iit-mcp-autotask 0.11.2 → 0.12.0

package/README.md

@@ -9,9 +9,9 @@ packaged playbooks, strong security boundaries, and predictable per-tenant in-pr
 client + SDK-owned TTL caches).
 
 > **Package status (2026-10-22):** the runtime dependency `node-autotask` is published to public npm
-> at `0.23.0`; the committed `pnpm-lock.yaml` pins that
+> at `0.24.0`; the committed `pnpm-lock.yaml` pins that
 > release with its integrity hash, so installs resolve deterministically. The dependency is always npm
-> (node-autotask pinned exactly at `0.23.0`) — never a `file:`, `git:`, `link:` or workspace reference
+> (node-autotask pinned exactly at `0.24.0`) — never a `file:`, `git:`, `link:` or workspace reference
 > to a local checkout.
 
 > **0.6.0 is a breaking release** (unreleased): tool names, result shapes and configuration all
@@ -452,7 +452,7 @@ No aliases: old names fail as unknown tools.
 |-------|-------|
 | `catalog`, `describe {operation}`, `read {operation,args}`, `fetch_many`, `ticket_full_context`, `company_full_profile` | unchanged (core) |
 | `read_batch {items}` / `relationship_map {resource_key}` | `read {items}` / `describe {resource}` |
-| `resource_who_am_i`, `version`, `threshold_information` | `tenant_status {parts}` (`identity`, `version`, `thresholds`) |
+| `resource_who_am_i`, `version`, `threshold_information` | `tenant_status {parts}` (`identity` + `impersonationResourceId`, `version`, `thresholds`, `server`) |
 | `resolve_any` | `resolve {identifier, resources?}` |
 | `search_across_resources {query,resources,limit}` | `resolve {identifier, match: "contains", resources, limit}` |
 | `company_` / `configurationItems_` / `contact_` / `project_` / `ticket_resolve` | `resolve {identifier, resource}` |
@@ -769,7 +769,7 @@ independent review with its resolutions, [`docs/reviews/0.6.0.md`](docs/reviews/
 
 ## SDK dependency
 
-`iit-mcp-autotask` depends on **`node-autotask` from npm at exactly `0.23.0`** (an exact pin —
+`iit-mcp-autotask` depends on **`node-autotask` from npm at exactly `0.24.0`** (an exact pin —
 no range operator; subpaths `.` / `/capabilities` / `/operations` / `/resources` / `/types` /
 `/pool`) — the only **vendor** dependency; the other two runtime dependencies are
 `@modelcontextprotocol/server` (the MCP framework) and `zod` (schema validation). It never
@@ -779,7 +779,7 @@ user — the published tarball ships no lockfile) must resolve to the release th
 reviewed against, or the plan-hash boot check refuses to start.
 
 **Publishing `node-autotask` is the maintainer's action, done manually.** It is published on the
-public registry at `0.23.0` (published 2026-10-21); the
+public registry at `0.24.0` (published 2026-10-23); the
 exact pin and the committed `pnpm-lock.yaml` (with `pnpm-workspace.yaml`) pin the real published
 tarball with its integrity hash, so installs resolve to exactly that release — the lockfile
 freezes the pnpm/git/Docker paths, the pin freezes the npm/npx paths. The docs are written against this

package/capabilities.json

@@ -166,7 +166,7 @@
     },
     {
       "id": "autotask.identity.tenant_status",
-      "description": "Who this integration is (identity), the API version, and request thresholds: the tenant-wide vendor count plus this client's local hourly budget. Use it first to check credentials.",
+      "description": "Identity (API user + impersonated user), Autotask API version, this server's package/SDK version and profile (server), and request thresholds (tenant count + local hourly budget). Use it first to check credentials.",
       "mcpPrimitive": "tool",
       "toolName": "autotask_tenant_status",
       "type": "read",
@@ -380,7 +380,7 @@
       "autotask_describe",
       "autotask_read"
     ],
-    "backingRegistryOperations": 1216,
+    "backingRegistryOperations": 1217,
     "note": "autotask_catalog finds the exact operation key (ranked search), autotask_describe serves its contract, autotask_read runs any effect=read key. Writes go through the operator profile (autotask_write then autotask_apply); authenticate.* is never served."
   },
   "schemas": {}

