@tenonhq/dovetail-servicenow 0.0.49 → 0.0.50

package/README.md

@@ -1154,7 +1154,14 @@ Claude Code and agents: `create_view`, `set_list_layout`, `set_form_layout`,
 `add_column` (same-scope by default; `crossScope: true` with `scope` adds a column OWNED
 by another app — a Journey field on an Automate table, element `<scope>_<name>` —
 guarded by `sys_db_object.alter_access` and the update set's scope, with the stored
-element and `sys_scope` read back; the CLI flag is `--cross-scope`) /
+element and `sys_scope` read back; the CLI flag is `--cross-scope`. A cross-scope
+result also carries `designAccess`: the platform UI refuses cross-scope authoring
+without a `sys_scope_design_access` record (column scope -> table scope), so a missing
+one is FLAGGED — not blocking, the headless insert works without it — and
+`ensureDesignAccess: true` / `--ensure-design-access` creates it first in the same
+update set) / `design_access` (ensure that record on its own — idempotent, created in
+the SOURCE app's update set and read back; CLI `dove-sn design-access --source <app>
+--target <app> --update-set <sys_id>`, `--dry-run` only reports exists/missing) /
 `add_index` (a single-column unique index via `sys_dictionary.unique`,
 read back from the `v_db_index` view - uniqueness enforcement is always reported
 unverified) / `index_list` (read-only: a table's database indexes from `v_db_index`,

package/dist/cli.js

@@ -1340,15 +1340,60 @@ async function runCreateTable(flags) {
         return 2;
     return 0;
 }
+/**
+ * dove-sn design-access:
+ *   --source x_cadso_journey --target x_cadso_automate
+ *   [--update-set <sys_id in source>] [--dry-run] [--json]
+ * Ensures the sys_scope_design_access record that lets the SOURCE app author in the
+ * TARGET app's tables (required by the platform UI for cross-scope columns). Idempotent;
+ * --dry-run only reports whether it exists. --update-set is required unless --dry-run.
+ */
+async function runDesignAccess(flags) {
+    if (!flags.source || !flags.target) {
+        process.stderr.write("design-access: --source (authoring app) and --target (app that owns the tables) are required\n");
+        return 1;
+    }
+    var isDryRun = flags["dry-run"] === "true";
+    if (!isDryRun && !flags["update-set"]) {
+        process.stderr.write("design-access: --update-set (an update set in --source) is required on the live path (only --dry-run works without one)\n");
+        return 1;
+    }
+    var result = await (0, table_1.ensureDesignAccess)({
+        client: (0, client_1.createClient)({}),
+        sourceScope: flags.source,
+        targetScope: flags.target,
+        updateSetSysId: flags["update-set"],
+        dryRun: isDryRun,
+    });
+    if (flags.json === "true") {
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+    }
+    else {
+        process.stdout.write("[" +
+            result.status +
+            "] " +
+            result.sourceScope +
+            " -> " +
+            result.targetScope +
+            (result.sysId ? " (" + result.sysId + ")" : "") +
+            "\n" +
+            result.note +
+            "\n");
+    }
+    if (result.status === "failed")
+        return 2;
+    return 0;
+}
 /**
  * dove-sn add-column:
  *   --table x_cadso_journey --label URL --type url
  *   [--name url] [--max-length 1024] [--reference <table>]
  *   [--mandatory] [--default <value>] [--dependent-on-field <element>]
- *   [--scope x_cadso_journey] [--cross-scope] [--update-set <sys_id>]
- *   [--from-json <spec.json>] [--dry-run] [--debug] [--json]
+ *   [--scope x_cadso_journey] [--cross-scope] [--ensure-design-access]
+ *   [--update-set <sys_id>] [--from-json <spec.json>] [--dry-run] [--debug] [--json]
  * --update-set is required unless --dry-run. --cross-scope opts in to a column
- * OWNED by --scope when that differs from the table's scope.
+ * OWNED by --scope when that differs from the table's scope; a missing Design Access
+ * record is flagged, and --ensure-design-access creates it first.
  */
 async function runAddColumn(flags) {
     var spec = {};
@@ -1388,6 +1433,10 @@ async function runAddColumn(flags) {
     if (flags["cross-scope"] === "true" || spec.crossScope === true) {
         params.crossScope = true;
     }
+    if (flags["ensure-design-access"] === "true" ||
+        spec.ensureDesignAccess === true) {
+        params.ensureDesignAccess = true;
+    }
     var us = flags["update-set"] || spec.updateSetSysId;
     if (us)
         params.updateSetSysId = us;
@@ -2616,6 +2665,9 @@ async function dispatch(parsed) {
     if (parsed.command === "add-column") {
         return await runAddColumn(parsed.flags);
     }
+    if (parsed.command === "design-access") {
+        return await runDesignAccess(parsed.flags);
+    }
     if (parsed.command === "add-index") {
         return await runAddIndex(parsed.flags);
     }

package/dist/cliUsage.js

@@ -209,6 +209,10 @@ exports.VERB_USAGE = {
                 flag: "cross-scope",
                 note: "Opt in to a column OWNED by --scope, which differs from the table's scope (element becomes <scope>_<name>; the table must allow new fields; --update-set must be in --scope).",
             },
+            {
+                flag: "ensure-design-access",
+                note: "Cross-scope only: create the missing sys_scope_design_access record (--scope -> table's scope) first, in the same update set. Without it a missing record is only flagged.",
+            },
             { flag: "update-set", value: "<sys_id>", note: "REQUIRED on the live path (only --dry-run works without one)." },
             DRY_RUN_FLAG,
             DEBUG_FLAG,
@@ -222,6 +226,26 @@ exports.VERB_USAGE = {
             "Cross-scope: dove-sn add-column --table x_cadso_automate_email_batch --label 'Instance Step' --name instance_step --type reference --reference x_cadso_journey_instance_step --scope x_cadso_journey --cross-scope --update-set <journey set>",
         ],
     },
+    "design-access": {
+        summary: "Ensure the sys_scope_design_access record that lets one app author in another app's tables (required by the UI for cross-scope columns)",
+        required: [
+            { flag: "source", value: "<x_scope>", note: "The AUTHORING app (owns the record and its update set)." },
+            { flag: "target", value: "<x_scope>", note: "The app that OWNS the tables." },
+        ],
+        optional: [
+            { flag: "update-set", value: "<sys_id>", note: "Update set in --source. REQUIRED on the live path." },
+            DRY_RUN_FLAG,
+            JSON_FLAG,
+        ],
+        gate: "dry-run-flag",
+        gateNote: "--update-set is required unless --dry-run; --dry-run reports exists/missing only.",
+        example: "dove-sn design-access --source x_cadso_journey --target x_cadso_automate --update-set <journey set>",
+        notes: [
+            "Idempotent: an existing record is reported and nothing is written.",
+            "Symptom it fixes: \"Invalid 'Table' selected on the Dictionary Entry record ... can only select '<app>' tables with read access enabled\" — the table's own access flags are NOT the gate.",
+            "Exit 2 when the record could not be created or verified on read-back.",
+        ],
+    },
     "set-column": {
         summary: "Update an EXISTING column's schema (label/mandatory/default/read-only/max-length/dependent-on-field), then verify",
         required: [

