@wardby/cli 0.3.0 → 0.4.1

package/dist/import/neutral-schema.d.ts

@@ -8,15 +8,15 @@ export declare const CiphertextSchema: z.ZodObject<{
     tag: z.ZodString;
 }, "strip", z.ZodTypeAny, {
     tag: string;
-    v: number;
     alg: string;
+    v: number;
     epk: string;
     nonce: string;
     ct: string;
 }, {
     tag: string;
-    v: number;
     alg: string;
+    v: number;
     epk: string;
     nonce: string;
     ct: string;
@@ -98,20 +98,20 @@ export declare const NeutralAgentSchema: z.ZodObject<{
         slug: z.ZodOptional<z.ZodDefault<z.ZodNullable<z.ZodString>>>;
         emailAllowlist: z.ZodOptional<z.ZodDefault<z.ZodNullable<z.ZodUnknown>>>;
     }, "strip", z.ZodTypeAny, {
-        slug?: string | null | undefined;
         description?: string | null | undefined;
+        slug?: string | null | undefined;
         emailAllowlist?: unknown;
     }, {
-        slug?: string | null | undefined;
         description?: string | null | undefined;
+        slug?: string | null | undefined;
         emailAllowlist?: unknown;
     }>>;
 }, "strip", z.ZodTypeAny, {
     name: string;
     model: string;
     budgetUsd: string;
-    kind: "native";
     provider: "openai" | "bedrock";
+    kind: "native";
     systemPrompt: string;
     schedule: string | null;
     timezone: string;
@@ -121,8 +121,8 @@ export declare const NeutralAgentSchema: z.ZodObject<{
     region: string | null;
     ownerEmail: string | null;
     unmodeled: {
-        slug?: string | null | undefined;
         description?: string | null | undefined;
+        slug?: string | null | undefined;
         emailAllowlist?: unknown;
     };
 }, {
@@ -140,8 +140,8 @@ export declare const NeutralAgentSchema: z.ZodObject<{
     region?: string | null | undefined;
     ownerEmail?: string | null | undefined;
     unmodeled?: {
-        slug?: string | null | undefined;
         description?: string | null | undefined;
+        slug?: string | null | undefined;
         emailAllowlist?: unknown;
     } | undefined;
 }>;
@@ -208,15 +208,15 @@ export declare const NeutralSecretSchema: z.ZodObject<{
         tag: z.ZodString;
     }, "strip", z.ZodTypeAny, {
         tag: string;
-        v: number;
         alg: string;
+        v: number;
         epk: string;
         nonce: string;
         ct: string;
     }, {
         tag: string;
-        v: number;
         alg: string;
+        v: number;
         epk: string;
         nonce: string;
         ct: string;
@@ -227,23 +227,23 @@ export declare const NeutralSecretSchema: z.ZodObject<{
     ownerEmail: string | null;
     ciphertext?: {
         tag: string;
-        v: number;
         alg: string;
+        v: number;
         epk: string;
         nonce: string;
         ct: string;
     } | undefined;
 }, {
     name: string;
+    description?: string | null | undefined;
     ciphertext?: {
         tag: string;
-        v: number;
         alg: string;
+        v: number;
         epk: string;
         nonce: string;
         ct: string;
     } | undefined;
-    description?: string | null | undefined;
     ownerEmail?: string | null | undefined;
 }>;
 export type NeutralSecret = z.infer<typeof NeutralSecretSchema>;
@@ -331,11 +331,11 @@ export declare const NeutralWebhookSchema: z.ZodObject<{
     agentName: z.ZodString;
     enabled: z.ZodBoolean;
 }, "strip", z.ZodTypeAny, {
-    agentName: string;
     enabled: boolean;
-}, {
     agentName: string;
+}, {
     enabled: boolean;
+    agentName: string;
 }>;
 export type NeutralWebhook = z.infer<typeof NeutralWebhookSchema>;
 export declare const NeutralBudgetSchema: z.ZodObject<{
@@ -349,8 +349,8 @@ export declare const NeutralBudgetSchema: z.ZodObject<{
     attachedAgentNames: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
 }, "strip", z.ZodTypeAny, {
     name: string;
-    period: "daily" | "weekly" | "monthly";
     enabled: boolean;
+    period: "daily" | "weekly" | "monthly";
     ownerEmail: string | null;
     attachedAgentNames: string[];
     alertThreshold: string;
@@ -358,8 +358,8 @@ export declare const NeutralBudgetSchema: z.ZodObject<{
     alertEmails: string[];
 }, {
     name: string;
-    period: "daily" | "weekly" | "monthly";
     enabled: boolean;
+    period: "daily" | "weekly" | "monthly";
     alertThreshold: string;
     blockThreshold: string;
     ownerEmail?: string | null | undefined;

