@tenonhq/dovetail-servicenow 0.0.39 → 0.0.41

package/README.md

@@ -55,6 +55,33 @@ Reads ServiceNow credentials from env vars in this order of precedence:
 | User     | `SN_USER`       | `SN_DEV_USERNAME`   | `SN_PROD_USERNAME`   |
 | Password | `SN_PASSWORD`   | `SN_DEV_PASSWORD`   | `SN_PROD_PASSWORD`   |
 
+### Flow Designer identity (`SN_FLOW_*`)
+
+`/api/now/processflow/*` — every Flow Designer authoring call (view/edit/clone/
+publish an action, create/copy/publish a flow) — **cannot carry a REST API access
+policy** on ServiceNow, so under API-key auth (`SN_API_KEY`) those calls 401. They
+authenticate instead with a dedicated basic-auth identity used **only** for
+processflow paths; every other path keeps the main identity:
+
+| Field    | Preferred          | Dev fallback           | Prod fallback           |
+|----------|--------------------|------------------------|-------------------------|
+| User     | `SN_FLOW_USER`     | `SN_DEV_FLOW_USER`     | `SN_PROD_FLOW_USER`     |
+| Password | `SN_FLOW_PASSWORD` | `SN_DEV_FLOW_PASSWORD` | `SN_PROD_FLOW_PASSWORD` |
+
+- **Key mode + flow identity** → processflow requests go out as basic auth with the
+  flow identity and **no** `x-sn-apikey` header; table/Dovetail requests keep the key.
+- **Basic mode, no flow identity** → unchanged: processflow uses the main `SN_USER`.
+- **Key mode, no flow identity** → a processflow call **throws before sending**, naming
+  `SN_FLOW_USER` / `SN_FLOW_PASSWORD` (it would only 401). A half-set pair also throws.
+- Programmatic: `createClient({ apiKey, flowUser, flowPassword })` — explicit config beats
+  env. A config that pins the main identity (apiKey or user/password — e.g. one resolved
+  from an `--env` file) takes the flow identity from the config only, never from
+  `process.env`, so a per-call retarget can't borrow another instance's flow creds.
+- `--env <file>` fully determines both identities: the `SN_FLOW_*` / `SN_DEV_FLOW_*` /
+  `SN_PROD_FLOW_*` keys are connection keys, replaced (or cleared) from the file.
+
+The flow password is never logged; errors name the variables, never their values.
+
 The dev/prod fallbacks match the names documented in the committed
 `Craftsman/.env.example`, so existing developer setups work out of the box.
 Bare instance names (e.g. `TenonWorkStudio`) get `.service-now.com` appended
@@ -266,8 +293,67 @@ npx dove-sn edit-action --sys-id <id> --scope <scope> --set-script ./script.js \
 npx dove-sn edit-action --sys-id <id> --scope <scope> --from-json ops.json             # dry-run
 npx dove-sn edit-action --sys-id <id> --scope <scope> --from-json ops.json \
   --apply --update-set <id>                                                            # publish + verify
+
+# Clone a Custom Action Type (every step + its step IO) into a scope and publish it
+npx dove-sn clone-action --from <source_sys_id> --name "Send REST (Spoke)" \
+  --scope x_cadso_email_spok --ops ops.json                                            # dry-run (plan)
+npx dove-sn clone-action --from <source_sys_id> --name "Send REST (Spoke)" \
+  --scope x_cadso_email_spok --ops ops.json --update-set <id> --confirm                # write + publish + verify
 ```
 
+### Cloning an action type (`clone-action` / `action_clone`)
+
+`clone-action` copies a Custom Action Type headlessly — **multi-step capable** — and
+publishes the copy:
+
+1. **Reads** (Table API only — `sn_build_agent` is never used) the parent
+   `sys_hub_action_type_definition`, its `sys_hub_action_input` / `sys_hub_action_output`
+   (`model_id` → parent), every `sys_hub_step_instance` (**`action`** → parent), and each
+   step's `sys_hub_step_ext_input` / `sys_hub_step_ext_output` (`model_id` → step).