package/dist/tools/catalog-data.d.ts

@@ -1,4 +1,6 @@
 import type { CapabilityRecord } from 'node-autotask/capabilities';
+/** The installed SDK's own version (the running process's, read from its package.json). */
+export declare const SDK_VERSION: string;
 export interface CatalogRow {
     operation: string;
     /** True for the 10 core-profile backing operations (dedicated tools). */
@@ -100,7 +102,7 @@ export declare function cacheOptionsForPreset(preset: 'on' | 'off', fieldCacheTt
  * fails the boot (or the CI test) instead of quietly shipping a tool surface that no longer
  * describes the SDK behind it.
  */
-export declare const BUILT_AGAINST_PLAN_HASH = "95746a69c86daeb7a5d10fa77dd92189c87c8145c547d06275fd0b517b913c9b";
+export declare const BUILT_AGAINST_PLAN_HASH = "479d7826acf548a8713c6891fe6cc5ea6ebb7c287896c932aac70834860a206f";
 /**
  * Fail fast when the installed SDK's plan has moved out from under this surface.
  * Called at boot (main.ts) and safe to call repeatedly (pure comparison).

package/dist/tools/catalog-data.js

@@ -19,6 +19,8 @@ import { ConfigError } from '../config.js';
 const require = createRequire(import.meta.url);
 /** The installed `node-autotask` package directory (the data files ship at its root). */
 const SDK_PACKAGE_DIR = dirname(require.resolve('node-autotask/package.json'));
+/** The installed SDK's own version (the running process's, read from its package.json). */
+export const SDK_VERSION = JSON.parse(readFileSync(join(SDK_PACKAGE_DIR, 'package.json'), 'utf8')).version;
 function loadSdkJson(name) {
     return JSON.parse(readFileSync(join(SDK_PACKAGE_DIR, name), 'utf8'));
 }
@@ -113,7 +115,7 @@ export const TOOL_DESCRIPTIONS = {
     autotask_resolve: 'Find the record behind an identifier: id or name, ticket number, configuration item serial number, contact email (by), in one resource or swept across several. Exact by default; contains for companies or a sweep (compact; limit = total).',
     autotask_query: 'List records with a filter: tickets, time entries, service calls, contracts or time-off requests (by status, company, date). limit default 50, max 2500; latest N, tsv, output_path. Slim: include_fields [names], note_chars 200.',
     autotask_fetch_many: 'Fetch up to 500 records by numeric id across mixed resources in one call: items: [{resource, id, fields?}]. Answers data.results[{ok, operation, result|error}], ok, failed (same as autotask_read); a miss is a typed NOT_FOUND slot.',
-    autotask_tenant_status: 'Who this integration is (identity), the API version, and request thresholds: the tenant-wide vendor count plus this client\'s local hourly budget. Use it first to check credentials.',
+    autotask_tenant_status: 'Identity (API user + impersonated user), Autotask API version, this server\'s package/SDK version and profile (server), and request thresholds (tenant count + local hourly budget). Use it first to check credentials.',
     autotask_ticket_full_context: 'One ticket with its company, contact, assigned resource, project, notes, time entries and attachment metadata. Missing parts degrade to typed absent; a missing ticket is not found.',
     autotask_company_full_profile: 'One company with locations, contacts, notes, open tickets and projects, 10 rows per part (capped: true = more exist; raise the limit). fields {part:[names]} trims columns. Open = status not 5. Missing parts degrade to typed absent.',
     autotask_project_get_context: 'One project with its company, opportunity and lead resource. Project phases and task lists do not exist on this API; charges and notes go through autotask_read.',
@@ -162,7 +164,7 @@ export function cacheOptionsForPreset(preset, fieldCacheTtlMs) {
  * fails the boot (or the CI test) instead of quietly shipping a tool surface that no longer
  * describes the SDK behind it.
  */
-export const BUILT_AGAINST_PLAN_HASH = '95746a69c86daeb7a5d10fa77dd92189c87c8145c547d06275fd0b517b913c9b';
+export const BUILT_AGAINST_PLAN_HASH = '479d7826acf548a8713c6891fe6cc5ea6ebb7c287896c932aac70834860a206f';
 /**
  * Fail fast when the installed SDK's plan has moved out from under this surface.
  * Called at boot (main.ts) and safe to call repeatedly (pure comparison).

