`gjLdZddlmZddlmZmZddlmZddlm Z m Z edGdd Z Gd d eZ d d gZ y ) aAbstract base for proxy upstream adapters. An :class:`UpstreamAdapter` represents one OAuth-authenticated provider the local proxy can forward requests to. The adapter is responsible for: - locating the user's auth state for that provider - refreshing/minting credentials when needed - reporting the resolved upstream base URL - declaring which request paths it accepts The proxy server is otherwise provider-agnostic. ) annotations)ABCabstractmethod) dataclass) FrozenSetOptionalT)frozencHeZdZUdZded< ded< dZded< dZded <y) UpstreamCredentialz1A resolved bearer + base URL ready to forward to.strbearerbase_urlBearer token_typeNz Optional[str] expires_at)__name__ __module__ __qualname____doc____annotations__rrQ/root/.hermes/venv/lib/python3.12/site-packages/hermes_cli/proxy/adapters/base.pyr r s/; KYMPJN $J $Nrr ceZdZdZeed dZeed dZeed dZed dZ ed dZ ddZ d dZ y )UpstreamAdapterz;Contract for an upstream provider the proxy can forward to.cy)z.Adapter key used on the CLI (e.g. ``"nous"``).Nrselfs rnamezUpstreamAdapter.name)rcy)z;Human-readable provider name for logs and ``proxy status``.Nrrs r display_namezUpstreamAdapter.display_name.r rcy)aTSet of relative request paths the upstream accepts. Paths are relative to the proxy's ``/v1`` mount point. For example, ``"/chat/completions"`` corresponds to a client request to ``http://127.0.0.1:/v1/chat/completions``. Requests to paths not in this set get a 404 with a helpful error body. Nrrs r allowed_pathszUpstreamAdapter.allowed_paths3r rcy)uReturn True if the user has usable credentials for this upstream. Should be cheap — no network calls. Used by ``proxy start`` for a clear up-front error before binding a port. Nrrs ris_authenticatedz UpstreamAdapter.is_authenticated>r rcy)aReturn a fresh credential, refreshing or rotating if necessary. Implementations should: - refresh the access token if it's near expiry - rotate the upstream bearer key if it's near expiry - persist any refreshed state back to disk Raises: RuntimeError: if the user isn't authenticated or the upstream refresh fails. The proxy will return 401 to the client. Nrrs rget_credentialzUpstreamAdapter.get_credentialFr rc ||f}y)zReturn an alternate credential after an upstream auth failure. The default is no retry. Providers can override this for one-shot fallback paths after the upstream rejects the first request. Nr)rfailed_credential status_code_s rget_retry_credentialz$UpstreamAdapter.get_retry_credentialTs { *rc |j}|jrd|jdnd}|jd|j|S#t$r}|jd|dcYd}~Sd}~wwxYw)z-One-line status summary for ``proxy status``.z : not ready ()Nz (expires z: )r( Exceptionr"rr)rcredexcttls rdescribezUpstreamAdapter.describebs~ =&&(D26 4??+1-b##$Bt}}ocU;; =''( cU!< < =sA A2A-'A2-A2N)returnr )r6zFrozenSet[str])r6bool)r6r )r*r r+intr6zOptional[UpstreamCredential]) rrrrpropertyrrr"r$r&r(r-r5rrrrr&sE ==JJ         .   & r?sU ##!& $ O O O C