@tenonhq/dovetail-servicenow 0.0.49 → 0.0.51

package/README.md

@@ -736,7 +736,7 @@ admin, and `sys_index_column` does not exist at all (HTTP 400 `Invalid table`),
 is no two-table index model to join and nothing to cross-check against.
 
 Each row comes back as `{ name, columns, type, rawColumns }`. `columns` is the view's
-bracketed `column_names` cell (`"[phone]"`, `"[a,b]"`) **parsed** into a list - never
+bracketed `column_names` cell (`"[phone]"`, `"[a;b]"` - semicolon-separated when composite) **parsed** into a list - never
 substring-matched, because `"[owner_id]"` contains `"owner"`. `type` is `access_method`.
 
 **Uniqueness is not readable.** `v_db_index` has no uniqueness field, so a unique index
@@ -747,49 +747,73 @@ is wrong than that the table is unindexed - every physical table has a `PRIMARY`
 
 ### Create an index (composite and non-unique included)
 
-> **A DATABASE INDEX IS A PHYSICAL, PER-INSTANCE CHANGE. IT IS NOT CAPTURED IN AN UPDATE
-> SET AND DOES NOT TRAVEL WITH A PROMOTION.** Re-run `index-create` against every
-> environment that needs the index (dev, test, uat, staging, prod). There is deliberately
-> no `--update-set` - passing one is an error, not a silent no-op.
+> **An index IS captured in an update set.** The platform's build job writes a
+> `sys_update_xml` row (`type=Indexes`, name `sys_index_<table>_<col>_<col>…`) into the
+> session user's **current** update set - the Database Indexes dialog says so itself, and
+> it was read back live on tenonworkstudio 2026-10-08. `--update-set` is therefore
+> **required** on the live path: the verb pins that set as current first and reads the
+> capture row back from it afterwards. The physical index is still built per instance;
+> committing the set elsewhere rebuilds it there.
 
 ```bash
-# Dry-run (the DEFAULT) - sends nothing and reads nothing
+# Dry-run (the DEFAULT) - sends nothing and reads nothing; no update set needed
 npx dove-sn index-create --table x_cadso_journey_instance --columns state,created_on
 
 # Send it
 npx dove-sn index-create \
-  --table x_cadso_journey_instance --columns state,created_on --confirm --json
+  --table x_cadso_journey_instance --columns state,created_on \
+  --update-set <sys_id> --confirm --json
 ```
 
 This is what `add-index` cannot do. `sys_dictionary.unique` - the only record-shaped lever
 - is **per-column and unique-only**, so composite and plain indexes have no record path at
-all. `index-create` instead replays the platform's own index-creator form
-(`sys_action=create_index`, `sysparm_index_table`, `sysparm_fields`,
-`sysparm_unique_index_SKIP`) over a form-login session. That contract is lifted from the
-instance's shipped `index_creator_information` UI macro, not from a guess, and the POST
-target is taken from the rendered page's own `<form action>`.
+all (`sys_index` is API-level-ACL 403, `sys_index_column` does not exist). `index-create`
+instead replays the two GlideAjax calls the platform's own Database Indexes dialog makes
+on `xmlhttp.do` over a form-login session - taken from a HAR of the Studio dialog plus the
+`dialog_index_create` UI page's client script, both read live:
+
+1. `IndexCreatorErrorChecker` / `canCreate` - the dialog's pre-flight (`sysparm_table_name`,
+   `sysparm_field_names`, `sysparm_unique`, `sysparm_access_method`). A `canCreate:false`
+   verdict is returned verbatim with its `errorCode` and nothing is scheduled.
+2. `ScheduleCreator` / `createSchedule` - schedules the build (`sysparm_table`,
+   `sysparm_fields`, `sysparm_access_method` - default `btree`, exactly as the dialog's
+   client JS does - `sysparm_unique` `true|false`, empty `sysparm_email` = no
+   notification, empty `sysparm_schedule_name`).
+
+(The `index_creator_dialog` page's `sys_action=create_index` form is inert - the browser
+never submits it, and the UI page has no processing script. The earlier form-POST replay
+was a silent no-op for that reason.)
 
 - **Dry-run by default.** Without `--confirm` nothing is sent *and nothing is read*;
   `--dry-run` forces a plan even with `--confirm`.
+- **Target checks before anything else.** The table must exist; the update set must exist,
+  be `in progress`, and belong to the table's application scope - a set in another scope
+  is refused, because the capture row would land in the wrong scope.
 - **Idempotent.** On the live path `v_db_index` is read first, and an index over *exactly*
-  these columns short-circuits to `already-exists` with no form session and no write.
-  Column **order** is part of an index's identity - `[a,b]` is not `[b,a]`.
-- **`--name` is refused.** The platform's form has no name input; ServiceNow names the
-  index itself. Reporting a name the instance does not carry would be a lie, so the
-  created index's *real* name is returned in `name` instead.
-- **The read-back is the proof.** After the POST the index is polled for in `v_db_index`
-  (default 10 checks, 3 s apart - a build on a populated table is asynchronous). If it
-  never appears the status is `failed`: a form processor returning a page is not evidence
-  an ALTER ran, and a unique index cannot build over duplicate values (EMPTY counts).
+  these columns short-circuits to `already-exists` with no pin, no form session and no
+  write. Column **order** is part of an index's identity - `[a;b]` is not `[b;a]`.
+- **The pin is read back.** The set is pinned with Dovetail's own `changeUpdateSet` and
+  `currentUpdateSet` is read; a pin that did not take stops the run before the session
+  opens.
+- **`--name` is refused.** The dialog has no name input; ServiceNow names the index after
+  its leading column (live: `[sys_created_on;status;version_step;version]` → index
+  `sys_created_on`). The created index's *real* name is returned in `name`.
+- **The read-back is the proof.** After scheduling, the index is polled for in `v_db_index`
+  (default 10 checks, 3 s apart). If it never appears the status is `failed`: an accepted
+  schedule is not evidence an ALTER ran, and a unique index cannot build over duplicate
+  values (EMPTY counts). Then the capture row is looked for in the pinned set:
+  `captured:true` only when it was read back; an index that exists but was not captured
+  is `created:true, captured:false` with `update-set-capture` in `unverified` - and
+  exit code 2, because it will not travel.
 - **Uniqueness is still never claimed.** `uniqueness-enforced` stays in `unverified` on
   every status.
 
