+
    „WÝj³j  ã                  óN  € R t ^ RIHt ^ RIt^ RIt^ RIt^ RIt^ RIHtH	t	 ^ RI
HtH
t
 ^ RIHt ^ RIHtHtHtHt ^ RIHt RtR	tR
t]! 0 Rim4      t]P4                  ! R4      t]P4                  ! R4      t]P4                  ! R4      t]	! RR7       ! R R4      4       tR R ltR R lt R R lt!R R lt"R R lt#R R lt$R R lt%R  R! lt&R" R# lt'R$ R% lt(R& R' lt)R( R) lt*R* R+ lt+R, R- lt,R. R/ lt-R0 R1 lt.R2 R3 lt/R4 R5 lt0R6 R7 lt1R8 R9 lt2R: R; lt3R< R= lt4R> R? lt5R@ RA lt6RBR/RC RD llt7RE RF lt8RG RH lt9RI RJ lt:RK RL lt;RM RN lt<RO RP lt=RQ RR lt>RS RT lt?RU RV lt@RW RX ltARY RZ ltBR[ R\ ltCR] R^ ltDR_ R` ltERa Rb ltFRc]BRd]CRe]DRf]E/tGRg Rh ltH. RjOtIR# )kaû  OAuth clients a plugin declares in ``plugin.yaml``: Hermes signs in, stores and refreshes the grant.

A plugin that calls a third-party API with the user's own OAuth client (a Google Cloud client, for example)
declares it under ``oauth:``. ``hermes auth add <plugin>:<id>`` runs the PKCE login of
:mod:`hermes_cli.auth_oauth_pkce_plugin` in a terminal, the grant lives in the active profile's
``auth.json`` (section ``plugin_oauth``) and Hermes refreshes it. The plugin calls
``credentialed_provider_request(<id>, ...)``: Hermes attaches the bearer for the declared hosts only, so
the plugin never holds a token (#139077; the same contract as the Codex lane, #136117).

Each grant remembers a fingerprint of the ``oauth:`` entry it was made for. A later version of the plugin
that changes the token URL, hosts, scopes or client variables gets ``ProviderNotSignedIn`` until the user
signs in again: the grant is used only for what the user consented to. Like capabilities, this is
consent and visibility, not a sandbox.
)ÚannotationsN)ÚasdictÚ	dataclass)ÚUTCÚdatetime)ÚPath)ÚAnyÚCallableÚMappingÚOptional)ÚurlparseÚplugin_oauthiÀÔ g      $@z^[a-z0-9][a-z0-9-]*$z^[A-Z][A-Z0-9_]*$zD^(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z](?:[a-z0-9-]*[a-z0-9])?$T)Úfrozenc                  óŠ   € ] tR t^&t$ RtR]R&   R]R&   R]R&   R]R&   R]R&   R]R	&   R
tR]R&   RtR]R&   ]R R l4       t	Rt
R# )ÚOAuthClientzTOne ``oauth:`` entry of a plugin manifest. Holds variable names, never their values.ÚstrÚidÚauthorize_urlÚ	token_urlztuple[str, ...]ÚscopesÚclient_id_envÚhostsÚ Úclient_secret_envztuple[tuple[str, str], ...]Úauthorize_paramsc               ó   € V ^8„  d   QhRR/# )é   Úreturnr   © )Úformats   "ÚKC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\plugin_oauth.pyÚ__annotate__ÚOAuthClient.__annotate__4   s   € ÷ dñ d˜Sñ dó    c                ó¦   € \         P                  ! \        P                  ! \	        V 4      RR7      P                  R4      4      P                  4       # )zIHash of every field: a grant is used only with the entry it was made for.T)Ú	sort_keyszutf-8)ÚhashlibÚsha256ÚjsonÚdumpsr   ÚencodeÚ	hexdigest)Úselfs   &r    ÚfingerprintÚOAuthClient.fingerprint3   s6   € ô �~Š~œdŸjšj¬°«ÀÔF×MÑMÈgÓVÓW×aÑaÓcÐcr#   r   N)Ú__name__Ú
__module__Ú__qualname__Ú__firstlineno__Ú__doc__Ú__annotations__r   r   Úpropertyr-   Ú__static_attributes__r   r#   r    r   r   &   sR   ‡ á^àƒGØÓØƒNØÓØÓØÓØÐ�sÓØ46ÐÐ1Ó6àôdó ôdr#   r   c               ó   € V ^8„  d   QhRR/# )r   Úurlr   r   )r   s   "r    r!   r!   ;   s   € ÷ 	ñ 	�Cñ 	r#   c                óŠ   € \        V \        4      '       g   R#  \        V 4      pVP                  pV#   \         d     R# i ; i)z```urlparse`` of *url*; None for a non-string or a URL it cannot read (bad IPv6 literal or port).N)Ú
isinstancer   r   ÚportÚ
ValueError)r8   ÚparsedÚ_s   &  r    Ú
_parse_urlr?   ;   sD   € ä�cœ3×ÒÙðÜ˜#“ˆØ�K‰Kˆð €Møô ô Úðús   š3 ³AÁAc               ó$   € V ^8„  d   QhRRRRRR/# )r   Úwherer   r8   r   r   ú	list[str]r   )r   s   "r    r!   r!   G   s!   € ÷ ñ ˜ð  3ð ¨9ñ r#   c                óÞ   € \        V4      pVeA   VP                  '       d/   VP                  f!   VP                  f   VP                  '       d   V  R2.# VP
                  R8w  d   V  R2.# . # )Nz7: must be an absolute URL without user info or fragmentÚhttpsz: must use https)r?   ÚhostnameÚusernameÚpasswordÚfragmentÚscheme)rA   r8   r=   s   && r    Ú_url_problemsrJ   G   si   € Ü˜‹_€FØŠ˜fŸoŸo˜o°·±Ò1LÐPV×P_ÑP_ÒPkØ��ˆØ�'ÐPÐQÐRÐRØ‡}�}˜ÔØ�'Ð)Ð*Ð+Ð+Ø€Ir#   c               ó    € V ^8„  d   QhRRRR/# )r   Únamer   r   Úboolr   )r   s   "r    r!   r!   Q   s   € ÷ oñ o˜Cð o Dñ or#   c                óè   a € ^ RI Hp ^ RIHp V! S 4      ;'       gW    \        ;QJ d-    V 3R lVP                  4        4       F  '       g   K   R# 	  R# ! V 3R lVP                  4        4       4      # )z±A variable Hermes itself reads (a provider key, a platform secret): never a plugin's client variable,
