@sonisoft/now-sdk-ext-cli 3.0.0 → 5.0.0

package/bin/credstore-boot.js

@@ -0,0 +1,67 @@
+/* eslint-disable n/no-process-exit, unicorn/no-process-exit -- this runs before
+   oclif exists, so there is no error handler to throw into; an uncaught rejection
+   here would print a stack trace instead of the remediation. */
+
+/**
+ * Opt in to headless-safe credential storage.
+ *
+ * By default `nex` uses the ServiceNow SDK exactly as it ships: credentials come
+ * from the OS keyring, `now-sdk auth --add` still manages them, and this file
+ * does nothing. That default is deliberate — `nex` must behave identically for
+ * someone who has never heard of sn-credstore.
+ *
+ * Pass `--cred-store` (or set SN_CRED_STORE_ENABLE=1) to redirect the SDK's
+ * credential storage to @sonisoft/sn-credstore instead. That matters when the
+ * keyring cannot be unlocked: over SSH, from a systemd unit, in CI, or from an
+ * agent. In those sessions `KeyChain.getPassword()` swallows the failure and
+ * returns null, so the SDK reports "Default Credential has not been set" — which
+ * is indistinguishable from genuinely having no credentials.
+ *
+ * Imported for its side effect by bin/run.js and bin/dev.js, before oclif.
+ *
+ * The import stays dynamic even though sn-credstore is now a declared
+ * dependency, because it must NOT run unless asked: importing
+ * '@sonisoft/sn-credstore/register' installs the shim as a side effect, so a
+ * static import would install it on every invocation regardless of the flag.
+ *
+ * argv is read directly rather than through oclif's parser because the shim has
+ * to be installed before AuthenticatedCommand.init() resolves credentials, and
+ * that runs before any flag this file cares about has been parsed. The flag is
+ * still declared in AuthenticatedCommand.baseFlags so it appears in --help and
+ * is not rejected as unknown.
+ */
+
+/**
+ * True when the user asked for the credential store.
+ *
+ * SN_CRED_STORE_DISABLE wins over everything, so there is always one variable
+ * that switches the shim off no matter what else is set — including in a shell
+ * where SN_CRED_STORE_ENABLE is exported globally.
+ */
+function credStoreRequested() {
+    if (process.env.SN_CRED_STORE_DISABLE) return false
+    if (process.env.SN_CRED_STORE_ENABLE) return true
+    return process.argv.includes('--cred-store')
+}
+
+if (credStoreRequested()) {
+    try {
+        await import('@sonisoft/sn-credstore/register')
+    } catch (error) {
+        // sn-credstore is a declared dependency now, so there is no "not
+        // installed" case left to tolerate — a failure here is a real failure.
+        //
+        // Continuing would silently fall back to the keyring, which is both the
+        // one thing the user just said not to do and actively unsafe: the SDK's
+        // next credential write reseeds from a failed read, wiping every other
+        // alias. Refusing to start is the safe outcome.
+        process.stderr.write(
+            `nex: the credential store failed to initialise: ${error?.message ?? error}\n` +
+                `${error?.remediation ? `\nRemediation: ${error.remediation}\n` : ''}` +
+                `\nTo run against the OS keyring instead, drop --cred-store.\n`,
+        )
+        process.exit(1)
+    }
+} else if (process.env.SN_CRED_STORE_DEBUG) {
+    process.stderr.write('nex: credential store not requested — using the SDK keyring\n')
+}

package/bin/dev.js

@@ -1,6 +1,10 @@
 #!/usr/bin/env -S node --loader ts-node/esm --disable-warning=ExperimentalWarning
 
+// FIRST, deliberately: redirect SDK credential storage off the OS keyring
+// before anything can read credentials. See bin/credstore-boot.js.
 // eslint-disable-next-line n/shebang
+import './credstore-boot.js'
+
 import {execute} from '@oclif/core'
 
 await execute({development: true, dir: import.meta.url})

package/bin/run.js

@@ -1,5 +1,9 @@
 #!/usr/bin/env node
 
+// FIRST, deliberately: redirect SDK credential storage off the OS keyring
+// before anything can read credentials. See bin/credstore-boot.js.
+import './credstore-boot.js'
+
 import {execute} from '@oclif/core'
 
 await execute({dir: import.meta.url})

package/dist/commands/auth/delete.d.ts

@@ -0,0 +1,17 @@
+import { Command } from '@oclif/core';
+export declare class AuthDelete extends Command {
+    static args: {
+        alias: import("@oclif/core/lib/interfaces/parser.js").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: {
+        command: string;
+        description: string;
+    }[];
+    static flags: {
+        all: import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
+        'cred-store': import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=delete.d.ts.map

package/dist/commands/auth/delete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/delete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAO,OAAO,EAAQ,MAAM,aAAa,CAAA;AAKhD,qBAAa,UAAW,SAAQ,OAAO;IACrC,MAAM,CAAC,IAAI;;MAEV;IACH,MAAM,CAAC,WAAW,SAEsE;IACxF,MAAM,CAAC,QAAQ;;;QAGZ;IACH,MAAM,CAAC,KAAK;;;MAGT;IAEK,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAmB3B"}

package/dist/commands/auth/delete.js

@@ -0,0 +1,34 @@
+import { Args, Command, Flags } from '@oclif/core';
+import { deleteAlias, deleteAllAliases } from '@sonisoft/sn-credstore';
+import { credStoreFlag } from '../../common/cred-store-flag.js';
+export class AuthDelete extends Command {
+    static args = {
+        alias: Args.string({ description: 'Alias to remove', required: false }),
+    };
+    static description = 'Remove a credential from the store.\n\n' +
+        'This does not touch the OS keyring — a copy stored there before migrating remains.';
+    static examples = [
+        { command: '<%= config.bin %> <%= command.id %> dev206299', description: 'Remove one alias' },
+        { command: '<%= config.bin %> <%= command.id %> --all', description: 'Remove every stored credential' },
+    ];
+    static flags = {
+        ...credStoreFlag,
+        all: Flags.boolean({ description: 'Remove every stored credential', required: false }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(AuthDelete);
+        if (flags.all) {
+            await deleteAllAliases();
+            this.log('Removed all stored credentials.');
+            return;
+        }
+        if (!args.alias) {
+            this.error('An alias is required, or --all to remove every credential.');
+        }
+        if (!(await deleteAlias(args.alias))) {
+            this.error(`No such alias "${args.alias}".`, { suggestions: ['Run "nex auth list" to see stored aliases.'] });
+        }
+        this.log(`Removed "${args.alias}".`);
+    }
+}
+//# sourceMappingURL=delete.js.map

