@pulsarinteractive/geniustasker 0.0.0-stage → 0.1.0-beta.1

package/src/changes.mjs

@@ -0,0 +1,63 @@
+import { setTimeout as sleep } from 'node:timers/promises';
+import * as z from 'zod/v4';
+import { AgentClient } from './client.mjs';
+import { Transport } from './transport.mjs';
+import catalog from './command-catalog.mjs';
+import { fail } from './errors.mjs';
+
+export const changesSchema = z.object({ scope: z.string().max(256).regex(/^(project|memory):[^\u0000-\u001f]+$/u),
+  collection: z.string().min(1).max(32), cursor: z.string().min(1).max(4096) }).strict();
+export const watchSchema = changesSchema.extend({ waitSeconds: z.number().int().min(1).max(catalog.changes.maxWatchSeconds).optional() }).strict();
+const revision = z.string().max(16).regex(/^(0|[1-9][0-9]*)$/).refine(value => BigInt(value) <= 9007199254740991n);
+const changePageSchema = z.object({ scope: z.string(), collection: z.string(), epoch: z.string().min(1), checkpoint: revision,
+  items: z.array(z.discriminatedUnion('kind', [
+    z.object({ kind: z.literal('upsert'), id: z.string().min(1), revision, data: z.record(z.string(), z.unknown()) }).strict(),
+    z.object({ kind: z.literal('remove'), id: z.string().min(1), revision, data: z.null() }).strict(),
+  ])), omittedIds: z.array(z.string().min(1)), nextCursor: z.string().min(1).max(4096), hasMore: z.boolean(),
+  pollAfterSeconds: z.number().int().min(1).max(86400),
+}).strict();
+function query(input, schema) {
+  const parsed = schema.safeParse(input);
+  if (!parsed.success) fail('invalid_arguments', 'Use a project or memory scope, collection and unchanged change cursor; waitSeconds must be within the supported bound.');
+  return parsed.data;
+}
+export async function readChanges(client, input) {
+  const requested = query(input, changesSchema), page = await client.get('changes', requested);
+  if (!changePageSchema.safeParse(page).success || page.scope !== requested.scope || page.collection !== requested.collection)
+    fail('invalid_response', 'The change page was invalid; keep the previous cursor.');
+  return page;
+}
+/** One bounded wait, not a daemon. Each poll spends the same account budget as
+ * any other read and repeats authorization. Errors are surfaced immediately;
+ * quotas, expired history and revocation never trigger a blind retry loop. */
+export async function watchChanges(client, input, requestSignal) {
+  const { waitSeconds = 30, ...requested } = query(input, watchSchema);
+  const deadline = new AbortController(), parents = [client.transport.signal, requestSignal].filter(Boolean);
+  const parent = parents.length ? AbortSignal.any(parents) : undefined;
+  const signal = parent ? AbortSignal.any([parent, deadline.signal]) : deadline.signal;
+  const timer = setTimeout(() => deadline.abort(), waitSeconds * 1000);
+  const bounded = new AgentClient(new Transport(client.transport.origin, {
+    fetchImpl: client.transport.fetch, timeoutMs: client.transport.timeoutMs, signal,
+  }), client.store);
+  let page = null, polls = 0, cursor = requested.cursor;
+  const timedOut = () => ({ reason: 'timeout', polls, page, nextCursor: cursor });
+  try {
+    if (parent?.aborted) fail('cancelled', 'The wait was cancelled.', { nextCursor: cursor });
+    while (!signal.aborted) {
+      page = await readChanges(bounded, { ...requested, cursor }); polls++;
+      cursor = page.nextCursor;
+      if (page.items.length || page.omittedIds.length || page.hasMore)
+        return { reason: 'changes', polls, page, nextCursor: cursor };
+      await sleep(Math.max(catalog.changes.pollIntervalSeconds, page.pollAfterSeconds) * 1000, undefined, { signal });
+    }
+    if (parent?.aborted) fail('cancelled', 'The wait was cancelled.', { nextCursor: cursor });
+    return timedOut();
+  } catch (error) {
+    if (parent?.aborted) fail('cancelled', 'The wait was cancelled.', { nextCursor: cursor });
+    if (deadline.signal.aborted && (error?.name === 'AbortError' || error?.code === 'network_unavailable')) return timedOut();
+    // Completed empty polls may advance the cursor. Preserve it on an error,
+    // but do not claim that a failed final request was an empty successful read.