or a manifest could have Hermes POST that secret to the token URL it names.)ÚPROVIDER_REGISTRY)Úis_registered_env_namec              3  óB   <"  € T F  pSVP                   9   x € K  	  R # 5i©N)Úapi_key_env_vars)Ú.0ÚprL   s   & €r    Ú	<genexpr>Ú$_hermes_owned_env.<locals>.<genexpr>W   s   øé € Ð.nÑSmÈa¨t°q×7IÑ7IÖ/IÓSmùs   ƒTF)Úhermes_cli.authrO   Úhermes_cli.config_env_routingrP   ÚanyÚvalues)rL   rO   rP   s   f  r    Ú_hermes_owned_envr\   Q   sU   ø€ õ 2ÝDá! $Ó'×nÐn¯3«3Ô.nÐSd×SkÑSkÔSmÓ.n¯3¬3Ðnª3Ðn¨3Ô.nÐSd×SkÑSkÔSmÓ.nÓ+nÐnr#   c               ó$   € V ^8„  d   QhRRRRRR/# )r   ÚentryÚdictrA   r   r   rB   r   )r   s   "r    r!   r!   Z   s!   € ÷ ñ ˜4ð ¨ð °	ñ r#   c           	     ó¬  € V P                  R 4      p\        V\        4      '       d   \        P	                  V4      '       d   . MV RV P                  R 4      : R2.pR F*  pV\        V RV 2V P                  V4      4      ,          pK,  	  V P                  R4      p\        V\        4      '       dC   V'       d;   \        ;QJ d    R V 4       F  '       d   K   RM	  RM! R V 4       4      '       g   VP                  V R24       R F«  w  rFV P                  V4      pV'       g	   V'       dO   \        V\        4      '       d   \        P	                  V4      '       g   VP                  V RV R	V: R
24       Kt  V'       g   K~  \        V4      '       g   K‘  VP                  V RV R	V R24       K­  	  V P                  R4      p\        V\        4      '       dC   V'       d;   \        ;QJ d    R V 4       F  '       d   K   RM	  RM! R V 4       4      '       g   VP                  V R24       V P                  R4      ;'       g    / p	\        V	\        4      '       dW   \        ;QJ d*    R V	P                  4        4       F  '       d   K   RM	  RM! R V	P                  4        4       4      '       g   VP                  V R24       V# )r   ú.id: z- must be lowercase letters, digits and dashesÚ.r   c              3  ór   "  € T F-  p\        V\        4      ;'       d    VP                  4       x € K/  	  R # 5irR   )r:   r   Ústrip)rT   Úss   & r    rV   Ú"_entry_problems.<locals>.<genexpr>a   s+   é € Ð7iÑbhÐ]^¼
À1ÄcÓ8J×8XÐ8XÈqÏwÉwËyÔ8XÓbhùs   ‚7ž7FTz2.scopes: must be a non-empty list of scope stringsú: z1 must be an UPPER_SNAKE environment variable namez; is a variable Hermes uses itself; declare the plugin's ownr   c              3  ó|   "  € T F2  p\        V\        4      ;'       d    \        P                  V4      x € K4  	  R # 5irR   )r:   r   Ú_HOST_REÚmatch)rT   Úhs   & r    rV   rf   j   s/   é € Ð5nÑhmÐcd´jÀÄCÓ6H×6^Ð6^ÌXÏ^É^Ð\]ÓM^Ô6^Óhmùs   ‚<ž<zP.hosts: must list lowercase DNS host names (no scheme, port, path or IP address)r   c              3  óv   "  € T F/  w  r\        V\        4      ;'       d    \        V\        4      x € K1  	  R # 5irR   )r:   r   )rT   ÚkÚvs   &  r    rV   rf   m   s0   é € Ð,rÑcqÑ[_Ð[\¬Z¸¼3Ó-?×-VÐ-VÄJÈqÔRUÓDVÔ-VÓcqùs   ‚9 9z..authorize_params: must map strings to strings)r   r   ))r   T)r   F)Úgetr:   r   Ú_ID_RErj   rJ   ÚlistÚallÚappendÚ_ENV_REr\   r_   Úitems)
r^   rA   Úoauth_idÚproblemsÚfieldr   ÚrequiredrL   r   Úparamss
   &&        r    Ú_entry_problemsr{   Z   s!  € Ø�y‰y˜‹€HÜ ¬#×.Ò.´6·<±<À×3IÒ3I‰rØˆ'��u—y‘y “Ñ)Ð)VÐWðPY€Hã/ˆØ”M U G¨1¨U¨GÐ"4°e·i±iÀÓ6FÓGÕGŠñ 0à�Y‰Y�xÓ €FÜ�vœt×$Ò$¯·C³CÑ7iÑbhÓ7i·C·C²CÑ7iÑbhÓ7i×4iÒ4iØ�‰˜5˜'Ð!SÐTÔUÛR‰ˆØ�y‰y˜ÓˆßŸ¤z°$¼×'<Ò'<ÄÇÁÈt×ATÒATØ�O‰O˜u˜g Q u g¨R°©xÐ7hÐiÖjß‰TÔ'¨×-Ô-Ø�O‰O˜u˜g Q u g¨R°¨vÐ5pÐqÖrñ Sð �I‰I�gÓ€EÜ�uœd×#Ò#¯·#³#Ñ5nÑhmÓ5n·#·#²#Ñ5nÑhmÓ5n×2nÒ2nØ�‰˜5˜'Ð!qÐrÔsØ�Y‰YÐ)Ó*×0Ð0¨b€FÜ�vœt×$Ò$¯«Ñ,rÐci×coÑcoÔcqÓ,r¯¯ªÑ,rÐci×coÑcoÔcqÓ,r×)rÒ)rØ�‰˜5˜'Ð!OÐPÔQØ€Or#   c               ó    € V ^8„  d   QhRRRR/# )r   r^   r_   r   r   r   )r   s   "r    r!   r!   r   s   € ÷ Wñ W�4ð W˜Kñ Wr#   c                óD  € \        V R ,          V R,          V R,          \        V R,          4      V R,          \        V R,          4      V P                  R4      ;'       g    R\        \        V P                  R4      ;'       g    / P	                  4       4      4      R	7      # )
r   r   r   r   r   r   r   r   r   )r   r   r   r   r   r   r   r   )r   Útuplero   Úsortedru   )r^   s   &r    Ú_clientr€   r   s…   € ÜØ��; e¨OÕ&<ÈÈkÕHZÜ�U˜8•_Ó%°U¸?Õ5KÔSXÐY^Ð_fÕYgÓShØŸ)™)Ð$7Ó8×>Ð>¸BÜœv u§y¡yÐ1CÓ'D×'JÐ'JÈ×&QÑ&QÓ&SÓTÓUô	Wð Wr#   c               ó    € V ^8„  d   QhRRRR/# )r   ÚmanifestúMapping[str, Any]r   z#tuple[list[OAuthClient], list[str]]r   )r   s   "r    r!   r!   z   s   € ÷ ñ Ð"3ð Ð8[ñ r#   c                ó,  a€ T ;'       g    / P                  R4      pVe   V. 8X  d   . . 3# \        V\        4      '       g   . R.3# . p. p\        V4       F¹  w  poRV R2p\        S\        4      '       d   \        SV4      MV R2.pV'       gR   \        ;QJ d    V3R lV 4       F  '       g   K   RM	  RM! V3R lV 4       4      '       d   V R	SR
,          : R2.pW6,          pV'       d   KŸ  VP                  \        S4      4       K»  	  W#3# )z\``oauth:`` from a manifest dict: the well-formed clients, and one problem string per defect.Úoauthz'oauth: must be a list of client entrieszoauth[Ú]z: must be a mappingc              3  óN   <"  € T F  qP                   SR ,          8H  x € K  	  R# 5i)r   N©r   )rT   Úcr^   s   & €r    rV   Ú&parse_oauth_clients.<locals>.<genexpr>†   s   øé € Ð%KÁ7¸a§d¡d¨e°D­kÖ&9Ã7ùs   ƒ"%TFra   r   z is declared twice)	ro   r:   rq   Ú	enumerater_   r{   rZ   rs   r€   )r‚   ÚrawÚclientsrw   ÚindexrA   Úentry_problemsr^   s   &      @r    Úparse_oauth_clientsr�   z   sÿ   ø€ à�>ˆ>�r×
