Áj¡UddlmZddlZddlZddlZddlZddlZddlZddlZddl Z ddl m Z m Z m Z mZmZmZddlmZddlZddlmZmZddlmZmZmZmZmZmZddlmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4d d l5m6Z6ejne8Z9d e:d <e rdd l;mdZ?dZ@dZAdZBdZCd dZDGddZEGddZFGddZGGddZHGddeGZIy)!) annotationsN) TYPE_CHECKINGAnyDictUnionOptionalcast)override) AccessTokenIdentityTokenProvider) SecretStr_unwrap_secret_strip_traceback_json_dumps_secrets_wrap_secret_fields_NonObjectPayloadError) ENV_SCOPE ENV_PROFILE ENV_BASE_URLENV_AUTH_TOKENENV_CONFIG_DIRTOKEN_ENDPOINTDEFAULT_BASE_URLENV_WORKSPACE_IDENV_ORGANIZATION_IDOAUTH_API_BETA_HEADERENV_FEDERATION_RULE_IDENV_SERVICE_ACCOUNT_IDTOKEN_EXCHANGE_TIMEOUTENV_IDENTITY_TOKEN_FILEGRANT_TYPE_REFRESH_TOKENMANDATORY_REFRESH_SECONDS _user_agent_require_https_active_profile_config_file_path_credentials_file_pathresolve_identity_token_path)AnthropicErrorzlogging.Loggerlog)WorkloadIdentityCredentials) StaticTokenEnvTokenCredentialsFileInMemoryConfigIdentityTokenFilec|y t|S#ttf$r }|d|nd}t|d|d|d}~wwxYw)z@Parse a credentials-file ``expires_at`` field into Unix seconds.Nzcredentials file at credentialsz has invalid 'expires_at' u; expected an integer Unix timestamp in seconds. The SDK does not parse ISO8601 — convert with int(datetime.timestamp()) before writing the file.)int TypeError ValueErrorr+)valuesourceerrwheres K/tmp/pip-target-k_scjv0h/lib/python/anthropic/lib/credentials/_providers.py_coerce_expires_atr=;sl }5z z "393E&vh/=g/y9F G   s ?:? oauth_tokenz1.0oidc_federation user_oauthcd d}||dt||dt||dt|jd}|tk(rk||dt ||dt ||dt|jd s/tjjt}|r d |d |d <y y y |tk(r||dty y )uFill empty profile fields from corresponding ANTHROPIC_* env vars. The profile file is authoritative — this only fills fields the file left unset. Empty-string env values are treated as unset. cv|j|s(tjj|}|r|||<yyyN)getosenviron)targetkeyenv_varvs r<fillz$_fill_missing_from_env..fill^s5zz# w'As base_urlorganization_id workspace_idtypefederation_rule_idservice_account_idscopeidentity_tokenfile)r9pathN)rGDict[str, Any]rHstrrIrXreturnNone) rrrrDAUTH_TYPE_OIDC_FEDERATIONrrrrErFr!AUTH_TYPE_USER_OAUTH)configauthrK auth_typerJs r<_fill_missing_from_envr`Ws  \*"$78!12 I-- T')?@ T')?@ T7I&xx() 67A4:A)F%&* * * T7I& +rLc&eZdZdZddZddddZy) r.zQAn :class:`AccessTokenProvider` that always returns a fixed token with no expiry.c||_yrC)_token)selftokens r<__init__zStaticToken.__init__ys  rLF force_refreshc2~t|jdS)Nre expires_at)r rc)rdrhs r<__call__zStaticToken.__call__|s >>rLN)rerXrYrZrhboolrYr )__name__ __module__ __qualname____doc__rfrlrLr<r.r.vs[16?rLr.c*eZdZdZefddZddddZy) r/zQAn :class:`AccessTokenProvider` that reads ``ANTHROPIC_AUTH_TOKEN`` at call time.c||_yrC)_env_var)rdrIs r<rfzEnvToken.__init__s  rLFrgc~tjj|j}|t d|jdt |dS)NzEnvironment variable zN is not set. Set it or pass an explicit `credentials=` provider to the client.rj)rErFrDrvr+r )rdrhr8s r<rlzEnvToken.