Stable Build v0.4.0

v0.4.0] - Upgrade @sericenow/sdk to v4.8.0 #25 plus clean ups

Brings the Fluent MCP server in lockstep with ServiceNow SDK 4.8.0 (new Fluent APIs, a new CLI tool, and cross-cutting type enhancements), plus a maintenance pass that removed dead code and added fail-fast startup validation.

Added

6 new metadata types (enum 58 → 64), each with spec + instruct + snippet(s):

• playbook — PlaybookDefinition (sys_pd_process_definition, from @servicenow/sdk/automation): guided, record-driven processes with lanes, activities, triggers, and inputs/outputs.
• rest-message — RestMessage (sys_rest_message): outbound HTTP integrations with shared auth/headers and callable functions.
• alias / alias-template — Alias (sys_alias) and AliasTemplate (sys_alias_templates): Connection & Credential aliases and reusable setup templates.
• retry-policy — RetryPolicy (sys_retry_policy): transient-failure handling (fixed-interval / exponential-backoff / Retry-After).
• data-lookup — DataLookup (dl_definition): auto-copy field values from a matcher table onto a source record.
• New MCP tool query_fluent_records — wraps now-sdk query for read-only Table REST queries, returning a JSON envelope. Supports fields, limit, offset, displayValue, view, queryCategory, noCount, queryNoDomain, excludeReferenceLink, timeout, and auth. Brings the tool count to 11.
• Now.del() declarative deletion documented in the coding_in_fluent prompt, alongside the new $meta.installMethod, $override, ACL field, and now-sdk query capabilities.

Changed

• ACL spec: field now typed as keyof FullSchema<T> | SystemColumns | '*'; added $meta.installMethod.
• UserPreference spec: added $override and $meta.installMethod.
• Table spec: noted that accessibleFrom now defaults to 'public'.
• Fixed the ai-agent-workflow snippet for 4.8.0's stricter dataAccess validation (role-name roleMap).
• Documentation refreshed (README, CLAUDE.md, AGENTS.md): SDK 4.8.0, 64 types, 11 tools, new Integration & Connections category.
• Dependencies: @servicenow/sdk 4.7.1 → 4.8.0 (pinned); devDeps bumped within-major (@types/node 25.9.4, @typescript-eslint/* 8.61.1, eslint 10.5.0, rollup 4.62.2). TypeScript held at ~5.9.3 and @types/node at 25.x (major bumps are not drop-in).

Fixed

• query_fluent_records now requires instance authentication — resolves the auth alias (explicit arg → session) before execution and fails fast with an actionable message instead of letting the SDK CLI error opaquely.
• Cross-platform encoded-query quoting — the encoded query is single-quoted on POSIX shells and double-quoted on Windows cmd.exe (where <, >, |, &, ^ are suppressed inside double quotes). The unsafe-character guard now rejects single quotes, double quotes, backticks, backslashes, and control characters so the value cannot break out of either quote style.
• query_fluent_records rejects empty/whitespace-only queries, matching the documented non-empty\ contract.

Maintenance

• Removed verified dead code across mcpErrors.ts, config.ts, init/types.ts, rootContext.ts, fluentMCPServer.ts, and toolsManager.ts (no behavior change).
• Deduplicated the auto-auth trigger into a single triggerAutoAuthOnce() source of truth for this security-relevant action.
• Added fail-fast startup validation: FluentMcpServer.start() now throws (before connecting the transport) with an actionable message if a configured resource directory is missing.

Release-note corrections (installed package = source of truth)

• $override is a generic escape-hatch, not "merge-mode" control.
• ScheduledScript has no $meta — its spec was intentionally left unchanged.
• ACL field is typed field-names + '*', not an open string.

Verification

• 333 tests / 32 suites green; lint and build clean.
• 64/64 specs type-check, 65/65 instructs clean, 0 unexpected snippet failures.