b\j %SSKJr SSKrSSKrSSKJrJr SSKJr SSK r SSK J r SSK J r SS KJr S /r\R""\5rS \S '\R*"5r\"5rS \S'SSjrSSjrSSjr"SS \ R85rg)) annotationsN) GeneratorAsyncGenerator)override) TokenCache)asyncify)OAUTH_API_BETA_HEADERAccessTokenAuthzlogging.Loggerlogzset[str]_warn_once_seenc[ U[;a SSS5 g[RU5 SSS5 [R"U/UQ76 g!,(df  N&=f)z8Emit a log warning at most once per ``key`` per process.N)_warn_once_lockraddr warning)keymessageargss U/var/www/website/venv/lib/python3.13/site-packages/anthropic/lib/credentials/_auth.py _warn_oncersG  / !   C  KK$ s AA Ac$[SU3SU5 g)aSWarn that an explicit ``api_key=`` / ``auth_token=`` argument shadows an explicit ``credentials=`` provider passed to the same constructor or ``copy()`` call. The static credential wins at the request-header level (``AccessTokenAuth.sync_auth_flow`` short-circuits on the pre-set header), which silently disables the credentials provider. zexplicit-shadow:z`%s=` was passed alongside `credentials=`; the static credential takes precedence and the credentials provider is silently disabled. Pass only one.Nr)params r(warn_explicit_static_shadows_credentialsrs  5'"   c&[SU3SUU5 g)aWarn that an ``ANTHROPIC_API_KEY`` / ``ANTHROPIC_AUTH_TOKEN`` from the environment is shadowing the SDK's profile / federation auto-discovery. Per the credential-precedence spec, a static-credential env var silently disables the auto-discovered federation and profile paths. Surface a one-shot warning so migrating users can see why their ``ANTHROPIC_PROFILE`` or WIF env vars are being ignored. z env-shadow:z%s is set and takes precedence over the SDK's profile / federation auto-discovery; unset %s to use the auto-discovered credential.Nr)env_vars r&warn_env_static_shadows_auto_discoveryr/s" gY J rcl\rSrSrSrSrS Sjr\S Sj5rS Sjr \ SSj5r \ SSj5r S r g )r AunAdapts a :class:`TokenCache` to httpx's :class:`~httpx.Auth` protocol. Used by :meth:`anthropic.Anthropic.custom_auth` to inject ``Authorization: Bearer`` plus the OAuth beta header on every request, with proactive refresh handled by :class:`TokenCache`. Static credentials shadow federation: if the outgoing request already carries an ``X-Api-Key`` or ``Authorization`` header (set by the client's api_key / auth_token path), this auth flow is a no-op. That matches the Go SDK's ``authMiddleware`` and the documented precedence in the WIF user guide — a static ``ANTHROPIC_API_KEY`` shadows any credentials provider. FcXlgN _token_cache)self token_caches r__init__AccessTokenAuth.__init__Qs'rc[URRS5=(d URRS55$)Nz X-Api-Key Authorization)boolheadersget)requests r_has_static_credential&AccessTokenAuth._has_static_credentialTs0GOO'' 4\8K8KO8\]]rcpSU3URS'URRSS5nURS5Vs/sH)oDR5(dMUR5PM+ nn[U;a4UR [5 SR U5URS'ggs snf)NzBearer r+zanthropic-beta,z, )r-r.splitstripr appendjoin)r&r/token existing_betaflagexisting_flagss r_applyAccessTokenAuth._applyXs-4UG+<(++,sAA$A"A$r$N)r'rreturnNone)r/ httpx.RequestrGr,)r/rIr9strrGrH)r/rIrGz.Generator[httpx.Request, httpx.Response, None])r/rIrGz-AsyncGenerator[httpx.Request, httpx.Response])__name__ __module__ __qualname____firstlineno____doc__requires_response_bodyr( staticmethodr0r=rrBrE__static_attributes__rrr r AsX #(^^J   r)rrJrrJrobjectrGrH)rrJrGrH)rrJrGrH) __future__rlogging threadingtypingrrtyping_extensionsrhttpx_cacher_utilsr _constantsr __all__ getLoggerrKr __annotations__LockrsetrrrrAuthr rSrrrdst",& -  ''1^1.."E!   $:ejj:r