@snutils/snu 0.2.11 → 0.2.12

package/dist/server/bridgeIdentity.js

@@ -0,0 +1,120 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadBridgeId = loadBridgeId;
+exports.inspectBridgeId = inspectBridgeId;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+/**
+ * A stable identity for "the ScriptSync bridge of this user on this machine".
+ *
+ * The SN Utils helper tab re-sends ServiceNow session tokens on its own when it
+ * reconnects, but only to a bridge the user has handed a token to before. This
+ * id is how it recognises that bridge after a restart: it is created once,
+ * kept private to the user under ~/.sn-scriptsync, and shared by the VS Code
+ * host and the standalone snu bridge so switching hosts does not reset trust.
+ *
+ * Returns an empty string when the file cannot be read or created. The helper
+ * then never refreshes automatically and a manual /token is needed, which is
+ * the behaviour from before this existed.
+ */
+function loadBridgeId(dir = path.join(os.homedir(), ".sn-scriptsync")) {
+    const file = path.join(dir, "bridge-id");
+    const read = () => {
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink())
+            return "";
+        // Existing files need the same privacy as newly created ones.
+        if (process.platform !== "win32")
+            fs.chmodSync(file, 0o600);
+        const id = fs.readFileSync(file, "utf8").trim();
+        return /^[a-f0-9]{64}$/.test(id) ? id : "";
+    };
+    try {
+        return read();
+    }
+    catch (err) {
+        if (err.code !== "ENOENT")
+            return "";
+    }
+    let temporary = "";
+    try {
+        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+        const id = crypto.randomBytes(32).toString("hex");
+        temporary = path.join(dir, `.bridge-id-${crypto.randomBytes(16).toString("hex")}`);
+        fs.writeFileSync(temporary, id + "\n", { mode: 0o600, flag: "wx" });
+        // Publish only a complete file, without replacing another host's identity.
+        try {
+            fs.linkSync(temporary, file);
+        }
+        catch (err) {
+            if (err.code !== "EEXIST")
+                return "";
+        }
+        return read();
+    }
+    catch {
+        return "";
+    }
+    finally {
+        if (temporary) {
+            try {
+                fs.unlinkSync(temporary);
+            }
+            catch { /* best effort */ }
+        }
+    }
+}
+/**
+ * Read-only look at the identity file, for diagnostics. Unlike loadBridgeId it
+ * never creates the file or changes its mode, and it never returns the id.
+ */
+function inspectBridgeId(dir = path.join(os.homedir(), ".sn-scriptsync")) {
+    const file = path.join(dir, "bridge-id");
+    try {
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink())
+            return { status: "not-a-file", private: null };
+        const isPrivate = process.platform === "win32" ? null : (stat.mode & 0o077) === 0;
+        const id = fs.readFileSync(file, "utf8").trim();
+        return { status: /^[a-f0-9]{64}$/.test(id) ? "ok" : "invalid", private: isPrivate };
+    }
+    catch (err) {
+        return { status: err.code === "ENOENT" ? "missing" : "unreadable", private: null };
+    }
+}
+//# sourceMappingURL=bridgeIdentity.js.map

package/dist/server/bridgeIdentity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridgeIdentity.js","sourceRoot":"","sources":["../../src/server/bridgeIdentity.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkBA,oCA6BC;AAQD,0CAWC;AAlED,+CAAiC;AACjC,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAE7B;;;;;;;;;;;;GAYG;AACH,SAAgB,YAAY,CAAC,MAAc,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,gBAAgB,CAAC;IACnF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,GAAW,EAAE;QACzB,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,OAAO,EAAE,CAAC;QACvD,8DAA8D;QAC9D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5D,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,OAAO,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,CAAC,CAAC;IACF,IAAI,CAAC;QAAC,OAAO,IAAI,EAAE,CAAC;IAAC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACnC,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,CAAC;QACJ,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClD,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnF,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,2EAA2E;QAC3E,IAAI,CAAC;YAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAClD,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAC;QACjE,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;YAAS,CAAC;QACV,IAAI,SAAS,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAAC,CAAC;IACjF,CAAC;AACF,CAAC;AAID;;;GAGG;AACH,SAAgB,eAAe,CAAC,MAAc,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,gBAAgB,CAAC;IACtF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACzC,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC5F,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAClF,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACrF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO,EAAE,MAAM,EAAG,GAA6B,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC/G,CAAC;AACF,CAAC"}

package/dist/server/dispatcher.d.ts

@@ -40,7 +40,6 @@ export declare class StandaloneDispatcher {
     private resolveScopeForCreate;
     listInstanceFolders(): string[];
     private pullTablePage;
-    private allCodeTables;
     private restGet;
     resolveInstance(requestInstance?: string): {
         name: string;

package/dist/server/dispatcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../../src/server/dispatcher.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAA0B,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAoB,aAAa,EAAE,MAAM,aAAa,CAAC;AAiD9D,eAAO,MAAM,uBAAuB,UAInC,CAAC;AAwGF,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAoBxE;AAwBD,MAAM,WAAW,2BAA2B;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAC,aAAa,GAAG;QAAE,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAClE;AAED,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,GAAG,CAAS;IACpB,OAAO,CAAC,EAAE,CAAqB;IAC/B,OAAO,CAAC,OAAO,CAAkB;IACjC,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,qBAAqB,CAA6B;IAC1D,OAAO,CAAC,wBAAwB,CAA6B;gBAEjD,IAAI,EAAE,2BAA2B;IAO7C,gBAAgB,IAAI,MAAM;IAI1B,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,GAAG;IAkBxC,sBAAsB,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;YAyDvC,yBAAyB;YAiDzB,sBAAsB;IA4BpC;;;;;;;OAOG;YACW,qBAAqB;IAmCnC,mBAAmB,IAAI,MAAM,EAAE;YAgBjB,aAAa;IAkK3B,OAAO,CAAC,aAAa;YASP,OAAO;IAmBrB,eAAe,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,GAAG,CAAA;KAAE;IA+E1F,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,SAAc,GAAG,IAAI;IAa/C,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC;CAg8B1D"}
+{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../../src/server/dispatcher.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAA0B,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAoB,aAAa,EAAE,MAAM,aAAa,CAAC;AAiD9D,eAAO,MAAM,uBAAuB,UAInC,CAAC;AAwGF,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAoBxE;AAwBD,MAAM,WAAW,2BAA2B;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAC,aAAa,GAAG;QAAE,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAClE;AAED,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,GAAG,CAAS;IACpB,OAAO,CAAC,EAAE,CAAqB;IAC/B,OAAO,CAAC,OAAO,CAAkB;IACjC,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,qBAAqB,CAA6B;IAC1D,OAAO,CAAC,wBAAwB,CAA6B;gBAEjD,IAAI,EAAE,2BAA2B;IAO7C,gBAAgB,IAAI,MAAM;IAI1B,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,GAAG;IAkBxC,sBAAsB,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;YAyDvC,yBAAyB;YAiDzB,sBAAsB;IA4BpC;;;;;;;OAOG;YACW,qBAAqB;IAmCnC,mBAAmB,IAAI,MAAM,EAAE;YAgBjB,aAAa;YAwKb,OAAO;IAoBrB,eAAe,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,GAAG,CAAA;KAAE;IAuF1F,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,SAAc,GAAG,IAAI;IAa/C,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC;CAi8B1D"}

package/dist/server/dispatcher.js

@@ -35,6 +35,8 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.StandaloneDispatcher = exports.HELPER_CONNECT_GUIDANCE = void 0;
 exports.resolveMappedFileName = resolveMappedFileName;
+const authProbe_js_1 = require("./authProbe.js");
