"j@%SSKJr SSKrSSKrSSKrSSKJr SSKJrJ r J r J r J r J r SSKJr SSKrSSKJrJr SSKJrJrJrJrJrJr SS KJrJrJrJrJ r J!r!J"r"J#r# S S K$J%r% \S \ 3r&S r'Sr(Sr)SSjr*SSjr+SS.SSjjr,/SQr-\R\"\/5r0S\1S'"SS\%5r2"SS5r3SSSSS.S Sjjr4g)!) annotationsN) TracebackType)AnyDictTypeUnionNoReturnOptional)override) AccessTokenIdentityTokenProvider) SecretStr_unwrap_secret_strip_traceback_json_dumps_secrets_wrap_secret_fields_NonObjectPayloadError)TOKEN_ENDPOINTDEFAULT_BASE_URLGRANT_TYPE_JWT_BEAREROAUTH_API_BETA_HEADERFEDERATION_BETA_HEADERTOKEN_EXCHANGE_TIMEOUT _user_agent_require_https)AnthropicError,i@icURRS5=(d URRS5nU$)Nz Request-Idz request-id)headersget)resprids `/home/mande/repo/quber/.venv/lib/python3.13/site-packages/anthropic/lib/credentials/_workload.py _request_idr'5s/)),7Y4<<;K;KL;YC JcUcg[U[5(a5[U5[::aU$US[S[U5[- S3-$[U[5(a0nSHnX ;dM XX'M U$g)zHTruncate a token-endpoint error body for safe inclusion in an exception.Nz... )errorerror_description error_uri) isinstancestrlen_MAX_ERROR_BODY_CHARSdict)bodykeptkeys r& _redact_bodyr5:s |$ t9- -K**+c$iBW6W5XXd.eee$!>C{ I ? r()hintc[UR55nUSURSU3nU(aUSU3n[ UURU[ U5S9e![a [UR5nNbf=f)uRaise a redacted `WorkloadIdentityError` from a non-200 token-endpoint response. Shared between the jwt-bearer exchange path in this module and the refresh_token grant path in `_providers`. The raw response body (which token endpoints can echo credential material into) is never bound to a local in this frame — only the redaction is — so this frame is safe under crash reporters that capture traceback locals. `hint` is an optional caller-supplied diagnostic appended verbatim to the error message (after the redacted body). Callers gate it on the response status and their own state — this helper does not inspect `resp` for it. z (HTTP ):   status_coder2 request_id)r5json ValueErrortextr;WorkloadIdentityErrorr')r$message_prefixr6redactedmessages r&_raise_token_endpoint_errorrDLs+ ,  (8(8'9XJGG IQtf% $$ t$   + *+sAA>=A>)WorkloadIdentityCredentialsr@exchange_federation_assertionzlogging.Loggerlogc^\rSrSr%SrS\S'S\S'S\S'S S S S .SU4S jjjr\SU4S jj5rS r U=r $)r@nzCRaised when the OIDC token exchange (`POST /v1/oauth/token`) fails. Optional[int]r;rr2 Optional[str]r<Nr:cH>[TU]U5 X lX0lX@lgN)super__init__r;r2r<)selfrCr;r2r< __class__s r&rOWorkloadIdentityError.__init__us" !& $r(cj>[TU]5nUR(aUSURS3$U$)Nz [request_id=])rN__str__r<)rPbaserQs r&rUWorkloadIdentityError.__str__s3w  ??V=(9; ; r()r2r<r;) rCr.r;rJr2rr<rKreturnNonerXr.) __name__ __module__ __qualname____firstlineno____doc____annotations__rOr rU__static_attributes__ __classcell__)rQs@r&r@r@nspM I &*$( % %# %  % " %  % %r(r@c\rSrSrSrSSSSS.SSjjr\SSj5r\SSj5rSSjr SS jr SS jr SS jr SS jr S S.SSjjrSrg)rEubExchanges an external OIDC JWT for an Anthropic access token via the RFC 7523 `jwt-bearer` grant. This is an `AccessTokenProvider`: calling it performs a *fresh* token exchange. Wrap in a `TokenCache` (done automatically when passed as `credentials=` to `anthropic.Anthropic`) to avoid exchanging on every request. Args: organization_id: The organization's raw UUID string (organizations do not use tagged IDs). workspace_id: Optional `wrkspc_*` tagged ID, or the literal `"default"` to scope the token to the organization's default workspace. When omitted the server picks the rule's sole enabled workspace, else the org default if the rule covers it. Required when the rule enables more than one non-default workspace, or to target a specific workspace other than the one the server would pick. The minted token is workspace-scoped: per-request workspace selection (the `anthropic-workspace-id` header) is not supported for federation tokens — switching workspaces requires a new token exchange with a different `workspace_id`. N)service_account_id workspace_idscope http_clientcXlX lX0lX@lXPlX`lSUlUc%[R"[S9Ul SUl gXpl SUl g)N)timeoutTF) _identity_token_provider_federation_rule_id_organization_id_service_account_id _workspace_id_scope_bound_base_urlhttpx2Clientr _http_client_owns_http_client)rPidentity_token_providerfederation_rule_idorganization_idrerfrgrhs r&rO$WorkloadIdentityCredentials.__init__sb)@%#5 /#5 )  /3   & 6L MD %)D " + %*D "r(cUR$rM)rprPs r&rg!WorkloadIdentityCredentials.scopes {{r(c4UR=(d [$rM)rqrr{s r& _base_url%WorkloadIdentityCredentials._base_urls##7'77r(cFURS5n[USS9 X lg)zSet the API `base_url` the token exchange POSTs to. For standalone use (no client) or tests. Clients bind through `for_base_url`, which never rebinds an instance another client is already exchanging through. /base_url)fieldN)rstriprrq)rPrbounds r& bind_base_url)WorkloadIdentityCredentials.bind_base_urls"$uJ/$r(cURS5nUnURb-URU:wa[R"U5nSUlUR U5 U$)aReturn the provider a client with `base_url` should exchange through. Binds in place, unless another client already bound this instance to a different host (e.g. the parent of `copy(base_url=...)`). Rebinding would move that client's token exchange too, so a copy bound to `base_url` is returned instead; it shares the identity token and borrows (never closes) this instance's `httpx2.Client`. rF)rrqcopyrur)rPrrproviders r& for_base_url(WorkloadIdentityCredentials.for_base_urlsX$    +0D0D0MyyH).H &u%r(c\UR(aURR5 gg)z6Close the underlying `httpx2.Client` if we created it.N)rurtcloser{s r&r!WorkloadIdentityCredentials.closes"  ! !    # # % "r(cU$rMr{s r& __enter__%WorkloadIdentityCredentials.__enter__s r(c$UR5 grM)r)rPexc_typeexctbs r&__exit__$WorkloadIdentityCredentials.__exit__s r(F) force_refreshcA[UR55n[UR5R S55nU[ :a[ SUS[ S35e[UURURS.nURbURUS'URbURUS'UR[3nURRU[!U5["S[%5S .S 9n[-U5n[UR.5[0:a3[ S [0S[UR.5S3UR2US9eUR2S:a6Sn UR2S:XaSn URcU S- n U S- n [5USU S9 [7UR955n U RES5n U bA[GU 5RI5S:wa$[ S U <S!3UR2[=U 5US9eU S"n [KU S#5n[S[UU 5[K[VRV"55U-S%9$![&R(a n[ S US U35[+U5eSnAff=f![:aJn[=UR>5n [ SUR2SU 3UR2U US9[+U5eSnAf[@a6n[ SURBSUR2S3UR2US9SeSnAff=f![L[N[:[P4a%n[ S$UR2[=U 5US9UeSnAff=f)&Nzutf-8zIdentity token assertion is z