@anthropic-ai/sdk 0.93.0 → 0.94.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +8 -0
- package/core/credentials.d.mts +20 -0
- package/core/credentials.d.mts.map +1 -1
- package/core/credentials.d.ts +20 -0
- package/core/credentials.d.ts.map +1 -1
- package/core/credentials.js +30 -11
- package/core/credentials.js.map +1 -1
- package/core/credentials.mjs +27 -9
- package/core/credentials.mjs.map +1 -1
- package/lib/credentials/credential-chain.d.mts.map +1 -1
- package/lib/credentials/credential-chain.d.ts.map +1 -1
- package/lib/credentials/credential-chain.js +18 -10
- package/lib/credentials/credential-chain.js.map +1 -1
- package/lib/credentials/credential-chain.mjs +19 -11
- package/lib/credentials/credential-chain.mjs.map +1 -1
- package/lib/credentials/oidc-federation.d.mts +12 -0
- package/lib/credentials/oidc-federation.d.mts.map +1 -1
- package/lib/credentials/oidc-federation.d.ts +12 -0
- package/lib/credentials/oidc-federation.d.ts.map +1 -1
- package/lib/credentials/oidc-federation.js +14 -1
- package/lib/credentials/oidc-federation.js.map +1 -1
- package/lib/credentials/oidc-federation.mjs +14 -1
- package/lib/credentials/oidc-federation.mjs.map +1 -1
- package/package.json +1 -1
- package/src/core/credentials.ts +39 -9
- package/src/lib/credentials/credential-chain.ts +19 -11
- package/src/lib/credentials/oidc-federation.ts +29 -1
- package/src/version.ts +1 -1
- package/version.d.mts +1 -1
- package/version.d.ts +1 -1
- package/version.js +1 -1
- package/version.mjs +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,13 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.94.0 (2026-05-05)
|
|
4
|
+
|
|
5
|
+
Full Changelog: [sdk-v0.93.0...sdk-v0.94.0](https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.93.0...sdk-v0.94.0)
|
|
6
|
+
|
|
7
|
+
### Features
|
|
8
|
+
|
|
9
|
+
* **client:** allow targeting a workspace for OIDC federation token exchange ([bde6620](https://github.com/anthropics/anthropic-sdk-typescript/commit/bde6620d68c2dd9e8e641b4cfed8847486ff046f))
|
|
10
|
+
|
|
3
11
|
## 0.93.0 (2026-05-04)
|
|
4
12
|
|
|
5
13
|
Full Changelog: [sdk-v0.92.0...sdk-v0.93.0](https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.92.0...sdk-v0.93.0)
|
package/core/credentials.d.mts
CHANGED
|
@@ -74,6 +74,7 @@ export type AnthropicCredentials = {
|
|
|
74
74
|
* in the file take precedence — env vars only fill gaps:
|
|
75
75
|
* - `ANTHROPIC_BASE_URL` → `base_url`
|
|
76
76
|
* - `ANTHROPIC_ORGANIZATION_ID` → `organization_id`
|
|
77
|
+
* - `ANTHROPIC_WORKSPACE_ID` → `workspace_id`
|
|
77
78
|
* - `ANTHROPIC_SCOPE` → `authentication.scope`
|
|
78
79
|
* - `ANTHROPIC_FEDERATION_RULE_ID` → `authentication.federation_rule_id` (oidc_federation)
|
|
79
80
|
* - `ANTHROPIC_IDENTITY_TOKEN_FILE` → `authentication.identity_token` (oidc_federation)
|
|
@@ -83,6 +84,25 @@ export type AnthropicCredentials = {
|
|
|
83
84
|
* and `ANTHROPIC_ORGANIZATION_ID` are set.
|
|
84
85
|
*/
|
|
85
86
|
export declare const loadConfig: (profile?: string) => Promise<AnthropicConfig | null>;
|
|
87
|
+
/**
|
|
88
|
+
* Source-tagged result of {@link loadConfigWithSource}. `fromFile` is `true`
|
|
89
|
+
* when `<config_dir>/configs/<profile>.json` exists on disk; `false` when the
|
|
90
|
+
* config was synthesized purely from environment variables.
|
|
91
|
+
*
|
|
92
|
+
* The credential chain uses this distinction to decide whether to back the
|
|
93
|
+
* federation exchange with a disk cache: file-backed profiles get a cache at
|
|
94
|
+
* `<config_dir>/credentials/<profile>.json`, env-only configs do not.
|
|
95
|
+
*/
|
|
96
|
+
export type LoadedConfig = {
|
|
97
|
+
config: AnthropicConfig;
|
|
98
|
+
fromFile: boolean;
|
|
99
|
+
};
|
|
100
|
+
/**
|
|
101
|
+
* Same as {@link loadConfig}, but also reports whether the config was loaded
|
|
102
|
+
* from a profile file on disk (`fromFile: true`) or synthesized entirely from
|
|
103
|
+
* environment variables (`fromFile: false`).
|
|
104
|
+
*/
|
|
105
|
+
export declare const loadConfigWithSource: (profile?: string) => Promise<LoadedConfig | null>;
|
|
86
106
|
/**
|
|
87
107
|
* Loads the credential material for the active profile.
|
|
88
108
|
*
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"credentials.d.mts","sourceRoot":"","sources":["../src/core/credentials.ts"],"names":[],"mappings":"AAGA,0FAA0F;AAC1F,eAAO,MAAM,mBAAmB,QAAQ,CAAC;AACzC,8FAA8F;AAC9F,eAAO,MAAM,wBAAwB,QAAQ,CAAC;AAE9C;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC,GAAG,CACA;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB,+DAA+D;IAC/D,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iDAAiD;IACjD,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,cAAc,CAAC,EACX;QACE,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;KACd,GACD,SAAS,CAAC;IACd,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B,GACD;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC,CACJ,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,aAAa,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAqBF
|
|
1
|
+
{"version":3,"file":"credentials.d.mts","sourceRoot":"","sources":["../src/core/credentials.ts"],"names":[],"mappings":"AAGA,0FAA0F;AAC1F,eAAO,MAAM,mBAAmB,QAAQ,CAAC;AACzC,8FAA8F;AAC9F,eAAO,MAAM,wBAAwB,QAAQ,CAAC;AAE9C;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC,GAAG,CACA;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB,+DAA+D;IAC/D,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iDAAiD;IACjD,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,cAAc,CAAC,EACX;QACE,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;KACd,GACD,SAAS,CAAC;IACd,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B,GACD;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC,CACJ,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,aAAa,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAqBF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,UAAU,GAAU,UAAU,MAAM,KAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAEjF,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAAU,UAAU,MAAM,KAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CA8FxF,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,eAAe,QAAa,OAAO,CAAC,oBAAoB,GAAG,IAAI,CA8B3E,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,GAC7B,QAAQ,eAAe,GAAG,IAAI,EAC9B,UAAU,MAAM,KACf,OAAO,CAAC,MAAM,GAAG,IAAI,CAkBvB,CAAC"}
|
package/core/credentials.d.ts
CHANGED
|
@@ -74,6 +74,7 @@ export type AnthropicCredentials = {
|
|
|
74
74
|
* in the file take precedence — env vars only fill gaps:
|
|
75
75
|
* - `ANTHROPIC_BASE_URL` → `base_url`
|
|
76
76
|
* - `ANTHROPIC_ORGANIZATION_ID` → `organization_id`
|
|
77
|
+
* - `ANTHROPIC_WORKSPACE_ID` → `workspace_id`
|
|
77
78
|
* - `ANTHROPIC_SCOPE` → `authentication.scope`
|
|
78
79
|
* - `ANTHROPIC_FEDERATION_RULE_ID` → `authentication.federation_rule_id` (oidc_federation)
|
|
79
80
|
* - `ANTHROPIC_IDENTITY_TOKEN_FILE` → `authentication.identity_token` (oidc_federation)
|
|
@@ -83,6 +84,25 @@ export type AnthropicCredentials = {
|
|
|
83
84
|
* and `ANTHROPIC_ORGANIZATION_ID` are set.
|
|
84
85
|
*/
|
|
85
86
|
export declare const loadConfig: (profile?: string) => Promise<AnthropicConfig | null>;
|
|
87
|
+
/**
|
|
88
|
+
* Source-tagged result of {@link loadConfigWithSource}. `fromFile` is `true`
|
|
89
|
+
* when `<config_dir>/configs/<profile>.json` exists on disk; `false` when the
|
|
90
|
+
* config was synthesized purely from environment variables.
|
|
91
|
+
*
|
|
92
|
+
* The credential chain uses this distinction to decide whether to back the
|
|
93
|
+
* federation exchange with a disk cache: file-backed profiles get a cache at
|
|
94
|
+
* `<config_dir>/credentials/<profile>.json`, env-only configs do not.
|
|
95
|
+
*/
|
|
96
|
+
export type LoadedConfig = {
|
|
97
|
+
config: AnthropicConfig;
|
|
98
|
+
fromFile: boolean;
|
|
99
|
+
};
|
|
100
|
+
/**
|
|
101
|
+
* Same as {@link loadConfig}, but also reports whether the config was loaded
|
|
102
|
+
* from a profile file on disk (`fromFile: true`) or synthesized entirely from
|
|
103
|
+
* environment variables (`fromFile: false`).
|
|
104
|
+
*/
|
|
105
|
+
export declare const loadConfigWithSource: (profile?: string) => Promise<LoadedConfig | null>;
|
|
86
106
|
/**
|
|
87
107
|
* Loads the credential material for the active profile.
