@tenonhq/dovetail-servicenow 0.0.48 → 0.0.49

package/README.md

@@ -1151,7 +1151,11 @@ console.log(formatLayoutResult("form layout", result));
 `dove-sn mcp` runs a self-contained MCP stdio server exposing the tools to
 Claude Code and agents: `create_view`, `set_list_layout`, `set_form_layout`,
 `set_related_lists`, `add_choices_to_field`, the schema verbs `create_table` /
-`add_column` / `add_index` (a single-column unique index via `sys_dictionary.unique`,
+`add_column` (same-scope by default; `crossScope: true` with `scope` adds a column OWNED
+by another app — a Journey field on an Automate table, element `<scope>_<name>` —
+guarded by `sys_db_object.alter_access` and the update set's scope, with the stored
+element and `sys_scope` read back; the CLI flag is `--cross-scope`) /
+`add_index` (a single-column unique index via `sys_dictionary.unique`,
 read back from the `v_db_index` view - uniqueness enforcement is always reported
 unverified) / `index_list` (read-only: a table's database indexes from `v_db_index`,
 the only index read surface - `sys_index` is API-level-ACL 403 and `sys_index_column`

package/dist/cli.js

@@ -1345,9 +1345,10 @@ async function runCreateTable(flags) {
  *   --table x_cadso_journey --label URL --type url
  *   [--name url] [--max-length 1024] [--reference <table>]
  *   [--mandatory] [--default <value>] [--dependent-on-field <element>]
- *   [--scope x_cadso_journey] [--update-set <sys_id>]
+ *   [--scope x_cadso_journey] [--cross-scope] [--update-set <sys_id>]
  *   [--from-json <spec.json>] [--dry-run] [--debug] [--json]
- * --update-set is required unless --dry-run.
+ * --update-set is required unless --dry-run. --cross-scope opts in to a column
+ * OWNED by --scope when that differs from the table's scope.
  */
 async function runAddColumn(flags) {
     var spec = {};
@@ -1384,6 +1385,9 @@ async function runAddColumn(flags) {
     var scope = flags.scope || spec.scope;
     if (scope)
         params.scope = scope;
+    if (flags["cross-scope"] === "true" || spec.crossScope === true) {
+        params.crossScope = true;
+    }
     var us = flags["update-set"] || spec.updateSetSysId;
     if (us)
         params.updateSetSysId = us;

package/dist/cliUsage.js

@@ -200,7 +200,15 @@ exports.VERB_USAGE = {
                 value: "<element>",
                 note: "Sibling column a document_id resolves against (its table_name column); must already exist.",
             },
-            { flag: "scope", value: "<x_scope>", note: "Owning app scope when it cannot be inferred from the table." },
+            {
+                flag: "scope",
+                value: "<x_scope>",
+                note: "Owning app scope. Must match the table's scope unless --cross-scope is passed.",
+            },
+            {
+                flag: "cross-scope",
+                note: "Opt in to a column OWNED by --scope, which differs from the table's scope (element becomes <scope>_<name>; the table must allow new fields; --update-set must be in --scope).",
+            },
             { flag: "update-set", value: "<sys_id>", note: "REQUIRED on the live path (only --dry-run works without one)." },
             DRY_RUN_FLAG,
             DEBUG_FLAG,
@@ -209,7 +217,10 @@ exports.VERB_USAGE = {
         gate: "dry-run-flag",
         gateNote: "--update-set is required unless --dry-run.",
         example: "dove-sn add-column --table x_cadso_journey --label URL --type url --max-length 1024 --update-set <sys_id>",
-        notes: ["Exit 2 when the write landed but the read-back does not show the column."],
+        notes: [
+            "Exit 2 when the write landed but the read-back does not show the column.",
+            "Cross-scope: dove-sn add-column --table x_cadso_automate_email_batch --label 'Instance Step' --name instance_step --type reference --reference x_cadso_journey_instance_step --scope x_cadso_journey --cross-scope --update-set <journey set>",
+        ],
     },
     "set-column": {
         summary: "Update an EXISTING column's schema (label/mandatory/default/read-only/max-length/dependent-on-field), then verify",

