§
     �’jž>  ã                  óØ  — U d dl mZ d dlZd dlZd dlmZmZmZmZm	Z	m
Z
 d dlmZ d dlmZmZmZmZ d dlZddlmZ ddlmZmZ dd	lmZmZmZ dd
lmZ dZdZdZ dddœZ! G d„ de	¦  «        Z" G d„ de	¦  «        Z#e#Z$de%d<    G d„ de	¦  «        Z& ede#e&¦  «        Z'ddœd=d!„Z(	 d>d?d%„Z)	 d@dddd'd(dd)œdAd4„Z*	 dBd(dd6œdCd8„Z+ G d9„ d:ee'         ¦  «        Z, G d;„ d<e,e#         ¦  «        Z-dS )Dé    )ÚannotationsN)ÚAnyÚGenericÚTypeVarÚCallableÚ	TypedDictÚcast)ÚPath)ÚLiteralÚ	TypeAliasÚNotRequiredÚoverrideé   )Úis_dict)ÚDefaultHttpx2ClientÚ_loaded_legacy_httpx)Ú
OAuthErrorÚOpenAIErrorÚSubjectTokenProviderError)Ú	to_threadz/urn:ietf:params:oauth:grant-type:token-exchangez#https://auth.openai.com/oauth/tokeni°  z$urn:ietf:params:oauth:token-type:jwtz)urn:ietf:params:oauth:token-type:id_token)ÚjwtÚidc                  ó$   — e Zd ZU ded<   ded<   dS )ÚSubjectTokenProviderzLiteral['jwt', 'id']Ú
token_typezCallable[[], str]Ú	get_tokenN)Ú__name__Ú
__module__Ú__qualname__Ú__annotations__© ó    úCC:\Projects\DSCons\.venv\Lib\site-packages\openai\auth\_workload.pyr   r      s*   € € € € € € Ø$Ð$Ð$Ñ$Ø Ð Ð Ñ Ð Ð r"   r   c                  óB   — e Zd ZU dZded<   	 ded<   	 ded<   	 ded<   d	S )
ÚWorkloadIdentityz(Identity provider resource id in WIFAPI.ÚstrÚidentity_provider_idÚservice_account_idr   ÚproviderúNotRequired[float]Úrefresh_buffer_secondsN©r   r   r   Ú__doc__r    r!   r"   r#   r%   r%      sQ   € € € € € € Ø2Ð2àÐÐÑàGØÐÐÑàEØ"Ð"Ð"Ñ"àØ.Ð.Ð.Ñ.Ð.Ð.r"   r%   r   ÚSubjectTokenWorkloadIdentityc                  ó<   — e Zd ZU dZded<   ded<   ded<   ded<   d	S )
ÚX509WorkloadIdentityzJAuthenticate with the client certificate configured on the HTTP transport.zLiteral['x509']Útyper&   r'   r(   r*   r+   Nr,   r!   r"   r#   r0   r0   1   sH   € € € € € € ØTÐTàÐÐÑØÐÐÑØÐÐÑØ.Ð.Ð.Ñ.Ð.Ð.r"   r0   Ú_WorkloadIdentityT)r+   r'   r&   r(   r+   úfloat | NoneÚreturnc                ó    — d| |dœ}|�||d<   |S )zHConfigure X.509 workload identity without handling certificate material.Úx509)r1   r'   r(   Nr+   r!   )r'   r(   r+   Úidentitys       r#   Úx509_workload_identityr8   =   s1   € ð Ø 4Ø0ð&ð &€Hð
 Ð)Ø-CˆÐ)Ñ*Ø€Or"   ú3/var/run/secrets/kubernetes.io/serviceaccount/tokenÚtoken_file_pathú
str | Pathc                ó   ‡ — dˆ fd„}d|dœS )aK  
    Get a subject token provider for Kubernetes clusters with Workload Identity configured.

    Cloud providers typically mount the subject token as a file in the container.

