.cjLDUdZddlmZddlZddlZddlZddlmZm Z ddl m Z ddl m Z mZmZddlmZmZmZmZmZejeZiZded <d aeGd d ZeGd dZeGddZd dd3dZd4dZ d5dZ!d6dZ"d6d Z#d7d&Z$d8d(Z%d9d*Z&d+Z'd:d/Z( d;d> IIIJJJt444G4444"'%"="="=====!&t!#>#>>>>>!&t!>>>>> ((((( &&&I $  & & & & & &&s3+&AAA66&BB#C&C,+C,c<tdadS)NF)rclearr\rrr_reset_registry_for_testsrcs NNrcfgr7 home_pathrr c||}tjdd|j} ||j||} ||}n#tjj$rb| t}d|dd|jd|_ tj |_|cY|d St $r`}t}d t#|jd ||_ tj|_|cYd }~|d Sd }~wwxYw |d n#|d wxYwt)|ts>t}dt#|jd|_ tj|_|S|S)uRun source.fetch() under a wall-clock budget; never raises. The budget is enforced with a daemon worker thread: a source that blows its budget is reported as ``TIMEOUT`` and its (eventual) result is discarded. The thread itself may linger until process exit — acceptable for a startup-only path, and strictly better than an unbounded hang on every ``hermes`` invocation. z secret-src-) max_workersthread_name_prefix)timeoutzfetch exceeded z.0fuBs budget — startup continued without this source (raise secrets.z-.timeout_seconds if the backend is just slow)F)waitz fetch raised z: Nzfetch returned z instead of FetchResult)fetch_timeout_seconds concurrentfuturesThreadPoolExecutorrsubmitfetchr# TimeoutErrorcancelr errorr TIMEOUT error_kindshutdownr^typerINTERNALrB) rrdrerjexecutorfuturer#resexcs r_fetch_with_timeoutr~s**3//G!44*E *E*E5H&sI>> ]]7]33FF!.    MMOOO--CN'NNN;NNN I '.CNJJ u%%%%    --CCS (:CCcCCCI&/CNJJJJJu%%%%   " u%%%%u%%%% fk * *mm Ld6ll3 L L L #+ MsIE-A43E-4AEE-) E2?E 1E2E- EE--F secrets_cfgct|d}g}t|tr|D]9}t|tr"|t vr||vr||:d|D}|rItdd |d t pdt D]}||vr||g}|D]}t |}||}t|tr|ni} | |r||i#t$r td|dYwxYw|S) aEResolve which sources run, in which order. Order: the optional ``secrets.sources`` list wins; sources not named there follow in registration order. Enabled = the source's own ``is_enabled`` says so for its config section. Mapped-vs-bulk precedence is applied on top of this order by :func:`apply_all`. r/cNg|]"}t|tr |tv |#Sr)rBrr).0es r z,_ordered_enabled_sources..sB@@@ C((@-.h->->->->->rz7secrets.sources names unknown source(s): %s (known: %s)z, nonez0Secret source '%s' is_enabled() raised; skippingTrX) rNrOrBr,rrappendrCrDjoinr7 is_enabledr^) rexplicitorderentryunknownrenabledrrds r_ordered_enabled_sourcesrsy))HE(D!!  $ $E%%% $%8*;*;U@R@R U###@@h@@@   NNI '""DIIh$7$7$A6    u   LL   "$G 0 0$ood##T**2cc 0  %% 'v&&& 0 0 0 NNM$  0 0 0 0 0 0 Ns3*E'FFOptional[Path]c|-t|}|jjdkr|jr|jSdD]@}tj|d}|r |dkr|cSAdS)zBest-effort active profile name for profile-scoped secret aliases. A named profile's HERMES_HOME is ``~/.hermes/profiles/``; the default profile (``~/.hermes``) returns "". Nprofiles)HERMES_PROFILE_NAMEHERMES_PROFILEr;default)rparentrosenvironrOstrip)reresolvedenv_namevalues r_active_profile_namers  ?? ? : - -(- -= = x,,2244  Ui''LLL 2r)_API_KEY_TOKEN_SECRET_KEY _PASSWORDvarprofile Optional[str]c.|sdSd|ddz}||sdS|dt| rt sdSt fdt DsdSS)zBMap ``FOO_`` to ``FOO`` for the active profile when safe.Nr<-c3BK|]}|VdSr4)endswith)rsaliass r z(_profile_alias_target..