+
    iHàjG  ã                  ó~  € R t ^ RIHt ^ RIt^ RIt^ RIt^ RIt^ RIt^ RIH	t	H
t
 ^ RIHt ^ RIHtHtHt ^ RIHt ^ RIHtHtHtHt ^ RIHt ^ R	IHt ^ R
IHt ^ RIHt RCtRDt RRRRRRRRRRRR/t!RRRRRRR R!R"RR#R$/t"RRERRF/t#R%^PR&R'/t$]PJ                  ! 4       t&Rt' ^ RI(t( ! R( R)]*4      t+R*R+R,R-R.R//t,R0 R1 lt-R2^R3^R4R/R5 R6 llt.R7 R8 lt/]! R9R:7       ! R; R<4      4       t0 ! R= R>4      t1R? R@ lt2RA RB lt3R#   ]) d8    Rt(]
! ])4      ;_uu_ 4        ^ RI't'RRR4        K„    + '       g   i      L•; ii ; i)Gu…  Local encrypted vault for browser autofill secrets.

Profile-scoped, model-blind credential store. Metadata (kind, label, origin,
timestamps) lives alongside an encrypted secret payload; the payload is
encrypted at rest with a locally generated Fernet key. The model only ever
sees opaque handles + metadata â€” secret values are resolved server-side by
the browser fill path and never enter tool results, logs, or the session DB.

Design notes:
- Follows the repo's "default frictionless, 0600 files OK" policy: the key
  file and vault file are created 0600 under ``<HERMES_HOME>/vault/``.
- Ported design (opaque-handle vault fill) from Merit-Systems/OpenInstinct
  (MIT): lib/manager/server/secret-store.ts + vault services.
- Three item kinds: ``login`` (password-only secret), ``payment`` (card fields) and
  ``address``; ``PAYMENT_FIELDS`` / ``ADDRESS_FIELDS`` are the canonical payload names.
)ÚannotationsN)ÚcontextmanagerÚsuppress)Ú	dataclass)ÚdatetimeÚtimezoneÚUTC)ÚPath)ÚAnyÚDictÚListÚOptional)Úurlsplit)Úmake_user_dir)Úget_hermes_home)Úatomic_write_bytesÚpaymentÚaddressÚcard_numberz	cc-numberÚcardholder_namezcc-nameÚ	exp_monthzcc-exp-monthÚexp_yearzcc-exp-yearÚcvczcc-cscÚbilling_postal_codezpostal-codeÚaddress_line1zaddress-line1Úaddress_line2zaddress-line2Úcityzaddress-level2Ústatezaddress-level1Úpostal_codeÚcountryzcountry-nameÚhttpÚhttpsi»  c                  ó   € ] tR t^DtRtRtR# )Ú
VaultErrorzEVault failure that is safe to surface (never contains secret values).© N)Ú__name__Ú
__module__Ú__qualname__Ú__firstlineno__Ú__doc__Ú__static_attributes__r$   ó    Ú6/home/ubuntu/.hermes/hermes-agent/agent/vault_store.pyr#   r#   D   s   † ÝOr+   r#   ÚSHA1Úsha1ÚSHA256Úsha256ÚSHA512Úsha512c               ó    € V ^8„  d   QhRRRR/# )é   ÚvalueÚstrÚreturnr$   )Úformats   "r,   Ú__annotate__r9   K   s   € ÷ .ñ . ð .¨ñ .r+   c                ó  € T ;'       g    RP                  4       p V '       g   R# ^^Rr2pV P                  4       P                  R4      '       Ed!   ^ RIHpHp V! V 4      pVP                  P                  4       R8w  d   \        R4      hV! VP                  4      P                  4        UUu/ uF  w  rxVP                  4       V^ ,          bK  	  p	ppV	P                  RR4      p  \        V	P                  RV4      4      p\        V	P                  R	V4      4      pT	P                  RT4      P                  4       P                  RR4      pTR9  g   T^ 8:  g   T\        9  d   \        R4      h\         P"                  ! RRV 4      P                  4       P%                  R4      p
V
'       d   \         P&                  ! RV
4      '       d   \        R4      hWV3R8X  d   V
# V
 RV RV RV 2# u uppi   \         d    \        R
4      hi ; i)a„  Accept a raw base32 seed or an ``otpauth://totp/...`` URI. Returns the canonical stored form:
