@jacebenson/jsn 4.3.1 → 4.3.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jacebenson/jsn",
-  "version": "4.3.1",
+  "version": "4.3.2",
   "description": "A command-line interface for ServiceNow that follows the Unix philosophy: simple, composable, and scriptable.",
   "type": "module",
   "bin": {

package/scripts/pre-commit-check.sh

@@ -56,6 +56,6 @@ else
     echo ""
     echo "⚠️  Architecture violations found!"
     echo "   Remember: Commands should call app.SDK.List() directly with local types."
-    echo "   See internal/commands/dev/forms.go for the correct pattern."
+    echo "   See internal/commands/forms.go for the correct pattern."
     exit 1
 fi

package/src/auth.js

@@ -812,8 +812,27 @@ export class AuthManager {
   async loginWithGck(instanceURL, input, username = this._activeUsername()) {
     instanceURL = normalizeInstanceURL(instanceURL);
     const creds = parseBrowserSessionInput(input);
-    this.saveCredentials(instanceURL, { ...creds, username: username || undefined }, username || undefined);
-    return { ...creds, username: username || undefined };
+    let response;
+    try {
+      response = await fetch(`${instanceURL}/api/now/table/sys_user?sysparm_limit=1`, {
+        method: 'GET',
+        headers: {
+          Accept: 'application/json',
+          'X-UserToken': creds.access_token,
+          Cookie: creds.cookies,
+        },
+      });
+    } catch (error) {
+      throw errAuth(`Could not test the browser session against ${instanceURL}. Nothing was saved. Retry with: jsn auth login ${instanceURL} --gck (${error.message})`);
+    }
+    if (!response.ok) {
+      throw errAuth(`Browser session rejected by ${instanceURL} (HTTP ${response.status}). Nothing was saved. Retry with: jsn auth login ${instanceURL} --gck`);
+    }
+    const body = await response.json();
+    const user = body?.result?.[0];
+    const verifiedUsername = typeof user?.user_name === 'string' ? user.user_name : username;
+    this.saveCredentials(instanceURL, { ...creds, username: verifiedUsername || undefined }, verifiedUsername || undefined);
+    return { ...creds, username: verifiedUsername || undefined };
   }
 
   async loginWithCode(instanceURL, code, username = this._activeUsername()) {

package/src/capabilities.js

@@ -8,8 +8,6 @@
 //     // Subcommand verbs that mutate instance state. The mutation guard
 //     // (src/mutations.js) derives its command-path list from these.
 //     mutationSubcommands: ['create', 'update', 'delete'],
-//     // Also registered under `jsn dev <name>` — derive both spellings.
-//     devAlias: true,
 //     // Command runs without a configured instance (joins the middleware
 //     // skip-list for the instance guard).
 //     noInstance: true,
@@ -42,7 +40,7 @@ const REGISTRY = new Map();
  * @returns {object} the caps object (for convenient inline use)
  */
 export function declareCapabilities(name, caps) {
-  REGISTRY.set(name, { devAlias: false, ...caps });
+  REGISTRY.set(name, { ...caps });
   return caps;
 }
 
@@ -99,9 +97,6 @@ export function dailyCheckSkipCommands(caps = collectCapabilities()) {
  * begins with the pattern IS that mutation (trailing positionals like a
  * sys_id don't change intent).
  *
- * Commands with `devAlias: true` are also registered under `jsn dev <name>`,
- * so both spellings are emitted.
- *
  * A whole-command mutation surface (e.g. `jsn eval`, `jsn rest` — the
  * command itself is the mutation, there is no mutating sub-verb) declares
  * `mutationSubcommands: ['']`.
@@ -116,7 +111,6 @@ export function mutationPaths(caps = collectCapabilities()) {
     for (const sub of c.mutationSubcommands) {
       const parts = sub === '' ? [] : sub.split(' ');
       paths.push([name, ...parts]);
-      if (c.devAlias) paths.push(['dev', name, ...parts]);
     }
   }
   return paths;

package/src/cli.js

@@ -34,12 +34,11 @@ import { transactionsCmd } from './commands/transactions.js';
 import { platformCmd } from './commands/platform.js';
 import { codesearchCmd } from './commands/codesearch.js';
 import { versionCmd } from './commands/version.js';
-import { devCmd } from './commands/dev.js';
 import { skillCmd, checkSkill } from './commands/skill.js';
 import { getVersion, checkLatest } from './commands/version.js';
 import { docsCmd } from './commands/docs/docs.js';
 
