activate-agentmd 2.4.0

package/src/lib/detect.js

@@ -0,0 +1,352 @@
+/**
+ * detect.js
+ *
+ * Inspects a project directory and maps what it finds to packages that
+ * actually exist in the registry.
+ *
+ * Two rules govern this file:
+ *
+ *  1. Never recommend a package that isn't in the registry. Every id below is
+ *     asserted against the registry by the test suite, so a renamed preset
+ *     breaks CI instead of producing a dead recommendation.
+ *  2. Detecting a technology is not the same as having packages for it. The
+ *     registry has no Python, Go or Rust packages today; those stacks are
+ *     reported as detected with zero recommendations rather than being
+ *     mapped to something vaguely adjacent.
+ */
+
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+
+/** Files we look for, keyed by the signal they represent. */
+const FILE_SIGNALS = [
+  { file: "Dockerfile", signal: "docker" },
+  { file: "docker-compose.yml", signal: "docker-compose" },
+  { file: "docker-compose.yaml", signal: "docker-compose" },
+  { file: "vercel.json", signal: "vercel" },
+  { file: "requirements.txt", signal: "python" },
+  { file: "pyproject.toml", signal: "python" },
+  { file: "go.mod", signal: "go" },
+  { file: "Cargo.toml", signal: "rust" },
+  { file: "pom.xml", signal: "java" },
+  { file: "build.gradle", signal: "java" },
+  { file: "tsconfig.json", signal: "typescript" },
+  { file: "tailwind.config.js", signal: "tailwind" },
+  { file: "tailwind.config.ts", signal: "tailwind" },
+  { file: "next.config.js", signal: "nextjs" },
+  { file: "next.config.ts", signal: "nextjs" },
+  { file: "next.config.mjs", signal: "nextjs" },
+];
+
+const DIR_SIGNALS = [
+  { dir: path.join(".github", "workflows"), signal: "github-actions" },
+  { dir: "prisma", signal: "prisma" },
+  { dir: "k8s", signal: "kubernetes" },
+  { dir: "kubernetes", signal: "kubernetes" },
+];
+
+/** npm dependency name (or prefix, with a trailing *) -> signal. */
+const DEPENDENCY_SIGNALS = {
+  next: "nextjs",
+  react: "react",
+  vue: "vue",
+  "@angular/core": "angular",
+  svelte: "svelte",
+  typescript: "typescript",
+  tailwindcss: "tailwind",
+  express: "express",
+  fastify: "fastify",
+  "@nestjs/core": "nestjs",
+  prisma: "prisma",
+  "@prisma/client": "prisma",
+  "drizzle-orm": "orm",
+  typeorm: "orm",
+  sequelize: "orm",
+  mongoose: "mongodb",
+  mongodb: "mongodb",
+  pg: "postgres",
+  postgres: "postgres",
+  mysql2: "mysql",
+  redis: "redis",
+  ioredis: "redis",
+  graphql: "graphql",
+  vitest: "unit-tests",
+  jest: "unit-tests",
+  mocha: "unit-tests",
+  "@playwright/test": "e2e-tests",
+  playwright: "e2e-tests",
+  cypress: "e2e-tests",
+  "next-auth": "auth",
+  "@auth/core": "auth",
+  passport: "auth",
+  jsonwebtoken: "jwt",
+  jose: "jwt",
+  zustand: "state-management",
+  redux: "state-management",
+  "@reduxjs/toolkit": "state-management",
+  "@tanstack/react-query": "state-management",
+};
+
+/**
+ * signal -> packages, as `<category>/<preset>` (the model is chosen by the
+ * caller). Signals with an empty list are reported but produce nothing —
+ * that's deliberate, see the header.
