node-autotask 0.18.0 → 0.20.0

package/dist/{chunk-WRWX6WIK.cjs → chunk-L6V66V22.cjs}

@@ -1,6 +1,6 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; } var _class; var _class2; var _class3; var _class4; var _class5; var _class6;
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; } var _class; var _class2; var _class3; var _class4; var _class5; var _class6; var _class7;
 
-var _chunk5O5EPYBOcjs = require('./chunk-5O5EPYBO.cjs');
+var _chunkFLYTKJKVcjs = require('./chunk-FLYTKJKV.cjs');
 
 // src/auth.ts
 var AUTH_HEADERS = {
@@ -1536,6 +1536,7 @@ var DEFAULT_TIMEOUT_MS = 3e4;
 var DEFAULT_MAX_RETRIES = 3;
 var DEFAULT_MAINTENANCE_MAX_WAIT_MS = 36e5;
 var DEFAULT_MAINTENANCE_POLL_MS = 3e4;
+var MAINTENANCE_WINDOW_MAX_MS = 4 * 36e5;
 var DEFAULT_MAX_CONCURRENT = 10;
 var DEFAULT_MAX_RESPONSE_BYTES = 64 * 1024 * 1024;
 var DEFAULT_MAX_SCAN_RECORDS = 500;
@@ -2073,6 +2074,88 @@ function refusedFilterShape(filter) {
 // src/http.ts
 var _async_hooks = require('async_hooks');
 
+// src/latest-count-cache.ts
+var LATEST_COUNT_CACHE_TTL_MS = 3e4;
+var LATEST_COUNT_CACHE_MAX_ENTRIES = 4096;
+var LatestCountCache = (_class6 = class {
+  /** The TTL in ms. */
+  
+  /** The entry bound (applies to STORED entries). */
+  
+  __init10() {this.store = /* @__PURE__ */ new Map()}
+  /** The invalidation epoch (the `ReadCache` pattern — issue #139): bumped
+   * by `clear()`; capture it before a wire read and pass it to `set` so a
+   * probe in flight across a write cannot re-store its stale answer. */
+  __init11() {this.epochCounter = 0}
+  constructor(ttlMs, maxEntries = LATEST_COUNT_CACHE_MAX_ENTRIES) {;_class6.prototype.__init10.call(this);_class6.prototype.__init11.call(this);
+    if (!Number.isInteger(ttlMs) || ttlMs <= 0) {
+      throw new AutotaskConfigError(`latestCountCache.ttlMs must be a positive integer (got ${String(ttlMs)})`);
+    }
+    if (!Number.isInteger(maxEntries) || maxEntries <= 0) {
+      throw new AutotaskConfigError(`latestCountCache.maxEntries must be a positive integer (got ${String(maxEntries)})`);
+    }
+    this.ttlMs = ttlMs;
+    this.maxEntries = maxEntries;
+  }
+  /** The composite key: (resource plan key, canonical filter serialisation)
+   * — the `\u0000` separator is unencodable in a filter value, so no two
+   * (resource, conditions) pairs collide. */
+  static key(resourceKey, conditions) {
+    return `${resourceKey}\0${JSON.stringify(_nullishCoalesce(conditions, () => ( [])))}`;
+  }
+  /** The live entry's count, or `undefined` (absent OR expired — an expired
+   * entry is purged lazily on this read). */
+  get(key) {
+    const entry = this.store.get(key);
+    if (entry === void 0) return void 0;
+    if (entry.expiresAt <= Date.now()) {
+      this.store.delete(key);
+      return void 0;
+    }
+    return entry.value;
+  }
+  /** The invalidation epoch: bumped by `clear()`; capture it before a wire
+   * read and pass it to `set` so a probe in flight across a write cannot
+   * re-store its stale answer (issue #139, the `ReadCache` pattern). */
+  get epoch() {
+    return this.epochCounter;
+  }
+  /** Store a SUCCESSFUL plain-number count under `key`, live for `ttlMs`.
+   * `epoch` is the invalidation epoch the caller captured BEFORE its wire
+   * read: a probe that straddled a `clear()` (a write) is dropped, never
+   * re-stored with its pre-write body (issue #139). Past the cap: purge
+   * expired entries first, then evict the oldest-inserted (Map iteration
+   * order = insertion order). */
+  set(key, value, epoch = this.epochCounter) {
+    if (epoch !== this.epochCounter) return;
+    if (!Number.isFinite(value)) return;
+    const entry = { value, expiresAt: Date.now() + this.ttlMs };
+    if (!this.store.has(key) && this.store.size >= this.maxEntries) {
+      for (const [k, e] of this.store) {
+        if (e.expiresAt <= Date.now()) this.store.delete(k);
+      }
+      if (this.store.size >= this.maxEntries) {
+        const oldest = this.store.keys().next();
+        if (!oldest.done) this.store.delete(oldest.value);
+      }
+    }
+    this.store.set(key, entry);
+  }
+  /** Drop one entry (absent = no-op). Issue #157: the stale-LOW recovery
+   *  deletes the cached total before its one fresh wire re-probe, so the
+   *  re-probe cannot be served by the entry it is meant to replace. */
+  delete(key) {
+    this.store.delete(key);
+  }
+  /** Clear every entry (a real write through the owning client — the
+   * write-then-read re-fetch rule) and bump the invalidation epoch: a
+   * `set` captured before this `clear` is discarded (issue #139). */
+  clear() {
+    this.epochCounter += 1;
+    this.store.clear();
+  }
+}, _class6);
+
 // src/relationships.ts
 var RELATIONSHIP_ZONE = {
   "zone": "ww29",
@@ -8305,7 +8388,7 @@ var RELATIONSHIP_MAP = {
     ],
     "naturalKeys": {
       "hasSearch": true,
-      "searchCovers": "title only (contains); ticketNumber lookups use resolve / findByTicketNumber",
+      "searchCovers": "title only (contains \u2014 the vendor's contains match is looser than a literal substring (case/token matching): a search can return MORE hits than a local title-substring check (measured 2026-10-19: 25 vs 24); a per-field contains filter in tickets.query is the precise tool); ticketNumber lookups use resolve / findByTicketNumber",
       "findBy": [
         "findByTicketNumber"
       ]
@@ -10252,8 +10335,8 @@ var EMPTY_REASON_STAMPS = {
 var POINTER_NOTES = {
   "ticket_history.query": `W1 (ww29 (australia-nz) live 2026-10-04; vendor contract change live-verified 2026-10-06): the vendor requires ticket_history.query to be supplied with exactly ONE ticketID-equals filter \u2014 an unfiltered call 500s by contract (10-06 text: "When querying the TicketHistory entity you are required to supply one and only one ticketID equals filter"). WITH the filter the query WORKS (live 2026-10-06: rows returned, hasMore true \u2014 a single {op:'eq', field:'ticketID', value:<id>} condition; the filter vocabulary is eq/noteq/gt/gte/lt/lte/beginsWith/endsWith/contains/exist/notExist/in/notIn/and/or). tickets.timeline / tickets.fullContext remain the convenient composites; raw history rows come from the filtered query.`,
   "time_entries.create": `W-A3 (ww29 (australia-nz) live 2026-10-04; drift re-verified 2026-10-06): the vendor now refuses ALL time-entry writes for this API-only user with "API-only user cannot be selected for this field" (10-04 text: "The specified AssignedResourceID and AssignedRoleID combination is not currently defined"). UNSATISFIABLE for an API-only integration user: the resources table is blind (0 rows) and the only selectable resource is the user's own API-only record, which the vendor refuses. createForResource \u2014 stage-11 PROVEN (8 live creates, 10-04) \u2014 is walled by the SAME drift (confirm-100 receipt 2026-10-06). Tenant evidence that valid pairs exist: postedWithin rows (resourceID 31131373 / 29869529 with roleID 29682834) \u2014 human resources the API user cannot select.`,
-  "time_entries.getPosted": `W-D3 (ww29 (australia-nz) live 2026-10-04, re-verified live 2026-10-15): this zone's TimeEntry entity exposes NO posted-state filter field \u2014 the vendor rejects postingStatus, postedDate and status with "Unable to find X in the TimeEntry Entity" (live field-existence oracle 2026-10-04: only dateWorked / resourceID / ticketID / taskID resolve as filter fields). Re-probed 2026-10-15 (ww29 re-probe campaign): time_entries.getPosted live 500, vendor body verbatim 'Unable to find postedDate in the TimeEntry Entity.' \u2014 a vendor endpoint defect on AU03, not a transient fault: posted cannot be filtered server-side on this zone \u2014 use time_entries.postedWithin (the dateWorked window, live-verified working) or read time_entries.query and derive posted-state from the fields your zone's entity exposes`,
-  "time_entries.getUnposted": `W-D3 (ww29 (australia-nz) live 2026-10-04, re-verified live 2026-10-15): this zone's TimeEntry entity exposes NO posted-state filter field \u2014 the vendor rejects postingStatus, postedDate and status with "Unable to find X in the TimeEntry Entity" (live field-existence oracle 2026-10-04: only dateWorked / resourceID / ticketID / taskID resolve as filter fields). Re-probed 2026-10-15 (ww29 re-probe campaign): time_entries.getUnposted live 500, vendor body verbatim 'Unable to find postedDate in the TimeEntry Entity.' \u2014 a vendor endpoint defect on AU03, not a transient fault: unposted cannot be filtered server-side on this zone \u2014 use time_entries.postedWithin (the dateWorked window, live-verified working) or read time_entries.query and derive posted-state from the fields your zone's entity exposes`,
+  "time_entries.getPosted": "W-D3 (ww29 (australia-nz) live 2026-10-04, re-verified live 2026-10-15): this zone's TimeEntry entity exposes NO posted-state filter field \u2014 the vendor rejects postingStatus, postedDate and status with \"Unable to find X in the TimeEntry Entity\" (live field-existence oracle 2026-10-04: only dateWorked / resourceID / ticketID / taskID resolve as filter fields). Re-probed 2026-10-15 (ww29 re-probe campaign): time_entries.getPosted live 500, vendor body verbatim 'Unable to find postedDate in the TimeEntry Entity.' \u2014 a vendor endpoint defect on AU03, not a transient fault: posted cannot be filtered server-side on this zone \u2014 use time_entries.postedWithin (the dateWorked window, live-verified working \u2014 omit the `posted` narrowing on this zone: it sends postedDate, which the zone 500s) or read time_entries.query and derive posted-state from the fields your zone's entity exposes",
+  "time_entries.getUnposted": "W-D3 (ww29 (australia-nz) live 2026-10-04, re-verified live 2026-10-15): this zone's TimeEntry entity exposes NO posted-state filter field \u2014 the vendor rejects postingStatus, postedDate and status with \"Unable to find X in the TimeEntry Entity\" (live field-existence oracle 2026-10-04: only dateWorked / resourceID / ticketID / taskID resolve as filter fields). Re-probed 2026-10-15 (ww29 re-probe campaign): time_entries.getUnposted live 500, vendor body verbatim 'Unable to find postedDate in the TimeEntry Entity.' \u2014 a vendor endpoint defect on AU03, not a transient fault: unposted cannot be filtered server-side on this zone \u2014 use time_entries.postedWithin (the dateWorked window, live-verified working \u2014 omit the `posted` narrowing on this zone: it sends postedDate, which the zone 500s) or read time_entries.query and derive posted-state from the fields your zone's entity exposes",
   "authenticate.get": "W2: authenticate.get is DESIGNATOR-ONLY \u2014 it returns the designator identity, not a tenant data surface; a miss/empty here is not a data-empty signal (no emptyReason is attached by design \u2014 a false reason would be worse than none)"
 };
 var BLIND_SURFACE_INVENTORY = {
@@ -14779,9 +14862,21 @@ function backoffDelay(attempt) {
   const exp = Math.min(BACKOFF_CAP_MS, BACKOFF_BASE_MS * 2 ** attempt);
   return Math.floor(exp / 2 + Math.random() * (exp / 2));
 }
-function isMaintenancePage(err) {
-  const snippet = typeof _optionalChain([err, 'access', _57 => _57.details, 'optionalAccess', _58 => _58.bodySnippet]) === "string" ? err.details.bodySnippet : "";
-  return /maintenance|temporarily unavailable|service unavailable|outage|downtime|down for/i.test(snippet);
+var MAINTENANCE_PROBE_BYTES = 256;
+function maintenanceProbe(text) {
+  return Buffer.from(text, "utf8").subarray(0, MAINTENANCE_PROBE_BYTES).toString("utf8");
+}
+function looksLikeMaintenanceText(text) {
+  return /maintenance|temporarily unavailable|service unavailable|outage|downtime|down for/i.test(
+    maintenanceProbe(text)
+  );
+}
+function isHtmlLike(contentType, body) {
+  if (contentType !== null && /text\/html|application\/xhtml/i.test(contentType)) return true;
