@tenonhq/dovetail-servicenow 0.0.38 → 0.0.40

package/README.md

@@ -516,11 +516,11 @@ Programmatic: `invokeRest({ method, path, body, confirm })` is exported, and the
 client gained `now.put` / `now.delete` / `now.invoke` (the latter returns
 `{ status, body }` verbatim) alongside the existing `now.get` / `now.post`.
 
-### Publish an app to the Store / application repository
+### Publish an app to the Store / application repository / an update set
 
 Publish a scoped application to the **ServiceNow Store**, the **company
-application repository**, or both — headlessly, with the publish's progress
-tracker polled to completion.
+application repository**, and/or **into a new update set** — headlessly, with
+each publish's progress tracker polled to completion.
 
 ```bash
 # Dry-run — the DEFAULT: resolves the app, prints the plan, publishes NOTHING
@@ -529,15 +529,21 @@ npx dove-sn publish-app --app x_cadso_filter --version 6.0.20260716 --target bot
 # Publish for real (store, then repo, same version)
 npx dove-sn publish-app --app x_cadso_filter --version 6.0.20260716 \
   --target both --dev-notes "July release" --confirm --json
+
+# Release flow on an instance WITHOUT the sn_cicd plugin: publish to the company
+# repository over the UI uploader, then capture the app into a dated update set.
+npx dove-sn publish-app --app x_cadso_filter --version 6.0.20260729 \
+  --target repo-ui,update-set --update-set-description 20260729 --confirm --json
 ```
 
 **Store publish is EXTERNALLY VISIBLE on the ServiceNow Store — treat
 `--target store --confirm` as a release.** `publish-app` is dry-run by default:
 without `--confirm` it prints the resolved plan and exits `1` (a deliberate
-refusal). `--target both` runs store then repo sequentially and short-circuits
-if the store leg fails.
+refusal). `--target` takes one target, a comma-separated list, or `both` (an
+alias for `store,repo`); targets run **in the order given** and short-circuit on
+the first failure.
 
-The two targets ride different transports:
+The targets ride different transports:
 
 - **store** replays the `sys_app` form's upload flow (`xmlhttp.do` +
   `sn_appauthor.ScopedAppUploaderAJAX`) over a form-login session — basic auth
@@ -547,13 +553,33 @@ The two targets ride different transports:
 - **repo** uses the supported CI/CD REST API (`POST /api/sn_cicd/app_repo/publish`
   + `GET /api/sn_cicd/progress/{id}`) over basic auth. The API user needs the
   `sn_cicd` role (or admin).
+- **repo-ui** reaches the *same* company repository as `repo`, but over the UI
+  uploader (`sysparm_publish_to_store=false`) instead of REST. Use it when the
+  instance has no CI/CD plugin — `tenonworkshop`, for instance, has no `sn_cicd`
+  scope and no `app_repo` service, so `repo` 404s there while `repo-ui` works.
+  It needs no Store credentials.
+- **update-set** publishes the app *into a newly created update set* via the
+  two-call `com.snc.apps.AppsAjaxProcessor` flow (`createUpdateSet` →
+  `publishToUpdateSet`). There is no REST equivalent. `--update-set-name`
+  defaults to the app's name (the dialog's field is readonly, so that is what
+  the UI submits); `--update-set-description` is conventionally the release date
+  stamp `YYYYMMDD`, which makes a whole release one query
+  (`sys_update_set` where `description=20260729`). `--include-data` maps to the
+  dialog's "Include demo data" box and defaults **off**, matching the value the
+  UI actually puts on the wire.
+
+Ordering matters when you combine them: the repo publish is what bumps
+`sys_app.version`, so put it **before** `update-set` if you want the set
+captured at the new version.
 
 `--app` accepts a scope name, `sys_app` sys_id, or app name; `--version` must be
 above the currently published version. The result carries the progress-tracker
 id, per-step states ("Packaging application", "Uploading application"), the
-Store `appLink`, and the publish's update-set sys_id where the instance reports
-one. Exit codes: `0` published or dry-run, `1` bad args/unconfirmed, `2`
-failed/timeout. Programmatic: `publishApp({ app, version, target, confirm })`.
+Store `appLink`, and the update-set sys_id — for the `update-set` target that is
+recorded as soon as the set is created, so it survives a later failure and you
+can always find (or delete) the set. Exit codes: `0` published or dry-run, `1`
+bad args/unconfirmed, `2` failed/timeout. Programmatic:
+`publishApp({ app, version, target, confirm })`.
 
