@opengeni/api-router 2.5.0 → 2.6.4-canary.0

package/src/model-catalog.ts

@@ -1,62 +1,55 @@
 import {
-  configuredModels,
-  configuredProviders,
-  withCodexCatalogProvider,
-  withXaiSubscriptionCatalogProvider,
-  withWorkspaceGatewayCatalogProvider,
+  OPENROUTER_PROVIDER_ID,
+  WORKSPACE_OPENROUTER_PROVIDER_ID,
   type ConfiguredModel,
-  type Settings,
 } from "@opengeni/config";
 import {
   ClientModel,
   WorkspaceModelCatalogResponse,
-  evaluateWorkspaceModelPolicy,
-  type ModelAvailabilityV1,
-  type ModelCredentialReadinessV1,
   type WorkspaceModelCatalogResponse as WorkspaceModelCatalogResponseType,
-  type WorkspaceModelPolicyContract,
 } from "@opengeni/contracts";
+import { resolveWorkspaceModelSelection, type WorkspaceModelSelectionInput } from "@opengeni/core";
 
-export type ModelAvailabilityObservation = {
-  status: "available" | "degraded" | "unavailable";
-  reason: "not_entitled" | "provider_unhealthy" | null;
-  checkedAt: string;
-};
-
-export type ModelCredentialReadinessObservation =
-  | { status: "ready"; checkedAt: string }
-  | {
-      status: "not_ready";
-      reason: "prerequisites_missing" | "needs_reauth";
-      checkedAt: string;
-    }
-  | { status: "error"; reason: "resolver_error"; checkedAt: string };
-
-export const MODEL_CREDENTIAL_READINESS_OBSERVATION_MAX_AGE_MS = 5 * 60_000;
+export {
+  MODEL_CREDENTIAL_READINESS_OBSERVATION_MAX_AGE_MS,
+  type ModelAvailabilityObservation,
+  type ModelCredentialReadinessObservation,
+} from "@opengeni/core";
 
 /** Static, client-safe definition projection. No provider secret is reachable. */
 export function projectClientModel(model: ConfiguredModel): ClientModel {
   const anonymousProvider =
     model.credentialSource.kind === "deployment" && model.credentialSource.mechanism === "none";
+  // Keep the established closed `source` enum compatible for older same-major
+  // clients. OpenRouter remains truthfully identified by its public provider
+  // id/label and billing metadata; omitting this optional legacy grouping field
+  // lets tolerant older contracts parse the additive provider.
   const source =
-    model.credentialSource.kind === "connected_subscription"
-      ? model.credentialSource.provider === "xai"
-        ? "supergrok"
-        : "codex"
-      : model.credentialSource.kind === "workspace_connection"
-        ? "workspace_gateway"
-        : anonymousProvider
-          ? undefined
-          : "opengeni";
+    model.providerId === OPENROUTER_PROVIDER_ID ||
+    model.providerId === WORKSPACE_OPENROUTER_PROVIDER_ID
+      ? undefined
+      : model.credentialSource.kind === "connected_subscription"
+        ? model.credentialSource.provider === "xai"
+          ? "supergrok"
+          : "codex"
+        : model.credentialSource.kind === "workspace_connection"
+          ? "workspace_gateway"
+          : anonymousProvider
+            ? undefined
+            : "opengeni";
   const publicProvider = anonymousProvider
     ? { provider: model.providerId, providerLabel: model.providerLabel }
-    : source === "codex"
-      ? { provider: "codex", providerLabel: "Codex" }
-      : source === "supergrok"
-        ? { provider: "supergrok", providerLabel: "SuperGrok" }
-        : source === "workspace_gateway"
-          ? { provider: "workspace-gateway", providerLabel: "Your Gateway" }
-          : { provider: "opengeni", providerLabel: "OpenGeni" };
+    : model.providerId === OPENROUTER_PROVIDER_ID
+      ? { provider: "openrouter", providerLabel: "OpenRouter" }
+      : model.providerId === WORKSPACE_OPENROUTER_PROVIDER_ID
+        ? { provider: "workspace-openrouter", providerLabel: "Your OpenRouter" }
+        : source === "codex"
+          ? { provider: "codex", providerLabel: "Codex" }
+          : source === "supergrok"
+            ? { provider: "supergrok", providerLabel: "SuperGrok" }
+            : source === "workspace_gateway"
+              ? { provider: "workspace-gateway", providerLabel: "Your Gateway" }
+              : { provider: "opengeni", providerLabel: "OpenGeni" };
   return ClientModel.parse({
     id: model.id,
     label: model.label,
@@ -71,243 +64,13 @@ export function projectClientModel(model: ConfiguredModel): ClientModel {
     aliases: model.aliases,
     executionLimits: model.executionLimits,
     billing: model.billing,
+    cost: model.cost,
     capabilities: model.capabilities,
     ...(model.pricing === undefined ? {} : { pricing: model.pricing }),
     definitionVersion: model.definitionVersion,
   });
 }
 