package/dist/commands/auth/delete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.js","sourceRoot":"","sources":["../../../src/commands/auth/delete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAC,MAAM,aAAa,CAAA;AAChD,OAAO,EAAC,WAAW,EAAE,gBAAgB,EAAC,MAAM,wBAAwB,CAAA;AAEpE,OAAO,EAAC,aAAa,EAAC,MAAM,iCAAiC,CAAA;AAE7D,MAAM,OAAO,UAAW,SAAQ,OAAO;IACrC,MAAM,CAAC,IAAI,GAAG;QACZ,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAC,WAAW,EAAE,iBAAiB,EAAE,QAAQ,EAAE,KAAK,EAAC,CAAC;KACtE,CAAA;IACH,MAAM,CAAC,WAAW,GACd,yCAAyC;QACzC,oFAAoF,CAAA;IACxF,MAAM,CAAC,QAAQ,GAAG;QACd,EAAC,OAAO,EAAE,+CAA+C,EAAE,WAAW,EAAE,kBAAkB,EAAC;QAC3F,EAAC,OAAO,EAAE,2CAA2C,EAAE,WAAW,EAAE,gCAAgC,EAAC;KACtG,CAAA;IACH,MAAM,CAAC,KAAK,GAAG;QACX,GAAG,aAAa;QAChB,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,EAAC,WAAW,EAAE,gCAAgC,EAAE,QAAQ,EAAE,KAAK,EAAC,CAAC;KACrF,CAAA;IAED,KAAK,CAAC,GAAG;QACP,MAAM,EAAC,IAAI,EAAE,KAAK,EAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QAElD,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YACd,MAAM,gBAAgB,EAAE,CAAA;YACxB,IAAI,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAA;YAC3C,OAAM;QACR,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAA;QAC1E,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,KAAK,CAAC,kBAAkB,IAAI,CAAC,KAAK,IAAI,EAAE,EAAC,WAAW,EAAE,CAAC,4CAA4C,CAAC,EAAC,CAAC,CAAA;QAC7G,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,KAAK,IAAI,CAAC,CAAA;IACtC,CAAC"}

package/dist/commands/auth/doctor.d.ts

@@ -0,0 +1,23 @@
+import { Command } from '@oclif/core';
+/**
+ * Diagnose credential storage.
+ *
+ * The failure this exists for is silent: a locked keyring makes
+ * `KeyChain.getPassword()` return null, which the SDK reports as "Default
+ * Credential has not been set" — indistinguishable from having no credentials.
+ * So the first thing to report is whether the shim actually installed.
+ */
+export declare class AuthDoctor extends Command {
+    static args: {};
+    static description: string;
+    static enableJsonFlag: boolean;
+    static examples: {
+        command: string;
+        description: string;
+    }[];
+    static flags: {
+        'cred-store': import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
+    };
+    run(): Promise<unknown>;
+}
+//# sourceMappingURL=doctor.d.ts.map

package/dist/commands/auth/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,OAAO,EAAC,MAAM,aAAa,CAAA;AAKnC;;;;;;;GAOG;AACH,qBAAa,UAAW,SAAQ,OAAO;IACrC,MAAM,CAAC,IAAI,KAAK;IAChB,MAAM,CAAC,WAAW,SAC2F;IAC7G,MAAM,CAAC,cAAc,UAAO;IAC5B,MAAM,CAAC,QAAQ;;;QAGd;IACH,MAAM,CAAC,KAAK;;MAAqB;IAGzB,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;CA0D9B"}

package/dist/commands/auth/doctor.js

@@ -0,0 +1,75 @@
+import { Command } from '@oclif/core';
+import { listAliases, loadConfig, PATCHED_ENV_VAR, probeAll } from '@sonisoft/sn-credstore';
+import { credStoreFlag } from '../../common/cred-store-flag.js';
+/**
+ * Diagnose credential storage.
+ *
+ * The failure this exists for is silent: a locked keyring makes
+ * `KeyChain.getPassword()` return null, which the SDK reports as "Default
+ * Credential has not been set" — indistinguishable from having no credentials.
+ * So the first thing to report is whether the shim actually installed.
+ */
+export class AuthDoctor extends Command {
+    static args = {};
+    static description = 'Diagnose credential storage: whether the SDK shim is active, which backend is in use, and what is stored.';
+    static enableJsonFlag = true;
+    static examples = [
+        { command: '<%= config.bin %> <%= command.id %>', description: 'Check credential storage health' },
+        { command: '<%= config.bin %> <%= command.id %> --json', description: 'Machine-readable output for CI' },
+    ];
+    static flags = { ...credStoreFlag };
+    async run() {
+        await this.parse(AuthDoctor);
+        const config = loadConfig();
+        const shimActive = process.env[PATCHED_ENV_VAR] === '1';
+        const backends = await probeAll(config);
+        // listAliases reads the active backend, so it can legitimately fail (no
+        // systemd in a container, an undecryptable blob after a reimage). That is a
+        // finding to report, not a crash.
+        let summary;
+        let readError;
+        try {
+            summary = await listAliases(config);
+        }
+        catch (error) {
+            readError = error instanceof Error ? error.message : String(error);
+        }
+        const report = {
+            aliases: summary?.aliases ?? [],
+            backends,
+            path: config.blobPath,
+            shimActive,
+            store: config.store,
+            ...(readError ? { readError } : {}),
+        };
+        if (this.jsonEnabled())
+            return report;
+        this.log(`shim active   : ${shimActive ? 'yes' : 'NO'}`);
+        if (!shimActive) {
+            this.log('');
+            this.log('  The SDK is reading the OS keyring, which non-interactive sessions cannot unlock.');
+            this.log('  If this is unexpected, check that SN_CRED_STORE_DISABLE is unset.');
+        }
+        this.log(`store         : ${config.store}`);
+        this.log(`path          : ${config.blobPath}`);
+        this.log('');
+        this.log('backends:');
+        for (const backend of backends) {
+            const state = backend.available ? 'available' : 'unavailable';
+            this.log(`  ${backend.id.padEnd(14)} ${state}${backend.error ? ` — ${backend.error}` : ''}`);
+            this.log(`  ${''.padEnd(14)} ${backend.description}`);
+        }
+        this.log('');
+        if (readError) {
+            this.log(`credentials   : COULD NOT READ — ${readError}`);
+        }
+        else {
+            this.log(`credentials   : ${report.aliases.length} stored`);
+            for (const info of report.aliases) {
+                this.log(`  ${info.isDefault ? '*' : ' '} ${info.alias}  (${info.type})  ${info.instanceUrl}`);
+            }
+        }
+        return report;
+    }
+}
+//# sourceMappingURL=doctor.js.map