 ### Export an update set (or a whole app) to importable XML
 

package/dist/cli.js

@@ -1043,15 +1043,18 @@ function printHelp() {
         "                      [--script-input <name>] [--update-set <sys_id>] [--apply] [--json])\n" +
         "  edit-flow          Patch a flow/subflow (rename, description, step inputs)\n" +
         "                     (--sys-id <sys_id> --from-json <ops.json> [--apply] [--update-set <sys_id>] [--scope <sys_id>] [--json])\n" +
-        "  publish-app        Publish a scoped app to the ServiceNow Store and/or the company\n" +
-        "                     application repository, then poll the publish to completion.\n" +
+        "  publish-app        Publish a scoped app to the ServiceNow Store, the company application\n" +
+        "                     repository, and/or a new update set, then poll each to completion.\n" +
         "                     STORE PUBLISH IS EXTERNALLY VISIBLE on the ServiceNow Store.\n" +
         "                     DRY-RUN BY DEFAULT — nothing is published without --confirm\n" +
-        "                     (--app <scope|sys_id|name> --version <v> --target store|repo|both\n" +
+        "                     (--app <scope|sys_id|name> --version <v>\n" +
+        "                      --target store|repo|repo-ui|update-set|both (comma-separated ok)\n" +
         "                      [--dev-notes <text>] [--store-user <email>] [--timeout-ms <n>]\n" +
-        "                      [--dry-run] [--json] [--confirm])\n" +
+        "                      [--update-set-name <name>] [--update-set-description <text>]\n" +
+        "                      [--include-data] [--dry-run] [--json] [--confirm])\n" +
         "                     Store creds: SN_STORE_USERNAME/SN_STORE_PASSWORD in the --env file;\n" +
-        "                     the password is never a flag. Repo publish needs the sn_cicd role.\n" +
+        "                     the password is never a flag. 'repo' needs the sn_cicd plugin+role;\n" +
+        "                     'repo-ui' reaches the same repository over the UI uploader instead.\n" +
         "  export-update-set  Export an update set to importable <unload> XML, with secret\n" +
         "                     values replaced by __SET_DURING_INSTALL__ (no opt-out).\n" +
         "                     assemble mode is READ-ONLY; complete mode marks the set\n" +
@@ -1070,8 +1073,11 @@ function printHelp() {
         "                     (--in <file> [--out <file>] [--rules <file>] [--report] [--json])\n" +
         "  mcp                Run the MCP stdio server (--smoke lists tools and exits)\n" +
         "\nGlobal flags:\n" +
-        "  --env <path>       Load credentials from a specific .env file (also --env-file,\n" +
-        "                     or the DOVETAIL_ENV_FILE env var). Default: .env in the cwd.\n");
+        "  --env <name|path>  Load credentials from a specific env file (also --env-file,\n" +
+        "                     or the DOVETAIL_ENV_FILE env var). A bare name like 'prod'\n" +
+        "                     resolves to .env.prod in the cwd. The file's SN_* connection\n" +
+        "                     vars replace any already exported; a missing or incomplete\n" +
+        "                     file is an error (no fallback). Default: .env in the cwd.\n");
 }
 /** Parse inline `--columns "Label:type:max, Other:choice, ..."` into ColumnSpec[]. */
 function parseColumnsInline(input) {
@@ -1830,8 +1836,19 @@ async function runInvokeRest(flags) {
  * dove-sn publish-app:
  *   --app <scope|sys_id|name>   Required. The sys_app to publish.
  *   --version <v>               Required. Version to publish (e.g. 6.0.20260716).
- *   --target store|repo|both    Required. STORE PUBLISH IS EXTERNALLY VISIBLE.
- *   [--dev-notes <text>]        Optional developer notes.
+ *   --target <t[,t...]>         Required. store | repo | repo-ui | update-set |
+ *                               both (= store,repo). STORE IS EXTERNALLY VISIBLE.
+ *                               repo   = CI/CD REST API (needs the sn_cicd plugin)
+ *                               repo-ui= same destination over the UI uploader,
+ *                                        for instances without sn_cicd
+ *                               update-set = publish the app INTO a new update set
+ *   [--dev-notes <text>]        Optional developer notes (uploader targets).
+ *   [--update-set-name <name>]  update-set only. Defaults to the app's name.
+ *   [--update-set-description <text>]
+ *                               update-set only. Tenon convention is the release
+ *                               date stamp (YYYYMMDD) so a release is one query.
+ *   [--include-data]            update-set only. Include demo data (default off,
+ *                               matching the observed wire value).
  *   [--store-user <email>]      Store account email (else SN_STORE_USERNAME).
  *                               The password comes ONLY from SN_STORE_PASSWORD —
  *                               there is no flag for it, ever.
@@ -1839,9 +1856,9 @@ async function runInvokeRest(flags) {
  *   [--dry-run] [--json] [--confirm]
  *
  * DRY-RUN unless --confirm: without it the resolved plan is printed and the
- * command exits 1 (a deliberate refusal, not success). --target both publishes
- * store then repo sequentially with the same version and short-circuits if the
- * store leg fails; --json emits an array of per-target results.
+ * command exits 1 (a deliberate refusal, not success). Multiple targets run
+ * sequentially with the same version and short-circuit on the first failure;
+ * --json emits an array of per-target results.
  * Exit codes: 0 published/dry-run, 1 bad args/unconfirmed, 2 failed/timeout.
  */
 async function runPublishApp(flags) {
@@ -1849,16 +1866,17 @@ async function runPublishApp(flags) {
     var version = flags.version;
     var target = flags.target;
     if (!app || !version || !target) {
-        process.stderr.write("publish-app: --app, --version and --target store|repo|both are required\n");
+        process.stderr.write("publish-app: --app, --version and --target <" +
+            publishApp_1.PUBLISH_TARGETS.join("|") +
+            "|both> are required\n");
         return 1;
     }
-    if (target !== "store" && target !== "repo" && target !== "both") {
-        process.stderr.write("publish-app: --target must be store, repo or both (got '" +
-            target +
-            "')\n");
+    var parsedTargets = (0, publishApp_1.parsePublishTargets)(target);
+    if (parsedTargets.error) {
+        process.stderr.write("publish-app: " + parsedTargets.error + "\n");
         return 1;
     }
-    var targets = target === "both" ? ["store", "repo"] : [target];
+    var targets = parsedTargets.targets;
     var dryRun = flags["dry-run"] === "true";
     var confirmed = flags.confirm === "true";
     var client = (0, client_1.createClient)({});
@@ -1877,6 +1895,16 @@ async function runPublishApp(flags) {
             params.devNotes = flags["dev-notes"];
         if (flags["store-user"])
             params.storeUsername = flags["store-user"];
+        if (flags["update-set-name"]) {
+            params.updateSetName = flags["update-set-name"];
+        }
+        // Read with !== undefined, not truthiness: an intentionally empty
+        // description must stay empty rather than silently fall back.
+        if (flags["update-set-description"] !== undefined) {
+            params.updateSetDescription = flags["update-set-description"];
+        }
+        if (flags["include-data"] === "true")
+            params.includeData = true;
         if (flags["timeout-ms"]) {
             // A NaN timeout would make the poll-loop budget check always false —
             // an infinite loop. Validate here, exit 1 on garbage.