|
|
88
108
|
*
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/core/credentials.ts"],"names":[],"mappings":"AAGA,0FAA0F;AAC1F,eAAO,MAAM,mBAAmB,QAAQ,CAAC;AACzC,8FAA8F;AAC9F,eAAO,MAAM,wBAAwB,QAAQ,CAAC;AAE9C;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC,GAAG,CACA;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB,+DAA+D;IAC/D,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iDAAiD;IACjD,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,cAAc,CAAC,EACX;QACE,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;KACd,GACD,SAAS,CAAC;IACd,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B,GACD;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC,CACJ,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,aAAa,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAqBF
|
|
1
|
+
{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/core/credentials.ts"],"names":[],"mappings":"AAGA,0FAA0F;AAC1F,eAAO,MAAM,mBAAmB,QAAQ,CAAC;AACzC,8FAA8F;AAC9F,eAAO,MAAM,wBAAwB,QAAQ,CAAC;AAE9C;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC,GAAG,CACA;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB,+DAA+D;IAC/D,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iDAAiD;IACjD,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,cAAc,CAAC,EACX;QACE,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;KACd,GACD,SAAS,CAAC;IACd,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B,GACD;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC,CACJ,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,aAAa,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAqBF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,UAAU,GAAU,UAAU,MAAM,KAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAEjF,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAAU,UAAU,MAAM,KAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CA8FxF,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,eAAe,QAAa,OAAO,CAAC,oBAAoB,GAAG,IAAI,CA8B3E,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,GAC7B,QAAQ,eAAe,GAAG,IAAI,EAC9B,UAAU,MAAM,KACf,OAAO,CAAC,MAAM,GAAG,IAAI,CAkBvB,CAAC"}
|
package/core/credentials.js
CHANGED
|
@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
|
|
|
33
33
|
};
|
|
34
34
|
})();
|
|
35
35
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
36
|
-
exports.getCredentialsPath = exports.loadCredentials = exports.loadConfig = exports.CREDENTIALS_FILE_VERSION = exports.CONFIG_FILE_VERSION = void 0;
|
|
36
|
+
exports.getCredentialsPath = exports.loadCredentials = exports.loadConfigWithSource = exports.loadConfig = exports.CREDENTIALS_FILE_VERSION = exports.CONFIG_FILE_VERSION = void 0;
|
|
37
37
|
const detect_platform_1 = require("../internal/detect-platform.js");
|
|
38
38
|
const utils_1 = require("../internal/utils.js");
|
|
39
39
|
/** Current schema version written to `configs/<profile>.json`. Absent on read ⇒ "1.0". */
|
|
@@ -73,6 +73,7 @@ function validateProfileName(name) {
|
|
|
73
73
|
* in the file take precedence — env vars only fill gaps:
|
|
74
74
|
* - `ANTHROPIC_BASE_URL` → `base_url`
|
|
75
75
|
* - `ANTHROPIC_ORGANIZATION_ID` → `organization_id`
|
|
76
|
+
* - `ANTHROPIC_WORKSPACE_ID` → `workspace_id`
|
|
76
77
|
* - `ANTHROPIC_SCOPE` → `authentication.scope`
|
|
77
78
|
* - `ANTHROPIC_FEDERATION_RULE_ID` → `authentication.federation_rule_id` (oidc_federation)
|
|
78
79
|
* - `ANTHROPIC_IDENTITY_TOKEN_FILE` → `authentication.identity_token` (oidc_federation)
|
|
@@ -82,6 +83,15 @@ function validateProfileName(name) {
|
|
|
82
83
|
* and `ANTHROPIC_ORGANIZATION_ID` are set.
|
|
83
84
|
*/
|
|
84
85
|
const loadConfig = async (profile) => {
|
|
86
|
+
return (await (0, exports.loadConfigWithSource)(profile))?.config ?? null;
|
|
87
|
+
};
|
|
88
|
+
exports.loadConfig = loadConfig;
|
|
89
|
+
/**
|
|
90
|
+
* Same as {@link loadConfig}, but also reports whether the config was loaded
|
|
91
|
+
* from a profile file on disk (`fromFile: true`) or synthesized entirely from
|
|
92
|
+
* environment variables (`fromFile: false`).
|
|
93
|
+
*/
|
|
94
|
+
const loadConfigWithSource = async (profile) => {
|
|
85
95
|
var _a, _b;
|
|
86
96
|
const rootConfigPath = await getRootConfigPath();
|
|
87
97
|
if (rootConfigPath === null) {
|
|
@@ -111,14 +121,22 @@ const loadConfig = async (profile) => {
|
|
|
111
121
|
const federationRuleId = (0, utils_1.readEnv)('ANTHROPIC_FEDERATION_RULE_ID');
|
|
112
122
|
if (federationRuleId && organizationId) {
|
|
113
123
|
return {
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
|
|
124
|
+
fromFile: false,
|
|
125
|
+
config: {
|
|
126
|
+
organization_id: organizationId,
|
|
127
|
+
// A defaulted-but-empty CI variable (`ANTHROPIC_WORKSPACE_ID=""`) is
|
|
128
|
+
// treated as unset — readEnv coerces empty to undefined, and the body
|
|
129
|
+
// builder's truthy check skips it — so `"workspace_id": ""` never goes
|
|
130
|
+
// on the wire.
|
|
131
|
+
workspace_id: (0, utils_1.readEnv)('ANTHROPIC_WORKSPACE_ID'),
|
|
132
|
+
base_url: (0, utils_1.readEnv)('ANTHROPIC_BASE_URL'),
|
|
133
|
+
authentication: {
|
|
134
|
+
type: 'oidc_federation',
|
|
135
|
+
federation_rule_id: federationRuleId,
|
|
136
|
+
service_account_id: (0, utils_1.readEnv)('ANTHROPIC_SERVICE_ACCOUNT_ID'),
|
|
137
|
+
identity_token: identityTokenFile ? { source: 'file', path: identityTokenFile } : undefined,
|
|
138
|
+
scope: (0, utils_1.readEnv)('ANTHROPIC_SCOPE'),
|
|
139
|
+
},
|
|
122
140
|
},
|
|
123
141
|
};
|
|
124
142
|
}
|
|
@@ -140,6 +158,7 @@ const loadConfig = async (profile) => {
|
|
|
140
158
|
}
|
|
141
159
|
// File values are authoritative; env vars only fill fields the file left unset.
|
|
142
160
|
config.organization_id ?? (config.organization_id = (0, utils_1.readEnv)('ANTHROPIC_ORGANIZATION_ID'));
|
|
161
|
+
config.workspace_id ?? (config.workspace_id = (0, utils_1.readEnv)('ANTHROPIC_WORKSPACE_ID'));
|
|
143
162
|
config.base_url ?? (config.base_url = (0, utils_1.readEnv)('ANTHROPIC_BASE_URL'));
|
|
144
163
|
(_a = config.authentication).scope ?? (_a.scope = (0, utils_1.readEnv)('ANTHROPIC_SCOPE'));
|
|
145
164
|
if (config.authentication.type === 'oidc_federation') {
|
|
@@ -161,9 +180,9 @@ const loadConfig = async (profile) => {
|
|
|
161
180
|
}
|
|
162
181
|
(_b = config.authentication).service_account_id ?? (_b.service_account_id = (0, utils_1.readEnv)('ANTHROPIC_SERVICE_ACCOUNT_ID'));
|
|
163
182
|
}
|
|
164
|
-
return config;
|
|
183
|
+
return { config, fromFile: true };
|
|
165
184
|
};
|
|
166
|
-
exports.
|
|
185
|
+
exports.loadConfigWithSource = loadConfigWithSource;
|
|
167
186
|
/**
|
|
168
187
|
* Loads the credential material for the active profile.
|
|
169
188
|
*
|
package/core/credentials.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/core/credentials.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oEAAiE;AACjE,gDAA4C;AAE5C,0FAA0F;AAC7E,QAAA,mBAAmB,GAAG,KAAK,CAAC;AACzC,8FAA8F;AACjF,QAAA,wBAAwB,GAAG,KAAK,CAAC;AAgE9C,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AAEjD,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,kBAAkB,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,oCAAoC,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,iBAAiB,IAAI,4EAA4E,CAClG,CAAC;IACJ,CAAC;AACH,CAAC;AAED
|
|
1
|
+
