@kolatts/pncli 1.1.0 → 1.2.0

package/dist/cli.js

@@ -19,6 +19,24 @@ var PncliError = class extends Error {
   }
 };
 
+// src/lib/exitCodes.ts
+var ExitCode = {
+  SUCCESS: 0,
+  GENERAL_ERROR: 1,
+  USAGE_ERROR: 2,
+  NETWORK_ERROR: 69,
+  // EX_UNAVAILABLE from sysexits.h
+  AUTH_ERROR: 77,
+  // EX_NOPERM from sysexits.h
+  CONFIG_ERROR: 78
+  // EX_CONFIG from sysexits.h
+};
+function exitCodeFromStatus(httpStatus) {
+  if (httpStatus === 401 || httpStatus === 403) return ExitCode.AUTH_ERROR;
+  if (httpStatus === 0) return ExitCode.NETWORK_ERROR;
+  return ExitCode.GENERAL_ERROR;
+}
+
 // src/lib/output.ts
 var globalOptions = { pretty: false, verbose: false };
 var globalUser = { email: void 0, userId: void 0 };
@@ -60,10 +78,10 @@ function fail(err, service, action, startTime) {
   };
   const msg = globalOptions.pretty ? chalk.red("\u2717 Error: ") + errorDetail.message : null;
   if (msg) process.stderr.write(msg + "\n");
-  process.stdout.write(
-    (globalOptions.pretty ? JSON.stringify(envelope, null, 2) : JSON.stringify(envelope)) + "\n"
-  );
-  process.exit(1);
+  const output = (globalOptions.pretty ? JSON.stringify(envelope, null, 2) : JSON.stringify(envelope)) + "\n";
+  const exitCode = err instanceof PncliError ? exitCodeFromStatus(err.status) : ExitCode.GENERAL_ERROR;
+  process.stdout.write(output, () => process.exit(exitCode));
+  throw new PncliError(errorDetail.message, errorDetail.status);
 }
 function log(message) {
   if (globalOptions.verbose) {
@@ -90,6 +108,11 @@ var ENV_KEYS = {
   JIRA_API_TOKEN: "PNCLI_JIRA_API_TOKEN",
   BITBUCKET_BASE_URL: "PNCLI_BITBUCKET_BASE_URL",
   BITBUCKET_PAT: "PNCLI_BITBUCKET_PAT",
+  ARTIFACTORY_BASE_URL: "PNCLI_ARTIFACTORY_BASE_URL",
+  ARTIFACTORY_TOKEN: "PNCLI_ARTIFACTORY_TOKEN",
+  ARTIFACTORY_REPO_NPM: "PNCLI_ARTIFACTORY_REPO_NPM",
+  ARTIFACTORY_REPO_NUGET: "PNCLI_ARTIFACTORY_REPO_NUGET",
+  ARTIFACTORY_REPO_MAVEN: "PNCLI_ARTIFACTORY_REPO_MAVEN",
   CONFIG_PATH: "PNCLI_CONFIG_PATH"
 };
 function getGlobalConfigPath(overridePath) {
@@ -148,6 +171,13 @@ function loadConfig(opts = {}) {
       baseUrl: process.env[ENV_KEYS.BITBUCKET_BASE_URL] ?? globalConfig.bitbucket?.baseUrl,
       pat: process.env[ENV_KEYS.BITBUCKET_PAT] ?? globalConfig.bitbucket?.pat
     },
+    artifactory: {
+      baseUrl: process.env[ENV_KEYS.ARTIFACTORY_BASE_URL] ?? globalConfig.artifactory?.baseUrl,
+      token: process.env[ENV_KEYS.ARTIFACTORY_TOKEN] ?? globalConfig.artifactory?.token,
+      npmRepo: process.env[ENV_KEYS.ARTIFACTORY_REPO_NPM] ?? globalConfig.artifactory?.npmRepo,
+      nugetRepo: process.env[ENV_KEYS.ARTIFACTORY_REPO_NUGET] ?? globalConfig.artifactory?.nugetRepo,
+      mavenRepo: process.env[ENV_KEYS.ARTIFACTORY_REPO_MAVEN] ?? globalConfig.artifactory?.mavenRepo
+    },
     defaults: mergedDefaults
   };
 }
@@ -190,6 +220,10 @@ function maskConfig(config) {
     bitbucket: {
       ...config.bitbucket,
       pat: config.bitbucket.pat ? "***" : void 0
+    },
+    artifactory: {
+      ...config.artifactory,
+      token: config.artifactory.token ? "***" : void 0
     }
   };
 }
@@ -394,8 +428,8 @@ function getGitContext(config) {
 }
 
 // src/lib/http.ts
-function buildUrl(base, path2, params) {
-  const url = new URL(path2, base.endsWith("/") ? base : base + "/");
+function buildUrl(base, path6, params) {
+  const url = new URL(path6, base.endsWith("/") ? base : base + "/");
   if (params) {
     for (const [key, val] of Object.entries(params)) {
       if (val !== void 0) {
@@ -440,8 +474,24 @@ async function request(url, init, timeoutMs) {
       try {
         const body = await response.text();
         const parsed = JSON.parse(body);
-        if (parsed.message) message = parsed.message;
-        else if (parsed.errors?.[0]?.message) message = parsed.errors[0].message;
+        const parts = [];
+        if (Array.isArray(parsed.errorMessages)) {
+          parts.push(...parsed.errorMessages.filter(Boolean));
+        }
+        if (parsed.errors && typeof parsed.errors === "object" && !Array.isArray(parsed.errors)) {
+          for (const [field, msg] of Object.entries(parsed.errors)) {
+            parts.push(`${field}: ${msg}`);
+          }
+        }
+        if (Array.isArray(parsed.errors)) {
+          for (const e of parsed.errors) {
+            if (e?.message) parts.push(e.message);
+          }
+        }
+        if (parts.length === 0 && parsed.message) {
+          parts.push(String(parsed.message));
+        }
+        if (parts.length > 0) message = parts.join("; ");
       } catch {
       }
       throw new PncliError(message, response.status, url);
@@ -466,7 +516,8 @@ var HttpClient = class {
     return {
       "Authorization": `Bearer ${apiToken}`,
       "Content-Type": "application/json",
-      "Accept": "application/json"
+      "Accept": "application/json",
+      "Connection": "close"
     };
   }
   bitbucketHeaders() {
@@ -475,13 +526,14 @@ var HttpClient = class {
     return {
       "Authorization": `Bearer ${pat}`,
       "Content-Type": "application/json",
-      "Accept": "application/json"
+      "Accept": "application/json",
+      "Connection": "close"
     };
   }
-  async jira(path2, opts = {}) {
+  async jira(path6, opts = {}) {
     const baseUrl = this.config.jira.baseUrl;
     if (!baseUrl) throw new PncliError("Jira baseUrl not configured. Run: pncli config init");
-    const url = buildUrl(baseUrl, path2, opts.params);
+    const url = buildUrl(baseUrl, path6, opts.params);
     const headers = this.jiraHeaders();
     const init = {
       method: opts.method ?? "GET",
@@ -490,19 +542,20 @@ var HttpClient = class {
     };
     if (this.dryRun) {
       const safeHeaders = { ...headers, Authorization: "[REDACTED]" };
-      process.stderr.write(`DRY RUN: ${init.method} ${url}
+      const msg = `DRY RUN: ${init.method} ${url}
 Headers: ${JSON.stringify(safeHeaders, null, 2)}
-`);
-      if (opts.body) process.stderr.write(`Body: ${JSON.stringify(opts.body, null, 2)}
-`);
-      process.exit(0);
+` + (opts.body ? `Body: ${JSON.stringify(opts.body, null, 2)}
+` : "");
+      process.stderr.write(msg, () => process.exit(ExitCode.SUCCESS));
+      return new Promise(() => {
+      });
     }
     return request(url, init, opts.timeoutMs ?? 3e4);
   }
-  async bitbucket(path2, opts = {}) {
+  async bitbucket(path6, opts = {}) {
     const baseUrl = this.config.bitbucket.baseUrl;
     if (!baseUrl) throw new PncliError("Bitbucket baseUrl not configured. Run: pncli config init");
-    const url = buildUrl(baseUrl, path2, opts.params);
+    const url = buildUrl(baseUrl, path6, opts.params);
     const headers = this.bitbucketHeaders();
     const init = {
       method: opts.method ?? "GET",
@@ -511,12 +564,13 @@ Headers: ${JSON.stringify(safeHeaders, null, 2)}
     };
     if (this.dryRun) {
       const safeHeaders = { ...headers, Authorization: "[REDACTED]" };
-      process.stderr.write(`DRY RUN: ${init.method} ${url}
+      const msg = `DRY RUN: ${init.method} ${url}
 Headers: ${JSON.stringify(safeHeaders, null, 2)}
-`);
-      if (opts.body) process.stderr.write(`Body: ${JSON.stringify(opts.body, null, 2)}
-`);
-      process.exit(0);
+` + (opts.body ? `Body: ${JSON.stringify(opts.body, null, 2)}
+` : "");
+      process.stderr.write(msg, () => process.exit(ExitCode.SUCCESS));
+      return new Promise(() => {
+      });
     }
     return request(url, init, opts.timeoutMs ?? 3e4);
   }
@@ -1436,21 +1490,1326 @@ function registerSonarCommands(program2) {