package/dist/index.d.ts

@@ -29,7 +29,7 @@ export type { RecordWriteResult, SetFieldParams, SetFieldResult, } from "./setFi
 export type { CreateRecordParams, CreateRecordResult } from "./createRecord";
 export { invokeRest, INVOKE_REST_METHODS } from "./invokeRest";
 export type { InvokeRestParams, InvokeRestResult } from "./invokeRest";
-export { publishApp, buildStartFields, parseXmlAnswer, parseProgressTree, classifyProgress, flattenSteps, harvestProgressResults, parseCicdPublishResponse, parseCicdProgress, DEFAULT_PUBLISH_TIMEOUT_MS, PUBLISH_POLL_DELAYS_MS, } from "./publishApp";
+export { publishApp, buildStartFields, buildCreateUpdateSetFields, buildPublishToUpdateSetFields, resolveUpdateSetNaming, describeTarget, parsePublishTargets, PUBLISH_TARGETS, parseXmlAnswer, parseProgressTree, classifyProgress, flattenSteps, harvestProgressResults, parseCicdPublishResponse, parseCicdProgress, DEFAULT_PUBLISH_TIMEOUT_MS, PUBLISH_POLL_DELAYS_MS, } from "./publishApp";
 export type { PublishAppParams, PublishAppResult, PublishTarget, PublishStep, ProgressNode, CicdProgress, PublishTransport, } from "./publishApp";
 export { exportUpdateSet, renderUpdateXmlRow, renderRemoteUpdateSet, renderUnload, countUnloadRecords, countUpdateXml, fetchUpdateXmlRows, refreshTypeFields, parseStatsCount, formatUnloadDate, xmlEscape, UPDATE_XML_FIELDS, DEFAULT_PAGE_SIZE, MAX_PAGE_SIZE, DEFAULT_MAX_ROWS, } from "./exportUpdateSet";
 export type { ExportUpdateSetParams, ExportUpdateSetResult, ExportMode, ExportTransport, } from "./exportUpdateSet";

