@kolatts/pncli 1.0.1 → 1.2.0

package/dist/cli.js

@@ -19,17 +19,40 @@ var PncliError = class extends Error {
   }
 };
 
+// src/lib/exitCodes.ts
+var ExitCode = {
+  SUCCESS: 0,
+  GENERAL_ERROR: 1,
+  USAGE_ERROR: 2,
+  NETWORK_ERROR: 69,
+  // EX_UNAVAILABLE from sysexits.h
+  AUTH_ERROR: 77,
+  // EX_NOPERM from sysexits.h
+  CONFIG_ERROR: 78
+  // EX_CONFIG from sysexits.h
+};
+function exitCodeFromStatus(httpStatus) {
+  if (httpStatus === 401 || httpStatus === 403) return ExitCode.AUTH_ERROR;
+  if (httpStatus === 0) return ExitCode.NETWORK_ERROR;
+  return ExitCode.GENERAL_ERROR;
+}
+
 // src/lib/output.ts
 var globalOptions = { pretty: false, verbose: false };
+var globalUser = { email: void 0, userId: void 0 };
 function setGlobalOptions(opts) {
   globalOptions = opts;
 }
+function setGlobalUser(user) {
+  globalUser = user;
+}
 function buildMeta(service, action, startTime) {
   return {
     service,
     action,
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    duration_ms: Date.now() - startTime
+    duration_ms: Date.now() - startTime,
+    user: globalUser.email ?? globalUser.userId ? globalUser : void 0
   };
 }
 function success(data, service, action, startTime) {
@@ -55,10 +78,10 @@ function fail(err, service, action, startTime) {
   };
   const msg = globalOptions.pretty ? chalk.red("\u2717 Error: ") + errorDetail.message : null;
   if (msg) process.stderr.write(msg + "\n");
-  process.stdout.write(
-    (globalOptions.pretty ? JSON.stringify(envelope, null, 2) : JSON.stringify(envelope)) + "\n"
-  );
-  process.exit(1);
+  const output = (globalOptions.pretty ? JSON.stringify(envelope, null, 2) : JSON.stringify(envelope)) + "\n";
+  const exitCode = err instanceof PncliError ? exitCodeFromStatus(err.status) : ExitCode.GENERAL_ERROR;
+  process.stdout.write(output, () => process.exit(exitCode));
+  throw new PncliError(errorDetail.message, errorDetail.status);
 }
 function log(message) {
   if (globalOptions.verbose) {
@@ -73,11 +96,143 @@ function warn(message) {
   );
 }
 
+// src/lib/config.ts
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { execSync } from "child_process";
+var ENV_KEYS = {
+  EMAIL: "PNCLI_EMAIL",
+  USERID: "PNCLI_USERID",
+  JIRA_BASE_URL: "PNCLI_JIRA_BASE_URL",
+  JIRA_API_TOKEN: "PNCLI_JIRA_API_TOKEN",
+  BITBUCKET_BASE_URL: "PNCLI_BITBUCKET_BASE_URL",
+  BITBUCKET_PAT: "PNCLI_BITBUCKET_PAT",
+  ARTIFACTORY_BASE_URL: "PNCLI_ARTIFACTORY_BASE_URL",
+  ARTIFACTORY_TOKEN: "PNCLI_ARTIFACTORY_TOKEN",
+  ARTIFACTORY_REPO_NPM: "PNCLI_ARTIFACTORY_REPO_NPM",
+  ARTIFACTORY_REPO_NUGET: "PNCLI_ARTIFACTORY_REPO_NUGET",
+  ARTIFACTORY_REPO_MAVEN: "PNCLI_ARTIFACTORY_REPO_MAVEN",
+  CONFIG_PATH: "PNCLI_CONFIG_PATH"
+};
+function getGlobalConfigPath(overridePath) {
+  if (overridePath) return overridePath;
+  const envPath = process.env[ENV_KEYS.CONFIG_PATH];
+  if (envPath) return envPath;
+  return path.join(os.homedir(), ".pncli", "config.json");
+}
+function loadJsonFile(filePath) {
+  try {
+    const content = fs.readFileSync(filePath, "utf8");
+    return JSON.parse(content);
+  } catch {
+    return null;
+  }
+}
+function getRepoRoot() {
+  try {
+    return execSync("git rev-parse --show-toplevel", { encoding: "utf8" }).trim();
+  } catch {
+    return null;
+  }
+}
+function mergeCustomFields(global, repo) {
+  const map = /* @__PURE__ */ new Map();
+  for (const f of global ?? []) map.set(f.id, f);
+  for (const f of repo ?? []) map.set(f.id, f);
+  return Array.from(map.values());
+}
+function mergeDefaults(global, repo) {
+  return {
+    jira: { ...global?.jira, ...repo?.jira },
+    bitbucket: { ...global?.bitbucket, ...repo?.bitbucket }
+  };
+}
+function loadConfig(opts = {}) {
+  const globalConfigPath = getGlobalConfigPath(opts.configPath);
+  const globalConfig = loadJsonFile(globalConfigPath) ?? {};
+  const repoRoot = getRepoRoot();
+  let repoConfig = {};
+  if (repoRoot) {
+    repoConfig = loadJsonFile(path.join(repoRoot, ".pncli.json")) ?? {};
+  }
+  const mergedDefaults = mergeDefaults(globalConfig.defaults, repoConfig.defaults);
+  return {
+    user: {
+      email: process.env[ENV_KEYS.EMAIL] ?? globalConfig.user?.email,
+      userId: process.env[ENV_KEYS.USERID] ?? globalConfig.user?.userId
+    },
+    jira: {
+      baseUrl: process.env[ENV_KEYS.JIRA_BASE_URL] ?? globalConfig.jira?.baseUrl,
+      apiToken: process.env[ENV_KEYS.JIRA_API_TOKEN] ?? globalConfig.jira?.apiToken,
+      customFields: mergeCustomFields(globalConfig.jira?.customFields, repoConfig.jira?.customFields)
+    },
+    bitbucket: {
+      baseUrl: process.env[ENV_KEYS.BITBUCKET_BASE_URL] ?? globalConfig.bitbucket?.baseUrl,
+      pat: process.env[ENV_KEYS.BITBUCKET_PAT] ?? globalConfig.bitbucket?.pat
+    },
+    artifactory: {
+      baseUrl: process.env[ENV_KEYS.ARTIFACTORY_BASE_URL] ?? globalConfig.artifactory?.baseUrl,
+      token: process.env[ENV_KEYS.ARTIFACTORY_TOKEN] ?? globalConfig.artifactory?.token,
+      npmRepo: process.env[ENV_KEYS.ARTIFACTORY_REPO_NPM] ?? globalConfig.artifactory?.npmRepo,
+      nugetRepo: process.env[ENV_KEYS.ARTIFACTORY_REPO_NUGET] ?? globalConfig.artifactory?.nugetRepo,
+      mavenRepo: process.env[ENV_KEYS.ARTIFACTORY_REPO_MAVEN] ?? globalConfig.artifactory?.mavenRepo
+    },
+    defaults: mergedDefaults
+  };
+}
+function writeGlobalConfig(config, configPath) {
+  const filePath = getGlobalConfigPath(configPath);
+  const dir = path.dirname(filePath);
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true });
+  }
+  fs.writeFileSync(filePath, JSON.stringify(config, null, 2) + "\n", "utf8");
+}
+function writeRepoConfig(config) {
+  const repoRoot = getRepoRoot();
+  const targetDir = repoRoot ?? process.cwd();
+  fs.writeFileSync(path.join(targetDir, ".pncli.json"), JSON.stringify(config, null, 2) + "\n", "utf8");
+}
+function setConfigValue(key, value, configPath) {
+  const filePath = getGlobalConfigPath(configPath);
+  const existing = loadJsonFile(filePath) ?? {};
+  const parts = key.split(".");
+  let current = existing;
+  for (let i = 0; i < parts.length - 1; i++) {
+    const part = parts[i];
+    if (typeof current[part] !== "object" || current[part] === null) {
+      current[part] = {};
+    }
+    current = current[part];
+  }
+  current[parts[parts.length - 1]] = value;
+  writeGlobalConfig(existing, configPath);
+}
+function maskConfig(config) {
+  return {
+    ...config,
+    jira: {
+      ...config.jira,
+      apiToken: config.jira.apiToken ? "***" : void 0,
+      customFields: config.jira.customFields
+    },
+    bitbucket: {
+      ...config.bitbucket,
+      pat: config.bitbucket.pat ? "***" : void 0
+    },
+    artifactory: {
+      ...config.artifactory,
+      token: config.artifactory.token ? "***" : void 0
+    }
+  };
+}
+
 // src/services/git/client.ts
-import { execSync, execFileSync } from "child_process";
+import { execSync as execSync2, execFileSync } from "child_process";
 var DIFF_LINE_LIMIT = 5e3;
 function exec(cmd, cwd) {
-  return execSync(cmd, { encoding: "utf8", cwd }).trim();
+  return execSync2(cmd, { encoding: "utf8", cwd }).trim();
 }
 function getStatus(root) {
   const output = exec("git status --porcelain", root);
@@ -209,17 +364,17 @@ function getBranches(root) {
 }
 
 // src/lib/git-context.ts
-import { execSync as execSync2 } from "child_process";
-function getRepoRoot() {
+import { execSync as execSync3 } from "child_process";
+function getRepoRoot2() {
   try {
-    return execSync2("git rev-parse --show-toplevel", { encoding: "utf8" }).trim();
+    return execSync3("git rev-parse --show-toplevel", { encoding: "utf8" }).trim();
   } catch {
     return null;
   }
 }
 function getCurrentBranch(repoRoot) {
   try {
-    return execSync2("git rev-parse --abbrev-ref HEAD", {
+    return execSync3("git rev-parse --abbrev-ref HEAD", {
       encoding: "utf8",
       cwd: repoRoot
     }).trim();
@@ -248,14 +403,14 @@ function parseRemote(remoteUrl, bitbucketBaseUrl) {
 }
 function getRemoteUrls(repoRoot) {
   try {
-    const output = execSync2("git remote -v", { encoding: "utf8", cwd: repoRoot });
+    const output = execSync3("git remote -v", { encoding: "utf8", cwd: repoRoot });
     return output.split("\n").filter((line) => line.includes("(fetch)")).map((line) => line.split("	")[1]?.split(" ")[0] ?? "").filter(Boolean);
   } catch {
     return [];
   }
 }
 function getGitContext(config) {
-  const root = getRepoRoot();
+  const root = getRepoRoot2();
   if (!root) return null;
   const branch = getCurrentBranch(root) ?? "unknown";
   const remoteUrls = getRemoteUrls(root);
@@ -272,113 +427,9 @@ function getGitContext(config) {
   return { root, branch, project, repo };
 }
 
-// src/lib/config.ts
-import fs from "fs";
-import os from "os";
-import path from "path";
-import { execSync as execSync3 } from "child_process";
-var ENV_KEYS = {
-  JIRA_BASE_URL: "PNCLI_JIRA_BASE_URL",
-  JIRA_EMAIL: "PNCLI_JIRA_EMAIL",
-  JIRA_API_TOKEN: "PNCLI_JIRA_API_TOKEN",
-  BITBUCKET_BASE_URL: "PNCLI_BITBUCKET_BASE_URL",
-  BITBUCKET_PAT: "PNCLI_BITBUCKET_PAT",
-  CONFIG_PATH: "PNCLI_CONFIG_PATH"
-};
-function getGlobalConfigPath(overridePath) {
-  if (overridePath) return overridePath;
-  const envPath = process.env[ENV_KEYS.CONFIG_PATH];
-  if (envPath) return envPath;
-  return path.join(os.homedir(), ".pncli", "config.json");
-}
-function loadJsonFile(filePath) {
-  try {
-    const content = fs.readFileSync(filePath, "utf8");
-    return JSON.parse(content);
-  } catch {
-    return null;
-  }
-}
-function getRepoRoot2() {
-  try {
-    return execSync3("git rev-parse --show-toplevel", { encoding: "utf8" }).trim();
-  } catch {
-    return null;
-  }
-}
-function mergeDefaults(global, repo) {
-  return {
-    jira: { ...global?.jira, ...repo?.jira },
-    bitbucket: { ...global?.bitbucket, ...repo?.bitbucket }
-  };
-}
-function loadConfig(opts = {}) {
-  const globalConfigPath = getGlobalConfigPath(opts.configPath);
-  const globalConfig = loadJsonFile(globalConfigPath) ?? {};
-  const repoRoot = getRepoRoot2();
-  let repoConfig = {};
-  if (repoRoot) {
-    repoConfig = loadJsonFile(path.join(repoRoot, ".pncli.json")) ?? {};
-  }
-  const mergedDefaults = mergeDefaults(globalConfig.defaults, repoConfig.defaults);
-  return {
-    jira: {
-      baseUrl: process.env[ENV_KEYS.JIRA_BASE_URL] ?? globalConfig.jira?.baseUrl,
-      email: process.env[ENV_KEYS.JIRA_EMAIL] ?? globalConfig.jira?.email,
-      apiToken: process.env[ENV_KEYS.JIRA_API_TOKEN] ?? globalConfig.jira?.apiToken
-    },
-    bitbucket: {
-      baseUrl: process.env[ENV_KEYS.BITBUCKET_BASE_URL] ?? globalConfig.bitbucket?.baseUrl,
