Pin requests sharing the state to the entry being tried (or warn that there is none).

Transform the given `data` based on the annotations provided in `type_`. Note: this function only looks at `Annotated` types that contain `Proper

The non-streaming retry body: the fallback entry applied as a patch against the original params, plus the refusal's credit token when it minted on

The raw-response mode the original caller entered the middleware chain with.

Open the wire for this hop: its message_start (raw for stream A; suppressed or id-rewritten for a spliced hop), the queued seam frames,

Forward a decoded event in its original wire bytes, preserving SSE fields beyond `event:`/`data:` (`id:`, `retry:`, comment lines). Falls back to

Build the options the base middleware handler hands to `_attempt_request()`. Returns a copy so that mutations made by the request pipeline never

This method is used as a callback for mutating the `Request` object after it has been constructed. This is useful for cases where you

Best-effort project from an explicit credentials object — service-account / impersonated credentials usually know theirs.

Raise a redacted :class:`WorkloadIdentityError` from a non-200 token-endpoint response. Shared between the jwt-bearer exchange path in this modul

Return the stripped contents of ``<config_dir>/active_config``, or ``None`` if the pointer file is missing or empty.

Read the credentials file. Re-reads on every call — daemons rotate it. Secret values in the returned dict (every string field not in

The policy category that caused the refusal; only the beta surface carries one.

base_url (arg or ``ANTHROPIC_GOOGLE_CLOUD_BASE_URL``, resolved by the caller) > derived template. Returns ``None`` when derivation must wait

Derive and set the real base URL once the project is known. Called on every request (after the project back-fill from ADC, if any); a

Resolve a denied call without executing it. The denial itself resolves the call server-side — no result event will ever be posted for

Resolve and validate all Mantle client configuration. Returns (resolved_api_key, resolved_base_url, use_sigv4, merged_headers).

Assert ``candidate`` resolves to a descendant of ``base``, return it verbatim. The containment check uses ``resolve(strict=False)`` on both sides

Convert MCP resource contents to an Anthropic content block.

The content blocks the runner computed and posted back, as carried in ``result`` (the flat ``content`` convenience field was removed).

Enqueue ``ev`` for dispatch, honoring its evaluated permission. A builtin call the server gated behind user confirmation (``evaluated

Drive the session tool loop, yielding an iterator of :class:`DispatchedToolCall`. :meth:`__aiter__` (and the module-level :func:`_run_

Drive a tool runner over ``messages`` and collect the tool_result messages it generated.

Return ``name`` as a confined relative path, or raise on path-traversal. Strips ``.`` components; rejects absolute paths and any ``..`` component

A copy of the served hop's response with `seams` prepended to its `content`, or `None` when the body isn't the expected message shape. The ca

Serialize an event back to its SSE wire form (`event: ...\\ndata: ...\\n\\n`). Multi-line `data` is emitted as one `data:` line per line, matchin

Extract the per-item sessions token from a work item's ``secret`` payload. The ``secret`` the poll response populates is not itself a credential:

Whether an exception raised by a request attempt should be retried. Also returns the HTTP response behind the failure, when there is one, so

A synthetic response standing in for `original`, with `stream` as its body. The spliced frames are emitted post-decode, so the original's con

Split on LF only (keeping any CR), without the empty tail a trailing newline leaves.

Write the trust marker, then pull every remote memory; pushes nothing. The baseline is cleared and rebuilt from successful writes only, so a

The chain entry this request starts at (-1 = the original params). Only an explicit `BetaFallbackState` pin moves the start; without one

A copy of `body` with `{type: "fallback"}` seam blocks filtered out of the replayed message history; `body` itself when there are none. An as

Drop the leading ``top`` component from ``safe`` (an already-confined relative path). Returns ``""`` for the bare top-dir entry itself.

Yield ``call`` to the consumer, tolerating a consumer that left early. ``BrokenResourceError`` — the consumer broke out of the iterator;

Convert a hop's accumulated response blocks to the appended assistant turn. A `fallback_has_prefill_claim` refusal guarantees the partial output

Push one local file; ``None`` keeps the old baseline so the next pass retries. A refusal the server would repeat (400/413, the utf-8 gate) en

``User-Agent`` value sent on token-endpoint POSTs. Computed lazily so this module doesn't need to import ``_version`` at module load time (th

Warn when an ``ANTHROPIC_API_KEY`` / ``ANTHROPIC_AUTH_TOKEN`` from the environment is set alongside signals that would normally drive profile /

Warn when an explicit ``api_key=`` / ``auth_token=`` argument shadows an explicit ``credentials=`` provider. Call *after* any copy-inheritance

Emit a log warning at most once per ``key`` per process.

A copy of `request` with `betas` appended to its `anthropic-beta` header (skipping values already present) and the middleware's helper-telemetry t

Write a memory's content to disk; ``False`` (and a warning) on failure. A ``..`` component in the wire path reaches here as :class:`F

Fold a refused hop's outcome in, readying the next hop.

Note: these endpoints are called automatically by the pre-built environment worker provided in the SDKs and CLI, for orchestrating se

Run a runnable tool's optional cleanup. Drives the legacy ``aclose`` / ``close`` attribute (awaited if it returns an awaitable) and, when the

Exponential backoff for ``attempt`` (1-indexed), capped at ``cap``.

The chain state after stream A's chainable refusal. `body` is the original request params (pre-pin) — the base every hop patches; `in

Close the response and release the connection. Automatically called if the response body is read to completion.