+2. **Plans** fresh sys_ids for every record (old→new step map), the target scope,
+   `name` = `--name`, `internal_name` = `--internal-name` or the slug of the name
+   (lowercase, non-alphanumerics → `_`), `state = draft`, and strips system/snapshot
+   fields (`master_snapshot`, `latest_snapshot`, `sys_update_name`, audit fields, …).
+3. **Writes** the graph through Dovetail `createRecord`, pinned to `--update-set`, scope
+   set per record.
+4. **Publishes**: the SOURCE action's steps are fetched from
+   `/processflow/action/action_types/{source}/step_instances`, each step's `action` and
+   `sys_id` remapped onto the clone, `--ops` applied, then grafted onto the clone's model
+   and POSTed to `/snapshot` — no steps fixture needed.
+5. **Verifies** by reading the clone's steps back (script hash + step IO per step, plus
+   the step count). A mismatch exits `1`.
+
+`--scope` takes a scope **name** (resolved via `sys_scope`) or a 32-hex sys_id. The
+clone is **idempotent** on `(name, scope)`: an existing match returns `unchanged` and
+writes nothing. **Dry-run by default** — without `--confirm` it prints the plan (records
+per table, step summary, the effect of every op) and writes nothing; `--update-set` is
+required with `--confirm`. Exit `0` on success (incl. dry-run / unchanged), `1` on error.
+
+`--ops` takes the same step ops as `edit-action --from-json`, plus **`setStepInputs`** —
+set an **existing** step input's value (and its `display_value` when present), e.g. a
+REST step's HTTP method. An unknown input fails with the list of inputs on that step:
+
+```json
+{
+  "setStepInputs": [
+    { "step": "REST Step", "input": "http_method", "value": "post" }
+  ],
+  "patchStepScripts": [
+    { "step": "Parse Response", "patchScript": { "find": "v1", "replace": "v2" } }
+  ],
+  "addStepOutputs": [{ "step": "Parse Response", "name": "isRetryable", "type": "boolean" }],
+  "addStepInputs": [
+    { "step": "Handle Error", "name": "isRetryable", "type": "boolean",
+      "pillFrom": { "step": "Parse Response", "output": "isRetryable" } }
+  ]
+}
+```
+
+The MCP tool **`action_clone`** takes the same inputs — `from`, `name`, `scope`,
+`internalName`, `description`, `updateSetSysId`, `ops` (inline object), `confirm`,
+`dryRun` — with the same dry-run-unless-`confirm:true` gate. `setStepInputs` is also
+accepted by `edit-action` / `action_edit`.
+
 ### Editing an action type's steps (`--from-json`)
 
 The flag form above patches the one auto-detected script. When you need to touch
@@ -516,11 +602,11 @@ Programmatic: `invokeRest({ method, path, body, confirm })` is exported, and the
 client gained `now.put` / `now.delete` / `now.invoke` (the latter returns
 `{ status, body }` verbatim) alongside the existing `now.get` / `now.post`.
 
-### Publish an app to the Store / application repository
+### Publish an app to the Store / application repository / an update set
 
 Publish a scoped application to the **ServiceNow Store**, the **company
-application repository**, or both — headlessly, with the publish's progress
-tracker polled to completion.
+application repository**, and/or **into a new update set** — headlessly, with
+each publish's progress tracker polled to completion.
 
 ```bash
 # Dry-run — the DEFAULT: resolves the app, prints the plan, publishes NOTHING
@@ -529,15 +615,21 @@ npx dove-sn publish-app --app x_cadso_filter --version 6.0.20260716 --target bot
 # Publish for real (store, then repo, same version)
 npx dove-sn publish-app --app x_cadso_filter --version 6.0.20260716 \
   --target both --dev-notes "July release" --confirm --json
+
+# Release flow on an instance WITHOUT the sn_cicd plugin: publish to the company
+# repository over the UI uploader, then capture the app into a dated update set.
