@anthropic-ai/sdk
Version:
The official TypeScript library for the Anthropic API
277 lines • 11.3 kB
JavaScript
import { getPlatformHeaders } from "../internal/detect-platform.mjs";
import { readEnv } from "../internal/utils.mjs";
/** Current schema version written to `configs/<profile>.json`. Absent on read ⇒ "1.0". */
export const CONFIG_FILE_VERSION = '1.0';
/** Current schema version written to `credentials/<profile>.json`. Absent on read ⇒ "1.0". */
export const CREDENTIALS_FILE_VERSION = '1.0';
const PROFILE_NAME_PATTERN = /^[A-Za-z0-9_.-]+$/;
function validateProfileName(name) {
if (!name) {
throw new Error('profile name is empty');
}
if (name === '.' || name === '..') {
throw new Error(`profile name "${name}" is not allowed`);
}
if (name.includes('/') || name.includes('\\')) {
throw new Error(`profile name "${name}" must not contain path separators`);
}
if (!PROFILE_NAME_PATTERN.test(name)) {
throw new Error(`profile name "${name}" contains disallowed characters (allowed: letters, digits, '_', '.', '-')`);
}
}
/**
* Loads the Anthropic configuration for the given (or active) profile.
*
* Returns `null` when running in a browser or no configuration can be resolved.
* Otherwise, returns the configuration based on the config file and environment variables.
*
* **Profile resolution** (first match wins):
* 1. Explicit `profile` argument
* 2. `ANTHROPIC_PROFILE` environment variable
* 3. Contents of `<config_dir>/active_config` file
* 4. `"default"`
*
* **Config resolution:**
* - If `<config_dir>/configs/<profile>.json` exists, it is loaded and
* missing fields are filled from environment variables. Values present
* in the file take precedence — env vars only fill gaps:
* - `ANTHROPIC_BASE_URL` → `base_url`
* - `ANTHROPIC_ORGANIZATION_ID` → `organization_id`
* - `ANTHROPIC_WORKSPACE_ID` → `workspace_id`
* - `ANTHROPIC_SCOPE` → `authentication.scope`
* - `ANTHROPIC_FEDERATION_RULE_ID` → `authentication.federation_rule_id` (oidc_federation)
* - `ANTHROPIC_IDENTITY_TOKEN_FILE` → `authentication.identity_token` (oidc_federation)
* - `ANTHROPIC_SERVICE_ACCOUNT_ID` → `authentication.service_account_id` (oidc_federation)
* - If no config file exists, an `oidc_federation` config is synthesized
* entirely from environment variables when both `ANTHROPIC_FEDERATION_RULE_ID`
* and `ANTHROPIC_ORGANIZATION_ID` are set.
*/
export const loadConfig = async (profile) => {
return (await loadConfigWithSource(profile))?.config ?? null;
};
/**
* Same as {@link loadConfig}, but also reports whether the config was loaded
* from a profile file on disk (`fromFile: true`) or synthesized entirely from
* environment variables (`fromFile: false`).
*/
export const loadConfigWithSource = async (profile) => {
var _a, _b;
const rootConfigPath = await getRootConfigPath();
if (rootConfigPath === null) {
return null;
}
const profileName = profile ?? (await getActiveProfileName());
if (profileName === null) {
return null;
}
validateProfileName(profileName);
const fs = await import('node:fs');
const path = await import('node:path');
const configPath = path.join(rootConfigPath, 'configs', `${profileName}.json`);
let configRaw;
try {
configRaw = await fs.promises.readFile(configPath, 'utf-8');
}
catch (err) {
if (err?.code !== 'ENOENT') {
throw new Error(`failed to read config file ${configPath}: ${err}`);
}
configRaw = null;
}
if (configRaw === null) {
const organizationId = readEnv('ANTHROPIC_ORGANIZATION_ID');
const identityTokenFile = readEnv('ANTHROPIC_IDENTITY_TOKEN_FILE');
const federationRuleId = readEnv('ANTHROPIC_FEDERATION_RULE_ID');
if (federationRuleId && organizationId) {
return {
fromFile: false,
config: {
organization_id: organizationId,
// A defaulted-but-empty CI variable (`ANTHROPIC_WORKSPACE_ID=""`) is
// treated as unset — readEnv coerces empty to undefined, and the body
// builder's truthy check skips it — so `"workspace_id": ""` never goes
// on the wire.
workspace_id: readEnv('ANTHROPIC_WORKSPACE_ID'),
base_url: readEnv('ANTHROPIC_BASE_URL'),
authentication: {
type: 'oidc_federation',
federation_rule_id: federationRuleId,
service_account_id: readEnv('ANTHROPIC_SERVICE_ACCOUNT_ID'),
identity_token: identityTokenFile ? { source: 'file', path: identityTokenFile } : undefined,
scope: readEnv('ANTHROPIC_SCOPE'),
},
},
};
}
return null;
}
let config;
try {
config = JSON.parse(configRaw);
}
catch (err) {
throw new Error(`failed to parse config file ${configPath}: ${err}`);
}
if (!config.authentication) {
throw new Error(`config file ${configPath} is missing "authentication"`);
}
const authType = config.authentication.type;
if (authType !== 'oidc_federation' && authType !== 'user_oauth') {
throw new Error(`authentication.type "${authType}" is not a known authentication type`);
}
// File values are authoritative; env vars only fill fields the file left unset.
