node-autotask 0.39.2 → 0.39.4

package/CHANGELOG.md

@@ -5,6 +5,27 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [0.39.4] - pending
+
+Patch: label path fix (#306). No capability-plan change.
+
+- **#306: `companyID: 0` now resolves to a name.** Id 0 is the tenant owner's own company (a real record, verified live: `GET /Companies/0` and `id eq 0` return it; none of 13 other FK targets probed has an id 0). Since 0.39.0 the row label path skipped every FK of 0, so `companyIDName` was `null` for internal tickets, projects and contracts. The 0-skip is now FK-specific: `companyID` 0 is read and named, every other FK of 0 (and every `*ResourceID` of 0) still serves `null` with no read. The composite paths never plan a company FK and are unchanged.
+
+## [0.39.3] - 2026-10-30
+
+Patch: standalone fixes (#263, #264, #265, #266, #306 part a). No capability-plan change.
+
+### Fixed
+- **#264:** `credentialShapeProblem` now reports an interior line feed (`'line feed'`), matching its "interior CR/LF always reported" doc; previously an LF-laden credential reached fetch and surfaced as an opaque `NETWORK_ERROR`.
+- **#265:** `createIfNotExists` treats a dedup match with an all-digit string id (above 2^53) as existing, and the create dry-run `parent-exists` check accepts a string-id parent; both go through `parseIdentifier`.
+- **#263:** a mutation sent with `idempotent: true` (for example `client.http.request`) now voids cached reads like any other write. `idempotent` governs retry only; the internal `/query`, `/query/count` and `/query/next` read POSTs still skip invalidation.
+- **#306 (a):** the picklist-unavailable note now names the resource (`... unavailable for tickets.status (see reasons)`), matching the `<resource>.<field>` `reasons` keys; the `resolveCompositeNames` catch branch is covered by a test.
+
+### Changed
+- **#266 / #306 (a):** docs only. Pagination module headers now state that same-origin cursors are used and cross-origin cursors are refused with `ResponseRejectedError` (issue #54); the API.md note on id 0 is reworded as a node rule, not a vendor claim.
+
 ## [0.39.2] - 2026-10-30
 
 Patch: follow-ups to the 0.39.0 / 0.39.1 label work (#302, #303, #304). The plan hash is unchanged (`9bb87de7...`); no capability-plan change, so the MCP server needs no re-pin.

package/README.md

@@ -120,7 +120,7 @@ code `INVALID_CREDENTIAL_SHAPE`) **before any request is built**. The three cano
 `AUTOTASK_API_INTEGRATION_CODE` and `AUTOTASK_USER` are read as fall-backs, canonical first.
 
 **What the SDK refuses at construction.** `apiIntegrationCode`, `userName`, `secret` and
-`impersonationResourceId` reject a value with a surrounding quote pair or an interior CR (and refuse
+`impersonationResourceId` reject a value with a surrounding quote pair or an interior CR or LF (and refuse
 whitespace-only blank values exactly as before); padding-only whitespace is still trimmed as it
 always was. The same gate runs at the wire boundary, so a value that reaches the transport by any
 other route is refused before the request is sent. Errors are value-free: they name the field and

package/dist/{chunk-GSGP2B4I.js → chunk-DBLXPY4B.js}

@@ -30,7 +30,7 @@ import {
   unwrapItems,
   unwrapOperation,
   vendorId
-} from "./chunk-UNOQESFU.js";
+} from "./chunk-GHRB46YN.js";
 import {
   CAPABILITIES
 } from "./chunk-GDSCYY2G.js";