"jSSKJr SSKrSSKJr SSKJrJr SSKJ r SSK J r J r J r JrJrJrJrJrJrJrJrJrJr SSKJrJrJr S S KJrJr S /rSS jr S S.SSjjr!g)) annotationsN)Optional)CredentialResultIdentityTokenProvider)WorkloadIdentityCredentials) ENV_SCOPE ENV_API_KEY ENV_PROFILEENV_AUTH_TOKENENV_CONFIG_DIRENV_WORKSPACE_IDENV_IDENTITY_TOKENENV_ORGANIZATION_IDENV_FEDERATION_RULE_IDENV_SERVICE_ACCOUNT_ID_has_active_profile_config_has_explicit_active_configresolve_identity_token_path) StaticTokenCredentialsFileIdentityTokenFile)AnthropicErrorCredentialsErrordefault_credentialsc X[RR[5n[RR[5n[ [R;n[ 5nU(aU(dgU(dUcgUb [U5nOSSjnUn[UUU[RR[5[RR[5=(d S[RR[5S9nURU5 [US9$)zBuild a `CredentialResult` for the env-var federation path (step 4 in the precedence spec). Returns `None` if the required trio isn't fully set.Ncv[RR[5nUc[ [S35eU$)Nzz is not set; the workload-identity chain selected this provider at construction time but the env var is no longer present.)osenvirongetrr)values ]/home/mande/repo/quber/.venv/lib/python3.13/site-packages/anthropic/lib/credentials/_chain.py_read_env_token1_build_federation_result.._read_env_token1s>JJNN#56E}&)*+,- L)identity_token_providerfederation_rule_idorganization_idservice_account_id workspace_idscopeprovider)returnstr)rr r!rrrrrrrrr bind_base_urlr)base_urlr(r)has_literal_tokenidentity_token_pathidentity_providerr$r.s r#_build_federation_resultr6s(>?jjnn%89O*bjj857 _ !4!<&-.AB ,* 1-'::>>*@AZZ^^$45=jjnnY' H 8$ X ..r&zhttps://api.anthropic.comr2c[RR[5(ag[RR[5nU(a[ [ U5S9$[[RR[5=(d# [RR[55n[5nU(dU(a@[5nURU5 UR5n[ UUURS9$[US9nUbU$[!5(aA[5nURU5 UR5n[ UUURS9$g!["a gf=f)u9Resolve a `CredentialResult` from the environment per the credential-resolution spec. First match wins. Implements steps 2-5 of the spec precedence chain (step 1 is handled at the client constructor level, above this function): Step 2a: `ANTHROPIC_API_KEY` → return `None` so the client uses its existing `X-Api-Key` header path. (API keys are not Bearer tokens, so they can't flow through this chain.) Step 2b: `ANTHROPIC_AUTH_TOKEN` → `StaticToken` (Bearer). Step 3: `ANTHROPIC_PROFILE` / `ANTHROPIC_CONFIG_DIR` set, or the `active_config` pointer file exists → load that profile. This is *explicit profile selection*; failures propagate. Step 4: `ANTHROPIC_FEDERATION_RULE_ID` + `ANTHROPIC_ORGANIZATION_ID` + `ANTHROPIC_IDENTITY_TOKEN[_FILE]` → direct jwt-bearer exchange via `WorkloadIdentityCredentials`. Critically, step 4 sits **between** explicit profile (step 3) and fallback profile (step 5): a machine with WIF env vars wired up must use WIF even if a leftover `default` profile exists on disk, but a user who explicitly `ANTHROPIC_PROFILE=dev` still gets their profile. Step 5: Fallback active profile from disk (`configs/default.json` or whatever `active_config` points at). Errors at this step are swallowed and the chain falls through — a corrupt unselected profile shouldn't break an otherwise-explicit api_key= path. Returns `None` when nothing matches — the client will fall back to its normal "no auth configured" error. Nr-)r. extra_headersr2r7)rr r!r r rrboolr r rrr1r9resolved_base_urlr6rr)r2 auth_token env_explicitpointer_explicit creds_filer9federation_results r#rrLs@@ zz~~k""/JZ)@AA  {3Urzz~~n7UVL24'$&   *"002 '11  1(C$  "##$&   * &446M '11    s E33 F?F)r2r0r/zOptional[CredentialResult])" __future__rrtypingr_typesrr _workloadr _constantsr r r r r rrrrrrrr _providersrrr _exceptionsrr__all__r6rr&r#rJsT" ;2HG; !,/^,GOOr&