@jacebenson/jsn 4.3.12 → 4.3.13-dev.101.1

package/src/commands/forms.js

@@ -1,105 +1,29 @@
 import { getStringField, interactiveList } from '../helpers.js';
 
-function getDisplayValue(record, key) {
-  if (!record || typeof record !== 'object') return '';
-  const val = record[key];
-  if (val == null) return '';
-  if (typeof val === 'string') return val;
-  if (typeof val === 'object') {
-    if (val.display_value != null && val.display_value !== '') return String(val.display_value);
-    if (val.value != null) return String(val.value);
-  }
-  return String(val);
-}
-
-function getIntValue(record, key) {
-  if (!record || typeof record !== 'object') return 0;
-  const val = record[key];
-  if (val == null) return 0;
-  if (typeof val === 'number') return Math.floor(val);
-  if (typeof val === 'string') { const n = parseInt(val, 10); return isNaN(n) ? 0 : n; }
-  if (typeof val === 'object' && val.value != null) { const n = parseInt(val.value, 10); return isNaN(n) ? 0 : n; }
-  return 0;
-}
-
-async function showForm(app, table, viewName) {
-  // 1) Look up the view
-  const viewParams = new URLSearchParams();
-  viewParams.set('sysparm_limit', '1');
-  viewParams.set('sysparm_fields', 'sys_id');
-  viewParams.set('sysparm_display_value', 'all');
-  viewParams.set('sysparm_query', `name=${viewName}`);
-  let viewSysID = '';
-  try { const vr = await app.sdk.list('sys_ui_view', viewParams); if (vr.length > 0) viewSysID = getStringField(vr[0], 'sys_id'); } catch { /* ignore */ }
-  if (!viewSysID) {
-    viewParams.set('sysparm_query', `title=${viewName}`);
-    try { const vr = await app.sdk.list('sys_ui_view', viewParams); if (vr.length > 0) viewSysID = getStringField(vr[0], 'sys_id'); } catch { /* ignore */ }
-  }
-
-  // 2) Get sections for this table + view
-  const secParams = new URLSearchParams();
-  secParams.set('sysparm_limit', '200');
-  secParams.set('sysparm_fields', 'sys_id,caption');
-  secParams.set('sysparm_display_value', 'all');
-  secParams.set('sysparm_query', `name=${table}^view=${viewName}^ORDERBYposition`);
-  if (viewSysID) {
-    secParams.set('sysparm_query', `name=${table}^view=${viewSysID}^ORDERBYposition`);
-  }
-  const sections = await app.sdk.list('sys_ui_section', secParams);
-
-  // 3) Get elements for each section
-  const sectionsOut = [];
-  for (const sec of sections) {
-    const secSysID = getStringField(sec, 'sys_id');
-    const sectionCaption = getDisplayValue(sec, 'caption') || '(unnamed)';
+import { createRecordMetadataReader } from '../metadata/records.js';
 
