@jacebenson/jsn 4.3.12 → 4.3.13-dev.101.1

package/src/cli.js

@@ -1,3 +1,4 @@
+import { visibleCommandRegistry } from './command-audience.js';
 // Root CLI using the local yargs-compatible adapter
 
 import yargs, { hideBin } from './cli-adapter.js';
@@ -7,17 +8,19 @@ import fs from 'node:fs';
 import { loadConfig, globalConfigDir } from './config.js';
 import { App } from './app.js';
 import { resolveSession, applySession } from './session.js';
-import { renderHelp } from './help.js';
+import { renderHelp, renderTips } from './help.js';
 import { isMutationCommand, refreshMutationCommands } from './mutations.js';
 import { skippedUpdatesCmd } from './commands/skipped-updates.js';
-import { noInstanceCommands, dailyCheckSkipCommands, contextHeaderSkipCommands } from './capabilities.js';
+import { isLocalPreview, noInstanceCommands, dailyCheckSkipCommands, contextHeaderSkipCommands } from './capabilities.js';
 import { guardExit, exitWithError, AppError, CodeUsage } from './errors.js';
 import { formatCommandList } from './helpers.js';
 
 // Command modules
+import { discoverCmd } from './commands/discover.js';
 import { setupCmd } from './commands/setup.js';
 import { authCmd } from './commands/auth.js';
 import { recordsCmd } from './commands/records.js';
+import { attachmentsCmd } from './commands/attachments.js';
 import { cmdbCmd } from './commands/cmdb.js';
 import { snippetsCmd } from './commands/snippets.js';
 import { catalogCmd } from './commands/catalog.js';
@@ -36,7 +39,7 @@ import { platformCmd } from './commands/platform.js';
 import { codesearchCmd } from './commands/codesearch.js';
 import { versionCmd } from './commands/version.js';
 import { skillCmd, checkSkill } from './commands/skill.js';
-import { getVersion, checkLatest } from './commands/version.js';
+import { getVersion, checkLatest, getReleaseChannel, getInstallCommand } from './commands/version.js';
 import { docsCmd } from './commands/docs/docs.js';
 
 // Table and platform commands registered at root level for progressive disclosure
@@ -69,7 +72,9 @@ import { logsCmd } from './commands/logs.js';
 import { scrapiCmd } from './commands/scrapi.js';
 import { b4rulesCmd } from './commands/b4rules.js';
 import { atfCmd } from './commands/atf.js';
+import { scanCmd } from './commands/scan.js';
 import { approvalsCmd } from './commands/approvals.js';
+import { historyCmd } from './commands/history.js';
 import { perfCmd } from './commands/perf.js';
 import { customizationsCmd } from './commands/customizations.js';
 import { midserversCmd } from './commands/midservers.js';
@@ -116,6 +121,7 @@ function wrap(handler) {
         process.stderr.write('Error: App context not initialized.\n');
         process.exit(1);
       }
+      await app.guardMutationContext(argv);
       await handler(argv, app);
     } catch (err) {
       // All error rendering goes through the unified renderer in
@@ -144,6 +150,13 @@ export function buildCLI() {
       },
     ])
     .options({
+      'all-commands': { type: 'boolean', describe: 'Show the full command list, including admin and developer tools' },
+      reason: { type: 'string', describe: 'Optional non-sensitive reason saved in local mutation history' },
+
+      force: {
+        type: 'boolean',
+        description: 'Approve Global + Default mutation context only after user approval; delete commands also use this for their separate confirmation',
+      },
       instance: {
         type: 'string',
         description: 'ServiceNow instance URL',
@@ -213,6 +226,7 @@ export function buildCLI() {
               hint: 'Run "jsn auth status" to list profiles.',
             });
           }
+          app._authArgv = argv;
           applySession(app, session);
         } catch (err) {
           guardExit(argv, { code: err.code || 'usage', message: err.message, hint: err.hint });
@@ -248,6 +262,7 @@ export function buildCLI() {
     .middleware(async (argv) => {
       // Session (incl. --instance/--profile overrides) was already applied
       // by the middleware above — nothing to re-apply here.
+      if (isLocalPreview(argv)) return;
       const cmd = (argv._[0] || '').toString();
       // Daily-check + context-header skip-list is derived from command
       // capability declarations (skipDailyChecks: true).
@@ -290,7 +305,7 @@ export function buildCLI() {
         }
       }
       if (!skipNpmCheck) {
-        const cacheFile = path.join(globalConfigDir(), '.last-npm-check');
+        const cacheFile = path.join(globalConfigDir(), `.last-npm-check-${getReleaseChannel()}`);
         let shouldCheck = true;
         try {
           const mtime = fs.statSync(cacheFile).mtimeMs;
@@ -303,9 +318,9 @@ export function buildCLI() {
 
