@tenonhq/dovetail-servicenow 0.0.50 → 0.0.51

package/README.md

@@ -736,7 +736,7 @@ admin, and `sys_index_column` does not exist at all (HTTP 400 `Invalid table`),
 is no two-table index model to join and nothing to cross-check against.
 
 Each row comes back as `{ name, columns, type, rawColumns }`. `columns` is the view's
-bracketed `column_names` cell (`"[phone]"`, `"[a,b]"`) **parsed** into a list - never
+bracketed `column_names` cell (`"[phone]"`, `"[a;b]"` - semicolon-separated when composite) **parsed** into a list - never
 substring-matched, because `"[owner_id]"` contains `"owner"`. `type` is `access_method`.
 
 **Uniqueness is not readable.** `v_db_index` has no uniqueness field, so a unique index
@@ -747,49 +747,73 @@ is wrong than that the table is unindexed - every physical table has a `PRIMARY`
 
 ### Create an index (composite and non-unique included)
 
-> **A DATABASE INDEX IS A PHYSICAL, PER-INSTANCE CHANGE. IT IS NOT CAPTURED IN AN UPDATE
-> SET AND DOES NOT TRAVEL WITH A PROMOTION.** Re-run `index-create` against every
-> environment that needs the index (dev, test, uat, staging, prod). There is deliberately
-> no `--update-set` - passing one is an error, not a silent no-op.
+> **An index IS captured in an update set.** The platform's build job writes a
+> `sys_update_xml` row (`type=Indexes`, name `sys_index_<table>_<col>_<col>…`) into the
+> session user's **current** update set - the Database Indexes dialog says so itself, and
+> it was read back live on tenonworkstudio 2026-10-08. `--update-set` is therefore
+> **required** on the live path: the verb pins that set as current first and reads the
+> capture row back from it afterwards. The physical index is still built per instance;
+> committing the set elsewhere rebuilds it there.
 
 ```bash
-# Dry-run (the DEFAULT) - sends nothing and reads nothing
+# Dry-run (the DEFAULT) - sends nothing and reads nothing; no update set needed
 npx dove-sn index-create --table x_cadso_journey_instance --columns state,created_on
 
 # Send it
 npx dove-sn index-create \
-  --table x_cadso_journey_instance --columns state,created_on --confirm --json
+  --table x_cadso_journey_instance --columns state,created_on \
+  --update-set <sys_id> --confirm --json
 ```
 
 This is what `add-index` cannot do. `sys_dictionary.unique` - the only record-shaped lever
 - is **per-column and unique-only**, so composite and plain indexes have no record path at
-all. `index-create` instead replays the platform's own index-creator form
-(`sys_action=create_index`, `sysparm_index_table`, `sysparm_fields`,
-`sysparm_unique_index_SKIP`) over a form-login session. That contract is lifted from the
-instance's shipped `index_creator_information` UI macro, not from a guess, and the POST
-target is taken from the rendered page's own `<form action>`.
+all (`sys_index` is API-level-ACL 403, `sys_index_column` does not exist). `index-create`
+instead replays the two GlideAjax calls the platform's own Database Indexes dialog makes
+on `xmlhttp.do` over a form-login session - taken from a HAR of the Studio dialog plus the
+`dialog_index_create` UI page's client script, both read live:
+
+1. `IndexCreatorErrorChecker` / `canCreate` - the dialog's pre-flight (`sysparm_table_name`,
+   `sysparm_field_names`, `sysparm_unique`, `sysparm_access_method`). A `canCreate:false`
+   verdict is returned verbatim with its `errorCode` and nothing is scheduled.
+2. `ScheduleCreator` / `createSchedule` - schedules the build (`sysparm_table`,
+   `sysparm_fields`, `sysparm_access_method` - default `btree`, exactly as the dialog's
+   client JS does - `sysparm_unique` `true|false`, empty `sysparm_email` = no
+   notification, empty `sysparm_schedule_name`).
+
+(The `index_creator_dialog` page's `sys_action=create_index` form is inert - the browser
+never submits it, and the UI page has no processing script. The earlier form-POST replay
+was a silent no-op for that reason.)
 
