@kolatts/pncli 1.1.0 → 1.3.0

package/dist/cli.js

@@ -5,6 +5,7 @@ import { Command } from "commander";
 import { createRequire } from "module";
 
 // src/lib/output.ts
+import fs from "fs";
 import chalk from "chalk";
 
 // src/lib/errors.ts
@@ -19,6 +20,24 @@ var PncliError = class extends Error {
   }
 };
 
+// src/lib/exitCodes.ts
+var ExitCode = {
+  SUCCESS: 0,
+  GENERAL_ERROR: 1,
+  USAGE_ERROR: 2,
+  NETWORK_ERROR: 69,
+  // EX_UNAVAILABLE from sysexits.h
+  AUTH_ERROR: 77,
+  // EX_NOPERM from sysexits.h
+  CONFIG_ERROR: 78
+  // EX_CONFIG from sysexits.h
+};
+function exitCodeFromStatus(httpStatus) {
+  if (httpStatus === 401 || httpStatus === 403) return ExitCode.AUTH_ERROR;
+  if (httpStatus === 0) return ExitCode.NETWORK_ERROR;
+  return ExitCode.GENERAL_ERROR;
+}
+
 // src/lib/output.ts
 var globalOptions = { pretty: false, verbose: false };
 var globalUser = { email: void 0, userId: void 0 };
@@ -60,10 +79,15 @@ function fail(err, service, action, startTime) {
   };
   const msg = globalOptions.pretty ? chalk.red("\u2717 Error: ") + errorDetail.message : null;
   if (msg) process.stderr.write(msg + "\n");
-  process.stdout.write(
-    (globalOptions.pretty ? JSON.stringify(envelope, null, 2) : JSON.stringify(envelope)) + "\n"
-  );
-  process.exit(1);
+  const output = (globalOptions.pretty ? JSON.stringify(envelope, null, 2) : JSON.stringify(envelope)) + "\n";
+  const exitCode = err instanceof PncliError ? exitCodeFromStatus(err.status) : ExitCode.GENERAL_ERROR;
+  try {
+    fs.writeSync(process.stdout.fd, output);
+  } catch (writeErr) {
+    if (writeErr.code !== "EPIPE") throw writeErr;
+  }
+  process.exitCode = exitCode;
+  throw new PncliError(errorDetail.message, errorDetail.status);
 }
 function log(message) {
   if (globalOptions.verbose) {
@@ -79,7 +103,7 @@ function warn(message) {
 }
 
 // src/lib/config.ts
-import fs from "fs";
+import fs2 from "fs";
 import os from "os";
 import path from "path";
 import { execSync } from "child_process";
@@ -90,6 +114,17 @@ var ENV_KEYS = {
   JIRA_API_TOKEN: "PNCLI_JIRA_API_TOKEN",
   BITBUCKET_BASE_URL: "PNCLI_BITBUCKET_BASE_URL",
   BITBUCKET_PAT: "PNCLI_BITBUCKET_PAT",
+  CONFLUENCE_BASE_URL: "PNCLI_CONFLUENCE_BASE_URL",
+  CONFLUENCE_API_TOKEN: "PNCLI_CONFLUENCE_API_TOKEN",
+  ARTIFACTORY_BASE_URL: "PNCLI_ARTIFACTORY_BASE_URL",
+  ARTIFACTORY_TOKEN: "PNCLI_ARTIFACTORY_TOKEN",
+  ARTIFACTORY_REPO_NPM: "PNCLI_ARTIFACTORY_REPO_NPM",
+  ARTIFACTORY_REPO_NUGET: "PNCLI_ARTIFACTORY_REPO_NUGET",
+  ARTIFACTORY_REPO_MAVEN: "PNCLI_ARTIFACTORY_REPO_MAVEN",
+  SONAR_BASE_URL: "PNCLI_SONAR_BASE_URL",
+  SONAR_TOKEN: "PNCLI_SONAR_TOKEN",
+  SDE_BASE_URL: "PNCLI_SDE_BASE_URL",
+  SDE_TOKEN: "PNCLI_SDE_TOKEN",
   CONFIG_PATH: "PNCLI_CONFIG_PATH"
 };
 function getGlobalConfigPath(overridePath) {
@@ -100,7 +135,7 @@ function getGlobalConfigPath(overridePath) {
 }
 function loadJsonFile(filePath) {
   try {
-    const content = fs.readFileSync(filePath, "utf8");
+    const content = fs2.readFileSync(filePath, "utf8");
     return JSON.parse(content);
   } catch {
     return null;
@@ -122,7 +157,9 @@ function mergeCustomFields(global, repo) {
 function mergeDefaults(global, repo) {
   return {
     jira: { ...global?.jira, ...repo?.jira },
-    bitbucket: { ...global?.bitbucket, ...repo?.bitbucket }
+    bitbucket: { ...global?.bitbucket, ...repo?.bitbucket },
+    sonar: { ...global?.sonar, ...repo?.sonar },
+    sde: { ...global?.sde, ...repo?.sde }
   };
 }
 function loadConfig(opts = {}) {
@@ -148,21 +185,40 @@ function loadConfig(opts = {}) {