package/dist/index.js

@@ -7,8 +7,8 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.normalizeColumns = exports.buildColumnXml = exports.projectTableGraph = exports.createTable = exports.WriteOrderError = exports.executeWritePlan = exports.topoSort = exports.generateSysId = exports.DEFAULT_RUN_FLOW_PATH = exports.testFlow = exports.editFlow = exports.buildPublishModel = exports.createFlow = exports.copyFlow = exports.publishFlow = exports.readActionType = exports.readFlow = exports.formatStepPill = exports.summarizeSteps = exports.verifySteps = exports.applyStepOps = exports.editActionType = exports.publishActionType = exports.triggerPublication = exports.cloneActionType = exports.cloneSubflow = exports.verifyArtifact = exports.listTemplates = exports.sincPlugin = exports.formatCreateViewResult = exports.formatLayoutResult = exports.setRelatedLists = exports.setFormLayout = exports.setListLayout = exports.createView = exports.formatRemoveChoicesResult = exports.formatAddChoicesResult = exports.formatHostAssetsResult = exports.classifyChunks = exports.hostAssets = exports.ChoiceWriteError = exports.removeChoicesFromField = exports.addChoicesToField = exports.resolveConfigFromEnvFile = exports.createClientFromEnvFile = exports.assertWriteAllowed = exports.evaluateWriteGate = exports.isCiEnvironment = exports.resolveExecutionContext = exports.createClient = void 0;
-exports.DEFAULT_EXPORT_APP_TIMEOUT_MS = exports.buildPublishFields = exports.buildCreateSetFields = exports.exportApp = exports.DEFAULT_MAX_ROWS = exports.MAX_PAGE_SIZE = exports.DEFAULT_PAGE_SIZE = exports.UPDATE_XML_FIELDS = exports.xmlEscape = exports.formatUnloadDate = exports.parseStatsCount = exports.refreshTypeFields = exports.fetchUpdateXmlRows = exports.countUpdateXml = exports.countUnloadRecords = exports.renderUnload = exports.renderRemoteUpdateSet = exports.renderUpdateXmlRow = exports.exportUpdateSet = exports.PUBLISH_POLL_DELAYS_MS = exports.DEFAULT_PUBLISH_TIMEOUT_MS = exports.parseCicdProgress = exports.parseCicdPublishResponse = exports.harvestProgressResults = exports.flattenSteps = exports.classifyProgress = exports.parseProgressTree = exports.parseXmlAnswer = exports.buildStartFields = exports.publishApp = exports.INVOKE_REST_METHODS = exports.invokeRest = exports.createRecord = exports.setField = exports.resolveTableAttributes = exports.setTable = exports.toStoredValue = exports.resolveAttributes = exports.setColumn = exports.indexMatchesColumns = exports.parseIndexColumns = exports.addIndex = exports.deriveElement = exports.addColumn = exports.DEFAULT_SAVE_ACTION = exports.DEFAULT_SUPER_CLASS = exports.TYPE_MAP = exports.defaultAccessFlags = exports.applyTableSaveOverlay = exports.resolveType = void 0;
-exports.SECRET_INTERNAL_TYPES = exports.SENTINEL = exports.isCapturable = exports.secretFieldsFromDictionary = exports.mergeSecretRules = exports.loadSecretRules = exports.defaultSecretRules = exports.escapeRegExp = exports.encodeXmlText = exports.encodeXmlEntities = exports.stripJsonValue = exports.stripField = exports.plannedStrips = exports.recordFieldNames = exports.readRecordTable = exports.readField = exports.verifyStripped = exports.stripSecrets = void 0;
+exports.DEFAULT_PAGE_SIZE = exports.UPDATE_XML_FIELDS = exports.xmlEscape = exports.formatUnloadDate = exports.parseStatsCount = exports.refreshTypeFields = exports.fetchUpdateXmlRows = exports.countUpdateXml = exports.countUnloadRecords = exports.renderUnload = exports.renderRemoteUpdateSet = exports.renderUpdateXmlRow = exports.exportUpdateSet = exports.PUBLISH_POLL_DELAYS_MS = exports.DEFAULT_PUBLISH_TIMEOUT_MS = exports.parseCicdProgress = exports.parseCicdPublishResponse = exports.harvestProgressResults = exports.flattenSteps = exports.classifyProgress = exports.parseProgressTree = exports.parseXmlAnswer = exports.PUBLISH_TARGETS = exports.parsePublishTargets = exports.describeTarget = exports.resolveUpdateSetNaming = exports.buildPublishToUpdateSetFields = exports.buildCreateUpdateSetFields = exports.buildStartFields = exports.publishApp = exports.INVOKE_REST_METHODS = exports.invokeRest = exports.createRecord = exports.setField = exports.resolveTableAttributes = exports.setTable = exports.toStoredValue = exports.resolveAttributes = exports.setColumn = exports.indexMatchesColumns = exports.parseIndexColumns = exports.addIndex = exports.deriveElement = exports.addColumn = exports.DEFAULT_SAVE_ACTION = exports.DEFAULT_SUPER_CLASS = exports.TYPE_MAP = exports.defaultAccessFlags = exports.applyTableSaveOverlay = exports.resolveType = void 0;
+exports.SECRET_INTERNAL_TYPES = exports.SENTINEL = exports.isCapturable = exports.secretFieldsFromDictionary = exports.mergeSecretRules = exports.loadSecretRules = exports.defaultSecretRules = exports.escapeRegExp = exports.encodeXmlText = exports.encodeXmlEntities = exports.stripJsonValue = exports.stripField = exports.plannedStrips = exports.recordFieldNames = exports.readRecordTable = exports.readField = exports.verifyStripped = exports.stripSecrets = exports.DEFAULT_EXPORT_APP_TIMEOUT_MS = exports.buildPublishFields = exports.buildCreateSetFields = exports.exportApp = exports.DEFAULT_MAX_ROWS = exports.MAX_PAGE_SIZE = void 0;
 var client_1 = require("./client");
 Object.defineProperty(exports, "createClient", { enumerable: true, get: function () { return client_1.createClient; } });
 var executionContext_1 = require("./executionContext");
@@ -99,6 +99,12 @@ Object.defineProperty(exports, "INVOKE_REST_METHODS", { enumerable: true, get: f
 var publishApp_1 = require("./publishApp");
 Object.defineProperty(exports, "publishApp", { enumerable: true, get: function () { return publishApp_1.publishApp; } });
 Object.defineProperty(exports, "buildStartFields", { enumerable: true, get: function () { return publishApp_1.buildStartFields; } });
+Object.defineProperty(exports, "buildCreateUpdateSetFields", { enumerable: true, get: function () { return publishApp_1.buildCreateUpdateSetFields; } });
+Object.defineProperty(exports, "buildPublishToUpdateSetFields", { enumerable: true, get: function () { return publishApp_1.buildPublishToUpdateSetFields; } });
+Object.defineProperty(exports, "resolveUpdateSetNaming", { enumerable: true, get: function () { return publishApp_1.resolveUpdateSetNaming; } });
+Object.defineProperty(exports, "describeTarget", { enumerable: true, get: function () { return publishApp_1.describeTarget; } });
+Object.defineProperty(exports, "parsePublishTargets", { enumerable: true, get: function () { return publishApp_1.parsePublishTargets; } });
+Object.defineProperty(exports, "PUBLISH_TARGETS", { enumerable: true, get: function () { return publishApp_1.PUBLISH_TARGETS; } });
 Object.defineProperty(exports, "parseXmlAnswer", { enumerable: true, get: function () { return publishApp_1.parseXmlAnswer; } });
 Object.defineProperty(exports, "parseProgressTree", { enumerable: true, get: function () { return publishApp_1.parseProgressTree; } });
 Object.defineProperty(exports, "classifyProgress", { enumerable: true, get: function () { return publishApp_1.classifyProgress; } });