-    let elements = [];
-    if (secSysID) {
-      const elemParams = new URLSearchParams();
-      elemParams.set('sysparm_limit', '500');
-      elemParams.set('sysparm_fields', 'element,type,label,position');
-      elemParams.set('sysparm_display_value', 'all');
-      elemParams.set('sysparm_query', `sys_ui_section=${secSysID}^ORDERBYposition`);
-      try { elements = await app.sdk.list('sys_ui_element', elemParams); } catch { /* ignore */ }
-    }
-
-    sectionsOut.push({
-      caption: sectionCaption,
-      position: getIntValue(sec, 'position'),
-      elements: elements
-        .map(e => ({
-          type: getDisplayValue(e, 'type'),
-          label: getDisplayValue(e, 'label'),
-          element: getDisplayValue(e, 'element'),
-          position: getIntValue(e, 'position'),
-        }))
-        .sort((a, b) => a.position - b.position),
-    });
+export function formatFormMetadata(metadata) {
+  const lines = [`Form: ${metadata.table} → ${metadata.requested_view}`];
+  if (metadata.form?.inherited) lines.push(`  Inherited layout: ${metadata.form.table}`);
+  if (!metadata.form) lines.push('  No unambiguous shared form layout is visible.');
+  for (const section of metadata.form?.sections || []) {
+    lines.push('', `── ${section.caption || '(unnamed)'} ──`);
+    for (const element of section.elements) lines.push(`  ${element.label || element.element || '(unnamed)'}${element.type ? ` (${element.type})` : ''}`);
+    if (!section.elements.length) lines.push('  (no visible elements)');
   }
-
-  sectionsOut.sort((a, b) => a.position - b.position);
-
-  // Build formatted output
-  const lines = [];
-  lines.push(`Form: ${table} → ${viewName}`);
-  if (viewSysID) lines.push(`  View: ${app.getEffectiveInstance()}/nav_to.do?uri=sys_ui_view.do?sys_id=${viewSysID}`);
-  lines.push('');
-
-  for (const sec of sectionsOut) {
-    const secLabel = sec.caption || '(unnamed)';
-    lines.push(`── ${secLabel} ──`);
-    if (sec.elements.length === 0) {
-      lines.push('  (no elements)');
-    }
-    for (const el of sec.elements) {
-      const elLabel = el.label || el.element || '(unnamed)';
-      const typeStr = el.type ? ` (${el.type})` : '';
-      lines.push(`  ${elLabel}${typeStr}`);
-    }
-    lines.push('');
+  const configured = metadata.related_lists.filter(item => item.configured);
+  if (configured.length) {
+    lines.push('', 'Configured related lists:');
+    for (const list of configured) lines.push(`  ${list.label || list.id} (${list.query_status})`);
   }
+  lines.push('', metadata.coverage.scope);
+  for (const warning of metadata.coverage.warnings) lines.push(`  ${warning.source}: ${warning.reason}`);
+  return lines.join('\n');
+}
 
-  process.stdout.write(lines.join('\n') + '\n');
+async function showForm(app, table, view) {
+  const metadata = await createRecordMetadataReader(app.sdk).read({ table, view });
+  app.ok({ ...metadata, _formatted: formatFormMetadata(metadata) }, { summary: `Form metadata for ${table}` });
 }
 
 export function formsCmd(wrap) {
@@ -164,7 +88,8 @@ export function formsCmd(wrap) {
           aliases: ['get'],
           describe: 'Show form layout',
           builder: (y) => y
-            .option('view', { type: 'string', default: 'Default view', describe: 'View name' }),
+            .option('view', { type: 'string', default: 'Default view', describe: 'Shared view name, title or sys_id' })
+            .epilogue('Discovers shared layouts, inherited forms and related-list metadata. JSON includes coverage limits; custom relationship scripts are never executed. Generic records get presentation is unchanged.'),
           handler: wrap(async (argv, app) => {
             app.requireInstance();
             await showForm(app, argv.table, argv.view);

package/src/commands/groups.js

@@ -1,4 +1,4 @@
-import { formatRecordForDisplay, getStringField, interactiveList, resolveFieldsParam, assertSafeExactMatch } from '../helpers.js';
+import { formatRecordForDisplay, getStringField, interactiveList, resolveFieldsParam, assertSafeExactMatch, buildRecordPayload } from '../helpers.js';
 import { declareCapabilities } from '../capabilities.js';
 
