node-autotask 0.41.0 → 0.42.0

package/dist/operations/index.cjs

@@ -69,30 +69,33 @@
 
 
 
-var _chunkDKAD7MOVcjs = require('../chunk-DKAD7MOV.cjs');
 
+var _chunkSEFJJY4Jcjs = require('../chunk-SEFJJY4J.cjs');
 
-var _chunkMJ6J74F3cjs = require('../chunk-MJ6J74F3.cjs');
-require('../chunk-MJTKK3QG.cjs');
+
+var _chunkVEOSOIU4cjs = require('../chunk-VEOSOIU4.cjs');
+
+
+var _chunkMJTKK3QGcjs = require('../chunk-MJTKK3QG.cjs');
 
 // src/operations/searchAcrossResources.ts
 var DEFAULT_LIMIT = 25;
 function resourceFor(client, key) {
-  return client[_chunkDKAD7MOVcjs.camelKey.call(void 0, key)];
+  return client[_chunkSEFJJY4Jcjs.camelKey.call(void 0, key)];
 }
 async function searchAcrossResources(client, query, opts = {}) {
   const text = query.trim();
   if (text === "") {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)("searchAcrossResources: query must be a non-empty string");
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)("searchAcrossResources: query must be a non-empty string");
   }
-  const keys = _nullishCoalesce(opts.resources, () => ( _chunkDKAD7MOVcjs.WORKFLOW_RESOURCES));
+  const keys = _nullishCoalesce(opts.resources, () => ( _chunkSEFJJY4Jcjs.WORKFLOW_RESOURCES));
   if (keys.length === 0) {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)("searchAcrossResources: no resources requested");
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)("searchAcrossResources: no resources requested");
   }
-  const limit = _chunkDKAD7MOVcjs.clampPageSize.call(void 0, _nullishCoalesce(opts.limit, () => ( DEFAULT_LIMIT)));
+  const limit = _chunkSEFJJY4Jcjs.clampPageSize.call(void 0, _nullishCoalesce(opts.limit, () => ( DEFAULT_LIMIT)));
   const totalLimit = opts.totalLimit;
   if (totalLimit !== void 0 && !(Number.isInteger(totalLimit) && totalLimit >= 1)) {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)("searchAcrossResources: totalLimit must be a positive integer");
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)("searchAcrossResources: totalLimit must be a positive integer");
   }
   const results = [];
   const skipped = [];
@@ -123,7 +126,7 @@ async function searchAcrossResources(client, query, opts = {}) {
 
 // src/operations/resolveAny.ts
 function resourceFor2(client, key) {
-  return client[_chunkDKAD7MOVcjs.camelKey.call(void 0, key)];
+  return client[_chunkSEFJJY4Jcjs.camelKey.call(void 0, key)];
 }
 var FAULT_CATEGORIES = /* @__PURE__ */ new Set(["auth", "rate_limit", "server", "network", "timeout", "policy"]);
 function missCost(identifier) {
@@ -132,13 +135,17 @@ function missCost(identifier) {
 }
 async function resolveAny(client, identifier, opts = {}) {
   if (typeof identifier === "number") {
-    _chunkDKAD7MOVcjs.parseIdentifier.call(void 0, identifier, "identifier");
+    _chunkSEFJJY4Jcjs.parseIdentifier.call(void 0, identifier, "identifier");
   } else if (identifier.trim() === "") {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)("resolveAny: identifier must be non-empty");
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)("resolveAny: identifier must be non-empty");
   }
-  const keys = _nullishCoalesce(opts.resources, () => ( _chunkDKAD7MOVcjs.WORKFLOW_RESOURCES));
+  const keys = _nullishCoalesce(opts.resources, () => ( _chunkSEFJJY4Jcjs.WORKFLOW_RESOURCES));
   if (keys.length === 0) {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)("resolveAny: no resources requested");
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)("resolveAny: no resources requested");
+  }
+  const match = _nullishCoalesce(opts.match, () => ( "exact"));
+  if (match !== "exact" && match !== "auto") {
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(`resolveAny: match must be 'exact' or 'auto' (got ${JSON.stringify(match)})`);
   }
   const results = [];
   for (const key of keys) {
@@ -157,20 +164,37 @@ async function resolveAny(client, identifier, opts = {}) {
     }
     try {
       const r = await holder.resolveDetailed(identifier);
-      results.push({
+      let outcome = {
         resource: key,
         value: _nullishCoalesce(r.value, () => ( null)),
         resolutionCost: r.resolutionCost,
         scanned: r.scanned,
         scanTruncated: r.scanTruncated,
         candidates: (_nullishCoalesce(r.candidates, () => ( []))).map((c) => c.id)
-      });
+      };
+      if (match === "auto" && outcome.value === null && typeof identifier === "string") {
+        const hits = await holder.resolveContainsMatches(identifier);
+        if (hits.length === 1) {
+          outcome = { resource: key, value: hits[0], resolutionCost: "server-filter", scanned: 0, scanTruncated: false, candidates: [] };
+        } else if (hits.length > 1) {
+          outcome = {
+            resource: key,
+            value: null,
+            resolutionCost: "server-filter",
+            scanned: 0,
+            scanTruncated: false,
+            candidates: hits.map((h) => h.id).filter((id) => typeof id === "number"),
+            error: "RESOLUTION_AMBIGUOUS"
+          };
+        }
+      }
+      results.push(outcome);
     } catch (err) {
       let code;
       let candidates = [];
-      if (err instanceof _chunkDKAD7MOVcjs.AutotaskConfigError) {
+      if (err instanceof _chunkSEFJJY4Jcjs.AutotaskConfigError) {
         code = "CONFIG_ERROR";
-      } else if (_chunkDKAD7MOVcjs.isAutotaskError.call(void 0, err)) {
+      } else if (_chunkSEFJJY4Jcjs.isAutotaskError.call(void 0, err)) {
         if (FAULT_CATEGORIES.has(err.category)) throw err;
         code = err.code;
         if (code === "RESOLUTION_AMBIGUOUS" && err.resourceIds !== void 0) {
@@ -197,7 +221,7 @@ async function resolveAny(client, identifier, opts = {}) {
 // src/operations/aggregate.ts
 var AGGREGATE_TOP_MAX = 100;
 var AGGREGATE_DEFAULT_TOP = 25;
-var AGGREGATE_DEFAULT_LIMIT = _chunkDKAD7MOVcjs.BOUNDED_QUERY_MAX_LIMIT;
+var AGGREGATE_DEFAULT_LIMIT = _chunkSEFJJY4Jcjs.BOUNDED_QUERY_MAX_LIMIT;
 var AGGREGATE_DATE_BUCKETS = ["month", "week", "year"];
 var DATE_ONLY_RE = /^(\d{4})-(\d{2})-(\d{2})$/;
 var DATETIME_RE = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(\.\d{1,9})?(Z|[+-]\d{2}:?\d{2})?$/;
@@ -254,10 +278,10 @@ function dateBucketLabel(value, bucket) {
 }
 var QUERY_RESOURCE_KEYS = (() => {
   const s = /* @__PURE__ */ new Set();
-  for (const rec of _chunkMJ6J74F3cjs.CAPABILITIES) if (rec.operation === "query") s.add(rec.resource);
+  for (const rec of _chunkVEOSOIU4cjs.CAPABILITIES) if (rec.operation === "query") s.add(rec.resource);
   return s;
 })();
-var AGGREGATE_OPT_KEYS = ["groupBy", "sum", "top", "limit", "names"];
+var AGGREGATE_OPT_KEYS = ["groupBy", "sum", "top", "limit", "names", "acknowledgeUnscoped"];
 var OP_RE = /^([a-z0-9_]+)\.query$/;
 function num2(v) {
   return typeof v === "number" && Number.isFinite(v) ? v : 0;
@@ -290,15 +314,15 @@ function parseFilterConditions(filter, problems) {
     return [];
   }
   try {
-    return _chunkDKAD7MOVcjs.buildFilter.call(void 0, conds).filter;
+    return _chunkSEFJJY4Jcjs.buildFilter.call(void 0, conds).filter;
   } catch (err) {
-    problems.push(err instanceof _chunkDKAD7MOVcjs.AutotaskConfigError ? err.message : `filter must be the query-bag filter (13 operators; caps 500 OR-conditions / 1 UDF / 8000 chars); ${String(err)}`);
+    problems.push(err instanceof _chunkSEFJJY4Jcjs.AutotaskConfigError ? err.message : `filter must be the query-bag filter (13 operators; caps 500 OR-conditions / 1 UDF / 8000 chars); ${String(err)}`);
     return [];
   }
 }
 function checkOptsBag(opts, problems) {
   if (opts !== void 0 && (typeof opts !== "object" || opts === null || Array.isArray(opts))) {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(
       `aggregate: opts must be the options object (got ${Array.isArray(opts) ? "an array" : typeof opts})`,
       { operation: "operations.aggregate" }
     );
@@ -309,6 +333,9 @@ function checkOptsBag(opts, problems) {
     }
   }
   if (_optionalChain([opts, 'optionalAccess', _2 => _2.names]) !== void 0 && typeof opts.names !== "boolean") problems.push(`names must be a boolean (got ${typeof opts.names})`);
+  if (_optionalChain([opts, 'optionalAccess', _3 => _3.acknowledgeUnscoped]) !== void 0 && typeof opts.acknowledgeUnscoped !== "boolean") {
+    problems.push(`acknowledgeUnscoped must be a boolean (got ${typeof opts.acknowledgeUnscoped})`);
+  }
 }
 function checkSumFields(name, fields, problems) {
   if (fields === void 0) return [];
@@ -362,18 +389,18 @@ function parseTopAndLimit(opts, problems) {
     if (!Number.isInteger(opts.limit)) {
       problems.push(`limit must be an integer (got ${String(opts.limit)})`);
     } else {
-      limit = Math.min(Math.max(opts.limit, 1), _chunkDKAD7MOVcjs.BOUNDED_QUERY_MAX_LIMIT);
+      limit = Math.min(Math.max(opts.limit, 1), _chunkSEFJJY4Jcjs.BOUNDED_QUERY_MAX_LIMIT);
     }
   }
   return { top, limit };
 }
 async function checkFieldNames(resourceKey, conditions, opts, problems) {
-  const record = resourceKey === void 0 ? void 0 : _chunkMJ6J74F3cjs.CAPABILITIES.find((r) => r.resource === resourceKey && r.operation === "query");
+  const record = resourceKey === void 0 ? void 0 : _chunkVEOSOIU4cjs.CAPABILITIES.find((r) => r.resource === resourceKey && r.operation === "query");
   if (record === void 0) return void 0;
   const strings = (v) => Array.isArray(v) ? v.filter((f) => typeof f === "string" && f.trim() !== "") : [];
   const groupBy = strings(opts.groupBy);
-  const found = await _chunkDKAD7MOVcjs.findUnknownFieldNames.call(void 0, record, void 0, {
-    filter: _chunkDKAD7MOVcjs.collectFilterFieldNames.call(void 0, conditions),
+  const found = await _chunkSEFJJY4Jcjs.findUnknownFieldNames.call(void 0, record, void 0, {
+    filter: _chunkSEFJJY4Jcjs.collectFilterFieldNames.call(void 0, conditions, resourceKey),
     groupBy: groupBy.map((f) => f.split("@")[0]),
     sum: strings(opts.sum)
   });
@@ -397,19 +424,22 @@ async function validateAggregate(operation, filter, opts) {
   checkOptsBag(opts, problems);
   const oracles = {
     resourceKey,
-    dateSets: resourceKey !== void 0 ? _chunkDKAD7MOVcjs.MODEL_DATE_FIELDS[resourceKey] : void 0
+    dateSets: resourceKey !== void 0 ? _chunkSEFJJY4Jcjs.MODEL_DATE_FIELDS[resourceKey] : void 0
   };
   const known = await checkFieldNames(resourceKey, conditions, opts, problems);
   const groupBy = parseGroupBy(opts, oracles, known, problems);
   const sum = checkSumFields("sum", opts.sum, problems);
   const { top, limit } = parseTopAndLimit(opts, problems);
   if (problems.length > 0) {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(
       `aggregate: ${problems.length} problem(s) found pre-request (zero wire was issued)
 - ` + problems.join("\n- "),
       { operation: "operations.aggregate" }
     );
   }
+  if ((groupBy.length > 0 || sum.length > 0) && conditions.length === 0 && opts.acknowledgeUnscoped !== true) {
+    throw new (0, _chunkSEFJJY4Jcjs.ScopeRequiredError)(operation, { threshold: _chunkSEFJJY4Jcjs.UNSCOPED_WALK_THRESHOLD }, "empty-filter");
+  }
   return { resourceKey, conditions, groupBy, sum, top, limit };
 }
 function foldGroups(items, v) {
@@ -438,9 +468,9 @@ function foldGroups(items, v) {
 }
 async function aggregate(client, operation, filter, opts = {}) {
   const v = await validateAggregate(operation, filter, opts);
-  const holder = client[_chunkDKAD7MOVcjs.camelKey.call(void 0, v.resourceKey)];
+  const holder = client[_chunkSEFJJY4Jcjs.camelKey.call(void 0, v.resourceKey)];
   if (holder === void 0) {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(`aggregate: the client exposes no accessor for resource "${v.resourceKey}"`, {
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(`aggregate: the client exposes no accessor for resource "${v.resourceKey}"`, {
       operation: "operations.aggregate",
       suggestedAction: "Rebuild the client from the SDK build that ships this registry (the resource set is pinned by the plan)."
     });
@@ -449,7 +479,7 @@ async function aggregate(client, operation, filter, opts = {}) {
   if (v.groupBy.length === 0 && v.sum.length === 0) {
     const raw = await holder.count({ filter: wireFilter });
     const sentinel = typeof raw === "object" && raw !== null && "count" in raw ? raw : { count: raw };
-    const result2 = { mode: "count", count: sentinel.count, blind: sentinel.blindSurface !== void 0 };
+    const result2 = { mode: "count", count: sentinel.count, blind: sentinel.blindSurface !== void 0, truncated: false };
     if (sentinel.blindSurface !== void 0) result2.blindSurface = sentinel.blindSurface;
     if (sentinel.emptyReason !== void 0) result2.emptyReason = sentinel.emptyReason;
     return result2;
@@ -457,19 +487,22 @@ async function aggregate(client, operation, filter, opts = {}) {
   const res = await holder.queryBounded({ filter: wireFilter, limit: v.limit });
   const sorted = foldGroups(res.items, v);
   const top = sorted.slice(0, v.top);
-  const labelled = opts.names === false || v.groupBy.length === 0 ? void 0 : await _chunkDKAD7MOVcjs.labelRows.call(void 0, client, v.resourceKey, top.map((g) => g.key));
+  const label = _chunkSEFJJY4Jcjs.readNamesOpt.call(void 0, client, opts.names, "aggregate");
+  const labelled = !label || v.groupBy.length === 0 ? void 0 : await _chunkSEFJJY4Jcjs.labelRows.call(void 0, client, v.resourceKey, top.map((g) => g.key));
   const result = {
     mode: v.groupBy.length > 0 ? "group" : "sum",
-    groups: top.map((g, i) => ({ key: _nullishCoalesce(_optionalChain([labelled, 'optionalAccess', _3 => _3.rows, 'access', _4 => _4[i]]), () => ( g.key)), count: g.count, ...g.sums !== void 0 ? { sums: g.sums } : {} })),
+    groups: top.map((g, i) => ({ key: _nullishCoalesce(_optionalChain([labelled, 'optionalAccess', _4 => _4.rows, 'access', _5 => _5[i]]), () => ( g.key)), count: g.count, ...g.sums !== void 0 ? { sums: g.sums } : {} })),
     totalGroups: sorted.length,
     groupsTruncated: sorted.length > top.length,
     totalScanned: res.fetched,
-    hasMore: res.hasMore
+    hasMore: res.hasMore,
+    truncated: res.hasMore
+    // issue #287 (D6): the walk hit its limit — groups may be incomplete
   };
   if (res.blindSurface !== void 0) result.blindSurface = res.blindSurface;
   if (res.emptyReason !== void 0) result.emptyReason = res.emptyReason;
   if (res.relationNote !== void 0) result.relationNote = res.relationNote;
-  if (_optionalChain([labelled, 'optionalAccess', _5 => _5.names]) !== void 0) result.names = labelled.names;
+  if (_optionalChain([labelled, 'optionalAccess', _6 => _6.names]) !== void 0) result.names = labelled.names;
   return result;
 }
 
