node-autotask 0.31.0 → 0.33.0

package/N8N_MCP_MANIFEST.json

@@ -1,6 +1,6 @@
 {
   "schema": "node-autotask n8n consumer mcp projection v1",
-  "generatedAt": "2026-10-26T22:34:43.655Z",
+  "generatedAt": "2026-10-27T11:39:16.557Z",
   "generator": "scripts/project-n8n-mcp.mjs",
   "inputs": {
     "capabilities": "capabilities.json (the capability registry — the single source of truth)",
@@ -1106,9 +1106,7 @@
           "verb": "create",
           "effect": "write",
           "kind": "primitive",
-          "flags": [
-            "sensitive"
-          ],
+          "flags": [],
           "requiredArgs": [
             "parentId",
             "data"
@@ -1135,7 +1133,7 @@
             "openWorldHint": true
           },
           "purpose": "Create a contact. (under a company)",
-          "bounds": "Dry-run first (dry_run). Sensitive.",
+          "bounds": "Dry-run first (dry_run).",
           "dryRun": true
         },
         {
@@ -1183,8 +1181,7 @@
           "effect": "write",
           "kind": "primitive",
           "flags": [
-            "idempotent",
-            "sensitive"
+            "idempotent"
           ],
           "requiredArgs": [
             "parentId",
@@ -1217,7 +1214,7 @@
             "openWorldHint": true
           },
           "purpose": "Update a contact. (under a company)",
-          "bounds": "Dry-run first (dry_run). Idempotent. Sensitive.",
+          "bounds": "Dry-run first (dry_run). Idempotent.",
           "dryRun": true
         },
         {
@@ -1271,7 +1268,7 @@
       "entity": "company",
       "apiEntity": "companies",
       "effectLine": "effect=read only — zero mutating requests, ungated by design",
-      "description": "Read company records (mode: read — effect=read operations only; zero mutating requests, ungated by design). Registry operations for companies: count: Count company records matching a JSON filter. | fullProfile: Get everything the node knows about one company in a single call: the company record, its locations, contacts and notes, its open tickets, and its projects — every part separately reported with caps. | get: Get one Company by id. | getContext: Get a company with its primary context records in one call. | getEntityInfo: Get the Company capability metadata (canCreate/canUpdate/hasUserDefinedFields/...). | getFieldInfo: Get the Company field catalog (types, picklists, required, maxLength) — the full raw field dump (the largest read of the info trio; compact discovery: operations.fieldCatalog). | getUdfInfo: Get the Company user-defined-field catalog. | query: Query Company records with a JSON filter. | resolve: Resolve a Company from a numeric id (the direct fetch, tried first) or an exact value of its primary text field(s) (companyName — exact match only). Returns the Company record with the numeric id for get/update/delete. Other identifier forms (e.g. an email address) are NOT tried by resolve — use the resource's dedicated lookup op where one exists (see autotask_catalog). | search: Search company records by text (contains on the searchable fields). | searchByDomain: Find companies whose web address matches a domain (when no web address matches, the op falls back to matching contact emails). | searchByIdentity: Find companies by any combination of companyName / email / website identity values. | unbilledWork: One call for a company's unbilled work: its posted billing items (per source), the time behind them (joined through the company's tickets and tasks — time entries carry no companyID), the per-ticket rollup, the unposted anti-join section, ex-tax totals + hours, and the billing-vs-time warnings. Bounds: Bounded: server-side pagination — up to limit records (default 500, max 2500) in one call; 1000-page guard; hasMore flags a truncation. Bounded: limit default 25, max 500. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.",
+      "description": "Read company records (mode: read — effect=read operations only; zero mutating requests, ungated by design). Registry operations for companies: count: Count company records matching a JSON filter. | fullProfile: Get everything the node knows about one company in a single call: the company record, its locations, contacts and notes, its open tickets, and its projects — every part separately reported with caps. | get: Get one Company by id. | getContext: Get a company with its primary context records in one call. | getEntityInfo: Get the Company capability metadata (canCreate/canUpdate/hasUserDefinedFields/...). | getFieldInfo: Get the Company field catalog (types, picklists, required, maxLength) — the full raw field dump (the largest read of the info trio; compact discovery: operations.fieldCatalog). | getUdfInfo: Get the Company user-defined-field catalog. | prepareCrmWrite: Plan a CRM write: from partial company/contact details, find the company, its locations and the location to link a contact to, duplicate contacts, the required fields still missing (with how to get each) and the next atomic write to preview. | query: Query Company records with a JSON filter. | resolve: Resolve a Company from a numeric id (the direct fetch, tried first) or an exact value of its primary text field(s) (companyName — exact match only). Returns the Company record with the numeric id for get/update/delete. Other identifier forms (e.g. an email address) are NOT tried by resolve — use the resource's dedicated lookup op where one exists (see autotask_catalog). | search: Search company records by text (contains on the searchable fields). | searchByDomain: Find companies whose web address matches a domain (when no web address matches, the op falls back to matching contact emails). | searchByIdentity: Find companies by any combination of companyName / email / website identity values. | unbilledWork: One call for a company's unbilled work: its posted billing items (per source), the time behind them (joined through the company's tickets and tasks — time entries carry no companyID), the per-ticket rollup, the unposted anti-join section, ex-tax totals + hours, and the billing-vs-time warnings. Bounds: Bounded: server-side pagination — up to limit records (default 500, max 2500) in one call; 1000-page guard; hasMore flags a truncation. Bounded: limit default 25, max 500. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.",
       "annotations": {
         "readOnlyHint": true,
         "destructiveHint": false,
@@ -1452,6 +1449,34 @@
           "purpose": "Get the Company user-defined-field catalog.",
           "bounds": ""
         },
+        {
+          "op": "companies.prepareCrmWrite",
+          "verb": "prepareCrmWrite",
+          "effect": "read",
+          "kind": "helper",
+          "flags": [],
+          "requiredArgs": [
+            "input"
+          ],
+          "input": {