 declareCapabilities('groups', { mutationSubcommands: ['create', 'update', 'delete'] });
@@ -94,12 +94,12 @@ export function groupsCmd(wrap) {
           builder: (y) => y
             .option('name', { alias: 'n', type: 'string', describe: 'Group name' })
             .option('manager', { type: 'string', describe: 'Manager name or sys_id' })
-            .option('data', { type: 'string', describe: 'JSON data for additional fields' }),
+            .option('data', { type: 'string', describe: 'JSON data for additional fields' })
+            .option('data-file', { type: 'string', describe: 'Read JSON payload from file' })
+            .option('data-stdin', { type: 'boolean', describe: 'Read JSON payload from stdin' })
+            .option('field', { alias: 'f', type: 'string', array: true, describe: 'Set a field as name=value; repeatable' }),
           handler: wrap(async (argv, app) => {
-            const recordData = {};
-            if (argv.data) {
-              Object.assign(recordData, JSON.parse(argv.data));
-            }
+            const recordData = buildRecordPayload(argv, { required: false });
             if (argv.name) recordData.name = argv.name;
             if (argv.manager) recordData.manager = argv.manager;
             if (!recordData.name) {
@@ -118,11 +118,14 @@ export function groupsCmd(wrap) {
           command: 'update <name>',
           describe: 'Update a group by name or sys_id',
           builder: (y) => y
-            .option('data', { type: 'string', demandOption: true, describe: 'JSON data to update' }),
+            .option('data', { type: 'string', describe: 'JSON data to update' })
+            .option('data-file', { type: 'string', describe: 'Read JSON payload from file' })
+            .option('data-stdin', { type: 'boolean', describe: 'Read JSON payload from stdin' })
+            .option('field', { alias: 'f', type: 'string', array: true, describe: 'Set a field as name=value; repeatable' }),
           handler: wrap(async (argv, app) => {
             const id = argv.name;
             assertSafeExactMatch(id);
-            const recordData = JSON.parse(argv.data);
+            const recordData = buildRecordPayload(argv);
             const isSysID = id.length === 32 && /^[0-9a-fA-F]+$/.test(id);
             const params = new URLSearchParams();
             params.set('sysparm_query', isSysID ? `sys_id=${id}` : `name=${id}`);

package/src/commands/history.js

@@ -0,0 +1,57 @@
+import { declareCapabilities } from '../capabilities.js';
+import { listHistory, pruneHistory } from '../mutation-history.js';
+
+export function historyCmd(wrap) {
+  declareCapabilities('history', { noInstance: true, skipDailyChecks: true });
+  const list = wrap(async (argv, app) => {
+    const entries = listHistory({ ...argv, instance: argv['instance-url'], profile: argv['profile-name'] });
+    app.ok({ entries, retentionDays: 7, _formatted: renderHistory(entries, { details: argv.details }) });
+  });
+  const filters = b => b
+    .option('details', { type: 'boolean', default: false, describe: 'Show full record IDs, instance URLs and reasons' })
+    .option('since', { type: 'string', describe: 'Earliest ISO timestamp' })
+    .option('until', { type: 'string', describe: 'Latest ISO timestamp' })
+    .option('instance-url', { type: 'string', describe: 'Filter by instance origin' })
+    .option('profile-name', { type: 'string', describe: 'Filter by recorded profile name (including removed profiles)' })
+    .option('table', { type: 'string', describe: 'Filter by table' })
+    .option('operation', { choices: ['create', 'update', 'delete'], type: 'string' })
+    .option('record', { type: 'string', describe: 'Filter by full resolved sys_id' })
+    .option('limit', { type: 'number', default: 50, describe: 'Maximum entries (1–10000)' });
+  return { command: 'history [subcommand]', describe: 'Local seven-day mutation history (not a durable ServiceNow audit)',
+    builder: y => filters(y).command({ command: 'list', describe: 'List local mutations', builder: filters, handler: list })
+      .command({ command: 'prune', describe: 'Remove expired entries only', handler: wrap(async (_argv, app) => {
+        app.ok({ ...pruneHistory(), _formatted: 'Expired local history removed; seven days retained.' });
+      }) }), handler: list };
+}
+
+export function renderHistory(entries, { details = false, timeZone = Intl.DateTimeFormat().resolvedOptions().timeZone } = {}) {
+  if (!entries.length) return 'No local mutations in the last seven days.';
+  const date = new Intl.DateTimeFormat('en-GB', { timeZone, month: 'short', day: '2-digit',
+    hour: '2-digit', minute: '2-digit', hourCycle: 'h23' });
+  // Strip terminal control characters from stored identifiers and labels.
+  // eslint-disable-next-line no-control-regex
+  const clean = value => String(value ?? '').replace(/[\x00-\x1f\x7f]/g, ' ');
+  const clip = (value, length) => value.length > length ? `${value.slice(0, length - 1)}…` : value;
+  const rows = entries.map(entry => {
+    let connection = entry.profile;
+    if (!connection) {
+      try { connection = new URL(entry.instance).host; } catch { connection = entry.instance; }
+    }
+    return [date.format(new Date(entry.timestamp)), entry.operation, clip(clean(entry.table), 22),
+      clip(clean(entry.sys_id || '(unknown)'), 12), entry.outcome, clip(clean(connection), 22)];
+  });
+  const headers = ['WHEN', 'ACTION', 'TABLE', 'RECORD', 'RESULT', 'CONNECTION'];
+  const widths = headers.map((header, i) => Math.max(header.length, ...rows.map(row => row[i].length)));
+  const format = row => row.map((cell, i) => cell.padEnd(widths[i])).join('  ').trimEnd();
+  const lines = [`Recent mutations · ${timeZone}`, '', format(headers)];
+  rows.forEach((row, i) => {
+    lines.push(format(row));
+    if (details) {
+      const entry = entries[i];
+      lines.push(`  ${clean(entry.timestamp)} · ${clean(entry.table)}/${clean(entry.sys_id || '(unknown)')}`,
+        `  ${clean(entry.instance)}${entry.reason ? ` · ${clean(entry.reason)}` : ''}`);
+    }
+  });
+  if (!details) lines.push('', 'Use --details for full IDs, URLs and reasons; --json for structured history.');
+  return lines.join('\n');
+}

