@tenonhq/dovetail-servicenow 0.0.29 → 0.0.31

package/README.md

@@ -406,6 +406,45 @@ Programmatic: `invokeRest({ method, path, body, confirm })` is exported, and the
 client gained `now.put` / `now.delete` / `now.invoke` (the latter returns
 `{ status, body }` verbatim) alongside the existing `now.get` / `now.post`.
 
+### Publish an app to the Store / application repository
+
+Publish a scoped application to the **ServiceNow Store**, the **company
+application repository**, or both — headlessly, with the publish's progress
+tracker polled to completion.
+
+```bash
+# Dry-run — the DEFAULT: resolves the app, prints the plan, publishes NOTHING
+npx dove-sn publish-app --app x_cadso_filter --version 6.0.20260716 --target both
+
+# Publish for real (store, then repo, same version)
+npx dove-sn publish-app --app x_cadso_filter --version 6.0.20260716 \
+  --target both --dev-notes "July release" --confirm --json
+```
+
+**Store publish is EXTERNALLY VISIBLE on the ServiceNow Store — treat
+`--target store --confirm` as a release.** `publish-app` is dry-run by default:
+without `--confirm` it prints the resolved plan and exits `1` (a deliberate
+refusal). `--target both` runs store then repo sequentially and short-circuits
+if the store leg fails.
+
+The two targets ride different transports:
+
+- **store** replays the `sys_app` form's upload flow (`xmlhttp.do` +
+  `sn_appauthor.ScopedAppUploaderAJAX`) over a form-login session — basic auth
+  alone no-ops there. It needs the Store account credentials in the loaded env
+  file as `SN_STORE_USERNAME` / `SN_STORE_PASSWORD`. The password is **never
+  accepted as a flag** and never appears in output, dry-run previews included.
+- **repo** uses the supported CI/CD REST API (`POST /api/sn_cicd/app_repo/publish`
+  + `GET /api/sn_cicd/progress/{id}`) over basic auth. The API user needs the
+  `sn_cicd` role (or admin).
+
+`--app` accepts a scope name, `sys_app` sys_id, or app name; `--version` must be
+above the currently published version. The result carries the progress-tracker
+id, per-step states ("Packaging application", "Uploading application"), the
+Store `appLink`, and the publish's update-set sys_id where the instance reports
+one. Exit codes: `0` published or dry-run, `1` bad args/unconfirmed, `2`
+failed/timeout. Programmatic: `publishApp({ app, version, target, confirm })`.
+
 `test-flow` defaults to **validate** — a safe pre-flight (published? inputs match
 declared variables?) that never runs the flow; `--execute --confirm` runs it via
 the server-side FlowAPI runner (deploy `resources/runFlow.md` first).
@@ -488,8 +527,10 @@ publish is read back and verified), `flow_publish` (compile a flow/subflow snaps
 publish, grafting a template), `flow_test` (validate or run a flow), and
 `flow_edit` (patch a flow), plus `invoke_rest` (invoke an arbitrary authenticated
 REST operation — Scripted REST included — with GET/POST/PUT/DELETE; dry-run by
-default, response passed through verbatim, bodies never logged). It reads
-ServiceNow credentials from the same env vars as the CLI.
+default, response passed through verbatim, bodies never logged) and `app_publish`
+(publish a scoped app to the ServiceNow Store and/or the application repository;
+dry-run by default, Store credentials env-only — they never transit tool
+arguments). It reads ServiceNow credentials from the same env vars as the CLI.