the bare uppercase base32 seed, followed by ``|digits|period|algo`` ONLY when the URI departs from
the RFC 6238 defaults (6 / 30 / SHA1), so a plain seed stays a plain seed. Non-default parameters
are honoured, not dropped: an 8-digit or 60-second authenticator would otherwise get wrong codes.Ú r-   z
otpauth://)Úparse_qsÚurlparseÚtotpzConly otpauth://totp links are supported (counter-based HOTP is not)ÚsecretÚdigitsÚperiodz)otpauth:// digits/period must be integersÚ	algorithmÚ-zNunsupported otpauth:// parameters (digits 6-8, period > 0, SHA1/SHA256/SHA512)z[\s-]Ú=z	[^A-Z2-7]z>authenticator key must be a base32 secret or an otpauth:// URIÚ|)é   é   é   )rF   é   r-   )ÚstripÚlowerÚ
startswithÚurllib.parser<   r=   Únetlocr#   ÚqueryÚitemsÚgetÚintÚ
ValueErrorÚupperÚreplaceÚ
_OTP_ALGOSÚreÚsubÚrstripÚsearch)r5   r@   rA   Úalgor<   r=   ÚparsedÚkÚvÚqsÚseeds   &          r,   Únormalize_otp_secretra   K   sÇ  € ð
 �[ˆ[�b×ÑÓ!€EßÙØ˜b &�D€FØ‡{�{ƒ}×Ñ ×-Ó-ß3Ù˜%“ˆØ�=‰=×ÑÓ  FÔ*ÜÐbÓcÐcÙ*2°6·<±<Ó*@×*FÑ*FÔ*HÔIÑ*H¡$ !ˆa�g‰g‹i˜˜1�ŠoÑ*HˆÑIØ—‘�x Ó$ˆð	JÜ˜Ÿ™ ¨&Ó1Ó2ˆFÜ˜Ÿ™ ¨&Ó1Ó2ˆFð �v‰v�k 4Ó(×.Ñ.Ó0×8Ñ8¸¸bÓAˆØ˜Ô" f°¤k°TÄÔ5KÜÐmÓnÐnÜ�6Š6�(˜B Ó&×,Ñ,Ó.×5Ñ5°cÓ:€Dß”2—9’9˜\¨4×0Ò0ÜÐYÓZÐZØ˜Ð Ô0ØˆØˆV�1�V�H˜A˜f˜X Q t fÐ-Ð-ùó Jøô
 ô 	JÜÐHÓIÐIð	Jús   Â-#G-Ã&6G3 Ç3H
r@   rA   Úatc          
     ó,   € V ^8„  d   QhRRRRRRRRRR/# )	r4   r`   r6   r@   rR   rA   rb   zOptional[float]r7   r$   )r8   s   "r,   r9   r9   k   s0   € ÷ #ñ #�3ð # 3ð #°Cð #À/ð #Ð]`ñ #r+   c               ó¾  € ^ RI p^ RIp^ RIp^ RIp^ RIpRp	RV 9   dO   V P                  R^4      w  r
r¼\        V
4      \        V4      \        P                  VP                  4       R4      r’pVP                  V R\        V 4      ) ^,          ,          ,           RR7      p\        Ve   TMVP	                  4       V,          4      pVP                  W×P                  RV4      \        WY4      4      P                  4       pVR
,          ^,          pVP!                  RVVV^,            4      ^ ,          R	,          ^
V,          ,          p\#        V4      P%                  V4      # )zqRFC 6238 TOTP for a stored seed (see normalize_otp_secret for the ``seed|digits|period|algo``
form). Stdlib only.Nr.   rE   rD   T)Úcasefoldz>Qz>Iiÿÿÿéÿÿÿÿ)Úbase64ÚhashlibÚhmacÚstructÚtimeÚsplitrR   rV   rQ   rT   Ú	b32decodeÚlenÚnewÚpackÚgetattrÚdigestÚunpackr6   Úzfill)r`   r@   rA   rb   rg   rh   ri   rj   Ú_timer[   ÚdÚpÚaÚkeyÚcounterrr   ÚoffsetÚcodes   &$$$              r,   Útotp_nowr}   k   s  € ó ÛÛÛÛà€DØ
ˆd„{ØŸ
™
 3¨Ó*‰ˆ�Ü" 1›v¤s¨1£v¬z¯~©~¸a¿g¹g»iÈÓ/P˜ˆØ
×
Ñ
˜4 #¬#¨d«)¨°a­Õ"8Õ8À4Ð
Ó
H€CÜ˜š‘2¨U¯Z©Z«\¸fÕDÓE€GØ�X‰X�cŸ;™; t¨WÓ5´w¸wÓ7MÓN×UÑUÓW€FØ�B�Z˜$Õ€FØ�M‰M˜$  v¨f°q­jÐ 9Ó:¸1Õ=À
ÕJÈrÐU[Í|Õ\€DÜˆt‹9�?‰?˜6Ó"Ð"r+   c               ó    € V ^8„  d   QhRRRR/# )r4   Úurl_or_originr6   r7   r$   )r8   s   "r,   r9   r9   €   s   € ÷ 'ñ ' Cð '¨Cñ 'r+   c                ó,  € T ;'       g    RP                  4       pV'       g   \        R4      hRV9  d   \        RV: R24      h\        V4      pVP                  ;'       g    RP	                  4       pVP
                  ;'       g    RP	                  4       pV'       d	   V'       g   \        RV: 24      h VP                  pTe   T\        P                  T4      8X  d   T RT 2# T RT R	T 2#   \         d   p\        RT: 24      ThRp?ii ; i)
zþNormalize a URL or origin to ``scheme://host[:port]``.

