@quantiya/codevibe-core 2.0.0 → 2.0.2

package/dist/local-executor/conflict-resolution-store.d.ts

@@ -0,0 +1,210 @@
+import type { ConflictClass, ConflictKind, ConflictSide } from './conflict-types';
+/** The fields that uniquely identify a 3-way conflict region (§4.5 key). */
+export interface ConflictIdInput {
+    repoId: string;
+    path: string;
+    /** base = merge-base side. */
+    base: ConflictSide;
+    /** track = the merging track branch (ours). */
+    track: ConflictSide;
+    /** counterpart = the current integration tip (theirs). */
+    counterpart: ConflictSide;
+    conflictKind: ConflictKind;
+    /** Deterministic 0-based index of the conflict region in the diff3 output. */
+    hunkOrdinal: number;
+    /** The pinned merge-implementation id (git version + strategy / vendored). */
+    mergeImplId: string;
+}
+/**
+ * Compute the deterministic `conflict_id` for a 3-way conflict region. Pure;
+ * identical inputs → identical id; any change in any of the three sides' blob/
+ * mode/type, the conflict kind, the hunk ordinal, or `merge_impl_id` → a
+ * different id (→ re-resolve, never a stale replay).
+ */
+export declare function computeConflictId(input: ConflictIdInput): string;
+/** SHA-256 hex of arbitrary resolved bytes (the audited `resolved_blob_hash`). */
+export declare function hashResolvedBytes(bytes: Buffer): string;
+/** The full agentic-resolution input identity (CP-14 WB2 / #C14-WB2-AGENTIC-IDENTITY). */
+export interface AgenticInstanceKey {
+    /** The off-branch merge-result tree the agent resolved against (full context). */
+    conflictedTree: string;
+    /** The slot's class-2 `conflict_id`s (sorted into the key for order-stability). */
+    conflictIds: readonly string[];
+    /** The resolving agent kind (CLAUDE | CODEX | GEMINI). */
+    implementorAgent: string;
+    /** The resolving agent's per-spawn task identity. */
+    implementorTaskId: string;
+    /** The pinned merge-implementation id (git version + strategy / vendored). */
+    mergeImplId: string;
+}
+/**
+ * Compute the deterministic agentic-resolution `instance_id`. Pure; a change in
+ * the conflict-set, the `conflictedTree` (full context), the resolver agent/task,
+ * or `merge_impl_id` → a distinct instance (never a stale-context replay).
+ */
+export declare function computeAgenticInstanceId(key: AgenticInstanceKey): string;
+/** A snapshot of the three sides' identity (stored for audit + exact-input replay). */
+export interface ConflictSidesSnapshot {
+    base: {
+        blobOid?: string;
+        mode?: string;
+        type: ConflictSide['type'];
+    };
+    track: {
+        blobOid?: string;
+        mode?: string;
+        type: ConflictSide['type'];
+    };
+    counterpart: {
+        blobOid?: string;
+        mode?: string;
+        type: ConflictSide['type'];
+    };
+}
+/** A first-class ConflictResolution audit record (§4.5). */
+export interface ConflictResolutionRecord {
+    conflict_id: string;
+    repoId: string;
+    path: string;
+    conflict_kind: ConflictKind;
+    hunk_ordinal: number;
+    merge_impl_id: string;
+    sides: ConflictSidesSnapshot;
+    /** The durable per-hunk resolved lines (so multiple hunks COMPOSE). */
+    resolved_hunk_patch: string;
+    /** SHA-256 of the fully-resolved FILE bytes — the integrity check on replay. */
+    resolved_blob_hash: string;
+    /** Who resolved it: a deterministic reconciler (lockfile-only in W3-core), the
+     * bounded prompt→JSON LLM, an AGENTIC resolver (CP-14 WB2 — read+write in a
+     * disposable repo; recorded per-slot via {@link AgenticResolutionRecord}, not
+     * here), or a human. */
+    resolver: 'reconciler:lockfile' | 'llm' | 'agentic' | 'human';
+    /** Free-text rationale (byte-explanation for class-1; model/human reasoning). */
+    rationale: string;
+    /** Self-reported confidence (best-effort; class-2 is Tier-2'd regardless). */
+    confidence?: number;
+    /** The resolution class (§4.3). */
+    class: ConflictClass;
+}
+/**
+ * A per-SLOT agentic ConflictResolution audit record (CP-14 WB2). Unlike the
+ * per-hunk {@link ConflictResolutionRecord}, an agentic resolution covers the
+ * whole slot's class-2 conflict-set, is keyed by its full-context
+ * {@link AgenticInstanceKey} (`instance_id`), and binds the resolved TREE OID
+ * (the selective-imported result) + per-file resolved blob OIDs — the
+ * full-committed-tree-OID authentication (agy r2-HIGH) compares the committed
+ * commit tree against `resolved_tree_oid`. There is no `resolved_hunk_patch`:
+ * the agent wrote whole files, so the audit is tree/blob-level, not hunk-level.