-// Dev subcommands promoted to root level for progressive disclosure
+// Table and platform commands registered at root level for progressive disclosure
 import {
   actionsCmd, includesCmd, rulesCmd,
   clientScriptsCmd, uiActionsCmd,
@@ -55,19 +54,19 @@ import {
   emailCmd,
   restmessageCmd, soapmessagesCmd,
   uimacrosCmd, uxlistsCmd, uxapplicabilityCmd,
-} from './commands/dev/_simple.js';
+} from './commands/_simple.js';
 import { decisiontablesCmd } from './commands/decisiontables.js';
-import { flowsCmd } from './commands/dev/flows.js';
-import { formsCmd } from './commands/dev/forms.js';
-import { listsCmd } from './commands/dev/lists.js';
-import { updateSetsCmd } from './commands/dev/updatesets.js';
-import { scopesCmd } from './commands/dev/scopes.js';
-import { domainsCmd } from './commands/dev/domains.js';
-import { evalCmd } from './commands/dev/eval.js';
-import { restCmd } from './commands/dev/rest.js';
-import { logsCmd } from './commands/dev/logs.js';
-import { scrapiCmd } from './commands/dev/scrapi.js';
-import { b4rulesCmd } from './commands/dev/b4rules.js';
+import { flowsCmd } from './commands/flows.js';
+import { formsCmd } from './commands/forms.js';
+import { listsCmd } from './commands/lists.js';
+import { updateSetsCmd } from './commands/updatesets.js';
+import { scopesCmd } from './commands/scopes.js';
+import { domainsCmd } from './commands/domains.js';
+import { evalCmd } from './commands/eval.js';
+import { restCmd } from './commands/rest.js';
+import { logsCmd } from './commands/logs.js';
+import { scrapiCmd } from './commands/scrapi.js';
+import { b4rulesCmd } from './commands/b4rules.js';
 import { atfCmd } from './commands/atf.js';
 import { approvalsCmd } from './commands/approvals.js';
 import { perfCmd } from './commands/perf.js';
@@ -378,8 +377,6 @@ export function buildCLI() {
     .command(skillCmd(wrap))
     .command(docsCmd(wrap))
     .command(versionCmd(wrap))
-    // Legacy
-    .command(devCmd(wrap))
     .demandCommand(1, 'You must specify a command')
     // Completion plumbing under a hidden command name, so the explicit
     // 'completion' command below owns the UX. (#176)

package/src/commands/{dev/_generic.js → _generic.js}

@@ -1,10 +1,10 @@
-// Generic dev subcommand builder for table-based CRUD
+// Generic table-based CRUD command builder
 
-import { formatRecordForDisplay, getStringField, parseDataArg, confirmDelete, interactiveList, canPrompt } from '../../helpers.js';
-import { resolveRecord, unwrapSysId } from '../../resolve-record.js';
-import { getCurrentUser, getCurrentApplication } from '../../context.js';
-import { FormatAuto } from '../../output.js';
-import { declareCapabilities } from '../../capabilities.js';
+import { formatRecordForDisplay, getStringField, parseDataArg, confirmDelete, interactiveList, canPrompt } from '../helpers.js';
+import { resolveRecord, unwrapSysId } from '../resolve-record.js';
+import { getCurrentUser, getCurrentApplication } from '../context.js';
+import { FormatAuto } from '../output.js';
+import { declareCapabilities } from '../capabilities.js';
 
 function vowelArticle(word) {
   const first = word.charAt(0).toLowerCase();
@@ -95,11 +95,8 @@ export function buildDevCmd(name, table, aliases, defaultColumns, wrap, opts = {
   const singular = toSingular(name, opts.singular);
   const readOnly = opts.readOnly || false;
   // Capability declaration: the readOnly flag drives the mutation registry.
-  // buildDevCmd commands are registered both at root and under `jsn dev`
-  // unless opts.devAlias says otherwise (root-only commands pass false).
   declareCapabilities(name, {
     mutationSubcommands: readOnly ? [] : ['create', 'update', 'delete'],
-    devAlias: opts.devAlias !== false,
   });
   const scopeValidation = opts.scopeValidation || false;
   const extraQuery = opts.extraQuery || '';

package/src/commands/{dev/_simple.js → _simple.js}

@@ -1,6 +1,6 @@
 import { buildDevCmd } from './_generic.js';
-import { getStringField } from '../../helpers.js';
-// Simple table-based dev commands — singular names passed for grammar
+import { getStringField } from '../helpers.js';
+// Simple table-based commands — singular names passed for grammar
 // Default columns and aliases match the Go version exactly
 
 async function fetchExtensionChain(sdk, record) {
@@ -81,7 +81,7 @@ export { columnsCmd } from './columns.js';
 