+            "properties": {
+              "input": {
+                "type": "object — CrmPrepareInput ({ intent: create_company|add_contact|update_contact|update_company, company?: {...}, contact?: {...} })"
+              }
+            },
+            "required": [
+              "input"
+            ]
+          },
+          "annotations": {
+            "readOnlyHint": true,
+            "destructiveHint": false,
+            "idempotentHint": true,
+            "openWorldHint": true
+          },
+          "purpose": "Plan a CRM write: from partial company/contact details, find the company, its locations and the location to link a contact to, duplicate contacts, the required fields still missing (with how to get each) and the next atomic write to preview.",
+          "bounds": ""
+        },
         {
           "op": "companies.query",
           "verb": "query",
@@ -1640,6 +1665,7 @@
         "companies.getEntityInfo",
         "companies.getFieldInfo",
         "companies.getUdfInfo",
+        "companies.prepareCrmWrite",
         "companies.query",
         "companies.resolve",
         "companies.search",
@@ -2939,7 +2965,7 @@
       "entity": "timeEntry",
       "apiEntity": "time_entries",
       "effectLine": "effect=read only — zero mutating requests, ungated by design",
-      "description": "Read timeEntry records (mode: read — effect=read operations only; zero mutating requests, ungated by design). Registry operations for time_entries: count: Count time entry records matching a JSON filter. | customRange: Get time entries for an explicit dateWorked range. | dateWorkedWindow: The unambiguous-named alias for time_entries.postedWithin (issue #66): the dateWorked window read with the posted/unposted split, counted in one pass — same wire, same result (incl. truncated). The window is ON dateWorked (entries worked within [from, to]); \"postedWithin\" keeps its historical name (its \"posted\" is the posted/unposted split over the returned rows, never a posted-date window). | get: Get one TimeEntry by id. | getEntityInfo: Get the TimeEntry capability metadata (canCreate/canUpdate/hasUserDefinedFields/...). | getFieldInfo: Get the TimeEntry field catalog (types, picklists, required, maxLength) — the full raw field dump (the largest read of the info trio; compact discovery: operations.fieldCatalog). | getPosted: Get posted time entries (optionally for one ticket). | getUdfInfo: Get the TimeEntry user-defined-field catalog. | getUnposted: Get unposted time entries (optionally for one ticket). | last14: Get time entries for the last 14 days (rolling, dateWorked). | last24h: Get time entries for the last 24 hours (rolling, dateWorked). | last30: Get time entries for the last 30 days (rolling, dateWorked). | last7: Get time entries for the last 7 days (rolling, dateWorked). | last90: Get time entries for the last 90 days (rolling, dateWorked). | lastFullFortnight: Get time entries for the last complete fortnight. | lastFullMonth: Get time entries for the last complete calendar month. | lastFullQuarter: Get time entries for the last complete calendar quarter. | lastFullWeek: Get time entries for the last complete calendar week. | postedWithin: Get time entries WORKED within an inclusive dateWorked window with the posted/unposted split, counted in one pass. The window is ON the dateWorked field — the name's \"posted\" is the posted/unposted SPLIT counted over the returned rows (the server-side postedDate exist|notExist predicate), never a posted-date window: no postedDate window op exists (the vendored TimeEntryModel declares no postedDate filter, and ww29-class zones 500 on postedDate filters ONLY WHEN the `posted` narrowing is set — omit `posted` on such zones — W-D3). The counts cover the returned rows only; truncated flags the capped window. time_entries.dateWorkedWindow is the unambiguous name. | query: Query TimeEntry records with a JSON filter. | recentTickets: List the distinct tickets a resource logged time against in an inclusive dateWorked window, with entry count, total hours, last worked date and the ticket's number, title, status, assignee and company. | resolve: Resolve a time entry from a numeric id (the direct fetch) only — this resource has no searchable text field, so a non-numeric identifier throws a config error. | today: Get time entries for today (dateWorked = now, server date). | yesterday: Get time entries for yesterday (dateWorked = yesterday, server date).. Bounds: Bounded: server-side pagination — up to limit records (default 500, max 2500) in one call; 1000-page guard; hasMore flags a truncation. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.",
+      "description": "Read timeEntry records (mode: read — effect=read operations only; zero mutating requests, ungated by design). Registry operations for time_entries: count: Count time entry records matching a JSON filter. | customRange: Get time entries for an explicit dateWorked range. | dateWorkedWindow: The unambiguous-named alias for time_entries.postedWithin (issue #66): the dateWorked window read with the posted/unposted split derived from the billing_items.timeEntryID join — same wire, same result (incl. truncated). The window is ON dateWorked (entries worked within [from, to]); \"postedWithin\" keeps its historical name (its \"posted\" is the posted/unposted split, never a posted-date window or a postedDate read). | get: Get one TimeEntry by id. | getEntityInfo: Get the TimeEntry capability metadata (canCreate/canUpdate/hasUserDefinedFields/...). | getFieldInfo: Get the TimeEntry field catalog (types, picklists, required, maxLength) — the full raw field dump (the largest read of the info trio; compact discovery: operations.fieldCatalog). | getPosted: Get posted time entries (an entry that a billing item references), optionally for one ticket and/or a dateWorked window — posted state derives from the billing_items.timeEntryID join, never a postedDate read or approval. | getUdfInfo: Get the TimeEntry user-defined-field catalog. | getUnposted: Get unposted time entries (entries no billing item references), optionally for one ticket and/or a dateWorked window — posted state derives from the billing_items.timeEntryID join, never a postedDate read or approval. | last14: Get time entries for the last 14 days (rolling, dateWorked). | last24h: Get time entries for the last 24 hours (rolling, dateWorked). | last30: Get time entries for the last 30 days (rolling, dateWorked). | last7: Get time entries for the last 7 days (rolling, dateWorked). | last90: Get time entries for the last 90 days (rolling, dateWorked). | lastFullFortnight: Get time entries for the last complete fortnight. | lastFullMonth: Get time entries for the last complete calendar month. | lastFullQuarter: Get time entries for the last complete calendar quarter. | lastFullWeek: Get time entries for the last complete calendar week. | postedWithin: Get time entries WORKED within an inclusive dateWorked window with the posted/unposted split. The window is ON the dateWorked field — the name's \"posted\" is the posted/unposted SPLIT derived from the billing_items.timeEntryID join (an entry a billing item references is posted, approval is not consulted), never a posted-date window or a postedDate read. The counts cover the returned rows only; truncated flags a capped read. time_entries.dateWorkedWindow is the unambiguous name. | query: Query TimeEntry records with a JSON filter. | recentTickets: List the distinct tickets a resource logged time against in an inclusive dateWorked window, with entry count, total hours, last worked date and the ticket's number, title, status, assignee and company. | resolve: Resolve a time entry from a numeric id (the direct fetch) only — this resource has no searchable text field, so a non-numeric identifier throws a config error. | today: Get time entries for today (dateWorked = now, server date). | yesterday: Get time entries for yesterday (dateWorked = yesterday, server date).. Bounds: Bounded: server-side pagination — up to limit records (default 500, max 2500) in one call; 1000-page guard; hasMore flags a truncation. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.",
       "annotations": {
         "readOnlyHint": true,
         "destructiveHint": false,
@@ -3044,7 +3070,7 @@
             "idempotentHint": true,
             "openWorldHint": true
           },
-          "purpose": "The unambiguous-named alias for time_entries.postedWithin (issue #66): the dateWorked window read with the posted/unposted split, counted in one pass — same wire, same result (incl. truncated). The window is ON dateWorked (entries worked within [from, to]); \"postedWithin\" keeps its historical name (its \"posted\" is the posted/unposted split over the returned rows, never a posted-date window).",
+          "purpose": "The unambiguous-named alias for time_entries.postedWithin (issue #66): the dateWorked window read with the posted/unposted split derived from the billing_items.timeEntryID join — same wire, same result (incl. truncated). The window is ON dateWorked (entries worked within [from, to]); \"postedWithin\" keeps its historical name (its \"posted\" is the posted/unposted split, never a posted-date window or a postedDate read).",
           "bounds": ""
         },
         {
@@ -3132,7 +3158,7 @@
             "idempotentHint": true,
             "openWorldHint": true
           },
-          "purpose": "Get posted time entries (optionally for one ticket).",
+          "purpose": "Get posted time entries (an entry that a billing item references), optionally for one ticket and/or a dateWorked window — posted state derives from the billing_items.timeEntryID join, never a postedDate read or approval.",
           "bounds": ""
         },
         {
@@ -3172,7 +3198,7 @@
             "idempotentHint": true,
             "openWorldHint": true
           },
-          "purpose": "Get unposted time entries (optionally for one ticket).",
+          "purpose": "Get unposted time entries (entries no billing item references), optionally for one ticket and/or a dateWorked window — posted state derives from the billing_items.timeEntryID join, never a postedDate read or approval.",
           "bounds": ""
         },
         {
@@ -3371,7 +3397,7 @@
                 "type": "string (UTC date, inclusive — the dateWorked window start: the from-day start) — opts.tz never shifts it (dateWorked is date-only)"
               },
               "to": {
-                "type": "string (UTC date, inclusive — the dateWorked window end: the to-day end) — opts.tz never shifts it (dateWorked is date-only). ONE server-filtered query; the window is ON the dateWorked field (the posted narrowing is a server-side postedDate exist|notExist predicate). Result { items, postedCount, unpostedCount, window, truncated } — the counts cover the returned rows only (at most limit); truncated is true when the vendor returned a live next-page cursor (more matching rows exist)"
+                "type": "string (UTC date, inclusive — the dateWorked window end: the to-day end) — opts.tz never shifts it (dateWorked is date-only). One bounded dateWorked read (max 500 entries) plus at most 2 billing_items joins (250 ids each, every read entry); the window is ON the dateWorked field (the posted narrowing is a client-side filter after the join). Result { items, postedCount, unpostedCount, window, truncated } — the counts cover the returned rows only (at most limit); truncated is true when the entry read has a live next-page cursor (more matching rows exist) or a join page was truncated"
               }
             },
             "required": [
@@ -3385,7 +3411,7 @@
             "idempotentHint": true,
             "openWorldHint": true
           },
-          "purpose": "Get time entries WORKED within an inclusive dateWorked window with the posted/unposted split, counted in one pass. The window is ON the dateWorked field — the name's \"posted\" is the posted/unposted SPLIT counted over the returned rows (the server-side postedDate exist|notExist predicate), never a posted-date window: no postedDate window op exists (the vendored TimeEntryModel declares no postedDate filter, and ww29-class zones 500 on postedDate filters ONLY WHEN the `posted` narrowing is set — omit `posted` on such zones — W-D3). The counts cover the returned rows only; truncated flags the capped window. time_entries.dateWorkedWindow is the unambiguous name.",
+          "purpose": "Get time entries WORKED within an inclusive dateWorked window with the posted/unposted split. The window is ON the dateWorked field — the name's \"posted\" is the posted/unposted SPLIT derived from the billing_items.timeEntryID join (an entry a billing item references is posted, approval is not consulted), never a posted-date window or a postedDate read. The counts cover the returned rows only; truncated flags a capped read. time_entries.dateWorkedWindow is the unambiguous name.",
           "bounds": ""
         },
         {
@@ -3856,17 +3882,17 @@
     }
   ],
   "stats": {
-    "registryRecords": 1279,
+    "registryRecords": 1280,
     "curatedEntities": 7,
     "includedEntities": 7,
     "readTools": 7,
     "writeTools": 7,
     "totalTools": 14,
-    "readOperations": 88,
+    "readOperations": 89,
     "writeOperations": 22,
     "approvalGatedWrites": 2,
     "destructiveExcluded": 4
   },
-  "capabilitiesHash": "68a3fbb3ceb8cf046bd966f47b7526050baa536df8199ddb21828582fcd69ff1",
+  "capabilitiesHash": "ba97b65fc4424ba19d524a07a92892920d809ab6aa37fc7c79d849725e73861b",
   "curationHash": "e19117ce73e38d9aded3be7e7f077a4e185d2e10294622b76c17d67f63cf9e3b"
 }

