@hominis/fireforge 0.40.0 → 0.42.0

package/dist/src/commands/patch/split.js

@@ -23,6 +23,7 @@ import { getProjectPaths, loadConfig } from '../../core/config.js';
 import { appendHistory, confirmDestructive } from '../../core/destructive.js';
 import { normalizePatchArtifact } from '../../core/patch-artifact-normalize.js';
 import { formatPatchNotFoundError } from '../../core/patch-identifier-suggest.js';
+import { buildPatchQueueContext } from '../../core/patch-lint.js';
 import { withPatchDirectoryLock } from '../../core/patch-lock.js';
 import { loadPatchesManifest, renumberPatchesInManifest, resolvePatchIdentifier, savePatchesManifest, validatePatchesManifest, } from '../../core/patch-manifest.js';
 import { enforcePatchPolicy } from '../../core/patch-policy.js';
@@ -30,7 +31,8 @@ import { GeneralError, InvalidArgumentError } from '../../errors/base.js';
 import { toError } from '../../utils/errors.js';
 import { readText, removeFile, writeText } from '../../utils/fs.js';
 import { info, intro, outro, success, warn } from '../../utils/logger.js';
-import { commanderArgParser, pickDefined } from '../../utils/options.js';
+import { addWaitLockOption, commanderArgParser, pickDefined, resolveWaitLockSeconds, } from '../../utils/options.js';
+import { normalizePatchDisplayName } from '../../utils/validation.js';
 import { placementPlansEqual, resolvePlacementPlan } from '../export-flow.js';
 import { runPatchLint } from '../export-shared.js';
 import { assertSourceOwnsFiles, buildNewPatchMetadata, buildSplitDiff, buildSplitSummary, findOwnerRewriteHolders, mergeStagedForwardImports, projectSplitManifest, rewriteSplitOwners, runProjectedSplitLint, } from './split-plan.js';
@@ -156,7 +158,7 @@ export async function commitPatchSplit(patchesDir, plan, newMetadata, options, c
             }
             throw error;
         }
-    });
+    }, { waitLockSeconds: resolveWaitLockSeconds(options.waitLock), command: 'patch split' });
 }
 /**
  * Runs the `patch split` command: plans the split, lints the projection,
@@ -195,6 +197,13 @@ export async function patchSplitCommand(projectRoot, sourceId, options) {
             (options.order === undefined && options.before === undefined ? source.filename : undefined),
     });
     const placement = await resolvePlacementPlan(paths.patches, placementOptions, category, options.name, config);
+    // The filename slug pipeline strips redundant category prefixes; the
+    // manifest display name must agree with the bare-slug naming policy,
+    // exactly as `export --name` already does (FORGE G13/H4).
+    const displayName = normalizePatchDisplayName(options.name, category);
+    if (displayName !== options.name) {
+        info(`Patch name normalized: "${options.name}" → "${displayName}" (the filename carries the order and category prefix).`);
+    }
     const plan = {
         source,
         movedFiles,
@@ -204,7 +213,7 @@ export async function patchSplitCommand(projectRoot, sourceId, options) {
         placement,
         placementOptions,
         category,
-        name: options.name,
+        name: displayName,
         description: options.description ?? '',
         ownerRewrites: findOwnerRewriteHolders(manifest.patches, source.filename, movedSet),
         // Populated by runProjectedSplitLint below (forward edges into the new patch).
@@ -212,10 +221,14 @@ export async function patchSplitCommand(projectRoot, sourceId, options) {
     };
     // Per-patch lint both projected bodies, threading the source patch's
     // tier/lintIgnore so an intentional-advisory patch can still split.
+    // The whole-queue context (built once, with the config for committed-gate
+    // parity) resolves cross-patch imports and sibling head.js harness roots
+    // instead of linting each projected body blind (FORGE I3).
+    const patchQueueCtx = await buildPatchQueueContext(paths.patches, config);
     const ignoreChecks = source.lintIgnore ? new Set(source.lintIgnore) : undefined;
-    await runPatchLint(paths.engine, remainingFiles, remainingDiff, config, options.skipLint, undefined, ignoreChecks, source.tier);
-    await runPatchLint(paths.engine, movedFiles, movedDiff, config, options.skipLint, undefined, ignoreChecks, source.tier);
-    const { conflicts, stagedDependencyAdditions } = await runProjectedSplitLint(paths.patches, plan);
+    await runPatchLint(paths.engine, remainingFiles, remainingDiff, config, options.skipLint, patchQueueCtx, ignoreChecks, source.tier);
+    await runPatchLint(paths.engine, movedFiles, movedDiff, config, options.skipLint, patchQueueCtx, ignoreChecks, source.tier);
+    const { conflicts, stagedDependencyAdditions } = runProjectedSplitLint(plan, patchQueueCtx);
     plan.stagedDependencyAdditions = stagedDependencyAdditions;
     const newMetadata = buildNewPatchMetadata(plan, config);
     enforcePatchPolicy({
@@ -253,7 +266,7 @@ export async function patchSplitCommand(projectRoot, sourceId, options) {
  */
 export function registerPatchSplit(parent, context) {
     const { getProjectRoot, withErrorHandling } = context;
-    parent
+    const command = parent
         .command('split <source>')
         .description('Move files out of a patch into a new patch as one transaction (shrink + create + staged-dependency owner rewrites)')
         .requiredOption('--files <path...>', 'Engine-relative files to move from the source patch to the new patch')
@@ -272,8 +285,8 @@ export function registerPatchSplit(parent, context) {
         .option('--dry-run', 'Show what would happen without writing')
         .option('-y, --yes', 'Skip confirmation prompt (required for non-TTY)')
         .option('--force-unsafe', 'Bypass projected-lint refusals')
-        .option('--skip-lint', 'Skip per-patch lint of the projected bodies')
-        .action(withErrorHandling(async (sourceId, options) => {
+        .option('--skip-lint', 'Skip per-patch lint of the projected bodies');
+    addWaitLockOption(command).action(withErrorHandling(async (sourceId, options) => {
         await patchSplitCommand(getProjectRoot(), sourceId, {
             files: options.files,
             name: options.name,
@@ -287,6 +300,7 @@ export function registerPatchSplit(parent, context) {
                 yes: options.yes,
                 forceUnsafe: options.forceUnsafe,
                 skipLint: options.skipLint,
+                waitLock: options.waitLock,
             }),
         });
     }));

