node-autotask 0.26.0 → 0.28.0

package/CHANGELOG.md

@@ -7,6 +7,89 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.28.0] - 2026-10-26
+
+Minor: two new operations and one plan-recorded fact. The plan hash moves `7318bd56…` -> `ebbd6f31…`, so a consumer
+re-pins once. The pending 0.27.1 schema-text fix rides in this release (0.27.1 was never published).
+
+### Added
+
+- **`tickets.forResource(resourceID, opts?)` (#225)** — the tickets one resource is on, as primary assignee, secondary
+  resource, or both (`scope`, default `both`), de-duplicated, with `primaryIds` / `secondaryIds` / `bothIds`,
+  `counts: { primary, secondary, both, open }`, `capped`, `unresolvedIds` and the `closedStatus` disclosure.
+  The vendor exposes no such join: `Tickets.assignedResourceID` is the primary owner only and `TicketSecondaryResources`
+  is a five-field link table with no status. Two bounded reads plus chunked `id in` (100 per read) do the join
+  client-side, the `time_entries.recentTickets` way — **not** the grouped cross-field `or`, whose live vendor semantics
+  are unverified.
+- **`tickets.statusSemantics(opts?)` (#226)** — resolves which status ids mean closed in *this* tenant from the live
+  `Tickets` status picklist (through the field-metadata cache, so a warm catalog is zero wire) and reports
+  `{ picklist, closedIds, source: 'picklist' | 'assumed', note }`. `excludeStatusIds` lets a caller decide.
+
+### Changed
+
+- **No module-level ticket-status literal remains.** `TICKET_COMPLETE_STATUS = 5` is gone from `move-engine.ts`; the
+  `MOVE_TARGET_CLOSED` refusal and `companies.fullProfile`'s `openTickets` part both consume the resolved set and carry
+  the disclosure (`closedStatusIds` / `closedStatusSource`, or the part `note`). When the picklist cannot be read, id 5
+  still stands in — but `source: 'assumed'` and the note say so in the output.
+
+### Fixed
+
+- **`time_entries.approve` described its `id` as "the time-off request id".** The special-op argument map is keyed by
+  verb, and `time_off_requests.approve` owns `approve`; a new `SPECIAL_OP_ARG_RESOURCE_OVERRIDES` map (the special-op
+  mirror of the per-resource window override) re-keys a shared verb by resource and wins wholesale over the shared entry.
+
+### Known
+
+- 28 helpers still declare `outputSchema: { type: 'void' }` while returning values; fixing that needs its own plan move
+  (issue #224).
+
+## [0.27.0] - 2026-10-26
+
+Matched release with iit-mcp-autotask 0.27.0. The plan hash moves `930b907e…` -> `7318bd56…`, so this is a minor
+bump. Three batches were batched into one release deliberately: every plan edit costs a consumer one re-pin, one
+`BUILT_AGAINST_PLAN_HASH` re-stamp and one catalog rebuild, so they share a single hash move.
+
+### Added
+
+- **Time-entry approval (#221).** `billing_item_approval_levels` (`create`, `query`, `queryAll`, `count`, `get`) —
+  the only REST approval write the vendor exposes — plus `timeEntries.approve(id, opts)`, which runs the documented
+  two-step in one call (create the approval level, then update the entry's `billingApprovalDateTime` /
+  `billingApprovalResourceID`) and reports `status: 'approved' | 'approval_fields_not_persisted'` with the resulting
+  `billingApprovalLevelMostRecent`. Non-persistence is a result, not an error: the approval-level row is the durable
+  half and has no DELETE. **Posting is not here and cannot be**: `BillingItems` has no create.
+- **Six reference-target resources (#220).** `tax_regions`, `invoice_templates`, `sales_orders`,
+  `organizational_level_associations`, `organizational_level1s`, `organizational_level2s`. Vendor asymmetries kept:
+  `invoice_templates` is read-only; `sales_orders` has no create; none of the six has a DELETE.
+- **`referenceTargets` plan block (#219 N5).** Eight association-FK targets: four funded by the resources above, four
+  declared `resource: null` / `exposedByVendor: false` with the remedy the caller should follow. Clause 19 validates
+  the block.
+- **`targetResource` / `targetEnumerable` on field rows (#219 N1).** Derived from the relationship map's `apiEntity`,
+  so `contacts.companyLocationID -> "company_locations"` and `tickets.queueID -> null / false`. A size-pinned test
+  fails when a plan resource is added that the map does not cover.
+- **`effectiveRequiredFields()` (#219 N4).** One precedence — live-proven prefix > `createRequiredSet` > vendor
+  `isRequired` — with the winning source named on the result.
+- **UDF surface (#219 N7).** `udf-marker` as the filter mechanism (the vendor's `isQueryable` is wrong for UDFs),
+  `writeShape` on object/array fields (`userDefinedFields: merge`), and UDF definitions with labels and picklist
+  values on the existing `udf` include.
+- **Structured create requirements (#219 N3).** `blocker.requires {anyOf|allOf|noneOf}`, `createGuidance.requiresByValue`
+  and `rejectedValues`. `ticket_charges.create` and `project_charges.create` declare
+  `anyOf: ["productID","billingCodeID"]`; `contracts.create` declares its per-type requirement ladder. Clause 20 fails
+  when a row's evidence states a one-of requirement the row does not declare.
+- **Declared derived fields (#219 N8).** `resources.time_entries.derivedFields` with token rules
+  (`elapsed(...)`, `parent`, `mirror(...)`, `external` + `writableRoute`), served on the record metadata, on
+  `fieldCatalog` rows and in the create guidance. Clause 21 keeps the artifact token-only.
+
+### Changed
+
+- **Pooled clients share one read cache (#219 N6).** `ClientPoolOptions.sharedReadCache` defaults to `true`, so a
+  read-back routed to another pooled client cannot be served a pre-write snapshot. `sharedReadCache: false` restores
+  the per-client caches.
+- **Cross-resource tool schemas carry `x-untrusted: ["*"]`.** The five wildcard tools previously inlined the union of
+  every resource's untrusted fields, so the served `tools/list` grew with the catalog and had reached 99.6% of the
+  10,000-token budget. `["*"]` states the stronger claim and leaves the per-resource lists as the authority; core
+  payload 43,107 B -> 34,467 B.
+
+
 ## [0.26.0] - Unreleased
 
 Matched release with iit-mcp-autotask 0.26.0.