@wardby/cli 0.2.1 → 0.4.0

package/dist/import/cli-args.js

@@ -21,9 +21,10 @@ export function parseImportArgs(args) {
         throw new Error("Missing bundle directory positional argument");
     }
     const dir = positionals[0];
-    // Parse owner/public
+    // Parse owner/public: --public may be combined with --owner (the owner of
+    // the imported agents, which --public then shares with everyone).
     const isPublic = values.public ?? false;
-    const owner = isPublic ? null : (values.owner ?? null);
+    const owner = values.owner ?? null;
     // Validate on-conflict
     const onConflict = (values["on-conflict"] ?? "fail");
     if (!VALID_CONFLICT_POLICIES.includes(onConflict)) {

package/dist/import/create.d.ts

@@ -11,7 +11,12 @@ import type { SecretCipher } from "../providers/secrets/types.js";
 export interface CreateOptions {
     db: PrismaClient;
     cipher: SecretCipher;
+    /** Owner of the imported tools, secrets, datastores, webhooks and budget groups; null in --public mode. */
     ownerId: string | null;
+    /** Owner of the imported agents (defaults to ownerId): never null for a real import. */
+    agentOwnerId?: string | null;
+    /** --public: share each imported agent with everyone at execute. */
+    publicAgents?: boolean;
     defaultBudget: string;
     secretMode: "references" | "envelope";
     transferPrivateKey?: KeyObject;