package/dist/src/commands/patch/staged-dependency-validate.d.ts

@@ -0,0 +1,15 @@
+import type { PatchMetadata } from '../../types/commands/index.js';
+/** The declaration fields common to both staged-dependency kinds. */
+interface StagedDependencyShape {
+    file: string;
+    creates: string;
+    owner?: string;
+}
+/**
+ * Validates the `--add` declaration fields against the loaded queue.
+ * Throws on a clear flag mixup; warns (only) when `--owner` is
+ * well-formed but absent from the queue, because the owner may
+ * legitimately be exported moments later and renumbering rewrites owners.
+ */
+export declare function validateStagedDependencyAdd(dependency: StagedDependencyShape, queuePatches: readonly PatchMetadata[]): void;
+export {};

package/dist/src/commands/patch/staged-dependency-validate.js

@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * Shape validation for `patch staged-dependency --add` (FORGE K10).
+ *
+ * `--creates`/`--file` take engine-relative FILE paths and `--owner`
+ * takes a patch FILENAME, but all three were accepted as arbitrary
+ * strings — a `--creates <patch-name>` mixup produced a declaration
+ * nothing could ever discharge, surfacing only later as a
+ * `staged-dependency-unused` warning. Refusals here fire only on a clear
+ * patch-name shape (slash-free values that end in `.patch` or match a
+ * queue patch filename/stem): legitimate engine paths always contain a
+ * `/`, so deep paths can never false-positive.
+ */
+import { InvalidArgumentError } from '../../errors/base.js';
+import { warn } from '../../utils/logger.js';
+function matchQueuePatch(value, queuePatches) {
+    return queuePatches.find((patch) => patch.filename === value || patch.filename === `${value}.patch`)?.filename;
+}
+function refusePatchShapedPath(flag, value, role, queuePatches) {
+    if (value.includes('/'))
+        return;
+    const matched = matchQueuePatch(value, queuePatches);
+    if (matched === undefined && !value.endsWith('.patch'))
+        return;
+    const evidence = matched !== undefined ? `matches patch ${matched} in the queue` : 'looks like a patch filename';
+    throw new InvalidArgumentError(`${flag} takes ${role} (e.g. browser/components/foo/Foo.sys.mjs), not a patch name — ` +
+        `"${value}" ${evidence}. If you meant to name the owning patch, pass it with --owner.`, flag);
+}
+/**
+ * Validates the `--add` declaration fields against the loaded queue.
+ * Throws on a clear flag mixup; warns (only) when `--owner` is
+ * well-formed but absent from the queue, because the owner may
+ * legitimately be exported moments later and renumbering rewrites owners.
+ */
+export function validateStagedDependencyAdd(dependency, queuePatches) {
+    refusePatchShapedPath('--creates', dependency.creates, 'the engine-relative path of the file a later patch creates', queuePatches);
+    refusePatchShapedPath('--file', dependency.file, 'the engine-relative file containing the declaring site inside this patch', queuePatches);
+    const owner = dependency.owner;
+    if (owner === undefined)
+        return;
+    if (owner.includes('/') || !owner.endsWith('.patch')) {
+        throw new InvalidArgumentError(`--owner names the owning patch artifact (e.g. 012-infra-foo.patch); ` +
+            `"${owner}" does not look like a patch filename. The created file path goes in --creates.`, '--owner');
+    }
+    if (!queuePatches.some((patch) => patch.filename === owner)) {
+        warn(`--owner ${owner} matches no patch currently in the queue. The declaration only ` +
+            'discharges once a patch with exactly this filename creates the --creates path.');
+    }
+}

package/dist/src/commands/patch/staged-dependency.js

@@ -10,6 +10,7 @@ import { GeneralError, InvalidArgumentError } from '../../errors/base.js';
 import { toError } from '../../utils/errors.js';
 import { info, intro, outro, warn } from '../../utils/logger.js';
 import { requirePatchQueue, requirePatchTarget } from './patch-context.js';
+import { validateStagedDependencyAdd } from './staged-dependency-validate.js';
 /** Joins the names of the missing flags for error attribution (FORGE G12). */
 function missingFlagList(pairs) {
     return pairs
@@ -231,6 +232,15 @@ export async function patchStagedDependencyCommand(projectRoot, identifier, opti
         : mode === 'add'
             ? requireRegistrationOptions(options)
             : resolveRegistrationRemovalTarget(options, targetPatch.stagedDependencies);
+    // Shape-check --add declarations against the loaded queue (FORGE K10):
+    // a patch-name-shaped --creates/--file is refused HERE instead of
+    // surfacing later as an undischargeable staged-dependency-unused.
+    if (mode === 'add') {
+        const added = importDependency ?? registrationDependency;
+        if (added !== undefined) {
+            validateStagedDependencyAdd(added, manifest.patches);
+        }
+    }
     const target = importDependency !== undefined
         ? importView(importDependency)
         : registrationDependency !== undefined

package/dist/src/commands/re-export-adjacent.js

@@ -17,16 +17,15 @@ import { isBrandingManagedPath } from '../core/branding.js';
 import { getModifiedFilesInDir, getUntrackedFilesInDir } from '../core/git-status.js';
 import { getClaimedFiles } from '../core/patch-manifest.js';
 import { isGeneratedBrandingPath } from '../core/status-classify.js';
+import { mapWithConcurrency } from '../utils/concurrency.js';
 import { pathExists } from '../utils/fs.js';
 import { info, warn } from '../utils/logger.js';
+/** Concurrency bound for existence probes (matches the classify/lint pools). */
+const PATH_PROBE_CONCURRENCY = 8;
 /** Returns the subset of `files` that no longer exist under `engineDir`. */
 export async function findMissingFiles(engineDir, files) {
-    const missingFiles = [];
-    for (const file of files) {
-        if (!(await pathExists(join(engineDir, file))))
-            missingFiles.push(file);
-    }
-    return missingFiles;
+    const exists = await mapWithConcurrency(files, PATH_PROBE_CONCURRENCY, (file) => pathExists(join(engineDir, file)));
+    return files.filter((_, index) => exists[index] !== true);
 }
 function isToolManagedPath(file, isNewFile, ctx) {
     // Mirrors status-classify: a generated branding path is tool-managed

