(=diQXWJIS59X#*g9}rnyIkOs`CJsv|Ipwx@TTn=Mo?Qcl~G(x
z0q1GJEEIg7jt(6Q5YtU~9m1*zb-%NTj-R!xK>{FdLx8=U;>q94T3El~HLVg;vKg!s
zu{oHnut4JQF%MBV*Zf$n?y-qdD<jhfZBh!K$)(HeIfs-Ux*5kgUNX?fF2`#}x900*
z*4KKY&C*2`$2=bW0>{EJ01246M9Hip^s{xD=1XW8Ct0tmCZ}sB^?$1^zTX4s;R0#M
z6vJVq*NPs;UA_6h;y*XSc|Q9f&2ylO{;_rWbeKno-S4^o=bq|lfEpQIX)gK7!xmsw
z_P>4Htze1!BY?A@K<sA+;NR>r<dcncJ_=<Xt9ShiOz&7e?6wz1Pxx~3MoKtN1D_)R
z;SQGrQqKUu;^4a2m#ml0?iy!c#S%B4#-Yp(4%UJA(fJJ|K|I?%iZKlU(EZ!4ij8%h
zejCallz3=6U$Y3j6%48*@5`r=KUoAIRi(mX8?u6!xVX4Fj2{-*X^{i6-;uAxZq~fL
z<c6nDrzR2YrTCB57HMVvziI8PaNub94bKN^7f0eXQ(y%VvazJ_AEeAv=@yTyaNx<V
zpqIpJst$a=N;a;o8mRqu+TcI_Vdi^JqM;f3M_y!PWFo(zvUUT&J6i+JHqFn<|51ak
zCXx~d@oiKcE!p1x)6SU&HFZUC{IQ4<l@0+^2&5=Uz$p8o!c<}mm;|Cp2%rK&6huG@
zB8y^;44NvdkOUDC6o{BaAS|L7Haiko6w8t*0bGhBYKkBTD4Xd`zqQjZ{npO-?af=}
zz5DK&bI$#r-?{vEZ=sxWBmm{I&D<hGWCB_j58z%wiHa~FBkylzHM>&)M)kp9_|)g|
z=Kz&Z<9MKG<qnoz&ZEFNeYQkwiwiA!aq#?Ut$GxL0u-_;i4x0xVzY<IWd13}by!?n
zl-jb6^;5Pi0YO#vG1J&lT@-zmcGM$c^l?GLXAkW$gaBO<clV?dkipK@9BN0NS)8m3
z|MiZonz^F@wL~W9<&(IX{sn!lCU^Ri#)tQ*uy@AVKzX4;Nez<3+v7}S9O||J%R!LK
zUE6*-)1O8+c+6^k1yBllOzs9DKzh}oC^;iFMmHH~S?YzZ7K(r>i4#o;4mE;&<<n?)
z|1}UVdRix17OLnGlOxjbqJ&GJjZIcIJs2gHjxFkN)DM*G=O_t)pHn-pN`^z2ZdlVe
z-y>s<BC&u{WA2;FpgG|11i0w+m8hzdQ=OJ_aeUXtn^q-b#2Mx-{cuFQ(=hc10-RHd
zjB*}^!C-N5aWW=f)Pv3sES;3hkM05OvlSJa3#nj4;66BQ{!9LlEcQ`%xBN{VP__2z
z0;Vm=$jC_OHMCpU)jNFe_`>Ij7#080IpuE{2sKsRt~azs0cKR@8qk<nnOr;bR?V$}
z?21wbVinKkq49Mc@WWwhVCVS+%fHgGzBhY%Gms&lOA<uh!n<y6ZbK8wS;Yiz;O77?
zhEi$?r3%pN_bE~I{>{G-PhAU*HGk2VazcRqhdxsxc7yOhb21u@*1-+Z_5F6ZB#8Aa
z-skMptI?9IS_A^5F%;qDF`#lN3%>n3-prE@fY}c?PtS)S{LF(tP4n06%TBL^iPNiL
zwPvr^evnYl-zB?5J*{YH*sB(^2WY#@>JN9DMEgdv9<0Sh(@s%lER2{&p>CcYL$U(b
zO#a#Lwl@Gy0^xGh?f@33$l#5;+56QOB}@1;iccXK>MNQO?7l_BEPHvZUq|p%ja2}1
z8UrP2C#WxLzD|CIUmJLH#$uCEaHIV2Kui__B3dan{V2SL*0{fY;~XT!Tc<HJsjGd{
zv-y#vbNVSJWCzbL*?(V|_-636^e%YsiP@4uR$Q+x$!*dq4c9;3(gM7Lxb^EGgu}zq
zdmgxRNSCo&h5>=e1s$)x&U4V1zo9-1CS?mt8#>|Q1i!$*Cg7_<p2sCa2kBd_HW(Vt
zP7-?I@n0DLzXdj3JXvg{0D?OZI&*fJYgF@`BgKG_+<7weY^g}J$c8U109Vuusu;$_
zhCey3!<o>w8=lhpDEov`&4yZ#9P8`XH$v8=jN#i6T+eYu-P=NkE9UdT&;q<Q5x)3r
zkIvGqhdx%Bk#kXZSxB}Yait$J;(j^jbRJQ2Ho7-AbotR$b4<hZ5)@Fv-m%dgxv#wI
zL(sWj<<ql4=k%*p7xsC<p5`6Y@p)XJZN@vHq`v8hX;f$wl37UUDvMg(f&8|L1?~R!
z)-~UY<(IbdMg94F4TNW+`7!HGo8l17zMv*Mhp=43MaOB%MN~jE<}eC<q;XkrEt3~Q
zHdsEX&Cej0p<Frmta|O^7v}nQ<k{HneW~j_JR)z$2R-ksSe_EEUpH>hRo=!$Q{M!j
zqmfdt8$BKGax`<wM{basR>qd^pSgH;#M(j<7m6LFH8E=O#)R$_1MMi{wae?nIJazk
z=UVueg`p!(BLY*6h2msg@pUwJm#!%<MA(@WWVr%E2g6_t1{Ha8D-U$HCL+viSRNal
z&=i*tm3|%4Fi05{Z-9%nv5(1HWsO<qZNC$X#8OiVMGUUscEY8GlC^YpA>@4(S&I5(
z<(eYEX}m8@UR@K(0KvUM8dWR3>fnTNeFE_tQIFzguEfYs!c$1|sV4T?W9K;$EmEJQ
z@#qIdIglo{d0l=c*4?+Z4}+N09&^WbUlF<Fi9WI6T)U(r6&iN(tW@QqX$nbVt9zd%
zz|3$WJ?Yb_X_g^p`~temOg!k+ym6vtPBy*A+9xWP2Q_;^oHpC1n*X-5{QuJf@a;>#
z%`MnPfoZob7HlTipx!(1Ki{|V&1U~<vr{Ut`=d%#$!-e(2RiCG)Pknxw!VMlN*D!a
NAd<&!LKQwF^$($nvef_p

literal 0
HcmV?d00001

diff --git a/docs/screenshots/issue-14017-open-url.png b/docs/screenshots/issue-14017-open-url.png
new file mode 100644
index 0000000000000000000000000000000000000000..869efe59bacc2f28d41c0c3d702391a028debaed
GIT binary patch
literal 25444
zcmeFZcT|&IyEhm_v4My_h=72?qaYxN^sXYHC?LH_k=}a`B>1TGA_CHjA|PFQ3k0Rt
z0MdI4p@$9$Dc{cfo-^y4S+mxxHFM6If6iYJZj$@ndtdwdmFwCGd#$EScZuZ^1OlOZ
z@%))41ac1iO8w!&8Sul+=dv~gauxF8*%NKww9T1|2pz9RaZ=muE6YW<|GCuR-v9Kq
z@O_rQxm7-23;DrcaS)!XYc5`V9xHF>`h4rYDo10iUztd)WUv*F{kP|8lJP;Dyb^Ci
zIWG~A&{B^Zsf{SfTW9;5u|(M6x2iG3=&VhH{Klyfa>Q$WIG-6jK+%Sj4fyd1LUj`Y
z3Htj&GkEd$69^3ia{J<$hv3DFt3gx{$n$?7v=GSSYiG^CpFZD)P=mLe{hzmh8T0HL
zl`NHWC5{|7C0Q9^eU=xf#Y&T9HUtx=38)itIz0*hsY$iif>b#dg~a6WL$U9;(ZY>V
z#7VN>o-D_>U81p1=@i1K`m=0ka$dht6ZN6PMj1Ag>u8c6%yQO)$`*(WHkT}A^SffA
zU`_ZS4a+uOAya#joFC_$nrubH(@F<C-bxdcm0GL5pEGgfd=Da+L99W(N=dMC!N#4R
zZ;K(J*Qau=YpkHKr6G@CZSbed7{NDhcJUv%v9()*6&16o@XhO9XfA)kHu9DKy(#Co
z82YuE#m_ThlZeyqMG>&*4o{&)5J8yN>@<^}Q*6=c)Wmv<=o(XvTrApavfxET9?{9(