package/dist/import/create.js

@@ -8,12 +8,15 @@ import { createSecret, attachSecret } from "../core/secrets.js";
 import { createDatastore, attachDatastore } from "../core/datastores.js";
 import { createWebhook } from "../core/webhooks.js";
 import { deriveJsonSchema } from "../sandbox/zod-params.js";
+import { findSameNamedAttachedTool, reservedToolNameReason } from "../core/tool-names.js";
 import { ToolCapabilitiesPatchSchema, FETCH_WILDCARD } from "../sandbox/tool-capabilities.js";
 import { PostgresDatastore } from "../providers/datastore/postgres.js";
 import { decryptTransferEnvelope } from "../providers/secrets/transfer-envelope.js";
 import { mapBudget } from "./budgets.js";
+import { EVERYONE_KEY, everyoneGrantData } from "../core/grants.js";
 export async function createFromBundle(bundle, recon, opts) {
     const { db, cipher, ownerId, secretMode, transferPrivateKey, allowOpenFetch } = opts;
+    const agentOwnerId = opts.agentOwnerId === undefined ? ownerId : opts.agentOwnerId;
     const warnings = [];
     const webhookSecrets = [];
     const pendingSecretReentry = [];
@@ -37,28 +40,41 @@ export async function createFromBundle(bundle, recon, opts) {
     for (const t of bundle.readTools()) {
         if (toolRejected(t.name) || toolSkipped(t.name))
             continue;
+        // A built-in dispatched before user tools would shadow it, so the tool
+        // could be created but never called (see core/tool-names.ts).
+        const reserved = reservedToolNameReason(eff(t.name));
+        if (reserved) {
+            warnings.push(`tool ${t.name}: skipped — ${reserved}`);
+            continue;
+        }
         const schema = await deriveJsonSchema(t.paramsZod);
         if (!schema.ok) {
             warnings.push(`tool ${t.name}: failed to derive JSON schema, skipping`);
             continue;
         }
-        const tool = await db.tool.upsert({
-            where: { name: eff(t.name) },
-            create: {
-                name: eff(t.name),
-                description: t.description,
-                paramsZod: t.paramsZod,
-                code: t.code,
-                jsonSchema: schema.value,
-                ownerId,
-            },
-            update: {},
-        });
+        // Names are unique per owner: reuse the target owner's own same-named
+        // tool (what upsert-by-name used to do), never another owner's. A
+        // compound unique with a nullable column can't key an upsert, hence
+        // findFirst + create.
+        const tool = (await db.tool.findFirst({ where: { ownerId, name: eff(t.name) } })) ??
+            (await db.tool.create({
+                data: {
+                    name: eff(t.name),
+                    description: t.description,
+                    paramsZod: t.paramsZod,
+                    code: t.code,
+                    jsonSchema: schema.value,
+                    ownerId,
+                },
+            }));
         toolIdMap.set(t.name, tool.id);
         toolsCreated++;
     }
     // Step 2: Agents
     const agentIdMap = new Map();
+    // Agents this import owns (created now, or already the import owner's):
+    // only their attachments are stamped with the owner's consent below.
+    const ownedAgentIds = new Set();
     for (const a of bundle.readAgents()) {
         if (agentSkipped(a.name))
             continue;
@@ -74,11 +90,27 @@ export async function createFromBundle(bundle, recon, opts) {
                 timezone: a.timezone,
                 maxTurns: a.maxTurns,
                 scheduleEnabled,
-                ownerId,
+                ownerId: agentOwnerId,
             },
             update: {},
         });
         agentIdMap.set(a.name, agent.id);
+        if (agentOwnerId !== null && agent.ownerId === agentOwnerId) {
+            ownedAgentIds.add(agent.id);
+            if (opts.publicAgents) {
+                await db.resourceGrant.upsert({
+                    where: {
+                        resourceType_resourceId_granteeKey: {
+                            resourceType: "agent",
+                            resourceId: agent.id,
+                            granteeKey: EVERYONE_KEY,
+                        },
+                    },
+                    create: everyoneGrantData("agent", agent.id, "execute", "import"),
+                    update: {},
+                });
+            }
+        }
         agentsCreated++;
     }
     // Step 3: Attach tools
@@ -105,7 +137,26 @@ export async function createFromBundle(bundle, recon, opts) {
             warnings.push(`agent-tool ${at.agentName}/${at.toolName}: invalid capabilities, skipping attachment`);
             continue;
         }
+        // Same guard as MCP attach_tool: an existing agent reused by name may
+        // already hold a different tool under this name (say a public one), and
+        // the runtime dispatches by name. Unlike attach_tool this check-then-
+        // upsert is not one Serializable transaction: the importer is an
+        // operator-only path, so a concurrent attach racing it is not defended
+        // against here (the runner's load-time duplicate check still is).
+        const clash = await findSameNamedAttachedTool(db, agentId, { id: toolId, name: eff(at.toolName) });
+        if (clash) {
+            warnings.push(`agent-tool ${at.agentName}/${at.toolName}: skipped — the agent already has a different tool with the same name (${clash.id})`);
+            continue;
+        }
         const caps = capsPatch.data;
+        // The importing operator is trusted with the database, so on an agent
+        // this import owns it grants the bundle's capabilities in the owner's
+        // name (the runner honours them only with that stamp). An existing
+        // agent owned by someone else keeps an unstamped, inert attachment.
+        const consent = ownedAgentIds.has(agentId) ? agentOwnerId : null;
+        if (consent === null) {
+            warnings.push(`agent-tool ${at.agentName}/${at.toolName}: attached without capabilities in force — the agent belongs to another owner, who must re-grant them with attach_tool`);
+        }
         await db.agentTool.upsert({
             where: { agentId_toolId: { agentId, toolId } },
             create: {
@@ -115,12 +166,15 @@ export async function createFromBundle(bundle, recon, opts) {
                 allowedDatastorePrefixes: caps.allowedDatastorePrefixes ?? [],
                 allowedHosts: caps.allowedHosts ?? [],
                 allowedSharedDatastorePrefixes: caps.allowedSharedDatastorePrefixes ?? {},
+                attachedById: agentOwnerId,
+                capabilitiesGrantedById: consent,
             },
             update: {
                 allowedSecrets: caps.allowedSecrets ?? [],
                 allowedDatastorePrefixes: caps.allowedDatastorePrefixes ?? [],
                 allowedHosts: caps.allowedHosts ?? [],
                 allowedSharedDatastorePrefixes: caps.allowedSharedDatastorePrefixes ?? {},
+                capabilitiesGrantedById: consent,
             },
         });
     }