bytes, which exceeds the u-byte limit. This is almost certainly not a JWT — check that the identity-token path points at the projected token, not a key or cert.) grant_type assertionrwrxrerfzapplication/json)zanthropic-betaz Content-Typez User-Agent)contentr"zFailed to reach token endpoint z: z%Token endpoint response body exceeds z bytes (got z); refusing to parse.)r;r<iiz9Ensure your federation rule matches your identity token. zIf your federation rule is scoped to multiple workspaces, set the ANTHROPIC_WORKSPACE_ID environment variable, the 'workspace_id' config key, or the workspace_id= argument. zaView your authentication events in the Workload identity page of Claude Console for more details.zToken exchange failed)rAr6z2Token endpoint returned non-JSON response (status r8r:zToken endpoint returned a JSON z (status z); expected an object. token_typebearerz/Token endpoint returned unsupported token_type z (expected 'Bearer'). access_token expires_inzLToken endpoint response missing required fields (access_token / expires_in).)token expires_at),rrkr/get_secret_valueencode_MAX_ASSERTION_BYTESr@rrlrmrnror~rrtpostr_JWT_BEARER_BETA_HEADERrrr HTTPErrorrr'r_MAX_TOKEN_RESPONSE_BYTESr;rDrr=r>r5r?r type_namer#r.lowerintKeyError TypeError OverflowErrorr rtime)rPrjwtassertion_bytesr2urlr$errr<r6datarBrrrs r&__call__$WorkloadIdentityCredentials.__call__s 5578c224;;GDE 1 1'..??Y'()ab 0"&":":#44 2   # # /)-)A)AD% &    )#'#5#5D   01 s$$)),D1&=$6"-- * D!& t|| 8 8'78Q7RSDLL)**?A ,,%     s " #'D3&R%%-FD w (=T[_ ` 'tyy{3D&XXl+  !c*o&;&;&=&I'A*Ode ,,!$'%   (ET,/0J!63tyy{CSV`C`aaY s'*I#bQTPU(VW]mnq]r r sJ )#DII.H'DTEUEUDVVYZbYcd ,,%  $C(  ) & (1#-- $JZJZI[[qr ,,%    .)Z? '^ ,,!$'%     sU4I%JL%J -JJ  L"AK L",1LL"%M$? MM$) rqrlrtrkrmrurprnro)rvrrwr.rxr.rerKrfrKrgrKrhOptional[httpx2.Client]rXrY)rXrKrZ)rr.rXrY)rr.rX'WorkloadIdentityCredentials')rXrY)rXr)rzOptional[Type[BaseException]]rzOptional[BaseException]rzOptional[TracebackType]rXrY)rboolrXr )r[r\r]r^r_rOpropertyrgr~rrrrrrrarr(r&rErEs:-1&*#/3!+"7!+ !+  !+ * !+$!+!+-!+ !+F88 %"& /% $   16sbsbr(rE)rerfrrhc [U[5(a [U5n[URUUUUUS9nUbUR U5 U"5UR 5 $!UR 5 f=f)aPerform a single RFC 7523 `jwt-bearer` exchange and return the resulting `AccessToken`. This is a one-shot convenience wrapper around `WorkloadIdentityCredentials` for callers that already have the assertion JWT in hand and just want the Anthropic access token back (no caching, no provider plumbing). `assertion` may be a `pydantic.SecretStr` to keep it redacted end-to-end; a plain `str` is wrapped on entry. )rvrwrxrerfrh)r-r.rrErrr)rrwrxrerfrrhcredss r&rFrFosr()S!!i( ' ) : :-'-!  E H%w  s A%%A7)r$httpx2.ResponserXrK)r2rrXr)r$rrAr.r6rKrXr )rzUnion[str, SecretStr]rwr.rxr.rerKrfrKrrKrhrrXr )5 __future__rrrloggingtypesrtypingrrrrr r typing_extensionsr rr_typesr r_secretsrrrrrr _constantsrrrrrrrr _exceptionsrrr0rrr'r5rD__all__ getLoggerr[rGr`r@rErFrr(r&rs" ==& 6   * 3315K4LM !# $fj: d''1^1N8bbbbT)-"&"+/%$%% % & %  %%)%%r(