samagotchi 0.119.0 → 0.121.0

data/lib/samagotchi/web/participant_access.rb

@@ -19,7 +19,8 @@ module Samagotchi
   module Web
     # What a participant (a Web::Grants token) may do in chi web, mixed into
     # App: the gate's lookup of their grant, the refusals that are theirs
-    # (token_revoked, token_expired with its ended page, another session's
+    # (token_revoked, token_expired with its ended page, token_bound for a
+    # link bound to another account, another session's
     # 404, not_permitted by role), the trimmed answers of their own routes
     # (info, the session, resolve, a wait on their turn), their turns, and
     # the running check that ends their streams when the grant does. What
@@ -30,6 +31,11 @@ module Samagotchi
       # A participant's refused routes are audited at most this often per
       # route (a page retrying would fill the log).
       REFUSED_AUDIT_INTERVAL = 60.0
+      # At most this many refusals a minute are remembered per reason, so
+      # audited: rotating paths or headers can't grow the map or the audit
+      # file without bound (as App::REFUSED_LOG_KEYS for the log), nor one
+      # reason's flood silence another's.
+      REFUSED_AUDIT_KEYS = 256
 
       ENDED = {
         revoked: ["token_revoked", ParticipantMessages::TOKEN_REVOKED],
@@ -65,8 +71,8 @@ module Samagotchi
       def participant_principal(req, tokens, identity: nil, proxied: false)
         tokens.each do |token|
           grant = @grants.lookup(token) or next
-          if grant.identity && !(proxied && identity == grant.identity)
-            req.env[ProxyGate::REFUSED_ENV] = "grant #{grant.id} is bound to another identity than #{identity || "(none)"}"
+          unless bound_ok?(grant, identity, proxied)
+            refuse_bound(req, grant, identity)
             next
           end
           grant = settle_grant(grant)
@@ -82,6 +88,36 @@ module Samagotchi
 
       GRANT_TOKEN_ENV = "samagotchi.grant_token"
       ENDED_GRANT_ENV = "samagotchi.ended_grant"
+      BOUND_GRANT_ENV = "samagotchi.bound_grant"
+
+      # Whether +grant+ may be used by this request: an unbound one anywhere,
+      # a bound one only proxied and only for its identity (the one check,
+      # for the gate and for a link code's trade).
+      def bound_ok?(grant, identity, proxied)
+        grant.identity.nil? || (proxied && !identity.nil? && identity == grant.identity)
+      end
+
+      # A bound grant presented by another identity, or not through the
+      # proxy: #grant_bound_response answers it (token_bound).
+      def refuse_bound(req, grant, identity)
+        req.env[ProxyGate::REFUSED_ENV] = "grant #{grant.id} is bound to another identity than #{identity || "(none)"}"
+        req.env[BOUND_GRANT_ENV] ||= [grant, identity]
+      end
+
+      # 401 token_bound for a bound grant's token (or link code) presented
+      # without its identity (the page's HTML says the same words), nil when
+      # none was: logged as a refusal and audited in the grant's session.
+      def grant_bound_response(req)
+        grant, identity = req.env[BOUND_GRANT_ENV]
+        return nil unless grant
+
+        log_refused(refused_peer(req), req.path_info, "grant #{grant.id} is bound to another identity than #{identity || "(none)"}")
+        audit_refused(req, grant, reason: "token_bound", per_route: false, identity: (identity || "(none)")[0, 200])
+        detail = ParticipantMessages::TOKEN_BOUND
+        return error_response(401, "token_bound", detail) if req.path_info.start_with?("/api/")
+
+        html_response(401, BOUND_PAGE.sub(ENDED_SENTENCE, "#{detail[0].upcase}#{detail[1..]}."))
+      end
 
       def settle_grant(grant)
         return grant unless grant.active?(@grants.now)
@@ -93,6 +129,9 @@ module Samagotchi
 
         Participants.revoke(@grants, session_id: grant.session_id, id: grant.id, by: by, state_dir: default_state_dir)
         @grants.find(grant.id) || grant
+      rescue Grants::Unwritable
+        # A store this chi can't write (a newer chi's): refused all the same.
+        grant.with(revoked_at: @grants.now.utc.iso8601, revoked_by: by)
       end
 