+  return body.trimStart().startsWith("<");
+}
+function maintenanceExhaustedAction(maxWaitMs, waits) {
+  return `The zone stayed in a maintenance window for ${Math.round(maxWaitMs / 6e4)} min \u2014 the SDK waited and retried ${waits} time(s) and gave up. Re-run after the window (the observed median is about 2 h; the ceiling is 4 h \u2014 MAINTENANCE_WINDOW_MAX_MS), or raise maintenanceMaxWaitMs.`;
 }
 function parseRetryAfter(value) {
   if (value === null || value.length === 0) return void 0;
@@ -14799,7 +14894,7 @@ function isAbortLike(err) {
   return typeof err === "object" && err !== null && "name" in err && err.name === "AbortError";
 }
 function isJsonMediaType(header) {
-  const mediaType = _nullishCoalesce(_optionalChain([header, 'access', _59 => _59.split, 'call', _60 => _60(";"), 'access', _61 => _61[0], 'optionalAccess', _62 => _62.trim, 'call', _63 => _63(), 'access', _64 => _64.toLowerCase, 'call', _65 => _65()]), () => ( ""));
+  const mediaType = _nullishCoalesce(_optionalChain([header, 'access', _57 => _57.split, 'call', _58 => _58(";"), 'access', _59 => _59[0], 'optionalAccess', _60 => _60.trim, 'call', _61 => _61(), 'access', _62 => _62.toLowerCase, 'call', _63 => _63()]), () => ( ""));
   return mediaType.startsWith("application/json") || mediaType.endsWith("+json");
 }
 function bodySnippet(text, redactPersonalData) {
@@ -14846,7 +14941,7 @@ function credentialShapeExpectation(headers, auth) {
     ...problem !== void 0 ? { problem } : {}
   };
 }
-var HttpClient = (_class6 = class {
+var HttpClient = (_class7 = class {
   /**
    * The LIVE base URL (issue #43): the construction-time value until a zone
    * re-point happens, then the tenant's newly resolved zone base. Reads are
@@ -14875,6 +14970,11 @@ var HttpClient = (_class6 = class {
   
   /** Resource-name cache for `operations.expandResourceNames` (issue #80: the default instance when `resourceNameCache` is absent; undefined only when the user set `false` explicitly, issue #65). */
   
+  /** The `latest` walk's count-probe cache (issue #127: the short-TTL
+   * per-client count cache — ALWAYS on, process-internal: no config
+   * surface, no served keys; the plain `count` op and `operations.aggregate`
+   * bypass it by construction and promise fresh totals). */
+  
   /** Resolved update fallback gate (issue #34; OFF by default). */
   
   
@@ -14888,7 +14988,7 @@ var HttpClient = (_class6 = class {
    * exhaustion `suggestedAction` (stop/narrow, never "raise the limit"). */
   
   /** Request timestamps inside the trailing hour (only used when `rateLimit.perHour` is set). */
-  __init10() {this.hourStamps = []}
+  __init12() {this.hourStamps = []}
   /** Tenant 429 cooldown gate store (undefined when the gate is disabled). */
   
   
@@ -14932,14 +15032,15 @@ var HttpClient = (_class6 = class {
    * already travels in every auth header; nothing new crosses the boundary). */
   
   
-  __init11() {this.inFlight = 0}
-  __init12() {this.waitQueue = []}
-  constructor(config) {;_class6.prototype.__init10.call(this);_class6.prototype.__init11.call(this);_class6.prototype.__init12.call(this);
+  __init13() {this.inFlight = 0}
+  __init14() {this.waitQueue = []}
+  constructor(config) {;_class7.prototype.__init12.call(this);_class7.prototype.__init13.call(this);_class7.prototype.__init14.call(this);
     this.liveBaseUrl = config.baseUrl;
     this.resolution = config.resolution;
     this.readCache = config.readCache;
     this.fieldCache = config.fieldCache;
     this.resourceNameCache = config.resourceNameCache;
+    this.latestCountCache = new LatestCountCache(LATEST_COUNT_CACHE_TTL_MS);
     this.update = config.update;
     this.zone = config.zone;
     this.reResolveZoneOn401 = config.reResolveZoneOn401;
@@ -14955,7 +15056,7 @@ var HttpClient = (_class6 = class {
     this.maintenanceMaxWaitMs = config.maintenanceMaxWaitMs;
     this.maintenancePollMs = config.maintenancePollMs;
     this.maxResponseBytes = config.maxResponseBytes;
-    this.perHour = _optionalChain([config, 'access', _66 => _66.rateLimit, 'optionalAccess', _67 => _67.perHour]);
+    this.perHour = _optionalChain([config, 'access', _64 => _64.rateLimit, 'optionalAccess', _65 => _65.perHour]);
     this.tenantKey = buildTenantKey(config.userName, config.baseUrl);
     this.cooldownStore = config.cooldown.enabled ? _nullishCoalesce(config.cooldown.store, () => ( defaultCooldownStore())) : void 0;
     this.cooldownMaxMs = config.cooldown.maxMs;
@@ -15016,7 +15117,7 @@ var HttpClient = (_class6 = class {
     };
     if (next.successes >= breaker.successesToClose) {
       breaker.store.delete(key);
-      _optionalChain([this, 'access', _68 => _68.logger, 'access', _69 => _69.warn, 'optionalCall', _70 => _70(
+      _optionalChain([this, 'access', _66 => _66.logger, 'access', _67 => _67.warn, 'optionalCall', _68 => _68(
         `[autotask] circuit breaker CLOSED for ${key} (${next.successes} probe successes)`,
         void 0
       )]);
@@ -15046,7 +15147,7 @@ var HttpClient = (_class6 = class {
       const failures = [...st.failures.filter((t) => t > now - breaker.failureWindowMs), now];
       if (failures.length >= breaker.failureThreshold) {
         breaker.store.set(key, { failures, openedAt: now, successes: 0, probes: 0 });
-        _optionalChain([this, 'access', _71 => _71.logger, 'access', _72 => _72.warn, 'optionalCall', _73 => _73(
+        _optionalChain([this, 'access', _69 => _69.logger, 'access', _70 => _70.warn, 'optionalCall', _71 => _71(
           `[autotask] circuit breaker OPEN for ${key} (${failures.length} counted failures in ${Math.round(breaker.failureWindowMs / 1e3)}s) \u2014 refusing locally for ${Math.round(breaker.openTimeoutMs / 1e3)}s`,
           correlationId
         )]);
@@ -15161,7 +15262,7 @@ var HttpClient = (_class6 = class {
       return void 0;
     }
     if (res.status < 200 || res.status >= 300) {
-      await _optionalChain([res, 'access', _74 => _74.body, 'optionalAccess', _75 => _75.cancel, 'call', _76 => _76(), 'access', _77 => _77.catch, 'call', _78 => _78(() => void 0)]);
+      await _optionalChain([res, 'access', _72 => _72.body, 'optionalAccess', _73 => _73.cancel, 'call', _74 => _74(), 'access', _75 => _75.catch, 'call', _76 => _76(() => void 0)]);
       return void 0;
     }
     let text;
@@ -15197,7 +15298,7 @@ var HttpClient = (_class6 = class {
     this.liveBaseUrl = to;
     this.tenantKey = buildTenantKey(this.auth.userName, to);
     this.breakerKey = buildBreakerKey(to);
-    _optionalChain([this, 'access', _79 => _79.logger, 'access', _80 => _80.warn, 'optionalCall', _81 => _81(
+    _optionalChain([this, 'access', _77 => _77.logger, 'access', _78 => _78.warn, 'optionalCall', _79 => _79(
       `[autotask] zone re-point ${from} -> ${to} (a 401 on the stale zone base; the vendor's unauthenticated zone discovery named the tenant's current zone) \u2014 retrying the request once against the new base`,
       void 0
     )]);
@@ -15217,6 +15318,7 @@ var HttpClient = (_class6 = class {
     const maintenancePollMs = _nullishCoalesce(opts.maintenancePollMs, () => ( this.maintenancePollMs));
     let firstMaintenanceAt;
     let maintenanceWaits = 0;
+    let maintenanceBudgetSpent = false;
     const started = Date.now();
     let deadlineAt = started + timeoutMs;
     const callerSignal = _nullishCoalesce(opts.signal, () => ( ambientSignal.getStore()));
@@ -15235,7 +15337,7 @@ var HttpClient = (_class6 = class {
     const expectBody = _nullishCoalesce(opts.expectBody, () => ( method !== "DELETE"));
     const ctx = { operation: opts.operation, url, correlationId };
     let lastStatus;
-    const interrupted = () => _optionalChain([callerSignal, 'optionalAccess', _82 => _82.aborted]) ? new AutotaskAbortError(`Request aborted: ${method} ${opts.path}`, { ...ctx, suggestedAction: "The caller aborted; re-issue the call if still needed." }) : new AutotaskTimeoutError(`Request timed out after ${timeoutMs}ms: ${method} ${opts.path}`, ctx);
+    const interrupted = () => _optionalChain([callerSignal, 'optionalAccess', _80 => _80.aborted]) ? new AutotaskAbortError(`Request aborted: ${method} ${opts.path}`, { ...ctx, suggestedAction: "The caller aborted; re-issue the call if still needed." }) : new AutotaskTimeoutError(`Request timed out after ${timeoutMs}ms: ${method} ${opts.path}`, ctx);
     const canWait = (delay) => delay <= MAX_RETRY_DELAY_MS && delay < deadlineAt - Date.now();
     const pause = async (delay) => {
       try {
@@ -15249,7 +15351,7 @@ var HttpClient = (_class6 = class {
       if (deadline2 !== void 0) {
         const remainingMs = deadline2 - Date.now();
         if (remainingMs > 0) {
-          if (_optionalChain([callerSignal, 'optionalAccess', _83 => _83.aborted])) throw interrupted();
+          if (_optionalChain([callerSignal, 'optionalAccess', _81 => _81.aborted])) throw interrupted();
           const seconds = Math.ceil(remainingMs / 1e3);
           const err = new RateLimitError(
             `Tenant is in a rate-limit cooldown; the call was NOT sent. ${seconds}s remain \u2014 do not retry before then, and narrow the query (filter/includeFields) before retrying.`,
@@ -15280,7 +15382,7 @@ var HttpClient = (_class6 = class {
     let breakerProbe = false;
     let breakerProbeKey;
     if (this.breaker !== void 0 && !opts.bypassCircuitBreaker) {
-      if (_optionalChain([callerSignal, 'optionalAccess', _84 => _84.aborted])) throw interrupted();
+      if (_optionalChain([callerSignal, 'optionalAccess', _82 => _82.aborted])) throw interrupted();
       const now = Date.now();
       const st = this.breaker.store.get(this.breakerKey);
       if (st !== void 0 && st.openedAt !== null) {
@@ -15338,7 +15440,7 @@ var HttpClient = (_class6 = class {
         breakerProbeKey = this.breakerKey;
       }
     }
-    _optionalChain([this, 'access', _85 => _85.logger, 'access', _86 => _86.debug, 'optionalCall', _87 => _87(`[autotask] ${method} ${opts.path}`, correlationId)]);
+    _optionalChain([this, 'access', _83 => _83.logger, 'access', _84 => _84.debug, 'optionalCall', _85 => _85(`[autotask] ${method} ${opts.path}`, correlationId)]);
     try {
       let attempt = 0;
       let outcome = null;
@@ -15358,7 +15460,7 @@ var HttpClient = (_class6 = class {
           if (signal.aborted || isAbortLike(err2)) throw interrupted();
           const delay = backoffDelay(attempt);
           if (attempt < maxRetries && retriable5xx && canWait(delay)) {
-            _optionalChain([this, 'access', _88 => _88.logger, 'access', _89 => _89.warn, 'optionalCall', _90 => _90(
+            _optionalChain([this, 'access', _86 => _86.logger, 'access', _87 => _87.warn, 'optionalCall', _88 => _88(
               `[autotask] network error on ${method} ${opts.path}; retrying in ${delay}ms (attempt ${attempt + 1}/${maxRetries})`,
               correlationId
             )]);
@@ -15376,7 +15478,7 @@ var HttpClient = (_class6 = class {
         try {
           status = res.status;
           if (status >= 300 && status < 400) {
-            await _optionalChain([res, 'access', _91 => _91.body, 'optionalAccess', _92 => _92.cancel, 'call', _93 => _93(), 'access', _94 => _94.catch, 'call', _95 => _95(() => void 0)]);
+            await _optionalChain([res, 'access', _89 => _89.body, 'optionalAccess', _90 => _90.cancel, 'call', _91 => _91(), 'access', _92 => _92.catch, 'call', _93 => _93(() => void 0)]);
             throw new ResponseRejectedError(
               `Refused to follow a ${status} redirect for ${method} ${opts.path}`,
               { ...ctx, code: "REDIRECT_BLOCKED", httpStatus: status, suggestedAction: "Check the configured zone/baseUrl; the API does not redirect." }
@@ -15437,14 +15539,15 @@ var HttpClient = (_class6 = class {
               httpStatus: status,
               suggestedAction: "The zone returned a non-JSON 2xx body; verify baseUrl points at the REST API."