package/dist/src/commands/re-export-bulk-scan.d.ts

@@ -1,5 +1,18 @@
 import type { PatchesManifest } from '../types/commands/index.js';
 /** Loads and validates a `re-export --scan-files` assignment manifest. */
 export declare function loadScanFilesAssignments(manifestPath: string, manifest: PatchesManifest): Promise<Map<string, string[]>>;
+/**
+ * Runtime enforcement of the dry-run purity contract (FORGE H1): fingerprints
+ * the engine tree and every patch artifact before and after `operation`, and
+ * throws when a dry-run changed anything it promised only to inspect. This
+ * turns any recurrence of the 0.40.0 "dry-run reverted a just-written export"
+ * incident into a hard, named failure instead of silent data loss discovered
+ * only when a later gate fails. The post-fingerprint runs whether `operation`
+ * resolves or rejects — a dry-run that mutates state and THEN fails is exactly
+ * the case where a rollback defect must not go unreported; a rejection with a
+ * purity violation surfaces the violation with the original error as `cause`.
+ * No-op outside dry-run.
+ */
+export declare function withDryRunPurityGuard<T>(engineDir: string, patchesDir: string, isDryRun: boolean, operation: () => Promise<T>): Promise<T>;
 /** Serializes dry-run re-export git inspection against the same project tree. */
 export declare function withDryRunReExportLock<T>(fireforgeDir: string, isDryRun: boolean, operation: () => Promise<T>): Promise<T>;