       # 401 token_revoked / token_expired for an ended grant's token (the
@@ -115,16 +154,24 @@ module Samagotchi
 
       # A participant's request, past the gate: its use is recorded (the
       # grant's last_used_at, at most once a minute) and a peer not seen
-      # since chi web started goes into the audit trail.
+      # since chi web started goes into the audit trail. Behind a proxy
+      # every peer is 127.0.0.1: there the peer is the client's identity
+      # (else the proxy's X-Forwarded-For hop, #refused_peer), and the line
+      # names the identity.
       def participant_seen(req, principal)
         grant = principal.grant
         @grants.touch(grant.id)
-        peer = req.get_header("REMOTE_ADDR").to_s
+        peer = refused_peer(req)
         fresh = @participant_mutex.synchronize { @participant_peers[grant.id].add?(peer) }
         return unless fresh
 
-        Participants.log(grant.session_id, :peer, state_dir: default_state_dir, participant: grant.id, ip: peer,
-                                                  user_agent: req.get_header("HTTP_USER_AGENT").to_s[0, 200])
+        fields = { ip: req.get_header("REMOTE_ADDR").to_s, user_agent: req.get_header("HTTP_USER_AGENT").to_s[0, 200] }
+        if proxied?(req)
+          state, identity = proxy_identity(req)
+          fields[:identity] = identity if state == :ok
+          fields[:peer] = peer
+        end
+        Participants.log(grant.session_id, :peer, state_dir: default_state_dir, participant: grant.id, **fields)
       end
 
       # A participant asking for a session that isn't their grant's: 404 as
@@ -146,19 +193,27 @@ module Samagotchi
         error_response(403, "not_permitted", NOT_PERMITTED)
       end
 
-      def audit_refused(req, grant)
-        key = [grant.id, req.request_method, req.path_info]
+      # +reason+ and +fields+ go into the line (a bound refusal names the
+      # identity that presented it). Once a minute per route for
+      # not_permitted; once a minute per grant and identity for a bound
+      # refusal, whatever the path (+per_route+ false); at most
+      # REFUSED_AUDIT_KEYS keys a minute.
+      def audit_refused(req, grant, reason: "not_permitted", per_route: true, **fields)
+        key = per_route ? [grant.id, req.request_method, req.path_info, reason, fields] : [grant.id, reason, fields]
         now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
         due = @participant_mutex.synchronize do
-          @participant_refused.delete_if { |_, at| now - at >= REFUSED_AUDIT_INTERVAL } if @participant_refused.size > 256
-          last = @participant_refused[key]
-          (last.nil? || now - last >= REFUSED_AUDIT_INTERVAL).tap { |fresh| @participant_refused[key] = now if fresh }
+          seen = (@participant_refused[reason] ||= {})
+          seen.delete_if { |_, at| now - at >= REFUSED_AUDIT_INTERVAL } if seen.size > 64
+          next false if seen.size >= REFUSED_AUDIT_KEYS && !seen.key?(key)
+
+          last = seen[key]
+          (last.nil? || now - last >= REFUSED_AUDIT_INTERVAL).tap { |fresh| seen[key] = now if fresh }
         end
         return unless due
 
         Participants.log(grant.session_id, :refused, state_dir: default_state_dir, participant: grant.id,
                                                      method: req.request_method, path: req.path_info[0, 200],
-                                                     reason: "not_permitted")
+                                                     reason: reason, **fields)
       end
 
       # GET /api/info for a participant: what SessionAccess::Remote's
@@ -405,6 +460,7 @@ module Samagotchi
         <p>{sentence}</p>
         </body></html>
       HTML
+      BOUND_PAGE = ENDED_PAGE.sub("<title>chi: review link ended</title>", "<title>chi: review link for another account</title>")
     end
   end
 end