             });
-            if (err2.code === "UNEXPECTED_CONTENT_TYPE" && maintenanceMaxWaitMs > 0 && isMaintenancePage(err2)) {
+            if (err2.code === "UNEXPECTED_CONTENT_TYPE" && maintenanceMaxWaitMs > 0 && looksLikeMaintenanceText(text)) {
               const now = Date.now();
               firstMaintenanceAt ??= now;
               const remaining = maintenanceMaxWaitMs - (now - firstMaintenanceAt);
               if (remaining > 0) {
                 const wait = Math.min(maintenancePollMs, remaining);
+                if (wait >= remaining) maintenanceBudgetSpent = true;
                 maintenanceWaits += 1;
-                _optionalChain([this, 'access', _96 => _96.logger, 'access', _97 => _97.warn, 'optionalCall', _98 => _98(
+                _optionalChain([this, 'access', _94 => _94.logger, 'access', _95 => _95.warn, 'optionalCall', _96 => _96(
                   `[autotask] maintenance window on ${method} ${opts.path}; waiting ${Math.round(wait / 1e3)}s (retry ${maintenanceWaits}, up to ${Math.round(maintenanceMaxWaitMs / 6e4)} min)`,
                   correlationId
                 )]);
@@ -15453,12 +15556,13 @@ var HttpClient = (_class6 = class {
                 await pause(wait);
                 continue;
               }
+              maintenanceBudgetSpent = true;
             }
             if (err2.code === "UNEXPECTED_CONTENT_TYPE" && retriable5xx && attempt < maxRetries) {
               const retryAfter = parseRetryAfter(res.headers.get("Retry-After"));
               const delay = retryAfter !== void 0 ? retryAfter * 1e3 : backoffDelay(attempt);
               if (canWait(delay)) {
-                _optionalChain([this, 'access', _99 => _99.logger, 'access', _100 => _100.warn, 'optionalCall', _101 => _101(
+                _optionalChain([this, 'access', _97 => _97.logger, 'access', _98 => _98.warn, 'optionalCall', _99 => _99(
                   `[autotask] non-JSON 2xx on ${method} ${opts.path}; retrying in ${delay}ms (attempt ${attempt + 1}/${maxRetries})`,
                   correlationId
                 )]);
@@ -15467,17 +15571,27 @@ var HttpClient = (_class6 = class {
                 continue;
               }
             }
-            if (maintenanceWaits > 0 && err2.code === "UNEXPECTED_CONTENT_TYPE") {
+            const pageSnippet = typeof _optionalChain([err2, 'access', _100 => _100.details, 'optionalAccess', _101 => _101.bodySnippet]) === "string" ? err2.details.bodySnippet : "";
+            if (maintenanceWaits > 0) {
               err2.details = {
                 ..._nullishCoalesce(err2.details, () => ( {})),
                 maintenance: {
                   waits: maintenanceWaits,
                   waitedMs: Date.now() - (_nullishCoalesce(firstMaintenanceAt, () => ( Date.now()))),
                   maxWaitMs: maintenanceMaxWaitMs,
-                  exhausted: true
+                  exhausted: maintenanceBudgetSpent
                 }
               };
-              err2.suggestedAction = `The zone stayed in a maintenance window for ${Math.round(maintenanceMaxWaitMs / 6e4)} min \u2014 the SDK waited and retried ${maintenanceWaits} time(s) and gave up. Re-run after the window (typically under 30 min), or raise maintenanceMaxWaitMs.`;
+              if (maintenanceBudgetSpent) {
+                err2.suggestedAction = maintenanceExhaustedAction(maintenanceMaxWaitMs, maintenanceWaits);
+              }
+            }
+            if (err2.code === "UNEXPECTED_CONTENT_TYPE" && !looksLikeMaintenanceText(text) && isHtmlLike(res.headers.get("Content-Type"), text)) {
+              err2.details = { ..._nullishCoalesce(err2.details, () => ( {})), maintenancePatternMiss: true };
+              _optionalChain([this, 'access', _102 => _102.logger, 'access', _103 => _103.debug, 'optionalCall', _104 => _104(
+                `[autotask] non-JSON body did not match the maintenance vocabulary on ${method} ${opts.path}: ${pageSnippet}`,
+                correlationId
+              )]);
             }
             attachEmptyReasonDetails(err2);
             throw err2;
@@ -15489,20 +15603,45 @@ var HttpClient = (_class6 = class {
           break;
         }
         let body;
+        let nonJsonBody;
         if (text.length > 0) {
           try {
             body = JSON.parse(text);
           } catch (e13) {
             body = text;
+            nonJsonBody = text;
           }
         }
+        const nonJsonSnippet = nonJsonBody === void 0 ? void 0 : bodySnippet(nonJsonBody, this.redactPersonalData);
+        const nonJsonIsMaintenance = nonJsonBody !== void 0 && looksLikeMaintenanceText(nonJsonBody);
+        const nonJsonIsHtmlCandidate = nonJsonBody !== void 0 && isHtmlLike(res.headers.get("Content-Type"), nonJsonBody);
+        const nonJsonMaintenanceMayWait = nonJsonIsMaintenance && retriable5xx;
+        if (nonJsonBody !== void 0 && maintenanceMaxWaitMs > 0 && nonJsonMaintenanceMayWait) {
+          const now = Date.now();
+          firstMaintenanceAt ??= now;
+          const remaining = maintenanceMaxWaitMs - (now - firstMaintenanceAt);
+          if (remaining > 0) {
+            const wait = Math.min(maintenancePollMs, remaining);
+            if (wait >= remaining) maintenanceBudgetSpent = true;
+            maintenanceWaits += 1;
+            _optionalChain([this, 'access', _105 => _105.logger, 'access', _106 => _106.warn, 'optionalCall', _107 => _107(
+              `[autotask] maintenance window on ${method} ${opts.path} (HTTP ${status}); waiting ${Math.round(wait / 1e3)}s (retry ${maintenanceWaits}, up to ${Math.round(maintenanceMaxWaitMs / 6e4)} min)`,
+              correlationId
+            )]);
+            deadlineAt = Date.now() + wait + timeoutMs;
+            armDeadline(deadlineAt - Date.now());
+            await pause(wait);
+            continue;
+          }
+          maintenanceBudgetSpent = true;
+        }
         const deterministic500 = status >= 500 && isDeterministicVendor500(parseVendorErrors(body));
         const retryableStatus = status === 429 || status >= 500;
         if (retryableStatus && !deterministic500 && attempt < maxRetries && (status === 429 ? retriable : retriable5xx)) {
           const retryAfter = parseRetryAfter(res.headers.get("Retry-After"));
           const delay = retryAfter !== void 0 ? retryAfter * 1e3 : backoffDelay(attempt);
           if (canWait(delay)) {
-            _optionalChain([this, 'access', _102 => _102.logger, 'access', _103 => _103.warn, 'optionalCall', _104 => _104(
+            _optionalChain([this, 'access', _108 => _108.logger, 'access', _109 => _109.warn, 'optionalCall', _110 => _110(
               `[autotask] ${status} on ${method} ${opts.path}; retrying in ${delay}ms (attempt ${attempt + 1}/${maxRetries})`,
               correlationId
             )]);
@@ -15515,7 +15654,7 @@ var HttpClient = (_class6 = class {
           const target = await this.discoverZoneBase(signal, ctx);
           const targetViolation = target === void 0 || this.hostPolicy === void 0 ? null : decideHostPolicy(target, this.hostPolicy);
           if (targetViolation !== null) {
-            _optionalChain([this, 'access', _105 => _105.logger, 'access', _106 => _106.warn, 'optionalCall', _107 => _107(
+            _optionalChain([this, 'access', _111 => _111.logger, 'access', _112 => _112.warn, 'optionalCall', _113 => _113(
               `[autotask] zone re-point refused by hostPolicy (${targetViolation.bound}): ${targetViolation.origin} \u2014 the original 401 propagates, zero wire to the refused host`,
               void 0
             )]);
@@ -15537,6 +15676,32 @@ var HttpClient = (_class6 = class {
           credentialShapeExpectation(headers, this.auth)
         );
         err.correlationId = correlationId;
+        if (maintenanceWaits > 0) {
+          err.details = {
+            ..._nullishCoalesce(err.details, () => ( {})),
+            maintenance: {
+              waits: maintenanceWaits,
+              waitedMs: Date.now() - (_nullishCoalesce(firstMaintenanceAt, () => ( Date.now()))),
+              maxWaitMs: maintenanceMaxWaitMs,
+              exhausted: maintenanceBudgetSpent
+            }
+          };
+          if (maintenanceBudgetSpent) {
+            err.suggestedAction = maintenanceExhaustedAction(maintenanceMaxWaitMs, maintenanceWaits);
+          }
+        }
+        if (nonJsonBody !== void 0) {
+          if (nonJsonIsMaintenance && !retriable5xx) {
+            err.details = { ..._nullishCoalesce(err.details, () => ( {})), maintenanceDetected: true };
+            err.suggestedAction = `A maintenance-shaped page answered ${method} ${opts.path} (HTTP ${status}); it was NOT waited out or re-sent \u2014 a non-2xx edge page can arrive after the request was forwarded, so verify the record before re-issuing (only a GET or an explicitly idempotent-flagged call waits this window out).`;
+          } else if (!nonJsonIsMaintenance && nonJsonIsHtmlCandidate) {
+            err.details = { ..._nullishCoalesce(err.details, () => ( {})), maintenancePatternMiss: true };
+            _optionalChain([this, 'access', _114 => _114.logger, 'access', _115 => _115.debug, 'optionalCall', _116 => _116(
+              `[autotask] non-JSON body did not match the maintenance vocabulary on ${method} ${opts.path}: ${nonJsonSnippet}`,
+              correlationId
+            )]);
+          }
+        }
         if (status === 401 && zoneRetry !== void 0) {
           err.details = {
             ..._nullishCoalesce(err.details, () => ( {})),
@@ -15553,7 +15718,7 @@ var HttpClient = (_class6 = class {
             threadThreshold
           });
           this.cooldownStore.set(this.tenantKey, Date.now() + durationMs);
-          _optionalChain([this, 'access', _108 => _108.logger, 'access', _109 => _109.warn, 'optionalCall', _110 => _110(
+          _optionalChain([this, 'access', _117 => _117.logger, 'access', _118 => _118.warn, 'optionalCall', _119 => _119(
             `[autotask] 429 on ${method} ${opts.path} surfaces after ${attempt + 1} attempt(s); tenant cooldown armed for ${Math.round(durationMs / 1e3)}s`,
             correlationId
           )]);
@@ -15598,7 +15763,7 @@ var HttpClient = (_class6 = class {
       if (this.fieldCache !== void 0 && err instanceof AutotaskError) {
         const op = typeof opts.operation === "string" ? opts.operation : void 0;
         const verb = op !== void 0 ? op.slice(op.lastIndexOf(".") + 1) : "";
-        const drift = _optionalChain([err, 'access', _111 => _111.details, 'optionalAccess', _112 => _112.deterministic]) === true || err.code === "INVALID_RESPONSE" && META_TRIO_VERBS.has(verb);
+        const drift = _optionalChain([err, 'access', _120 => _120.details, 'optionalAccess', _121 => _121.deterministic]) === true || err.code === "INVALID_RESPONSE" && META_TRIO_VERBS.has(verb);
         if (drift && op !== void 0) {
           const dot = op.indexOf(".");
           if (dot > 0) this.fieldCache.invalidate(op.slice(0, dot));
@@ -15608,7 +15773,8 @@ var HttpClient = (_class6 = class {