 // Read-only commands (Go only has list/show)
 export { importCmd } from './import.js';
-export const spPagesCmd = (wrap) => buildDevCmd('sppages', 'sp_page', ['sp-pages', 'pages'], ['id', 'title', 'sys_scope'], wrap, { singular: 'Service Portal page', readOnly: true });
+export const spPagesCmd = (wrap) => buildDevCmd('sppages', 'sp_page', ['sp-pages'], ['id', 'title', 'sys_scope'], wrap, { singular: 'Service Portal page', readOnly: true });
 export const spWidgetsCmd = (wrap) => buildDevCmd('spwidgets', 'sp_widget', ['sp-widget', 'widgets'], ['id', 'name', 'sys_scope'], wrap, { singular: 'Service Portal widget', readOnly: true });
 export const uiPagesCmd = (wrap) => buildDevCmd('uipages', 'sys_ui_page', ['ui-page', 'pages'], ['name', 'sys_scope'], wrap, { singular: 'UI page', scopeValidation: true });
 export const appMenuCmd = (wrap) => buildDevCmd('appmenu', 'sys_app_application', ['app-menu', 'menu'], ['name', 'active', 'sys_scope'], wrap, { singular: 'application menu', scopeValidation: true });
@@ -99,30 +99,30 @@ export const viewsCmd = (wrap) => buildDevCmd('views', 'sys_ui_view', ['view', '
 export const privilegesCmd = (wrap) => buildDevCmd('privileges', 'sys_scope_privilege', ['privilege', 'priv'], ['source_scope', 'target_scope', 'target_name', 'operation', 'status'], wrap, { singular: 'privilege', scopeValidation: true });
 export const uxscriptsCmd = (wrap) => buildDevCmd('uxscripts', 'sys_ux_lib_source_script', ['uxscript', 'ux'], ['name', 'active', 'sys_scope'], wrap, { singular: 'UX script', scopeValidation: true });
 export { aliasesCmd } from './aliases.js';
-export const catalogscriptsCmd = (wrap) => buildDevCmd('catalogscripts', 'catalog_script_client', ['catalogscript', 'cs'], ['name', 'table', 'active', 'sys_scope'], wrap, { singular: 'catalog script', scopeValidation: true });
+export const catalogscriptsCmd = (wrap) => buildDevCmd('catalogscripts', 'catalog_script_client', ['catalogscript'], ['name', 'table', 'active', 'sys_scope'], wrap, { singular: 'catalog script', scopeValidation: true });
 
 // ── Automation: Async ──
-export const scriptactionsCmd = (wrap) => buildDevCmd('scriptactions', 'sysevent_script_action', ['scriptaction'], ['name', 'active', 'sys_scope'], wrap, { singular: 'script action', scopeValidation: true, devAlias: false });
-export const scheduledjobsCmd = (wrap) => buildDevCmd('scheduledjobs', 'sysauto_script', ['scheduledjob'], ['name', 'active', 'run_type', 'sys_scope'], wrap, { singular: 'scheduled job', scopeValidation: true, devAlias: false });
-export const asyncrulesCmd = (wrap) => buildDevCmd('asyncrules', 'sys_script', ['asyncrule'], ['name', 'collection', 'active', 'order', 'sys_scope'], wrap, { singular: 'async business rule', scopeValidation: true, extraQuery: 'when=async', devAlias: false });
-export const triggersCmd = (wrap) => buildDevCmd('triggers', 'sysevent_register', ['trigger'], ['name', 'event_name', 'active', 'sys_scope'], wrap, { singular: 'event trigger', scopeValidation: true, devAlias: false });
+export const scriptactionsCmd = (wrap) => buildDevCmd('scriptactions', 'sysevent_script_action', ['scriptaction'], ['name', 'active', 'sys_scope'], wrap, { singular: 'script action', scopeValidation: true });
+export const scheduledjobsCmd = (wrap) => buildDevCmd('scheduledjobs', 'sysauto_script', ['scheduledjob'], ['name', 'active', 'run_type', 'sys_scope'], wrap, { singular: 'scheduled job', scopeValidation: true });
+export const asyncrulesCmd = (wrap) => buildDevCmd('asyncrules', 'sys_script', ['asyncrule'], ['name', 'collection', 'active', 'order', 'sys_scope'], wrap, { singular: 'async business rule', scopeValidation: true, extraQuery: 'when=async' });
+export const triggersCmd = (wrap) => buildDevCmd('triggers', 'sysevent_register', ['trigger'], ['name', 'event_name', 'active', 'sys_scope'], wrap, { singular: 'event trigger', scopeValidation: true });
 
 // ── Automation: In Memory ──
 
-export const assignmentsCmd = (wrap) => buildDevCmd('assignments', 'sysrule_assignment', ['assignment'], ['name', 'active', 'sys_scope'], wrap, { singular: 'assignment rule', scopeValidation: true, readOnly: true, devAlias: false });
+export const assignmentsCmd = (wrap) => buildDevCmd('assignments', 'sysrule_assignment', ['assignment'], ['name', 'active', 'sys_scope'], wrap, { singular: 'assignment rule', scopeValidation: true, readOnly: true });
 
 // ── Automation: Inbound ──
-export const emailCmd = (wrap) => buildDevCmd('email', 'sysevent_in_email_action', ['emails'], ['name', 'active', 'type', 'sys_scope'], wrap, { singular: 'inbound email action', scopeValidation: true, devAlias: false });
+export const emailCmd = (wrap) => buildDevCmd('email', 'sysevent_in_email_action', ['emails'], ['name', 'active', 'type', 'sys_scope'], wrap, { singular: 'inbound email action', scopeValidation: true });
 
 // ── Automation: Outbound ──
 export { restmessageCmd } from './restmessage.js';
 export { soapmessagesCmd } from './soapmessages.js';
 