+ */
+const RECOMMENDATIONS = {
+  nextjs: ["Frontend/nextjs", "Backend/nextjs", "Frontend/server-components", "Frontend/routing", "Frontend/metadata"],
+  react: ["Frontend/react", "Frontend/hooks", "Frontend/client-components"],
+  typescript: ["Frontend/typescript"],
+  tailwind: ["Frontend/tailwind"],
+  "state-management": ["Frontend/state-management"],
+  express: ["Backend/express", "Backend/middlewares", "Backend/error-handling"],
+  prisma: ["Database/prisma", "Database/orm", "Database/migration", "Database/schema-design"],
+  orm: ["Database/orm", "Database/migration", "Database/schema-design"],
+  postgres: ["Database/postgres", "Database/indexes", "Database/query-optimization"],
+  mysql: ["Database/mysql", "Database/indexes"],
+  mongodb: ["Database/mongodb", "Database/schema-design"],
+  redis: ["Database/redis", "Performance/caching"],
+  graphql: ["API/graphql", "API/pagination"],
+  auth: ["Security/authentication", "Security/authorization", "Security/oauth"],
+  jwt: ["Security/jwt", "Security/authentication"],
+  "unit-tests": ["Testing/unit", "Testing/test-strategy"],
+  "e2e-tests": ["Testing/e2e", "Testing/accessibility"],
+  docker: ["DevOps/docker", "DevOps/environments"],
+  "docker-compose": ["DevOps/docker-compose"],
+  kubernetes: ["DevOps/kubernetes", "DevOps/rollback"],
+  "github-actions": ["DevOps/github-actions", "DevOps/cicd"],
+  vercel: ["DevOps/vercel", "DevOps/deployment"],
+
+  // Detected, but the registry has nothing for them yet. Listing them with an
+  // empty array is how `init` stays honest about coverage.
+  vue: [],
+  angular: [],
+  svelte: [],
+  fastify: [],
+  nestjs: [],
+  python: ["Backend/python-conventions", "Testing/pytest", "Backend/python-async"],
+  fastapi: ["Backend/fastapi", "Backend/pydantic", "Backend/python-async"],
+  django: ["Backend/django", "Testing/pytest"],
+  flask: ["Backend/flask", "Testing/pytest"],
+  pydantic: ["Backend/pydantic"],
+  sqlalchemy: ["Database/sqlalchemy"],
+  pytest: ["Testing/pytest"],
+  go: ["Backend/go-conventions", "Backend/go-errors", "Backend/go-http", "Backend/go-concurrency", "Testing/go-testing", "Database/go-database", "Performance/go-performance"],
+  rust: [],
+  java: [],
+};
+
+/** Recommended for every project regardless of stack. */
+const BASELINE = ["Security/owasp", "Review/code-review", "AI/agent-rules"];
+
+/** Human labels for the signals `init` prints. */
+const LABELS = {
+  nextjs: "Next.js",
+  react: "React",
+  vue: "Vue",
+  angular: "Angular",
+  svelte: "Svelte",
+  typescript: "TypeScript",
+  tailwind: "Tailwind CSS",
+  "state-management": "Client state management",
+  express: "Express",
+  fastify: "Fastify",
+  nestjs: "NestJS",
+  prisma: "Prisma",
+  orm: "SQL ORM",
+  postgres: "PostgreSQL",
+  mysql: "MySQL",
+  mongodb: "MongoDB",
+  redis: "Redis",
+  graphql: "GraphQL",
+  auth: "Authentication",
+  jwt: "JWT",
+  "unit-tests": "Unit testing",
+  "e2e-tests": "End-to-end testing",
+  docker: "Docker",
+  "docker-compose": "Docker Compose",
+  kubernetes: "Kubernetes",
+  "github-actions": "GitHub Actions",
+  vercel: "Vercel",
+  python: "Python",
+  fastapi: "FastAPI",
+  django: "Django",
+  flask: "Flask",
+  pydantic: "Pydantic",
+  sqlalchemy: "SQLAlchemy",
+  pytest: "pytest",
+  go: "Go",
+  rust: "Rust",
+  java: "Java",
+};
+
+/**
+ * A directory holding one of these is treated as a workspace worth scanning
+ * on its own.
+ *
+ * Deliberately not a workspace-config parser. Reading `workspaces` globs from
+ * package.json would miss pnpm-workspace.yaml (needs a YAML parser), Cargo
+ * `[workspace] members`, Go multi-module layouts and Nx project graphs — four
+ * formats, four parsers, four things to keep current. Looking for the manifest
+ * files themselves covers every one of those layouts, and any layout nobody
+ * has invented yet, in one bounded walk.
