node-autotask 0.8.3 → 0.10.0

package/dist/{chunk-4WJCXIY2.js → chunk-3VB6N44U.js}

@@ -1,2766 +1,39 @@
 import {
-  AutotaskAbortError,
   AutotaskConfigError,
   AutotaskError,
-  AutotaskNetworkError,
-  AutotaskTimeoutError,
   BLIND_SURFACE_STAMPS,
-  CREDENTIAL_ENV_LOAD_ACTION,
-  CircuitBreakerError,
+  BaseResource,
   ConflictError,
-  DEFAULT_PAGE_SIZE,
-  DELETE_BOUNDARY_NOTES,
-  EMPTY_REASON_STAMPS,
-  EmptyResponseError,
-  MAX_PAGES,
-  MAX_PAGE_SIZE,
   NotFoundError,
-  POINTER_NOTES,
-  QueryTooLongError,
-  REDACTED,
   RELATIONSHIP_MAP,
-  RESPONSE_DRIFT_MARKERS,
-  RateLimitError,
   ResolutionError,
-  ResponseRejectedError,
   StaleObjectError,
-  UnexpectedContentTypeError,
-  buildBreakerKey,
-  buildTenantKey,
-  clampPageSize,
-  collectAll,
-  cooldownDurationMs,
-  credentialShapeProblem,
-  decideHostPolicy,
-  defaultCircuitBreakerStore,
-  defaultCooldownStore,
-  errorFromStatus,
-  formatVendorDetail,
-  isAutotaskError,
-  isBreakerFailure,
-  isDeterministicVendor500,
-  isIdentifierCandidate,
-  isRecord,
-  isRedactedFieldName,
-  newCorrelationId,
-  paginate,
-  paginateItems,
-  parseIdentifier,
-  parseVendorErrors,
-  redactAuditBody,
-  redactResponseBody,
-  totalPagesFor
-} from "./chunk-GYI4ZQID.js";
-import {
-  CAPABILITIES
-} from "./chunk-32AKZMY4.js";
-
-// src/auth.ts
-var AUTH_HEADERS = {
-  integrationCode: "ApiIntegrationCode",
-  userName: "UserName",
-  secret: "Secret",
-  impersonation: "ImpersonationResourceId"
-};
-function buildAuthHeaders(cfg) {
-  const headers = {
-    [AUTH_HEADERS.integrationCode]: cfg.apiIntegrationCode,
-    [AUTH_HEADERS.userName]: cfg.userName,
-    [AUTH_HEADERS.secret]: cfg.secret
-  };
-  if (cfg.impersonationResourceId !== void 0 && cfg.impersonationResourceId.length > 0) {
-    headers[AUTH_HEADERS.impersonation] = cfg.impersonationResourceId;
-  }
-  return headers;
-}
-function withAuthHeaders(headers, cfg) {
-  const merged = { ...headers ?? {} };
-  const auth = buildAuthHeaders(cfg);
-  const owned = new Set(Object.keys(auth));
-  for (const key of Object.keys(merged)) {
-    if (owned.has(key)) delete merged[key];
-  }
-  return { ...merged, ...auth };
-}
-
-// src/query.ts
-var FILTER_OPERATORS = [
-  "eq",
-  "noteq",
-  "gt",
-  "gte",
-  "lt",
-  "lte",
-  "beginsWith",
-  "endsWith",
-  "contains",
-  "exist",
-  "notExist",
-  "in",
-  "notIn",
-  "and",
-  "or"
-];
-var GROUPING_OPERATORS = ["and", "or"];
-var MAX_OR_CONDITIONS = 500;
-var MAX_UDF_PER_QUERY = 1;
-var MAX_QUERY_LENGTH = 8e3;
-var MAX_GET_LENGTH = 2048;
-var MAX_FIELD_LENGTH = 128;
-function isFilterOperator(op) {
-  return typeof op === "string" && FILTER_OPERATORS.includes(op);
-}
-function validateCondition(cond, path) {
-  if (!isRecord(cond)) {
-    throw new AutotaskConfigError(`Filter condition at ${path} must be an object`);
-  }
-  const op = cond.op;
-  if (!isFilterOperator(op)) {
-    throw new AutotaskConfigError(
-      `Unknown filter operator "${String(op)}" at ${path}; expected one of: ${FILTER_OPERATORS.join(", ")}`
-    );
-  }
-  if (op === "and" || op === "or") {
-    if (!Array.isArray(cond.items) || cond.items.length === 0) {
-      throw new AutotaskConfigError(`Grouping operator "${op}" requires a non-empty "items" array at ${path}`);
-    }
-    cond.items.forEach((item, i) => validateCondition(item, `${path}.items[${i}]`));
-    return;
-  }
-  if (typeof cond.field !== "string" || cond.field.trim().length === 0) {
-    throw new AutotaskConfigError(`Filter condition at ${path} requires a non-empty "field"`);
-  }
-  if (cond.field.length > MAX_FIELD_LENGTH) {
-    throw new AutotaskConfigError(
-      `Filter field name at ${path} is ${cond.field.length} chars; the cap is ${MAX_FIELD_LENGTH}`
-    );
-  }
-  if (op === "in" || op === "notIn") {
-    if (!Array.isArray(cond.value)) {
-      throw new AutotaskConfigError(`Operator "${op}" requires an array "value" at ${path}`);
-    }
-  }
-  if (cond.value !== void 0) {
-    const values = Array.isArray(cond.value) ? cond.value : [cond.value];
-    for (const value of values) {
-      if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean") {
-        throw new AutotaskConfigError(`Filter value at ${path} must be a string, number or boolean`);
-      }
-    }
-  }
-}
-function countOrConditions(conditions) {
-  let n = 0;
-  for (const cond of conditions) {
-    if (!isRecord(cond)) continue;
-    if (cond.op === "or" && Array.isArray(cond.items)) n += cond.items.length;
-    if (Array.isArray(cond.items)) n += countOrConditions(cond.items);
-  }
-  return n;
-}
-function countUdfConditions(conditions) {
-  let n = 0;
-  for (const cond of conditions) {
-    if (!isRecord(cond)) continue;
-    if (cond.udf === true) n += 1;
-    if (Array.isArray(cond.items)) n += countUdfConditions(cond.items);
-  }
-  return n;
-}
-function serializeFilter(filter) {
-  return JSON.stringify(filter);
-}
-function validateFilter(filter) {
-  if (!isRecord(filter) || !Array.isArray(filter.filter)) {
-    throw new AutotaskConfigError("Filter must be the shape { filter: FilterCondition[] }");
-  }
-  filter.filter.forEach((condition, i) => validateCondition(condition, `filter[${i}]`));
-  const orCount = countOrConditions(filter.filter);
-  if (orCount > MAX_OR_CONDITIONS) {
-    throw new AutotaskConfigError(
-      `Query has ${orCount} OR-conditions; the vendor cap is ${MAX_OR_CONDITIONS} \u2014 split the query`
-    );
-  }
-  const udfCount = countUdfConditions(filter.filter);
-  if (udfCount > MAX_UDF_PER_QUERY) {
-    throw new AutotaskConfigError(
-      `Query has ${udfCount} UDF conditions (udf: true); the vendor allows at most ${MAX_UDF_PER_QUERY} per query`
-    );
-  }
-  const length = serializeFilter(filter).length;
-  if (length > MAX_QUERY_LENGTH) {
-    throw new AutotaskConfigError(
-      `Serialised filter is ${length} chars; the vendor cap is ${MAX_QUERY_LENGTH} \u2014 narrow the query`
-    );
-  }
-}
-function buildFilter(conditions) {
-  const list = Array.isArray(conditions) ? conditions : [conditions];
-  if (list.length === 0) {
-    throw new AutotaskConfigError("buildFilter requires at least one condition");
-  }
-  const root = list.length === 1 ? list[0] : { op: "and", items: list };
-  const filter = { filter: [root] };
-  validateFilter(filter);
-  return filter;
-}
-
-// src/http.ts
-import { AsyncLocalStorage } from "async_hooks";
-var IDEMPOTENT_METHODS = ["GET", "PUT", "DELETE"];
-var BACKOFF_BASE_MS = 200;
-var BACKOFF_CAP_MS = 3e4;
-var MAX_RETRY_DELAY_MS = 6e4;
-var HOUR_MS = 36e5;
-function assertSafePath(path) {
-  const pathPart = path.split("?", 1)[0];
-  const bad = !path.startsWith("/") || /[#\\\u0000-\u001f\u007f]/.test(pathPart) || pathPart.split("/").some((segment) => {
-    let decoded;
-    try {
-      decoded = decodeURIComponent(segment);
-    } catch {
-      return true;
-    }
-    return decoded === "." || decoded === ".." || /[/\\]/.test(decoded);
-  });
-  if (bad) {
-    throw new AutotaskConfigError(`Refused request path ${JSON.stringify(path.slice(0, 200))}: not a plain absolute API path (dot segment, '#', '\\', control character or missing leading '/')`);
-  }
-}
-function buildUrl(baseUrl, path, query) {
-  assertSafePath(path);
-  let url = baseUrl + path;
-  if (new URL(url).origin !== new URL(baseUrl).origin) {
-    throw new AutotaskConfigError(`Refused request path ${JSON.stringify(path.slice(0, 200))}: it leaves the configured origin`);
-  }
-  if (query !== void 0) {
-    const params = new URLSearchParams();
-    for (const [key, value] of Object.entries(query)) {
-      if (value === null || value === void 0 || value === "") continue;
-      params.set(key, String(value));
-    }
-    const qs = params.toString();
-    if (qs.length > 0) url += `?${qs}`;
-  }
-  return url;
-}
-function cursorToPath(baseUrl, cursor) {
-  const base = new URL(baseUrl);
-  let url;
-  try {
-    url = new URL(cursor, base);
-  } catch {
-    throw new ResponseRejectedError("Refused the pagination cursor: not a parseable URL");
-  }
-  if (url.origin !== base.origin) {
-    throw new ResponseRejectedError(`Refused the pagination cursor: it points off the configured origin (${url.origin})`);
-  }
-  const basePath = base.pathname.replace(/\/+$/, "");
-  const path = basePath !== "" && url.pathname.startsWith(`${basePath}/`) ? url.pathname.slice(basePath.length) : url.pathname;
-  return path + url.search;
-}
-var ZONE_DISCOVERY_URL = "https://webservices.autotask.net/atservicesrest/v1.0/zoneInformation";
-function normalizeZoneBase(raw) {
-  let url;
-  try {
-    url = new URL(raw);
-  } catch {
-    return void 0;
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:") return void 0;
-  return `${url.origin}${url.pathname.replace(/\/+$/, "")}`;
-}
-function buildQueryRequest(baseUrl, resourcePath, params) {
-  const queryPath = `${resourcePath}/query`;
-  const raw = params.filter;
-  const conditions = raw === void 0 ? void 0 : Array.isArray(raw) ? raw : raw.filter;
-  const filter = conditions === void 0 ? void 0 : buildFilter(conditions);
-  if (params.via === "get") {
-    const search = {};
-    if (filter !== void 0) search.filter = filter.filter;
-    if (params.maxRecords !== void 0) search.maxRecords = params.maxRecords;
-    if (params.includeFields !== void 0) search.includeFields = params.includeFields;
-    const req = {
-      method: "GET",
-      path: queryPath,
-      query: { search: JSON.stringify(search) }
-    };
-    const url = buildUrl(baseUrl, queryPath, req.query);
-    if (url.length > MAX_GET_LENGTH) {
-      throw new QueryTooLongError(
-        `GET query URL is ${url.length} chars; the vendor GET cap is ${MAX_GET_LENGTH}`
-      );
-    }
-    return req;
-  }
-  const body = {};
-  if (params.maxRecords !== void 0) body.MaxRecords = params.maxRecords;
-  if (params.includeFields !== void 0) body.IncludeFields = params.includeFields;
-  body.filter = filter === void 0 ? [] : filter.filter;
-  return { method: "POST", path: queryPath, body, idempotent: true };
-}
-var ambientSignal = new AsyncLocalStorage();
-function runWithSignal(signal, fn) {
-  return ambientSignal.run(signal, fn);
-}
-function sleep(ms, signal) {
-  return new Promise((resolve, reject2) => {
-    if (signal.aborted) return reject2(signal.reason);
-    const onAbort = () => {
-      clearTimeout(timer);
-      reject2(signal.reason);
-    };
-    const timer = setTimeout(() => {
-      signal.removeEventListener("abort", onAbort);
-      resolve();
-    }, ms);
-    signal.addEventListener("abort", onAbort, { once: true });
-  });
-}
-async function readBodyText(res, max, what, ctx) {
-  const tooLarge = () => new ResponseRejectedError(`Response for ${what} exceeds maxResponseBytes (${max})`, {
-    ...ctx,
-    code: "RESPONSE_TOO_LARGE",
-    suggestedAction: "Narrow the query (filter/includeFields) or raise maxResponseBytes."
-  });
-  const declared = Number(res.headers.get("Content-Length"));
-  if (Number.isFinite(declared) && declared > max) {
-    await res.body?.cancel().catch(() => void 0);
-    throw tooLarge();
-  }
-  if (res.body === null) return "";
-  const reader = res.body.getReader();
-  const decoder = new TextDecoder();
-  let total = 0;
-  let text = "";
-  for (; ; ) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    total += value.byteLength;
-    if (total > max) {
-      await reader.cancel().catch(() => void 0);
-      throw tooLarge();
-    }
-    text += decoder.decode(value, { stream: true });
-  }
-  return text + decoder.decode();
-}
-function backoffDelay(attempt) {
-  const exp = Math.min(BACKOFF_CAP_MS, BACKOFF_BASE_MS * 2 ** attempt);
-  return Math.floor(exp / 2 + Math.random() * (exp / 2));
-}
-function parseRetryAfter(value) {
-  if (value === null || value.length === 0) return void 0;
-  const trimmed = value.trim();
-  if (/^\d+$/.test(trimmed)) return Number.parseInt(trimmed, 10);
-  if (/^[+-]?\d+$/.test(trimmed)) return void 0;
-  const asDate = Date.parse(trimmed);
-  if (Number.isFinite(asDate)) {
-    const secs = Math.ceil((asDate - Date.now()) / 1e3);
-    return Math.max(secs, 0);
-  }
-  return void 0;
-}
-function isAbortLike(err) {
-  return typeof err === "object" && err !== null && "name" in err && err.name === "AbortError";
-}
-function isJsonMediaType(header) {
-  const mediaType = header.split(";")[0]?.trim().toLowerCase() ?? "";
-  return mediaType.startsWith("application/json") || mediaType.endsWith("+json");
-}
-function bodySnippet(text, redactPersonalData) {
-  const bytes = Buffer.from(text, "utf8").subarray(0, 256).toString("utf8");
-  return redactResponseBody(bytes, { redactPersonalData });
-}
-var CREDENTIAL_HEADER_NAMES = /* @__PURE__ */ new Set([
-  "ApiIntegrationCode",
-  "UserName",
-  "Secret",
-  "ImpersonationResourceId"
-]);
-function assertCredentialShape(headers, auth) {
-  const owned = new Set(CREDENTIAL_HEADER_NAMES);
-  for (const name of Object.keys(buildAuthHeaders(auth))) owned.add(name);
-  for (const name of Object.keys(headers)) {
-    if (!owned.has(name)) continue;
-    const value = headers[name];
-    const shape = credentialShapeProblem(value.trim(), { skipEdgeWhitespace: true });
-    if (shape === void 0) continue;
-    throw new AutotaskConfigError(
-      `${name} ${CREDENTIAL_ENV_LOAD_ACTION} (${shape})`,
-      {
-        code: "INVALID_CREDENTIAL_SHAPE",
-        suggestedAction: "Load the credential with the shell (`set -a; . ./.env; set +a`) or with loadAutotaskCredentialsFromEnv() from node-autotask; single-quoted values must be shell-sourced, not parsed by a quote-preserving loader. No request was sent."
-      }
-    );
-  }
-}
-function credentialShapeExpectation(headers, auth) {
-  const owned = new Set(CREDENTIAL_HEADER_NAMES);
-  for (const name of Object.keys(buildAuthHeaders(auth))) owned.add(name);
-  const names = Object.keys(headers).filter((name) => owned.has(name));
-  if (names.length === 0) return void 0;
-  let problem;
-  for (const name of names) {
-    const value = headers[name];
-    problem = credentialShapeProblem(value.trim(), { skipEdgeWhitespace: true });
-    if (problem !== void 0) break;
-  }
-  return {
-    headerNames: names,
-    allValuesClean: problem === void 0,
-    ...problem !== void 0 ? { problem } : {}
-  };
-}
-var HttpClient = class {
-  /**
-   * The LIVE base URL (issue #43): the construction-time value until a zone
-   * re-point happens, then the tenant's newly resolved zone base. Reads are
-   * source-compatible with the pre-#43 readonly field; the ONLY write site
-   * is the 401 recovery's `repointZoneBase` (process-lifetime, never
-   * persisted — like a cache). The configured base (`config.baseUrl`)
-   * stays the construction-time value; `baseUrl` is where the client
-   * TALKS.
-   */
-  get baseUrl() {
-    return this.liveBaseUrl;
-  }
-  maxConcurrent;
-  timeoutMs;
-  /** Bounded client-scan caps for resolution (section 19.2; per-client). */
-  resolution;
-  /** Opt-in single-record read cache (undefined = off, the default). */
-  readCache;
-  /** Opt-in field-metadata cache for the entityInformation trio (undefined = off, the default). */
-  fieldCache;
-  /** Resolved update fallback gate (issue #34; OFF by default). */
-  update;
-  auth;
-  maxRetries;
-  maxResponseBytes;
-  perHour;
-  /** The resolved profile (issue #4) — the agent profile changes the
-   * exhaustion `suggestedAction` (stop/narrow, never "raise the limit"). */
-  profile;
-  /** Request timestamps inside the trailing hour (only used when `rateLimit.perHour` is set). */
-  hourStamps = [];
-  /** Tenant 429 cooldown gate store (undefined when the gate is disabled). */
-  cooldownStore;
-  cooldownMaxMs;
-  cooldownDefaultMs;
-  /** The live base URL (issue #43 — the `baseUrl` getter's backing field;
-   * re-pointed by the 401 recovery's `repointZoneBase`). */
-  liveBaseUrl;
-  /** The resolved named zone (issue #43): the CATALOG-base marker for the
-   * re-point gate — `undefined` for a bare explicit baseUrl, `'other'` for
-   * an explicit baseUrl named "other"; neither class is re-pointable.
-   * (The construction-time value — a re-point changes the live base, not
-   * the configured zone.) */
-  zone;
-  /** The resolved zone re-resolution gate (issue #43; OFF by default). */
-  reResolveZoneOn401;
-  /** The resolved opt-in host bounds (skill 3.5.0 / L2, finding A1; absent
-   * when the caller supplied no `hostPolicy` — the byte-identical default).
-   * Gates the issue-#43 re-point target: a refused host is a discovery
-   * fault (the original 401 propagates byte-identically, zero wire). */
-  hostPolicy;
-  /** The gate key for this client's tenant (lowercased userName + host).
-   * Re-derived on a zone re-point (issue #43 — the re-pointed host starts
-   * with fresh per-host state). */
-  tenantKey;
-  /** The host circuit breaker settings (issue #26; undefined when the
-   * breaker is off — the default, in which case the gate/recording sites
-   * are skipped and no store entry is ever written). */
-  breaker;
-  /** The breaker key for this client's host (lowercased host of the base
-   * URL — host-only: vendor health is host-scoped, issue #26). Re-derived
-   * on a zone re-point (issue #43). */
-  breakerKey;
-  logger;
-  /** Response redaction policy (the INV-A1 hotfix; PII/CONFIDENTIAL default on, SECRET always).
-   *  Public read so the single dry-run envelope builder (base.ts `buildDryRunResult`)
-   *  threads the SAME resolved policy (INV-E M3 — the in-process input echo). */
-  redactPersonalData;
-  /** The configured UserName (the authenticated user). Public read so the
-   * ZoneInformation resource can send the swagger-required `user` query
-   * param (the same public-read precedent as redactPersonalData — the value
-   * already travels in every auth header; nothing new crosses the boundary). */
-  userName;
-  onAudit;
-  inFlight = 0;
-  waitQueue = [];
-  constructor(config) {
-    this.liveBaseUrl = config.baseUrl;
-    this.resolution = config.resolution;
-    this.readCache = config.readCache;
-    this.fieldCache = config.fieldCache;
-    this.update = config.update;
-    this.zone = config.zone;
-    this.reResolveZoneOn401 = config.reResolveZoneOn401;
-    this.hostPolicy = config.hostPolicy;
-    this.onAudit = config.onAudit;
-    this.auth = {
-      apiIntegrationCode: config.apiIntegrationCode,
-      userName: config.userName,
-      secret: config.secret,
-      impersonationResourceId: config.impersonationResourceId
-    };
-    this.maxRetries = config.maxRetries;
-    this.maxResponseBytes = config.maxResponseBytes;
-    this.perHour = config.rateLimit?.perHour;
-    this.tenantKey = buildTenantKey(config.userName, config.baseUrl);
-    this.cooldownStore = config.cooldown.enabled ? config.cooldown.store ?? defaultCooldownStore() : void 0;
-    this.cooldownMaxMs = config.cooldown.maxMs;
-    this.cooldownDefaultMs = config.cooldown.defaultMs;
-    this.breakerKey = buildBreakerKey(config.baseUrl);
-    this.breaker = config.circuitBreaker.enabled ? {
-      failureWindowMs: config.circuitBreaker.failureWindowMs,
-      failureThreshold: config.circuitBreaker.failureThreshold,
-      openTimeoutMs: config.circuitBreaker.openTimeoutMs,
-      successesToClose: config.circuitBreaker.successesToClose,
-      halfOpenProbes: config.circuitBreaker.halfOpenProbes,
-      store: config.circuitBreaker.store ?? defaultCircuitBreakerStore(),
-      isFailure: config.circuitBreaker.isFailure ?? isBreakerFailure
-    } : void 0;
-    this.profile = config.profile;
-    this.maxConcurrent = config.maxConcurrent;
-    this.timeoutMs = config.timeoutMs;
-    this.logger = config.logger;
-    this.redactPersonalData = config.redactPersonalData;
-    this.userName = config.userName;
-  }
-  /**
-   * The LOCAL hourly-budget state (the sliding window this client counts):
-   * `{ perHour, used, remaining }` — `undefined` when `rateLimit.perHour`
-   * is off. The limiter is PER PROCESS (issue #4): it cannot see other
-   * instances or integrations on the tenant — the tenant-wide count is
-   * `thresholdInformation.get()`.
-   */
-  hourlyBudget() {
-    if (this.perHour === void 0) return void 0;
-    const now = Date.now();
-    while (this.hourStamps.length > 0 && this.hourStamps[0] <= now - HOUR_MS) this.hourStamps.shift();
-    return { perHour: this.perHour, used: this.hourStamps.length, remaining: Math.max(0, this.perHour - this.hourStamps.length) };
-  }
-  /**
-   * Breaker success recording (issue #26): a 2xx that got through counts
-   * toward `successesToClose` whenever the host has an armed state (open or
-   * half-open — a half-open probe, or a threshold-bypass probe of a downed
-   * host; decision Q10). A probe completion decrements the admitted-probe
-   * budget. On reaching `successesToClose` the circuit CLOSES: counters
-   * reset and the entry is DELETED (a healthy host leaves no trace — the
-   * #6 delete-on-2xx precedent). A success while closed (or with no entry)
-   * is a no-op: the closed failure window is a rate window that prunes
-   * itself lazily, not a gate a success clears early.
-   */
-  recordBreakerSuccess(probe, probeKey) {
-    const breaker = this.breaker;
-    if (breaker === void 0) return;
-    if (probe && (probeKey === void 0 || probeKey !== this.breakerKey)) return;
-    const key = probe && probeKey !== void 0 ? probeKey : this.breakerKey;
-    const st = breaker.store.get(key);
-    if (st === void 0 || st.openedAt === null) return;
-    const next = {
-      failures: st.failures,
-      openedAt: st.openedAt,
-      successes: st.successes + 1,
-      probes: probe ? Math.max(0, st.probes - 1) : st.probes
-    };
-    if (next.successes >= breaker.successesToClose) {
-      breaker.store.delete(key);
-      this.logger.warn?.(
-        `[autotask] circuit breaker CLOSED for ${key} (${next.successes} probe successes)`,
-        void 0
-      );
-      return;
-    }
-    breaker.store.set(key, next);
-  }
-  /**
-   * Breaker failure recording (issue #26): called from the outer catch (the
-   * single choke point every surfaced failure passes through) for errors
-   * the failure predicate counts. While closed, a counted failure appends
-   * to the window-pruned `failures` (keeping only timestamps strictly inside
-   * `failureWindowMs`) and OPENS the circuit at `failureThreshold`. While
-   * open / half-open (a probe failure, a racy late probe failure, or a
-   * threshold-bypass failure) it RE-ARMS the open period from now and
-   * resets the success count (the #6 "a 429 re-arms" precedent — a bypass
-   * failure never fails silently).
-   */
-  recordBreakerFailure(probe, probeKey, correlationId) {
-    const breaker = this.breaker;
-    if (breaker === void 0) return;
-    if (probe && (probeKey === void 0 || probeKey !== this.breakerKey)) return;
-    const key = probe && probeKey !== void 0 ? probeKey : this.breakerKey;
-    const now = Date.now();
-    const st = breaker.store.get(key) ?? { failures: [], openedAt: null, successes: 0, probes: 0 };
-    if (st.openedAt === null) {
-      const failures = [...st.failures.filter((t) => t > now - breaker.failureWindowMs), now];
-      if (failures.length >= breaker.failureThreshold) {
-        breaker.store.set(key, { failures, openedAt: now, successes: 0, probes: 0 });
-        this.logger.warn?.(
-          `[autotask] circuit breaker OPEN for ${key} (${failures.length} counted failures in ${Math.round(breaker.failureWindowMs / 1e3)}s) \u2014 refusing locally for ${Math.round(breaker.openTimeoutMs / 1e3)}s`,
-          correlationId
-        );
-        return;
-      }
-      breaker.store.set(key, { ...st, failures });
-      return;
-    }
-    breaker.store.set(key, {
-      failures: st.failures,
-      openedAt: now,
-      successes: 0,
-      probes: probe ? Math.max(0, st.probes - 1) : st.probes
-    });
-  }
-  acquire() {
-    if (this.inFlight < this.maxConcurrent) {
-      this.inFlight += 1;
-      return Promise.resolve();
-    }
-    return new Promise((resolve) => {
-      this.waitQueue.push(() => {
-        this.inFlight += 1;
-        resolve();
-      });
-    });
-  }
-  release() {
-    this.inFlight -= 1;
-    const next = this.waitQueue.shift();
-    if (next !== void 0) next();
-  }
-  /**
-   * One request: build URL/headers, apply the whole-call deadline, retry
-   * idempotent methods on 429/5xx, map failures to the typed errors.
