@tenonhq/dovetail-core 0.0.125 → 0.0.127

package/dist/gitHead.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readGitHead = readGitHead;
+const child_process_1 = require("child_process");
+// A full object id: SHA-1 (40 hex) or SHA-256 (64 hex) repositories.
+var OBJECT_ID_PATTERN = /^[0-9a-f]{40}([0-9a-f]{24})?$/i;
+/**
+ * @description Resolves the commit HEAD points at for the git work tree that
+ * contains `dir` (`git rev-parse HEAD`, so linked worktrees and submodules
+ * resolve correctly). Never throws: resolves `null` when `dir` is not inside a
+ * git work tree, the repo has no commits yet, git is not installed, or the
+ * output is not an object id.
+ * @param {string} dir - Any directory inside the work tree.
+ * @returns {Promise<string | null>} The HEAD commit id, or null when unknown.
+ */
+function readGitHead(dir) {
+    return new Promise(function (resolve) {
+        if (typeof dir !== "string" || dir.trim() === "") {
+            resolve(null);
+            return;
+        }
+        try {
+            (0, child_process_1.execFile)("git", ["rev-parse", "HEAD"], { cwd: dir, timeout: 5000, windowsHide: true }, function (error, stdout) {
+                if (error) {
+                    resolve(null);
+                    return;
+                }
+                var head = String(stdout || "").trim();
+                resolve(OBJECT_ID_PATTERN.test(head) ? head : null);
+            });
+        }
+        catch (e) {
+            resolve(null);
+        }
+    });
+}

