@sayknow-cli/coding-agent 0.3.16 → 0.4.0

package/src/runtime-mcp/oauth-discovery.ts

@@ -4,6 +4,8 @@
  * Automatically detects OAuth requirements from MCP server responses
  * and extracts authentication endpoints.
  */
+import type { AddressResolver, PublicUrlAccepted } from "../web/insane/url-guard";
+import { validatePublicHttpUrl } from "../web/insane/url-guard";
 
 export interface OAuthEndpoints {
 	authorizationUrl: string;
@@ -20,6 +22,16 @@ export interface AuthDetectionResult {
 	message?: string;
 }
 
+interface OAuthDiscoveryOptions {
+	fetch?: (input: string | URL | Request, init?: BunFetchRequestInit) => Promise<Response>;
+	resolver?: AddressResolver;
+	maxRequests?: number;
+	maxNodes?: number;
+	maxRedirects?: number;
+	timeoutMs?: number;
+	signal?: AbortSignal;
+}
+
 function parseMcpAuthServerUrl(errorMessage: string): string | undefined {
 	const match = errorMessage.match(/Mcp-Auth-Server:\s*([^;\]\s]+)/i);
 	if (!match?.[1]) return undefined;
@@ -194,17 +206,11 @@ export function analyzeAuthError(error: Error): AuthDetectionResult {
 		return { requiresAuth: false };
 	}
 
-	const authServerUrl = extractMcpAuthServerUrl(error);
-
-	// Try to extract OAuth endpoints
-	const oauth = extractOAuthEndpoints(error);
-
-	if (oauth) {
+	// Error text is useful for classification, but is not trusted discovery authority.
+	if (extractOAuthEndpoints(error) || extractMcpAuthServerUrl(error)) {
 		return {
 			requiresAuth: true,
 			authType: "oauth",
-			oauth,
-			authServerUrl,
 			message: "Server requires OAuth authentication. Launching authorization flow...",
 		};
 	}
@@ -220,7 +226,6 @@ export function analyzeAuthError(error: Error): AuthDetectionResult {
 		return {
 			requiresAuth: true,
 			authType: "apikey",
-			authServerUrl,
 			message: "Server requires API key authentication.",
 		};
 	}
@@ -229,7 +234,6 @@ export function analyzeAuthError(error: Error): AuthDetectionResult {
 	return {
 		requiresAuth: true,
 		authType: "unknown",
-		authServerUrl,
 		message: "Server requires authentication but type could not be determined.",
 	};
 }
@@ -241,6 +245,7 @@ export function analyzeAuthError(error: Error): AuthDetectionResult {
 export async function discoverOAuthEndpoints(
 	serverUrl: string,
 	authServerUrl?: string,
+	options: OAuthDiscoveryOptions = {},
 ): Promise<OAuthEndpoints | null> {
 	const wellKnownPaths = [
 		"/.well-known/oauth-authorization-server",
@@ -250,8 +255,82 @@ export async function discoverOAuthEndpoints(
 		"/.mcp/auth",
 		"/authorize", // Some MCP servers expose OAuth config here
 	];
-	const urlsToQuery = [authServerUrl, serverUrl].filter((value): value is string => Boolean(value));
-	const visitedAuthServers = new Set<string>();
+	const fetcher = options.fetch ?? globalThis.fetch;
+	const maxRequests = options.maxRequests ?? 32;
+	const maxNodes = options.maxNodes ?? 8;
+	const maxRedirects = options.maxRedirects ?? 3;
+	const timeoutSignal = AbortSignal.timeout(options.timeoutMs ?? 10_000);
+	const signal = options.signal ? AbortSignal.any([options.signal, timeoutSignal]) : timeoutSignal;
+	const { promise: aborted, resolve: resolveAbort } = Promise.withResolvers<null>();
+	if (signal.aborted) resolveAbort(null);
+	else signal.addEventListener("abort", () => resolveAbort(null), { once: true });
+	const queue: string[] = [];
+	const queued = new Set<string>();
+	const visited = new Set<string>();
+	let requests = 0;
+
+	const canonicalUrl = (raw: string): string | null => {
+		try {
+			const url = new URL(raw);
+			url.hash = "";
+			return url.toString();
+		} catch {
+			return null;
+		}
+	};
+
+	const validateUrl = async (raw: string): Promise<PublicUrlAccepted | null> => {
+		const canonical = canonicalUrl(raw);
+		if (!canonical || signal.aborted) return null;
+		const result = await Promise.race([validatePublicHttpUrl(canonical, { resolver: options.resolver }), aborted]);
+		if (!result) return null;
+		return result.ok && !signal.aborted ? result : null;
+	};
+
+	const enqueue = async (raw: string): Promise<void> => {
+		const canonical = canonicalUrl(raw);
+		if (!canonical) return;
+		const authority = new URL(canonical).origin;
+		if (queued.has(authority) || visited.has(authority) || queued.size + visited.size >= maxNodes) return;
+		const accepted = await validateUrl(canonical);
+		if (!accepted) return;
+		queued.add(accepted.url.origin);
+		queue.push(accepted.url.origin);
+	};
+
+	const fetchMetadata = async (raw: string): Promise<Record<string, unknown> | null> => {
+		let current = raw;
+		for (let redirects = 0; redirects <= maxRedirects; redirects++) {
+			if (signal.aborted || requests >= maxRequests) return null;
+			const accepted = await validateUrl(current);
+			if (!accepted) return null;
+			const target = new URL(accepted.url);
+			const address = accepted.addresses[0];
+			target.hostname = address.includes(":") ? `[${address}]` : address;
+			requests++;
+			const response = await fetcher(target, {
+				method: "GET",
+				headers: { Accept: "application/json", Host: accepted.url.host },
+				redirect: "manual",
+				signal,
+				tls: accepted.url.protocol === "https:" ? { serverName: accepted.url.hostname } : undefined,
+			});
+			if ([301, 302, 303, 307, 308].includes(response.status)) {
+				const location = response.headers.get("Location");
+				if (!location || redirects === maxRedirects) return null;
+				current = new URL(location, accepted.url).toString();
+				continue;
+			}
+			if (!response.ok) return null;
+			return (await Promise.race([response.json(), aborted])) as Record<string, unknown> | null;
+		}
+		return null;
+	};
+
+	const server = await validateUrl(serverUrl);
+	if (!server) return null;
+	await enqueue(server.url.toString());
+	if (authServerUrl) await enqueue(authServerUrl);
 
