@tenonhq/dovetail-core 0.0.96 → 0.0.98

package/dist/appUtils.js

@@ -118,7 +118,13 @@ const processFilesInManRec = async (recPath, rec, forceWrite) => {
 const processRecsInManTable = async (tablePath, table, forceWrite, onRecordProcessed) => {
     const { records } = table;
     const recKeys = Object.keys(records);
-    const recKeyToPath = (key) => path_1.default.join(tablePath, records[key].name);
+    // Derive the folder name via toSafeFolderName, not the raw record.name. The
+    // download path normalizes manifest keys upstream (processManifest), but the
+    // refresh path (processMissingFiles) feeds this writer the raw bulkDownload
+    // response, whose .name is the unmodified ServiceNow display name — which can
+    // be filesystem-unsafe (e.g. a `<table>.*` ACL). toSafeFolderName is
+    // idempotent on already-safe names, so re-applying it here is harmless.
+    const recKeyToPath = (key) => path_1.default.join(tablePath, (0, exports.toSafeFolderName)(records[key]));
     const recPathPromises = recKeys
         .map(recKeyToPath)
         .map(fUtils.createDirRecursively);
@@ -511,11 +517,16 @@ const refreshAllFiles = async (newManifest, sourcePath, options = {}) => {
             var recs = filesToProcess[tableName].records;
             var recKeys = Object.keys(recs);
             await Promise.all(recKeys.map(function (k) {
-                return fUtils.createDirRecursively(path_1.default.join(tablePath, recs[k].name));
+                // toSafeFolderName, not raw recs[k].name: the bulkDownload response
+                // carries the unmodified ServiceNow display name, which may be
+                // filesystem-unsafe (e.g. a `<table>.*` ACL). Without this, refresh
+                // recreates Windows-illegal folders that normalizeManifestKeys
+                // already removed from the manifest.
+                return fUtils.createDirRecursively(path_1.default.join(tablePath, (0, exports.toSafeFolderName)(recs[k])));
             }));
             await (0, genericUtils_1.processBatched)(recKeys, constants_1.CONCURRENCY_RECORDS, async function (recKey) {
                 var rec = recs[recKey];
-                var recPath = path_1.default.join(tablePath, rec.name);
+                var recPath = path_1.default.join(tablePath, (0, exports.toSafeFolderName)(rec));
                 // Split server-provided metadata off from the regular files so we can
                 // track whether any regular file actually changed — metaData shouldn't
                 // be the trigger for "this record changed" since we stamp it on every

package/dist/bootstrap.js

@@ -40,7 +40,15 @@ exports.init = init;
 const dotenv_1 = __importDefault(require("dotenv"));
 const ConfigManager = __importStar(require("./config"));
 const Logger_1 = require("./Logger");
+const envArg_1 = require("./envArg");
 async function init() {
+    // Honor a per-command `--env <path>` override before config/env load so
+    // dotenv reads the requested file. Resolved here (not in loadConfigs) because
+    // the override must be set before loadEnvPath runs inside loadConfigs.
+    const envArg = (0, envArg_1.parseEnvArg)(process.argv.slice(2));
+    if (envArg) {
+        ConfigManager.setEnvPathOverride((0, envArg_1.resolveEnvArgPath)(envArg));
+    }
     let configLoaded = false;
     try {
         await ConfigManager.loadConfigs();

package/dist/commander.js

@@ -24,6 +24,12 @@ async function initCommands() {
         },
     };
     yargs_1.default
+        .option("env", {
+        alias: "e",
+        type: "string",
+        describe: "Path to a .env file to load for this command (default: .env in the project root). Lets one checkout target multiple instances.",
+    })
+        .global("env")
         .command(["watch", "w", "watchAllScopes"], "Watch all scopes for file changes and sync to ServiceNow", (cmdArgs) => {
         cmdArgs.options({
             ...sharedOptions,

