@tenonhq/dovetail-core 0.0.118 → 0.0.119

package/dist/MultiScopeWatcher.js

@@ -560,17 +560,10 @@ class MultiScopeWatcherManager {
         try {
             const { defaultClient } = await Promise.resolve().then(() => __importStar(require("./snClient")));
             const client = defaultClient();
-            // Create axios client directly to get update set details
-            const axios = (await Promise.resolve().then(() => __importStar(require("axios")))).default;
-            const { SN_USER = "", SN_PASSWORD = "", SN_INSTANCE = "" } = process.env;
-            const axiosClient = axios.create({
-                auth: {
-                    username: SN_USER,
-                    password: SN_PASSWORD
-                },
-                baseURL: SN_INSTANCE
-            });
-            const response = await axiosClient.get(`/api/now/table/sys_update_set/${updateSetId}`, {
+            // Reuse the shared client's axios instance — it carries the resolved
+            // auth mode (inbound API key or basic) so this read never drifts from
+            // the rest of the tool's transport.
+            const response = await client.client.get(`/api/now/table/sys_update_set/${updateSetId}`, {
                 params: {
                     sysparm_fields: "name,state,sys_id"
                 }

package/dist/allScopesCommands.js

@@ -301,10 +301,12 @@ async function initScopesCommand(args) {
         Logger_1.logger.info(`Using ${apiDelay}ms delay between API calls to prevent server overload`);
     }
     try {
-        // First check if we have environment variables set
+        // First check if we have environment variables set. SN_USER stays
+        // required even in API-key mode (acting-user resolution); the password
+        // is optional once an inbound SN_API_KEY is set.
         if (!process.env.SN_USER ||
-            !process.env.SN_PASSWORD ||
-            !process.env.SN_INSTANCE) {
+            !process.env.SN_INSTANCE ||
+            (!process.env.SN_PASSWORD && !process.env.SN_API_KEY)) {
             try {
                 let loginAnswers = await (0, wizard_1.getLoginInfo)();
                 await (0, wizard_1.setupDotEnv)(loginAnswers);
@@ -314,9 +316,9 @@ async function initScopesCommand(args) {
                 throw error;
             }
             if (!process.env.SN_USER ||
-                !process.env.SN_PASSWORD ||
-                !process.env.SN_INSTANCE) {
-                Logger_1.logger.error("Missing ServiceNow credentials. Please ensure SN_USER, SN_PASSWORD, and SN_INSTANCE are set in your .env file");
+                !process.env.SN_INSTANCE ||
+                (!process.env.SN_PASSWORD && !process.env.SN_API_KEY)) {
+                Logger_1.logger.error("Missing ServiceNow credentials. Please ensure SN_USER, SN_INSTANCE, and SN_PASSWORD (or SN_API_KEY) are set in your .env file");
                 throw new Error("ServiceNow credentials not configured");
             }
         }
@@ -371,12 +373,14 @@ async function watchAllScopesCommand(args) {
     (0, commands_1.setLogLevel)(args);
     var dashboardProcess = null;
     try {
-        // First check if we have environment variables set
+        // First check if we have environment variables set. SN_USER stays
+        // required even in API-key mode; the password is optional once an
+        // inbound SN_API_KEY is set.
         if (!process.env.SN_USER ||
-            !process.env.SN_PASSWORD ||
-            !process.env.SN_INSTANCE) {
+            !process.env.SN_INSTANCE ||
+            (!process.env.SN_PASSWORD && !process.env.SN_API_KEY)) {
             let loginAnswers = await (0, wizard_1.getLoginInfo)();
-            Logger_1.logger.error("Missing ServiceNow credentials. Please ensure SN_USER, SN_PASSWORD, and SN_INSTANCE are set in your .env file");
+            Logger_1.logger.error("Missing ServiceNow credentials. Please ensure SN_USER, SN_INSTANCE, and SN_PASSWORD (or SN_API_KEY) are set in your .env file");
             throw new Error("ServiceNow credentials not configured");
         }
         // Start dashboard unless --no-dashboard flag is set

