"j|%SSKJr SSKrSSKrSSKJrJr SSKJr SSK r SSK J r SSK J r S/r\R"\5rS \S '\R&"5r\"5rS \S 'SS jrSSjrSSjr"SS\ R45rg)) annotationsN) GeneratorAsyncGenerator)override) TokenCache)OAUTH_API_BETA_HEADERAccessTokenAuthzlogging.Loggerlogzset[str]_warn_once_seenc[ U[;a SSS5 g[RU5 SSS5 [R"U/UQ76 g!,(df  N&=f)z6Emit a log warning at most once per `key` per process.N)_warn_once_lockr addr warning)keymessageargss \/home/mande/repo/quber/.venv/lib/python3.13/site-packages/anthropic/lib/credentials/_auth.py _warn_oncersG  / !   C  KK$ s AA Ac$[SU3SU5 g)aIWarn that an explicit `api_key=` / `auth_token=` argument shadows an explicit `credentials=` provider passed to the same constructor or `copy()` call. The static credential wins at the request-header level (`AccessTokenAuth.sync_auth_flow` short-circuits on the pre-set header), which silently disables the credentials provider. zexplicit-shadow:z`%s=` was passed alongside `credentials=`; the static credential takes precedence and the credentials provider is silently disabled. Pass only one.Nr)params r(warn_explicit_static_shadows_credentialsrs  5'"   c&[SU3SUU5 g)aWarn that an `ANTHROPIC_API_KEY` / `ANTHROPIC_AUTH_TOKEN` from the environment is shadowing the SDK's profile / federation auto-discovery. Per the credential-precedence spec, a static-credential env var silently disables the auto-discovered federation and profile paths. Surface a one-shot warning so migrating users can see why their `ANTHROPIC_PROFILE` or WIF env vars are being ignored. z env-shadow:z%s is set and takes precedence over the SDK's profile / federation auto-discovery; unset %s to use the auto-discovered credential.Nr)env_vars r&warn_env_static_shadows_auto_discoveryr.s" gY J rcl\rSrSrSrSrS Sjr\S Sj5rS Sjr \ SSj5r \ SSj5r S r g )r @uIAdapts a `TokenCache` to httpx's `httpx2.Auth` protocol. Used by `anthropic.Anthropic.custom_auth` to inject `Authorization: Bearer` plus the OAuth beta header on every request, with proactive refresh handled by `TokenCache`. Static credentials shadow federation: if the outgoing request already carries an `X-Api-Key` or `Authorization` header (set by the client's api_key / auth_token path), this auth flow is a no-op. That matches the Go SDK's `authMiddleware` and the documented precedence in the WIF user guide — a static `ANTHROPIC_API_KEY` shadows any credentials provider. FcXlgN _token_cache)self token_caches r__init__AccessTokenAuth.__init__Ps'rc[URRS5=(d URRS55$)Nz X-Api-Key Authorization)boolheadersget)requests r_has_static_credential&AccessTokenAuth._has_static_credentialSs0GOO'' 4\8K8KO8\]]rcpSU3URS'URRSS5nURS5Vs/sH)oDR5(dMUR5PM+ nn[U;a4UR [5 SR U5URS'ggs snf)NzBearer r)zanthropic-beta,)r+r,splitstripr appendjoin)r$r-token existing_betaflagexisting_flagss r_applyAccessTokenAuth._applyWs-4UG+<(++,rbsq",& -  ''1^1.."E!   $7fkk7r