@tenonhq/dovetail-core 0.0.98 → 0.0.100

package/dist/allScopesCommands.js

@@ -36,6 +36,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.processManifestForScope = processManifestForScope;
 exports.processScope = processScope;
 exports.initScopesCommand = initScopesCommand;
 exports.watchAllScopesCommand = watchAllScopesCommand;
@@ -51,7 +52,8 @@ const fs = __importStar(require("fs"));
 const child_process_1 = require("child_process");
 const progress_1 = __importDefault(require("progress"));
 const fsp = fs.promises;
-// Custom function to process manifest with specific source directory
+// Custom function to process manifest with specific source directory.
+// Exported for regression testing of filesystem-safe folder writing.
 async function processManifestForScope(manifest, sourceDirectory, forceWrite = false) {
     try {
         // Ensure the source directory exists
@@ -62,6 +64,13 @@ async function processManifestForScope(manifest, sourceDirectory, forceWrite = f
             Logger_1.logger.error("Failed to create directory: " + sourceDirectory);
             throw dirError;
         }
+        // Re-key the manifest to filesystem-safe folder names before writing.
+        // Idempotent, so it is safe even when the caller already normalized.
+        // Without this, a Windows-illegal display name (trailing dot/space, or
+        // any of <>:"|?*) would be written as a raw folder and abort `git clone`
+        // on Windows. Keeps the folder ≡ manifest-key invariant `dove push` relies
+        // on. See toSafeFolderName / normalizeManifestKeys (PR #117, #133).
+        AppUtils.normalizeManifestKeys(manifest);
         const tables = manifest.tables || {};
         const tableNames = Object.keys(tables);
         var totalRecords = 0;
@@ -86,8 +95,10 @@ async function processManifestForScope(manifest, sourceDirectory, forceWrite = f
             FileLogger_1.fileLogger.debug("Table " + tableName + ": " + recordNames.length + " records");
             for (const recordName of recordNames) {
                 const record = tableRecords.records[recordName];
-                // Use the record's name property instead of the key for the directory name
-                const recordDirName = record.name || recordName;
+                // Derive the folder via toSafeFolderName (never the raw record.name):
+                // normalizeManifestKeys above already re-keyed unsafe names to sys_id,
+                // and this keeps the writer defensive if that ever changes.
+                const recordDirName = AppUtils.toSafeFolderName(record);
                 const recordPath = path.join(tablePath, recordDirName);
                 // Check if metadata file exists in the files from server
                 const hasMetadataFromServer = record.files && record.files.some((f) => f.name === 'metaData' && f.type === 'json');
@@ -195,8 +206,9 @@ async function processScope(scopeName, scopeConfig, apiDelay = 0) {
         else {
             Logger_1.logger.warn("No _tables whitelist defined — writing ALL tables for " + scopeName);
         }
-        // Normalize record keys from sys_id to display name
-        AppUtils.normalizeManifestKeys(manifest);
+        // Record-key normalization now happens inside processManifestForScope (the
+        // writer owns the folder ≡ key invariant). The missing-files structure
+        // below keys by record.sys_id, so it does not depend on normalized names.
         // Build the missing files structure from the filtered manifest
         var manifestTables = manifest.tables || {};
         var allMissingFiles = {};