package/src/commands/incidents.js

@@ -1,7 +1,5 @@
-import { buildTicketCommands } from './_ticket.js';
-
-const incidentDefaultColumns = ['number', 'short_description', 'priority', 'state', 'assigned_to'];
+import { buildProfileCommand } from '../record-profiles.js';
 
 export function incidentsCmd(wrap) {
-  return buildTicketCommands('incident', 'incidents', 'inc', incidentDefaultColumns, {}, null, wrap);
+  return buildProfileCommand('incidents', wrap);
 }

package/src/commands/midservers.js

@@ -1,8 +1,13 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import process from 'node:process';
-import { input, password as passwordPrompt, select } from '../prompts.js';
+import { input, password as passwordPrompt, select, confirm } from '../prompts.js';
 import { confirmDelete, formatRecordForDisplay, getStringField, interactiveList, canPrompt, assertSafeExactMatch } from '../helpers.js';
+import { AppError, CodeConfirmationRequired } from '../errors.js';
+import { prepareRemoteMidServer, installRemoteMidServer, startRemoteMidServer, stopRemoteMidServer, logsRemoteMidServer, followRemoteMidServer, removeRemoteMidServer } from '../midserver-remote.js';
+import { prepareWindowsRemoteMidServer, installWindowsRemoteMidServer, startWindowsRemoteMidServer, stopWindowsRemoteMidServer, logsWindowsRemoteMidServer, removeWindowsRemoteMidServer } from '../midserver-windows-remote.js';
+import { prepareLinuxRemoteMidServer, installLinuxRemoteMidServer, startLinuxRemoteMidServer, stopLinuxRemoteMidServer, logsLinuxRemoteMidServer, removeLinuxRemoteMidServer } from '../midserver-linux-remote.js';
+import { downloadRemoteMidRecipe } from '../midserver-remote-recipe.js';
 import { FormatAuto } from '../output.js';
 import { declareCapabilities } from '../capabilities.js';
 import { resolveRecord, unwrapSysId } from '../resolve-record.js';
@@ -15,7 +20,7 @@ const LIST_FIELDS = ['sys_id', 'name', 'status', 'host_name', 'ip_address', 'ver
 const DEFAULT_TIMEOUT = 120000;
 const DEFAULT_INTERVAL = 2000;
 