@@ -488,12 +521,12 @@ var DEFAULT_CONTRACT_TYPE_RE = /^\s*(recurring|fixed)\b/i;
 var CONTRACTS_PATH = "/V1.0/Contracts";
 var COMPANIES_PATH = "/V1.0/Companies";
 var BILLING_ITEMS_PATH = "/V1.0/BillingItems";
-var LINE_TYPE_FIELDS = ["billingItemType", "timeEntryID", "expenseItemID", ..._chunkDKAD7MOVcjs.CHARGE_LINE_FKS, ..._chunkDKAD7MOVcjs.SERVICE_LINE_FKS];
-var isLabour = (line) => _chunkDKAD7MOVcjs.billingLineType.call(void 0, line) === "labour";
+var LINE_TYPE_FIELDS = ["billingItemType", "timeEntryID", "expenseItemID", ..._chunkSEFJJY4Jcjs.CHARGE_LINE_FKS, ..._chunkSEFJJY4Jcjs.SERVICE_LINE_FKS];
+var isLabour = (line) => _chunkSEFJJY4Jcjs.billingLineType.call(void 0, line) === "labour";
 function picklistKey(c, dim, path, field, raw, missing) {
-  const id = _chunkDKAD7MOVcjs.num.call(void 0, raw);
+  const id = _chunkSEFJJY4Jcjs.num.call(void 0, raw);
   if (id === 0) return { id: null, label: missing };
-  const label = _optionalChain([c, 'access', _6 => _6.labels, 'access', _7 => _7[path], 'optionalAccess', _8 => _8.get, 'call', _9 => _9(field), 'optionalAccess', _10 => _10.get, 'call', _11 => _11(id)]);
+  const label = _optionalChain([c, 'access', _7 => _7.labels, 'access', _8 => _8[path], 'optionalAccess', _9 => _9.get, 'call', _10 => _10(field), 'optionalAccess', _11 => _11.get, 'call', _12 => _12(id)]);
   if (label === void 0) {
     c.unlabelled.add(`${dim}: ${field} value ${id} has no label on the live ${path} picklist (id-only)`);
     return { id };
@@ -504,7 +537,7 @@ var DIMENSIONS = {
   vertical: {
     joins: { companies: ["marketSegmentID"] },
     picklist: COMPANIES_PATH,
-    key: (c) => picklistKey(c, "vertical", COMPANIES_PATH, "marketSegmentID", _optionalChain([c, 'access', _12 => _12.company, 'optionalAccess', _13 => _13["marketSegmentID"]]), "unassigned")
+    key: (c) => picklistKey(c, "vertical", COMPANIES_PATH, "marketSegmentID", _optionalChain([c, 'access', _13 => _13.company, 'optionalAccess', _14 => _14["marketSegmentID"]]), "unassigned")
   },
   contractType: {
     key: (c) => picklistKey(c, "contractType", CONTRACTS_PATH, "contractType", c.contract["contractType"], "none")
@@ -514,7 +547,7 @@ var DIMENSIONS = {
   },
   company: {
     joins: { companies: ["companyName"] },
-    key: (c) => ({ id: _chunkDKAD7MOVcjs.num.call(void 0, c.line["companyID"]), name: String(_nullishCoalesce(_optionalChain([c, 'access', _14 => _14.company, 'optionalAccess', _15 => _15["companyName"]]), () => ( ""))) })
+    key: (c) => ({ id: _chunkSEFJJY4Jcjs.num.call(void 0, c.line["companyID"]), name: String(_nullishCoalesce(_optionalChain([c, 'access', _15 => _15.company, 'optionalAccess', _16 => _16["companyName"]]), () => ( ""))) })
   },
   month: {
     key: (c) => ({ id: c.invoice.month })
@@ -522,11 +555,11 @@ var DIMENSIONS = {
   billingItemKind: {
     lineFields: LINE_TYPE_FIELDS,
     picklist: BILLING_ITEMS_PATH,
-    key: (c) => _chunkDKAD7MOVcjs.num.call(void 0, c.line["billingItemType"]) === 0 ? { id: _chunkDKAD7MOVcjs.billingLineType.call(void 0, c.line), label: _chunkDKAD7MOVcjs.billingLineType.call(void 0, c.line) } : picklistKey(c, "billingItemKind", BILLING_ITEMS_PATH, "billingItemType", c.line["billingItemType"], "other")
+    key: (c) => _chunkSEFJJY4Jcjs.num.call(void 0, c.line["billingItemType"]) === 0 ? { id: _chunkSEFJJY4Jcjs.billingLineType.call(void 0, c.line), label: _chunkSEFJJY4Jcjs.billingLineType.call(void 0, c.line) } : picklistKey(c, "billingItemKind", BILLING_ITEMS_PATH, "billingItemType", c.line["billingItemType"], "other")
   },
   contract: {
     joins: { contracts: ["contractName"] },
-    key: (c) => ({ id: _chunkDKAD7MOVcjs.num.call(void 0, c.line["contractID"]), name: String(_nullishCoalesce(c.contract["contractName"], () => ( ""))) })
+    key: (c) => ({ id: _chunkSEFJJY4Jcjs.num.call(void 0, c.line["contractID"]), name: String(_nullishCoalesce(c.contract["contractName"], () => ( ""))) })
   },
   // Per line (no contract-pointer fallback): association → level2 (the Line of Business, `name`) + level1 (the division).
   lineOfBusiness: {
@@ -534,11 +567,11 @@ var DIMENSIONS = {
     joins: { organizationalLevelAssociations: [], organizationalLevel1s: [], organizationalLevel2s: [] },
     unresolved: "unresolvedAssociations",
     key: (c) => {
-      const id = _chunkDKAD7MOVcjs.num.call(void 0, c.line["organizationalLevelAssociationID"]);
+      const id = _chunkSEFJJY4Jcjs.num.call(void 0, c.line["organizationalLevelAssociationID"]);
       if (id === 0) return { id: null, label: "no LOB assigned" };
       const a = c.joined.organizationalLevelAssociations.get(id);
-      const l1 = c.joined.organizationalLevel1s.get(_chunkDKAD7MOVcjs.num.call(void 0, _optionalChain([a, 'optionalAccess', _16 => _16["organizationalLevel1ID"]])));
-      const l2 = c.joined.organizationalLevel2s.get(_chunkDKAD7MOVcjs.num.call(void 0, _optionalChain([a, 'optionalAccess', _17 => _17["organizationalLevel2ID"]])));
+      const l1 = c.joined.organizationalLevel1s.get(_chunkSEFJJY4Jcjs.num.call(void 0, _optionalChain([a, 'optionalAccess', _17 => _17["organizationalLevel1ID"]])));
+      const l2 = c.joined.organizationalLevel2s.get(_chunkSEFJJY4Jcjs.num.call(void 0, _optionalChain([a, 'optionalAccess', _18 => _18["organizationalLevel2ID"]])));
       if (l1 === void 0 || l2 === void 0) return "unresolvedAssociations";
       return { id, name: String(_nullishCoalesce(l2["name"], () => ( ""))), division: String(_nullishCoalesce(l1["name"], () => ( ""))) };
     }
@@ -549,9 +582,9 @@ var DIMENSIONS = {
     joins: { timeEntries: [], resources: [] },
     unresolved: "unresolvedTimeEntries",
     key: (c) => {
-      const te = _chunkDKAD7MOVcjs.num.call(void 0, c.line["timeEntryID"]);
+      const te = _chunkSEFJJY4Jcjs.num.call(void 0, c.line["timeEntryID"]);
       if (!isLabour(c.line) || te === 0) return { id: null, label: "n/a" };
-      const id = _chunkDKAD7MOVcjs.num.call(void 0, _optionalChain([c, 'access', _18 => _18.joined, 'access', _19 => _19.timeEntries, 'access', _20 => _20.get, 'call', _21 => _21(te), 'optionalAccess', _22 => _22["resourceID"]]));
+      const id = _chunkSEFJJY4Jcjs.num.call(void 0, _optionalChain([c, 'access', _19 => _19.joined, 'access', _20 => _20.timeEntries, 'access', _21 => _21.get, 'call', _22 => _22(te), 'optionalAccess', _23 => _23["resourceID"]]));
       const r = c.joined.resources.get(id);
       if (r === void 0) return "unresolvedTimeEntries";
       return { id, name: `${String(_nullishCoalesce(r["firstName"], () => ( "")))} ${String(_nullishCoalesce(r["lastName"], () => ( "")))}`.trim() };
@@ -562,58 +595,58 @@ var DIMENSIONS = {
     joins: { billingCodes: [] },
     unresolved: "unresolvedBillingCodes",
     key: (c) => {
-      const id = _chunkDKAD7MOVcjs.num.call(void 0, c.line["billingCodeID"]);
+      const id = _chunkSEFJJY4Jcjs.num.call(void 0, c.line["billingCodeID"]);
       if (id === 0) return { id: null, label: "none" };
       const b = c.joined.billingCodes.get(id);
       return b === void 0 ? "unresolvedBillingCodes" : { id, name: String(_nullishCoalesce(b["name"], () => ( ""))) };
     }
   }
 };
-var fk = (rows, field) => [...rows].map((r) => _chunkDKAD7MOVcjs.num.call(void 0, r[field]));
+var fk = (rows, field) => [...rows].map((r) => _chunkSEFJJY4Jcjs.num.call(void 0, r[field]));
 var ONE_CHUNK = (idChunks) => Math.min(1, idChunks);
 var JOINS = {
   contracts: {
-    make: (http) => new (0, _chunkDKAD7MOVcjs.ContractsResource)(http, PAGE),
+    make: (http) => new (0, _chunkSEFJJY4Jcjs.ContractsResource)(http, PAGE),
     fields: ["id", "contractType", "contractCategory"],
     ids: (lines) => fk(lines, "contractID")
   },
   companies: {
-    make: (http) => new (0, _chunkDKAD7MOVcjs.CompaniesResource)(http, PAGE),
+    make: (http) => new (0, _chunkSEFJJY4Jcjs.CompaniesResource)(http, PAGE),
     fields: ["id"],
     ids: (lines) => fk(lines, "companyID")
   },
   organizationalLevelAssociations: {
-    make: (http) => new (0, _chunkDKAD7MOVcjs.OrganizationalLevelAssociationsResource)(http, PAGE),
+    make: (http) => new (0, _chunkSEFJJY4Jcjs.OrganizationalLevelAssociationsResource)(http, PAGE),
     fields: ["id", "organizationalLevel1ID", "organizationalLevel2ID"],
     ids: (lines) => fk(lines, "organizationalLevelAssociationID")
   },
   organizationalLevel1s: {
-    make: (http) => new (0, _chunkDKAD7MOVcjs.OrganizationalLevel1sResource)(http, PAGE),
+    make: (http) => new (0, _chunkSEFJJY4Jcjs.OrganizationalLevel1sResource)(http, PAGE),
     fields: ["id", "name"],
     ids: (_, j) => fk(j["organizationalLevelAssociations"].values(), "organizationalLevel1ID"),
     chunks: ONE_CHUNK
   },
   organizationalLevel2s: {
-    make: (http) => new (0, _chunkDKAD7MOVcjs.OrganizationalLevel2sResource)(http, PAGE),
+    make: (http) => new (0, _chunkSEFJJY4Jcjs.OrganizationalLevel2sResource)(http, PAGE),
     fields: ["id", "name"],
     ids: (_, j) => fk(j["organizationalLevelAssociations"].values(), "organizationalLevel2ID"),
     chunks: ONE_CHUNK
   },
   timeEntries: {
-    make: (http) => new (0, _chunkDKAD7MOVcjs.TimeEntriesResource)(http, PAGE),
+    make: (http) => new (0, _chunkSEFJJY4Jcjs.TimeEntriesResource)(http, PAGE),
     fields: ["id", "resourceID"],
     ids: (lines) => fk(lines.filter(isLabour), "timeEntryID"),
     // One time entry per labour line: the line count is the upper bound (labour share unknown pre-walk).
     chunks: (_, lines) => pages(lines)
   },
   resources: {
-    make: (http, client) => new (0, _chunkDKAD7MOVcjs.ResourcesResource)(http, client.config, PAGE),
+    make: (http, client) => new (0, _chunkSEFJJY4Jcjs.ResourcesResource)(http, client.config, PAGE),
     fields: ["id", "firstName", "lastName"],
     ids: (_, j) => fk(j["timeEntries"].values(), "resourceID"),
     chunks: ONE_CHUNK
   },
   billingCodes: {
-    make: (http) => new (0, _chunkDKAD7MOVcjs.BillingCodesResource)(http, PAGE),
+    make: (http) => new (0, _chunkSEFJJY4Jcjs.BillingCodesResource)(http, PAGE),
     fields: ["id", "name"],
     ids: (lines) => fk(lines, "billingCodeID")
   }
@@ -648,7 +681,7 @@ function checkInt(name, v, def, max, problems) {
 }
 function validate(opts) {
   if (typeof opts !== "object" || opts === null || Array.isArray(opts)) {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)("revenueRollup: opts must be the options object { <scope>, dateFrom, dateTo, ... } (zero wire was issued)", { operation: OP });
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)("revenueRollup: opts must be the options object { <scope>, dateFrom, dateTo, ... } (zero wire was issued)", { operation: OP });
   }
   const o = opts;
   const problems = [];
@@ -665,12 +698,12 @@ function validate(opts) {
     if (scopeKind === "tenantWide" && o.tenantWide !== true) problems.push("tenantWide must be exactly true");
   }
   const { dateFrom, dateTo } = o;
-  if (!_chunkDKAD7MOVcjs.isDateYMD.call(void 0, dateFrom) || !_chunkDKAD7MOVcjs.isDateYMD.call(void 0, dateTo)) {
+  if (!_chunkSEFJJY4Jcjs.isDateYMD.call(void 0, dateFrom) || !_chunkSEFJJY4Jcjs.isDateYMD.call(void 0, dateTo)) {
     problems.push("dateFrom and dateTo are both required as YYYY-MM-DD (the window is inclusive, whole UTC days)");
   } else if (dateFrom > dateTo) {
     problems.push(`dateFrom ${dateFrom} is after dateTo ${dateTo}`);
-  } else if (_chunkDKAD7MOVcjs.monthsInWindow.call(void 0, dateFrom, dateTo) > _chunkDKAD7MOVcjs.PROFITABILITY_MAX_WINDOW_MONTHS) {
-    problems.push(`the window spans ${_chunkDKAD7MOVcjs.monthsInWindow.call(void 0, dateFrom, dateTo)} months; the cap is ${_chunkDKAD7MOVcjs.PROFITABILITY_MAX_WINDOW_MONTHS}`);
+  } else if (_chunkSEFJJY4Jcjs.monthsInWindow.call(void 0, dateFrom, dateTo) > _chunkSEFJJY4Jcjs.PROFITABILITY_MAX_WINDOW_MONTHS) {
+    problems.push(`the window spans ${_chunkSEFJJY4Jcjs.monthsInWindow.call(void 0, dateFrom, dateTo)} months; the cap is ${_chunkSEFJJY4Jcjs.PROFITABILITY_MAX_WINDOW_MONTHS}`);
   }
   let groupBy = [...DEFAULT_GROUP_BY];
   if (o.groupBy !== void 0) {
@@ -697,7 +730,7 @@ function validate(opts) {
   };
   if (o.includeNonChargeable !== void 0 && typeof o.includeNonChargeable !== "boolean") problems.push("includeNonChargeable must be a boolean");
   if (problems.length > 0) {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(`revenueRollup: ${problems.length} problem(s) found pre-request (zero wire was issued)
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(`revenueRollup: ${problems.length} problem(s) found pre-request (zero wire was issued)
 - ${problems.join("\n- ")}`, { operation: OP });
   }
   return v;
@@ -715,7 +748,7 @@ function resolveSelector(name, sel, values) {
 }
 function unmatched(name, what, values) {
   const live = [...values].map(([id, l]) => `${id} ${l}`).join("; ") || "(the picklist serves no values)";
-  return new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(`revenueRollup: ${name}: ${what}. Live values (id label): ${live}`, {
+  return new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(`revenueRollup: ${name}: ${what}. Live values (id label): ${live}`, {
     operation: OP,
     suggestedAction: `Pass ${name} as ids or exact labels from the live list.`
   });
@@ -726,10 +759,10 @@ var chunk = (a) => {
   for (let i = 0; i < a.length; i += PAGE) out.push(a.slice(i, i + PAGE));
   return out;
 };
-var byId = (rows) => [...new Map(rows.map((r) => [_chunkDKAD7MOVcjs.num.call(void 0, r["id"]), r])).values()];
-var cents = (v) => Math.round(_chunkDKAD7MOVcjs.num.call(void 0, v) * 100);
-var revC = (line) => cents(_chunkDKAD7MOVcjs.internalAmount.call(void 0, line, "internalCurrencyTotalAmount", "totalAmount"));
-var extC = (line) => cents(_chunkDKAD7MOVcjs.internalAmount.call(void 0, line, "internalCurrencyExtendedPrice", "extendedPrice"));
+var byId = (rows) => [...new Map(rows.map((r) => [_chunkSEFJJY4Jcjs.num.call(void 0, r["id"]), r])).values()];
+var cents = (v) => Math.round(_chunkSEFJJY4Jcjs.num.call(void 0, v) * 100);
+var revC = (line) => cents(_chunkSEFJJY4Jcjs.internalAmount.call(void 0, line, "internalCurrencyTotalAmount", "totalAmount"));
+var extC = (line) => cents(_chunkSEFJJY4Jcjs.internalAmount.call(void 0, line, "internalCurrencyExtendedPrice", "extendedPrice"));
 var INTERNAL_FIELDS = ["internalCurrencyTotalAmount", "internalCurrencyExtendedPrice"];
 var lacksInternal = (line) => INTERNAL_FIELDS.some((k) => !Number.isFinite(line[k]));
 var money = (c) => c / 100;
@@ -740,7 +773,7 @@ async function collect(res, filter, includeFields) {
   return out;
 }
 function blindCount() {
-  return new (0, _chunkDKAD7MOVcjs.AutotaskError)("revenueRollup: a gate count came back blind (unknown, not zero); the roll-up cannot be sized", {
+  return new (0, _chunkSEFJJY4Jcjs.AutotaskError)("revenueRollup: a gate count came back blind (unknown, not zero); the roll-up cannot be sized", {
     code: "INVALID_RESPONSE",
     category: "server",
     operation: OP,
@@ -750,7 +783,7 @@ function blindCount() {
 }
 function countMismatch(what, streamed, counted, rows) {
   const rowNote = rows !== void 0 && rows !== streamed ? ` (${rows} rows)` : "";
-  return new (0, _chunkDKAD7MOVcjs.AutotaskError)(`revenueRollup: the ${what} stream returned ${streamed} distinct ids${rowNote} but the gate count was ${counted} (the data changed mid-walk or a page dropped rows); the fold was discarded`, {
+  return new (0, _chunkSEFJJY4Jcjs.AutotaskError)(`revenueRollup: the ${what} stream returned ${streamed} distinct ids${rowNote} but the gate count was ${counted} (the data changed mid-walk or a page dropped rows); the fold was discarded`, {
     code: "INVALID_RESPONSE",
     category: "server",
     operation: OP,
@@ -759,7 +792,7 @@ function countMismatch(what, streamed, counted, rows) {
   });
 }
 function budgetError(message, details, suggestedAction) {
-  return new (0, _chunkDKAD7MOVcjs.AutotaskError)(message, { code: "BUDGET_EXCEEDED", category: "policy", operation: OP, details, suggestedAction });
+  return new (0, _chunkSEFJJY4Jcjs.AutotaskError)(message, { code: "BUDGET_EXCEEDED", category: "policy", operation: OP, details, suggestedAction });
 }
 function lastMonthsFrom(dateTo, months) {
   return new Date(Date.UTC(Number(dateTo.slice(0, 4)), Number(dateTo.slice(5, 7)) - months, 1)).toISOString().slice(0, 10);
@@ -792,7 +825,7 @@ async function revenueRollup(client, opts) {
   const groupDims = v.groupBy.map((d) => DIMENSIONS[d]);
   const paths = [.../* @__PURE__ */ new Set([CONTRACTS_PATH, ...groupDims.flatMap((d) => d.picklist ? [d.picklist] : [])])];
   const labels = {};
-  for (const p of paths) labels[p] = await _chunkDKAD7MOVcjs.readPicklists.call(void 0, http, p, OP);
+  for (const p of paths) labels[p] = await _chunkSEFJJY4Jcjs.readPicklists.call(void 0, http, p, OP);
   const contractLabels = labels[CONTRACTS_PATH];
   const typeValues = _nullishCoalesce(contractLabels.get("contractType"), () => ( /* @__PURE__ */ new Map()));
   const inTypes = v.contractTypes ? resolveSelector("contractTypes", v.contractTypes, typeValues) : new Map([...typeValues].filter(([, l]) => DEFAULT_CONTRACT_TYPE_RE.test(l)));
@@ -801,23 +834,23 @@ async function revenueRollup(client, opts) {
   let scopeIds = v.scopeIds;
   if (v.scopeKind === "ownerResourceID") {
     const owned = /* @__PURE__ */ new Set();
-    for await (const c of new (0, _chunkDKAD7MOVcjs.CompaniesResource)(http, PAGE).query({ filter: [{ field: "ownerResourceID", op: "eq", value: v.ownerResourceID }], includeFields: ["id"], maxRecords: PAGE, names: false })) {
-      const id = _chunkDKAD7MOVcjs.num.call(void 0, c.id);
+    for await (const c of new (0, _chunkSEFJJY4Jcjs.CompaniesResource)(http, PAGE).query({ filter: [{ field: "ownerResourceID", op: "eq", value: v.ownerResourceID }], includeFields: ["id"], maxRecords: PAGE, names: false })) {
+      const id = _chunkSEFJJY4Jcjs.num.call(void 0, c.id);
       if (id > 0) owned.add(id);
       if (owned.size > SCOPE_IDS_MAX) break;
     }
     scopeIds = [...owned].sort((a, b) => a - b);
     if (scopeIds.length === 0 || scopeIds.length > SCOPE_IDS_MAX) {
-      throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(
+      throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(
         `revenueRollup: ownerResourceID ${v.ownerResourceID} resolves to ${scopeIds.length > SCOPE_IDS_MAX ? `more than ${SCOPE_IDS_MAX}` : 0} companies (companies.query; 1..${SCOPE_IDS_MAX} supported)`,
         { operation: OP, suggestedAction: "Pass companyIDs explicitly, or tenantWide: true." }
       );
     }
   }
   const scopeCond = scopeIds === void 0 ? [] : [{ field: v.scopeKind === "contractIDs" ? "contractID" : "companyID", op: "in", value: scopeIds }];
-  const invoices = new (0, _chunkDKAD7MOVcjs.InvoicesResource)(http, PAGE);
-  const billingItems = new (0, _chunkDKAD7MOVcjs.BillingItemsResource)(http, PAGE);
-  const windowOn = (field) => [{ field, op: "gte", value: v.dateFrom }, { field, op: "lt", value: _chunkDKAD7MOVcjs.dayAfter.call(void 0, v.dateTo) }];
+  const invoices = new (0, _chunkSEFJJY4Jcjs.InvoicesResource)(http, PAGE);
+  const billingItems = new (0, _chunkSEFJJY4Jcjs.BillingItemsResource)(http, PAGE);
+  const windowOn = (field) => [{ field, op: "gte", value: v.dateFrom }, { field, op: "lt", value: _chunkSEFJJY4Jcjs.dayAfter.call(void 0, v.dateTo) }];
   const invoiceFilter = (voided2) => [...windowOn("invoiceDateTime"), { field: "isVoided", op: "eq", value: voided2 }];
   const withVoided = v.scopeKind !== "contractIDs";
   const voidedFilter = [...invoiceFilter(true), ...scopeIds !== void 0 && withVoided ? [{ field: "companyID", op: "in", value: scopeIds }] : []];
@@ -826,7 +859,7 @@ async function revenueRollup(client, opts) {
   const uninvoicedFilter = [{ field: "invoiceID", op: "notExist" }, ...windowOn("itemDate"), ...scopeCond];
   const nUninvoiced = v.nonChargeable ? await billingItems.count({ filter: uninvoicedFilter }) : 0;
   if (typeof nInvoices !== "number" || typeof nLines !== "number" || typeof nUninvoiced !== "number") throw blindCount();
-  const joinsNeeded = Object.keys(JOINS).filter((j) => j === "contracts" || groupDims.some((d) => _optionalChain([d, 'access', _23 => _23.joins, 'optionalAccess', _24 => _24[j]])));
+  const joinsNeeded = Object.keys(JOINS).filter((j) => j === "contracts" || groupDims.some((d) => _optionalChain([d, 'access', _24 => _24.joins, 'optionalAccess', _25 => _25[j]])));
   const chunks = pages(nInvoices);
   const linePages = chunks + Math.max(0, pages(nLines) - 1) + chunks;
   const uninvoicedPages = v.nonChargeable ? Math.max(1, pages(nUninvoiced)) : 0;
@@ -841,7 +874,7 @@ async function revenueRollup(client, opts) {
   const invoiceRows = await collect(invoices, invoiceFilter(false), ["id", "invoiceTotal", "invoiceDateTime", "companyID"]);
   const invoiceById = /* @__PURE__ */ new Map();
   for (const r of invoiceRows) {
-    invoiceById.set(_chunkDKAD7MOVcjs.num.call(void 0, r["id"]), { total: cents(r["invoiceTotal"]), month: String(_nullishCoalesce(r["invoiceDateTime"], () => ( ""))).slice(0, 7), companyID: _chunkDKAD7MOVcjs.num.call(void 0, r["companyID"]) });
+    invoiceById.set(_chunkSEFJJY4Jcjs.num.call(void 0, r["id"]), { total: cents(r["invoiceTotal"]), month: String(_nullishCoalesce(r["invoiceDateTime"], () => ( ""))).slice(0, 7), companyID: _chunkSEFJJY4Jcjs.num.call(void 0, r["companyID"]) });
   }
   if (invoiceById.size !== nInvoices) throw countMismatch("invoice", invoiceById.size, nInvoices, invoiceRows.length);
   const voided = withVoided ? byId(await collect(invoices, voidedFilter, ["id", "invoiceTotal"])) : void 0;
@@ -855,13 +888,13 @@ async function revenueRollup(client, opts) {
     if (rows.length !== n) throw countMismatch("line", rows.length, n);
     return rows;
   }, chunk(ids), { concurrency: CONCURRENCY })).flat();
-  const orphan = lines.find((l) => !invoiceById.has(_chunkDKAD7MOVcjs.num.call(void 0, l["invoiceID"])));
+  const orphan = lines.find((l) => !invoiceById.has(_chunkSEFJJY4Jcjs.num.call(void 0, l["invoiceID"])));
   if (orphan !== void 0) {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskError)(`revenueRollup: billing line ${_chunkDKAD7MOVcjs.num.call(void 0, orphan["id"])} belongs to invoice ${_chunkDKAD7MOVcjs.num.call(void 0, orphan["invoiceID"])}, which is not among the ${invoiceById.size} streamed invoices; the fold was discarded`, {
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskError)(`revenueRollup: billing line ${_chunkSEFJJY4Jcjs.num.call(void 0, orphan["id"])} belongs to invoice ${_chunkSEFJJY4Jcjs.num.call(void 0, orphan["invoiceID"])}, which is not among the ${invoiceById.size} streamed invoices; the fold was discarded`, {
       code: "INVALID_RESPONSE",
