܎jE!UddlmZddlZddlZddlZddlmZmZddlZddl m Z m Z ddl m Z ddlmZmZdd lmZd gZejeZd ed <d ZGdd ZdS)) annotationsN)CallableOptional) AccessTokenAccessTokenProvider)WorkloadIdentityError)ADVISORY_REFRESH_SECONDSMANDATORY_REFRESH_SECONDS)AnthropicError TokenCachezlogging.LoggerlogcNeZdZdZeeejddd ZddZddZ ddZ ddZ dS)ru2Thread-safe cache wrapping an :class:`AccessTokenProvider` with two-tier proactive refresh and single-flight semantics. Refresh policy on each :meth:`get_token` call: * No cached token → call provider (blocking), cache, return. * Cached with ``expires_at=None`` → return cached forever (never refresh). * More than ``advisory_refresh_seconds`` remaining → return cached. * Between ``mandatory_refresh_seconds`` and ``advisory_refresh_seconds`` remaining (advisory window) → try provider; on success swap cache; on failure log a warning and return the stale cached token. If another caller is already refreshing, the advisory caller just returns the cached token — no second refresh, no waiting. * Less than ``mandatory_refresh_seconds`` remaining or already expired (mandatory window) → call provider; on failure RAISE. Concurrent mandatory callers wait on a shared ``Event`` so exactly one provider call is in flight. The lock is released before the provider call so a 30-second HTTP POST doesn't serialize unrelated callers through a single thread. This matters under async: ``asyncify(get_token)`` runs on the thread pool, and holding the lock across the network call would pin an async worker for the whole exchange. )advisory_refresh_secondsmandatory_refresh_seconds time_sourceproviderrrintrrCallable[[], float]returnNonec||_||_||_||_t j|_d|_d|_d|_ d|_ dS)NFg) _provider _advisory _mandatory _time_source threadingLock_lock_cached_refresh_event _next_force_last_advisory_failure_time)selfrrrrs NC:\Projects\DSCons\.venv\Lib\site-packages\anthropic\lib\credentials\_cache.py__init__zTokenCache.__init__3s["13'^%% .2 :>!36(((forceboolrc ||S#t$r0}dt|vr|cYd}~Sd}~wwxYw)z@Invoke ``self._provider``, tolerating legacy zero-arg callables.) force_refreshr-N)r TypeErrorstr)r&r*errs r'_invoke_providerzTokenCache._invoke_providerLso $>>>66 6 $ $ $c#hh..>>## # # # # # #  $s A%A A Act|j5|j}dddn #1swxYwY ||}nS#t$rF}|jdkrt d|d}Yd}~nd}~wwxYw|j5d|_dddn #1swxYwY|S)zBCall the provider, retrying once on a 401 from the token endpoint.N)r*iz*Token provider returned 401; retrying onceTF)r!r$r1r status_coderdebug)r&r*resultr0s r'_call_providerzTokenCache._call_providerXsTZ % %$E % % % % % % % % % % % % % % % 7***77FF$ 7 7 7#%% IIB C C C***66FFFFFF  7 Z % %$D  % % % % % % % % % % % % % % % s3  ? B 11%| ( ( ( ( ( ( ( (!4?22 .:#)< ( ( ( ( ( ( ( (  ,,..1QQTttt#)<# ( ( ( ( ( ( ( ($-3),/ NN)&2>B>QLL+4/*;*;D'#'L7 ( ( ( ( ( ( ( ( ( ( ( ( ( ( (:'!!###  ++--    Z//#2H*.D'/////////////// +++ $0ZnV[VeEf5g5g0KKa) OO;?;L;L;N;N8OOOOOOOOOOOOOOO,2222222 " + +$ .&*# + + + + + + + + + + + + + + +''' LLNNN; sD-D+D+D:DDD2E HHE3' H3E7 7H:E7 ;A!HH6 HH H H HHHH)I  IIcb|j5d|_d|_ddddS#1swxYwYdS)zClear the cached token so the next :meth:`get_token` re-invokes the provider. Also sets a one-shot ``force_refresh`` flag so on-disk providers skip their freshness short-circuit instead of re-serving the revoked token. NT)r!r"r$)r&s r' invalidatezTokenCache.invalidates Z $ $DL#D  $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $s $((N) rrrrrrrrrr)r*r+rr)rr)rr/)rr) __name__ __module__ __qualname____doc__r r timer(r1r6rJrLr)r'rrs:)A)B+/9 6666662 $ $ $ $"FFFFP$$$$$$r)) __future__rrQloggingrtypingrrr@_typesrr _workloadr _constantsr r _exceptionsr __all__ getLoggerrMr__annotations__r:rrRr)r'r]s""""""" %%%%%%%% 44444444,,,,,,KKKKKKKK)))))) .'g'111111 $% `$`$`$`$`$`$`$`$`$`$r)