+const scopeDiscovery_js_1 = require("./scopeDiscovery.js");
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
@@ -166,11 +168,11 @@ function resolveTableCodeFields(tableName, cwd) {
     }
     return ['script'];
 }
-function resolveFieldExtension(tableName, fieldName, cwd) {
+function resolveFieldExtension(tableName, fieldName, cwd, liveType) {
     const meta = getMetaDataRelations(cwd);
     let fieldType = 'script';
     try {
-        fieldType = meta?.tableFields?.[tableName]?.codeFields?.[fieldName]?.type || fieldName;
+        fieldType = liveType || meta?.tableFields?.[tableName]?.codeFields?.[fieldName]?.type || fieldName;
     }
     catch { }
     let ext = FIELDTYPES[fieldType]?.extension;
@@ -475,7 +477,7 @@ class StandaloneDispatcher {
             sysparm_offset: String(offset),
             sysparm_display_value: 'false',
             sysparm_exclude_reference_link: 'true',
-            sysparm_no_count: 'true',
+            sysparm_no_count: 'false',
         };
         if (combinedQuery) {
             queryParams.sysparm_query = combinedQuery;
@@ -499,6 +501,7 @@ class StandaloneDispatcher {
         const isFolderRecordTable = FOLDERRECORDTABLES.includes(table);
         let filesWritten = 0;
         let skippedEmpty = 0;
+        let skippedUnreadable = 0;
         const warnings = [];
         const pulledRecordsList = [];
         for (const rec of matchedRecords) {
@@ -553,7 +556,12 @@ class StandaloneDispatcher {
             }
             const recordFiles = [];
             for (const field of codeFields) {
-                const ext = resolveFieldExtension(table, field, this.cwd);
+                if (!Object.prototype.hasOwnProperty.call(rec, field)) {
+                    skippedUnreadable++;
+                    warnings.push(`${table}/${sysId}.${field}: field not returned; local file preserved.`);
+                    continue;
+                }
+                const ext = resolveFieldExtension(table, field, this.cwd, opts.fieldDefinitions?.[field]?.type);
                 let targetPath;
                 try {
                     targetPath = isFolderRecordTable
@@ -603,27 +611,18 @@ class StandaloneDispatcher {
             });
         }
         return {
+            pagination: res.pagination,
             table,
             matchedRecords: matchedRecords.length,
             pulledRecords: pulledRecordsList.length,
             filesWritten,
             skippedEmpty,
+            skippedUnreadable,
             warnings,
             records: pulledRecordsList,
         };
     }
-    // Which artifact tables snu knows how to write to disk: the ones in
-    // resources/metaDataRelations.json that declare code fields.
-    allCodeTables() {
-        const meta = getMetaDataRelations(this.cwd);
-        const out = new Set();
-        for (const [table, def] of Object.entries(meta?.tableFields || {})) {
-            if (def?.codeFields && typeof def.codeFields === 'object')
-                out.add(table);
-        }
-        return out;
-    }
-    async restGet(inst, reqCommand, endpoint, queryParams) {
+    async restGet(inst, reqCommand, endpoint, queryParams, withPagination = false) {
         const correlationId = crypto.randomUUID();
         const pendingPromise = this.pending.register({ id: correlationId, command: reqCommand, timeoutMs: 70_000 });
         this.ws.sendToBrowser({
@@ -637,9 +636,10 @@ class StandaloneDispatcher {
         });
         const res = await pendingPromise;
         if (res?.success === false) {
-            throw Object.assign(new Error(res.error || `REST request failed: ${endpoint}`), { code: res.code || 'E_COMMAND_FAILED' });
+            const hint = res?.status ? '' : (0, authProbe_js_1.helperFailureHint)(typeof res?.error === 'string' ? res.error : '', inst.settings?.url);
+            throw Object.assign(new Error([res.error || `REST request failed: ${endpoint}`, hint].filter(Boolean).join(' ')), { code: res.code || 'E_COMMAND_FAILED' });
         }
-        return res?.data;
+        return withPagination ? { rows: res?.data?.result, pagination: res?.pagination } : res?.data;
