@anthropic-ai/sdk 0.92.0 → 0.93.0

package/core/credentials.mjs

@@ -0,0 +1,259 @@
+import { getPlatformHeaders } from "../internal/detect-platform.mjs";
+import { readEnv } from "../internal/utils.mjs";
+/** Current schema version written to `configs/<profile>.json`. Absent on read ⇒ "1.0". */
+export const CONFIG_FILE_VERSION = '1.0';
+/** Current schema version written to `credentials/<profile>.json`. Absent on read ⇒ "1.0". */
+export const CREDENTIALS_FILE_VERSION = '1.0';
+const PROFILE_NAME_PATTERN = /^[A-Za-z0-9_.-]+$/;
+function validateProfileName(name) {
+    if (!name) {
+        throw new Error('profile name is empty');
+    }
+    if (name === '.' || name === '..') {
+        throw new Error(`profile name "${name}" is not allowed`);
+    }
+    if (name.includes('/') || name.includes('\\')) {
+        throw new Error(`profile name "${name}" must not contain path separators`);
+    }
+    if (!PROFILE_NAME_PATTERN.test(name)) {
+        throw new Error(`profile name "${name}" contains disallowed characters (allowed: letters, digits, '_', '.', '-')`);
+    }
+}
+/**
+ * Loads the Anthropic configuration for the given (or active) profile.
+ *
+ * Returns `null` when running in a browser or no configuration can be resolved.
+ * Otherwise, returns the configuration based on the config file and environment variables.
+ *
+ * **Profile resolution** (first match wins):
+ *   1. Explicit `profile` argument
+ *   2. `ANTHROPIC_PROFILE` environment variable
+ *   3. Contents of `<config_dir>/active_config` file
+ *   4. `"default"`
+ *
+ * **Config resolution:**
+ *   - If `<config_dir>/configs/<profile>.json` exists, it is loaded and
+ *     missing fields are filled from environment variables. Values present
+ *     in the file take precedence — env vars only fill gaps:
+ *       - `ANTHROPIC_BASE_URL` → `base_url`
+ *       - `ANTHROPIC_ORGANIZATION_ID` → `organization_id`
+ *       - `ANTHROPIC_SCOPE` → `authentication.scope`
+ *       - `ANTHROPIC_FEDERATION_RULE_ID` → `authentication.federation_rule_id` (oidc_federation)
+ *       - `ANTHROPIC_IDENTITY_TOKEN_FILE` → `authentication.identity_token` (oidc_federation)
+ *       - `ANTHROPIC_SERVICE_ACCOUNT_ID` → `authentication.service_account_id` (oidc_federation)
+ *   - If no config file exists, an `oidc_federation` config is synthesized
+ *     entirely from environment variables when both `ANTHROPIC_FEDERATION_RULE_ID`
+ *     and `ANTHROPIC_ORGANIZATION_ID` are set.
+ */
+export const loadConfig = async (profile) => {
+    var _a, _b;
+    const rootConfigPath = await getRootConfigPath();
+    if (rootConfigPath === null) {
+        return null;
+    }
+    const profileName = profile ?? (await getActiveProfileName());
+    if (profileName === null) {
+        return null;
+    }
+    validateProfileName(profileName);
+    const fs = await import('node:fs');
+    const path = await import('node:path');
+    const configPath = path.join(rootConfigPath, 'configs', `${profileName}.json`);
+    let configRaw;
+    try {
+        configRaw = await fs.promises.readFile(configPath, 'utf-8');
+    }
+    catch (err) {
+        if (err?.code !== 'ENOENT') {
+            throw new Error(`failed to read config file ${configPath}: ${err}`);
+        }
+        configRaw = null;
+    }
+    if (configRaw === null) {
+        const organizationId = readEnv('ANTHROPIC_ORGANIZATION_ID');
+        const identityTokenFile = readEnv('ANTHROPIC_IDENTITY_TOKEN_FILE');
+        const federationRuleId = readEnv('ANTHROPIC_FEDERATION_RULE_ID');
+        if (federationRuleId && organizationId) {
+            return {
+                organization_id: organizationId,
+                base_url: readEnv('ANTHROPIC_BASE_URL'),
+                authentication: {
+                    type: 'oidc_federation',
+                    federation_rule_id: federationRuleId,
+                    service_account_id: readEnv('ANTHROPIC_SERVICE_ACCOUNT_ID'),
+                    identity_token: identityTokenFile ? { source: 'file', path: identityTokenFile } : undefined,
+                    scope: readEnv('ANTHROPIC_SCOPE'),
+                },
+            };
+        }
+        return null;
+    }
+    let config;
+    try {
+        config = JSON.parse(configRaw);
+    }
+    catch (err) {
+        throw new Error(`failed to parse config file ${configPath}: ${err}`);
+    }
+    if (!config.authentication) {
+        throw new Error(`config file ${configPath} is missing "authentication"`);
+    }
+    const authType = config.authentication.type;
+    if (authType !== 'oidc_federation' && authType !== 'user_oauth') {
+        throw new Error(`authentication.type "${authType}" is not a known authentication type`);
+    }
+    // File values are authoritative; env vars only fill fields the file left unset.
+    config.organization_id ?? (config.organization_id = readEnv('ANTHROPIC_ORGANIZATION_ID'));
+    config.base_url ?? (config.base_url = readEnv('ANTHROPIC_BASE_URL'));
+    (_a = config.authentication).scope ?? (_a.scope = readEnv('ANTHROPIC_SCOPE'));
+    if (config.authentication.type === 'oidc_federation') {
+        if (!config.authentication.identity_token) {
+            const identityTokenFile = readEnv('ANTHROPIC_IDENTITY_TOKEN_FILE');
+            if (identityTokenFile) {
