@tenonhq/dovetail-servicenow 0.0.48 → 0.0.50

package/README.md

@@ -1151,7 +1151,18 @@ console.log(formatLayoutResult("form layout", result));
 `dove-sn mcp` runs a self-contained MCP stdio server exposing the tools to
 Claude Code and agents: `create_view`, `set_list_layout`, `set_form_layout`,
 `set_related_lists`, `add_choices_to_field`, the schema verbs `create_table` /
-`add_column` / `add_index` (a single-column unique index via `sys_dictionary.unique`,
+`add_column` (same-scope by default; `crossScope: true` with `scope` adds a column OWNED
+by another app — a Journey field on an Automate table, element `<scope>_<name>` —
+guarded by `sys_db_object.alter_access` and the update set's scope, with the stored
+element and `sys_scope` read back; the CLI flag is `--cross-scope`. A cross-scope
+result also carries `designAccess`: the platform UI refuses cross-scope authoring
+without a `sys_scope_design_access` record (column scope -> table scope), so a missing
+one is FLAGGED — not blocking, the headless insert works without it — and
+`ensureDesignAccess: true` / `--ensure-design-access` creates it first in the same
+update set) / `design_access` (ensure that record on its own — idempotent, created in
+the SOURCE app's update set and read back; CLI `dove-sn design-access --source <app>
+--target <app> --update-set <sys_id>`, `--dry-run` only reports exists/missing) /
+`add_index` (a single-column unique index via `sys_dictionary.unique`,
 read back from the `v_db_index` view - uniqueness enforcement is always reported
 unverified) / `index_list` (read-only: a table's database indexes from `v_db_index`,
 the only index read surface - `sys_index` is API-level-ACL 403 and `sys_index_column`

package/dist/cli.js

@@ -1340,14 +1340,60 @@ async function runCreateTable(flags) {
         return 2;
     return 0;
 }
+/**
+ * dove-sn design-access:
+ *   --source x_cadso_journey --target x_cadso_automate
+ *   [--update-set <sys_id in source>] [--dry-run] [--json]
+ * Ensures the sys_scope_design_access record that lets the SOURCE app author in the
+ * TARGET app's tables (required by the platform UI for cross-scope columns). Idempotent;
+ * --dry-run only reports whether it exists. --update-set is required unless --dry-run.
+ */
+async function runDesignAccess(flags) {
+    if (!flags.source || !flags.target) {
+        process.stderr.write("design-access: --source (authoring app) and --target (app that owns the tables) are required\n");
+        return 1;
+    }
+    var isDryRun = flags["dry-run"] === "true";
+    if (!isDryRun && !flags["update-set"]) {
+        process.stderr.write("design-access: --update-set (an update set in --source) is required on the live path (only --dry-run works without one)\n");
+        return 1;
+    }
+    var result = await (0, table_1.ensureDesignAccess)({
+        client: (0, client_1.createClient)({}),
+        sourceScope: flags.source,
+        targetScope: flags.target,
+        updateSetSysId: flags["update-set"],
+        dryRun: isDryRun,
+    });
+    if (flags.json === "true") {
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+    }
+    else {
+        process.stdout.write("[" +
+            result.status +
+            "] " +
+            result.sourceScope +
+            " -> " +
+            result.targetScope +
+            (result.sysId ? " (" + result.sysId + ")" : "") +
+            "\n" +
+            result.note +
+            "\n");
+    }
+    if (result.status === "failed")
+        return 2;
+    return 0;
+}
 /**
  * dove-sn add-column:
  *   --table x_cadso_journey --label URL --type url
  *   [--name url] [--max-length 1024] [--reference <table>]
  *   [--mandatory] [--default <value>] [--dependent-on-field <element>]
- *   [--scope x_cadso_journey] [--update-set <sys_id>]
- *   [--from-json <spec.json>] [--dry-run] [--debug] [--json]
- * --update-set is required unless --dry-run.
+ *   [--scope x_cadso_journey] [--cross-scope] [--ensure-design-access]
+ *   [--update-set <sys_id>] [--from-json <spec.json>] [--dry-run] [--debug] [--json]
+ * --update-set is required unless --dry-run. --cross-scope opts in to a column
+ * OWNED by --scope when that differs from the table's scope; a missing Design Access
+ * record is flagged, and --ensure-design-access creates it first.
  */
 async function runAddColumn(flags) {
     var spec = {};
@@ -1384,6 +1430,13 @@ async function runAddColumn(flags) {
     var scope = flags.scope || spec.scope;
     if (scope)
         params.scope = scope;
+    if (flags["cross-scope"] === "true" || spec.crossScope === true) {
+        params.crossScope = true;
+    }
+    if (flags["ensure-design-access"] === "true" ||
+        spec.ensureDesignAccess === true) {
+        params.ensureDesignAccess = true;
+    }
     var us = flags["update-set"] || spec.updateSetSysId;
     if (us)
         params.updateSetSysId = us;
@@ -2612,6 +2665,9 @@ async function dispatch(parsed) {
     if (parsed.command === "add-column") {
         return await runAddColumn(parsed.flags);
     }
+    if (parsed.command === "design-access") {
+        return await runDesignAccess(parsed.flags);
+    }
     if (parsed.command === "add-index") {
         return await runAddIndex(parsed.flags);
     }

