@opengeni/runtime 0.5.0 → 0.6.1

package/dist/sandbox/index.d.ts

@@ -1,6 +1,6 @@
 export { collectSandboxEnvironment, parseExposedPorts } from '@opengeni/config';
 export { CAPABILITY_DESCRIPTORS, CapabilityDescriptor, DESKTOP_STREAM_PORT, StreamTokenPayload, StreamTokenPayload as StreamTokenPayloadType, TERMINAL_STREAM_PORT } from '@opengeni/contracts';
 import '@openai/agents/sandbox';
-export { A as ActiveBackendResolverDeps, a as ActiveBackendUnresolvableError, b as ActivePointer, C as ChannelAConflictError, c as ChannelAEmitter, d as ChannelAExecArgs, e as ChannelAExecResult, f as ChannelANotFoundError, g as ChannelASession, h as ChannelAUnsupportedError, i as ChannelAValidationError, j as ControlRpc, D as DEFAULT_DESKTOP_GEOMETRY, k as DISPLAY_STACK_TIMEOUT_MS, l as DesktopGeometry, m as DisplayStackError, n as DisplayStackUnsupportedError, E as EnsureDisplayStackOptions, o as EnsureDisplayStackResult, p as EnsureTerminalServerOptions, q as EnsureTerminalServerResult, r as EstablishedSandboxSession, s as ExposeStreamPortInput, t as ExposeStreamPortResult, u as ExposedPortEndpoint, F as FinalizeRecordingResult, L as LiveModalSandboxLeaseAttribution, M as MintStreamTokenInput, v as MockAgentResponder, w as MockAgentResponderOptions, x as MockExecHandler, y as ModalOrphanSweepResult, z as ModalSandboxAttribution, N as NatsControlRpc, B as NatsRequestConnection, G as NegotiationContext, H as NumstatEntry, P as PROVIDER_REGISTRY, I as ProviderConstructionContext, J as ProviderRegistration, K as RecordingCodec, O as RecordingContentType, Q as RecordingError, S as RecordingProcess, T as RecordingUnavailableError, U as ResolvedActiveBackend, V as RoutableBackendSession, W as RoutableSandbox, X as RoutingSandboxSession, Y as RoutingSandboxSessionDeps, Z as RoutingTransitionEvent, _ as RoutingUnsupportedError, $ as SELFHOSTED_DEFAULT_TIMEOUT_MS, a0 as SELFHOSTED_RECONNECT_WINDOW_MS, a1 as SELFHOSTED_RELAY_STREAM_PATH, a2 as STREAM_PORT, a3 as STREAM_TOKEN_DEFAULT_TTL_SECONDS, a4 as SandboxChannelAService, a5 as SandboxChannelAServiceOptions, a6 as SandboxConfigError, a7 as SandboxCreatedCallback, a8 as SandboxProviderUnavailableError, a9 as SelfhostedApplyDiff, aa as SelfhostedControlError, ab as SelfhostedEditor, ac as SelfhostedEnrollment, ad as SelfhostedExecArgs, ae as SelfhostedExecResult, af as SelfhostedImageOutput, ag as SelfhostedLivenessState, ah as SelfhostedNegotiationInput, ai as SelfhostedRelayConfig, aj as SelfhostedSandboxClient, ak as SelfhostedSession, al as SelfhostedSessionBuild, am as SelfhostedSessionDeps, an as SelfhostedSessionState, ao as SelfhostedUnavailableReason, ap as StartRecordingInput, aq as StreamPortUnavailableError, ar as TERMINAL_SERVER_TIMEOUT_MS, as as TerminalServerError, at as TerminalServerUnsupportedError, au as agentErrorToControlError, av as assertDescriptorRegistryInvariants, aw as assertProviderRegistryInvariants, ax as assertSafeRelPath, ay as backendSupportsOs, az as buildDisplayStackScript, aA