+npx dove-sn publish-app --app x_cadso_filter --version 6.0.20260729 \
+  --target repo-ui,update-set --update-set-description 20260729 --confirm --json
 ```
 
 **Store publish is EXTERNALLY VISIBLE on the ServiceNow Store — treat
 `--target store --confirm` as a release.** `publish-app` is dry-run by default:
 without `--confirm` it prints the resolved plan and exits `1` (a deliberate
-refusal). `--target both` runs store then repo sequentially and short-circuits
-if the store leg fails.
+refusal). `--target` takes one target, a comma-separated list, or `both` (an
+alias for `store,repo`); targets run **in the order given** and short-circuit on
+the first failure.
 
-The two targets ride different transports:
+The targets ride different transports:
 
 - **store** replays the `sys_app` form's upload flow (`xmlhttp.do` +
   `sn_appauthor.ScopedAppUploaderAJAX`) over a form-login session — basic auth
@@ -547,13 +639,33 @@ The two targets ride different transports:
 - **repo** uses the supported CI/CD REST API (`POST /api/sn_cicd/app_repo/publish`
   + `GET /api/sn_cicd/progress/{id}`) over basic auth. The API user needs the
   `sn_cicd` role (or admin).
+- **repo-ui** reaches the *same* company repository as `repo`, but over the UI
+  uploader (`sysparm_publish_to_store=false`) instead of REST. Use it when the
+  instance has no CI/CD plugin — `tenonworkshop`, for instance, has no `sn_cicd`
+  scope and no `app_repo` service, so `repo` 404s there while `repo-ui` works.
+  It needs no Store credentials.
+- **update-set** publishes the app *into a newly created update set* via the
+  two-call `com.snc.apps.AppsAjaxProcessor` flow (`createUpdateSet` →
+  `publishToUpdateSet`). There is no REST equivalent. `--update-set-name`
+  defaults to the app's name (the dialog's field is readonly, so that is what
+  the UI submits); `--update-set-description` is conventionally the release date
+  stamp `YYYYMMDD`, which makes a whole release one query
+  (`sys_update_set` where `description=20260729`). `--include-data` maps to the
+  dialog's "Include demo data" box and defaults **off**, matching the value the
+  UI actually puts on the wire.
+
+Ordering matters when you combine them: the repo publish is what bumps
+`sys_app.version`, so put it **before** `update-set` if you want the set
+captured at the new version.
 
 `--app` accepts a scope name, `sys_app` sys_id, or app name; `--version` must be
 above the currently published version. The result carries the progress-tracker
 id, per-step states ("Packaging application", "Uploading application"), the
-Store `appLink`, and the publish's update-set sys_id where the instance reports
-one. Exit codes: `0` published or dry-run, `1` bad args/unconfirmed, `2`
-failed/timeout. Programmatic: `publishApp({ app, version, target, confirm })`.
+Store `appLink`, and the update-set sys_id — for the `update-set` target that is
+recorded as soon as the set is created, so it survives a later failure and you
+can always find (or delete) the set. Exit codes: `0` published or dry-run, `1`
+bad args/unconfirmed, `2` failed/timeout. Programmatic:
+`publishApp({ app, version, target, confirm })`.
 
 ### Export an update set (or a whole app) to importable XML
 
@@ -699,7 +811,9 @@ and read-back-verified — `host_assets` (deploy a built dist/), plus the Flow D
 tools `flow_view` (read a flow/subflow's step graph), `action_view` (read an action
 type's model), `action_edit` (structurally edit a published action type — per-step
 scripts, step-level inputs/outputs, data-pill wiring — dry-run by default, and the
-publish is read back and verified), `flow_publish` (compile a flow/subflow snapshot), `flow_copy`
+publish is read back and verified), `action_clone` (clone an action type — every step
+and its step IO — into a scope and publish + verify it; dry-run by default),
+`flow_publish` (compile a flow/subflow snapshot), `flow_copy`
 (copy a flow as an inactive draft), `flow_create` (create a NEW flow from scratch +
 publish, grafting a template), `flow_test` (validate or run a flow), and
 `flow_edit` (patch a flow), plus `invoke_rest` (invoke an arbitrary authenticated

package/dist/cli.js

@@ -83,6 +83,7 @@ const copyFlow_1 = require("./flowDesigner/copyFlow");
 const createFlow_1 = require("./flowDesigner/createFlow");
 const editFlow_1 = require("./flowDesigner/editFlow");
 const editActionType_1 = require("./flowDesigner/editActionType");
+const cloneActionType_1 = require("./flowDesigner/cloneActionType");
 const testFlow_1 = require("./flowDesigner/testFlow");
 const table_1 = require("./table");
 const setField_1 = require("./setField");
@@ -929,6 +930,170 @@ async function runEditAction(flags) {
     }
     return 0;
 }
+/**
+ * dove-sn clone-action:
+ *   --from <sys_id>            Required. Source sys_hub_action_type_definition sys_id.
+ *   --name <name>              Required. Display name of the clone (idempotency key with --scope).
+ *   --scope <name|sys_id>      Required. Target scope — a scope name (x_cadso_email_spok) or 32-hex sys_id.
+ *   --internal-name <name>     Optional. Default: slug of --name.
+ *   --description <text>       Optional.
+ *   --ops <path>               Optional. JSON StepOps applied to the cloned steps before publish:
+ *                              patchStepScripts / setStepInputs / addStepOutputs / addStepInputs.
+ *   --update-set <sys_id>      Required with --confirm. Every write + the publish land here.
+ *   --confirm                  Execute (write the graph, publish, verify). WITHOUT it: dry-run.
+ *   --dry-run                  Force a dry-run even with --confirm.
+ *   --json                     Emit the structured CloneActionTypeResult.
+ *
+ * Clones a Custom Action Type — parent, inputs, outputs, every step instance and
+ * its step-level ext inputs/outputs — into the target scope, then publishes it
+ * headlessly through the snapshot path (multi-step capable) and reads the steps
+ * back to verify. Idempotent on (name, scope). DRY-RUN BY DEFAULT.
+ *
+ * --ops shape:
+ *   {
+ *     "setStepInputs":    [{ "step": "REST Step", "input": "http_method", "value": "post" }],
+ *     "patchStepScripts": [{ "step": "Parse", "patchScript": { "find": "a", "replace": "b" } }],
+ *     "addStepOutputs":   [{ "step": "Parse", "name": "isRetryable", "type": "boolean" }],
+ *     "addStepInputs":    [{ "step": "Handle", "name": "isRetryable", "type": "boolean",
+ *                            "pillFrom": { "step": "Parse", "output": "isRetryable" } }]
+ *   }
+ * `step` is a step cid or label; `scriptFile` (resolved relative to the ops file)
+ * is sugar for `setScript` in patchStepScripts.
