@opengeni/contracts 2.15.2 → 3.0.1-canary.0

package/src/connect.ts

@@ -0,0 +1,202 @@
+import { z } from "zod";
+import { IntegrationInstanceKey, IntegrationSource } from "./index";
+
+const opaqueId = z.string().min(1).max(512);
+export const ConnectOwnership = z.enum(["personal", "workspace"]);
+export type ConnectOwnership = z.infer<typeof ConnectOwnership>;
+export const ConnectProvider = z
+  .object({
+    id: opaqueId,
+    label: z.string().min(1).max(256),
+    family: opaqueId,
+    readiness: z.enum(["available", "needs_configuration", "operator_only", "unsupported"]),
+    reason: z.string().max(1024).optional(),
+    ownership: z.array(ConnectOwnership).max(2),
+    setup: z
+      .array(
+        z.enum(["none", "oauth", "credentials", "device", "installation", "openapi", "graphql"]),
+      )
+      .max(7),
+  })
+  .strict();
+export type ConnectProvider = z.infer<typeof ConnectProvider>;
+export const ConnectAccount = z
+  .object({
+    id: opaqueId,
+    providerId: opaqueId,
+    version: z.number().int().positive().optional(),
+    label: z.string().max(256),
+    ownership: ConnectOwnership,
+    status: z.enum(["connected", "auth_needed", "disabled"]),
+  })
+  .strict();
+export type ConnectAccount = z.infer<typeof ConnectAccount>;
+export const ConnectResource = z
+  .object({ id: opaqueId, label: z.string().max(512), kind: opaqueId })
+  .strict();
+export type ConnectResource = z.infer<typeof ConnectResource>;
+export const ConnectNextAction = z.discriminatedUnion("type", [
+  z.object({ type: z.literal("authorize"), url: z.string().url().max(16_384) }).strict(),
+  z
+    .object({
+      type: z.literal("credentials"),
+      fields: z
+        .array(
+          z
+            .object({
+              name: opaqueId,
+              label: z.string().max(256),
+              required: z.boolean(),
+              secret: z.boolean(),
+              options: z
+                .array(z.object({ value: opaqueId, label: z.string().max(512) }).strict())
+                .max(1000)
+                .optional(),
+            })
+            .strict(),
+        )
+        .max(32),
+    })
+    .strict(),
+  z
+    .object({
+      type: z.literal("wait"),
+      pollAfterMs: z.number().int().min(250).max(60_000),
+      userCode: z.string().max(128).optional(),
+      verificationUrl: z.string().url().max(2048).optional(),
+    })
+    .strict(),
+  z
+    .object({ type: z.literal("select_account"), accounts: z.array(ConnectAccount).max(100) })
+    .strict(),
+  z
+    .object({
+      type: z.literal("select_resources"),
+      resources: z.array(ConnectResource).max(100),
+      cursor: z.string().max(2048).optional(),
+    })
+    .strict(),
+  z
+    .object({
+      type: z.literal("preview"),
+      previewId: opaqueId,
+      contentHash: opaqueId,
+      operations: z.array(ConnectResource).max(2000),
+    })
+    .strict(),
+  z.object({ type: z.literal("none") }).strict(),
+]);
+export type ConnectNextAction = z.infer<typeof ConnectNextAction>;
+export const ConnectInstallationTarget = z
+  .object({
+    instanceKey: IntegrationInstanceKey,
+    displayName: z.string().min(1).max(200),
+    expectedInstanceVersion: z.number().int().positive().optional(),
+  })
+  .strict();
+export type ConnectInstallationTarget = z.infer<typeof ConnectInstallationTarget>;
+export const ConnectAttemptState = z.enum([
+  "ready",
+  "requires_user_action",
+  "credential_input",
+  "provider_wait",
+  "account_selection",
+  "resource_selection",
+  "preview",
+  "installing",
+  "connected_but_incomplete",
+  "complete",
+  "cancelled",
+  "expired",
+  "failed",
+  "uncertain",
+]);
+export const ConnectAttempt = z
+  .object({
+    id: opaqueId,
+    workspaceId: opaqueId,
+    providerId: opaqueId,
+    ownership: ConnectOwnership,
+    revision: z.number().int().positive(),
+    state: ConnectAttemptState,
+    credentialsCommitted: z.boolean(),
+    integrationInstalled: z.boolean(),
+    completionRequirement: z.enum(["connection", "integration", "provider_setup"]),
+    nextAction: ConnectNextAction,
+    expiresAt: z.string().datetime({ offset: true }),
+    account: ConnectAccount.optional(),
+    installationTarget: ConnectInstallationTarget.optional(),
+    source: IntegrationSource.optional(),
