+
    jHàjX`  ã                  óf  a € 0 t $ R t^ RIHt ^ RIt^ RIt^ RIt^ RIt^ RIt^ RI	t	^ RI
t
^ RIt^ RIt^ RIt^ RIHtHt ^ RIHtHt ^ RIHt ^ RIHtHtHtHtHt ^ RIHtHt ^ RI H!t!H"t"H#t#H$t$H%t%H&t& ^t'Rbt(Rct)]PT                  ! R	4      t+]PT                  ! R
4      t,]-! 0 Rdm4      t.]Re,          t/]Rf,          t0 ! R R]14      t2 ! R R]24      t3Rt4]! ^ R7      R R l4       t5RgR R llt6R R lt7R R lt8R R lt9R R lt:]! ]$]2RRR7      t;R  R! lt<R" R# lt=R$ R% lt>R& R' lt?R( R) lt@R* R+ ltAR, R- ltBR. R/ ltCR0 R1 ltD0 RhmtE]! R7R87       ! R9 R:4      4       tFR2]'3R3RiR4R7R5R;R<RR6R/R= R> lltG]! ]GR7R?7      tHRgR@ RA lltI]! ^R7      RB RC l4       tJRD RE ltKRF RG ltL]M! ]9]8]8]8]9]8]8]8]8]9]9]8]:]:]8RH7      tNRI]ORJ&   ]! R7R87       ! RK RL4      4       tPRjtQ]-! RM0]QmRNkROkRPkRQk4      tR]RRR0,          tS0 RkmtTRltURmtVRNRRORnRPRRTRURVRRRR/RW RX lltWRYRSRZR/R[ R\ lltXRZR/R] R^ lltYRZRR_Ro/R` Ra lltZR# )pa	  Typed contracts for autonomous cross-gateway hosted-room members.

The Desktop may bootstrap an invitation but is never the issuer or runtime courier: the target gateway
verifies a scoped grant and the full task coordinates before admitting any model or tool work.
)ÚannotationsN)ÚasdictÚ	dataclass)Ú	lru_cacheÚpartial)ÚPath)ÚAnyÚCallableÚIterableÚLiteralÚMapping)ÚRoomExecutionPolicyÚexecution_policy_mapping)Úbounded_intÚclockÚcompact_jsonÚexact_fieldsÚ
identifierÚtextz%^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,255}$z^[0-9a-f]{64}$c                  ó   € ] tR t^(tRtRtR# )ÚHostedRoomPeerErrorz9Base error for malformed or unauthorized peer-room input.© N©Ú__name__Ú
__module__Ú__qualname__Ú__firstlineno__Ú__doc__Ú__static_attributes__r   ó    Ú=/home/ubuntu/.hermes/hermes-agent/gateway/hosted_room_peer.pyr   r   (   s   † Õ'fr   r   c                  ó   € ] tR t^*tRtRtR# )ÚHostedRoomGrantErrorz6Raised when a room-scoped grant is invalid or expired.r   Nr   r   r   r    r"   r"   *   s   † Õ1mr   r"   z.room-link-grant-secret)Úmaxsizec               ó    € V ^8„  d   QhRRRR/# )é   Ú
home_valueÚstrÚreturnÚbytesr   )Úformats   "r    Ú__annotate__r+   1   s   € ÷  dñ  d°Cð  d¸Eñ  dr   c           
     óD  a€ ^ RI Hp \        V 4      ;pP                  RRR7       V\        ,          oR V3R llp V! 4       p\,        P.                  ! TR\0        P2                  4      P5                  4       #   \
         Edœ    \        P                  ! ^ 4      pTR\         R\        P                  ! 4        R\        P                  ! ^4      P                  4        2,          p\        P                  ! T\        P                  \        P                  ,          \        P                  ,          R4      p \        P                  ! TRRR	7      ;_uu_ 4       pTP                  T4       TP!                  4        \        P"                  ! TP%                  4       4       R
R
R
4       M  + '       g   i     M; i \        P&                  ! TS4       T! T4       M  \(         d    T! 4       p Mi ; iTP+                  RR7        ELÃ  TP+                  RR7       i ; ii ; i)zDLoad one restart-scoped grant secret for an exact installation root.)Úfsync_directoryT)ÚparentsÚexist_okc               ó   € V ^8„  d   QhRR/# )r%   r(   r)   r   )r*   s   "r    r+   Ú9_gateway_room_grant_secret_for_home.<locals>.__annotate__6   s   € ÷ ñ �5ñ r   c                 óö   <€ \        SP                  4       ;p 4      ^ 8w  d   \        R4      h\        P                  ! SP                  4       P
                  4      ^?,          '       d   SP                  R4       V # )é    z"gateway RoomLink secret is invalidé€  )ÚlenÚ
read_bytesr"   ÚstatÚS_IMODEÚst_modeÚchmod)ÚdataÚpaths    €r    Ú_readÚ2_gateway_room_grant_secret_for_home.<locals>._read6   sY   ø€ Ü�t—‘Ó(Ð(ˆtÓ)¨RÔ/Ü&Ð'KÓLÐLÜ�<Š<˜Ÿ	™	›×+Ñ+Ó,¨u×4Ô4Ø�J‰J�uÔØˆr   Ú.r4   Úwb)ÚclosefdN)Ú
missing_oks(   hermes-hosted-room-installation-grant-v1)Úutilsr-   r   ÚmkdirÚ_ROOM_GRANT_SECRET_FILEÚFileNotFoundErrorÚosÚurandomÚgetpidÚhexÚopenÚO_WRONLYÚO_CREATÚO_EXCLÚfdopenÚwriteÚflushÚfsyncÚfilenoÚlinkÚFileExistsErrorÚunlinkÚhmacÚnewÚhashlibÚsha256Údigest)	r&   r-   Úhomer=   ÚmaterialÚ	temporaryÚfdÚstreamr<   s	   &       @r    Ú#_gateway_room_grant_secret_for_homera   0   s“  ø€ õ &Ü�*ÓÐ€T×$Ñ$¨T¸DÐ$ÔAØÔ)Õ)€D÷ð ð.Ù“7ˆô( �8Š8�HÐIÌ7Ï>É>ÓZ×aÑaÓcÐcøô' õ .ô —:’:˜b“>ˆØ˜QÔ6Ð7°q¼¿º»¸ÀQÄrÇzÂzÐRSÃ}×GXÑGXÓGZÐF[Ð\Õ\ˆ	Ü�WŠW�Y¤§¡¬b¯j©jÕ 8¼2¿9¹9Õ DÀeÓLˆð	.Ü—’˜2˜t¨T×2Õ2°fØ—‘˜XÔ&Ø—‘”Ü—’˜Ÿ™›Ô)÷ 3×2×2Ð2úð&Ü—’˜	 4Ô(ñ   Õ%øô #ô #Ù ›7’ð#úð
 ×Ñ¨Ð×-øˆI×Ñ¨ÐÕ-úð%.úsa   ½A8 Á8B=HÄ6!HÅAF&Æ	HÆ&F6Æ1HÆ:GÇ	HÇG/Ç,HÇ.G/Ç/HÇ2HÈHÈHc               ó    € V ^8„  d   QhRRRR/# )r%   ÚrootzPath | str | Noner(   r)   r   )r*   s   "r    r+   r+   T   s   € ÷ Wñ WÐ$5ð WÀñ Wr   c                óä   € V f5   ^ RI Hp \        P                  P	                  R4      ;'       g    V! 4       p \        \        \        V 4      P                  4       P                  4       4      4      # )aP  Load or atomically mint the gateway-only RoomLink signing secret.

