viviscape-mcp 2.0.2 → 2.2.0

package/dist/api-client.js

@@ -1,4 +1,5 @@
-import { API_PREFIX, baseUrl } from './config.js';
+import { API_PREFIX, APP_NAME, baseUrl } from './config.js';
+import { GROUP_TYPES } from './enums.js';
 import { featureForPath, requireFeature } from './auth/permissions.js';
 /** Raised when the stored session is rejected or bounced to the login page. */
 export class SessionExpiredError extends Error {
@@ -13,6 +14,25 @@ export class ApiError extends Error {
         this.status = status;
     }
 }
+/**
+ * GroupMilestone payload. The API wants the whole record, so fill the fields it
+ * computes with neutral values and let an update merge over the existing row.
+ */
+function buildMilestonePayload(data, ctx, existing) {
+    const est = data.estimated_hours ? parseShorthandDuration(String(data.estimated_hours)).duration : '';
+    return {
+        milestone_id: Number(data.milestone_id ?? existing?.milestone_id ?? 0),
+        group_id: Number(data.project_id ?? existing?.group_id ?? 0),
+        user_id: ctx.userId,
+        milestone: (data.title ?? existing?.milestone ?? ''),
+        sequence: Number(data.sequence ?? existing?.sequence ?? 0),
+        start_date: isoDate(data.start_date, String(existing?.start_date ?? nowIso())),
+        due_date: isoDate(data.due_date, String(existing?.due_date ?? nowIso())),
+        estimated_time: est || existing?.estimated_time || '',
+        complete: Boolean(data.complete ?? existing?.complete ?? false),
+        progress: Number(data.progress ?? existing?.progress ?? 0),
+    };
+}
 /**
  * Parse shorthand duration (e.g., "3h", "1h30m", "45m") to HH:MM:SS TimeSpan format.
  */
@@ -33,74 +53,47 @@ function parseShorthandDuration(input) {
 /**
  * Build a full Group_Task payload from simplified MCP tool params.
  */
+/**
+ * Group_Task create payload.
+ *
+ * Modelled on what the ViviScape Work UI actually posts to tasks/add
+ * (ClockWyzWeb/Scripts/app/tasks.js, \$scope.nt): fourteen fields, ids as
+ * strings, estimated_time as shorthand text, and assignment expressed as
+ * staff_assignees [{user_id, attention}].
+ *
+ * The previous version sent a 37-field row with estimated_ticks and a
+ * hand-computed priority_rank, which the API rejected outright ("Invalid Server
+ * Request"). priority_rank is server-computed -- the UI never sends it, and the
+ * live values are not ordinal (low=3, moderate=27, important=86).
+ */
 function buildTaskPayload(data, ctx) {
-    const now = new Date().toISOString();
-    const assignees = [];
-    const userId = data.assigned_to ?? ctx.userId;
-    assignees.push({
-        assignee_id: 0,
-        task_id: 0,
-        user_id: userId,
-        client_id: 0,
-        leader: true,
-        attention: false,
-        promoting: false,
-        pinned: false,
-        notify: true,
-        active: false,
-        activitys: [],
-        duration: '00:00:00',
-        duration_friendly: '-',
-    });
-    // Convert estimated_hours shorthand to ticks (1 tick = 100ns, 1h = 36_000_000_000 ticks)
-    let estimatedTicks = 0;
-    if (data.estimated_hours) {
-        const parsed = parseShorthandDuration(String(data.estimated_hours));
-        const [h, m] = parsed.duration.split(':').map(Number);
-        estimatedTicks = ((h * 60 + m) * 60) * 10_000_000;
-    }
-    const priorityMap = { low: 1, medium: 2, high: 3, critical: 4 };
-    const priorityStr = String(data.priority || 'medium');
-    const priorityRank = priorityMap[priorityStr] ?? 2;
-    return {
-        task_id: 0,
-        group_id: data.project_id ?? 0,
-        company_id: data.company_id ?? 0,
-        service_id: data.service_id ?? 0,
+    const start = isoDate(data.start_date, nowIso());
+    const payload = {
+        status: data.status || 'new',
+        account_id: ctx.accountId,
+        service_id: String(data.service_id ?? 0),
+        estimated_time: data.estimated_hours ? String(data.estimated_hours) : '8h',
+        group_id: String(data.project_id ?? 0),
+        milestone_id: String(data.milestone_id ?? 0),
         task: data.title ?? '',
+        review_required: '0',
         description: data.description ?? '',
-        notes: data.notes ?? '',
-        status: data.status ?? 'new',
-        priority: priorityStr,
-        priority_rank: priorityRank,
-        start: data.start_date ?? now,
-        end: data.due_date ?? now,
-        creation_date: now,
-        complete_date: '1901-01-01T00:00:00+00:00',
-        estimated_ticks: estimatedTicks,
-        task_type: data.task_type ?? 'task',
-        isbillable: data.isbillable ?? false,
-        creator_id: userId,
-        milestone_id: data.milestone_id ?? 0,
-        client_id: 0,
-        event_id: 0,
-        account_id: ctx.accountId,
-        percentage: 0,
-        attention: false,
-        pinned: false,
-        assign_all_staff: false,
-        agg_cost: 0,
-        agg_rate: 0,
-        predecessor_id: 0,
-        predecessor_complete: false,
-        predecessor_name: '',
-        review_required: false,
-        parts: '',
-        staff_assignees: assignees,
-        client_assignees: [],
-        task_files: [],
-        logs: [],
+        priority: data.priority || 'low',
+        // The signed-in user creates the task. Assignment is separate -- see
+        // staff_assignees below and the task_assignee_* tools.