    Args:
        token_file_path: path to the mounted service account token file. Defaults to `/var/run/secrets/kubernetes.io/serviceaccount/token`.
    r4   r&   c                 ó$  •— 	 t          ‰d¦  «        5 } |                      ¦   «                              ¦   «         }|st          d‰› d�¦  «        ‚|cd d d ¦  «         S # 1 swxY w Y   d S # t          $ r}t          d‰› d|› �¦  «        |‚d }~ww xY w)NÚrzThe token file at z
 is empty.z!Failed to read the token file at z: )ÚopenÚreadÚstripr   Ú	Exception)ÚfÚtokenÚer:   s      €r#   r   z5k8s_service_account_token_provider.<locals>.get_tokenZ   s   ø€ ð	oÝ�o sÑ+Ô+ð ¨qØŸš™œŸšÑ(Ô(�Øð fÝ3Ð4dÈÐ4dÐ4dÐ4dÑeÔeÐeØð	ð ð ð ñ ô ð ð ð ð ð ð øøøð ð ð ð ð ð øõ
 ð 	oð 	oð 	oÝ+Ð,fÐP_Ð,fÐ,fÐcdÐ,fÐ,fÑgÔgÐmnÐnøøøøð	oøøøs:   ƒA* “=AÁA* ÁA!Á!A* Á$A!Á%A* Á*
BÁ4B
Â
Br   ©r   r   ©r4   r&   r!   )r:   r   s   ` r#   Ú"k8s_service_account_token_providerrH   N   s7   ø€ ðoð oð oð oð oð oð  ¨iÐ8Ð8Ð8r"   úhttps://management.azure.com/z
2018-02-01ç      $@)Ú	object_idÚ	client_idÚ
msi_res_idÚapi_versionÚtimeoutÚhttp_clientÚresourcerK   ú
str | NonerL   rM   rN   rO   ÚfloatrP   úhttpx2.Client | Nonec               ó2   ‡ ‡‡‡‡‡‡— dˆˆˆˆˆˆ ˆfd„}d|dœS )a�  
    Get a subject token provider for Azure Managed Identities.

    See: https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/how-to-use-vm-token#get-a-token-using-http

    Args:
        resource: the resource URI to request a token for. Defaults to `https://management.azure.com/` (Azure Resource Manager).
        object_id: the object ID of the managed identity to use, when multiple are assigned.
        client_id: the client ID of the managed identity to use, when multiple are assigned.
        msi_res_id: the ARM resource ID of the managed identity to use, when multiple are assigned.
        api_version: the Azure IMDS API version. Defaults to `2018-02-01`.
        timeout: the request timeout in seconds. Defaults to 10.0.
        http_client: optional httpx2.Client instance to use for requests. If not provided, a new client will be created for each request.
    r4   r&   c                 ó2  •— 	 d} ‰‰dœ}‰�‰|d<   ‰�‰|d<   ‰
�‰
|d<   ‰	�‰	                      | |ddi‰¬¦  «        }nFt          j        ¦   «         5 }|                      | |ddi‰¬¦  «        }d d d ¦  «         n# 1 swxY w Y   |j        rt	          d	|j        › �|¬
