cliV1 0.0.7__py3-none-any.whl

swagger_petstore_open_api_3_1_0/core/_internal/wire.py

@@ -0,0 +1,201 @@
+"""One declared value, one wire-ready form.
+
+Every request parameter -- query, form, path, header, or a base URL's server variable -- reaches
+the wire the same way: validated against the type the endpoint declared, dumped through that
+type's adapter, and turned into text. Only the *arrangement* differs, and that stays with each
+destination: :mod:`.form` explodes values into ``key[sub]`` pairs, :mod:`.urls` joins them into
+``/``-separated segments, :mod:`.headers` folds them into one field value.
+
+That shared prefix lives here, which is why a ``datetime`` declared ``RFC1123DateTime`` renders as
+its GMT string at every destination without any of them knowing what a datetime is -- and why a
+fifth destination would need no serialization code of its own."""
+
+from __future__ import annotations
+
+import json
+from collections.abc import Iterable, Mapping
+from typing import Any, TypeGuard
+
+from pydantic import ValidationError
+
+from ..optionality import strip_unset
+from ..params import Param
+
+
+def wire_value(param: Param[Any]) -> object:
+    """``param``'s value in wire form: validated against its declared type, then dumped.
+
+    The same two steps, in the same order, as :func:`json_body` -- and the reason a parameter
+    holds its resolved adapter rather than the type expression it came from. Validation coerces
+    dict-shaped input (``Model | FooDict`` companions) through the model's own rules; the dump
+    applies the type's serializer, which is what renders an ``RFC1123DateTime`` as its GMT string,
+    an enum as its value and a model under its wire aliases.
+
+    A validation failure is re-raised naming the parameter: pydantic titles the error by the
+    *type* (``1 validation error for int``), which on an endpoint with five parameters leaves the
+    caller guessing which one failed. ``ValidationError`` subclasses ``ValueError``, so a caller's
+    ``except ValueError`` covers both spellings, and the full per-field detail rides ``__cause__``.
+
+    ``strip_unset`` is what drops a field the caller never touched, and the only thing that can:
+    ``UnsetType`` is not ``None``, so the dump keeps the key and it serializes as ``null``, which a
+    JSON-encoded path segment or header value would carry verbatim. An *explicit* ``None`` is
+    kept -- see docs/designs/optional-nullable-fields.md. Which of those nulls survives is the
+    destination's own decision, taken in :func:`text_values` and ``flattening.flatten``: compact
+    JSON can spell one, a query pair or a flat path segment cannot.
+
+    The result is still structured -- a collection stays a list, a model stays a mapping -- because
+    the query and form destination needs that shape to explode into ``key[sub]`` keys.
+
+    Args:
+        param: The parameter to render, carrying its declared type's adapter.
+
+    Returns:
+        The dumped value, still structured; a top-level set is sorted so one call yields one URL.
+
+    Raises:
+        ValueError: If the value does not match its declared type. The message names the
+            parameter; pydantic's per-field detail rides ``__cause__``."""
+    try:
+        validated = param.adapter.validate_python(param.value)
+    except ValidationError as error:
+        raise ValueError(f"Parameter value does not match its declared type: {param.key}") from error
+
+    dumped: object = strip_unset(validated, param.adapter.dump_python(validated, mode="json"))
+
+    # JSON has no set, so the dump has already flattened one into a list in hash-iteration order.
+    # Sorting is what keeps one call producing one URL across runs. A *top-level* set is the whole
+    # reach on purpose: a set nested inside a container is not an emittable declared type --
+    # ``adapters.py``'s ``_CONTAINERS`` and ``strip_unset`` close at ``list``/``dict`` for the same
+    # reason -- so walking deeper would be speculative surface for a shape no spec yields.
+    if isinstance(validated, (set, frozenset)) and isinstance(dumped, list):
+        return sorted(dumped, key=str)
+
+    return dumped
+
+
+def text_values(param: Param[Any]) -> tuple[str, ...]:
+    """``param`` as the flat texts it contributes -- one per path segment or header list member.
+
+    Empty means it contributes nothing: its value was ``None``, or its collection was. A scalar is
+    one text, a flat collection is one text per member, and anything structured -- a mapping, a
+    model, or a collection holding either -- is one text of compact JSON, since neither a path
+    segment nor a header value can carry a nested shape any other way.
