@tenonhq/dovetail-servicenow 0.0.30 → 0.0.32

package/README.md

@@ -406,6 +406,45 @@ Programmatic: `invokeRest({ method, path, body, confirm })` is exported, and the
 client gained `now.put` / `now.delete` / `now.invoke` (the latter returns
 `{ status, body }` verbatim) alongside the existing `now.get` / `now.post`.
 
+### Publish an app to the Store / application repository
+
+Publish a scoped application to the **ServiceNow Store**, the **company
+application repository**, or both — headlessly, with the publish's progress
+tracker polled to completion.
+
+```bash
+# Dry-run — the DEFAULT: resolves the app, prints the plan, publishes NOTHING
+npx dove-sn publish-app --app x_cadso_filter --version 6.0.20260716 --target both
+
+# Publish for real (store, then repo, same version)
+npx dove-sn publish-app --app x_cadso_filter --version 6.0.20260716 \
+  --target both --dev-notes "July release" --confirm --json
+```
+
+**Store publish is EXTERNALLY VISIBLE on the ServiceNow Store — treat
+`--target store --confirm` as a release.** `publish-app` is dry-run by default:
+without `--confirm` it prints the resolved plan and exits `1` (a deliberate
+refusal). `--target both` runs store then repo sequentially and short-circuits
+if the store leg fails.
+
+The two targets ride different transports:
+
+- **store** replays the `sys_app` form's upload flow (`xmlhttp.do` +
+  `sn_appauthor.ScopedAppUploaderAJAX`) over a form-login session — basic auth
+  alone no-ops there. It needs the Store account credentials in the loaded env
+  file as `SN_STORE_USERNAME` / `SN_STORE_PASSWORD`. The password is **never
+  accepted as a flag** and never appears in output, dry-run previews included.
+- **repo** uses the supported CI/CD REST API (`POST /api/sn_cicd/app_repo/publish`
+  + `GET /api/sn_cicd/progress/{id}`) over basic auth. The API user needs the
+  `sn_cicd` role (or admin).
+
+`--app` accepts a scope name, `sys_app` sys_id, or app name; `--version` must be
+above the currently published version. The result carries the progress-tracker
+id, per-step states ("Packaging application", "Uploading application"), the
+Store `appLink`, and the publish's update-set sys_id where the instance reports
+one. Exit codes: `0` published or dry-run, `1` bad args/unconfirmed, `2`
+failed/timeout. Programmatic: `publishApp({ app, version, target, confirm })`.
+
 `test-flow` defaults to **validate** — a safe pre-flight (published? inputs match
 declared variables?) that never runs the flow; `--execute --confirm` runs it via
 the server-side FlowAPI runner (deploy `resources/runFlow.md` first).
@@ -488,8 +527,10 @@ publish is read back and verified), `flow_publish` (compile a flow/subflow snaps
 publish, grafting a template), `flow_test` (validate or run a flow), and
 `flow_edit` (patch a flow), plus `invoke_rest` (invoke an arbitrary authenticated
 REST operation — Scripted REST included — with GET/POST/PUT/DELETE; dry-run by
-default, response passed through verbatim, bodies never logged). It reads
-ServiceNow credentials from the same env vars as the CLI.
+default, response passed through verbatim, bodies never logged) and `app_publish`
+(publish a scoped app to the ServiceNow Store and/or the application repository;
+dry-run by default, Store credentials env-only — they never transit tool
+arguments). It reads ServiceNow credentials from the same env vars as the CLI.