API keys are client-known, possibly profile-scoped bearer credentials and must never become
grant-signing authority; this secret lives in the installation root, is never exposed by config
or capability RPCs, and is shared only by this installation's gateway processes.
)Úget_hermes_homeÚHERMES_HOME)
Úhermes_constantsre   rG   ÚenvironÚgetra   r'   r   Ú
expanduserÚresolve)rc   re   s   & r    Úgateway_room_grant_secretrl   T   sQ   € ð ‚|Ý4ô �z‰z�~‰~˜mÓ,×AÐA±Ó0AˆÜ.¬s´4¸³:×3HÑ3HÓ3J×3RÑ3RÓ3TÓ/UÓVÐVr   c               ó    € V ^8„  d   QhRRRR/# )r%   Úapi_keyr'   r(   r)   r   )r*   s   "r    r+   r+   c   s   € ÷ fñ f cð f¨eñ fr   c                óê   € \        V \        4      '       d   \        V 4      ^8  d   \        R4      h\        P
                  ! V P                  R4      R\        P                  4      P                  4       # )z§Domain-separate room grants from the configured API key.

The 8-char floor is for contract tests; production key strength is enforced by the API-server startup guard.
z,room grants require a strong gateway API keyúutf-8s   hermes-hosted-room-grant-v1)
Ú
isinstancer'   r5   r"   rW   rX   ÚencoderY   rZ   r[   )rn   s   &r    Úderive_room_grant_secretrs   c   sR   € ô
 �gœs×#Ò#¤s¨7£|°aÔ'7Ü"Ð#QÓRÐRÜ�8Š8�G—N‘N 7Ó+Ð-KÌWÏ^É^Ó\×cÑcÓeÐer   c               ó$   € V ^8„  d   QhRRRRRR/# ©r%   Úvaluer   Úfieldr'   r(   r   )r*   s   "r    r+   r+   m   s!   € ÷ 'ñ '�sð ' cð '¨cñ 'r   c          	     ó8   € \        W\        R \        V R2R7      # )é   z is invalid)ÚlabelÚerrorÚ	max_charsÚpatternÚinvalid)r   r   Ú_IDENTIFIER_RE©rv   rw   s   &$r    Ú_identifierr�   m   s#   € ÜØÔ"5ÀÌnØ�'˜Ð%ô'ð 'r   c               ó$   € V ^8„  d   QhRRRRRR/# )r%   rv   r   rw   r'   r(   Úintr   )r*   s   "r    r+   r+   s   s&   € ÷ oñ o˜ð o¨ð o°ñ or   c               ó.   € \        V \        V R 2^R7      # )z must be a positive integer)r{   ÚmessageÚlow)r   r   r€   s   &$r    Ú_positive_intr‡   s   s   € Ü�uÔ$7ÀEÀ7ÐJeÐAfÐlmÔnÐnr   c               ó$   € V ^8„  d   QhRRRRRR/# ru   r   )r*   s   "r    r+   r+   w   s!   € ÷ ñ �3ð  #ð ¨#ñ r   c               ó„   € \        V \        4      '       d   \        P                  V 4      '       g   \	        V R 24      hV # )z must be a sha256 digest)rq   r'   Ú
_DIGEST_REÚ	fullmatchr   r€   s   &$r    Ú_digestrŒ   w   s7   € Ü�eœS×!Ò!¬×)=Ñ)=¸e×)DÒ)DÜ! U GÐ+CÐ"DÓEÐEØ€Lr   z {label} missing fields: {fields}z {label} unknown fields: {fields})r{   Úmissing_fmtÚunknown_fmtc               ó    € V ^8„  d   QhRRRR/# )r%   rv   úMapping[str, Any]r(   r)   r   )r*   s   "r    r+   r+   ‚   s   € ÷ /ñ /Ð,ð /°ñ /r   c                ó6   € \        V 4      P                  R 4      # )Úascii)r   rr   ©rv   s   &r    Ú_canonical_jsonr”   ‚   s   € Ü˜Ó×%Ñ% gÓ.Ð.r   c               ó    € V ^8„  d   QhRRRR/# )r%   rv   r)   r(   r'   r   )r*   s   "r    r+   r+   †   s   € ÷ Hñ H�eð H ñ Hr   c                ój   € \         P                  ! V 4      P                  R 4      P                  R4      # )ó   =r’   )Úbase64Úurlsafe_b64encodeÚrstripÚdecoder“   s   &r    Ú
_b64encoderœ   †   s)   € Ü×#Ò# EÓ*×1Ñ1°$Ó7×>Ñ>¸wÓGÐGr   c               ó    € V ^8„  d   QhRRRR/# )r%   rv   r'   r(   r)   r   )r*   s   "r    r+   r+   Š   s   € ÷ Nñ N�cð N˜eñ Nr   c                ó¬   €  \         P                  ! V R \        V 4      ) ^,          ,          ,           4      #   \         d   p\	        R4      ThRp?ii ; i)Ú=zroom grant encoding is invalidN)r˜   Úurlsafe_b64decoder5   Ú	Exceptionr"   )rv   Úexcs   & r    Ú
_b64decoder£   Š   sM   € ðNÜ×'Ò'¨°¼¸E»
