+
    iHàj—  ã                  óØ   € R t ^ RIHt ^ RIt^ RIt^ RIt^ RIt^ RIt^ RIH	t	 ^ RI
Ht ]P                  ! ]4      tRt^tRt ! R R]4      tR	 R
 ltR R lt ! R R4      tRR R lltR# )aÉ  Mint a provider API key by running a command (``key_cmd``).

Enterprise gateways (SSO/OIDC brokers, cloud IAM, auth proxies) issue SHORT-LIVED bearers; a key
copied into ``.env`` goes stale within the hour. ``key_cmd`` names a command that PRINTS a token
(the ``apiKeyHelper`` / ``gcloud auth print-access-token`` idiom). Both wire clients accept a
callable API key and invoke it per request; the token is cached until shortly before expiry.
Output contract: ONLY the token on stdout, bare or as JSON with an ``access_token`` field
(``expires_in`` / ISO ``expiry`` honoured). Precedence: explicit ``--api-key`` wins (one-off
recovery escape hatch); otherwise ``key_cmd`` beats a static ``api_key`` / ``key_env``.
)ÚannotationsN)ÚOptional)ÚKEY_CMDg      N@g      Œ@c                  ó   € ] tR t^#tRtRtR# )ÚCommandTokenErrorz/A ``key_cmd`` failed to produce a usable token.© N)Ú__name__Ú
__module__Ú__qualname__Ú__firstlineno__Ú__doc__Ú__static_attributes__r   ó    Ú?/home/ubuntu/.hermes/hermes-agent/agent/command_token_source.pyr   r   #   s   † Ý9r   r   c               ó    € V ^8„  d   QhRRRR/# )é   Úapi_keyÚobjectÚreturnÚstrr   )Úformats   "r   Ú__annotate__r   '   s   € ÷ ;ñ ; vð ;°#ñ ;r   c                ó¬   €  \        V 4      '       d   V ! 4       MT p\        T\        4      '       d   TP	                  4       # R#   \         d     R# i ; i)zNBest-effort probe credential; never send a callable's repr or log mint errors.Ú )ÚcallableÚ	ExceptionÚ
isinstancer   Ústrip)r   Útokens   & r   Úmaterialize_probe_api_keyr   '   sM   € ðÜ% g×.Ò.‘”	°Gˆô ' u¬c×2Ò2ˆ5�;‰;‹=Ð:¸Ð:øô ô Úðús   ‚A ÁAÁAc               ó$   € V ^8„  d   QhRRRRRR/# )r   Úcommandr   Úlabelr   ztuple[str, Optional[float]]r   )r   s   "r   r   r   0   s'   € ÷ Bñ B�3ð B˜sð BÐ'Bñ Br   c                óþ  € ^ RI Hp  \        P                  ! V \        P                  RRRR\
        V! RR7      RR7	      pTP                  ^ 8w  d   \        RT: RTP                   R24      hTP                  ;'       g    RpTP                  4       '       g   \        RT: R24      hTP                  4       P                  R4      '       Ed    \        P                  ! T4      p\#        T\$        4      '       dä   \'        TP)                  R4      ;'       g    R4      P                  4       pT'       g   \        RT: R24      hTP)                  R4      p\#        T\*        \,        34      '       d   T^ 8”  d   T\-        T4      3# ^ RIHp	 R FH  p
T	! TP)                  T
4      4      pTe   T\2        P2                  ! 4       ,
          M^ pT^ 8”  g   KE  Y|3u # 	  TR
3# TP                  4       pRT9   d   \        RT: R24      hTR
3#   \        P                   d   p\        RT: R\
         R	24      ThR
p?i\         d   p\        RT: RT 24      ThR
p?ii ; i  \        P                    d    R
p EL”i ; i)u*  Run *command*, returning ``(token, ttl_seconds_or_None)``. The helper runs FOR the profile whose
provider is being minted: it gets that profile's own env (secrets + HERMES_HOME), never the multiplexer's
launch environ â€” an ``op read`` / ``vault kv get`` helper must sign in as the served profile.)Úserved_profile_child_envTÚreplace)Úinherit_credentialsF)ÚstdinÚshellÚcapture_outputÚtextÚerrorsÚtimeoutÚenvÚcheckzkey_cmd for provider z timed out after ÚsNz could not be executed: z exited zn. Run that provider's key_cmd manually to see why (e.g. `databricks auth login` if its OAuth session expired).r   z produced no outputÚ{Úaccess_tokenz. returned JSON without an 'access_token' fieldÚ
expires_in)Ú_parse_iso_timestampÚ