__call__sS  t}}- = ' 7TU 488rLN)rIrXrYrZrm)rorprqrrrrfrlrsrLr<r/r/s[&4 169rLr/ceZdZdZ ddd ddZeddZeddZeddZddZ d d Z d!d Z d"d Z d#d Z d#d Zd$dZd%dZd%dZd&dZd#dZddd'dZddd(dZd)dZddd(dZd*dZy)+r0uAn :class:`AccessTokenProvider` backed by a named profile. A profile is a pair of files under the config directory (``~/.config/anthropic/`` by default; override with ``ANTHROPIC_CONFIG_DIR``): * ``configs/.json`` — non-secret. Holds the nested ``"authentication"`` object (discriminated by its ``"type"`` field), plus top-level ``organization_id``, ``workspace_id``, and ``base_url``. The ``authentication`` object may contain a ``credentials_path`` field overriding the credentials file location. * ``credentials/.json`` — secret (0600). Holds ``access_token``, ``expires_at``, and (for ``user_oauth`` with a ``client_id``) ``refresh_token``. The split keeps secret material out of files that may need to be readable by config-only consumers, and lets the SDK enforce 0600 on the credentials file without locking out config readers. Dispatches on the ``authentication.type`` discriminator: ``"oidc_federation"`` OIDC workload identity federation. Lazily constructs a :class:`WorkloadIdentityCredentials` delegate from the nested auth fields plus the top-level ``organization_id`` and calls it to perform the jwt-bearer exchange. ``"user_oauth"`` Output of an interactive PKCE login. If the auth block has a ``client_id``, performs ``refresh_token`` grants on expiry and writes the new tokens back to the credentials file (atomic replace, refresh-token rotation supported). Without a ``client_id``, the credentials file is treated as externally rotated — the SDK re-reads it on every invocation and returns whatever ``access_token`` is there, no refresh grant attempted. This is the pattern for a sidecar/daemon that mints the access token out-of-band. Args: profile: Profile name. ``None`` resolves via ``ANTHROPIC_PROFILE`` env → ``/active_config`` pointer file → ``"default"``. N) http_clientc||n t|_t|j|_d|_||_d|_d|_d|_t|_ d|_ yrC) r&_profiler' _config_path_bound_base_url _http_client_owned_http_client_config_credentials_pathr _base_url_workload_delegate)rdprofilerys r<rfzCredentialsFile.__init__s^ $+#6O26 9=.IMrLc|jSrC)r{rds r<rzCredentialsFile.profiles }}rLc|jSrC)r|rs r< config_pathzCredentialsFile.config_paths   rLc|j}|jd}|rt|jdSdS)uThe ``base_url`` declared in the profile config file, if any. Returns ``None`` when the config has no top-level ``base_url`` key — callers should fall back to their own default rather than the provider's bound/default value, so a profile that *doesn't* pin a host never overrides an explicit client setting. Loads the config on first access. rM/N) _load_configrDrXrstrip)rdr]raws r<resolved_base_urlz!CredentialsFile.resolved_base_urls:""$jj$'*s3xs#44rLc |jd}t||jd||_|jE|j |j|_t|j |jdyy)a`Adopt the owning client's ``base_url`` as a fallback for the token exchange. Slots between the config file's own ``base_url`` field and the hard-coded default; a ``base_url`` in the config file still wins. Rebinding affects every client holding this instance; clients bind through :meth:`for_base_url` instead. r : base_urlfieldN)rr%r|r}r_resolve_base_urlr)rdrMbounds r< bind_base_urlzCredentialsFile.bind_base_urlsu$ ut'8'8&9$DE$ << #!33DLLADN 4>>D4E4E3Fj1Q R $rLc|jd}|j|j|k(r|j||S|j}|j ds&|j j dt k7r|Stj|}|j|_ d|_ d|_ d|_ |j||S)aReturn the provider a client with ``base_url`` should exchange through. Binds in place, unless another client already bound this instance to a different host (e.g. the parent of ``copy(base_url=...)