>s/::Qu~~a  ::::::r)r9upperrlenrany_ALIAS_SUFFIXES)rrsuffixrs @r_profile_alias_targetr4s t 7??3,,2244 4F <<  t 3v;;, E )%00t ::::/::: : :t LrrOptional[Dict[str, str]]c "ddl}||n|jtt|tr|ni}t |}|sS|d}t|trtd|Dn tt|dd}|rt|nd}d|Dd |Dz}g} i|D]|j } t| tr| ni} t| |} | | | f | D]} | j #t $rYwxYwt#} | D]1\}}} | jr$| d | jD2i| D],\} } t+j jpj | j | jsL | n#t $rd YnwxYwd d dfd}| jD]\} }t| t4rt|t4s0|| |}|r|sAt7| |}|r:|| vr6|vr2|||d r$| j d| d|d|d.S)uFetch from every enabled source and apply the merged result to env. ``environ`` defaults to ``os.environ``; injectable for tests. Precedence per env var (most-specific intent wins): 1. ``secrets.preserve_existing`` names — a pre-existing env value always wins for these, even against a source with ``override_existing: true`` (escape hatch for profile-local platform secrets, #58073). 2. Pre-existing env (.env / shell) — unless the winning source has ``override_existing: true``. 3. Mapped sources, in configured order. 4. Bulk sources, in configured order. First claim wins. A later source that also carries the var gets a ``skipped_claimed`` entry and a conflict warning — never a silent clobber, and ``override_existing`` never applies across sources. Profile aliasing (#51447): when running under a named profile, an applied var ``FOO_`` (credential-shaped suffixes only) also hydrates the canonical ``FOO`` so platform adapters and plugins that read fixed env names see the profile's value. The alias obeys the same protected / preserve / claimed / override guards and is disabled with ``secrets.profile_alias: false``. rNpreserve_existingc3K|]A}t|t|+|VBdSr4)rBrr)rns rrzapply_all..is]$$:a+=+=$BC''))$  $$$$$$r profile_aliasTr;c(g|]}|jdk |S)r?rrrs rrzapply_all..rs$:::aag&9&9&9&9&9rc(g|]}|jdk |S)r@rrs rrzapply_all..ss$:::6(9(9!(9(9(9rc3DK|]}t|t|VdSr4)rBr)rvs rrzapply_all..sE%%Z3-?-?%%%%%%%r)rr"r#F)is_aliasrrrrrr2ct|s j|dS|vr j|dS|vrJ j| j|d|d jddSt|}|r |vr j |dS|rs j |dS||< j|< j |t| j j | j |<dS)z=Apply one var through the shared guard chain. True = applied.Fz: kept value from z; uW also supplies it (first source wins — remove one binding or reorder secrets.sources))rrrrT)rr+rr*r)r1rrrOr(r'rrr0) rrrexistedclaimedenvoverridepreserve protectedreportrsrs r _try_applyzapply_all.._try_applys$S)) "))#...ui$++C000ug~~"))#... ''EEgclEE{EEE u3773<<((G 3(??#**3///u x #**3///uCH!;GCL J  c " " "%/{l$ &&&F c " 4rzapplied profile-scoped z as z (active profile ))rrrrrrr2r)rrr.rBr7rrOr, frozensetrrrr~rprotected_env_vars setdefaultr^setokupdatesecretsr!r"r/override_existingrHrrwarnings)rrer_osr preserve_raw alias_enabledrorderedfetchesrdr#rsupplied_directlyr<rrr'rrrrrrrrrs @@@@@@@@r apply_allrCsW6(''ckC ]]F!+K!>!>F++BK&{33G  ??#677L L$ ' '9)$$'$$$-6[[ $??@@M1>F"9---BG;:7:::::W:::;G=?G "I  oofk**T**2cc$VS)<<V,--- 0055 7 7$$S&+6666 7    D  !UU 1f 9   $ $%%!>%%%    !G&<<V v{ & ; !'))) b!!!y   //44HH   HHH BG               D!...00  JCc3'' z%/E/E  je,,G ' )#w77E &777Ers6#""""" ((((((((''''''''''  8 $ $%'&&&&    = = = = = = =  =  % % % % % % %  %">C......b #### &&&&B,,,,^&&&&R&I     37IIIIIIIr