-**Requires a username+password identity that can form-log-in.** An instance on
-API-key-only auth, SSO or MFA rejects the form login however valid the API key is; the
-verb fails at the session with that diagnosis rather than a mystery 302, and no `.do`
-replay (including `create-table`'s) can work in that state.
+**Requires a username+password identity that can form-log-in.** `xmlhttp.do` ignores
+Basic auth and API keys, so an API-key-only, SSO or MFA identity fails at the session with
+that diagnosis (TenonHQ/Dovetail#292).
 
-Exit codes: `0` created / already-exists / dry-run, `1` bad args, `2` failed.
+Exit codes: `0` created / already-exists / dry-run, `1` bad args, `2` failed - and `2`
+when the index was created but its capture row was not found in the pinned set.
 
 ### Set a field on a record
 
@@ -1154,15 +1178,22 @@ Claude Code and agents: `create_view`, `set_list_layout`, `set_form_layout`,
 `add_column` (same-scope by default; `crossScope: true` with `scope` adds a column OWNED
 by another app — a Journey field on an Automate table, element `<scope>_<name>` —
 guarded by `sys_db_object.alter_access` and the update set's scope, with the stored
-element and `sys_scope` read back; the CLI flag is `--cross-scope`) /
+element and `sys_scope` read back; the CLI flag is `--cross-scope`. A cross-scope
+result also carries `designAccess`: the platform UI refuses cross-scope authoring
+without a `sys_scope_design_access` record (column scope -> table scope), so a missing
+one is FLAGGED — not blocking, the headless insert works without it — and
+`ensureDesignAccess: true` / `--ensure-design-access` creates it first in the same
+update set) / `design_access` (ensure that record on its own — idempotent, created in
+the SOURCE app's update set and read back; CLI `dove-sn design-access --source <app>
+--target <app> --update-set <sys_id>`, `--dry-run` only reports exists/missing) /
 `add_index` (a single-column unique index via `sys_dictionary.unique`,
 read back from the `v_db_index` view - uniqueness enforcement is always reported
 unverified) / `index_list` (read-only: a table's database indexes from `v_db_index`,
 the only index read surface - `sys_index` is API-level-ACL 403 and `sys_index_column`
 does not exist) / `index_create` (create an index, composite and non-unique included, by
-replaying the platform index-creator form; dry-run by default, idempotent, read back from
-`v_db_index` - and **not** captured in an update set, because a database index is a
-physical per-instance change), the record-write verbs `set_field` (update scalar fields on an
+replaying the Database Indexes dialog's own processor calls; dry-run by default, idempotent,
+pinned to a required update set, read back from `v_db_index` and the capture row read back
+from `sys_update_xml`), the record-write verbs `set_field` (update scalar fields on an
 existing record), `create_record` (insert one record) and `delete_record` (delete one
 record — dry-run by default, `confirm:true` to apply, `updateSetSysId` required, the
 record read back before AND after so success is only reported once it is confirmed