package/dist/mcp/registry.js

@@ -440,7 +440,13 @@ function buildDescriptors(deps = {}) {
                 "table NAME; element is derived from label unless column.name is given. dependent_on_field names " +
                 "the sibling column a document_id column resolves against (its table_name column) — it must " +
                 "already exist on the table, is verified on the read-back, and is refused when absent. " +
-                "updateSetSysId is required on the live path. dryRun:true returns the plan with no writes.",
+                "scope must match the table's scope unless crossScope:true, which opts in to a column OWNED " +
+                "by scope on another app's table (the platform's cross-scope field: element becomes " +
+                "<scope>_<name>, the dictionary row and its update-set capture land in scope); the table " +
+                "must allow new fields from other scopes (sys_db_object.alter_access) and updateSetSysId " +
+                "must belong to scope — both checked on dryRun too, and the stored element + sys_scope are " +
+                "read back. updateSetSysId is required on the live path. dryRun:true returns the plan with " +
+                "no writes.",
             shape: schemas_1.addColumnSchema.shape,
             handler: async function (args) {
                 var p = schemas_1.addColumnSchema.parse(args);
@@ -458,6 +464,7 @@ function buildDescriptors(deps = {}) {
                     table: p.table,
                     column: p.column,
                     scope: p.scope,
+                    crossScope: p.crossScope,
                     updateSetSysId: p.updateSetSysId,
                     dryRun: p.dryRun,
                     debug: p.debug,

package/dist/mcp/schemas.d.ts

@@ -1890,6 +1890,7 @@ export declare var addColumnSchema: z.ZodObject<{
         dependent_on_field?: string | undefined;
     }>;
     scope: z.ZodOptional<z.ZodString>;
+    crossScope: z.ZodOptional<z.ZodBoolean>;
     updateSetSysId: z.ZodOptional<z.ZodString>;
     dryRun: z.ZodOptional<z.ZodBoolean>;
     debug: z.ZodOptional<z.ZodBoolean>;
@@ -1909,6 +1910,7 @@ export declare var addColumnSchema: z.ZodObject<{
     debug?: boolean | undefined;
     updateSetSysId?: string | undefined;
     scope?: string | undefined;
+    crossScope?: boolean | undefined;
 }, {
     table: string;
     column: {
@@ -1925,6 +1927,7 @@ export declare var addColumnSchema: z.ZodObject<{
     debug?: boolean | undefined;
     updateSetSysId?: string | undefined;
     scope?: string | undefined;
+    crossScope?: boolean | undefined;
 }>;
 export declare var addIndexSchema: z.ZodObject<{
     table: z.ZodString;

package/dist/mcp/schemas.js

@@ -364,6 +364,10 @@ exports.addColumnSchema = zod_1.z.object({
     table: zod_1.z.string().min(1),
     column: exports.columnSpecSchema,
     scope: zod_1.z.string().optional(),
+    // Explicit opt-in to a column OWNED by `scope` when that differs from the table's
+    // scope (a Journey field on an Automate table). Without it a mismatched scope is
+    // refused — on dryRun and live alike — because that is the classic wrong-scope slip.
+    crossScope: zod_1.z.boolean().optional(),
     updateSetSysId: zod_1.z.string().optional(),
     dryRun: zod_1.z.boolean().optional(),
     debug: zod_1.z.boolean().optional(),