-function modelDefinitionRunnable(model: ConfiguredModel): boolean {
-  return (
-    model.capabilities.inputModalities.includes("text") &&
-    model.capabilities.outputModalities.includes("text") &&
-    model.capabilities.transports.sse.runnable
-  );
-}
-
-function observedCredentialReadiness(input: {
-  observation: ModelCredentialReadinessObservation | undefined;
-  basis: "connection" | "resolver";
-  nowMs: number;
-  maxAgeMs: number;
-}): ModelCredentialReadinessV1 {
-  if (!input.observation) {
-    return {
-      status: "not_ready",
-      reason: "prerequisites_missing",
-      basis: input.basis,
-      checkedAt: null,
-    };
-  }
-  const checkedAtMs = Date.parse(input.observation.checkedAt);
-  if (!Number.isFinite(checkedAtMs)) {
-    return {
-      status: "error",
-      reason: "resolver_error",
-      basis: input.basis,
-      checkedAt: null,
-    };
-  }
-  const checkedAt = new Date(checkedAtMs).toISOString();
-  if (Math.abs(input.nowMs - checkedAtMs) > input.maxAgeMs) {
-    return {
-      status: "not_ready",
-      reason: "observation_stale",
-      basis: input.basis,
-      checkedAt,
-    };
-  }
-  if (input.observation.status === "ready") {
-    return { status: "ready", reason: null, basis: input.basis, checkedAt };
-  }
-  if (input.observation.status === "not_ready") {
-    return {
-      status: "not_ready",
-      reason:
-        input.observation.reason === "needs_reauth" ? "needs_reauth" : "prerequisites_missing",
-      basis: input.basis,
-      checkedAt,
-    };
-  }
-  return {
-    status: "error",
-    reason: "resolver_error",
-    basis: input.basis,
-    checkedAt,
-  };
-}
-
-function credentialReadinessFor(input: {
-  model: ConfiguredModel;
-  provider: ReturnType<typeof configuredProviders>[number] | undefined;
-  codexSubscriptionActive: boolean;
-  xaiSubscriptionActive: boolean;
-  workspaceGatewayConnectionActive: boolean;
-  observation: ModelCredentialReadinessObservation | undefined;
-  nowMs: number;
-  maxAgeMs: number;
-}): ModelCredentialReadinessV1 {
-  const source = input.model.credentialSource;
-  if (source.kind === "connected_subscription") {
-    const active =
-      source.provider === "xai" ? input.xaiSubscriptionActive : input.codexSubscriptionActive;
-    return active
-      ? { status: "ready", reason: null, basis: "connection", checkedAt: null }
-      : {
-          status: "not_ready",
-          reason: "needs_reauth",
-          basis: "connection",
-          checkedAt: null,
-        };
-  }
-  if (source.kind === "workspace_connection") {
-    return input.workspaceGatewayConnectionActive
-      ? { status: "ready", reason: null, basis: "connection", checkedAt: null }
-      : {
-          status: "not_ready",
-          reason: "needs_reauth",
-          basis: "connection",
-          checkedAt: null,
-        };
-  }
-  if (source.kind === "deployment" && source.mechanism === "none") {
-    return { status: "ready", reason: null, basis: "configuration", checkedAt: null };
-  }
-  if (source.kind === "deployment" && source.mechanism === "api_key") {
-    return input.provider?.apiKey
-      ? { status: "ready", reason: null, basis: "configuration", checkedAt: null }
-      : {
-          status: "not_ready",
-          reason: "missing_credential",
-          basis: "configuration",
-          checkedAt: null,
-        };
-  }
-  return observedCredentialReadiness({
-    observation: input.observation,
-    basis: "resolver",
