@tenonhq/dovetail-servicenow 0.0.34 → 0.0.35

package/README.md

@@ -93,6 +93,13 @@ npx dove-sn add-choices \
 
 # JSON payload form (recommended for >5 choices)
 npx dove-sn add-choices --from-json ./choices.json
+
+# Retire values — a SOFT delete (sets inactive=true), never a row drop
+npx dove-sn remove-choices \
+  --table x_cadso_core_event \
+  --column state \
+  --update-set 0083c3bb33d003507b18bc534d5c7b6d \
+  --values "expired,failed"
 ```
 
 JSON payload shape:
@@ -110,10 +117,37 @@ JSON payload shape:
 }
 ```
 
+`remove-choices` takes the same `--from-json` form, with a `values` array in
+place of `choices`.
+
+### Removal semantics
+
+- **Soft delete.** Sets `sys_choice.inactive = true`; the row is retained and
+  the operation is reversible by re-adding the value. `sys_dictionary.choice` is
+  left alone — retiring values does not un-make the column a choice field.
+- **Idempotent.** `deactivated` (a live row was flipped) / `unchanged` (already
+  inactive) / `missing` (no such value on the field). Re-running writes nothing.
+- **Duplicates.** `sys_choice` has no uniqueness constraint on
+  `(name, element, value, language)`, so a field can hold several live rows for
+  one value. Every live row is deactivated, and `sysIds` lists all of them — a
+  length above 1 is your signal the field needs cleaning up.
+- **Inherited choices are not covered.** Matching is scoped to
+  `sys_choice.name = <table>`, so a value defined on a *parent* table reports
+  `missing` rather than being deactivated. Hiding one on a child table needs an
+  override row this verb does not write.
+- **Promotion.** ServiceNow captures the change as a single `Choice list` record
+  for the whole column, not one per value — so promoting the update set moves
+  the entire choice-list state for that column.
+
 ## Programmatic
 
 ```ts
-import { createClient, addChoicesToField } from "@tenonhq/dovetail-servicenow";
+import {
+  createClient,
+  addChoicesToField,
+  removeChoicesFromField,
+  ChoiceWriteError,
+} from "@tenonhq/dovetail-servicenow";
 
 var client = createClient({});
 var result = await addChoicesToField(client, { /* ... */ });
@@ -123,6 +157,32 @@ console.log(result.choices);
 //   { value: "delivered", label: "Delivered", sysId: "...", action: "created" },
 //   { value: "failed",    label: "Failed",    sysId: "...", action: "created" }
 // ]
+
+var removed = await removeChoicesFromField(client, {
+  table: "x_cadso_core_event",
+  column: "state",
+  updateSetSysId: "0083c3bb33d003507b18bc534d5c7b6d",
+  values: ["expired"],
+});
+// removed.choices[0] -> { value: "expired", sysId: "...", sysIds: ["..."], action: "deactivated" }
+```
+
+Both verbs write one value at a time. If a write fails partway through they
+throw a **`ChoiceWriteError`** carrying `completed` (the values that already
+landed, in result shape), `failedValue` (the one that threw — its state on the
+instance is unknown), and `cause` (the original error). Catch it rather than
+re-querying the instance to work out how far the run got:
+
+```ts
+try {
+  await removeChoicesFromField(client, params);
+} catch (e) {
+  if (e instanceof ChoiceWriteError) {
+    console.error("already deactivated:", e.completed.map((r) => r.value));
+    console.error("verify by hand:", e.failedValue);
+  }
+  throw e;
+}
 ```
 
 ## Form, list & view layouts

package/dist/choices.d.ts

@@ -8,7 +8,29 @@
  * so choices stay in the same application as the field.
  */
 import type { ServiceNowClient } from "./client";
-import type { AddChoicesParams, AddChoicesResult } from "./types";
+import type { AddChoicesParams, AddChoicesResult, ChoiceActionResult, ChoiceRemovalResult, RemoveChoicesParams, RemoveChoicesResult } from "./types";
+/**
+ * Thrown when a choices write fails partway through the value loop.
+ *
+ * Both verbs write one value at a time. Without this, a throw on value 3 of 5
+ * unwound the whole call and took the local `results` array with it — the
+ * caller could not tell which values had already been deactivated (or which
+ * sys_choice rows had already been created on the add path) without going and
+ * querying the instance. That is the worst possible moment to lose the record:
+ * the writes already landed and are already captured in the update set.
+ *
+ * `completed` holds the values that finished before the failure, in order, in
+ * exactly the shape they would have had in a successful result. `failedValue`
+ * is the value being processed when the write threw, and is NOT in `completed`
+ * — its state on the instance is unknown (the row may or may not have been
+ * written before the error), so it needs checking by hand.
+ */
+export declare class ChoiceWriteError extends Error {
+    readonly completed: Array<ChoiceActionResult | ChoiceRemovalResult>;
+    readonly failedValue: string;
+    readonly cause: unknown;
+    constructor(verb: string, failedValue: string, completed: Array<ChoiceActionResult | ChoiceRemovalResult>, cause: unknown);
+}
 export declare function encodeQueryValue(v: string): string;
 /**
  * Upsert choices for a field and (optionally) toggle sys_dictionary.choice.
@@ -16,3 +38,33 @@ export declare function encodeQueryValue(v: string): string;
  * for every row and skips the dictionary write when no change is required.
  */
 export declare function addChoicesToField(client: ServiceNowClient, params: AddChoicesParams): Promise<AddChoicesResult>;
+/**
+ * Soft-delete choice values for a field: set `inactive=true` on each matching
+ * sys_choice row via pushWithUpdateSet. NEVER a hard delete — the row stays, so the
+ * change is reversible and the historical value still resolves on records that
+ * already hold it. (A hard drop of sys_choice is deliberately deferred; see DEV-511.)
+ *
+ * Idempotent:
+ *   - active value     -> "deactivated" (every live row for it flipped to inactive —
+ *                         usually one write, but more when the field holds duplicates)
+ *   - already inactive -> "unchanged"  (no write)
+ *   - value not found  -> "missing"    (no write)
+ *
+ * The dictionary row is fetched only to PROVE the field exists — without that guard a
+ * mistyped column reports every value as "missing", the silent-failure this family
+ * exists to catch. sys_dictionary.choice is left alone on purpose: removing values
+ * does not un-make the column a choice field.
+ *
+ * Repeated values are collapsed before the loop, so `["a", "a"]` costs no more than
+ * `["a"]` and yields one result row — an idempotent verb must not depend on the caller
+ * de-duplicating first. (That is "no EXTRA writes from repeats", not "exactly one
+ * write": a single value still takes one write per live duplicate row on the field.)
+ *
+ * LIMITATION — inherited choices. Matching is scoped to `sys_choice.name = <table>`, so
+ * a value defined on a PARENT table (task.state inherited by a child) reports "missing"
+ * rather than being deactivated. Hiding an inherited choice on a child table needs an
+ * override row on the child, which this verb does not write. For the x_cadso_* tables
+ * this family targets that case does not arise; on extended OOB tables, treat a
+ * surprising "missing" as a signal to check the parent.
+ */
+export declare function removeChoicesFromField(client: ServiceNowClient, params: RemoveChoicesParams): Promise<RemoveChoicesResult>;

