node-autotask 0.44.0 → 0.45.0

package/N8N_MCP_MANIFEST.json

@@ -1,10 +1,9 @@
 {
   "schema": "node-autotask n8n consumer mcp projection v1",
-  "generatedAt": "2026-11-01T01:23:14.190Z",
+  "generatedAt": "2026-11-01T10:43:53.479Z",
   "generator": "scripts/project-n8n-mcp.mjs",
   "inputs": {
     "capabilities": "capabilities.json (the capability registry — the single source of truth)",
-    "plan": "capabilities.plan.json (resources.parentScoped only)",
     "curation": "n8n-mcp.curation.json (the P3 written rule + the entity subset)",
     "curationRule": "P3 written rule (n8n consumer subset) — include exactly the entities a daily support workflow actually touches: the ticket lifecycle and its scoped notes; the parties (contacts and companies and their sites); the staff (resources); the effort (time entries) — and only where the tenant has live data (verified data-full tenant: 11,644 tickets, 2026-10-03). The rule is EVIDENCE-BASED, not taste: extend or shrink the subset only via a recorded change to this curation config (the entity entry and its reason are the record); never hand-edit the generated N8N_MCP_MANIFEST.json / N8N_MCP_MANIFEST.md."
   },
@@ -512,7 +511,7 @@
       "entity": "ticket",
       "apiEntity": "tickets",
       "effectLine": "effect=write (plus destructive only when curation re-includes it)",
-      "description": "Write ticket records (mode: write — the registry operations with effect=write for tickets: changeStatus, create, openWithNoteAndAssign, update). Writes are dry-run first: dry_run defaults to true — the request is validated against the registry inputSchema and a DryRunResult envelope is returned; the mutating request is never issued unless the caller passes confirm (the n8n-side handler must force dry-run unless confirm is present, mirroring the SDK governor). Destructive operations are refused without the confirm flag — confirm must equal the operation key exactly (the deliberate act is the call). The n8n consumer surface excludes destructive operations by curation default (excludeDestructive); they remain available on the canonical SDK server (autotask_delete / per-op tools). By curation default (excludeDestructive) no destructive operation is included; destructive capability remains on the canonical SDK server surface. Per-operation required arguments: changeStatus [id, targetStatus]; create [data]; openWithNoteAndAssign [params]; update [id, data]. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.",
+      "description": "Write ticket records (mode: write — the registry operations with effect=write for tickets: changeStatus, create, update). Writes are dry-run first: dry_run defaults to true — the request is validated against the registry inputSchema and a DryRunResult envelope is returned; the mutating request is never issued unless the caller passes confirm (the n8n-side handler must force dry-run unless confirm is present, mirroring the SDK governor). Destructive operations are refused without the confirm flag — confirm must equal the operation key exactly (the deliberate act is the call). The n8n consumer surface excludes destructive operations by curation default (excludeDestructive); they remain available on the canonical SDK server (autotask_delete / per-op tools). By curation default (excludeDestructive) no destructive operation is included; destructive capability remains on the canonical SDK server surface. Per-operation required arguments: changeStatus [id, targetStatus]; create [data]; update [id, data]. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.",
       "annotations": {
         "readOnlyHint": false,
         "destructiveHint": false,
@@ -527,7 +526,6 @@
             "enum": [
               "changeStatus",
               "create",
-              "openWithNoteAndAssign",
               "update"
             ]
           },
@@ -544,15 +542,6 @@
             "type": "object",
             "ref": "tickets body (see types)"
           },
-          "params": {
-            "type": "object — { companyID: number | string (the parent company id), title: string, priority?: number (default 3 Low), status?: number (default 1 New), queueID?: number (the node NEVER guesses a queue: omitted + vendor-500 → the typed QUEUE_REQUIRED error with the vendor message + discovery suggestedAction) }"
-          },
-          "note": {
-            "type": "object (optional) — { description: string, title?: string, noteType?: number (default 1), publish?: number (default 1; integer picklist 1/2/4 — a JSON boolean 500s) }"
-          },
-          "assign": {
-            "type": "object (optional) — { resourceID: number | string, roleID: number (required with resourceID) } (prechecked via resources.get BEFORE the create — RESOURCE_INVALID on missing/inactive; the resources table is blind to the API user, get is the authority)"
-          },
           "dry_run": {
             "type": "boolean",
             "default": true,
@@ -635,41 +624,6 @@
           "bounds": "Dry-run first (dry_run).",
           "dryRun": true
         },
-        {
-          "op": "tickets.openWithNoteAndAssign",
-          "verb": "openWithNoteAndAssign",
-          "effect": "write",
-          "kind": "helper",
-          "flags": [],
-          "requiredArgs": [
-            "params"
-          ],
-          "input": {
-            "properties": {
-              "params": {
-                "type": "object — { companyID: number | string (the parent company id), title: string, priority?: number (default 3 Low), status?: number (default 1 New), queueID?: number (the node NEVER guesses a queue: omitted + vendor-500 → the typed QUEUE_REQUIRED error with the vendor message + discovery suggestedAction) }"
-              },
-              "note": {
-                "type": "object (optional) — { description: string, title?: string, noteType?: number (default 1), publish?: number (default 1; integer picklist 1/2/4 — a JSON boolean 500s) }"
-              },
-              "assign": {
-                "type": "object (optional) — { resourceID: number | string, roleID: number (required with resourceID) } (prechecked via resources.get BEFORE the create — RESOURCE_INVALID on missing/inactive; the resources table is blind to the API user, get is the authority)"
-              }
-            },
-            "required": [
-              "params"
-            ]
-          },
-          "annotations": {
-            "readOnlyHint": false,
-            "destructiveHint": false,
-            "idempotentHint": false,
-            "openWorldHint": true
-          },
-          "purpose": "Open a ticket with an optional first scoped note and an optional assignment in ONE op — the node absorbs the ww29-proven create contract and the note/assignment wire choreography (6 calls today → 1).",
-          "bounds": "Dry-run first (dry_run).",
-          "dryRun": true
-        },
         {
           "op": "tickets.update",
           "verb": "update",
@@ -711,7 +665,6 @@
       "backingOperations": [
         "tickets.changeStatus",
         "tickets.create",
-        "tickets.openWithNoteAndAssign",
         "tickets.update"
       ]
     },
@@ -721,7 +674,7 @@
       "entity": "contact",
       "apiEntity": "contacts",
       "effectLine": "effect=read only — zero mutating requests, ungated by design",
-      "description": "Read contact records (mode: read — effect=read operations only; zero mutating requests, ungated by design). Registry operations for contacts: count: Count contact records matching a JSON filter. (under a company) | findByEmail: Find a contact by email address. | get: Get one Contact by id. | getContext: Get a contact with its primary context records in one call. (under a company) | getEntityInfo: Get the Contact capability metadata (canCreate/canUpdate/hasUserDefinedFields/...). | getFieldInfo: Get the Contact field catalog (types, picklists, required, maxLength) — the full raw field dump (the largest read of the info trio; compact discovery: operations.fieldCatalog). | getUdfInfo: Get the Contact user-defined-field catalog. | query: Query Contact records with a JSON filter. | resolve: Resolve a Contact from a numeric id (the direct fetch, tried first) or an exact value of its primary text field(s) (firstName + lastName — exact match only). Returns the Contact record with the numeric id for get/update/delete. Other identifier forms (e.g. an email address) are NOT tried by resolve — use the resource's dedicated lookup op where one exists (see autotask_catalog). | search: Search contact records by text (contains on the searchable fields). (under a company). Bounds: Sensitive. Bounded: server-side pagination — ordinary limit default 500, max 2500; walk.maxRows independently sets the total cap, with pages at most min(500, limit); 1000-page guard; hasMore/truncated flag remaining rows. Sensitive. Bounded: limit default 25, max 500. Sensitive. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.",