-      pat: process.env[ENV_KEYS.BITBUCKET_PAT] ?? globalConfig.bitbucket?.pat
-    },
-    defaults: mergedDefaults
-  };
-}
-function writeGlobalConfig(config, configPath) {
-  const filePath = getGlobalConfigPath(configPath);
-  const dir = path.dirname(filePath);
-  if (!fs.existsSync(dir)) {
-    fs.mkdirSync(dir, { recursive: true });
-  }
-  fs.writeFileSync(filePath, JSON.stringify(config, null, 2) + "\n", "utf8");
-}
-function writeRepoConfig(config) {
-  const repoRoot = getRepoRoot2();
-  const targetDir = repoRoot ?? process.cwd();
-  fs.writeFileSync(path.join(targetDir, ".pncli.json"), JSON.stringify(config, null, 2) + "\n", "utf8");
-}
-function setConfigValue(key, value, configPath) {
-  const filePath = getGlobalConfigPath(configPath);
-  const existing = loadJsonFile(filePath) ?? {};
-  const parts = key.split(".");
-  let current = existing;
-  for (let i = 0; i < parts.length - 1; i++) {
-    const part = parts[i];
-    if (typeof current[part] !== "object" || current[part] === null) {
-      current[part] = {};
-    }
-    current = current[part];
-  }
-  current[parts[parts.length - 1]] = value;
-  writeGlobalConfig(existing, configPath);
-}
-function maskConfig(config) {
-  return {
-    ...config,
-    jira: {
-      ...config.jira,
-      apiToken: config.jira.apiToken ? "***" : void 0
-    },
-    bitbucket: {
-      ...config.bitbucket,
-      pat: config.bitbucket.pat ? "***" : void 0
-    }
-  };
-}
-
 // src/lib/http.ts
-function buildUrl(base, path2, params) {
-  const url = new URL(path2, base.endsWith("/") ? base : base + "/");
+function buildUrl(base, path6, params) {
+  const url = new URL(path6, base.endsWith("/") ? base : base + "/");
   if (params) {
     for (const [key, val] of Object.entries(params)) {
       if (val !== void 0) {
@@ -423,8 +474,24 @@ async function request(url, init, timeoutMs) {
       try {
         const body = await response.text();
         const parsed = JSON.parse(body);
-        if (parsed.message) message = parsed.message;
-        else if (parsed.errors?.[0]?.message) message = parsed.errors[0].message;
+        const parts = [];
+        if (Array.isArray(parsed.errorMessages)) {
+          parts.push(...parsed.errorMessages.filter(Boolean));
+        }
+        if (parsed.errors && typeof parsed.errors === "object" && !Array.isArray(parsed.errors)) {
+          for (const [field, msg] of Object.entries(parsed.errors)) {
+            parts.push(`${field}: ${msg}`);
+          }
+        }
+        if (Array.isArray(parsed.errors)) {
+          for (const e of parsed.errors) {
+            if (e?.message) parts.push(e.message);
+          }
+        }
+        if (parts.length === 0 && parsed.message) {
+          parts.push(String(parsed.message));
+        }
+        if (parts.length > 0) message = parts.join("; ");
       } catch {
       }
       throw new PncliError(message, response.status, url);
@@ -444,13 +511,13 @@ var HttpClient = class {
     this.dryRun = dryRun;
   }
   jiraHeaders() {
-    const { email, apiToken } = this.config.jira;
-    if (!email || !apiToken) throw new PncliError("Jira credentials not configured. Run: pncli config init");
-    const token = Buffer.from(`${email}:${apiToken}`).toString("base64");
+    const { apiToken } = this.config.jira;
+    if (!apiToken) throw new PncliError("Jira credentials not configured. Run: pncli config init");
     return {
-      "Authorization": `Basic ${token}`,
+      "Authorization": `Bearer ${apiToken}`,
       "Content-Type": "application/json",
-      "Accept": "application/json"
+      "Accept": "application/json",
+      "Connection": "close"
     };
   }
   bitbucketHeaders() {
@@ -459,13 +526,14 @@ var HttpClient = class {
     return {
       "Authorization": `Bearer ${pat}`,
       "Content-Type": "application/json",
-      "Accept": "application/json"
+      "Accept": "application/json",
+      "Connection": "close"
     };
   }
-  async jira(path2, opts = {}) {
+  async jira(path6, opts = {}) {
     const baseUrl = this.config.jira.baseUrl;
     if (!baseUrl) throw new PncliError("Jira baseUrl not configured. Run: pncli config init");
-    const url = buildUrl(baseUrl, path2, opts.params);
+    const url = buildUrl(baseUrl, path6, opts.params);
     const headers = this.jiraHeaders();
     const init = {
       method: opts.method ?? "GET",
@@ -474,19 +542,20 @@ var HttpClient = class {
     };
     if (this.dryRun) {
       const safeHeaders = { ...headers, Authorization: "[REDACTED]" };
-      process.stderr.write(`DRY RUN: ${init.method} ${url}
+      const msg = `DRY RUN: ${init.method} ${url}
 Headers: ${JSON.stringify(safeHeaders, null, 2)}
-`);
-      if (opts.body) process.stderr.write(`Body: ${JSON.stringify(opts.body, null, 2)}
-`);
-      process.exit(0);
+` + (opts.body ? `Body: ${JSON.stringify(opts.body, null, 2)}
+` : "");
+      process.stderr.write(msg, () => process.exit(ExitCode.SUCCESS));
+      return new Promise(() => {
+      });
     }
     return request(url, init, opts.timeoutMs ?? 3e4);
   }
-  async bitbucket(path2, opts = {}) {
+  async bitbucket(path6, opts = {}) {
     const baseUrl = this.config.bitbucket.baseUrl;
     if (!baseUrl) throw new PncliError("Bitbucket baseUrl not configured. Run: pncli config init");
-    const url = buildUrl(baseUrl, path2, opts.params);
+    const url = buildUrl(baseUrl, path6, opts.params);
     const headers = this.bitbucketHeaders();
     const init = {
       method: opts.method ?? "GET",
@@ -495,12 +564,13 @@ Headers: ${JSON.stringify(safeHeaders, null, 2)}
     };
     if (this.dryRun) {
       const safeHeaders = { ...headers, Authorization: "[REDACTED]" };
-      process.stderr.write(`DRY RUN: ${init.method} ${url}
+      const msg = `DRY RUN: ${init.method} ${url}
 Headers: ${JSON.stringify(safeHeaders, null, 2)}
-`);
-      if (opts.body) process.stderr.write(`Body: ${JSON.stringify(opts.body, null, 2)}
-`);
-      process.exit(0);
+` + (opts.body ? `Body: ${JSON.stringify(opts.body, null, 2)}
+` : "");
+      process.stderr.write(msg, () => process.exit(ExitCode.SUCCESS));
+      return new Promise(() => {
+      });
     }
     return request(url, init, opts.timeoutMs ?? 3e4);
   }
@@ -724,7 +794,7 @@ var BitbucketClient = class {
 
 // src/services/git/commands.ts
 function requireRepoRoot() {
-  const root = getRepoRoot();
+  const root = getRepoRoot2();
   if (!root) throw new PncliError("Not a git repository", 1);
   return root;
 }
@@ -804,7 +874,7 @@ function registerGitCommands(program2) {
 }
 
 // src/services/jira/client.ts
-var API2 = "/rest/api/3";
+var API2 = "/rest/api/2";
 var JiraClient = class {
   constructor(http) {
     this.http = http;
@@ -819,16 +889,11 @@ var JiraClient = class {
         project: { key: opts.project },
         issuetype: { name: opts.issueType },
         summary: opts.summary,
-        ...opts.description ? {
-          description: {
-            type: "doc",
-            version: 1,
-            content: [{ type: "paragraph", content: [{ type: "text", text: opts.description }] }]
-          }
-        } : {},
+        ...opts.description ? { description: opts.description } : {},
         ...opts.priority ? { priority: { name: opts.priority } } : {},
-        ...opts.assignee ? { assignee: { accountId: opts.assignee } } : {},
-        ...opts.labels?.length ? { labels: opts.labels } : {}
+        ...opts.assignee ? { assignee: { name: opts.assignee } } : {},
+        ...opts.labels?.length ? { labels: opts.labels } : {},
+        ...opts.customFieldValues ?? {}
       }
     };
     const created = await this.http.jira(`${API2}/issue`, {
@@ -840,16 +905,11 @@ var JiraClient = class {
   async updateIssue(key, opts) {
     const fields = {};
     if (opts.summary) fields.summary = opts.summary;
-    if (opts.description) {
-      fields.description = {
-        type: "doc",
-        version: 1,
-        content: [{ type: "paragraph", content: [{ type: "text", text: opts.description }] }]
-      };
-    }
+    if (opts.description) fields.description = opts.description;
     if (opts.priority) fields.priority = { name: opts.priority };
-    if (opts.assignee) fields.assignee = { accountId: opts.assignee };
+    if (opts.assignee) fields.assignee = { name: opts.assignee };
     if (opts.labels) fields.labels = opts.labels;
+    Object.assign(fields, opts.customFieldValues ?? {});
     await this.http.jira(`${API2}/issue/${key}`, {
       method: "PUT",
       body: { fields }
@@ -870,13 +930,7 @@ var JiraClient = class {
   async addComment(key, text) {
     return this.http.jira(`${API2}/issue/${key}/comment`, {
       method: "POST",
-      body: {
-        body: {
-          type: "doc",
-          version: 1,
-          content: [{ type: "paragraph", content: [{ type: "text", text }] }]
-        }
-      }
+      body: { body: text }
     });
   }
   async listComments(key) {
@@ -888,22 +942,27 @@ var JiraClient = class {
       return { ...result, values: result.comments };
     });
   }
-  async search(jql, maxResults) {
+  async search(jql, maxResults, customFields) {
+    const standardFields = ["summary", "status", "priority", "assignee", "issuetype", "project", "created", "updated", "labels", "reporter"];
+    const fields = customFields?.length ? [...standardFields, ...customFields.map((f) => f.id)] : standardFields;
     if (maxResults !== void 0) {
       return this.http.jira(`${API2}/search`, {
         method: "POST",
-        body: { jql, maxResults, fields: ["summary", "status", "priority", "assignee", "issuetype", "project", "created", "updated", "labels", "reporter"] }
+        body: { jql, maxResults, fields }
       });
     }
     const allIssues = await this.http.jiraPaginate(async (startAt, max) => {
       const result = await this.http.jira(`${API2}/search`, {
         method: "POST",
-        body: { jql, startAt, maxResults: max, fields: ["summary", "status", "priority", "assignee", "issuetype", "project", "created", "updated", "labels", "reporter"] }
+        body: { jql, startAt, maxResults: max, fields }
       });
       return { ...result, values: result.issues };
     });
     return { issues: allIssues, total: allIssues.length, startAt: 0, maxResults: allIssues.length };
   }
+  async fetchFields() {
+    return this.http.jira(`${API2}/field`);
+  }
   async assignIssue(key, accountId) {
     await this.http.jira(`${API2}/issue/${key}/assignee`, {
       method: "PUT",
@@ -933,6 +992,57 @@ var JiraClient = class {
   }
 };
 
+// src/services/jira/custom-fields.ts
+function buildFieldMap(fields) {
+  const byName = /* @__PURE__ */ new Map();