 	const findEndpoints = (metadata: Record<string, unknown>): OAuthEndpoints | null => {
 		if (metadata.authorization_endpoint && metadata.token_endpoint) {
@@ -310,32 +389,43 @@ export async function discoverOAuthEndpoints(
 		return null;
 	};
 
-	for (const baseUrl of urlsToQuery) {
-		visitedAuthServers.add(baseUrl);
+	while (queue.length > 0 && !signal.aborted && requests < maxRequests) {
+		const baseUrl = queue.shift()!;
+		queued.delete(baseUrl);
+		if (visited.has(baseUrl)) continue;
+		visited.add(baseUrl);
 		for (const path of wellKnownPaths) {
 			try {
 				const url = new URL(path, baseUrl);
-				const response = await fetch(url.toString(), {
-					method: "GET",
-					headers: { Accept: "application/json" },
-				});
+				const metadata = await fetchMetadata(url.toString());
 
-				if (response.ok) {
-					const metadata = (await response.json()) as Record<string, unknown>;
+				if (metadata) {
 					const endpoints = findEndpoints(metadata);
-					if (endpoints) return endpoints;
+					if (endpoints) {
+						const issuer = typeof metadata.issuer === "string" ? canonicalUrl(metadata.issuer) : null;
+						const issuerBound = issuer === canonicalUrl(baseUrl);
+						const authorization = await validateUrl(endpoints.authorizationUrl);
+						const token = await validateUrl(endpoints.tokenUrl);
+						const legacySameOrigin =
+							!issuer && authorization?.url.origin === baseUrl && token?.url.origin === baseUrl;
+						if ((issuerBound || legacySameOrigin) && authorization && token) {
+							return {
+								...endpoints,
+								authorizationUrl: authorization.url.toString(),
+								tokenUrl: token.url.toString(),
+							};
+						}
+					}
 