package/dist/table/addColumn.d.ts

@@ -16,8 +16,23 @@
  *
  * The scope arg passed to `createRecord` is the scope NAME (e.g. "x_cadso_core"),
  * not the sys_scope sys_id — the server-side changeScope matches on the scope name.
- * A column always belongs to its table's scope, so the name is resolved from the
- * table; an explicit `scope` override must match it.
+ * By default a column belongs to its table's scope, so the name is resolved from the
+ * table and an explicit `scope` override must match it.
+ *
+ * CROSS-SCOPE COLUMNS (`crossScope: true`). ServiceNow lets one app add a column to
+ * another app's table — Studio with app = Journey adding a field to an Automate table
+ * — and prefixes the element with the OWNING scope: `x_cadso_journey_instance_step`
+ * on `x_cadso_automate_email_batch`, dictionary row owned by x_cadso_journey. This is
+ * the column-ownership rule for Tenon's layered apps, so it is supported here as an
+ * explicit opt-in: `scope` names the column's scope, `crossScope: true` acknowledges it
+ * differs from the table's. The insert runs through the same scope-aware op switched
+ * to the COLUMN's scope, so the dictionary row and its update-set capture both land
+ * in the column's scope. Guards, run on dry-run and live alike: the override scope
+ * must exist; the table must allow new fields from other scopes
+ * (`sys_db_object.alter_access`); the update set must belong to the column's scope.
+ * The element is sent already prefixed (`<scope>_<name>`; an already-prefixed name
+ * is accepted as-is) and the element ServiceNow actually stored is read back and
+ * reported, together with a `sys_scope` assertion on the read-back row.
  *
  * SIZING THE PHYSICAL COLUMN. A max_length carried on the INSERT sets the dictionary
  * row but NOT the column ServiceNow actually builds — it materialises at the platform
@@ -46,8 +61,19 @@ export interface AddColumnParams {
     table: string;
     /** The single column to add. `name` (the element) is optional; derived from label when omitted. */
     column: ColumnSpec;
-    /** Scope name or sys_scope sys_id. Must match the table's own scope (a column lives there). */
+    /**
+     * Scope name or sys_scope sys_id. Must match the table's own scope (a column lives
+     * there) — unless `crossScope` is true, in which case it names the scope that will OWN
+     * the column (e.g. "x_cadso_journey" for a Journey column on an Automate table).
+     */
     scope?: string;
+    /**
+     * Explicit opt-in to a column owned by a different scope than its table. Requires
+     * `scope`. The element is prefixed with the owning scope (`x_cadso_journey_<name>`),
+     * the table must allow new fields from other scopes (sys_db_object.alter_access),
+     * and the update set must belong to the column's scope.
+     */
+    crossScope?: boolean;
     /** Update set sys_id to capture the insert into. REQUIRED on the live path (dry-run doesn't need it). */
     updateSetSysId?: string;
     /** Emit diagnostic detail in the result note. */
@@ -67,6 +93,11 @@ export interface AddColumnResult {
     label: string;
     /** Resolved ServiceNow internal_type (friendly -> internal). */
     internalType: string;
+    /**
+     * Scope NAME that owns the column ("" on a network-free dry-run). Equals the table's
+     * scope unless `crossScope` was used, in which case it is the override scope.
+     */
+    scope: string;
     /** sys_id of the sys_dictionary row (the insert's, or the existing row's on "skipped"). */
     columnSysId: string;
     /** Update set the write was captured into ("" on dry-run). */

