@henrikogard/auroradocs-mcp 0.1.1 → 0.2.1

package/README.md

@@ -1,14 +1,17 @@
 # AuroraDocs MCP Server
 
-`@henrikogard/auroradocs-mcp` connects a local MCP client to one AuroraCloud
-workspace. It runs on your computer over stdio and sends authenticated requests
-to `https://api.auroradocs.eu`.
+`@henrikogard/auroradocs-mcp` connects a local MCP client to independently
+granted AuroraCloud workspaces. It runs on your computer over stdio and sends
+authenticated requests to `https://api.auroradocs.eu`.
 
-The public package is `@henrikogard/auroradocs-mcp`, the executable is
-`aurora-mcp`, and this documentation targets version `0.1.1`.
+The public package is `@henrikogard/auroradocs-mcp` and the executable is
+`aurora-mcp`. The latest published package and current source version are
+`0.2.1`.
 
 For an end-to-end installation walkthrough, use the dedicated
-[Setup guide](docs/setup.md).
+[Setup guide](docs/setup.md). AI assistants and client integrators should start
+with the [Agent guide](docs/agent-guide.md); Hermes and OpenClaw users should
+also apply the bounded [read-only agent profiles](docs/agent-profiles.md).
 
 ## Requirements
 
@@ -18,10 +21,19 @@ For an end-to-end installation walkthrough, use the dedicated
 - a supported local MCP client: Claude Desktop, Claude Code, Codex, or another
   client that can start a stdio server
 
-Browser-only workspaces and Local folders workspaces are not supported. The
-server does not read a browser tab or a folder on your computer.
+Browser-only workspaces and Local folders workspaces are not AuroraCloud MCP
+destinations. By default the server does not read a browser tab or local
+folder. The optional Obsidian importer reads only one explicitly configured
+vault root for analysis and import; it never turns that folder into a workspace.
 
-## Create an MCP key
+## Create an MCP credential
+
+New multi-workspace installations should use an `aur_mcp_client_` credential
+with owner-approved, independently revocable workspace grants. Follow the
+[Setup guide](docs/setup.md) for that flow. The workspace-scoped `aur_mcp_`
+steps below remain available during the legacy migration window.
+
+### Legacy workspace token
 
 1. Sign in to AuroraDocs and open the AuroraCloud workspace you want to use.
 2. Go to **Settings → Workspace → MCP Access**.
@@ -52,18 +64,21 @@ write scope does not imply its read counterpart.
 | Confirm the connection and list titles | `read:objects` |
 | Read page or Canvas content | `read:objects`, `read:content` |
 | Search and read workspace knowledge | `read:objects`, `read:content`, `search` |
-| Review or update tasks and week planning | `read:objects`, `tasks` |
-| Update task metadata after confirmation | `read:objects`, `tasks`, `write:objects` |
+| Review tasks and week planning | `read:objects`, `read:tasks` |
+| Update task metadata after confirmation | `read:objects`, `read:tasks`, `write:tasks`, `write:objects` |
 | Create or rename non-task objects | `read:objects`, `write:objects` |
 | Replace or append document content | `read:objects`, `read:content`, `write:content` |
+| Design custom types and reusable templates | `read:objects`; add `write:objects` and `write:content` only for an approved apply |
+| Import an authorized Obsidian vault | `read:objects`, `write:objects`, `write:content` |
 
 `read:objects` is the practical baseline because the server verifies workspace
 membership at startup and most tools operate on object metadata. Add
 `write:objects` or `write:content` only when you intend to let the client modify
 the workspace. See the complete [scope and tool reference](docs/tools.md).
 
-The `tasks` scope permits both reading and writing task metadata. Do not grant
-it to a client that should have strictly read-only access.
+New client grants use separate `read:tasks` and `write:tasks` scopes. The legacy
+`tasks` scope permits both reading and writing task metadata; it is
+compatibility-only and cannot be selected for new grants.
 
 `search_objects` and its `search` alias search object titles with `read:objects` only.
 `wiki_search` searches workspace knowledge and requires `read:objects` plus `search`.
@@ -72,18 +87,24 @@ in the knowledge-search recipe above.
 
 ## Configure a client
 
-All examples below use the production AuroraCloud API and pin package version
-`0.1.1`. Replace `WORKSPACE_ID` and `REDACTED` locally. Do not commit the
+All examples below use the production AuroraCloud API, a new client credential,
+and package version `0.2.1`. Replace `REDACTED` locally. Do not commit the
 resulting configuration. The examples store the token in the client's saved
 configuration, so protect that file as a credential.
 