package/dist/initSystem/corePlugin.js

@@ -98,6 +98,15 @@ exports.corePlugin = {
             },
             required: true,
         },
+        {
+            envKey: "SN_API_KEY",
+            prompt: {
+                type: "password",
+                message: "Inbound API key (optional, Enter to skip — becomes the default auth when set):",
+                mask: "*",
+            },
+            required: false,
+        },
     ],
     configure: [
         {
@@ -105,7 +114,7 @@ exports.corePlugin = {
             label: "Selecting ServiceNow applications",
             run: async (context) => {
                 var baseUrl = instanceBaseUrl(context.env.SN_INSTANCE);
-                var client = (0, snClient_1.snClient)(baseUrl, context.env.SN_USER, context.env.SN_PASSWORD);
+                var client = (0, snClient_1.snClient)(baseUrl, context.env.SN_USER, context.env.SN_PASSWORD, context.env.SN_API_KEY);
                 Logger_1.logger.info("Fetching application list...");
                 var apps = await (0, snClient_1.unwrapSNResponse)(client.getAppList());
                 if (apps.length === 0) {
@@ -303,13 +312,16 @@ async function validateCoreLogin(context) {
     const instance = context.env.SN_INSTANCE;
     const user = context.env.SN_USER;
     const password = context.env.SN_PASSWORD;
-    if (!instance || !user || !password) {
+    const apiKey = context.env.SN_API_KEY;
+    // SN_USER stays required even in API-key mode — the client's user-preference
+    // logic (current app / update set pinning) resolves the acting user from it.
+    if (!instance || !user || (!password && !apiKey)) {
         return "Missing required credentials";
     }
     const instanceUrl = normalizeInstance(instance);
     const baseUrl = instanceBaseUrl(instance);
     try {
-        const client = (0, snClient_1.snClient)(baseUrl, user, password);
+        const client = (0, snClient_1.snClient)(baseUrl, user, password, apiKey);
         await (0, snClient_1.unwrapSNResponse)(client.getAppList());
         context.env.SN_INSTANCE = instanceUrl;
         return true;
@@ -321,7 +333,7 @@ async function validateCoreLogin(context) {
             return "Instance not found — check the URL (got: " + instanceUrl + ")";
         }
         if (status === 401 || msg.includes("401")) {
-            return "Invalid username or password.";
+            return "Invalid credentials — check the username/password (or the API key and its REST API access policies).";
         }
         if (status === 403 || msg.includes("403")) {
             return "Access denied — user may lack required roles.";

package/dist/reconcileCommand.js

@@ -95,11 +95,13 @@ function getUpdateSetConfig() {
 }
 const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
 function requireCreds() {
-    const { SN_USER = "", SN_PASSWORD = "", SN_INSTANCE = "" } = process.env;
-    if (!SN_USER || !SN_PASSWORD || !SN_INSTANCE) {
-        throw new Error("Missing ServiceNow credentials. Ensure SN_INSTANCE, SN_USER, and SN_PASSWORD are set in your .env file or environment.");
+    const { SN_USER = "", SN_PASSWORD = "", SN_INSTANCE = "", SN_API_KEY = "", } = process.env;
+    // SN_USER stays required even in API-key mode (acting-user resolution);
+    // the password becomes optional once an inbound API key is set.
+    if (!SN_USER || !SN_INSTANCE || (!SN_PASSWORD && !SN_API_KEY)) {
+        throw new Error("Missing ServiceNow credentials. Ensure SN_INSTANCE, SN_USER, and SN_PASSWORD (or SN_API_KEY) are set in your .env file or environment.");
     }
-    return { SN_USER, SN_PASSWORD, SN_INSTANCE };
+    return { SN_USER, SN_PASSWORD, SN_INSTANCE, SN_API_KEY };
 }
 function normalizeInstance(instance) {
     return instance.replace(/^https?:\/\//, "").replace(/\/$/, "");
@@ -158,6 +160,7 @@ async function buildSchemaDiffs(options) {
             instance: creds.SN_INSTANCE,
             username: creds.SN_USER,
             password: creds.SN_PASSWORD,
+            apiKey: creds.SN_API_KEY,
             outputDir: tmpDir,
             scopes,
         });