+  const byId = /* @__PURE__ */ new Map();
+  for (const f of fields) {
+    byName.set(f.name.toLowerCase(), f);
+    byId.set(f.id, f);
+  }
+  return { byName, byId };
+}
+function translateJql(jql, fieldMap) {
+  if (fieldMap.byName.size === 0) return jql;
+  const sortedNames = Array.from(fieldMap.byName.keys()).sort((a, b) => b.length - a.length);
+  const parts = jql.split(/(["'][^"']*["'])/);
+  return parts.map((part, i) => {
+    if (i % 2 === 1) return part;
+    let out = part;
+    for (const name of sortedNames) {
+      const def = fieldMap.byName.get(name);
+      const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      out = out.replace(new RegExp(`(?<![\\w"'])${escaped}(?![\\w"'])`, "gi"), def.id);
+    }
+    return out;
+  }).join("");
+}
+function translateFieldsInOutput(fields, fieldMap) {
+  if (fieldMap.byId.size === 0) return fields;
+  const result = {};
+  for (const [key, value] of Object.entries(fields)) {
+    const def = fieldMap.byId.get(key);
+    result[def ? def.name : key] = value;
+  }
+  return result;
+}
+function formatFieldValue(value, type) {
+  switch (type) {
+    case "number":
+      return Number(value);
+    case "select":
+      return { value };
+    case "multi-select":
+      return value.split(",").map((v) => ({ value: v.trim() }));
+    case "labels":
+      return value.split(",").map((v) => v.trim());
+    case "user":
+      return { accountId: value };
+    default:
+      return value;
+  }
+}
+
 // src/services/jira/commands.ts
 function getClient(program2) {
   const opts = program2.optsWithGlobals();
@@ -941,6 +1051,16 @@ function getClient(program2) {
   const http = createHttpClient(config, Boolean(opts.dryRun));
   return new JiraClient(http);
 }
+function getClientAndFields(program2) {
+  const opts = program2.optsWithGlobals();
+  const config = loadConfig({ configPath: opts.config });
+  if (!config.jira.baseUrl) throw new PncliError("Jira not configured. Run: pncli config init");
+  const http = createHttpClient(config, Boolean(opts.dryRun));
+  const client = new JiraClient(http);
+  const customFields = config.jira.customFields;
+  const fieldMap = buildFieldMap(customFields);
+  return { client, fieldMap, customFields };
+}
 function getDefaults(program2) {
   const opts = program2.optsWithGlobals();
   const config = loadConfig({ configPath: opts.config });
@@ -955,35 +1075,38 @@ function registerJiraCommands(program2) {
   jira.command("get-issue").description("Get a Jira issue by key").requiredOption("--key <issue-key>", "Issue key (e.g. PROJ-123)").action(async (opts) => {
     const start = Date.now();
     try {
-      const client = getClient(program2);
+      const { client, fieldMap } = getClientAndFields(program2);
       const data = await client.getIssue(opts.key);
-      success(data, "jira", "get-issue", start);
+      const translated = { ...data, fields: translateFieldsInOutput(data.fields, fieldMap) };
+      success(translated, "jira", "get-issue", start);
     } catch (err) {
       fail(err, "jira", "get-issue", start);
     }
   });
-  jira.command("create-issue").description("Create a Jira issue").option("--project <key>", "Project key").option("--type <type>", "Issue type (Bug, Story, Task, ...)").requiredOption("--summary <text>", "Issue summary").option("--description <text>", "Issue description").option("--priority <name>", "Priority name").option("--assignee <accountId>", "Assignee account ID").option("--labels <labels>", "Comma-separated labels").action(async (opts) => {
+  jira.command("create-issue").description("Create a Jira issue").option("--project <key>", "Project key").option("--type <type>", "Issue type (Bug, Story, Task, ...)").requiredOption("--summary <text>", "Issue summary").option("--description <text>", "Issue description").option("--priority <name>", "Priority name").option("--assignee <accountId>", "Assignee account ID").option("--labels <labels>", "Comma-separated labels").option("--field <Name=value>", "Custom field value (repeatable)", (val, acc) => [...acc, val], []).action(async (opts) => {
     const start = Date.now();
     try {
-      const client = getClient(program2);
+      const { client, fieldMap } = getClientAndFields(program2);
       const defaults = getDefaults(program2);
       const project = opts.project ?? defaults.project;
       const issueType = opts.type ?? defaults.issueType ?? "Task";
       const priority = opts.priority ?? defaults.priority;
       if (!project) throw new PncliError("--project required (or set defaults.jira.project in config)", 1);
       const labels = opts.labels ? opts.labels.split(",").map((s) => s.trim()) : void 0;
-      const data = await client.createIssue({ project, issueType, summary: opts.summary, description: opts.description, priority, assignee: opts.assignee, labels });
+      const customFieldValues = parseFieldArgs(opts.field, fieldMap);
+      const data = await client.createIssue({ project, issueType, summary: opts.summary, description: opts.description, priority, assignee: opts.assignee, labels, customFieldValues });
       success(data, "jira", "create-issue", start);
     } catch (err) {
       fail(err, "jira", "create-issue", start);
     }
   });
-  jira.command("update-issue").description("Update a Jira issue").requiredOption("--key <issue-key>", "Issue key").option("--summary <text>", "New summary").option("--description <text>", "New description").option("--priority <name>", "New priority").option("--assignee <accountId>", "New assignee account ID").option("--labels <labels>", "Comma-separated labels").action(async (opts) => {
+  jira.command("update-issue").description("Update a Jira issue").requiredOption("--key <issue-key>", "Issue key").option("--summary <text>", "New summary").option("--description <text>", "New description").option("--priority <name>", "New priority").option("--assignee <accountId>", "New assignee account ID").option("--labels <labels>", "Comma-separated labels").option("--field <Name=value>", "Custom field value (repeatable)", (val, acc) => [...acc, val], []).action(async (opts) => {
     const start = Date.now();
     try {
-      const client = getClient(program2);
+      const { client, fieldMap } = getClientAndFields(program2);
       const labels = opts.labels ? opts.labels.split(",").map((s) => s.trim()) : void 0;
-      await client.updateIssue(opts.key, { summary: opts.summary, description: opts.description, priority: opts.priority, assignee: opts.assignee, labels });
+      const customFieldValues = parseFieldArgs(opts.field, fieldMap);
+      await client.updateIssue(opts.key, { summary: opts.summary, description: opts.description, priority: opts.priority, assignee: opts.assignee, labels, customFieldValues });
       success({ updated: opts.key }, "jira", "update-issue", start);
     } catch (err) {
       fail(err, "jira", "update-issue", start);
@@ -1039,10 +1162,15 @@ function registerJiraCommands(program2) {
   jira.command("search").description("Search Jira issues with JQL").requiredOption("--jql <query>", "JQL query string").option("--max-results <n>", "Maximum number of results").action(async (opts) => {
     const start = Date.now();
     try {
-      const client = getClient(program2);
+      const { client, fieldMap, customFields } = getClientAndFields(program2);
       const maxResults = opts.maxResults ? parseInt(opts.maxResults, 10) : void 0;
-      const data = await client.search(opts.jql, maxResults);
-      success(data, "jira", "search", start);
+      const translatedJql = translateJql(opts.jql, fieldMap);
+      const data = await client.search(translatedJql, maxResults, customFields);
+      const translatedIssues = data.issues.map((issue) => ({
+        ...issue,
+        fields: translateFieldsInOutput(issue.fields, fieldMap)
+      }));
+      success({ ...data, issues: translatedIssues }, "jira", "search", start);
     } catch (err) {
       fail(err, "jira", "search", start);
     }
@@ -1067,6 +1195,35 @@ function registerJiraCommands(program2) {
       fail(err, "jira", "link-issue", start);
     }
   });
+  jira.command("fields").description("List custom fields (configured or discovered from Jira API)").option("--discover", "Fetch field metadata from Jira API").option("--custom-only", "Show only custom fields (requires --discover)").action(async (opts) => {
+    const start = Date.now();
+    try {
+      if (opts.discover) {
+        const client = getClient(program2);
+        const fields = await client.fetchFields();
+        const result = opts.customOnly ? fields.filter((f) => f.custom) : fields;
+        success(result, "jira", "fields", start);
+      } else {
+        const { customFields } = getClientAndFields(program2);
+        success(customFields, "jira", "fields", start);
+      }
+    } catch (err) {
+      fail(err, "jira", "fields", start);
+    }
+  });
+}
+function parseFieldArgs(fieldArgs, fieldMap) {
+  const result = {};
+  for (const arg of fieldArgs) {
+    const eq = arg.indexOf("=");
+    if (eq === -1) throw new PncliError(`Invalid --field format (expected Name=value): ${arg}`, 1);
+    const name = arg.slice(0, eq).trim();
+    const value = arg.slice(eq + 1);
+    const def = fieldMap.byName.get(name.toLowerCase());
+    if (!def) throw new PncliError(`Unknown custom field: "${name}". Run: pncli jira fields`, 1);
+    result[def.id] = formatFieldValue(value, def.type);
+  }
+  return result;
 }
 
 // src/services/bitbucket/commands.ts
@@ -1333,21 +1490,1326 @@ function registerSonarCommands(program2) {
   });
 }
 
-// src/services/artifactory/commands.ts
-function registerArtifactoryCommands(program2) {
-  program2.command("artifactory").description("Artifactory operations").action(() => {
-    success(
-      { message: "Coming soon \u2014 the nightmare never ends." },
-      "artifactory",
-      "stub",
-      Date.now()
+// src/services/deps/parsers/index.ts
+import fs2 from "fs";
+import path5 from "path";
+import { execSync as execSync4, execFileSync as execFileSync2 } from "child_process";
+
+// src/services/deps/parsers/npm.ts
+import path2 from "path";
+function findNpmManifests(files) {
+  const lockFiles = new Set(
+    files.filter((f) => {
+      const base = path2.basename(f);
+      return base === "package-lock.json" || base === "yarn.lock" || base === "pnpm-lock.yaml";
+    })
+  );
+  const manifests = [];
+  for (const file of files) {
+    if (path2.basename(file) !== "package.json") continue;
+    if (file.split("/").includes("node_modules")) continue;
+    const dir = path2.dirname(file);
+    let lockFile;
