+ Wjt4a0t$Rt^RIHt^RIt^RIt^RIt^RIt^RI t ^RI t ^RI H t ^RI Ht]P!]4t] P$!4tRtRtRt^t]!0Rm4tR]R&!R R ]P64tR R ltR RltRRltRRlt R#)a2Audit log for dashboard-auth events: ``$HERMES_HOME/logs/dashboard-auth.log``, one JSON object per line. Token-like fields are stripped before serialisation so refresh tokens / JWTs never reach disk. Minimal import surface (no ``hermes_constants`` at import time) so early-loading middleware can import it.) annotationsN)Path)Anyz...[truncated] frozenset_REDACTED_FIELDSc^]tRt^$tRtRtRtRtRtRt Rt Rt R t R t R tR tR tRtRtRtRtRtRtR#) AuditEventzEEvent types; values are the literal ``event`` field on the JSON line. login_start login_success login_failurelogoutrefresh_successrefresh_failurerevokesession_verify_failuresession_rejectedws_ticket_mintedws_ticket_rejectedtoken_auth_successtoken_auth_failurenative_authorize_startnative_code_issuednative_token_successnative_token_failureN)__name__ __module__ __qualname____firstlineno____doc__ LOGIN_START LOGIN_SUCCESS LOGIN_FAILURELOGOUTREFRESH_SUCCESSREFRESH_FAILUREREVOKESESSION_VERIFY_FAILURESESSION_REJECTEDWS_TICKET_MINTEDWS_TICKET_REJECTEDTOKEN_AUTH_SUCCESSTOKEN_AUTH_FAILURENATIVE_AUTHORIZE_STARTNATIVE_CODE_ISSUEDNATIVE_TOKEN_SUCCESSNATIVE_TOKEN_FAILURE__static_attributes__rSC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_cli\dashboard_auth\audit.pyr r $sdOK#M#M F'O'O F5))---5-11r3r cV^8dQhRR/#)returnrr)formats"r4 __annotate__r9:s==4=r3c8^RIHpV!4R, R, #)z]Lazy leaf import: honours profile overrides + the native-Windows ``%LOCALAPPDATA%`` fallback.get_hermes_homelogszdashboard-auth.log)hermes_constantsr<r;s r4_resolve_log_pathr?:s0  v %(< <!$$??%$''+015aq!511 ec3tT$Z@ A AU %#e*/@"@A'#.@*AABEWWW L@1s D %Dc$V^8dQhRRRRRR/#)r6pathr pending_bytesrJr7Noner)r8s"r4r9r9Ms!  D   r3c 4VP4PV,\8dR#\ \ ^, ^R4FvpTP TP RT 24pTP4'gK;\P!Y0P TP RT^, 244Kx \P!YP TP R244R# \dR#i;i \dR#i;i)uRotate ``path`` to ``.1``/…/``.<_BACKUP_COUNT>`` once appending *pending_bytes* would reach ``_MAX_BYTES``. Mirrors stdlib ``RotatingFileHandler``'s naming; must be called with ``_write_lock`` held. Rotation errors must not break the write path.N.z.1) statst_size _MAX_BYTESOSErrorrange _BACKUP_COUNT with_namenameexistsosreplace)rUrVisrcs&& r4_rotate_if_neededrhMs 99;   . ;  < }q(!R0A..DII;as!34Czz|| 3$))Aa!eW/E FG1 4499+R(89:     s**C6ADA1D6 DD DDc$V^8dQhRRRRRR/#)r6eventr fieldsrr7rWr)r8s"r4r9r9`s&EEZE3E4Er3c *R\PP\P4P 4RVP /VP 4UUu/uFwr#V\9gKV\V4bK uppCp\P!VR R7R,pVPR4p\4pVPPRRR7\;_uu_4\!V\#V44\%VR4;_uu_4pVP'V4R R R 4R R R 4R #uuppi +'giL ;i +'giR #;i \(d"p \*P-R T 4R p ? R #R p ? ii;i) uAppend one event; token-like fields dropped, log dir created, size-capped rotation (``_MAX_BYTES`` with ``_BACKUP_COUNT`` backups). Write failures are logged at WARNING but never raise — auth must not fail because the audit logger broke.tsrj) separators zutf-8T)parentsexist_okabNz)dashboard-auth audit log write failed: %s),:)_dtdatetimenowUTC isoformatrArErrFjsondumpsencoder?parentmkdir _write_lockrhrOopenwrite Exception_logwarning) rjrkrRrSentryline line_bytesrUfes &, r4 audit_logr`s-E #,,""377+557 U[[^17 \!K[B[#q.##\^zz%J7$>[[)  " $6 [ dC O 4dD!!Q #"[ ]"![[ E @!DDEsgAE&D91D9A*E&+*ED? 'E/E&9E&? E E E# E&#E&& F1F  FiP> codestatecookieticket access_token Authorization authorization code_verifier refresh_token)!__conditional_annotations__r __future__rrvruenumrzloggingrd threadingpathlibrtypingr getLoggerrrLockrrPrQr]r`rr__annotations__Enumr r?rFrhr)rs@r4rs#  "nn %  ()CD)D 22,=  &Er3