node-autotask 0.16.0 → 0.18.0

package/ARCHITECTURE.md

@@ -396,8 +396,13 @@ The only total is `count()` (`/query/count`); "more rows exist" is `nextPageUrl
 The node follows `pageDetails.nextPageUrl` (an absolute vendor URL, POSTing the
 filter to it), and the SDK does the same: the walk is the fetcher
 (`BaseResource.fetchPage`), which POSTs the `QueryModel` body to
-`/V1.0/<E>/query` for page 1 (`MaxRecords = pageSize`) and POSTs the preserved
-filter to the ABSOLUTE cursor for every later page. The cursor is rebased to
+`/V1.0/<E>/query` for page 1 (`MaxRecords = pageSize`) and POSTs the SAME body
+(`buildQueryBody` — `MaxRecords`, `IncludeFields` with the `id` append, the
+preserved `filter`) to the ABSOLUTE cursor for every later page (issue #118:
+before the fix the continuation carried `{ filter }` alone and returned the
+full vendor model). Live-verified 2026-10-19: the vendor HONOURS
+`IncludeFields` on a continuation and IGNORES `MaxRecords` (its own 500-row
+page; the walk slices to its limit). The cursor is rebased to
 the client base URL (`cursorToPath`): same-origin cursors are stripped of the
 base and used verbatim, cross-origin ones are re-based onto the client base —
 mirroring the node's custom-zone behaviour. A page reports `hasMore` when
@@ -993,8 +998,9 @@ export const NoopLogger: Logger = {};
   envelope pass-through, per-envelope unwrap errors, error mapping per status (vendor error
   body formatting), retry/backoff on 429 with `Retry-After`, `Itgenatr005` as retryable
   `RateLimitError`, `AbortSignal` timeout, concurrency guard.
-- **Pagination (`pagination.test.ts`)**: multi-page cursor-follow walk (POST the filter
-  to the absolute `nextPageUrl`, rebased to the client base URL), early stop on short
+- **Pagination (`pagination.test.ts`)**: multi-page cursor-follow walk (POST the same
+  `QueryModel` body to the absolute `nextPageUrl`, rebased to the client base URL;
+  issue #118 pins the continuation's `IncludeFields`/`MaxRecords`), early stop on short
   page, **1000-page guard** (`PaginationLimitError`), `collectAll` equivalence.
 - **Query (`query.test.ts`)**: filter builder (13 operators, and/or wrapping, UDF flag),
   cap enforcement (500 OR-conditions, 1 UDF/query), GET-length measurement.

package/MCP_TOOL_CATALOG.json

@@ -1,7 +1,7 @@
 {
   "generatedBy": "scripts/build-tool-catalog.mjs",
-  "generatedAt": "2026-10-17T13:48:44.078Z",
-  "planHash": "bd88648453f58ede018062ce66acefacb672fecaa450af89f421057809971e14",
+  "generatedAt": "2026-10-19T05:26:26.501Z",
+  "planHash": "5176d37fc9bae34139c151ae0ea8336dab63a30382f04acbcaed0e24cdd71d5f",
   "metaTools": [
     {
       "name": "autotask_catalog",

package/MCP_TOOL_MANIFEST.md

@@ -1,6 +1,6 @@
 # MCP Tool Manifest — node-autotask
 
-<!-- GENERATED by scripts/project-mcp-tools.mjs at 2026-10-17T13:48:43.787Z — do not hand-edit. -->
+<!-- GENERATED by scripts/project-mcp-tools.mjs at 2026-10-19T05:26:26.653Z — do not hand-edit. -->
 
 Mechanical MCP projection of the capability registry (generator-design section 7, ARCHITECTURE section 19.5).
 Tool names are the plan `mcpTool` columns (entity-first `autotask_<entity>_<verb>`); descriptions are the
@@ -8,7 +8,7 @@ registry `purpose` + a mechanical bounds/flags sentence; annotations derive from
 Curation edits live ONLY in `MCP_TOOL_OVERRIDES.json` (records `{ tool, field, newValue, reason }`).
 
 Registry: 1213 operations; projected tools: 850 (one per registry op with a non-null `mcpTool`);
-not projected (catalog/describe material): 363. planHash: `bd88648453f58ede…`
+not projected (catalog/describe material): 363. planHash: `5176d37fc9bae341…`
 
 ## Always-on core tier (CORE_RULE — computed, never a hand list)
 
@@ -947,8 +947,8 @@ singleton, so no helper tier is expected there; G8, 2026-09-26.)
 
 ## Meta
 
-- generatedAt: 2026-10-17T13:48:43.787Z
-- planHash: bd88648453f58ede018062ce66acefacb672fecaa450af89f421057809971e14
+- generatedAt: 2026-10-19T05:26:26.653Z
+- planHash: 5176d37fc9bae34139c151ae0ea8336dab63a30382f04acbcaed0e24cdd71d5f
 - registry records: 1213
 - projected tools: 850
 - core tier: 15