¦  «        ‚|                     ¦   «         }|                      d¦  «        }|st	          d|¬
¦  «        ‚t          t          |¦  «        S # t          $ r}t	          d|› �¦  «        |‚d }~ww xY w)Nz5http://169.254.169.254/metadata/identity/oauth2/token)zapi-versionrQ   rK   rL   rM   ÚMetadataÚtrue©ÚparamsÚheadersrO   z4Failed to fetch Azure subject token from IMDS: HTTP ©ÚresponseÚaccess_tokenz3Azure IMDS response did not include an access_tokenz/Failed to fetch Azure subject token from IMDS: )
ÚgetÚhttpx2ÚClientÚis_errorr   Ústatus_codeÚjsonr	   r&   rB   )ÚurlrZ   r]   ÚclientÚdatarD   rE   rN   rL   rP   rM   rK   rQ   rO   s          €€€€€€€r#   r   z8azure_managed_identity_token_provider.<locals>.get_token€   sË  ø€ ð	jØIˆCØ5@ÈhÐ%WÐ%WˆFØÐ$Ø&/��{Ñ#ØÐ$Ø&/��{Ñ#ØÐ%Ø'1��|Ñ$àÐ&Ø&Ÿ?š?¨3°vÈ
ÐTZÐG[Ðel˜?ÑmÔm��å”]‘_”_ð m¨Ø%Ÿzšz¨#°fÀzÐSYÐFZÐdk˜zÑlÔl�Hðmð mð mñ mô mð mð mð mð mð mð møøøð mð mð mð mð Ô ð Ý/ØaÈ8ÔK_ÐaÐaØ%ðñ ô ð ð —=’=‘?”?ˆDØ—H’H˜^Ñ,Ô,ˆEØð Ý/ØIÐT\ðñ ô ð õ �˜UÑ#Ô#Ð#øÝð 	jð 	jð 	jÝ+Ð,aÐ^_Ð,aÐ,aÑbÔbÐhiÐiøøøøð	jøøøs=   ƒAC4 ÁA8Á,C4 Á8A<Á<C4 Á?A<Â A3C4 Ã4
DÃ>DÄDr   rF   rG   r!   )rQ   rK   rL   rM   rN   rO   rP   r   s   ``````` r#   Ú%azure_managed_identity_token_providerrh   g   sb   øøøøøøø€ ð2jð jð jð jð jð jð jð jð jð jð jð jð@  ¨iÐ8Ð8Ð8r"   úhttps://api.openai.com/v1)rO   rP   Úaudiencec               ó"   ‡ ‡‡— dˆ ˆˆfd„}d|dœS )a6  
    Get a subject token provider for GCP VM instances using the instance metadata server.

    See: https://cloud.google.com/compute/docs/instances/verifying-instance-identity

    Args:
        audience: the unique URI agreed upon by both the instance and the system verifying
            the instance's identity. Defaults to `https://api.openai.com/v1`.
        timeout: the request timeout in seconds. Defaults to 10.0.
        http_client: optional httpx2.Client instance to use for requests. If not provided, a new client will be created for each request.
    r4   r&   c                 óÀ  •— 	 d} d‰i}‰�‰                      | |ddi‰¬¦  «        }nFt          j        ¦   «         5 }|                      | |ddi‰¬¦  «        }d d d ¦  «         n# 1 swxY w Y   |j        rt	          d|j        › �|¬¦  «        ‚|j                             ¦   «         }|st	          d|¬¦  «        ‚|S # t          $ r}t	          d	|› �¦  «        |‚d }~ww xY w)
