node-autotask 0.25.0 → 0.27.0

package/CHANGELOG.md

@@ -7,6 +7,67 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.27.0] - 2026-10-26
+
+Matched release with iit-mcp-autotask 0.27.0. The plan hash moves `930b907e…` -> `7318bd56…`, so this is a minor
+bump. Three batches were batched into one release deliberately: every plan edit costs a consumer one re-pin, one
+`BUILT_AGAINST_PLAN_HASH` re-stamp and one catalog rebuild, so they share a single hash move.
+
+### Added
+
+- **Time-entry approval (#221).** `billing_item_approval_levels` (`create`, `query`, `queryAll`, `count`, `get`) —
+  the only REST approval write the vendor exposes — plus `timeEntries.approve(id, opts)`, which runs the documented
+  two-step in one call (create the approval level, then update the entry's `billingApprovalDateTime` /
+  `billingApprovalResourceID`) and reports `status: 'approved' | 'approval_fields_not_persisted'` with the resulting
+  `billingApprovalLevelMostRecent`. Non-persistence is a result, not an error: the approval-level row is the durable
+  half and has no DELETE. **Posting is not here and cannot be**: `BillingItems` has no create.
+- **Six reference-target resources (#220).** `tax_regions`, `invoice_templates`, `sales_orders`,
+  `organizational_level_associations`, `organizational_level1s`, `organizational_level2s`. Vendor asymmetries kept:
+  `invoice_templates` is read-only; `sales_orders` has no create; none of the six has a DELETE.
+- **`referenceTargets` plan block (#219 N5).** Eight association-FK targets: four funded by the resources above, four
+  declared `resource: null` / `exposedByVendor: false` with the remedy the caller should follow. Clause 19 validates
+  the block.
+- **`targetResource` / `targetEnumerable` on field rows (#219 N1).** Derived from the relationship map's `apiEntity`,
+  so `contacts.companyLocationID -> "company_locations"` and `tickets.queueID -> null / false`. A size-pinned test
+  fails when a plan resource is added that the map does not cover.
+- **`effectiveRequiredFields()` (#219 N4).** One precedence — live-proven prefix > `createRequiredSet` > vendor
+  `isRequired` — with the winning source named on the result.
+- **UDF surface (#219 N7).** `udf-marker` as the filter mechanism (the vendor's `isQueryable` is wrong for UDFs),
+  `writeShape` on object/array fields (`userDefinedFields: merge`), and UDF definitions with labels and picklist
+  values on the existing `udf` include.
+- **Structured create requirements (#219 N3).** `blocker.requires {anyOf|allOf|noneOf}`, `createGuidance.requiresByValue`
+  and `rejectedValues`. `ticket_charges.create` and `project_charges.create` declare
+  `anyOf: ["productID","billingCodeID"]`; `contracts.create` declares its per-type requirement ladder. Clause 20 fails
+  when a row's evidence states a one-of requirement the row does not declare.
+- **Declared derived fields (#219 N8).** `resources.time_entries.derivedFields` with token rules
+  (`elapsed(...)`, `parent`, `mirror(...)`, `external` + `writableRoute`), served on the record metadata, on
+  `fieldCatalog` rows and in the create guidance. Clause 21 keeps the artifact token-only.
+
+### Changed
+
+- **Pooled clients share one read cache (#219 N6).** `ClientPoolOptions.sharedReadCache` defaults to `true`, so a
+  read-back routed to another pooled client cannot be served a pre-write snapshot. `sharedReadCache: false` restores
+  the per-client caches.
+- **Cross-resource tool schemas carry `x-untrusted: ["*"]`.** The five wildcard tools previously inlined the union of
+  every resource's untrusted fields, so the served `tools/list` grew with the catalog and had reached 99.6% of the
+  10,000-token budget. `["*"]` states the stronger claim and leaves the per-resource lists as the authority; core
+  payload 43,107 B -> 34,467 B.
+
+
+## [0.26.0] - Unreleased
+
+Matched release with iit-mcp-autotask 0.26.0.
+
+The plan hash changes (one new entity plus the `sensitive` fix below), so this is a minor bump. Not yet published; `scripts/published-plan-hashes.json` is recorded after publication.
+
+### Security
+
+- `configuration_item_webhooks`: every operation (including `create`, `update` and `delete`) now carries the `sensitive` flag, as the other four webhook resources already did. Webhooks are a data-exfiltration sink and consumers (the iit-mcp-autotask hard rules) force a human confirm on `sensitive`; the resource had been left out of the hand list in `scripts/g12-plan-patch.mjs`. Fixed in `capabilities.plan.json` and regenerated. A new test asserts that every `*_webhooks` operation is `sensitive`, so a future webhook resource cannot be missed.
+
+### Added
+
+- `currencies` resource (read-only): `currencies.query`, `currencies.count`, `currencies.get` plus the entity-metadata ops, generated from the vendored spec (`/V1.0/Currencies`). The vendor's `PUT|PATCH /V1.0/Currencies` is deliberately not planned, so no currency write is exposed. A tenant's currency id to ISO-code binding is read from the tenant, never assumed.
+
 ## [0.25.0] - 2026-10-24
 
 The plan hash is unchanged (`479d7826acf5…`); additive and backwards compatible, positional calls behave exactly as before.