"j%SSKJr SSKrSSKrSSKrSSKrSSKrSSKrSSKrSSK r SSK J r J r J r JrJrJr SSKJr SSKrSSKJrJr SSKJrJrJrJrJrJr SSKJrJ r J!r!J"r"J#r#J$r$J%r%J&r&J'r'J(r(J)r)J*r*J+r+J,r,J-r-J.r.J/r/J0r0J1r1J2r2J3r3J4r4 S S K5J6r6J7r7J8r8 \Rr"\:5r;S \r> /SQr?SSjr@SrASrBSrCSrDSrES SjrF"SS5rG"SS5rH"SS5rI"SS5rJ"SS\I5rKg)!) annotationsN) TYPE_CHECKINGAnyDictUnionOptionalcast)override) AccessTokenIdentityTokenProvider) SecretStr_unwrap_secret_strip_traceback_json_dumps_secrets_wrap_secret_fields_NonObjectPayloadError) ENV_SCOPE ENV_PROFILE ENV_BASE_URLENV_AUTH_TOKENENV_CONFIG_DIRTOKEN_ENDPOINTDEFAULT_BASE_URLENV_WORKSPACE_IDENV_ORGANIZATION_IDOAUTH_API_BETA_HEADERENV_FEDERATION_RULE_IDENV_SERVICE_ACCOUNT_IDTOKEN_EXCHANGE_TIMEOUTENV_IDENTITY_TOKEN_FILEGRANT_TYPE_REFRESH_TOKENMANDATORY_REFRESH_SECONDS _user_agent_require_https_active_profile_config_file_path_credentials_file_pathresolve_identity_token_path)AnthropicErrorCredentialsErrorIdentityTokenFileErrorzlogging.Loggerlog)WorkloadIdentityCredentials) StaticTokenEnvTokenCredentialsFileInMemoryConfigIdentityTokenFilecUcg[U5$![[4a"nUbSU3OSn[USU<S35UeSnAff=f)z>Parse a credentials-file `expires_at` field into Unix seconds.Nzcredentials file at credentialsz has invalid 'expires_at' u; expected an integer Unix timestamp in seconds. The SDK does not parse ISO8601 — convert with int(datetime.timestamp()) before writing the file.)int TypeError ValueErrorr,)valuesourceerrwheres a/home/mande/repo/quber/.venv/lib/python3.13/site-packages/anthropic/lib/credentials/_providers.py_coerce_expires_atr?;sl }5z z "393E&vh/=g/y9F G   s A>A oauth_tokenz1.0oidc_federation user_oauthcS SjnU"US[5 U"US[5 U"US[5 URS5nU[:XauU"US[ 5 U"US[ 5 U"US[5 URS 5(d4[RR[5nU(a S US .US 'g g g U[:XaU"US[5 g g )uFill empty profile fields from corresponding ANTHROPIC_* env vars. The profile file is authoritative — this only fills fields the file left unset. Empty-string env values are treated as unset. cURU5(d,[RRU5nU(aX0U'gggN)getosenviron)targetkeyenv_varvs r>fill$_fill_missing_from_env..fill^s5zz# w'As base_urlorganization_id workspace_idtypefederation_rule_idservice_account_idscopeidentity_tokenfile)r;pathN)rIDict[str, Any]rJstrrKr[returnNone) rrrrFAUTH_TYPE_OIDC_FEDERATIONrrrrGrHr!AUTH_TYPE_USER_OAUTH)configauthrM auth_typerLs r>_fill_missing_from_envrcWs  \*"$78!12 I-- T')?@ T')?@ T7I&xx()) 67A4:A)F%&* * * T7I& +rOc4\rSrSrSrS SjrSS.S SjjrSrg) r0vzJAn `AccessTokenProvider` that always returns a fixed token with no expiry.cXlgrE_token)selftokens r>__init__StaticToken.__init__ys rOF force_refreshc,A[URSS9$)Nrj expires_at)r rh)rirns r>__call__StaticToken.__call__|s >>rOrgN)rjr[r\r]rnboolr\r )__name__ __module__ __qualname____firstlineno____doc__rkrr__static_attributes__rOr>r0r0vsT16??rOr0c:\rSrSrSr\4S SjjrSS.S SjjrSrg) r1zHAn `AccessTokenProvider` that reads `ANTHROPIC_AUTH_TOKEN` at call time.cXlgrE_env_var)rirKs r>rkEnvToken.__init__s rOFrmcA[RRUR5nUc[ SURS35e[ USS9$)NzEnvironment variable zN is not set. Set it or pass an explicit `credentials=` provider to the client.rp)rGrHrFrr,r )rirnr:s r>rrEnvToken.__call__sS  t}}- ="' 7TU 488rOrN)rKr[r\r]rt) rvrwrxryrzrrkrrr{r|rOr>r1r1sR&4 1699rOr1c.