܎jMUddlmZddlZddlZddlZddlZddlZddlZddlZddl Z ddl m Z m Z m Z mZmZmZddlmZddlZddlmZmZddlmZmZmZmZmZmZddlmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4d d l5m6Z6ej7e8Z9d e:d <e rdd l;mdZ?dZ@dZAdZBdZCd*dZDGdd ZEGd!d"ZFGd#d$ZGGd%d&ZHGd'd(eGZIdS)+) annotationsN) TYPE_CHECKINGAnyDictUnionOptionalcast)override) AccessTokenIdentityTokenProvider) SecretStr_unwrap_secret_strip_traceback_json_dumps_secrets_wrap_secret_fields_NonObjectPayloadError) ENV_SCOPE ENV_PROFILE ENV_BASE_URLENV_AUTH_TOKENENV_CONFIG_DIRTOKEN_ENDPOINTDEFAULT_BASE_URLENV_WORKSPACE_IDENV_ORGANIZATION_IDOAUTH_API_BETA_HEADERENV_FEDERATION_RULE_IDENV_SERVICE_ACCOUNT_IDTOKEN_EXCHANGE_TIMEOUTENV_IDENTITY_TOKEN_FILEGRANT_TYPE_REFRESH_TOKENMANDATORY_REFRESH_SECONDS _user_agent_require_https_active_profile_config_file_path_credentials_file_pathresolve_identity_token_path)AnthropicErrorzlogging.Loggerlog)WorkloadIdentityCredentials) StaticTokenEnvTokenCredentialsFileInMemoryConfigIdentityTokenFilevaluersourceOptional[pathlib.Path]return Optional[int]c|dS t|S#ttf$r$}|d|nd}t|d|d|d}~wwxYw)z@Parse a credentials-file ``expires_at`` field into Unix seconds.Nzcredentials file at credentialsz has invalid 'expires_at' u; expected an integer Unix timestamp in seconds. The SDK does not parse ISO8601 — convert with int(datetime.timestamp()) before writing the file.)int TypeError ValueErrorr+)r3r4errwheres RC:\Projects\DSCons\.venv\Lib\site-packages\anthropic\lib\credentials\_providers.py_coerce_expires_atr@;s }t5zz z "393E/v///= G G G G G    sA AA  oauth_tokenz1.0oidc_federation user_oauthconfigDict[str, Any]authNonecdd}||d t||d t||d t|d }|tkr||d t ||dt ||dt|ds0tj t}|r d|d|d<dSdSdS|tkr||dtdSdS)uFill empty profile fields from corresponding ANTHROPIC_* env vars. The profile file is authoritative — this only fills fields the file left unset. Empty-string env values are treated as unset. targetrEkeystrenv_varr6rGc||s(tj|}|r |||<dSdSdSN)getosenviron)rIrJrLvs r?fillz$_fill_missing_from_env..fill^sPzz#  w''A s     base_urlorganization_id workspace_idtypefederation_rule_idservice_account_idscopeidentity_tokenfile)r4pathN)rIrErJrKrLrKr6rG) rrrrOAUTH_TYPE_OIDC_FEDERATIONrrrrPrQr!AUTH_TYPE_USER_OAUTH)rDrFrS auth_typerRs r?_fill_missing_from_envrbWsF     D\***D"$7888D!1222  I--- T')?@@@ T')?@@@ T7I&&&xx()) G 677A G4:A)F)F%&&& G G G G * * * T7I&&&&& + *rTc(eZdZdZddZdddd Zd S)r.zQAn :class:`AccessTokenProvider` that always returns a fixed token with no expiry.tokenrKr6rGc||_dSrN)_token)selfrds r?__init__zStaticToken.__init__ys  rTF force_refreshrjboolr c0~t|jdS)Nrd expires_at)r rf)rgrjs r?__call__zStaticToken.__call__|s >>>>rTN)rdrKr6rGrjrkr6r )__name__ __module__ __qualname____doc__rhrorTr?r.r.vsQ[[16????????rTr.c,eZdZdZefddZdddd Zd S)r/zQAn :class:`AccessTokenProvider` that reads ``ANTHROPIC_AUTH_TOKEN`` at call time.rLrKr6rGc||_dSrN)_env_var)rgrLs r?rhzEnvToken.__init__s  rTFrirjrkr c~tj|j}|t d|jdt |dS)NzEnvironment variable zN is not set. Set it or pass an explicit `credentials=` provider to the client.rm)rPrQrOrxr+r )rgrjr3s r?rozEnvToken.