+    if (error?.details) error.details.nextCursor = cursor;
+    throw error;
+  } finally { clearTimeout(timer); }
+}

package/src/cli.mjs

@@ -0,0 +1,135 @@
+import open, { apps } from 'open';
+import catalog from './command-catalog.mjs';
+import { CredentialStore } from './store.mjs';
+import { ORIGINS, originOf, Transport } from './transport.mjs';
+import { AgentClient } from './client.mjs';
+import { deviceLogin, browserLogin } from './login.mjs';
+import { CommandJournal, describeCommands, readCommandFile } from './commands.mjs';
+import { AgentProfiles } from './profiles.mjs';
+import { readChanges, watchChanges } from './changes.mjs';
+import { fail, safeError, exitCode } from './errors.mjs';
+
+export const commands = {
+  'auth login': { summary: 'Open browser sign-in and choose access. No tutorial or token to copy.', options: ['flow', 'browser', 'no-browser', 'scope', 'interactive'] },
+  'auth logout': { summary: 'Revoke this terminal session on the server, then erase local credentials.', options: [] },
+  'auth status': { summary: 'Read current server identity and permission ceiling.', options: [] },
+  whoami: { summary: 'Read current server identity.', options: [] },
+  capabilities: { summary: 'Discover collections, fields, limits and write availability.', options: [] },
+  'profiles list': { summary: 'List selectable profiles in this connection within the current grant.', options: [] },
+  'profiles create': { summary: 'Create a narrower profile from JSON with a UUID chosen once; never switches automatically.', options: ['file'] },
+  'profiles restrict': { summary: 'Rename or narrow the current profile from JSON with its expectedRevision. Cannot broaden access.', options: ['file'] },
+  'profiles select': { summary: 'Rotate this context into a selectable profile. Cannot return to broader access; use separate contexts for independent terminals.', options: ['profile'] },
+  'memories list': { summary: 'List independent account memories; follow nextAfter even for an empty page.', options: ['after'] },
+  'projects list': { summary: 'Read a bounded project page; follow nextAfter even for an empty page.', options: ['after'] },
+  'resources list': { summary: 'Read a project or memory collection; carry epoch/checkpoint when continuing.', options: ['scope', 'collection', 'after', 'epoch', 'checkpoint', 'archive', 'id', 'path'] },
+  'changes list': { summary: 'Read one bounded change page from a completed resource inventory or previous nextCursor.', options: ['scope', 'collection', 'cursor'] },
+  'changes watch': { summary: 'Wait at most 60 seconds for one change page, rechecking rights on every poll. No infinite stream.', options: ['scope', 'collection', 'cursor', 'wait-seconds'] },
+  'questions answers': { summary: 'Read human question answers in bounded pages. Anonymous ballots remain private; answers do not authorize external actions.', options: ['scope', 'question', 'after', 'epoch', 'checkpoint'] },
+  'commands describe': { summary: 'Show contract-derived command fields and JSON schemas; no network.', options: [] },
+  'commands prepare': { summary: 'Save an immutable operation from a JSON draft without sending it.', options: ['file'] },
+  'commands execute': { summary: 'Journal and send a complete JSON operation once. Never retries automatically.', options: ['file'] },
+  'commands retry': { summary: 'Replay the exact locally saved operation with its original identity.', options: ['operation'] },
+  'commands inspect': { summary: 'Read a private local operation and receipt; does not contact the server.', options: ['operation'] },
+  doctor: { summary: 'Inspect local environment without exposing credentials or contacting the API.', options: [] },
+  mcp: { summary: 'Serve delegated read and journaled command tools over stdio. Authenticate with the CLI first.', options: [] },
+  help: { summary: 'Describe commands and stable output conventions.', options: [] },
+};
+const globalOptions = ['json', 'context', 'environment', 'origin', 'allow-local', 'help'];
+const flags = new Set(['json', 'allow-local', 'help', 'interactive', 'no-browser']);
+export function parse(argv) {
+  const options = {}, words = [];