package/dist/tools/meta.d.ts

@@ -12,7 +12,7 @@ export declare function paramNames(operation: string, rec: unknown): Record<stri
 export declare function buildDescribe(ctx: ToolContext): BuiltTool;
 /** `autotask_read`: one read by exact key, or up to 10 (`items`) with per-item results. */
 export declare function buildRead(ctx: ToolContext): BuiltTool;
-/** `autotask_tenant_status`: identity / version / thresholds; each part degrades to typed absent. */
+/** `autotask_tenant_status`: identity / version / thresholds / server; each part degrades to typed absent. */
 export declare function buildTenantStatus(ctx: ToolContext): BuiltTool;
 /** `autotask_fetch_many`: up to 500 records by numeric id across mixed resources. */
 export declare function buildFetchMany(ctx: ToolContext): BuiltTool;

package/dist/tools/meta.js

@@ -16,12 +16,13 @@
  * fail-closed refusal, then the work, with the SDK error contract mapped on failure.
  */
 import { AutotaskConfigError } from 'node-autotask';
-import { CATALOG, TOOL_NAME_BY_OP, opsForTool, recordById, servedToolName, untrustedFieldsOf } from './catalog-data.js';
+import { CATALOG, SDK_VERSION, TOOL_NAME_BY_OP, opsForTool, recordById, servedToolName, untrustedFieldsOf } from './catalog-data.js';
 import { releaseClientOnError } from './context.js';
 import { abortedAnswer, InputInvalidError, readOneItem, requestSecrets } from './dispatch.js';
 import { crossResourceUntrusted, markResult, ok, typedErrorPayload } from './results.js';
 import { bm25Rank } from './rank.js';
 import { playbooksFor } from './guide.js';
+import { SERVER_NAME, SERVER_VERSION } from './server-version.js';
 import { CATALOG_INPUT, DESCRIBE_INPUT, COMPANY_FULL_PROFILE_INPUT, CONFIGURATION_ITEM_PROFILE_INPUT, CONTACT_FULL_PROFILE_INPUT, CONTRACT_FULL_PROFILE_INPUT, FETCH_MANY_INPUT, INVOICE_GET_INPUT, PROJECT_GET_CONTEXT_INPUT, QUERY_INPUT, QUOTE_GET_INPUT, RESOLVE_INPUT, RESOURCE_WORKLOAD_INPUT, SERVICE_CALL_FULL_PROFILE_INPUT, TICKET_FULL_CONTEXT_INPUT, QUERY_LIMIT, READ_INPUT, TENANT_STATUS_INPUT, TENANT_STATUS_PARTS, closedInput, } from './schemas.js';
 import { refusalReason } from '../policy.js';
 /** Search text per catalog row (key words + purpose), built once. */
@@ -100,9 +101,9 @@ const TOOL_INPUT = {
 };
 /** Tools whose argument SHAPE (not just casing) differs from the SDK call. */
 const SHAPE_NOTES = {
-    autotask_resolve: 'flat args, not the SDK identifier + opts bag: identifier -> identifier (positional in every key); by picks the key (ticket_number -> tickets.findByTicketNumber, serial -> configuration_items.findBySerial, email -> contacts.findByEmail, id_or_name -> <resource>.resolve); no resource -> operations.resolveAny (match exact) or operations.searchAcrossResources (match contains), resource + match contains -> companies.search; the opts bag is built from expand, include_family (includeFamily), limit and resources',
+    autotask_resolve: 'flat args, not the SDK identifier + opts bag: identifier -> identifier (positional in every key); by picks the key (ticket_number -> tickets.findByTicketNumber, serial -> configuration_items.findBySerial, email -> contacts.findByEmail, id_or_name -> <resource>.resolve); no resource -> operations.resolveAny (match exact) or operations.searchAcrossResources (match contains), resource companies + match contains -> companies.search; resource tickets + match contains -> tickets.search (title contains; company_id -> companyID); the opts bag is built from expand, include_family (includeFamily), limit and resources',