config.organization_id ?? (config.organization_id = readEnv('ANTHROPIC_ORGANIZATION_ID'));
config.workspace_id ?? (config.workspace_id = readEnv('ANTHROPIC_WORKSPACE_ID'));
config.base_url ?? (config.base_url = readEnv('ANTHROPIC_BASE_URL'));
(_a = config.authentication).scope ?? (_a.scope = readEnv('ANTHROPIC_SCOPE'));
if (config.authentication.type === 'oidc_federation') {
if (!config.authentication.identity_token) {
const identityTokenFile = readEnv('ANTHROPIC_IDENTITY_TOKEN_FILE');
if (identityTokenFile) {
config.authentication.identity_token = {
source: 'file',
path: identityTokenFile,
};
}
}
// Unlike siblings using `??= readEnv()` (which leaves `undefined`), coerce
// to '' so the type stays `string` (always set). The downstream required
// check in credential-chain rejects empty, so semantics match but types are
// cleaner.
if (!config.authentication.federation_rule_id) {
config.authentication.federation_rule_id = readEnv('ANTHROPIC_FEDERATION_RULE_ID') ?? '';
}
(_b = config.authentication).service_account_id ?? (_b.service_account_id = readEnv('ANTHROPIC_SERVICE_ACCOUNT_ID'));
}
return { config, fromFile: true };
};
/**
* Loads the credential material for the active profile.
*
* Returns the parsed credentials or `null` when running in a browser or
* no credentials file can be found.
*
* **Profile resolution** (first match wins):
* 1. `ANTHROPIC_PROFILE` environment variable
* 2. Contents of `<config_dir>/active_config` file
* 3. `"default"`
*
* **Credentials path resolution** (first match wins):
* 1. `authentication.credentials_path` from the active profile's config (via {@link loadConfig})
* 2. `<config_dir>/credentials/<profile>.json`
*/
export const loadCredentials = async () => {
const config = await loadConfig();
const credentialsPath = await getCredentialsPath(config);
if (!credentialsPath) {
return null;
}
const fs = await import('node:fs');
let raw;
try {
raw = await fs.promises.readFile(credentialsPath, 'utf-8');
}
catch (err) {
if (err?.code !== 'ENOENT') {
throw new Error(`failed to read credentials file ${credentialsPath}: ${err}`);
}
return null;
}
let creds;
try {
creds = JSON.parse(raw);
}
catch (err) {
throw new Error(`failed to parse credentials file ${credentialsPath}: ${err}`);
}
if (creds.type && creds.type !== 'oauth_token') {
throw new Error(`credentials file ${credentialsPath} has unsupported type "${creds.type}" (want "oauth_token")`);
}
return creds;
};
/**
* Resolves the credentials file path for the given config.
*
* Uses `authentication.credentials_path` from the config if set, otherwise
* falls back to `<config_dir>/credentials/<profile>.json`.
*
* Returns `null` when running in a browser or the path cannot be resolved.
*/
export const getCredentialsPath = async (config, profile) => {
if (config?.authentication.credentials_path) {
return config.authentication.credentials_path;
}
const rootConfigPath = await getRootConfigPath();
if (!rootConfigPath) {
return null;
}
const profileName = profile ?? (await getActiveProfileName());
if (!profileName) {
return null;
}
validateProfileName(profileName);
const path = await import('node:path');
return path.join(rootConfigPath, 'credentials', `${profileName}.json`);
};
const getRootConfigPath = async () => {
if (!supportsLocalConfigFiles()) {
return null;
}
const path = await import('node:path');
// ANTHROPIC_CONFIG_DIR is treated as a trusted path: it is set by the
// process operator, not by remote input, so it is not validated.
const configDir = readEnv('ANTHROPIC_CONFIG_DIR');
if (configDir) {
return configDir;
}
const os = getPlatformHeaders()['X-Stainless-OS'];
if (os === 'Windows') {
const appData = readEnv('APPDATA');
if (appData) {
return path.join(appData, 'Anthropic');
}
const userProfile = readEnv('USERPROFILE');
if (userProfile) {
return path.join(userProfile, 'AppData', 'Roaming', 'Anthropic');
}
// No usable Windows config root — return null so callers fall through to
// "no config available" rather than silently writing under C:\.
return null;
}
const xdgConfigHome = readEnv('XDG_CONFIG_HOME');
if (xdgConfigHome) {
return path.join(xdgConfigHome, 'anthropic');
}
const home = readEnv('HOME');
if (home) {
return path.join(home, '.config', 'anthropic');
}
return null;
};
const supportsLocalConfigFiles = () => {
const runtime = getPlatformHeaders()['X-Stainless-Runtime'];
return runtime === 'node' || runtime === 'deno';
};
const getActiveProfileName = async () => {
const rootConfigPath = await getRootConfigPath();
if (!rootConfigPath) {
return null;
}
const profileName = readEnv('ANTHROPIC_PROFILE');
if (profileName) {
return profileName;
}
const fs = await import('node:fs');
const path = await import('node:path');
const filePath = path.join(rootConfigPath, 'active_config');
try {
return (await fs.promises.readFile(filePath, 'utf-8')).trim() || 'default';
}
catch (err) {
if (err?.code !== 'ENOENT') {
throw new Error(`failed to read ${filePath}: ${err}`);
}
return 'default';
}
};
//# sourceMappingURL=credentials.mjs.map