@nanobpm/nano-workforce 0.107.1 → 0.107.2

package/.github/workflows/ci.yml

@@ -5,6 +5,12 @@ on:
     branches: [main]
   push:
     branches: [main]
+  # Merge-skew guard (issue #366): also run the required gates against the merge queue's
+  # PROSPECTIVE merged commit (GitHub Actions `merge_group` event). Several gates assert a whole-repo invariant (migration prefixes,
+  # BPMN DI freshness, committed generated artifacts) that two PRs can each satisfy in isolation yet
+  # violate once BOTH land on `main`. Validating the speculative merge commit the queue builds — not
+  # the stale PR head — blocks such a merge categorically instead of letting it poison the next PR.
+  merge_group:
 
 permissions:
   contents: read
@@ -77,3 +83,30 @@ jobs:
       - name: E2E (urban-testkit)
         run: npm run e2e
 
+  # FINAL regression guard for epic nano-ide#314 (S6, #321): the compounding oracle that keeps the
+  # code-first (`defineFlow`) and model-first (`.bpmn`) representations of the nano-workforce corpus
+  # in lockstep. For every model it DERIVES the BPMN from its defineFlow port, structurally DIFFS it
+  # against the checked-in golden via the S0 harness (@nanobpm/workflow/test-support), and DEPLOYS
+  # the derived model to the in-process @nanobpm/engine-wasm engine — failing on any structural drift
+  # OR deploy rejection. Parked models (awaiting an upstream construct) must each carry a documented
+  # blocker, and a self-proving canary asserts the oracle's red path genuinely fires so the gate can
+  # never rot into a vacuous green while the corpus is parked. Hermetic (in-process wasm engine, no
+  # sockets), so it runs on every PR/push as its own job.
+  derivation-parity:
+    name: derivation parity (nwf corpus regression guard)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Derive + diff + deploy the full nwf corpus
+        run: npm run check:derivation-parity
+

package/.github/workflows/invariants.yml

@@ -0,0 +1,72 @@
+name: Whole-repo invariants (merge-skew guard)
+
+# Closes the merge-skew failure class (issue #366).
+#
+# Several gates assert a GLOBAL invariant / checked-in DERIVED artifact — `derived == f(sources)` —
+# but the main CI only ever verifies them against a PR's OWN head. Two PRs can each pass in isolation
+# and still break the invariant once BOTH squash-merge, because `main`'s `derived` is then
+# `f(sources_A ∪ sources_B)`, which neither branch's green CI ever saw (the 052 migration collision,
+# #359; the stale `retro.bpmn` DI, #365). Nothing re-checked `main`, so the breakage landed silently
+# and poisoned the next unrelated PR to touch the same job.
+#
+# This lean workflow re-asserts those whole-repo invariants where the merge actually happens:
+#   - `merge_group`  — the queue's PROSPECTIVE merged commit, so a skew is blocked BEFORE it lands.
+#   - `push: [main]` — a fast backstop that fails a `main`-scoped build within minutes if something
+#                      slipped through, instead of first surfacing on an unrelated open PR.
+#   - `schedule`     — a daily catch-all for any skew introduced by a merge that bypassed the queue.
+on:
+  merge_group:
+  push:
+    branches: [main]
+  schedule:
+    # 06:00 UTC daily — cheap catch-all backstop.
+    - cron: "0 6 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  invariants:
+    name: whole-repo invariants
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          # Full history: the migration immutability gate diffs against the merge-base with
+          # origin/main, and the layout gate needs the whole tree — neither works on a shallow clone.
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+
+      - name: Install dependencies
+        run: npm ci
+
+      # Prefix-collision (+ immutability): two branches that each took "the next" free migration
+      # prefix collide once merged. Re-run on the merged/`main` tree so the collision can't hide.
+      - name: Check migration prefixes (no collisions)
+        run: npm run check:migrations
+
+      # BPMN DI freshness: a merged semantic model can carry flows whose DI was regenerated on neither
+      # branch. Regenerate the DI over the merged model and fail if any committed diagram is stale.
+      - name: Check BPMN diagram freshness (layout)
+        run: npm run layout:check
+
+      # Generated-artifact freshness (`urban gen --check`): landscape.gen.html, JSON Schemas / OpenAPI,
+      # the processos grammar (ir.gbnf) and friends are `derived == f(sources)` — re-derive over the
+      # merged sources and fail if a committed artifact drifted.
+      - name: Check generated artifacts (urban gen --check)
+        run: npm run gen:check
+
+      # Navigation index is another checked-in derived artifact; re-assert it on the merged tree too.
+      - name: Check navigation index freshness
+        run: npm run sync:nav:check
+
+      # Backstop: catch ANY other committed generated file that the merged sources render stale, even
+      # one without its own `--check` script above. A clean tree is the whole-repo invariant.
+      - name: No stale committed artifacts on the merged tree
+        run: git diff --exit-code