     autotask_fetch_many: 'SDK items is the same [{resource, id, fields?}] array; the tool wraps it as items and sets no opts (the 500-item cap is fixed)',
-    autotask_tenant_status: 'parts [identity, version, thresholds] picks which of resources.whoAmI, version.get, threshold_information.get run (default all three); none takes args',
+    autotask_tenant_status: 'parts [identity, version, thresholds, server] picks which of resources.whoAmI, version.get, threshold_information.get run, plus the zero-wire server part (default all four); identity also returns impersonationResourceId; none takes args',
     autotask_contact_full_profile: 'takes only id (+ ticket_limit), no parentId: the tool resolves the contact by id alone',
     autotask_invoice_get: 'format selects the key: record -> invoices.get, html -> invoices.markupHtml, xml -> invoices.markupXml, pdf -> invoices.pdf; output_path is tool-only (writes the export to a file)',
 };
@@ -367,17 +368,25 @@ const STATUS_OPS = {
     version: 'version.get',
     thresholds: 'threshold_information.get',
 };
-/** `autotask_tenant_status`: identity / version / thresholds; each part degrades to typed absent. */
+/** `autotask_tenant_status`: identity / version / thresholds / server; each part degrades to typed absent. */
 export function buildTenantStatus(ctx) {
     return {
-        title: 'Show the Autotask tenant identity, API version and thresholds',
+        title: 'Show the Autotask tenant identity, API version, thresholds and server version',
         input: closedInput(TENANT_STATUS_INPUT),
         run: async (raw, signal) => {
             const args = raw;
             const parts = [...new Set(args.parts)];
             const data = {};
             let firstError;
+            // whoAmI is the API user; the resource entries are logged as is the impersonation id (null: none). Zero wire, so present even when identity degrades.
+            if (parts.includes('identity'))
+                data.impersonationResourceId = ctx.poolConfig?.impersonationResourceId ?? null;
             for (const part of parts) {
+                // Zero wire: this package's version (the same constant as serverInfo and /metadata), kept apart from the vendor `version` part.
+                if (part === 'server') {
+                    data.server = { name: SERVER_NAME, version: SERVER_VERSION, sdkVersion: SDK_VERSION, profile: ctx.config.AUTOTASK_PROFILE };
+                    continue;
+                }
                 const op = STATUS_OPS[part];
                 try {
                     const value = await ctx.ops.invokeRead(ctx.client, op, [], undefined, signal);
@@ -403,7 +412,7 @@ export function buildTenantStatus(ctx) {
                 }
             }
             // Nothing answered: the call failed, with the first part's typed error (never an empty ok).
-            if (firstError !== undefined && Object.values(data).every((v) => v?.absent !== undefined))
+            if (firstError !== undefined && parts.filter((p) => p !== 'server').every((p) => data[p]?.absent !== undefined))
                 throw firstError;
             const identity = data.identity;
             return ok(parts.includes('identity') && identity === null ? 'No Resource matched the configured user.' : `Tenant status returned (${parts.join(', ')}).`, data);