     } finally {
       clearTimeout(deadlineTimer);
       if (!(method === "GET" || opts.idempotent === true)) {
-        _optionalChain([this, 'access', _113 => _113.readCache, 'optionalAccess', _114 => _114.clear, 'call', _115 => _115()]);
+        _optionalChain([this, 'access', _122 => _122.readCache, 'optionalAccess', _123 => _123.clear, 'call', _124 => _124()]);
+        this.latestCountCache.clear();
         const nameOp = typeof opts.operation === "string" ? opts.operation : void 0;
         const nameDot = nameOp !== void 0 ? nameOp.indexOf(".") : -1;
         if (this.resourceNameCache !== void 0 && nameOp !== void 0 && nameDot > 0 && nameOp.slice(0, nameDot) === "resources") {
@@ -15618,7 +15784,7 @@ var HttpClient = (_class6 = class {
     }
     throw new AutotaskError("unreachable: the request loop ended without an outcome");
   }
-}, _class6);
+}, _class7);
 var INVALID_SHAPE_ACTION = "Report the unexpected response shape; verify baseUrl points at the REST API.";
 var META_TRIO_VERBS = /* @__PURE__ */ new Set(["getEntityInfo", "getFieldInfo", "getUdfInfo"]);
 function attachEmptyReasonDetails(err) {
@@ -15628,7 +15794,7 @@ function attachEmptyReasonDetails(err) {
   const resource = err.operation.slice(0, dot);
   const op = err.operation.slice(dot + 1);
   const surface = err.operation;
-  const stamp = _optionalChain([EMPTY_REASON_STAMPS, 'access', _116 => _116[resource], 'optionalAccess', _117 => _117[op]]);
+  const stamp = _optionalChain([EMPTY_REASON_STAMPS, 'access', _125 => _125[resource], 'optionalAccess', _126 => _126[op]]);
   const pointer = POINTER_NOTES[surface];
   const isGetMiss = err instanceof NotFoundError && op === "get";
   if (stamp === void 0 && pointer === void 0 && !isGetMiss) return;
@@ -15918,7 +16084,7 @@ async function expandResourceNames(client, ids, opts = {}) {
         continue;
       }
     }
-    const epoch = _nullishCoalesce(_optionalChain([cache, 'optionalAccess', _118 => _118.epoch]), () => ( 0));
+    const epoch = _nullishCoalesce(_optionalChain([cache, 'optionalAccess', _127 => _127.epoch]), () => ( 0));
     const work = (async () => {
       try {
         const record = await holder.get(id, { fresh });
@@ -16005,7 +16171,7 @@ function capabilitySets() {
   const fieldOps = /* @__PURE__ */ new Map();
   const udfOps = /* @__PURE__ */ new Map();
   const resources = /* @__PURE__ */ new Set();
-  for (const rec of _chunk5O5EPYBOcjs.CAPABILITIES) {
+  for (const rec of _chunkFLYTKJKVcjs.CAPABILITIES) {
     if (rec.resource === "operations") continue;
     resources.add(rec.resource);
     if (rec.operation === "getFieldInfo") fieldOps.set(rec.resource, rec);
@@ -16038,7 +16204,7 @@ async function fieldCatalog(client, opts) {
     }
   }
   const { fieldOps, udfOps, resources: allResources } = capabilitySets();
-  const includeRaw = _nullishCoalesce(_optionalChain([opts, 'optionalAccess', _119 => _119.include]), () => ( ["fields"]));
+  const includeRaw = _nullishCoalesce(_optionalChain([opts, 'optionalAccess', _128 => _128.include]), () => ( ["fields"]));
   if (!Array.isArray(includeRaw) || includeRaw.length === 0) {
     throw new AutotaskConfigError("fieldCatalog: opts.include must be a non-empty array of (info|fields|udf)");
   }
@@ -16052,7 +16218,7 @@ async function fieldCatalog(client, opts) {
     }
     if (!include.includes(kind)) include.push(kind);
   }
-  const resourcesRaw = _nullishCoalesce(_optionalChain([opts, 'optionalAccess', _120 => _120.resources]), () => ( WORKFLOW_RESOURCES));
+  const resourcesRaw = _nullishCoalesce(_optionalChain([opts, 'optionalAccess', _129 => _129.resources]), () => ( WORKFLOW_RESOURCES));
   if (!Array.isArray(resourcesRaw) || resourcesRaw.length === 0) {
     throw new AutotaskConfigError("fieldCatalog: opts.resources must be a non-empty array of plan resource keys");
   }
@@ -16084,7 +16250,7 @@ async function fieldCatalog(client, opts) {
     if (!targets.includes(key)) targets.push(key);
   }
   let fieldsFilter;
-  const fieldsRaw = _optionalChain([opts, 'optionalAccess', _121 => _121.fields]);
+  const fieldsRaw = _optionalChain([opts, 'optionalAccess', _130 => _130.fields]);
   if (fieldsRaw !== void 0) {
     if (!Array.isArray(fieldsRaw) || fieldsRaw.length === 0) {
       throw new AutotaskConfigError("fieldCatalog: opts.fields must be a non-empty array of vendor field name strings");
@@ -16106,7 +16272,7 @@ async function fieldCatalog(client, opts) {
       `fieldCatalog: opts.labels must be a boolean (got ${typeof opts.labels})`
     );
   }
-  const labels = _optionalChain([opts, 'optionalAccess', _122 => _122.labels]) === true;
+  const labels = _optionalChain([opts, 'optionalAccess', _131 => _131.labels]) === true;
   const cost = targets.length * include.length;
   if (cost > MAX_FIELD_CATALOG_WIRE) {
     throw new AutotaskConfigError(
@@ -16115,7 +16281,7 @@ async function fieldCatalog(client, opts) {
     );
   }
   const cache = client.http.fieldCache;
-  const fresh = _optionalChain([opts, 'optionalAccess', _123 => _123.fresh]) === true;
+  const fresh = _optionalChain([opts, 'optionalAccess', _132 => _132.fresh]) === true;
   const zone = _nullishCoalesce(client.config.zone, () => ( "unknown"));
   const rows = [];
   let wireUsed = 0;
@@ -16139,11 +16305,11 @@ async function fieldCatalog(client, opts) {
       error: null
     };
     const fetches = {
-      info: () => _nullishCoalesce(_optionalChain([holder, 'optionalAccess', _124 => _124.getEntityInfo, 'optionalCall', _125 => _125()]), () => ( Promise.reject(new AutotaskError(`fieldCatalog: the client exposes no getEntityInfo read for "${resource}"`, { code: "INVALID_RESPONSE", category: "server" })))),
-      fields: () => _nullishCoalesce(_optionalChain([holder, 'optionalAccess', _126 => _126.getFieldInfo, 'optionalCall', _127 => _127()]), () => ( Promise.reject(new AutotaskError(`fieldCatalog: the client exposes no getFieldInfo read for "${resource}"`, { code: "INVALID_RESPONSE", category: "server" })))),
-      udf: () => _nullishCoalesce(_optionalChain([holder, 'optionalAccess', _128 => _128.getUdfInfo, 'optionalCall', _129 => _129()]), () => ( Promise.reject(new AutotaskError(`fieldCatalog: the client exposes no getUdfInfo read for "${resource}"`, { code: "INVALID_RESPONSE", category: "server" }))))
+      info: () => _nullishCoalesce(_optionalChain([holder, 'optionalAccess', _133 => _133.getEntityInfo, 'optionalCall', _134 => _134()]), () => ( Promise.reject(new AutotaskError(`fieldCatalog: the client exposes no getEntityInfo read for "${resource}"`, { code: "INVALID_RESPONSE", category: "server" })))),
+      fields: () => _nullishCoalesce(_optionalChain([holder, 'optionalAccess', _135 => _135.getFieldInfo, 'optionalCall', _136 => _136()]), () => ( Promise.reject(new AutotaskError(`fieldCatalog: the client exposes no getFieldInfo read for "${resource}"`, { code: "INVALID_RESPONSE", category: "server" })))),
+      udf: () => _nullishCoalesce(_optionalChain([holder, 'optionalAccess', _137 => _137.getUdfInfo, 'optionalCall', _138 => _138()]), () => ( Promise.reject(new AutotaskError(`fieldCatalog: the client exposes no getUdfInfo read for "${resource}"`, { code: "INVALID_RESPONSE", category: "server" }))))
     };
-    if (fresh) _optionalChain([cache, 'optionalAccess', _130 => _130.invalidate, 'call', _131 => _131(resource)]);
+    if (fresh) _optionalChain([cache, 'optionalAccess', _139 => _139.invalidate, 'call', _140 => _140(resource)]);
     let allCached = true;
     const ages = [];
     for (const kind of include) {
@@ -16196,7 +16362,7 @@ async function fieldCatalog(client, opts) {
     label: zone,
     cached: cache !== void 0,
     labels,
-    ttlMs: _nullishCoalesce(_optionalChain([cache, 'optionalAccess', _132 => _132.ttlMs]), () => ( null)),
+    ttlMs: _nullishCoalesce(_optionalChain([cache, 'optionalAccess', _141 => _141.ttlMs]), () => ( null)),
     fetchedAt: (/* @__PURE__ */ new Date()).toISOString(),
     rows,
     wireUsed,
@@ -16361,7 +16527,7 @@ async function resolveCompositeNames(http, plan, opts = {}) {
       } else {
         for (const f of plan.labelFields) {
           const frow = row.fields.find((x) => x.name === f);
-          picklists[f] = _optionalChain([frow, 'optionalAccess', _133 => _133.picklistValues]);
+          picklists[f] = _optionalChain([frow, 'optionalAccess', _142 => _142.picklistValues]);
         }
       }
     } catch (err) {
@@ -16372,8 +16538,8 @@ async function resolveCompositeNames(http, plan, opts = {}) {
   }
   return {
     section,
-    resourceName: (id) => _nullishCoalesce(_optionalChain([section, 'access', _134 => _134.rows, 'access', _135 => _135[`resource:${id}`], 'optionalAccess', _136 => _136.name]), () => ( null)),
-    recordName: (table, id) => _nullishCoalesce(_optionalChain([section, 'access', _137 => _137.rows, 'access', _138 => _138[`${table}:${id}`], 'optionalAccess', _139 => _139.name]), () => ( null)),
+    resourceName: (id) => _nullishCoalesce(_optionalChain([section, 'access', _143 => _143.rows, 'access', _144 => _144[`resource:${id}`], 'optionalAccess', _145 => _145.name]), () => ( null)),
+    recordName: (table, id) => _nullishCoalesce(_optionalChain([section, 'access', _146 => _146.rows, 'access', _147 => _147[`${table}:${id}`], 'optionalAccess', _148 => _148.name]), () => ( null)),
     labelFor: (field, value) => {
       if (value === null || value === void 0) return null;
       const values = picklists[field];
@@ -16644,8 +16810,8 @@ function validateFetchManyItems(items, cap, opName = "fetchMany", capRef = `FETC
         problems.push(`${at}.fields: must be an array of exact vendor field names (discover them via operations.fieldCatalog)`);
         continue;
       }
-      if (_optionalChain([validation, 'optionalAccess', _140 => _140.fieldCheck]) !== false) {
-        const authoritative = _nullishCoalesce(_optionalChain([validation, 'optionalAccess', _141 => _141.fieldSetsByResource, 'optionalAccess', _142 => _142.get, 'call', _143 => _143(resourceKey)]), () => ( fields));
+      if (_optionalChain([validation, 'optionalAccess', _149 => _149.fieldCheck]) !== false) {
+        const authoritative = _nullishCoalesce(_optionalChain([validation, 'optionalAccess', _150 => _150.fieldSetsByResource, 'optionalAccess', _151 => _151.get, 'call', _152 => _152(resourceKey)]), () => ( fields));
         for (const f of item.fields) {
           if (!authoritative.includes(f)) {
             problems.push(
@@ -16749,7 +16915,7 @@ function project2(value, fields) {
   return out;
 }
 function resourcePathOf(key, holder) {
-  const path = _optionalChain([holder, 'optionalAccess', _144 => _144.resourcePath]);
+  const path = _optionalChain([holder, 'optionalAccess', _153 => _153.resourcePath]);
   if (typeof path !== "string" || path === "") {
     throw new AutotaskConfigError(`fetchByIds: the client exposes no ${key} resource path (registry drift)`, {
       suggestedAction: "Rebuild the client from the SDK build that ships this registry (the resource set is pinned by the plan)."