+ */
+var CLONE_OPS_KEYS = ["patchStepScripts", "setStepInputs", "addStepOutputs", "addStepInputs"];
+async function runCloneAction(flags, bare) {
+    var bareErr = bareStringFlagError("clone-action", bare, [
+        "from",
+        "name",
+        "scope",
+        "internal-name",
+        "description",
+        "ops",
+        "update-set",
+    ]);
+    if (bareErr) {
+        process.stderr.write(bareErr);
+        return 1;
+    }
+    var from = flags.from;
+    var name = flags.name;
+    var scope = flags.scope;
+    if (!from || !name || !scope) {
+        process.stderr.write("clone-action: --from <sys_id>, --name <name> and --scope <scope name|sys_id> are required\n");
+        return 1;
+    }
+    var confirm = flags.confirm === "true";
+    var dryRun = flags["dry-run"] === "true";
+    var updateSet = flags["update-set"] || flags.updateSetSysId;
+    if (confirm && !dryRun && !updateSet) {
+        process.stderr.write("clone-action: --update-set <sys_id> is required with --confirm\n");
+        return 1;
+    }
+    var stepOps;
+    if (flags.ops) {
+        var parsedOps = JSON.parse(fs.readFileSync(flags.ops, "utf8"));
+        if (!parsedOps || typeof parsedOps !== "object" || Array.isArray(parsedOps)) {
+            process.stderr.write("clone-action: --ops must contain a StepOps object\n");
+            return 1;
+        }
+        var opsObj = parsedOps;
+        var opsKeys = Object.keys(opsObj);
+        for (var k = 0; k < opsKeys.length; k += 1) {
+            if (CLONE_OPS_KEYS.indexOf(opsKeys[k]) === -1) {
+                process.stderr.write("clone-action: unknown --ops key '" +
+                    opsKeys[k] +
+                    "' (allowed: " +
+                    CLONE_OPS_KEYS.join(", ") +
+                    ")\n");
+                return 1;
+            }
+        }
+        resolveScriptFiles(opsObj, flags.ops);
+        stepOps = opsObj;
+    }
+    var result = await (0, cloneActionType_1.cloneActionType)({
+        client: (0, client_1.createClient)({}),
+        sourceSysId: from,
+        newName: name,
+        internalName: flags["internal-name"],
+        newScope: scope,
+        updateSetSysId: updateSet,
+        description: flags.description,
+        stepOps: stepOps,
+        confirm: confirm,
+        dryRun: dryRun,
+    });
+    if (flags.json === "true") {
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        return result.verify && !result.verify.ok ? 1 : 0;
+    }
+    process.stdout.write("[" + result.action + "] " + name + " (" + result.internalName + ") -> " + result.sysId + "\n");
+    if (result.action === "unchanged") {
+        process.stdout.write("  an action with this name already exists in the target scope — nothing written\n");
+        return 0;
+    }
+    if (result.plan) {
+        process.stdout.write("  scope: " +
+            result.plan.scope.name +
+            " (" +
+            result.plan.scope.sysId +
+            ")  source scope: " +
+            result.plan.sourceScopeSysId +
+            "\n  records: " +
+            result.plan.total +
+            "\n");
+        var tables = Object.keys(result.plan.counts);
+        for (var t = 0; t < tables.length; t += 1) {
+            process.stdout.write("    " + tables[t] + ": " + result.plan.counts[tables[t]] + "\n");
+        }
+    }
+    if (result.steps) {
+        process.stdout.write("\n--- steps (as published) ---\n");
+        for (var si = 0; si < result.steps.after.length; si += 1) {
+            var step = result.steps.after[si];
+            process.stdout.write("  " +
+                step.label +
+                " (" +
+                step.cid +
+                ")" +
+                (step.scriptChars !== null ? " script " + step.scriptChars + " chars" : "") +
+                (step.extendedInputs.length ? " in:" + step.extendedInputs.length : "") +
+                (step.extendedOutputs.length ? " out:" + step.extendedOutputs.length : "") +
+                "\n");
+        }