package/dist/index.d.ts

@@ -21,8 +21,8 @@ export { sincPlugin } from "./plugin";
 export { listTemplates, verifyArtifact, cloneSubflow, cloneActionType, resolveScope, slugInternalName, fetchActionSteps, findStepInput, triggerPublication, publishActionType, editActionType, defineActionType, planActionDefinition, validateDefineSpec, applyStepOps, verifySteps, summarizeSteps, formatStepPill, readFlow, readActionType, publishFlow, copyFlow, createFlow, buildPublishModel, editFlow, testFlow, DEFAULT_RUN_FLOW_PATH, generateSysId, topoSort, executeWritePlan, WriteOrderError, } from "./flowDesigner";
 export type { TemplateRef, ListTemplatesParams, FlowKind, VerifyExpect, VerifyFound, VerifyFailure, VerifyReport, VerifyArtifactParams, CloneSubflowParams, CloneSubflowResult, CloneActionTypeParams, CloneActionTypeResult, CloneActionTypePlan, CloneActionTypeStepReport, TriggerPublicationParams, TriggerPublicationResult, PublishActionTypeParams, PublishActionTypeResult, EditActionTypeParams, EditActionTypeResult, EditActionTypeOps, DefineActionSpec, DefineActionInputSpec, DefineActionOutputSpec, DefineStepSpec, DefineStepVarSpec, DefineStepOutputSpec, DefineStepValue, DefineActionTypeParams, DefineActionTypeResult, DefineActionDiff, DefineActionPlan, PlanActionDefinitionParams, ActionView, StepView, StepOps, StepRecord, StepSummary, StepIoSummary, PatchStepScriptOp, SetStepInputOp, AddStepOutputOp, AddStepInputOp, ApplyStepOpsResult, VerifyStepsResult, ReadFlowParams, ReadFlowResult, FlowStep, FlowVariable, ReadActionTypeParams, ReadActionTypeResult, ActionIo, PublishFlowParams, PublishFlowResult, CopyFlowParams, CopyFlowResult, CreateFlowParams, CreateFlowResult, EditFlowParams, EditFlowResult, EditFlowOps, StepInputPatch, TestFlowParams, TestFlowResult, WriteOp, WriteOpResult, } from "./flowDesigner";
 export type { ServiceNowClientConfig, ChoiceValue, ChoiceType, AddChoicesParams, AddChoicesResult, ChoiceActionResult, ChoiceFieldRef, RemoveChoicesParams, RemoveChoicesResult, ChoiceRemovalResult, DictionaryRecord, UpdateSetRecord, LayoutAction, LayoutRecordResult, LayoutResult, CreateViewParams, CreateViewResult, FormSectionSpec, SetFormLayoutParams, SetListLayoutParams, SetRelatedListsParams, ChunkRole, ChunkInfo, ChunkResult, PrunedResult, HostAssetsParams, HostAssetsResult, } from "./types";
-export { createTable, projectTableGraph, buildColumnXml, normalizeColumns, resolveType, applyTableSaveOverlay, defaultAccessFlags, TYPE_MAP, DEFAULT_SUPER_CLASS, DEFAULT_SAVE_ACTION, addColumn, deriveElement, addIndex, parseIndexColumns, indexMatchesColumns, listIndexes, createIndex, validateCreateIndex, DEFAULT_INDEX_FORM_PATH, NOT_IN_UPDATE_SET, setColumn, resolveAttributes, toStoredValue, setTable, resolveTableAttributes, } from "./table";
-export type { CreateTableParams, CreateTableResult, AddColumnParams, AddColumnResult, AddIndexParams, AddIndexResult, AddIndexVerification, ListIndexesParams, ListIndexesResult, TableIndex, CreateIndexParams, CreateIndexResult, SetColumnParams, SetColumnResult, ColumnAttributes, AttributeChange, SetTableParams, SetTableResult, TableAttributes, TableGraph, NormalizedColumn, ColumnSpec, AccessFlags, OverlaySpec, } from "./table";
+export { createTable, projectTableGraph, buildColumnXml, normalizeColumns, resolveType, applyTableSaveOverlay, defaultAccessFlags, TYPE_MAP, DEFAULT_SUPER_CLASS, DEFAULT_SAVE_ACTION, addColumn, deriveElement, ensureDesignAccess, findDesignAccess, DESIGN_ACCESS_TABLE, addIndex, parseIndexColumns, indexMatchesColumns, listIndexes, createIndex, validateCreateIndex, DEFAULT_INDEX_FORM_PATH, NOT_IN_UPDATE_SET, setColumn, resolveAttributes, toStoredValue, setTable, resolveTableAttributes, } from "./table";
+export type { CreateTableParams, CreateTableResult, AddColumnParams, AddColumnResult, DesignAccessFlag, EnsureDesignAccessParams, EnsureDesignAccessResult, AddIndexParams, AddIndexResult, AddIndexVerification, ListIndexesParams, ListIndexesResult, TableIndex, CreateIndexParams, CreateIndexResult, SetColumnParams, SetColumnResult, ColumnAttributes, AttributeChange, SetTableParams, SetTableResult, TableAttributes, TableGraph, NormalizedColumn, ColumnSpec, AccessFlags, OverlaySpec, } from "./table";
 export { setField } from "./setField";
 export { createRecord } from "./createRecord";
 export type { RecordWriteResult, SetFieldParams, SetFieldResult, } from "./setField";