°{ÀQµÕ0GÕ(GÓHÐHøÜô NÜ"Ð#CÓDÈ#ÐMûðNús   ‚47 ·AÁAÁAc               ó    € V ^8„  d   QhRRRR/# )r%   Útokenr'   r(   ztuple[bytes, bytes]r   )r*   s   "r    r+   r+   ‘   s   € ÷ Bñ B˜ð BÐ 3ñ Br   c                ó|   € V P                  R4      w  rpV'       g   \        R4      h\        V4      \        V4      3# )zDReturn the decoded ``(payload, signature)`` halves of a grant token.r?   úroom grant is invalid)Ú	partitionr"   r£   )r¥   Úencoded_tokenÚ	separatorÚsignature_tokens   &   r    Ú_split_tokenr¬   ‘   s9   € à05·±ÀÓ0DÑ-€M˜oßÜ"Ð#:Ó;Ð;Ü�mÓ$¤j°Ó&AÐAÐAr   c               ó$   € V ^8„  d   QhRRRRRR/# )r%   rv   r   rw   r'   r(   z	list[Any]r   )r*   s   "r    r+   r+   ™   s!   € ÷ ñ ˜3ð ¨#ð °)ñ r   c               ó^   € \        V \        4      '       d	   V '       g   \        V R 24      hV # )z must be a non-empty list)rq   Úlistr   r€   s   &$r    Ú_non_empty_listr°   ™   s)   € Ü�eœT×"Ò"¯%Ü! U GÐ+DÐ"EÓFÐFØ€Lr   c               ó    € V ^8„  d   QhRRRR/# )r%   Ú	links_rawr   r(   útuple[LinkMode, ...]r   )r*   s   "r    r+   r+   Ÿ   s   € ÷ +ñ + ð +Ð)=ñ +r   c                óô   € \         ;QJ d'    R  \        V RR7       4       F  '       g   K   RM	  RM! R  \        V RR7       4       4      '       d   \        R4      h\        \        P                  V 4      4      # )c              3  ó2   "  € T F  q\         9  x € K  	  R # 5i©N)Ú_LINK_MODES)Ú.0Úitems   & r    Ú	<genexpr>Ú$_parse_link_modes.<locals>.<genexpr>    s   é € Ð
^Ñ/] t”{Ö"Ó/]ùs   ‚Ú
link_modes©rw   TFz'link_modes contains an unsupported mode)Úanyr°   r   ÚtupleÚdictÚfromkeys)r²   s   &r    Ú_parse_link_modesrÂ   Ÿ   sS   € ß
ƒsÑ
^¬¸yÐP\Õ/]Ó
^‡s‡s‚sÑ
^¬¸yÐP\Õ/]Ó
^×^Ò^Ü!Ð"KÓLÐLÜ”—‘˜yÓ)Ó*Ð*r   c               ó    € V ^8„  d   QhRRRR/# )r%   Úversions_rawr   r(   z	list[int]r   )r*   s   "r    r+   r+   ¥   s   € ÷ \ñ \ Sð \¨Yñ \r   c           
     óX   € \        V  Uu0 uF  p\        VR R7      kK  	  up4      # u upi )Úprotocol_versionr½   )Úsortedr‡   )rÄ   r¹   s   & r    Ú_protocol_versionsrÈ   ¥   s'   € ÜÉ\ÓZÉ\ÀT”= Ð-?×@É\ÑZÓ[Ð[ùÒZs   Š'c               ó    € V ^8„  d   QhRRRR/# )r%   rv   r�   r(   r'   r   )r*   s   "r    r+   r+   ©   s   € ÷ rñ rÐ,ð r°ñ rr   c           
     ó¾   € \         P                  ! \        V P                  4        UUu/ uF  w  rVR8w  g   K  WbK  	  upp4      4      P	                  4       # u uppi )zCDigest of the catalog mapping without its ``catalog_digest`` field.Úcatalog_digest)rY   rZ   r”   ÚitemsÚ	hexdigest)rv   ÚkÚvs   &  r    Ú_catalog_digestrÐ   ©   sE   € ä�>Š>œ/¸E¿K¹K¼MÔ*c¹M±D°AÈQÐRbÑMb¬4¨1ª4¹MÒ*cÓdÓe×oÑoÓqÐqùÓ*cs
   ©A¹Ac               ó    € V ^8„  d   QhRRRR/# )r%   Úendpointr   r(   z7tuple[str | None, str | None, TransportSecurity | None]r   )r*   s   "r    r+   r+   ®   s   € ÷ )ñ )˜cð )Ð&]ñ )r   c                ó~  € \        V \        4      '       d&   \        V P                  R4      \        4      '       g   \	        R4      hV R,          '       g(   \        V RR0RR7       R\        V R,          RR7      R3# \        V 0 RmRR7       \        V R	,          4      w  rV R
,          V8w  d   \	        R4      hVRV3# )zSReturn ``(url, reason, transport_security)`` for an advertised endpoint capability.Ú	availablezendpoint capability is invalidÚreasonzendpoint capability©Úrequiredrz   Nzendpoint.reasonr½   ÚurlÚtransport_securityz2endpoint transport_security does not match its URL>   rØ   rÔ   rÙ   )rq   r   ri   Úboolr   Ú_exact_fieldsr�   Úvalidate_room_link_url)rÒ   rØ   rÙ   s   &  r    Ú_parse_endpointrÝ   ®   s°   € ä�h¤×(Ò(´
¸8¿<¹<ÈÓ;TÔVZ×0[Ò0[Ü!Ð"BÓCÐCØ�K× Ô Ü�h¨+°xÐ)@ÐH]Õ^Ø”[ ¨(Õ!3Ð;LÔMÈtÐSÐSÜ�(Ò%OÐWlÕmÜ4°X¸eµ_ÓEÑ€CØÐ$Õ%Ð);Ô;Ü!Ð"VÓWÐWØ�Ð(Ð(Ð(r   Úprotocol_versionsr¼   r   ÚattachmentsÚexecution_policyT)Úfrozenc                  óÄ   € ] tR t^Át$ RtR]R&   R]R&   R]R&   R]R	&   R]R
&   R]R&   R]R&   R]R&   RtR]R&   RtR]R&   RtR]R&   ]	R R l4       t
R R ltR R ltRtR# )ÚGatewayRoomCatalogz9Authenticated gateway capabilities inherited by its Bots.r'   Úinstallation_idztuple[int, ...]rÞ   r³   r¼   rÚ   Úpersistent_processr   rß   r   rà   rË   Nú