zFKaGHmgW9}TtM4c$Ey-HS<EChkT@AWR#7Uy(KA*m(KA1IU41(f1k}%?s-=4aQ=3AT
zG3<P)YlnH;$x;??tM4K3J5KPhn?_?B6(dx>gMo3_`}9SbvT_SUFLl#yzVl0rf*wrQ
zn-33t^e`3J(mH+sMdW$L9WIWUW*}Yd5VJ)Xr5u0kqWDT<{ZE4X(%~cU=!S~YSDK~i
zW!EmxxZsVvn?I#<iV8IO5Ogjd%bHbin{0W_2bnOaU>i4;)sIexI-mpxG?j1r_m?hs
zJp%dkisT)aIE1}PdceyJctwr%td{+o#(y-;<c<zdg5m3KEvm?UXIac9tF=vINECD6
z^ZUQY#MfuHxs=%lN*zWUQ9;N3Qsf>c*-DhSfTVW}*hoRTgVEGGTu8!RA_keV6~E=x
zf5%85!y9ubKI=h@(h!&ZdF&E1XR%AI<s4vZ?~Nbs9@?0`m>t8RcXl{gFGFOpo1Zmc
z<>Xfk(MmHvY;TdMcJi#c;EUW|Lt*BdiC2DywWgVGp^ci(%8j`5N1?Z6mg<AucfUY4
z>#V*IH{k6i@`4+)E=VH&!L(oAJL6n6->gjMGRj;jgSmnRn0H<uGd=wshpgL<RR~5U
zzc&5QcVkwHl)DgEp4u&r-WIpr*&j1)C=jPjRF(62))Lr2jBd2t{Am)^U*&uBVOM;G
zapg&#s*Kkhe(=~NU_2&In_nXDEeY>E+-ETUS_!t<rIca>0{o|UC8p!{)&b7qsO|`n
zAM1-U6(R559Bee5X&1IZ>@0sUB|L%_iFC}z(5=Jz_Fy^nPDs=zYJ8*I{wy?ucgEbP
zX0A!v8|6LA3q8&twcvcj;^Q*|-JHLm*;G*{dM4MmXDV!#dbWJ_a!ltctT(flngV{s
zJD#?{J-q`%MrOpcNgyNJ-rd4WHqXe35JH`Dl^A^8>wZk`&%2~GwlSJEZFbfD$xAfx
zk>3ew98GoW+rx>^ZS2Gyb+4!;`JuF84WYDhD;s{sK86;2*g6dNQ4!X{VPi|o)|_4p
z+c-l=7G6mVu~CJuj(k;6K^>+a4^Z!`Sa@&hjn%ntCy&9%iwN;`=NTIlzv=M;&7JvJ
zu8s2h!WrpE*ZobB2P$Rsn6Kjsc21U(5JWxuCoB2`>2bYkbb{V2NBK>u^z8MfEds|f
zC)c4R?b}%Q)iHIcJ7m*3Oo5Wqqty*=+R1>5zV1I9bxS1ozhHiN*@|xIop-VYmzpn|
znk@J=M;X;iKykBE+nGKntYAj%P-+C&qWTJxK9J~Zn;jwBiS%300V*Tw37XR@(to>%
zA^zOS+)OPFoH-9W#4u%ew3g&7gxs5!;_9&`tOa-M--jMLB^A#7{G-lljGr4Y*46hP
zm>7$ahq@A*?dW{2qMG)PhFHW{4+dxcwLz5|oX@bCG!ldHv!&aoQ<aLR*s-lxX=jwt
z-}1PVI2TL4K((EQ-J|LAxvz|7%SM%E#AjE76prc+%JL^J*QlNJj862Sk5EP&zRe|v
z9x|S2gT(1ndVv71k2<QdSk~-v9Ikm>Fo3)?r3mZKHH8M|8x<QzO9Uhy!H8g}W;26L
z)H~nS^lrr5Hk9)Ey^L${B(+4*sS_J9Df0a{4|WrZ-mWdSVLf{c&Fuo0(9C+7-h`p`
zuo*ee`L8p1v$d`Z%bBJrF%#&D^EYDtf<b>F>Y|RHHTo_@?6c6U2=?#E8r1$ARvgRX
zqS>Ij43_b*5_4^Nv7?lPUe=u6(x|b>Fa6O`Dz_2o7SsCp*vUWM1nIir6oZ&KSlquy
z*x68yx#`!XVDPfHahLuuQ1^k8qdP`cPToBREvOe+>J<`T<+|q9DoX<wbvZNBpiWds
zP<fEaJzDdRKve055wbIbOZkdz0p<bN<D>t0-wMh+>BEU97}EQ25E3}j^<mBfzx_O3
z`qj=c%t;dmoK#9(5Oyk7aZAi`0&*L}rD-ApaM!`#dYP#p&AzM|t(a5u3+bJyp1_Qg
zr7%fNBf_3jmKEO$i=3smO!PGLW(keN4VBA2r5l+(5hKM$M8EV$)+eDY!7(?rGK(9$
zdJ-pBb}W1vjtLRYfdNkd-*~)X+d*~m(a)nobM0{40`Ic{o&Ook>MSn5%-7<d01YuI
z?SM@=RX@GxI~zwYTk%xBccx~>BJqaYdEXfITlGZi_vEF;LO2Zn(^%Z->%_s3c&@SE
zWFj0P<0zN`TT4{0JIKI9sP<***`Jwdgw_<OWi@!s)hiz#?!DXIzZcn9Ih_S<P`^@;
zD($ehO!jF{_#^yp^k_O?OU}B3dKI|-$CRVo3NgMJq(Gy(KIjy|Z9-m+m40CI5IGfs
zB5ZYtuaia_F>{E3FgfXisH@XXOS27|r(x7`L-6^Pm^64l-Szfpe_5<p;q=`R=#3F%
zE#|XE2UFCiV<O(FW81CQFLCtERei)x8EZe%Y?>%IhMYx^<zzXM@xHCw7}BGo@As$Z
zNWXWv<eO}cHaCZy8XIejL~P9MN{Yox1#e(I@Pf)#Op50uXq0+M{XYUWH|5onkCKNP
ze@z`4@HP5^V1Hf6c79%!Cf)Ow9+USR4}4^+C0pRcl^EYqDzO!rdZXl_2TF5!vl?|#
zkLW+VGQ-+kgHng1+uWJ!O!8kAn3uI(Ug>*acw3N%>9a%60y)EfO+9bglq0!f>k2b5
z+v3y*eps@PLfE?Bzb2R=>ql@pg;_Sh=XB}^ePhxa<lTEVZ;scayjd;(sJwi|EF7RR
z`tYIea%Vjb9&k8<D{XQmCiSRT_^eGyQ}UfoCDtUX!DYCyY|u*@n=vEeh1=*)r8_+!
z<qS_bW%uz-3HTVeL=;2$dkxK&4p}&mU0J0Z4ZeHlv?>n$IsDfrI<Q9DC-yx=^@i_Q
z0Zdfg0SPyAK9IO^>Ks2aXR+TuA;7VXbUpGaBepecX^*W=;%SM4cNI(<y$*Ku60n-v
zuz6+qBrtOWQc|kvQlbu~E9$2+Cs32_@?&=2p-)XwsJ*>|!qRlS{j*LJ=;n|`c1FXt
zNsV7mhS!1f(VbM!zG>MI>{NyI<;xrm$NB81+jUlcCtb=b&Pe4M8lk<>(=ln+9cZcn
zZn4gXyx>D`O&uKQjWluat^s$o)s&`f27&l<r3!<gFz;p-uKyw6kWU{<43tHQgar$3
zn~8bhj!dziRuxuE9NydU^|4H*4~vv(DyNA#$n=Chk=4x&B|6)rIz0Ur3?2x9R5o5=
z3EHr5N($Hx?c!7Gfm@=|AL38kgkP4PMk6*6Uu7#Cw?9bk+Be9-;4KYhGEH*u7Toc+
z$K)Q5w9D_c?2@zuD#&B$F)C_TlSuo}s*k~~(yN!zb7<L+sC0=ULIVPZKPc?+tL1&j
z_u|RrzMJCfKizU3xnx4~Ua^Zi@1^G;fAN#Hw>M=as3AdDvfiJYmqD-eW#k!)ES@+X
zw8ouwoZMs=mMm0lW4s()YA<MP@_lYTFvrw3wmz1thE?3Tcg<tny015+v<aSBFKuI8
zVJ-GX+tB1viF%KXwZ+~SR3JcBTMssVNa994`s=Bnz};EL&9`*&jfM7ghq1Mm)4MGl
zBZpgwbnI+vK7JqM{0Oaa!dY!clGc{PFq{5PJX-^HU@L=Jd}Ue#y`jQ1W*mo^WpC+c
zl`q=!o;wvRdDD~@zC=D{gLaL-ZKT}HimjSy^<DNo6Y=_{1*^YcrL3kSpZy*$PrXzc
zWz<4RZ;j`5u!|8Ep?h7ZS=aR)hCH>TM5+g)9^;{V9LCr!e=BM^nIAIF1M}}57|Uqx
zwr;emBh>KcAX!eHy=p%T@ZZyQ3U&qHlC@ur53uchop~n1&_xX9RR&`m%~oQR;0)t*
z-m$lV7_L9xBSdu8lEt=_sCDmnOHbUPd-+tEZgr+qAoWqU3sTNN4CI!7&wF@qU(}(g
z4s+zj)bm8%W*ZlI($6>*Su;A4D|vHb7hOg?Pv3t}J;NQfufUj{WtE!&-;V!f6U`BD