-The server requires exactly these environment variables:
+New client credentials require these environment variables:
 
 | Variable | Value |
 | --- | --- |
 | `AURORA_API_URL` | `https://api.auroradocs.eu` |
-| `AURORA_WORKSPACE_ID` | the workspace ID shown on the MCP Access page |
-| `AURORA_API_TOKEN` | the one-time `aur_mcp_` token |
+| `AURORA_API_TOKEN` | the one-time `aur_mcp_client_` credential |
+| `AURORA_OBSIDIAN_VAULT_ROOT` | optional absolute path authorizing read-only analysis of one Obsidian vault |
+| `AURORA_MCP_STATE_DIR` | optional private plan/journal directory outside that vault |
+
+Do not set `AURORA_WORKSPACE_ID` for a client credential. The server discovers
+only its owner-approved grants with `list_workspaces`; each data call then
+selects a workspace explicitly. A legacy `aur_mcp_` token still requires
+`AURORA_WORKSPACE_ID` during the migration window.
 
 Do not configure an AuroraDocs email or password. Public onboarding supports
 MCP-token authentication only.
@@ -98,10 +119,9 @@ this server under `mcpServers`, preserving any servers already present:
   "mcpServers": {
     "auroradocs": {
       "command": "npx",
-      "args": ["-y", "@henrikogard/auroradocs-mcp@0.1.1"],
+      "args": ["-y", "@henrikogard/auroradocs-mcp@0.2.1"],
       "env": {
         "AURORA_API_URL": "https://api.auroradocs.eu",
-        "AURORA_WORKSPACE_ID": "WORKSPACE_ID",
         "AURORA_API_TOKEN": "REDACTED"
       }
     }
@@ -121,9 +141,8 @@ Options must appear before the server name:
 ```bash
 claude mcp add --transport stdio --scope user \
   --env AURORA_API_URL=https://api.auroradocs.eu \
-  --env AURORA_WORKSPACE_ID=WORKSPACE_ID \
   --env AURORA_API_TOKEN=REDACTED \
-  auroradocs -- npx -y @henrikogard/auroradocs-mcp@0.1.1
+  auroradocs -- npx -y @henrikogard/auroradocs-mcp@0.2.1
 ```
 
 Run `claude mcp get auroradocs` to inspect the saved entry, then use `/mcp` in
@@ -137,9 +156,8 @@ The installed Codex CLI accepts `--env` for local stdio servers:
 ```bash
 codex mcp add \
   --env AURORA_API_URL=https://api.auroradocs.eu \
-  --env AURORA_WORKSPACE_ID=WORKSPACE_ID \
   --env AURORA_API_TOKEN=REDACTED \
-  auroradocs -- npx -y @henrikogard/auroradocs-mcp@0.1.1
+  auroradocs -- npx -y @henrikogard/auroradocs-mcp@0.2.1
 ```
 