@@ -16921,7 +17087,7 @@ function blindEmptyReason(stamp) {
   };
 }
 function attachUpdateTargetMissReason(err, key) {
-  const pinned = _optionalChain([EMPTY_REASON_STAMPS, 'access', _145 => _145[key], 'optionalAccess', _146 => _146.update]);
+  const pinned = _optionalChain([EMPTY_REASON_STAMPS, 'access', _154 => _154[key], 'optionalAccess', _155 => _155.update]);
   if (pinned === void 0) return;
   err.details = { ..._nullishCoalesce(err.details, () => ( {})), emptyReason: pinned };
 }
@@ -17102,7 +17268,7 @@ var BaseResource = class {
     return (page, pageSize) => this.fetchPage(p, page, pageSize, state);
   }
   walkPageSize(params) {
-    return clampPageSize(_nullishCoalesce(_optionalChain([params, 'optionalAccess', _147 => _147.maxRecords]), () => ( this.defaultPageSize)));
+    return clampPageSize(_nullishCoalesce(_optionalChain([params, 'optionalAccess', _156 => _156.maxRecords]), () => ( this.defaultPageSize)));
   }
   /** Stream items across pages (the resource `query` surface). */
   queryItems(params) {
@@ -17114,7 +17280,7 @@ var BaseResource = class {
   }
   /** Collect every item across all pages (the resource `queryAll` surface; 1000-page guarded). */
   async queryAllItems(params) {
-    return collectAll(this.pageFetcher(params), { pageSize: this.walkPageSize(params), maxRecords: _optionalChain([params, 'optionalAccess', _148 => _148.maxTotalRecords]) });
+    return collectAll(this.pageFetcher(params), { pageSize: this.walkPageSize(params), maxRecords: _optionalChain([params, 'optionalAccess', _157 => _157.maxTotalRecords]) });
   }
   /**
    * `queryBounded` — server-side pagination (the MCP query surface): ONE call
@@ -17151,19 +17317,19 @@ var BaseResource = class {
         "queryBounded: params must be an object { filter?, limit?, latest?, includeFields? } \u2014 a bare conditions array is not accepted (wrap it: { filter: [...] })"
       );
     }
-    const limit = _nullishCoalesce(_optionalChain([params, 'optionalAccess', _149 => _149.limit]), () => ( BOUNDED_QUERY_DEFAULT_LIMIT));
+    const limit = _nullishCoalesce(_optionalChain([params, 'optionalAccess', _158 => _158.limit]), () => ( BOUNDED_QUERY_DEFAULT_LIMIT));
     if (!Number.isInteger(limit) || limit < 1 || limit > BOUNDED_QUERY_MAX_LIMIT) {
       throw new AutotaskConfigError(
         `queryBounded: limit must be an integer 1..${BOUNDED_QUERY_MAX_LIMIT} (got ${String(limit)}) \u2014 it is the TOTAL record cap, not a page size`
       );
     }
-    const noteChars = _optionalChain([params, 'optionalAccess', _150 => _150.noteChars]);
+    const noteChars = _optionalChain([params, 'optionalAccess', _159 => _159.noteChars]);
     if (noteChars !== void 0 && (!Number.isInteger(noteChars) || noteChars < 1)) {
       throw new AutotaskConfigError(
         `queryBounded: noteChars must be an integer >= 1 (got ${String(noteChars)}) \u2014 it is the per-field char cap on the untrusted-class free-text fields (absent = the raw, untruncated result)`
       );
     }
-    const walkParams = _optionalChain([params, 'optionalAccess', _151 => _151.fieldsPreset]) !== void 0 ? { ...params, includeFields: resolveFieldsPreset(params.fieldsPreset, this.config.key, params.includeFields) } : _nullishCoalesce(params, () => ( {}));
+    const walkParams = _optionalChain([params, 'optionalAccess', _160 => _160.fieldsPreset]) !== void 0 ? { ...params, includeFields: resolveFieldsPreset(params.fieldsPreset, this.config.key, params.includeFields) } : _nullishCoalesce(params, () => ( {}));
     const latest = walkParams.latest;
     if (latest !== void 0) {
       if (!Number.isInteger(latest) || latest < 1 || latest > BOUNDED_QUERY_MAX_LIMIT) {
@@ -17171,7 +17337,7 @@ var BaseResource = class {
           `queryBounded: latest must be an integer 1..${BOUNDED_QUERY_MAX_LIMIT} (got ${String(latest)}) \u2014 it is the count of the highest-id rows to return`
         );
       }
-      if (_optionalChain([params, 'optionalAccess', _152 => _152.limit]) !== void 0 && limit < latest) {
+      if (_optionalChain([params, 'optionalAccess', _161 => _161.limit]) !== void 0 && limit < latest) {
         throw new AutotaskConfigError(
           `queryBounded: limit (${String(limit)}) must be >= latest (${String(latest)}) \u2014 latest governs the returned count and limit is the walk window`
         );
@@ -17253,8 +17419,8 @@ var BaseResource = class {
    *  speculation). */
   stampEmptyQueryResult(result, params) {
     if (result.items.length !== 0) return;
-    result.blindSurface = blindStampFor(_optionalChain([BLIND_SURFACE_STAMPS, 'access', _153 => _153[this.config.key], 'optionalAccess', _154 => _154.query]), _optionalChain([params, 'optionalAccess', _155 => _155.filter]));
-    const pinnedReason = normalizedConditions(_optionalChain([params, 'optionalAccess', _156 => _156.filter])) === void 0 ? _optionalChain([EMPTY_REASON_STAMPS, 'access', _157 => _157[this.config.key], 'optionalAccess', _158 => _158.query]) : void 0;
+    result.blindSurface = blindStampFor(_optionalChain([BLIND_SURFACE_STAMPS, 'access', _162 => _162[this.config.key], 'optionalAccess', _163 => _163.query]), _optionalChain([params, 'optionalAccess', _164 => _164.filter]));
+    const pinnedReason = normalizedConditions(_optionalChain([params, 'optionalAccess', _165 => _165.filter])) === void 0 ? _optionalChain([EMPTY_REASON_STAMPS, 'access', _166 => _166[this.config.key], 'optionalAccess', _167 => _167.query]) : void 0;
     if (result.blindSurface !== void 0 || pinnedReason !== void 0) {
       result.emptyReason = result.blindSurface !== void 0 ? blindEmptyReason(result.blindSurface) : pinnedReason;
     }
@@ -17268,17 +17434,56 @@ var BaseResource = class {
     const bigB = typeof b === "number" ? BigInt(String(b)) : BigInt(b);
     return bigA < bigB ? -1 : bigA > bigB ? 1 : 0;
   }
+  /** Issue #127: the `latest` walk's count probes through the per-client
+   *  short-TTL count cache (`LatestCountCache` — fixed 30 s TTL, the
+   *  memory guard; cleared on every real write through this client, the
+   *  write-then-read re-fetch rule). Only a SUCCESSFUL plain-number vendor
+   *  count answer is stored: the blind-surface / pinned-empty sentinels are
+   *  RECORDS and pass through un-stored (the plan-pinned stamps stay fresh
+   *  and re-derive on every call), and an error rejects before any store.
+   *  The key is (resource plan key, canonical filter serialisation — the
+   *  normalised conditions' JSON): the initial `count(F)` probe and every
+   *  `id gt T` threshold probe are separate entries, and a re-asked
+   *  "top N" within the TTL makes ZERO extra count calls (its probes all
+   *  hit — the bracket/search sequence is deterministic given the counts).
+   *  Issue #157: two corrections to the snapshot trade. (1) A total of 0 is
+   *  NEVER stored — a 0 is rare and cheap to re-probe, and a cached 0 fed
+   *  the false-empty branch (a repeat after an out-of-band insert returned
+   *  no rows without walking). (2) `fresh: true` DELETES the entry before
+   *  the wire read and re-stores the fresh answer — the ONE re-probe the
+   *  stale-LOW recovery in `latestWalk` is allowed. Counts are snapshots,
+   *  not contracts: the truncation guard covers the growth-of-total
+   *  direction; a stale-LOW total within the TTL is resolved by that one
+   *  fresh re-probe (never by the guard alone). The plain `count` op and
+   *  `operations.aggregate` call `countGlobal` directly and promise fresh
+   *  totals — this wrapper is used ONLY on the latest-walk probe path.
+   */
+  async latestProbeCount(filter, opts = {}) {
+    const cache = this.http.latestCountCache;
+    const key = LatestCountCache.key(this.config.key, normalizedConditions(filter));
+    if (opts.fresh === true) {
+      cache.delete(key);
+    } else {
+      const hit = cache.get(key);
+      if (hit !== void 0) return { value: hit, cached: true };
+    }
+    const epoch = cache.epoch;
+    const res = await this.countGlobal({ filter });
+    const value = res;
+    if (typeof value === "number" && value !== 0) cache.set(key, value, epoch);
+    return { value, cached: false };
+  }
   /** Issue #59: one `latest` threshold count probe — a ROWLESS
    *  `count(F ∧ id gt T)` call (the vendor caps — ≤500 OR-conditions,
    *  8000 chars serialised — leave a single `gt` condition room on any
-   *  filter). The `BlindCountResult` sentinel (a record, not a number —
+   *  filter). Issue #127: it rides the per-client short-TTL count cache — the same (resource, conditions) probe within the 30 s window is reused (zero vendor calls); a sentinel answer is never cached. The `BlindCountResult` sentinel (a record, not a number —
    *  the declared `number` return is the documented under-type) unwraps to
    *  its `count` value (always 0): at or above the max matching id the
    *  count is 0, which is exactly the bracket-termination signal. */
   async countAboveId(baseConds, t) {
     const value = t <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(t) : t.toString();
-    const res = await this.countGlobal({ filter: [...baseConds, { op: "gt", field: "id", value }] });
-    return typeof res === "object" && res !== null && "count" in res ? res.count : res;
+    const probed = await this.latestProbeCount([...baseConds, { op: "gt", field: "id", value }]);
+    return typeof probed.value === "object" && probed.value !== null && "count" in probed.value ? probed.value.count : probed.value;
   }
   /**
    * Issue #59: the `latest: N` mechanism — the N highest-`id` rows,
@@ -17296,8 +17501,11 @@ var BaseResource = class {
    *      1 + ceil(C/500) <= 6, independent of table size. A truncated walk
    *      (the vendor's rows disagree with its own count) is
    *      LATEST_WINDOW_INCOMPLETE — the top-N of a truncated set is
-   *      unprovable. Sort id-descending; return the top N (a set of
-   *      C < N returns itself).
+   *      unprovable — EXCEPT issue #157: when `C` came from the CACHE, the
+   *      total is re-probed ONCE fresh (the stale-LOW recovery: a larger
+   *      fresh total continues the walk against it; the refusal stands only
+   *      when the fresh probe confirms the cached value). Sort
+   *      id-descending; return the top N (a set of C < N returns itself).
    *    - `C > 2500` → THRESHOLD mode: find the smallest id threshold `T`
    *      with `count(F ∧ id gt T) <= N` by exponential bracketing
    *      (T = 1, 2, 4, …) + binary search — each probe ONE rowless count
@@ -17324,13 +17532,25 @@ var BaseResource = class {
    *    answer.
    * `includeFields` always carries `id` (the P1 id-append,
    * `buildQueryRequest`), which `latest` sorts on. Pure read; no mutation
-   * paths involved.
