@oneie/claude 0.9.0 → 0.10.0

package/scripts/node_modules/@anthropic-ai/sdk/lib/credentials/credential-chain.mjs

@@ -1,208 +0,0 @@
-import { readEnv } from "../../internal/utils/env.mjs";
-import { CREDENTIALS_FILE_VERSION, loadConfigWithSource, getCredentialsPath, } from "../../core/credentials.mjs";
-import { MANDATORY_REFRESH_THRESHOLD_IN_SECONDS, WorkloadIdentityError, checkCredentialsFileSafety, writeCredentialsFileAtomic, } from "./types.mjs";
-import { nowAsSeconds } from "../../internal/utils/time.mjs";
-import { identityTokenFromFile, identityTokenFromValue } from "./identity-token.mjs";
-import { oidcFederationProvider } from "./oidc-federation.mjs";
-import { userOAuthProvider } from "./user-oauth.mjs";
-export function resolveCredentialsFromConfig(config, options) {
-    const credentialsPath = config.authentication.credentials_path ?? null;
-    const effectiveBaseURL = (config.base_url || options.baseURL).replace(/\/+$/, '');
-    const provider = buildProvider(config, credentialsPath, effectiveBaseURL, options);
-    const extraHeaders = {};
-    // For federation profiles workspace_id is sent in the jwt-bearer exchange
-    // body, not as a request header (the minted token is already
-    // workspace-scoped, so the header would be ignored).
-    if (config.workspace_id && config.authentication.type === 'user_oauth') {
-        extraHeaders['anthropic-workspace-id'] = config.workspace_id;
-    }
-    // Surface the profile's own base_url (not the options.baseURL fallback) so
-    // the client can adopt it for outbound API requests when the caller didn't
-    // pin one explicitly. Echoing options.baseURL back would defeat precedence.
-    return { provider, extraHeaders, baseURL: config.base_url || undefined };
-}
-/**
- * Resolves a {@link CredentialResult} from the environment. Returns `null`
- * when no credentials can be resolved.
- *
- * Resolution order:
- *
- *   1. Config file for the active profile (or the explicit `profile` argument)
- *      → dispatch on `authentication.type` (`oidc_federation`, `user_oauth`)
- *   2. Environment variables `ANTHROPIC_FEDERATION_RULE_ID` +
- *      `ANTHROPIC_ORGANIZATION_ID` (+ identity token) → OIDC federation
- *   3. Nothing matches → `null`
- *
- * Passing `profile` selects `<config_dir>/configs/<profile>.json` directly,
- * skipping `ANTHROPIC_PROFILE` / `active_config` resolution.
- */
-export async function defaultCredentials(options, profile) {
-    const loaded = await loadConfigWithSource(profile);
-    if (!loaded) {
-        return null;
-    }
-    const { config, fromFile } = loaded;
-    // For file-loaded configs, default credentials_path to the per-profile
-    // location so user_oauth and federation caching work. Shallow-clone first
-    // so callers that retain a reference to the loaded config don't observe the
-    // patched-in default.
-    //
-    // Env-only credentials (no profile file on disk) skip the disk cache —
-    // matching the other SDKs. A disk cache keyed by profile path would
-    // re-serve a stale token after a change to ANTHROPIC_WORKSPACE_ID (or
-    // ANTHROPIC_ORGANIZATION_ID / ANTHROPIC_FEDERATION_RULE_ID) until the
-    // cached token expired, so the env-only chain stays in-memory only.
-    const withPath = config.authentication.credentials_path || !fromFile ?
-        config
-        : {
-            ...config,
-            authentication: {
-                ...config.authentication,
-                credentials_path: (await getCredentialsPath(config, profile)) ?? undefined,
-            },
-        };
-    return resolveCredentialsFromConfig(withPath, options);
-}
-function buildProvider(config, credentialsPath, baseURL, options) {
-    switch (config.authentication.type) {
-        case 'oidc_federation': {
-            const auth = config.authentication;
-            const identityProvider = resolveIdentityTokenProvider(auth);
-            if (!identityProvider) {
-                throw new WorkloadIdentityError('oidc_federation config requires an identity token (set authentication.identity_token, ' +
-                    'ANTHROPIC_IDENTITY_TOKEN_FILE, or ANTHROPIC_IDENTITY_TOKEN)');
-            }
-            if (!auth.federation_rule_id) {
-                throw new WorkloadIdentityError("oidc_federation config requires 'federation_rule_id'. Set it in authentication.federation_rule_id in your profile, or via ANTHROPIC_FEDERATION_RULE_ID (profile takes precedence).");
-            }
-            if (!config.organization_id) {
-                throw new WorkloadIdentityError('oidc_federation config requires organization_id (set ANTHROPIC_ORGANIZATION_ID or config.organization_id)');
-            }
-            const exchange = oidcFederationProvider({
-                identityTokenProvider: identityProvider,
-                federationRuleId: auth.federation_rule_id,
-                organizationId: config.organization_id,
-                serviceAccountId: auth.service_account_id,
-                workspaceId: config.workspace_id,
-                baseURL,
-                fetch: options.fetch,
-                userAgent: options.userAgent,
-            });
-            // If there's a credentials file path, wrap the exchange with file caching