 Run `codex mcp get auroradocs` to inspect the saved entry.
@@ -151,10 +169,9 @@ Use this valid generic JSON shape when a client accepts an MCP server object:
 ```json
 {
   "command": "npx",
-  "args": ["-y", "@henrikogard/auroradocs-mcp@0.1.1"],
+  "args": ["-y", "@henrikogard/auroradocs-mcp@0.2.1"],
   "env": {
     "AURORA_API_URL": "https://api.auroradocs.eu",
-    "AURORA_WORKSPACE_ID": "WORKSPACE_ID",
     "AURORA_API_TOKEN": "REDACTED"
   }
 }
@@ -164,15 +181,62 @@ The client must launch the process locally and communicate over stdio. Do not
 configure `https://api.auroradocs.eu` as an MCP HTTP/SSE URL; it is the API the
 local server calls, not a hosted MCP endpoint.
 
+## Agent discovery and recovery
+
+The server sends initialization instructions, exposes machine-readable workflow
+recipes with approval/write/stop/result contracts, and advertises MCP
+completions for authorized workspace, project, object-type, recipe, and template
+prompt/resource arguments. The `template_instantiation` prompt guides an exact
+template selection before creation. `restore_object` recovers an explicitly
+identified soft-deleted object and safely reports when it was already active.
+
+MCP completions apply to prompt and resource-template arguments; direct tool
+inputs continue to use the bounded discovery tools documented in the
+[Agent guide](docs/agent-guide.md).
+
+## Custom databases and templates
+
+AuroraDocs MCP can discover existing object types/templates, offer starter
+recipes for contacts, interests, equipment, subscriptions, and expenses, and
+plan an arbitrary special-purpose schema. Use `plan_custom_database` first,
+review the exact plan ID/hash, then call `apply_custom_database_plan` only after
+approval. Updates are additive: they cannot remove a property, change its value
+type or storage mapping, weaken requiredness, or silently retarget relations.
+
+The `custom_database_design` prompt teaches the same recipe-first,
+plan-before-apply flow. Templates can include a starter body and schema-declared
+defaults, but should never contain real credentials, payment data, or sensitive
+personal records.
+
+## Obsidian vault import
+
+Set `AURORA_OBSIDIAN_VAULT_ROOT` to one absolute local vault path only when you
+want to authorize read-only analysis. Import is a separate action: the server
+first returns a reviewable plan, then asks through MCP form elicitation when the
+client supports it. A compatibility client must wait for a later user message
+and send the exact plan ID/hash with `confirmed: true`. Decline, cancel,
+malformed confirmation, stale source state, missing scopes, viewer access, and
+E2EE all stop before AuroraDocs writes.
+
+Imports run in resume-safe batches, keep private plan metadata plus a
+content-free progress journal outside the vault, survive MCP process restarts,
+and never modify the source. Back up both systems first and start
+with a small test workspace. See [Obsidian import](docs/obsidian-import.md) for
+configuration, mapping, consent, recovery, and fidelity limits.
+
+Analysis rejects more than 256 MiB of eligible Markdown/Canvas source files,
+and hidden, plugin, Git, cache, trash, and other ignored paths cannot be read as
+attachments even when vault content links to them.
+
 ## Verify read-only access first
 
-1. Mint a token with only `read:objects`.
+1. Grant the client one workspace with only `read:objects`.
 2. Start or restart the client.
-3. Ask the client to call `list_objects` with a small limit and return only
-   object titles and IDs.
-4. Confirm that the result belongs to the intended workspace.
-5. Only then mint a replacement token with any additional scopes your workflow
-   genuinely needs. Update the client, verify it, and revoke the first token.
+3. Ask the client to call `list_workspaces` and confirm only the expected grant
+   is visible.
+4. Call `get_project_context` for one explicit workspace and project ID.
+5. Only then extend that workspace grant with any optional read scopes the
+   workflow genuinely needs.
 
 If the connection fails, see [Troubleshooting](docs/troubleshooting.md). Never
 paste the raw token into logs or bug reports.
@@ -211,7 +275,11 @@ report a vulnerability, follow [SECURITY.md](SECURITY.md).
 
 ## Reference
 
+- [Agent guide](docs/agent-guide.md)
 - [Tools and scopes](docs/tools.md)
+- [Obsidian import](docs/obsidian-import.md)
+- [Hermes and OpenClaw agent profiles](docs/agent-profiles.md)
+- [Agent planning and knowledge roadmap](docs/agent-planning-knowledge-roadmap.md)
 - [Security boundaries](docs/security.md)
 - [Troubleshooting](docs/troubleshooting.md)
 - [Contributing](CONTRIBUTING.md)
@@ -226,13 +294,19 @@ pnpm check
 ```
 
 The live AuroraCloud smoke test is intentionally separate because it requires a
-real workspace and a least-privilege `aur_mcp_` token. Give the smoke token only
-`read:objects`, `read:content`, and `search`; explicitly omit `tasks` because
-that scope authorizes both task reads and task writes. The smoke authenticates,
-checks membership, lists tools, members, and objects, and reads the recent
-knowledge catalog. Every dispatched tool must carry the catalog's authoritative
-read-only classification, and the smoke never creates, updates, or deletes
-workspace data. See [CONTRIBUTING.md](CONTRIBUTING.md) before using it.
+real owner-approved workspace grant. Prefer `AURORA_API_TOKEN=aur_mcp_client_...`
+with `AURORA_API_URL`; a legacy `aur_mcp_...` token additionally requires
+`AURORA_WORKSPACE_ID`. Grant only `read:objects`; add `read:content` only when
+the selected project's readable brief or citations must be included.
+
+The smoke always calls `list_workspaces`. Set `AURORA_SMOKE_PROJECT_ID` to add
+one bounded `get_project_context` request; omit it to verify discovery without
+guessing a project. When a client credential has multiple grants, also set
+`AURORA_SMOKE_WORKSPACE_ID` for that project check. The dispatcher verifies the
+catalog's authoritative read-only classification and never dispatches a write
+tool. Keep `AURORA_API_TOKEN` out of commands, logs, and committed files by
+providing it through your local secret environment. See
+[CONTRIBUTING.md](CONTRIBUTING.md) before using the smoke.
 