+ */
+const WORKSPACE_MARKERS = [
+  "package.json",
+  "pyproject.toml",
+  "requirements.txt",
+  "go.mod",
+  "Cargo.toml",
+  "pom.xml",
+  "build.gradle",
+  "Dockerfile",
+];
+
+/** Never descended into: build output, dependencies, and virtualenvs. */
+const SKIP_DIRS = new Set([
+  "node_modules", ".git", ".next", ".nuxt", ".svelte-kit", ".turbo", ".venv",
+  "venv", "__pycache__", "dist", "build", "out", "target", "vendor", "coverage",
+  ".cache", ".terraform", "bin", "obj",
+]);
+
+/**
+ * How deep to look for workspaces. `apps/web`, `services/api` and
+ * `packages/ui/core` are all within three segments of the root, which covers
+ * every monorepo layout in common use without walking a whole source tree.
+ */
+const MAX_DEPTH = 3;
+
+function exists(cwd, relative) {
+  return fs.existsSync(path.join(cwd, relative));
+}
+
+/**
+ * Directories to scan: the root, plus every nested directory holding a
+ * manifest. Returns paths relative to `cwd`, root first.
+ */
+function findWorkspaces(cwd, maxDepth = MAX_DEPTH) {
+  const found = ["."];
+  const walk = (relative, depth) => {
+    if (depth > maxDepth) return;
+    let entries;
+    try {
+      entries = fs.readdirSync(path.join(cwd, relative), { withFileTypes: true });
+    } catch {
+      return; // unreadable directory shouldn't abort the scan
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory() || SKIP_DIRS.has(entry.name) || entry.name.startsWith(".")) continue;
+      const child = relative === "." ? entry.name : path.join(relative, entry.name);
+      if (WORKSPACE_MARKERS.some((m) => exists(cwd, path.join(child, m)))) found.push(child);
+      walk(child, depth + 1);
+    }
+  };
+  walk(".", 1);
+  return found;
+}
+
+/** Scan exactly one directory. Returns Map of signal -> evidence. */
+function scanOne(dir) {
+  const found = new Map();
+  const note = (signal, via) => {
+    if (!found.has(signal)) found.set(signal, via);
+  };
+
+  for (const { file, signal } of FILE_SIGNALS) {
+    if (exists(dir, file)) note(signal, file);
+  }
+  for (const { dir: sub, signal } of DIR_SIGNALS) {
+    if (exists(dir, sub)) note(signal, sub + "/");
+  }
+
+  const pkgPath = path.join(dir, "package.json");
+  if (fs.existsSync(pkgPath)) {
+    let pkg;
+    try {
+      pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+    } catch {
+      pkg = null; // malformed package.json shouldn't abort the whole scan
+    }
+    if (pkg) {
+      const deps = Object.keys({ ...pkg.dependencies, ...pkg.devDependencies });
+      for (const dep of deps) {
+        const signal = Object.prototype.hasOwnProperty.call(DEPENDENCY_SIGNALS, dep)
+          ? DEPENDENCY_SIGNALS[dep]
+          : null;
+        if (signal) note(signal, `package.json (${dep})`);
+      }
+    }
+  }
+
+  // Python dependency files are plain text, so a name match is enough. Only
+  // libraries with a package behind them are listed.
+  for (const file of ["requirements.txt", "pyproject.toml"]) {
+    const p = path.join(dir, file);
+    if (!fs.existsSync(p)) continue;
+    let text = "";
+    try { text = fs.readFileSync(p, "utf-8").toLowerCase(); } catch { continue; }
+    for (const lib of ["fastapi", "django", "flask", "pydantic", "sqlalchemy", "pytest"]) {
+      if (new RegExp(`(^|[\\s"'\\[])${lib}([\\s"'\\]=<>~!;,]|$)`, "m").test(text)) note(lib, `${file} (${lib})`);
+    }
+  }
+
+  return found;
+}
+
+/**
+ * Scan a project, including every workspace in a monorepo.
+ *
+ * Returns { signals, packages, workspaces }. `signals` and `packages` are the
+ * union across the whole repo — one `agentmd link` writes one config, so the
+ * agent needs the union regardless of where each signal came from. The
+ * per-workspace breakdown is kept so `init` can show which package produced
+ * what rather than presenting a merged list as if it were one stack.