package/dist/index.js

@@ -7,8 +7,8 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.editFlow = exports.buildPublishModel = exports.createFlow = exports.copyFlow = exports.publishFlow = exports.readActionType = exports.readFlow = exports.formatStepPill = exports.summarizeSteps = exports.verifySteps = exports.applyStepOps = exports.validateDefineSpec = exports.planActionDefinition = exports.defineActionType = exports.editActionType = exports.publishActionType = exports.triggerPublication = exports.findStepInput = exports.fetchActionSteps = exports.slugInternalName = exports.resolveScope = exports.cloneActionType = exports.cloneSubflow = exports.verifyArtifact = exports.listTemplates = exports.sincPlugin = exports.formatCreateViewResult = exports.formatLayoutResult = exports.setRelatedLists = exports.setFormLayout = exports.setListLayout = exports.createView = exports.formatRemoveChoicesResult = exports.formatAddChoicesResult = exports.formatHostAssetsResult = exports.classifyChunks = exports.hostAssets = exports.ChoiceWriteError = exports.removeChoicesFromField = exports.addChoicesToField = exports.resolveConfigFromEnvFile = exports.createClientFromEnvFile = exports.assertWriteAllowed = exports.evaluateWriteGate = exports.isCiEnvironment = exports.resolveExecutionContext = exports.PROCESSFLOW_PATH_PREFIX = exports.isProcessflowPath = exports.resolveFlowAuth = exports.createClient = void 0;
-exports.parseProgressTree = exports.parseXmlAnswer = exports.PUBLISH_TARGETS = exports.parsePublishTargets = exports.describeTarget = exports.resolveUpdateSetNaming = exports.buildPublishToUpdateSetFields = exports.buildCreateUpdateSetFields = exports.buildStartFields = exports.publishApp = exports.INVOKE_REST_METHODS = exports.invokeRest = exports.verifyReadBack = exports.readBackMatches = exports.hasHtmlEntity = exports.decodeHtmlEntities = exports.deleteRecord = exports.createRecord = exports.setField = exports.resolveTableAttributes = exports.setTable = exports.toStoredValue = exports.resolveAttributes = exports.setColumn = exports.NOT_IN_UPDATE_SET = exports.DEFAULT_INDEX_FORM_PATH = exports.validateCreateIndex = exports.createIndex = exports.listIndexes = exports.indexMatchesColumns = exports.parseIndexColumns = exports.addIndex = exports.deriveElement = exports.addColumn = exports.DEFAULT_SAVE_ACTION = exports.DEFAULT_SUPER_CLASS = exports.TYPE_MAP = exports.defaultAccessFlags = exports.applyTableSaveOverlay = exports.resolveType = exports.normalizeColumns = exports.buildColumnXml = exports.projectTableGraph = exports.createTable = exports.WriteOrderError = exports.executeWritePlan = exports.topoSort = exports.generateSysId = exports.DEFAULT_RUN_FLOW_PATH = exports.testFlow = void 0;
-exports.SECRET_INTERNAL_TYPES = exports.SENTINEL = exports.isCapturable = exports.secretFieldsFromDictionary = exports.mergeSecretRules = exports.loadSecretRules = exports.defaultSecretRules = exports.escapeRegExp = exports.encodeXmlText = exports.encodeXmlEntities = exports.stripJsonValue = exports.stripField = exports.plannedStrips = exports.recordFieldNames = exports.readRecordTable = exports.readField = exports.verifyStripped = exports.stripSecrets = exports.DEFAULT_EXPORT_APP_TIMEOUT_MS = exports.buildPublishFields = exports.buildCreateSetFields = exports.exportApp = exports.DEFAULT_MAX_ROWS = exports.MAX_PAGE_SIZE = exports.DEFAULT_PAGE_SIZE = exports.UPDATE_XML_FIELDS = exports.xmlEscape = exports.formatUnloadDate = exports.parseStatsCount = exports.refreshTypeFields = exports.fetchUpdateXmlRows = exports.countUpdateXml = exports.countUnloadRecords = exports.renderUnload = exports.renderRemoteUpdateSet = exports.renderUpdateXmlRow = exports.exportUpdateSet = exports.PUBLISH_POLL_DELAYS_MS = exports.DEFAULT_PUBLISH_TIMEOUT_MS = exports.parseCicdProgress = exports.parseCicdPublishResponse = exports.harvestProgressResults = exports.flattenSteps = exports.classifyProgress = void 0;
+exports.parsePublishTargets = exports.describeTarget = exports.resolveUpdateSetNaming = exports.buildPublishToUpdateSetFields = exports.buildCreateUpdateSetFields = exports.buildStartFields = exports.publishApp = exports.INVOKE_REST_METHODS = exports.invokeRest = exports.verifyReadBack = exports.readBackMatches = exports.hasHtmlEntity = exports.decodeHtmlEntities = exports.deleteRecord = exports.createRecord = exports.setField = exports.resolveTableAttributes = exports.setTable = exports.toStoredValue = exports.resolveAttributes = exports.setColumn = exports.NOT_IN_UPDATE_SET = exports.DEFAULT_INDEX_FORM_PATH = exports.validateCreateIndex = exports.createIndex = exports.listIndexes = exports.indexMatchesColumns = exports.parseIndexColumns = exports.addIndex = exports.DESIGN_ACCESS_TABLE = exports.findDesignAccess = exports.ensureDesignAccess = exports.deriveElement = exports.addColumn = exports.DEFAULT_SAVE_ACTION = exports.DEFAULT_SUPER_CLASS = exports.TYPE_MAP = exports.defaultAccessFlags = exports.applyTableSaveOverlay = exports.resolveType = exports.normalizeColumns = exports.buildColumnXml = exports.projectTableGraph = exports.createTable = exports.WriteOrderError = exports.executeWritePlan = exports.topoSort = exports.generateSysId = exports.DEFAULT_RUN_FLOW_PATH = exports.testFlow = void 0;
+exports.SECRET_INTERNAL_TYPES = exports.SENTINEL = exports.isCapturable = exports.secretFieldsFromDictionary = exports.mergeSecretRules = exports.loadSecretRules = exports.defaultSecretRules = exports.escapeRegExp = exports.encodeXmlText = exports.encodeXmlEntities = exports.stripJsonValue = exports.stripField = exports.plannedStrips = exports.recordFieldNames = exports.readRecordTable = exports.readField = exports.verifyStripped = exports.stripSecrets = exports.DEFAULT_EXPORT_APP_TIMEOUT_MS = exports.buildPublishFields = exports.buildCreateSetFields = exports.exportApp = exports.DEFAULT_MAX_ROWS = exports.MAX_PAGE_SIZE = exports.DEFAULT_PAGE_SIZE = exports.UPDATE_XML_FIELDS = exports.xmlEscape = exports.formatUnloadDate = exports.parseStatsCount = exports.refreshTypeFields = exports.fetchUpdateXmlRows = exports.countUpdateXml = exports.countUnloadRecords = exports.renderUnload = exports.renderRemoteUpdateSet = exports.renderUpdateXmlRow = exports.exportUpdateSet = exports.PUBLISH_POLL_DELAYS_MS = exports.DEFAULT_PUBLISH_TIMEOUT_MS = exports.parseCicdProgress = exports.parseCicdPublishResponse = exports.harvestProgressResults = exports.flattenSteps = exports.classifyProgress = exports.parseProgressTree = exports.parseXmlAnswer = exports.PUBLISH_TARGETS = void 0;
 var client_1 = require("./client");
 Object.defineProperty(exports, "createClient", { enumerable: true, get: function () { return client_1.createClient; } });
 Object.defineProperty(exports, "resolveFlowAuth", { enumerable: true, get: function () { return client_1.resolveFlowAuth; } });
@@ -91,6 +91,9 @@ Object.defineProperty(exports, "DEFAULT_SUPER_CLASS", { enumerable: true, get: f
 Object.defineProperty(exports, "DEFAULT_SAVE_ACTION", { enumerable: true, get: function () { return table_1.DEFAULT_SAVE_ACTION; } });
 Object.defineProperty(exports, "addColumn", { enumerable: true, get: function () { return table_1.addColumn; } });
 Object.defineProperty(exports, "deriveElement", { enumerable: true, get: function () { return table_1.deriveElement; } });
+Object.defineProperty(exports, "ensureDesignAccess", { enumerable: true, get: function () { return table_1.ensureDesignAccess; } });
+Object.defineProperty(exports, "findDesignAccess", { enumerable: true, get: function () { return table_1.findDesignAccess; } });
+Object.defineProperty(exports, "DESIGN_ACCESS_TABLE", { enumerable: true, get: function () { return table_1.DESIGN_ACCESS_TABLE; } });
 Object.defineProperty(exports, "addIndex", { enumerable: true, get: function () { return table_1.addIndex; } });
 Object.defineProperty(exports, "parseIndexColumns", { enumerable: true, get: function () { return table_1.parseIndexColumns; } });
 Object.defineProperty(exports, "indexMatchesColumns", { enumerable: true, get: function () { return table_1.indexMatchesColumns; } });

package/dist/mcp/registry.d.ts

@@ -10,7 +10,7 @@ import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 import type { ToolAnnotations } from "@tenonhq/dovetail-mcp-kit";
 import type { ServiceNowClient } from "../client";
-export declare var TOOL_NAMES: readonly ["create_view", "set_list_layout", "set_form_layout", "set_related_lists", "add_choices_to_field", "remove_choices_from_field", "flow_view", "action_view", "action_edit", "action_clone", "action_define", "flow_publish", "flow_copy", "flow_create", "flow_test", "flow_edit", "create_table", "add_column", "add_index", "index_list", "index_create", "set_column", "set_table", "set_field", "create_record", "delete_record", "host_assets", "invoke_rest", "app_publish", "update_set_export", "app_export"];
+export declare var TOOL_NAMES: readonly ["create_view", "set_list_layout", "set_form_layout", "set_related_lists", "add_choices_to_field", "remove_choices_from_field", "flow_view", "action_view", "action_edit", "action_clone", "action_define", "flow_publish", "flow_copy", "flow_create", "flow_test", "flow_edit", "create_table", "add_column", "design_access", "add_index", "index_list", "index_create", "set_column", "set_table", "set_field", "create_record", "delete_record", "host_assets", "invoke_rest", "app_publish", "update_set_export", "app_export"];
 export type ToolName = (typeof TOOL_NAMES)[number];
 export interface RegistryDeps {
     /** Optional client injection for tests; defaults to createClient({}). */