z96Bc>?J_yDv>2{Av%Hty3<R|&gsteJXa3uLuO&g&36~rXwFaolsL#NBQ_h0i;g*=5
zZJ~j4v!usfqu~>Uh~Asx&hEGv9+J0pBx^3A3-+I0fT;CemSCC;C#m(GsW40lz$4q^
zkjC@AR*T~J`D~?OrrZpyvA6_pI~R?1zlMEta-XlY8cpRZB8LWH>tIW~R%F_ufvvor
zt$d=Q0K<RiBT87b1CLk9#kS8rUmnbEmHN<i*lq%GaV$OrdU(@&@8qqH@BxeeFE0h*
zEUPbbo>$@0m=W?8t%M&T=tKeP-yLaSfVTL=vUQFH0-4l3f2EnP?tJa&UVh<#%Y%V<
z!dG*gYn{ZjMYCU9Lhc%do+Du{*tA|(hjy8%n8m*U%=YN8-Tz@aj7~r)wnEnD|7KfZ
zHKj_}W2LtXq|en8|KsiSD()=-NKMW4vmlMuKe=uTF8tTp8ODG!1bs08gwO*edpzk-
z`oOqe#NoV@&o*K$H`Tdet9quv2W4hOaZ<7rIf-&d;}%mc$UtLb<3s`Da&NP)&vylp
z1ozF6l7?+w>I%)2#~|fDxK=gy94YI6V9UKG-kQ-$YBgzVvikXmV$lq6mNp(uelc=R
zu97d)D|2Bkio7=f_*4YHaeXCm7{=FTQWXdNY=_bQe{ga<5fGWJZww)Hr6+T1;=RUi
z@ra9gdi@XmfA1$O31;XDQ6wmzwf<W|{`D2n@-2*uM3r@RPC`*Fy{bUdZ*RTvIL2wX
zTi=s}XguLm*p}-Liepwcvw6sLI~@MH%EFydni>AAj}SJZ-<4^}s=sx8ww3t@vB^+D
zx2dJDVQq*(bkB?Kaf8_DIv31Uufjvd=TPIcs8wYYQkZKYM`O3M8peH$I=`em0&*9f
zoCm><I#Iop)o=G)i~q2??Aqd139IPs4WUgVF78Z`ZSm_$v^?tJBGTT|z51^DrT1#I
z3<IWn(f`Wv^}DiqNmjG6KK-`>hR26GPXfJFkv;vaDaEf)Z!H9SlsMpcIw22K5w7@H
zuAy?D(VP!sJ;L?1@7W%6>H{)$q^Feqp7J^wG8S~&VJhh`Fo8L=b?%k2+5WH_w=`vK
zcI4cb>e?57!s1xv5;ijX7BcD;`yqtvsCzh0EturrFEsW_HdiEI%;0p|ePGz*s5Ddi
z@Y-n774oh53vt(v8yAM-l+<f29i8I0BpqAl-7L80<n1359&Lzv9(3OCh>?c>ZW6*E
zF3PisXJb1Db&%uV+Mz?W%sF2*LZVnbkGw3nuk>)YmJ)Wo<_fwBQR?Y34g*Zxe97L&
z@xPR#!kG(R-pc8ey6e!|8@ioPdLHgPusnzHP`j@ho(Atq(+Y{n2<#f)3fEC=Zz`!9
zr``B`QV}lyfvPXsATXyi_N_sKMtza)aqOR2Vy533G=Fa1rD{_2pOM*xFE=IZ7rmGv
zZ0+ebTORmg+`OE))x;g9SLsq!FwGAOSW6}okKStL%6C^df?oR55r2cx!Nddg6%2gq
zFqqzcJl(c2nHSZf*Ph0a;f^kXb(m<z{SBpSoUi|?;m?+u?)~ehBuFtrx#o+@aY}C{
z9=;KHWRvq(I{5~i6g>B;-})81P#w&F8M8-L)>%fJ%!u*wiCd8Rjzkm6IxBtXc`r@o
zv56M^_&f2q7`~})Hxb}YIIC^(wJ*M)L9d^eZbZDCM_@aRHIo4AfWZfr$y!Y?k-`I<
zU`<cwMhk#KEu@*%eiS+)k@QN1<K%>udH<j@{0qY$ZuRIxZIW@Rgf)(_@Wg{%qY>GY
zXMGs;tlOfz`v&JyxrHEe!(3x_4ASFu*-UpXhoZ;lgwlYv*tRDlr91skY~YsNNdZ+k
zaRUu_O99jU@ZBnF1>B^7wEfENq24Hsj_Ac?C^nus@O+eW?QMOj!nh4}lGRkH>(w4^
z9d^Z$?~9M^XG<s9N+xQ2P3;9$#is1dJ}$APr%ye!QCvz~>3^&xeep5hX{V%CUWQh8
zz1~6N(fRe-O0JD(kp6PHspFpQG-2@#(?buNNvsOh;Xi13BtFx7C94Y)E$isMR%0d{
zmAPTl<V>(TY(Zag9TBVp%z_A;d5a6)Gd-fi)!~)*gXrm5Jo<*~T69lTbqiSGzS`A`
zN&Kn8M+c4vevPH<a^CJjZ~f}ozh4w7cG;`Lj2S<InU~6Nd@<6D4|jjh+tT}U<0#+h
zj4^)_cc#{U&*NB+{&bJcyJ+au4CLG2#EG9N5z<w34th8Le6r^LQmu1EW7noJVD`QR
zY_gP;@llh9#h7&3m-;R;Q;eVVPp;{V>-A?=g;DN1d{rbKa#-7y7%9=hu4c5Vi_gl*
z<-Jjk>&{8iuC^%m1C}?D2;0`(JewZj@gg@QuCwiWDIdqli=5J|BoFhzlAhEYk<G{G
z8eI$4?lEt|Om>gns7jt^uVRnjH><-A(Q3@45G_(WkCTJ-sLyLZ6`Z@0Sb3A;3p)j_
zeivVkjnZc#uXr1!8&d<21xV{etPxt3=YiIKhDqITsNvT^;emhX86lr)y(*YinU|E%
z>1I*M)7WuTss0UiiN*0IgZm1jUn2A#9un{ZmMZBDX;N?1>~>}&`21&6U@*cEOENh=
zvS3(6Pk+`^44u)f_U4;2;h@ukrsSdZ-XCJQfv`<0sv)BM`TX@ll22D>J?-S<na)3Z
zpLFeC#P+2L*(5MUMyPZ|Zi+AU=jSv_+N?wt9ed+WOceIB9?dWBUQg89+6%5a)qeBP
z@a?O*eo1%FK#>PC%gDt{C8R|J^o9!jP?&p8x)iaW$2R5D?Q*Y|&uZ;gwt8XR#YOQP
zTf?)}Lw75f8IttU_+kRu%BfZKs#I!btP{A@*=2o4YYP*PFN>~T#+7_AEQ()`JA|K5
zpD*@()N^;6{@BG|;n2b1<oEsbq0KeP9$^BYb~f*6=!^7?+$5-#(~ZA(4HXYF=Kb)r
z%bHtu=uX#8Q2Tu;P6exGfz{i(Qd;YRQ?}|}zHz)#Remhu;K;{llhu`eHtT_`_;zSu
zbUnUKDR0J4S3yrNZ#HGde|;~bRM*#UG@ZHV{)RQAB;w4|z&E!<aNim6_tK>o2qzPI
zV?NzU5xL?`u5}(o%o<O_CZFbatd;HZ;r@Ax)*U{L<}KdubzcpHsoelIm*t*k#kF_u
zMzgm>uLq*lBVeyz9^Y~C8NPIGq3*aHdpe7rtrn0wTHCFc$svxHpc)W)mF~YX0{uG<
z(`_nbPE>(Veimn(i=lHk-WqI8O7Wd8Joe_}pS$`&#ow_;L2M~m#_Ef?j+nD{{_Z};
zLBKHKnszMv{s@pEE4?NQf@NZR318BL3hgbi^-U9-HmuPlfCwj4U<Vp@N9(F~4_l&)
z4GIm7KJLj5y{8c=ul}rQkz8Jf>JQW0fibEYhS%J4dD3XAL!F#ETbiO;RO`Z*@gYHf
z4LUijt6Lohsf=pqXCYM>h^OQGHh<@<&g>f5-%oFtZ`RDz*J2Iy>sNlHuQeKVZ$Q=O
z*XJ5v1Qc&az0VPw)BY|;dK(`pzd2oof%^tH5i!G=)}}Wnu;LS;RA^}zR%cYINyEyY
z;I<fKa85WYd0ljx`i+;3v9{SZyBk5VabFtp@`0irKRLRwVs16t`U_TMTWAx(pb;R)
zUnt7+{z_>;#FKmtXSbG}OK}d{rnZ*7>-n!bw_5FwXVaKm1Pu%v;(f9Qj|;0BQcaQ*
z0)9YjWpmVimR~NBMu+j?O{B}MW{kILUm|Ho>%G36c?09`W=iqh?5;rZ!=nc)Bihya
zr^XUkpN`cW7Y;kDp2N@;^Ybqk=j+*?F`mlt$loYJ7spe?fZs)Y{ko|cwHiCzTkPoP
zLX<48b$>78<=;fnch+pL4IunX?0oh<ISrv5nX(e80X`$5xs!`FBT3!goDK5-GRQA?