package/dist/commands/auth/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../../src/commands/auth/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,OAAO,EAAC,MAAM,aAAa,CAAA;AACnC,OAAO,EAAC,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,QAAQ,EAAC,MAAM,wBAAwB,CAAA;AAEzF,OAAO,EAAC,aAAa,EAAC,MAAM,iCAAiC,CAAA;AAE7D;;;;;;;GAOG;AACH,MAAM,OAAO,UAAW,SAAQ,OAAO;IACrC,MAAM,CAAC,IAAI,GAAG,EAAE,CAAA;IAChB,MAAM,CAAC,WAAW,GAChB,2GAA2G,CAAA;IAC7G,MAAM,CAAC,cAAc,GAAG,IAAI,CAAA;IAC5B,MAAM,CAAC,QAAQ,GAAG;QAChB,EAAC,OAAO,EAAE,qCAAqC,EAAE,WAAW,EAAE,iCAAiC,EAAC;QAChG,EAAC,OAAO,EAAE,4CAA4C,EAAE,WAAW,EAAE,gCAAgC,EAAC;KACvG,CAAA;IACH,MAAM,CAAC,KAAK,GAAG,EAAC,GAAG,aAAa,EAAC,CAAA;IAG/B,KAAK,CAAC,GAAG;QACP,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QAE5B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAC3B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,GAAG,CAAA;QACvD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAA;QAEvC,wEAAwE;QACxE,4EAA4E;QAC5E,kCAAkC;QAClC,IAAI,OAAO,CAAA;QACX,IAAI,SAA6B,CAAA;QACjC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACpE,CAAC;QAED,MAAM,MAAM,GAAG;YACb,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE;YAC/B,QAAQ;YACR,IAAI,EAAE,MAAM,CAAC,QAAQ;YACrB,UAAU;YACV,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAC,SAAS,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAClC,CAAA;QAED,IAAI,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,MAAM,CAAA;QAErC,IAAI,CAAC,GAAG,CAAC,mBAAmB,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACZ,IAAI,CAAC,GAAG,CAAC,oFAAoF,CAAC,CAAA;YAC9F,IAAI,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAA;QACjF,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;QAC3C,IAAI,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC9C,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACZ,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACrB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAA;YAC7D,IAAI,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAC5F,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;QACvD,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACZ,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,GAAG,CAAC,oCAAoC,SAAS,EAAE,CAAC,CAAA;QAC3D,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,MAAM,SAAS,CAAC,CAAA;YAC3D,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBAClC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;YAChG,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC"}

package/dist/commands/auth/list.d.ts

@@ -0,0 +1,15 @@
+import { Command } from '@oclif/core';
+export declare class AuthList extends Command {
+    static args: {};
+    static description: string;
+    static enableJsonFlag: boolean;
+    static examples: {
+        command: string;
+        description: string;
+    }[];
+    static flags: {
+        'cred-store': import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
+    };
+    run(): Promise<unknown>;
+}
+//# sourceMappingURL=list.d.ts.map

package/dist/commands/auth/list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,OAAO,EAAC,MAAM,aAAa,CAAA;AAKnC,qBAAa,QAAS,SAAQ,OAAO;IACnC,MAAM,CAAC,IAAI,KAAK;IAChB,MAAM,CAAC,WAAW,SAIY;IAC9B,MAAM,CAAC,cAAc,UAAO;IAC5B,MAAM,CAAC,QAAQ;;;QAGd;IACH,MAAM,CAAC,KAAK;;MAAqB;IAGzB,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;CAiC9B"}

package/dist/commands/auth/list.js

@@ -0,0 +1,42 @@
+import { Command } from '@oclif/core';
+import { listAliases } from '@sonisoft/sn-credstore';
+import { credStoreFlag } from '../../common/cred-store-flag.js';
+export class AuthList extends Command {
+    static args = {};
+    static description = 'List credentials in the headless-safe credential store.\n\n' +
+        'These are the credentials the ServiceNow SDK reads via the sn-credstore shim, ' +
+        'which works in non-interactive sessions where the OS keyring cannot be unlocked.\n\n' +
+        'Secrets are never printed.';
+    static enableJsonFlag = true;
+    static examples = [
+        { command: '<%= config.bin %> <%= command.id %>', description: 'List stored credentials' },
+        { command: '<%= config.bin %> <%= command.id %> --json', description: 'List as JSON for scripting' },
+    ];
+    static flags = { ...credStoreFlag };
+    async run() {
+        await this.parse(AuthList);
+        const summary = await listAliases();
+        if (this.jsonEnabled())
+            return summary;
+        this.log(summary.description);
+        this.log('');
+        if (summary.aliases.length === 0) {
+            this.log('No credentials stored.');
+            this.log('');
+            this.log('Import existing ones:  sn-credstore import --from keyring');
+            this.log('Or add a new one:      now-sdk-x auth --add <instance>');
+            return summary;
+        }
+        for (const info of summary.aliases) {
+            this.log(`${info.isDefault ? '*' : ' '} ${info.alias}`);
+            this.log(`      host = ${info.instanceUrl}`);
+            this.log(`      type = ${info.type}`);
+            this.log(info.type === 'basic'
+                ? `      username = ${info.username}`
+                : // Expired is not an error worth flagging red: the next use refreshes it.
+                    `      expires = ${new Date(info.expiresAt * 1000).toISOString()}${info.expired ? '  (EXPIRED — refreshes on next use)' : ''}`);
+        }
+        return summary;
+    }
+}
+//# sourceMappingURL=list.js.map