-   * Returns the RAW parsed body (2xx); `undefined` for an empty 2xx body.
-   */
-  /**
-   * One audit event per settled request (section 19.3): the correlation id,
-   * the redacted request body, the outcome. An audit hook that throws never
-   * breaks the request.
-   */
-  emitAudit(event) {
-    if (this.onAudit === void 0) return;
-    try {
-      this.onAudit(event);
-    } catch {
-    }
-  }
-  /** Sliding-window `rateLimit.perHour` limiter: waits for a slot within the call budget, else throws. */
-  async takeHourlySlot(deadlineAt, signal, ctx) {
-    if (this.perHour === void 0) return;
-    for (; ; ) {
-      const now = Date.now();
-      while (this.hourStamps.length > 0 && this.hourStamps[0] <= now - HOUR_MS) this.hourStamps.shift();
-      if (this.hourStamps.length < this.perHour) {
-        this.hourStamps.push(now);
-        return;
-      }
-      const waitMs = this.hourStamps[0] + HOUR_MS - now;
-      if (waitMs >= deadlineAt - now) {
-        const err = new RateLimitError(`Client-side rateLimit.perHour (${this.perHour}) exhausted; next slot in ${Math.ceil(waitMs / 1e3)}s`, {
-          ...ctx,
-          suggestedAction: this.profile === "agent" ? "Stop or narrow the query \u2014 the LOCAL hourly budget is exhausted (per-process: it cannot see other instances or integrations on the tenant). Do NOT raise rateLimit.perHour; the window frees in about an hour." : "Back off until the hourly window frees a slot, or raise rateLimit.perHour."
-        });
-        err.retryAfter = Math.ceil(waitMs / 1e3);
-        throw err;
-      }
-      await sleep(waitMs, signal);
-    }
-  }
-  /**
-   * Issue #43: the re-point gate — the zone re-resolution is available for
-   * this request. ALL gates must hold (the WYRE prior art, adopted
-   * verbatim): the flag is ON (strict `true`, off by default), the live
-   * base is CATALOG-derived (an explicit baseUrl — a bare one, or
-   * `zone: 'other'` + baseUrl — is NEVER re-pointed: the operator said
-   * where to go), and the path is RELATIVE (an absolute path, e.g. a
-   * cursor `nextPageUrl`, is already baked to a host we do not own and
-   * cannot be rewritten). The fourth gate — "this is not already the
-   * recovery retry" (exactly ONE retry, never a loop) — is enforced at the
-   * call site by the request-local `zoneRetry` flag.
-   */
-  canReResolveZone(opts) {
-    if (!this.reResolveZoneOn401) return false;
-    if (this.zone === void 0 || this.zone === "other") return false;
-    if (!opts.path.startsWith("/") || /^https?:\/\//i.test(opts.path)) return false;
-    return true;
-  }
-  /**
-   * Issue #43: one UNAUTHENTICATED vendor zone-discovery call
-   * (`GET https://webservices.autotask.net/atservicesrest/v1.0/zoneInformation?user=<userName>`
-   * — NO auth headers: the recovery signal must not leak credentials to a
-   * host that is not the configured API base). Returns the tenant's
-   * resolved zone base URL, or undefined on ANY fault (network, non-2xx,
-   * redirect, malformed body, missing/invalid `url`) — the caller then
-   * propagates the original 401 untouched (zero retry). Bounded by the
-   * SAME whole-call deadline as the request it recovers.
-   */
-  async discoverZoneBase(signal, ctx) {
-    const discoveryUrl = `${ZONE_DISCOVERY_URL}?user=${encodeURIComponent(this.userName)}`;
-    let res;
-    try {
-      res = await fetch(discoveryUrl, {
-        method: "GET",
-        headers: { Accept: "application/json" },
-        redirect: "manual",
-        // a redirect off the discovery host is a fault, not a target
-        signal
-      });
-    } catch {
-      return void 0;
-    }
-    if (res.status < 200 || res.status >= 300) {
-      await res.body?.cancel().catch(() => void 0);
-      return void 0;
-    }
-    let text;
-    try {
-      text = await readBodyText(res, this.maxResponseBytes, "zone discovery", { ...ctx, httpStatus: res.status });
-    } catch {
-      return void 0;
-    }
-    let body;
-    try {
-      body = JSON.parse(text);
-    } catch {
-      return void 0;
-    }
-    if (!isRecord(body) || typeof body.url !== "string" || body.url.trim().length === 0) {
-      return void 0;
-    }
-    return normalizeZoneBase(body.url);
-  }
-  /**
-   * Issue #43: re-point the client to the tenant's newly resolved zone
-   * base. The transport's PER-HOST state is RE-DERIVED, so the re-pointed
-   * host starts FRESH: no cooldown/breaker/tenant-rate inheritance from
-   * the stale host (conservative — the stale host's armed entries stay in
-   * the shared stores for the other clients that still talk to it; nothing
-   * is copied across). The configured base (config.baseUrl) is untouched;
-   * the LIVE base is `baseUrl` (the getter over liveBaseUrl), and the
-   * re-point is logged (a transport fact — the success path is unchanged,
-   * no envelope change).
-   */
-  repointZoneBase(to) {
-    const from = this.liveBaseUrl;
-    this.liveBaseUrl = to;
-    this.tenantKey = buildTenantKey(this.auth.userName, to);
-    this.breakerKey = buildBreakerKey(to);
-    this.logger.warn?.(
-      `[autotask] zone re-point ${from} -> ${to} (a 401 on the stale zone base; the vendor's unauthenticated zone discovery named the tenant's current zone) \u2014 retrying the request once against the new base`,
-      void 0
-    );
-  }
-  async request(opts) {
-    const method = opts.method;
-    let url = buildUrl(this.baseUrl, opts.path, opts.query);
-    let zoneRetry;
-    const headers = withAuthHeaders(opts.headers, this.auth);
-    assertCredentialShape(headers, this.auth);
-    if (opts.body !== void 0) headers["Content-Type"] = "application/json";
-    const bodyText = opts.body !== void 0 ? JSON.stringify(opts.body) : void 0;
-    const correlationId = newCorrelationId();
-    const timeoutMs = opts.timeoutMs ?? this.timeoutMs;
-    const maxRetries = opts.maxRetries ?? this.maxRetries;
-    const started = Date.now();
-    const deadlineAt = started + timeoutMs;
-    const callerSignal = opts.signal ?? ambientSignal.getStore();
-    const signal = AbortSignal.any(
-      callerSignal === void 0 ? [AbortSignal.timeout(timeoutMs)] : [AbortSignal.timeout(timeoutMs), callerSignal]
-    );
-    const auditBody = opts.body !== void 0 ? redactAuditBody(opts.body) : void 0;
-    const retriable = opts.idempotent ?? IDEMPOTENT_METHODS.includes(method);
-    const expectBody = opts.expectBody ?? method !== "DELETE";
-    const ctx = { operation: opts.operation, url, correlationId };
-    let lastStatus;
-    const interrupted = () => callerSignal?.aborted ? new AutotaskAbortError(`Request aborted: ${method} ${opts.path}`, { ...ctx, suggestedAction: "The caller aborted; re-issue the call if still needed." }) : new AutotaskTimeoutError(`Request timed out after ${timeoutMs}ms: ${method} ${opts.path}`, ctx);
-    const canWait = (delay) => delay <= MAX_RETRY_DELAY_MS && delay < deadlineAt - Date.now();
-    const pause = async (delay) => {
-      try {
-        await sleep(delay, signal);
-      } catch {
-        throw interrupted();
-      }
-    };
-    if (this.cooldownStore !== void 0 && !opts.bypassCooldown) {
-      const deadline = this.cooldownStore.get(this.tenantKey);
-      if (deadline !== void 0) {
-        const remainingMs = deadline - Date.now();
-        if (remainingMs > 0) {
-          if (callerSignal?.aborted) throw interrupted();
-          const seconds = Math.ceil(remainingMs / 1e3);
-          const err = new RateLimitError(
-            `Tenant is in a rate-limit cooldown; the call was NOT sent. ${seconds}s remain \u2014 do not retry before then, and narrow the query (filter/includeFields) before retrying.`,
-            {
-              ...ctx,
-              code: "RATE_LIMITED_COOLDOWN",
-              retryable: false,
-              suggestedAction: `Wait ${seconds}s (per-tenant 429 cooldown) and retry with a narrower query; the call was not sent and consumed no vendor budget.`
-            }
-          );
-          err.retryAfter = seconds;
-          err.notSent = true;
-          this.emitAudit({
-            correlationId,
-            operation: opts.operation,
-            method,
-            path: opts.path,
-            durationMs: Date.now() - started,
-            body: auditBody,
-            notSent: true,
-            errorCode: "RATE_LIMITED_COOLDOWN"
-          });
-          throw err;
-        }
-        this.cooldownStore.delete(this.tenantKey);
-      }
-    }
-    let breakerProbe = false;
-    let breakerProbeKey;
-    if (this.breaker !== void 0 && !opts.bypassCircuitBreaker) {
-      if (callerSignal?.aborted) throw interrupted();
-      const now = Date.now();
-      const st = this.breaker.store.get(this.breakerKey);
-      if (st !== void 0 && st.openedAt !== null) {
-        const openUntil = st.openedAt + this.breaker.openTimeoutMs;
-        if (now < openUntil) {
-          const remainingMs = openUntil - now;
-          const seconds = Math.ceil(remainingMs / 1e3);
-          const err = new CircuitBreakerError(
-            `The circuit breaker for ${this.breakerKey} is open; the call was NOT sent. ${seconds}s remain \u2014 retry the same call after the wait (a host-scoped vendor fault, not the request).`,
-            {
-              ...ctx,
-              details: { state: "open", retryAfterMs: remainingMs, failureCount: st.failures.length },
-              suggestedAction: `Wait ${seconds}s (the circuit is open for ${this.breakerKey}) and retry the SAME call; the call was not sent and consumed no vendor budget.`
-            }
-          );
-          err.retryAfter = seconds;
-          err.notSent = true;
-          this.emitAudit({
-            correlationId,
-            operation: opts.operation,
-            method,
-            path: opts.path,
-            durationMs: Date.now() - started,
-            body: auditBody,
-            notSent: true,
-            errorCode: "CIRCUIT_BREAKER_OPEN"
-          });
-          throw err;
-        }
-        if (st.probes >= this.breaker.halfOpenProbes) {
-          const err = new CircuitBreakerError(
-            `The circuit breaker for ${this.breakerKey} is half-open and its probes are in flight; the call was NOT sent \u2014 retry once a probe settles.`,
-            {
-              ...ctx,
-              details: { state: "half-open", retryAfterMs: 0, failureCount: st.failures.length },
-              suggestedAction: "A half-open probe is settling; retry shortly \u2014 the call was not sent and consumed no vendor budget."
-            }
-          );
-          err.notSent = true;
-          this.emitAudit({
-            correlationId,
-            operation: opts.operation,
-            method,
-            path: opts.path,
-            durationMs: Date.now() - started,
-            body: auditBody,
-            notSent: true,
-            errorCode: "CIRCUIT_BREAKER_OPEN"
-          });
-          throw err;
-        }
-        const admitted = { ...st, probes: st.probes + 1 };
-        this.breaker.store.set(this.breakerKey, admitted);
-        breakerProbe = true;
-        breakerProbeKey = this.breakerKey;
-      }
-    }
-    this.logger.debug?.(`[autotask] ${method} ${opts.path}`, correlationId);
-    try {
-      let attempt = 0;
-      let outcome = null;
-      for (; ; ) {
-        try {
-          await this.takeHourlySlot(deadlineAt, signal, ctx);
-        } catch (err2) {
-          if (signal.aborted) throw interrupted();
-          throw err2;
-        }
-        await this.acquire();
-        let res;
-        try {
-          res = await fetch(url, { method, headers, body: bodyText, signal, redirect: "manual" });
-        } catch (err2) {
-          this.release();
-          if (signal.aborted || isAbortLike(err2)) throw interrupted();
-          const delay = backoffDelay(attempt);
-          if (attempt < maxRetries && retriable && canWait(delay)) {
-            this.logger.warn?.(
-              `[autotask] network error on ${method} ${opts.path}; retrying in ${delay}ms (attempt ${attempt + 1}/${maxRetries})`,
-              correlationId
-            );
-            attempt += 1;
-            await pause(delay);
-            continue;
-          }
-          throw new AutotaskNetworkError(
-            `Network error during ${method} ${opts.path}: ${err2 instanceof Error ? err2.message : String(err2)}`,
-            ctx
-          );
-        }
-        let status;
-        let text;
-        try {
-          status = res.status;
-          if (status >= 300 && status < 400) {
-            await res.body?.cancel().catch(() => void 0);
-            throw new ResponseRejectedError(
-              `Refused to follow a ${status} redirect for ${method} ${opts.path}`,
-              { ...ctx, code: "REDIRECT_BLOCKED", httpStatus: status, suggestedAction: "Check the configured zone/baseUrl; the API does not redirect." }
-            );
-          }
-          text = await readBodyText(res, this.maxResponseBytes, `${method} ${opts.path}`, { ...ctx, httpStatus: status });
-        } catch (err2) {
-          this.release();
-          if (err2 instanceof AutotaskError) throw err2;
-          if (signal.aborted || isAbortLike(err2)) throw interrupted();
-          throw new AutotaskNetworkError(
-            `Network error reading the response of ${method} ${opts.path}: ${err2 instanceof Error ? err2.message : String(err2)}`,
-            ctx
-          );
-        }
-        this.release();
-        lastStatus = status;
-        if (status >= 200 && status < 300) {
-          if (this.cooldownStore !== void 0) this.cooldownStore.delete(this.tenantKey);
-          if (text.length === 0) {
-            if (expectBody) {
-              const err2 = new EmptyResponseError(`Empty ${status} response for ${method} ${opts.path}`, {
-                ...ctx,
-                httpStatus: status,
-                retryable: method !== "DELETE",
-                details: { httpStatus: status, method }
-              });
-              attachEmptyReasonDetails(err2);
-              throw err2;
-            }
-            outcome = { value: void 0, status };
-            break;
-          }
-          let parsed;
-          try {
-            parsed = JSON.parse(text);
-          } catch {
-            const contentType = res.headers.get("Content-Type");
-            const err2 = contentType !== null && contentType !== "" && !isJsonMediaType(contentType) ? new UnexpectedContentTypeError(
-              `Non-JSON response body for ${method} ${opts.path} (HTTP ${status})`,
-              {
-                ...ctx,
-                httpStatus: status,
-                details: {
-                  httpStatus: status,
-                  contentType,
-                  bodySnippet: bodySnippet(text, this.redactPersonalData)
-                },
-                // The content-type is host-sourced (a host-supplied
-                // baseUrl can serve arbitrary HTML) — capped, never prose;
-                // the raw snippet rides details only.
-                suggestedAction: retriable ? `The zone answered with a non-JSON body (content-type: ${contentType.slice(0, 100)}); the zone is likely in a maintenance window \u2014 retry after the window, or verify baseUrl points at the REST API.` : `The zone answered a write with a non-JSON body (content-type: ${contentType.slice(0, 100)}); the request may have taken effect \u2014 verify the record before re-issuing (writes are never auto-retried).`
-              }
-            ) : new AutotaskError(`Invalid JSON response body for ${method} ${opts.path}`, {
-              ...ctx,
-              code: "INVALID_RESPONSE",
-              category: "server",
-              httpStatus: status,
-              suggestedAction: "The zone returned a non-JSON 2xx body; verify baseUrl points at the REST API."
-            });
-            if (err2.code === "UNEXPECTED_CONTENT_TYPE" && retriable && attempt < maxRetries) {
-              const retryAfter = parseRetryAfter(res.headers.get("Retry-After"));
-              const delay = retryAfter !== void 0 ? retryAfter * 1e3 : backoffDelay(attempt);
-              if (canWait(delay)) {
-                this.logger.warn?.(
-                  `[autotask] non-JSON 2xx on ${method} ${opts.path}; retrying in ${delay}ms (attempt ${attempt + 1}/${maxRetries})`,
-                  correlationId
-                );
-                attempt += 1;
-                await pause(delay);
-                continue;
-              }
-            }
-            attachEmptyReasonDetails(err2);
-            throw err2;
-          }
-          outcome = {
-            value: opts.skipResponseRedaction ? parsed : redactResponseBody(parsed, { redactPersonalData: this.redactPersonalData }),
-            status
-          };
-          break;
-        }
-        let body;
-        if (text.length > 0) {
-          try {
-            body = JSON.parse(text);
-          } catch {
-            body = text;
-          }
-        }
-        const deterministic500 = status >= 500 && isDeterministicVendor500(parseVendorErrors(body));
-        const retryableStatus = status === 429 || status >= 500;
-        if (retryableStatus && !deterministic500 && attempt < maxRetries && retriable) {
-          const retryAfter = parseRetryAfter(res.headers.get("Retry-After"));
-          const delay = retryAfter !== void 0 ? retryAfter * 1e3 : backoffDelay(attempt);
-          if (canWait(delay)) {
-            this.logger.warn?.(
-              `[autotask] ${status} on ${method} ${opts.path}; retrying in ${delay}ms (attempt ${attempt + 1}/${maxRetries})`,
-              correlationId
-            );
-            attempt += 1;
-            await pause(delay);
-            continue;
-          }
-        }
-        if (status === 401 && zoneRetry === void 0 && this.canReResolveZone(opts)) {
-          const target = await this.discoverZoneBase(signal, ctx);
-          const targetViolation = target === void 0 || this.hostPolicy === void 0 ? null : decideHostPolicy(target, this.hostPolicy);
-          if (targetViolation !== null) {
-            this.logger.warn?.(
-              `[autotask] zone re-point refused by hostPolicy (${targetViolation.bound}): ${targetViolation.origin} \u2014 the original 401 propagates, zero wire to the refused host`,
-              void 0
-            );
-          }
-          if (target !== void 0 && targetViolation === null && target !== this.baseUrl) {
-            zoneRetry = { from: this.baseUrl, to: target };
-            this.repointZoneBase(target);
-            url = buildUrl(this.baseUrl, opts.path, opts.query);
-            continue;
-          }
-        }
-        const retryAfterSecs = parseRetryAfter(res.headers.get("Retry-After"));
-        const err = errorFromStatus(
-          status,
-          body,
-          url,
-          opts.operation,
-          this.redactPersonalData,
-          credentialShapeExpectation(headers, this.auth)
-        );
-        err.correlationId = correlationId;
-        if (status === 401 && zoneRetry !== void 0) {
-          err.details = {
-            ...err.details ?? {},
-            zoneRecovery: { from: zoneRetry.from, to: zoneRetry.to, retried: true }
-          };
-        }
-        attachEmptyReasonDetails(err);
-        if (err instanceof RateLimitError && retryAfterSecs !== void 0) err.retryAfter = retryAfterSecs;
-        if (status === 429 && this.cooldownStore !== void 0) {
-          const threadThreshold = err.code.toLowerCase() === "itgenatr005";
-          const durationMs = cooldownDurationMs(retryAfterSecs, {
-            maxMs: this.cooldownMaxMs,
-            defaultMs: this.cooldownDefaultMs,
-            threadThreshold
-          });
-          this.cooldownStore.set(this.tenantKey, Date.now() + durationMs);
-          this.logger.warn?.(
-            `[autotask] 429 on ${method} ${opts.path} surfaces after ${attempt + 1} attempt(s); tenant cooldown armed for ${Math.round(durationMs / 1e3)}s`,
-            correlationId
-          );
-        }
-        throw err;
-      }
-      if (outcome !== null) {
-        this.emitAudit({
-          correlationId,
-          operation: opts.operation,
-          method,
-          path: opts.path,
-          status: outcome.status,
-          durationMs: Date.now() - started,
-          body: auditBody
-        });
-        if (this.breaker !== void 0) {
-          try {
-            this.recordBreakerSuccess(breakerProbe, breakerProbeKey);
-          } catch {
-          }
-        }
-        return outcome.value;
-      }
-    } catch (err) {
-      if (this.breaker !== void 0 && err instanceof AutotaskError && err.notSent !== true) {
-        try {
-          if (this.breaker.isFailure(err)) this.recordBreakerFailure(breakerProbe, breakerProbeKey, correlationId);
-        } catch {
-        }
-      }
-      this.emitAudit({
-        correlationId,
-        operation: opts.operation,
-        method,
-        path: opts.path,
-        status: lastStatus,
-        durationMs: Date.now() - started,
-        body: auditBody,
-        errorCode: err instanceof AutotaskError ? err.code : "NETWORK_ERROR"
-      });
-      if (this.fieldCache !== void 0 && err instanceof AutotaskError) {
-        const op = typeof opts.operation === "string" ? opts.operation : void 0;
-        const verb = op !== void 0 ? op.slice(op.lastIndexOf(".") + 1) : "";
-        const drift = err.details?.deterministic === true || err.code === "INVALID_RESPONSE" && META_TRIO_VERBS.has(verb);
-        if (drift && op !== void 0) {
-          const dot = op.indexOf(".");
-          if (dot > 0) this.fieldCache.invalidate(op.slice(0, dot));
-        }
-      }
-      throw err;
-    } finally {
-      if (!(method === "GET" || opts.idempotent === true)) this.readCache?.clear();
-    }
-    throw new AutotaskError("unreachable: the request loop ended without an outcome");
-  }
-};
-var INVALID_SHAPE_ACTION = "Report the unexpected response shape; verify baseUrl points at the REST API.";
-var META_TRIO_VERBS = /* @__PURE__ */ new Set(["getEntityInfo", "getFieldInfo", "getUdfInfo"]);
-function attachEmptyReasonDetails(err) {
-  if (err.operation === void 0) return;
-  const dot = err.operation.indexOf(".");
-  if (dot <= 0) return;
-  const resource = err.operation.slice(0, dot);
-  const op = err.operation.slice(dot + 1);
-  const surface = err.operation;
-  const stamp = EMPTY_REASON_STAMPS[resource]?.[op];
-  const pointer = POINTER_NOTES[surface];
-  const isGetMiss = err instanceof NotFoundError && op === "get";
-  if (stamp === void 0 && pointer === void 0 && !isGetMiss) return;
-  err.details = { ...err.details ?? {} };
-  if (stamp !== void 0) {
-    err.details.emptyReason = stamp;
-  } else if (isGetMiss) {
-    const blindOps = BLIND_SURFACE_STAMPS[resource];
-    const blind = blindOps !== void 0 ? Object.values(blindOps).find((v) => v !== void 0) : void 0;
-    err.details.emptyReason = blind !== void 0 ? {
-      surface,
-      kind: "blind-surface",
-      note: blind.note,
-      authority: blind.authority,
-      remedy: "the note is the remedy \u2014 the authority op answers for a record"
-    } : {
-      surface,
-      kind: "not-found",
-      note: `no ${resource} record exists at this id (a miss is the data, not an error condition)`,
-      authority: `${resource}.query`,
-      remedy: `query the ${resource} collection (a bounded queryBounded walk) or verify the id from the authority surface \u2014 do not retry the same get`
-    };
-  }
-  if (pointer !== void 0) err.details.pointerNote = pointer;
-}
-function unwrapItems(body, operation) {
-  if (!isRecord(body) || !Array.isArray(body.items) || !isRecord(body.pageDetails)) {
-    const err = new AutotaskError("Expected the query envelope { items, pageDetails }; got a different shape", {
-      code: "INVALID_RESPONSE",
-      category: "server",
-      operation,
-      suggestedAction: INVALID_SHAPE_ACTION
-    });
-    attachEmptyReasonDetails(err);
-    throw err;
-  }
-  return { items: body.items, pageDetails: body.pageDetails };
-}
-function unwrapItem(body, id, operation) {
-  if (!isRecord(body) || !("item" in body)) {
-    throw new AutotaskError("Expected the item envelope { item }; got a different shape", {
-      code: "INVALID_RESPONSE",
-      category: "server",
-      operation,
-      suggestedAction: INVALID_SHAPE_ACTION
-    });
-  }
-  const item = body.item;
-  if (item === null) {
-    const err = new NotFoundError(