         if (shouldCheck) {
           const version = getVersion();
-          checkLatest({ background: true }).then(latest => {
+          checkLatest({ background: true, version }).then(latest => {
             if (latest && version !== latest) {
-              process.stderr.write(`\n⚠ jsn ${latest} available (you have ${version}) — run "npm install -g @jacebenson/jsn" to update\n\n`);
+              process.stderr.write(`\n⚠ jsn ${latest} available (you have ${version}) — run "${getInstallCommand(version)}" to update\n\n`);
             }
           }).catch(() => {});
 
@@ -398,6 +413,7 @@ export function buildCLI() {
     // DATA
     .command(cmdbCmd(wrap))
     .command(recordsCmd(wrap))
+    .command(attachmentsCmd(wrap))
     .command(transactionsCmd(wrap))
 
     .command(platformCmd(wrap))
@@ -406,9 +422,11 @@ export function buildCLI() {
     .command(codesearchCmd(wrap))
     // DEVELOPER
     .command(atfCmd(wrap))
+    .command(scanCmd(wrap))
     .command(approvalsCmd(wrap))
     .command(skippedUpdatesCmd(wrap))
     .command(perfCmd(wrap))
+    .command(historyCmd(wrap))
     .command(customizationsCmd(wrap))
     .command(midserversCmd(wrap))
     .command(diffCmd(wrap))
@@ -418,6 +436,7 @@ export function buildCLI() {
     .command(skillCmd(wrap))
     .command(docsCmd(wrap))
     .command(versionCmd(wrap))
+    .command(discoverCmd(wrap, (argv) => visibleCommandRegistry(cliInstance.commandRegistry(), app.config, argv)))
     .demandCommand(1, 'You must specify a command')
     // Completion plumbing under a hidden command name, so the explicit
     // 'completion' command below owns the UX. (#176)
@@ -437,6 +456,12 @@ export function buildCLI() {
         if (current && !current.startsWith('-') && depth === 0) {
           out = [...new Set([...out, ...rootCommands])];
         }
+        const options = cliInstance.parseGlobalOptions(process.argv.slice(2));
+        const visible = visibleCommandRegistry(cliInstance.commandRegistry(), loadConfig(options), options);
+        if (!depth) {
+          const names = new Set(visible.commands.flatMap(command => [command.name, ...command.aliases]));
+          out = out.filter(value => value.startsWith('-') || names.has(value));
+        }
         done([...new Set(out)]);
       });
     })
@@ -473,7 +498,7 @@ export function buildCLI() {
     })
     .onParentDiscovery((argv, { path, subcommands }) => {
       // Reached only for a parent command that declares no default handler of
-      // its own (records attachments, docs community, and any future parent) —
+      // its own (attachments, docs community, and any future parent) —
       // the adapter used to fall through and exit 0 having printed nothing.
       // Children come from the registry, description included, so this list
       // cannot drift from the registrations the way a hand-written one did.
@@ -498,6 +523,7 @@ export function buildCLI() {
         }, { summary });
       })(argv);
     })
+    .epilogue(renderTips())
     .help('help', 'Show help')
     .version(false)
     .strictCommands()
@@ -541,7 +567,7 @@ export function buildCLI() {
           if (typeof formatArgv?.get === 'string' && formatArgv.get) {
             app.output.setJqFilter(formatArgv.get);
           }
-          const { commands } = cliInstance.commandRegistry();
+          const { commands } = visibleCommandRegistry(cliInstance.commandRegistry(), loadConfig(formatArgv), formatArgv);
           try {
             app.ok({ commands }, {
               summary: `${commands.length} registered commands — run "jsn <command> --json" for a command's subcommands.`,
@@ -551,7 +577,7 @@ export function buildCLI() {
           }
           process.exit(0);
         }
-        process.stdout.write(renderHelp(loadConfig(), cliInstance.commandRegistry()) + '\n');
+        process.stdout.write(renderHelp(loadConfig(formatArgv), visibleCommandRegistry(cliInstance.commandRegistry(), loadConfig(formatArgv), formatArgv)) + '\n');
         process.exit(0);
       }
       // Every other failure here (unknown command, missing required argument,
@@ -571,6 +597,12 @@ export function buildCLI() {
       exitWithError(new AppError(CodeUsage, msg, hint), { app });
     });
 