package/dist/appUtils.js

@@ -36,7 +36,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createAndAssignUpdateSet = exports.swapScope = exports.buildFiles = exports.summarizeRecord = exports.pushFiles = exports.getAppFileList = exports.groupAppFiles = exports.processMissingFiles = exports.refreshAllFiles = exports.findMissingFiles = exports.syncManifest = exports.processManifest = exports.normalizeManifestKeys = exports.toSafeFolderName = void 0;
+exports.createAndAssignUpdateSet = exports.swapScope = exports.buildFiles = exports.summarizeRecord = exports.pushFiles = exports.getAppFileList = exports.groupAppFiles = exports.processMissingFiles = exports.refreshAllFiles = exports.findMissingFiles = exports.syncManifest = exports.processManifest = exports.normalizeManifestKeys = exports.toSafeFolderName = exports.stampMetadataContent = void 0;
 const path_1 = __importDefault(require("path"));
 const fs_1 = __importDefault(require("fs"));
 const progress_1 = __importDefault(require("progress"));
@@ -62,6 +62,14 @@ const getUpdateSetConfig = () => {
     }
     return {};
 };
+// Strip the ServiceNow instance host from an absolute _record_link, leaving the
+// instance-relative path. The CADSO metadata endpoint returns an absolute URL
+// (https://<instance>.service-now.com/<table>.do?sys_id=...); persisting that
+// makes the on-disk artifact instance-bound, so a re-pull from a different
+// instance rewrites every metaData.json with the new host. The relative path
+// (/<table>.do?sys_id=...) resolves against whatever instance the reader is on.
+// Matches any *.service-now.com host so the output is portable across instances.
+const stripRecordLinkHost = (link) => link.replace(/^https?:\/\/[^/]+\.service-now\.com/i, "");
 // Merge _lastUpdatedOn into the server-provided metadata content. Preserves all
 // record fields (sys_id, sys_scope, field value/display_value pairs, etc.) so
 // the local metaData.json is a full snapshot of the record, not just a stub.
@@ -80,6 +88,9 @@ const stampMetadataContent = (file) => {
         else {
             metadata._lastUpdatedOn = stamp;
         }
+        if (typeof metadata._record_link === "string") {
+            metadata._record_link = stripRecordLinkHost(metadata._record_link);
+        }
         return { ...file, content: JSON.stringify(metadata, null, 2) };
     }
     catch (e) {
@@ -87,6 +98,7 @@ const stampMetadataContent = (file) => {
         return file;
     }
 };
+exports.stampMetadataContent = stampMetadataContent;
 const hasServerMetadata = (files) => files.some((f) => f.name === "metaData" && f.type === "json" && !!f.content);
 const processFilesInManRec = async (recPath, rec, forceWrite) => {
     FileLogger_1.fileLogger.debug("Processing record: " + rec.name + " (" + rec.files.length + " files)");
@@ -101,7 +113,7 @@ const processFilesInManRec = async (recPath, rec, forceWrite) => {
         };
         await fileWrite(stubMetadata, recPath);
     }
-    const writeResults = await (0, genericUtils_1.allSettledBatched)(rec.files, constants_1.CONCURRENCY_FILES, function (file) { return fileWrite(stampMetadataContent(file), recPath); });
+    const writeResults = await (0, genericUtils_1.allSettledBatched)(rec.files, constants_1.CONCURRENCY_FILES, function (file) { return fileWrite((0, exports.stampMetadataContent)(file), recPath); });
     const writeFailures = writeResults.filter((r) => r.status === "rejected");
     if (writeFailures.length > 0) {
         writeFailures.forEach((f) => {
@@ -572,7 +584,7 @@ const refreshAllFiles = async (newManifest, sourcePath, options = {}) => {
                 if (anyChanged || forceWrite) {
                     let metadataFile;
                     if (metadataFiles.length > 0 && metadataFiles[0].content) {
-                        metadataFile = stampMetadataContent(metadataFiles[0]);
+                        metadataFile = (0, exports.stampMetadataContent)(metadataFiles[0]);
                     }
                     else {
                         metadataFile = {