Nz]http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identityrj   zMetadata-FlavorÚGooglerY   z=Failed to fetch GCP subject token from metadata server: HTTP r\   z+GCP metadata server returned an empty tokenz8Failed to fetch GCP subject token from metadata server: )	r_   r`   ra   rb   r   rc   ÚtextrA   rB   )	re   rZ   r]   rf   rD   rE   rj   rP   rO   s	         €€€r#   r   z(gcp_id_token_provider.<locals>.get_tokenµ   s|  ø€ ð	sØqˆCØ  (Ð+ˆFàÐ&Ø&Ÿ?š?¨3°vÐHYÐ[cÐGdÐnu˜?ÑvÔv��å”]‘_”_ð v¨Ø%Ÿzšz¨#°fÐGXÐZbÐFcÐmt˜zÑuÔu�Hðvð vð vñ vô vð vð vð vð vð vð vøøøð vð vð vð vð Ô ð Ý/ØjÐT\ÔThÐjÐjØ%ðñ ô ð ð ”M×'Ò'Ñ)Ô)ˆEØð rÝ/Ð0]ÐhpÐqÑqÔqÐqØˆLøÝð 	sð 	sð 	sÝ+Ð,jÐghÐ,jÐ,jÑkÔkÐqrÐrøøøøð	søøøs;   ƒ7B; ºA"ÁB; Á"A&Á&B; Á)A&Á*AB; Â;
CÃCÃCr   rF   rG   r!   )rj   rO   rP   r   s   ``` r#   Úgcp_id_token_providerro   £   sE   øøø€ ð$sð sð sð sð sð sð sð sð. ¨YÐ7Ð7Ð7r"   c                  ó�   — e Zd Zeddœd&d„Zd'd„Zd'd„Zd(d)d„Zd*d„Zd+d„Z	d,d„Z
d-d„Zd.d„Zd/d„Zd/d„Zd/d „Zd0d!„Zd1d$„Zd2d%„ZdS )3Ú_WorkloadIdentityAuthT©Útoken_exchange_urlÚ_use_httpx2Úworkload_identityr2   rs   r&   rt   Úboolr4   ÚNonec               óâ   — || _         || _        || _        d | _        d | _        d | _        d | _        d| _        t          j	        ¦   «         | _
        t          j        | j
        ¦  «        | _        d S ©NF)ru   rs   rt   Ú_follow_redirectsÚ_cached_tokenÚ"_cached_token_expires_at_monotonicÚ"_cached_token_refresh_at_monotonicÚ_refreshingÚ	threadingÚLockÚ_lockÚ	ConditionÚ
_condition)Úselfru   rs   rt   s       r#   Ú__init__z_WorkloadIdentityAuth.__init__Ð   sl   € ð 6GˆÔØ"4ˆÔØ&ˆÔØ.2ˆÔà)-ˆÔØ@DˆÔ/Ø@DˆÔ/Ø!&ˆÔÝ”^Ñ%Ô%ˆŒ
Ý#Ô-¨d¬jÑ9Ô9ˆŒˆˆr"   c                óè  — | j         5  | j        rH|                      ¦   «         r4| j                             ¦   «          | j        r|                      ¦   «         °4|                      ¦   «         s:|                      ¦   «         s&t          t          | j        ¦  «        cd d d ¦  «         S | j        rr| j        r | j                             ¦   «          | j        ° | j        }|                      ¦   «         rt          d¦  «        ‚t          t          |¦  «        cd d d ¦  «         S d| _        d d d ¦  «         n# 1 swxY w Y   	 |  