+                config.authentication.identity_token = {
+                    source: 'file',
+                    path: identityTokenFile,
+                };
+            }
+        }
+        // Unlike siblings using `??= readEnv()` (which leaves `undefined`), coerce
+        // to '' so the type stays `string` (always set). The downstream required
+        // check in credential-chain rejects empty, so semantics match but types are
+        // cleaner.
+        if (!config.authentication.federation_rule_id) {
+            config.authentication.federation_rule_id = readEnv('ANTHROPIC_FEDERATION_RULE_ID') ?? '';
+        }
+        (_b = config.authentication).service_account_id ?? (_b.service_account_id = readEnv('ANTHROPIC_SERVICE_ACCOUNT_ID'));
+    }
+    return config;
+};
+/**
+ * Loads the credential material for the active profile.
+ *
+ * Returns the parsed credentials or `null` when running in a browser or
+ * no credentials file can be found.
+ *
+ * **Profile resolution** (first match wins):
+ *   1. `ANTHROPIC_PROFILE` environment variable
+ *   2. Contents of `<config_dir>/active_config` file
+ *   3. `"default"`
+ *
+ * **Credentials path resolution** (first match wins):
+ *   1. `authentication.credentials_path` from the active profile's config (via {@link loadConfig})
+ *   2. `<config_dir>/credentials/<profile>.json`
+ */
+export const loadCredentials = async () => {
+    const config = await loadConfig();
+    const credentialsPath = await getCredentialsPath(config);
+    if (!credentialsPath) {
+        return null;
+    }
+    const fs = await import('node:fs');
+    let raw;
+    try {
+        raw = await fs.promises.readFile(credentialsPath, 'utf-8');
+    }
+    catch (err) {
+        if (err?.code !== 'ENOENT') {
+            throw new Error(`failed to read credentials file ${credentialsPath}: ${err}`);
+        }
+        return null;
+    }
+    let creds;
+    try {
+        creds = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`failed to parse credentials file ${credentialsPath}: ${err}`);
+    }
+    if (creds.type && creds.type !== 'oauth_token') {
+        throw new Error(`credentials file ${credentialsPath} has unsupported type "${creds.type}" (want "oauth_token")`);
+    }
+    return creds;
+};
+/**
+ * Resolves the credentials file path for the given config.
+ *
+ * Uses `authentication.credentials_path` from the config if set, otherwise
+ * falls back to `<config_dir>/credentials/<profile>.json`.
+ *
+ * Returns `null` when running in a browser or the path cannot be resolved.
+ */
+export const getCredentialsPath = async (config, profile) => {
+    if (config?.authentication.credentials_path) {
+        return config.authentication.credentials_path;
+    }
+    const rootConfigPath = await getRootConfigPath();
+    if (!rootConfigPath) {
+        return null;
+    }
+    const profileName = profile ?? (await getActiveProfileName());
+    if (!profileName) {
+        return null;
+    }
+    validateProfileName(profileName);
+    const path = await import('node:path');
+    return path.join(rootConfigPath, 'credentials', `${profileName}.json`);
+};
+const getRootConfigPath = async () => {
+    if (!supportsLocalConfigFiles()) {
+        return null;
+    }
+    const path = await import('node:path');
+    // ANTHROPIC_CONFIG_DIR is treated as a trusted path: it is set by the
+    // process operator, not by remote input, so it is not validated.
+    const configDir = readEnv('ANTHROPIC_CONFIG_DIR');
+    if (configDir) {
+        return configDir;
+    }
+    const os = getPlatformHeaders()['X-Stainless-OS'];
+    if (os === 'Windows') {
+        const appData = readEnv('APPDATA');
+        if (appData) {
+            return path.join(appData, 'Anthropic');
+        }
+        const userProfile = readEnv('USERPROFILE');
+        if (userProfile) {
+            return path.join(userProfile, 'AppData', 'Roaming', 'Anthropic');
+        }
+        // No usable Windows config root — return null so callers fall through to
+        // "no config available" rather than silently writing under C:\.
+        return null;
+    }
+    const xdgConfigHome = readEnv('XDG_CONFIG_HOME');
+    if (xdgConfigHome) {
+        return path.join(xdgConfigHome, 'anthropic');
+    }
+    const home = readEnv('HOME');
+    if (home) {
+        return path.join(home, '.config', 'anthropic');
+    }
+    return null;
+};
+const supportsLocalConfigFiles = () => {
+    const runtime = getPlatformHeaders()['X-Stainless-Runtime'];
+    return runtime === 'node' || runtime === 'deno';
+};
+const getActiveProfileName = async () => {
+    const rootConfigPath = await getRootConfigPath();
+    if (!rootConfigPath) {
+        return null;
+    }
+    const profileName = readEnv('ANTHROPIC_PROFILE');
+    if (profileName) {
+        return profileName;
+    }
+    const fs = await import('node:fs');
+    const path = await import('node:path');
+    const filePath = path.join(rootConfigPath, 'active_config');
+    try {
+        return (await fs.promises.readFile(filePath, 'utf-8')).trim() || 'default';
+    }
+    catch (err) {
+        if (err?.code !== 'ENOENT') {
+            throw new Error(`failed to read ${filePath}: ${err}`);
+        }
+        return 'default';
+    }
+};
+//# sourceMappingURL=credentials.mjs.map

