@wardby/cli 0.2.1 → 0.3.0

package/dist/import/cli-args.js

@@ -21,9 +21,10 @@ export function parseImportArgs(args) {
         throw new Error("Missing bundle directory positional argument");
     }
     const dir = positionals[0];
-    // Parse owner/public
+    // Parse owner/public: --public may be combined with --owner (the owner of
+    // the imported agents, which --public then shares with everyone).
     const isPublic = values.public ?? false;
-    const owner = isPublic ? null : (values.owner ?? null);
+    const owner = values.owner ?? null;
     // Validate on-conflict
     const onConflict = (values["on-conflict"] ?? "fail");
     if (!VALID_CONFLICT_POLICIES.includes(onConflict)) {

package/dist/import/create.d.ts

@@ -11,7 +11,12 @@ import type { SecretCipher } from "../providers/secrets/types.js";
 export interface CreateOptions {
     db: PrismaClient;
     cipher: SecretCipher;
+    /** Owner of the imported tools, secrets, datastores, webhooks and budget groups; null in --public mode. */
     ownerId: string | null;
+    /** Owner of the imported agents (defaults to ownerId): never null for a real import. */
+    agentOwnerId?: string | null;
+    /** --public: share each imported agent with everyone at execute. */
+    publicAgents?: boolean;
     defaultBudget: string;
     secretMode: "references" | "envelope";
     transferPrivateKey?: KeyObject;