       category: "server",
       operation: OP,
-      details: { reason: "orphan_line", lineID: _chunkDKAD7MOVcjs.num.call(void 0, orphan["id"]), invoiceID: _chunkDKAD7MOVcjs.num.call(void 0, orphan["invoiceID"]) },
+      details: { reason: "orphan_line", lineID: _chunkSEFJJY4Jcjs.num.call(void 0, orphan["id"]), invoiceID: _chunkSEFJJY4Jcjs.num.call(void 0, orphan["invoiceID"]) },
       suggestedAction: "Retry the call."
     });
   }
@@ -872,15 +905,15 @@ async function revenueRollup(client, opts) {
   for (const j of joinsNeeded) {
     const spec = JOINS[j];
     const res = spec.make(http, client);
-    const fields = [.../* @__PURE__ */ new Set([...spec.fields, ...groupDims.flatMap((d) => _nullishCoalesce(_optionalChain([d, 'access', _25 => _25.joins, 'optionalAccess', _26 => _26[j]]), () => ( [])))])];
+    const fields = [.../* @__PURE__ */ new Set([...spec.fields, ...groupDims.flatMap((d) => _nullishCoalesce(_optionalChain([d, 'access', _26 => _26.joins, 'optionalAccess', _27 => _27[j]]), () => ( [])))])];
     const want = [...new Set(spec.ids(all, joined))].filter((id) => id > 0).sort((a, b) => a - b);
     const rows = await client.batch((c) => collect(res, [{ field: "id", op: "in", value: c }], fields), chunk(want), { concurrency: CONCURRENCY });
-    for (const r of rows.flat()) joined[j].set(_chunkDKAD7MOVcjs.num.call(void 0, r["id"]), r);
+    for (const r of rows.flat()) joined[j].set(_chunkSEFJJY4Jcjs.num.call(void 0, r["id"]), r);
   }
   return fold(v, { invoiceById, voided, lines, uninvoiced, joined, labels, inTypes, inCategories, scopeIds, calls, estimate });
 }
 function refusal(v, estimate, fixed, scopeIds, joinCount) {
-  const months = _chunkDKAD7MOVcjs.monthsInWindow.call(void 0, v.dateFrom, v.dateTo);
+  const months = _chunkSEFJJY4Jcjs.monthsInWindow.call(void 0, v.dateFrom, v.dateTo);
   const variable = estimate - fixed;
   const fitMonths = Math.floor((v.budget - fixed) * months / variable);
   const suggestions = [];
@@ -953,13 +986,13 @@ function fold(v, f) {
   const contractLabels = f.labels[CONTRACTS_PATH];
   const bucketLabel = (field, fallback) => (t) => {
     const values = contractLabels.get(field);
-    const l = _optionalChain([values, 'optionalAccess', _27 => _27.get, 'call', _28 => _28(t)]);
+    const l = _optionalChain([values, 'optionalAccess', _28 => _28.get, 'call', _29 => _29(t)]);
     if (l === void 0) return `${fallback} ${t}`;
     return [...values.values()].filter((x) => x === l).length > 1 ? `${l} (${t})` : l;
   };
   const typeLabel = bucketLabel("contractType", "type");
   const catLabel = bucketLabel("contractCategory", "category");
-  const needCompany = v.groupBy.some((d) => _optionalChain([DIMENSIONS, 'access', _29 => _29[d], 'access', _30 => _30.joins, 'optionalAccess', _31 => _31.companies]));
+  const needCompany = v.groupBy.some((d) => _optionalChain([DIMENSIONS, 'access', _30 => _30[d], 'access', _31 => _31.joins, 'optionalAccess', _32 => _32.companies]));
   const byLob = v.groupBy.includes("lineOfBusiness");
   const unlabelled = /* @__PURE__ */ new Set();
   const uncontracted = amt();
@@ -976,15 +1009,15 @@ function fold(v, f) {
   const zeroTotal = amt();
   const zeroIds = /* @__PURE__ */ new Set();
   const locate = (line, invoice) => {
-    const contractID = _chunkDKAD7MOVcjs.num.call(void 0, line["contractID"]);
+    const contractID = _chunkSEFJJY4Jcjs.num.call(void 0, line["contractID"]);
     if (contractID === 0) return { bucket: uncontracted, unresolved: false };
     const contract = f.joined.contracts.get(contractID);
     if (contract === void 0) return { bucket: unresolvedContracts, unresolved: true };
-    const type = _chunkDKAD7MOVcjs.num.call(void 0, contract["contractType"]);
+    const type = _chunkSEFJJY4Jcjs.num.call(void 0, contract["contractType"]);
     if (!f.inTypes.has(type)) return { bucket: slot(otherTypes, typeLabel(type)), unresolved: false };
-    const cat = _chunkDKAD7MOVcjs.num.call(void 0, contract["contractCategory"]);
+    const cat = _chunkSEFJJY4Jcjs.num.call(void 0, contract["contractCategory"]);
     if (f.inCategories !== void 0 && !f.inCategories.has(cat)) return { bucket: slot(otherCats, cat === 0 ? "uncategorised" : catLabel(cat)), unresolved: false };
-    const company = f.joined.companies.get(_chunkDKAD7MOVcjs.num.call(void 0, line["companyID"]));
+    const company = f.joined.companies.get(_chunkSEFJJY4Jcjs.num.call(void 0, line["companyID"]));
     if (needCompany && company === void 0) return { bucket: unresolvedCompanies, unresolved: true };
     const ctx = { line, invoice, contract, company, joined: f.joined, labels: f.labels, unlabelled };
     const keys = {};
@@ -1004,7 +1037,7 @@ function fold(v, f) {
     return { cell };
   };
   for (const line of f.lines) {
-    const invoiceID = _chunkDKAD7MOVcjs.num.call(void 0, line["invoiceID"]);
+    const invoiceID = _chunkSEFJJY4Jcjs.num.call(void 0, line["invoiceID"]);
     const invoice = f.invoiceById.get(invoiceID);
     lineTotals.set(invoiceID, (_nullishCoalesce(lineTotals.get(invoiceID), () => ( 0))) + cents(line["totalAmount"]));
     const c = revC(line);
@@ -1025,9 +1058,9 @@ function fold(v, f) {
       cell.creditLines += 1;
     }
     cell.included += extC(line) - c;
-    cell.contracts.add(_chunkDKAD7MOVcjs.num.call(void 0, line["contractID"]));
+    cell.contracts.add(_chunkSEFJJY4Jcjs.num.call(void 0, line["contractID"]));
     cell.items += 1;
-    allContracts.add(_chunkDKAD7MOVcjs.num.call(void 0, line["contractID"]));
+    allContracts.add(_chunkSEFJJY4Jcjs.num.call(void 0, line["contractID"]));
     if (byLob && cell.keys.lineOfBusiness.id === null) add(noPointer, c);
     const k = v.nonChargeable ? ncClass(line) : void 0;
     if (k) ncAdd(cell.nc, k, line);
@@ -1035,7 +1068,7 @@ function fold(v, f) {
   for (const line of f.uninvoiced) {
     const k = ncClass(line);
     if (!k) continue;
-    const at = locate(line, { total: 0, month: String(_nullishCoalesce(line["itemDate"], () => ( ""))).slice(0, 7), companyID: _chunkDKAD7MOVcjs.num.call(void 0, line["companyID"]) });
+    const at = locate(line, { total: 0, month: String(_nullishCoalesce(line["itemDate"], () => ( ""))).slice(0, 7), companyID: _chunkSEFJJY4Jcjs.num.call(void 0, line["companyID"]) });
     if ("cell" in at) ncAdd(at.cell.nc, k, line);
     else if (at.unresolved) add(unresolvedNc, extC(line));
   }
@@ -1145,20 +1178,20 @@ function slot(m, k) {
 async function relationshipMap(client, resourceKey) {
   void client;
   if (typeof resourceKey !== "string" || resourceKey.trim() === "") {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(
       `relationshipMap: resourceKey must be a non-empty plan resource key string (e.g. 'tickets'; got ${typeof resourceKey === "string" ? "a blank string" : typeof resourceKey})`,
       { suggestedAction: "Pass the exact plan resource key (snake_case) from autotask_catalog \u2014 e.g. tickets, companies, configuration_items, ticket_notes." }
     );
   }
   const key = resourceKey.trim();
-  const entry = _chunkDKAD7MOVcjs.RELATIONSHIP_MAP[key];
+  const entry = _chunkSEFJJY4Jcjs.RELATIONSHIP_MAP[key];
   if (entry === void 0) {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskError)(
-      `relationshipMap: unknown resource "${key}" \u2014 the plan has ${Object.keys(_chunkDKAD7MOVcjs.RELATIONSHIP_MAP).length} resources`,
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskError)(
+      `relationshipMap: unknown resource "${key}" \u2014 the plan has ${Object.keys(_chunkSEFJJY4Jcjs.RELATIONSHIP_MAP).length} resources`,
       {
         code: "RESOURCE_UNKNOWN",
         category: "validation",
-        suggestedAction: `Pass the exact plan resource key (snake_case) from autotask_catalog (e.g. tickets, companies, configuration_items). Zone facts served are ${_chunkDKAD7MOVcjs.RELATIONSHIP_ZONE.label} (${_chunkDKAD7MOVcjs.RELATIONSHIP_ZONE.zone})-verified.`
+        suggestedAction: `Pass the exact plan resource key (snake_case) from autotask_catalog (e.g. tickets, companies, configuration_items). Zone facts served are ${_chunkSEFJJY4Jcjs.RELATIONSHIP_ZONE.label} (${_chunkSEFJJY4Jcjs.RELATIONSHIP_ZONE.zone})-verified.`
       }
     );
   }
@@ -1175,24 +1208,24 @@ var BLIND_SURFACE_KINDS = [
 async function blindSurfaces(client, opts) {
   void client;
   if (opts !== void 0 && (typeof opts !== "object" || opts === null || Array.isArray(opts))) {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)("blindSurfaces: opts must be an object { resource?: string, kind?: BlindSurfaceKind }");
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)("blindSurfaces: opts must be an object { resource?: string, kind?: BlindSurfaceKind }");
   }
-  const inv = _chunkDKAD7MOVcjs.BLIND_SURFACE_INVENTORY;
+  const inv = _chunkSEFJJY4Jcjs.BLIND_SURFACE_INVENTORY;
   if (inv === null) {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)("blindSurfaces: the reachability inventory is absent from the generated artifact \u2014 re-run the build");
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)("blindSurfaces: the reachability inventory is absent from the generated artifact \u2014 re-run the build");
   }
   let surfaces = inv.surfaces;
-  if (_optionalChain([opts, 'optionalAccess', _32 => _32.resource]) !== void 0) {
+  if (_optionalChain([opts, 'optionalAccess', _33 => _33.resource]) !== void 0) {
     const key = typeof opts.resource === "string" ? opts.resource.trim() : "";
     if (key === "") {
-      throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(
+      throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(
         "blindSurfaces: opts.resource must be a non-empty plan resource key string (e.g. 'tickets')",
         { suggestedAction: "Pass the exact plan resource key (snake_case) from autotask_catalog \u2014 e.g. tickets, companies, configuration_items." }
       );
     }
     if (!inv.surfaces.some((row) => row.resource === key)) {
-      throw new (0, _chunkDKAD7MOVcjs.AutotaskError)(
-        `blindSurfaces: unknown resource "${key}" \u2014 the plan has ${Object.keys(_chunkDKAD7MOVcjs.RELATIONSHIP_MAP).length} resources`,
+      throw new (0, _chunkSEFJJY4Jcjs.AutotaskError)(
+        `blindSurfaces: unknown resource "${key}" \u2014 the plan has ${Object.keys(_chunkSEFJJY4Jcjs.RELATIONSHIP_MAP).length} resources`,
         {
           code: "RESOURCE_UNKNOWN",
           category: "validation",
@@ -1202,9 +1235,9 @@ async function blindSurfaces(client, opts) {
     }
     surfaces = surfaces.filter((row) => row.resource === key);
   }
-  if (_optionalChain([opts, 'optionalAccess', _33 => _33.kind]) !== void 0) {
+  if (_optionalChain([opts, 'optionalAccess', _34 => _34.kind]) !== void 0) {
     if (!BLIND_SURFACE_KINDS.includes(opts.kind)) {
-      throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(
+      throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(
         `blindSurfaces: unknown kind "${String(opts.kind)}" \u2014 the valid classes are: ${BLIND_SURFACE_KINDS.join(", ")}`,
         { suggestedAction: `Filter with one of: ${BLIND_SURFACE_KINDS.join(", ")} (or omit kind for the full 116-surface inventory).` }
       );
@@ -1217,51 +1250,51 @@ async function blindSurfaces(client, opts) {
 // src/operations/probeReachability.ts
 async function probeReachability(client, opts) {
   if (opts !== void 0 && (typeof opts !== "object" || opts === null || Array.isArray(opts))) {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)("probeReachability: opts must be an object { resources?: string[], limit?: 1|2, maxWireCalls?: number, confirmProbe?: true }");
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)("probeReachability: opts must be an object { resources?: string[], limit?: 1|2, maxWireCalls?: number, confirmProbe?: true }");
   }
-  const defs = _chunkDKAD7MOVcjs.REACHABILITY_PROBE_DEFAULTS;
-  if (_optionalChain([opts, 'optionalAccess', _34 => _34.confirmProbe]) !== true) {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(
+  const defs = _chunkSEFJJY4Jcjs.REACHABILITY_PROBE_DEFAULTS;
+  if (_optionalChain([opts, 'optionalAccess', _35 => _35.confirmProbe]) !== true) {
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(
       "probeReachability: confirmProbe: true is required \u2014 the op deliberately fans out read wire across the tenant (one bounded query per surface); pass confirmProbe: true to run it",
       { suggestedAction: `Re-call with { confirmProbe: true } (plus resources/limit/maxWireCalls as needed). For the ZERO-wire pinned inventory use operations.blindSurfaces.` }
     );
   }
-  const limit = _nullishCoalesce(_optionalChain([opts, 'optionalAccess', _35 => _35.limit]), () => ( defs.limitDefault));
+  const limit = _nullishCoalesce(_optionalChain([opts, 'optionalAccess', _36 => _36.limit]), () => ( defs.limitDefault));
   if (!Number.isInteger(limit) || limit < 1 || limit > defs.limitMax) {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(
       `probeReachability: limit must be an integer 1..${defs.limitMax} (got ${String(limit)}) \u2014 the rows-per-surface bound for the discovery read`
     );
   }
-  const cap = _nullishCoalesce(_optionalChain([opts, 'optionalAccess', _36 => _36.maxWireCalls]), () => ( defs.defaultCap));
+  const cap = _nullishCoalesce(_optionalChain([opts, 'optionalAccess', _37 => _37.maxWireCalls]), () => ( defs.defaultCap));
   if (!Number.isInteger(cap) || cap < 1) {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(`probeReachability: maxWireCalls must be a positive integer (got ${String(cap)})`);
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(`probeReachability: maxWireCalls must be a positive integer (got ${String(cap)})`);
   }
   if (cap > defs.hardCap) {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(
       `probeReachability: maxWireCalls ${cap} exceeds the hard wire cap of ${defs.hardCap} \u2014 the sweep is refused above it (never capped silently)`,
       { suggestedAction: `Pass maxWireCalls \u2264 ${defs.hardCap} and a resources set no larger than the cap (the refused set is never truncated).` }
     );
   }
-  const inv = _chunkDKAD7MOVcjs.BLIND_SURFACE_INVENTORY;
+  const inv = _chunkSEFJJY4Jcjs.BLIND_SURFACE_INVENTORY;
   if (inv === null) {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)("probeReachability: the reachability inventory is absent from the generated artifact \u2014 re-run the build");
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)("probeReachability: the reachability inventory is absent from the generated artifact \u2014 re-run the build");
   }
   let targets;
-  if (_optionalChain([opts, 'optionalAccess', _37 => _37.resources]) === void 0) {
+  if (_optionalChain([opts, 'optionalAccess', _38 => _38.resources]) === void 0) {
     targets = [...defs.defaultTargets];
   } else {
     if (!Array.isArray(opts.resources) || opts.resources.length === 0) {
-      throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)("probeReachability: opts.resources must be a non-empty string[] of plan resource keys (or omit it for the default non-data-full set)");
+      throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)("probeReachability: opts.resources must be a non-empty string[] of plan resource keys (or omit it for the default non-data-full set)");
     }
     const seen = /* @__PURE__ */ new Set();
     for (const r of opts.resources) {
       if (typeof r !== "string" || r.trim() === "") {
-        throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(`probeReachability: opts.resources must contain non-empty plan resource key strings (got ${typeof r === "string" && r.trim() === "" ? "a blank string" : typeof r})`);
+        throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(`probeReachability: opts.resources must contain non-empty plan resource key strings (got ${typeof r === "string" && r.trim() === "" ? "a blank string" : typeof r})`);
       }
       const key = r.trim();
       if (!inv.surfaces.some((row) => row.resource === key)) {
         const surfaceCount = new Set(inv.surfaces.map((s) => s.resource)).size;
-        throw new (0, _chunkDKAD7MOVcjs.AutotaskError)(
+        throw new (0, _chunkSEFJJY4Jcjs.AutotaskError)(
           `probeReachability: unknown resource "${key}" \u2014 the inventory has ${surfaceCount} surfaces`,
           {
             code: "RESOURCE_UNKNOWN",
@@ -1275,7 +1308,7 @@ async function probeReachability(client, opts) {
     targets = [...seen];
   }
   if (targets.length > cap) {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(
       `probeReachability: ${targets.length} requested surface(s) exceed the wire cap of ${cap} \u2014 the sweep is refused above its cap (never truncated)`,
       { suggestedAction: `Raise maxWireCalls (\u2264 ${defs.hardCap}) to cover the set, or pass a smaller resources list.` }
     );
@@ -1285,8 +1318,8 @@ async function probeReachability(client, opts) {
   for (const resource of targets.sort()) {
     const row = byResource.get(resource);
     if (row === void 0) continue;
-    const holder = client[_chunkDKAD7MOVcjs.camelKey.call(void 0, resource)];
-    const probeFn = _optionalChain([holder, 'optionalAccess', _38 => _38.queryBounded]);
+    const holder = client[_chunkSEFJJY4Jcjs.camelKey.call(void 0, resource)];
+    const probeFn = _optionalChain([holder, 'optionalAccess', _39 => _39.queryBounded]);
     if (typeof probeFn !== "function") {
       results.push({
         ...row,
@@ -1297,14 +1330,14 @@ async function probeReachability(client, opts) {
     }
     try {
       const res = await probeFn.call(holder, { limit });
-      const items = Array.isArray(_optionalChain([res, 'optionalAccess', _39 => _39.items])) ? res.items : [];
+      const items = Array.isArray(_optionalChain([res, 'optionalAccess', _40 => _40.items])) ? res.items : [];
       results.push({
         ...row,
         unfilteredRows: items.length,
         probe: { ok: true, wire: 1, error: null }
       });
     } catch (err) {
-      const code = _chunkDKAD7MOVcjs.isAutotaskError.call(void 0, err) ? err.code : "NETWORK_ERROR";
+      const code = _chunkSEFJJY4Jcjs.isAutotaskError.call(void 0, err) ? err.code : "NETWORK_ERROR";
       const message = err instanceof Error ? err.message : String(err);
       results.push({
         ...row,
@@ -1332,30 +1365,30 @@ var CREATE_BLOCKER_KINDS = [
 async function createGuidance(client, opts) {
   void client;
   if (opts !== void 0 && (typeof opts !== "object" || opts === null || Array.isArray(opts))) {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(
       "createGuidance: opts must be an object { resources?: string[], kind?: CreateBlockerKind }"
     );
   }
-  let servedRows = _chunkDKAD7MOVcjs.CREATE_GUIDANCE.rows.map((row) => ({
+  let servedRows = _chunkSEFJJY4Jcjs.CREATE_GUIDANCE.rows.map((row) => ({
     ...row,
     // Issue #219 N4: one precedence rule, stated on every row (live-proven >
     // zone > spec). The spec set is not available here (it is a LIVE read) —
     // the helper is handed the plan's two shapes and names the source.
-    requiredFields: _chunkDKAD7MOVcjs.effectiveRequiredFields.call(void 0, void 0, _nullishCoalesce(_optionalChain([_chunkDKAD7MOVcjs.RELATIONSHIP_MAP, 'access', _40 => _40[row.resource], 'optionalAccess', _41 => _41.zoneFacts]), () => ( null)))
+    requiredFields: _chunkSEFJJY4Jcjs.effectiveRequiredFields.call(void 0, void 0, _nullishCoalesce(_optionalChain([_chunkSEFJJY4Jcjs.RELATIONSHIP_MAP, 'access', _41 => _41[row.resource], 'optionalAccess', _42 => _42.zoneFacts]), () => ( null)))
   }));
-  if (_optionalChain([opts, 'optionalAccess', _42 => _42.resources]) !== void 0) {
+  if (_optionalChain([opts, 'optionalAccess', _43 => _43.resources]) !== void 0) {
     if (!Array.isArray(opts.resources) || opts.resources.length === 0) {
-      throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)("createGuidance: opts.resources must be a non-empty string[] of plan resource keys");
+      throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)("createGuidance: opts.resources must be a non-empty string[] of plan resource keys");
     }
     const wanted = /* @__PURE__ */ new Set();
     for (const r of opts.resources) {
       if (typeof r !== "string" || r.trim() === "") {
-        throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)("createGuidance: opts.resources must contain non-empty plan resource key strings");
+        throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)("createGuidance: opts.resources must contain non-empty plan resource key strings");
       }
       const key = r.trim();
-      if (!_chunkDKAD7MOVcjs.CREATE_GUIDANCE.rows.some((row) => row.resource === key)) {
-        throw new (0, _chunkDKAD7MOVcjs.AutotaskError)(
-          `createGuidance: unknown resource "${key}" \u2014 the catalog has ${_chunkDKAD7MOVcjs.CREATE_GUIDANCE.rows.length} create entities`,
+      if (!_chunkSEFJJY4Jcjs.CREATE_GUIDANCE.rows.some((row) => row.resource === key)) {
+        throw new (0, _chunkSEFJJY4Jcjs.AutotaskError)(
+          `createGuidance: unknown resource "${key}" \u2014 the catalog has ${_chunkSEFJJY4Jcjs.CREATE_GUIDANCE.rows.length} create entities`,
           {
             code: "RESOURCE_UNKNOWN",
             category: "validation",
@@ -1367,29 +1400,53 @@ async function createGuidance(client, opts) {
     }
     servedRows = servedRows.filter((row) => wanted.has(row.resource));
   }
-  if (_optionalChain([opts, 'optionalAccess', _43 => _43.kind]) !== void 0) {
+  if (_optionalChain([opts, 'optionalAccess', _44 => _44.kind]) !== void 0) {
     if (!CREATE_BLOCKER_KINDS.includes(opts.kind)) {
-      throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(
+      throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(
         `createGuidance: unknown kind "${String(opts.kind)}" \u2014 the valid kinds are: ${CREATE_BLOCKER_KINDS.join(", ")}`
       );
     }
-    servedRows = servedRows.filter((row) => _optionalChain([row, 'access', _44 => _44.blocker, 'optionalAccess', _45 => _45.kind]) === opts.kind);
+    servedRows = servedRows.filter((row) => _optionalChain([row, 'access', _45 => _45.blocker, 'optionalAccess', _46 => _46.kind]) === opts.kind);
   }
   return {
-    zone: _chunkDKAD7MOVcjs.CREATE_GUIDANCE.zone,
-    label: _chunkDKAD7MOVcjs.CREATE_GUIDANCE.label,
-    verifiedAt: _chunkDKAD7MOVcjs.CREATE_GUIDANCE.verifiedAt,
+    zone: _chunkSEFJJY4Jcjs.CREATE_GUIDANCE.zone,
+    label: _chunkSEFJJY4Jcjs.CREATE_GUIDANCE.label,
+    verifiedAt: _chunkSEFJJY4Jcjs.CREATE_GUIDANCE.verifiedAt,
     rows: servedRows,
-    counts: _chunkDKAD7MOVcjs.CREATE_GUIDANCE.counts
+    counts: _chunkSEFJJY4Jcjs.CREATE_GUIDANCE.counts
   };
 }
 
