b\j%SSKJr SSKrSSKrSSKrSSKrSSKrSSKrSSKrSSK J r J r J r J r JrJr SSKJr SSKrSSKJrJr SSKJrJrJrJrJrJr SSKJrJrJ r J!r!J"r"J#r#J$r$J%r%J&r&J'r'J(r(J)r)J*r*J+r+J,r,J-r-J.r.J/r/J0r0J1r1J2r2J3r3 S S K4J5r5 \Rl"\75r8S \9S '\ (aSS K:J;r; /SQrSr?Sr@SrASrBS SjrC"SS5rD"SS5rE"SS5rF"SS5rG"SS\F5rHg)!) annotationsN) TYPE_CHECKINGAnyDictUnionOptionalcast)override) AccessTokenIdentityTokenProvider) SecretStr_unwrap_secret_strip_traceback_json_dumps_secrets_wrap_secret_fields_NonObjectPayloadError) ENV_SCOPE ENV_PROFILE ENV_BASE_URLENV_AUTH_TOKENENV_CONFIG_DIRTOKEN_ENDPOINTDEFAULT_BASE_URLENV_WORKSPACE_IDENV_ORGANIZATION_IDOAUTH_API_BETA_HEADERENV_FEDERATION_RULE_IDENV_SERVICE_ACCOUNT_IDTOKEN_EXCHANGE_TIMEOUTENV_IDENTITY_TOKEN_FILEGRANT_TYPE_REFRESH_TOKENMANDATORY_REFRESH_SECONDS _user_agent_require_https_active_profile_config_file_path_credentials_file_pathresolve_identity_token_path)AnthropicErrorzlogging.Loggerlog)WorkloadIdentityCredentials) StaticTokenEnvTokenCredentialsFileInMemoryConfigIdentityTokenFilecUcg[U5$![[4a"nUbSU3OSn[USU<S35UeSnAff=f)z@Parse a credentials-file ``expires_at`` field into Unix seconds.Nzcredentials file at credentialsz has invalid 'expires_at' u; expected an integer Unix timestamp in seconds. The SDK does not parse ISO8601 — convert with int(datetime.timestamp()) before writing the file.)int TypeError ValueErrorr+)valuesourceerrwheres Z/var/www/website/venv/lib/python3.13/site-packages/anthropic/lib/credentials/_providers.py_coerce_expires_atr=:sl }5z z "393E&vh/=g/y9F G   s A>A oauth_tokenz1.0oidc_federation user_oauthcS SjnU"US[5 U"US[5 U"US[5 URS5nU[:XauU"US[ 5 U"US[ 5 U"US[5 URS 5(d4[RR[5nU(a S US .US 'g g g U[:XaU"US[5 g g )uFill empty profile fields from corresponding ANTHROPIC_* env vars. The profile file is authoritative — this only fills fields the file left unset. Empty-string env values are treated as unset. cURU5(d,[RRU5nU(aX0U'gggN)getosenviron)targetkeyenv_varvs r<fill$_fill_missing_from_env..fill]s5zz# w'As base_urlorganization_id workspace_idtypefederation_rule_idservice_account_idscopeidentity_tokenfile)r9pathN)rGDict[str, Any]rHstrrIrYreturnNone) rrrrDAUTH_TYPE_OIDC_FEDERATIONrrrrErFr!AUTH_TYPE_USER_OAUTH)configauthrK auth_typerJs r<_fill_missing_from_envraVs  \*"$78!12 I-- T')?@ T')?@ T7I&xx()) 67A4:A)F%&* * * T7I& +rMc4\rSrSrSrS SjrSS.S SjjrSrg) r.uzQAn :class:`AccessTokenProvider` that always returns a fixed token with no expiry.cXlgrC_token)selftokens r<__init__StaticToken.__init__xs rMF force_refreshc,A[URSS9$)Nrh expires_at)r rf)rgrls r<__call__StaticToken.__call__{s >>rMreN)rhrYrZr[rlboolrZr )__name__ __module__ __qualname____firstlineno____doc__rirp__static_attributes__rMr<r.r.us[16??rMr.c:\rSrSrSr\4S SjjrSS.S SjjrSrg) r/zQAn :class:`AccessTokenProvider` that reads ``ANTHROPIC_AUTH_TOKEN`` at call time.cXlgrC_env_var)rgrIs r<riEnvToken.__init__s rMFrkcA[RRUR5nUc[ SURS35e[ USS9$)NzEnvironment variable zN is not set. Set it or pass an explicit `credentials=` provider to the client.rn)rErFrDrr+r )rgrlr8s r<rpEnvToken.