+    for (const lf of ["package-lock.json", "yarn.lock", "pnpm-lock.yaml"]) {
+      const candidate = dir === "." ? lf : `${dir}/${lf}`;
+      if (lockFiles.has(candidate)) {
+        lockFile = candidate;
+        break;
+      }
+    }
+    manifests.push({ file, ecosystem: "npm", lockFile });
+  }
+  return manifests;
+}
+function parseNpmPackages(content, manifest, opts, lockContent) {
+  if (lockContent && manifest.lockFile) {
+    const base = path2.basename(manifest.lockFile);
+    if (base === "package-lock.json") {
+      const pkgs = parsePackageLock(lockContent, manifest.lockFile, opts);
+      if (pkgs.length > 0) return pkgs;
+    } else if (base === "yarn.lock") {
+      return parseYarnLock(lockContent, manifest.lockFile, opts, content);
+    } else if (base === "pnpm-lock.yaml") {
+      return parsePnpmLock(lockContent, manifest.lockFile, opts, content);
+    }
+  }
+  return parsePackageJson(content, manifest.file, opts);
+}
+function stripVersionPrefix(v) {
+  return v.replace(/^[\^~>=<* ]+/, "").split(/\s/)[0] ?? v;
+}
+function parsePackageJson(content, filePath, opts) {
+  let pkg2;
+  try {
+    pkg2 = JSON.parse(content);
+  } catch {
+    return [];
+  }
+  const packages = [];
+  for (const [name, version] of Object.entries(pkg2.dependencies ?? {})) {
+    packages.push({
+      name,
+      version: stripVersionPrefix(version),
+      ecosystem: "npm",
+      source: filePath,
+      type: "direct",
+      scope: "production"
+    });
+  }
+  if (opts.includeDev) {
+    for (const [name, version] of Object.entries(pkg2.devDependencies ?? {})) {
+      packages.push({
+        name,
+        version: stripVersionPrefix(version),
+        ecosystem: "npm",
+        source: filePath,
+        type: "direct",
+        scope: "dev"
+      });
+    }
+  }
+  return packages;
+}
+function parsePackageLock(content, lockFilePath, opts) {
+  let lock;
+  try {
+    lock = JSON.parse(content);
+  } catch {
+    return [];
+  }
+  if ((lock.lockfileVersion ?? 1) < 2 || !lock.packages) return [];
+  const packages = [];
+  for (const [pkgPath, meta] of Object.entries(lock.packages)) {
+    if (pkgPath === "") continue;
+    if (!meta.version) continue;
+    const isDev = meta.dev === true || meta.devOptional === true;
+    if (isDev && !opts.includeDev) continue;
+    const withoutRoot = pkgPath.startsWith("node_modules/") ? pkgPath.slice("node_modules/".length) : pkgPath;
+    const segments = withoutRoot.split("/node_modules/");
+    const isTransitive = segments.length > 1;
+    if (isTransitive && !opts.includeTransitive) continue;
+    const name = segments[segments.length - 1] ?? pkgPath;
+    packages.push({
+      name,
+      version: meta.version,
+      ecosystem: "npm",
+      source: lockFilePath,
+      type: isTransitive ? "transitive" : "direct",
+      scope: isDev ? "dev" : "production"
+    });
+  }
+  return packages;
+}
+function parseYarnLock(content, lockFilePath, opts, packageJsonContent) {
+  let pkgJson;
+  try {
+    pkgJson = JSON.parse(packageJsonContent);
+  } catch {
+    pkgJson = {};
+  }
+  const directDeps = new Set(Object.keys(pkgJson.dependencies ?? {}));
+  const devDeps = new Set(Object.keys(pkgJson.devDependencies ?? {}));
+  const allDirectDeps = /* @__PURE__ */ new Set([...directDeps, ...devDeps]);
+  const packages = [];
+  const seen = /* @__PURE__ */ new Set();
+  const blockRegex = /^"?(@?[^@"\n][^"\n]*)@[^:]+:?\n\s+version "([^"]+)"/gm;
+  for (const match of content.matchAll(blockRegex)) {
+    const name = match[1].trim().replace(/^"|"$/g, "");
+    const version = match[2];
+    const key = `${name}@${version}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    const isDev = devDeps.has(name) && !directDeps.has(name);
+    if (isDev && !opts.includeDev) continue;
+    const isTransitive = !allDirectDeps.has(name);
+    if (isTransitive && !opts.includeTransitive) continue;
+    packages.push({
+      name,
+      version,
+      ecosystem: "npm",
+      source: lockFilePath,
+      type: isTransitive ? "transitive" : "direct",
+      scope: isDev ? "dev" : "production"
+    });
+  }
+  return packages;
+}
+function parsePnpmLock(content, lockFilePath, opts, packageJsonContent) {
+  let pkgJson;
+  try {
+    pkgJson = JSON.parse(packageJsonContent);
+  } catch {
+    pkgJson = {};
+  }
+  const directDeps = new Set(Object.keys(pkgJson.dependencies ?? {}));
+  const devDeps = new Set(Object.keys(pkgJson.devDependencies ?? {}));
+  const allDirectDeps = /* @__PURE__ */ new Set([...directDeps, ...devDeps]);
+  const packages = [];
+  const seen = /* @__PURE__ */ new Set();
+  const blockRegex = /^\s{2}(\/?@?[^@\s/][^@\s]*)@(\d[^:\s]*):\s*\n((?:\s{4}[^\n]+\n)*)/gm;
+  for (const match of content.matchAll(blockRegex)) {
+    const name = match[1].replace(/^\//, "");
+    const version = match[2];
+    const attrs = match[3] ?? "";
+    const key = `${name}@${version}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    const isDev = devDeps.has(name) && !directDeps.has(name) || /^\s+dev:\s*true/m.test(attrs);
+    if (isDev && !opts.includeDev) continue;
+    const isTransitive = !allDirectDeps.has(name);
+    if (isTransitive && !opts.includeTransitive) continue;
+    packages.push({
+      name,
+      version,
+      ecosystem: "npm",
+      source: lockFilePath,
+      type: isTransitive ? "transitive" : "direct",
+      scope: isDev ? "dev" : "production"
+    });
+  }
+  return packages;
+}
+
+// src/services/deps/parsers/nuget.ts
+import path3 from "path";
+var PROJ_EXTENSIONS = /* @__PURE__ */ new Set([".csproj", ".fsproj", ".vbproj"]);
+function findNugetManifests(files) {
+  const lockFiles = /* @__PURE__ */ new Map();
+  for (const f of files) {
+    if (path3.basename(f) === "packages.lock.json") {
+      lockFiles.set(path3.dirname(f), f);
+    }
+  }
+  const manifests = [];
+  for (const file of files) {
+    const base = path3.basename(file);
+    const ext = path3.extname(file);
+    if (PROJ_EXTENSIONS.has(ext) || base === "packages.config") {
+      const dir = path3.dirname(file);
+      const lockFile = lockFiles.get(dir);
+      manifests.push({ file, ecosystem: "nuget", lockFile });
+    }
+    if (base === "Directory.Packages.props") {
+      const dir = path3.dirname(file);
+      manifests.push({ file, ecosystem: "nuget", lockFile: lockFiles.get(dir) });
+    }
+  }
+  const deduped = [];
+  const seenLocks = /* @__PURE__ */ new Set();
+  for (const manifest of manifests) {
+    if (!manifest.lockFile) {
+      deduped.push(manifest);
+      continue;
+    }
+    if (!seenLocks.has(manifest.lockFile)) {
+      seenLocks.add(manifest.lockFile);
+      deduped.push(manifest);
+    }
+  }
+  return deduped;
+}
+function parseNugetPackages(content, manifest, opts, lockContent, propsContent) {
+  const base = path3.basename(manifest.file);
+  if (lockContent) {
+    return parsePackagesLock(lockContent, manifest.lockFile ?? manifest.file, opts);
+  }
+  if (base === "packages.config") {
+    return parsePackagesConfig(content, manifest.file);
+  }
+  if (base === "Directory.Packages.props") {
+    return parseDirectoryPackagesProps(content, manifest.file);
+  }
+  return parseCsproj(content, manifest.file, propsContent);
+}
+function parseCsproj(content, filePath, propsContent) {
+  const centralVersions = propsContent ? extractCentralVersions(propsContent) : /* @__PURE__ */ new Map();
+  const packages = [];
+  const singleLine = /<PackageReference\s+([^>]+?)\/>/gi;
+  const multiLine = /<PackageReference\s+([^>]+?)>([\s\S]*?)<\/PackageReference>/gi;
+  const extractFromAttrsAndInner = (attrs, inner) => {
+    const nameMatch = /\bInclude="([^"]+)"/i.exec(attrs);
+    if (!nameMatch) return;
+    const name = nameMatch[1];
+    let version;
+    const attrVersion = /\bVersion="([^"]+)"/i.exec(attrs);
+    if (attrVersion) {
+      version = attrVersion[1];
+    } else if (inner) {
+      const innerVersion = /<Version>([^<]+)<\/Version>/i.exec(inner);
+      if (innerVersion) version = innerVersion[1];
+    }
+    if (!version || version.startsWith("$(")) {
+      version = centralVersions.get(name) ?? centralVersions.get(name.toLowerCase());
+    }
+    if (!version) return;
+    packages.push({
+      name,
+      version,
+      ecosystem: "nuget",
+      source: filePath,
+      type: "direct",
+      scope: "production"
+    });
+  };
+  for (const m of content.matchAll(singleLine)) {
+    extractFromAttrsAndInner(m[1], "");
+  }
+  for (const m of content.matchAll(multiLine)) {
+    extractFromAttrsAndInner(m[1], m[2] ?? "");
+  }
+  return packages;
+}
+function extractCentralVersions(propsContent) {
+  const map = /* @__PURE__ */ new Map();
+  const regex = /<PackageVersion\s+Include="([^"]+)"\s+Version="([^"]+)"/gi;
+  for (const m of propsContent.matchAll(regex)) {
+    map.set(m[1], m[2]);
+    map.set(m[1].toLowerCase(), m[2]);
+  }
+  return map;
+}
+function parseDirectoryPackagesProps(content, filePath) {
+  const packages = [];
+  const regex = /<PackageVersion\s+Include="([^"]+)"\s+Version="([^"]+)"/gi;
+  for (const m of content.matchAll(regex)) {
+    packages.push({
+      name: m[1],
+      version: m[2],
+      ecosystem: "nuget",
+      source: filePath,
+      type: "direct",
+      scope: "production"
+    });
+  }
+  return packages;
+}
+function parsePackagesConfig(content, filePath) {
+  const packages = [];
+  const regex = /<package\s+id="([^"]+)"\s+version="([^"]+)"/gi;
+  for (const m of content.matchAll(regex)) {
+    packages.push({
+      name: m[1],
+      version: m[2],
+      ecosystem: "nuget",
+      source: filePath,
+      type: "direct",
+      scope: "production"
+    });
+  }
+  return packages;
+}
+function parsePackagesLock(content, filePath, opts) {
+  let lock;
+  try {
+    lock = JSON.parse(content);
+  } catch {
+    return [];
+  }
+  const packages = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const frameworkDeps of Object.values(lock.dependencies ?? {})) {
+    for (const [name, meta] of Object.entries(frameworkDeps)) {
+      const version = meta.resolved ?? "";
+      if (!version) continue;
+      const isTransitive = meta.type === "Transitive";
+      if (isTransitive && !opts.includeTransitive) continue;
+      const key = `${name}@${version}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      packages.push({
+        name,
+        version,
+        ecosystem: "nuget",
+        source: filePath,
+        type: isTransitive ? "transitive" : "direct",
+        scope: "production"
+      });
+    }
+  }
+  return packages;
+}
+
+// src/services/deps/parsers/maven.ts