package/dist/cliUsage.js

@@ -200,7 +200,19 @@ exports.VERB_USAGE = {
                 value: "<element>",
                 note: "Sibling column a document_id resolves against (its table_name column); must already exist.",
             },
-            { flag: "scope", value: "<x_scope>", note: "Owning app scope when it cannot be inferred from the table." },
+            {
+                flag: "scope",
+                value: "<x_scope>",
+                note: "Owning app scope. Must match the table's scope unless --cross-scope is passed.",
+            },
+            {
+                flag: "cross-scope",
+                note: "Opt in to a column OWNED by --scope, which differs from the table's scope (element becomes <scope>_<name>; the table must allow new fields; --update-set must be in --scope).",
+            },
+            {
+                flag: "ensure-design-access",
+                note: "Cross-scope only: create the missing sys_scope_design_access record (--scope -> table's scope) first, in the same update set. Without it a missing record is only flagged.",
+            },
             { flag: "update-set", value: "<sys_id>", note: "REQUIRED on the live path (only --dry-run works without one)." },
             DRY_RUN_FLAG,
             DEBUG_FLAG,
@@ -209,7 +221,30 @@ exports.VERB_USAGE = {
         gate: "dry-run-flag",
         gateNote: "--update-set is required unless --dry-run.",
         example: "dove-sn add-column --table x_cadso_journey --label URL --type url --max-length 1024 --update-set <sys_id>",
-        notes: ["Exit 2 when the write landed but the read-back does not show the column."],
+        notes: [
+            "Exit 2 when the write landed but the read-back does not show the column.",
+            "Cross-scope: dove-sn add-column --table x_cadso_automate_email_batch --label 'Instance Step' --name instance_step --type reference --reference x_cadso_journey_instance_step --scope x_cadso_journey --cross-scope --update-set <journey set>",
+        ],
+    },
+    "design-access": {
+        summary: "Ensure the sys_scope_design_access record that lets one app author in another app's tables (required by the UI for cross-scope columns)",
+        required: [
+            { flag: "source", value: "<x_scope>", note: "The AUTHORING app (owns the record and its update set)." },
+            { flag: "target", value: "<x_scope>", note: "The app that OWNS the tables." },
+        ],
+        optional: [
+            { flag: "update-set", value: "<sys_id>", note: "Update set in --source. REQUIRED on the live path." },
+            DRY_RUN_FLAG,
+            JSON_FLAG,
+        ],
+        gate: "dry-run-flag",
+        gateNote: "--update-set is required unless --dry-run; --dry-run reports exists/missing only.",
+        example: "dove-sn design-access --source x_cadso_journey --target x_cadso_automate --update-set <journey set>",
+        notes: [
+            "Idempotent: an existing record is reported and nothing is written.",
+            "Symptom it fixes: \"Invalid 'Table' selected on the Dictionary Entry record ... can only select '<app>' tables with read access enabled\" — the table's own access flags are NOT the gate.",
+            "Exit 2 when the record could not be created or verified on read-back.",
+        ],
     },
     "set-column": {
         summary: "Update an EXISTING column's schema (label/mandatory/default/read-only/max-length/dependent-on-field), then verify",