package/dist/table/addColumn.js

@@ -17,8 +17,23 @@
  *
  * The scope arg passed to `createRecord` is the scope NAME (e.g. "x_cadso_core"),
  * not the sys_scope sys_id — the server-side changeScope matches on the scope name.
- * A column always belongs to its table's scope, so the name is resolved from the
- * table; an explicit `scope` override must match it.
+ * By default a column belongs to its table's scope, so the name is resolved from the
+ * table and an explicit `scope` override must match it.
+ *
+ * CROSS-SCOPE COLUMNS (`crossScope: true`). ServiceNow lets one app add a column to
+ * another app's table — Studio with app = Journey adding a field to an Automate table
+ * — and prefixes the element with the OWNING scope: `x_cadso_journey_instance_step`
+ * on `x_cadso_automate_email_batch`, dictionary row owned by x_cadso_journey. This is
+ * the column-ownership rule for Tenon's layered apps, so it is supported here as an
+ * explicit opt-in: `scope` names the column's scope, `crossScope: true` acknowledges it
+ * differs from the table's. The insert runs through the same scope-aware op switched
+ * to the COLUMN's scope, so the dictionary row and its update-set capture both land
+ * in the column's scope. Guards, run on dry-run and live alike: the override scope
+ * must exist; the table must allow new fields from other scopes
+ * (`sys_db_object.alter_access`); the update set must belong to the column's scope.
+ * The element is sent already prefixed (`<scope>_<name>`; an already-prefixed name
+ * is accepted as-is) and the element ServiceNow actually stored is read back and
+ * reported, together with a `sys_scope` assertion on the read-back row.
  *
  * SIZING THE PHYSICAL COLUMN. A max_length carried on the INSERT sets the dictionary
  * row but NOT the column ServiceNow actually builds — it materialises at the platform
@@ -60,6 +75,7 @@ var READ_BACK_FIELDS = [
     "internal_type",
     "max_length",
     "dependent_on_field",
+    "sys_scope",
 ];
 /** Patch max_length on a sys_dictionary row, captured in the given update set. */
 async function setMaxLength(client, columnSysId, updateSetSysId, length) {
@@ -121,10 +137,10 @@ function validate(params) {
     if (!params.column || typeof params.column !== "object")
         throw new Error("add-column: column is required.");
 }
-/** Resolve the table by name or sys_id; returns its name, sys_id, and sys_scope sys_id. */
+/** Resolve the table by name or sys_id; returns its name, sys_id, scope, and alter_access. */
 async function resolveTable(client, table) {
     var query = SYS_ID.test(table) ? "sys_id=" + table : "name=" + table;
-    var rows = await client.table.query("sys_db_object", query, { limit: 1, fields: ["sys_id", "name", "sys_scope"] });
+    var rows = await client.table.query("sys_db_object", query, { limit: 1, fields: ["sys_id", "name", "sys_scope", "alter_access"] });
     if (rows.length === 0) {
         throw new Error("add-column: table '" + table + "' not found in sys_db_object.");
     }
@@ -132,6 +148,126 @@ async function resolveTable(client, table) {
         name: (0, setField_1.fieldToString)(rows[0].name) || table,
         sysId: (0, setField_1.fieldToString)(rows[0].sys_id),
         scopeSysId: (0, setField_1.fieldToString)(rows[0].sys_scope),
+        alterAccess: (0, setField_1.fieldToString)(rows[0].alter_access),
+    };
+}
+/** Resolve a scope by NAME or sys_id to both; empty strings when not found. */
+async function resolveScope(client, scope) {
+    var query = SYS_ID.test(scope) ? "sys_id=" + scope : "scope=" + scope;
+    var rows = await client.table.query("sys_scope", query, { limit: 1, fields: ["sys_id", "scope"] });
+    if (rows.length === 0)
+        return { name: "", sysId: "" };
+    return {
+        name: (0, setField_1.fieldToString)(rows[0].scope),
+        sysId: (0, setField_1.fieldToString)(rows[0].sys_id),
+    };
+}
+/** Resolve an update set's owning application (sys_scope sys_id); "" when not found. */
+async function resolveUpdateSetScope(client, updateSetSysId) {
+    var rows = await client.table.query("sys_update_set", "sys_id=" + updateSetSysId, { limit: 1, fields: ["sys_id", "name", "application"] });
+    if (rows.length === 0)
+        return { found: false, applicationSysId: "", name: "" };
+    return {
+        found: true,
+        applicationSysId: (0, setField_1.fieldToString)(rows[0].application),
+        name: (0, setField_1.fieldToString)(rows[0].name),
+    };
+}
+/**
+ * Resolve the table + decide which scope owns the column, running every scope guard.
+ * Shared by the dry-run and live paths so a request that would fail live fails the
+ * dry-run the same way — a dry-run that skips the guards is worse than none.
+ */
+async function planColumnScope(client, params, element) {
+    var resolved = await resolveTable(client, params.table);
+    var tableScopeName = await resolveScopeName(client, resolved.scopeSysId);
+    if (!tableScopeName) {
+        throw new Error("add-column: could not resolve the scope name for table '" +
+            resolved.name +
+            "' (sys_scope " +
+            (resolved.scopeSysId || "(none)") +
+            ") — needed to scope the insert correctly.");
+    }
+    var override = params.scope ? params.scope.trim() : "";
+    var wantsCross = params.crossScope === true;
+    if (wantsCross && !override) {