package/dist/pullRecord.js

@@ -202,6 +202,13 @@ function spliceManifestRecord(manifest, scope, table, entry, previousKey) {
             if (previousKey !== undefined && key === previousKey && key !== entry.name)
                 continue;
             if (key === entry.name) {
+                const held = existing[key];
+                if (held && held.sys_id && held.sys_id !== entry.sys_id) {
+                    // Never replace another record's entry: its folder would be overwritten
+                    // and its sys_id dropped from the manifest.
+                    throw new Error(table + ": manifest key '" + key + "' already belongs to sys_id " + held.sys_id +
+                        ", not " + entry.sys_id + ". Refusing to overwrite it.");
+                }
                 records[key] = entryShape(entry);
                 placed = true;
                 continue;
@@ -388,6 +395,18 @@ function tableIsWhitelisted(scope, table) {
         return false;
     }
 }
+/** sys_id holding `key` in `table` of a manifest, or undefined when the key is free. */
+function sysIdAtKey(manifest, table, key) {
+    if (!manifest || !manifest.tables)
+        return undefined;
+    const tableEntry = manifest.tables[table];
+    if (!tableEntry || !tableEntry.records)
+        return undefined;
+    if (!Object.prototype.hasOwnProperty.call(tableEntry.records, key))
+        return undefined;
+    const rec = tableEntry.records[key];
+    return rec && rec.sys_id ? rec.sys_id : undefined;
+}
 async function readIfExists(p) {
     try {
         return await fs_1.promises.readFile(p, "utf8");
@@ -460,6 +479,40 @@ async function planPull(rawTargets, options = {}, client = (0, snClient_1.defaul
         const requestFiles = hit ? toManifestFiles(hit.record.files) : filesFromFieldOverrides(r.scope, r.table);
         return Object.assign({}, r, { serverKey: hit ? hit.key : undefined, requestFiles });
     });
+    // Local manifests, read once per scope (the diff below and the key-collision
+    // checks both need them).
+    const manifestTexts = {};
+    const manifestsByScope = {};
+    for (const scope of scopes) {
+        const manifestPath = ConfigManager.getScopeManifestPath(scope);
+        manifestTexts[scope] = parseManifestText(await readIfExists(manifestPath));
+        manifestsByScope[scope] = {
+            scope,
+            manifestPath,
+            formatPreserved: manifestTexts[scope].formatPreserved,
+            existed: manifestTexts[scope].existed,
+            records: [],
+        };
+    }
+    // A server-provided key the local manifest gives to a DIFFERENT record means the
+    // server's duplicate-suffix order moved since the last refresh. Splicing it in
+    // would overwrite that record's entry and folder, so refuse before any content
+    // is fetched; only a table refresh can re-key both consistently.
+    const keyConflicts = [];
+    for (const p of pending) {
+        if (p.serverKey === undefined)
+            continue;
+        const holder = sysIdAtKey(manifestTexts[p.scope].manifest, p.table, p.serverKey);
+        if (holder !== undefined && holder !== p.sysId) {
+            keyConflicts.push(p.table + " " + p.sysId + ": manifest key '" + p.serverKey + "' already belongs to sys_id " +
+                holder + " in the local manifest for scope '" + p.scope + "'. Run 'dove refresh -t " + p.table +
+                "' to re-key the table. Nothing was written.");
+        }
+    }
+    if (keyConflicts.length > 0) {
+        throw new Error((keyConflicts.length === 1 ? "Refusing to pull:\n  " : "Refusing to pull (" + keyConflicts.length + " problems):\n  ") +
+            keyConflicts.join("\n  "));
+    }
     const missing = {};
     for (const p of pending) {
         if (!missing[p.table])