package/dist/tests/downloadSafeFolderNames.test.js

@@ -0,0 +1,189 @@
+"use strict";
+/**
+ * Regression: the download / initScopes writer must produce filesystem-SAFE
+ * folder names — even when its caller forgets to normalize the manifest first.
+ *
+ * `processManifestForScope` (allScopesCommands.ts) builds one folder per record.
+ * It used to do `record.name || recordName` with no sanitization, so a record
+ * whose ServiceNow display name is Windows-illegal — e.g. a sys_ui_script named
+ * `x_cadso_core.` (trailing dot) — was written as a literal `x_cadso_core.`
+ * folder. Windows forbids trailing dots/spaces in path segments, so Git aborts
+ * the whole checkout (`error: invalid path`) and the clone fails for every
+ * Windows dev. It only avoided the bug because one caller happened to call
+ * normalizeManifestKeys first; any other caller re-introduced it.
+ *
+ * The writer now normalizes the manifest itself and routes folder names through
+ * toSafeFolderName, so an unsafe name falls back to its sys_id (and the manifest
+ * is re-keyed to match — preserving the folder ≡ key invariant `dove push`
+ * relies on), while a safe name stays human-readable.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+// ---------- mocks (must come before importing the module under test) ----------
+var mockLogger = {
+    info: jest.fn(),
+    debug: jest.fn(),
+    warn: jest.fn(),
+    error: jest.fn(),
+    success: jest.fn(),
+    getLogLevel: function () { return "warn"; },
+};
+var mockFileLogger = {
+    debug: jest.fn(),
+    info: jest.fn(),
+    warn: jest.fn(),
+    error: jest.fn(),
+};
+jest.mock("../Logger", function () { return { logger: mockLogger }; });
+jest.mock("../FileLogger", function () { return { fileLogger: mockFileLogger }; });
+jest.mock("../config", function () { return {}; });
+jest.mock("../snClient", function () {
+    return {
+        defaultClient: function () { return {}; },
+        unwrapSNResponse: function (p) { return Promise.resolve(p); },
+    };
+});
+jest.mock("../wizard", function () {
+    return { setupDotEnv: jest.fn(), getLoginInfo: jest.fn() };
+});
+jest.mock("../commands", function () { return { setLogLevel: jest.fn() }; });
+jest.mock("progress", function () {
+    return jest.fn().mockImplementation(function () {
+        return { tick: jest.fn() };
+    });
+});
+const AllScopes = __importStar(require("../allScopesCommands"));
+// ---------- helpers ----------
+var tmpRoot;
+var UI_SYS_ID = "89295b86334983d07b18bc534d5c7b8a";
+var SAFE_SYS_ID = "aa11bb22cc33dd44ee55ff6600112233";
+function listFolders(table) {
+    try {
+        return fs.readdirSync(path.join(tmpRoot, table)).sort();
+    }
+    catch (e) {
+        return [];
+    }
+}
+describe("download — folder names are filesystem-safe (self-sufficient writer)", function () {
+    beforeEach(function () {
+        jest.clearAllMocks();
+        tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), "dove-dl-safe-"));
+    });
+    afterEach(function () {
+        try {
+            fs.rmSync(tmpRoot, { recursive: true, force: true });
+        }
+        catch (e) { }
+    });
+    test("a trailing-dot record name is written to its sys_id folder, never `x_cadso_core.`", async function () {
+        // Manifest keyed by the raw, Windows-illegal display name — i.e. a caller
+        // that did NOT pre-normalize. The writer must defend itself.
+        var manifest = {
+            tables: {
+                sys_ui_script: {
+                    records: {
+                        "x_cadso_core.": {
+                            name: "x_cadso_core.",
+                            sys_id: UI_SYS_ID,
+                            files: [{ name: "script", type: "js", content: "// ui" }],
+                        },
+                    },
+                },
+            },
+        };
+        await AllScopes.processManifestForScope(manifest, tmpRoot, true);
+        var folders = listFolders("sys_ui_script");
+        expect(folders).toContain(UI_SYS_ID);
+        expect(folders).not.toContain("x_cadso_core.");
+        // File landed inside the sys_id folder.
+        expect(fs.readFileSync(path.join(tmpRoot, "sys_ui_script", UI_SYS_ID, "script.js"), "utf8")).toBe("// ui");
+        // Folder ≡ manifest-key invariant: the manifest was re-keyed to the sys_id
+        // so `dove push` (which looks records up by folder name) still resolves it.
+        expect(Object.keys(manifest.tables.sys_ui_script.records)).toEqual([UI_SYS_ID]);
+    });
+    test("other Windows-illegal names also fall back to sys_id (wildcard ACL, trailing space)", async function () {
+        var ACL_SYS_ID = "bc91c2a5f334621048dff31590812771";
+        var SPACE_SYS_ID = "cc22dd33ee44ff5500112233445566aa";
+        var manifest = {
+            tables: {
+                sys_security_acl: {
+                    records: {
+                        // A `<table>.*` wildcard ACL — the `*` (and trailing `.*`) is illegal on Windows.
+                        "x_cadso_work_campaign.*": {
+                            name: "x_cadso_work_campaign.*",
+                            sys_id: ACL_SYS_ID,
+                            files: [{ name: "script", type: "js", content: "// acl" }],
+                        },
+                        // A trailing space is silently stripped by Win32 — also unsafe.
+                        "Trailing Space ": {
+                            name: "Trailing Space ",
+                            sys_id: SPACE_SYS_ID,
+                            files: [{ name: "script", type: "js", content: "// space" }],
+                        },
+                    },
+                },
+            },
+        };
+        await AllScopes.processManifestForScope(manifest, tmpRoot, true);
+        var folders = listFolders("sys_security_acl");
+        expect(folders).toContain(ACL_SYS_ID);
+        expect(folders).toContain(SPACE_SYS_ID);
+        expect(folders).not.toContain("x_cadso_work_campaign.*");
+        expect(folders).not.toContain("Trailing Space ");
+    });
+    test("a filesystem-safe name stays human-readable (no needless sys_id fallback)", async function () {
+        var manifest = {
+            tables: {
+                sys_ui_script: {
+                    records: {
+                        "Tenon Shell": {
+                            name: "Tenon Shell",
+                            sys_id: SAFE_SYS_ID,
+                            files: [{ name: "script", type: "js", content: "// shell" }],
+                        },
+                    },
+                },
+            },
+        };
+        await AllScopes.processManifestForScope(manifest, tmpRoot, true);
+        var folders = listFolders("sys_ui_script");
+        expect(folders).toContain("Tenon Shell");
+        expect(folders).not.toContain(SAFE_SYS_ID);
+    });
+});