   });
 }
 
-// src/services/artifactory/commands.ts
-function registerArtifactoryCommands(program2) {
-  program2.command("artifactory").description("Artifactory operations").action(() => {
-    success(
-      { message: "Coming soon \u2014 the nightmare never ends." },
-      "artifactory",
-      "stub",
-      Date.now()
+// src/services/deps/parsers/index.ts
+import fs2 from "fs";
+import path5 from "path";
+import { execSync as execSync4, execFileSync as execFileSync2 } from "child_process";
+
+// src/services/deps/parsers/npm.ts
+import path2 from "path";
+function findNpmManifests(files) {
+  const lockFiles = new Set(
+    files.filter((f) => {
+      const base = path2.basename(f);
+      return base === "package-lock.json" || base === "yarn.lock" || base === "pnpm-lock.yaml";
+    })
+  );
+  const manifests = [];
+  for (const file of files) {
+    if (path2.basename(file) !== "package.json") continue;
+    if (file.split("/").includes("node_modules")) continue;
+    const dir = path2.dirname(file);
+    let lockFile;
+    for (const lf of ["package-lock.json", "yarn.lock", "pnpm-lock.yaml"]) {
+      const candidate = dir === "." ? lf : `${dir}/${lf}`;
+      if (lockFiles.has(candidate)) {
+        lockFile = candidate;
+        break;
+      }
+    }
+    manifests.push({ file, ecosystem: "npm", lockFile });
+  }
+  return manifests;
+}
+function parseNpmPackages(content, manifest, opts, lockContent) {
+  if (lockContent && manifest.lockFile) {
+    const base = path2.basename(manifest.lockFile);
+    if (base === "package-lock.json") {
+      const pkgs = parsePackageLock(lockContent, manifest.lockFile, opts);
+      if (pkgs.length > 0) return pkgs;
+    } else if (base === "yarn.lock") {
+      return parseYarnLock(lockContent, manifest.lockFile, opts, content);
+    } else if (base === "pnpm-lock.yaml") {
+      return parsePnpmLock(lockContent, manifest.lockFile, opts, content);
+    }
+  }
+  return parsePackageJson(content, manifest.file, opts);
+}
+function stripVersionPrefix(v) {
+  return v.replace(/^[\^~>=<* ]+/, "").split(/\s/)[0] ?? v;
+}
+function parsePackageJson(content, filePath, opts) {
+  let pkg2;
+  try {
+    pkg2 = JSON.parse(content);
+  } catch {
+    return [];
+  }
+  const packages = [];
+  for (const [name, version] of Object.entries(pkg2.dependencies ?? {})) {
+    packages.push({
+      name,
+      version: stripVersionPrefix(version),
+      ecosystem: "npm",
+      source: filePath,
+      type: "direct",
+      scope: "production"
+    });
+  }
+  if (opts.includeDev) {
+    for (const [name, version] of Object.entries(pkg2.devDependencies ?? {})) {
+      packages.push({
+        name,
+        version: stripVersionPrefix(version),
+        ecosystem: "npm",
+        source: filePath,
+        type: "direct",
+        scope: "dev"
+      });
+    }
+  }
+  return packages;
+}
+function parsePackageLock(content, lockFilePath, opts) {
+  let lock;
+  try {
+    lock = JSON.parse(content);
+  } catch {
+    return [];
+  }
+  if ((lock.lockfileVersion ?? 1) < 2 || !lock.packages) return [];
+  const packages = [];
+  for (const [pkgPath, meta] of Object.entries(lock.packages)) {
+    if (pkgPath === "") continue;
+    if (!meta.version) continue;
+    const isDev = meta.dev === true || meta.devOptional === true;
+    if (isDev && !opts.includeDev) continue;
+    const withoutRoot = pkgPath.startsWith("node_modules/") ? pkgPath.slice("node_modules/".length) : pkgPath;
+    const segments = withoutRoot.split("/node_modules/");
+    const isTransitive = segments.length > 1;
+    if (isTransitive && !opts.includeTransitive) continue;
+    const name = segments[segments.length - 1] ?? pkgPath;
+    packages.push({
+      name,
+      version: meta.version,
+      ecosystem: "npm",
+      source: lockFilePath,
+      type: isTransitive ? "transitive" : "direct",
+      scope: isDev ? "dev" : "production"
+    });
+  }
+  return packages;
+}
+function parseYarnLock(content, lockFilePath, opts, packageJsonContent) {
+  let pkgJson;
+  try {
+    pkgJson = JSON.parse(packageJsonContent);
+  } catch {
+    pkgJson = {};
+  }
+  const directDeps = new Set(Object.keys(pkgJson.dependencies ?? {}));
+  const devDeps = new Set(Object.keys(pkgJson.devDependencies ?? {}));
+  const allDirectDeps = /* @__PURE__ */ new Set([...directDeps, ...devDeps]);
+  const packages = [];
+  const seen = /* @__PURE__ */ new Set();
+  const blockRegex = /^"?(@?[^@"\n][^"\n]*)@[^:]+:?\n\s+version "([^"]+)"/gm;
+  for (const match of content.matchAll(blockRegex)) {
+    const name = match[1].trim().replace(/^"|"$/g, "");
+    const version = match[2];
+    const key = `${name}@${version}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    const isDev = devDeps.has(name) && !directDeps.has(name);
+    if (isDev && !opts.includeDev) continue;
+    const isTransitive = !allDirectDeps.has(name);
+    if (isTransitive && !opts.includeTransitive) continue;
+    packages.push({
+      name,
+      version,
+      ecosystem: "npm",
+      source: lockFilePath,
+      type: isTransitive ? "transitive" : "direct",
+      scope: isDev ? "dev" : "production"
+    });
+  }
+  return packages;
+}
+function parsePnpmLock(content, lockFilePath, opts, packageJsonContent) {
+  let pkgJson;
+  try {
+    pkgJson = JSON.parse(packageJsonContent);
+  } catch {
+    pkgJson = {};
+  }
+  const directDeps = new Set(Object.keys(pkgJson.dependencies ?? {}));
+  const devDeps = new Set(Object.keys(pkgJson.devDependencies ?? {}));
+  const allDirectDeps = /* @__PURE__ */ new Set([...directDeps, ...devDeps]);
+  const packages = [];
+  const seen = /* @__PURE__ */ new Set();
+  const blockRegex = /^\s{2}(\/?@?[^@\s/][^@\s]*)@(\d[^:\s]*):\s*\n((?:\s{4}[^\n]+\n)*)/gm;
+  for (const match of content.matchAll(blockRegex)) {
+    const name = match[1].replace(/^\//, "");
+    const version = match[2];
+    const attrs = match[3] ?? "";
+    const key = `${name}@${version}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    const isDev = devDeps.has(name) && !directDeps.has(name) || /^\s+dev:\s*true/m.test(attrs);
+    if (isDev && !opts.includeDev) continue;
+    const isTransitive = !allDirectDeps.has(name);
+    if (isTransitive && !opts.includeTransitive) continue;
+    packages.push({
+      name,
+      version,
+      ecosystem: "npm",
+      source: lockFilePath,
+      type: isTransitive ? "transitive" : "direct",
+      scope: isDev ? "dev" : "production"
+    });
+  }
+  return packages;
+}
+
+// src/services/deps/parsers/nuget.ts
+import path3 from "path";
+var PROJ_EXTENSIONS = /* @__PURE__ */ new Set([".csproj", ".fsproj", ".vbproj"]);
+function findNugetManifests(files) {
+  const lockFiles = /* @__PURE__ */ new Map();
+  for (const f of files) {
+    if (path3.basename(f) === "packages.lock.json") {
+      lockFiles.set(path3.dirname(f), f);
+    }
+  }
+  const manifests = [];
+  for (const file of files) {
+    const base = path3.basename(file);
+    const ext = path3.extname(file);
+    if (PROJ_EXTENSIONS.has(ext) || base === "packages.config") {
+      const dir = path3.dirname(file);
+      const lockFile = lockFiles.get(dir);
+      manifests.push({ file, ecosystem: "nuget", lockFile });
+    }
+    if (base === "Directory.Packages.props") {
+      const dir = path3.dirname(file);
+      manifests.push({ file, ecosystem: "nuget", lockFile: lockFiles.get(dir) });
+    }
+  }
+  const deduped = [];