package/AGENTS.md

@@ -272,7 +272,13 @@ Migrations live in `db/migrations/*.sql` and are **auto-applied on boot** from
   Check `origin/main`, not your branch point — a fan-out epic branch forks at one
   prefix while `main` keeps advancing, so the branch-local "next" number collides
   on merge. Two files must never share a prefix; `npm run check:migrations`
-  (a CI gate) enforces this and fails the build on any new duplicate.
+  (a CI gate) enforces this and fails the build on any new duplicate. Because a
+  prefix collision only exists in the *union* of two branches, this gate — like
+  `layout:check` and the generated-artifact `--check`s — is also re-run on the
+  merge queue's **prospective merged commit** and on **push to `main`** by
+  `.github/workflows/invariants.yml` (issue #366), so a merge-skew collision is
+  blocked at merge time or fails a `main`-scoped build within minutes rather than
+  first surfacing on an unrelated open PR.
 - **A merged migration is IMMUTABLE — never rename, delete, or edit it.** The
   runtime keys the `_urban_migrations` ledger by *filename*, so a renamed file is
   a *new* migration to the runner: it re-runs its DDL against an already-migrated

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+## [0.107.2](https://github.com/nanobpm/nano-workforce/compare/v0.107.1...v0.107.2) (2026-08-20)
+
+
+### Bug Fixes
+
+* **ci:** close the merge-skew failure class — re-check whole-repo invariants on the post-merge state ([#367](https://github.com/nanobpm/nano-workforce/issues/367)) ([62f5214](https://github.com/nanobpm/nano-workforce/commit/62f5214961cdb82a708d7cc08acecbf5eecf25ed)), closes [#359](https://github.com/nanobpm/nano-workforce/issues/359) [#365](https://github.com/nanobpm/nano-workforce/issues/365) [#366](https://github.com/nanobpm/nano-workforce/issues/366)
+
 ## [0.107.1](https://github.com/nanobpm/nano-workforce/compare/v0.107.0...v0.107.1) (2026-08-20)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.107.1",
+  "version": "0.107.2",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",
@@ -41,6 +41,8 @@
     "heal:migrations": "node --experimental-strip-types scripts/heal-migration-ledger.ts",
     "check:contracts": "node --experimental-strip-types scripts/check-contracts.ts",
     "reconcile:contracts": "node --experimental-strip-types scripts/reconcile-contracts.ts",
+    "precheck:derivation-parity": "urban gen",
+    "check:derivation-parity": "node --experimental-strip-types scripts/check-derivation-parity.ts",
     "gen": "urban gen",
     "gen:check": "urban gen --check",
     "layout": "node --experimental-strip-types scripts/layout-bpmn.ts",

