4Rj UddlmZddlZddlZddlZddlmZmZddlZddl m Z m Z ddl m Z ddlmZmZdd lmZd gZej(eZd ed <d ZGdd Zy)) annotationsN)CallableOptional) AccessTokenAccessTokenProvider)WorkloadIdentityError)ADVISORY_REFRESH_SECONDSMANDATORY_REFRESH_SECONDS)AnthropicError TokenCachezlogging.LoggerlogcheZdZdZeeej d d dZd dZd dZ d dZ d dZ y)ru2Thread-safe cache wrapping an :class:`AccessTokenProvider` with two-tier proactive refresh and single-flight semantics. Refresh policy on each :meth:`get_token` call: * No cached token → call provider (blocking), cache, return. * Cached with ``expires_at=None`` → return cached forever (never refresh). * More than ``advisory_refresh_seconds`` remaining → return cached. * Between ``mandatory_refresh_seconds`` and ``advisory_refresh_seconds`` remaining (advisory window) → try provider; on success swap cache; on failure log a warning and return the stale cached token. If another caller is already refreshing, the advisory caller just returns the cached token — no second refresh, no waiting. * Less than ``mandatory_refresh_seconds`` remaining or already expired (mandatory window) → call provider; on failure RAISE. Concurrent mandatory callers wait on a shared ``Event`` so exactly one provider call is in flight. The lock is released before the provider call so a 30-second HTTP POST doesn't serialize unrelated callers through a single thread. This matters under async: ``asyncify(get_token)`` runs on the thread pool, and holding the lock across the network call would pin an async worker for the whole exchange. )advisory_refresh_secondsmandatory_refresh_seconds time_sourcec||_||_||_||_t j |_d|_d|_d|_ d|_ y)NFg) _provider _advisory _mandatory _time_source threadingLock_lock_cached_refresh_event _next_force_last_advisory_failure_time)selfproviderrrrs h/var/www/html/meridian/meridian-ai/venv/lib/python3.12/site-packages/anthropic/lib/credentials/_cache.py__init__zTokenCache.__init__3sT"13'^^% .2 :>!36(c |j|S#t$r(}dt|vr|jcYd}~Sd}~wwxYw)z@Invoke ``self._provider``, tolerating legacy zero-arg callables.) force_refreshr'N)r TypeErrorstr)r!forceerrs r#_invoke_providerzTokenCache._invoke_providerLsF $>>>6 6 $c#h.>># #  $s AAAAcr|j5|j}ddd |j}|j5d|_ddd|S#1swY:xYw#t$rA}|jdk7rt j d|jd}Yd}~od}~wwxYw#1swY|SxYw)zBCall the provider, retrying once on a 401 from the token endpoint.N)r*iz*Token provider returned 401; retrying onceTF)rrr,r status_coderdebug)r!r*resultr+s r#_call_providerzTokenCache._call_providerXsZZ %$$E % 7***7F ZZ %$D  %  % %% 7#% IIB C***6F  7  % s. AAB,A B)(7B$$B),B6c< d}d}|j5|j}||j|jcdddS|j|j z }||j kDr|jcdddS||j kDrg|j|jcdddS|j |jz tkr|jcdddS|}t|}|j |j}ntj|_d}ddd|jH |j}|j5||_|j}d|_dddJ|j!|jS#1swY}xYw#t$r}|j5|j}d|_dddn #1swYnxYwJ|j!|t#|t$t&j(fr_t*j-d|||j5|j |_dddn #1swYnxYw|jcYd}~Sd}~wwxYw#1swYxYw)z5Return a valid bearer token, refreshing if necessary.NrzGAdvisory token refresh failed (%ds remaining); serving cached token: %s)rr expires_attokenrrrrr ADVISORY_REFRESH_BACKOFF_SECONDSintrEventwaitr1 BaseExceptionset isinstancer httpx HTTPErrorrwarning) r!advisory_fallbackremaining_secondscached remaining waiter_eventfreshr+releaseds r# get_tokenzTokenCache.get_tokenis}7;  !  (%((0%||  ( ( !' 1 1D4E4E4G GI 4>>1%|| ( (!4??2 ..:#)<< ( (  ,,.1Q1QQTtt#)<<# ( ($-3),/ N)&&2>B>Q>QL+4//*;D'#'L7 (:'!!#  ++-$ +$ ..&*# +' '' LLN;; C ( (T! ZZ/#22H*.D'/// +++ $0ZnV[VeVeEf5gKKa) O;?;L;L;N8OOO,222 " + +s&F)7F)&F)3/F),AF) F5&J)F25 J> J  G' J 'G0 ,A J  I+" J +I4 0J JJ  JJcb|j5d|_d|_dddy#1swYyxYw)zClear the cached token so the next :meth:`get_token` re-invokes the provider. Also sets a one-shot ``force_refresh`` flag so on-disk providers skip their freshness short-circuit instead of re-serving the revoked token. NT)rrr)r!s r# invalidatezTokenCache.invalidates/ ZZ $DL#D  $ $ $s%.N) r"rrr6rr6rzCallable[[], float]returnNone)r*boolrIr)rIr)rIr))rIrJ) __name__ __module__ __qualname____doc__r r timer$r,r1rFrHr%r#rrsb:)A)B+/99 6%6#& 6 $' 6 ) 6 62 $"FP$r%) __future__rrPloggingrtypingrrr<_typesrr _workloadr _constantsr r _exceptionsr __all__ getLoggerrLr__annotations__r5rrQr%r#r\sU" % 4,K) .'g''1^1 $% `$`$r%