package/dist/import/create.js

@@ -8,12 +8,15 @@ import { createSecret, attachSecret } from "../core/secrets.js";
 import { createDatastore, attachDatastore } from "../core/datastores.js";
 import { createWebhook } from "../core/webhooks.js";
 import { deriveJsonSchema } from "../sandbox/zod-params.js";
+import { findSameNamedAttachedTool, reservedToolNameReason } from "../core/tool-names.js";
 import { ToolCapabilitiesPatchSchema, FETCH_WILDCARD } from "../sandbox/tool-capabilities.js";
 import { PostgresDatastore } from "../providers/datastore/postgres.js";
 import { decryptTransferEnvelope } from "../providers/secrets/transfer-envelope.js";
 import { mapBudget } from "./budgets.js";
+import { EVERYONE_KEY, everyoneGrantData } from "../core/grants.js";
 export async function createFromBundle(bundle, recon, opts) {
     const { db, cipher, ownerId, secretMode, transferPrivateKey, allowOpenFetch } = opts;
+    const agentOwnerId = opts.agentOwnerId === undefined ? ownerId : opts.agentOwnerId;
     const warnings = [];
     const webhookSecrets = [];
     const pendingSecretReentry = [];
@@ -37,28 +40,41 @@ export async function createFromBundle(bundle, recon, opts) {
     for (const t of bundle.readTools()) {
         if (toolRejected(t.name) || toolSkipped(t.name))
             continue;
+        // A built-in dispatched before user tools would shadow it, so the tool
+        // could be created but never called (see core/tool-names.ts).
+        const reserved = reservedToolNameReason(eff(t.name));
+        if (reserved) {
+            warnings.push(`tool ${t.name}: skipped — ${reserved}`);
+            continue;
+        }
         const schema = await deriveJsonSchema(t.paramsZod);
         if (!schema.ok) {
             warnings.push(`tool ${t.name}: failed to derive JSON schema, skipping`);
             continue;
         }
-        const tool = await db.tool.upsert({
-            where: { name: eff(t.name) },
-            create: {
-                name: eff(t.name),
-                description: t.description,
-                paramsZod: t.paramsZod,
-                code: t.code,
-                jsonSchema: schema.value,
-                ownerId,
-            },
-            update: {},
-        });
+        // Names are unique per owner: reuse the target owner's own same-named
+        // tool (what upsert-by-name used to do), never another owner's. A
+        // compound unique with a nullable column can't key an upsert, hence
+        // findFirst + create.
+        const tool = (await db.tool.findFirst({ where: { ownerId, name: eff(t.name) } })) ??
+            (await db.tool.create({
+                data: {
+                    name: eff(t.name),
+                    description: t.description,
+                    paramsZod: t.paramsZod,
+                    code: t.code,
+                    jsonSchema: schema.value,
+                    ownerId,
+                },
+            }));
         toolIdMap.set(t.name, tool.id);
         toolsCreated++;
     }
     // Step 2: Agents
     const agentIdMap = new Map();
+    // Agents this import owns (created now, or already the import owner's):
+    // only their attachments are stamped with the owner's consent below.
+    const ownedAgentIds = new Set();
     for (const a of bundle.readAgents()) {
         if (agentSkipped(a.name))
             continue;
@@ -74,11 +90,27 @@ export async function createFromBundle(bundle, recon, opts) {
                 timezone: a.timezone,
                 maxTurns: a.maxTurns,
                 scheduleEnabled,
-                ownerId,
+                ownerId: agentOwnerId,
             },
             update: {},
         });
         agentIdMap.set(a.name, agent.id);
+        if (agentOwnerId !== null && agent.ownerId === agentOwnerId) {
+            ownedAgentIds.add(agent.id);
+            if (opts.publicAgents) {
+                await db.resourceGrant.upsert({
+                    where: {
+                        resourceType_resourceId_granteeKey: {
+                            resourceType: "agent",
+                            resourceId: agent.id,
+                            granteeKey: EVERYONE_KEY,
+                        },
+                    },
+                    create: everyoneGrantData("agent", agent.id, "execute", "import"),
+                    update: {},
+                });
+            }
+        }
         agentsCreated++;
     }
     // Step 3: Attach tools
@@ -105,7 +137,26 @@ export async function createFromBundle(bundle, recon, opts) {
             warnings.push(`agent-tool ${at.agentName}/${at.toolName}: invalid capabilities, skipping attachment`);
             continue;
         }
+        // Same guard as MCP attach_tool: an existing agent reused by name may
+        // already hold a different tool under this name (say a public one), and
+        // the runtime dispatches by name. Unlike attach_tool this check-then-
+        // upsert is not one Serializable transaction: the importer is an
+        // operator-only path, so a concurrent attach racing it is not defended
+        // against here (the runner's load-time duplicate check still is).
+        const clash = await findSameNamedAttachedTool(db, agentId, { id: toolId, name: eff(at.toolName) });
+        if (clash) {
+            warnings.push(`agent-tool ${at.agentName}/${at.toolName}: skipped — the agent already has a different tool with the same name (${clash.id})`);
+            continue;
+        }
         const caps = capsPatch.data;
+        // The importing operator is trusted with the database, so on an agent
+        // this import owns it grants the bundle's capabilities in the owner's
+        // name (the runner honours them only with that stamp). An existing
+        // agent owned by someone else keeps an unstamped, inert attachment.
+        const consent = ownedAgentIds.has(agentId) ? agentOwnerId : null;
+        if (consent === null) {
+            warnings.push(`agent-tool ${at.agentName}/${at.toolName}: attached without capabilities in force — the agent belongs to another owner, who must re-grant them with attach_tool`);
+        }
         await db.agentTool.upsert({
             where: { agentId_toolId: { agentId, toolId } },
             create: {
@@ -115,12 +166,15 @@ export async function createFromBundle(bundle, recon, opts) {
                 allowedDatastorePrefixes: caps.allowedDatastorePrefixes ?? [],
                 allowedHosts: caps.allowedHosts ?? [],
                 allowedSharedDatastorePrefixes: caps.allowedSharedDatastorePrefixes ?? {},
+                attachedById: agentOwnerId,
+                capabilitiesGrantedById: consent,
             },
             update: {
                 allowedSecrets: caps.allowedSecrets ?? [],
                 allowedDatastorePrefixes: caps.allowedDatastorePrefixes ?? [],
                 allowedHosts: caps.allowedHosts ?? [],
                 allowedSharedDatastorePrefixes: caps.allowedSharedDatastorePrefixes ?? {},
+                capabilitiesGrantedById: consent,
             },
         });
     }