{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/core/credentials.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oEAAiE;AACjE,gDAA4C;AAE5C,0FAA0F;AAC7E,QAAA,mBAAmB,GAAG,KAAK,CAAC;AACzC,8FAA8F;AACjF,QAAA,wBAAwB,GAAG,KAAK,CAAC;AAgE9C,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AAEjD,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,kBAAkB,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,oCAAoC,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,iBAAiB,IAAI,4EAA4E,CAClG,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACI,MAAM,UAAU,GAAG,KAAK,EAAE,OAAgB,EAAmC,EAAE;IACpF,OAAO,CAAC,MAAM,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;AAC/D,CAAC,CAAC;AAFW,QAAA,UAAU,cAErB;AAaF;;;;GAIG;AACI,MAAM,oBAAoB,GAAG,KAAK,EAAE,OAAgB,EAAgC,EAAE;;IAC3F,MAAM,cAAc,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACjD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,MAAM,oBAAoB,EAAE,CAAC,CAAC;IAC9D,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAEjC,MAAM,EAAE,GAAG,wDAAa,SAAS,GAAC,CAAC;IACnC,MAAM,IAAI,GAAG,wDAAa,WAAW,GAAC,CAAC;IACvC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,GAAG,WAAW,OAAO,CAAC,CAAC;IAC/E,IAAI,SAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,KAAK,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IACD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,cAAc,GAAG,IAAA,eAAO,EAAC,2BAA2B,CAAC,CAAC;QAC5D,MAAM,iBAAiB,GAAG,IAAA,eAAO,EAAC,+BAA+B,CAAC,CAAC;QACnE,MAAM,gBAAgB,GAAG,IAAA,eAAO,EAAC,8BAA8B,CAAC,CAAC;QACjE,IAAI,gBAAgB,IAAI,cAAc,EAAE,CAAC;YACvC,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE;oBACN,eAAe,EAAE,cAAc;oBAC/B,qEAAqE;oBACrE,sEAAsE;oBACtE,uEAAuE;oBACvE,eAAe;oBACf,YAAY,EAAE,IAAA,eAAO,EAAC,wBAAwB,CAAC;oBAC/C,QAAQ,EAAE,IAAA,eAAO,EAAC,oBAAoB,CAAC;oBACvC,cAAc,EAAE;wBACd,IAAI,EAAE,iBAAiB;wBACvB,kBAAkB,EAAE,gBAAgB;wBACpC,kBAAkB,EAAE,IAAA,eAAO,EAAC,8BAA8B,CAAC;wBAC3D,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,SAAS;wBAC3F,KAAK,EAAE,IAAA,eAAO,EAAC,iBAAiB,CAAC;qBAClC;iBACF;aACF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+BAA+B,UAAU,KAAK,GAAG,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,eAAe,UAAU,8BAA8B,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC;IAC5C,IAAI,QAAQ,KAAK,iBAAiB,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,sCAAsC,CAAC,CAAC;IAC1F,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,eAAe,KAAtB,MAAM,CAAC,eAAe,GAAK,IAAA,eAAO,EAAC,2BAA2B,CAAC,EAAC;IAChE,MAAM,CAAC,YAAY,KAAnB,MAAM,CAAC,YAAY,GAAK,IAAA,eAAO,EAAC,wBAAwB,CAAC,EAAC;IAC1D,MAAM,CAAC,QAAQ,KAAf,MAAM,CAAC,QAAQ,GAAK,IAAA,eAAO,EAAC,oBAAoB,CAAC,EAAC;IAClD,MAAA,MAAM,CAAC,cAAc,EAAC,KAAK,QAAL,KAAK,GAAK,IAAA,eAAO,EAAC,iBAAiB,CAAC,EAAC;IAE3D,IAAI,MAAM,CAAC,cAAc,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,cAAc,EAAE,CAAC;YAC1C,MAAM,iBAAiB,GAAG,IAAA,eAAO,EAAC,+BAA+B,CAAC,CAAC;YACnE,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,CAAC,cAAc,CAAC,cAAc,GAAG;oBACrC,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,iBAAiB;iBACxB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,yEAAyE;QACzE,4EAA4E;QAC5E,WAAW;QACX,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,kBAAkB,EAAE,CAAC;YAC9C,MAAM,CAAC,cAAc,CAAC,kBAAkB,GAAG,IAAA,eAAO,EAAC,8BAA8B,CAAC,IAAI,EAAE,CAAC;QAC3F,CAAC;QACD,MAAA,MAAM,CAAC,cAAc,EAAC,kBAAkB,QAAlB,kBAAkB,GAAK,IAAA,eAAO,EAAC,8BAA8B,CAAC,EAAC;IACvF,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC,CAAC;AA9FW,QAAA,oBAAoB,wBA8F/B;AAEF;;;;;;;;;;;;;;GAcG;AACI,MAAM,eAAe,GAAG,KAAK,IAA0C,EAAE;IAC9E,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAU,GAAE,CAAC;IAClC,MAAM,eAAe,GAAG,MAAM,IAAA,0BAAkB,EAAC,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,wDAAa,SAAS,GAAC,CAAC;IACnC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,mCAAmC,eAAe,KAAK,GAAG,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAA2B,CAAC;IAChC,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,oCAAoC,eAAe,KAAK,GAAG,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,oBAAoB,eAAe,0BAA0B,KAAK,CAAC,IAAI,wBAAwB,CAChG,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AA9BW,QAAA,eAAe,mBA8B1B;AAEF;;;;;;;GAOG;AACI,MAAM,kBAAkB,GAAG,KAAK,EACrC,MAA8B,EAC9B,OAAgB,EACQ,EAAE;IAC1B,IAAI,MAAM,EAAE,cAAc,CAAC,gBAAgB,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC;IAChD,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACjD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,MAAM,oBAAoB,EAAE,CAAC,CAAC;IAC9D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAEjC,MAAM,IAAI,GAAG,wDAAa,WAAW,GAAC,CAAC;IACvC,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,aAAa,EAAE,GAAG,WAAW,OAAO,CAAC,CAAC;AACzE,CAAC,CAAC;AArBW,QAAA,kBAAkB,sBAqB7B;AAEF,MAAM,iBAAiB,GAAG,KAAK,IAA4B,EAAE;IAC3D,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,wDAAa,WAAW,GAAC,CAAC;IAEvC,sEAAsE;IACtE,iEAAiE;IACjE,MAAM,SAAS,GAAG,IAAA,eAAO,EAAC,sBAAsB,CAAC,CAAC;IAClD,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,EAAE,GAAG,IAAA,oCAAkB,GAAE,CAAC,gBAAgB,CAAC,CAAC;IAClD,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,IAAA,eAAO,EAAC,SAAS,CAAC,CAAC;QACnC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,WAAW,GAAG,IAAA,eAAO,EAAC,aAAa,CAAC,CAAC;QAC3C,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QACnE,CAAC;QACD,yEAAyE;QACzE,gEAAgE;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,aAAa,GAAG,IAAA,eAAO,EAAC,iBAAiB,CAAC,CAAC;IACjD,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,IAAI,GAAG,IAAA,eAAO,EAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,wBAAwB,GAAG,GAAY,EAAE;IAC7C,MAAM,OAAO,GAAG,IAAA,oCAAkB,GAAE,CAAC,qBAAqB,CAAC,CAAC;IAC5D,OAAO,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM,CAAC;AAClD,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,KAAK,IAA4B,EAAE;IAC9D,MAAM,cAAc,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACjD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,IAAA,eAAO,EAAC,mBAAmB,CAAC,CAAC;IACjD,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,EAAE,GAAG,wDAAa,SAAS,GAAC,CAAC;IACnC,MAAM,IAAI,GAAG,wDAAa,WAAW,GAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IAC7E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,KAAK,GAAG,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC"}
|
package/core/credentials.mjs
CHANGED
|
@@ -37,6 +37,7 @@ function validateProfileName(name) {
|
|
|
37
37
|
* in the file take precedence — env vars only fill gaps:
|
|
38
38
|
* - `ANTHROPIC_BASE_URL` → `base_url`
|
|
39
39
|
* - `ANTHROPIC_ORGANIZATION_ID` → `organization_id`
|
|
40
|
+
* - `ANTHROPIC_WORKSPACE_ID` → `workspace_id`
|
|
40
41
|
* - `ANTHROPIC_SCOPE` → `authentication.scope`
|
|
41
42
|
* - `ANTHROPIC_FEDERATION_RULE_ID` → `authentication.federation_rule_id` (oidc_federation)
|
|
42
43
|
* - `ANTHROPIC_IDENTITY_TOKEN_FILE` → `authentication.identity_token` (oidc_federation)
|
|
@@ -46,6 +47,14 @@ function validateProfileName(name) {
|
|
|
46
47
|
* and `ANTHROPIC_ORGANIZATION_ID` are set.
|
|
47
48
|
*/
|
|
48
49
|
export const loadConfig = async (profile) => {
|
|
50
|
+
return (await loadConfigWithSource(profile))?.config ?? null;
|
|
51
|
+
};
|
|
52
|
+
/**
|
|
53
|
+
* Same as {@link loadConfig}, but also reports whether the config was loaded
|
|
54
|
+
* from a profile file on disk (`fromFile: true`) or synthesized entirely from
|
|
55
|
+
* environment variables (`fromFile: false`).
|
|
56
|
+
*/
|
|
57
|
+
export const loadConfigWithSource = async (profile) => {
|
|
49
58
|
var _a, _b;
|
|
50
59
|
const rootConfigPath = await getRootConfigPath();
|
|
51
60
|
if (rootConfigPath === null) {
|
|
@@ -75,14 +84,22 @@ export const loadConfig = async (profile) => {
|
|
|
75
84
|
const federationRuleId = readEnv('ANTHROPIC_FEDERATION_RULE_ID');
|
|
76
85
|
if (federationRuleId && organizationId) {
|
|
77
86
|
return {
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
87
|
+
fromFile: false,
|
|
88
|
+
config: {
|
|
89
|
+
organization_id: organizationId,
|
|
90
|
+
// A defaulted-but-empty CI variable (`ANTHROPIC_WORKSPACE_ID=""`) is
|
|
91
|
+
// treated as unset — readEnv coerces empty to undefined, and the body
|
|
92
|
+
// builder's truthy check skips it — so `"workspace_id": ""` never goes
|
|
93
|
+
// on the wire.
|
|
94
|
+
workspace_id: readEnv('ANTHROPIC_WORKSPACE_ID'),
|
|
95
|
+
base_url: readEnv('ANTHROPIC_BASE_URL'),
|
|
96
|
+
authentication: {
|
|
97
|
+
type: 'oidc_federation',
|
|
98
|
+
federation_rule_id: federationRuleId,
|
|
99
|
+
service_account_id: readEnv('ANTHROPIC_SERVICE_ACCOUNT_ID'),
|
|
100
|
+
identity_token: identityTokenFile ? { source: 'file', path: identityTokenFile } : undefined,
|
|
101
|
+
scope: readEnv('ANTHROPIC_SCOPE'),
|
|
102
|
+
},
|
|
86
103
|
},
|
|
87
104
|
};
|
|
88
105
|
}
|
|
@@ -104,6 +121,7 @@ export const loadConfig = async (profile) => {
|
|
|
104
121
|
}
|
|
105
122
|
// File values are authoritative; env vars only fill fields the file left unset.
|
|
106
123
|
config.organization_id ?? (config.organization_id = readEnv('ANTHROPIC_ORGANIZATION_ID'));
|
|
124
|
+
config.workspace_id ?? (config.workspace_id = readEnv('ANTHROPIC_WORKSPACE_ID'));
|
|
107
125
|
config.base_url ?? (config.base_url = readEnv('ANTHROPIC_BASE_URL'));
|
|
108
126
|
(_a = config.authentication).scope ?? (_a.scope = readEnv('ANTHROPIC_SCOPE'));
|
|
109
127
|
if (config.authentication.type === 'oidc_federation') {
|
|
@@ -125,7 +143,7 @@ export const loadConfig = async (profile) => {
|
|
|
125
143
|
}
|
|
126
144
|
(_b = config.authentication).service_account_id ?? (_b.service_account_id = readEnv('ANTHROPIC_SERVICE_ACCOUNT_ID'));
|
|
127
145
|
}
|
|
128
|
-
return config;
|
|
146
|
+
return { config, fromFile: true };
|
|
129
147
|
};
|
|
130
148
|
/**
|
|
131
149
|
* Loads the credential material for the active profile.