package/dist/knowledge/check.d.ts

@@ -0,0 +1,13 @@
+export type CheckSeverity = "error" | "warning";
+export type CheckCode = "concept_invalid" | "concept_secret" | "index_missing" | "index_link_broken" | "concept_not_indexed" | "citation_unverifiable" | "citation_stale";
+export interface CheckIssue {
+    severity: CheckSeverity;
+    code: CheckCode;
+    file: string;
+    message: string;
+}
+export interface BundleFiles {
+    files: Map<string, string>;
+}
+export type RepoFileReader = (repoRelativePath: string) => string | null;
+export declare function checkBundle(bundle: BundleFiles, readRepoFile: RepoFileReader): CheckIssue[];

package/dist/knowledge/check.js

@@ -0,0 +1,69 @@
+import { redactTokenShapedValues } from "../coding/protocol.js";
+import { parseConcept, RESERVED_BUNDLE_FILES } from "./concept.js";
+import { spanHash } from "./span-hash.js";
+const LINK = /\]\(([^)#\s]+\.md)(?:#[^)\s]*)?\)/g;
+const URL_SCHEME = /^[a-z][a-z0-9+.-]*:/i;
+const baseName = (path) => path.split("/").pop() ?? path;
+function dirOf(path) {
+    const cut = path.lastIndexOf("/");
+    return cut < 0 ? "" : path.slice(0, cut + 1);
+}
+function normalize(path) {
+    const parts = [];
+    for (const part of path.split("/")) {
+        if (part === "..")
+            parts.pop();
+        else if (part !== "." && part !== "")
+            parts.push(part);
+    }
+    return parts.join("/");
+}
+export function checkBundle(bundle, readRepoFile) {
+    const issues = [];
+    const add = (severity, code, file, message) => issues.push({ severity, code, file, message });
+    if (!bundle.files.has("index.md"))
+        add("error", "index_missing", "index.md", "the bundle has no root index.md");
+    const linked = new Set();
+    for (const [path, text] of bundle.files) {
+        if (redactTokenShapedValues(text) !== text)
+            add("error", "concept_secret", path, "contains a secret-shaped value");
+        if (baseName(path) !== "index.md")
+            continue;
+        for (const match of text.matchAll(LINK)) {
+            if (URL_SCHEME.test(match[1]))
+                continue;
+            const target = normalize(match[1].startsWith("/") ? match[1].slice(1) : dirOf(path) + match[1]);
+            linked.add(target);
+            if (!bundle.files.has(target))
+                add("error", "index_link_broken", path, `links to missing ${target}`);
+        }
+    }
+    const fileCache = new Map();
+    const read = (p) => {
+        if (!fileCache.has(p))
+            fileCache.set(p, readRepoFile(p));
+        return fileCache.get(p) ?? null;
+    };
+    for (const [path, text] of bundle.files) {
+        const base = path.split("/").pop() ?? path;
+        if (!path.endsWith(".md") || RESERVED_BUNDLE_FILES.has(base))
+            continue;
+        const parsed = parseConcept(path, text);
+        if (!parsed.ok) {
+            add("error", "concept_invalid", path, parsed.error);
+            continue;
+        }
+        if (!linked.has(path))
+            add("warning", "concept_not_indexed", path, "not linked from an index.md");
+        for (const citation of parsed.concept.citations) {
+            const where = `${citation.path}${citation.lines ? `#L${citation.lines[0]}-L${citation.lines[1]}` : ""}`;
+            const source = read(citation.path);
+            const actual = source === null ? null : spanHash(source, citation.lines);
+            if (actual === null)
+                add("warning", "citation_unverifiable", path, `${where} is missing or out of range`);
+            else if (actual !== citation.spanHash)
+                add("warning", "citation_stale", path, `${where} changed since it was cited`);
+        }
+    }
+    return issues;
+}