+  const seenLocks = /* @__PURE__ */ new Set();
+  for (const manifest of manifests) {
+    if (!manifest.lockFile) {
+      deduped.push(manifest);
+      continue;
+    }
+    if (!seenLocks.has(manifest.lockFile)) {
+      seenLocks.add(manifest.lockFile);
+      deduped.push(manifest);
+    }
+  }
+  return deduped;
+}
+function parseNugetPackages(content, manifest, opts, lockContent, propsContent) {
+  const base = path3.basename(manifest.file);
+  if (lockContent) {
+    return parsePackagesLock(lockContent, manifest.lockFile ?? manifest.file, opts);
+  }
+  if (base === "packages.config") {
+    return parsePackagesConfig(content, manifest.file);
+  }
+  if (base === "Directory.Packages.props") {
+    return parseDirectoryPackagesProps(content, manifest.file);
+  }
+  return parseCsproj(content, manifest.file, propsContent);
+}
+function parseCsproj(content, filePath, propsContent) {
+  const centralVersions = propsContent ? extractCentralVersions(propsContent) : /* @__PURE__ */ new Map();
+  const packages = [];
+  const singleLine = /<PackageReference\s+([^>]+?)\/>/gi;
+  const multiLine = /<PackageReference\s+([^>]+?)>([\s\S]*?)<\/PackageReference>/gi;
+  const extractFromAttrsAndInner = (attrs, inner) => {
+    const nameMatch = /\bInclude="([^"]+)"/i.exec(attrs);
+    if (!nameMatch) return;
+    const name = nameMatch[1];
+    let version;
+    const attrVersion = /\bVersion="([^"]+)"/i.exec(attrs);
+    if (attrVersion) {
+      version = attrVersion[1];
+    } else if (inner) {
+      const innerVersion = /<Version>([^<]+)<\/Version>/i.exec(inner);
+      if (innerVersion) version = innerVersion[1];
+    }
+    if (!version || version.startsWith("$(")) {
+      version = centralVersions.get(name) ?? centralVersions.get(name.toLowerCase());
+    }
+    if (!version) return;
+    packages.push({
+      name,
+      version,
+      ecosystem: "nuget",
+      source: filePath,
+      type: "direct",
+      scope: "production"
+    });
+  };
+  for (const m of content.matchAll(singleLine)) {
+    extractFromAttrsAndInner(m[1], "");
+  }
+  for (const m of content.matchAll(multiLine)) {
+    extractFromAttrsAndInner(m[1], m[2] ?? "");
+  }
+  return packages;
+}
+function extractCentralVersions(propsContent) {
+  const map = /* @__PURE__ */ new Map();
+  const regex = /<PackageVersion\s+Include="([^"]+)"\s+Version="([^"]+)"/gi;
+  for (const m of propsContent.matchAll(regex)) {
+    map.set(m[1], m[2]);
+    map.set(m[1].toLowerCase(), m[2]);
+  }
+  return map;
+}
+function parseDirectoryPackagesProps(content, filePath) {
+  const packages = [];
+  const regex = /<PackageVersion\s+Include="([^"]+)"\s+Version="([^"]+)"/gi;
+  for (const m of content.matchAll(regex)) {
+    packages.push({
+      name: m[1],
+      version: m[2],
+      ecosystem: "nuget",
+      source: filePath,
+      type: "direct",
+      scope: "production"
+    });
+  }
+  return packages;
+}
+function parsePackagesConfig(content, filePath) {
+  const packages = [];
+  const regex = /<package\s+id="([^"]+)"\s+version="([^"]+)"/gi;
+  for (const m of content.matchAll(regex)) {
+    packages.push({
+      name: m[1],
+      version: m[2],
+      ecosystem: "nuget",
+      source: filePath,
+      type: "direct",
+      scope: "production"
+    });
+  }
+  return packages;
+}
+function parsePackagesLock(content, filePath, opts) {
+  let lock;
+  try {
+    lock = JSON.parse(content);
+  } catch {
+    return [];
+  }
+  const packages = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const frameworkDeps of Object.values(lock.dependencies ?? {})) {
+    for (const [name, meta] of Object.entries(frameworkDeps)) {
+      const version = meta.resolved ?? "";
+      if (!version) continue;
+      const isTransitive = meta.type === "Transitive";
+      if (isTransitive && !opts.includeTransitive) continue;
+      const key = `${name}@${version}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      packages.push({
+        name,
+        version,
+        ecosystem: "nuget",
+        source: filePath,
+        type: isTransitive ? "transitive" : "direct",
+        scope: "production"
+      });
+    }
+  }
+  return packages;
+}
+
+// src/services/deps/parsers/maven.ts
+import path4 from "path";
+function findMavenManifests(files) {
+  const lockFiles = new Set(files.filter((f) => path4.basename(f) === "gradle.lockfile"));
+  const manifests = [];
+  for (const file of files) {
+    const base = path4.basename(file);
+    if (base === "pom.xml" || base === "build.gradle" || base === "build.gradle.kts") {
+      const dir = path4.dirname(file);
+      const lockCandidate = dir === "." ? "gradle.lockfile" : `${dir}/gradle.lockfile`;
+      const lockFile = lockFiles.has(lockCandidate) ? lockCandidate : void 0;
+      manifests.push({ file, ecosystem: "maven", lockFile });
+    }
+  }
+  return manifests;
+}
+function parseMavenPackages(content, manifest, opts, lockContent) {
+  const base = path4.basename(manifest.file);
+  if (lockContent && manifest.lockFile) {
+    return parseGradleLock(lockContent, manifest.lockFile, opts);
+  }
+  if (base === "pom.xml") {
+    return parsePomXml(content, manifest.file, opts);
+  }
+  if (base === "build.gradle" || base === "build.gradle.kts") {
+    return parseBuildGradle(content, manifest.file, opts);
+  }
+  return [];
+}
+function parsePomXml(content, filePath, opts) {
+  const props = extractPomProperties(content);
+  const managedVersions = extractDependencyManagement(content, props);
+  const withoutMgmt = content.replace(/<dependencyManagement>[\s\S]*?<\/dependencyManagement>/gi, "");
+  const packages = [];
+  const depRegex = /<dependency>([\s\S]*?)<\/dependency>/gi;
+  for (const match of withoutMgmt.matchAll(depRegex)) {
+    const inner = match[1];
+    const groupId = /<groupId>\s*([^<\s]+)\s*<\/groupId>/i.exec(inner)?.[1];
+    const artifactId = /<artifactId>\s*([^<\s]+)\s*<\/artifactId>/i.exec(inner)?.[1];
+    if (!groupId || !artifactId) continue;
+    const rawVersion = /<version>\s*([^<\s]+)\s*<\/version>/i.exec(inner)?.[1];
+    const resolvedVersion = resolveProperty(rawVersion ?? null, props) ?? managedVersions.get(`${groupId}:${artifactId}`);
+    if (!resolvedVersion) continue;
+    const scope = /<scope>\s*([^<\s]+)\s*<\/scope>/i.exec(inner)?.[1] ?? "compile";
+    const isDev = scope === "test" || scope === "provided";
+    if (isDev && !opts.includeDev) continue;
+    packages.push({
+      name: `${groupId}:${artifactId}`,
+      version: resolvedVersion,
+      ecosystem: "maven",
+      source: filePath,
+      type: "direct",
+      scope: isDev ? "dev" : "production"
+    });
+  }
+  return packages;
+}
+function extractPomProperties(content) {
+  const props = /* @__PURE__ */ new Map();
+  const propsMatch = /<properties>([\s\S]*?)<\/properties>/i.exec(content);
+  if (!propsMatch) return props;
+  const propRegex = /<([a-zA-Z0-9._-]+)>\s*([^<]+)\s*<\/\1>/g;
+  for (const m of propsMatch[1].matchAll(propRegex)) {
+    props.set(m[1], m[2].trim());
+  }
+  return props;
+}
+function extractDependencyManagement(content, props) {
+  const versions = /* @__PURE__ */ new Map();
+  const mgmtMatch = /<dependencyManagement>([\s\S]*?)<\/dependencyManagement>/i.exec(content);
+  if (!mgmtMatch) return versions;
+  const depRegex = /<dependency>([\s\S]*?)<\/dependency>/gi;
+  for (const m of mgmtMatch[1].matchAll(depRegex)) {
+    const inner = m[1];
+    const groupId = /<groupId>\s*([^<\s]+)\s*<\/groupId>/i.exec(inner)?.[1];