+ */
+export interface AgenticResolutionRecord {
+    /** {@link computeAgenticInstanceId} over the slot's {@link AgenticInstanceKey}. */
+    instance_id: string;
+    /** The off-branch merge-result tree the agent resolved against (full context). */
+    conflictedTree: string;
+    /** The slot's class-2 `conflict_id`s this resolution covers (sorted). */
+    conflictIds: string[];
+    implementorAgent: string;
+    implementorTaskId: string;
+    merge_impl_id: string;
+    /** The resolved tree OID (the selective-imported result overlaid on `conflictedTree`). */
+    resolved_tree_oid: string;
+    /**
+     * Per-conflicted-file resolved-content digests (the only paths the agent's edits import).
+     * `blobSha256` is the SHA-256 of the resolved file bytes ({@link hashResolvedBytes}), NOT a
+     * git blob OID (Stage-2 Codex LOW — the prior `blobOid` name was misleading). It is an audit
+     * field only; the full-tree-OID moat ({@link AgenticResolutionRecord.resolved_tree_oid}) is
+     * what `verifyAgenticSlot` checks — this per-file digest is NOT on any OID-auth path.
+     */
+    resolved_blobs: Array<{
+        path: string;
+        blobSha256: string;
+    }>;
+    resolver: 'agentic';
+    /** Agentic resolution is always class-2 (the LLM-resolvable tier). */
+    class: 2;
+    /** Free-text rationale (best-effort; the slot is final-tip Tier-2'd regardless). */
+    rationale?: string;
+}
+/** Strip a `ConflictSide` to its stored identity snapshot (no raw bytes). */
+export declare function snapshotSides(input: ConflictIdInput): ConflictSidesSnapshot;
+/**
+ * The durable ConflictResolution store (§4.5). Keyed by `conflict_id`. The
+ * merge-train looks up a conflict's id BEFORE invoking any model: on a hit the
+ * recorded resolution replays (no model call); on a miss it resolves and
+ * `put`s the record. Implementations persist to the audit corpus (the
+ * `MergeGateResult` chain) with the same EventDedupKey discipline; the
+ * in-memory impl below is for tests + a same-process replay cache.
+ */
+export interface ConflictResolutionStore {
+    get(conflictId: string): Promise<ConflictResolutionRecord | null>;
+    /**
+     * Persist a resolution. Idempotent on `conflict_id`: a second put with the
+     * SAME conflict_id keeps the ORIGINAL record (the recorded resolution for a
+     * given exact 3-way input is immutable — never overwritten by a re-run).
+     * Returns the record now in the store (original on a dup).
+     *
+     * `attemptId` (CP-14 WB2) tags the record as PENDING for that resolve attempt
+     * until the `resolution_recorded` WAL marker is durable; a crashed attempt's
+     * pending records are dropped by {@link clearPending} on recovery (case 3),
+     * never colliding with a fresh non-deterministic re-attempt. Omit for a
+     * deterministic (class-1 / replay-stable) record that has no collision risk.
+     */
+    put(record: ConflictResolutionRecord, attemptId?: string): Promise<ConflictResolutionRecord>;
+    /** Look up an agentic per-slot resolution by its `instance_id`. */
+    getAgentic(instanceId: string): Promise<AgenticResolutionRecord | null>;
+    /**
+     * Persist an agentic per-slot resolution (keyed by `instance_id`). Idempotent
+     * on `instance_id` (same full-context instance → keep the original). `attemptId`
+     * tags it PENDING until the WAL marker (see {@link put}).