 // ── UX: Core UI ──
-export const uimacrosCmd = (wrap) => buildDevCmd('uimacros', 'sys_ui_macro', ['uimacro'], ['name', 'active', 'sys_scope'], wrap, { singular: 'UI macro', scopeValidation: true, devAlias: false });
+export const uimacrosCmd = (wrap) => buildDevCmd('uimacros', 'sys_ui_macro', ['uimacro'], ['name', 'active', 'sys_scope'], wrap, { singular: 'UI macro', scopeValidation: true });
 
 // ── UX: Workspaces ──
-export const uxlistsCmd = (wrap) => buildDevCmd('uxlists', 'sys_ux_list', ['uxlist'], ['name', 'active', 'sys_scope'], wrap, { singular: 'workspace list', scopeValidation: true, readOnly: true, devAlias: false });
-export const uxapplicabilityCmd = (wrap) => buildDevCmd('uxapplicability', 'sys_ux_applicability_m2m', ['uxapp'], ['name', 'active', 'sys_scope'], wrap, { singular: 'workspace applicability', scopeValidation: true, readOnly: true, devAlias: false });
+export const uxlistsCmd = (wrap) => buildDevCmd('uxlists', 'sys_ux_list', ['uxlist'], ['name', 'active', 'sys_scope'], wrap, { singular: 'workspace list', scopeValidation: true, readOnly: true });
+export const uxapplicabilityCmd = (wrap) => buildDevCmd('uxapplicability', 'sys_ux_applicability_m2m', ['uxapp'], ['name', 'active', 'sys_scope'], wrap, { singular: 'workspace applicability', scopeValidation: true, readOnly: true });
 export { uipoliciesCmd } from './uipolicies.js';
 export const cataloguipoliciesCmd = (wrap) => buildDevCmd('cataloguipolicies', 'catalog_ui_policy', ['cataloguipolicy', 'cup'], ['short_description', 'catalog_item', 'variable_set', 'active', 'sys_scope'], wrap, { singular: 'catalog UI policy', scopeValidation: true });

package/src/commands/_ticket.js

@@ -8,7 +8,7 @@ import { declareCapabilities } from '../capabilities.js';
 
 export function buildTicketCommands(table, displayName, alias, defaultColumns, stateMap, iconFn, wrap) {
   // Ticket-style CRUD: list/show are reads; create/update/delete mutate.
-  // Root-level only (no `jsn dev` spelling).
+  // Root-level command only.
   declareCapabilities(displayName, { mutationSubcommands: ['create', 'update', 'delete'] });
   return {
     command: `${displayName} [subcommand]`,

package/src/commands/{dev/aliases.js → aliases.js}

@@ -1,5 +1,5 @@
 import { buildDevCmd } from './_generic.js';
-import { getStringField } from '../../helpers.js';
+import { getStringField } from '../helpers.js';
 
 export const aliasesCmd = (wrap) => buildDevCmd('aliases', 'sys_alias', ['alias', 'als'],
   ['name', 'table', 'sys_scope'], wrap, {

package/src/commands/auth.js

@@ -326,7 +326,7 @@ export async function loginWizard(app, argv = {}) {
       // Probe domain separation capability once and stamp the profile, so
       // `jsn domains` (and its help entry) only appear on instances with it.
       try {
-        const domainsMod = await import('./dev/domains.js');
+        const domainsMod = await import('./domains.js');
         const sdk = app.getSDKForProfile
           ? app.getSDKForProfile(instance, {
             profile,
@@ -436,14 +436,14 @@ export async function modifyProfile(app, argv = {}) {
       app.ok({ profile: name, domain: '' }, { summary: `Domain cleared for ${name}` });
       return;
     }
-    const { isDomainSeparationInstalled } = await import('./dev/domains.js');
+    const { isDomainSeparationInstalled } = await import('./domains.js');
     const sdk = app.getSDKForProfile
       ? app.getSDKForProfile(profile.instance_url, { profile, authMethod: profile.auth_method, username: profile.username })
       : app.sdk;
     if (!(await isDomainSeparationInstalled({ sdk }))) {
       throw new Error(`Domain separation is not installed on ${profile.instance_url}`);
     }
-    const { resolveDomainSysId } = await import('./dev/domains.js');
+    const { resolveDomainSysId } = await import('./domains.js');
     const sysID = await resolveDomainSysId({ sdk }, argv.domain);
     profile.domain = sysID;
     await saveConfig(app.config);
@@ -472,7 +472,7 @@ export async function modifyProfile(app, argv = {}) {
       choices,
     });
     if (flag === 'domain') {
-      const domainsMod = await import('./dev/domains.js');
+      const domainsMod = await import('./domains.js');
       const installed = await domainsMod.isDomainSeparationInstalled({ sdk });
       if (!installed) {
         throw new Error(`Domain separation is not installed on ${profile.instance_url}`);
@@ -948,7 +948,7 @@ Examples:
             // Re-probe domain separation on refresh so the capability flag
             // stays in sync if the plugin was installed/removed since setup.
             try {
-              const { isDomainSeparationInstalled } = await import('./dev/domains.js');
+              const { isDomainSeparationInstalled } = await import('./domains.js');
               const sdk = app.getSDKForProfile
                 ? app.getSDKForProfile(instanceURL, {
                   ...targetAuthOptions,

package/src/commands/{dev/b4rules.js → b4rules.js}

@@ -2,4 +2,4 @@ import { buildDevCmd } from './_generic.js';
 