+
+    The arrangement is settled *before* the ``None`` rule, because the two arrangements can
+    represent different things: compact JSON spells ``null``, so a structured collection carries a
+    ``None`` member as one, while a flat collection has no such spelling and refuses it.
+
+    Args:
+        param: The parameter to render.
+
+    Returns:
+        One text per segment or header member; empty when the parameter contributes nothing.
+
+    Raises:
+        ValueError: If the value does not match its declared type, or if a *flat* collection holds
+            a ``None`` -- neither a path segment nor a header member can spell one."""
+    value = wire_value(param)
+    if value is None:
+        return ()
+
+    if isinstance(value, Mapping):
+        return (compact_json(value),)
+
+    if not is_collection(value):
+        return (to_text(value),)
+
+    members = list(value)
+    if any(isinstance(member, Mapping) or is_collection(member) for member in members):
+        return (compact_json(members),)
+
+    if any(member is None for member in members):
+        # Query and form encoding can drop a member, because it can also repeat or omit a key.
+        # Neither of these destinations can: a path would address a different route and a header
+        # would carry an empty list slot, both silently.
+        raise ValueError(f"Parameter value contains None: {param.key}")
+
+    return tuple(to_text(member) for member in members)
+
+
+def to_text(value: object) -> str:
+    """One dumped scalar as the text a URL or a header carries.
+
+    The adapter has already applied wire aliases, enum values and temporal formats, so only
+    booleans are left: every destination here is text and expects JSON's ``true``/``false``,
+    whereas ``str(True)`` would emit ``True``. Called only where a value actually becomes text,
+    which is what lets the structured branches above keep real booleans for :func:`compact_json`.
+
+    Args:
+        value: One already-dumped scalar.
+
+    Returns:
+        Its text form, with booleans lowercased to JSON's spelling."""
+    if isinstance(value, bool):
+        return "true" if value else "false"
+
+    return str(value)
+
+
+def parse_json(content: bytes) -> Any:
+    """Parse a response body as JSON, normalising both ways it can fail.
+
+    Parsed from the bytes rather than from a decoded ``str``, so RFC 8259 encoding detection applies
+    (UTF-8/16/32, BOM-tolerant) and an undecodable byte is a failure rather than a replacement
+    character smuggled into a successful payload.
+
+    ``json.JSONDecodeError`` and ``UnicodeDecodeError`` are both ``ValueError``s already, but they
+    read as two unrelated faults; a caller who reached a body that will not parse is owed one answer.
+    The inverse of :func:`compact_json`, and here for the same reason -- one spelling, every caller.
+
+    Args:
+        content: The raw body.
+
+    Returns:
+        Whatever the body parses to -- an object, array or scalar.
+
+    Raises:
+        ValueError: If the body is not valid JSON, or is not decodable at all."""
+    try:
+        return json.loads(content)
+    except (json.JSONDecodeError, UnicodeDecodeError) as exc:
+        raise ValueError("Response body is not valid JSON") from exc
+
+
+def compact_json(value: object, *, ensure_ascii: bool = True) -> str:
+    """JSON-encode a structured value with no insignificant whitespace.
+
+    ``ensure_ascii`` defaults on: a header field value is ISO-8859-1 by RFC 9110 and the transport
+    rejects anything outside it, so a header, a path segment or a multipart text part keeps every
+    non-ASCII character escaped. A JSON *body* passes ``False`` and goes out as UTF-8 -- the bytes
+    httpx's own encoder produced before a body carried its own, so the wire did not change.
+    ``allow_nan`` is turned off: at its default a non-finite float encodes as ``Infinity`` or
+    ``NaN`` -- a Python dialect no RFC 8259 parser accepts -- so the call would fail server-side,
+    far from the line that produced the value.
+
+    Args:
+        value: The structured value to encode.
+        ensure_ascii: Whether non-ASCII characters are escaped; off for a body, on everywhere else.
+
+    Returns:
+        Its JSON text with no insignificant whitespace.
+
+    Raises:
+        ValueError: If ``value`` holds a non-finite float, which has no RFC 8259 spelling."""
+    return json.dumps(value, separators=(",", ":"), ensure_ascii=ensure_ascii, allow_nan=False)
+
+
+def is_collection(value: object) -> TypeGuard[Iterable[object]]:
+    """True for an iterable that should expand into several wire values.
