@tenonhq/dovetail-servicenow 0.0.38 → 0.0.39

package/dist/cli.js

@@ -1070,8 +1070,11 @@ function printHelp() {
         "                     (--in <file> [--out <file>] [--rules <file>] [--report] [--json])\n" +
         "  mcp                Run the MCP stdio server (--smoke lists tools and exits)\n" +
         "\nGlobal flags:\n" +
-        "  --env <path>       Load credentials from a specific .env file (also --env-file,\n" +
-        "                     or the DOVETAIL_ENV_FILE env var). Default: .env in the cwd.\n");
+        "  --env <name|path>  Load credentials from a specific env file (also --env-file,\n" +
+        "                     or the DOVETAIL_ENV_FILE env var). A bare name like 'prod'\n" +
+        "                     resolves to .env.prod in the cwd. The file's SN_* connection\n" +
+        "                     vars replace any already exported; a missing or incomplete\n" +
+        "                     file is an error (no fallback). Default: .env in the cwd.\n");
 }
 /** Parse inline `--columns "Label:type:max, Other:choice, ..."` into ColumnSpec[]. */
 function parseColumnsInline(input) {

package/dist/loadEnv.d.ts

@@ -1,15 +1,45 @@
+/**
+ * ServiceNow connection variables. When an env file is selected explicitly,
+ * these are taken from the file ONLY — any value already in process.env is
+ * cleared first — so the selected file fully determines the target instance
+ * and auth mode. (Without this, a shell/session-exported SN_INSTANCE or
+ * SN_API_KEY silently won over the file and the command hit the wrong
+ * instance.)
+ */
+export declare var SN_CONNECTION_KEYS: string[];
+/**
+ * Resolve an `--env` selector to an absolute env-file path.
+ *
+ * Accepts, in order:
+ *   - an absolute path, or any value containing a path separator → used as a path
+ *     (relative paths resolve against cwd) — unchanged legacy behavior;
+ *   - a bare name that exists as a file in cwd (e.g. `--env my.env`) → that file;
+ *   - a bare name like `loft` → `<cwd>/.env.loft`, matching the MCP tool's
+ *     per-call `env` resolution; a `.env`-prefixed basename is used as-is.
+ *
+ * Returns the resolved path; does not check existence (loadEnvFile does).
+ */
+export declare function resolveEnvSelection(raw: string, cwd?: string): string;
 /**
  * Loads ServiceNow credentials for the `dove-sn` CLI and its MCP server.
  *
  * Resolution order for the env file:
- *   1. An explicit `--env <path>` / `--env-file <path>` flag (passed in here).
- *   2. The `DOVETAIL_ENV_FILE` environment variable — lets an MCP host point
- *      `dove-sn mcp` at a specific credential file without a CLI flag.
+ *   1. An explicit `--env <name|path>` / `--env-file <name|path>` flag.
+ *   2. The `DOVETAIL_ENV_FILE` environment variable.
  *   3. The default `.env` in the current working directory.
  *
- * dotenv does not override variables already present in process.env, so an
- * explicit file augments (never clobbers) credentials the parent shell exported.
+ * For an explicit selection (1 or 2) this FAILS CLOSED: a missing file, or a
+ * file that doesn't define an instance plus credentials, throws instead of
+ * silently falling back to whatever instance the surrounding environment
+ * points at. The file's ServiceNow connection variables (SN_CONNECTION_KEYS)
+ * replace any already in process.env; every other variable keeps dotenv's
+ * never-override semantics.
+ *
+ * The default cwd `.env` (3) keeps its historical behavior: optional, and
+ * never overrides already-exported variables.
  *
- * @param {string} [explicitPath] - Path from the `--env` / `--env-file` flag.
+ * @param {string} [explicitSelection] - Value of the `--env` / `--env-file` flag.
+ * @returns {string|undefined} The absolute path of the explicitly selected
+ *   file, or undefined when the default `.env` path was used.
  */
-export declare function loadEnvFile(explicitPath?: string): void;
+export declare function loadEnvFile(explicitSelection?: string): string | undefined;