 
 ```bash
 npx dove-sn mcp --smoke   # list the registered tools and exit

package/dist/cli.js

@@ -60,6 +60,7 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const loadEnv_1 = require("./loadEnv");
 const client_1 = require("./client");
+const fieldsFromJson_1 = require("./fieldsFromJson");
 const choices_1 = require("./choices");
 const formatter_1 = require("./formatter");
 const views_1 = require("./layout/views");
@@ -82,6 +83,7 @@ const table_1 = require("./table");
 const setField_1 = require("./setField");
 const createRecord_1 = require("./createRecord");
 const invokeRest_1 = require("./invokeRest");
+const publishApp_1 = require("./publishApp");
 const hostAssets_1 = require("./hostAssets");
 const flowDesigner_formatter_2 = require("./flowDesigner-formatter");
 function parseArgs(argv) {
@@ -897,11 +899,12 @@ function printHelp() {
         "                     DRY-RUN BY DEFAULT — nothing is sent without --confirm\n" +
         "                     (--method <GET|POST|PUT|DELETE> --path /api/<scope>/<service>/<resource>\n" +
         "                      [--body '<json>' | --body-json <path>] [--confirm] [--dry-run] [--json])\n" +
-        "  set-field          Set scalar field value(s) on an EXISTING record, into an update set, then verify\n" +
-        '                     (--table <t> --sys-id <id>|--query <q> --fields "k=v,k2=v2"\n' +
-        "                      --update-set <sys_id> [--dry-run] [--json])\n" +
+        "  set-field          Set field value(s) on an EXISTING record, into an update set, then verify\n" +
+        "                     (--table <t> --sys-id <id>|--query <q> --update-set <sys_id>\n" +
+        '                      (--fields "k=v,k2=v2" | --from-json <path>) [--dry-run] [--json])\n' +
         "  create-record      Create ONE NEW record in a data table, into an update set, then verify\n" +
-        '                     (--table <t> --fields "k=v,k2=v2" --scope <s> --update-set <sys_id>\n' +
+        "                     (--table <t> --scope <s> --update-set <sys_id>\n" +
+        '                      (--fields "k=v,k2=v2" | --from-json <path>)\n' +
         "                      [--if-absent <encoded-query>] [--dry-run] [--json])\n" +
         "  host-assets        Deploy a built dist/ to ServiceNow (carrier sys_ui_script + attachment + m2m)\n" +
         "                     (--dir <dist> --app <sys_id> --scope <namespace>\n" +
@@ -916,6 +919,15 @@ function printHelp() {
         "                      [--script-input <name>] [--update-set <sys_id>] [--apply] [--json])\n" +
         "  edit-flow          Patch a flow/subflow (rename, description, step inputs)\n" +
         "                     (--sys-id <sys_id> --from-json <ops.json> [--apply] [--update-set <sys_id>] [--scope <sys_id>] [--json])\n" +
+        "  publish-app        Publish a scoped app to the ServiceNow Store and/or the company\n" +
+        "                     application repository, then poll the publish to completion.\n" +
+        "                     STORE PUBLISH IS EXTERNALLY VISIBLE on the ServiceNow Store.\n" +
+        "                     DRY-RUN BY DEFAULT — nothing is published without --confirm\n" +
+        "                     (--app <scope|sys_id|name> --version <v> --target store|repo|both\n" +
+        "                      [--dev-notes <text>] [--store-user <email>] [--timeout-ms <n>]\n" +
+        "                      [--dry-run] [--json] [--confirm])\n" +
+        "                     Store creds: SN_STORE_USERNAME/SN_STORE_PASSWORD in the --env file;\n" +
+        "                     the password is never a flag. Repo publish needs the sn_cicd role.\n" +
         "  mcp                Run the MCP stdio server (--smoke lists tools and exits)\n" +
         "\nGlobal flags:\n" +
         "  --env <path>       Load credentials from a specific .env file (also --env-file,\n" +
@@ -1228,24 +1240,48 @@ function parseFieldsInline(input) {
     }
     return out;
 }
+/**
+ * Merge the two field sources for the record-write verbs: inline `--fields "k=v,k2=v2"`
+ * and `--from-json <path>` (a JSON object — the only form that can carry a large or
+ * multiline value, since the inline form splits on commas and trims). On a key present in
+ * both, `--from-json` wins: it is the explicit spec file. Throws on an unreadable file,
+ * malformed JSON, or a non-scalar value (surfaced by the caller as a bad-args error).
+ */
+function mergeFields(flags) {
+    var inline = parseFieldsInline(flags.fields || "");
+    if (!flags["from-json"])
+        return inline;
+    return Object.assign(inline, (0, fieldsFromJson_1.readFieldsFromJsonFile)(flags["from-json"]));
+}
 /**
  * dove-sn set-field:
  *   --table x_cadso_core_metric_point_type
  *   --sys-id <id>  |  --query "name=send_size"   (query must resolve to exactly 1 row)
- *   --fields "order=20"                          (comma-separated key=value pairs)
+ *   [--fields "order=20"]                        (comma-separated key=value pairs)
+ *   [--from-json <path>]                         (JSON { field: value }; carries large or
+ *                                                 multiline values the inline form can't;
+ *                                                 overrides --fields on a shared key)
+ *                                                — at least one of --fields / --from-json is required
  *   --update-set <sys_id>                        (required — the change is captured here)
  *   [--dry-run] [--json]
  * Exit codes: 0 applied/dry-run, 1 bad args, 2 write landed but read-back unverified.