package/dist/src/commands/re-export-bulk-scan.js

@@ -1,11 +1,17 @@
 // SPDX-License-Identifier: EUPL-1.2
+import { createHash } from 'node:crypto';
+import { readdir, readFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { isUnavailableGenerationToken, snapshotEngineGeneration, unavailableGenerationReason, } from '../core/engine-session-lock.js';
 import { createSiblingLockPath, withFileLock } from '../core/file-lock.js';
 import { resolvePatchIdentifier } from '../core/patch-manifest.js';
-import { InvalidArgumentError } from '../errors/base.js';
-import { toError } from '../utils/errors.js';
+import { GeneralError, InvalidArgumentError } from '../errors/base.js';
+import { mapWithConcurrency } from '../utils/concurrency.js';
+import { getNodeErrorCode, toError } from '../utils/errors.js';
 import { readText } from '../utils/fs.js';
 import { normalizeEngineRelativeInput } from './re-export-scan.js';
+/** Concurrency bound for patch-body hashing (matches the classify/lint pools). */
+const PATCH_HASH_CONCURRENCY = 8;
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
@@ -66,6 +72,140 @@ export async function loadScanFilesAssignments(manifestPath, manifest) {
     }
     return new Map([...filesByPatch.entries()].map(([patchFilename, files]) => [patchFilename, [...files].sort()]));
 }
+/**
+ * Fingerprints every piece of state a `re-export --dry-run` promises not to
+ * disturb: the engine's commit + working-tree status (via the same generation
+ * token `fireforge test` uses) and the byte content of every regular file
+ * under `patches/` — ALL of them, not just the selected patches, because the
+ * FORGE H1 field incident was a dry-run of patch B reverting a just-written
+ * export of patch A. A missing patches directory (ENOENT/ENOTDIR) fingerprints
+ * as empty — there is nothing there to protect — but any other listing failure
+ * (EACCES, EIO, …) throws: an unreadable directory is not evidence it is
+ * empty, and treating it as such would let the guard silently vouch for state
+ * it never saw (fail closed). The same rule covers an unmeasurable engine
+ * generation and an unreadable individual patch file; a before-pass failure
+ * aborts the dry run before it starts, since a guard that measured nothing
+ * cannot vouch for anything.
+ */
+async function fingerprintDryRunState(engineDir, patchesDir) {
+    const fingerprint = new Map();
+    const generation = await snapshotEngineGeneration(engineDir);
+    if (isUnavailableGenerationToken(generation)) {
+        // A failed probe measured nothing — hashing the failure token would let
+        // two identical failures compare "unchanged" (vouching for unmeasured
+        // state) and two differing messages report a spurious violation.
+        throw new GeneralError(`[dry-run] cannot fingerprint the engine working tree for the purity guard: ` +
+            unavailableGenerationReason(generation));
+    }
+    fingerprint.set('the engine working tree', createHash('sha256').update(generation).digest('hex'));
+    let names = [];
+    try {
+        const entries = await readdir(patchesDir, { withFileTypes: true });
+        names = entries
+            .filter((entry) => entry.isFile())
+            .map((entry) => entry.name)
+            .sort();
+    }
+    catch (error) {
+        // No patches directory — nothing there to protect; the same condition on
+        // the post-run pass produces the same empty set, and a directory that
+        // appears mid-dry-run correctly reports as a violation. Any OTHER failure
+        // must not read as "empty": the guard would be vouching for state it
+        // never saw.
+        const code = getNodeErrorCode(error);
+        if (code !== 'ENOENT' && code !== 'ENOTDIR') {
+            throw new GeneralError(`[dry-run] cannot fingerprint ${patchesDir} for the purity guard: ${toError(error).message}`, error);
+        }
+    }
+    const results = await mapWithConcurrency(names, PATCH_HASH_CONCURRENCY, async (name) => {
+        try {
+            return {
+                hash: createHash('sha256')
+                    .update(await readFile(join(patchesDir, name)))