 					if (path === "/.well-known/oauth-protected-resource") {
+						const resource = typeof metadata.resource === "string" ? canonicalUrl(metadata.resource) : null;
+						if (resource !== canonicalUrl(server.url.toString())) continue;
 						const authServers = Array.isArray(metadata.authorization_servers)
 							? metadata.authorization_servers.filter((entry): entry is string => typeof entry === "string")
 							: [];
 
 						for (const discoveredAuthServer of authServers) {
-							if (visitedAuthServers.has(discoveredAuthServer)) {
-								continue;
-							}
-							const discovered = await discoverOAuthEndpoints(serverUrl, discoveredAuthServer);
-							if (discovered) return discovered;
+							await enqueue(discoveredAuthServer);
 						}
 					}
 				}

package/src/runtime-mcp/oauth-flow.ts

@@ -8,10 +8,28 @@
 import type { OAuthCallbackFlowOptions } from "@sayknow-cli/ai/utils/oauth/callback-server";
 import { OAuthCallbackFlow } from "@sayknow-cli/ai/utils/oauth/callback-server";
 import type { OAuthController, OAuthCredentials } from "@sayknow-cli/ai/utils/oauth/types";
+import { MCPExpectedFailure } from "./types";
 
 const DEFAULT_PORT = 3000;
 const CALLBACK_PATH = "/callback";
 const CALLBACK_BIND_HOSTNAME = "127.0.0.1";
+type RefreshTokenResponse = {
+	access_token: string;
+	refresh_token?: string;
+	expires_in?: number;
+};
+
+function isRefreshTokenResponse(value: unknown): value is RefreshTokenResponse {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const payload = value as Record<string, unknown>;
+	return (
+		typeof payload.access_token === "string" &&
+		payload.access_token.length > 0 &&
+		(payload.refresh_token === undefined || typeof payload.refresh_token === "string") &&
+		(payload.expires_in === undefined ||
+			(typeof payload.expires_in === "number" && Number.isFinite(payload.expires_in) && payload.expires_in >= 0))
+	);
+}
 
 function isLoopbackHostname(hostname: string): boolean {
 	return hostname === "localhost" || hostname === "127.0.0.1";
@@ -384,22 +402,34 @@ export async function refreshMCPOAuthToken(
 	if (clientId) params.set("client_id", clientId);
 	if (clientSecret) params.set("client_secret", clientSecret);
 
-	const response = await fetch(tokenUrl, {
-		method: "POST",
-		headers: { "Content-Type": "application/x-www-form-urlencoded" },
-		body: params.toString(),
-	});
+	let response: Response;
+	try {
+		response = await fetch(tokenUrl, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body: params.toString(),
+		});
+	} catch (error) {
+		throw new MCPExpectedFailure(error);
+	}
 
 	if (!response.ok) {
-		const text = await response.text();
-		throw new Error(`MCP OAuth refresh failed: ${response.status} ${text}`);
+		let text: string;
+		try {
+			text = await response.text();
+		} catch (error) {
+			throw new MCPExpectedFailure(error);
+		}
+		throw new MCPExpectedFailure(new Error(`MCP OAuth refresh failed: ${response.status} ${text}`));
 	}
 
-	const data = (await response.json()) as {
-		access_token: string;
-		refresh_token?: string;
-		expires_in?: number;
-	};
+	let data: unknown;
+	try {
+		data = await response.json();
+	} catch {
+		throw new MCPExpectedFailure();
+	}
+	if (!isRefreshTokenResponse(data)) throw new MCPExpectedFailure();
 	const expiresIn = data.expires_in ?? 3600;
 	return {
 		access: data.access_token,

package/src/runtime-mcp/transports/http.ts

@@ -15,7 +15,7 @@ import type {
 	MCPSseServerConfig,
 	MCPTransport,
 } from "../../runtime-mcp/types";
-import { toJsonRpcError } from "../../runtime-mcp/types";
+import { MCPExpectedFailure, toJsonRpcError } from "../../runtime-mcp/types";
 