+// src/operations/registryIndex.ts
+var OPERATION_BY_ID = new Map(_chunkVEOSOIU4cjs.CAPABILITIES.map((r) => [r.id, r]));
+
+// src/operations/sanitiseResult.ts
+async function sanitiseResult(client, result, operation) {
+  void client;
+  if (typeof operation !== "string" || operation === "") {
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(
+      'sanitiseResult: operation must be a non-empty registry operation key (e.g. "tickets.query")',
+      { suggestedAction: "Pass the operation key the result came from \u2014 the registry id, not the resource key." }
+    );
+  }
+  const record = OPERATION_BY_ID.get(operation);
+  if (record === void 0) {
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(
+      `sanitiseResult: unknown operation "${operation.slice(0, 60)}" \u2014 it is not in the capability registry`,
+      { operation, suggestedAction: "List the registry (the ./capabilities subpath) for the exact operation key." }
+    );
+  }
+  const fields = _optionalChain([record, 'access', _47 => _47.metadata, 'optionalAccess', _48 => _48.untrustedFields]);
+  if (!Array.isArray(fields) || fields.length === 0) return result;
+  return _chunkMJTKK3QGcjs.deepMarkUntrusted.call(void 0, result, fields);
+}
+
 // src/operations/recovery.ts
 var RECOVERY_CONFIRM = "operations.recovery";
 var RECOVERY_DEFAULT_LIMIT = 25;
 var RECOVERY_MAX_LIMIT = 100;
 function configError(message, operation, suggestedAction) {
-  throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(message, { operation, suggestedAction });
+  throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(message, { operation, suggestedAction });
 }
 function parseMatchId(record) {
   const raw = record.id;
@@ -1405,7 +1462,7 @@ function parseMatchId(record) {
   return { id: null, unsafe: true };
 }
 function validateRecoveryInput(input, operation) {
-  if (!_chunkDKAD7MOVcjs.isRecord.call(void 0, input)) {
+  if (!_chunkSEFJJY4Jcjs.isRecord.call(void 0, input)) {
     configError(
       `recovery: input must be an object { resource, marker, ... } (got ${typeof input})`,
       operation,
@@ -1439,10 +1496,10 @@ function validateRecoveryInput(input, operation) {
   return { resource, marker, action };
 }
 function resolveRecoveryTarget(client, resource, operation) {
-  const entry = _chunkDKAD7MOVcjs.RELATIONSHIP_MAP[resource];
+  const entry = _chunkSEFJJY4Jcjs.RELATIONSHIP_MAP[resource];
   if (entry === void 0) {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskError)(
-      `recovery: unknown resource "${resource}" \u2014 the plan has ${Object.keys(_chunkDKAD7MOVcjs.RELATIONSHIP_MAP).length} resources`,
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskError)(
+      `recovery: unknown resource "${resource}" \u2014 the plan has ${Object.keys(_chunkSEFJJY4Jcjs.RELATIONSHIP_MAP).length} resources`,
       {
         code: "RESOURCE_UNKNOWN",
         category: "validation",
@@ -1451,7 +1508,7 @@ function resolveRecoveryTarget(client, resource, operation) {
       }
     );
   }
-  const holder = client[_chunkDKAD7MOVcjs.camelKey.call(void 0, resource)];
+  const holder = client[_chunkSEFJJY4Jcjs.camelKey.call(void 0, resource)];
   if (!holder || typeof holder.queryBounded !== "function") {
     configError(
       `recovery: ${resource} exposes no bounded query surface \u2014 the marker search cannot run`,
@@ -1462,7 +1519,7 @@ function resolveRecoveryTarget(client, resource, operation) {
   return { entry, holder };
 }
 function resolveMarkerField(input, resource, operation) {
-  const field = input.field !== void 0 ? String(input.field) : _chunkDKAD7MOVcjs.MARKER_FIELDS[resource];
+  const field = input.field !== void 0 ? String(input.field) : _chunkSEFJJY4Jcjs.MARKER_FIELDS[resource];
   if (typeof field !== "string" || field.trim() === "") {
     configError(
       `recovery: ${resource} has no plan markerField and no input.field was passed \u2014 the marker search needs a name-like field to filter on`,
@@ -1501,7 +1558,7 @@ function resolveExtraFilter(input, operation) {
     );
   }
   for (const c of input.filter) {
-    if (!_chunkDKAD7MOVcjs.isRecord.call(void 0, c) || typeof c.op !== "string" || c.op === "and" || c.op === "or") {
+    if (!_chunkSEFJJY4Jcjs.isRecord.call(void 0, c) || typeof c.op !== "string" || c.op === "and" || c.op === "or") {
       configError(
         "recovery: input.filter accepts only plain leaf conditions ({ field, op, value }) \u2014 no grouping",
         operation,
@@ -1526,7 +1583,7 @@ function resolveLimit(input, operation) {
 async function applyRecoveryDeletes(holder, matches, parentId, resource, operation) {
   const deleteMethod = holder.delete;
   if (deleteMethod === void 0) {
-    throw new (0, _chunkDKAD7MOVcjs.DeleteBoundaryError)(
+    throw new (0, _chunkSEFJJY4Jcjs.DeleteBoundaryError)(
       `recovery: ${resource} has no delete method on the client \u2014 the boundary is marked available in the plan but the typed delete surface is missing`,
       {
         operation,
@@ -1555,14 +1612,14 @@ async function applyRecoveryDeletes(holder, matches, parentId, resource, operati
           verify = "still-present";
         }
       } catch (err) {
-        if (err instanceof _chunkDKAD7MOVcjs.NotFoundError) verify = "not-found";
+        if (err instanceof _chunkSEFJJY4Jcjs.NotFoundError) verify = "not-found";
         else {
           verify = "error";
-          code = _chunkDKAD7MOVcjs.isAutotaskError.call(void 0, err) ? err.code : "SERVER_ERROR";
+          code = _chunkSEFJJY4Jcjs.isAutotaskError.call(void 0, err) ? err.code : "SERVER_ERROR";
         }
       }
     } catch (err) {
-      code = _chunkDKAD7MOVcjs.isAutotaskError.call(void 0, err) ? err.code : "SERVER_ERROR";
+      code = _chunkSEFJJY4Jcjs.isAutotaskError.call(void 0, err) ? err.code : "SERVER_ERROR";
     }
     deleted.push({ id, verified: verify === "not-found", code });
   }
@@ -1590,7 +1647,7 @@ async function recovery(client, input, opts = {}) {
   const parentId = resolveParentId(input, entry, resource, operation);
   const extra = resolveExtraFilter(input, operation);
   const limit = resolveLimit(input, operation);
-  const boundaryNote = _chunkDKAD7MOVcjs.DELETE_BOUNDARY_NOTES[resource];
+  const boundaryNote = _chunkSEFJJY4Jcjs.DELETE_BOUNDARY_NOTES[resource];
   const boundary = {
     available: boundaryNote === void 0,
     reason: _nullishCoalesce(boundaryNote, () => ( null)),
@@ -1602,7 +1659,7 @@ async function recovery(client, input, opts = {}) {
   };
   const isDelete = action === "delete";
   if (isDelete && boundaryNote !== void 0) {
-    throw new (0, _chunkDKAD7MOVcjs.DeleteBoundaryError)(
+    throw new (0, _chunkSEFJJY4Jcjs.DeleteBoundaryError)(
       `recovery: the vendor defines no DELETE for ${resource} \u2014 the delete cannot be issued through the API (zero wire was issued)`,
       {
         operation,
@@ -1611,10 +1668,10 @@ async function recovery(client, input, opts = {}) {
       }
     );
   }
-  const dryRun = _optionalChain([opts, 'optionalAccess', _46 => _46.dryRun]) !== false;
-  const confirm = _nullishCoalesce(_optionalChain([opts, 'optionalAccess', _47 => _47.confirm]), () => ( input.confirm));
+  const dryRun = _optionalChain([opts, 'optionalAccess', _49 => _49.dryRun]) !== false;
+  const confirm = _nullishCoalesce(_optionalChain([opts, 'optionalAccess', _50 => _50.confirm]), () => ( input.confirm));
   if (isDelete && !dryRun && confirm !== RECOVERY_CONFIRM) {
-    throw new (0, _chunkDKAD7MOVcjs.ConfirmationRequiredError)(
+    throw new (0, _chunkSEFJJY4Jcjs.ConfirmationRequiredError)(
       `recovery: action 'delete' apply is destructive and requires its confirmation flag: pass confirm: "${RECOVERY_CONFIRM}"`,
       {
         operation: RECOVERY_CONFIRM,
@@ -1630,7 +1687,7 @@ async function recovery(client, input, opts = {}) {
   const query = await holder.queryBounded({ filter: conditions, limit });
   if (query.hasMore) {
     const wire = isDelete ? "DELETE wire" : "mutating wire";
-    throw new (0, _chunkDKAD7MOVcjs.RecoveryTruncatedError)(
+    throw new (0, _chunkSEFJJY4Jcjs.RecoveryTruncatedError)(
       `recovery: the marker search on ${resource} TRIPPED its match cap (${limit}) \u2014 more matches exist than were returned (zero ${wire} was issued)`,
       {
         operation,
@@ -1659,7 +1716,7 @@ async function recovery(client, input, opts = {}) {
     return { ...base, simulated: true, dryRun: true };
   }
   if (unsafeId) {
-    throw new (0, _chunkDKAD7MOVcjs.MarkerUnsafeIdError)(
+    throw new (0, _chunkSEFJJY4Jcjs.MarkerUnsafeIdError)(
       `recovery: ${unsafeIds.length} of ${matches.length} match(es) on ${resource} have ids beyond Number.MAX_SAFE_INTEGER \u2014 they CANNOT be addressed through the SDK's typed delete surface (zero DELETE wire was issued)`,
       {
         operation,
@@ -1677,7 +1734,7 @@ function needsConfirmation(record) {
   return record.effect === "destructive" || (_nullishCoalesce(record.flags, () => ( []))).includes("requiresApproval");
 }
 function refuse(message, operation, suggestedAction) {
-  throw new (0, _chunkDKAD7MOVcjs.ConfirmationRequiredError)(message, { operation, suggestedAction });
+  throw new (0, _chunkSEFJJY4Jcjs.ConfirmationRequiredError)(message, { operation, suggestedAction });
 }
 var MODE_BY_EFFECT = {
   read: "read",
@@ -1723,7 +1780,7 @@ function looseTypeOk(type, value) {
     case "string[]":
       return Array.isArray(value) && value.every((v) => typeof v === "string");
     case "object":
-      return _chunkDKAD7MOVcjs.isRecord.call(void 0, value);
+      return _chunkSEFJJY4Jcjs.isRecord.call(void 0, value);
     default:
       return true;
   }
@@ -1737,12 +1794,12 @@ function declaredArgList(record) {
 function resolveDispatchArgs(record, argsIn) {
   const operation = record.id;
   const bad = (message) => {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(`invoke: "${operation}" ${message}`, { operation });
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(`invoke: "${operation}" ${message}`, { operation });
   };
   if (argsIn === void 0 || argsIn === null) return [];
   if (Array.isArray(argsIn)) return argsIn;
   const byName = argsIn;
-  if (!_chunkDKAD7MOVcjs.isRecord.call(void 0, byName) || ![Object.prototype, null].includes(Object.getPrototypeOf(byName))) {
+  if (!_chunkSEFJJY4Jcjs.isRecord.call(void 0, byName) || ![Object.prototype, null].includes(Object.getPrototypeOf(byName))) {
     return bad(`args must be a positional array or a plain object of named inputs (declared: ${declaredArgList(record)})`);
   }
   const schema = _nullishCoalesce(record.inputSchema, () => ( {}));
@@ -1763,7 +1820,7 @@ function validateDispatchArgs(record, argsIn) {
     const bagName = names.find((n) => schema[n].properties);
     const surplus = args[names.length];
     const bagHint = bagName && surplus !== null && typeof surplus === "object" && !Array.isArray(surplus) ? ` \u2014 options go inside the single ${bagName} object` : "";
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(
       `invoke: "${operation}" declares ${names.length} positional arg(s) (${declaredArgList(record)}) but ${args.length} were passed \u2014 extra args are refused${bagHint}`,
       {
         operation,
@@ -1773,7 +1830,7 @@ function validateDispatchArgs(record, argsIn) {
   }
   const required = names.filter((n) => schema[n].required);
   if (args.length < required.length) {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(
       `invoke: "${operation}" requires ${required.length} positional arg(s) (${required.map((n) => `${n}: ${schema[n].type}`).join(", ")}) but only ${args.length} were passed \u2014 declared args: ${declaredArgList(record)}`,
       { operation }
     );
@@ -1784,7 +1841,7 @@ function validateDispatchArgs(record, argsIn) {
     const name = names[i];
     const spec = schema[name];
     if (!looseTypeOk(spec.type, value)) {
-      throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(
+      throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(
         `invoke: "${operation}" arg ${i + 1} is declared ${name}: ${spec.type} \u2014 the value has the wrong type (pass a ${spec.type} value)`,
         { operation }
       );
@@ -1792,17 +1849,17 @@ function validateDispatchArgs(record, argsIn) {
   }
 }
 function foldFlattenedOpts(record, toolArgs) {
-  if (!_chunkDKAD7MOVcjs.isRecord.call(void 0, toolArgs)) {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(`invoke: "${record.id}" tool args must be a plain object of named inputs`, { operation: record.id });
+  if (!_chunkSEFJJY4Jcjs.isRecord.call(void 0, toolArgs)) {
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(`invoke: "${record.id}" tool args must be a plain object of named inputs`, { operation: record.id });
   }
-  const bagKeys = (_nullishCoalesce(_optionalChain([record, 'access', _48 => _48.inputSchema, 'optionalAccess', _49 => _49.opts, 'optionalAccess', _50 => _50.properties]), () => ( []))).map((p) => p.name);
+  const bagKeys = (_nullishCoalesce(_optionalChain([record, 'access', _51 => _51.inputSchema, 'optionalAccess', _52 => _52.opts, 'optionalAccess', _53 => _53.properties]), () => ( []))).map((p) => p.name);
   const flat = Object.keys(toolArgs).filter((k) => bagKeys.includes(k) && toolArgs[k] !== void 0 && toolArgs[k] !== null);
   const folded = { ...toolArgs };
   for (const k of bagKeys) delete folded[k];
   if (folded.opts === null) delete folded.opts;
   if (flat.length === 0) return folded;
   if (folded.opts !== void 0) {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(
       `invoke: "${record.id}" was given both opts and flattened option(s) ${flat.map((k) => `"${k}"`).join(", ")} \u2014 pass one form`,
       { operation: record.id }
     );
@@ -1812,7 +1869,7 @@ function foldFlattenedOpts(record, toolArgs) {
 