package/dist/import/index.js

@@ -10,19 +10,19 @@ import { supportedGlobalsFromPrelude } from "./tool-scan.js";
 import { SANDBOX_PRELUDE } from "../sandbox/prelude.js";
 import { resolveLlmRegistrations } from "../providers/llm/registration.js";
 import { RoutingLlmProvider } from "../providers/llm/routing.js";
-import { loadProviderConfig } from "../config/providers.js";
+import { loadMcpConfig, loadProviderConfig } from "../config/providers.js";
 import { buildSecretCipher } from "../providers/secrets/index.js";
 import { resolvePrincipal } from "../mcp/auth/principal.js";
 import { loadTransferPrivateKey, transferKeyIdOf } from "../providers/secrets/transfer-envelope.js";
 import { readFileSync } from "node:fs";
 export async function runImport(opts) {
     const env = opts.env ?? process.env;
-    // Guard: owner XOR public
+    // Guard: --owner or --public (or both). --public no longer means
+    // owner-less: the imported agents are owned by --owner, or by the
+    // importing operator (LOCAL_PRINCIPAL), and shared with everyone at
+    // execute (resource-sharing grants spec §3.8).
     if (opts.owner === null && !opts.isPublic) {
-        throw new Error("Must specify either --owner or --public (not neither)");
-    }
-    if (opts.owner !== null && opts.isPublic) {
-        throw new Error("Cannot specify both --owner and --public");
+        throw new Error("Must specify --owner, --public, or both");
     }
     // Open bundle
     const bundle = openBundle(opts.dir);
@@ -36,10 +36,13 @@ export async function runImport(opts) {
     // Load existing names from db
     const existingAgents = await opts.db.agent.findMany({ select: { name: true } });
     const existingAgentNames = new Set(existingAgents.map((a) => a.name));
-    const existingTools = await opts.db.tool.findMany({ select: { name: true } });
-    const existingToolNames = new Set(existingTools.map((t) => t.name));
-    // For owner-scoped entities (secrets, budgets), load only if we have an owner
+    // For owner-scoped entities (tools, secrets, budgets), load only if we have an owner
     const ownerId = opts.owner !== null && !opts.isPublic ? (await resolvePrincipal(opts.owner, opts.db)).id : null;
+    // Tool names are unique per owner (null = the public namespace), so only
+    // the target owner's tools can collide; another owner's same-named tool
+    // is no conflict.
+    const existingTools = await opts.db.tool.findMany({ where: { ownerId }, select: { name: true } });
+    const existingToolNames = new Set(existingTools.map((t) => t.name));
     // Tier-1 capabilities: "budgets" and "shared-datastores" are implemented
     const capabilitiesSupported = new Set(["budgets", "shared-datastores"]);
     // Run preflight reconciliation
@@ -84,11 +87,18 @@ export async function runImport(opts) {
     // Build secret cipher
     const providerConfig = loadProviderConfig(env);
     const cipher = buildSecretCipher(providerConfig, env);
+    // The imported agents' owner: --owner, or in --public mode the importing
+    // operator. Resolved only for a real import (never on --dry-run).
+    const agentOwnerId = opts.isPublic
+        ? (await resolvePrincipal(opts.owner ?? loadMcpConfig(env).localPrincipal, opts.db)).id
+        : ownerId;
     // Run create
     const result = await createFromBundle(bundle, recon, {
         db: opts.db,
         cipher,
         ownerId,
+        agentOwnerId,
+        publicAgents: opts.isPublic,
         defaultBudget: opts.defaultBudget ?? "10.00",
         secretMode: effectiveSecretMode,
         transferPrivateKey,

package/dist/import/neutral-schema.d.ts

@@ -46,13 +46,13 @@ export declare const ManifestSchema: z.ZodObject<{
     capabilities: z.ZodArray<z.ZodString, "many">;
     counts: z.ZodRecord<z.ZodString, z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
-    capabilities: string[];
-    bundleVersion: number;
     source: {
         product: string;
         exporterVersion: string;
         exportedAt: string;
     };
+    capabilities: string[];
+    bundleVersion: number;
     secretMode: "references" | "envelope";
     transferKeyId: string | null;
     contentWindowDays: number | null;
@@ -62,13 +62,13 @@ export declare const ManifestSchema: z.ZodObject<{
     runAuditSince: string | null;
     counts: Record<string, number>;
 }, {
-    capabilities: string[];
-    bundleVersion: number;
     source: {
         product: string;
         exporterVersion: string;
         exportedAt: string;
     };
+    capabilities: string[];
+    bundleVersion: number;
     secretMode: "references" | "envelope";
     counts: Record<string, number>;
     transferKeyId?: string | null | undefined;
@@ -98,41 +98,41 @@ export declare const NeutralAgentSchema: z.ZodObject<{
         slug: z.ZodOptional<z.ZodDefault<z.ZodNullable<z.ZodString>>>;
         emailAllowlist: z.ZodOptional<z.ZodDefault<z.ZodNullable<z.ZodUnknown>>>;
     }, "strip", z.ZodTypeAny, {
-        description?: string | null | undefined;
         slug?: string | null | undefined;
+        description?: string | null | undefined;
         emailAllowlist?: unknown;
     }, {
-        description?: string | null | undefined;
         slug?: string | null | undefined;
+        description?: string | null | undefined;
         emailAllowlist?: unknown;
     }>>;
 }, "strip", z.ZodTypeAny, {
     name: string;
     model: string;
     budgetUsd: string;
-    systemPrompt: string;
     kind: "native";
+    provider: "openai" | "bedrock";
+    systemPrompt: string;
     schedule: string | null;
     timezone: string;
     scheduleEnabled: boolean;
     maxTurns: number;
     memoryEnabled: boolean;
-    provider: "openai" | "bedrock";
     region: string | null;
     ownerEmail: string | null;
     unmodeled: {
-        description?: string | null | undefined;
         slug?: string | null | undefined;
+        description?: string | null | undefined;
         emailAllowlist?: unknown;
     };
 }, {
     name: string;
     model: string;
     budgetUsd: string;
+    provider: "openai" | "bedrock";
     systemPrompt: string;
     scheduleEnabled: boolean;
     maxTurns: number;
-    provider: "openai" | "bedrock";
     kind?: "native" | undefined;
     schedule?: string | null | undefined;
     timezone?: string | undefined;
@@ -140,8 +140,8 @@ export declare const NeutralAgentSchema: z.ZodObject<{
     region?: string | null | undefined;
     ownerEmail?: string | null | undefined;
     unmodeled?: {
-        description?: string | null | undefined;
         slug?: string | null | undefined;
+        description?: string | null | undefined;
         emailAllowlist?: unknown;
     } | undefined;
 }>;