package/dist/commands/auth/list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../../../src/commands/auth/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,OAAO,EAAC,MAAM,aAAa,CAAA;AACnC,OAAO,EAAC,WAAW,EAAC,MAAM,wBAAwB,CAAA;AAElD,OAAO,EAAC,aAAa,EAAC,MAAM,iCAAiC,CAAA;AAE7D,MAAM,OAAO,QAAS,SAAQ,OAAO;IACnC,MAAM,CAAC,IAAI,GAAG,EAAE,CAAA;IAChB,MAAM,CAAC,WAAW,GAChB,6DAA6D;QAC7D,gFAAgF;QAChF,sFAAsF;QACtF,4BAA4B,CAAA;IAC9B,MAAM,CAAC,cAAc,GAAG,IAAI,CAAA;IAC5B,MAAM,CAAC,QAAQ,GAAG;QAChB,EAAC,OAAO,EAAE,qCAAqC,EAAE,WAAW,EAAE,yBAAyB,EAAC;QACxF,EAAC,OAAO,EAAE,4CAA4C,EAAE,WAAW,EAAE,4BAA4B,EAAC;KACnG,CAAA;IACH,MAAM,CAAC,KAAK,GAAG,EAAC,GAAG,aAAa,EAAC,CAAA;IAG/B,KAAK,CAAC,GAAG;QACP,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC1B,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAA;QAEnC,IAAI,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,OAAO,CAAA;QAEtC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAC7B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAEZ,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAA;YAClC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACZ,IAAI,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAA;YACrE,IAAI,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAA;YAClE,OAAO,OAAO,CAAA;QAChB,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;YACvD,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;YAC5C,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;YACrC,IAAI,CAAC,GAAG,CACN,IAAI,CAAC,IAAI,KAAK,OAAO;gBACnB,CAAC,CAAC,oBAAoB,IAAI,CAAC,QAAQ,EAAE;gBACrC,CAAC,CAAC,yEAAyE;oBACzE,mBAAmB,IAAI,IAAI,CAAC,IAAI,CAAC,SAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,GAC/D,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,EACzD,EAAE,CACP,CAAA;QACH,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC"}

package/dist/commands/auth/use.d.ts

@@ -0,0 +1,16 @@
+import { Command } from '@oclif/core';
+export declare class AuthUse extends Command {
+    static args: {
+        alias: import("@oclif/core/lib/interfaces/parser.js").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: {
+        command: string;
+        description: string;
+    }[];
+    static flags: {
+        'cred-store': import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=use.d.ts.map

package/dist/commands/auth/use.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/use.ts"],"names":[],"mappings":"AAAA,OAAO,EAAO,OAAO,EAAC,MAAM,aAAa,CAAA;AAKzC,qBAAa,OAAQ,SAAQ,OAAO;IAClC,MAAM,CAAC,IAAI;;MAEV;IACH,MAAM,CAAC,WAAW,SAE+B;IACjD,MAAM,CAAC,QAAQ;;;QAA0G;IACzH,MAAM,CAAC,KAAK;;MAAqB;IAEzB,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAS3B"}

package/dist/commands/auth/use.js

@@ -0,0 +1,20 @@
+import { Args, Command } from '@oclif/core';
+import { setDefaultAlias } from '@sonisoft/sn-credstore';
+import { credStoreFlag } from '../../common/cred-store-flag.js';
+export class AuthUse extends Command {
+    static args = {
+        alias: Args.string({ description: 'Alias to make the default', required: true }),
+    };
+    static description = 'Set the default credential alias.\n\n' +
+        'Commands run without --auth use this alias.';
+    static examples = [{ command: '<%= config.bin %> <%= command.id %> dev206299', description: 'Make dev206299 the default' }];
+    static flags = { ...credStoreFlag };
+    async run() {
+        const { args } = await this.parse(AuthUse);
+        if (!(await setDefaultAlias(args.alias))) {
+            this.error(`No such alias "${args.alias}".`, { suggestions: ['Run "nex auth list" to see stored aliases.'] });
+        }
+        this.log(`Default alias is now "${args.alias}"`);
+    }
+}
+//# sourceMappingURL=use.js.map

package/dist/commands/auth/use.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"use.js","sourceRoot":"","sources":["../../../src/commands/auth/use.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,IAAI,EAAE,OAAO,EAAC,MAAM,aAAa,CAAA;AACzC,OAAO,EAAC,eAAe,EAAC,MAAM,wBAAwB,CAAA;AAEtD,OAAO,EAAC,aAAa,EAAC,MAAM,iCAAiC,CAAA;AAE7D,MAAM,OAAO,OAAQ,SAAQ,OAAO;IAClC,MAAM,CAAC,IAAI,GAAG;QACZ,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAC,WAAW,EAAE,2BAA2B,EAAE,QAAQ,EAAE,IAAI,EAAC,CAAC;KAC/E,CAAA;IACH,MAAM,CAAC,WAAW,GACd,uCAAuC;QACvC,6CAA6C,CAAA;IACjD,MAAM,CAAC,QAAQ,GAAG,CAAC,EAAC,OAAO,EAAE,+CAA+C,EAAE,WAAW,EAAE,4BAA4B,EAAC,CAAC,CAAA;IACzH,MAAM,CAAC,KAAK,GAAG,EAAC,GAAG,aAAa,EAAC,CAAA;IAE/B,KAAK,CAAC,GAAG;QACP,MAAM,EAAC,IAAI,EAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAExC,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,KAAK,CAAC,kBAAkB,IAAI,CAAC,KAAK,IAAI,EAAE,EAAC,WAAW,EAAE,CAAC,4CAA4C,CAAC,EAAC,CAAC,CAAA;QAC7G,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,yBAAyB,IAAI,CAAC,KAAK,GAAG,CAAC,CAAA;IAClD,CAAC"}

