npm - @sonisoft/now-sdk-ext-cli - Versions diffs - 3.0.0 → 5.0.1 - Mend

@sonisoft/now-sdk-ext-cli 3.0.0 → 5.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (35) hide show

package/README.md +500 -164
package/bin/argv-guard.js +25 -0
package/bin/argv-secrets.js +103 -0
package/bin/credstore-boot.js +67 -0
package/bin/dev.js +8 -0
package/bin/run.js +8 -0
package/dist/commands/auth/delete.d.ts +17 -0
package/dist/commands/auth/delete.d.ts.map +1 -0
package/dist/commands/auth/delete.js +34 -0
package/dist/commands/auth/delete.js.map +1 -0
package/dist/commands/auth/doctor.d.ts +23 -0
package/dist/commands/auth/doctor.d.ts.map +1 -0
package/dist/commands/auth/doctor.js +87 -0
package/dist/commands/auth/doctor.js.map +1 -0
package/dist/commands/auth/list.d.ts +15 -0
package/dist/commands/auth/list.d.ts.map +1 -0
package/dist/commands/auth/list.js +42 -0
package/dist/commands/auth/list.js.map +1 -0
package/dist/commands/auth/use.d.ts +16 -0
package/dist/commands/auth/use.d.ts.map +1 -0
package/dist/commands/auth/use.js +20 -0
package/dist/commands/auth/use.js.map +1 -0
package/dist/common/authenticated-command.d.ts +10 -0
package/dist/common/authenticated-command.d.ts.map +1 -1
package/dist/common/authenticated-command.js +65 -12
package/dist/common/authenticated-command.js.map +1 -1
package/dist/common/cred-store-flag.d.ts +17 -0
package/dist/common/cred-store-flag.d.ts.map +1 -0
package/dist/common/cred-store-flag.js +23 -0
package/dist/common/cred-store-flag.js.map +1 -0
package/dist/common/scope-autocomplete.d.ts.map +1 -1
package/dist/common/scope-autocomplete.js +8 -0
package/dist/common/scope-autocomplete.js.map +1 -1
package/oclif.manifest.json +1550 -825
package/package.json +3 -2

package/README.md CHANGED Viewed

@@ -211,6 +211,54 @@ now-sdk auth --list
 **Note**: Credentials configured via `now-sdk auth` are automatically available to `nex` commands through the `--auth` flag.
+#### Headless and non-interactive use
+`now-sdk` stores credentials in the OS keyring, which a non-interactive session
+cannot unlock — even running as the same user. Worse, the failure is silent: the
+SDK's `KeyChain.getPassword()` swallows the error and returns `null`, so you get
+`Default Credential has not been set` rather than a keyring error.
+If you run `nex` over SSH, from a systemd service, from CI, or from an AI agent,
+install [`@sonisoft/sn-credstore`](https://github.com/sonisoft-cnanda/sn-credstore)
+and pass `--cred-store`. The SDK then reads from a headless-safe store that many
+concurrent processes can share:
+```bash
+npm install -g @sonisoft/sn-credstore
+# One-time migration of existing keyring credentials.
+# Run this from a desktop session — the keyring will prompt to unlock.
+sn-credstore import --from keyring
+nex auth doctor                                    # confirm what is where
+nex aggregate count --table incident --auth my-dev-instance --cred-store
+```
+**This is opt-in.** Without `--cred-store`, `nex` uses the ServiceNow SDK's OS
+keyring exactly as it always has, whether or not sn-credstore is installed. To
+opt in for a whole session instead of per command, export
+`SN_CRED_STORE_ENABLE=1`.
+By default the store is encrypted with `systemd-creds --user`, which binds it to
+this host. Containers without systemd should set `SN_CRED_STORE=file`.
+| Variable | Description |
+|---|---|
+| `SN_CRED_STORE_ENABLE` | Opt in without passing `--cred-store` on every command |
+| `SN_CRED_STORE_DISABLE` | Hard off switch; wins over the flag and everything else |
+| `SN_CRED_STORE` | Backend: `systemd-creds` (default), `file`, or `auto` |
+| `SN_CRED_STORE_PATH` | Override the store location |
+| `SN_CRED_STORE_DEBUG` | Verbose diagnostics on stderr |
+#### Managing stored credentials
+```bash
+nex auth list                # list aliases (secrets are never printed)
+nex auth use my-dev-instance # set the default alias
+nex auth delete old-alias    # remove one alias
+nex auth doctor              # diagnose credential storage
+```
 ### 2. Run Your First Command
 ```bash
@@ -500,6 +548,8 @@ nex bulk update --table incident --query "state=7" --data '{"active":"false"}' -
 * [Add credentials (interactive - will prompt for username/password)](#add-credentials-interactive---will-prompt-for-usernamepassword)
 * [Set as default (optional)](#set-as-default-optional)
 * [List configured authentication profiles](#list-configured-authentication-profiles)
+* [One-time migration of existing keyring credentials.](#one-time-migration-of-existing-keyring-credentials)
+* [Run this from a desktop session — the keyring will prompt to unlock.](#run-this-from-a-desktop-session--the-keyring-will-prompt-to-unlock)
 * [Start interactive REPL](#start-interactive-repl)
 * [Execute an ATF test](#execute-an-atf-test)
 * [List repository applications](#list-repository-applications)
@@ -639,7 +689,7 @@ $ npm install -g @sonisoft/now-sdk-ext-cli
 $ nex COMMAND
 running command...
 $ nex (--version)
-@sonisoft/now-sdk-ext-cli/3.0.0 linux-x64 node-v26.5.0
+@sonisoft/now-sdk-ext-cli/5.0.1 linux-x64 node-v26.5.0
 $ nex --help [COMMAND]
 USAGE
   $ nex COMMAND
@@ -661,6 +711,10 @@ USAGE
 * [`nex attachment get`](#nex-attachment-get)
 * [`nex attachment list`](#nex-attachment-list)
 * [`nex attachment upload`](#nex-attachment-upload)
+* [`nex auth delete [ALIAS]`](#nex-auth-delete-alias)
+* [`nex auth doctor`](#nex-auth-doctor)
+* [`nex auth list`](#nex-auth-list)
+* [`nex auth use ALIAS`](#nex-auth-use-alias)
 * [`nex autocomplete [SHELL]`](#nex-autocomplete-shell)
 * [`nex batch create`](#nex-batch-create)
 * [`nex batch update`](#nex-batch-update)
@@ -735,7 +789,8 @@ Count records in a ServiceNow table.
 ```
 USAGE
-  $ nex aggregate count -t <value> [-j] [-a <value>] [--log-level debug|warn|error|info|trace] [-q <value>]
+  $ nex aggregate count -t <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-q
+    <value>]
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -744,6 +799,8 @@ FLAGS
   -t, --table=<value>  (required) ServiceNow table name to count records in
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -771,7 +828,7 @@ EXAMPLES
     $ nex aggregate count --table incident --query "active=true" --json --auth dev
 ```
-_See code: [src/commands/aggregate/count.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/aggregate/count.ts)_
+_See code: [src/commands/aggregate/count.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/aggregate/count.ts)_
 ## `nex aggregate group`
@@ -779,8 +836,9 @@ Run a grouped aggregate query on a ServiceNow table.
 ```
 USAGE
-  $ nex aggregate group -t <value> -g <value>... [-j] [-a <value>] [--log-level debug|warn|error|info|trace] [-q
-    <value>] [-c] [--avg <value>...] [--min <value>...] [--max <value>...] [--sum <value>...] [--having <value>] [-d]
+  $ nex aggregate group -t <value> -g <value>... [-j] [-a <value>] [--cred-store] [--log-level
+    debug|warn|error|info|trace] [-q <value>] [-c] [--avg <value>...] [--min <value>...] [--max <value>...] [--sum
+    <value>...] [--having <value>] [-d]
 FLAGS
   -a, --auth=<value>         Auth alias to use.
@@ -797,6 +855,8 @@ FLAGS
       --sum=<value>...       Comma-separated field names to compute SUM on per group
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -828,7 +888,7 @@ EXAMPLES
     $ nex aggregate group --table incident --group-by priority --count --having "count>10" --auth dev
 ```
-_See code: [src/commands/aggregate/group.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/aggregate/group.ts)_
+_See code: [src/commands/aggregate/group.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/aggregate/group.ts)_
 ## `nex aggregate query`
@@ -836,8 +896,8 @@ Run aggregate statistics on a ServiceNow table.