package/dist/cli.js

@@ -1340,15 +1340,60 @@ async function runCreateTable(flags) {
         return 2;
     return 0;
 }
+/**
+ * dove-sn design-access:
+ *   --source x_cadso_journey --target x_cadso_automate
+ *   [--update-set <sys_id in source>] [--dry-run] [--json]
+ * Ensures the sys_scope_design_access record that lets the SOURCE app author in the
+ * TARGET app's tables (required by the platform UI for cross-scope columns). Idempotent;
+ * --dry-run only reports whether it exists. --update-set is required unless --dry-run.
+ */
+async function runDesignAccess(flags) {
+    if (!flags.source || !flags.target) {
+        process.stderr.write("design-access: --source (authoring app) and --target (app that owns the tables) are required\n");
+        return 1;
+    }
+    var isDryRun = flags["dry-run"] === "true";
+    if (!isDryRun && !flags["update-set"]) {
+        process.stderr.write("design-access: --update-set (an update set in --source) is required on the live path (only --dry-run works without one)\n");
+        return 1;
+    }
+    var result = await (0, table_1.ensureDesignAccess)({
+        client: (0, client_1.createClient)({}),
+        sourceScope: flags.source,
+        targetScope: flags.target,
+        updateSetSysId: flags["update-set"],
+        dryRun: isDryRun,
+    });
+    if (flags.json === "true") {
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+    }
+    else {
+        process.stdout.write("[" +
+            result.status +
+            "] " +
+            result.sourceScope +
+            " -> " +
+            result.targetScope +
+            (result.sysId ? " (" + result.sysId + ")" : "") +
+            "\n" +
+            result.note +
+            "\n");
+    }
+    if (result.status === "failed")
+        return 2;
+    return 0;
+}
 /**
  * dove-sn add-column:
  *   --table x_cadso_journey --label URL --type url
  *   [--name url] [--max-length 1024] [--reference <table>]
  *   [--mandatory] [--default <value>] [--dependent-on-field <element>]
- *   [--scope x_cadso_journey] [--cross-scope] [--update-set <sys_id>]
- *   [--from-json <spec.json>] [--dry-run] [--debug] [--json]
+ *   [--scope x_cadso_journey] [--cross-scope] [--ensure-design-access]
+ *   [--update-set <sys_id>] [--from-json <spec.json>] [--dry-run] [--debug] [--json]
  * --update-set is required unless --dry-run. --cross-scope opts in to a column
- * OWNED by --scope when that differs from the table's scope.
+ * OWNED by --scope when that differs from the table's scope; a missing Design Access
+ * record is flagged, and --ensure-design-access creates it first.
  */
 async function runAddColumn(flags) {
     var spec = {};
@@ -1388,6 +1433,10 @@ async function runAddColumn(flags) {
     if (flags["cross-scope"] === "true" || spec.crossScope === true) {
         params.crossScope = true;
     }
+    if (flags["ensure-design-access"] === "true" ||
+        spec.ensureDesignAccess === true) {
+        params.ensureDesignAccess = true;
+    }
     var us = flags["update-set"] || spec.updateSetSysId;
     if (us)
         params.updateSetSysId = us;
@@ -1539,16 +1588,19 @@ async function runIndexList(flags) {
 }
 /**
  * dove-sn index-create:
- *   --table x_cadso_core_u_smoke --columns a,b [--unique] [--access-method <m>]
- *   [--confirm] [--dry-run] [--poll-attempts <n>] [--poll-interval-ms <n>]
- *   [--debug] [--json]
+ *   --table x_cadso_core_u_smoke --columns a,b --update-set <sys_id> [--unique]
+ *   [--access-method <m>] [--confirm] [--dry-run] [--poll-attempts <n>]
+ *   [--poll-interval-ms <n>] [--debug] [--json]
  *
  * DRY-RUN BY DEFAULT — nothing is sent (and nothing is even READ) without --confirm;
- * --dry-run forces a plan even with it. There is deliberately NO --update-set: a
- * database index is physical and is not captured in one.
+ * --dry-run forces a plan even with it. --update-set is REQUIRED on the live path:
+ * the build job captures the index definition (sys_update_xml type=Indexes) into the
+ * user's CURRENT update set, so the verb pins that set first and reads the capture
+ * row back from it afterwards.
  *
  * Exit codes: 0 created / already-exists / dry-run, 1 bad args, 2 failed (which
- * includes "the form was posted but no index was read back").
+ * includes "scheduled but no index was read back") — and 2 when the index was read
+ * back but its capture row was NOT found in the pinned set.
  */
 async function runIndexCreate(flags) {
     var columns = splitList(flags.columns || "");
@@ -1556,10 +1608,12 @@ async function runIndexCreate(flags) {
         process.stderr.write("index-create: --table <name> and --columns <a[,b,...]> are required\n");
         return 1;
     }
-    if (flags["update-set"]) {
-        process.stderr.write("index-create: --update-set is not accepted. A database index is a PHYSICAL, " +
-            "PER-INSTANCE change — it is NOT captured in an update set and does not " +
-            "travel with a promotion. Run index-create against each environment.\n");
+    // DRY-RUN BY DEFAULT: --confirm is what sends; --dry-run forces a plan even with it.
+    var indexDryRun = flags["dry-run"] === "true" || flags.confirm !== "true";
+    if (!indexDryRun && !flags["update-set"]) {
+        process.stderr.write("index-create: --update-set is required on the live path — the index " +
+            "definition is captured into the user's CURRENT update set, so it must be " +
+            "pinned first (only a dry-run works without one)\n");
         return 1;
     }
     var params = {
@@ -1574,8 +1628,8 @@ async function runIndexCreate(flags) {
         params.name = flags.name;
     if (flags["access-method"])
         params.accessMethod = flags["access-method"];
-    if (flags["form-path"])
-        params.formPath = flags["form-path"];
+    if (flags["update-set"])
+        params.updateSetSysId = flags["update-set"];
     if (flags.debug === "true")
         params.debug = true;
     // A non-integer poll setting would make the bounded wait unbounded (or zero).
@@ -1614,6 +1668,12 @@ async function runIndexCreate(flags) {
             (result.name ? " -> " + result.name : "") +
             (result.instance ? " on " + result.instance : "") +
             (result.verified ? " — verified" : "") +
+            (result.updateSet
+                ? " [update set " +
+                    (result.updateSet.name || result.updateSet.sysId) +
+                    (result.captured ? " — captured" : " — capture NOT verified") +
+                    "]"
+                : "") +
             "\n" +
             result.note +
             "\nUNVERIFIED: " +
@@ -1622,6 +1682,10 @@ async function runIndexCreate(flags) {
     }
     if (result.status === "failed")
         return 2;
+    // An index that exists but whose definition was not captured will not travel —
+    // surface that as a non-zero exit, the same way an unread-back index is.
+    if (result.status === "created" && !result.captured)
+        return 2;
     return 0;
 }
 /** Parse a CLI boolean flag. Bare `--mandatory` means true; `--mandatory false` means
@@ -2616,6 +2680,9 @@ async function dispatch(parsed) {
     if (parsed.command === "add-column") {
         return await runAddColumn(parsed.flags);
     }
+    if (parsed.command === "design-access") {
+        return await runDesignAccess(parsed.flags);
+    }
     if (parsed.command === "add-index") {
         return await runAddIndex(parsed.flags);
     }