+        creator_id: ctx.userId,
+        start,
+        end: isoDate(data.due_date, start),
+        focus: false,
     };
+    if (data.notes)
+        payload.notes = data.notes;
+    if (data.company_id)
+        payload.company_id = data.company_id;
+    if (data.assigned_to) {
+        payload.staff_assignees = [{ user_id: Number(data.assigned_to), attention: false }];
+    }
+    return payload;
 }
 /**
  * Build update fields for a Group_Task, mapping friendly names to API names.
@@ -187,6 +180,7 @@ function buildTimeLogPayload(data, ctx) {
     };
 }
 const EPOCH = '2000-01-01T00:00:00';
+const EMPTY_GUID = '00000000-0000-0000-0000-000000000000';
 function isoDate(value, fallback) {
     if (typeof value === 'string' && value.trim())
         return value;
@@ -261,6 +255,51 @@ export class ViviScapeClient {
             return text;
         }
     }
+    /**
+     * Shared response handling for the binary upload paths, which cannot go
+     * through request() because that always sends JSON.
+     */
+    async send(method, path, init) {
+        requireFeature(featureForPath(path), this.creds);
+        const url = `${this.baseUrl}${API_PREFIX}/${path.replace(/^\//, '')}`;
+        const res = await fetch(url, { method, redirect: 'manual', ...init });
+        const text = await res.text();
+        if (res.status === 401 || res.status === 403)
+            throw new SessionExpiredError();
+        if (res.status >= 300 && res.status < 400)
+            throw new SessionExpiredError();
+        if (!res.ok) {
+            const snippet = text.length > 400 ? `${text.slice(0, 400)}...` : text;
+            throw new ApiError(res.status, `API ${method} ${path} returned ${res.status}: ${snippet}`);
+        }
+        if (!text.trim())
+            return null;
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            return text;
+        }
+    }
+    authHeaders(extra = {}) {
+        return {
+            'Authorization': `Bearer ${this.creds.access_token}`,
+            'user_id': String(this.creds.user_id),
+            'pid': String(this.creds.pid),
+            ...extra,
+        };
+    }
+    /** multipart/form-data upload; fetch sets the boundary, so no Content-Type here. */
+    async postMultipart(path, form) {
+        return this.send('POST', path, { headers: this.authHeaders(), body: form });
+    }
+    /** Raw-body upload with metadata in headers (the groups/file/add contract). */
+    async postBytes(path, bytes, extra) {
+        return this.send('POST', path, {
+            headers: this.authHeaders({ 'Content-Type': 'application/octet-stream', ...extra }),
+            body: bytes,
+        });
+    }
     get(path) {
         return this.request('GET', path);
     }
@@ -371,6 +410,68 @@ export class ViviScapeClient {
     async getActiveProjectsByUser(userId) {
         return this.get(`user/groups/active?user_id=${userId || this.userId}&account_id=${this.accountId}`);
     }
+    /**
+     * Create a project (group). GEN_Group has ~40 fields; live rows for this
+     * tenant show account_id 0, platform_account_id = pid, and group type 5
+     * (PROJECT), so those are the defaults here.
+     *
+     * There is no delete route for projects -- a created project can only be
+     * archived or renamed afterward.