package/dist/choices.js

@@ -9,8 +9,59 @@
  * so choices stay in the same application as the field.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChoiceWriteError = void 0;
 exports.encodeQueryValue = encodeQueryValue;
 exports.addChoicesToField = addChoicesToField;
+exports.removeChoicesFromField = removeChoicesFromField;
+/**
+ * Thrown when a choices write fails partway through the value loop.
+ *
+ * Both verbs write one value at a time. Without this, a throw on value 3 of 5
+ * unwound the whole call and took the local `results` array with it — the
+ * caller could not tell which values had already been deactivated (or which
+ * sys_choice rows had already been created on the add path) without going and
+ * querying the instance. That is the worst possible moment to lose the record:
+ * the writes already landed and are already captured in the update set.
+ *
+ * `completed` holds the values that finished before the failure, in order, in
+ * exactly the shape they would have had in a successful result. `failedValue`
+ * is the value being processed when the write threw, and is NOT in `completed`
+ * — its state on the instance is unknown (the row may or may not have been
+ * written before the error), so it needs checking by hand.
+ */
+class ChoiceWriteError extends Error {
+    completed;
+    failedValue;
+    cause;
+    constructor(verb, failedValue, completed, cause) {
+        var detail = cause instanceof Error
+            ? cause.message
+            : String(cause == null ? "" : cause);
+        super(verb +
+            ' failed on value "' +
+            failedValue +
+            '" after completing ' +
+            completed.length +
+            " value(s): " +
+            detail +
+            "\nAlready written (captured in the update set): " +
+            (completed.length === 0
+                ? "none"
+                : completed
+                    .map(function (r) {
+                    return r.value + " [" + r.action + "]";
+                })
+                    .join(", ")) +
+            '\nState of "' +
+            failedValue +
+            '" on the instance is unknown — verify it directly.');
+        this.name = "ChoiceWriteError";
+        this.completed = completed;
+        this.failedValue = failedValue;
+        this.cause = cause;
+    }
+}
+exports.ChoiceWriteError = ChoiceWriteError;
 function encodeQueryValue(v) {
     // ServiceNow encoded-query values: commas/carets/equals are special. We
     // don't expect them in table/column/value/language inputs, but keep this
@@ -75,8 +126,110 @@ async function fetchUpdateSet(client, sysId) {
     }
     return row;
 }
-async function fetchExistingChoices(client, table, column) {
-    return client.table.query("sys_choice", "name=" + encodeQueryValue(table) + "^element=" + encodeQueryValue(column), 1000);
+var CHOICE_PAGE_LIMIT = 1000;
+/**
+ * Values per encoded-query batch. Keeps `valueIN a,b,c…` comfortably inside practical
+ * URL limits when a caller passes a long list.
+ */
+var CHOICE_QUERY_BATCH = 50;
+/**
+ * Read the existing sys_choice rows for JUST the values being acted on.
+ *
+ * Scoped rather than whole-field on purpose. Reading every row of the field means the
+ * result set grows with the field, not with the request, and `client.table.query` has no
+ * `sysparm_offset` — so a field with more choices than one page could only be handled by
+ * guessing at a truncated read (silently wrong: the add path inserts a duplicate, the
+ * remove path reports a live value as "missing") or by refusing outright, which would
+ * make both verbs unusable on large choice sets. Asking only for the requested values
+ * bounds the read by the request, so large fields stay editable and there is nothing to
+ * truncate.
+ *
+ * Note that values are interpolated into an encoded query, so `encodeQueryValue` rejects
+ * ones carrying `,` `^` `=`. Both CLI surfaces already split on those characters, so such
+ * values were never expressible there; the library paths now refuse them loudly rather
+ * than building a malformed query.
+ */
+async function fetchExistingChoices(client, table, column, values) {
+    var base = "name=" + encodeQueryValue(table) + "^element=" + encodeQueryValue(column);
+    var out = [];
+    for (var i = 0; i < values.length; i += CHOICE_QUERY_BATCH) {
+        var batch = values.slice(i, i + CHOICE_QUERY_BATCH).map(encodeQueryValue);
+        // Ask for one MORE than the ceiling: requesting exactly it cannot distinguish "there
+        // are exactly that many" from "there are more and this is page 1".
+        var rows = await client.table.query("sys_choice", base + "^valueIN" + batch.join(","), CHOICE_PAGE_LIMIT + 1);
+        // A backstop, not an everyday path: this batch asked for at most CHOICE_QUERY_BATCH
+        // values, so overflowing a page means one value has an absurd number of duplicate
+        // rows. Refuse rather than act on a read that may be incomplete.
+        if (rows.length > CHOICE_PAGE_LIMIT) {
+            throw new Error("Refusing to act on a truncated choice list: " +
+                table +
+                "." +
+                column +
+                " returned more than " +
+                CHOICE_PAGE_LIMIT +
+                " sys_choice rows for a single batch of requested values, so the read cannot " +
+                "be trusted to be complete.");
+        }
+        out = out.concat(rows);
+    }
+    return out;
+}
+/**
+ * Group the instance's rows by language::value, keeping EVERY row per key.
+ *
+ * sys_choice has no uniqueness constraint on (name, element, value, language), so a
+ * field can genuinely hold two live rows for one value. Indexing to a single row would
+ * act on one and silently leave the other — the tool reports success while the choice
+ * still renders in the dropdown.
+ */
+function groupExistingByKey(rows) {
+    // Null-prototype: keys derive from record data, and Object.prototype members must not
+    // masquerade as existing entries. See dedupe() for the failure this avoids.
+    var byKey = Object.create(null);
+    rows.forEach(function (row) {
+        var key = (row.language || "en") + "::" + row.value;
+        if (!byKey[key])
+            byKey[key] = [];
+        byKey[key].push(row);
+    });
+    return byKey;
+}
+/**
+ * Collapse choices that target the same language::value. Position is first-seen, but
+ * the LAST spec wins, so `[{a,"Old"},{a,"New"}]` upserts the label the caller asked for
+ * most recently rather than silently writing both.
+ */
+function dedupeChoices(choices) {
+    var byKey = Object.create(null);
+    var order = [];
+    choices.forEach(function (c) {
+        var key = (c.language || "en") + "::" + c.value;
+        if (!byKey[key])
+            order.push(key);
+        byKey[key] = c;
+    });
+    return order.map(function (key) {
+        return byKey[key];
+    });
+}
+/**
+ * Preserve first-seen order while dropping repeats.
+ *
+ * The lookup is a null-prototype map because the keys are raw choice values: on a plain
+ * `{}`, `seen["constructor"]` / `["toString"]` / `["__proto__"]` are already truthy via
+ * Object.prototype, so a value with one of those names would be treated as a repeat and
+ * silently dropped from the request — never written, never even reported.
+ */
+function dedupe(values) {
+    var seen = Object.create(null);
+    var out = [];
+    values.forEach(function (v) {
+        if (seen[v])
+            return;
+        seen[v] = true;
+        out.push(v);
+    });
+    return out;
 }
 function buildChoiceFields(table, column, choice, scope) {
     var fields = {
@@ -134,27 +287,40 @@ async function addChoicesToField(client, params) {
         });
         choiceNow = targetChoiceType;
     }
-    var existing = await fetchExistingChoices(client, params.table, params.column);
-    var existingByValue = {};
-    existing.forEach(function (row) {
-        var key = (row.language || "en") + "::" + row.value;
-        existingByValue[key] = row;
-    });
+    // Collapse repeats on language::value, last spec wins. Without this a value listed
+    // twice is created twice — the cache is read once up front, so the second pass still
+    // sees "not present" and inserts a genuine duplicate sys_choice row.
+    var choices = dedupeChoices(params.choices);
+    // Read only the values being upserted — see fetchExistingChoices on why the read is
+    // scoped to the request rather than the whole field.
+    var existing = await fetchExistingChoices(client, params.table, params.column, dedupe(choices.map(function (c) {
+        return c.value;
+    })));
+    var existingByValue = groupExistingByKey(existing);