package/dist/tools/resolves.js

@@ -72,7 +72,7 @@ const COMPACT_FIELDS = {
     configuration_items: ['referenceTitle'],
     contacts: ['firstName', 'lastName'],
     projects: ['projectNumber', 'projectName'],
-    tickets: ['ticketNumber'],
+    tickets: ['ticketNumber', 'title', 'status', 'assignedResourceID'],
 };
 /** One sweep match: compact by default, the full record under `record` when `expand` (as before). */
 function matchRow(resource, record, expand) {
@@ -108,7 +108,11 @@ function resolveText(resource, identifier, record) {
 function exactMiss(resource, identifier) {
     const spec = RESOURCES[resource];
     const blind = spec.blind ? '; a miss is not proof of absence (companies the API user does not own are a blind surface)' : '';
-    const contains = resource === 'companies' ? 'For a contains match pass match: "contains"' : 'For a contains match omit resource and pass match: "contains" (a sweep)';
+    const contains = resource === 'companies'
+        ? 'For a contains match pass match: "contains"'
+        : resource === 'tickets'
+            ? 'For a title search pass match: "contains" (optionally company_id), or find it by activity with autotask_read time_entries.recentTickets'
+            : 'For a contains match omit resource and pass match: "contains" (a sweep)';
     return new NotFoundError(`resolve: no ${spec.noun} exactly matches "${identifier}" — matching is EXACT on ${spec.field}${blind}`, {
         operation: `${resource}.resolve`,
         suggestedAction: `${contains}; or fetch by numeric id via autotask_read ${spec.getOp} — then cite the record's ${spec.humanFields.join(' or ')}, never the bare id.`,
@@ -126,8 +130,11 @@ function validateCombination(a) {
         if (a.match === 'contains')
             throw new InputInvalidError(`resolve: by "${a.by}" is an exact natural-key lookup — match "contains" does not apply`, 'match');
     }
-    if (a.match === 'contains' && a.resource !== undefined && a.resource !== 'companies') {
-        throw new InputInvalidError('resolve: match "contains" applies to companies or to a sweep (omit resource) only', 'match');
+    if (a.match === 'contains' && a.resource !== undefined && a.resource !== 'companies' && a.resource !== 'tickets') {
+        throw new InputInvalidError('resolve: match "contains" applies to companies, tickets (title) or to a sweep (omit resource) only', 'match');
+    }
+    if (a.company_id !== undefined && !(a.match === 'contains' && a.resource === 'tickets')) {
+        throw new InputInvalidError('resolve: company_id scopes a tickets title search only (resource "tickets", match "contains")', 'company_id');
     }
     if (a.include_family && !(a.match === 'contains' && a.resource === 'companies')) {
         throw new InputInvalidError('resolve: include_family applies to resource "companies" with match "contains" only', 'include_family');
@@ -210,6 +217,23 @@ export function buildResolve(ctx) {
                     throw new NotFoundError(`resolve: no ${RESOURCES[resource].noun} with ${a.by} "${a.identifier}"`, { operation });
                 return ok(resolveText(resource, a.identifier, record), { resource, by: a.by, match: 'exact', ref: refOf(resource, record), record: markResult(record, ctx.untrustedFields(operation)) });
             }
+            // ---- tickets contains (#162): a title search, optionally scoped to one company, compact rows ----
+            if (a.match === 'contains' && resource === 'tickets') {
+                gate('tickets.search');
+                const opts = { limit: a.limit, ...(a.company_id !== undefined ? { companyID: a.company_id } : {}), ...(a.expand ? {} : { includeFields: ['ticketNumber', 'title', 'status', 'assignedResourceID', 'companyID'] }) };
+                const found = await ctx.ops.invokeRead(ctx.client, 'tickets.search', [String(a.identifier), opts], undefined, signal);
+                if (found === undefined)
+                    return abortedAnswer(ctx.correlationId);
+                const rows = (Array.isArray(found) ? found : []).map((t) => (a.expand ? { resource, ref: refOf('tickets', t), record: t } : { ...matchRow('tickets', t, false), ...(asRecord(t).companyID !== undefined ? { companyID: asRecord(t).companyID } : {}) }));
+                const miss = rows.length === 0 ? ' No title contains that text: the work may use other words; list the tickets the resource logged time on with autotask_read time_entries.recentTickets [from, to, {resourceID, companyID?}] to find it by activity.' : '';
+                return ok(`Ticket title search "${a.identifier}"${a.company_id !== undefined ? ` (company ${a.company_id})` : ''}: ${rows.length} match(es).${miss}`, {
+                    resource,
+                    match: 'contains',
+                    count: rows.length,
+                    truncated: rows.length >= a.limit,
+                    matches: markResult(rows, fields),
+                });
+            }
             // ---- companies contains (issue #9) ----
             if (a.match === 'contains') {
                 gate('companies.search');

package/dist/tools/schemas.d.ts

@@ -244,6 +244,7 @@ export declare const RESOLVE_INPUT: z.ZodObject<{
         exact: "exact";
         contains: "contains";
     }>>;
+    company_id: z.ZodOptional<z.ZodNumber>;
     expand: z.ZodDefault<z.ZodBoolean>;
     include_family: z.ZodDefault<z.ZodBoolean>;
     limit: z.ZodDefault<z.ZodNumber>;
@@ -317,9 +318,10 @@ export declare const FETCH_MANY_INPUT: z.ZodObject<{
         fields: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
-export declare const TENANT_STATUS_PARTS: readonly ["identity", "version", "thresholds"];
+export declare const TENANT_STATUS_PARTS: readonly ["identity", "version", "thresholds", "server"];
 export declare const TENANT_STATUS_INPUT: z.ZodObject<{
     parts: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        server: "server";
         identity: "identity";
         version: "version";
         thresholds: "thresholds";