+   * paths involved. Issue #127: every count probe of this walk (the
+   * initial `count(F)` + the `id gt T` threshold probes) rides the
+   * per-client short-TTL count cache (30 s; a real write through this
+   * client clears it) — a re-asked "top N" within the window reuses the
+   * probes (zero extra vendor count calls); sentinel answers are never
+   * cached (the plan-pinned stamps stay fresh), and a 0 total is never
+   * cached either (issue #157: a 0 is cheap to re-probe and a cached 0
+   * would shadow an out-of-band insert). The stale-LOW direction is closed
+   * by the ONE fresh re-probe above; the stale-HIGH direction is safe by
+   * construction (threshold mode re-probes fresh `id gt T` counts and
+   * full-set mode ends when the cursor exhausts). The plain `count` op and
+   * `operations.aggregate` bypass the cache by construction and promise
+   * fresh totals.
    */
   async latestWalk(params, limit, latest) {
     const baseConds = _nullishCoalesce(normalizedConditions(params.filter), () => ( []));
-    const probe = await this.countGlobal(params);
-    if (typeof probe === "object" && probe !== null) {
-      const rec = probe;
+    const probe = await this.latestProbeCount(params.filter);
+    if (typeof probe.value === "object" && probe.value !== null) {
+      const rec = probe.value;
       if (rec.blindSurface !== void 0) {
         return this.latestBlindWalk(params, limit, latest);
       }
@@ -17338,47 +17558,60 @@ var BaseResource = class {
       this.stampEmptyQueryResult(result, params);
       return result;
     }
-    const total = probe;
-    if (total === 0) {
-      const result = { items: [], fetched: 0, hasMore: false, pagesWalked: 0 };
-      this.stampEmptyQueryResult(result, params);
-      return result;
-    }
-    if (total <= BOUNDED_QUERY_MAX_LIMIT) {
-      const { items: items2, pages: pages2, guard: guard2, sliced: sliced2, cursor: cursor2 } = await this.walkBounded(params, total);
-      if (this.walkTruncated(total, { itemsLength: items2.length, guard: guard2, sliced: sliced2, cursor: cursor2 })) {
-        throw this.latestWindowIncompleteError(total);
+    let total = probe.value;
+    let cacheSourced = probe.cached;
+    let reProbed = false;
+    for (; ; ) {
+      if (total === 0) {
+        const result = { items: [], fetched: 0, hasMore: false, pagesWalked: 0 };
+        this.stampEmptyQueryResult(result, params);
+        return result;
       }
-      return this.finishLatest(items2, latest, pages2);
-    }
-    let probes = 1;
-    const spend = () => {
-      probes += 1;
-      if (probes > LATEST_MAX_COUNT_PROBES) throw this.latestThresholdUnresolvedError();
-    };
-    let lo = 0n;
-    let hi = 0n;
-    for (let t = 1n; ; t = t << 1n) {
-      spend();
-      if (await this.countAboveId(baseConds, t) <= latest) {
-        hi = t;
-        break;
+      if (total <= BOUNDED_QUERY_MAX_LIMIT) {
+        const { items: items2, pages: pages2, guard: guard2, sliced: sliced2, cursor: cursor2 } = await this.walkBounded(params, total);
+        if (this.walkTruncated(total, { itemsLength: items2.length, guard: guard2, sliced: sliced2, cursor: cursor2 })) {
+          if (cacheSourced && !reProbed) {
+            reProbed = true;
+            const fresh = await this.latestProbeCount(params.filter, { fresh: true });
+            if (typeof fresh.value === "number" && fresh.value > total) {
+              total = fresh.value;
+              cacheSourced = false;
+              continue;
+            }
+          }
+          throw this.latestWindowIncompleteError(total);
+        }
+        return this.finishLatest(items2, latest, pages2);
       }
-      lo = t;
-    }
-    while (hi - lo > 1n) {
-      const mid = lo + hi >> 1n;
-      spend();
-      if (await this.countAboveId(baseConds, mid) <= latest) hi = mid;
-      else lo = mid;
-    }
-    const windowValue = hi <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(hi) : hi.toString();
-    const window = [...baseConds, { op: "gte", field: "id", value: windowValue }];
-    const { items, pages, guard, sliced, cursor } = await this.walkBounded({ ...params, filter: window }, latest + 1);
-    if (this.walkTruncated(latest + 1, { itemsLength: items.length, guard, sliced, cursor })) {
-      throw this.latestWindowIncompleteError(latest + 1);
+      let probes = reProbed ? 2 : 1;
+      const spend = () => {
+        probes += 1;
+        if (probes > LATEST_MAX_COUNT_PROBES) throw this.latestThresholdUnresolvedError();
+      };
+      let lo = 0n;
+      let hi = 0n;
+      for (let t = 1n; ; t = t << 1n) {
+        spend();
+        if (await this.countAboveId(baseConds, t) <= latest) {
+          hi = t;
+          break;
+        }
+        lo = t;
+      }
+      while (hi - lo > 1n) {
+        const mid = lo + hi >> 1n;
+        spend();
+        if (await this.countAboveId(baseConds, mid) <= latest) hi = mid;
+        else lo = mid;
+      }
+      const windowValue = hi <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(hi) : hi.toString();
+      const window = [...baseConds, { op: "gte", field: "id", value: windowValue }];
+      const { items, pages, guard, sliced, cursor } = await this.walkBounded({ ...params, filter: window }, latest + 1);
+      if (this.walkTruncated(latest + 1, { itemsLength: items.length, guard, sliced, cursor })) {
+        throw this.latestWindowIncompleteError(latest + 1);
+      }
+      return this.finishLatest(items, latest, pages);
     }
-    return this.finishLatest(items, latest, pages);
   }
   /** The shared `latest` completion: the (provably complete or
    *  stamp-scoped) set sorted id-descending, top N taken. `hasMore: false`
@@ -17405,7 +17638,7 @@ var BaseResource = class {
     if (result.items.length === 0) {
       this.stampEmptyQueryResult(result, params);
     } else {
-      result.blindSurface = blindStampFor(_optionalChain([BLIND_SURFACE_STAMPS, 'access', _159 => _159[this.config.key], 'optionalAccess', _160 => _160.query]), params.filter);
+      result.blindSurface = blindStampFor(_optionalChain([BLIND_SURFACE_STAMPS, 'access', _168 => _168[this.config.key], 'optionalAccess', _169 => _169.query]), params.filter);
     }
     return result;
   }
@@ -17444,7 +17677,7 @@ var BaseResource = class {
    *  or, on a plan-pinned blind surface, the `{ count: 0, blindSurface }`
    *  typed sentinel (S12-C T10; see `BlindCountResult`). */
   async countGlobal(params) {
-    const conditions = normalizedConditions(_optionalChain([params, 'optionalAccess', _161 => _161.filter]));
+    const conditions = normalizedConditions(_optionalChain([params, 'optionalAccess', _170 => _170.filter]));
     const body = {};
     body.filter = conditions === void 0 ? [] : buildFilter(conditions).filter;
     const res = await this.http.request({
@@ -17455,9 +17688,9 @@ var BaseResource = class {
       idempotent: true
     });
     const count = unwrapQueryCount(res, `${this.config.key}.count`);
-    const stamp = blindStampFor(_optionalChain([BLIND_SURFACE_STAMPS, 'access', _162 => _162[this.config.key], 'optionalAccess', _163 => _163.count]), _optionalChain([params, 'optionalAccess', _164 => _164.filter]));
+    const stamp = blindStampFor(_optionalChain([BLIND_SURFACE_STAMPS, 'access', _171 => _171[this.config.key], 'optionalAccess', _172 => _172.count]), _optionalChain([params, 'optionalAccess', _173 => _173.filter]));
     if (count === 0) {
-      const pinnedReason = conditions === void 0 ? _optionalChain([EMPTY_REASON_STAMPS, 'access', _165 => _165[this.config.key], 'optionalAccess', _166 => _166.count]) : void 0;
+      const pinnedReason = conditions === void 0 ? _optionalChain([EMPTY_REASON_STAMPS, 'access', _174 => _174[this.config.key], 'optionalAccess', _175 => _175.count]) : void 0;
       if (stamp !== void 0 || pinnedReason !== void 0) {
         return {
           count,
@@ -17488,9 +17721,9 @@ var BaseResource = class {
       const hit = cache.get(path);
       if (hit !== void 0) return hit;
     }
-    const epoch = _optionalChain([cache, 'optionalAccess', _167 => _167.epoch]);
+    const epoch = _optionalChain([cache, 'optionalAccess', _176 => _176.epoch]);
     const res = await this.http.request({ method: "GET", path, operation });
-    _optionalChain([cache, 'optionalAccess', _168 => _168.set, 'call', _169 => _169(path, res, resource, epoch)]);
+    _optionalChain([cache, 'optionalAccess', _177 => _177.set, 'call', _178 => _178(path, res, resource, epoch)]);
     return res;
   }
   /**
@@ -17529,7 +17762,7 @@ var BaseResource = class {
       return value;
     });
     work.catch((err) => {
-      if (err instanceof AutotaskError && (err.code === "INVALID_RESPONSE" || _optionalChain([err, 'access', _170 => _170.details, 'optionalAccess', _171 => _171.deterministic]) === true)) {
+      if (err instanceof AutotaskError && (err.code === "INVALID_RESPONSE" || _optionalChain([err, 'access', _179 => _179.details, 'optionalAccess', _180 => _180.deterministic]) === true)) {
         cache.invalidate(key);
       }
     });
@@ -17559,7 +17792,7 @@ var BaseResource = class {
       path: `${this.resourcePath}/${numeric}`,
       operation: `${this.config.key}.get`,
       skipResponseRedaction: true,
-      maxRetries: _optionalChain([readOpts, 'optionalAccess', _172 => _172.maxRetries])
+      maxRetries: _optionalChain([readOpts, 'optionalAccess', _181 => _181.maxRetries])
     });
     return unwrapItem(res, numeric, `${this.config.key}.get`, this.entityName);
   }
@@ -17578,7 +17811,7 @@ var BaseResource = class {
       path: this.scopedItemPath(parentId, numeric),
       operation: `${this.config.key}.get`,
       skipResponseRedaction: true,