+  cliInstance.rootHelpRenderer = () => {
+    const options = cliInstance.parseGlobalOptions(process.argv.slice(2));
+    const config = loadConfig(options);
+    return renderHelp(config, visibleCommandRegistry(cliInstance.commandRegistry(), config, options));
+  };
+
   // Snapshot the root command names (plus aliases) for the completion
   // filter. Done before any parse — command builders mutate the registry.
   rootCommands = cliInstance.getInternalMethods().getCommandInstance().getCommands();

package/src/command-audience.js

@@ -0,0 +1,35 @@
+// Presentation policy only. ServiceNow ACLs still authorize every request.
+// Explicit command paths and --all-commands remain available to every account.
+const BASIC_COMMANDS = new Set([
+  'incidents', 'changes', 'requests', 'tasks', 'tickets', 'approvals', 'records',
+  'groups', 'groupmembers', 'grouproles', 'users', 'setup', 'auth', 'skill',
+  'version', 'docs', 'history', 'discover', 'completion',
+]);
+
+export async function detectCommandAudience(sdk, username, instanceURL = sdk?.baseURL) {
+  if (!username || typeof sdk?.listStrict !== 'function') return undefined;
+  try {
+    const roles = await sdk.listStrict('sys_user_has_role', {
+      sysparm_query: 'user=javascript:gs.getUserID()^role.name=admin',
+      sysparm_fields: 'sys_id', sysparm_limit: '1',
+    }, { touchLastSeen: false });
+    return { username, instance_url: instanceURL, mode: roles.length ? 'admin' : 'basic', role_check: 'verified' };
+  } catch {
+    // Missing role access must not expand help. This is a presentation fallback,
+    // not a claim that the role query succeeded or an authorization boundary.
+    return { username, instance_url: instanceURL, mode: 'basic', role_check: 'unavailable' };
+  }
+}
+
+export function commandAudience(config, { instance, allCommands = false } = {}) {
+  if (allCommands || instance) return 'all';
+  const name = config?.activeProfile || config?.defaultProfile;
+  const profile = config?.profiles?.[name];
+  const cached = profile?.command_audience;
+  return cached?.username === profile?.username && cached?.instance_url === profile?.instance_url && cached?.mode === 'basic' ? 'basic' : 'all';
+}
+
+export function visibleCommandRegistry(registry, config, options = {}) {
+  if (commandAudience(config, options) !== 'basic') return registry;
+  return { ...registry, commands: registry.commands.filter(command => BASIC_COMMANDS.has(command.name)) };
+}

package/src/commands/_generic.js

@@ -1,7 +1,10 @@
+import { constrainQuery, constrainedQueryHelp } from '../constrained-query.js';
+import { enrichRelatedLists, relatedListOptions } from '../related-lists.js';
 // Generic table-based CRUD command builder
 
-import { formatRecordForDisplay, getStringField, parseDataArg, confirmDelete, interactiveList, canPrompt } from '../helpers.js';
-import { resolveRecord, unwrapSysId } from '../resolve-record.js';
+import { formatRecordForDisplay, getStringField, buildRecordPayload, confirmDelete, interactiveList, canPrompt } from '../helpers.js';
+import { getRecord, listRecords, recordListParams, createRecord, updateRecord, deleteRecord, recordOptions } from '../records-engine.js';
+import { unwrapSysId } from '../resolve-record.js';
 import { getCurrentUser, getCurrentApplication } from '../context.js';
 import { FormatAuto } from '../output.js';
 import { declareCapabilities } from '../capabilities.js';
@@ -108,7 +111,7 @@ export function buildDevCmd(name, table, aliases, defaultColumns, wrap, opts = {
     if (!readOnly) {
       crumbs.unshift(
         { action: 'delete', cmd: `jsn ${name} delete ${id}`, description: `Delete this ${singular}` },
-        { action: 'update', cmd: `jsn ${name} update ${id} --data '{...}'`, description: `Update this ${singular}` }
+        { action: 'update', cmd: `jsn ${name} update ${id} -f name=value`, description: `Update this ${singular}` }
       );
     }
     return crumbs;
@@ -120,19 +123,24 @@ export function buildDevCmd(name, table, aliases, defaultColumns, wrap, opts = {
         command: 'list',
         aliases: ['ls'],
         describe: `List ${name}`,
-        builder: (y) => y
-          .option('query', { type: 'string', describe: 'Encoded query (e.g. "nameLIKEincident" or "active=true^priority=1")' })
-          .option('columns', { alias: ['c', 'fields'], type: 'string', describe: 'Comma-separated columns (e.g. "name,label,super_class")' })
-          .option('limit', { alias: 'l', type: 'number', default: 50, describe: 'Max records' }),
+        builder: (y) => {
+          const command = recordOptions(y)
+            .option('query', { type: 'string', describe: 'Encoded query (e.g. "nameLIKEincident" or "active=true^priority=1")' })
+            .option('columns', { alias: ['c', 'fields'], type: 'string', describe: 'Comma-separated columns (e.g. "name,label,super_class")' })
+            .option('limit', { alias: 'l', type: 'number', default: 50, describe: 'Max records' });
+          const help = [opts.help, extraQuery ? constrainedQueryHelp(extraQuery) : ''].filter(Boolean).join('\n');
+          return help ? command.epilogue(help) : command;
+        },
         handler: wrap(async (argv, app) => {
           const query = argv.query || '';
+          const constrainedQuery = constrainQuery(query, extraQuery);
           const columns = argv.columns ? argv.columns.split(',') : defaultColumns;
           const limit = argv.limit;
 