data/lib/samagotchi/web/participant_exposure.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module Samagotchi
+  module Web
+    # What a participant may learn of their review's usage, by their grant's
+    # exposure level (Grants::Grant#exposure; the review-composer plan's D3):
+    # the policy that maps a level to the usage fields the review route
+    # gives them (ParticipantReview#review_usage). One level today:
+    #
+    # - +own+ (every grant's): their own spend and cap, their own queued
+    #   turns and queue limit, their link's expiry, the session's model.
+    #   Never another participant's or the owner's usage, nor the session's.
+    #
+    # A later level (a tier that also shows the session's spend, say) adds
+    # its row to LEVELS and its fields' sources in ParticipantReview: one
+    # place each. A level this chi doesn't know (written by a newer chi, or
+    # a hand-edited store) reads as DEFAULT, the narrowest: an unknown level
+    # never shows more. See docs/internals/participants.md (Exposure).
+    module ParticipantExposure
+      OWN = "own"
+      DEFAULT = OWN
+      # level => the usage fields it shows, in the order the page reads them.
+      LEVELS = {
+        OWN => %i[spent cap queued queue_limit expires_at model].freeze
+      }.freeze
+
+      # +value+ as a level this chi knows, else DEFAULT.
+      def self.level(value) = LEVELS.key?(value) ? value : DEFAULT
+
+      # @return [Array<Symbol>] the fields +value+'s level shows
+      def self.fields(value) = LEVELS.fetch(level(value))
+
+      # The usage +value+'s level shows, each field read from +sources+
+      # (field => a callable): only the fields shown are computed, and a
+      # field a level names with no source raises (KeyError), never shows
+      # nothing silently.
+      # @param sources [Hash{Symbol => #call}]
+      # @return [Hash{Symbol => Object}]
+      def self.usage(value, sources)
+        fields(value).to_h { |field| [field, sources.fetch(field).call] }
+      end
+    end
+  end
+end

data/lib/samagotchi/web/participant_review.rb

@@ -2,6 +2,7 @@
 
 require_relative "participant_view"
 require_relative "participant_stream_filter"
+require_relative "participant_exposure"
 require_relative "../session_metrics"
 require_relative "../review_start"
 require_relative "../guardrails/review_paths"
@@ -58,15 +59,18 @@ module Samagotchi
         automatic = automatic_turn_ids(id, session, shown, current, state)
         waiting = !!(current&.dig("waiting_for_owner") || turn_snapshot&.dig("continue_offer") ||
                      (turn_snapshot && !turn_snapshot["current_turn"] && turn_snapshot["pending_question"]))
+        queued = turn_snapshot && snapshot_list(turn_snapshot, "queued")
+        status = displayed_status(session, state)
+        status = Session::STATUS_IDLE if status == Session::STATUS_RUNNING && current.nil?
         json_response(200, {
-          viewer: review_viewer(req, id),
-          session: { id: session.id, title: participant_title(session), status: displayed_status(session, state) },
+          viewer: review_viewer(req, id, session: session, state: state, queued: queued, viewer: viewer),
+          session: { id: session.id, title: participant_title(session), status: status },
           subjects: review_subjects(session, viewer),
           participants: participant_names(id).map { |entry| entry.slice(:id, :name, :kind) },
           messages: with_reply_html(ParticipantView.messages(shown, viewer, automatic: automatic)),
           current_turn: current,
           waiting_for_owner: waiting,
-          queued: review_queue(snapshot_list(turn_snapshot, "queued"), viewer),
+          queued: review_queue(queued || [], viewer),
           last_event_id: turn_snapshot && turn_snapshot["event_id"]
         })
       end
@@ -140,15 +144,71 @@ module Samagotchi
       def delegate_child?(session) = !session.parent_id.to_s.empty?
 
       # Who is reading: a participant (their id, name, whether they may
-      # comment: not once their cap is reached), or the owner looking
-      # through the participant view (no composer).
-      def review_viewer(req, id)
+      # comment: not once their cap is reached, and their +usage+ as their
+      # grant's exposure shows it), or the owner looking through the
+      # participant view (no composer, no usage: the owner has /stats).
+      # +state+ the live worker's session state (nil without one), +queued+
+      # its queue.
+      def review_viewer(req, id, session:, state:, queued:, viewer:)
         return { kind: "owner", can_comment: false } if principal(req).owner?
 