__call__sb  t}-- = U UUU 48888rTN)rLrKr6rGrp)rqrrrsrtrrhrorurTr?r/r/sY[[&4     1699999999rTr/ceZdZdZ d/ddd0d Zed1d Zed2dZed3dZd4dZ d5dZ d6dZ d7dZ d8dZ d8dZd9dZd:dZd:dZd;d Zd8d!Zd"d#dd+Zd"d#d=d,Zd?d.ZdS)@r0uAn :class:`AccessTokenProvider` backed by a named profile. A profile is a pair of files under the config directory (``~/.config/anthropic/`` by default; override with ``ANTHROPIC_CONFIG_DIR``): * ``configs/.json`` — non-secret. Holds the nested ``"authentication"`` object (discriminated by its ``"type"`` field), plus top-level ``organization_id``, ``workspace_id``, and ``base_url``. The ``authentication`` object may contain a ``credentials_path`` field overriding the credentials file location. * ``credentials/.json`` — secret (0600). Holds ``access_token``, ``expires_at``, and (for ``user_oauth`` with a ``client_id``) ``refresh_token``. The split keeps secret material out of files that may need to be readable by config-only consumers, and lets the SDK enforce 0600 on the credentials file without locking out config readers. Dispatches on the ``authentication.type`` discriminator: ``"oidc_federation"`` OIDC workload identity federation. Lazily constructs a :class:`WorkloadIdentityCredentials` delegate from the nested auth fields plus the top-level ``organization_id`` and calls it to perform the jwt-bearer exchange. ``"user_oauth"`` Output of an interactive PKCE login. If the auth block has a ``client_id``, performs ``refresh_token`` grants on expiry and writes the new tokens back to the credentials file (atomic replace, refresh-token rotation supported). Without a ``client_id``, the credentials file is treated as externally rotated — the SDK re-reads it on every invocation and returns whatever ``access_token`` is there, no refresh grant attempted. This is the pattern for a sidecar/daemon that mints the access token out-of-band. Args: profile: Profile name. ``None`` resolves via ``ANTHROPIC_PROFILE`` env → ``/active_config`` pointer file → ``"default"``. N) http_clientprofile Optional[str]r{Optional[httpx.Client]r6rGc||n t|_t|j|_d|_||_d|_d|_d|_t|_ d|_ dSrN) r&_profiler' _config_path_bound_base_url _http_client_owned_http_client_config_credentials_pathr _base_url_workload_delegate)rgr|r{s r?rhzCredentialsFile.__init__sj $+#6O26 9=.IMrTrKc|jSrN)rrgs r?r|zCredentialsFile.profiles }rT pathlib.Pathc|jSrN)rrs r? config_pathzCredentialsFile.config_paths   rTc|}|d}|r"t|dndS)uThe ``base_url`` declared in the profile config file, if any. Returns ``None`` when the config has no top-level ``base_url`` key — callers should fall back to their own default rather than the provider's bound/default value, so a profile that *doesn't* pin a host never overrides an explicit client setting. Loads the config on first access. rU/N) _load_configrOrKrstrip)rgrDraws r?resolved_base_urlz!CredentialsFile.resolved_base_urlsH""$$jj$$'*4s3xxs###4rTrUc|d}t||jd||_|j?||j|_t|j|jddSdS)a`Adopt the owning client's ``base_url`` as a fallback for the token exchange. Slots between the config file's own ``base_url`` field and the hard-coded default; a ``base_url`` in the config file still wins. Rebinding affects every client holding this instance; clients bind through :meth:`for_base_url` instead. r : base_urlfieldN)rr%rrr_resolve_base_urlr)rgrUbounds r? bind_base_urlzCredentialsFile.bind_base_urls$$ ut'8$D$D$DEEEE$ < #!33DLAADN 4>D4E1Q1Q1Q R R R R R R $ #rT'CredentialsFile'c|d}|j |j|kr|||S|}|ds0|dt kr|Stj|}||_ d|_ d|_ d|_ |||S)aReturn the provider a client with ``base_url`` should exchange through. Binds in place, unless another client already bound this instance to a different host (e.g. the parent of ``copy(base_url=...)