package/dist/mcp/auth/access.d.ts

@@ -0,0 +1,70 @@
+/**
+ * The MCP seam for agent access (resource-sharing grants spec §3.3). Every
+ * agent tool routes through here instead of ownership.ts's owner-or-public
+ * rule, which no longer applies to agents: an owner-less agent is reachable
+ * only through its grants (the migration gives everyone execute).
+ *
+ * - Below read: 404 with the same text as a missing row, so existence never
+ *   leaks. At read or above but below the level required: 403 naming both.
+ * - The helpers take a `db` argument so a Serializable transaction reads the
+ *   grant rows through `tx`; a concurrent revoke then conflicts instead of
+ *   racing.
+ * - `ctx.operator` (stdio's local operator, never an HTTP principal) is
+ *   owner of every agent for access checks and sees every agent in
+ *   listings, but does NOT bypass requireBindingOwner: one owner's secrets,
+ *   datastores and repositories never reach another owner's agent.
+ */
+import type { Prisma, PrismaClient } from "#prisma";
+import { type Access, type Level } from "../../core/grants.js";
+import type { McpRequestContext } from "../context.js";
+import { McpError } from "../errors.js";
+export type AgentLevel = Level<"agent">;
+export type AgentAccess = Access<"agent">;
+type AgentRef = {
+    id: string;
+    ownerId: string | null;
+};
+type GrantDb = Pick<PrismaClient, "resourceGrant">;
+export declare function agentNotFound(id: string): McpError;
+export declare function insufficientAgentAccess(id: string, required: AgentLevel | "owner", held: AgentAccess): McpError;
+/** The caller's access to an agent row already read. */
+export declare function agentAccess(ctx: McpRequestContext, agent: AgentRef, db?: GrantDb): Promise<AgentAccess>;
+/** For a row already read (inside a transaction, or with includes): 404 below read, 403 below `required`. */
+export declare function assertAgentAccess<A extends AgentRef>(ctx: McpRequestContext, agent: A | null, id: string, required: AgentLevel | "owner", db?: GrantDb): Promise<{
+    agent: A;
+    access: AgentAccess;
+}>;
+/** 404 if missing or access < read; 403 if read <= access < required. Returns row + access. */
+export declare function requireAgentAccess(ctx: McpRequestContext, id: string, required: AgentLevel | "owner", db?: Pick<PrismaClient, "agent" | "resourceGrant">): Promise<{
+    agent: {
+        name: string;
+        model: string;
+        budgetUsd: import("@prisma/client-runtime-utils").Decimal;
+        kind: import("#prisma").AgentKind;
+        id: string;
+        ownerId: string | null;
+        createdAt: Date;
+        updatedAt: Date;
+        systemPrompt: string;
+        schedule: string | null;
+        timezone: string;
+        scheduleEnabled: boolean;
+        lastScheduledAt: Date | null;
+        maxTurns: number;
+        budgetGroupId: string | null;
+        memoryEnabled: boolean;
+        effort: string | null;
+    };
+    access: AgentAccess;
+}>;
+/**
+ * Bindings (secrets, datastores, repositories, capability grants): strict
+ * ownership, whatever the grants. The stdio operator does NOT bypass this:
+ * it can adopt the agent first (make_owner / grants adopt-public).
+ */
+export declare function requireBindingOwner(ctx: McpRequestContext, agent: AgentRef): void;
+/** Prisma where for agent listings: own rows plus rows granted >= read; the operator sees all. */
+export declare function readableAgentsWhere(ctx: McpRequestContext, db?: GrantDb): Promise<Prisma.AgentWhereInput>;
+/** One grant lookup for a whole listing: returns agent -> the caller's access. */
+export declare function agentAccessResolver(ctx: McpRequestContext, db?: GrantDb): Promise<(agent: AgentRef) => AgentAccess>;
+export {};