+import path4 from "path";
+function findMavenManifests(files) {
+  const lockFiles = new Set(files.filter((f) => path4.basename(f) === "gradle.lockfile"));
+  const manifests = [];
+  for (const file of files) {
+    const base = path4.basename(file);
+    if (base === "pom.xml" || base === "build.gradle" || base === "build.gradle.kts") {
+      const dir = path4.dirname(file);
+      const lockCandidate = dir === "." ? "gradle.lockfile" : `${dir}/gradle.lockfile`;
+      const lockFile = lockFiles.has(lockCandidate) ? lockCandidate : void 0;
+      manifests.push({ file, ecosystem: "maven", lockFile });
+    }
+  }
+  return manifests;
+}
+function parseMavenPackages(content, manifest, opts, lockContent) {
+  const base = path4.basename(manifest.file);
+  if (lockContent && manifest.lockFile) {
+    return parseGradleLock(lockContent, manifest.lockFile, opts);
+  }
+  if (base === "pom.xml") {
+    return parsePomXml(content, manifest.file, opts);
+  }
+  if (base === "build.gradle" || base === "build.gradle.kts") {
+    return parseBuildGradle(content, manifest.file, opts);
+  }
+  return [];
+}
+function parsePomXml(content, filePath, opts) {
+  const props = extractPomProperties(content);
+  const managedVersions = extractDependencyManagement(content, props);
+  const withoutMgmt = content.replace(/<dependencyManagement>[\s\S]*?<\/dependencyManagement>/gi, "");
+  const packages = [];
+  const depRegex = /<dependency>([\s\S]*?)<\/dependency>/gi;
+  for (const match of withoutMgmt.matchAll(depRegex)) {
+    const inner = match[1];
+    const groupId = /<groupId>\s*([^<\s]+)\s*<\/groupId>/i.exec(inner)?.[1];
+    const artifactId = /<artifactId>\s*([^<\s]+)\s*<\/artifactId>/i.exec(inner)?.[1];
+    if (!groupId || !artifactId) continue;
+    const rawVersion = /<version>\s*([^<\s]+)\s*<\/version>/i.exec(inner)?.[1];
+    const resolvedVersion = resolveProperty(rawVersion ?? null, props) ?? managedVersions.get(`${groupId}:${artifactId}`);
+    if (!resolvedVersion) continue;
+    const scope = /<scope>\s*([^<\s]+)\s*<\/scope>/i.exec(inner)?.[1] ?? "compile";
+    const isDev = scope === "test" || scope === "provided";
+    if (isDev && !opts.includeDev) continue;
+    packages.push({
+      name: `${groupId}:${artifactId}`,
+      version: resolvedVersion,
+      ecosystem: "maven",
+      source: filePath,
+      type: "direct",
+      scope: isDev ? "dev" : "production"
+    });
+  }
+  return packages;
+}
+function extractPomProperties(content) {
+  const props = /* @__PURE__ */ new Map();
+  const propsMatch = /<properties>([\s\S]*?)<\/properties>/i.exec(content);
+  if (!propsMatch) return props;
+  const propRegex = /<([a-zA-Z0-9._-]+)>\s*([^<]+)\s*<\/\1>/g;
+  for (const m of propsMatch[1].matchAll(propRegex)) {
+    props.set(m[1], m[2].trim());
+  }
+  return props;
+}
+function extractDependencyManagement(content, props) {
+  const versions = /* @__PURE__ */ new Map();
+  const mgmtMatch = /<dependencyManagement>([\s\S]*?)<\/dependencyManagement>/i.exec(content);
+  if (!mgmtMatch) return versions;
+  const depRegex = /<dependency>([\s\S]*?)<\/dependency>/gi;
+  for (const m of mgmtMatch[1].matchAll(depRegex)) {
+    const inner = m[1];
+    const groupId = /<groupId>\s*([^<\s]+)\s*<\/groupId>/i.exec(inner)?.[1];
+    const artifactId = /<artifactId>\s*([^<\s]+)\s*<\/artifactId>/i.exec(inner)?.[1];
+    const rawVersion = /<version>\s*([^<\s]+)\s*<\/version>/i.exec(inner)?.[1];
+    if (!groupId || !artifactId || !rawVersion) continue;
+    const resolved = resolveProperty(rawVersion, props);
+    if (resolved) versions.set(`${groupId}:${artifactId}`, resolved);
+  }
+  return versions;
+}
+function resolveProperty(value, props) {
+  if (!value) return null;
+  const resolved = value.replace(/\$\{([^}]+)\}/g, (_, key) => props.get(key) ?? `\${${key}}`);
+  return /\$\{[^}]+\}/.test(resolved) ? null : resolved;
+}
+var GRADLE_DEV_CONFIGS = /* @__PURE__ */ new Set(["testImplementation", "testCompileOnly", "testRuntimeOnly", "testApi"]);
+function parseBuildGradle(content, filePath, opts) {
+  const packages = [];
+  const seen = /* @__PURE__ */ new Set();
+  const stringNotation = /\b(\w+)\s*\(?\s*['"]([^:'"]+):([^:'"]+):([^'"]+)['"]\s*\)?/g;
+  for (const m of content.matchAll(stringNotation)) {
+    const config = m[1];
+    const groupId = m[2];
+    const artifactId = m[3];
+    const version = m[4].split("@")[0];
+    const isDev = GRADLE_DEV_CONFIGS.has(config);
+    if (isDev && !opts.includeDev) continue;
+    const name = `${groupId}:${artifactId}`;
+    const key = `${name}@${version}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    packages.push({
+      name,
+      version,
+      ecosystem: "maven",
+      source: filePath,
+      type: "direct",
+      scope: isDev ? "dev" : "production"
+    });
+  }
+  const mapNotation = /\b(\w+)\s+group:\s*['"]([^'"]+)['"]\s*,\s*name:\s*['"]([^'"]+)['"]\s*,\s*version:\s*['"]([^'"]+)['"]/g;
+  for (const m of content.matchAll(mapNotation)) {
+    const config = m[1];
+    const groupId = m[2];
+    const artifactId = m[3];
+    const version = m[4];
+    const isDev = GRADLE_DEV_CONFIGS.has(config);
+    if (isDev && !opts.includeDev) continue;
+    const name = `${groupId}:${artifactId}`;
+    const key = `${name}@${version}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    packages.push({
+      name,
+      version,
+      ecosystem: "maven",
+      source: filePath,
+      type: "direct",
+      scope: isDev ? "dev" : "production"
+    });
+  }
+  return packages;
+}
+function parseGradleLock(content, filePath, opts) {
+  const packages = [];
+  const seen = /* @__PURE__ */ new Set();
+  const lineRegex = /^([^:#\s]+):([^:#\s]+):([^=\s]+)=(.+)$/gm;
+  for (const m of content.matchAll(lineRegex)) {
+    const groupId = m[1];
+    const artifactId = m[2];
+    const version = m[3];
+    const configs = m[4].split(",").map((s) => s.trim());
+    const isDev = configs.every((c) => GRADLE_DEV_CONFIGS.has(c));
+    if (isDev && !opts.includeDev) continue;
+    const name = `${groupId}:${artifactId}`;
+    const key = `${name}@${version}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    packages.push({
+      name,
+      version,
+      ecosystem: "maven",
+      source: filePath,
+      type: "direct",
+      scope: isDev ? "dev" : "production"
+    });
+  }
+  return packages;
+}
+
+// src/services/deps/parsers/index.ts
+function getRepoFiles(repoRoot) {
+  try {
+    const out = execSync4("git ls-files --cached --others --exclude-standard", {
+      encoding: "utf8",
+      cwd: repoRoot
+    });
+    return out.trim().split("\n").filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+function readFile(repoRoot, relPath) {
+  try {
+    return fs2.readFileSync(path5.join(repoRoot, relPath), "utf8");
+  } catch {
+    return null;
+  }
+}
+function readFileAtRef(repoRoot, ref, relPath) {
+  try {
+    return execFileSync2("git", ["show", `${ref}:${relPath}`], {
+      encoding: "utf8",
+      cwd: repoRoot,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+  } catch {
+    return null;
+  }
+}
+function findPropsContent(manifestFile, readFn) {
+  let dir = path5.dirname(manifestFile);
+  for (let depth = 0; depth < 10; depth++) {
+    const candidate = dir === "." ? "Directory.Packages.props" : `${dir}/Directory.Packages.props`;
+    const content = readFn(candidate);
+    if (content) return content;
+    if (dir === ".") break;
+    dir = path5.dirname(dir);
+  }
+  return null;
+}
+function parseManifests(manifests, opts, readFn) {
+  const allPackages = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const manifest of manifests) {
+    const content = readFn(manifest.file);
+    if (!content) continue;
+    const lockContent = manifest.lockFile ? readFn(manifest.lockFile) ?? void 0 : void 0;
+    let pkgs = [];
+    if (manifest.ecosystem === "npm") {
+      pkgs = parseNpmPackages(content, manifest, opts, lockContent);
+    } else if (manifest.ecosystem === "nuget") {
+      const propsContent = findPropsContent(manifest.file, readFn) ?? void 0;
+      pkgs = parseNugetPackages(content, manifest, opts, lockContent, propsContent);
+    } else if (manifest.ecosystem === "maven") {
+      pkgs = parseMavenPackages(content, manifest, opts, lockContent);
+    }
+    for (const pkg2 of pkgs) {
+      const key = `${pkg2.ecosystem}:${pkg2.name}@${pkg2.version}:${pkg2.source}`;
+      if (!seen.has(key)) {
+        seen.add(key);
+        allPackages.push(pkg2);
+      }
+    }
+  }
+  return allPackages;
+}
+function scanRepo(repoRoot, opts = {}) {
+  const files = getRepoFiles(repoRoot);
+  const eco = opts.ecosystem ?? "all";
+  const npmManifests = eco === "all" || eco === "npm" ? findNpmManifests(files) : [];
+  const nugetManifests = eco === "all" || eco === "nuget" ? findNugetManifests(files) : [];
+  const mavenManifests = eco === "all" || eco === "maven" ? findMavenManifests(files) : [];
+  const manifests = [...npmManifests, ...nugetManifests, ...mavenManifests];
+  const packages = parseManifests(manifests, opts, (rel) => readFile(repoRoot, rel));
+  return buildScanData(manifests, packages);
+}
+function scanRepoAtRef(repoRoot, ref, opts = {}) {
+  const eco = opts.ecosystem ?? "all";
+  let files = [];
+  try {
+    const out = execFileSync2("git", ["ls-tree", "-r", "--name-only", ref], {
+      encoding: "utf8",
+      cwd: repoRoot,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    files = out.trim().split("\n").filter(Boolean);
+  } catch {
+    return buildScanData([], []);
+  }
+  const npmManifests = eco === "all" || eco === "npm" ? findNpmManifests(files) : [];
+  const nugetManifests = eco === "all" || eco === "nuget" ? findNugetManifests(files) : [];
+  const mavenManifests = eco === "all" || eco === "maven" ? findMavenManifests(files) : [];
+  const manifests = [...npmManifests, ...nugetManifests, ...mavenManifests];
+  const packages = parseManifests(manifests, opts, (rel) => readFileAtRef(repoRoot, ref, rel));
+  return buildScanData(manifests, packages);
+}
+function buildScanData(manifests, packages) {
+  const ecosystemSet = new Set(manifests.map((m) => m.ecosystem));
+  const byEcosystem = {};
+  const byType = { direct: 0, transitive: 0 };
+  const byScope = { production: 0, dev: 0 };
+  for (const pkg2 of packages) {
+    byEcosystem[pkg2.ecosystem] = (byEcosystem[pkg2.ecosystem] ?? 0) + 1;
+    byType[pkg2.type] = (byType[pkg2.type] ?? 0) + 1;
+    byScope[pkg2.scope] = (byScope[pkg2.scope] ?? 0) + 1;
+  }
+  return {
+    ecosystems: Array.from(ecosystemSet),
+    manifests,
+    packages,
+    summary: {
