Ë
    kQêj!   ã                  ó¬   — d Z ddlmZ ddlZ ej                  d«      Z ej                  d«      Zdd„Zdd„Zdd„Z	 G d	„ d
«      Z
 G d„ d«      Zg d¢Zy)a±  Named Secrets, and the bindings that deliver them to Functions.

A Secret is a database-scoped named credential. Nothing in this module holds a
value: :class:`EnvVarSecret` names one and says which environment variable it
should arrive in, and the value is resolved by the remote service when a
Function bound to it runs. No API returns a stored credential, by construction
rather than by policy -- there is no code path that could.
é    )ÚannotationsNz^[A-Za-z0-9_.-]{1,255}$z^[A-Za-z_][A-Za-z0-9_]*$c                ó®   — t        | t        «      s!t        dt        | «      j                  › �«      ‚t
        j                  | «      st        d| ›�«      ‚| S )z4Check a Secret name locally and return it unchanged.z"Secret name must be a string, not zinvalid Secret name: )Ú
isinstanceÚstrÚ	TypeErrorÚtypeÚ__name__Ú_SECRET_NAMEÚ	fullmatchÚ
ValueError©Únames    úT/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/lancedb/secrets.pyÚvalidate_secret_namer      sP   € ä�dœCÔ ÜÐ<¼TÀ$»Z×=PÑ=PÐ<QÐRÓSÐSÜ×!Ñ! $Ô'ÜÐ0°°Ð9Ó:Ð:Ø€Kó    c                ó  — | €yt        | t        «      rt        d| ›d�«      ‚t        | «      }|D ]V  }t        |t        «      s!t        dt	        |«      j
                  › �«      ‚t        j                  |«      rŒJt        d|›�«      ‚ |S )a  Check a namespace path locally and return it as a tuple.

    ``None`` and ``[]`` both mean the root namespace. Segments follow the same
    rule as Secret names: a binding carries the path and the name as separate
    fields, so neither is ever parsed out of the other.
    © zGnamespace_path must be a list of segments, not a string; did you mean [z]?z-namespace path segment must be a string, not z invalid namespace path segment: )	r   r   r   Útupler   r	   r
   r   r   )Únamespace_pathÚsegmentsÚsegments      r   Úvalidate_namespace_pathr   "   s©   € ð ÐØÜ�.¤#Ô&ÜðØ+Ð.¨bð2ó
ð 	
ô �^Ó$€HØò MˆÜ˜'¤3Ô'ÜØ?ÄÀWÃ×@VÑ@VÐ?WÐXóð ô ×%Ñ% gÕ.ÜÐ?À¸{ÐKÓLÐLðMð €Or   c                ó®   — t        | t        «      s!t        dt        | «      j                  › �«      ‚t
        j                  | «      st        d| ›�«      ‚| S )zCCheck an environment variable name locally and return it unchanged.z0environment variable name must be a string, not z#invalid environment variable name: )r   r   r   r   r	   Ú_ENV_VARIABLEr   r   r   s    r   Úvalidate_env_variabler   ;   sV   € ä�dœCÔ ÜØ>¼tÀD»z×?RÑ?RÐ>SÐTó
ð 	
ô ×"Ñ" 4Ô(ÜÐ>¸t¸hÐGÓHÐHØ€Kr   c                  ót   — e Zd ZdZdZddœ	 	 	 dd„Zedd„«       Zedd„«       Zed„ «       Z	dd	„Z
dd
„Zdd„Zy)ÚEnvVarSecreta¿  A Secret bound to the environment variable a Function's library reads.

    Pass these in the ``secrets`` sequence of
    [DBConnection.create_function][lancedb.db.DBConnection.create_function]. The
    Function's source is unchanged by binding: it reads ``OPENAI_API_KEY`` the
    way it always did, and the binding is what puts a value there.

    This is a local value. Constructing it contacts no server, so it always
    succeeds and says nothing about whether the Secret exists; that is checked
    at registration, where a mistyped Secret name surfaces as a clear "does not
    exist" naming both the Secret and the variable bound to it. A mistyped
    *variable* name cannot be caught anywhere -- nothing knows which variables a
    Function reads -- so it surfaces on the first rows instead.

    The type exists so a credential cannot be passed by accident. A bare string
    in the same position is a plausible-looking mistake with the opposite
    meaning, and it reads identically in a diff.

    Parameters
    ----------
    secret_name : str
        The Secret's database-scoped name.
    env_variable : str
        The environment variable the Function reads it from.
    secret_namespace_path : list of str, optional
        The namespace the Secret is addressed within. ``None`` and ``[]`` both
        mean the root namespace. Carried beside the name rather than joined
        into it, so neither is ever parsed back out of the other.