 
 ```bash
 npx dove-sn mcp --smoke   # list the registered tools and exit

package/dist/cli.js

@@ -83,6 +83,7 @@ const table_1 = require("./table");
 const setField_1 = require("./setField");
 const createRecord_1 = require("./createRecord");
 const invokeRest_1 = require("./invokeRest");
+const publishApp_1 = require("./publishApp");
 const hostAssets_1 = require("./hostAssets");
 const flowDesigner_formatter_2 = require("./flowDesigner-formatter");
 function parseArgs(argv) {
@@ -894,6 +895,14 @@ function printHelp() {
         "                     Shorten or clear those values first, then re-run.\n" +
         "                     --element / --internal-type are REFUSED with an explanation:\n" +
         "                     ServiceNow silently ignores both on an existing column.\n" +
+        "  set-table          Update an EXISTING TABLE's own dictionary row (the collection row),\n" +
+        "                     into an update set, then verify against the instance\n" +
+        "                     (--table <t> --update-set <sys_id> [--audit true|false]\n" +
+        "                      [--dry-run] [--json])\n" +
+        "                     --audit turns RECORD AUDITING on/off for the whole table: with it\n" +
+        "                     true ServiceNow writes a sys_audit row per changed field on every\n" +
+        "                     insert and update — a real cost on a high-write table.\n" +
+        "                     Column attributes belong to set-column, record values to set-field.\n" +
         "  invoke-rest        Invoke an arbitrary authenticated REST operation (Scripted REST incl.)\n" +
         "                     DRY-RUN BY DEFAULT — nothing is sent without --confirm\n" +
         "                     (--method <GET|POST|PUT|DELETE> --path /api/<scope>/<service>/<resource>\n" +
@@ -918,6 +927,15 @@ function printHelp() {
         "                      [--script-input <name>] [--update-set <sys_id>] [--apply] [--json])\n" +
         "  edit-flow          Patch a flow/subflow (rename, description, step inputs)\n" +
         "                     (--sys-id <sys_id> --from-json <ops.json> [--apply] [--update-set <sys_id>] [--scope <sys_id>] [--json])\n" +
+        "  publish-app        Publish a scoped app to the ServiceNow Store and/or the company\n" +
+        "                     application repository, then poll the publish to completion.\n" +
+        "                     STORE PUBLISH IS EXTERNALLY VISIBLE on the ServiceNow Store.\n" +
+        "                     DRY-RUN BY DEFAULT — nothing is published without --confirm\n" +
+        "                     (--app <scope|sys_id|name> --version <v> --target store|repo|both\n" +
+        "                      [--dev-notes <text>] [--store-user <email>] [--timeout-ms <n>]\n" +
+        "                      [--dry-run] [--json] [--confirm])\n" +
+        "                     Store creds: SN_STORE_USERNAME/SN_STORE_PASSWORD in the --env file;\n" +
+        "                     the password is never a flag. Repo publish needs the sn_cicd role.\n" +
         "  mcp                Run the MCP stdio server (--smoke lists tools and exits)\n" +
         "\nGlobal flags:\n" +
         "  --env <path>       Load credentials from a specific .env file (also --env-file,\n" +
@@ -1108,12 +1126,12 @@ async function runAddColumn(flags) {
 }
 /** Parse a CLI boolean flag. Bare `--mandatory` means true; `--mandatory false` means
  *  false. Anything else is rejected rather than quietly coerced to `true`. */
-function parseBoolFlag(name, raw) {
+function parseBoolFlag(name, raw, verb = "set-column") {
     if (raw === "true")
         return true;
     if (raw === "false")
         return false;
-    throw new Error("set-column: --" + name + " must be true or false (got '" + raw + "').");
+    throw new Error(verb + ": --" + name + " must be true or false (got '" + raw + "').");
 }
 /**
  * dove-sn set-column:
@@ -1211,6 +1229,71 @@ async function runSetColumn(flags, bare) {
         return 2;
     return 0;
 }
+/**
+ * dove-sn set-table:
+ *   --table x_cadso_core_setting --audit true --update-set <sys_id>
+ *   [--dry-run] [--json]
+ *
+ * Updates the TABLE's own dictionary row (the `internal_type=collection` row, whose
+ * `element` is empty) — not a column's. Column attributes belong to set-column; a
+ * record's values belong to set-field.
+ */
+async function runSetTable(flags, bare) {
+    // Guard the string flags AND the updateSetSysId alias: a value-less string flag
+    // arrives as the literal "true", so --update-set (or its alias) with nothing after
+    // it would silently become the sys_id "true" and later fail as "not found".
+    var stringFlags = ["table", "update-set", "updateSetSysId"];
+    for (var f = 0; f < stringFlags.length; f += 1) {
+        if (bare[stringFlags[f]]) {
+            process.stderr.write("set-table: --" + stringFlags[f] + " needs a value (it was given none).\n");
+            return 1;
+        }
+    }
+    var table = flags.table;
+    if (!table) {
+        process.stderr.write("set-table: --table is required " +
+            "(--update-set is required too, unless --dry-run)\n");
+        return 1;
+    }
+    var attributes = {};
+    if (flags.audit !== undefined) {
+        attributes.audit = parseBoolFlag("audit", flags.audit, "set-table");
+    }
+    var params = {
+        client: (0, client_1.createClient)({}),
+        table: table,
+        attributes: attributes,
+    };
+    var setTableUs = flags["update-set"] || flags.updateSetSysId;
+    if (setTableUs)
+        params.updateSetSysId = setTableUs;
+    if (flags["dry-run"] === "true")
+        params.dryRun = true;
+    var result = await (0, table_1.setTable)(params);
+    if (flags.json === "true") {
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+    }
+    else {
+        process.stdout.write("[" +
+            result.status +
+            "] " +
+            result.table +
+            (result.verified && result.status === "applied" ? " — verified" : "") +
+            (result.status === "applied" && !result.capturedInUpdateSet
+                ? " — NOT CAPTURED"
+                : "") +
+            "\n" +
+            result.note +
+            "\n");
+    }
+    // 2 = the write landed but the instance does not reflect it (or it was not
+    // captured), which must not read as success to a script.