+    const artifactId = /<artifactId>\s*([^<\s]+)\s*<\/artifactId>/i.exec(inner)?.[1];
+    const rawVersion = /<version>\s*([^<\s]+)\s*<\/version>/i.exec(inner)?.[1];
+    if (!groupId || !artifactId || !rawVersion) continue;
+    const resolved = resolveProperty(rawVersion, props);
+    if (resolved) versions.set(`${groupId}:${artifactId}`, resolved);
+  }
+  return versions;
+}
+function resolveProperty(value, props) {
+  if (!value) return null;
+  const resolved = value.replace(/\$\{([^}]+)\}/g, (_, key) => props.get(key) ?? `\${${key}}`);
+  return /\$\{[^}]+\}/.test(resolved) ? null : resolved;
+}
+var GRADLE_DEV_CONFIGS = /* @__PURE__ */ new Set(["testImplementation", "testCompileOnly", "testRuntimeOnly", "testApi"]);
+function parseBuildGradle(content, filePath, opts) {
+  const packages = [];
+  const seen = /* @__PURE__ */ new Set();
+  const stringNotation = /\b(\w+)\s*\(?\s*['"]([^:'"]+):([^:'"]+):([^'"]+)['"]\s*\)?/g;
+  for (const m of content.matchAll(stringNotation)) {
+    const config = m[1];
+    const groupId = m[2];
+    const artifactId = m[3];
+    const version = m[4].split("@")[0];
+    const isDev = GRADLE_DEV_CONFIGS.has(config);
+    if (isDev && !opts.includeDev) continue;
+    const name = `${groupId}:${artifactId}`;
+    const key = `${name}@${version}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    packages.push({
+      name,
+      version,
+      ecosystem: "maven",
+      source: filePath,
+      type: "direct",
+      scope: isDev ? "dev" : "production"
+    });
+  }
+  const mapNotation = /\b(\w+)\s+group:\s*['"]([^'"]+)['"]\s*,\s*name:\s*['"]([^'"]+)['"]\s*,\s*version:\s*['"]([^'"]+)['"]/g;
+  for (const m of content.matchAll(mapNotation)) {
+    const config = m[1];
+    const groupId = m[2];
+    const artifactId = m[3];
+    const version = m[4];
+    const isDev = GRADLE_DEV_CONFIGS.has(config);
+    if (isDev && !opts.includeDev) continue;
+    const name = `${groupId}:${artifactId}`;
+    const key = `${name}@${version}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    packages.push({
+      name,
+      version,
+      ecosystem: "maven",
+      source: filePath,
+      type: "direct",
+      scope: isDev ? "dev" : "production"
+    });
+  }
+  return packages;
+}
+function parseGradleLock(content, filePath, opts) {
+  const packages = [];
+  const seen = /* @__PURE__ */ new Set();
+  const lineRegex = /^([^:#\s]+):([^:#\s]+):([^=\s]+)=(.+)$/gm;
+  for (const m of content.matchAll(lineRegex)) {
+    const groupId = m[1];
+    const artifactId = m[2];
+    const version = m[3];
+    const configs = m[4].split(",").map((s) => s.trim());
+    const isDev = configs.every((c) => GRADLE_DEV_CONFIGS.has(c));
+    if (isDev && !opts.includeDev) continue;
+    const name = `${groupId}:${artifactId}`;
+    const key = `${name}@${version}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    packages.push({
+      name,
+      version,
+      ecosystem: "maven",
+      source: filePath,
+      type: "direct",
+      scope: isDev ? "dev" : "production"
+    });
+  }
+  return packages;
+}
+
+// src/services/deps/parsers/index.ts
+function getRepoFiles(repoRoot) {
+  try {
+    const out = execSync4("git ls-files --cached --others --exclude-standard", {
+      encoding: "utf8",
+      cwd: repoRoot
+    });
+    return out.trim().split("\n").filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+function readFile(repoRoot, relPath) {
+  try {
+    return fs2.readFileSync(path5.join(repoRoot, relPath), "utf8");
+  } catch {
+    return null;
+  }
+}
+function readFileAtRef(repoRoot, ref, relPath) {
+  try {
+    return execFileSync2("git", ["show", `${ref}:${relPath}`], {
+      encoding: "utf8",
+      cwd: repoRoot,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+  } catch {
+    return null;
+  }
+}
+function findPropsContent(manifestFile, readFn) {
+  let dir = path5.dirname(manifestFile);
+  for (let depth = 0; depth < 10; depth++) {
+    const candidate = dir === "." ? "Directory.Packages.props" : `${dir}/Directory.Packages.props`;
+    const content = readFn(candidate);
+    if (content) return content;
+    if (dir === ".") break;
+    dir = path5.dirname(dir);
+  }
+  return null;
+}
+function parseManifests(manifests, opts, readFn) {
+  const allPackages = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const manifest of manifests) {
+    const content = readFn(manifest.file);
+    if (!content) continue;
+    const lockContent = manifest.lockFile ? readFn(manifest.lockFile) ?? void 0 : void 0;
+    let pkgs = [];
+    if (manifest.ecosystem === "npm") {
+      pkgs = parseNpmPackages(content, manifest, opts, lockContent);
+    } else if (manifest.ecosystem === "nuget") {
+      const propsContent = findPropsContent(manifest.file, readFn) ?? void 0;
+      pkgs = parseNugetPackages(content, manifest, opts, lockContent, propsContent);
+    } else if (manifest.ecosystem === "maven") {
+      pkgs = parseMavenPackages(content, manifest, opts, lockContent);
+    }
+    for (const pkg2 of pkgs) {
+      const key = `${pkg2.ecosystem}:${pkg2.name}@${pkg2.version}:${pkg2.source}`;
+      if (!seen.has(key)) {
+        seen.add(key);
+        allPackages.push(pkg2);
+      }
+    }
+  }
+  return allPackages;
+}
+function scanRepo(repoRoot, opts = {}) {
+  const files = getRepoFiles(repoRoot);
+  const eco = opts.ecosystem ?? "all";
+  const npmManifests = eco === "all" || eco === "npm" ? findNpmManifests(files) : [];
+  const nugetManifests = eco === "all" || eco === "nuget" ? findNugetManifests(files) : [];
+  const mavenManifests = eco === "all" || eco === "maven" ? findMavenManifests(files) : [];
+  const manifests = [...npmManifests, ...nugetManifests, ...mavenManifests];
+  const packages = parseManifests(manifests, opts, (rel) => readFile(repoRoot, rel));
+  return buildScanData(manifests, packages);
+}
+function scanRepoAtRef(repoRoot, ref, opts = {}) {
+  const eco = opts.ecosystem ?? "all";
+  let files = [];
+  try {
+    const out = execFileSync2("git", ["ls-tree", "-r", "--name-only", ref], {
+      encoding: "utf8",
+      cwd: repoRoot,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    files = out.trim().split("\n").filter(Boolean);
+  } catch {
+    return buildScanData([], []);
+  }
+  const npmManifests = eco === "all" || eco === "npm" ? findNpmManifests(files) : [];
+  const nugetManifests = eco === "all" || eco === "nuget" ? findNugetManifests(files) : [];
+  const mavenManifests = eco === "all" || eco === "maven" ? findMavenManifests(files) : [];
+  const manifests = [...npmManifests, ...nugetManifests, ...mavenManifests];
+  const packages = parseManifests(manifests, opts, (rel) => readFileAtRef(repoRoot, ref, rel));
+  return buildScanData(manifests, packages);
+}
+function buildScanData(manifests, packages) {
+  const ecosystemSet = new Set(manifests.map((m) => m.ecosystem));
+  const byEcosystem = {};
+  const byType = { direct: 0, transitive: 0 };
+  const byScope = { production: 0, dev: 0 };
+  for (const pkg2 of packages) {
+    byEcosystem[pkg2.ecosystem] = (byEcosystem[pkg2.ecosystem] ?? 0) + 1;
+    byType[pkg2.type] = (byType[pkg2.type] ?? 0) + 1;
+    byScope[pkg2.scope] = (byScope[pkg2.scope] ?? 0) + 1;
+  }
+  return {
+    ecosystems: Array.from(ecosystemSet),
+    manifests,
+    packages,
+    summary: {
+      totalPackages: packages.length,
+      byEcosystem,
+      byType,
+      byScope
+    }
+  };
+}
+