package/N8N_MCP_MANIFEST.md

@@ -1,6 +1,6 @@
 # N8N MCP Manifest — node-autotask (consumer projection)
 
-<!-- GENERATED by scripts/project-n8n-mcp.mjs at 2026-10-26T22:34:43.655Z — do not hand-edit. -->
+<!-- GENERATED by scripts/project-n8n-mcp.mjs at 2026-10-27T11:39:16.557Z — do not hand-edit. -->
 
 The n8n CONSUMER projection of the capability registry: the canonical source for what the
 n8n-side MCP tools must expose. The SDK is canonical — this is a projection of it, never a
@@ -27,7 +27,7 @@ user's n8n instances; PROD is read-only for any verification).
 | `autotask_ticket_write` | write | ticket | false | false | false | true | 4 |
 | `autotask_contact` | read | contact | true | false | true | true | 10 |
 | `autotask_contact_write` | write | contact | false | false | false | true | 4 |
-| `autotask_company` | read | company | true | false | true | true | 13 |
+| `autotask_company` | read | company | true | false | true | true | 14 |
 | `autotask_company_write` | write | company | false | false | false | true | 3 |
 | `autotask_companyLocation` | read | companyLocation | true | false | true | true | 8 |
 | `autotask_companyLocation_write` | write | companyLocation | false | false | false | true | 2 |
@@ -100,14 +100,14 @@ Tool input: {"operation":{"type":"string","enum":["create","moveToCompany","upda
 
 | backingOperation | verb | effect | flags | requiredArgs | purpose |
 |------------------|------|--------|-------|--------------|---------|
-| `contacts.create` | create | write | sensitive | parentId, data | Create a contact. (under a company) Dry-run first (dry_run). Sensitive. |
+| `contacts.create` | create | write | — | parentId, data | Create a contact. (under a company) Dry-run first (dry_run). |
 | `contacts.moveToCompany` | moveToCompany | write | requiresApproval+sensitive | sourceContactId, destinationCompanyId | Move a contact to a different company. Dry-run first (dry_run). Requires confirmation (confirm: contacts.moveToCompany). Sensitive. |
-| `contacts.update` | update | write | idempotent+sensitive | parentId, id, data | Update a contact. (under a company) Dry-run first (dry_run). Idempotent. Sensitive. |
+| `contacts.update` | update | write | idempotent | parentId, id, data | Update a contact. (under a company) Dry-run first (dry_run). Idempotent. |
 | `contacts.upsertByEmail` | upsertByEmail | write | — | companyID, email | Make sure a contact with the given email exists under the given company — find-or-create under the RIGHT parent, with the typed EXISTS/CREATED result (+ the record). Dry-run first (dry_run). |
 