Default ports (80 for http, 443 for https) are stripped so that
``https://example.com`` and ``https://example.com:443`` compare equal.
Raises :class:`VaultError` for values without a scheme + host.
r;   zorigin is requiredz://z"origin must include a scheme (got Ú)zcould not parse origin from zinvalid port in origin NÚ:)
rJ   r#   r   ÚschemerK   ÚhostnameÚportrS   Ú_DEFAULT_PORTSrQ   )r   r5   Úpartsrƒ   Úhostr…   Úexcs   &      r,   Únormalize_originrŠ   €   s  € ð × Ð ˜b×'Ñ'Ó)€EßÜÐ-Ó.Ð.Ø�EÔÜÐ=¸e¹YÀaÐHÓIÐIÜ�U‹O€EØ�l‰l× Ð ˜b×'Ñ'Ó)€FØ�N‰N× Ð ˜b×'Ñ'Ó)€DßŸÜÐ7¸±yÐAÓBÐBðGØ�z‰zˆð ‚|�tœ~×1Ñ1°&Ó9Ô9Ø�˜˜T˜FÐ#Ð#ØˆX�S˜˜˜a ˜vÐ&Ð&øô	 ô GÜÐ2°5±)Ð<Ó=À3ÐFûðGús   Â8C3 Ã3DÃ>DÄDT)Úfrozenc                  ó’   € ] tR t^št$ RtR]R&   R]R&   R]R&   R]R&   R]R&   R	tR]R
&   R	tR]R&   RtR]R&   Rt	R]R&   R R lt
RtR	# )ÚVaultItemMetazåMetadata-only view of a vault item. Never contains secret values.

For ``kind='login'`` the identifier (email/username/phone) is metadata,
not a secret: the agent may see it and type it itself. Only the password
is vault-secret.
r6   ÚidÚkindÚlabelúOptional[str]ÚoriginÚ
created_atNÚidentifier_typeÚ
identifierFÚboolÚhas_otpÚtupleÚallowed_originsc               ó   € V ^8„  d   QhRR/# )r4   r7   údict[str, Any]r$   )r8   s   "r,   r9   ÚVaultItemMeta.__annotate__°   s   € ÷ ñ ˜ñ r+   c           
     	ól  € R V P                   RV P                  RV P                  RV P                  RV P                  /pV P
                  e   V P
                  VR&   V P                  VR&   V P                  '       d   RVR&   \        V P                  4      ^8”  d   \        V P                  4      VR	&   V# )
rŽ   r�   r�   r’   r“   r•   r”   Tr—   r™   )rŽ   r�   r�   r’   r“   r•   r”   r—   rn   r™   Úlist)ÚselfÚouts   & r,   Úto_dictÚVaultItemMeta.to_dict°   s¡   € à�$—'‘'Ø�D—I‘IØ�T—Z‘ZØ�d—k‘kØ˜$Ÿ/™/ð
ˆð �?‰?Ò&Ø $§¡ˆC�ÑØ%)×%9Ñ%9ˆCÐ!Ñ"Ø�<�<ˆ<Ø!ˆC�	‰NÜˆt×#Ñ#Ó$ qÔ(Ü%)¨$×*>Ñ*>Ó%?ˆCÐ!Ñ"Øˆ
r+   r$   )r%   r&   r'   r(   r)   Ú__annotations__r”   r•   r—   r™   r¡   r*   r$   r+   r,   r�   r�   š   sW   ‡ ñð 	ƒGØ
ƒIØƒJØÓØƒOØ%)€O�]Ó)Ø $€J�Ó$Ø€GˆTÓð  €O�UÓ÷ñ r+   r�   c                  óÆ   € ] tR t^ÂtRtRR R lltR R lt]R 4       tR t	R	 R
 lt
R R ltRR R lltR R ltR R ltR R ltR R ltR R lt]R R l4       tRtR# )Ú
VaultStorez?Encrypted, profile-scoped vault under ``<HERMES_HOME>/vault/``.Nc               ó   € V ^8„  d   QhRR/# )r4   Úbase_dirzOptional[Path]r$   )r8   s   "r,   r9   ÚVaultStore.__annotate__Å   s   € ÷ 2ñ 2 ñ 2r+   c                	óÂ   € Ve   \        V4      M\        \        4       4      R,          V n        V P                  R,          V n        V P                  R,          V n        R # )NÚvaultzvault.json.encz	vault.key)r	   r   Ú_baseÚ_vault_pathÚ	_key_path)rŸ   r§   s   &&r,   Ú__init__ÚVaultStore.__init__Å   sI   € Ø'/Ò';”T˜(”^Ü”Ó"Ó# gÕ-ð 	Œ