       baseUrl: process.env[ENV_KEYS.BITBUCKET_BASE_URL] ?? globalConfig.bitbucket?.baseUrl,
       pat: process.env[ENV_KEYS.BITBUCKET_PAT] ?? globalConfig.bitbucket?.pat
     },
+    confluence: {
+      baseUrl: process.env[ENV_KEYS.CONFLUENCE_BASE_URL] ?? globalConfig.confluence?.baseUrl,
+      apiToken: process.env[ENV_KEYS.CONFLUENCE_API_TOKEN] ?? globalConfig.confluence?.apiToken ?? process.env[ENV_KEYS.JIRA_API_TOKEN] ?? globalConfig.jira?.apiToken
+    },
+    artifactory: {
+      baseUrl: process.env[ENV_KEYS.ARTIFACTORY_BASE_URL] ?? globalConfig.artifactory?.baseUrl,
+      token: process.env[ENV_KEYS.ARTIFACTORY_TOKEN] ?? globalConfig.artifactory?.token,
+      npmRepo: process.env[ENV_KEYS.ARTIFACTORY_REPO_NPM] ?? globalConfig.artifactory?.npmRepo,
+      nugetRepo: process.env[ENV_KEYS.ARTIFACTORY_REPO_NUGET] ?? globalConfig.artifactory?.nugetRepo,
+      mavenRepo: process.env[ENV_KEYS.ARTIFACTORY_REPO_MAVEN] ?? globalConfig.artifactory?.mavenRepo
+    },
+    sonar: {
+      baseUrl: process.env[ENV_KEYS.SONAR_BASE_URL] ?? globalConfig.sonar?.baseUrl,
+      token: process.env[ENV_KEYS.SONAR_TOKEN] ?? globalConfig.sonar?.token
+    },
+    sde: {
+      baseUrl: process.env[ENV_KEYS.SDE_BASE_URL] ?? globalConfig.sde?.baseUrl,
+      token: process.env[ENV_KEYS.SDE_TOKEN] ?? globalConfig.sde?.token
+    },
     defaults: mergedDefaults
   };
 }
 function writeGlobalConfig(config, configPath) {
   const filePath = getGlobalConfigPath(configPath);
   const dir = path.dirname(filePath);
-  if (!fs.existsSync(dir)) {
-    fs.mkdirSync(dir, { recursive: true });
+  if (!fs2.existsSync(dir)) {
+    fs2.mkdirSync(dir, { recursive: true });
   }
-  fs.writeFileSync(filePath, JSON.stringify(config, null, 2) + "\n", "utf8");
+  fs2.writeFileSync(filePath, JSON.stringify(config, null, 2) + "\n", "utf8");
 }
 function writeRepoConfig(config) {
   const repoRoot = getRepoRoot();
   const targetDir = repoRoot ?? process.cwd();
-  fs.writeFileSync(path.join(targetDir, ".pncli.json"), JSON.stringify(config, null, 2) + "\n", "utf8");
+  fs2.writeFileSync(path.join(targetDir, ".pncli.json"), JSON.stringify(config, null, 2) + "\n", "utf8");
 }
 function setConfigValue(key, value, configPath) {
   const filePath = getGlobalConfigPath(configPath);
@@ -190,6 +246,22 @@ function maskConfig(config) {
     bitbucket: {
       ...config.bitbucket,
       pat: config.bitbucket.pat ? "***" : void 0
+    },
+    confluence: {
+      ...config.confluence,
+      apiToken: config.confluence.apiToken ? "***" : void 0
+    },
+    artifactory: {
+      ...config.artifactory,
+      token: config.artifactory.token ? "***" : void 0
+    },
+    sonar: {
+      ...config.sonar,
+      token: config.sonar.token ? "***" : void 0
+    },
+    sde: {
+      ...config.sde,
+      token: config.sde.token ? "***" : void 0
     }
   };
 }
@@ -394,8 +466,9 @@ function getGitContext(config) {
 }
 
 // src/lib/http.ts
-function buildUrl(base, path2, params) {
-  const url = new URL(path2, base.endsWith("/") ? base : base + "/");
+import fs3 from "fs";
+function buildUrl(base, path6, params) {
+  const url = new URL(path6, base.endsWith("/") ? base : base + "/");
   if (params) {
     for (const [key, val] of Object.entries(params)) {
       if (val !== void 0) {
@@ -440,8 +513,25 @@ async function request(url, init, timeoutMs) {
       try {
         const body = await response.text();
         const parsed = JSON.parse(body);
-        if (parsed.message) message = parsed.message;
-        else if (parsed.errors?.[0]?.message) message = parsed.errors[0].message;
+        const parts = [];