Ñ
˜wÓ
'€CØ
‚{�c˜R”iØ�2ˆvˆÜ�cœ4× Ò ØÐ=Ð>Ð>Ð>Ø!#€GØ€HÜ! #ž‰ˆˆuØ˜˜˜qÐ!ˆÜ:DÀUÌD×:QÒ:Qœ¨°Ô6Ð[`ÐZaÐatÐXuÐWvˆß§#£#Ô%KÁ7Ó%K§#§#¢#Ô%KÁ7Ó%K×"KÒ"KØ!&  u¨U°4­[©OÐ;MÐNÐOˆNØÕ"ˆß‰~Ø�N‰Nœ7 5›>Ö*ñ 'ð ÐÐr#   c               ó    € V ^8„  d   QhRRRR/# )r   Ú
plugin_dirr   r   zlist[OAuthClient]r   )r   s   "r    r!   r!   Ž   s   € ÷ ñ  $ð Ð+<ñ r#   c                óÎ   € ^ RI HpHp V! V 4      p\        V'       d	   V! V4      M/ 4      w  rEV'       d0   \	        RV P
                   R2RP                  V4      ,           4      hV# )zcThe plugin's own ``oauth:`` clients; a malformed block fails loud instead of reading as undeclared.)Únative_manifest_fileÚread_native_manifestúPlugin 'z.' has an invalid oauth: block in plugin.yaml: ú; )Úpm.plugin_declarationsr”   r•   r�   r<   rL   Újoin)r’   r”   r•   Úmanifest_filer�   rw   s   &     r    Ú_declared_clientsr›   Ž   s\   € çQá(¨Ó4€MÜ+×S`Ñ,@ÀÔ,OÐfhÓiÑ€GßÜ˜8 J§O¡OÐ#4Ð4bÐcÐfj×foÑfoÐpxÓfyÕyÓzÐzØ€Nr#   c               ó    € V ^8„  d   QhRRRR/# )r   r’   r   r   r   r   )r   s   "r    r!   r!   ™   s   € ÷ ñ ˜4ð  Cñ r#   c                ó  € ^ RI Hp V P                  4       V P                  4       3 FS  pV! 4        FE  pW#8w  g   K  VP	                  V4      '       g   K$  VP                  V4      P                  4       u u # 	  KU  	  V P                  # )zfThe plugin's key under the plugins root it lives in (``voice``, ``web/exa``); grants are stored by it.)Ú_plugin_roots)Ú#hermes_cli.plugin_provider_requestsrž   ÚabsoluteÚresolveÚis_relative_toÚrelative_toÚas_posixrL   )r’   rž   ÚpathÚroots   &   r    Ú
plugin_keyr§   ™   sm   € åAà×$Ñ$Ó&¨
×(:Ñ(:Ó(<Ó=ˆÙ!–OˆDØŽ| × 3Ñ 3°D× 9Ô 9Ø×'Ñ'¨Ó-×6Ñ6Ó8Ô8ó $ñ >ð �?‰?Ðr#   c               ó    € V ^8„  d   QhRRRR/# )r   Úclientr   r   r   r   )r   s   "r    r!   r!   ¤   s   € ÷ pñ p�{ð p sñ pr#   c                ó„   € R P                  \        P                  R V P                  V P                  3 4       4      4      # )ú, c              3  óL   "  € T F  p\        V4      P                  x € K  	  R # 5irR   )r   rE   )rT   r8   s   & r    rV   Ú_idp_hosts.<locals>.<genexpr>¥   s   é € Ð"nÑEm¸c¤8¨C£=×#9Ö#9ÓEmùs   ‚"$)r™   r_   Úfromkeysr   r   ©r©   s   &r    Ú
_idp_hostsr°   ¤   s2   € Ø�9‰9”T—]‘]Ñ"nÀf×FZÑFZÐ\b×\lÑ\lÑEmÓ"nÓnÓoÐor#   c               ó    € V ^8„  d   QhRRRR/# )r   r‚   rƒ   r   r   r   )r   s   "r    r!   r!   ¨   s   € ÷ 3ñ 3Ð,ð 3°ñ 3r#   c                ó¶   a€ \        T ;'       g    / P                  R4      ;'       g    R4      oRP                  V3R l\        V 4      ^ ,           4       4      # )zPInstall/show text for the declared clients; empty when the plugin declares none.rL   z<plugin>r—   c              3  ó´   <"  € T FM  pR VP                    R\        V4       RRP                  VP                  4       RS RVP                    R2x € KO  	  R# 5i)zSigns in to ú at z for r«   z with `hermes auth add Ú:zG` (Hermes stores and refreshes the token; the plugin never receives it)N)r   r°   r™   r   )rT   r‰   rL   s   & €r    rV   Úoauth_notice.<locals>.<genexpr>«   se   øé € ð 3ñ 2ˆAð �q—t‘t�f˜D¤¨A£ ¨u°T·Y±Y¸q¿w¹wÓ5GÐ4HÐH_Ð`dÐ_eÐefÐgh×gkÑgkÐflð mPõ 	Pã1ùs   ƒAA)r   ro   r™   r�   )r‚   rL   s   &@r    Úoauth_noticer·   ¨   sP   ø€ ä�—�˜B×#Ñ# FÓ+×9Ð9¨zÓ:€DØ�9‰9ô 3ô % XÓ.¨qÖ1ó3ó 3ð 3r#   c               ó    € V ^8„  d   QhRRRR/# ©r   r‚   rƒ   r   zset[str]r   )r   s   "r    r!   r!   ±   s   € ÷ ñ Ð-ð °(ñ r#   c                ó  € \        4       p\        V 4      ^ ,           Fe  pVP                  VP                   R\	        V4       RRP                  VP                  4       RRP                  VP                  4       R24       Kg  	  V# )zÕOne line per client for the re-pin consent delta: a new entry, or a changed authorize host, token host,
hosts or scopes, shows up as added. Any other change only alters the fingerprint, so the user signs in again.z (z -> r«   r—   Ú Ú))Úsetr�   Úaddr   r°   r™   r   r   )r‚   Úlinesr‰   s   &  r    Úoauth_surfacerÀ   ±   sq   € ô “e€EÜ  Ó*¨1×-Ð-ˆØ�	‰	�Q—T‘T�F˜"œZ¨›]˜O¨4°·	±	¸!¿'¹'Ó0BÐ/CÀ2ÀcÇhÁhÈqÏxÉxÓFXÐEYÐYZÐ[Ö\ñ .à€Lr#   c               ó    € V ^8„  d   QhRRRR/# r¹   r   )r   s   "r    r!   r!   º   s   € ÷ ñ Ð"3ð ¸ñ r#   c           
     óò   € \        4       pR Ff  pV P                  V4      ;'       g    .  FD  pTP                  \        \	        V\
        4      '       d   VP                  R4      MT4      4       KF  	  Kh  	  V# )Úrequires_envrL   )rÃ   Úoptional_env)r½   ro   r¾   r   r:   r_   )r‚   Únamesrx   r^   s   &   r    Ú_declared_env_namesrÆ   º   s`   € Ü“e€EÛ1ˆØ—\‘\ %Ó(×.Ð.¨BÒ.ˆEØ�I‰I”c¬z¸%Ä×/FÒ/F˜%Ÿ)™) FÔ+ÈEÓRÖSó /ñ 2ð €Lr#   c               ó$   € V ^8„  d   QhRRRRRR/# ©r   r‚   rƒ   r’   r   r   rB   r   )r   s   "r    r!   r!   Â   s"   € ÷ ñ Ð'8ð Àdð Èyñ r#   c           	     ó²  € ^ RI Hp \        V 4      w  r4\        V 4      pV Fˆ  pVP                  V9   d!   VP                  RVP                  : R24       \        RVP                  VP                  34       F.  pWu9  g   K  VP                  RVP                  : RV R24       K0  	  KŠ  	  V'       d#   VP                  R8X  d   VP                  R	4       V# )