``). That binding is left alone, and what happens depends on the profile: * pins its own ``base_url``: the bind is irrelevant, return ``self``. * ``oidc_federation``: return a copy bound to ``base_url``. It shares the identity token and http client, but not the on-disk token cache, whose tokens belong to the original deployment. * ``user_oauth``: return ``self``. The refresh token is tied to the deployment that issued it, so there is nothing per-host to copy. rNrUrX) rrrrrO _auth_blockr_copy_get_http_clientrrrr)rgrUrrDproviders r? for_base_urlzCredentialsFile.for_base_urls$$   '4+?5+H+H   u % % %K""$$ ::j ! ! T%5%5%7%7%;%;F%C%CG`%`%`K9T?? $ 5 5 7 7&*#&*#%)"u%%%rTrDrEc|dr(t|ddS|j|jStS)u+base_url precedence: top-level config field → bound (the owning client's base_url, via :meth:`bind_base_url`) → default. Validated against the scheme/TLS rules so a malicious config with ``base_url="http://evil/"`` can't exfiltrate the assertion or refresh token.rUr)rOrKrrrrgrDs r?rz!CredentialsFile._resolve_base_urlsQ ::j ! ! 7vj)**11#66 6   +' 'rTDict[str, str]c|}i}|dtkr)|d}|rt ||d<|S)zReturn headers derived from the config file (e.g. ``workspace_id``). Eagerly reads the config if not yet loaded. The returned dict is suitable for merging into the client's default headers. rXrWzanthropic-workspace-id)rrrOr_rK)rgrDheadersrWs r? extra_headerszCredentialsFile.extra_headersst ""$$"$      ! !& ) )-F F F!::n55L F47 4E4E01rTc |j|jS |jd}nr#t$r6}t d|jd|jdt dtd |d}~wttf$r }t d |jd ||d}~wwxYw tj |}n2#tj $r }t d |jd ||d}~wwxYwt|ts-t d |jd t|jd t#d|}|d}t|ts(t d |jdt&dt(dt#d|}t+|||||_t1|j|jd|d}|r9t3jt7||_nt=|j|_||_|S)zPRead and cache the config file, resolving ``base_url`` and ``credentials_path``.Nutf-8encodingzConfig file not found at (profile z). Set z' to select a different profile, or set z" to relocate the config directory.zConfig file at  could not be read:  is not valid JSON: ! must contain a JSON object, not .rEauthenticationzV is missing the 'authentication' object. Expected shape: {"authentication": {"type": ""|" ", ...}, ...}rrcredentials_path)rr read_textFileNotFoundErrorr+rrrOSErrorUnicodeDecodeErrorjsonloadsJSONDecodeError isinstancedictrXrqr rOr_r`rbrrr%pathlibPathrK expanduserrr()rgrr= raw_configrDraw_authrFr s r?rzCredentialsFile._load_config2s < #<  j#--w-??CC     5D,=5555"55KY555   +, j j j !_43D!_!_Z]!_!_``fi i j j"jooJJ# j j j !_43D!_!_Z]!_!_``fi i j*d++  r$"3rrVZ[eVfVfVorrr & 33::.//(D))  X$"3XX-XX2FXXX  $h// vt,,,//77t~0A-M-M-MNNNN88.//  K%,\#h--%@%@%K%K%M%MD " "%;DM%J%JD "  s8, B1A''B;BBB44C#CC#c |jJ|j}tjdkr tj|d}nQ#t$r!}t d|d|jd|d}~wt$r}t d|d ||d}~wwxYwtj|j rt d|d tj |j }|d zrt d|d |d d|d|dzrt d||| ttj|d}n#t$r!}t d|d|jd|d}~wtj$r(}t d|d|t%|d}~wt&$r!