package/dist/schemaCommand.js

@@ -46,11 +46,13 @@ const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
 const fs_1 = require("fs");
 function requireCreds() {
-    const { SN_USER = "", SN_PASSWORD = "", SN_INSTANCE = "" } = process.env;
-    if (!SN_USER || !SN_PASSWORD || !SN_INSTANCE) {
-        throw new Error("Missing ServiceNow credentials. Ensure SN_INSTANCE, SN_USER, and SN_PASSWORD are set in your .env file or environment.");
+    const { SN_USER = "", SN_PASSWORD = "", SN_INSTANCE = "", SN_API_KEY = "", } = process.env;
+    // SN_USER stays required even in API-key mode (acting-user resolution);
+    // the password becomes optional once an inbound API key is set.
+    if (!SN_USER || !SN_INSTANCE || (!SN_PASSWORD && !SN_API_KEY)) {
+        throw new Error("Missing ServiceNow credentials. Ensure SN_INSTANCE, SN_USER, and SN_PASSWORD (or SN_API_KEY) are set in your .env file or environment.");
     }
-    return { SN_USER, SN_PASSWORD, SN_INSTANCE };
+    return { SN_USER, SN_PASSWORD, SN_INSTANCE, SN_API_KEY };
 }
 function normalizeInstance(instance) {
     return instance.replace(/^https?:\/\//, "").replace(/\/$/, "");
@@ -74,7 +76,7 @@ function outputDirFor(args) {
     return args.output ? path_1.default.resolve(args.output) : path_1.default.join(rootDir, "schema");
 }
 async function schemaPullCommand(args) {
-    const { SN_USER, SN_PASSWORD, SN_INSTANCE } = requireCreds();
+    const { SN_USER, SN_PASSWORD, SN_INSTANCE, SN_API_KEY } = requireCreds();
     const scopes = resolveScopes(args);
     const outputDir = outputDirFor(args);
     try {
@@ -82,6 +84,7 @@ async function schemaPullCommand(args) {
             instance: SN_INSTANCE,
             username: SN_USER,
             password: SN_PASSWORD,
+            apiKey: SN_API_KEY,
             outputDir,
             scopes,
         });
@@ -119,6 +122,7 @@ async function resolveRefDir(options) {
             instance: creds.SN_INSTANCE,
             username: creds.SN_USER,
             password: creds.SN_PASSWORD,
+            apiKey: creds.SN_API_KEY,
             outputDir: tmpDir,
             scopes,
         });