-      id !== void 0 ? `The record with ID ${id} was not found` : "The record was not found",
-      {
-        httpStatus: 200,
-        resourceIds: id !== void 0 ? [id] : void 0,
-        operation,
-        suggestedAction: "Verify the id, or resolve the record by name first."
-      }
-    );
-    attachEmptyReasonDetails(err);
-    throw err;
-  }
-  return item;
-}
-function unwrapQueryCount(body, operation) {
-  if (!isRecord(body) || typeof body.queryCount !== "number") {
-    const err = new AutotaskError("Expected the count envelope { queryCount: number }; got a different shape", {
-      code: "INVALID_RESPONSE",
-      category: "server",
-      operation,
-      suggestedAction: INVALID_SHAPE_ACTION
-    });
-    attachEmptyReasonDetails(err);
-    throw err;
-  }
-  return body.queryCount;
-}
-function unwrapOperation(body, operation) {
-  const value = isRecord(body) ? body.itemId !== void 0 ? body.itemId : body.id : void 0;
-  const idValue = toIdentifierId(value);
-  if (idValue === void 0) {
-    const err = new AutotaskError(
-      "Expected OperationResultModel { itemId } (or { id }); got a different shape",
-      { code: "INVALID_RESPONSE", category: "server", operation, suggestedAction: INVALID_SHAPE_ACTION }
-    );
-    attachEmptyReasonDetails(err);
-    throw err;
-  }
-  return { id: idValue };
-}
-function toIdentifierId(value) {
-  if (typeof value === "number" && Number.isInteger(value)) return value;
-  if (typeof value === "string" && /^\d+$/.test(value.trim())) {
-    const trimmed = value.trim();
-    const parsed = Number.parseInt(trimmed, 10);
-    return Number.isSafeInteger(parsed) ? parsed : trimmed;
-  }
-  return void 0;
-}
-function passthrough(body) {
-  return body;
-}
-
-// src/cache-ttl-tables.ts
-var RESOURCE_KEY_BY_PATH = {
-  "/V1.0/Appointments": "appointments",
-  "/V1.0/BillingCodes": "billing_codes",
-  "/V1.0/BillingItems": "billing_items",
-  "/V1.0/ChangeRequestLinks": "change_request_links",
-  "/V1.0/ChecklistLibraries": "checklist_libraries",
-  "/V1.0/ChecklistLibraryChecklistItems": "checklist_library_checklist_items",
-  "/V1.0/ClassificationIcons": "classification_icons",
-  "/V1.0/Companies": "companies",
-  "/V1.0/CompanyAlerts": "company_alerts",
-  "/V1.0/CompanyLocations": "company_locations",
-  "/V1.0/CompanyNotes": "company_notes",
-  "/V1.0/CompanySiteConfigurations": "company_site_configurations",
-  "/V1.0/CompanyWebhooks": "company_webhooks",
-  "/V1.0/ConfigurationItemBillingProductAssociations": "configuration_item_billing_product_associations",
-  "/V1.0/ConfigurationItemCategories": "configuration_item_categories",
-  "/V1.0/ConfigurationItemCategoryUdfAssociations": "configuration_item_category_udf_associations",
-  "/V1.0/ConfigurationItemDnsRecords": "configuration_item_dns_records",
-  "/V1.0/ConfigurationItemNotes": "configuration_item_notes",
-  "/V1.0/ConfigurationItemRelatedItems": "configuration_item_related_items",
-  "/V1.0/ConfigurationItemSslSubjectAlternativeNames": "configuration_item_ssl_subject_alternative_names",
-  "/V1.0/ConfigurationItemTypes": "configuration_item_types",
-  "/V1.0/ConfigurationItemWebhooks": "configuration_item_webhooks",
-  "/V1.0/ConfigurationItems": "configuration_items",
-  "/V1.0/ContactGroupContacts": "contact_group_contacts",
-  "/V1.0/ContactGroups": "contact_groups",
-  "/V1.0/ContactWebhooks": "contact_webhooks",
-  "/V1.0/Contacts": "contacts",
-  "/V1.0/ContractBillingRules": "contract_billing_rules",
-  "/V1.0/ContractBlockHourFactors": "contract_block_hour_factors",
-  "/V1.0/ContractBlocks": "contract_blocks",
-  "/V1.0/ContractCharges": "contract_charges",
-  "/V1.0/ContractExclusionBillingCodes": "contract_exclusion_billing_codes",
-  "/V1.0/ContractExclusionRoles": "contract_exclusion_roles",
-  "/V1.0/ContractExclusionSetExcludedRoles": "contract_exclusion_set_excluded_roles",
-  "/V1.0/ContractExclusionSetExcludedWorkTypes": "contract_exclusion_set_excluded_work_types",
-  "/V1.0/ContractExclusionSets": "contract_exclusion_sets",
-  "/V1.0/ContractMilestones": "contract_milestones",
-  "/V1.0/ContractNotes": "contract_notes",
-  "/V1.0/ContractRates": "contract_rates",
-  "/V1.0/ContractRetainers": "contract_retainers",
-  "/V1.0/ContractRoleCosts": "contract_role_costs",
-  "/V1.0/ContractServiceAdjustments": "contract_service_adjustments",
-  "/V1.0/ContractServiceBundleAdjustments": "contract_service_bundle_adjustments",
-  "/V1.0/ContractServiceBundleUnits": "contract_service_bundle_units",
-  "/V1.0/ContractServiceBundles": "contract_service_bundles",
-  "/V1.0/ContractServiceUnits": "contract_service_units",
-  "/V1.0/ContractServices": "contract_services",
-  "/V1.0/ContractTicketPurchases": "contract_ticket_purchases",
-  "/V1.0/Contracts": "contracts",
-  "/V1.0/Countries": "countries",
-  "/V1.0/Departments": "departments",
-  "/V1.0/DomainRegistrars": "domain_registrars",
-  "/V1.0/ExpenseItemAttachments": "expense_item_attachments",
-  "/V1.0/ExpenseItems": "expense_items",
-  "/V1.0/ExpenseReports": "expense_reports",
-  "/V1.0/HolidaySets": "holiday_sets",
-  "/V1.0/Holidays": "holidays",
-  "/V1.0/InventoryProducts": "inventory_products",
-  "/V1.0/Invoices": "invoices",
-  "/V1.0/NotificationHistory": "notification_history",
-  "/V1.0/Opportunities": "opportunities",
-  "/V1.0/OpportunityAttachments": "opportunity_attachments",
-  "/V1.0/OpportunityCategories": "opportunity_categories",
-  "/V1.0/Phases": "phases",
-  "/V1.0/ProductVendors": "product_vendors",
-  "/V1.0/Products": "products",
-  "/V1.0/ProjectCharges": "project_charges",
-  "/V1.0/ProjectNotes": "project_notes",
-  "/V1.0/Projects": "projects",
-  "/V1.0/PurchaseApprovals": "purchase_approvals",
-  "/V1.0/PurchaseOrderItemReceiving": "purchase_order_item_receiving",
-  "/V1.0/PurchaseOrderItems": "purchase_order_items",
-  "/V1.0/PurchaseOrders": "purchase_orders",
-  "/V1.0/QuoteItems": "quote_items",
-  "/V1.0/QuoteLocations": "quote_locations",
-  "/V1.0/QuoteTemplates": "quote_templates",
-  "/V1.0/Quotes": "quotes",
-  "/V1.0/ResourceRoleQueues": "resource_role_queues",
-  "/V1.0/ResourceRoles": "resource_roles",
-  "/V1.0/ResourceSkills": "resource_skills",
-  "/V1.0/ResourceTimeOffAdditional": "resource_time_off_additional",
-  "/V1.0/ResourceTimeOffApprovers": "resource_time_off_approvers",
-  "/V1.0/ResourceTimeOffBalances": "resource_time_off_balances",
-  "/V1.0/Resources": "resources",
-  "/V1.0/Roles": "roles",
-  "/V1.0/ServiceCallTaskResources": "service_call_task_resources",
-  "/V1.0/ServiceCallTasks": "service_call_tasks",
-  "/V1.0/ServiceCallTicketResources": "service_call_ticket_resources",
-  "/V1.0/ServiceCallTickets": "service_call_tickets",
-  "/V1.0/ServiceCalls": "service_calls",
-  "/V1.0/ServiceLevelAgreementResults": "service_level_agreement_results",
-  "/V1.0/Services": "services",
-  "/V1.0/Skills": "skills",
-  "/V1.0/SubscriptionPeriods": "subscription_periods",
-  "/V1.0/Subscriptions": "subscriptions",
-  "/V1.0/SurveyResults": "survey_results",
-  "/V1.0/Surveys": "surveys",
-  "/V1.0/TagAliases": "tag_aliases",
-  "/V1.0/TagGroups": "tag_groups",
-  "/V1.0/Tags": "tags",
-  "/V1.0/TaskSecondaryResources": "task_secondary_resources",
-  "/V1.0/Tasks": "tasks",
-  "/V1.0/TicketAdditionalConfigurationItems": "ticket_additional_configuration_items",
-  "/V1.0/TicketAdditionalContacts": "ticket_additional_contacts",
-  "/V1.0/TicketAttachments": "ticket_attachments",
-  "/V1.0/TicketCategories": "ticket_categories",
-  "/V1.0/TicketCategoryFieldDefaults": "ticket_category_field_defaults",
-  "/V1.0/TicketChangeRequestApprovals": "ticket_change_request_approvals",
-  "/V1.0/TicketCharges": "ticket_charges",
-  "/V1.0/TicketChecklistItems": "ticket_checklist_items",
-  "/V1.0/TicketChecklistLibraries": "ticket_checklist_libraries",
-  "/V1.0/TicketHistory": "ticket_history",
-  "/V1.0/TicketNoteAttachments": "ticket_note_attachments",
-  "/V1.0/TicketNoteWebhooks": "ticket_note_webhooks",
-  "/V1.0/TicketNotes": "ticket_notes",
-  "/V1.0/TicketSecondaryResources": "ticket_secondary_resources",
-  "/V1.0/TicketWebhooks": "ticket_webhooks",
-  "/V1.0/Tickets": "tickets",
-  "/V1.0/TimeEntries": "time_entries",
-  "/V1.0/TimeEntryAttachments": "time_entry_attachments",
-  "/V1.0/TimeOffRequests": "time_off_requests"
-};
-
-// src/resources/base.ts
-var BOUNDED_QUERY_DEFAULT_LIMIT = 500;
-var BOUNDED_QUERY_MAX_LIMIT = 2500;
-var MARKER_RECOVERY_LIMIT = 5;
-function describeResponseShape(body) {
-  if (body === null) return "null";
-  if (Array.isArray(body)) return `array(len=${body.length})`;
-  if (typeof body !== "object") return typeof body;
-  const rec = body;
-  const keys = Object.keys(rec).sort();
-  const typeOf = (v) => v === null ? "null" : Array.isArray(v) ? "array" : typeof v;
-  const parts = keys.slice(0, 16).map((k) => `${k}:${typeOf(rec[k])}`);
-  const more = keys.length > 16 ? `, +${keys.length - 16} more` : "";
-  return `{ ${parts.join(", ")}${more} }`;
-}
-function defaultMarkerToken(data) {
-  for (const field of ["name", "title"]) {
-    const v = data[field];
-    if (typeof v === "string" && v.trim() !== "") return v.trim();
-  }
-  return null;
-}
-var CONTEXT_ABSENT_MARKER = "#context-absent";
-function contextAbsentKey(path) {
-  return path + "\0context-absent";
-}
-function blindEmptyReason(stamp) {
-  return {
-    surface: stamp.surface,
-    kind: "blind-surface",
-    note: stamp.note,
-    authority: stamp.authority,
-    remedy: "the note is the remedy \u2014 the authority op answers for a record"
-  };
-}
-function attachUpdateTargetMissReason(err, key) {
-  const pinned = EMPTY_REASON_STAMPS[key]?.update;
-  if (pinned === void 0) return;
-  err.details = { ...err.details ?? {}, emptyReason: pinned };
-}
-function buildDryRunResult(spec, policy = { redactPersonalData: true }) {
-  if (spec.operation === "") {
-    throw new AutotaskConfigError("dry-run: the operation name is required");
-  }
-  const wouldApply = spec.checks.every((check) => check.ok);
-  const resource = spec.operation.split(".")[0] ?? spec.operation;
-  const diffPart = spec.diff !== void 0 ? {
-    diff: spec.diff.map((entry) => {
-      if (entry.to === void 0) return entry;
-      const to = isRedactedFieldName(entry.field, policy) ? REDACTED : redactResponseBody(entry.to, policy);
-      return { ...entry, to };
-    })
-  } : {};
-  const dataPart = spec.data !== void 0 ? { data: redactResponseBody(spec.data, policy) } : {};
-  return {
-    operation: spec.operation,
-    wouldApply,
-    target: { resource, ids: spec.ids },
-    request: { method: spec.method, path: spec.path },
-    ...diffPart,
-    checks: spec.checks,
-    impact: spec.impact,
-    simulated: true,
-    warnings: spec.warnings ?? [],
-    ...dataPart,
-    ...spec.emptyReason !== void 0 ? { emptyReason: spec.emptyReason } : {}
-  };
-}
-function computeFieldDiff(current, data) {
-  const out = [];
-  for (const [field, to] of Object.entries(data)) {
-    if (field === "id" || to === void 0) continue;
-    const from = current[field];
-    if (from !== void 0 && JSON.stringify(from) === JSON.stringify(to)) continue;
-    out.push({ field, from: from === void 0 ? null : from, to });
-  }
-  return out;
-}
-function mergePartialBody(current, data) {
-  const merged = { ...current };
-  for (const [key, value] of Object.entries(data)) {
-    if (value === void 0) continue;
-    merged[key] = value;
-  }
-  return merged;
-}
-function normalizeUdfInput(value) {
-  if (Array.isArray(value)) {
-    return value.map((entry) => {
-      if (!isRecord(entry) || typeof entry.name !== "string" || entry.name === "") {
-        throw new AutotaskConfigError("userDefinedFields array entries must be { name, value } objects");
-      }
-      return { name: entry.name, value: entry.value };
-    });
-  }
-  if (isRecord(value)) {
-    return Object.entries(value).map(([name, entryValue]) => ({ name, value: entryValue }));
-  }
-  throw new AutotaskConfigError("userDefinedFields must be an array of { name, value } entries or a name-to-value map");
-}
-function normalizedConditions(filter) {
-  if (filter === void 0) return void 0;
-  return Array.isArray(filter) ? filter : filter.filter;
-}
-function blindStampFor(stamp, filter) {
-  if (stamp === void 0) return void 0;
-  if (stamp.kind !== "unfiltered-blind") return stamp;
-  const conditions = normalizedConditions(filter);
-  return conditions === void 0 || conditions.length === 0 ? stamp : void 0;
-}
-function decodeFileData(body) {
-  if (isRecord(body)) {
-    const data = body.data;
-    if (typeof data === "string") return Buffer.from(data, "base64");
-    if (Array.isArray(data) && data.every((b) => typeof b === "number")) {
-      return Buffer.from(data);
-    }
-  }
-  if (typeof body === "string") return Buffer.from(body, "base64");
-  throw new AutotaskError(
-    "Expected the file envelope FileQueryResultModel { data } (or a base64 string); got a different shape",
-    { code: "INVALID_RESPONSE", category: "server" }
-  );
-}
-var BaseResource = class {
-  http;
-  config;
-  /** Default page size for query walks (the client's resolved `pageSize`). */
-  defaultPageSize;
-  /** Versioned global URL segment (from the config), e.g. '/V1.0/Companies'. */
-  get resourcePath() {
-    return this.config.resourcePath;
-  }
-  /** Parent-scoped template (from the config); undefined for top-level resources. */
-  get parentScopedPath() {
-    return this.config.parentScopedPath;
-  }
-  /** Parent field used to narrow the global query (from the config). */
-  get parentField() {
-    return this.config.parentField;
-  }
-  /** The bounded client-scan caps (section 19.2; resolved per client). */
-  get resolutionCaps() {
-    return this.http.resolution;
-  }
-  constructor(http, config, pageSize) {
-    if (config.key === "" || config.resourcePath === "") {
-      throw new AutotaskConfigError("BaseResource requires a non-empty key and resourcePath");
-    }
-    this.http = http;
-    this.config = config;
-    this.defaultPageSize = clampPageSize(pageSize ?? DEFAULT_PAGE_SIZE);
-  }
-  // ------------------------------------------------------------------
-  // Query walk (wired to the G3 walker; cursor-follow per the pinned wire)
-  // ------------------------------------------------------------------
-  /** One page fetch: page 1 POSTs the QueryModel body; later pages POST the filter to the absolute cursor. */
-  async fetchPage(params, page, pageSize, state) {
-    const operation = `${this.config.key}.query`;
-    if (page === 1) {
-      const req = buildQueryRequest(this.http.baseUrl, this.resourcePath, { ...params, maxRecords: pageSize });
-      const body2 = await this.http.request({ ...req, operation });
-      return this.readPage(body2, page, pageSize, state);
-    }
-    const cursor = state.cursor;
-    if (cursor === null) {
-      throw new AutotaskError(`No pagination cursor available for page ${page} of ${operation}`, {
-        code: "INVALID_RESPONSE",
-        category: "server",
-        operation
-      });
-    }
-    const conditions = normalizedConditions(params.filter);
-    const body = { filter: conditions === void 0 ? [] : buildFilter(conditions).filter };
-    const res = await this.http.request({
-      method: "POST",
-      path: cursorToPath(this.http.baseUrl, cursor),
-      body,
-      operation,
-      idempotent: true
-    });
-    return this.readPage(res, page, pageSize, state);
-  }
-  readPage(body, page, pageSize, state) {
-    const { items, pageDetails } = unwrapItems(body, `${this.config.key}.query`);
-    state.cursor = pageDetails.nextPageUrl;
-    const totalPages = totalPagesFor(pageDetails.requestCount, pageSize);
-    return {
-      items,
-      page,
-      pageSize,
-      requestCount: pageDetails.requestCount,
-      totalPages,
-      // The vendor's nextPageUrl is the continuation signal (node-proven: the walk
-      // follows the cursor until it is null; the 1000-page guard caps pathological loops).
-      hasMore: state.cursor !== null
-    };
-  }
-  /** Build the per-walk fetcher (closure keeps cursor state private to this walk). */
-  pageFetcher(params) {
-    const state = { cursor: null };
-    const p = params ?? {};
-    return (page, pageSize) => this.fetchPage(p, page, pageSize, state);
-  }
-  walkPageSize(params) {
-    return clampPageSize(params?.maxRecords ?? this.defaultPageSize);
-  }
-  /** Stream items across pages (the resource `query` surface). */
-  queryItems(params) {
-    return paginateItems(this.pageFetcher(params), { pageSize: this.walkPageSize(params) });
-  }
-  /** Stream page objects (the resource `queryPages` surface). */
-  queryPageIter(params) {
-    return paginate(this.pageFetcher(params), { pageSize: this.walkPageSize(params) });
-  }
-  /** Collect every item across all pages (the resource `queryAll` surface; 1000-page guarded). */
-  async queryAllItems(params) {
-    return collectAll(this.pageFetcher(params), { pageSize: this.walkPageSize(params), maxRecords: params?.maxTotalRecords });
-  }
-  /**
-   * `queryBounded` — server-side pagination (the MCP query surface): ONE call
-   * walks the vendor cursor internally until `limit` TOTAL records are
-   * collected or the cursor is exhausted, and returns a bounded,
-   * complete-enough result. The client never owns the walk:
-   * - `limit` = total records (default 500, hard max 2500 — above it throws
-   *   AutotaskConfigError; it is NOT a page size). The page-1 request uses
-   *   the internal page size min(500, limit); follow-up pages POST the
-   *   preserved filter to the absolute cursor verbatim (the pinned wire:
-   *   MaxRecords/IncludeFields are baked into the cursor — never changed
-   *   mid-walk), so the walk reuses `fetchPage` (the shared cursor machinery)
-   *   with a per-walk closure state (walks never share state).
-   * - The 1000-page guard still applies as a SOFT stop: a walk that would
-   *   fetch a 1001st page stops with `hasMore: true` (never a throw — this
-   *   is a bounded read, not the `paginate` generator's error path).
-   * - `hasMore` = (truncated by limit OR guard) AND (a non-null next cursor
-   *   was seen at the stop point OR the final page was sliced to meet the
-   *   limit). Cursor exhausted, or a short/empty page with no truncation →
-   *   false (never claims more than the cursor + the slice say exist).
-   * - `count` is always omitted: `pageDetails.count` is the current page's
-   *   record count (vendor-documented), never a total — `<resource>.count`
-   *   is the total.
-   * Pure read; no mutation paths involved.
-   */
-  async queryBounded(params) {
-    if (Array.isArray(params)) {
-      throw new AutotaskConfigError(
-        "queryBounded: params must be an object { filter?, limit?, includeFields? } \u2014 a bare conditions array is not accepted (wrap it: { filter: [...] })"
-      );
-    }
-    const limit = params?.limit ?? BOUNDED_QUERY_DEFAULT_LIMIT;
-    if (!Number.isInteger(limit) || limit < 1 || limit > BOUNDED_QUERY_MAX_LIMIT) {
-      throw new AutotaskConfigError(
-        `queryBounded: limit must be an integer 1..${BOUNDED_QUERY_MAX_LIMIT} (got ${String(limit)}) \u2014 it is the TOTAL record cap, not a page size`
-      );
-    }
-    const state = { cursor: null };
-    const p = params ?? {};
-    const items = [];
-    let pages = 0;
-    let sliced = 0;
-    let guard = false;
-    const pageSize = Math.min(MAX_PAGE_SIZE, limit);
-    for (; ; ) {
-      if (pages >= MAX_PAGES) {
-        guard = true;
-        break;
-      }
-      const page = await this.fetchPage(p, pages + 1, pageSize, state);
-      pages += 1;
-      const remaining = limit - items.length;
-      const take = page.items.slice(0, remaining);
-      sliced += Math.max(0, page.items.length - remaining);
-      items.push(...take);
-      if (items.length >= limit) break;
-      if (!page.hasMore || page.items.length === 0) break;
-    }
-    const hasMore = (items.length >= limit || guard) && (sliced > 0 || state.cursor !== null);
-    const result = { items, fetched: items.length, hasMore, pagesWalked: pages };
-    if (items.length === 0) {
-      result.blindSurface = blindStampFor(BLIND_SURFACE_STAMPS[this.config.key]?.query, params?.filter);
-      const pinnedReason = normalizedConditions(params?.filter) === void 0 ? EMPTY_REASON_STAMPS[this.config.key]?.query : void 0;
-      if (result.blindSurface !== void 0 || pinnedReason !== void 0) {
-        result.emptyReason = result.blindSurface !== void 0 ? blindEmptyReason(result.blindSurface) : pinnedReason;
-      }
-    }
-    return result;
-  }
-  // ------------------------------------------------------------------
-  // Count
-  // ------------------------------------------------------------------
-  /** `POST /V1.0/<E>/query/count` → `queryCount` unwrapped to a plain number —
-   *  or, on a plan-pinned blind surface, the `{ count: 0, blindSurface }`
-   *  typed sentinel (S12-C T10; see `BlindCountResult`). */
-  async countGlobal(params) {
-    const conditions = normalizedConditions(params?.filter);
-    const body = {};
-    body.filter = conditions === void 0 ? [] : buildFilter(conditions).filter;
-    const res = await this.http.request({
-      method: "POST",
-      path: `${this.resourcePath}/query/count`,
-      body,
-      operation: `${this.config.key}.count`,
-      idempotent: true
-    });
-    const count = unwrapQueryCount(res, `${this.config.key}.count`);
-    const stamp = blindStampFor(BLIND_SURFACE_STAMPS[this.config.key]?.count, params?.filter);
-    if (count === 0) {
-      const pinnedReason = conditions === void 0 ? EMPTY_REASON_STAMPS[this.config.key]?.count : void 0;
-      if (stamp !== void 0 || pinnedReason !== void 0) {
-        return {
-          count,
-          ...stamp !== void 0 ? { blindSurface: stamp } : {},
-          emptyReason: stamp !== void 0 ? blindEmptyReason(stamp) : pinnedReason
-        };
-      }
-    }
-    return count;
-  }
-  // ------------------------------------------------------------------
-  // Single-record reads
-  // ------------------------------------------------------------------
-  /** Single-record GET through the opt-in read cache (off by default: with
-   *  no cache this is exactly one `http.request`). Only the successful
-   *  (already redacted) body is stored — errors throw before `set`.
-   *  `fresh` skips the lookup (the read still refreshes the entry for the
-   *  other callers): mutation-path reads (stale-object guard, dry-run diff)
-   *  and the composite ROOT read of a hot resource (issue #36 — the
-   *  ticket-composite root) must see the live record, never a snapshot.
-   *  `resource` (issue #32) is the plan key of the entity this path
-   *  points to: the stored entry's TTL is the per-resource override for
-   *  that key when `cache.perResourceTtlMs` names it, else `ttlMs`. */
-  async cachedGet(path, operation, fresh = false, resource) {
-    const cache = this.http.readCache;
-    if (cache !== void 0 && !fresh) {
-      const hit = cache.get(path);
-      if (hit !== void 0) return hit;
-    }
-    const res = await this.http.request({ method: "GET", path, operation });
-    cache?.set(path, res, resource);
-    return res;
-  }
-  /**
-   * Entity-metadata read through the opt-in field cache (issue #31; off by
-   * default: with no fieldCache this is exactly one `http.request` — the
-   * bit-for-bit uncached trio path). One private helper beside `cachedGet`,
-   * for the same three reasons the read cache exists: a vendor drift
-   * (deterministic 500, INVALID_RESPONSE) must not be served stale, repeat
-   * reads must not pay the wire, and concurrent callers must not issue
-   * duplicate requests. The UNWRAPPED value is stored (never the raw
-   * envelope); an EMPTY or FAILED result is never cached (a failure
-   * rejects before any `set`; an empty is refused by the cache itself);
-   * concurrent callers share ONE in-flight wire request; the drift signal
-   * (the INVALID_RESPONSE shape drift, the deterministic validation 500)
-   * invalidates THIS entity's entries so the next call refetches
-   * (transport-level signals are also invalidated in the transport's own
-   * catch — the two sites cover the 2xx and non-2xx halves). `fresh`
-   * skips the lookup: fetch live and refresh the entries.
-   */
-  async cachedMeta(kind, path, operation, unwrap, fresh = false) {
-    const cache = this.http.fieldCache;
-    if (cache === void 0) {