 - **Dry-run by default.** Without `--confirm` nothing is sent *and nothing is read*;
   `--dry-run` forces a plan even with `--confirm`.
+- **Target checks before anything else.** The table must exist; the update set must exist,
+  be `in progress`, and belong to the table's application scope - a set in another scope
+  is refused, because the capture row would land in the wrong scope.
 - **Idempotent.** On the live path `v_db_index` is read first, and an index over *exactly*
-  these columns short-circuits to `already-exists` with no form session and no write.
-  Column **order** is part of an index's identity - `[a,b]` is not `[b,a]`.
-- **`--name` is refused.** The platform's form has no name input; ServiceNow names the
-  index itself. Reporting a name the instance does not carry would be a lie, so the
-  created index's *real* name is returned in `name` instead.
-- **The read-back is the proof.** After the POST the index is polled for in `v_db_index`
-  (default 10 checks, 3 s apart - a build on a populated table is asynchronous). If it
-  never appears the status is `failed`: a form processor returning a page is not evidence
-  an ALTER ran, and a unique index cannot build over duplicate values (EMPTY counts).
+  these columns short-circuits to `already-exists` with no pin, no form session and no
+  write. Column **order** is part of an index's identity - `[a;b]` is not `[b;a]`.
+- **The pin is read back.** The set is pinned with Dovetail's own `changeUpdateSet` and
+  `currentUpdateSet` is read; a pin that did not take stops the run before the session
+  opens.
+- **`--name` is refused.** The dialog has no name input; ServiceNow names the index after
+  its leading column (live: `[sys_created_on;status;version_step;version]` → index
+  `sys_created_on`). The created index's *real* name is returned in `name`.
+- **The read-back is the proof.** After scheduling, the index is polled for in `v_db_index`
+  (default 10 checks, 3 s apart). If it never appears the status is `failed`: an accepted
+  schedule is not evidence an ALTER ran, and a unique index cannot build over duplicate
+  values (EMPTY counts). Then the capture row is looked for in the pinned set:
+  `captured:true` only when it was read back; an index that exists but was not captured
+  is `created:true, captured:false` with `update-set-capture` in `unverified` - and
+  exit code 2, because it will not travel.
 - **Uniqueness is still never claimed.** `uniqueness-enforced` stays in `unverified` on
   every status.
 
-**Requires a username+password identity that can form-log-in.** An instance on
-API-key-only auth, SSO or MFA rejects the form login however valid the API key is; the
-verb fails at the session with that diagnosis rather than a mystery 302, and no `.do`
-replay (including `create-table`'s) can work in that state.
+**Requires a username+password identity that can form-log-in.** `xmlhttp.do` ignores
+Basic auth and API keys, so an API-key-only, SSO or MFA identity fails at the session with
+that diagnosis (TenonHQ/Dovetail#292).
 
-Exit codes: `0` created / already-exists / dry-run, `1` bad args, `2` failed.
+Exit codes: `0` created / already-exists / dry-run, `1` bad args, `2` failed - and `2`
+when the index was created but its capture row was not found in the pinned set.
 
 ### Set a field on a record
 
@@ -1167,9 +1191,9 @@ read back from the `v_db_index` view - uniqueness enforcement is always reported
 unverified) / `index_list` (read-only: a table's database indexes from `v_db_index`,
 the only index read surface - `sys_index` is API-level-ACL 403 and `sys_index_column`
 does not exist) / `index_create` (create an index, composite and non-unique included, by
-replaying the platform index-creator form; dry-run by default, idempotent, read back from
-`v_db_index` - and **not** captured in an update set, because a database index is a
-physical per-instance change), the record-write verbs `set_field` (update scalar fields on an
+replaying the Database Indexes dialog's own processor calls; dry-run by default, idempotent,
+pinned to a required update set, read back from `v_db_index` and the capture row read back
+from `sys_update_xml`), the record-write verbs `set_field` (update scalar fields on an
 existing record), `create_record` (insert one record) and `delete_record` (delete one
 record — dry-run by default, `confirm:true` to apply, `updateSetSysId` required, the
 record read back before AND after so success is only reported once it is confirmed

package/dist/cli.js

@@ -1588,16 +1588,19 @@ async function runIndexList(flags) {
 }
 /**
  * dove-sn index-create:
- *   --table x_cadso_core_u_smoke --columns a,b [--unique] [--access-method <m>]
- *   [--confirm] [--dry-run] [--poll-attempts <n>] [--poll-interval-ms <n>]
- *   [--debug] [--json]
+ *   --table x_cadso_core_u_smoke --columns a,b --update-set <sys_id> [--unique]
+ *   [--access-method <m>] [--confirm] [--dry-run] [--poll-attempts <n>]
+ *   [--poll-interval-ms <n>] [--debug] [--json]
  *
  * DRY-RUN BY DEFAULT — nothing is sent (and nothing is even READ) without --confirm;
- * --dry-run forces a plan even with it. There is deliberately NO --update-set: a
- * database index is physical and is not captured in one.
+ * --dry-run forces a plan even with it. --update-set is REQUIRED on the live path:
+ * the build job captures the index definition (sys_update_xml type=Indexes) into the
+ * user's CURRENT update set, so the verb pins that set first and reads the capture
+ * row back from it afterwards.
  *
  * Exit codes: 0 created / already-exists / dry-run, 1 bad args, 2 failed (which
- * includes "the form was posted but no index was read back").
+ * includes "scheduled but no index was read back") — and 2 when the index was read
+ * back but its capture row was NOT found in the pinned set.
  */
 async function runIndexCreate(flags) {
     var columns = splitList(flags.columns || "");
@@ -1605,10 +1608,12 @@ async function runIndexCreate(flags) {
         process.stderr.write("index-create: --table <name> and --columns <a[,b,...]> are required\n");
         return 1;
     }
-    if (flags["update-set"]) {
-        process.stderr.write("index-create: --update-set is not accepted. A database index is a PHYSICAL, " +
-            "PER-INSTANCE change — it is NOT captured in an update set and does not " +
-            "travel with a promotion. Run index-create against each environment.\n");
+    // DRY-RUN BY DEFAULT: --confirm is what sends; --dry-run forces a plan even with it.
+    var indexDryRun = flags["dry-run"] === "true" || flags.confirm !== "true";
+    if (!indexDryRun && !flags["update-set"]) {
+        process.stderr.write("index-create: --update-set is required on the live path — the index " +
+            "definition is captured into the user's CURRENT update set, so it must be " +
+            "pinned first (only a dry-run works without one)\n");
         return 1;
     }
     var params = {
@@ -1623,8 +1628,8 @@ async function runIndexCreate(flags) {
         params.name = flags.name;
     if (flags["access-method"])
         params.accessMethod = flags["access-method"];
-    if (flags["form-path"])
-        params.formPath = flags["form-path"];
+    if (flags["update-set"])
+        params.updateSetSysId = flags["update-set"];
     if (flags.debug === "true")
         params.debug = true;
     // A non-integer poll setting would make the bounded wait unbounded (or zero).
@@ -1663,6 +1668,12 @@ async function runIndexCreate(flags) {
             (result.name ? " -> " + result.name : "") +
             (result.instance ? " on " + result.instance : "") +
             (result.verified ? " — verified" : "") +
+            (result.updateSet
+                ? " [update set " +
+                    (result.updateSet.name || result.updateSet.sysId) +
+                    (result.captured ? " — captured" : " — capture NOT verified") +
+                    "]"
+                : "") +
             "\n" +
             result.note +
             "\nUNVERIFIED: " +
@@ -1671,6 +1682,10 @@ async function runIndexCreate(flags) {
     }
     if (result.status === "failed")
         return 2;
+    // An index that exists but whose definition was not captured will not travel —
+    // surface that as a non-zero exit, the same way an unread-back index is.
+    if (result.status === "created" && !result.captured)
+        return 2;
     return 0;
 }
 /** Parse a CLI boolean flag. Bare `--mandatory` means true; `--mandatory false` means