-            // (check file for fresh token before exchanging, write back after).
-            if (credentialsPath) {
-                return cachedExchangeProvider(exchange, credentialsPath, options.onCacheWriteError, options.onSafetyWarning);
-            }
-            return exchange;
-        }
-        case 'user_oauth': {
-            if (!credentialsPath) {
-                throw new WorkloadIdentityError('user_oauth config requires authentication.credentials_path ' +
-                    '(or load via a profile so it defaults to <config_dir>/credentials/<profile>.json)');
-            }
-            return userOAuthProvider({
-                credentialsPath,
-                clientId: config.authentication.client_id,
-                baseURL,
-                fetch: options.fetch,
-                userAgent: options.userAgent,
-                onSafetyWarning: options.onSafetyWarning,
-            });
-        }
-        default: {
-            const t = config.authentication.type;
-            throw new WorkloadIdentityError(`authentication.type "${t}" is not a known authentication type`);
-        }
-    }
-}
-/**
- * Resolves the identity token provider from config fields or environment variables.
- *
- * Resolution order:
- *   1. `identity_token.path` from the config (source: "file")
- *   2. `ANTHROPIC_IDENTITY_TOKEN_FILE` env var
- *   3. `ANTHROPIC_IDENTITY_TOKEN` env var (static value)
- */
-function resolveIdentityTokenProvider(auth) {
-    if (auth.identity_token) {
-        // Cast needed to stringify an unknown source value for the error message:
-        // the on-disk JSON may contain a source this SDK version doesn't know about.
-        const source = auth.identity_token.source;
-        if (source !== 'file') {
-            throw new WorkloadIdentityError(`identity_token.source "${source}" is not supported by this SDK version (only "file")`);
-        }
-        if (!auth.identity_token.path) {
-            throw new WorkloadIdentityError(`identity_token.source "file" requires a non-empty path`);
-        }
-        return identityTokenFromFile(auth.identity_token.path);
-    }
-    const tokenFile = readEnv('ANTHROPIC_IDENTITY_TOKEN_FILE');
-    if (tokenFile) {
-        return identityTokenFromFile(tokenFile);
-    }
-    const tokenValue = readEnv('ANTHROPIC_IDENTITY_TOKEN');
-    if (tokenValue) {
-        return identityTokenFromValue(tokenValue);
-    }
-    return null;
-}
-/**
- * Wraps a federation exchange provider with credential file caching.
- * Checks the file for a fresh token before exchanging, and writes the
- * result back after a successful exchange (best-effort, atomic replace).
- *
- * Note: this is not cross-process serialized — two SDK instances that
- * miss the cache simultaneously will both perform a full exchange and
- * the last writer wins. That is acceptable: federation exchanges are
- * idempotent and the cache is an optimization, not a correctness gate.
- */
-function cachedExchangeProvider(exchange, credentialsPath, onCacheWriteError, onSafetyWarning) {
-    return async (opts) => {
-        const fs = await import('node:fs');
-        await checkCredentialsFileSafety(credentialsPath, onSafetyWarning);
-        // Try cached credentials file
-        let existing;
-        try {
-            const raw = await fs.promises.readFile(credentialsPath, 'utf-8');
-            existing = JSON.parse(raw);
-            const token = existing?.['access_token'];
-            if (token && !opts?.forceRefresh) {
-                const expiresAt = existing?.['expires_at'];
-                if (expiresAt == null || nowAsSeconds() < expiresAt - MANDATORY_REFRESH_THRESHOLD_IN_SECONDS) {
-                    return { token, expiresAt: expiresAt ?? null };
-                }
-            }
-        }
-        catch (err) {
-            // ENOENT or invalid-JSON → no usable cache, exchange fresh. Other
-            // errors (EACCES, EISDIR, …) indicate a broken cache path; surface to
-            // the optional hook so they're at least debuggable, then proceed.
-            const code = err?.code;
-            if (code !== 'ENOENT' && !(err instanceof SyntaxError)) {
-                onCacheWriteError?.(err);
-            }
-        }
-        // Exchange for a new token
-        const result = await exchange(opts);
-        // Write cache back (best-effort). Preserve any unknown keys from the
-        // existing file (notably refresh_token, in the unlikely case this path
-        // is shared with a user_oauth profile) so the federation cache writer
-        // doesn't clobber material it didn't own.
-        try {
-            await writeCredentialsFileAtomic(credentialsPath, {
-                ...(existing ?? {}),
-                version: CREDENTIALS_FILE_VERSION,
-                type: 'oauth_token',
-                access_token: result.token,
-                expires_at: result.expiresAt,
-            });
-        }
-        catch (err) {
-            // Best-effort caching: surface to the optional hook but never fail
-            // the exchange itself.
-            onCacheWriteError?.(err);
-        }
-        return result;
-    };
-}
-//# sourceMappingURL=credential-chain.mjs.map

