@sonisoft/now-sdk-ext-cli 3.0.0 → 5.0.1

package/bin/argv-guard.js

@@ -0,0 +1,25 @@
+/* eslint-disable n/no-process-exit, unicorn/no-process-exit -- this runs before
+   oclif exists, so there is no error handler to throw into; an uncaught rejection
+   here would print a stack trace instead of the remediation. */
+
+/**
+ * Side-effecting half of the argv secret check.
+ *
+ * Split from bin/argv-secrets.js so the detection logic can be imported and
+ * tested without the import itself terminating the test process.
+ *
+ * Imported for its side effect by bin/run.js and bin/dev.js, before
+ * credstore-boot.js — a secret in argv should be refused before anything reads,
+ * stores, or logs a credential.
+ */
+
+import {findSecretArgument, secretArgumentMessage} from './argv-secrets.js'
+
+// slice(2): skip the node binary and the script path, so a secret-shaped
+// filename in the invocation cannot trip the check.
+const found = findSecretArgument(process.argv.slice(2))
+
+if (found) {
+    process.stderr.write(secretArgumentMessage(found))
+    process.exit(2)
+}

package/bin/argv-secrets.js

@@ -0,0 +1,103 @@
+/**
+ * Refuse to run when a secret was passed as a command-line argument.
+ *
+ * Anything in argv is already exposed by the time this runs: the shell has
+ * written it to history, and it is visible to every process on the host via
+ * `ps auxww` for as long as this one lives. Neither can be undone from here.
+ *
+ * So this is not really prevention — it is detection plus an honest message. The
+ * user needs to know the value leaked and should be rotated, which is strictly
+ * more useful than oclif's "Nonexistent flag: --password". Refusing to run also
+ * makes the habit fail fast rather than working quietly until someone greps a
+ * shell history.
+ *
+ * None of these flags exist on any `nex` command today, so nothing legitimate is
+ * blocked. The check is deliberately conservative about that: it matches on flag
+ * NAME only, never on the shape of a value, because `nex exec` takes arbitrary
+ * scripts and `--query`, `--filter`, `--data`, `--payload` and `--spec` all take
+ * arbitrary text that can look like anything.
+ *
+ * Kept as plain JS in bin/ for the same reason as credstore-boot.js: it runs
+ * before oclif and before any build output is required.
+ */
+
+/**
+ * Long flags whose value would be a credential.
+ *
+ * Short flags are deliberately excluded — `-p` and `-t` are too easily something
+ * else, and a false positive here blocks legitimate work.
+ */
+const SECRET_FLAGS = new Set([
+    '--password',
+    '--passwd',
+    '--pass',
+    '--secret',
+    '--client-secret',
+    '--clientsecret',
+    '--token',
+    '--access-token',
+    '--refresh-token',
+    '--id-token',
+    '--auth-token',
+    '--user-token',
+    '--session-token',
+    '--api-key',
+    '--apikey',
+    '--credential',
+    '--credentials',
+])
+
+/**
+ * Returns details of the first secret-bearing argument, or null.
+ *
+ * Only reports when a value is actually present. `--password` with nothing after
+ * it, or followed by another flag, carries no secret — oclif will reject it as a
+ * missing value, which is not this file's problem.
+ *
+ * @param {string[]} argv
+ * @returns {{flag: string, form: 'inline' | 'separate'} | null}
+ */
+export function findSecretArgument(argv) {
+    if (!Array.isArray(argv)) return null
+
+    for (const [index, arg] of argv.entries()) {
+        if (typeof arg !== 'string' || !arg.startsWith('--')) continue
+
+        const equals = arg.indexOf('=')
+        const name = (equals === -1 ? arg : arg.slice(0, equals)).toLowerCase()
+        if (!SECRET_FLAGS.has(name)) continue
+
+        if (equals !== -1) {
+            // `--password=` with nothing after it carries no value.
+            if (arg.length > equals + 1) return {flag: name, form: 'inline'}
+            continue
+        }
+
+        const next = argv[index + 1]
+        if (next !== undefined && !next.startsWith('-')) return {flag: name, form: 'separate'}
+    }
+
+    return null
+}
+
+/**
+ * Human-facing message for a detected secret argument.
+ *
+ * Leads with the exposure rather than the refusal, because the exposure is the
+ * part the user has to act on and cannot undo.
+ *
+ * @param {{flag: string}} found
+ * @returns {string}
+ */
+export function secretArgumentMessage(found) {
+    return (
+        `nex: refusing to run — a secret was passed on the command line (${found.flag}).\n` +
+        `\nThat value is already in your shell history and was visible in the process\n` +
+        `list while this command started. Treat it as compromised and rotate it.\n` +
+        `\nRemediation: store credentials once instead of passing them per command.\n` +
+        `  now-sdk auth --add <instance>     # add a credential\n` +
+        `  nex auth list                     # see what is stored\n` +
+        `  nex --auth <alias> ...            # select one per command\n` +
+        `\nFor non-interactive use, set the value in the environment rather than argv.\n`
+    )
+}