+
+    ``TypeGuard``, deliberately not the newer ``TypeIs``: ``TypeIs`` also narrows the *negative*
+    branch, which would be unsound here -- ``str`` is ``Iterable`` yet this returns ``False`` for
+    it, so a checker told "not an ``Iterable``" would wrongly rule out strings. ``TypeGuard``
+    narrows only where this returns ``True``, which is exactly what the caller needs to iterate.
+
+    Args:
+        value: The dumped value to classify.
+
+    Returns:
+        ``True`` for an iterable that expands into several wire values -- a ``str``, ``bytes`` or
+        ``Mapping`` is one value, not several."""
+    return isinstance(value, Iterable) and not isinstance(value, (str, bytes, Mapping))

swagger_petstore_open_api_3_1_0/core/adapters.py

@@ -0,0 +1,177 @@
+"""The one place a ``TypeAdapter`` is built, and what a value is validated *into*.
+
+Shared by the request path (:func:`json_body`, :func:`param`) and the response path (the decoders),
+so the expensive step in pydantic v2 -- building the adapter -- happens once per type for the life
+of the process rather than once per request.
+
+It sits on its own, below both paths, because both need it and neither owns it: a request-body
+module reaching into the response-decoding module for it would put a cycle in the import graph."""
+
+from __future__ import annotations
+
+from functools import reduce
+from operator import or_
+from threading import RLock
+from types import UnionType
+from typing import Any, Final, TypeVar, Union, get_args, get_origin
+
+from pydantic import TypeAdapter
+from typing_extensions import TypeForm, is_typeddict
+
+T = TypeVar("T")
+
+_CONTAINERS: Final = (list, dict)
+"""The container origins a spec can express -- an array and a map -- so the only two emitted."""
+
+_ADAPTER_CACHE_MAX: Final = 512
+_adapter_lock: Final = RLock()
+_adapters: Final[dict[object, TypeAdapter[Any]]] = {}
+
+
+def validation_target(type_: TypeForm[T]) -> TypeForm[T]:
+    """Drop the dict-shaped companions from ``type_``, leaving what a value is validated *into*.
+
+    An endpoint accepts ``Employee | EmployeeDict``, and that whole union is what it declares and
+    hands the factory -- but only ``Employee`` may reach :func:`adapter_for`. The adapter both
+    validates *and* dumps, and a dict matching the ``TypedDict`` arm is dumped verbatim: wire
+    aliases lost (``address_line_1`` for ``addressLine1``), defaulted fields absent, unknown keys
+    silently dropped. A companion is an *input* shape, never a wire shape, so the type describing
+    what a caller may pass and the type a value is validated into are two different things.
+
+    The strip reaches wherever a companion can be written -- through union members and into
+    container parameters -- so ``list[Employee | EmployeeDict]`` and
+    ``list[Employee] | list[EmployeeDict]`` both resolve to ``list[Employee]``. Generic over ``T``
+    so that ``adapter_for(validation_target(type_))`` keeps the adapter's type instead of erasing
+    it to ``Any`` at the one hop between two otherwise precise signatures.
+
+    A type form that is dict-shaped *throughout* has no target at all. Only a generator defect
+    emits one, and it type-checks, so it is named here rather than surfacing as ``reduce`` failing
+    on an empty sequence at the first request.
+
+    Args:
+        type_: The declared type expression, dict-shaped companions included.
+
+    Returns:
+        The same expression with every companion arm removed -- what a value validates into.
+
+    Raises:
+        TypeError: If ``type_`` is dict-shaped throughout, leaving no model arm to validate into."""
+    if _is_companion(type_):
+        raise TypeError(
+            f"{type_!r} names only dict-shaped companions, which are input shapes and never wire "
+            f"shapes -- a validation target needs the model arm each companion accompanies"
+        )
+
+    target: TypeForm[T] = _strip_companions(type_)
+    return target
+
+
+def _is_companion(type_: TypeForm[Any]) -> bool:
+    """Whether ``type_`` is dict-shaped throughout, so no model arm survives the strip.
+
+    ``all`` for a union and ``any`` for a container, and the asymmetry is the rule itself: a union
+    keeps a target while *one* member has one, whereas a container whose parameter has none has none
+    either -- ``list[EmployeeDict]`` cannot be narrowed to a list of anything.
+
+    Args:
+        type_: The type expression to classify.
+
+    Returns:
+        ``True`` when nothing in ``type_`` would survive the companion strip."""