|
package/core/credentials.mjs.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"credentials.mjs","sourceRoot":"","sources":["../src/core/credentials.ts"],"names":[],"mappings":"OAAO,EAAE,kBAAkB,EAAE;OACtB,EAAE,OAAO,EAAE;AAElB,0FAA0F;AAC1F,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AACzC,8FAA8F;AAC9F,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAgE9C,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AAEjD,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,kBAAkB,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,oCAAoC,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,iBAAiB,IAAI,4EAA4E,CAClG,CAAC;IACJ,CAAC;AACH,CAAC;AAED
|
|
1
|
+
{"version":3,"file":"credentials.mjs","sourceRoot":"","sources":["../src/core/credentials.ts"],"names":[],"mappings":"OAAO,EAAE,kBAAkB,EAAE;OACtB,EAAE,OAAO,EAAE;AAElB,0FAA0F;AAC1F,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AACzC,8FAA8F;AAC9F,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAgE9C,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AAEjD,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,kBAAkB,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,oCAAoC,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,iBAAiB,IAAI,4EAA4E,CAClG,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,OAAgB,EAAmC,EAAE;IACpF,OAAO,CAAC,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;AAC/D,CAAC,CAAC;AAaF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EAAE,OAAgB,EAAgC,EAAE;;IAC3F,MAAM,cAAc,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACjD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,MAAM,oBAAoB,EAAE,CAAC,CAAC;IAC9D,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAEjC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,GAAG,WAAW,OAAO,CAAC,CAAC;IAC/E,IAAI,SAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,KAAK,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IACD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,cAAc,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;QAC5D,MAAM,iBAAiB,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAAC;QACnE,MAAM,gBAAgB,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;QACjE,IAAI,gBAAgB,IAAI,cAAc,EAAE,CAAC;YACvC,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE;oBACN,eAAe,EAAE,cAAc;oBAC/B,qEAAqE;oBACrE,sEAAsE;oBACtE,uEAAuE;oBACvE,eAAe;oBACf,YAAY,EAAE,OAAO,CAAC,wBAAwB,CAAC;oBAC/C,QAAQ,EAAE,OAAO,CAAC,oBAAoB,CAAC;oBACvC,cAAc,EAAE;wBACd,IAAI,EAAE,iBAAiB;wBACvB,kBAAkB,EAAE,gBAAgB;wBACpC,kBAAkB,EAAE,OAAO,CAAC,8BAA8B,CAAC;wBAC3D,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,SAAS;wBAC3F,KAAK,EAAE,OAAO,CAAC,iBAAiB,CAAC;qBAClC;iBACF;aACF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+BAA+B,UAAU,KAAK,GAAG,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,eAAe,UAAU,8BAA8B,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC;IAC5C,IAAI,QAAQ,KAAK,iBAAiB,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,sCAAsC,CAAC,CAAC;IAC1F,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,eAAe,KAAtB,MAAM,CAAC,eAAe,GAAK,OAAO,CAAC,2BAA2B,CAAC,EAAC;IAChE,MAAM,CAAC,YAAY,KAAnB,MAAM,CAAC,YAAY,GAAK,OAAO,CAAC,wBAAwB,CAAC,EAAC;IAC1D,MAAM,CAAC,QAAQ,KAAf,MAAM,CAAC,QAAQ,GAAK,OAAO,CAAC,oBAAoB,CAAC,EAAC;IAClD,MAAA,MAAM,CAAC,cAAc,EAAC,KAAK,QAAL,KAAK,GAAK,OAAO,CAAC,iBAAiB,CAAC,EAAC;IAE3D,IAAI,MAAM,CAAC,cAAc,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,cAAc,EAAE,CAAC;YAC1C,MAAM,iBAAiB,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAAC;YACnE,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,CAAC,cAAc,CAAC,cAAc,GAAG;oBACrC,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,iBAAiB;iBACxB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,yEAAyE;QACzE,4EAA4E;QAC5E,WAAW;QACX,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,kBAAkB,EAAE,CAAC;YAC9C,MAAM,CAAC,cAAc,CAAC,kBAAkB,GAAG,OAAO,CAAC,8BAA8B,CAAC,IAAI,EAAE,CAAC;QAC3F,CAAC;QACD,MAAA,MAAM,CAAC,cAAc,EAAC,kBAAkB,QAAlB,kBAAkB,GAAK,OAAO,CAAC,8BAA8B,CAAC,EAAC;IACvF,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,IAA0C,EAAE;IAC9E,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,MAAM,eAAe,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,mCAAmC,eAAe,KAAK,GAAG,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAA2B,CAAC;IAChC,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,oCAAoC,eAAe,KAAK,GAAG,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,oBAAoB,eAAe,0BAA0B,KAAK,CAAC,IAAI,wBAAwB,CAChG,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,MAA8B,EAC9B,OAAgB,EACQ,EAAE;IAC1B,IAAI,MAAM,EAAE,cAAc,CAAC,gBAAgB,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC;IAChD,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACjD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,MAAM,oBAAoB,EAAE,CAAC,CAAC;IAC9D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAEjC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACvC,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,aAAa,EAAE,GAAG,WAAW,OAAO,CAAC,CAAC;AACzE,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,KAAK,IAA4B,EAAE;IAC3D,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAEvC,sEAAsE;IACtE,iEAAiE;IACjE,MAAM,SAAS,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAClD,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,EAAE,GAAG,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAClD,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QAC3C,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QACnE,CAAC;QACD,yEAAyE;QACzE,gEAAgE;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjD,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,wBAAwB,GAAG,GAAY,EAAE;IAC7C,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC,qBAAqB,CAAC,CAAC;IAC5D,OAAO,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM,CAAC;AAClD,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,KAAK,IAA4B,EAAE;IAC9D,MAAM,cAAc,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACjD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACjD,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IAC7E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,KAAK,GAAG,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"credential-chain.d.mts","sourceRoot":"","sources":["../../src/lib/credentials/credential-chain.ts"],"names":[],"mappings":"OAAO,KAAK,EAAE,KAAK,EAAE;OAEd,EAIL,KAAK,eAAe,EACrB;OACM,KAAK,EAAuB,gBAAgB,EAAyB;AAY5E;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,iBAAiB,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IACzD,eAAe,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CACvD,CAAC;AAEF,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,eAAe,GACvB,gBAAgB,CAkBlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,eAAe,EACxB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,
|
|
1
|
+
{"version":3,"file":"credential-chain.d.mts","sourceRoot":"","sources":["../../src/lib/credentials/credential-chain.ts"],"names":[],"mappings":"OAAO,KAAK,EAAE,KAAK,EAAE;OAEd,EAIL,KAAK,eAAe,EACrB;OACM,KAAK,EAAuB,gBAAgB,EAAyB;AAY5E;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,iBAAiB,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IACzD,eAAe,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CACvD,CAAC;AAEF,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,eAAe,GACvB,gBAAgB,CAkBlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,eAAe,EACxB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA6BlC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"credential-chain.d.ts","sourceRoot":"","sources":["../../src/lib/credentials/credential-chain.ts"],"names":[],"mappings":"OAAO,KAAK,EAAE,KAAK,EAAE;OAEd,EAIL,KAAK,eAAe,EACrB;OACM,KAAK,EAAuB,gBAAgB,EAAyB;AAY5E;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,iBAAiB,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IACzD,eAAe,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CACvD,CAAC;AAEF,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,eAAe,GACvB,gBAAgB,CAkBlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,eAAe,EACxB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,
|
|
1
|
+
{"version":3,"file":"credential-chain.d.ts","sourceRoot":"","sources":["../../src/lib/credentials/credential-chain.ts"],"names":[],"mappings":"OAAO,KAAK,EAAE,KAAK,EAAE;OAEd,EAIL,KAAK,eAAe,EACrB;OACM,KAAK,EAAuB,gBAAgB,EAAyB;AAY5E;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,iBAAiB,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IACzD,eAAe,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CACvD,CAAC;AAEF,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,eAAe,GACvB,gBAAgB,CAkBlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,eAAe,EACxB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA6BlC"}
|
|
@@ -47,9 +47,9 @@ function resolveCredentialsFromConfig(config, options) {
|
|
|
47
47
|
const effectiveBaseURL = (config.base_url || options.baseURL).replace(/\/+$/, '');
|
|
48
48
|
const provider = buildProvider(config, credentialsPath, effectiveBaseURL, options);
|
|
49
49
|
const extraHeaders = {};
|
|
50
|
-
//
|
|
51
|
-
//
|
|
52
|
-
//
|
|
50
|
+
// For federation profiles workspace_id is sent in the jwt-bearer exchange
|
|
51
|
+
// body, not as a request header (the minted token is already
|
|
52
|
+
// workspace-scoped, so the header would be ignored).
|
|
53
53
|
if (config.workspace_id && config.authentication.type === 'user_oauth') {
|
|
54
54
|
extraHeaders['anthropic-workspace-id'] = config.workspace_id;
|
|
55
55
|
}
|
|
@@ -74,15 +74,22 @@ function resolveCredentialsFromConfig(config, options) {
|
|
|
74
74
|
* skipping `ANTHROPIC_PROFILE` / `active_config` resolution.
|
|
75
75
|
*/
|
|
76
76
|
async function defaultCredentials(options, profile) {
|
|
77
|
-
const
|
|
78
|
-
if (!
|
|
77
|
+
const loaded = await (0, credentials_1.loadConfigWithSource)(profile);
|
|
78
|
+
if (!loaded) {
|
|
79
79
|
return null;
|
|
80
80
|
}
|
|
81
|
-
|
|
82
|
-
//
|
|
83
|
-
//
|
|
84
|
-
// config don't observe the
|
|
85
|
-
|
|
81
|
+
const { config, fromFile } = loaded;
|
|
82
|
+
// For file-loaded configs, default credentials_path to the per-profile
|
|
83
|
+
// location so user_oauth and federation caching work. Shallow-clone first
|
|
84
|
+
// so callers that retain a reference to the loaded config don't observe the
|
|
85
|
+
// patched-in default.
|
|
86
|
+
//
|
|
87
|
+
// Env-only credentials (no profile file on disk) skip the disk cache —
|
|
88
|
+
// matching the other SDKs. A disk cache keyed by profile path would
|
|
89
|
+
// re-serve a stale token after a change to ANTHROPIC_WORKSPACE_ID (or
|
|
90
|
+
// ANTHROPIC_ORGANIZATION_ID / ANTHROPIC_FEDERATION_RULE_ID) until the
|
|
91
|
+
// cached token expired, so the env-only chain stays in-memory only.
|
|
92
|
+
const withPath = config.authentication.credentials_path || !fromFile ?