 // Before-query business rules — applies filters to GlideRecord queries before they execute.
 // These are sys_script records with order < 100.
-export const b4rulesCmd = (wrap) => buildDevCmd('b4rules', 'sys_script', ['b4rule'], ['name', 'collection', 'active', 'order', 'sys_scope'], wrap, { singular: 'before-query business rule', scopeValidation: true, extraQuery: 'when=before', devAlias: false });
+export const b4rulesCmd = (wrap) => buildDevCmd('b4rules', 'sys_script', ['b4rule'], ['name', 'collection', 'active', 'order', 'sys_scope'], wrap, { singular: 'before-query business rule', scopeValidation: true, extraQuery: 'when=before' });

package/src/commands/decisiontables.js

@@ -8,7 +8,7 @@ import { declareCapabilities } from '../capabilities.js';
 export const decisiontablesCmd = (wrap) => {
   const name = 'decisiontables';
   const singular = 'decision table';
-  declareCapabilities(name, { mutationSubcommands: ['create', 'update', 'delete'], devAlias: false });
+  declareCapabilities(name, { mutationSubcommands: ['create', 'update', 'delete'] });
 
   const readData = (argv) => {
     if (argv.dataFile) return fs.readFileSync(argv.dataFile, 'utf8');

package/src/commands/{dev/domains.js → domains.js}

@@ -10,11 +10,11 @@
 // via the `X-Now-Domain` header — the same scoping the platform applies
 // to its own picker sessions.
 
-import { getStringField, interactiveList, assertSafeExactMatch } from '../../helpers.js';
-import { declareCapabilities } from '../../capabilities.js';
+import { getStringField, interactiveList, assertSafeExactMatch } from '../helpers.js';
+import { declareCapabilities } from '../capabilities.js';
 
 // `domains set` writes the chosen domain into the profile config.
-declareCapabilities('domains', { mutationSubcommands: ['set'], devAlias: true });
+declareCapabilities('domains', { mutationSubcommands: ['set'] });
 
 const DETAIL_FIELDS = 'sys_id,name,parent,sys_domain_path,description,active,sys_created_on,sys_updated_on';
 

package/src/commands/{dev/eval.js → eval.js}

@@ -1,10 +1,10 @@
 import fs from 'node:fs';
-import { getCurrentUser, getCurrentApplication } from '../../context.js';
-import { declareCapabilities } from '../../capabilities.js';
+import { getCurrentUser, getCurrentApplication } from '../context.js';
+import { declareCapabilities } from '../capabilities.js';
 
 // The whole command is a mutation surface (runs arbitrary server-side JS) —
-// declared as `['']` so both `jsn eval` and `jsn dev eval` are gated.
-declareCapabilities('eval', { mutationSubcommands: [''], devAlias: true });
+// declared as `['']` so the root `jsn eval` command are gated.
+declareCapabilities('eval', { mutationSubcommands: [''] });
 
 export function evalCmd(wrap) {
   return {

package/src/commands/{dev/flows.js → flows.js}

@@ -1,9 +1,9 @@
-import { formatRecordForDisplay, getStringField, interactiveList } from '../../helpers.js';
-import { discoverFlowContextFields, normalizeFlowContext, summarizeFlowContexts, formatFlowContextSummary, aggregateFlowContextMappings, mergeFlowContextStats, buildFlowContextQuery } from '../../flow-context.js';
-import { declareCapabilities } from '../../capabilities.js';
-import { inspectFlow } from '../../flow-inspection.js';
-import { publishFlows, publishDoctor, flowStatus } from '../../flow-publish.js';
-import { resolveRecord, unwrapSysId } from '../../resolve-record.js';
+import { formatRecordForDisplay, getStringField, interactiveList } from '../helpers.js';
+import { discoverFlowContextFields, normalizeFlowContext, summarizeFlowContexts, formatFlowContextSummary, aggregateFlowContextMappings, mergeFlowContextStats, buildFlowContextQuery } from '../flow-context.js';
+import { declareCapabilities } from '../capabilities.js';
+import { inspectFlow } from '../flow-inspection.js';
+import { publishFlows, publishDoctor, flowStatus } from '../flow-publish.js';
+import { resolveRecord, unwrapSysId } from '../resolve-record.js';
 
 function flowInspectionAdapter(app) {
   return {
@@ -12,7 +12,7 @@ function flowInspectionAdapter(app) {
   };
 }
 