+    if is_typeddict(type_):
+        return True
+
+    origin = get_origin(type_)
+    if origin in (Union, UnionType):
+        return all(_is_companion(arg) for arg in get_args(type_))
+    if origin in _CONTAINERS:
+        return any(_is_companion(arg) for arg in get_args(type_))
+    return False
+
+
+def _strip_companions(type_: TypeForm[Any]) -> TypeForm[Any]:
+    """``type_`` with every companion dropped, rebuilt only where something actually changed.
+
+    Two properties, each load-bearing:
+
+    - the origin checks, because ``get_args(list[str])`` is ``(str,)`` -- descending is only sound
+      for the origins whose parameters *are* element types, so everything else is returned
+      untouched. Notably ``Annotated``, which is how a discriminated union carries its
+      ``WireDiscriminator``: descending would silently untag it.
+      ``_CONTAINERS`` is closed at ``list`` and ``dict`` rather than "every container Python has" --
+      a spec expresses arrays and maps, and descending a shape no generator emits would be
+      speculative surface. A ``tuple`` or ``set`` parameter passes through like any other origin;
+    - the nothing-changed short-circuits, which hand back the expression *as written* rather than a
+      rebuilt one, so a companion-free union such as ``EmailStr | str`` cannot lose a member to
+      ``Union``'s deduplication, and one declared type keeps one :func:`adapter_for` cache entry.
+
+    Rebuilt with ``|`` rather than ``Union[tuple(targets)]``: mypy types that subscript as a typing
+    special form rather than a ``TypeForm``, so it cannot be returned from this signature. The
+    annotated locals are what keep the imprecision of ``get_args`` here instead of at every caller.
+
+    Args:
+        type_: The type expression to strip.
+
+    Returns:
+        ``type_`` itself when no companion was found, otherwise the rebuilt expression."""
+    origin = get_origin(type_)
+    args = get_args(type_)
+
+    if origin in (Union, UnionType):
+        targets = [_strip_companions(arg) for arg in args if not _is_companion(arg)]
+        if len(targets) == len(args) and all(target is arg for target, arg in zip(targets, args, strict=True)):
+            return type_
+        rebuilt: TypeForm[Any] = reduce(or_, targets)
+        return rebuilt
+
+    if origin in _CONTAINERS:
+        stripped = [_strip_companions(arg) for arg in args]
+        if all(target is arg for target, arg in zip(stripped, args, strict=True)):
+            return type_
+        reparametrized: TypeForm[Any] = origin[tuple(stripped)]
+        return reparametrized
+
+    return type_
+
+
+def adapter_for(type_: TypeForm[T]) -> TypeAdapter[T]:
+    """Return the process-wide cached ``TypeAdapter`` for ``type_``, building it once.
+
+    The cache must be module-level to work at all: a decoder is constructed per call, so
+    an instance-owned cache would be discarded with it and never see a second lookup.
+
+    Unhashable type forms bypass the cache. At ``_ADAPTER_CACHE_MAX`` entries it is cleared
+    wholesale -- predictable, and far beyond the number of distinct types one generated SDK
+    produces.
+
+    A hit is served without the lock, which is sound because a dict read is atomic under the GIL and
+    internally locked on free-threaded builds; a stale read racing the wholesale ``clear()`` still
+    returns a correct adapter for that type. The lock is there to make each *build* happen once --
+    the contract ``test_adapter_cache.py`` pins -- not to serialize reads, so the build stays inside
+    it and the re-check inside catches a type another thread built while this one waited.
+
+    Args:
+        type_: The validation target, already stripped of companions by :func:`validation_target`.
+
+    Returns:
+        The adapter for ``type_``, shared across the process unless ``type_`` is unhashable."""
+    try:
+        hash(type_)
+    except TypeError:
+        return TypeAdapter(type_)
+
+    cached = _adapters.get(type_)
+    if cached is not None:
+        return cached
+
+    with _adapter_lock:
+        cached = _adapters.get(type_)
+        if cached is not None:
+            return cached
+
+        if len(_adapters) >= _ADAPTER_CACHE_MAX:
+            _adapters.clear()
+
+        adapter: TypeAdapter[T] = TypeAdapter(type_)
+        _adapters[type_] = adapter
+        return adapter

swagger_petstore_open_api_3_1_0/core/auth/__init__.py

@@ -0,0 +1,70 @@
+"""The authentication layer's curated surface: its models, its contract, its composites.