           // Interactive picker with pagination
           if (canPrompt() && app.output.getFormat() === FormatAuto && !query) {
             const picked = await interactiveList({
-              app, table, singular, columns: ['name', 'sys_scope'], limit, query: extraQuery,
+              app, table, singular, columns: ['name', 'sys_scope'], limit, query: constrainedQuery,
               labelField: 'name',
               message: `Select ${vowelArticle(singular)} ${singular}`,
               formatLabel: (r) => {
@@ -147,12 +155,12 @@ export function buildDevCmd(name, table, aliases, defaultColumns, wrap, opts = {
             const recordName = getStringField(record, 'name') || getStringField(record, 'sys_id');
             record._context = { instance_url: app.getEffectiveInstance(), table };
             if (opts.onShow) {
-              await opts.onShow(record, app);
+              await opts.onShow(record, app, argv);
             }
             app.ok(record, {
               summary: `${singular.charAt(0).toUpperCase() + singular.slice(1)}: ${recordName}`,
               breadcrumbs: [
-                ...(readOnly ? [] : [{ action: 'update', cmd: `jsn ${name} update ${recordName} --data '{...}'`, description: `Update this ${singular}` }]),
+                ...(readOnly ? [] : [{ action: 'update', cmd: `jsn ${name} update ${recordName} -f name=value`, description: `Update this ${singular}` }]),
                 { action: 'list', cmd: `jsn ${name} list`, description: `Back to all ${name}` },
               ],
             });
@@ -160,19 +168,14 @@ export function buildDevCmd(name, table, aliases, defaultColumns, wrap, opts = {
           }
 
           // Non-interactive: text/table output
-          const params = new URLSearchParams();
-          params.set('sysparm_limit', String(limit));
-          params.set('sysparm_display_value', 'all');
-          params.set('sysparm_fields', ['sys_id', ...columns].join(','));
-          const baseQ = extraQuery ? extraQuery + '^' : '';
-          const q = query ? query + '^ORDERBYDESCsys_updated_on' : (baseQ + 'ORDERBYDESCsys_updated_on');
-          params.set('sysparm_query', q);
-          const records = await app.sdk.list(table, params);
+          const q = `${constrainedQuery}${constrainedQuery ? '^' : ''}ORDERBYDESCsys_updated_on`;
+          const params = recordListParams({ limit, fields: ['sys_id', ...columns], query: q });
+          const records = await listRecords(app.sdk, { table, params, displayValues: argv.displayValues ?? opts.referenceMode });
           app.ok({
             table,
             count: records.length,
             columns,
-            records: records.map(r => formatRecordForDisplay(r, columns)),
+            records: argv.displayValues || opts.listProjection === 'full' ? records : records.map(r => formatRecordForDisplay(r, columns)),
             context: { instance_url: app.getEffectiveInstance() },
           }, {
             summary: `${records.length} ${name}(s)`,
@@ -184,6 +187,11 @@ export function buildDevCmd(name, table, aliases, defaultColumns, wrap, opts = {
         command: opts.resolveIdentifier ? 'show [identifier]' : 'show <identifier>',
         aliases: ['get'],
         describe: `Show ${vowelArticle(singular)} ${singular} by name or sys_id`,
+        builder: y => {
+          const command = relatedListOptions(recordOptions(y));
+          return opts.relationships?.essential?.length ? command.option('essential', { type: 'boolean', default: true,
+            describe: 'Fetch profile-declared essential children; --no-essential skips them. Supplementary lists remain lazy.' }) : command;
+        },
         handler: wrap(async (argv, app) => {
           const id = opts.resolveIdentifier ? await opts.resolveIdentifier(argv, app) : argv.identifier;
           if (id === undefined) return;
@@ -192,16 +200,17 @@ export function buildDevCmd(name, table, aliases, defaultColumns, wrap, opts = {
           const fields = (showFields && showFields.length > 0)
             ? [...new Set(['sys_id', ...showFields])]
             : undefined;
-          const record = await resolveRecord(app.sdk, { table, identifier: id, matchField: 'name', resource: singular, fields });
+          const record = await getRecord(app.sdk, { table, identifier: id, identifierField: argv.identifierField, displayValues: argv.displayValues ?? opts.referenceMode, matchField: opts.identifierField || 'name', resource: singular, fields });
           record._context = {
             instance_url: app.getEffectiveInstance(),
             table,
           };
 