zly*7#V=!~%=i;05g=wNQ0>wV9FZ^lJ-^HqMGB}x~(0(+Uf8>K+v7?Fcfl1Du-3zbX
zYP_q;*roli=$sStiQt-C?;&>`te#VXT+vU*Z0@h?wJQ7Z#RsxZ$@k>7A(h|Ux%CSN
za3kq8)Ab&v#HW8QNd-VMq~ChhEhXPGyp8cWK+C6Kk-o2J$GCg<W~?gOLDamglj#;4
zI_od$E#aLFqDr%}1W%N8jrTvtrlIrP=uS&~31_<LT#`Ke<VfSt_>%Z^>Q9+;wFVyK
zucor#Dp3oX0N>YQevU0FxtXScR`%9z4Nq|GA$SMNww)kUOp#HO@B1OTdf`%;wZ-66
z*vrCVR>^N)6^al}PBCwl>B5n7=49?Sf3X&@7{Kecl5}tpC3ev1)!-D3sSm!HzXA*U
z6<WRzDK_7?P;=3Li#E~{y${c0fg)L4_|qRC%LiIt@SL9^=<Wn$1YhKXs_W&JfxN)w
zyS+|^ZoJDJHV`TPY9aP6<IQ%vq+Y$Tx1-JyMzgxe{@t5(HqVa&_UjxOBF-O4dJZ}z
z_Be}A_@)RNmYfn5?lJCly#Mnx3~8q*-z1$c^L06=YL=b6it$x8Q@n5&hp$$*qh5y5
zT#p+GBX-iuAgos4(u+jstT!`w<;6&BP6uqRhVfMf|8UZu($|{eIY>`t^LCz<_IC{Q
z^d1@y?|R=a2Y5k?@-V%)=lg(wx{&1|R~Y<RozE(f_Xc0h;7uWG-@pT2f3N<ODNh`q
z?Z;U3dnuQM6wcBCsE07C{Uhqcso!aVCg|i%uwf!9{wR;gy9ey7_9#Wmllt55CFsgE
zEu{YR&ky77AdfVeMs2z3;??A!r@J9^9I5o;c>Zsi^lw`_RyImmCGq1;bj-D}$DRSk
zJr<509K4XpVoZsg{W!|I$*h1i(2g<vi+o(lXM9o$`IXCFS7V!pzg|GNO9@`+`5`LD
zab-f0&(X6D0~zC)ago`-%>Mpa$Lqt^u`l-nJM(Bu0@n4nlDyR0Je=p!0ftaKlCgHW
z<|sSIkd4fNhFtdMjg2c=#IVhuD7n*0v-XC5-oxdzLpIT`3+(fFA%nioO~j;gi8<lH
z`C?73b)9kX&-WnI4ycBU&4=_~i!W$YS&T}eZDzNBvg}qZg#9Y^VpUv{M$}XJeta2@
z=6nC%NN9+9;LMh!<)!Az*80KAB0slzWa)gZz}sYl)5T%>)hsH;yL5eqD0{4HHcfQ>
z=EUG(U*0~el86NjWR!>TUxH6NXl->gtm8Hizs=qMTeaQry9cKK<rn_0$;|P>@fwdm
zGEe@~3!v3)&jWJRHda-9<^Y{&+W+r=q19EQl<5sEr<`g6SCVa3`clVW>&<1{W&f!H
zO|qzf6gB+6k)pRKYVzMYROUP={M+VtCS##<r;k>XMBe?E*Zv1Y9c)&5ljFdc2X+s)
zXQUm}CygP_F5DL&kVj_eSr;kw<^Sn30Mqk7Z5IF2W%B=HlZ|H|L@LFq=Zh7jvPvyo
z$_m034xz0SG_Lnto30y{Q0zXpTD#|n@LU_Z`|^t=WGfh4y&MY_pYi-tV%*UFn5Ma&
z^UMx#vl`8Q{o^z1$4zbPaOUB_(Woh$*e5o%DU0<(fr{RbCv462mJ{VxE=@S=8s{04
zz{8QY2qqhdlL~}pQXkWwo_)khB>`i%f)p7omaizWIt}N%Onm-Zu<7L6lu=N14wG$G
zA3tBjZx@2tXBgG!+l^8rEMTOA2}bJ6q^e|~x@pVWMxRB{)1YaVa%w3L(5Io9qzvU<
zccxsrl-JNMW3yDL!x-Z>BJSNgu{#jz;=UMm$Rn~OWD+zwRTdOvO2dedzuVyFf~xO=
zs~uQ&2%!dIs{lp=3~Z|BU&v=6PKpp3!>~+gh)6g5c91Tp$v8E;um!c^=&1(ooi)o6
z)g}$t+20KE${^o@IK8AKYf4YmKtVytal<nGr}zRF7?}}bm<*vU^6Dcr?fyA``#vcG
zQu*LN8>=2~<k#0DQ<zRUpqph3TuO+8p_c}yJMFA4w|u7EY|_1St8cWvW%pZ-b?ekw
z+K<~=j1aVju(hTTU8tIQ*HWm8RQt%~23kmHN&R|3CUMgyN=*tKueH9uzBpHOj)wN8
z>!2c&Q{|wNfusj)H^TH5a2S>4@q^uTvWLT3m^2Tyt@5(rwY*HyNGZ&#^V6L+&e#x_
z+J#{A43kEGB7O`>>X0W5ekOL=%-R<gKMJaLB@>Uy^XKJjH_LmfXS}Dncjw5Y<4ovw
zohfl$Z=xWgln5fLu^}H)s1BhSJ!dMwXEN*7!N$NA!NZ!Xo|%ylQOTVd;NCjf{VH|L
zu_KaM>#&f|+@7$)D&cCjpV~hr=`>ks{))kQ|J{lBT+IcPR_?1VpZrI5;=C#iyA8tB
zw$gsvvZRwG!N!B3*+wXa3wcyks`wD*v&NLwXLp9KGHN8BsARb{ha?Xwa}bx~)RpQ)
zgSmFC9VWlOh~pgHMv_Uyo@nXq+Rpl_3dPVy!d_3v6*iW;t7~+7i3!Ov>s@0eP$x^Q
z%t3#$FlO8$rf<qcc~tgf{(ZzspU~bXg)6uoQ_@gxQyX)rL^@alhM;T$E43*ZKelAV
z#}~37Lo7L1G}{+}{yQj>eTdYnX&(JypKw!iB=5X*@9-p+mITHbQO-r%?;8Q=ulYwK
zAD=JDlX0m1$E<b)940e{#RW|(KJBUydH+b*{ysyDatu4$SNtp#J7XEA+Aobo$WSYz
zB}swg)45C(vqQuQn<P1mJ0rBXD5sKs;72#@t;C(}2CUo~)9S!kvmm8s_0a{6Zse^<
zW?}!s^#mrDY`n%4ZWMUXEc?pcQM<7p)a8i>+cOPJT3i#+9P)CD4rop&w$X<GMJMQ~
zB|k#Tla}Nc6Rr3UK@cjf%Pod-RnPiw1XOqS#x`3lgGagr)k!_FL1hs0)dP72wMugY
zYJ=j@%qM`-z)luIfLlI2@(KxY>XB`J%xCa2k+5G<@U3>zwnH1MW<q-4jE>@TvK$^)
zAw3GO(fCR1wUP5^W7K=L9hHp4kCZmyR#I`p2;DTBneoCTVH(cSrk&rHHP)hV5ygL{
zTW?iQIq$xIWTMpFSEI?8kXi#`)7ZW1uA&)@{t|5GJqN#GB~Qu4_L{y7=(fQK_vrec
zW5xk{u#FXX%`tX)>7xO9U4BntBpfC}D1l9vF}x{7U1H%wzE+;niz5#5Nym7Zg$0_y
zl!;&es*q^r9hF}U)umw9h2}Gv_%6)<dXH^7-OjDfNVLqhW^J1qU#PFI@5XOkk>0#o
z_`tr0p$>VFBe+#HX5v@U51D+27%SvC(}6}V_1K?&q*>)TYi9PqkX2_6F^0xuKm~@@
zP(3N|*RNkSf}#R%qEi#o>hp}!CcJ&`&cPpb<%>RGuNp|E=sKZ6DDHtfv)-L%m-W{k
z^-8_AANhdqA5UFpRoOg#F&5!xLmBdLnB}1obn1+4pd!8xI~n?}D*c_#`*&5{U@6YW
z9oOGV_I@CWkGk#O&TM0e-gDIUhaXjBw#6X6Dujqh*=#BiQje#m;fhs_O3DW_zDrSD
z=o=RIR8vI0Z6fyjBNAGXeoGjK(nc`=2*-&a5g@z&xabaYkLDzrq)>T2=52oblrvU9
z|7RAuOLB#LSPEzJtHp78gj%xhR`Hy}#1Ncdv2el?$8OJ~Yc89pKJht13kT_^Ua1Lp
zhVNp!&n)xDMKGb0ikvdaeYjAr=uXIJQ)q+utgnSmjyS3r6j9jXFFpM9iPgFG&S(30
zZ=**Z@s{$(btpO(5nEMRi~FU-m0fA~6Lr{L+&k*?O4iYy#P=M8+e#UJE6D&d!u#lM