package/dist/config.js

@@ -48,6 +48,7 @@ exports.getSourcePath = getSourcePath;
 exports.getSourcePathForScope = getSourcePathForScope;
 exports.getBuildPath = getBuildPath;
 exports.getEnvPath = getEnvPath;
+exports.setEnvPathOverride = setEnvPathOverride;
 exports.getDiffPath = getDiffPath;
 exports.getDiffFile = getDiffFile;
 exports.getRefresh = getRefresh;
@@ -96,6 +97,7 @@ let config_path;
 let source_path;
 let build_path;
 let env_path;
+let env_path_override;
 let manifest_path;
 let diff_path;
 let diff_file;
@@ -188,6 +190,16 @@ function getEnvPath() {
         return env_path;
     throw new Error("Error getting env path");
 }
+/**
+ * @description Overrides the .env file the CLI loads for this invocation.
+ * Set from the per-command `--env` flag before loadConfigs() runs (see
+ * bootstrap.ts) so `loadEnvPath` resolves to the requested file. Pass an
+ * absolute path; relative resolution is handled by the caller (resolveEnvArgPath).
+ * @param {string} absolutePath - Absolute path to the .env file to load.
+ */
+function setEnvPathOverride(absolutePath) {
+    env_path_override = absolutePath;
+}
 function getDiffPath() {
     if (diff_path)
         return diff_path;
@@ -535,6 +547,13 @@ async function loadBuildPath() {
 }
 async function loadEnvPath() {
     let rootDir = getRootDir();
+    // A per-command `--env` override wins over the project-root .env so a single
+    // checkout can target multiple instances by pointing at different credential
+    // files. The override is already resolved to an absolute path by the caller.
+    if (env_path_override) {
+        env_path = env_path_override;
+        return;
+    }
     env_path = path_1.default.join(rootDir, ".env");
 }
 async function loadManifestPath() {

package/dist/envArg.js

@@ -0,0 +1,66 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseEnvArg = parseEnvArg;
+exports.resolveEnvArgPath = resolveEnvArgPath;
+const path_1 = __importDefault(require("path"));
+/**
+ * Per-invocation .env selection for the `dove` CLI.
+ *
+ * Every command accepts `--env <path>` (alias `-e`, also `--env-file` /
+ * `--envFile`) so a single checkout can target multiple instances by pointing
+ * at different credential files, e.g.:
+ *
+ *   npx dove push --env .env.prod
+ *   npx dove status -e ../envs/workshop.env
+ *
+ * The flag is parsed from raw argv before config/env load (see bootstrap.ts)
+ * and also registered as a global yargs option so it appears in `--help`.
+ */
+// Flag spellings that select an env file. `-e` is the short alias.
+var ENV_FLAGS = ["--env", "--env-file", "--envFile", "-e"];
+/**
+ * @description Extracts the env-file path from a raw argv slice. Supports both
+ * `--env <path>` and `--env=<path>` (and the `-e` / `--env-file` spellings).
+ * Returns the last occurrence so a later flag overrides an earlier one.
+ * @param {string[]} argv - Arguments after the node + script entries (process.argv.slice(2)).
+ * @returns {string|undefined} The raw path string, or undefined when absent.
+ */
+function parseEnvArg(argv) {
+    var found;
+    for (var i = 0; i < argv.length; i++) {
+        var arg = argv[i];
+        // `--env=path` / `-e=path`
+        var eq = arg.match(/^(--env|--env-file|--envFile|-e)=(.*)$/);
+        if (eq) {
+            found = eq[2];
+            continue;
+        }
+        // `--env path` / `-e path`
+        if (ENV_FLAGS.indexOf(arg) !== -1) {
+            var next = argv[i + 1];
+            if (typeof next === "string" && next.charAt(0) !== "-") {
+                found = next;
+                i++;
+            }
+        }
+    }
+    if (found === undefined || found === "")
+        return undefined;
+    return found;
+}
+/**
+ * @description Resolves a raw env-file argument to an absolute path. Relative
+ * paths resolve against the directory the command was run from (cwd), matching
+ * where the user typed the path.
+ * @param {string} rawPath - The value returned by parseEnvArg.
+ * @param {string} [cwd] - Base directory for relative paths (defaults to process.cwd()).
+ * @returns {string} An absolute path to the requested .env file.
+ */
+function resolveEnvArgPath(rawPath, cwd) {
+    if (path_1.default.isAbsolute(rawPath))
+        return rawPath;
+    return path_1.default.resolve(cwd || process.cwd(), rawPath);
+}