package/dist/loadEnv.d.ts

@@ -1,15 +1,45 @@
+/**
+ * ServiceNow connection variables. When an env file is selected explicitly,
+ * these are taken from the file ONLY — any value already in process.env is
+ * cleared first — so the selected file fully determines the target instance
+ * and auth mode. (Without this, a shell/session-exported SN_INSTANCE or
+ * SN_API_KEY silently won over the file and the command hit the wrong
+ * instance.)
+ */
+export declare var SN_CONNECTION_KEYS: string[];
+/**
+ * Resolve an `--env` selector to an absolute env-file path.
+ *
+ * Accepts, in order:
+ *   - an absolute path, or any value containing a path separator → used as a path
+ *     (relative paths resolve against cwd) — unchanged legacy behavior;
+ *   - a bare name that exists as a file in cwd (e.g. `--env my.env`) → that file;
+ *   - a bare name like `loft` → `<cwd>/.env.loft`, matching the MCP tool's
+ *     per-call `env` resolution; a `.env`-prefixed basename is used as-is.
+ *
+ * Returns the resolved path; does not check existence (loadEnvFile does).
+ */
+export declare function resolveEnvSelection(raw: string, cwd?: string): string;
 /**
  * Loads ServiceNow credentials for the `dove-sn` CLI and its MCP server.
  *
  * Resolution order for the env file:
- *   1. An explicit `--env <path>` / `--env-file <path>` flag (passed in here).
- *   2. The `DOVETAIL_ENV_FILE` environment variable — lets an MCP host point
- *      `dove-sn mcp` at a specific credential file without a CLI flag.
+ *   1. An explicit `--env <name|path>` / `--env-file <name|path>` flag.
+ *   2. The `DOVETAIL_ENV_FILE` environment variable.
  *   3. The default `.env` in the current working directory.
  *
- * dotenv does not override variables already present in process.env, so an
- * explicit file augments (never clobbers) credentials the parent shell exported.
+ * For an explicit selection (1 or 2) this FAILS CLOSED: a missing file, or a
+ * file that doesn't define an instance plus credentials, throws instead of
+ * silently falling back to whatever instance the surrounding environment
+ * points at. The file's ServiceNow connection variables (SN_CONNECTION_KEYS)
+ * replace any already in process.env; every other variable keeps dotenv's
+ * never-override semantics.
+ *
+ * The default cwd `.env` (3) keeps its historical behavior: optional, and
+ * never overrides already-exported variables.
  *
- * @param {string} [explicitPath] - Path from the `--env` / `--env-file` flag.
+ * @param {string} [explicitSelection] - Value of the `--env` / `--env-file` flag.
+ * @returns {string|undefined} The absolute path of the explicitly selected
+ *   file, or undefined when the default `.env` path was used.
  */
-export declare function loadEnvFile(explicitPath?: string): void;
+export declare function loadEnvFile(explicitSelection?: string): string | undefined;

package/dist/loadEnv.js

@@ -3,30 +3,110 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SN_CONNECTION_KEYS = void 0;
+exports.resolveEnvSelection = resolveEnvSelection;
 exports.loadEnvFile = loadEnvFile;
+const fs_1 = __importDefault(require("fs"));
 const dotenv_1 = __importDefault(require("dotenv"));
 const path_1 = __importDefault(require("path"));
+const createClientFromEnvFile_1 = require("./createClientFromEnvFile");
+/**
+ * ServiceNow connection variables. When an env file is selected explicitly,
+ * these are taken from the file ONLY — any value already in process.env is
+ * cleared first — so the selected file fully determines the target instance
+ * and auth mode. (Without this, a shell/session-exported SN_INSTANCE or
+ * SN_API_KEY silently won over the file and the command hit the wrong
+ * instance.)
+ */
+exports.SN_CONNECTION_KEYS = [
+    "SN_INSTANCE",
+    "SN_DEV_INSTANCE",
+    "SN_PROD_INSTANCE",
+    "SN_API_KEY",
+    "SN_DEV_API_KEY",
+    "SN_PROD_API_KEY",
+    "SN_USER",
+    "SN_PASSWORD",
+    "SN_DEV_USERNAME",
+    "SN_DEV_PASSWORD",
+    "SN_PROD_USERNAME",
+    "SN_PROD_PASSWORD",
+];
+/**
+ * Resolve an `--env` selector to an absolute env-file path.
+ *
+ * Accepts, in order:
+ *   - an absolute path, or any value containing a path separator → used as a path
+ *     (relative paths resolve against cwd) — unchanged legacy behavior;