+     */
+    async addProject(data) {
+        return this.post('groups/add', {
+            intGroupId: 0,
+            intGroupTypeId: GROUP_TYPES.PROJECT,
+            intCompanyId: data.company_id,
+            intPostPermission: 0,
+            intEventId: 0,
+            intGroupBeacon: 0,
+            decBalance: 0,
+            strImage: '',
+            strImageThumb: '',
+            strGroupName: data.name,
+            strGroupShortDescription: data.short_description || '',
+            strGroupDescription: data.description || '',
+            strGroupLink: '',
+            bitActive: true,
+            bitPublic: data.is_public ?? false,
+            intCapacity: 0,
+            intStaff: 0,
+            intMembers: 0,
+            intPayoutAccountId: 0,
+            Clients: [],
+            Staff: data.staff && data.staff.length ? data.staff : [this.userId],
+            account_id: 0,
+            platform_account_id: this.accountId,
+            user_id: this.userId,
+            status: data.status || 'new',
+            enabledWelcome: false,
+            enabledGoodbye: false,
+            showClients: false,
+            welcomeMessage: '',
+            goodbyeMessage: '',
+        });
+    }
+    /** Update a project by merging changes onto the row the API already has. */
+    async updateProject(projectId, changes) {
+        const existing = await this.getProjectById(projectId);
+        const row = Array.isArray(existing) ? existing[0] : existing;
+        if (!row || typeof row !== 'object') {
+            throw new ApiError(404, `Project ${projectId} not found, cannot update.`);
+        }
+        return this.post('groups/update', { ...row, ...changes });
+    }
+    /** Status-only update; leaves budget and approved time untouched. */
+    async setProjectStatus(projectId, status, billable = true) {
+        return this.get(`groups/update/status?groupid=${projectId}&status=${encodeURIComponent(status)}&billable=${billable}`);
+    }
+    async addProjectUser(projectId, userId, opts = {}) {
+        return this.get(`groups/user/add?userid=${userId}&groupid=${projectId}` +
+            `&iscontact=${opts.is_contact ?? false}&islead=${opts.is_lead ?? false}`);
+    }
+    async removeProjectUser(projectId, userId) {
+        return this.get(`groups/user/remove?groupid=${projectId}&userid=${userId}`);
+    }
     // -- Tasks --------------------------------------------------
     async addTask(data) {
         return this.post('tasks/add', buildTaskPayload(data, this.ctx));
@@ -385,15 +486,19 @@ export class ViviScapeClient {
     async getProjectTasks(projectId) {
         return this.get(`tasks/group?group_id=${projectId}`);
     }
-    async getOpenTasks() {
+    /**
+     * The account/tasks/open route filters server-side on company, ownership, and
+     * a date window; pass them through instead of hardcoding "everything".
+     */
+    async getOpenTasks(opts = {}) {
         return this.post('account/tasks/open', {
             account_id: this.accountId,
             user_id: this.userId,
-            start: EPOCH,
-            end: nowIso(),
-            company_id: 0,
-            teamfilter: '',
-            onlymytasks: false,
+            start: opts.start || EPOCH,
+            end: opts.end || nowIso(),
+            company_id: opts.company_id ?? 0,
+            teamfilter: opts.team || '',
+            onlymytasks: opts.only_mine ?? false,
         });
     }
     async getTask(taskId) {
@@ -411,6 +516,178 @@ export class ViviScapeClient {
     async getCompanyTasks(companyId) {
         return this.get(`company/tasks?company_id=${companyId}&user_id=${this.userId}`);
     }
+    // -- Task comments ------------------------------------------
+    async getTaskComments(taskId) {
+        return this.get(`task/comments/${taskId}`);
+    }
+    async getTaskComment(commentId) {
+        return this.get(`task/comment/id/${commentId}`);
+    }
+    /**
+     * NOTE: on platform account 1, the backend fires a client-notification webhook
+     * for comments on tasks whose client_id > 0. Adding a comment can therefore
+     * reach the customer -- the tool description says so too.
