HR Leave · SDK Windows Full Cycle

ServiceNow SDK on Windows — Full Cycle

Prerequisites · install · authentication · all 12 commands (PowerShell) · build/deploy · what Fluent can and cannot do · Vulnerability Response (VR / VRO) object cycle

OSWindows 10/11 · PowerShell 5+
Node20.18+ (verified 20.20.2)
Package@servicenow/sdk@4.12.2
CompanionEvery flag
Open while you work Studio Applications Flow Designer Vulnerable Items Update Sets

Read this board first

Install → Auth → Init → Dependencies → Edit Fluent → Build → Install (deploy) → Query proof. Everything else is detail.

0Node 20+
→
1npm i SDK
→
2auth --add
→
3init
→
4deps
→
5*.now.ts
→
6build
→
7install
→
8query

1 · Prerequisites (Windows)

Do these once per machine before any now-sdk command

Node.jsLTS 20.18+ from nodejs.org · verify node -v
npmBundled · verify npm -v
GitOptional but required for teams · commit keys.ts
InstancePDI or sub-prod URL · admin or app creator
PowerShellUse ` for line continue · not \
ExecutionIf scripts blocked: Set-ExecutionPolicy -Scope CurrentUser RemoteSigned
# PowerShell — verify toolchain
node -v          # expect v20.x
npm -v
where.exe node
where.exe npm

Do not install the SDK globally. Pin version per project with package.json. Global now-sdk drifts and breaks CI.

2 · Install SDK (Windows)

Three ways — pick one

2.1 New empty folder

mkdir C:\SNApps\my-sdk-app
cd C:\SNApps\my-sdk-app
npm init -y
npm install -D @servicenow/sdk@4.12.2
npx @servicenow/sdk --version
npx @servicenow/sdk --help

2.2 This repository (already installed)

cd C:\SVCProject\HR_Leave_App\servicenow-ai-workspace\hr-leave-sdk
npm ci
npx @servicenow/sdk --version
# binaries: now-sdk · now-sdk-debug · @servicenow/sdk  →  bin/index.js

2.3 Before init — pick a free scope (mandatory)

# After auth exists (§3), query vendor code + scope collision
npx @servicenow/sdk query sys_properties -q "name=glide.appcreator.company.code" -f name,value --auth DEV
npx @servicenow/sdk query sys_scope -q "scope=x_YOURCODE_myapp" -f scope,name --auth DEV
# Scope max 18 chars, pattern (x|sn)_[a-z0-9_]+

3 · Authentication cycle

Keychain locally · env vars in CI · never commit passwords

LOCALauth --add
→
LISTauth --list
→
USEauth --use
→
CMD--auth DEV
→
CISN_SDK_*
now-sdk auth
--add <url>Store credentials for an instance
--type basic|oauthAuth type for --add
--alias NAMEShort name (e.g. DEV)
--listShow stored aliases
--use NAMEDefault alias
--delete NAMERemove alias
--printEmit live token for curl
--format headers|bearer|envPrint format
--password-stdinPipe password (non-interactive)
# Basic (PDI lab)
npx @servicenow/sdk auth --add https://devXXXXXX.service-now.com --type basic --alias DEV

# Non-interactive (password from env — do not echo)
$env:SN_PASSWORD | npx @servicenow/sdk auth --add https://devXXXXXX.service-now.com `
  --type basic --alias DEV --username admin --password-stdin

# OAuth (interactive / registry client)
npx @servicenow/sdk auth --add https://devXXXXXX.service-now.com --type oauth --alias DEV_OAUTH

npx @servicenow/sdk auth --list
npx @servicenow/sdk auth --use DEV
npx @servicenow/sdk auth --print --format bearer --auth DEV
✓ Prefer alias + --auth DEV on every command ✓ OAuth for CI ✗ --oauth --client-id (flags do not exist) ✗ Commit .env with passwords

4 · All 12 commands (PowerShell cheat sheet)

Verified against installed CLI 4.12.2 — full flag tables in SDK_CURSOR_FULL_DOCUMENTATION §3

# 1 auth     — credentials
npx @servicenow/sdk auth --list

# 2 init / create — scaffold or convert
npx @servicenow/sdk init --appName "HR Leave" --packageName hr-leave-sdk `
  --scopeName x_786686_hr_leave --auth DEV
# convert legacy:  npx @servicenow/sdk init --from <sys_app_sys_id> --auth DEV

# 3 download — pull metadata for inspection (not Fluent)
npx @servicenow/sdk download .\download-out --auth DEV

# 4 build — compile Fluent → XML (this IS validation)
npx @servicenow/sdk build
npx @servicenow/sdk build --frozenKeys --errorOnConflict   # CI gate