package/dist/index.d.ts

@@ -21,8 +21,8 @@ export { sincPlugin } from "./plugin";
 export { listTemplates, verifyArtifact, cloneSubflow, cloneActionType, resolveScope, slugInternalName, fetchActionSteps, findStepInput, triggerPublication, publishActionType, editActionType, defineActionType, planActionDefinition, validateDefineSpec, applyStepOps, verifySteps, summarizeSteps, formatStepPill, readFlow, readActionType, publishFlow, copyFlow, createFlow, buildPublishModel, editFlow, testFlow, DEFAULT_RUN_FLOW_PATH, generateSysId, topoSort, executeWritePlan, WriteOrderError, } from "./flowDesigner";
 export type { TemplateRef, ListTemplatesParams, FlowKind, VerifyExpect, VerifyFound, VerifyFailure, VerifyReport, VerifyArtifactParams, CloneSubflowParams, CloneSubflowResult, CloneActionTypeParams, CloneActionTypeResult, CloneActionTypePlan, CloneActionTypeStepReport, TriggerPublicationParams, TriggerPublicationResult, PublishActionTypeParams, PublishActionTypeResult, EditActionTypeParams, EditActionTypeResult, EditActionTypeOps, DefineActionSpec, DefineActionInputSpec, DefineActionOutputSpec, DefineStepSpec, DefineStepVarSpec, DefineStepOutputSpec, DefineStepValue, DefineActionTypeParams, DefineActionTypeResult, DefineActionDiff, DefineActionPlan, PlanActionDefinitionParams, ActionView, StepView, StepOps, StepRecord, StepSummary, StepIoSummary, PatchStepScriptOp, SetStepInputOp, AddStepOutputOp, AddStepInputOp, ApplyStepOpsResult, VerifyStepsResult, ReadFlowParams, ReadFlowResult, FlowStep, FlowVariable, ReadActionTypeParams, ReadActionTypeResult, ActionIo, PublishFlowParams, PublishFlowResult, CopyFlowParams, CopyFlowResult, CreateFlowParams, CreateFlowResult, EditFlowParams, EditFlowResult, EditFlowOps, StepInputPatch, TestFlowParams, TestFlowResult, WriteOp, WriteOpResult, } from "./flowDesigner";
 export type { ServiceNowClientConfig, ChoiceValue, ChoiceType, AddChoicesParams, AddChoicesResult, ChoiceActionResult, ChoiceFieldRef, RemoveChoicesParams, RemoveChoicesResult, ChoiceRemovalResult, DictionaryRecord, UpdateSetRecord, LayoutAction, LayoutRecordResult, LayoutResult, CreateViewParams, CreateViewResult, FormSectionSpec, SetFormLayoutParams, SetListLayoutParams, SetRelatedListsParams, ChunkRole, ChunkInfo, ChunkResult, PrunedResult, HostAssetsParams, HostAssetsResult, } from "./types";
-export { createTable, projectTableGraph, buildColumnXml, normalizeColumns, resolveType, applyTableSaveOverlay, defaultAccessFlags, TYPE_MAP, DEFAULT_SUPER_CLASS, DEFAULT_SAVE_ACTION, addColumn, deriveElement, addIndex, parseIndexColumns, indexMatchesColumns, listIndexes, createIndex, validateCreateIndex, DEFAULT_INDEX_FORM_PATH, NOT_IN_UPDATE_SET, setColumn, resolveAttributes, toStoredValue, setTable, resolveTableAttributes, } from "./table";
-export type { CreateTableParams, CreateTableResult, AddColumnParams, AddColumnResult, AddIndexParams, AddIndexResult, AddIndexVerification, ListIndexesParams, ListIndexesResult, TableIndex, CreateIndexParams, CreateIndexResult, SetColumnParams, SetColumnResult, ColumnAttributes, AttributeChange, SetTableParams, SetTableResult, TableAttributes, TableGraph, NormalizedColumn, ColumnSpec, AccessFlags, OverlaySpec, } from "./table";
+export { createTable, projectTableGraph, buildColumnXml, normalizeColumns, resolveType, applyTableSaveOverlay, defaultAccessFlags, TYPE_MAP, DEFAULT_SUPER_CLASS, DEFAULT_SAVE_ACTION, addColumn, deriveElement, ensureDesignAccess, findDesignAccess, DESIGN_ACCESS_TABLE, addIndex, parseIndexColumns, indexMatchesColumns, listIndexes, createIndex, validateCreateIndex, DEFAULT_INDEX_FORM_PATH, NOT_IN_UPDATE_SET, setColumn, resolveAttributes, toStoredValue, setTable, resolveTableAttributes, } from "./table";
+export type { CreateTableParams, CreateTableResult, AddColumnParams, AddColumnResult, DesignAccessFlag, EnsureDesignAccessParams, EnsureDesignAccessResult, AddIndexParams, AddIndexResult, AddIndexVerification, ListIndexesParams, ListIndexesResult, TableIndex, CreateIndexParams, CreateIndexResult, SetColumnParams, SetColumnResult, ColumnAttributes, AttributeChange, SetTableParams, SetTableResult, TableAttributes, TableGraph, NormalizedColumn, ColumnSpec, AccessFlags, OverlaySpec, } from "./table";
 export { setField } from "./setField";
 export { createRecord } from "./createRecord";
 export type { RecordWriteResult, SetFieldParams, SetFieldResult, } from "./setField";