-declareCapabilities('flows', { mutationSubcommands: ['create', 'update', 'delete', 'publish'], devAlias: true });
+declareCapabilities('flows', { mutationSubcommands: ['create', 'update', 'delete', 'publish'] });
 
 function renderChecks(checks) {
   return checks.map((c) => {

package/src/commands/{dev/forms.js → forms.js}

@@ -1,4 +1,4 @@
-import { getStringField, interactiveList } from '../../helpers.js';
+import { getStringField, interactiveList } from '../helpers.js';
 
 function getDisplayValue(record, key) {
   if (!record || typeof record !== 'object') return '';

package/src/commands/{dev/import.js → import.js}

@@ -1,5 +1,5 @@
 import { buildDevCmd } from './_generic.js';
-import { getStringField } from '../../helpers.js';
+import { getStringField } from '../helpers.js';
 
 export const importCmd = (wrap) => buildDevCmd('import', 'sys_import_set', ['imports', 'imp'],
   ['name', 'sys_target_table', 'state', 'sys_created_on'], wrap, {

package/src/commands/{dev/lists.js → lists.js}

@@ -1,4 +1,4 @@
-import { getStringField, interactiveList } from '../../helpers.js';
+import { getStringField, interactiveList } from '../helpers.js';
 
 export function listsCmd(wrap) {
   return {

package/src/commands/{dev/logs.js → logs.js}

@@ -1,4 +1,4 @@
-import { formatRecordForDisplay, interactiveList, getStringField } from '../../helpers.js';
+import { formatRecordForDisplay, interactiveList, getStringField } from '../helpers.js';
 
 function logIcon(level) {
   level = (level || '').toLowerCase();

package/src/commands/{dev/rest.js → rest.js}

@@ -1,8 +1,8 @@
-import { declareCapabilities } from '../../capabilities.js';
+import { declareCapabilities } from '../capabilities.js';
 
 // Raw REST passthrough — can hit any endpoint with any method, so the whole
-// command is a mutation surface on read-only profiles (both spellings).
-declareCapabilities('rest', { mutationSubcommands: [''], devAlias: true });
+// command is a mutation surface on read-only profiles.
+declareCapabilities('rest', { mutationSubcommands: [''] });
 
 export function restCmd(wrap) {
   return {

package/src/commands/{dev/restmessage.js → restmessage.js}

@@ -1,11 +1,10 @@
 import { buildDevCmd } from './_generic.js';
-import { getStringField } from '../../helpers.js';
+import { getStringField } from '../helpers.js';
 
 export const restmessageCmd = (wrap) => buildDevCmd('restmessage', 'sys_rest_message', ['rm', 'restmsg'],
   ['name', 'endpoint', 'active', 'sys_scope'], wrap, {
     singular: 'REST message',
     scopeValidation: true,
-    devAlias: false,
     onShow: async (record, app) => {
       const sysID = getStringField(record, 'sys_id') || '';
       if (!sysID) return;

package/src/commands/{dev/scopes.js → scopes.js}

@@ -1,9 +1,9 @@
-import { formatRecordForDisplay, getStringField, interactiveList, assertSafeExactMatch } from '../../helpers.js';
-import { requireCurrentUserSysId, setCurrentApplication } from '../../context.js';
-import { declareCapabilities } from '../../capabilities.js';
-import { unwrapSysId } from '../../resolve-record.js';
+import { formatRecordForDisplay, getStringField, interactiveList, assertSafeExactMatch } from '../helpers.js';
+import { requireCurrentUserSysId, setCurrentApplication } from '../context.js';
+import { declareCapabilities } from '../capabilities.js';
+import { unwrapSysId } from '../resolve-record.js';
 
-declareCapabilities('scopes', { mutationSubcommands: ['create', 'set'], devAlias: true });
+declareCapabilities('scopes', { mutationSubcommands: ['create', 'set'] });
 
 /**
  * Resolve a scope identifier to a single sys_scope record.

package/src/commands/{dev/scrapi.js → scrapi.js}

@@ -8,13 +8,13 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { formatRecordForDisplay, getStringField, isHexString } from '../../helpers.js';
-import { errUsageHint } from '../../errors.js';
-import { declareCapabilities } from '../../capabilities.js';
+import { formatRecordForDisplay, getStringField, isHexString } from '../helpers.js';
+import { errUsageHint } from '../errors.js';
+import { declareCapabilities } from '../capabilities.js';
 
 // `scrapi create` builds a full Scripted REST API in one call (list/show are
-// reads). Registered at root and under `jsn dev`.
-declareCapabilities('scrapi', { mutationSubcommands: ['create'], devAlias: true });
+// reads). Registered at the root.
+declareCapabilities('scrapi', { mutationSubcommands: ['create'] });
 
 /**
  * Parse a --resource flag value of the form:

package/src/commands/{dev/soapmessages.js → soapmessages.js}

@@ -1,11 +1,10 @@
 import { buildDevCmd } from './_generic.js';
-import { getStringField } from '../../helpers.js';
+import { getStringField } from '../helpers.js';
 
 export const soapmessagesCmd = (wrap) => buildDevCmd('soapmessages', 'sys_soap_message', ['soapmsg'],
   ['name', 'active', 'sys_scope'], wrap, {
     singular: 'SOAP message',
     scopeValidation: true,
-    devAlias: false,
     onShow: async (record, app) => {
       const sysID = getStringField(record, 'sys_id') || '';
       if (!sysID) return;