+        for (var ci = 0; ci < result.steps.changes.length; ci += 1) {
+            process.stdout.write("  + " + result.steps.changes[ci] + "\n");
+        }
+        for (var wi = 0; wi < result.steps.warnings.length; wi += 1) {
+            process.stdout.write("  ! " + result.steps.warnings[wi] + "\n");
+        }
+    }
+    if (result.action === "planned") {
+        process.stdout.write("\nDRY RUN — nothing written. Re-run with --confirm --update-set <sys_id> to clone + publish.\n");
+        return 0;
+    }
+    process.stdout.write("\nwritten: " +
+        result.written.length +
+        " record(s)" +
+        (result.publish
+            ? "; published (HTTP " +
+                result.publish.httpStatus +
+                (result.publish.snapshotSysId ? ", snapshot " + result.publish.snapshotSysId : "") +
+                ")"
+            : "") +
+        "\n");
+    if (result.verify) {
+        process.stdout.write("\n--- verify (read back from the instance) ---\n");
+        process.stdout.write("  " + (result.verify.ok ? "OK" : "FAILED") + "\n");
+        for (var vi = 0; vi < result.verify.notes.length; vi += 1) {
+            process.stdout.write("  " + (result.verify.ok ? "+ " : "! ") + result.verify.notes[vi] + "\n");
+        }
+        if (!result.verify.ok) {
+            return 1;
+        }
+    }
+    return 0;
+}
 async function runMcp(flags) {
     if (flags.smoke === "true") {
         await (0, server_1.runSmoke)();
@@ -1041,17 +1206,29 @@ function printHelp() {
         "                                              (per-step scripts + step IO + data-pill wiring)\n" +
         '                      | --patch-script "<find>::<replace>" | --set-script <path> | --merge-outputs <path>\n' +
         "                      [--script-input <name>] [--update-set <sys_id>] [--apply] [--json])\n" +
+        "  clone-action       Clone a Custom Action Type (all steps + step IO) into a scope and publish it\n" +
+        "                     DRY-RUN BY DEFAULT — nothing is written without --confirm\n" +
+        "                     (--from <sys_id> --name <n> --scope <scope name|sys_id>\n" +
+        "                      [--internal-name <n>] [--description <d>]\n" +
+        "                      [--ops <ops.json>]  ops: setStepInputs / patchStepScripts /\n" +
+        "                                          addStepOutputs / addStepInputs\n" +
+        "                      [--update-set <sys_id> (required with --confirm)] [--confirm] [--dry-run] [--json])\n" +
+        "                     Idempotent on (name, scope). Publishes via the snapshot path and\n" +
+        "                     reads the steps back to verify.\n" +
         "  edit-flow          Patch a flow/subflow (rename, description, step inputs)\n" +
         "                     (--sys-id <sys_id> --from-json <ops.json> [--apply] [--update-set <sys_id>] [--scope <sys_id>] [--json])\n" +
-        "  publish-app        Publish a scoped app to the ServiceNow Store and/or the company\n" +
-        "                     application repository, then poll the publish to completion.\n" +
+        "  publish-app        Publish a scoped app to the ServiceNow Store, the company application\n" +
+        "                     repository, and/or a new update set, then poll each to completion.\n" +
         "                     STORE PUBLISH IS EXTERNALLY VISIBLE on the ServiceNow Store.\n" +
         "                     DRY-RUN BY DEFAULT — nothing is published without --confirm\n" +
-        "                     (--app <scope|sys_id|name> --version <v> --target store|repo|both\n" +
+        "                     (--app <scope|sys_id|name> --version <v>\n" +
+        "                      --target store|repo|repo-ui|update-set|both (comma-separated ok)\n" +
         "                      [--dev-notes <text>] [--store-user <email>] [--timeout-ms <n>]\n" +
-        "                      [--dry-run] [--json] [--confirm])\n" +
+        "                      [--update-set-name <name>] [--update-set-description <text>]\n" +