-    nowMs: input.nowMs,
-    maxAgeMs: input.maxAgeMs,
-  });
-}
-
-function isXaiGrokModel(model: ConfiguredModel): boolean {
-  return model.providerId === "xai" && model.id.startsWith("xai/grok-");
-}
-
-function observationTimestamp(observation: ModelAvailabilityObservation | undefined): {
-  checkedAt: string | null;
-  checkedAtMs: number | null;
-} {
-  if (!observation || typeof observation.checkedAt !== "string") {
-    return { checkedAt: null, checkedAtMs: null };
-  }
-  const checkedAtMs = Date.parse(observation.checkedAt);
-  if (!Number.isFinite(checkedAtMs)) {
-    return { checkedAt: null, checkedAtMs: null };
-  }
-  return { checkedAt: new Date(checkedAtMs).toISOString(), checkedAtMs };
-}
-
-function xaiGrokAvailabilityFor(input: {
-  observation: ModelAvailabilityObservation | undefined;
-  nowMs: number;
-  maxAgeMs: number;
-}): ModelAvailabilityV1 {
-  const { checkedAt, checkedAtMs } = observationTimestamp(input.observation);
-  const freshSuccessfulObservation =
-    input.observation?.status === "available" &&
-    input.observation.reason === null &&
-    checkedAtMs !== null &&
-    checkedAtMs <= input.nowMs &&
-    input.nowMs - checkedAtMs <= input.maxAgeMs;
-
-  if (freshSuccessfulObservation) {
-    return {
-      status: "available",
-      selectable: true,
-      reason: null,
-      checkedAt,
-    };
-  }
-
-  return {
-    status: "unavailable",
-    selectable: false,
-    reason:
-      input.observation?.status === "unavailable"
-        ? (input.observation.reason ?? "provider_unhealthy")
-        : "provider_unhealthy",
-    checkedAt,
-  };
-}
-
-function availabilityFor(input: {
-  model: ConfiguredModel;
-  credentialReadiness: ModelCredentialReadinessV1;
-  policyAllowed: boolean;
-  observation?: ModelAvailabilityObservation | undefined;
-  nowMs: number;
-  maxAgeMs: number;
-}): ModelAvailabilityV1 {
-  if (!modelDefinitionRunnable(input.model)) {
-    return {
-      status: "unavailable",
-      selectable: false,
-      reason: "unsupported",
-      checkedAt: null,
-    };
-  }
-  if (input.credentialReadiness.status !== "ready") {
-    return {
-      status: "unavailable",
-      selectable: false,
-      reason:
-        input.credentialReadiness.reason === "missing_credential"
-          ? "missing_credential"
-          : input.credentialReadiness.reason === "needs_reauth"
-            ? "needs_reauth"
-            : "credential_not_ready",
-      checkedAt: input.credentialReadiness.checkedAt,
-    };
-  }
-  if (!input.policyAllowed) {
-    return {
-      status: "unavailable",
-      selectable: false,
-      reason: "policy_blocked",
-      checkedAt: null,
-    };
-  }
-  if (isXaiGrokModel(input.model)) {
-    return xaiGrokAvailabilityFor({
-      observation: input.observation,
-      nowMs: input.nowMs,
-      maxAgeMs: input.maxAgeMs,
-    });
-  }
-  if (!input.observation) {
-    // Credential readiness and policy are known-good, but no current
-    // provider-health observation is available. Unknown is intentionally
-    // selectable; the execution boundary rechecks all authoritative gates.
-    return { status: "unknown", selectable: true, reason: null, checkedAt: null };
-  }
-  if (input.observation.status === "unavailable") {
-    return {
-      status: "unavailable",
-      selectable: false,
-      reason: input.observation.reason ?? "provider_unhealthy",
-      checkedAt: input.observation.checkedAt,
-    };
-  }
-  return {
-    status: input.observation.status,