package/src/commands/{dev/uipolicies.js → uipolicies.js}

@@ -1,5 +1,5 @@
 import { buildDevCmd } from './_generic.js';
-import { getStringField } from '../../helpers.js';
+import { getStringField } from '../helpers.js';
 
 export const uipoliciesCmd = (wrap) => buildDevCmd('uipolicies', 'sys_ui_policy', ['uipolicy', 'up'],
   ['short_description', 'table', 'sys_class_name', 'active'], wrap, {

package/src/commands/{dev/updatesets.js → updatesets.js}

@@ -1,12 +1,11 @@
 import fs from 'node:fs';
-import { formatRecordForDisplay, getStringField, interactiveList, assertSafeExactMatch } from '../../helpers.js';
-import { getCurrentApplication, getCurrentUpdateSet, requireCurrentUserSysId, setCurrentApplication, setCurrentUpdateSet } from '../../context.js';
-import { errAPI, errUsage } from '../../errors.js';
-import { declareCapabilities } from '../../capabilities.js';
+import { formatRecordForDisplay, getStringField, interactiveList, assertSafeExactMatch } from '../helpers.js';
+import { getCurrentApplication, getCurrentUpdateSet, requireCurrentUserSysId, setCurrentApplication, setCurrentUpdateSet } from '../context.js';
+import { errAPI, errUsage } from '../errors.js';
+import { declareCapabilities } from '../capabilities.js';
 
 declareCapabilities('updatesets', {
   mutationSubcommands: ['create', 'set', 'complete', 'ignore', 'parent'],
-  devAlias: true,
 });
 
 /**

package/src/sdk.js

@@ -29,9 +29,11 @@ export class SDKClient {
     this.authProvider = authProvider;
     this.timeout = opts.timeout || DEFAULT_TIMEOUT;
     this.domain = opts.domain || '';
+    this.oauthCookies = null;
+    this.sessionUserToken = '';
   }
 
-  async _setAuth(req) {
+  async _setAuth(req, { skipOAuthSession = false } = {}) {
     if (!this.authProvider) {
       throw errAuth('No authentication configured');
     }
@@ -41,10 +43,22 @@ export class SDKClient {
     }
     switch (creds.auth_method) {
       case 'basic':
+        if (!skipOAuthSession) {
+          const cookies = await this._warmSession();
+          if (cookies) {
+            req.headers.set('Cookie', cookies);
+            if (this.sessionUserToken) req.headers.set('X-UserToken', this.sessionUserToken);
+            break;
+          }
+        }
         req.headers.set('Authorization', 'Basic ' + Buffer.from(`${creds.username}:${creds.password}`).toString('base64'));
         break;
       case 'token':
       case 'oauth':
+        if (!skipOAuthSession) {
+          const cookies = await this._warmSession();
+          if (cookies) req.headers.set('Cookie', cookies);
+        }
         req.headers.set('Authorization', `Bearer ${creds.access_token}`);
         break;
       case 'gck':
@@ -113,7 +127,7 @@ export class SDKClient {
     const timer = setTimeout(() => controller.abort(), this.timeout);
     try {
       const req = new Request(endpoint, { ...opts, signal: controller.signal });
-      await this._setAuth(req);
+      await this._setAuth(req, { skipOAuthSession: true });
       return await fetch(req);
     } finally {
       clearTimeout(timer);
@@ -780,15 +794,52 @@ export class SDKClient {
   }
 
   async _warmSession() {
+    if (this.oauthCookies) return this.oauthCookies;
     try {
-      const endpoint = `${this.baseURL}/api/now/table/sys_user?sysparm_limit=1`;
-      const resp = await this._fetchWithAuth(endpoint, { method: 'GET', headers: { Accept: 'application/json' } });
-      // Extract cookies for subsequent UI page requests
-      const setCookie = resp.headers.getSetCookie?.() || resp.headers.get('set-cookie');
-      if (setCookie) {
-        return Array.isArray(setCookie) ? setCookie.join('; ') : setCookie;
+      const creds = await this.authProvider.getCredentials();
+      if (creds.auth_method === 'oauth') {
+        let cookies = '';
+        const collectCookies = (resp) => {
+          const values = resp.headers.getSetCookie?.() || [];
+          const raw = Array.isArray(values) ? values : [resp.headers.get('set-cookie')].filter(Boolean);
+          const next = raw.map(value => value.split(';', 1)[0]).filter(Boolean);
+          if (next.length) cookies = [...new Set(`${cookies}; ${next.join('; ')}`.split(';').map(v => v.trim()).filter(Boolean))].join('; ');
+        };
+        const login = `${this.baseURL}/angular.do?sysparm_type=get_user`;
+        collectCookies(await fetch(new Request(login, { method: 'POST' })));
+        const scopeEndpoint = `${this.baseURL}/api/now/table/sys_scope?sysparm_fields=sys_id%2Csys_class_name&sysparm_limit=1`;
+        collectCookies(await this._fetchWithAuth(scopeEndpoint, {
+          method: 'GET',
+          headers: cookies ? { Cookie: cookies } : {},
+        }));
+        collectCookies(await this._fetchWithAuth(login, {
+          method: 'POST',
+          headers: cookies ? { Cookie: cookies } : {},
+        }));
+        this.oauthCookies = cookies;
+        return cookies;
       }
-      return '';
+      const endpoint = `${this.baseURL}/angular.do`;
+      const loginResp = await this._fetchWithAuth(`${endpoint}?sysparm_type=view_form.login`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          sysparm_type: 'login',
+          'ni.nolog.user_password': 'true',
+          user_name: creds.username,
+          user_password: creds.password,
+        }).toString(),
+      });
+      const values = loginResp.headers.getSetCookie?.() || [];
+      const raw = Array.isArray(values) ? values : [loginResp.headers.get('set-cookie')].filter(Boolean);
+      const cookies = raw.map(value => value.split(';', 1)[0]).filter(Boolean).join('; ');
+      const refreshResp = await this._fetchWithAuth(`${endpoint}?sysparm_type=get_user`, {
+        method: 'POST',
+        headers: cookies ? { Cookie: cookies } : {},
+      });
+      this.sessionUserToken = refreshResp.headers.get('x-usertoken-response') || '';
+      this.oauthCookies = cookies;
+      return cookies;
     } catch {
       return '';
     }