     var results = [];
-    for (var i = 0; i < params.choices.length; i += 1) {
-        var choice = params.choices[i];
+    for (var i = 0; i < choices.length; i += 1) {
+        var choice = choices[i];
         var key = (choice.language || "en") + "::" + choice.value;
-        var match = existingByValue[key];
-        if (match && isUnchanged(match, choice)) {
+        var matches = existingByValue[key] || [];
+        var matchSysIds = matches.map(function (row) {
+            return row.sys_id;
+        });
+        // Every live row for this value, not just one: a field can already hold duplicates,
+        // and updating one would leave the other showing the old label in the dropdown.
+        var stale = matches.filter(function (row) {
+            return !isUnchanged(row, choice);
+        });
+        if (matches.length > 0 && stale.length === 0) {
             results.push({
                 value: choice.value,
                 label: choice.label,
-                sysId: match.sys_id,
+                sysId: matchSysIds[0],
+                sysIds: matchSysIds,
                 action: "unchanged",
             });
             continue;
         }
-        if (match) {
+        if (matches.length > 0) {
             var updFields = {
                 label: choice.label,
                 language: choice.language || "en",
@@ -163,30 +329,45 @@ async function addChoicesToField(client, params) {
             if (choice.sequence != null) {
                 updFields.sequence = String(choice.sequence);
             }
-            await client.claude.pushWithUpdateSet({
-                update_set_sys_id: params.updateSetSysId,
-                table: "sys_choice",
-                record_sys_id: match.sys_id,
-                fields: updFields,
-            });
+            try {
+                for (var s = 0; s < stale.length; s += 1) {
+                    await client.claude.pushWithUpdateSet({
+                        update_set_sys_id: params.updateSetSysId,
+                        table: "sys_choice",
+                        record_sys_id: stale[s].sys_id,
+                        fields: updFields,
+                    });
+                }
+            }
+            catch (e) {
+                throw new ChoiceWriteError("add-choices", choice.value, results, e);
+            }
             results.push({
                 value: choice.value,
                 label: choice.label,
-                sysId: match.sys_id,
+                sysId: matchSysIds[0],
+                sysIds: matchSysIds,
                 action: "updated",
             });
             continue;
         }
-        var created = await client.claude.createRecord({
-            table: "sys_choice",
-            fields: buildChoiceFields(params.table, params.column, choice, dict.sys_scope),
-            scope: scopeName,
-            update_set_sys_id: params.updateSetSysId,
-        });
+        var created;
+        try {
+            created = await client.claude.createRecord({
+                table: "sys_choice",
+                fields: buildChoiceFields(params.table, params.column, choice, dict.sys_scope),
+                scope: scopeName,
+                update_set_sys_id: params.updateSetSysId,
+            });
+        }
+        catch (e) {
+            throw new ChoiceWriteError("add-choices", choice.value, results, e);
+        }
         results.push({
             value: choice.value,
             label: choice.label,
             sysId: created.sys_id,
+            sysIds: [created.sys_id],
             action: "created",
         });
     }
@@ -201,3 +382,107 @@ async function addChoicesToField(client, params) {
         choices: results,
     };
 }
+/**
+ * Soft-delete choice values for a field: set `inactive=true` on each matching
+ * sys_choice row via pushWithUpdateSet. NEVER a hard delete — the row stays, so the
+ * change is reversible and the historical value still resolves on records that
+ * already hold it. (A hard drop of sys_choice is deliberately deferred; see DEV-511.)
+ *
+ * Idempotent:
+ *   - active value     -> "deactivated" (every live row for it flipped to inactive —
+ *                         usually one write, but more when the field holds duplicates)
+ *   - already inactive -> "unchanged"  (no write)
+ *   - value not found  -> "missing"    (no write)
+ *
+ * The dictionary row is fetched only to PROVE the field exists — without that guard a
+ * mistyped column reports every value as "missing", the silent-failure this family
+ * exists to catch. sys_dictionary.choice is left alone on purpose: removing values
+ * does not un-make the column a choice field.
+ *
+ * Repeated values are collapsed before the loop, so `["a", "a"]` costs no more than
+ * `["a"]` and yields one result row — an idempotent verb must not depend on the caller
+ * de-duplicating first. (That is "no EXTRA writes from repeats", not "exactly one
+ * write": a single value still takes one write per live duplicate row on the field.)
+ *
+ * LIMITATION — inherited choices. Matching is scoped to `sys_choice.name = <table>`, so
+ * a value defined on a PARENT table (task.state inherited by a child) reports "missing"
+ * rather than being deactivated. Hiding an inherited choice on a child table needs an
+ * override row on the child, which this verb does not write. For the x_cadso_* tables
+ * this family targets that case does not arise; on extended OOB tables, treat a
+ * surprising "missing" as a signal to check the parent.
+ */
+async function removeChoicesFromField(client, params) {
+    if (!params.updateSetSysId) {
+        throw new Error("updateSetSysId is required — every write must be captured in a named update set.");
+    }
+    if (!params.values || params.values.length === 0) {
+        throw new Error("values must be a non-empty array.");
+    }
+    var language = params.language || "en";
+    // fetchDictionary throws a clear error when the field does not exist; fetchUpdateSet
+    // throws unless the set is in progress. Both mirror the add path's guards.
+    var dict = await fetchDictionary(client, params.table, params.column);
+    var updateSet = await fetchUpdateSet(client, params.updateSetSysId);
+    // Collapse repeats: without this a duplicated value writes twice and is counted
+    // twice in the summary, which contradicts the idempotency contract.
+    var values = dedupe(params.values);
+    // Read only the values being removed — see fetchExistingChoices on why the read is
+    // scoped to the request rather than the whole field.
+    var existing = await fetchExistingChoices(client, params.table, params.column, values);
+    var existingByValue = groupExistingByKey(existing);
+    var results = [];
+    for (var i = 0; i < values.length; i += 1) {
+        var value = values[i];
+        var matches = existingByValue[language + "::" + value] || [];
+        if (matches.length === 0) {
+            results.push({ value: value, sysId: "", sysIds: [], action: "missing" });
+            continue;
+        }
+        var sysIds = matches.map(function (row) {
+            return row.sys_id;
+        });
+        // Deactivate EVERY live row for this value. A field can hold more than one, and
+        // stopping at the first leaves the choice selectable while reporting success.
+        var active = matches.filter(function (row) {
+            return row.inactive !== "true";
+        });
+        if (active.length === 0) {
+            results.push({
+                value: value,
+                sysId: sysIds[0],
+                sysIds: sysIds,
+                action: "unchanged",
+            });
+            continue;
+        }
+        try {
+            for (var a = 0; a < active.length; a += 1) {
+                await client.claude.pushWithUpdateSet({
+                    update_set_sys_id: params.updateSetSysId,
+                    table: "sys_choice",
+                    record_sys_id: active[a].sys_id,
+                    fields: { inactive: "true" },
+                });
+            }
+        }
+        catch (e) {
+            throw new ChoiceWriteError("remove-choices", value, results, e);
+        }
+        results.push({
+            value: value,
+            sysId: sysIds[0],
+            sysIds: sysIds,
+            action: "deactivated",
+        });
+    }
+    return {
+        field: {
+            table: params.table,
+            column: params.column,
+            language: language,
+            dictionarySysId: dict.sys_id,
+        },
+        updateSet: { sysId: updateSet.sys_id, name: updateSet.name },
+        choices: results,
+    };
+}