package/dist/knowledge/cli.d.ts

@@ -0,0 +1,14 @@
+export declare function parseKnowledgeArgs(args: string[]): {
+    dir: string;
+    root: string;
+    strict: boolean;
+    json: boolean;
+};
+/**
+ * Every `.md` file under `dir`, keyed by bundle-relative POSIX path. Entry
+ * types come from the directory listing itself (no separate stat, so nothing
+ * can change between the check and the read), and symbolic links are skipped:
+ * a bundle is plain files, and following links could loop or leave the bundle.
+ */
+export declare function loadBundle(dir: string): Map<string, string>;
+export declare function knowledgeCommand(args: string[]): Promise<void>;

package/dist/knowledge/cli.js

@@ -0,0 +1,67 @@
+import { readdirSync, readFileSync } from "node:fs";
+import { join, relative, resolve, sep } from "node:path";
+import { parseArgs } from "node:util";
+import { checkBundle } from "./check.js";
+import { DEFAULT_KNOWLEDGE_BUNDLE_PATH } from "./concept.js";
+const USAGE = "usage: wardby knowledge check [dir] [--root <repo root>] [--strict] [--json]";
+export function parseKnowledgeArgs(args) {
+    const [sub, ...rest] = args;
+    if (sub !== "check")
+        throw new Error(USAGE);
+    const { values, positionals } = parseArgs({
+        args: rest,
+        allowPositionals: true,
+        options: { root: { type: "string" }, strict: { type: "boolean" }, json: { type: "boolean" } },
+    });
+    if (positionals.length > 1)
+        throw new Error(USAGE);
+    return {
+        dir: positionals[0] ?? DEFAULT_KNOWLEDGE_BUNDLE_PATH,
+        root: values.root ?? ".",
+        strict: values.strict ?? false,
+        json: values.json ?? false,
+    };
+}
+/**
+ * Every `.md` file under `dir`, keyed by bundle-relative POSIX path. Entry
+ * types come from the directory listing itself (no separate stat, so nothing
+ * can change between the check and the read), and symbolic links are skipped:
+ * a bundle is plain files, and following links could loop or leave the bundle.
+ */
+export function loadBundle(dir) {
+    const files = new Map();
+    const walk = (current) => {
+        for (const entry of readdirSync(current, { withFileTypes: true })) {
+            const full = join(current, entry.name);
+            if (entry.isDirectory())
+                walk(full);
+            else if (entry.isFile() && entry.name.endsWith(".md")) {
+                files.set(relative(dir, full).split(sep).join("/"), readFileSync(full, "utf8"));
+            }
+        }
+    };
+    walk(dir);
+    return files;
+}
+export async function knowledgeCommand(args) {
+    const options = parseKnowledgeArgs(args);
+    const root = resolve(options.root);
+    const files = loadBundle(resolve(root, options.dir));
+    const issues = checkBundle({ files }, (path) => {
+        try {
+            return readFileSync(join(root, path), "utf8");
+        }
+        catch {
+            return null;
+        }
+    });
+    if (options.json)
+        process.stdout.write(`${JSON.stringify({ issues }, null, 2)}\n`);
+    else {
+        for (const issue of issues)
+            process.stdout.write(`${issue.severity} ${issue.code} ${options.dir}/${issue.file}: ${issue.message}\n`);
+        process.stdout.write(`${files.size} files checked, ${issues.filter((i) => i.severity === "error").length} errors, ${issues.filter((i) => i.severity === "warning").length} warnings\n`);
+    }
+    if (issues.some((i) => i.severity === "error" || (options.strict && i.severity === "warning")))
+        process.exitCode = 1;
+}