__call__sS  t}}- = ' 7TU 488rMr~N)rIrYrZr[rr) rtrurvrwrxrrirpryrzrMr<r/r/s[&4 1699rMr/c$\rSrSrSrSSS.SSjjjr\SSj5r\SSj5r\SSj5r S S jr S!S jr S"S jr S#S jr S#S jrS$SjrS%SjrS%SjrS&SjrS#SjrSS.S'SjjrSS.S(SjjrS)SjrSS.S(SjjrS*SjrSrg)+r0umAn :class:`AccessTokenProvider` backed by a named profile. A profile is a pair of files under the config directory (``~/.config/anthropic/`` by default; override with ``ANTHROPIC_CONFIG_DIR``): * ``configs/.json`` — non-secret. Holds the nested ``"authentication"`` object (discriminated by its ``"type"`` field), plus top-level ``organization_id``, ``workspace_id``, and ``base_url``. The ``authentication`` object may contain a ``credentials_path`` field overriding the credentials file location. * ``credentials/.json`` — secret (0600). Holds ``access_token``, ``expires_at``, and (for ``user_oauth`` with a ``client_id``) ``refresh_token``. The split keeps secret material out of files that may need to be readable by config-only consumers, and lets the SDK enforce 0600 on the credentials file without locking out config readers. Dispatches on the ``authentication.type`` discriminator: ``"oidc_federation"`` OIDC workload identity federation. Lazily constructs a :class:`WorkloadIdentityCredentials` delegate from the nested auth fields plus the top-level ``organization_id`` and calls it to perform the jwt-bearer exchange. ``"user_oauth"`` Output of an interactive PKCE login. If the auth block has a ``client_id``, performs ``refresh_token`` grants on expiry and writes the new tokens back to the credentials file (atomic replace, refresh-token rotation supported). Without a ``client_id``, the credentials file is treated as externally rotated — the SDK re-reads it on every invocation and returns whatever ``access_token`` is there, no refresh grant attempted. This is the pattern for a sidecar/daemon that mints the access token out-of-band. Args: profile: Profile name. ``None`` resolves via ``ANTHROPIC_PROFILE`` env → ``/active_config`` pointer file → ``"default"``. N) http_clientcUbUO [5Ul[UR5UlSUlX lSUlSUlSUl[Ul SUl grC) r&_profiler' _config_path_bound_base_url _http_client_owned_http_client_config_credentials_pathr _base_url_workload_delegate)rgprofilers r<riCredentialsFile.__init__s\ $+#6O26 9=.IMrMcUR$rC)rrgs r<rCredentialsFile.profiles }}rMcUR$rC)rrs r< config_pathCredentialsFile.config_paths   rMcUR5nURS5nU(a[U5RS5$S$)uYThe ``base_url`` declared in the profile config file, if any. Returns ``None`` when the config has no top-level ``base_url`` key — callers should fall back to their own default rather than the provider's bound/default value, so a profile that *doesn't* pin a host never overrides an explicit client setting. Loads the config on first access. rN/N) _load_configrDrYrstrip)rgr^raws r<resolved_base_url!CredentialsFile.resolved_base_urls:""$jj$'*s3xs#44rMcURS5n[X RS3S9 X lURbBUR UR5Ul[UR URS3S9 gg)aAdopt the owning client's ``base_url`` as a fallback for the token exchange. Slots between the config file's own ``base_url`` field and the hard-coded default; a ``base_url`` in the config file still wins. The owning client binds exactly once at construction; sharing one instance across clients