package/dist/mcp/registry.js

@@ -57,6 +57,7 @@ exports.TOOL_NAMES = [
     "flow_edit",
     "create_table",
     "add_column",
+    "design_access",
     "add_index",
     "index_list",
     "index_create",
@@ -445,7 +446,11 @@ function buildDescriptors(deps = {}) {
                 "<scope>_<name>, the dictionary row and its update-set capture land in scope); the table " +
                 "must allow new fields from other scopes (sys_db_object.alter_access) and updateSetSysId " +
                 "must belong to scope — both checked on dryRun too, and the stored element + sys_scope are " +
-                "read back. updateSetSysId is required on the live path. dryRun:true returns the plan with " +
+                "read back. A cross-scope result carries designAccess { present, sysId, created }: the " +
+                "platform UI refuses cross-scope authoring without a sys_scope_design_access record " +
+                "(scope -> the table's scope), so a missing one is FLAGGED (not blocking — the headless " +
+                "insert works without it); ensureDesignAccess:true creates it first in the same update " +
+                "set. updateSetSysId is required on the live path. dryRun:true returns the plan with " +
                 "no writes.",
             shape: schemas_1.addColumnSchema.shape,
             handler: async function (args) {
@@ -465,12 +470,43 @@ function buildDescriptors(deps = {}) {
                     column: p.column,
                     scope: p.scope,
                     crossScope: p.crossScope,
+                    ensureDesignAccess: p.ensureDesignAccess,
                     updateSetSysId: p.updateSetSysId,
                     dryRun: p.dryRun,
                     debug: p.debug,
                 });
             },
         },
+        {
+            name: "design_access",
+            annotations: dovetail_mcp_kit_1.WRITE_CREATE,
+            description: "Ensure the sys_scope_design_access record that lets sourceScope (the AUTHORING app) " +
+                "design in targetScope's tables (the app that OWNS them). The platform UI requires it " +
+                "for cross-scope columns — the symptom is \"Invalid 'Table' selected on the Dictionary " +
+                "Entry record ... can only select '<app>' tables with read access enabled\", and the " +
+                "table's own access flags are NOT the gate. Scopes are names or sys_scope sys_ids. " +
+                "Idempotent: an existing record returns status 'exists' and nothing is written. Live " +
+                "creates it via the scope-aware createRecord op switched to sourceScope, captured in " +
+                "updateSetSysId (must belong to sourceScope), then reads it back and asserts " +
+                "source/target. updateSetSysId is required on the live path; dryRun:true only reports " +
+                "exists / missing.",
+            shape: schemas_1.designAccessSchema.shape,
+            handler: async function (args) {
+                var p = schemas_1.designAccessSchema.parse(args);
+                if (p.dryRun !== true &&
+                    (!p.updateSetSysId || !p.updateSetSysId.trim())) {
+                    throw new Error("design_access: updateSetSysId (an update set in sourceScope) is required on " +
+                        "the live path — set dryRun:true to only check whether the record exists.");
+                }
+                return (0, table_1.ensureDesignAccess)({
+                    client: client(),
+                    sourceScope: p.sourceScope,
+                    targetScope: p.targetScope,
+                    updateSetSysId: p.updateSetSysId,
+                    dryRun: p.dryRun,
+                });
+            },
+        },
         {
             name: "add_index",
             annotations: dovetail_mcp_kit_1.WRITE_OVERWRITE,

package/dist/mcp/schemas.d.ts

@@ -1891,6 +1891,7 @@ export declare var addColumnSchema: z.ZodObject<{
     }>;
     scope: z.ZodOptional<z.ZodString>;
     crossScope: z.ZodOptional<z.ZodBoolean>;
+    ensureDesignAccess: z.ZodOptional<z.ZodBoolean>;
     updateSetSysId: z.ZodOptional<z.ZodString>;
     dryRun: z.ZodOptional<z.ZodBoolean>;
     debug: z.ZodOptional<z.ZodBoolean>;
@@ -1911,6 +1912,7 @@ export declare var addColumnSchema: z.ZodObject<{
     updateSetSysId?: string | undefined;
     scope?: string | undefined;
     crossScope?: boolean | undefined;
+    ensureDesignAccess?: boolean | undefined;
 }, {
     table: string;
     column: {
@@ -1928,6 +1930,23 @@ export declare var addColumnSchema: z.ZodObject<{
     updateSetSysId?: string | undefined;
     scope?: string | undefined;
     crossScope?: boolean | undefined;
+    ensureDesignAccess?: boolean | undefined;
+}>;
+export declare var designAccessSchema: z.ZodObject<{
+    sourceScope: z.ZodString;
+    targetScope: z.ZodString;
+    updateSetSysId: z.ZodOptional<z.ZodString>;
+    dryRun: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    sourceScope: string;
+    targetScope: string;
+    dryRun?: boolean | undefined;
+    updateSetSysId?: string | undefined;
+}, {
+    sourceScope: string;
+    targetScope: string;
+    dryRun?: boolean | undefined;
+    updateSetSysId?: string | undefined;
 }>;
 export declare var addIndexSchema: z.ZodObject<{
     table: z.ZodString;

package/dist/mcp/schemas.js

@@ -4,7 +4,7 @@
  * own file so registry.ts stays focused on wiring.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.invokeRestSchema = exports.publishAppSchema = exports.exportAppSchema = exports.exportUpdateSetSchema = exports.deleteRecordSchema = exports.createRecordSchema = exports.setFieldSchema = exports.setTableSchema = exports.tableAttributesSchema = exports.setColumnSchema = exports.columnAttributesSchema = exports.createIndexSchema = exports.listIndexesSchema = exports.addIndexSchema = exports.addColumnSchema = exports.createTableSchema = exports.columnSpecSchema = exports.hostAssetsSchema = exports.editFlowSchema = exports.defineActionSchema = exports.defineActionSpecSchema = exports.cloneActionSchema = exports.editActionSchema = exports.stepInputPatchSchema = exports.testFlowSchema = exports.createFlowSchema = exports.copyFlowSchema = exports.publishFlowSchema = exports.viewActionSchema = exports.viewFlowSchema = exports.removeChoicesFromFieldSchema = exports.addChoicesToFieldSchema = exports.choiceValueSchema = exports.setRelatedListsSchema = exports.setFormLayoutSchema = exports.formSectionSchema = exports.setListLayoutSchema = exports.createViewSchema = void 0;
+exports.invokeRestSchema = exports.publishAppSchema = exports.exportAppSchema = exports.exportUpdateSetSchema = exports.deleteRecordSchema = exports.createRecordSchema = exports.setFieldSchema = exports.setTableSchema = exports.tableAttributesSchema = exports.setColumnSchema = exports.columnAttributesSchema = exports.createIndexSchema = exports.listIndexesSchema = exports.addIndexSchema = exports.designAccessSchema = exports.addColumnSchema = exports.createTableSchema = exports.columnSpecSchema = exports.hostAssetsSchema = exports.editFlowSchema = exports.defineActionSchema = exports.defineActionSpecSchema = exports.cloneActionSchema = exports.editActionSchema = exports.stepInputPatchSchema = exports.testFlowSchema = exports.createFlowSchema = exports.copyFlowSchema = exports.publishFlowSchema = exports.viewActionSchema = exports.viewFlowSchema = exports.removeChoicesFromFieldSchema = exports.addChoicesToFieldSchema = exports.choiceValueSchema = exports.setRelatedListsSchema = exports.setFormLayoutSchema = exports.formSectionSchema = exports.setListLayoutSchema = exports.createViewSchema = void 0;
 const zod_1 = require("zod");
 exports.createViewSchema = zod_1.z.object({
     name: zod_1.z.string().min(1),
@@ -368,10 +368,23 @@ exports.addColumnSchema = zod_1.z.object({
     // scope (a Journey field on an Automate table). Without it a mismatched scope is
     // refused — on dryRun and live alike — because that is the classic wrong-scope slip.
     crossScope: zod_1.z.boolean().optional(),
+    // Cross-scope only: create the missing sys_scope_design_access record (scope -> the
+    // table's scope) first, in the same update set. Without it a missing record is flagged.
+    ensureDesignAccess: zod_1.z.boolean().optional(),
     updateSetSysId: zod_1.z.string().optional(),
     dryRun: zod_1.z.boolean().optional(),
     debug: zod_1.z.boolean().optional(),
 });
+// design_access: ensure the sys_scope_design_access record that lets sourceScope author
+// in targetScope's tables. updateSetSysId (an update set in sourceScope) is optional in
+// the schema because dryRun needs none; the live-path requirement is enforced at the tool
+// boundary (registry.ts), matching add_column.
+exports.designAccessSchema = zod_1.z.object({
+    sourceScope: zod_1.z.string().min(1),
+    targetScope: zod_1.z.string().min(1),
+    updateSetSysId: zod_1.z.string().optional(),
+    dryRun: zod_1.z.boolean().optional(),
+});
 // add-index keeps a column LIST because an index is conceptually multi-column, but the
 // only headless lever (sys_dictionary.unique) is per-COLUMN — so addIndex REFUSES a list
 // longer than one rather than silently building a different index than the one asked for.