 ## License
 

package/dist/auroraClient.d.ts

@@ -1,10 +1,12 @@
 /**
  * auroraClient.ts — AuroraCloud client helpers for the MCP server.
  *
- * SECURITY: Every query is scoped to the configured workspace.
- * On authenticate(), the server verifies the caller is a member of
- * that workspace — if not, the process exits.
+ * SECURITY: Client credentials discover only independently granted workspaces.
+ * Legacy credentials verify membership in their configured default workspace.
+ * Tool execution resolves a granted or verified workspace before data access.
  */
+import type { AuroraConnectionContext, ContentReadResult, GrantedWorkspace } from './contracts.js';
+import type { CustomDatabaseTemplateDefault, ObjectTypeDef, ObjectTypeSchema, PropertyValueType } from './customDatabases.js';
 export type AuroraObjectRecord = {
     id: string;
     workspace_id: string;
@@ -33,6 +35,15 @@ export type AuroraPropertyRecord = {
     value_bool: boolean | null;
     value_ref: string | null;
 };
+export type AuroraTemplateInput = {
+    workspaceId: string;
+    objectId?: string;
+    type: string;
+    title: string;
+    icon?: string | null;
+    body?: string;
+    defaults?: CustomDatabaseTemplateDefault[];
+};
 export type AuroraWorkspaceMember = {
     id: string;
     name: string | null;
@@ -44,11 +55,11 @@ export type AuroraTaskList = {
     name: string;
     default_status: string | null;
 };
-export declare const WORKSPACE_KNOWLEDGE_SOURCE_KINDS: readonly ["object", "content_chunk", "property", "comment", "attachment_metadata", "relationship"];
+export declare const WORKSPACE_KNOWLEDGE_SOURCE_KINDS: readonly ['object', 'content_chunk', 'property', 'comment', 'attachment_metadata', 'relationship'];
 export type WorkspaceKnowledgeSourceKind = (typeof WORKSPACE_KNOWLEDGE_SOURCE_KINDS)[number];
-export declare const WORKSPACE_KNOWLEDGE_AVAILABILITY_STATES: readonly ["available", "encrypted_locked", "not_indexed", "unsupported_type", "permission_denied"];
+export declare const WORKSPACE_KNOWLEDGE_AVAILABILITY_STATES: readonly ['available', 'encrypted_locked', 'not_indexed', 'unsupported_type', 'permission_denied'];
 export type WorkspaceKnowledgeAvailability = (typeof WORKSPACE_KNOWLEDGE_AVAILABILITY_STATES)[number];
-export declare const WORKSPACE_KNOWLEDGE_RELATIONSHIP_TYPES: readonly ["parent", "child", "link", "backlink", "tag", "task_project"];
+export declare const WORKSPACE_KNOWLEDGE_RELATIONSHIP_TYPES: readonly ['parent', 'child', 'link', 'backlink', 'tag', 'task_project'];
 export type WorkspaceKnowledgeRelationshipType = (typeof WORKSPACE_KNOWLEDGE_RELATIONSHIP_TYPES)[number];
 export type WorkspaceKnowledgeRelationship = {
     type: WorkspaceKnowledgeRelationshipType;
@@ -68,7 +79,7 @@ export type WorkspaceKnowledgeSource = {
     snippet: string | null;
     plainText: string | null;
     blockId: string | null;
-    updatedAt: string;
+    updatedAt: string | null;
     score: number | null;
     matchedFields: Array<'title' | 'content' | 'properties' | 'relationships'>;
     availability: WorkspaceKnowledgeAvailability;
@@ -86,13 +97,21 @@ type BackendAuthStore = {
     record: AuthRecord;
     save(token: string, record: AuthRecord): void;
 };
+export type CollectionPage<T> = {
+    items: T[];
+    page: number;
+    perPage: number;
+    totalPages: number;
+    totalItems: number;
+};
 type BackendCollection = {
-    list(options?: {
+    listPage(options: {
         filter?: string;
         sort?: string;
         expand?: string;
-        batch?: number;
-    }): Promise<Array<Record<string, unknown>>>;
+        page: number;
+        perPage: number;
+    }): Promise<CollectionPage<Record<string, unknown>>>;
     get(id: string): Promise<Record<string, unknown>>;
     create(data: Record<string, unknown>): Promise<Record<string, unknown>>;
     update(id: string, data: Record<string, unknown>): Promise<Record<string, unknown>>;
@@ -108,6 +127,8 @@ type BackendClient = {
     request<T = unknown>(path: string, options?: {
         method?: string;
         body?: unknown;
+        rawBody?: BodyInit;
+        headers?: HeadersInit;
     }): Promise<T>;
 };
 export declare function resetAuroraClientForTests(): void;