str | NoneÚendpoint_urlÚendpoint_reasonzTransportSecurity | NonerÙ   c               ó    € V ^8„  d   QhRRRR/# )r%   rv   r�   r(   rã   r   )r*   s   "r    r+   ÚGatewayRoomCatalog.__annotate__Ñ   s   € ÷ ñ Ð!2ð Ð7Iñ r   c                	óš  € \        V\        R 0RR7       \        VR,          RR7      p\        \	        \        VR,          RR7      4      4      p\        VR,          4      pR F-  p\        W,          \        4      '       d   K!  \        V R
24      h	  \        P                  ! VR,          4      pR V9   d   \        VR ,          4      MRpV ! W#WAR,          VR,          VR	,          V\        VR,          RR7      .VO5!  p\        P                  ! \!        VP#                  4       4      VP$                  4      '       g   \        R4      hV# )rÒ   zcapability catalog)r×   Úoptionalrz   rä   r½   rÞ   r¼   rå   r   rß   z must be a booleanrà   rË   z)catalog_digest does not match the catalog)rå   r   rß   )NNN)rÛ   Ú_CATALOG_FIELDSr�   r¿   rÈ   r°   rÂ   rq   rÚ   r   r   Úfrom_mappingrÝ   rŒ   rW   Úcompare_digestrÐ   Ú
as_mappingrË   )	Úclsrv   rä   ÚversionsÚlinksrw   ÚpolicyrÒ   Úcatalogs	   &&       r    rî   ÚGatewayRoomCatalog.from_mappingÐ   s.  € ä�e¤oÀÀÐThÕiÜ% eÐ,=Õ&>ÐFWÔXˆÜÔ+¬O¸EÐBUÕ<VÐ^qÔ,rÓsÓtˆÜ! %¨Õ"5Ó6ˆÛBˆEÜ˜e�l¬D×1Ô1Ü)¨U¨GÐ3EÐ*FÓGÐGñ Cô %×1Ò1°%Ð8JÕ2KÓLˆØ9CÀuÔ9L”? 5¨Õ#4Ô5ÐRdˆÙØ uÐ4HÕ.IÈ5ÐQWÍ=ÐZ_Ð`mÕZnÐpvÜ�EÐ*Õ+Ð3CÔDðQàGOóQˆô ×"Ò"¤?°7×3EÑ3EÓ3GÓ#HÈ'×J`ÑJ`×aÒaÜ%Ð&QÓRÐRØˆr   c               ó   € V ^8„  d   QhRR/# ©r%   r(   údict[str, Any]r   )r*   s   "r    r+   rê   â   s   € ÷ 	ñ 	˜Nñ 	r   c                óh  € RV P                   R\        V P                  4      R\        V P                  4      RV P                  RV P
                  RV P                  RV P                  P                  4       RV P                  /pV P                  f   V P                  e   V P                  4       VR	&   V# )
zECanonical catalog mapping; ``endpoint`` appears only when advertised.rä   rÞ   r¼   rå   r   rß   rà   rË   rÒ   )rä   r¯   rÞ   r¼   rå   r   rß   rà   rð   rË   rç   rè   Úendpoint_mapping)Úselfrv   s   & r    rð   ÚGatewayRoomCatalog.as_mappingâ   s¦   € ð ˜t×3Ñ3Ð5HÌ$Èt×OeÑOeÓJfØœ$˜tŸ™Ó/Ð1EÀt×G^ÑG^Ð`fÐhl×hqÑhqØ˜4×+Ñ+Ð-?À×AVÑAV×AaÑAaÓAcØ˜d×1Ñ1ð	3ˆð
 ×ÑÒ(¨D×,@Ñ,@Ò,LØ $× 5Ñ 5Ó 7ˆE�*ÑØˆr   c               ó   € V ^8„  d   QhRR/# rø   r   )r*   s   "r    r+   rê   í   s   € ÷ lñ l .ñ lr   c                óŠ   € V P                   f   RRRV P                  ;'       g    R/# RRRV P                   RV P                  /# )z:Return the normalized self-advertised endpoint capability.rÔ   FrÕ   Únot_configuredTrØ   rÙ   )rç   rè   rÙ   ©rü   s   &r    rû   Ú#GatewayRoomCatalog.endpoint_mappingí   sM   € à×ÑÒ$Ø ¨°$×2FÑ2F×2ZÐ2ZÐJZÐ[Ð[Ø˜T 5¨$×*;Ñ*;Ð=QÐSW×SjÑSjÐkÐkr   r   )r   r   r   r   r   Ú__annotations__rç   rè   rÙ   Úclassmethodrî   rð   rû   r   r   r   r    rã   rã   Á   sw   ‡ áCØÓØ&Ó&Ø$Ó$ØÓØ
ƒJØÓØ)Ó)ØÓØ#€L�*Ó#Ø"&€O�ZÓ&Ø37ÐÐ0Ó7àôó ðõ"	÷lñ lr   rã   FrÒ   c               ó@   € V ^8„  d   QhRRRRRRRRR	RR
RRRRRRRRR/
# )r%   rä   r'   rÞ   zIterable[int]r¼   zIterable[LinkMode]rå   rÚ   r   rß   rÒ   zMapping[str, Any] | NoneÚtarget_profilerà   r(   rù   r   )r*   s   "r    r+   r+   ô   sj   € ÷ ñ ØðØ0=ðà"ðàMQðàY]ðð ðð *Bðð [^ðð /ð	ð ;Iñ	r   c        	        óœ  € \        T;'       d    \        P                  ! R4      R8g  4      p\        VRR7      p	\        P
                  ! T;'       g    \        V	R7      4      p
V
P                  V	8w  d   \        R4      hV
P                  R8X  d   \        R4      hR	\        V R	R7      R
\        V4      R\        P                  V4       Uu. uF  q»R8X  g   K  VNK  	  upRTR\        V4      R\        V4      RV
P                  4       R\        Vf   \        4       MT4      /p\        V4      VR&   \         P                  V4       V# u upi )a  Build a canonical catalog mapping with its digest for the SERVED ``target_profile``.