package/dist/table/addColumn.d.ts

@@ -34,6 +34,14 @@
  * is accepted as-is) and the element ServiceNow actually stored is read back and
  * reported, together with a `sys_scope` assertion on the read-back row.
  *
+ * DESIGN ACCESS. Since the Zurich bw40 hotfix the platform UI also requires a
+ * `sys_scope_design_access` record (source = the column's scope, target = the table's)
+ * before one app may author in another's tables. The headless insert here does not hit
+ * that check, so a missing record does not block the column — but it is FLAGGED on every
+ * cross-scope result (`designAccess`), because the next UI edit of the column, and the
+ * target instance, will. `ensureDesignAccess: true` creates it first, in the same update
+ * set (see ./designAccess.ts).
+ *
  * SIZING THE PHYSICAL COLUMN. A max_length carried on the INSERT sets the dictionary
  * row but NOT the column ServiceNow actually builds — it materialises at the platform
  * default regardless. An insert declaring string(4000) therefore leaves a varchar(255)
@@ -74,6 +82,12 @@ export interface AddColumnParams {
      * and the update set must belong to the column's scope.
      */
     crossScope?: boolean;
+    /**
+     * Cross-scope only: create the sys_scope_design_access record (column scope -> table
+     * scope) when it is missing, captured in the same update set, BEFORE the column insert.
+     * Without it a missing record is only flagged on the result.
+     */
+    ensureDesignAccess?: boolean;
     /** Update set sys_id to capture the insert into. REQUIRED on the live path (dry-run doesn't need it). */
     updateSetSysId?: string;
     /** Emit diagnostic detail in the result note. */
@@ -81,6 +95,21 @@ export interface AddColumnParams {
     /** Plan only — no writes. Pure + deterministic. */
     dryRun?: boolean;
 }
+/** Design Access state for a cross-scope column (absent on a same-scope add). */
+export interface DesignAccessFlag {
+    /** Always true when reported: a cross-scope column needs the record for UI/Studio work. */
+    required: true;
+    /** true = record exists (or was created); false = missing; null = could not be read. */
+    present: boolean | null;
+    /** sys_scope_design_access sys_id ("" when missing / unknown). */
+    sysId: string;
+    /** Authoring scope (the column's owner). */
+    sourceScope: string;
+    /** Table-owning scope. */
+    targetScope: string;
+    /** True when THIS run created the record. */
+    created: boolean;
+}
 export interface AddColumnResult {
     status: "created" | "dry-run" | "failed" | "skipped";
     /** The table's name (resolved; echoes the input on dry-run). */
@@ -106,6 +135,8 @@ export interface AddColumnResult {
     verified: boolean;
     /** Human-readable note (success summary, the read-back result, or the failure body). */
     note: string;
+    /** Cross-scope only: whether the Design Access record the platform UI requires exists. */
+    designAccess?: DesignAccessFlag;
 }
 /**
  * Derive the dictionary element (column name) from a label the way Studio does for
@@ -114,4 +145,9 @@ export interface AddColumnResult {
  * Pass `column.name` explicitly for anything non-trivial.
  */
 export declare function deriveElement(label: string, explicit?: string): string;
+/**
+ * The Design Access sentence appended to a cross-scope result's note ("" when none).
+ * Exported for tests.
+ */
+export declare function designAccessNote(da: DesignAccessFlag | undefined, ensureRequested: boolean, isDryRun: boolean): string;
 export declare function addColumn(params: AddColumnParams): Promise<AddColumnResult>;

package/dist/table/addColumn.js

@@ -35,6 +35,14 @@
  * is accepted as-is) and the element ServiceNow actually stored is read back and
  * reported, together with a `sys_scope` assertion on the read-back row.
  *
+ * DESIGN ACCESS. Since the Zurich bw40 hotfix the platform UI also requires a
+ * `sys_scope_design_access` record (source = the column's scope, target = the table's)
+ * before one app may author in another's tables. The headless insert here does not hit
+ * that check, so a missing record does not block the column — but it is FLAGGED on every
+ * cross-scope result (`designAccess`), because the next UI edit of the column, and the
+ * target instance, will. `ensureDesignAccess: true` creates it first, in the same update
+ * set (see ./designAccess.ts).
+ *
  * SIZING THE PHYSICAL COLUMN. A max_length carried on the INSERT sets the dictionary
  * row but NOT the column ServiceNow actually builds — it materialises at the platform
  * default regardless. An insert declaring string(4000) therefore leaves a varchar(255)
@@ -55,9 +63,11 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.deriveElement = deriveElement;
+exports.designAccessNote = designAccessNote;
 exports.addColumn = addColumn;
 const setField_1 = require("../setField");
 const buildTableSave_1 = require("./buildTableSave");
+const designAccess_1 = require("./designAccess");
 var SYS_ID = /^[0-9a-f]{32}$/i;
 /** Patch dependent_on_field on a sys_dictionary row, captured in the given update set. */
 async function setDependentOnField(client, columnSysId, updateSetSysId, dependentOnField) {
@@ -262,12 +272,35 @@ async function planColumnScope(client, params, element) {
     // element; an already-prefixed name is accepted as-is.
     var prefix = owner.name + "_";
     var prefixed = element.indexOf(prefix) === 0 ? element : prefix + element;
+    // Flag — never block on — the Design Access record the platform UI requires. A read
+    // failure is reported as UNKNOWN (null), not as missing: a blind check is not evidence.
+    var present = null;
+    var daSysId = "";
+    try {
+        daSysId = await (0, designAccess_1.findDesignAccess)({
+            client: client,
+            sourceScopeSysId: owner.sysId,
+            targetScopeSysId: resolved.scopeSysId,
+        });
+        present = daSysId !== "";
+    }
+    catch (e) {
+        present = null;
+    }
     return {
         resolved: resolved,
         scopeName: owner.name,
         scopeSysId: owner.sysId,
         crossScope: true,
         element: prefixed,
+        designAccess: {
+            required: true,
+            present: present,
+            sysId: daSysId,
+            sourceScope: owner.name,
+            targetScope: tableScopeName,
+            created: false,
+        },
     };
 }
 /** Resolve a sys_scope sys_id to its scope NAME (e.g. "x_cadso_core"). */
@@ -277,7 +310,58 @@ async function resolveScopeName(client, scopeSysId) {
     var rows = await client.table.query("sys_scope", "sys_id=" + scopeSysId, { limit: 1, fields: ["scope"] });
     return rows.length > 0 ? (0, setField_1.fieldToString)(rows[0].scope) : "";
 }
+/**
+ * The Design Access sentence appended to a cross-scope result's note ("" when none).
+ * Exported for tests.
+ */
+function designAccessNote(da, ensureRequested, isDryRun) {
+    if (!da)
+        return "";
+    var pair = "'" + da.sourceScope + "' -> '" + da.targetScope + "'";
+    if (da.created) {
+        return (" Design Access " +
+            pair +
+            " was created (sys_scope_design_access " +
+            da.sysId +
+            ").");
+    }
+    if (da.present === true) {
+        return (" Design Access " +
+            pair +
+            " is present (sys_scope_design_access " +
+            da.sysId +
+            ").");
+    }
+    var state = da.present === null
+        ? "could NOT be read (sys_scope_design_access query failed) — check it on the instance"
+        : "is MISSING";
+    if (isDryRun && ensureRequested && da.present === false) {
+        return (" DESIGN ACCESS REQUIRED: " +
+            pair +
+            " " +
+            state +
+            " — would create it first, in the same update set.");
+    }
+    return (" DESIGN ACCESS REQUIRED: " +
+        pair +
+        " " +
+        state +
+        ". The headless insert does not need it, but UI/Studio edits of this column and the " +
+        "target instance will refuse it — re-run with --ensure-design-access (MCP: " +
+        "ensureDesignAccess:true) or create it with dove-sn design-access.");
+}
 async function addColumn(params) {
+    var daOut = {};
+    var result = await addColumnInner(params, daOut);
+    // The dry-run path attaches its own flag + note; every live return is decorated here so
+    // no exit path (created / skipped / any failure) can drop the flag.
+    if (!result.designAccess && daOut.value) {
+        result.designAccess = daOut.value;
+        result.note += designAccessNote(daOut.value, params.ensureDesignAccess === true, false);
+    }
+    return result;
+}
+async function addColumnInner(params, daOut) {
     validate(params);
     var client = params.client;
     // Normalize the single column (validates label, resolves the friendly type to an
@@ -323,7 +407,8 @@ async function addColumn(params) {
             : SYS_ID.test(params.table)
                 ? params.table
                 : "";
-        return {
+        var dryDa = planned ? planned.designAccess : undefined;
+        var dryResult = {
             status: "dry-run",
             table: planTable,
             tableSysId: planTableSysId,
@@ -353,8 +438,12 @@ async function addColumn(params) {
                         wantDependent +
                         "' (which must already exist on the table)"
                     : "") +
-                ", then read it back.",
+                ", then read it back." +
+                designAccessNote(dryDa, params.ensureDesignAccess === true, true),
         };
+        if (dryDa)
+            dryResult.designAccess = dryDa;
+        return dryResult;
     }
     // ---- LIVE PATH ------------------------------------------------------------
     // Require an explicit update set so the schema change is captured in a KNOWN
@@ -370,6 +459,34 @@ async function addColumn(params) {
     var resolved = plan.resolved;
     var scopeName = plan.scopeName;
     element = plan.element;
+    // Create the missing Design Access record FIRST when asked — nothing about the column
+    // has been written yet, so a failure here stops cleanly with the instance untouched
+    // (or, if the record landed but did not verify, says exactly that).
+    var da = plan.designAccess;
+    if (da && da.present !== true && params.ensureDesignAccess === true) {
+        var ensured = await (0, designAccess_1.ensureDesignAccess)({
+            client: client,
+            sourceScope: da.sourceScope,
+            targetScope: da.targetScope,
+            updateSetSysId: params.updateSetSysId,
+        });
+        da = {
+            required: true,
+            present: ensured.present,
+            sysId: ensured.sysId,
+            sourceScope: da.sourceScope,
+            targetScope: da.targetScope,
+            created: ensured.status === "created",
+        };
+        if (ensured.status === "failed") {
+            var daFail = failure(resolved, col, element, params.updateSetSysId, "Design Access could not be ensured, so the column was NOT added: " +
+                ensured.note, undefined, scopeName);
+            daFail.designAccess = da;
+            return daFail;
+        }
+    }
+    if (da)
+        daOut.value = da;
     // max_length is deliberately NOT sent on the insert — see the sizing step below.
     // Reference (and date) columns carry no max_length at all.
     var wantLength = col.type === "reference" ? "" : col.maxLength;