+      "description": "Read contact records (mode: read — effect=read operations only; zero mutating requests, ungated by design). Registry operations for contacts: count: Count contact records matching a JSON filter. (under a company) | findByEmail: Find a contact by email address. | fullProfile: Get a contact with its company and its open tickets in a single call: the contact (the parent-scoped root read, or the stage-1 row when the contact has no company FK), its company, and its open tickets — every part separately reported. | get: Get one Contact by id. | getContext: Get a contact with its primary context records in one call. (under a company) | getEntityInfo: Get the Contact capability metadata (canCreate/canUpdate/hasUserDefinedFields/...). | getFieldInfo: Get the Contact field catalog (types, picklists, required, maxLength) — the full raw field dump (the largest read of the info trio; compact discovery: operations.fieldCatalog). | getUdfInfo: Get the Contact user-defined-field catalog. | query: Query Contact records with a JSON filter. | resolve: Resolve a Contact from a numeric id (the direct fetch, tried first) or an exact value of its primary text field(s) (firstName + lastName — exact match only). Returns the Contact record with the numeric id for get/update/delete. Other identifier forms (e.g. an email address) are NOT tried by resolve — use the resource's dedicated lookup op where one exists (see autotask_catalog). | search: Search contact records by text (contains on the searchable fields). (under a company). Bounds: Sensitive. Bounded: server-side pagination — ordinary limit default 500, max 2500; walk.maxRows independently sets the total cap, with pages at most min(500, limit); 1000-page guard; hasMore/truncated flag remaining rows. Sensitive. Bounded: limit default 25, max 500. Sensitive. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.",
       "annotations": {
         "readOnlyHint": true,
         "destructiveHint": false,
@@ -790,6 +743,34 @@
           "purpose": "Find a contact by email address.",
           "bounds": "Sensitive."
         },
+        {
+          "op": "contacts.fullProfile",
+          "verb": "fullProfile",
+          "effect": "read",
+          "kind": "helper",
+          "flags": [],
+          "requiredArgs": [
+            "id"
+          ],
+          "input": {
+            "properties": {
+              "id": {
+                "type": "number | string"
+              }
+            },
+            "required": [
+              "id"
+            ]
+          },
+          "annotations": {
+            "readOnlyHint": true,
+            "destructiveHint": false,
+            "idempotentHint": true,
+            "openWorldHint": true
+          },
+          "purpose": "Get a contact with its company and its open tickets in a single call: the contact (the parent-scoped root read, or the stage-1 row when the contact has no company FK), its company, and its open tickets — every part separately reported.",
+          "bounds": ""
+        },
         {
           "op": "contacts.get",
           "verb": "get",
@@ -1026,6 +1007,7 @@
       "backingOperations": [
         "contacts.count",
         "contacts.findByEmail",
+        "contacts.fullProfile",
         "contacts.get",
         "contacts.getContext",
         "contacts.getEntityInfo",
@@ -1042,7 +1024,7 @@
       "entity": "contact",
       "apiEntity": "contacts",
       "effectLine": "effect=write (plus destructive only when curation re-includes it)",
-      "description": "Write contact records (mode: write — the registry operations with effect=write for contacts: create, moveToCompany, update, upsertByEmail). Writes are dry-run first: dry_run defaults to true — the request is validated against the registry inputSchema and a DryRunResult envelope is returned; the mutating request is never issued unless the caller passes confirm (the n8n-side handler must force dry-run unless confirm is present, mirroring the SDK governor). Destructive operations are refused without the confirm flag — confirm must equal the operation key exactly (the deliberate act is the call). The n8n consumer surface excludes destructive operations by curation default (excludeDestructive); they remain available on the canonical SDK server (autotask_delete / per-op tools). By curation default (excludeDestructive) no destructive operation is included; destructive capability remains on the canonical SDK server surface. Approval-gated operations (contacts.moveToCompany) additionally require confirm equal to the operation key. Per-operation required arguments: create [parentId, data]; moveToCompany [sourceContactId, destinationCompanyId]; update [parentId, id, data]; upsertByEmail [companyID, email]. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.",
+      "description": "Write contact records (mode: write — the registry operations with effect=write for contacts: create, moveToCompany, update). Writes are dry-run first: dry_run defaults to true — the request is validated against the registry inputSchema and a DryRunResult envelope is returned; the mutating request is never issued unless the caller passes confirm (the n8n-side handler must force dry-run unless confirm is present, mirroring the SDK governor). Destructive operations are refused without the confirm flag — confirm must equal the operation key exactly (the deliberate act is the call). The n8n consumer surface excludes destructive operations by curation default (excludeDestructive); they remain available on the canonical SDK server (autotask_delete / per-op tools). By curation default (excludeDestructive) no destructive operation is included; destructive capability remains on the canonical SDK server surface. Approval-gated operations (contacts.moveToCompany) additionally require confirm equal to the operation key. Per-operation required arguments: create [parentId, data]; moveToCompany [sourceContactId, destinationCompanyId]; update [parentId, id, data]. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.",
       "annotations": {
         "readOnlyHint": false,
         "destructiveHint": false,
@@ -1057,8 +1039,7 @@
             "enum": [
               "create",
               "moveToCompany",
-              "update",
-              "upsertByEmail"
+              "update"
             ]
           },
           "parentId": {
@@ -1077,15 +1058,6 @@
           "id": {
             "type": "number | string"
           },
-          "companyID": {
-            "type": "number | string (the parent — the create MUST be scoped: the global /V1.0/Contacts collection has no POST)"
-          },
-          "email": {
-            "type": "string (the natural dedup key — the vendor field emailAddress, exact match under the parent)"
-          },
-          "extra": {
-            "type": "object (optional) — { firstName?: string (default: the email local-part), lastName?: string (default: empty string), isActive?: boolean | number (BOOLEAN ACCEPTED — mapped to the zone-correct number 1/0; a raw 0/1 number passes through) }"
-          },
           "dry_run": {
             "type": "boolean",
             "default": true,
@@ -1216,50 +1188,12 @@
           "purpose": "Update a contact. (under a company)",
           "bounds": "Dry-run first (dry_run). Idempotent.",
           "dryRun": true
-        },
-        {
-          "op": "contacts.upsertByEmail",
-          "verb": "upsertByEmail",
-          "effect": "write",
-          "kind": "helper",
-          "flags": [],
-          "requiredArgs": [
-            "companyID",
-            "email"
-          ],
-          "input": {
-            "properties": {
-              "companyID": {
-                "type": "number | string (the parent — the create MUST be scoped: the global /V1.0/Contacts collection has no POST)"
-              },
-              "email": {
-                "type": "string (the natural dedup key — the vendor field emailAddress, exact match under the parent)"
-              },
-              "extra": {
-                "type": "object (optional) — { firstName?: string (default: the email local-part), lastName?: string (default: empty string), isActive?: boolean | number (BOOLEAN ACCEPTED — mapped to the zone-correct number 1/0; a raw 0/1 number passes through) }"
-              }
-            },
-            "required": [
-              "companyID",
-              "email"
-            ]
-          },
-          "annotations": {
-            "readOnlyHint": false,
-            "destructiveHint": false,
-            "idempotentHint": false,
-            "openWorldHint": true
-          },
-          "purpose": "Make sure a contact with the given email exists under the given company — find-or-create under the RIGHT parent, with the typed EXISTS/CREATED result (+ the record).",
-          "bounds": "Dry-run first (dry_run).",
-          "dryRun": true
         }
       ],
       "backingOperations": [
         "contacts.create",
         "contacts.moveToCompany",
-        "contacts.update",
-        "contacts.upsertByEmail"
+        "contacts.update"