           if (opts.onShow) {
-            await opts.onShow(record, app);
+            await opts.onShow(record, app, argv);
           }
 
+          await enrichRelatedLists(record, { table, argv, app });
           const summary = typeof showSummary === 'function' ? showSummary(record, id) : showSummary;
           const breadcrumbs = typeof showBreadcrumbs === 'function' ? showBreadcrumbs(record, id) : showBreadcrumbs;
 
@@ -214,12 +223,14 @@ export function buildDevCmd(name, table, aliases, defaultColumns, wrap, opts = {
         .command({
           command: 'create',
           describe: `Create a new ${singular}`,
-          builder: (y) => y
-            .option('data', { type: 'string', describe: 'JSON fields (e.g. \'{"state":"2"}\')' })
-            .option('data-file', { type: 'string', describe: 'Read JSON payload from file' }),
+          builder: (y) => recordOptions(y, false)
+            .option('data', { type: 'string', describe: 'JSON fields' })
+            .option('data-file', { type: 'string', describe: 'Read JSON payload from file' })
+            .option('data-stdin', { type: 'boolean', describe: 'Read JSON payload from stdin' })
+            .option('field', { alias: 'f', type: 'string', array: true, describe: 'Set a field as name=value; repeatable' }),
           handler: wrap(async (argv, app) => {
-            const recordData = parseDataArg(argv);
-            const record = await app.sdk.create(table, recordData);
+            const recordData = buildRecordPayload(argv);
+            const record = await createRecord(app.sdk, { table, data: recordData });
             app.ok(record, {
               summary: `Created ${singular}`,
               breadcrumbs: [
@@ -231,29 +242,31 @@ export function buildDevCmd(name, table, aliases, defaultColumns, wrap, opts = {
         .command({
           command: 'update <identifier>',
           describe: `Update ${vowelArticle(singular)} ${singular}`,
-          builder: (y) => y
-            .option('data', { type: 'string', describe: 'JSON fields (e.g. \'{"state":"2"}\')' })
-            .option('data-file', { type: 'string', describe: 'Read JSON payload from file' }),
+          builder: (y) => recordOptions(y, false)
+            .option('data', { type: 'string', describe: 'JSON fields' })
+            .option('data-file', { type: 'string', describe: 'Read JSON payload from file' })
+            .option('data-stdin', { type: 'boolean', describe: 'Read JSON payload from stdin' })
+            .option('field', { alias: 'f', type: 'string', array: true, describe: 'Set a field as name=value; repeatable' }),
           handler: wrap(async (argv, app) => {
             const id = argv.identifier;
-            const record = await resolveRecord(app.sdk, { table, identifier: id, matchField: 'name', resource: singular });
+            const record = await getRecord(app.sdk, { table, identifier: id, identifierField: argv.identifierField, displayValues: argv.displayValues ?? opts.referenceMode, matchField: opts.identifierField || 'name', resource: singular });
             if (scopeValidation) {
               await guardScope(app.sdk, record);
             }
 
             const sysID = unwrapSysId(record);
-            const recordData = parseDataArg(argv);
-            const updated = await app.sdk.update(table, sysID, recordData);
+            const recordData = buildRecordPayload(argv);
+            const updated = await updateRecord(app.sdk, { table, record: { sys_id: sysID }, data: recordData });
             app.ok(updated, { summary: `Updated ${singular} ${id}` });
           }),
         })
         .command({
           command: 'delete <identifier>',
           describe: `Delete ${vowelArticle(singular)} ${singular}`,
-          builder: (y) => y.option('force', { type: 'boolean', default: false, describe: 'Skip confirmation' }),
+          builder: (y) => recordOptions(y, false).option('force', { type: 'boolean', default: false, describe: 'Skip confirmation' }),
           handler: wrap(async (argv, app) => {
             const id = argv.identifier;
-            const record = await resolveRecord(app.sdk, { table, identifier: id, matchField: 'name', resource: singular });
+            const record = await getRecord(app.sdk, { table, identifier: id, identifierField: argv.identifierField, displayValues: argv.displayValues ?? opts.referenceMode, matchField: opts.identifierField || 'name', resource: singular });
             if (scopeValidation) {
               await guardScope(app.sdk, record);
             }
@@ -263,19 +276,27 @@ export function buildDevCmd(name, table, aliases, defaultColumns, wrap, opts = {
 