``). That binding is left alone, and what happens depends on the profile: * pins its own ``base_url``: the bind is irrelevant, return ``self``. * ``oidc_federation``: return a copy bound to ``base_url``. It shares the identity token and http client, but not the on-disk token cache, whose tokens belong to the original deployment. * ``user_oauth``: return ``self``. The refresh token is tied to the deployment that issued it, so there is nothing per-host to copy. rNrMrP) rr}rrrD _auth_blockr[copy_get_http_clientr~rrr)rdrMrr]providers r< for_base_urlzCredentialsFile.for_base_urls$    '4+?+?5+H   u %K""$ ::j !T%5%5%7%;%;F%CG`%`K99T? $ 5 5 7&*#&*#%)"u%rLc|jdrt|djdS|j |jStS)u+base_url precedence: top-level config field → bound (the owning client's base_url, via :meth:`bind_base_url`) → default. Validated against the scheme/TLS rules so a malicious config with ``base_url="http://evil/"`` can't exfiltrate the assertion or refresh token.rMr)rDrXrr}rrdr]s r<rz!CredentialsFile._resolve_base_urlsI ::j !vj)*11#6 6    +'' 'rLc|j}i}|jjdtk7r!|jd}|rt ||d<|S)zReturn headers derived from the config file (e.g. ``workspace_id``). Eagerly reads the config if not yet loaded. The returned dict is suitable for merging into the client's default headers. rPrOzanthropic-workspace-id)rrrDr[rX)rdr]headersrOs r< extra_headerszCredentialsFile.extra_headerss\ ""$"$     ! !& )-F F!::n5L47 4E01rLc |j |jS |jjd} tj|}t|ts/t d |jd t|j d t#d|}|j%d}t|ts't d |jdt&dt(dt#d|}t+|||j-||_t1|j.|jd|j%d}|r2t3j4t7|j9|_nt=|j |_||_|S#t$r:}t d|jd|j dt dtd |d}~wttf$r!}t d |jd ||d}~wwxYw#tj$r!}t d |jd ||d}~wwxYw)zPRead and cache the config file, resolving ``base_url`` and ``credentials_path``.Nutf-8encodingzConfig file not found at (profile z). Set z' to select a different profile, or set z" to relocate the config directory.zConfig file at  could not be read:  is not valid JSON: ! must contain a JSON object, not .rWauthenticationzV is missing the 'authentication' object. Expected shape: {"authentication": {"type": ""|" ", ...}, ...}rrcredentials_path)rr| read_textFileNotFoundErrorr+r{rrOSErrorUnicodeDecodeErrorjsonloadsJSONDecodeError isinstancedictrPror rDr[r\r`rrr%pathlibPathrX expanduserrr()rdrr: raw_configr]raw_authr^r s r<rzCredentialsFile._load_config2sP << #<<  j##--w-?C j"jjoJ*d+ !$"3"3!44UVZ[eVfVoVoUppqr & 3::./(D) !$"3"3!45-.c2F1GX  $h/ vt,//7t~~0A0A/B*-MN88./ %,\\#h-%@%K%K%MD "%;DMM%JD "  U!  +D,=,=+>jHYZ"m#J>JZ[45   +, j ?43D3D2EEYZ]Y^!_`fi i j## j ?43D3D2EEYZ]Y^!_`fi i js:FH  H "5GH )HH  I H<<Ic |jJ|j}tjdk(r tj|d}tj|jrt d|d tj|j}|d zrt d|d |d d|d|dzrtjd||| ttj|j!d}|j-d}|M|t.k7rD|j0J|j0dj-d}t d|dt.d||S#t$r"}t d|d|j d|d}~wt$r}t d|d ||d}~wwxYw#t$r"}t d|d|j d|d}~wtj"$r }t d|d|t%|d}~wt&$r"}t d|d|j(ddd}~wtt*f$r}t d|d||d}~wwxYw)uRead the credentials file. Re-reads on every call — daemons rotate it. Secret values in the returned dict (every string field not in ``_secrets._PLAIN_KEYS``) are :class:`SecretStr`-wrapped — unwrap with ``_unwrap_secret`` at the point of use. Writing the