    Examples
    --------
    >>> from lancedb import EnvVarSecret
    >>> binding = EnvVarSecret(
    ...     secret_name="openai-prod", env_variable="OPENAI_API_KEY"
    ... )
    >>> binding.secret_name, binding.env_variable
    ('openai-prod', 'OPENAI_API_KEY')
    )Ú_secret_nameÚ_env_variableÚ_secret_namespace_pathN)Úsecret_namespace_pathc               ód   — t        |«      | _        t        |«      | _        t	        |«      | _        y ©N)r   r   r   r   r   r    )ÚselfÚsecret_nameÚenv_variabler!   s       r   Ú__init__zEnvVarSecret.__init__p   s,   € ô 1°Ó=ˆÔÜ2°<Ó@ˆÔÜ&=Ð>SÓ&TˆÕ#r   c                ó   — | j                   S ©z"The Secret's database-scoped name.)r   ©r$   s    r   r%   zEnvVarSecret.secret_namew   s   € ð × Ñ Ð r   c                ó   — | j                   S )z3The environment variable the value is delivered in.)r   r*   s    r   r&   zEnvVarSecret.env_variable|   s   € ð ×!Ñ!Ð!r   c                ó,   — t        | j                  «      S )zCThe namespace path the Secret is addressed within, root when empty.)Úlistr    r*   s    r   r!   z"EnvVarSecret.secret_namespace_path�   s   € ô �D×/Ñ/Ó0Ð0r   c                óŒ   — | j                   rdt        | j                   «      ›�nd}d| j                  ›d| j                  ›|› d�S )Nz, secret_namespace_path=Ú zEnvVarSecret(secret_name=z, env_variable=ú))r    r-   r   r   )r$   Úpaths     r   Ú__repr__zEnvVarSecret.__repr__†   s^   € ð ×*Ò*ð '¤t¨D×,GÑ,GÓ'HÐ&KÑLàð 	ð (¨×(9Ñ(9Ð'<ð =Ø ×.Ñ.Ð1°$°°qð:ð	
r   c                óÄ   — t        |t        «      xrO |j                  | j                  k(  xr4 |j                  | j                  k(  xr |j                  | j                  k(  S r#   )r   r   r   r   r    ©r$   Úothers     r   Ú__eq__zEnvVarSecret.__eq__‘   sa   € ä�uœlÓ+ò LØ×"Ñ" d×&7Ñ&7Ñ7òLà×#Ñ# t×'9Ñ'9Ñ9òLð ×,Ñ,°×0KÑ0KÑKð		
r   c                ód   — t        t        | j                  | j                  | j                  f«      S r#   )Úhashr   r   r   r    r*   s    r   Ú__hash__zEnvVarSecret.__hash__™   s2   € ÜäØ×!Ñ!Ø×"Ñ"Ø×+Ñ+ð	ó
ð 	
r   )r%   r   r&   r   ©Úreturnr   ©r5   Úobjectr;   Úbool©r;   Úint)r	   Ú
__module__Ú__qualname__Ú__doc__Ú	__slots__r'   Úpropertyr%   r&   r!   r2   r6   r9   r   r   r   r   r   F   sz   „ ñ%ðN L€Ið MQñUØðUØ.1óUð ò!ó ð!ð ò"ó ð"ð ñ1ó ð1ó	
ó
ô
r   r   c                  ót   — e Zd ZdZdZdd„Zedd„«       Zedd„«       Zedd„«       Z	e
dd„«       Zdd„Zdd	„Zy
)Ú
SecretInfoz›What a database records about a Secret. Never its value.

    Returned by
    [DBConnection.describe_secret][lancedb.db.DBConnection.describe_secret].
    ©Ú_nameÚ_created_at_millisÚ_updated_at_millisc                ó.   — || _         || _        || _        y r#   rH   )r$   r   Úcreated_at_millisÚupdated_at_milliss       r   r'   zSecretInfo.__init__­   s   € ØˆŒ
Ø"3ˆÔØ"3ˆÕr   c                ó   — | j                   S r)   )rI   r*   s    r   r   zSecretInfo.name²   s   € ð �z‰zÐr   c                ó   — | j                   S )zBWhen the Secret was created, in milliseconds since the Unix epoch.)rJ   r*   s    r   rM   zSecretInfo.created_at_millis·   s   € ð ×&Ñ&Ð&r   c                ó   — | j                   S )zìWhen the Secret's value was last rotated, in epoch milliseconds.

        The only observable that a rotation landed: no API returns a credential,
        so a caller confirms ``alter_secret`` took effect by watching this move.
        )rK   r*   s    r   rN   zSecretInfo.updated_at_millis¼   s   € ð ×&Ñ&Ð&r   c                ó*   —  | |d   |d   |d   ¬«      S )Nr   rM   rN   )r   rM   rN   r   )ÚclsÚvalues     r   Ú	from_jsonzSecretInfo.from_jsonÅ   s(   € áØ�v‘Ø#Ð$7Ñ8Ø#Ð$7Ñ8ô
ð 	
r   c                óV   — d| j                   ›d| j                  ›d| j                  ›d�S )NzSecretInfo(name=z, created_at_millis=z, updated_at_millis=r0   rH   r*   s    r   r2   zSecretInfo.__repr__Í   s;   € à˜tŸz™z˜nð -!Ø!%×!8Ñ!8Ð ;ð <!Ø!%×!8Ñ!8Ð ;¸1ð>ð	
r   c                óÄ   — t        |t        «      xrO |j                  | j                  k(  xr4 |j                  | j                  k(  xr |j                  | j                  k(  S r#   )r   rG   rI   rJ   rK   r4   s     r   r6   zSecretInfo.__eq__Ô   s]   € ä�uœjÓ)ò DØ—‘˜tŸz™zÑ)òDà×(Ñ(¨D×,CÑ,CÑCòDð ×(Ñ(¨D×,CÑ,CÑCð		
r   N)r   r   rM   r@   rN   r@   r:   r?   )rT   Údictr;   z'SecretInfo'r<   )r	   rA   rB   rC   rD   r'   rE   r   rM   rN   ÚclassmethodrU   r2   r6   r   r   r   rG   rG   ¤   sn   „ ñð F€Ió4ð
 òó ðð ò'ó ð'ð ò'ó ð'ð ò
ó ð
ó
ô
r   rG   )r   rG   r   r   )r   r   r;   r   r#   )rC   Ú
__future__r   ÚreÚcompiler
   r   r   r   r   r   rG   Ú__all__r   r   r   ú<module>r^      sd   ðñõ #ã 	ð ˆr�z‰zÐ4Ó5€Ø�—
‘
Ð6Ó7€óóó2÷[
ñ [
÷|6
ñ 6
òr�r   