package/dist/initSystem/orchestrator.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -12,8 +45,24 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const Logger_1 = require("../Logger");
 const FileUtils_1 = require("../FileUtils");
+const ConfigManager = __importStar(require("../config"));
 const discovery_1 = require("./discovery");
 const corePlugin_1 = require("./corePlugin");
+/**
+ * @description Resolves the .env file login should read from and write to,
+ * honoring a per-command `--env` override when one is set. Falls back to
+ * <rootDir>/.env when config hasn't loaded an override.
+ * @param {string} rootDir - Project root used for the default .env location.
+ * @returns {string} Absolute path to the target .env file.
+ */
+function resolveLoginEnvPath(rootDir) {
+    try {
+        return ConfigManager.getEnvPath();
+    }
+    catch (e) {
+        return path_1.default.resolve(rootDir, ".env");
+    }
+}
 // ============================================================================
 // Init Context
 // ============================================================================
@@ -24,7 +73,7 @@ const corePlugin_1 = require("./corePlugin");
  */
 function buildInitContext(plugins) {
     const rootDir = process.cwd();
-    const envPath = path_1.default.resolve(rootDir, ".env");
+    const envPath = resolveLoginEnvPath(rootDir);
     const env = {};
     // Load existing .env values
     try {
@@ -254,10 +303,11 @@ function saveEnvVars(context, plugins) {
         .filter(key => context.env[key])
         .map(key => ({ key, value: context.env[key] }));
     if (vars.length > 0) {
-        (0, FileUtils_1.writeEnvVars)({ vars });
+        const envPath = resolveLoginEnvPath(process.cwd());
+        (0, FileUtils_1.writeEnvVars)({ vars, envPath });
         // Also set on process.env for immediate use
         vars.forEach(({ key, value }) => { process.env[key] = value; });
-        Logger_1.logger.success(chalk_1.default.green("✓ Saved to .env (existing values preserved)"));
+        Logger_1.logger.success(chalk_1.default.green("✓ Saved to " + path_1.default.basename(envPath) + " (existing values preserved)"));
     }
 }
 async function runInit(options) {

package/dist/tests/envArg.test.js

@@ -0,0 +1,49 @@
+"use strict";
+// Tests for the per-command `--env` flag parser (envArg.ts). Covers the flag
+// spellings (--env, --env-file, --envFile, -e), `=` and space-separated forms,
+// last-wins precedence, absence, and absolute/relative path resolution.
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const path_1 = __importDefault(require("path"));
+const envArg_1 = require("../envArg");
+describe("parseEnvArg", function () {
+    it("returns undefined when no env flag is present", function () {
+        expect((0, envArg_1.parseEnvArg)(["push", "--diff", "main"])).toBeUndefined();
+    });
+    it("parses --env <path> (space-separated)", function () {
+        expect((0, envArg_1.parseEnvArg)(["push", "--env", ".env.prod"])).toBe(".env.prod");
+    });
+    it("parses --env=<path>", function () {
+        expect((0, envArg_1.parseEnvArg)(["status", "--env=../envs/workshop.env"])).toBe("../envs/workshop.env");
+    });
+    it("parses the -e short alias (space and = forms)", function () {
+        expect((0, envArg_1.parseEnvArg)(["status", "-e", ".env.dev"])).toBe(".env.dev");
+        expect((0, envArg_1.parseEnvArg)(["status", "-e=.env.dev"])).toBe(".env.dev");
+    });
+    it("parses --env-file and --envFile spellings", function () {
+        expect((0, envArg_1.parseEnvArg)(["push", "--env-file", "a.env"])).toBe("a.env");
+        expect((0, envArg_1.parseEnvArg)(["push", "--envFile", "b.env"])).toBe("b.env");
+    });
+    it("takes the last occurrence when the flag is repeated", function () {
+        expect((0, envArg_1.parseEnvArg)(["push", "--env", "first.env", "--env", "second.env"])).toBe("second.env");
+    });
+    it("ignores a bare --env with no following value", function () {
+        expect((0, envArg_1.parseEnvArg)(["push", "--env"])).toBeUndefined();
+    });
+    it("does not consume the next token when it looks like another flag", function () {
+        expect((0, envArg_1.parseEnvArg)(["push", "--env", "--ci"])).toBeUndefined();
+    });
+    it("treats an empty --env= as absent", function () {
+        expect((0, envArg_1.parseEnvArg)(["push", "--env="])).toBeUndefined();
+    });
+});
+describe("resolveEnvArgPath", function () {
+    it("returns absolute paths unchanged", function () {
+        expect((0, envArg_1.resolveEnvArgPath)("/abs/path/.env", "/cwd")).toBe("/abs/path/.env");
+    });
+    it("resolves relative paths against the provided cwd", function () {
+        expect((0, envArg_1.resolveEnvArgPath)(".env.prod", "/projects/sn")).toBe(path_1.default.join("/projects/sn", ".env.prod"));
+    });
+});