package/scripts/check-derivation-parity.ts

@@ -0,0 +1,213 @@
+// check-derivation-parity — the FINAL regression guard for epic nanobpm/nano-ide#314 (S6, #321).
+//
+// This is the compounding oracle that keeps the code-first (`defineFlow`) and model-first (`.bpmn`)
+// representations of the nano-workforce corpus in lockstep. For EVERY golden under
+// `resources/processes/*.bpmn` it runs the full derive → diff → deploy loop:
+//
+//   (a) DERIVE  — take the golden's `defineFlow` port (test/derivation-parity/flows.ts) and derive
+//                 its BPMN with `@nanobpm/workflow`.
+//   (b) DIFF    — structurally compare the derived model against the checked-in golden using the S0
+//                 parity harness (`@nanobpm/workflow/test-support`'s `normalize` / `assertDerivation-
+//                 Parity`). The normalization/diff is NEVER reimplemented here — this gate only calls
+//                 the shared harness, so the code-first check can't drift from the unit suite's.
+//   (c) DEPLOY  — deploy the derived model to the in-process `@nanobpm/engine-wasm` engine (via
+//                 `@nanobpm/urban-testkit`) and assert the engine ACCEPTS it.
+//
+// Any structural drift (b) OR deploy rejection (c) fails the build.
+//
+// PARKED MODELS ARE ACCOUNTED FOR, NOT IGNORED. The corpus is currently fully parked behind
+// upstream `@nanobpm/workflow` constructs (see test/derivation-parity/flows.ts for the three blocker
+// classes). Each parked model must carry a documented `blockedReason`; a model that is neither
+// ported nor documented fails this gate, so the corpus can never silently lose coverage. As each
+// parked model flips to a real `flow` upstream, it is automatically pulled into the full
+// derive → diff → deploy loop here with NO change to this script.
+//
+// SELF-PROVING CANARY. Because the corpus is (today) all-parked, a gate that merely iterated it
+// would be a vacuous green — it could rot without anyone noticing. So before touching the corpus we
+// run a CANARY that proves the oracle's RED path genuinely fires: a faithful derived flow deploys
+// green and diffs green, a drifted derivation is CAUGHT by the diff, and a corrupted model is
+// REJECTED by the engine. If any red path fails to fire (the diff misses drift, or the engine
+// accepts garbage), the gate fails — the oracle must be able to say no.
+
+import { mkdtempSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createWasmEngineClient } from "@nanobpm/urban-testkit";
+import type { DeclarativeFlow } from "@nanobpm/workflow";
+import { declarativeToBpmn, defineFlow, toDeployableBpmn } from "@nanobpm/workflow";
+import { assertDerivationParity } from "@nanobpm/workflow/test-support";
+import { PORTS } from "../test/derivation-parity/flows.ts";
+
+const REPO_ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
+const PROCESSES_DIR = join(REPO_ROOT, "resources", "processes");
+const goldenPath = (model: string): string => join(PROCESSES_DIR, `${model}.bpmn`);
+
+type WasmEngine = Awaited<ReturnType<typeof createWasmEngineClient>>;
+
+const errMsg = (e: unknown): string => (e instanceof Error ? e.message : String(e));
+
+/** Deploy a derived flow's *deployable* BPMN (semantic model + auto-layout DI) to the wasm engine
+ *  and assert acceptance. Throws when the engine rejects the model or reports nothing deployed. */
+async function deployDerived(engine: WasmEngine, id: string, flow: DeclarativeFlow): Promise<void> {
+  const xml = await toDeployableBpmn(flow);
+  const result = await engine.deployResources([{ name: `${id}.bpmn`, content: xml, contentType: "application/xml" }]);
+  if (!result || result.deployed < 1) {
+    throw new Error(`engine did not accept derived "${id}" (deployed=${result?.deployed ?? 0})`);
+  }
+}
+
+/** Prove the derive → diff → deploy oracle can actually say NO, so an all-parked corpus can't let
+ *  this gate rot into a vacuous green. Pushes a line onto `errors` for any red path that fails to
+ *  fire. */
+async function proveOracleFiresRed(engine: WasmEngine, errors: string[]): Promise<void> {
+  const dir = mkdtempSync(join(tmpdir(), "nwf-parity-canary-"));
+  try {
+    const canary = defineFlow("parity-canary", (w) => {
+      w.task("step-a", { jobType: "senior:noop" });
+    });
+    const golden = join(dir, "parity-canary.bpmn");
+    writeFileSync(golden, declarativeToBpmn(canary), "utf8");
+
+    // DIFF, green: a faithful derivation matches its own golden.
+    try {
+      assertDerivationParity(canary, golden);
+    } catch (e) {
+      errors.push(`  canary: a faithful derivation was reported as drift — the diff is broken (${errMsg(e)})`);
+    }
+
+    // DIFF, red: a structurally different derivation MUST be caught.
+    const drifted = defineFlow("parity-canary", (w) => {
