b\j SSKJr SSKrSSKJr SSKJrJr SSKJ r SSK J r J r J r JrJrJrJrJrJrJrJrJrJr SSKJrJrJr S S KJr S /rSS jrS S.SSjjr g)) annotationsN)Optional)CredentialResultIdentityTokenProvider)WorkloadIdentityCredentials) ENV_SCOPE ENV_API_KEY ENV_PROFILEENV_AUTH_TOKENENV_CONFIG_DIRENV_WORKSPACE_IDENV_IDENTITY_TOKENENV_ORGANIZATION_IDENV_FEDERATION_RULE_IDENV_SERVICE_ACCOUNT_ID_has_active_profile_config_has_explicit_active_configresolve_identity_token_path) StaticTokenCredentialsFileIdentityTokenFile)AnthropicErrordefault_credentialsc X[RR[5n[RR[5n[ [R;n[ 5nU(aU(dgU(dUcgUb [U5nOSSjnUn[UUU[RR[5[RR[5=(d S[RR[5S9nURU5 [US9$)zBuild a :class:`CredentialResult` for the env-var federation path (step 4 in the precedence spec). Returns ``None`` if the required trio isn't fully set.Ncv[RR[5nUc[ [S35eU$)Nzz is not set; the workload-identity chain selected this provider at construction time but the env var is no longer present.)osenvirongetrr)values V/var/www/website/venv/lib/python3.13/site-packages/anthropic/lib/credentials/_chain.py_read_env_token1_build_federation_result.._read_env_token1s>JJNN#56E}$)*+,- L)identity_token_providerfederation_rule_idorganization_idservice_account_id workspace_idscopeprovider)returnstr)rrr rrrrrrrrr bind_base_urlr)base_urlr'r(has_literal_tokenidentity_token_pathidentity_providerr#r-s r"_build_federation_resultr5s(>?jjnn%89O*bjj857 _ !4!<&-.AB ,* 1-'::>>*@AZZ^^$45=jjnnY' H 8$ X ..r%zhttps://api.anthropic.comr1c[RR[5(ag[RR[5nU(a[ [ U5S9$[[RR[5=(d# [RR[55n[5nU(dU(a@[5nURU5 UR5n[ UUURS9$[US9nUbU$[!5(aA[5nURU5 UR5n[ UUURS9$g!["a gf=f)ulResolve a :class:`CredentialResult` from the environment per the credential-resolution spec. First match wins. Implements steps 2-5 of the spec precedence chain (step 1 is handled at the client constructor level, above this function): Step 2a: ``ANTHROPIC_API_KEY`` → return ``None`` so the client uses its existing ``X-Api-Key`` header path. (API keys are not Bearer tokens, so they can't flow through this chain.) Step 2b: ``ANTHROPIC_AUTH_TOKEN`` → :class:`StaticToken` (Bearer). Step 3: ``ANTHROPIC_PROFILE`` / ``ANTHROPIC_CONFIG_DIR`` set, or the ``active_config`` pointer file exists → load that profile. This is *explicit profile selection*; failures propagate. Step 4: ``ANTHROPIC_FEDERATION_RULE_ID`` + ``ANTHROPIC_ORGANIZATION_ID`` + ``ANTHROPIC_IDENTITY_TOKEN[_FILE]`` → direct jwt-bearer exchange via :class:`WorkloadIdentityCredentials`. Critically, step 4 sits **between** explicit profile (step 3) and fallback profile (step 5): a machine with WIF env vars wired up must use WIF even if a leftover ``default`` profile exists on disk, but a user who explicitly ``ANTHROPIC_PROFILE=dev`` still gets their profile. Step 5: Fallback active profile from disk (``configs/default.json`` or whatever ``active_config`` points at). Errors at this step are swallowed and the chain falls through — a corrupt unselected profile shouldn't break an otherwise-explicit api_key= path. Returns ``None`` when nothing matches — the client will fall back to its normal "no auth configured" error. Nr,)r- extra_headersr1r6)rrr r r rrboolr r rrr0r8resolved_base_urlr5rr)r1 auth_token env_explicitpointer_explicit creds_filer8federation_results r"rrLs@@ zz~~k""/JZ)@AA  {3Urzz~~n7UVL24'$&   *"002 '11  1(C$  "##$&   * &446M '11    s E33 F?F)r1r/r.zOptional[CredentialResult])! __future__rrtypingr_typesrr _workloadr _constantsr r r r r rrrrrrrr _providersrrr _exceptionsr__all__r5rr%r"rIsT" ;2HG) !,/^,GOOr%