zfCatalog admission on top of the shape: declared variables, no clash with core sign-ins or ``custom:``.)Ú
_PROVIDERSz	oauth id z. is a Hermes sign-in provider; pick another idNúoauth rg   z4 must be declared under requires_env or optional_envÚcustomzba plugin named 'custom' cannot declare oauth: `hermes auth add custom:<name>` is a custom provider)
rŸ   rÊ   r�   rÆ   r   rs   Úfilterr   r   rL   )r‚   r’   rÊ   r�   rw   Údeclaredr©   rL   s   &&      r    Úoauth_admission_problemsrÏ   Â   s·   € å>ä+¨HÓ5Ñ€GÜ" 8Ó,€HÛˆØ�9‰9˜
Ô"Ø�O‰O˜i¨¯	©	¡}Ð4bÐcÔdÜ˜4 &×"6Ñ"6¸×8PÑ8PÐ!QÖRˆDØÖ#Ø—‘ &¨¯©©°R¸°vÐ=qÐ rÖsó Sñ ÷ �:—?‘? hÔ.Ø�‰Ð|Ô}Ø€Or#   c               ó    € V ^8„  d   QhRRRR/# )r   Úhostr   r   r   )r   s   "r    r!   r!   Ó   s   € ÷ $ñ $�#ð $˜#ñ $r#   c                óÐ   € V P                  R4      p\        V4      ^8”  d1   \        VR,          4      ^8X  d   \        VR,          4      ^8:  d   ^M^pRP                  W) R 4      # )z`Registered domain, roughly: ``vendor.co.uk`` keeps three labels (no public-suffix list in core).rb   Néÿÿÿÿéþÿÿÿ)ÚsplitÚlenr™   )rÑ   ÚlabelsÚkeeps   &  r    Ú_parentrÙ   Ó   sU   € à�Z‰Z˜‹_€FÜ�F“˜a”¤C¨¨r­
£O°qÔ$8¼SÀÈÅ»_ÐPQÔ=Q‰1ÐWX€DØ�8‰8�F˜5˜6�NÓ#Ð#r#   c               ó$   € V ^8„  d   QhRRRRRR/# rÈ   r   )r   s   "r    r!   r!   Ú   s"   € ÷ ñ Ð'8ð Àdð Èyñ r#   c                óü  € \        V 4      ^ ,          pV UUUu. uF“  q3P                   F�  p\        V4      VP                  VP                  3 Uu0 uF+  p\        \        V4      P                  ;'       g    R4      kK-  	  up9  g   Ka  RVP                  : RV R\        V4       R2NKƒ  	  K•  	  pppp\        V Uu0 uF  q3P                  kK  	  up4      p\        VP                  R4      4       F\  p VP                  RRR	7      p	TT U
u. uF1  qªT	9   g   K  R
TP                  T4      P                  4        RT
 R2NK3  	  up
,          pK^  	  V# u upi u upppi u upi   \         d     K�  i ; iu up
i )z¦Reviewer warnings: a host outside the sign-in provider's domains (does the IdP own it?), and plugin
code that names a declared token URL (Hermes refreshes the grant).r   rË   z: host z shares no domain with z; check the provider owns itz*.pyz	utf-8-sigÚreplace)ÚencodingÚerrorszoauth: z names the token URL z>; Hermes refreshes the grant, so the plugin should not call it)r�   r   rÙ   r   r   r   rE   r   r°   r   ÚrglobÚ	read_textÚOSErrorr£   r¤   )r‚   r’   r�   r‰   rÑ   ÚuÚwarningsÚurlsr¥   Útextr8   s   &&         r    Úoauth_admission_warningsræ   Ú   s‘  € ô " (Ó+¨AÕ.€Gá õwÙ �A¯W¬W TÜ˜4“=ÐWX×WfÑWfÐhi×hsÑhsÑVtÓ(uÑVtÐQR¬´¸!³×1EÑ1E×1KÐ1KÈÖ)LÑVtÑ(uÑuô q�&˜Ÿ™™ ¨ vÐ-DÄZÐPQÃ]ÀOÐSoÓpÙ-4ñ qÙ ð ò wô ©Ó0© 1—;”;©Ñ0Ó1€DÜ�z×'Ñ'¨Ó/Ö0ˆð	Ø—>‘>¨;¸y�>ÓIˆDð 	ÙX\ómÙX\ÐQTÐgkÑ`kôM�w˜t×/Ñ/°
Ó;×DÑDÓFÐGÐG\Ð]`Ð\að bMó MÙX\ñmõ 	mŠñ 1ð €Oùò )vùôwùò 1øô ô 	Úð	üòmsG   ™7EÁ%EÁ6EÂEÂ
(EÂ?E"Ã8E'ÄE9Ä*E9ÅEÅ'E6Å5E6c               ó    € V ^8„  d   QhRRRR/# )r   Úkeyr   r   úOptional[dict]r   )r   s   "r    r!   r!   î   s   € ÷ 8ñ 8�Sð 8˜^ñ 8r#   c                óÚ   € ^ RI Hp V! 4       P                  \        4      p\	        V\
        4      '       d   VP                  V 4      MRp\	        V\
        4      '       d   \        V4      # R# )é    )Ú_load_auth_storeN)rX   rì   ro   Ú_SECTIONr:   r_   )rè   rì   ÚsectionÚrows   &   r    Ú_read_grantrð   î   sO   € Ý0áÓ ×$Ñ$¤XÓ.€GÜ(¨´$×7Ò7ˆ'�+‰+�cÔ
¸T€CÜ" 3¬×-Ò-Œ4�‹9Ð7°4Ð7r#   c               ó    € V ^8„  d   QhRRRR/# )r   Úpluginr   r   ÚNoner   )r   s   "r    r!   r!   ö   s   € ÷ $ñ $ ð $¨ñ $r#   c           	     óš  € ^ RI HpHpHp V! 4       ;_uu_ 4        V! 4       pVP	                  \
        4      p\        V\        4      '       d2   V Uu. uF$  qfP                  R^4      ^ ,          V 8X  g   K"  VNK&  	  upM. pV'       d#   V F  pVP                  V4       K  	  V! V4       RRR4       R# u upi   + '       g   i     R# ; i)z\Drop every grant of plugin key *plugin* from the active profile (``hermes plugins remove``).)Ú_auth_store_lockrì   Ú_save_auth_storerµ   N)
rX   rõ   rì   rö   ro   rí   r:   r_   ÚrsplitÚpop)	rò   rõ   rì   rö   Ústorerî   rm   Ústalerè   s	   &        r    Úforget_plugin_grantsrû   ö   sž   € çTÑTá	×	Õ	Ù Ó"ˆØ—)‘)œHÓ%ˆÜISÐT[Ô]a×IbÒIb™GÓE™G�q§x¡x°°QÓ'7¸Õ':¸fÑ'D—�™GÒEÐhjˆßÛ�Ø—‘˜CÖ ñ á˜UÔ#÷ 
Ñ	ùò F÷ 
×	Ð	ús)   š7B9ÁB4Á5B4Á;B9Â"B9Â4B9Â9C
	c               ó$   € V ^8„  d   QhRRRRRR/# )r   rè   r   rï   ré   r   ró   r   )r   s   "r    r!   r!     s!   € ÷  ñ  �cð   ð  °4ñ  r#   c                óä   € ^ RI HpHpHpHp V! 4       ;_uu_ 4        V! 4       pV! V\