package/dist/cli.js

@@ -69,6 +69,7 @@ const formLayout_1 = require("./layout/formLayout");
 const relatedLists_1 = require("./layout/relatedLists");
 const formatter_2 = require("./layout/formatter");
 const server_1 = require("./mcp/server");
+const schemas_1 = require("./mcp/schemas");
 const buildFlowOrchestrator_1 = require("./flowDesigner/buildFlowOrchestrator");
 const flowDesigner_formatter_1 = require("./flowDesigner-formatter");
 const readFlow_1 = require("./flowDesigner/readFlow");
@@ -147,15 +148,104 @@ function paramsFromFlags(flags) {
     }
     return params;
 }
-async function runAddChoices(flags) {
+/**
+ * A string flag whose value was forgotten arrives as the literal "true" (see
+ * ParsedArgs.bare). Booleans legitimately do that, strings never do — so refuse
+ * rather than write nonsense. Returns the message to print, or null when clean.
+ */
+function bareStringFlagError(verb, bare, stringFlags) {
+    for (var f = 0; f < stringFlags.length; f += 1) {
+        if (bare[stringFlags[f]]) {
+            return (verb + ": --" + stringFlags[f] + " needs a value (it was given none).\n");
+        }
+    }
+    return null;
+}
+async function runAddChoices(flags, bare) {
+    // `updateSetSysId` is guarded alongside `update-set` because paramsFromFlags accepts
+    // both spellings — guarding only the dashed one leaves the alias as a way in.
+    var bareErr = bareStringFlagError("add-choices", bare, [
+        "table",
+        "column",
+        "update-set",
+        "updateSetSysId",
+        "choices",
+        "from-json",
+        "choice-type",
+    ]);
+    if (bareErr) {
+        process.stderr.write(bareErr);
+        return 1;
+    }
     var params = paramsFromFlags(flags);
     var client = (0, client_1.createClient)({});
     var result = await (0, choices_1.addChoicesToField)(client, params);
     if (flags.json === "true") {
         process.stdout.write(JSON.stringify({ params: params, result: result }, null, 2) + "\n");
-        return;
+        return 0;
     }
     process.stdout.write((0, formatter_1.formatAddChoicesResult)(params.table, params.column, result) + "\n");
+    return 0;
+}
+function removeParamsFromFlags(flags) {
+    if (flags["from-json"]) {
+        var raw = fs.readFileSync(flags["from-json"], "utf8");
+        // Validate rather than cast: the same zod schema the MCP tool parses with, so a
+        // malformed spec fails here with a field-level message instead of somewhere
+        // downstream as an undefined table name.
+        return schemas_1.removeChoicesFromFieldSchema.parse(JSON.parse(raw));
+    }
+    var table = flags.table;
+    var column = flags.column;
+    var updateSetSysId = flags["update-set"] || flags.updateSetSysId;
+    var valuesInline = flags.values;
+    if (!table || !column || !updateSetSysId || !valuesInline) {
+        throw new Error("Missing required flags: --table, --column, --update-set, --values");
+    }
+    var params = {
+        table: table,
+        column: column,
+        updateSetSysId: updateSetSysId,
+        values: valuesInline
+            .split(",")
+            .map(function (v) {
+            return v.trim();
+        })
+            .filter(function (v) {
+            return v.length > 0;
+        }),
+    };
+    if (flags.language) {
+        params.language = flags.language;
+    }
+    return params;
+}
+async function runRemoveChoices(flags, bare) {
+    // --language matters most here: a bare one makes every lookup key "true::<value>",
+    // so every value reports "missing", nothing is written, and the summary still reads
+    // like a clean run. That is the silent failure this verb family exists to catch.
+    var bareErr = bareStringFlagError("remove-choices", bare, [
+        "table",
+        "column",
+        "update-set",
+        "updateSetSysId",
+        "values",
+        "language",
+        "from-json",
+    ]);
+    if (bareErr) {
+        process.stderr.write(bareErr);
+        return 1;
+    }
+    var params = removeParamsFromFlags(flags);
+    var client = (0, client_1.createClient)({});
+    var result = await (0, choices_1.removeChoicesFromField)(client, params);
+    if (flags.json === "true") {
+        process.stdout.write(JSON.stringify({ params: params, result: result }, null, 2) + "\n");
+        return 0;
+    }
+    process.stdout.write((0, formatter_1.formatRemoveChoicesResult)(params.table, params.column, result) + "\n");
+    return 0;
 }
 /**
  * dove-sn build-flow:
@@ -850,6 +940,9 @@ function printHelp() {
     process.stdout.write("dove-sn — ServiceNow platform helpers\n\n" +
         "Commands:\n" +
         "  add-choices        Upsert sys_choice rows for a table.column\n" +
+        "  remove-choices     Soft-delete (inactive=true) sys_choice values for a table.column\n" +
+        "                     (--table <t> --column <c> --values a,b,c --update-set <sys_id>\n" +
+        "                      [--language en] [--from-json <path>] [--json])\n" +
         "  create-view        Create a custom view (sys_ui_view)\n" +
         "                     (--name <n> --update-set <sys_id> [--title <t>] [--scope <s>] [--dry-run] [--json])\n" +
         "  set-list-layout    Set the columns of a list layout\n" +
@@ -1149,17 +1242,17 @@ function parseBoolFlag(name, raw, verb = "set-column") {
  * to set a RECORD's value, use set-field.
  */
 async function runSetColumn(flags, bare) {
-    // A string flag whose value was forgotten arrives as the literal "true" — `--label`
-    // with nothing after it would rename the column to "true". Booleans legitimately do
-    // that, strings never do, so refuse rather than silently write nonsense.
-    var stringFlags = ["label", "default", "table", "column", "update-set"];
-    for (var f = 0; f < stringFlags.length; f += 1) {
-        if (bare[stringFlags[f]]) {
-            process.stderr.write("set-column: --" +
-                stringFlags[f] +
-                " needs a value (it was given none).\n");
-            return 1;
-        }
+    var bareErr = bareStringFlagError("set-column", bare, [
+        "label",
+        "default",
+        "table",
+        "column",
+        "update-set",
+        "updateSetSysId",
+    ]);
+    if (bareErr) {
+        process.stderr.write(bareErr);
+        return 1;
     }
     var table = flags.table;
     var column = flags.column;
@@ -1726,8 +1819,10 @@ async function main() {
     // target multiple instances; otherwise the cwd `.env` is used.
     (0, loadEnv_1.loadEnvFile)(parsed.flags.env || parsed.flags["env-file"]);
     if (parsed.command === "add-choices") {
-        await runAddChoices(parsed.flags);
-        return 0;
+        return await runAddChoices(parsed.flags, parsed.bare);
+    }
+    if (parsed.command === "remove-choices") {
+        return await runRemoveChoices(parsed.flags, parsed.bare);
     }
     if (parsed.command === "build-flow") {
         return await runBuildFlowCmd(parsed.flags);

package/dist/executionContext.d.ts

@@ -0,0 +1,84 @@
+/**
+ * S1 — Execution-context detection + two-phase gate (schema-CRUD RFC §7).
+ *
+ * The reusable gate every schema-mutating verb runs through before it writes. It
+ * answers one question, given HOW the command was invoked:
+ *
+ *   - Local / interactive  → two-phase. A schema mutation writes only on explicit
+ *     confirmation, after the caller has seen the dry-run plan.
+ *   - Automation / CI       → a DESTRUCTIVE change is allowed only if it arrived
+ *     through a merged pull request: the workflow passes a merge ref AND proof the
+ *     change is present in that merged diff. Missing either → refuse. This is the
+ *     §7.1 rule: an unattended run may not ORIGINATE a destructive schema change.
+ *
+ * This is NOT a security boundary — a caller can construct any input it likes. It is
+ * a guard rail that makes the safe path the default and the dangerous path explicit,
+ * legibly, in one place instead of re-derived per verb. It FAILS CLOSED: when the
+ * context is ambiguous it resolves to `local` (confirm-required), and an automation
+ * destructive write with no valid merge signal is refused (RFC R4 — the gate is only
+ * as good as the signal the workflow passes, so absence or falsity both refuse).
+ *
+ * ES6 only; no optional chaining. Pure logic — no ServiceNow I/O — so it is unit
+ * tested exhaustively and carries no live-instance risk.
+ */
+export type ExecutionContext = "local" | "automation";
+export interface ResolveContextInput {
+    /** Explicit override (e.g. from a `--context` flag). Wins over auto-detection. */
+    override?: string;
+    /**
+     * Environment to read the CI signal from. Injected for tests; defaults to
+     * process.env. Kept explicit so detection is deterministic and testable.
+     */
+    env?: Record<string, string | undefined>;
+}
+/**
+ * Whether we appear to be running in a CI/automation environment. Reads the standard
+ * signals — GitHub Actions sets GITHUB_ACTIONS=true; CI=true is the generic marker
+ * most runners set. Necessary but NOT sufficient to allow a destructive write: "ran
+ * in CI" ≠ "came from a merged PR" (that is the merge-signal check in the gate).
+ */
+export declare function isCiEnvironment(env: Record<string, string | undefined>): boolean;
+/**
+ * Resolve local-vs-automation. An explicit override always wins (and an override that
+ * is neither 'local' nor 'automation' is a hard error, not a silent fallback). With
+ * no override, auto-detect CI; default to `local` — the safer, confirm-required
+ * branch — when there is no CI signal.
+ */
+export declare function resolveExecutionContext(input?: ResolveContextInput): ExecutionContext;
+/**
+ * The merged-PR signal an automation workflow passes for a destructive change.
+ *
+ * `changePresent` is the load-bearing field: the workflow is responsible for proving
+ * the destructive change is actually in the diff at `mergeRef`, and the gate fails
+ * closed unless it is explicitly true. Passing a ref alone is not enough — that would
+ * let any CI run assert "a PR merged somewhere", which is exactly the loophole §7.1
+ * closes.
+ */
+export interface MergeSignal {
+    /** The merge commit SHA or PR ref the automation ran from. */
+    mergeRef: string;
+    /** Proof the destructive change is present in the diff at `mergeRef`. */
+    changePresent: boolean;
+}
+export interface WriteGateInput {
+    context: ExecutionContext;
+    /** True for a WRITE_DESTRUCTIVE operation (drop table/column). */
+    destructive: boolean;
+    /** Local: explicit confirmation that the dry-run plan was reviewed and accepted. */
+    confirmed?: boolean;
+    /** Automation: the merged-PR signal, required for a destructive change. */
+    mergeSignal?: MergeSignal;
+}
+export interface GateDecision {
+    allowed: boolean;
+    /** Why the write was refused, and what to do — empty string when allowed. */
+    reason: string;
+}
+/**
+ * Decide whether a schema write may proceed. Returns a decision rather than throwing,
+ * so a verb can fold `reason` into its own structured result; `assertWriteAllowed` is
+ * the throwing wrapper for callers that prefer to abort.
+ */
+export declare function evaluateWriteGate(input: WriteGateInput): GateDecision;
+/** Throwing wrapper around evaluateWriteGate for verbs that prefer to abort on refusal. */
+export declare function assertWriteAllowed(input: WriteGateInput): void;