+     */
+    async addTaskComment(data) {
+        return this.post('task/comment/add', {
+            comment_id: EMPTY_GUID,
+            task_id: data.task_id,
+            user_id: this.userId,
+            client_id: data.client_id ?? 0,
+            creator: this.creds.name || this.creds.email || String(this.userId),
+            comment: data.comment,
+            attachment_file: '',
+            attachment_url: '',
+            source: data.source || APP_NAME,
+            comment_date: nowIso(),
+        });
+    }
+    async updateTaskComment(data) {
+        return this.post('task/comment/update', {
+            comment_id: data.comment_id,
+            task_id: data.task_id,
+            user_id: this.userId,
+            client_id: 0,
+            creator: this.creds.name || this.creds.email || String(this.userId),
+            comment: data.comment,
+            attachment_file: '',
+            attachment_url: '',
+            source: APP_NAME,
+            comment_date: nowIso(),
+        });
+    }
+    /**
+     * The backend's remove proxy answers 500 even on success: it returns 400 when
+     * the upstream delete fails, so a 500 means it crashed deserializing an empty
+     * success body (res.data.ToString() on null). Verify by re-reading the thread
+     * rather than reporting a failure that did not happen.
+     */
+    async removeTaskComment(commentId, taskId) {
+        try {
+            return await this.get(`task/comment/remove/${commentId}`);
+        }
+        catch (err) {
+            if (!(err instanceof ApiError) || err.status !== 500)
+                throw err;
+            if (!taskId) {
+                throw new ApiError(500, `API returned 500 removing comment ${commentId}. This backend answers 500 even when the ` +
+                    'delete succeeds; pass task_id so the removal can be verified by re-reading the thread.');
+            }
+            const rows = await this.getTaskComments(taskId);
+            const present = Array.isArray(rows)
+                && rows.some((r) => String(r.comment_id).toLowerCase() === commentId.toLowerCase());
+            if (present)
+                throw err;
+            return {
+                removed: true,
+                comment_id: commentId,
+                task_id: taskId,
+                note: 'Backend returned 500 while serializing its response; verified removed by re-reading the thread.',
+            };
+        }
+    }
+    async markTaskRead(taskId) {
+        return this.post('task/read/mark', { task_id: taskId, user_id: this.userId });
+    }
+    // -- Task assignment and lifecycle --------------------------
+    async addTaskAssignee(data) {
+        return this.post('tasks/assignee/add', {
+            assignee_id: 0,
+            task_id: data.task_id,
+            user_id: data.user_id,
+            client_id: 0,
+            active: true,
+            leader: data.leader ?? false,
+            attention: data.attention ?? false,
+            promoting: false,
+            pinned: false,
+            notify: data.notify ?? true,
+        });
+    }
+    /** Takes the assignee_id from the task's staff_assignees, not a user_id. */
+    async removeTaskAssignee(assigneeId) {
+        return this.get(`tasks/assignee/remove?assignee_id=${assigneeId}`);
+    }
+    async setTaskLeader(taskId, userId) {
+        return this.get(`task/assign/leader/${taskId}/${userId}`);
+    }
+    async setTaskAttention(taskId, userId, flag) {
+        return this.get(`task/assign/attention/${taskId}/${userId}/${flag}`);
+    }
+    async deleteTask(taskId) {
+        return this.get(`tasks/delete?task_id=${taskId}`);
+    }
+    /** Fold one task into another; the source task is consumed. */
+    async mergeTasks(fromTaskId, toTaskId) {
+        return this.post('tasks/merge', { task_from_id: fromTaskId, task_to_id: toTaskId });
+    }
+    // -- Milestones ---------------------------------------------
+    async getMilestones(projectId) {
+        return this.get(`milestones/list/${projectId}`);
+    }
+    async getActiveMilestones() {
+        return this.get(`milestones/active/account/${this.accountId}`);
+    }
+    async getMilestonesByCompany(companyId) {
+        return this.get(`milestones/account/${this.accountId}/${companyId}`);
+    }
+    async getMilestonesByUser(userId) {
+        return this.get(`milestones/user/active/account/${this.accountId}/${userId || this.userId}`);
+    }
+    async getMilestone(milestoneId) {
+        return this.get(`milestone/id/${milestoneId}`);
+    }
+    async addMilestone(data) {
+        return this.post('milestone/add', buildMilestonePayload(data, this.ctx));
+    }
+    async updateMilestone(data) {
+        if (data.milestone_id) {
+            const existing = await this.getMilestone(Number(data.milestone_id));
+            const row = Array.isArray(existing) ? existing[0] : existing;
+            if (row && typeof row === 'object') {
+                return this.post('milestone/update', { ...row, ...buildMilestonePayload(data, this.ctx, row) });
+            }
+        }
+        return this.post('milestone/update', buildMilestonePayload(data, this.ctx));
+    }
+    /** Copy a milestone (and its task template) into a project. */
+    async cloneMilestone(milestoneId, projectId, title) {
+        const existing = await this.getMilestone(milestoneId);
+        const row = (Array.isArray(existing) ? existing[0] : existing);
+        if (!row || typeof row !== 'object') {
+            throw new ApiError(404, `Milestone ${milestoneId} not found, cannot clone.`);
+        }
+        return this.post('milestone/clone', {
+            ...row,
+            milestone_id: milestoneId,
+            group_id: projectId,
+            user_id: this.userId,
+            ...(title ? { milestone: title } : {}),
+        });
+    }
+    /**
+     * Known broken upstream: milestone/remove answers 500 and the milestone
+     * survives. The proxy returns 400 with detail when the upstream delete fails,
+     * so the 500 is a crash in its own success branch (Convert.ToBoolean on a
+     * non-boolean data payload) -- but unlike the comment-remove case the record
+     * is genuinely still there. Verify and say so plainly instead of pretending.
