o 6Wj(@s"ddlmZddlZddlZddlZddlmZddlmZdZ dZ dZ d Z d Z d Zd Zd ZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdGddZdHd!d"Z dId$d%Z!dGd&d'Z"dJd+d,Z#d-d.dKd1d2Z$dLd5d6Z%dMd7d8Z&dMd9d:Z'dNdd?Z)dOdPdCdDZ*dNdEdFZ+dS)Q) annotationsN)Optional)AnthropicErrorz+urn:ietf:params:oauth:grant-type:jwt-bearer refresh_tokenz/v1/oauth/tokeng>@zoauth-2025-04-20zoidc-federation-2026-04-01xdefaultzhttps://api.anthropic.comANTHROPIC_API_KEYANTHROPIC_AUTH_TOKENANTHROPIC_CONFIG_DIRANTHROPIC_PROFILEANTHROPIC_IDENTITY_TOKENANTHROPIC_IDENTITY_TOKEN_FILEANTHROPIC_FEDERATION_RULE_IDANTHROPIC_ORGANIZATION_IDANTHROPIC_SERVICE_ACCOUNT_IDANTHROPIC_WORKSPACE_IDANTHROPIC_SCOPEANTHROPIC_BASE_URLreturnstrcCsddlm}d|S)z``User-Agent`` value sent on token-endpoint POSTs. Computed lazily so this module doesn't need to import ``_version`` at module load time (the credentials package is otherwise import-light). r __version__zanthropic-python/)_versionrrrs/home/esfera/Documents/content_generation/venv/lib/python3.10/site-packages/anthropic/lib/credentials/_constants.py _user_agent8s  r pathlib.PathcCsjtjt}|r t|Stjdkr,tjd}|rt|ntjdd}|dStjddS)uYResolve the config directory. ``ANTHROPIC_CONFIG_DIR`` env var → platform default. Platform defaults: * Linux & macOS: ``~/.config/anthropic/`` — XDG-style on both platforms for consistency across SDKs (macOS does **not** use ``~/Library/Application Support/``). * Windows: ``%APPDATA%\Anthropic\`` win32APPDATAAppDataRoaming Anthropicz.config anthropic) osenvirongetENV_CONFIG_DIRpathlibPathsysplatformhome)envappdatabaserrr _config_dirCs     r1 Optional[str]cCs8z tdjdd}Wn tyYdSw|pdS)zxReturn the stripped contents of ``/active_config``, or ``None`` if the pointer file is missing or empty. active_configzutf-8)encodingN)r1 read_textstripOSError)namerrr_read_active_config_pointerXs  r9cCsBtjt}|rt|td|St}|durtSt|dd|S)uResolve the active profile name. ``ANTHROPIC_PROFILE`` env var → ``/active_config`` pointer file → ``"default"`` literal. The resolved name is validated against path- traversal patterns before being returned. sourceNzactive_config pointer file)r%r&r' ENV_PROFILE_validate_profile_namer9DEFAULT_PROFILE)r.r8rrr_active_profilebs   r?urlfieldNonecCs>|d}|drdS|drdSt|d|d)a;Reject non-``https://`` token-endpoint URLs. Localhost is allowed for testing so ``base_url="http://localhost:8080"`` works against a local ``oauth_server`` instance; everything else must be TLS-encrypted because the body of these POSTs carries the assertion JWT or a long-lived refresh token. /zhttps://N)zhttp://localhostzhttp://127.0.0.1z http://[::1]z must use https (got z^); the token-exchange endpoint carries secret material and cannot be used over cleartext HTTP.)lowerrstrip startswithr)r@rAloweredrrr_require_httpsts  rHz profile namer:profiler;cCs|s t|d||krt|d|d|dr(t|d|dddtjfD]}|rC||vrCt|d|d|dq.d |vrRt|d|d d S) aReject profile names that could escape the config directory. Profile names come from user-controlled sources (``ANTHROPIC_PROFILE``, the ``active_config`` pointer file, ``CredentialsFile(profile=...)