-declareCapabilities('midservers', { mutationSubcommands: ['add', 'remove', 'execute', 'start', 'stop'] });
+declareCapabilities('midservers', { mutationSubcommands: ['add', 'remove', 'execute', 'start', 'stop', 'validate'] });
 
 function agentName(record) {
   const name = getStringField(record, 'name');
@@ -274,6 +279,13 @@ export function assertMidServerReady(record) {
 }
 
 async function promptMidCredentials(app, argv) {
+  if (argv.passwordStdin) {
+    if (!argv.username) throw new Error('--password-stdin requires --username');
+    const password = fs.readFileSync(0, 'utf8').replace(/\r?\n$/, '');
+    if (!password || Buffer.byteLength(password) > 65536 || password.includes('\0')) throw new Error('Invalid password input');
+    const validation = await validateMidCredentials(app.getEffectiveInstance(), argv.username, password);
+    return { username: argv.username, password, releaseName: validation.releaseName };
+  }
   if (!canPrompt()) throw new Error('MID Server installation is interactive. Run it from a terminal.');
   let username = argv.username || '';
   while (true) {
@@ -344,7 +356,31 @@ function removeLocalMidServer(instanceURL, name, directory) {
   return true;
 }
 
+function remoteDirectory(app, argv, name) {
+  const directory = argv.directory || midInstallDirectory(app.getEffectiveInstance(), name);
+  const file = ['.jsn-mid-windows-remote.json', '.jsn-mid-linux-remote.json', '.jsn-mid-remote.json'].find(name => fs.existsSync(path.join(directory, name)));
+  if (!file) throw new Error('No owned remote MID metadata found');
+  const metadata = JSON.parse(fs.readFileSync(path.join(directory, file), 'utf8'));
+  if (metadata.target !== argv.ssh || metadata.instanceURL !== app.getEffectiveInstance().replace(/\/$/, '') || metadata.name !== name) {
+    throw new Error('Remote MID target, instance or name does not match owned local metadata');
+  }
+  return directory;
+}
+
+function nativeRemote(directory) {
+  if (fs.existsSync(path.join(directory, '.jsn-mid-windows-remote.json'))) return { start: startWindowsRemoteMidServer, stop: stopWindowsRemoteMidServer, logs: logsWindowsRemoteMidServer, remove: removeWindowsRemoteMidServer };
+  if (fs.existsSync(path.join(directory, '.jsn-mid-linux-remote.json'))) return { start: startLinuxRemoteMidServer, stop: stopLinuxRemoteMidServer, logs: logsLinuxRemoteMidServer, remove: removeLinuxRemoteMidServer };
+  return null;
+}
+
 async function showMidServerLogs(app, identifier, argv) {
+  if (argv.ssh) {
+    const directory = remoteDirectory(app, argv, identifier);
+    if (argv.follow && nativeRemote(directory)) throw new Error('Remote native logs currently support bounded --tail only');
+    if (argv.follow) return followRemoteMidServer({ directory, tail: argv.tail });
+    const text = (nativeRemote(directory)?.logs || logsRemoteMidServer)({ directory, tail: argv.tail });
+    return app.ok({ target: argv.ssh, text, _formatted: text }, { summary: 'Remote MID logs' });
+  }
   const installDir = argv.directory || midInstallDirectory(app.getEffectiveInstance(), identifier);
   const direct = readDirectInstallation(app.getEffectiveInstance(), identifier, argv.directory);
   if (direct) {
@@ -420,7 +456,8 @@ export function midserversCmd(wrap) {
         builder: (b) => b
           .option('tail', { type: 'number', default: 100, describe: 'Number of log lines' })
           .option('follow', { type: 'boolean', default: false, describe: 'Follow the logs' })
-          .option('directory', { type: 'string', describe: 'Local installation directory override' }),
+          .option('directory', { type: 'string', describe: 'Local installation metadata directory override' })
+          .option('ssh', { type: 'string', describe: 'Configured SSH alias for the remote MID target' }),
         handler: wrap(async (argv, app) => {
           await showMidServerLogs(app, argv.identifier, argv);
         }),