package/dist/tests/stampMetadataContent.test.js

@@ -0,0 +1,62 @@
+"use strict";
+// Tests for stampMetadataContent — the writer that finalizes each record's
+// metaData.json before it lands on disk.
+//
+// Two on-disk-stability concerns are covered:
+//   1. _lastUpdatedOn is sourced from the record's sys_updated_on (stable across
+//      re-pulls) rather than a fresh wall-clock stamp.
+//   2. _record_link is rewritten to an instance-relative path. The CADSO metadata
+//      endpoint returns an absolute URL (https://<instance>.service-now.com/...);
+//      persisting the host makes the artifact instance-bound and dirties every
+//      file on a re-pull from a different instance. Stripping any *.service-now.com
+//      host keeps the diff to genuine schema changes.
+Object.defineProperty(exports, "__esModule", { value: true });
+const appUtils_1 = require("../appUtils");
+const metaFile = (content) => ({
+    name: "metaData",
+    type: "json",
+    content: JSON.stringify(content),
+});
+const parse = (file) => JSON.parse(file.content);
+describe("stampMetadataContent — _record_link host stripping", () => {
+    it("strips the configured workstudio host, leaving the relative path", () => {
+        const out = (0, appUtils_1.stampMetadataContent)(metaFile({
+            sys_updated_on: { value: "2025-08-21 17:09:02" },
+            _record_link: "https://tenonworkstudio.service-now.com/sys_hub_action_input.do?sys_id=85de623c33ef2a107b18bc534d5c7b92",
+        }));
+        expect(parse(out)._record_link).toBe("/sys_hub_action_input.do?sys_id=85de623c33ef2a107b18bc534d5c7b92");
+    });
+    it("strips any *.service-now.com host (instance-portable)", () => {
+        for (const host of ["tenonworkshop", "tenon", "tenonworkbench"]) {
+            const out = (0, appUtils_1.stampMetadataContent)(metaFile({
+                _record_link: `https://${host}.service-now.com/x_cadso_core_setting.do?sys_id=abc`,
+            }));
+            expect(parse(out)._record_link).toBe("/x_cadso_core_setting.do?sys_id=abc");
+        }
+    });
+    it("leaves an already-relative _record_link untouched (idempotent)", () => {
+        const out = (0, appUtils_1.stampMetadataContent)(metaFile({ _record_link: "/sys_hub_action_input.do?sys_id=abc" }));
+        expect(parse(out)._record_link).toBe("/sys_hub_action_input.do?sys_id=abc");
+    });
+    it("leaves records without a _record_link unchanged", () => {
+        const out = (0, appUtils_1.stampMetadataContent)(metaFile({ sys_updated_on: { value: "2025-08-21 17:09:02" } }));
+        expect(parse(out)._record_link).toBeUndefined();
+    });
+    it("ignores a non-string _record_link rather than throwing", () => {
+        const out = (0, appUtils_1.stampMetadataContent)(metaFile({ _record_link: null }));
+        expect(parse(out)._record_link).toBeNull();
+    });
+    it("still sources _lastUpdatedOn from sys_updated_on while stripping the host", () => {
+        const out = (0, appUtils_1.stampMetadataContent)(metaFile({
+            sys_updated_on: { value: "2025-08-21 17:09:02" },
+            _record_link: "https://tenonworkstudio.service-now.com/incident.do?sys_id=1",
+        }));
+        const parsed = parse(out);
+        expect(parsed._lastUpdatedOn).toBe("2025-08-21 17:09:02");
+        expect(parsed._record_link).toBe("/incident.do?sys_id=1");
+    });
+    it("passes through non-metaData files verbatim", () => {
+        const script = { name: "script", type: "js", content: "var x = 1;" };
+        expect((0, appUtils_1.stampMetadataContent)(script)).toEqual(script);
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tenonhq/dovetail-core",
-  "version": "0.0.98",
+  "version": "0.0.100",
   "description": "Next-gen file syncer",
   "license": "GPL-3.0",
   "main": "./dist/index.js",