}t d|d|jddd}~wtt*f$r}t d|d||d}~wwxYw|d}|Q|t.krF|jJ|jdd}t d|dt.d||S)uRead the credentials file. Re-reads on every call — daemons rotate it. Secret values in the returned dict (every string field not in ``_secrets._PLAIN_KEYS``) are :class:`SecretStr`-wrapped — unwrap with ``_unwrap_secret`` at the point of use. Writing the dict back through :meth:`_atomic_write_credentials` unwraps automatically. On Unix, verifies the file is not group/world-readable. World-readable credentials files are refused outright; group-readable files log a warning but are accepted. The check is skipped on Windows where POSIX mode bits don't carry the same meaning. NposixF)follow_symlinkszCredentials file not found at r).Credentials file at z could not be accessed: zu is a symlink; refusing to follow (move the real file into place to keep secret material on the expected filesystem).z is world-readable (mode z#oz); run `chmod 600 z` before retrying.8zMCredentials file at %s is group-readable (mode %#o); consider `chmod 600 %s`.rrrrrrrXrzcredentials file has type z ; expected z for authentication.type )rrPnamestatrr+rrS_ISLNKst_modeS_IMODEr,warningrrrrrrr type_namerrOCREDENTIALS_FILE_TYPEr)rgr^ file_statr=modecredsactualras r?_read_credentialsz!CredentialsFile._read_credentialses%111% 7g   jGD%@@@ $ t t t$%id%i%iVZVc%i%i%ijjpss j j j$%_D%_%_Z]%_%_``fii j|I-.. $k4kkk< 122De| $?4??$V??&*???e|  c   b %8 4>>[b>CcCc8d8d$e$eEE  p p p !e$!e!eRVR_!e!e!efflo o# t t t !W!W!WRU!W!WXX^nor^s^s s%   !^t^^cm^^^ +, b b b !W!W!WRU!W!WXX^a a b 6""  &,A"A"A<+++ %56::6BBI 9V99BW99+499  s]9 BA B,BB5E G:E--G:?#F"" G:/G  G:G55G: httpx.Clientcx|j|jS|jtjt|_|jS)zFReturn an ``httpx.Client``, lazily creating (and tracking) one we own.N)timeout)rrhttpxClientr rs r?rz CredentialsFile._get_http_clients<   ($ $  " *&+l;Q&R&R&RD #&&rTc|j |jd|_|j|jdSdS)z3Close the owned ``httpx.Client`` if we created one.N)rcloserrs r?rzCredentialsFile.closesT  " .  # ) ) + + +&*D #  " .  # ) ) + + + + + / .rTc"d|_d|_dS)aDrop the cached config so the next call re-reads it from disk. ``CredentialsFile`` caches the parsed config across calls to keep the hot path cheap; a daemon that rotates a profile in place (e.g. flips ``"type": "user_oauth"`` to ``"type": "oidc_federation"``) will not be picked up automatically. Callers that need to react to such changes can call ``reload()`` to force a fresh read on the next ``__call__``. N)rrrs r?reloadzCredentialsFile.reloads "&rTdatac0|jJ|jj}|dddtj|d|jjdd\}} t j|dt j|t|d t j |t j |n#t j |wxYwt j ||jn5#t$r( t j|n#t$rYnwxYwwxYw t j|t j} t j |t j |dS#t j |wxYw#t$rYdSwxYw) aiAtomic write to the credentials file (NOT the config file). ``data`` may hold :class:`SecretStr` token values (see :meth:`_read_credentials`); they are unwrapped at dump time, so the on-disk format is unchanged and this frame's locals stay redacted if the write fails (e.g. ENOSPC) with a crash reporter capturing them. NTi)parentsexist_okrrz.tmp)dirprefixsuffixi)indent)rparentmkdirtempfilemkstemprrPfchmodwriterfsyncrreplace BaseExceptionunlinkropenO_RDONLY)rgrrfdtmpdir_fds r?_atomic_write_credentialsz)CredentialsFile._atomic_write_credentialss%111'. TDu === "v6X$:P:U6X6X6XaghhhC   "e$$$0a@@@AAA   JsD2 3 3 3 3     #        WVR[11F !                DD smA B:%C.:CC.. D 9D D  DD DD $FE.F.FF FFcV|}td|dS)zEReturn the cached ``authentication`` sub-object from the config file.rEr)rr rs r?rzCredentialsFile._auth_blocks*""$$$f-=&>???rTFrirjrkr c 2|}|d}|tkr|||S|tkr|||St d|d|jdtdtd )NrXriUnknown authentication.type  at . Expected  or r)rrOr__call_oidc_federationr`_call_user_oauthr+r)rgrjrFras r?rozCredentialsFile.