"j(*SSKJr SSKrSSKrSSKrSSKJr SSKJrJ r Sr Sr Sr S r S rS rS rS rSrSrSrSrSrSrSrSrSrSrSrSrSrSrS+Sjr S,Sjr!S-Sjr"S+Sjr#S.S jr$S!S".S/S#jjr%S0S$jr&S1S%jr'S1S&jr(S2S'jr)S2S(jr*S3S4S)jjr+S2S*jr,g)5) annotationsN)Optional)AnthropicErrorCredentialsErrorz+urn:ietf:params:oauth:grant-type:jwt-bearer refresh_tokenz/v1/oauth/tokeng>@zoauth-2025-04-20zoidc-federation-2026-04-01xdefaultzhttps://api.anthropic.comANTHROPIC_API_KEYANTHROPIC_AUTH_TOKENANTHROPIC_CONFIG_DIRANTHROPIC_PROFILEANTHROPIC_IDENTITY_TOKENANTHROPIC_IDENTITY_TOKEN_FILEANTHROPIC_FEDERATION_RULE_IDANTHROPIC_ORGANIZATION_IDANTHROPIC_SERVICE_ACCOUNT_IDANTHROPIC_WORKSPACE_IDANTHROPIC_SCOPEANTHROPIC_BASE_URLcSSKJn SU3$)z`User-Agent` value sent on token-endpoint POSTs. Computed lazily so this module doesn't need to import `_version` at module load time (the credentials package is otherwise import-light). r __version__zanthropic-python/)_versionrrs a/home/mande/repo/quber/.venv/lib/python3.13/site-packages/anthropic/lib/credentials/_constants.py _user_agentr8s ( {m ,,c[RR[5nU(a[R "U5$[ RS:Xae[RRS5nU(a[R "U5O#[R R5S- S- nUS- $[R R5S- S- $)u5Resolve the config directory. `ANTHROPIC_CONFIG_DIR` env var → platform default. Platform defaults: * Linux & macOS: `~/.config/anthropic/` — XDG-style on both platforms for consistency across SDKs (macOS does **not** use `~/Library/Application Support/`). * Windows: `%APPDATA%\Anthropic\` win32APPDATAAppDataRoaming Anthropicz.config anthropic) osenvirongetENV_CONFIG_DIRpathlibPathsysplatformhome)envappdatabases r _config_dirr2Cs **.. (C ||C   ||w**..+(/w||G$W\\5F5F5H95TW`5`k!! <<    *[ 88rc[5S- RSS9R5nU=(d S$![a gf=f)zpReturn the stripped contents of `/active_config`, or `None` if the pointer file is missing or empty. active_configzutf-8)encodingN)r2 read_textstripOSError)names r_read_active_config_pointerr:XsJ /::G:LRRT <4 s(5 AAc[RR[5nU(a[ U[S9 U$[ 5nUc[ $[ USS9 U$)uResolve the active profile name. `ANTHROPIC_PROFILE` env var → `/active_config` pointer file → `"default"` literal. The resolved name is validated against path- traversal patterns before being returned. sourcezactive_config pointer file)r&r'r( ENV_PROFILE_validate_profile_namer:DEFAULT_PROFILE)r/r9s r_active_profilerAbsK **.. %C s;7 & (D |4(DE KrcUR5RS5nURS5(agURS5(ag[USU<S35e)a!Reject non-`https://` token-endpoint URLs. Localhost is allowed for testing so `base_url="http://localhost:8080"` works against a local `oauth_server` instance; everything else must be TLS-encrypted because the body of these POSTs carries the assertion JWT or a long-lived refresh token. /zhttps://N)zhttp://localhostzhttp://127.0.0.1z http://[::1]z must use https (got z^); the token-exchange endpoint carries secret material and cannot be used over cleartext HTTP.)lowerrstrip startswithr)urlfieldlowereds r_require_httpsrJtshiik  %G*%%RSS  '&sg.J K rz profile namer<c tU(d[US35eXR5:wa[USU<S35eURS5(a[USU<S35eSS[R4H'nU(dM X ;dM[USU<SU<S35e S U;a[USU<S 35eg ) aReject profile names that could escape the config directory. Profile names come from user-controlled sources (`ANTHROPIC_PROFILE`, the `active_config` pointer file, `CredentialsFile(profile=...)`) and are interpolated into filesystem paths. A value like `"../../etc/shadow"` would otherwise let a read of `configs/.json` escape the config root entirely. Pass `source=` so the error message names where the bad value came from. z must not be empty. z$ has leading or trailing whitespace..z must not start with a dot.rC\um must not contain path separators — profiles are filenames under the config directory. Pick a name without z must not contain null bytes.N)rr7rFr&sep)profiler=rPs rr?r?s &)<=>>--/!