\rSrSrSrSSS.SSjjjr\SSj5r\SSj5r\S Sj5r S!S jr S"S jr S#S jr S$S jr S%S jrS%SjrS&SjrS'SjrS'SjrS(SjrS%SjrSS.S)SjjrSS.S*SjjrS+SjrSS.S*SjjrS,SjrSrg)-r2u'An `AccessTokenProvider` backed by a named profile. A profile is a pair of files under the config directory (`~/.config/anthropic/` by default; override with `ANTHROPIC_CONFIG_DIR`): * `configs/.json` — non-secret. Holds the nested `"authentication"` object (discriminated by its `"type"` field), plus top-level `organization_id`, `workspace_id`, and `base_url`. The `authentication` object may contain a `credentials_path` field overriding the credentials file location. * `credentials/.json` — secret (0600). Holds `access_token`, `expires_at`, and (for `user_oauth` with a `client_id`) `refresh_token`. The split keeps secret material out of files that may need to be readable by config-only consumers, and lets the SDK enforce 0600 on the credentials file without locking out config readers. Dispatches on the `authentication.type` discriminator: `"oidc_federation"` OIDC workload identity federation. Lazily constructs a `WorkloadIdentityCredentials` delegate from the nested auth fields plus the top-level `organization_id` and calls it to perform the jwt-bearer exchange. `"user_oauth"` Output of an interactive PKCE login. If the auth block has a `client_id`, performs `refresh_token` grants on expiry and writes the new tokens back to the credentials file (atomic replace, refresh-token rotation supported). Without a `client_id`, the credentials file is treated as externally rotated — the SDK re-reads it on every invocation and returns whatever `access_token` is there, no refresh grant attempted. This is the pattern for a sidecar/daemon that mints the access token out-of-band. Args: profile: Profile name. `None` resolves via `ANTHROPIC_PROFILE` env → `/active_config` pointer file → `"default"`. N) http_clientcUbUO [5Ul[UR5UlSUlX lSUlSUlSUl[Ul SUl grE) r&_profiler' _config_path_bound_base_url _http_client_owned_http_client_config_credentials_pathr _base_url_workload_delegate)riprofilers r>rkCredentialsFile.__init__s\ $+#6OrCredentialsFile.profiles }}rOcUR$rE)rrs r> config_pathCredentialsFile.config_paths   rOcUR5nURS5nU(a[U5RS5$S$)uSThe `base_url` declared in the profile config file, if any. Returns `None` when the config has no top-level `base_url` key — callers should fall back to their own default rather than the provider's bound/default value, so a profile that *doesn't* pin a host never overrides an explicit client setting. Loads the config on first access. rP/N) _load_configrFr[rstrip)rir`raws r>resolved_base_url!CredentialsFile.resolved_base_urls:""$jj$'*s3xs#44rOcURS5n[X RS3S9 X lURbBUR UR5Ul[UR URS3S9 gg)a,Adopt the owning client's `base_url` as a fallback for the token exchange. Slots between the config file's own `base_url` field and the hard-coded default; a `base_url` in the config file still wins. Rebinding affects every client holding this instance; clients bind through `for_base_url` instead. r : base_urlfieldN)rr%rrr_resolve_base_urlr)rirPbounds r> bind_base_urlCredentialsFile.bind_base_urlsq$ u'8'8&9$DE$ << #!33DLLADN 4>>D4E4E3Fj1Q R $rOcURS5nURbURU:XaURU5 U$UR5nUR S5(d'UR 5R S5[ :waU$[R"U5nUR5Ul SUl SUl SUl URU5 U$)aReturn the provider a client with `base_url` should exchange through. Binds in place, unless another client already bound this instance to a different host (e.g. the parent of `copy(base_url=...)