package/dist/snClient.js

@@ -243,17 +243,26 @@ const processPushResponse = (response, recSummary) => {
     };
 };
 exports.processPushResponse = processPushResponse;
-const snClient = (baseURL, username, password) => {
+const snClient = (baseURL, username, password, apiKey) => {
     const jar = new tough_cookie_1.CookieJar();
+    // When an inbound API key is supplied it is the default auth mode: the
+    // x-sn-apikey header replaces basic auth entirely. Requires key-enabled
+    // REST API access policies on the instance.
+    const baseHeaders = {
+        "Content-Type": "application/json",
+    };
+    if (apiKey) {
+        baseHeaders["x-sn-apikey"] = apiKey;
+    }
     const rawAxios = (0, axios_cookiejar_support_1.wrapper)(axios_1.default.create({
         withCredentials: true,
-        auth: {
-            username,
-            password,
-        },
-        headers: {
-            "Content-Type": "application/json",
-        },
+        auth: apiKey
+            ? undefined
+            : {
+                username,
+                password,
+            },
+        headers: baseHeaders,
         baseURL,
         jar,
     }));
@@ -540,8 +549,8 @@ const defaultClient = () => {
     if (internalClient) {
         return internalClient;
     }
-    const { SN_USER = "", SN_PASSWORD = "", SN_INSTANCE = "" } = process.env;
-    internalClient = (0, exports.snClient)(`https://${SN_INSTANCE}/`, SN_USER, SN_PASSWORD);
+    const { SN_USER = "", SN_PASSWORD = "", SN_INSTANCE = "", SN_API_KEY = "", } = process.env;
+    internalClient = (0, exports.snClient)(`https://${SN_INSTANCE}/`, SN_USER, SN_PASSWORD, SN_API_KEY);
     return internalClient;
 };
 exports.defaultClient = defaultClient;

package/dist/tests/snClient.apiKey.test.js

@@ -0,0 +1,40 @@
+"use strict";
+// Auth-mode tests for snClient: an inbound API key (4th param) becomes the
+// x-sn-apikey header on the real axios instance and basic auth is NOT set;
+// without a key the existing basic-auth behavior is unchanged. Also covers
+// defaultClient() picking SN_API_KEY out of the environment.
+Object.defineProperty(exports, "__esModule", { value: true });
+var mockLogger = {
+    info: jest.fn(),
+    debug: jest.fn(),
+    warn: jest.fn(),
+    error: jest.fn(),
+    getLogLevel: function () { return "debug"; },
+};
+jest.mock("../Logger", function () {
+    return { logger: mockLogger };
+});
+jest.mock("../FileLogger", function () {
+    return { fileLogger: { debug: jest.fn(), info: jest.fn(), warn: jest.fn(), error: jest.fn() } };
+});
+jest.mock("../genericUtils", function () {
+    return { wait: jest.fn().mockResolvedValue(undefined) };
+});
+const snClient_1 = require("../snClient");
+describe("snClient — auth mode", function () {
+    it("key mode: sets x-sn-apikey header and no basic auth", function () {
+        var c = (0, snClient_1.snClient)("https://x.service-now.com/", "user", "pass", "key-123");
+        expect(c.client.defaults.headers["x-sn-apikey"]).toBe("key-123");
+        expect(c.client.defaults.auth).toBeUndefined();
+    });
+    it("basic mode: sets basic auth and no x-sn-apikey header", function () {
+        var c = (0, snClient_1.snClient)("https://x.service-now.com/", "user", "pass");
+        expect(c.client.defaults.auth).toEqual({ username: "user", password: "pass" });
+        expect(c.client.defaults.headers["x-sn-apikey"]).toBeUndefined();
+    });
+    it("empty-string key falls back to basic auth", function () {
+        var c = (0, snClient_1.snClient)("https://x.service-now.com/", "user", "pass", "");
+        expect(c.client.defaults.auth).toEqual({ username: "user", password: "pass" });
+        expect(c.client.defaults.headers["x-sn-apikey"]).toBeUndefined();
+    });
+});