                    ¦   «          | j         5  |                      ¦   «         rt          d¦  «        ‚t          t          | j        ¦  «        cd d d ¦  «         | j         5  d| _        | j                             ¦   «          d d d ¦  «         S # 1 swxY w Y   S # 1 swxY w Y   	 | j         5  d| _        | j                             ¦   «          d d d ¦  «         d S # 1 swxY w Y   d S # | j         5  d| _        | j                             ¦   «          d d d ¦  «         w # 1 swxY w Y   w xY w)Nz)Token is unusable after refresh completedTF)r�   r~   Ú_token_unusablerƒ   ÚwaitÚ_needs_refreshr	   r&   r{   ÚRuntimeErrorÚ_perform_refreshÚ
notify_all©r„   rD   s     r#   r   z_WorkloadIdentityAuth.get_tokenã   sî  € ØŒZð 	$ð 	$ØÔ"ð ' t×';Ò';Ñ'=Ô'=ð 'Ø”×$Ò$Ñ&Ô&Ð&ð Ô"ð ' t×';Ò';Ñ'=Ô'=ð 'ð ×'Ò'Ñ)Ô)ð 5°$×2EÒ2EÑ2GÔ2Gð 5Ý�C Ô!3Ñ4Ô4ð	$ð 	$ð 	$ð 	$ñ 	$ô 	$ð 	$ð 	$ð Ôð (ØÔ&ð +Ø”O×(Ò(Ñ*Ô*Ð*ð Ô&ð +àÔ*�Ø×'Ò'Ñ)Ô)ð TÝ&Ð'RÑSÔSÐSÝ�C Ñ'Ô'ð	$ð 	$ð 	$ð 	$ñ 	$ô 	$ð 	$ð 	$ð  $ˆDÔð	$ð 	$ð 	$ñ 	$ô 	$ð 	$ð 	$ð 	$ð 	$ð 	$ð 	$øøøð 	$ð 	$ð 	$ð 	$ð"		-Ø×!Ò!Ñ#Ô#Ð#Ø”ð 5ð 5Ø×'Ò'Ñ)Ô)ð TÝ&Ð'RÑSÔSÐSÝ�C Ô!3Ñ4Ô4ð5ð 5ð 5ð 5ñ 5ô 5ð 5ð
 ”ð -ð -Ø#(�Ô Ø”×*Ò*Ñ,Ô,Ð,ð-ð -ð -ñ -ô -ð -ð -ð -ð -ð -ð -øøøð -ð -ð -ð -ð -ð5ð 5ð 5ð 5øøøð 5ð 5ð 5ð 5ð 5ð
 ”ð -ð -Ø#(�Ô Ø”×*Ò*Ñ,Ô,Ð,ð-ð -ð -ñ -ô -ð -ð -ð -ð -ð -ð -ð -øøøð -ð -ð -ð -ð -ð -ø�”ð -ð -Ø#(�Ô Ø”×*Ò*Ñ,Ô,Ð,ð-ð -ð -ñ -ô -ð -ð -ð -ð -ð -ð -øøøð -ð -ð -ð -ð -øøøs—   ˆBD2Â&A,D2ÄD2Ä2D6Ä9D6Ä>H0 Å=G"ÆH0 Æ)!GÇG	ÇG	Ç"G&Ç&H0 Ç)G&Ç*H0 Ç5!H#È#H'È*H'È0I1È8!I%ÉI1É%I)É)I1É,I)É-I1c              ƒ  ó:   K  — t          | j        ¦  «        ƒ d {V —†S ©N)r   r   ©r„   s    r#   Úget_token_asyncz%_WorkloadIdentityAuth.get_token_async   s(   è è € Ý˜tœ~Ñ.Ô.Ð.Ð.Ð.Ð.Ð.Ð.Ð.r"   NrD   rR   c                ó¦   — | j         5  |�| j        |k    r	 d d d ¦  «         d S d | _        d | _        d | _        d d d ¦  «         d S # 1 swxY w Y   d S r�   )r�   r{   r|   r}   r�   s     r#   Úinvalidate_tokenz&_WorkloadIdentityAuth.invalidate_token  sÆ   € ØŒZð 	;ð 	;ØÐ  TÔ%7¸5Ò%@Ð%@Øð	;ð 	;ð 	;ñ 	;ô 	;ð 	;ð 	;ð 	;ð "&ˆDÔØ6:ˆDÔ3Ø6:ˆDÔ3ð	;ð 	;ð 	;ñ 	;ô 	;ð 	;ð 	;ð 	;ð 	;ð 	;ð 	;ð 	;øøøð 	;ð 	;ð 	;ð 	;ð 	;ð 	;s   ˆA¤AÁA
ÁA
c                óX   — |                       ¦   «         }|                      |¦  «         d S r�   )Ú_fetch_token_from_exchangeÚ_store_token)r„   Ú
token_datas     r#   r‹   z&_WorkloadIdentityAuth._perform_refresh  s-   € Ø×4Ò4Ñ6Ô6ˆ
Ø×Ò˜*Ñ%Ô%Ð%Ð%Ð%r"   r—   údict[str, Any]c                óä   — t          j        ¦   «         }|d         }| j        5  |d         | _        ||z   | _        ||                      |¦  «        z   | _        d d d ¦  «         d S # 1 swxY w Y   d S )NÚ
