@sonisoft/now-sdk-ext-core 5.0.1 → 5.1.0

package/dist/PublicApi.d.ts

@@ -41,3 +41,11 @@ export { MessageClientBuilder } from './sn/amb/MessageClientBuilder.js';
 export type { SubscriptionCollection, Context } from './sn/amb/MessageClientBuilder.js';
 export { Channel } from './sn/amb/Channel.js';
 export { ChannelListener } from './sn/amb/ChannelListener.js';
+/**
+ * Not in the generated barrel, on purpose. ctix exports whatever a directory's
+ * index.ts re-exports, and a credentials/index.ts would make importing this
+ * library enough to monkeypatch the SDK's credential storage. Installing the
+ * shim has to stay an explicit call.
+ */
+export { initCredentialStore } from './credentials/ensureShim.js';
+export type { InitCredentialStoreResult } from './credentials/ensureShim.js';

package/dist/PublicApi.js

@@ -43,4 +43,11 @@ export { AMBClient } from './sn/amb/AMBClient.js';
 export { MessageClientBuilder } from './sn/amb/MessageClientBuilder.js';
 export { Channel } from './sn/amb/Channel.js';
 export { ChannelListener } from './sn/amb/ChannelListener.js';
+/**
+ * Not in the generated barrel, on purpose. ctix exports whatever a directory's
+ * index.ts re-exports, and a credentials/index.ts would make importing this
+ * library enough to monkeypatch the SDK's credential storage. Installing the
+ * shim has to stay an explicit call.
+ */
+export { initCredentialStore } from './credentials/ensureShim.js';
 //# sourceMappingURL=PublicApi.js.map

package/dist/PublicApi.js.map

@@ -1 +1 @@
-{"version":3,"file":"PublicApi.js","sourceRoot":"","sources":["../src/PublicApi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,+EAA+E;AAC/E,0EAA0E;AAC1E,qCAAqC;AACrC,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAE5E,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAExE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"PublicApi.js","sourceRoot":"","sources":["../src/PublicApi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,+EAA+E;AAC/E,0EAA0E;AAC1E,qCAAqC;AACrC,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAE5E,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAExE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D;;;;;GAKG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/credentials/ensureShim.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Opt-in headless credential storage for library consumers.
+ *
+ * Deliberately NOT a module side effect and NOT in the ctix-generated barrel:
+ * `import { anything } from '@sonisoft/now-sdk-ext-core'` must never monkeypatch
+ * the ServiceNow SDK's credential storage as a consequence. A consumer that
+ * wants the shim asks for it by calling this.
+ *
+ * Applications that own their entry point (nex, the MCP server) import
+ * '@sonisoft/sn-credstore/register' there instead — earlier, and unconditional.
+ * This exists for embedders that do not control process startup.
+ */
+export interface InitCredentialStoreResult {
+    /** True once the SDK's KeyChain is reading the headless-safe store. */
+    active: boolean;
+    /** Why it is not active, when it is not. */
+    reason?: 'not-installed' | 'disabled';
+}
+/**
+ * Point the ServiceNow SDK's credential storage at a headless-safe store.
+ *
+ * Non-interactive sessions cannot unlock the OS keyring even as the same user,
+ * and `KeyChain.getPassword()` swallows that failure and returns null — so the
+ * SDK reports "Default Credential has not been set" rather than a keyring error.
+ *
+ * Idempotent, and safe to call when @sonisoft/sn-credstore is not installed: it
+ * reports `active: false` and leaves the SDK on its default keyring path. Callers
+ * that require the store should check the result rather than assume success.
+ *
+ * Throws only when the shim IS installed and fails to apply — continuing then
+ * would silently fall back to the keyring, and the SDK's next credential write
+ * reseeds from a failed read, wiping every other alias.
+ */
+export declare function initCredentialStore(): Promise<InitCredentialStoreResult>;