ð  Ÿ:™:Ð(8Õ8ˆÔØŸ™ kÕ1ˆŽr+   c               ó   € V ^8„  d   QhRR/# )r4   r7   ÚNoner$   )r8   s   "r,   r9   r¨   Î   s   € ÷ ñ ˜Tñ r+   c                	óø   € \        V P                  R RRR7        ^ RIHp V! V P                  4       R#   \         d:     \
        P                  ! T P                  R 4        R#   \         d      R# i ; ii ; i)iÀ  T)ÚmodeÚparentsÚexist_ok)Ú_secure_dirN)r   r«   Úhermes_cli.configr¶   Ú	ExceptionÚosÚchmodÚOSError)rŸ   r¶   s   & r,   Ú_ensure_dirÚVaultStore._ensure_dirÎ   s`   € Ü�d—j‘j u°dÀTÕJð
	Ý5á˜Ÿ
™
Ö#øÜô 	ðÜ—’˜Ÿ™ U×+øÜô Ûðúð	ús'   ›5 µA9Á!A%Á%A5Á0A9Á4A5Á5A9c              #  óÄ  "  € \         ;_uu_ 4        V P                  4        V P                  R,          p\        '       dI   VP	                  4       '       d    VP                  4       P                  ^ 8X  d   VP                  RRR7       \        T\        '       d   RMRRR7      ;_uu_ 4       p\        '       d'   \        P                  ! V\        P                  4       MQ\        '       dF   VP                  ^ 4       \        P                  ! VP                  4       \        P                  ^4        Rx € \!        \"        4      ;_uu_ 4        \        '       d'   \        P                  ! V\        P$                  4       MQ\        '       dF   VP                  ^ 4       \        P                  ! VP                  4       \        P&                  ^4       RRR4       RRR4       RRR4       R#   + '       g   i     L"; i  \!        \"        4      ;_uu_ 4        \        '       d'   \        P                  ! T\        P$                  4       MQ\        '       dF   TP                  ^ 4       \        P                  ! TP                  4       \        P&                  ^4       RRR4       i   + '       g   i     i ; i; i  + '       g   i     Lè; i  + '       g   i     R# ; i5i)zàSerialize read-modify-write cycles across threads AND processes: the Desktop gateway, a CLI
`hermes vault add` and a TUI slash worker all write the same ``vault.json.enc``; two unlocked
writers would drop each other's items.z.vault.lockÚ úutf-8)Úencodingzr+za+N)Ú_LOCKr¼   r«   ÚmsvcrtÚexistsÚstatÚst_sizeÚ
write_textÚopenÚfcntlÚflockÚLOCK_EXÚseekÚlockingÚfilenoÚLK_LOCKr   r»   ÚLOCK_UNÚLK_UNLCK)rŸ   Ú	lock_pathÚfds   &  r,   Ú_lockedÚVaultStore._lockedÞ   s—  é € ÷
 ŽUØ×ÑÔØŸ
™
 ]Õ2ˆIß‹v˜y×/Ñ/×1Ò1°Y·^±^Ó5E×5MÑ5MÐQRÔ5RØ×$Ñ$ S°7Ð$Ô;Ü�i¯«¡°TÀG×LÕLÐPRß“5Ü—K’K ¤E§M¡MÕ2ß“VØ—G‘G˜A”JÜ—N’N 2§9¡9£;´·±ÀÔBðLÛä!¤'×*Õ*ß ›5Ü!ŸKšK¨¬E¯M©MÕ:ß#›VØŸG™G AœJÜ"ŸNšN¨2¯9©9«;¼¿¹ÈÔK÷ +÷ M÷ ‰U÷ +×*ûœ¤'×*Õ*ß ›5Ü!ŸKšK¨¬E¯M©MÕ:ß#›VØŸG™G AœJÜ"ŸNšN¨2¯9©9«;¼¿¹ÈÔK÷ +×*×*Ð*ý÷ M×Lú÷ �UˆUüs™   ‚K ‘AKÁAKÂ->J9	Ã,AJ9	Ä2G>Ä6J9	Å>G+ÆAG+ÇJ9	ÇKÇ!