as buildSelfhostedBackendSession, aB as buildStreamUrl, aC as buildTerminalServerScript, aD as contentTypeForCodec, aE as createSandboxClient, aF as createSandboxClientForBackend, aG as decodeModalSnapshotId, aH as deletePriorPersistedSnapshot, aI as deleteRecordingArtifacts, aJ as deserializeSandboxSessionStateEnvelope, aK as desktopCapableBackend, aL as ensureDisplayStack, aM as ensureTerminalServer, aN as establishSandboxSessionFromEnvelope, aO as exposeStreamPort, aP as extForCodec, aQ as isExecSessionLostBanner, aR as isProviderSandboxNotFoundError, aS as isSelfhostedProviderNotFoundError, aT as isWorkspaceEscapeError, aU as makeActiveBackendResolver, aV as mintStreamToken, aW as modalSandboxAttributionEnvironment, aX as modalSandboxAttributionTags, aY as negotiateCapabilities, aZ as negotiateSelfhostedCapabilities, a_ as offlineAgentError, a$ as offlineControlResponse, b0 as parseExecBannerSessionId, b1 as parseNumstatZ, b2 as parsePorcelainV2, b3 as parseUnifiedPatch, b4 as readRecordingBytes, b5 as readWorkspaceArchiveFromEnvelopeSessionState, b6 as recordingStorageKey, b7 as restoredSandboxSessionStateFromEntry, b8 as sandboxStateEntryFromRunState, b9 as selectBackend, ba as selfhostedLiveness, bb as serializeEstablishedSandboxEnvelope, bc as setSelfhostedApplyDiff, bd as startRecording, be as stopRecording, bf as stripExecBanner, bg as subjectFor, bh as sweepModalOrphanSandboxes, bi as tagModalSandbox, bj as tearDownDisplayStack, bk as tearDownTerminalServer, bl as terminateModalSandboxById, bm as timeoutAgentError, bn as timeoutControlResponse, bo as verifyStreamToken } from '../index-BrdnxaAW.js';
+export { A as ActiveBackendResolverDeps, a as ActiveBackendUnresolvableError, b as ActivePointer, C as ChannelAConflictError, c as ChannelAEmitter, d as ChannelAExecArgs, e as ChannelAExecResult, f as ChannelANotFoundError, g as ChannelASession, h as ChannelAUnsupportedError, i as ChannelAValidationError, j as ControlRpc, D as DEFAULT_DESKTOP_GEOMETRY, k as DISPLAY_STACK_TIMEOUT_MS, l as DesktopGeometry, m as DisplayStackError, n as DisplayStackUnsupportedError, E as EnsureDisplayStackOptions, o as EnsureDisplayStackResult, p as EnsureTerminalServerOptions, q as EnsureTerminalServerResult, r as EstablishedSandboxSession, s as ExposeStreamPortInput, t as ExposeStreamPortResult, u as ExposedPortEndpoint, F as FinalizeRecordingResult, L as LiveModalSandboxLeaseAttribution, M as MintStreamTokenInput, v as MockAgentResponder, w as MockAgentResponderOptions, x as MockExecHandler, y as ModalModuleLoader, z as ModalOrphanSweepResult, B as ModalSandboxAttribution, N as NatsControlRpc, G as NatsRequestConnection, H as NegotiationContext, I as NumstatEntry, P as PROVIDER_REGISTRY, J as ProviderConstructionContext, K as ProviderRegistration, O as RecordingCodec, Q as RecordingContentType, S as RecordingError, T as RecordingProcess, U as RecordingUnavailableError, V as ResolvedActiveBackend, W as RoutableBackendSession, X as RoutableSandbox, Y