__call__s!!HHV$$ 1 1 1--d--PP P , , ,((](KK K S9 S SD3>33,D11$6 '<"--- 0DD ) ) )''KcKK#C(( ) )  s " " ' '=X Y Y Y Y &9$))++&F&FGG ) ) )('_4K[___ ,&;t,,$C((  ) &   ('vcmvvdN^vvv ,&;t,,   [[00  ^''(\]] ] \488 ^,,JJ:&   ''::::   TY[[))J6kk/22Cm 3i-f *n,l!,o &&u--- !;!;WWWWsUAF--G<GG9!H J%3I J%.JJK$$L 5LL Optional[Dict[str, Any]]c|jJ|jsdS |S#t$r&}t |jt rYd}~dSd}~wwxYw)u``_read_credentials`` variant that returns ``None`` on absence instead of raising — used by the federation disk-cache path where a missing credentials file just means "exchange now". N)rexistsrr+r __cause__r)rgr=s r?_read_credentials_if_existsz+CredentialsFile._read_credentials_if_exists{s %111%,,.. 4 ))++ +   #-):;; ttttt  s: A*A%$A%%A*c|j|||_|j|S|}|s||d}|d} |rf|dt jt |tz kr8ttt|t|Sn#ttf$rYnwxYw|} |i|pitt t#|j|jdn2#t($r%}t*d|Yd}~nd}~wwxYw|S)Nrrnrm)rrXrrnz?federation token disk-cache write-back failed (best-effort): %s)r_build_workload_delegaterr rOrfloatr#r rKrr:r;r<rrrrrdrnrr,debug)rgrFrjcachedrrnrdr=s r?rz%CredentialsFile._call_oidc_federations  " *&*&C&CD&I&ID #  ! )**,, ,1133 !3!::n55LL11J  l". eJ&7&7:S&SSS&S 1M1M-N-N[^_i[j[jkkkkz*    '')) ^  * *|71%.ek$:$:"'"2     ^ ^ ^ IIWY\ ] ] ] ] ] ] ] ] ^ s,A'C))C=<C=AE F!FFr-c ddlm}m}|d}|jJ|jd}|r|s|dt d|j|d}|i|d}|d krtd |d |d }|s#td |jd|jd|dnd}|rt|n t} || |||d|jd|d| } | |j | S)Nr rr-rYrVz%config file with authentication.type zS must include 'authentication.federation_rule_id' and top-level 'organization_id': r\r4r]zidentity_token source z- is not supported; only 'file' is implementedr^z@identity_token source 'file' requires a non-empty path; profile rz has identity_token=rrZrWr[identity_token_providerrYrVrZrWr[r{) rrr-rOrr_rr+rr2rrr) rgrFrr-rYrVidentity_token_cfgr4identity_token_pathrdelegates r?r"z(CredentialsFile._build_workload_delegates RQQQQQQQ!XX&:;;|''',**+<==!  '''8Q''$'' "XX&677  )'++H55F$%uf%u%u%uvvv"4"8"8"@"@ &  %s#}ss484Ess[msss #' =Pi$%8999VgViVi /.$,1+#xx(<==)).99((7##--//    t~...rTrN)r|r}r{r~r6rGr6rKr6r)r6r})rUrKr6rG)rUrKr6r)rDrEr6rK)r6rr6rE)r6rr6rG)rrEr6rGrp)rFrErjrkr6r )r6rrFrEr6r-)rqrrrsrtrhpropertyr|rrrrrrrrrrrrrrorr rr"rurTr?r0r0sA''V"&N/3 NNNNNN&X!!!X! 5 5 5X 5SSSS":     &1111fFFFFP'''',,,, ' ' ' '((((X@@@@ 16       "OTlXlXlXlXlXlX`    TY......`333333rTr0c<eZdZdZd d dZedd Zdd ZdS)r2zAn :class:`IdentityTokenProvider` that reads a JWT from a file on every call. Kubernetes projected service-account tokens (and similar) are rotated in place, so the file MUST be re-read on every invocation rather than cached. Nr^$Union[str, 'os.PathLike[str]', None]r6rGcft|}|tdtd||_dS)Nz;No identity token file path given. Pass `path=` or set the z environment variable.)r)r+r!_path)rgr^resolveds r?rhzIdentityTokenFile.__init__sK.t44   )Ne)))  rTrc|jSrN)r6rs r?r^zIdentityTokenFile.paths zrTrKc |jd}n#t$r}t d|jd|d}~wt $r!}t d|jd|d|d}~wt $r}t d|jd |d}~wttf$r }t d|jd ||d}~wwxYw|st d|jd |S) Nrrz!Identity token file not found at rzIdentity token file at z" is not readable by this process: z;. Check the file mode and the effective uid of the process.zIdentity token path zF is a directory, not a file. Point at the projected token file itself.rz is empty. If this is a Kubernetes projected service-account token, check the volume mount and the serviceAccountToken projection audience.) r6rstriprr+PermissionErrorIsADirectoryErrorrr)rgr r=s r?rozIdentityTokenFile.