         grant = principal(req).grant
         capped = !participant_cap_refusal(grant).nil?
         { kind: "participant", id: grant.id, name: grant.name, participant_kind: grant.kind, can_comment: !capped,
-          cap_reached: capped, session_id: id }
+          cap_reached: capped, session_id: id,
+          usage: review_usage(grant, session: session, state: state, queued: queued, viewer: viewer) }
+      end
+
+      # A participant's usage, the fields their grant's exposure level
+      # shows (ParticipantExposure), each computed only when shown. Every
+      # source reads the grant's own author: never another participant's or
+      # the owner's.
+      def review_usage(grant, session:, state:, queued:, viewer:)
+        usage = ParticipantExposure.usage(grant.exposure, {
+          spent: -> { participant_spent(grant, state) },
+          cap: -> { grant.spend_cap },
+          queued: -> { queued&.count { |entry| entry.is_a?(Hash) && viewer.own?(entry["author"]) } },
+          queue_limit: -> { grant.queue_limit },
+          expires_at: -> { grant.expires_at },
+          model: -> { participant_model(session, state, viewer) }
+        })
+        usage.delete(:queued) unless queued
+        usage
+      end
+
+      # What the participant has cost so far, in dollars: the saved
+      # analytics' count (#participant_cap_refusal's), or the live worker's
+      # when it is more (SessionMetrics#spend: its saved turns, the running
+      # turn's finished generations and the side requests; a running turn
+      # is saved only at its end). The worker's count already holds the
+      # saved one, so the two are never added.
+      def participant_spent(grant, state)
+        dir = Session.session_dir(grant.session_id, state_dir: default_state_dir)
+        saved = SessionMetrics.saved_spend(dir, grant.author)
+        live = live_spend(state, grant.author)
+        [saved, live].max.round(4)
+      end
+
+      # +author+'s cost in the live worker's metrics (spend_by_author), 0.0
+      # without one.
+      def live_spend(state, author)
+        cost = state.is_a?(Hash) ? state.dig("metrics", "spend_by_author", author, "cost") : nil
+        cost.is_a?(Numeric) && cost.to_f.finite? ? cost.to_f : 0.0
+      rescue TypeError
+        0.0
+      end
+
+      # The model the session runs on, as its host is sent it (the alias
+      # applied, no host name): the live worker's, else the saved one's;
+      # nil when it doesn't resolve.
+      def participant_model(session, state, viewer)
+        ref = (state.is_a?(Hash) && state["model_name"]) || session.model_name
+        return nil if ref.to_s.empty?
+
+        name = host_registry.bare_name(ref.to_s)
+        name.to_s.empty? ? nil : ParticipantView::Redact.text(name.to_s, viewer)
+      rescue StandardError
+        nil
       end
 
       # The queue as a participant sees it: their own queued turns (the
@@ -185,8 +245,10 @@ module Samagotchi
           grant = principal(req).grant
           attrs.merge!("viewer" => "participant", "session" => grant.session_id, "name" => grant.name)
         end
-        data = attrs.map { |key, value| %(data-#{key}="#{Rack::Utils.escape_html(value)}") }.join(" ")
-        html_response(200, File.read(path).sub("<body>", "<body #{data}>"))
+        # The owner's participant view has no composer; a participant's
+        # selection quotes with the same presets as the owner's page.
+        attrs.merge!(annotate_presets_data) unless principal(req).owner?
+        html_response(200, File.read(path).sub("<body>", "<body #{body_data(attrs)}>"))
       end
 
       # A filtered stream's frame filter (App#stream_filter), for the

data/lib/samagotchi/web/participants_admin.rb

@@ -22,14 +22,17 @@ module Samagotchi
       # grants (one session's, or every one), in every state, never a token
       # or digest. One session's also carries +warning+: the share warning
       # for a session that isn't a review session (ReviewStart.share_warning,
-      # null for one), which the panel shows before its Invite.
+      # null for one), which the panel shows before its Invite; and
+      # +identity_header+: the header this chi web's auth proxy names the
+      # signed-in user in (null without one), for the Invite's email field.
       def handle_participants_list(_req, id = nil)
         now = @grants.now
         grants = @grants.list(session_id: id).map { |grant| grant.public_h(now) }
         return json_response(200, { participants: grants }) unless id
 
         warning = ReviewStart.share_warning(Session.load(id, state_dir: default_state_dir))
-        json_response(200, { participants: with_spend(id, grants), warning: warning })
+        json_response(200, { participants: with_spend(id, grants), warning: warning,
+                             identity_header: @public_url&.identity_header })
       end
 