package/dist/tests/refreshSafeFolderNames.test.js

@@ -0,0 +1,216 @@
+"use strict";
+/**
+ * Regression: the refresh path must write filesystem-SAFE folder names.
+ *
+ * normalizeManifestKeys() (PR #117) re-keys the manifest object so a record
+ * with a Windows-illegal display name (e.g. a table-wildcard ACL named
+ * `x_cadso_work_campaign.*`) maps to its sys_id. But the refresh writer
+ * (`refreshAllFiles`) builds folders from the raw `getMissingFiles`
+ * (bulkDownload) server response, whose `.name` is the unmodified display
+ * name — so it recreated the illegal `<table>.*` folders on every refresh,
+ * silently breaking the folder ≡ manifest-key invariant and aborting
+ * `git clone` on Windows.
+ *
+ * These tests assert the writer routes through toSafeFolderName: a `.*` ACL
+ * record lands in a sys_id folder, while a safe name stays human-readable.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+// ---------- mocks (must come before importing the module under test) ----------
+var mockLogger = {
+    info: jest.fn(),
+    debug: jest.fn(),
+    warn: jest.fn(),
+    error: jest.fn(),
+    success: jest.fn(),
+    getLogLevel: function () { return "warn"; },
+};
+var mockFileLogger = {
+    debug: jest.fn(),
+    info: jest.fn(),
+    warn: jest.fn(),
+    error: jest.fn(),
+};
+var mockClient = {
+    getManifest: jest.fn(),
+    getMissingFiles: jest.fn(),
+};
+jest.mock("../Logger", function () { return { logger: mockLogger }; });
+jest.mock("../FileLogger", function () { return { fileLogger: mockFileLogger }; });
+jest.mock("../snClient", function () {
+    return {
+        defaultClient: function () { return mockClient; },
+        unwrapSNResponse: function (p) { return Promise.resolve(p).then(function (r) { return r; }); },
+        processPushResponse: jest.fn(),
+        retryOnErr: jest.fn(),
+        retryOnHttpErr: jest.fn(),
+        unwrapTableAPIFirstItem: jest.fn(),
+    };
+});
+var mockConfig = {
+    getConfig: jest.fn().mockReturnValue({
+        scopes: { x_cadso_work: {} },
+        tableOptions: {},
+    }),
+    getManifest: jest.fn().mockResolvedValue({
+        x_cadso_work: { scope: "x_cadso_work", tables: {} },
+    }),
+    getSourcePathForScope: jest.fn(),
+    getSourcePath: jest.fn(),
+    getManifestPath: jest.fn().mockReturnValue("/tmp/dove.manifest.json"),
+    resolveConfigForScope: jest.fn().mockImplementation(function () {
+        return {
+            tables: ["sys_security_acl"],
+            fieldOverrides: {},
+            apiIncludes: {},
+            apiExcludes: {},
+        };
+    }),
+    isMultiScopeManifest: jest.fn().mockReturnValue(true),
+    updateManifest: jest.fn(),
+};
+jest.mock("../config", function () { return mockConfig; });
+jest.mock("progress", function () {
+    return jest.fn().mockImplementation(function () {
+        return { tick: jest.fn() };
+    });
+});
+// Keep real FileUtils so we assert against the actual file system; stub only
+// writeScopeManifest so no manifest file is written.
+jest.mock("../FileUtils", function () {
+    var actual = jest.requireActual("../FileUtils");
+    return Object.assign({}, actual, {
+        writeScopeManifest: jest.fn().mockResolvedValue(undefined),
+    });
+});
+const AppUtils = __importStar(require("../appUtils"));
+// ---------- helpers ----------
+var tmpRoot;
+var ACL_SYS_ID = "bc91c2a5f334621048dff31590812771";
+function listAclFolders() {
+    var dir = path.join(tmpRoot, "sys_security_acl");
+    try {
+        return fs.readdirSync(dir).sort();
+    }
+    catch (e) {
+        return [];
+    }
+}
+describe("refresh — folder names are filesystem-safe (sys_id fallback)", function () {
+    beforeEach(function () {