 // src/operations/invoke/inputSets.ts
 var PARAMS_BAG_KEYS = {
-  query: ["filter", "limit", "includeFields", "via", "latest", "noteChars", "fieldsPreset", "fieldCheck", "names"],
+  query: ["filter", "limit", "includeFields", "via", "latest", "noteChars", "fieldCheck", "names", "acknowledgeUnscoped", "walk"],
   // No registry row DECLARES `queryAll` today (a plan decision: the raw walk is
   // called directly), so this entry never fires. It is KEPT so that a future
   // `queryAll` row — which `invoke` WOULD dispatch via holder[operation] —
@@ -1832,7 +1889,9 @@ var BAG_KEY_SYNONYMS = {
   page: "limit",
   pageSize: "limit",
   cursor: "limit",
-  maxrecords: "maxRecords"
+  maxrecords: "maxRecords",
+  fieldsPreset: "includeFields"
+  // issue #287: the preset was removed — the refusal points at the explicit includeFields
 };
 function levenshtein(a, b) {
   if (a === b) return 0;
@@ -1859,16 +1918,19 @@ function suggestForKey(key, valid) {
   if (best !== null && best.dist <= 3) return best.key;
   return null;
 }
+function keySuggestions(unknown, valid) {
+  return unknown.map((k) => [k, suggestForKey(k, valid)]).filter((pair) => pair[1] !== null).map(([k, s]) => `"${k}" \u2192 "${s}"`);
+}
 function validateParamsBag(record, args) {
   if (record.inputSchemaStrict !== true) return;
   const valid = PARAMS_BAG_KEYS[record.operation];
   if (valid === void 0) return;
-  const bag = _optionalChain([args, 'optionalAccess', _51 => _51[0]]);
-  if (bag === void 0 || bag === null || !_chunkDKAD7MOVcjs.isRecord.call(void 0, bag)) return;
+  const bag = _optionalChain([args, 'optionalAccess', _54 => _54[0]]);
+  if (bag === void 0 || bag === null || !_chunkSEFJJY4Jcjs.isRecord.call(void 0, bag)) return;
   const unknown = Object.keys(bag).filter((k) => !valid.includes(k));
   if (unknown.length === 0) return;
-  const suggestions = unknown.map((k) => [k, suggestForKey(k, valid)]).filter((pair) => pair[1] !== null).map(([k, s]) => `"${k}" \u2192 "${s}"`);
-  throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(
+  const suggestions = keySuggestions(unknown, valid);
+  throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(
     `invoke: "${record.id}" params bag has unknown key(s) ${unknown.map((k) => `"${k}"`).join(", ")} \u2014 the bag is closed (valid keys: ${valid.join(", ")})`,
     {
       operation: record.id,
@@ -1876,32 +1938,13 @@ function validateParamsBag(record, args) {
     }
   );
 }
-function validateGetBag(record, args) {
-  if (record.kind !== "primitive" || record.operation !== "get") return;
-  const at = Object.keys(_nullishCoalesce(record.inputSchema, () => ( {}))).indexOf("opts");
-  const bag = at < 0 ? void 0 : _optionalChain([args, 'optionalAccess', _52 => _52[at]]);
-  if (bag === void 0 || bag === null || !_chunkDKAD7MOVcjs.isRecord.call(void 0, bag)) return;
-  const unknown = Object.keys(bag).filter((k) => k !== "fresh");
-  if (unknown.length > 0) {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(
-      `invoke: "${record.id}" opts bag has unknown key(s) ${unknown.map((k) => `"${k}"`).join(", ")} \u2014 the bag is closed (valid keys: fresh)`,
-      { operation: record.id, suggestedAction: "Pass only { fresh?: boolean }." }
-    );
-  }
-  if (bag.fresh !== void 0 && typeof bag.fresh !== "boolean") {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(
-      `invoke: fresh must be a boolean (got ${typeof bag.fresh}) \u2014 "${record.id}" was not issued`,
-      { operation: record.id, suggestedAction: "Pass fresh: true (bypass the read cache) or omit it." }
-    );
-  }
-}
 var INVOKE_OPTION_KEYS = ["dryRun", "confirm", "lastModifiedDate", "maxRetries", "fresh", "mode"];
 function validateInvokeOptions(opts, operation) {
   if (opts === void 0 || opts === null) return;
   const unknown = Object.keys(opts).filter((k) => !INVOKE_OPTION_KEYS.includes(k));
   if (unknown.length === 0) return;
-  const suggestions = unknown.map((k) => [k, suggestForKey(k, ["dryRun", "confirm", "lastModifiedDate", "maxRetries", "fresh"])]).filter((pair) => pair[1] !== null).map(([k, s]) => `"${k}" \u2192 "${s}"`);
-  throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(
+  const suggestions = keySuggestions(unknown, ["dryRun", "confirm", "lastModifiedDate", "maxRetries", "fresh"]);
+  throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(
     `invoke: "${operation}" has unknown option key(s) ${unknown.map((k) => `"${k}"`).join(", ")} \u2014 the options set is closed (valid: dryRun, confirm, lastModifiedDate, maxRetries, fresh; "mode" is internal to the mode wrappers)`,
     {
       operation,
@@ -1913,8 +1956,8 @@ function unknownKeysRefusal(raw, validKeys, subject, operation) {
   if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return null;
   const unknown = Object.keys(raw).filter((k) => !validKeys.includes(k));
   if (unknown.length === 0) return null;
-  const suggestions = unknown.map((k) => [k, suggestForKey(k, [...validKeys])]).filter((pair) => pair[1] !== null).map(([k, s]) => `"${k}" \u2192 "${s}"`);
-  return new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(
+  const suggestions = keySuggestions(unknown, [...validKeys]);
+  return new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(
     `unknown ${subject} ${unknown.map((k) => `"${k}"`).join(", ")} \u2014 the ${subject} set is closed (valid keys: ${validKeys.join(", ")})`,
     {
       ...operation !== void 0 ? { operation } : {},
@@ -1923,9 +1966,63 @@ function unknownKeysRefusal(raw, validKeys, subject, operation) {
   );
 }
 