package/dist/knowledge/concept.d.ts

@@ -0,0 +1,54 @@
+import { z } from "zod";
+export declare const DEFAULT_KNOWLEDGE_BUNDLE_PATH = "docs/knowledge";
+export declare const RESERVED_BUNDLE_FILES: Set<string>;
+declare const CitationSchema: z.ZodObject<{
+    id: z.ZodOptional<z.ZodString>;
+    repo: z.ZodString;
+    path: z.ZodEffects<z.ZodString, string, string>;
+    lines: z.ZodOptional<z.ZodEffects<z.ZodTuple<[z.ZodNumber, z.ZodNumber], null>, [number, number], [number, number]>>;
+    symbol: z.ZodOptional<z.ZodString>;
+    sha: z.ZodString;
+    spanHash: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    repo: string;
+    sha: string;
+    spanHash: string;
+    symbol?: string | undefined;
+    id?: string | undefined;
+    lines?: [number, number] | undefined;
+}, {
+    path: string;
+    repo: string;
+    sha: string;
+    spanHash: string;
+    symbol?: string | undefined;
+    id?: string | undefined;
+    lines?: [number, number] | undefined;
+}>;
+export type KnowledgeCitation = z.infer<typeof CitationSchema>;
+export interface ParsedConcept {
+    path: string;
+    type: string;
+    title?: string;
+    description?: string;
+    status: "draft" | "stable" | "deprecated";
+    roles: string[];
+    affects: string[];
+    citations: KnowledgeCitation[];
+    body: string;
+    frontMatter: Record<string, unknown>;
+}
+export type ParseResult = {
+    ok: true;
+    concept: ParsedConcept;
+} | {
+    ok: false;
+    error: string;
+};
+export declare function splitFrontMatter(text: string): {
+    yaml: string;
+    body: string;
+} | null;
+export declare function parseConcept(path: string, text: string): ParseResult;
+export {};

package/dist/knowledge/concept.js

@@ -0,0 +1,78 @@
+import { parse as parseYaml } from "yaml";
+import { z } from "zod";
+export const DEFAULT_KNOWLEDGE_BUNDLE_PATH = "docs/knowledge";
+export const RESERVED_BUNDLE_FILES = new Set(["index.md", "log.md"]);
+const CitationSchema = z.object({
+    id: z.string().min(1).optional(),
+    repo: z.string().min(1),
+    path: z
+        .string()
+        .min(1)
+        .refine((p) => !p.startsWith("/") && !p.split("/").includes(".."), "path must be repo-relative"),
+    lines: z
+        .tuple([z.number().int().min(1), z.number().int().min(1)])
+        .refine(([a, b]) => b >= a, "lines must be [start, end] with end >= start")
+        .optional(),
+    symbol: z.string().min(1).optional(),
+    sha: z.string().regex(/^[0-9a-f]{40}$/, "sha must be a full 40-hex commit"),
+    spanHash: z.string().regex(/^sha256:[0-9a-f]{64}$/, "spanHash must be sha256:<64 hex>"),
+});
+const WardbyBlockSchema = z
+    .object({
+    schema: z.literal(1),
+    roles: z.array(z.enum(["builder", "reviewer", "planner"])).default([]),
+    affects: z.array(z.string().min(1)).default([]),
+    citations: z.array(CitationSchema).default([]),
+    supersedes: z.string().nullable().optional(),
+    confidence: z.enum(["low", "medium", "high"]).optional(),
+})
+    .passthrough();
+const FrontMatterSchema = z
+    .object({
+    type: z.string().trim().min(1),
+    title: z.string().optional(),
+    description: z.string().optional(),
+    status: z.enum(["draft", "stable", "deprecated"]).default("stable"),
+    wardby: WardbyBlockSchema.optional(),
+})
+    .passthrough();
+export function splitFrontMatter(text) {
+    const match = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/.exec(text);
+    return match ? { yaml: match[1], body: match[2] } : null;
+}
+export function parseConcept(path, text) {
+    const base = path.split("/").pop() ?? path;
+    if (RESERVED_BUNDLE_FILES.has(base))
+        return { ok: false, error: `${base} is reserved and cannot be a concept` };
+    const split = splitFrontMatter(text);
+    if (!split)
+        return { ok: false, error: "missing YAML front-matter (--- ... ---)" };
+    let raw;
+    try {
+        raw = parseYaml(split.yaml);
+    }
+    catch (error) {
+        return { ok: false, error: `invalid YAML: ${error instanceof Error ? error.message : String(error)}` };
+    }
+    const parsed = FrontMatterSchema.safeParse(raw);
+    if (!parsed.success) {
+        const issue = parsed.error.issues[0];
+        return { ok: false, error: `${issue.path.join(".") || "front-matter"}: ${issue.message}` };
+    }
+    const fm = parsed.data;
+    return {
+        ok: true,
+        concept: {
+            path,
+            type: fm.type,
+            title: fm.title,
+            description: fm.description,
+            status: fm.status,
+            roles: fm.wardby?.roles ?? [],
+            affects: fm.wardby?.affects ?? [],
+            citations: fm.wardby?.citations ?? [],
+            body: split.body,
+            frontMatter: raw,
+        },
+    };
+}