package/dist/cliUsage.js

@@ -209,6 +209,10 @@ exports.VERB_USAGE = {
                 flag: "cross-scope",
                 note: "Opt in to a column OWNED by --scope, which differs from the table's scope (element becomes <scope>_<name>; the table must allow new fields; --update-set must be in --scope).",
             },
+            {
+                flag: "ensure-design-access",
+                note: "Cross-scope only: create the missing sys_scope_design_access record (--scope -> table's scope) first, in the same update set. Without it a missing record is only flagged.",
+            },
             { flag: "update-set", value: "<sys_id>", note: "REQUIRED on the live path (only --dry-run works without one)." },
             DRY_RUN_FLAG,
             DEBUG_FLAG,
@@ -222,6 +226,26 @@ exports.VERB_USAGE = {
             "Cross-scope: dove-sn add-column --table x_cadso_automate_email_batch --label 'Instance Step' --name instance_step --type reference --reference x_cadso_journey_instance_step --scope x_cadso_journey --cross-scope --update-set <journey set>",
         ],
     },
+    "design-access": {
+        summary: "Ensure the sys_scope_design_access record that lets one app author in another app's tables (required by the UI for cross-scope columns)",
+        required: [
+            { flag: "source", value: "<x_scope>", note: "The AUTHORING app (owns the record and its update set)." },
+            { flag: "target", value: "<x_scope>", note: "The app that OWNS the tables." },
+        ],
+        optional: [
+            { flag: "update-set", value: "<sys_id>", note: "Update set in --source. REQUIRED on the live path." },
+            DRY_RUN_FLAG,
+            JSON_FLAG,
+        ],
+        gate: "dry-run-flag",
+        gateNote: "--update-set is required unless --dry-run; --dry-run reports exists/missing only.",
+        example: "dove-sn design-access --source x_cadso_journey --target x_cadso_automate --update-set <journey set>",
+        notes: [
+            "Idempotent: an existing record is reported and nothing is written.",
+            "Symptom it fixes: \"Invalid 'Table' selected on the Dictionary Entry record ... can only select '<app>' tables with read access enabled\" — the table's own access flags are NOT the gate.",
+            "Exit 2 when the record could not be created or verified on read-back.",
+        ],
+    },
     "set-column": {
         summary: "Update an EXISTING column's schema (label/mandatory/default/read-only/max-length/dependent-on-field), then verify",
         required: [
@@ -308,14 +332,15 @@ exports.VERB_USAGE = {
         ],
     },
     "index-create": {
-        summary: "Create a DATABASE index (composite and non-unique included) by replaying the platform index-creator form, then read it back",
+        summary: "Create a DATABASE index (composite and non-unique included) by replaying the platform Database Indexes dialog's processor calls, pinned to an update set, then read it back",
         required: [
             { flag: "table", value: "<name>" },
             { flag: "columns", value: "<a[,b,...]>", note: "Comma-separated column elements, in index order." },
+            { flag: "update-set", value: "<sys_id>", note: "Required on the live path; the index definition is captured into it. Must be in the table's application scope." },
         ],
         optional: [
             { flag: "unique" },
-            { flag: "access-method", value: "<m>", note: "Platform access method (default: the form's default)." },
+            { flag: "access-method", value: "<m>", note: "Platform access method (default: btree, as the dialog does)." },
             CONFIRM_FLAG,
             FORCE_DRY_RUN_FLAG,
             { flag: "poll-attempts", value: "<n>", note: "Positive integer." },
@@ -325,11 +350,12 @@ exports.VERB_USAGE = {
         ],
         gate: "confirm",
         gateNote: "Nothing is sent OR read without --confirm.",
-        example: "dove-sn index-create --table x_cadso_journey_instance --columns state,created_on --confirm",
+        example: "dove-sn index-create --table x_cadso_journey_instance --columns state,created_on --update-set <sys_id> --confirm",
         notes: [
-            "A DATABASE INDEX IS PHYSICAL AND PER-INSTANCE: not captured in an update set, does not travel with a promotion — re-run it against every environment. --update-set is therefore REFUSED.",
-            "Idempotent: an index over exactly those columns returns already-exists with no write. --name is refused (the form has no name input; the real name is returned).",
-            "Needs a username+password identity that can form-log-in.",
+            "An index IS captured in an update set: the build job writes a sys_update_xml row (type=Indexes) into the user's CURRENT set, so --update-set is pinned first and the capture row is read back from it. The physical index is still built per instance; committing the set elsewhere rebuilds it.",
+            "Replays the dialog's own xmlhttp.do calls: IndexCreatorErrorChecker.canCreate (pre-flight) then ScheduleCreator.createSchedule. Idempotent: an index over exactly those columns returns already-exists with no write. --name is refused (the dialog has no name input; the real name is returned).",
+            "Needs a username+password identity that can form-log-in (xmlhttp.do ignores Basic auth / API keys).",
+            "Exit 2 when the index was scheduled but never read back from v_db_index, and when it was read back but its capture row was not found in the pinned set.",
         ],
     },
     "set-field": {

package/dist/index.d.ts

@@ -21,8 +21,8 @@ export { sincPlugin } from "./plugin";
 export { listTemplates, verifyArtifact, cloneSubflow, cloneActionType, resolveScope, slugInternalName, fetchActionSteps, findStepInput, triggerPublication, publishActionType, editActionType, defineActionType, planActionDefinition, validateDefineSpec, applyStepOps, verifySteps, summarizeSteps, formatStepPill, readFlow, readActionType, publishFlow, copyFlow, createFlow, buildPublishModel, editFlow, testFlow, DEFAULT_RUN_FLOW_PATH, generateSysId, topoSort, executeWritePlan, WriteOrderError, } from "./flowDesigner";
 export type { TemplateRef, ListTemplatesParams, FlowKind, VerifyExpect, VerifyFound, VerifyFailure, VerifyReport, VerifyArtifactParams, CloneSubflowParams, CloneSubflowResult, CloneActionTypeParams, CloneActionTypeResult, CloneActionTypePlan, CloneActionTypeStepReport, TriggerPublicationParams, TriggerPublicationResult, PublishActionTypeParams, PublishActionTypeResult, EditActionTypeParams, EditActionTypeResult, EditActionTypeOps, DefineActionSpec, DefineActionInputSpec, DefineActionOutputSpec, DefineStepSpec, DefineStepVarSpec, DefineStepOutputSpec, DefineStepValue, DefineActionTypeParams, DefineActionTypeResult, DefineActionDiff, DefineActionPlan, PlanActionDefinitionParams, ActionView, StepView, StepOps, StepRecord, StepSummary, StepIoSummary, PatchStepScriptOp, SetStepInputOp, AddStepOutputOp, AddStepInputOp, ApplyStepOpsResult, VerifyStepsResult, ReadFlowParams, ReadFlowResult, FlowStep, FlowVariable, ReadActionTypeParams, ReadActionTypeResult, ActionIo, PublishFlowParams, PublishFlowResult, CopyFlowParams, CopyFlowResult, CreateFlowParams, CreateFlowResult, EditFlowParams, EditFlowResult, EditFlowOps, StepInputPatch, TestFlowParams, TestFlowResult, WriteOp, WriteOpResult, } from "./flowDesigner";
 export type { ServiceNowClientConfig, ChoiceValue, ChoiceType, AddChoicesParams, AddChoicesResult, ChoiceActionResult, ChoiceFieldRef, RemoveChoicesParams, RemoveChoicesResult, ChoiceRemovalResult, DictionaryRecord, UpdateSetRecord, LayoutAction, LayoutRecordResult, LayoutResult, CreateViewParams, CreateViewResult, FormSectionSpec, SetFormLayoutParams, SetListLayoutParams, SetRelatedListsParams, ChunkRole, ChunkInfo, ChunkResult, PrunedResult, HostAssetsParams, HostAssetsResult, } from "./types";
-export { createTable, projectTableGraph, buildColumnXml, normalizeColumns, resolveType, applyTableSaveOverlay, defaultAccessFlags, TYPE_MAP, DEFAULT_SUPER_CLASS, DEFAULT_SAVE_ACTION, addColumn, deriveElement, addIndex, parseIndexColumns, indexMatchesColumns, listIndexes, createIndex, validateCreateIndex, DEFAULT_INDEX_FORM_PATH, NOT_IN_UPDATE_SET, setColumn, resolveAttributes, toStoredValue, setTable, resolveTableAttributes, } from "./table";
-export type { CreateTableParams, CreateTableResult, AddColumnParams, AddColumnResult, AddIndexParams, AddIndexResult, AddIndexVerification, ListIndexesParams, ListIndexesResult, TableIndex, CreateIndexParams, CreateIndexResult, SetColumnParams, SetColumnResult, ColumnAttributes, AttributeChange, SetTableParams, SetTableResult, TableAttributes, TableGraph, NormalizedColumn, ColumnSpec, AccessFlags, OverlaySpec, } from "./table";
+export { createTable, projectTableGraph, buildColumnXml, normalizeColumns, resolveType, applyTableSaveOverlay, defaultAccessFlags, TYPE_MAP, DEFAULT_SUPER_CLASS, DEFAULT_SAVE_ACTION, addColumn, deriveElement, ensureDesignAccess, findDesignAccess, DESIGN_ACCESS_TABLE, addIndex, parseIndexColumns, indexMatchesColumns, listIndexes, createIndex, validateCreateIndex, captureRowName, parseAjaxAnswer, parseCanCreate, buildCanCreateFields, buildCreateScheduleFields, XMLHTTP_PATH, DEFAULT_ACCESS_METHOD, CAPTURE_NOTE, setColumn, resolveAttributes, toStoredValue, setTable, resolveTableAttributes, } from "./table";
+export type { CreateTableParams, CreateTableResult, AddColumnParams, AddColumnResult, DesignAccessFlag, EnsureDesignAccessParams, EnsureDesignAccessResult, AddIndexParams, AddIndexResult, AddIndexVerification, ListIndexesParams, ListIndexesResult, TableIndex, CreateIndexParams, CreateIndexResult, SetColumnParams, SetColumnResult, ColumnAttributes, AttributeChange, SetTableParams, SetTableResult, TableAttributes, TableGraph, NormalizedColumn, ColumnSpec, AccessFlags, OverlaySpec, } from "./table";
 export { setField } from "./setField";
 export { createRecord } from "./createRecord";
 export type { RecordWriteResult, SetFieldParams, SetFieldResult, } from "./setField";