|
|
86
93
|
config
|
|
87
94
|
: {
|
|
88
95
|
...config,
|
|
@@ -113,6 +120,7 @@ function buildProvider(config, credentialsPath, baseURL, options) {
|
|
|
113
120
|
federationRuleId: auth.federation_rule_id,
|
|
114
121
|
organizationId: config.organization_id,
|
|
115
122
|
serviceAccountId: auth.service_account_id,
|
|
123
|
+
workspaceId: config.workspace_id,
|
|
116
124
|
baseURL,
|
|
117
125
|
fetch: options.fetch,
|
|
118
126
|
userAgent: options.userAgent,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"credential-chain.js","sourceRoot":"","sources":["../../src/lib/credentials/credential-chain.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,oEAqBC;AAiBD,
|
|
1
|
+
{"version":3,"file":"credential-chain.js","sourceRoot":"","sources":["../../src/lib/credentials/credential-chain.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,oEAqBC;AAiBD,gDAgCC;AA5GD,qDAAmD;AACnD,2DAKgC;AAEhC,sCAKiB;AACjB,uDAAyD;AACzD,wDAAiF;AACjF,0DAA2D;AAC3D,gDAAiD;AAqBjD,SAAgB,4BAA4B,CAC1C,MAAuB,EACvB,OAAwB;IAExB,MAAM,eAAe,GAAG,MAAM,CAAC,cAAc,CAAC,gBAAgB,IAAI,IAAI,CAAC;IACvE,MAAM,gBAAgB,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAElF,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAEnF,MAAM,YAAY,GAA2B,EAAE,CAAC;IAChD,0EAA0E;IAC1E,6DAA6D;IAC7D,qDAAqD;IACrD,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,cAAc,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACvE,YAAY,CAAC,wBAAwB,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC;IAC/D,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACI,KAAK,UAAU,kBAAkB,CACtC,OAAwB,EACxB,OAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,IAAA,kCAAoB,EAAC,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAEpC,uEAAuE;IACvE,0EAA0E;IAC1E,4EAA4E;IAC5E,sBAAsB;IACtB,EAAE;IACF,uEAAuE;IACvE,oEAAoE;IACpE,sEAAsE;IACtE,sEAAsE;IACtE,oEAAoE;IACpE,MAAM,QAAQ,GACZ,MAAM,CAAC,cAAc,CAAC,gBAAgB,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM;QACR,CAAC,CAAC;YACE,GAAG,MAAM;YACT,cAAc,EAAE;gBACd,GAAG,MAAM,CAAC,cAAc;gBACxB,gBAAgB,EAAE,CAAC,MAAM,IAAA,gCAAkB,EAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,SAAS;aAC3E;SACF,CAAC;IAEN,OAAO,4BAA4B,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,aAAa,CACpB,MAAuB,EACvB,eAA8B,EAC9B,OAAe,EACf,OAAwB;IAExB,QAAQ,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACnC,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,CAAC;YACnC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;YAC5D,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,MAAM,IAAI,6BAAqB,CAC7B,wFAAwF;oBACtF,6DAA6D,CAChE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC7B,MAAM,IAAI,6BAAqB,CAC7B,oLAAoL,CACrL,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;gBAC5B,MAAM,IAAI,6BAAqB,CAC7B,2GAA2G,CAC5G,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,IAAA,wCAAsB,EAAC;gBACtC,qBAAqB,EAAE,gBAAgB;gBACvC,gBAAgB,EAAE,IAAI,CAAC,kBAAkB;gBACzC,cAAc,EAAE,MAAM,CAAC,eAAe;gBACtC,gBAAgB,EAAE,IAAI,CAAC,kBAAkB;gBACzC,WAAW,EAAE,MAAM,CAAC,YAAY;gBAChC,OAAO;gBACP,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC,CAAC;YAEH,0EAA0E;YAC1E,oEAAoE;YACpE,IAAI,eAAe,EAAE,CAAC;gBACpB,OAAO,sBAAsB,CAC3B,QAAQ,EACR,eAAe,EACf,OAAO,CAAC,iBAAiB,EACzB,OAAO,CAAC,eAAe,CACxB,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,MAAM,IAAI,6BAAqB,CAC7B,6DAA6D;oBAC3D,mFAAmF,CACtF,CAAC;YACJ,CAAC;YACD,OAAO,IAAA,8BAAiB,EAAC;gBACvB,eAAe;gBACf,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS;gBACzC,OAAO;gBACP,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,eAAe,EAAE,OAAO,CAAC,eAAe;aACzC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,CAAC,GAAI,MAAM,CAAC,cAAmC,CAAC,IAAI,CAAC;YAC3D,MAAM,IAAI,6BAAqB,CAAC,wBAAwB,CAAC,sCAAsC,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,4BAA4B,CACnC,IAA6E;IAE7E,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,0EAA0E;QAC1E,6EAA6E;QAC7E,MAAM,MAAM,GAAI,IAAI,CAAC,cAAqC,CAAC,MAAM,CAAC;QAClE,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,6BAAqB,CAC7B,0BAA0B,MAAM,sDAAsD,CACvF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,6BAAqB,CAAC,wDAAwD,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,IAAA,sCAAqB,EAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,SAAS,GAAG,IAAA,aAAO,EAAC,+BAA+B,CAAC,CAAC;IAC3D,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,IAAA,sCAAqB,EAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,UAAU,GAAG,IAAA,aAAO,EAAC,0BAA0B,CAAC,CAAC;IACvD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,IAAA,uCAAsB,EAAC,UAAU,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,sBAAsB,CAC7B,QAA6B,EAC7B,eAAuB,EACvB,iBAAuD,EACvD,eAAoD;IAEpD,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE;QACpB,MAAM,EAAE,GAAG,wDAAa,SAAS,GAAC,CAAC;QAEnC,MAAM,IAAA,kCAA0B,EAAC,eAAe,EAAE,eAAe,CAAC,CAAC;QAEnE,8BAA8B;QAC9B,IAAI,QAA6C,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YACjE,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,cAAc,CAAuB,CAAC;YAC/D,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;gBACjC,MAAM,SAAS,GAAG,QAAQ,EAAE,CAAC,YAAY,CAAuB,CAAC;gBACjE,IAAI,SAAS,IAAI,IAAI,IAAI,IAAA,mBAAY,GAAE,GAAG,SAAS,GAAG,8CAAsC,EAAE,CAAC;oBAC7F,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,IAAI,IAAI,EAAE,CAAC;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,kEAAkE;YAClE,sEAAsE;YACtE,kEAAkE;YAClE,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;YAClD,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,YAAY,WAAW,CAAC,EAAE,CAAC;gBACvD,iBAAiB,EAAE,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEpC,qEAAqE;QACrE,uEAAuE;QACvE,sEAAsE;QACtE,0CAA0C;QAC1C,IAAI,CAAC;YACH,MAAM,IAAA,kCAA0B,EAAC,eAAe,EAAE;gBAChD,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;gBACnB,OAAO,EAAE,sCAAwB;gBACjC,IAAI,EAAE,aAAa;gBACnB,YAAY,EAAE,MAAM,CAAC,KAAK;gBAC1B,UAAU,EAAE,MAAM,CAAC,SAAS;aAC7B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,uBAAuB;YACvB,iBAAiB,EAAE,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { readEnv } from "../../internal/utils/env.mjs";
|
|
2
|
-
import { CREDENTIALS_FILE_VERSION,
|
|
2
|
+
import { CREDENTIALS_FILE_VERSION, loadConfigWithSource, getCredentialsPath, } from "../../core/credentials.mjs";
|
|
3
3
|
import { MANDATORY_REFRESH_THRESHOLD_IN_SECONDS, WorkloadIdentityError, checkCredentialsFileSafety, writeCredentialsFileAtomic, } from "./types.mjs";
|
|
4
4
|
import { nowAsSeconds } from "../../internal/utils/time.mjs";
|
|
5
5
|
import { identityTokenFromFile, identityTokenFromValue } from "./identity-token.mjs";
|
|
@@ -10,9 +10,9 @@ export function resolveCredentialsFromConfig(config, options) {
|
|
|
10
10
|
const effectiveBaseURL = (config.base_url || options.baseURL).replace(/\/+$/, '');
|
|
11
11
|
const provider = buildProvider(config, credentialsPath, effectiveBaseURL, options);
|
|
12
12
|
const extraHeaders = {};
|
|
13
|
-
//
|
|
14
|
-
//
|
|
15
|
-
//
|
|
13
|
+
// For federation profiles workspace_id is sent in the jwt-bearer exchange
|
|
14
|
+
// body, not as a request header (the minted token is already
|
|
15
|
+
// workspace-scoped, so the header would be ignored).
|
|
16
16
|
if (config.workspace_id && config.authentication.type === 'user_oauth') {
|
|
17
17
|
extraHeaders['anthropic-workspace-id'] = config.workspace_id;
|
|
18
18
|
}
|
|
@@ -37,15 +37,22 @@ export function resolveCredentialsFromConfig(config, options) {
|
|
|
37
37
|
* skipping `ANTHROPIC_PROFILE` / `active_config` resolution.
|
|
38
38
|
*/
|
|
39
39
|
export async function defaultCredentials(options, profile) {
|
|
40
|
-
const
|
|
41
|
-
if (!
|
|
40
|
+
const loaded = await loadConfigWithSource(profile);
|
|
41
|
+
if (!loaded) {
|
|
42
42
|
return null;
|
|
43
43
|
}
|
|
44
|
-
|
|
45
|
-
//
|
|
46
|
-
//
|
|
47
|
-
// config don't observe the
|
|
48
|
-
|
|
44
|
+
const { config, fromFile } = loaded;
|
|
45
|
+
// For file-loaded configs, default credentials_path to the per-profile
|
|
46
|
+
// location so user_oauth and federation caching work. Shallow-clone first
|
|
47
|
+
// so callers that retain a reference to the loaded config don't observe the
|
|
48
|
+
// patched-in default.
|
|
49
|
+
//
|
|
50
|
+
// Env-only credentials (no profile file on disk) skip the disk cache —
|
|
51
|
+
// matching the other SDKs. A disk cache keyed by profile path would
|
|
52
|
+
// re-serve a stale token after a change to ANTHROPIC_WORKSPACE_ID (or
|
|
53
|
+
// ANTHROPIC_ORGANIZATION_ID / ANTHROPIC_FEDERATION_RULE_ID) until the
|
|
54
|
+
// cached token expired, so the env-only chain stays in-memory only.
|
|
55
|
+
const withPath = config.authentication.credentials_path || !fromFile ?