       ]
     },
     {
@@ -1680,7 +1614,7 @@
       "entity": "company",
       "apiEntity": "companies",
       "effectLine": "effect=write (plus destructive only when curation re-includes it)",
-      "description": "Write company records (mode: write — the registry operations with effect=write for companies: create, update, upsertByName). Writes are dry-run first: dry_run defaults to true — the request is validated against the registry inputSchema and a DryRunResult envelope is returned; the mutating request is never issued unless the caller passes confirm (the n8n-side handler must force dry-run unless confirm is present, mirroring the SDK governor). Destructive operations are refused without the confirm flag — confirm must equal the operation key exactly (the deliberate act is the call). The n8n consumer surface excludes destructive operations by curation default (excludeDestructive); they remain available on the canonical SDK server (autotask_delete / per-op tools). By curation default (excludeDestructive) no destructive operation is included; destructive capability remains on the canonical SDK server surface. Per-operation required arguments: create [data]; update [id, data]; upsertByName [companyName, params]. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.",
+      "description": "Write company records (mode: write — the registry operations with effect=write for companies: create, update). Writes are dry-run first: dry_run defaults to true — the request is validated against the registry inputSchema and a DryRunResult envelope is returned; the mutating request is never issued unless the caller passes confirm (the n8n-side handler must force dry-run unless confirm is present, mirroring the SDK governor). Destructive operations are refused without the confirm flag — confirm must equal the operation key exactly (the deliberate act is the call). The n8n consumer surface excludes destructive operations by curation default (excludeDestructive); they remain available on the canonical SDK server (autotask_delete / per-op tools). By curation default (excludeDestructive) no destructive operation is included; destructive capability remains on the canonical SDK server surface. Per-operation required arguments: create [data]; update [id, data]. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.",
       "annotations": {
         "readOnlyHint": false,
         "destructiveHint": false,
@@ -1694,8 +1628,7 @@
             "type": "string",
             "enum": [
               "create",
-              "update",
-              "upsertByName"
+              "update"
             ]
           },
           "data": {
@@ -1705,12 +1638,6 @@
           "id": {
             "type": "number | string"
           },
-          "companyName": {
-            "type": "string (the natural dedup key — exact match on the vendor field companyName; the dedup covers only companies this API user can enumerate — the unowned surface is blind)"
-          },
-          "params": {
-            "type": "object — { phone: string, ownerResourceID?: number (REQUIRED on the create path — an active non-API-only resource; the node cannot enumerate candidates: the resources table is blind to the API user; absent + a dedup miss → the typed OWNER_RESOURCE_REQUIRED, zero wire), companyType?: number (default 1 — the ww29-proven value) }"
-          },
           "dry_run": {
             "type": "boolean",
             "default": true,
@@ -1792,46 +1719,11 @@
           "purpose": "Update a company.",
           "bounds": "Dry-run first (dry_run). Idempotent.",
           "dryRun": true
-        },
-        {
-          "op": "companies.upsertByName",
-          "verb": "upsertByName",
-          "effect": "write",
-          "kind": "helper",
-          "flags": [],
-          "requiredArgs": [
-            "companyName",
-            "params"
-          ],
-          "input": {
-            "properties": {
-              "companyName": {
-                "type": "string (the natural dedup key — exact match on the vendor field companyName; the dedup covers only companies this API user can enumerate — the unowned surface is blind)"
-              },
-              "params": {
-                "type": "object — { phone: string, ownerResourceID?: number (REQUIRED on the create path — an active non-API-only resource; the node cannot enumerate candidates: the resources table is blind to the API user; absent + a dedup miss → the typed OWNER_RESOURCE_REQUIRED, zero wire), companyType?: number (default 1 — the ww29-proven value) }"
-              }
-            },
-            "required": [
-              "companyName",
-              "params"
-            ]
-          },
-          "annotations": {
-            "readOnlyHint": false,
-            "destructiveHint": false,
-            "idempotentHint": false,
-            "openWorldHint": true
-          },
-          "purpose": "Make sure a company with the given name exists — find-or-create that carries the blind-surface boundary IN THE RESULT instead of pretending total visibility.",
-          "bounds": "Dry-run first (dry_run).",
-          "dryRun": true
         }
       ],
       "backingOperations": [
         "companies.create",
-        "companies.update",
-        "companies.upsertByName"
+        "companies.update"
       ]
     },
     {
@@ -2554,7 +2446,7 @@
       "entity": "resource",
       "apiEntity": "resources",
       "effectLine": "effect=read only — zero mutating requests, ungated by design",
-      "description": "Read resource records (mode: read — effect=read operations only; zero mutating requests, ungated by design). Registry operations for resources: count: Count resource records matching a JSON filter. | get: Get one Resource by id. | getEntityInfo: Get the Resource capability metadata (canCreate/canUpdate/hasUserDefinedFields/...). | getFieldInfo: Get the Resource field catalog (types, picklists, required, maxLength) — the full raw field dump (the largest read of the info trio; compact discovery: operations.fieldCatalog). | getUdfInfo: Get the Resource user-defined-field catalog. | query: Query Resource records with a JSON filter. | resolve: Resolve a resource from a numeric id (the direct fetch, tried first) or an exact value of its primary text field(s) (firstName + lastName — exact match only). Returns the Resource record with the numeric id for get/update/delete. Other identifier forms (e.g. an email address) are NOT tried by resolve — use the resource's dedicated lookup op where one exists (see autotask_catalog). | search: Search resource records by text (contains on the searchable fields). | whoAmI: Identify the resource the current credentials act as.. Bounds: Sensitive. Bounded: server-side pagination — ordinary limit default 500, max 2500; walk.maxRows independently sets the total cap, with pages at most min(500, limit); 1000-page guard; hasMore/truncated flag remaining rows. Sensitive. Bounded: limit default 25, max 500. Sensitive. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.",
+      "description": "Read resource records (mode: read — effect=read operations only; zero mutating requests, ungated by design). Registry operations for resources: count: Count resource records matching a JSON filter. | get: Get one Resource by id. | getEntityInfo: Get the Resource capability metadata (canCreate/canUpdate/hasUserDefinedFields/...). | getFieldInfo: Get the Resource field catalog (types, picklists, required, maxLength) — the full raw field dump (the largest read of the info trio; compact discovery: operations.fieldCatalog). | getUdfInfo: Get the Resource user-defined-field catalog. | query: Query Resource records with a JSON filter. | resolve: Resolve a resource from a numeric id (the direct fetch, tried first) or an exact value of its primary text field(s) (firstName + lastName — exact match only). Returns the Resource record with the numeric id for get/update/delete. Other identifier forms (e.g. an email address) are NOT tried by resolve — use the resource's dedicated lookup op where one exists (see autotask_catalog). | search: Search resource records by text (contains on the searchable fields). | whoAmI: Identify the resource the current credentials act as. | workload: Get a resource's workload in a single call: its open tickets (rows + the exact open totals), its task assignments and the tasks behind them, its time-off balances and requests.. Bounds: Sensitive. Bounded: server-side pagination — ordinary limit default 500, max 2500; walk.maxRows independently sets the total cap, with pages at most min(500, limit); 1000-page guard; hasMore/truncated flag remaining rows. Sensitive. Bounded: limit default 25, max 500. Sensitive. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.",
       "annotations": {
         "readOnlyHint": true,
         "destructiveHint": false,
@@ -2811,6 +2703,34 @@
           },
           "purpose": "Identify the resource the current credentials act as.",
           "bounds": "Sensitive."