package/scripts/node_modules/@anthropic-ai/sdk/lib/credentials/credential-chain.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"credential-chain.mjs","sourceRoot":"","sources":["../../src/lib/credentials/credential-chain.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,qCAAiC;AACnD,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,GAEnB,mCAA+B;AAEhC,OAAO,EACL,sCAAsC,EACtC,qBAAqB,EACrB,0BAA0B,EAC1B,0BAA0B,GAC3B,oBAAgB;AACjB,OAAO,EAAE,YAAY,EAAE,sCAAkC;AACzD,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,6BAAyB;AACjF,OAAO,EAAE,sBAAsB,EAAE,8BAA0B;AAC3D,OAAO,EAAE,iBAAiB,EAAE,yBAAqB;AAqBjD,MAAM,UAAU,4BAA4B,CAC1C,MAAuB,EACvB,OAAwB;IAExB,MAAM,eAAe,GAAG,MAAM,CAAC,cAAc,CAAC,gBAAgB,IAAI,IAAI,CAAC;IACvE,MAAM,gBAAgB,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAElF,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAEnF,MAAM,YAAY,GAA2B,EAAE,CAAC;IAChD,0EAA0E;IAC1E,6DAA6D;IAC7D,qDAAqD;IACrD,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,cAAc,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACvE,YAAY,CAAC,wBAAwB,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC;IAC/D,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAwB,EACxB,OAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAEpC,uEAAuE;IACvE,0EAA0E;IAC1E,4EAA4E;IAC5E,sBAAsB;IACtB,EAAE;IACF,uEAAuE;IACvE,oEAAoE;IACpE,sEAAsE;IACtE,sEAAsE;IACtE,oEAAoE;IACpE,MAAM,QAAQ,GACZ,MAAM,CAAC,cAAc,CAAC,gBAAgB,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM;QACR,CAAC,CAAC;YACE,GAAG,MAAM;YACT,cAAc,EAAE;gBACd,GAAG,MAAM,CAAC,cAAc;gBACxB,gBAAgB,EAAE,CAAC,MAAM,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,SAAS;aAC3E;SACF,CAAC;IAEN,OAAO,4BAA4B,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,aAAa,CACpB,MAAuB,EACvB,eAA8B,EAC9B,OAAe,EACf,OAAwB;IAExB,QAAQ,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACnC,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,CAAC;YACnC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;YAC5D,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,MAAM,IAAI,qBAAqB,CAC7B,wFAAwF;oBACtF,6DAA6D,CAChE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC7B,MAAM,IAAI,qBAAqB,CAC7B,oLAAoL,CACrL,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;gBAC5B,MAAM,IAAI,qBAAqB,CAC7B,2GAA2G,CAC5G,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,sBAAsB,CAAC;gBACtC,qBAAqB,EAAE,gBAAgB;gBACvC,gBAAgB,EAAE,IAAI,CAAC,kBAAkB;gBACzC,cAAc,EAAE,MAAM,CAAC,eAAe;gBACtC,gBAAgB,EAAE,IAAI,CAAC,kBAAkB;gBACzC,WAAW,EAAE,MAAM,CAAC,YAAY;gBAChC,OAAO;gBACP,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC,CAAC;YAEH,0EAA0E;YAC1E,oEAAoE;YACpE,IAAI,eAAe,EAAE,CAAC;gBACpB,OAAO,sBAAsB,CAC3B,QAAQ,EACR,eAAe,EACf,OAAO,CAAC,iBAAiB,EACzB,OAAO,CAAC,eAAe,CACxB,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,MAAM,IAAI,qBAAqB,CAC7B,6DAA6D;oBAC3D,mFAAmF,CACtF,CAAC;YACJ,CAAC;YACD,OAAO,iBAAiB,CAAC;gBACvB,eAAe;gBACf,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS;gBACzC,OAAO;gBACP,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,eAAe,EAAE,OAAO,CAAC,eAAe;aACzC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,CAAC,GAAI,MAAM,CAAC,cAAmC,CAAC,IAAI,CAAC;YAC3D,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,sCAAsC,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,4BAA4B,CACnC,IAA6E;IAE7E,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,0EAA0E;QAC1E,6EAA6E;QAC7E,MAAM,MAAM,GAAI,IAAI,CAAC,cAAqC,CAAC,MAAM,CAAC;QAClE,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,qBAAqB,CAC7B,0BAA0B,MAAM,sDAAsD,CACvF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,qBAAqB,CAAC,wDAAwD,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,qBAAqB,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAC3D,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACvD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,sBAAsB,CAC7B,QAA6B,EAC7B,eAAuB,EACvB,iBAAuD,EACvD,eAAoD;IAEpD,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE;QACpB,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QAEnC,MAAM,0BAA0B,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;QAEnE,8BAA8B;QAC9B,IAAI,QAA6C,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YACjE,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,cAAc,CAAuB,CAAC;YAC/D,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;gBACjC,MAAM,SAAS,GAAG,QAAQ,EAAE,CAAC,YAAY,CAAuB,CAAC;gBACjE,IAAI,SAAS,IAAI,IAAI,IAAI,YAAY,EAAE,GAAG,SAAS,GAAG,sCAAsC,EAAE,CAAC;oBAC7F,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,IAAI,IAAI,EAAE,CAAC;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,kEAAkE;YAClE,sEAAsE;YACtE,kEAAkE;YAClE,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;YAClD,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,YAAY,WAAW,CAAC,EAAE,CAAC;gBACvD,iBAAiB,EAAE,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEpC,qEAAqE;QACrE,uEAAuE;QACvE,sEAAsE;QACtE,0CAA0C;QAC1C,IAAI,CAAC;YACH,MAAM,0BAA0B,CAAC,eAAe,EAAE;gBAChD,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;gBACnB,OAAO,EAAE,wBAAwB;gBACjC,IAAI,EAAE,aAAa;gBACnB,YAAY,EAAE,MAAM,CAAC,KAAK;gBAC1B,UAAU,EAAE,MAAM,CAAC,SAAS;aAC7B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,uBAAuB;YACvB,iBAAiB,EAAE,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/scripts/node_modules/@anthropic-ai/sdk/lib/credentials/identity-token.d.mts