@@ -468,9 +521,9 @@ async function planPull(rawTargets, options = {}, client = (0, snClient_1.defaul
     }
     const downloaded = await (0, snClient_1.unwrapSNResponse)(client.getMissingFiles(missing, config.tableOptions || {}));
     // 4. Diff against disk + local manifests.
-    const manifestTexts = {};
-    const manifestsByScope = {};
     const records = [];
+    // Fallback keys claimed earlier in THIS batch: scope -> table -> key -> sys_id.
+    const claimed = {};
     const forceWrite = !!options.force;
     for (const p of pending) {
         const label = p.table + " " + p.sysId;
@@ -479,21 +532,44 @@ async function planPull(rawTargets, options = {}, client = (0, snClient_1.defaul
             throw new Error(label + ": the instance returned no content for this record (bulkDownload).");
         }
         const recWarnings = [];
-        const key = p.serverKey !== undefined
-            ? p.serverKey
-            : (0, appUtils_1.toSafeFolderName)({ name: dl.record.name, sys_id: p.sysId, files: [] });
-        if (!manifestTexts[p.scope]) {
-            const manifestPath = ConfigManager.getScopeManifestPath(p.scope);
-            manifestTexts[p.scope] = parseManifestText(await readIfExists(manifestPath));
-            manifestsByScope[p.scope] = {
-                scope: p.scope,
-                manifestPath,
-                formatPreserved: manifestTexts[p.scope].formatPreserved,
-                existed: manifestTexts[p.scope].existed,
-                records: [],
+        const local = manifestTexts[p.scope].manifest;
+        let key;
+        if (p.serverKey !== undefined) {
+            key = p.serverKey;
+        }
+        else {
+            // Not in the server manifest: the key is the bare display name, which may
+            // already belong to another record (locally, on the server, or earlier in
+            // this batch). Disambiguate the way normalizeManifestKeys does.
+            if (!claimed[p.scope])
+                claimed[p.scope] = {};
+            if (!claimed[p.scope][p.table])
+                claimed[p.scope][p.table] = {};
+            const batchClaims = claimed[p.scope][p.table];
+            const takenByOther = (k) => {
+                const holders = [
+                    sysIdAtKey(local, p.table, k),
+                    sysIdAtKey(serverManifests[p.scope], p.table, k),
+                    Object.prototype.hasOwnProperty.call(batchClaims, k) ? batchClaims[k] : undefined,
+                ];
+                for (const h of holders)
+                    if (h !== undefined && h !== p.sysId)
+                        return h;
+                return undefined;
             };
+            key = (0, appUtils_1.toSafeFolderName)({ name: dl.record.name, sys_id: p.sysId, files: [] });
+            if (takenByOther(key) !== undefined) {
+                const suffixed = (0, appUtils_1.duplicateFolderName)(key, p.sysId);
+                const holder = takenByOther(suffixed);
+                if (holder !== undefined) {
+                    throw new Error("Refusing to pull:\n  " + label + ": manifest keys '" + key + "' and '" + suffixed +
+                        "' both belong to other records (sys_id " + holder + "). Run 'dove refresh -t " + p.table +
+                        "' to re-key the table. Nothing was written.");
+                }
+                key = suffixed;
+            }
+            batchClaims[key] = p.sysId;
         }
-        const local = manifestTexts[p.scope].manifest;
         const existing = findRecordBySysId(local ? local.tables : undefined, p.table, p.sysId);
         const manifestEntry = { files: p.requestFiles.map((f) => ({ name: f.name, type: f.type })), name: key, sys_id: p.sysId };
         let manifestAction = "add";