 ```
 USAGE
-  $ nex aggregate query -t <value> [-j] [-a <value>] [--log-level debug|warn|error|info|trace] [-q <value>] [-c]
-    [--avg <value>...] [--min <value>...] [--max <value>...] [--sum <value>...]
+  $ nex aggregate query -t <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-q
+    <value>] [-c] [--avg <value>...] [--min <value>...] [--max <value>...] [--sum <value>...]
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -851,6 +911,8 @@ FLAGS
       --sum=<value>...  Comma-separated field names to compute SUM on
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -880,7 +942,7 @@ EXAMPLES
     $ nex aggregate query --table incident --sum reassignment_count --json --auth dev
 ```
-_See code: [src/commands/aggregate/query.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/aggregate/query.ts)_
+_See code: [src/commands/aggregate/query.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/aggregate/query.ts)_
 ## `nex app`
@@ -888,7 +950,8 @@ Manage ServiceNow applications: uninstall applications from your instance.
 ```
 USAGE
-  $ nex app [--json] [-a <value>] [--log-level debug|warn|error|info|trace] [-u] [-i <value>] [-s <value>]
+  $ nex app [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-u] [-i
+    <value>] [-s <value>]
 FLAGS
   -a, --auth=<value>           Auth alias to use.
@@ -897,6 +960,8 @@ FLAGS
   -u, --uninstall              Uninstall the app
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -932,7 +997,7 @@ EXAMPLES
     $ nex app -u -i a1b2c3d4e5f6 -s x_my_custom_app -a dev-instance
 ```
-_See code: [src/commands/app/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/app/index.ts)_
+_See code: [src/commands/app/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/app/index.ts)_
 ## `nex app install`
@@ -940,7 +1005,8 @@ Install or upgrade multiple ServiceNow applications from a batch definition file
 ```
 USAGE
-  $ nex app install [--json] [-a <value>] [--log-level debug|warn|error|info|trace] [-b] [-d <value>]
+  $ nex app install [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-b] [-d
+    <value>]
 FLAGS
   -a, --auth=<value>            Auth alias to use.
@@ -948,6 +1014,8 @@ FLAGS
   -d, --definitionPath=<value>  Path to JSON batch definition file containing applications to install
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -989,7 +1057,7 @@ EXAMPLES
     $ nex app install -b -d ./apps.json -a dev-instance --log-level debug
 ```
-_See code: [src/commands/app/install.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/app/install.ts)_
+_See code: [src/commands/app/install.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/app/install.ts)_
 ## `nex app repo-install`
@@ -997,8 +1065,8 @@ Install an application from your ServiceNow company repository.
 ```
 USAGE
-  $ nex app repo-install -s <value> [--json] [-a <value>] [--log-level debug|warn|error|info|trace] [-w]
-    [--poll-interval <value>] [-t <value>] [-v <value>]
+  $ nex app repo-install -s <value> [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
+    [-w] [--poll-interval <value>] [-t <value>] [-v <value>]
 FLAGS
   -a, --auth=<value>           Auth alias to use.
@@ -1009,6 +1077,8 @@ FLAGS
       --poll-interval=<value>  [default: 5000] Polling interval in milliseconds (default: 5000)
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -1063,7 +1133,7 @@ EXAMPLES
     $ nex app repo-install -s x_my_app -a dev-instance --log-level debug
 ```
-_See code: [src/commands/app/repo-install.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/app/repo-install.ts)_
+_See code: [src/commands/app/repo-install.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/app/repo-install.ts)_
 ## `nex app repo-list`
@@ -1071,7 +1141,7 @@ List applications available in your ServiceNow company repository.
 ```
 USAGE
-  $ nex app repo-list [-j] [-a <value>] [--log-level debug|warn|error|info|trace] [-n] [-i]
+  $ nex app repo-list [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-n] [-i]
 FLAGS
   -a, --auth=<value>  Auth alias to use.
@@ -1080,6 +1150,8 @@ FLAGS
   -n, --installable   Show only applications that can be installed (not yet installed)
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -1127,7 +1199,7 @@ EXAMPLES
     $ nex app repo-list -a dev-instance
 ```
-_See code: [src/commands/app/repo-list.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/app/repo-list.ts)_
+_See code: [src/commands/app/repo-list.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/app/repo-list.ts)_
 ## `nex app uninstall`
@@ -1135,7 +1207,8 @@ Uninstall a ServiceNow application from your instance.
 ```
 USAGE
-  $ nex app uninstall -i <value> -s <value> [--json] [-a <value>] [--log-level debug|warn|error|info|trace]
+  $ nex app uninstall -i <value> -s <value> [--json] [-a <value>] [--cred-store] [--log-level
+    debug|warn|error|info|trace]
 FLAGS
   -a, --auth=<value>           Auth alias to use.
@@ -1143,6 +1216,8 @@ FLAGS
   -s, --scope=<value>          (required) Scope of application
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -1178,7 +1253,7 @@ EXAMPLES
     $ nex app uninstall -i a1b2c3d4e5f6 -s x_my_custom_app -a dev-instance
 ```
-_See code: [src/commands/app/uninstall.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/app/uninstall.ts)_
+_See code: [src/commands/app/uninstall.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/app/uninstall.ts)_
 ## `nex atf`
@@ -1186,9 +1261,9 @@ Execute ATF (Automated Test Framework) tests or test suites on a ServiceNow inst
 ```
 USAGE
-  $ nex atf [-j] [-a <value>] [--log-level debug|warn|error|info|trace] [-t <value> | -s <value> | -n
-    <value>] [-w] [-p <value>] [-b <value>] [--browser-version <value>] [--os-name <value>] [--os-version <value>]
-    [--performance] [--cloud]
+  $ nex atf [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-t <value> | -s
+    <value> | -n <value>] [-w] [-p <value>] [-b <value>] [--browser-version <value>] [--os-name <value>] [--os-version
+    <value>] [--performance] [--cloud]
 FLAGS
   -a, --auth=<value>             Auth alias to use.
@@ -1206,6 +1281,8 @@ FLAGS
       --performance              Run as performance test
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -1250,7 +1327,7 @@ EXAMPLES
     $ nex atf --suite-id e077e00b83103210621e78c6feaad383 --poll-interval 10000 --auth dev-instance
 ```
-_See code: [src/commands/atf/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/atf/index.ts)_
+_See code: [src/commands/atf/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/atf/index.ts)_
 ## `nex attachment get`
@@ -1258,13 +1335,15 @@ Get metadata for a specific attachment.
 ```
 USAGE
-  $ nex attachment get -s <value> [--json] [-a <value>] [--log-level debug|warn|error|info|trace]
+  $ nex attachment get -s <value> [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
 FLAGS
   -a, --auth=<value>    Auth alias to use.
   -s, --sys-id=<value>  (required) Sys ID of the attachment
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -1282,7 +1361,7 @@ EXAMPLES
     $ nex attachment get -s att123 --json --auth dev
 ```
-_See code: [src/commands/attachment/get.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/attachment/get.ts)_
+_See code: [src/commands/attachment/get.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/attachment/get.ts)_
 ## `nex attachment list`
@@ -1290,8 +1369,8 @@ List attachments on a ServiceNow record.
 ```
 USAGE
-  $ nex attachment list -r <value> -t <value> [--json] [-a <value>] [--log-level debug|warn|error|info|trace]
-    [--limit <value>]
+  $ nex attachment list -r <value> -t <value> [--json] [-a <value>] [--cred-store] [--log-level
+    debug|warn|error|info|trace] [--limit <value>]
 FLAGS
   -a, --auth=<value>       Auth alias to use.
@@ -1300,6 +1379,8 @@ FLAGS
       --limit=<value>      [default: 20] Maximum number of attachments to return
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -1317,7 +1398,7 @@ EXAMPLES
     $ nex attachment list -t incident -r abc123 --limit 50 --json --auth dev
 ```
-_See code: [src/commands/attachment/list.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/attachment/list.ts)_
+_See code: [src/commands/attachment/list.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/attachment/list.ts)_
 ## `nex attachment upload`
@@ -1325,7 +1406,7 @@ Upload a file as an attachment to a ServiceNow record.