@@ -431,16 +468,19 @@ export function midserversCmd(wrap) {
         builder: (b) => b
           .option('tail', { type: 'number', default: 100, describe: 'Number of log lines' })
           .option('follow', { type: 'boolean', default: false, describe: 'Follow the logs' })
-          .option('directory', { type: 'string', describe: 'Local installation directory override' }),
+          .option('directory', { type: 'string', describe: 'Local installation metadata directory override' })
+          .option('ssh', { type: 'string', describe: 'Configured SSH alias for the remote MID target' }),
         handler: wrap(async (argv, app) => {
           await showMidServerLogs(app, argv.identifier, argv);
         }),
       })
       .command({
         command: 'start <identifier>',
-        describe: 'Start an owned direct MID (Windows: foreground console, no service)',
-        builder: b => b.option('directory', { type: 'string', describe: 'Installation directory override' }),
+        describe: 'Start an owned MID locally or over SSH (remote Windows uses a service)',
+        builder: b => b.option('directory', { type: 'string', describe: 'Installation directory override' })
+          .option('ssh', { type: 'string', describe: 'Configured SSH alias for the remote MID target' }),
         handler: wrap(async (argv, app) => {
+          if (argv.ssh) { const directory = remoteDirectory(app, argv, argv.identifier); return app.ok((nativeRemote(directory)?.start || startRemoteMidServer)({ directory }), { summary: 'Remote MID start command completed' }); }
           const metadata = readDirectInstallation(app.getEffectiveInstance(), argv.identifier, argv.directory);
           if (!metadata) throw new Error('No owned direct MID installation found');
           if (metadata.state !== 'prepared') throw new Error('MID is already started or has an uncertain runtime state; stop it first');
@@ -450,9 +490,11 @@ export function midserversCmd(wrap) {
       })
       .command({
         command: 'stop <identifier>',
-        describe: 'Stop an owned Linux direct MID; Windows console uses Ctrl+C',
-        builder: b => b.option('directory', { type: 'string', describe: 'Installation directory override' }),
+        describe: 'Stop an owned MID locally or over SSH (local Windows console uses Ctrl+C)',
+        builder: b => b.option('directory', { type: 'string', describe: 'Installation directory override' })
+          .option('ssh', { type: 'string', describe: 'Configured SSH alias for the remote MID target' }),
         handler: wrap(async (argv, app) => {
+          if (argv.ssh) { const directory = remoteDirectory(app, argv, argv.identifier); return app.ok((nativeRemote(directory)?.stop || stopRemoteMidServer)({ directory }), { summary: 'Remote MID stop command completed' }); }
           const metadata = readDirectInstallation(app.getEffectiveInstance(), argv.identifier, argv.directory);
           if (!metadata) throw new Error('No owned direct MID installation found');
           app.ok(runDirectInstallation(metadata, 'stop'), { summary: 'Owned native MID stop command completed' });
@@ -463,13 +505,45 @@ export function midserversCmd(wrap) {
         describe: 'Install and verify a MID Server',
         builder: (b) => b
           .option('name', { type: 'string', describe: 'MID Server name (prompted when omitted)' })
-          .option('username', { type: 'string', describe: 'MID Server username (password is always prompted)' })
+          .option('username', { type: 'string', describe: 'MID Server username' })
+          .option('password-stdin', { type: 'boolean', describe: 'Read MID password from stdin instead of a terminal prompt' })
+          .option('ssh', { type: 'string', describe: 'Install MID on a configured SSH target (Docker, native Windows service or Linux background process)' })
+          .option('native-platform', { type: 'string', choices: ['windows', 'linux'], default: 'windows', describe: 'Remote direct ZIP platform (Linux uses a user background process and needs Python 3)' })