+        if (Array.isArray(parsed.errorMessages)) {
+          parts.push(...parsed.errorMessages.filter(Boolean));
+        }
+        if (parsed.errors && typeof parsed.errors === "object" && !Array.isArray(parsed.errors)) {
+          for (const [field, msg] of Object.entries(parsed.errors)) {
+            parts.push(`${field}: ${msg}`);
+          }
+        }
+        if (Array.isArray(parsed.errors)) {
+          for (const e of parsed.errors) {
+            if (e?.message) parts.push(e.message);
+            else if (e?.msg) parts.push(e.msg);
+          }
+        }
+        if (parts.length === 0 && parsed.message) {
+          parts.push(String(parsed.message));
+        }
+        if (parts.length > 0) message = parts.join("; ");
       } catch {
       }
       throw new PncliError(message, response.status, url);
@@ -449,7 +539,9 @@ async function request(url, init, timeoutMs) {
     if (response.status === 204) {
       return void 0;
     }
-    return response.json();
+    const text = await response.text();
+    if (!text) return void 0;
+    return JSON.parse(text);
   }
   throw lastError ?? new PncliError("Request failed after retries", 1, url);
 }
@@ -466,7 +558,8 @@ var HttpClient = class {
     return {
       "Authorization": `Bearer ${apiToken}`,
       "Content-Type": "application/json",
-      "Accept": "application/json"
+      "Accept": "application/json",
+      "Connection": "close"
     };
   }
   bitbucketHeaders() {
@@ -475,13 +568,14 @@ var HttpClient = class {
     return {
       "Authorization": `Bearer ${pat}`,
       "Content-Type": "application/json",
-      "Accept": "application/json"
+      "Accept": "application/json",
+      "Connection": "close"
     };
   }
-  async jira(path2, opts = {}) {
+  async jira(path6, opts = {}) {
     const baseUrl = this.config.jira.baseUrl;
     if (!baseUrl) throw new PncliError("Jira baseUrl not configured. Run: pncli config init");
-    const url = buildUrl(baseUrl, path2, opts.params);
+    const url = buildUrl(baseUrl, path6, opts.params);
     const headers = this.jiraHeaders();
     const init = {
       method: opts.method ?? "GET",
@@ -490,19 +584,20 @@ var HttpClient = class {
     };
     if (this.dryRun) {
       const safeHeaders = { ...headers, Authorization: "[REDACTED]" };
-      process.stderr.write(`DRY RUN: ${init.method} ${url}
+      const msg = `DRY RUN: ${init.method} ${url}
 Headers: ${JSON.stringify(safeHeaders, null, 2)}
-`);
-      if (opts.body) process.stderr.write(`Body: ${JSON.stringify(opts.body, null, 2)}
-`);
-      process.exit(0);
+` + (opts.body ? `Body: ${JSON.stringify(opts.body, null, 2)}
+` : "");
+      fs3.writeSync(process.stderr.fd, msg);
+      process.exitCode = ExitCode.SUCCESS;
+      throw new PncliError("dry-run", 0);
     }
     return request(url, init, opts.timeoutMs ?? 3e4);
   }
-  async bitbucket(path2, opts = {}) {
+  async bitbucket(path6, opts = {}) {
     const baseUrl = this.config.bitbucket.baseUrl;
     if (!baseUrl) throw new PncliError("Bitbucket baseUrl not configured. Run: pncli config init");
-    const url = buildUrl(baseUrl, path2, opts.params);
+    const url = buildUrl(baseUrl, path6, opts.params);
     const headers = this.bitbucketHeaders();
     const init = {
       method: opts.method ?? "GET",
@@ -511,15 +606,148 @@ Headers: ${JSON.stringify(safeHeaders, null, 2)}
     };
     if (this.dryRun) {
       const safeHeaders = { ...headers, Authorization: "[REDACTED]" };
-      process.stderr.write(`DRY RUN: ${init.method} ${url}
+      const msg = `DRY RUN: ${init.method} ${url}