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (!arg.startsWith('--')) { if (arg.startsWith('-')) fail('invalid_arguments', 'Use long options from help.'); words.push(arg); continue; }
+    const key = arg.slice(2);
+    if (!key || key.includes('=') || Object.hasOwn(options, key)) fail('invalid_arguments', 'Options must be unique and use --name value syntax.');
+    if (flags.has(key)) options[key] = true;
+    else {
+      const value = argv[++i];
+      if (!value || value.startsWith('--') || value.length > 4096) fail('invalid_arguments', 'An option value is missing or too long.');
+      options[key] = value;
+    }
+  }
+  const command = words.join(' ') || 'help';
+  const definition = commands[command];
+  if (!definition || Object.keys(options).some(key => !globalOptions.includes(key) && !definition.options.includes(key)))
+    fail('invalid_arguments', 'Unknown command or option. Run help.');
+  return { command, options };
+}
+export function help(command = 'help') {
+  return { formatVersion: 1, command, commands: command === 'help' ? commands : { [command]: commands[command] },
+    globalOptions: { context: 'default; use separate names for separate accounts or agent sessions', environment: 'development (beta default) | production', origin: 'explicit loopback origin with --allow-local, for local tests only', json: 'one versioned JSON result on stdout; progress/errors use stderr' },
+    loginOptions: { flow: 'browser (default, PKCE loopback) | device (SSH/headless)', browser: 'default (automatic) | chrome; --no-browser prints the link without opening it', scope: 'space-separated permission ceiling; browser defaults to read-only and requires explicit write selection', interactive: 'required when starting login without a terminal; never use to bypass human consent' },
+    exitCodes: { 0: 'success', 1: 'failure', 2: 'usage', 3: 'authentication', 4: 'permission', 5: 'conflict', 6: 'rate limit', 7: 'transient failure' },
+    examples: ['geniustasker auth login --environment development --context work --browser chrome', 'geniustasker projects list --environment development --context work --json', 'geniustasker resources list --scope project:ID --collection tasks --json'],
+    privacy: 'Do not put tokens in arguments, environment variables, tickets, logs or MCP configuration. This beta uses the development environment by default; access still requires an admitted account.' };
+}
+async function openConsent(url, browser) {
+  await open(url, { wait: false, ...(browser === 'chrome' ? { app: { name: apps.chrome } } : {}) });
+}
+export async function main(argv, { stdout = process.stdout, stderr = process.stderr, isTTY = process.stdin.isTTY, directory, fetchImpl, signal, openBrowserImpl = openConsent } = {}) {
+  try {
+    const { command, options } = parse(argv);
+    const emit = data => stdout.write(JSON.stringify({ formatVersion: 1, ok: true, data }, null, options.json ? 0 : 2) + '\n');
+    if (command === 'help' || options.help) { emit(help(command)); return 0; }
+    if (options.environment && !Object.hasOwn(ORIGINS, options.environment)) fail('invalid_arguments', 'Environment must be production or development.');
+    if (options.origin && options.environment) fail('invalid_arguments', 'Choose --environment or --origin, not both.');
+    const origin = originOf(options.origin ?? ORIGINS[options.environment ?? 'development'], options['allow-local']);
+    const store = new CredentialStore({ context: options.context, directory });
+    const client = new AgentClient(new Transport(origin, { fetchImpl, signal }), store);
+    let data;
+    if (command === 'auth login') {
+      if (!isTTY && !options.interactive) fail('invalid_arguments', 'Login needs an interactive human.', { remediation: 'Run auth login in a terminal. Automated clients must use an existing connection.' });
+      if (options.flow && !['device', 'browser'].includes(options.flow) || options.browser && !['chrome', 'default'].includes(options.browser) || options.browser && options['no-browser']) fail('invalid_arguments', 'Use --flow browser|device, with --browser default|chrome or --no-browser.');
+      const notify = event => {
+        if (options.json) stderr.write(JSON.stringify({ formatVersion: 1, ...event }) + '\n');