           .option('install-method', { type: 'string', choices: ['docker', 'direct'], describe: 'Installation method (prompted when omitted)' })
           .option('directory', { type: 'string', describe: 'Installation directory (must not exist for direct ZIP)' })
           .option('wait-timeout', { type: 'number', default: 300000, describe: 'How long to wait for the MID Server to report Up' })
           .option('wait-interval', { type: 'number', default: 3000, describe: 'MID Server status polling interval in milliseconds' }),
         handler: wrap(async (argv, app) => {
           app.requireInstance();
+          if (argv.ssh) {
+            if (!argv.name) throw new Error('Remote installation requires --name');
+            const name = normalizeMidName(argv.name);
+            const existing = await app.sdk.list(AGENT_TABLE, new URLSearchParams({ sysparm_query: `name=${name}`, sysparm_limit: '1', sysparm_fields: 'sys_id' }));
+            if (existing.length) throw new Error('MID name already exists; refusing to adopt an existing MID');
+            const credentials = await promptMidCredentials(app, argv);
+            const directory = argv.directory || midInstallDirectory(app.getEffectiveInstance(), name);
+            fs.mkdirSync(path.dirname(directory), { recursive: true, mode: 0o700 });
+            const native = (argv.installMethod || argv['install-method']) === 'direct';
+            let installation;
+            if (native) {
+              const linux = argv.nativePlatform === 'linux';
+              const prepare = linux ? prepareLinuxRemoteMidServer : prepareWindowsRemoteMidServer;
+              const install = linux ? installLinuxRemoteMidServer : installWindowsRemoteMidServer;
+              const start = linux ? startLinuxRemoteMidServer : startWindowsRemoteMidServer;
+              prepare({ target: argv.ssh, instanceURL: app.getEffectiveInstance(), name, directory });
+              install({ directory, releaseName: credentials.releaseName, username: credentials.username, password: credentials.password });
+              installation = start({ directory });
+            } else {
+              prepareRemoteMidServer({ target: argv.ssh, instanceURL: app.getEffectiveInstance(), name, directory });
+              const context = await downloadRemoteMidRecipe(credentials.releaseName);
+              installation = installRemoteMidServer({ directory, context, username: credentials.username, password: credentials.password });
+            }
+            const kind = native ? (argv.nativePlatform === 'linux' ? 'remote-linux-background' : 'remote-windows-service') : 'remote-docker';
+            let record;
+            try { record = await waitForMidServerUp(app, name, Math.max(1, argv.waitTimeout), Math.max(500, argv.waitInterval)); }
+            catch { return app.ok({ installation: kind, target: argv.ssh, directory, name, registration: 'pending' }, { summary: 'Remote MID started; registration is pending. Runtime and ownership metadata retained for logs or explicit teardown.' }); }
+            return app.ok({ installation: kind, target: argv.ssh, directory, name, registration: 'up', validated: queueValue(record.validated) === 'true', record, runtime_state: installation.state }, { summary: 'Remote MID is Up; validation is a separate explicit operation' });
+          }
           const credentials = await promptMidCredentials(app, argv);
           const name = argv.name || (await input({
             message: 'MID Server name:',
@@ -580,8 +654,19 @@ export function midserversCmd(wrap) {
         aliases: ['delete'],
         describe: 'Remove a MID Server record (interactive when no identifier is given)',
         builder: (b) => b.option('force', { type: 'boolean', default: false, describe: 'Skip confirmation' })
