1 · Prerequisites (Windows)
Do these once per machine before any now-sdk command
node -vnpm -vkeys.ts` for line continue · not \Set-ExecutionPolicy -Scope CurrentUser RemoteSigned# PowerShell — verify toolchain
node -v # expect v20.x
npm -v
where.exe node
where.exe npmDo not install the SDK globally. Pin version per project with package.json. Global now-sdk drifts and breaks CI.
2 · Install SDK (Windows)
Three ways — pick one
2.1 New empty folder
mkdir C:\SNApps\my-sdk-app
cd C:\SNApps\my-sdk-app
npm init -y
npm install -D @servicenow/sdk@4.12.2
npx @servicenow/sdk --version
npx @servicenow/sdk --help2.2 This repository (already installed)
cd C:\SVCProject\HR_Leave_App\servicenow-ai-workspace\hr-leave-sdk
npm ci
npx @servicenow/sdk --version
# binaries: now-sdk · now-sdk-debug · @servicenow/sdk → bin/index.js2.3 Before init — pick a free scope (mandatory)
# After auth exists (§3), query vendor code + scope collision
npx @servicenow/sdk query sys_properties -q "name=glide.appcreator.company.code" -f name,value --auth DEV
npx @servicenow/sdk query sys_scope -q "scope=x_YOURCODE_myapp" -f scope,name --auth DEV
# Scope max 18 chars, pattern (x|sn)_[a-z0-9_]+3 · Authentication cycle
Keychain locally · env vars in CI · never commit passwords
--add <url> | Store credentials for an instance |
--type basic|oauth | Auth type for --add |
--alias NAME | Short name (e.g. DEV) |
--list | Show stored aliases |
--use NAME | Default alias |
--delete NAME | Remove alias |
--print | Emit live token for curl |
--format headers|bearer|env | Print format |
--password-stdin | Pipe password (non-interactive) |
# Basic (PDI lab)
npx @servicenow/sdk auth --add https://devXXXXXX.service-now.com --type basic --alias DEV
# Non-interactive (password from env — do not echo)
$env:SN_PASSWORD | npx @servicenow/sdk auth --add https://devXXXXXX.service-now.com `
--type basic --alias DEV --username admin --password-stdin
# OAuth (interactive / registry client)
npx @servicenow/sdk auth --add https://devXXXXXX.service-now.com --type oauth --alias DEV_OAUTH
npx @servicenow/sdk auth --list
npx @servicenow/sdk auth --use DEV
npx @servicenow/sdk auth --print --format bearer --auth DEV4 · All 12 commands (PowerShell cheat sheet)
Verified against installed CLI 4.12.2 — full flag tables in SDK_CURSOR_FULL_DOCUMENTATION §3
# 1 auth — credentials
npx @servicenow/sdk auth --list
# 2 init / create — scaffold or convert
npx @servicenow/sdk init --appName "HR Leave" --packageName hr-leave-sdk `
--scopeName x_786686_hr_leave --auth DEV
# convert legacy: npx @servicenow/sdk init --from <sys_app_sys_id> --auth DEV
# 3 download — pull metadata for inspection (not Fluent)
npx @servicenow/sdk download .\download-out --auth DEV
# 4 build — compile Fluent → XML (this IS validation)
npx @servicenow/sdk build
npx @servicenow/sdk build --frozenKeys --errorOnConflict # CI gate
# 5 install / deploy — push to instance
npx @servicenow/sdk install --auth DEV
npx @servicenow/sdk install --auth DEV --async false --demoData false
# DESTRUCTIVE: npx @servicenow/sdk install -r --auth DEV
# 6 dependencies — types + app deps
npx @servicenow/sdk dependencies --auth DEV
# 7 transform — instance/XML → Fluent
npx @servicenow/sdk transform --table sys_script,sys_script_include --auth DEV
npx @servicenow/sdk transform --from .\exports\update_set.xml
# 8 clean — wipe dist/
npx @servicenow/sdk clean
# 9 pack — zip artefact
npx @servicenow/sdk pack
# 10 explain — 256 offline topics
npx @servicenow/sdk explain --list flow
npx @servicenow/sdk explain flow-api
npx @servicenow/sdk explain building-ai-agents-guide --format raw | clip
# 11 query — Glide-style from terminal
npx @servicenow/sdk query sys_app -q "scope=x_786686_hr_leave" -f name,scope,version --auth DEV
npx @servicenow/sdk query sn_vul_vulnerable_item -q "state=open" --limit 5 --auth DEV
# 12 cicd — App Repository publish / install / rollback
npx @servicenow/sdk cicd --helpNot commands: validate, upgrade, build --watch, auth --oauth (use --type oauth). See corrections in SDK flag doc §10.
