+
    kHàjh  ã                  óŽ   € R t ^ RIHt ^ RIHtHtHt RtRtRRRR/t	R	t
R
R/R R lltR R ltRR/R R lltR R ltR R ltR# )a!  Solstice sign-in: browser PKCE with a loopback redirect, token exchange and refresh brokered by the
Nous portal (NAS), which holds the confidential client secret. Hermes keeps its own PKCE verifier and
the user's tokens; NAS never sees a prompt.

The generic ``hermes_cli.auth_oauth_pkce_plugin`` flow runs the browser leg, the credential-pool row
and the single-use-safe refresh. This module supplies only what is NAS-specific: the client config it
discovers and the token POSTs it brokers. Every NAS call carries the user's Nous access token.
)Úannotations)ÚAnyÚDictÚMappingzhttps://portal.nousresearch.comz/api/oauth/gemini-auth/configÚauthorization_codez/api/oauth/gemini-auth/exchangeÚrefresh_tokenz/api/oauth/gemini-auth/refreshg      >@ÚreloginFc               ó$   € V ^8„  d   QhRRRRRR/# )é   ÚmessageÚstrÚcoder   Úbool© )Úformats   "ÚJ/home/ubuntu/.hermes/hermes-agent/plugins/model-providers/solstice/auth.pyÚ__annotate__r      s&   € ÷ gñ g�#ð g˜Sð g¨dñ gó    c               ó*   € ^ RI Hp V! RV  2RWR7      # )é    )Ú	AuthErrorz
solstice: Úsolstice)Úproviderr   Úrelogin_required)Úhermes_cli.auth_constantsr   )r   r   r   r   s   &&$ r   Ú_errr      s   € Ý3Ù�z ' Ð+°jÀtÔfÐfr   c               ó   € V ^8„  d   QhRR/# )r
   Úreturnr   r   )r   s   "r   r   r      s   € ÷ Hñ H�sñ Hr   c                 óB   € ^ RI Hp Hp T ! V! R4      ;'       g    / 4      # )zTThe Nous portal the user is signed into (``HERMES_PORTAL_BASE_URL`` override first).©Ú_nous_portal_base_urlÚget_provider_auth_stateÚnous)Úhermes_cli.authr    r!   r   s     r   Ú_nas_base_urlr$      s   € çNÙ Ñ!8¸Ó!@×!FÐ!FÀBÓGÐGr   ÚjsonNc               ó(   € V ^8„  d   QhRRRRRRRR/# )r
   Úmethodr   Úpathr%   zMapping[str, Any] | Noner   zdict[str, Any]r   )r   s   "r   r   r      s*   € ÷ ñ ˜ð  Cð Ð2Jð ÐVdñ r   c               óü  € ^ RI HpHp ^ RIHp  V! 4       p TP                  T \        4       T,           T\        RR	R
RT 2/T! 4       R7      pTP                  R8X  d   \        RR4      hTP                  R8¼  d   \        RTP                   R2R4      hTP                  4       #   \
         d   p\        RRRR7      ThRp?ii ; i  \
         d)   p\        R\        T4      P                   2R4      ThRp?ii ; i)r   )Ú_default_verifyÚresolve_nous_access_token)Úhttpxz6sign in to Nous Portal first (`hermes auth add nous`).Úsolstice_nous_login_requiredT©r   NÚAcceptzapplication/jsonÚAuthorizationzBearer )r%   ÚtimeoutÚheadersÚverifyzNous portal request failed: Úsolstice_broker_unreachablei”  z'not available on this Nous account yet.Úsolstice_not_configuredi�  zNous portal returned HTTP Ú.Úsolstice_broker_failed)r#   r*   r+   r   r,   Ú	Exceptionr   Úrequestr$   Ú_TIMEOUT_SECONDSÚtypeÚ__name__Ústatus_coder%   )	r'   r(   r%   r*   r+   r,   ÚtokenÚexcÚresponses	   &&$      r   Ú_nas_requestrA      s  € ßJÝ/ð*Ù)Ó+ˆðpØ—=‘= ¬«¸4Õ)?ÀdÔTdØ*2Ð4FÈÐ[bÐchÐbiÐYjÐ)kÙ(7Ó(9ð !ó ;ˆð