-          .option('directory', { type: 'string', describe: 'Local installation directory override' }),
+          .option('directory', { type: 'string', describe: 'Local installation metadata directory override' })
+          .option('ssh', { type: 'string', describe: 'Configured SSH alias for the remote MID target' }),
         handler: wrap(async (argv, app) => {
+          if (argv.ssh) {
+            if (!argv.identifier) throw new Error('Remote removal requires the owned MID name');
+            const directory = remoteDirectory(app, argv, argv.identifier);
+            await confirmDelete(app, argv, `Remove owned MID '${argv.identifier}' from SSH target '${argv.ssh}' and delete its MID record`);
+            const removed = (nativeRemote(directory)?.remove || removeRemoteMidServer)({ directory });
+            const records = await app.sdk.list(AGENT_TABLE, new URLSearchParams({ sysparm_query: `name=${argv.identifier}`, sysparm_limit: '2', sysparm_fields: 'sys_id,name' }));
+            if (records.length > 1) throw new Error('Remote runtime removed; multiple MID records match. Inspect records before deleting any.');
+            if (records.length) await app.sdk.delete(AGENT_TABLE, unwrapSysId(records[0]));
+            return app.ok({ name: argv.identifier, target: argv.ssh, remote_runtime_removed: removed.state === 'removed', record_deleted: records.length === 1, metadata_directory: directory }, { summary: 'Owned remote MID runtime removed; nonsecret ownership receipt retained' });
+          }
           let record;
           if (argv.identifier) {
             try {
@@ -621,6 +706,28 @@ export function midserversCmd(wrap) {
           app.ok({ name, sys_id: sysId, deleted: Boolean(record), local_compose_removed: localRemoved && !direct, local_installation_removed: localRemoved, local_installation_type: direct ? 'direct' : 'docker' }, { summary: `Removed MID Server '${name}'${localRemoved ? ' and its owned local runtime' : ''}` });
         }),
       })
+      .command({
+        command: 'validate <identifier>',
+        describe: 'Explicitly trust a MID through the platform Validate action; never writes the validated flag directly',
+        builder: b => b.option('timeout', { type: 'number', default: 300000, describe: 'Validation verification timeout in milliseconds' }),
+        handler: wrap(async (argv, app) => {
+          const record = await resolveMidServer(app.sdk, argv.identifier);
+          assertMidServerUp(record);
+          if (!argv.force) {
+            if (!canPrompt() || app.output.getFormat() !== FormatAuto) throw new AppError(CodeConfirmationRequired, 'MID trust validation requires approval.', 'After approval, rerun with --force.');
+            if (!await confirm({ message: `Trust MID '${getStringField(record, 'name')}' using the platform Validate action?`, default: false })) return;
+          }
+          const cookies = await app.sdk._warmSession(), csrf = await app.sdk._getScriptsPageCSRF(cookies);
+          await app.sdk.rawRequest(`${app.sdk.baseURL}/xmlhttp.do`, { method: 'POST', headers: { Cookie: cookies, 'X-UserToken': csrf }, body: new URLSearchParams({ sysparm_processor: 'MIDServerAjax', sysparm_name: 'validateMID', sysparm_agent: unwrapSysId(record), sysparm_ck: csrf }).toString() });
+          const started = Date.now();
+          while (Date.now() - started < argv.timeout) {
+            const current = await resolveMidServer(app.sdk, argv.identifier);
+            if (queueValue(current.validated) === 'true') return app.ok({ name: getStringField(current, 'name'), validated: true }, { summary: 'MID trust validation verified' });
+            await new Promise(resolve => setTimeout(resolve, 2000));
+          }
+          throw new Error('MID validation was requested but not verified; inspect MID issues before retrying');
+        }),
+      })
       .command({
         command: 'execute [identifier]',
         describe: 'Execute a shell command through a MID Server',