package/core/credentials.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.mjs","sourceRoot":"","sources":["../src/core/credentials.ts"],"names":[],"mappings":"OAAO,EAAE,kBAAkB,EAAE;OACtB,EAAE,OAAO,EAAE;AAElB,0FAA0F;AAC1F,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AACzC,8FAA8F;AAC9F,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAgE9C,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AAEjD,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,kBAAkB,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,oCAAoC,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,iBAAiB,IAAI,4EAA4E,CAClG,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,OAAgB,EAAmC,EAAE;;IACpF,MAAM,cAAc,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACjD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,MAAM,oBAAoB,EAAE,CAAC,CAAC;IAC9D,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAEjC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,GAAG,WAAW,OAAO,CAAC,CAAC;IAC/E,IAAI,SAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,KAAK,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IACD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,cAAc,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;QAC5D,MAAM,iBAAiB,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAAC;QACnE,MAAM,gBAAgB,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;QACjE,IAAI,gBAAgB,IAAI,cAAc,EAAE,CAAC;YACvC,OAAO;gBACL,eAAe,EAAE,cAAc;gBAC/B,QAAQ,EAAE,OAAO,CAAC,oBAAoB,CAAC;gBACvC,cAAc,EAAE;oBACd,IAAI,EAAE,iBAAiB;oBACvB,kBAAkB,EAAE,gBAAgB;oBACpC,kBAAkB,EAAE,OAAO,CAAC,8BAA8B,CAAC;oBAC3D,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,SAAS;oBAC3F,KAAK,EAAE,OAAO,CAAC,iBAAiB,CAAC;iBAClC;aACF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+BAA+B,UAAU,KAAK,GAAG,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,eAAe,UAAU,8BAA8B,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC;IAC5C,IAAI,QAAQ,KAAK,iBAAiB,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,sCAAsC,CAAC,CAAC;IAC1F,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,eAAe,KAAtB,MAAM,CAAC,eAAe,GAAK,OAAO,CAAC,2BAA2B,CAAC,EAAC;IAChE,MAAM,CAAC,QAAQ,KAAf,MAAM,CAAC,QAAQ,GAAK,OAAO,CAAC,oBAAoB,CAAC,EAAC;IAClD,MAAA,MAAM,CAAC,cAAc,EAAC,KAAK,QAAL,KAAK,GAAK,OAAO,CAAC,iBAAiB,CAAC,EAAC;IAE3D,IAAI,MAAM,CAAC,cAAc,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,cAAc,EAAE,CAAC;YAC1C,MAAM,iBAAiB,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAAC;YACnE,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,CAAC,cAAc,CAAC,cAAc,GAAG;oBACrC,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,iBAAiB;iBACxB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,yEAAyE;QACzE,4EAA4E;QAC5E,WAAW;QACX,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,kBAAkB,EAAE,CAAC;YAC9C,MAAM,CAAC,cAAc,CAAC,kBAAkB,GAAG,OAAO,CAAC,8BAA8B,CAAC,IAAI,EAAE,CAAC;QAC3F,CAAC;QACD,MAAA,MAAM,CAAC,cAAc,EAAC,kBAAkB,QAAlB,kBAAkB,GAAK,OAAO,CAAC,8BAA8B,CAAC,EAAC;IACvF,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,IAA0C,EAAE;IAC9E,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,MAAM,eAAe,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,mCAAmC,eAAe,KAAK,GAAG,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAA2B,CAAC;IAChC,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,oCAAoC,eAAe,KAAK,GAAG,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,oBAAoB,eAAe,0BAA0B,KAAK,CAAC,IAAI,wBAAwB,CAChG,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,MAA8B,EAC9B,OAAgB,EACQ,EAAE;IAC1B,IAAI,MAAM,EAAE,cAAc,CAAC,gBAAgB,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC;IAChD,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACjD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,MAAM,oBAAoB,EAAE,CAAC,CAAC;IAC9D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAEjC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACvC,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,aAAa,EAAE,GAAG,WAAW,OAAO,CAAC,CAAC;AACzE,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,KAAK,IAA4B,EAAE;IAC3D,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAEvC,sEAAsE;IACtE,iEAAiE;IACjE,MAAM,SAAS,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAClD,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,EAAE,GAAG,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAClD,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QAC3C,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QACnE,CAAC;QACD,yEAAyE;QACzE,gEAAgE;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjD,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,wBAAwB,GAAG,GAAY,EAAE;IAC7C,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC,qBAAqB,CAAC,CAAC;IAC5D,OAAO,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM,CAAC;AAClD,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,KAAK,IAA4B,EAAE;IAC9D,MAAM,cAAc,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACjD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACjD,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IAC7E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,KAAK,GAAG,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC"}