package/bin/credstore-boot.js

@@ -0,0 +1,67 @@
+/* eslint-disable n/no-process-exit, unicorn/no-process-exit -- this runs before
+   oclif exists, so there is no error handler to throw into; an uncaught rejection
+   here would print a stack trace instead of the remediation. */
+
+/**
+ * Opt in to headless-safe credential storage.
+ *
+ * By default `nex` uses the ServiceNow SDK exactly as it ships: credentials come
+ * from the OS keyring, `now-sdk auth --add` still manages them, and this file
+ * does nothing. That default is deliberate — `nex` must behave identically for
+ * someone who has never heard of sn-credstore.
+ *
+ * Pass `--cred-store` (or set SN_CRED_STORE_ENABLE=1) to redirect the SDK's
+ * credential storage to @sonisoft/sn-credstore instead. That matters when the
+ * keyring cannot be unlocked: over SSH, from a systemd unit, in CI, or from an
+ * agent. In those sessions `KeyChain.getPassword()` swallows the failure and
+ * returns null, so the SDK reports "Default Credential has not been set" — which
+ * is indistinguishable from genuinely having no credentials.
+ *
+ * Imported for its side effect by bin/run.js and bin/dev.js, before oclif.
+ *
+ * The import stays dynamic even though sn-credstore is now a declared
+ * dependency, because it must NOT run unless asked: importing
+ * '@sonisoft/sn-credstore/register' installs the shim as a side effect, so a
+ * static import would install it on every invocation regardless of the flag.
+ *
+ * argv is read directly rather than through oclif's parser because the shim has
+ * to be installed before AuthenticatedCommand.init() resolves credentials, and
+ * that runs before any flag this file cares about has been parsed. The flag is
+ * still declared in AuthenticatedCommand.baseFlags so it appears in --help and
+ * is not rejected as unknown.
+ */
+
+/**
+ * True when the user asked for the credential store.
+ *
+ * SN_CRED_STORE_DISABLE wins over everything, so there is always one variable
+ * that switches the shim off no matter what else is set — including in a shell
+ * where SN_CRED_STORE_ENABLE is exported globally.
+ */
+function credStoreRequested() {
+    if (process.env.SN_CRED_STORE_DISABLE) return false
+    if (process.env.SN_CRED_STORE_ENABLE) return true
+    return process.argv.includes('--cred-store')
+}
+
+if (credStoreRequested()) {
+    try {
+        await import('@sonisoft/sn-credstore/register')
+    } catch (error) {
+        // sn-credstore is a declared dependency now, so there is no "not
+        // installed" case left to tolerate — a failure here is a real failure.
+        //
+        // Continuing would silently fall back to the keyring, which is both the
+        // one thing the user just said not to do and actively unsafe: the SDK's
+        // next credential write reseeds from a failed read, wiping every other
+        // alias. Refusing to start is the safe outcome.
+        process.stderr.write(
+            `nex: the credential store failed to initialise: ${error?.message ?? error}\n` +
+                `${error?.remediation ? `\nRemediation: ${error.remediation}\n` : ''}` +
+                `\nTo run against the OS keyring instead, drop --cred-store.\n`,
+        )
+        process.exit(1)
+    }
+} else if (process.env.SN_CRED_STORE_DEBUG) {
+    process.stderr.write('nex: credential store not requested — using the SDK keyring\n')
+}

package/bin/dev.js

@@ -1,6 +1,14 @@
 #!/usr/bin/env -S node --loader ts-node/esm --disable-warning=ExperimentalWarning
 