package/dist/import/index.js

@@ -10,19 +10,19 @@ import { supportedGlobalsFromPrelude } from "./tool-scan.js";
 import { SANDBOX_PRELUDE } from "../sandbox/prelude.js";
 import { resolveLlmRegistrations } from "../providers/llm/registration.js";
 import { RoutingLlmProvider } from "../providers/llm/routing.js";
-import { loadProviderConfig } from "../config/providers.js";
+import { loadMcpConfig, loadProviderConfig } from "../config/providers.js";
 import { buildSecretCipher } from "../providers/secrets/index.js";
 import { resolvePrincipal } from "../mcp/auth/principal.js";
 import { loadTransferPrivateKey, transferKeyIdOf } from "../providers/secrets/transfer-envelope.js";
 import { readFileSync } from "node:fs";
 export async function runImport(opts) {
     const env = opts.env ?? process.env;
-    // Guard: owner XOR public
+    // Guard: --owner or --public (or both). --public no longer means
+    // owner-less: the imported agents are owned by --owner, or by the
+    // importing operator (LOCAL_PRINCIPAL), and shared with everyone at
+    // execute (resource-sharing grants spec §3.8).
     if (opts.owner === null && !opts.isPublic) {
-        throw new Error("Must specify either --owner or --public (not neither)");
-    }
-    if (opts.owner !== null && opts.isPublic) {
-        throw new Error("Cannot specify both --owner and --public");
+        throw new Error("Must specify --owner, --public, or both");
     }
     // Open bundle
     const bundle = openBundle(opts.dir);
@@ -36,10 +36,13 @@ export async function runImport(opts) {
     // Load existing names from db
     const existingAgents = await opts.db.agent.findMany({ select: { name: true } });
     const existingAgentNames = new Set(existingAgents.map((a) => a.name));
-    const existingTools = await opts.db.tool.findMany({ select: { name: true } });
-    const existingToolNames = new Set(existingTools.map((t) => t.name));
-    // For owner-scoped entities (secrets, budgets), load only if we have an owner
+    // For owner-scoped entities (tools, secrets, budgets), load only if we have an owner
     const ownerId = opts.owner !== null && !opts.isPublic ? (await resolvePrincipal(opts.owner, opts.db)).id : null;
+    // Tool names are unique per owner (null = the public namespace), so only
+    // the target owner's tools can collide; another owner's same-named tool
+    // is no conflict.
+    const existingTools = await opts.db.tool.findMany({ where: { ownerId }, select: { name: true } });
+    const existingToolNames = new Set(existingTools.map((t) => t.name));
     // Tier-1 capabilities: "budgets" and "shared-datastores" are implemented
     const capabilitiesSupported = new Set(["budgets", "shared-datastores"]);
     // Run preflight reconciliation
@@ -84,11 +87,18 @@ export async function runImport(opts) {
     // Build secret cipher
     const providerConfig = loadProviderConfig(env);
     const cipher = buildSecretCipher(providerConfig, env);
+    // The imported agents' owner: --owner, or in --public mode the importing
+    // operator. Resolved only for a real import (never on --dry-run).
+    const agentOwnerId = opts.isPublic
+        ? (await resolvePrincipal(opts.owner ?? loadMcpConfig(env).localPrincipal, opts.db)).id
+        : ownerId;
     // Run create
     const result = await createFromBundle(bundle, recon, {
         db: opts.db,
         cipher,
         ownerId,
+        agentOwnerId,
+        publicAgents: opts.isPublic,
         defaultBudget: opts.defaultBudget ?? "10.00",
         secretMode: effectiveSecretMode,
         transferPrivateKey,