package/dist/cliUsage.js

@@ -332,14 +332,15 @@ exports.VERB_USAGE = {
         ],
     },
     "index-create": {
-        summary: "Create a DATABASE index (composite and non-unique included) by replaying the platform index-creator form, then read it back",
+        summary: "Create a DATABASE index (composite and non-unique included) by replaying the platform Database Indexes dialog's processor calls, pinned to an update set, then read it back",
         required: [
             { flag: "table", value: "<name>" },
             { flag: "columns", value: "<a[,b,...]>", note: "Comma-separated column elements, in index order." },
+            { flag: "update-set", value: "<sys_id>", note: "Required on the live path; the index definition is captured into it. Must be in the table's application scope." },
         ],
         optional: [
             { flag: "unique" },
-            { flag: "access-method", value: "<m>", note: "Platform access method (default: the form's default)." },
+            { flag: "access-method", value: "<m>", note: "Platform access method (default: btree, as the dialog does)." },
             CONFIRM_FLAG,
             FORCE_DRY_RUN_FLAG,
             { flag: "poll-attempts", value: "<n>", note: "Positive integer." },
@@ -349,11 +350,12 @@ exports.VERB_USAGE = {
         ],
         gate: "confirm",
         gateNote: "Nothing is sent OR read without --confirm.",
-        example: "dove-sn index-create --table x_cadso_journey_instance --columns state,created_on --confirm",
+        example: "dove-sn index-create --table x_cadso_journey_instance --columns state,created_on --update-set <sys_id> --confirm",
         notes: [
-            "A DATABASE INDEX IS PHYSICAL AND PER-INSTANCE: not captured in an update set, does not travel with a promotion — re-run it against every environment. --update-set is therefore REFUSED.",
-            "Idempotent: an index over exactly those columns returns already-exists with no write. --name is refused (the form has no name input; the real name is returned).",
-            "Needs a username+password identity that can form-log-in.",
+            "An index IS captured in an update set: the build job writes a sys_update_xml row (type=Indexes) into the user's CURRENT set, so --update-set is pinned first and the capture row is read back from it. The physical index is still built per instance; committing the set elsewhere rebuilds it.",
+            "Replays the dialog's own xmlhttp.do calls: IndexCreatorErrorChecker.canCreate (pre-flight) then ScheduleCreator.createSchedule. Idempotent: an index over exactly those columns returns already-exists with no write. --name is refused (the dialog has no name input; the real name is returned).",
+            "Needs a username+password identity that can form-log-in (xmlhttp.do ignores Basic auth / API keys).",
+            "Exit 2 when the index was scheduled but never read back from v_db_index, and when it was read back but its capture row was not found in the pinned set.",
         ],
     },
     "set-field": {