package/internal/utils/time.d.mts

@@ -0,0 +1,3 @@
+/** Current time as unix epoch seconds. */
+export declare function nowAsSeconds(): number;
+//# sourceMappingURL=time.d.mts.map

package/internal/utils/time.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"time.d.mts","sourceRoot":"","sources":["../../src/internal/utils/time.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,wBAAgB,YAAY,IAAI,MAAM,CAErC"}

package/internal/utils/time.d.ts

@@ -0,0 +1,3 @@
+/** Current time as unix epoch seconds. */
+export declare function nowAsSeconds(): number;
+//# sourceMappingURL=time.d.ts.map

package/internal/utils/time.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"time.d.ts","sourceRoot":"","sources":["../../src/internal/utils/time.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,wBAAgB,YAAY,IAAI,MAAM,CAErC"}

package/internal/utils/time.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nowAsSeconds = nowAsSeconds;
+/** Current time as unix epoch seconds. */
+function nowAsSeconds() {
+    return Math.floor(Date.now() / 1000);
+}
+//# sourceMappingURL=time.js.map

package/internal/utils/time.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"time.js","sourceRoot":"","sources":["../../src/internal/utils/time.ts"],"names":[],"mappings":";;AACA,oCAEC;AAHD,0CAA0C;AAC1C,SAAgB,YAAY;IAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AACvC,CAAC"}

package/internal/utils/time.mjs

@@ -0,0 +1,5 @@
+/** Current time as unix epoch seconds. */
+export function nowAsSeconds() {
+    return Math.floor(Date.now() / 1000);
+}
+//# sourceMappingURL=time.mjs.map

package/internal/utils/time.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"time.mjs","sourceRoot":"","sources":["../../src/internal/utils/time.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,MAAM,UAAU,YAAY;IAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AACvC,CAAC"}

package/lib/credentials/credential-chain.d.mts

@@ -0,0 +1,39 @@
+import type { Fetch } from "../../internal/builtin-types.mjs";
+import { type AnthropicConfig } from "../../core/credentials.mjs";
+import type { CredentialResult } from "./types.mjs";
+/**
+ * Builds a {@link CredentialResult} from an explicit {@link AnthropicConfig}.
+ *
+ * Use this when constructing a client from an in-memory config object rather
+ * than from profile files or environment variables.
+ *
+ * For `oidc_federation`, `authentication.credentials_path` is optional —
+ * if omitted, every call performs a fresh exchange with no on-disk cache.
+ * For `user_oauth`, `authentication.credentials_path` is required (it is
+ * where the access/refresh tokens live).
+ */
+export type ResolverOptions = {
+    baseURL: string;
+    fetch: Fetch;
+    userAgent?: string | undefined;
+    onCacheWriteError?: ((err: unknown) => void) | undefined;
+    onSafetyWarning?: ((msg: string) => void) | undefined;
+};
+export declare function resolveCredentialsFromConfig(config: AnthropicConfig, options: ResolverOptions): CredentialResult;
+/**
+ * Resolves a {@link CredentialResult} from the environment. Returns `null`
+ * when no credentials can be resolved.
+ *
+ * Resolution order:
+ *
+ *   1. Config file for the active profile (or the explicit `profile` argument)
+ *      → dispatch on `authentication.type` (`oidc_federation`, `user_oauth`)
+ *   2. Environment variables `ANTHROPIC_FEDERATION_RULE_ID` +
+ *      `ANTHROPIC_ORGANIZATION_ID` (+ identity token) → OIDC federation
+ *   3. Nothing matches → `null`
+ *
+ * Passing `profile` selects `<config_dir>/configs/<profile>.json` directly,
+ * skipping `ANTHROPIC_PROFILE` / `active_config` resolution.
+ */
+export declare function defaultCredentials(options: ResolverOptions, profile?: string): Promise<CredentialResult | null>;
+//# sourceMappingURL=credential-chain.d.mts.map