with different ``base_url`` values is unsupported and silently picks the last bind when the config file doesn't pin a host. r : base_urlfieldN)rr%rrr_resolve_base_urlr)rgrNbounds r< bind_base_urlCredentialsFile.bind_base_urlsq$ u'8'8&9$DE$ << #!33DLLADN 4>>D4E4E3Fj1Q R $rMcURS5(a[US5RS5$URb UR$[$)u base_url precedence: top-level config field → bound (the owning client's base_url, via :meth:`bind_base_url`) → default. Validated against the scheme/TLS rules so a malicious config with ``base_url="http://evil/"`` can't exfiltrate the assertion or refresh token.rNr)rDrYrrrrgr^s r<r!CredentialsFile._resolve_base_urlsL ::j ! !vj)*11#6 6    +'' 'rMcUR5n0nUR5RS5[:wa&URS5nU(a[ U5US'U$)zReturn headers derived from the config file (e.g. ``workspace_id``). Eagerly reads the config if not yet loaded. The returned dict is suitable for merging into the client's default headers. rQrPzanthropic-workspace-id)r _auth_blockrDr\rY)rgr^headersrPs r< extra_headersCredentialsFile.extra_headerss\ ""$"$     ! !& )-F F!::n5L47 4E01rMc URb UR$URRSS9n[R"U5n[U[5(d/[ S URS [U5R S 35e[#SU5nUR%S5n[U[5(d'[ S URS[&S[(S35e[#SU5n[+XF5 UR-U5Ul[1UR.URS3S9 UR%S5nU(a3[2R4"[7U55R95UlO[=UR 5UlX@lU$![a;n[ SURSUR <S[ S[S3 5UeSnAf[[4a!n[ S URS U35UeSnAff=f![Ra!n[ S URS U35UeSnAff=f)zPRead and cache the config file, resolving ``base_url`` and ``credentials_path``.Nutf-8encodingzConfig file not found at (profile z). Set z' to select a different profile, or set z" to relocate the config directory.zConfig file at  could not be read:  is not valid JSON: ! must contain a JSON object, not .rXauthenticationzV is missing the 'authentication' object. Expected shape: {"authentication": {"type": ""|" ", ...}, ...}rrcredentials_path)rr read_textFileNotFoundErrorr+rrrOSErrorUnicodeDecodeErrorjsonloadsJSONDecodeError isinstancedictrQrtr rDr\r]rarrr%pathlibPathrY expanduserrr()rgrr: raw_configr^raw_authr_r s r<rCredentialsFile._load_configsR << #<<  j##--w-?C j"jjoJ*d++ !$"3"3!44UVZ[eVfVoVoUppqr & 3::./(D)) !$"3"3!45-.c2F1GX  $h/ v,//7t~~0A0A/B*-MN88./ %,\\#h-%@%K%K%MD "%;DMM%JD "  U!  +D,=,=+>jHYZ"m#J>JZ[45   +, j ?43D3D2EEYZ]Y^!_`fi i j## j ?43D3D2EEYZ]Y^!_`fi i js:F#H# H-6G##H6HHI.I  Ic URceURn[RS:Xa[R"USS9n[R"UR5(a[ SUS 35e[R"UR5nUS -(a[ SUS US SUS35eUS-(a[RSUUU5 [[R"UR!SS955nUR-S5nUbRU[.:waHUR0ceUR0SR-S5n[ SU<S[.<SU<35eU$![a#n[ SUSUR <S35UeSnAf[an[ SUS U35UeSnAff=f![a#n[ SUSUR <S35UeSnAf[R"a n[ SUSU35[%U5eSnAf[&a"n[ SUSUR(S35SeSnAf[[*4an[ SUSU35UeSnAff=f)uIRead the credentials file. Re-reads on every call — daemons rotate it. Secret values in the returned dict (every string field not in ``_secrets._PLAIN_KEYS``) are :class:`SecretStr`-wrapped — unwrap with ``_unwrap_secret`` at the point of use. Writing the dict back through :meth:`_atomic_write_credentials` unwraps automatically. On Unix, verifies the file is not group/world-readable. World-readable credentials files are refused outright; group-readable files log a warning but are accepted. The check is skipped on Windows where POSIX mode bits don't carry the same meaning. NposixF)follow_symlinkszCredentials file not found at