
    `gj                    B   d Z ddlmZ ddlZddlZddlZddlmZmZ ddlm	Z	 ddl
mZmZ  ej                  e      ZddlmZ ddlmZ d	Zd
ZdZ e	d       G d d             Zd ZddZddZddZddZddZddZddZ	 	 d 	 	 	 	 	 	 	 d!dZ 	 	 d 	 	 	 	 	 	 	 d"dZ!y)#zIGeneric managed-tool gateway helpers for Nous-hosted vendor passthroughs.    )annotationsN)datetimetimezone)	dataclass)CallableOptionalget_hermes_home)managed_nous_tools_enabledznousresearch.comhttpsx   T)frozenc                  6    e Zd ZU ded<   ded<   ded<   ded<   y)ManagedToolGatewayConfigstrvendorgateway_originnous_user_tokenboolmanaged_modeN)__name__
__module____qualname____annotations__     M/root/.hermes/venv/lib/python3.12/site-packages/tools/managed_tool_gateway.pyr   r      s    Kr   r   c                     t               dz  S )zDReturn the Hermes auth store path, respecting HERMES_HOME overrides.z	auth.jsonr	   r   r   r   auth_json_pathr      s    {**r   c                 0   	 t               } | j                         sy t        j                  | j	                               }|j                  di       }t        |t              sy |j                  di       }t        |t              r|S 	 y # t        $ r Y y w xY w)N	providersnous)	r   is_filejsonloads	read_textget
isinstancedict	Exception)pathdatar!   nous_providers       r   _read_nous_provider_stater.   #   s    ||~zz$..*+HH["-	)T*!fb1mT*   +   s   B	 AB	 ##B	 		BBc                v   t        | t              r| j                         sy | j                         }|j                  d      r|d d dz   }	 t	        j
                  |      }|j                   |j                  t        j                        }|j                  t        j                        S # t        $ r Y y w xY w)NZz+00:00)tzinfo)r(   r   stripendswithr   fromisoformat
ValueErrorr2   replacer   utc
astimezone)value
normalizedparseds      r   _parse_timestampr=   4   s    eS!J3_x/
''
3 }}x||4X\\**	  s   B, ,	B87B8c                    t        |       }|y|t        j                  t        j                        z
  j                         }|t        dt        |            k  S )NTr   )r=   r   nowr   r8   total_secondsmaxint)
expires_atskew_secondsexpires	remainings       r   _access_token_is_expiringrG   C   sK    z*G8<<55DDFIAs<0111r   c                 ,   t        j                  d      } t        | t              r | j	                         r| j	                         S t               xs i }|j                  d      }t        |t              r |j	                         r|j	                         S y)a  Cheap probe for a Nous gateway token without triggering refresh.

    Availability scans (`hermes tools`, banner/status paint, provider
    `is_available()` checks) must stay off the synchronous OAuth refresh path.
    This helper therefore only inspects the explicit env override and the
    cached auth-store token, without checking expiry and without making any
    network calls. Truthful refresh handling stays in request/session paths
    that call :func:`read_nous_access_token`.
    TOOL_GATEWAY_USER_TOKENaccess_tokenN)osgetenvr(   r   r3   r.   r'   )explicitr-   rJ   s      r   peek_nous_access_tokenrN   K   sw     yy23H(C X^^%5~~-/52M $$^4L,$););)=!!##r   c                    t        j                  d      } t        | t              r | j	                         r| j	                         S t               xs i }t               }|r!t        |j                  d      t              s|S 	 ddl
m}  |t              }t        |t              r |j	                         r|j	                         S |S # t        $ r!}t        j                  d|       Y d}~|S d}~ww xY w)zJRead a Nous Subscriber OAuth access token from auth store or env override.rI   rC   r   )resolve_nous_access_token)refresh_skew_secondsz$Nous access token refresh failed: %sN)rK   rL   r(   r   r3   r.   rN   rG   r'   '_NOUS_ACCESS_TOKEN_REFRESH_SKEW_SECONDShermes_cli.authrP   r*   loggerdebug)rM   r-   cached_tokenrP   refreshed_tokenexcs         r   read_nous_access_tokenrY   `   s    yy23H(C X^^%5~~-/52M)+L5,'/ 	B=3!H
 os+0E0E0G"((**   B;SAABs   AC 	C1C,,C1c                     t        j                  dd      j                         j                         } | st        S | dv r| S t        d      )z,Return configured shared gateway URL scheme.TOOL_GATEWAY_SCHEME >   httpr   z-TOOL_GATEWAY_SCHEME must be 'http' or 'https')rK   rL   r3   lower_DEFAULT_TOOL_GATEWAY_SCHEMEr6   )schemes    r   get_tool_gateway_schemera   |   sH    YY,b1779??AF++""
D
EEr   c                d   | j                         j                  dd       d}t        j                  |d      j	                         j                  d      }|r|S t               }t        j                  dd      j	                         j	                  d      }|r
| d|  d| S | d|  dt         S )	z0Return the gateway origin for a specific vendor.-__GATEWAY_URLr\   /TOOL_GATEWAY_DOMAINz://z	-gateway.)upperr7   rK   rL   r3   rstripra   _DEFAULT_TOOL_GATEWAY_DOMAIN)r   
vendor_keyexplicit_vendor_urlshared_schemeshared_domains        r   build_vendor_gateway_urlro      s    LLN**345\BJ))J399;BB3G""+-MII3R8>>@FFsKMF89]ODD_Cxy1M0NOOr   c                    t               sy|xs t        }|xs t        } ||       } |       }|r|syt        | ||d      S )z8Resolve shared managed-tool gateway config for a vendor.NT)r   r   r   r   )r   ro   rY   r   )r   gateway_buildertoken_readerresolved_gateway_builderresolved_token_readerr   r   s          r   resolve_managed_tool_gatewayru      sX     &'.J2J(B,B-f5N+-O#%'	 r   c                2    t        | ||xs t              duS )a|  Return True when gateway URL and a likely-usable Nous token are present.

    Defaults to :func:`peek_nous_access_token` so read-only availability scans
    avoid synchronous OAuth refresh. Callers that are about to make a real
    gateway request should use :func:`resolve_managed_tool_gateway` (which
    still defaults to the refresh-aware :func:`read_nous_access_token`).
    )rq   rr   N)ru   rN   )r   rq   rr   s      r   is_managed_tool_gateway_readyrw      s*     ('!;%; 	 r   )returnzOptional[dict])r:   objectrx   zOptional[datetime])rC   ry   rD   rB   rx   r   )rx   zOptional[str])rx   r   )r   r   rx   r   )NN)r   r   rq   Optional[Callable[[str], str]]rr   %Optional[Callable[[], Optional[str]]]rx   z"Optional[ManagedToolGatewayConfig])r   r   rq   rz   rr   r{   rx   r   )"__doc__
__future__r   r$   loggingrK   r   r   dataclassesr   typingr   r   	getLoggerr   rT   hermes_constantsr
   tools.tool_backend_helpersr   rj   r_   rR   r   r   r.   r=   rG   rN   rY   ra   ro   ru   rw   r   r   r   <module>r      s    O "   	 ' ! %			8	$ , A1 & *- ' $  +
"+2*8	FP" 7;:>3 8 (	6 7;:>3 8 
	r   