+      totalPackages: packages.length,
+      byEcosystem,
+      byType,
+      byScope
+    }
+  };
+}
+
+// src/services/deps/scan.ts
+function runScan(config, opts) {
+  void config;
+  const repoRoot = getRepoRoot2();
+  if (!repoRoot) {
+    throw new PncliError("Not inside a git repository. deps commands require a git repo root.", 1);
+  }
+  return scanRepo(repoRoot, opts);
+}
+
+// src/services/deps/semver.ts
+function parse(v) {
+  const clean = v.replace(/^[^0-9]*/, "");
+  const dashIdx = clean.indexOf("-");
+  const plusIdx = clean.indexOf("+");
+  const metaStart = plusIdx > -1 ? plusIdx : Infinity;
+  const preStart = dashIdx > -1 && dashIdx < metaStart ? dashIdx : Infinity;
+  const numeric = clean.slice(0, Math.min(preStart, metaStart));
+  const preRelease = preStart < Infinity ? clean.slice(preStart + 1, metaStart < Infinity ? metaStart : void 0) : "";
+  const parts = numeric.split(".").map((n) => parseInt(n, 10) || 0);
+  return { major: parts[0] ?? 0, minor: parts[1] ?? 0, patch: parts[2] ?? 0, preRelease };
+}
+function compareSemver(a, b) {
+  const av = parse(a);
+  const bv = parse(b);
+  if (av.major !== bv.major) return av.major - bv.major;
+  if (av.minor !== bv.minor) return av.minor - bv.minor;
+  if (av.patch !== bv.patch) return av.patch - bv.patch;
+  if (!av.preRelease && bv.preRelease) return 1;
+  if (av.preRelease && !bv.preRelease) return -1;
+  if (av.preRelease && bv.preRelease) return av.preRelease.localeCompare(bv.preRelease);
+  return 0;
+}
+function isNewer(current, latest) {
+  return compareSemver(latest, current) > 0;
+}
+function updateType(current, latest) {
+  const cv = parse(current);
+  const lv = parse(latest);
+  if (lv.major > cv.major) return "major";
+  if (lv.minor > cv.minor) return "minor";
+  return "patch";
+}
+function isDowngrade(from, to) {
+  return compareSemver(to, from) < 0;
+}
+
+// src/services/deps/diff.ts
+function runDiff(config, from, to, opts) {
+  void config;
+  const repoRoot = getRepoRoot2();
+  if (!repoRoot) {
+    throw new PncliError("Not inside a git repository.", 1);
+  }
+  const fromScan = scanRepoAtRef(repoRoot, from, opts);
+  const toScan = to ? scanRepoAtRef(repoRoot, to, opts) : scanRepo(repoRoot, opts);
+  const fromMap = /* @__PURE__ */ new Map();
+  const toMap = /* @__PURE__ */ new Map();
+  for (const pkg2 of fromScan.packages) {
+    const key = `${pkg2.ecosystem}:${pkg2.name}:${pkg2.source}`;
+    fromMap.set(key, pkg2.version);
+  }
+  for (const pkg2 of toScan.packages) {
+    const key = `${pkg2.ecosystem}:${pkg2.name}:${pkg2.source}`;
+    toMap.set(key, pkg2.version);
+  }
+  const changes = [];
+  const allKeys = /* @__PURE__ */ new Set([...fromMap.keys(), ...toMap.keys()]);
+  for (const key of allKeys) {
+    const parts = key.split(":");
+    const eco = parts[0];
+    const source = parts[parts.length - 1] ?? "";
+    const name = parts.slice(1, -1).join(":");
+    const fromVer = fromMap.get(key) ?? null;
+    const toVer = toMap.get(key) ?? null;
+    let change;
+    if (!fromVer) {
+      change = "added";
+    } else if (!toVer) {
+      change = "removed";
+    } else if (fromVer === toVer) {
+      continue;
+    } else {
+      change = isDowngrade(fromVer, toVer) ? "downgraded" : "upgraded";
+    }
+    changes.push({ name, ecosystem: eco, change, from: fromVer, to: toVer, source });
+  }
+  const summary = { added: 0, removed: 0, upgraded: 0, downgraded: 0, unchanged: 0 };
+  for (const c of changes) summary[c.change]++;
+  summary.unchanged = [...allKeys].filter((k) => {
+    const fv = fromMap.get(k);
+    const tv = toMap.get(k);
+    return fv !== void 0 && tv !== void 0 && fv === tv;
+  }).length;
+  return { from, to: to ?? "working tree", changes, summary };
+}
+
+// src/services/deps/clients/osv.ts
+var OSV_URL = "https://api.osv.dev";
+var BATCH_SIZE = 500;
+var TIMEOUT_MS = 3e4;
+var OSV_ECOSYSTEM = {
+  npm: "npm",
+  nuget: "NuGet",
+  maven: "Maven"
+};
+async function fetchWithTimeout2(url, init) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
+  try {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function checkOsvConnectivity() {
+  try {
+    const res = await fetchWithTimeout2(`${OSV_URL}/v1/querybatch`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ queries: [] })
+    });
+    return { reachable: res.ok || res.status === 400 };
+  } catch (err) {
+    return {
+      reachable: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+function extractRemediation(vuln, pkg2) {
+  const fixedVersions = [];
+  for (const affected of vuln.affected ?? []) {
+    for (const range of affected.ranges ?? []) {
+      if (range.type === "SEMVER" || range.type === "ECOSYSTEM") {
+        for (const event of range.events ?? []) {
+          if (event.fixed) fixedVersions.push(event.fixed);
+        }
+      }
+    }
+  }
+  const unique = [...new Set(fixedVersions)];
+  const fixAvailable = unique.length > 0;
+  const advice = fixAvailable ? `Upgrade ${pkg2.name} to ${unique.join(" or ")}` : `No fix available yet for ${pkg2.name}. Monitor ${vuln.id} for updates.`;
+  return { fixAvailable, fixedVersions: unique, advice };
+}
+function extractSeverity(vuln) {
+  const dbSpecific = vuln.database_specific ?? {};
+  const dbSeverity = typeof dbSpecific["severity"] === "string" ? dbSpecific["severity"] : void 0;
+  let cvss = null;
+  const rawCvss = dbSpecific["cvss"];
+  if (typeof rawCvss === "number") {
+    cvss = rawCvss;
+  } else if (rawCvss && typeof rawCvss === "object" && "score" in rawCvss) {
+    const score = rawCvss["score"];
+    if (typeof score === "number") cvss = score;
+  }
+  for (const s of vuln.severity ?? []) {
+    const score = parseFloat(s.score);
+    if (!isNaN(score) && score >= 0 && score <= 10) {
+      cvss = score;
+      break;
+    }
+  }
+  return {
+    severity: dbSeverity ?? inferSeverityFromCvss(cvss),
+    cvss
+  };
+}
+function inferSeverityFromCvss(cvss) {
+  if (cvss === null) return "UNKNOWN";
+  if (cvss >= 9) return "CRITICAL";
+  if (cvss >= 7) return "HIGH";
+  if (cvss >= 4) return "MEDIUM";
+  return "LOW";
+}
+function mapVuln(vuln, pkg2) {
+  const { severity, cvss } = extractSeverity(vuln);
+  return {
+    id: vuln.id,
+    summary: vuln.summary ?? "",
+    severity,
+    cvss,
+    aliases: vuln.aliases ?? [],
+    remediation: extractRemediation(vuln, pkg2),
+    references: (vuln.references ?? []).map((r) => r.url ?? "").filter(Boolean)
+  };
+}
+async function queryBatch(queries, packages) {
+  const res = await fetchWithTimeout2(`${OSV_URL}/v1/querybatch`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ queries })
+  });
+  if (!res.ok) {
+    throw new Error(`OSV.dev returned HTTP ${res.status}`);
+  }
+  const data = await res.json();
+  const vulnerable = [];
+  for (let i = 0; i < data.results.length; i++) {
+    const result = data.results[i];
+    const pkg2 = packages[i];
+    if (!result || !pkg2) continue;
+    const vulns = result.vulns ?? [];
+    if (vulns.length === 0) continue;
+    vulnerable.push({
+      ...pkg2,
+      vulnerabilities: vulns.map((v) => mapVuln(v, pkg2))
+    });
+  }
+  return vulnerable;
+}
+async function checkPackagesForVulns(packages) {
+  const allVulnerable = [];
+  for (let i = 0; i < packages.length; i += BATCH_SIZE) {
+    const chunk = packages.slice(i, i + BATCH_SIZE);
+    const queries = chunk.map((pkg2) => ({
+      package: {
+        name: pkg2.name,
+        ecosystem: OSV_ECOSYSTEM[pkg2.ecosystem] ?? pkg2.ecosystem
+      },
+      version: pkg2.version
+    }));
+    const results = await queryBatch(queries, chunk);
+    allVulnerable.push(...results);
+  }
+  return allVulnerable;
+}
+
+// src/services/deps/clients/artifactory.ts
+var TIMEOUT_MS2 = 15e3;
+async function fetchWithTimeout3(url, token) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS2);
+  try {
+    return await fetch(url, {
+      headers: { Authorization: `Bearer ${token}` },
+      signal: controller.signal
+    });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function checkArtifactoryConnectivity(config) {
+  if (!config.baseUrl && !config.token) {
+    return {
+      reachable: false,
+      authenticated: false,
+      configured: false,
+      error: "Artifactory is not configured"
+    };
+  }
+  if (!config.baseUrl) {
+    return {
+      reachable: false,
+      authenticated: false,
+      configured: false,
+      error: "Artifactory baseUrl is not set"
+    };
+  }
+  if (!config.token) {
+    return {
+      reachable: false,
+      authenticated: false,
+      configured: false,
+      error: "Artifactory token is not set"
+    };
+  }
+  try {
+    const res = await fetchWithTimeout3(`${config.baseUrl}/api/system/ping`, config.token);
+    if (res.status === 401 || res.status === 403) {
+      return {
+        reachable: true,
+        authenticated: false,
+        configured: true,
+        error: "Artifactory token is invalid or lacks permissions"
+      };
+    }
+    return { reachable: res.ok, authenticated: res.ok, configured: true };
+  } catch (err) {
+    return {
+      reachable: false,
+      authenticated: false,
+      configured: true,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+function requireArtifactory(config, command) {
+  if (!config.baseUrl && !config.token) {
+    throw new PncliError(
+      `${command} requires Artifactory. Add the following to ~/.pncli/config.json:
+  "artifactory": { "baseUrl": "https://artifactory.company.com", "token": "your-token" }
+Or set PNCLI_ARTIFACTORY_BASE_URL and PNCLI_ARTIFACTORY_TOKEN environment variables.`,
+      503
+    );
+  }
+  if (!config.baseUrl) {
+    throw new PncliError(
+      `${command} requires an Artifactory URL. Set artifactory.baseUrl in ~/.pncli/config.json or PNCLI_ARTIFACTORY_BASE_URL.`,
+      503
+    );
+  }
+  if (!config.token) {
+    throw new PncliError(
+      `${command} requires an Artifactory token. Set artifactory.token in ~/.pncli/config.json or PNCLI_ARTIFACTORY_TOKEN.`,
+      503
+    );
+  }
+}
+function repoForEcosystem(config, eco) {
+  if (eco === "npm") return config.npmRepo;
+  if (eco === "nuget") return config.nugetRepo;
+  if (eco === "maven") return config.mavenRepo;
+  return void 0;
+}
+async function getLatestNpm(baseUrl, token, repoName, packageName) {
+  try {
+    const encoded = packageName.startsWith("@") ? packageName.replace("/", "%2F") : packageName;
+    const res = await fetchWithTimeout3(`${baseUrl}/api/npm/${repoName}/${encoded}`, token);
+    if (!res.ok) return null;
+    const data = await res.json();
+    return data["dist-tags"]?.latest ?? null;
+  } catch {