The profile is the session's, never the process's: a multiplexed gateway advertises one
catalog per served profile, so there is no env (``HERMES_PROFILE``) fallback (#116900).ÚHERMES_DESKTOPÚ1r  r½   ©r  zIexecution_policy target_profile does not match the catalog target_profileÚoffz8remote room execution requires manual or smart approvalsrä   rÞ   r¼   Údirectrå   r   rß   rà   rÒ   rË   )rÚ   rG   Úgetenvr�   r   rî   r   r  r   Úapproval_moderÈ   rÀ   rÁ   rð   Úlocal_room_link_endpointrÐ   rã   )rä   rÞ   r¼   rå   r   rß   rÒ   r  rà   ÚprofileÚchecked_policyÚmoderv   s   $$$$$$$$$    r    Úcatalog_mappingr  ô   s;  € ô Ð0×WÐW´R·Y²YÐ?OÓ5PÐTWÑ5WÓXÐÜ˜.Ð0@ÔA€GÜ(×5Ò5Ø×LÐLÔ4ÀGÔLóN€Nà×$Ñ$¨Ô/Ü!Ð"mÓnÐnð ×#Ñ# uÔ,Ü!Ð"\Ó]Ð]àœ; Ð>OÔPØÔ/Ð0AÓBà¬¯©°jÔ(AÓVÑ(A ÈXÑEU—t�tÑ(AÑVØÐ0°&¼$¸t»*ÀmÔUYÐZeÓUfØ˜N×5Ñ5Ó7Ø”D°xÒ7GÔ1Ô3ÈXÓVðX€Eô .¨eÓ4€EÐ
ÑÜ×#Ñ# EÔ*Ø€Lùò Ws   ÃE	ÃE	)rå   c               ó    € V ^8„  d   QhRRRR/# )r%   rv   z
Any | Noner(   rù   r   )r*   s   "r    r+   r+     s   € ÷ Uñ U Jð U¸.ñ Ur   c                óÚ   € \        V f   \        4       MT ;p;'       g    R4      P                  4       '       g   RRRR/#  \        V4      w  r#RRRTR	T/#   \         d
    RRRR/u # i ; i)
zAReturn the validated endpoint this gateway explicitly advertises.Ú rÔ   FrÕ   r   Úinvalid_configurationTrØ   rÙ   )r'   Ú_configured_room_link_urlÚstriprÜ   r   )rv   Ú
configuredrØ   rÙ   s   &   r    r  r    sŒ   € ä¸Uº]Ô7Ô9ÐPUÐU�
×\Ð\ÐZ\Ó]×cÑc×eÒeØ˜U HÐ.>Ð?Ð?ðGÜ"8¸Ó"DÑˆð ˜˜u cÐ+?ÐASÐTÐTøô ô GØ˜U HÐ.EÐFÒFðGús   ÁA ÁA*Á)A*c               ó    € V ^8„  d   QhRRRR/# )r%   r\   r'   r(   ræ   r   )r*   s   "r    r+   r+   %  s   € ÷ Oñ O Sð O¨Zñ Or   c                óJ  € ^ RI Hp ^ RIHpHpHp \        V! 4       4      V 8X  d   V! 4       P                  pM"V! V 4      p V! 4       P                  pV! V4       \        V\        4      '       d'   VP                  4       '       d   VP                  4       # R#   T! T4       i ; i)zFRead the restart-scoped user setting without polling config on probes.)Úload_gateway_config)re   Úreset_hermes_home_overrideÚset_hermes_home_overrideN)
Úgateway.configr  rg   re   r  r  r'   Úroom_link_urlrq   r  )r\   r  re   r  r  rv   r¥   s   &      r    Ú_room_link_url_from_configr"  $  sƒ   € õ 3ßfÑfÜ
‰?ÓÓ Ô%Ù#Ó%×3Ñ3‰á(¨Ó.ˆð	.Ù'Ó)×7Ñ7ˆEá& uÔ-Ü& u¬c×2Ò2°u·{±{·}²}ˆ5�;‰;‹=ÐNÈ$ÐNøñ ' uÕ-ús   ÁB Â
B"c               ó   € V ^8„  d   QhRR/# )r%   r(   ræ   r   )r*   s   "r    r+   r+   4  s   € ÷ Kñ K :ñ Kr   c                 óÚ   € \         P                  ! R4      ;p e   V # ^ RIHpHp V! 4       p\        \        V4      4      ;p'       d   V# V! 4       pWS8w  d   \        \        V4      4      # R# )zKResolve the explicit endpoint: env override > profile config > root config.ÚHERMES_ROOM_LINK_URLN)Úget_default_hermes_rootre   )rG   r  rg   r&  re   r"  r'   )Úoverrider&  re   r\   r  rc   s         r    r  r  4  sd   € ä—I’IÐ4Ó5Ð5ˆÒBØˆßIÙÓ€DÜ/´°D³	Ó:Ð:€zÖ:ØÐñ #Ó$€DØ48´LÔ%¤c¨$£iÓ0ÐJÀdÐJr   c               ó    € V ^8„  d   QhRRRR/# )r%   rv   r   r(   ztuple[str, TransportSecurity]r   )r*   s   "r    r+   r+   B  s   € ÷ Uñ U #ð UÐ*Gñ Ur   c                ó„  € \        T ;'       g    R4      P                  4       P                  R4      p \        P                  P                  V4      pVP                  ;'       g    RP                  R4      P                  4       pVP                   T'       d   TP                  f   TP                  e   \        R4      hTP                  '       g   TP                  '       d   \        R4      hTP                  P                  4       R8X  d   TR3# TP                  P                  4       R	8w  d   \        R