package/dist/reconcileCommand.js

@@ -53,6 +53,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyCreates = applyCreates;
 exports.reconcileCommand = reconcileCommand;
 const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
@@ -338,6 +339,7 @@ async function buildCreateFields(scope, change) {
     }
     return fields;
 }
+// Exported for tests.
 async function applyCreates(scope, creates, updateSetSysId) {
     if (creates.length === 0) {
         return [];

package/dist/snClient.js

@@ -334,14 +334,28 @@ const snClient = (baseURL, username, password, apiKey) => {
         const endpoint = `api/now/table/${table}/${recordId}`;
         return client.patch(endpoint, fields);
     };
-    const getScopeId = (scopeName) => {
+    // Resolve a scope name to its sys_scope sys_id. `scope=<name>` is not unique
+    // on every instance: `scope=global` also matches sys_app rows (their scope
+    // column is "global"), so the real Global scope is addressed by its fixed
+    // sys_id, and any other ambiguous name is refused rather than guessed.
+    const getScopeId = async (scopeName) => {
         const endpoint = "api/now/table/sys_scope";
-        return client.get(endpoint, {
+        const query = scopeName === "global" ? "sys_id=global" : `scope=${scopeName}`;
+        const resp = await client.get(endpoint, {
             params: {
-                sysparm_query: `scope=${scopeName}`,
+                sysparm_query: query,
                 sysparm_fields: "sys_id",
             },
         });
+        const rows = resp && resp.data && Array.isArray(resp.data.result)
+            ? resp.data.result
+            : [];
+        if (rows.length > 1) {
+            const ids = rows.map((row) => (row && row.sys_id) || "?").join(", ");
+            throw new Error(`Scope "${scopeName}" is ambiguous: ${rows.length} sys_scope rows match ` +
+                `(${ids}). Refusing to guess which one owns the change.`);
+        }
+        return resp;
     };
     const getScopeById = (scopeSysId) => {
         const endpoint = "api/now/table/sys_scope";
@@ -366,6 +380,23 @@ const snClient = (baseURL, username, password, apiKey) => {
             },
         });
     };
+    /**
+     * In-progress update sets with exactly this name in one application, so a
+     * create can refuse a duplicate (a retry after a timeout would otherwise
+     * leave two same-named sets, and activate-by-name picks either). A `^` in
+     * the name is escaped as `^^` so it cannot split the encoded query.
+     */
+    const getInProgressUpdateSetsByName = (updateSetName, applicationSysId) => {
+        const endpoint = "api/now/table/sys_update_set";
+        const safeName = String(updateSetName).replace(/\^/g, "^^");
+        return client.get(endpoint, {
+            params: {
+                sysparm_query: `name=${safeName}^application=${applicationSysId}` +
+                    "^state=in progress",
+                sysparm_fields: "sys_id,name,application",
+            },
+        });
+    };
     /**
      * Reads ONE record by sys_id, selecting only its class and owning scope, so a
      * per-record pull can resolve (and refuse) the target scope before it fetches
@@ -558,6 +589,16 @@ const snClient = (baseURL, username, password, apiKey) => {
                 "or in Studio then run `dove refresh -s <scope>` to materialise " +
                 "the new records locally."));
         }
+        // Guard: the generic createRecord op never sets `application`, so an
+        // update set inserted through it lands in the session app (and a
+        // name-only read-back still passes). Update sets must go through the
+        // scope-correct createUpdateSet op.
+        if (params && params.table === "sys_update_set") {
+            return Promise.reject(new Error("Refusing to insert sys_update_set via createRecord: the generic " +
+                "createRecord op does not set the update set's application, so it " +
+                "would land in the session app. Use `dove createUpdateSet --name " +
+                "<name> --scope <scope>` instead."));
+        }
         return _callDovetailApi("createRecord", (endpoint) => client.post(endpoint, params));
     };
     const deleteRecord = (params) => {
@@ -569,6 +610,7 @@ const snClient = (baseURL, username, password, apiKey) => {
         getScopeId,
         getScopeById,
         getUpdateSetById,
+        getInProgressUpdateSetsByName,
         getRecordScope,
         getUpdateSetMembers,
         getUserSysId,