  */
 async function runSetField(flags) {
     var table = flags.table;
-    var fields = parseFieldsInline(flags.fields || "");
+    var fields;
+    try {
+        fields = mergeFields(flags);
+    }
+    catch (err) {
+        process.stderr.write("set-field: " + (err instanceof Error ? err.message : String(err)) + "\n");
+        return 1;
+    }
     var hasTarget = Boolean(flags["sys-id"] || flags.query);
     if (!table ||
         Object.keys(fields).length === 0 ||
         !hasTarget ||
         !flags["update-set"]) {
-        process.stderr.write('set-field: --table, --fields "k=v", one of --sys-id/--query, and --update-set are required\n');
+        process.stderr.write('set-field: --table, one of --sys-id/--query, --update-set, and at least one field (--fields "k=v" or --from-json <path>) are required\n');
         return 1;
     }
     var params = {
@@ -1285,7 +1321,10 @@ async function runSetField(flags) {
 /**
  * dove-sn create-record:
  *   --table x_cadso_core_metric_point_type
- *   --fields "name=avg_message_parts,label=Avg. Message Parts,order=35"
+ *   [--fields "name=avg_message_parts,label=Avg. Message Parts,order=35"]
+ *   [--from-json <path>]                         (JSON { field: value }; carries large or
+ *                                                 multiline values the inline form can't)
+ *                                                — at least one of --fields / --from-json is required
  *   --scope x_cadso_core                         (the app that owns the new record)
  *   --update-set <sys_id>                        (required — the insert is captured here)
  *   [--if-absent "name=avg_message_parts"]       (skip the insert when this query already matches)
@@ -1295,12 +1334,21 @@ async function runSetField(flags) {
  */
 async function runCreateRecord(flags) {
     var table = flags.table;
-    var fields = parseFieldsInline(flags.fields || "");
+    var fields;
+    try {
+        fields = mergeFields(flags);
+    }
+    catch (err) {
+        process.stderr.write("create-record: " +
+            (err instanceof Error ? err.message : String(err)) +
+            "\n");
+        return 1;
+    }
     if (!table ||
         Object.keys(fields).length === 0 ||
         !flags.scope ||
         !flags["update-set"]) {
-        process.stderr.write('create-record: --table, --fields "k=v", --scope and --update-set are required\n');
+        process.stderr.write('create-record: --table, --scope, --update-set, and at least one field (--fields "k=v" or --from-json <path>) are required\n');
         return 1;
     }
     var params = {
@@ -1473,6 +1521,104 @@ async function runInvokeRest(flags) {
     }
     return 0;
 }
+/**
+ * dove-sn publish-app:
+ *   --app <scope|sys_id|name>   Required. The sys_app to publish.
+ *   --version <v>               Required. Version to publish (e.g. 6.0.20260716).
+ *   --target store|repo|both    Required. STORE PUBLISH IS EXTERNALLY VISIBLE.
+ *   [--dev-notes <text>]        Optional developer notes.
+ *   [--store-user <email>]      Store account email (else SN_STORE_USERNAME).
+ *                               The password comes ONLY from SN_STORE_PASSWORD —
+ *                               there is no flag for it, ever.
+ *   [--timeout-ms <n>]          Progress-poll budget (default 120000).
+ *   [--dry-run] [--json] [--confirm]
+ *
+ * DRY-RUN unless --confirm: without it the resolved plan is printed and the
+ * command exits 1 (a deliberate refusal, not success). --target both publishes
+ * store then repo sequentially with the same version and short-circuits if the
+ * store leg fails; --json emits an array of per-target results.
+ * Exit codes: 0 published/dry-run, 1 bad args/unconfirmed, 2 failed/timeout.