4      h TR8X  g>   TP!                  R4      '       g'   \"        P$                  ! T4      P&                  '       d   TR3#  \        R4      h  \         d   p\        R4      ThRp?ii ; i  \         d     L7i ; i)z]Validate a RoomLink endpoint and classify its transport: plaintext HTTP only toward loopback.r  Ú/r?   ztarget_url is invalidNz-target_url must not include query or fragmentÚhttpsÚtlsÚhttpztarget_url must use httpsÚ	localhostz
.localhostÚloopbackz3target_url must use https outside the local machine)r'   r  rš   ÚurllibÚparseÚurlsplitÚhostnameÚlowerÚportÚ
ValueErrorr   ÚusernameÚpasswordÚqueryÚfragmentÚschemeÚendswithÚ	ipaddressÚ
ip_addressÚis_loopback)rv   ÚrawÚparsedr3  r¢   s   &    r    rÜ   rÜ   B  st  € ä
ˆe�kˆk�rÓ
×
 Ñ
 Ó
"×
)Ñ
)¨#Ó
.€CðDÜ—‘×&Ñ& sÓ+ˆØ—O‘O×)Ð) r×1Ñ1°#Ó6×<Ñ<Ó>ˆà�Š÷ �v—‘Ò2°f·o±oÒ6QÜ!Ð"9Ó:Ð:Ø‡|‡|€|�v——�Ü!Ð"QÓRÐRØ‡}�}×ÑÓ Ô'Ø�EˆzÐØ‡}�}×ÑÓ Ô&Ü!Ð"=Ó>Ð>ðØ�{Ô" h×&7Ñ&7¸×&EÒ&EÌ×I]ÒI]Ð^fÓIg×Is×IsÐIsØ˜
�?Ð"ð Jtô ÐSÓ
TÐTøô ô DÜ!Ð"9Ó:ÀÐCûðDûô ô Ùðús;   ´1F Á&,F Ä>F1 Å%F1 ÆF1 ÆF.ÆF)Æ)F.Æ1F?Æ>F?)rÆ   Úroom_idÚhome_install_idÚauthority_gateway_idÚauthority_epochÚ	member_idÚtarget_install_idr  Útask_idÚexecution_generationÚsource_event_seqÚcancellation_scope_idÚcapability_digestÚexecution_policy_digestÚtrace_idzdict[str, Callable[..., Any]]Ú_DISPATCH_FIELDSc                  óè   € ] tR tRt$ RtR]R&   R]R&   R]R&   R]R&   R]R	&   R]R
&   R]R&   R]R&   R]R&   R]R&   R]R&   R]R&   R]R&   R]R&   R]R&   R]R&   R]R&   R R lt]R R l4       tRt	R# )ÚHostedMemberDispatchid  z@Recipient-validated identity for one remote room member attempt.rƒ   rÆ   r'   rB  rC  rD  rE  rF  rG  r  rH  rI  rJ  rK  ÚpromptÚprompt_digestrL  rM  rN  c               ó   € V ^8„  d   QhRR/# rø   r   )r*   s   "r    r+   Ú!HostedMemberDispatch.__annotate__y  s   € ÷ ñ ˜Nñ r   c                ó   € \        V 4      # )z:Return the canonical wire mapping used for fingerprinting.)r   r  s   &r    rð   ÚHostedMemberDispatch.as_mappingy  s   € ä�d‹|Ðr   c               ó    € V ^8„  d   QhRRRR/# )r%   rv   r�   r(   rQ  r   )r*   s   "r    r+   rU  ~  s    € ÷ 
bñ 
bÐ!2ð 
bÐ7Kñ 
br   c                	ó`  € \        V\        \        4      R R0,          RR7       \        VR ,          ;p\        4      '       d   VP                  4       '       g   \        R4      h\        V\        R \        RR7       \        VR,          RR7      p\        P                  ! \        P                  ! VP                  R4      4      P                  4       V4      '       g   \        R	4      hT ! R
R VRV/\        P!                  4        UUu/ uF  w  rEWE! W,          VR7      bK  	  uppB # u uppi )rR  rS  ÚdispatchrÖ   z!prompt must be a non-empty stringF)r{   rz   Ú	max_bytesr  r½   rp   z#prompt_digest does not match promptr   )rÛ   ÚsetrO  rq   r'   r  r   r   ÚMAX_PROMPT_BYTESrŒ   rW   rï   rY   rZ   rr   rÍ   rÌ   )rñ   rv   rR  rS  ÚnameÚchecks   &&    r    rî   Ú!HostedMemberDispatch.from_mapping}  s  € ä�e¤cÔ*:Ó&;¸xÈÐ>YÕ&YÐakÕlÜ E¨(¥OÐ3˜&´S×9Ò9ÀÇÁÇÂÜ%Ð&IÓJÐJÜˆVÔ.°hÔJZÐbgÕhÜ  oÕ 6¸oÔNˆÜ×"Ò"¤7§>¢>°&·-±-ÀÓ2HÓ#I×#SÑ#SÓ#UÐWd×eÒeÜ%Ð&KÓLÐLÙñ bØðbØ)6ðbäGW×G]ÑG]ÔG_Ô`ÑG_¹¸ˆt�U˜5�;¨dÔ3Ò3ÑG_Ò`ñbð 	bùã`s   Ä	D*r   N)
r   r   r   r   r   r  rð   r  rî   r   r   r   r    rQ  rQ  d  s�   ‡ áJØÓØƒLØÓØÓØÓØƒNØÓØÓØƒLØÓØÓØÓØƒKØÓØÓØ Ó ØƒMõð ô
bó ô
br   rQ  ÚversionrM  ÚpermissionsÚ	issued_atÚ
expires_atÚstatus_expires_atrZ  Úttl_secondsi  Ústatus_ttl_secondsc                óX   € V ^8„  d   QhRRRRRRRRRRRR	R
RRRRRRRRRRRRRRRRRRR/# )r%   Úsecretr)   Úgrant_idr'   rB  rC  rD  rE  rƒ   rF  rG  r  rM  ræ   rb  zIterable[str]rc  úfloat | Nonerf  Úfloatrg  re  r(   r   )r*   s   "r    r+   r+   —  s�   € ÷ #ñ #Øð#Ø #ð#Ø.1ð#ØDGð#Ø_bð#àð#à%(ð#à=@ð#àRUð#ð (ð#ð >Kð#ð ð	#ð 27ð	#ð T`ð	#ð
 $ð#ð