+// FIRST, deliberately: refuse to run if a secret was passed in argv, before
+// anything can read, store, or log it. See bin/argv-guard.js.
 // eslint-disable-next-line n/shebang
+import './argv-guard.js'
+
+// THEN: redirect SDK credential storage off the OS keyring before anything can
+// read credentials. See bin/credstore-boot.js.
+import './credstore-boot.js'
+
 import {execute} from '@oclif/core'
 
 await execute({development: true, dir: import.meta.url})

package/bin/run.js

@@ -1,5 +1,13 @@
 #!/usr/bin/env node
 
+// FIRST, deliberately: refuse to run if a secret was passed in argv, before
+// anything can read, store, or log it. See bin/argv-guard.js.
+import './argv-guard.js'
+
+// THEN: redirect SDK credential storage off the OS keyring before anything can
+// read credentials. See bin/credstore-boot.js.
+import './credstore-boot.js'
+
 import {execute} from '@oclif/core'
 
 await execute({dir: import.meta.url})

package/dist/commands/auth/delete.d.ts

@@ -0,0 +1,17 @@
+import { Command } from '@oclif/core';
+export declare class AuthDelete extends Command {
+    static args: {
+        alias: import("@oclif/core/lib/interfaces/parser.js").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: {
+        command: string;
+        description: string;
+    }[];
+    static flags: {
+        all: import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
+        'cred-store': import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=delete.d.ts.map

package/dist/commands/auth/delete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/delete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAO,OAAO,EAAQ,MAAM,aAAa,CAAA;AAKhD,qBAAa,UAAW,SAAQ,OAAO;IACrC,MAAM,CAAC,IAAI;;MAEV;IACH,MAAM,CAAC,WAAW,SAEsE;IACxF,MAAM,CAAC,QAAQ;;;QAGZ;IACH,MAAM,CAAC,KAAK;;;MAGT;IAEK,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAmB3B"}

package/dist/commands/auth/delete.js

@@ -0,0 +1,34 @@
+import { Args, Command, Flags } from '@oclif/core';
+import { deleteAlias, deleteAllAliases } from '@sonisoft/sn-credstore';
+import { credStoreFlag } from '../../common/cred-store-flag.js';
+export class AuthDelete extends Command {
+    static args = {
+        alias: Args.string({ description: 'Alias to remove', required: false }),
+    };
+    static description = 'Remove a credential from the store.\n\n' +
+        'This does not touch the OS keyring — a copy stored there before migrating remains.';
+    static examples = [
+        { command: '<%= config.bin %> <%= command.id %> dev206299', description: 'Remove one alias' },
+        { command: '<%= config.bin %> <%= command.id %> --all', description: 'Remove every stored credential' },
+    ];
+    static flags = {
+        ...credStoreFlag,
+        all: Flags.boolean({ description: 'Remove every stored credential', required: false }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(AuthDelete);
+        if (flags.all) {
+            await deleteAllAliases();
+            this.log('Removed all stored credentials.');
+            return;
+        }
+        if (!args.alias) {
+            this.error('An alias is required, or --all to remove every credential.');
+        }
+        if (!(await deleteAlias(args.alias))) {
+            this.error(`No such alias "${args.alias}".`, { suggestions: ['Run "nex auth list" to see stored aliases.'] });
+        }
+        this.log(`Removed "${args.alias}".`);
+    }
+}
+//# sourceMappingURL=delete.js.map

package/dist/commands/auth/delete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.js","sourceRoot":"","sources":["../../../src/commands/auth/delete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAC,MAAM,aAAa,CAAA;AAChD,OAAO,EAAC,WAAW,EAAE,gBAAgB,EAAC,MAAM,wBAAwB,CAAA;AAEpE,OAAO,EAAC,aAAa,EAAC,MAAM,iCAAiC,CAAA;AAE7D,MAAM,OAAO,UAAW,SAAQ,OAAO;IACrC,MAAM,CAAC,IAAI,GAAG;QACZ,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAC,WAAW,EAAE,iBAAiB,EAAE,QAAQ,EAAE,KAAK,EAAC,CAAC;KACtE,CAAA;IACH,MAAM,CAAC,WAAW,GACd,yCAAyC;QACzC,oFAAoF,CAAA;IACxF,MAAM,CAAC,QAAQ,GAAG;QACd,EAAC,OAAO,EAAE,+CAA+C,EAAE,WAAW,EAAE,kBAAkB,EAAC;QAC3F,EAAC,OAAO,EAAE,2CAA2C,EAAE,WAAW,EAAE,gCAAgC,EAAC;KACtG,CAAA;IACH,MAAM,CAAC,KAAK,GAAG;QACX,GAAG,aAAa;QAChB,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,EAAC,WAAW,EAAE,gCAAgC,EAAE,QAAQ,EAAE,KAAK,EAAC,CAAC;KACrF,CAAA;IAED,KAAK,CAAC,GAAG;QACP,MAAM,EAAC,IAAI,EAAE,KAAK,EAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QAElD,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YACd,MAAM,gBAAgB,EAAE,CAAA;YACxB,IAAI,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAA;YAC3C,OAAM;QACR,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAA;QAC1E,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,KAAK,CAAC,kBAAkB,IAAI,CAAC,KAAK,IAAI,EAAE,EAAC,WAAW,EAAE,CAAC,4CAA4C,CAAC,EAAC,CAAC,CAAA;QAC7G,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,KAAK,IAAI,CAAC,CAAA;IACtC,CAAC"}