             await confirmDelete(app, argv, `Delete ${singular} '${recordName}'`);
 
-            await app.sdk.delete(table, sysID);
+            await deleteRecord(app.sdk, { table, record: { sys_id: sysID } });
             app.ok({ name: recordName, sys_id: sysID, deleted: true }, { summary: `Deleted ${singular} '${recordName}'` });
           }),
         });
     }
 
-    return y;
+    const help = [opts.help, extraQuery ? constrainedQueryHelp(extraQuery) : ''].filter(Boolean).join('\n');
+    return help ? y.epilogue(help) : y;
   };
 
   return {
     command: `${name} [subcommand]`,
     aliases: aliases || [],
-    describe: `Manage ${name} (e.g. "${name} list --query nameLIKEincident")`,
+    describe: opts.describe || `Manage ${name} (e.g. "${name} list --query nameLIKEincident")`,
+    discovery: {
+      table,
+      defaultColumns,
+      benefits: ['Configured list columns', 'Lookup by name or sys_id',
+        ...(showFields ? ['Configured show fields'] : []),
+        ...(opts.onShow ? ['Additional table-specific show processing'] : [])],
+    },
     builder,
     handler: (_argv) => {
       // This handler only runs when no subcommand is matched (the default case).

package/src/commands/_simple.js

@@ -1,4 +1,4 @@
-import { buildDevCmd } from './_generic.js';
+import { buildProfileCommand } from '../record-profiles.js';
 import { getStringField } from '../helpers.js';
 // Simple table-based commands — singular names passed for grammar
 // Default columns and aliases match the Go version exactly
@@ -47,13 +47,13 @@ async function fetchExtensionChain(sdk, record) {
 
 export { actionsCmd } from './actions.js';
 
-export const includesCmd = (wrap) => buildDevCmd('includes', 'sys_script_include', ['include', 'si'], ['name', 'api_name', 'active', 'sys_scope'], wrap, { singular: 'script include', scopeValidation: true });
+export const includesCmd = (wrap) => buildProfileCommand('includes', wrap);
 
-export const rulesCmd = (wrap) => buildDevCmd('rules', 'sys_script', ['rule', 'br'], ['name', 'collection', 'active', 'order', 'sys_scope'], wrap, { singular: 'business rule', scopeValidation: true });
+export const rulesCmd = (wrap) => buildProfileCommand('rules', wrap);
 
-export const clientScriptsCmd = (wrap) => buildDevCmd('clientscripts', 'sys_script_client', ['clientscript', 'cs'], ['name', 'table', 'active', 'type', 'sys_scope'], wrap, { singular: 'client script', scopeValidation: true });
+export const clientScriptsCmd = (wrap) => buildProfileCommand('clientscripts', wrap);
 
-export const uiActionsCmd = (wrap) => buildDevCmd('uiactions', 'sys_ui_action', ['uiaction', 'ua'], ['name', 'table', 'active', 'order', 'sys_scope'], wrap, { singular: 'UI action', scopeValidation: true });
+export const uiActionsCmd = (wrap) => buildProfileCommand('uiactions', wrap);
 
 // NOTE: uipolicies has exactly ONE definition — the rich one in
 // ./uipolicies.js (re-exported below at the bottom of this file). A plain
@@ -62,10 +62,7 @@ export const uiActionsCmd = (wrap) => buildDevCmd('uiactions', 'sys_ui_action',
 // this module's uiPoliciesCmd before uipoliciesCmd — so the factory version
 // was dead code shadowing nothing. Deleted; the re-export is the behavior.
 
