Use the CLI in scripts

For first-time connection setup, see non-interactive context creation. Every choice has an explicit flag, including login and default scope.

Prerequisite: a configured context and credentials in the runner's explicitly configured credential backend. Use an explicit context/tenant and machine output; do not parse aligned human tables.

tsm --context dev --tenant default app entity types --json > entity-types.json
tsm --context dev app forms capabilities -o yaml > capabilities.yaml

JSON/YAML contain full data and no ANSI colors, including when human color is enabled. Diagnostics go to stderr. Exit0 means success; exit10 is invalid usage/configuration; other nonzero codes report remote/domain/partial failures according to the command. Preserve both the exit code and result for diagnosis. A failed validation can still return a useful structured report.

Do not depend on ambient TSM_URL/TSM_ENV overrides; use registered contexts. Avoid credentials in checked-in YAML, shell history or CI logs. OS vault is default; encrypted file/memory storage is an explicit separate configuration. Use tsm auth status for recorded account metadata and auth whoami for online identity.