+// src/services/deps/scan.ts
+function runScan(config, opts) {
+  void config;
+  const repoRoot = getRepoRoot2();
+  if (!repoRoot) {
+    throw new PncliError("Not inside a git repository. deps commands require a git repo root.", 1);
+  }
+  return scanRepo(repoRoot, opts);
+}
+
+// src/services/deps/semver.ts
+function parse(v) {
+  const clean = v.replace(/^[^0-9]*/, "");
+  const dashIdx = clean.indexOf("-");
+  const plusIdx = clean.indexOf("+");
+  const metaStart = plusIdx > -1 ? plusIdx : Infinity;
+  const preStart = dashIdx > -1 && dashIdx < metaStart ? dashIdx : Infinity;
+  const numeric = clean.slice(0, Math.min(preStart, metaStart));
+  const preRelease = preStart < Infinity ? clean.slice(preStart + 1, metaStart < Infinity ? metaStart : void 0) : "";
+  const parts = numeric.split(".").map((n) => parseInt(n, 10) || 0);
+  return { major: parts[0] ?? 0, minor: parts[1] ?? 0, patch: parts[2] ?? 0, preRelease };
+}
+function compareSemver(a, b) {
+  const av = parse(a);
+  const bv = parse(b);
+  if (av.major !== bv.major) return av.major - bv.major;
+  if (av.minor !== bv.minor) return av.minor - bv.minor;
+  if (av.patch !== bv.patch) return av.patch - bv.patch;
+  if (!av.preRelease && bv.preRelease) return 1;
+  if (av.preRelease && !bv.preRelease) return -1;
+  if (av.preRelease && bv.preRelease) return av.preRelease.localeCompare(bv.preRelease);
+  return 0;
+}
+function isNewer(current, latest) {
+  return compareSemver(latest, current) > 0;
+}
+function updateType(current, latest) {
+  const cv = parse(current);
+  const lv = parse(latest);
+  if (lv.major > cv.major) return "major";
+  if (lv.minor > cv.minor) return "minor";
+  return "patch";
+}
+function isDowngrade(from, to) {
+  return compareSemver(to, from) < 0;
+}
+
+// src/services/deps/diff.ts
+function runDiff(config, from, to, opts) {
+  void config;
+  const repoRoot = getRepoRoot2();
+  if (!repoRoot) {
+    throw new PncliError("Not inside a git repository.", 1);
+  }
+  const fromScan = scanRepoAtRef(repoRoot, from, opts);
+  const toScan = to ? scanRepoAtRef(repoRoot, to, opts) : scanRepo(repoRoot, opts);
+  const fromMap = /* @__PURE__ */ new Map();
+  const toMap = /* @__PURE__ */ new Map();
+  for (const pkg2 of fromScan.packages) {
+    const key = `${pkg2.ecosystem}:${pkg2.name}:${pkg2.source}`;
+    fromMap.set(key, pkg2.version);
+  }
+  for (const pkg2 of toScan.packages) {
+    const key = `${pkg2.ecosystem}:${pkg2.name}:${pkg2.source}`;
+    toMap.set(key, pkg2.version);
+  }
+  const changes = [];
+  const allKeys = /* @__PURE__ */ new Set([...fromMap.keys(), ...toMap.keys()]);
+  for (const key of allKeys) {
+    const parts = key.split(":");
+    const eco = parts[0];
+    const source = parts[parts.length - 1] ?? "";
+    const name = parts.slice(1, -1).join(":");
+    const fromVer = fromMap.get(key) ?? null;
+    const toVer = toMap.get(key) ?? null;
+    let change;
+    if (!fromVer) {
+      change = "added";
+    } else if (!toVer) {
+      change = "removed";
+    } else if (fromVer === toVer) {
+      continue;
+    } else {
+      change = isDowngrade(fromVer, toVer) ? "downgraded" : "upgraded";
+    }
+    changes.push({ name, ecosystem: eco, change, from: fromVer, to: toVer, source });
+  }
+  const summary = { added: 0, removed: 0, upgraded: 0, downgraded: 0, unchanged: 0 };
+  for (const c of changes) summary[c.change]++;
+  summary.unchanged = [...allKeys].filter((k) => {
+    const fv = fromMap.get(k);
+    const tv = toMap.get(k);
+    return fv !== void 0 && tv !== void 0 && fv === tv;
+  }).length;
+  return { from, to: to ?? "working tree", changes, summary };
+}
+
+// src/services/deps/clients/osv.ts
+var OSV_URL = "https://api.osv.dev";
+var BATCH_SIZE = 500;
+var TIMEOUT_MS = 3e4;
+var OSV_ECOSYSTEM = {
+  npm: "npm",
+  nuget: "NuGet",
+  maven: "Maven"
+};
+async function fetchWithTimeout2(url, init) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
+  try {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function checkOsvConnectivity() {
+  try {
+    const res = await fetchWithTimeout2(`${OSV_URL}/v1/querybatch`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ queries: [] })
+    });
+    return { reachable: res.ok || res.status === 400 };
+  } catch (err) {
+    return {
+      reachable: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+function extractRemediation(vuln, pkg2) {
+  const fixedVersions = [];
+  for (const affected of vuln.affected ?? []) {
+    for (const range of affected.ranges ?? []) {
+      if (range.type === "SEMVER" || range.type === "ECOSYSTEM") {
+        for (const event of range.events ?? []) {
+          if (event.fixed) fixedVersions.push(event.fixed);
+        }
+      }
+    }
+  }
+  const unique = [...new Set(fixedVersions)];
+  const fixAvailable = unique.length > 0;
+  const advice = fixAvailable ? `Upgrade ${pkg2.name} to ${unique.join(" or ")}` : `No fix available yet for ${pkg2.name}. Monitor ${vuln.id} for updates.`;
+  return { fixAvailable, fixedVersions: unique, advice };
+}
+function extractSeverity(vuln) {
+  const dbSpecific = vuln.database_specific ?? {};
+  const dbSeverity = typeof dbSpecific["severity"] === "string" ? dbSpecific["severity"] : void 0;
+  let cvss = null;
+  const rawCvss = dbSpecific["cvss"];
+  if (typeof rawCvss === "number") {
+    cvss = rawCvss;
+  } else if (rawCvss && typeof rawCvss === "object" && "score" in rawCvss) {
+    const score = rawCvss["score"];
+    if (typeof score === "number") cvss = score;
+  }
+  for (const s of vuln.severity ?? []) {
+    const score = parseFloat(s.score);
+    if (!isNaN(score) && score >= 0 && score <= 10) {
+      cvss = score;
+      break;
+    }
+  }
+  return {
+    severity: dbSeverity ?? inferSeverityFromCvss(cvss),
+    cvss
+  };
+}
+function inferSeverityFromCvss(cvss) {
+  if (cvss === null) return "UNKNOWN";
+  if (cvss >= 9) return "CRITICAL";
+  if (cvss >= 7) return "HIGH";
+  if (cvss >= 4) return "MEDIUM";
+  return "LOW";
+}
+function mapVuln(vuln, pkg2) {
+  const { severity, cvss } = extractSeverity(vuln);
+  return {
+    id: vuln.id,
+    summary: vuln.summary ?? "",
+    severity,
+    cvss,
+    aliases: vuln.aliases ?? [],
+    remediation: extractRemediation(vuln, pkg2),
+    references: (vuln.references ?? []).map((r) => r.url ?? "").filter(Boolean)
+  };
+}
+async function queryBatch(queries, packages) {
+  const res = await fetchWithTimeout2(`${OSV_URL}/v1/querybatch`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ queries })
+  });
+  if (!res.ok) {
+    throw new Error(`OSV.dev returned HTTP ${res.status}`);
+  }
+  const data = await res.json();
+  const vulnerable = [];
+  for (let i = 0; i < data.results.length; i++) {
+    const result = data.results[i];
+    const pkg2 = packages[i];
+    if (!result || !pkg2) continue;
+    const vulns = result.vulns ?? [];
+    if (vulns.length === 0) continue;
+    vulnerable.push({
+      ...pkg2,
+      vulnerabilities: vulns.map((v) => mapVuln(v, pkg2))
+    });
+  }
+  return vulnerable;
+}
+async function checkPackagesForVulns(packages) {
+  const allVulnerable = [];
+  for (let i = 0; i < packages.length; i += BATCH_SIZE) {
+    const chunk = packages.slice(i, i + BATCH_SIZE);
+    const queries = chunk.map((pkg2) => ({
+      package: {
+        name: pkg2.name,
+        ecosystem: OSV_ECOSYSTEM[pkg2.ecosystem] ?? pkg2.ecosystem
+      },
+      version: pkg2.version
+    }));
+    const results = await queryBatch(queries, chunk);