package/dist/index.d.ts

@@ -21,7 +21,7 @@ export { sincPlugin } from "./plugin";
 export { listTemplates, verifyArtifact, cloneSubflow, cloneActionType, resolveScope, slugInternalName, fetchActionSteps, findStepInput, triggerPublication, publishActionType, editActionType, defineActionType, planActionDefinition, validateDefineSpec, applyStepOps, verifySteps, summarizeSteps, formatStepPill, readFlow, readActionType, publishFlow, copyFlow, createFlow, buildPublishModel, editFlow, testFlow, DEFAULT_RUN_FLOW_PATH, generateSysId, topoSort, executeWritePlan, WriteOrderError, } from "./flowDesigner";
 export type { TemplateRef, ListTemplatesParams, FlowKind, VerifyExpect, VerifyFound, VerifyFailure, VerifyReport, VerifyArtifactParams, CloneSubflowParams, CloneSubflowResult, CloneActionTypeParams, CloneActionTypeResult, CloneActionTypePlan, CloneActionTypeStepReport, TriggerPublicationParams, TriggerPublicationResult, PublishActionTypeParams, PublishActionTypeResult, EditActionTypeParams, EditActionTypeResult, EditActionTypeOps, DefineActionSpec, DefineActionInputSpec, DefineActionOutputSpec, DefineStepSpec, DefineStepVarSpec, DefineStepOutputSpec, DefineStepValue, DefineActionTypeParams, DefineActionTypeResult, DefineActionDiff, DefineActionPlan, PlanActionDefinitionParams, ActionView, StepView, StepOps, StepRecord, StepSummary, StepIoSummary, PatchStepScriptOp, SetStepInputOp, AddStepOutputOp, AddStepInputOp, ApplyStepOpsResult, VerifyStepsResult, ReadFlowParams, ReadFlowResult, FlowStep, FlowVariable, ReadActionTypeParams, ReadActionTypeResult, ActionIo, PublishFlowParams, PublishFlowResult, CopyFlowParams, CopyFlowResult, CreateFlowParams, CreateFlowResult, EditFlowParams, EditFlowResult, EditFlowOps, StepInputPatch, TestFlowParams, TestFlowResult, WriteOp, WriteOpResult, } from "./flowDesigner";
 export type { ServiceNowClientConfig, ChoiceValue, ChoiceType, AddChoicesParams, AddChoicesResult, ChoiceActionResult, ChoiceFieldRef, RemoveChoicesParams, RemoveChoicesResult, ChoiceRemovalResult, DictionaryRecord, UpdateSetRecord, LayoutAction, LayoutRecordResult, LayoutResult, CreateViewParams, CreateViewResult, FormSectionSpec, SetFormLayoutParams, SetListLayoutParams, SetRelatedListsParams, ChunkRole, ChunkInfo, ChunkResult, PrunedResult, HostAssetsParams, HostAssetsResult, } from "./types";
-export { createTable, projectTableGraph, buildColumnXml, normalizeColumns, resolveType, applyTableSaveOverlay, defaultAccessFlags, TYPE_MAP, DEFAULT_SUPER_CLASS, DEFAULT_SAVE_ACTION, addColumn, deriveElement, ensureDesignAccess, findDesignAccess, DESIGN_ACCESS_TABLE, addIndex, parseIndexColumns, indexMatchesColumns, listIndexes, createIndex, validateCreateIndex, DEFAULT_INDEX_FORM_PATH, NOT_IN_UPDATE_SET, setColumn, resolveAttributes, toStoredValue, setTable, resolveTableAttributes, } from "./table";
+export { createTable, projectTableGraph, buildColumnXml, normalizeColumns, resolveType, applyTableSaveOverlay, defaultAccessFlags, TYPE_MAP, DEFAULT_SUPER_CLASS, DEFAULT_SAVE_ACTION, addColumn, deriveElement, ensureDesignAccess, findDesignAccess, DESIGN_ACCESS_TABLE, addIndex, parseIndexColumns, indexMatchesColumns, listIndexes, createIndex, validateCreateIndex, captureRowName, parseAjaxAnswer, parseCanCreate, buildCanCreateFields, buildCreateScheduleFields, XMLHTTP_PATH, DEFAULT_ACCESS_METHOD, CAPTURE_NOTE, setColumn, resolveAttributes, toStoredValue, setTable, resolveTableAttributes, } from "./table";
 export type { CreateTableParams, CreateTableResult, AddColumnParams, AddColumnResult, DesignAccessFlag, EnsureDesignAccessParams, EnsureDesignAccessResult, AddIndexParams, AddIndexResult, AddIndexVerification, ListIndexesParams, ListIndexesResult, TableIndex, CreateIndexParams, CreateIndexResult, SetColumnParams, SetColumnResult, ColumnAttributes, AttributeChange, SetTableParams, SetTableResult, TableAttributes, TableGraph, NormalizedColumn, ColumnSpec, AccessFlags, OverlaySpec, } from "./table";
 export { setField } from "./setField";
 export { createRecord } from "./createRecord";

