@pulsarinteractive/geniusfitness 0.1.0-beta.1

package/CHANGELOG.md

@@ -0,0 +1,9 @@
+# Changelog
+
+## Unreleased
+
+- Browser PKCE and device login using the GeniusFitness account and explicit consent.
+- Bounded programs, exercise catalogue, planning, results and private health reads.
+- Journaled program, workout, exercise, schedule, goal and activity commands.
+- Current Coach subscription and athlete-access boundaries.
+- Conditional read cache, incremental changes, narrowed profiles and workflow skills.

package/CONTRIBUTING.md

@@ -0,0 +1,72 @@
+# Contributing
+
+Thanks for helping improve GeniusFitness's agent integrations. This repository
+contains the CLI, local MCP server, skills and integration documentation.
+
+## Development setup
+
+Use Node.js 22.13 or newer and npm:
+
+```sh
+npm ci
+npm run verify
+```
+
+Local tests need no GeniusFitness account. They use temporary files, synthetic
+identities, loopback servers and the official MCP client SDK.
+
+## Code conventions
+
+- Use ECMAScript modules and explicit `node:` imports for Node built-ins.
+- Format with `npm run format`; ESLint enforces recommended checks, strict
+  equality, unused-variable detection and braces on control statements.
+- Choose names that explain the operation. Keep parsing, authentication, HTTP
+  transport, persistence and MCP presentation in their respective modules.
+- Document exported entry points and invariants. Explain why a failure needs
+  special treatment; comments should not repeat the next line of code.
+- Inject clocks, network calls and cancellation signals where behavior needs
+  deterministic tests. Avoid new global state, background daemons or polling.
+- Prefer a focused helper when it clarifies responsibility. Avoid abstraction
+  that hides credential ownership, lock lifetime or retry decisions.
+
+The [architecture guide](docs/ARCHITECTURE.md) describes module responsibilities
+and the authentication, write and change-feed lifecycles.
+
+## Behavioral compatibility
+
+CLI JSON output, exit codes, MCP tool names and command envelopes are public
+interfaces. Changes must preserve existing callers or be documented as a breaking
+change. Keep stdout reserved for protocol output; diagnostics belong on stderr.
+
+Validate input at the boundary. Surface errors through `AgentError` with a stable
+code and useful remediation. Never relay raw provider exceptions or credentials.
+A command must preserve origin, account, profile and operation identity. An
+uncertain write may only retry its saved immutable request; a revision conflict
+requires rereading the resource. Access and quotas remain server-enforced.
+
+`src/command-catalog.mjs` is a generated interface snapshot. Submit contract
+updates with their generation provenance and review the client-facing diff;
+do not hand-edit generated schemas. Third-party schemas also remain unchanged.
+
+## Tests and documentation
+
+Add regression coverage for observable changes, including relevant failures and
+cancellation. Use synthetic data; live account exports do not belong in fixtures.
+Read [Testing](docs/TESTING.md) for the suite boundaries and focused commands.
+
+Update command help, examples, skills and relevant guides when behavior changes.
+Examples must run against documented capabilities, with placeholders for resource
+IDs and without access tokens. Keep program permissions, Coach access and personal health consent independent.
+
+## Pull requests
+
+Describe the user-visible problem, the behavior after the change and the checks
+performed. Keep unrelated changes separate. Run `npm run verify` and review the
+archive inventory before proposing distribution changes. Security reports belong
+in the repository's private reporting channel, as described in [Security](SECURITY.md).
+
+## Licensing
+
+Contributions to the client, skills and documentation are accepted under the
+[MIT license](LICENSE). Third-party material retains its original license and
+must have clear provenance and notices. See [Third-party notices](THIRD_PARTY_NOTICES.md).

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Pulsar Interactive
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/LICENSES/Apache-2.0.txt