@@ -116,25 +137,130 @@ export declare function getAuroraClient(): BackendClient;
  * Authenticate and verify workspace membership.
  * Exits the process if the user is not a member of the target workspace.
  */
+export type AuthenticateOptions = {
+    token?: string;
+    workspaceId?: string;
+};
+export declare function listGrantedWorkspaces(): Promise<GrantedWorkspace[]>;
 export declare function authenticate(): Promise<void>;
+export declare function authenticate(options: AuthenticateOptions): Promise<AuroraConnectionContext>;
 export declare function listObjects(workspaceId: string, type?: string): Promise<AuroraObjectRecord[]>;
+export declare function listObjectsPage(workspaceId: string, type: string | undefined, page: number, perPage: number, options?: {
+    excludeTemplates?: boolean;
+}): Promise<CollectionPage<AuroraObjectRecord>>;
+export declare function searchObjectsPage(workspaceId: string, query: string, limit: number): Promise<WorkspaceKnowledgeSource[]>;
 export declare function getObject(id: string, workspaceId: string): Promise<AuroraObjectRecord | null>;
-export declare function createObject(workspaceId: string, type: string, title: string): Promise<AuroraObjectRecord>;
+export declare function createObject(workspaceId: string, type: string, title: string, options?: {
+    id?: string;
+    icon?: string | null;
+    parentId?: string | null;
+    isTemplate?: boolean;
+}): Promise<AuroraObjectRecord>;
+export declare function createAuroraObjectStable(workspaceId: string, input: {
+    id: string;
+    type: string;
+    title: string;
+    icon?: string | null;
+    parentId?: string | null;
+    isTemplate?: boolean;
+}): Promise<AuroraObjectRecord>;
+export declare function listAuroraObjectTypes(workspaceId: string): Promise<ObjectTypeDef[]>;
+export declare function createAuroraObjectType(workspaceId: string, input: {
+    id: string;
+    name: string;
+    icon: string | null;
+    color: string | null;
+    schema: ObjectTypeSchema[];
+}): Promise<ObjectTypeDef>;
+export declare function updateAuroraObjectType(workspaceId: string, id: string, changes: {
+    name?: string;
+    icon?: string | null;
+    color?: string | null;
+    schema?: ObjectTypeSchema[];
+}): Promise<ObjectTypeDef>;
+export declare function listAuroraTemplates(workspaceId: string, type?: string): Promise<AuroraObjectRecord[]>;
+export declare function listAuroraTemplatesPage(workspaceId: string, type?: string): Promise<CollectionPage<AuroraObjectRecord>>;
+export declare function upsertAuroraPropertyStable(objectId: string, workspaceId: string, key: string, valueType: PropertyValueType, value: string | number | boolean | null): Promise<void>;
+export declare function createAuroraTemplate(input: AuroraTemplateInput): Promise<AuroraObjectRecord>;
+export declare function createAuroraObjectFromTemplate(workspaceId: string, templateId: string, objectId?: string): Promise<string>;
+export declare function setAuroraContentStable(workspaceId: string, objectId: string, content: Record<string, unknown>): Promise<void>;
+export type AuroraImportCapabilities = {
+    workspaceId: string;
+    role: string;
+    scopes: string[];
+    e2ee: {
+        enabled: boolean;
+        importBlocked: boolean;
+        reason: string | null;
+    };
+    upload: {
+        maxBytes: number;
+        mimePolicy: unknown;
+        limitBytes: number;
+        usedBytes: number;
+        remainingBytes: number;
+    };
+    storage: {
+        available: boolean;
+        backend: string;
+    };
+};
+export declare function getAuroraImportCapabilities(workspaceId: string): Promise<AuroraImportCapabilities>;
+export type AuroraAttachmentUpload = {
+    id: string;
+    workspaceId: string;
+    objectId: string;
+    fileName: string;
+    mimeType: string;
+    sizeBytes: number;
+    url: string;
+};
+export declare function uploadAuroraMcpAttachment(input: {
+    workspaceId: string;
+    objectId: string;
+    fileName: string;
+    mimeType: string;
+    bytes: Buffer;
+    idempotencyKey: string;
+}): Promise<AuroraAttachmentUpload>;
 export declare function updateObjectTitle(id: string, title: string, workspaceId: string): Promise<void>;