 /**
  * HTTP transport for MCP servers.
@@ -123,7 +123,7 @@ export class HttpTransport implements MCPTransport {
 			}
 		} catch (error) {
 			if (error instanceof Error && error.name !== "AbortError") {
-				logger.debug("HTTP SSE stream error", { url: this.config.url, error: error.message });
+				logger.debug("HTTP SSE stream error");
 				this.onError?.(error);
 			}
 		}
@@ -160,10 +160,14 @@ export class HttpTransport implements MCPTransport {
 				if (newHeaders) {
 					// Persist refreshed headers so subsequent requests use them directly
 					this.config = { ...this.config, headers: newHeaders };
-					return this.#executeRequest<T>(method, params, options);
+					try {
+						return await this.#executeRequest<T>(method, params, options);
+					} catch (retryError) {
+						throw retryError instanceof MCPExpectedFailure ? retryError : new MCPExpectedFailure(retryError);
+					}
 				}
 			}
-			throw error;
+			throw error instanceof MCPExpectedFailure ? error : new MCPExpectedFailure(error);
 		}
 	}
 
@@ -173,7 +177,7 @@ export class HttpTransport implements MCPTransport {
 		options: MCPRequestOptions | undefined,
 	): Promise<T> {
 		if (!this.#connected) {
-			throw new Error("Transport not connected");
+			throw new MCPExpectedFailure();
 		}
 
 		const id = Snowflake.next();
@@ -238,10 +242,27 @@ export class HttpTransport implements MCPTransport {
 			}
 
 			// Handle JSON response
-			const result = (await response.json()) as JsonRpcResponse;
+			if (!response.body) {
+				throw new MCPExpectedFailure();
+			}
+			const parsedResult = await response.json();
+
+			if (
+				typeof parsedResult !== "object" ||
+				parsedResult === null ||
+				!("id" in parsedResult) ||
+				parsedResult.id !== id ||
+				(!("result" in parsedResult) && !("error" in parsedResult))
+			) {
+				throw new MCPExpectedFailure();
+			}
 
-			if (result.error) {
-				throw new Error(`MCP error ${result.error.code}: ${result.error.message}`);
+			const result = parsedResult as JsonRpcResponse;
+			if ("error" in result) {
+				if (!result.error) {
+					throw new MCPExpectedFailure();
+				}
+				throw new MCPExpectedFailure(new Error(`MCP error ${result.error.code}: ${result.error.message}`));
 			}
 
 			return result.result as T;
@@ -260,7 +281,7 @@ export class HttpTransport implements MCPTransport {
 
 	#parseSSEResponse<T>(response: Response, expectedId: string | number, options?: MCPRequestOptions): Promise<T> {
 		if (!response.body) {
-			throw new Error("No response body");
+			throw new MCPExpectedFailure();
 		}
 
 		const timeout = this.config.timeout ?? 30000;
@@ -294,10 +315,19 @@ export class HttpTransport implements MCPTransport {
 						) {
 							captured = true;
 							drainController.abort();
-							if (message.error) {
-								reject(new Error(`MCP error ${message.error.code}: ${message.error.message}`));
+							const response = message as JsonRpcResponse;
+							if ("error" in response) {
+								if (!response.error) {
+									reject(new MCPExpectedFailure());
+								} else {
+									reject(
+										new MCPExpectedFailure(
+											new Error(`MCP error ${response.error.code}: ${response.error.message}`),
+										),
+									);
+								}
 							} else {
-								resolve(message.result as T);
+								resolve(response.result as T);
 							}
 							return;
 						}
@@ -306,18 +336,18 @@ export class HttpTransport implements MCPTransport {
 					}
 				}
 				if (!captured) {
-					reject(new Error(`No response received for request ID ${expectedId}`));
+					reject(new MCPExpectedFailure());
 				}
 			} catch (error) {
 				if (captured) return;
 				if (error instanceof Error && error.name === "AbortError") {
 					if (options?.signal?.aborted) {
-						reject(error);
+						reject(new MCPExpectedFailure(error));
 					} else {
-						reject(new Error(`SSE response timeout after ${timeout}ms`));
+						reject(new MCPExpectedFailure(new Error(`SSE response timeout after ${timeout}ms`)));
 					}
 				} else {
-					reject(error as Error);
+					reject(error instanceof MCPExpectedFailure ? error : new MCPExpectedFailure(error));
 				}
 			} finally {
 				clearTimeout(timeoutId);
@@ -390,7 +420,7 @@ export class HttpTransport implements MCPTransport {
 
 	async notify(method: string, params?: Record<string, unknown>): Promise<void> {
 		if (!this.#connected) {
-			throw new Error("Transport not connected");
+			throw new MCPExpectedFailure();
 		}
 