+        "                      [--include-data] [--dry-run] [--json] [--confirm])\n" +
         "                     Store creds: SN_STORE_USERNAME/SN_STORE_PASSWORD in the --env file;\n" +
-        "                     the password is never a flag. Repo publish needs the sn_cicd role.\n" +
+        "                     the password is never a flag. 'repo' needs the sn_cicd plugin+role;\n" +
+        "                     'repo-ui' reaches the same repository over the UI uploader instead.\n" +
         "  export-update-set  Export an update set to importable <unload> XML, with secret\n" +
         "                     values replaced by __SET_DURING_INSTALL__ (no opt-out).\n" +
         "                     assemble mode is READ-ONLY; complete mode marks the set\n" +
@@ -1074,7 +1251,10 @@ function printHelp() {
         "                     or the DOVETAIL_ENV_FILE env var). A bare name like 'prod'\n" +
         "                     resolves to .env.prod in the cwd. The file's SN_* connection\n" +
         "                     vars replace any already exported; a missing or incomplete\n" +
-        "                     file is an error (no fallback). Default: .env in the cwd.\n");
+        "                     file is an error (no fallback). Default: .env in the cwd.\n" +
+        "  Flow Designer auth /api/now/processflow/* can't carry an API access policy, so\n" +
+        "                     under SN_API_KEY those calls use a dedicated basic-auth identity:\n" +
+        "                     SN_FLOW_USER / SN_FLOW_PASSWORD (or SN_DEV_FLOW_* / SN_PROD_FLOW_*).\n");
 }
 /** Parse inline `--columns "Label:type:max, Other:choice, ..."` into ColumnSpec[]. */
 function parseColumnsInline(input) {
@@ -1833,8 +2013,19 @@ async function runInvokeRest(flags) {
  * dove-sn publish-app:
  *   --app <scope|sys_id|name>   Required. The sys_app to publish.
  *   --version <v>               Required. Version to publish (e.g. 6.0.20260716).
- *   --target store|repo|both    Required. STORE PUBLISH IS EXTERNALLY VISIBLE.
- *   [--dev-notes <text>]        Optional developer notes.
+ *   --target <t[,t...]>         Required. store | repo | repo-ui | update-set |
+ *                               both (= store,repo). STORE IS EXTERNALLY VISIBLE.
+ *                               repo   = CI/CD REST API (needs the sn_cicd plugin)
+ *                               repo-ui= same destination over the UI uploader,
+ *                                        for instances without sn_cicd
+ *                               update-set = publish the app INTO a new update set
+ *   [--dev-notes <text>]        Optional developer notes (uploader targets).
+ *   [--update-set-name <name>]  update-set only. Defaults to the app's name.
+ *   [--update-set-description <text>]
+ *                               update-set only. Tenon convention is the release
+ *                               date stamp (YYYYMMDD) so a release is one query.
+ *   [--include-data]            update-set only. Include demo data (default off,
+ *                               matching the observed wire value).
  *   [--store-user <email>]      Store account email (else SN_STORE_USERNAME).
  *                               The password comes ONLY from SN_STORE_PASSWORD —
  *                               there is no flag for it, ever.
@@ -1842,9 +2033,9 @@ async function runInvokeRest(flags) {
  *   [--dry-run] [--json] [--confirm]
  *
  * DRY-RUN unless --confirm: without it the resolved plan is printed and the
- * command exits 1 (a deliberate refusal, not success). --target both publishes
- * store then repo sequentially with the same version and short-circuits if the
- * store leg fails; --json emits an array of per-target results.
+ * command exits 1 (a deliberate refusal, not success). Multiple targets run
+ * sequentially with the same version and short-circuit on the first failure;
+ * --json emits an array of per-target results.
  * Exit codes: 0 published/dry-run, 1 bad args/unconfirmed, 2 failed/timeout.