K Ç+G;Ç6J9	Ç>J6È>J#ÉAJ#Ê	J6Ê#J3Ê.J6Ê6J9	Ê9K	ËKËK	Ë	K c                	óš  € ^ RI Hp V P                  4        V P                  P	                  4       '       g™   VP                  4       p\        P                  ! V P                  \        P                  \        P                  ,          \        P                  ,          R4      p \        P                  ! W24       \        P                  ! V4       M(V P                  P                  4       P                  4       p \        P                  ! V P                  R4       V! V4      #   \        P                  ! T4       i ; i  \          d     L0i ; i)é    )ÚFerneté€  )Úcryptography.fernetrØ   r¼   r­   rÄ   Úgenerate_keyr¹   rÈ   ÚO_WRONLYÚO_CREATÚO_EXCLÚwriteÚcloseÚ
read_bytesrJ   rº   r»   )rŸ   rØ   ry   rÓ   s   &   r,   Ú_fernetÚVaultStore._fernetø   sÝ   € Ý.à×ÑÔØ�~‰~×$Ñ$×&Ò&Ø×%Ñ%Ó'ˆCÜ—’Ø—‘¤§¡¬b¯j©jÕ 8¼2¿9¹9Õ DÀeóˆBðÜ—’˜Ô!ä—’˜•à—.‘.×+Ñ+Ó-×3Ñ3Ó5ˆCð	Ü�HŠH�T—^‘^ UÔ+ñ �c‹{Ðøô —’˜•ûô
 ô 	Ùð	ús   Â"D! Ã8!D< Ä!D9Ä<E
Å	E
c               ó   € V ^8„  d   QhRR/# )r4   r7   úlist[dict[str, Any]]r$   )r8   s   "r,   r9   r¨     s   € ÷ 8ñ 8Ð/ñ 8r+   c                	óT  € V P                   P                  4       '       g   . # V P                   P                  4       pV'       g   . # ^ RIHp  V P                  4       P                  V4      p \        P                  ! TP                  R4      4      p\        T\        4      '       g   \        R4      hTP                  R. 4      p\        T\         4      '       d   T# . #   T d   p\        R4      ThRp?ii ; i  \        P                  \        3 d   p\        R4      ThRp?ii ; i)r×   )ÚInvalidTokenz>vault file could not be decrypted (key mismatch or corruption)NrÀ   z&vault file is corrupted (invalid JSON)z*vault file is corrupted (unexpected shape)rP   )r¬   rÄ   rá   rÚ   rç   râ   Údecryptr#   ÚjsonÚloadsÚdecodeÚJSONDecodeErrorÚUnicodeDecodeErrorÚ
isinstanceÚdictrQ   rž   )rŸ   Úblobrç   Úrawr‰   ÚdatarP   s   &      r,   Ú	_read_allÚVaultStore._read_all  s	  € Ø×Ñ×&Ñ&×(Ò(ØˆIØ×Ñ×*Ñ*Ó,ˆßØˆIÝ4ð	Ø—,‘,“.×(Ñ(¨Ó.ˆCð
	Ü—:’:˜cŸj™j¨Ó1Ó2ˆDô
 ˜$¤×%Ò%ÜÐIÓJÐJØ—‘˜ "Ó%ˆÜ" 5¬$×/Ò/ˆuÐ7°RÐ7øð ô 	ÜØPóàðûð	ûô ×$Ñ$Ô&8Ð9ô 	ÜØ8óàðûð	ús0   ÁC  Á.%C; Ã C8Ã'C3Ã3C8Ã;D'ÄD"Ä"D'c               ó    € V ^8„  d   QhRRRR/# )r4   rP   rå   r7   r±   r$   )r8   s   "r,   r9   r¨   (  s   € ÷ Oñ OÐ 4ð O¸ñ Or+   c                	óè   € V P                  4        \        P                  ! R ^RV/4      P                  R4      pV P	                  4       P                  V4      p\        V P                  VRRR7       R# )ÚversionrP   rÀ   rÙ   T)r³   Ú	fsync_dirN)r¼   ré   ÚdumpsÚencoderâ   Úencryptr   r¬   )rŸ   rP   Úpayloadrð   s   &&  r,   Ú
_write_allÚVaultStore._write_all(  sZ   € Ø×ÑÔÜ—*’*˜i¨¨G°UÐ;Ó<×CÑCÀGÓLˆØ�|‰|‹~×%Ñ% gÓ.ˆä˜4×+Ñ+¨T¸È×Nr+   c          
     ó,   € V ^8„  d   QhRRRRRRRRRR	/# )
r4   r�   r6   r�   r?   r›   r’   r‘   r7   r�   r$   )r8   s   "r,   r9   r¨   1  sC   € ÷ B"ñ B"àðB"ð ðB"ð ð	B"ð
 ðB"ð 
ñB"r+   c                óB  € V\         9  d   \        RV: R\          R24      hT;'       g    RP                  4       pV'       g   \        R4      hRpRpRp\        V4      pVR8X  dý   V'       g   \        R4      h\	        V4      pVP                  R	R4      pV\        9  d   \        R
\         24      h\        VP                  RR4      ;'       g    R4      P                  4       pV'       d   VP                  R4      '       g   \        R4      h\        V4      p\        \        VP                  R4      ;'       g    R4      4      p	RVR,          /V	'       d   RV	/M/ CpMÑVR8X  d   \        M\        p
VP                  4        UUu/ uFD  w  r¼Wº9   g   K  \        T;'       g    R4      P                  4       '       g   K8  V\        V4      bKF  	  ppp\        V,           Uu. uF  qÝV9  g   K  VNK  	  ppV'       d    \        V RRP                  V4       24      hV'       d   \	        V4      pR\        P                   ! 4       P"                  R,           2pRVRVRVRVR\$        P&                  ! \(        4      P+                  4       R	VRVR\        V4      /pV P-                  4       ;_uu_ 4        V P/                  4       pVP1                  V4       V P3                  V4       RRR4       V P5                  V4      # u uppi u upi   + '       g   i     L,; i)u¹  Add an item. ``secret`` is the sensitive payload (encrypted at rest).