# 5 install / deploy — push to instance
npx @servicenow/sdk install --auth DEV
npx @servicenow/sdk install --auth DEV --async false --demoData false
# DESTRUCTIVE:  npx @servicenow/sdk install -r --auth DEV

# 6 dependencies — types + app deps
npx @servicenow/sdk dependencies --auth DEV

# 7 transform — instance/XML → Fluent
npx @servicenow/sdk transform --table sys_script,sys_script_include --auth DEV
npx @servicenow/sdk transform --from .\exports\update_set.xml

# 8 clean — wipe dist/
npx @servicenow/sdk clean

# 9 pack — zip artefact
npx @servicenow/sdk pack

# 10 explain — 256 offline topics
npx @servicenow/sdk explain --list flow
npx @servicenow/sdk explain flow-api
npx @servicenow/sdk explain building-ai-agents-guide --format raw | clip

# 11 query — Glide-style from terminal
npx @servicenow/sdk query sys_app -q "scope=x_786686_hr_leave" -f name,scope,version --auth DEV
npx @servicenow/sdk query sn_vul_vulnerable_item -q "state=open" --limit 5 --auth DEV

# 12 cicd — App Repository publish / install / rollback
npx @servicenow/sdk cicd --help

Not commands: validate, upgrade, build --watch, auth --oauth (use --type oauth). See corrections in SDK flag doc §10.

5 · Build → deploy description cycle

The loop you run every day on Windows

PowerShell · hr-leave-sdkdaily loop
1 Edit
2 Build
3 Install
4 Query
5 Commit
Editsrc\fluent\*.now.ts
Buildnpx @servicenow/sdk build → dist\ + keys.ts
Installnpx @servicenow/sdk install --auth DEV
Proofquery sys_script / your tables
Gitadd keys.ts if changed · commit
Screen — daily cycle. If git status shows keys.ts dirty after build, that change is part of the commit.
cd C:\SVCProject\HR_Leave_App\servicenow-ai-workspace\hr-leave-sdk

# edit Fluent files...
npx @servicenow/sdk build
if ($LASTEXITCODE -ne 0) { throw "build failed" }

npx @servicenow/sdk install --auth DEV --async false
if ($LASTEXITCODE -ne 0) { throw "install failed" }

npx @servicenow/sdk query sys_app -q "scope=x_786686_hr_leave" -f name,version --auth DEV

git add -A
git status
git commit -m "feat: update leave BR order"

6 · CI authentication (Windows / GitHub Actions)

No OS keychain in CI — use SN_SDK_* env vars

VariableValue
SN_SDK_NODE_ENVSN_SDK_CI_INSTALL (required switch)
SN_SDK_AUTH_TYPEoauth (preferred) or basic
SN_SDK_INSTANCE_URLhttps://….service-now.com
SN_SDK_OAUTH_CLIENT_ID / _SECRETApplication Registry (oauth)
SN_SDK_USER / SN_SDK_USER_PWDbasic only
# Local simulation of CI mode (PowerShell)
$env:SN_SDK_NODE_ENV = "SN_SDK_CI_INSTALL"
$env:SN_SDK_AUTH_TYPE = "oauth"
$env:SN_SDK_INSTANCE_URL = "https://devXXXXXX.service-now.com"
$env:SN_SDK_OAUTH_CLIENT_ID = "...."
$env:SN_SDK_OAUTH_CLIENT_SECRET = "...."
npx @servicenow/sdk build --frozenKeys
npx @servicenow/sdk install
✓ Instance property glide.oauth.inbound.client.credential.grant_type.enabled = true ✓ OAuth service user Identity Type = Human + admin ✗ auth --add inside GitHub Actions

7 · What the SDK CAN and CANNOT do

From Fluent FAQ + WFA + AI guides on SDK 4.12.2

7.1 CAN — first-class Fluent APIs

Application metadata as code: Tables, columns, choices, roles, ACLs, Business Rules, Client Scripts, Script Includes, UI Policies/Actions, Catalog items / Record Producers, Notifications, Properties, Application Menus/Modules, ATF tests, REST Message / Scripted REST (via dedicated APIs or Record()), Workflow Automation Flows (Flow(), triggers, actions, subflows), AI Agents / Agentic Workflows (SDK ≥ 4.4 — explain building-ai-agents-guide).

Lifecycle: init / init --from, transform (pull UI changes into Fluent), build, install/deploy, pack, cicd, query, explain, dependencies, hybrid apps (partial Fluent + XML).

Cross-scope / store apps: Depend on plugins, call typed APIs where published; wrap SecOps tables with your own scoped logic (Script Includes, Flows that use sn_vul_* records).