package/dist/import/neutral-schema.d.ts

@@ -8,15 +8,15 @@ export declare const CiphertextSchema: z.ZodObject<{
     tag: z.ZodString;
 }, "strip", z.ZodTypeAny, {
     tag: string;
-    v: number;
     alg: string;
+    v: number;
     epk: string;
     nonce: string;
     ct: string;
 }, {
     tag: string;
-    v: number;
     alg: string;
+    v: number;
     epk: string;
     nonce: string;
     ct: string;
@@ -46,13 +46,13 @@ export declare const ManifestSchema: z.ZodObject<{
     capabilities: z.ZodArray<z.ZodString, "many">;
     counts: z.ZodRecord<z.ZodString, z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
-    capabilities: string[];
-    bundleVersion: number;
     source: {
         product: string;
         exporterVersion: string;
         exportedAt: string;
     };
+    capabilities: string[];
+    bundleVersion: number;
     secretMode: "references" | "envelope";
     transferKeyId: string | null;
     contentWindowDays: number | null;
@@ -62,13 +62,13 @@ export declare const ManifestSchema: z.ZodObject<{
     runAuditSince: string | null;
     counts: Record<string, number>;
 }, {
-    capabilities: string[];
-    bundleVersion: number;
     source: {
         product: string;
         exporterVersion: string;
         exportedAt: string;
     };
+    capabilities: string[];
+    bundleVersion: number;
     secretMode: "references" | "envelope";
     counts: Record<string, number>;
     transferKeyId?: string | null | undefined;
@@ -110,14 +110,14 @@ export declare const NeutralAgentSchema: z.ZodObject<{
     name: string;
     model: string;
     budgetUsd: string;
-    systemPrompt: string;
+    provider: "openai" | "bedrock";
     kind: "native";
+    systemPrompt: string;
     schedule: string | null;
     timezone: string;
     scheduleEnabled: boolean;
     maxTurns: number;
     memoryEnabled: boolean;
-    provider: "openai" | "bedrock";
     region: string | null;
     ownerEmail: string | null;
     unmodeled: {
@@ -129,10 +129,10 @@ export declare const NeutralAgentSchema: z.ZodObject<{
     name: string;
     model: string;
     budgetUsd: string;
+    provider: "openai" | "bedrock";
     systemPrompt: string;
     scheduleEnabled: boolean;
     maxTurns: number;
-    provider: "openai" | "bedrock";
     kind?: "native" | undefined;
     schedule?: string | null | undefined;
     timezone?: string | undefined;
@@ -208,15 +208,15 @@ export declare const NeutralSecretSchema: z.ZodObject<{
         tag: z.ZodString;
     }, "strip", z.ZodTypeAny, {
         tag: string;
-        v: number;
         alg: string;
+        v: number;
         epk: string;
         nonce: string;
         ct: string;
     }, {
         tag: string;
-        v: number;
         alg: string;
+        v: number;
         epk: string;
         nonce: string;
         ct: string;
@@ -227,23 +227,23 @@ export declare const NeutralSecretSchema: z.ZodObject<{
     ownerEmail: string | null;
     ciphertext?: {
         tag: string;
-        v: number;
         alg: string;
+        v: number;
         epk: string;
         nonce: string;
         ct: string;
     } | undefined;
 }, {
     name: string;
+    description?: string | null | undefined;
     ciphertext?: {
         tag: string;
-        v: number;
         alg: string;
+        v: number;
         epk: string;
         nonce: string;
         ct: string;
     } | undefined;
-    description?: string | null | undefined;
     ownerEmail?: string | null | undefined;
 }>;
 export type NeutralSecret = z.infer<typeof NeutralSecretSchema>;
@@ -331,11 +331,11 @@ export declare const NeutralWebhookSchema: z.ZodObject<{
     agentName: z.ZodString;
     enabled: z.ZodBoolean;
 }, "strip", z.ZodTypeAny, {
-    agentName: string;
     enabled: boolean;
-}, {
     agentName: string;
+}, {
     enabled: boolean;
+    agentName: string;
 }>;
 export type NeutralWebhook = z.infer<typeof NeutralWebhookSchema>;
 export declare const NeutralBudgetSchema: z.ZodObject<{
@@ -349,8 +349,8 @@ export declare const NeutralBudgetSchema: z.ZodObject<{
     attachedAgentNames: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
 }, "strip", z.ZodTypeAny, {
     name: string;
-    period: "daily" | "weekly" | "monthly";
     enabled: boolean;
+    period: "daily" | "weekly" | "monthly";
     ownerEmail: string | null;
     attachedAgentNames: string[];
     alertThreshold: string;
@@ -358,8 +358,8 @@ export declare const NeutralBudgetSchema: z.ZodObject<{
     alertEmails: string[];
 }, {
     name: string;
-    period: "daily" | "weekly" | "monthly";
     enabled: boolean;
+    period: "daily" | "weekly" | "monthly";
     alertThreshold: string;
     blockThreshold: string;
     ownerEmail?: string | null | undefined;

package/dist/knowledge/check.d.ts

@@ -0,0 +1,13 @@
+export type CheckSeverity = "error" | "warning";
+export type CheckCode = "concept_invalid" | "concept_secret" | "index_missing" | "index_link_broken" | "concept_not_indexed" | "citation_unverifiable" | "citation_stale";
+export interface CheckIssue {
+    severity: CheckSeverity;
+    code: CheckCode;
+    file: string;
+    message: string;
+}
+export interface BundleFiles {
+    files: Map<string, string>;
+}
+export type RepoFileReader = (repoRelativePath: string) => string | null;
+export declare function checkBundle(bundle: BundleFiles, readRepoFile: RepoFileReader): CheckIssue[];