as RoutingSandboxSession, Z as RoutingSandboxSessionDeps, _ as RoutingTransitionEvent, $ as RoutingUnsupportedError, a0 as SELFHOSTED_DEFAULT_TIMEOUT_MS, a1 as SELFHOSTED_RECONNECT_WINDOW_MS, a2 as SELFHOSTED_RELAY_STREAM_PATH, a3 as STREAM_PORT, a4 as STREAM_TOKEN_DEFAULT_TTL_SECONDS, a5 as SandboxChannelAService, a6 as SandboxChannelAServiceOptions, a7 as SandboxConfigError, a8 as SandboxCreatedCallback, a9 as SandboxProviderUnavailableError, aa as SelfhostedApplyDiff, ab as SelfhostedControlError, ac as SelfhostedEditor, ad as SelfhostedEnrollment, ae as SelfhostedExecArgs, af as SelfhostedExecResult, ag as SelfhostedImageOutput, ah as SelfhostedLivenessState, ai as SelfhostedNegotiationInput, aj as SelfhostedRelayConfig, ak as SelfhostedSandboxClient, al as SelfhostedSession, am as SelfhostedSessionBuild, an as SelfhostedSessionDeps, ao as SelfhostedSessionState, ap as SelfhostedUnavailableReason, aq as StartRecordingInput, ar as StreamPortUnavailableError, as as TERMINAL_SERVER_TIMEOUT_MS, at as TerminalServerError, au as TerminalServerUnsupportedError, av as agentErrorToControlError, aw as assertDescriptorRegistryInvariants, ax as assertProviderRegistryInvariants, ay as assertSafeRelPath, az as backendSupportsOs, aA as buildDisplayStackScript, aB as buildSelfhostedBackendSession, aC as buildStreamUrl, aD as buildTerminalServerScript, aE as contentTypeForCodec, aF as createSandboxClient, aG as createSandboxClientForBackend, aH as decodeModalSnapshotId, aI as deletePriorPersistedSnapshot, aJ as deleteRecordingArtifacts, aK as deserializeSandboxSessionStateEnvelope, aL as desktopCapableBackend, aM as ensureDisplayStack, aN as ensureModalRegistryImage, aO as ensureTerminalServer, aP as establishSandboxSessionFromEnvelope, aQ as exposeStreamPort, aR as extForCodec, aS as isExecSessionLostBanner, aT as isProviderSandboxNotFoundError, aU as isSelfhostedProviderNotFoundError, aV as isWorkspaceEscapeError, aW as makeActiveBackendResolver, aX as mintStreamToken, aY as modalSandboxAttributionEnvironment, aZ as modalSandboxAttributionTags, a_ as negotiateCapabilities, a$ as negotiateSelfhostedCapabilities, b0 as offlineAgentError, b1 as offlineControlResponse, b2 as parseExecBannerSessionId, b3 as parseNumstatZ, b4 as parsePorcelainV2, b5 as parseUnifiedPatch, b6 as readRecordingBytes, b7 as readWorkspaceArchiveFromEnvelopeSessionState, b8 as recordingStorageKey, b9 as restoredSandboxSessionStateFromEntry, ba as sandboxStateEntryFromRunState, bb as selectBackend, bc as selfhostedLiveness, bd as serializeEstablishedSandboxEnvelope, be as setSelfhostedApplyDiff, bf as startRecording, bg as stopRecording, bh as stripExecBanner, bi as subjectFor, bj as sweepModalOrphanSandboxes, bk as tagModalSandbox, bl as tearDownDisplayStack, bm as tearDownTerminalServer, bn as terminateModalSandboxById, bo as timeoutAgentError, bp as timeoutControlResponse, bq as verifyStreamToken } from '../index-BTo_bZvN.js';
 import 'modal';
 import '@opengeni/agent-proto';