 ```
 USAGE
-  $ nex attachment upload -f <value> -r <value> -t <value> [--json] [-a <value>] [--log-level
+  $ nex attachment upload -f <value> -r <value> -t <value> [--json] [-a <value>] [--cred-store] [--log-level
     debug|warn|error|info|trace] [--content-type <value>]
 FLAGS
@@ -1336,6 +1417,8 @@ FLAGS
       --content-type=<value>  MIME content type of the file
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -1353,7 +1436,131 @@ EXAMPLES
     $ nex attachment upload -t incident -r abc123 -f ./data.csv --content-type text/csv --auth dev
 ```
-_See code: [src/commands/attachment/upload.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/attachment/upload.ts)_
+_See code: [src/commands/attachment/upload.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/attachment/upload.ts)_
+## `nex auth delete [ALIAS]`
+Remove a credential from the store.
+```
+USAGE
+  $ nex auth delete [ALIAS] [--cred-store] [--all]
+ARGUMENTS
+  [ALIAS]  Alias to remove
+FLAGS
+  --all  Remove every stored credential
+GLOBAL FLAGS
+  --cred-store  Accepted for symmetry with other commands and ignored — the auth commands always use
+                @sonisoft/sn-credstore.
+DESCRIPTION
+  Remove a credential from the store.
+  This does not touch the OS keyring — a copy stored there before migrating remains.
+EXAMPLES
+  Remove one alias
+    $ nex auth delete dev206299
+  Remove every stored credential
+    $ nex auth delete --all
+```
+_See code: [src/commands/auth/delete.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/auth/delete.ts)_
+## `nex auth doctor`
+Diagnose credential storage: whether the SDK shim is active, which backend is in use, and what is stored.
+```
+USAGE
+  $ nex auth doctor [--json] [--cred-store]
+GLOBAL FLAGS
+  --cred-store  Accepted for symmetry with other commands and ignored — the auth commands always use
+                @sonisoft/sn-credstore.
+  --json        Format output as json.
+DESCRIPTION
+  Diagnose credential storage: whether the SDK shim is active, which backend is in use, and what is stored.
+EXAMPLES
+  Check credential storage health
+    $ nex auth doctor
+  Machine-readable output for CI
+    $ nex auth doctor --json
+```
+_See code: [src/commands/auth/doctor.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/auth/doctor.ts)_
+## `nex auth list`
+List credentials in the headless-safe credential store.
+```
+USAGE
+  $ nex auth list [--json] [--cred-store]
+GLOBAL FLAGS
+  --cred-store  Accepted for symmetry with other commands and ignored — the auth commands always use
+                @sonisoft/sn-credstore.
+  --json        Format output as json.
+DESCRIPTION
+  List credentials in the headless-safe credential store.
+  These are the credentials the ServiceNow SDK reads via the sn-credstore shim, which works in non-interactive sessions
+  where the OS keyring cannot be unlocked.
+  Secrets are never printed.
+EXAMPLES
+  List stored credentials
+    $ nex auth list
+  List as JSON for scripting
+    $ nex auth list --json
+```
+_See code: [src/commands/auth/list.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/auth/list.ts)_
+## `nex auth use ALIAS`
+Set the default credential alias.
+```
+USAGE
+  $ nex auth use ALIAS [--cred-store]
+ARGUMENTS
+  ALIAS  Alias to make the default
+GLOBAL FLAGS
+  --cred-store  Accepted for symmetry with other commands and ignored — the auth commands always use
+                @sonisoft/sn-credstore.
+DESCRIPTION
+  Set the default credential alias.
+  Commands run without --auth use this alias.
+EXAMPLES
+  Make dev206299 the default
+    $ nex auth use dev206299
+```
+_See code: [src/commands/auth/use.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/auth/use.ts)_
 ## `nex autocomplete [SHELL]`
@@ -1392,7 +1599,8 @@ Batch create records on a ServiceNow instance from a JSON file.
 ```
 USAGE
-  $ nex batch create -f <value> [--json] [-a <value>] [--log-level debug|warn|error|info|trace] [--transaction]
+  $ nex batch create -f <value> [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
+    [--transaction]
 FLAGS
   -a, --auth=<value>  Auth alias to use.
@@ -1400,6 +1608,8 @@ FLAGS
       --transaction   Stop on first error (transactional)
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -1417,7 +1627,7 @@ EXAMPLES
     $ nex batch create --file ./records.json --no-transaction --auth dev
 ```
-_See code: [src/commands/batch/create.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/batch/create.ts)_
+_See code: [src/commands/batch/create.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/batch/create.ts)_
 ## `nex batch update`
@@ -1425,7 +1635,8 @@ Batch update records on a ServiceNow instance from a JSON file.
 ```
 USAGE
-  $ nex batch update -f <value> [--json] [-a <value>] [--log-level debug|warn|error|info|trace] [--stop-on-error]
+  $ nex batch update -f <value> [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
+    [--stop-on-error]
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -1433,6 +1644,8 @@ FLAGS
       --stop-on-error  Stop processing on first error
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -1450,7 +1663,7 @@ EXAMPLES
     $ nex batch update --file ./updates.json --stop-on-error --auth dev
 ```
-_See code: [src/commands/batch/update.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/batch/update.ts)_
+_See code: [src/commands/batch/update.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/batch/update.ts)_
 ## `nex bulk delete`
@@ -1458,8 +1671,8 @@ Bulk delete records matching an encoded query.
 ```
 USAGE
-  $ nex bulk delete -t <value> -q <value> [-j] [-a <value>] [--log-level debug|warn|error|info|trace] [--confirm]
-    [-l <value>]
+  $ nex bulk delete -t <value> -q <value> [-j] [-a <value>] [--cred-store] [--log-level
+    debug|warn|error|info|trace] [--confirm] [-l <value>]
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -1470,6 +1683,8 @@ FLAGS
       --confirm        Execute the delete (without this flag, performs a dry run)
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -1504,7 +1719,7 @@ EXAMPLES
     $ nex bulk delete --table u_staging --query "processed=true" --confirm --json --auth dev
 ```
-_See code: [src/commands/bulk/delete.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/bulk/delete.ts)_
+_See code: [src/commands/bulk/delete.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/bulk/delete.ts)_
 ## `nex bulk update`
@@ -1512,8 +1727,8 @@ Bulk update records matching an encoded query.
 ```
 USAGE
-  $ nex bulk update -t <value> -q <value> -d <value> [-j] [-a <value>] [--log-level debug|warn|error|info|trace]
-    [--confirm] [-l <value>]
+  $ nex bulk update -t <value> -q <value> -d <value> [-j] [-a <value>] [--cred-store] [--log-level
+    debug|warn|error|info|trace] [--confirm] [-l <value>]
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -1525,6 +1740,8 @@ FLAGS
       --confirm        Execute the update (without this flag, performs a dry run)
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -1562,7 +1779,7 @@ EXAMPLES
     $ nex bulk update --table incident --query "active=true" --data '{"state":"6"}' --confirm --json --auth dev
 ```
-_See code: [src/commands/bulk/update.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/bulk/update.ts)_
+_See code: [src/commands/bulk/update.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/bulk/update.ts)_
 ## `nex exec SCOPE [FILE]`
@@ -1570,7 +1787,8 @@ Execute JavaScript on a ServiceNow instance remotely using Scripts - Background.
 ```
 USAGE
-  $ nex exec SCOPE [FILE] [--json] [-a <value>] [--log-level debug|warn|error|info|trace] [-p <value>]
+  $ nex exec SCOPE [FILE] [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
+    [-p <value>]
 ARGUMENTS
   SCOPE   Scope to execute script in. Use "global" for global scope.
@@ -1581,6 +1799,8 @@ FLAGS
   -p, --params=<value>  JSON object of parameters to replace in script file. Use {paramName} syntax in your script.
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -1681,7 +1901,7 @@ EXAMPLES
     $ nex exec global ./script.js --auth dev-instance --params '{"token":"abc123","env":"dev"}'
 ```
-_See code: [src/commands/exec/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/exec/index.ts)_
+_See code: [src/commands/exec/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/exec/index.ts)_
 ## `nex flow action`
@@ -1689,8 +1909,8 @@ Execute a Flow Designer action by scoped name.