+        jest.clearAllMocks();
+        tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), "dove-safe-folder-"));
+        mockConfig.getSourcePathForScope.mockReturnValue(tmpRoot);
+        mockConfig.getSourcePath.mockReturnValue(tmpRoot);
+    });
+    afterEach(function () {
+        try {
+            fs.rmSync(tmpRoot, { recursive: true, force: true });
+        }
+        catch (e) { }
+    });
+    test("a `<table>.*` ACL record is written to its sys_id folder, never `.*`", async function () {
+        // Manifest as the server returns it: keyed by the illegal display name.
+        // normalizeManifestKeys re-keys this to sys_id inside syncManifest.
+        mockClient.getManifest.mockResolvedValue({
+            scope: "x_cadso_work",
+            tables: {
+                sys_security_acl: {
+                    records: {
+                        "x_cadso_work_campaign.*": {
+                            name: "x_cadso_work_campaign.*",
+                            sys_id: ACL_SYS_ID,
+                            files: [{ name: "script", type: "js" }],
+                        },
+                    },
+                },
+            },
+        });
+        // bulkDownload echoes the RAW display name back — the bug source. The
+        // writer must not trust it for the folder path.
+        mockClient.getMissingFiles.mockResolvedValue({
+            sys_security_acl: {
+                records: {
+                    "x_cadso_work_campaign.*": {
+                        name: "x_cadso_work_campaign.*",
+                        sys_id: ACL_SYS_ID,
+                        files: [{ name: "script", type: "js", content: "// acl" }],
+                    },
+                },
+            },
+        });
+        await AppUtils.syncManifest("x_cadso_work");
+        var folders = listAclFolders();
+        expect(folders).toContain(ACL_SYS_ID);
+        expect(folders).not.toContain("x_cadso_work_campaign.*");
+        // The file landed inside the sys_id folder.
+        expect(fs.readFileSync(path.join(tmpRoot, "sys_security_acl", ACL_SYS_ID, "script.js"), "utf8")).toBe("// acl");
+    });
+    test("a filesystem-safe ACL name stays human-readable (no needless sys_id fallback)", async function () {
+        var SAFE_SYS_ID = "aa11bb22cc33dd44ee55ff6600112233";
+        mockClient.getManifest.mockResolvedValue({
+            scope: "x_cadso_work",
+            tables: {
+                sys_security_acl: {
+                    records: {
+                        x_cadso_work_campaign: {
+                            name: "x_cadso_work_campaign",
+                            sys_id: SAFE_SYS_ID,
+                            files: [{ name: "script", type: "js" }],
+                        },
+                    },
+                },
+            },
+        });
+        mockClient.getMissingFiles.mockResolvedValue({
+            sys_security_acl: {
+                records: {
+                    x_cadso_work_campaign: {
+                        name: "x_cadso_work_campaign",
+                        sys_id: SAFE_SYS_ID,
+                        files: [{ name: "script", type: "js", content: "// safe" }],
+                    },
+                },
+            },
+        });
+        await AppUtils.syncManifest("x_cadso_work");
+        var folders = listAclFolders();
+        expect(folders).toContain("x_cadso_work_campaign");
+        expect(folders).not.toContain(SAFE_SYS_ID);
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tenonhq/dovetail-core",
-  "version": "0.0.96",
+  "version": "0.0.98",
   "description": "Next-gen file syncer",
   "license": "GPL-3.0",
   "main": "./dist/index.js",