package/dist/common/authenticated-command.d.ts

@@ -5,6 +5,7 @@ export type Args<T extends typeof Command> = Interfaces.InferredArgs<T['args']>;
 export declare abstract class AuthenticatedCommand<T extends typeof Command> extends Command {
     static baseFlags: {
         auth: Interfaces.OptionFlag<string | undefined, Interfaces.CustomOptions>;
+        'cred-store': Interfaces.BooleanFlag<boolean>;
         'log-level': Interfaces.OptionFlag<"info" | "debug" | "warn" | "error" | "trace", Interfaces.CustomOptions>;
     };
     static enableJsonFlag: boolean;
@@ -20,5 +21,14 @@ export declare abstract class AuthenticatedCommand<T extends typeof Command> ext
     }): Promise<any>;
     protected finally(_: Error | undefined): Promise<any>;
     init(): Promise<void>;
+    /**
+     * Fail with remediation the user can act on.
+     *
+     * The keyring failure mode this guards against is silent: in a non-interactive
+     * session the keyring cannot be unlocked, `KeyChain.getPassword()` swallows the
+     * error and returns null, and the SDK reports it as "no credentials" — which is
+     * indistinguishable from genuinely having none. So say which of the two it is.
+     */
+    private failAuth;
 }
 //# sourceMappingURL=authenticated-command.d.ts.map

package/dist/common/authenticated-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authenticated-command.d.ts","sourceRoot":"","sources":["../../src/common/authenticated-command.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAS,UAAU,EAAE,MAAM,aAAa,CAAA;AAExD,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAA8B,MAAM,4BAA4B,CAAC;AAMpG,MAAM,MAAM,KAAK,CAAC,CAAC,SAAS,OAAO,OAAO,IAAI,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,OAAO,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAA;AAC7H,MAAM,MAAM,IAAI,CAAC,CAAC,SAAS,OAAO,OAAO,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;AAE/E,8BAAsB,oBAAoB,CAAC,CAAC,SAAS,OAAO,OAAO,CAAE,SAAQ,OAAO;IAElF,MAAM,CAAC,SAAS;;;MASf;IAEC,MAAM,CAAC,cAAc,UAAO;IAChC,SAAS,CAAC,OAAO,EAAG,MAAM,CAAC;IACvB,SAAS,CAAC,IAAI,EAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,KAAK,EAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,SAAS,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IAEnC,IAAW,MAAM,IAAI,MAAM,CAE1B;IAED,IAAW,MAAM,CAAC,MAAM,EAAE,MAAM,EAE/B;cAEa,KAAK,CAAC,GAAG,EAAE,KAAK,GAAG;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAC,GAAG,OAAO,CAAC,GAAG,CAAC;cAQrD,OAAO,CAAC,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC;IAK9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAwCnC"}
+{"version":3,"file":"authenticated-command.d.ts","sourceRoot":"","sources":["../../src/common/authenticated-command.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAS,UAAU,EAAE,MAAM,aAAa,CAAA;AAExD,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAA8B,MAAM,4BAA4B,CAAC;AAMpG,MAAM,MAAM,KAAK,CAAC,CAAC,SAAS,OAAO,OAAO,IAAI,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,OAAO,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAA;AAC7H,MAAM,MAAM,IAAI,CAAC,CAAC,SAAS,OAAO,OAAO,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;AAE/E,8BAAsB,oBAAoB,CAAC,CAAC,SAAS,OAAO,OAAO,CAAE,SAAQ,OAAO;IAElF,MAAM,CAAC,SAAS;;;;MAmBf;IAEC,MAAM,CAAC,cAAc,UAAO;IAChC,SAAS,CAAC,OAAO,EAAG,MAAM,CAAC;IACvB,SAAS,CAAC,IAAI,EAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,KAAK,EAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,SAAS,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IAEnC,IAAW,MAAM,IAAI,MAAM,CAE1B;IAED,IAAW,MAAM,CAAC,MAAM,EAAE,MAAM,EAE/B;cAEa,KAAK,CAAC,GAAG,EAAE,KAAK,GAAG;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAC,GAAG,OAAO,CAAC,GAAG,CAAC;cAUrD,OAAO,CAAC,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC;IAK9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAuDlC;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ;CA0BjB"}