package/dist/table/designAccess.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Cross-scope DESIGN ACCESS — the `sys_scope_design_access` record that lets one app
+ * author (design) inside another app's tables.
+ *
+ * Why this exists: since the Zurich bw40 hotfix (tenonworkstudio, 2026-10-04), creating a
+ * column from app S on a table owned by app T through the platform UI / Studio fails with
+ *
+ *   Invalid 'Table' selected on the Dictionary Entry record. The '<table>' table is in
+ *   application '<T>', but the current application is '<S>'. The 'Table' field can only
+ *   select '<T>' tables with read access enabled.
+ *
+ * even when the table's own Application Access flags (read / alter / configuration) are
+ * all on. The fix is a Design Access record: source_scope = S (the authoring app),
+ * target_package = T (the app that owns the table), owned by — and captured in an update
+ * set of — S. Without it the column can still be inserted headless (the scope-aware
+ * createRecord op does not hit the UI check), but the next person to open that column in
+ * the UI, and the target instance's checks, trip over it. So add-column --cross-scope FLAGS
+ * a missing record and can create it; this module is that check + create.
+ *
+ * Read-back discipline matches add-column: a created record is read back by the returned
+ * sys_id and its source/target asserted before it is called verified. ES6 only, no
+ * optional chaining, no `any`.
+ */
+import type { ServiceNowClient } from "../client";
+export declare var DESIGN_ACCESS_TABLE: string;
+export interface ResolvedScopeRef {
+    /** Scope NAME (e.g. "x_cadso_journey"). */
+    name: string;
+    /** sys_scope sys_id. */
+    sysId: string;
+}
+/** Resolve a scope by NAME or sys_id; empty strings when not found. */
+export declare function resolveScopeRef(client: ServiceNowClient, scope: string): Promise<ResolvedScopeRef>;
+/**
+ * Find the Design Access record granting `sourceScopeSysId` design access to
+ * `targetScopeSysId`'s tables. Returns its sys_id, or "" when there is none.
+ */
+export declare function findDesignAccess(params: {
+    client: ServiceNowClient;
+    sourceScopeSysId: string;
+    targetScopeSysId: string;
+}): Promise<string>;
+export interface EnsureDesignAccessParams {
+    client: ServiceNowClient;
+    /** The AUTHORING app — scope name or sys_scope sys_id (e.g. "x_cadso_journey"). */
+    sourceScope: string;
+    /** The app that OWNS the tables — scope name or sys_scope sys_id (e.g. "x_cadso_automate"). */
+    targetScope: string;
+    /** Update set (in the SOURCE scope) to capture the record in. Required on the live path. */
+    updateSetSysId?: string;
+    /** Report whether the record exists / would be created — no writes. */
+    dryRun?: boolean;
+}
+export interface EnsureDesignAccessResult {
+    status: "exists" | "created" | "dry-run" | "failed";
+    /** Source (authoring) scope name. */
+    sourceScope: string;
+    /** Target (table-owning) scope name. */
+    targetScope: string;
+    /** The Design Access record's sys_id ("" when absent on dry-run, or on failure before insert). */
+    sysId: string;
+    /** True when the record is present: found, or created and read back. */
+    present: boolean;
+    /** Update set the create was captured into ("" when nothing was written). */
+    updateSetSysId: string;
+    note: string;
+}
+/**
+ * Make sure `sourceScope` has design access to `targetScope`'s tables. Idempotent: an
+ * existing record is reported ("exists") and nothing is written. Dry-run reports whether
+ * it exists or would be created. Live creates it through the scope-aware createRecord op
+ * switched to the SOURCE scope, captured in `updateSetSysId` (which must belong to the
+ * source scope), then reads it back.
+ */
+export declare function ensureDesignAccess(params: EnsureDesignAccessParams): Promise<EnsureDesignAccessResult>;