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,57 @@
+# GeniusFitness CLI & MCP
+
+Manage your training plans, exercises and progress with your own AI tools.
+GeniusFitness keeps your programs and permissions in one place; your agent uses
+its own model and credentials.
+
+## Install and connect
+
+Requires Node.js 22.13 or newer.
+
+```bash
+npm install --global @pulsarinteractive/geniusfitness@beta
+geniusfitness auth login
+geniusfitness whoami --json
+geniusfitness programs list --json
+```
+
+Login opens your browser. Sign in to GeniusFitness, select programs and
+permissions, then approve. There is no token to copy into your terminal.
+
+## What you can do
+
+| Feature                            | CLI                                   | MCP                                 |
+| ---------------------------------- | ------------------------------------- | ----------------------------------- |
+| Find your programs                 | `programs list`                       | `fitness_programs`                  |
+| Search exercises                   | `catalog search --query squat`        | `fitness_catalog`                   |
+| Read workouts, planning or results | `resources list`                      | `fitness_resources`                 |
+| Summarize activity                 | `metrics summary`                     | `fitness_metrics`                   |
+| Create or edit a plan              | `commands prepare` / `commands retry` | Journaled command tools             |
+| Follow changes                     | `changes list` / `changes watch`      | `fitness_changes` / `fitness_watch` |
+
+Choose from the exercise catalogue before creating a custom exercise. Private
+health measurements require separate permission. Managing another athlete’s
+shared program also requires a Coach subscription and that athlete’s access grant.
+
+## Connect your agent
+
+Authenticate once with the CLI, then configure your MCP client to run:
+
+```bash
+geniusfitness mcp --context default
+```
+
+[Setup examples](https://github.com/PulsarInteractive/geniusfitness-agent-tools/blob/main/docs/INTEGRATIONS.md)
+· [Training workflow](https://github.com/PulsarInteractive/geniusfitness-agent-tools/blob/main/docs/TRAINING.md)
+· [Permissions and limits](https://github.com/PulsarInteractive/geniusfitness-agent-tools/blob/main/docs/LIMITS.md)
+· [Agent skills](https://github.com/PulsarInteractive/geniusfitness-agent-tools/tree/main/skills)
+
+## Documentation
+
+- [CLI reference](https://github.com/PulsarInteractive/geniusfitness-agent-tools/blob/main/docs/CLI.md)
+- [Authentication and account safety](https://github.com/PulsarInteractive/geniusfitness-agent-tools/blob/main/docs/AUTHENTICATION.md)
+- [Contributing](https://github.com/PulsarInteractive/geniusfitness-agent-tools/blob/main/CONTRIBUTING.md)
+- [Security reports](https://github.com/PulsarInteractive/geniusfitness-agent-tools/blob/main/SECURITY.md)
+
+MIT © Pulsar Interactive. This repository contains the public agent client and
+skills; the GeniusFitness application and service implementation are separate.

package/SECURITY.md

@@ -0,0 +1,14 @@
+# Security
+
+Report suspected vulnerabilities privately through GitHub's security advisory
+reporting for this repository. Do not put tokens, private project content or
+account exports in public issues. For ordinary bugs, use synthetic reproduction
+steps and redact identifiers that are not needed.
+
+The client uses the official service, explicit browser consent, bounded grants
+and private credential files. Revocation is separate from uninstalling npm or a
+plugin. The beta uses development admission; package installation grants nothing.
+
+Public changes are checked against a file allowlist and credential/private-path
+patterns, then reviewed before publishing. Automated scans supplement review;
+they cannot guarantee that arbitrary new content is safe to disclose.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,15 @@
+# Third-party notices
+
+## Agent Plugins JSON schemas
+
+`tools/schemas/plugin.schema.json` and `tools/schemas/mcp.schema.json` are
+unmodified Agent Plugins 1.0.0 JSON schemas, used for development validation.
+
+- Project: [Agent Plugins specification](https://github.com/agentplugins/agent-plugins-spec)
+- Source: [version 1.0.0 schemas](https://github.com/agentplugins/agent-plugins-spec/tree/main/schemas/1.0.0)
+- License: Apache-2.0, as stated in the [upstream licensing notice](https://github.com/agentplugins/agent-plugins-spec/blob/main/LICENSE.md)
+- Full license: [LICENSES/Apache-2.0.txt](LICENSES/Apache-2.0.txt)
+
+These schemas retain their original license. The MIT license for GeniusFitness's
+client does not replace their terms. npm dependencies retain the licenses
+included in their respective packages.

package/bin/geniusfitness.mjs

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+import { main } from '../src/cli.mjs';
+const cancellation = new AbortController();
+process.once('SIGINT', () => cancellation.abort());
+process.once('SIGTERM', () => cancellation.abort());
+process.exitCode = await main(process.argv.slice(2), { signal: cancellation.signal });