@@ -1,11 +0,0 @@
-import type { IdentityTokenProvider } from "./types.mjs";
-/**
- * Reads a JWT from a file on every call. Supports automatic rotation
- * (e.g. Kubernetes projected service-account tokens).
- */
-export declare function identityTokenFromFile(path: string): IdentityTokenProvider;
-/**
- * Wraps a static JWT string as an {@link IdentityTokenProvider}.
- */
-export declare function identityTokenFromValue(token: string): IdentityTokenProvider;
-//# sourceMappingURL=identity-token.d.mts.map

package/scripts/node_modules/@anthropic-ai/sdk/lib/credentials/identity-token.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity-token.d.mts","sourceRoot":"","sources":["../../src/lib/credentials/identity-token.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,oBAAgB;AAErD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,CAmBzE;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,CAK3E"}

package/scripts/node_modules/@anthropic-ai/sdk/lib/credentials/identity-token.d.ts

@@ -1,11 +0,0 @@
-import type { IdentityTokenProvider } from "./types.js";
-/**
- * Reads a JWT from a file on every call. Supports automatic rotation
- * (e.g. Kubernetes projected service-account tokens).
- */
-export declare function identityTokenFromFile(path: string): IdentityTokenProvider;
-/**
- * Wraps a static JWT string as an {@link IdentityTokenProvider}.
- */
-export declare function identityTokenFromValue(token: string): IdentityTokenProvider;
-//# sourceMappingURL=identity-token.d.ts.map

package/scripts/node_modules/@anthropic-ai/sdk/lib/credentials/identity-token.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity-token.d.ts","sourceRoot":"","sources":["../../src/lib/credentials/identity-token.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,mBAAgB;AAErD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,CAmBzE;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,CAK3E"}

package/scripts/node_modules/@anthropic-ai/sdk/lib/credentials/identity-token.js

@@ -1,72 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.identityTokenFromFile = identityTokenFromFile;
-exports.identityTokenFromValue = identityTokenFromValue;
-const error_1 = require("../../core/error.js");
-/**
- * Reads a JWT from a file on every call. Supports automatic rotation
- * (e.g. Kubernetes projected service-account tokens).
- */
-function identityTokenFromFile(path) {
-    if (!path) {
-        throw new error_1.AnthropicError('Identity token file path is empty');
-    }
-    return async () => {
-        const fs = await Promise.resolve().then(() => __importStar(require('node:fs')));
-        let content;
-        try {
-            content = await fs.promises.readFile(path, 'utf-8');
-        }
-        catch (err) {
-            throw new error_1.AnthropicError(`Failed to read identity token file at ${path}: ${err}`);
-        }
-        const token = content.trim();
-        if (!token) {
-            throw new error_1.AnthropicError(`Identity token file at ${path} is empty`);
-        }
-        return token;
-    };
-}
-/**
- * Wraps a static JWT string as an {@link IdentityTokenProvider}.
- */
-function identityTokenFromValue(token) {
-    if (!token) {
-        throw new error_1.AnthropicError('Identity token value is empty');
-    }
-    return () => token;
-}
-//# sourceMappingURL=identity-token.js.map

package/scripts/node_modules/@anthropic-ai/sdk/lib/credentials/identity-token.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity-token.js","sourceRoot":"","sources":["../../src/lib/credentials/identity-token.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAOA,sDAmBC;AAKD,wDAKC;AApCD,+CAAkD;AAGlD;;;GAGG;AACH,SAAgB,qBAAqB,CAAC,IAAY;IAChD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,sBAAc,CAAC,mCAAmC,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,KAAK,IAAI,EAAE;QAChB,MAAM,EAAE,GAAG,wDAAa,SAAS,GAAC,CAAC;QACnC,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,sBAAc,CAAC,yCAAyC,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,sBAAc,CAAC,0BAA0B,IAAI,WAAW,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,sBAAsB,CAAC,KAAa;IAClD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,sBAAc,CAAC,+BAA+B,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC;AACrB,CAAC"}

package/scripts/node_modules/@anthropic-ai/sdk/lib/credentials/identity-token.mjs