For ``kind='login'``, ``origin`` is required and the payload must
contain ``identifier_type``, ``identifier`` and ``password``. The
identifier fields are NOT secret â€” they are moved into item metadata
(the agent may see and type the identifier itself); only
``password`` stays in the encrypted secret payload. ``payment`` and
``address`` payloads remain fully secret.
zunknown vault kind z (expected one of r�   r;   zlabel is requiredNÚloginz"origin is required for login itemsr”   zidentifier_type must be one of r•   Úpasswordz+login items require identifier and passwordÚ
otp_secretr   z items require z, Úvault_:Né   NrŽ   r�   r�   r’   r“   r?   )ÚVAULT_KINDSr#   rJ   rï   rŠ   ÚpopÚLOGIN_IDENTIFIER_TYPESr6   rQ   ra   ÚPAYMENT_FIELDSÚADDRESS_FIELDSrP   ÚREQUIRED_FIELDSÚjoinÚuuidÚuuid4Úhexr   Únowr   Ú	isoformatrÔ   ró   Úappendrý   Ú_meta)rŸ   r�   r�   r?   r’   Únorm_originr•   r”   Úid_typer  Úallowedr]   r^   ÚfÚmissingÚitem_idÚrecordrP   s   &&&&&             r,   Úadd_itemÚVaultStore.add_item1  s¥  € ð  ”{Ô"ÜÐ2°4±(Ð:LÌ[ÈMÐYZÐ[Ó\Ð\Ø—�˜"×#Ñ#Ó%ˆßÜÐ0Ó1Ð1Ø%)ˆØ$(ˆ
Ø)-ˆÜ�f“ˆØ�7Œ?ßÜ Ð!EÓFÐFÜ*¨6Ó2ˆKØ—j‘jÐ!2°DÓ9ˆGØÔ4Ô4Ü Ø5Ô6LÐ5MÐNóð ô ˜VŸZ™Z¨°bÓ9×?Ð?¸RÓ@×FÑFÓHˆJß V§Z¡Z°
×%;Ò%;Ü Ð!NÓOÐOÜ! '›lˆOô .¬c°&·*±*¸\Ó2J×2PÐ2PÈbÓ.QÓRˆJØ  &¨Õ"4Ðk×Wa¸,È
Ñ9SÐgiÐk‰Fà(,°	Ô(9•n¼~ˆGØ,2¯L©L¬NÔd©N¡D A¸a¹l”iÌsÐST×SZÐSZÐXZË|×OaÑOa×Oc”i�aœ˜Q›’i©NˆFÑdÜ"1°$Ö"7ÓKÑ"7˜QÀF¹?—q�qÑ"7ˆGÐKßÜ  D 6¨¸¿¹À7Ó9KÐ8LÐ!MÓNÐNßÜ.¨vÓ6�àœ4Ÿ:š:›<×+Ñ+¨CÕ0Ð1Ð2ˆà�'Ø�DØ�UØ�kØœ(Ÿ,š,¤sÓ+×5Ñ5Ó7Ø˜Ø˜*Ø”d˜6“lð	
ˆð �\‰\�^�^Ø—N‘NÓ$ˆEØ�L‰L˜Ô Ø�O‰O˜EÔ"÷ ð �z‰z˜&Ó!Ð!ùó- eùÚK÷" �^ús0   Æ

LÆLÆ'LÇLÇ&L	Ç3L	Ê73LÌL	c               ó   € V ^8„  d   QhRR/# )r4   r7   zlist[VaultItemMeta]r$   )r8   s   "r,   r9   r¨   u  s   € ÷ Añ AÐ/ñ Ar+   c                óÖ   € V P                  4       ;_uu_ 4        V P                  4        Uu. uF  qP                  V4      NK  	  upuuRRR4       # u upi   + '       g   i     R# ; i)z:Metadata-only listing. Secret payloads are never included.N)rÔ   ró   r  )rŸ   Úrecs   & r,   Ú