+     */
+    putAgentic(record: AgenticResolutionRecord, attemptId?: string): Promise<AgenticResolutionRecord>;
+    /**
+     * Recovery case 3 (Codex r5 / agy r5): drop every PENDING (pre-WAL) record
+     * written under `attemptId` — per-hunk AND agentic — so a fresh non-deterministic
+     * re-dispatch can write without a first-writer-wins collision. Pending records
+     * are non-authoritative by construction (only a durable WAL makes them load-
+     * bearing), so clearing them is safe. No-op for an unknown `attemptId`.
+     */
+    clearPending(attemptId: string): Promise<void>;
+    /** Explicitly delete a single record by `conflict_id` or agentic `instance_id`. */
+    delete(key: string): Promise<void>;
+}
+/** In-memory {@link ConflictResolutionStore} (tests + same-process replay cache). */
+export declare class InMemoryConflictResolutionStore implements ConflictResolutionStore {
+    private readonly byId;
+    private readonly agenticById;
+    /** attemptId → the keys (conflict_id / instance_id) it wrote while PENDING. */
+    private readonly pendingByAttempt;
+    private trackPending;
+    get(conflictId: string): Promise<ConflictResolutionRecord | null>;
+    put(record: ConflictResolutionRecord, attemptId?: string): Promise<ConflictResolutionRecord>;
+    getAgentic(instanceId: string): Promise<AgenticResolutionRecord | null>;
+    putAgentic(record: AgenticResolutionRecord, attemptId?: string): Promise<AgenticResolutionRecord>;
+    clearPending(attemptId: string): Promise<void>;
+    delete(key: string): Promise<void>;
+    /** Test helper: number of distinct recorded per-hunk resolutions. */
+    get size(): number;
+    /** Test helper: number of distinct recorded agentic per-slot resolutions. */
+    get agenticSize(): number;
+}
+/**
+ * Verify that `bytes` match the record's audited `resolved_blob_hash`. The bytes
+ * MUST be at the SAME granularity the record hashed:
+ *   - class-2 (per-hunk): the resolved HUNK bytes (`resolved_hunk_patch`);
+ *   - class-1 (whole-file): the whole resolved FILE bytes.
+ * Used as a fail-closed integrity guard: on a fresh resolve it confirms the
+ * stored hash reproduces the bytes; on a durable-store REPLAY it catches a
+ * corrupted record — a mismatch → FAIL CLOSED (re-resolve / escalate), never
+ * adopt unverified bytes (§4.5).
+ */
+export declare function verifyResolvedBytes(record: ConflictResolutionRecord, bytes: Buffer): boolean;
+/**
+ * Recompute the `conflict_id` from a record's STORED identity fields (repoId /
+ * path / sides {blob,mode,type} / conflict_kind / hunk_ordinal / merge_impl_id).
+ * On a durable-store REPLAY the result MUST equal both the record's own
+ * `conflict_id` AND the lookup key — a mismatch means the record's identity
+ * metadata was tampered/corrupted (the hunk-hash alone wouldn't catch a flipped
+ * `class`/`sides`/`kind`), so the caller FAILS CLOSED instead of replaying it
+ * (Stage-2 r1 Codex HIGH — replay must not trust mutable record metadata).
+ */
+export declare function recomputeConflictIdFromRecord(record: ConflictResolutionRecord): string;

package/dist/local-executor/conflict-types.d.ts

@@ -0,0 +1,86 @@
+/**
+ * The git conflict KIND for a path (§4.5). Only `content` (a regular-file text
+ * 3-way content conflict) is class-1/class-2 eligible; every other kind is a
+ * hard route-to-human (class-3) — a blob-only resolution would be unsound for a
+ * rename/mode/type/submodule/binary conflict.
+ */
+export type ConflictKind = 'content' | 'add_add' | 'rename_rename' | 'rename_delete' | 'modify_delete' | 'mode_change' | 'type_change' | 'submodule' | 'binary';
+/** A git tree-entry object type for one side of a conflict (§4.5 key input). */
+export type GitObjectType = 'regular' | 'symlink' | 'gitlink';
+/**
+ * One side (base / track / counterpart) of a 3-way conflict for a single path.
+ * `blobOid`/`mode`/`type` are part of the `conflict_id` key (§4.5) so a same-blob
+ * but different-mode/type pair can never stale-replay across each other.