package/dist/index.js

@@ -7,8 +7,9 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.editFlow = exports.buildPublishModel = exports.createFlow = exports.copyFlow = exports.publishFlow = exports.readActionType = exports.readFlow = exports.formatStepPill = exports.summarizeSteps = exports.verifySteps = exports.applyStepOps = exports.validateDefineSpec = exports.planActionDefinition = exports.defineActionType = exports.editActionType = exports.publishActionType = exports.triggerPublication = exports.findStepInput = exports.fetchActionSteps = exports.slugInternalName = exports.resolveScope = exports.cloneActionType = exports.cloneSubflow = exports.verifyArtifact = exports.listTemplates = exports.sincPlugin = exports.formatCreateViewResult = exports.formatLayoutResult = exports.setRelatedLists = exports.setFormLayout = exports.setListLayout = exports.createView = exports.formatRemoveChoicesResult = exports.formatAddChoicesResult = exports.formatHostAssetsResult = exports.classifyChunks = exports.hostAssets = exports.ChoiceWriteError = exports.removeChoicesFromField = exports.addChoicesToField = exports.resolveConfigFromEnvFile = exports.createClientFromEnvFile = exports.assertWriteAllowed = exports.evaluateWriteGate = exports.isCiEnvironment = exports.resolveExecutionContext = exports.PROCESSFLOW_PATH_PREFIX = exports.isProcessflowPath = exports.resolveFlowAuth = exports.createClient = void 0;
-exports.parseProgressTree = exports.parseXmlAnswer = exports.PUBLISH_TARGETS = exports.parsePublishTargets = exports.describeTarget = exports.resolveUpdateSetNaming = exports.buildPublishToUpdateSetFields = exports.buildCreateUpdateSetFields = exports.buildStartFields = exports.publishApp = exports.INVOKE_REST_METHODS = exports.invokeRest = exports.verifyReadBack = exports.readBackMatches = exports.hasHtmlEntity = exports.decodeHtmlEntities = exports.deleteRecord = exports.createRecord = exports.setField = exports.resolveTableAttributes = exports.setTable = exports.toStoredValue = exports.resolveAttributes = exports.setColumn = exports.NOT_IN_UPDATE_SET = exports.DEFAULT_INDEX_FORM_PATH = exports.validateCreateIndex = exports.createIndex = exports.listIndexes = exports.indexMatchesColumns = exports.parseIndexColumns = exports.addIndex = exports.deriveElement = exports.addColumn = exports.DEFAULT_SAVE_ACTION = exports.DEFAULT_SUPER_CLASS = exports.TYPE_MAP = exports.defaultAccessFlags = exports.applyTableSaveOverlay = exports.resolveType = exports.normalizeColumns = exports.buildColumnXml = exports.projectTableGraph = exports.createTable = exports.WriteOrderError = exports.executeWritePlan = exports.topoSort = exports.generateSysId = exports.DEFAULT_RUN_FLOW_PATH = exports.testFlow = void 0;
-exports.SECRET_INTERNAL_TYPES = exports.SENTINEL = exports.isCapturable = exports.secretFieldsFromDictionary = exports.mergeSecretRules = exports.loadSecretRules = exports.defaultSecretRules = exports.escapeRegExp = exports.encodeXmlText = exports.encodeXmlEntities = exports.stripJsonValue = exports.stripField = exports.plannedStrips = exports.recordFieldNames = exports.readRecordTable = exports.readField = exports.verifyStripped = exports.stripSecrets = exports.DEFAULT_EXPORT_APP_TIMEOUT_MS = exports.buildPublishFields = exports.buildCreateSetFields = exports.exportApp = exports.DEFAULT_MAX_ROWS = exports.MAX_PAGE_SIZE = exports.DEFAULT_PAGE_SIZE = exports.UPDATE_XML_FIELDS = exports.xmlEscape = exports.formatUnloadDate = exports.parseStatsCount = exports.refreshTypeFields = exports.fetchUpdateXmlRows = exports.countUpdateXml = exports.countUnloadRecords = exports.renderUnload = exports.renderRemoteUpdateSet = exports.renderUpdateXmlRow = exports.exportUpdateSet = exports.PUBLISH_POLL_DELAYS_MS = exports.DEFAULT_PUBLISH_TIMEOUT_MS = exports.parseCicdProgress = exports.parseCicdPublishResponse = exports.harvestProgressResults = exports.flattenSteps = exports.classifyProgress = void 0;
+exports.publishApp = exports.INVOKE_REST_METHODS = exports.invokeRest = exports.verifyReadBack = exports.readBackMatches = exports.hasHtmlEntity = exports.decodeHtmlEntities = exports.deleteRecord = exports.createRecord = exports.setField = exports.resolveTableAttributes = exports.setTable = exports.toStoredValue = exports.resolveAttributes = exports.setColumn = exports.CAPTURE_NOTE = exports.DEFAULT_ACCESS_METHOD = exports.XMLHTTP_PATH = exports.buildCreateScheduleFields = exports.buildCanCreateFields = exports.parseCanCreate = exports.parseAjaxAnswer = exports.captureRowName = exports.validateCreateIndex = exports.createIndex = exports.listIndexes = exports.indexMatchesColumns = exports.parseIndexColumns = exports.addIndex = exports.DESIGN_ACCESS_TABLE = exports.findDesignAccess = exports.ensureDesignAccess = exports.deriveElement = exports.addColumn = exports.DEFAULT_SAVE_ACTION = exports.DEFAULT_SUPER_CLASS = exports.TYPE_MAP = exports.defaultAccessFlags = exports.applyTableSaveOverlay = exports.resolveType = exports.normalizeColumns = exports.buildColumnXml = exports.projectTableGraph = exports.createTable = exports.WriteOrderError = exports.executeWritePlan = exports.topoSort = exports.generateSysId = exports.DEFAULT_RUN_FLOW_PATH = exports.testFlow = void 0;