package/dist/index.js

@@ -7,8 +7,9 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.editFlow = exports.buildPublishModel = exports.createFlow = exports.copyFlow = exports.publishFlow = exports.readActionType = exports.readFlow = exports.formatStepPill = exports.summarizeSteps = exports.verifySteps = exports.applyStepOps = exports.validateDefineSpec = exports.planActionDefinition = exports.defineActionType = exports.editActionType = exports.publishActionType = exports.triggerPublication = exports.findStepInput = exports.fetchActionSteps = exports.slugInternalName = exports.resolveScope = exports.cloneActionType = exports.cloneSubflow = exports.verifyArtifact = exports.listTemplates = exports.sincPlugin = exports.formatCreateViewResult = exports.formatLayoutResult = exports.setRelatedLists = exports.setFormLayout = exports.setListLayout = exports.createView = exports.formatRemoveChoicesResult = exports.formatAddChoicesResult = exports.formatHostAssetsResult = exports.classifyChunks = exports.hostAssets = exports.ChoiceWriteError = exports.removeChoicesFromField = exports.addChoicesToField = exports.resolveConfigFromEnvFile = exports.createClientFromEnvFile = exports.assertWriteAllowed = exports.evaluateWriteGate = exports.isCiEnvironment = exports.resolveExecutionContext = exports.PROCESSFLOW_PATH_PREFIX = exports.isProcessflowPath = exports.resolveFlowAuth = exports.createClient = void 0;
-exports.parsePublishTargets = exports.describeTarget = exports.resolveUpdateSetNaming = exports.buildPublishToUpdateSetFields = exports.buildCreateUpdateSetFields = exports.buildStartFields = exports.publishApp = exports.INVOKE_REST_METHODS = exports.invokeRest = exports.verifyReadBack = exports.readBackMatches = exports.hasHtmlEntity = exports.decodeHtmlEntities = exports.deleteRecord = exports.createRecord = exports.setField = exports.resolveTableAttributes = exports.setTable = exports.toStoredValue = exports.resolveAttributes = exports.setColumn = exports.NOT_IN_UPDATE_SET = exports.DEFAULT_INDEX_FORM_PATH = exports.validateCreateIndex = exports.createIndex = exports.listIndexes = exports.indexMatchesColumns = exports.parseIndexColumns = exports.addIndex = exports.DESIGN_ACCESS_TABLE = exports.findDesignAccess = exports.ensureDesignAccess = exports.deriveElement = exports.addColumn = exports.DEFAULT_SAVE_ACTION = exports.DEFAULT_SUPER_CLASS = exports.TYPE_MAP = exports.defaultAccessFlags = exports.applyTableSaveOverlay = exports.resolveType = exports.normalizeColumns = exports.buildColumnXml = exports.projectTableGraph = exports.createTable = exports.WriteOrderError = exports.executeWritePlan = exports.topoSort = exports.generateSysId = exports.DEFAULT_RUN_FLOW_PATH = exports.testFlow = void 0;
-exports.SECRET_INTERNAL_TYPES = exports.SENTINEL = exports.isCapturable = exports.secretFieldsFromDictionary = exports.mergeSecretRules = exports.loadSecretRules = exports.defaultSecretRules = exports.escapeRegExp = exports.encodeXmlText = exports.encodeXmlEntities = exports.stripJsonValue = exports.stripField = exports.plannedStrips = exports.recordFieldNames = exports.readRecordTable = exports.readField = exports.verifyStripped = exports.stripSecrets = exports.DEFAULT_EXPORT_APP_TIMEOUT_MS = exports.buildPublishFields = exports.buildCreateSetFields = exports.exportApp = exports.DEFAULT_MAX_ROWS = exports.MAX_PAGE_SIZE = exports.DEFAULT_PAGE_SIZE = exports.UPDATE_XML_FIELDS = exports.xmlEscape = exports.formatUnloadDate = exports.parseStatsCount = exports.refreshTypeFields = exports.fetchUpdateXmlRows = exports.countUpdateXml = exports.countUnloadRecords = exports.renderUnload = exports.renderRemoteUpdateSet = exports.renderUpdateXmlRow = exports.exportUpdateSet = exports.PUBLISH_POLL_DELAYS_MS = exports.DEFAULT_PUBLISH_TIMEOUT_MS = exports.parseCicdProgress = exports.parseCicdPublishResponse = exports.harvestProgressResults = exports.flattenSteps = exports.classifyProgress = exports.parseProgressTree = exports.parseXmlAnswer = exports.PUBLISH_TARGETS = void 0;