package/dist/knowledge/check.js

@@ -0,0 +1,69 @@
+import { redactTokenShapedValues } from "../coding/protocol.js";
+import { parseConcept, RESERVED_BUNDLE_FILES } from "./concept.js";
+import { spanHash } from "./span-hash.js";
+const LINK = /\]\(([^)#\s]+\.md)(?:#[^)\s]*)?\)/g;
+const URL_SCHEME = /^[a-z][a-z0-9+.-]*:/i;
+const baseName = (path) => path.split("/").pop() ?? path;
+function dirOf(path) {
+    const cut = path.lastIndexOf("/");
+    return cut < 0 ? "" : path.slice(0, cut + 1);
+}
+function normalize(path) {
+    const parts = [];
+    for (const part of path.split("/")) {
+        if (part === "..")
+            parts.pop();
+        else if (part !== "." && part !== "")
+            parts.push(part);
+    }
+    return parts.join("/");
+}
+export function checkBundle(bundle, readRepoFile) {
+    const issues = [];
+    const add = (severity, code, file, message) => issues.push({ severity, code, file, message });
+    if (!bundle.files.has("index.md"))
+        add("error", "index_missing", "index.md", "the bundle has no root index.md");
+    const linked = new Set();
+    for (const [path, text] of bundle.files) {
+        if (redactTokenShapedValues(text) !== text)
+            add("error", "concept_secret", path, "contains a secret-shaped value");
+        if (baseName(path) !== "index.md")
+            continue;
+        for (const match of text.matchAll(LINK)) {
+            if (URL_SCHEME.test(match[1]))
+                continue;
+            const target = normalize(match[1].startsWith("/") ? match[1].slice(1) : dirOf(path) + match[1]);
+            linked.add(target);
+            if (!bundle.files.has(target))
+                add("error", "index_link_broken", path, `links to missing ${target}`);
+        }
+    }
+    const fileCache = new Map();
+    const read = (p) => {
+        if (!fileCache.has(p))
+            fileCache.set(p, readRepoFile(p));
+        return fileCache.get(p) ?? null;
+    };
+    for (const [path, text] of bundle.files) {
+        const base = path.split("/").pop() ?? path;
+        if (!path.endsWith(".md") || RESERVED_BUNDLE_FILES.has(base))
+            continue;
+        const parsed = parseConcept(path, text);
+        if (!parsed.ok) {
+            add("error", "concept_invalid", path, parsed.error);
+            continue;
+        }
+        if (!linked.has(path))
+            add("warning", "concept_not_indexed", path, "not linked from an index.md");
+        for (const citation of parsed.concept.citations) {
+            const where = `${citation.path}${citation.lines ? `#L${citation.lines[0]}-L${citation.lines[1]}` : ""}`;
+            const source = read(citation.path);
+            const actual = source === null ? null : spanHash(source, citation.lines);
+            if (actual === null)
+                add("warning", "citation_unverifiable", path, `${where} is missing or out of range`);
+            else if (actual !== citation.spanHash)
+                add("warning", "citation_stale", path, `${where} changed since it was cited`);
+        }
+    }
+    return issues;
+}

package/dist/knowledge/cli.d.ts

@@ -0,0 +1,14 @@
+export declare function parseKnowledgeArgs(args: string[]): {
+    dir: string;
+    root: string;
+    strict: boolean;
+    json: boolean;
+};
+/**
+ * Every `.md` file under `dir`, keyed by bundle-relative POSIX path. Entry
+ * types come from the directory listing itself (no separate stat, so nothing
+ * can change between the check and the read), and symbolic links are skipped:
+ * a bundle is plain files, and following links could loop or leave the bundle.
+ */
+export declare function loadBundle(dir: string): Map<string, string>;
+export declare function knowledgeCommand(args: string[]): Promise<void>;