package/dist/mcp/auth/access.js

@@ -0,0 +1,58 @@
+import { atLeast, effectiveAccess, grantedAccessMap, grantedIds } from "../../core/grants.js";
+import { McpError } from "../errors.js";
+export function agentNotFound(id) {
+    return new McpError(404, `Agent "${id}" not found.`);
+}
+function describeLevel(level) {
+    return level === "owner" ? "the agent's owner" : `${level} access`;
+}
+export function insufficientAgentAccess(id, required, held) {
+    return new McpError(403, `Agent "${id}": this needs ${describeLevel(required)}; you have ${held === "owner" ? "owner" : held} access.`);
+}
+/** The caller's access to an agent row already read. */
+export function agentAccess(ctx, agent, db = ctx.db) {
+    return effectiveAccess(db, "agent", agent, ctx.principal.id, { operator: ctx.operator === true });
+}
+/** For a row already read (inside a transaction, or with includes): 404 below read, 403 below `required`. */
+export async function assertAgentAccess(ctx, agent, id, required, db = ctx.db) {
+    if (!agent)
+        throw agentNotFound(id);
+    const access = await agentAccess(ctx, agent, db);
+    if (!atLeast("agent", access, "read"))
+        throw agentNotFound(id);
+    if (!atLeast("agent", access, required))
+        throw insufficientAgentAccess(id, required, access);
+    return { agent, access };
+}
+/** 404 if missing or access < read; 403 if read <= access < required. Returns row + access. */
+export async function requireAgentAccess(ctx, id, required, db = ctx.db) {
+    const agent = await db.agent.findUnique({ where: { id } });
+    return assertAgentAccess(ctx, agent, id, required, db);
+}
+/**
+ * Bindings (secrets, datastores, repositories, capability grants): strict
+ * ownership, whatever the grants. The stdio operator does NOT bypass this:
+ * it can adopt the agent first (make_owner / grants adopt-public).
+ */
+export function requireBindingOwner(ctx, agent) {
+    if (agent.ownerId === null) {
+        throw new McpError(403, `Agent "${agent.id}" has no owner, so nothing can be bound to it; an admin can assign one with make_owner.`);
+    }
+    if (agent.ownerId !== ctx.principal.id) {
+        throw new McpError(403, `Only the owner of agent "${agent.id}" can change its bindings.`);
+    }
+}
+/** Prisma where for agent listings: own rows plus rows granted >= read; the operator sees all. */
+export async function readableAgentsWhere(ctx, db = ctx.db) {
+    if (ctx.operator)
+        return {};
+    const ids = await grantedIds(db, "agent", ctx.principal.id, "read");
+    return { OR: [{ ownerId: ctx.principal.id }, { id: { in: ids } }] };
+}
+/** One grant lookup for a whole listing: returns agent -> the caller's access. */
+export async function agentAccessResolver(ctx, db = ctx.db) {
+    if (ctx.operator)
+        return () => "owner";
+    const granted = await grantedAccessMap(db, "agent", ctx.principal.id);
+    return (agent) => agent.ownerId !== null && agent.ownerId === ctx.principal.id ? "owner" : (granted.get(agent.id) ?? "none");
+}