     }
     resolveInstance(requestInstance) {
         const folders = this.listInstanceFolders();
@@ -680,8 +680,16 @@ class StandaloneDispatcher {
             if (live) {
                 return { name: live.name, folder: this.cwd, settings: live };
             }
-            throw Object.assign(new Error(`No authenticated instance named "${requestInstance}" is connected. Run /token on that ServiceNow instance and retry.`), {
+            const known = [
+                ...liveInstances.map((candidate) => `${candidate.name} (${candidate.url})`),
+                ...folders.map((folder) => path.basename(folder)),
+            ];
+            const knownText = known.length
+                ? ` Known here: ${[...new Set(known)].join(', ')}. Pass one of these as the instance, by name, hostname or origin.`
+                : ' This bridge has not received any session since it started.';
+            throw Object.assign(new Error(`No authenticated instance named "${requestInstance}" is connected.${knownText} Otherwise open that exact hostname in the browser, run /token and retry.`), {
                 code: 'E_INSTANCE_NOT_FOUND',
+                details: { requested: requestInstance, liveInstances: liveInstances.map((candidate) => ({ name: candidate.name, url: candidate.url })) },
             });
         }
         if (folders.length === 1) {
@@ -792,6 +800,18 @@ class StandaloneDispatcher {
                         message: 'The SN Utils helper tab is not connected, so the session cannot be checked.',
                     });
                 }
+                const hasLiveSession = !!origin && this.ws.getLiveInstances().some((live) => {
+                    try {
+                        return new URL(live.url).origin.toLowerCase() === origin;
+                    }
+                    catch {
+                        return false;
+                    }
+                });
+                if (!inst.settings?.g_ck) {
+                    const verdict = (0, authProbe_js_1.classifyProbe)({ error: 'Missing instance URL or authentication token', origin, hasLiveSession });
+                    return reply({ ok: false, state: verdict.state, message: verdict.message });
+                }
                 const correlationId = crypto.randomUUID();
                 const pendingPromise = this.pending.register({ id: correlationId, command: req.command, timeoutMs: 15_000 });
                 this.ws.sendToBrowser({
@@ -805,32 +825,25 @@ class StandaloneDispatcher {
                 });
                 try {
                     const res = await pendingPromise;
-                    const status = res?.status;
                     // 401 and 403 mean opposite things: the session is gone, versus the
-                    // session authenticated and an ACL refused the row.
-                    const state = res?.success === false
-                        ? status === 401
-                            ? 'AUTH_EXPIRED'
-                            : status === 403
-                                ? 'AUTH_OK'
-                                : 'AUTH_UNKNOWN'
-                        : 'AUTH_OK';
+                    // session authenticated and an ACL refused the row. Failures without
+                    // a status are classified from the helper tab's own error text.
+                    const verdict = res?.success === false
+                        ? (0, authProbe_js_1.classifyProbe)({ status: res?.status, error: typeof res?.error === 'string' ? res.error : res?.error?.message, origin, hasLiveSession })
+                        : (0, authProbe_js_1.classifyProbe)({ status: 200, origin, hasLiveSession });
                     return reply({
-                        ok: state === 'AUTH_OK',
-                        state,
-                        message: state === 'AUTH_OK'
-                            ? 'ServiceNow accepted the session.'
-                            : state === 'AUTH_EXPIRED'
-                                ? 'ServiceNow rejected the session (401). Open the instance in the browser and run /token to refresh it.'
