5pjM %SrSSKrSSKrSSKrSSKrSSKrSSKrSSKJr SSK J r SSK J r SSK Jr SSKJrJrJr S S KJr S S KJr S S KJrJr S rSrS\S\SS4SjrSq\ "5rSq \S-\!S'\RD"\#5r$S\S-4Sjr%S\S-4Sjr&S\S-4Sjr'S\S-4Sjr("SS\ 5r)\ "5r*Sq+\)S-\!S'Sr,S\S-4Sjr-"SS\ 5r.\ "5r/Sq0\.S-\!S 'S!r1Sr2Sq3S\S-4S"jr4S#\S\4S$jr5S%\SS4S&jr6S'\7\\4S\8S-4S(jr9S\7\\44S)jr:S\7\\7\\444S*jr;S+\7\\7\\44SS4S,jrS#\S-S\S-4S3jr?g)4zVContains a helper to get the token from machine (env variable, secret or config file).N)Path)Lock) TypedDict) constants)DeviceCodeErrorOAuthErrorCode OIDCError) WeakFileLock)refresh_access_token)is_colab_enterpriseis_google_colabiipathcontentreturncURRSS[S9 [R"[ U5[R [R-[R-[5n[R"US5nURU5 SSS5 UR[5 URR[5 g!,(df  ND=f![[4a gf=f)ziWrite content to file, restricting both the file and its parent directory to owner-only on POSIX systems.T)parentsexist_okmodewN)parentmkdir_SECRET_DIR_MODEosopenstrO_WRONLYO_CREATO_TRUNC_SECRET_FILE_MODEfdopenwritechmodOSErrorNotImplementedError)rrfdfs W/var/www/html/pdf-tiff/venv/lib/python3.13/site-packages/huggingface_hub/utils/_auth.py _write_secretr*%sKKdT8HI TBKK"**4rzzACT UB 2s q    $% *+   ( )   s C'4C- C*-D?DF_GOOGLE_COLAB_SECRETc|[5=(d, [5=(d [5=(d [5$)a% Get token if user is logged in. Note: in most cases, you should use [`huggingface_hub.utils.build_hf_headers`] instead. This method is only useful if you want to retrieve the token for other purposes than sending an HTTP request. If `HF_OIDC_RESOURCE` is set (Trusted Publishers, typically in CI), a short-lived token obtained via OIDC token exchange takes precedence. Otherwise the token is retrieved from the `HF_TOKEN` environment variable, then from the token file in the Hugging Face home folder. Returns None if user is not logged in. To log in, use [`login`] or `hf auth login`. OAuth tokens obtained with the browser-based login come with a refresh token: when such a token is close to expiry, it is transparently refreshed and persisted before being returned. Note: if `HF_OIDC_RESOURCE` is set but the OIDC token exchange fails, this raises instead of returning `None`, opting into OIDC is explicit, so a failure surfaces as a clear error rather than a silent fallback. Returns: `str` or `None`: The token, `None` if it doesn't exist. )_get_token_from_oidc_get_token_from_environment_get_token_from_file_refreshed_get_token_from_google_colabr) get_tokenr3:s2,  * & ( * ) + * ( ) r2c\[5(a[5(ag[ [(a[sSSS5 $SSKJn SSKJn URS5n[U5qS q[sSSS5 $![a SSS5 gf=f!URa [R"S5 SqNSURa [ R#S5 SqN{Ua/n[R"S[%U5S 35 SqSnANSnAff=f!,(df  g=f) zGet token from Google Colab secrets vault using `google.colab.userdata.get(...)`. Token is read from the vault only once per session and then stored in a global variable to avoid re-requesting access to the vault. Nr)userdata)ErrorHF_TOKENz Access to the secret `HF_TOKEN` has not been granted on this notebook. You will not be requested again. Please restart the session if you want to be prompted again.zThe secret `HF_TOKEN` does not exist in your Colab secrets. Run `huggingface_hub.login()` to authenticate (recommended but still optional to access