+ */
+function detect(cwd) {
+  const dirs = findWorkspaces(cwd);
+  const evidence = new Map(); // signal -> "apps/web/package.json (next)"
+  const workspaces = [];
+
+  for (const relative of dirs) {
+    const found = scanOne(path.join(cwd, relative));
+    if (found.size === 0) continue;
+
+    for (const [signal, via] of found) {
+      if (!evidence.has(signal)) {
+        evidence.set(signal, relative === "." ? via : `${relative}/${via}`);
+      }
+    }
+
+    const ids = [...found.keys()];
+    workspaces.push({
+      path: relative,
+      signals: ids.map((signal) => ({ signal, label: LABELS[signal] || signal, via: found.get(signal) })),
+      packages: [...new Set(ids.flatMap((s) => RECOMMENDATIONS[s] || []))],
+    });
+  }
+
+  const signals = [...evidence.entries()].map(([signal, via]) => ({
+    signal,
+    label: LABELS[signal] || signal,
+    via,
+    packages: RECOMMENDATIONS[signal] || [],
+  }));
+
+  const packages = [...new Set(signals.flatMap((s) => s.packages).concat(BASELINE))];
+
+  return { signals, packages, workspaces };
+}
+
+module.exports = {
+  detect,
+  findWorkspaces,
+  scanOne,
+  RECOMMENDATIONS,
+  BASELINE,
+  LABELS,
+  DEPENDENCY_SIGNALS,
+  FILE_SIGNALS,
+  DIR_SIGNALS,
+  WORKSPACE_MARKERS,
+};

package/src/lib/diff.js

@@ -0,0 +1,142 @@
+/**
+ * diff.js
+ *
+ * Line diff for `update --dry`, so you can see what an update would do to a
+ * package before it touches the file.
+ *
+ * "Trust us, run it and find out" is not a reasonable thing to ask of a tool
+ * that rewrites instructions an agent will act on. The preview is the point.
+ *
+ * Hand-rolled rather than pulled from npm: the CLI's zero-runtime-dependency
+ * property is worth more than the 40 lines below, and a package manager for
+ * supply-chain-sensitive content adding a transitive tree to print a diff
+ * would be its own punchline.
+ */
+
+"use strict";
+
+const pc = require("picocolors");
+
+/**
+ * Above this many differing lines on either side, the quadratic LCS table
+ * stops being worth it (1500² Uint32 is ~9 MB) and a full replace reads no
+ * worse than a line-matched diff would.
+ */
+const MAX_LCS = 1500;
+
+/**
+ * Diff two line arrays into [marker, text] pairs where marker is " ", "-" or "+".
+ *
+ * Common prefix and suffix are trimmed first. For the edits this tool actually
+ * makes — a paragraph rewritten inside an otherwise stable document — that
+ * collapses the LCS problem to a handful of lines.
+ */
+function diffLines(a, b) {
+  let start = 0;
+  while (start < a.length && start < b.length && a[start] === b[start]) start++;
+
+  let endA = a.length;
+  let endB = b.length;
+  while (endA > start && endB > start && a[endA - 1] === b[endB - 1]) {
+    endA--;
+    endB--;
+  }
+
+  const out = [];
+  for (let i = 0; i < start; i++) out.push([" ", a[i]]);
+
+  const midA = a.slice(start, endA);
+  const midB = b.slice(start, endB);
+  const n = midA.length;
+  const m = midB.length;
+
+  if (n > MAX_LCS || m > MAX_LCS) {
+    for (const line of midA) out.push(["-", line]);
+    for (const line of midB) out.push(["+", line]);
+  } else {
+    // table[i][j] = length of the LCS of midA[i..] and midB[j..]