package/dist/common/authenticated-command.js

@@ -6,6 +6,16 @@ export class AuthenticatedCommand extends Command {
     //   // define flags that can be inherited by any command that extends BaseCommand
     static baseFlags = {
         'auth': Flags.string({ char: 'a', description: 'Auth alias to use.', required: false }),
+        // Declared so it appears in --help and is not rejected as unknown. It is
+        // ACTED ON in bin/credstore-boot.js, which reads argv directly: the shim has
+        // to be installed before init() resolves credentials, and that runs before
+        // oclif has parsed anything.
+        'cred-store': Flags.boolean({
+            description: 'Read credentials from @sonisoft/sn-credstore instead of the OS keyring. ' +
+                'Use this in headless sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.',
+            helpGroup: 'GLOBAL',
+            required: false,
+        }),
         'log-level': Flags.option({
             default: 'info',
             helpGroup: 'GLOBAL',
@@ -27,9 +37,11 @@ export class AuthenticatedCommand extends Command {
         this._logger = logger;
     }
     async catch(err) {
-        // add any custom logic to handle errors from the command
-        // or simply return the parent class error handling
-        this.authLogger.error("Globally caught exception occurred.", err);
+        // authLogger is assigned partway through init(), so anything that throws
+        // before that point — a missing required flag, for instance — arrived here
+        // with it still undefined and produced "Cannot read properties of undefined
+        // (reading 'error')", hiding the actual usage error behind a TypeError.
+        this.authLogger?.error("Globally caught exception occurred.", err);
         return super.catch(err);
     }
     async finally(_) {
@@ -57,21 +69,62 @@ export class AuthenticatedCommand extends Command {
         // const credential:Creds = await (flags.auth ? wrapper.getStoredCredentialsByAlias(flags.auth) : wrapper.getStoredCredentialsByAlias( 'fluent-default'));
         // const credentialArgs = {"_": "get-credentials", auth: flags.auth || "fluent-default"};
         const alias = flags.auth || "fluent-default";
-        const credential = await getCredentials(alias);
+        let credential;
+        try {
+            credential = await getCredentials(alias);
+        }
+        catch (error) {
+            // getCredentials throws for an unknown alias, but it also throws when the
+            // store itself is unreachable. Those need different remediation, and
+            // sn-credstore's errors carry their own — so pass it through rather than
+            // replacing it with a generic "check your alias".
+            this.failAuth(alias, error);
+        }
         // Never log `credential` or any object containing it (e.g. snSettings) — it
         // holds the ServiceNow password/token, and these lines run at --log-level
         // debug, which would write it to the terminal and to CI logs.
         this.authLogger.debug("Credential lookup complete.", { alias, found: Boolean(credential) });
-        if (credential) {
-            const snSettings = {
-                alias: flags.auth,
-                credential
-            };
-            this.instance = new ServiceNowInstance(snSettings);
+        if (!credential) {
+            // Previously this only logged, leaving this.instance undefined so the
+            // command failed later with an unrelated TypeError. An unusable command
+            // must not start.
+            this.failAuth(alias);
         }
-        else {
-            this.authLogger.error("Either credential not found or no credentials created.", { alias });
+        const snSettings = {
+            alias: flags.auth,
+            credential
+        };
+        this.instance = new ServiceNowInstance(snSettings);
+    }
+    /**
+     * Fail with remediation the user can act on.
+     *
+     * The keyring failure mode this guards against is silent: in a non-interactive
+     * session the keyring cannot be unlocked, `KeyChain.getPassword()` swallows the
+     * error and returns null, and the SDK reports it as "no credentials" — which is
+     * indistinguishable from genuinely having none. So say which of the two it is.
+     */
+    failAuth(alias, cause) {
+        const shimActive = process.env.NOW_SDK_KEYCHAIN_PATCHED === '1';
+        const suggestions = [
+            'Run "nex auth list" to see stored credentials.',
+            'Run "nex auth doctor" to check credential storage.',
+        ];
+        if (!shimActive) {
+            // Not necessarily wrong — the keyring is the default and works fine in a
+            // desktop session. But it is the likeliest explanation for "no credentials"
+            // when there is no terminal to unlock the keyring from, and that is exactly
+            // when nobody is around to reason it out.
+            suggestions.unshift('If this is a headless session (SSH, systemd, CI, an agent), the OS keyring cannot be ' +
+                'unlocked and will report no credentials regardless of what is stored. Pass --cred-store ' +
+                'to read from @sonisoft/sn-credstore instead.');
         }
+        // sn-credstore errors carry actionable remediation; a bare message loses it.
+        const remediation = cause?.remediation;
+        if (remediation)
+            suggestions.unshift(remediation);
+        const detail = cause instanceof Error ? cause.message : `No credentials found for alias "${alias}".`;
+        this.error(detail, { suggestions });
     }
 }
 //# sourceMappingURL=authenticated-command.js.map