-    selectable: true,
-    reason: null,
-    checkedAt: input.observation.checkedAt,
-  };
-}
-
 /**
  * Authenticated workspace catalog. Codex definitions are included only when
  * the deployment enables that connection type; concrete readiness is supplied
@@ -316,69 +79,14 @@ function availabilityFor(input: {
  * successful typed resolver observation; credential health and provider health
  * are separate inputs and neither is fabricated.
  */
-export function buildWorkspaceModelCatalog(input: {
-  settings: Settings;
-  policy: WorkspaceModelPolicyContract | null;
-  codexSubscriptionActive: boolean;
-  xaiSubscriptionActive?: boolean;
-  workspaceGatewayConnectionActive?: boolean;
-  credentialReadinessObservations?:
-    | Readonly<Record<string, ModelCredentialReadinessObservation>>
-    | undefined;
-  observations?: Readonly<Record<string, ModelAvailabilityObservation>> | undefined;
-  now?: Date | undefined;
-  credentialReadinessMaxAgeMs?: number | undefined;
-}): WorkspaceModelCatalogResponseType {
-  const codexSettings = input.settings.codexSubscriptionEnabled
-    ? withCodexCatalogProvider(input.settings)
-    : input.settings;
-  const xaiSettings = input.settings.supergrokSubscriptionEnabled
-    ? withXaiSubscriptionCatalogProvider(codexSettings)
-    : codexSettings;
-  const catalogSettings = withWorkspaceGatewayCatalogProvider(xaiSettings);
-  const providers = new Map(
-    configuredProviders(catalogSettings).map((provider) => [provider.id, provider]),
-  );
-  const requestedNowMs = input.now?.getTime();
-  const nowMs =
-    typeof requestedNowMs === "number" && Number.isFinite(requestedNowMs)
-      ? requestedNowMs
-      : Date.now();
-  const maxAgeMs =
-    typeof input.credentialReadinessMaxAgeMs === "number" &&
-    Number.isFinite(input.credentialReadinessMaxAgeMs) &&
-    input.credentialReadinessMaxAgeMs >= 0
-      ? input.credentialReadinessMaxAgeMs
-      : MODEL_CREDENTIAL_READINESS_OBSERVATION_MAX_AGE_MS;
-  const models = configuredModels(catalogSettings).map((model) => {
-    const provider = providers.get(model.providerId);
-    const policyAllowed = evaluateWorkspaceModelPolicy(input.policy, {
-      providerId: model.providerId,
-      modelId: model.id,
-    }).allowed;
-    const credentialReadiness = credentialReadinessFor({
-      model,
-      provider,
-      codexSubscriptionActive: input.codexSubscriptionActive,
-      xaiSubscriptionActive: input.xaiSubscriptionActive === true,
-      workspaceGatewayConnectionActive: input.workspaceGatewayConnectionActive === true,
-      observation: input.credentialReadinessObservations?.[model.definitionVersion],
-      nowMs,
-      maxAgeMs,
-    });
-    return {
-      ...projectClientModel(model),
-      credentialReadiness,
-      policyAllowed,
-      availability: availabilityFor({
-        model,
-        credentialReadiness,
-        policyAllowed,
-        observation: input.observations?.[model.definitionVersion],
-        nowMs,
-        maxAgeMs,
-      }),
-    };
-  });
+export function buildWorkspaceModelCatalog(
+  input: WorkspaceModelSelectionInput,
+): WorkspaceModelCatalogResponseType {
+  const models = resolveWorkspaceModelSelection(input).map((selection) => ({
+    ...projectClientModel(selection.model),
+    credentialReadiness: selection.credentialReadiness,
+    policyAllowed: selection.policyAllowed,
+    availability: selection.availability,
+  }));
   return WorkspaceModelCatalogResponse.parse({ models });
 }