 ```
 USAGE
-  $ nex flow action -n <value> [-j] [-a <value>] [--log-level debug|warn|error|info|trace] [-i <value>] [-m
-    foreground|background] [--scope <value>] [--quick]
+  $ nex flow action -n <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-i
+    <value>] [-m foreground|background] [--scope <value>] [--quick]
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -1703,6 +1923,8 @@ FLAGS
       --scope=<value>   Scope context for script execution
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -1724,7 +1946,7 @@ EXAMPLES
       '{"table":"incident","values":{"short_description":"Test"}}' --auth dev
 ```
-_See code: [src/commands/flow/action.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/flow/action.ts)_
+_See code: [src/commands/flow/action.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/flow/action.ts)_
 ## `nex flow cancel`
@@ -1732,8 +1954,8 @@ Cancel a running or paused flow execution.
 ```
 USAGE
-  $ nex flow cancel -c <value> [-j] [-a <value>] [--log-level debug|warn|error|info|trace] [-r <value>] [--scope
-    <value>]
+  $ nex flow cancel -c <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-r
+    <value>] [--scope <value>]
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -1743,6 +1965,8 @@ FLAGS
       --scope=<value>       Scope context for script execution
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -1761,7 +1985,7 @@ EXAMPLES
     $ nex flow cancel --context-id abc123def456 --reason "No longer needed" --auth dev
 ```
-_See code: [src/commands/flow/cancel.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/flow/cancel.ts)_
+_See code: [src/commands/flow/cancel.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/flow/cancel.ts)_
 ## `nex flow copy`
@@ -1769,7 +1993,8 @@ Copy an existing flow into a target scoped application.
 ```
 USAGE
-  $ nex flow copy -s <value> -n <value> -t <value> [-j] [-a <value>] [--log-level debug|warn|error|info|trace]
+  $ nex flow copy -s <value> -n <value> -t <value> [-j] [-a <value>] [--cred-store] [--log-level
+    debug|warn|error|info|trace]
 FLAGS
   -a, --auth=<value>            Auth alias to use.
@@ -1780,6 +2005,8 @@ FLAGS
                                 sys_ids)
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -1815,7 +2042,7 @@ EXAMPLES
       dev
 ```
-_See code: [src/commands/flow/copy.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/flow/copy.ts)_
+_See code: [src/commands/flow/copy.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/flow/copy.ts)_
 ## `nex flow details`
@@ -1823,7 +2050,8 @@ Get rich execution details for a flow context.
 ```
 USAGE
-  $ nex flow details -c <value> [-j] [-a <value>] [--log-level debug|warn|error|info|trace] [--scope <value>] [-d]
+  $ nex flow details -c <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
+    [--scope <value>] [-d]
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -1833,6 +2061,8 @@ FLAGS
       --scope=<value>       Scope sys_id for the ProcessFlow API transaction scope parameter
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -1865,7 +2095,7 @@ EXAMPLES
     $ nex flow details -c d4e5f6789012345678abcdef01234567 --json --auth dev
 ```
-_See code: [src/commands/flow/details.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/flow/details.ts)_
+_See code: [src/commands/flow/details.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/flow/details.ts)_
 ## `nex flow error`
@@ -1873,7 +2103,8 @@ Retrieve error details from a failed flow execution.
 ```
 USAGE
-  $ nex flow error -c <value> [-j] [-a <value>] [--log-level debug|warn|error|info|trace] [--scope <value>]
+  $ nex flow error -c <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
+    [--scope <value>]
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -1882,6 +2113,8 @@ FLAGS
       --scope=<value>       Scope context for script execution
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -1896,7 +2129,7 @@ EXAMPLES
     $ nex flow error --context-id abc123def456 --auth dev
 ```
-_See code: [src/commands/flow/error.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/flow/error.ts)_
+_See code: [src/commands/flow/error.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/flow/error.ts)_
 ## `nex flow logs`
@@ -1904,8 +2137,8 @@ Retrieve flow execution log entries for a given context.
 ```
 USAGE
-  $ nex flow logs -c <value> [-j] [-a <value>] [--log-level debug|warn|error|info|trace] [-l <value>] [-o
-    asc|desc]
+  $ nex flow logs -c <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-l
+    <value>] [-o asc|desc]
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -1916,6 +2149,8 @@ FLAGS
                             <options: asc|desc>
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -1944,7 +2179,7 @@ EXAMPLES
     $ nex flow logs -c d4e5f6789012345678abcdef01234567 --json --auth dev
 ```
-_See code: [src/commands/flow/logs.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/flow/logs.ts)_
+_See code: [src/commands/flow/logs.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/flow/logs.ts)_
 ## `nex flow message`
@@ -1952,8 +2187,8 @@ Send a message to a paused flow execution.
 ```
 USAGE
-  $ nex flow message -c <value> -m <value> [-j] [-a <value>] [--log-level debug|warn|error|info|trace] [-p
-    <value>] [--scope <value>]
+  $ nex flow message -c <value> -m <value> [-j] [-a <value>] [--cred-store] [--log-level
+    debug|warn|error|info|trace] [-p <value>] [--scope <value>]
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -1964,6 +2199,8 @@ FLAGS
       --scope=<value>       Scope context for script execution
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -1983,7 +2220,7 @@ EXAMPLES
     $ nex flow message --context-id abc123def456 --message "data_ready" --payload '{"status":"ok"}' --auth dev
 ```
-_See code: [src/commands/flow/message.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/flow/message.ts)_
+_See code: [src/commands/flow/message.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/flow/message.ts)_
 ## `nex flow outputs`
@@ -1991,7 +2228,8 @@ Retrieve outputs from a completed flow execution.
 ```
 USAGE
-  $ nex flow outputs -c <value> [-j] [-a <value>] [--log-level debug|warn|error|info|trace] [--scope <value>]
+  $ nex flow outputs -c <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
+    [--scope <value>]
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -2000,6 +2238,8 @@ FLAGS
       --scope=<value>       Scope context for script execution
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -2018,7 +2258,7 @@ EXAMPLES
     $ nex flow outputs --context-id abc123def456 --json --auth dev
 ```
-_See code: [src/commands/flow/outputs.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/flow/outputs.ts)_
+_See code: [src/commands/flow/outputs.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/flow/outputs.ts)_
 ## `nex flow run`
@@ -2026,8 +2266,8 @@ Execute a published Flow Designer flow by scoped name.
 ```
 USAGE
-  $ nex flow run -n <value> [-j] [-a <value>] [--log-level debug|warn|error|info|trace] [-i <value>] [-m
-    foreground|background] [--scope <value>] [--quick]
+  $ nex flow run -n <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-i
+    <value>] [-m foreground|background] [--scope <value>] [--quick]
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -2040,6 +2280,8 @@ FLAGS
       --scope=<value>   Scope context for script execution (e.g. global, x_myapp)
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -2073,7 +2315,7 @@ EXAMPLES
     $ nex flow run --name global.my_flow --mode background --auth dev
 ```
-_See code: [src/commands/flow/run.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/flow/run.ts)_
+_See code: [src/commands/flow/run.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/flow/run.ts)_
 ## `nex flow status`
@@ -2081,7 +2323,8 @@ Get the status of a flow execution context.
 ```
 USAGE
-  $ nex flow status -c <value> [-j] [-a <value>] [--log-level debug|warn|error|info|trace] [--scope <value>]
+  $ nex flow status -c <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
+    [--scope <value>]
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -2090,6 +2333,8 @@ FLAGS
       --scope=<value>       Scope context for script execution
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -2106,7 +2351,7 @@ EXAMPLES
     $ nex flow status --context-id abc123def456 --auth dev
 ```
-_See code: [src/commands/flow/status.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/flow/status.ts)_
+_See code: [src/commands/flow/status.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/flow/status.ts)_
 ## `nex flow subflow`
@@ -2114,8 +2359,8 @@ Execute a published Flow Designer subflow by scoped name.
 ```
 USAGE
-  $ nex flow subflow -n <value> [-j] [-a <value>] [--log-level debug|warn|error|info|trace] [-i <value>] [-m
-    foreground|background] [--scope <value>] [--quick]
+  $ nex flow subflow -n <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-i
+    <value>] [-m foreground|background] [--scope <value>] [--quick]
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -2128,6 +2373,8 @@ FLAGS
       --scope=<value>   Scope context for script execution
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -2155,7 +2402,7 @@ EXAMPLES
     $ nex flow subflow --name x_myapp.process_record --inputs '{"table":"incident","sys_id":"abc123"}' --auth dev
 ```
-_See code: [src/commands/flow/subflow.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/flow/subflow.ts)_
+_See code: [src/commands/flow/subflow.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/flow/subflow.ts)_
 ## `nex flow test`
@@ -2163,8 +2410,8 @@ Test a Flow Designer flow without requiring it to be published.