  */
 async function runPublishApp(flags) {
@@ -1852,16 +2043,17 @@ async function runPublishApp(flags) {
     var version = flags.version;
     var target = flags.target;
     if (!app || !version || !target) {
-        process.stderr.write("publish-app: --app, --version and --target store|repo|both are required\n");
+        process.stderr.write("publish-app: --app, --version and --target <" +
+            publishApp_1.PUBLISH_TARGETS.join("|") +
+            "|both> are required\n");
         return 1;
     }
-    if (target !== "store" && target !== "repo" && target !== "both") {
-        process.stderr.write("publish-app: --target must be store, repo or both (got '" +
-            target +
-            "')\n");
+    var parsedTargets = (0, publishApp_1.parsePublishTargets)(target);
+    if (parsedTargets.error) {
+        process.stderr.write("publish-app: " + parsedTargets.error + "\n");
         return 1;
     }
-    var targets = target === "both" ? ["store", "repo"] : [target];
+    var targets = parsedTargets.targets;
     var dryRun = flags["dry-run"] === "true";
     var confirmed = flags.confirm === "true";
     var client = (0, client_1.createClient)({});
@@ -1880,6 +2072,16 @@ async function runPublishApp(flags) {
             params.devNotes = flags["dev-notes"];
         if (flags["store-user"])
             params.storeUsername = flags["store-user"];
+        if (flags["update-set-name"]) {
+            params.updateSetName = flags["update-set-name"];
+        }
+        // Read with !== undefined, not truthiness: an intentionally empty
+        // description must stay empty rather than silently fall back.
+        if (flags["update-set-description"] !== undefined) {
+            params.updateSetDescription = flags["update-set-description"];
+        }
+        if (flags["include-data"] === "true")
+            params.includeData = true;
         if (flags["timeout-ms"]) {
             // A NaN timeout would make the poll-loop budget check always false —
             // an infinite loop. Validate here, exit 1 on garbage.
@@ -2219,6 +2421,9 @@ async function main() {
     if (parsed.command === "edit-action") {
         return await runEditAction(parsed.flags);
     }
+    if (parsed.command === "clone-action") {
+        return await runCloneAction(parsed.flags, parsed.bare);
+    }
     if (parsed.command === "create-view") {
         await runCreateView(parsed.flags);
         return 0;

package/dist/client.d.ts

@@ -29,6 +29,33 @@ export type ResolvedAuth = {
     user: string;
     password: string;
 };
+/** Path prefix of the Flow Designer authoring API — the only paths the flow identity is used for. */
+export declare var PROCESSFLOW_PATH_PREFIX: string;
+/**
+ * Resolved Flow Designer (processflow) identity:
+ *   - "basic"   — a complete SN_FLOW_USER / SN_FLOW_PASSWORD pair;
+ *   - "partial" — only one half was set (reported, never sent);
+ *   - "none"    — no flow identity configured.
+ */
+export type ResolvedFlowAuth = {
+    mode: "basic";
+    user: string;
+    password: string;
+} | {
+    mode: "partial";
+    missing: string;
+} | {
+    mode: "none";
+};
+/**
+ * Explicit config beats env. When the config pins the MAIN identity (apiKey or
+ * user/password — e.g. a config resolved from an --env file), the flow identity
+ * is taken from the config ONLY, so a per-call retarget can never borrow the
+ * process's flow credentials for a different instance.
+ */
+export declare function resolveFlowAuth(cfg: ServiceNowClientConfig): ResolvedFlowAuth;
+/** True when an instance-relative request URL targets the processflow API. */
+export declare function isProcessflowPath(url: unknown): boolean;
 export interface TableQueryOptions {
     limit?: number;
     fields?: string[];
@@ -137,7 +164,9 @@ export interface ServiceNowClient {
     now: {
         /**
          * GET an arbitrary native ServiceNow REST path (e.g. /api/now/processflow/...).
-         * Basic auth, same credentials/retry/throttle as the rest of the client.
+         * Same credentials/retry/throttle as the rest of the client, except that
+         * /api/now/processflow/* paths authenticate with the dedicated Flow Designer
+         * identity (SN_FLOW_USER / SN_FLOW_PASSWORD) when one is configured.
          * Use for endpoints that aren't the Table API or the Dovetail Scripted REST API
          * — currently the Flow Designer processflow endpoints. Returns the raw response body.
          */