+exports.secretFieldsFromDictionary = exports.mergeSecretRules = exports.loadSecretRules = exports.defaultSecretRules = exports.escapeRegExp = exports.encodeXmlText = exports.encodeXmlEntities = exports.stripJsonValue = exports.stripField = exports.plannedStrips = exports.recordFieldNames = exports.readRecordTable = exports.readField = exports.verifyStripped = exports.stripSecrets = exports.DEFAULT_EXPORT_APP_TIMEOUT_MS = exports.buildPublishFields = exports.buildCreateSetFields = exports.exportApp = exports.DEFAULT_MAX_ROWS = exports.MAX_PAGE_SIZE = exports.DEFAULT_PAGE_SIZE = exports.UPDATE_XML_FIELDS = exports.xmlEscape = exports.formatUnloadDate = exports.parseStatsCount = exports.refreshTypeFields = exports.fetchUpdateXmlRows = exports.countUpdateXml = exports.countUnloadRecords = exports.renderUnload = exports.renderRemoteUpdateSet = exports.renderUpdateXmlRow = exports.exportUpdateSet = exports.PUBLISH_POLL_DELAYS_MS = exports.DEFAULT_PUBLISH_TIMEOUT_MS = exports.parseCicdProgress = exports.parseCicdPublishResponse = exports.harvestProgressResults = exports.flattenSteps = exports.classifyProgress = exports.parseProgressTree = exports.parseXmlAnswer = exports.PUBLISH_TARGETS = exports.parsePublishTargets = exports.describeTarget = exports.resolveUpdateSetNaming = exports.buildPublishToUpdateSetFields = exports.buildCreateUpdateSetFields = exports.buildStartFields = void 0;
+exports.SECRET_INTERNAL_TYPES = exports.SENTINEL = exports.isCapturable = void 0;
 var client_1 = require("./client");
 Object.defineProperty(exports, "createClient", { enumerable: true, get: function () { return client_1.createClient; } });
 Object.defineProperty(exports, "resolveFlowAuth", { enumerable: true, get: function () { return client_1.resolveFlowAuth; } });
@@ -91,14 +92,23 @@ Object.defineProperty(exports, "DEFAULT_SUPER_CLASS", { enumerable: true, get: f
 Object.defineProperty(exports, "DEFAULT_SAVE_ACTION", { enumerable: true, get: function () { return table_1.DEFAULT_SAVE_ACTION; } });
 Object.defineProperty(exports, "addColumn", { enumerable: true, get: function () { return table_1.addColumn; } });
 Object.defineProperty(exports, "deriveElement", { enumerable: true, get: function () { return table_1.deriveElement; } });
+Object.defineProperty(exports, "ensureDesignAccess", { enumerable: true, get: function () { return table_1.ensureDesignAccess; } });
+Object.defineProperty(exports, "findDesignAccess", { enumerable: true, get: function () { return table_1.findDesignAccess; } });
+Object.defineProperty(exports, "DESIGN_ACCESS_TABLE", { enumerable: true, get: function () { return table_1.DESIGN_ACCESS_TABLE; } });
 Object.defineProperty(exports, "addIndex", { enumerable: true, get: function () { return table_1.addIndex; } });
 Object.defineProperty(exports, "parseIndexColumns", { enumerable: true, get: function () { return table_1.parseIndexColumns; } });
 Object.defineProperty(exports, "indexMatchesColumns", { enumerable: true, get: function () { return table_1.indexMatchesColumns; } });
 Object.defineProperty(exports, "listIndexes", { enumerable: true, get: function () { return table_1.listIndexes; } });
 Object.defineProperty(exports, "createIndex", { enumerable: true, get: function () { return table_1.createIndex; } });
 Object.defineProperty(exports, "validateCreateIndex", { enumerable: true, get: function () { return table_1.validateCreateIndex; } });
-Object.defineProperty(exports, "DEFAULT_INDEX_FORM_PATH", { enumerable: true, get: function () { return table_1.DEFAULT_INDEX_FORM_PATH; } });
-Object.defineProperty(exports, "NOT_IN_UPDATE_SET", { enumerable: true, get: function () { return table_1.NOT_IN_UPDATE_SET; } });
+Object.defineProperty(exports, "captureRowName", { enumerable: true, get: function () { return table_1.captureRowName; } });
+Object.defineProperty(exports, "parseAjaxAnswer", { enumerable: true, get: function () { return table_1.parseAjaxAnswer; } });
+Object.defineProperty(exports, "parseCanCreate", { enumerable: true, get: function () { return table_1.parseCanCreate; } });
+Object.defineProperty(exports, "buildCanCreateFields", { enumerable: true, get: function () { return table_1.buildCanCreateFields; } });
+Object.defineProperty(exports, "buildCreateScheduleFields", { enumerable: true, get: function () { return table_1.buildCreateScheduleFields; } });
+Object.defineProperty(exports, "XMLHTTP_PATH", { enumerable: true, get: function () { return table_1.XMLHTTP_PATH; } });
+Object.defineProperty(exports, "DEFAULT_ACCESS_METHOD", { enumerable: true, get: function () { return table_1.DEFAULT_ACCESS_METHOD; } });
+Object.defineProperty(exports, "CAPTURE_NOTE", { enumerable: true, get: function () { return table_1.CAPTURE_NOTE; } });
 Object.defineProperty(exports, "setColumn", { enumerable: true, get: function () { return table_1.setColumn; } });
 Object.defineProperty(exports, "resolveAttributes", { enumerable: true, get: function () { return table_1.resolveAttributes; } });
 Object.defineProperty(exports, "toStoredValue", { enumerable: true, get: function () { return table_1.toStoredValue; } });