+ */
+async function runPublishApp(flags) {
+    var app = flags.app;
+    var version = flags.version;
+    var target = flags.target;
+    if (!app || !version || !target) {
+        process.stderr.write("publish-app: --app, --version and --target store|repo|both are required\n");
+        return 1;
+    }
+    if (target !== "store" && target !== "repo" && target !== "both") {
+        process.stderr.write("publish-app: --target must be store, repo or both (got '" +
+            target +
+            "')\n");
+        return 1;
+    }
+    var targets = target === "both" ? ["store", "repo"] : [target];
+    var dryRun = flags["dry-run"] === "true";
+    var confirmed = flags.confirm === "true";
+    var client = (0, client_1.createClient)({});
+    var results = [];
+    var exitCode = 0;
+    for (var i = 0; i < targets.length; i += 1) {
+        var params = {
+            client: client,
+            app: app,
+            version: version,
+            target: targets[i],
+            confirm: confirmed,
+            dryRun: dryRun,
+        };
+        if (flags["dev-notes"])
+            params.devNotes = flags["dev-notes"];
+        if (flags["store-user"])
+            params.storeUsername = flags["store-user"];
+        if (flags["timeout-ms"]) {
+            // A NaN timeout would make the poll-loop budget check always false —
+            // an infinite loop. Validate here, exit 1 on garbage.
+            var timeoutMs = Number(flags["timeout-ms"]);
+            if (!Number.isInteger(timeoutMs) || timeoutMs <= 0) {
+                process.stderr.write("publish-app: --timeout-ms must be a positive integer (got '" +
+                    flags["timeout-ms"] +
+                    "')\n");
+                return 1;
+            }
+            params.timeoutMs = timeoutMs;
+        }
+        var result = await (0, publishApp_1.publishApp)(params);
+        results.push(result);
+        if (flags.json !== "true") {
+            process.stdout.write("[" +
+                result.status +
+                "] " +
+                result.target +
+                " — " +
+                result.appName +
+                " (" +
+                result.appScope +
+                ") v" +
+                result.version +
+                (result.appLink ? " — " + result.appLink : "") +
+                (result.updateSetSysId
+                    ? " — update set " + result.updateSetSysId
+                    : "") +
+                "\n" +
+                result.note +
+                "\n");
+        }
+        if (result.status === "failed" || result.status === "timeout") {
+            exitCode = 2;
+            break; // Short-circuit: never repo-publish after a failed store leg.
+        }
+    }
+    if (flags.json === "true") {
+        process.stdout.write(JSON.stringify(results, null, 2) + "\n");
+    }
+    if (exitCode === 0 && !dryRun && !confirmed) {
+        process.stderr.write("publish-app: refusing to publish without --confirm (the plan above is a dry-run).\n");
+        return 1;
+    }
+    return exitCode;
+}
 async function main() {
     var parsed = parseArgs(process.argv.slice(2));
     // Load credentials before any command runs. `--env`/`--env-file` (or the
@@ -1547,6 +1693,9 @@ async function main() {
         await runSetRelatedLists(parsed.flags);
         return 0;
     }
+    if (parsed.command === "publish-app") {
+        return await runPublishApp(parsed.flags);
+    }
     if (parsed.command === "mcp") {
         return await runMcp(parsed.flags);
     }

package/dist/fieldsFromJson.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `--from-json` field-map loader for the record-write verbs (set-field, create-record).
+ *
+ * The inline `--fields "k=v,k2=v2"` form splits on commas and trims each piece — so it
+ * cannot carry a value that contains a comma, a newline, an `=`, or leading/trailing
+ * whitespace. That rules out every large field: a script body, an HTML/XML/CSS field, a
+ * JSON blob. `--from-json <path>` closes that gap: the file is a flat JSON object of
+ * `field → value`, and JSON quoting carries any character faithfully.
+ *
+ * Values may be string | number | boolean. Numbers/booleans are stringified — matching
+ * the inline parser and the wire format, where ServiceNow scalar fields are strings.
+ * `null`/`undefined` values are skipped. Nested objects and arrays are rejected: a scalar
+ * field cannot take one, and silently JSON-encoding it would write garbage into the record.
+ */
+export declare function coerceFieldsFromJson(parsed: unknown): Record<string, string>;
+/**
+ * Read + parse a `--from-json` file into a validated field map. The path is resolved
+ * against the process cwd, matching the other `--from-json` consumers in the CLI.