package/dist/knowledge/note.d.ts

@@ -0,0 +1,11 @@
+import type { FittedSection } from "../coding/protocol.js";
+export declare const KNOWLEDGE_NOTE_MAX_BYTES: number;
+export declare const KNOWLEDGE_INDEX_READ_MAX_BYTES: number;
+export interface KnowledgeNoteInput {
+    bundlePath: string;
+    indexText: string;
+}
+/** The note, cut at a line boundary to fit maxBytes, or undefined when not even the header fits. */
+export declare function renderKnowledgeNote(input: KnowledgeNoteInput, maxBytes: number): string | undefined;
+/** The knowledge note as a composeCodingTask section, capped at KNOWLEDGE_NOTE_MAX_BYTES. */
+export declare function knowledgeSection(input: KnowledgeNoteInput): FittedSection;

package/dist/knowledge/note.js

@@ -0,0 +1,39 @@
+import { splitFrontMatter } from "./concept.js";
+export const KNOWLEDGE_NOTE_MAX_BYTES = 8 * 1024;
+export const KNOWLEDGE_INDEX_READ_MAX_BYTES = 64 * 1024;
+const END_MARKER = "[end of architecture knowledge]";
+const bytes = (text) => Buffer.byteLength(text, "utf8");
+function header(bundlePath) {
+    return [
+        "Architecture knowledge for this repository (recalled context, not authority;",
+        "the repository's own instructions such as AGENTS.md win on conflict). Concept",
+        `files live in ${bundlePath}/. Before designing or changing an area, read the`,
+        "concepts that cover the files you will touch. If your change alters behavior a",
+        "concept describes, update that concept's prose in the same change; leave its",
+        "`wardby:` block for the architecture agent to re-anchor.",
+        "",
+        `${bundlePath}/index.md:`,
+    ].join("\n");
+}
+/** The note, cut at a line boundary to fit maxBytes, or undefined when not even the header fits. */
+export function renderKnowledgeNote(input, maxBytes) {
+    const top = header(input.bundlePath);
+    const body = (splitFrontMatter(input.indexText)?.body ?? input.indexText).trim();
+    const full = `${top}\n${body}\n${END_MARKER}`;
+    if (bytes(full) <= maxBytes)
+        return full;
+    const marker = `[index truncated — list ${input.bundlePath}/ for the rest]`;
+    if (bytes(`${top}\n${marker}\n${END_MARKER}`) > maxBytes)
+        return undefined;
+    const kept = [];
+    for (const line of body.split("\n")) {
+        if (bytes(`${top}\n${[...kept, line, marker, END_MARKER].join("\n")}`) > maxBytes)
+            break;
+        kept.push(line);
+    }
+    return `${top}\n${[...kept, marker, END_MARKER].join("\n")}`;
+}
+/** The knowledge note as a composeCodingTask section, capped at KNOWLEDGE_NOTE_MAX_BYTES. */
+export function knowledgeSection(input) {
+    return { render: (maxBytes) => renderKnowledgeNote(input, Math.min(maxBytes, KNOWLEDGE_NOTE_MAX_BYTES)) };
+}