+    if (result.status === "failed")
+        return 2;
+    if (result.status === "applied" && !result.capturedInUpdateSet)
+        return 2;
+    return 0;
+}
 /** Parse inline `--fields "k=v, k2=v2"` into a field map. */
 function parseFieldsInline(input) {
     var out = {};
@@ -1511,6 +1594,104 @@ async function runInvokeRest(flags) {
     }
     return 0;
 }
+/**
+ * dove-sn publish-app:
+ *   --app <scope|sys_id|name>   Required. The sys_app to publish.
+ *   --version <v>               Required. Version to publish (e.g. 6.0.20260716).
+ *   --target store|repo|both    Required. STORE PUBLISH IS EXTERNALLY VISIBLE.
+ *   [--dev-notes <text>]        Optional developer notes.
+ *   [--store-user <email>]      Store account email (else SN_STORE_USERNAME).
+ *                               The password comes ONLY from SN_STORE_PASSWORD —
+ *                               there is no flag for it, ever.
+ *   [--timeout-ms <n>]          Progress-poll budget (default 120000).
+ *   [--dry-run] [--json] [--confirm]
+ *
+ * DRY-RUN unless --confirm: without it the resolved plan is printed and the
+ * command exits 1 (a deliberate refusal, not success). --target both publishes
+ * store then repo sequentially with the same version and short-circuits if the
+ * store leg fails; --json emits an array of per-target results.
+ * Exit codes: 0 published/dry-run, 1 bad args/unconfirmed, 2 failed/timeout.
+ */
+async function runPublishApp(flags) {
+    var app = flags.app;
+    var version = flags.version;
+    var target = flags.target;
+    if (!app || !version || !target) {
+        process.stderr.write("publish-app: --app, --version and --target store|repo|both are required\n");
+        return 1;
+    }
+    if (target !== "store" && target !== "repo" && target !== "both") {
+        process.stderr.write("publish-app: --target must be store, repo or both (got '" +
+            target +
+            "')\n");
+        return 1;
+    }
+    var targets = target === "both" ? ["store", "repo"] : [target];
+    var dryRun = flags["dry-run"] === "true";
+    var confirmed = flags.confirm === "true";
+    var client = (0, client_1.createClient)({});
+    var results = [];
+    var exitCode = 0;
+    for (var i = 0; i < targets.length; i += 1) {
+        var params = {
+            client: client,
+            app: app,
+            version: version,
+            target: targets[i],
+            confirm: confirmed,
+            dryRun: dryRun,
+        };
+        if (flags["dev-notes"])
+            params.devNotes = flags["dev-notes"];
+        if (flags["store-user"])
+            params.storeUsername = flags["store-user"];
+        if (flags["timeout-ms"]) {
+            // A NaN timeout would make the poll-loop budget check always false —
+            // an infinite loop. Validate here, exit 1 on garbage.
+            var timeoutMs = Number(flags["timeout-ms"]);
+            if (!Number.isInteger(timeoutMs) || timeoutMs <= 0) {
+                process.stderr.write("publish-app: --timeout-ms must be a positive integer (got '" +
+                    flags["timeout-ms"] +
+                    "')\n");
+                return 1;
+            }
+            params.timeoutMs = timeoutMs;
+        }
+        var result = await (0, publishApp_1.publishApp)(params);
+        results.push(result);
+        if (flags.json !== "true") {
+            process.stdout.write("[" +
+                result.status +
+                "] " +
+                result.target +
+                " — " +
+                result.appName +
+                " (" +
+                result.appScope +
+                ") v" +
+                result.version +
+                (result.appLink ? " — " + result.appLink : "") +
+                (result.updateSetSysId
+                    ? " — update set " + result.updateSetSysId
+                    : "") +
+                "\n" +
+                result.note +
+                "\n");
+        }
+        if (result.status === "failed" || result.status === "timeout") {
+            exitCode = 2;
+            break; // Short-circuit: never repo-publish after a failed store leg.