+        },
+        {
+          "op": "resources.workload",
+          "verb": "workload",
+          "effect": "read",
+          "kind": "helper",
+          "flags": [],
+          "requiredArgs": [
+            "id"
+          ],
+          "input": {
+            "properties": {
+              "id": {
+                "type": "number | string"
+              }
+            },
+            "required": [
+              "id"
+            ]
+          },
+          "annotations": {
+            "readOnlyHint": true,
+            "destructiveHint": false,
+            "idempotentHint": true,
+            "openWorldHint": true
+          },
+          "purpose": "Get a resource's workload in a single call: its open tickets (rows + the exact open totals), its task assignments and the tasks behind them, its time-off balances and requests.",
+          "bounds": ""
         }
       ],
       "backingOperations": [
@@ -2822,7 +2742,8 @@
         "resources.query",
         "resources.resolve",
         "resources.search",
-        "resources.whoAmI"
+        "resources.whoAmI",
+        "resources.workload"
       ]
     },
     {
@@ -2831,11 +2752,11 @@
       "entity": "resource",
       "apiEntity": "resources",
       "effectLine": "effect=write (plus destructive only when curation re-includes it)",
-      "description": "Write resource records (mode: write — the registry operations with effect=write for resources: transferOwnership, update). Writes are dry-run first: dry_run defaults to true — the request is validated against the registry inputSchema and a DryRunResult envelope is returned; the mutating request is never issued unless the caller passes confirm (the n8n-side handler must force dry-run unless confirm is present, mirroring the SDK governor). Destructive operations are refused without the confirm flag — confirm must equal the operation key exactly (the deliberate act is the call). The n8n consumer surface excludes destructive operations by curation default (excludeDestructive); they remain available on the canonical SDK server (autotask_delete / per-op tools). By curation default (excludeDestructive) no destructive operation is included; destructive capability remains on the canonical SDK server surface. Approval-gated operations (resources.transferOwnership) additionally require confirm equal to the operation key. Per-operation required arguments: transferOwnership [sourceResourceIds, destinationResourceId]; update [id, data]. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.",
+      "description": "Write resource records (mode: write — the registry operations with effect=write for resources: update). Writes are dry-run first: dry_run defaults to true — the request is validated against the registry inputSchema and a DryRunResult envelope is returned; the mutating request is never issued unless the caller passes confirm (the n8n-side handler must force dry-run unless confirm is present, mirroring the SDK governor). Destructive operations are refused without the confirm flag — confirm must equal the operation key exactly (the deliberate act is the call). The n8n consumer surface excludes destructive operations by curation default (excludeDestructive); they remain available on the canonical SDK server (autotask_delete / per-op tools). By curation default (excludeDestructive) no destructive operation is included; destructive capability remains on the canonical SDK server surface. Per-operation required arguments: update [id, data]. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.",
       "annotations": {
         "readOnlyHint": false,
         "destructiveHint": false,
-        "idempotentHint": false,
+        "idempotentHint": true,
         "openWorldHint": true
       },
       "inputSchema": {
@@ -2844,16 +2765,9 @@
           "operation": {
             "type": "string",
             "enum": [
-              "transferOwnership",
               "update"
             ]
           },
-          "sourceResourceIds": {
-            "type": "(number | string)[] (max 500)"
-          },
-          "destinationResourceId": {
-            "type": "number | string"
-          },
           "id": {
             "type": "number | string"
           },
@@ -2876,45 +2790,6 @@
         ]
       },
       "operations": [
-        {
-          "op": "resources.transferOwnership",
-          "verb": "transferOwnership",
-          "effect": "write",
-          "kind": "helper",
-          "flags": [
-            "requiresApproval",
-            "sensitive"
-          ],
-          "requiredArgs": [
-            "sourceResourceIds",
-            "destinationResourceId"
-          ],
-          "input": {
-            "properties": {
-              "sourceResourceIds": {
-                "type": "(number | string)[] (max 500)"
-              },
-              "destinationResourceId": {
-                "type": "number | string"
-              }
-            },
-            "required": [
-              "sourceResourceIds",
-              "destinationResourceId"
-            ]
-          },
-          "annotations": {
-            "readOnlyHint": false,
-            "destructiveHint": false,
-            "idempotentHint": false,
-            "openWorldHint": true
-          },
-          "purpose": "Transfer ownership of named resources to another resource.",
-          "bounds": "Dry-run first (dry_run). Requires confirmation (confirm: resources.transferOwnership). Sensitive.",
-          "dryRun": true,
-          "confirmRequired": true,
-          "confirmValue": "resources.transferOwnership"
-        },
         {
           "op": "resources.update",
           "verb": "update",
@@ -2955,7 +2830,6 @@
         }
       ],
       "backingOperations": [
-        "resources.transferOwnership",
         "resources.update"
       ]
     },
@@ -2965,7 +2839,7 @@
       "entity": "timeEntry",
       "apiEntity": "time_entries",
       "effectLine": "effect=read only — zero mutating requests, ungated by design",
-      "description": "Read timeEntry records (mode: read — effect=read operations only; zero mutating requests, ungated by design). Registry operations for time_entries: count: Count time entry records matching a JSON filter. | customRange: Get time entries for an explicit dateWorked range. | dateWorkedWindow: The unambiguous-named alias for time_entries.postedWithin (issue #66): the dateWorked window read with the posted/unposted split derived from the billing_items.timeEntryID join — same wire, same result (incl. truncated). The window is ON dateWorked (entries worked within [from, to]); \"postedWithin\" keeps its historical name (its \"posted\" is the posted/unposted split, never a posted-date window or a postedDate read). | get: Get one TimeEntry by id. | getEntityInfo: Get the TimeEntry capability metadata (canCreate/canUpdate/hasUserDefinedFields/...). | getFieldInfo: Get the TimeEntry field catalog (types, picklists, required, maxLength) — the full raw field dump (the largest read of the info trio; compact discovery: operations.fieldCatalog). | getPosted: Get posted time entries (an entry that a billing item references), optionally for one ticket and/or a dateWorked window — posted state derives from the billing_items.timeEntryID join, never a postedDate read or approval. | getUdfInfo: Get the TimeEntry user-defined-field catalog. | getUnposted: Get unposted time entries (entries no billing item references), optionally for one ticket and/or a dateWorked window — posted state derives from the billing_items.timeEntryID join, never a postedDate read or approval. | last14: Get time entries for the last 14 days (rolling, dateWorked). | last24h: Get time entries for the last 24 hours (rolling, dateWorked). | last30: Get time entries for the last 30 days (rolling, dateWorked). | last7: Get time entries for the last 7 days (rolling, dateWorked). | last90: Get time entries for the last 90 days (rolling, dateWorked). | lastFullFortnight: Get time entries for the last complete fortnight. | lastFullMonth: Get time