package/lib/credentials/credential-chain.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-chain.d.mts","sourceRoot":"","sources":["../../src/lib/credentials/credential-chain.ts"],"names":[],"mappings":"OAAO,KAAK,EAAE,KAAK,EAAE;OAEd,EAIL,KAAK,eAAe,EACrB;OACM,KAAK,EAAuB,gBAAgB,EAAyB;AAY5E;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,iBAAiB,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IACzD,eAAe,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CACvD,CAAC;AAEF,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,eAAe,GACvB,gBAAgB,CAkBlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,eAAe,EACxB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAsBlC"}

package/lib/credentials/credential-chain.d.ts

@@ -0,0 +1,39 @@
+import type { Fetch } from "../../internal/builtin-types.js";
+import { type AnthropicConfig } from "../../core/credentials.js";
+import type { CredentialResult } from "./types.js";
+/**
+ * Builds a {@link CredentialResult} from an explicit {@link AnthropicConfig}.
+ *
+ * Use this when constructing a client from an in-memory config object rather
+ * than from profile files or environment variables.
+ *
+ * For `oidc_federation`, `authentication.credentials_path` is optional —
+ * if omitted, every call performs a fresh exchange with no on-disk cache.
+ * For `user_oauth`, `authentication.credentials_path` is required (it is
+ * where the access/refresh tokens live).
+ */
+export type ResolverOptions = {
+    baseURL: string;
+    fetch: Fetch;
+    userAgent?: string | undefined;
+    onCacheWriteError?: ((err: unknown) => void) | undefined;
+    onSafetyWarning?: ((msg: string) => void) | undefined;
+};
+export declare function resolveCredentialsFromConfig(config: AnthropicConfig, options: ResolverOptions): CredentialResult;
+/**
+ * Resolves a {@link CredentialResult} from the environment. Returns `null`
+ * when no credentials can be resolved.
+ *
+ * Resolution order:
+ *
+ *   1. Config file for the active profile (or the explicit `profile` argument)
+ *      → dispatch on `authentication.type` (`oidc_federation`, `user_oauth`)
+ *   2. Environment variables `ANTHROPIC_FEDERATION_RULE_ID` +
+ *      `ANTHROPIC_ORGANIZATION_ID` (+ identity token) → OIDC federation
+ *   3. Nothing matches → `null`
+ *
+ * Passing `profile` selects `<config_dir>/configs/<profile>.json` directly,
+ * skipping `ANTHROPIC_PROFILE` / `active_config` resolution.
+ */
+export declare function defaultCredentials(options: ResolverOptions, profile?: string): Promise<CredentialResult | null>;
+//# sourceMappingURL=credential-chain.d.ts.map

package/lib/credentials/credential-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-chain.d.ts","sourceRoot":"","sources":["../../src/lib/credentials/credential-chain.ts"],"names":[],"mappings":"OAAO,KAAK,EAAE,KAAK,EAAE;OAEd,EAIL,KAAK,eAAe,EACrB;OACM,KAAK,EAAuB,gBAAgB,EAAyB;AAY5E;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,iBAAiB,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IACzD,eAAe,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CACvD,CAAC;AAEF,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,eAAe,GACvB,gBAAgB,CAkBlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,eAAe,EACxB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAsBlC"}