package/dist/executionContext.js

@@ -0,0 +1,105 @@
+"use strict";
+/**
+ * S1 — Execution-context detection + two-phase gate (schema-CRUD RFC §7).
+ *
+ * The reusable gate every schema-mutating verb runs through before it writes. It
+ * answers one question, given HOW the command was invoked:
+ *
+ *   - Local / interactive  → two-phase. A schema mutation writes only on explicit
+ *     confirmation, after the caller has seen the dry-run plan.
+ *   - Automation / CI       → a DESTRUCTIVE change is allowed only if it arrived
+ *     through a merged pull request: the workflow passes a merge ref AND proof the
+ *     change is present in that merged diff. Missing either → refuse. This is the
+ *     §7.1 rule: an unattended run may not ORIGINATE a destructive schema change.
+ *
+ * This is NOT a security boundary — a caller can construct any input it likes. It is
+ * a guard rail that makes the safe path the default and the dangerous path explicit,
+ * legibly, in one place instead of re-derived per verb. It FAILS CLOSED: when the
+ * context is ambiguous it resolves to `local` (confirm-required), and an automation
+ * destructive write with no valid merge signal is refused (RFC R4 — the gate is only
+ * as good as the signal the workflow passes, so absence or falsity both refuse).
+ *
+ * ES6 only; no optional chaining. Pure logic — no ServiceNow I/O — so it is unit
+ * tested exhaustively and carries no live-instance risk.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isCiEnvironment = isCiEnvironment;
+exports.resolveExecutionContext = resolveExecutionContext;
+exports.evaluateWriteGate = evaluateWriteGate;
+exports.assertWriteAllowed = assertWriteAllowed;
+/**
+ * Whether we appear to be running in a CI/automation environment. Reads the standard
+ * signals — GitHub Actions sets GITHUB_ACTIONS=true; CI=true is the generic marker
+ * most runners set. Necessary but NOT sufficient to allow a destructive write: "ran
+ * in CI" ≠ "came from a merged PR" (that is the merge-signal check in the gate).
+ */
+function isCiEnvironment(env) {
+    return env.GITHUB_ACTIONS === "true" || env.CI === "true" || env.CI === "1";
+}
+/**
+ * Resolve local-vs-automation. An explicit override always wins (and an override that
+ * is neither 'local' nor 'automation' is a hard error, not a silent fallback). With
+ * no override, auto-detect CI; default to `local` — the safer, confirm-required
+ * branch — when there is no CI signal.
+ */
+function resolveExecutionContext(input = {}) {
+    var override = input.override
+        ? String(input.override).trim().toLowerCase()
+        : "";
+    if (override === "local" || override === "automation") {
+        return override;
+    }
+    if (override) {
+        throw new Error("context must be 'local' or 'automation', got '" + input.override + "'.");
+    }
+    var env = input.env || process.env;
+    return isCiEnvironment(env) ? "automation" : "local";
+}
+/**
+ * Decide whether a schema write may proceed. Returns a decision rather than throwing,
+ * so a verb can fold `reason` into its own structured result; `assertWriteAllowed` is
+ * the throwing wrapper for callers that prefer to abort.
+ */
+function evaluateWriteGate(input) {
+    if (input.context === "local") {
+        // Every schema mutation is two-phase locally — destructive or not.
+        if (!input.confirmed) {
+            return {
+                allowed: false,
+                reason: "Local schema writes are two-phase: review the dry-run plan, then re-run " +
+                    "with confirmation. Nothing was written.",
+            };
+        }
+        return { allowed: true, reason: "" };
+    }
+    // Automation. A non-destructive write may run unattended; a destructive one may not
+    // ORIGINATE here — it must have arrived through a merged PR.
+    if (!input.destructive) {
+        return { allowed: true, reason: "" };
+    }
+    if (!input.mergeSignal || !input.mergeSignal.mergeRef) {
+        return {
+            allowed: false,
+            reason: "Automation refuses a destructive schema change without a merged-PR signal " +
+                "— an unattended run may not originate one (fail closed).",
+        };
+    }
+    if (!input.mergeSignal.changePresent) {
+        return {
+            allowed: false,
+            reason: "The destructive change is not present in the merged diff '" +
+                input.mergeSignal.mergeRef +
+                "' — refusing (fail closed).",
+        };
+    }
+    return { allowed: true, reason: "" };
+}
+/** Throwing wrapper around evaluateWriteGate for verbs that prefer to abort on refusal. */
+function assertWriteAllowed(input) {
+    var decision = evaluateWriteGate(input);
+    if (!decision.allowed) {
+        // No verb prefix — the reason is self-contained, and this gate is shared by every
+        // schema verb (remove-field/remove-table/…), none of which owns the message.
+        throw new Error(decision.reason);
+    }
+}

package/dist/formatter.d.ts

@@ -1,6 +1,12 @@
-import type { AddChoicesResult } from "./types";
+import type { AddChoicesResult, RemoveChoicesResult } from "./types";
 /**
  * Human-readable one-page summary of an addChoicesToField result.
  * Used by the CLI and by Claude skills when surfacing outcomes back to the user.
  */
 export declare function formatAddChoicesResult(table: string, column: string, result: AddChoicesResult): string;
+/**
+ * Human-readable one-page summary of a removeChoicesFromField result.
+ * Soft-delete semantics: "deactivated" set inactive=true; "unchanged" was already
+ * inactive; "missing" was not found on the field.
+ */
+export declare function formatRemoveChoicesResult(table: string, column: string, result: RemoveChoicesResult): string;