list_itemsÚVaultStore.list_itemsu  sB   € à�\‰\�^�^Ø/3¯~©~Ô/?Ó@Ñ/?¨—J‘J˜s–OÑ/?Ñ@÷ Š^ùÚ@÷ �^ˆ^ús   ™A¬AÁAÁAÁA(	c               ó   € V ^8„  d   QhRR/# )r4   r7   r–   r$   )r8   s   "r,   r9   r¨   z  s   € ÷ ñ ˜4ñ r+   c                	óÈ   €  V P                  4       ;_uu_ 4        \        V P                  4       4      uuR R R 4       #   + '       g   i     R # ; i  \         d     R# i ; i)NF)rÔ   r–   ró   r¸   )rŸ   s   &r,   Ú	has_itemsÚVaultStore.has_itemsz  s>   € ð	Ø—‘—•Ü˜DŸN™NÓ,Ó-÷  ——“ûäô 	Úð	ús+   ‚A š>³
A ¾A	Á	A ÁA ÁA!Á A!c               ó    € V ^8„  d   QhRRRR/# )r4   r  r6   r7   r–   r$   )r8   s   "r,   r9   r¨   �  s   € ÷ ñ  3ð ¨4ñ r+   c                	óV  € V P                  4       ;_uu_ 4        V P                  4       pV Uu. uF  q3P                  R 4      V8w  g   K  VNK  	  pp\        V4      \        V4      8X  d    RRR4       R# V P	                  V4        RRR4       R# u upi   + '       g   i     R# ; i)rŽ   NFT)rÔ   ró   rQ   rn   rý   )rŸ   r  rP   r  Ú	remainings   &&   r,   Úremove_itemÚVaultStore.remove_item�  s{   € Ø�\‰\�^�^Ø—N‘NÓ$ˆEÙ(-ÓJ© ·±¸³À'Ñ1IŸ˜©ˆIÐJÜ�9‹~¤ U£Ô+Ø÷	 ‰^ð
 �O‰O˜IÔ&Ø÷ ‰^ùâJ÷ �^ˆ^ús(   ™B®BÁ
BÁBÁ6BÂBÂB(	c               ó    € V ^8„  d   QhRRRR/# )r4   r  r6   r7   zOptional[VaultItemMeta]r$   )r8   s   "r,   r9   r¨   Š  s   € ÷ ñ  ð Ð(?ñ r+   c                	ó  € V P                  4       ;_uu_ 4        V P                  4        F6  pVP                  R 4      V8X  g   K  V P                  V4      u uuRRR4       # 	  RRR4       R#   + '       g   i     R# ; i)rŽ   N)rÔ   ró   rQ   r  ©rŸ   r  r  s   && r,   Úget_metaÚVaultStore.get_metaŠ  sX   € Ø�\‰\�^�^Ø—~‘~Ö'�Ø—7‘7˜4“= GÖ+ØŸ:™: c›?Ñ*÷ Š^Ù'÷ ñ ÷	 Ž^ñ ús   ™'A.ÁA.Á"A.Á.A?	c               ó    € V ^8„  d   QhRRRR/# )r4   r  r6   r7   r›   r$   )r8   s   "r,   r9   r¨   ‘  s   € ÷ 
?ñ 
? cð 
?¨nñ 
?r+   c                óB  € V P                  4       ;_uu_ 4        V P                  4        FI  pVP                  R4      V8X  g   K  \        VP                  R4      ;'       g    / 4      u uuRRR4       # 	  RRR4       \	        RV: 24      h  + '       g   i     L; i)z½Resolve the decrypted secret payload for server-side use ONLY.