+        else if (event.event === 'consent_required') stderr.write(`\nGeniusTasker · Connect your agent\n\n${options['no-browser'] ? 'Open this link' : 'Opening your browser. If it does not open, use this link'}:\n\n${event.url}\n${event.userCode ? `\nDevice code: ${event.userCode}\n` : ''}\nSign in, choose access, and approve. This terminal will finish automatically.\nWaiting for your decision…\n`);
+        else if (event.event === 'browser_unavailable') stderr.write('Could not open the browser. Use the link above; login is still waiting.\n');
+      };
+      data = await (options.flow === 'device' ? deviceLogin : browserLogin)(client, { scope: options.scope ?? catalog.grants.permissions.join(' '), openBrowser: options['no-browser'] ? undefined : async url => {
+        try { await openBrowserImpl(url, options.browser); }
+        catch { notify({ event: 'browser_unavailable', message: 'Open the printed consent URL in your browser. Login is still waiting.' }); }
+      },
+        notify });
+      if (!options.json) {
+        stdout.write(`\nConnected to GeniusTasker.\nYour chosen access is ready for the CLI and MCP.\nRun geniustasker auth status${options.context ? ' --context ' + options.context : ''} to check the connection.\n`);
+        return 0;
+      }
+    } else if (command === 'auth logout') data = await client.logout();
+    else if (command === 'profiles list') data = await new AgentProfiles(client).list();
+    else if (command === 'profiles create') data = await new AgentProfiles(client).create(await readCommandFile(options.file));
+    else if (command === 'profiles restrict') data = await new AgentProfiles(client).restrict(await readCommandFile(options.file));
+    else if (command === 'profiles select') data = await new AgentProfiles(client).select({ profileId: options.profile });
+    else if (command === 'commands describe') data = describeCommands();
+    else if (command === 'commands prepare') data = await new CommandJournal(client).prepare(await readCommandFile(options.file));
+    else if (command === 'commands execute') data = await new CommandJournal(client).execute(await readCommandFile(options.file));
+    else if (command === 'commands retry') data = await new CommandJournal(client).retry(options.operation);
+    else if (command === 'commands inspect') data = await new CommandJournal(client).inspect(options.operation);
+    else if (command === 'doctor') data = await client.doctor();
+    else if (command === 'whoami' || command === 'auth status') data = await client.get('me');
+    else if (command === 'capabilities') data = await client.get('capabilities');
+    else if (command === 'projects list' || command === 'memories list') data = await client.get(command === 'projects list' ? 'projects' : 'memories', { after: options.after });
+    else if (command === 'changes list' || command === 'changes watch') {
+      const input = { scope: options.scope, collection: options.collection, cursor: options.cursor };
+      data = command === 'changes list' ? await readChanges(client, input) :
+        await watchChanges(client, { ...input, ...(options['wait-seconds'] === undefined ? {} : { waitSeconds: Number(options['wait-seconds']) }) });
+    }
+    else if (command === 'resources list' || command === 'questions answers') {
+      if (!(command === 'questions answers' ? options.scope?.startsWith('project:') : /^(project|memory):[^\u0000-\u001f]+$/.test(options.scope ?? '')) || !(command === 'resources list' ? options.collection : options.question) || options.after && (!options.epoch || !options.checkpoint))
+        fail('invalid_arguments', 'Use --scope project:ID or memory:ID and --collection for resources or --question for answers; continuation needs --epoch and --checkpoint.');
+      data = await client.get(command === 'resources list' ? 'resources' : 'answers', Object.fromEntries(commands[command].options.filter(key => options[key] !== undefined).map(key => [key, options[key]])));
+    } else if (command === 'mcp') {
+      const { runMcp } = await import('./mcp.mjs');
+      const server = await runMcp(client);
+      const close = () => { void server.close(); };
+      signal?.addEventListener('abort', close, { once: true });
+      if (signal?.aborted) close();
+      return 0; // stdout belongs exclusively to JSON-RPC.