+ * `content` is the raw bytes (present for regular text sides; absent for a
+ * deleted side or a non-blob).
+ */
+export interface ConflictSide {
+    /** The git blob OID (40/64-hex), or undefined for a deleted/absent side. */
+    blobOid?: string;
+    /** The octal tree-entry mode (e.g. `100644`, `100755`, `120000`, `160000`). */
+    mode?: string;
+    /** The object type of this side. */
+    type: GitObjectType;
+    /** Raw bytes of this side's blob (regular text sides), or undefined. */
+    content?: Buffer;
+}
+/**
+ * The full per-path conflict descriptor the classifier + resolver consume.
+ * Assembled by the merge-train wiring (W3-6) from the 3-way blob extraction.
+ */
+export interface ConflictFileMeta {
+    /** Repo-relative path (the integration-tip path). */
+    path: string;
+    /** The git conflict kind. */
+    conflictKind: ConflictKind;
+    /** True if any side is detected binary (NUL byte / git binary heuristic). */
+    isBinary: boolean;
+    /** True if any present REGULAR side is not valid UTF-8 (and not NUL-binary) —
+     * e.g. a Latin-1 / invalid-UTF-8 text file. The diff3 parse + compose path is
+     * UTF-8 string-based, so such a blob would round-trip through `U+FFFD`
+     * replacement bytes and silently corrupt unchanged context lines. It is routed
+     * to class-3 (`non_utf8`), FAILING CLOSED before class-2 (Stage-2 r6 Codex MED).
+     * A byte-oriented diff3 path could re-enable these as class-2; that is a follow-on. */
+    isNonUtf8: boolean;
+    /** True if any touched path carries a Git-LFS filter (→ class-3, §4.2). */
+    hasLfs: boolean;
+    /** True if `.gitattributes` declares a custom `merge=`/`filter=` driver for
+     * this path (→ class-3, §4.2) — never run a driver, never silently strip it. */
+    hasDangerousAttr: boolean;
+    /** The three sides (base = merge-base; track = the merging branch; counterpart
+     * = the current integration tip). */
+    base: ConflictSide;
+    track: ConflictSide;
+    counterpart: ConflictSide;
+}
+/** The resolution class for a conflict (§4.3). */
+export type ConflictClass = 1 | 2 | 3;
+/** Why a conflict was put in its class (audit + the human-gate surface). */
+export interface ConflictClassification {
+    /** 1 = deterministic-mechanical, 2 = LLM-assisted (Tier-2'd), 3 = human gate. */
+    class: ConflictClass;
+    /** Human-readable rationale. */
+    reason: string;
+    /** For class-1: the deterministic reconciler family to apply. W3-core ships
+     * only the structurally-safe `lockfile` reconciler; whitespace/import-order
+     * are deferred to the language-aware follow-on (see class1-reconcilers.ts). */
+    reconciler?: 'lockfile';
+    /** For class-3: the structural trigger category that forced the human gate. */
+    humanGateTrigger?: 'shared_contract' | 'dangerous_attr' | 'submodule' | 'lfs' | 'binary' | 'non_utf8' | 'mode_change' | 'type_change' | 'rename' | 'add_add' | 'modify_delete' | 'lockfile_version_delta';
+}
+/**
+ * One conflict HUNK within a path — the unit a resolution is recorded against
+ * (§4.5 stores the per-hunk `resolved_hunk_patch` so multiple hunks on one file
+ * COMPOSE rather than overwrite). `hunkOrdinal` is the deterministic index of
+ * the conflict region in the pinned diff3 output.
+ */
+export interface ConflictHunk {
+    /** Deterministic 0-based index of this conflict region in the diff3 output. */
+    hunkOrdinal: number;
+    /** The base (merge-base) lines of this region. */
+    baseLines: string[];
+    /** The track-branch (ours) lines of this region. */
+    trackLines: string[];
+    /** The integration-tip (theirs) lines of this region. */
+    counterpartLines: string[];
+}

package/dist/local-executor/cp7-audit-writer.d.ts

@@ -0,0 +1,152 @@
+import type { AuditKindCp7, StrictAuditSink } from "../credential-broker/audit-sink";
+/** One CP-7 audit-log entry, mirroring `codevibe-audit::AuditEntry` (no new fields). */
+export interface Cp7AuditEntry {
+    /** Primary key — this entry's identity (a uuid). NOT the dedup key. */
+    entry_id: string;
+    /** Foreign key to the orchestration task this entry describes. */
+    task_id: string;
+    /** Which CP-7 audit kind (snake_case wire form). */
+    kind: AuditKindCp7;
+    /** Typed payload per `kind` (the broker/LE-supplied object). */
+    payload: Record<string, unknown>;
+    /** When the event occurred (a fixed ISO-8601 ms-precision UTC string). */
+    timestamp: string;
+    /**
+     * Hex SHA-256 of the canonical serialization of the PREVIOUS entry in this
+     * task's file. `null` ONLY for the genesis (first) entry — the documented
+     * zero/empty sentinel (§W3.2 step 3).