package/release-manifest.json

@@ -1,7 +1,161 @@
 {
   "$schema": "dovetail-manifest/v1",
-  "generated_at": "2026-05-31T16:52:41.031Z",
+  "generated_at": "2026-06-02T14:03:06.707Z",
   "events": [
+    {
+      "$schema": "dovetail-release-event/v1",
+      "event_id": "dovetail-schema@0.0.10",
+      "package": "@tenonhq/dovetail-schema",
+      "version": "0.0.10",
+      "prev_version": "0.0.9",
+      "published_at": "2026-06-02T14:03:06.699Z",
+      "git": {
+        "sha": "9a243fd936caa778def575de19c79d978b65f5ac",
+        "tag": "dovetail-schema@0.0.10"
+      },
+      "semver_bump": "patch",
+      "commits": [
+        {
+          "sha": "9a243fd93",
+          "subject": "fix(schema): stop stamping created_at/generated_at into schema pull output (#135)",
+          "pr": 135
+        },
+        {
+          "sha": "407d6d75e",
+          "subject": "chore(release): publish 2 packages [skip ci]"
+        }
+      ],
+      "exports_delta": null,
+      "narrative": null
+    },
+    {
+      "$schema": "dovetail-release-event/v1",
+      "event_id": "dovetail-core@0.0.97",
+      "package": "@tenonhq/dovetail-core",
+      "version": "0.0.97",
+      "prev_version": "0.0.96",
+      "published_at": "2026-06-01T23:57:01.670Z",
+      "git": {
+        "sha": "a0c364c7070a82f70c5dc9eed01c29c61b2f8b56",
+        "tag": "dovetail-core@0.0.97"
+      },
+      "semver_bump": "patch",
+      "commits": [
+        {
+          "sha": "a0c364c70",
+          "subject": "fix: route refresh folder writes through toSafeFolderName (Windows-safe names) (#133)",
+          "pr": 133
+        },
+        {
+          "sha": "958f4fcd7",
+          "subject": "chore(release): publish 3 packages [skip ci]"
+        }
+      ],
+      "exports_delta": null,
+      "narrative": null
+    },
+    {
+      "$schema": "dovetail-release-event/v1",
+      "event_id": "dovetail-core@0.0.96",
+      "package": "@tenonhq/dovetail-core",
+      "version": "0.0.96",
+      "prev_version": "0.0.95",
+      "published_at": "2026-06-01T21:28:08.724Z",
+      "git": {
+        "sha": "a3ea5ead48b0bd4c324e0847e7e768a43520c7ec",
+        "tag": "dovetail-core@0.0.96"
+      },
+      "semver_bump": "patch",
+      "commits": [
+        {
+          "sha": "a3ea5ead4",
+          "subject": "feat(client): point Dovetail clients at the scoped dovetail_* APIs (#132)",
+          "pr": 132
+        },
+        {
+          "sha": "93d180eef",
+          "subject": "chore(release): @tenonhq/dovetail-servicenow@0.0.9 [skip ci]"
+        },
+        {
+          "sha": "d32523991",
+          "subject": "chore(release): @tenonhq/dovetail-servicenow@0.0.8 [skip ci]"
+        },
+        {
+          "sha": "ba1c67775",
+          "subject": "chore(release): @tenonhq/dovetail-dashboard@0.0.36 [skip ci]"
+        },
+        {
+          "sha": "9901285c6",
+          "subject": "chore(release): @tenonhq/dovetail-dashboard@0.0.35 [skip ci]"
+        },
+        {
+          "sha": "55de31527",
+          "subject": "chore(release): @tenonhq/dovetail-dashboard@0.0.34 [skip ci]"
+        },
+        {
+          "sha": "776f1fc53",
+          "subject": "chore(release): @tenonhq/dovetail-sawmill@0.0.7 [skip ci]"
+        },
+        {
+          "sha": "407d6d75e",
+          "subject": "chore(release): publish 2 packages [skip ci]"
+        }
+      ],
+      "exports_delta": null,
+      "narrative": null
+    },
+    {
+      "$schema": "dovetail-release-event/v1",
+      "event_id": "dovetail-servicenow@0.0.10",
+      "package": "@tenonhq/dovetail-servicenow",
+      "version": "0.0.10",
+      "prev_version": "0.0.9",
+      "published_at": "2026-06-01T21:28:08.724Z",
+      "git": {
+        "sha": "a3ea5ead48b0bd4c324e0847e7e768a43520c7ec",
+        "tag": "dovetail-servicenow@0.0.10"
+      },
+      "semver_bump": "patch",
+      "commits": [
+        {
+          "sha": "a3ea5ead4",
+          "subject": "feat(client): point Dovetail clients at the scoped dovetail_* APIs (#132)",
+          "pr": 132
+        },
+        {
+          "sha": "93d180eef",
+          "subject": "chore(release): @tenonhq/dovetail-servicenow@0.0.9 [skip ci]"
+        }
+      ],
+      "exports_delta": null,
+      "narrative": null
+    },
+    {
+      "$schema": "dovetail-release-event/v1",
+      "event_id": "dovetail-sawmill@0.0.8",
+      "package": "@tenonhq/dovetail-sawmill",
+      "version": "0.0.8",
+      "prev_version": "0.0.7",
+      "published_at": "2026-06-01T21:28:08.724Z",
+      "git": {
+        "sha": "a3ea5ead48b0bd4c324e0847e7e768a43520c7ec",
+        "tag": "dovetail-sawmill@0.0.8"
+      },
+      "semver_bump": "patch",
+      "commits": [
+        {
+          "sha": "a3ea5ead4",
+          "subject": "feat(client): point Dovetail clients at the scoped dovetail_* APIs (#132)",
+          "pr": 132
+        },
+        {
+          "sha": "776f1fc53",
+          "subject": "chore(release): @tenonhq/dovetail-sawmill@0.0.7 [skip ci]"
+        }
+      ],
+      "exports_delta": null,
+      "narrative": null
+    },
     {
       "$schema": "dovetail-release-event/v1",
       "event_id": "dovetail-servicenow@0.0.9",

