@tenonhq/dovetail-servicenow 0.0.35 → 0.0.36

package/dist/client.d.ts

@@ -20,6 +20,15 @@
  * have SN_INSTANCE/SN_USER/SN_PASSWORD work without reconfiguration.
  */
 import type { ServiceNowClientConfig } from "./types";
+/** Resolved auth mode: inbound API key (x-sn-apikey header) or basic auth. */
+export type ResolvedAuth = {
+    mode: "apiKey";
+    apiKey: string;
+} | {
+    mode: "basic";
+    user: string;
+    password: string;
+};
 export interface TableQueryOptions {
     limit?: number;
     fields?: string[];

package/dist/client.js

@@ -52,6 +52,15 @@ function resolveInstance(cfg) {
     return normalizeHost(raw);
 }
 function resolveAuth(cfg) {
+    // Explicit config wins over the environment, and within each layer an API
+    // key is the default over basic credentials. A cfg that names user/password
+    // (e.g. one resolved from an --env file) deliberately pins basic auth even
+    // when the surrounding process.env carries SN_API_KEY — an env-file retarget
+    // must be fully determined by its file.
+    if (cfg.apiKey) {
+        return { mode: "apiKey", apiKey: cfg.apiKey };
+    }
+    var cfgWantsBasic = Boolean(cfg.user || cfg.password);
     var user = cfg.user
         || process.env.SN_USER
         || process.env.SN_DEV_USERNAME
@@ -62,11 +71,20 @@ function resolveAuth(cfg) {
         || process.env.SN_DEV_PASSWORD
         || process.env.SN_PROD_PASSWORD
         || "";
+    if (!cfgWantsBasic) {
+        var envApiKey = process.env.SN_API_KEY
+            || process.env.SN_DEV_API_KEY
+            || process.env.SN_PROD_API_KEY
+            || "";
+        if (envApiKey) {
+            return { mode: "apiKey", apiKey: envApiKey };
+        }
+    }
     if (!user || !password) {
-        throw new Error("ServiceNow credentials missing — set SN_USER/SN_PASSWORD (preferred) " +
-            "or SN_DEV_USERNAME/SN_DEV_PASSWORD (or SN_PROD_*).");
+        throw new Error("ServiceNow credentials missing — set SN_API_KEY (inbound API key, preferred), " +
+            "or SN_USER/SN_PASSWORD, or SN_DEV_USERNAME/SN_DEV_PASSWORD (or SN_PROD_*).");
     }
-    return { user: user, password: password };
+    return { mode: "basic", user: user, password: password };
 }
 function sleep(ms) {
     return new Promise(function (resolve) {
@@ -97,10 +115,19 @@ function createClient(config = {}) {
     var max5xx = config.maxRetries5xx != null
         ? config.maxRetries5xx
         : Number(process.env.SN_MAX_RETRIES_5XX) || 3;
+    var baseHeaders = {
+        accept: "application/json",
+        "content-type": "application/json"
+    };
+    if (creds.mode === "apiKey") {
+        baseHeaders["x-sn-apikey"] = creds.apiKey;
+    }
     var http = axios_1.default.create({
         baseURL: "https://" + host,
-        auth: { username: creds.user, password: creds.password },
-        headers: { accept: "application/json", "content-type": "application/json" },
+        auth: creds.mode === "basic"
+            ? { username: creds.user, password: creds.password }
+            : undefined,
+        headers: baseHeaders,
         validateStatus: function () { return true; }
     });
     var lastAt = 0;

package/dist/createClientFromEnvFile.d.ts

@@ -17,8 +17,9 @@ import type { ServiceNowClientConfig } from "./types";
  * the surrounding process.env, so the file fully determines the target.
  *
  * Throws if the file cannot be read, or if it does not define an instance and
- * a complete credential pair — failing loudly rather than silently falling
- * back to whatever instance the host process happens to be pointed at.
+ * credentials (an inbound API key, or a complete basic-auth pair) — failing
+ * loudly rather than silently falling back to whatever instance the host
+ * process happens to be pointed at.
  */
 export declare function resolveConfigFromEnvFile(envPath: string): ServiceNowClientConfig;
 /**