package/dist/loadEnv.js

@@ -3,30 +3,110 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SN_CONNECTION_KEYS = void 0;
+exports.resolveEnvSelection = resolveEnvSelection;
 exports.loadEnvFile = loadEnvFile;
+const fs_1 = __importDefault(require("fs"));
 const dotenv_1 = __importDefault(require("dotenv"));
 const path_1 = __importDefault(require("path"));
+const createClientFromEnvFile_1 = require("./createClientFromEnvFile");
+/**
+ * ServiceNow connection variables. When an env file is selected explicitly,
+ * these are taken from the file ONLY — any value already in process.env is
+ * cleared first — so the selected file fully determines the target instance
+ * and auth mode. (Without this, a shell/session-exported SN_INSTANCE or
+ * SN_API_KEY silently won over the file and the command hit the wrong
+ * instance.)
+ */
+exports.SN_CONNECTION_KEYS = [
+    "SN_INSTANCE",
+    "SN_DEV_INSTANCE",
+    "SN_PROD_INSTANCE",
+    "SN_API_KEY",
+    "SN_DEV_API_KEY",
+    "SN_PROD_API_KEY",
+    "SN_USER",
+    "SN_PASSWORD",
+    "SN_DEV_USERNAME",
+    "SN_DEV_PASSWORD",
+    "SN_PROD_USERNAME",
+    "SN_PROD_PASSWORD",
+];
+/**
+ * Resolve an `--env` selector to an absolute env-file path.
+ *
+ * Accepts, in order:
+ *   - an absolute path, or any value containing a path separator → used as a path
+ *     (relative paths resolve against cwd) — unchanged legacy behavior;
+ *   - a bare name that exists as a file in cwd (e.g. `--env my.env`) → that file;
+ *   - a bare name like `loft` → `<cwd>/.env.loft`, matching the MCP tool's
+ *     per-call `env` resolution; a `.env`-prefixed basename is used as-is.
+ *
+ * Returns the resolved path; does not check existence (loadEnvFile does).
+ */
+function resolveEnvSelection(raw, cwd) {
+    if (typeof raw !== "string" || raw.trim().length === 0) {
+        throw new Error("--env must be a non-empty env-file name or path.");
+    }
+    var value = raw.trim();
+    var base = cwd || process.cwd();
+    if (path_1.default.isAbsolute(value) || /[\\/]/.test(value)) {
+        return path_1.default.resolve(base, value);
+    }
+    var literal = path_1.default.resolve(base, value);
+    if (fs_1.default.existsSync(literal)) {
+        return literal;
+    }
+    if (value.indexOf(".env") === 0) {
+        return literal;
+    }
+    return path_1.default.resolve(base, ".env." + value);
+}
 /**
  * Loads ServiceNow credentials for the `dove-sn` CLI and its MCP server.
  *
  * Resolution order for the env file:
- *   1. An explicit `--env <path>` / `--env-file <path>` flag (passed in here).
- *   2. The `DOVETAIL_ENV_FILE` environment variable — lets an MCP host point
- *      `dove-sn mcp` at a specific credential file without a CLI flag.
+ *   1. An explicit `--env <name|path>` / `--env-file <name|path>` flag.
+ *   2. The `DOVETAIL_ENV_FILE` environment variable.
  *   3. The default `.env` in the current working directory.
  *
- * dotenv does not override variables already present in process.env, so an
- * explicit file augments (never clobbers) credentials the parent shell exported.
+ * For an explicit selection (1 or 2) this FAILS CLOSED: a missing file, or a
+ * file that doesn't define an instance plus credentials, throws instead of
+ * silently falling back to whatever instance the surrounding environment
+ * points at. The file's ServiceNow connection variables (SN_CONNECTION_KEYS)
+ * replace any already in process.env; every other variable keeps dotenv's
+ * never-override semantics.
+ *
+ * The default cwd `.env` (3) keeps its historical behavior: optional, and
+ * never overrides already-exported variables.
  *
- * @param {string} [explicitPath] - Path from the `--env` / `--env-file` flag.
+ * @param {string} [explicitSelection] - Value of the `--env` / `--env-file` flag.
+ * @returns {string|undefined} The absolute path of the explicitly selected
+ *   file, or undefined when the default `.env` path was used.
  */
-function loadEnvFile(explicitPath) {
-    var raw = explicitPath || process.env.DOVETAIL_ENV_FILE;
-    if (raw) {
-        var resolved = path_1.default.isAbsolute(raw) ? raw : path_1.default.resolve(process.cwd(), raw);
-        dotenv_1.default.config({ path: resolved });
-        return;
+function loadEnvFile(explicitSelection) {
+    var raw = explicitSelection || process.env.DOVETAIL_ENV_FILE;
+    if (!raw) {
+        // No explicit selection — load .env from cwd if it exists (no-op otherwise).
+        dotenv_1.default.config();
+        return undefined;
+    }
+    var resolved = resolveEnvSelection(raw);
+    if (!fs_1.default.existsSync(resolved)) {
+        throw new Error("env file not found: '" + resolved + "' (from --env '" + raw + "'). " +
+            "Refusing to fall back to the default environment — pass an existing env-file " +
+            "name (e.g. 'prod' → .env.prod in the current directory) or path.");
     }
-    // No explicit selection — load .env from cwd if it exists (no-op otherwise).
-    dotenv_1.default.config();
+    // Validates instance + credentials and throws loudly if either is missing.
+    (0, createClientFromEnvFile_1.resolveConfigFromEnvFile)(resolved);
+    var parsed = dotenv_1.default.parse(fs_1.default.readFileSync(resolved, "utf8"));
+    exports.SN_CONNECTION_KEYS.forEach(function (key) {
+        delete process.env[key];
+        if (Object.prototype.hasOwnProperty.call(parsed, key) && parsed[key] !== "") {
+            process.env[key] = parsed[key];
+        }
+    });
+    // Everything else in the file: dotenv's normal never-override semantics.
+    dotenv_1.default.config({ path: resolved });
+    return resolved;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tenonhq/dovetail-servicenow",
-  "version": "0.0.38",
+  "version": "0.0.39",
   "engines": {
     "node": ">=22"
   },