package/dist/commands/auth/doctor.d.ts

@@ -0,0 +1,23 @@
+import { Command } from '@oclif/core';
+/**
+ * Diagnose credential storage.
+ *
+ * The failure this exists for is silent: a locked keyring makes
+ * `KeyChain.getPassword()` return null, which the SDK reports as "Default
+ * Credential has not been set" — indistinguishable from having no credentials.
+ * So the first thing to report is whether the shim actually installed.
+ */
+export declare class AuthDoctor extends Command {
+    static args: {};
+    static description: string;
+    static enableJsonFlag: boolean;
+    static examples: {
+        command: string;
+        description: string;
+    }[];
+    static flags: {
+        'cred-store': import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
+    };
+    run(): Promise<unknown>;
+}
+//# sourceMappingURL=doctor.d.ts.map

package/dist/commands/auth/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,OAAO,EAAC,MAAM,aAAa,CAAA;AAKnC;;;;;;;GAOG;AACH,qBAAa,UAAW,SAAQ,OAAO;IACrC,MAAM,CAAC,IAAI,KAAK;IAChB,MAAM,CAAC,WAAW,SAC2F;IAC7G,MAAM,CAAC,cAAc,UAAO;IAC5B,MAAM,CAAC,QAAQ;;;QAGd;IACH,MAAM,CAAC,KAAK;;MAAqB;IAGzB,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;CAsE9B"}

package/dist/commands/auth/doctor.js

@@ -0,0 +1,87 @@
+import { Command } from '@oclif/core';
+import { listAliases, loadConfig, PATCHED_ENV_VAR, probeAll } from '@sonisoft/sn-credstore';
+import { credStoreFlag } from '../../common/cred-store-flag.js';
+/**
+ * Diagnose credential storage.
+ *
+ * The failure this exists for is silent: a locked keyring makes
+ * `KeyChain.getPassword()` return null, which the SDK reports as "Default
+ * Credential has not been set" — indistinguishable from having no credentials.
+ * So the first thing to report is whether the shim actually installed.
+ */
+export class AuthDoctor extends Command {
+    static args = {};
+    static description = 'Diagnose credential storage: whether the SDK shim is active, which backend is in use, and what is stored.';
+    static enableJsonFlag = true;
+    static examples = [
+        { command: '<%= config.bin %> <%= command.id %>', description: 'Check credential storage health' },
+        { command: '<%= config.bin %> <%= command.id %> --json', description: 'Machine-readable output for CI' },
+    ];
+    static flags = { ...credStoreFlag };
+    async run() {
+        await this.parse(AuthDoctor);
+        const config = loadConfig();
+        const shimActive = process.env[PATCHED_ENV_VAR] === '1';
+        const backends = await probeAll(config);
+        // listAliases reads the active backend, so it can legitimately fail (no
+        // systemd in a container, an undecryptable blob after a reimage). That is a
+        // finding to report, not a crash.
+        let summary;
+        let readError;
+        try {
+            summary = await listAliases(config);
+        }
+        catch (error) {
+            readError = error instanceof Error ? error.message : String(error);
+        }
+        const report = {
+            aliases: summary?.aliases ?? [],
+            backends,
+            path: config.blobPath,
+            shimActive,
+            store: config.store,
+            ...(readError ? { readError } : {}),
+        };
+        if (this.jsonEnabled())
+            return report;
+        this.log(`shim active   : ${shimActive ? 'yes' : 'no'}`);
+        if (!shimActive) {
+            // "no" is the DEFAULT, not a fault — the shim is opt-in. The previous
+            // wording ("NO", plus a hint to check SN_CRED_STORE_DISABLE) read as though
+            // something were broken, and pointed at the one variable that is almost
+            // never the reason. Say what to do instead.
+            this.log('');
+            this.log('  The SDK is reading the OS keyring. That is the default and works fine with an');
+            this.log('  interactive desktop session.');
+            this.log('');
+            this.log('  In a headless session — SSH, systemd, CI, an agent — the keyring cannot be');
+            this.log('  unlocked and will report no credentials whatever is stored. To use the store');
+            this.log('  listed below instead, pass --cred-store or set SN_CRED_STORE_ENABLE=1.');
+            if (process.env.SN_CRED_STORE_DISABLE) {
+                this.log('');
+                this.log('  NOTE: SN_CRED_STORE_DISABLE is set, which overrides both of those.');
+            }
+        }
+        this.log(`store         : ${config.store}`);
+        this.log(`path          : ${config.blobPath}`);
+        this.log('');
+        this.log('backends:');
+        for (const backend of backends) {
+            const state = backend.available ? 'available' : 'unavailable';
+            this.log(`  ${backend.id.padEnd(14)} ${state}${backend.error ? ` — ${backend.error}` : ''}`);
+            this.log(`  ${''.padEnd(14)} ${backend.description}`);
+        }
+        this.log('');
+        if (readError) {
+            this.log(`credentials   : COULD NOT READ — ${readError}`);
+        }
+        else {
+            this.log(`credentials   : ${report.aliases.length} stored`);
+            for (const info of report.aliases) {
+                this.log(`  ${info.isDefault ? '*' : ' '} ${info.alias}  (${info.type})  ${info.instanceUrl}`);
+            }
+        }
+        return report;
+    }
+}
+//# sourceMappingURL=doctor.js.map