+    allVulnerable.push(...results);
+  }
+  return allVulnerable;
+}
+
+// src/services/deps/clients/artifactory.ts
+var TIMEOUT_MS2 = 15e3;
+async function fetchWithTimeout3(url, token) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS2);
+  try {
+    return await fetch(url, {
+      headers: { Authorization: `Bearer ${token}` },
+      signal: controller.signal
+    });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function checkArtifactoryConnectivity(config) {
+  if (!config.baseUrl && !config.token) {
+    return {
+      reachable: false,
+      authenticated: false,
+      configured: false,
+      error: "Artifactory is not configured"
+    };
+  }
+  if (!config.baseUrl) {
+    return {
+      reachable: false,
+      authenticated: false,
+      configured: false,
+      error: "Artifactory baseUrl is not set"
+    };
+  }
+  if (!config.token) {
+    return {
+      reachable: false,
+      authenticated: false,
+      configured: false,
+      error: "Artifactory token is not set"
+    };
+  }
+  try {
+    const res = await fetchWithTimeout3(`${config.baseUrl}/api/system/ping`, config.token);
+    if (res.status === 401 || res.status === 403) {
+      return {
+        reachable: true,
+        authenticated: false,
+        configured: true,
+        error: "Artifactory token is invalid or lacks permissions"
+      };
+    }
+    return { reachable: res.ok, authenticated: res.ok, configured: true };
+  } catch (err) {
+    return {
+      reachable: false,
+      authenticated: false,
+      configured: true,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+function requireArtifactory(config, command) {
+  if (!config.baseUrl && !config.token) {
+    throw new PncliError(
+      `${command} requires Artifactory. Add the following to ~/.pncli/config.json:
+  "artifactory": { "baseUrl": "https://artifactory.company.com", "token": "your-token" }
+Or set PNCLI_ARTIFACTORY_BASE_URL and PNCLI_ARTIFACTORY_TOKEN environment variables.`,
+      503
+    );
+  }
+  if (!config.baseUrl) {
+    throw new PncliError(
+      `${command} requires an Artifactory URL. Set artifactory.baseUrl in ~/.pncli/config.json or PNCLI_ARTIFACTORY_BASE_URL.`,
+      503
+    );
+  }
+  if (!config.token) {
+    throw new PncliError(
+      `${command} requires an Artifactory token. Set artifactory.token in ~/.pncli/config.json or PNCLI_ARTIFACTORY_TOKEN.`,
+      503
+    );
+  }
+}
+function repoForEcosystem(config, eco) {
+  if (eco === "npm") return config.npmRepo;
+  if (eco === "nuget") return config.nugetRepo;
+  if (eco === "maven") return config.mavenRepo;
+  return void 0;
+}
+async function getLatestNpm(baseUrl, token, repoName, packageName) {
+  try {
+    const encoded = packageName.startsWith("@") ? packageName.replace("/", "%2F") : packageName;
+    const res = await fetchWithTimeout3(`${baseUrl}/api/npm/${repoName}/${encoded}`, token);
+    if (!res.ok) return null;
+    const data = await res.json();
+    return data["dist-tags"]?.latest ?? null;
+  } catch {
+    return null;
+  }
+}
+async function getLatestNuget(baseUrl, token, repoName, packageName) {
+  try {
+    const lower = packageName.toLowerCase();
+    const res = await fetchWithTimeout3(
+      `${baseUrl}/api/nuget/v3/${repoName}/flatcontainer/${lower}/index.json`,
+      token
     );
+    if (!res.ok) return null;
+    const data = await res.json();
+    const versions = data.versions ?? [];
+    return versions[versions.length - 1] ?? null;
+  } catch {
+    return null;
+  }
+}
+async function getLatestMaven(baseUrl, token, repoName, packageName) {
+  const [groupId, artifactId] = packageName.split(":");
+  if (!groupId || !artifactId) return null;
+  try {
+    const res = await fetchWithTimeout3(
+      `${baseUrl}/api/search/latestVersion?g=${encodeURIComponent(groupId)}&a=${encodeURIComponent(artifactId)}&repos=${repoName}`,
+      token
+    );
+    if (!res.ok) return null;
+    const text = await res.text();
+    return text.trim() || null;
+  } catch {
+    return null;
+  }
+}
+async function getOutdatedPackages(packages, config, filterType) {
+  const { baseUrl, token } = config;
+  if (!baseUrl || !token) return { outdated: [], uncheckedEcosystems: [] };
+  const outdated = [];
+  const unchecked = /* @__PURE__ */ new Set();
+  for (const pkg2 of packages) {
+    const repoName = repoForEcosystem(config, pkg2.ecosystem);
+    if (!repoName) {
+      unchecked.add(pkg2.ecosystem);
+      continue;
+    }
+    let latest = null;
+    if (pkg2.ecosystem === "npm") {
+      latest = await getLatestNpm(baseUrl, token, repoName, pkg2.name);
+    } else if (pkg2.ecosystem === "nuget") {
+      latest = await getLatestNuget(baseUrl, token, repoName, pkg2.name);
+    } else if (pkg2.ecosystem === "maven") {
+      latest = await getLatestMaven(baseUrl, token, repoName, pkg2.name);
+    }
+    if (!latest || !isNewer(pkg2.version, latest)) continue;
+    const type = updateType(pkg2.version, latest);
+    if (filterType) {
+      const order = { major: 3, minor: 2, patch: 1 };
+      if (order[type] < order[filterType]) continue;
+    }
+    outdated.push({
+      name: pkg2.name,
+      ecosystem: pkg2.ecosystem,
+      current: pkg2.version,
+      latest,
+      updateType: type,
+      source: pkg2.source
+    });
+  }
+  return { outdated, uncheckedEcosystems: [...unchecked] };
+}
+async function getLicenseNpm(baseUrl, token, repoName, packageName) {
+  try {
+    const encoded = packageName.startsWith("@") ? packageName.replace("/", "%2F") : packageName;
+    const res = await fetchWithTimeout3(`${baseUrl}/api/npm/${repoName}/${encoded}`, token);
+    if (!res.ok) return null;
+    const data = await res.json();
+    if (typeof data.license === "string") return data.license;
+    if (typeof data.license === "object" && data.license !== null) return data.license.type ?? null;
+    return null;
+  } catch {
+    return null;
+  }
+}
+async function getLicenseNuget(baseUrl, token, repoName, packageName, version) {
+  try {
+    const lower = packageName.toLowerCase();
+    const res = await fetchWithTimeout3(
+      `${baseUrl}/api/nuget/v3/${repoName}/registration/${lower}/${version}.json`,
+      token
+    );
+    if (!res.ok) return null;
+    const data = await res.json();
+    return data.licenseExpression ?? (data.licenseUrl ? "See licenseUrl" : null);
+  } catch {
+    return null;
+  }
+}
+async function getLicensedPackages(packages, config) {
+  const { baseUrl, token } = config;
+  if (!baseUrl || !token) return [];
+  const result = [];
+  for (const pkg2 of packages) {
+    const repoName = repoForEcosystem(config, pkg2.ecosystem);
+    let license = null;
+    if (repoName) {
+      if (pkg2.ecosystem === "npm") {
+        license = await getLicenseNpm(baseUrl, token, repoName, pkg2.name);
+      } else if (pkg2.ecosystem === "nuget") {
+        license = await getLicenseNuget(baseUrl, token, repoName, pkg2.name, pkg2.version);
+      }
+    }
+    result.push({
+      name: pkg2.name,
+      version: pkg2.version,
+      ecosystem: pkg2.ecosystem,
+      source: pkg2.source,
+      license
+    });
+  }
+  return result;
+}
+
+// src/services/deps/connectivity.ts
+var cachedTier = null;
+async function detectTier(config) {
+  if (cachedTier) return cachedTier;
+  const [osvResult, artResult] = await Promise.all([
+    checkOsvConnectivity(),
+    checkArtifactoryConnectivity(config.artifactory)
+  ]);