       # One session's grants with what each spent and how many turns they
@@ -44,9 +47,11 @@ module Samagotchi
       end
 
       # POST /api/sessions/:id/participants {name, kind?, ttl? (seconds),
-      # cap? (dollars)}: a new grant. The answer carries the token and the
-      # link once (chi keeps only its digest), and +warning+ for a session
-      # that isn't a review session (ReviewStart.share_warning; null for one).
+      # cap? (dollars), identity? (an email: the grant is bound to it, only
+      # behind an auth proxy with an identity header)}: a new grant. The
+      # answer carries the token and the link once (chi keeps only its
+      # digest), and +warning+ for a session that isn't a review session
+      # (ReviewStart.share_warning; null for one).
       def handle_participants_invite(req, id)
         body = body_hash(req) or return error_response(400, "invalid_json", "invalid JSON body")
         ttl = body["ttl"]
@@ -56,7 +61,8 @@ module Samagotchi
         return error_response(400, "invalid_participant", Grants::CAP_RANGE) unless cap.nil? || Grants.cap?(cap)
 
         issued = Participants.invite(@grants, session_id: id, name: body["name"], kind: (body["kind"] || "human").to_s,
-                                              ttl: ttl, cap: cap, state_dir: default_state_dir)
+                                              ttl: ttl, cap: cap, identity: body["identity"], public_url: @public_url,
+                                              state_dir: default_state_dir)
         link = participant_link(req, id, issued.token, expires_at: issued.grant.expires_at)
         warning = ReviewStart.share_warning(Session.load(id, state_dir: default_state_dir))
         json_response(201, { participant: issued.grant.public_h(@grants.now), token: issued.token,

data/lib/samagotchi/web/proxy_gate.rb

@@ -11,9 +11,12 @@ module Samagotchi
     # chi web behind an auth proxy (web.public_url), mixed into App. With a
     # PublicUrl every request needs a token (this machine's too: a proxy
     # with no trace and a rewritten Host looks local). A request is
-    # *proxied* when it carries a proxy trace (ProxyTrace: X-Forwarded-*,
-    # Forwarded, X-Real-IP, a known identity header…), the configured
-    # identity header, or the public Host. A proxied request:
+    # *proxied* when it comes from a loopback peer (the proxy runs on this
+    # machine: the pod's Caddy/oauth2-proxy, Tailscale Serve) and carries a
+    # proxy trace (ProxyTrace: X-Forwarded-*, Forwarded, X-Real-IP, a known
+    # identity header…), the configured identity header, or the public Host.
+    # A LAN peer's traces are its own words, never the proxy's: it is a LAN
+    # request (the LAN token rules; a bound grant refused). A proxied request:
     # - is the owner with the owner token, and, when web.proxy.identity_header
     #   is set, only if that header is one clean value equal to
     #   web.proxy.owner (D-a: identity AND token);
@@ -45,6 +48,13 @@ module Samagotchi
       # and another port does.
       SECURE_COOKIE = "__Host-chi_token"
 
+      # 127.0.0.0/8, ::1 and their IPv4-mapped form: the only peers whose
+      # proxy traces and identity header are trusted (the proxy is local).
+      def self.loopback_peer?(addr)
+        addr = addr.to_s
+        addr.start_with?("127.", "::ffff:127.") || addr == "::1"
+      end
+
       private
 
       def init_proxy_gate(public_url, token)
@@ -59,6 +69,8 @@ module Samagotchi
         return false unless @public_url
 
         env = req.env
+        return false unless ProxyGate.loopback_peer?(env["REMOTE_ADDR"])
+
         return true if @public_url.host?(env["HTTP_HOST"])
         return true if @public_url.identity_env && env.key?(@public_url.identity_env)
 
@@ -86,6 +98,9 @@ module Samagotchi
         value = value.strip
         return [:bad, "identity header empty"] if value.empty?
         return [:bad, "identity header repeated or with a comma"] if value.include?(",")
+        # Grants.clean_identity takes ASCII only: a non-ASCII header could
+        # never match a grant or the owner, so it is refused as such.
+        return [:bad, "identity header not ASCII"] unless value.ascii_only?
 