+                    .digest('hex'),
+            };
+        }
+        catch (error) {
+            // A file that vanished between the listing and the read is omitted, so
+            // a dry run that DELETED a patch artifact reports as the violation it
+            // is (key present before, absent after) instead of hiding behind a
+            // fingerprinting error. Every other failure fails closed: a constant
+            // placeholder would make unreadable-before equal unreadable-after even
+            // when the bytes changed underneath.
+            const code = getNodeErrorCode(error);
+            if (code === 'ENOENT' || code === 'ENOTDIR')
+                return { vanished: true };
+            return { error };
+        }
+    });
+    for (const [index, name] of names.entries()) {
+        const result = results[index];
+        if (result === undefined)
+            continue;
+        if ('error' in result) {
+            throw new GeneralError(`[dry-run] cannot fingerprint ${join(patchesDir, name)} for the purity guard: ${toError(result.error).message}`, result.error);
+        }
+        if ('vanished' in result)
+            continue;
+        fingerprint.set(`patches/${name}`, result.hash);
+    }
+    return fingerprint;
+}
+/**
+ * Runtime enforcement of the dry-run purity contract (FORGE H1): fingerprints
+ * the engine tree and every patch artifact before and after `operation`, and
+ * throws when a dry-run changed anything it promised only to inspect. This
+ * turns any recurrence of the 0.40.0 "dry-run reverted a just-written export"
+ * incident into a hard, named failure instead of silent data loss discovered
+ * only when a later gate fails. The post-fingerprint runs whether `operation`
+ * resolves or rejects — a dry-run that mutates state and THEN fails is exactly
+ * the case where a rollback defect must not go unreported; a rejection with a
+ * purity violation surfaces the violation with the original error as `cause`.
+ * No-op outside dry-run.
+ */
+export async function withDryRunPurityGuard(engineDir, patchesDir, isDryRun, operation) {
+    if (!isDryRun)
+        return operation();
+    const before = await fingerprintDryRunState(engineDir, patchesDir);
+    let result;
+    let operationError;
+    let failed = false;
+    try {
+        result = await operation();
+    }
+    catch (error) {
+        failed = true;
+        operationError = error;
+    }
+    let after;
+    try {
+        after = await fingerprintDryRunState(engineDir, patchesDir);
+    }
+    catch (fingerprintError) {
+        // The post-run fingerprint failing must not swallow the dry run's own
+        // failure — an operation that mutated state, broke it, AND made it
+        // unreadable is exactly the case where both facts matter. The combined
+        // message carries both; the operation error stays the `cause`.
+        if (failed) {
+            throw new GeneralError(`[dry-run] this dry run failed (${toError(operationError).message}), and its purity could ` +
+                `not be verified afterwards: ${toError(fingerprintError).message}. Inspect engine/ and ` +
+                'your patches/ diff before trusting them.', operationError);
+        }
+        throw fingerprintError;
+    }
+    const touched = [...new Set([...before.keys(), ...after.keys()])]
+        .sort()
+        .filter((key) => before.get(key) !== after.get(key));
+    if (touched.length > 0) {
+        throw new GeneralError(`[dry-run] invariant violated: this dry run modified ${touched.join(', ')}. ` +
+            'This is a FireForge bug — please report it, and inspect the listed state ' +
+            '(e.g. `git status` in engine/ and your patches/ diff) before trusting it.' +
+            (failed ? ` The dry run also failed: ${toError(operationError).message}` : ''), operationError);
+    }
+    if (failed)
+        throw operationError;
+    return result;
+}
 /** Serializes dry-run re-export git inspection against the same project tree. */
 export async function withDryRunReExportLock(fireforgeDir, isDryRun, operation) {
     if (!isDryRun)

