
    b\jh                    ~    S r SSKJr  SSKJrJrJrJr  SSKJ	r	J
r
  \(       a  SSKJrJr  S/r\" S	S
S5      rSS jrg)u  Shared util for building a Bearer-only sub-client for a helper.

Several helpers (the environment poller, the environment worker, the session
tool runner) need to issue requests authenticated by a per-helper credential
(a self-hosted environment key, today) rather than the parent client's own
``X-Api-Key``. They each want to inherit the parent's full configuration —
``timeout``, ``max_retries``, ``http_client``, custom ``default_headers``,
``default_query`` — and override only the auth bits, plus tag every request
with their own ``x-stainless-helper`` value.

:func:`_copy_client_with_bearer_auth` is the one shared construction.
    )annotations)TYPE_CHECKINGDictTypeVarcast   )STAINLESS_HELPER_HEADERStainlessHelperHeaderValue   )	AnthropicAsyncAnthropic_copy_client_with_bearer_authClientTr   r   c                  U(       d  [        SU< 35      eU R                  US[        U0S9nSUl        [	        SUR
                  5      n[        U5       H*  nUR                  5       S;   d  M  UR                  U5        M,     U$ )u  Return a copy of ``client`` authenticated with ``auth_token`` as Bearer.

The returned sub-client inherits the parent's full configuration via
``client.copy()`` (``base_url``, ``timeout``, ``max_retries``,
``http_client``, ``default_query``, and any custom ``default_headers``).
Overrides applied:

- ``auth_token=auth_token`` — the new credential.
- ``credentials=None`` — any inherited credentials provider is cleared so
  the bearer is the unambiguous auth.
- ``default_headers`` merges in ``x-stainless-helper: <helper>`` so every
  request the sub-client issues is tagged for SDK telemetry without
  per-call plumbing.
- ``api_key=None`` — the parent's ``X-Api-Key`` is cleared via a post-hoc
  mutation; today's ``copy()`` treats ``api_key=None`` as "inherit" via
  truthy-or, so the assignment is the only way to drop the parent's API
  key from the sub-client.
- Any inherited ``Authorization`` / ``X-Api-Key`` entries in the parent's
  custom default-headers are stripped from the sub-client. They would
  otherwise win over the bearer we just set, because
  :meth:`AsyncAnthropic.default_headers` merges ``_custom_headers`` after
  ``auth_headers`` (and so beats the ``Authorization`` value produced by
  ``auth_token``).
z9Expected a non-empty value for `auth_token` but received N)
auth_tokencredentialsdefault_headerszDict[str, str])authorizationz	x-api-key)	
ValueErrorcopyr	   api_keyr   _custom_headerslistlowerpop)clientr   helperscopedcustomkeys         R/var/www/website/venv/lib/python3.13/site-packages/anthropic/lib/_scoped_client.pyr   r      s    2 TU_Tbcdd[[0&9  F
 FN ""2F4J4JKFF|99;88JJsO  M    N)r   r   r   strr   r
   returnr   )__doc__
__future__r   typingr   r   r   r   _stainless_helpersr	   r
   _clientr   r   __all__r   r    r"   r!   <module>r,      s>    # 5 5 S3 +
+ )[*:
;(r"   