package/skills/dove-setup-project.md

@@ -56,6 +56,7 @@ SN_INSTANCE=your-instance.service-now.com
 - Instance should NOT have `https://` prefix or trailing slash
 - Optional: `DASHBOARD_PORT=3456`
 - **Never commit `.env` to git**
+- **Multiple instances?** Keep one file per instance (`.env.dev`, `.env.prod`) and pass `--env <path>` (alias `-e`) on any command: `npx dove push --env .env.prod`. `dove login --env .env.prod` writes credentials to that file too. Git-ignore the whole pattern (`.env*`).
 
 #### Set up `.gitignore`
 ```

package/skills/dove-troubleshoot-sync.md

@@ -49,10 +49,12 @@ Ask the user which symptom they are experiencing (if not already clear):
    - Instance should NOT have `https://` prefix or trailing slash
    - Credentials must have admin or developer role
 
-2. **Test connection:** `npx dove status`
+2. **Test connection:** `npx dove status` (add `--env <path>` to test a specific credential file, e.g. `npx dove status --env .env.prod`)
 
 3. **Check the Dovetail server scoped app** is installed on the instance. Without it, API endpoints will 404.
 
+   - **Hitting the wrong instance?** A stray `.env` in the working directory — or a shell-exported `SN_INSTANCE` — can override the file you expect. Pass `--env <path>` to load credentials from a specific file (every `dove` command accepts it; alias `-e`). Already-set environment variables still win, so unset conflicting `SN_*` vars if needed.
+
 4. **Check for MFA/SSO:** If the instance uses MFA or SSO, basic auth may not work. You may need a local ServiceNow account.
 
 ### Diagnostic C: Scope Mismatch