package/dist/src/commands/re-export-drift.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Foreign-drift preview + `--refuse-foreign-drift` gate for `re-export`
+ * (FORGE J2).
+ *
+ * A scan-less re-export rebuilds each patch body as a whole-file
+ * `git diff HEAD` over the owned files — so a CONCURRENT session's
+ * uncommitted lines inside a file the patch already owns are silently
+ * absorbed into the refreshed body. The adjacency advisory
+ * (`re-export-adjacent.ts`) warns about unmanaged NEIGHBOUR files but is
+ * structurally blind to drift inside owned files. This module compares
+ * the old body against the refreshed body per file and reports the
+ * payload lines that are about to ENTER the body; under
+ * `--refuse-foreign-drift` the patch is skipped and the run exits
+ * non-zero, mirroring `--refuse-adjacent-unmanaged`.
+ *
+ * "Foreign" is decided by content, not authorship: re-export's legitimate
+ * job is capturing intentional engine edits, so the preview always prints
+ * and the hard stop is an explicit opt-in for multi-session checkouts.
+ * The comparison is offset-insensitive — per-file MULTISETS of `+`/`-`
+ * payload lines — because a refresh legitimately shifts hunk offsets and
+ * context without changing what the patch does.
+ */
+import type { PatchMetadata } from '../types/commands/index.js';
+/** Why a patch was refused under `--refuse-foreign-drift`. */
+export type ForeignDriftRefusalReason = 'foreign-drift' | 'baseline-unreadable';
+/** Per-run context threaded through the re-export loop (mirrors FORGE G2). */
+export interface ForeignDriftContext {
+    refuseForeignDrift: boolean;
+    /**
+     * Engine-relative files whose drift is expected (`--expect`, FORGE L6):
+     * drift confined to these files does not refuse. Files here that never
+     * drift are reported after the run as likely typos.
+     */
+    expectedDriftFiles: ReadonlySet<string>;
+    /** Expected files that actually drifted at least once this run. */
+    expectedSeen: Set<string>;
+    /** Number of patches whose old/new bodies reached the drift comparison. */
+    evaluationRuns: number;
+    refusals: {
+        patchFilename: string;
+        files: string[];
+        reason: ForeignDriftRefusalReason;
+    }[];
+}
+/** One owned file's foreign drift between the old and refreshed body. */
+export interface FileForeignDrift {
+    file: string;
+    /** `+` payload lines in the new body not present in the old body. */
+    addedLines: number;
+    /** `-` payload lines in the new body not present in the old body. */
+    removedLines: number;
+    /** `@@` headers of new-body hunks carrying foreign lines (capped). */
+    hunkSummaries: string[];
+    /** True when a binary section's recorded new-side blob hash changed. */
+    binaryChanged: boolean;
+}
+/**
+ * Pure comparison: per owned file, which `+`/`-` payload lines the
+ * refreshed body carries that the old body did not. Files NOT in
+ * `previousFilesAffected` are skipped — those are intentional adoptions
+ * (`--scan`), not drift.
+ */
+export declare function computeForeignDrift(oldBody: string, newBody: string, previousFilesAffected: readonly string[]): FileForeignDrift[];
+/**
+ * Reads the old body, prints the always-on drift preview (including under
+ * dry-run and `--scan`), and — when `ctx.refuseForeignDrift` is set —
+ * records a refusal and returns `true` so the caller skips the write.
+ */
+export declare function reportForeignDrift(args: {
+    patch: PatchMetadata;
+    patchesDir: string;
+    newDiffContent: string;
+    ctx: ForeignDriftContext;
+}): Promise<boolean>;