+ *   - a bare name that exists as a file in cwd (e.g. `--env my.env`) → that file;
+ *   - a bare name like `loft` → `<cwd>/.env.loft`, matching the MCP tool's
+ *     per-call `env` resolution; a `.env`-prefixed basename is used as-is.
+ *
+ * Returns the resolved path; does not check existence (loadEnvFile does).
+ */
+function resolveEnvSelection(raw, cwd) {
+    if (typeof raw !== "string" || raw.trim().length === 0) {
+        throw new Error("--env must be a non-empty env-file name or path.");
+    }
+    var value = raw.trim();
+    var base = cwd || process.cwd();
+    if (path_1.default.isAbsolute(value) || /[\\/]/.test(value)) {
+        return path_1.default.resolve(base, value);
+    }
+    var literal = path_1.default.resolve(base, value);
+    if (fs_1.default.existsSync(literal)) {
+        return literal;
+    }
+    if (value.indexOf(".env") === 0) {
+        return literal;
+    }
+    return path_1.default.resolve(base, ".env." + value);
+}
 /**
  * Loads ServiceNow credentials for the `dove-sn` CLI and its MCP server.
  *
  * Resolution order for the env file:
- *   1. An explicit `--env <path>` / `--env-file <path>` flag (passed in here).
- *   2. The `DOVETAIL_ENV_FILE` environment variable — lets an MCP host point
- *      `dove-sn mcp` at a specific credential file without a CLI flag.
+ *   1. An explicit `--env <name|path>` / `--env-file <name|path>` flag.
+ *   2. The `DOVETAIL_ENV_FILE` environment variable.
  *   3. The default `.env` in the current working directory.
  *
- * dotenv does not override variables already present in process.env, so an
- * explicit file augments (never clobbers) credentials the parent shell exported.
+ * For an explicit selection (1 or 2) this FAILS CLOSED: a missing file, or a
+ * file that doesn't define an instance plus credentials, throws instead of
+ * silently falling back to whatever instance the surrounding environment
+ * points at. The file's ServiceNow connection variables (SN_CONNECTION_KEYS)
+ * replace any already in process.env; every other variable keeps dotenv's
+ * never-override semantics.
+ *
+ * The default cwd `.env` (3) keeps its historical behavior: optional, and
+ * never overrides already-exported variables.
  *
- * @param {string} [explicitPath] - Path from the `--env` / `--env-file` flag.
+ * @param {string} [explicitSelection] - Value of the `--env` / `--env-file` flag.
+ * @returns {string|undefined} The absolute path of the explicitly selected
+ *   file, or undefined when the default `.env` path was used.
  */
-function loadEnvFile(explicitPath) {
-    var raw = explicitPath || process.env.DOVETAIL_ENV_FILE;
-    if (raw) {
-        var resolved = path_1.default.isAbsolute(raw) ? raw : path_1.default.resolve(process.cwd(), raw);
-        dotenv_1.default.config({ path: resolved });
-        return;
+function loadEnvFile(explicitSelection) {
+    var raw = explicitSelection || process.env.DOVETAIL_ENV_FILE;
+    if (!raw) {
+        // No explicit selection — load .env from cwd if it exists (no-op otherwise).
+        dotenv_1.default.config();
+        return undefined;
+    }
+    var resolved = resolveEnvSelection(raw);
+    if (!fs_1.default.existsSync(resolved)) {
+        throw new Error("env file not found: '" + resolved + "' (from --env '" + raw + "'). " +
+            "Refusing to fall back to the default environment — pass an existing env-file " +
+            "name (e.g. 'prod' → .env.prod in the current directory) or path.");
     }
-    // No explicit selection — load .env from cwd if it exists (no-op otherwise).
-    dotenv_1.default.config();
+    // Validates instance + credentials and throws loudly if either is missing.
+    (0, createClientFromEnvFile_1.resolveConfigFromEnvFile)(resolved);
+    var parsed = dotenv_1.default.parse(fs_1.default.readFileSync(resolved, "utf8"));
+    exports.SN_CONNECTION_KEYS.forEach(function (key) {
+        delete process.env[key];
+        if (Object.prototype.hasOwnProperty.call(parsed, key) && parsed[key] !== "") {
+            process.env[key] = parsed[key];
+        }
+    });
+    // Everything else in the file: dotenv's normal never-override semantics.
+    dotenv_1.default.config({ path: resolved });
+    return resolved;
 }