package/dist/common/authenticated-command.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticated-command.js","sourceRoot":"","sources":["../../src/common/authenticated-command.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAc,MAAM,aAAa,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EAAU,kBAAkB,EAA8B,MAAM,4BAA4B,CAAC;AAEpG,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAOpD,MAAM,OAAgB,oBAA+C,SAAQ,OAAO;IACpF,kFAAkF;IAChF,MAAM,CAAC,SAAS,GAAG;QACjB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,EAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,QAAQ,EAAE,KAAK,EAAC,CAAC;QACrF,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC;YACxB,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,QAAQ;YACnB,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAU;YAC7D,OAAO,EAAE,4BAA4B;SAEtC,CAAC,EAAE;KACL,CAAA;IACH,sBAAsB;IAClB,MAAM,CAAC,cAAc,GAAG,IAAI,CAAA;IACtB,OAAO,CAAU;IACb,IAAI,CAAW;IACf,UAAU,CAAS;IACnB,KAAK,CAAY;IACrB,QAAQ,CAAqB;IAEnC,IAAW,MAAM;QACb,OAAO,IAAI,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,IAAW,MAAM,CAAC,MAAc;QAC5B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,GAAgC;QACpD,yDAAyD;QACzD,mDAAmD;QACnD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;QAElE,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACzB,CAAC;IAES,KAAK,CAAC,OAAO,CAAC,CAAoB;QAC1C,8EAA8E;QAC9E,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IACzB,CAAC;IAEM,KAAK,CAAC,IAAI;QACf,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,EAAC,IAAI,EAAE,KAAK,EAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;YACrC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YACpB,SAAS,EAAG,KAAK,CAAC,IAAoC,CAAC,SAAS;YAChE,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc;YACxC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;YACtB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;SACzB,CAAC,CAAA;QAEF,IAAI,CAAC,KAAK,GAAG,KAAiB,CAAA;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAe,CAAA;QAE3B,6EAA6E;QAC7E,uEAAuE;QACvE,uDAAuD;QACvD,MAAM,QAAQ,GAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAwB,IAAI,MAAM,CAAC;QAC3E,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,YAAY,CAAC,sBAAsB,EAAE,QAAQ,CAAC,CAAC;QAC5E,6DAA6D;QAC7D,0JAA0J;QAC1J,yFAAyF;QAEzF,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,IAAI,gBAAgB,CAAC;QAC7C,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;QAC/C,4EAA4E;QAC5E,0EAA0E;QAC1E,8DAA8D;QAC9D,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,EAAC,CAAC,CAAC;QAC1F,IAAG,UAAU,EAAC,CAAC;YACZ,MAAM,UAAU,GAA8B;gBACzC,KAAK,EAAE,KAAK,CAAC,IAAI;gBAClB,UAAU;aACZ,CAAA;YACD,IAAI,CAAC,QAAQ,GAAG,IAAI,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACvD,CAAC;aAAI,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,wDAAwD,EAAE,EAAC,KAAK,EAAC,CAAC,CAAC;QAC7F,CAAC;IAEH,CAAC"}
+{"version":3,"file":"authenticated-command.js","sourceRoot":"","sources":["../../src/common/authenticated-command.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAc,MAAM,aAAa,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EAAU,kBAAkB,EAA8B,MAAM,4BAA4B,CAAC;AAEpG,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAOpD,MAAM,OAAgB,oBAA+C,SAAQ,OAAO;IACpF,kFAAkF;IAChF,MAAM,CAAC,SAAS,GAAG;QACjB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,EAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,QAAQ,EAAE,KAAK,EAAC,CAAC;QACrF,yEAAyE;QACzE,6EAA6E;QAC7E,2EAA2E;QAC3E,6BAA6B;QAC7B,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC;YAC1B,WAAW,EAAE,0EAA0E;gBACrF,gGAAgG;YAClG,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,KAAK;SAChB,CAAC;QACF,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC;YACxB,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,QAAQ;YACnB,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAU;YAC7D,OAAO,EAAE,4BAA4B;SAEtC,CAAC,EAAE;KACL,CAAA;IACH,sBAAsB;IAClB,MAAM,CAAC,cAAc,GAAG,IAAI,CAAA;IACtB,OAAO,CAAU;IACb,IAAI,CAAW;IACf,UAAU,CAAS;IACnB,KAAK,CAAY;IACrB,QAAQ,CAAqB;IAEnC,IAAW,MAAM;QACb,OAAO,IAAI,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,IAAW,MAAM,CAAC,MAAc;QAC5B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,GAAgC;QACpD,yEAAyE;QACzE,2EAA2E;QAC3E,4EAA4E;QAC5E,wEAAwE;QACxE,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;QAEnE,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACzB,CAAC;IAES,KAAK,CAAC,OAAO,CAAC,CAAoB;QAC1C,8EAA8E;QAC9E,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IACzB,CAAC;IAEM,KAAK,CAAC,IAAI;QACf,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,EAAC,IAAI,EAAE,KAAK,EAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;YACrC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YACpB,SAAS,EAAG,KAAK,CAAC,IAAoC,CAAC,SAAS;YAChE,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc;YACxC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;YACtB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;SACzB,CAAC,CAAA;QAEF,IAAI,CAAC,KAAK,GAAG,KAAiB,CAAA;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAe,CAAA;QAE3B,6EAA6E;QAC7E,uEAAuE;QACvE,uDAAuD;QACvD,MAAM,QAAQ,GAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAwB,IAAI,MAAM,CAAC;QAC3E,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,YAAY,CAAC,sBAAsB,EAAE,QAAQ,CAAC,CAAC;QAC5E,6DAA6D;QAC7D,0JAA0J;QAC1J,yFAAyF;QAEzF,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,IAAI,gBAAgB,CAAC;QAE7C,IAAI,UAAU,CAAC;QACf,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0EAA0E;YAC1E,qEAAqE;YACrE,yEAAyE;YACzE,kDAAkD;YAClD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;QAED,4EAA4E;QAC5E,0EAA0E;QAC1E,8DAA8D;QAC9D,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,EAAC,CAAC,CAAC;QAE1F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,sEAAsE;YACtE,wEAAwE;YACxE,kBAAkB;YAClB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QAED,MAAM,UAAU,GAA+B;YAC7C,KAAK,EAAE,KAAK,CAAC,IAAI;YACjB,UAAU;SACX,CAAA;QACD,IAAI,CAAC,QAAQ,GAAG,IAAI,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;OAOG;IACK,QAAQ,CAAC,KAAa,EAAE,KAAe;QAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,GAAG,CAAC;QAChE,MAAM,WAAW,GAAG;YAClB,gDAAgD;YAChD,oDAAoD;SACrD,CAAC;QAEF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,yEAAyE;YACzE,4EAA4E;YAC5E,4EAA4E;YAC5E,0CAA0C;YAC1C,WAAW,CAAC,OAAO,CACjB,uFAAuF;gBACvF,0FAA0F;gBAC1F,8CAA8C,CAC/C,CAAC;QACJ,CAAC;QAED,6EAA6E;QAC7E,MAAM,WAAW,GAAI,KAA4C,EAAE,WAAW,CAAC;QAC/E,IAAI,WAAW;YAAE,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAElD,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,mCAAmC,KAAK,IAAI,CAAC;QACrG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAC,WAAW,EAAC,CAAC,CAAC;IACpC,CAAC"}

package/dist/common/cred-store-flag.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `--cred-store`, accepted and ignored.
+ *
+ * The `auth` commands always operate on the sn-credstore store — that is what
+ * they are for — so the flag is redundant on them. But it is a global flag on
+ * every authenticated command, and people reasonably type it here too. Rejecting
+ * it with "Nonexistent flag: --cred-store" reads like the feature is missing
+ * rather than already implied.
+ *
+ * Declared, not acted on. The one place it has an effect is
+ * bin/credstore-boot.js, which reads process.argv directly because the shim must
+ * be installed before oclif parses anything.
+ */
+export declare const credStoreFlag: {
+    'cred-store': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+};
+//# sourceMappingURL=cred-store-flag.d.ts.map

package/dist/common/cred-store-flag.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cred-store-flag.d.ts","sourceRoot":"","sources":["../../src/common/cred-store-flag.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa;;CAQzB,CAAA"}

package/dist/common/cred-store-flag.js

@@ -0,0 +1,23 @@
+import { Flags } from '@oclif/core';
+/**
+ * `--cred-store`, accepted and ignored.
+ *
+ * The `auth` commands always operate on the sn-credstore store — that is what
+ * they are for — so the flag is redundant on them. But it is a global flag on
+ * every authenticated command, and people reasonably type it here too. Rejecting
+ * it with "Nonexistent flag: --cred-store" reads like the feature is missing
+ * rather than already implied.
+ *
+ * Declared, not acted on. The one place it has an effect is
+ * bin/credstore-boot.js, which reads process.argv directly because the shim must
+ * be installed before oclif parses anything.
+ */
+export const credStoreFlag = {
+    'cred-store': Flags.boolean({
+        description: 'Accepted for symmetry with other commands and ignored — the auth commands always ' +
+            'use @sonisoft/sn-credstore.',
+        helpGroup: 'GLOBAL',
+        required: false,
+    }),
+};
+//# sourceMappingURL=cred-store-flag.js.map