 Headers: ${JSON.stringify(safeHeaders, null, 2)}
-`);
-      if (opts.body) process.stderr.write(`Body: ${JSON.stringify(opts.body, null, 2)}
-`);
-      process.exit(0);
+` + (opts.body ? `Body: ${JSON.stringify(opts.body, null, 2)}
+` : "");
+      fs3.writeSync(process.stderr.fd, msg);
+      process.exitCode = ExitCode.SUCCESS;
+      throw new PncliError("dry-run", 0);
+    }
+    return request(url, init, opts.timeoutMs ?? 3e4);
+  }
+  confluenceHeaders() {
+    const { apiToken } = this.config.confluence;
+    if (!apiToken) throw new PncliError("Confluence credentials not configured. Run: pncli config init");
+    return {
+      "Authorization": `Bearer ${apiToken}`,
+      "Content-Type": "application/json",
+      "Accept": "application/json",
+      "Connection": "close"
+    };
+  }
+  async confluence(path6, opts = {}) {
+    const baseUrl = this.config.confluence.baseUrl;
+    if (!baseUrl) throw new PncliError("Confluence baseUrl not configured. Run: pncli config init");
+    const url = buildUrl(baseUrl, path6, opts.params);
+    const headers = this.confluenceHeaders();
+    const init = {
+      method: opts.method ?? "GET",
+      headers,
+      body: opts.body !== void 0 ? JSON.stringify(opts.body) : void 0
+    };
+    if (this.dryRun) {
+      const safeHeaders = { ...headers, Authorization: "[REDACTED]" };
+      const msg = `DRY RUN: ${init.method} ${url}
+Headers: ${JSON.stringify(safeHeaders, null, 2)}
+` + (opts.body ? `Body: ${JSON.stringify(opts.body, null, 2)}
+` : "");
+      fs3.writeSync(process.stderr.fd, msg);
+      process.exitCode = ExitCode.SUCCESS;
+      throw new PncliError("dry-run", 0);
+    }
+    return request(url, init, opts.timeoutMs ?? 3e4);
+  }
+  sdeHeaders() {
+    const { token } = this.config.sde;
+    if (!token) throw new PncliError("SDElements credentials not configured. Run: pncli config init");
+    return {
+      "Authorization": `Token ${token}`,
+      "Content-Type": "application/json",
+      "Accept": "application/json",
+      "Connection": "close"
+    };
+  }
+  async sde(path6, opts = {}) {
+    const baseUrl = this.config.sde.baseUrl;
+    if (!baseUrl) throw new PncliError("SDElements baseUrl not configured. Run: pncli config init");
+    const url = buildUrl(baseUrl, path6, opts.params);
+    const headers = this.sdeHeaders();
+    const init = {
+      method: opts.method ?? "GET",
+      headers,
+      body: opts.body !== void 0 ? JSON.stringify(opts.body) : void 0
+    };
+    if (this.dryRun) {
+      const safeHeaders = { ...headers, Authorization: "[REDACTED]" };
+      const msg = `DRY RUN: ${init.method} ${url}
+Headers: ${JSON.stringify(safeHeaders, null, 2)}
+` + (opts.body ? `Body: ${JSON.stringify(opts.body, null, 2)}
+` : "");
+      fs3.writeSync(process.stderr.fd, msg);
+      process.exitCode = ExitCode.SUCCESS;
+      throw new PncliError("dry-run", 0);
+    }
+    return request(url, init, opts.timeoutMs ?? 3e4);
+  }
+  async sdePaginate(fetchPage) {
+    const results = [];
+    let page = 1;
+    const pageSize = 100;
+    while (true) {
+      const response = await fetchPage(page, pageSize);
+      results.push(...response.results);
+      if (results.length >= response.count || response.results.length === 0) break;
+      page++;
+    }
+    return results;
+  }
+  sonarHeaders() {
+    const { token } = this.config.sonar;
+    if (!token) throw new PncliError("SonarQube credentials not configured. Run: pncli config init");
+    return {
+      "Authorization": `Bearer ${token}`,
+      "Content-Type": "application/json",