        4      pVf   VP                  V R4       MWV &   V! V4       RRR4       R#   + '       g   i     R# ; i)zcReplace one grant (``None`` removes it) under the auth-store lock; other sections stay as they are.)rõ   rì   rö   Ú_store_sectionN)rX   rõ   rì   rö   rþ   rí   rø   )rè   rï   rõ   rì   rö   rþ   rù   rî   s   &&      r    Ú_write_grantrÿ     sV   € çdÓdá	×	Õ	Ù Ó"ˆÙ  ¬Ó1ˆØŠ;Ø�K‰K˜˜TÕ"à�C‰LÙ˜Ô÷ 
×	×	Ò	ús   œ8AÁA/	c               ó$   € V ^8„  d   QhRRRRRR/# )r   rè   r   ÚmessageÚcoder   )r   s   "r    r!   r!     s&   € ÷ Cñ C�Sð C 3ð C¨cñ Cr#   c                ó,   € ^ RI Hp V! V  RV 2WR7      # )rë   ©Ú	AuthErrorrg   )Úproviderr  )Úhermes_cli.auth_constantsr  )rè   r  r  r  s   &&& r    Ú_auth_errorr    s   € Ý3á˜�u˜B˜w˜iÐ(°3ÔBÐBr#   c               ó(   € V ^8„  d   QhRRRRRRRR/# )r   rL   r   r  rè   r   r   )r   s   "r    r!   r!     s(   € ÷ ñ ˆsð ˜#ð  Cð ¨Cñ r#   c                ó’   € ^ RI Hp \        V! V 4      ;'       g    R4      P                  4       pV'       g   \	        W  R2V4      hV# )rë   )Ú
get_secretr   zD is not set. Add it to this profile's .env (the plugin declares it).)Úagent.secret_scoper  r   rd   r  )rL   r  rè   r  Úvalues   &&&  r    Ú_envr    sC   € Ý-ä‘
˜4Ó ×&Ð& BÓ'×-Ñ-Ó/€EßÜ˜# Ð'kÐlÐnrÓsÐsØ€Lr#   c               ó    € V ^8„  d   QhRRRR/# )r   Úresponser   r   r_   r   )r   s   "r    r!   r!   #  s   € ÷ 8ñ 8˜3ð 8 4ñ 8r#   c                ó~   €  V P                  4       p\        T\        4      '       d   T# / #   \         d    / u # i ; irR   )r(   r<   r:   r_   )r  Úpayloads   & r    Ú_json_objectr  #  sA   € ðØ—-‘-“/ˆô ! ¬$×/Ò/ˆ7Ð7°RÐ7øô ô ØŠ	ðús   ‚, ¬<»<c               ó$   € V ^8„  d   QhRRRRRR/# )r   rè   r   ÚstatusÚintr  rƒ   r   )r   s   "r    r!   r!   +  s'   € ÷ fñ f�cð f 3ð fÐ1Bñ fr#   c                óÞ   € ^ RI Hp \        VP                  R4      ;'       g    R4      P	                  4       pWC9   g   V\
        9   d   \        V RV RV R2V4      # \        V RV R2R	4      # )
zPKeep the OAuth ``error`` code a caller can act on; never echo the response body.©Ú_OAUTH_GRANT_DEAD_CODESÚerrorr   z-the token endpoint refused the request (HTTP r«   ú).z$the token endpoint failed with HTTP rb   Úoauth_refresh_failed)rX   r  r   ro   rd   Ú_CLIENT_ERROR_CODESr  )rè   r  r  r  r  s   &&&  r    Ú_token_errorr  +  sv   € å7ä�—‘˜GÓ$×*Ð*¨Ó+×1Ñ1Ó3€EØÔ'¨5Ô4GÔ+GÜ˜3Ð"OÐPVÈxÐWYÐZ_ÐY`Ð`bÐ cÐejÓkÐkÜ�sÐBÀ6À(È!ÐLÐNdÓeÐer#   c               ó(   € V ^8„  d   QhRRRRRRRR/# )	r   r©   r   r  rƒ   rè   r   r   ró   r   )r   s   "r    r!   r!   5  s1   € ÷ Kñ K Kð KÐ:Kð KÐRUð KÐZ^ñ Kr#   c                óF  € VP                  R 4      p\        V\        4      '       d   VP                  4       '       g   R# V P                   Uu. uF  qDVP                  4       9  g   K  VNK  	  ppV'       d$   \        VRRP                  V4      ,           R4      hR# u upi )ÚscopeNzAnot every permission was granted, so nothing was saved. Missing: r«   Úoauth_scope_not_granted)ro   r:   r   rd   r   rÕ   r  r™   )r©   r  rè   Úgrantedr!  Úmissings   &&&   r    Ú_require_granted_scopesr%  5  s…   € Ø�k‰k˜'Ó"€GÜ�gœs×#Ò#¨7¯=©=¯?ª?ÙØ"(§-¢-ÓP¡-˜ÀÇÁÃÑ3O�uˆu¡-€GÐPßÜ˜#ÐbØ ŸI™I gÓ.õ /Ø0IóKð 	Kñ ùò Qs   ÁBÁ)Bc               ó$   € V ^8„  d   QhRRRRRR/# )r   r©   r   rè   r   r   z-Callable[[dict[str, str]], Mapping[str, Any]]r   )r   s   "r    r!   r!   ?  s"   € ÷ ñ ˜;ð ¨Sð Ð5bñ r#   c                ó   a a€ R V V3R llpV# )z£``OAuthPKCEConfig.token_request``: the client credentials are read right before each POST, so the
secret never sits in the frozen config, whose repr would show it.c               ó    € V ^8„  d   QhRRRR/# )r   Úfieldszdict[str, str]r   rƒ   r   )r   s   "r    r!   Ú$_token_request.<locals>.__annotate__C  s   € ÷ ñ �^ð Ð(9ñ r#   c           	     óh  <€ ^ RI Hp ^ RIHp / V CR\	        SP
                  RS	4      /CpSP                  '       d   \	        SP                  RS	4      VR&   Rp VP                  SP                  VRR	/\        V! 4       R
R7      pV'       d   \        S	RV R2R4      h\        X4      p^ÈVP                  u;8:  d   R8  g   M \!        S	VP                  V4      hV P#                  R4      R8X  d   \%        SVS	4       V#   TP                   d    p\        T4      P                  p Rp?L¦Rp?ii ; i)rë   )Ú_default_verify)ÚhttpxÚ	client_idÚoauth_client_id_missingÚoauth_client_secret_missingÚclient_secretr   ÚAcceptzapplication/jsonF)ÚdataÚheadersÚtimeoutÚverifyÚfollow_redirectsNzthe token request failed (r  r  i,  Ú
grant_typeÚauthorization_code)rX   r,  r  r-  r  r   r   Úpostr   Ú_TOKEN_TIMEOUTÚ	HTTPErrorÚtyper/   r  r  Ústatus_coder  ro   r%  )
r)  r,  r-  ÚformÚfailurer  Úexcr  r©   rè   s
   &       €€r    r:  Ú_token_request.<locals>.postC  s&  ø€ Ý3Ý3àb�&Ðb˜+¤t¨F×,@Ñ,@ÐB[Ð]`Ó'aÑbˆØ×#×#Ð#Ü$(¨×)AÑ)AÐC`ÐbeÓ$fˆD�Ñ!Øˆð	)Ø—z‘z &×"2Ñ"2¸ÈÐRdÐGeÜ*8ÁÓARÐejð "ó lˆH÷ Ü˜cÐ%?À¸yÈÐ#KÐMcÓdÐdÜ˜xÓ(ˆØ�h×*Ñ*Ö0¨SÖ0Ü˜s H×$8Ñ$8¸'ÓBÐBØ�:‰:�lÓ#Ð';Ô;Ü# F¨G°SÔ9Øˆøð �‰ô 	)Ü˜3“i×(Ñ(�Gûð	)ús   Á,D ÄD1ÄD,Ä,D1r   )r©   rè   r:  s   ff r    Ú_token_requestrC  ?  s   ù€ ÷ñ ð, €Kr#   r5  c               ó$   € V ^8„  d   QhRRRRRR/# )r   r©   r   rè   r   r5  zOptional[float]r   )r   s   "r    r!   r!   \  s&   € ÷ `ñ `˜ð `¨3ð `¸Oñ `r#   c               óà   € ^ RI Hp T! \        V P                  RV4      V P                  V P