+    const table = Array.from({ length: n + 1 }, () => new Uint32Array(m + 1));
+    for (let i = n - 1; i >= 0; i--) {
+      for (let j = m - 1; j >= 0; j--) {
+        table[i][j] =
+          midA[i] === midB[j]
+            ? table[i + 1][j + 1] + 1
+            : Math.max(table[i + 1][j], table[i][j + 1]);
+      }
+    }
+
+    let i = 0;
+    let j = 0;
+    while (i < n && j < m) {
+      if (midA[i] === midB[j]) {
+        out.push([" ", midA[i]]);
+        i++;
+        j++;
+      } else if (table[i + 1][j] >= table[i][j + 1]) {
+        out.push(["-", midA[i++]]);
+      } else {
+        out.push(["+", midB[j++]]);
+      }
+    }
+    while (i < n) out.push(["-", midA[i++]]);
+    while (j < m) out.push(["+", midB[j++]]);
+  }
+
+  for (let i = endA; i < a.length; i++) out.push([" ", a[i]]);
+  return out;
+}
+
+/** Added and removed line counts, for a one-line summary. */
+function stat(before, after) {
+  const ops = diffLines(before.split("\n"), after.split("\n"));
+  return {
+    added: ops.filter(([m]) => m === "+").length,
+    removed: ops.filter(([m]) => m === "-").length,
+  };
+}
+
+/**
+ * Drop runs of unchanged lines, keeping `context` on each side of every edit.
+ * Elided runs are marked "@" so the output never implies the file is shorter
+ * than it is.
+ */
+function toHunks(ops, context) {
+  const keep = new Set();
+  for (let i = 0; i < ops.length; i++) {
+    if (ops[i][0] === " ") continue;
+    for (let k = Math.max(0, i - context); k <= Math.min(ops.length - 1, i + context); k++) {
+      keep.add(k);
+    }
+  }
+
+  const out = [];
+  let previous = -1;
+  for (let i = 0; i < ops.length; i++) {
+    if (!keep.has(i)) continue;
+    if (previous !== -1 && i > previous + 1) out.push(["@", ""]);
+    out.push(ops[i]);
+    previous = i;
+  }
+  return out;
+}
+
+/** Render a diff for the terminal. Returns "" when the two sides are identical. */
+function formatDiff(before, after, options) {
+  const { context = 2, maxLines = 24 } = options || {};
+  const hunks = toHunks(diffLines(before.split("\n"), after.split("\n")), context);
+  if (hunks.length === 0) return "";
+
+  const lines = hunks.slice(0, maxLines).map(([marker, text]) => {
+    if (marker === "+") return pc.green(`     + ${text}`);
+    if (marker === "-") return pc.red(`     - ${text}`);
+    if (marker === "@") return pc.dim("     ⋮");
+    return pc.dim(`       ${text}`);
+  });
+
+  const hidden = hunks.length - maxLines;
+  if (hidden > 0) lines.push(pc.dim(`     … ${hidden} more diff line${hidden === 1 ? "" : "s"}`));
+
+  return lines.join("\n");
+}
+
+module.exports = { diffLines, formatDiff, stat };

package/src/lib/enterprise.js

@@ -0,0 +1,140 @@
+/**
+ * enterprise.js
+ *
+ * `.agentmd/enterprise.json` — the file a company commits so every developer
+ * and every CI run in that repo is pointed at the same place, without anyone
+ * having to remember a flag.
+ *
+ *   {
+ *     "privateRegistry": "https://standards.acme.internal/agentmd",
+ *     "cloudUrl":        "https://ci.acme.internal/agentmd",
+ *     "licenseKey":      "agmd_…",
+ *     "requireSso":      true,
+ *     "ssoProvider":     "okta",
+ *     "allowPublicRegistry": true,
+ *     "pinnedStandards": ["Security/owasp", "Review/code-review"]
+ *   }
+ *
+ * It is committed, so it holds no secrets beyond the license key — which is a
+ * per-company entitlement, not a credential that can spend money. Anything
+ * that could (an API key, an SSO client secret) stays in the environment, and
+ * this file only ever names it.
+ *
+ * Environment variables win over the file, so a developer can point at a
+ * staging registry without editing a shared, committed file.
+ */
+
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+
+const FILE = path.join(".agentmd", "enterprise.json");
+
+/** Keys we understand. An unknown key is surfaced rather than ignored. */
+const KNOWN = [
+  "privateRegistry",
+  "cloudUrl",
+  "licenseKey",
+  "requireSso",
+  "ssoProvider",
+  "allowPublicRegistry",
+  "pinnedStandards",
+  "$schema",
+];
+
+/**
+ * Read the config for this project.
+ *
+ * Always returns an object: `{ config, problems, path, exists }`. A malformed
+ * file is a problem to report, never a reason to abort — the local workflow
+ * must keep working when someone commits a stray comma.