zKAc|&;SjhHc}vd!U=`e#lN6O?jPrdPRAn<&uGC=zVT-%;@aL5jAq%Cg&JK3yrXC2)
zI!s3DvBU_1XMt4Yc=!i9UFShBx%>&iRHFaZ<P~hMiyLg?7MWvf^yn}q6Amlul*FW6
zho;J7#YwUtSDXLp5k$&RL(D`kG(YZ$%lmWlrj)1cpoAoLzF>7h()tH&J&qHE*xQ$9
zwhV028T}5yp0$6W-LI%vvp%7y(bjj~|7g?T;J1$C;kO8Z0%JJ4&;9~obq@o<Sg-^x
zYn}|}$tBP~`_a$QA5R5&tpFgn+5YGX5nWyo>xa>g>gQOal(Eu9?1ofa(0!u&&lhr2
zI7)|Pn>ijh*lRNQIJDtY{g$siKL4%8CQH>bMas*b=BKwd&CKKipb4$WK>R@%iyhzw
z&fC*<K%6<!QV0a8n6_D!j=IP|>erdc_DSDo4<T&-{0FN38z}!@ih@;2KvmeFnl?%r
z<W470B}fuJVQJ2Pqj-0z0||1%OuZMYT)>I<lv5&#0N`u)PbSHeRG!?%H#X2aS~Fpt
z3ZQnm#{^D1Yyc<*N_M(+!SaL!`co_tURL)TydwtuDsL)wV;X>-9DXoHtSZ60uW!?7
z8^A`Wj?T7%+#ZN*DZ)-mMJ{^(mjCKkx6Z)RBPUOr8z4Ps(aY>KPquXBkv2@p>vKr>
zsOvh-m0S9C+(HUzQR6t=K8EtRZks~o`fszj??fNhZ<H7zeBDTo`n~zt`R>ogcZ=7c
z8zy^CH6>9hbHtsm^npA_lCyms9B`R_*R6L<%8k42tQ|t__q%mh8nJ;cB&Euoim}xN
zZD(<6h&?5ebQ!;}L@5c|^hb_g<%$TZ92&X8CRNF+uIntcXj|=Xu1*>M9fe@+s9WOB
zZz2WTpSjjA1heifP-sNk$%U5*U1EDS{5Pp%t;t6<NS%^>FqLj{ubC$u*aCKbiO&Ui
z&<<PAOUz0XQp%Q|zx?)BW<W`lUY_9Ev=;+5vzxp3v|Go`XwP)4(dY;LePNW$^$z_y
zl-mjyq7fsD4P$J74C~5D`pZRybkDjlFaI@5>d7J#GD-BtN@`u!Cl24%)04=Nd#D1%
z#ZVI9BGI=b%f0)@ZL5#up^#6HsBW&B@j7_MUgUZZu%9~D%Z*02796ndqf$iqKEKlK
zr#EseQ|!G;-RE*QCOuYx*P$Ah3q4#PS>;r$FX;<cG%mR*3}ROTG@vdrB~&OD$?mpZ
zk4V&EoNqjyJuT~CFDxwVDU43ItP~%P_cpmJaLv)lEJ8?US3>XE#&}NB9d9l*i;=X1
z-3Ip%3t}0nEX0k!%_=lWa?d;MNA8|?XtG6!1zqer`J=KJ9i=9Hqc`Vx)YOW2IcmT1
z^O>%6cC<EVy}8ZvrkQ2m@ISo(k3P`^!KLfhu)c0qcf=B7`1^ZRE^j_yNDYnAMHKhN
z9~i9~2OKS44PTdn4A4?$fRpxFRLO-0luT%Kwt$~|MHB^KTl};7a$M+D25!zJM#Vvy
zVNpX7b{SvS-dkK;PVKaQ0a5lgt<``%fez&!14Txm(m(B-20et+IWlZHRyq8sX{^cK
zKQ`Y-J2P=lbaaFEmv0DLqIrxME6w#{WcE6rPwKsKQ?#P1lNd*gIFD%dX^ZYl@*O{L
z=#3C;sy!Sv>KKjaxvKbQng?N{nhNq|yx-FIHUr`k0Ma~pV*Z}7ZRMF;ZOi(8{F(+-
zB}I;7V(+4ldH76khsMu-zBf?FwT>$zjdzVW!Vp6!6WYJVf)=$H_BU(hV9bz#Gk|25
z=>*qIvZ`<~C=U0AWcsh?KM&?kbA7rTmvDn<p25SSd=$En^ne%2@ZCb9AV3k(C2l-y
zXJJH%PPzM>DjFe?%LXH~Cnz|{WAnw|DDzj#jo%6k_;sK*oA2r6ZkE;A>qYR|X8ed?
zanD|;KJs3D{#xh}+`#J$m(VQibW3`xQVZ5uRs4@dFTko>9gp0XJM~|fl)QOU4f2c5
zmW|_L?NW44NW?pWwz6-3DjbtD-z~YHm~i|@Ekz{XefNmVThK+0Z3UG%S6nnGxkPCF
zwQ>h}biEb~w@6G(I~lXI%#_*Kz33-goKJOI6%6^EB4iwFuqAHT^0$*2j$gOK3(3c1
z(p-Q9Z}{<y&)m_J3%Q%Gw6#}5JtAOaZ+#jhtD9j0nkxL|fSV{CMI5$D8I?Oa5`Sbz
z^FFoy-e9izAv1|Zr-=e}x~w>E-W;La3s3#dNuO~Y2`o@l*3z-+o#{4T8CQXACO|c{
zgCd^#d>G-hUpc*gUtIU*FA2_3KuC@GQ!ypuUAb3;OWT!)qF;k#7}CBLUP$X!pVAGh
z5|`8qSBN&YFJLX`URiW|ja#rR6p()j1dnpIQ$nF(7*kXUpLn`xTJK7YCN5(%+~Ml(
zLhsbhnDy`oZnI4@YSxSvVhM)NfKKS@eC{VH^5_LATi$&9UaI4@y90>(n?R4U3C#mA
zH=AwL+9%!_3%5M+Hz;~A`lrTa?&d_catugKR)u%mHR2D=(Hi9uI&GICjN&VTMN-8-
z^lN#>Ywr6pN3=FqpyX1qN?R%W!A(_GI|bIgILEf(+Q(NNnzrjV3O?)eA2w6dZvqAv
zYsaTx7JD%wOUIE9OXbk>pk^9?O=>qxwXFhC>^^$6V1Ge|w!`SE8&MsO*V=rgW8cU6
zq2^g^p+dIob4<AIVigmMJ>PntqijiaYs0|su&>RMQ<M(cxRy~Ie?zz^2gMEnXK>hF
zWxVp9^}{@8(BO&i9n~hcZxq+ee!8Qux4!XBF@iTUJC0AvyI@^glF3dO3$w!?tZ4)W
z0>;7h<(WpMDH1kOz{irivJt6W@kdQsk?tXHN!g@~mClXl*|!WQqVeH;B`1JoU#Bj6
z{#Rovwq(u4D#3!&TenZ^AcL)g{hiG3x2-=B$14Hq-)^V**eBTR6@}&9vO-S<EzJ?s
z=6$u;0}lqj4D<3$$%xlmOoZ3ibT~3RDZDgkP`6Z4aHYOL>er-IqVb-W(unLA`vuu%
zzq5UYMZSM)!fZ8u0-+*)7wIGQn;a!RtB<?*rXo`olJ&1q|6R!yBlCz;b+AK|{T=5+
zZP9lnZ|vXGiSew58(fwmr3>4r6&+DPU3;DLP<F4A%Wr>;Cudamh?DtWF!3rw^p5$f
zO-+;1lFgy}*UY|Gb=E67iB$syM?X3;!pJy}I4!yGysWV7Gs3`e*v!F&MnHQ;K20wu
zBGIpBUBZ}>Nh}M-Uz>PF?J7o0Uodk+#IBa#@ZBuy2p_UdOOtS^5{HbX09yT_9!WYZ
z)rq+ho*3)6Pn%|X#&$)rnL*lU=%Q|h@REoefE0tC*6lXr1IbS^#x7-TH~hGJapzJl
zG=p3Q6-K2OXnXBiCCEYDI)O~WfdovVh1gPo%)S$T;V-+q@{69;ES%*^k-Z+;@%9z&
z=N@suzy=GS_;!!^?Ow7?MwrYEx180`A1Z@Cs|S@T67ugIA$*fwTb+||clpbZ3qoPl
zrD=JZ&q^<p2<7Kra)rHjKwl5yZR<qv8fiZ=x*5bpR7wz?!~M{)MxU|HPUWc&>t-#Z
zs2QLLJ<AS@z9zd3s~Mf#n*Sy>6R+cRoKd(=EWBS<*w&B<*WTmwqit>b82U@cYvzXi
zf{maqdusG|S&$AxH&g?U!mH={<S(#5t^p5*&BTgpd{OARs#o*W(**HWU0p2;iBfhO
z^t$=qLt1K*IXv>#55Cw8BHpidrfFR0!$$UHzWb|7nA1wTA_5vDzZV<xDotWH5E$8k
z$1_ZE1-$PV+|AX^tH-y-qjGtht74uMXnH|iUoQ6rTKq!nG2eL*&2vr9QDjbc#I9>!