+      w.task("step-a", { jobType: "senior:noop" });
+      w.task("step-b", { jobType: "senior:noop" });
+    });
+    let structuralFired = false;
+    try {
+      assertDerivationParity(drifted, golden);
+    } catch {
+      structuralFired = true;
+    }
+    if (!structuralFired) {
+      errors.push("  canary: the structural-drift oracle did NOT fire (an added node slipped past the diff)");
+    }
+
+    // DEPLOY, green: a valid derived model is accepted by the engine.
+    try {
+      await deployDerived(engine, "parity-canary", canary);
+    } catch (e) {
+      errors.push(`  canary: the engine rejected a VALID derived model — the deploy oracle is broken (${errMsg(e)})`);
+    }
+
+    // DEPLOY, red: a corrupted model MUST be rejected.
+    let deployFired = false;
+    try {
+      await engine.deployResources([{ name: "corrupt.bpmn", content: "<not-bpmn/>", contentType: "application/xml" }]);
+    } catch {
+      deployFired = true;
+    }
+    if (!deployFired) {
+      errors.push("  canary: the deploy-rejection oracle did NOT fire (the engine accepted invalid BPMN)");
+    }
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+/** Assert PORTS covers EXACTLY the checked-in goldens under
+ *  `resources/processes/*.bpmn`. Without this the guard's "full corpus" claim is
+ *  unproven: a newly-added golden with no PORTS entry would be silently skipped
+ *  (eroding coverage while still reporting OK), and a stale PORTS entry for a
+ *  deleted golden would iterate a model that no longer exists. Both directions
+ *  fail the gate. */
+function assertPortsCoverGoldens(errors: string[]): void {
+  const goldens = readdirSync(PROCESSES_DIR)
+    .filter((f) => f.endsWith(".bpmn"))
+    .map((f) => f.slice(0, -".bpmn".length));
+  const ported = PORTS.map((p) => p.model);
+
+  const missing = goldens.filter((g) => !ported.includes(g)).sort();
+  if (missing.length > 0) {
+    errors.push(
+      `  PORTS is missing ${missing.length} checked-in golden(s) under resources/processes ` +
+        `(${missing.join(", ")}) — add a derived flow or a documented blockedReason so the ` +
+        `"full corpus" guard can't silently skip them.`,
+    );
+  }
+
+  const orphaned = ported.filter((m) => !goldens.includes(m)).sort();
+  if (orphaned.length > 0) {
+    errors.push(
+      `  PORTS references ${orphaned.length} model(s) with no golden under resources/processes ` +
+        `(${orphaned.join(", ")}) — remove the stale entry or restore its golden.`,
+    );
+  }
+
+  const seen = new Set<string>();
+  const duplicated = new Set<string>();
+  for (const m of ported) {
+    if (seen.has(m)) duplicated.add(m);
+    seen.add(m);
+  }
+  if (duplicated.size > 0) {
+    errors.push(
+      `  PORTS has duplicate entries for ${duplicated.size} model(s) (${[...duplicated].sort().join(", ")}) — ` +
+        `each golden must appear exactly once.`,
+    );
+  }
+}
+
+async function main(): Promise<void> {
+  const errors: string[] = [];
+  const engine = await createWasmEngineClient();
+
+  let ported = 0;
+  let deployed = 0;
+  let parked = 0;
+
+  try {
+    assertPortsCoverGoldens(errors);
+    await proveOracleFiresRed(engine, errors);
+
+    for (const port of PORTS) {
+      if (port.flow) {
+        ported++;
+        const golden = goldenPath(port.model);
+        try {
+          assertDerivationParity(port.flow, golden);
+        } catch (e) {
+          errors.push(`  ${port.model}: STRUCTURAL DRIFT vs golden — ${errMsg(e)}`);
+          continue; // a model that doesn't derive its golden can't be trusted to deploy meaningfully
+        }
+        try {
+          await deployDerived(engine, port.model, port.flow);
+          deployed++;
+        } catch (e) {
+          errors.push(`  ${port.model}: DEPLOY REJECTED by wasm engine — ${errMsg(e)}`);
+        }
+      } else {
+        parked++;
+        if (!port.blockedReason || port.blockedReason.trim().length === 0) {
+          errors.push(
+            `  ${port.model}: neither ported (no flow) nor documented (no blockedReason) — every ` +
+              `corpus model must derive its golden or carry a precise blocker.`,
+          );
+        }
+      }
+    }
+  } finally {
+    // Release the underlying WASM engine resources so repeated runs (local / CI matrix) don't leak.
+    await engine.close();
+  }
+
+  if (errors.length > 0) {
+    console.error(`check-derivation-parity: the nano-workforce corpus failed its derivation-parity guard:\n${errors.join("\n")}`);
+    process.exit(1);
+  }
+
+  console.log(
+    `check-derivation-parity: OK (${PORTS.length} corpus models — ${ported} ported ` +
+      `[${deployed} deploy-accepted by the wasm engine], ${parked} documented-parked; oracle red paths verified).`,
+  );
+}
+
+if (import.meta.main) main();