-      const res = await this.http.request({ method: "GET", path, operation });
-      return unwrap(res);
-    }
-    const key = this.config.key;
-    if (!fresh) {
-      const shared = cache.inflight(key, kind);
-      if (shared !== void 0) return shared;
-      const hit = cache.get(key, kind);
-      if (hit !== void 0) return hit;
-    }
-    const work = this.http.request({ method: "GET", path, operation }).then((body) => {
-      const value = unwrap(body);
-      cache.set(key, kind, value);
-      return value;
-    });
-    work.catch((err) => {
-      if (err instanceof AutotaskError && (err.code === "INVALID_RESPONSE" || err.details?.deterministic === true)) {
-        cache.invalidate(key);
-      }
-    });
-    return cache.track(key, kind, work);
-  }
-  /** `GET /V1.0/<E>/{id}` → `{ item }` unwrapped (`item: null` → NotFoundError). */
-  async getGlobal(id, fresh = false) {
-    const numeric = parseIdentifier(id, "id");
-    const res = await this.cachedGet(`${this.resourcePath}/${numeric}`, `${this.config.key}.get`, fresh, this.config.key);
-    return unwrapItem(res, numeric, `${this.config.key}.get`);
-  }
-  /**
-   * V2 merge read: a FRESH single-record GET that skips response redaction
-   * (the `skipResponseRedaction` transport flag). The merge round-trips the
-   * record's own current values back to the same vendor endpoint in the
-   * confirmed PUT — redacting this read would write literal '[REDACTED]'
-   * markers into the merged body (corruption on live records; the caller
-   * never sees the values: the PUT answers `{ id }`, and the request-body
-   * audit keeps logging redacted). Never cached: mutation-path reads must
-   * see the live record, and an unredacted body must not enter the
-   * (redacted-view) read cache.
-   */
-  async getGlobalUnredacted(id) {
-    const numeric = parseIdentifier(id, "id");
-    const res = await this.http.request({
-      method: "GET",
-      path: `${this.resourcePath}/${numeric}`,
-      operation: `${this.config.key}.get`,
-      skipResponseRedaction: true
-    });
-    return unwrapItem(res, numeric, `${this.config.key}.get`);
-  }
-  /**
-   * Issue #34 fallback merge read: a FRESH parent-scoped single-record GET
-   * that skips response redaction and is never cached (the same invariants
-   * as `getGlobalUnredacted`, on the scoped item path — the spec's readable
-   * route for parent-scoped children). The merged retry body round-trips the
-   * record's own current values: a redacted read would write literal
-   * '[REDACTED]' markers into the fallback PUT (corruption on live records).
-   */
-  async getScopedUnredacted(parentId, id) {
-    const numeric = parseIdentifier(id, "id");
-    const res = await this.http.request({
-      method: "GET",
-      path: this.scopedItemPath(parentId, numeric),
-      operation: `${this.config.key}.get`,
-      skipResponseRedaction: true
-    });
-    return unwrapItem(res, numeric, `${this.config.key}.get`);
-  }
-  /** Parent-scoped `GET .../{parentId}/<Child>/{id}` → `{ item }` unwrapped. */
-  async getScopedRaw(parentId, id, fresh = false) {
-    const numeric = parseIdentifier(id, "id");
-    const res = await this.cachedGet(this.scopedItemPath(parentId, id), `${this.config.key}.get`, fresh, this.config.key);
-    return unwrapItem(res, numeric, `${this.config.key}.get`);
-  }
-  /**
-   * Attachment single-read: the vendor answers the model DIRECTLY (swagger),
-   * while the node observed `{ items: [model] }` for some attachment GETs —
-   * accept all three shapes; empty/null → NotFoundError.
-   */
-  async getScopedModel(parentId, id, fresh = false) {
-    const numeric = parseIdentifier(id, "id");
-    const res = await this.cachedGet(this.scopedItemPath(parentId, id), `${this.config.key}.get`, fresh, this.config.key);
-    return this.unwrapModelLike(res, numeric);
-  }
-  unwrapModelLike(body, id) {
-    if (!isRecord(body)) {
-      throw new AutotaskError(
-        `Expected an attachment model (or { item } / { items }) envelope for ID ${id}; got a different shape`,
-        { code: "INVALID_RESPONSE", category: "server", resourceIds: [id] }
-      );
-    }
-    if (Object.keys(body).length === 0) {
-      throw new NotFoundError(`The record with ID ${id} was not found`, { httpStatus: 200, resourceIds: [id] });
-    }
-    if ("item" in body) return unwrapItem(body, id);
-    if (Array.isArray(body.items)) {
-      const first = body.items[0];
-      if (first === null || first === void 0) {
-        throw new NotFoundError(`The record with ID ${id} was not found`, { httpStatus: 200, resourceIds: [id] });
-      }
-      return first;
-    }
-    return body;
-  }
-  // ------------------------------------------------------------------
-  // Mutations
-  // ------------------------------------------------------------------
-  /** Normalise a mutation body: `id` OR `itemId` → `id`; UDF map → UDF array (UDF-capable only). */
-  normalizeMutationBody(data) {
-    const body = { ...data };
-    if (body.itemId !== void 0 && body.id === void 0) {
-      body.id = body.itemId;
-      delete body.itemId;
-    }
-    if (this.config.udfCapable && body.userDefinedFields !== void 0) {
-      body.userDefinedFields = normalizeUdfInput(body.userDefinedFields);
-    }
-    return body;
-  }
-  /** `POST /V1.0/<E>` → `{ id }` (issue #13: a drifted 2xx runs the bounded marker recovery where the plan pins a marker field). */
-  async createGlobal(data, opts = {}) {
-    const body = this.normalizeMutationBody(data);
-    const res = await this.http.request({
-      method: "POST",
-      path: this.resourcePath,
-      body,
-      operation: `${this.config.key}.create`
-    });
-    return this.unwrapCreateOperation(res, body, opts);
-  }
-  /**
-   * Issue #13: the create-response envelope unwrap with the bounded marker
-   * recovery. The fast path is the plain `unwrapOperation` (a well-formed
-   * envelope costs ZERO extra requests and returns the byte-identical
-   * `{ id }` result). Only a typed `INVALID_RESPONSE` (a 2xx body that is
-   * not the specced envelope / `{ id }` / `{ itemId }` alternative) with a
-   * plan-pinned marker field AND `recoverIdFromMarker !== false` runs the
-   * fallback — and it can only run on the APPLY path: a dry run returns the
-   * pinned envelope BEFORE the mutating request, so the fallback never sees
-   * a dry-run response (skipped entirely by construction).
-   */
-  async unwrapCreateOperation(body, wireBody, opts) {
-    const operation = `${this.config.key}.create`;
-    try {
-      return unwrapOperation(body, operation);
-    } catch (err) {
-      if (!isAutotaskError(err) || err.code !== "INVALID_RESPONSE") throw err;
-      const pin = RESPONSE_DRIFT_MARKERS[this.config.key];
-      if (pin === void 0 || opts.recoverIdFromMarker === false) throw err;
-      return this.recoverCreatedIdByMarker(err, body, wireBody, opts, pin);
-    }
-  }
-  /**
-   * Issue #13: the ONE bounded marker read on the resource's own query
-   * surface (`POST <collection>/query`, MaxRecords 5 — a read: idempotent,
-   * zero mutating wire; the fallback never issues anything else). Outcomes:
-   * exactly ONE numeric match → the normal success result stamped
-   * `idFrom: 'marker-recovery'` + the `shapeDrift` note; zero matches, more
-   * than one, or a cap-tripped search (a full 5 + a next cursor) → the
-   * existing `INVALID_RESPONSE` with the drift detail + the failed search
-   * (candidate ids listed — never a guessed id).
-   */
-  async recoverCreatedIdByMarker(err, body, wireBody, opts, pin) {
-    const operation = `${this.config.key}.create`;
-    const markerField = typeof opts.markerField === "string" && opts.markerField.trim() !== "" ? opts.markerField.trim() : pin.markerField;
-    const markerToken = typeof opts.markerToken === "string" && opts.markerToken.trim() !== "" ? opts.markerToken.trim() : defaultMarkerToken(wireBody);
-    if (markerToken === null) throw err;
-    const observedShape = describeResponseShape(body);
-    const res = await this.http.request({
-      method: "POST",
-      idempotent: true,
-      path: `${this.resourcePath}/query`,
-      body: { MaxRecords: MARKER_RECOVERY_LIMIT, filter: [{ field: markerField, op: "contains", value: markerToken }] },
-      operation: `${operation}.marker-recovery`
-    });
-    const { items, pageDetails } = unwrapItems(res, operation);
-    const truncated = items.length >= MARKER_RECOVERY_LIMIT && pageDetails.nextPageUrl !== null;
-    const drift = {
-      observedShape,
-      speccedEnvelope: "OperationResultModel",
-      markerField,
-      markerToken,
-      matches: items.length,
-      truncated,
-      note: pin.note
-    };
-    const numericIds = items.map((row) => {
-      const id = row.id;
-      if (typeof id === "number" && Number.isInteger(id) && id >= 0) return id;
-      if (typeof id === "string" && /^\d+$/.test(id.trim())) {
-        const parsed = Number.parseInt(id.trim(), 10);
-        return Number.isSafeInteger(parsed) ? parsed : id.trim();
-      }
-      return null;
-    });
-    if (items.length === 1 && !truncated && numericIds[0] !== null) {
-      const id = numericIds[0];
-      const shapeDrift = {
-        observedShape,
-        speccedEnvelope: "OperationResultModel",
-        note: `The create answered 2xx with a body that is not the specced OperationResultModel (observed: ${observedShape}); the id was recovered by ONE bounded marker read (${markerField} contains the caller's marker, limit ${MARKER_RECOVERY_LIMIT}) \u2014 exactly one numeric match.`
-      };
-      return { id, idFrom: "marker-recovery", shapeDrift };
-    }
-    const candidateIds = numericIds.map((n, i) => n ?? String(items[i].id ?? "unknown"));
-    const outcome = items.length === 0 ? "found 0 matches" : truncated ? `found ${items.length} matches at the limit ${MARKER_RECOVERY_LIMIT} cap (truncated \u2014 more may exist)` : `found ${items.length} matches`;
-    err.details = { ...err.details, responseDrift: { ...drift, candidateIds } };
-    err.suggestedAction = `The create answered 2xx with a body that is not the specced OperationResultModel (observed shape: ${observedShape}); the bounded marker recovery (${markerField} contains the caller's marker, limit ${MARKER_RECOVERY_LIMIT}) ${outcome} \u2014 ` + (items.length === 0 ? "the record may exist with an unfindable marker; report the vendor response-shape drift and locate the record in the UI." : "refusing to guess an id \u2014 disambiguate with an exact-field query (or the UI) and recover the id before retrying.");
-    throw err;
-  }
-  /** `PUT /V1.0/<E>/{id}` (the vendor tolerates PATCH at the same path) → `{ id }`.
-   *  For collection-only-writable resources (`collectionUpdate`, D1) the
-   *  vendor spec defines no put/patch on the item path (it is GET-only; the
-   *  item-path PUT 405s), so the confirmed update hits the COLLECTION
-   *  `PUT /V1.0/<E>` with the record id merged into the mutation body — the
-   *  vendor keys the record by the id in the body (the same convention the
-   *  parent-scoped `updateScopedRaw` PATCH uses).
-   *
-   *  V2 partial-update merge: the vendor's collection PUT validates the FULL
-   *  model (a partial body 500s 'Missing Required Field'), so a
-   *  collectionUpdate update MERGES the caller's partial body into the
-   *  record's current full model before the PUT: ONE fresh GET serves both
-   *  the merge source and the stale-object guard's read (a `lastModifiedDate`
-   *  mismatch throws STALE_OBJECT before the PUT; the guard semantics are
-   *  unchanged — it is a no-op where the model lacks the field or the caller
-   *  supplied no token). `opts.raw === true` sends the caller body as-is
-   *  instead (the pre-merge wire; the guard keeps its own verification read
-   *  when a token is supplied).
-   *
-   *  Issue #34: with `update.putFallback: true` (OFF by default), a TYPED
-   *  404 on the pinned route retries ONCE as `PUT /{Entity}/{id}` where the
-   *  gate holds — never a collectionUpdate route (the spec defines no
-   *  item-path update there), never a `raw: true` update, never a non-404
-   *  fault; the retry body runs the same fresh-read merge (see
-   *  `putFallbackMergedBody`), so the fallback is never a null-clearing
-   *  partial. A declined gate (a collectionUpdate route 404s, or the retry
-   *  itself 404s) throws the self-explaining typed error (the route tried,
-   *  the status, the opt-in; `details.putFallback`). */
-  /**
-   * Issue #34 gate: the fallback may fire only while `update.putFallback`
-   * is ON and the pinned update route answered a TYPED 404 (a transport
-   * `NotFoundError` with `httpStatus: 404`) — never a 400/405/422/5xx, and
-   * never a 2xx shape fault (those keep today's typed error byte-identical).
-   */
-  putFallbackEligible(err) {
-    return this.http.update.putFallback === true && err instanceof NotFoundError && err.httpStatus === 404;
-  }
-  /**
-   * Issue #34: the fallback retry body — the caller's (normalised) fields
-   * merged onto a FRESH unredacted read of the current record (the same
-   * merge the collection-update path performs; the read is the live record,
-   * never cached). A target miss on the merge read surfaces with the pinned
-   * update-target reason (the issue-#14 convention) — the recovery has
-   * nothing to merge onto, and no retry is issued.
-   */
-  async putFallbackMergedBody(read, callerBody, id) {
-    let current;
-    try {
-      current = await read();
-    } catch (err) {
-      if (err instanceof NotFoundError) attachUpdateTargetMissReason(err, this.config.key);
-      throw err;
-    }
-    const merged = mergePartialBody(current, callerBody);
-    merged.id = id;
-    return merged;
-  }
-  /**
-   * Issue #34: the self-explaining typed error a DECLINED gate throws. The
-   * original transport error keeps its identity (class / code / httpStatus);
-   * the message names the route tried, the status and the opt-in, and the
-   * structured detail rides under `details.putFallback`
-   * (`{ route, status, retried, optIn }`).
-   */
-  putFallbackDeclined(err, route, retried) {
-    err.message = `${route} answered 404 on the pinned update route; ` + (retried ? `the update.putFallback retry ${route} also answered 404 \u2014 the zone drops the item route as well, so no further recovery is possible` : `the opt-in update.putFallback declines to retry this route (collectionUpdate resources have no spec-defined item-path update; raw updates send exactly what they were told) \u2014 no fallback was issued`);
-    err.details = { ...err.details ?? {}, putFallback: { route, status: 404, retried, optIn: "update.putFallback" } };
-    err.suggestedAction = retried ? "The zone answers 404 for both the pinned update route and the item route \u2014 verify the zone route registration for this entity before retrying." : "The zone drops the pinned update route and the spec defines no item-path update for this resource \u2014 verify the zone route registration, or issue the update against the collection route raw.";
-    return err;
-  }
-  async updateGlobal(id, data, opts = {}) {
-    const numeric = parseIdentifier(id, "id");
-    const operation = `${this.config.key}.update`;
-    let body = this.normalizeMutationBody(data);
-    const collectionUpdate = this.config.collectionUpdate === true;
-    if (collectionUpdate) {
-      if (opts.raw !== true) {
-        let current;
-        try {
-          current = await this.getGlobalUnredacted(numeric);
-        } catch (err) {
-          if (err instanceof NotFoundError) attachUpdateTargetMissReason(err, this.config.key);
-          throw err;
-        }
-        this.staleObjectCheck(current, opts, operation);
-        body = mergePartialBody(current, body);
-      } else {
-        await this.guardStaleBeforeMutation(numeric, opts, operation);
-      }
-      body.id = numeric;
-    }
-    const route = collectionUpdate ? `PUT ${this.resourcePath}` : `PUT ${this.resourcePath}/${numeric}`;
-    let res;
-    try {
-      res = await this.http.request({
-        method: "PUT",
-        path: collectionUpdate ? this.resourcePath : `${this.resourcePath}/${numeric}`,
-        body,
-        operation
-      });
-    } catch (err) {
-      if (!this.putFallbackEligible(err)) throw err;
-      if (collectionUpdate) {
-        throw this.putFallbackDeclined(err, route, false);
-      }
-      const merged = await this.putFallbackMergedBody(
-        () => this.getGlobalUnredacted(numeric),
-        body,
-        numeric
-      );
-      let retry;
-      try {
-        retry = await this.http.request({
-          method: "PUT",
-          path: `${this.resourcePath}/${numeric}`,
-          body: merged,
-          operation
-        });
-      } catch (rerr) {
-        if (this.putFallbackEligible(rerr)) throw this.putFallbackDeclined(rerr, route, true);
-        throw rerr;
-      }
-      return unwrapOperation(retry, operation);
-    }
-    return unwrapOperation(res, operation);
-  }
-  /** `DELETE /V1.0/<E>/{id}` → `{ id }` (OperationResultModel). A blank 2xx
-   *  (204 / empty body) is a valid vendor delete answer — synthesize the
-   *  result from the path id (issue #25: the transport returns undefined
-   *  for it; a non-blank wrong shape still throws via unwrapOperation). */
-  async deleteGlobal(id) {
-    const numeric = parseIdentifier(id, "id");
-    const res = await this.http.request({
-      method: "DELETE",
-      path: `${this.resourcePath}/${numeric}`,
-      operation: `${this.config.key}.delete`
-    });
-    return res === void 0 ? { id: numeric } : unwrapOperation(res, `${this.config.key}.delete`);
-  }
-  scopedCollectionPath(parentId) {
-    if (this.config.parentScopedPath === void 0) {
-      throw new AutotaskConfigError(`Resource ${this.config.key} is not parent-scoped; there is no parent-scoped path`);
-    }
-    const p = parseIdentifier(parentId, "parentId");
-    return this.config.parentScopedPath.replace("{parentId}", String(p));
-  }
-  scopedItemPath(parentId, id) {
-    return `${this.scopedCollectionPath(parentId)}/${parseIdentifier(id, "id")}`;
-  }
-  /** Parent-scoped create: `POST .../{parentId}/<Child>` (issue #13: a drifted 2xx runs the bounded marker recovery where the plan pins a marker field). */
-  async createScopedRaw(parentId, data, opts = {}) {
-    const body = this.normalizeMutationBody(data);
-    const res = await this.http.request({
-      method: "POST",
-      path: this.scopedCollectionPath(parentId),
-      body,
-      operation: `${this.config.key}.create`
-    });
-    return this.unwrapCreateOperation(res, body, opts);
-  }
-  /** Parent-scoped update: `PATCH .../{parentId}/<Child>` — the COLLECTION.
-   *  Swagger documents put+patch on the scoped collection and has NO put/patch on
-   *  the item path anywhere in the spec; the node strips the id from the path and
-   *  PATCHes the collection, and the vendor keys the record by the id in the body. */
-  async updateScopedRaw(parentId, id, data) {
-    const numeric = parseIdentifier(id, "id");
-    const body = this.normalizeMutationBody(data);
-    body.id = numeric;
-    const path = this.scopedCollectionPath(parentId);
-    const operation = `${this.config.key}.update`;
-    let res;
-    try {
-      res = await this.http.request({
-        method: "PATCH",
-        path,
-        body,
-        operation
-      });
-    } catch (err) {
-      if (!this.putFallbackEligible(err)) throw err;
-      const merged = await this.putFallbackMergedBody(
-        () => this.getScopedUnredacted(parentId, numeric),
-        body,
-        numeric
-      );
-      let retry;
-      try {
-        retry = await this.http.request({
-          method: "PUT",
-          path: `${path}/${numeric}`,
-          body: merged,
-          operation
-        });
-      } catch (rerr) {
-        if (this.putFallbackEligible(rerr)) throw this.putFallbackDeclined(rerr, `PUT ${path}/${numeric}`, true);
-        throw rerr;
-      }
-      return unwrapOperation(retry, operation);
-    }
-    return unwrapOperation(res, operation);
-  }
-  /** Parent-scoped delete: `DELETE .../{parentId}/<Child>/{id}` → `{ id }`
-   *  (a blank 2xx synthesizes `{ id }` from the path id — issue #25). */
-  async deleteScopedRaw(parentId, id) {
-    const numeric = parseIdentifier(id, "id");
-    const res = await this.http.request({
-      method: "DELETE",
-      path: this.scopedItemPath(parentId, id),
-      operation: `${this.config.key}.delete`
-    });
-    return res === void 0 ? { id: numeric } : unwrapOperation(res, `${this.config.key}.delete`);
-  }
-  /**
-   * Attachment delete: the vendor returns the deleted attachment MODEL, not
-   * OperationResultModel (G1 envelope.md) — pass it through typed.
-   */
-  async deleteScopedModel(parentId, id) {
-    const numeric = parseIdentifier(id, "id");
-    const res = await this.http.request({
-      method: "DELETE",
-      path: this.scopedItemPath(parentId, id),
-      operation: `${this.config.key}.delete`
-    });
-    if (res === void 0) return {};
-    if (!isRecord(res)) {
-      throw new AutotaskError(
-        `Expected the deleted attachment model for ID ${numeric}; got a different shape`,
-        { code: "INVALID_RESPONSE", category: "server", resourceIds: [numeric] }
-      );
-    }
-    return res;
-  }
-  // ------------------------------------------------------------------
-  // Entity metadata trio (global paths; the vendor defines them for children too)
-  // ------------------------------------------------------------------
-  /** `GET /V1.0/<E>/entityInformation` → `{ info }` unwrapped.
-   *  Goes through the opt-in field cache when `fieldCache` is configured
-   *  (off by default: the bit-for-bit uncached wire path). A fresh
-   *  (bypass + refresh) metadata read is the caller's act: drop the
-   *  entity's entries via the fieldCache's `invalidate` first — the trio
-   *  keeps its no-arg surface (the registry/MCP arity pin). */
-  async getEntityInfo() {
-    return await this.cachedMeta(
-      "info",
-      `${this.resourcePath}/entityInformation`,
-      `${this.config.key}.getEntityInfo`,
-      (res) => {
-        const body = isRecord(res) ? res : void 0;
-        if (body === void 0 || !isRecord(body.info)) {
-          throw new AutotaskError("Expected the entityInformation envelope { info }; got a different shape", {
-            code: "INVALID_RESPONSE",
-            category: "server"
-          });
-        }
-        return body.info;
-      }
-    );
-  }
-  /** `GET /V1.0/<E>/entityInformation/fields` → `{ fields }` unwrapped.
-   *  Goes through the opt-in field cache when `fieldCache` is configured
-   *  (off by default: the bit-for-bit uncached wire path). A fresh
-   *  (bypass + refresh) metadata read is the caller's act: drop the
-   *  entity's entries via the fieldCache's `invalidate` first — the trio
-   *  keeps its no-arg surface (the registry/MCP arity pin). */
-  async getFieldInfo() {
-    return await this.cachedMeta(
-      "fields",
-      `${this.resourcePath}/entityInformation/fields`,
-      `${this.config.key}.getFieldInfo`,
-      (res) => this.unwrapFields(res, "FieldInformationResultModel")
-    );
-  }
-  /** `GET /V1.0/<E>/entityInformation/userDefinedFields` → `{ fields }` unwrapped.
-   *  Goes through the opt-in field cache when `fieldCache` is configured
-   *  (off by default: the bit-for-bit uncached wire path). A fresh
-   *  (bypass + refresh) metadata read is the caller's act: drop the
-   *  entity's entries via the fieldCache's `invalidate` first — the trio
-   *  keeps its no-arg surface (the registry/MCP arity pin). */
-  async getUdfInfo() {
-    return await this.cachedMeta(
-      "udf",
-      `${this.resourcePath}/entityInformation/userDefinedFields`,
-      `${this.config.key}.getUdfInfo`,
-      (res) => this.unwrapFields(res, "UserDefinedFieldInformationResultModel")
-    );
-  }
-  unwrapFields(body, envelopeName) {
-    if (!isRecord(body) || !Array.isArray(body.fields)) {
-      throw new AutotaskError(`Expected the ${envelopeName} envelope { fields: [] }; got a different shape`, {
-        code: "INVALID_RESPONSE",
-        category: "server"
-      });
-    }
-    return body.fields;
-  }
-  // ------------------------------------------------------------------
-  // Compositions used by special ops (node-parity flows)
-  // ------------------------------------------------------------------