+exports.publishApp = exports.INVOKE_REST_METHODS = exports.invokeRest = exports.verifyReadBack = exports.readBackMatches = exports.hasHtmlEntity = exports.decodeHtmlEntities = exports.deleteRecord = exports.createRecord = exports.setField = exports.resolveTableAttributes = exports.setTable = exports.toStoredValue = exports.resolveAttributes = exports.setColumn = exports.CAPTURE_NOTE = exports.DEFAULT_ACCESS_METHOD = exports.XMLHTTP_PATH = exports.buildCreateScheduleFields = exports.buildCanCreateFields = exports.parseCanCreate = exports.parseAjaxAnswer = exports.captureRowName = exports.validateCreateIndex = exports.createIndex = exports.listIndexes = exports.indexMatchesColumns = exports.parseIndexColumns = exports.addIndex = exports.DESIGN_ACCESS_TABLE = exports.findDesignAccess = exports.ensureDesignAccess = exports.deriveElement = exports.addColumn = exports.DEFAULT_SAVE_ACTION = exports.DEFAULT_SUPER_CLASS = exports.TYPE_MAP = exports.defaultAccessFlags = exports.applyTableSaveOverlay = exports.resolveType = exports.normalizeColumns = exports.buildColumnXml = exports.projectTableGraph = exports.createTable = exports.WriteOrderError = exports.executeWritePlan = exports.topoSort = exports.generateSysId = exports.DEFAULT_RUN_FLOW_PATH = exports.testFlow = void 0;
+exports.secretFieldsFromDictionary = exports.mergeSecretRules = exports.loadSecretRules = exports.defaultSecretRules = exports.escapeRegExp = exports.encodeXmlText = exports.encodeXmlEntities = exports.stripJsonValue = exports.stripField = exports.plannedStrips = exports.recordFieldNames = exports.readRecordTable = exports.readField = exports.verifyStripped = exports.stripSecrets = exports.DEFAULT_EXPORT_APP_TIMEOUT_MS = exports.buildPublishFields = exports.buildCreateSetFields = exports.exportApp = exports.DEFAULT_MAX_ROWS = exports.MAX_PAGE_SIZE = exports.DEFAULT_PAGE_SIZE = exports.UPDATE_XML_FIELDS = exports.xmlEscape = exports.formatUnloadDate = exports.parseStatsCount = exports.refreshTypeFields = exports.fetchUpdateXmlRows = exports.countUpdateXml = exports.countUnloadRecords = exports.renderUnload = exports.renderRemoteUpdateSet = exports.renderUpdateXmlRow = exports.exportUpdateSet = exports.PUBLISH_POLL_DELAYS_MS = exports.DEFAULT_PUBLISH_TIMEOUT_MS = exports.parseCicdProgress = exports.parseCicdPublishResponse = exports.harvestProgressResults = exports.flattenSteps = exports.classifyProgress = exports.parseProgressTree = exports.parseXmlAnswer = exports.PUBLISH_TARGETS = exports.parsePublishTargets = exports.describeTarget = exports.resolveUpdateSetNaming = exports.buildPublishToUpdateSetFields = exports.buildCreateUpdateSetFields = exports.buildStartFields = void 0;
+exports.SECRET_INTERNAL_TYPES = exports.SENTINEL = exports.isCapturable = void 0;
 var client_1 = require("./client");
 Object.defineProperty(exports, "createClient", { enumerable: true, get: function () { return client_1.createClient; } });
 Object.defineProperty(exports, "resolveFlowAuth", { enumerable: true, get: function () { return client_1.resolveFlowAuth; } });
@@ -100,8 +101,14 @@ Object.defineProperty(exports, "indexMatchesColumns", { enumerable: true, get: f
 Object.defineProperty(exports, "listIndexes", { enumerable: true, get: function () { return table_1.listIndexes; } });
 Object.defineProperty(exports, "createIndex", { enumerable: true, get: function () { return table_1.createIndex; } });
 Object.defineProperty(exports, "validateCreateIndex", { enumerable: true, get: function () { return table_1.validateCreateIndex; } });
-Object.defineProperty(exports, "DEFAULT_INDEX_FORM_PATH", { enumerable: true, get: function () { return table_1.DEFAULT_INDEX_FORM_PATH; } });
-Object.defineProperty(exports, "NOT_IN_UPDATE_SET", { enumerable: true, get: function () { return table_1.NOT_IN_UPDATE_SET; } });
+Object.defineProperty(exports, "captureRowName", { enumerable: true, get: function () { return table_1.captureRowName; } });
+Object.defineProperty(exports, "parseAjaxAnswer", { enumerable: true, get: function () { return table_1.parseAjaxAnswer; } });
+Object.defineProperty(exports, "parseCanCreate", { enumerable: true, get: function () { return table_1.parseCanCreate; } });
+Object.defineProperty(exports, "buildCanCreateFields", { enumerable: true, get: function () { return table_1.buildCanCreateFields; } });
+Object.defineProperty(exports, "buildCreateScheduleFields", { enumerable: true, get: function () { return table_1.buildCreateScheduleFields; } });
+Object.defineProperty(exports, "XMLHTTP_PATH", { enumerable: true, get: function () { return table_1.XMLHTTP_PATH; } });
+Object.defineProperty(exports, "DEFAULT_ACCESS_METHOD", { enumerable: true, get: function () { return table_1.DEFAULT_ACCESS_METHOD; } });
+Object.defineProperty(exports, "CAPTURE_NOTE", { enumerable: true, get: function () { return table_1.CAPTURE_NOTE; } });
 Object.defineProperty(exports, "setColumn", { enumerable: true, get: function () { return table_1.setColumn; } });
 Object.defineProperty(exports, "resolveAttributes", { enumerable: true, get: function () { return table_1.resolveAttributes; } });
 Object.defineProperty(exports, "toStoredValue", { enumerable: true, get: function () { return table_1.toStoredValue; } });