+        throw new Error("add-column: crossScope requires --scope naming the scope that will OWN the column " +
+            "(e.g. x_cadso_journey for a Journey column on an Automate table).");
+    }
+    var sameScope = !override ||
+        override === tableScopeName ||
+        override === resolved.scopeSysId;
+    if (sameScope) {
+        return {
+            resolved: resolved,
+            scopeName: tableScopeName,
+            scopeSysId: resolved.scopeSysId,
+            crossScope: false,
+            element: element,
+        };
+    }
+    // The override names a scope other than the table's. Without the explicit opt-in
+    // this is the classic wrong-scope mistake, so refuse — on dry-run and live alike.
+    if (!wantsCross) {
+        throw new Error("add-column: --scope '" +
+            override +
+            "' does not match table '" +
+            resolved.name +
+            "' scope '" +
+            tableScopeName +
+            "' — a column lives in its table's scope. Omit --scope or set it to '" +
+            tableScopeName +
+            "'. To add a column OWNED by '" +
+            override +
+            "' (a cross-scope field, element prefixed '" +
+            override +
+            "_'), pass --cross-scope.");
+    }
+    var owner = await resolveScope(client, override);
+    if (!owner.name || !owner.sysId) {
+        throw new Error("add-column: cross-scope owner '" +
+            override +
+            "' was not found in sys_scope — pass the scope name (x_cadso_journey) or its sys_id.");
+    }
+    if (resolved.alterAccess !== "true") {
+        throw new Error("add-column: table '" +
+            resolved.name +
+            "' does not allow new fields from other scopes (sys_db_object.alter_access is '" +
+            (resolved.alterAccess || "(empty)") +
+            "'). Enable 'Allow new fields' on the table in its own scope, or add the column " +
+            "in scope '" +
+            tableScopeName +
+            "' instead.");
+    }
+    if (params.updateSetSysId && params.updateSetSysId.trim()) {
+        var us = await resolveUpdateSetScope(client, params.updateSetSysId.trim());
+        if (!us.found) {
+            throw new Error("add-column: update set '" +
+                params.updateSetSysId +
+                "' was not found in sys_update_set.");
+        }
+        if (us.applicationSysId !== owner.sysId) {
+            throw new Error("add-column: update set '" +
+                (us.name || params.updateSetSysId) +
+                "' does not belong to the column's scope '" +
+                owner.name +
+                "' — a cross-scope column is captured in an update set of the scope that OWNS " +
+                "it, not the table's. Pass an update set in '" +
+                owner.name +
+                "'.");
+        }
+    }
+    // ServiceNow stores a cross-scope element as <owner>_<name>. Send it already
+    // prefixed so the pre-check, the insert, and the read-back all agree on the one
+    // element; an already-prefixed name is accepted as-is.
+    var prefix = owner.name + "_";
+    var prefixed = element.indexOf(prefix) === 0 ? element : prefix + element;
+    return {
+        resolved: resolved,
+        scopeName: owner.name,
+        scopeSysId: owner.sysId,
+        crossScope: true,
+        element: prefixed,
     };
 }
 /** Resolve a sys_scope sys_id to its scope NAME (e.g. "x_cadso_core"). */
@@ -170,23 +306,47 @@ async function addColumn(params) {
             "' names the column being added — a column cannot depend on itself.");
     }
     if (params.dryRun) {
+        // A plain dry-run (no scope named) is pure + deterministic — no network — so it
+        // can plan without an instance. Once a scope IS named, the plan depends on the
+        // instance (does the table allow it? does the update set match?), so the dry-run
+        // runs the SAME guards as the live path and fails the same way. It used to skip
+        // them, so a cross-scope request dry-ran clean and only failed live.
+        var hasScopeAsk = (params.scope !== undefined && params.scope.trim() !== "") ||
+            params.crossScope === true;
+        var planned;
+        if (hasScopeAsk)
+            planned = await planColumnScope(client, params, element);
+        var planElement = planned ? planned.element : element;
+        var planTable = planned ? planned.resolved.name : params.table;
+        var planTableSysId = planned
+            ? planned.resolved.sysId
+            : SYS_ID.test(params.table)
+                ? params.table
+                : "";
         return {
             status: "dry-run",
-            table: params.table,
-            tableSysId: SYS_ID.test(params.table) ? params.table : "",
-            element: element,
+            table: planTable,
+            tableSysId: planTableSysId,
+            element: planElement,
             label: col.label,
             internalType: col.type,
+            scope: planned ? planned.scopeName : "",
             columnSysId: "",
             updateSetSysId: params.updateSetSysId ? params.updateSetSysId : "",
             verified: false,
             note: "dry-run: no write. Would add column '" +
-                element +
+                planElement +
                 "' (" +
                 col.type +
                 ") to '" +
-                params.table +