package/dist/mcp/registry.d.ts

@@ -10,7 +10,7 @@ import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 import type { ToolAnnotations } from "@tenonhq/dovetail-mcp-kit";
 import type { ServiceNowClient } from "../client";
-export declare var TOOL_NAMES: readonly ["create_view", "set_list_layout", "set_form_layout", "set_related_lists", "add_choices_to_field", "remove_choices_from_field", "flow_view", "action_view", "action_edit", "action_clone", "action_define", "flow_publish", "flow_copy", "flow_create", "flow_test", "flow_edit", "create_table", "add_column", "add_index", "index_list", "index_create", "set_column", "set_table", "set_field", "create_record", "delete_record", "host_assets", "invoke_rest", "app_publish", "update_set_export", "app_export"];
+export declare var TOOL_NAMES: readonly ["create_view", "set_list_layout", "set_form_layout", "set_related_lists", "add_choices_to_field", "remove_choices_from_field", "flow_view", "action_view", "action_edit", "action_clone", "action_define", "flow_publish", "flow_copy", "flow_create", "flow_test", "flow_edit", "create_table", "add_column", "design_access", "add_index", "index_list", "index_create", "set_column", "set_table", "set_field", "create_record", "delete_record", "host_assets", "invoke_rest", "app_publish", "update_set_export", "app_export"];
 export type ToolName = (typeof TOOL_NAMES)[number];
 export interface RegistryDeps {
     /** Optional client injection for tests; defaults to createClient({}). */

