+ jM8aR4t=0tRt^RIt^RIt^RIt^RIt^RIt^RIt^RIH t ^RI H t ^RI H t ^RIHt^RIHtHtHt^RIHt^RIHt^R IHtHtR tR tR R ltRs] !4tRs ]^k]PB!]"4t#RRlt$RRlt%RRlt&RRlt'!RR] 4t(] !4t)Rs*]^kRt+RRlt,!RR] 4t-] !4t.Rs/]^kR5t0Rt1Rs2RRlt3R R!lt4R"R#lt5R$R%lt6R&R'lt7R(R)lt8R*R+lt9R,R-lt:R.RR/R/R0R1llt;R2R3lt%D(#D0(D--D00 E c2V^8dQhR\R,/#r.r/)rs"rrrs``S4Z`rc\\PPR4;'g \PPR44#)r;HUGGING_FACE_HUB_TOKEN)rCrenvironrBr5rrr2r2s0  z2^^bjjnnE]6^ __rc2V^8dQhR\R,/#r.r/)rs"rrrscDjrc\\\P4P 44# \ dR#i;i)N)rCrr HF_TOKEN_PATH read_textFileNotFoundErrorr5rr_get_token_from_filerVs8D!8!89CCEFF s/2 AAc,a]tRt^toV3RltRtVtR#)_OidcTokenCachec><V^8dQh/S[;R&S[;R&S[;R&#)rresourcerK expires_atrfloat)r __classdict__s"rr_OidcTokenCache.__annotate__s&M Jrr5N__name__ __module__ __qualname____firstlineno____annotate_func____static_attributes____classdictcell__r^s@rrXrXrrXi,c2V^8dQhR\R,/#r.r/)rs"rrrs00cDj0rc \PPR4pV'gR#^RIHpHp\ ;_uu_4\P!4p\e<\R,V8Xd*V\R,8d\R,uuRRR4#\PPR4;'gRpVfV!4f \R4hV!WR 7pVR ,p\VPR R 44pVe^M\pRVRVRV\Wx, ^4,/s VuuRRR4# +'giR#;i) aGet a short-lived OIDC token in CI (Trusted Publishers). Enabled by setting `HF_OIDC_RESOURCE`, which scopes the token to a repo or user. The ID token is read from `HF_OIDC_ID_TOKEN` if available, or minted from a supported CI provider (e.g. GitHub Actions). Returns `None` when OIDC is not enabled. If enabled, any failure is raised explicitly rather than falling back silently. See `huggingface_hub._oidc` and https://huggingface.co/docs/hub/trusted-publishers. HF_OIDC_RESOURCEN)detect_provider oidc_loginrZr[rKHF_OIDC_ID_TOKENzHF_OIDC_RESOURCE is set but no OIDC id token is available: not running in a supported CI provider (github) and HF_OIDC_ID_TOKEN is not set. Set HF_OIDC_ID_TOKEN to the id token minted by your CI provider, or unset HF_OIDC_RESOURCE.)rZ subject_token access_token expires_ini)rrPrB_oidcrmrn_OIDC_TOKEN_LOCKtime monotonic_OIDC_TOKEN_CACHErint_OIDC_REFRESH_MARGINmax) rZrmrnnowrpresultrKrrmargins rr1r1szz~~01H 3  nn  )!*-9' 55$W-   '9:BBd  _%6%>O  XK~&L$78 $/5I  U #J$7 ;;  =    sAD>%D>?A4D>> E c,a]tRt^toV3RltRtVtR#)_OAuthRefreshCachec><V^8dQh/S[;R&S[;R&S[;R&#)r file_tokenresolved_token recheck_atr\)rr^s"rr_OAuthRefreshCache.__annotate__s'Orr5Nr`rhs@rrrrirrc2V^8dQhR\R,/#r.r/)rs"rrrs11d 1rc8\4pVfR#\V4#)zSGet the token from `HF_TOKEN_PATH`, transparently refreshing it if close to expiry.N)rV_refresh_oauth_token_if_neededrKs rr3r3s "E } )% 00rc0V^8dQhR\R\/#)rrKrr/)rs"rrrs``#`#`rc a\;_uu_4\P!4p\pVe/VR,S8Xd!WR,8dVR,uuRRR4#\V3Rl\ 4P 44R/34wr4VP R4p\V4pVe VeVfA\4pVeVS8wd VuuRRR4#RSRSRV\,/sSuuRRR4#V\, V8d RSRSRV\, /sSuuRRR4#\\PR,^R7;_uu_4\ 4P V/4pVP R 4S8wd(VP R 4;'gSp\V4p M\V4p V R ,pR V 9d#\V4\V R ,4,MRp \!TTV P R4;'gTV R 7\4S8Xd$\#\%\P&4V4\(P+R V R24RRR4RXRTR\?T\,X 'dT \, M^4/sTuuRRR4# +'giLN;i \,dp \/T \04'dET P2\4P68Xd&\(P9RT R24\;R4p M\=RT R24T\,p RSRSRT /sSuRp ? uuRRR4#Rp ? ii;i +'giR#;i)aRefresh an OAuth access token if it is close to expiry. Best-effort: never raises. OAuth tokens obtained with the browser-based login are stored with a `refresh_token` and an `expires_at` timestamp (see `_save_token`). When the active token is one of them and about to expire, exchange the refresh token for a new access token and persist it. Any other token is returned unchanged. Nrrrc3^<"TF"wrVPR4S8XgKW3xK$ R#5i)hf_tokenN)rB).0namefieldsrKs& r 1_refresh_oauth_token_if_needed..s. v0R V\V`V`akVlpuVu^d^0Rs- - refresh_tokenz.lock)timeoutrrqrr)rK token_namerr[zAccess token `z` has been refreshed.zYour Hugging Face access