+     */
+    async removeMilestone(milestoneId) {
+        try {
+            return await this.get(`milestone/remove/${milestoneId}`);
+        }
+        catch (err) {
+            if (!(err instanceof ApiError) || err.status !== 500)
+                throw err;
+            const still = await this.getMilestone(milestoneId).catch(() => null);
+            const row = Array.isArray(still) ? still[0] : still;
+            if (row && typeof row === 'object' && row.milestone_id) {
+                throw new ApiError(500, `milestone/remove/${milestoneId} returned 500 and the milestone still exists. ` +
+                    'This route is broken server-side; delete the milestone in the ViviScape Work UI.');
+            }
+            return { removed: true, milestone_id: milestoneId, note: 'Backend returned 500 but the milestone is gone.' };
+        }
+    }
     // -- Time logs ----------------------------------------------
     async addTimeLog(data) {
         return this.post('logs/add', buildTimeLogPayload(data, this.ctx));
@@ -451,6 +728,173 @@ export class ViviScapeClient {
             module: 'notes',
         });
     }
+    // -- Note relations, tags, revisions -------------------------
+    async getAccountNotes(companyId = 0, userId = 0) {
+        return this.post('notes/account', {
+            account_id: this.accountId,
+            company_id: companyId,
+            user_id: userId,
+        });
+    }
+    async getNoteRevisions(noteId) {
+        return this.get(`note/revisions/${noteId}`);
+    }
+    async getNoteCompanies(noteId) {
+        return this.get(`note/companies/${noteId}`);
+    }
+    async addNoteCompany(noteId, companyId) {
+        return this.post('note/company/add', {
+            assignment_id: EMPTY_GUID,
+            note_id: noteId,
+            assign_user_id: this.userId,
+            company_id: companyId,
+        });
+    }
+    async removeNoteCompany(assignmentId) {
+        return this.get(`note/company/remove/${assignmentId}`);
+    }
+    async getNoteUsers(noteId) {
+        return this.get(`note/users/${noteId}`);
+    }
+    async addNoteUser(noteId, userId, permission = 'read') {
+        return this.post('note/user/add', {
+            assignment_id: EMPTY_GUID,
+            note_id: noteId,
+            user_id: userId,
+            permission,
+        });
+    }
+    async updateNoteUser(assignmentId, noteId, userId, permission) {
+        return this.post('note/user/update', {
+            assignment_id: assignmentId,
+            note_id: noteId,
+            user_id: userId,
+            permission,
+        });
+    }
+    async removeNoteUser(assignmentId) {
+        return this.get(`note/user/remove/${assignmentId}`);
+    }
+    async getNoteTags(noteId) {
+        return this.get(`note/tags/${noteId}`);
+    }
+    async addNoteTag(noteId, tag) {
+        return this.post('note/tags/add', { tag_id: EMPTY_GUID, note_id: noteId, tag });
+    }
+    async removeNoteTag(tagId) {
+        return this.get(`note/tag/remove/${tagId}`);
+    }
+    // -- Note attachments ----------------------------------------
+    async getNoteAttachments(noteId) {
+        return this.get(`note/attachments/${noteId}`);
+    }
+    /** Uploads a local file as a note attachment. knowledge=true marks it for extraction. */
+    async uploadNoteAttachment(noteId, filePath, knowledge = false) {
+        const { readFileSync } = await import('node:fs');
+        const { basename } = await import('node:path');
+        const form = new FormData();
+        form.append('knowledge', String(knowledge));
+        form.append('file', new Blob([readFileSync(filePath)]), basename(filePath));
+        return this.postMultipart(`note/attachment/upload/${noteId}`, form);
+    }
+    async removeNoteAttachment(attachmentId) {
+        return this.get(`note/attachment/remove/${attachmentId}`);
+    }
+    /** Flag an attachment as knowledge-base material (drives text extraction). */
+    async setNoteAttachmentKnowledge(attachment) {