dict back through :meth:`_atomic_write_credentials` unwraps automatically. On Unix, verifies the file is not group/world-readable. World-readable credentials files are refused outright; group-readable files log a warning but are accepted. The check is skipped on Windows where POSIX mode bits don't carry the same meaning. NposixF)follow_symlinkszCredentials file not found at r).Credentials file at z could not be accessed: zu is a symlink; refusing to follow (move the real file into place to keep secret material on the expected filesystem).z is world-readable (mode z#oz); run `chmod 600 z` before retrying.8zMCredentials file at %s is group-readable (mode %#o); consider `chmod 600 %s`.rrrrrrrPrzcredentials file has type z ; expected z for authentication.type )rrEnamestatrr+r{rS_ISLNKst_modeS_IMODEr,warningrrrrrrr type_namerrDCREDENTIALS_FILE_TYPEr)rdrV file_statr:modecredsactualr_s r<_read_credentialsz!CredentialsFile._read_credentialses%%111%% 77g  jGGD%@ ||I--.$*4&1jk<< 1 12De|$*4&0I$rS&&*V+=?e| c   b %8 4>>[b>Cc8d$eE"6"  &,A"A<<+ ++ %56::6BI ,VJkBWAZ[++4-9  i% t$'EdV:VZVcVcUffh%ijpss j$';D6AYZ]Y^%_`fii j4! p #A$zRVR_R_Qbbd!eflo o## t #7v=QRUQV!WX^nor^s s% !&tf,Mcmm_\]^ +, b #7v=QRUQV!WX^a a bs_E .F( F%%F F%F  F%( I1GI$G?? I H((I:I  Ic|j |jS|jtjt|_|jS)zFReturn an ``httpx.Client``, lazily creating (and tracking) one we own.)timeout)r~rhttpxClientr rs r<rz CredentialsFile._get_http_clientsD    ($$ $  " " *&+ll;Q&RD #&&&rLc|j!|jjd|_|j|jjyy)z3Close the owned ``httpx.Client`` if we created one.N)rcloserrs r<rzCredentialsFile.closesK  " " .  # # ) ) +&*D #  " " .  # # ) ) + /rLc d|_d|_y)aDrop the cached config so the next call re-reads it from disk. ``CredentialsFile`` caches the parsed config across calls to keep the hot path cheap; a daemon that rotates a profile in place (e.g. flips ``"type": "user_oauth"`` to ``"type": "oidc_federation"``) will not be picked up automatically. Callers that need to react to such changes can call ``reload()`` to force a fresh read on the next ``__call__``. N)rrrs r<reloadzCredentialsFile.reloads "&rLcl|jJ|jj}|jdddtj|d|jj dd\}} t j|dt j|t|d t j|t j|t j||j t j |t j"} t j|t j|y#t j|wxYw#t$r' t j|#t$rYwxYwwxYw#t j|wxYw#t$rYywxYw) aiAtomic write to the credentials file (NOT the config file). ``data`` may hold :class:`SecretStr` token values (see :meth:`_read_credentials`); they are unwrapped at dump time, so the on-disk format is unchanged and this frame's locals stay redacted if the write fails (e.g. ENOSPC) with a crash reporter capturing them. NTi)parentsexist_okrrz.tmp)dirprefixsuffixi)indent)rparentmkdirtempfilemkstemprrEfchmodwriterfsyncrreplace BaseExceptionunlinkropenO_RDONLY)rddatarfdtmpdir_fds r<_atomic_write_credentialsz)CredentialsFile._atomic_write_credentialssb%%111''.. TDu = ""v$:P:P:U:U9VVW6XaghC   "e$0a@A  JJsD22 3 WWVR[[1F !  !    #         sm.A E:5E0$F'F *F'EE F $E:9F : FF FF  F$$F'' F32F3c@|j}td|dS)zEReturn the cached ``authentication`` sub-object from the config file.rWr)rr rs r<rzCredentialsFile._auth_blocks$""$$f-=&>??rLFrgc |j}|jd}|tk(r|j||S|tk(r|j ||St d|d|jdtdtd )NrPrgUnknown authentication.type  at . Expected  or r)rrDr[_call_oidc_federationr\_call_user_oauthr+r|)rdrhr^r_s r<rlzCredentialsFile.