-// src/operations/invoke/registry.ts
-var RECORDS = _chunkMJ6J74F3cjs.CAPABILITIES;
-var byId2 = new Map(RECORDS.map((r) => [r.id, r]));
+// src/operations/scopeGuard.ts
+var PROPAGATE_CODES = /* @__PURE__ */ new Set([
+  "ABORTED",
+  "UNAUTHORIZED",
+  "FORBIDDEN",
+  "HOST_POLICY_DENIED",
+  "RATE_LIMITED",
+  "RATE_LIMITED_COOLDOWN"
+]);
+function hasIdScope(filter) {
+  if (Array.isArray(filter)) return filter.some(hasIdScope);
+  if (filter === null || typeof filter !== "object") return false;
+  const n = filter;
+  const op = typeof n.op === "string" ? n.op.toLowerCase() : "";
+  if (Array.isArray(n.items)) return op === "and" && n.items.some(hasIdScope);
+  if (Array.isArray(n.filter)) return hasIdScope(n.filter);
+  if (typeof n.field !== "string" || !(n.field === "id" || /ID$/.test(n.field))) return false;
+  const real = (v) => v !== void 0 && v !== null && v !== "";
+  const list = Array.isArray(n.value) ? n.value : typeof n.value === "string" ? n.value.split(",").map((t) => t.trim()) : [];
+  return op === "eq" && real(n.value) || op === "in" && list.some(real);
+}
+async function guardUnscopedQueryWalk(holder, operation, bag) {
+  const filter = _optionalChain([bag, 'optionalAccess', _55 => _55["filter"]]);
+  const limit = _optionalChain([bag, 'optionalAccess', _56 => _56["limit"]]);
+  const latest = _optionalChain([bag, 'optionalAccess', _57 => _57["latest"]]);
+  const walk = typeof _optionalChain([bag, 'optionalAccess', _58 => _58["walk"]]) === "object" && _optionalChain([bag, 'optionalAccess', _59 => _59["walk"]]) !== null ? _optionalChain([bag, 'optionalAccess', _60 => _60["walk"]]) : void 0;
+  const maxRows = typeof _optionalChain([walk, 'optionalAccess', _61 => _61.maxRows]) === "number" ? walk.maxRows : void 0;
+  const effectiveLimit = typeof limit === "number" ? limit : _chunkSEFJJY4Jcjs.BOUNDED_QUERY_DEFAULT_LIMIT;
+  let walked = typeof latest === "number" ? Math.max(effectiveLimit, latest) : effectiveLimit;
+  if (maxRows !== void 0) walked = Math.min(walked, maxRows);
+  if (walked <= _chunkSEFJJY4Jcjs.UNSCOPED_WALK_THRESHOLD || hasIdScope(filter)) return {};
+  let conditions;
+  try {
+    conditions = _chunkSEFJJY4Jcjs.normalizedConditions.call(void 0, filter);
+  } catch (e) {
+    return {};
+  }
+  let counted;
+  try {
+    counted = await holder.count({ filter: conditions === void 0 ? void 0 : conditions });
+  } catch (err) {
+    const code = _optionalChain([err, 'optionalAccess', _62 => _62.code]);
+    if (typeof code === "string" && PROPAGATE_CODES.has(code)) throw err;
+    const label = typeof code === "string" && /^[A-Z][A-Z_]{2,40}$/.test(code) ? ` (${code})` : "";
+    return { note: `scope check skipped: the pre-flight count failed${label}; this unscoped walk was not guarded.` };
+  }
+  const sentinel = typeof counted === "object" && counted !== null && "count" in counted ? counted : { count: counted };
+  if (sentinel.blindSurface !== void 0) {
+    return { note: "scope check skipped: the count surface is blind (a 0 is not a true zero); this unscoped walk was not guarded." };
+  }
+  const count = typeof sentinel.count === "number" && Number.isFinite(sentinel.count) && sentinel.count >= 0 ? sentinel.count : void 0;
+  if (count === void 0) {
+    return { note: "scope check skipped: the pre-flight count was unreadable; this unscoped walk was not guarded." };
+  }
+  if (count > _chunkSEFJJY4Jcjs.UNSCOPED_WALK_THRESHOLD) throw new (0, _chunkSEFJJY4Jcjs.ScopeRequiredError)(operation, { threshold: _chunkSEFJJY4Jcjs.UNSCOPED_WALK_THRESHOLD, count });
+  return {};
+}
 