package/dist/commands/auth/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../../src/commands/auth/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,OAAO,EAAC,MAAM,aAAa,CAAA;AACnC,OAAO,EAAC,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,QAAQ,EAAC,MAAM,wBAAwB,CAAA;AAEzF,OAAO,EAAC,aAAa,EAAC,MAAM,iCAAiC,CAAA;AAE7D;;;;;;;GAOG;AACH,MAAM,OAAO,UAAW,SAAQ,OAAO;IACrC,MAAM,CAAC,IAAI,GAAG,EAAE,CAAA;IAChB,MAAM,CAAC,WAAW,GAChB,2GAA2G,CAAA;IAC7G,MAAM,CAAC,cAAc,GAAG,IAAI,CAAA;IAC5B,MAAM,CAAC,QAAQ,GAAG;QAChB,EAAC,OAAO,EAAE,qCAAqC,EAAE,WAAW,EAAE,iCAAiC,EAAC;QAChG,EAAC,OAAO,EAAE,4CAA4C,EAAE,WAAW,EAAE,gCAAgC,EAAC;KACvG,CAAA;IACH,MAAM,CAAC,KAAK,GAAG,EAAC,GAAG,aAAa,EAAC,CAAA;IAG/B,KAAK,CAAC,GAAG;QACP,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QAE5B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAC3B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,GAAG,CAAA;QACvD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAA;QAEvC,wEAAwE;QACxE,4EAA4E;QAC5E,kCAAkC;QAClC,IAAI,OAAO,CAAA;QACX,IAAI,SAA6B,CAAA;QACjC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACpE,CAAC;QAED,MAAM,MAAM,GAAG;YACb,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE;YAC/B,QAAQ;YACR,IAAI,EAAE,MAAM,CAAC,QAAQ;YACrB,UAAU;YACV,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAC,SAAS,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAClC,CAAA;QAED,IAAI,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,MAAM,CAAA;QAErC,IAAI,CAAC,GAAG,CAAC,mBAAmB,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,sEAAsE;YACtE,4EAA4E;YAC5E,wEAAwE;YACxE,4CAA4C;YAC5C,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACZ,IAAI,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAA;YAC3F,IAAI,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAA;YAC1C,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACZ,IAAI,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAA;YACxF,IAAI,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAA;YAC1F,IAAI,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAA;YACpF,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;gBACtC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;gBACZ,IAAI,CAAC,GAAG,CAAC,sEAAsE,CAAC,CAAA;YAClF,CAAC;QACH,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;QAC3C,IAAI,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC9C,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACZ,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACrB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAA;YAC7D,IAAI,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAC5F,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;QACvD,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACZ,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,GAAG,CAAC,oCAAoC,SAAS,EAAE,CAAC,CAAA;QAC3D,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,MAAM,SAAS,CAAC,CAAA;YAC3D,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBAClC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;YAChG,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC"}