+        }
+    }
+    if (flags.json === "true") {
+        process.stdout.write(JSON.stringify(results, null, 2) + "\n");
+    }
+    if (exitCode === 0 && !dryRun && !confirmed) {
+        process.stderr.write("publish-app: refusing to publish without --confirm (the plan above is a dry-run).\n");
+        return 1;
+    }
+    return exitCode;
+}
 async function main() {
     var parsed = parseArgs(process.argv.slice(2));
     // Load credentials before any command runs. `--env`/`--env-file` (or the
@@ -1551,6 +1732,9 @@ async function main() {
     if (parsed.command === "set-column") {
         return await runSetColumn(parsed.flags, parsed.bare);
     }
+    if (parsed.command === "set-table") {
+        return await runSetTable(parsed.flags, parsed.bare);
+    }
     if (parsed.command === "set-field") {
         return await runSetField(parsed.flags);
     }
@@ -1585,6 +1769,9 @@ async function main() {
         await runSetRelatedLists(parsed.flags);
         return 0;
     }
+    if (parsed.command === "publish-app") {
+        return await runPublishApp(parsed.flags);
+    }
     if (parsed.command === "mcp") {
         return await runMcp(parsed.flags);
     }

package/dist/index.d.ts

@@ -19,11 +19,13 @@ export { sincPlugin } from "./plugin";
 export { listTemplates, verifyArtifact, cloneSubflow, cloneActionType, triggerPublication, publishActionType, editActionType, applyStepOps, verifySteps, summarizeSteps, formatStepPill, readFlow, readActionType, publishFlow, copyFlow, createFlow, buildPublishModel, editFlow, testFlow, DEFAULT_RUN_FLOW_PATH, generateSysId, topoSort, executeWritePlan, WriteOrderError, } from "./flowDesigner";
 export type { TemplateRef, ListTemplatesParams, FlowKind, VerifyExpect, VerifyFound, VerifyFailure, VerifyReport, VerifyArtifactParams, CloneSubflowParams, CloneSubflowResult, CloneActionTypeParams, CloneActionTypeResult, TriggerPublicationParams, TriggerPublicationResult, PublishActionTypeParams, PublishActionTypeResult, EditActionTypeParams, EditActionTypeResult, EditActionTypeOps, StepOps, StepRecord, StepSummary, StepIoSummary, PatchStepScriptOp, AddStepOutputOp, AddStepInputOp, ApplyStepOpsResult, VerifyStepsResult, ReadFlowParams, ReadFlowResult, FlowStep, FlowVariable, ReadActionTypeParams, ReadActionTypeResult, ActionIo, PublishFlowParams, PublishFlowResult, CopyFlowParams, CopyFlowResult, CreateFlowParams, CreateFlowResult, EditFlowParams, EditFlowResult, EditFlowOps, StepInputPatch, TestFlowParams, TestFlowResult, WriteOp, WriteOpResult, } from "./flowDesigner";
 export type { ServiceNowClientConfig, ChoiceValue, ChoiceType, AddChoicesParams, AddChoicesResult, ChoiceActionResult, DictionaryRecord, UpdateSetRecord, LayoutAction, LayoutRecordResult, LayoutResult, CreateViewParams, CreateViewResult, FormSectionSpec, SetFormLayoutParams, SetListLayoutParams, SetRelatedListsParams, ChunkRole, ChunkInfo, ChunkResult, PrunedResult, HostAssetsParams, HostAssetsResult, } from "./types";
-export { createTable, projectTableGraph, buildColumnXml, normalizeColumns, resolveType, applyTableSaveOverlay, defaultAccessFlags, TYPE_MAP, DEFAULT_SUPER_CLASS, DEFAULT_SAVE_ACTION, addColumn, deriveElement, setColumn, resolveAttributes, toStoredValue, } from "./table";
-export type { CreateTableParams, CreateTableResult, AddColumnParams, AddColumnResult, SetColumnParams, SetColumnResult, ColumnAttributes, AttributeChange, TableGraph, NormalizedColumn, ColumnSpec, AccessFlags, OverlaySpec, } from "./table";
+export { createTable, projectTableGraph, buildColumnXml, normalizeColumns, resolveType, applyTableSaveOverlay, defaultAccessFlags, TYPE_MAP, DEFAULT_SUPER_CLASS, DEFAULT_SAVE_ACTION, addColumn, deriveElement, setColumn, resolveAttributes, toStoredValue, setTable, resolveTableAttributes, } from "./table";
+export type { CreateTableParams, CreateTableResult, AddColumnParams, AddColumnResult, SetColumnParams, SetColumnResult, ColumnAttributes, AttributeChange, SetTableParams, SetTableResult, TableAttributes, TableGraph, NormalizedColumn, ColumnSpec, AccessFlags, OverlaySpec, } from "./table";
 export { setField } from "./setField";
 export { createRecord } from "./createRecord";
 export type { RecordWriteResult, SetFieldParams, SetFieldResult, } from "./setField";
 export type { CreateRecordParams, CreateRecordResult } from "./createRecord";
 export { invokeRest, INVOKE_REST_METHODS } from "./invokeRest";
 export type { InvokeRestParams, InvokeRestResult } from "./invokeRest";
+export { publishApp, buildStartFields, parseXmlAnswer, parseProgressTree, classifyProgress, flattenSteps, harvestProgressResults, parseCicdPublishResponse, parseCicdProgress, DEFAULT_PUBLISH_TIMEOUT_MS, PUBLISH_POLL_DELAYS_MS, } from "./publishApp";