entries for the last complete calendar month. | lastFullQuarter: Get time entries for the last complete calendar quarter. | lastFullWeek: Get time entries for the last complete calendar week. | postedWithin: Get time entries WORKED within an inclusive dateWorked window with the posted/unposted split. The window is ON the dateWorked field — the name's \"posted\" is the posted/unposted SPLIT derived from the billing_items.timeEntryID join (an entry a billing item references is posted, approval is not consulted), never a posted-date window or a postedDate read. The counts cover the returned rows only; truncated flags a capped read. time_entries.dateWorkedWindow is the unambiguous name. | query: Query TimeEntry records with a JSON filter. | resolve: Resolve a time entry from a numeric id (the direct fetch) only — this resource has no searchable text field, so a non-numeric identifier throws a config error. | today: Get time entries for today (dateWorked = now, server date). | yesterday: Get time entries for yesterday (dateWorked = yesterday, server date).. Bounds: Bounded: server-side pagination — ordinary limit default 500, max 2500; walk.maxRows independently sets the total cap, with pages at most min(500, limit); 1000-page guard; hasMore/truncated flag remaining rows. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.",
+      "description": "Read timeEntry records (mode: read — effect=read operations only; zero mutating requests, ungated by design). Registry operations for time_entries: count: Count time entry records matching a JSON filter. | dateWorkedWindow: The ONE posted-state read (issue #290): a bounded read over the inclusive dateWorked window [from, to] (UTC 'YYYY-MM-DD' days) with the posted/unposted split derived from the billing_items.timeEntryID join — never a postedDate read (W-D3: this zone's TimeEntry entity has no postedDate; postedDate exist|notExist 500s, live ww29 2026-10-27). Approval is NOT consulted (ww29 never populates billingApprovalDateTime yet bills those entries). The no-window form is gone: read with no dateWorked filter goes through time_entries.query. | get: Get one TimeEntry by id. | getEntityInfo: Get the TimeEntry capability metadata (canCreate/canUpdate/hasUserDefinedFields/...). | getFieldInfo: Get the TimeEntry field catalog (types, picklists, required, maxLength) — the full raw field dump (the largest read of the info trio; compact discovery: operations.fieldCatalog). | getUdfInfo: Get the TimeEntry user-defined-field catalog. | query: Query TimeEntry records with a JSON filter. | resolve: Resolve a time entry from a numeric id (the direct fetch) only — this resource has no searchable text field, so a non-numeric identifier throws a config error.. Bounds: Bounded: server-side pagination — ordinary limit default 500, max 2500; walk.maxRows independently sets the total cap, with pages at most min(500, limit); 1000-page guard; hasMore/truncated flag remaining rows. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.",
       "annotations": {
         "readOnlyHint": true,
         "destructiveHint": false,
@@ -3002,44 +2876,6 @@
           "purpose": "Count time entry records matching a JSON filter.",
           "bounds": ""
         },
-        {
-          "op": "time_entries.customRange",
-          "verb": "customRange",
-          "effect": "read",
-          "kind": "helper",
-          "flags": [],
-          "requiredArgs": [
-            "from",
-            "to"
-          ],
-          "input": {
-            "properties": {
-              "from": {
-                "type": "string (UTC date-time)"
-              },
-              "to": {
-                "type": "string (UTC date-time)"
-              },
-              "limit": {
-                "type": "number",
-                "default": 500,
-                "max": 500
-              }
-            },
-            "required": [
-              "from",
-              "to"
-            ]
-          },
-          "annotations": {
-            "readOnlyHint": true,
-            "destructiveHint": false,
-            "idempotentHint": true,
-            "openWorldHint": true
-          },
-          "purpose": "Get time entries for an explicit dateWorked range.",
-          "bounds": ""
-        },
         {
           "op": "time_entries.dateWorkedWindow",
           "verb": "dateWorkedWindow",
@@ -3053,10 +2889,10 @@
           "input": {
             "properties": {
               "from": {
-                "type": "string (UTC date, inclusive — the dateWorked window start: the from-day start) — opts.tz never shifts it (dateWorked is date-only)"
+                "type": "string (UTC date, inclusive — the dateWorked window start: the from-day start; the UTC calendar days ARE the wire bounds — dateWorked is date-only at 00:00 UTC, so nothing is ever shifted)"
               },
               "to": {
-                "type": "string (UTC date, inclusive — the dateWorked window end: the to-day end) — opts.tz never shifts it (dateWorked is date-only). The unambiguous-named alias for postedWithin (same wire, same result incl. truncated — the name names the dateWorked window the counts cover). Result { items, postedCount, unpostedCount, window, nextCursor, unconfirmed, truncated } — the counts cover the returned rows only (at most limit); opts.cursor pages past 500 entries, opts.countOnly returns whole-window totals { window, total, postedCount, unpostedCount, vendorCalls, estimate, budget } under opts.maxVendorCalls (default 30, max 200; BUDGET_EXCEEDED refusal)"
+                "type": "string (UTC date, inclusive — the dateWorked window end: the to-day end). One bounded dateWorked read (limit 1-500, default 500 — the hard cap) plus at most 2 billing_items joins (250 ids each, every read entry); the window is ON the dateWorked field (the posted narrowing is a client-side filter after the join); opts.state ('posted' | 'unposted', omitted = both) narrows items client-side after the join (no postedDate condition is ever sent), opts.ticketID / opts.resourceID narrow the read server-side. Result { items, postedCount, unpostedCount, window, nextCursor, unconfirmed, truncated } — the counts cover the returned rows only (at most limit); opts.cursor pages past 500 entries, opts.countOnly returns whole-window totals { window, total, postedCount, unpostedCount, vendorCalls, estimate, budget } under opts.maxVendorCalls (default 30, max 200; BUDGET_EXCEEDED refusal); truncated is true when the entry read has a live next-page cursor (more matching rows exist) or a join page was truncated"
               }
             },
             "required": [
@@ -3070,7 +2906,7 @@
             "idempotentHint": true,
             "openWorldHint": true
           },
-          "purpose": "The unambiguous-named alias for time_entries.postedWithin (issue #66): the dateWorked window read with the posted/unposted split derived from the billing_items.timeEntryID join — same wire, same result (incl. truncated). The window is ON dateWorked (entries worked within [from, to]); \"postedWithin\" keeps its historical name (its \"posted\" is the posted/unposted split, never a posted-date window or a postedDate read).",
+          "purpose": "The ONE posted-state read (issue #290): a bounded read over the inclusive dateWorked window [from, to] (UTC 'YYYY-MM-DD' days) with the posted/unposted split derived from the billing_items.timeEntryID join — never a postedDate read (W-D3: this zone's TimeEntry entity has no postedDate; postedDate exist|notExist 500s, live ww29 2026-10-27). Approval is NOT consulted (ww29 never populates billingApprovalDateTime yet bills those entries). The no-window form is gone: read with no dateWorked filter goes through time_entries.query.",
           "bounds": ""
         },
         {
@@ -3141,26 +2977,6 @@
           "purpose": "Get the TimeEntry field catalog (types, picklists, required, maxLength) — the full raw field dump (the largest read of the info trio; compact discovery: operations.fieldCatalog).",
           "bounds": ""