|
|
49
56
|
config
|
|
50
57
|
: {
|
|
51
58
|
...config,
|
|
@@ -76,6 +83,7 @@ function buildProvider(config, credentialsPath, baseURL, options) {
|
|
|
76
83
|
federationRuleId: auth.federation_rule_id,
|
|
77
84
|
organizationId: config.organization_id,
|
|
78
85
|
serviceAccountId: auth.service_account_id,
|
|
86
|
+
workspaceId: config.workspace_id,
|
|
79
87
|
baseURL,
|
|
80
88
|
fetch: options.fetch,
|
|
81
89
|
userAgent: options.userAgent,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"credential-chain.mjs","sourceRoot":"","sources":["../../src/lib/credentials/credential-chain.ts"],"names":[],"mappings":"OACO,EAAE,OAAO,EAAE;OACX,EACL,wBAAwB,EACxB,
|
|
1
|
+
{"version":3,"file":"credential-chain.mjs","sourceRoot":"","sources":["../../src/lib/credentials/credential-chain.ts"],"names":[],"mappings":"OACO,EAAE,OAAO,EAAE;OACX,EACL,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,GAEnB;OAEM,EACL,sCAAsC,EACtC,qBAAqB,EACrB,0BAA0B,EAC1B,0BAA0B,GAC3B;OACM,EAAE,YAAY,EAAE;OAChB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE;OACjD,EAAE,sBAAsB,EAAE;OAC1B,EAAE,iBAAiB,EAAE;AAqB5B,MAAM,UAAU,4BAA4B,CAC1C,MAAuB,EACvB,OAAwB;IAExB,MAAM,eAAe,GAAG,MAAM,CAAC,cAAc,CAAC,gBAAgB,IAAI,IAAI,CAAC;IACvE,MAAM,gBAAgB,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAElF,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAEnF,MAAM,YAAY,GAA2B,EAAE,CAAC;IAChD,0EAA0E;IAC1E,6DAA6D;IAC7D,qDAAqD;IACrD,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,cAAc,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACvE,YAAY,CAAC,wBAAwB,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC;IAC/D,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAwB,EACxB,OAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAEpC,uEAAuE;IACvE,0EAA0E;IAC1E,4EAA4E;IAC5E,sBAAsB;IACtB,EAAE;IACF,uEAAuE;IACvE,oEAAoE;IACpE,sEAAsE;IACtE,sEAAsE;IACtE,oEAAoE;IACpE,MAAM,QAAQ,GACZ,MAAM,CAAC,cAAc,CAAC,gBAAgB,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM;QACR,CAAC,CAAC;YACE,GAAG,MAAM;YACT,cAAc,EAAE;gBACd,GAAG,MAAM,CAAC,cAAc;gBACxB,gBAAgB,EAAE,CAAC,MAAM,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,SAAS;aAC3E;SACF,CAAC;IAEN,OAAO,4BAA4B,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,aAAa,CACpB,MAAuB,EACvB,eAA8B,EAC9B,OAAe,EACf,OAAwB;IAExB,QAAQ,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACnC,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,CAAC;YACnC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;YAC5D,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,MAAM,IAAI,qBAAqB,CAC7B,wFAAwF;oBACtF,6DAA6D,CAChE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC7B,MAAM,IAAI,qBAAqB,CAC7B,oLAAoL,CACrL,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;gBAC5B,MAAM,IAAI,qBAAqB,CAC7B,2GAA2G,CAC5G,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,sBAAsB,CAAC;gBACtC,qBAAqB,EAAE,gBAAgB;gBACvC,gBAAgB,EAAE,IAAI,CAAC,kBAAkB;gBACzC,cAAc,EAAE,MAAM,CAAC,eAAe;gBACtC,gBAAgB,EAAE,IAAI,CAAC,kBAAkB;gBACzC,WAAW,EAAE,MAAM,CAAC,YAAY;gBAChC,OAAO;gBACP,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC,CAAC;YAEH,0EAA0E;YAC1E,oEAAoE;YACpE,IAAI,eAAe,EAAE,CAAC;gBACpB,OAAO,sBAAsB,CAC3B,QAAQ,EACR,eAAe,EACf,OAAO,CAAC,iBAAiB,EACzB,OAAO,CAAC,eAAe,CACxB,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,MAAM,IAAI,qBAAqB,CAC7B,6DAA6D;oBAC3D,mFAAmF,CACtF,CAAC;YACJ,CAAC;YACD,OAAO,iBAAiB,CAAC;gBACvB,eAAe;gBACf,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS;gBACzC,OAAO;gBACP,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,eAAe,EAAE,OAAO,CAAC,eAAe;aACzC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,CAAC,GAAI,MAAM,CAAC,cAAmC,CAAC,IAAI,CAAC;YAC3D,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,sCAAsC,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,4BAA4B,CACnC,IAA6E;IAE7E,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,0EAA0E;QAC1E,6EAA6E;QAC7E,MAAM,MAAM,GAAI,IAAI,CAAC,cAAqC,CAAC,MAAM,CAAC;QAClE,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,qBAAqB,CAC7B,0BAA0B,MAAM,sDAAsD,CACvF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,qBAAqB,CAAC,wDAAwD,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,qBAAqB,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAC3D,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACvD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,sBAAsB,CAC7B,QAA6B,EAC7B,eAAuB,EACvB,iBAAuD,EACvD,eAAoD;IAEpD,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE;QACpB,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QAEnC,MAAM,0BAA0B,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;QAEnE,8BAA8B;QAC9B,IAAI,QAA6C,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YACjE,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,cAAc,CAAuB,CAAC;YAC/D,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;gBACjC,MAAM,SAAS,GAAG,QAAQ,EAAE,CAAC,YAAY,CAAuB,CAAC;gBACjE,IAAI,SAAS,IAAI,IAAI,IAAI,YAAY,EAAE,GAAG,SAAS,GAAG,sCAAsC,EAAE,CAAC;oBAC7F,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,IAAI,IAAI,EAAE,CAAC;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,kEAAkE;YAClE,sEAAsE;YACtE,kEAAkE;YAClE,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;YAClD,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,YAAY,WAAW,CAAC,EAAE,CAAC;gBACvD,iBAAiB,EAAE,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEpC,qEAAqE;QACrE,uEAAuE;QACvE,sEAAsE;QACtE,0CAA0C;QAC1C,IAAI,CAAC;YACH,MAAM,0BAA0B,CAAC,eAAe,EAAE;gBAChD,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;gBACnB,OAAO,EAAE,wBAAwB;gBACjC,IAAI,EAAE,aAAa;gBACnB,YAAY,EAAE,MAAM,CAAC,KAAK;gBAC1B,UAAU,EAAE,MAAM,CAAC,SAAS;aAC7B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,uBAAuB;YACvB,iBAAiB,EAAE,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}
|
|
@@ -5,6 +5,18 @@ export type OIDCFederationConfig = {
|
|
|
5
5
|
federationRuleId: string;
|
|
6
6
|
organizationId: string;
|
|
7
7
|
serviceAccountId?: string | undefined;
|
|
8
|
+
/**
|
|
9
|
+
* Optional `wrkspc_*` tagged ID, or the literal `"default"` to scope the
|
|
10
|
+
* token to the organization's default workspace. When omitted the server
|
|
11
|
+
* picks the rule's sole enabled workspace, else the org default if the rule
|
|
12
|
+
* covers it. Required when the rule enables more than one non-default
|
|
13
|
+
* workspace, or to target a specific workspace other than the one the
|
|
14
|
+
* server would pick. The minted token is workspace-scoped: per-request
|
|
15
|
+
* workspace selection (the `anthropic-workspace-id` header) is not supported
|
|
16
|
+
* for federation tokens — switching workspaces requires a new token exchange
|
|
17
|
+
* with a different `workspaceId`.
|
|
18
|
+
*/
|
|
19
|
+
workspaceId?: string | undefined;
|
|
8
20
|
baseURL: string;
|
|
9
21
|
fetch: Fetch;
|
|
10
22
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc-federation.d.mts","sourceRoot":"","sources":["../../src/lib/credentials/oidc-federation.ts"],"names":[],"mappings":"OAAO,KAAK,EAAE,KAAK,EAAE;OACd,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE;AAc1D,MAAM,MAAM,oBAAoB,GAAG;IACjC,qBAAqB,EAAE,qBAAqB,CAAC;IAC7C,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;IACb;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,oBAAoB,GAAG,mBAAmB,
|
|
1
|
+
{"version":3,"file":"oidc-federation.d.mts","sourceRoot":"","sources":["../../src/lib/credentials/oidc-federation.ts"],"names":[],"mappings":"OAAO,KAAK,EAAE,KAAK,EAAE;OACd,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE;AAc1D,MAAM,MAAM,oBAAoB,GAAG;IACjC,qBAAqB,EAAE,qBAAqB,CAAC;IAC7C,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;IACb;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,oBAAoB,GAAG,mBAAmB,CAuFxF"}
|
|
@@ -5,6 +5,18 @@ export type OIDCFederationConfig = {
|
|
|
5
5
|
federationRuleId: string;
|
|
6
6
|
organizationId: string;
|
|
7
7
|
serviceAccountId?: string | undefined;
|
|
8
|
+
/**
|
|
9
|
+
* Optional `wrkspc_*` tagged ID, or the literal `"default"` to scope the
|
|
10
|
+
* token to the organization's default workspace. When omitted the server
|
|
11
|
+
* picks the rule's sole enabled workspace, else the org default if the rule
|
|
12
|
+
* covers it. Required when the rule enables more than one non-default
|
|
13
|
+
* workspace, or to target a specific workspace other than the one the
|
|
14
|
+
* server would pick. The minted token is workspace-scoped: per-request
|
|
15
|
+
* workspace selection (the `anthropic-workspace-id` header) is not supported
|
|
16
|
+
* for federation tokens — switching workspaces requires a new token exchange
|
|
17
|
+
* with a different `workspaceId`.
|
|
18
|
+
*/
|
|
19
|
+
workspaceId?: string | undefined;
|
|
8
20
|
baseURL: string;
|
|
9
21
|
fetch: Fetch;
|
|
10
22
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc-federation.d.ts","sourceRoot":"","sources":["../../src/lib/credentials/oidc-federation.ts"],"names":[],"mappings":"OAAO,KAAK,EAAE,KAAK,EAAE;OACd,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE;AAc1D,MAAM,MAAM,oBAAoB,GAAG;IACjC,qBAAqB,EAAE,qBAAqB,CAAC;IAC7C,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;IACb;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,oBAAoB,GAAG,mBAAmB,
|
|
1
|
+
{"version":3,"file":"oidc-federation.d.ts","sourceRoot":"","sources":["../../src/lib/credentials/oidc-federation.ts"],"names":[],"mappings":"OAAO,KAAK,EAAE,KAAK,EAAE;OACd,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE;AAc1D,MAAM,MAAM,oBAAoB,GAAG;IACjC,qBAAqB,EAAE,qBAAqB,CAAC;IAC7C,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;IACb;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,oBAAoB,GAAG,mBAAmB,CAuFxF"}
|
|
@@ -33,6 +33,9 @@ function oidcFederationProvider(config) {
|
|
|
33
33
|
if (config.serviceAccountId) {
|
|
34
34
|
body['service_account_id'] = config.serviceAccountId;
|
|
35
35
|
}
|
|
36
|
+
if (config.workspaceId) {
|
|
37
|
+
body['workspace_id'] = config.workspaceId;
|
|
38
|
+
}
|
|
36
39
|
const url = `${config.baseURL}${types_1.TOKEN_ENDPOINT}`;
|
|
37
40
|
let resp;
|
|
38
41
|
try {
|
|
@@ -53,7 +56,17 @@ function oidcFederationProvider(config) {
|
|
|
53
56
|
if (!resp.ok) {
|
|
54
57
|
const text = await resp.text().catch(() => '');
|
|
55
58
|
const redacted = (0, types_1.redactSensitive)(text);
|
|
56
|
-
|
|
59
|
+
// A 401 is hard to debug from the status code alone, so surface
|
|
60
|
+
// guidance: check the federation rule, optionally set a workspace ID
|
|
61
|
+
// (the most common fix when no workspaceId is configured), and point at
|
|
62
|
+
// the Workload identity page in Claude Console for the server-side
|
|
63
|
+
// authentication event log. Other statuses (5xx, 400, ...) get no hint.