package/scripts/check-migrations.test.ts

@@ -6,7 +6,7 @@
 // with origin/main; here we drive its diff classifier directly with representative
 // `git diff --find-renames --name-status` output so each violation shape is pinned.
 import test from "node:test";
-import { immutabilityErrorsFromDiff } from "./check-migrations.ts";
+import { collisionErrorsFromFiles, immutabilityErrorsFromDiff } from "./check-migrations.ts";
 import { assert, assertEquals } from "#test-assert";
 
 test("a rename of a merged migration is a violation", () => {
@@ -56,3 +56,41 @@ test("mixed changes report every violation but ignore the addition", () => {
   assert(errors.some((e) => /DELETED/.test(e)));
   assert(errors.some((e) => /RENAMED/.test(e)));
 });
+
+// Merge-skew regression coverage (issue #366).
+//
+// The failure class this pins: two PRs each pass `check:migrations` on their OWN head, but their
+// COMBINATION on `main` after both squash-merge violates the prefix-collision invariant — because
+// neither branch's green CI ever saw the other's file. The 052 collision (#351 + #355, hotfixed in
+// #359) was exactly this. Driving the pure collision detector with each branch's tree AND their union
+// demonstrates that only the post-merge state trips the gate, which is why the gate must re-run on
+// the prospective merged commit (merge_group) / on push to `main`, not just PR heads.
+test("merge skew: two individually-clean branches whose union collides IS caught", () => {
+  const mainTree = ["050_capability_gates.sql", "051_merges_per_day.sql"];
+  // Each branch independently picks the same "next free" prefix (060) without seeing its sibling.
+  const branchA = [...mainTree, "060_plan_conformance.sql"];
+  const branchB = [...mainTree, "060_worker_durable_resume.sql"];
+
+  // On its own head, each branch is clean — this is why both PRs go green in isolation.
+  assertEquals(collisionErrorsFromFiles(branchA), [], "branch A alone has no colliding prefix");
+  assertEquals(collisionErrorsFromFiles(branchB), [], "branch B alone has no colliding prefix");
+
+  // The post-merge tree on `main` (git merges both files cleanly — the names don't textually
+  // conflict) now shares slot 060. The gate, re-run on that merged state, catches it.
+  const mergedOnMain = [...new Set([...branchA, ...branchB])].sort();
+  const errors = collisionErrorsFromFiles(mergedOnMain);
+  assertEquals(errors.length, 1, "the merged tree has exactly one colliding prefix");
+  assert(/prefix 060/.test(errors[0]));
+  assert(/060_plan_conformance.sql/.test(errors[0]));
+  assert(/060_worker_durable_resume.sql/.test(errors[0]));
+});
+
+test("collision detector flags a non-NNN shape and grandfathers historical dupes", () => {
+  assert(collisionErrorsFromFiles(["nope.sql"]).some((e) => /required NNN_name.sql shape/.test(e)));
+  // Grandfathered historical collisions (already applied forward-only) must stay exempt.
+  assertEquals(
+    collisionErrorsFromFiles(["052_plan_conformance.sql", "052_worker_durable_resume.sql"]),
+    [],
+    "grandfathered prefix 052 is not a new violation",
+  );
+});