 ×Ñ˜sÔ"ÜÐ<Ð>WÓXÐXØ×Ñ˜sÔ"ÜÐ/°×0DÑ0DÐ/EÀQÐGÐIaÓbÐbØ�=‰=‹?Ðøô ô *ÜÐKÐMkØô!Ø&)ð	*ûð*ûô ô pÜÐ1´$°s³)×2DÑ2DÐ1EÐFÐHeÓfÐloÐoûðpús.   �B& ˜6C Â&CÂ1C Ã CÃC;Ã#C6Ã6C;c               ó   € V ^8„  d   QhRR/# )r
   r   zdict[str, str]r   )r   s   "r   r   r   5   s   € ÷ Yñ Y˜ñ Yr   c                 óx  € \        R\        4      p R Uu. uF?  p\        V P                  V4      ;'       g    R4      P	                  4       '       d   K=  VNKA  	  ppV'       d    \        RRP                  V4       R2R4      hR Uu/ uF"  q\        W,          4      P	                  4       bK$  	  up# u upi u upi )zV``client_id`` / ``authorize_url`` / ``scope`` NAS serves for the shared Google client.ÚGETÚ zNous portal config is missing z, r6   Úsolstice_config_invalid)Ú	client_idÚauthorize_urlÚscope)rA   Ú_CONFIG_PATHr   ÚgetÚstripr   Újoin)ÚpayloadÚkÚmissings      r   Údiscover_clientrQ   5   s¢   € ä˜5¤,Ó/€GÙAÓkÑA�QÌÈWÏ[É[ÐYZË^×MaÐMaÐ_aÓIb×IhÑIh×Ij�qˆqÑA€GÐkßÜÐ3°D·I±I¸gÓ4FÐ3GÀqÐIÐKdÓeÐeÙ0WÓXÑ0W¨1Œs�7•:‹×$Ñ$Ó&Ò&Ñ0WÑXÐXùò lùò Ys   •!B2·B2ÁB2Â(B7c               ó    € V ^8„  d   QhRRRR/# )r
   ÚgrantzMapping[str, str]r   zMapping[str, Any]r   )r   s   "r   r   r   >   s   € ÷ ñ Ð 1ð Ð6Gñ r   c                ó0  € \         V R,          ,          pV P                  4        UUu/ uF  w  r#VR9   g   K  W#bK  	  ppp \        RWR7      # u uppi   \         d6   pT R,          R8X  d"   \	        TRR4      R8X  d   \        RR	R
R7      Thh Rp?ii ; i)a  ``OAuthPKCEConfig.token_request``: send the grant to NAS, which adds the client secret.

NAS folds every Google token-endpoint failure into HTTP 502, so a refresh it rejects is treated as
a dead grant (re-login) rather than retried against a token Google already refused.
Ú
grant_typer   r   ÚPOST)r%   rE   r7   zFthe stored sign-in was rejected; run `hermes auth add solstice` again.Úinvalid_grantTr.   N)r   Úcode_verifierÚredirect_urir   )Ú_TOKEN_PATHSÚitemsrA   r8   Úgetattrr   )rS   r(   rO   ÚvÚbodyr?   s   &     r   Úbroker_token_requestr_   >   sž   € ô ˜˜lÕ+Õ,€DØ"Ÿ[™[œ]Ôn™]‘T�Q¨aÐ3mÑ.mŒDˆAŠD™]€DÑnðÜ˜F DÔ4Ð4ùó oøô ô Ø�Õ /Ô1´g¸cÀ6È2Ó6NÐRjÔ6jÜÐ_Ø&°ô6Ø;>ð?àûð	ús"   ¨A¸AÁA ÁBÁ 0BÂB)Ú__doc__Ú
__future__r   Útypingr   r   r   ÚDEFAULT_NAS_BASE_URLrJ   rZ   r:   r   r$   rA   rQ   r_   r   r   r   Ú<module>rd      sa   ðñõ #ç %Ñ %à8Ð Ø.€Ø$Ð&GÈÐZzÐ{€ØÐ ðg°U÷ gõ
HðÈT÷ õ,Y÷r   