expires_inr^   )ÚtimeÚ	monotonicr�   r{   r|   Ú_refresh_delay_secondsr}   )r„   r—   Únowrš   s       r#   r–   z"_WorkloadIdentityAuth._store_token  sÏ   € ÝŒnÑÔˆØ Ô-ˆ
àŒZð 	dð 	dØ!+¨NÔ!;ˆDÔØ69¸JÑ6FˆDÔ3Ø69¸D×<WÒ<WÐXbÑ<cÔ<cÑ6cˆDÔ3ð	dð 	dð 	dñ 	dô 	dð 	dð 	dð 	dð 	dð 	dð 	dð 	døøøð 	dð 	dð 	dð 	dð 	dð 	ds   £5A%Á%A)Á,A)c                ó    — t          d¦  «        ‚)Nz>Workload identity authentication must implement token exchange)ÚNotImplementedErrorr�   s    r#   r•   z0_WorkloadIdentityAuth._fetch_token_from_exchange  s   € Ý!Ð"bÑcÔcÐcr"   r]   úhttpx2.Responsec                ó  — 	 |j         r|                     ¦   «         nd }n# t          $ r d }Y nw xY w|j        dv rt	          ||¬¦  «        ‚|j        r—|€t          d¦  «        ‚t          |¦  «        st          d¦  «        ‚|                     d¦  «        }|                     d¦  «        }t          |t          ¦  «        r|st          d¦  «        ‚||                      |¦  «        dœS t          d	|j        › �¦  «        ‚)
N)i�  i‘  i“  )r]   Úbodyz4Token exchange succeeded but response body was emptyz@Token exchange succeeded but response body was not a JSON objectr^   rš   z<Token exchange response did not include a valid access_token)r^   rš   z"Token exchange failed with status )Úcontentrd   Ú
ValueErrorrc   r   Ú
is_successr   r   r_   Ú
isinstancer&   Ú_validate_expires_in)r„   r]   r£   r^   rš   s        r#   Ú_handle_token_responsez,_WorkloadIdentityAuth._handle_token_response  s0  € ð	Ø&.Ô&6Ð@�8—=’=‘?”?�?¸DˆDˆDøÝð 	ð 	ð 	ØˆDˆDˆDð	øøøð Ô ?Ð2Ð2Ý h°TÐ:Ñ:Ô:Ð:àÔð 		gØˆ|Ý!Ð"XÑYÔYÐYÝ˜4‘=”=ð fÝ!Ð"dÑeÔeÐeØŸ8š8 NÑ3Ô3ˆLØŸš ,Ñ/Ô/ˆJÝ˜l­CÑ0Ô0ð b¸ð bÝ!Ð"`ÑaÔaÐaØ$0À×@YÒ@YÐZdÑ@eÔ@eÐfÐfÐfåØG°Ô1EÐGÐGñ
ô 
ð 	
s   ‚   /®/rš   ÚobjectrS   c                óv   — t          |t          t          f¦  «        st          d¦  «        ‚t          |¦  «        S )Nz:Token exchange response did not include a valid expires_in)r§   ÚintrS   r   )r„   rš   s     r#   r¨   z*_WorkloadIdentityAuth._validate_expires_in3  s6   € Ý˜*¥s­E lÑ3Ô3ð 	\ÝÐZÑ[Ô[Ð[Ý�ZÑ Ô Ð r"   c                ó<   — | j         d u p|                      ¦   «         S r�   )r{   Ú_token_expiredr�   s    r#   r‡   z%_WorkloadIdentityAuth._token_unusable8  s!   € ØÔ! TÐ)ÐB¨T×-@Ò-@Ñ-BÔ-BÐBr"   c                óL   — | j         €dS t          j        ¦   «         | j         k    S )NT)r|   r›   rœ   r�   s    r#   r®   z$_WorkloadIdentityAuth._token_expired;  s&   € ØÔ2Ð:Ø�4ÝŒ~ÑÔ 4Ô#JÒJÐJr"   c                óL   — | j         €dS t          j        ¦   «         | j         k    S ry   )r}   r›   rœ   r�   s    r#   r‰   z$_WorkloadIdentityAuth._needs_refresh@  s&   € ØÔ2Ð:Ø�5ÝŒ~ÑÔ 4Ô#JÒJÐJr"   c                óŽ   — | j                              dt          ¦  «        }t          ||dz  ¦  «        }t	          ||z
  d¦  «        S )Nr+   r   g        )ru   r_   ÚDEFAULT_REFRESH_BUFFER_SECONDSÚminÚmax)r„   rš   Úconfigured_bufferÚeffective_buffers       r#   r�   z,_WorkloadIdentityAuth._refresh_delay_secondsE  sH   € Ø Ô2×6Ò6Ð7OÕQoÑpÔpÐÝÐ0°*¸q±.ÑAÔAÐÝ�:Ð 0Ñ0°#Ñ6Ô6Ð6r"   Úrequestúhttpx2.Requestc                ó   — ~dS )ú>Preserve the established subject-token request retry behavior.Tr!   ©r„   r·   s     r#   Ú_can_retry_requestz(_WorkloadIdentityAuth._can_retry_requestJ  s
   € àØˆtr"   c                ó   — ~dS )rº   Nr!   r»   s     r#   Ú_prepare_retry_requestz,_WorkloadIdentityAuth._prepare_retry_requestO  s	   € àˆGˆGr"   )ru   r2   rs   r&   rt   rv   r4   rw   rG   r�   )rD   rR   r4   rw   )r4   rw   )r—   r˜   r4   rw   ©r4   r˜   )r]   r¡   r4   r˜   )rš   rª   r4   rS   )r4   rv   )rš   rS   r4   rS   )r·   r¸   r4   rv   )r·   r¸   r4   rw   )r   r   r   ÚDEFAULT_TOKEN_EXCHANGE_URLr…   r   r‘   r“   r‹   r–   r•   r©   r¨   r‡   r®   r‰   r�   r¼   r¾   r!   r"   r#   rq   rq   Ï   sk  € € € € € ð
 #=Ø ð:ð :ð :ð :ð :ð :ð&-ð -ð -ð -ð:/ð /ð /ð /ð;ð ;ð ;ð ;ð ;ð&ð &ð &ð &ðdð dð dð dðdð dð dð dð
ð 
ð 
ð 
ð0!ð !ð !ð !ð
Cð Cð Cð CðKð Kð Kð Kð
Kð Kð Kð Kð
7ð 7ð 7ð 7ð
ð ð ð ð
ð ð ð ð ð r"   rq   c                  óH   ‡ — e Zd Zeddœdˆ fd„Zedd„¦   «         Zdd„Zˆ xZS )ÚWorkloadIdentityAuthTrr   ru   r%   rs   r&   rt   rv   r4   rw   c               óP   •— t          ¦   «                              |||¬¦  «         d S )N)ru   rs   rt   )Úsuperr…   )r„   ru   rs   rt   Ú	__class__s       €r#   r…   zWorkloadIdentityAuth.__init__U  s9   ø€ õ 	‰Œ×ÒØ/Ø1Ø#ð 	ñ 	
ô 	
ð 	
ð 	
ð 	
r"   r˜   c           
     ó^  — |                       ¦   «         }| j        d         d         }t                               |¦  «        }|€?t	          d|›dd                     t                               ¦   «         ¦  «        › �¦  «        ‚| j        st          ¦   «         nd }|�| 	                    ¦   «         nt          d¬¦  «        }|5 }|                     | j        t          ||| j        d         | j        d	         d