package/dist/sandbox/index.js

@@ -53,6 +53,7 @@ import {
   deserializeSandboxSessionStateEnvelope,
   desktopCapableBackend,
   ensureDisplayStack,
+  ensureModalRegistryImage,
   ensureTerminalServer,
   establishSandboxSessionFromEnvelope,
   exposeStreamPort,
@@ -95,7 +96,7 @@ import {
   timeoutAgentError,
   timeoutControlResponse,
   verifyStreamToken
-} from "../chunk-Q36E4MDM.js";
+} from "../chunk-DYBF7ZEB.js";
 export {
   ActiveBackendUnresolvableError,
   CAPABILITY_DESCRIPTORS,
@@ -151,6 +152,7 @@ export {
   deserializeSandboxSessionStateEnvelope,
   desktopCapableBackend,
   ensureDisplayStack,
+  ensureModalRegistryImage,
   ensureTerminalServer,
   establishSandboxSessionFromEnvelope,
   exposeStreamPort,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/runtime",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "type": "module",
   "license": "Apache-2.0",
   "main": "./dist/index.js",
@@ -31,7 +31,7 @@
   },
   "dependencies": {
     "@opengeni/agent-proto": "^0.2.1",
-    "@opengeni/config": "^0.3.0",
+    "@opengeni/config": "^0.4.0",
     "@opengeni/contracts": "^0.9.0",
     "@openai/agents": "^0.11.6",
     "@openai/agents-extensions": "^0.11.6",