package/dist/mcp/registry.js

@@ -624,18 +624,24 @@ function buildDescriptors(deps = {}) {
         {
             name: "app_publish",
             annotations: dovetail_mcp_kit_1.WRITE_EXECUTE,
-            description: "Publish a scoped ServiceNow application to ONE target per call — the ServiceNow Store " +
-                "(target 'store') or the company Application Repository (target 'repo'); call twice to " +
-                "publish to both — then poll the publish to completion. STORE PUBLISH IS EXTERNALLY " +
-                "VISIBLE on the ServiceNow Store — treat it as a release. DRY-RUN BY DEFAULT: without " +
-                "confirm:true the resolved plan (app, current version, target) is returned and nothing is " +
-                "published. target 'store' replays the sys_app form's upload flow over a form-login session " +
-                "and requires SN_STORE_USERNAME/SN_STORE_PASSWORD in the server's env file — credentials " +
-                "never transit tool arguments. target 'repo' uses the supported CI/CD REST API " +
-                "(/api/sn_cicd/app_repo/publish) and requires the sn_cicd role. app is a scope name, " +
+            description: "Publish a scoped ServiceNow application to ONE target per call, then poll the publish to " +
+                "completion; call repeatedly to hit several targets. STORE PUBLISH IS EXTERNALLY VISIBLE " +
+                "on the ServiceNow Store — treat it as a release. DRY-RUN BY DEFAULT: without confirm:true " +
+                "the resolved plan (app, current version, target) is returned and nothing is published. " +
+                "Targets: 'store' replays the sys_app form's upload flow over a form-login session and " +
+                "requires SN_STORE_USERNAME/SN_STORE_PASSWORD in the server's env file — credentials never " +
+                "transit tool arguments. 'repo' publishes to the company Application Repository via the " +
+                "supported CI/CD REST API (/api/sn_cicd/app_repo/publish) and requires the sn_cicd plugin " +
+                "and role. 'repo-ui' reaches the SAME company repository over the UI uploader instead — use " +
+                "it on instances without sn_cicd, where 'repo' 404s. 'update-set' publishes the app INTO a " +
+                "newly created update set via the two-call AppsAjaxProcessor flow (no REST equivalent " +
+                "exists); updateSetName defaults to the app's name and updateSetDescription is conventionally " +
+                "the release date stamp (YYYYMMDD) so a whole release is one sys_update_set query. " +
+                "includeData (default false) is the dialog's 'Include demo data' box. app is a scope name, " +
                 "sys_app sys_id, or app name; version must be above the currently published version. The " +
                 "result carries the progress-tracker id, per-step states, the Store appLink, and the " +
-                "publish's update-set sys_id where the instance reports one.",
+                "update-set sys_id (for 'update-set' this is set as soon as the set is created, so it " +
+                "survives a later failure).",
             shape: schemas_1.publishAppSchema.shape,
             handler: async function (args) {
                 var p = schemas_1.publishAppSchema.parse(args);
@@ -644,6 +650,9 @@ function buildDescriptors(deps = {}) {
                     version: p.version,
                     target: p.target,
                     devNotes: p.devNotes,
+                    updateSetName: p.updateSetName,
+                    updateSetDescription: p.updateSetDescription,
+                    includeData: p.includeData,
                     confirm: p.confirm,
                     dryRun: p.dryRun,
                     timeoutMs: p.timeoutMs,