package/dist/formatter.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.formatAddChoicesResult = formatAddChoicesResult;
+exports.formatRemoveChoicesResult = formatRemoveChoicesResult;
 /**
  * Human-readable one-page summary of an addChoicesToField result.
  * Used by the CLI and by Claude skills when surfacing outcomes back to the user.
@@ -36,3 +37,67 @@ function formatAddChoicesResult(table, column, result) {
     lines.push("Summary: " + created + " created, " + updated + " updated, " + unchanged + " unchanged.");
     return lines.join("\n");
 }
+/**
+ * Human-readable one-page summary of a removeChoicesFromField result.
+ * Soft-delete semantics: "deactivated" set inactive=true; "unchanged" was already
+ * inactive; "missing" was not found on the field.
+ */
+function formatRemoveChoicesResult(table, column, result) {
+    var lines = [];
+    lines.push("ServiceNow choice soft-delete — " +
+        table +
+        "." +
+        column +
+        " [" +
+        result.field.language +
+        "]");
+    lines.push("");
+    lines.push("Update set: " +
+        result.updateSet.name +
+        " (" +
+        result.updateSet.sysId +
+        ")");
+    lines.push("Dictionary: " + result.field.dictionarySysId);
+    lines.push("");
+    var deactivated = 0;
+    var unchanged = 0;
+    var missing = 0;
+    lines.push("Choices:");
+    result.choices.forEach(function (row) {
+        if (row.action === "deactivated")
+            deactivated += 1;
+        else if (row.action === "unchanged")
+            unchanged += 1;
+        else
+            missing += 1;
+        // A value with more than one row is worth saying out loud — the field carries
+        // duplicates. The wording has to follow the action: on "unchanged" nothing was
+        // written, so claiming they were deactivated would contradict the summary below.
+        // "all now inactive" rather than "all deactivated": on a mixed set — one duplicate
+        // already inactive, one live — only the live row is written, so claiming both were
+        // deactivated overstates it. End state is what the reader needs, and it is true in
+        // both cases.
+        var note = "";
+        if (row.sysIds.length > 1) {
+            note =
+                row.action === "deactivated"
+                    ? "  [" + row.sysIds.length + " duplicate rows, all now inactive]"
+                    : "  [" + row.sysIds.length + " duplicate rows, all already inactive]";
+        }
+        lines.push("  [" +
+            row.action.padEnd(11) +
+            "] " +
+            row.value +
+            (row.sysId ? "  (" + row.sysId + ")" : "") +
+            note);
+    });
+    lines.push("");
+    lines.push("Summary: " +
+        deactivated +
+        " deactivated, " +
+        unchanged +
+        " unchanged, " +
+        missing +
+        " missing.");
+    return lines.join("\n");
+}

package/dist/index.d.ts

@@ -5,11 +5,13 @@
  * REST API so every change lands in the target update set and scope.
  */
 export { createClient } from "./client";
+export { resolveExecutionContext, isCiEnvironment, evaluateWriteGate, assertWriteAllowed, } from "./executionContext";
+export type { ExecutionContext, ResolveContextInput, MergeSignal, WriteGateInput, GateDecision, } from "./executionContext";
 export { createClientFromEnvFile, resolveConfigFromEnvFile, } from "./createClientFromEnvFile";
 export type { ServiceNowClient, TableQueryOptions, TableSchema, TableSchemaField, AttachmentMeta, NowInvokeMethod, NowInvokeParams, NowInvokeResponse, } from "./client";
-export { addChoicesToField } from "./choices";
+export { addChoicesToField, removeChoicesFromField, ChoiceWriteError, } from "./choices";
 export { hostAssets, classifyChunks, formatHostAssetsResult, } from "./hostAssets";
-export { formatAddChoicesResult } from "./formatter";
+export { formatAddChoicesResult, formatRemoveChoicesResult } from "./formatter";
 export { createView } from "./layout/views";
 export { setListLayout } from "./layout/listLayout";
 export { setFormLayout } from "./layout/formLayout";
@@ -18,7 +20,7 @@ export { formatLayoutResult, formatCreateViewResult } from "./layout/formatter";
 export { sincPlugin } from "./plugin";
 export { listTemplates, verifyArtifact, cloneSubflow, cloneActionType, triggerPublication, publishActionType, editActionType, applyStepOps, verifySteps, summarizeSteps, formatStepPill, readFlow, readActionType, publishFlow, copyFlow, createFlow, buildPublishModel, editFlow, testFlow, DEFAULT_RUN_FLOW_PATH, generateSysId, topoSort, executeWritePlan, WriteOrderError, } from "./flowDesigner";
 export type { TemplateRef, ListTemplatesParams, FlowKind, VerifyExpect, VerifyFound, VerifyFailure, VerifyReport, VerifyArtifactParams, CloneSubflowParams, CloneSubflowResult, CloneActionTypeParams, CloneActionTypeResult, TriggerPublicationParams, TriggerPublicationResult, PublishActionTypeParams, PublishActionTypeResult, EditActionTypeParams, EditActionTypeResult, EditActionTypeOps, StepOps, StepRecord, StepSummary, StepIoSummary, PatchStepScriptOp, AddStepOutputOp, AddStepInputOp, ApplyStepOpsResult, VerifyStepsResult, ReadFlowParams, ReadFlowResult, FlowStep, FlowVariable, ReadActionTypeParams, ReadActionTypeResult, ActionIo, PublishFlowParams, PublishFlowResult, CopyFlowParams, CopyFlowResult, CreateFlowParams, CreateFlowResult, EditFlowParams, EditFlowResult, EditFlowOps, StepInputPatch, TestFlowParams, TestFlowResult, WriteOp, WriteOpResult, } from "./flowDesigner";
-export type { ServiceNowClientConfig, ChoiceValue, ChoiceType, AddChoicesParams, AddChoicesResult, ChoiceActionResult, DictionaryRecord, UpdateSetRecord, LayoutAction, LayoutRecordResult, LayoutResult, CreateViewParams, CreateViewResult, FormSectionSpec, SetFormLayoutParams, SetListLayoutParams, SetRelatedListsParams, ChunkRole, ChunkInfo, ChunkResult, PrunedResult, HostAssetsParams, HostAssetsResult, } from "./types";
+export type { ServiceNowClientConfig, ChoiceValue, ChoiceType, AddChoicesParams, AddChoicesResult, ChoiceActionResult, RemoveChoicesParams, RemoveChoicesResult, ChoiceRemovalResult, DictionaryRecord, UpdateSetRecord, LayoutAction, LayoutRecordResult, LayoutResult, CreateViewParams, CreateViewResult, FormSectionSpec, SetFormLayoutParams, SetListLayoutParams, SetRelatedListsParams, ChunkRole, ChunkInfo, ChunkResult, PrunedResult, HostAssetsParams, HostAssetsResult, } from "./types";
 export { createTable, projectTableGraph, buildColumnXml, normalizeColumns, resolveType, applyTableSaveOverlay, defaultAccessFlags, TYPE_MAP, DEFAULT_SUPER_CLASS, DEFAULT_SAVE_ACTION, addColumn, deriveElement, setColumn, resolveAttributes, toStoredValue, setTable, resolveTableAttributes, } from "./table";
 export type { CreateTableParams, CreateTableResult, AddColumnParams, AddColumnResult, SetColumnParams, SetColumnResult, ColumnAttributes, AttributeChange, SetTableParams, SetTableResult, TableAttributes, TableGraph, NormalizedColumn, ColumnSpec, AccessFlags, OverlaySpec, } from "./table";
 export { setField } from "./setField";