         },
-        {
-          "op": "time_entries.getPosted",
-          "verb": "getPosted",
-          "effect": "read",
-          "kind": "helper",
-          "flags": [],
-          "requiredArgs": [],
-          "input": {
-            "properties": {},
-            "required": []
-          },
-          "annotations": {
-            "readOnlyHint": true,
-            "destructiveHint": false,
-            "idempotentHint": true,
-            "openWorldHint": true
-          },
-          "purpose": "Get posted time entries (an entry that a billing item references), optionally for one ticket and/or a dateWorked window — posted state derives from the billing_items.timeEntryID join, never a postedDate read or approval.",
-          "bounds": ""
-        },
         {
           "op": "time_entries.getUdfInfo",
           "verb": "getUdfInfo",
@@ -3182,14 +2998,28 @@
           "bounds": ""
         },
         {
-          "op": "time_entries.getUnposted",
-          "verb": "getUnposted",
+          "op": "time_entries.query",
+          "verb": "query",
           "effect": "read",
-          "kind": "helper",
+          "kind": "primitive",
           "flags": [],
           "requiredArgs": [],
           "input": {
-            "properties": {},
+            "properties": {
+              "filter": {
+                "type": "FilterCondition[] (13 operators + and/or; autotask_describe for the exact grammar)"
+              },
+              "limit": {
+                "type": "number",
+                "default": 500,
+                "max": 2500,
+                "note": "TOTAL records (server-side pagination; not a page size)"
+              },
+              "includeFields": {
+                "type": "string[]",
+                "note": "field subset to return (vendor API casing; omit = full model — pass to save context)"
+              }
+            },
             "required": []
           },
           "annotations": {
@@ -3198,19 +3028,27 @@
             "idempotentHint": true,
             "openWorldHint": true
           },
-          "purpose": "Get unposted time entries (entries no billing item references), optionally for one ticket and/or a dateWorked window — posted state derives from the billing_items.timeEntryID join, never a postedDate read or approval.",
-          "bounds": ""
+          "purpose": "Query TimeEntry records with a JSON filter.",
+          "bounds": "Bounded: server-side pagination — ordinary limit default 500, max 2500; walk.maxRows independently sets the total cap, with pages at most min(500, limit); 1000-page guard; hasMore/truncated flag remaining rows."
         },
         {
-          "op": "time_entries.last14",
-          "verb": "last14",
+          "op": "time_entries.resolve",
+          "verb": "resolve",
           "effect": "read",
           "kind": "helper",
           "flags": [],
-          "requiredArgs": [],
+          "requiredArgs": [
+            "identifier"
+          ],
           "input": {
-            "properties": {},
-            "required": []
+            "properties": {
+              "identifier": {
+                "type": "number | string"
+              }
+            },
+            "required": [
+              "identifier"
+            ]
           },
           "annotations": {
             "readOnlyHint": true,
@@ -3218,329 +3056,19 @@
             "idempotentHint": true,
             "openWorldHint": true
           },
-          "purpose": "Get time entries for the last 14 days (rolling, dateWorked).",
-          "bounds": ""
-        },
-        {
-          "op": "time_entries.last24h",
-          "verb": "last24h",
-          "effect": "read",
-          "kind": "helper",
-          "flags": [],
-          "requiredArgs": [],
-          "input": {
-            "properties": {},
-            "required": []
-          },
-          "annotations": {
-            "readOnlyHint": true,
-            "destructiveHint": false,
-            "idempotentHint": true,
-            "openWorldHint": true
-          },
-          "purpose": "Get time entries for the last 24 hours (rolling, dateWorked).",
-          "bounds": ""
-        },
-        {
-          "op": "time_entries.last30",
-          "verb": "last30",
-          "effect": "read",
-          "kind": "helper",
-          "flags": [],
-          "requiredArgs": [],
-          "input": {
-            "properties": {},
-            "required": []
-          },
-          "annotations": {
-            "readOnlyHint": true,
-            "destructiveHint": false,
-            "idempotentHint": true,
-            "openWorldHint": true
-          },
-          "purpose": "Get time entries for the last 30 days (rolling, dateWorked).",
-          "bounds": ""
-        },
-        {
-          "op": "time_entries.last7",
-          "verb": "last7",
-          "effect": "read",
-          "kind": "helper",
-          "flags": [],
-          "requiredArgs": [],
-          "input": {
-            "properties": {},
-            "required": []
-          },
-          "annotations": {
-            "readOnlyHint": true,
-            "destructiveHint": false,
-            "idempotentHint": true,
-            "openWorldHint": true
-          },
-          "purpose": "Get time entries for the last 7 days (rolling, dateWorked).",
-          "bounds": ""
-        },
-        {
-          "op": "time_entries.last90",
-          "verb": "last90",
-          "effect": "read",
-          "kind": "helper",
-          "flags": [],
-          "requiredArgs": [],
-          "input": {
-            "properties": {},
-            "required": []
-          },
-          "annotations": {
-            "readOnlyHint": true,
-            "destructiveHint": false,
-            "idempotentHint": true,
-            "openWorldHint": true
-          },
-          "purpose": "Get time entries for the last 90 days (rolling, dateWorked).",
-          "bounds": ""
-        },
-        {
-          "op": "time_entries.lastFullFortnight",
-          "verb": "lastFullFortnight",
-          "effect": "read",
-          "kind": "helper",
-          "flags": [],
-          "requiredArgs": [],
-          "input": {
-            "properties": {},
-            "required": []
-          },
-          "annotations": {
-            "readOnlyHint": true,
-            "destructiveHint": false,
-            "idempotentHint": true,
-            "openWorldHint": true
-          },
-          "purpose": "Get time entries for the last complete fortnight.",
-          "bounds": ""
-        },
-        {
-          "op": "time_entries.lastFullMonth",
-          "verb": "lastFullMonth",
-          "effect": "read",
-          "kind": "helper",
-          "flags": [],
-          "requiredArgs": [],
-          "input": {
-            "properties": {},
-            "required": []
-          },
-          "annotations": {
-            "readOnlyHint": true,
-            "destructiveHint": false,
-            "idempotentHint": true,
-            "openWorldHint": true
-          },
-          "purpose": "Get time entries for the last complete calendar month.",
-          "bounds": ""
-        },
-        {
-          "op": "time_entries.lastFullQuarter",
-          "verb": "lastFullQuarter",
-          "effect": "read",
-          "kind": "helper",
-          "flags": [],
-          "requiredArgs": [],
-          "input": {
-            "properties": {},
-            "required": []
-          },
-          "annotations": {
-            "readOnlyHint": true,
-            "destructiveHint": false,
-            "idempotentHint": true,
-            "openWorldHint": true
-          },
-          "purpose": "Get time entries for the last complete calendar quarter.",
-          "bounds": ""
-        },
-        {
-          "op": "time_entries.lastFullWeek",
-          "verb": "lastFullWeek",
-          "effect": "read",
-          "kind": "helper",
-          "flags": [],
-          "requiredArgs": [],
-          "input": {
-            "properties": {},