package/dist/common/cred-store-flag.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cred-store-flag.js","sourceRoot":"","sources":["../../src/common/cred-store-flag.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,KAAK,EAAC,MAAM,aAAa,CAAA;AAEjC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC;QAC1B,WAAW,EACT,mFAAmF;YACnF,6BAA6B;QAC/B,SAAS,EAAE,QAAQ;QACnB,QAAQ,EAAE,KAAK;KAChB,CAAC;CACH,CAAA"}

package/dist/common/scope-autocomplete.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-autocomplete.d.ts","sourceRoot":"","sources":["../../src/common/scope-autocomplete.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AA6BD;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,GAAE,MAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAsDvG;AAQD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,GAAE,MAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAY3G"}
+{"version":3,"file":"scope-autocomplete.d.ts","sourceRoot":"","sources":["../../src/common/scope-autocomplete.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AA6BD;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,GAAE,MAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAiEvG;AAQD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,GAAE,MAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAY3G"}

package/dist/common/scope-autocomplete.js

@@ -26,6 +26,14 @@ export async function queryScopes(authAlias, prefix = '') {
         // Get credentials
         const credential = await getCredentials(authAlias || "fluent-default");
         if (!credential) {
+            // Returning no completions is the only sane behaviour here — a shell
+            // completion hook cannot print an error without corrupting the candidate
+            // list. But "no scopes" and "credentials unreadable" look identical, so
+            // leave a breadcrumb for anyone debugging why completion went quiet.
+            if (process.env.SN_CRED_STORE_DEBUG) {
+                process.stderr.write(`[nex] scope completion: no credentials for "${authAlias || 'fluent-default'}"` +
+                    `${process.env.NOW_SDK_KEYCHAIN_PATCHED === '1' ? '' : ' (credential shim NOT active)'}\n`);
+            }
             return [];
         }
         // Create ServiceNow instance

package/dist/common/scope-autocomplete.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-autocomplete.js","sourceRoot":"","sources":["../../src/common/scope-autocomplete.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAA8B,MAAM,4BAA4B,CAAC;AAgB5F;;;;;GAKG;AACH,SAAS,aAAa,CAAC,UAAiB,EAAE,QAAgB;IACxD,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,UAAU,IAAI,UAAU,EAAE,CAAC;QAC5D,OAAO,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IACzF,CAAC;IAEF,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,cAAc,IAAI,UAAU,EAAE,CAAC;QAC/D,OAAO,UAAU,UAAU,CAAC,YAAY,EAAE,CAAC;IAC7C,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,SAA6B,EAAE,SAAiB,EAAE;IAClF,IAAI,CAAC;QACH,kBAAkB;QAElB,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,SAAS,IAAI,gBAAgB,CAAC,CAAC;QAEvE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,6BAA6B;QAC7B,MAAM,UAAU,GAA+B;YAC7C,KAAK,EAAE,SAAS;YAChB,UAAU;SACX,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAEpD,qCAAqC;QACrC,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC;QAC5D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,cAAc,EAAE,YAAY;YAC5B,aAAa,EAAE,IAAI;YACnB,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,kBAAkB,MAAM,oBAAoB,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;SAClF,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE;YAC1D,OAAO,EAAE;gBACP,QAAQ,EAAE,kBAAkB;gBAC5B,eAAe,EAAE,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAClE,cAAc,EAAE,kBAAkB;aACnC;YACD,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAsB,CAAC;QACvD,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,IAAI,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACjB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;QACjC,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,GAAG,IAAI,GAAG,EAAmD,CAAC;AAC9E,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAE7C;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAA6B,EAAE,SAAiB,EAAE;IACtF,MAAM,QAAQ,GAAG,GAAG,SAAS,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;IACvD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAExC,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,SAAS,EAAE,CAAC;QAC1D,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACpD,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAE5D,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"scope-autocomplete.js","sourceRoot":"","sources":["../../src/common/scope-autocomplete.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAA8B,MAAM,4BAA4B,CAAC;AAgB5F;;;;;GAKG;AACH,SAAS,aAAa,CAAC,UAAiB,EAAE,QAAgB;IACxD,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,UAAU,IAAI,UAAU,EAAE,CAAC;QAC5D,OAAO,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IACzF,CAAC;IAEF,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,cAAc,IAAI,UAAU,EAAE,CAAC;QAC/D,OAAO,UAAU,UAAU,CAAC,YAAY,EAAE,CAAC;IAC7C,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,SAA6B,EAAE,SAAiB,EAAE;IAClF,IAAI,CAAC;QACH,kBAAkB;QAElB,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,SAAS,IAAI,gBAAgB,CAAC,CAAC;QAEvE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,qEAAqE;YACrE,yEAAyE;YACzE,wEAAwE;YACxE,qEAAqE;YACrE,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;gBACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+CAA+C,SAAS,IAAI,gBAAgB,GAAG;oBAC7E,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,+BAA+B,IAAI,CAC7F,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,6BAA6B;QAC7B,MAAM,UAAU,GAA+B;YAC7C,KAAK,EAAE,SAAS;YAChB,UAAU;SACX,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAEpD,qCAAqC;QACrC,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC;QAC5D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,cAAc,EAAE,YAAY;YAC5B,aAAa,EAAE,IAAI;YACnB,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,kBAAkB,MAAM,oBAAoB,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;SAClF,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE;YAC1D,OAAO,EAAE;gBACP,QAAQ,EAAE,kBAAkB;gBAC5B,eAAe,EAAE,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAClE,cAAc,EAAE,kBAAkB;aACnC;YACD,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAsB,CAAC;QACvD,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,IAAI,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACjB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;QACjC,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,GAAG,IAAI,GAAG,EAAmD,CAAC;AAC9E,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAE7C;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAA6B,EAAE,SAAiB,EAAE;IACtF,MAAM,QAAQ,GAAG,GAAG,SAAS,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;IACvD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAExC,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,SAAS,EAAE,CAAC;QAC1D,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACpD,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAE5D,OAAO,MAAM,CAAC;AAChB,CAAC"}