package/docs/AUTHENTICATION.md

@@ -0,0 +1,40 @@
+# Authentication
+
+`geniusfitness auth login` opens the GeniusFitness consent page in your browser.
+Sign in using the same Firebase-backed account as the app, select accessible
+programs and permissions, then approve. The browser returns a single-use code to
+a loopback listener; PKCE binds it to the terminal that started the request.
+
+The terminal stores the resulting delegated session in a private context. It
+never receives your password. Your account and program permissions remain the
+ceiling on all agent activity.
+
+Use `--browser chrome` to select Chrome, or `--no-browser` to print the consent
+link. For a remote shell without a loopback callback, use `--flow device` and
+approve its short-lived request in your browser. Neither flow grants access
+merely by opening the page.
+
+## Health and Coach permissions
+
+Health measurements are never preselected. Read access to programs does not
+include personal health data. Coach writes need separate `coaching:write` consent,
+a current Coach subscription and the normal permissions on the shared program.
+A downgrade or revoked membership is checked on later operations, including a
+prepared write that has not committed yet.
+
+## Renewal and revocation
+
+Refresh tokens rotate. An uncertain refresh response requires reconnecting;
+replaying an old refresh token can revoke its session family. Logging out
+revokes the presented terminal session before erasing the local credential.
+Revoking a connection invalidates its profiles and sessions.
+
+Use a different `--context` for another account. Never copy credential files into
+a repository or share them with a collaborator. An agent’s command journal may
+contain personal training details; treat it as private local data as well.
+
+## Errors
+
+Expired or already-consumed consent links require a new `auth login`. Broader
+permissions require a new human decision; a tool cannot grant them to itself.
+After a network error, inspect the operation before trying a write with a new ID.

package/docs/CLI.md

@@ -0,0 +1,50 @@
+# CLI reference
+
+`geniusfitness help --json` lists commands and options. `--json` emits one
+versioned result on stdout; progress and errors use stderr. MCP reserves stdout
+for protocol messages.
+
+| Command                                | Purpose                                                          |
+| -------------------------------------- | ---------------------------------------------------------------- |
+| `auth login`                           | Browser consent with PKCE; `--flow device` for a remote terminal |
+| `auth status`, `whoami`                | Current identity, profile and permission ceiling                 |
+| `auth logout`                          | Revoke the terminal session, then erase local credentials        |
+| `capabilities`                         | Server collections, commands and current limits                  |
+| `programs list`                        | Bounded list of accessible programs                              |
+| `catalog search`                       | Find catalogue exercises by query, key, equipment or muscle      |
+| `resources list`                       | One collection or exact record                                   |
+| `metrics summary`                      | Daily program totals within a date range                         |
+| `changes list`, `changes watch`        | Bounded incremental follow-up                                    |
+| `commands describe`                    | Local command catalogue and envelope schemas                     |
+| `commands prepare`                     | Persist a draft with one immutable operation ID                  |
+| `commands execute`                     | Send a complete journaled operation once                         |
+| `commands retry`                       | Replay the exact saved operation                                 |
+| `commands inspect`                     | Inspect local operation evidence without a server call           |
+| `profiles list/create/restrict/select` | Manage narrower profiles                                         |
+| `doctor`                               | Inspect local setup without revealing credentials                |
+| `mcp`                                  | Run the local MCP server                                         |
+
+```bash
+geniusfitness resources list --scope project:PROGRAM_ID --collection workouts --json
+geniusfitness catalog search --query squat --json
+geniusfitness metrics summary --scope project:PROGRAM_ID --from 2026-09-01 --until 2026-09-30 --json
+geniusfitness commands prepare --file workout-draft.json --json
+geniusfitness commands retry --operation OPERATION_ID --json
+```
+
+`--context` separates accounts or sessions. The initial beta defaults to the
+development environment; access requires an admitted GeniusFitness account.
+Choose `--environment production` explicitly for that environment. Environments
+never share credentials. Arbitrary public API origins are refused; loopback
+origins are available only with an explicit local-testing option.
+
+| Exit code | Meaning                           |
+| --------- | --------------------------------- |
+| 0         | Success                           |
+| 1         | Other failure                     |
+| 2         | Invalid command or input          |
+| 3         | Authentication required           |
+| 4         | Permission denied                 |
+| 5         | Conflict requiring reconciliation |
+| 6         | Rate or usage limit               |
+| 7         | Transient failure                 |

package/docs/INTEGRATIONS.md

@@ -0,0 +1,50 @@
+# Agent integrations
+
+First authenticate with the CLI in a terminal:
+
+```bash
+geniusfitness auth login --context training
+```
+
+The MCP process uses that context and never starts an interactive login itself.
+No token belongs in an MCP configuration, command line or shared project file.
+
+## MCP clients
+
+Install the CLI globally, then use:
+
+```json
+{
+  "mcpServers": {
+    "geniusfitness": {
+      "command": "geniusfitness",
+      "args": ["mcp", "--context", "training"]
+    }
+  }
+}
+```
+
+Version-pinned `npx` examples are in `examples/`. Use the same context and
+environment for login and MCP. Different accounts need different contexts.
+
+## Skills
+
+The `skills/` directory contains portable workflow instructions:
+
+| Skill                    | Purpose                                                                 |
+| ------------------------ | ----------------------------------------------------------------------- |
+| `geniusfitness`          | Find programs, reuse catalogue exercises and maintain training plans    |
+| `geniusfitness-coaching` | Work on an athlete’s shared program with current Coach rights           |
+| `geniusfitness-progress` | Read reliable progress and manage authorized activity or health records |
+
+Install them through your agent client’s supported skill mechanism. The plugin
+manifest combines the skills with a local stdio MCP configuration. It does not
+claim approval in a hosted integration directory or provide a remote MCP URL.
+
+## Independent sessions
+
+Profiles can narrow the access available to a connection. Selecting a narrower
+profile rotates credentials and cannot regain broader access. Use separate named
+contexts for independently authorized terminals. Saved operations belong to the
+account, connection and profile that prepared them; another profile cannot adopt
+their pending writes.