package/dist/table/designAccess.js

@@ -0,0 +1,250 @@
+"use strict";
+/**
+ * Cross-scope DESIGN ACCESS — the `sys_scope_design_access` record that lets one app
+ * author (design) inside another app's tables.
+ *
+ * Why this exists: since the Zurich bw40 hotfix (tenonworkstudio, 2026-10-04), creating a
+ * column from app S on a table owned by app T through the platform UI / Studio fails with
+ *
+ *   Invalid 'Table' selected on the Dictionary Entry record. The '<table>' table is in
+ *   application '<T>', but the current application is '<S>'. The 'Table' field can only
+ *   select '<T>' tables with read access enabled.
+ *
+ * even when the table's own Application Access flags (read / alter / configuration) are
+ * all on. The fix is a Design Access record: source_scope = S (the authoring app),
+ * target_package = T (the app that owns the table), owned by — and captured in an update
+ * set of — S. Without it the column can still be inserted headless (the scope-aware
+ * createRecord op does not hit the UI check), but the next person to open that column in
+ * the UI, and the target instance's checks, trip over it. So add-column --cross-scope FLAGS
+ * a missing record and can create it; this module is that check + create.
+ *
+ * Read-back discipline matches add-column: a created record is read back by the returned
+ * sys_id and its source/target asserted before it is called verified. ES6 only, no
+ * optional chaining, no `any`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DESIGN_ACCESS_TABLE = void 0;
+exports.resolveScopeRef = resolveScopeRef;
+exports.findDesignAccess = findDesignAccess;
+exports.ensureDesignAccess = ensureDesignAccess;
+const setField_1 = require("../setField");
+var SYS_ID = /^[0-9a-f]{32}$/i;
+var SCOPE_NAME = /^[a-z0-9_]+$/i;
+/** Safe to splice into an encoded query: no ^, =, spaces or other operators. */
+var SAFE_ID = /^[0-9a-z_]+$/i;
+exports.DESIGN_ACCESS_TABLE = "sys_scope_design_access";
+/** Resolve a scope by NAME or sys_id; empty strings when not found. */
+async function resolveScopeRef(client, scope) {
+    var s = String(scope || "").trim();
+    if (!s)
+        return { name: "", sysId: "" };
+    if (!SYS_ID.test(s) && !SCOPE_NAME.test(s)) {
+        throw new Error("design-access: '" + s + "' is not a scope name or sys_scope sys_id.");
+    }
+    var rows = await client.table.query("sys_scope", SYS_ID.test(s) ? "sys_id=" + s : "scope=" + s, { limit: 1, fields: ["sys_id", "scope"] });
+    if (rows.length === 0)
+        return { name: "", sysId: "" };
+    return {
+        name: (0, setField_1.fieldToString)(rows[0].scope),
+        sysId: (0, setField_1.fieldToString)(rows[0].sys_id),
+    };
+}
+/**
+ * Find the Design Access record granting `sourceScopeSysId` design access to
+ * `targetScopeSysId`'s tables. Returns its sys_id, or "" when there is none.
+ */
+async function findDesignAccess(params) {
+    // Both ids are spliced into an encoded query — refuse anything that could carry a
+    // query operator (^, =, spaces) rather than querying on it.
+    if (!SAFE_ID.test(params.sourceScopeSysId) ||
+        !SAFE_ID.test(params.targetScopeSysId)) {
+        return "";
+    }
+    var rows = await params.client.table.query(exports.DESIGN_ACCESS_TABLE, "source_scope=" +
+        params.sourceScopeSysId +
+        "^target_package=" +
+        params.targetScopeSysId, { limit: 1, fields: ["sys_id"] });
+    return rows.length > 0 ? (0, setField_1.fieldToString)(rows[0].sys_id) : "";
+}
+/** Resolve both scopes, refusing unknown or identical ones. Shared by dry-run and live. */
+async function resolvePair(params) {
+    if (!params || typeof params !== "object")
+        throw new Error("design-access: params object required.");
+    if (!params.client)
+        throw new Error("design-access: client is required.");
+    if (!params.sourceScope || !String(params.sourceScope).trim())
+        throw new Error("design-access: sourceScope (the authoring app) is required.");
+    if (!params.targetScope || !String(params.targetScope).trim())
+        throw new Error("design-access: targetScope (the app that owns the tables) is required.");
+    var source = await resolveScopeRef(params.client, params.sourceScope);
+    if (!source.sysId)
+        throw new Error("design-access: source scope '" +
+            params.sourceScope +
+            "' was not found in sys_scope.");
+    var target = await resolveScopeRef(params.client, params.targetScope);
+    if (!target.sysId)
+        throw new Error("design-access: target scope '" +
+            params.targetScope +
+            "' was not found in sys_scope.");
+    if (source.sysId === target.sysId)
+        throw new Error("design-access: source and target are the same scope ('" +
+            source.name +
+            "') — an app needs no design access to its own tables.");
+    return { source: source, target: target };
+}
+/**
+ * Make sure `sourceScope` has design access to `targetScope`'s tables. Idempotent: an
+ * existing record is reported ("exists") and nothing is written. Dry-run reports whether
+ * it exists or would be created. Live creates it through the scope-aware createRecord op
+ * switched to the SOURCE scope, captured in `updateSetSysId` (which must belong to the
+ * source scope), then reads it back.
+ */
+async function ensureDesignAccess(params) {
+    var pair = await resolvePair(params);
+    var client = params.client;
+    var label = "'" + pair.source.name + "' -> '" + pair.target.name + "'";
+    var existing = await findDesignAccess({
+        client: client,
+        sourceScopeSysId: pair.source.sysId,
+        targetScopeSysId: pair.target.sysId,
+    });
+    var base = {
+        sourceScope: pair.source.name,
+        targetScope: pair.target.name,
+    };
+    if (existing) {
+        return {
+            status: "exists",
+            sourceScope: base.sourceScope,
+            targetScope: base.targetScope,
+            sysId: existing,
+            present: true,
+            updateSetSysId: "",
+            note: "Design Access " +
+                label +
+                " already exists (" +
+                exports.DESIGN_ACCESS_TABLE +
+                " " +
+                existing +
+                ") — nothing to do.",
+        };
+    }
+    var us = params.updateSetSysId ? params.updateSetSysId.trim() : "";
+    if (us) {
+        if (!SAFE_ID.test(us))
+            throw new Error("design-access: update set '" + us + "' is not a sys_id.");
+        var usRows = await client.table.query("sys_update_set", "sys_id=" + us, { limit: 1, fields: ["sys_id", "name", "application"] });
+        if (usRows.length === 0)
+            throw new Error("design-access: update set '" +
+                us +
+                "' was not found in sys_update_set.");
+        if ((0, setField_1.fieldToString)(usRows[0].application) !== pair.source.sysId) {
+            throw new Error("design-access: update set '" +
+                ((0, setField_1.fieldToString)(usRows[0].name) || us) +
+                "' does not belong to the source scope '" +
+                pair.source.name +
+                "' — the Design Access record is owned by the AUTHORING app and ships in its " +
+                "update set. Pass an update set in '" +
+                pair.source.name +
+                "'.");
+        }
+    }
+    if (params.dryRun) {
+        return {
+            status: "dry-run",
+            sourceScope: base.sourceScope,
+            targetScope: base.targetScope,
+            sysId: "",
+            present: false,
+            updateSetSysId: us,
+            note: "dry-run: no write. Design Access " +
+                label +
+                " is MISSING — would create it in scope '" +
+                pair.source.name +
+                "', captured into update set " +
+                (us || "(none provided — required on the live path)") +
+                ", then read it back.",
+        };
+    }
+    if (!us) {
+        throw new Error("design-access: updateSetSysId is required on the live path so the record is " +
+            "captured in a known update set of the source scope (dry-run does not need one).");
+    }
+    var created;
+    try {
+        created = await client.claude.createRecord({
+            table: exports.DESIGN_ACCESS_TABLE,
+            fields: {
+                source_scope: pair.source.sysId,
+                target_package: pair.target.sysId,
+            },
+            scope: pair.source.name,
+            update_set_sys_id: us,
+        });
+    }
+    catch (e) {
+        return failed(base, us, "", "insert failed: " + errText(e));
+    }
+    var newSysId = (0, setField_1.fieldToString)(created && created.sys_id);
+    if (!newSysId) {
+        return failed(base, us, "", "createRecord returned no sys_id — the insert may not have landed; check the instance.");
+    }
+    var rows;
+    try {
+        rows = await client.table.query(exports.DESIGN_ACCESS_TABLE, "sys_id=" + newSysId, { limit: 1, fields: ["sys_id", "source_scope", "target_package"] });
+    }
+    catch (e) {
+        return failed(base, us, newSysId, "record created but the read-back failed: " + errText(e));
+    }
+    if (rows.length === 0) {
+        return failed(base, us, newSysId, "createRecord returned " +
+            newSysId +
+            " but no record was found on read-back.");
+    }
+    var gotSource = (0, setField_1.fieldToString)(rows[0].source_scope);
+    var gotTarget = (0, setField_1.fieldToString)(rows[0].target_package);
+    if (gotSource !== pair.source.sysId || gotTarget !== pair.target.sysId) {
+        return failed(base, us, newSysId, "record " +
+            newSysId +
+            " read back as source_scope '" +
+            (gotSource || "(empty)") +
+            "' / target_package '" +
+            (gotTarget || "(empty)") +
+            "', not the requested '" +
+            pair.source.sysId +
+            "' / '" +
+            pair.target.sysId +
+            "'. Fix or delete it on the instance.");
+    }
+    return {
+        status: "created",
+        sourceScope: base.sourceScope,
+        targetScope: base.targetScope,
+        sysId: newSysId,
+        present: true,
+        updateSetSysId: us,
+        note: "Created Design Access " +
+            label +
+            " (" +
+            exports.DESIGN_ACCESS_TABLE +
+            " " +
+            newSysId +
+            ") — verified on read-back, captured into update set " +
+            us +
+            ".",
+    };
+}
+function errText(e) {
+    return e && e.message ? e.message : String(e);
+}
+function failed(base, updateSetSysId, sysId, note) {
+    return {
+        status: "failed",
+        sourceScope: base.sourceScope,
+        targetScope: base.targetScope,
+        sysId: sysId,
+        present: false,
+        updateSetSysId: updateSetSysId,
+        note: "design-access: " + note,
+    };
+}