-      maxRetries: _optionalChain([readOpts, 'optionalAccess', _173 => _173.maxRetries])
+      maxRetries: _optionalChain([readOpts, 'optionalAccess', _182 => _182.maxRetries])
     });
     return unwrapItem(res, numeric, `${this.config.key}.get`, this.entityName);
   }
@@ -18237,7 +18470,7 @@ var BaseResource = class {
       current = parentId === void 0 ? await this.getGlobal(id, true) : this.config.attachmentGet ? await this.getScopedModel(parentId, id, true) : await this.getScopedRaw(parentId, id, true);
     } catch (err) {
       if (err instanceof NotFoundError) {
-        const updateReason = _optionalChain([EMPTY_REASON_STAMPS, 'access', _174 => _174[this.config.key], 'optionalAccess', _175 => _175.update]);
+        const updateReason = _optionalChain([EMPTY_REASON_STAMPS, 'access', _183 => _183[this.config.key], 'optionalAccess', _184 => _184.update]);
         checks.push({
           name: "current-record-exists",
           ok: false,
@@ -18395,12 +18628,12 @@ var BaseResource = class {
         return null;
       }
     }
-    const epoch = _optionalChain([cache, 'optionalAccess', _176 => _176.epoch]);
+    const epoch = _optionalChain([cache, 'optionalAccess', _185 => _185.epoch]);
     try {
       return await this.fetchRecordRaw(entityPath, referenceId);
     } catch (err) {
       if (err instanceof NotFoundError) {
-        _optionalChain([cache, 'optionalAccess', _177 => _177.set, 'call', _178 => _178(absentKey, CONTEXT_ABSENT_MARKER, RESOURCE_KEY_BY_PATH[entityPath], epoch)]);
+        _optionalChain([cache, 'optionalAccess', _186 => _186.set, 'call', _187 => _187(absentKey, CONTEXT_ABSENT_MARKER, RESOURCE_KEY_BY_PATH[entityPath], epoch)]);
         return null;
       }
       throw err;
@@ -18517,7 +18750,7 @@ var BaseResource = class {
   missDetail(operator, fields) {
     const key = this.config.key;
     const probe = fields.map((field) => ({ field, op: operator, value: "" }));
-    const blind = blindStampFor(_optionalChain([BLIND_SURFACE_STAMPS, 'access', _179 => _179[key], 'optionalAccess', _180 => _180.query]), probe);
+    const blind = blindStampFor(_optionalChain([BLIND_SURFACE_STAMPS, 'access', _188 => _188[key], 'optionalAccess', _189 => _189.query]), probe);
     const next = [];
     if (blind !== void 0) {
       next.push(`This surface is blind to records the API user does not own, so a miss is not proof of absence: ${blind.authority} returns the record when the id is known.`);
@@ -18793,4 +19026,5 @@ var BaseResource = class {
 
 
 
-exports.AUTH_HEADERS = AUTH_HEADERS; exports.buildAuthHeaders = buildAuthHeaders; exports.withAuthHeaders = withAuthHeaders; exports.NoopLogger = NoopLogger; exports.REDACTED = REDACTED; exports.CREDENTIAL_HEADER_NAMES = CREDENTIAL_HEADER_NAMES; exports.isCredentialHeaderName = isCredentialHeaderName; exports.redactRecord = redactRecord; exports.SECRET_RESPONSE_FIELDS = SECRET_RESPONSE_FIELDS; exports.PERSONAL_RESPONSE_FIELDS = PERSONAL_RESPONSE_FIELDS; exports.CONFIDENTIAL_RESPONSE_FIELDS = CONFIDENTIAL_RESPONSE_FIELDS; exports.isRedactedFieldName = isRedactedFieldName; exports.redactResponseBody = redactResponseBody; exports.AutotaskError = AutotaskError; exports.AutotaskConfigError = AutotaskConfigError; exports.AutotaskNetworkError = AutotaskNetworkError; exports.AutotaskTimeoutError = AutotaskTimeoutError; exports.AutotaskAbortError = AutotaskAbortError; exports.ResponseRejectedError = ResponseRejectedError; exports.BadRequestError = BadRequestError; exports.UnauthorizedError = UnauthorizedError; exports.ForbiddenError = ForbiddenError; exports.NotFoundError = NotFoundError; exports.ConflictError = ConflictError; exports.UnprocessableEntityError = UnprocessableEntityError; exports.RateLimitError = RateLimitError; exports.ServerError = ServerError; exports.UnexpectedContentTypeError = UnexpectedContentTypeError; exports.EmptyResponseError = EmptyResponseError; exports.CircuitBreakerError = CircuitBreakerError; exports.HostPolicyDeniedError = HostPolicyDeniedError; exports.ResolutionError = ResolutionError; exports.PaginationLimitError = PaginationLimitError; exports.QueryTooLongError = QueryTooLongError; exports.parseVendorErrors = parseVendorErrors; exports.isDeterministicVendor500 = isDeterministicVendor500; exports.formatVendorDetail = formatVendorDetail; exports.CREDENTIAL_SHAPE_POINTER = CREDENTIAL_SHAPE_POINTER; exports.mergeDetails = mergeDetails; exports.errorFromStatus = errorFromStatus; exports.StaleObjectError = StaleObjectError; exports.ConfirmationRequiredError = ConfirmationRequiredError; exports.DeleteBoundaryError = DeleteBoundaryError; exports.MarkerUnsafeIdError = MarkerUnsafeIdError; exports.RecoveryTruncatedError = RecoveryTruncatedError; exports.isAutotaskError = isAutotaskError; exports.hasSurroundingQuotes = hasSurroundingQuotes; exports.credentialShapeProblem = credentialShapeProblem; exports.CREDENTIAL_ENV_LOAD_ACTION = CREDENTIAL_ENV_LOAD_ACTION; exports.MIN_PREFIX_SUMMARY_LENGTH = MIN_PREFIX_SUMMARY_LENGTH; exports.credentialValueSummary = credentialValueSummary; exports.FIELD_CACHE_KINDS = FIELD_CACHE_KINDS; exports.DEFAULT_CIRCUIT_BREAKER_WINDOW_MS = DEFAULT_CIRCUIT_BREAKER_WINDOW_MS; exports.DEFAULT_CIRCUIT_BREAKER_FAILURE_THRESHOLD = DEFAULT_CIRCUIT_BREAKER_FAILURE_THRESHOLD; exports.DEFAULT_CIRCUIT_BREAKER_OPEN_TIMEOUT_MS = DEFAULT_CIRCUIT_BREAKER_OPEN_TIMEOUT_MS; exports.DEFAULT_CIRCUIT_BREAKER_SUCCESSES_TO_CLOSE = DEFAULT_CIRCUIT_BREAKER_SUCCESSES_TO_CLOSE; exports.DEFAULT_CIRCUIT_BREAKER_MAX_ENTRIES = DEFAULT_CIRCUIT_BREAKER_MAX_ENTRIES; exports.InMemoryCircuitBreakerStore = InMemoryCircuitBreakerStore; exports.defaultCircuitBreakerStore = defaultCircuitBreakerStore; exports.resetDefaultCircuitBreakerStore = resetDefaultCircuitBreakerStore; exports.buildBreakerKey = buildBreakerKey; exports.isBreakerFailure = isBreakerFailure; exports.DEFAULT_COOLDOWN_MAX_MS = DEFAULT_COOLDOWN_MAX_MS; exports.DEFAULT_COOLDOWN_DEFAULT_MS = DEFAULT_COOLDOWN_DEFAULT_MS; exports.DEFAULT_COOLDOWN_MAX_ENTRIES = DEFAULT_COOLDOWN_MAX_ENTRIES; exports.InMemoryCooldownStore = InMemoryCooldownStore; exports.defaultCooldownStore = defaultCooldownStore; exports.resetDefaultCooldownStore = resetDefaultCooldownStore; exports.buildTenantKey = buildTenantKey; exports.cooldownDurationMs = cooldownDurationMs; exports.ZONE_CATALOG = ZONE_CATALOG; exports.ZONES = ZONES; exports.DEFAULT_ZONE = DEFAULT_ZONE; exports.AGENT_PROFILE = AGENT_PROFILE; exports.DEFAULT_PAGE_SIZE = DEFAULT_PAGE_SIZE; exports.MAX_PAGE_SIZE = MAX_PAGE_SIZE; exports.DEFAULT_TIMEOUT_MS = DEFAULT_TIMEOUT_MS; exports.DEFAULT_MAX_RETRIES = DEFAULT_MAX_RETRIES; exports.DEFAULT_MAINTENANCE_MAX_WAIT_MS = DEFAULT_MAINTENANCE_MAX_WAIT_MS; exports.DEFAULT_MAINTENANCE_POLL_MS = DEFAULT_MAINTENANCE_POLL_MS; exports.DEFAULT_MAX_CONCURRENT = DEFAULT_MAX_CONCURRENT; exports.DEFAULT_MAX_RESPONSE_BYTES = DEFAULT_MAX_RESPONSE_BYTES; exports.DEFAULT_MAX_SCAN_RECORDS = DEFAULT_MAX_SCAN_RECORDS; exports.DEFAULT_MAX_SCAN_PAGES = DEFAULT_MAX_SCAN_PAGES; exports.DEFAULT_READ_CACHE_TTL_MS = DEFAULT_READ_CACHE_TTL_MS; exports.DEFAULT_FIELD_CACHE_TTL_MS = DEFAULT_FIELD_CACHE_TTL_MS; exports.DEFAULT_RESOURCE_NAME_CACHE_TTL_MS = DEFAULT_RESOURCE_NAME_CACHE_TTL_MS; exports.zoneUrl = zoneUrl; exports.resolveBaseUrl = resolveBaseUrl; exports.resolveCredentials = resolveCredentials; exports.resolveConfig = resolveConfig; exports.isRecord = isRecord2; exports.assertRecord = assertRecord; exports.deepMergeParams = deepMergeParams; exports.isIdentifierCandidate = isIdentifierCandidate; exports.parseIdentifier = parseIdentifier; exports.flattenUdfs = flattenUdfs; exports.newCorrelationId = newCorrelationId; exports.redactAuditBody = redactAuditBody; exports.camelKey = camelKey; exports.FILTER_OPERATORS = FILTER_OPERATORS; exports.GROUPING_OPERATORS = GROUPING_OPERATORS; exports.MAX_OR_CONDITIONS = MAX_OR_CONDITIONS; exports.MAX_UDF_PER_QUERY = MAX_UDF_PER_QUERY; exports.MAX_QUERY_LENGTH = MAX_QUERY_LENGTH; exports.MAX_GET_LENGTH = MAX_GET_LENGTH; exports.MAX_FIELD_LENGTH = MAX_FIELD_LENGTH; exports.isFilterOperator = isFilterOperator; exports.serializeFilter = serializeFilter; exports.validateFilter = validateFilter; exports.buildFilter = buildFilter; exports.normalizedConditions = normalizedConditions; exports.RELATIONSHIP_ZONE = RELATIONSHIP_ZONE; exports.RELATIONSHIP_MAP = RELATIONSHIP_MAP; exports.BLIND_SURFACE_STAMPS = BLIND_SURFACE_STAMPS; exports.DELETE_BOUNDARY_NOTES = DELETE_BOUNDARY_NOTES; exports.MARKER_FIELDS = MARKER_FIELDS; exports.EMPTY_REASON_STAMPS = EMPTY_REASON_STAMPS; exports.BLIND_SURFACE_INVENTORY = BLIND_SURFACE_INVENTORY; exports.REACHABILITY_PROBE_DEFAULTS = REACHABILITY_PROBE_DEFAULTS; exports.CREATE_GUIDANCE = CREATE_GUIDANCE; exports.UNTRUSTED_FIELDS_BY_RESOURCE = UNTRUSTED_FIELDS_BY_RESOURCE; exports.IDEMPOTENT_METHODS = IDEMPOTENT_METHODS; exports.buildUrl = buildUrl; exports.cursorToPath = cursorToPath; exports.buildQueryBody = buildQueryBody; exports.buildQueryRequest = buildQueryRequest; exports.runWithSignal = runWithSignal; exports.HttpClient = HttpClient; exports.unwrapItems = unwrapItems; exports.unwrapItem = unwrapItem; exports.unwrapQueryCount = unwrapQueryCount; exports.unwrapOperation = unwrapOperation; exports.passthrough = passthrough; exports.MAX_PAGES = MAX_PAGES; exports.clampPageSize = clampPageSize; exports.totalPagesFor = totalPagesFor; exports.paginate = paginate; exports.paginateItems = paginateItems; exports.collectAll = collectAll; exports.toArray = toArray; exports.FIELD_PRESETS = FIELD_PRESETS; exports.FIELD_PRESET_NAMES = FIELD_PRESET_NAMES; exports.resolveFieldsPreset = resolveFieldsPreset; exports.BOUNDED_QUERY_MAX_LIMIT = BOUNDED_QUERY_MAX_LIMIT; exports.truncateNoteChars = truncateNoteChars; exports.buildDryRunResult = buildDryRunResult; exports.mergePartialBody = mergePartialBody; exports.blindStampFor = blindStampFor; exports.decodeFileData = decodeFileData; exports.BaseResource = BaseResource; exports.EXPAND_RESOURCE_NAMES_MAX_IDS = EXPAND_RESOURCE_NAMES_MAX_IDS; exports.expandResourceNames = expandResourceNames; exports.WORKFLOW_RESOURCES = WORKFLOW_RESOURCES; exports.MAX_FIELD_CATALOG_WIRE = MAX_FIELD_CATALOG_WIRE; exports.FIELD_CATALOG_HONESTY_NOTE = FIELD_CATALOG_HONESTY_NOTE; exports.fieldCatalog = fieldCatalog; exports.PICKLIST_VALUE_NOT_SERVED_NOTE = PICKLIST_VALUE_NOT_SERVED_NOTE; exports.TICKET_LABEL_FIELDS = TICKET_LABEL_FIELDS; exports.createNamePlan = createNamePlan; exports.addNameSibling = addNameSibling; exports.addLabelSibling = addLabelSibling; exports.resolveCompositeNames = resolveCompositeNames; exports.MODEL_FIELD_SETS = MODEL_FIELD_SETS; exports.MODEL_DATE_FIELDS = MODEL_DATE_FIELDS; exports.FETCH_MANY_MAX_ITEMS = FETCH_MANY_MAX_ITEMS; exports.validateFetchManyItems = validateFetchManyItems; exports.fetchMany = fetchMany; exports.FETCH_BY_IDS_MAX_ITEMS = FETCH_BY_IDS_MAX_ITEMS; exports.FETCH_BY_IDS_CHUNK_SIZE = FETCH_BY_IDS_CHUNK_SIZE; exports.fetchByIds = fetchByIds;