+     */
+    prev_hash: string | null;
+    /** Deterministic event-identity key (the framed W0 helper output, hex). */
+    event_dedup_key: string;
+}
+/** The pinned canonical-form version tag (bump = chain-breaking migration). */
+export declare const CP7_CANONICAL_FORM_VERSION = "cp7-w3-canonical-v1";
+/** The documented genesis `prev_hash` sentinel — `null` (first entry only). */
+export declare const GENESIS_PREV_HASH: null;
+/**
+ * Deterministic, stable-key-ordered JSON serialization of an arbitrary
+ * JSON-able value. Object keys are recursively sorted ascending (JS default
+ * `<` on the key strings — UTF-16 code-unit order); arrays keep element order;
+ * scalars use `JSON.stringify`. This is the `payload` serializer (and is reused
+ * for the whole canonical object so the ordering rule is single-sourced).
+ *
+ * Rejects values that JSON cannot round-trip deterministically: `undefined`,
+ * functions, and non-finite numbers throw (a payload carrying one is a bug —
+ * fail closed rather than silently drop a field and corrupt the chain).
+ */
+export declare function canonicalJson(value: unknown): string;
+/**
+ * Serialize a {@link Cp7AuditEntry} to its PINNED canonical bytes (a UTF-8
+ * string). The 7 fields are emitted in {@link CANONICAL_FIELD_ORDER}; `payload`
+ * (and every field, via the single-sourced {@link canonicalJson}) is
+ * stable-key-ordered. THIS string is what `computeEntryHash` hashes — the
+ * verifier contract (CP-8 must reproduce it).
+ */
+export declare function canonicalEntryBytes(entry: Cp7AuditEntry): string;
+/**
+ * The TS-NATIVE tamper-evident chain hash of a {@link Cp7AuditEntry}: lowercase
+ * hex SHA-256 over its {@link canonicalEntryBytes}. The NEXT entry's `prev_hash`
+ * is this value; flipping ANY field of THIS entry changes these bytes → changes
+ * this hash → breaks the next entry's `prev_hash` link → chain verify fails.
+ *
+ * NOT a byte-mirror of the Rust `sha256_hex(serde_json::to_string(&AuditEntry))`
+ * chain (§W3.2 step 3) — TS-native by design.
+ */
+export declare function computeEntryHash(entry: Cp7AuditEntry): string;
+/**
+ * Verify a hash chain over an ordered list of entries (the CP-8 reader logic,
+ * inlined here for the W3 self-consistency + mutation tests). Returns the index
+ * of the FIRST broken link, or `null` if the whole chain verifies.
+ *
+ * A chain is valid iff entry[0].prev_hash === GENESIS sentinel AND for every
+ * i>0, entry[i].prev_hash === computeEntryHash(entry[i-1]).
+ */
+export declare function verifyChain(entries: ReadonlyArray<Cp7AuditEntry>): number | null;
+/**
+ * The real {@link StrictAuditSink} for a live session (§W3.2). ONE instance per
+ * `task_id`, bound to that task's `audit.jsonl` path. Every `emit`:
+ *   1. allocates an `entry_id` (uuid),
+ *   2. computes the framed `event_dedup_key` from the payload,
+ *   3. chains `prev_hash` off the last entry written to THIS file,
+ *   4. builds the {@link Cp7AuditEntry} (no new fields),
+ *   5. durably appends (`O_CREAT|O_APPEND|O_WRONLY|`**`O_NOFOLLOW`** open +
+ *      `fstat` regular-file assert + `writeSync` + **`fsyncSync`**) and returns
+ *      `{ack}` ONLY after fsync; ANY throw → `{nack}` (NEVER swallowed). The
+ *      O_NOFOLLOW open refuses to follow a planted leaf symlink (ELOOP) so the
+ *      record can never be redirected into the agent-writable workdir; a
+ *      post-write finalize failure POISONS the writer (fail closed),
+ *   6. with all appends serialized per-task (in-instance queue) so concurrent
+ *      emits chain deterministically.