7.2 CANNOT — do these in the platform UI (or not at all via Fluent)

Design-time UI behaviour: Fluent does not run form UX, UI Policy preview, or Flow Designer’s live data-pill picker. Those stay in Studio / Flow Designer; sync with transform when needed. (SDK FAQ: no parity with dynamic editing surfaces.)

Redefine OOB plugin ownership: You cannot “Fluent-replace” ServiceNow’s Vulnerability Response plugin tables as if they were your scoped app. Do not ship competing dictionary on sn_vul_vulnerable_item from a custom scope expecting to own VR.

Scanner / spoke wizard UIs: Qualys/Tenable connector setup, Credential stores’ secrets UI, IntegrationHub spoke activation clicks — instance configuration, not Fluent source.

Some Process Automation / Playbook features: Public playbooks, certain experience-only activity types, legacy schema playbooks — configure in Workflow Studio; check explain playbook-* topics for current limits.

CLI myths: No validate, no upgrade, no build --watch. Validation = build. Upgrade SDK = change package.json + npm install.

Runtime data: Users, group membership, VI records, attachments, email history do not travel in Fluent install the way metadata does. Seed/migrate separately.

ArtefactSDK?Notes
Custom table in your scopeYESTable({...})
Business Rule / ACL / RoleYESDedicated factories
Flow (WFA)YESFlow() / wfa APIs · or UI + transform
AI AgentYESSDK 4.4+ · AiAgent APIs
Any table via Record()PARTIALMetadata records without dedicated API
OOB VR dictionary ownershipNOUse plugin; automate around it
Portal widget Angular UX polishLIMITEDOften Studio / portal tools
UI Builder experience pixelsLIMITEDPrefer UI Builder; transform carefully
Live SMTP / scanner credentialsNOCredential aliases on instance

8 · VR / VRO module — description cycle + SDK role

Vulnerability Response (also called VR / VRO in ops slang) inside SecOps

8.1 Lifecycle (description cycle)

1Scanner
→
2Import
→
3CVE master
→
4VI
→
5Assign
→
6Remediate
→
7Verify
→
8Close

Scanner (Qualys/Tenable/…) → Import Set / Integration → sn_vul_vulnerability (CVE master) → sn_vul_vulnerable_item (CI × CVE) → assignment rules → owner → Change / task → rescan → closed.

8.2 Related objects (tables & friends)

ObjectTable / pathPurposeDirect URL
Vulnerabilitysn_vul_vulnerabilityCVE / advisory masterlist
Vulnerable Item (VI)sn_vul_vulnerable_itemAsset × vuln instancelist
Third-party entrysn_vul_third_party_entryScanner native ID maplist
Softwaresn_vul_softwareAffected packageslist
Solutionsn_vul_solutionRemediation guidancelist
Assignment rulesn_vul_assignment_ruleAuto-route VIslist
Remediation tasktask / change linksWork to fixchanges
CIcmdb_ciAsset linkageCI
SIRsn_si_incidentSecurity incident (related SecOps)SIR
TI Indicatorsn_ti_indicatorThreat intelTI
Flowssys_hub_flowAuto-assign / notify / create changeFlow Designer
CTD testssn_vul_ctd_testConfig complianceCTD

8.3 What SDK should do for VR/VRO

DO with SDK: Custom scoped app that orchestrates VR — Script Includes that query VIs, Flows that trigger on VI state change, notifications, integration Scripted REST into your app, ATF tests for your automation, AI agents that read VI summaries under invoking-user ACLs.

DON'T with SDK: Attempt to recreate the whole VR product in Fluent; overwrite OOB business rules on sn_vul_* without a clear upgrade plan; store scanner passwords in Fluent source.

// Example direction: Flow in Fluent OR Flow Designer that watches VIs
// Prefer UI Flow Designer for first VR automation, then:
//   npx @servicenow/sdk transform --table sys_hub_flow --auth DEV
// Full practical lab:
//   PRACTICAL_SECOPS_VRO_FROM_SCRATCH.html
//   PRACTICAL_FLOW_DESIGNER_FROM_SCRATCH.html

9 · Lab checklist — prove the SDK cycle

Stop when every box is true on Windows

  1. node -v ≥ 20.18
  2. npx @servicenow/sdk --version prints 4.12.x
  3. auth --list shows DEV
  4. build exit 0
  5. install --auth DEV exit 0
  6. query sys_app returns your scope
  7. You can state three CAN and three CANNOT from §7 without looking
  8. You can draw the VR cycle Scanner→VI→Close from §8

Authoritative command flags: SDK_CURSOR_FULL_DOCUMENTATION.html. This page is the Windows + lifecycle + can/cannot + VR companion.