package/dist/tools/schemas.js

@@ -211,7 +211,8 @@ export const RESOLVE_INPUT = z.object({
     resource: WF.optional().describe('Resource to resolve in; omit to sweep several.'),
     resources: z.array(WF).min(1).optional().describe('Sweep only: resources to try (default all five).'),
     by: z.enum(['id_or_name', 'ticket_number', 'serial', 'email']).default('id_or_name').describe('Identifier kind; non-default needs resource.'),
-    match: z.enum(['exact', 'contains']).default('exact').describe('contains: companies or a sweep only.'),
+    match: z.enum(['exact', 'contains']).default('exact').describe('contains: companies, tickets (title) or a sweep.'),
+    company_id: z.number().int().positive().optional().describe('tickets + contains only: scope the title search to one company id.'),
     expand: z.boolean().default(false).describe('Full record instead of the compact summary (sweep and typed).'),
     include_family: z.boolean().default(false).describe('Companies contains only: parent and child ids per match.'),
     limit: z.number().int().min(1).max(50).default(10).describe('Total matches across resources, 1-50 (companies: max 10).'),
@@ -294,9 +295,9 @@ export const FETCH_MANY_INPUT = z.object({
         .min(1)
         .describe('Up to 500 { resource, id } across resources; a miss is typed in its slot.'),
 });
-export const TENANT_STATUS_PARTS = ['identity', 'version', 'thresholds'];
+export const TENANT_STATUS_PARTS = ['identity', 'version', 'thresholds', 'server'];
 export const TENANT_STATUS_INPUT = z.object({
-    parts: z.array(z.enum(TENANT_STATUS_PARTS)).min(1).default([...TENANT_STATUS_PARTS]).describe('identity, version and/or thresholds (default all).'),
+    parts: z.array(z.enum(TENANT_STATUS_PARTS)).min(1).default([...TENANT_STATUS_PARTS]).describe('identity (API user + the impersonation resource id this server acts as), version (the Autotask API build), thresholds, server (this package + SDK version, profile); default all.'),
 });
 /**
  * The per-call name options on the four SDK-backed composites (issue #20 item 4). `names`

package/dist/tools/server-version.d.ts

@@ -0,0 +1,3 @@
+/** The wire identity of this server: a leaf module (no imports) so any tool can read it without an import cycle. */
+export declare const SERVER_NAME = "iit-mcp-autotask";
+export declare const SERVER_VERSION = "0.12.0";

package/dist/tools/server-version.js

@@ -0,0 +1,4 @@
+/** The wire identity of this server: a leaf module (no imports) so any tool can read it without an import cycle. */
+export const SERVER_NAME = 'iit-mcp-autotask';
+export const SERVER_VERSION = '0.12.0';
+//# sourceMappingURL=server-version.js.map

package/dist/tools/server.d.ts

@@ -27,8 +27,8 @@ import { type Config } from '../config.js';
 import { type TokenStore } from '../http-guard.js';
 import type { WriteRuntime } from '../write/runtime.js';
 /** The wire identity of this server (the initialize answer + the `/metadata` payload). */
-export declare const SERVER_NAME = "iit-mcp-autotask";
-export declare const SERVER_VERSION = "0.11.2";
+import { SERVER_NAME, SERVER_VERSION } from './server-version.js';
+export { SERVER_NAME, SERVER_VERSION };
 export declare const SERVER_TITLE = "Autotask MCP Server";
 /**
  * The MCP protocol era this server advertises (the `/metadata` stamp, both levels).
@@ -60,7 +60,7 @@ export declare function serverInstructions(config: Pick<Config, 'AUTOTASK_PROFIL
 /** The full identity stamp (the `/metadata` build block — the era pair, FR-2). */
 export declare const SERVER_IDENTITY: {
     readonly name: "iit-mcp-autotask";
-    readonly version: "0.11.2";
+    readonly version: "0.12.0";
     readonly mcpProtocolBaseline: "2026-07-28";
     readonly legacyProtocolFallback: "2025-11-25";
 };

package/dist/tools/server.js

@@ -28,8 +28,8 @@ import { skillsFor } from './guide.js';
 import { registerTools } from './register.js';
 import { configForToken } from '../http-guard.js';
 /** The wire identity of this server (the initialize answer + the `/metadata` payload). */
-export const SERVER_NAME = 'iit-mcp-autotask';
-export const SERVER_VERSION = '0.11.2';
+import { SERVER_NAME, SERVER_VERSION } from './server-version.js';
+export { SERVER_NAME, SERVER_VERSION };
 export const SERVER_TITLE = 'Autotask MCP Server';
 /**
  * The MCP protocol era this server advertises (the `/metadata` stamp, both levels).

