܎jddlmZddlZddlmZddlmZmZddlm Z ddl m Z m Z m Z mZmZmZmZmZmZmZmZmZmZddlmZmZmZd d lmZd gZddZddddZ dS)) annotationsN)Optional)CredentialResultIdentityTokenProvider)WorkloadIdentityCredentials) ENV_SCOPE ENV_API_KEY ENV_PROFILEENV_AUTH_TOKENENV_CONFIG_DIRENV_WORKSPACE_IDENV_IDENTITY_TOKENENV_ORGANIZATION_IDENV_FEDERATION_RULE_IDENV_SERVICE_ACCOUNT_ID_has_active_profile_config_has_explicit_active_configresolve_identity_token_path) StaticTokenCredentialsFileIdentityTokenFile)AnthropicErrordefault_credentialsbase_urlstrreturnOptional[CredentialResult]c `tjt}tjt}t tjv}t }|r|sdS|s|dS|t|}ndd}|}t|||tjttjtpdtjt}| |t|S)zBuild a :class:`CredentialResult` for the env-var federation path (step 4 in the precedence spec). Returns ``None`` if the required trio isn't fully set.Nrrctjt}|t td|S)Nzz is not set; the workload-identity chain selected this provider at construction time but the env var is no longer present.)osenvirongetrr)values NC:\Projects\DSCons\.venv\Lib\site-packages\anthropic\lib\credentials\_chain.py_read_env_tokenz1_build_federation_result.._read_env_token1sFJNN#566E}$)--- L)identity_token_providerfederation_rule_idorganization_idservice_account_id workspace_idscopeprovider)rr)r"r#r$rrrrrrrrr bind_base_urlr)rr*r+has_literal_tokenidentity_token_pathidentity_providerr'r0s r&_build_federation_resultr5s#(>??jnn%899O*bj8577 _t !4!<t&-.ABB    ,* 1-':>>*@AAZ^^$455=jnnY''   H 8$$$ X . . ..r(zhttps://api.anthropic.comrcHtjtrdStjt}|rt t |Sttjtp#tjt}t}|s|rNt}| || }t |||jSt|}||St!rat}| | | }n#t"$rYdSwxYwt |||jSdS)uResolve a :class:`CredentialResult` from the environment per the credential-resolution spec. First match wins. Implements steps 2-5 of the spec precedence chain (step 1 is handled at the client constructor level, above this function): Step 2a: ``ANTHROPIC_API_KEY`` → return ``None`` so the client uses its existing ``X-Api-Key`` header path. (API keys are not Bearer tokens, so they can't flow through this chain.) Step 2b: ``ANTHROPIC_AUTH_TOKEN`` → :class:`StaticToken` (Bearer). Step 3: ``ANTHROPIC_PROFILE`` / ``ANTHROPIC_CONFIG_DIR`` set, or the ``active_config`` pointer file exists → load that profile. This is *explicit profile selection*; failures propagate. Step 4: ``ANTHROPIC_FEDERATION_RULE_ID`` + ``ANTHROPIC_ORGANIZATION_ID`` + ``ANTHROPIC_IDENTITY_TOKEN[_FILE]`` → direct jwt-bearer exchange via :class:`WorkloadIdentityCredentials`. Critically, step 4 sits **between** explicit profile (step 3) and fallback profile (step 5): a machine with WIF env vars wired up must use WIF even if a leftover ``default`` profile exists on disk, but a user who explicitly ``ANTHROPIC_PROFILE=dev`` still gets their profile. Step 5: Fallback active profile from disk (``configs/default.json`` or whatever ``active_config`` points at). Errors at this step are swallowed and the chain falls through — a corrupt unselected profile shouldn't break an otherwise-explicit api_key= path. Returns ``None`` when nothing matches — the client will fall back to its normal "no auth configured" error. Nr/)r0 extra_headersrr6)r"r#r$r r rrboolr r rrr1r8resolved_base_urlr5rr)r auth_token env_explicitpointer_explicit creds_filer8federation_results r&rrLs@ z~~k""t//JBZ)@)@AAAA  {33Urz~~n7U7UVVL244 ' $&&   ***"0022 '1    1(CCC$  "##  $&&   *** &4466MM   44 '1    4s%E:: FF)rrrr)! __future__rr"typingr_typesrr _workloadr _constantsr r r r r rrrrrrrr _providersrrr _exceptionsr__all__r5rr(r&rIsx"""""" ;;;;;;;;222222HGGGGGGGGG)))))) !,/,/,/,/^,GOOOOOOOOr(