package/lib/credentials/credential-chain.js

@@ -0,0 +1,237 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveCredentialsFromConfig = resolveCredentialsFromConfig;
+exports.defaultCredentials = defaultCredentials;
+const env_1 = require("../../internal/utils/env.js");
+const credentials_1 = require("../../core/credentials.js");
+const types_1 = require("./types.js");
+const time_1 = require("../../internal/utils/time.js");
+const identity_token_1 = require("./identity-token.js");
+const oidc_federation_1 = require("./oidc-federation.js");
+const user_oauth_1 = require("./user-oauth.js");
+function resolveCredentialsFromConfig(config, options) {
+    const credentialsPath = config.authentication.credentials_path ?? null;
+    const effectiveBaseURL = (config.base_url || options.baseURL).replace(/\/+$/, '');
+    const provider = buildProvider(config, credentialsPath, effectiveBaseURL, options);
+    const extraHeaders = {};
+    // Workspace scoping for oidc_federation is server-side (the federation rule
+    // encodes the workspace and the minted token is workspace-scoped), so the
+    // header is only meaningful for user_oauth.
+    if (config.workspace_id && config.authentication.type === 'user_oauth') {
+        extraHeaders['anthropic-workspace-id'] = config.workspace_id;
+    }
+    // Surface the profile's own base_url (not the options.baseURL fallback) so
+    // the client can adopt it for outbound API requests when the caller didn't
+    // pin one explicitly. Echoing options.baseURL back would defeat precedence.
+    return { provider, extraHeaders, baseURL: config.base_url || undefined };
+}
+/**
+ * Resolves a {@link CredentialResult} from the environment. Returns `null`
+ * when no credentials can be resolved.
+ *
+ * Resolution order:
+ *
+ *   1. Config file for the active profile (or the explicit `profile` argument)
+ *      → dispatch on `authentication.type` (`oidc_federation`, `user_oauth`)
+ *   2. Environment variables `ANTHROPIC_FEDERATION_RULE_ID` +
+ *      `ANTHROPIC_ORGANIZATION_ID` (+ identity token) → OIDC federation
+ *   3. Nothing matches → `null`
+ *
+ * Passing `profile` selects `<config_dir>/configs/<profile>.json` directly,
+ * skipping `ANTHROPIC_PROFILE` / `active_config` resolution.
+ */
+async function defaultCredentials(options, profile) {
+    const config = await (0, credentials_1.loadConfig)(profile);
+    if (!config) {
+        return null;
+    }
+    // For env/file-loaded configs, default credentials_path to the
+    // per-profile location so user_oauth and federation caching work.
+    // Shallow-clone first so callers that retain a reference to the loaded
+    // config don't observe the patched-in default.
+    const withPath = config.authentication.credentials_path ?
+        config
+        : {
+            ...config,
+            authentication: {
+                ...config.authentication,
+                credentials_path: (await (0, credentials_1.getCredentialsPath)(config, profile)) ?? undefined,
+            },
+        };
+    return resolveCredentialsFromConfig(withPath, options);
+}
+function buildProvider(config, credentialsPath, baseURL, options) {
+    switch (config.authentication.type) {
+        case 'oidc_federation': {
+            const auth = config.authentication;
+            const identityProvider = resolveIdentityTokenProvider(auth);
+            if (!identityProvider) {
+                throw new types_1.WorkloadIdentityError('oidc_federation config requires an identity token (set authentication.identity_token, ' +
+                    'ANTHROPIC_IDENTITY_TOKEN_FILE, or ANTHROPIC_IDENTITY_TOKEN)');
+            }
+            if (!auth.federation_rule_id) {
+                throw new types_1.WorkloadIdentityError("oidc_federation config requires 'federation_rule_id'. Set it in authentication.federation_rule_id in your profile, or via ANTHROPIC_FEDERATION_RULE_ID (profile takes precedence).");
+            }
+            if (!config.organization_id) {
+                throw new types_1.WorkloadIdentityError('oidc_federation config requires organization_id (set ANTHROPIC_ORGANIZATION_ID or config.organization_id)');
+            }
+            const exchange = (0, oidc_federation_1.oidcFederationProvider)({
+                identityTokenProvider: identityProvider,
+                federationRuleId: auth.federation_rule_id,
+                organizationId: config.organization_id,
+                serviceAccountId: auth.service_account_id,
+                baseURL,
+                fetch: options.fetch,
+                userAgent: options.userAgent,
+            });
+            // If there's a credentials file path, wrap the exchange with file caching
+            // (check file for fresh token before exchanging, write back after).
+            if (credentialsPath) {
+                return cachedExchangeProvider(exchange, credentialsPath, options.onCacheWriteError, options.onSafetyWarning);
+            }
+            return exchange;
+        }
+        case 'user_oauth': {
+            if (!credentialsPath) {