@@ -1,35 +0,0 @@
-import { AnthropicError } from "../../core/error.mjs";
-/**
- * Reads a JWT from a file on every call. Supports automatic rotation
- * (e.g. Kubernetes projected service-account tokens).
- */
-export function identityTokenFromFile(path) {
-    if (!path) {
-        throw new AnthropicError('Identity token file path is empty');
-    }
-    return async () => {
-        const fs = await import('node:fs');
-        let content;
-        try {
-            content = await fs.promises.readFile(path, 'utf-8');
-        }
-        catch (err) {
-            throw new AnthropicError(`Failed to read identity token file at ${path}: ${err}`);
-        }
-        const token = content.trim();
-        if (!token) {
-            throw new AnthropicError(`Identity token file at ${path} is empty`);
-        }
-        return token;
-    };
-}
-/**
- * Wraps a static JWT string as an {@link IdentityTokenProvider}.
- */
-export function identityTokenFromValue(token) {
-    if (!token) {
-        throw new AnthropicError('Identity token value is empty');
-    }
-    return () => token;
-}
-//# sourceMappingURL=identity-token.mjs.map

package/scripts/node_modules/@anthropic-ai/sdk/lib/credentials/identity-token.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity-token.mjs","sourceRoot":"","sources":["../../src/lib/credentials/identity-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,6BAAyB;AAGlD;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,cAAc,CAAC,mCAAmC,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,KAAK,IAAI,EAAE;QAChB,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,yCAAyC,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,cAAc,CAAC,0BAA0B,IAAI,WAAW,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,cAAc,CAAC,+BAA+B,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC;AACrB,CAAC"}

package/scripts/node_modules/@anthropic-ai/sdk/lib/credentials/oidc-federation.d.mts

@@ -1,40 +0,0 @@
-import type { Fetch } from "../../internal/builtin-types.mjs";
-import type { AccessTokenProvider, IdentityTokenProvider } from "./types.mjs";
-export type OIDCFederationConfig = {
-    identityTokenProvider: IdentityTokenProvider;
-    federationRuleId: string;
-    organizationId: string;
-    serviceAccountId?: string | undefined;
-    /**
-     * Optional `wrkspc_*` tagged ID, or the literal `"default"` to scope the
-     * token to the organization's default workspace. When omitted the server
-     * picks the rule's sole enabled workspace, else the org default if the rule
-     * covers it. Required when the rule enables more than one non-default
-     * workspace, or to target a specific workspace other than the one the
-     * server would pick. The minted token is workspace-scoped: per-request
-     * workspace selection (the `anthropic-workspace-id` header) is not supported
-     * for federation tokens — switching workspaces requires a new token exchange
-     * with a different `workspaceId`.
-     */
-    workspaceId?: string | undefined;
-    baseURL: string;
-    fetch: Fetch;
-    /**
-     * Overrides the outgoing User-Agent header on the token exchange. When
-     * empty, sends an SDK-identified UA so the token endpoint's access logs
-     * identify the caller.
-     */
-    userAgent?: string | undefined;
-};
-/**
- * Exchanges an external OIDC JWT for an Anthropic access token via the
- * RFC 7523 jwt-bearer grant.
- *
- * Each invocation performs a fresh token exchange. Wrap in a
- * {@link TokenCache} to avoid exchanging on every request.
- *
- * Federation grants do not return a refresh token — callers re-exchange
- * their assertion on expiry.
- */
-export declare function oidcFederationProvider(config: OIDCFederationConfig): AccessTokenProvider;
-//# sourceMappingURL=oidc-federation.d.mts.map

package/scripts/node_modules/@anthropic-ai/sdk/lib/credentials/oidc-federation.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oidc-federation.d.mts","sourceRoot":"","sources":["../../src/lib/credentials/oidc-federation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,yCAAqC;AAC1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,oBAAgB;AAc1E,MAAM,MAAM,oBAAoB,GAAG;IACjC,qBAAqB,EAAE,qBAAqB,CAAC;IAC7C,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;IACb;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,oBAAoB,GAAG,mBAAmB,CAuFxF"}

package/scripts/node_modules/@anthropic-ai/sdk/lib/credentials/oidc-federation.d.ts

@@ -1,40 +0,0 @@
-import type { Fetch } from "../../internal/builtin-types.js";
-import type { AccessTokenProvider, IdentityTokenProvider } from "./types.js";
-export type OIDCFederationConfig = {
-    identityTokenProvider: IdentityTokenProvider;
-    federationRuleId: string;
-    organizationId: string;
-    serviceAccountId?: string | undefined;
-    /**
-     * Optional `wrkspc_*` tagged ID, or the literal `"default"` to scope the
-     * token to the organization's default workspace. When omitted the server
-     * picks the rule's sole enabled workspace, else the org default if the rule
-     * covers it. Required when the rule enables more than one non-default
-     * workspace, or to target a specific workspace other than the one the
-     * server would pick. The minted token is workspace-scoped: per-request
-     * workspace selection (the `anthropic-workspace-id` header) is not supported
-     * for federation tokens — switching workspaces requires a new token exchange
-     * with a different `workspaceId`.
-     */
-    workspaceId?: string | undefined;
-    baseURL: string;
-    fetch: Fetch;
-    /**
-     * Overrides the outgoing User-Agent header on the token exchange. When
-     * empty, sends an SDK-identified UA so the token endpoint's access logs
-     * identify the caller.
-     */
-    userAgent?: string | undefined;
-};
-/**
- * Exchanges an external OIDC JWT for an Anthropic access token via the
- * RFC 7523 jwt-bearer grant.
- *
- * Each invocation performs a fresh token exchange. Wrap in a
- * {@link TokenCache} to avoid exchanging on every request.
- *
- * Federation grants do not return a refresh token — callers re-exchange
- * their assertion on expiry.
- */
-export declare function oidcFederationProvider(config: OIDCFederationConfig): AccessTokenProvider;
-//# sourceMappingURL=oidc-federation.d.ts.map