Callers must never place the returned values into tool results,
logs, exceptions, or any string that reaches the session DB.
rŽ   r?   Nzno vault item with id )rÔ   ró   rQ   rï   r#   r-  s   && r,   Úresolve_secretÚVaultStore.resolve_secret‘  ss   € ð �\‰\�^�^Ø—~‘~Ö'�Ø—7‘7˜4“= GÖ+Ü §¡¨Ó 1× 7Ð 7°RÓ8Ñ8÷ Š^Ù'÷ ô Ð1°'±Ð=Ó>Ð>÷	 �^ús   ™'BÁBÁ"BÁ5BÂB	c               ó    € V ^8„  d   QhRRRR/# )r4   r  r›   r7   r�   r$   )r8   s   "r,   r9   r¨   ž  s   € ÷ 
ñ 
�>ð 
 mñ 
r+   c                	óØ  € V P                  R 4      p\        \        V P                  RR4      4      \        V P                  RR4      4      \        V P                  RR4      4      V P                  R4      \        V P                  RR4      4      V'       d   V P                  R4      MRT;'       g    R\        V P                  R	4      ;'       g    / P                  R
4      4      R7      # )r•   rŽ   r;   r�   r�   r’   r“   r”   Nr?   r  )rŽ   r�   r�   r’   r“   r”   r•   r—   )rQ   r�   r6   r–   )r  r•   s   & r,   r  ÚVaultStore._meta�  sµ   € à—W‘W˜\Ó*ˆ
ÜÜ�3—7‘7˜4 Ó$Ó%Ü�S—W‘W˜V RÓ(Ó)Ü�c—g‘g˜g rÓ*Ó+Ø—7‘7˜8Ó$Ü˜3Ÿ7™7 <°Ó4Ó5ß:D˜CŸG™GÐ$5Ô6È$Ø!×)Ð) TÜ˜#Ÿ'™' (Ó+×1Ð1¨r×6Ñ6°|ÓDÓEô	
ð 		
r+   )r«   r­   r¬   )N)r%   r&   r'   r(   r)   r®   r¼   r   rÔ   râ   ró   rý   r  r   r$  r)  r.  r2  Ústaticmethodr  r*   r$   r+   r,   r¥   r¥   Â   sj   † ÙI÷2õð  ñLó ðLò2õ.8õ2O÷B"õHAõ
õõõ
?ð ô
ó ô
r+   r¥   c               ó   € V ^8„  d   QhRR/# )r4   r7   r¥   r$   )r8   s   "r,   r9   r9   ¬  s   € ÷ ñ ˜ñ r+   c                 ó   € \        4       # )z#Default profile-scoped vault store.)r¥   r$   r+   r,   Úget_vault_storer:  ¬  s
   € ä‹<Ðr+   c               ó$   € V ^8„  d   QhRRRRRR/# )r4   Útextr6   r?   r›   r7   r$   )r8   s   "r,   r9   r9   ±  s!   € ÷ 
ñ 
 ð 
¨nð 
Àñ 
r+   c                óð   € T pVP                  4        FG  p\        V\        4      '       g   K  \        V4      ^8¼  g   K-  W29   g   K5  VP	                  VR4      pKI  	  \
        P                  ! RRV4      pV# )zŽDefensively strip any secret values from a string (e.g. an exception
message) before it can be surfaced. Case-sensitive exact substring scrub.z
[REDACTED]z(password['\"]?\s*[:=]\s*)\S+z\1[REDACTED])Úvaluesrî   r6   rn   rU   rW   rX   )r<  r?   Úscrubbedr5   s   &&  r,   Úscrub_secret_from_textr@  ±  sa   € ð €HØ—‘–ˆÜ�eœS×!Ô!¤c¨%£j°A¦o¸%Ö:KØ×'Ñ'¨¨|Ó<ŠHñ !ô
 �vŠvÐ6¸ÈÓR€HØ€Or+   )r  r   r   )ÚemailÚphoneÚusername)r   r   r   r   )r   r   r   r   )4r)   Ú
__future__r   ré   r¹   rW   Ú	threadingr  Ú
contextlibr   r   Údataclassesr   r   r   r   Úpathlibr	   Útypingr
   r   r   r   rM   r   Úhermes_dir_aclr   Úhermes_constantsr   Úutilsr   r  r  r	  r
  r  r†   ÚLockrÂ   rÃ   rÉ   ÚImportErrorr¸   r#   rV   ra   r}   rŠ   r�   r¥   r:  r@  r$   r+   r,   Ú<module>rO     s‡  ðñõ" #ã Û 	Û 	Û Û ß /Ý !ß ,Ñ ,Ý ß ,Ó ,Ý !Ý (å ,Ý $à-€à7Ð ð �;Ð 1°9¸kÈ>Ø�˜u hÐ0EÀ}ð€ð
 �_ o°ÈÐP`ØÐ˜}¨m¸YÈð€ð ÐMØÐQðS€ð ˜"˜g sÐ+€à�ŠÓ€ð 
€ðÛôP�ô Pð �f˜h¨°(¸HÐE€
õ.ð@#¨ð #¸"ð #ÐTX÷ #õ*'ñ4 �$Ô÷$ð $ó ð$÷Ng
ñ g
õT÷

øðg ô Ø€EÙ	�+×	Õ	Û÷ 
×	×	Ó	úðús*   ÂC> Ã>D<ÄD'ÄD<Ä'D8Ä2D<Ä8D<