package/dist/index.js

@@ -7,8 +7,8 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.editFlow = exports.buildPublishModel = exports.createFlow = exports.copyFlow = exports.publishFlow = exports.readActionType = exports.readFlow = exports.formatStepPill = exports.summarizeSteps = exports.verifySteps = exports.applyStepOps = exports.validateDefineSpec = exports.planActionDefinition = exports.defineActionType = exports.editActionType = exports.publishActionType = exports.triggerPublication = exports.findStepInput = exports.fetchActionSteps = exports.slugInternalName = exports.resolveScope = exports.cloneActionType = exports.cloneSubflow = exports.verifyArtifact = exports.listTemplates = exports.sincPlugin = exports.formatCreateViewResult = exports.formatLayoutResult = exports.setRelatedLists = exports.setFormLayout = exports.setListLayout = exports.createView = exports.formatRemoveChoicesResult = exports.formatAddChoicesResult = exports.formatHostAssetsResult = exports.classifyChunks = exports.hostAssets = exports.ChoiceWriteError = exports.removeChoicesFromField = exports.addChoicesToField = exports.resolveConfigFromEnvFile = exports.createClientFromEnvFile = exports.assertWriteAllowed = exports.evaluateWriteGate = exports.isCiEnvironment = exports.resolveExecutionContext = exports.PROCESSFLOW_PATH_PREFIX = exports.isProcessflowPath = exports.resolveFlowAuth = exports.createClient = void 0;
-exports.parseProgressTree = exports.parseXmlAnswer = exports.PUBLISH_TARGETS = exports.parsePublishTargets = exports.describeTarget = exports.resolveUpdateSetNaming = exports.buildPublishToUpdateSetFields = exports.buildCreateUpdateSetFields = exports.buildStartFields = exports.publishApp = exports.INVOKE_REST_METHODS = exports.invokeRest = exports.verifyReadBack = exports.readBackMatches = exports.hasHtmlEntity = exports.decodeHtmlEntities = exports.deleteRecord = exports.createRecord = exports.setField = exports.resolveTableAttributes = exports.setTable = exports.toStoredValue = exports.resolveAttributes = exports.setColumn = exports.NOT_IN_UPDATE_SET = exports.DEFAULT_INDEX_FORM_PATH = exports.validateCreateIndex = exports.createIndex = exports.listIndexes = exports.indexMatchesColumns = exports.parseIndexColumns = exports.addIndex = exports.deriveElement = exports.addColumn = exports.DEFAULT_SAVE_ACTION = exports.DEFAULT_SUPER_CLASS = exports.TYPE_MAP = exports.defaultAccessFlags = exports.applyTableSaveOverlay = exports.resolveType = exports.normalizeColumns = exports.buildColumnXml = exports.projectTableGraph = exports.createTable = exports.WriteOrderError = exports.executeWritePlan = exports.topoSort = exports.generateSysId = exports.DEFAULT_RUN_FLOW_PATH = exports.testFlow = void 0;
-exports.SECRET_INTERNAL_TYPES = exports.SENTINEL = exports.isCapturable = exports.secretFieldsFromDictionary = exports.mergeSecretRules = exports.loadSecretRules = exports.defaultSecretRules = exports.escapeRegExp = exports.encodeXmlText = exports.encodeXmlEntities = exports.stripJsonValue = exports.stripField = exports.plannedStrips = exports.recordFieldNames = exports.readRecordTable = exports.readField = exports.verifyStripped = exports.stripSecrets = exports.DEFAULT_EXPORT_APP_TIMEOUT_MS = exports.buildPublishFields = exports.buildCreateSetFields = exports.exportApp = exports.DEFAULT_MAX_ROWS = exports.MAX_PAGE_SIZE = exports.DEFAULT_PAGE_SIZE = exports.UPDATE_XML_FIELDS = exports.xmlEscape = exports.formatUnloadDate = exports.parseStatsCount = exports.refreshTypeFields = exports.fetchUpdateXmlRows = exports.countUpdateXml = exports.countUnloadRecords = exports.renderUnload = exports.renderRemoteUpdateSet = exports.renderUpdateXmlRow = exports.exportUpdateSet = exports.PUBLISH_POLL_DELAYS_MS = exports.DEFAULT_PUBLISH_TIMEOUT_MS = exports.parseCicdProgress = exports.parseCicdPublishResponse = exports.harvestProgressResults = exports.flattenSteps = exports.classifyProgress = void 0;
+exports.parsePublishTargets = exports.describeTarget = exports.resolveUpdateSetNaming = exports.buildPublishToUpdateSetFields = exports.buildCreateUpdateSetFields = exports.buildStartFields = exports.publishApp = exports.INVOKE_REST_METHODS = exports.invokeRest = exports.verifyReadBack = exports.readBackMatches = exports.hasHtmlEntity = exports.decodeHtmlEntities = exports.deleteRecord = exports.createRecord = exports.setField = exports.resolveTableAttributes = exports.setTable = exports.toStoredValue = exports.resolveAttributes = exports.setColumn = exports.NOT_IN_UPDATE_SET = exports.DEFAULT_INDEX_FORM_PATH = exports.validateCreateIndex = exports.createIndex = exports.listIndexes = exports.indexMatchesColumns = exports.parseIndexColumns = exports.addIndex = exports.DESIGN_ACCESS_TABLE = exports.findDesignAccess = exports.ensureDesignAccess = exports.deriveElement = exports.addColumn = exports.DEFAULT_SAVE_ACTION = exports.DEFAULT_SUPER_CLASS = exports.TYPE_MAP = exports.defaultAccessFlags = exports.applyTableSaveOverlay = exports.resolveType = exports.normalizeColumns = exports.buildColumnXml = exports.projectTableGraph = exports.createTable = exports.WriteOrderError = exports.executeWritePlan = exports.topoSort = exports.generateSysId = exports.DEFAULT_RUN_FLOW_PATH = exports.testFlow = void 0;
+exports.SECRET_INTERNAL_TYPES = exports.SENTINEL = exports.isCapturable = exports.secretFieldsFromDictionary = exports.mergeSecretRules = exports.loadSecretRules = exports.defaultSecretRules = exports.escapeRegExp = exports.encodeXmlText = exports.encodeXmlEntities = exports.stripJsonValue = exports.stripField = exports.plannedStrips = exports.recordFieldNames = exports.readRecordTable = exports.readField = exports.verifyStripped = exports.stripSecrets = exports.DEFAULT_EXPORT_APP_TIMEOUT_MS = exports.buildPublishFields = exports.buildCreateSetFields = exports.exportApp = exports.DEFAULT_MAX_ROWS = exports.MAX_PAGE_SIZE = exports.DEFAULT_PAGE_SIZE = exports.UPDATE_XML_FIELDS = exports.xmlEscape = exports.formatUnloadDate = exports.parseStatsCount = exports.refreshTypeFields = exports.fetchUpdateXmlRows = exports.countUpdateXml = exports.countUnloadRecords = exports.renderUnload = exports.renderRemoteUpdateSet = exports.renderUpdateXmlRow = exports.exportUpdateSet = exports.PUBLISH_POLL_DELAYS_MS = exports.DEFAULT_PUBLISH_TIMEOUT_MS = exports.parseCicdProgress = exports.parseCicdPublishResponse = exports.harvestProgressResults = exports.flattenSteps = exports.classifyProgress = exports.parseProgressTree = exports.parseXmlAnswer = exports.PUBLISH_TARGETS = void 0;
 var client_1 = require("./client");
 Object.defineProperty(exports, "createClient", { enumerable: true, get: function () { return client_1.createClient; } });
 Object.defineProperty(exports, "resolveFlowAuth", { enumerable: true, get: function () { return client_1.resolveFlowAuth; } });
@@ -91,6 +91,9 @@ Object.defineProperty(exports, "DEFAULT_SUPER_CLASS", { enumerable: true, get: f
 Object.defineProperty(exports, "DEFAULT_SAVE_ACTION", { enumerable: true, get: function () { return table_1.DEFAULT_SAVE_ACTION; } });
 Object.defineProperty(exports, "addColumn", { enumerable: true, get: function () { return table_1.addColumn; } });
 Object.defineProperty(exports, "deriveElement", { enumerable: true, get: function () { return table_1.deriveElement; } });
+Object.defineProperty(exports, "ensureDesignAccess", { enumerable: true, get: function () { return table_1.ensureDesignAccess; } });
+Object.defineProperty(exports, "findDesignAccess", { enumerable: true, get: function () { return table_1.findDesignAccess; } });
+Object.defineProperty(exports, "DESIGN_ACCESS_TABLE", { enumerable: true, get: function () { return table_1.DESIGN_ACCESS_TABLE; } });
 Object.defineProperty(exports, "addIndex", { enumerable: true, get: function () { return table_1.addIndex; } });
 Object.defineProperty(exports, "parseIndexColumns", { enumerable: true, get: function () { return table_1.parseIndexColumns; } });
 Object.defineProperty(exports, "indexMatchesColumns", { enumerable: true, get: function () { return table_1.indexMatchesColumns; } });