package/dist/commands/auth/list.d.ts

@@ -0,0 +1,15 @@
+import { Command } from '@oclif/core';
+export declare class AuthList extends Command {
+    static args: {};
+    static description: string;
+    static enableJsonFlag: boolean;
+    static examples: {
+        command: string;
+        description: string;
+    }[];
+    static flags: {
+        'cred-store': import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
+    };
+    run(): Promise<unknown>;
+}
+//# sourceMappingURL=list.d.ts.map

package/dist/commands/auth/list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,OAAO,EAAC,MAAM,aAAa,CAAA;AAKnC,qBAAa,QAAS,SAAQ,OAAO;IACnC,MAAM,CAAC,IAAI,KAAK;IAChB,MAAM,CAAC,WAAW,SAIY;IAC9B,MAAM,CAAC,cAAc,UAAO;IAC5B,MAAM,CAAC,QAAQ;;;QAGd;IACH,MAAM,CAAC,KAAK;;MAAqB;IAGzB,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;CAiC9B"}

package/dist/commands/auth/list.js

@@ -0,0 +1,42 @@
+import { Command } from '@oclif/core';
+import { listAliases } from '@sonisoft/sn-credstore';
+import { credStoreFlag } from '../../common/cred-store-flag.js';
+export class AuthList extends Command {
+    static args = {};
+    static description = 'List credentials in the headless-safe credential store.\n\n' +
+        'These are the credentials the ServiceNow SDK reads via the sn-credstore shim, ' +
+        'which works in non-interactive sessions where the OS keyring cannot be unlocked.\n\n' +
+        'Secrets are never printed.';
+    static enableJsonFlag = true;
+    static examples = [
+        { command: '<%= config.bin %> <%= command.id %>', description: 'List stored credentials' },
+        { command: '<%= config.bin %> <%= command.id %> --json', description: 'List as JSON for scripting' },
+    ];
+    static flags = { ...credStoreFlag };
+    async run() {
+        await this.parse(AuthList);
+        const summary = await listAliases();
+        if (this.jsonEnabled())
+            return summary;
+        this.log(summary.description);
+        this.log('');
+        if (summary.aliases.length === 0) {
+            this.log('No credentials stored.');
+            this.log('');
+            this.log('Import existing ones:  sn-credstore import --from keyring');
+            this.log('Or add a new one:      now-sdk-x auth --add <instance>');
+            return summary;
+        }
+        for (const info of summary.aliases) {
+            this.log(`${info.isDefault ? '*' : ' '} ${info.alias}`);
+            this.log(`      host = ${info.instanceUrl}`);
+            this.log(`      type = ${info.type}`);
+            this.log(info.type === 'basic'
+                ? `      username = ${info.username}`
+                : // Expired is not an error worth flagging red: the next use refreshes it.
+                    `      expires = ${new Date(info.expiresAt * 1000).toISOString()}${info.expired ? '  (EXPIRED — refreshes on next use)' : ''}`);
+        }
+        return summary;
+    }
+}
+//# sourceMappingURL=list.js.map

package/dist/commands/auth/list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../../../src/commands/auth/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,OAAO,EAAC,MAAM,aAAa,CAAA;AACnC,OAAO,EAAC,WAAW,EAAC,MAAM,wBAAwB,CAAA;AAElD,OAAO,EAAC,aAAa,EAAC,MAAM,iCAAiC,CAAA;AAE7D,MAAM,OAAO,QAAS,SAAQ,OAAO;IACnC,MAAM,CAAC,IAAI,GAAG,EAAE,CAAA;IAChB,MAAM,CAAC,WAAW,GAChB,6DAA6D;QAC7D,gFAAgF;QAChF,sFAAsF;QACtF,4BAA4B,CAAA;IAC9B,MAAM,CAAC,cAAc,GAAG,IAAI,CAAA;IAC5B,MAAM,CAAC,QAAQ,GAAG;QAChB,EAAC,OAAO,EAAE,qCAAqC,EAAE,WAAW,EAAE,yBAAyB,EAAC;QACxF,EAAC,OAAO,EAAE,4CAA4C,EAAE,WAAW,EAAE,4BAA4B,EAAC;KACnG,CAAA;IACH,MAAM,CAAC,KAAK,GAAG,EAAC,GAAG,aAAa,EAAC,CAAA;IAG/B,KAAK,CAAC,GAAG;QACP,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC1B,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAA;QAEnC,IAAI,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,OAAO,CAAA;QAEtC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAC7B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAEZ,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAA;YAClC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACZ,IAAI,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAA;YACrE,IAAI,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAA;YAClE,OAAO,OAAO,CAAA;QAChB,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;YACvD,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;YAC5C,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;YACrC,IAAI,CAAC,GAAG,CACN,IAAI,CAAC,IAAI,KAAK,OAAO;gBACnB,CAAC,CAAC,oBAAoB,IAAI,CAAC,QAAQ,EAAE;gBACrC,CAAC,CAAC,yEAAyE;oBACzE,mBAAmB,IAAI,IAAI,CAAC,IAAI,CAAC,SAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,GAC/D,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,EACzD,EAAE,CACP,CAAA;QACH,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC"}