+        return this.post('note/attachment/knowledge', attachment);
+    }
+    // -- Notebooks -----------------------------------------------
+    async getNotebooks(userId = 0) {
+        return this.get(`note/books/user/${userId || this.userId}`);
+    }
+    async getNotebookNotes(bookId) {
+        return this.get(`note/book/notes/${bookId}`);
+    }
+    async addNotebook(name, description = '') {
+        return this.post('note/book/add', {
+            book_id: EMPTY_GUID,
+            name,
+            description,
+            creator_id: this.userId,
+            account_id: this.accountId,
+        });
+    }
+    async updateNotebook(bookId, changes) {
+        return this.post('note/book/update', {
+            book_id: bookId,
+            creator_id: this.userId,
+            account_id: this.accountId,
+            ...changes,
+        });
+    }
+    async removeNotebook(bookId) {
+        return this.get(`note/book/remove/${bookId}`);
+    }
+    /** Add or remove notes from a notebook in one call. */
+    async assignNotesToBook(bookId, noteIds, assign = true) {
+        return this.post('note/book/assign', { book_id: bookId, note_ids: noteIds, assign });
+    }
+    async getNotebookUsers(bookId) {
+        return this.get(`note/book/users/${bookId}`);
+    }
+    async addNotebookUser(bookId, userId, permission = 'read') {
+        return this.post('note/book/user/add', {
+            assignment_id: EMPTY_GUID,
+            book_id: bookId,
+            user_id: userId,
+            permission,
+        });
+    }
+    async updateNotebookUser(assignmentId, bookId, userId, permission) {
+        return this.post('note/book/user/update', {
+            assignment_id: assignmentId,
+            book_id: bookId,
+            user_id: userId,
+            permission,
+        });
+    }
+    async removeNotebookUser(assignmentId) {
+        return this.get(`note/book/user/remove/${assignmentId}`);
+    }
+    // -- Project and task files ----------------------------------
+    async getProjectFiles(projectId, userId = 0) {
+        return this.get(`groups/files?groupid=${projectId}&userid=${userId || this.userId}`);
+    }
+    async getTaskFiles(taskId) {
+        return this.get(`groups/task/files?taskid=${taskId}`);
+    }
+    /**
+     * Upload a file to a project. This route takes the raw bytes as the body and
+     * every piece of metadata as a header, and the handler reads each header
+     * without a null check -- so all of them must be sent, even when empty.
+     */
+    async uploadProjectFile(opts) {
+        const { readFileSync } = await import('node:fs');
+        const { basename } = await import('node:path');
+        const name = basename(opts.file_path);
+        return this.postBytes('groups/file/add', readFileSync(opts.file_path), {
+            userid: String(this.userId),
+            groupid: String(opts.project_id),
+            filename: name,
+            title: opts.title || name,
+            youtube: '',
+            notify: String(opts.notify ?? false),
+            taskid: String(opts.task_id ?? 0),
+            lat: '0',
+            lng: '0',
+        });
+    }
+    async updateProjectFile(file) {
+        return this.post('groups/file/update', file);
+    }
+    async deleteProjectFile(fileId) {
+        return this.get(`groups/file/delete?fileid=${fileId}`);
+    }
+    /** Returns whatever the download route serves; usually a redirect target or URL. */
+    async downloadProjectFile(fileId) {
+        return this.get(`groups/file/download/${fileId}`);
+    }
     // -- Account ------------------------------------------------
     async getAccountInfo() {
         return this.get(`account/id/${this.accountId}`);

package/dist/auth/permissions.js

@@ -62,6 +62,8 @@ export function featureForPath(path) {
         return 'logs';
     if (p.startsWith('prospect'))
         return 'crm';
+    if (p.startsWith('task/comment'))
+        return 'comment';
     if (p.startsWith('task'))
         return 'tasks';
     return 'auth';