+    return null;
+  }
+}
+async function getLatestNuget(baseUrl, token, repoName, packageName) {
+  try {
+    const lower = packageName.toLowerCase();
+    const res = await fetchWithTimeout3(
+      `${baseUrl}/api/nuget/v3/${repoName}/flatcontainer/${lower}/index.json`,
+      token
+    );
+    if (!res.ok) return null;
+    const data = await res.json();
+    const versions = data.versions ?? [];
+    return versions[versions.length - 1] ?? null;
+  } catch {
+    return null;
+  }
+}
+async function getLatestMaven(baseUrl, token, repoName, packageName) {
+  const [groupId, artifactId] = packageName.split(":");
+  if (!groupId || !artifactId) return null;
+  try {
+    const res = await fetchWithTimeout3(
+      `${baseUrl}/api/search/latestVersion?g=${encodeURIComponent(groupId)}&a=${encodeURIComponent(artifactId)}&repos=${repoName}`,
+      token
     );
+    if (!res.ok) return null;
+    const text = await res.text();
+    return text.trim() || null;
+  } catch {
+    return null;
+  }
+}
+async function getOutdatedPackages(packages, config, filterType) {
+  const { baseUrl, token } = config;
+  if (!baseUrl || !token) return { outdated: [], uncheckedEcosystems: [] };
+  const outdated = [];
+  const unchecked = /* @__PURE__ */ new Set();
+  for (const pkg2 of packages) {
+    const repoName = repoForEcosystem(config, pkg2.ecosystem);
+    if (!repoName) {
+      unchecked.add(pkg2.ecosystem);
+      continue;
+    }
+    let latest = null;
+    if (pkg2.ecosystem === "npm") {
+      latest = await getLatestNpm(baseUrl, token, repoName, pkg2.name);
+    } else if (pkg2.ecosystem === "nuget") {
+      latest = await getLatestNuget(baseUrl, token, repoName, pkg2.name);
+    } else if (pkg2.ecosystem === "maven") {
+      latest = await getLatestMaven(baseUrl, token, repoName, pkg2.name);
+    }
+    if (!latest || !isNewer(pkg2.version, latest)) continue;
+    const type = updateType(pkg2.version, latest);
+    if (filterType) {
+      const order = { major: 3, minor: 2, patch: 1 };
+      if (order[type] < order[filterType]) continue;
+    }
+    outdated.push({
+      name: pkg2.name,
+      ecosystem: pkg2.ecosystem,
+      current: pkg2.version,
+      latest,
+      updateType: type,
+      source: pkg2.source
+    });
+  }
+  return { outdated, uncheckedEcosystems: [...unchecked] };
+}
+async function getLicenseNpm(baseUrl, token, repoName, packageName) {
+  try {
+    const encoded = packageName.startsWith("@") ? packageName.replace("/", "%2F") : packageName;
+    const res = await fetchWithTimeout3(`${baseUrl}/api/npm/${repoName}/${encoded}`, token);
+    if (!res.ok) return null;
+    const data = await res.json();
+    if (typeof data.license === "string") return data.license;
+    if (typeof data.license === "object" && data.license !== null) return data.license.type ?? null;
+    return null;
+  } catch {
+    return null;
+  }
+}
+async function getLicenseNuget(baseUrl, token, repoName, packageName, version) {
+  try {
+    const lower = packageName.toLowerCase();
+    const res = await fetchWithTimeout3(
+      `${baseUrl}/api/nuget/v3/${repoName}/registration/${lower}/${version}.json`,
+      token
+    );
+    if (!res.ok) return null;
+    const data = await res.json();
+    return data.licenseExpression ?? (data.licenseUrl ? "See licenseUrl" : null);
+  } catch {
+    return null;
+  }
+}
+async function getLicensedPackages(packages, config) {
+  const { baseUrl, token } = config;
+  if (!baseUrl || !token) return [];
+  const result = [];
+  for (const pkg2 of packages) {
+    const repoName = repoForEcosystem(config, pkg2.ecosystem);
+    let license = null;
+    if (repoName) {
+      if (pkg2.ecosystem === "npm") {
+        license = await getLicenseNpm(baseUrl, token, repoName, pkg2.name);
+      } else if (pkg2.ecosystem === "nuget") {
+        license = await getLicenseNuget(baseUrl, token, repoName, pkg2.name, pkg2.version);
+      }
+    }
+    result.push({
+      name: pkg2.name,
+      version: pkg2.version,
+      ecosystem: pkg2.ecosystem,
+      source: pkg2.source,
+      license
+    });
+  }
+  return result;
+}
+
+// src/services/deps/connectivity.ts
+var cachedTier = null;
+async function detectTier(config) {
+  if (cachedTier) return cachedTier;
+  const [osvResult, artResult] = await Promise.all([
+    checkOsvConnectivity(),
+    checkArtifactoryConnectivity(config.artifactory)
+  ]);
+  const artifactoryReachable = artResult.reachable && artResult.authenticated;
+  const osvReachable = osvResult.reachable;
+  let tier = "local";
+  if (artifactoryReachable) tier = "artifactory";
+  if (osvReachable) tier = "full";
+  cachedTier = { tier, osvReachable, artifactoryReachable };
+  return cachedTier;
+}
+async function buildConnectivityData(config) {
+  const [osvResult, artResult] = await Promise.all([
+    checkOsvConnectivity(),
+    checkArtifactoryConnectivity(config.artifactory)
+  ]);
+  const artCfg = config.artifactory;
+  let tier = "local";
+  if (artResult.reachable && artResult.authenticated) tier = "artifactory";
+  if (osvResult.reachable) tier = "full";
+  cachedTier = {
+    tier,
+    osvReachable: osvResult.reachable,
+    artifactoryReachable: artResult.reachable && artResult.authenticated
+  };
+  return {
+    artifactory: {
+      reachable: artResult.reachable,
+      url: artCfg.baseUrl ?? "(not configured)",
+      authenticated: artResult.authenticated,
+      repositories: {
+        npm: artCfg.npmRepo ?? "(not configured)",
+        nuget: artCfg.nugetRepo ?? "(not configured)",
+        maven: artCfg.mavenRepo ?? "(not configured)"
+      },
+      ...artResult.error ? { error: artResult.error } : {}
+    },
+    osv: {
+      reachable: osvResult.reachable,
+      url: "https://api.osv.dev",
+      ...osvResult.error ? { error: osvResult.error } : {}
+    },
+    tier,
+    capabilities: {
+      scan: true,
+      diff: true,
+      outdated: artResult.reachable && artResult.authenticated,
+      licenseCheck: artResult.reachable && artResult.authenticated,
+      cveCheck: osvResult.reachable
+    }
+  };
+}
+
+// src/services/deps/frisk.ts
+async function runFrisk(config, opts) {
+  const repoRoot = getRepoRoot2();
+  if (!repoRoot) {
+    throw new PncliError("Not inside a git repository.", 1);
+  }
+  const { tier, osvReachable } = await detectTier(config);
+  if (!osvReachable) {
+    throw new PncliError(
+      "deps frisk requires OSV.dev access but api.osv.dev is not reachable from this machine. Run 'pncli deps connectivity' to diagnose.",
+      503
+    );
+  }
+  const scanOpts = {
+    ...opts,
+    includeTransitive: opts.includeTransitive ?? true
+  };
+  const scan = scanRepo(repoRoot, scanOpts);
+  if (scan.packages.length === 0) {
+    return { tier, scanned: 0, vulnerable: 0, packages: [] };
+  }
+  const vulnerable = await checkPackagesForVulns(scan.packages);
+  return {
+    tier,
+    scanned: scan.packages.length,
+    vulnerable: vulnerable.length,
+    packages: vulnerable
+  };
+}
+
+// src/services/deps/outdated.ts
+async function runOutdated(config, opts, filterType) {
+  const repoRoot = getRepoRoot2();
+  if (!repoRoot) {
+    throw new PncliError("Not inside a git repository.", 1);
+  }
+  requireArtifactory(config.artifactory, "deps outdated");
+  const { artifactoryReachable } = await detectTier(config);
+  if (!artifactoryReachable) {
+    throw new PncliError(
+      `Artifactory at ${config.artifactory.baseUrl} is not reachable or authentication failed. Run 'pncli deps connectivity' to diagnose.`,
+      503
+    );
+  }
+  const scan = scanRepo(repoRoot, { ...opts, includeTransitive: false });
+  const directPackages = scan.packages.filter((p) => p.type === "direct");
+  const { outdated, uncheckedEcosystems } = await getOutdatedPackages(
+    directPackages,
+    config.artifactory,
+    filterType
+  );
+  const summary = { total: outdated.length, major: 0, minor: 0, patch: 0 };
+  for (const pkg2 of outdated) summary[pkg2.updateType]++;
+  return {
+    source: "artifactory",
+    artifactoryUrl: config.artifactory.baseUrl ?? "",
+    outdated,
+    uncheckedEcosystems,
+    summary
+  };
+}
+
+// src/services/deps/license-check.ts
+async function runLicenseCheck(config, opts) {
+  const repoRoot = getRepoRoot2();
+  if (!repoRoot) {
+    throw new PncliError("Not inside a git repository.", 1);
+  }
+  requireArtifactory(config.artifactory, "deps license-check");
+  const { artifactoryReachable } = await detectTier(config);
+  if (!artifactoryReachable) {
+    throw new PncliError(
+      `Artifactory at ${config.artifactory.baseUrl} is not reachable or authentication failed. Run 'pncli deps connectivity' to diagnose.`,
+      503
+    );
+  }
+  const scan = scanRepo(repoRoot, { ...opts, includeTransitive: false });
+  const directPackages = scan.packages.filter((p) => p.type === "direct");
+  const licensed = await getLicensedPackages(directPackages, config.artifactory);
+  const byLicense = {};
+  let unknown = 0;
+  for (const pkg2 of licensed) {
+    if (!pkg2.license) {
+      unknown++;
+    } else {
+      byLicense[pkg2.license] = (byLicense[pkg2.license] ?? 0) + 1;
+    }
+  }
+  return {
+    source: "artifactory",
+    artifactoryUrl: config.artifactory.baseUrl ?? "",
+    packages: licensed,
+    summary: {
+      total: licensed.length,
+      byLicense,
+      unknown
+    }
+  };
+}
+
+// src/services/deps/commands.ts
+function registerDepsCommands(program2) {
+  const deps = program2.command("deps").description("Dependency scanning, CVE detection, and license auditing");
+  deps.command("frisk").description("Scan all dependencies for CVEs and output remediation paths (requires OSV.dev)").option("--ecosystem <ecosystem>", "Filter to one ecosystem: npm, nuget, maven, all", "all").option("--direct-only", "Only scan direct dependencies (default: include transitive)", false).option("--include-dev", "Include dev/test dependencies", false).action(async (opts, cmd) => {
+    const startTime = Date.now();
+    try {
+      const globalOpts = cmd.optsWithGlobals();
+      const config = loadConfig({ configPath: globalOpts.config });
+      const scanOpts = {
+        ecosystem: opts.ecosystem,
+        includeTransitive: !opts.directOnly,
+        includeDev: opts.includeDev
+      };
+      const data = await runFrisk(config, scanOpts);
+      success(data, "deps", "frisk", startTime);
+    } catch (err) {
+      fail(err, "deps", "frisk", startTime);
+    }
+  });