-            "required": []
-          },
-          "annotations": {
-            "readOnlyHint": true,
-            "destructiveHint": false,
-            "idempotentHint": true,
-            "openWorldHint": true
-          },
-          "purpose": "Get time entries for the last complete calendar week.",
-          "bounds": ""
-        },
-        {
-          "op": "time_entries.postedWithin",
-          "verb": "postedWithin",
-          "effect": "read",
-          "kind": "helper",
-          "flags": [],
-          "requiredArgs": [
-            "from",
-            "to"
-          ],
-          "input": {
-            "properties": {
-              "from": {
-                "type": "string (UTC date, inclusive — the dateWorked window start: the from-day start) — opts.tz never shifts it (dateWorked is date-only)"
-              },
-              "to": {
-                "type": "string (UTC date, inclusive — the dateWorked window end: the to-day end) — opts.tz never shifts it (dateWorked is date-only). One bounded dateWorked read (max 500 entries) plus at most 2 billing_items joins (250 ids each, every read entry); the window is ON the dateWorked field (the posted narrowing is a client-side filter after the join). Result { items, postedCount, unpostedCount, window, nextCursor, unconfirmed, truncated } — the counts cover the returned rows only (at most limit); opts.cursor pages past 500 entries, opts.countOnly returns whole-window totals { window, total, postedCount, unpostedCount, vendorCalls, estimate, budget } under opts.maxVendorCalls (default 30, max 200; BUDGET_EXCEEDED refusal); truncated is true when the entry read has a live next-page cursor (more matching rows exist) or a join page was truncated"
-              }
-            },
-            "required": [
-              "from",
-              "to"
-            ]
-          },
-          "annotations": {
-            "readOnlyHint": true,
-            "destructiveHint": false,
-            "idempotentHint": true,
-            "openWorldHint": true
-          },
-          "purpose": "Get time entries WORKED within an inclusive dateWorked window with the posted/unposted split. The window is ON the dateWorked field — the name's \"posted\" is the posted/unposted SPLIT derived from the billing_items.timeEntryID join (an entry a billing item references is posted, approval is not consulted), never a posted-date window or a postedDate read. The counts cover the returned rows only; truncated flags a capped read. time_entries.dateWorkedWindow is the unambiguous name.",
-          "bounds": ""
-        },
-        {
-          "op": "time_entries.query",
-          "verb": "query",
-          "effect": "read",
-          "kind": "primitive",
-          "flags": [],
-          "requiredArgs": [],
-          "input": {
-            "properties": {
-              "filter": {
-                "type": "FilterCondition[] (13 operators + and/or; autotask_describe for the exact grammar)"
-              },
-              "limit": {
-                "type": "number",
-                "default": 500,
-                "max": 2500,
-                "note": "TOTAL records (server-side pagination; not a page size)"
-              },
-              "includeFields": {
-                "type": "string[]",
-                "note": "field subset to return (vendor API casing; omit = full model — pass to save context)"
-              }
-            },
-            "required": []
-          },
-          "annotations": {
-            "readOnlyHint": true,
-            "destructiveHint": false,
-            "idempotentHint": true,
-            "openWorldHint": true
-          },
-          "purpose": "Query TimeEntry records with a JSON filter.",
-          "bounds": "Bounded: server-side pagination — ordinary limit default 500, max 2500; walk.maxRows independently sets the total cap, with pages at most min(500, limit); 1000-page guard; hasMore/truncated flag remaining rows."
-        },
-        {
-          "op": "time_entries.resolve",
-          "verb": "resolve",
-          "effect": "read",
-          "kind": "helper",
-          "flags": [],
-          "requiredArgs": [
-            "identifier"
-          ],
-          "input": {
-            "properties": {
-              "identifier": {
-                "type": "number | string"
-              }
-            },
-            "required": [
-              "identifier"
-            ]
-          },
-          "annotations": {
-            "readOnlyHint": true,
-            "destructiveHint": false,
-            "idempotentHint": true,
-            "openWorldHint": true
-          },
-          "purpose": "Resolve a time entry from a numeric id (the direct fetch) only — this resource has no searchable text field, so a non-numeric identifier throws a config error.",
-          "bounds": ""
-        },
-        {
-          "op": "time_entries.today",
-          "verb": "today",
-          "effect": "read",
-          "kind": "helper",
-          "flags": [],
-          "requiredArgs": [],
-          "input": {
-            "properties": {},
-            "required": []
-          },
-          "annotations": {
-            "readOnlyHint": true,
-            "destructiveHint": false,
-            "idempotentHint": true,
-            "openWorldHint": true
-          },
-          "purpose": "Get time entries for today (dateWorked = now, server date).",
-          "bounds": ""
-        },
-        {
-          "op": "time_entries.yesterday",
-          "verb": "yesterday",
-          "effect": "read",
-          "kind": "helper",
-          "flags": [],
-          "requiredArgs": [],
-          "input": {
-            "properties": {},
-            "required": []
-          },
-          "annotations": {
-            "readOnlyHint": true,
-            "destructiveHint": false,
-            "idempotentHint": true,
-            "openWorldHint": true
-          },
-          "purpose": "Get time entries for yesterday (dateWorked = yesterday, server date).",
+          "purpose": "Resolve a time entry from a numeric id (the direct fetch) only — this resource has no searchable text field, so a non-numeric identifier throws a config error.",
           "bounds": ""
         }
       ],
       "backingOperations": [
         "time_entries.count",
-        "time_entries.customRange",
         "time_entries.dateWorkedWindow",
         "time_entries.get",
         "time_entries.getEntityInfo",
         "time_entries.getFieldInfo",
-        "time_entries.getPosted",
         "time_entries.getUdfInfo",
-        "time_entries.getUnposted",
-        "time_entries.last14",
-        "time_entries.last24h",
-        "time_entries.last30",
-        "time_entries.last7",
-        "time_entries.last90",
-        "time_entries.lastFullFortnight",
-        "time_entries.lastFullMonth",
-        "time_entries.lastFullQuarter",
-        "time_entries.lastFullWeek",
-        "time_entries.postedWithin",
         "time_entries.query",
-        "time_entries.resolve",
-        "time_entries.today",
-        "time_entries.yesterday"
+        "time_entries.resolve"
       ]
     },
     {
@@ -3549,7 +3077,7 @@
       "entity": "timeEntry",
       "apiEntity": "time_entries",
       "effectLine": "effect=write (plus destructive only when curation re-includes it)",
-      "description": "Write timeEntry records (mode: write — the registry operations with effect=write for time_entries: approve, create, createForResource, createIfNotExists, update). Writes are dry-run first: dry_run defaults to true — the request is validated against the registry inputSchema and a DryRunResult envelope is returned; the mutating request is never issued unless the caller passes confirm (the n8n-side handler must force dry-run unless confirm is present, mirroring the SDK governor). Destructive operations are refused without the confirm flag — confirm must equal the operation key exactly (the deliberate act is the call). The n8n consumer surface excludes destructive operations by curation default (excludeDestructive); they remain available on the canonical SDK server (autotask_delete / per-op tools). By curation default (excludeDestructive) no destructive operation is included; destructive capability remains on the canonical SDK server surface. Per-operation required arguments: approve [id]; create [data]; createForResource [resourceID, params]; createIfNotExists [data]; update [id, data]. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.",