-                                : 'The session check could not complete. This is not a verdict — retry before acting on it.',
+                        ok: verdict.state === 'AUTH_OK',
+                        state: verdict.state,
+                        message: verdict.message,
                         detail: res?.error,
                     });
                 }
                 catch (err) {
+                    const verdict = (0, authProbe_js_1.classifyProbe)({ status: err?.details?.status, error: err?.message || String(err), origin, hasLiveSession });
                     return reply({
                         ok: false,
-                        state: 'AUTH_UNKNOWN',
-                        message: 'The session check could not complete. This is not a verdict — retry before acting on it.',
+                        state: verdict.state,
+                        message: verdict.message,
                         detail: err?.message || String(err),
                     });
                 }
@@ -1427,64 +1440,66 @@ class StandaloneDispatcher {
                     }
                     catch { }
                 }
-                // Which artifact tables does this application actually use?
+                const fetchPage = (table, query) => this.restGet(inst, req.command, `/api/now/table/${table}`, query, true);
+                const discovery = await (0, scopeDiscovery_js_1.readAllPages)(fetchPage, 'sys_metadata', `sys_scope=${scopeSysId}^sys_class_name!=sys_metadata_delete^sys_update_name!=NULL^ORDERBYsys_id`, 'sys_class_name');
                 const classCounts = new Map();
-                const metaPage = 1000;
-                for (let offset = 0;; offset += metaPage) {
-                    const data = await this.restGet(inst, req.command, '/api/now/table/sys_metadata', {
-                        sysparm_query: `sys_scope=${scopeSysId}^sys_class_name!=sys_metadata_delete^sys_update_name!=NULL^ORDERBYsys_id`,
-                        sysparm_fields: 'sys_class_name',
-                        sysparm_limit: String(metaPage),
-                        sysparm_offset: String(offset),
-                        sysparm_exclude_reference_link: 'true',
-                        sysparm_no_count: 'true',
-                    });
-                    const rows = Array.isArray(data?.result) ? data.result : [];
-                    for (const r of rows) {
-                        const cls = String(typeof r.sys_class_name === 'object' ? r.sys_class_name.value : r.sys_class_name || '');
-                        if (cls)
-                            classCounts.set(cls, (classCounts.get(cls) || 0) + 1);
-                    }
-                    if (rows.length < metaPage)
-                        break;
+                for (const row of discovery.rows) {
+                    const cls = String(typeof row.sys_class_name === 'object' ? row.sys_class_name.value : row.sys_class_name || '');
+                    if (/^[a-zA-Z0-9_]+$/.test(cls))
+                        classCounts.set(cls, (classCounts.get(cls) || 0) + 1);
                 }
-                const codeTables = this.allCodeTables();
-                const tables = [...classCounts.keys()].filter((t) => codeTables.has(t) && (!tableFilter || tableFilter.has(t))).sort();
-                const skippedTables = [...classCounts.keys()].filter((t) => !codeTables.has(t)).sort()
-                    .map((t) => ({ table: t, records: classCounts.get(t) || 0 }));
+                const schema = await (0, scopeDiscovery_js_1.discoverScopeFields)([...classCounts.keys()], getMetaDataRelations(this.cwd)?.tableFields || {}, fetchPage);
+                const tables = [...classCounts.keys()].filter(t => Object.keys(schema.definitions[t]?.codeFields || {}).length && (!tableFilter || tableFilter.has(t))).sort();
+                const skippedTables = [...classCounts.keys()].filter(t => !Object.keys(schema.definitions[t]?.codeFields || {}).length).sort()
+                    .map(table => ({ table, records: classCounts.get(table) || 0, reason: schema.warnings.some(w => w.startsWith(`${table}:`)) ? 'dictionary_unavailable' : 'no_scriptable_fields' }));
                 const missingTables = tableFilter ? [...tableFilter].filter((t) => !classCounts.has(t)).sort() : [];
                 const perTable = [];
-                const warnings = [];
-                let totalRecords = 0, totalFiles = 0, totalSkippedEmpty = 0;
+                const warnings = [...discovery.warnings, ...schema.warnings];
+                let complete = discovery.complete && schema.warnings.length === 0;
+                let totalRecords = 0, totalFiles = 0, totalSkippedEmpty = 0, totalSkippedUnreadable = 0;