-  /**
-   * Bounded read against another entity's global `query` endpoint (special-op
-   * compositions only; the primary surface stays the resource's own ops).
-   */
-  async queryEntity(entityPath, conditions, opts = {}) {
-    const body = { filter: buildFilter(conditions).filter };
-    if (opts.maxRecords !== void 0) body.MaxRecords = clampPageSize(opts.maxRecords);
-    if (opts.includeFields !== void 0) body.IncludeFields = opts.includeFields;
-    const res = await this.http.request({
-      method: "POST",
-      idempotent: true,
-      path: entityPath,
-      body,
-      operation: `${this.config.key}.cross-query`
-    });
-    return unwrapItems(res, `${this.config.key}.cross-query`).items;
-  }
-  async createIfNotExists(dataOrParentId, dataOrOpts, opts = {}) {
-    const isObject = (v) => isRecord(v) && !Array.isArray(v);
-    const scoped = this.config.parentScopedPath !== void 0;
-    let parentId;
-    let data;
-    let cinOpts;
-    if (scoped) {
-      const dataIsOptsBag = isObject(dataOrOpts) && ("dedupFields" in dataOrOpts || "dryRun" in dataOrOpts);
-      if (!isIdentifierCandidate(dataOrParentId) || !isObject(dataOrOpts) || dataIsOptsBag) {
-        throw new AutotaskConfigError(
-          `createIfNotExists for parent-scoped resource ${this.config.key} requires (parentId, data[, opts]) \u2014 the global collection has no create; a missing parentId would be a wrong-path request`
-        );
-      }
-      parentId = parseIdentifier(dataOrParentId, "parentId");
-      data = dataOrOpts;
-      cinOpts = opts;
-    } else {
-      if (!isObject(dataOrParentId)) {
-        throw new AutotaskConfigError(
-          `createIfNotExists for top-level resource ${this.config.key} takes (data[, opts]) \u2014 got a non-record first argument`
-        );
-      }
-      data = dataOrParentId;
-      cinOpts = isObject(dataOrOpts) ? dataOrOpts : {};
-    }
-    const record = isRecord(data) ? data : {};
-    const dedupFields = (cinOpts.dedupFields ?? []).filter((field) => field in record);
-    let existing;
-    let existingId;
-    if (dedupFields.length > 0) {
-      const conditions = dedupFields.map((field) => ({
-        field,
-        op: "eq",
-        value: record[field]
-      }));
-      if (parentId !== void 0 && this.config.parentField !== void 0) {
-        conditions.unshift({ field: this.config.parentField, op: "eq", value: parentId });
-      }
-      const matches = await this.queryEntity(`${this.resourcePath}/query`, conditions, { maxRecords: 10 });
-      const first = matches[0];
-      if (first !== void 0) {
-        const firstId = first.id;
-        if (typeof firstId === "number") {
-          existing = first;
-          existingId = firstId;
-        }
-      }
-    }
-    if (cinOpts.dryRun === true) {
-      const checks = [
-        { name: "input-validation", ok: isRecord(data) && Object.keys(data).length > 0 }
-      ];
-      if (dedupFields.length > 0) {
-        checks.push({ name: "duplicate-detection", ok: existingId === void 0 });
-      }
-      const warnings = existingId !== void 0 ? [`duplicate match on ${dedupFields.join(", ")} (id ${existingId}); the create would be skipped`] : [];
-      return buildDryRunResult({
-        operation: `${this.config.key}.createIfNotExists`,
-        method: "POST",
-        path: parentId !== void 0 ? this.scopedCollectionPath(parentId) : this.resourcePath,
-        ids: existingId !== void 0 ? [existingId] : [],
-        checks,
-        warnings,
-        impact: { affected: 1, scope: "single-record", reversible: true },
-        data
-      }, { redactPersonalData: this.http.redactPersonalData });
-    }
-    if (existing !== void 0 && existingId !== void 0) {
-      return { id: existingId, created: false, existing };
-    }
-    const op = parentId !== void 0 ? await this.createScopedRaw(parentId, data) : await this.createGlobal(data);
-    return { id: op.id, created: true };
-  }
-  // ------------------------------------------------------------------
-  // Dry-run scaffolding + stale-object guard (mutation safety, section 19.3)
-  // ------------------------------------------------------------------
-  /**
-   * Stale-object guard (section 19.3): compare the plan's `staleCheck` field
-   * (vendor `lastModifiedDate`) against the caller-observed value. Mismatch
-   * throws `STALE_OBJECT`. Returns true when a comparison was actually made
-   * (the resource model carries the field AND the vendor answered it AND the
-   * caller supplied an expected value); false when the check is unavailable.
-   */
-  staleObjectCheck(current, opts, operation) {
-    const field = this.config.staleField;
-    const expected = opts.lastModifiedDate;
-    if (field === void 0 || expected === void 0) return false;
-    const actual = current[field];
-    if (typeof actual !== "string") return false;
-    if (actual !== expected) {
-      throw new StaleObjectError(
-        `stale object: ${this.config.key} ${field} changed since the caller read it (expected ${expected}, current ${actual})`,
-        {
-          code: "STALE_OBJECT",
-          operation,
-          suggestedAction: "Re-read the record and retry with the fresh lastModifiedDate."
-        }
-      );
-    }
-    return true;
-  }
-  /**
-   * Stale-object guard for a REAL mutation: the caller supplied an expected
-   * `lastModifiedDate` and the model carries the field → fetch the current
-   * record and compare before the mutating request (mismatch throws
-   * STALE_OBJECT; a vanished record propagates the vendor's NotFoundError).
-   */
-  async guardStaleBeforeMutation(id, opts, operation, parentId) {
-    if (opts.lastModifiedDate === void 0 || this.config.staleField === void 0) return;
-    let current;
-    try {
-      current = parentId === void 0 ? await this.getGlobal(id, true) : this.config.attachmentGet ? await this.getScopedModel(parentId, id, true) : await this.getScopedRaw(parentId, id, true);
-    } catch (err) {
-      if (err instanceof NotFoundError) attachUpdateTargetMissReason(err, this.config.key);
-      throw err;
-    }
-    this.staleObjectCheck(current, opts, operation);
-  }
-  /**
-   * `create` dry-run: input validation + parent verification (scoped
-   * resources) + the pinned envelope. NO request is issued (scoped parent
-   * verification is a read). Duplicate detection has no reliable lookup for
-   * a plain create (that is `createIfNotExists`), so it is not claimed.
-   */
-  async runCreateDryRun(data, parentId) {
-    const checks = [];
-    const warnings = [];
-    checks.push({ name: "input-validation", ok: isRecord(data) && Object.keys(data).length > 0 });
-    const deleteBoundaryNote = DELETE_BOUNDARY_NOTES[this.config.key];
-    if (deleteBoundaryNote !== void 0) {
-      checks.push({ name: "delete-boundary", ok: true });
-      warnings.push(deleteBoundaryNote);
-    }
-    let path = this.resourcePath;
-    if (parentId !== void 0) {
-      path = this.scopedCollectionPath(parentId);
-      const parentPath = this.config.parentPath;
-      if (parentPath === void 0) {
-        throw new AutotaskConfigError(
-          `dry-run: ${this.config.key} is parent-scoped but has no parentPath configured`
-        );
-      }
-      const parent = await this.contextFetch(parentPath, parentId);
-      checks.push({ name: "parent-exists", ok: parent !== null });
-      if (parent === null) {
-        warnings.push(`parent ${parentId} not found; the vendor would reject the create`);
-      }
-    }
-    return buildDryRunResult({
-      operation: `${this.config.key}.create`,
-      method: "POST",
-      path,
-      ids: [],
-      checks,
-      impact: { affected: 1, scope: "single-record", reversible: true },
-      warnings,
-      data
-    }, { redactPersonalData: this.http.redactPersonalData });
-  }
-  /**
-   * `update` dry-run: input validation + current-record fetch (a missing
-   * record carries `warnings` and no `diff` — pinned), the stale-object
-   * check (mismatch throws STALE_OBJECT) and the best-effort `diff`. NO
-   * mutating request is issued.
-   */
-  async runUpdateDryRun(id, data, opts = {}, parentId) {
-    const operation = `${this.config.key}.update`;
-    const checks = [];
-    const warnings = [];
-    checks.push({ name: "input-validation", ok: isRecord(data) && Object.keys(data).length > 0 });
-    const scopedUpdate = parentId !== void 0 && this.config.parentScopedPath !== void 0;
-    const collectionUpdate = scopedUpdate || this.config.collectionUpdate === true;
-    const path = scopedUpdate ? this.scopedCollectionPath(parentId) : collectionUpdate ? this.resourcePath : `${this.resourcePath}/${id}`;
-    const method = scopedUpdate ? "PATCH" : "PUT";
-    let current = null;
-    try {
-      current = parentId === void 0 ? await this.getGlobal(id, true) : this.config.attachmentGet ? await this.getScopedModel(parentId, id, true) : await this.getScopedRaw(parentId, id, true);
-    } catch (err) {
-      if (err instanceof NotFoundError) {
-        const updateReason = EMPTY_REASON_STAMPS[this.config.key]?.update;
-        checks.push({
-          name: "current-record-exists",
-          ok: false,
-          ...updateReason !== void 0 ? { note: updateReason.note } : {}
-        });
-        warnings.push(`current record ${id} not fetchable; no diff`);
-        return buildDryRunResult({
-          operation,
-          method,
-          path,
-          ids: [id],
-          checks,
-          impact: { affected: 1, scope: "single-record", reversible: true },
-          warnings,
-          data,
-          ...updateReason !== void 0 ? { emptyReason: updateReason } : {}
-        }, { redactPersonalData: this.http.redactPersonalData });
-      }
-      throw err;
-    }
-    checks.push({ name: "current-record-exists", ok: true });
-    if (this.staleObjectCheck(current, opts, operation)) {
-      checks.push({ name: "stale-check", ok: true });
-    }
-    let envelopeData = data;
-    if (parentId === void 0 && this.config.collectionUpdate === true && opts.raw !== true) {
-      envelopeData = mergePartialBody(
-        current,
-        this.normalizeMutationBody(data)
-      );
-    }
-    return buildDryRunResult({
-      operation,
-      method,
-      path,
-      ids: [id],
-      checks,
-      diff: computeFieldDiff(current, data),
-      impact: { affected: 1, scope: "single-record", reversible: true },
-      warnings,
-      data: envelopeData
-    }, { redactPersonalData: this.http.redactPersonalData });
-  }
-  /**
-   * `delete` dry-run: current-record verification + the stale-object check +
-   * the pinned envelope (no diff — a delete has no before/after fields). NO
-   * mutating request is issued.
-   */
-  async runDeleteDryRun(id, opts = {}, parentId) {
-    const operation = `${this.config.key}.delete`;
-    const checks = [];
-    const warnings = [];
-    const path = parentId === void 0 ? `${this.resourcePath}/${id}` : this.scopedItemPath(parentId, id);
-    let current = null;
-    try {
-      current = parentId === void 0 ? await this.getGlobal(id, true) : this.config.attachmentGet ? await this.getScopedModel(parentId, id, true) : await this.getScopedRaw(parentId, id, true);
-    } catch (err) {
-      if (err instanceof NotFoundError) {
-        checks.push({ name: "current-record-exists", ok: false });
-        warnings.push(`record ${id} not fetchable; the vendor would reject the delete`);
-        return buildDryRunResult({
-          operation,
-          method: "DELETE",
-          path,
-          ids: [id],
-          checks,
-          impact: { affected: 1, scope: "single-record", reversible: false },
-          warnings
-        }, { redactPersonalData: this.http.redactPersonalData });
-      }
-      throw err;
-    }
-    checks.push({ name: "current-record-exists", ok: true });
-    if (this.staleObjectCheck(current, opts, operation)) {
-      checks.push({ name: "stale-check", ok: true });
-    }
-    return buildDryRunResult({
-      operation,
-      method: "DELETE",
-      path,
-      ids: [id],
-      checks,
-      impact: { affected: 1, scope: "single-record", reversible: false },
-      warnings
-    }, { redactPersonalData: this.http.redactPersonalData });
-  }
-  /**
-   * Attachment `download`: `GET .../{parentId}/<Child>/{id}/data` → Buffer
-   * (node-proven `/data` path, quirk #9; the metadata GET is `get`).
-   */
-  async downloadScoped(parentId, id) {
-    const res = await this.http.request({
-      method: "GET",
-      path: `${this.scopedItemPath(parentId, id)}/data`,
-      operation: `${this.config.key}.download`
-    });
-    return decodeFileData(res);
-  }
-  // ------------------------------------------------------------------
-  // Cross-entity reads + resolution helpers (helper-floor ops, G4)
-  // ------------------------------------------------------------------
-  /** Raw single-record read on ANY entity path: `GET <path>/{id}` → `{ item }`
-   *  unwrapped (`item: null` → NotFoundError). Used by `resolve` (id branch)
-   *  and `getContext` (the cross-entity parts); the operation tag is scoped to
-   *  the resource + call site so errors stay attributable. `fresh` skips the
-   *  cache lookup (the read still refreshes the entry for the other callers):
-   *  the composite ROOT of a hot resource (issue #36) must see the live
-   *  record, never a snapshot. */
-  async fetchRecordRaw(entityPath, id, fresh = false) {
-    const numeric = parseIdentifier(id, "id");
-    const resource = RESOURCE_KEY_BY_PATH[entityPath];
-    const res = await this.cachedGet(`${entityPath}/${numeric}`, `${this.config.key}.fetchRecord`, fresh, resource);
-    if (this.config.attachmentGet) {
-      return this.unwrapModelLike(res, numeric);
-    }
-    return unwrapItem(res, numeric, `${this.config.key}.fetchRecord`);
-  }
-  /**
-   * `getContext` part fetch: a single-record read that degrades to `null`
-   *  when the reference id is absent (or the vendor answers not-found).
-   *  Other errors propagate — a part that fails on a real fault is not a
-   *  "missing reference".
-   *
-   *  Issue #36 (negative caching, the pinned hazard): the vendor's true
-   *  not-found (the HTTP 404 or the 200 `item: null` signal — both surface
-   *  as `NotFoundError`) is stored as an ABSENT marker in the SAME ReadCache
-   *  under a namespaced key the positive get path never constructs, so a
-   *  repeat composite call serves 'absent' with zero wire for that part.
-   *  The marker expires on the READ entity's TTL (the #32 per-resource
-   *  table / `perResourceTtlMs` override, via `set`'s resource key) and is
-   *  cleared by any real write through the client (the ReadCache clear).
-   *  A transient fault (5xx, shape drift, network) is NEVER stored as an
-   *  ABSENT marker — it propagates and the next call re-wires (no
-   *  poisoning; a malformed 200 body may still land under the POSITIVE
-   *  key — pre-existing ReadCache behaviour, out of this mechanism's
-   *  scope). The marker is consulted BEFORE the positive lookup, but a
-   *  POSITIVE entry that exists alongside a live marker means a newer
-   *  positive outcome (this client read/created the record after the
-   *  not-found) — the marker is dropped and the positive entry serves
-   *  (the newest outcome wins in both directions). A record created
-   *  ELSEWHERE may serve 'absent' until the marker TTL expires (or a write
-   *  through this client lands) — the opt-in staleness contract, same
-   *  trade as the positive entries.
-   */
-  async contextFetch(entityPath, referenceId) {
-    if (typeof referenceId !== "number" || !Number.isInteger(referenceId) || referenceId < 0) {
-      return null;
-    }
-    const cache = this.http.readCache;
-    const absentKey = contextAbsentKey(`${entityPath}/${referenceId}`);
-    if (cache !== void 0 && cache.get(absentKey) !== void 0) {
-      if (cache.get(`${entityPath}/${referenceId}`) !== void 0) {
-        cache.delete(absentKey);
-      } else {
-        return null;
-      }
-    }
-    try {
-      return await this.fetchRecordRaw(entityPath, referenceId);
-    } catch (err) {
-      if (err instanceof NotFoundError) {
-        cache?.set(absentKey, CONTEXT_ABSENT_MARKER, RESOURCE_KEY_BY_PATH[entityPath]);
-        return null;
-      }
-      throw err;
-    }
-  }
-  /**
-   * `resolve` — the helper-floor resolution (section 19.2), with cost and
-   * truncation tracking (`resolveDetailed`); the plain `resolveBase` is its
-   * value projection. Pinned semantics:
-   * - numeric id (number or all-digit string) → single record read; a miss
-   *   throws NotFoundError (the vendor's own not-found, cost `direct`);
-   * - bare value → SERVER FILTER FIRST: exact (`eq`) on the `searchFields`
-   *   (OR-grouped when the entity covers several), bounded to 2 records —
-   *   1 → the record (cost `server-filter`), ≥2 → RESOLUTION_AMBIGUOUS with
-   *   the candidate ids;
-   * - zero items + zero `requestCount` is a COMPLETE non-match (the vendor
-   *   filters every model field; the server answer is authoritative) → null;
-   * - zero items + positive `requestCount` is an INCONCLUSIVE server answer
-   *   (an index gap the server could not reconcile) → the bounded CLIENT
-   *   SCAN fallback: an unfiltered walk, exact match on the `searchFields`,
-   *   capped by the client caps (`maxScanRecords` / `maxScanPages`). A hit
-   *   is cost `client-scan`; a completed scan with no match → null; a
-   *   cap-tripped scan THROWS RESOLUTION_TRUNCATED — never a silent null.
-   * - bare value on an id-only resource → AutotaskConfigError (CONFIG_ERROR).
-   */
-  async resolveDetailed(identifier) {
-    let numeric = null;
-    if (isIdentifierCandidate(identifier)) {
-      numeric = parseIdentifier(identifier, "id");
-    }
-    if (numeric !== null) {
-      const record = await this.fetchRecordRaw(this.resourcePath, numeric);
-      return { value: record, resolutionCost: "direct", scanned: 0, scanTruncated: false };
-    }
-    if (typeof identifier !== "string" || identifier.trim() === "") {
-      throw new AutotaskConfigError("resolve: identifier must be a numeric id or a non-empty value");
-    }
-    const value = identifier.trim();
-    const fields = this.config.searchFields ?? [];
-    if (fields.length === 0) {
-      throw new AutotaskConfigError(
-        `resolve: ${this.config.key} has no primary text field (ids only)`
-      );
-    }
-    const leaf = fields.map((field) => ({ field, op: "eq", value }));
-    const root = leaf.length === 1 ? leaf[0] : { op: "or", items: leaf };
-    const { items, requestCount } = await this.queryPage1([root], 2);
-    if (items.length === 1) {
-      return { value: items[0], resolutionCost: "server-filter", scanned: 0, scanTruncated: false };
-    }
-    if (items.length >= 2) {
-      const ids = items.map((m) => m.id).filter((id) => typeof id === "number");
-      throw new ResolutionError(
-        `resolve: "${value}" is ambiguous on ${this.config.key} (matched ${items.length} records)`,
-        { code: "RESOLUTION_AMBIGUOUS", resourceIds: ids }
-      );
-    }
-    if (requestCount === 0) {
-      return { value: null, resolutionCost: "server-filter", scanned: 0, scanTruncated: false, triedFields: fields };
-    }
-    const scan = await this.scanForExactMatch(value, fields);
-    if (scan.found !== null) {
-      return {
-        value: scan.found,
-        resolutionCost: "client-scan",
-        scanned: scan.scanned,
-        scanTruncated: false
-      };
-    }
-    if (scan.truncated) {
-      throw new ResolutionError(
-        `resolve: "${value}" is unverified on ${this.config.key} \u2014 the bounded client scan read ${scan.scanned} records (cap) without completing; a complete non-match cannot be proven`,
-        {
-          code: "RESOLUTION_TRUNCATED",
-          suggestedAction: "Retry with a more specific identifier, or narrow the search to fewer records."
-        }
-      );
-    }
-    return { value: null, resolutionCost: "client-scan", scanned: scan.scanned, scanTruncated: false, triedFields: fields };
-  }
-  /** The plain value projection of `resolveDetailed` (the `resolve` floor). */
-  async resolveBase(identifier) {
-    return (await this.resolveDetailed(identifier)).value;
-  }
-  /** One page of the resource's own `/query` with items + total match count. */
-  async queryPage1(conditions, maxRecords) {
-    const body = {
-      filter: buildFilter(conditions).filter,
-      MaxRecords: maxRecords
-    };
-    const res = await this.http.request({
-      method: "POST",
-      idempotent: true,
-      path: `${this.resourcePath}/query`,
-      body,
-      operation: `${this.config.key}.resolve`
-    });
-    const { items, pageDetails } = unwrapItems(res, `${this.config.key}.resolve`);
-    return { items, requestCount: pageDetails.requestCount };
-  }
-  /**
-   * The bounded client-scan fallback (section 19.2): an unfiltered walk of
-   * the resource's own query endpoint, exact match on `fields`, bounded by
-   * BOTH client caps (records AND pages). `truncated` is true when the caps
-   * were hit before the walk completed (a complete non-match is unproven).
-   */
-  async scanForExactMatch(value, fields) {
-    const caps = this.resolutionCaps;
-    const pageSize = Math.max(1, Math.floor(caps.maxScanRecords / caps.maxScanPages));
-    const state = { cursor: null };
-    let scanned = 0;
-    let pages = 0;
-    let found = null;
-    let exhausted = false;
-    for (; ; ) {
-      const page = await this.fetchPage({ maxRecords: pageSize }, pages + 1, pageSize, state);
-      pages += 1;
-      for (const item of page.items) {
-        scanned += 1;
-        const rec = item;
-        if (fields.some((field) => rec[field] === value)) {
-          found = item;
-          break;
-        }
-      }
-      if (found !== null) break;
-      if (!page.hasMore) {
-        exhausted = true;
-        break;
-      }
-      if (pages >= caps.maxScanPages || scanned >= caps.maxScanRecords) break;
-    }
-    return { found, scanned, truncated: found === null && !exhausted };
-  }
-  /**
-   * `findBy<field>` helpers: exact (`eq`) filter on one vendor field, bounded
-   *  to 2 records — 0 → null, 1 → the record, ≥2 → ResolutionError with the
-   *  candidate ids.
-   */
-  async findByField(field, value) {
-    if (value.trim() === "") throw new AutotaskConfigError(`findBy${field}: empty value`);
-    const matches = await this.queryEntity(
-      `${this.resourcePath}/query`,
-      [{ field, op: "eq", value: value.trim() }],
-      { maxRecords: 2 }
-    );
-    if (matches.length === 0) return null;
-    if (matches.length > 1) {
-      const ids = matches.map((m) => m.id).filter((id) => typeof id === "number");
-      throw new ResolutionError(
-        `findBy${field}: "${value}" is ambiguous on ${this.config.key} (matched ${matches.length} records)`,
-        { code: "RESOLUTION_AMBIGUOUS", resourceIds: ids }
-      );
-    }
-    return matches[0];
-  }
-  /**
-   * `search` — the bounded contains surface (no vendor free-text search):
-   * `contains` on every `searchFields` field (OR-grouped), `MaxRecords` =
-   * `limit` (default 25, clamped to 1..500). Empty query → AutotaskConfigError.
-   */
-  async searchBase(query, opts = {}) {
-    const text = query.trim();
-    if (text === "") throw new AutotaskConfigError("search: empty query");
-    const fields = this.config.searchFields ?? [];
-    if (fields.length === 0) {
-      throw new AutotaskConfigError(`search: ${this.config.key} has no searchable field`);
-    }
-    const limit = opts.limit === void 0 ? 25 : clampPageSize(opts.limit);
-    const leaf = fields.map((field) => ({ field, op: "contains", value: text }));
-    const root = leaf.length === 1 ? leaf[0] : { op: "or", items: leaf };
-    return this.queryEntity(`${this.resourcePath}/query`, [root], { maxRecords: limit });
-  }
-};
+  TICKET_LABEL_FIELDS,
+  UNTRUSTED_FIELDS_BY_RESOURCE,
+  addLabelSibling,
+  addNameSibling,
+  blindStampFor,
+  buildDryRunResult,
+  buildFilter,
+  clampPageSize,
+  createNamePlan,
+  cursorToPath,
+  decodeFileData,
+  formatVendorDetail,
+  isAutotaskError,
+  mergePartialBody,
+  parseIdentifier,
+  parseVendorErrors,
+  resolveCompositeNames,
+  resolveFieldsPreset,
+  truncateNoteChars,
+  unwrapItem,
+  unwrapItems,
+  unwrapOperation
+} from "./chunk-HWC2WPX2.js";
+import {
+  CAPABILITIES
+} from "./chunk-6KFP5HV3.js";
 