 ```
 USAGE
-  $ nex flow test -f <value> -o <value> [-j] [-a <value>] [--log-level debug|warn|error|info|trace] [--scope
-    <value>] [--synchronous]
+  $ nex flow test -f <value> -o <value> [-j] [-a <value>] [--cred-store] [--log-level
+    debug|warn|error|info|trace] [--scope <value>] [--synchronous]
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -2176,6 +2423,8 @@ FLAGS
       --[no-]synchronous    Run test synchronously (default: true)
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -2207,7 +2456,7 @@ EXAMPLES
     $ nex flow test -f 887dda5583237210fdb8f7b6feaad32c -o '{"current":"abc123"}' --json --auth dev
 ```
-_See code: [src/commands/flow/test.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/flow/test.ts)_
+_See code: [src/commands/flow/test.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/flow/test.ts)_
 ## `nex health check`
@@ -2215,8 +2464,8 @@ Run a consolidated health check on a ServiceNow instance.
 ```
 USAGE
-  $ nex health check [-j] [-a <value>] [--log-level debug|warn|error|info|trace] [--include-version]
-    [--include-cluster] [--include-stuck-jobs] [--include-semaphores] [--include-operational-counts]
+  $ nex health check [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
+    [--include-version] [--include-cluster] [--include-stuck-jobs] [--include-semaphores] [--include-operational-counts]
     [--stuck-job-threshold <value>]
 FLAGS
@@ -2230,6 +2479,8 @@ FLAGS
       --stuck-job-threshold=<value>      [default: 30] Minutes threshold for a job to be considered stuck
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -2267,7 +2518,7 @@ EXAMPLES
     $ nex health check --json --auth dev
 ```
-_See code: [src/commands/health/check.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/health/check.ts)_
+_See code: [src/commands/health/check.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/health/check.ts)_
 ## `nex help [COMMAND]`
@@ -2295,8 +2546,8 @@ Tail and monitor ServiceNow system logs in real-time with beautiful formatting.
 ```
 USAGE
-  $ nex log [--json] [-a <value>] [--log-level debug|warn|error|info|trace] [-o <value>] [-i <value>]
-    [--no-color] [-f <value>...]
+  $ nex log [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-o <value>]
+    [-i <value>] [--no-color] [-f <value>...]
 FLAGS
   -a, --auth=<value>       Auth alias to use.
@@ -2309,6 +2560,8 @@ FLAGS
       --no-color           Disable colored output
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -2392,7 +2645,7 @@ EXAMPLES
     $ nex log --no-color --auth dev-instance
 ```
-_See code: [src/commands/log/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/log/index.ts)_
+_See code: [src/commands/log/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/log/index.ts)_
 ## `nex plugins`
@@ -2690,8 +2943,8 @@ Query any ServiceNow table using the Table API.
 ```
 USAGE
-  $ nex query -t <value> [-j] [-a <value>] [--log-level debug|warn|error|info|trace] [-q <value>] [-f
-    <value>] [-d] [-l <value>]
+  $ nex query -t <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-q
+    <value>] [-f <value>] [-d] [-l <value>]
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -2703,6 +2956,8 @@ FLAGS
   -t, --table=<value>   (required) ServiceNow table name to query
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -2734,7 +2989,7 @@ EXAMPLES
     $ nex query --table sys_user --query "active=true" --limit 5 --json --auth dev
 ```
-_See code: [src/commands/query/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/query/index.ts)_
+_See code: [src/commands/query/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/query/index.ts)_
 ## `nex query app`
@@ -2742,7 +2997,8 @@ Search for applications by name across scoped apps and plugins.
 ```
 USAGE
-  $ nex query app -s <value> [-j] [-a <value>] [--log-level debug|warn|error|info|trace] [-a] [-l <value>]
+  $ nex query app -s <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-a]
+    [-l <value>]
 FLAGS
   -a, --active          Only show active applications
@@ -2752,6 +3008,8 @@ FLAGS
   -s, --search=<value>  (required) Application name search term
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -2776,7 +3034,7 @@ EXAMPLES
     $ nex query app --search "HR" --active --auth dev
 ```
-_See code: [src/commands/query/app.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/query/app.ts)_
+_See code: [src/commands/query/app.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/query/app.ts)_
 ## `nex query columns`
@@ -2784,7 +3042,8 @@ List and search columns (fields) on a ServiceNow table.
 ```
 USAGE
-  $ nex query columns -t <value> [-j] [-a <value>] [--log-level debug|warn|error|info|trace] [-s <value>]
+  $ nex query columns -t <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-s
+    <value>]
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -2793,6 +3052,8 @@ FLAGS
   -t, --table=<value>   (required) ServiceNow table name to list columns for
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -2820,7 +3081,7 @@ EXAMPLES
     $ nex query columns --table incident --json --auth dev
 ```
-_See code: [src/commands/query/columns.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/query/columns.ts)_
+_See code: [src/commands/query/columns.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/query/columns.ts)_
 ## `nex query syslog`
@@ -2828,7 +3089,8 @@ Query ServiceNow system logs (one-shot, non-tailing).
 ```
 USAGE
-  $ nex query syslog [-j] [-a <value>] [--log-level debug|warn|error|info|trace] [-q <value>] [-l <value>]
+  $ nex query syslog [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-q <value>] [-l
+    <value>]
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -2837,6 +3099,8 @@ FLAGS
   -q, --query=<value>  ServiceNow encoded query string for filtering syslog records
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -2866,7 +3130,7 @@ EXAMPLES
     $ nex query syslog --query "sourceLIKEincident" --json --auth dev
 ```
-_See code: [src/commands/query/syslog.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/query/syslog.ts)_
+_See code: [src/commands/query/syslog.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/query/syslog.ts)_
 ## `nex schema`
@@ -2874,8 +3138,8 @@ Discover and inspect a ServiceNow table schema including fields, types, and rela
 ```
 USAGE
-  $ nex schema -t <value> [-j] [-a <value>] [--log-level debug|warn|error|info|trace] [--include-choices]
-    [--include-relationships] [--include-ui-policies] [--include-business-rules]
+  $ nex schema -t <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
+    [--include-choices] [--include-relationships] [--include-ui-policies] [--include-business-rules]
 FLAGS
   -a, --auth=<value>            Auth alias to use.
@@ -2887,6 +3151,8 @@ FLAGS
       --include-ui-policies     Include UI policies in the schema output
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -2914,7 +3180,7 @@ EXAMPLES
     $ nex schema --table incident --include-choices --include-relationships --auth dev
 ```
-_See code: [src/commands/schema/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/schema/index.ts)_
+_See code: [src/commands/schema/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/schema/index.ts)_
 ## `nex schema field`
@@ -2922,7 +3188,8 @@ Get detailed information about a specific field on a ServiceNow table.
 ```
 USAGE
-  $ nex schema field -t <value> -f <value> [-j] [-a <value>] [--log-level debug|warn|error|info|trace]
+  $ nex schema field -t <value> -f <value> [-j] [-a <value>] [--cred-store] [--log-level
+    debug|warn|error|info|trace]
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -2931,6 +3198,8 @@ FLAGS
   -t, --table=<value>  (required) ServiceNow table name
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -2950,7 +3219,7 @@ EXAMPLES
     $ nex schema field --table incident --field priority --json --auth dev
 ```
-_See code: [src/commands/schema/field.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/schema/field.ts)_
+_See code: [src/commands/schema/field.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/schema/field.ts)_
 ## `nex schema validate-catalog`
@@ -2958,7 +3227,7 @@ Validate a ServiceNow catalog item configuration for common issues.