+                throw new types_1.WorkloadIdentityError('user_oauth config requires authentication.credentials_path ' +
+                    '(or load via a profile so it defaults to <config_dir>/credentials/<profile>.json)');
+            }
+            return (0, user_oauth_1.userOAuthProvider)({
+                credentialsPath,
+                clientId: config.authentication.client_id,
+                baseURL,
+                fetch: options.fetch,
+                userAgent: options.userAgent,
+                onSafetyWarning: options.onSafetyWarning,
+            });
+        }
+        default: {
+            const t = config.authentication.type;
+            throw new types_1.WorkloadIdentityError(`authentication.type "${t}" is not a known authentication type`);
+        }
+    }
+}
+/**
+ * Resolves the identity token provider from config fields or environment variables.
+ *
+ * Resolution order:
+ *   1. `identity_token.path` from the config (source: "file")
+ *   2. `ANTHROPIC_IDENTITY_TOKEN_FILE` env var
+ *   3. `ANTHROPIC_IDENTITY_TOKEN` env var (static value)
+ */
+function resolveIdentityTokenProvider(auth) {
+    if (auth.identity_token) {
+        // Cast needed to stringify an unknown source value for the error message:
+        // the on-disk JSON may contain a source this SDK version doesn't know about.
+        const source = auth.identity_token.source;
+        if (source !== 'file') {
+            throw new types_1.WorkloadIdentityError(`identity_token.source "${source}" is not supported by this SDK version (only "file")`);
+        }
+        if (!auth.identity_token.path) {
+            throw new types_1.WorkloadIdentityError(`identity_token.source "file" requires a non-empty path`);
+        }
+        return (0, identity_token_1.identityTokenFromFile)(auth.identity_token.path);
+    }
+    const tokenFile = (0, env_1.readEnv)('ANTHROPIC_IDENTITY_TOKEN_FILE');
+    if (tokenFile) {
+        return (0, identity_token_1.identityTokenFromFile)(tokenFile);
+    }
+    const tokenValue = (0, env_1.readEnv)('ANTHROPIC_IDENTITY_TOKEN');
+    if (tokenValue) {
+        return (0, identity_token_1.identityTokenFromValue)(tokenValue);
+    }
+    return null;
+}
+/**
+ * Wraps a federation exchange provider with credential file caching.
+ * Checks the file for a fresh token before exchanging, and writes the
+ * result back after a successful exchange (best-effort, atomic replace).
+ *
+ * Note: this is not cross-process serialized — two SDK instances that
+ * miss the cache simultaneously will both perform a full exchange and
+ * the last writer wins. That is acceptable: federation exchanges are
+ * idempotent and the cache is an optimization, not a correctness gate.
+ */
+function cachedExchangeProvider(exchange, credentialsPath, onCacheWriteError, onSafetyWarning) {
+    return async (opts) => {
+        const fs = await Promise.resolve().then(() => __importStar(require('node:fs')));
+        await (0, types_1.checkCredentialsFileSafety)(credentialsPath, onSafetyWarning);
+        // Try cached credentials file
+        let existing;
+        try {
+            const raw = await fs.promises.readFile(credentialsPath, 'utf-8');
+            existing = JSON.parse(raw);
+            const token = existing?.['access_token'];
+            if (token && !opts?.forceRefresh) {
+                const expiresAt = existing?.['expires_at'];
+                if (expiresAt == null || (0, time_1.nowAsSeconds)() < expiresAt - types_1.MANDATORY_REFRESH_THRESHOLD_IN_SECONDS) {
+                    return { token, expiresAt: expiresAt ?? null };
+                }
+            }
+        }
+        catch (err) {
+            // ENOENT or invalid-JSON → no usable cache, exchange fresh. Other
+            // errors (EACCES, EISDIR, …) indicate a broken cache path; surface to
+            // the optional hook so they're at least debuggable, then proceed.
+            const code = err?.code;
+            if (code !== 'ENOENT' && !(err instanceof SyntaxError)) {
+                onCacheWriteError?.(err);
+            }
+        }
+        // Exchange for a new token
+        const result = await exchange(opts);
+        // Write cache back (best-effort). Preserve any unknown keys from the
+        // existing file (notably refresh_token, in the unlikely case this path
+        // is shared with a user_oauth profile) so the federation cache writer
+        // doesn't clobber material it didn't own.
+        try {
+            await (0, types_1.writeCredentialsFileAtomic)(credentialsPath, {
+                ...(existing ?? {}),
+                version: credentials_1.CREDENTIALS_FILE_VERSION,
+                type: 'oauth_token',
+                access_token: result.token,
+                expires_at: result.expiresAt,
+            });
+        }
+        catch (err) {
+            // Best-effort caching: surface to the optional hook but never fail
+            // the exchange itself.
+            onCacheWriteError?.(err);
+        }
+        return result;
+    };
+}
+//# sourceMappingURL=credential-chain.js.map