package/dist/mcp/registry.js

@@ -57,6 +57,7 @@ exports.TOOL_NAMES = [
     "flow_edit",
     "create_table",
     "add_column",
+    "design_access",
     "add_index",
     "index_list",
     "index_create",
@@ -445,7 +446,11 @@ function buildDescriptors(deps = {}) {
                 "<scope>_<name>, the dictionary row and its update-set capture land in scope); the table " +
                 "must allow new fields from other scopes (sys_db_object.alter_access) and updateSetSysId " +
                 "must belong to scope — both checked on dryRun too, and the stored element + sys_scope are " +
-                "read back. updateSetSysId is required on the live path. dryRun:true returns the plan with " +
+                "read back. A cross-scope result carries designAccess { present, sysId, created }: the " +
+                "platform UI refuses cross-scope authoring without a sys_scope_design_access record " +
+                "(scope -> the table's scope), so a missing one is FLAGGED (not blocking — the headless " +
+                "insert works without it); ensureDesignAccess:true creates it first in the same update " +
+                "set. updateSetSysId is required on the live path. dryRun:true returns the plan with " +
                 "no writes.",
             shape: schemas_1.addColumnSchema.shape,
             handler: async function (args) {
@@ -465,12 +470,43 @@ function buildDescriptors(deps = {}) {
                     column: p.column,
                     scope: p.scope,
                     crossScope: p.crossScope,
+                    ensureDesignAccess: p.ensureDesignAccess,
                     updateSetSysId: p.updateSetSysId,
                     dryRun: p.dryRun,
                     debug: p.debug,
                 });
             },
         },
+        {
+            name: "design_access",
+            annotations: dovetail_mcp_kit_1.WRITE_CREATE,
+            description: "Ensure the sys_scope_design_access record that lets sourceScope (the AUTHORING app) " +
+                "design in targetScope's tables (the app that OWNS them). The platform UI requires it " +
+                "for cross-scope columns — the symptom is \"Invalid 'Table' selected on the Dictionary " +
+                "Entry record ... can only select '<app>' tables with read access enabled\", and the " +
+                "table's own access flags are NOT the gate. Scopes are names or sys_scope sys_ids. " +
+                "Idempotent: an existing record returns status 'exists' and nothing is written. Live " +
+                "creates it via the scope-aware createRecord op switched to sourceScope, captured in " +
+                "updateSetSysId (must belong to sourceScope), then reads it back and asserts " +
+                "source/target. updateSetSysId is required on the live path; dryRun:true only reports " +
+                "exists / missing.",
+            shape: schemas_1.designAccessSchema.shape,
+            handler: async function (args) {
+                var p = schemas_1.designAccessSchema.parse(args);
+                if (p.dryRun !== true &&
+                    (!p.updateSetSysId || !p.updateSetSysId.trim())) {
+                    throw new Error("design_access: updateSetSysId (an update set in sourceScope) is required on " +
+                        "the live path — set dryRun:true to only check whether the record exists.");
+                }
+                return (0, table_1.ensureDesignAccess)({
+                    client: client(),
+                    sourceScope: p.sourceScope,
+                    targetScope: p.targetScope,
+                    updateSetSysId: p.updateSetSysId,
+                    dryRun: p.dryRun,
+                });
+            },
+        },
         {
             name: "add_index",
             annotations: dovetail_mcp_kit_1.WRITE_OVERWRITE,
@@ -539,7 +575,7 @@ function buildDescriptors(deps = {}) {
                 "admin (an ACL that refuses GET refuses POST), and sys_index_column does not exist at " +
                 "all (HTTP 400 'Invalid table') — there is no two-table index model to join. Each row " +
                 "returns { name, columns, type, rawColumns }: `columns` is v_db_index's bracketed " +
-                "`column_names` cell ('[phone]', '[a,b]') PARSED into a list, never substring-matched, " +
+                "`column_names` cell ('[phone]', '[a;b]' — semicolon-separated when composite) PARSED into a list, never substring-matched, " +
                 "and `type` is access_method (btree for essentially everything). UNIQUENESS IS NOT " +
                 "READABLE: v_db_index carries no uniqueness field, so a unique index and an ordinary " +
                 "one are indistinguishable in it — `unique` is therefore left ABSENT rather than " +
@@ -556,28 +592,38 @@ function buildDescriptors(deps = {}) {
             name: "index_create",
             annotations: dovetail_mcp_kit_1.WRITE_ADDITIVE_IDEMPOTENT,
             description: "Create a DATABASE INDEX on an EXISTING ServiceNow table — including the COMPOSITE and " +
-                "NON-UNIQUE indexes add_index cannot build. A DATABASE INDEX IS A PHYSICAL, PER-INSTANCE " +
-                "CHANGE: IT IS NOT CAPTURED IN AN UPDATE SET AND DOES NOT TRAVEL WITH A PROMOTION, so it " +
-                "must be re-run against every environment that needs it — which is why this tool takes " +
-                "no updateSetSysId. There is no record path to an index (sys_index is API-level-ACL 403, " +
-                "sys_index_column does not exist, and sys_dictionary.unique — the add_index lever — is " +
-                "per-column and unique-only), so this replays the platform's own index-creator form " +
-                "(sys_action=create_index) over a form-login session. DRY-RUN BY DEFAULT: without " +
-                "confirm:true NOTHING is sent and nothing is read; dryRun:true forces a dry-run even " +
-                "with confirm. IDEMPOTENT: on the live path v_db_index is read first, and an index over " +
-                "exactly these columns returns 'already-exists' with no write. `columns` is ORDERED — " +
-                "order is part of an index's identity and is preserved verbatim. `name` is REFUSED: the " +
-                "platform's form has no name input (ServiceNow names the index itself), so accepting one " +
-                "would mean reporting a name the instance does not carry — the created index's real name " +
-                "comes back in `name`. After the POST the index is polled for in v_db_index (default 10 " +
-                "checks, 3s apart, since a build on a populated table is asynchronous); if it never " +
-                "appears the result is 'failed', because a form processor returning a page is not " +
-                "evidence an ALTER ran — and a unique index cannot build over duplicate values, EMPTY " +
-                "included. verified:true means a matching row was READ BACK. 'uniqueness-enforced' is " +
-                "ALWAYS in unverified: v_db_index has no uniqueness field, so enforcement is provable " +
-                "only by a duplicate-insert test. Requires a username+password identity that can form-" +
-                "log-in; an instance on API-key-only auth or SSO/MFA will fail at the session with a " +
-                "diagnosis, because no .do replay can work there.",
+                "NON-UNIQUE indexes add_index cannot build. AN INDEX IS CAPTURED IN AN UPDATE SET: the " +
+                "platform's build job writes a sys_update_xml row (type=Indexes, name " +
+                "sys_index_<table>_<col>_…) into the session user's CURRENT update set, so " +
+                "updateSetSysId is REQUIRED on the live path — the tool pins that set as current " +
+                "(Dovetail changeUpdateSet, read back) BEFORE scheduling, refuses a set outside the " +
+                "table's application scope or not 'in progress', and reads the capture row back " +
+                "from that set afterwards. The physical index is still built per instance; committing " +
+                "the set elsewhere rebuilds it. There is no record path to an index (sys_index is " +
+                "API-level-ACL 403, sys_index_column does not exist, and sys_dictionary.unique — the " +
+                "add_index lever — is per-column and unique-only), so this replays the two GlideAjax " +
+                "calls the platform's own Database Indexes dialog makes on xmlhttp.do over a " +
+                "form-login session: IndexCreatorErrorChecker.canCreate (the dialog's pre-flight; a " +
+                "canCreate:false verdict is returned verbatim with its errorCode and nothing is " +
+                "scheduled) then ScheduleCreator.createSchedule (sysparm_table, sysparm_fields, " +
+                "sysparm_access_method — default btree — sysparm_unique true|false, no email, no " +
+                "name). DRY-RUN BY DEFAULT: without confirm:true NOTHING is sent and nothing is read; " +
+                "dryRun:true forces a dry-run even with confirm. IDEMPOTENT: on the live path " +
+                "v_db_index is read first, and an index over exactly these columns returns " +
+                "'already-exists' with no write. `columns` is ORDERED — order is part of an " +
+                "index's identity and is preserved verbatim. `name` is REFUSED: the dialog has no " +
+                "name input (ServiceNow names the index after its leading column), so accepting one " +
+                "would mean reporting a name the instance does not carry — the real name comes back " +
+                "in `name`. After scheduling, the index is polled for in v_db_index (default 10 " +
+                "checks, 3s apart); if it never appears the result is 'failed', because an accepted " +
+                "schedule is not evidence an ALTER ran — and a unique index cannot build over " +
+                "duplicate values, EMPTY included. verified:true means a matching row was READ BACK; " +
+                "captured:true means the sys_update_xml row was READ BACK from the pinned set (an " +
+                "index that exists but was not captured is created:true, captured:false with " +
+                "'update-set-capture' in unverified). 'uniqueness-enforced' is ALWAYS in " +
+                "unverified: v_db_index has no uniqueness field. Requires a username+password identity " +
+                "that can form-log-in; xmlhttp.do ignores Basic auth and API keys, so an API-key-only " +
+                "or SSO/MFA identity fails at the session with a diagnosis (TenonHQ/Dovetail#292).",
             shape: schemas_1.createIndexSchema.shape,
             handler: async function (args) {
                 var p = schemas_1.createIndexSchema.parse(args);
@@ -585,6 +631,7 @@ function buildDescriptors(deps = {}) {
                     client: client(),
                     table: p.table,
                     columns: p.columns,
+                    updateSetSysId: p.updateSetSysId,
                     unique: p.unique,
                     name: p.name,
                     accessMethod: p.accessMethod,