package/src/image-history.ts

@@ -1,4 +1,5 @@
 import type { AgentInputItem } from "@openai/agents";
+import { SCREENSHOT_OMITTED_IMAGE_DATA_URL } from "./screenshot-omitted-card";
 
 export const SCREENSHOT_OMITTED_PLACEHOLDER =
   "[screenshot omitted: an older desktop frame — the full image remains in the session event log]";
@@ -59,7 +60,7 @@ function collectItemImageOccurrences(
     return;
   }
   if (item.type === "computer_call_result" || item.type === "computer_call_output") {
-    collectComputerOutputImages(item, path, placeholder, out);
+    collectComputerOutputImages(item, path, out);
     return;
   }
   if (item.type === "function_call_result" || item.type === "function_call_output") {
@@ -70,7 +71,6 @@ function collectItemImageOccurrences(
 function collectComputerOutputImages(
   item: Record<string, unknown>,
   path: PathSegment[],
-  placeholder: string,
   out: ImageOccurrence[],
 ): void {
   const output = item.output;
@@ -79,7 +79,7 @@ function collectComputerOutputImages(
   }
   for (const key of ["data", "image_url", "imageUrl"]) {
     if (isImageDataUrl(output[key])) {
-      out.push({ path: [...path, "output", key], replacement: placeholder });
+      out.push({ path: [...path, "output", key], replacement: SCREENSHOT_OMITTED_IMAGE_DATA_URL });
       return;
     }
   }

package/src/index.ts

@@ -180,6 +180,7 @@ export {
   elideStaleScreenshotImages,
   SCREENSHOT_OMITTED_PLACEHOLDER,
 } from "./image-history";
+export { SCREENSHOT_OMITTED_IMAGE_DATA_URL } from "./screenshot-omitted-card";
 export type { ElideStaleScreenshotsOptions, ElideStaleScreenshotsResult } from "./image-history";
 
 ensureReadableStreamFrom();

package/src/sandbox/index.ts

@@ -55,12 +55,14 @@ export {
   type ProviderConstructionContext,
 } from "./providers";
 export {
+  ensureModalRegistryImage,
   modalSandboxAttributionEnvironment,
   modalSandboxAttributionTags,
   sweepModalOrphanSandboxes,
   tagModalSandbox,
   terminateModalSandboxById,
   type LiveModalSandboxLeaseAttribution,
+  type ModalModuleLoader,
   type ModalOrphanSweepResult,
   type ModalSandboxAttribution,
 } from "./providers/modal";

package/src/sandbox/providers/modal.ts

@@ -87,8 +87,9 @@ export const modalProvider: ProviderRegistration = {
     if (settings.modalWorkspacePersistence) {
       options.workspacePersistence = settings.modalWorkspacePersistence;
     }
-    if (settings.modalImageRef) {
-      options.image = ModalImageSelector.fromTag(settings.modalImageRef);
+    const imageSelector = resolveModalImageSelector(settings);
+    if (imageSelector) {
+      options.image = imageSelector;
     }
     if (settings.modalTokenId) {
       options.tokenId = settings.modalTokenId;
@@ -106,6 +107,115 @@ export const modalProvider: ProviderRegistration = {
 type ModalModule = typeof import("modal");
 type ModalClientLike = InstanceType<ModalModule["ModalClient"]>;
 