 		const body = {
@@ -447,9 +477,9 @@ export class HttpTransport implements MCPTransport {
 		} catch (error) {
 			clearTimeout(timeoutId);
 			if (error instanceof Error && error.name === "AbortError") {
-				throw new Error(`Notify timeout after ${timeout}ms`);
+				throw new MCPExpectedFailure(new Error(`Notify timeout after ${timeout}ms`));
 			}
-			throw error;
+			throw error instanceof MCPExpectedFailure ? error : new MCPExpectedFailure(error);
 		}
 	}
 

package/src/runtime-mcp/transports/stdio.ts

@@ -16,7 +16,7 @@ import type {
 	MCPStdioServerConfig,
 	MCPTransport,
 } from "../../runtime-mcp/types";
-import { toJsonRpcError } from "../../runtime-mcp/types";
+import { MCPExpectedFailure, toJsonRpcError } from "../../runtime-mcp/types";
 
 /**
  * Stdio transport for MCP servers.
@@ -90,7 +90,7 @@ export class StdioTransport implements MCPTransport {
 	 */
 	async connect(): Promise<void> {
 		if (this.#closePromise) {
-			throw new Error("Transport is closing");
+			throw new MCPExpectedFailure();
 		}
 		if (this.#connected) return;
 
@@ -101,14 +101,19 @@ export class StdioTransport implements MCPTransport {
 					...Bun.env,
 					...this.config.env,
 				};
+		const cwd = this.config.cwd ?? getProjectDir();
 
-		this.#process = spawnOwnedProcess([this.config.command, ...args], {
-			cwd: this.config.cwd ?? getProjectDir(),
-			env,
-			stdin: "pipe",
-			gracefulMs: CLOSE_WAIT_MS,
-			name: `mcp-stdio:${this.config.command}`,
-		});
+		try {
+			this.#process = spawnOwnedProcess([this.config.command, ...args], {
+				cwd,
+				env,
+				stdin: "pipe",
+				gracefulMs: CLOSE_WAIT_MS,
+				name: `mcp-stdio:${this.config.command}`,
+			});
+		} catch (error) {
+			throw new MCPExpectedFailure(error);
+		}
 
 		this.#connected = true;
 
@@ -121,6 +126,7 @@ export class StdioTransport implements MCPTransport {
 
 	async #startReadLoop(): Promise<void> {
 		if (!this.#process?.child.stdout) return;
+		let failure: MCPExpectedFailure | undefined;
 		try {
 			for await (const line of readJsonl(this.#process.child.stdout)) {
 				if (!this.#connected) break;
@@ -131,11 +137,12 @@ export class StdioTransport implements MCPTransport {
 				}
 			}
 		} catch (error) {
+			failure = new MCPExpectedFailure(error);
 			if (this.#connected) {
-				this.onError?.(error instanceof Error ? error : new Error(String(error)));
+				this.onError?.(failure);
 			}
 		} finally {
-			this.#handleClose();
+			this.#handleClose(failure);
 		}
 	}
 
@@ -180,8 +187,16 @@ export class StdioTransport implements MCPTransport {
 			const pending = this.#pendingRequests.get(response.id);
 			if (pending) {
 				this.#pendingRequests.delete(response.id);
-				if (response.error) {
-					pending.reject(new Error(`MCP error ${response.error.code}: ${response.error.message}`));
+				if (!("result" in response) && !("error" in response)) {
+					pending.reject(new MCPExpectedFailure());
+				} else if ("error" in response) {
+					if (!response.error) {
+						pending.reject(new MCPExpectedFailure());
+					} else {
+						pending.reject(
+							new MCPExpectedFailure(new Error(`MCP error ${response.error.code}: ${response.error.message}`)),
+						);
+					}
 				} else {
 					pending.resolve(response.result);
 				}
@@ -228,8 +243,8 @@ export class StdioTransport implements MCPTransport {
 		stdin.flush();
 	}
 