 ```
 USAGE
-  $ nex schema validate-catalog -s <value> [-j] [-a <value>] [--log-level debug|warn|error|info|trace]
+  $ nex schema validate-catalog -s <value> [-j] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -2966,6 +3235,8 @@ FLAGS
   -s, --sys-id=<value>  (required) Catalog item sys_id to validate
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -2985,7 +3256,7 @@ EXAMPLES
     $ nex schema validate-catalog --sys-id a1b2c3d4e5f6 --json --auth dev
 ```
-_See code: [src/commands/schema/validate-catalog.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/schema/validate-catalog.ts)_
+_See code: [src/commands/schema/validate-catalog.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/schema/validate-catalog.ts)_
 ## `nex scope`
@@ -2993,13 +3264,15 @@ Get the current application scope or list available applications.
 ```
 USAGE
-  $ nex scope [--json] [-a <value>] [--log-level debug|warn|error|info|trace] [-l]
+  $ nex scope [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-l]
 FLAGS
   -a, --auth=<value>  Auth alias to use.
   -l, --list          List all available applications
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -3021,7 +3294,7 @@ EXAMPLES
     $ nex scope -l --json --auth dev
 ```
-_See code: [src/commands/scope/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/scope/index.ts)_
+_See code: [src/commands/scope/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/scope/index.ts)_
 ## `nex scope set`
@@ -3029,13 +3302,15 @@ Set the current application scope on a ServiceNow instance.
 ```
 USAGE
-  $ nex scope set -a <value> [--json] [-a <value>] [--log-level debug|warn|error|info|trace]
+  $ nex scope set -a <value> [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
 FLAGS
   -a, --app-id=<value>  (required) 32-char sys_id of application
   -a, --auth=<value>    Auth alias to use.
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -3053,7 +3328,7 @@ EXAMPLES
     $ nex scope set -a abc123def456ghi789jkl012mno345pq --json --auth dev
 ```
-_See code: [src/commands/scope/set.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/scope/set.ts)_
+_See code: [src/commands/scope/set.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/scope/set.ts)_
 ## `nex script-sync pull`
@@ -3062,7 +3337,7 @@ Pull a script from a ServiceNow instance to a local file.
 ```
 USAGE
   $ nex script-sync pull -n <value> -t sys_script_include|sys_script|sys_ui_script|sys_ui_action|sys_script_client
-    [--json] [-a <value>] [--log-level debug|warn|error|info|trace] [-o <value>]
+    [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-o <value>]
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -3072,6 +3347,8 @@ FLAGS
                         <options: sys_script_include|sys_script|sys_ui_script|sys_ui_action|sys_script_client>
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -3102,7 +3379,7 @@ EXAMPLES
     $ nex script-sync pull -n MyClientScript -t sys_script_client --json --auth dev-instance
 ```
-_See code: [src/commands/script-sync/pull.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/script-sync/pull.ts)_
+_See code: [src/commands/script-sync/pull.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/script-sync/pull.ts)_
 ## `nex script-sync push`
@@ -3111,7 +3388,7 @@ Push a local script file to a ServiceNow instance.
 ```
 USAGE
   $ nex script-sync push -n <value> -t sys_script_include|sys_script|sys_ui_script|sys_ui_action|sys_script_client -f
-    <value> [--json] [-a <value>] [--log-level debug|warn|error|info|trace]
+    <value> [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -3121,6 +3398,8 @@ FLAGS
                        <options: sys_script_include|sys_script|sys_ui_script|sys_ui_action|sys_script_client>
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -3152,7 +3431,7 @@ EXAMPLES
     $ nex script-sync push -n MyUIScript -t sys_ui_script -f ./scripts/ui-script.js --json --auth dev-instance
 ```
-_See code: [src/commands/script-sync/push.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/script-sync/push.ts)_
+_See code: [src/commands/script-sync/push.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/script-sync/push.ts)_
 ## `nex script-sync sync`
@@ -3160,7 +3439,7 @@ Synchronize all scripts in a directory with a ServiceNow instance.
 ```
 USAGE
-  $ nex script-sync sync -d <value> [--json] [-a <value>] [--log-level debug|warn|error|info|trace] [-t
+  $ nex script-sync sync -d <value> [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-t
     sys_script_include|sys_script|sys_ui_script|sys_ui_action|sys_script_client...]
 FLAGS
@@ -3170,6 +3449,8 @@ FLAGS
                            <options: sys_script_include|sys_script|sys_ui_script|sys_ui_action|sys_script_client>
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -3200,7 +3481,7 @@ EXAMPLES
     $ nex script-sync sync -d ./scripts --json --auth dev-instance
 ```
-_See code: [src/commands/script-sync/sync.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/script-sync/sync.ts)_
+_See code: [src/commands/script-sync/sync.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/script-sync/sync.ts)_
 ## `nex search`
@@ -3208,8 +3489,8 @@ Search platform code across a ServiceNow instance.
 ```
 USAGE
-  $ nex search -t <value> [--json] [-a <value>] [--log-level debug|warn|error|info|trace] [-l <value>] [-s
-    <value>] [-g <value>] [--table <value>]
+  $ nex search -t <value> [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-l
+    <value>] [-s <value>] [-g <value>] [--table <value>]
 FLAGS
   -a, --auth=<value>          Auth alias to use.
@@ -3220,6 +3501,8 @@ FLAGS
       --table=<value>         Table name to search within (requires --search-group)
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -3256,7 +3539,7 @@ EXAMPLES
     $ nex search --term "GlideRecord" --limit 10 --json --auth dev-instance
 ```
-_See code: [src/commands/search/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/search/index.ts)_
+_See code: [src/commands/search/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/search/index.ts)_
 ## `nex search add-table`
@@ -3264,7 +3547,7 @@ Add a table to a code search group on a ServiceNow instance.
 ```
 USAGE
-  $ nex search add-table -f <value> -g <value> -t <value> [--json] [-a <value>] [--log-level
+  $ nex search add-table -f <value> -g <value> -t <value> [--json] [-a <value>] [--cred-store] [--log-level
     debug|warn|error|info|trace]
 FLAGS
@@ -3274,6 +3557,8 @@ FLAGS
   -t, --table=<value>          (required) Table name to add to the search group
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -3306,7 +3591,7 @@ EXAMPLES
       dev-instance
 ```
-_See code: [src/commands/search/add-table.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/search/add-table.ts)_
+_See code: [src/commands/search/add-table.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/search/add-table.ts)_
 ## `nex search groups`
@@ -3314,12 +3599,14 @@ List all available code search groups on a ServiceNow instance.
 ```
 USAGE
-  $ nex search groups [--json] [-a <value>] [--log-level debug|warn|error|info|trace]
+  $ nex search groups [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
 FLAGS
   -a, --auth=<value>  Auth alias to use.
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -3344,7 +3631,7 @@ EXAMPLES
     $ nex search groups --json --auth dev-instance
 ```
-_See code: [src/commands/search/groups.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/search/groups.ts)_
+_See code: [src/commands/search/groups.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/search/groups.ts)_
 ## `nex search tables`
@@ -3352,13 +3639,15 @@ List tables configured for a specific code search group.
 ```
 USAGE
-  $ nex search tables -g <value> [--json] [-a <value>] [--log-level debug|warn|error|info|trace]
+  $ nex search tables -g <value> [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
 FLAGS
   -a, --auth=<value>          Auth alias to use.
   -g, --search-group=<value>  (required) Search group name to list tables for
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -3384,7 +3673,7 @@ EXAMPLES
     $ nex search tables --search-group "Business Rules" --json --auth dev-instance
 ```
-_See code: [src/commands/search/tables.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/search/tables.ts)_
+_See code: [src/commands/search/tables.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/search/tables.ts)_
 ## `nex store install`
@@ -3392,8 +3681,8 @@ Install an application from the ServiceNow Store.
 ```
 USAGE
-  $ nex store install -a <value> -v <value> [--json] [-a <value>] [--log-level debug|warn|error|info|trace]
-    [--demo-data] [--no-wait] [--poll-interval <value>] [--timeout <value>]
+  $ nex store install -a <value> -v <value> [--json] [-a <value>] [--cred-store] [--log-level
+    debug|warn|error|info|trace] [--demo-data] [--no-wait] [--poll-interval <value>] [--timeout <value>]
 FLAGS
   -a, --app-id=<value>         (required) Store application sys_id
@@ -3405,6 +3694,8 @@ FLAGS
       --timeout=<value>        [default: 1800000] Installation timeout in milliseconds
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -3426,7 +3717,7 @@ EXAMPLES
     $ nex store install -a abc123 -v 1.0.0 --demo-data --auth dev
 ```
-_See code: [src/commands/store/install.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/store/install.ts)_
+_See code: [src/commands/store/install.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/store/install.ts)_
 ## `nex store search`
@@ -3434,8 +3725,8 @@ Search for applications in the ServiceNow Store.