z\ printed multiple lines; it must print only the token (or JSON with an 'access_token' field))ÚexpiryÚ	expiresOn)Útools.environments.localr$   Ú
subprocessÚrunÚDEVNULLÚ_MINT_TIMEOUT_SECONDSÚTimeoutExpiredr   ÚOSErrorÚ
returncodeÚstdoutr   ÚlstripÚ
startswithÚjsonÚloadsÚJSONDecodeErrorr   Údictr   ÚgetÚintÚfloatÚhermes_cli.authr3   Útime)r!   r"   r$   Ú	completedÚexcr?   Úpayloadr   Úttlr3   ÚfieldÚdeadlineÚ	remainings   &&           r   Ú_mintrR   0   s‡  € õ BðiÜ—N’NØœ:×-Ñ-°TÈ$ÐUYÐbkô  vKÙ(¸TÔBØô
ˆ	ð ×Ñ˜qÔ ô  Ø# E¡9¨H°Y×5IÑ5IÐ4Jð KKð Ló
ð 	
ð ×Ñ×#Ð# €FØ�<‰<�>Š>ÜÐ"7¸±yÐ@SÐ TÓUÐUð ‡}�}ƒ×!Ñ! #×&Ó&ð	Ü—j’j Ó(ˆGô �gœt×$Ò$Ü˜Ÿ™ NÓ3×9Ð9°rÓ:×@Ñ@ÓBˆEßÜ'Ø+¨E©9Ð4bÐcóð ð —+‘+˜lÓ+ˆCÜ˜#¤¤U˜|×,Ò,°°q´Øœe C›jÐ(Ð(õ =ã0�Ù/°·±¸EÓ0BÓC�Ø6>Ò6J˜H¤t§y¢y£{Ö2ÐPQ�	Ø˜q–=Ø Ð+Ò+ñ	 1ð
 ˜$�;Ðð �L‰L‹N€EØˆu„}ÜØ# E¡9ð -Jð Jó
ð 	
ð �$ˆ;Ðøôm ×$Ñ$ô ÜØ# E¡9Ð,=Ô>SÐ=TÐTUÐVó
àð	ûô ô iÜÐ"7¸±yÐ@XÐY\ÐX]Ð ^Ó_ÐehÐhûðiûô( ×#Ñ#ô 	Ø‹Gð	ús;   ˆ8H ÃI! ÈIÈ H8È8IÉIÉIÉIÉ!I<É;I<c                  óP   € ] tR t^utRt]tR
R R llt]R R l4       t	R R lt
RtR	# )ÚCommandTokenSourcezFCallable returning a bearer token, cached until shortly before expiry.c               ó$   € V ^8„  d   QhRRRRRR/# )r   r!   r   r"   r   ÚNoner   )r   s   "r   r   ÚCommandTokenSource.__annotate__z   s!   € ÷ &ñ & ð &¨Cð &¸tñ &r   c                	ó„   € Wn         T;'       g    R V n        \        P                  ! 4       V n        RV n        RV n        R# )Úcustomr   g        N)Ú_commandÚ_labelÚ	threadingÚLockÚ_lockÚ_tokenÚ_expires_at)Úselfr!   r"   s   &&&r   Ú__init__ÚCommandTokenSource.__init__z   s3   € ØŒØ×'Ð'˜xˆŒÜ—^’^Ó%ˆŒ
ØˆŒØ"%ˆÖr   c               ó   € V ^8„  d   QhRR/# ©r   r   r   r   )r   s   "r   r   rW   ‚   s   € ÷ &ñ & ñ &r   c                ó    € RV P                    2# )zEStable catalog identity; token rotation must not mint on cache reads.zcmd:)rZ   )ra   s   &r   Úcache_identityÚ!CommandTokenSource.cache_identity�   s   € ð �d—m‘m�_Ð%Ð%r   c               ó   € V ^8„  d   QhRR/# re   r   )r   s   "r   r   rW   †   s   € ÷ ñ ˜#ñ r   c           	     	óJ  € V P                   ;_uu_ 4        V P                  '       d;   \        P                  ! 4       V P                  8  d   V P                  uuR R R 4       # \        V P                  V P                  4      w  rWn        \        P                  ! 4       V'       d   \        V\        ,
          R4      M\        ,           V n        \        P                  RV P                  V'       d   \        V4       R2MR4       VuuR R R 4       #   + '       g   i     R # ; i)Ng      @z-Minted key_cmd token for provider %s (ttl=%s)r/   Úunknown)r^   r_   rJ   Ú	monotonicr`   rR   rZ   r[   ÚmaxÚ_TOKEN_REFRESH_LEEWAY_SECONDSÚ_NO_TTL_REFRESH_SECONDSÚloggerÚdebugrG   )ra   r   rN   s   &  r   Ú__call__ÚCommandTokenSource.__call__†   sµ   € Ø�Z�Z‹ZØ�{�{ˆ{œtŸ~š~Ó/°$×2BÑ2BÔBØ—{‘{÷ ŠZô ˜tŸ}™}¨d¯k©kÓ:‰JˆEØŒKÜ#Ÿ~š~Ó/ßAD”�CÔ7Õ7¸Ô=ÔJaõ ˆDÔô �L‰LØ?Ø—‘¯s¤ C£˜z¨™^¸	ôð ÷ �Z�Z‹Zús   •ADÁ"BDÃ1DÄD"	)rZ   r`   r[   r^   r_   N©rY   )r   r	   r
   r   r   r   Úhermes_credential_sourcerb   Úpropertyrg   rr   r   r   r   r   rT   rT   u   s.   † ÙPà&Ð÷&ð ô&ó ð&÷ñ r   rT   c               ó$   € V ^8„  d   QhRRRRRR/# )r   Úkey_cmdr   Úprovider_labelr   zOptional[CommandTokenSource]r   )r   s   "r   r   r   –   s'   € ÷ Lñ L¨#ð L¸sð LÐRnñ Lr   c                ór   € \        T ;'       g    R4      P                  4       pV'       d   \        W!4      # R# )zCA per-request token provider for *key_cmd*, or ``None`` when unset.r   N)r   r   rT   )rx   ry   r!   s   && r   Úbuild_command_token_providerr{   –   s.   € ä�'—-�-˜RÓ ×&Ñ&Ó(€Gß:AÔ˜gÓ6ÐKÀtÐKr   rt   )r   Ú
__future__r   rB   Úloggingr8   r\   rJ   Útypingr   Úagent.credential_sourcer   Ú	getLoggerr   rp   rn   r;   ro   ÚRuntimeErrorr   r   rR   rT   r{   r   r   r   Ú<module>r‚      sy   ðñ	õ #ã Û Û Û Û Ý å +à	×	Ò	˜8Ó	$€ð !%Ð àÐ ð  Ð ô:˜ô :õ;õB÷Jñ ÷BLñ Lr   