+ * Throws a clean, prefixed message on a missing file or malformed JSON so the caller can
+ * surface it as a bad-args error rather than an uncaught stack trace.
+ */
+export declare function readFieldsFromJsonFile(filePath: string): Record<string, string>;

package/dist/fieldsFromJson.js

@@ -0,0 +1,107 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.coerceFieldsFromJson = coerceFieldsFromJson;
+exports.readFieldsFromJsonFile = readFieldsFromJsonFile;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/**
+ * `--from-json` field-map loader for the record-write verbs (set-field, create-record).
+ *
+ * The inline `--fields "k=v,k2=v2"` form splits on commas and trims each piece — so it
+ * cannot carry a value that contains a comma, a newline, an `=`, or leading/trailing
+ * whitespace. That rules out every large field: a script body, an HTML/XML/CSS field, a
+ * JSON blob. `--from-json <path>` closes that gap: the file is a flat JSON object of
+ * `field → value`, and JSON quoting carries any character faithfully.
+ *
+ * Values may be string | number | boolean. Numbers/booleans are stringified — matching
+ * the inline parser and the wire format, where ServiceNow scalar fields are strings.
+ * `null`/`undefined` values are skipped. Nested objects and arrays are rejected: a scalar
+ * field cannot take one, and silently JSON-encoding it would write garbage into the record.
+ */
+function coerceFieldsFromJson(parsed) {
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error("--from-json must contain a JSON object of field → value pairs");
+    }
+    var obj = parsed;
+    var out = {};
+    var keys = Object.keys(obj);
+    for (var i = 0; i < keys.length; i += 1) {
+        var key = keys[i];
+        var value = obj[key];
+        if (value === null || value === undefined)
+            continue;
+        var valueType = typeof value;
+        if (valueType === "string") {
+            out[key] = value;
+        }
+        else if (valueType === "number" || valueType === "boolean") {
+            out[key] = String(value);
+        }
+        else {
+            throw new Error("--from-json field '" +
+                key +
+                "' must be a string, number, or boolean (got " +
+                valueType +
+                ")");
+        }
+    }
+    return out;
+}
+/**
+ * Read + parse a `--from-json` file into a validated field map. The path is resolved
+ * against the process cwd, matching the other `--from-json` consumers in the CLI.
+ * Throws a clean, prefixed message on a missing file or malformed JSON so the caller can
+ * surface it as a bad-args error rather than an uncaught stack trace.
+ */
+function readFieldsFromJsonFile(filePath) {
+    var raw;
+    try {
+        raw = fs.readFileSync(path.resolve(filePath), "utf8");
+    }
+    catch (err) {
+        var readMsg = err instanceof Error ? err.message : String(err);
+        throw new Error("--from-json: cannot read '" + filePath + "': " + readMsg);
+    }
+    var parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        var parseMsg = err instanceof Error ? err.message : String(err);
+        throw new Error("--from-json: '" + filePath + "' is not valid JSON: " + parseMsg);
+    }
+    return coerceFieldsFromJson(parsed);
+}

package/dist/index.d.ts

@@ -27,3 +27,5 @@ export type { RecordWriteResult, SetFieldParams, SetFieldResult, } from "./setFi
 export type { CreateRecordParams, CreateRecordResult } from "./createRecord";
 export { invokeRest, INVOKE_REST_METHODS } from "./invokeRest";
 export type { InvokeRestParams, InvokeRestResult } from "./invokeRest";
+export { publishApp, buildStartFields, parseXmlAnswer, parseProgressTree, classifyProgress, flattenSteps, harvestProgressResults, parseCicdPublishResponse, parseCicdProgress, DEFAULT_PUBLISH_TIMEOUT_MS, PUBLISH_POLL_DELAYS_MS, } from "./publishApp";
+export type { PublishAppParams, PublishAppResult, PublishTarget, PublishStep, ProgressNode, CicdProgress, PublishTransport, } from "./publishApp";

package/dist/index.js