package/dist/mcp/registry.d.ts

@@ -10,7 +10,7 @@ import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 import type { ToolAnnotations } from "@tenonhq/dovetail-mcp-kit";
 import type { ServiceNowClient } from "../client";
-export declare var TOOL_NAMES: readonly ["create_view", "set_list_layout", "set_form_layout", "set_related_lists", "add_choices_to_field", "remove_choices_from_field", "flow_view", "action_view", "action_edit", "action_clone", "action_define", "flow_publish", "flow_copy", "flow_create", "flow_test", "flow_edit", "create_table", "add_column", "add_index", "index_list", "index_create", "set_column", "set_table", "set_field", "create_record", "delete_record", "host_assets", "invoke_rest", "app_publish", "update_set_export", "app_export"];
+export declare var TOOL_NAMES: readonly ["create_view", "set_list_layout", "set_form_layout", "set_related_lists", "add_choices_to_field", "remove_choices_from_field", "flow_view", "action_view", "action_edit", "action_clone", "action_define", "flow_publish", "flow_copy", "flow_create", "flow_test", "flow_edit", "create_table", "add_column", "design_access", "add_index", "index_list", "index_create", "set_column", "set_table", "set_field", "create_record", "delete_record", "host_assets", "invoke_rest", "app_publish", "update_set_export", "app_export"];
 export type ToolName = (typeof TOOL_NAMES)[number];
 export interface RegistryDeps {
     /** Optional client injection for tests; defaults to createClient({}). */