package/dist/tools/write/preview.js

@@ -102,8 +102,31 @@ async function dryRun(r, a) {
     }
     return { ok: dry };
 }
+/**
+ * #163: who a time entry is for. A preview-only read (never in the plan hash): the resource's name and
+ * the entry's role echoed so the operator sees the human, not just an id. A miss is typed absent, never a failure.
+ */
+async function entryResource(r, a) {
+    if (r.op !== 'time_entries.create')
+        return undefined;
+    const data = a.parsed.data;
+    const id = data?.resourceID;
+    if (typeof id !== 'number' || !Number.isInteger(id) || id <= 0)
+        return undefined;
+    const roleID = typeof data?.roleID === 'number' ? data.roleID : null;
+    try {
+        const res = (await r.ctx.ops.invokeRead(r.ctx.client, 'resources.get', [id], undefined, r.signal));
+        if (res === undefined || res === null)
+            return { id, roleID, name: null };
+        const name = typeof res.name === 'string' ? res.name : [res.firstName, res.lastName].filter((x) => typeof x === 'string' && x !== '').join(' ');
+        return { id, roleID, name: cleanUntrustedText(name, false).slice(0, 100) || null };
+    }
+    catch {
+        return { id, roleID, name: null, absent: true };
+    }
+}
 /** The policy decision over the derived facts, its audit row and the preview the answers carry. */
-function evaluatePhase(r, a, snap, dry) {
+function evaluatePhase(r, a, snap, dry, resource) {
     const { ctx, w, store, loaded, args, op, audit } = r;
     const { record, shape, parsed } = a;
     const now = w.runtime.now();
@@ -120,6 +143,7 @@ function evaluatePhase(r, a, snap, dry) {
         diff: markedDiff(dry.diff),
         warnings: (dry.warnings ?? []).slice(0, 20).map((x) => String(x)),
         impact: honestImpact(dry.impact, shape),
+        ...(resource !== undefined ? { resource } : {}),
         ...(shape === 'move' ? { move: moveSummary(record, parsed.targets, snap.current, dry.data, facts) } : {}),
     };
     return { now, tenantId, facts, decision, planHash, preview };
@@ -217,7 +241,7 @@ export function buildWrite(ctx) {
             const dry = await dryRun(r, admitted.ok);
             if ('stop' in dry)
                 return dry.stop;
-            return persist(r, admitted.ok, snap.ok, evaluatePhase(r, admitted.ok, snap.ok, dry.ok));
+            return persist(r, admitted.ok, snap.ok, evaluatePhase(r, admitted.ok, snap.ok, dry.ok, await entryResource(r, admitted.ok)));
         },
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "iit-mcp-autotask",
-  "version": "0.11.2",
+  "version": "0.12.0",
   "description": "MCP server for the Autotask (Datto) PSA domain, built on the node-autotask SDK",
   "license": "MIT",
   "author": "Max Soukhomlinov",
@@ -53,7 +53,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/server": "^2.2.0",
-    "node-autotask": "0.23.0",
+    "node-autotask": "0.24.0",
     "zod": "^4.6.7"
   },
   "devDependencies": {

package/server.json

@@ -1,6 +1,6 @@
 {
   "name": "iit-mcp-autotask",
-  "version": "0.11.2",
+  "version": "0.12.0",
   "description": "MCP server for the Autotask (Datto) PSA API, powered by the node-autotask SDK",
   "mcpProtocolBaseline": "2026-07-28",
   "legacyProtocolFallback": "2025-11-25",
@@ -63,7 +63,7 @@
   "capabilitiesManifest": "capabilities.json",
   "sdk": {
     "package": "node-autotask",
-    "versionRange": "0.23.0"
+    "versionRange": "0.24.0"
   },
   "vendorExtensions": false,
   "credentialModelNote": "per-request; server-held under stdio or, on HTTP, only behind AUTOTASK_HTTP_AUTH=tokens; operator plans and the ledger are keyed by principal and tenant id, never by credential, and an apply uses the credential on the apply request"

