4Rj(ddlmZddlZddlZddlZddlmZddlmZdZ dZ dZ d Z d Z d Zd Zd ZdZdZdZdZdZdZdZdZdZdZdZdZdZdZd+dZd,dZ d-dZ!d+dZ"d.d Z#d!d"d/d#Z$d0d$Z%d1d%Z&d1d&Z'd2d'Z(d2d(Z)d3d4d)Z*d2d*Z+y)5) annotationsN)Optional)AnthropicErrorz+urn:ietf:params:oauth:grant-type:jwt-bearer refresh_tokenz/v1/oauth/tokeng>@zoauth-2025-04-20zoidc-federation-2026-04-01xdefaultzhttps://api.anthropic.comANTHROPIC_API_KEYANTHROPIC_AUTH_TOKENANTHROPIC_CONFIG_DIRANTHROPIC_PROFILEANTHROPIC_IDENTITY_TOKENANTHROPIC_IDENTITY_TOKEN_FILEANTHROPIC_FEDERATION_RULE_IDANTHROPIC_ORGANIZATION_IDANTHROPIC_SERVICE_ACCOUNT_IDANTHROPIC_WORKSPACE_IDANTHROPIC_SCOPEANTHROPIC_BASE_URLcddlm}d|S)z``User-Agent`` value sent on token-endpoint POSTs. Computed lazily so this module doesn't need to import ``_version`` at module load time (the credentials package is otherwise import-light). r __version__zanthropic-python/)_versionrrs l/var/www/html/meridian/meridian-ai/venv/lib/python3.12/site-packages/anthropic/lib/credentials/_constants.py _user_agentr8s ( {m ,,ctjjt}|rt j |St jdk(r_tjjd}|rt j |n#tj jdz dz }|dz Stj jdz dz S)uYResolve the config directory. ``ANTHROPIC_CONFIG_DIR`` env var → platform default. Platform defaults: * Linux & macOS: ``~/.config/anthropic/`` — XDG-style on both platforms for consistency across SDKs (macOS does **not** use ``~/Library/Application Support/``). * Windows: ``%APPDATA%\Anthropic\`` win32APPDATAAppDataRoaming Anthropicz.config anthropic) osenvirongetENV_CONFIG_DIRpathlibPathsysplatformhome)envappdatabases r _config_dirr1Cs **.. (C ||C   ||w**..+(/w||G$W\\5F5F5H95TW`5`k!! <<    *[ 88rc tdz jdj}|xsdS#t$rYywxYw)zxReturn the stripped contents of ``/active_config``, or ``None`` if the pointer file is missing or empty. active_configzutf-8)encodingN)r1 read_textstripOSError)names r_read_active_config_pointerr9XsJ /::G:LRRT <4 s +3 ??ctjjt}|rt |t|St }|t St |d|S)uResolve the active profile name. ``ANTHROPIC_PROFILE`` env var → ``/active_config`` pointer file → ``"default"`` literal. The resolved name is validated against path- traversal patterns before being returned. sourcezactive_config pointer file)r%r&r' ENV_PROFILE_validate_profile_namer9DEFAULT_PROFILE)r.r8s r_active_profiler@bsK **.. %C s;7 & (D |4(DE Krc|jjd}|jdry|jdryt|d|d)a;Reject non-``https://`` token-endpoint URLs. Localhost is allowed for testing so ``base_url="http://localhost:8080"`` works against a local ``oauth_server`` instance; everything else must be TLS-encrypted because the body of these POSTs carries the assertion JWT or a long-lived refresh token. /zhttps://N)zhttp://localhostzhttp://127.0.0.1z http://[::1]z must use https (got z^); the token-exchange endpoint carries secret material and cannot be used over cleartext HTTP.)lowerrstrip startswithr)urlfieldlowereds r_require_httpsrItsbiik  %G*%RS  '&sg.J K rz profile namer;c @|st|d||jk7rt|d|d|jdrt|d|dddtjfD]}|s||vs t|d|d|dd |vrt|d|d y ) aReject profile names that could escape the config directory. Profile names come from user-controlled sources (``ANTHROPIC_PROFILE``, the ``active_config`` pointer file, ``CredentialsFile(profile=...)