package/dist/knowledge/cli.js

@@ -0,0 +1,67 @@
+import { readdirSync, readFileSync } from "node:fs";
+import { join, relative, resolve, sep } from "node:path";
+import { parseArgs } from "node:util";
+import { checkBundle } from "./check.js";
+import { DEFAULT_KNOWLEDGE_BUNDLE_PATH } from "./concept.js";
+const USAGE = "usage: wardby knowledge check [dir] [--root <repo root>] [--strict] [--json]";
+export function parseKnowledgeArgs(args) {
+    const [sub, ...rest] = args;
+    if (sub !== "check")
+        throw new Error(USAGE);
+    const { values, positionals } = parseArgs({
+        args: rest,
+        allowPositionals: true,
+        options: { root: { type: "string" }, strict: { type: "boolean" }, json: { type: "boolean" } },
+    });
+    if (positionals.length > 1)
+        throw new Error(USAGE);
+    return {
+        dir: positionals[0] ?? DEFAULT_KNOWLEDGE_BUNDLE_PATH,
+        root: values.root ?? ".",
+        strict: values.strict ?? false,
+        json: values.json ?? false,
+    };
+}
+/**
+ * Every `.md` file under `dir`, keyed by bundle-relative POSIX path. Entry
+ * types come from the directory listing itself (no separate stat, so nothing
+ * can change between the check and the read), and symbolic links are skipped:
+ * a bundle is plain files, and following links could loop or leave the bundle.
+ */
+export function loadBundle(dir) {
+    const files = new Map();
+    const walk = (current) => {
+        for (const entry of readdirSync(current, { withFileTypes: true })) {
+            const full = join(current, entry.name);
+            if (entry.isDirectory())
+                walk(full);
+            else if (entry.isFile() && entry.name.endsWith(".md")) {
+                files.set(relative(dir, full).split(sep).join("/"), readFileSync(full, "utf8"));
+            }
+        }
+    };
+    walk(dir);
+    return files;
+}
+export async function knowledgeCommand(args) {
+    const options = parseKnowledgeArgs(args);
+    const root = resolve(options.root);
+    const files = loadBundle(resolve(root, options.dir));
+    const issues = checkBundle({ files }, (path) => {
+        try {
+            return readFileSync(join(root, path), "utf8");
+        }
+        catch {
+            return null;
+        }
+    });
+    if (options.json)
+        process.stdout.write(`${JSON.stringify({ issues }, null, 2)}\n`);
+    else {
+        for (const issue of issues)
+            process.stdout.write(`${issue.severity} ${issue.code} ${options.dir}/${issue.file}: ${issue.message}\n`);
+        process.stdout.write(`${files.size} files checked, ${issues.filter((i) => i.severity === "error").length} errors, ${issues.filter((i) => i.severity === "warning").length} warnings\n`);
+    }
+    if (issues.some((i) => i.severity === "error" || (options.strict && i.severity === "warning")))
+        process.exitCode = 1;
+}

package/dist/knowledge/concept.d.ts

@@ -0,0 +1,54 @@
+import { z } from "zod";
+export declare const DEFAULT_KNOWLEDGE_BUNDLE_PATH = "docs/knowledge";
+export declare const RESERVED_BUNDLE_FILES: Set<string>;
+declare const CitationSchema: z.ZodObject<{
+    id: z.ZodOptional<z.ZodString>;
+    repo: z.ZodString;
+    path: z.ZodEffects<z.ZodString, string, string>;
+    lines: z.ZodOptional<z.ZodEffects<z.ZodTuple<[z.ZodNumber, z.ZodNumber], null>, [number, number], [number, number]>>;
+    symbol: z.ZodOptional<z.ZodString>;
+    sha: z.ZodString;
+    spanHash: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    repo: string;
+    sha: string;
+    spanHash: string;
+    symbol?: string | undefined;
+    id?: string | undefined;
+    lines?: [number, number] | undefined;
+}, {
+    path: string;
+    repo: string;
+    sha: string;
+    spanHash: string;
+    symbol?: string | undefined;
+    id?: string | undefined;
+    lines?: [number, number] | undefined;
+}>;
+export type KnowledgeCitation = z.infer<typeof CitationSchema>;
+export interface ParsedConcept {
+    path: string;
+    type: string;
+    title?: string;
+    description?: string;
+    status: "draft" | "stable" | "deprecated";
+    roles: string[];
+    affects: string[];
+    citations: KnowledgeCitation[];
+    body: string;
+    frontMatter: Record<string, unknown>;
+}
+export type ParseResult = {
+    ok: true;
+    concept: ParsedConcept;
+} | {
+    ok: false;
+    error: string;
+};
+export declare function splitFrontMatter(text: string): {
+    yaml: string;
+    body: string;
+} | null;
+export declare function parseConcept(path: string, text: string): ParseResult;
+export {};