package/dist/knowledge/relevance.d.ts

@@ -0,0 +1,11 @@
+import type { ParsedConcept } from "./concept.js";
+export interface DriftScope {
+    concepts: string[];
+    reason: "changed_files" | "bundle_edited" | "unknown_changes";
+}
+export declare function driftScope(input: {
+    changedPaths: string[];
+    changedPathsComplete: boolean;
+    bundlePath: string;
+    concepts: ParsedConcept[];
+}): DriftScope | null;

package/dist/knowledge/relevance.js

@@ -0,0 +1,14 @@
+import { matchesGlob } from "../core/glob.js";
+export function driftScope(input) {
+    const all = input.concepts.map((c) => c.path).sort();
+    if (!input.changedPathsComplete)
+        return all.length ? { concepts: all, reason: "unknown_changes" } : null;
+    const prefix = `${input.bundlePath}/`;
+    const bundleEdited = input.changedPaths.some((p) => p.startsWith(prefix));
+    const selected = input.concepts.filter((concept) => input.changedPaths.some((changed) => changed === prefix + concept.path ||
+        concept.citations.some((c) => c.path === changed) ||
+        concept.affects.some((glob) => matchesGlob(changed, glob))));
+    if (!selected.length)
+        return null;
+    return { concepts: selected.map((c) => c.path).sort(), reason: bundleEdited ? "bundle_edited" : "changed_files" };
+}

package/dist/knowledge/span-hash.d.ts

@@ -0,0 +1,3 @@
+/** sha256 of lines A..B (1-based, inclusive), each followed by "\n"
+ * (equals `sed -n 'A,Bp' FILE | sha256sum` when the last cited line ends with a newline). */
+export declare function spanHash(fileText: string, lines?: [number, number]): string | null;

package/dist/knowledge/span-hash.js

@@ -0,0 +1,16 @@
+import { createHash } from "node:crypto";
+/** sha256 of lines A..B (1-based, inclusive), each followed by "\n"
+ * (equals `sed -n 'A,Bp' FILE | sha256sum` when the last cited line ends with a newline). */
+export function spanHash(fileText, lines) {
+    const digest = (text) => `sha256:${createHash("sha256").update(text, "utf8").digest("hex")}`;
+    if (!lines)
+        return digest(fileText);
+    const [start, end] = lines;
+    const all = fileText.endsWith("\n") ? fileText.slice(0, -1).split("\n") : fileText.split("\n");
+    if (start < 1 || end < start || end > all.length)
+        return null;
+    return digest(all
+        .slice(start - 1, end)
+        .map((line) => `${line}\n`)
+        .join(""));
+}

package/dist/mcp/auth/access.d.ts

@@ -40,17 +40,19 @@ export declare function requireAgentAccess(ctx: McpRequestContext, id: string, r
         name: string;
         model: string;
         budgetUsd: import("@prisma/client-runtime-utils").Decimal;
+        createdAt: Date;
+        updatedAt: Date;
         kind: import("#prisma").AgentKind;
         id: string;
         ownerId: string | null;
-        createdAt: Date;
-        updatedAt: Date;
         systemPrompt: string;
         schedule: string | null;
         timezone: string;
         scheduleEnabled: boolean;
         lastScheduledAt: Date | null;
         maxTurns: number;
+        defectProjectKey: string | null;
+        defectIssueType: string | null;
         budgetGroupId: string | null;
         memoryEnabled: boolean;
         effort: string | null;