 03ñ#r   c               ól  € \        V 4      ^ 8  d   \        R4      h\        V4      pVf   T\        Vf   TMT4      ,           M
\        V4      p\        P
                  ! V4      '       dX   V^ 8:  gQ   V\        8”  gF   \        P
                  ! V4      '       d*   VV\        V4      ,           8  g   VV\        ,           8”  d   \        R4      h\        \        \        V
4      4      4      pV'       d   \        V4      \        8:  g   \        R4      h\        4       pR\        /\         Uu/ uF-  pV\        P!                  V\"        4      ! VV,          VR7      bK/  	  upCR\%        T	;'       g    \'        VR7      R,          RR7      R	\)        V4      R
VRV\        V4      ,           RV/Cp\+        V4      p\-        V4       R\-        \.        P0                  ! V V\2        P4                  4      P7                  4       4       2p\        VP9                  R4      4      \:        8”  d   \        R4      hV# u upi )zAIssue a target-verifiable bearer grant scoped to one room member.z+room grant secret must be at least 32 bytesúroom grant lifetime is invalidz"room grant permissions are invalidra  r½   rM  r
  Úpolicy_digestrb  rc  rd  re  r?   r’   zroom grant is too large)r5   r"   r   rl  ÚmathÚisfiniteÚMAX_DISPATCH_GRANT_TTL_SECONDSÚMAX_STATUS_GRANT_TTL_SECONDSr¿   rÇ   r\  Ú_GRANT_PERMISSIONSÚlocalsÚPROTOCOL_VERSIONÚ_GRANT_SCOPErO  ri   r�   rŒ   r   r¯   r”   rœ   rW   rX   rY   rZ   r[   rr   ÚMAX_TOKEN_BYTES)ri  rj  rB  rC  rD  rE  rF  rG  r  rM  rb  rc  rf  rg  re  ÚnowÚbounded_status_expiryÚallowedÚscoper^  ÚpayloadÚencodedr¥   s   &$$$$$$$$$$$$$$        r    Úissue_room_grantr  —  sð  € ô ˆ6ƒ{�RÔÜ"Ð#PÓQÐQÜ
�	Ó
€Cð Ò$ð 	ŒeÐ#5Ò#=‘KÐCUÓVÖVäÐ$Ó%ð ô
 �MŠM˜#×Ò +°Ô"2°kÔDbÔ6bÜ�}Š}Ð2×3Ò3Ð7LÈsÔUZÐ[fÓUgÕOgÔ7gØ  3Ô)EÕ#EÔEÜ"Ð#CÓDÐDÜ”Fœ3˜{Ó+Ó,Ó-€Gßœ#˜g›,Ô*<Ô<Ü"Ð#GÓHÐHÜ‹H€EàÔ#ð4å^jÓ
kÑ^jÐVZˆ4Ô!×%Ñ% d¬KÔ8¸¸t½ÈDÔQÒQÑ^jÑ
kð4ð 	"¤7Ø#÷ Xð XÜ'°~ÔFÀÕWÐ_xô$
ð œ$˜w›-¨°c¸<ÈÌuÐU`ÓOaÕIaØÐ2ñ4€Gô ˜gÓ&€GÜ˜'Ó"Ð# 1¤Z´·²¸ÀÌ'Ï.É.Ó0Y×0`Ñ0`Ó0bÓ%cÐ$dÐe€EÜ
ˆ5�<‰<˜Ó Ó!¤OÔ3Ü"Ð#<Ó=Ð=Ø€Lùò ls   Ä)3H1Ú
permissionry  c               ó0   € V ^8„  d   QhRRRRRRRRRR	R
R/# )r%   ri  r)   r¥   r'   rZ  rQ  r€  ry  rk  r(   rù   r   )r*   s   "r    r+   r+   ½  s<   € ÷ 	ñ 	Øð	Øð	Ø)=ð	ØNQð	Øeqð	àñ	r   c               ó@  aa€ \        WW4R7      oSR,          SP                  8w  d   \        R4      h\        ;QJ d/    VV3R l. \        R,          ORN 4       F  '       g   K   RM$	  RM ! VV3R l. \        R,          ORN 4       4      '       d   \        R	4      hS# )
zCVerify one room grant against exact recipient dispatch coordinates.)r€  ry  ra  z+room grant protocol does not match dispatchc              3  ó`   <"  € T F#  pSP                  V4      \        SV4      8g  x € K%  	  R # 5ir¶   )ri   Úgetattr)r¸   ÚfrZ  r}  s   & €€r    rº   Ú$verify_room_grant.<locals>.<genexpr>Ä  s'   øé € Ð
jÑ;i°aˆ7�;‰;�q‹>œW X¨qÓ1Ö1Ó;iùs   ƒ+.:é   NNrM  TFz(room grant scope does not match dispatch)Údecode_room_grantrÆ   r"   r¾   rw  )ri  r¥   rZ  r€  ry  r}  s   &&f$$@r    Úverify_room_grantr‰  ½  s„   ù€ ô   ¸*ÔN€GØˆyÕ˜X×6Ñ6Ô6Ü"Ð#PÓQÐQß
ƒsÕ
jÐ;i¼\È"Õ=MÐ;iÐOhÑ;iÓ
j‡s‡s‚sÕ
jÐ;i¼\È"Õ=MÐ;iÐOhÑ;iÓ
j×jÒjÜ"Ð#MÓNÐNØ€Nr   c          
     ó,   € V ^8„  d   QhRRRRRRRRRR	/# )
r%   ri  r)   r¥   r'   r€  ry  rk  r(   rù   r   )r*   s   "r    r+   r+   É  s0   € ÷ ñ ˜eð ¨Cð Àð È,ð Ðbpñ r   c               óÚ  € \        V\        4      '       d$   \        VP                  R4      4      \        8”  d   \        R4      h\        V4      w  rE\        P                  ! \        P                  ! W\        P                  4      P                  4       V4      '       g   \        R4      h \        P                  ! VP                  R4      4      p\        T\"        4      '       d   \%        T4      \&        \(        09  d   \        R4      h\*        P,                  ! \/        T4      ;p4      '       g   \        R4      h \1        TR	,          4      p	\1        TR