package/dist/mcp/registry.js

@@ -57,6 +57,7 @@ exports.TOOL_NAMES = [
     "flow_edit",
     "create_table",
     "add_column",
+    "design_access",
     "add_index",
     "index_list",
     "index_create",
@@ -440,7 +441,17 @@ function buildDescriptors(deps = {}) {
                 "table NAME; element is derived from label unless column.name is given. dependent_on_field names " +
                 "the sibling column a document_id column resolves against (its table_name column) — it must " +
                 "already exist on the table, is verified on the read-back, and is refused when absent. " +
-                "updateSetSysId is required on the live path. dryRun:true returns the plan with no writes.",
+                "scope must match the table's scope unless crossScope:true, which opts in to a column OWNED " +
+                "by scope on another app's table (the platform's cross-scope field: element becomes " +
+                "<scope>_<name>, the dictionary row and its update-set capture land in scope); the table " +
+                "must allow new fields from other scopes (sys_db_object.alter_access) and updateSetSysId " +
+                "must belong to scope — both checked on dryRun too, and the stored element + sys_scope are " +
+                "read back. A cross-scope result carries designAccess { present, sysId, created }: the " +
+                "platform UI refuses cross-scope authoring without a sys_scope_design_access record " +
+                "(scope -> the table's scope), so a missing one is FLAGGED (not blocking — the headless " +
+                "insert works without it); ensureDesignAccess:true creates it first in the same update " +
+                "set. updateSetSysId is required on the live path. dryRun:true returns the plan with " +
+                "no writes.",
             shape: schemas_1.addColumnSchema.shape,
             handler: async function (args) {
                 var p = schemas_1.addColumnSchema.parse(args);
@@ -458,12 +469,44 @@ function buildDescriptors(deps = {}) {
                     table: p.table,
                     column: p.column,
                     scope: p.scope,
+                    crossScope: p.crossScope,
+                    ensureDesignAccess: p.ensureDesignAccess,
                     updateSetSysId: p.updateSetSysId,
                     dryRun: p.dryRun,
                     debug: p.debug,
                 });
             },
         },
+        {
+            name: "design_access",
+            annotations: dovetail_mcp_kit_1.WRITE_CREATE,
+            description: "Ensure the sys_scope_design_access record that lets sourceScope (the AUTHORING app) " +
+                "design in targetScope's tables (the app that OWNS them). The platform UI requires it " +
+                "for cross-scope columns — the symptom is \"Invalid 'Table' selected on the Dictionary " +
+                "Entry record ... can only select '<app>' tables with read access enabled\", and the " +
+                "table's own access flags are NOT the gate. Scopes are names or sys_scope sys_ids. " +
+                "Idempotent: an existing record returns status 'exists' and nothing is written. Live " +
+                "creates it via the scope-aware createRecord op switched to sourceScope, captured in " +
+                "updateSetSysId (must belong to sourceScope), then reads it back and asserts " +
+                "source/target. updateSetSysId is required on the live path; dryRun:true only reports " +
+                "exists / missing.",
+            shape: schemas_1.designAccessSchema.shape,
+            handler: async function (args) {
+                var p = schemas_1.designAccessSchema.parse(args);
+                if (p.dryRun !== true &&
+                    (!p.updateSetSysId || !p.updateSetSysId.trim())) {
+                    throw new Error("design_access: updateSetSysId (an update set in sourceScope) is required on " +
+                        "the live path — set dryRun:true to only check whether the record exists.");
+                }
+                return (0, table_1.ensureDesignAccess)({
+                    client: client(),
+                    sourceScope: p.sourceScope,
+                    targetScope: p.targetScope,
+                    updateSetSysId: p.updateSetSysId,
+                    dryRun: p.dryRun,
+                });
+            },
+        },
         {
             name: "add_index",
             annotations: dovetail_mcp_kit_1.WRITE_OVERWRITE,

package/dist/mcp/schemas.d.ts

@@ -1890,6 +1890,8 @@ export declare var addColumnSchema: z.ZodObject<{
         dependent_on_field?: string | undefined;
     }>;
     scope: z.ZodOptional<z.ZodString>;
+    crossScope: z.ZodOptional<z.ZodBoolean>;
+    ensureDesignAccess: z.ZodOptional<z.ZodBoolean>;
     updateSetSysId: z.ZodOptional<z.ZodString>;
     dryRun: z.ZodOptional<z.ZodBoolean>;
     debug: z.ZodOptional<z.ZodBoolean>;
@@ -1909,6 +1911,8 @@ export declare var addColumnSchema: z.ZodObject<{
     debug?: boolean | undefined;
     updateSetSysId?: string | undefined;
     scope?: string | undefined;
+    crossScope?: boolean | undefined;
+    ensureDesignAccess?: boolean | undefined;
 }, {
     table: string;
     column: {
@@ -1925,6 +1929,24 @@ export declare var addColumnSchema: z.ZodObject<{
     debug?: boolean | undefined;
     updateSetSysId?: string | undefined;
     scope?: string | undefined;
+    crossScope?: boolean | undefined;
+    ensureDesignAccess?: boolean | undefined;
+}>;
+export declare var designAccessSchema: z.ZodObject<{
+    sourceScope: z.ZodString;
+    targetScope: z.ZodString;
+    updateSetSysId: z.ZodOptional<z.ZodString>;
+    dryRun: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    sourceScope: string;
+    targetScope: string;
+    dryRun?: boolean | undefined;
+    updateSetSysId?: string | undefined;
+}, {
+    sourceScope: string;
+    targetScope: string;
+    dryRun?: boolean | undefined;
+    updateSetSysId?: string | undefined;
 }>;
 export declare var addIndexSchema: z.ZodObject<{
     table: z.ZodString;