+    error: z
+      .object({ code: opaqueId, message: z.string().max(2048), retryable: z.boolean() })
+      .strict()
+      .optional(),
+  })
+  .strict()
+  .superRefine((value, context) => {
+    if (
+      value.state === "complete" &&
+      value.completionRequirement === "integration" &&
+      !value.integrationInstalled
+    ) {
+      context.addIssue({
+        code: "custom",
+        message: "Complete setup requires an installed integration",
+      });
+    }
+    if (
+      value.state === "complete" &&
+      value.completionRequirement === "connection" &&
+      !value.credentialsCommitted
+    ) {
+      context.addIssue({
+        code: "custom",
+        message: "Connection setup requires committed credentials",
+      });
+    }
+    if (
+      ["complete", "cancelled", "expired"].includes(value.state) &&
+      value.nextAction.type !== "none"
+    ) {
+      context.addIssue({ code: "custom", message: "A terminal setup has no next action" });
+    }
+  });
+export type ConnectAttempt = z.infer<typeof ConnectAttempt>;
+export const ConnectAdvance = z.discriminatedUnion("type", [
+  z
+    .object({
+      type: z.literal("credentials"),
+      values: z.record(z.string().max(256), z.string().max(16_384)),
+    })
+    .strict(),
+  z.object({ type: z.literal("account"), accountId: opaqueId }).strict(),
+  z.object({ type: z.literal("resources"), resourceIds: z.array(opaqueId).max(1000) }).strict(),
+  z
+    .object({
+      type: z.literal("install"),
+      previewId: opaqueId,
+      contentHash: opaqueId,
+      operationIds: z.array(opaqueId).max(2000),
+    })
+    .strict(),
+  z.object({ type: z.literal("retry") }).strict(),
+]);
+export type ConnectAdvance = z.infer<typeof ConnectAdvance>;
+export const ConnectOperationRequest = z
+  .object({
+    expectedRevision: z.number().int().positive().safe(),
+    idempotencyKey: opaqueId,
+  })
+  .strict();
+export const AdvanceConnectRequest = ConnectOperationRequest.extend({ action: ConnectAdvance });
+export const BeginConnectRequest = z
+  .object({
+    providerId: opaqueId,
+    ownership: ConnectOwnership,
+    // URL parsing validates separately; never transform this original string.
+    returnUrl: z.string().min(1).max(4096),
+    idempotencyKey: opaqueId,
+    reconnectAccountId: opaqueId.optional(),
+    installationTarget: ConnectInstallationTarget.optional(),
+  })
+  .strict();

package/src/external-identities.ts

@@ -0,0 +1,213 @@
+import { z } from "zod";
+import { Permission } from "./permissions";
+
+// External identifiers are opaque, case-sensitive strings. In particular a
+// native-looking identifier is still host data, never a native subject claim.
+// Bound bytes, not just JS code units: these values share a PostgreSQL B-tree
+// index entry. Never normalize/truncate an identifier to make it fit, and reject
+// text that the driver would replace or PostgreSQL cannot represent.
+const encoder = new TextEncoder();
+function opaqueText(maxBytes: number) {
+  return z
+    .string()
+    .min(1)
+    .max(maxBytes)
+    .refine(
+      (value) =>
+        !value.includes("\0") &&
+        !/[\uD800-\uDFFF]/u.test(value) &&
+        encoder.encode(value).byteLength <= maxBytes,
+      {
+        message: `Identifier must be valid PostgreSQL Unicode text of at most ${maxBytes} UTF-8 bytes`,
+      },
+    );
+}
+const externalId = opaqueText(1024);
+const source = opaqueText(200);
+const externalSubject = z
+  .string()
+  .regex(/^external_user:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$(?![\s\S])/);
+const nativeSubject = z
+  .string()
+  .min(1)
+  .max(1024)
+  .regex(/^user:[^\r\n]+$(?![\s\S])/);
+export const ExternalIdentityReference = z
+  .object({
+    externalId,
+    source: source.default("default"),
+  })
+  .strict();
+export type ExternalIdentityReference = z.infer<typeof ExternalIdentityReference>;
+
+export const AddExternalWorkspaceMemberRequest = z
+  .object({
+    identity: ExternalIdentityReference,
+    permissions: z.array(Permission).min(1).max(Permission.options.length),
+  })
+  .strict();
+export type AddExternalWorkspaceMemberRequest = z.infer<typeof AddExternalWorkspaceMemberRequest>;
+
+/** Uses the organization membership ID returned by lazy identity admission.