package/scripts/node_modules/@anthropic-ai/sdk/lib/credentials/oidc-federation.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oidc-federation.d.ts","sourceRoot":"","sources":["../../src/lib/credentials/oidc-federation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,wCAAqC;AAC1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,mBAAgB;AAc1E,MAAM,MAAM,oBAAoB,GAAG;IACjC,qBAAqB,EAAE,qBAAqB,CAAC;IAC7C,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC;IACb;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,oBAAoB,GAAG,mBAAmB,CAuFxF"}

package/scripts/node_modules/@anthropic-ai/sdk/lib/credentials/oidc-federation.js

@@ -1,82 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.oidcFederationProvider = oidcFederationProvider;
-const types_1 = require("./types.js");
-const time_1 = require("../../internal/utils/time.js");
-const version_1 = require("../../version.js");
-/**
- * Exchanges an external OIDC JWT for an Anthropic access token via the
- * RFC 7523 jwt-bearer grant.
- *
- * Each invocation performs a fresh token exchange. Wrap in a
- * {@link TokenCache} to avoid exchanging on every request.
- *
- * Federation grants do not return a refresh token — callers re-exchange
- * their assertion on expiry.
- */
-function oidcFederationProvider(config) {
-    return async () => {
-        (0, types_1.requireSecureTokenEndpoint)(config.baseURL);
-        const jwt = await config.identityTokenProvider();
-        // The token endpoint enforces a 16 KiB assertion limit; surface a clear
-        // client-side error so misconfigured projected-token sources are
-        // diagnosable without a server round-trip.
-        if (jwt.length > 16 * 1024) {
-            throw new types_1.WorkloadIdentityError(`Identity token is ${Math.ceil(jwt.length / 1024)} KiB, exceeds the 16 KiB assertion limit`);
-        }
-        const body = {
-            grant_type: types_1.GRANT_TYPE_JWT_BEARER,
-            assertion: jwt,
-            federation_rule_id: config.federationRuleId,
-            organization_id: config.organizationId,
-        };
-        if (config.serviceAccountId) {
-            body['service_account_id'] = config.serviceAccountId;
-        }
-        if (config.workspaceId) {
-            body['workspace_id'] = config.workspaceId;
-        }
-        const url = `${config.baseURL}${types_1.TOKEN_ENDPOINT}`;
-        let resp;
-        try {
-            resp = await config.fetch(url, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                    'anthropic-beta': `${types_1.OAUTH_API_BETA_HEADER},${types_1.FEDERATION_BETA_HEADER}`,
-                    'User-Agent': config.userAgent || `anthropic-sdk-typescript/${version_1.VERSION} oidcFederationProvider`,
-                },
-                body: JSON.stringify(body),
-            });
-        }
-        catch (err) {
-            throw new types_1.WorkloadIdentityError(`Failed to reach token endpoint ${url}: ${err}`);
-        }
-        const requestId = resp.headers.get('Request-Id');
-        if (!resp.ok) {
-            const text = await resp.text().catch(() => '');
-            const redacted = (0, types_1.redactSensitive)(text);
-            // A 401 is hard to debug from the status code alone, so surface
-            // guidance: check the federation rule, optionally set a workspace ID
-            // (the most common fix when no workspaceId is configured), and point at
-            // the Workload identity page in Claude Console for the server-side
-            // authentication event log. Other statuses (5xx, 400, ...) get no hint.
-            let hint = '';
-            if (resp.status === 401) {
-                const hintMiddle = config.workspaceId ? '' : ("If your federation rule is scoped to multiple workspaces, set the ANTHROPIC_WORKSPACE_ID environment variable, the 'workspace_id' config key, or the `workspaceId` option. ");
-                hint = ` Ensure your federation rule matches your identity token. ${hintMiddle}View your authentication events in the Workload identity page of Claude Console for more details.`;
-            }
-            throw new types_1.WorkloadIdentityError(`Token exchange failed with status ${resp.status}${requestId ? ` (request-id ${requestId})` : ''}: ${redacted}${hint}`, resp.status, redacted, requestId);
-        }
-        const data = await (0, types_1.parseTokenResponse)(resp, requestId);
-        const expiresIn = Number(data.expires_in);
-        if (!Number.isFinite(expiresIn)) {
-            throw new types_1.WorkloadIdentityError(`Token endpoint response missing required fields: ${JSON.stringify((0, types_1.redactSensitive)(data))}`, resp.status, (0, types_1.redactSensitive)(data), requestId);
-        }
-        return {
-            token: data.access_token,
-            expiresAt: (0, time_1.nowAsSeconds)() + expiresIn,
-        };
-    };
-}
-//# sourceMappingURL=oidc-federation.js.map