5 · Build → deploy description cycle
The loop you run every day on Windows
git status shows keys.ts dirty after build, that change is part of the commit.cd C:\SVCProject\HR_Leave_App\servicenow-ai-workspace\hr-leave-sdk
# edit Fluent files...
npx @servicenow/sdk build
if ($LASTEXITCODE -ne 0) { throw "build failed" }
npx @servicenow/sdk install --auth DEV --async false
if ($LASTEXITCODE -ne 0) { throw "install failed" }
npx @servicenow/sdk query sys_app -q "scope=x_786686_hr_leave" -f name,version --auth DEV
git add -A
git status
git commit -m "feat: update leave BR order"6 · CI authentication (Windows / GitHub Actions)
No OS keychain in CI — use SN_SDK_* env vars
| Variable | Value |
|---|---|
SN_SDK_NODE_ENV | SN_SDK_CI_INSTALL (required switch) |
SN_SDK_AUTH_TYPE | oauth (preferred) or basic |
SN_SDK_INSTANCE_URL | https://….service-now.com |
SN_SDK_OAUTH_CLIENT_ID / _SECRET | Application Registry (oauth) |
SN_SDK_USER / SN_SDK_USER_PWD | basic only |
# Local simulation of CI mode (PowerShell)
$env:SN_SDK_NODE_ENV = "SN_SDK_CI_INSTALL"
$env:SN_SDK_AUTH_TYPE = "oauth"
$env:SN_SDK_INSTANCE_URL = "https://devXXXXXX.service-now.com"
$env:SN_SDK_OAUTH_CLIENT_ID = "...."
$env:SN_SDK_OAUTH_CLIENT_SECRET = "...."
npx @servicenow/sdk build --frozenKeys
npx @servicenow/sdk install7 · What the SDK CAN and CANNOT do
From Fluent FAQ + WFA + AI guides on SDK 4.12.2
7.1 CAN — first-class Fluent APIs
Application metadata as code: Tables, columns, choices, roles, ACLs, Business Rules, Client Scripts, Script Includes, UI Policies/Actions, Catalog items / Record Producers, Notifications, Properties, Application Menus/Modules, ATF tests, REST Message / Scripted REST (via dedicated APIs or Record()), Workflow Automation Flows (Flow(), triggers, actions, subflows), AI Agents / Agentic Workflows (SDK ≥ 4.4 — explain building-ai-agents-guide).
Lifecycle: init / init --from, transform (pull UI changes into Fluent), build, install/deploy, pack, cicd, query, explain, dependencies, hybrid apps (partial Fluent + XML).
Cross-scope / store apps: Depend on plugins, call typed APIs where published; wrap SecOps tables with your own scoped logic (Script Includes, Flows that use sn_vul_* records).
7.2 CANNOT — do these in the platform UI (or not at all via Fluent)
Design-time UI behaviour: Fluent does not run form UX, UI Policy preview, or Flow Designer’s live data-pill picker. Those stay in Studio / Flow Designer; sync with transform when needed. (SDK FAQ: no parity with dynamic editing surfaces.)
Redefine OOB plugin ownership: You cannot “Fluent-replace” ServiceNow’s Vulnerability Response plugin tables as if they were your scoped app. Do not ship competing dictionary on sn_vul_vulnerable_item from a custom scope expecting to own VR.
Scanner / spoke wizard UIs: Qualys/Tenable connector setup, Credential stores’ secrets UI, IntegrationHub spoke activation clicks — instance configuration, not Fluent source.