``) and are interpolated into filesystem paths. A value like ``"../../etc/shadow"`` would otherwise let a read of ``configs/.json`` escape the config root entirely. Pass ``source=`` so the error message names where the bad value came from. z must not be empty. z$ has leading or trailing whitespace..z must not start with a dot.rC\um must not contain path separators — profiles are filenames under the config directory. Pick a name without z must not contain null bytes.N)rr6rFr%sep)rIr;rNrrrr=s"     r=r0 candidatec CsZ|jdd}|jdd}z||W|Sty,}z td|d|d|d}~ww)uAssert ``candidate`` resolves to a descendant of ``base``, return it verbatim. The containment check uses ``resolve(strict=False)`` on both sides so symlinks and ``..`` segments are normalized for the purposes of escape detection. The returned path is the *original* (unresolved) candidate — callers that care about symlink following must handle it themselves (e.g. ``os.stat(follow_symlinks=False)``). F)strictzResolved path z escapes config directory rKN)resolve relative_to ValueErrorr)r0rO base_resolvedcandidate_resolvederrrrr_resolve_unders  rWcC&t|t}t||d|dS)zCPath to ``/configs/.json`` (non-secret, 0644).configs.jsonr=r1rWrIr0rrr_config_file_pathr]cCrX)zCPath to ``/credentials/.json`` (secret, 0600). credentialsrZr[r\rrr_credentials_file_pathr^r`boolc Cs*zttWSttfyYdSw)aTighter auto-discover check for the tier-1 credential chain. Returns ``True`` only if the *active* profile's config file exists. The previous version returned ``True`` for any ``.json`` under ``configs/``, which meant a stray ``configs/work.json`` on disk was enough to steer ``default_credentials()`` into reading ``configs/default.json`` and failing because ``default.json`` wasn't there. F)r]r?is_filer7rrrrr_has_active_profile_configs  rccCs tduS)uTrue if the user wrote a non-empty ``active_config`` pointer file. This is an explicit opt-in signal equivalent to setting ``ANTHROPIC_PROFILE``: the user has told us which profile to load. If the target config file is missing or malformed, the chain should surface that error rather than silently falling through — matching how ``ANTHROPIC_PROFILE=missing`` behaves today. N)r9rrrr_has_explicit_active_configs rdpathstr | os.PathLike[str] | Nonepathlib.Path | NonecCs0|dur t|Stjt}|rt|SdS)u<ctor arg → ``ANTHROPIC_IDENTITY_TOKEN_FILE`` → ``None``.N)r)r*r%r&r'ENV_IDENTITY_TOKEN_FILE)rer.rrrresolve_identity_token_paths    ricCs^tjts tjtrdStrdStjtr-tjtr-tjts+tjt r-dSdS)uTrue if the environment / filesystem contains signals that would normally drive the tier-1 (profile) or tier-2 (env federation) paths of :func:`default_credentials`. Used by the shadow-warning detection in the client constructor: if a static ``ANTHROPIC_API_KEY`` / ``ANTHROPIC_AUTH_TOKEN`` is set alongside any of these signals, the auto-discovery would have yielded a credential but got silently shadowed — and the user should know. TF) r%r&r'r<r(rdENV_FEDERATION_RULE_IDENV_ORGANIZATION_IDrhENV_IDENTITY_TOKENrrrr"_has_auto_discoverable_credentialss rm)rr)rr)rr2)r@rrArrrB)rIrr;rrrB)r0rrOrrr)rIrrr)rra)N)rerfrrg), __future__rr%r+r)typingr _exceptionsrGRANT_TYPE_JWT_BEARERGRANT_TYPE_REFRESH_TOKENTOKEN_ENDPOINTTOKEN_EXCHANGE_TIMEOUTOAUTH_API_BETA_HEADERFEDERATION_BETA_HEADERADVISORY_REFRESH_SECONDSMANDATORY_REFRESH_SECONDSr>DEFAULT_BASE_URL ENV_API_KEYENV_AUTH_TOKENr(r<rlrhrjrkENV_SERVICE_ACCOUNT_IDENV_WORKSPACE_ID ENV_SCOPE ENV_BASE_URLrr1r9r?rHr=rWr]r`rcrdrirmrrrrsR