ze=tXjA;<%_V8iEaHQnnGG!{(Yee76?^GJ|4t>4qeVC@Fe<c6$o*#$h;6{Rjcs7REj
zxnIH%fRUc-;zl2?D^WZX1BKf$Z_}Srf06)8<h!SYh!xpeHZYnrBwlhY?q>DeS7rK@
z>#nI$(Z?}m)BweCxmJ&xM{qVS-`yb8NdQZJ&Sx%=>-;uA2Zr|%Rc*T~27J-7a7$-&
z6Z+f&;i7ti)zmkRwef{+b8GY!@jvlWeDdYB1vYEl(Xkd)epO;FMX3o5k<nazE-oeY
zBVu#O-BbQt3hh1J+vyfM3c<8t5@WwFxn5?}83@qZk8NAZE_ct~UF22D_PIA!uvNrI
z6JB@+N9)(Kh2Sc56x9wq;?1nl_UrL<yBF~;NfMhb-QJ3MD5uQ~`Cj~IIA2RRsLBF3
zd8%|Fz@ck*&6EoSY9o122p#n$o5y%6!7cWoXwx}&P~7NiD5r>@ymE6*trm#G7vOp+
zg7&p@z^wB~r!?9>5BhIz2K+yrWUL29*}&(!FK2;T1y-dE7z8t<I7cf_&A7pP#x^?&
zn4X`hJVgMq>^|F0mxq&RSRDr%p~tjAqgB4Ui+ZMkUKM>}5r3yqdGa(>2SsBJ$4p}u
z70%An2I(@@)qoN2>fB<Mpk94FO-<|h@MWSv)TN&Xmj{9uUrIEEFI|=dSG0rPU9kpt
z*6{0u*lO+S6fx0cwd`_T`!79;IoS@tpb6LK0y}P)3&f=RgvZj$9t=>Ozx5E%TgPI9
zpJu;|TpAOqgnPa`I30|E9aNPDIxYPEII+$w4<p#fpH2XMdB?%nVdtu$GiXoT$Dm^1
z!jP<Uz?4X**gZfw9269m*n8S9H$T6^U}z`-ivmr)+#JA}1gW~*VXOp~G`<R$5TZw*
zVH2pCC;|5lHlJ38HaErA@T`&Huc8*9LKMOQ^F50NRF%s?9oR5+67{ISZ4XMFO1A}A
zyzH1AkfCR-Q=JO#wXGQzu6gE!d_p=<caIKd5O!nWk$m@%#4VS9KiO>!d0dxz6L>wg
z(wy5~YM?ke18kh|*jP0(0V5B`|H+&+drwzhWkCT=a1;(GFko!5T5oj$z^NTnV%-8X
ze`383$VkpmrF*@GGb;3Va@+GZK&K`1Bg^O2!JEKS;vmeQKL#EkNXqX@Kma+nM>12q
zC6IXylD#Zmm6|jj&B4iz#eOL0tgv-&Qc=1e4xQ-IcsR-xEnyz<pt@7H1+33EPJEX-
ztQ>%{!G?X;9nbY)J4$rD13@Kkq_B9V8@OZ{RFDVRXK0I-G6Ih#vSZ}@n}euYLg?X(
zVcg~JTI0UVhxO;#edn_|h_<x!Y*L=H2*0Rk_--51z9PlW1XJ&bE#L2#78GPqUJQ>t
z&k^7{TOwM%0Y1vG?$B+iJrH04s>bL(Z{rkDy>h3UT9JMWADO=03+TKP@=U2X&116C
zt_)MQClN03rTax$CsWhT$E3f`q2!5c>OI~6a*(~p--3qQFlKWbx!o}JR=L(4ix^ok
z+kvbAd7%9_yAKIlE^t;cNBv0hc!!)AjBt`L`x=kmDD7ZA83>V!7reFsKi#UaAb?zf
z1VP*0DWOQlWs-5ggFsIK?I{lh<5ilF{1R>v7K8`(t!~K<pqWv^%ngai$n08xOme^}
z#XwnYV53C_1`3yVUJ5pf^m|0csJ3QkmvC1fo-D<1cn&;a5Zym)wF`^8E}ZG!egE<e
zex4OaPrZsgRy@$<QdfBIwNYijNjN_Rv_$3{ezZmoAk1>Z0kFcW?EmP5Ty0=UAV?(R
zN}}0i@j&j|uf(rl`<J`oDuTZZ;h@@n7ligGnt0G#id?(0cP_$ee`1ebDZVvAp%7mr
z2Y3lH<Zn>J9d-MYr!K!$`G<6hB%cB=3kU81G?I&Ac|H1z5hp8xOvI9b-F3Ak)~|Zn
zy+^5o>0IN5IN+-zxz*BczFmQnFz^!41ALQt|BYK4qcWS9_FwE4CvfsHoG(>G{O*u;
z5t4Ufh56n;KIk+JJz!<PYk^%#`GA=0BoRAJ^zeleipsV4!*H35BID#KI_NAimP=Ww
zk_6)N+92_t%L1X003iO_d$9mwEie`hZk`EzVTPW6Hv@4I`1`}fGDm*R@A*oKqr_4&
zz7$D73zk`wt%ah?<~JuQxJ;wiq`ko=cPkJ??ELQBVlwvBm_?2eaQiWmD@mQrLZamc
zV<pCUYUzeW4?kO;ZIk#gz7^0*DIYw~<2Y$PPcd?MT-vLGYk6Zk_JCI=*FWn5Kb^vY
zyjGLIxDn<=-1b36BpFXXVGFq-T?Yc89mWpi2AsHIy1!di2#izbk&<>d#Yx0oHy_ts
zCBtaNeu<?>iG|&!4x4*wJrsvsqS>gMvrBJw)d+gQ0Jql))ZR(z9O0fA16KP@(vQup
zqL1MUKy3%eQ7DkPCdsXF`SVMAql!5o`-DX0gf%WAPZlGV2sTlHx&T-(w2*7r7e#(X
zM=W3e%0u%_z#kah&n~Q)RFgo^*Ub9ILL>hEGkh`)(%KE&PvDPJvS55@_994+%FlQs
zdYL7?0l5uLN&($LsWDSB|LFxp@fWg4T6M=qiB104lN)*d8r0#mv@yWG*OA0%smn4}
zbyHS~*iA#vek(sWiA52i9=NV0bTxkk1XmzniAU2OsPW|IF>@#F;@>0?UH4McTz_A5
zlMqsey)Mhd^#GFl{JW450Ci5@j-DTC$`>m=FzuzElo+KJH)=qx4ISNm#2ck?Woszs
z<zHT0FDPayj`+jPoikb~2-SVu)ZPVLoRJUXIpgmNqDv`dAc;?ln~Fung@w|%<v5EK
zHt+E}yuD?Pa-v7@)=&l^_rl`paN#e?4by+r<=MQJYOf9y8`T87I=kj8zBIs@*d7+8
z&~teSCA0qu@xH2og)hd8gIic-R7j2##p|4wcA+_fNicfESzC9iLuc!bCEB~6;dEbI
zphT;6B;<#1hta3v@Wrd(BmkST#;vELJ8n_G-M8|bK?gkx$mx+W7Ga#;CYh#dHjEI>
zEK05ozdfe?&EadOFOG#%5&<SO;sVpTmgi%!V%a}$`B@-|M-e~EhGr``D->n-fdDM(
zed;sgrT5pr;77ObR#kUV8h$U4;WA&IGf4UdEnnNV8S@|ULQQeqdYpslo<lGARNs_o
z|2;$~8Gi0F<yg^&@Y|ma*ze0-i7^gO1~TB3U<GVJPu+e!x2NH*<3P2ZyL^KZ!hJ5X
zquza@W19e}V(lVg%gl=4OHtzertSEM${W;CO<&8_YDKOx2nkSWm*h!Q>Ob_p&%x0E
zn9b0naa7jL^ClDLd}g2c6x|75)`*S1&2krCs}?IRA$a8u?~qQ&>#9Nx7)m^)_*?Fk
zuYPUJ5kx^X<1L#iQI4^*kgX38+5t|*ps?kAV3G*O++a}6w)fu$7!Rs>8c+m?Zi`yn
z;j^`qk4z>%_{l5A;);Klbk`Ut9Q0YZ>N;PYT9wM?J;lPwP=J>`rb-`$ISro8MF`Z}
z=ESr_QHRYZ$}>w0L3`(bK)1$+MuWL<IR2a7STQ$6)Is;}@dR&sMz1B{cp~-;Uf;Qq
zCh1}AX6pQMIp($$el?rVD51kYTp_~e0Wwy?q4tYLLm`9cQZt2-Ooo^#qUG0jj;B4;
z5lDvH9now?Ma6>(oi+M@&r)(l+qrn1q2W7-%Q~4O6yKMRSahbjUKv7jZ6r@Uv$IUY
zKM;T_rZ-vZz;1Z><VOVQ7*6&%Tl`~AEkmXbP9|vxMx`CCX2-Or2^pC@En5FwP;k9S
zso_3s=ht~IPetRhYMph8`7*eHkth2(u98l%<o!(Y8%fdb1i%|Xm>6-TZUKj}0ow!x
zg_^+aI*d}?-g;qaG$)2a1Zsk!5KO1cRtqw(+gwStOZ4!Q7LBu{HbEG}-Bk)&hP8yv
z@O=Yl{fELnfLV)i$_zZh0dn^j7v_sBICD}K{A1z@C}|`j30AjWrZrNkGo#Z1M9D8H
z5^m<hg@w*((S_6uly0ic&M#$|>avI0X@nw!xO=MML5Ve9f&rjt7RePwnPTe`pi47i
zVvJ|Nr`Y>={ZSR~JEe_yWXFFkHM)Yq#b6V2u=XbthF?oG@xR~i7a8-}adtpT{zE~B
z0owc*Un%0zY%Lh;DPV>XKHQ_3>ftYGcbTE{@6Ma^`N7Rn9m`)>&hYSeC~pJu6=odu
z!tGAB#D|-veiwGz+otpoVH!OBnOA0d?;HMW<Ic02-PWL_(P#gV2`F;pBje$1PK#$e
z1#BEb_sgAiuRPe@``L1(r@Q7leBrWbXLmY9;+npVze=ejUSXH1O^#Ap@dFvM3Dk}m
z4aC)7bKnO;c#URna3%x-7EJ^QdQyi96!>Rx;HyG*Wom*^i_&ZZg5P`dr73>s=i3(Z
zSC(HpU1HNYuenr>=-Q;Ywg1q_2HYqFU@8f~R0F_>{Si4(App^DbPEeM$xSN^8B0DT
zfBVkt5K8O4o}VWMzo2n1%GMv0ISGLHoKj%*W(Alh(n*JWw1_AuLv_xU3CCv2ALgs4
z2kdp}C=T*6++RA|uBn5PjlRyFCwsI7+`R5?)pYn?TxRQAv8s&chi(Q76n8{tHd-N~
zg6Z@|touOL6Nb&DWgE2NDuuXK72=8q0Y86(h|x3l8le>F5{#5PMnWViLt8cK1$9~T
z#Iac3f3M%Sq+2#}a@?^WmN<U{f~}ht<txsm0jD_b-FBe-Oom}+8!b2%qe6{kSF_%8
zeo{|<ba!@|XGE9%DMAz!PUXwpi%FEqcR<=6V>`>@oNp-wh{e6W6v!1)vZNd^$gLos
zlGGB6-OdylB&fb94341rrlAqZX)|gLn&$jK-E<F=U!C&&84_@%>@2-$?^A(iqfx6j
zm1P0v{+6A~;{sb^oeNF7p3MES7nn{r&W*nmsQX?!b37Bq;`^*Y->9{-$O|3vDP*~O
zH&$$kMdg*#L4A9}^(T0vIlL}R(u_{-#m(6&P@8e7U(59qggg-O*`6l2Is2i!6Z%Y2
zSZMSszyT}67liK-5Ut9LJ}1E6mpWnuSvqpLN`h{=wK8Zd8TTEqE>1qt{%S<NbtB~G
z(d0Gd)pRkZ$yCq@1FYF+{cw;Wme#`#E<>;>Ait`7Q`4NfuT6TG$}j6CX{MU6t0(^y
zDGh{JN;zn;p`0+IGy}LB7#q(3-Ih&Q(}FZNQ0T^uVqw)RsvqAjiVQHUQI72WfB0^n
zuMRW=Unz=YZ77Es;>7#EtJhqRuRwp0L8Yw*&12Ru!G#mvXu)OLECmfJ8mSDRq)tZk
zOrsWC0M|h}PLu=jd`)K#u$~P76w?6YgoC011(wPH{X@>c{Bl9;w*PbP@*{}h7^r|T
znf}(G>W4_N059d!Vu;@GJKz)83i&t#x8T3y>xZ6>(PkA>&g+5GidC;bA$0cl$IIZB
z`aPfzV9V*}FB)dZMm<HJQrl{6Q~g&oN`hNLY;FF-gy4420;Og{O5xFK;|o=D{Zj}{
zkoPhr;{*Qzm=)zmZ?gg2164<{akKZd5GgsZ$XUkv0MRKF8&Z>bkec8y2-s0C$i!c$
z9(UxOq5bp(3aXxh2ug#*&QLj}zso7_-^<n&0-CKFz-lOpN>B$ygCPf1*MPtpGlk1?