`). That binding is left alone, and what happens depends on the profile: * pins its own `base_url`: the bind is irrelevant, return `self`. * `oidc_federation`: return a copy bound to `base_url`. It shares the identity token and http client, but not the on-disk token cache, whose tokens belong to the original deployment. * `user_oauth`: return `self`. The refresh token is tied to the deployment that issued it, so there is nothing per-host to copy. rNrPrS) rrrrrF _auth_blockr^copy_get_http_clientrrrr)rirPrr`providers r> for_base_urlCredentialsFile.for_base_urls$    '4+?+?5+H   u %K""$ ::j ! !T%5%5%7%;%;F%CG`%`K99T? $ 5 5 7&*#&*#%)"u%rOcURS5(a[US5RS5$URb UR$[$)ubase_url precedence: top-level config field → bound (the owning client's base_url, via `bind_base_url`) → default. Validated against the scheme/TLS rules so a malicious config with `base_url="http://evil/"` can't exfiltrate the assertion or refresh token.rPr)rFr[rrrrir`s r>r!CredentialsFile._resolve_base_urlsL ::j ! !vj)*11#6 6    +'' 'rOcUR5n0nUR5RS5[:wa&URS5nU(a[ U5US'U$)zReturn headers derived from the config file (e.g. `workspace_id`). Eagerly reads the config if not yet loaded. The returned dict is suitable for merging into the client's default headers. rSrRzanthropic-workspace-id)rrrFr^r[)rir`headersrRs r> extra_headersCredentialsFile.extra_headerss\ ""$"$     ! !& )-F F!::n5L47 4E01rOc URb UR$URRSS9n[R"U5n[U[5(d/[ S URS [U5R S 35e[#SU5nUR%S5n[U[5(d'[ S URS[&S[(S35e[#SU5n[+XF5 UR-U5Ul[1UR.URS3S9 UR%S5nU(a3[2R4"[7U55R95UlO[=UR 5UlX@lU$![a;n[ SURSUR <S[ S[S3 5UeSnAf[[4a!n[ S URS U35UeSnAff=f![Ra!n[ S URS U35UeSnAff=f)zLRead and cache the config file, resolving `base_url` and `credentials_path`.Nutf-8encodingzConfig file not found at (profile z). Set z' to select a different profile, or set z" to relocate the config directory.zConfig file at  could not be read:  is not valid JSON: ! must contain a JSON object, not .rZauthenticationzV is missing the 'authentication' object. Expected shape: {"authentication": {"type": ""|" ", ...}, ...}rrcredentials_path)rr read_textFileNotFoundErrorr,rrrOSErrorUnicodeDecodeErrorjsonloadsJSONDecodeError isinstancedictrSrvr rFr^r_rcrrr%pathlibPathr[ expanduserrr()rirr< raw_configr`raw_authrar s r>rCredentialsFile._load_config0sR << #<<  l##--w-?C l"jjoJ*d++"!$"3"3!44UVZ[eVfVoVoUppqr & 3::./(D))"!$"3"3!45-.c2F1GX  $h/ v,//7t~~0A0A/B*-MN88./ %,\\#h-%@%K%K%MD "%;DMM%JD "  U! "+D,=,=+>jHYZ"m#J>JZ[45   +, l"_T5F5F4GG[\_[`#abhk k l## l"_T5F5F4GG[\_[`#abhk k ls:F#H# H-6G##H6HHI.I  Ic URceURn[RS:Xa[R"USS9n[R"UR5(a[ SUS 35e[R"UR5nUS -(a[ SUS US SUS35e[[R"URSS955nUR)S5nUbRU[*:waHUR,ceUR,SR)S5n[ SU<S[*<SU<35eU$![a#n[ SUSUR <S35UeSnAf[an[ SUS U35UeSnAff=f![a#n[ SUSUR <S35UeSnAf[Ra n[ SUSU35[!U5eSnAf["a"n[ SUSUR$S35SeSnAf[[&4an[ SUSU35UeSnAff=f)uRead the credentials file. Re-reads on every call — daemons rotate it. Secret values in the returned dict (every string field not in `_secrets._PLAIN_KEYS`) are `SecretStr`-wrapped — unwrap with `_unwrap_secret` at the point of use. Writing the dict back through `_atomic_write_credentials` unwraps automatically. On Unix, refuses symlinks and any file readable or writable by group or others (`mode & 0o077`). The check is skipped on Windows where POSIX mode bits don't carry the same meaning. NposixF)follow_symlinkszCredentials file not found at r).Credentials file at z could not be accessed: zu is a symlink; refusing to follow (move the real file into place to keep secret material on the expected filesystem).?z( is accessible by group or others (mode z#oz); run `chmod 600 z` before retrying.rrrrrrrSrzcredentials file has type z ; expected z for authentication.type )rrGnamestatrr,rrS_ISLNKst_modeS_IMODErrrrrrr type_namerrFCREDENTIALS_FILE_TYPEr)rirY file_statr<modecredsactualrbs r>_read_credentials!CredentialsFile._read_credentialscs%%111%% 77g  lGGD%@ ||I--..&*4&1jk<< 1 12De|&*4&0XY]^`Xab&&*V+=? d %8 4>>[b>Cc8d$eE"6"  &,A"A<<+ ++ %56::6BI",VJkBWAZ[++4-9  [% v&)GvZX\XeXeWhhj'klruu l&)=dVC[\_[`'abhkk l&! r"%CD6TXTaTaSddf#ghnq q## v"%9$?STWSX#YZ`pqt`u u% #&tf,Mcmm_\]^ +, d"%9$?STWSX#YZ`c c ds_E;,F FE77 FFF I (GI G88 I H""I 5II cURb UR$URc[R"[S9UlUR$)zEReturn an `httpx2.Client`, lazily creating (and tracking) one we own.)timeout)rrhttpx2Clientr rs r>r CredentialsFile._get_http_clientsD    ($$ $  " " *&,mmrCredentialsFile.closesK  " " .  # # ) ) +&*D #  " " .  # # ) ) + /rOc SUlSUlg)aDrop the cached config so the next call re-reads it from disk. `CredentialsFile` caches the parsed config across calls to keep the hot path cheap; a daemon that rotates a profile in place (e.g. flips `"type": "user_oauth"` to `"type": "oidc_federation"`) will not be picked up automatically. Callers that need to react to such changes can call `reload()` to force a fresh read on the next `__call__`. N)rrrs r>reloadCredentialsFile.reloads "&rOcvURceURRnURSSSS9 [R"USURR S3SS9up4[ R"US5 [ R"U[US S 95 [ R"U5 [ R"U5 [ R"X@R5 [ R "U[ R"5n[ R"U5 [ R"U5 g![ R"U5 f=f![a) [ R"U5 e![a ef=ff=f![ R"U5 f=f![a gf=f) a2Atomic write to the credentials file (NOT the config file). `data` may hold `SecretStr` token values (see `_read_credentials`); they are unwrapped at dump time, so the on-disk format is unchanged and this frame's locals stay redacted if the write fails (e.g. ENOSPC) with a crash reporter capturing them. NTi)parentsexist_okrrz.tmp)dirprefixsuffixi)indent)rparentmkdirtempfilemkstemprrGfchmodwriterfsyncrreplace BaseExceptionunlinkropenO_RDONLY)ridatarfdtmpdir_fds r>_atomic_write_credentials)CredentialsFile._atomic_write_credentialss^%%111''.. TDu = ""v$:P:P:U:U9VVW6Xagh   "e$0a@A  JJs22 3 WWVR[[1F !  !    #         sm)A D?56E,%F+F(F+?EE F %E<;F < F F F  F F((F++ F87F8c@UR5n[SUS5$)zCReturn the cached `authentication` sub-object from the config file.rZr)rr rs r>rCredentialsFile._auth_blocks$""$$f-=&>??rOFrmc UR5nURS5nU[:XaURX!S9$U[:XaUR X!S9$[ SU<SURS[<S[<S3 5e)NrSrmUnknown authentication.type  at . Expected  or r)rrFr^_call_oidc_federationr__call_user_oauthr,r)rirnrarbs r>rrCredentialsFile.