+
+The route the runtime facade and ``raw_client`` take, so neither needs to know how this package is laid
+out. What only ``schemes/`` needs -- ``ScopeT``, ``OAuth2Credentials``, ``CredentialsPlacement``,
+``OAuthParams`` and ``scope_params`` -- stays behind, reached at ``models`` directly.
+
+⚠️ **``schemes/`` is deliberately not re-exported here.** A scheme module reaches ``raw_client``, which
+reaches this package -- so importing ``.schemes`` from this file would close that loop into an
+``ImportError`` on whichever of the two is imported first. The facade names ``.schemes`` itself."""
+
+from .composition import (
+    AllSchemes,
+    AnySchemes,
+    AsyncAllSchemes,
+    AsyncAnySchemes,
+    invalidate,
+    is_configured,
+    no_auth,
+    resolve_auth,
+)
+from .models import (
+    AuthParams,
+    OAuthError,
+    OAuthProviderError,
+    OAuthToken,
+    OAuthTokenRefreshable,
+    client_secret_basic,
+    client_secret_post,
+    oauth_error_response,
+)
+from .protocols import (
+    AsyncAuthScheme,
+    AsyncRefreshableTokenSource,
+    AsyncTokenSource,
+    AuthScheme,
+    RefreshableTokenSource,
+    RevocableAuthScheme,
+    TokenSource,
+)
+
+__all__ = [
+    # What one scheme contributes to a request
+    "AuthParams",
+    # The contract
+    "AuthScheme",
+    "AsyncAuthScheme",
+    "RevocableAuthScheme",
+    # The absent credential, and composition
+    "no_auth",
+    "is_configured",
+    "resolve_auth",
+    "invalidate",
+    "AllSchemes",
+    "AnySchemes",
+    "AsyncAllSchemes",
+    "AsyncAnySchemes",
+    # Managed OAuth 2.0 -- the token source seam
+    "TokenSource",
+    "AsyncTokenSource",
+    "RefreshableTokenSource",
+    "AsyncRefreshableTokenSource",
+    # Managed OAuth 2.0 -- the provider's vocabulary
+    "OAuthToken",
+    "OAuthTokenRefreshable",
+    "OAuthProviderError",
+    "OAuthError",
+    "oauth_error_response",
+    "client_secret_basic",
+    "client_secret_post",
+]

swagger_petstore_open_api_3_1_0/core/auth/composition.py

@@ -0,0 +1,175 @@
+"""The absent credential, and the two ways an operation's ``security`` composes several schemes.
+
+:data:`no_auth` is what an unconfigured credential becomes, and :func:`is_configured` tests identity
+against that one instance -- never "applying it did not raise", so a *blank* credential is configured
+and is sent. :class:`AllSchemes` and :class:`AnySchemes`, with their async twins, are OpenAPI's AND and
+OR requirements. Neither withholds a request over a partial set: the SDK never refuses to send because
+a credential is missing, the server decides.
+
+All four composites carry ``invalidate``, which makes a composite itself revocable so nesting
+propagates."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Final
+
+from .models import AuthParams
+from .protocols import AsyncAuthScheme, AuthScheme, RevocableAuthScheme
+
+
+async def resolve_auth(scheme: AsyncAuthScheme) -> AuthParams:
+    """The async client's counterpart to a plain ``scheme.apply()``.
+
+    Narrowing is on :class:`AuthParams` rather than on awaitability, so the awaited branch keeps its
+    precise type instead of widening to ``Any``.
+
+    Args:
+        scheme: The scheme to apply, whether or not it needs I/O to produce its parameters.
+
+    Returns:
+        What the scheme contributes to this request."""
+    applied = scheme.apply()
+    return applied if isinstance(applied, AuthParams) else await applied
+
+
+@dataclass(frozen=True, slots=True)
+class _NoAuth:
+    """The absent credential: a scheme that contributes nothing.
+
+    Private so that :func:`is_configured` can test identity against the one instance below; a second
+    instance would be indistinguishable from a configured scheme by that test."""
+
+    def apply(self) -> AuthParams:
+        return AuthParams()
+
+
+no_auth: Final[AuthScheme] = _NoAuth()
+"""What the client writes when a credential is absent, and ``execute``'s default.
+
+An endpoint whose operation declares no ``security`` omits ``auth=`` entirely and takes this. The SDK
+never refuses to send a request because a credential is missing -- the server decides."""
+
+
+def is_configured(scheme: AuthScheme | AsyncAuthScheme) -> bool:
+    """Whether a credential was supplied for ``scheme``.