 export declare function deleteObject(id: string, workspaceId: string): Promise<void>;
-export declare function getContent(objectId: string, workspaceId: string): Promise<string | null>;
+export declare function restoreObject(id: string, workspaceId: string): Promise<boolean>;
+/** Sentinel returned by getContent when content is E2EE-encrypted. */
+export declare const E2EE_LOCKED_SENTINEL = "<<E2EE_LOCKED>>";
+/**
+ * Read an object's content as plain text.
+ *
+ * Returns distinct availability states:
+ *   - `not_found` — the object does not exist in this workspace
+ *   - `empty` — the object exists but has no content record or empty content
+ *   - `encrypted_locked` — content is end-to-end encrypted (cannot be read)
+ *   - `permission_denied` — the token lacks `read:content` scope
+ *   - `available` — content was read successfully
+ */
+export declare function getContent(objectId: string, workspaceId: string): Promise<ContentReadResult>;
 export declare function getContentJson(objectId: string, workspaceId: string): Promise<Record<string, unknown> | null>;
 export declare function searchWorkspaceKnowledgeServer(workspaceId: string, query: string, limit?: number): Promise<WorkspaceKnowledgeSource[]>;
 export declare function getWorkspaceKnowledgeObjectServer(workspaceId: string, objectId: string, includeFullText?: boolean): Promise<WorkspaceKnowledgeSource | null>;
 export declare function listWorkspaceRelatedKnowledgeServer(workspaceId: string, objectId: string, limit?: number): Promise<WorkspaceKnowledgeSource[]>;
 export declare function listWorkspaceRecentKnowledgeServer(workspaceId: string, limit?: number): Promise<WorkspaceKnowledgeSource[]>;
 export declare function setContent(objectId: string, workspaceId: string, contentJson: Record<string, unknown>): Promise<void>;
+/**
+ * Check whether an object's content is E2EE-encrypted, without fetching the
+ * full content payload. Returns `null` if the object or its content record
+ * is missing. Used to pre-check before mixed write operations (e.g. updating
+ * both title and content) so the operation fails atomically instead of
+ * leaving a half-applied update.
+ */
+export declare function getObjectE2eeStatus(objectId: string, workspaceId: string): Promise<boolean | null>;
 export declare function appendContentText(objectId: string, workspaceId: string, text: string): Promise<void>;
-export declare function listProperties(objectIds: string[], workspaceId: string): Promise<AuroraPropertyRecord[]>;
+export declare function listProperties(objectIds: string[], workspaceId: string, options?: {
+    maxPages?: number;
+}): Promise<AuroraPropertyRecord[]>;
 export declare function upsertProperty(objectId: string, workspaceId: string, key: string, valueType: string, value: string): Promise<void>;
 export declare function listMembers(workspaceId: string): Promise<AuroraWorkspaceMember[]>;
 export declare function listTaskLists(workspaceId: string): Promise<AuroraTaskList[]>;
-export declare function listTaskStatuses(_workspaceId: string): Promise<string[]>;
+export declare function listTaskStatuses(): Promise<string[]>;
 export type AuroraTaskProps = {
     status: string | null;
     priority: string | null;
@@ -145,12 +271,16 @@ export type AuroraTaskProps = {
     task_list_id: string | null;
 };
 export declare function getTaskProps(objectId: string, workspaceId: string): Promise<AuroraTaskProps>;
-export declare function updateTaskProps(objectId: string, workspaceId: string, patch: Partial<AuroraTaskProps>): Promise<void>;
+export declare function updateTaskProps(objectId: string, workspaceId: string, patch: Partial<AuroraTaskProps>, options?: {
+    existingObject?: AuroraObjectRecord;
+}): Promise<void>;
 export type AuroraPlanningTask = AuroraTaskProps & {
     id: string;
     title: string | null;
     updated_at: string | null;
 };
+/** Maximum number of tasks listPlanningTasks will fetch + hydrate. */
+export declare const PLANNING_TASKS_MAX = 500;
 export declare function listPlanningTasks(workspaceId: string): Promise<AuroraPlanningTask[]>;
 export declare function readCanvasContent(workspaceId: string, objectId: string): Promise<{
     object: AuroraObjectRecord;