+export type { PublishAppParams, PublishAppResult, PublishTarget, PublishStep, ProgressNode, CicdProgress, PublishTransport, } from "./publishApp";

package/dist/index.js

@@ -7,7 +7,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.addColumn = exports.DEFAULT_SAVE_ACTION = exports.DEFAULT_SUPER_CLASS = exports.TYPE_MAP = exports.defaultAccessFlags = exports.applyTableSaveOverlay = exports.resolveType = exports.normalizeColumns = exports.buildColumnXml = exports.projectTableGraph = exports.createTable = exports.WriteOrderError = exports.executeWritePlan = exports.topoSort = exports.generateSysId = exports.DEFAULT_RUN_FLOW_PATH = exports.testFlow = exports.editFlow = exports.buildPublishModel = exports.createFlow = exports.copyFlow = exports.publishFlow = exports.readActionType = exports.readFlow = exports.formatStepPill = exports.summarizeSteps = exports.verifySteps = exports.applyStepOps = exports.editActionType = exports.publishActionType = exports.triggerPublication = exports.cloneActionType = exports.cloneSubflow = exports.verifyArtifact = exports.listTemplates = exports.sincPlugin = exports.formatCreateViewResult = exports.formatLayoutResult = exports.setRelatedLists = exports.setFormLayout = exports.setListLayout = exports.createView = exports.formatAddChoicesResult = exports.formatHostAssetsResult = exports.classifyChunks = exports.hostAssets = exports.addChoicesToField = exports.resolveConfigFromEnvFile = exports.createClientFromEnvFile = exports.createClient = void 0;
-exports.INVOKE_REST_METHODS = exports.invokeRest = exports.createRecord = exports.setField = exports.toStoredValue = exports.resolveAttributes = exports.setColumn = exports.deriveElement = void 0;
+exports.PUBLISH_POLL_DELAYS_MS = exports.DEFAULT_PUBLISH_TIMEOUT_MS = exports.parseCicdProgress = exports.parseCicdPublishResponse = exports.harvestProgressResults = exports.flattenSteps = exports.classifyProgress = exports.parseProgressTree = exports.parseXmlAnswer = exports.buildStartFields = exports.publishApp = exports.INVOKE_REST_METHODS = exports.invokeRest = exports.createRecord = exports.setField = exports.resolveTableAttributes = exports.setTable = exports.toStoredValue = exports.resolveAttributes = exports.setColumn = exports.deriveElement = void 0;
 var client_1 = require("./client");
 Object.defineProperty(exports, "createClient", { enumerable: true, get: function () { return client_1.createClient; } });
 var createClientFromEnvFile_1 = require("./createClientFromEnvFile");
@@ -75,6 +75,8 @@ Object.defineProperty(exports, "deriveElement", { enumerable: true, get: functio
 Object.defineProperty(exports, "setColumn", { enumerable: true, get: function () { return table_1.setColumn; } });
 Object.defineProperty(exports, "resolveAttributes", { enumerable: true, get: function () { return table_1.resolveAttributes; } });
 Object.defineProperty(exports, "toStoredValue", { enumerable: true, get: function () { return table_1.toStoredValue; } });
+Object.defineProperty(exports, "setTable", { enumerable: true, get: function () { return table_1.setTable; } });
+Object.defineProperty(exports, "resolveTableAttributes", { enumerable: true, get: function () { return table_1.resolveTableAttributes; } });
 var setField_1 = require("./setField");
 Object.defineProperty(exports, "setField", { enumerable: true, get: function () { return setField_1.setField; } });
 var createRecord_1 = require("./createRecord");
@@ -82,3 +84,15 @@ Object.defineProperty(exports, "createRecord", { enumerable: true, get: function
 var invokeRest_1 = require("./invokeRest");
 Object.defineProperty(exports, "invokeRest", { enumerable: true, get: function () { return invokeRest_1.invokeRest; } });
 Object.defineProperty(exports, "INVOKE_REST_METHODS", { enumerable: true, get: function () { return invokeRest_1.INVOKE_REST_METHODS; } });
+var publishApp_1 = require("./publishApp");
+Object.defineProperty(exports, "publishApp", { enumerable: true, get: function () { return publishApp_1.publishApp; } });
+Object.defineProperty(exports, "buildStartFields", { enumerable: true, get: function () { return publishApp_1.buildStartFields; } });
+Object.defineProperty(exports, "parseXmlAnswer", { enumerable: true, get: function () { return publishApp_1.parseXmlAnswer; } });
+Object.defineProperty(exports, "parseProgressTree", { enumerable: true, get: function () { return publishApp_1.parseProgressTree; } });
+Object.defineProperty(exports, "classifyProgress", { enumerable: true, get: function () { return publishApp_1.classifyProgress; } });