+    }
+    emit(data); return 0;
+  } catch (error) {
+    const safe = safeError(error);
+    stderr.write(JSON.stringify({ formatVersion: 1, ok: false, error: safe.toJSON() }) + '\n');
+    return exitCode(safe);
+  }
+}

package/src/client.mjs

@@ -0,0 +1,95 @@
+import { fail } from './errors.mjs';
+
+export function credentials(result, origin, now = Date.now()) {
+  const token = (value, kind) => typeof value === 'string' && new RegExp(`^gta1\\.[a-f0-9]{64}\\.wd${kind}_[A-Za-z0-9_-]{43}$`).test(value);
+  if (!token(result?.access_token, 'a') || !token(result?.refresh_token, 'r') || result.token_type !== 'Bearer' ||
+      !Number.isSafeInteger(result.expires_in) || result.expires_in < 1 || result.expires_in > 3600 ||
+      ['connection_id', 'profile_id', 'session_id'].some(key => typeof result[key] !== 'string' || !/^[A-Za-z0-9_-]{1,128}$/.test(result[key])))
+    fail('invalid_response', 'The authorization response was invalid.', { remediation: 'Revoke the new session in Account → Agents and retry login.' });
+  return { formatVersion: 1, origin, clientId: 'geniustasker-cli',
+    access_token: result.access_token, refresh_token: result.refresh_token, token_type: 'Bearer', expires_in: result.expires_in,
+    connection_id: result.connection_id, profile_id: result.profile_id, session_id: result.session_id,
+    expiresAt: now + result.expires_in * 1000, refreshPending: false };
+}
+
+export class AgentClient {
+  constructor(transport, store) { this.transport = transport; this.store = store; }
+  async session() {
+    const session = await this.store.read();
+    if (!session) fail('not_authenticated', 'This context is not connected.', { remediation: 'Run auth login with this context and environment.' });
+    if (session.formatVersion !== 1 || session.origin !== this.transport.origin || session.clientId !== 'geniustasker-cli')
+      fail('credential_origin_mismatch', 'This context belongs to another API environment.', { remediation: 'Select its original environment, or use a different --context for the new environment.' });
+    // Validate private storage before ever sending any token to the network.
+    credentials(session, session.origin);
+    if (!Number.isSafeInteger(session.expiresAt)) fail('invalid_credential_store', 'The session expiry is invalid.');
+    return session;
+  }
+  async authorizedSession() {
+    return this.store.locked(async () => {
+      const session = await this.session();
+      if (session.refreshPending) fail('reauthentication_required', 'The previous renewal outcome is unknown.', { remediation: 'Run auth logout, then auth login. Do not replay the previous refresh token.' });
+      if (session.expiresAt > Date.now() + 30000) return session;
+      return this.renewLocked(session);
+    }, this.transport.signal);
+  }
+  /** Only called while holding the credential store lock. Selection rotates
+   * access and refresh together so an in-flight old command cannot acquire the
+   * new profile's identity. It never extends the server's absolute lifetime. */
+  async renewLocked(session, selection) {
+    await this.store.write({ ...session, refreshPending: true });
+    let result;
+    try {
+      result = await this.transport.oauth('token', { grant_type: 'refresh_token', refresh_token: session.refresh_token,
+        ...(selection ? { profile_id: selection.profileId, profile_revision: String(selection.expectedRevision), source_revision: String(selection.expectedSourceRevision) } : {}) });
+    } catch (error) {
+      // These two server outcomes happen before token consumption/rotation.
+      // Every other refusal or lost reply retains the uncertainty marker.
+      if (selection && error?.status === 400 && ['profile_selection_conflict', 'profile_selection_denied'].includes(error.code)) {
+        await this.store.write(session);
+        error.remediation = 'List profiles again. Only a human can approve broader access; a changed profile requires a fresh selection.';
+      }
+      throw error;
+    }
+    const next = credentials(result, this.transport.origin);
+    if (next.connection_id !== session.connection_id || next.profile_id !== (selection?.profileId ?? session.profile_id) || next.session_id !== session.session_id)
+      fail('invalid_response', 'Renewal returned an unexpected identity.');
+    await this.store.write(next);
+    return next;
+  }
+  async selectProfile(selection) {
+    return this.store.locked(async () => {
+      const session = await this.session();
+      if (session.refreshPending) fail('reauthentication_required', 'The previous renewal outcome is unknown.', { remediation: 'Run auth logout, then auth login; do not replay the previous refresh token.' });
+      if (selection.sourceProfileId !== session.profile_id || selection.connectionId !== session.connection_id)
+        fail('profile_selection_conflict', 'Another process changed this context.', { status: 409, remediation: 'Read profiles again. Use separate --context names for independent terminals.' });
+      const next = await this.renewLocked(session, selection);
+      return { connected: true, connectionId: next.connection_id, profileId: next.profile_id, sessionId: next.session_id };
+    }, this.transport.signal);
+  }
+  async accessToken() { return (await this.authorizedSession()).access_token; }
+  async get(resource, query) {
+    if (!['me', 'capabilities', 'projects', 'memories', 'resources', 'profiles', 'answers', 'changes'].includes(resource)) fail('invalid_arguments', 'Unknown delegated resource.');
+    const token = await this.accessToken();
+    // No blanket retries, no automatic writes. Revocation and ACL errors remain
+    // visible to the agent. A caller chooses how to recover using the envelope.