package/dist/tests/claudeSession.test.js

@@ -4,6 +4,28 @@
 // explicit env object is passed so the real process.env never leaks in.
 Object.defineProperty(exports, "__esModule", { value: true });
 const claudeSession_1 = require("../claudeSession");
+describe("isClaudeCodeToolShell (hard-block signal)", function () {
+    it("is true only when CLAUDECODE has a value", function () {
+        expect((0, claudeSession_1.isClaudeCodeToolShell)({ CLAUDECODE: "1" })).toBe(true);
+        expect((0, claudeSession_1.isClaudeCodeToolShell)({ CLAUDECODE: " " })).toBe(false);
+        expect((0, claudeSession_1.isClaudeCodeToolShell)({})).toBe(false);
+    });
+    it("ignores CLAUDE_CODE_* config variables a human may have in their profile", function () {
+        expect((0, claudeSession_1.isClaudeCodeToolShell)({ CLAUDE_CODE_USE_BEDROCK: "1" })).toBe(false);
+        expect((0, claudeSession_1.isClaudeCodeSession)({ CLAUDE_CODE_USE_BEDROCK: "1" })).toBe(true);
+    });
+});
+describe("isWatchInClaudeAllowed", function () {
+    it("accepts exactly 1", function () {
+        expect((0, claudeSession_1.isWatchInClaudeAllowed)({ DOVE_ALLOW_WATCH_IN_CLAUDE: "1" })).toBe(true);
+    });
+    it("rejects unset, empty, and other truthy-looking values", function () {
+        expect((0, claudeSession_1.isWatchInClaudeAllowed)({})).toBe(false);
+        expect((0, claudeSession_1.isWatchInClaudeAllowed)({ DOVE_ALLOW_WATCH_IN_CLAUDE: "" })).toBe(false);
+        expect((0, claudeSession_1.isWatchInClaudeAllowed)({ DOVE_ALLOW_WATCH_IN_CLAUDE: "true" })).toBe(false);
+        expect((0, claudeSession_1.isWatchInClaudeAllowed)({ DOVE_ALLOW_WATCH_IN_CLAUDE: "0" })).toBe(false);
+    });
+});
 describe("isClaudeCodeSession", function () {
     it("returns false for an empty environment", function () {
         expect((0, claudeSession_1.isClaudeCodeSession)({})).toBe(false);