zn1G7o_qk&PMwa18MRmoGBBL5-oHL~diE>^s+hZ26eo8r4iDj`I9DCoQfFo@d^|c_X
ztSv^TND3eBOatc~jR2)DuNHHeMNCxKlmZf8ChW&v(#U)g0>Blt+&sD_3=$bNz05=E
zRa@YdK%4~2t>kt<$H?%=NL9!IE4VrcjF-iXWia*G_QBxx#(32~f^b~Vf7~w$?L%m9
z21Db-I|C7K(7-@dTgzB?l(Eb#Y;F0s9f^SZ*C|jb7Rr3F+4VS=vQ!i`Ze4{G(NOww
z|1W1iYe7$}Ej6HGszL-XbC%%SiY_)o24d5^Mhz%UH|Qif@#!64kB@te85gbutmP#3
zgDD5w(T74`bAoA^_b5IJ2!9Ds!dHsEl}z6;?8_`{S-b)25cB7l-n^FCvIAC1CSjRd
zuYTAMlg`wDM+?IJ3@idY+Ju0fZKOC9<|oo~xPI`8P5Bsb%fEyP2YK>Q4>ACfl8JL<
zHg0a3aK_-bEx|-!X`q+{-*}DafI9O7lUdI{s=L@bA-6Om{qSpfl-`n&?N^Qt!0T}K
z)P&vMb=iD8S}F0Nn@*H>_7@0_pZ1wlwxFL6!qx@)4=R?TrQ07{R(HzJoz5O})+xsO
zQyO3VfVN;{7W{3p+=~iW5oU<tLQ^z<<O}NaSNN?X0zjwnZ^x}d{v&I&Kb9igvZJMV
z`SM1AK5PX37oTw#2$L$}(G<nx?0XgU7h4Ensa%5k{4LkVXXh#61c1&o2>03EKMCjQ
z*(oPxVKw|5`@mz0W|J19$yH6gktaUNp?95^yX`~<ZC&^^KRy++E)jl{1d7m&ARL#C
zA`{&t$h#b5p|`(30BTWgpRXRUc%9NG@-KZCPGI>3%q8ZCjs`-MO8{49J@9(a!l27h
zL{1oaI)mkuXR1gCI;h9<f3<hz;ZW~ue3(+*qZ|o?q{va?)L62Hijfu)V;fm=vW>A$
zA=%O?Sq~9e4xt4zNR~Jl_l_mo7`u>tU$XDyzQ4|M?>+ZE&-wR0_dZYmc|7y*_5Hrz
z_kBOh`?a;7(gJh3<DJ3*f{?$B6%JO@!l8NM0K*U_u*>@ROE5$s>UU`8VSF`a=V{W`
zadV`z3-oPN-Pv-GR2mAAKA^JJUyJSA8kG}4X|jh2JE!$^!T_L3ano&)>B@Qy>$=*u
zj;@L|h<8&kLYi-Ob>zA>tYrIc6IFa33xZ4xFADu?o#JGm9Scf&V9$F*LF5jl`>~*d
zxJL&cj*0eA67=7>ZiRW63OqW+TW_@py+%-^>($UoL|Yy?Z6%7(7vRUyk9Q!v0XEJh
ztN6~8fr2&Q$`46Wi8?n+Jm$e>l0XYtbZgcUtNa)b+67jiy!aYqgs?H2+r~xPZc%bm
zlas>oBTt2GNsy*F?+E|JdVjk7qs4U&rRkitRp??HZN5Ms+he;pAuDQ6+apM3B2{Uk
z<@K0VP`9_p_6kHrtDepbBm%wQopcEyMz^G<x<j5i-vqYVwLU?}>Bq@T&KzLlR!XdU
z-vkD~70}%qx-s_R@ezK*T^S~_awaTcU0xL(a0scn%WL3>kLqxE7xx1b>^2V5X49T!
zUXpgKrO%Xsimy}%d8$etXUcEMYw)S@BM0fBtuPXmvX2}kCqmTl366>IvZ;^70y%YJ
z3#YsZbcm3@SS_tm7<dh3KG8u3Qmue$pKF~YK7AST08o9Z7#4{KF6<QYInLWdnAH0C
zY%wQpQ)BA6em`_dC(^K1DM#qfLNEIvg_AmjA$AxHH)rg<2Mvn#2$|ng-rUor>ed=;
z()}Z*R!3P$TLSM&r|d~yIkrtH@=20*z6Wv`z*8p=rDveVsP?JkBKiR(<t64tPpf{!