package/dist/mcp/schemas.d.ts

@@ -1099,26 +1099,35 @@ export declare var publishAppSchema: z.ZodObject<{
     app: z.ZodString;
     version: z.ZodString;
     devNotes: z.ZodOptional<z.ZodString>;
-    target: z.ZodUnion<[z.ZodLiteral<"store">, z.ZodLiteral<"repo">]>;
+    target: z.ZodUnion<[z.ZodLiteral<"store">, z.ZodLiteral<"repo">, z.ZodLiteral<"repo-ui">, z.ZodLiteral<"update-set">]>;
+    updateSetName: z.ZodOptional<z.ZodString>;
+    updateSetDescription: z.ZodOptional<z.ZodString>;
+    includeData: z.ZodOptional<z.ZodBoolean>;
     confirm: z.ZodOptional<z.ZodBoolean>;
     dryRun: z.ZodOptional<z.ZodBoolean>;
     timeoutMs: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
-    target: "store" | "repo";
+    target: "store" | "repo" | "repo-ui" | "update-set";
     version: string;
     app: string;
     confirm?: boolean | undefined;
     dryRun?: boolean | undefined;
+    includeData?: boolean | undefined;
     timeoutMs?: number | undefined;
     devNotes?: string | undefined;
+    updateSetName?: string | undefined;
+    updateSetDescription?: string | undefined;
 }, {
-    target: "store" | "repo";
+    target: "store" | "repo" | "repo-ui" | "update-set";
     version: string;
     app: string;
     confirm?: boolean | undefined;
     dryRun?: boolean | undefined;
+    includeData?: boolean | undefined;
     timeoutMs?: number | undefined;
     devNotes?: string | undefined;
+    updateSetName?: string | undefined;
+    updateSetDescription?: string | undefined;
 }>;
 export declare var invokeRestSchema: z.ZodObject<{
     method: z.ZodEffects<z.ZodEnum<["GET", "POST", "PUT", "DELETE"]>, "GET" | "DELETE" | "POST" | "PUT", unknown>;

package/dist/mcp/schemas.js

@@ -339,7 +339,15 @@ exports.publishAppSchema = zod_1.z.object({
     app: zod_1.z.string().min(1),
     version: zod_1.z.string().min(1),
     devNotes: zod_1.z.string().optional(),
-    target: zod_1.z.union([zod_1.z.literal("store"), zod_1.z.literal("repo")]),
+    target: zod_1.z.union([
+        zod_1.z.literal("store"),
+        zod_1.z.literal("repo"),
+        zod_1.z.literal("repo-ui"),
+        zod_1.z.literal("update-set"),
+    ]),
+    updateSetName: zod_1.z.string().optional(),
+    updateSetDescription: zod_1.z.string().optional(),
+    includeData: zod_1.z.boolean().optional(),
     confirm: zod_1.z.boolean().optional(),
     dryRun: zod_1.z.boolean().optional(),
     timeoutMs: zod_1.z.number().int().positive().optional(),