package/dist/tests/commanderStrict.test.js

@@ -84,12 +84,17 @@ async function run(args) {
 }
 beforeEach(function () {
     jest.clearAllMocks();
+    process.exitCode = undefined;
+});
+afterEach(function () {
+    process.exitCode = undefined;
 });
 describe("dove pull", function () {
     it("routes `pull` to the refresh command", async function () {
         const { error } = await run(["pull"]);
         expect(error).toBeUndefined();
         expect(commands_1.refreshCommand).toHaveBeenCalledTimes(1);
+        expect(process.exitCode).toBeUndefined();
     });
     it("still routes the canonical `refresh` and its `r` alias", async function () {
         await run(["refresh"]);
@@ -136,6 +141,28 @@ describe("dove pull", function () {
         expect(argv.sysIds).toBe("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa1,bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb2");
         expect(pullRecordCommand_1.pullRecordCommand).toHaveBeenCalledTimes(1);
     });
+    it("refuses a bare `pull --dry-run` instead of running a real full refresh", async function () {
+        const { error } = await run(["pull", "--dry-run"]);
+        expect(error).toBeDefined();
+        expect(String(error)).toMatch(/--dry-run needs a table/);
+        expect(String(error)).toMatch(/full refresh/);
+        expect(process.exitCode).toBe(1);
+        expect(commands_1.refreshCommand).not.toHaveBeenCalled();
+        expect(pullRecordCommand_1.pullRecordCommand).not.toHaveBeenCalled();
+    });
+    it("refuses `pull --sys-ids <id>` with no table instead of running a full refresh", async function () {
+        const { error } = await run(["pull", "--sys-ids", "94243ee5c3f78f10d4ddf1db050131a6"]);
+        expect(error).toBeDefined();
+        expect(String(error)).toMatch(/needs a table/);
+        expect(String(error)).toMatch(/full refresh/);
+        expect(commands_1.refreshCommand).not.toHaveBeenCalled();
+        expect(pullRecordCommand_1.pullRecordCommand).not.toHaveBeenCalled();
+    });
+    it("refuses a bare `pull -t <table> --dry-run` (refresh has no dry run)", async function () {
+        const { error } = await run(["pull", "-t", "sys_script_include", "--dry-run"]);
+        expect(error).toBeDefined();
+        expect(commands_1.refreshCommand).not.toHaveBeenCalled();
+    });
     it("routes `pull --from-update-set` (no table) to the per-record pull", async function () {
         const { error, argv } = await run(["pull", "--from-update-set", "dddddddddddddddddddddddddddddddd"]);
         expect(error).toBeUndefined();

package/dist/tests/createRecordUpdateSet.test.js

@@ -66,6 +66,7 @@ var mockClient = {
     getScopeId: jest.fn(),
     getScopeById: jest.fn(),
     getUpdateSetById: jest.fn(),
+    getInProgressUpdateSetsByName: jest.fn(),
     createUpdateSet: jest.fn(),
     createRecord: jest.fn(),
 };
@@ -120,6 +121,9 @@ describe("dove create sys_update_set (#231)", function () {
             }
             return axiosResult([]);
         });
+        mockClient.getInProgressUpdateSetsByName.mockImplementation(function () {
+            return axiosResult([]);
+        });
         mockClient.createUpdateSet.mockImplementation(function (name, scopeSysId) {
             return axiosResult({ sys_id: SET_SYS_ID, name: name, application: scopeSysId });
         });
@@ -159,6 +163,42 @@ describe("dove create sys_update_set (#231)", function () {
         expect(success[0].msg).toContain(SET_SYS_ID);
         expect(success[0].msg).toContain(REQUESTED_SCOPE);
     });
+    it("prints an activation hint keyed on the new set's sys_id, not its name", async function () {
+        mockClient.getUpdateSetById.mockReturnValue(axiosResult([{ sys_id: SET_SYS_ID, application: { value: REQUESTED_SCOPE_SYS_ID } }]));
+        await (0, createRecordCommand_1.createRecordCommand)({
+            table: "sys_update_set",
+            name: "Journey - Fix 231",
+            scope: REQUESTED_SCOPE,
+            ci: true,
+            logLevel: "info",
+        });
+        expect(mockClient.getInProgressUpdateSetsByName).toHaveBeenCalledWith("Journey - Fix 231", REQUESTED_SCOPE_SYS_ID);
+        var hint = logMessages.filter(function (m) {
+            return m.level === "info" && m.msg.indexOf("switchUpdateSet") !== -1;
+        });
+        expect(hint).toHaveLength(1);
+        expect(hint[0].msg).toContain("--sysId " + SET_SYS_ID);
+        expect(hint[0].msg).toContain("-s " + REQUESTED_SCOPE);
+        expect(hint[0].msg).not.toContain("--name");
+    });
+    it("refuses (exit 1, no op call) when an in-progress set with the same name already exists in the scope", async function () {
+        mockClient.getInProgressUpdateSetsByName.mockImplementation(function () {
+            return axiosResult([{ sys_id: "existingSetSysId000000000000000cd", name: "Journey - Fix 231" }]);
+        });
+        await expect((0, createRecordCommand_1.createRecordCommand)({
+            table: "sys_update_set",
+            name: "Journey - Fix 231",
+            scope: REQUESTED_SCOPE,
+            ci: true,
+            logLevel: "info",
+        })).rejects.toBeInstanceOf(ExitSignal);
+        expect(exitSpy).toHaveBeenCalledWith(1);
+        expect(mockClient.createUpdateSet).not.toHaveBeenCalled();
+        expect(mockClient.createRecord).not.toHaveBeenCalled();
+        expect(logMessages.filter(function (m) { return m.level === "success"; })).toHaveLength(0);
+        expect(errorText()).toContain("already exists");
+        expect(errorText()).toContain("existingSetSysId000000000000000cd");
+    });
     it("fails loudly (exit 1, no success) when the created set's application is not the requested scope", async function () {
         // The op "succeeded" but the set landed in the session's current app.
         mockClient.createUpdateSet.mockImplementation(function (name) {