+      "Accept": "application/json",
+      "Connection": "close"
+    };
+  }
+  async sonar(path6, opts = {}) {
+    const baseUrl = this.config.sonar.baseUrl;
+    if (!baseUrl) throw new PncliError("SonarQube baseUrl not configured. Run: pncli config init");
+    const url = buildUrl(baseUrl, path6, opts.params);
+    const headers = this.sonarHeaders();
+    const init = {
+      method: opts.method ?? "GET",
+      headers,
+      body: opts.body !== void 0 ? JSON.stringify(opts.body) : void 0
+    };
+    if (this.dryRun) {
+      const safeHeaders = { ...headers, Authorization: "[REDACTED]" };
+      const msg = `DRY RUN: ${init.method} ${url}
+Headers: ${JSON.stringify(safeHeaders, null, 2)}
+` + (opts.body ? `Body: ${JSON.stringify(opts.body, null, 2)}
+` : "");
+      fs3.writeSync(process.stderr.fd, msg);
+      process.exitCode = ExitCode.SUCCESS;
+      throw new PncliError("dry-run", 0);
     }
     return request(url, init, opts.timeoutMs ?? 3e4);
   }
+  async sonarPaginate(fetchPage) {
+    const results = [];
+    let page = 1;
+    const pageSize = 500;
+    while (true) {
+      const response = await fetchPage(page, pageSize);
+      results.push(...response.items);
+      if (results.length >= response.total || response.items.length === 0) break;
+      page++;
+    }
+    return results;
+  }
+  async confluencePaginate(fetchPage) {
+    const results = [];
+    let start = 0;
+    const limit = 25;
+    while (true) {
+      const page = await fetchPage(start, limit);
+      results.push(...page.results);
+      if (!page._links.next) break;
+      start += page.size;
+    }
+    return results;
+  }
   async paginate(fetchPage) {
     const results = [];
     let start = 0;
@@ -1412,124 +1640,2423 @@ function registerBitbucketCommands(program2) {
   });
 }
 
+// src/services/confluence/client.ts
+var API3 = "/rest/api";
+var ConfluenceClient = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async getPage(id, expand = "body.storage,version,space,ancestors") {
+    return this.http.confluence(`${API3}/content/${id}`, {
+      params: { expand }
+    });
+  }
+  async getPageByTitle(spaceKey, title) {
+    const result = await this.http.confluence(`${API3}/content`, {
+      params: { spaceKey, title, expand: "body.storage,version,space", type: "page" }
+    });
+    return result.results[0] ?? null;
+  }
+  async listPages(spaceKey, opts = {}) {
+    const initialStart = opts.start ?? 0;
+    return this.http.confluencePaginate(async (start, limit) => {
+      return this.http.confluence(`${API3}/content`, {
+        params: { spaceKey, type: "page", expand: "version", start: initialStart + start, limit: opts.limit ?? limit }
+      });
+    });
+  }
+  async getPageChildren(id) {
+    return this.http.confluencePaginate(async (start, limit) => {
+      return this.http.confluence(`${API3}/content/${id}/child/page`, {
+        params: { expand: "version", start, limit }
+      });
+    });
+  }
+  async getLabels(id) {
+    return this.http.confluencePaginate(async (start, limit) => {
+      return this.http.confluence(`${API3}/content/${id}/label`, {
+        params: { start, limit }
+      });
+    });
+  }
+  async search(cql, opts = {}) {
+    return this.http.confluence(`${API3}/content/search`, {
+      params: {
+        cql,
+        start: opts.start ?? 0,
+        limit: opts.limit ?? 25,
+        ...opts.expand ? { expand: opts.expand } : {}
+      }
+    });
+  }
+  async createPage(opts) {
+    const body = {
+      type: "page",
+      title: opts.title,
+      space: { key: opts.spaceKey },