__call__s!HHV$ 1 1--d-P P , ,(((K K*9-tDr CredentialsFile._call_user_oauthsp _^&&(yy0 "%9$:P:P9QQl#mn nHH[) ,EIIl,CTE[E[\J^L%AjY Y /2 '/ /@@V'**Y))*, ( ,(?AWAWX !7DIIK*>">"23,D1$6 '<"-- 0D(   s " '=X Y &9$))+&FG$[[0 '(\] ] \48 ^,J TYY[)J6kk/2Cm 3i-f *n,l!,o &&u- !;WWe )'EcUK#C( ) ) )(J4K[K[J\\^_ ,,&t,$C(  ) & (5cmm_IdN^N^M__uv ,,&t,   :}5 'GGYZ9:  sUA I='J.3 L1=J+J&&J+. L.80K(( L.54L))L.1MMMcURceURR5(dgUR5$![a*n[ UR [ 5(aSnAgeSnAff=f)u`_read_credentials` variant that returns `None` on absence instead of raising — used by the federation disk-cache path where a missing credentials file just means "exchange now". N)rexistsrr+r __cause__r)rir<s r>_read_credentials_if_exists+CredentialsFile._read_credentials_if_existsksj %%111%%,,.. ))+ + #--):;;  sA A5 A0/A00A5cURcURU5UlURcUR5$UR5nU(d~Ub{UR S5nUR S5nU(aQUbN[ R "5[ U5[- :a%[[[U55[U5S9$UR5nUR0U=(d 0E[[ [#UR$5UR&S.E5 U$![[4a Nmf=f![(a!n[*R-SU5 SnAU$SnAff=f)Nrrqrp)r#rSrrqz?federation token disk-cache write-back failed (best-effort): %s)r_build_workload_delegaterr5rFr%floatr#r r[rr7r8r9r r)rrrjrqrr.debug)rirarncachedrrqrjr<s r>r%CredentialsFile._call_oidc_federationzsY  " " *&*&C&CD&ID #  ! ! )**, ,113!3!::n5LL1J  ". eJ&7:S&SS&S 1M-N[^_i[jkk '') ^  * *|71%.ekk$:"'"2"2  'z*  " ^ IIWY\ ] ]  ^s,>AD1'AE1EE E2E--E2c SSKJnJn URS5nURceURRS5nU(aU(dU"S[ <SUR 35eURS5nUbkURS5nUS :wa[S U<S 35eURS 5nU(d+[S UR<SUR SU<S35eOSnU(a [U5O [5n U"U UUURS5URRS5URS5UR5S9n U RUR5 U $)Nr rr/rTrQz%config file with authentication.type zS must include 'authentication.federation_rule_id' and top-level 'organization_id': rWr;rXzidentity_token source z- is not supported; only 'file' is implementedrYz@identity_token source 'file' requires a non-empty path; profile rz has identity_token=rrUrRrVidentity_token_providerrTrQrUrRrVr) r$rr/rFrr^rr,rr4rrr) rirarr/rTrQidentity_token_cfgr;identity_token_pathrdelegates r>r8(CredentialsFile._build_workload_delegates R!XX&:;||''',,**+<=!'78Q7TUX$$%' "XX&67  )'++H5F&)?zIv'wxx"4"8"8"@ & '#}}/tD4E4E3FFZ[mZppqs '#' =P$%89VgVi /$,1+#xx(<=)).9((7#--/  t~~.rO) rrrrrrrrrrE)r Optional[str]rOptional[httpx2.Client]r\r]r\r[r\z pathlib.Path)r\rE)rPr[r\r])rPr[r\z'CredentialsFile')r`rZr\r[)r\zDict[str, str]r\rZ)r\z httpx2.Clientr\r])rrZr\r]rt)rarZrnrur\r )r\zOptional[Dict[str, Any]]rarZr\r/)rvrwrxryrzrkpropertyrrrrrrrrrrrrr rrrrr5rr8r{r|rOr>r2r2s'V"&N04 NN- N  N&!! 5 5S":  "1f>@', '(T@ 16  OTlX\ TY.`3rOr2cD\rSrSrSrSS Sjjr\S Sj5rS SjrSr g) r4izAn `IdentityTokenProvider` that reads a JWT from a file on every call. Kubernetes projected service-account tokens (and similar) are rotated in place, so the file MUST be re-read on every invocation rather than cached. NcR[U5nUc[S[S35eX lg)Nz;No identity token file path given. Pass `path=` or set the z environment variable.)r)r,r!_path)rirYresolveds r>rkIdentityTokenFile.__init__s:.t4  "MNeMfg()  rOcUR$rErOrs r>rYIdentityTokenFile.paths zzrOcHURRSS9R5nU(d"[ SURS 3URS9eU$![a(n[ SURS3URS9UeSnAf[ a+n[ SURSUS3URS9UeSnAf[ a(n[ S URS 3URS9UeSnAf[[4a*n[ SURS U3URS9UeSnAff=f) Nrrz!Identity token file not found at r)rYzIdentity token file at z" is not readable by this process: z;. Check the file mode and the effective uid of the process.zIdentity token path zF is a directory, not a file. Point at the projected token file itself.rz is empty. If this is a Kubernetes projected service-account token, check the volume mount and the serviceAccountToken projection audience.) rOrstriprr-PermissionErrorIsADirectoryErrorrr)rirr<s r>rrIdentityTokenFile.