``) and are interpolated into filesystem paths. A value like ``"../../etc/shadow"`` would otherwise let a read of ``configs/.json`` escape the config root entirely. Pass ``source=`` so the error message names where the bad value came from. z must not be empty. z$ has leading or trailing whitespace..z must not start with a dot.rB\um must not contain path separators — profiles are filenames under the config directory. Pick a name without z must not contain null bytes.N)rr6rEr%sep)profiler<rOs rr>r>s x':;<<'--/!xq 3WXYY#xq 3NOPPT266" 3'> (!G;'ZZ]Y``ac  xq 3PQRRrc|jd}|jd} |j||S#t$r}td|d|d|d}~wwxYw)uAssert ``candidate`` resolves to a descendant of ``base``, return it verbatim. The containment check uses ``resolve(strict=False)`` on both sides so symlinks and ``..`` segments are normalized for the purposes of escape detection. The returned path is the *original* (unresolved) candidate — callers that care about symlink following must handle it themselves (e.g. ``os.stat(follow_symlinks=False)``). F)strictzResolved path z escapes config directory rLN)resolve relative_to ValueErrorr)r0 candidate base_resolvedcandidate_resolvederrs r_resolve_underrZs{LLL.M"**%*8w&&}5  w~.@-AA[\i[jjklmsvvws9 AAAcVt|t}t||dz |dz S)zCPath to ``/configs/.json`` (non-secret, 0644).configs.jsonr>r1rZrPr0s r_config_file_pathr`s/7# =D $y 0gYe3D D EErcVt|t}t||dz |dz S)zCPath to ``/credentials/.json`` (secret, 0600). credentialsr]r^r_s r_credentials_file_pathrcs/7# =D $} 4'%7H H IIrcp ttjS#ttf$rYywxYw)aTighter auto-discover check for the tier-1 credential chain. Returns ``True`` only if the *active* profile's config file exists. The previous version returned ``True`` for any ``.json`` under ``configs/``, which meant a stray ``configs/work.json`` on disk was enough to steer ``default_credentials()`` into reading ``configs/default.json`` and failing because ``default.json`` wasn't there. F)r`r@is_filer7rrr_has_active_profile_configrgs5 !23;;== ^ $s #55ctduS)uTrue if the user wrote a non-empty ``active_config`` pointer file. This is an explicit opt-in signal equivalent to setting ``ANTHROPIC_PROFILE``: the user has told us which profile to load. If the target config file is missing or malformed, the chain should surface that error rather than silently falling through — matching how ``ANTHROPIC_PROFILE=missing`` behaves today. N)r9rfrr_has_explicit_active_configris ' ( 44rc|tj|Stjj t }|rtj|Sy)u<ctor arg → ``ANTHROPIC_IDENTITY_TOKEN_FILE`` → ``None``.N)r)r*r%r&r'ENV_IDENTITY_TOKEN_FILE)pathr.s rresolve_identity_token_pathrms? ||D!! **..0 1C ||C  rctjjts#tjjtryt rytjjt rjtjjtrGtjjts#tjjtryy)uTrue if the environment / filesystem contains signals that would normally drive the tier-1 (profile) or tier-2 (env federation) paths of :func:`default_credentials`. Used by the shadow-warning detection in the client constructor: if a static ``ANTHROPIC_API_KEY`` / ``ANTHROPIC_AUTH_TOKEN`` is set alongside any of these signals, the auto-discovery would have yielded a credential but got silently shadowed — and the user should know. TF) r%r&r'r=r(riENV_FEDERATION_RULE_IDENV_ORGANIZATION_IDrkENV_IDENTITY_TOKENrfrr"_has_auto_discoverable_credentialsrrsw zz~~k"bjjnn^&D"$ zz~~,-"**..AT2U ::>>1 2bjjnnEW6X r)returnstr)rs pathlib.Path)rsz Optional[str])rFrtrGrtrsNone)rPrtr<rtrsrv)r0rurVrursru)rPrtrsru)rsbool)N)rlzstr | os.PathLike[str] | Nonerszpathlib.Path | None), __future__rr%r+r)typingr _exceptionsrGRANT_TYPE_JWT_BEARERGRANT_TYPE_REFRESH_TOKENTOKEN_ENDPOINTTOKEN_EXCHANGE_TIMEOUTOAUTH_API_BETA_HEADERFEDERATION_BETA_HEADERADVISORY_REFRESH_SECONDSMANDATORY_REFRESH_SECONDSr?DEFAULT_BASE_URL ENV_API_KEYENV_AUTH_TOKENr(r=rqrkrorpENV_SERVICE_ACCOUNT_IDENV_WORKSPACE_ID ENV_SCOPE ENV_BASE_URLrr1r9r@rIr>rZr`rcrgrirmrrrfrrrs" )E*" +6." '(! 09717+  # -9*$&;IS4$FJ  5r