package/dist/table/index.d.ts

@@ -12,7 +12,9 @@ export type { ColumnSpec, AccessFlags, OverlaySpec } from "./buildTableSave";
 export { resolveFormAuth, openFormSession, setCurrentApplication, getRecordForm, getNewRecordForm, getWithSession, getFormPage, parseFormInputs, postForm, scrapeCk, decodeHtmlEntities, } from "./formSession";
 export type { FormAuth, FormSession, HarvestedForm, FetchedFormPage, PostResult, } from "./formSession";
 export { addColumn, deriveElement } from "./addColumn";
-export type { AddColumnParams, AddColumnResult } from "./addColumn";
+export type { AddColumnParams, AddColumnResult, DesignAccessFlag } from "./addColumn";
+export { ensureDesignAccess, findDesignAccess, resolveScopeRef, DESIGN_ACCESS_TABLE, } from "./designAccess";
+export type { EnsureDesignAccessParams, EnsureDesignAccessResult, ResolvedScopeRef, } from "./designAccess";
 export { addIndex, scanForDuplicates, parseIndexColumns, indexMatchesColumns, } from "./addIndex";
 export type { AddIndexParams, AddIndexResult, AddIndexVerification, DuplicateScan, DuplicateValue, } from "./addIndex";
 export { listIndexes, assertTableName } from "./listIndexes";

package/dist/table/index.js

@@ -5,8 +5,8 @@
  * live-validation caveat.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.diffInherited = exports.effectiveValue = exports.findLabelRow = exports.findOverrideRow = exports.resolveTableScope = exports.explainMaxLengthNotOverridable = exports.LABEL_LANGUAGE = exports.OVERRIDABLE = exports.findTruncationRisk = exports.toStoredValue = exports.resolveAttributes = exports.setColumn = exports.NOT_IN_UPDATE_SET = exports.DEFAULT_INDEX_FORM_PATH = exports.validateCreateIndex = exports.createIndex = exports.assertTableName = exports.listIndexes = exports.indexMatchesColumns = exports.parseIndexColumns = exports.scanForDuplicates = exports.addIndex = exports.deriveElement = exports.addColumn = exports.decodeHtmlEntities = exports.scrapeCk = exports.postForm = exports.parseFormInputs = exports.getFormPage = exports.getWithSession = exports.getNewRecordForm = exports.getRecordForm = exports.setCurrentApplication = exports.openFormSession = exports.resolveFormAuth = exports.TYPE_MAP = exports.listEditKey = exports.showInMenuKey = exports.defaultAccessFlags = exports.applyTableSaveOverlay = exports.resolveType = exports.normalizeColumns = exports.xmlEscape = exports.buildColumnXml = exports.DEFAULT_COLUMNS_REL_ID = exports.DEFAULT_SAVE_ACTION = exports.DEFAULT_SUPER_CLASS = exports.parseSysIdFromLocation = exports.projectTableGraph = exports.createTable = void 0;
-exports.resolveTableAttributes = exports.setTable = exports.labelUpdateName = exports.overrideUpdateName = exports.applyInheritedWrites = void 0;
+exports.resolveTableScope = exports.explainMaxLengthNotOverridable = exports.LABEL_LANGUAGE = exports.OVERRIDABLE = exports.findTruncationRisk = exports.toStoredValue = exports.resolveAttributes = exports.setColumn = exports.NOT_IN_UPDATE_SET = exports.DEFAULT_INDEX_FORM_PATH = exports.validateCreateIndex = exports.createIndex = exports.assertTableName = exports.listIndexes = exports.indexMatchesColumns = exports.parseIndexColumns = exports.scanForDuplicates = exports.addIndex = exports.DESIGN_ACCESS_TABLE = exports.resolveScopeRef = exports.findDesignAccess = exports.ensureDesignAccess = exports.deriveElement = exports.addColumn = exports.decodeHtmlEntities = exports.scrapeCk = exports.postForm = exports.parseFormInputs = exports.getFormPage = exports.getWithSession = exports.getNewRecordForm = exports.getRecordForm = exports.setCurrentApplication = exports.openFormSession = exports.resolveFormAuth = exports.TYPE_MAP = exports.listEditKey = exports.showInMenuKey = exports.defaultAccessFlags = exports.applyTableSaveOverlay = exports.resolveType = exports.normalizeColumns = exports.xmlEscape = exports.buildColumnXml = exports.DEFAULT_COLUMNS_REL_ID = exports.DEFAULT_SAVE_ACTION = exports.DEFAULT_SUPER_CLASS = exports.parseSysIdFromLocation = exports.projectTableGraph = exports.createTable = void 0;
+exports.resolveTableAttributes = exports.setTable = exports.labelUpdateName = exports.overrideUpdateName = exports.applyInheritedWrites = exports.diffInherited = exports.effectiveValue = exports.findLabelRow = exports.findOverrideRow = void 0;
 var createTable_1 = require("./createTable");
 Object.defineProperty(exports, "createTable", { enumerable: true, get: function () { return createTable_1.createTable; } });
 Object.defineProperty(exports, "projectTableGraph", { enumerable: true, get: function () { return createTable_1.projectTableGraph; } });
@@ -40,6 +40,11 @@ Object.defineProperty(exports, "decodeHtmlEntities", { enumerable: true, get: fu
 var addColumn_1 = require("./addColumn");
 Object.defineProperty(exports, "addColumn", { enumerable: true, get: function () { return addColumn_1.addColumn; } });
 Object.defineProperty(exports, "deriveElement", { enumerable: true, get: function () { return addColumn_1.deriveElement; } });
+var designAccess_1 = require("./designAccess");
+Object.defineProperty(exports, "ensureDesignAccess", { enumerable: true, get: function () { return designAccess_1.ensureDesignAccess; } });
+Object.defineProperty(exports, "findDesignAccess", { enumerable: true, get: function () { return designAccess_1.findDesignAccess; } });
+Object.defineProperty(exports, "resolveScopeRef", { enumerable: true, get: function () { return designAccess_1.resolveScopeRef; } });
+Object.defineProperty(exports, "DESIGN_ACCESS_TABLE", { enumerable: true, get: function () { return designAccess_1.DESIGN_ACCESS_TABLE; } });
 var addIndex_1 = require("./addIndex");
 Object.defineProperty(exports, "addIndex", { enumerable: true, get: function () { return addIndex_1.addIndex; } });
 Object.defineProperty(exports, "scanForDuplicates", { enumerable: true, get: function () { return addIndex_1.scanForDuplicates; } });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tenonhq/dovetail-servicenow",
-  "version": "0.0.49",
+  "version": "0.0.50",
   "engines": {
     "node": ">=22"
   },