package/docs/LIMITS.md

@@ -0,0 +1,56 @@
+# Permissions and limits
+
+The connection grant, selected profile, current subscription and ordinary
+program permissions all apply. Narrowing a grant takes effect on subsequent
+requests; retaining a cached record does not preserve revoked rights.
+
+## API limits
+
+These are the initial configurable limits. Read `whoami` or `capabilities` for
+the active server values. Every terminal and profile on one account shares them.
+
+| Limit                     |  Free |           Premium |             Coach |
+| ------------------------- | ----: | ----------------: | ----------------: |
+| Requests per minute       |    30 |                60 |               180 |
+| Write requests per minute |     5 |                10 |                30 |
+| Monthly request credits   | 5,000 | No monthly cutoff | No monthly cutoff |
+| Monthly write requests    |   500 | No monthly cutoff | No monthly cutoff |
+
+A read uses one Free credit; a write uses five and also counts toward the write
+limit. Paid accounts remain bounded by their minute limits. Respect `Retry-After`
+and retain the same operation when a write’s outcome is uncertain. Do not open
+extra contexts to work around a limit.
+
+## Data capacity
+
+| Personal data                     |   Free | Premium |   Coach |
+| --------------------------------- | -----: | ------: | ------: |
+| Custom or imported exercises      |    200 |   5,000 |  20,000 |
+| Health measurements               |  2,000 |  20,000 | 100,000 |
+| Combined live personal-data bytes | 10 MiB |  50 MiB | 100 MiB |
+
+These limits apply to both app and agent writes. They are separate from shared
+program and media allowances. After a downgrade, existing data remains readable;
+you can delete data or reduce its size. Growth beyond the current capacity is
+refused. Business-plan values can change before launch.
+
+## Permission groups
+
+| Permission                           | Data or action                                               |
+| ------------------------------------ | ------------------------------------------------------------ |
+| `programs:read` / `programs:write`   | Programs, workout templates, exercise slots and instructions |
+| `exercises:read` / `exercises:write` | Catalogue metadata and the account’s exercise library        |
+| `planning:read` / `planning:write`   | Planning entries, recurring schedules and goals              |
+| `metrics:read` / `metrics:write`     | Completed workouts, runs and progress summaries              |
+| `health:read` / `health:write`       | The account’s private health measurements                    |
+| `coaching:write`                     | Additional approval for writes concerning another athlete    |
+
+Health permissions and all writes require deliberate selection on the consent
+page. Coach permission requires an active Coach subscription when used and never
+replaces program membership or grants another person’s private health data.
+
+## Bounded reads
+
+Resource and catalogue pages contain at most 25 items. Read one selected program
+at a time. Metrics summaries cover at most 366 inclusive UTC days. A filtered
+empty page with a continuation is not the end of the list.

package/docs/RELEASING.md

@@ -0,0 +1,23 @@
+# Releasing the agent tools
+
+Releases contain the standalone client, public command metadata, skills and
+user guides. Server and application implementations are not part of this package.
+
+1. Update the version in `package.json`, its lockfile, MCP server identification,
+   plugin manifests and pinned installation examples. Record user-facing changes
+   in `CHANGELOG.md`.
+2. Run `npm ci` and `npm run verify`. CI repeats the verification on Linux and
+   macOS. Review the package file list, license, public links and dependency audit.
+3. Test browser login, one authorized read and one reversible command against
+   the intended environment using a dedicated test account. Check revocation and
+   confirm the deployed service supports the published command metadata.
+4. Create a matching Git tag only for the reviewed commit. Publish the inspected
+   package with `npm publish --access public --tag beta` while it is a prerelease.
+   Publication may require the maintainer's npm authentication.
+5. Check the registry version, MIT license, repository URL and distribution tags.
+   Install the registry artifact in a fresh directory and verify `--help`, MCP
+   startup and the included skills. Do not assume an upload updated every tag.
+
+Keep experimental client changes unpublished until their server capabilities are
+available. A public source commit, an npm release and a service rollout are
+separate events and should be reported separately.