zm((UB{22(fXZd2$hbQ^7{=o%I$eDfFp7lK)$08?g{~CKy-!y(==H#FwWvqfrXRCaV
z%J&oQv!$zHail04AyDOTW8o*1EXw_GVk76SXbgtN3d#<2@xfCF=HkIEztVU!#d{Oq
zTj&BtBT{DEo5qV>Ta4GQIb|5;;4~_|z+8sS0Y_aGJ^*|kixHYfYEY4&;HXvW;aS4c
z4vF?57K0>yth`X*E_tB%Fo9Yc)>((v6^J)IHyWJKVKERJ*IOUQn-9lYg+1}LX^7+I
z?x@{#2o{K4G^oYTyiC0y@LII*a_Yj%3>?nRy)(yheNLx#VW6Zi!|1rS-SkC#Uma(`
zJD$x69p5;cS)BV(Lr;kadTOkBT938jU+tf)#*EOBID#DP0eFPk`~^+61-*gtU6{(o
zI6~Wkag<NS_PVY@31mATz<uWACJkc&P!pw~;$$p&f!R$)$S-w)&r>A@D#)Tp%cux3
zUX6E1#0+;mM3_`Ds^B)N9uiW~xn))<{Psy#K3)Z#o(n6qOsG$xjl-;1_jyCSm=Q8s
zffNY&XC<m*JiX|i`g6^*f1?A*2K*rQl=&t`<-SJ=(5O3GNQz=Vx*rxwzNA4jK+r!R
zj7G@GKt##2I`@i@5sJC=-g51tv)3DxIo@C?ApeGLIB?D+Uud_-sCVOei^yQZ4c8ZX
z*%Vj?e2C)`Tfd2?t{kfy9u+pVTZ1j^;bFUibZ~%iw?^N6z^x$NIESBkZdmLksr(Dn
z{%v5yyTC^}DA*|E+y?j?^Q)4(BUUHjnby-EMk<GWwl^xpY!L4H_hZ*|Z8x_0<V@dh
zT$JL~anl`<;2@2a6##dR(??8HXTc(lAk6F~+)J!AM#1%`G7DIJq4LIPmPGJUXXJCQ
z)z90b@lKE|1F-jzdqi_Fx%F``Jztu)t>Xm0JAep}AlI_Wy_sA<dY-YofDnZXhx<!{
zDGs;yL{f{lIIkh>KfyI-7V3>)jB-lV5yOkXV;8KQfnt?p44iwAHZ8McrHeQ}3m$4D
z+g(3w6$^(b+hO{Yg+f45#3jbby2m1eRW#ix;LL{*83HM_p)m+QiWo_-R#oaQQn}_c
zbh{2b0??!6pz-;VID20#<tvQCu2~6f8bw(yZrX{o8>oCQPov5)ZnV~CHrxF)u_mX(
zkn}t-XL69R4%gCoxy?|nWz#VFt5ZWuEU}g5yHj$a6tV$GGP1r$4XCljKh;EndtSnq
z@8u|1BqHW^TUdMox4GJ$0%+CVpn&RMTBtkSSiJ=aOchu)1hPXNb%DVkNyQ3rb%!u}
zXEW{)vY`^4KPu+F$b++8d~N6V2uATb5QHyNDoKS!DO?o9uYcp#aI>b6x6I{NoJ0iX
zD9hlUC<T>Aub(wL;#Q9ZWsF)vmE%G3(WwB(3L1oiAY>ECbX1|Kgp_lCIi<%;QAqFO
zfE%Sq{#b+$628(5c@diB`=1BZw81ZX^X^B{XQ3?%b99bs#YL@XLE=ajY<PUO1)3uL
z^>rn*k&<}#H2z<LVvj#=aL{Q0{L_X8Us{Zo+6m}*4`rQrkJ0BJvr85h5THOOJi}|3
z4hEg_0o*A=dvrQRR`KMZ%kdg(MSI7hzzC%JlL|kb^_c75I#ynp_8|+R`g2pNX2Bq-
znDWYFYVn3=T`5p%NJGm`2BV^$F{t5|ezI3~V^BuHh=2aohNoE@;X%A^l-%i};m8av
zu<@zguC_p>LEnsO&yvNESuF058PHB1WkDY1_~%R$ymgXXdg6``p~?K7SF(~>TuQce
zvd9e<Hovp&MQ&q1-Yg!bbBZH|JIW`cxs9o}UhB@->z&XQN=LSWl@VDv^u`dLwq61b
zIp<ZF`NR(BY)hb(GFF-c7PoZ0N<iZ?as@N3F*3GHU?8LpawR>~O~t_!$Mx4>Q?^DC
zt8;^@67Y0Oz;W0f2wKSk=xp*d+T@z8RSr+Ag7oktM3>+~x`xP805_mXcs5%F;}?f~
zsiBN@;Q1Cm+9Wkxx(F|oY^=`Gz+-5W`8nFqtVUIQ{>7xe!Bu;Ej75Vh#~FBG2>}j3
z+|(e59AgGQG37u>ngmfP!tIt$Pz-^TkJoc6%a%a<-GxB_zq^+4qypn&vYijwS-(8!
zw+G#((^sbnO_u~via)|UL{~6u!U|wXZz!car_B=bIdo$XmJ~@>2oOR(6VXs7j4Je0
zHA+-+|J+U`Y@Sp{mrru}`4_wh=d#5W=CZfze&IspafhF0?Ftc6L+x7_;mA7%3N#uS
z_h9($^+Se1{uEp?SI9rJ<}eoV9C>?K&*bpr505c&0n^^;0{)w@KsqgkCPu^j$Xlp6
zR!u1yKJzFFeelW`NT)D`XUWEV1voNVhTFv)+Tai6z+6Q5v$Si?FMomNufov#{(zk9
zMK-25Xw#(QKJyZU0tYxMn0mQY(gQLz{HflODJ<=LiM1&!zro#K%V?zaR^CkBzpq>^
zzQz|*Ir{?fT{03B2#!S~h+bXfW<v`_weMfYGc<yEkO0@+#h?v%*Puz40N>({crOmD
zY2`tNK_uQP@{GxbnfPQmzOBD&Fvk_EM$8D!##=4KXfQ*21kj0famM@9roM*_)vxHU
zO}gx<^Fkw+B(skfMhMzl_3ui$I?YQpmL~Gc(B!{<E<ZE3xqG~I&GXQcLQG%;Fa<S)
zhLJ@mt1Px08LZAOs#iDzPHCQ{9rViwg4IL^kI9nQsZzVm#^Ar@3<H|vUC}J>7y4?C
zn=06}JwQ<rd$Q4d%j*y2>uM1mi+l$6q|czJ>CX=n@;tNnf4Sp-Rt%;(Z%R{>PX(77
zUu4UQd)-uRy~e$pd7y2yw>HN3U0-imr@sLhiKrP(XH2_!6bWzV2yMrBP&1nN_oT^t
zw^P>*#&;uAIeBkunemy$I`Ww(57|VXQ6mtw=m}jnoPR$@S^ZBf1a9+ScGKq%iDP!7
zqNth6dfvC%7<x+VIV)hX6|l8rW9Z*wQH;ZF-gi{lX3Ya0!&Wpg&ikly!C?4{S|$JG
z9d@RpY#%SVJvaFjJDLhqNEc4e)8nOT0Dt0naW<oF1KHZiIX>IR5ID>FKlhFbg-3D7
zY*?hd8s!aOX@7*T&CI+fsE1)Qd5X*}b+ISN3Yf;PTegl5MM;4L-hI`3O4}m20Rn_b
z%-BP5;9mc@i|K!frsf4ZKuT_6Pq3r2=fDgz=U@5MGLfs&WZPDl{uqU34vg>m?&~jZ
zkkMOSK4IY(HvVaOnB(hEL?~5T)d)pCR95f5q6UlJy^2CpGS$tKw;?$0s@K{0-3efR
zm!|{n32kaK7o4{DjUSl<i1Bzxj2DHPy#Trx3Uv?`@u#=#4+-?YX$*lZ`=5NkALeww
zy^8(E!uIW4zP*Y5?Y{gEqzlQ+5_r~<wF&t@0{_-}e!HRHZs`B*4c$?NQoOUXt3*l<
ezF<Rw8;w%Ds&I}iwki$2gVNH_R?oU%@!;>I%KUKv

literal 0
HcmV?d00001

diff --git a/plugins/manifest.schema.json b/plugins/manifest.schema.json
index 7c97820273..7cdb1287a7 100644
--- a/plugins/manifest.schema.json
+++ b/plugins/manifest.schema.json
@@ -31,7 +31,8 @@
       "items": {
         "anyOf": [
           { "enum": ["host.events", "host.binary", "host.workbench", "host.filesystem", "host.plans:read", "host.schema:read", "host.storage", "host.ai", "host.clipboard:read", "host.data:read", "host.connections:read", "host.connections::read"] },
-          { "type": "string", "pattern": "^host\\.network:https://[A-Za-z0-9._-]+(:[0-9]+)?$" }
+          { "type": "string", "pattern": "^host\\.network:https://[A-Za-z0-9._-]+(:[0-9]+)?$" },
+          { "type": "string", "pattern": "^host\\.openUrl:https?://[^\\s/?#@*\\\\]+$", "maxLength": 4109 }
         ]
       }
     },
diff --git a/plugins/sdk/dev-host/browser-bridge.mjs b/plugins/sdk/dev-host/browser-bridge.mjs
index 3b7ca2f5a2..610253de66 100644
--- a/plugins/sdk/dev-host/browser-bridge.mjs
+++ b/plugins/sdk/dev-host/browser-bridge.mjs
@@ -146,6 +146,7 @@ function installBridge(channel) {
       getAll: () => request("host.getConnections", {}),
     }),
     copy: (text) => request("host.copy", { text }),
+    openUrl: (url) => request("host.openUrl", { url }),
     storage: {
       get: (key) => request("host.storageGet", { key }),
       set: (key, value) => request("host.storageSet", { key, value: value === undefined ? null : value }),
diff --git a/plugins/sdk/dev-host/tests/browser-bridge.test.mjs b/plugins/sdk/dev-host/tests/browser-bridge.test.mjs
index c67b98b925..61209e40b9 100644
--- a/plugins/sdk/dev-host/tests/browser-bridge.test.mjs
+++ b/plugins/sdk/dev-host/tests/browser-bridge.test.mjs
@@ -5,6 +5,22 @@ import { JSDOM } from "jsdom";
 import { sandboxDocument } from "../browser-bridge.mjs";
 import { hostMessage, pluginInitMessage } from "../ui/messages.js";
 
+test("external URL requests use the host protocol and preserve rejection on unsupported hosts", async (t) => {
+  const dom = new JSDOM(sandboxDocument("<html><head></head><body></body></html>", "generation"), { runScripts: "dangerously" });
+  t.after(() => dom.window.close());
+  const w = dom.window;
+  let message;
+  w.postMessage = (value) => {
+    if (value.type === "request") message = value;
+  };
+  const request = w.dbxPlugin.openUrl("https://example.com/guide");
+  assert.equal(message.method, "host.openUrl");
+  assert.equal(message.params.url, "https://example.com/guide");
+  w.dispatchEvent(new w.MessageEvent("message", { source: w, data: hostMessage("generation", { type: "response", id: message.id, error: { message: "Host URL opening is unavailable" } }) }));
+  await assert.rejects(request, /Host URL opening is unavailable/);
+  assert.equal(w.dbxPlugin.capabilities?.openUrl, undefined);
+});
+
 test("bridge delivers host-compatible environment, lifecycle and binary events", async (t) => {
   const dom = new JSDOM(sandboxDocument("<head></head>", "test"), { runScripts: "dangerously" });
   t.after(() => dom.window.close());