+  const artifactoryReachable = artResult.reachable && artResult.authenticated;
+  const osvReachable = osvResult.reachable;
+  let tier = "local";
+  if (artifactoryReachable) tier = "artifactory";
+  if (osvReachable) tier = "full";
+  cachedTier = { tier, osvReachable, artifactoryReachable };
+  return cachedTier;
+}
+async function buildConnectivityData(config) {
+  const [osvResult, artResult] = await Promise.all([
+    checkOsvConnectivity(),
+    checkArtifactoryConnectivity(config.artifactory)
+  ]);
+  const artCfg = config.artifactory;
+  let tier = "local";
+  if (artResult.reachable && artResult.authenticated) tier = "artifactory";
+  if (osvResult.reachable) tier = "full";
+  cachedTier = {
+    tier,
+    osvReachable: osvResult.reachable,
+    artifactoryReachable: artResult.reachable && artResult.authenticated
+  };
+  return {
+    artifactory: {
+      reachable: artResult.reachable,
+      url: artCfg.baseUrl ?? "(not configured)",
+      authenticated: artResult.authenticated,
+      repositories: {
+        npm: artCfg.npmRepo ?? "(not configured)",
+        nuget: artCfg.nugetRepo ?? "(not configured)",
+        maven: artCfg.mavenRepo ?? "(not configured)"
+      },
+      ...artResult.error ? { error: artResult.error } : {}
+    },
+    osv: {
+      reachable: osvResult.reachable,
+      url: "https://api.osv.dev",
+      ...osvResult.error ? { error: osvResult.error } : {}
+    },
+    tier,
+    capabilities: {
+      scan: true,
+      diff: true,
+      outdated: artResult.reachable && artResult.authenticated,
+      licenseCheck: artResult.reachable && artResult.authenticated,
+      cveCheck: osvResult.reachable
+    }
+  };
+}
+
+// src/services/deps/frisk.ts
+async function runFrisk(config, opts) {
+  const repoRoot = getRepoRoot2();
+  if (!repoRoot) {
+    throw new PncliError("Not inside a git repository.", 1);
+  }
+  const { tier, osvReachable } = await detectTier(config);
+  if (!osvReachable) {
+    throw new PncliError(
+      "deps frisk requires OSV.dev access but api.osv.dev is not reachable from this machine. Run 'pncli deps connectivity' to diagnose.",
+      503
+    );
+  }
+  const scanOpts = {
+    ...opts,
+    includeTransitive: opts.includeTransitive ?? true
+  };
+  const scan = scanRepo(repoRoot, scanOpts);
+  if (scan.packages.length === 0) {
+    return { tier, scanned: 0, vulnerable: 0, packages: [] };
+  }
+  const vulnerable = await checkPackagesForVulns(scan.packages);
+  return {
+    tier,
+    scanned: scan.packages.length,
+    vulnerable: vulnerable.length,
+    packages: vulnerable
+  };
+}
+
+// src/services/deps/outdated.ts
+async function runOutdated(config, opts, filterType) {
+  const repoRoot = getRepoRoot2();
+  if (!repoRoot) {
+    throw new PncliError("Not inside a git repository.", 1);
+  }
+  requireArtifactory(config.artifactory, "deps outdated");
+  const { artifactoryReachable } = await detectTier(config);
+  if (!artifactoryReachable) {
+    throw new PncliError(
+      `Artifactory at ${config.artifactory.baseUrl} is not reachable or authentication failed. Run 'pncli deps connectivity' to diagnose.`,
+      503
+    );
+  }
+  const scan = scanRepo(repoRoot, { ...opts, includeTransitive: false });
+  const directPackages = scan.packages.filter((p) => p.type === "direct");
+  const { outdated, uncheckedEcosystems } = await getOutdatedPackages(
+    directPackages,
+    config.artifactory,
+    filterType
+  );
+  const summary = { total: outdated.length, major: 0, minor: 0, patch: 0 };
+  for (const pkg2 of outdated) summary[pkg2.updateType]++;
+  return {
+    source: "artifactory",
+    artifactoryUrl: config.artifactory.baseUrl ?? "",
+    outdated,
+    uncheckedEcosystems,
+    summary
+  };
+}
+
+// src/services/deps/license-check.ts
+async function runLicenseCheck(config, opts) {
+  const repoRoot = getRepoRoot2();
+  if (!repoRoot) {
+    throw new PncliError("Not inside a git repository.", 1);
+  }
+  requireArtifactory(config.artifactory, "deps license-check");
+  const { artifactoryReachable } = await detectTier(config);
+  if (!artifactoryReachable) {
+    throw new PncliError(
+      `Artifactory at ${config.artifactory.baseUrl} is not reachable or authentication failed. Run 'pncli deps connectivity' to diagnose.`,
+      503
+    );
+  }
+  const scan = scanRepo(repoRoot, { ...opts, includeTransitive: false });
+  const directPackages = scan.packages.filter((p) => p.type === "direct");
+  const licensed = await getLicensedPackages(directPackages, config.artifactory);
+  const byLicense = {};
+  let unknown = 0;
+  for (const pkg2 of licensed) {
+    if (!pkg2.license) {
+      unknown++;
+    } else {
+      byLicense[pkg2.license] = (byLicense[pkg2.license] ?? 0) + 1;
+    }
+  }
+  return {
+    source: "artifactory",
+    artifactoryUrl: config.artifactory.baseUrl ?? "",
+    packages: licensed,
+    summary: {
+      total: licensed.length,
+      byLicense,
+      unknown
+    }
+  };
+}
+
+// src/services/deps/commands.ts
+function registerDepsCommands(program2) {
+  const deps = program2.command("deps").description("Dependency scanning, CVE detection, and license auditing");
+  deps.command("frisk").description("Scan all dependencies for CVEs and output remediation paths (requires OSV.dev)").option("--ecosystem <ecosystem>", "Filter to one ecosystem: npm, nuget, maven, all", "all").option("--direct-only", "Only scan direct dependencies (default: include transitive)", false).option("--include-dev", "Include dev/test dependencies", false).action(async (opts, cmd) => {
+    const startTime = Date.now();
+    try {
+      const globalOpts = cmd.optsWithGlobals();
+      const config = loadConfig({ configPath: globalOpts.config });
+      const scanOpts = {
+        ecosystem: opts.ecosystem,
+        includeTransitive: !opts.directOnly,
+        includeDev: opts.includeDev
+      };
+      const data = await runFrisk(config, scanOpts);
+      success(data, "deps", "frisk", startTime);
+    } catch (err) {
+      fail(err, "deps", "frisk", startTime);
+    }
+  });
+  deps.command("scan").description("Inventory all dependencies from manifest files (local only, no network)").option("--ecosystem <ecosystem>", "Filter to one ecosystem: npm, nuget, maven, all", "all").option("--include-transitive", "Include transitive dependencies", false).option("--include-dev", "Include dev/test dependencies", false).action((opts, cmd) => {
+    const startTime = Date.now();
+    try {
+      const globalOpts = cmd.optsWithGlobals();
+      const config = loadConfig({ configPath: globalOpts.config });
+      const scanOpts = {
+        ecosystem: opts.ecosystem,
+        includeTransitive: opts.includeTransitive,
+        includeDev: opts.includeDev
+      };
+      const data = runScan(config, scanOpts);
+      success(data, "deps", "scan", startTime);
+    } catch (err) {
+      fail(err, "deps", "scan", startTime);
+    }
+  });
+  deps.command("diff").description("Show dependency changes between two git refs (local only, no network)").requiredOption("--from <ref>", "Base git ref (commit, tag, or branch)").option("--to <ref>", "Target git ref (default: working tree)").option("--ecosystem <ecosystem>", "Filter to one ecosystem: npm, nuget, maven, all", "all").option("--include-dev", "Include dev/test dependencies", false).action((opts, cmd) => {
+    const startTime = Date.now();
+    try {
+      const globalOpts = cmd.optsWithGlobals();
+      const config = loadConfig({ configPath: globalOpts.config });