+ * Reactivation restores admission only, not revoked work or workspace grants. */
+export const UpdateExternalIdentityMembershipRequest = z
+  .object({
+    kind: z.enum(["suspend", "reactivate", "offboard"]),
+    expectedAuthorizationRevision: z.number().int().positive().safe(),
+    operationId: z.string().uuid(),
+    reason: z.string().max(512).optional(),
+  })
+  .strict();
+export type UpdateExternalIdentityMembershipRequest = z.infer<
+  typeof UpdateExternalIdentityMembershipRequest
+>;
+
+export const ExternalActorSelection = z.discriminatedUnion("mode", [
+  z.object({ mode: z.literal("external"), identity: ExternalIdentityReference }).strict(),
+  z
+    .object({
+      mode: z.literal("linked_native"),
+      identity: ExternalIdentityReference,
+      linkId: z.string().uuid(),
+      expectedLinkRevision: z.number().int().positive().safe(),
+    })
+    .strict(),
+]);
+export type ExternalActorSelection = z.infer<typeof ExternalActorSelection>;
+
+export const ExternalIdentity = z
+  .object({
+    id: z.string().uuid(),
+    accountId: z.string().uuid(),
+    source,
+    externalId,
+    subjectId: externalSubject,
+    organizationMembershipId: z.string().uuid(),
+    personalWorkspaceId: z.string().uuid(),
+    status: z.enum(["active", "disabled", "revoked"]),
+    authorizationRevision: z.number().int().positive().safe(),
+  })
+  .strict();
+export type ExternalIdentity = z.infer<typeof ExternalIdentity>;
+
+// Audit attribution, not authentication. Only the canonical access resolver
+// may establish provenance; accepting this JSON from a browser proves nothing.
+export const ExternalActorAttribution = z
+  .object({
+    accountId: z.string().uuid(),
+    authenticatingApiKeyId: z.string().uuid(),
+    externalIdentityId: z.string().uuid(),
+    externalSubjectId: externalSubject,
+    externalAuthorizationRevision: z.number().int().positive().safe(),
+    effectiveSubjectId: z.string().min(1).max(1024),
+    actingMode: z.enum(["external", "linked_native"]),
+    linkId: z.string().uuid().optional(),
+    linkRevision: z.number().int().positive().safe().optional(),
+  })
+  .strict()
+  .superRefine((value, context) => {
+    if (value.actingMode === "external") {
+      if (
+        value.effectiveSubjectId !== value.externalSubjectId ||
+        value.linkId !== undefined ||
+        value.linkRevision !== undefined
+      ) {
+        context.addIssue({
+          code: "custom",
+          message: "External mode cannot delegate native identity",
+        });
+      }
+    } else if (
+      !value.linkId ||
+      !value.linkRevision ||
+      !nativeSubject.safeParse(value.effectiveSubjectId).success
+    ) {
+      context.addIssue({
+        code: "custom",
+        message: "Linked mode requires exact native delegation provenance",
+      });
+    }
+  });
+export type ExternalActorAttribution = z.infer<typeof ExternalActorAttribution>;
+
+/** Server-signed/encrypted continuation data, never sufficient live authority. */
+export const ExternalActorContinuation = z
+  .object({
+    identity: ExternalIdentityReference,
+    actor: ExternalActorAttribution,
+  })
+  .strict();
+export type ExternalActorContinuation = z.infer<typeof ExternalActorContinuation>;
+
+export const ExternalIdentityLink = z
+  .object({
+    id: z.string().uuid(),
+    accountId: z.string().uuid(),
+    externalIdentityId: z.string().uuid(),
+    externalIdentity: ExternalIdentityReference.optional(),
+    nativeSubjectId: nativeSubject.nullable(),
+    status: z.enum(["pending", "active", "revoked", "expired"]),
+    revision: z.number().int().positive().safe(),
+    permissions: z.array(Permission).max(Permission.options.length),