                  V P                  \        V P                  4      T\        W4      T;'       g    RR7      # )rë   )ÚOAuthPKCEConfigr/  g     €f@)r.  r   r   r   Úextra_authorize_paramsÚlabelÚtoken_requestÚtimeout_seconds)
Ú!hermes_cli.auth_oauth_pkce_pluginrF  r  r   r   r   r   r_   r   rC  )r©   rè   r5  rF  s   &&$ r    Ú_pkce_configrL  \  sc   € ÝAáÜ�v×+Ñ+Ð-FÈÓLÐ\b×\pÑ\pØ×"Ñ"¨6¯=©=ÔQUÐV\×VmÑVmÓQnØ¤°Ó!<Èg×N^ÐN^ÐY^ô`ð `r#   c               ó   € V ^8„  d   QhRR/# )r   r  r   r   )r   s   "r    r!   r!   g  s   € ÷ (ñ (˜Cñ (r#   c                ó   € ^ RI Hp V! V 4      # )rë   ©ÚProviderNotSignedIn)rŸ   rP  )r  rP  s   & r    Ú_not_signed_inrQ  g  s   € ÝGá˜wÓ'Ð'r#   c               ó$   € V ^8„  d   QhRRRRRR/# )r   r©   r   rè   r   r  r   )r   s   "r    r!   r!   m  s&   € ÷ Lñ L�[ð L sð L°#ñ Lr#   c                ót   € \        R V P                   RVP                  R^4      ^ ,           RV RV R2	4      # )zThe z sign-in for plugin 'rµ   z' was revoked (z). Run `hermes auth add ú` to sign in again.)rQ  r   r÷   )r©   rè   r  s   &&&r    Ú_revokedrU  m  sR   € Ü˜D §¡ Ð+@ÀÇÁÈCÐQRÓASÐTUÕAVÐ@WÐWfÐgkÐflð m2Ø25°Ð6IðKó Lð Lr#   c               ó(   € V ^8„  d   QhRRRRRRRR/# )	r   rï   ré   r©   r   rè   r   r   r_   r   )r   s   "r    r!   r!   r  s(   € ÷ 
ñ 
�~ð 
¨{ð 
Àð 
Èñ 
r#   c           	     ób  € VP                  R ^4      ^ ,          pV f    \        RVP                   RV RV R24      hV P                  R4      '       d   \	        W\        V R,          4      4      hV P                  R4      VP                  8w  d    \        RV RVP                   R	V R
24      hV # )rµ   zNot signed in to ú for plugin 'z/' in this Hermes profile. Run `hermes auth add z`.Údeadr-   r–   z' changed its oauth entry 'z,' since you signed in. Run `hermes auth add rT  )r÷   rQ  r   ro   rU  r   r-   )rï   r©   rè   rò   s   &&& r    Ú_usable_grantrZ  r  s¿   € Ø�Z‰Z˜˜QÓ Õ"€FØ
‚{ÜÐ0°·±°¸=ÈÈð Q5Ø58°E¸ð=ó >ð 	>à
‡w�wˆv‡‚Ü�v¤C¨¨F­Ó$4Ó5Ð5Ø
‡w�wˆ}Ó ×!3Ñ!3Ô3Ü˜x¨ xÐ/JÈ6Ï9É9È+ð V5Ø58°EÐ9LðNó Oð 	Oà€Jr#   c               ó    € V ^8„  d   QhRRRR/# )r   rï   rƒ   r   r   r   )r   s   "r    r!   r!     s   € ÷ +ñ +Ð&ð +¨3ñ +r#   c                ó$  € \        V P                  R 4      ;'       g    R4      pV P                  R4      pVRJ ;'       g=    \        V4      \        \        P                  ! 4       R,          4      \        ,           8„  pV'       d   V'       d   V# R# )Úaccess_tokenr   Úexpires_at_msNéè  )r   ro   r  ÚtimeÚ_EXPIRY_MARGIN_MS)rï   ÚtokenÚexpiresÚlives   &   r    Ú_live_tokenre    sj   € Ü�—‘˜Ó'×-Ð-¨2Ó.€EØ�g‰g�oÓ&€GØ�dˆ?×XÐXœc '›l¬S´·²³¸tÕ1CÓ-DÔGXÕ-XÑX€DßŸdˆ5Ð*¨Ð*r#   c               ó(   € V ^8„  d   QhRRRRRRRR/# )r   r©   r   rè   r   rï   r_   r   r   )r   s   "r    r!   r!   †  s(   € ÷ 'ñ '�[ð ' sð '°ð '¸#ñ 'r#   c           
     óâ  € ^ RI Hp ^ RIHp ^ RIHp \        VP                  R4      ;'       g    R4      pV'       g   \        WR4      h V! V\        W4      RRRV/RR	7      p\        T/ TCTC4       \        TR,          4      #   T da   pTP                  T9   dJ   \        TR
TP                  RTP                  R4      /4       \        Y\        TP                  4      4      Rhh Rp?ii ; i)z±Rotate the grant; the caller holds the auth-store lock, so a peer process waits instead of spending
the same refresh token, and a logout cannot be undone by a refresh in flight.r  r  )Ú_post_tokenÚrefresh_tokenr   Úno_refresh_tokenr8  r  )r  rY  r-   Nr]  )rX   r  r  r  rK  rh  r   ro   rU  rL  r  rÿ   )	r©   rè   rï   r  r  rh  ri  r)  rA  s	   &&&      r    Ú_refreshrk  †  sá   € õ 8Ý3Ý=ä˜Ÿ™ Ó0×6Ð6°BÓ7€MßÜ�vÐ$6Ó7Ð7ðÙ˜S¤,¨vÓ";Ø*¨O¸_ÈmÐ\Ðcyô{ˆô �Ð'˜Ð' Ð'Ô(Üˆv�nÕ%Ó&Ð&øð ô Ø�8‰8Ð.Ô.Ü˜˜v s§x¡x°ÀÇÁÈÓ@VÐWÔXÜ˜6¬¨C¯H©H«Ó6¸DÐ@Øûð	ús   ÁB ÂC.ÂAC)Ã)C.c               ó$   € V ^8„  d   QhRRRRRR/# )r   r’   r   r©   r   r   r   r   )r   s   "r    r!   r!   œ  s!   € ÷ >ñ >˜ð > kð >°cñ >r#   c                óV  € ^ RI Hp \        V 4       RVP                   2p\	        \        \        V4      W4      4      pV'       d   V# V! 4       ;_uu_ 4        \        \        V4      W4      p\	        V4      ;'       g    \        WV4      uuRRR4       #   + '       g   i     R# ; i)z®A live access token for the plugin's grant. Reading takes no lock (writes are atomic); a refresh
re-reads under the lock, because a peer may have rotated the grant meanwhile.©rõ   rµ   N)rX   rõ   r§   r   re  rZ  rð   rk  )r’   r©   rõ   rè   rb  rï   s   &&    r    Ú_bearerro  œ  s   € õ 1ä˜
Ó#Ð$ A f§i¡i [Ð
1€CÜœ¤k°#Ó&6¸ÓDÓE€EßØˆÙ	×	Õ	ÜœK¨Ó,¨fÓ:ˆÜ˜3Ó×=Ð=¤8¨F¸Ó#=÷ 
×	×	Ó	ús   Á4BÂB(	c               ó    € V ^8„  d   QhRRRR/# )r   r’   r   r  r   r   )r   s   "r    r!   r!   ª  s   € ÷ %ñ % 4ð %°3ñ %r#   c                ó€   a aa€ \        V3R l\        S 4       4       R4      oSf   R# R VV 3R llp\        S4      V3# )a)  ``(origins, resolver)`` for *provider* when the calling plugin declares it under ``oauth:``, else None.