 // src/operations/invoke/dispatch.ts
 var INVOKE_MAX_INLINE_BYTES = 1024 * 1024;
@@ -1941,9 +2038,9 @@ function bufferResult(buf) {
   };
 }
 function resolveRecord(operation) {
-  const record = byId2.get(operation);
+  const record = OPERATION_BY_ID.get(operation);
   if (record === void 0) {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(
       `invoke: unknown operation "${operation}" \u2014 it is not in the capability registry`,
       { operation, suggestedAction: "List the registry (the ./capabilities subpath) for the exact operation key." }
     );
@@ -1954,30 +2051,30 @@ function governPreRequest(record, operation, opts) {
   validateInvokeOptions(opts, operation);
   const mode = opts.mode;
   if (mode !== void 0 && MODE_BY_EFFECT[record.effect] !== mode) {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(crossModeRefusal(operation, record.effect, mode), { operation });
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(crossModeRefusal(operation, record.effect, mode), { operation });
   }
   if (opts.dryRun !== void 0 && typeof opts.dryRun !== "boolean") {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(
       `invoke: dryRun must be a boolean (got ${typeof opts.dryRun}) \u2014 "${operation}" was not issued`,
       { operation, suggestedAction: "Pass dryRun: true (simulate) or dryRun: false (apply) as a real boolean." }
     );
   }
   if (opts.fresh !== void 0) {
     if (typeof opts.fresh !== "boolean") {
-      throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(
+      throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(
         `invoke: fresh must be a boolean (got ${typeof opts.fresh}) \u2014 "${operation}" was not issued`,
         { operation, suggestedAction: "Pass fresh: true (bypass the read cache) or omit it." }
       );
     }
     if (record.effect !== "read" || record.kind !== "primitive" || record.operation !== "get" || !("opts" in (_nullishCoalesce(record.inputSchema, () => ( {}))))) {
-      throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(
+      throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(
         `invoke: fresh applies only to a single-record "<resource>.get" read \u2014 "${operation}" was not issued`,
         { operation, suggestedAction: "Drop the fresh option (only <resource>.get consults the read cache per call)." }
       );
     }
   }
   if (record.effect === "read" && opts.dryRun === true) {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(
       `invoke: "${operation}" is a read \u2014 dryRun is not applicable (reads issue their request as-is)`,
       { operation }
     );
@@ -1994,7 +2091,7 @@ function operationsHolder(client) {
   return {
     resolveAny: (identifier, opts) => resolveAny(client, identifier, opts),
     searchAcrossResources: (query, opts) => searchAcrossResources(client, query, opts),
-    fetchMany: (items, opts) => _chunkDKAD7MOVcjs.fetchMany.call(void 0, client, items, opts),
+    fetchMany: (items, opts) => _chunkSEFJJY4Jcjs.fetchMany.call(void 0, client, items, opts),
     // Issue #62: the generic aggregate + the cheap count — the
     // groupBy/sum-absent mode is ONE vendor /query/count (the S12-C blind
     // sentinel rides through); the group/sum modes walk the named
@@ -2006,12 +2103,12 @@ function operationsHolder(client) {
     // Issue #59 PR-B: the bulk fetch by ids — query-first chunked `id in`
     // reads + the per-id `get` fallback (blind-surface-safe; per-item
     // typed outcomes reuse the fetchMany shapes).
-    fetchByIds: (items, opts) => _chunkDKAD7MOVcjs.fetchByIds.call(void 0, client, items, opts),
+    fetchByIds: (items, opts) => _chunkSEFJJY4Jcjs.fetchByIds.call(void 0, client, items, opts),
     // Issue #65: opt-in resource name expansion — per-id resources.get
     // reads ONLY (never an id-in query — the resources table can be blind
     // to count/query while per-id reads work); blind-marked rows for ids
     // the API user cannot resolve; the read cache (default-on).
-    expandResourceNames: (ids, opts) => _chunkDKAD7MOVcjs.expandResourceNames.call(void 0, client, ids, opts),
+    expandResourceNames: (ids, opts) => _chunkSEFJJY4Jcjs.expandResourceNames.call(void 0, client, ids, opts),
     relationshipMap: (resourceKey) => relationshipMap(client, resourceKey),
     // Issue #11: the served blind-surface inventory (zero wire) + the
     // bounded caller-opted reachability sweep (read-only, confirmProbe-
@@ -2021,12 +2118,16 @@ function operationsHolder(client) {
     // Issue #12: the served zone-fact create-guidance catalog (zero wire).
     createGuidance: (opts) => createGuidance(client, opts),
     // Issue #202: ExecuteCommand deep links — pure, zero wire.
-    uiLink: (input) => _chunkDKAD7MOVcjs.uiLink.call(void 0, client, input),
+    uiLink: (input) => _chunkSEFJJY4Jcjs.uiLink.call(void 0, client, input),
+    // Issue #287 (D8): the projection-layer untrusted-content helper — pure,
+    // zero wire (the registry record's metadata.untrustedFields + the deep
+    // walker from src/untrusted.ts; an unknown operation refuses).
+    sanitiseResult: (result, operation) => sanitiseResult(client, result, operation),
     // Issue #31: the opt-in live field-metadata channel — N bounded
     // entityInformation GETs (the op's own cap refuses over-cap fan-outs
     // pre-request; per-resource failures are recorded on the row and
     // never abort the call).
-    fieldCatalog: (opts) => _chunkDKAD7MOVcjs.fieldCatalog.call(void 0, client, opts),
+    fieldCatalog: (opts) => _chunkSEFJJY4Jcjs.fieldCatalog.call(void 0, client, opts),
     // Issue #9: the one-call recovery/cleanup op — effect write in the
     // registry (the governor's dry-run-first applies to it); the op's own
     // confirm gate makes the destructive action deliberate (the governor
@@ -2036,15 +2137,15 @@ function operationsHolder(client) {
 }
 function resolveHolder(client, record, operation) {
   const clientBag = client;
-  let holder = clientBag[_chunkDKAD7MOVcjs.camelKey.call(void 0, record.resource)];
+  let holder = clientBag[_chunkSEFJJY4Jcjs.camelKey.call(void 0, record.resource)];
   if (typeof holder === "function") {
-    holder = _nullishCoalesce(clientBag[`${_chunkDKAD7MOVcjs.camelKey.call(void 0, record.resource)}Resource`], () => ( holder));
+    holder = _nullishCoalesce(clientBag[`${_chunkSEFJJY4Jcjs.camelKey.call(void 0, record.resource)}Resource`], () => ( holder));
   }
   if (holder === void 0 && record.resource === "operations") {
     holder = operationsHolder(client);
   }
   if (holder === void 0) {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(
       `invoke: the client exposes no accessor for resource "${record.resource}"`,
       { operation }
     );
@@ -2094,22 +2195,41 @@ function appendFresh(record, callArgs) {
   callArgs[at] = { fresh: true };
   return callArgs;
 }
+function validateFreshSpelling(record, args) {
+  if (record.kind !== "primitive" || record.operation !== "get") return;
+  const at = Object.keys(_nullishCoalesce(record.inputSchema, () => ( {}))).indexOf("opts");
+  const bag = at < 0 ? void 0 : args[at];
+  if (bag === void 0 || bag === null) return;
+  throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(
+    `invoke: "${record.id}" takes no positional options bag \u2014 the fresh spelling is the fresh invoke option (pass { fresh: true } in the invoke options, not as a method argument)`,
+    {
+      operation: record.id,
+      suggestedAction: 'Pass fresh: true as an invoke option: invoke(client, "<resource>.get", [id], { fresh: true }). The typed client.<resource>.get(id, { fresh: true }) method keeps its own bag.'
+    }
+  );
+}
+var PRE_REQUEST_VALIDATORS = [
+  (c) => governPreRequest(c.record, c.operation, c.opts),
+  (c) => validateDispatchArgs(c.record, c.args),
+  (c) => validateParamsBag(c.record, c.args),
+  (c) => validateFreshSpelling(c.record, c.args),
+  (c) => c.boundedQuery || c.countedQuery ? _chunkSEFJJY4Jcjs.validateQueryFieldNames.call(void 0, c.record, c.holder, c.args) : Promise.resolve(void 0)
+];
+async function runPreRequestPass(ctx) {
+  for (const step of PRE_REQUEST_VALIDATORS) await step(ctx);
+}
 async function invokeMode(client, operation, argsIn = [], opts = {}) {
   const record = resolveRecord(operation);
-  governPreRequest(record, operation, opts);
   const args = resolveDispatchArgs(record, argsIn);
-  validateDispatchArgs(record, args);
-  validateParamsBag(record, args);
-  validateGetBag(record, args);
   const boundedQuery = record.kind === "primitive" && record.operation === "query";
   const countedQuery = record.kind === "primitive" && record.operation === "count";
   const holder = resolveHolder(client, record, operation);
-  if (boundedQuery || countedQuery) await _chunkDKAD7MOVcjs.validateQueryFieldNames.call(void 0, record, holder, args);
-  const labelQuery = boundedQuery && _chunkDKAD7MOVcjs.readNamesOpt.call(void 0, _optionalChain([args, 'access', _53 => _53[0], 'optionalAccess', _54 => _54["names"]]), `invoke: "${record.id}" params bag`);
+  await runPreRequestPass({ record, operation, args, opts, client, holder, boundedQuery, countedQuery });
+  const labelQuery = boundedQuery && _chunkSEFJJY4Jcjs.readNamesOpt.call(void 0, client, _optionalChain([args, 'access', _63 => _63[0], 'optionalAccess', _64 => _64["names"]]), `invoke: "${record.id}" params bag`);
   const methodName = boundedQuery ? "queryBounded" : record.operation;
   const method = holder[methodName];
   if (typeof method !== "function") {
-    throw new (0, _chunkDKAD7MOVcjs.AutotaskConfigError)(
+    throw new (0, _chunkSEFJJY4Jcjs.AutotaskConfigError)(
       `invoke: "${record.resource}.${methodName}" is not a callable method on the client`,
       { operation }
     );
@@ -2118,16 +2238,20 @@ async function invokeMode(client, operation, argsIn = [], opts = {}) {
   const mutationOpts = buildMutationOpts(opts, isWrite);
   const callArgs = buildCallArgs(record, args, mutationOpts, isWrite);
   if (opts.fresh === true) appendFresh(record, callArgs);
+  if (boundedQuery) _chunkSEFJJY4Jcjs.validateWalkBag.call(void 0, _optionalChain([args, 'access', _65 => _65[0], 'optionalAccess', _66 => _66["walk"]]), `invoke: "${record.id}"`, { operation: record.id });
+  let scopeNote;
+  if (boundedQuery && _optionalChain([args, 'access', _67 => _67[0], 'optionalAccess', _68 => _68["acknowledgeUnscoped"]]) !== true) {
+    scopeNote = (await guardUnscopedQueryWalk(holder, record.id, args[0])).note;
+  }
   const result = await method.apply(holder, callArgs);
-  if (labelQuery && Array.isArray(_optionalChain([result, 'optionalAccess', _55 => _55.items]))) {
+  if (labelQuery && Array.isArray(_optionalChain([result, 'optionalAccess', _69 => _69.items]))) {
     const bounded = result;
-    const labelled = await _chunkDKAD7MOVcjs.labelRows.call(void 0, client, record.resource, bounded.items);
-    return { ...bounded, items: labelled.rows, ...labelled.names !== void 0 ? { names: labelled.names } : {} };
+    const labelled = await _chunkSEFJJY4Jcjs.labelRows.call(void 0, client, record.resource, bounded.items);
+    return { ...bounded, items: labelled.rows, ...labelled.names !== void 0 ? { names: labelled.names } : {}, ...scopeNote !== void 0 ? { scopeNote } : {} };
   }
-  return Buffer.isBuffer(result) ? bufferResult(result) : result;
+  const finished = Buffer.isBuffer(result) ? bufferResult(result) : result;
+  return scopeNote !== void 0 && finished !== null && typeof finished === "object" ? { ...finished, scopeNote } : finished;
 }
-
-// src/operations/invoke/wrappers.ts
 async function invoke(client, operation, args = [], opts = {}) {
   return invokeMode(client, operation, args, { ...opts, mode: void 0 });
 }
@@ -2192,7 +2316,4 @@ async function invokeDelete(client, operation, args = [], opts = {}) {
 