public models or datasets).z@ Error while fetching `HF_TOKEN` secret value from your vault: 'z'.T)rr_GOOGLE_COLAB_SECRET_LOCK_IS_GOOGLE_COLAB_CHECKEDr+ google.colabr5google.colab.errorsr6 ImportErrorget _clean_tokenNotebookAccessErrorwarningswarnSecretNotFoundErrorloggerinfor)r5 ColabErrortokenes r)r0r0Ws    3 5 5 # $ #' # "  - ? (LL,E#/#6 0$( #Q # "  # "  ++ ( MMQ  $( ++ ( KKf $(  ( MM]^abc^d]eegh i#'  (E # "skD A<B+D< BDBD(D<D>&D$D&D+%DDDD D+c[[RRS5=(d [RRS55$)Nr7HUGGING_FACE_HUB_TOKEN)r>renvironr=r1r2r)r.r.s-  z2^bjjnnE]6^ __r2c[[[R5R 55$![ a gf=f)N)r>rr HF_TOKEN_PATH read_textFileNotFoundErrorr1r2r)_get_token_from_filerOs8D!8!89CCEFF s /2 ??c4\rSrSr%\\S'\\S'\\S'Srg)_OidcTokenCacheresourcerF expires_atr1N__name__ __module__ __qualname____firstlineno__r__annotations__float__static_attributes__r1r2r)rQrQsM Jr2rQ_OIDC_TOKEN_CACHEi,c>[RRS5nU(dgSSKJnJn [  [R"5n[b,[SU:XaU[S:a[SsSSS5 $[RRS5=(d SnUcU"5c [S 5eU"XS 9nUS n[URS S 55nUbSO[nUUU[Xx- S5-S.q UsSSS5 $!,(df  g=f)aGet a short-lived OIDC token in CI (Trusted Publishers). Enabled by setting `HF_OIDC_RESOURCE`, which scopes the token to a repo or user. The ID token is read from `HF_OIDC_ID_TOKEN` if available, or minted from a supported CI provider (e.g. GitHub Actions). Returns `None` when OIDC is not enabled. If enabled, any failure is raised explicitly rather than falling back silently. See `huggingface_hub._oidc` and https://huggingface.co/docs/hub/trusted-publishers. HF_OIDC_RESOURCENr)detect_provider oidc_loginrSrTrFHF_OIDC_ID_TOKENzHF_OIDC_RESOURCE is set but no OIDC id token is available: not running in a supported CI provider (github) and HF_OIDC_ID_TOKEN is not set. Set HF_OIDC_ID_TOKEN to the id token minted by your CI provider, or unset HF_OIDC_RESOURCE.)rS subject_token access_token expires_inir)rSrFrT)rrJr=_oidcr`ra_OIDC_TOKEN_LOCKtime monotonicr]r int_OIDC_REFRESH_MARGINmax) rSr`ranowrcresultrFremargins r)r-r-szz~~01H 3 nn  )!*-9' 55$W-   '9:Bd  _%6%>O  XK~&L$78 $/5I J$7 ;;  =   s?D?BD Dc4\rSrSr%\\S'\\S'\\S'Srg)_OAuthRefreshCache file_tokenresolved_token recheck_atr1NrUr1r2r)rqrqsOr2rq_OAUTH_REFRESH_CACHEiQc4[5nUcg[U5$)zSGet the token from `HF_TOKEN_PATH`, transparently refreshing it if close to expiry.N)rO_refresh_oauth_token_if_neededrFs r)r/r/s "E } )% 00r2rFc ^[ [R"5n[nUbUST:XaXS:aUSsSSS5 $[U4Sj[ 5R 55S045up4UR S5n[U5nUbUbUc6[5nUbUT:wa UsSSS5 $TTU[-S.qTsSSS5 $U[- U:aTTU[- S.qTsSSS5 $[[RS-S S 9 [ 5R U05nUR S 5T:wa&UR S 5=(d Tn[U5n O[U5n U S nS U ;a[U5[U S 5-OSn [!UUU R S5=(d UU S9 [5T:Xa#[#[%[R&5U5 [(R+SUS35 SSS5 WU[?U[-W (a U [- OS5S.qUsSSS5 $!,(df  N@=f![,an [/U [05(aCU R2[4R6:Xa%[(R9SU S35 [;S5n O[=SU S35 U[-n TTU S.qTsSn A sSSS5 $Sn A ff=f!,(df  g=f)aRefresh an OAuth access token if it is close to expiry. Best-effort: never raises. OAuth tokens obtained with the browser-based login are stored with a `refresh_token` and an `expires_at` timestamp (see `_save_token`). When the active token is one of them and about to expire, exchange the refresh token for a new access token and persist it. Any other token is returned