package/dist/mcp/registry.js

@@ -575,7 +575,7 @@ function buildDescriptors(deps = {}) {
                 "admin (an ACL that refuses GET refuses POST), and sys_index_column does not exist at " +
                 "all (HTTP 400 'Invalid table') — there is no two-table index model to join. Each row " +
                 "returns { name, columns, type, rawColumns }: `columns` is v_db_index's bracketed " +
-                "`column_names` cell ('[phone]', '[a,b]') PARSED into a list, never substring-matched, " +
+                "`column_names` cell ('[phone]', '[a;b]' — semicolon-separated when composite) PARSED into a list, never substring-matched, " +
                 "and `type` is access_method (btree for essentially everything). UNIQUENESS IS NOT " +
                 "READABLE: v_db_index carries no uniqueness field, so a unique index and an ordinary " +
                 "one are indistinguishable in it — `unique` is therefore left ABSENT rather than " +
@@ -592,28 +592,38 @@ function buildDescriptors(deps = {}) {
             name: "index_create",
             annotations: dovetail_mcp_kit_1.WRITE_ADDITIVE_IDEMPOTENT,
             description: "Create a DATABASE INDEX on an EXISTING ServiceNow table — including the COMPOSITE and " +
-                "NON-UNIQUE indexes add_index cannot build. A DATABASE INDEX IS A PHYSICAL, PER-INSTANCE " +
-                "CHANGE: IT IS NOT CAPTURED IN AN UPDATE SET AND DOES NOT TRAVEL WITH A PROMOTION, so it " +
-                "must be re-run against every environment that needs it — which is why this tool takes " +
-                "no updateSetSysId. There is no record path to an index (sys_index is API-level-ACL 403, " +
-                "sys_index_column does not exist, and sys_dictionary.unique — the add_index lever — is " +
-                "per-column and unique-only), so this replays the platform's own index-creator form " +
-                "(sys_action=create_index) over a form-login session. DRY-RUN BY DEFAULT: without " +
-                "confirm:true NOTHING is sent and nothing is read; dryRun:true forces a dry-run even " +
-                "with confirm. IDEMPOTENT: on the live path v_db_index is read first, and an index over " +
-                "exactly these columns returns 'already-exists' with no write. `columns` is ORDERED — " +
-                "order is part of an index's identity and is preserved verbatim. `name` is REFUSED: the " +
-                "platform's form has no name input (ServiceNow names the index itself), so accepting one " +
-                "would mean reporting a name the instance does not carry — the created index's real name " +
-                "comes back in `name`. After the POST the index is polled for in v_db_index (default 10 " +
-                "checks, 3s apart, since a build on a populated table is asynchronous); if it never " +
-                "appears the result is 'failed', because a form processor returning a page is not " +
-                "evidence an ALTER ran — and a unique index cannot build over duplicate values, EMPTY " +
-                "included. verified:true means a matching row was READ BACK. 'uniqueness-enforced' is " +
-                "ALWAYS in unverified: v_db_index has no uniqueness field, so enforcement is provable " +
-                "only by a duplicate-insert test. Requires a username+password identity that can form-" +
-                "log-in; an instance on API-key-only auth or SSO/MFA will fail at the session with a " +
-                "diagnosis, because no .do replay can work there.",
+                "NON-UNIQUE indexes add_index cannot build. AN INDEX IS CAPTURED IN AN UPDATE SET: the " +
+                "platform's build job writes a sys_update_xml row (type=Indexes, name " +
+                "sys_index_<table>_<col>_…) into the session user's CURRENT update set, so " +
+                "updateSetSysId is REQUIRED on the live path — the tool pins that set as current " +
+                "(Dovetail changeUpdateSet, read back) BEFORE scheduling, refuses a set outside the " +
+                "table's application scope or not 'in progress', and reads the capture row back " +
+                "from that set afterwards. The physical index is still built per instance; committing " +
+                "the set elsewhere rebuilds it. There is no record path to an index (sys_index is " +
+                "API-level-ACL 403, sys_index_column does not exist, and sys_dictionary.unique — the " +
+                "add_index lever — is per-column and unique-only), so this replays the two GlideAjax " +
+                "calls the platform's own Database Indexes dialog makes on xmlhttp.do over a " +
+                "form-login session: IndexCreatorErrorChecker.canCreate (the dialog's pre-flight; a " +
+                "canCreate:false verdict is returned verbatim with its errorCode and nothing is " +
+                "scheduled) then ScheduleCreator.createSchedule (sysparm_table, sysparm_fields, " +
+                "sysparm_access_method — default btree — sysparm_unique true|false, no email, no " +
+                "name). DRY-RUN BY DEFAULT: without confirm:true NOTHING is sent and nothing is read; " +
+                "dryRun:true forces a dry-run even with confirm. IDEMPOTENT: on the live path " +
+                "v_db_index is read first, and an index over exactly these columns returns " +
+                "'already-exists' with no write. `columns` is ORDERED — order is part of an " +
+                "index's identity and is preserved verbatim. `name` is REFUSED: the dialog has no " +
+                "name input (ServiceNow names the index after its leading column), so accepting one " +
+                "would mean reporting a name the instance does not carry — the real name comes back " +
+                "in `name`. After scheduling, the index is polled for in v_db_index (default 10 " +
+                "checks, 3s apart); if it never appears the result is 'failed', because an accepted " +
+                "schedule is not evidence an ALTER ran — and a unique index cannot build over " +
+                "duplicate values, EMPTY included. verified:true means a matching row was READ BACK; " +
+                "captured:true means the sys_update_xml row was READ BACK from the pinned set (an " +
+                "index that exists but was not captured is created:true, captured:false with " +
+                "'update-set-capture' in unverified). 'uniqueness-enforced' is ALWAYS in " +
+                "unverified: v_db_index has no uniqueness field. Requires a username+password identity " +
+                "that can form-log-in; xmlhttp.do ignores Basic auth and API keys, so an API-key-only " +
+                "or SSO/MFA identity fails at the session with a diagnosis (TenonHQ/Dovetail#292).",
             shape: schemas_1.createIndexSchema.shape,
             handler: async function (args) {
                 var p = schemas_1.createIndexSchema.parse(args);
@@ -621,6 +631,7 @@ function buildDescriptors(deps = {}) {
                     client: client(),
                     table: p.table,
                     columns: p.columns,
+                    updateSetSysId: p.updateSetSysId,
                     unique: p.unique,
                     name: p.name,
                     accessMethod: p.accessMethod,