+
+exports.AUTH_HEADERS = AUTH_HEADERS; exports.buildAuthHeaders = buildAuthHeaders; exports.withAuthHeaders = withAuthHeaders; exports.NoopLogger = NoopLogger; exports.REDACTED = REDACTED; exports.CREDENTIAL_HEADER_NAMES = CREDENTIAL_HEADER_NAMES; exports.isCredentialHeaderName = isCredentialHeaderName; exports.redactRecord = redactRecord; exports.SECRET_RESPONSE_FIELDS = SECRET_RESPONSE_FIELDS; exports.PERSONAL_RESPONSE_FIELDS = PERSONAL_RESPONSE_FIELDS; exports.CONFIDENTIAL_RESPONSE_FIELDS = CONFIDENTIAL_RESPONSE_FIELDS; exports.isRedactedFieldName = isRedactedFieldName; exports.redactResponseBody = redactResponseBody; exports.AutotaskError = AutotaskError; exports.AutotaskConfigError = AutotaskConfigError; exports.AutotaskNetworkError = AutotaskNetworkError; exports.AutotaskTimeoutError = AutotaskTimeoutError; exports.AutotaskAbortError = AutotaskAbortError; exports.ResponseRejectedError = ResponseRejectedError; exports.BadRequestError = BadRequestError; exports.UnauthorizedError = UnauthorizedError; exports.ForbiddenError = ForbiddenError; exports.NotFoundError = NotFoundError; exports.ConflictError = ConflictError; exports.UnprocessableEntityError = UnprocessableEntityError; exports.RateLimitError = RateLimitError; exports.ServerError = ServerError; exports.UnexpectedContentTypeError = UnexpectedContentTypeError; exports.EmptyResponseError = EmptyResponseError; exports.CircuitBreakerError = CircuitBreakerError; exports.HostPolicyDeniedError = HostPolicyDeniedError; exports.ResolutionError = ResolutionError; exports.PaginationLimitError = PaginationLimitError; exports.QueryTooLongError = QueryTooLongError; exports.parseVendorErrors = parseVendorErrors; exports.isDeterministicVendor500 = isDeterministicVendor500; exports.formatVendorDetail = formatVendorDetail; exports.CREDENTIAL_SHAPE_POINTER = CREDENTIAL_SHAPE_POINTER; exports.mergeDetails = mergeDetails; exports.errorFromStatus = errorFromStatus; exports.StaleObjectError = StaleObjectError; exports.ConfirmationRequiredError = ConfirmationRequiredError; exports.DeleteBoundaryError = DeleteBoundaryError; exports.MarkerUnsafeIdError = MarkerUnsafeIdError; exports.RecoveryTruncatedError = RecoveryTruncatedError; exports.isAutotaskError = isAutotaskError; exports.hasSurroundingQuotes = hasSurroundingQuotes; exports.credentialShapeProblem = credentialShapeProblem; exports.CREDENTIAL_ENV_LOAD_ACTION = CREDENTIAL_ENV_LOAD_ACTION; exports.MIN_PREFIX_SUMMARY_LENGTH = MIN_PREFIX_SUMMARY_LENGTH; exports.credentialValueSummary = credentialValueSummary; exports.FIELD_CACHE_KINDS = FIELD_CACHE_KINDS; exports.DEFAULT_CIRCUIT_BREAKER_WINDOW_MS = DEFAULT_CIRCUIT_BREAKER_WINDOW_MS; exports.DEFAULT_CIRCUIT_BREAKER_FAILURE_THRESHOLD = DEFAULT_CIRCUIT_BREAKER_FAILURE_THRESHOLD; exports.DEFAULT_CIRCUIT_BREAKER_OPEN_TIMEOUT_MS = DEFAULT_CIRCUIT_BREAKER_OPEN_TIMEOUT_MS; exports.DEFAULT_CIRCUIT_BREAKER_SUCCESSES_TO_CLOSE = DEFAULT_CIRCUIT_BREAKER_SUCCESSES_TO_CLOSE; exports.DEFAULT_CIRCUIT_BREAKER_MAX_ENTRIES = DEFAULT_CIRCUIT_BREAKER_MAX_ENTRIES; exports.InMemoryCircuitBreakerStore = InMemoryCircuitBreakerStore; exports.defaultCircuitBreakerStore = defaultCircuitBreakerStore; exports.resetDefaultCircuitBreakerStore = resetDefaultCircuitBreakerStore; exports.buildBreakerKey = buildBreakerKey; exports.isBreakerFailure = isBreakerFailure; exports.DEFAULT_COOLDOWN_MAX_MS = DEFAULT_COOLDOWN_MAX_MS; exports.DEFAULT_COOLDOWN_DEFAULT_MS = DEFAULT_COOLDOWN_DEFAULT_MS; exports.DEFAULT_COOLDOWN_MAX_ENTRIES = DEFAULT_COOLDOWN_MAX_ENTRIES; exports.InMemoryCooldownStore = InMemoryCooldownStore; exports.defaultCooldownStore = defaultCooldownStore; exports.resetDefaultCooldownStore = resetDefaultCooldownStore; exports.buildTenantKey = buildTenantKey; exports.cooldownDurationMs = cooldownDurationMs; exports.ZONE_CATALOG = ZONE_CATALOG; exports.ZONES = ZONES; exports.DEFAULT_ZONE = DEFAULT_ZONE; exports.AGENT_PROFILE = AGENT_PROFILE; exports.DEFAULT_PAGE_SIZE = DEFAULT_PAGE_SIZE; exports.MAX_PAGE_SIZE = MAX_PAGE_SIZE; exports.DEFAULT_TIMEOUT_MS = DEFAULT_TIMEOUT_MS; exports.DEFAULT_MAX_RETRIES = DEFAULT_MAX_RETRIES; exports.DEFAULT_MAINTENANCE_MAX_WAIT_MS = DEFAULT_MAINTENANCE_MAX_WAIT_MS; exports.DEFAULT_MAINTENANCE_POLL_MS = DEFAULT_MAINTENANCE_POLL_MS; exports.MAINTENANCE_WINDOW_MAX_MS = MAINTENANCE_WINDOW_MAX_MS; exports.DEFAULT_MAX_CONCURRENT = DEFAULT_MAX_CONCURRENT; exports.DEFAULT_MAX_RESPONSE_BYTES = DEFAULT_MAX_RESPONSE_BYTES; exports.DEFAULT_MAX_SCAN_RECORDS = DEFAULT_MAX_SCAN_RECORDS; exports.DEFAULT_MAX_SCAN_PAGES = DEFAULT_MAX_SCAN_PAGES; exports.DEFAULT_READ_CACHE_TTL_MS = DEFAULT_READ_CACHE_TTL_MS; exports.DEFAULT_FIELD_CACHE_TTL_MS = DEFAULT_FIELD_CACHE_TTL_MS; exports.DEFAULT_RESOURCE_NAME_CACHE_TTL_MS = DEFAULT_RESOURCE_NAME_CACHE_TTL_MS; exports.zoneUrl = zoneUrl; exports.resolveBaseUrl = resolveBaseUrl; exports.resolveCredentials = resolveCredentials; exports.resolveConfig = resolveConfig; exports.isRecord = isRecord2; exports.assertRecord = assertRecord; exports.deepMergeParams = deepMergeParams; exports.isIdentifierCandidate = isIdentifierCandidate; exports.parseIdentifier = parseIdentifier; exports.flattenUdfs = flattenUdfs; exports.newCorrelationId = newCorrelationId; exports.redactAuditBody = redactAuditBody; exports.camelKey = camelKey; exports.FILTER_OPERATORS = FILTER_OPERATORS; exports.GROUPING_OPERATORS = GROUPING_OPERATORS; exports.MAX_OR_CONDITIONS = MAX_OR_CONDITIONS; exports.MAX_UDF_PER_QUERY = MAX_UDF_PER_QUERY; exports.MAX_QUERY_LENGTH = MAX_QUERY_LENGTH; exports.MAX_GET_LENGTH = MAX_GET_LENGTH; exports.MAX_FIELD_LENGTH = MAX_FIELD_LENGTH; exports.isFilterOperator = isFilterOperator; exports.serializeFilter = serializeFilter; exports.validateFilter = validateFilter; exports.buildFilter = buildFilter; exports.normalizedConditions = normalizedConditions; exports.RELATIONSHIP_ZONE = RELATIONSHIP_ZONE; exports.RELATIONSHIP_MAP = RELATIONSHIP_MAP; exports.BLIND_SURFACE_STAMPS = BLIND_SURFACE_STAMPS; exports.DELETE_BOUNDARY_NOTES = DELETE_BOUNDARY_NOTES; exports.MARKER_FIELDS = MARKER_FIELDS; exports.EMPTY_REASON_STAMPS = EMPTY_REASON_STAMPS; exports.BLIND_SURFACE_INVENTORY = BLIND_SURFACE_INVENTORY; exports.REACHABILITY_PROBE_DEFAULTS = REACHABILITY_PROBE_DEFAULTS; exports.CREATE_GUIDANCE = CREATE_GUIDANCE; exports.UNTRUSTED_FIELDS_BY_RESOURCE = UNTRUSTED_FIELDS_BY_RESOURCE; exports.IDEMPOTENT_METHODS = IDEMPOTENT_METHODS; exports.buildUrl = buildUrl; exports.cursorToPath = cursorToPath; exports.buildQueryBody = buildQueryBody; exports.buildQueryRequest = buildQueryRequest; exports.runWithSignal = runWithSignal; exports.HttpClient = HttpClient; exports.unwrapItems = unwrapItems; exports.unwrapItem = unwrapItem; exports.unwrapQueryCount = unwrapQueryCount; exports.unwrapOperation = unwrapOperation; exports.passthrough = passthrough; exports.MAX_PAGES = MAX_PAGES; exports.clampPageSize = clampPageSize; exports.totalPagesFor = totalPagesFor; exports.paginate = paginate; exports.paginateItems = paginateItems; exports.collectAll = collectAll; exports.toArray = toArray; exports.FIELD_PRESETS = FIELD_PRESETS; exports.FIELD_PRESET_NAMES = FIELD_PRESET_NAMES; exports.resolveFieldsPreset = resolveFieldsPreset; exports.BOUNDED_QUERY_MAX_LIMIT = BOUNDED_QUERY_MAX_LIMIT; exports.truncateNoteChars = truncateNoteChars; exports.buildDryRunResult = buildDryRunResult; exports.mergePartialBody = mergePartialBody; exports.blindStampFor = blindStampFor; exports.decodeFileData = decodeFileData; exports.BaseResource = BaseResource; exports.EXPAND_RESOURCE_NAMES_MAX_IDS = EXPAND_RESOURCE_NAMES_MAX_IDS; exports.expandResourceNames = expandResourceNames; exports.WORKFLOW_RESOURCES = WORKFLOW_RESOURCES; exports.MAX_FIELD_CATALOG_WIRE = MAX_FIELD_CATALOG_WIRE; exports.FIELD_CATALOG_HONESTY_NOTE = FIELD_CATALOG_HONESTY_NOTE; exports.fieldCatalog = fieldCatalog; exports.PICKLIST_VALUE_NOT_SERVED_NOTE = PICKLIST_VALUE_NOT_SERVED_NOTE; exports.TICKET_LABEL_FIELDS = TICKET_LABEL_FIELDS; exports.createNamePlan = createNamePlan; exports.addNameSibling = addNameSibling; exports.addLabelSibling = addLabelSibling; exports.resolveCompositeNames = resolveCompositeNames; exports.MODEL_FIELD_SETS = MODEL_FIELD_SETS; exports.MODEL_DATE_FIELDS = MODEL_DATE_FIELDS; exports.FETCH_MANY_MAX_ITEMS = FETCH_MANY_MAX_ITEMS; exports.validateFetchManyItems = validateFetchManyItems; exports.fetchMany = fetchMany; exports.FETCH_BY_IDS_MAX_ITEMS = FETCH_BY_IDS_MAX_ITEMS; exports.FETCH_BY_IDS_CHUNK_SIZE = FETCH_BY_IDS_CHUNK_SIZE; exports.fetchByIds = fetchByIds;