package/dist/tests/dovetailUtilsMSTableOptions.test.js

@@ -56,6 +56,7 @@ function makeGlideRecord(rows, captured, validFields) {
             return validFields === null ? true : validFields.indexOf(field) !== -1;
         };
         this.query = function () {
+            captured.queryCalls += 1;
             i = -1;
         };
         this.next = function () {
@@ -85,7 +86,11 @@ function makeGlideRecord(rows, captured, validFields) {
 function loadUtils(opts) {
     const rows = opts.rows || [];
     const warnings = [];
-    const captured = { encodedQueries: [], fieldQueries: [] };
+    const captured = {
+        encodedQueries: [],
+        fieldQueries: [],
+        queryCalls: 0,
+    };
     const metadataClasses = opts.metadataClasses || [];
     const sandbox = {
         Class: {
@@ -185,7 +190,13 @@ describe("DovetailUtilsMS.buildTableMap — scopeQuery", () => {
         expect(scopeFilters).toHaveLength(0);
     });
     it("renders {scopeId} as the scope sys_id", () => {
-        const out = buildChoices({ scopeQuery: "sys_package={scopeId}" });
+        const out = buildChoices({ scopeQuery: "sys_package={scopeId}" }, [
+            "name",
+            "element",
+            "value",
+            "label",
+            "sys_package",
+        ]);
         expect(out.captured.encodedQueries).toContain("sys_package=5e9f5f8b87420250369f33373cbb3559");
     });
     it("keeps the sys_scope filter when no scopeQuery is set (existing behaviour)", () => {
@@ -229,6 +240,102 @@ describe("DovetailUtilsMS.buildTableMap — scopeQuery", () => {
         expect(out.captured.encodedQueries).toHaveLength(0);
     });
 });
+describe("DovetailUtilsMS.buildTableMap — scopeQuery fails closed", () => {
+    // ServiceNow drops an encoded-query term on an unknown column, so an unchecked
+    // scopeQuery typo would return the WHOLE table (sys_choice: >200k rows) for every
+    // scope. buildTableMap must refuse such a query and never call query().
+    function expectRefused(out, reason) {
+        expect(out.captured.queryCalls).toBe(0);
+        expect(out.captured.encodedQueries).toHaveLength(0);
+        expect(Object.keys(out.records)).toHaveLength(0);
+        expect(out.warnings).toHaveLength(1);
+        expect(out.warnings[0]).toContain("sys_choice");
+        expect(out.warnings[0]).toContain("scopeQuery");
+        expect(out.warnings[0]).toMatch(reason);
+    }
+    // The fixture's three "Failed" labels also raise duplicate-name warnings; only
+    // scopeQuery refusals matter to the accept-path assertions.
+    function scopeQueryWarnings(warnings) {
+        return warnings.filter(function (w) {
+            return w.indexOf("scopeQuery") !== -1;
+        });
+    }
+    it("refuses a scopeQuery whose field does not exist on the table (typo)", () => {
+        const out = buildChoices({ scopeQuery: "nmeSTARTSWITH{scope}_" });
+        expectRefused(out, /nme/);
+    });
+    it("refuses a scopeQuery with no {scope}/{scopeId} token", () => {
+        const out = buildChoices({ scopeQuery: "active=true" }, null);
+        expectRefused(out, /\{scope\}/);
+    });
+    it("refuses a scopeQuery containing ^NQ", () => {
+        const out = buildChoices({
+            scopeQuery: "nameSTARTSWITH{scope}_^NQelement=state",
+        });
+        expectRefused(out, /\^NQ/);
+    });
+    it("verifies every ^OR term, not just the first", () => {
+        const out = buildChoices({
+            scopeQuery: "nameSTARTSWITH{scope}_^ORelmentSTARTSWITH{scope}_",
+        });
+        expectRefused(out, /elment/);
+    });
+    it("refuses a dot-walked field it cannot verify", () => {
+        const out = buildChoices({ scopeQuery: "name.sys_scope={scopeId}" }, null);
+        expectRefused(out, /name\.sys_scope/);
+    });
+    it("refuses a term with no operator", () => {
+        const out = buildChoices({ scopeQuery: "nameSTARTSWITH{scope}_^element" });
+        expectRefused(out, /element/);
+    });
+    it("refuses an empty term (^^)", () => {
+        const out = buildChoices({
+            scopeQuery: "nameSTARTSWITH{scope}_^^element=x",
+        });
+        expectRefused(out, /empty/);
+    });
+    it("refuses when the scope token would render empty", () => {
+        const loaded = loadUtils({
+            rows: CHOICE_ROWS,
+            validFields: ["name", "element", "value", "label"],
+        });
+        const result = loaded.utils.buildTableMap({
+            tableName: "sys_choice",
+            scopeId: null,
+            scopeName: "",
+            getContents: false,
+            includes: { sys_choice: { label: { type: "txt" } } },
+            excludes: {},
+            tableOptions: { scopeQuery: "nameSTARTSWITH{scope}_" },
+        });
+        expect(loaded.captured.queryCalls).toBe(0);
+        expect(Object.keys(result.records)).toHaveLength(0);
+        expect(loaded.warnings[0]).toMatch(/empty/);
+    });
+    it("accepts a valid ^OR template unchanged and runs the query", () => {
+        const out = buildChoices({
+            scopeQuery: "nameSTARTSWITH{scope}_^ORelementSTARTSWITH{scope}_",
+        });
+        expect(out.captured.queryCalls).toBe(1);
+        expect(out.captured.encodedQueries).toEqual([
+            "nameSTARTSWITHx_cadso_automate_^ORelementSTARTSWITHx_cadso_automate_",
+        ]);
+        expect(scopeQueryWarnings(out.warnings)).toHaveLength(0);
+        expect(Object.keys(out.records).length).toBeGreaterThan(0);
+    });
+    it("accepts symbol and word operators (!=, ISNOTEMPTY, IN, ORDERBY)", () => {
+        const out = buildChoices({
+            scopeQuery: "nameSTARTSWITH{scope}_^element!=x^valueISNOTEMPTY^labelINa,b^ORDERBYname",
+        });
+        expect(out.captured.queryCalls).toBe(1);
+        expect(scopeQueryWarnings(out.warnings)).toHaveLength(0);
+    });
+    it("leaves tables without a scopeQuery on the sys_scope path (no validation)", () => {
+        const out = buildChoices({}, []);
+        expect(out.captured.queryCalls).toBe(1);
+        expect(scopeQueryWarnings(out.warnings)).toHaveLength(0);
+    });
+});
 describe("DovetailUtilsMS.generateRecordName — nameTemplate", () => {
     it("names sys_choice folders {name}.{element}.{value} so same-label rows never collide", () => {
         const out = buildChoices({ nameTemplate: "{name}.{element}.{value}" });