+
    oiv                     .   R t ^ RIt^ RIHt ^ RIt^ RIt^ RIHt ^ RIH	t	 ^ RIH
t
 ^ RIHt ^ RIHt ^ RIHt ]P                  ]P                   ]P"                  ]P$                  0tR.t]! ]R	4      '       d   ]P,                  ! 4       tM$]P0                  ! R
R4      P3                  4       R8H  t]'       d   R]
P4                   2tMR]
P4                   2tR] R2t]R,           t]R,           t]R,           t]R,           t  ! R R]PB                  4      t!R# )zTools for using the Google `Cloud Identity and Access Management (IAM)
API`_'s auth-related functionality.

.. _Cloud Identity and Access Management (IAM) API:
    https://cloud.google.com/iam/docs/
N)_exponential_backoff)_helpers)credentials)crypt)
exceptions)mtlsz#https://www.googleapis.com/auth/iamshould_use_client_cert!GOOGLE_API_USE_CLIENT_CERTIFICATEfalsetrueziamcredentials.mtls.ziamcredentials.zhttps://z!/v1/projects/-/serviceAccounts/{}z:generateAccessTokenz	:signBlobz:signJwtz:generateIdTokenc                      a  ] tR t^Ht o RtR tR t]R 4       t]	P                  ! ]P                  4      R 4       tRtV tR# )Signera  Signs messages using the IAM `signBlob API`_.

This is useful when you need to sign bytes but do not have access to the
credential's private key file.

.. _signBlob API:
    https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts
    /signBlob
c                *    Wn         W n        W0n        R# )au  
Args:
    request (google.auth.transport.Request): The object used to make
        HTTP requests.
    credentials (google.auth.credentials.Credentials): The credentials
        that will be used to authenticate the request to the IAM API.
        The credentials must have of one the following scopes:

        - https://www.googleapis.com/auth/iam
        - https://www.googleapis.com/auth/cloud-platform
    service_account_email (str): The service account email identifying
        which service account to use to sign bytes. Often, this can
        be the same as the service account email in the given
        credentials.
N)_request_credentials_service_account_email)selfrequestr   service_account_emails   &&&&r/Users/tonyclaw/.openclaw/workspace/scripts/youtube-playlists/venv/lib/python3.14/site-packages/google/auth/iam.py__init__Signer.__init__S   s       '&;#    c                t   \         P                  ! V4      pRp\        P                  \        P
                  V P                  P                  4      P                  V P                  4      pRR/p\        P                  ! R\        P                  ! V4      P                  R4      /4      P                  R4      p\         P"                  ! 4       pV F  pV P                  P%                  V P&                  W#V4       V P'                  W2WTR7      pVP(                  \*        9   d   KT  VP(                  \,        P.                  8w  d0   \0        P2                  ! RP                  VP4                  4      4      h\        P6                  ! VP4                  P                  R4      4      u # 	  \0        P2                  ! R4      h)	z(Makes a request to the API signBlob API.POSTzContent-Typezapplication/jsonpayloadzutf-8)urlmethodbodyheadersz&Error calling the IAM signBlob API: {}z#exhausted signBlob endpoint retries)r   to_bytes_IAM_SIGN_ENDPOINTreplacer   DEFAULT_UNIVERSE_DOMAINr   universe_domainformatr   jsondumpsbase64	b64encodedecodeencoder   ExponentialBackoffbefore_requestr   statusIAM_RETRY_CODEShttp_clientOKr   TransportErrordataloads)	r   messager   r   r   r   retries_responses	   &&       r   _make_signing_requestSigner._make_signing_requestg   sV   ##G, ((//1B1B1R1R

&,,
- 	 "#56zz((188AB

&/ 	 '99;A,,T]]FQ}}$}XH/1+..0 //<CCHMMR  ::hmm227;<<  ''(MNNr   c                    R# )zOptional[str]: The key ID used to identify this private key.

.. warning::
   This is always ``None``. The key ID used by IAM can not
   be reliably determined ahead of time.
N )r   s   &r   key_idSigner.key_id   s     r   c                ^    V P                  V4      p\        P                  ! VR ,          4      # )
signedBlob)r9   r(   	b64decode)r   r5   r8   s   && r   signSigner.sign   s(    --g6 677r   )r   r   r   N)__name__
__module____qualname____firstlineno____doc__r   r9   propertyr=   r   copy_docstringr   r   rB   __static_attributes____classdictcell__)__classdict__s   @r   r   r   H   sL     <(O<   U\\*8 +8r   r   )"rH   r(   http.clientclientr0   r&   osgoogle.authr   r   r   r   r   google.auth.transportr   INTERNAL_SERVER_ERRORBAD_GATEWAYSERVICE_UNAVAILABLEGATEWAY_TIMEOUTr/   
_IAM_SCOPEhasattrr   use_client_certgetenvlowerr#   _IAM_DOMAIN_IAM_BASE_URL_IAM_ENDPOINTr!   _IAM_SIGNJWT_ENDPOINT_IAM_IDTOKEN_ENDPOINTr   r<   r   r   <module>ra      s     !  	 ,   #  " & %%##	 44
 4)**113O 			5w?EEG6Q  ()L)L(MNK#K$G$G#HIK ;-'JK  66"[0 %
2 %(:: J8U\\ J8r   