+    expiresAt: z.string().datetime({ offset: true }).nullable(),
+  })
+  .strict()
+  .refine(
+    (value) => value.status !== "active" || value.nativeSubjectId !== null,
+    "An active link requires a confirmed native identity",
+  );
+export type ExternalIdentityLink = z.infer<typeof ExternalIdentityLink>;
+
+export const ExternalIdentityLinkPage = z
+  .object({
+    links: z.array(ExternalIdentityLink).max(50),
+    nextCursor: z.string().uuid().nullable(),
+  })
+  .strict();
+export type ExternalIdentityLinkPage = z.infer<typeof ExternalIdentityLinkPage>;
+
+/** A native confirmation may narrow this request, never broaden it. The
+ * challenge is delivered once to the host and is not an authentication token. */
+export const BeginExternalIdentityLinkRequest = z
+  .object({
+    permissions: z.array(Permission).min(1).max(Permission.options.length),
+    expiresAt: z.string().datetime({ offset: true }).nullable().default(null),
+  })
+  .strict();
+export type BeginExternalIdentityLinkRequest = z.input<typeof BeginExternalIdentityLinkRequest>;
+export const ConfirmExternalIdentityLinkRequest = z
+  .object({
+    challenge: z.string().regex(/^[A-Za-z0-9_-]{43}$/),
+    expectedRevision: z.number().int().positive().safe(),
+    permissions: z.array(Permission).min(1).max(Permission.options.length),
+  })
+  .strict();
+export type ConfirmExternalIdentityLinkRequest = z.infer<typeof ConfirmExternalIdentityLinkRequest>;
+export const BeginExternalIdentityLinkResponse = z
+  .object({
+    link: ExternalIdentityLink,
+    challenge: z.string().regex(/^[A-Za-z0-9_-]{43}$/),
+    confirmBefore: z.string().datetime({ offset: true }),
+  })
+  .strict();
+export type BeginExternalIdentityLinkResponse = z.infer<typeof BeginExternalIdentityLinkResponse>;
+export const ExternalIdentityLinkPreview = z
+  .object({
+    link: ExternalIdentityLink,
+    externalIdentity: ExternalIdentityReference,
+    nativeSubjectId: nativeSubject,
+    organizationId: z.string().uuid(),
+  })
+  .strict();
+export type ExternalIdentityLinkPreview = z.infer<typeof ExternalIdentityLinkPreview>;
+
+/** Immutable accepted-work restriction, not a browser credential. Original key
+ * identity remains audit-only; durable use validates the live link and members. */
+export const ExternalLinkWorkSnapshot = z
+  .object({
+    identity: ExternalIdentityReference,
+    actor: ExternalActorAttribution.refine((value) => value.actingMode === "linked_native"),
+    permissions: z.array(Permission).max(Permission.options.length),
+  })
+  .strict();
+export type ExternalLinkWorkSnapshot = z.infer<typeof ExternalLinkWorkSnapshot>;

package/src/host-mcp-bindings.ts

@@ -0,0 +1,226 @@
+import { z } from "zod";
+export { HostMcpCreateSelections, type HostMcpCreateSelection } from "./index";
+import { McpServerConnectionRef, SessionTenancyVisibility } from "./index";
+import {
+  ConnectionUseAuthoritySnapshot,
+  IssueConnectionUseGrantRequest,
+} from "./connection-authority";
+import { ExternalIdentity } from "./external-identities";
+export const HostMcpOwnerSubject = z.union([
+  ExternalIdentity.shape.subjectId,
+  z
+    .string()
+    .max(4096)
+    .regex(/^user:[^\r\n\u0000]+$/),
+]);
+
+/** Credential-free, immutable destination and host connection selection. */
+export const HostMcpBindingDefinition = z
+  .object({
+    serverId: z.string().min(1).max(256),
+    destinationUrl: z
+      .string()
+      .url()
+      .max(4096)
+      .refine((value) => {
+        const url = new URL(value);
+        return url.protocol === "https:" && !url.username && !url.password && !url.hash;