+      ancestors: opts.parentId ? [{ id: opts.parentId }] : [],
+      body: {
+        storage: {
+          value: opts.body,
+          representation: opts.representation ?? "storage"
+        }
+      }
+    };
+    return this.http.confluence(`${API3}/content`, {
+      method: "POST",
+      body
+    });
+  }
+  async updatePage(id, opts) {
+    const body = {
+      version: { number: opts.version },
+      type: "page",
+      title: opts.title,
+      status: opts.status ?? "current"
+    };
+    if (opts.body !== void 0) {
+      body.body = {
+        storage: {
+          value: opts.body,
+          representation: opts.representation ?? "storage"
+        }
+      };
+    }
+    return this.http.confluence(`${API3}/content/${id}`, {
+      method: "PUT",
+      body
+    });
+  }
+  async deletePage(id) {
+    return this.http.confluence(`${API3}/content/${id}`, { method: "DELETE" });
+  }
+  async listComments(pageId) {
+    return this.http.confluencePaginate(async (start, limit) => {
+      return this.http.confluence(`${API3}/content/${pageId}/child/comment`, {
+        params: { expand: "body.storage,version", start, limit }
+      });
+    });
+  }
+  async addComment(pageId, body, representation = "storage") {
+    return this.http.confluence(`${API3}/content`, {
+      method: "POST",
+      body: {
+        type: "comment",
+        container: { id: pageId, type: "page" },
+        body: {
+          storage: { value: body, representation }
+        }
+      }
+    });
+  }
+  async addLabel(pageId, labels) {
+    const body = labels.map((name) => ({ prefix: "global", name }));
+    const result = await this.http.confluence(`${API3}/content/${pageId}/label`, {
+      method: "POST",
+      body
+    });
+    return result.results;
+  }
+  async removeLabel(pageId, label) {
+    return this.http.confluence(`${API3}/content/${pageId}/label/${label}`, { method: "DELETE" });
+  }
+  async listSpaces(opts = {}) {
+    const initialStart = opts.start ?? 0;
+    return this.http.confluencePaginate(async (start, limit) => {
+      return this.http.confluence(`${API3}/space`, {
+        params: {
+          start: initialStart + start,
+          limit: opts.limit ?? limit,
+          ...opts.type ? { type: opts.type } : {}
+        }
+      });
+    });
+  }
+  async getSpace(key) {
+    return this.http.confluence(`${API3}/space/${key}`, {
+      params: { expand: "description.plain" }
+    });
+  }
+  async listAttachments(pageId) {
+    return this.http.confluencePaginate(async (start, limit) => {
+      return this.http.confluence(`${API3}/content/${pageId}/child/attachment`, {
+        params: { start, limit }
+      });
+    });
+  }
+};
+
 // src/services/confluence/commands.ts
+function getClient3(program2) {
+  const opts = program2.optsWithGlobals();
+  const config = loadConfig({ configPath: opts.config });
+  if (!config.confluence.baseUrl) throw new PncliError("Confluence not configured. Run: pncli config init");
+  const http = createHttpClient(config, Boolean(opts.dryRun));
+  return new ConfluenceClient(http);
+}
 function registerConfluenceCommands(program2) {
-  program2.command("confluence").description("Confluence operations").action(() => {
-    success(
-      { message: "Coming soon \u2014 the nightmare never ends." },
-      "confluence",
-      "stub",
-      Date.now()
-    );
+  const confluence = program2.command("confluence").description("Confluence operations");