+ */
+export declare class Cp7AuditWriter implements StrictAuditSink {
+    private readonly taskId;
+    private readonly auditPath;
+    /** The last entry's hash (the next entry's `prev_hash`). `null` = genesis. */
+    private lastHash;
+    /** True once we've established `lastHash` (in-memory OR from the file). */
+    private chainInitialized;
+    /** The in-instance serialization tail — appends chain onto this. */
+    private appendQueue;
+    /**
+     * Stage-2 r1 MEDIUM — the writer is POISONED once an append has WRITTEN bytes
+     * to disk but FAILED to complete cleanly (fsync/close threw AFTER the write
+     * syscall). The bytes are durable but `lastHash` did NOT advance, so the
+     * on-disk chain has an orphaned line a later emit would acknowledge against a
+     * stale `prev_hash` → a forever-broken chain. Once poisoned, EVERY subsequent
+     * `emit` fails closed with `{nack}` (NEVER acks onto a broken chain). This is
+     * set ONLY on a POST-write failure — a PRE-write failure (open/O_NOFOLLOW/
+     * fstat reject → the file is untouched) nacks WITHOUT poisoning, since the
+     * chain on disk is still intact and the next emit can proceed.
+     */
+    private poisoned;
+    /**
+     * @param taskId    The orchestration task_id — the audit scope (§3.5). Bound
+     *                  at construction; every entry carries it + the dedup keys
+     *                  frame on it.
+     * @param auditPath The per-task `audit.jsonl` absolute path. The LE derives it
+     *                  as `<repoRootCanonical>/.codevibe/audit/<group>/<track>/`
+     *                  and asserts (containment guard) it is OUTSIDE the agent's
+     *                  workdir BEFORE constructing this (see engage-substrate.ts).
+     */
+    constructor(taskId: string, auditPath: string);
+    /** The per-task audit file path (for the E2E + teardown). */
+    get path(): string;
+    /**
+     * Emit one strict audit row. Resolves `{ack: entry_id}` ONLY after the row is
+     * durably fsync'd; resolves `{nack: reason}` on ANY failure (open/O_NOFOLLOW
+     * ELOOP/fstat/write/fsync/canonicalization). NEVER throws, NEVER swallows a
+     * failure into a false ack.
+     *
+     * Appends are serialized onto an in-instance queue so concurrent emits chain
+     * deterministically (no interleaved `prev_hash` race).
+     *
+     * Stage-2 r1 MEDIUM — POISON FAIL-CLOSED: if an append wrote bytes to disk but
+     * failed to finalize (fsync/close threw after the write), the writer becomes
+     * POISONED and EVERY subsequent emit nacks (`"writer poisoned after partial
+     * write"`) — never an ack onto the now-broken on-disk chain. A PRE-write
+     * failure (open/O_NOFOLLOW/fstat/dedup/canonicalize) nacks WITHOUT poisoning
+     * (the file is untouched; the next emit may proceed).
+     */
+    emit(kind: AuditKindCp7, payload: Record<string, unknown>): Promise<{
+        ack: string;
+    } | {
+        nack: string;
+    }>;
+    /**
+     * The serialized single-append body. Runs under the queue (never concurrently
+     * with another append on this instance). Returns `{ack}`/`{nack}` — NEVER
+     * rejects (a throw is caught + converted to a nack so the chain tail stays
+     * a resolved promise).
+     */
+    private appendOne;
+    /**
+     * Recover the chain tail from an existing file (resumed session). Reads the
+     * file's last non-empty line, parses it as a {@link Cp7AuditEntry}, and
+     * returns `computeEntryHash` of it. Returns `null` (genesis) if the file is
+     * absent or empty. A corrupt last line THROWS — better a hard fail than
+     * silently re-chaining off a forged/truncated tail (mirrors the Rust
+     * `FileAuditWriter::open` CorruptedTail contract).
+     */
+    private readLastHashFromFile;
+}