@@ -7,7 +7,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.addColumn = exports.DEFAULT_SAVE_ACTION = exports.DEFAULT_SUPER_CLASS = exports.TYPE_MAP = exports.defaultAccessFlags = exports.applyTableSaveOverlay = exports.resolveType = exports.normalizeColumns = exports.buildColumnXml = exports.projectTableGraph = exports.createTable = exports.WriteOrderError = exports.executeWritePlan = exports.topoSort = exports.generateSysId = exports.DEFAULT_RUN_FLOW_PATH = exports.testFlow = exports.editFlow = exports.buildPublishModel = exports.createFlow = exports.copyFlow = exports.publishFlow = exports.readActionType = exports.readFlow = exports.formatStepPill = exports.summarizeSteps = exports.verifySteps = exports.applyStepOps = exports.editActionType = exports.publishActionType = exports.triggerPublication = exports.cloneActionType = exports.cloneSubflow = exports.verifyArtifact = exports.listTemplates = exports.sincPlugin = exports.formatCreateViewResult = exports.formatLayoutResult = exports.setRelatedLists = exports.setFormLayout = exports.setListLayout = exports.createView = exports.formatAddChoicesResult = exports.formatHostAssetsResult = exports.classifyChunks = exports.hostAssets = exports.addChoicesToField = exports.resolveConfigFromEnvFile = exports.createClientFromEnvFile = exports.createClient = void 0;
-exports.INVOKE_REST_METHODS = exports.invokeRest = exports.createRecord = exports.setField = exports.toStoredValue = exports.resolveAttributes = exports.setColumn = exports.deriveElement = void 0;
+exports.PUBLISH_POLL_DELAYS_MS = exports.DEFAULT_PUBLISH_TIMEOUT_MS = exports.parseCicdProgress = exports.parseCicdPublishResponse = exports.harvestProgressResults = exports.flattenSteps = exports.classifyProgress = exports.parseProgressTree = exports.parseXmlAnswer = exports.buildStartFields = exports.publishApp = exports.INVOKE_REST_METHODS = exports.invokeRest = exports.createRecord = exports.setField = exports.toStoredValue = exports.resolveAttributes = exports.setColumn = exports.deriveElement = void 0;
 var client_1 = require("./client");
 Object.defineProperty(exports, "createClient", { enumerable: true, get: function () { return client_1.createClient; } });
 var createClientFromEnvFile_1 = require("./createClientFromEnvFile");
@@ -82,3 +82,15 @@ Object.defineProperty(exports, "createRecord", { enumerable: true, get: function
 var invokeRest_1 = require("./invokeRest");
 Object.defineProperty(exports, "invokeRest", { enumerable: true, get: function () { return invokeRest_1.invokeRest; } });
 Object.defineProperty(exports, "INVOKE_REST_METHODS", { enumerable: true, get: function () { return invokeRest_1.INVOKE_REST_METHODS; } });
+var publishApp_1 = require("./publishApp");
+Object.defineProperty(exports, "publishApp", { enumerable: true, get: function () { return publishApp_1.publishApp; } });
+Object.defineProperty(exports, "buildStartFields", { enumerable: true, get: function () { return publishApp_1.buildStartFields; } });
+Object.defineProperty(exports, "parseXmlAnswer", { enumerable: true, get: function () { return publishApp_1.parseXmlAnswer; } });
+Object.defineProperty(exports, "parseProgressTree", { enumerable: true, get: function () { return publishApp_1.parseProgressTree; } });
+Object.defineProperty(exports, "classifyProgress", { enumerable: true, get: function () { return publishApp_1.classifyProgress; } });
+Object.defineProperty(exports, "flattenSteps", { enumerable: true, get: function () { return publishApp_1.flattenSteps; } });
+Object.defineProperty(exports, "harvestProgressResults", { enumerable: true, get: function () { return publishApp_1.harvestProgressResults; } });
+Object.defineProperty(exports, "parseCicdPublishResponse", { enumerable: true, get: function () { return publishApp_1.parseCicdPublishResponse; } });
+Object.defineProperty(exports, "parseCicdProgress", { enumerable: true, get: function () { return publishApp_1.parseCicdProgress; } });
+Object.defineProperty(exports, "DEFAULT_PUBLISH_TIMEOUT_MS", { enumerable: true, get: function () { return publishApp_1.DEFAULT_PUBLISH_TIMEOUT_MS; } });