 ```
 USAGE
-  $ nex store search [--json] [-a <value>] [--log-level debug|warn|error|info|trace] [--limit <value>] [--tab
-    available_for_you|installed|updates] [-t <value>]
+  $ nex store search [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [--limit
+    <value>] [--tab available_for_you|installed|updates] [-t <value>]
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -3445,6 +3736,8 @@ FLAGS
                        <options: available_for_you|installed|updates>
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -3466,7 +3759,7 @@ EXAMPLES
     $ nex store search --tab updates --limit 10 --auth dev
 ```
-_See code: [src/commands/store/search.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/store/search.ts)_
+_See code: [src/commands/store/search.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/store/search.ts)_
 ## `nex store update`
@@ -3474,8 +3767,8 @@ Update a ServiceNow Store application to a new version.
 ```
 USAGE
-  $ nex store update -a <value> -v <value> [--json] [-a <value>] [--log-level debug|warn|error|info|trace]
-    [--no-wait] [--poll-interval <value>] [--timeout <value>]
+  $ nex store update -a <value> -v <value> [--json] [-a <value>] [--cred-store] [--log-level
+    debug|warn|error|info|trace] [--no-wait] [--poll-interval <value>] [--timeout <value>]
 FLAGS
   -a, --app-id=<value>         (required) Store application sys_id
@@ -3486,6 +3779,8 @@ FLAGS
       --timeout=<value>        [default: 1800000] Update timeout in milliseconds
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -3507,7 +3802,7 @@ EXAMPLES
     $ nex store update -a abc123 -v 2.0.0 --timeout 3600000 --auth dev
 ```
-_See code: [src/commands/store/update.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/store/update.ts)_
+_See code: [src/commands/store/update.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/store/update.ts)_
 ## `nex store validate`
@@ -3515,13 +3810,15 @@ Validate a batch installation definition file.
 ```
 USAGE
-  $ nex store validate -f <value> [--json] [-a <value>] [--log-level debug|warn|error|info|trace]
+  $ nex store validate -f <value> [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
 FLAGS
   -a, --auth=<value>  Auth alias to use.
   -f, --file=<value>  (required) Path to batch definition JSON file
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -3535,7 +3832,7 @@ EXAMPLES
     $ nex store validate --file ./batch-definition.json --auth dev
 ```
-_See code: [src/commands/store/validate.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/store/validate.ts)_
+_See code: [src/commands/store/validate.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/store/validate.ts)_
 ## `nex task approve`
@@ -3543,7 +3840,8 @@ Approve a ServiceNow change request.
 ```
 USAGE
-  $ nex task approve -n <value> [--json] [-a <value>] [--log-level debug|warn|error|info|trace] [-c <value>]
+  $ nex task approve -n <value> [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-c
+    <value>]
 FLAGS
   -a, --auth=<value>      Auth alias to use.
@@ -3551,6 +3849,8 @@ FLAGS
   -n, --number=<value>    (required) Change request number (e.g., CHG0010001)
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -3575,7 +3875,7 @@ EXAMPLES
     $ nex task approve -n CHG0010001 -c "Looks good, approved" --auth dev
 ```
-_See code: [src/commands/task/approve.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/task/approve.ts)_
+_See code: [src/commands/task/approve.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/task/approve.ts)_
 ## `nex task assign`
@@ -3583,8 +3883,8 @@ Assign a ServiceNow task to a user or group.
 ```
 USAGE
-  $ nex task assign -n <value> -u <value> [--json] [-a <value>] [--log-level debug|warn|error|info|trace] [-g
-    <value>] [--table <value>]
+  $ nex task assign -n <value> -u <value> [--json] [-a <value>] [--cred-store] [--log-level
+    debug|warn|error|info|trace] [-g <value>] [--table <value>]
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -3594,6 +3894,8 @@ FLAGS
       --table=<value>   [default: task] ServiceNow table name
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -3625,7 +3927,7 @@ EXAMPLES
     $ nex task assign --number CHG0010001 --table change_request --user admin --auth dev
 ```
-_See code: [src/commands/task/assign.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/task/assign.ts)_
+_See code: [src/commands/task/assign.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/task/assign.ts)_
 ## `nex task close`
@@ -3633,8 +3935,8 @@ Close a ServiceNow incident.
 ```
 USAGE
-  $ nex task close --notes <value> -n <value> [--json] [-a <value>] [--log-level debug|warn|error|info|trace]
-    [--close-code <value>]
+  $ nex task close --notes <value> -n <value> [--json] [-a <value>] [--cred-store] [--log-level
+    debug|warn|error|info|trace] [--close-code <value>]
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -3643,6 +3945,8 @@ FLAGS
       --notes=<value>       (required) Close notes
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -3668,7 +3972,7 @@ EXAMPLES
     $ nex task close -n INC0010001 --notes "Closed" --close-code "Solved (Permanently)" --auth dev
 ```
-_See code: [src/commands/task/close.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/task/close.ts)_
+_See code: [src/commands/task/close.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/task/close.ts)_
 ## `nex task comment`
@@ -3676,8 +3980,8 @@ Add a comment or work note to a ServiceNow task.
 ```
 USAGE
-  $ nex task comment -c <value> -n <value> [--json] [-a <value>] [--log-level debug|warn|error|info|trace]
-    [--table <value>] [--work-note]
+  $ nex task comment -c <value> -n <value> [--json] [-a <value>] [--cred-store] [--log-level
+    debug|warn|error|info|trace] [--table <value>] [--work-note]
 FLAGS
   -a, --auth=<value>     Auth alias to use.
@@ -3687,6 +3991,8 @@ FLAGS
       --work-note        Add as work note instead of comment
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -3717,7 +4023,7 @@ EXAMPLES
     $ nex task comment --number CHG0010001 --table change_request --comment "Approved" --auth dev
 ```
-_See code: [src/commands/task/comment.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/task/comment.ts)_
+_See code: [src/commands/task/comment.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/task/comment.ts)_
 ## `nex task find`
@@ -3725,7 +4031,8 @@ Find a ServiceNow task by its number.
 ```
 USAGE
-  $ nex task find -n <value> [--json] [-a <value>] [--log-level debug|warn|error|info|trace] [--table <value>]
+  $ nex task find -n <value> [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
+    [--table <value>]
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -3733,6 +4040,8 @@ FLAGS
       --table=<value>   [default: task] ServiceNow table name
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -3762,7 +4071,7 @@ EXAMPLES
     $ nex task find -n INC0010001 --json --auth dev
 ```
-_See code: [src/commands/task/find.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/task/find.ts)_
+_See code: [src/commands/task/find.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/task/find.ts)_
 ## `nex task resolve`
@@ -3770,8 +4079,8 @@ Resolve a ServiceNow incident with resolution notes.
 ```
 USAGE
-  $ nex task resolve --notes <value> -n <value> [--json] [-a <value>] [--log-level debug|warn|error|info|trace]
-    [--close-code <value>]
+  $ nex task resolve --notes <value> -n <value> [--json] [-a <value>] [--cred-store] [--log-level
+    debug|warn|error|info|trace] [--close-code <value>]
 FLAGS
   -a, --auth=<value>        Auth alias to use.
@@ -3780,6 +4089,8 @@ FLAGS
       --notes=<value>       (required) Resolution notes
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -3805,7 +4116,7 @@ EXAMPLES
     $ nex task resolve -n INC0010001 --notes "Fixed" --close-code "Solved (Permanently)" --auth dev
 ```
-_See code: [src/commands/task/resolve.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/task/resolve.ts)_
+_See code: [src/commands/task/resolve.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/task/resolve.ts)_
 ## `nex update-set`
@@ -3813,7 +4124,8 @@ List update sets on a ServiceNow instance.
 ```
 USAGE
-  $ nex update-set [--json] [-a <value>] [--log-level debug|warn|error|info|trace] [--limit <value>] [-q <value>]
+  $ nex update-set [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [--limit
+    <value>] [-q <value>]
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -3821,6 +4133,8 @@ FLAGS
       --limit=<value>  [default: 20] Maximum number of update sets to return
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -3842,7 +4156,7 @@ EXAMPLES
     $ nex update-set --json --auth dev-instance
 ```
-_See code: [src/commands/update-set/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/update-set/index.ts)_
+_See code: [src/commands/update-set/index.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/update-set/index.ts)_
 ## `nex update-set clone`
@@ -3850,7 +4164,8 @@ Clone an update set and its records.