package/dist/mcp/auth/grants-cli.d.ts

@@ -0,0 +1,149 @@
+import { type PrismaClient } from "#prisma";
+/** The report needs only raw queries, so it can run on a schema the generated client doesn't match. */
+export interface ReportDb {
+    $queryRaw<T = unknown>(query: TemplateStringsArray, ...values: unknown[]): PromiseLike<T>;
+}
+export declare const BEHAVIOUR_CHANGES: string[];
+export interface MigrationReport {
+    grantsTable: boolean;
+    ownerlessAgents: {
+        agentId: string;
+        name: string;
+        everyoneGrant: string | null;
+        /** What adopting the agent as each principal would bring back into force (review I3). */
+        revivedByAdopter: {
+            principalId: string;
+            subject: string;
+            secrets: string[];
+            datastores: string[];
+            toolCapabilities: string[];
+        }[];
+    }[];
+    inertBindings: {
+        kind: "secret" | "datastore";
+        agentId: string;
+        agentName: string;
+        agentOwnerId: string | null;
+        boundName: string;
+        resourceId: string;
+        resourceOwnerId: string | null;
+        /** Removed by prune-bindings (owned agent); on an owner-less agent adopt-public decides. */
+        prunable: boolean;
+    }[];
+    suspendedCapabilities: {
+        agentId: string;
+        agentName: string;
+        toolId: string;
+        toolName: string;
+        regrant: string;
+    }[];
+    /**
+     * Capabilities the migration stamps with the current owner on owner-less
+     * tools: a previous owner may have set them before a make_owner (review
+     * M2). They stay in force; the owner should review them.
+     */
+    reviewCapabilities: {
+        agentId: string;
+        agentName: string;
+        toolId: string;
+        toolName: string;
+        regrant: string;
+    }[];
+    failingEdges: {
+        parentAgentId: string;
+        parentOwnerId: string | null;
+        childAgentId: string;
+        childOwnerId: string | null;
+        boundName: string;
+    }[];
+    webhooks: {
+        onOwnerlessAgents: {
+            id: string;
+            agentId: string;
+            createdBy: string | null;
+        }[];
+        creatorLacksExecute: {
+            id: string;
+            agentId: string;
+            createdBy: string | null;
+        }[];
+    };
+    behaviourChanges: string[];
+    orphanGrants: {
+        id: string;
+        resourceType: string;
+        resourceId: string;
+    }[] | null;
+}
+export declare function migrationReport(db: ReportDb): Promise<MigrationReport>;
+export declare function formatMigrationReport(report: MigrationReport): string;
+export interface AdoptedAgent {
+    agentId: string;
+    name: string;
+    bindingsRemoved: {
+        kind: "secret" | "datastore";
+        boundName: string;
+        resourceId: string;
+    }[];
+    bindingsKept: {
+        kind: "secret" | "datastore";
+        boundName: string;
+    }[];
+    capabilitiesStamped: string[];
+    /** Every attached tool the new owner doesn't own (review M7); `regrant` only when it had capabilities. */
+    foreignTools: {
+        toolId: string;
+        toolName: string;
+        toolOwnerId: string | null;
+        regrant: string | null;
+    }[];
+    failingEdges: {
+        parentAgentId: string;
+        childAgentId: string;
+        boundName: string;
+    }[];
+    /** The everyone grant before and after adoption (null = none). */
+    everyoneGrant: {
+        before: string | null;
+        after: string | null;
+    };
+}
+export interface AdoptResult {
+    owner: {
+        id: string;
+        subject: string;
+    };
+    dryRun: boolean;
+    agents: AdoptedAgent[];
+}
+/** Gives every owner-less agent `ownerSubject` as its owner. See the module header. */
+export declare function adoptPublic(db: PrismaClient, opts: {
+    ownerSubject: string;
+    dryRun: boolean;
+    keepEveryoneExecute?: boolean;
+}): Promise<AdoptResult>;
+export declare function formatAdoptResult(result: AdoptResult): string;
+export interface PruneResult {
+    dryRun: boolean;
+    removed: {
+        kind: "secret" | "datastore";
+        agentId: string;
+        agentName: string;
+        boundName: string;
+        resourceId: string;
+        resourceOwnerId: string | null;
+    }[];
+}
+/** Deletes cross-owner secret/datastore bindings on owned agents, in one transaction. */
+export declare function pruneBindings(db: PrismaClient, opts: {
+    dryRun: boolean;
+}): Promise<PruneResult>;
+export declare function formatPruneResult(result: PruneResult): string;
+/**
+ * The owner of an agent made with `wardby agent create` (resource-sharing
+ * grants spec §3.8): `--owner <subject>` must already exist (a typo never
+ * mints a principal), otherwise the local operator (LOCAL_PRINCIPAL),
+ * found or created exactly as stdio does.
+ */
+export declare function resolveCliAgentOwner(db: PrismaClient, ownerSubject: string | undefined, localPrincipal: string): Promise<string>;
+export declare function grantsCommand(args: string[], db: PrismaClient, output?: (value: string) => void): Promise<void>;