+Object.defineProperty(exports, "PUBLISH_POLL_DELAYS_MS", { enumerable: true, get: function () { return publishApp_1.PUBLISH_POLL_DELAYS_MS; } });

package/dist/mcp/registry.d.ts

@@ -10,7 +10,7 @@ import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 import type { ToolAnnotations } from "@tenonhq/dovetail-mcp-kit";
 import type { ServiceNowClient } from "../client";
-export declare var TOOL_NAMES: readonly ["create_view", "set_list_layout", "set_form_layout", "set_related_lists", "add_choices_to_field", "flow_view", "action_view", "action_edit", "flow_publish", "flow_copy", "flow_create", "flow_test", "flow_edit", "create_table", "add_column", "set_column", "set_field", "create_record", "host_assets", "invoke_rest"];
+export declare var TOOL_NAMES: readonly ["create_view", "set_list_layout", "set_form_layout", "set_related_lists", "add_choices_to_field", "flow_view", "action_view", "action_edit", "flow_publish", "flow_copy", "flow_create", "flow_test", "flow_edit", "create_table", "add_column", "set_column", "set_field", "create_record", "host_assets", "invoke_rest", "app_publish"];
 export type ToolName = (typeof TOOL_NAMES)[number];
 export interface RegistryDeps {
     /** Optional client injection for tests; defaults to createClient({}). */

package/dist/mcp/registry.js

@@ -31,6 +31,7 @@ const hostAssets_1 = require("../hostAssets");
 const setField_1 = require("../setField");
 const createRecord_1 = require("../createRecord");
 const invokeRest_1 = require("../invokeRest");
+const publishApp_1 = require("../publishApp");
 const schemas_1 = require("./schemas");
 exports.TOOL_NAMES = [
     "create_view",
@@ -53,6 +54,7 @@ exports.TOOL_NAMES = [
     "create_record",
     "host_assets",
     "invoke_rest",
+    "app_publish",
 ];
 // Annotation presets (READ_ONLY / WRITE_ADDITIVE_IDEMPOTENT / WRITE_CREATE /
 // WRITE_OVERWRITE / WRITE_EXECUTE) come from @tenonhq/dovetail-mcp-kit.
@@ -491,6 +493,39 @@ function buildDescriptors(deps = {}) {
                 return (0, invokeRest_1.invokeRest)(params);
             },
         },
+        {
+            name: "app_publish",
+            annotations: dovetail_mcp_kit_1.WRITE_EXECUTE,
+            description: "Publish a scoped ServiceNow application to ONE target per call — the ServiceNow Store " +
+                "(target 'store') or the company Application Repository (target 'repo'); call twice to " +
+                "publish to both — then poll the publish to completion. STORE PUBLISH IS EXTERNALLY " +
+                "VISIBLE on the ServiceNow Store — treat it as a release. DRY-RUN BY DEFAULT: without " +
+                "confirm:true the resolved plan (app, current version, target) is returned and nothing is " +
+                "published. target 'store' replays the sys_app form's upload flow over a form-login session " +
+                "and requires SN_STORE_USERNAME/SN_STORE_PASSWORD in the server's env file — credentials " +
+                "never transit tool arguments. target 'repo' uses the supported CI/CD REST API " +
+                "(/api/sn_cicd/app_repo/publish) and requires the sn_cicd role. app is a scope name, " +
+                "sys_app sys_id, or app name; version must be above the currently published version. The " +
+                "result carries the progress-tracker id, per-step states, the Store appLink, and the " +
+                "publish's update-set sys_id where the instance reports one.",
+            shape: schemas_1.publishAppSchema.shape,
+            handler: async function (args) {
+                var p = schemas_1.publishAppSchema.parse(args);
+                var params = {
+                    app: p.app,
+                    version: p.version,
+                    target: p.target,
+                    devNotes: p.devNotes,
+                    confirm: p.confirm,
+                    dryRun: p.dryRun,
+                    timeoutMs: p.timeoutMs,
+                };
+                if (deps.client) {
+                    params.client = deps.client;
+                }
+                return (0, publishApp_1.publishApp)(params);