package/scripts/node_modules/@anthropic-ai/sdk/lib/credentials/oidc-federation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oidc-federation.js","sourceRoot":"","sources":["../../src/lib/credentials/oidc-federation.ts"],"names":[],"mappings":";;AAoDA,wDAuFC;AAzID,sCASiB;AACjB,uDAAyD;AACzD,8CAAwC;AA6BxC;;;;;;;;;GASG;AACH,SAAgB,sBAAsB,CAAC,MAA4B;IACjE,OAAO,KAAK,IAAI,EAAE;QAChB,IAAA,kCAA0B,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAE3C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,qBAAqB,EAAE,CAAC;QACjD,wEAAwE;QACxE,iEAAiE;QACjE,2CAA2C;QAC3C,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,6BAAqB,CAC7B,qBAAqB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,0CAA0C,CAC5F,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAA2B;YACnC,UAAU,EAAE,6BAAqB;YACjC,SAAS,EAAE,GAAG;YACd,kBAAkB,EAAE,MAAM,CAAC,gBAAgB;YAC3C,eAAe,EAAE,MAAM,CAAC,cAAc;SACvC,CAAC;QACF,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC5B,IAAI,CAAC,oBAAoB,CAAC,GAAG,MAAM,CAAC,gBAAgB,CAAC;QACvD,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,IAAI,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;QAC5C,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,GAAG,sBAAc,EAAE,CAAC;QACjD,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC7B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,gBAAgB,EAAE,GAAG,6BAAqB,IAAI,8BAAsB,EAAE;oBACtE,YAAY,EAAE,MAAM,CAAC,SAAS,IAAI,4BAA4B,iBAAO,yBAAyB;iBAC/F;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,6BAAqB,CAAC,kCAAkC,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAEjD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,IAAA,uBAAe,EAAC,IAAI,CAAC,CAAC;YACvC,gEAAgE;YAChE,qEAAqE;YACrE,wEAAwE;YACxE,mEAAmE;YACnE,wEAAwE;YACxE,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxB,MAAM,UAAU,GACd,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CACxB,6KAA6K,CAC9K,CAAC;gBACJ,IAAI,GAAG,6DAA6D,UAAU,mGAAmG,CAAC;YACpL,CAAC;YACD,MAAM,IAAI,6BAAqB,CAC7B,qCAAqC,IAAI,CAAC,MAAM,GAC9C,SAAS,CAAC,CAAC,CAAC,gBAAgB,SAAS,GAAG,CAAC,CAAC,CAAC,EAC7C,KAAK,QAAQ,GAAG,IAAI,EAAE,EACtB,IAAI,CAAC,MAAM,EACX,QAAQ,EACR,SAAS,CACV,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAA,0BAAkB,EAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,6BAAqB,CAC7B,oDAAoD,IAAI,CAAC,SAAS,CAAC,IAAA,uBAAe,EAAC,IAAI,CAAC,CAAC,EAAE,EAC3F,IAAI,CAAC,MAAM,EACX,IAAA,uBAAe,EAAC,IAAI,CAAC,EACrB,SAAS,CACV,CAAC;QACJ,CAAC;QAED,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,YAAY;YACxB,SAAS,EAAE,IAAA,mBAAY,GAAE,GAAG,SAAS;SACtC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/scripts/node_modules/@anthropic-ai/sdk/lib/credentials/oidc-federation.mjs