+// --- Private-registry image resolution (OPENGENI_MODAL_IMAGE_REGISTRY_SECRET) ------
+//
+// The Agents-extension Modal backend resolves `modalImageRef` via
+// `Image.fromRegistry(tag)` with NO secret, so it can only pull PUBLIC images. To run
+// a PRIVATE image we resolve the named Modal Secret and pre-build the authenticated
+// `fromRegistry(tag, secret)` image ONCE per process, then hand the provider `build`
+// a `ModalImageSelector.fromImage(...)`. `build` is synchronous and modal is imported
+// lazily (never loaded for non-modal backends), so resolution can't happen inside
+// `build`; the worker awaits `ensureModalRegistryImage` at boot for global refs and
+// at turn time for pack-scoped refs, then `build` reads the settled result. Modal
+// images are lazy, workspace-scoped definitions, so an image built by this module's
+// client is usable by the ModalSandboxClient's own client.
+
+/** Loader seam so unit tests can inject a fake modal module. */
+export type ModalModuleLoader = () => Promise<Pick<ModalModule, "ModalClient">>;
+
+const defaultModalLoader: ModalModuleLoader = () => import("modal");
+
+/** Settled, synchronously-readable resolved images, keyed per config. */
+const resolvedRegistryImages = new Map<string, unknown>();
+/** In-flight resolutions, for cross-call de-duplication. */
+const inFlightRegistryImages = new Map<string, Promise<void>>();
+
+function registryImageCacheKey(settings: Settings): string {
+  return [
+    settings.modalImageRef ?? "",
+    settings.modalImageRegistrySecret ?? "",
+    settings.modalEnvironment ?? "",
+  ].join("|");
+}
+
+/**
+ * Resolve + cache the private-registry Modal image. No-op unless BOTH
+ * `modalImageRef` and `modalImageRegistrySecret` are set. Memoized per
+ * (imageRef, secret, environment) so it runs once per worker process. Awaited at
+ * worker boot for the deployment-global image and at turn time for pack-scoped
+ * images BEFORE the first sandbox using that ref is created; `build` then reads the
+ * resolved image and otherwise falls back to the public `fromTag` path.
+ */
+export async function ensureModalRegistryImage(
+  settings: Settings,
+  loadModal: ModalModuleLoader = defaultModalLoader,
+): Promise<void> {
+  if (!settings.modalImageRegistrySecret || !settings.modalImageRef) {
+    return;
+  }
+  const key = registryImageCacheKey(settings);
+  if (resolvedRegistryImages.has(key)) {
+    return;
+  }
+  let pending = inFlightRegistryImages.get(key);
+  if (!pending) {
+    pending = (async () => {
+      const modal = await loadModal();
+      const client = new modal.ModalClient(modalClientOptions(settings));
+      // Resolve the Secret via the AUTHENTICATED client (client.secrets.fromName),
+      // NOT the static `modal.Secret.fromName`, which resolves against
+      // `getDefaultClient()` — i.e. the standard MODAL_TOKEN_ID/MODAL_TOKEN_SECRET env
+      // or ~/.modal.toml — and so would throw "Profile is missing token_id" in any host
+      // that supplies the token only through OpenGeni settings (OPENGENI_MODAL_TOKEN_ID).
+      const secret = await client.secrets.fromName(
+        settings.modalImageRegistrySecret!,
+        settings.modalEnvironment ? { environment: settings.modalEnvironment } : undefined,
+      );
+      // fromRegistry is synchronous and returns a lazy image definition (built
+      // server-side at sandbox create); the resolved secretId travels with it.
+      const image = client.images.fromRegistry(settings.modalImageRef!, secret);
+      resolvedRegistryImages.set(key, image);
+    })().finally(() => {
+      inFlightRegistryImages.delete(key);
+    });
+    inFlightRegistryImages.set(key, pending);
+  }
+  await pending;
+}
+
+/** The resolved private-registry image for these settings, or undefined if none. */
+function cachedModalRegistryImage(settings: Settings): unknown | undefined {
+  if (!settings.modalImageRegistrySecret || !settings.modalImageRef) {
+    return undefined;
+  }
+  return resolvedRegistryImages.get(registryImageCacheKey(settings));
+}
+
+/**
+ * Choose the image selector for a Modal sandbox client from settings. Returns:
+ *  - `fromImage(resolved)` when a private-registry secret is configured AND the
+ *    image has been resolved (ensureModalRegistryImage ran before create);
+ *  - `fromTag(modalImageRef)` for the public path (no secret, or cold cache — the
+ *    resume/attach paths never pull an image so the tag branch is harmless there);
+ *  - `undefined` when no image ref is set (Modal uses its default image).
+ * Exported for unit tests.
+ */
+export function resolveModalImageSelector(settings: Settings): ModalImageSelector | undefined {
+  if (!settings.modalImageRef) {
+    return undefined;
+  }
+  const registryImage = cachedModalRegistryImage(settings);
+  return registryImage
+    ? ModalImageSelector.fromImage(registryImage as Parameters<typeof ModalImageSelector.fromImage>[0])
+    : ModalImageSelector.fromTag(settings.modalImageRef);
+}
+
+/** Test-only: clear the resolved/in-flight image caches. */
+export function __resetModalRegistryImageCacheForTest(): void {
+  resolvedRegistryImages.clear();
+  inFlightRegistryImages.clear();
+}
+
 function modalClientOptions(settings: Settings): ConstructorParameters<ModalModule["ModalClient"]>[0] {
   return {
     ...(settings.modalTokenId ? { tokenId: settings.modalTokenId } : {}),