package/release-manifest.json

@@ -1,7 +1,93 @@
 {
   "$schema": "dovetail-manifest/v1",
-  "generated_at": "2026-06-02T14:03:06.707Z",
+  "generated_at": "2026-06-02T18:16:07.004Z",
   "events": [
+    {
+      "$schema": "dovetail-release-event/v1",
+      "event_id": "dovetail-core@0.0.99",
+      "package": "@tenonhq/dovetail-core",
+      "version": "0.0.99",
+      "prev_version": "0.0.98",
+      "published_at": "2026-06-02T18:16:06.996Z",
+      "git": {
+        "sha": "bad6776e9a426207b700d39dd139438c8a934d49",
+        "tag": "dovetail-core@0.0.99"
+      },
+      "semver_bump": "patch",
+      "commits": [
+        {
+          "sha": "bad6776e9",
+          "subject": "fix(core): write instance-relative _record_link in metaData.json (#139)",
+          "pr": 139
+        },
+        {
+          "sha": "e0cf83a8c",
+          "subject": "chore(release): @tenonhq/dovetail-servicenow@0.0.13 [skip ci]"
+        },
+        {
+          "sha": "bd127c726",
+          "subject": "chore(release): @tenonhq/dovetail-servicenow@0.0.12 [skip ci]"
+        },
+        {
+          "sha": "448696846",
+          "subject": "chore(release): publish 3 packages [skip ci]"
+        }
+      ],
+      "exports_delta": null,
+      "narrative": null
+    },
+    {
+      "$schema": "dovetail-release-event/v1",
+      "event_id": "dovetail-servicenow@0.0.13",
+      "package": "@tenonhq/dovetail-servicenow",
+      "version": "0.0.13",
+      "prev_version": "0.0.12",
+      "published_at": "2026-06-02T17:01:03.745Z",
+      "git": {
+        "sha": "db8fddb963948f013aacfc6f67b26773234ef39d",
+        "tag": "dovetail-servicenow@0.0.13"
+      },
+      "semver_bump": "patch",
+      "commits": [
+        {
+          "sha": "db8fddb96",
+          "subject": "feat(servicenow): create-flow — mint + publish a whole flow from scratch (#138)",
+          "pr": 138
+        },
+        {
+          "sha": "bd127c726",
+          "subject": "chore(release): @tenonhq/dovetail-servicenow@0.0.12 [skip ci]"
+        },
+        {
+          "sha": "448696846",
+          "subject": "chore(release): publish 3 packages [skip ci]"
+        }
+      ],
+      "exports_delta": null,
+      "narrative": null
+    },
+    {
+      "$schema": "dovetail-release-event/v1",
+      "event_id": "dovetail-servicenow@0.0.12",
+      "package": "@tenonhq/dovetail-servicenow",
+      "version": "0.0.12",
+      "prev_version": "0.0.11",
+      "published_at": "2026-06-02T16:06:43.535Z",
+      "git": {
+        "sha": "73ad931dbda5cdf85d4bc91307a17eb4d08de3d2",
+        "tag": "dovetail-servicenow@0.0.12"
+      },
+      "semver_bump": "patch",
+      "commits": [
+        {
+          "sha": "73ad931db",
+          "subject": "docs: point SN env-var references at committed .env.example (#137)",
+          "pr": 137
+        }
+      ],
+      "exports_delta": null,
+      "narrative": null
+    },
     {
       "$schema": "dovetail-release-event/v1",
       "event_id": "dovetail-schema@0.0.10",