+  deps.command("scan").description("Inventory all dependencies from manifest files (local only, no network)").option("--ecosystem <ecosystem>", "Filter to one ecosystem: npm, nuget, maven, all", "all").option("--include-transitive", "Include transitive dependencies", false).option("--include-dev", "Include dev/test dependencies", false).action((opts, cmd) => {
+    const startTime = Date.now();
+    try {
+      const globalOpts = cmd.optsWithGlobals();
+      const config = loadConfig({ configPath: globalOpts.config });
+      const scanOpts = {
+        ecosystem: opts.ecosystem,
+        includeTransitive: opts.includeTransitive,
+        includeDev: opts.includeDev
+      };
+      const data = runScan(config, scanOpts);
+      success(data, "deps", "scan", startTime);
+    } catch (err) {
+      fail(err, "deps", "scan", startTime);
+    }
+  });
+  deps.command("diff").description("Show dependency changes between two git refs (local only, no network)").requiredOption("--from <ref>", "Base git ref (commit, tag, or branch)").option("--to <ref>", "Target git ref (default: working tree)").option("--ecosystem <ecosystem>", "Filter to one ecosystem: npm, nuget, maven, all", "all").option("--include-dev", "Include dev/test dependencies", false).action((opts, cmd) => {
+    const startTime = Date.now();
+    try {
+      const globalOpts = cmd.optsWithGlobals();
+      const config = loadConfig({ configPath: globalOpts.config });
+      const scanOpts = {
+        ecosystem: opts.ecosystem,
+        includeTransitive: true,
+        includeDev: opts.includeDev
+      };
+      const data = runDiff(config, opts.from, opts.to ?? null, scanOpts);
+      success(data, "deps", "diff", startTime);
+    } catch (err) {
+      fail(err, "deps", "diff", startTime);
+    }
+  });
+  deps.command("outdated").description("Check for newer versions available in Artifactory (requires Artifactory)").option("--ecosystem <ecosystem>", "Filter to one ecosystem: npm, nuget, maven, all", "all").option("--major", "Only show major version bumps").option("--minor", "Only show minor version bumps or higher").option("--patch", "Only show patch version bumps or higher").action(async (opts, cmd) => {
+    const startTime = Date.now();
+    try {
+      const globalOpts = cmd.optsWithGlobals();
+      const config = loadConfig({ configPath: globalOpts.config });
+      const scanOpts = { ecosystem: opts.ecosystem };
+      const filterType = opts.major ? "major" : opts.minor ? "minor" : opts.patch ? "patch" : void 0;
+      const data = await runOutdated(config, scanOpts, filterType);
+      success(data, "deps", "outdated", startTime);
+    } catch (err) {
+      fail(err, "deps", "outdated", startTime);
+    }
+  });
+  deps.command("license-check").description("Report licenses for all direct dependencies via Artifactory (requires Artifactory)").option("--ecosystem <ecosystem>", "Filter to one ecosystem: npm, nuget, maven, all", "all").option("--include-dev", "Include dev/test dependencies", false).action(async (opts, cmd) => {
+    const startTime = Date.now();
+    try {
+      const globalOpts = cmd.optsWithGlobals();
+      const config = loadConfig({ configPath: globalOpts.config });
+      const scanOpts = {
+        ecosystem: opts.ecosystem,
+        includeDev: opts.includeDev
+      };
+      const data = await runLicenseCheck(config, scanOpts);
+      success(data, "deps", "license-check", startTime);
+    } catch (err) {
+      fail(err, "deps", "license-check", startTime);
+    }
+  });
+  deps.command("connectivity").description("Test network access to Artifactory and OSV.dev, report available tier").action(async (_opts, cmd) => {
+    const startTime = Date.now();
+    try {
+      const globalOpts = cmd.optsWithGlobals();
+      const config = loadConfig({ configPath: globalOpts.config });
+      const data = await buildConnectivityData(config);
+      success(data, "deps", "connectivity", startTime);
+    } catch (err) {
+      fail(err, "deps", "connectivity", startTime);
+    }
   });
 }
 
 // src/services/config/commands.ts
 import { input, password, confirm } from "@inquirer/prompts";
-import fs2 from "fs";
+import fs3 from "fs";
 function registerConfigCommands(program2) {
   const config = program2.command("config").description("Manage pncli configuration");
   config.command("init").description("Interactive setup wizard").option("--repo", "Write repo config (.pncli.json) instead of global config").action(async (opts) => {
@@ -1361,7 +2823,7 @@ function registerConfigCommands(program2) {
     } catch (err) {
       if (err instanceof Error && err.message.includes("User force closed")) {
         process.stderr.write("\nSetup cancelled.\n");
-        process.exit(1);
+        process.exit(ExitCode.GENERAL_ERROR);
       }
       fail(err, "config", "init", start);
     }
@@ -1397,17 +2859,24 @@ function registerConfigCommands(program2) {
 }
 async function initGlobalConfig(start) {
   process.stderr.write("pncli config init \u2014 Global configuration\n\n");
-  const jiraBaseUrl = await input({
-    message: "Jira base URL (e.g. https://your-domain.atlassian.net):",
+  process.stderr.write("\u2500\u2500 Identity \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+  const userEmail = await input({
+    message: "Your email address (used across Jira, Bitbucket, etc.):",
     default: ""
   });
-  const jiraEmail = await input({
-    message: "Jira email address:",
+  const userId = await input({
+    message: "Your username / user ID:",
+    default: ""
+  });
+  process.stderr.write("\n\u2500\u2500 Jira \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+  const jiraBaseUrl = await input({
+    message: "Jira base URL (e.g. https://jira.your-company.com):",
     default: ""
   });
   const jiraApiToken = await password({
-    message: "Jira API token:"
+    message: "Jira personal access token:"
   });
+  process.stderr.write("\n\u2500\u2500 Bitbucket \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
   const bitbucketBaseUrl = await input({
     message: "Bitbucket Server base URL (e.g. https://bitbucket.your-company.com):",
     default: ""
@@ -1415,28 +2884,74 @@ async function initGlobalConfig(start) {
   const bitbucketPat = await password({
     message: "Bitbucket personal access token:"
   });
+  process.stderr.write("\n\u2500\u2500 Artifactory \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+  const useArtifactory = await confirm({
+    message: "Configure Artifactory for dependency commands (deps outdated, deps license-check)?",
+    default: false
+  });
+  let artifactoryBaseUrl = "";
+  let artifactoryToken = "";
+  let npmRepo = "";
+  let nugetRepo = "";
+  let mavenRepo = "";
+  if (useArtifactory) {
+    artifactoryBaseUrl = await input({
+      message: "Artifactory base URL (e.g. https://artifactory.company.com):",
+      default: ""
+    });
+    artifactoryToken = await password({
+      message: "Artifactory API token:"
+    });
+    process.stderr.write("\nConfigure which ecosystems you use (skip any that don't apply):\n");
+    const useNpm = await confirm({ message: "  Use npm packages from Artifactory?", default: true });
+    if (useNpm) {
+      npmRepo = await input({ message: "  npm repository name:", default: "npm-remote" });
+    }
+    const useNuget = await confirm({ message: "  Use NuGet packages from Artifactory?", default: false });
+    if (useNuget) {
+      nugetRepo = await input({ message: "  NuGet repository name:", default: "nuget-remote" });
+    }
+    const useMaven = await confirm({ message: "  Use Maven packages from Artifactory?", default: false });
+    if (useMaven) {
+      mavenRepo = await input({ message: "  Maven repository name:", default: "libs-release" });
+    }
+  }
+  process.stderr.write("\n\u2500\u2500 Defaults \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
   const jiraProject = await input({
     message: "Default Jira project key (optional):",
     default: ""
   });
+  process.stderr.write("\n");
   const confirmed = await confirm({
     message: "Write config to ~/.pncli/config.json?",
     default: true
   });
   if (!confirmed) {
     process.stderr.write("Aborted.\n");
-    process.exit(0);
+    process.exit(ExitCode.SUCCESS);
   }
   writeGlobalConfig({
+    user: {
+      email: userEmail || void 0,
+      userId: userId || void 0
+    },
     jira: {
       baseUrl: jiraBaseUrl || void 0,
-      email: jiraEmail || void 0,
       apiToken: jiraApiToken || void 0
     },
     bitbucket: {
       baseUrl: bitbucketBaseUrl || void 0,
       pat: bitbucketPat || void 0
     },
+    ...useArtifactory ? {
+      artifactory: {
+        baseUrl: artifactoryBaseUrl || void 0,
+        token: artifactoryToken || void 0,
+        npmRepo: npmRepo || void 0,
+        nugetRepo: nugetRepo || void 0,
+        mavenRepo: mavenRepo || void 0
+      }
+    } : {},
     defaults: {
       jira: {
         project: jiraProject || void 0
@@ -1471,16 +2986,16 @@ async function initRepoConfig(start) {
   });
   if (!confirmed) {
     process.stderr.write("Aborted.\n");
-    process.exit(0);
+    process.exit(ExitCode.SUCCESS);
   }
-  if (fs2.existsSync(".pncli.json")) {
+  if (fs3.existsSync(".pncli.json")) {
     const overwrite = await confirm({
       message: ".pncli.json already exists. Overwrite?",
       default: false
     });
     if (!overwrite) {
       process.stderr.write("Aborted.\n");
-      process.exit(0);
+      process.exit(ExitCode.SUCCESS);
     }
   }
   writeRepoConfig({
@@ -1510,27 +3025,32 @@ program.hook("preAction", (thisCommand) => {
     pretty: Boolean(opts.pretty),
     verbose: Boolean(opts.verbose)
   });
+  try {
+    const config = loadConfig({ configPath: opts.config });
+    setGlobalUser(config.user);
+  } catch {
+  }
 });
 registerGitCommands(program);
 registerJiraCommands(program);
 registerBitbucketCommands(program);
 registerConfluenceCommands(program);
 registerSonarCommands(program);
-registerArtifactoryCommands(program);
+registerDepsCommands(program);
 registerConfigCommands(program);
 program.addHelpText("after", `
 Services:
   git          Local git operations (status, diff, log, branch)
+  deps         Dependency scanning, CVE detection, license auditing
   jira         Jira Data Cloud (coming soon)
   bitbucket    Bitbucket Server (coming soon)
   confluence   Confluence (coming soon)
   sonar        SonarQube (coming soon)
-  artifactory  Artifactory (coming soon)
   config       Manage pncli configuration
 `);
 program.parseAsync(process.argv).catch((err) => {
   process.stderr.write(`Fatal: ${err instanceof Error ? err.message : String(err)}
 `);
-  process.exit(1);
+  process.exit(ExitCode.GENERAL_ERROR);
 });
 //# sourceMappingURL=cli.js.map