package/src/commands/dev.js

@@ -1,82 +0,0 @@
-// Parent dev command
-
-import {
-  actionsCmd, includesCmd, rulesCmd,
-  clientScriptsCmd, uiActionsCmd,
-  tablesCmd, columnsCmd, importCmd,
-  spPagesCmd, spWidgetsCmd, uiPagesCmd, appMenuCmd,
-  aclsCmd, rolesCmd, propertiesCmd,
-  relationshipsCmd, appmodulesCmd, listcontrolsCmd, viewsCmd,
-  privilegesCmd, uxscriptsCmd, aliasesCmd,
-  catalogscriptsCmd, cataloguipoliciesCmd,
-  uipoliciesCmd,
-} from './dev/_simple.js';
-import { flowsCmd } from './dev/flows.js';
-import { formsCmd } from './dev/forms.js';
-import { listsCmd } from './dev/lists.js';
-import { updateSetsCmd } from './dev/updatesets.js';
-import { scopesCmd } from './dev/scopes.js';
-import { domainsCmd } from './dev/domains.js';
-import { evalCmd } from './dev/eval.js';
-import { restCmd } from './dev/rest.js';
-import { logsCmd } from './dev/logs.js';
-import { scrapiCmd } from './dev/scrapi.js';
-
-export function devCmd(wrap) {
-  return {
-    command: 'dev [subcommand]',
-    describe: 'Manage ServiceNow development artifacts',
-    builder: (yargs) => {
-      return yargs
-        .command(flowsCmd(wrap))
-        .command(actionsCmd(wrap))
-        .command(includesCmd(wrap))
-        .command(rulesCmd(wrap))
-        .command(clientScriptsCmd(wrap))
-        .command(uiActionsCmd(wrap))
-        .command(uipoliciesCmd(wrap))
-        .command(tablesCmd(wrap))
-        .command(columnsCmd(wrap))
-        .command(formsCmd(wrap))
-        .command(listsCmd(wrap))
-        .command(importCmd(wrap))
-        .command(spPagesCmd(wrap))
-        .command(spWidgetsCmd(wrap))
-        .command(uiPagesCmd(wrap))
-        .command(appMenuCmd(wrap))
-        .command(scrapiCmd(wrap))
-        .command(aclsCmd(wrap))
-        .command(rolesCmd(wrap))
-        .command(updateSetsCmd(wrap))
-        .command(scopesCmd(wrap))
-        .command(domainsCmd(wrap))
-        .command(propertiesCmd(wrap))
-        .command(relationshipsCmd(wrap))
-        .command(appmodulesCmd(wrap))
-        .command(listcontrolsCmd(wrap))
-        .command(viewsCmd(wrap))
-        .command(privilegesCmd(wrap))
-        .command(uxscriptsCmd(wrap))
-        .command(aliasesCmd(wrap))
-        .command(catalogscriptsCmd(wrap))
-        .command(cataloguipoliciesCmd(wrap))
-        .command(logsCmd(wrap))
-        .command(evalCmd(wrap))
-        .command(restCmd(wrap));
-    },
-    handler: (argv) => {
-      if (argv._[1]) return; // a subcommand ran — its own handler handled it
-      console.log('Manage ServiceNow development artifacts.');
-      console.log('');
-      console.log('Most dev commands are also available at the top level:');
-      console.log('  flows, actions, rules, clientscripts, uiactions, uipolicies,');
-      console.log('  tables, columns, forms, lists, import, sppages, spwidgets,');
-      console.log('  uipages, appmenu, scrapi, acls, roles, properties,');
-      console.log('  relationships, appmodules, listcontrols, views, privileges,');
-      console.log('  uxscripts, aliases, catalogscripts, cataloguipolicies, logs,');
-      console.log('  updatesets, scopes, eval, rest');
-      console.log('');
-      console.log('Run "jsn dev <command> --help" or "jsn <command> --help" for details.');
-    },
-  };
-}