+            },
+        },
     ];
 }
 function registerAllTools(server, deps = {}) {

package/dist/mcp/schemas.d.ts

@@ -958,6 +958,31 @@ export declare var createRecordSchema: z.ZodObject<{
     dryRun?: boolean | undefined;
     ifAbsentQuery?: string | undefined;
 }>;
+export declare var publishAppSchema: z.ZodObject<{
+    app: z.ZodString;
+    version: z.ZodString;
+    devNotes: z.ZodOptional<z.ZodString>;
+    target: z.ZodUnion<[z.ZodLiteral<"store">, z.ZodLiteral<"repo">]>;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+    dryRun: z.ZodOptional<z.ZodBoolean>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    target: "store" | "repo";
+    version: string;
+    app: string;
+    confirm?: boolean | undefined;
+    dryRun?: boolean | undefined;
+    devNotes?: string | undefined;
+    timeoutMs?: number | undefined;
+}, {
+    target: "store" | "repo";
+    version: string;
+    app: string;
+    confirm?: boolean | undefined;
+    dryRun?: boolean | undefined;
+    devNotes?: string | undefined;
+    timeoutMs?: number | undefined;
+}>;
 export declare var invokeRestSchema: z.ZodObject<{
     method: z.ZodEffects<z.ZodEnum<["GET", "POST", "PUT", "DELETE"]>, "GET" | "DELETE" | "POST" | "PUT", unknown>;
     path: z.ZodString;

package/dist/mcp/schemas.js

@@ -4,7 +4,7 @@
  * own file so registry.ts stays focused on wiring.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.invokeRestSchema = exports.createRecordSchema = exports.setFieldSchema = exports.setColumnSchema = exports.columnAttributesSchema = exports.addColumnSchema = exports.createTableSchema = exports.columnSpecSchema = exports.hostAssetsSchema = exports.editFlowSchema = exports.editActionSchema = exports.stepInputPatchSchema = exports.testFlowSchema = exports.createFlowSchema = exports.copyFlowSchema = exports.publishFlowSchema = exports.viewActionSchema = exports.viewFlowSchema = exports.addChoicesToFieldSchema = exports.choiceValueSchema = exports.setRelatedListsSchema = exports.setFormLayoutSchema = exports.formSectionSchema = exports.setListLayoutSchema = exports.createViewSchema = void 0;
+exports.invokeRestSchema = exports.publishAppSchema = exports.createRecordSchema = exports.setFieldSchema = exports.setColumnSchema = exports.columnAttributesSchema = exports.addColumnSchema = exports.createTableSchema = exports.columnSpecSchema = exports.hostAssetsSchema = exports.editFlowSchema = exports.editActionSchema = exports.stepInputPatchSchema = exports.testFlowSchema = exports.createFlowSchema = exports.copyFlowSchema = exports.publishFlowSchema = exports.viewActionSchema = exports.viewFlowSchema = exports.addChoicesToFieldSchema = exports.choiceValueSchema = exports.setRelatedListsSchema = exports.setFormLayoutSchema = exports.formSectionSchema = exports.setListLayoutSchema = exports.createViewSchema = void 0;
 const zod_1 = require("zod");
 exports.createViewSchema = zod_1.z.object({
     name: zod_1.z.string().min(1),
@@ -261,6 +261,19 @@ exports.createRecordSchema = zod_1.z.object({
     ifAbsentQuery: zod_1.z.string().optional(),
     dryRun: zod_1.z.boolean().optional(),
 });
+// app_publish: publish a scoped app to the ServiceNow Store or the company
+// application repository. Deliberately NO credential fields — the Store
+// account resolves from SN_STORE_USERNAME/SN_STORE_PASSWORD inside the verb,
+// so credentials never transit MCP arguments or telemetry.
+exports.publishAppSchema = zod_1.z.object({
+    app: zod_1.z.string().min(1),
+    version: zod_1.z.string().min(1),
+    devNotes: zod_1.z.string().optional(),
+    target: zod_1.z.union([zod_1.z.literal("store"), zod_1.z.literal("repo")]),
+    confirm: zod_1.z.boolean().optional(),
+    dryRun: zod_1.z.boolean().optional(),
+    timeoutMs: zod_1.z.number().int().positive().optional(),
+});
 // invoke_rest: transport primitive for arbitrary authenticated REST operations
 // (Scripted REST included). The dry-run-unless-confirm gate lives in invokeRest
 // itself; the regex here rejects absolute URLs and non-/api/ paths early.