package/N8N_MCP_MANIFEST.json

@@ -1,6 +1,6 @@
 {
   "schema": "node-autotask n8n consumer mcp projection v1",
-  "generatedAt": "2026-10-17T13:48:43.907Z",
+  "generatedAt": "2026-10-19T05:26:26.775Z",
   "generator": "scripts/project-n8n-mcp.mjs",
   "inputs": {
     "capabilities": "capabilities.json (the capability registry — the single source of truth)",
@@ -3667,6 +3667,6 @@
     "approvalGatedWrites": 2,
     "destructiveExcluded": 3
   },
-  "capabilitiesHash": "fd92667b96dd9c74d9bbda2a34bf50b9791e2f236a6d2bb50b50a02a1d064882",
+  "capabilitiesHash": "d30f65bc49ac2898667865b753c0f0cd3f0c951c337a1036b48b049e8c32c61a",
   "curationHash": "e19117ce73e38d9aded3be7e7f077a4e185d2e10294622b76c17d67f63cf9e3b"
 }

package/N8N_MCP_MANIFEST.md

@@ -1,6 +1,6 @@
 # N8N MCP Manifest — node-autotask (consumer projection)
 
-<!-- GENERATED by scripts/project-n8n-mcp.mjs at 2026-10-17T13:48:43.907Z — do not hand-edit. -->
+<!-- GENERATED by scripts/project-n8n-mcp.mjs at 2026-10-19T05:26:26.775Z — do not hand-edit. -->
 
 The n8n CONSUMER projection of the capability registry: the canonical source for what the
 n8n-side MCP tools must expose. The SDK is canonical — this is a projection of it, never a
@@ -282,6 +282,6 @@ only via a recorded change to `n8n-mcp.curation.json`.
 
 ## Meta
 
-- generatedAt: 2026-10-17T13:48:43.907Z
-- capabilitiesHash: fd92667b96dd9c74d9bbda2a34bf50b9791e2f236a6d2bb50b50a02a1d064882
+- generatedAt: 2026-10-19T05:26:26.775Z
+- capabilitiesHash: d30f65bc49ac2898667865b753c0f0cd3f0c951c337a1036b48b049e8c32c61a
 - curationHash: e19117ce73e38d9aded3be7e7f077a4e185d2e10294622b76c17d67f63cf9e3b

package/README.md

@@ -147,6 +147,42 @@ length and a two-character prefix per value — never a full value. See
 [`docs/LIVE-TESTING.md`](./docs/LIVE-TESTING.md) §0b.
 
 
+### The full variable set
+
+`.env.example` is the committed template; `.env*` is gitignored, so real values never enter git.
+
+```sh
+cp .env.example .env      # then fill in the three credentials
+```
+
+Optional settings are **commented out with a sample value** — uncomment a line to set it. For example
+`AUTOTASK_PROFILE=agent` selects the conservative agent profile (page 25, 8,000/hr, 20 s timeout,
+1 retry, 3 concurrent), and `AUTOTASK_MAX_RETRIES=1` is that profile's retry budget. Leave the five
+server-layer overrides unset rather than blank: an empty value is *invalid* for them by design
+(fail-closed), so a stray `AUTOTASK_MAX_RETRIES=` stops startup with an error naming the variable.
+
+| variable | read by | meaning |
+|---|---|---|
+| `AUTOTASK_TRACKING_IDENTIFIER` | `bin/doctor.js`, examples, live scripts | API tracking identifier (aliases: `AUTOTASK_API_CODE`, `AUTOTASK_API_INTEGRATION_CODE`) |
+| `AUTOTASK_USERNAME` | same | API user (alias: `AUTOTASK_USER`) |
+| `AUTOTASK_SECRET` | same | secret — see the single-quote contract above |
+| `AUTOTASK_ZONE` | doctor, examples, live scripts | **catalog name**, not a host (default `old-australian` = webservices6); `other` requires a base URL — the template lists all 23 |
+| `AUTOTASK_BASE_URL` | doctor, examples, live scripts | explicit REST base; **wins** over the zone; include `/atservicesrest` |
+| `AUTOTASK_IMPERSONATION_ID` | doctor, examples | optional `ImpersonationResourceId` header |
+| `AUTOTASK_PROFILE` | reference MCP servers | `library` (default) / `agent` — the agent profile's numbers are compared in the template and in *Agent profile* above |
+| `AUTOTASK_RATE_LIMIT_PER_HOUR` | reference MCP servers | hourly limiter: a positive integer, or `0` / `off` to disable |
+| `AUTOTASK_MAX_CONCURRENT` | reference MCP servers | concurrency guard (vendor max 10) |
+| `AUTOTASK_TIMEOUT_MS` | reference MCP servers | whole-call timeout |
+| `AUTOTASK_MAX_RETRIES` | reference MCP servers | retry budget (`0` disables) |
+| `AUTOTASK_UNTRUSTED_WRAP` | MCP servers | `on` (default) / `off` — the `<untrusted_content>` projection |
+| `AUTOTASK_GATEWAY_MODE` | `examples/mcp-server-http.ts` | `on` for multi-tenant gateway mode (per-request credentials) |
+| `PORT` | `examples/mcp-server-http.ts` | listen port (default 7437) |
+| `AUTOTASK_ENV_FILE` | live scripts | alternate `.env` path (shell variables always win) |
+
+The SDK itself never reads `process.env`: pass `apiIntegrationCode` / `userName` / `secret`
+explicitly, or call `loadAutotaskCredentialsFromEnv()`.
+
+
 ## Agent profile (conservative limits for LLM-driven servers)
 
 `profile: 'agent'` on the config switches the SDK to conservative limits for