o î6Wj ã@s¼ddlmZddlZddlmZddlmZmZddlm Z ddl m Z m Z m Z mZmZmZmZmZmZmZmZmZmZddlmZmZmZd d lmZd gZddd„Zddœddd „Z dS)é)Ú annotationsN)ÚOptionalé)ÚCredentialResultÚIdentityTokenProvider)ÚWorkloadIdentityCredentials) Ú ENV_SCOPEÚ ENV_API_KEYÚ ENV_PROFILEÚENV_AUTH_TOKENÚENV_CONFIG_DIRÚENV_WORKSPACE_IDÚENV_IDENTITY_TOKENÚENV_ORGANIZATION_IDÚENV_FEDERATION_RULE_IDÚENV_SERVICE_ACCOUNT_IDÚ_has_active_profile_configÚ_has_explicit_active_configÚresolve_identity_token_path)Ú StaticTokenÚCredentialsFileÚIdentityTokenFileé)ÚAnthropicErrorÚdefault_credentialsÚbase_urlÚstrÚreturnúOptional[CredentialResult]c Cs¨tj t¡}tj t¡}ttjv}tƒ}|r|sdS|s"|dur"dS|dur+t|ƒ}nddd„}|}t|||tj t ¡tj t ¡pBdtj t ¡d}|  |¡t |dS) z¡Build a :class:`CredentialResult` for the env-var federation path (step 4 in the precedence spec). Returns ``None`` if the required trio isn't fully set.NrrcSs&tj t¡}|durtt›dƒ‚|S)Nzz is not set; the workload-identity chain selected this provider at construction time but the env var is no longer present.)ÚosÚenvironÚgetrr)Úvalue©r#úo/home/esfera/Documents/content_generation/venv/lib/python3.10/site-packages/anthropic/lib/credentials/_chain.pyÚ_read_env_token1s ÿz1_build_federation_result.._read_env_token)Úidentity_token_providerÚfederation_rule_idÚorganization_idÚservice_account_idÚ workspace_idÚscope©Úprovider)rr)rr r!rrrrrrrr rÚ bind_base_urlr)rr'r(Úhas_literal_tokenÚidentity_token_pathÚidentity_providerr%r-r#r#r$Ú_build_federation_results,         ÷ r2zhttps://api.anthropic.com©rcCsâtj t¡rdStj t¡}|rtt|ƒdSttj t¡p#tj t ¡ƒ}t ƒ}|s,|r@t ƒ}|  |¡|  ¡}t|||jdSt|d}|durK|Stƒrot ƒ}|  |¡z|  ¡}Wn tyfYdSwt|||jdSdS)uÔResolve a :class:`CredentialResult` from the environment per the credential-resolution spec. First match wins. Implements steps 2-5 of the spec precedence chain (step 1 is handled at the client constructor level, above this function): Step 2a: ``ANTHROPIC_API_KEY`` → return ``None`` so the client uses its existing ``X-Api-Key`` header path. (API keys are not Bearer tokens, so they can't flow through this chain.) Step 2b: ``ANTHROPIC_AUTH_TOKEN`` → :class:`StaticToken` (Bearer). Step 3: ``ANTHROPIC_PROFILE`` / ``ANTHROPIC_CONFIG_DIR`` set, or the ``active_config`` pointer file exists → load that profile. This is *explicit profile selection*; failures propagate. Step 4: ``ANTHROPIC_FEDERATION_RULE_ID`` + ``ANTHROPIC_ORGANIZATION_ID`` + ``ANTHROPIC_IDENTITY_TOKEN[_FILE]`` → direct jwt-bearer exchange via :class:`WorkloadIdentityCredentials`. Critically, step 4 sits **between** explicit profile (step 3) and fallback profile (step 5): a machine with WIF env vars wired up must use WIF even if a leftover ``default`` profile exists on disk, but a user who explicitly ``ANTHROPIC_PROFILE=dev`` still gets their profile. Step 5: Fallback active profile from disk (``configs/default.json`` or whatever ``active_config`` points at). Errors at this step are swallowed and the chain falls through — a corrupt unselected profile shouldn't break an otherwise-explicit api_key= path. Returns ``None`` when nothing matches — the client will fall back to its normal "no auth configured" error. Nr,)r-Ú extra_headersrr3)rr r!r r rrÚboolr r rrr.r4Úresolved_base_urlr2rr)rÚ auth_tokenÚ env_explicitÚpointer_explicitÚ creds_filer4Úfederation_resultr#r#r$rLsB   ý    ÿý)rrrr)!Ú __future__rrÚtypingrÚ_typesrrÚ _workloadrÚ _constantsrr r r r r rrrrrrrÚ _providersrrrÚ _exceptionsrÚ__all__r2rr#r#r#r$Ús   <  /