-export const tablesCmd = (wrap) => buildDevCmd('tables', 'sys_db_object', ['table', 't'], ['name', 'label', 'super_class', 'create_access_controls'], wrap, {
-  singular: 'table',
-  scopeValidation: true,
-  showFields: ['name', 'label', 'super_class', 'create_access_controls', 'sys_scope', 'sys_created_on', 'sys_updated_on', 'sys_created_by', 'sys_updated_by', 'is_extendable'],
+export const tablesCmd = (wrap) => buildProfileCommand('tables', wrap, {
   async onShow(record, app) {
     const tableName = getStringField(record, 'name');
     const [count, extChain] = await Promise.all([
@@ -81,48 +78,48 @@ export { columnsCmd } from './columns.js';
 
 // Read-only commands (Go only has list/show)
 export { importCmd } from './import.js';
-export const spPagesCmd = (wrap) => buildDevCmd('sppages', 'sp_page', ['sp-pages'], ['id', 'title', 'sys_scope'], wrap, { singular: 'Service Portal page', readOnly: true });
-export const spWidgetsCmd = (wrap) => buildDevCmd('spwidgets', 'sp_widget', ['sp-widget', 'widgets'], ['id', 'name', 'sys_scope'], wrap, { singular: 'Service Portal widget', readOnly: true });
-export const uiPagesCmd = (wrap) => buildDevCmd('uipages', 'sys_ui_page', ['ui-page', 'pages'], ['name', 'sys_scope'], wrap, { singular: 'UI page', scopeValidation: true });
-export const appMenuCmd = (wrap) => buildDevCmd('appmenu', 'sys_app_application', ['app-menu', 'menu'], ['name', 'active', 'sys_scope'], wrap, { singular: 'application menu', scopeValidation: true });
+export const spPagesCmd = (wrap) => buildProfileCommand('sppages', wrap);
+export const spWidgetsCmd = (wrap) => buildProfileCommand('spwidgets', wrap);
+export const uiPagesCmd = (wrap) => buildProfileCommand('uipages', wrap);
+export const appMenuCmd = (wrap) => buildProfileCommand('appmenu', wrap);
 
 // Commands with full CRUD
-export const aclsCmd = (wrap) => buildDevCmd('acls', 'sys_security_acl', ['acl'], ['name', 'operation', 'type', 'active', 'sys_scope'], wrap, { singular: 'ACL', scopeValidation: true });
-export const rolesCmd = (wrap) => buildDevCmd('roles', 'sys_user_role', ['role', 'r'], ['name', 'description', 'elevated_privilege', 'sys_scope'], wrap, { singular: 'role', scopeValidation: true });
-export const propertiesCmd = (wrap) => buildDevCmd('properties', 'sys_properties', ['property', 'prop'], ['name', 'value', 'description', 'sys_scope'], wrap, { singular: 'property', scopeValidation: true });
+export const aclsCmd = (wrap) => buildProfileCommand('acls', wrap);
+export const rolesCmd = (wrap) => buildProfileCommand('roles', wrap);
+export const propertiesCmd = (wrap) => buildProfileCommand('properties', wrap);
 
 // New commands for scoped-app tables
-export const relationshipsCmd = (wrap) => buildDevCmd('relationships', 'sys_relationship', ['relationship', 'rel'], ['name', 'sys_scope'], wrap, { singular: 'relationship', scopeValidation: true });
-export const appmodulesCmd = (wrap) => buildDevCmd('appmodules', 'sys_app_module', ['appmodule', 'am'], ['name', 'active', 'sys_scope'], wrap, { singular: 'application module', scopeValidation: true });
-export const listcontrolsCmd = (wrap) => buildDevCmd('listcontrols', 'sys_ui_list_control', ['listcontrol', 'lc'], ['name', 'active', 'sys_scope'], wrap, { singular: 'list control', scopeValidation: true });
-export const viewsCmd = (wrap) => buildDevCmd('views', 'sys_ui_view', ['view', 'vw'], ['name', 'title', 'sys_scope'], wrap, { singular: 'view', scopeValidation: true });
-export const privilegesCmd = (wrap) => buildDevCmd('privileges', 'sys_scope_privilege', ['privilege', 'priv'], ['source_scope', 'target_scope', 'target_name', 'operation', 'status'], wrap, { singular: 'privilege', scopeValidation: true });
-export const uxscriptsCmd = (wrap) => buildDevCmd('uxscripts', 'sys_ux_lib_source_script', ['uxscript', 'ux'], ['name', 'active', 'sys_scope'], wrap, { singular: 'UX script', scopeValidation: true });
+export const relationshipsCmd = (wrap) => buildProfileCommand('relationships', wrap);
+export const appmodulesCmd = (wrap) => buildProfileCommand('appmodules', wrap);
+export const listcontrolsCmd = (wrap) => buildProfileCommand('listcontrols', wrap);
+export const viewsCmd = (wrap) => buildProfileCommand('views', wrap);
+export const privilegesCmd = (wrap) => buildProfileCommand('privileges', wrap);
+export const uxscriptsCmd = (wrap) => buildProfileCommand('uxscripts', wrap);
 export { aliasesCmd } from './aliases.js';
-export const catalogscriptsCmd = (wrap) => buildDevCmd('catalogscripts', 'catalog_script_client', ['catalogscript'], ['name', 'table', 'active', 'sys_scope'], wrap, { singular: 'catalog script', scopeValidation: true });
+export const catalogscriptsCmd = (wrap) => buildProfileCommand('catalogscripts', wrap);
 