-                "' via a scope-aware sys_dictionary insert, captured into update set " +
+                planTable +
+                "'" +
+                (planned && planned.crossScope
+                    ? " OWNED BY scope '" +
+                        planned.scopeName +
+                        "' (cross-scope: the table allows new fields and the update set is in that scope)"
+                    : "") +
+                " via a scope-aware sys_dictionary insert, captured into update set " +
                 (params.updateSetSysId ? params.updateSetSysId : "(none provided)") +
                 (wantDependent
                     ? ", dependent on column '" +
@@ -203,31 +363,13 @@ async function addColumn(params) {
         throw new Error("add-column: updateSetSysId is required on the live path so the sys_dictionary " +
             "insert is captured in a known update set (dry-run does not need one).");
     }
-    var resolved = await resolveTable(client, params.table);
-    var scopeName = await resolveScopeName(client, resolved.scopeSysId);
-    if (!scopeName) {
-        throw new Error("add-column: could not resolve the scope name for table '" +
-            resolved.name +
-            "' (sys_scope " +
-            (resolved.scopeSysId || "(none)") +
-            ") — needed to scope the insert correctly.");
-    }
-    // A column lives in its table's scope. An explicit override must match it (by name
-    // or sys_id); we never write a column into a scope other than its table's.
-    if (params.scope && params.scope.trim()) {
-        var override = params.scope.trim();
-        if (override !== scopeName && override !== resolved.scopeSysId) {
-            throw new Error("add-column: --scope '" +
-                override +
-                "' does not match table '" +
-                resolved.name +
-                "' scope '" +
-                scopeName +
-                "' — a column must live in its table's scope. Omit --scope or set it to '" +
-                scopeName +
-                "'.");
-        }
-    }
+    // Resolve the table and decide which scope OWNS the column — the table's by default,
+    // the override's under crossScope. Every scope guard runs inside planColumnScope, the
+    // same code the dry-run ran, so nothing can pass dry-run and fail here on scope.
+    var plan = await planColumnScope(client, params, element);
+    var resolved = plan.resolved;
+    var scopeName = plan.scopeName;
+    element = plan.element;
     // max_length is deliberately NOT sent on the insert — see the sizing step below.
     // Reference (and date) columns carry no max_length at all.
     var wantLength = col.type === "reference" ? "" : col.maxLength;
@@ -289,6 +431,7 @@ async function addColumn(params) {
             element: existingElement,
             label: col.label,
             internalType: existingType || col.type,
+            scope: scopeName,
             columnSysId: existingSysId,
             updateSetSysId: params.updateSetSysId,
             verified: drift.length === 0,
@@ -320,7 +463,10 @@ async function addColumn(params) {
         mandatory: params.column.mandatory === true ? "true" : "false",
         default_value: typeof params.column.default === "string" ? params.column.default : "",
         active: "true",
-        sys_scope: resolved.scopeSysId,
+        // The COLUMN's owner — the table's scope by default, the override's under
+        // crossScope. The createRecord `scope` below is switched to the same owner so the
+        // dictionary row and its update-set capture agree on who owns the column.
+        sys_scope: plan.scopeSysId,
     };
     // Reference columns carry the target table NAME (not a sys_id) in `reference`.
     if (col.reference)
@@ -341,11 +487,11 @@ async function addColumn(params) {
     }
     catch (e) {
         return failure(resolved, col, element, params.updateSetSysId, "sys_dictionary insert failed: " +
-            (e && e.message ? e.message : String(e)));
+            (e && e.message ? e.message : String(e)), undefined, scopeName);
     }
     var columnSysId = (0, setField_1.fieldToString)(created && created.sys_id);
     if (!columnSysId) {
-        return failure(resolved, col, element, params.updateSetSysId, "createRecord returned no sys_id — the insert may not have landed; check the instance.");
+        return failure(resolved, col, element, params.updateSetSysId, "createRecord returned no sys_id — the insert may not have landed; check the instance.", undefined, scopeName);
     }
     // SIZE THE PHYSICAL COLUMN. A max_length carried on the INSERT sets the dictionary
     // row but NOT the column ServiceNow actually builds — it materialises at the platform
@@ -389,7 +535,7 @@ async function addColumn(params) {
             " was created, but sizing/verifying it failed: " +
             (e && e.message ? e.message : String(e)) +
             " — the column EXISTS but may not be the size it was declared, so treat it as " +
-            "unsafe to write to until it is checked on the instance.", columnSysId);
+            "unsafe to write to until it is checked on the instance.", columnSysId, scopeName);
     }
     // The read-back proves THIS insert landed (by sys_id, not element — ServiceNow can
     // normalise the element server-side) AND that the column is the size it was asked to
@@ -402,6 +548,23 @@ async function addColumn(params) {