+ */
+function load(cwd = process.cwd()) {
+  const file = path.join(cwd, FILE);
+  const problems = [];
+
+  let config = {};
+  let exists = false;
+  try {
+    const raw = fs.readFileSync(file, "utf-8");
+    exists = true;
+    config = JSON.parse(raw);
+    if (!config || typeof config !== "object" || Array.isArray(config)) {
+      problems.push(`${FILE} must contain a JSON object`);
+      config = {};
+    }
+  } catch (err) {
+    if (err.code !== "ENOENT") problems.push(`${FILE}: ${err.message}`);
+  }
+
+  for (const key of Object.keys(config)) {
+    if (!KNOWN.includes(key)) problems.push(`${FILE}: unknown key \`${key}\``);
+  }
+  for (const key of ["privateRegistry", "cloudUrl"]) {
+    const value = config[key];
+    if (value === undefined) continue;
+    if (typeof value !== "string") { problems.push(`${FILE}: \`${key}\` must be a string`); continue; }
+    // A private registry may be an https endpoint or a path on a shared
+    // volume; a plaintext http endpoint is refused for the same reason the
+    // fetcher refuses one — this content becomes agent instructions.
+    if (/^http:\/\//i.test(value)) problems.push(`${FILE}: \`${key}\` must be https, not http`);
+  }
+  if (config.pinnedStandards !== undefined && !Array.isArray(config.pinnedStandards)) {
+    problems.push(`${FILE}: \`pinnedStandards\` must be an array`);
+  }
+
+  // The environment wins, so a developer can redirect without touching a file
+  // their whole team shares.
+  const resolved = {
+    ...config,
+    privateRegistry: process.env.AGENTMD_PRIVATE_REGISTRY || config.privateRegistry || null,
+    cloudUrl: process.env.AGENTMD_CLOUD_URL || config.cloudUrl || null,
+    requireSso: config.requireSso === true,
+    allowPublicRegistry: config.allowPublicRegistry !== false,
+  };
+
+  return { config: resolved, problems, path: file, exists };
+}
+
+/** Write a starter config. Refuses to clobber one that already exists. */
+function init(cwd = process.cwd(), values = {}) {
+  const file = path.join(cwd, FILE);
+  if (fs.existsSync(file)) throw new Error(`${FILE} already exists`);
+  const body = {
+    $schema: "https://agent-dot-md.vercel.app/schema/enterprise.json",
+    privateRegistry: values.privateRegistry || "https://standards.example.internal/agentmd",
+    cloudUrl: values.cloudUrl || null,
+    licenseKey: values.licenseKey || "",
+    requireSso: values.requireSso ?? false,
+    allowPublicRegistry: true,
+    pinnedStandards: [],
+  };
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, JSON.stringify(body, null, 2) + "\n", "utf-8");
+  return file;
+}
+
+/**
+ * Whether SSO is satisfied.
+ *
+ * The CLI cannot perform an SSO handshake by itself — that belongs to the
+ * identity provider and the web session. What it can do is refuse to reach a
+ * private registry unless the company's chosen proof is present, and say
+ * exactly which one is missing. `requireSso` is enforced, not advisory.
+ */
+function ssoStatus(config, env = process.env) {
+  if (!config.requireSso) return { required: false, satisfied: true, via: null };
+  const token = env.AGENTMD_SSO_TOKEN || env.AGENTMD_OIDC_TOKEN;
+  if (token) return { required: true, satisfied: true, via: env.AGENTMD_SSO_TOKEN ? "AGENTMD_SSO_TOKEN" : "AGENTMD_OIDC_TOKEN" };
+  // GitHub Actions can mint an OIDC token for the job; that is the CI answer.
+  if (env.ACTIONS_ID_TOKEN_REQUEST_TOKEN) return { required: true, satisfied: true, via: "GitHub OIDC" };
+  return {
+    required: true,
+    satisfied: false,
+    via: null,
+    hint: `SSO is required by ${FILE}${config.ssoProvider ? ` (${config.ssoProvider})` : ""}. Set AGENTMD_SSO_TOKEN, or run in a job with GitHub OIDC enabled.`,
+  };
+}
+
+module.exports = { load, init, ssoStatus, FILE, KNOWN };