-	#handleClose(): void {
-		void this.#closeInternal(true);
+	#handleClose(failure?: MCPExpectedFailure): void {
+		void this.#closeInternal(true, failure);
 	}
 
 	async request<T = unknown>(
@@ -239,7 +254,7 @@ export class StdioTransport implements MCPTransport {
 	): Promise<T> {
 		const stdin = this.#getStdin();
 		if (!this.#connected || !stdin) {
-			throw new Error("Transport not connected");
+			throw new MCPExpectedFailure();
 		}
 
 		const id = Snowflake.next();
@@ -255,7 +270,7 @@ export class StdioTransport implements MCPTransport {
 
 		if (signal?.aborted) {
 			const reason = signal.reason instanceof Error ? signal.reason : new Error("Aborted");
-			return Promise.reject(reason);
+			return Promise.reject(new MCPExpectedFailure(reason));
 		}
 
 		const { promise, resolve, reject } = Promise.withResolvers<T>();
@@ -278,7 +293,7 @@ export class StdioTransport implements MCPTransport {
 		const onAbort = () => {
 			cleanup();
 			const reason = signal?.reason instanceof Error ? signal.reason : new Error("Aborted");
-			reject(reason);
+			reject(new MCPExpectedFailure(reason));
 		};
 
 		if (signal) {
@@ -298,7 +313,7 @@ export class StdioTransport implements MCPTransport {
 
 		timer = setTimeout(() => {
 			cleanup();
-			reject(new Error(`Request timeout after ${timeout}ms`));
+			reject(new MCPExpectedFailure(new Error(`Request timeout after ${timeout}ms`)));
 		}, timeout);
 
 		const message = `${JSON.stringify(request)}\n`;
@@ -308,7 +323,7 @@ export class StdioTransport implements MCPTransport {
 			stdin.flush();
 		} catch (error: unknown) {
 			cleanup();
-			reject(error instanceof Error ? error : new Error(String(error)));
+			reject(new MCPExpectedFailure(error));
 		}
 
 		return promise;
@@ -317,7 +332,7 @@ export class StdioTransport implements MCPTransport {
 	async notify(method: string, params?: Record<string, unknown>): Promise<void> {
 		const stdin = this.#getStdin();
 		if (!this.#connected || !stdin) {
-			throw new Error("Transport not connected");
+			throw new MCPExpectedFailure();
 		}
 
 		const notification = {
@@ -327,29 +342,33 @@ export class StdioTransport implements MCPTransport {
 		};
 
 		const message = `${JSON.stringify(notification)}\n`;
-		// Bun's FileSink has write() method directly
-		stdin.write(message);
-		stdin.flush();
+		try {
+			// Bun's FileSink has write() method directly
+			stdin.write(message);
+			stdin.flush();
+		} catch (error) {
+			throw new MCPExpectedFailure(error);
+		}
 	}
 
 	async close(): Promise<void> {
 		await this.#closeInternal(false);
 	}
 
-	#closeInternal(fromReadLoop: boolean): Promise<void> {
+	#closeInternal(fromReadLoop: boolean, failure?: MCPExpectedFailure): Promise<void> {
 		if (this.#closePromise) return this.#closePromise;
-		this.#closePromise = this.#finishClose(fromReadLoop).finally(() => {
+		this.#closePromise = this.#finishClose(fromReadLoop, failure).finally(() => {
 			this.#closePromise = null;
 		});
 		return this.#closePromise;
 	}
 
-	async #finishClose(fromReadLoop: boolean): Promise<void> {
+	async #finishClose(fromReadLoop: boolean, failure?: MCPExpectedFailure): Promise<void> {
 		const wasConnected = this.#connected;
 		this.#connected = false;
 
 		for (const [, pending] of this.#pendingRequests) {
-			pending.reject(new Error("Transport closed"));
+			pending.reject(failure ?? new MCPExpectedFailure());
 		}
 		this.#pendingRequests.clear();
 

package/src/runtime-mcp/types.ts

@@ -223,6 +223,16 @@ export interface MCPToolCallResult {
 // Transport Types
 // =============================================================================
 
+/** Expected configured-server transport or protocol failure. */
+export class MCPExpectedFailure extends Error {
+	constructor(cause?: unknown) {
+		super(
+			cause instanceof Error ? cause.message : "MCP server operation failed",
+			cause === undefined ? undefined : { cause },
+		);
+		this.name = "MCPExpectedFailure";
+	}
+}
 export interface MCPRequestOptions {
 	/** Abort signal (e.g. Escape-to-interrupt) */
 	signal?: AbortSignal;