+      }, "Host binding requires an HTTPS destination without userinfo or fragment")
+      .transform((value) => new URL(value).toString()),
+    connectionRef: McpServerConnectionRef,
+  })
+  .strict()
+  .superRefine((value, context) => {
+    if (value.connectionRef.hostBinding)
+      context.addIssue({
+        code: "custom",
+        path: ["connectionRef", "hostBinding"],
+        message: "A binding definition cannot reference another binding",
+      });
+    if (value.connectionRef.authoritySource !== "host" || !value.connectionRef.connectionId)
+      context.addIssue({
+        code: "custom",
+        path: ["connectionRef"],
+        message: "Explicit host connection authority is required",
+      });
+    if (new TextEncoder().encode(JSON.stringify(value)).byteLength > 65_536)
+      context.addIssue({ code: "custom", message: "Host binding definition exceeds 64 KiB" });
+  });
+export type HostMcpBindingDefinition = z.infer<typeof HostMcpBindingDefinition>;
+
+export const HostMcpBinding = z
+  .object({
+    id: z.string().uuid(),
+    accountId: z.string().uuid(),
+    workspaceId: z.string().uuid(),
+    ownerSubjectId: HostMcpOwnerSubject,
+    authorizationRevision: z.number().int().positive().safe(),
+    generation: z.number().int().positive().safe(),
+    status: z.enum(["active", "revoked"]),
+    definition: HostMcpBindingDefinition,
+    createdAt: z.string().datetime({ offset: true }),
+    revokedAt: z.string().datetime({ offset: true }).nullable(),
+  })
+  .strict();
+export type HostMcpBinding = z.infer<typeof HostMcpBinding>;
+
+export const CreateHostMcpBindingRequest = z
+  .object({
+    operationId: z.string().uuid(),
+    definition: HostMcpBindingDefinition,
+  })
+  .strict();
+export type CreateHostMcpBindingRequest = z.infer<typeof CreateHostMcpBindingRequest>;
+
+/** Internal owner-authorized issuance; never itself proves caller identity. */
+const HostMcpDelegationGrant = IssueConnectionUseGrantRequest.superRefine((value, context) => {
+  if (
+    Boolean(value.sessionId) !== (value.expectedAuthorityEpoch != null) ||
+    (value.expectedAuthorityEpoch != null && !Number.isSafeInteger(value.expectedAuthorityEpoch))
+  ) {
+    context.addIssue({
+      code: "custom",
+      message: "Host session grants require a matching safe authority epoch",
+    });
+  }
+});
+export const IssueHostMcpDelegationRequest = z
+  .object({
+    operationId: z.string().uuid(),
+    bindingId: z.string().uuid(),
+    expectedBindingGeneration: z.number().int().positive().safe(),
+    grant: HostMcpDelegationGrant,
+  })
+  .strict();
+export type IssueHostMcpDelegationRequest = z.infer<typeof IssueHostMcpDelegationRequest>;
+
+export const HostMcpDelegation = z
+  .object({
+    id: z.string().uuid(),
+    accountId: z.string().uuid(),
+    workspaceId: z.string().uuid(),
+    ownerSubjectId: HostMcpOwnerSubject,
+    ownerAuthorizationRevision: z.number().int().positive().safe(),
+    bindingId: z.string().uuid(),
+    bindingGeneration: z.number().int().positive().safe(),
+    grant: HostMcpDelegationGrant,
+    generation: z.number().int().positive().safe(),
+    status: z.enum(["active", "revoked"]),
+    createdAt: z.string().datetime({ offset: true }),
+    revokedAt: z.string().datetime({ offset: true }).nullable(),
+  })
+  .strict();
+export type HostMcpDelegation = z.infer<typeof HostMcpDelegation>;
+
+/** Internal admission evidence, not a caller-supplied permission or credential.
+ * Persistence must construct this from live authenticated authority and freeze
+ * it with accepted work. Runtime use must independently revalidate that work,
+ * membership, binding and delegation. No API key is retained as execution rights.