 ### `autotask_company` (read — company)
 
-> Read company records (mode: read — effect=read operations only; zero mutating requests, ungated by design). Registry operations for companies: count: Count company records matching a JSON filter. | fullProfile: Get everything the node knows about one company in a single call: the company record, its locations, contacts and notes, its open tickets, and its projects — every part separately reported with caps. | get: Get one Company by id. | getContext: Get a company with its primary context records in one call. | getEntityInfo: Get the Company capability metadata (canCreate/canUpdate/hasUserDefinedFields/...). | getFieldInfo: Get the Company field catalog (types, picklists, required, maxLength) — the full raw field dump (the largest read of the info trio; compact discovery: operations.fieldCatalog). | getUdfInfo: Get the Company user-defined-field catalog. | query: Query Company records with a JSON filter. | resolve: Resolve a Company from a numeric id (the direct fetch, tried first) or an exact value of its primary text field(s) (companyName — exact match only). Returns the Company record with the numeric id for get/update/delete. Other identifier forms (e.g. an email address) are NOT tried by resolve — use the resource's dedicated lookup op where one exists (see autotask_catalog). | search: Search company records by text (contains on the searchable fields). | searchByDomain: Find companies whose web address matches a domain (when no web address matches, the op falls back to matching contact emails). | searchByIdentity: Find companies by any combination of companyName / email / website identity values. | unbilledWork: One call for a company's unbilled work: its posted billing items (per source), the time behind them (joined through the company's tickets and tasks — time entries carry no companyID), the per-ticket rollup, the unposted anti-join section, ex-tax totals + hours, and the billing-vs-time warnings. Bounds: Bounded: server-side pagination — up to limit records (default 500, max 2500) in one call; 1000-page guard; hasMore flags a truncation. Bounded: limit default 25, max 500. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.
+> Read company records (mode: read — effect=read operations only; zero mutating requests, ungated by design). Registry operations for companies: count: Count company records matching a JSON filter. | fullProfile: Get everything the node knows about one company in a single call: the company record, its locations, contacts and notes, its open tickets, and its projects — every part separately reported with caps. | get: Get one Company by id. | getContext: Get a company with its primary context records in one call. | getEntityInfo: Get the Company capability metadata (canCreate/canUpdate/hasUserDefinedFields/...). | getFieldInfo: Get the Company field catalog (types, picklists, required, maxLength) — the full raw field dump (the largest read of the info trio; compact discovery: operations.fieldCatalog). | getUdfInfo: Get the Company user-defined-field catalog. | prepareCrmWrite: Plan a CRM write: from partial company/contact details, find the company, its locations and the location to link a contact to, duplicate contacts, the required fields still missing (with how to get each) and the next atomic write to preview. | query: Query Company records with a JSON filter. | resolve: Resolve a Company from a numeric id (the direct fetch, tried first) or an exact value of its primary text field(s) (companyName — exact match only). Returns the Company record with the numeric id for get/update/delete. Other identifier forms (e.g. an email address) are NOT tried by resolve — use the resource's dedicated lookup op where one exists (see autotask_catalog). | search: Search company records by text (contains on the searchable fields). | searchByDomain: Find companies whose web address matches a domain (when no web address matches, the op falls back to matching contact emails). | searchByIdentity: Find companies by any combination of companyName / email / website identity values. | unbilledWork: One call for a company's unbilled work: its posted billing items (per source), the time behind them (joined through the company's tickets and tasks — time entries carry no companyID), the per-ticket rollup, the unposted anti-join section, ex-tax totals + hours, and the billing-vs-time warnings. Bounds: Bounded: server-side pagination — up to limit records (default 500, max 2500) in one call; 1000-page guard; hasMore flags a truncation. Bounded: limit default 25, max 500. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.
 
 | backingOperation | verb | effect | flags | requiredArgs | purpose |
 |------------------|------|--------|-------|--------------|---------|
@@ -118,6 +118,7 @@ Tool input: {"operation":{"type":"string","enum":["create","moveToCompany","upda
 | `companies.getEntityInfo` | getEntityInfo | read | — | none | Get the Company capability metadata (canCreate/canUpdate/hasUserDefinedFields/...). |
 | `companies.getFieldInfo` | getFieldInfo | read | — | none | Get the Company field catalog (types, picklists, required, maxLength) — the full raw field dump (the largest read of the info trio; compact discovery: operations.fieldCatalog). |
 | `companies.getUdfInfo` | getUdfInfo | read | — | none | Get the Company user-defined-field catalog. |
+| `companies.prepareCrmWrite` | prepareCrmWrite | read | — | input | Plan a CRM write: from partial company/contact details, find the company, its locations and the location to link a contact to, duplicate contacts, the required fields still missing (with how to get each) and the next atomic write to preview. |
 | `companies.query` | query | read | — | none | Query Company records with a JSON filter. Bounded: server-side pagination — up to limit records (default 500, max 2500) in one call; 1000-page guard; hasMore flags a truncation. |
 | `companies.resolve` | resolve | read | — | identifier | Resolve a Company from a numeric id (the direct fetch, tried first) or an exact value of its primary text field(s) (companyName — exact match only). Returns the Company record with the numeric id for get/update/delete. Other identifier forms (e.g. an email address) are NOT tried by resolve — use the resource's dedicated lookup op where one exists (see autotask_catalog). |
 | `companies.search` | search | read | — | query | Search company records by text (contains on the searchable fields). Bounded: limit default 25, max 500. |
@@ -217,19 +218,19 @@ Tool input: {"operation":{"type":"string","enum":["transferOwnership","update"]}
 