|
|
64
|
+
let hint = '';
|
|
65
|
+
if (resp.status === 401) {
|
|
66
|
+
const hintMiddle = config.workspaceId ? '' : ("If your federation rule is scoped to multiple workspaces, set the ANTHROPIC_WORKSPACE_ID environment variable, the 'workspace_id' config key, or the `workspaceId` option. ");
|
|
67
|
+
hint = ` Ensure your federation rule matches your identity token. ${hintMiddle}View your authentication events in the Workload identity page of Claude Console for more details.`;
|
|
68
|
+
}
|
|
69
|
+
throw new types_1.WorkloadIdentityError(`Token exchange failed with status ${resp.status}${requestId ? ` (request-id ${requestId})` : ''}: ${redacted}${hint}`, resp.status, redacted, requestId);
|
|
57
70
|
}
|
|
58
71
|
const data = await (0, types_1.parseTokenResponse)(resp, requestId);
|
|
59
72
|
const expiresIn = Number(data.expires_in);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc-federation.js","sourceRoot":"","sources":["../../src/lib/credentials/oidc-federation.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"oidc-federation.js","sourceRoot":"","sources":["../../src/lib/credentials/oidc-federation.ts"],"names":[],"mappings":";;AAoDA,wDAuFC;AAzID,sCASiB;AACjB,uDAAyD;AACzD,8CAAwC;AA6BxC;;;;;;;;;GASG;AACH,SAAgB,sBAAsB,CAAC,MAA4B;IACjE,OAAO,KAAK,IAAI,EAAE;QAChB,IAAA,kCAA0B,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAE3C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,qBAAqB,EAAE,CAAC;QACjD,wEAAwE;QACxE,iEAAiE;QACjE,2CAA2C;QAC3C,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,6BAAqB,CAC7B,qBAAqB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,0CAA0C,CAC5F,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAA2B;YACnC,UAAU,EAAE,6BAAqB;YACjC,SAAS,EAAE,GAAG;YACd,kBAAkB,EAAE,MAAM,CAAC,gBAAgB;YAC3C,eAAe,EAAE,MAAM,CAAC,cAAc;SACvC,CAAC;QACF,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC5B,IAAI,CAAC,oBAAoB,CAAC,GAAG,MAAM,CAAC,gBAAgB,CAAC;QACvD,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,IAAI,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;QAC5C,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,GAAG,sBAAc,EAAE,CAAC;QACjD,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC7B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,gBAAgB,EAAE,GAAG,6BAAqB,IAAI,8BAAsB,EAAE;oBACtE,YAAY,EAAE,MAAM,CAAC,SAAS,IAAI,4BAA4B,iBAAO,yBAAyB;iBAC/F;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,6BAAqB,CAAC,kCAAkC,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAEjD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,IAAA,uBAAe,EAAC,IAAI,CAAC,CAAC;YACvC,gEAAgE;YAChE,qEAAqE;YACrE,wEAAwE;YACxE,mEAAmE;YACnE,wEAAwE;YACxE,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxB,MAAM,UAAU,GACd,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CACxB,6KAA6K,CAC9K,CAAC;gBACJ,IAAI,GAAG,6DAA6D,UAAU,mGAAmG,CAAC;YACpL,CAAC;YACD,MAAM,IAAI,6BAAqB,CAC7B,qCAAqC,IAAI,CAAC,MAAM,GAC9C,SAAS,CAAC,CAAC,CAAC,gBAAgB,SAAS,GAAG,CAAC,CAAC,CAAC,EAC7C,KAAK,QAAQ,GAAG,IAAI,EAAE,EACtB,IAAI,CAAC,MAAM,EACX,QAAQ,EACR,SAAS,CACV,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAA,0BAAkB,EAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,6BAAqB,CAC7B,oDAAoD,IAAI,CAAC,SAAS,CAAC,IAAA,uBAAe,EAAC,IAAI,CAAC,CAAC,EAAE,EAC3F,IAAI,CAAC,MAAM,EACX,IAAA,uBAAe,EAAC,IAAI,CAAC,EACrB,SAAS,CACV,CAAC;QACJ,CAAC;QAED,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,YAAY;YACxB,SAAS,EAAE,IAAA,mBAAY,GAAE,GAAG,SAAS;SACtC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}
|
|
@@ -30,6 +30,9 @@ export function oidcFederationProvider(config) {
|
|
|
30
30
|
if (config.serviceAccountId) {
|
|
31
31
|
body['service_account_id'] = config.serviceAccountId;
|
|
32
32
|
}
|
|
33
|
+
if (config.workspaceId) {
|
|
34
|
+
body['workspace_id'] = config.workspaceId;
|
|
35
|
+
}
|
|
33
36
|
const url = `${config.baseURL}${TOKEN_ENDPOINT}`;
|
|
34
37
|
let resp;
|
|
35
38
|
try {
|
|
@@ -50,7 +53,17 @@ export function oidcFederationProvider(config) {
|
|
|
50
53
|
if (!resp.ok) {
|
|
51
54
|
const text = await resp.text().catch(() => '');
|
|
52
55
|
const redacted = redactSensitive(text);
|
|
53
|
-
|
|
56
|
+
// A 401 is hard to debug from the status code alone, so surface
|
|
57
|
+
// guidance: check the federation rule, optionally set a workspace ID
|
|
58
|
+
// (the most common fix when no workspaceId is configured), and point at
|
|
59
|
+
// the Workload identity page in Claude Console for the server-side
|
|
60
|
+
// authentication event log. Other statuses (5xx, 400, ...) get no hint.
|
|
61
|
+
let hint = '';
|
|
62
|
+
if (resp.status === 401) {
|
|
63
|
+
const hintMiddle = config.workspaceId ? '' : ("If your federation rule is scoped to multiple workspaces, set the ANTHROPIC_WORKSPACE_ID environment variable, the 'workspace_id' config key, or the `workspaceId` option. ");
|
|
64
|
+
hint = ` Ensure your federation rule matches your identity token. ${hintMiddle}View your authentication events in the Workload identity page of Claude Console for more details.`;
|
|
65
|
+
}
|
|
66
|
+
throw new WorkloadIdentityError(`Token exchange failed with status ${resp.status}${requestId ? ` (request-id ${requestId})` : ''}: ${redacted}${hint}`, resp.status, redacted, requestId);
|
|
54
67
|
}
|
|
55
68
|
const data = await parseTokenResponse(resp, requestId);
|
|
56
69
|
const expiresIn = Number(data.expires_in);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc-federation.mjs","sourceRoot":"","sources":["../../src/lib/credentials/oidc-federation.ts"],"names":[],"mappings":"OAEO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,0BAA0B,GAC3B;OACM,EAAE,YAAY,EAAE;OAChB,EAAE,OAAO,EAAE;
|
|
1
|
+
{"version":3,"file":"oidc-federation.mjs","sourceRoot":"","sources":["../../src/lib/credentials/oidc-federation.ts"],"names":[],"mappings":"OAEO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,0BAA0B,GAC3B;OACM,EAAE,YAAY,EAAE;OAChB,EAAE,OAAO,EAAE;AA6BlB;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAA4B;IACjE,OAAO,KAAK,IAAI,EAAE;QAChB,0BAA0B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAE3C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,qBAAqB,EAAE,CAAC;QACjD,wEAAwE;QACxE,iEAAiE;QACjE,2CAA2C;QAC3C,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,qBAAqB,CAC7B,qBAAqB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,0CAA0C,CAC5F,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAA2B;YACnC,UAAU,EAAE,qBAAqB;YACjC,SAAS,EAAE,GAAG;YACd,kBAAkB,EAAE,MAAM,CAAC,gBAAgB;YAC3C,eAAe,EAAE,MAAM,CAAC,cAAc;SACvC,CAAC;QACF,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC5B,IAAI,CAAC,oBAAoB,CAAC,GAAG,MAAM,CAAC,gBAAgB,CAAC;QACvD,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,IAAI,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;QAC5C,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,GAAG,cAAc,EAAE,CAAC;QACjD,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC7B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,gBAAgB,EAAE,GAAG,qBAAqB,IAAI,sBAAsB,EAAE;oBACtE,YAAY,EAAE,MAAM,CAAC,SAAS,IAAI,4BAA4B,OAAO,yBAAyB;iBAC/F;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAEjD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YACvC,gEAAgE;YAChE,qEAAqE;YACrE,wEAAwE;YACxE,mEAAmE;YACnE,wEAAwE;YACxE,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxB,MAAM,UAAU,GACd,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CACxB,6KAA6K,CAC9K,CAAC;gBACJ,IAAI,GAAG,6DAA6D,UAAU,mGAAmG,CAAC;YACpL,CAAC;YACD,MAAM,IAAI,qBAAqB,CAC7B,qCAAqC,IAAI,CAAC,MAAM,GAC9C,SAAS,CAAC,CAAC,CAAC,gBAAgB,SAAS,GAAG,CAAC,CAAC,CAAC,EAC7C,KAAK,QAAQ,GAAG,IAAI,EAAE,EACtB,IAAI,CAAC,MAAM,EACX,QAAQ,EACR,SAAS,CACV,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,qBAAqB,CAC7B,oDAAoD,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAC3F,IAAI,CAAC,MAAM,EACX,eAAe,CAAC,IAAI,CAAC,EACrB,SAAS,CACV,CAAC;QACJ,CAAC;QAED,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,YAAY;YACxB,SAAS,EAAE,YAAY,EAAE,GAAG,SAAS;SACtC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED
package/src/core/credentials.ts
CHANGED
|
@@ -105,6 +105,7 @@ function validateProfileName(name: string): void {
|
|
|
105
105
|
* in the file take precedence — env vars only fill gaps:
|
|
106
106
|
* - `ANTHROPIC_BASE_URL` → `base_url`
|
|
107
107
|
* - `ANTHROPIC_ORGANIZATION_ID` → `organization_id`
|
|
108
|
+
* - `ANTHROPIC_WORKSPACE_ID` → `workspace_id`
|
|
108
109
|
* - `ANTHROPIC_SCOPE` → `authentication.scope`
|
|
109
110
|
* - `ANTHROPIC_FEDERATION_RULE_ID` → `authentication.federation_rule_id` (oidc_federation)
|
|
110
111
|
* - `ANTHROPIC_IDENTITY_TOKEN_FILE` → `authentication.identity_token` (oidc_federation)
|
|
@@ -114,6 +115,26 @@ function validateProfileName(name: string): void {
|
|
|
114
115
|
* and `ANTHROPIC_ORGANIZATION_ID` are set.
|
|
115
116
|
*/
|
|
116
117
|
export const loadConfig = async (profile?: string): Promise<AnthropicConfig | null> => {
|
|
118
|
+
return (await loadConfigWithSource(profile))?.config ?? null;
|
|
119
|
+
};
|
|
120
|
+
|
|
121
|
+
/**
|
|
122
|
+
* Source-tagged result of {@link loadConfigWithSource}. `fromFile` is `true`
|
|
123
|
+
* when `<config_dir>/configs/<profile>.json` exists on disk; `false` when the
|
|
124
|
+
* config was synthesized purely from environment variables.
|
|
125
|
+
*
|
|
126
|
+
* The credential chain uses this distinction to decide whether to back the
|
|
127
|
+
* federation exchange with a disk cache: file-backed profiles get a cache at
|
|
128
|
+
* `<config_dir>/credentials/<profile>.json`, env-only configs do not.
|
|
129
|
+
*/
|
|
130
|
+
export type LoadedConfig = { config: AnthropicConfig; fromFile: boolean };
|
|
131
|
+
|
|
132
|
+
/**
|
|
133
|
+
* Same as {@link loadConfig}, but also reports whether the config was loaded
|
|
134
|
+
* from a profile file on disk (`fromFile: true`) or synthesized entirely from
|
|
135
|
+
* environment variables (`fromFile: false`).
|
|
136
|
+
*/
|
|
137
|
+
export const loadConfigWithSource = async (profile?: string): Promise<LoadedConfig | null> => {
|
|
117
138
|
const rootConfigPath = await getRootConfigPath();
|
|
118
139
|
if (rootConfigPath === null) {
|
|
119
140
|
return null;
|
|
@@ -143,14 +164,22 @@ export const loadConfig = async (profile?: string): Promise<AnthropicConfig | nu
|
|
|
143
164
|
const federationRuleId = readEnv('ANTHROPIC_FEDERATION_RULE_ID');
|
|
144
165
|
if (federationRuleId && organizationId) {
|
|
145
166
|
return {
|
|
146
|
-
|
|
147
|
-
|
|
148
|
-
|
|
149
|
-
|
|
150
|
-
|
|
151
|
-
|
|
152
|
-
|
|
153
|
-
|
|
167
|
+
fromFile: false,
|
|
168
|
+
config: {
|
|
169
|
+
organization_id: organizationId,
|
|
170
|
+
// A defaulted-but-empty CI variable (`ANTHROPIC_WORKSPACE_ID=""`) is
|
|
171
|
+
// treated as unset — readEnv coerces empty to undefined, and the body
|
|
172
|
+
// builder's truthy check skips it — so `"workspace_id": ""` never goes
|
|
173
|
+
// on the wire.