 // src/resources/appointments.ts
 var AppointmentsResource = class extends BaseResource {
@@ -2891,6 +164,324 @@ var BillingCodesResource = class extends BaseResource {
   }
 };
 
+// src/resources/special/dateWindow.ts
+var DAY_MS = 864e5;
+var DEFAULT_LIMIT = 25;
+var MAX_LIMIT = 500;
+function clampWindowLimit(limit) {
+  const n = limit === void 0 ? DEFAULT_LIMIT : Math.trunc(limit);
+  if (!Number.isInteger(n) || n < 1) {
+    throw new AutotaskConfigError(`limit must be an integer >= 1 (got ${String(limit)})`);
+  }
+  return Math.min(n, MAX_LIMIT);
+}
+var iso = (ms) => new Date(ms).toISOString().slice(0, 19) + "Z";
+var WEEKDAYS = { Sun: 0, Mon: 1, Tue: 2, Wed: 3, Thu: 4, Fri: 5, Sat: 6 };
+function wallParts(tz, ms) {
+  const parts = new Intl.DateTimeFormat("en-US", {
+    timeZone: tz,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit",
+    hour: "2-digit",
+    minute: "2-digit",
+    second: "2-digit",
+    hour12: false,
+    weekday: "short"
+  }).formatToParts(new Date(ms));
+  const w = {};
+  let weekday = -1;
+  for (const p of parts) {
+    switch (p.type) {
+      case "year":
+        w.y = Number(p.value);
+        break;
+      case "month":
+        w.m = Number(p.value);
+        break;
+      case "day":
+        w.d = Number(p.value);
+        break;
+      case "hour":
+        w.h = Number(p.value) % 24;
+        break;
+      case "minute":
+        w.mi = Number(p.value);
+        break;
+      case "second":
+        w.s = Number(p.value);
+        break;
+      case "weekday":
+        weekday = WEEKDAYS[p.value] ?? -1;
+        break;
+    }
+  }
+  if (weekday < 0 || [w.y, w.m, w.d, w.h, w.mi, w.s].some((v) => v === void 0 || Number.isNaN(v))) {
+    throw new AutotaskConfigError(`dateWindow: could not read the wall-clock parts for timezone "${tz}" (the Intl format returned an incomplete or unmapped part)`);
+  }
+  return { y: w.y, m: w.m, d: w.d, h: w.h, mi: w.mi, s: w.s, weekday };
+}
+function tzOffsetMs(tz, ms) {
+  const p = wallParts(tz, ms);
+  return Date.UTC(p.y, p.m - 1, p.d, p.h, p.mi, p.s) - ms;
+}
+function localDayStartMs(y, m, d, tz) {
+  if (tz === void 0) return Date.UTC(y, m - 1, d);
+  const candidate = Date.UTC(y, m - 1, d);
+  const offset = tzOffsetMs(tz, candidate);
+  let start = candidate - offset;
+  if (tzOffsetMs(tz, start) !== offset) {
+    start = candidate - tzOffsetMs(tz, start);
+  }
+  const p = wallParts(tz, start);
+  if (p.d !== d) start += 864e5 - ((p.h * 60 + p.mi) * 60 + p.s) * 1e3;
+  return start;
+}
+function localDayEndMs(y, m, d, tz) {
+  if (tz === void 0) return Date.UTC(y, m - 1, d) + DAY_MS - 1;
+  const next = new Date(Date.UTC(y, m - 1, d + 1));
+  return localDayStartMs(next.getUTCFullYear(), next.getUTCMonth() + 1, next.getUTCDate(), tz) - 1;
+}
+function validateZone(tz, opName = "dateWindow") {
+  if (typeof tz !== "string" || tz.length === 0) {
+    throw new AutotaskConfigError(
+      `${opName}: tz must be a non-empty IANA timezone string (got ${JSON.stringify(tz)}; e.g. 'Australia/Sydney' \u2014 omitted tz = UTC)`,
+      { operation: opName }
+    );
+  }
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone: tz });
+  } catch {
+    throw new AutotaskConfigError(
+      `${opName}: tz is not a valid IANA timezone (${JSON.stringify(tz)}; e.g. 'Australia/Sydney' \u2014 omitted tz = UTC)`,
+      { operation: opName }
+    );
+  }
+  return tz;
+}
+var utcDayStart = (ms) => {
+  const d = new Date(ms);
+  return Date.UTC(d.getUTCFullYear(), d.getUTCMonth(), d.getUTCDate());
+};
+var utcDayEnd = (ms) => utcDayStart(ms) + DAY_MS - 1;
+function utcDateWindowBounds(kind, now) {
+  const t = now.getTime();
+  let from;
+  let to;
+  switch (kind) {
+    case "today":
+      from = utcDayStart(t);
+      to = utcDayEnd(t);
+      break;
+    case "yesterday":
+      from = utcDayStart(t - DAY_MS);
+      to = utcDayEnd(t - DAY_MS);
+      break;
+    case "last24h":
+      from = t - DAY_MS;
+      to = t;
+      break;
+    case "last7":
+    case "last14":
+    case "last30":
+    case "last90": {
+      const days = Number(kind.slice(4));
+      from = utcDayStart(t - days * DAY_MS);
+      to = utcDayEnd(t);
+      break;
+    }
+    case "lastFullWeek":
+    case "lastFullFortnight": {
+      const d = new Date(t);
+      const daysSinceMonday = (d.getUTCDay() + 6) % 7;
+      const thisMonday = utcDayStart(t) - daysSinceMonday * DAY_MS;
+      const daysBack = kind === "lastFullWeek" ? 7 : 14;
+      from = thisMonday - daysBack * DAY_MS;
+      to = thisMonday - 1;
+      break;
+    }
+    case "lastFullMonth": {
+      const d = new Date(t);
+      const y = d.getUTCFullYear();
+      const m = d.getUTCMonth() - 1;
+      from = Date.UTC(y, m, 1);
+      to = Date.UTC(y, m + 1, 1) - 1;
+      break;
+    }
+    case "lastFullQuarter": {
+      const d = new Date(t);
+      let q = Math.floor(d.getUTCMonth() / 3) - 1;
+      let y = d.getUTCFullYear();
+      if (q < 0) {
+        q = 3;
+        y -= 1;
+      }
+      const first = q * 3;
+      from = Date.UTC(y, first, 1);
+      to = Date.UTC(y, first + 3, 1) - 1;
+      break;
+    }
+  }
+  return { from: iso(from), to: iso(to) };
+}
+function dateWindowBounds(kind, now, tz) {
+  if (tz === void 0) return utcDateWindowBounds(kind, now);
+  const zone = validateZone(tz);
+  const t = now.getTime();
+  if (kind === "last24h") {
+    return { from: iso(t - DAY_MS), to: iso(t) };
+  }
+  const { y, m, d, weekday } = wallParts(zone, t);
+  const shifted = (dy) => new Date(Date.UTC(y, m - 1, d + dy));
+  const dayStart = (dy) => {
+    const dt = shifted(dy);
+    return localDayStartMs(dt.getUTCFullYear(), dt.getUTCMonth() + 1, dt.getUTCDate(), zone);
+  };
+  const dayStartAt = (instant) => {
+    const p = wallParts(zone, instant);
+    return localDayStartMs(p.y, p.m, p.d, zone);
+  };
+  const dayEndAt = (instant) => {
+    const p = wallParts(zone, instant);
+    return localDayEndMs(p.y, p.m, p.d, zone);
+  };
+  let from;
+  let to;
+  switch (kind) {
+    case "today":
+      from = dayStartAt(t);
+      to = dayEndAt(t);
+      break;
+    case "yesterday":
+      from = dayStart(-1);
+      to = dayStart(0) - 1;
+      break;
+    case "last7":
+    case "last14":
+    case "last30":
+    case "last90": {
+      const days = Number(kind.slice(4));
+      from = dayStart(-days);
+      to = dayEndAt(t);
+      break;
+    }
+    case "lastFullWeek":
+    case "lastFullFortnight": {
+      const daysSinceMonday = (weekday + 6) % 7;
+      const daysBack = kind === "lastFullWeek" ? 7 : 14;
+      from = dayStart(-(daysSinceMonday + daysBack));
+      to = dayStart(-daysSinceMonday) - 1;
+      break;
+    }
+    case "lastFullMonth": {
+      const prev = new Date(Date.UTC(y, m - 2, 1));
+      from = localDayStartMs(prev.getUTCFullYear(), prev.getUTCMonth() + 1, 1, zone);
+      to = localDayStartMs(y, m, 1, zone) - 1;
+      break;
+    }
+    case "lastFullQuarter": {
+      const q = Math.floor((m - 1) / 3);
+      const prevQ = q - 1 < 0 ? 3 : q - 1;
+      const prevY = q - 1 < 0 ? y - 1 : y;
+      from = localDayStartMs(prevY, prevQ * 3 + 1, 1, zone);
+      to = localDayStartMs(y, q * 3 + 1, 1, zone) - 1;
+      break;
+    }
+  }
+  return { from: iso(from), to: iso(to) };
+}
+async function dateWindowQuery(http, path, field, kind, limit, operation, now, tz) {
+  const zone = tz === void 0 ? void 0 : validateZone(tz, operation);
+  const { from, to } = dateWindowBounds(kind, now, zone);
+  const filter = [
+    { field, op: "gte", value: from },
+    { field, op: "lte", value: to }
+  ];
+  const res = await http.request({
+    method: "POST",
+    idempotent: true,
+    path,
+    body: { MaxRecords: limit, filter },
+    operation
+  });
+  return unwrapItems(res).items;
+}
+var isoUtc = (ms) => new Date(ms).toISOString().slice(0, 19) + "Z";
+function customRangeDay(value, label, zone, opName) {
+  const m = /^(\d{4})-(\d{2})-(\d{2})$/.exec(value.trim());
+  if (!m) {
+    throw new AutotaskConfigError(
+      zone === void 0 ? `${opName}: ${label} must be a UTC 'YYYY-MM-DD' date (got ${JSON.stringify(value)})` : `${opName}: ${label} must be a 'YYYY-MM-DD' local calendar day in ${zone} (got ${JSON.stringify(value)})`,
+      { operation: opName }
+    );
+  }
+  const y = Number(m[1]);
+  const mo = Number(m[2]);
+  const d = Number(m[3]);
+  const probe = new Date(Date.UTC(y, mo - 1, d));
+  const real = probe.getUTCFullYear() === y && probe.getUTCMonth() === mo - 1 && probe.getUTCDate() === d;
+  const ms = !real ? NaN : zone === void 0 ? Date.UTC(y, mo - 1, d) : localDayStartMs(y, mo, d, zone);
+  if (!Number.isFinite(ms)) {
+    throw new AutotaskConfigError(
+      zone === void 0 ? `${opName}: ${label} is not a valid UTC date (${JSON.stringify(value)})` : `${opName}: ${label} is not a valid calendar day in ${zone} (${JSON.stringify(value)})`,
+      { operation: opName }
+    );
+  }
+  return { y, mo, d, ms };
+}
+async function customRangeQuery(http, path, field, from, to, limit, operation, zone) {
+  const fromB = customRangeDay(from, "from", zone, operation);
+  const toB = customRangeDay(to, "to", zone, operation);
+  if (fromB.ms > toB.ms) {
+    throw new AutotaskConfigError(
+      `${operation}: from (${isoUtc(fromB.ms)}) must not be after to (${isoUtc(toB.ms)})`,
+      { operation }
+    );
+  }
+  const toEndMs = zone === void 0 ? toB.ms + DAY_MS - 1 : localDayEndMs(toB.y, toB.mo, toB.d, zone);
+  const filter = [
+    { field, op: "gte", value: isoUtc(fromB.ms) },
+    { field, op: "lte", value: isoUtc(toEndMs) }
+  ];
+  const res = await http.request({
+    method: "POST",
+    idempotent: true,
+    path,
+    body: { MaxRecords: limit, filter },
+    operation
+  });
+  return unwrapItems(res).items;
+}
+
+// src/resources/special/billing_items.ts
+async function windowQuery(_resource, kind, http, opts) {
+  const now = opts?.now ?? /* @__PURE__ */ new Date();
+  const tz = opts?.tz === void 0 ? void 0 : validateZone(opts.tz, `billing_items.${kind}`);
+  return dateWindowQuery(
+    http,
+    "/V1.0/BillingItems/query",
+    "itemDate",
+    kind,
+    clampWindowLimit(opts?.limit),
+    `billing_items.${kind}`,
+    now,
+    tz
+  );
+}
+async function customRange(_resource, from, to, http, opts) {
+  const zone = opts?.tz === void 0 ? void 0 : validateZone(opts.tz, "billing_items.customRange");
+  return customRangeQuery(
+    http,
+    "/V1.0/BillingItems/query",
+    "itemDate",
+    from,
+    to,
+    clampWindowLimit(opts?.limit),
+    "billing_items.customRange",
+    zone
+  );
+}
+
 // src/resources/billing_items.ts
 var BillingItemsResource = class extends BaseResource {
   constructor(http, pageSize) {
@@ -2943,6 +534,54 @@ var BillingItemsResource = class extends BaseResource {
     void opts;
     return this.resolveBase(identifier);
   }
+  /** Node-parity special op (hand-written in src/resources/special/billing_items.ts). */
+  customRange(from, to, opts) {
+    return customRange(this, from, to, this.http, opts);
+  }
+  /** Node-parity special op (hand-written in src/resources/special/billing_items.ts). */
+  last14(opts) {
+    return windowQuery(this, "last14", this.http, opts);
+  }
+  /** Node-parity special op (hand-written in src/resources/special/billing_items.ts). */
+  last24h(opts) {
+    return windowQuery(this, "last24h", this.http, opts);
+  }
+  /** Node-parity special op (hand-written in src/resources/special/billing_items.ts). */
+  last30(opts) {
+    return windowQuery(this, "last30", this.http, opts);
+  }
+  /** Node-parity special op (hand-written in src/resources/special/billing_items.ts). */
+  last7(opts) {
+    return windowQuery(this, "last7", this.http, opts);
+  }
+  /** Node-parity special op (hand-written in src/resources/special/billing_items.ts). */
+  last90(opts) {
+    return windowQuery(this, "last90", this.http, opts);
+  }
+  /** Node-parity special op (hand-written in src/resources/special/billing_items.ts). */
+  lastFullFortnight(opts) {
+    return windowQuery(this, "lastFullFortnight", this.http, opts);
+  }
+  /** Node-parity special op (hand-written in src/resources/special/billing_items.ts). */
+  lastFullMonth(opts) {
+    return windowQuery(this, "lastFullMonth", this.http, opts);
+  }
+  /** Node-parity special op (hand-written in src/resources/special/billing_items.ts). */
+  lastFullQuarter(opts) {
+    return windowQuery(this, "lastFullQuarter", this.http, opts);
+  }
+  /** Node-parity special op (hand-written in src/resources/special/billing_items.ts). */
+  lastFullWeek(opts) {
+    return windowQuery(this, "lastFullWeek", this.http, opts);
+  }
+  /** Node-parity special op (hand-written in src/resources/special/billing_items.ts). */
+  today(opts) {
+    return windowQuery(this, "today", this.http, opts);
+  }
+  /** Node-parity special op (hand-written in src/resources/special/billing_items.ts). */
+  yesterday(opts) {
+    return windowQuery(this, "yesterday", this.http, opts);
+  }
 };
 