Core-only, like the ``_PROVIDERS`` resolvers: the resolver returns the bearer, so plugins go through
``credentialed_provider_request``, which attributes the caller and checks the origin first.c              3  óL   <"  € T F  qP                   S8X  g   K  Vx € K  	  R # 5irR   rˆ   )rT   r‰   r  s   & €r    rV   Ú%_plugin_oauth_spec.<locals>.<genexpr>¯  ó   øé € ÐPÑ;˜¿t¹tÀxÑ?O—1’1Ó;ùó   ƒ$š
$Nc               ó    € V ^8„  d   QhRRRR/# )r   r8   r   r   ztuple[dict[str, str], str]r   )r   s   "r    r!   Ú(_plugin_oauth_spec.<locals>.__annotate__³  s   € ÷ Oñ O�Sð OÐ7ñ Or#   c                óª   <€ \        V 4      pVP                  f   VP                  e   \        RSP                   R24      hRR\        SS4       2/V 3# )NzRefusing to send the z  sign-in to a URL with user infoÚAuthorizationzBearer )r   rF   rG   ÚPermissionErrorr   ro  )r8   r=   r©   r’   s   & €€r    r¡   Ú#_plugin_oauth_spec.<locals>.resolve³  sX   ø€ Ü˜#“ˆØ�?‰?Ò&¨&¯/©/Ò*EÜ!Ð$9¸&¿)¹)¸ÐDdÐ"eÓfÐfà 7¬7°:¸vÓ+FÐ*GÐ!HÐIÈ3ÐNÐNr#   )Únextr›   Ú_origins)r’   r  r¡   r©   s   ff @r    Ú_plugin_oauth_specr~  ª  sD   ú€ ô
 ÔPÔ/°
Ô;ÓPÐRVÓW€FØ‚~Ù÷Oñ Oô �FÓ˜WÐ$Ð$r#   c               ó    € V ^8„  d   QhRRRR/# )r   r©   r   r   Ú	frozensetr   )r   s   "r    r!   r!   ½  s   € ÷ Dñ D�[ð D Yñ Dr#   c                ó:   € \        R V P                   4       4      # )zLOrigins the bearer may go to: each declared host, HTTPS on the default port.c              3  ó,   "  € T F
  pR VR3x € K  	  R# 5i)rD   i»  Nr   )rT   rÑ   s   & r    rV   Ú_origins.<locals>.<genexpr>¿  s   é € ÐC±l¨d�g˜t SÕ)³lùs   ‚)r€  r   r¯   s   &r    r}  r}  ½  s   € äÑC°f·l²lÓCÓCÐCr#   c               ó$   € V ^8„  d   QhRRRRRR/# )r   rò   r   rv   r   z"Optional[tuple[Path, OAuthClient]]r   )r   s   "r    r!   r!   Ä  s'   € ÷ 	@ñ 	@˜cð 	@¨Sð 	@Ð5Wñ 	@r#   c                óÐ   a€ ^ RI Hp V! V 4      pVe   V^,          '       g   R# \        \        V^,          4      4      p\	        V3R l\        V4       4       R4      pVe   WE3# R# )z\Resolve *plugin* the way ``hermes plugins show`` does, then its ``oauth:`` entry *oauth_id*.©Ú_find_plugin_entryNc              3  óL   <"  € T F  qP                   S8X  g   K  Vx € K  	  R # 5irR   rˆ   )rT   r‰   rv   s   & €r    rV   Ú$_installed_client.<locals>.<genexpr>Ì  rt  ru  )Úhermes_cli.plugins_cmdr‡  r   r   r|  r›   )rò   rv   r‡  r^   r’   r©   s   &f    r    Ú_installed_clientr‹  Ä  s^   ø€ å9á˜vÓ&€EØ‚}˜E !ŸHœHÙÜ”c˜% �(“mÓ$€JÜÔPÔ/°
Ô;ÓPÐRVÓW€FØ#)Ò#5ˆJÐÐ?¸4Ð?r#   c               ó   € V ^8„  d   QhRR/# )r   r   rM   r   )r   s   "r    r!   r!   Ð  s   € ÷ Cñ C�Tñ Cr#   c                 ó>   € ^ RI Hp Hp V! 4       ;'       g    V ! 4       # )rë   ©Ú_is_gateway_approval_contextÚ_no_user_can_answer)Útools.approval_contextr�  r�  rŽ  s     r    Ú_unattendedr’  Ð  s   € ßXáÓ ×BÐBÑ$@Ó$BÐBr#   c               ó(   € V ^8„  d   QhRRRRRRRR/# ©	r   Úargsr   r©   r   rè   r   r   rM   r   )r   s   "r    r!   r!   Ö  s(   € ÷ ñ �3ð  ð °#ð ¸$ñ r#   c                óê  € ^ RI Hp ^ RIHp \	        4       '       d   \        RV R24      hVP                  '       d   RMRp\        RVP                  R^4      ^ ,           R	VP                   R
\        VP                  4      P                   RV R\        VP                  4      P                   RRP                  VP                  4       R24        V! V\!        W\#        V RR4      R7      \#        V RR4      '       * R7      p\%        T/ TCRTP&                  /C4       \        RTP                   RTP                  R^4      ^ ,           R24       R#   T d   p\        RT 24      RhRp?ii ; i)rë   r  )Úloginz`hermes auth add zm` signs you in through a browser; run it in your own terminal, not from a gateway, cron job or agent session.z and the client secretr   r–   rµ   z' signs in to r´   z. The sign-in codez go to z; the token is sent only to r«   rb   r5  N)r5  Ú
no_browserF)Úopen_browserzLogin failed: r-   zSigned in to rX  z.'; the grant is stored in this Hermes profile.T)r  r  rK  r—  r’  Ú
SystemExitr   Úprintr÷   r   r   r   rE   r   r™   r   rL  Úgetattrrÿ   r-   )r•  r©   rè   r  r—  Úsecretr)  rA  s   &&&     r    Ú_cli_addrž  Ö  so  € Ý3Ý7ä‡}‚}ÜÐ,¨S¨Eð 2Jð Jó Kð 	Kà)/×)A×)AÐ)AÑ%Àr€FÜ	ˆH�S—Z‘Z  QÓ'¨Õ*Ð+¨>¸&¿)¹)¸ÀDÌÐRX×RfÑRfÓIg×IpÑIpÐHqð rØ#˜H G¬H°V×5EÑ5EÓ,F×,OÑ,OÐ+PÐPlØ�Y‰Y�v—|‘|Ó$Ð% Qð(ô )ð;Ù�sœL¨¼gÀdÈIÐW[Ó>\Ô]Ü(/°°lÀEÓ(JÔ$JôLˆô �ÐC˜ÐC °×0BÑ0BÑCÔDÜ	ˆM˜&Ÿ)™)˜ M°#·*±*¸SÀ!Ó2DÀQÕ2GÐ1HÐHvÐ
wÔxÙøð	 ô ;Ü˜>¨#¨Ð/Ó0°dÐ:ûð;ús   Ã1E ÅE2ÅE-Å-E2c               ó(   € V ^8„  d   QhRRRRRRRR/# r”  r   )r   s   "r    r!   r!   ë  s(   € ÷ ñ �cð  ;ð °Sð ¸Tñ r#   c           	     óö  € ^ RI Hp \        V4      p \        WAV4       T'       d   TP	                  R