package/src/routes/api-integrations.ts

@@ -148,7 +148,7 @@ export function registerApiIntegrationRoutes(
 
   app.post("/v1/workspaces/:workspaceId/integrations/install", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");
     const payload = InstallApiIntegrationRequest.parse(await c.req.json());
     const resolved = await resolveForRoute({
       deps,
@@ -261,7 +261,7 @@ export function registerApiIntegrationRoutes(
     "/v1/workspaces/:workspaceId/integrations/:capabilityId/instances/:instanceKey",
     async (c) => {
       const workspaceId = c.req.param("workspaceId");
-      const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
+      const grant = await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");
       const capabilityId = decodeURIComponent(c.req.param("capabilityId"));
       const instanceKey = decodeURIComponent(c.req.param("instanceKey"));
       const payload = UninstallApiIntegrationRequest.parse(await c.req.json());

package/src/routes/api-keys.ts

@@ -1,12 +1,41 @@
-import { CreateApiKeyRequest, CreateApiKeyResponse, Permission } from "@opengeni/contracts";
-import { createApiKey, listApiKeys, revokeApiKey } from "@opengeni/db";
+import {
+  CreateApiKeyRequest,
+  CreateApiKeyResponse,
+  CreateOrganizationApiKeyRequest,
+  Permission,
+  type AccessContext,
+} from "@opengeni/contracts";
+import {
+  createApiKey,
+  createOrganizationApiKey as createOrganizationApiKeyRecord,
+  listApiKeys,
+  listOrganizationApiKeys,
+  OrganizationApiKeyLimitExceededError,
+  revokeApiKey,
+  revokeOrganizationApiKey,
+} from "@opengeni/db";
+import { configuredStaticUsageLimits } from "@opengeni/config";
 import { zValidator } from "@hono/zod-validator";
 import type { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import type { ApiRouteDeps } from "@opengeni/core";
-import { requireAccessGrant } from "@opengeni/core";
+import {
+  accountScopedApiKeyWorkspaceAuthority,
+  requireAccessContext,
+  requireAccessGrant,
+  requireAccessGrantAuthorization,
+  type AccessGrantAuthorization,
+} from "@opengeni/core";
 import { requireLimit } from "@opengeni/core";
 
+export const organizationApiKeyPermissions: Permission[] = [
+  "account:read",
+  "workspace:create",
+  "workspace:read",
+  "workspace:admin",
+  "api_keys:manage",
+];
+
 export function registerApiKeyRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.get("/v1/workspaces/:workspaceId/api-keys", async (c) => {
     const workspaceId = c.req.param("workspaceId");
@@ -19,11 +48,17 @@ export function registerApiKeyRoutes(app: Hono, deps: ApiRouteDeps): void {
     zValidator("json", CreateApiKeyRequest.omit({ workspaceId: true })),
     async (c) => {
       const workspaceId = c.req.param("workspaceId");
-      const grant = await requireAccessGrant(c, deps, workspaceId, "api_keys:manage");
+      const authorization = await requireAccessGrantAuthorization(
+        c,
+        deps,
+        workspaceId,
+        "api_keys:manage",
+      );
+      const grant = authorization.grant;
       const body = c.req.valid("json");
       const permissions: Permission[] =
         body.permissions.length > 0 ? (body.permissions as Permission[]) : ["workspace:read"];
-      ensureDelegablePermissions(grant.permissions, permissions);
+      ensureDelegablePermissions(authorization, permissions);
       await requireLimit(deps, {
         accountId: grant.accountId,
         workspaceId,
@@ -51,12 +86,90 @@ export function registerApiKeyRoutes(app: Hono, deps: ApiRouteDeps): void {
     await requireAccessGrant(c, deps, workspaceId, "api_keys:manage");
     return c.json(await revokeApiKey(deps.db, workspaceId, c.req.param("apiKeyId")));
   });
+
+  app.get("/v1/organizations/:organizationId/api-keys", async (c) => {
+    const organizationId = c.req.param("organizationId");
+    const context = await requireAccessContext(c, deps);
+    requireOrganizationApiKeyControlPermission(context, organizationId);
+    return c.json({ apiKeys: await listOrganizationApiKeys(deps.db, organizationId) });
+  });
+
+  app.post(
+    "/v1/organizations/:organizationId/api-keys",
+    zValidator("json", CreateOrganizationApiKeyRequest),
+    async (c) => {
+      const organizationId = c.req.param("organizationId");
+      const context = await requireAccessContext(c, deps);
+      requireOrganizationApiKeyControlPermission(context, organizationId);
+      const body = c.req.valid("json");
+      const token = generateApiKeyToken();
+      try {
+        const apiKey = await createOrganizationApiKeyRecord(deps.db, {
+          accountId: organizationId,
+          name: body.name,
+          description: body.description ?? null,
+          prefix: token.slice(0, 14),
+          keyHash: await sha256Hex(token),
+          permissions: organizationApiKeyPermissions,
+          expiresAt: body.expiresAt ? new Date(body.expiresAt) : null,
+          maxActiveKeys: organizationApiKeyLimit(deps),
+          rotationSourceApiKeyId: authenticatedApiKeyId(context),
+        });
+        return c.json(CreateApiKeyResponse.parse({ apiKey, token }), 201);
+      } catch (error) {
+        if (error instanceof OrganizationApiKeyLimitExceededError) {
+          throw new HTTPException(429, { message: error.message });
+        }
+        throw error;
+      }
+    },
+  );
+
+  app.delete("/v1/organizations/:organizationId/api-keys/:apiKeyId", async (c) => {
+    const organizationId = c.req.param("organizationId");
+    const context = await requireAccessContext(c, deps);
+    requireOrganizationApiKeyControlPermission(context, organizationId);
+    const apiKey = await revokeOrganizationApiKey(deps.db, organizationId, c.req.param("apiKeyId"));
+    if (!apiKey) {
+      throw new HTTPException(404, { message: "API key not found" });
+    }
+    return c.json(apiKey);
+  });
+}
+
+function requireAccountPermission(
+  context: AccessContext,
+  accountId: string,
+  permission: Permission,
+): void {
+  const grant = context.accountGrants.find((candidate) => candidate.accountId === accountId);
+  if (
+    !grant ||
+    (!grant.permissions.includes(permission) && !grant.permissions.includes("account:admin"))
+  ) {
+    throw new HTTPException(403, { message: `missing permission: ${permission}` });
+  }
 }
 