r).Credentials file at z could not be accessed: zu is a symlink; refusing to follow (move the real file into place to keep secret material on the expected filesystem).z is world-readable (mode z#oz); run `chmod 600 z` before retrying.8zMCredentials file at %s is group-readable (mode %#o); consider `chmod 600 %s`.rrrrrrrQrzcredentials file has type z ; expected z for authentication.type )rrEnamestatrr+rrS_ISLNKst_modeS_IMODEr,warningrrrrrrr type_namerrDCREDENTIALS_FILE_TYPEr)rgrW file_statr:modecredsactualr`s r<_read_credentials!CredentialsFile._read_credentialsIs%%111%% 77g  jGGD%@ ||I--..$*4&1jk<< 1 12De|$*4&0I$rS&&*V+=?e| c   b %8 4>>[b>Cc8d$eE"6"  &,A"A<<+ ++ %56::6BI ,VJkBWAZ[++4-9  i% t$'EdV:VZVcVcUffh%ijpss j$';D6AYZ]Y^%_`fii j4! p #A$zRVR_R_Qbbd!eflo o## t #7v=QRUQV!WX^nor^s s% !&tf,Mcmm_\]^ +, b #7v=QRUQV!WX^a a bs_E1,G1 F=;F F=&F88F= I. G((I.?H I.'II.I))I.cURb UR$URc[R"[S9UlUR$)zFReturn an ``httpx.Client``, lazily creating (and tracking) one we own.)timeout)rrhttpxClientr rs r<_get_http_client CredentialsFile._get_http_clientsD    ($$ $  " " *&+ll;Q&RD #&&&rMcURb!URR5 SUlURbURR5 gg)z3Close the owned ``httpx.Client`` if we created one.N)rcloserrs r<rCredentialsFile.closesK  " " .  # # ) ) +&*D #  " " .  # # ) ) + /rMc SUlSUlg)aDrop the cached config so the next call re-reads it from disk. ``CredentialsFile`` caches the parsed config across calls to keep the hot path cheap; a daemon that rotates a profile in place (e.g. flips ``"type": "user_oauth"`` to ``"type": "oidc_federation"``) will not be picked up automatically. Callers that need to react to such changes can call ``reload()`` to force a fresh read on the next ``__call__``. N)rrrs r<reloadCredentialsFile.reloads "&rMcvURceURRnURSSSS9 [R"USURR S3SS9up4[ R"US5 [ R"U[US S 95 [ R"U5 [ R"U5 [ R"X@R5 [ R "U[ R"5n[ R"U5 [ R"U5 g![ R"U5 f=f![a) [ R"U5 e![a ef=ff=f![ R"U5 f=f![a gf=f) aAAtomic write to the credentials file (NOT the config file). ``data`` may hold :class:`SecretStr` token values (see :meth:`_read_credentials`); they are unwrapped at dump time, so the on-disk format is unchanged and this frame's locals stay redacted if the write fails (e.g. ENOSPC) with a crash reporter capturing them. NTi)parentsexist_okrrz.tmp)dirprefixsuffixi)indent)rparentmkdirtempfilemkstemprrEfchmodwriterfsyncrreplace BaseExceptionunlinkropenO_RDONLY)rgdatarfdtmpdir_fds r<_atomic_write_credentials)CredentialsFile._atomic_write_credentialss^%%111''.. TDu = ""v$:P:P:U:U9VVW6Xagh   "e$0a@A  JJs22 3 WWVR[[1F !  !    #         sm)A D?56E,%F+F(F+?EE F %E<;F < F F F  F F((F++ F87F8c@UR5n[SUS5$)zEReturn the cached ``authentication`` sub-object from the config file.rXr)rr rs r<rCredentialsFile._auth_blocks$""$$f-=&>??rMFrkc UR5nURS5nU[:XaURX!S9$U[:XaUR X!S9$[ SU<SURS[<S[<S3 5e)NrQrkUnknown authentication.type  at . Expected  or r)rrDr\_call_oidc_federationr]_call_user_oauthr+r)rgrlr_r`s r<rpCredentialsFile.