unchanged. Nrsrurtc3\># UH!upURS5T:XdMX4v M# g7f)hf_tokenN)r=).0namefieldsrFs r) 1_refresh_oauth_token_if_needed..s. v0R V\V`V`akVlpuVu^d^0Rs, , refresh_token)rsrtruz.lock)timeoutr|rdre)rF token_namerrTzAccess token `z` has been refreshed.zYour Hugging Face access token has expired and could not be refreshed (session expired or revoked). Run `hf auth login` to re-authenticate. ()infz2Could not refresh your Hugging Face access token: z. Will retry later.r) _OAUTH_REFRESH_LOCKrhrvnext_read_stored_tokens_fullitemsr=_parse_expires_atrO_OAUTH_RECHECK_INTERVAL_OAUTH_REFRESH_MARGINr rHF_STORED_TOKENS_PATHr rj _save_tokenr*rrLrCrD Exception isinstancer error_coder INVALID_GRANTwarningr[_warn_refresh_failure_oncerl) rFrmcacherrrrTcurrent_file_token new_tokennew_expires_atresponserGrus ` r)rxrxs iik$  |!4!=#lH[B[)*   " v0H0J0P0P0R v 2J   ?3 &v.  !6*:L"6!7 !-2D2M)#  ($"'!$;;$ 1  4 - - 3#"'(+@@$ A  D) i==GQST1377 BG::j)U2 & : 6 ?%I%6v%>N3MBH ( 8IO[_gOgSXH\4J0K%KmqN'#-&.ll?&C&T}#1 ,-6%d9+B+B&CYOKK. c [[R5nUR5(d0$[R "SS9nUR U5 UR5Vs0sHo"[URU55_M sn$s snf![Ra$n[RSU35 0sSnA$SnAff=f)zRead all sections of the stored tokens INI file, with all their fields. Beside `hf_token`, sections for OAuth tokens also carry `refresh_token` and `expires_at` (unix timestamp), used by [`get_token`] to transparently refresh them. N interpolationz"Error parsing stored tokens file: ) rrrexists configparser ConfigParserreadsectionsdictrr6rCerror) tokens_pathconfigrrGs r)rrrs y667K       & &T :F K MS__M^_M^zDj!9::M^___    9!=> s0#B)$B BBC )CC C  stored_tokensc[R"SS9n[UR55HAnUR U5 XR 5Hup4UR X#U5 M MC [R"5nURU5 [[[R5UR55 g)zBWrite all sections and their fields to the stored tokens INI file.Nr)rrsortedkeys add_sectionrsetioStringIOr#r*rrrgetvalue)rrrkeyvaluebufs r)_save_stored_tokens_fullrs  & &T :F]//12 :&'399;JC JJz .<3 ++-C LL$y667Hr2rc<[5nX;ag[X5$)z Get the token by name. Args: token_name (`str`): The name of the token to get. Returns: `str` or `None`: The token, `None` if it doesn't exist. N)rr>)rrs r)_get_token_by_namers#&'M&  1 22r2)rrTrrTc[5nSU0nUbX%S'Ub[U5US'XTU'[U5 [R SUS[ R 35 g)a Save the given token. If the stored tokens file does not exist, it will be created. Args: token (`str`): The token to save. token_name (`str`): The name of the token. refresh_token (`str`, *optional*): OAuth refresh token used to renew the access token when it expires. expires_at (`int`, *optional*): Unix timestamp at which the access token expires. r|NrrTz The token `z` has been saved to )rrrrCrDrr)rFrrrTrrs r)rrsi"-.M% F "/":| &*]+ KK+j\)=i>]>]=^_`r2c|UcgURSS5RSS5R5=(d S$)zmClean token by removing trailing and leading spaces and newlines. If token is an empty string, return None. N r )replacestriprys r)r>r>s8  } ==r " * *4 4 : : < DDr2)@__doc__rrloggingrrhr@pathlibr threadingrtypingrrrerrorsrr r _fixesr _oauth_devicer _runtimerrr!rrr*r9r8r+rZ getLoggerrVrCr3r0r.rOrQrgr]rkr-rqrrvrrrr/rxrrrjrrrrrrr>r1r2r)rsy]  ?? /:    s  t  ! F#'cDj'   8 $3::7$cDj7$t`S4Z` cDji6,0?T)00cDj0ff26(4/6!1d 1`#`#`F%%%d38nt q4S> q$sDcN':";& IDd38n1D,E I$ I3333:3&AE_ca aa36:aRUX\R\a a:Ed EsTzEr2