package/dist/createClientFromEnvFile.js

@@ -25,8 +25,9 @@ const client_1 = require("./client");
  * the surrounding process.env, so the file fully determines the target.
  *
  * Throws if the file cannot be read, or if it does not define an instance and
- * a complete credential pair — failing loudly rather than silently falling
- * back to whatever instance the host process happens to be pointed at.
+ * credentials (an inbound API key, or a complete basic-auth pair) — failing
+ * loudly rather than silently falling back to whatever instance the host
+ * process happens to be pointed at.
  */
 function resolveConfigFromEnvFile(envPath) {
     if (typeof envPath !== "string" || envPath.length === 0) {
@@ -41,15 +42,24 @@ function resolveConfigFromEnvFile(envPath) {
     }
     var parsed = dotenv_1.default.parse(raw);
     var instance = parsed.SN_INSTANCE || parsed.SN_DEV_INSTANCE || parsed.SN_PROD_INSTANCE || "";
+    var apiKey = parsed.SN_API_KEY || parsed.SN_DEV_API_KEY || parsed.SN_PROD_API_KEY || "";
     var user = parsed.SN_USER || parsed.SN_DEV_USERNAME || parsed.SN_PROD_USERNAME || "";
     var password = parsed.SN_PASSWORD || parsed.SN_DEV_PASSWORD || parsed.SN_PROD_PASSWORD || "";
     if (!instance) {
         throw new Error("env file '" + envPath + "' does not define a ServiceNow instance — " +
             "set SN_INSTANCE (preferred) or SN_DEV_INSTANCE / SN_PROD_INSTANCE.");
     }
+    if (apiKey) {
+        // Key is the default auth mode when the file defines one. Returning the
+        // key WITHOUT user/password keeps the resolved config fully explicit —
+        // resolveAuth treats a config that names user/password as a deliberate
+        // basic-auth pin, so leaking them here would flip the mode.
+        return { instance: instance, apiKey: apiKey };
+    }
     if (!user || !password) {
         throw new Error("env file '" + envPath + "' is missing ServiceNow credentials — " +
-            "set SN_USER/SN_PASSWORD (preferred) or SN_DEV_USERNAME/SN_DEV_PASSWORD (or SN_PROD_*).");
+            "set SN_API_KEY (inbound API key, preferred), SN_USER/SN_PASSWORD, " +
+            "or SN_DEV_USERNAME/SN_DEV_PASSWORD (or SN_PROD_*).");
     }
     return { instance: instance, user: user, password: password };
 }

package/dist/types.d.ts

@@ -4,9 +4,16 @@
 export interface ServiceNowClientConfig {
     /** Instance host, e.g. "tenonworkstudio.service-now.com". Defaults to SN_INSTANCE env var. */
     instance?: string;
-    /** Basic-auth user. Defaults to SN_USER env var. */
+    /**
+     * Inbound REST API key, sent as the `x-sn-apikey` header. Defaults to the
+     * SN_API_KEY env var. When a key is present it is the default auth mode and
+     * basic auth is not sent. Requires matching REST API access policies on the
+     * instance — an API without a key-enabled policy ignores the header (401).
+     */
+    apiKey?: string;
+    /** Basic-auth user. Defaults to SN_USER env var. Fallback when no API key is configured. */
     user?: string;
-    /** Basic-auth password. Defaults to SN_PASSWORD env var. */
+    /** Basic-auth password. Defaults to SN_PASSWORD env var. Fallback when no API key is configured. */
     password?: string;
     /** Min gap between requests (ms). Defaults to SN_REQUEST_INTERVAL_MS or 20. */
     requestIntervalMs?: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tenonhq/dovetail-servicenow",
-  "version": "0.0.35",
+  "version": "0.0.36",
   "engines": {
     "node": ">=22"
   },