         [:ok, value.downcase]
       end

data/lib/samagotchi/web/public/annotate_bar.css

@@ -0,0 +1,18 @@
+/* The selection bubble (annotate_bar.js): Annotate + the presets (web.annotate_presets), small pills with a gap (they
+   wrap on a narrow page). Both pages link it: the owner's (app.js) and the participant page (participant.js). Colours
+   are tokens.css's. */
+#annotateBar{position:fixed;z-index:20;display:flex;flex-wrap:wrap;gap:4px;max-width:calc(100vw - 16px)}
+#annotateBar[hidden]{display:none}
+#annotateBar button{font-size:12px;padding:4px 10px;border-radius:999px;box-shadow:0 2px 8px var(--shadow-strong)}
+/* A bundle's pills (chi.annotation) after a thin separator; beyond 3, "⋯" opens the rest in a list under it. */
+#annotateBar .annotate-actions{display:flex;flex-wrap:wrap;gap:4px;align-items:center;position:relative}
+#annotateBar .annotate-actions[hidden]{display:none}
+#annotateBar .annotate-sep{width:1px;align-self:stretch;margin:3px 2px;background:var(--border-strong)}
+#annotateBar .annotate-action,#annotateBar .annotate-more{background:var(--accent-bg);color:var(--accent);border:1px solid var(--accent-border);padding:3px 10px;max-width:32ch;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+#annotateBar .annotate-action:disabled{opacity:.5;cursor:not-allowed}
+#annotateBar .annotate-action[data-sends]::after{content:"↗";margin-left:4px;opacity:.75}
+#annotateBar .annotate-more-list{position:absolute;top:calc(100% + 4px);right:0;display:flex;flex-direction:column;align-items:flex-end;gap:4px}
+#annotateBar.docked{right:8px;justify-content:center}
+@media (pointer:coarse){#annotateBar button{font-size:14px;padding:8px 14px}}
+#annotateBar .annotate-more-list[hidden]{display:none}
+#annotateBar .annotate-preset{background:var(--bg-raised);color:var(--text-2);border:1px solid var(--border-strong);padding:3px 10px;max-width:32ch;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}

data/lib/samagotchi/web/public/annotate_bar.js

@@ -39,12 +39,19 @@ import { actionEnabled, actionTitle, sameActions, selectionFields, splitInline }
 // @param dock () => the element the bar docks above on a touch screen
 //   (the composer's dock); without one, or when it isn't laid out, the
 //   bar docks at the bottom of the window
+// @param source (node) => where a selection starting at +node+ came from,
+//   {kind, root, …}, or null where the page isn't annotatable
+//   (annotations.js annotationSource by default; the participant page
+//   passes its own, participant_annotate.js)
+// @param quote (text, source) => the quote block for the selected +text+
+//   (annotations.js quoteBlock by default), or null for no text
 // @param doc, win the page's document and window
 // @return {schedule(), hide(), el}; schedule() re-reads the selection on the
 //   next frame (call it on scroll)
 export function createAnnotateBar({
   presets, canAnnotate, roots, isLive, onQuote, actions = () => [], running = () => false, onAction = () => {},
-  dock = () => null, doc = globalThis.document, win = globalThis.window,
+  dock = () => null, source: sourceOf = annotationSource, quote = quoteBlock,
+  doc = globalThis.document, win = globalThis.window,
 }) {
   const bar = doc.createElement("div");
   bar.id = "annotateBar";
@@ -131,7 +138,7 @@ export function createAnnotateBar({
     if (!canAnnotate() || !sel || sel.isCollapsed || !sel.rangeCount) return hide();
     const range = sel.getRangeAt(0);
     if (!roots().some((root) => root.contains(range.startContainer))) return hide();
-    const source = annotationSource(range.startContainer);
+    const source = sourceOf(range.startContainer);
     // A running turn's narration box shows complete sentences and its thinking
     // is appended by delta; a selection in either is refused while the step is
     // live — the quote lands once it closes (then on the full text).
@@ -140,7 +147,7 @@ export function createAnnotateBar({
     const clipped = range.cloneRange();
     if (!source.root.contains(range.endContainer)) clipped.setEnd(source.root, source.root.childNodes.length);
     const raw = clipped.toString();
-    const block = quoteBlock(raw, source);
+    const block = quote(raw, source);
     if (!block) return hide();
     pendingQuote = block;
     pendingFields = selectionFields(raw, source);