package/dist/wizard.js

@@ -24,17 +24,25 @@ async function getLoginInfo() {
             name: "password",
             message: "What is your password on that instance?",
         },
+        {
+            type: "password",
+            name: "apiKey",
+            message: "Inbound API key (optional, Enter to skip — becomes the default auth when set)?",
+        },
     ]);
 }
 async function setupDotEnv(answers) {
     process.env.SN_USER = answers.username;
     process.env.SN_PASSWORD = answers.password;
     process.env.SN_INSTANCE = answers.instance;
-    (0, FileUtils_1.writeEnvVars)({
-        vars: [
-            { key: "SN_USER", value: answers.username },
-            { key: "SN_PASSWORD", value: answers.password },
-            { key: "SN_INSTANCE", value: answers.instance },
-        ],
-    });
+    var vars = [
+        { key: "SN_USER", value: answers.username },
+        { key: "SN_PASSWORD", value: answers.password },
+        { key: "SN_INSTANCE", value: answers.instance },
+    ];
+    if (answers.apiKey) {
+        process.env.SN_API_KEY = answers.apiKey;
+        vars.push({ key: "SN_API_KEY", value: answers.apiKey });
+    }
+    (0, FileUtils_1.writeEnvVars)({ vars: vars });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tenonhq/dovetail-core",
-  "version": "0.0.118",
+  "version": "0.0.119",
   "description": "Next-gen file syncer",
   "license": "GPL-3.0",
   "main": "./dist/index.js",
@@ -22,7 +22,7 @@
     "node": ">=22"
   },
   "devDependencies": {
-    "@tenonhq/dovetail-types": "~0.0.20",
+    "@tenonhq/dovetail-types": "~0.0.21",
     "@types/dotenv": "^6.1.1",
     "@types/inquirer": "^8.2.10",
     "@types/jest": "^29.5.5",
@@ -39,7 +39,7 @@
   },
   "dependencies": {
     "@tenonhq/dovetail-clickup": "~0.0.13",
-    "@tenonhq/dovetail-schema": "~0.0.12",
+    "@tenonhq/dovetail-schema": "~0.0.13",
     "axios": "^1.5.1",
     "axios-cookiejar-support": "^4.0.7",
     "axios-rate-limit": "^1.3.0",