 
 
-
-
-
-exports.AGGREGATE_DATE_BUCKETS = AGGREGATE_DATE_BUCKETS; exports.AGGREGATE_DEFAULT_LIMIT = AGGREGATE_DEFAULT_LIMIT; exports.AGGREGATE_DEFAULT_TOP = AGGREGATE_DEFAULT_TOP; exports.AGGREGATE_TOP_MAX = AGGREGATE_TOP_MAX; exports.BLIND_SURFACE_KINDS = BLIND_SURFACE_KINDS; exports.CREATE_BLOCKER_KINDS = CREATE_BLOCKER_KINDS; exports.ENTITY_TYPE_TO_RESOURCE = _chunkDKAD7MOVcjs.ENTITY_TYPE_TO_RESOURCE; exports.EXPAND_RESOURCE_NAMES_MAX_IDS = _chunkDKAD7MOVcjs.EXPAND_RESOURCE_NAMES_MAX_IDS; exports.FETCH_BY_IDS_CHUNK_SIZE = _chunkDKAD7MOVcjs.FETCH_BY_IDS_CHUNK_SIZE; exports.FETCH_BY_IDS_MAX_ITEMS = _chunkDKAD7MOVcjs.FETCH_BY_IDS_MAX_ITEMS; exports.FETCH_MANY_MAX_ITEMS = _chunkDKAD7MOVcjs.FETCH_MANY_MAX_ITEMS; exports.FIELD_CACHE_KINDS = _chunkDKAD7MOVcjs.FIELD_CACHE_KINDS; exports.FIELD_CATALOG_HONESTY_NOTE = _chunkDKAD7MOVcjs.FIELD_CATALOG_HONESTY_NOTE; exports.INVOKE_OPTION_KEYS = INVOKE_OPTION_KEYS; exports.MAX_FIELD_CATALOG_WIRE = _chunkDKAD7MOVcjs.MAX_FIELD_CATALOG_WIRE; exports.MIN_FIELD_CATALOG_MAX_BYTES = _chunkDKAD7MOVcjs.MIN_FIELD_CATALOG_MAX_BYTES; exports.PARAMS_BAG_KEYS = PARAMS_BAG_KEYS; exports.PICKLIST_CATALOG_UNAVAILABLE_NOTE = _chunkDKAD7MOVcjs.PICKLIST_CATALOG_UNAVAILABLE_NOTE; exports.PICKLIST_VALUE_NOT_SERVED_NOTE = _chunkDKAD7MOVcjs.PICKLIST_VALUE_NOT_SERVED_NOTE; exports.RECOVERY_CONFIRM = RECOVERY_CONFIRM; exports.RECOVERY_DEFAULT_LIMIT = RECOVERY_DEFAULT_LIMIT; exports.RECOVERY_MAX_LIMIT = RECOVERY_MAX_LIMIT; exports.UI_LINK_ENTITIES = _chunkDKAD7MOVcjs.UI_LINK_ENTITIES; exports.WORKFLOW_RESOURCES = _chunkDKAD7MOVcjs.WORKFLOW_RESOURCES; exports.aggregate = aggregate; exports.blindSurfaces = blindSurfaces; exports.buildUiLink = _chunkDKAD7MOVcjs.buildUiLink; exports.createGuidance = createGuidance; exports.dateBucketLabel = dateBucketLabel; exports.effectiveRequiredFields = _chunkDKAD7MOVcjs.effectiveRequiredFields; exports.expandResourceNames = _chunkDKAD7MOVcjs.expandResourceNames; exports.fetchByIds = _chunkDKAD7MOVcjs.fetchByIds; exports.fetchMany = _chunkDKAD7MOVcjs.fetchMany; exports.fieldCatalog = _chunkDKAD7MOVcjs.fieldCatalog; exports.foldFlattenedOpts = foldFlattenedOpts; exports.invoke = invoke; exports.invokeDelete = invokeDelete; exports.invokeRead = invokeRead; exports.invokeWrite = invokeWrite; exports.isEnumerableResource = _chunkDKAD7MOVcjs.isEnumerableResource; exports.needsConfirmation = needsConfirmation; exports.probeReachability = probeReachability; exports.recovery = recovery; exports.relationshipMap = relationshipMap; exports.resolveAny = resolveAny; exports.resourceForEntityType = _chunkDKAD7MOVcjs.resourceForEntityType; exports.revenueRollup = revenueRollup; exports.searchAcrossResources = searchAcrossResources; exports.uiLink = _chunkDKAD7MOVcjs.uiLink; exports.unknownKeysRefusal = unknownKeysRefusal; exports.validateDispatchArgs = validateDispatchArgs; exports.validateFetchManyItems = _chunkDKAD7MOVcjs.validateFetchManyItems; exports.validateInvokeOptions = validateInvokeOptions; exports.validateParamsBag = validateParamsBag;
+exports.AGGREGATE_DATE_BUCKETS = AGGREGATE_DATE_BUCKETS; exports.AGGREGATE_DEFAULT_LIMIT = AGGREGATE_DEFAULT_LIMIT; exports.AGGREGATE_DEFAULT_TOP = AGGREGATE_DEFAULT_TOP; exports.AGGREGATE_TOP_MAX = AGGREGATE_TOP_MAX; exports.BLIND_SURFACE_KINDS = BLIND_SURFACE_KINDS; exports.CREATE_BLOCKER_KINDS = CREATE_BLOCKER_KINDS; exports.EXPAND_RESOURCE_NAMES_MAX_IDS = _chunkSEFJJY4Jcjs.EXPAND_RESOURCE_NAMES_MAX_IDS; exports.FETCH_BY_IDS_CHUNK_SIZE = _chunkSEFJJY4Jcjs.FETCH_BY_IDS_CHUNK_SIZE; exports.FETCH_BY_IDS_MAX_ITEMS = _chunkSEFJJY4Jcjs.FETCH_BY_IDS_MAX_ITEMS; exports.FETCH_MANY_MAX_ITEMS = _chunkSEFJJY4Jcjs.FETCH_MANY_MAX_ITEMS; exports.FIELD_CACHE_KINDS = _chunkSEFJJY4Jcjs.FIELD_CACHE_KINDS; exports.FIELD_CATALOG_HONESTY_NOTE = _chunkSEFJJY4Jcjs.FIELD_CATALOG_HONESTY_NOTE; exports.INVOKE_OPTION_KEYS = INVOKE_OPTION_KEYS; exports.MAX_FIELD_CATALOG_WIRE = _chunkSEFJJY4Jcjs.MAX_FIELD_CATALOG_WIRE; exports.MIN_FIELD_CATALOG_MAX_BYTES = _chunkSEFJJY4Jcjs.MIN_FIELD_CATALOG_MAX_BYTES; exports.PARAMS_BAG_KEYS = PARAMS_BAG_KEYS; exports.PICKLIST_VALUE_NOT_SERVED_NOTE = _chunkSEFJJY4Jcjs.PICKLIST_VALUE_NOT_SERVED_NOTE; exports.RECOVERY_CONFIRM = RECOVERY_CONFIRM; exports.RECOVERY_DEFAULT_LIMIT = RECOVERY_DEFAULT_LIMIT; exports.RECOVERY_MAX_LIMIT = RECOVERY_MAX_LIMIT; exports.UI_LINK_ENTITIES = _chunkSEFJJY4Jcjs.UI_LINK_ENTITIES; exports.WORKFLOW_RESOURCES = _chunkSEFJJY4Jcjs.WORKFLOW_RESOURCES; exports.aggregate = aggregate; exports.blindSurfaces = blindSurfaces; exports.buildUiLink = _chunkSEFJJY4Jcjs.buildUiLink; exports.createGuidance = createGuidance; exports.dateBucketLabel = dateBucketLabel; exports.effectiveRequiredFields = _chunkSEFJJY4Jcjs.effectiveRequiredFields; exports.expandResourceNames = _chunkSEFJJY4Jcjs.expandResourceNames; exports.fetchByIds = _chunkSEFJJY4Jcjs.fetchByIds; exports.fetchMany = _chunkSEFJJY4Jcjs.fetchMany; exports.fieldCatalog = _chunkSEFJJY4Jcjs.fieldCatalog; exports.foldFlattenedOpts = foldFlattenedOpts; exports.invoke = invoke; exports.invokeDelete = invokeDelete; exports.invokeRead = invokeRead; exports.invokeWrite = invokeWrite; exports.needsConfirmation = needsConfirmation; exports.probeReachability = probeReachability; exports.recovery = recovery; exports.relationshipMap = relationshipMap; exports.resolveAny = resolveAny; exports.revenueRollup = revenueRollup; exports.sanitiseResult = sanitiseResult; exports.searchAcrossResources = searchAcrossResources; exports.uiLink = _chunkSEFJJY4Jcjs.uiLink; exports.unknownKeysRefusal = unknownKeysRefusal; exports.validateDispatchArgs = validateDispatchArgs; exports.validateFetchManyItems = _chunkSEFJJY4Jcjs.validateFetchManyItems; exports.validateInvokeOptions = validateInvokeOptions; exports.validateParamsBag = validateParamsBag;