package/dist/index.js

@@ -6,21 +6,29 @@
  * REST API so every change lands in the target update set and scope.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.addColumn = exports.DEFAULT_SAVE_ACTION = exports.DEFAULT_SUPER_CLASS = exports.TYPE_MAP = exports.defaultAccessFlags = exports.applyTableSaveOverlay = exports.resolveType = exports.normalizeColumns = exports.buildColumnXml = exports.projectTableGraph = exports.createTable = exports.WriteOrderError = exports.executeWritePlan = exports.topoSort = exports.generateSysId = exports.DEFAULT_RUN_FLOW_PATH = exports.testFlow = exports.editFlow = exports.buildPublishModel = exports.createFlow = exports.copyFlow = exports.publishFlow = exports.readActionType = exports.readFlow = exports.formatStepPill = exports.summarizeSteps = exports.verifySteps = exports.applyStepOps = exports.editActionType = exports.publishActionType = exports.triggerPublication = exports.cloneActionType = exports.cloneSubflow = exports.verifyArtifact = exports.listTemplates = exports.sincPlugin = exports.formatCreateViewResult = exports.formatLayoutResult = exports.setRelatedLists = exports.setFormLayout = exports.setListLayout = exports.createView = exports.formatAddChoicesResult = exports.formatHostAssetsResult = exports.classifyChunks = exports.hostAssets = exports.addChoicesToField = exports.resolveConfigFromEnvFile = exports.createClientFromEnvFile = exports.createClient = void 0;
-exports.PUBLISH_POLL_DELAYS_MS = exports.DEFAULT_PUBLISH_TIMEOUT_MS = exports.parseCicdProgress = exports.parseCicdPublishResponse = exports.harvestProgressResults = exports.flattenSteps = exports.classifyProgress = exports.parseProgressTree = exports.parseXmlAnswer = exports.buildStartFields = exports.publishApp = exports.INVOKE_REST_METHODS = exports.invokeRest = exports.createRecord = exports.setField = exports.resolveTableAttributes = exports.setTable = exports.toStoredValue = exports.resolveAttributes = exports.setColumn = exports.deriveElement = void 0;
+exports.normalizeColumns = exports.buildColumnXml = exports.projectTableGraph = exports.createTable = exports.WriteOrderError = exports.executeWritePlan = exports.topoSort = exports.generateSysId = exports.DEFAULT_RUN_FLOW_PATH = exports.testFlow = exports.editFlow = exports.buildPublishModel = exports.createFlow = exports.copyFlow = exports.publishFlow = exports.readActionType = exports.readFlow = exports.formatStepPill = exports.summarizeSteps = exports.verifySteps = exports.applyStepOps = exports.editActionType = exports.publishActionType = exports.triggerPublication = exports.cloneActionType = exports.cloneSubflow = exports.verifyArtifact = exports.listTemplates = exports.sincPlugin = exports.formatCreateViewResult = exports.formatLayoutResult = exports.setRelatedLists = exports.setFormLayout = exports.setListLayout = exports.createView = exports.formatRemoveChoicesResult = exports.formatAddChoicesResult = exports.formatHostAssetsResult = exports.classifyChunks = exports.hostAssets = exports.ChoiceWriteError = exports.removeChoicesFromField = exports.addChoicesToField = exports.resolveConfigFromEnvFile = exports.createClientFromEnvFile = exports.assertWriteAllowed = exports.evaluateWriteGate = exports.isCiEnvironment = exports.resolveExecutionContext = exports.createClient = void 0;
+exports.PUBLISH_POLL_DELAYS_MS = exports.DEFAULT_PUBLISH_TIMEOUT_MS = exports.parseCicdProgress = exports.parseCicdPublishResponse = exports.harvestProgressResults = exports.flattenSteps = exports.classifyProgress = exports.parseProgressTree = exports.parseXmlAnswer = exports.buildStartFields = exports.publishApp = exports.INVOKE_REST_METHODS = exports.invokeRest = exports.createRecord = exports.setField = exports.resolveTableAttributes = exports.setTable = exports.toStoredValue = exports.resolveAttributes = exports.setColumn = exports.deriveElement = exports.addColumn = exports.DEFAULT_SAVE_ACTION = exports.DEFAULT_SUPER_CLASS = exports.TYPE_MAP = exports.defaultAccessFlags = exports.applyTableSaveOverlay = exports.resolveType = void 0;
 var client_1 = require("./client");
 Object.defineProperty(exports, "createClient", { enumerable: true, get: function () { return client_1.createClient; } });
+var executionContext_1 = require("./executionContext");
+Object.defineProperty(exports, "resolveExecutionContext", { enumerable: true, get: function () { return executionContext_1.resolveExecutionContext; } });
+Object.defineProperty(exports, "isCiEnvironment", { enumerable: true, get: function () { return executionContext_1.isCiEnvironment; } });
+Object.defineProperty(exports, "evaluateWriteGate", { enumerable: true, get: function () { return executionContext_1.evaluateWriteGate; } });
+Object.defineProperty(exports, "assertWriteAllowed", { enumerable: true, get: function () { return executionContext_1.assertWriteAllowed; } });
 var createClientFromEnvFile_1 = require("./createClientFromEnvFile");
 Object.defineProperty(exports, "createClientFromEnvFile", { enumerable: true, get: function () { return createClientFromEnvFile_1.createClientFromEnvFile; } });
 Object.defineProperty(exports, "resolveConfigFromEnvFile", { enumerable: true, get: function () { return createClientFromEnvFile_1.resolveConfigFromEnvFile; } });
 var choices_1 = require("./choices");
 Object.defineProperty(exports, "addChoicesToField", { enumerable: true, get: function () { return choices_1.addChoicesToField; } });
+Object.defineProperty(exports, "removeChoicesFromField", { enumerable: true, get: function () { return choices_1.removeChoicesFromField; } });
+Object.defineProperty(exports, "ChoiceWriteError", { enumerable: true, get: function () { return choices_1.ChoiceWriteError; } });
 var hostAssets_1 = require("./hostAssets");
 Object.defineProperty(exports, "hostAssets", { enumerable: true, get: function () { return hostAssets_1.hostAssets; } });
 Object.defineProperty(exports, "classifyChunks", { enumerable: true, get: function () { return hostAssets_1.classifyChunks; } });
 Object.defineProperty(exports, "formatHostAssetsResult", { enumerable: true, get: function () { return hostAssets_1.formatHostAssetsResult; } });
 var formatter_1 = require("./formatter");
 Object.defineProperty(exports, "formatAddChoicesResult", { enumerable: true, get: function () { return formatter_1.formatAddChoicesResult; } });
+Object.defineProperty(exports, "formatRemoveChoicesResult", { enumerable: true, get: function () { return formatter_1.formatRemoveChoicesResult; } });
 var views_1 = require("./layout/views");
 Object.defineProperty(exports, "createView", { enumerable: true, get: function () { return views_1.createView; } });
 var listLayout_1 = require("./layout/listLayout");

package/dist/mcp/registry.d.ts

@@ -10,7 +10,7 @@ import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 import type { ToolAnnotations } from "@tenonhq/dovetail-mcp-kit";
 import type { ServiceNowClient } from "../client";
-export declare var TOOL_NAMES: readonly ["create_view", "set_list_layout", "set_form_layout", "set_related_lists", "add_choices_to_field", "flow_view", "action_view", "action_edit", "flow_publish", "flow_copy", "flow_create", "flow_test", "flow_edit", "create_table", "add_column", "set_column", "set_table", "set_field", "create_record", "host_assets", "invoke_rest", "app_publish"];
+export declare var TOOL_NAMES: readonly ["create_view", "set_list_layout", "set_form_layout", "set_related_lists", "add_choices_to_field", "remove_choices_from_field", "flow_view", "action_view", "action_edit", "flow_publish", "flow_copy", "flow_create", "flow_test", "flow_edit", "create_table", "add_column", "set_column", "set_table", "set_field", "create_record", "host_assets", "invoke_rest", "app_publish"];
 export type ToolName = (typeof TOOL_NAMES)[number];
 export interface RegistryDeps {
     /** Optional client injection for tests; defaults to createClient({}). */

package/dist/mcp/registry.js

@@ -39,6 +39,7 @@ exports.TOOL_NAMES = [
     "set_form_layout",
     "set_related_lists",
     "add_choices_to_field",
+    "remove_choices_from_field",
     "flow_view",
     "action_view",
     "action_edit",
@@ -120,6 +121,25 @@ function buildDescriptors(deps = {}) {
                 return (0, choices_1.addChoicesToField)(client(), schemas_1.addChoicesToFieldSchema.parse(args));
             },
         },
+        {
+            name: "remove_choices_from_field",
+            annotations: dovetail_mcp_kit_1.WRITE_OVERWRITE,
+            description: "Soft-delete sys_choice values for a ServiceNow table.column by setting inactive=true " +
+                "(the row is kept, so it is reversible and historical values still resolve). Never a " +
+                "hard delete. Idempotent: an already-inactive value is 'unchanged', an absent value is " +
+                "'missing', and a value repeated in the request causes no extra writes — it collapses " +
+                "to one result row. A single value CAN write more than once when the field holds " +
+                "duplicate rows for it; every live one is deactivated. sys_dictionary.choice is left " +
+                "alone. Matching is scoped by LANGUAGE (defaults to 'en'), so a value that exists only " +
+                "in another language reports 'missing' and is left untouched — pass `language` to target " +
+                "it. Matching is also scoped to this table, so a choice INHERITED from a parent table " +
+                "reports 'missing' rather than being deactivated. Writes are captured in the supplied " +
+                "update set.",
+            shape: schemas_1.removeChoicesFromFieldSchema.shape,
+            handler: async function (args) {
+                return (0, choices_1.removeChoicesFromField)(client(), schemas_1.removeChoicesFromFieldSchema.parse(args));
+            },
+        },
         {
             name: "flow_view",
             annotations: dovetail_mcp_kit_1.READ_ONLY,