 ### `autotask_timeEntry` (read — timeEntry)
 
-> Read timeEntry records (mode: read — effect=read operations only; zero mutating requests, ungated by design). Registry operations for time_entries: count: Count time entry records matching a JSON filter. | customRange: Get time entries for an explicit dateWorked range. | dateWorkedWindow: The unambiguous-named alias for time_entries.postedWithin (issue #66): the dateWorked window read with the posted/unposted split, counted in one pass — same wire, same result (incl. truncated). The window is ON dateWorked (entries worked within [from, to]); "postedWithin" keeps its historical name (its "posted" is the posted/unposted split over the returned rows, never a posted-date window). | get: Get one TimeEntry by id. | getEntityInfo: Get the TimeEntry capability metadata (canCreate/canUpdate/hasUserDefinedFields/...). | getFieldInfo: Get the TimeEntry field catalog (types, picklists, required, maxLength) — the full raw field dump (the largest read of the info trio; compact discovery: operations.fieldCatalog). | getPosted: Get posted time entries (optionally for one ticket). | getUdfInfo: Get the TimeEntry user-defined-field catalog. | getUnposted: Get unposted time entries (optionally for one ticket). | last14: Get time entries for the last 14 days (rolling, dateWorked). | last24h: Get time entries for the last 24 hours (rolling, dateWorked). | last30: Get time entries for the last 30 days (rolling, dateWorked). | last7: Get time entries for the last 7 days (rolling, dateWorked). | last90: Get time entries for the last 90 days (rolling, dateWorked). | lastFullFortnight: Get time entries for the last complete fortnight. | lastFullMonth: Get time entries for the last complete calendar month. | lastFullQuarter: Get time entries for the last complete calendar quarter. | lastFullWeek: Get time entries for the last complete calendar week. | postedWithin: Get time entries WORKED within an inclusive dateWorked window with the posted/unposted split, counted in one pass. The window is ON the dateWorked field — the name's "posted" is the posted/unposted SPLIT counted over the returned rows (the server-side postedDate exist|notExist predicate), never a posted-date window: no postedDate window op exists (the vendored TimeEntryModel declares no postedDate filter, and ww29-class zones 500 on postedDate filters ONLY WHEN the `posted` narrowing is set — omit `posted` on such zones — W-D3). The counts cover the returned rows only; truncated flags the capped window. time_entries.dateWorkedWindow is the unambiguous name. | query: Query TimeEntry records with a JSON filter. | recentTickets: List the distinct tickets a resource logged time against in an inclusive dateWorked window, with entry count, total hours, last worked date and the ticket's number, title, status, assignee and company. | resolve: Resolve a time entry from a numeric id (the direct fetch) only — this resource has no searchable text field, so a non-numeric identifier throws a config error. | today: Get time entries for today (dateWorked = now, server date). | yesterday: Get time entries for yesterday (dateWorked = yesterday, server date).. Bounds: Bounded: server-side pagination — up to limit records (default 500, max 2500) in one call; 1000-page guard; hasMore flags a truncation. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.
+> Read timeEntry records (mode: read — effect=read operations only; zero mutating requests, ungated by design). Registry operations for time_entries: count: Count time entry records matching a JSON filter. | customRange: Get time entries for an explicit dateWorked range. | dateWorkedWindow: The unambiguous-named alias for time_entries.postedWithin (issue #66): the dateWorked window read with the posted/unposted split derived from the billing_items.timeEntryID join — same wire, same result (incl. truncated). The window is ON dateWorked (entries worked within [from, to]); "postedWithin" keeps its historical name (its "posted" is the posted/unposted split, never a posted-date window or a postedDate read). | get: Get one TimeEntry by id. | getEntityInfo: Get the TimeEntry capability metadata (canCreate/canUpdate/hasUserDefinedFields/...). | getFieldInfo: Get the TimeEntry field catalog (types, picklists, required, maxLength) — the full raw field dump (the largest read of the info trio; compact discovery: operations.fieldCatalog). | getPosted: Get posted time entries (an entry that a billing item references), optionally for one ticket and/or a dateWorked window — posted state derives from the billing_items.timeEntryID join, never a postedDate read or approval. | getUdfInfo: Get the TimeEntry user-defined-field catalog. | getUnposted: Get unposted time entries (entries no billing item references), optionally for one ticket and/or a dateWorked window — posted state derives from the billing_items.timeEntryID join, never a postedDate read or approval. | last14: Get time entries for the last 14 days (rolling, dateWorked). | last24h: Get time entries for the last 24 hours (rolling, dateWorked). | last30: Get time entries for the last 30 days (rolling, dateWorked). | last7: Get time entries for the last 7 days (rolling, dateWorked). | last90: Get time entries for the last 90 days (rolling, dateWorked). | lastFullFortnight: Get time entries for the last complete fortnight. | lastFullMonth: Get time entries for the last complete calendar month. | lastFullQuarter: Get time entries for the last complete calendar quarter. | lastFullWeek: Get time entries for the last complete calendar week. | postedWithin: Get time entries WORKED within an inclusive dateWorked window with the posted/unposted split. The window is ON the dateWorked field — the name's "posted" is the posted/unposted SPLIT derived from the billing_items.timeEntryID join (an entry a billing item references is posted, approval is not consulted), never a posted-date window or a postedDate read. The counts cover the returned rows only; truncated flags a capped read. time_entries.dateWorkedWindow is the unambiguous name. | query: Query TimeEntry records with a JSON filter. | recentTickets: List the distinct tickets a resource logged time against in an inclusive dateWorked window, with entry count, total hours, last worked date and the ticket's number, title, status, assignee and company. | resolve: Resolve a time entry from a numeric id (the direct fetch) only — this resource has no searchable text field, so a non-numeric identifier throws a config error. | today: Get time entries for today (dateWorked = now, server date). | yesterday: Get time entries for yesterday (dateWorked = yesterday, server date).. Bounds: Bounded: server-side pagination — up to limit records (default 500, max 2500) in one call; 1000-page guard; hasMore flags a truncation. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.
 