,          4      p
\1        TP3                  RT
4      4      pYšT3p\9        \;        \*        P,                  T4      4      '       d   Yšu;8  d   T8:  g   M \        R4      hTR9   d   TMT
pY‰^,
          8  g   Y�8¼  d   \        R4      h\        TP3                  R4      ;p\<        4      '       d   Y.9  d   \        R4      hT#   \          d   p\        R4      ThRp?ii ; i  \4        \6        3 d   p\        R4      ThRp?ii ; i)zBVerify grant signature, lifetime and operation without a dispatch.rp   r§   zroom grant signature is invalidr’   zroom grant payload is invalidNzroom grant fields are invalidzroom grant clock is invalidrc  rd  re  rn  z#room grant is expired or not activerb  z(room grant does not allow this operation>   ÚstopÚstatusÚapprove)rq   r'   r5   rr   rx  r"   r¬   rW   rï   rX   rY   rZ   r[   ÚjsonÚloadsr›   r¡   rÀ   Ú	frozensetÚ_GRANT_FIELDSÚ_GRANT_REFRESH_FIELDSrp  rq  r   rl  ri   Ú	TypeErrorr6  ÚallÚmapr¯   )ri  r¥   r€  ry  r~  Úsupplied_signaturer}  r¢   Úchecked_nowrc  rd  re  Ú	lifetimesÚoperation_expires_atrb  s   &&$$           r    rˆ  rˆ  É  sþ  € ä�eœS×!Ò!¤S¨¯©°gÓ)>Ó%?Ä/Ô%QÜ"Ð#:Ó;Ð;Ü".¨uÓ"5Ñ€GÜ×ÒœtŸxšx¨¼¿¹ÓH×OÑOÓQÐSe×fÒfÜ"Ð#DÓEÐEðMÜ—*’*˜WŸ^™^¨GÓ4Ó5ˆô �gœt×$Ò$¬	°'Ó(:Ä=ÔRgÐBhÔ(hÜ"Ð#BÓCÐCÜ�=Š=¬¨c«
Ð2˜×3Ò3Ü"Ð#@ÓAÐAðNÜ˜' +Õ.Ó/ˆ	Ü˜7 <Õ0Ó1ˆ
Ü! '§+¡+Ð.AÀ:Ó"NÓOÐð Ð(9Ð:€IÜ””D—M‘M 9Ó-×.Ò.°9Ö3^ÐM^Ö3^Ü"Ð#CÓDÐDØ0:Ð>[Ô0[Ñ,ÐakÐØ •^Ô# {Ô'JÜ"Ð#HÓIÐIÜ W§[¡[°Ó%?Ð?�kÄ×FÒFÈ*ÔJgÜ"Ð#MÓNÐNØ€Nøô) ô MÜ"Ð#BÓCÈÐLûðMûô ”zÐ"ô NÜ"Ð#CÓDÈ#ÐMûðNús0   Â,%H) Ä??I È)IÈ4I É IÉI*ÉI%É%I*Úleeway_secondsc               ó(   € V ^8„  d   QhRRRRRRRR/# )	r%   r¥   r'   ry  rk  r›  rl  r(   rÚ   r   )r*   s   "r    r+   r+   é  s*   € ÷ ñ ¨Sð ¸,ð Ð_dð Ðrvñ r   c               ó  €  \        \        P                  ! \        V 4      ^ ,          P	                  R4      4      R,          4      p\        V4      \        R\        V4      4      ,           V8¬  #   \         d     R# i ; i)zYRead only grant timing to schedule refresh; trust is established by the target, not here.r’   rd  g        T)rl  r�  r�  r¬   r›   r   Úmaxr¡   )r¥   ry  r›  rd  s   &$$ r    Ú!room_grant_needs_dispatch_refreshrŸ  é  sf   € ðÜœ4Ÿ:š:¤l°5Ó&9¸!Õ&<×&CÑ&CÀGÓ&LÓMÈlÕ[Ó\ˆ
Ü�S‹zœC ¤U¨>Ó%:Ó;Õ;¸zÑIÐIøÜô Úðús   ‚A,A/ Á/A>Á=A>i @  i   >   ÚpullÚrelayr  ÚdesktopÚoverlay)r  r£  r¡  r   r¢  )r,  r/  r¶   >   r   r¼   rß   rË   rä   rà   rÞ   rå   )r  r   )rj  rB  rC  rD  rE  rF  rG  r  >   rŒ  r�  rŽ  rZ  i€Q i �' )rŽ  rZ  r�  rŒ  i,  )[Ú__conditional_annotations__r   Ú
__future__r   r˜   rY   rW   r=  r�  rp  rG   Úrer7   Úurllib.parser0  Údataclassesr   r   Ú	functoolsr   r   Úpathlibr   Útypingr   r	   r
   r   r   Ú$gateway.hosted_room_execution_policyr   r   Úgateway.hosted_rooms_commonr   r   r   r   r   r   rv  rx  r]  Úcompiler   rŠ   r‘  r·   ÚLinkModeÚTransportSecurityr6  r   r"   rE   ra   rl   rs   r�   r‡   rŒ   rÛ   r”   rœ   r£   r¬   r°   rÂ   rÈ   rÐ   rÝ   rí   rã   r  Úlocal_catalog_mappingr  r"  r  rÜ   rÀ   rO  r  rQ  rw  r’  r“  rt  rr  rs  r  r‰  rˆ  rŸ  )r¤  s   @r    Ú<module>r²     s)  øðôõ #ã Û Û Û Û Û Û 	Û 	Û Û ß )ß (Ý ß <Õ <ç ^ß h× hð
 Ð Ø€ØÐ Ø—’ÐDÓE€Ø�ZŠZÐ)Ó*€
ÙÒIÓJ€ØÐBÕC€ØÐ-Õ.Ð ô g˜*Ô fä mÐ.Ô mð 4Ð ñ �2Ôô dó ð d÷FWõfõ'õoõñ ØÐ+Ð9[Ø2ô4€õ
/õHõNõBõõ+õ\õrõ
)ò*€ñ
 �$Ô÷/lð /ló ð/lðdØAQÐ@Sðà%7ðà`dðð ðð EIðð 26÷	ñD   ÀDÔIÐ ÷Uñ �2ÔôOó ðOõKõUñ6 37Ø"¨KÈÐkvØ!¨[ÈKÐhsØ¨mÈmØ%¸ÐZaÐlwô	3yÐ Ð/ó yñ �$Ô÷#bð #bó ð#bðN+€ñ ØðcØðcØ7ðcØ9FðcØHSðcØUaðcó d€à%Ð)<Ð(=Õ=Ð Ú>Ð Ø!-Ð Ø0Ð ð#ð +/ð#ð Nwð#ð #ð	#ð :>ð	#ð cgð	#ð
 '+÷#ðL	ØT^ð	Øtx÷	ðÐY]÷ ð@Èð Ðgm÷ ñ r   