+      const scanOpts = {
+        ecosystem: opts.ecosystem,
+        includeTransitive: true,
+        includeDev: opts.includeDev
+      };
+      const data = runDiff(config, opts.from, opts.to ?? null, scanOpts);
+      success(data, "deps", "diff", startTime);
+    } catch (err) {
+      fail(err, "deps", "diff", startTime);
+    }
+  });
+  deps.command("outdated").description("Check for newer versions available in Artifactory (requires Artifactory)").option("--ecosystem <ecosystem>", "Filter to one ecosystem: npm, nuget, maven, all", "all").option("--major", "Only show major version bumps").option("--minor", "Only show minor version bumps or higher").option("--patch", "Only show patch version bumps or higher").action(async (opts, cmd) => {
+    const startTime = Date.now();
+    try {
+      const globalOpts = cmd.optsWithGlobals();
+      const config = loadConfig({ configPath: globalOpts.config });
+      const scanOpts = { ecosystem: opts.ecosystem };
+      const filterType = opts.major ? "major" : opts.minor ? "minor" : opts.patch ? "patch" : void 0;
+      const data = await runOutdated(config, scanOpts, filterType);
+      success(data, "deps", "outdated", startTime);
+    } catch (err) {
+      fail(err, "deps", "outdated", startTime);
+    }
+  });
+  deps.command("license-check").description("Report licenses for all direct dependencies via Artifactory (requires Artifactory)").option("--ecosystem <ecosystem>", "Filter to one ecosystem: npm, nuget, maven, all", "all").option("--include-dev", "Include dev/test dependencies", false).action(async (opts, cmd) => {
+    const startTime = Date.now();
+    try {
+      const globalOpts = cmd.optsWithGlobals();
+      const config = loadConfig({ configPath: globalOpts.config });
+      const scanOpts = {
+        ecosystem: opts.ecosystem,
+        includeDev: opts.includeDev
+      };
+      const data = await runLicenseCheck(config, scanOpts);
+      success(data, "deps", "license-check", startTime);
+    } catch (err) {
+      fail(err, "deps", "license-check", startTime);
+    }
+  });
+  deps.command("connectivity").description("Test network access to Artifactory and OSV.dev, report available tier").action(async (_opts, cmd) => {
+    const startTime = Date.now();
+    try {
+      const globalOpts = cmd.optsWithGlobals();
+      const config = loadConfig({ configPath: globalOpts.config });
+      const data = await buildConnectivityData(config);
+      success(data, "deps", "connectivity", startTime);
+    } catch (err) {
+      fail(err, "deps", "connectivity", startTime);
+    }
   });
 }
 
 // src/services/config/commands.ts
 import { input, password, confirm } from "@inquirer/prompts";
-import fs2 from "fs";
+import fs3 from "fs";
 function registerConfigCommands(program2) {
   const config = program2.command("config").description("Manage pncli configuration");
   config.command("init").description("Interactive setup wizard").option("--repo", "Write repo config (.pncli.json) instead of global config").action(async (opts) => {
@@ -1464,7 +2823,7 @@ function registerConfigCommands(program2) {
     } catch (err) {
       if (err instanceof Error && err.message.includes("User force closed")) {
         process.stderr.write("\nSetup cancelled.\n");
-        process.exit(1);
+        process.exit(ExitCode.GENERAL_ERROR);
       }
       fail(err, "config", "init", start);
     }
@@ -1525,6 +2884,38 @@ async function initGlobalConfig(start) {
   const bitbucketPat = await password({
     message: "Bitbucket personal access token:"
   });
+  process.stderr.write("\n\u2500\u2500 Artifactory \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+  const useArtifactory = await confirm({
+    message: "Configure Artifactory for dependency commands (deps outdated, deps license-check)?",
+    default: false
+  });
+  let artifactoryBaseUrl = "";
+  let artifactoryToken = "";
+  let npmRepo = "";
+  let nugetRepo = "";
+  let mavenRepo = "";
+  if (useArtifactory) {
+    artifactoryBaseUrl = await input({
+      message: "Artifactory base URL (e.g. https://artifactory.company.com):",
+      default: ""
+    });
+    artifactoryToken = await password({
+      message: "Artifactory API token:"
+    });
+    process.stderr.write("\nConfigure which ecosystems you use (skip any that don't apply):\n");
+    const useNpm = await confirm({ message: "  Use npm packages from Artifactory?", default: true });
+    if (useNpm) {
+      npmRepo = await input({ message: "  npm repository name:", default: "npm-remote" });
+    }
+    const useNuget = await confirm({ message: "  Use NuGet packages from Artifactory?", default: false });
+    if (useNuget) {
+      nugetRepo = await input({ message: "  NuGet repository name:", default: "nuget-remote" });
+    }
+    const useMaven = await confirm({ message: "  Use Maven packages from Artifactory?", default: false });
+    if (useMaven) {
+      mavenRepo = await input({ message: "  Maven repository name:", default: "libs-release" });
+    }
+  }
   process.stderr.write("\n\u2500\u2500 Defaults \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
   const jiraProject = await input({
     message: "Default Jira project key (optional):",
@@ -1537,7 +2928,7 @@ async function initGlobalConfig(start) {
   });
   if (!confirmed) {
     process.stderr.write("Aborted.\n");
-    process.exit(0);
+    process.exit(ExitCode.SUCCESS);
   }
   writeGlobalConfig({
     user: {
@@ -1552,6 +2943,15 @@ async function initGlobalConfig(start) {
       baseUrl: bitbucketBaseUrl || void 0,
       pat: bitbucketPat || void 0
     },
+    ...useArtifactory ? {
+      artifactory: {
+        baseUrl: artifactoryBaseUrl || void 0,
+        token: artifactoryToken || void 0,
+        npmRepo: npmRepo || void 0,
+        nugetRepo: nugetRepo || void 0,
+        mavenRepo: mavenRepo || void 0
+      }
+    } : {},
     defaults: {
       jira: {
         project: jiraProject || void 0
@@ -1586,16 +2986,16 @@ async function initRepoConfig(start) {
   });
   if (!confirmed) {
     process.stderr.write("Aborted.\n");
-    process.exit(0);
+    process.exit(ExitCode.SUCCESS);
   }
-  if (fs2.existsSync(".pncli.json")) {
+  if (fs3.existsSync(".pncli.json")) {
     const overwrite = await confirm({
       message: ".pncli.json already exists. Overwrite?",
       default: false
     });
     if (!overwrite) {
       process.stderr.write("Aborted.\n");
-      process.exit(0);
+      process.exit(ExitCode.SUCCESS);
     }
   }
   writeRepoConfig({
@@ -1636,21 +3036,21 @@ registerJiraCommands(program);
 registerBitbucketCommands(program);
 registerConfluenceCommands(program);
 registerSonarCommands(program);
-registerArtifactoryCommands(program);
+registerDepsCommands(program);
 registerConfigCommands(program);
 program.addHelpText("after", `
 Services:
   git          Local git operations (status, diff, log, branch)
+  deps         Dependency scanning, CVE detection, license auditing
   jira         Jira Data Cloud (coming soon)
   bitbucket    Bitbucket Server (coming soon)
   confluence   Confluence (coming soon)
   sonar        SonarQube (coming soon)
-  artifactory  Artifactory (coming soon)
   config       Manage pncli configuration
 `);
 program.parseAsync(process.argv).catch((err) => {
   process.stderr.write(`Fatal: ${err instanceof Error ? err.message : String(err)}
 `);
-  process.exit(1);
+  process.exit(ExitCode.GENERAL_ERROR);
 });
 //# sourceMappingURL=cli.js.map