 | backingOperation | verb | effect | flags | requiredArgs | purpose |
 |------------------|------|--------|-------|--------------|---------|
 | `time_entries.count` | count | read | — | none | Count time entry records matching a JSON filter. |
 | `time_entries.customRange` | customRange | read | — | from, to | Get time entries for an explicit dateWorked range. |
-| `time_entries.dateWorkedWindow` | dateWorkedWindow | read | — | from, to | The unambiguous-named alias for time_entries.postedWithin (issue #66): the dateWorked window read with the posted/unposted split, counted in one pass — same wire, same result (incl. truncated). The window is ON dateWorked (entries worked within [from, to]); "postedWithin" keeps its historical name (its "posted" is the posted/unposted split over the returned rows, never a posted-date window). |
+| `time_entries.dateWorkedWindow` | dateWorkedWindow | read | — | from, to | The unambiguous-named alias for time_entries.postedWithin (issue #66): the dateWorked window read with the posted/unposted split derived from the billing_items.timeEntryID join — same wire, same result (incl. truncated). The window is ON dateWorked (entries worked within [from, to]); "postedWithin" keeps its historical name (its "posted" is the posted/unposted split, never a posted-date window or a postedDate read). |
 | `time_entries.get` | get | read | — | id | Get one TimeEntry by id. |
 | `time_entries.getEntityInfo` | getEntityInfo | read | — | none | Get the TimeEntry capability metadata (canCreate/canUpdate/hasUserDefinedFields/...). |
 | `time_entries.getFieldInfo` | getFieldInfo | read | — | none | Get the TimeEntry field catalog (types, picklists, required, maxLength) — the full raw field dump (the largest read of the info trio; compact discovery: operations.fieldCatalog). |
-| `time_entries.getPosted` | getPosted | read | — | none | Get posted time entries (optionally for one ticket). |
+| `time_entries.getPosted` | getPosted | read | — | none | Get posted time entries (an entry that a billing item references), optionally for one ticket and/or a dateWorked window — posted state derives from the billing_items.timeEntryID join, never a postedDate read or approval. |
 | `time_entries.getUdfInfo` | getUdfInfo | read | — | none | Get the TimeEntry user-defined-field catalog. |
-| `time_entries.getUnposted` | getUnposted | read | — | none | Get unposted time entries (optionally for one ticket). |
+| `time_entries.getUnposted` | getUnposted | read | — | none | Get unposted time entries (entries no billing item references), optionally for one ticket and/or a dateWorked window — posted state derives from the billing_items.timeEntryID join, never a postedDate read or approval. |
 | `time_entries.last14` | last14 | read | — | none | Get time entries for the last 14 days (rolling, dateWorked). |
 | `time_entries.last24h` | last24h | read | — | none | Get time entries for the last 24 hours (rolling, dateWorked). |
 | `time_entries.last30` | last30 | read | — | none | Get time entries for the last 30 days (rolling, dateWorked). |
@@ -239,7 +240,7 @@ Tool input: {"operation":{"type":"string","enum":["transferOwnership","update"]}
 | `time_entries.lastFullMonth` | lastFullMonth | read | — | none | Get time entries for the last complete calendar month. |
 | `time_entries.lastFullQuarter` | lastFullQuarter | read | — | none | Get time entries for the last complete calendar quarter. |
 | `time_entries.lastFullWeek` | lastFullWeek | read | — | none | Get time entries for the last complete calendar week. |
-| `time_entries.postedWithin` | postedWithin | read | — | from, to | Get time entries WORKED within an inclusive dateWorked window with the posted/unposted split, counted in one pass. The window is ON the dateWorked field — the name's "posted" is the posted/unposted SPLIT counted over the returned rows (the server-side postedDate exist|notExist predicate), never a posted-date window: no postedDate window op exists (the vendored TimeEntryModel declares no postedDate filter, and ww29-class zones 500 on postedDate filters ONLY WHEN the `posted` narrowing is set — omit `posted` on such zones — W-D3). The counts cover the returned rows only; truncated flags the capped window. time_entries.dateWorkedWindow is the unambiguous name. |
+| `time_entries.postedWithin` | postedWithin | read | — | from, to | Get time entries WORKED within an inclusive dateWorked window with the posted/unposted split. The window is ON the dateWorked field — the name's "posted" is the posted/unposted SPLIT derived from the billing_items.timeEntryID join (an entry a billing item references is posted, approval is not consulted), never a posted-date window or a postedDate read. The counts cover the returned rows only; truncated flags a capped read. time_entries.dateWorkedWindow is the unambiguous name. |
 | `time_entries.query` | query | read | — | none | Query TimeEntry records with a JSON filter. Bounded: server-side pagination — up to limit records (default 500, max 2500) in one call; 1000-page guard; hasMore flags a truncation. |
 | `time_entries.recentTickets` | recentTickets | read | — | from, to, opts | List the distinct tickets a resource logged time against in an inclusive dateWorked window, with entry count, total hours, last worked date and the ticket's number, title, status, assignee and company. |
 | `time_entries.resolve` | resolve | read | — | identifier | Resolve a time entry from a numeric id (the direct fetch) only — this resource has no searchable text field, so a non-numeric identifier throws a config error. |
@@ -275,19 +276,19 @@ only via a recorded change to `n8n-mcp.curation.json`.
 