+Object.defineProperty(exports, "flattenSteps", { enumerable: true, get: function () { return publishApp_1.flattenSteps; } });
+Object.defineProperty(exports, "harvestProgressResults", { enumerable: true, get: function () { return publishApp_1.harvestProgressResults; } });
+Object.defineProperty(exports, "parseCicdPublishResponse", { enumerable: true, get: function () { return publishApp_1.parseCicdPublishResponse; } });
+Object.defineProperty(exports, "parseCicdProgress", { enumerable: true, get: function () { return publishApp_1.parseCicdProgress; } });
+Object.defineProperty(exports, "DEFAULT_PUBLISH_TIMEOUT_MS", { enumerable: true, get: function () { return publishApp_1.DEFAULT_PUBLISH_TIMEOUT_MS; } });
+Object.defineProperty(exports, "PUBLISH_POLL_DELAYS_MS", { enumerable: true, get: function () { return publishApp_1.PUBLISH_POLL_DELAYS_MS; } });

package/dist/mcp/registry.d.ts

@@ -10,7 +10,7 @@ import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 import type { ToolAnnotations } from "@tenonhq/dovetail-mcp-kit";
 import type { ServiceNowClient } from "../client";
-export declare var TOOL_NAMES: readonly ["create_view", "set_list_layout", "set_form_layout", "set_related_lists", "add_choices_to_field", "flow_view", "action_view", "action_edit", "flow_publish", "flow_copy", "flow_create", "flow_test", "flow_edit", "create_table", "add_column", "set_column", "set_field", "create_record", "host_assets", "invoke_rest"];
+export declare var TOOL_NAMES: readonly ["create_view", "set_list_layout", "set_form_layout", "set_related_lists", "add_choices_to_field", "flow_view", "action_view", "action_edit", "flow_publish", "flow_copy", "flow_create", "flow_test", "flow_edit", "create_table", "add_column", "set_column", "set_table", "set_field", "create_record", "host_assets", "invoke_rest", "app_publish"];
 export type ToolName = (typeof TOOL_NAMES)[number];
 export interface RegistryDeps {
     /** Optional client injection for tests; defaults to createClient({}). */

package/dist/mcp/registry.js

@@ -31,6 +31,7 @@ const hostAssets_1 = require("../hostAssets");
 const setField_1 = require("../setField");
 const createRecord_1 = require("../createRecord");
 const invokeRest_1 = require("../invokeRest");
+const publishApp_1 = require("../publishApp");
 const schemas_1 = require("./schemas");
 exports.TOOL_NAMES = [
     "create_view",
@@ -49,10 +50,12 @@ exports.TOOL_NAMES = [
     "create_table",
     "add_column",
     "set_column",
+    "set_table",
     "set_field",
     "create_record",
     "host_assets",
     "invoke_rest",
+    "app_publish",
 ];
 // Annotation presets (READ_ONLY / WRITE_ADDITIVE_IDEMPOTENT / WRITE_CREATE /
 // WRITE_OVERWRITE / WRITE_EXECUTE) come from @tenonhq/dovetail-mcp-kit.
@@ -391,6 +394,42 @@ function buildDescriptors(deps = {}) {
                 });
             },
         },
+        {
+            name: "set_table",
+            annotations: dovetail_mcp_kit_1.WRITE_OVERWRITE,
+            description: "Update an EXISTING ServiceNow TABLE's own dictionary attributes — the row where " +
+                "internal_type=collection and element is EMPTY — captured into a named update set, then " +
+                "READ BACK from the instance to verify. Completes the trio: set_field changes a RECORD's " +
+                "value, set_column changes a COLUMN's definition, set_table changes the TABLE's own. " +
+                "Currently settable: audit. audit=true turns RECORD AUDITING on for the whole table — " +
+                "ServiceNow then writes a sys_audit row per changed field on every insert and update, " +
+                "which is a real storage and write cost on a high-volume table, so weigh it before " +
+                "enabling. Attributes are a closed set, never an open field map; a COLUMN attribute " +
+                "(label/mandatory/default/maxLength/readOnly/element/internalType) is refused by name and " +
+                "redirected to set_column. When the requested value already matches, nothing is written " +
+                "and the status is 'unchanged' — note that an identical-value write also captures " +
+                "NOTHING, so there is no update-set row to promote. dryRun:true diffs against the " +
+                "instance and writes nothing.",
+            shape: schemas_1.setTableSchema.shape,
+            handler: async function (args) {
+                var p = schemas_1.setTableSchema.parse(args);
+                // Same live-path guard as set_column: the schema leaves updateSetSysId
+                // optional so dry-run works without one.