__call__s!HHV$ 1 1--d-P P , ,(((K K*9-tD>">"23,D1$6 '<"-- 0D(   s " '=X Y &9$))+&FG$[[0 '(\] ] \48 ^,J TYY[)J6kk/2Cm 3i-f *n,l!,o &&u- !;WWe )'EcUK#C( ) ) )(J4K[K[J\\^_ ,,&t,$C(  ) & (5cmm_IdN^N^M__uv ,,&t,   :& 'GGYZ9:  sUA I='J.3 L1=J+J&&J+. L.80K(( L.54L))L.1MMMcURceURR5(dgUR5$![a*n[ UR [ 5(aSnAgeSnAff=f)u``_read_credentials`` variant that returns ``None`` on absence instead of raising — used by the federation disk-cache path where a missing credentials file just means "exchange now". N)rexistsrr+r __cause__r)rgr:s r<_read_credentials_if_exists+CredentialsFile._read_credentials_if_exists_sj %%111%%,,.. ))+ + #--):;;  sA A5 A0/A00A5cURcURU5UlURcUR5$UR5nU(d~Ub{UR S5nUR S5nU(aQUbN[ R "5[ U5[- :a%[[[U55[U5S9$UR5nUR0U=(d 0E[[ [#UR$5UR&S.E5 U$![[4a Nmf=f![(a!n[*R-SU5 SnAU$SnAff=f)Nrrorn)rrQrroz?federation token disk-cache write-back failed (best-effort): %s)r_build_workload_delegaterr/rDr floatr#r rYrr5r6r7rr#rrrhrorr,debug)rgr_rlcachedrrorhr:s r<r %CredentialsFile._call_oidc_federationnsY  " " *&*&C&CD&ID #  ! ! )**, ,113!3!::n5LL1J  ". eJ&7:S&SS&S 1M-N[^_i[jkk '') ^  * *|71%.ekk$:"'"2"2  'z*  " ^ IIWY\ ] ]  ^s,>AD1'AE1EE E2E--E2c SSKJnJn URS5nURceURRS5nU(aU(dU"S[ <SUR 35eURS5nUbkURS5nUS :wa[S U<S 35eURS 5nU(d+[S UR<SUR SU<S35eOSnU(a [U5O [5n U"U UUURS5URRS5URS5UR5S9n U RUR5 U $)Nr rr-rRrOz%config file with authentication.type zS must include 'authentication.federation_rule_id' and top-level 'organization_id': rUr9rVzidentity_token source z- is not supported; only 'file' is implementedrWz@identity_token source 'file' requires a non-empty path; profile r z has identity_token=rrSrPrTidentity_token_providerrRrOrSrPrTr) rrr-rDrr\rr+rr2rrr) rgr_rr-rRrOidentity_token_cfgr9identity_token_pathproviderdelegates r<r2(CredentialsFile._build_workload_delegates R!XX&:;||''',,**+<=!'78Q7TUX$$%' "XX&67  )'++H5F$'=fZGt%uvv"4"8"8"@ & %#}}/tD4E4E3FFZ[mZppqs '#' =P$%89VgVi /$,1+#xx(<=)).9((7#--/  t~~.rM) rrrrrrrrrrC)r Optional[str]rOptional[httpx.Client]rZr[rZrYrZz pathlib.Path)rZr@)rNrYrZr[)r^rXrZrY)rZzDict[str, str]rZrX)rZz httpx.ClientrZr[)rrXrZr[rr)r_rXrlrsrZr )rZzOptional[Dict[str, Any]]r_rXrZr-)rtrurvrwrxripropertyrrrrrrrrrrrrrrprr/r r2ryrzrMr<r0r0s'V"&N/3 NN, N  N&!! 5 5S&  &1fFP', '(X@ 16  "OTlX` TY.`3rMr0cD\rSrSrSrSS Sjjr\S Sj5rS SjrSr g) r2izAn :class:`IdentityTokenProvider` that reads a JWT from a file on every call. Kubernetes projected service-account tokens (and similar) are rotated in place, so the file MUST be re-read on every invocation rather than cached. NcR[U5nUc[S[S35eX lg)Nz;No identity token file path given. Pass `path=` or set the z environment variable.)r)r+r!_path)rgrWresolveds r<riIdentityTokenFile.__init__s:.t4   MNeMfg()  rMcUR$rCrJrs r<rWIdentityTokenFile.paths zzrMcURRSS9R5nU(d[ SURS 35eU$![an[ SURS35UeSnAf[ a"n[ SURSUS35UeSnAf[ an[ SURS 35UeSnAf[[4a!n[ SURS U35UeSnAff=f) Nrrz!Identity token file not found at rzIdentity token file at z" is not readable by this process: z;. Check the file mode and the effective uid of the process.zIdentity token path zF is a directory, not a file. Point at the projected token file itself.rz is empty. If this is a Kubernetes projected service-account token, check the volume mount and the serviceAccountToken projection audience.) rJrstriprr+PermissionErrorIsADirectoryErrorrr)rgrr:s r<rpIdentityTokenFile.