œd¬¦  «        }|                      |¦  «        cd d d ¦  «         S # 1 swxY w Y   d S )Nr)   r   zUnsupported token type: z. Supported types: z, F)Úfollow_redirectsr'   r(   )Ú
grant_typeÚsubject_tokenÚsubject_token_typer'   r(   rJ   )rd   rO   )Ú_get_subject_tokenru   ÚSUBJECT_TOKEN_TYPESr_   r   ÚjoinÚkeysrt   r   ra   r   Úpostrs   ÚTOKEN_EXCHANGE_GRANT_TYPEr©   )r„   rÉ   r   rÊ   Úlegacy_httpxÚexchange_clientrf   r]   s           r#   r•   z/WorkloadIdentityAuth._fetch_token_from_exchangeb  s�  € à×/Ò/Ñ1Ô1ˆØÔ+¨JÔ7¸ÔEˆ
Ý0×4Ò4°ZÑ@Ô@ÐØÐ%ÝØs¨:ÐsÐsÈDÏIÊIÕVi×VnÒVnÑVpÔVpÑLqÔLqÐsÐsñô ð ð 6:Ô5EÐOÕ+Ñ-Ô-Ð-È4ˆà%1Ð%=ˆL×ÒÑ!Ô!Ð!ÕCVÐhmÐCnÑCnÔCnð 	ð ð 	9 Ø—{’{ØÔ'å";Ø%2Ø*<Ø,0Ô,BÐCYÔ,ZØ*.Ô*@ÐAUÔ*Vðð ð ð #ñ 
ô 
ˆHð ×.Ò.¨xÑ8Ô8ð	9ð 	9ð 	9ð 	9ñ 	9ô 	9ð 	9ð 	9ð 	9ð 	9ð 	9ð 	9øøøð 	9ð 	9ð 	9ð 	9ð 	9ð 	9s   ÃAD"Ä"D&Ä)D&c                ób   — | j         d         } |d         ¦   «         }|st          d¦  «        ‚|S )Nr)   r   z>The workload identity provider returned an empty subject token)ru   r   )r„   r)   rÉ   s      r#   rË   z'WorkloadIdentityAuth._get_subject_token~  s?   € ØÔ)¨*Ô5ˆØ-˜ Ô-Ñ/Ô/ˆØð 	`ÝÐ^Ñ_Ô_Ð_ØÐr"   )ru   r%   rs   r&   rt   rv   r4   rw   r¿   rG   )	r   r   r   rÀ   r…   r   r•   rË   Ú__classcell__)rÅ   s   @r#   rÂ   rÂ   T  sƒ   ø€ € € € € ð
 #=Ø ð
ð 
ð 
ð 
ð 
ð 
ð 
ð 
ð ð9ð 9ð 9ñ „Xð9ð6ð ð ð ð ð ð ð r"   rÂ   )r'   r&   r(   r&   r+   r3   r4   r0   )r9   )r:   r;   r4   r   )rI   )rQ   r&   rK   rR   rL   rR   rM   rR   rN   r&   rO   rS   rP   rT   r4   r   )ri   )rj   r&   rO   rS   rP   rT   r4   r   ).Ú
__future__r   r›   r   Útypingr   r   r   r   r   r	   Úpathlibr
   Útyping_extensionsr   r   r   r   r`   Ú_utilsr   Ú_httpx2r   r   Ú_exceptionsr   r   r   Ú_utils._syncr   rÐ   rÀ   r²   rÌ   r   r%   r.   r    r0   r2   r8   rH   rh   ro   rq   rÂ   r!   r"   r#   ú<module>rÝ      sî  ðØ "Ð "Ð "Ð "Ð "Ð "Ð "à €€€Ø Ð Ð Ð Ø CÐ CÐ CÐ CÐ CÐ CÐ CÐ CÐ CÐ CÐ CÐ CÐ CÐ CÐ CÐ CØ Ð Ð Ð Ð Ð Ø GÐ GÐ GÐ GÐ GÐ GÐ GÐ GÐ GÐ GÐ GÐ Gà €€€à Ð Ð Ð Ð Ð Ø ?Ð ?Ð ?Ð ?Ð ?Ð ?Ð ?Ð ?Ø LÐ LÐ LÐ LÐ LÐ LÐ LÐ LÐ LÐ LØ $Ð $Ð $Ð $Ð $Ð $àMÐ ØBÐ Ø!%Ð ð 2Ø
5ðð Ð ð!ð !ð !ð !ð !˜9ñ !ô !ð !ð
/ð /ð /ð /ð /�yñ /ô /ð /ð +;Ð Ð :Ð :Ð :Ñ :ð/ð /ð /ð /ð /˜9ñ /ô /ð /ð �WÐ1Ð3CÐEYÑZÔZÐ ð ,0ð	ð ð ð ð ð ð$ #Xð9ð 9ð 9ð 9ð 9ð4 4ð99ð !Ø Ø!Ø#ØØ(,ð99ð 99ð 99ð 99ð 99ð 99ðz 0ð)8ð Ø(,ð	)8ð )8ð )8ð )8ð )8ð )8ðXBð Bð Bð Bð B˜GÐ$6Ô7ñ Bô Bð BðJ/ð /ð /ð /ð /Ð0Ð1AÔBñ /ô /ð /ð /ð /r"   