+      "description": "Write timeEntry records (mode: write — the registry operations with effect=write for time_entries: create, update). Writes are dry-run first: dry_run defaults to true — the request is validated against the registry inputSchema and a DryRunResult envelope is returned; the mutating request is never issued unless the caller passes confirm (the n8n-side handler must force dry-run unless confirm is present, mirroring the SDK governor). Destructive operations are refused without the confirm flag — confirm must equal the operation key exactly (the deliberate act is the call). The n8n consumer surface excludes destructive operations by curation default (excludeDestructive); they remain available on the canonical SDK server (autotask_delete / per-op tools). By curation default (excludeDestructive) no destructive operation is included; destructive capability remains on the canonical SDK server surface. Per-operation required arguments: create [data]; update [id, data]. Errors carry the SDK error contract: code, category, retryable, operation, httpStatus, suggestedAction (the nextAction directive — follow the directive), correlationId, vendorError (when the vendor returned a response body — the deep-redacted body, host-sourced text wrapped as untrusted content when untrusted-wrapping is on); credentials never appear in an error message.",
       "annotations": {
         "readOnlyHint": false,
         "destructiveHint": false,
@@ -3562,26 +3090,17 @@
           "operation": {
             "type": "string",
             "enum": [
-              "approve",
               "create",
-              "createForResource",
-              "createIfNotExists",
               "update"
             ]
           },
-          "id": {
-            "type": "number | string"
-          },
           "data": {
             "type": "object",
             "ref": "time_entries body (see types)"
           },
-          "resourceID": {
+          "id": {
             "type": "number | string"
           },
-          "params": {
-            "type": "object — the smart-create params: { internallAllocationCodeID?: number (pin the internal linkage code), ticketID?: number, taskID?: number, roleID?: number (pin the task/ticket roleID — vendor-validated as an allocation code), dateWorked?: UTC YYYY-MM-DD, startDateTime?: UTC ISO, endDateTime?: UTC ISO, hoursWorked?: number, + any other vendor TimeEntry field } (exactly one linkage pin; none → the default internal linkage with the node-resolved code)"
-          },
           "dry_run": {
             "type": "boolean",
             "default": true,
@@ -3597,35 +3116,6 @@
         ]
       },
       "operations": [
-        {
-          "op": "time_entries.approve",
-          "verb": "approve",
-          "effect": "write",
-          "kind": "helper",
-          "flags": [],
-          "requiredArgs": [
-            "id"
-          ],
-          "input": {
-            "properties": {
-              "id": {
-                "type": "number | string"
-              }
-            },
-            "required": [
-              "id"
-            ]
-          },
-          "annotations": {
-            "readOnlyHint": false,
-            "destructiveHint": false,
-            "idempotentHint": false,
-            "openWorldHint": true
-          },
-          "purpose": "Approve a time entry (the REST-only approval path): create the BillingItemApprovalLevels record, apply the vendor-documented follow-up update of BillingApprovalDateTime + BillingApprovalResourceID, then read the entry back and report whether the vendor accepted it.",
-          "bounds": "Dry-run first (dry_run).",
-          "dryRun": true
-        },
         {
           "op": "time_entries.create",
           "verb": "create",
@@ -3656,70 +3146,6 @@
           "bounds": "Dry-run first (dry_run).",
           "dryRun": true
         },
-        {
-          "op": "time_entries.createForResource",
-          "verb": "createForResource",
-          "effect": "write",
-          "kind": "helper",
-          "flags": [],
-          "requiredArgs": [
-            "resourceID",
-            "params"
-          ],
-          "input": {
-            "properties": {
-              "resourceID": {
-                "type": "number | string"
-              },
-              "params": {
-                "type": "object — the smart-create params: { internallAllocationCodeID?: number (pin the internal linkage code), ticketID?: number, taskID?: number, roleID?: number (pin the task/ticket roleID — vendor-validated as an allocation code), dateWorked?: UTC YYYY-MM-DD, startDateTime?: UTC ISO, endDateTime?: UTC ISO, hoursWorked?: number, + any other vendor TimeEntry field } (exactly one linkage pin; none → the default internal linkage with the node-resolved code)"
-              }
-            },
-            "required": [
-              "resourceID",
-              "params"
-            ]
-          },
-          "annotations": {
-            "readOnlyHint": false,
-            "destructiveHint": false,
-            "idempotentHint": false,
-            "openWorldHint": true
-          },
-          "purpose": "Create a time entry for a resource with the allocation-code dependency resolved by the node: it verifies the resource is active, honours the caller's linkage pin (else the default internal linkage), resolves an EXISTING active allocation code applicable to the resource (never creates one — the API user cannot), and posts the vendor-valid body.",
-          "bounds": "Dry-run first (dry_run).",
-          "dryRun": true
-        },
-        {
-          "op": "time_entries.createIfNotExists",
-          "verb": "createIfNotExists",
-          "effect": "write",
-          "kind": "helper",
-          "flags": [],
-          "requiredArgs": [
-            "data"
-          ],
-          "input": {
-            "properties": {
-              "data": {
-                "type": "object",
-                "ref": "time_entries body (see types)"
-              }
-            },
-            "required": [
-              "data"
-            ]
-          },
-          "annotations": {
-            "readOnlyHint": false,
-            "destructiveHint": false,
-            "idempotentHint": false,
-            "openWorldHint": true
-          },
-          "purpose": "Create a TimeEntry.",
-          "bounds": "Dry-run first (dry_run).",
-          "dryRun": true
-        },
         {
           "op": "time_entries.update",
           "verb": "update",
@@ -3759,10 +3185,7 @@
         }
       ],
       "backingOperations": [
-        "time_entries.approve",
         "time_entries.create",
-        "time_entries.createForResource",
-        "time_entries.createIfNotExists",
         "time_entries.update"
       ]
     }
@@ -3843,17 +3266,17 @@
     }
   ],
   "stats": {
-    "registryRecords": 1282,
+    "registryRecords": 1224,
     "curatedEntities": 7,
     "includedEntities": 7,
     "readTools": 7,
     "writeTools": 7,
     "totalTools": 14,
-    "readOperations": 88,
-    "writeOperations": 22,
-    "approvalGatedWrites": 2,
+    "readOperations": 75,
+    "writeOperations": 15,
+    "approvalGatedWrites": 1,
     "destructiveExcluded": 4
   },
-  "capabilitiesHash": "7cf0032e0744a559430781aeafbd3984b708e71f04b850011e08fbf113eaadcc",
-  "curationHash": "e19117ce73e38d9aded3be7e7f077a4e185d2e10294622b76c17d67f63cf9e3b"
+  "capabilitiesHash": "729ea0d47099fd45e1dde837510a92bd566a793368d0a4882e2613cbe05f7594",
+  "curationHash": "623fbca25fa416f983dde22c8b736ce813a2db1bd8c188f7124abba710f52452"
 }