+                if (p.dryRun !== true &&
+                    (!p.updateSetSysId || !p.updateSetSysId.trim())) {
+                    throw new Error("set_table: updateSetSysId is required on the live path so the schema " +
+                        "change is captured in a known update set — set dryRun:true to plan " +
+                        "without one.");
+                }
+                return (0, table_1.setTable)({
+                    client: client(),
+                    table: p.table,
+                    attributes: p.attributes,
+                    updateSetSysId: p.updateSetSysId,
+                    dryRun: p.dryRun,
+                });
+            },
+        },
         {
             name: "set_field",
             annotations: dovetail_mcp_kit_1.WRITE_OVERWRITE,
@@ -491,6 +530,39 @@ function buildDescriptors(deps = {}) {
                 return (0, invokeRest_1.invokeRest)(params);
             },
         },
+        {
+            name: "app_publish",
+            annotations: dovetail_mcp_kit_1.WRITE_EXECUTE,
+            description: "Publish a scoped ServiceNow application to ONE target per call — the ServiceNow Store " +
+                "(target 'store') or the company Application Repository (target 'repo'); call twice to " +
+                "publish to both — then poll the publish to completion. STORE PUBLISH IS EXTERNALLY " +
+                "VISIBLE on the ServiceNow Store — treat it as a release. DRY-RUN BY DEFAULT: without " +
+                "confirm:true the resolved plan (app, current version, target) is returned and nothing is " +
+                "published. target 'store' replays the sys_app form's upload flow over a form-login session " +
+                "and requires SN_STORE_USERNAME/SN_STORE_PASSWORD in the server's env file — credentials " +
+                "never transit tool arguments. target 'repo' uses the supported CI/CD REST API " +
+                "(/api/sn_cicd/app_repo/publish) and requires the sn_cicd role. app is a scope name, " +
+                "sys_app sys_id, or app name; version must be above the currently published version. The " +
+                "result carries the progress-tracker id, per-step states, the Store appLink, and the " +
+                "publish's update-set sys_id where the instance reports one.",
+            shape: schemas_1.publishAppSchema.shape,
+            handler: async function (args) {
+                var p = schemas_1.publishAppSchema.parse(args);
+                var params = {
+                    app: p.app,
+                    version: p.version,
+                    target: p.target,
+                    devNotes: p.devNotes,
+                    confirm: p.confirm,
+                    dryRun: p.dryRun,
+                    timeoutMs: p.timeoutMs,
+                };
+                if (deps.client) {
+                    params.client = deps.client;
+                }
+                return (0, publishApp_1.publishApp)(params);
+            },
+        },
     ];
 }
 function registerAllTools(server, deps = {}) {

package/dist/mcp/schemas.d.ts

@@ -914,6 +914,43 @@ export declare var setColumnSchema: z.ZodObject<{
     dryRun?: boolean | undefined;
     updateSetSysId?: string | undefined;
 }>;
+export declare var tableAttributesSchema: z.ZodObject<{
+    audit: z.ZodOptional<z.ZodBoolean>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    audit: z.ZodOptional<z.ZodBoolean>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    audit: z.ZodOptional<z.ZodBoolean>;
+}, z.ZodTypeAny, "passthrough">>;
+export declare var setTableSchema: z.ZodObject<{
+    table: z.ZodString;
+    attributes: z.ZodObject<{
+        audit: z.ZodOptional<z.ZodBoolean>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        audit: z.ZodOptional<z.ZodBoolean>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        audit: z.ZodOptional<z.ZodBoolean>;
+    }, z.ZodTypeAny, "passthrough">>;
+    updateSetSysId: z.ZodOptional<z.ZodString>;
+    dryRun: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    table: string;
+    attributes: {
+        audit?: boolean | undefined;
+    } & {
+        [k: string]: unknown;
+    };
+    dryRun?: boolean | undefined;
+    updateSetSysId?: string | undefined;
+}, {
+    table: string;
+    attributes: {
+        audit?: boolean | undefined;
+    } & {
+        [k: string]: unknown;
+    };
+    dryRun?: boolean | undefined;
+    updateSetSysId?: string | undefined;
+}>;
 export declare var setFieldSchema: z.ZodObject<{
     table: z.ZodString;
     sysId: z.ZodOptional<z.ZodString>;
@@ -958,6 +995,31 @@ export declare var createRecordSchema: z.ZodObject<{
     dryRun?: boolean | undefined;
     ifAbsentQuery?: string | undefined;
 }>;
+export declare var publishAppSchema: z.ZodObject<{
+    app: z.ZodString;
+    version: z.ZodString;
+    devNotes: z.ZodOptional<z.ZodString>;
+    target: z.ZodUnion<[z.ZodLiteral<"store">, z.ZodLiteral<"repo">]>;
+    confirm: z.ZodOptional<z.ZodBoolean>;
+    dryRun: z.ZodOptional<z.ZodBoolean>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    target: "store" | "repo";