     var readBackDependent = verified
         ? (0, setField_1.fieldToString)(rows[0].dependent_on_field)
         : "";
+    var readBackScope = verified ? (0, setField_1.fieldToString)(rows[0].sys_scope) : "";
+    // Ownership is part of the column's identity: a cross-scope row that reads back in
+    // the TABLE's scope was prefixed for nothing and will ship in the wrong update set.
+    // Asserted whenever the instance reports a scope (a read-back that omits it, as in
+    // older stubs, is not evidence either way).
+    if (verified && readBackScope && readBackScope !== plan.scopeSysId) {
+        return failure(resolved, col, element, params.updateSetSysId, "column '" +
+            actualElement +
+            "' materialised but sys_scope read back as '" +
+            readBackScope +
+            "', not the requested '" +
+            plan.scopeSysId +
+            "' (" +
+            scopeName +
+            ") — the column is owned by the wrong app and its capture will not promote with " +
+            "the right scope. Reconcile it on the instance before writing to it.", columnSysId, scopeName);
+    }
     if (verified && wantLength && readBackLength !== wantLength) {
         return failure(resolved, col, element, params.updateSetSysId, "column '" +
             actualElement +
@@ -411,7 +574,7 @@ async function addColumn(params) {
             wantLength +
             "' — the physical column is NOT the size it was declared, so values over the " +
             "real limit would be silently truncated. Fix the column on the instance before " +
-            "writing to it.", columnSysId);
+            "writing to it.", columnSysId, scopeName);
     }
     if (verified && wantDependent && readBackDependent !== wantDependent) {
         return failure(resolved, col, element, params.updateSetSysId, "column '" +
@@ -421,13 +584,13 @@ async function addColumn(params) {
             ", not the requested '" +
             wantDependent +
             "' — a document_id with no dependency resolves against nothing. Set it on " +
-            "the instance (set-column --dependent-on-field) before writing to the column.", columnSysId);
+            "the instance (set-column --dependent-on-field) before writing to the column.", columnSysId, scopeName);
     }
     if (!verified) {
         return failure(resolved, col, element, params.updateSetSysId, "createRecord returned sys_id " +
             columnSysId +
             " but no sys_dictionary row was found on read-back — the column may not have " +
-            "materialised; check the instance.", columnSysId);
+            "materialised; check the instance.", columnSysId, scopeName);
     }
     // Same trust-the-read-back rule as max_length: a column that reads back a different
     // internal_type than was requested is NOT the column that was asked for. Refuse to
@@ -441,7 +604,7 @@ async function addColumn(params) {
             "', not the requested '" +
             col.type +
             "' — the column that exists is not the column that was asked for. Reconcile it " +
-            "on the instance before writing to it.", columnSysId);
+            "on the instance before writing to it.", columnSysId, scopeName);
     }
     var note = "Added column '" +
         actualElement +
@@ -450,6 +613,9 @@ async function addColumn(params) {
         ") to " +
         resolved.name +
         (wantDependent ? ", dependent on '" + wantDependent + "'" : "") +
+        (plan.crossScope
+            ? " owned by scope '" + scopeName + "' (cross-scope field)"
+            : "") +
         " — verified present in sys_dictionary, captured into update set " +
         params.updateSetSysId +
         (actualElement !== element
@@ -467,7 +633,11 @@ async function addColumn(params) {
                 " scopeName=" +
                 scopeName +
                 " sys_scope=" +
-                resolved.scopeSysId +
+                plan.scopeSysId +
+                " crossScope=" +
+                String(plan.crossScope) +
+                " readBackScope=" +
+                (readBackScope || "(none)") +
                 " readBackType=" +
                 (readBackType || "(none)") +
                 "]";
@@ -479,6 +649,7 @@ async function addColumn(params) {
         element: actualElement,
         label: col.label,
         internalType: col.type,
+        scope: scopeName,
         columnSysId: columnSysId,
         updateSetSysId: params.updateSetSysId,
         verified: true,
@@ -486,7 +657,7 @@ async function addColumn(params) {
     };
 }
 /** Build a `failed` result (shared by the insert-threw and read-back-empty paths). */
-function failure(resolved, col, element, updateSetSysId, note, columnSysId) {
+function failure(resolved, col, element, updateSetSysId, note, columnSysId, scope) {
     return {
         status: "failed",
         table: resolved.name,
@@ -494,6 +665,7 @@ function failure(resolved, col, element, updateSetSysId, note, columnSysId) {
         element: element,
         label: col.label,
         internalType: col.type,
+        scope: scope ? scope : "",
         columnSysId: columnSysId ? columnSysId : "",
         updateSetSysId: updateSetSysId,
         verified: false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tenonhq/dovetail-servicenow",
-  "version": "0.0.48",
+  "version": "0.0.49",
   "engines": {
     "node": ">=22"
   },