package/lib/credentials/credential-chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-chain.js","sourceRoot":"","sources":["../../src/lib/credentials/credential-chain.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,oEAqBC;AAiBD,gDAyBC;AArGD,qDAAmD;AACnD,2DAKgC;AAEhC,sCAKiB;AACjB,uDAAyD;AACzD,wDAAiF;AACjF,0DAA2D;AAC3D,gDAAiD;AAqBjD,SAAgB,4BAA4B,CAC1C,MAAuB,EACvB,OAAwB;IAExB,MAAM,eAAe,GAAG,MAAM,CAAC,cAAc,CAAC,gBAAgB,IAAI,IAAI,CAAC;IACvE,MAAM,gBAAgB,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAElF,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAEnF,MAAM,YAAY,GAA2B,EAAE,CAAC;IAChD,4EAA4E;IAC5E,0EAA0E;IAC1E,4CAA4C;IAC5C,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,cAAc,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACvE,YAAY,CAAC,wBAAwB,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC;IAC/D,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACI,KAAK,UAAU,kBAAkB,CACtC,OAAwB,EACxB,OAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAU,EAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+DAA+D;IAC/D,kEAAkE;IAClE,uEAAuE;IACvE,+CAA+C;IAC/C,MAAM,QAAQ,GACZ,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC;QACtC,MAAM;QACR,CAAC,CAAC;YACE,GAAG,MAAM;YACT,cAAc,EAAE;gBACd,GAAG,MAAM,CAAC,cAAc;gBACxB,gBAAgB,EAAE,CAAC,MAAM,IAAA,gCAAkB,EAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,SAAS;aAC3E;SACF,CAAC;IAEN,OAAO,4BAA4B,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,aAAa,CACpB,MAAuB,EACvB,eAA8B,EAC9B,OAAe,EACf,OAAwB;IAExB,QAAQ,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACnC,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,CAAC;YACnC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;YAC5D,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,MAAM,IAAI,6BAAqB,CAC7B,wFAAwF;oBACtF,6DAA6D,CAChE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC7B,MAAM,IAAI,6BAAqB,CAC7B,oLAAoL,CACrL,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;gBAC5B,MAAM,IAAI,6BAAqB,CAC7B,2GAA2G,CAC5G,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,IAAA,wCAAsB,EAAC;gBACtC,qBAAqB,EAAE,gBAAgB;gBACvC,gBAAgB,EAAE,IAAI,CAAC,kBAAkB;gBACzC,cAAc,EAAE,MAAM,CAAC,eAAe;gBACtC,gBAAgB,EAAE,IAAI,CAAC,kBAAkB;gBACzC,OAAO;gBACP,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC,CAAC;YAEH,0EAA0E;YAC1E,oEAAoE;YACpE,IAAI,eAAe,EAAE,CAAC;gBACpB,OAAO,sBAAsB,CAC3B,QAAQ,EACR,eAAe,EACf,OAAO,CAAC,iBAAiB,EACzB,OAAO,CAAC,eAAe,CACxB,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,MAAM,IAAI,6BAAqB,CAC7B,6DAA6D;oBAC3D,mFAAmF,CACtF,CAAC;YACJ,CAAC;YACD,OAAO,IAAA,8BAAiB,EAAC;gBACvB,eAAe;gBACf,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS;gBACzC,OAAO;gBACP,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,eAAe,EAAE,OAAO,CAAC,eAAe;aACzC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,CAAC,GAAI,MAAM,CAAC,cAAmC,CAAC,IAAI,CAAC;YAC3D,MAAM,IAAI,6BAAqB,CAAC,wBAAwB,CAAC,sCAAsC,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,4BAA4B,CACnC,IAA6E;IAE7E,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,0EAA0E;QAC1E,6EAA6E;QAC7E,MAAM,MAAM,GAAI,IAAI,CAAC,cAAqC,CAAC,MAAM,CAAC;QAClE,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,6BAAqB,CAC7B,0BAA0B,MAAM,sDAAsD,CACvF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,6BAAqB,CAAC,wDAAwD,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,IAAA,sCAAqB,EAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,SAAS,GAAG,IAAA,aAAO,EAAC,+BAA+B,CAAC,CAAC;IAC3D,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,IAAA,sCAAqB,EAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,UAAU,GAAG,IAAA,aAAO,EAAC,0BAA0B,CAAC,CAAC;IACvD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,IAAA,uCAAsB,EAAC,UAAU,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,sBAAsB,CAC7B,QAA6B,EAC7B,eAAuB,EACvB,iBAAuD,EACvD,eAAoD;IAEpD,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE;QACpB,MAAM,EAAE,GAAG,wDAAa,SAAS,GAAC,CAAC;QAEnC,MAAM,IAAA,kCAA0B,EAAC,eAAe,EAAE,eAAe,CAAC,CAAC;QAEnE,8BAA8B;QAC9B,IAAI,QAA6C,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YACjE,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,cAAc,CAAuB,CAAC;YAC/D,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;gBACjC,MAAM,SAAS,GAAG,QAAQ,EAAE,CAAC,YAAY,CAAuB,CAAC;gBACjE,IAAI,SAAS,IAAI,IAAI,IAAI,IAAA,mBAAY,GAAE,GAAG,SAAS,GAAG,8CAAsC,EAAE,CAAC;oBAC7F,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,IAAI,IAAI,EAAE,CAAC;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,kEAAkE;YAClE,sEAAsE;YACtE,kEAAkE;YAClE,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;YAClD,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,YAAY,WAAW,CAAC,EAAE,CAAC;gBACvD,iBAAiB,EAAE,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEpC,qEAAqE;QACrE,uEAAuE;QACvE,sEAAsE;QACtE,0CAA0C;QAC1C,IAAI,CAAC;YACH,MAAM,IAAA,kCAA0B,EAAC,eAAe,EAAE;gBAChD,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;gBACnB,OAAO,EAAE,sCAAwB;gBACjC,IAAI,EAAE,aAAa;gBACnB,YAAY,EAAE,MAAM,CAAC,KAAK;gBAC1B,UAAU,EAAE,MAAM,CAAC,SAAS;aAC7B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,uBAAuB;YACvB,iBAAiB,EAAE,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}