package/src/screenshot-omitted-card.ts

@@ -0,0 +1,15 @@
+// The legible "screenshot omitted" card that image-history substitutes for an
+// ELIDED `computer_call_output` screenshot. The hosted computer tool requires
+// `computer_call_output.output.image_url` to remain a syntactically valid URL;
+// the text placeholder is valid for tool-result text paths but 400s this image
+// channel once older screenshots are elided.
+//
+// This is a valid 8-bit RGBA PNG (signature + chunk CRCs emitted by the
+// dependency-free generator) rendered from a fixed message:
+//   SCREENSHOT OMITTED
+//   EARLIER FRAME ELIDED
+//   TO SAVE CONTEXT.
+//
+// Regenerate with: `bun run scripts/gen-screenshot-omitted-card.mjs`
+export const SCREENSHOT_OMITTED_IMAGE_DATA_URL =
+  "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAgwAAAC0CAYAAAD4gHQ+AAAG2klEQVR42u3dMXLbMBCGUR/ChQuPT5KD+c5q1Ki2b+CMRlji38UrXpWYoUkA/AoM8vb17/sHAOAvbx4CACAYAADBAAAIBgBAMAAAggEAEAwAgGAAABAMAIBgAAAEAwAgGAAAwQAACAYAQDAAAIIBAEAwAACCAQAQDACAYAAABAMAIBgAAMEAAAiGco/77SVXXz/9fqvv/9nrvzoedr/ftPvfPX7S14fV7+fZn582f0+7vggQDIJBMAgGwSAYXF8wCAbBIBgEg2AQDK4vGASDYBAMgkEwCAbXFwznBUP1C0q/fvUHK+35rF7QT3+/u38+fX149YOyejxb/9yfYBAMgkEwCAbBYP1zf4JBMAgGwSAYBINgEAyiQDAIBsEgGASDYBAMgkEwCIbc51P954JBMCSPP+ufYBAMJoxgEAyCQTBY/9yfYBAMgkEwCAbBIBgEA4JBMAgGwSAYBINgEAyzDm5K39SXdtDU7utXL8jdD86yIAqGk4Oh28FcCAbBIBgEg2AQDIJBMAgGwSAYBINgEAyCQTAIBsEgGASDYBAMgkEwzA+GaZsGLShrP9DT3p9gsOlUMNj0KBgEgwVFMAgGwWB+uz/BIBgEg2DwwRIM5rdgQDAIBsHggyUYBINgEAyCIeWDaEHpfbCUD5ZgEAyCAcEgGCwoPliCQTAIBsEgGASDCSsYBINgEAyCQTAIBhNWMAgGwWB+C4a5//nU6oM7qv+9qxe06vs/7fmkLTjV47/7gtjt/VbPr9MPbtq9PiAYBINgEAyCQTAIBhEgGASDYBAMgkEwCAbBIBgEg2AQDIJBMAgGwWDTIwAgGAAAwQAACAYAQDAAAAgGAEAwAACCAQAQDACAYAAABAMAIBgAAMEAACAYAADBAAAIBgBAMAAAggEAEAwAgGAAAASDhwAACAYAQDAAAIIBAEgIho/3z59Kj/ttqdX/XvX9P3v9bs8//frV47v786/+farH/+7xOW38GP/Wt78IBsEgGASDYBAMgkEwCAbBIBgEg2AQDIJBMAgGwSAYBINgEAyCQTBMDIa061dPqN0Tdvfzm35/xn/tB331398dkNPGT/f5nRZU6e9PMAgGwWD8CwbBIBgEg2AQDIJBMAgGwSAYBINgEAyCQTAIBsEgGASDYBAMgkEwnDz+q/9cMAgGwSAYBINgEAyCQTAIBsEgGASDYBAMgkEwCAbBIBgsmIJBMBj/gkEwCIazg8HBGrMnbLeDs04f/+kHB63+c+NHMCSNH8EgGASDYBAMgkEwCAbBIBhMWMEgGASDYBAMgkEwmLCCQTAIBsEgGASDTY9pm6pseuy9aXT687Gp2KZHwWDTo2AQDIJBMAgGwSAYBINgEAyCwYIvGASD9UcwCAbBIBgEg2AQDIJBMAiGvgPGpqO995e+aa3b8xEMxo9gEAyCQTAIBsEgGASDYBAMgkEwCAbBIBgEg/VHMAgGwSAYBINgEAyCQTA4uGndwS/dFrS0g6fSru8/n/JBT5pf09bP064//WBAwWBBEwyCQTAIBuuDYBAMgsGCIBgEg2CwPggGwSAYTFjBIBgEg2AQDIIBAJhIMAAAggEAEAwAgGAAAAQDACAYAADBAAAIBgAAwQAACAYAQDAAAIIBABAMAIBgAAAEAwAgGAAABAMAIBgAAMEAAAgGAEAwAACCAQAQDACAYFjvcb8ttfrfS3sh3Z7Pq8/zfz9/9fjxfme936uvb/wjGASDD4pg8H4Fg/GPYBAMgkEweL+CQTCAYBAMPiiCQTAIBh89em96rJ5w1T+/+/dPW/DTrt99fKd/0E+f36evXwgGweCDIhi8X8Fg/QLBIBgEg/crGKxfIBgEg2AQDIJBMIBgEAyCQTCkPP/d4yNtfl89ngUDgkEwCAbBIBgEg2BAMAgGwSAYBINgEAwIBsHggyIYBINgEAwIBsGQdLDP7oOz0g+uEQyCYef4SX//IBgEg2AQDIJBMIBgEAyCQTAIBsEgGBAMgkEwCAbBIBgEA4JBMHTaZGXTo2BYGag2Pdr0iGAQDIJBMAgGwSAYEAyCQTAIBsEgGAQDgkEwCAbBIBgEg2AAwSAYrno+1R8gwTArCP3nU1m/X/omYgSDYBAMgkEwCAbBgGAQDIJBMAgGwSAYEAwmnGAQDIJBMAgGBEO3BbX7wT7VBzd1XxCnHeS0+6Au4yf74DLBgGAQDIJBMAgGwSAYEAyCQTAIBsEgGAQDgkEwCAbBIBiMH8GAYAAAEAwAgGAAAAQDACAYAADBAAAIBgBAMAAAggEAQDAAAIIBABAMAIBgAAAEAwAgGAAAwQAACAYAAMEAAAgGAEAwAACCAQAQDACAYAAABAMAcLxffBoP915amCIAAAAASUVORK5CYII=";