package/dist/commands/auth/use.d.ts

@@ -0,0 +1,16 @@
+import { Command } from '@oclif/core';
+export declare class AuthUse extends Command {
+    static args: {
+        alias: import("@oclif/core/lib/interfaces/parser.js").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: {
+        command: string;
+        description: string;
+    }[];
+    static flags: {
+        'cred-store': import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=use.d.ts.map

package/dist/commands/auth/use.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/use.ts"],"names":[],"mappings":"AAAA,OAAO,EAAO,OAAO,EAAC,MAAM,aAAa,CAAA;AAKzC,qBAAa,OAAQ,SAAQ,OAAO;IAClC,MAAM,CAAC,IAAI;;MAEV;IACH,MAAM,CAAC,WAAW,SAE+B;IACjD,MAAM,CAAC,QAAQ;;;QAA0G;IACzH,MAAM,CAAC,KAAK;;MAAqB;IAEzB,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAS3B"}

package/dist/commands/auth/use.js

@@ -0,0 +1,20 @@
+import { Args, Command } from '@oclif/core';
+import { setDefaultAlias } from '@sonisoft/sn-credstore';
+import { credStoreFlag } from '../../common/cred-store-flag.js';
+export class AuthUse extends Command {
+    static args = {
+        alias: Args.string({ description: 'Alias to make the default', required: true }),
+    };
+    static description = 'Set the default credential alias.\n\n' +
+        'Commands run without --auth use this alias.';
+    static examples = [{ command: '<%= config.bin %> <%= command.id %> dev206299', description: 'Make dev206299 the default' }];
+    static flags = { ...credStoreFlag };
+    async run() {
+        const { args } = await this.parse(AuthUse);
+        if (!(await setDefaultAlias(args.alias))) {
+            this.error(`No such alias "${args.alias}".`, { suggestions: ['Run "nex auth list" to see stored aliases.'] });
+        }
+        this.log(`Default alias is now "${args.alias}"`);
+    }
+}
+//# sourceMappingURL=use.js.map

package/dist/commands/auth/use.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"use.js","sourceRoot":"","sources":["../../../src/commands/auth/use.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,IAAI,EAAE,OAAO,EAAC,MAAM,aAAa,CAAA;AACzC,OAAO,EAAC,eAAe,EAAC,MAAM,wBAAwB,CAAA;AAEtD,OAAO,EAAC,aAAa,EAAC,MAAM,iCAAiC,CAAA;AAE7D,MAAM,OAAO,OAAQ,SAAQ,OAAO;IAClC,MAAM,CAAC,IAAI,GAAG;QACZ,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAC,WAAW,EAAE,2BAA2B,EAAE,QAAQ,EAAE,IAAI,EAAC,CAAC;KAC/E,CAAA;IACH,MAAM,CAAC,WAAW,GACd,uCAAuC;QACvC,6CAA6C,CAAA;IACjD,MAAM,CAAC,QAAQ,GAAG,CAAC,EAAC,OAAO,EAAE,+CAA+C,EAAE,WAAW,EAAE,4BAA4B,EAAC,CAAC,CAAA;IACzH,MAAM,CAAC,KAAK,GAAG,EAAC,GAAG,aAAa,EAAC,CAAA;IAE/B,KAAK,CAAC,GAAG;QACP,MAAM,EAAC,IAAI,EAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAExC,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,KAAK,CAAC,kBAAkB,IAAI,CAAC,KAAK,IAAI,EAAE,EAAC,WAAW,EAAE,CAAC,4CAA4C,CAAC,EAAC,CAAC,CAAA;QAC7G,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,yBAAyB,IAAI,CAAC,KAAK,GAAG,CAAC,CAAA;IAClD,CAAC"}