__call__s, kjj**G*<BBDG )$**6PQ  )! ] #DTZZLPQ!RSY\ \  )$**5WX[W\]LM !  &tzzl3<= +, k #:4::,FZ[^Z_!`agj j ks;'A C4A// C4<B C4&CC4C//C4rNrC)rWz$Union[str, 'os.PathLike[str]', None]rZr[rCrB) rtrurvrwrxrirGrWrpryrzrMr<r2r2s% rMr2c^\rSrSrSr\R "S5rSSS.S Sjjr\ S Sj5r \ S Sj5r \ SU4S jj5r S r U=r$)r1iu~An :class:`AccessTokenProvider` driven by an in-memory config dict (same shape as ``configs/.json``) rather than files on disk. Intended for callers that want to construct an :class:`anthropic.Anthropic` client with a fully programmatic credentials setup — equivalent to the Go SDK's ``option.WithConfig`` / TypeScript SDK's ``ClientOptions.config``. Both ``authentication.type`` discriminator values are supported: ``"oidc_federation"`` ``authentication.credentials_path`` is **optional**. If set, exchanged tokens are cached to / read from that file (same atomic 0600 write as :class:`CredentialsFile`). If omitted, every call performs a fresh jwt-bearer exchange with no on-disk cache. ``"user_oauth"`` ``authentication.credentials_path`` is **required** — it is where the access/refresh tokens live. Behaviour is identical to a file-backed :class:`CredentialsFile` profile of the same shape. The implementation subclasses :class:`CredentialsFile` so the dispatch, refresh-grant, disk-cache and atomic-write logic are shared verbatim; only config loading and identity-token resolution are overridden. zN)r:rc URS5n[U[5(d[S[S[ S35e[ SU5nURS5nU[[ 4;a [SU<S[<S [ <S 35eURS 5nU[ :XaU(d[S [ <S 35eSUlURUl SUl X0l SUl SUl X lXlU(a-[ R""[%U55R'5OSUlUR+U5Ul[/UR,SS9 g)Nrzaconfig dict is missing the 'authentication' object. Expected shape: {"authentication": {"type": "rrrXrQr r r rrzauthentication.type z requires 'authentication.credentials_path' (where the access/refresh tokens live). For profile-based resolution, use CredentialsFile instead.z zconfig: base_urlr)rDrrr+r\r]r r_IN_MEMORY_PATHrrrrr!_identity_token_provider_overriderrrrYrrrrr%)rgr^r:rrr_r`rs r<riInMemoryConfig.__init__sn::./(D)) BB[A\])*/;  $h/HHV$ 68LM M .ym<58=Q?MN &  00.2':>IM1H. Uec2B.C!D!O!O!Qko//7t~~-?@rMc8URceUR$rC)rrs r<rInMemoryConfig._load_configKs||'''||rMcSUlgrC)rrs r<rInMemoryConfig.reloadPs #'rMc >URc[TU] U5$SSKJnJn UR S5nURceURR S5nU(aU(dU"S[<S35eU"URUUUR S5URR S5UR S 5UR5S 9nURUR5 U$) Nr r8rRrOz%config dict with authentication.type zQ must include 'authentication.federation_rule_id' and top-level 'organization_id'rSrPrTr9) rXsuperr2rrr-rDrr\rrr)rgr_rr-rRrOr> __class__s r<r2'InMemoryConfig._build_workload_delegateVs  1 1 973D9 9Q!XX&:;||''',,**+<=!'78Q7TUVW /$($J$J1+#xx(<=)).9((7#--/  t~~.rM) rrrrrrrXrrr)r^rXr:zOptional[IdentityTokenProvider]rrArZr[rDrErF)rtrurvrwrxrrrWrir rrr2ry __classcell__)r`s@r<r1r1s2ll#78O DH.2 +A+A"A +A , +A  +AZ'' rMr1)r8rr9zOptional[pathlib.Path]rZz Optional[int])r^rXr_rXrZr[)I __future__rrErrr loggingrrtypingrrrrrr typing_extensionsr r_typesr r _secretsrrrrrr _constantsrrrrrrrrrrrrr r!r"r#r$r%r&r'r(r) _exceptionsr+ getLoggerrtr,__annotations__rr-__all__r=rCONFIG_FILE_VERSIONr#r\r]rar.r/r0r2r1rzrMr<ros" BB& 60*''1^16 _ "& .#'>??99"@ @ F++\m_mrM