4      MRp\        T RRP                  TP                  4       2T'       d?   R\        P                  ! \        T4      R,          \        4      P                  RR7       2MR,           4       R	#   T d@   pTf   RMTP	                  R4      '       d   RMRp\        T RT RT 24        Rp?R	# Rp?ii ; i)rë   rO  Nz
logged outrY  Úrevokedzsign-in neededrg   z
  Tr^  z: logged in
  hosts: r«   z
  access token valid until r_  Úseconds)Útimespecr   )rŸ   rP  rð   rZ  ro   r›  r™   r   r   Úfromtimestampr  r   Ú	isoformat)r•  r©   rè   rP  rï   rA  Ústaterc  s   &&&     r    Ú_cli_statusr§  ë  sá   € ÝGä
�cÓ
€CðÜ�c 3Ô'÷
 +.ˆc�g‰g�oÔ&°4€GÜ	ˆSˆEÐ'¨¯	©	°&·,±,Ó(?Ð'@Ð
Açð (¬×(>Ò(>¼sÀ7»|ÈdÕ?RÔTWÓ(X×(bÑ(bÐluÐ(bÓ(vÐ'wÑxØõô ñ øð ô Ø #¢‘¸c¿g¹gÀf¿oºo±ÐScˆÜ���R˜�w˜d 3 %Ð(Ô)Ýûðús   “B2 Â2C8Â9C3ÃC3Ã3C8c               ó(   € V ^8„  d   QhRRRRRRRR/# r”  r   )r   s   "r    r!   r!   ü  s(   € ÷ ñ �sð  Kð °cð ¸dñ r#   c                ó  € ^ RI Hp ^ RIHp ^ RIHp  V! 4       ;_uu_ 4        \        W\        \        V4      W4      4       RRR4       \        T R24       R#   + '       g   i     L ; i  YE3 d   p\        RT 24      RhRp?ii ; i)rë   rn  r  rO  NzRefresh failed: z: refreshedT)rX   rõ   r  r  rŸ   rP  rk  rZ  rð   rš  r›  )r•  r©   rè   rõ   r  rP  rA  s   &&&    r    Ú_cli_refreshrª  ü  sx   € Ý0Ý3ÝGð=Ù×ÕÜ�V¤-´¸CÓ0@À&Ó"NÔO÷  ô 
ˆSˆE�Ð
ÔÙ÷  ×ûàÐ+ô =ÜÐ+¨C¨5Ð1Ó2¸Ð<ûð=ús4   ”A. £ AÁA. ÁA+	Á&A. Á+A. Á.B
Á6BÂB
c               ó(   € V ^8„  d   QhRRRRRRRR/# r”  r   )r   s   "r    r!   r!   
  s(   € ÷ ñ �cð  ;ð °Sð ¸Tñ r#   c           	     ó„   € \        VR 4       \        RVP                   RVP                  R^4      ^ ,           R24       R# )NúSigned out of rX  rµ   z+'; the grant was removed from this profile.T)rÿ   r›  r   r÷   )r•  r©   rè   s   &&&r    Ú_cli_logoutr®  
  s<   € Ü��dÔÜ	ˆN˜6Ÿ9™9˜+ ]°3·:±:¸cÀ1Ó3EÀaÕ3HÐ2IÐItÐ
uÔvÙr#   c               ó$   € V ^8„  d   QhRRRRRR/# )r   rò   r   rv   r   zOptional[str]r   )r   s   "r    r!   r!     s&   € ÷ iñ i˜ð i sð i¨}ñ ir#   c                óÔ   € ^ RI Hp V! V 4      pVe:   V^,          '       d+   \        \        \	        V^,          4      4      4       RV 2.M. p\        R . VOV  RV 2N 4       R4      # )z^The stored grant key ``hermes auth logout <plugin>:<id>`` means, without parsing the manifest.r†  Nrµ   c              3  óD   "  € T F  p\        V4      f   K  Vx € K  	  R # 5irR   )rð   )rT   rè   s   & r    rV   Ú_logout_key.<locals>.<genexpr>  s   é € ÐaÑ @˜ÄKÐPSÓDT—’Ó @ùs   ‚ –
 )rŠ  r‡  r§   r   r   r|  )rò   rv   r‡  r^   rÅ   s   &&   r    Ú_logout_keyr³    ss   € å9á˜vÓ&€EØAFÒARÐW\Ð]^×W_ÔW_”
œ4¤ E¨!¥H£Ó.Ó/Ð0°°(°Ð<Ñ=Ðeg€EÜÑaÐ @ %Ð @¨F¨8°1°X°JÐ)?Ñ @ÓaÐcgÓhÐhr#   r¾   r  ÚrefreshÚlogoutc               ó(   € V ^8„  d   QhRRRRRRRR/# )r   Úactionr   r•  r   r  r   zOptional[bool]r   )r   s   "r    r!   r!     s.   € ÷ Jñ J˜sð J¨#ð J¸ð JÀñ Jr#   c                óè  € \        T;'       g    R4      P                  R4      w  r4p\        P                  V 4      pVe    V'       d   V'       d   V'       d   VR8X  d   R# V R8X  d-   \	        W54      ;pe   \        VR4       \        RV R24       R#  \        W54      pTf   R# Tw  r«T! Y\        T
4       RTP                   24      #   \         d   p	\        \        T	4      4      RhRp	?	ii ; i)	z¤``hermes auth add|status|refresh|logout <plugin>:<id>``; None when *provider* is not a plugin's
``oauth:`` entry (``custom:<name>`` stays the custom-provider pool).r   rµ   NrÌ   rµ  r­  z*; the grant was removed from this profile.T)r   Ú	partitionÚ_CLI_ACTIONSro   r³  rÿ   r›  r‹  r<   rš  r§   r   )r·  r•  r  rò   Úseprv   Úhandlerrè   ÚfoundrA  r’   r©   s   &&&         r    Úhandle_auth_actionr¾    så   € ô   § ¨BÓ/×9Ñ9¸#Ó>Ñ€F�Ü×Ñ˜vÓ&€GØ‚Ÿs§v·(¸vÈÔ?QÙØ�Ô¤k°&Ó&CÐC˜sÒPÜ�S˜$ÔÜ�˜s˜eÐ#MÐNÔOÙð-Ü! &Ó3ˆð ‚}ÙØÑ€JÙ�4¤J¨zÓ$:Ð#;¸1¸V¿Y¹Y¸KÐ!HÓIÐIøô ô -Üœ˜S›Ó"¨Ð,ûð-ús   ÂC ÃC1ÃC,Ã,C1>   Úinvalid_scopeÚinvalid_clientÚunauthorized_client)	r   rû   r¾  rÏ   ræ   r·   rÀ   r�   r§   )Jr3   Ú
__future__r   r&   r(   Úrer`  Údataclassesr   r   r   r   Úpathlibr   Útypingr   r	   r
   r   Úurllib.parser   rí   ra  r;  r€  r  Úcompilerp   rt   ri   r   r?   rJ   r\   r{   r€   r�   r›   r§   r°   r·   rÀ   rÆ   rÏ   rÙ   ræ   rð   rû   rÿ   r  r  r  r  r%  rC  rL  rQ  rU  rZ  re  rk  ro  r~  r}  r‹  r’  rž  r§  rª  r®  r³  rº  r¾  Ú__all__r   r#   r    Ú<module>rÊ     sš  ðñõ #ã Û Û 	Û ß )ß "Ý ß 3Ó 3Ý !à€ØÐ Ø€ÙÒ ZÓ[Ð Ø	�ŠÐ+Ó	,€Ø
�*Š*Ð)Ó
*€à�:Š:Ð]Ó^€ñ �$Ô÷dð dó ðdõ(	õõoõõ0Wõõ(õõpõ3õõõõ"$õõ(8õ$õ õ Cõõ8õfõKõð:`Èd÷ `õ(õLõ

õ+õ'õ,>õ%õ&Dõ	@õCõõ*õ"õõið �x ¨;¸	À<ÐQYÐ[fÐg€õJò*‚r#   