package/dist/mcp/schemas.js

@@ -4,7 +4,7 @@
  * own file so registry.ts stays focused on wiring.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.invokeRestSchema = exports.publishAppSchema = exports.exportAppSchema = exports.exportUpdateSetSchema = exports.deleteRecordSchema = exports.createRecordSchema = exports.setFieldSchema = exports.setTableSchema = exports.tableAttributesSchema = exports.setColumnSchema = exports.columnAttributesSchema = exports.createIndexSchema = exports.listIndexesSchema = exports.addIndexSchema = exports.addColumnSchema = exports.createTableSchema = exports.columnSpecSchema = exports.hostAssetsSchema = exports.editFlowSchema = exports.defineActionSchema = exports.defineActionSpecSchema = exports.cloneActionSchema = exports.editActionSchema = exports.stepInputPatchSchema = exports.testFlowSchema = exports.createFlowSchema = exports.copyFlowSchema = exports.publishFlowSchema = exports.viewActionSchema = exports.viewFlowSchema = exports.removeChoicesFromFieldSchema = exports.addChoicesToFieldSchema = exports.choiceValueSchema = exports.setRelatedListsSchema = exports.setFormLayoutSchema = exports.formSectionSchema = exports.setListLayoutSchema = exports.createViewSchema = void 0;
+exports.invokeRestSchema = exports.publishAppSchema = exports.exportAppSchema = exports.exportUpdateSetSchema = exports.deleteRecordSchema = exports.createRecordSchema = exports.setFieldSchema = exports.setTableSchema = exports.tableAttributesSchema = exports.setColumnSchema = exports.columnAttributesSchema = exports.createIndexSchema = exports.listIndexesSchema = exports.addIndexSchema = exports.designAccessSchema = exports.addColumnSchema = exports.createTableSchema = exports.columnSpecSchema = exports.hostAssetsSchema = exports.editFlowSchema = exports.defineActionSchema = exports.defineActionSpecSchema = exports.cloneActionSchema = exports.editActionSchema = exports.stepInputPatchSchema = exports.testFlowSchema = exports.createFlowSchema = exports.copyFlowSchema = exports.publishFlowSchema = exports.viewActionSchema = exports.viewFlowSchema = exports.removeChoicesFromFieldSchema = exports.addChoicesToFieldSchema = exports.choiceValueSchema = exports.setRelatedListsSchema = exports.setFormLayoutSchema = exports.formSectionSchema = exports.setListLayoutSchema = exports.createViewSchema = void 0;
 const zod_1 = require("zod");
 exports.createViewSchema = zod_1.z.object({
     name: zod_1.z.string().min(1),
@@ -364,10 +364,27 @@ exports.addColumnSchema = zod_1.z.object({
     table: zod_1.z.string().min(1),
     column: exports.columnSpecSchema,
     scope: zod_1.z.string().optional(),
+    // Explicit opt-in to a column OWNED by `scope` when that differs from the table's
+    // scope (a Journey field on an Automate table). Without it a mismatched scope is
+    // refused — on dryRun and live alike — because that is the classic wrong-scope slip.
+    crossScope: zod_1.z.boolean().optional(),
+    // Cross-scope only: create the missing sys_scope_design_access record (scope -> the
+    // table's scope) first, in the same update set. Without it a missing record is flagged.
+    ensureDesignAccess: zod_1.z.boolean().optional(),
     updateSetSysId: zod_1.z.string().optional(),
     dryRun: zod_1.z.boolean().optional(),
     debug: zod_1.z.boolean().optional(),
 });
+// design_access: ensure the sys_scope_design_access record that lets sourceScope author
+// in targetScope's tables. updateSetSysId (an update set in sourceScope) is optional in
+// the schema because dryRun needs none; the live-path requirement is enforced at the tool
+// boundary (registry.ts), matching add_column.
+exports.designAccessSchema = zod_1.z.object({
+    sourceScope: zod_1.z.string().min(1),
+    targetScope: zod_1.z.string().min(1),
+    updateSetSysId: zod_1.z.string().optional(),
+    dryRun: zod_1.z.boolean().optional(),
+});
 // add-index keeps a column LIST because an index is conceptually multi-column, but the
 // only headless lever (sys_dictionary.unique) is per-COLUMN — so addIndex REFUSES a list
 // longer than one rather than silently building a different index than the one asked for.