package/skills/log-time-entry.md

@@ -5,7 +5,7 @@ version: 1
 profile: operator
 description: Log time on one ticket: resolve it, preview the time entry, apply that plan, confirm the stored entry.
 when_not_to_use: editing or deleting time entries; moving an entry to another ticket (time_entries.moveToTicket via autotask_write, args [sourceId, toTicketId]; an update of ticketID does not persist); bulk imports; time reports (use autotask_query time_entries)
-ops: ["autotask_resolve:tickets.findByTicketNumber", "autotask_read:billing_codes.query", "autotask_write:time_entries.create", "autotask_apply", "autotask_query:time_entries.query"]
+ops: ["autotask_resolve:tickets.findByTicketNumber", "autotask_resolve:tickets.search", "autotask_read:billing_codes.query", "autotask_write:time_entries.create", "autotask_apply", "autotask_query:time_entries.query"]
 inputs: {"type": "object", "required": ["ticket", "resourceID", "dateWorked", "hoursWorked", "summaryNotes", "run_id"], "properties": {"ticket": {"type": ["string", "integer"], "description": "Ticket number (T20260101.0001) or numeric ticket id"}, "resourceID": {"type": "integer", "description": "Numeric id of the resource who did the work"}, "roleID": {"type": "integer", "description": "Numeric role id, when the tenant needs one"}, "dateWorked": {"type": "string", "description": "YYYY-MM-DD"}, "startDateTime": {"type": "string", "description": "ISO 8601 UTC start; Service tickets need it"}, "endDateTime": {"type": "string", "description": "ISO 8601 UTC end; Service tickets need it"}, "hoursWorked": {"type": "number", "description": "Hours, e.g. 1.5"}, "billingCodeID": {"type": "integer", "description": "Active general allocation code (work type)"}, "summaryNotes": {"type": "string", "description": "What was done"}, "run_id": {"type": "string", "description": "The caller's run id: the idempotency key"}}}
 outcomes: ["ok", "needs_input", "needs_approval", "denied", "error"]
 hazards: ["writes one time entry to the PSA", "zone ww29: an API-only user cannot log time (a 500 business-rule error, failed)", "Service tickets refuse hours-only entries: send startDateTime and endDateTime", "ww29 (verified live 2026-10-18): ticketed entries require a roleID and an active general billingCodeID - the vendor refuses missing ones with a deterministic 500 (failed, nothing written)"]
@@ -23,7 +23,7 @@ eval: evals/log-time-entry.json
 
 ## Steps
 
-1. A ticket number: `autotask_resolve {identifier: "<ticket>", resource: "tickets", by: "ticket_number"}`; keep `data.record.id`. A numeric id skips this step.
+1. A ticket number: `autotask_resolve {identifier: "<ticket>", resource: "tickets", by: "ticket_number"}`; keep `data.record.id`. A numeric id skips this step. No ticket named: `autotask_resolve {identifier: "<title words>", resource: "tickets", match: "contains", company_id: <id>}` (compact rows). Zero rows is not proof of absence: `autotask_read {operation: "time_entries.recentTickets", args: [from, to, {resourceID, companyID}]}` lists the tickets the resource logged time on: pick one.
 2. No `billingCodeID` in the task: `autotask_read {operation: "billing_codes.query", args: [{filter: [{field: "isActive", op: "eq", value: true}, {field: "useType", op: "eq", value: 1}], limit: 10}]}`; take `id` from a returned record (never from result prose). None: return `needs_input` for `billingCodeID`. The answer is `data.results[0].result`.
 3. Preview: `autotask_write {operation: "time_entries.create", args: [{resourceID, ticketID: <id>, roleID?, billingCodeID, dateWorked, startDateTime?, endDateTime?, hoursWorked, summaryNotes}], idempotency_key: "<run_id>:time-entry"}`. Nothing is written. Read `status`:
    - `ok`: keep `plan`; go to step 4.
@@ -70,6 +70,7 @@ The entry read back in step 5 has the ticket id, resource, date and hours of the
 | Tool | Operation | Effect | Required args |
 |---|---|---|---|
 | autotask_resolve | tickets.findByTicketNumber | read | value |
+| autotask_resolve | tickets.search | read | query |
 | autotask_read | billing_codes.query | read | - |
 | autotask_write | time_entries.create | write | data |
 | autotask_apply | - | - | - |