__call__s!HHV$ 1 1--d--P P , ,((](K K*9-tD>">"23,D1$6 '<"-- 0D(   s " '=X Y &9$))+&FG$[[0 '(\] ] \48 ^,J TYY[)J6kk/2Cm 3i-f *n,l!,o &&u- !;WWe )'EcUK#C( ) ) )(J4K[K[J\\^_ ,,&t,$C(  ) & (5cmm_IdN^N^M__uv ,,&t,   :& 'GGYZ9:  sU2A I(J L(J;JJ L!3K L 7LLM. L;;Mc|jJ|jjsy |jS#t$r%}t |j t rYd}~yd}~wwxYw)u``_read_credentials`` variant that returns ``None`` on absence instead of raising — used by the federation disk-cache path where a missing credentials file just means "exchange now". N)rexistsrr+r __cause__r)rdr:s r<_read_credentials_if_existsz+CredentialsFile._read_credentials_if_exists{sd %%111%%,,. ))+ + #--):;  s; A)A$#A$$A)c|j|j||_|j|jS|j}|sx|v|j d}|j d} |rQ|Ot j t |tz kr(ttt|t|S|j} |ji|xsitt t#|j$|j&d|S#ttf$rYgwxYw#t($r!}t*j-d|Yd}~|Sd}~wwxYw)Nrrkrj)rrPrrkz?federation token disk-cache write-back failed (best-effort): %s)r_build_workload_delegaterrrDr floatr#r rXrr5r6r7rr rrrerkrr,debug)rdr^rhcachedrrkrer:s r<rz%CredentialsFile._call_oidc_federationsY  " " *&*&C&CD&ID #  ! ! )**, ,113!3!::n5LL1J  ". eJ&7:S&SS&S 1M-N[^_i[jkk '') ^  * *|71%.ekk$:"'"2"2  'z*  " ^ IIWY\ ] ]  ^s,6ADAD4D10D14 E=EEc ddlm}m}|jd}|jJ|jjd}|r|s|dt d|j |jd}|a|jd}|d k7rtd |d |jd }|s+td |jd|j d|dd}|r t|n t} || |||jd|jjd|jd|j} | j|j| S)Nr rr-rQrNz%config file with authentication.type zS must include 'authentication.federation_rule_id' and top-level 'organization_id': rTr9rUzidentity_token source z- is not supported; only 'file' is implementedrVz@identity_token source 'file' requires a non-empty path; profile rz has identity_token=rrRrOrSidentity_token_providerrQrNrRrOrSry) rrr-rDrr[r|r+r{r2rrr) rdr^rr-rQrNidentity_token_cfgr9identity_token_pathrdelegates r<rz(CredentialsFile._build_workload_delegates R!XX&:;||''',,**+<=!'78Q7TUX$$%' "XX&67  )'++H5F$'=fZGt%uvv"4"8"8"@ & %#}}/tD4E4E3FFZ[mZppqs #' =P$%89VgVi /$,1+#xx(<=)).9((7#--/  t~~.rLrC)r Optional[str]ryOptional[httpx.Client]rYrZrYrXrYz pathlib.Path)rYr$)rMrXrYrZ)rMrXrYz'CredentialsFile')r]rWrYrX)rYzDict[str, str]rYrW)rYz httpx.ClientrYrZ)rrWrYrZrm)r^rWrhrnrYr )rYzOptional[Dict[str, Any]]r^rWrYr-)rorprqrrrfpropertyrrrrrrrrrrrrrrrlrrrrrsrLr<r0r0s'V"&N/3 NN, N  N&!! 5 5S":  &1fFP', '(X@ 16  "OTlX` TY.`3rLr0c4eZdZdZdddZeddZd dZy) r2zAn :class:`IdentityTokenProvider` that reads a JWT from a file on every call. Kubernetes projected service-account tokens (and similar) are rotated in place, so the file MUST be re-read on every invocation rather than cached. NcRt|}|tdtd||_y)Nz;No identity token file path given. Pass `path=` or set the z environment variable.)r)r+r!_path)rdrVresolveds r<rfzIdentityTokenFile.__init__s<.t4   MNeMfg()  rLc|jSrC)r.rs r<rVzIdentityTokenFile.paths zzrLc |jjdj}|st d|jd |S#t$r}t d|jd|d}~wt $r"}t d|jd|d|d}~wt $r}t d|jd |d}~wttf$r!}t d|jd ||d}~wwxYw) Nrrz!Identity token file not found at rzIdentity token file at z" is not readable by this process: z;. Check the file mode and the effective uid of the process.zIdentity token path zF is a directory, not a file. Point at the projected token file itself.rz is empty. If this is a Kubernetes projected service-account token, check the volume mount and the serviceAccountToken projection audience.) r.rstriprr+PermissionErrorIsADirectoryErrorrr)rdrr:s r<rlzIdentityTokenFile.