package/release-manifest.json

@@ -1,7 +1,85 @@
 {
   "$schema": "dovetail-manifest/v1",
-  "generated_at": "2026-07-28T06:44:03.536Z",
+  "generated_at": "2026-07-28T22:07:08.748Z",
   "events": [
+    {
+      "$schema": "dovetail-release-event/v1",
+      "event_id": "dovetail-servicenow@0.0.35",
+      "package": "@tenonhq/dovetail-servicenow",
+      "version": "0.0.35",
+      "prev_version": "0.0.34",
+      "published_at": "2026-07-28T22:07:08.734Z",
+      "git": {
+        "sha": "44c5d85d6b3232119e47397da43344b4185f94ff",
+        "tag": "dovetail-servicenow@0.0.35"
+      },
+      "semver_bump": "patch",
+      "commits": [
+        {
+          "sha": "44c5d85d6",
+          "subject": "feat(servicenow): remove-choices verb — soft-delete choice values (DEV-511) (#237)",
+          "pr": 237
+        },
+        {
+          "sha": "c80d5cc24",
+          "subject": "feat(servicenow): S1 execution-context gate + WRITE_DESTRUCTIVE tier (DEV-507) (#239)",
+          "pr": 239
+        },
+        {
+          "sha": "1749ba4f0",
+          "subject": "chore(release): publish 2 packages [skip ci]"
+        }
+      ],
+      "exports_delta": null,
+      "narrative": null
+    },
+    {
+      "$schema": "dovetail-release-event/v1",
+      "event_id": "dovetail-mcp@0.0.32",
+      "package": "@tenonhq/dovetail-mcp",
+      "version": "0.0.32",
+      "prev_version": "0.0.31",
+      "published_at": "2026-07-28T22:07:08.734Z",
+      "git": {
+        "sha": "44c5d85d6b3232119e47397da43344b4185f94ff",
+        "tag": "dovetail-mcp@0.0.32"
+      },
+      "semver_bump": "patch",
+      "commits": [
+        {
+          "sha": "1749ba4f0",
+          "subject": "chore(release): publish 2 packages [skip ci]"
+        }
+      ],
+      "exports_delta": null,
+      "narrative": null
+    },
+    {
+      "$schema": "dovetail-release-event/v1",
+      "event_id": "dovetail-core@0.0.118",
+      "package": "@tenonhq/dovetail-core",
+      "version": "0.0.118",
+      "prev_version": "0.0.117",
+      "published_at": "2026-07-28T07:09:33.080Z",
+      "git": {
+        "sha": "e4193968a18d54df70f599a15e2b7b940fa491b9",
+        "tag": "dovetail-core@0.0.118"
+      },
+      "semver_bump": "patch",
+      "commits": [
+        {
+          "sha": "e4193968a",
+          "subject": "fix(core): close review findings from the metaData work (#251)",
+          "pr": 251
+        },
+        {
+          "sha": "f245dd850",
+          "subject": "chore(release): @tenonhq/dovetail-core@0.0.117 [skip ci]"
+        }
+      ],
+      "exports_delta": null,
+      "narrative": null
+    },
     {
       "$schema": "dovetail-release-event/v1",
       "event_id": "dovetail-core@0.0.117",
@@ -1176,84 +1254,6 @@
       ],
       "exports_delta": null,
       "narrative": null
-    },
-    {
-      "$schema": "dovetail-release-event/v1",
-      "event_id": "dovetail-babel-plugin@0.0.11",
-      "package": "@tenonhq/dovetail-babel-plugin",
-      "version": "0.0.11",
-      "prev_version": "0.0.10",
-      "published_at": "2026-06-16T01:18:07.728Z",
-      "git": {
-        "sha": "edabc263bd89f08b5c7a075f270c2172e82da4da",
-        "tag": "dovetail-babel-plugin@0.0.11"
-      },
-      "semver_bump": "patch",
-      "commits": [
-        {
-          "sha": "edabc263b",
-          "subject": "chore(deps): bump @babel/core from 7.29.0 to 7.29.6 (#181)",
-          "pr": 181
-        },
-        {
-          "sha": "de9d77971",
-          "subject": "chore(release): publish 14 packages [skip ci]"
-        }
-      ],
-      "exports_delta": null,
-      "narrative": null
-    },
-    {
-      "$schema": "dovetail-release-event/v1",
-      "event_id": "dovetail-babel-plugin-remove-modules@0.0.11",
-      "package": "@tenonhq/dovetail-babel-plugin-remove-modules",
-      "version": "0.0.11",
-      "prev_version": "0.0.10",
-      "published_at": "2026-06-16T01:18:07.728Z",
-      "git": {
-        "sha": "edabc263bd89f08b5c7a075f270c2172e82da4da",
-        "tag": "dovetail-babel-plugin-remove-modules@0.0.11"
-      },
-      "semver_bump": "patch",
-      "commits": [
-        {
-          "sha": "edabc263b",
-          "subject": "chore(deps): bump @babel/core from 7.29.0 to 7.29.6 (#181)",
-          "pr": 181
-        },
-        {
-          "sha": "de9d77971",
-          "subject": "chore(release): publish 14 packages [skip ci]"
-        }
-      ],
-      "exports_delta": null,
-      "narrative": null
-    },
-    {
-      "$schema": "dovetail-release-event/v1",
-      "event_id": "dovetail-babel-preset-servicenow@0.0.11",
-      "package": "@tenonhq/dovetail-babel-preset-servicenow",
-      "version": "0.0.11",
-      "prev_version": "0.0.10",
-      "published_at": "2026-06-16T01:18:07.728Z",
-      "git": {
-        "sha": "edabc263bd89f08b5c7a075f270c2172e82da4da",
-        "tag": "dovetail-babel-preset-servicenow@0.0.11"
-      },
-      "semver_bump": "patch",
-      "commits": [
-        {
-          "sha": "edabc263b",
-          "subject": "chore(deps): bump @babel/core from 7.29.0 to 7.29.6 (#181)",
-          "pr": 181
-        },
-        {
-          "sha": "de9d77971",
-          "subject": "chore(release): publish 14 packages [skip ci]"
-        }
-      ],
-      "exports_delta": null,
-      "narrative": null
     }
   ]
 }