node-autotask 0.39.2 → 0.39.3

package/CHANGELOG.md

@@ -5,6 +5,21 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [0.39.3] - 2026-10-30
+
+Patch: standalone fixes (#263, #264, #265, #266, #306 part a). No capability-plan change.
+
+### Fixed
+- **#264:** `credentialShapeProblem` now reports an interior line feed (`'line feed'`), matching its "interior CR/LF always reported" doc; previously an LF-laden credential reached fetch and surfaced as an opaque `NETWORK_ERROR`.
+- **#265:** `createIfNotExists` treats a dedup match with an all-digit string id (above 2^53) as existing, and the create dry-run `parent-exists` check accepts a string-id parent; both go through `parseIdentifier`.
+- **#263:** a mutation sent with `idempotent: true` (for example `client.http.request`) now voids cached reads like any other write. `idempotent` governs retry only; the internal `/query`, `/query/count` and `/query/next` read POSTs still skip invalidation.
+- **#306 (a):** the picklist-unavailable note now names the resource (`... unavailable for tickets.status (see reasons)`), matching the `<resource>.<field>` `reasons` keys; the `resolveCompositeNames` catch branch is covered by a test.
+
+### Changed
+- **#266 / #306 (a):** docs only. Pagination module headers now state that same-origin cursors are used and cross-origin cursors are refused with `ResponseRejectedError` (issue #54); the API.md note on id 0 is reworded as a node rule, not a vendor claim.
+
 ## [0.39.2] - 2026-10-30
 
 Patch: follow-ups to the 0.39.0 / 0.39.1 label work (#302, #303, #304). The plan hash is unchanged (`9bb87de7...`); no capability-plan change, so the MCP server needs no re-pin.

package/README.md

@@ -120,7 +120,7 @@ code `INVALID_CREDENTIAL_SHAPE`) **before any request is built**. The three cano
 `AUTOTASK_API_INTEGRATION_CODE` and `AUTOTASK_USER` are read as fall-backs, canonical first.
 
 **What the SDK refuses at construction.** `apiIntegrationCode`, `userName`, `secret` and
-`impersonationResourceId` reject a value with a surrounding quote pair or an interior CR (and refuse
+`impersonationResourceId` reject a value with a surrounding quote pair or an interior CR or LF (and refuse
 whitespace-only blank values exactly as before); padding-only whitespace is still trimmed as it
 always was. The same gate runs at the wire boundary, so a value that reaches the transport by any
 other route is refused before the request is sent. Errors are value-free: they name the field and

package/dist/{chunk-I7IM342A.js → chunk-5JAS6CAN.js}

@@ -125,7 +125,7 @@ import {
   VersionInformationResource,
   VersionResource,
   ZoneInformationResource
-} from "./chunk-GSGP2B4I.js";
+} from "./chunk-K6RZDRWX.js";
 import {
   AutotaskConfigError,
   BillingCodesResource,
@@ -141,7 +141,7 @@ import {
   TimeEntriesResource,
   resolveConfig,
   runWithSignal
-} from "./chunk-UNOQESFU.js";
+} from "./chunk-GSMFRPYB.js";
 
 // src/client.ts
 var AutotaskClient = class {

package/dist/{chunk-5QS3VT34.cjs → chunk-BPRDYT5L.cjs}

@@ -1095,6 +1095,7 @@ function credentialShapeProblem(value, options = {}) {
     return "single- or double-quote surrounding the value";
   }
   if (value.includes("\r")) return "carriage return";
+  if (value.includes("\n")) return "line feed";
   return void 0;
 }
 var CREDENTIAL_ENV_LOAD_ACTION = "value appears shell-quoted or line-break contaminated \u2014 check how your env file was loaded (single-quoted values must be shell-sourced, not parsed by a quote-preserving loader)";
@@ -17469,7 +17470,7 @@ var HttpClient = class {
   }
   /** A real write (even a failed one — it may have partly applied) voids cached reads. */
   invalidateAfterWrite(opts) {
-    if (opts.method === "GET" || opts.idempotent === true) return;
+    if (opts.method === "GET" || opts.idempotent === true && /\/query(\/|\?|$)/.test(opts.path)) return;
     _optionalChain([this, 'access', _120 => _120.readCache, 'optionalAccess', _121 => _121.clear, 'call', _122 => _122()]);
     this.latestCountCache.clear();
     const nameOp = typeof opts.operation === "string" ? opts.operation : void 0;
@@ -20281,9 +20282,9 @@ var MutationBase = class extends MetaBase {
       const first = matches[0];
       if (first !== void 0) {
         const firstId = first.id;
-        if (typeof firstId === "number") {
+        if (isIdentifierCandidate(firstId)) {
           existing = first;
-          existingId = firstId;
+          existingId = parseIdentifier(firstId, "id");
         }
       }
     }
@@ -20382,9 +20383,13 @@ var MutationBase = class extends MetaBase {
         );
       }
       let parent = null;
-      if (typeof parentId === "number" && Number.isInteger(parentId) && parentId >= 0) {
+      if (isIdentifierCandidate(parentId)) {
         try {
-          parent = await this.fetchRecordRaw(parentPath, parentId, true);
+          parent = await this.fetchRecordRaw(
+            parentPath,
+            parseIdentifier(parentId, "parentId"),
+            true
+          );
         } catch (err) {
           if (!(err instanceof NotFoundError)) throw err;
         }
@@ -20877,7 +20882,7 @@ function readNamesOpt(value, where) {
   }
   return value;
 }
-async function labelRows(client, resourceKey, rows) {
+async function labelRows(client, resourceKey, rows, resourceKeyedReasons = false) {
   const keys = /* @__PURE__ */ new Set();
   for (const row of rows) for (const k of Object.keys(row)) keys.add(k);
   if (keys.size === 0) return { rows: [...rows] };
@@ -20944,7 +20949,7 @@ async function labelRows(client, resourceKey, rows) {
   if (capped === 0 && unresolved.length === 0 && catalogError === void 0) return { rows: out };
   const parts = [];
   if (capped > 0) parts.push(`${capped} id(s) left unlabelled (their *Name is null): the per-call cap of ${DEFAULT_MAX_NAME_READS} uncached name reads was hit \u2014 names already read are cached, so repeating or narrowing the call labels more`);
-  if (unresolved.length > 0) parts.push(`picklist label(s) unavailable for ${unresolved.join(", ")} (see reasons)`);
+  if (unresolved.length > 0) parts.push(`picklist label(s) unavailable for ${unresolved.map((f) => resourceKeyedReasons ? `${resourceKey}.${f}` : f).join(", ")} (see reasons)`);
   if (catalogError !== void 0) {
     parts.push(
       `the ${resourceKey} field catalog read failed (${catalogError.code}), so picklist labels are unavailable for this call, not absent: ` + (unavailable.length > 0 ? `the *Label is null for ${unavailable.join(", ")}` : "no *Label sibling was added (the picklist fields are unknown until a catalog read succeeds)") + " \u2014 retry the call to label them"
@@ -20971,7 +20976,7 @@ async function labelFetchResults(client, result) {
   const reasons = {};
   const catalogErrors = {};
   for (const [resource, indices] of byResource) {
-    const labelled = await labelRows(client, resource, indices.map((i) => results[i].value));
+    const labelled = await labelRows(client, resource, indices.map((i) => results[i].value), true);
     indices.forEach((idx, j) => {
       results[idx] = { ...results[idx], value: labelled.rows[j] };
     });