__call__s, kjj**G*<BBDG )$**6PQ  )! ] #DTZZLPQ!RSY\ \  )$**5WX[W\]LM !  &tzzl3<= +, k #:4::,FZ[^Z_!`agj j ks;*A C.A,, C.8B C.!B;;C. C))C.rC)rVz$Union[str, 'os.PathLike[str]', None]rYrZr'r&)rorprqrrrfr+rVrlrsrLr<r2r2s% rLr2ceZdZdZej dZddd d dZed dZ ed dZ ed fd Z xZ S) r1uAn :class:`AccessTokenProvider` driven by an in-memory config dict (same shape as ``configs/.json``) rather than files on disk. Intended for callers that want to construct an :class:`anthropic.Anthropic` client with a fully programmatic credentials setup — equivalent to the Go SDK's ``option.WithConfig`` / TypeScript SDK's ``ClientOptions.config``. Both ``authentication.type`` discriminator values are supported: ``"oidc_federation"`` ``authentication.credentials_path`` is **optional**. If set, exchanged tokens are cached to / read from that file (same atomic 0600 write as :class:`CredentialsFile`). If omitted, every call performs a fresh jwt-bearer exchange with no on-disk cache. ``"user_oauth"`` ``authentication.credentials_path`` is **required** — it is where the access/refresh tokens live. Behaviour is identical to a file-backed :class:`CredentialsFile` profile of the same shape. The implementation subclasses :class:`CredentialsFile` so the dispatch, refresh-grant, disk-cache and atomic-write logic are shared verbatim; only config loading and identity-token resolution are overridden. zN)r ryc |jd}t|tstdtdt dt d|}|jd}|tt fvrtd|dtd t d |jd }|t k(r|std t d d|_|j|_ d|_ ||_ d|_ d|_ ||_||_|r,t!j"t%|j'nd|_|j+||_t/|j,dy)Nrzaconfig dict is missing the 'authentication' object. Expected shape: {"authentication": {"type": "rrrWrPrrrrrzauthentication.type z requires 'authentication.credentials_path' (where the access/refresh tokens live). For profile-based resolution, use CredentialsFile instead.z zconfig: base_urlr)rDrrr+r[r\r r{_IN_MEMORY_PATHr|r}r~rr!_identity_token_provider_overriderrrrXrrrrr%)rdr]r ryrr^r_rs r<rfzInMemoryConfig.__init__:sq::./(D) BB[A\])*/;  $h/HHV$ 68LM M .ym<58=Q?MN &  00.2':>IM1H. Uec2B.C!D!O!O!Qko//7t~~-?@rLc6|jJ|jSrC)rrs r<rzInMemoryConfig._load_configgs||'''||rLcd|_yrC)rrs r<rzInMemoryConfig.reloadls #'rLc |jt| |Sddlm}m}|j d}|jJ|jj d}|r|s|dtd||j|||j d|jj d|j d |j }|j|j|S) Nr rrQrNz%config dict with authentication.type zQ must include 'authentication.federation_rule_id' and top-level 'organization_id'rRrOrSr) r8superrrrr-rDrr[rrr)rdr^rr-rQrNr# __class__s r<rz'InMemoryConfig._build_workload_delegaters  1 1 973D9 9Q!XX&:;||''',,**+<=!'78Q7TUVW /$($J$J1+#xx(<=)).9((7#--/  t~~.rL)r]rWr zOptional[IdentityTokenProvider]ryr%rYrZr(r)r*) rorprqrrrrr7rfr rrr __classcell__)r=s@r<r1r1s2#gll#78O DH.2 +A+A"A +A , +A  +AZ'' rLr1)r8rr9zOptional[pathlib.Path]rYz Optional[int])r]rWr^rWrYrZ)J __future__rrErrrr loggingrrtypingrrrrrr typing_extensionsr r_typesr r _secretsrrrrrr _constantsrrrrrrrrrrrrr r!r"r#r$r%r&r'r(r) _exceptionsr+ getLoggerror,__annotations__rr-__all__r=rCONFIG_FILE_VERSIONr r[r\r`r.r/r0r2r1rsrLr<rKs" BB& 60*'g''1^16 _ "& .#'>??99"[ [ |++\m_mrL