__call__sT jj**G*<BBDG&()$**6PQZZ   3! v(+LTZZLXY)Zaeakaklru u ()$**5WX[W\]LMZZ   ! (&tzzl3<=ZZ   +, ()$**5I#OVZV`V`  s;'A D!#B D!&B44 D!#C$$D!7%DD!rSrE)rYz$Union[str, 'os.PathLike[str]', None]r\r]rHrG) rvrwrxryrzrkrLrYrrr{r|rOr>r4r4s% rOr4c^\rSrSrSr\R "S5rSSS.S Sjjr\ S Sj5r \ S Sj5r \ SU4S jj5r S r U=r$)r3iuKAn `AccessTokenProvider` driven by an in-memory config dict (same shape as `configs/.json`) rather than files on disk. Intended for callers that want to construct an `anthropic.Anthropic` client with a fully programmatic credentials setup — equivalent to the Go SDK's `option.WithConfig` / TypeScript SDK's `ClientOptions.config`. Both `authentication.type` discriminator values are supported: `"oidc_federation"` `authentication.credentials_path` is **optional**. If set, exchanged tokens are cached to / read from that file (same atomic 0600 write as `CredentialsFile`). If omitted, every call performs a fresh jwt-bearer exchange with no on-disk cache. `"user_oauth"` `authentication.credentials_path` is **required** — it is where the access/refresh tokens live. Behaviour is identical to a file-backed `CredentialsFile` profile of the same shape. The implementation subclasses `CredentialsFile` so the dispatch, refresh-grant, disk-cache and atomic-write logic are shared verbatim; only config loading and identity-token resolution are overridden. zN)r@rc URS5n[U[5(d[S[S[ S35e[ SU5nURS5nU[[ 4;a [SU<S[<S [ <S 35eURS 5nU[ :XaU(d[S [ <S 35eSUlURUl SUl X0l SUl SUl X lXlU(a-[ R""[%U55R'5OSUlUR+U5Ul[/UR,SS9 g)Nrzaconfig dict is missing the 'authentication' object. Expected shape: {"authentication": {"type": "rrrZrSrrrrrzauthentication.type z requires 'authentication.credentials_path' (where the access/refresh tokens live). For profile-based resolution, use CredentialsFile instead.z zconfig: base_urlr)rFrrr,r^r_r r_IN_MEMORY_PATHrrrrr!_identity_token_provider_overriderrrr[rrrrr%)rir`r@rrrarbrs r>rkInMemoryConfig.__init__/sn::./(D))"BB[A\])*/;  $h/HHV$ 68LM M".ym<58=Q?MN &  00.2';?IM1H. Uec2B.C!D!O!O!Qko//7t~~-?@rOc8URceUR$rE)rrs r>rInMemoryConfig._load_config\s||'''||rOcSUlgrE)rrs r>rInMemoryConfig.reloadas #'rOc >URc[TU] U5$SSKJnJn UR S5nURceURR S5nU(aU(dU"S[<S35eU"URUUUR S5URR S5UR S 5UR5S 9nURUR5 U$) Nr r>rTrQz%config dict with authentication.type zQ must include 'authentication.federation_rule_id' and top-level 'organization_id'rUrRrVr?) r]superr8r$rr/rFrr^rrr)rirarr/rTrQrC __class__s r>r8'InMemoryConfig._build_workload_delegategs  1 1 973D9 9Q!XX&:;||''',,**+<=!'78Q7TUVW /$($J$J1+#xx(<=)).9((7#--/  t~~.rO) rrrrrrr]rrr)r`rZr@zOptional[IdentityTokenProvider]rrFr\r]rIrJrK)rvrwrxryrzrrr\rkr rrr8r{ __classcell__)res@r>r3r3s2ll#78O DH/3 +A+A"A +A - +A  +AZ'' rOr3)r:rr;zOptional[pathlib.Path]r\z Optional[int])r`rZrarZr\r])L __future__rrGrrrr%loggingrrtypingrrrrrr typing_extensionsr r_typesr r _secretsrrrrrr _constantsrrrrrrrrrrrrr r!r"r#r$r%r&r'r(r) _exceptionsr+r,r- getLoggerrvr.__annotations__r$r/__all__r?rCONFIG_FILE_VERSIONr)r^r_rcr0r1r2r4r3r|rOr>rts" BB& 60TS''1^16 _ "& .#'>??99"K K \00fm_mrO