token has expired and could not be refreshed (session expired or revoked). Run `hf auth login` to re-authenticate. ()infz2Could not refresh your Hugging Face access token: z. Will retry later.) _OAUTH_REFRESH_LOCKru_OAUTH_REFRESH_CACHEnext_read_stored_tokens_fullitemsrB_parse_expires_atrV_OAUTH_RECHECK_INTERVAL_OAUTH_REFRESH_MARGINr rHF_STORED_TOKENS_PATHr rx _save_tokenr,rrSrHrI Exception isinstancer error_coder INVALID_GRANTwarningr]_warn_refresh_failure_oncerz) rKr{cacherrrr[current_file_token new_tokennew_expires_atresponserLrs f rrrs*  iik$  |!4!=#lH[B[)*   " v0H0J0P0P0R v 2J   ?3 &v.  !6*:L"6!7 !-2D2M)#  (e %c$;;$ 1  4 - - 3e %j+@@$ A  D) i==GQSTT1377 BG::j)U2 & : 6 ? ?%I%6v%>N3MBH ( 8IO[_gOgSXH\4J0K%KmqN'#-&.ll?&C&T&T}#1 ,-6%d9+B+B&CYOKK. qrc \4P4UUu/uFwrWPRR4bK upp#uuppi)a) Returns the parsed INI file containing the access tokens. The file is located at `HF_STORED_TOKENS_PATH`, defaulting to `~/.cache/huggingface/stored_tokens`. If the file does not exist, an empty dictionary is returned. Returns: `dict[str, str]` Key is the token name and value is the token. r)rrrB)rrs rget_stored_tokensrfs=NfMgMmMmMo pMo7IzJ :r2 2Mo pp ps=chV^8dQhR\\\\\3,3,/#rr)rs"rrrrs%$sDcN':";rc \\P4pVP4'g/#\P !RR7pVP V4VP4Uu/uFq"\VPV44bK up#uupi \Pd%p\PRT 24/uRp?#Rp?ii;i)zRead all sections of the stored tokens INI file, with all their fields. Beside `hf_token`, sections for OAuth tokens also carry `refresh_token` and `expires_at` (unix timestamp), used by [`get_token`] to transparently refresh them. N interpolationz"Error parsing stored tokens file: ) rrrexists configparser ConfigParserreadsectionsrrr:rHerror) tokens_pathconfigrrLs rrrrs y667K       & &T :F K MS__M^_M^zDj!9::M^___    9!=> s0 #B-#BBBC-C C CclV^8dQhR\\\\\3,3,RR/#)r stored_tokensrNr)rs"rrrs0 I IDd38n1D,E I$ Irc\P!RR7p\VP44FEpVP V4W,P 4Fwr4VP W#V4K KG \P!4pVPV4\\\P4VP44R#)zBWrite all sections and their fields to the stored tokens INI file.Nr)rrsortedkeys add_sectionrsetioStringIOr&r,rrrgetvalue)rrrkeyvaluebufs& r_save_stored_tokens_fullrs  & &T :F]//12 :&'399;JC JJz .<3 ++-C LL$y667Hrc>V^8dQhR\R\R,/#)rrrNr/)rs"rrrs33333:3rcH\4pW9dR#\W,4#)z Get the token by name. Args: token_name (`str`): The name of the token to get. Returns: `str` or `None`: The token, `None` if it doesn't exist. N)rrC)rrs& r_get_token_by_namers#&'M&  1 22rrr[c hV^8dQhR\R\R\R,R\R,RR/#)rrKrrNr[r)rrx)rs"rrrsEaa aa36:aRUX\R\a arc\4pRV/pVeW%R&Ve\V4VR&WTV&\V4\P RV R\ P 24R#)a Save the given token. If the stored tokens file does not exist, it will be created. Args: token (`str`): The token to save. token_name (`str`): The name of the token. refresh_token (`str`, *optional*): OAuth refresh token used to renew the access token when it expires. expires_at (`int`, *optional*): Unix timestamp at which the access token expires. rNrr[z The token `z` has been saved to )rrrrHrIrr)rKrrr[rrs&&$$ rrrsi"-.M% F "/":| &*]+ KK+j\)=i>]>]=^_`rcLV^8dQhR\R,R\R,/#)rrKNrr/)rs"rrrs&EEd EsTzErcVfR#VPRR4PRR4P4;'gR#)zmClean token by removing trailing and leading spaces and newlines. If token is an empty string, return None. N r )replacestriprs&rrCrCs;  } ==r " * *4 4 : : < D DDrcV^8dQh/^\9d\R,;R&^\9d\R,;R&^\9d\R,;R&#)rNr>rwr)__conditional_annotations__rrXr)rs"rrrsV\\N('cDj'O]p10?T)0q]p76(4/6q]riQ)>r__doc__rrloggingrrurEpathlibr threadingrtypingrrrerrorsrrr_fixesr _oauth_devicer _runtimer r r$rr,r=r<r> getLoggerrarHr6r4r2rVrXrtrwryr1rrrrrrr3rrrrrrrrrCr)rs@rrs1]  ?? /:  ! F#''   8 $:7$t` i6,000ff266!1`F% q& I3$a@Da_ca:Er