+    version: string;
+    app: string;
+    confirm?: boolean | undefined;
+    dryRun?: boolean | undefined;
+    devNotes?: string | undefined;
+    timeoutMs?: number | undefined;
+}, {
+    target: "store" | "repo";
+    version: string;
+    app: string;
+    confirm?: boolean | undefined;
+    dryRun?: boolean | undefined;
+    devNotes?: string | undefined;
+    timeoutMs?: number | undefined;
+}>;
 export declare var invokeRestSchema: z.ZodObject<{
     method: z.ZodEffects<z.ZodEnum<["GET", "POST", "PUT", "DELETE"]>, "GET" | "DELETE" | "POST" | "PUT", unknown>;
     path: z.ZodString;

package/dist/mcp/schemas.js

@@ -4,7 +4,7 @@
  * own file so registry.ts stays focused on wiring.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.invokeRestSchema = exports.createRecordSchema = exports.setFieldSchema = exports.setColumnSchema = exports.columnAttributesSchema = exports.addColumnSchema = exports.createTableSchema = exports.columnSpecSchema = exports.hostAssetsSchema = exports.editFlowSchema = exports.editActionSchema = exports.stepInputPatchSchema = exports.testFlowSchema = exports.createFlowSchema = exports.copyFlowSchema = exports.publishFlowSchema = exports.viewActionSchema = exports.viewFlowSchema = exports.addChoicesToFieldSchema = exports.choiceValueSchema = exports.setRelatedListsSchema = exports.setFormLayoutSchema = exports.formSectionSchema = exports.setListLayoutSchema = exports.createViewSchema = void 0;
+exports.invokeRestSchema = exports.publishAppSchema = exports.createRecordSchema = exports.setFieldSchema = exports.setTableSchema = exports.tableAttributesSchema = exports.setColumnSchema = exports.columnAttributesSchema = exports.addColumnSchema = exports.createTableSchema = exports.columnSpecSchema = exports.hostAssetsSchema = exports.editFlowSchema = exports.editActionSchema = exports.stepInputPatchSchema = exports.testFlowSchema = exports.createFlowSchema = exports.copyFlowSchema = exports.publishFlowSchema = exports.viewActionSchema = exports.viewFlowSchema = exports.addChoicesToFieldSchema = exports.choiceValueSchema = exports.setRelatedListsSchema = exports.setFormLayoutSchema = exports.formSectionSchema = exports.setListLayoutSchema = exports.createViewSchema = void 0;
 const zod_1 = require("zod");
 exports.createViewSchema = zod_1.z.object({
     name: zod_1.z.string().min(1),
@@ -241,6 +241,28 @@ exports.setColumnSchema = zod_1.z.object({
     updateSetSysId: zod_1.z.string().min(1).optional(),
     dryRun: zod_1.z.boolean().optional(),
 });
+// set-table takes a CLOSED attribute set for the same reason set-column does: an
+// unbounded write to sys_dictionary lets a caller silently corrupt schema. These are
+// the TABLE's own attributes (the internal_type=collection row), not a column's.
+//
+// .passthrough() is deliberate: z.object() strips unknown keys by default, which would
+// silently drop a column attribute (or a typo) BEFORE resolveTableAttributes could see
+// it — so { audit:true, label:"x" } would succeed, quietly discarding label. Passing
+// unknown keys through lets the core allowlist reject them (a column attribute earns the
+// "use set-column" redirect; anything else, "not a settable table attribute").
+exports.tableAttributesSchema = zod_1.z
+    .object({
+    audit: zod_1.z.boolean().optional(),
+})
+    .passthrough();
+exports.setTableSchema = zod_1.z.object({
+    table: zod_1.z.string().min(1),
+    attributes: exports.tableAttributesSchema,
+    // Optional because dryRun works without one; the live-path requirement is
+    // enforced at the tool boundary (registry.ts), matching set_column.
+    updateSetSysId: zod_1.z.string().min(1).optional(),
+    dryRun: zod_1.z.boolean().optional(),
+});
 // Data-record write verbs. Kept as plain z.object (no .refine wrapper) so
 // registry.ts can read `.shape`; the deeper rules — one of sysId/query, at
 // least one field, the schema-table refusal — are enforced by the core
@@ -261,6 +283,19 @@ exports.createRecordSchema = zod_1.z.object({
     ifAbsentQuery: zod_1.z.string().optional(),
     dryRun: zod_1.z.boolean().optional(),
 });
+// app_publish: publish a scoped app to the ServiceNow Store or the company
+// application repository. Deliberately NO credential fields — the Store
+// account resolves from SN_STORE_USERNAME/SN_STORE_PASSWORD inside the verb,
+// so credentials never transit MCP arguments or telemetry.
+exports.publishAppSchema = zod_1.z.object({
+    app: zod_1.z.string().min(1),
+    version: zod_1.z.string().min(1),
+    devNotes: zod_1.z.string().optional(),
+    target: zod_1.z.union([zod_1.z.literal("store"), zod_1.z.literal("repo")]),
+    confirm: zod_1.z.boolean().optional(),
+    dryRun: zod_1.z.boolean().optional(),
+    timeoutMs: zod_1.z.number().int().positive().optional(),
+});
 // invoke_rest: transport primitive for arbitrary authenticated REST operations
 // (Scripted REST included). The dry-run-unless-confirm gate lives in invokeRest
 // itself; the regex here rejects absolute URLs and non-/api/ paths early.