package/dist/table/addColumn.d.ts

@@ -16,8 +16,31 @@
  *
  * The scope arg passed to `createRecord` is the scope NAME (e.g. "x_cadso_core"),
  * not the sys_scope sys_id — the server-side changeScope matches on the scope name.
- * A column always belongs to its table's scope, so the name is resolved from the
- * table; an explicit `scope` override must match it.
+ * By default a column belongs to its table's scope, so the name is resolved from the
+ * table and an explicit `scope` override must match it.
+ *
+ * CROSS-SCOPE COLUMNS (`crossScope: true`). ServiceNow lets one app add a column to
+ * another app's table — Studio with app = Journey adding a field to an Automate table
+ * — and prefixes the element with the OWNING scope: `x_cadso_journey_instance_step`
+ * on `x_cadso_automate_email_batch`, dictionary row owned by x_cadso_journey. This is
+ * the column-ownership rule for Tenon's layered apps, so it is supported here as an
+ * explicit opt-in: `scope` names the column's scope, `crossScope: true` acknowledges it
+ * differs from the table's. The insert runs through the same scope-aware op switched
+ * to the COLUMN's scope, so the dictionary row and its update-set capture both land
+ * in the column's scope. Guards, run on dry-run and live alike: the override scope
+ * must exist; the table must allow new fields from other scopes
+ * (`sys_db_object.alter_access`); the update set must belong to the column's scope.
+ * The element is sent already prefixed (`<scope>_<name>`; an already-prefixed name
+ * is accepted as-is) and the element ServiceNow actually stored is read back and
+ * reported, together with a `sys_scope` assertion on the read-back row.
+ *
+ * DESIGN ACCESS. Since the Zurich bw40 hotfix the platform UI also requires a
+ * `sys_scope_design_access` record (source = the column's scope, target = the table's)
+ * before one app may author in another's tables. The headless insert here does not hit
+ * that check, so a missing record does not block the column — but it is FLAGGED on every
+ * cross-scope result (`designAccess`), because the next UI edit of the column, and the
+ * target instance, will. `ensureDesignAccess: true` creates it first, in the same update
+ * set (see ./designAccess.ts).
  *
  * SIZING THE PHYSICAL COLUMN. A max_length carried on the INSERT sets the dictionary
  * row but NOT the column ServiceNow actually builds — it materialises at the platform
@@ -46,8 +69,25 @@ export interface AddColumnParams {
     table: string;
     /** The single column to add. `name` (the element) is optional; derived from label when omitted. */
     column: ColumnSpec;
-    /** Scope name or sys_scope sys_id. Must match the table's own scope (a column lives there). */
+    /**
+     * Scope name or sys_scope sys_id. Must match the table's own scope (a column lives
+     * there) — unless `crossScope` is true, in which case it names the scope that will OWN
+     * the column (e.g. "x_cadso_journey" for a Journey column on an Automate table).
+     */
     scope?: string;
+    /**
+     * Explicit opt-in to a column owned by a different scope than its table. Requires
+     * `scope`. The element is prefixed with the owning scope (`x_cadso_journey_<name>`),
+     * the table must allow new fields from other scopes (sys_db_object.alter_access),
+     * and the update set must belong to the column's scope.
+     */
+    crossScope?: boolean;
+    /**
+     * Cross-scope only: create the sys_scope_design_access record (column scope -> table
+     * scope) when it is missing, captured in the same update set, BEFORE the column insert.
+     * Without it a missing record is only flagged on the result.
+     */
+    ensureDesignAccess?: boolean;
     /** Update set sys_id to capture the insert into. REQUIRED on the live path (dry-run doesn't need it). */
     updateSetSysId?: string;
     /** Emit diagnostic detail in the result note. */
@@ -55,6 +95,21 @@ export interface AddColumnParams {
     /** Plan only — no writes. Pure + deterministic. */
     dryRun?: boolean;
 }
+/** Design Access state for a cross-scope column (absent on a same-scope add). */
+export interface DesignAccessFlag {
+    /** Always true when reported: a cross-scope column needs the record for UI/Studio work. */
+    required: true;
+    /** true = record exists (or was created); false = missing; null = could not be read. */
+    present: boolean | null;
+    /** sys_scope_design_access sys_id ("" when missing / unknown). */
+    sysId: string;
+    /** Authoring scope (the column's owner). */
+    sourceScope: string;
+    /** Table-owning scope. */
+    targetScope: string;
+    /** True when THIS run created the record. */
+    created: boolean;
+}
 export interface AddColumnResult {
     status: "created" | "dry-run" | "failed" | "skipped";
     /** The table's name (resolved; echoes the input on dry-run). */
@@ -67,6 +122,11 @@ export interface AddColumnResult {
     label: string;
     /** Resolved ServiceNow internal_type (friendly -> internal). */
     internalType: string;
+    /**
+     * Scope NAME that owns the column ("" on a network-free dry-run). Equals the table's
+     * scope unless `crossScope` was used, in which case it is the override scope.
+     */
+    scope: string;
     /** sys_id of the sys_dictionary row (the insert's, or the existing row's on "skipped"). */
     columnSysId: string;
     /** Update set the write was captured into ("" on dry-run). */
@@ -75,6 +135,8 @@ export interface AddColumnResult {
     verified: boolean;
     /** Human-readable note (success summary, the read-back result, or the failure body). */
     note: string;
+    /** Cross-scope only: whether the Design Access record the platform UI requires exists. */
+    designAccess?: DesignAccessFlag;
 }
 /**
  * Derive the dictionary element (column name) from a label the way Studio does for
@@ -83,4 +145,9 @@ export interface AddColumnResult {
  * Pass `column.name` explicitly for anything non-trivial.
  */
 export declare function deriveElement(label: string, explicit?: string): string;
+/**
+ * The Design Access sentence appended to a cross-scope result's note ("" when none).
+ * Exported for tests.
+ */
+export declare function designAccessNote(da: DesignAccessFlag | undefined, ensureRequested: boolean, isDryRun: boolean): string;
 export declare function addColumn(params: AddColumnParams): Promise<AddColumnResult>;