 // ── Automation: Async ──
-export const scriptactionsCmd = (wrap) => buildDevCmd('scriptactions', 'sysevent_script_action', ['scriptaction'], ['name', 'active', 'sys_scope'], wrap, { singular: 'script action', scopeValidation: true });
-export const scheduledjobsCmd = (wrap) => buildDevCmd('scheduledjobs', 'sysauto_script', ['scheduledjob'], ['name', 'active', 'run_type', 'sys_scope'], wrap, { singular: 'scheduled job', scopeValidation: true });
-export const asyncrulesCmd = (wrap) => buildDevCmd('asyncrules', 'sys_script', ['asyncrule'], ['name', 'collection', 'active', 'order', 'sys_scope'], wrap, { singular: 'async business rule', scopeValidation: true, extraQuery: 'when=async' });
-export const triggersCmd = (wrap) => buildDevCmd('triggers', 'sysevent_register', ['trigger'], ['name', 'event_name', 'active', 'sys_scope'], wrap, { singular: 'event trigger', scopeValidation: true });
+export const scriptactionsCmd = (wrap) => buildProfileCommand('scriptactions', wrap);
+export const scheduledjobsCmd = (wrap) => buildProfileCommand('scheduledjobs', wrap);
+export const asyncrulesCmd = (wrap) => buildProfileCommand('asyncrules', wrap);
+export const triggersCmd = (wrap) => buildProfileCommand('triggers', wrap);
 
 // ── Automation: In Memory ──
 
-export const assignmentsCmd = (wrap) => buildDevCmd('assignments', 'sysrule_assignment', ['assignment'], ['name', 'active', 'sys_scope'], wrap, { singular: 'assignment rule', scopeValidation: true, readOnly: true });
+export const assignmentsCmd = (wrap) => buildProfileCommand('assignments', wrap);
 
 // ── Automation: Inbound ──
-export const emailCmd = (wrap) => buildDevCmd('email', 'sysevent_in_email_action', ['emails'], ['name', 'active', 'type', 'sys_scope'], wrap, { singular: 'inbound email action', scopeValidation: true });
+export const emailCmd = (wrap) => buildProfileCommand('email', wrap);
 
 // ── Automation: Outbound ──
 export { restmessageCmd } from './restmessage.js';
 export { soapmessagesCmd } from './soapmessages.js';
 
 // ── UX: Core UI ──
-export const uimacrosCmd = (wrap) => buildDevCmd('uimacros', 'sys_ui_macro', ['uimacro'], ['name', 'active', 'sys_scope'], wrap, { singular: 'UI macro', scopeValidation: true });
+export const uimacrosCmd = (wrap) => buildProfileCommand('uimacros', wrap);
 
 // ── UX: Workspaces ──
-export const uxlistsCmd = (wrap) => buildDevCmd('uxlists', 'sys_ux_list', ['uxlist'], ['name', 'active', 'sys_scope'], wrap, { singular: 'workspace list', scopeValidation: true, readOnly: true });
-export const uxapplicabilityCmd = (wrap) => buildDevCmd('uxapplicability', 'sys_ux_applicability_m2m', ['uxapp'], ['name', 'active', 'sys_scope'], wrap, { singular: 'workspace applicability', scopeValidation: true, readOnly: true });
+export const uxlistsCmd = (wrap) => buildProfileCommand('uxlists', wrap);
+export const uxapplicabilityCmd = (wrap) => buildProfileCommand('uxapplicability', wrap);
 export { uipoliciesCmd } from './uipolicies.js';
-export const cataloguipoliciesCmd = (wrap) => buildDevCmd('cataloguipolicies', 'catalog_ui_policy', ['cataloguipolicy', 'cup'], ['short_description', 'catalog_item', 'variable_set', 'active', 'sys_scope'], wrap, { singular: 'catalog UI policy', scopeValidation: true });
+export const cataloguipoliciesCmd = (wrap) => buildProfileCommand('cataloguipolicies', wrap);