 ```
 USAGE
-  $ nex update-set clone -n <value> -s <value> [--json] [-a <value>] [--log-level debug|warn|error|info|trace]
+  $ nex update-set clone -n <value> -s <value> [--json] [-a <value>] [--cred-store] [--log-level
+    debug|warn|error|info|trace]
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -3858,6 +4173,8 @@ FLAGS
   -s, --source=<value>  (required) Source update set sys_id
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -3875,7 +4192,7 @@ EXAMPLES
     $ nex update-set clone --source us-001 --name "Cloned Set" --json --auth dev-instance
 ```
-_See code: [src/commands/update-set/clone.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/update-set/clone.ts)_
+_See code: [src/commands/update-set/clone.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/update-set/clone.ts)_
 ## `nex update-set create`
@@ -3883,8 +4200,8 @@ Create a new update set.
 ```
 USAGE
-  $ nex update-set create -n <value> [--json] [-a <value>] [--log-level debug|warn|error|info|trace] [--application
-    <value>] [-d <value>]
+  $ nex update-set create -n <value> [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
+    [--application <value>] [-d <value>]
 FLAGS
   -a, --auth=<value>         Auth alias to use.
@@ -3893,6 +4210,8 @@ FLAGS
       --application=<value>  Application scope for the new update set
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -3914,7 +4233,7 @@ EXAMPLES
     $ nex update-set create --name "My Feature Set" --application x_my_app --auth dev-instance
 ```
-_See code: [src/commands/update-set/create.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/update-set/create.ts)_
+_See code: [src/commands/update-set/create.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/update-set/create.ts)_
 ## `nex update-set current`
@@ -3922,13 +4241,15 @@ Get or set the current update set.
 ```
 USAGE
-  $ nex update-set current [--json] [-a <value>] [--log-level debug|warn|error|info|trace] [-s <value>]
+  $ nex update-set current [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace] [-s <value>]
 FLAGS
   -a, --auth=<value>  Auth alias to use.
   -s, --set=<value>   sys_id of update set to make current
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -3950,7 +4271,7 @@ EXAMPLES
     $ nex update-set current --json --auth dev-instance
 ```
-_See code: [src/commands/update-set/current.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/update-set/current.ts)_
+_See code: [src/commands/update-set/current.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/update-set/current.ts)_
 ## `nex update-set inspect`
@@ -3958,13 +4279,15 @@ Inspect the components of an update set.
 ```
 USAGE
-  $ nex update-set inspect -s <value> [--json] [-a <value>] [--log-level debug|warn|error|info|trace]
+  $ nex update-set inspect -s <value> [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
 FLAGS
   -a, --auth=<value>    Auth alias to use.
   -s, --sys-id=<value>  (required) sys_id of the update set to inspect
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -3982,7 +4305,7 @@ EXAMPLES
     $ nex update-set inspect --sys-id us-001 --json --auth dev-instance
 ```
-_See code: [src/commands/update-set/inspect.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/update-set/inspect.ts)_
+_See code: [src/commands/update-set/inspect.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/update-set/inspect.ts)_
 ## `nex update-set move`
@@ -3990,8 +4313,8 @@ Move records between update sets.
 ```
 USAGE
-  $ nex update-set move --target <value> [--json] [-a <value>] [--log-level debug|warn|error|info|trace] [--records
-    <value>] [--source <value>]
+  $ nex update-set move --target <value> [--json] [-a <value>] [--cred-store] [--log-level
+    debug|warn|error|info|trace] [--records <value>] [--source <value>]
 FLAGS
   -a, --auth=<value>     Auth alias to use.
@@ -4000,6 +4323,8 @@ FLAGS
       --target=<value>   (required) Target update set sys_id
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -4021,7 +4346,7 @@ EXAMPLES
     $ nex update-set move --target us-002 --source us-001 --json --auth dev-instance
 ```
-_See code: [src/commands/update-set/move.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/update-set/move.ts)_
+_See code: [src/commands/update-set/move.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/update-set/move.ts)_
 ## `nex workflow create`
@@ -4029,13 +4354,15 @@ Create a complete workflow from a JSON specification file.
 ```
 USAGE
-  $ nex workflow create -s <value> [--json] [-a <value>] [--log-level debug|warn|error|info|trace]
+  $ nex workflow create -s <value> [--json] [-a <value>] [--cred-store] [--log-level debug|warn|error|info|trace]
 FLAGS
   -a, --auth=<value>  Auth alias to use.
   -s, --spec=<value>  (required) Path to workflow JSON specification file
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -4053,7 +4380,7 @@ EXAMPLES
     $ nex workflow create -s ./workflow.json --json --auth dev
 ```
-_See code: [src/commands/workflow/create.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/workflow/create.ts)_
+_See code: [src/commands/workflow/create.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/workflow/create.ts)_
 ## `nex workflow publish`
@@ -4061,7 +4388,8 @@ Publish a workflow version.
 ```
 USAGE
-  $ nex workflow publish -s <value> -v <value> [--json] [-a <value>] [--log-level debug|warn|error|info|trace]
+  $ nex workflow publish -s <value> -v <value> [--json] [-a <value>] [--cred-store] [--log-level
+    debug|warn|error|info|trace]
 FLAGS
   -a, --auth=<value>            Auth alias to use.
@@ -4069,6 +4397,8 @@ FLAGS
   -v, --version-id=<value>      (required) Sys ID of the workflow version to publish
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --json                Format output as json.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -4086,7 +4416,7 @@ EXAMPLES
     $ nex workflow publish -v wfv-001 -s act-001 --json --auth dev
 ```
-_See code: [src/commands/workflow/publish.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/workflow/publish.ts)_
+_See code: [src/commands/workflow/publish.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/workflow/publish.ts)_
 ## `nex xml export`
@@ -4094,7 +4424,8 @@ Export a single ServiceNow record as XML.
 ```
 USAGE
-  $ nex xml export -t <value> -s <value> [-j] [-a <value>] [--log-level debug|warn|error|info|trace] [-o <value>]
+  $ nex xml export -t <value> -s <value> [-j] [-a <value>] [--cred-store] [--log-level
+    debug|warn|error|info|trace] [-o <value>]
 FLAGS
   -a, --auth=<value>    Auth alias to use.
@@ -4104,6 +4435,8 @@ FLAGS
   -t, --table=<value>   (required) Table name of the record to export
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -4133,7 +4466,7 @@ EXAMPLES
     $ nex xml export --table sys_script --sys-id abc123 --json --auth dev
 ```
-_See code: [src/commands/xml/export.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/xml/export.ts)_
+_See code: [src/commands/xml/export.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/xml/export.ts)_
 ## `nex xml import`
@@ -4141,7 +4474,8 @@ Import XML records into a ServiceNow instance.
 ```
 USAGE
-  $ nex xml import -f <value> -t <value> [-j] [-a <value>] [--log-level debug|warn|error|info|trace]
+  $ nex xml import -f <value> -t <value> [-j] [-a <value>] [--cred-store] [--log-level
+    debug|warn|error|info|trace]
 FLAGS
   -a, --auth=<value>   Auth alias to use.
@@ -4150,6 +4484,8 @@ FLAGS
   -t, --table=<value>  (required) Target table to import records into
 GLOBAL FLAGS
+  --cred-store          Read credentials from @sonisoft/sn-credstore instead of the OS keyring. Use this in headless
+                        sessions (SSH, systemd, CI, agents) where the keyring cannot be unlocked.
   --log-level=<option>  [default: info] Specify level for logging.
                         <options: debug|warn|error|info|trace>
@@ -4174,7 +4510,7 @@ EXAMPLES
     $ nex xml import --file ./records.xml --table incident --json --auth dev
 ```
-_See code: [src/commands/xml/import.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v3.0.0/src/commands/xml/import.ts)_
+_See code: [src/commands/xml/import.ts](https://github.com/sonisoft-cnanda/now-sdk-ext-cli/blob/v5.0.1/src/commands/xml/import.ts)_
 <!-- commandsstop -->
 ---