 // src/resources/change_request_links.ts
@@ -3184,12 +823,12 @@ var ClassificationIconsResource = class extends BaseResource {
 };
 
 // src/resources/special/companies.ts
-var DEFAULT_LIMIT = 25;
-var MAX_LIMIT = 500;
+var DEFAULT_LIMIT2 = 25;
+var MAX_LIMIT2 = 500;
 function clampLimit(limit) {
-  const n = limit === void 0 ? DEFAULT_LIMIT : Math.trunc(limit);
+  const n = limit === void 0 ? DEFAULT_LIMIT2 : Math.trunc(limit);
   if (!Number.isInteger(n) || n < 1) throw new AutotaskConfigError(`limit must be an integer >= 1 (got ${String(limit)})`);
-  return Math.min(n, MAX_LIMIT);
+  return Math.min(n, MAX_LIMIT2);
 }
 async function queryCompanies(http, filter, limit) {
   const res = await http.request({
@@ -3261,7 +900,85 @@ async function searchByIdentity(_resource, identity, opts = {}, http) {
     const ids = [...new Set(contacts.map((c) => c.companyID).filter((id) => typeof id === "number" && id >= 0))];
     add(await fetchCompanies(http, ids, limit));
   }
-  return [...found.values()].slice(0, limit);
+  return [...found.values()].slice(0, limit);
+}
+var COMPANIES_FAMILY_CHILD_CAP = 50;
+var COMPANIES_FAMILY_BLIND_NOTE = "the family is reported as SEEN BY THIS API USER, never as complete: childIDs (and the search hits themselves) are scoped to the caller-visible enumeration (companies.query is the plan-pinned unowned-blind surface \u2014 get is the authority)";
+var COMPANY_SEARCH_OPT_KEYS = ["limit", "includeFamily"];
+async function familyChildPage(http, parentID) {
+  const res = await http.request({
+    method: "POST",
+    idempotent: true,
+    path: "/V1.0/Companies/query",
+    body: {
+      MaxRecords: COMPANIES_FAMILY_CHILD_CAP,
+      filter: buildFilter([{ field: "parentCompanyID", op: "eq", value: parentID }]).filter
+    },
+    operation: "companies.search"
+  });
+  const { items, pageDetails } = unwrapItems(res, "companies.search");
+  return { rows: items, hasNext: pageDetails.nextPageUrl !== null };
+}
+function assertSearchWithDetailOpts(opts) {
+  if (opts === void 0) return;
+  if (typeof opts !== "object" || opts === null || Array.isArray(opts)) {
+    throw new AutotaskConfigError("companies.searchWithDetail: opts must be an object { limit?: number }", {
+      operation: "companies.searchWithDetail"
+    });
+  }
+  for (const key of Object.keys(opts)) {
+    if (key !== "limit") {
+      throw new AutotaskConfigError(
+        `companies.searchWithDetail: unknown opts key "${key}" \u2014 the bag is closed: limit (includeFamily is a companies.search option)`,
+        { operation: "companies.searchWithDetail" }
+      );
+    }
+  }
+}
+async function searchWithFamily(_resource, query, opts = {}, http) {
+  if (opts !== void 0 && (typeof opts !== "object" || opts === null || Array.isArray(opts))) {
+    throw new AutotaskConfigError("companies.search: opts must be an object { limit?: number, includeFamily?: boolean }");
+  }
+  for (const key of Object.keys(opts ?? {})) {
+    if (!COMPANY_SEARCH_OPT_KEYS.includes(key)) {
+      throw new AutotaskConfigError(
+        `companies.search: unknown opts key "${key}" \u2014 the bag is closed: ${COMPANY_SEARCH_OPT_KEYS.join(", ")}`,
+        { operation: "companies.search" }
+      );
+    }
+  }
+  if (opts.includeFamily !== void 0 && typeof opts.includeFamily !== "boolean") {
+    throw new AutotaskConfigError(`companies.search: opts.includeFamily must be a boolean (got ${String(opts.includeFamily)})`, {
+      operation: "companies.search"
+    });
+  }
+  const text = query.trim();
+  if (text === "") throw new AutotaskConfigError("search: empty query", { operation: "companies.search" });
+  const limit = opts.limit === void 0 ? 25 : clampPageSize(opts.limit);
+  const res = await http.request({
+    method: "POST",
+    idempotent: true,
+    path: "/V1.0/Companies/query",
+    body: { MaxRecords: limit, filter: buildFilter([{ field: "companyName", op: "contains", value: text }]).filter },
+    operation: "companies.search"
+  });
+  const hits = unwrapItems(res, "companies.search").items;
+  if (opts.includeFamily !== true) return hits;
+  const rows = [];
+  for (const hit of hits) {
+    const family = {
+      parentID: hit.parentCompanyID ?? null,
+      childIDs: [],
+      blindNote: COMPANIES_FAMILY_BLIND_NOTE
+    };
+    if (typeof hit.id === "number") {
+      const { rows: children, hasNext } = await familyChildPage(http, hit.id);
+      family.childIDs = children.map((c) => c.id).filter((id) => typeof id === "number");
+      if (children.length >= COMPANIES_FAMILY_CHILD_CAP && hasNext) family.childIDsTruncated = true;
+    }
+    rows.push({ ...hit, family });
+  }
+  return rows;
 }
 var OP_UPSERT_NAME = "companies.upsertByName";
 var UPSERT_NAME_MAX_DISCOVERY_MERGES = 3;
@@ -3495,7 +1212,7 @@ async function fullProfile(resource, id, opts = {}, http) {
       };
     }
   }
-  return {
+  const result = {
     company,
     locations: { items: locations, capped: locations.length >= PROFILE_PART_LIMIT },
     contacts: { items: contacts, capped: contacts.length >= contactLimit },
@@ -3511,6 +1228,384 @@ async function fullProfile(resource, id, opts = {}, http) {
       projects: "ok"
     }
   };
+  if (opts.names === true) {
+    const builder = createNamePlan(TICKET_LABEL_FIELDS);
+    const c = company;
+    builder.addResource(c["ownerResourceID"]);
+    builder.addResource(c["createdByResourceID"]);
+    for (const row of openTickets.items) {
+      const r = row;
+      builder.addResource(r["creatorResourceID"]);
+      builder.addFk("contract", r["contractID"]);
+      builder.addFk("billingCode", r["billingCodeID"]);
+      builder.addFk("role", r["assignedResourceRoleID"]);
+    }
+    for (const row of projects) {
+      const r = row;
+      builder.addResource(r["projectLeadResourceID"]);
+      builder.addResource(r["creatorResourceID"]);
+      builder.addFk("contract", r["contractID"]);
+    }
+    const names = await resolveCompositeNames(http, builder.plan(), { maxNameReads: opts.maxNameReads });
+    const companyRow = { ...company };
+    addNameSibling(companyRow, "ownerResourceID", (v) => names.resourceName(v));
+    addNameSibling(companyRow, "createdByResourceID", (v) => names.resourceName(v));
+    result.company = companyRow;
+    result.openTickets = {
+      ...openTickets,
+      items: openTickets.items.map((row) => {
+        const r = { ...row };
+        addNameSibling(r, "creatorResourceID", (v) => names.resourceName(v));
+        addNameSibling(r, "contractID", (v) => names.recordName("contract", v));
+        addNameSibling(r, "billingCodeID", (v) => names.recordName("billingCode", v));
+        addNameSibling(r, "assignedResourceRoleID", (v) => names.recordName("role", v));
+        for (const f of TICKET_LABEL_FIELDS) addLabelSibling(r, f, names);
+        return r;
+      })
+    };
+    result.projects = {
+      ...result.projects,
+      items: result.projects.items.map((row) => {
+        const r = { ...row };
+        addNameSibling(r, "projectLeadResourceID", (v) => names.resourceName(v));
+        addNameSibling(r, "creatorResourceID", (v) => names.resourceName(v));
+        addNameSibling(r, "contractID", (v) => names.recordName("contract", v));
+        return r;
+      })
+    };
+    result.names = names.section;
+  }
+  return result;
+}
+var UNBILLED_WORK_NOTE_CHARS_DEFAULT = 400;
+var UNBILLED_WORK_JOIN_SET_CAP = 300;
+var UNBILLED_WORK_OPT_KEYS = [
+  "source",
+  "includeParent",
+  "dateFrom",
+  "dateTo",
+  "invoiceId",
+  "ticketIds",
+  "includeNotes",
+  "noteChars",
+  "rollup",
+  "limit"
+];
+var UNBILLED_WORK_SOURCE_SET = ["posted_uninvoiced", "invoice", "date_range", "tickets"];
+var DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+function num(v) {
+  return typeof v === "number" && Number.isFinite(v) ? v : 0;
+}
+function isDateYMD(v) {
+  return typeof v === "string" && DATE_RE.test(v) && !Number.isNaN(Date.parse(v));
+}
+function validateUnbilledWorkOptions(companyId, opts) {
+  if (opts !== void 0 && (typeof opts !== "object" || opts === null || Array.isArray(opts))) {
+    throw new AutotaskConfigError(
+      `unbilledWork: opts must be the options object (got ${Array.isArray(opts) ? "an array" : typeof opts})`,
+      { operation: "companies.unbilledWork" }
+    );
+  }
+  const problems = [];
+  for (const key of Object.keys(opts ?? {})) {
+    if (!UNBILLED_WORK_OPT_KEYS.includes(key)) {
+      problems.push(`unknown opts key "${key}" \u2014 the bag is closed: ${UNBILLED_WORK_OPT_KEYS.join(", ")}`);
+    }
+  }
+  const source = opts.source ?? "posted_uninvoiced";
+  if (!UNBILLED_WORK_SOURCE_SET.includes(source)) {
+    problems.push(`source must be one of: ${UNBILLED_WORK_SOURCE_SET.join(", ")} (got ${String(source)})`);
+  }
+  if (opts.includeParent !== void 0 && typeof opts.includeParent !== "boolean") {
+    problems.push(`includeParent must be a boolean (got ${String(opts.includeParent)})`);
+  }
+  if (opts.includeNotes !== void 0 && typeof opts.includeNotes !== "boolean") {
+    problems.push(`includeNotes must be a boolean (got ${String(opts.includeNotes)})`);
+  }
+  const noteChars = opts.noteChars ?? UNBILLED_WORK_NOTE_CHARS_DEFAULT;
+  if (!Number.isInteger(noteChars) || noteChars < 1) problems.push(`noteChars must be an integer >= 1 (got ${String(opts.noteChars)})`);
+  const rollup = opts.rollup ?? "ticket";
+  if (rollup !== "ticket" && rollup !== "entry") problems.push(`rollup must be 'ticket' or 'entry' (got ${String(opts.rollup)})`);
+  let limit;
+  try {
+    limit = clampLimit(opts.limit);
+  } catch (err) {
+    problems.push(err instanceof AutotaskError ? err.message : `limit must be an integer >= 1 (got ${String(opts.limit)})`);
+    limit = 50;
+  }
+  if (source === "date_range") {
+    if (!isDateYMD(opts.dateFrom)) problems.push(`dateFrom is required (YYYY-MM-DD) when source is "date_range" (got ${String(opts.dateFrom)})`);
+    if (!isDateYMD(opts.dateTo)) problems.push(`dateTo is required (YYYY-MM-DD) when source is "date_range" (got ${String(opts.dateTo)})`);
+  } else {
+    if (opts.dateFrom !== void 0 && !isDateYMD(opts.dateFrom)) problems.push(`dateFrom must be YYYY-MM-DD (got ${String(opts.dateFrom)})`);
+    if (opts.dateTo !== void 0 && !isDateYMD(opts.dateTo)) problems.push(`dateTo must be YYYY-MM-DD (got ${String(opts.dateTo)})`);
+  }
+  if (source === "invoice") {
+    if (opts.invoiceId === void 0) {
+      problems.push('invoiceId is required (the vendor invoice id) when source is "invoice"');
+    } else {
+      try {
+        parseIdentifier(opts.invoiceId, "opts.invoiceId");
+      } catch (err) {
+        problems.push(err instanceof AutotaskError ? err.message : "invoiceId must be a vendor numeric id");
+      }
+    }
+  }
+  if (source === "tickets") {
+    if (!Array.isArray(opts.ticketIds) || opts.ticketIds.length === 0) {
+      problems.push('ticketIds is required (a non-empty array of vendor ticket ids) when source is "tickets"');
+    } else {
+      opts.ticketIds.forEach((tid, i) => {
+        try {
+          parseIdentifier(tid, `opts.ticketIds[${i}]`);
+        } catch (err) {
+          problems.push(err instanceof AutotaskError ? err.message : `ticketIds[${i}] must be a vendor numeric id`);
+        }
+      });
+    }
+  }
+  try {
+    parseIdentifier(companyId, "companyId");
+  } catch (err) {
+    problems.push(err instanceof AutotaskError ? err.message : "companyId must be a vendor numeric id");
+  }
+  if (problems.length > 0) {
+    throw new AutotaskConfigError(
+      `unbilledWork: ${problems.length} problem(s) found pre-request (zero wire was issued)
+- ` + problems.join("\n- "),
+      { operation: "companies.unbilledWork" }
+    );
+  }
+  return {
+    source,
+    includeParent: opts.includeParent ?? true,
+    dateFrom: isDateYMD(opts.dateFrom) ? opts.dateFrom : void 0,
+    dateTo: isDateYMD(opts.dateTo) ? opts.dateTo : void 0,
+    invoiceId: source === "invoice" ? opts.invoiceId : void 0,
+    ticketIds: source === "tickets" ? opts.ticketIds : void 0,
+    includeNotes: opts.includeNotes ?? false,
+    noteChars,
+    rollup,
+    limit
+  };
+}
+async function boundedPart(http, path, conditions, limit, includeFields) {
+  const body = { MaxRecords: limit, filter: conditions };
+  if (includeFields !== void 0) body.IncludeFields = includeFields;
+  const res = await http.request({
+    method: "POST",
+    idempotent: true,
+    path,
+    body,
+    operation: "companies.unbilledWork"
+  });
+  const { items, pageDetails } = unwrapItems(res, "companies.unbilledWork");
+  const capped = items.length >= limit;
+  return { items, capped, hasMore: capped && pageDetails.nextPageUrl != null };
+}
+function capJoinSet(ids, cap) {
+  const sorted = [...new Set(ids)].sort((a, b) => a - b);
+  if (sorted.length <= cap) return { ids: sorted, truncated: false };
+  return { ids: sorted.slice(0, cap), truncated: true };
+}
+function unbilledWorkPartStatus(key, conditions, items) {
+  if (items.length !== 0) return { status: "ok" };
+  const stamp = blindStampFor(BLIND_SURFACE_STAMPS[key]?.query, conditions);
+  if (stamp !== void 0) return { status: "blind", blindSurface: stamp, note: stamp.note };
+  return {
+    status: "ok",
+    note: `0 rows on ${key}.query for this filter (a filtered empty is a TRUE zero \u2014 the pinned blind surfaces stamp only their blind shape, and this call is always filtered)`
+  };
+}
+async function unbilledWork(resource, companyId, opts = {}, http) {
+  const v = validateUnbilledWorkOptions(companyId, opts);
+  const id = parseIdentifier(companyId, "companyId");
+  const company = await resource.get(id);
+  const companyIds = [num(company.id)];
+  let parent = null;
+  let parentStatus = "skipped";
+  if (v.includeParent) {
+    const parentID = company.parentCompanyID;
+    if (typeof parentID === "number" && parentID > 0) {
+      try {
+        parent = await resource.get(parentID);
+        parentStatus = "ok";
+        companyIds.push(num(parent.id));
+      } catch (err) {
+        if (err instanceof NotFoundError) parent = null;
+        else throw err;
+      }
+    }
+  }
+  const ticketsCond = [{ field: "companyID", op: "in", value: companyIds }];
+  const ticketsRaw = await boundedPart(http, "/V1.0/Tickets/query", ticketsCond, v.limit);
+  const projectsCond = [{ field: "companyID", op: "in", value: companyIds }];
+  const projectsRaw = await boundedPart(http, "/V1.0/Projects/query", projectsCond, v.limit);
+  const projectIds = projectsRaw.items.map((p) => num(p.id)).filter((n) => n > 0);
+  let taskIds = [];
+  let tasksHasMore = false;
+  if (projectIds.length > 0) {
+    const tasksRaw = await boundedPart(http, "/V1.0/Tasks/query", [{ field: "projectID", op: "in", value: projectIds }], v.limit);
+    taskIds = tasksRaw.items.map((t) => num(t.id)).filter((n) => n > 0);
+    tasksHasMore = tasksRaw.hasMore;
+  }
+  const ticketJoinIds = ticketsRaw.items.map((t) => num(t.id)).filter((n) => n > 0);
+  if (v.source === "tickets" && v.ticketIds !== void 0) {
+    for (const tid of v.ticketIds) ticketJoinIds.push(typeof tid === "number" ? tid : parseInt(tid, 10));
+  }
+  const billingConditions = [{ field: "companyID", op: "in", value: companyIds }];
+  if (v.source === "posted_uninvoiced") billingConditions.push({ field: "invoiceID", op: "notExist" });
+  if (v.source === "invoice" && v.invoiceId !== void 0) billingConditions.push({ field: "invoiceID", op: "eq", value: v.invoiceId });
+  if (v.source === "date_range") {
+    billingConditions.push({ field: "itemDate", op: "gte", value: v.dateFrom }, { field: "itemDate", op: "lte", value: v.dateTo });
+  }
+  if (v.source === "tickets" && v.ticketIds !== void 0) billingConditions.push({ field: "ticketID", op: "in", value: v.ticketIds });
+  if (v.source !== "date_range") {
+    if (v.dateFrom !== void 0) billingConditions.push({ field: "itemDate", op: "gte", value: v.dateFrom });
+    if (v.dateTo !== void 0) billingConditions.push({ field: "itemDate", op: "lte", value: v.dateTo });
+  }
+  const billingFields = resolveFieldsPreset("billing_join", "billing_items");
+  const billingIncludeFields = [...billingFields, "id", ...v.includeNotes ? ["description"] : []];
+  const billingRaw = await boundedPart(http, "/V1.0/BillingItems/query", billingConditions, v.limit, billingIncludeFields);
+  const taskCap = capJoinSet(taskIds, UNBILLED_WORK_JOIN_SET_CAP);
+  const ticketCap = capJoinSet(ticketJoinIds, UNBILLED_WORK_JOIN_SET_CAP);
+  const joinNotes = [];
+  for (const [what, more] of [["ticket", ticketsRaw.hasMore], ["project", projectsRaw.hasMore], ["task", tasksHasMore]]) {
+    if (more) joinNotes.push(`${what} join read hit the limit of ${v.limit} \u2014 time entries are joined against the first ${v.limit} ${what}s only (raise limit to widen it)`);
+  }
+  if (taskCap.truncated) joinNotes.push(`task join set truncated to ${UNBILLED_WORK_JOIN_SET_CAP} of ${taskIds.length} ids (the 8000-char filter cap \u2014 the results cover the returned join set only)`);
+  if (ticketCap.truncated) joinNotes.push(`ticket join set truncated to ${UNBILLED_WORK_JOIN_SET_CAP} of ${ticketJoinIds.length} ids (the 8000-char filter cap \u2014 the results cover the returned join set only)`);
+  let timePart;
+  let entries = [];
+  if (taskCap.ids.length === 0 && ticketCap.ids.length === 0) {
+    timePart = {
+      items: [],
+      capped: false,
+      hasMore: false,
+      status: "skipped",
+      // joinNotes ride the skipped part too: an empty join set from a PARTIAL read (e.g. a full projects page) is not a true zero
+      note: ["skipped: the company (set) has no tickets or tasks in the returned join set \u2014 no tasks/tickets to join against is NOT evidence of no time entries (zero wire)", ...joinNotes].join(" | ")
+    };
+  } else {
+    const timeConditions = taskCap.ids.length > 0 && ticketCap.ids.length > 0 ? [{ op: "or", items: [{ field: "taskID", op: "in", value: taskCap.ids }, { field: "ticketID", op: "in", value: ticketCap.ids }] }] : taskCap.ids.length > 0 ? [{ field: "taskID", op: "in", value: taskCap.ids }] : [{ field: "ticketID", op: "in", value: ticketCap.ids }];
+    if (v.dateFrom !== void 0) timeConditions.push({ field: "dateWorked", op: "gte", value: v.dateFrom });
+    if (v.dateTo !== void 0) timeConditions.push({ field: "dateWorked", op: "lte", value: v.dateTo });
+    const timeFields = ["taskID", "ticketID", "hoursWorked", "dateWorked", "id", ...v.includeNotes ? ["summaryNotes"] : []];
+    const raw = await boundedPart(http, "/V1.0/TimeEntries/query", timeConditions, v.limit, timeFields);
+    entries = raw.items;
+    let cappedItems = entries;
+    let noteCharsTruncated = 0;
+    if (v.includeNotes) {
+      [cappedItems, noteCharsTruncated] = truncateNoteChars(entries, v.noteChars, ["summaryNotes"]);
+    }
+    const st = unbilledWorkPartStatus("time_entries", timeConditions, entries);
+    timePart = {
+      items: cappedItems,
+      capped: raw.capped,
+      hasMore: raw.hasMore,
+      status: st.status,
+      blindSurface: st.blindSurface,
+      note: [...joinNotes, ...st.note !== void 0 ? [st.note] : [], ...noteCharsTruncated > 0 ? [`noteChars: ${noteCharsTruncated} note field value(s) truncated at ${v.noteChars} chars`] : []].filter(Boolean).join(" | ") || void 0
+    };
+  }
+  let billingItems = billingRaw.items;
+  let billingNoteCharsTruncated = 0;
+  if (v.includeNotes) {
+    const noteFields = (UNTRUSTED_FIELDS_BY_RESOURCE["billing_items"] ?? []).filter((f) => billingIncludeFields.includes(f));
+    [billingItems, billingNoteCharsTruncated] = truncateNoteChars(billingRaw.items, v.noteChars, noteFields);
+  }
+  const billingSt = unbilledWorkPartStatus("billing_items", billingConditions, billingRaw.items);
+  const billingItemsPart = {
+    items: billingItems,
+    capped: billingRaw.capped,
+    hasMore: billingRaw.hasMore,
+    status: billingSt.status,
+    blindSurface: billingSt.blindSurface,
+    note: [...billingSt.note !== void 0 ? [billingSt.note] : [], ...billingNoteCharsTruncated > 0 ? [`noteChars: ${billingNoteCharsTruncated} note field value(s) truncated at ${v.noteChars} chars`] : []].filter(Boolean).join(" | ") || void 0
+  };
+  const entryByTimeId = /* @__PURE__ */ new Map();
+  for (const e of entries) entryByTimeId.set(num(e.id), e);
+  const fold = /* @__PURE__ */ new Map();
+  const rowFor = (key) => {
+    let r = fold.get(key);
+    if (r === void 0) {
+      r = { ticketId: key === "unassigned" ? null : key, itemCount: 0, hours: 0, preTax: 0, entryCount: 0 };
+      fold.set(key, r);
+    }
+    return r;
+  };
+  for (const item of billingItems) {
+    const t = num(item.ticketID);
+    const r = rowFor(t > 0 ? t : "unassigned");
+    r.itemCount += 1;
+    r.preTax += num(item.extendedPrice);
+  }
+  for (const e of entries) {
+    const t = num(e.ticketID);
+    const r = rowFor(t > 0 ? t : "unassigned");
+    r.entryCount += 1;
+    r.hours += num(e.hoursWorked);
+  }
+  const totals = { preTax: 0, hours: 0, entryCount: 0, totalAmount: 0, taxDollars: 0 };
+  for (const row of fold.values()) {
+    totals.preTax += row.preTax;
+    totals.hours += row.hours;
+    totals.entryCount += row.entryCount;
+  }
+  for (const item of billingItems) {
+    totals.totalAmount += num(item.totalAmount);
+    totals.taxDollars += num(item.taxDollars);
+  }
+  const rollupRows = [...fold.values()].sort((a, b) => {
+    if (a.ticketId === null) return 1;
+    if (b.ticketId === null) return -1;
+    return a.ticketId - b.ticketId;
+  });
+  const rollup = v.rollup === "entry" ? { mode: "entry", items: timePart.items, capped: timePart.capped, hasMore: timePart.hasMore } : { mode: "ticket", rows: rollupRows };
+  const billedEntryIds = new Set(billingItems.map((i) => num(i.timeEntryID)).filter((n) => n > 0));
+  const unpostedAll = entries.filter((e) => num(e.id) > 0 && !billedEntryIds.has(num(e.id)));
+  const unpostedCapped = unpostedAll.length > v.limit;
+  const unposted = {
+    items: unpostedAll.slice(0, v.limit),
+    capped: unpostedCapped,
+    hasMore: unpostedCapped,
+    status: "ok",
+    note: unpostedCapped ? `unposted list capped at ${v.limit} of ${unpostedAll.length} (the full anti-join set is larger)` : void 0
+  };
+  const noTimeEntryAll = billingItems.filter((i) => !num(i.timeEntryID));
+  const hourDeltaAll = [];
+  for (const item of billingItems) {
+    const teId = num(item.timeEntryID);
+    if (teId <= 0) continue;
+    const entry = entryByTimeId.get(teId);
+    if (entry === void 0) continue;
+    const billed = num(item.quantity);
+    const worked = num(entry.hoursWorked);
+    if (Math.abs(billed - worked) > 0) {
+      hourDeltaAll.push({ billingItemId: num(item.id), timeEntryId: teId, billedQuantity: billed, entryHours: worked });
+    }
+  }
+  const warnings = {
+    noTimeEntry: { items: noTimeEntryAll.slice(0, v.limit).map((i) => ({ billingItemId: num(i.id) })), count: noTimeEntryAll.length },
+    hourDelta: { items: hourDeltaAll.slice(0, v.limit), count: hourDeltaAll.length }
+  };
+  return {
+    company,
+    parent,
+    billingItems: billingItemsPart,
+    timeEntries: timePart,
+    rollup,
+    unposted,
+    totals,
+    warnings,
+    parts: {
+      company: "ok",
+      parent: parentStatus,
+      billingItems: billingSt.status,
+      timeEntries: timePart.status,
+      unposted: "ok"
+    }
+  };
 }
 
 // src/resources/companies.ts
@@ -3574,9 +1669,20 @@ var CompaniesResource = class extends BaseResource {
     return this.resolveBase(identifier);
   }
   /** Search Company records: bounded contains on companyName (no vendor free-text search exists);
-   * limit defaults to 25, max 500. */
+   * limit defaults to 25, max 500. The closed opts bag { limit?, includeFamily? }:
+   * includeFamily: true adds the per-match family block (parentID — zero extra wire —
+   * the record's own parentCompanyID; childIDs — one bounded single-page query per match,
+   * capped at 50 with the childIDsTruncated flag; the blind-surface blindNote — the
+   * family is reported as SEEN BY THIS API USER, never as complete). */
   async search(query, opts) {
-    return this.searchBase(query, opts);
+    return searchWithFamily(this, query, opts, this.http);
+  }
+  /** `search` with an empty result explained. Same closed opts discipline as `search`: only `limit` is
+   * accepted here (an unknown key is refused pre-request, zero wire — never silently dropped); the
+   * family block is a `search`-only option. */
+  async searchWithDetail(query, opts = {}) {
+    assertSearchWithDetailOpts(opts);
+    return super.searchWithDetail(query, opts);
   }
   /** Get the Company with its primary context records in one call (each part a single-record
    * fetch; no sub-lists; absent/dangling references come back null). */
@@ -3603,6 +1709,10 @@ var CompaniesResource = class extends BaseResource {
   fullProfile(id, opts) {
     return fullProfile(this, id, opts, this.http);
   }
+  /** Node-parity special op (hand-written in src/resources/special/companies.ts). */
+  unbilledWork(id, opts) {
+    return unbilledWork(this, id, opts, this.http);
+  }
 };
 
 // src/resources/company_alerts.ts
@@ -4431,7 +2541,7 @@ async function profile(resource, id, opts = {}, http) {
     blind: wallQuirk !== void 0
   };
   if (wallQuirk !== void 0) productAssociations.note = wallQuirk;
-  return {
+  const result = {
     ci,
     type,
     category,
@@ -4447,6 +2557,16 @@ async function profile(resource, id, opts = {}, http) {
       productAssociations: wallQuirk !== void 0 ? "blind" : "ok"
     }
   };
+  if (opts.names === true) {
+    const builder = createNamePlan();
+    builder.addFk("contract", root["contractID"]);
+    const names = await resolveCompositeNames(http, builder.plan(), { maxNameReads: opts.maxNameReads });
+    const ciRow = { ...ci };
+    addNameSibling(ciRow, "contractID", (v) => names.recordName("contract", v));
+    result.ci = ciRow;
+    result.names = names.section;
+  }
+  return result;
 }
 
 // src/resources/configuration_items.ts
@@ -7209,6 +5329,33 @@ async function pdf(_resource, id, http) {
   });
   return decodeFileData(res);
 }
+async function windowQuery2(_resource, kind, http, opts) {
+  const now = opts?.now ?? /* @__PURE__ */ new Date();
+  const tz = opts?.tz === void 0 ? void 0 : validateZone(opts.tz, `invoices.${kind}`);
+  return dateWindowQuery(
+    http,
+    "/V1.0/Invoices/query",
+    "invoiceDateTime",
+    kind,
+    clampWindowLimit(opts?.limit),
+    `invoices.${kind}`,
+    now,
+    tz
+  );
+}
+async function customRange2(_resource, from, to, http, opts) {
+  const zone = opts?.tz === void 0 ? void 0 : validateZone(opts.tz, "invoices.customRange");
+  return customRangeQuery(
+    http,
+    "/V1.0/Invoices/query",
+    "invoiceDateTime",
+    from,
+    to,
+    clampWindowLimit(opts?.limit),
+    "invoices.customRange",
+    zone
+  );
+}
 
 // src/resources/invoices.ts
 var InvoicesResource = class extends BaseResource {
@@ -7263,6 +5410,46 @@ var InvoicesResource = class extends BaseResource {
     return this.resolveBase(identifier);
   }
   /** Node-parity special op (hand-written in src/resources/special/invoices.ts). */
+  customRange(from, to, opts) {
+    return customRange2(this, from, to, this.http, opts);
+  }
+  /** Node-parity special op (hand-written in src/resources/special/invoices.ts). */
+  last14(opts) {
+    return windowQuery2(this, "last14", this.http, opts);
+  }
+  /** Node-parity special op (hand-written in src/resources/special/invoices.ts). */
+  last24h(opts) {
+    return windowQuery2(this, "last24h", this.http, opts);
+  }
+  /** Node-parity special op (hand-written in src/resources/special/invoices.ts). */
+  last30(opts) {
+    return windowQuery2(this, "last30", this.http, opts);
+  }
+  /** Node-parity special op (hand-written in src/resources/special/invoices.ts). */
+  last7(opts) {
+    return windowQuery2(this, "last7", this.http, opts);
+  }
+  /** Node-parity special op (hand-written in src/resources/special/invoices.ts). */
+  last90(opts) {
+    return windowQuery2(this, "last90", this.http, opts);
+  }
+  /** Node-parity special op (hand-written in src/resources/special/invoices.ts). */
+  lastFullFortnight(opts) {
+    return windowQuery2(this, "lastFullFortnight", this.http, opts);
+  }
+  /** Node-parity special op (hand-written in src/resources/special/invoices.ts). */
+  lastFullMonth(opts) {
+    return windowQuery2(this, "lastFullMonth", this.http, opts);
+  }
+  /** Node-parity special op (hand-written in src/resources/special/invoices.ts). */
+  lastFullQuarter(opts) {
+    return windowQuery2(this, "lastFullQuarter", this.http, opts);
+  }
+  /** Node-parity special op (hand-written in src/resources/special/invoices.ts). */
+  lastFullWeek(opts) {
+    return windowQuery2(this, "lastFullWeek", this.http, opts);
+  }
+  /** Node-parity special op (hand-written in src/resources/special/invoices.ts). */
   markupHtml(id) {
     return markup(this, id, "html", this.http);
   }
@@ -7274,6 +5461,14 @@ var InvoicesResource = class extends BaseResource {
   pdf(id) {
     return pdf(this, id, this.http);
   }
+  /** Node-parity special op (hand-written in src/resources/special/invoices.ts). */
+  today(opts) {
+    return windowQuery2(this, "today", this.http, opts);
+  }
+  /** Node-parity special op (hand-written in src/resources/special/invoices.ts). */
+  yesterday(opts) {
+    return windowQuery2(this, "yesterday", this.http, opts);
+  }
 };
 
 // src/resources/modules.ts
@@ -7895,14 +6090,29 @@ var ProjectsResource = class extends BaseResource {
     return this.searchBase(query, opts);
   }
   /** Get the Project with its primary context records in one call (each part a single-record
-   * fetch; no sub-lists; absent/dangling references come back null). */
-  async getContext(id) {
+   * fetch; no sub-lists; absent/dangling references come back null). `names: true` (issue #77)
+   * adds the opt-in name siblings on the project row (creator name, contract name — the
+   * closed scope; project picklists stay label-less) + the top-level `names` section;
+   * `maxNameReads` may lower the name-read budget (default 20), never raise it. */
+  async getContext(id, opts = {}) {
     const project = await this.fetchRecordRaw("/V1.0/Projects", id);
     const root = project;
     const company = await this.contextFetch("/V1.0/Companies", root["companyID"]);
     const opportunity = await this.contextFetch("/V1.0/Opportunities", root["opportunityID"]);
     const leadResource = await this.contextFetch("/V1.0/Resources", root["projectLeadResourceID"]);
-    return { project, company, opportunity, leadResource };
+    const result = { project, company, opportunity, leadResource };
+    if (opts.names === true) {
+      const builder = createNamePlan();
+      builder.addResource(root["creatorResourceID"]);
+      builder.addFk("contract", root["contractID"]);
+      const names = await resolveCompositeNames(this.http, builder.plan(), { maxNameReads: opts.maxNameReads });
+      const row = { ...project };
+      addNameSibling(row, "creatorResourceID", (v) => names.resourceName(v));
+      addNameSibling(row, "contractID", (v) => names.recordName("contract", v));
+      result.project = row;
+      result.names = names.section;
+    }
+    return result;
   }
 };
 
@@ -8661,9 +6871,12 @@ var ResourcesResource = class extends BaseResource {
   async count(params) {
     return this.countGlobal(params);
   }
-  /** Get one record by id (item envelope; item: null → NotFoundError). */
-  async get(id) {
-    return this.getGlobal(id);
+  /** Get one record by id (item envelope; item: null → NotFoundError).
+   * `fresh: true` in the opts bag bypasses AND refreshes the ReadCache entry for this id
+   * (the per-id authority read of operations.expandResourceNames with fresh: true — issue #77);
+   * a plain get is the bit-for-bit cached read. */
+  async get(id, opts = {}) {
+    return this.getGlobal(id, opts.fresh === true);
   }
   /** Update a record (PUT on the COLLECTION — the vendored spec's item path is GET-only; the vendor
    * keys the record by the id in the body). The vendor validates the FULL model on this route (V2), so a
@@ -8711,6 +6924,14 @@ async function getByResource(_resource, resourceId, http) {
     path: `/V1.0/Resources/${numericResource}/TimeOffAdditional`,
     operation: "resource_time_off_additional.getByResource"
   });
+  if (typeof res === "object" && res !== null && !Array.isArray(res)) {
+    const keys = Object.keys(res);
+    if (keys.length === 1 && keys[0] === "item") {
+      const item = res.item;
+      if (item === null) return [];
+      if (typeof item === "object" && !Array.isArray(item)) return [item];
+    }
+  }
   return unwrapItems(res, "resource_time_off_additional.getByResource").items;
 }
 
