4Rj ddlmZddlZddlmZddlmZmZddlm Z ddl m Z m Z m Z mZmZmZmZmZmZmZmZmZmZddlmZmZmZd d lmZd gZdd Zd dddZ y)) annotationsN)Optional)CredentialResultIdentityTokenProvider)WorkloadIdentityCredentials) ENV_SCOPE ENV_API_KEY ENV_PROFILEENV_AUTH_TOKENENV_CONFIG_DIRENV_WORKSPACE_IDENV_IDENTITY_TOKENENV_ORGANIZATION_IDENV_FEDERATION_RULE_IDENV_SERVICE_ACCOUNT_ID_has_active_profile_config_has_explicit_active_configresolve_identity_token_path) StaticTokenCredentialsFileIdentityTokenFile)AnthropicErrordefault_credentialsc 4tjjt}tjjt}t tjv}t }|r|sy|s|y| t|}ndd}|}t|||tjjttjjtxsdtjjt}|j|t|S)zBuild a :class:`CredentialResult` for the env-var federation path (step 4 in the precedence spec). Returns ``None`` if the required trio isn't fully set.Ncttjjt}|t td|S)Nzz is not set; the workload-identity chain selected this provider at construction time but the env var is no longer present.)osenvirongetrr)values h/var/www/html/meridian/meridian-ai/venv/lib/python3.12/site-packages/anthropic/lib/credentials/_chain.py_read_env_tokenz1_build_federation_result.._read_env_token1s>JJNN#56E}$)*+,- L)identity_token_providerfederation_rule_idorganization_idservice_account_id workspace_idscopeprovider)returnstr)rrr rrrrrrrrr bind_base_urlr)base_urlr&r'has_literal_tokenidentity_token_pathidentity_providerr#r,s r"_build_federation_resultr4s(>?jjnn%89O*bjj857 _ !4!<&-.AB ,* 1-'::>>*@AZZ^^$45=jjnnY' H 8$ X ..r$zhttps://api.anthropic.comr0ctjjtrytjjt}|rt t |Sttjjtxs#tjjt}t}|s|rCt}|j||j}t |||jSt|}||St!rDt}|j| |j}t |||jSy#t"$rYywxYw)uResolve a :class:`CredentialResult` from the environment per the credential-resolution spec. First match wins. Implements steps 2-5 of the spec precedence chain (step 1 is handled at the client constructor level, above this function): Step 2a: ``ANTHROPIC_API_KEY`` → return ``None`` so the client uses its existing ``X-Api-Key`` header path. (API keys are not Bearer tokens, so they can't flow through this chain.) Step 2b: ``ANTHROPIC_AUTH_TOKEN`` → :class:`StaticToken` (Bearer). Step 3: ``ANTHROPIC_PROFILE`` / ``ANTHROPIC_CONFIG_DIR`` set, or the ``active_config`` pointer file exists → load that profile. This is *explicit profile selection*; failures propagate. Step 4: ``ANTHROPIC_FEDERATION_RULE_ID`` + ``ANTHROPIC_ORGANIZATION_ID`` + ``ANTHROPIC_IDENTITY_TOKEN[_FILE]`` → direct jwt-bearer exchange via :class:`WorkloadIdentityCredentials`. Critically, step 4 sits **between** explicit profile (step 3) and fallback profile (step 5): a machine with WIF env vars wired up must use WIF even if a leftover ``default`` profile exists on disk, but a user who explicitly ``ANTHROPIC_PROFILE=dev`` still gets their profile. Step 5: Fallback active profile from disk (``configs/default.json`` or whatever ``active_config`` points at). Errors at this step are swallowed and the chain falls through — a corrupt unselected profile shouldn't break an otherwise-explicit api_key= path. Returns ``None`` when nothing matches — the client will fall back to its normal "no auth configured" error. Nr+)r, extra_headersr0r5)rrr r r rrboolr r rrr/r7resolved_base_urlr4rr)r0 auth_token env_explicitpointer_explicit creds_filer7federation_results r"rrLs:@ zz~~k"/JZ)@AA  {3Urzz~~n7UVL24'$&   *"002 '11  1(C$  "#$&   * &446M '11    s7E E,+E,)r0r.r-zOptional[CredentialResult])! __future__rrtypingr_typesrr _workloadr _constantsr r r r r rrrrrrrr _providersrrr _exceptionsr__all__r4rr$r"rHsN" ;2HG) !,/^,GOr$