+ */
+export const HostMcpAcceptedAuthority = z
+  .object({
+    version: z.literal(1),
+    accountId: z.string().uuid(),
+    workspaceId: z.string().uuid(),
+    targetSessionId: z.string().uuid(),
+    targetSessionVisibility: SessionTenancyVisibility,
+    targetSessionAuthorityEpoch: z.number().int().positive().safe(),
+    acceptedWork: ConnectionUseAuthoritySnapshot.shape.acceptedWork,
+    bindingId: z.string().uuid(),
+    bindingGeneration: z.number().int().positive().safe(),
+    definition: HostMcpBindingDefinition,
+    ownerSubjectId: HostMcpOwnerSubject,
+    ownerOrganizationMembershipId: z.string().uuid(),
+    ownerMembershipAuthorizationRevision: z.number().int().positive().safe(),
+    delegationId: z.string().uuid(),
+    delegationGeneration: z.number().int().positive().safe(),
+    scheduledOrigin: z
+      .object({
+        taskId: z.string().uuid(),
+        taskAuthorityRevision: z.number().int().positive().safe(),
+        runId: z.string().uuid(),
+      })
+      .strict()
+      .optional(),
+    source: z.discriminatedUnion("kind", [
+      z.object({ kind: z.literal("direct") }).strict(),
+      z.object({ kind: z.literal("scheduled_task") }).strict(),
+      z
+        .object({
+          kind: z.literal("child_turn"),
+          sessionId: z.string().uuid(),
+          turnId: z.string().uuid(),
+        })
+        .strict(),
+      z
+        .object({
+          kind: z.literal("inherited_turn"),
+          sessionId: z.string().uuid(),
+          turnId: z.string().uuid(),
+        })
+        .strict(),
+    ]),
+  })
+  .strict()
+  .superRefine((value, context) => {
+    if (
+      (value.source.kind === "direct" && value.scheduledOrigin) ||
+      (value.source.kind === "scheduled_task" &&
+        (!value.scheduledOrigin ||
+          value.acceptedWork.kind !== "scheduled_task" ||
+          value.scheduledOrigin.taskId !== value.acceptedWork.taskId ||
+          value.scheduledOrigin.runId !== value.acceptedWork.runId ||
+          value.scheduledOrigin.taskAuthorityRevision !== value.acceptedWork.taskAuthorityRevision))
+    )
+      context.addIssue({
+        code: "custom",
+        message: "Scheduled host authority must retain its exact run origin",
+      });
+    if (
+      value.acceptedWork.kind === "turn" &&
+      value.source.kind === "inherited_turn" &&
+      value.acceptedWork.turnId === value.source.turnId
+    ) {
+      context.addIssue({
+        code: "custom",
+        path: ["source"],
+        message: "Accepted work cannot inherit from itself",
+      });
+    }
+    if (
+      value.acceptedWork.kind === "scheduled_task" &&
+      !Number.isSafeInteger(value.acceptedWork.taskAuthorityRevision)
+    ) {
+      context.addIssue({
+        code: "custom",
+        path: ["acceptedWork"],
+        message: "Task authority revision must be a safe integer",
+      });
+    }
+    if (new TextEncoder().encode(JSON.stringify(value)).byteLength > 65_536) {
+      context.addIssue({ code: "custom", message: "Host accepted authority exceeds 64 KiB" });
+    }
+  });
+export type HostMcpAcceptedAuthority = z.infer<typeof HostMcpAcceptedAuthority>;
+
+/** Credential-free selection frozen on one immutable scheduled-task revision. */
+export const HostMcpTaskAuthority = z
+  .object({
+    version: z.literal(1),
+    accountId: z.string().uuid(),
+    workspaceId: z.string().uuid(),
+    taskId: z.string().uuid(),
+    taskAuthorityRevision: z.number().int().positive().safe(),
+    taskExecutionDigest: z.string().regex(/^[0-9a-f]{64}$/),
+    ownerSubjectId: HostMcpOwnerSubject,
+    ownerOrganizationMembershipId: z.string().uuid(),
+    ownerMembershipAuthorizationRevision: z.number().int().positive().safe(),
+    bindingId: z.string().uuid(),
+    bindingGeneration: z.number().int().positive().safe(),
+    delegationId: z.string().uuid(),
+    delegationGeneration: z.number().int().positive().safe(),
+    definition: HostMcpBindingDefinition,
+    context: SessionTenancyVisibility,
+  })
+  .strict();
+export type HostMcpTaskAuthority = z.infer<typeof HostMcpTaskAuthority>;