                 for (const table of tables) {
-                    const codeFields = resolveTableCodeFields(table, this.cwd);
+                    const fieldDefinitions = schema.definitions[table].codeFields;
+                    const codeFields = Object.keys(fieldDefinitions);
                     const query = `sys_scope=${scopeSysId}^sys_class_name=${table}^ORDERBYsys_id`;
-                    const entry = { table, matchedRecords: 0, pulledRecords: 0, filesWritten: 0, skippedEmpty: 0, truncated: false };
+                    const entry = { table, matchedRecords: 0, pulledRecords: 0, filesWritten: 0, skippedEmpty: 0, skippedUnreadable: 0, truncated: false };
                     if (includeRecords)
                         entry.records = [];
-                    for (let offset = 0;; offset += PAGE) {
+                    let reportedTotal;
+                    for (let offset = 0;;) {
                         const pageLimit = Math.min(PAGE, limit - entry.matchedRecords);
                         if (pageLimit <= 0) {
                             entry.truncated = true;
                             break;
                         }
-                        const page = await this.pullTablePage(inst, req.command, { table, query, codeFields, limit: pageLimit, offset });
+                        const page = await this.pullTablePage(inst, req.command, { table, query, codeFields, fieldDefinitions, limit: pageLimit, offset });
+                        if (page.pagination?.totalCount && /^\d+$/.test(page.pagination.totalCount))
+                            reportedTotal = Number(page.pagination.totalCount);
                         entry.matchedRecords += page.matchedRecords;
                         entry.pulledRecords += page.pulledRecords;
                         entry.filesWritten += page.filesWritten;
                         entry.skippedEmpty += page.skippedEmpty;
+                        entry.skippedUnreadable += page.skippedUnreadable;
                         if (includeRecords)
                             entry.records.push(...page.records);
                         for (const w of page.warnings)
                             warnings.push(`${table}: ${w}`);
-                        if (page.matchedRecords < pageLimit)
+                        const paging = (0, scopeDiscovery_js_1.pageState)(page.pagination, offset, pageLimit, page.matchedRecords);
+                        if (paging.nextOffset === undefined) {
+                            complete = complete && paging.complete;
+                            if (paging.warning)
+                                warnings.push(`${table}: ${paging.warning}`);
                             break;
+                        }
+                        offset = paging.nextOffset;
                     }
+                    if (!entry.truncated && reportedTotal !== undefined && reportedTotal > entry.matchedRecords)
+                        warnings.push(`${table}: ${reportedTotal - entry.matchedRecords} matching records were not returned; access controls or changing records may account for the difference.`);
                     if (entry.truncated)
                         warnings.push(`${table}: stopped at the per-table limit of ${limit} records; raise "limit" or pull the rest with pull_records.`);
                     totalRecords += entry.pulledRecords;
                     totalFiles += entry.filesWritten;
                     totalSkippedEmpty += entry.skippedEmpty;
+                    totalSkippedUnreadable += entry.skippedUnreadable;
                     perTable.push(entry);
                 }
                 for (const t of missingTables)
@@ -1495,10 +1510,12 @@ class StandaloneDispatcher {
                     status: 'success',
                     timestamp: Date.now(),
                     result: {
+                        complete: complete && !perTable.some(t => t.truncated) && warnings.length === 0,
+                        metadataRecords: discovery.rows.length,
                         scope: { name: scopeName, sys_id: scopeSysId },
                         folder: path.join(inst.name, scopeName).replace(/\\/g, '/'),
                         tables: perTable,
-                        totals: { tables: perTable.length, records: totalRecords, filesWritten: totalFiles, skippedEmpty: totalSkippedEmpty },
+                        totals: { tables: perTable.length, records: totalRecords, filesWritten: totalFiles, skippedEmpty: totalSkippedEmpty, skippedUnreadable: totalSkippedUnreadable },
                         skippedTables,
                         warnings,
                     },