package/dist/mcp/auth/ownership.d.ts

@@ -26,34 +26,34 @@ export declare function visibleToPrincipal(principalId: string): {
 };
 export declare function requireOwnedBudgetGroup(db: PrismaClient, id: string, principalId: string): Promise<{
     name: string;
+    createdAt: Date;
+    updatedAt: Date;
     id: string;
     ownerId: string | null;
     dailyBudgetUsd: import("@prisma/client-runtime-utils").Decimal | null;
     weeklyBudgetUsd: import("@prisma/client-runtime-utils").Decimal | null;
     monthlyBudgetUsd: import("@prisma/client-runtime-utils").Decimal | null;
     warnThresholdRatio: import("@prisma/client-runtime-utils").Decimal;
-    createdAt: Date;
-    updatedAt: Date;
 }>;
 export declare function requireReadableBudgetGroup(db: Pick<PrismaClient, "budgetGroup">, id: string, principalId: string): Promise<{
     name: string;
+    createdAt: Date;
+    updatedAt: Date;
     id: string;
     ownerId: string | null;
     dailyBudgetUsd: import("@prisma/client-runtime-utils").Decimal | null;
     weeklyBudgetUsd: import("@prisma/client-runtime-utils").Decimal | null;
     monthlyBudgetUsd: import("@prisma/client-runtime-utils").Decimal | null;
     warnThresholdRatio: import("@prisma/client-runtime-utils").Decimal;
-    createdAt: Date;
-    updatedAt: Date;
 }>;
 export declare function requireOwnedSecret(db: PrismaClient, id: string, principalId: string): Promise<void>;
 export declare function requireOwnedWebhook(db: PrismaClient, id: string, principalId: string): Promise<void>;
 export declare function requireOwnedDatastore(db: PrismaClient, id: string, principalId: string): Promise<{
     name: string;
-    id: string;
-    ownerId: string | null;
     createdAt: Date;
     updatedAt: Date;
+    id: string;
+    ownerId: string | null;
 }>;
 export declare function requireOwnedTool(db: Pick<PrismaClient, "tool">, id: string, principalId: string): Promise<Tool>;
 /**
@@ -74,12 +74,12 @@ export declare function assertStrictlyOwnedTool(tool: Tool | null, id: string, p
 export declare function requireOwnedTask(db: PrismaClient, taskId: string, principalId: string): Promise<{
     status: import("#prisma").TaskStatus;
     runId: string | null;
-    kind: import("#prisma").TaskKind;
     error: import("@prisma/client/runtime/client").JsonValue | null;
-    result: import("@prisma/client/runtime/client").JsonValue | null;
-    id: string;
     createdAt: Date;
     updatedAt: Date;
+    kind: import("#prisma").TaskKind;
+    result: import("@prisma/client/runtime/client").JsonValue | null;
+    id: string;
     principalId: string | null;
     inputRequests: import("@prisma/client/runtime/client").JsonValue | null;
     inputResponses: import("@prisma/client/runtime/client").JsonValue | null;

package/dist/mcp/auth/resource-server.d.ts

@@ -16,7 +16,9 @@ export declare const SCOPES_SUPPORTED: string[];
  * agents:admin reassigns ANY agent's owner (make_owner) and sets a BYO
  * workerImageRef; packages:approve widens coding agents' package allowlists;
  * services:manage changes the coding-run service catalog, which decides what
- * runs next to every coding run that names an entry.
+ * runs next to every coding run that names an entry; admin:view reads every
+ * owner's runs (the admin viewer API); models:admin changes the model catalog,
+ * which prices every principal's runs.
  * A token scope only DELEGATES — it never authorizes on its own:
  * requireScope/requireAnyScope honour one only when one of the caller's
  * roles (McpRequestContext.roles, resolved live per request) grants it.