@@ -10862,11 +9083,11 @@ async function slaHealthCheck(_resource, id, opts = {}, http) {
   );
   const slas = rows.map((row) => {
     const bool = (v) => typeof v === "boolean" ? v : null;
-    const num = (v) => typeof v === "number" ? v : null;
+    const num2 = (v) => typeof v === "number" ? v : null;
     const milestones = [
-      { name: "firstResponse", met: bool(row.isFirstResponseMet), elapsedHours: num(row.firstResponseElapsedHours) },
-      { name: "resolution", met: bool(row.isResolutionMet), elapsedHours: num(row.resolutionElapsedHours) },
-      { name: "resolutionPlan", met: bool(row.isResolutionPlanMet), elapsedHours: num(row.resolutionPlanElapsedHours) }
+      { name: "firstResponse", met: bool(row.isFirstResponseMet), elapsedHours: num2(row.firstResponseElapsedHours) },
+      { name: "resolution", met: bool(row.isResolutionMet), elapsedHours: num2(row.resolutionElapsedHours) },
+      { name: "resolutionPlan", met: bool(row.isResolutionPlanMet), elapsedHours: num2(row.resolutionPlanElapsedHours) }
     ];
     return { id: Number(row.id), name: row.serviceLevelAgreementName ?? null, milestones };
   });
@@ -11248,55 +9469,21 @@ async function openWithNoteAndAssign(resource, params, note, assign, opts, http)
     ...assign !== void 0 ? { blind: { resources: true, note: "the resources table is blind to this API user (count/query return 0) \u2014 the assignee was verified via resources.get (the authority)" } } : {}
   };
 }
-var STATUS_PICKLIST = [
-  { id: 1, label: "New" },
-  { id: 5, label: "Complete" },
-  { id: 7, label: "Waiting Customer" },
-  { id: 8, label: "In Progress" },
-  { id: 11, label: "Escalated" },
-  { id: 12, label: "Waiting 3rd Party" },
-  { id: 13, label: "Waiting Approval" },
-  { id: 14, label: "Ticket Updated" },
-  { id: 15, label: "N-central Update" },
-  { id: 17, label: "Follow up time" },
-  { id: 18, label: "Allocated" },
-  { id: 20, label: "Idle" },
-  { id: 21, label: "Sales & Ordering" },
-  { id: 24, label: "RTN" },
-  { id: 25, label: "Waiting Internal" },
-  { id: 27, label: "Ready to Allocate" },
-  { id: 28, label: "Customer to Test" },
-  { id: 29, label: "Call Scheduled" },
-  { id: 30, label: "Call Requested" },
-  { id: 31, label: "Waiting Order" },
-  { id: 33, label: "Waiting to Invoice" },
-  { id: 34, label: "Stakeholder Update" },
-  { id: 35, label: "Stage 1 - OPP Identified" },
-  { id: 36, label: "Stage 2 - Qualification" },
-  { id: 37, label: "Stage 3 - Presales Scope" },
-  { id: 38, label: "Stage 4 - Quote Creation" },
-  { id: 39, label: "Stage 5 - Quote Prepared" },
-  { id: 40, label: "Stage 6 - Quote Presented" },
-  { id: 41, label: "Stage 7 - Quote Followed" },
-  { id: 42, label: "Stage 8 - Negotiation" },
-  { id: 43, label: "Stage 9 - Verbal Approval" }
-];
-var STATUS_PICKLIST_SET = new Set(STATUS_PICKLIST.map((v) => v.id));
 var STATUS_REQUIRED_FIELDS = {
   // <discovery output lands here — e.g. 8: { requiredFields: ['dueDateTime'], safeDefaults: { dueDateTime: '<now>' } }>
 };
 var StatusUnknownError = class extends AutotaskError {
-  /** The pinned picklist size (the message names it; the labels are via autotask_describe(tickets.describeFields)). */
+  /** The live picklist size (the message names it; the values + labels are via operations.fieldCatalog with labels: true). */
   picklistCount;
   constructor(message, options = {}) {
     super(message, {
       code: "STATUS_UNKNOWN",
       category: "validation",
-      suggestedAction: "Pass one of the pinned picklist values (autotask_describe(tickets.describeFields) lists the full labels).",
+      suggestedAction: `Pass one of the tenant's live status values (discover the current values + labels with operations.fieldCatalog({ resources: ["tickets"], fields: ["status"], labels: true })).`,
       ...options
     });
     this.name = "StatusUnknownError";
-    this.picklistCount = STATUS_PICKLIST.length;
+    this.picklistCount = options.picklistCount ?? 0;
   }
 };
 var StatusFieldsRequiredError = class extends AutotaskError {
@@ -11313,17 +9500,56 @@ var StatusFieldsRequiredError = class extends AutotaskError {
     this.currentValues = details.currentValues;
   }
 };
-async function changeStatus(_resource, id, targetStatus, fields, opts, http) {
+async function readLiveStatusSet(resource) {
+  const raw = await resource.getFieldInfo();
+  const row = raw.find((f) => f.name === "status");
+  const values = row !== void 0 && row.isPickList === true ? row.picklistValues : void 0;
+  const ids = /* @__PURE__ */ new Set();
+  if (Array.isArray(values)) {
+    for (const pv of values) {
+      const n = Number(pv.value);
+      if (Number.isFinite(n)) ids.add(n);
+    }
+  }
+  return ids;
+}
+var GUARD_DEGRADED_WARNING = "the tenant's live status picklist metadata was unavailable (the local guard is degraded for this call \u2014 the W-A4 wall or a metadata failure); the vendor's own validation is the final authority on the status value";
+async function changeStatus(resource, id, targetStatus, fields, opts, http) {
   const ticketId = parseIdentifier(id, "id");
   if (!isPositiveInt(targetStatus)) {
     throw new AutotaskConfigError(`changeStatus: targetStatus must be a positive integer (got ${String(targetStatus)})`, { operation: OP_STATUS });
   }
-  if (!STATUS_PICKLIST_SET.has(targetStatus)) {
-    throw new StatusUnknownError(
-      `changeStatus: targetStatus ${targetStatus} is not in the ww29 status picklist (pinned: ${STATUS_PICKLIST.length} values, max id 43 \u2014 tenant-specific; the live describeFields probe is the oracle)`,
-      { operation: OP_STATUS }
-    );
+  let liveStatus = null;
+  try {
+    const ids = await readLiveStatusSet(resource);
+    if (ids.size > 0) liveStatus = ids;
+  } catch (err) {
+    if (!isAutotaskError(err) || err.code === "ABORTED") throw err;
+  }
+  if (liveStatus !== null && !liveStatus.has(targetStatus)) {
+    http.fieldCache?.invalidate("tickets");
+    let freshStatus = null;
+    let reReadFailed = false;
+    try {
+      const freshIds = await readLiveStatusSet(resource);
+      if (freshIds.size > 0) freshStatus = freshIds;
+    } catch (err) {
+      if (!isAutotaskError(err) || err.code === "ABORTED") throw err;
+      freshStatus = null;
+      reReadFailed = true;
+    }
+    if (freshStatus !== null && freshStatus.has(targetStatus)) {
+      liveStatus = freshStatus;
+    } else {
+      const verdict = freshStatus ?? liveStatus;
+      const staleNote = freshStatus === null ? `; the live re-read ${reReadFailed ? "failed" : "returned no values"}, so this picklist count is from the initial read (up to one field-cache TTL old)` : "";
+      throw new StatusUnknownError(
+        `changeStatus: targetStatus ${targetStatus} is not in the tenant's live status picklist (live: ${verdict.size} values \u2014 the entity metadata is the oracle; the values + labels are discoverable with operations.fieldCatalog({ resources: ["tickets"], fields: ["status"], labels: true })${staleNote})`,
+        { operation: OP_STATUS, picklistCount: verdict.size }
+      );
+    }
   }
+  const guardDegraded = liveStatus === null;
   if (fields !== void 0 && (typeof fields !== "object" || fields === null || Array.isArray(fields))) {
     throw new AutotaskConfigError("changeStatus: fields must be a plain object of ticket fields (or omitted)", { operation: OP_STATUS });
   }
@@ -11346,7 +9572,10 @@ async function changeStatus(_resource, id, targetStatus, fields, opts, http) {
             { name: "no-op", ok: true }
           ],
           impact: { affected: 0, scope: "single-record", reversible: true },
-          warnings: [`NO_CHANGE: the ticket is already in the target status ${targetStatus} \u2014 the apply would be a zero-wire no-op.`],
+          warnings: [
+            ...guardDegraded ? [GUARD_DEGRADED_WARNING] : [],
+            `NO_CHANGE: the ticket is already in the target status ${targetStatus} \u2014 the apply would be a zero-wire no-op.`
+          ],
           data: { reason: "NO_CHANGE", status: targetStatus }
         },
         { redactPersonalData: http.redactPersonalData }
@@ -11378,6 +9607,7 @@ async function changeStatus(_resource, id, targetStatus, fields, opts, http) {
   }
   if (opts.dryRun === true) {
     const warnings = [];
+    if (guardDegraded) warnings.push(GUARD_DEGRADED_WARNING);
     if (filled.length > 0) {
       warnings.push(`the node will fill the map-required field(s) ${filled.join(", ")} with the proven-safe defaults (the live-discovered map); the caller value always wins.`);
     }
@@ -11534,6 +9764,38 @@ async function fullContext(resource, id, opts = {}, http) {
     result.parts.histories = historiesRead.status;
     result.truncated = result.truncated || part.capped || historyRows.some((h) => h.detailTruncated === true);
   }
+  if (opts.names === true) {
+    const builder = createNamePlan(TICKET_LABEL_FIELDS);
+    const t = ctx.ticket;
+    builder.addResource(t["creatorResourceID"]);
+    builder.addFk("contract", t["contractID"]);
+    builder.addFk("billingCode", t["billingCodeID"]);
+    builder.addFk("role", t["assignedResourceRoleID"]);
+    for (const e of entriesPart.items) {
+      builder.addResource(e["resourceID"]);
+      builder.addFk("role", e["roleID"]);
+      builder.addFk("billingCode", e["billingCodeID"]);
+      builder.addFk("contract", e["contractID"]);
+    }
+    const names = await resolveCompositeNames(http, builder.plan(), { maxNameReads: opts.maxNameReads });
+    const ticketRow = { ...ctx.ticket };
+    addNameSibling(ticketRow, "creatorResourceID", (v) => names.resourceName(v));
+    addNameSibling(ticketRow, "contractID", (v) => names.recordName("contract", v));
+    addNameSibling(ticketRow, "billingCodeID", (v) => names.recordName("billingCode", v));
+    addNameSibling(ticketRow, "assignedResourceRoleID", (v) => names.recordName("role", v));
+    for (const f of TICKET_LABEL_FIELDS) addLabelSibling(ticketRow, f, names);
+    result.ticket = ticketRow;
+    result.timeEntries.items = entriesPart.items.map((e) => {
+      const row = { ...e };
+      addNameSibling(row, "resourceID", (v) => names.resourceName(v));
+      addNameSibling(row, "roleID", (v) => names.recordName("role", v));
+      addNameSibling(row, "billingCodeID", (v) => names.recordName("billingCode", v));
+      addNameSibling(row, "contractID", (v) => names.recordName("contract", v));
+      return row;
+    });
+    result.names = names.section;
+    result.truncated = result.truncated || names.section.truncated;
+  }
   return result;
 }
 
@@ -11720,82 +9982,8 @@ var TicketWebhooksResource = class extends BaseResource {
 };
 
 // src/resources/special/time_entries.ts
-var DAY_MS = 864e5;
-var DEFAULT_LIMIT2 = 25;
-var MAX_LIMIT2 = 500;
-function clampLimit2(limit) {
-  const n = limit === void 0 ? DEFAULT_LIMIT2 : Math.trunc(limit);
-  if (!Number.isInteger(n) || n < 1) {
-    throw new AutotaskConfigError(`limit must be an integer >= 1 (got ${String(limit)})`);
-  }
-  return Math.min(n, MAX_LIMIT2);
-}
-var utcDayStart = (ms) => {
-  const d = new Date(ms);
-  return Date.UTC(d.getUTCFullYear(), d.getUTCMonth(), d.getUTCDate());
-};
-var utcDayEnd = (ms) => utcDayStart(ms) + DAY_MS - 1;
-var iso = (ms) => new Date(ms).toISOString().slice(0, 19) + "Z";
-function timeEntriesWindowBounds(kind, now) {
-  const t = now.getTime();
-  let from;
-  let to;
-  switch (kind) {
-    case "today":
-      from = utcDayStart(t);
-      to = utcDayEnd(t);
-      break;
-    case "yesterday":
-      from = utcDayStart(t - DAY_MS);
-      to = utcDayEnd(t - DAY_MS);
-      break;
-    case "last24h":
-      from = t - DAY_MS;
-      to = t;
-      break;
-    case "last7":
-    case "last14":
-    case "last30":
-    case "last90": {
-      const days = Number(kind.slice(4));
-      from = utcDayStart(t - days * DAY_MS);
-      to = utcDayEnd(t);
-      break;
-    }
-    case "lastFullWeek":
-    case "lastFullFortnight": {
-      const d = new Date(t);
-      const daysSinceMonday = (d.getUTCDay() + 6) % 7;
-      const thisMonday = utcDayStart(t) - daysSinceMonday * DAY_MS;
-      const daysBack = kind === "lastFullWeek" ? 7 : 14;
-      from = thisMonday - daysBack * DAY_MS;
-      to = thisMonday - 1;
-      break;
-    }
-    case "lastFullMonth": {
-      const d = new Date(t);
-      const y = d.getUTCFullYear();
-      const m = d.getUTCMonth() - 1;
-      from = Date.UTC(y, m, 1);
-      to = Date.UTC(y, m + 1, 1) - 1;
-      break;
-    }
-    case "lastFullQuarter": {
-      const d = new Date(t);
-      let q = Math.floor(d.getUTCMonth() / 3) - 1;
-      let y = d.getUTCFullYear();
-      if (q < 0) {
-        q = 3;
-        y -= 1;
-      }
-      const first = q * 3;
-      from = Date.UTC(y, first, 1);
-      to = Date.UTC(y, first + 3, 1) - 1;
-      break;
-    }
-  }
-  return { from: iso(from), to: iso(to) };
-}
+var DAY_MS2 = 864e5;
+var iso2 = (ms) => new Date(ms).toISOString().slice(0, 19) + "Z";
 async function queryTimeEntries(_resource, filter, limit, operation, http) {
   const res = await http.request({
     method: "POST",
@@ -11804,30 +9992,34 @@ async function queryTimeEntries(_resource, filter, limit, operation, http) {
     body: { MaxRecords: limit, filter },
     operation
   });
-  return unwrapItems(res).items;
+  const { items, pageDetails } = unwrapItems(res);
+  return { items, hasMore: pageDetails.nextPageUrl != null };
 }
-async function windowQuery(_resource, kind, http, opts) {
+async function windowQuery3(_resource, kind, http, opts) {
   const now = opts?.now ?? /* @__PURE__ */ new Date();
-  const { from, to } = timeEntriesWindowBounds(kind, now);
+  const tz = opts?.tz === void 0 ? void 0 : validateZone(opts.tz, `time_entries.${kind}`);
+  const { from, to } = dateWindowBounds(kind, now, tz);
   const filter = [
     { field: "dateWorked", op: "gte", value: from },
     { field: "dateWorked", op: "lte", value: to }
   ];
-  return queryTimeEntries(_resource, filter, clampLimit2(opts?.limit), `time_entries.${kind}`, http);
+  const { items } = await queryTimeEntries(_resource, filter, clampWindowLimit(opts?.limit), `time_entries.${kind}`, http);
+  return items;
 }
-async function customRange(_resource, from, to, http, opts) {
-  const parseDay = (value, label) => {
-    const m = /^(\d{4})-(\d{2})-(\d{2})$/.exec(value.trim());
-    if (!m) throw new AutotaskConfigError(`customRange: ${label} must be a UTC 'YYYY-MM-DD' date`);
-    return Date.UTC(Number(m[1]), Number(m[2]) - 1, Number(m[3]));
-  };
-  const fromMs = parseDay(from, "from");
-  const toMs = parseDay(to, "to");
+async function customRange3(_resource, from, to, http, opts) {
+  const zone = opts?.tz === void 0 ? void 0 : validateZone(opts.tz, "time_entries.customRange");
+  const fromB = customRangeDay(from, "from", zone, "customRange");
+  const toB = customRangeDay(to, "to", zone, "customRange");
+  if (fromB.ms > toB.ms) {
+    throw new AutotaskConfigError("customRange: from must not be after to");
+  }
+  const toEndMs = zone === void 0 ? toB.ms + DAY_MS2 - 1 : localDayEndMs(toB.y, toB.mo, toB.d, zone);
   const filter = [
-    { field: "dateWorked", op: "gte", value: iso(fromMs) },
-    { field: "dateWorked", op: "lte", value: iso(toMs + DAY_MS - 1) }
+    { field: "dateWorked", op: "gte", value: iso2(fromB.ms) },
+    { field: "dateWorked", op: "lte", value: iso2(toEndMs) }
   ];
-  return queryTimeEntries(_resource, filter, clampLimit2(opts?.limit), "time_entries.customRange", http);
+  const { items } = await queryTimeEntries(_resource, filter, clampWindowLimit(opts?.limit), "time_entries.customRange", http);
+  return items;
 }
 async function postedDateStatusQuery(_resource, mode, http, opts) {
   const filter = [
@@ -11835,39 +10027,27 @@ async function postedDateStatusQuery(_resource, mode, http, opts) {
   ];
   if (opts?.ticketID !== void 0) filter.push({ field: "ticketID", op: "eq", value: opts.ticketID });
   const operation = mode === "posted" ? "time_entries.getPosted" : "time_entries.getUnposted";
-  return queryTimeEntries(_resource, filter, clampLimit2(opts?.limit), operation, http);
+  const { items } = await queryTimeEntries(_resource, filter, clampWindowLimit(opts?.limit), operation, http);
+  return items;
 }
-async function postedWithin(_resource, from, to, http, opts) {
-  const OP2 = "time_entries.postedWithin";
-  const parseBound = (value, label) => {
-    const m = /^(\d{4})-(\d{2})-(\d{2})$/.exec(value.trim());
-    if (!m) {
-      throw new AutotaskConfigError(
-        `postedWithin: ${label} must be a UTC 'YYYY-MM-DD' date string (got ${JSON.stringify(value)})`,
-        { operation: OP2 }
-      );
-    }
-    const ms = Date.UTC(Number(m[1]), Number(m[2]) - 1, Number(m[3]));
-    if (!Number.isFinite(ms)) {
-      throw new AutotaskConfigError(`postedWithin: ${label} is not a valid UTC date (${JSON.stringify(value)})`, { operation: OP2 });
-    }
-    return ms;
-  };
-  const fromMs = parseBound(from, "from");
-  const toMs = parseBound(to, "to");
-  if (fromMs > toMs) {
-    throw new AutotaskConfigError(`postedWithin: from (${iso(fromMs)}) must not be after to (${iso(toMs)})`, { operation: OP2 });
-  }
-  const windowToMs = toMs + DAY_MS - 1;
+async function postedWithin(_resource, from, to, http, opts, opLabel = "time_entries.postedWithin") {
+  const OP2 = opLabel;
+  const zone = opts?.tz === void 0 ? void 0 : validateZone(opts.tz, OP2);
+  const fromB = customRangeDay(from, "from", zone, OP2);
+  const toB = customRangeDay(to, "to", zone, OP2);
+  if (fromB.ms > toB.ms) {
+    throw new AutotaskConfigError(`${OP2}: from (${iso2(fromB.ms)}) must not be after to (${iso2(toB.ms)})`, { operation: OP2 });
+  }
+  const windowToMs = zone === void 0 ? toB.ms + DAY_MS2 - 1 : localDayEndMs(toB.y, toB.mo, toB.d, zone);
   const filter = [
-    { field: "dateWorked", op: "gte", value: iso(fromMs) },
-    { field: "dateWorked", op: "lte", value: iso(windowToMs) }
+    { field: "dateWorked", op: "gte", value: iso2(fromB.ms) },
+    { field: "dateWorked", op: "lte", value: iso2(windowToMs) }
   ];
   if (opts?.posted === true) filter.push({ field: "postedDate", op: "exist" });
   else if (opts?.posted === false) filter.push({ field: "postedDate", op: "notExist" });
   if (opts?.ticketID !== void 0) filter.push({ field: "ticketID", op: "eq", value: opts.ticketID });
   if (opts?.resourceID !== void 0) filter.push({ field: "resourceID", op: "eq", value: opts.resourceID });
-  const items = await queryTimeEntries(_resource, filter, clampLimit2(opts?.limit), OP2, http);
+  const { items, hasMore } = await queryTimeEntries(_resource, filter, clampWindowLimit(opts?.limit), OP2, http);
   let postedCount = 0;
   for (const item of items) {
     const postedDate = item.postedDate;
@@ -11879,9 +10059,15 @@ async function postedWithin(_resource, from, to, http, opts) {
     items,
     postedCount,
     unpostedCount: items.length - postedCount,
-    window: { from: iso(fromMs), to: iso(windowToMs) }
+    window: { from: iso2(fromB.ms), to: iso2(windowToMs) },
+    // A live next-page cursor past the bounded read: the counts above cover
+    // the returned rows ONLY when this is true (issue #66 AC1 — the 500-row cap case is the general case).
+    truncated: hasMore
   };
 }
+async function dateWorkedWindow(resource, from, to, http, opts) {
+  return postedWithin(resource, from, to, http, opts, "time_entries.dateWorkedWindow");
+}
 var USE_TYPE_GENERAL = 1;
 var USE_TYPE_INTERNAL = 3;
 var BODY_INTERNAL_CODE_KEY = "internalBillingCodeID";
@@ -12162,13 +10348,13 @@ async function createForResource(resource, resourceID, params, opts = {}, http)
     const callerValue = params[field];
     window[field] = callerValue !== void 0 ? callerValue : defaults[field];
   }
-  const passthrough2 = {};
+  const passthrough = {};
   for (const [key, value] of Object.entries(params)) {
     if (value === void 0 || PARAM_KEYS.has(key)) continue;
     if (READ_ONLY_TIME_ENTRY_FIELDS.has(key) || LINKAGE_OWNED_FIELDS.has(key)) continue;
-    passthrough2[key] = value;
+    passthrough[key] = value;
   }
-  const body = { resourceID: rid, ...window, ...passthrough2 };
+  const body = { resourceID: rid, ...window, ...passthrough };
   if (usedLinkage === "internal") {
     body[BODY_INTERNAL_CODE_KEY] = resolvedCode.id;
   } else {
@@ -12245,7 +10431,7 @@ async function createForResource(resource, resourceID, params, opts = {}, http)
     }
   }
   if (isAutotaskError(lastError)) {
-    lastError.suggestedAction = (lastError.suggestedAction ? `${lastError.suggestedAction} ` : "") + `The createForResource attempt budget (${MAX_CREATE_ATTEMPTS} attempts: the role ladder + ${MAX_DISCOVERY_MERGES2} discovery merges) was exhausted \u2014 the vendor oracle rejected every candidate. Re-read the record/fields (time_entries.getFieldInfo, billing_codes.query with a filter) and retry with an explicit pin.`;
+    lastError.suggestedAction = (lastError.suggestedAction ? `${lastError.suggestedAction} ` : "") + `The createForResource attempt budget (${MAX_CREATE_ATTEMPTS} attempts: the role ladder + ${MAX_DISCOVERY_MERGES2} discovery merges) was exhausted \u2014 the vendor oracle rejected every candidate. Re-read the record/fields (operations.fieldCatalog, billing_codes.query with a filter) and retry with an explicit pin.`;
   }
   throw lastError;
 }
@@ -12336,7 +10522,11 @@ var TimeEntriesResource = class extends BaseResource {
   }
   /** Node-parity special op (hand-written in src/resources/special/time_entries.ts). */
   customRange(from, to, opts) {
-    return customRange(this, from, to, this.http, opts);
+    return customRange3(this, from, to, this.http, opts);
+  }
+  /** Node-parity special op (hand-written in src/resources/special/time_entries.ts). */
+  dateWorkedWindow(from, to, opts) {
+    return dateWorkedWindow(this, from, to, this.http, opts);
   }
   /** Node-parity special op (hand-written in src/resources/special/time_entries.ts). */
   getPosted(opts) {
@@ -12348,39 +10538,39 @@ var TimeEntriesResource = class extends BaseResource {
   }
   /** Node-parity special op (hand-written in src/resources/special/time_entries.ts). */
   last14(opts) {
-    return windowQuery(this, "last14", this.http, opts);
+    return windowQuery3(this, "last14", this.http, opts);
   }
   /** Node-parity special op (hand-written in src/resources/special/time_entries.ts). */
   last24h(opts) {
-    return windowQuery(this, "last24h", this.http, opts);
+    return windowQuery3(this, "last24h", this.http, opts);
   }
   /** Node-parity special op (hand-written in src/resources/special/time_entries.ts). */
   last30(opts) {
-    return windowQuery(this, "last30", this.http, opts);
+    return windowQuery3(this, "last30", this.http, opts);
   }
   /** Node-parity special op (hand-written in src/resources/special/time_entries.ts). */
   last7(opts) {
-    return windowQuery(this, "last7", this.http, opts);
+    return windowQuery3(this, "last7", this.http, opts);
   }
   /** Node-parity special op (hand-written in src/resources/special/time_entries.ts). */
   last90(opts) {
-    return windowQuery(this, "last90", this.http, opts);
+    return windowQuery3(this, "last90", this.http, opts);
   }
   /** Node-parity special op (hand-written in src/resources/special/time_entries.ts). */
   lastFullFortnight(opts) {
-    return windowQuery(this, "lastFullFortnight", this.http, opts);
+    return windowQuery3(this, "lastFullFortnight", this.http, opts);
   }
   /** Node-parity special op (hand-written in src/resources/special/time_entries.ts). */
   lastFullMonth(opts) {
-    return windowQuery(this, "lastFullMonth", this.http, opts);
+    return windowQuery3(this, "lastFullMonth", this.http, opts);
   }
   /** Node-parity special op (hand-written in src/resources/special/time_entries.ts). */
   lastFullQuarter(opts) {
-    return windowQuery(this, "lastFullQuarter", this.http, opts);
+    return windowQuery3(this, "lastFullQuarter", this.http, opts);
   }
   /** Node-parity special op (hand-written in src/resources/special/time_entries.ts). */
   lastFullWeek(opts) {
-    return windowQuery(this, "lastFullWeek", this.http, opts);
+    return windowQuery3(this, "lastFullWeek", this.http, opts);
   }
   /** Node-parity special op (hand-written in src/resources/special/time_entries.ts). */
   postedWithin(from, to, opts) {
@@ -12388,11 +10578,11 @@ var TimeEntriesResource = class extends BaseResource {
   }
   /** Node-parity special op (hand-written in src/resources/special/time_entries.ts). */
   today(opts) {
-    return windowQuery(this, "today", this.http, opts);
+    return windowQuery3(this, "today", this.http, opts);
   }
   /** Node-parity special op (hand-written in src/resources/special/time_entries.ts). */
   yesterday(opts) {
-    return windowQuery(this, "yesterday", this.http, opts);
+    return windowQuery3(this, "yesterday", this.http, opts);
   }
 };
 
@@ -12614,31 +10804,6 @@ var ZoneInformationResource = class {
 };
 
 export {
-  AUTH_HEADERS,
-  buildAuthHeaders,
-  withAuthHeaders,
-  FILTER_OPERATORS,
-  GROUPING_OPERATORS,
-  MAX_OR_CONDITIONS,
-  MAX_UDF_PER_QUERY,
-  MAX_QUERY_LENGTH,
-  MAX_GET_LENGTH,
-  MAX_FIELD_LENGTH,
-  isFilterOperator,
-  serializeFilter,
-  validateFilter,
-  buildFilter,
-  IDEMPOTENT_METHODS,
-  buildUrl,
-  cursorToPath,
-  buildQueryRequest,
-  runWithSignal,
-  HttpClient,
-  unwrapItems,
-  unwrapItem,
-  unwrapQueryCount,
-  unwrapOperation,
-  passthrough,
   AppointmentsResource,
   AuthenticateResource,
   BillingCodesResource,
@@ -12768,4 +10933,3 @@ export {
   VersionResource,
   ZoneInformationResource
 };
-//# sourceMappingURL=chunk-4WJCXIY2.js.map