|
|
174
|
+
workspace_id: readEnv('ANTHROPIC_WORKSPACE_ID'),
|
|
175
|
+
base_url: readEnv('ANTHROPIC_BASE_URL'),
|
|
176
|
+
authentication: {
|
|
177
|
+
type: 'oidc_federation',
|
|
178
|
+
federation_rule_id: federationRuleId,
|
|
179
|
+
service_account_id: readEnv('ANTHROPIC_SERVICE_ACCOUNT_ID'),
|
|
180
|
+
identity_token: identityTokenFile ? { source: 'file', path: identityTokenFile } : undefined,
|
|
181
|
+
scope: readEnv('ANTHROPIC_SCOPE'),
|
|
182
|
+
},
|
|
154
183
|
},
|
|
155
184
|
};
|
|
156
185
|
}
|
|
@@ -173,6 +202,7 @@ export const loadConfig = async (profile?: string): Promise<AnthropicConfig | nu
|
|
|
173
202
|
|
|
174
203
|
// File values are authoritative; env vars only fill fields the file left unset.
|
|
175
204
|
config.organization_id ??= readEnv('ANTHROPIC_ORGANIZATION_ID');
|
|
205
|
+
config.workspace_id ??= readEnv('ANTHROPIC_WORKSPACE_ID');
|
|
176
206
|
config.base_url ??= readEnv('ANTHROPIC_BASE_URL');
|
|
177
207
|
config.authentication.scope ??= readEnv('ANTHROPIC_SCOPE');
|
|
178
208
|
|
|
@@ -197,7 +227,7 @@ export const loadConfig = async (profile?: string): Promise<AnthropicConfig | nu
|
|
|
197
227
|
config.authentication.service_account_id ??= readEnv('ANTHROPIC_SERVICE_ACCOUNT_ID');
|
|
198
228
|
}
|
|
199
229
|
|
|
200
|
-
return config;
|
|
230
|
+
return { config, fromFile: true };
|
|
201
231
|
};
|
|
202
232
|
|
|
203
233
|
/**
|
|
@@ -2,7 +2,7 @@ import type { Fetch } from '../../internal/builtin-types';
|
|
|
2
2
|
import { readEnv } from '../../internal/utils/env';
|
|
3
3
|
import {
|
|
4
4
|
CREDENTIALS_FILE_VERSION,
|
|
5
|
-
|
|
5
|
+
loadConfigWithSource,
|
|
6
6
|
getCredentialsPath,
|
|
7
7
|
type AnthropicConfig,
|
|
8
8
|
} from '../../core/credentials';
|
|
@@ -47,9 +47,9 @@ export function resolveCredentialsFromConfig(
|
|
|
47
47
|
const provider = buildProvider(config, credentialsPath, effectiveBaseURL, options);
|
|
48
48
|
|
|
49
49
|
const extraHeaders: Record<string, string> = {};
|
|
50
|
-
//
|
|
51
|
-
//
|
|
52
|
-
//
|
|
50
|
+
// For federation profiles workspace_id is sent in the jwt-bearer exchange
|
|
51
|
+
// body, not as a request header (the minted token is already
|
|
52
|
+
// workspace-scoped, so the header would be ignored).
|
|
53
53
|
if (config.workspace_id && config.authentication.type === 'user_oauth') {
|
|
54
54
|
extraHeaders['anthropic-workspace-id'] = config.workspace_id;
|
|
55
55
|
}
|
|
@@ -79,17 +79,24 @@ export async function defaultCredentials(
|
|
|
79
79
|
options: ResolverOptions,
|
|
80
80
|
profile?: string,
|
|
81
81
|
): Promise<CredentialResult | null> {
|
|
82
|
-
const
|
|
83
|
-
if (!
|
|
82
|
+
const loaded = await loadConfigWithSource(profile);
|
|
83
|
+
if (!loaded) {
|
|
84
84
|
return null;
|
|
85
85
|
}
|
|
86
|
+
const { config, fromFile } = loaded;
|
|
86
87
|
|
|
87
|
-
// For
|
|
88
|
-
//
|
|
89
|
-
//
|
|
90
|
-
//
|
|
88
|
+
// For file-loaded configs, default credentials_path to the per-profile
|
|
89
|
+
// location so user_oauth and federation caching work. Shallow-clone first
|
|
90
|
+
// so callers that retain a reference to the loaded config don't observe the
|
|
91
|
+
// patched-in default.
|
|
92
|
+
//
|
|
93
|
+
// Env-only credentials (no profile file on disk) skip the disk cache —
|
|
94
|
+
// matching the other SDKs. A disk cache keyed by profile path would
|
|
95
|
+
// re-serve a stale token after a change to ANTHROPIC_WORKSPACE_ID (or
|
|
96
|
+
// ANTHROPIC_ORGANIZATION_ID / ANTHROPIC_FEDERATION_RULE_ID) until the
|
|
97
|
+
// cached token expired, so the env-only chain stays in-memory only.
|
|
91
98
|
const withPath: AnthropicConfig =
|
|
92
|
-
config.authentication.credentials_path ?
|
|
99
|
+
config.authentication.credentials_path || !fromFile ?
|
|
93
100
|
config
|
|
94
101
|
: {
|
|
95
102
|
...config,
|
|
@@ -134,6 +141,7 @@ function buildProvider(
|
|
|
134
141
|
federationRuleId: auth.federation_rule_id,
|
|
135
142
|
organizationId: config.organization_id,
|
|
136
143
|
serviceAccountId: auth.service_account_id,
|
|
144
|
+
workspaceId: config.workspace_id,
|
|
137
145
|
baseURL,
|
|
138
146
|
fetch: options.fetch,
|
|
139
147
|
userAgent: options.userAgent,
|
|
@@ -18,6 +18,18 @@ export type OIDCFederationConfig = {
|
|
|
18
18
|
federationRuleId: string;
|
|
19
19
|
organizationId: string;
|
|
20
20
|
serviceAccountId?: string | undefined;
|
|
21
|
+
/**
|
|
22
|
+
* Optional `wrkspc_*` tagged ID, or the literal `"default"` to scope the
|
|
23
|
+
* token to the organization's default workspace. When omitted the server
|
|
24
|
+
* picks the rule's sole enabled workspace, else the org default if the rule
|
|
25
|
+
* covers it. Required when the rule enables more than one non-default
|
|
26
|
+
* workspace, or to target a specific workspace other than the one the
|
|
27
|
+
* server would pick. The minted token is workspace-scoped: per-request
|
|
28
|
+
* workspace selection (the `anthropic-workspace-id` header) is not supported
|
|
29
|
+
* for federation tokens — switching workspaces requires a new token exchange
|
|
30
|
+
* with a different `workspaceId`.
|
|
31
|
+
*/
|
|
32
|
+
workspaceId?: string | undefined;
|
|
21
33
|
baseURL: string;
|
|
22
34
|
fetch: Fetch;
|
|
23
35
|
/**
|
|
@@ -61,6 +73,9 @@ export function oidcFederationProvider(config: OIDCFederationConfig): AccessToke
|
|
|
61
73
|
if (config.serviceAccountId) {
|
|
62
74
|
body['service_account_id'] = config.serviceAccountId;
|
|
63
75
|
}
|
|
76
|
+
if (config.workspaceId) {
|
|
77
|
+
body['workspace_id'] = config.workspaceId;
|
|
78
|
+
}
|
|
64
79
|
|
|
65
80
|
const url = `${config.baseURL}${TOKEN_ENDPOINT}`;
|
|
66
81
|
let resp: Response;
|
|
@@ -83,10 +98,23 @@ export function oidcFederationProvider(config: OIDCFederationConfig): AccessToke
|
|
|
83
98
|
if (!resp.ok) {
|
|
84
99
|
const text = await resp.text().catch(() => '');
|
|
85
100
|
const redacted = redactSensitive(text);
|
|
101
|
+
// A 401 is hard to debug from the status code alone, so surface
|
|
102
|
+
// guidance: check the federation rule, optionally set a workspace ID
|
|
103
|
+
// (the most common fix when no workspaceId is configured), and point at
|
|
104
|
+
// the Workload identity page in Claude Console for the server-side
|
|
105
|
+
// authentication event log. Other statuses (5xx, 400, ...) get no hint.
|
|
106
|
+
let hint = '';
|
|
107
|
+
if (resp.status === 401) {
|
|
108
|
+
const hintMiddle =
|
|
109
|
+
config.workspaceId ? '' : (
|
|
110
|
+
"If your federation rule is scoped to multiple workspaces, set the ANTHROPIC_WORKSPACE_ID environment variable, the 'workspace_id' config key, or the `workspaceId` option. "
|
|
111
|
+
);
|
|
112
|
+
hint = ` Ensure your federation rule matches your identity token. ${hintMiddle}View your authentication events in the Workload identity page of Claude Console for more details.`;
|
|
113
|
+
}
|
|
86
114
|
throw new WorkloadIdentityError(
|
|
87
115
|
`Token exchange failed with status ${resp.status}${
|
|
88
116
|
requestId ? ` (request-id ${requestId})` : ''
|
|
89
|
-
}: ${redacted}`,
|
|
117
|
+
}: ${redacted}${hint}`,
|
|
90
118
|
resp.status,
|
|
91
119
|
redacted,
|
|
92
120
|
requestId,
|
package/src/version.ts
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
export const VERSION = '0.
|
|
1
|
+
export const VERSION = '0.94.0'; // x-release-please-version
|
package/version.d.mts
CHANGED
|
@@ -1,2 +1,2 @@
|
|
|
1
|
-
export declare const VERSION = "0.
|
|
1
|
+
export declare const VERSION = "0.94.0";
|
|
2
2
|
//# sourceMappingURL=version.d.mts.map
|
package/version.d.ts
CHANGED
|
@@ -1,2 +1,2 @@
|
|
|
1
|
-
export declare const VERSION = "0.
|
|
1
|
+
export declare const VERSION = "0.94.0";
|
|
2
2
|
//# sourceMappingURL=version.d.ts.map
|
package/version.js
CHANGED
package/version.mjs
CHANGED
|
@@ -1,2 +1,2 @@
|
|
|
1
|
-
export const VERSION = '0.
|
|
1
|
+
export const VERSION = '0.94.0'; // x-release-please-version
|
|
2
2
|
//# sourceMappingURL=version.mjs.map
|