@@ -1,79 +0,0 @@
-import { FEDERATION_BETA_HEADER, GRANT_TYPE_JWT_BEARER, OAUTH_API_BETA_HEADER, TOKEN_ENDPOINT, WorkloadIdentityError, parseTokenResponse, redactSensitive, requireSecureTokenEndpoint, } from "./types.mjs";
-import { nowAsSeconds } from "../../internal/utils/time.mjs";
-import { VERSION } from "../../version.mjs";
-/**
- * Exchanges an external OIDC JWT for an Anthropic access token via the
- * RFC 7523 jwt-bearer grant.
- *
- * Each invocation performs a fresh token exchange. Wrap in a
- * {@link TokenCache} to avoid exchanging on every request.
- *
- * Federation grants do not return a refresh token — callers re-exchange
- * their assertion on expiry.
- */
-export function oidcFederationProvider(config) {
-    return async () => {
-        requireSecureTokenEndpoint(config.baseURL);
-        const jwt = await config.identityTokenProvider();
-        // The token endpoint enforces a 16 KiB assertion limit; surface a clear
-        // client-side error so misconfigured projected-token sources are
-        // diagnosable without a server round-trip.
-        if (jwt.length > 16 * 1024) {
-            throw new WorkloadIdentityError(`Identity token is ${Math.ceil(jwt.length / 1024)} KiB, exceeds the 16 KiB assertion limit`);
-        }
-        const body = {
-            grant_type: GRANT_TYPE_JWT_BEARER,
-            assertion: jwt,
-            federation_rule_id: config.federationRuleId,
-            organization_id: config.organizationId,
-        };
-        if (config.serviceAccountId) {
-            body['service_account_id'] = config.serviceAccountId;
-        }
-        if (config.workspaceId) {
-            body['workspace_id'] = config.workspaceId;
-        }
-        const url = `${config.baseURL}${TOKEN_ENDPOINT}`;
-        let resp;
-        try {
-            resp = await config.fetch(url, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                    'anthropic-beta': `${OAUTH_API_BETA_HEADER},${FEDERATION_BETA_HEADER}`,
-                    'User-Agent': config.userAgent || `anthropic-sdk-typescript/${VERSION} oidcFederationProvider`,
-                },
-                body: JSON.stringify(body),
-            });
-        }
-        catch (err) {
-            throw new WorkloadIdentityError(`Failed to reach token endpoint ${url}: ${err}`);
-        }
-        const requestId = resp.headers.get('Request-Id');
-        if (!resp.ok) {
-            const text = await resp.text().catch(() => '');
-            const redacted = redactSensitive(text);
-            // A 401 is hard to debug from the status code alone, so surface
-            // guidance: check the federation rule, optionally set a workspace ID
-            // (the most common fix when no workspaceId is configured), and point at
-            // the Workload identity page in Claude Console for the server-side
-            // authentication event log. Other statuses (5xx, 400, ...) get no hint.
-            let hint = '';
-            if (resp.status === 401) {
-                const hintMiddle = config.workspaceId ? '' : ("If your federation rule is scoped to multiple workspaces, set the ANTHROPIC_WORKSPACE_ID environment variable, the 'workspace_id' config key, or the `workspaceId` option. ");
-                hint = ` Ensure your federation rule matches your identity token. ${hintMiddle}View your authentication events in the Workload identity page of Claude Console for more details.`;
-            }
-            throw new WorkloadIdentityError(`Token exchange failed with status ${resp.status}${requestId ? ` (request-id ${requestId})` : ''}: ${redacted}${hint}`, resp.status, redacted, requestId);
-        }
-        const data = await parseTokenResponse(resp, requestId);
-        const expiresIn = Number(data.expires_in);
-        if (!Number.isFinite(expiresIn)) {
-            throw new WorkloadIdentityError(`Token endpoint response missing required fields: ${JSON.stringify(redactSensitive(data))}`, resp.status, redactSensitive(data), requestId);
-        }
-        return {
-            token: data.access_token,
-            expiresAt: nowAsSeconds() + expiresIn,
-        };
-    };
-}
-//# sourceMappingURL=oidc-federation.mjs.map

package/scripts/node_modules/@anthropic-ai/sdk/lib/credentials/oidc-federation.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"oidc-federation.mjs","sourceRoot":"","sources":["../../src/lib/credentials/oidc-federation.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,0BAA0B,GAC3B,oBAAgB;AACjB,OAAO,EAAE,YAAY,EAAE,sCAAkC;AACzD,OAAO,EAAE,OAAO,EAAE,0BAAsB;AA6BxC;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAA4B;IACjE,OAAO,KAAK,IAAI,EAAE;QAChB,0BAA0B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAE3C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,qBAAqB,EAAE,CAAC;QACjD,wEAAwE;QACxE,iEAAiE;QACjE,2CAA2C;QAC3C,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,qBAAqB,CAC7B,qBAAqB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,0CAA0C,CAC5F,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAA2B;YACnC,UAAU,EAAE,qBAAqB;YACjC,SAAS,EAAE,GAAG;YACd,kBAAkB,EAAE,MAAM,CAAC,gBAAgB;YAC3C,eAAe,EAAE,MAAM,CAAC,cAAc;SACvC,CAAC;QACF,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC5B,IAAI,CAAC,oBAAoB,CAAC,GAAG,MAAM,CAAC,gBAAgB,CAAC;QACvD,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,IAAI,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;QAC5C,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,GAAG,cAAc,EAAE,CAAC;QACjD,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC7B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,gBAAgB,EAAE,GAAG,qBAAqB,IAAI,sBAAsB,EAAE;oBACtE,YAAY,EAAE,MAAM,CAAC,SAAS,IAAI,4BAA4B,OAAO,yBAAyB;iBAC/F;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAEjD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YACvC,gEAAgE;YAChE,qEAAqE;YACrE,wEAAwE;YACxE,mEAAmE;YACnE,wEAAwE;YACxE,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxB,MAAM,UAAU,GACd,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CACxB,6KAA6K,CAC9K,CAAC;gBACJ,IAAI,GAAG,6DAA6D,UAAU,mGAAmG,CAAC;YACpL,CAAC;YACD,MAAM,IAAI,qBAAqB,CAC7B,qCAAqC,IAAI,CAAC,MAAM,GAC9C,SAAS,CAAC,CAAC,CAAC,gBAAgB,SAAS,GAAG,CAAC,CAAC,CAAC,EAC7C,KAAK,QAAQ,GAAG,IAAI,EAAE,EACtB,IAAI,CAAC,MAAM,EACX,QAAQ,EACR,SAAS,CACV,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,qBAAqB,CAC7B,oDAAoD,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAC3F,IAAI,CAAC,MAAM,EACX,eAAe,CAAC,IAAI,CAAC,EACrB,SAAS,CACV,CAAC;QACJ,CAAC;QAED,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,YAAY;YACxB,SAAS,EAAE,YAAY,EAAE,GAAG,SAAS;SACtC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}