package/dist/credentials/ensureShim.js

@@ -0,0 +1,71 @@
+/**
+ * Opt-in headless credential storage for library consumers.
+ *
+ * Deliberately NOT a module side effect and NOT in the ctix-generated barrel:
+ * `import { anything } from '@sonisoft/now-sdk-ext-core'` must never monkeypatch
+ * the ServiceNow SDK's credential storage as a consequence. A consumer that
+ * wants the shim asks for it by calling this.
+ *
+ * Applications that own their entry point (nex, the MCP server) import
+ * '@sonisoft/sn-credstore/register' there instead — earlier, and unconditional.
+ * This exists for embedders that do not control process startup.
+ */
+/**
+ * Absence is legitimate. A shim that loads and then fails is not.
+ *
+ * sn-credstore is an OPTIONAL dependency of this package, because core is a
+ * library: making it required would force a credential shim onto every consumer,
+ * including ones that never call initCredentialStore(). So it can genuinely be
+ * missing — `npm install --no-optional`, a pruned install, a bundler that dropped
+ * it — and that must degrade rather than throw.
+ */
+function isNotInstalled(error) {
+    const err = error;
+    return (err?.code === 'ERR_MODULE_NOT_FOUND' &&
+        // Only OUR specifier missing means "not installed". The same code from a
+        // broken import *inside* sn-credstore means it is installed and broken,
+        // which must not be mistaken for absence.
+        /@sonisoft[/\\]sn-credstore/.test(String(err.message)));
+}
+let cached;
+/**
+ * Point the ServiceNow SDK's credential storage at a headless-safe store.
+ *
+ * Non-interactive sessions cannot unlock the OS keyring even as the same user,
+ * and `KeyChain.getPassword()` swallows that failure and returns null — so the
+ * SDK reports "Default Credential has not been set" rather than a keyring error.
+ *
+ * Idempotent, and safe to call when @sonisoft/sn-credstore is not installed: it
+ * reports `active: false` and leaves the SDK on its default keyring path. Callers
+ * that require the store should check the result rather than assume success.
+ *
+ * Throws only when the shim IS installed and fails to apply — continuing then
+ * would silently fall back to the keyring, and the SDK's next credential write
+ * reseeds from a failed read, wiping every other alias.
+ */
+export async function initCredentialStore() {
+    if (cached)
+        return cached;
+    if (process.env.SN_CRED_STORE_DISABLE) {
+        cached = { active: false, reason: 'disabled' };
+        return cached;
+    }
+    try {
+        // Held in a variable so TypeScript does not try to resolve it. This
+        // package still compiles with moduleResolution "node", which predates and
+        // ignores `exports` maps, so a literal specifier for the ./register
+        // subpath fails to type-check even though Node resolves it correctly at
+        // runtime. Switching core to Node16 resolution would fix it properly, but
+        // that is a change with a much wider blast radius than this file.
+        const specifier = '@sonisoft/sn-credstore/register';
+        await import(specifier);
+        cached = { active: true };
+    }
+    catch (error) {
+        if (!isNotInstalled(error))
+            throw error;
+        cached = { active: false, reason: 'not-installed' };
+    }
+    return cached;
+}
+//# sourceMappingURL=ensureShim.js.map

package/dist/credentials/ensureShim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensureShim.js","sourceRoot":"","sources":["../../src/credentials/ensureShim.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,KAAc;IAClC,MAAM,GAAG,GAAG,KAA0C,CAAC;IACvD,OAAO,CACH,GAAG,EAAE,IAAI,KAAK,sBAAsB;QACpC,yEAAyE;QACzE,wEAAwE;QACxE,0CAA0C;QAC1C,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CACzD,CAAC;AACN,CAAC;AASD,IAAI,MAA6C,CAAC;AAElD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACrC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;QACpC,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAC/C,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,IAAI,CAAC;QACD,oEAAoE;QACpE,0EAA0E;QAC1E,oEAAoE;QACpE,wEAAwE;QACxE,0EAA0E;QAC1E,kEAAkE;QAClE,MAAM,SAAS,GAAG,iCAAiC,CAAC;QACpD,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QACxB,MAAM,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QACxC,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACxD,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sonisoft/now-sdk-ext-core",
-  "version": "5.0.1",
+  "version": "5.1.0",
   "description": "Comprehensive TypeScript library extending ServiceNow SDK with application management, ATF testing, real-time log monitoring, AMB event subscriptions, and automation tools",
   "keywords": [
     "servicenow",
@@ -144,5 +144,8 @@
   },
   "engines": {
     "node": ">=26.0.0"
+  },
+  "optionalDependencies": {
+    "@sonisoft/sn-credstore": "^1.0.0"
   }
 }