__call__s kj**G*<<BBDDGG  ] ] ] !RTZ!R!R!RSSY\ \    M$*MMX[MMM !    =tz=== +, k k k !`4:!`!`[^!`!`aagj j k  Q$*QQQ  s8-0 CA C A<< C B""C6CCrN)r^r4r6rGr.r-)rqrrrsrtrhr2r^rorurTr?r2r2sk XrTr2ceZdZdZejdZddddd ZeddZ eddZ edfd Z xZ S)r1uAn :class:`AccessTokenProvider` driven by an in-memory config dict (same shape as ``configs/.json``) rather than files on disk. Intended for callers that want to construct an :class:`anthropic.Anthropic` client with a fully programmatic credentials setup — equivalent to the Go SDK's ``option.WithConfig`` / TypeScript SDK's ``ClientOptions.config``. Both ``authentication.type`` discriminator values are supported: ``"oidc_federation"`` ``authentication.credentials_path`` is **optional**. If set, exchanged tokens are cached to / read from that file (same atomic 0600 write as :class:`CredentialsFile`). If omitted, every call performs a fresh jwt-bearer exchange with no on-disk cache. ``"user_oauth"`` ``authentication.credentials_path`` is **required** — it is where the access/refresh tokens live. Behaviour is identical to a file-backed :class:`CredentialsFile` profile of the same shape. The implementation subclasses :class:`CredentialsFile` so the dispatch, refresh-grant, disk-cache and atomic-write logic are shared verbatim; only config loading and identity-token resolution are overridden. zN)r)r{rDrEr)Optional[IdentityTokenProvider]r{r~r6rGc |d}t|ts tdtdt dt d|}|d}|tt fvr#td|dtd t d |d }|t kr|std t d d|_|j|_ d|_ ||_ d|_ d|_ ||_||_|r3t!jt%|nd|_|||_t/|jddS)Nrzaconfig dict is missing the 'authentication' object. Expected shape: {"authentication": {"type": "rrrErXrrrrrzauthentication.type z requires 'authentication.credentials_path' (where the access/refresh tokens live). For profile-based resolution, use CredentialsFile instead.z zconfig: base_urlr)rOrrr+r_r`r r_IN_MEMORY_PATHrrrrr!_identity_token_provider_overriderrrrKrrrrr%)rgrDr)r{rrFrars r?rhzInMemoryConfig.__init__:s::.//(D))  ;B[;;);;;  $h//HHV$$ 68LM M M WyWW5WW=QWWW   88$677 , , ,5E , N';NNN &  0.2':>IM1H. Ue!oc2B.C.C!D!D!O!O!Q!Q!Qko//77t~-?@@@@@@rTc"|jJ|jSrN)rrs r?rzInMemoryConfig._load_configgs|'''|rTcd|_dSrN)rrs r?rzInMemoryConfig.reloadls#'rTrFr-c  |j!t|Sddlm}m}|d}|jJ|jd}|r|s|dtd||j|||d|jd|d | }| |j |S) Nr r'rYrVz%config dict with authentication.type zQ must include 'authentication.federation_rule_id' and top-level 'organization_id'rZrWr[r() rAsuperr"rrr-rOrr_rrr)rgrFrr-rYrVr, __class__s r?r"z'InMemoryConfig._build_workload_delegaters5  1 97733D99 9QQQQQQQQ!XX&:;;|''',**+<==!  ''W8QWWW /.$($J1+#xx(<==)).99((7##--//    t~...rT)rDrEr)r>r{r~r6rGr/r0r1) rqrrrsrtrrr@rhr rrr" __classcell__)rFs@r?r1r1s2#gl#788O DH.2 +A+A+A+A+A+AZX'''X' XrTr1)r3rr4r5r6r7)rDrErFrEr6rG)J __future__rrPrrrrloggingrrtypingrrrrrr typing_extensionsr r_typesr r _secretsrrrrrr _constantsrrrrrrrrrrrrr r!r"r#r$r%r&r'r(r) _exceptionsr+ getLoggerrqr,__annotations__rr-__all__r@rCONFIG_FILE_VERSIONrr_r`rbr.r/r0r2r1rurTr?rTs""""""" BBBBBBBBBBBBBBBB&&&&&& 666666660*)))))'g'1111117666666 _ _ _    "& .#''''>????????99999999"[ [ [ [ [ [ [ [ |++++++++\mmmmm_mmmmmrT