+    return this.transport.request(`/api/agents/v1/${resource}`, { token, query });
+  }
+  async logout() {
+    return this.store.locked(async () => {
+      if (!await this.store.read()) return { connected: false, alreadyDisconnected: true };
+      const session = await this.session();
+      // Keep credentials on failure so revocation can be retried. A used refresh
+      // token can revoke a family whose rotation response was lost.
+      await this.transport.oauth('revoke', { token: session.refresh_token, token_type_hint: 'refresh_token' });
+      await this.store.remove();
+      return { connected: false, revoked: true };
+    }, this.transport.signal);
+  }
+  async doctor() {
+    const session = await this.store.read();
+    return { node: process.versions.node, origin: this.transport.origin, connectedLocally: Boolean(session),
+      sameEnvironment: session ? session.origin === this.transport.origin : null,
+      needsLogin: session ? session.refreshPending === true : true, storage: 'private OS-user file',
+      publication: 'local preview; npm distribution is not enabled', writes: 'Discover server capabilities before attempting changes.' };
+  }
+}

package/src/command-catalog.mjs

@@ -0,0 +1,287 @@
+// Generated from contracts/agents.tsp. Do not edit by hand.
+export default {
+  "maxCommandBytes": 32768,
+  "commands": {
+    "approval.cancel": {
+      "fields": [
+        "requestVersion"
+      ],
+      "module": "Project/ProjectTaskComment",
+      "permission": "approvals:write"
+    },
+    "approval.consume": {
+      "fields": [
+        "requestVersion",
+        "actionJson"
+      ],
+      "module": "Project/ProjectTaskComment",
+      "permission": "approvals:write"
+    },
+    "approval.request": {
+      "create": true,
+      "fields": [
+        "task",
+        "taskRevision",
+        "title",
+        "summary",
+        "actionJson",
+        "approver",
+        "expiresAt"
+      ],
+      "module": "Project/ProjectTaskComment",
+      "permission": "approvals:write"
+    },
+    "comment.create": {
+      "create": true,
+      "fields": [
+        "task",
+        "text",
+        "mentions"
+      ],
+      "module": "Project/ProjectTaskComment",
+      "permission": "comments:write"
+    },
+    "comment.delete": {
+      "delete": true,
+      "fields": [],
+      "module": "Project/ProjectTaskComment",
+      "permission": "comments:write"
+    },
+    "comment.update": {
+      "fields": [
+        "text",
+        "mentions"
+      ],
+      "module": "Project/ProjectTaskComment",
+      "permission": "comments:write"
+    },
+    "goal.create": {
+      "create": true,
+      "fields": [
+        "title",
+        "owner",
+        "isTeamOwner",
+        "period",
+        "interval",
+        "startTime",
+        "taskNumber",
+        "scheduleTaskOnly",
+        "notification",
+        "alertNotification"
+      ],
+      "module": "Project/ProjectMemberGoals",
+      "permission": "goals:write"
+    },
+    "goal.delete": {
+      "delete": true,
+      "fields": [],
+      "module": "Project/ProjectMemberGoals",
+      "permission": "goals:write"
+    },
+    "goal.update": {
+      "fields": [
+        "title",
+        "owner",
+        "isTeamOwner",
+        "period",
+        "interval",
+        "startTime",
+        "taskNumber",
+        "scheduleTaskOnly",
+        "notification",
+        "alertNotification"
+      ],
+      "module": "Project/ProjectMemberGoals",
+      "permission": "goals:write"
+    },
+    "memory.create": {
+      "create": true,
+      "fields": [
+        "title",
+        "productKey",
+        "summary",
+        "instructions",
+        "color"
+      ],
+      "module": "Memory/$",
+      "permission": "memory:write"
+    },
+    "memory.delete": {
+      "delete": true,
+      "fields": [],