package/dist/common/authenticated-command.d.ts

@@ -5,6 +5,7 @@ export type Args<T extends typeof Command> = Interfaces.InferredArgs<T['args']>;
 export declare abstract class AuthenticatedCommand<T extends typeof Command> extends Command {
     static baseFlags: {
         auth: Interfaces.OptionFlag<string | undefined, Interfaces.CustomOptions>;
+        'cred-store': Interfaces.BooleanFlag<boolean>;
         'log-level': Interfaces.OptionFlag<"info" | "debug" | "warn" | "error" | "trace", Interfaces.CustomOptions>;
     };
     static enableJsonFlag: boolean;
@@ -20,5 +21,14 @@ export declare abstract class AuthenticatedCommand<T extends typeof Command> ext
     }): Promise<any>;
     protected finally(_: Error | undefined): Promise<any>;
     init(): Promise<void>;
+    /**
+     * Fail with remediation the user can act on.
+     *
+     * The keyring failure mode this guards against is silent: in a non-interactive
+     * session the keyring cannot be unlocked, `KeyChain.getPassword()` swallows the
+     * error and returns null, and the SDK reports it as "no credentials" — which is
+     * indistinguishable from genuinely having none. So say which of the two it is.
+     */
+    private failAuth;
 }
 //# sourceMappingURL=authenticated-command.d.ts.map

package/dist/common/authenticated-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authenticated-command.d.ts","sourceRoot":"","sources":["../../src/common/authenticated-command.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAS,UAAU,EAAE,MAAM,aAAa,CAAA;AAExD,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAA8B,MAAM,4BAA4B,CAAC;AAMpG,MAAM,MAAM,KAAK,CAAC,CAAC,SAAS,OAAO,OAAO,IAAI,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,OAAO,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAA;AAC7H,MAAM,MAAM,IAAI,CAAC,CAAC,SAAS,OAAO,OAAO,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;AAE/E,8BAAsB,oBAAoB,CAAC,CAAC,SAAS,OAAO,OAAO,CAAE,SAAQ,OAAO;IAElF,MAAM,CAAC,SAAS;;;MASf;IAEC,MAAM,CAAC,cAAc,UAAO;IAChC,SAAS,CAAC,OAAO,EAAG,MAAM,CAAC;IACvB,SAAS,CAAC,IAAI,EAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,KAAK,EAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,SAAS,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IAEnC,IAAW,MAAM,IAAI,MAAM,CAE1B;IAED,IAAW,MAAM,CAAC,MAAM,EAAE,MAAM,EAE/B;cAEa,KAAK,CAAC,GAAG,EAAE,KAAK,GAAG;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAC,GAAG,OAAO,CAAC,GAAG,CAAC;cAQrD,OAAO,CAAC,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC;IAK9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAwCnC"}
+{"version":3,"file":"authenticated-command.d.ts","sourceRoot":"","sources":["../../src/common/authenticated-command.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAS,UAAU,EAAE,MAAM,aAAa,CAAA;AAExD,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAA8B,MAAM,4BAA4B,CAAC;AAMpG,MAAM,MAAM,KAAK,CAAC,CAAC,SAAS,OAAO,OAAO,IAAI,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,OAAO,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAA;AAC7H,MAAM,MAAM,IAAI,CAAC,CAAC,SAAS,OAAO,OAAO,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;AAE/E,8BAAsB,oBAAoB,CAAC,CAAC,SAAS,OAAO,OAAO,CAAE,SAAQ,OAAO;IAElF,MAAM,CAAC,SAAS;;;;MAmBf;IAEC,MAAM,CAAC,cAAc,UAAO;IAChC,SAAS,CAAC,OAAO,EAAG,MAAM,CAAC;IACvB,SAAS,CAAC,IAAI,EAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,KAAK,EAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,SAAS,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IAEnC,IAAW,MAAM,IAAI,MAAM,CAE1B;IAED,IAAW,MAAM,CAAC,MAAM,EAAE,MAAM,EAE/B;cAEa,KAAK,CAAC,GAAG,EAAE,KAAK,GAAG;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAC,GAAG,OAAO,CAAC,GAAG,CAAC;cAUrD,OAAO,CAAC,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC;IAK9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAuDlC;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ;CA0BjB"}