-function ensureDelegablePermissions(grantPermissions: Permission[], requested: Permission[]): void {
+function ensureDelegablePermissions(
+  authorization: AccessGrantAuthorization,
+  requested: Permission[],
+): void {
+  const grantPermissions = authorization.grant.permissions;
   if (grantPermissions.includes("workspace:admin")) {
+    const accountLiteralPermissions = new Set<Permission>([
+      "account:read",
+      "account:admin",
+      "workspace:create",
+      "billing:read",
+      "billing:manage",
+    ]);
+    const workspaceLiteralPermissions = new Set<Permission>(["members:manage", "secrets:read"]);
     const highTrustMissing = requested.filter(
-      (permission) => permission === "secrets:read" && !grantPermissions.includes("secrets:read"),
+      (permission) =>
+        (accountLiteralPermissions.has(permission) &&
+          !authorization.accountGrant?.permissions.includes(permission)) ||
+        (workspaceLiteralPermissions.has(permission) && !grantPermissions.includes(permission)),
     );
     if (highTrustMissing.length === 0) return;
     throw new HTTPException(403, {
@@ -71,6 +184,35 @@ function ensureDelegablePermissions(grantPermissions: Permission[], requested: P
   }
 }
 
+function requireOrganizationApiKeyControlPermission(
+  context: AccessContext,
+  organizationId: string,
+): void {
+  requireAccountPermission(context, organizationId, "api_keys:manage");
+  if (!context.subjectId.startsWith("api_key:")) return;
+  const authority = accountScopedApiKeyWorkspaceAuthority(context);
+  if (
+    !authority ||
+    authority.accountId !== organizationId ||
+    !authority.permissions.includes("api_keys:manage")
+  ) {
+    throw new HTTPException(403, { message: "organization API key authority required" });
+  }
+}
+
+function authenticatedApiKeyId(context: AccessContext): string | null {
+  return context.subjectId.startsWith("api_key:")
+    ? context.subjectId.slice("api_key:".length)
+    : null;
+}
+
+function organizationApiKeyLimit(deps: ApiRouteDeps): number | null {
+  if (deps.settings.usageLimitsMode !== "static" && deps.settings.usageLimitsMode !== "managed") {
+    return null;
+  }
+  return configuredStaticUsageLimits(deps.settings).maxApiKeysPerWorkspace ?? null;
+}
+
 function generateApiKeyToken(): string {
   const bytes = new Uint8Array(32);
   crypto.getRandomValues(bytes);