package/dist/mcp/schemas.d.ts

@@ -185,6 +185,25 @@ export declare var addChoicesToFieldSchema: z.ZodObject<{
     column: string;
     choiceType?: 0 | 1 | 3 | null | undefined;
 }>;
+export declare var removeChoicesFromFieldSchema: z.ZodObject<{
+    table: z.ZodString;
+    column: z.ZodString;
+    values: z.ZodArray<z.ZodString, "many">;
+    language: z.ZodOptional<z.ZodString>;
+    updateSetSysId: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    values: string[];
+    table: string;
+    updateSetSysId: string;
+    column: string;
+    language?: string | undefined;
+}, {
+    values: string[];
+    table: string;
+    updateSetSysId: string;
+    column: string;
+    language?: string | undefined;
+}>;
 export declare var viewFlowSchema: z.ZodObject<{
     sysId: z.ZodString;
     raw: z.ZodOptional<z.ZodBoolean>;

package/dist/mcp/schemas.js

@@ -4,7 +4,7 @@
  * own file so registry.ts stays focused on wiring.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.invokeRestSchema = exports.publishAppSchema = exports.createRecordSchema = exports.setFieldSchema = exports.setTableSchema = exports.tableAttributesSchema = exports.setColumnSchema = exports.columnAttributesSchema = exports.addColumnSchema = exports.createTableSchema = exports.columnSpecSchema = exports.hostAssetsSchema = exports.editFlowSchema = exports.editActionSchema = exports.stepInputPatchSchema = exports.testFlowSchema = exports.createFlowSchema = exports.copyFlowSchema = exports.publishFlowSchema = exports.viewActionSchema = exports.viewFlowSchema = exports.addChoicesToFieldSchema = exports.choiceValueSchema = exports.setRelatedListsSchema = exports.setFormLayoutSchema = exports.formSectionSchema = exports.setListLayoutSchema = exports.createViewSchema = void 0;
+exports.invokeRestSchema = exports.publishAppSchema = exports.createRecordSchema = exports.setFieldSchema = exports.setTableSchema = exports.tableAttributesSchema = exports.setColumnSchema = exports.columnAttributesSchema = exports.addColumnSchema = exports.createTableSchema = exports.columnSpecSchema = exports.hostAssetsSchema = exports.editFlowSchema = exports.editActionSchema = exports.stepInputPatchSchema = exports.testFlowSchema = exports.createFlowSchema = exports.copyFlowSchema = exports.publishFlowSchema = exports.viewActionSchema = exports.viewFlowSchema = exports.removeChoicesFromFieldSchema = exports.addChoicesToFieldSchema = exports.choiceValueSchema = exports.setRelatedListsSchema = exports.setFormLayoutSchema = exports.formSectionSchema = exports.setListLayoutSchema = exports.createViewSchema = void 0;
 const zod_1 = require("zod");
 exports.createViewSchema = zod_1.z.object({
     name: zod_1.z.string().min(1),
@@ -61,6 +61,13 @@ exports.addChoicesToFieldSchema = zod_1.z.object({
         .nullable()
         .optional(),
 });
+exports.removeChoicesFromFieldSchema = zod_1.z.object({
+    table: zod_1.z.string().min(1),
+    column: zod_1.z.string().min(1),
+    values: zod_1.z.array(zod_1.z.string().min(1)).min(1),
+    language: zod_1.z.string().min(1).optional(),
+    updateSetSysId: zod_1.z.string().min(1),
+});
 exports.viewFlowSchema = zod_1.z.object({
     sysId: zod_1.z.string().min(1),
     raw: zod_1.z.boolean().optional(),

package/dist/types.d.ts

@@ -54,7 +54,25 @@ export interface UpdateSetRecord {
 export interface ChoiceActionResult {
     value: string;
     label: string;
+    /**
+     * The FIRST row matching this value — `sysIds[0]`. On "created" it is the new row;
+     * on "updated" a duplicate that was already correct is left untouched, so this is
+     * not necessarily a row that was written. `sysIds` is the complete picture.
+     */
     sysId: string;
+    /**
+     * EVERY sys_choice row that matched this language::value — not only the ones written.
+     * Normally one, but sys_choice has no uniqueness constraint, so a field can hold
+     * duplicates; on "updated" only the rows that actually differ are written, and any
+     * duplicate that already matched the spec is left alone. A length > 1 is the caller's
+     * signal that the field needs cleaning up.
+     *
+     * OPTIONAL only for backwards compatibility: this type ships in a published package,
+     * and a required field would break any consumer that constructs or mocks one. The
+     * runtime always populates it — treat a missing value as "an older build produced
+     * this", not as a state addChoicesToField can return.
+     */
+    sysIds?: Array<string>;
     action: "created" | "updated" | "unchanged";
 }
 export interface AddChoicesResult {
@@ -70,6 +88,58 @@ export interface AddChoicesResult {
     };
     choices: Array<ChoiceActionResult>;
 }
+export interface RemoveChoicesParams {
+    /** Target table, e.g. "x_cadso_core_event". */
+    table: string;
+    /** Target column, e.g. "state". */
+    column: string;
+    /** Choice values to soft-delete (deactivate). */
+    values: Array<string>;
+    /** Language of the choices to deactivate. Defaults to "en". */
+    language?: string;
+    /** Update set sys_id that will capture every write. Required — no default. */
+    updateSetSysId: string;
+}
+export interface ChoiceRemovalResult {
+    value: string;
+    /**
+     * The FIRST row matching this value — `sysIds[0]`, or "" when the value was not
+     * found. Not necessarily a row that was written: when one duplicate is already
+     * inactive and another is live, only the live one is touched. `sysIds` is the
+     * complete picture.
+     */
+    sysId: string;
+    /**
+     * EVERY sys_choice row that matched this language::value; [] when missing. A field
+     * can hold more than one row for a value (sys_choice has no uniqueness constraint),
+     * and all live ones are deactivated — acting on just the first would leave the
+     * choice selectable while reporting success.
+     *
+     * Required, unlike its counterpart on ChoiceActionResult: this type is new in the
+     * remove-choices verb and has never shipped, so there is no consumer to break, and
+     * the formatter can read it without an existence guard.
+     */
+    sysIds: Array<string>;
+    /**
+     * deactivated — was active, now inactive=true.
+     * unchanged   — already inactive; nothing written (idempotent).
+     * missing     — no such value on this field.language; nothing written.
+     */
+    action: "deactivated" | "unchanged" | "missing";
+}
+export interface RemoveChoicesResult {
+    field: {
+        table: string;
+        column: string;
+        language: string;
+        dictionarySysId: string;
+    };
+    updateSet: {
+        sysId: string;
+        name: string;
+    };
+    choices: Array<ChoiceRemovalResult>;
+}
 /** Outcome of a single sys_ui_* record within a layout reconcile. */
 export type LayoutAction = "created" | "updated" | "deleted" | "unchanged";
 /** Per-record result row — one ServiceNow sys_ui_* record touched (or planned). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tenonhq/dovetail-servicenow",
-  "version": "0.0.34",
+  "version": "0.0.35",
   "engines": {
     "node": ">=22"
   },