package/dist/mcp/schemas.d.ts

@@ -1983,6 +1983,7 @@ export declare var listIndexesSchema: z.ZodObject<{
 export declare var createIndexSchema: z.ZodObject<{
     table: z.ZodString;
     columns: z.ZodArray<z.ZodString, "many">;
+    updateSetSysId: z.ZodOptional<z.ZodString>;
     unique: z.ZodOptional<z.ZodBoolean>;
     name: z.ZodOptional<z.ZodString>;
     accessMethod: z.ZodOptional<z.ZodString>;
@@ -1998,6 +1999,7 @@ export declare var createIndexSchema: z.ZodObject<{
     confirm?: boolean | undefined;
     dryRun?: boolean | undefined;
     debug?: boolean | undefined;
+    updateSetSysId?: string | undefined;
     unique?: boolean | undefined;
     accessMethod?: string | undefined;
     pollAttempts?: number | undefined;
@@ -2009,6 +2011,7 @@ export declare var createIndexSchema: z.ZodObject<{
     confirm?: boolean | undefined;
     dryRun?: boolean | undefined;
     debug?: boolean | undefined;
+    updateSetSysId?: string | undefined;
     unique?: boolean | undefined;
     accessMethod?: string | undefined;
     pollAttempts?: number | undefined;

package/dist/mcp/schemas.js

@@ -413,11 +413,13 @@ exports.listIndexesSchema = zod_1.z.object({
 // earns the explanation that the platform's index-creator form has no name input (the
 // same contract set-column uses for internalType/element); createIndex refuses it.
 // confirm is the write gate: without confirm:true the tool is a pure dry-run that sends
-// nothing and reads nothing. There is deliberately NO updateSetSysId — a database index is
-// physical and is not captured in an update set.
+// nothing and reads nothing. updateSetSysId is optional here because a dry-run needs none;
+// the live path requires it (createIndex refuses without one) because the build job
+// captures the index definition into the user's CURRENT update set.
 exports.createIndexSchema = zod_1.z.object({
     table: zod_1.z.string().min(1),
     columns: zod_1.z.array(zod_1.z.string().min(1)).min(1),
+    updateSetSysId: zod_1.z.string().min(1).optional(),
     unique: zod_1.z.boolean().optional(),
     name: zod_1.z.string().optional(),
     accessMethod: zod_1.z.string().min(1).optional(),

package/dist/table/addIndex.d.ts

@@ -119,7 +119,13 @@ export interface DuplicateScan {
  * `client.table.query` exposes no sysparm_offset.
  */
 export declare function scanForDuplicates(client: ServiceNowClient, table: string, column: string): Promise<DuplicateScan>;
-/** Parse a v_db_index `column_names` cell ("[a]", "[a,b]") into its column list. */
+/**
+ * Parse a v_db_index `column_names` cell into its column list. The live view
+ * separates a composite index's columns with a SEMICOLON — "[a;b;c]" (read live
+ * from tenonworkstudio 2026-10-08: "[sys_created_on;status;version_step;version]").
+ * A comma is tolerated too, so an older fixture or a differently-rendered cell
+ * still parses; a cell that is one bare name ("[a]") is a one-column list.
+ */
 export declare function parseIndexColumns(raw: string): Array<string>;
 /**
  * Does this row's column list match the requested one EXACTLY? Parsed, never

package/dist/table/addIndex.js

@@ -224,7 +224,13 @@ function describeDuplicates(scan) {
         shown.join(", ") +
         (scan.duplicates.length > shown.length ? ", ..." : ""));
 }
-/** Parse a v_db_index `column_names` cell ("[a]", "[a,b]") into its column list. */
+/**
+ * Parse a v_db_index `column_names` cell into its column list. The live view
+ * separates a composite index's columns with a SEMICOLON — "[a;b;c]" (read live
+ * from tenonworkstudio 2026-10-08: "[sys_created_on;status;version_step;version]").
+ * A comma is tolerated too, so an older fixture or a differently-rendered cell
+ * still parses; a cell that is one bare name ("[a]") is a one-column list.
+ */
 function parseIndexColumns(raw) {
     var text = String(raw === undefined || raw === null ? "" : raw).trim();
     if (text.length > 1 &&
@@ -235,7 +241,7 @@ function parseIndexColumns(raw) {
     if (!text)
         return [];
     return text
-        .split(",")
+        .split(/[;,]/)
         .map(function (part) {
         return part.trim();
     })