+
+    Identity against the one null object, never "applying it did not raise". A *blank* credential is
+    configured and is sent: ``None`` is the only sentinel.
+
+    Args:
+        scheme: The scheme to test, a caller's own included.
+
+    Returns:
+        ``True`` unless this is the null object :data:`no_auth`."""
+    return scheme is not no_auth
+
+
+def invalidate(scheme: AuthScheme | AsyncAuthScheme) -> None:
+    """Drop whatever ``scheme`` cached, if it caches anything at all.
+
+    A no-op for every static scheme, so on an API with no managed OAuth the 401 branch in ``execute``
+    costs one ``isinstance`` and nothing else.
+
+    Args:
+        scheme: The scheme a 401 was received against."""
+    if isinstance(scheme, RevocableAuthScheme):
+        scheme.invalidate()
+
+
+class AllSchemes:
+    """AND-composition: every configured member applies.
+
+    An unconfigured member contributes nothing and drops out on its own; the request still goes out
+    with whatever *was* configured. This layer never withholds a request over a partial set."""
+
+    __slots__ = ("_schemes",)
+
+    def __init__(self, *schemes: AuthScheme) -> None:
+        self._schemes = schemes
+
+    def apply(self) -> AuthParams:
+        applied = [scheme.apply() for scheme in self._schemes]
+        return AuthParams(
+            headers=tuple(p for a in applied for p in a.headers),
+            query_params=tuple(p for a in applied for p in a.query_params),
+            cookies=tuple(p for a in applied for p in a.cookies),
+        )
+
+    def invalidate(self) -> None:
+        """Drop every member's cached credential, via the module-level :func:`invalidate`.
+
+        Having this makes a composite itself revocable, so nesting one inside another propagates."""
+        for scheme in self._schemes:
+            invalidate(scheme)
+
+
+class AnySchemes:
+    """OR-composition: the first *configured* member applies.
+
+    Selection is on credential presence, never on "applying it did not fail" -- an unconfigured member
+    listed ahead of a configured one must not win and send the request unauthenticated. With nothing
+    configured the request goes out unauthenticated, as a single unconfigured scheme would."""
+
+    __slots__ = ("_schemes",)
+
+    def __init__(self, *schemes: AuthScheme) -> None:
+        self._schemes = schemes
+
+    def apply(self) -> AuthParams:
+        for scheme in self._schemes:
+            if is_configured(scheme):
+                return scheme.apply()
+        return AuthParams()
+
+    def invalidate(self) -> None:
+        """Drop every member's cached credential; see :meth:`AllSchemes.invalidate`.
+
+        Over-invalidates on purpose: which arm won the last :meth:`apply` is not tracked, and tracking
+        it would mean per-request state on an object every request shares."""
+        for scheme in self._schemes:
+            invalidate(scheme)
+
+
+class AsyncAllSchemes:
+    """:class:`AllSchemes` for the asynchronous client: a member may await its credential."""
+
+    __slots__ = ("_schemes",)
+
+    def __init__(self, *schemes: AsyncAuthScheme) -> None:
+        self._schemes = schemes
+
+    async def apply(self) -> AuthParams:
+        applied = [await resolve_auth(scheme) for scheme in self._schemes]
+        return AuthParams(
+            headers=tuple(p for a in applied for p in a.headers),
+            query_params=tuple(p for a in applied for p in a.query_params),
+            cookies=tuple(p for a in applied for p in a.cookies),
+        )
+
+    def invalidate(self) -> None:
+        """See :meth:`AllSchemes.invalidate`. Not a coroutine: dropping a cache never awaits."""
+        for scheme in self._schemes:
+            invalidate(scheme)
+
+
+class AsyncAnySchemes:
+    """:class:`AnySchemes` for the asynchronous client: the chosen member may await its credential.
+
+    Selection still happens without I/O, so only the one member that wins is ever resolved."""
+
+    __slots__ = ("_schemes",)
+
+    def __init__(self, *schemes: AsyncAuthScheme) -> None:
+        self._schemes = schemes
+
+    async def apply(self) -> AuthParams:
+        for scheme in self._schemes:
+            if is_configured(scheme):
+                return await resolve_auth(scheme)
+        return AuthParams()
+
+    def invalidate(self) -> None:
+        """See :meth:`AnySchemes.invalidate`, including why it over-invalidates."""
+        for scheme in self._schemes:
+            invalidate(scheme)