 ## Stats
 
-- registryRecords: 1279
+- registryRecords: 1280
 - curatedEntities: 7
 - includedEntities: 7
 - readTools: 7
 - writeTools: 7
 - totalTools: 14
-- readOperations: 88
+- readOperations: 89
 - writeOperations: 22
 - approvalGatedWrites: 2
 - destructiveExcluded: 4
 
 ## Meta
 
-- generatedAt: 2026-10-26T22:34:43.655Z
-- capabilitiesHash: 68a3fbb3ceb8cf046bd966f47b7526050baa536df8199ddb21828582fcd69ff1
+- generatedAt: 2026-10-27T11:39:16.557Z
+- capabilitiesHash: ba97b65fc4424ba19d524a07a92892920d809ab6aa37fc7c79d849725e73861b
 - curationHash: e19117ce73e38d9aded3be7e7f077a4e185d2e10294622b76c17d67f63cf9e3b

package/README.md

@@ -349,7 +349,7 @@ The SDK ships the mechanical substrate, not a server (no MCP imports, no zod):
    whose MCP annotation is `readOnlyHint !== true` — today exactly **267
    tools**: the 265 dedicated write/delete tools (209 `effect=write` + 56
    `effect=destructive`, every one of them has a dedicated tool) +
-   `autotask_write` + `autotask_delete`. The remaining **633 tools** (the 620 dedicated read tools + the 10 core read tools + `autotask_read` +
+   `autotask_write` + `autotask_delete`. The remaining **634 tools** (the 621 dedicated read tools + the 10 core read tools + `autotask_read` +
    `autotask_catalog` + `autotask_describe`) all carry `readOnlyHint: true`
    and are safe ungated: every op they can route is `effect=read` (zero
    mutating requests — pinned by the test inventory). Refined class for the
@@ -398,10 +398,11 @@ The SDK ships the mechanical substrate, not a server (no MCP imports, no zod):
    blind count/query surfaces (companies, unfiltered billing_codes, resources
    — `get(id)` is the authority), the isActive-is-a-number quirk, the
    time-entry `internalBillingCodeID` wire key, and the W-D3 posted-state
-   filter wall on this zone's `time_entries` (the live TimeEntry entity has
-   NO posted-state filter field — `time_entries.postedWithin` is the working
-   window read; `getPosted` / `getUnposted` 500 there is the typed known
-   wall, the pinned pointer note rides the error). Since the served-metadata
+   gap on this zone's `time_entries` (the live TimeEntry entity has NO
+   `postedDate`; `getPosted` / `getUnposted` / `postedWithin` derive posted
+   state from the `billing_items.timeEntryID` join (any billing item referencing the entry),
+   and `getPosted` / `getUnposted` return `{ items, hasMore, window,
+   approvedCount, unapprovedCount }`). Since the served-metadata
    maturity pass (S12-C): the 6 pinned blind surfaces attach a TYPED
    `blindSurface` sentinel to 0/empty count/query results at read time
    (§11.7 — the result-time enforcement of the §11.2 rule), the top-create
@@ -582,7 +583,8 @@ suites are the release gate, the live scripts are the ground-truth check.
   + `npm run verify`, the Node-24 floor, the per-tenant 429 cooldown, delete
   boundaries + `operations.recovery`, the blind-surface inventory + bounded
   probe, the zone-fact create-guidance catalog, the posted/unposted rework
-  (spec-correct `postedDate` wire + the live-verified W-D3 typed wall +
+  (first the spec `postedDate` wire, replaced in 0.32.0 by the
+  billing-item join because ww29 has no `postedDate`; W-D3 +
   `postedWithin`), the create-path marker recovery, the typed `emptyReason`,
   and the served-error `details` pass-through) — live-verified on the ww29
   sandbox with real reads AND writes (marker-tagged, zero residue;