&7+5YZ[[#&7+5PQRRT266" 33>"(!G;'ZZ]Y``ac # &7+5RSTTrcURSS9nURSS9nURU5 U$![an[SUSUS35UeSnAff=f)uAssert `candidate` resolves to a descendant of `base`, return it verbatim. The containment check uses `resolve(strict=False)` on both sides so symlinks and `..` segments are normalized for the purposes of escape detection. The returned path is the *original* (unresolved) candidate — callers that care about symlink following must handle it themselves (e.g. `os.stat(follow_symlinks=False)`). F)strictzResolved path z escapes config directory rMN)resolve relative_to ValueErrorr)r1 candidate base_resolvedcandidate_resolvederrs r_resolve_underr[s{LLL.M"**%*8y&&}5  y0B/CC]^k]llmnouxxys3 AAAcT[U5 [5n[XS- US3- 5$)zAPath to `/configs/.json` (non-secret, 0644).configs.jsonr?r2r[rQr1s r_config_file_pathras-7# =D $y 0gYe3D D EErcT[U5 [5n[XS- US3- 5$)zAPath to `/credentials/.json` (secret, 0600). credentialsr^r_r`s r_credentials_file_pathrds-7# =D $} 4'%7H H IIrcr[[55R5$![[4a gf=f)axTighter auto-discover check for the tier-1 credential chain. Returns `True` only if the *active* profile's config file exists. The previous version returned `True` for any `.json` under `configs/`, which meant a stray `configs/work.json` on disk was enough to steer `default_credentials()` into reading `configs/default.json` and failing because `default.json` wasn't there. F)rarAis_filer8rrr_has_active_profile_configrhs5 !23;;== ^ $s #66c[5SL$)usTrue if the user wrote a non-empty `active_config` pointer file. This is an explicit opt-in signal equivalent to setting `ANTHROPIC_PROFILE`: the user has told us which profile to load. If the target config file is missing or malformed, the chain should surface that error rather than silently falling through — matching how `ANTHROPIC_PROFILE=missing` behaves today. N)r:rgrr_has_explicit_active_configrjs ' ( 44rcUb[R"U5$[RR [ 5nU(a[R"U5$g)u8ctor arg → `ANTHROPIC_IDENTITY_TOKEN_FILE` → `None`.N)r*r+r&r'r(ENV_IDENTITY_TOKEN_FILE)pathr/s rresolve_identity_token_pathrns? ||D!! **..0 1C ||C  rc[RR[5(d([RR[5(ag[ 5(ag[RR[ 5(ay[RR[5(aQ[RR[5(d([RR[5(agg)uTrue if the environment / filesystem contains signals that would normally drive the tier-1 (profile) or tier-2 (env federation) paths of `default_credentials`. Used by the shadow-warning detection in the client constructor: if a static `ANTHROPIC_API_KEY` / `ANTHROPIC_AUTH_TOKEN` is set alongside any of these signals, the auto-discovery would have yielded a credential but got silently shadowed — and the user should know. TF) r&r'r(r>r)rjENV_FEDERATION_RULE_IDENV_ORGANIZATION_IDrlENV_IDENTITY_TOKENrgrr"_has_auto_discoverable_credentialsrss zz~~k""bjjnn^&D&D"$$ zz~~,--"**..AT2U2U ::>>1 2 2bjjnnEW6X6X r)returnstr)rt pathlib.Path)rtz Optional[str])rGrurHrurtNone)rQrur=rurtrw)r1rvrWrvrtrv)rQrurtrv)rtbool)N)rmzstr | os.PathLike[str] | Nonertzpathlib.Path | None)- __future__rr&r,r*typingr _exceptionsrrGRANT_TYPE_JWT_BEARERGRANT_TYPE_REFRESH_TOKENTOKEN_ENDPOINTTOKEN_EXCHANGE_TIMEOUTOAUTH_API_BETA_HEADERFEDERATION_BETA_HEADERADVISORY_REFRESH_SECONDSMANDATORY_REFRESH_SECONDSr@DEFAULT_BASE_URL ENV_API_KEYENV_AUTH_TOKENr)r>rrrlrprqENV_SERVICE_ACCOUNT_IDENV_WORKSPACE_ID ENV_SCOPE ENV_BASE_URLrr2r:rArJr?r[rardrhrjrnrsrgrrrs" ;E*" +6." '(! 09717+  # -9*$&;IU4$FJ  5r