package/scripts/check-migrations.ts

@@ -150,11 +150,13 @@ function checkImmutability(errors: string[]): boolean {
   return true;
 }
 
-function main(): void {
-  const files = readdirSync(MIGRATIONS_DIR)
-    .filter((f) => f.endsWith(".sql"))
-    .sort();
-
+/** Classify a migration file listing into shape + prefix-collision errors. Pure over the file list
+ *  so the MERGE-SKEW scenario can be pinned in a test: two individually-clean branches each pass this
+ *  over their OWN tree, but the gate must fail over the UNION that lands on `main` after both merge
+ *  (issue #366). This is exactly why the gate has to re-run on the post-merge state — neither branch's
+ *  green CI ever saw the other's prefix. Grandfathered historical collisions stay exempt. Exported
+ *  for unit coverage. */
+export function collisionErrorsFromFiles(files: readonly string[]): string[] {
   const errors: string[] = [];
   const byPrefix = new Map<string, string[]>();
 
@@ -175,13 +177,23 @@ function main(): void {
   for (const [prefix, group] of byPrefix) {
     if (group.length > 1 && !GRANDFATHERED_DUPES.has(prefix)) {
       errors.push(
-        `  prefix ${prefix} is used by ${group.length} files: ${group.join(", ")} — ` +
+        `  prefix ${prefix} is used by ${group.length} files: ${[...group].sort().join(", ")} — ` +
           `two migrations cannot share an apply-order slot. Renumber the newer one to the next ` +
           `free prefix (check origin/main, not your branch point).`,
       );
     }
   }
 
+  return errors;
+}
+
+function main(): void {
+  const files = readdirSync(MIGRATIONS_DIR)
+    .filter((f) => f.endsWith(".sql"))
+    .sort();
+
+  const errors: string[] = collisionErrorsFromFiles(files);
+
   const immutabilityChecked = checkImmutability(errors);
 
   if (errors.length > 0) {

package/test/derivation-parity/README.md

@@ -121,3 +121,28 @@ Then, on a resumed run here:
 
 No golden `.bpmn` file may be edited to force a match — the derivation must
 reproduce the checked-in golden.
+
+## CI regression guard (S6, nano-ide#321)
+
+The unit suite above (run under `npm test`) does the DERIVE + structural DIFF for
+every ported model. The **final regression guard** adds the third leg — DEPLOY —
+and wires the whole corpus into CI as its own job:
+
+    npm run check:derivation-parity        # scripts/check-derivation-parity.ts
+
+For every model it derives the BPMN from its `defineFlow` port, structurally
+diffs it against the checked-in golden via the **same** S0 harness
+(`normalize` / `assertDerivationParity` — never reimplemented), and **deploys the
+derived model to the in-process `@nanobpm/engine-wasm` engine**
+(`@nanobpm/urban-testkit`), asserting the engine accepts it. Any structural drift
+**or** deploy rejection fails the build. Parked models must each carry a
+documented `blockedReason`, so the corpus can never silently lose coverage; a
+parked model flips into the full derive → diff → deploy loop automatically the
+moment its `flow` lands — no change to the gate.
+
+Because the corpus is (currently) fully parked, the gate runs a **self-proving
+canary** first: it proves a faithful derivation deploys and diffs green, a
+drifted derivation is caught by the diff, and a corrupted model is rejected by
+the engine — so the oracle's red path can never rot into a vacuous green. The
+guard runs on every PR/push as the `derivation-parity` job in
+`.github/workflows/ci.yml`.