+      "module": "Memory/$",
+      "permission": "memory:write"
+    },
+    "memory.page.create": {
+      "create": true,
+      "fields": [
+        "title",
+        "path",
+        "summary",
+        "blocks",
+        "tags",
+        "provenance"
+      ],
+      "module": "Memory/MemoryPage",
+      "permission": "memory:write"
+    },
+    "memory.page.delete": {
+      "delete": true,
+      "fields": [],
+      "module": "Memory/MemoryPage",
+      "permission": "memory:write"
+    },
+    "memory.page.update": {
+      "fields": [
+        "title",
+        "path",
+        "summary",
+        "blocks",
+        "tags",
+        "provenance"
+      ],
+      "module": "Memory/MemoryPage",
+      "permission": "memory:write"
+    },
+    "memory.update": {
+      "fields": [
+        "title",
+        "productKey",
+        "summary",
+        "instructions",
+        "color"
+      ],
+      "module": "Memory/$",
+      "permission": "memory:write"
+    },
+    "question.close": {
+      "fields": [],
+      "module": "Project/ProjectVote",
+      "permission": "questions:write"
+    },
+    "question.create": {
+      "create": true,
+      "fields": [
+        "task",
+        "question",
+        "description",
+        "answerKind",
+        "options",
+        "selection",
+        "anonymous",
+        "eligibleUsers",
+        "closesAt"
+      ],
+      "module": "$private/VoteDraft",
+      "permission": "questions:write"
+    },
+    "task.archive": {
+      "fields": [],
+      "module": "Project/ProjectTask",
+      "permission": "tasks:write"
+    },
+    "task.create": {
+      "create": true,
+      "fields": [
+        "title",
+        "description",
+        "type",
+        "owner",
+        "status",
+        "enableDueDate",
+        "dueDate",
+        "estimateDays",
+        "quantity",
+        "quantityUnit",
+        "autoArchive",
+        "autoArchiveDays",
+        "autoArchiveHours",
+        "dependencies",
+        "tags"
+      ],
+      "module": "Project/ProjectTask",
+      "permission": "tasks:write"
+    },
+    "task.report": {
+      "fields": [
+        "phase",
+        "summary",
+        "nextSteps",
+        "evidence",
+        "mentions"
+      ],
+      "module": "Project/ProjectTask",
+      "permission": "tasks:write"
+    },
+    "task.restore": {
+      "fields": [],
+      "module": "Project/ProjectTask",
+      "permission": "tasks:write"
+    },
+    "task.update": {
+      "fields": [
+        "title",
+        "description",
+        "type",
+        "owner",
+        "status",
+        "enableDueDate",
+        "dueDate",
+        "estimateDays",
+        "quantity",
+        "quantityUnit",
+        "autoArchive",
+        "autoArchiveDays",
+        "autoArchiveHours",
+        "dependencies",
+        "tags"
+      ],
+      "module": "Project/ProjectTask",
+      "permission": "tasks:write"
+    },
+    "ticket.create": {
+      "create": true,
+      "fields": [
+        "title",
+        "description",
+        "kind",
+        "placement",
+        "sprint",
+        "parent",
+        "details",
+        "planning"
+      ],
+      "module": "Project/ProjectTask",
+      "permission": "tasks:write"
+    },
+    "ticket.plan": {
+      "fields": [
+        "changes"
+      ],
+      "module": "Project/$",
+      "permission": "tasks:write"
+    }
+  },
+  "changes": {
+    "pollIntervalSeconds": 5,
+    "maxWatchSeconds": 60
+  },
+  "grants": {
+    "permissions": [
+      "projects:read",
+      "tasks:read",
+      "tasks:write",
+      "comments:write",
+      "questions:write",
+      "approvals:write",
+      "goals:read",
+      "goals:write",
+      "memory:read",
+      "memory:write",
+      "media:read",
+      "media:write"
+    ],
+    "maxResources": 200,
+    "maxProfilesPerConnection": 20
+  }
+};