Some Process Automation / Playbook features: Public playbooks, certain experience-only activity types, legacy schema playbooks — configure in Workflow Studio; check explain playbook-* topics for current limits.
CLI myths: No validate, no upgrade, no build --watch. Validation = build. Upgrade SDK = change package.json + npm install.
Runtime data: Users, group membership, VI records, attachments, email history do not travel in Fluent install the way metadata does. Seed/migrate separately.
| Artefact | SDK? | Notes |
|---|---|---|
| Custom table in your scope | YES | Table({...}) |
| Business Rule / ACL / Role | YES | Dedicated factories |
| Flow (WFA) | YES | Flow() / wfa APIs · or UI + transform |
| AI Agent | YES | SDK 4.4+ · AiAgent APIs |
| Any table via Record() | PARTIAL | Metadata records without dedicated API |
| OOB VR dictionary ownership | NO | Use plugin; automate around it |
| Portal widget Angular UX polish | LIMITED | Often Studio / portal tools |
| UI Builder experience pixels | LIMITED | Prefer UI Builder; transform carefully |
| Live SMTP / scanner credentials | NO | Credential aliases on instance |
8 · VR / VRO module — description cycle + SDK role
Vulnerability Response (also called VR / VRO in ops slang) inside SecOps
8.1 Lifecycle (description cycle)
Scanner (Qualys/Tenable/…) → Import Set / Integration → sn_vul_vulnerability (CVE master) → sn_vul_vulnerable_item (CI × CVE) → assignment rules → owner → Change / task → rescan → closed.
8.2 Related objects (tables & friends)
| Object | Table / path | Purpose | Direct URL |
|---|---|---|---|
| Vulnerability | sn_vul_vulnerability | CVE / advisory master | list |
| Vulnerable Item (VI) | sn_vul_vulnerable_item | Asset × vuln instance | list |
| Third-party entry | sn_vul_third_party_entry | Scanner native ID map | list |
| Software | sn_vul_software | Affected packages | list |
| Solution | sn_vul_solution | Remediation guidance | list |
| Assignment rule | sn_vul_assignment_rule | Auto-route VIs | list |
| Remediation task | task / change links | Work to fix | changes |
| CI | cmdb_ci | Asset linkage | CI |
| SIR | sn_si_incident | Security incident (related SecOps) | SIR |
| TI Indicator | sn_ti_indicator | Threat intel | TI |
| Flows | sys_hub_flow | Auto-assign / notify / create change | Flow Designer |
| CTD tests | sn_vul_ctd_test | Config compliance | CTD |
8.3 What SDK should do for VR/VRO
DO with SDK: Custom scoped app that orchestrates VR — Script Includes that query VIs, Flows that trigger on VI state change, notifications, integration Scripted REST into your app, ATF tests for your automation, AI agents that read VI summaries under invoking-user ACLs.
DON'T with SDK: Attempt to recreate the whole VR product in Fluent; overwrite OOB business rules on sn_vul_* without a clear upgrade plan; store scanner passwords in Fluent source.
// Example direction: Flow in Fluent OR Flow Designer that watches VIs
// Prefer UI Flow Designer for first VR automation, then:
// npx @servicenow/sdk transform --table sys_hub_flow --auth DEV
// Full practical lab:
// PRACTICAL_SECOPS_VRO_FROM_SCRATCH.html
// PRACTICAL_FLOW_DESIGNER_FROM_SCRATCH.htmlSecOps + VRO lab
Full practical cycle
Open →Flow Designer lab
Build remediation flows
Open →AI practical
Agents on SecOps/HR data
Open →SDK flag bible
Every flag · keys.ts · CI
Open →SecOps deep module
CIS labs · architecture
Open →9 · Lab checklist — prove the SDK cycle
Stop when every box is true on Windows
node -v≥ 20.18npx @servicenow/sdk --versionprints 4.12.xauth --listshows DEVbuildexit 0install --auth DEVexit 0query sys_appreturns your scope- You can state three CAN and three CANNOT from §7 without looking
- You can draw the VR cycle Scanner→VI→Close from §8
Authoritative command flags: SDK_CURSOR_FULL_DOCUMENTATION.html. This page is the Windows + lifecycle + can/cannot + VR companion.