+  confluence.command("get-page").description("Get a Confluence page by ID").requiredOption("--id <page-id>", "Page ID").option("--expand <fields>", "Comma-separated fields to expand", "body.storage,version,space,ancestors").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const client = getClient3(program2);
+      const data = await client.getPage(opts.id, opts.expand);
+      success(data, "confluence", "get-page", start);
+    } catch (err) {
+      fail(err, "confluence", "get-page", start);
+    }
   });
-}
-
-// src/services/sonar/commands.ts
-function registerSonarCommands(program2) {
-  program2.command("sonar").description("SonarQube operations").action(() => {
-    success(
-      { message: "Coming soon \u2014 the nightmare never ends." },
-      "sonar",
-      "stub",
-      Date.now()
-    );
+  confluence.command("get-page-by-title").description("Find a Confluence page by space key and title").requiredOption("--space <key>", "Space key").requiredOption("--title <title>", "Page title").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const client = getClient3(program2);
+      const data = await client.getPageByTitle(opts.space, opts.title);
+      if (!data) throw new PncliError(`Page not found: "${opts.title}" in space ${opts.space}`, 1);
+      success(data, "confluence", "get-page-by-title", start);
+    } catch (err) {
+      fail(err, "confluence", "get-page-by-title", start);
+    }
   });
-}
-
-// src/services/artifactory/commands.ts
-function registerArtifactoryCommands(program2) {
-  program2.command("artifactory").description("Artifactory operations").action(() => {
-    success(
-      { message: "Coming soon \u2014 the nightmare never ends." },
-      "artifactory",
-      "stub",
-      Date.now()
-    );
+  confluence.command("list-pages").description("List pages in a Confluence space").requiredOption("--space <key>", "Space key").option("--limit <n>", "Max results per page (default: all)").option("--start <n>", "Offset for first result").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const client = getClient3(program2);
+      const data = await client.listPages(opts.space, {
+        limit: opts.limit ? parseInt(opts.limit, 10) : void 0,
+        start: opts.start ? parseInt(opts.start, 10) : void 0
+      });
+      success(data, "confluence", "list-pages", start);
+    } catch (err) {
+      fail(err, "confluence", "list-pages", start);
+    }
   });
-}
-
-// src/services/config/commands.ts
-import { input, password, confirm } from "@inquirer/prompts";
-import fs2 from "fs";
-function registerConfigCommands(program2) {
-  const config = program2.command("config").description("Manage pncli configuration");
-  config.command("init").description("Interactive setup wizard").option("--repo", "Write repo config (.pncli.json) instead of global config").action(async (opts) => {
+  confluence.command("get-page-children").description("Get child pages of a Confluence page").requiredOption("--id <page-id>", "Parent page ID").action(async (opts) => {
     const start = Date.now();
     try {
-      if (opts.repo) {
-        await initRepoConfig(start);
-      } else {
-        await initGlobalConfig(start);
-      }
+      const client = getClient3(program2);
+      const data = await client.getPageChildren(opts.id);
+      success(data, "confluence", "get-page-children", start);
     } catch (err) {
-      if (err instanceof Error && err.message.includes("User force closed")) {
-        process.stderr.write("\nSetup cancelled.\n");
-        process.exit(1);
-      }
-      fail(err, "config", "init", start);
+      fail(err, "confluence", "get-page-children", start);
     }
   });
-  config.command("show").description("Print fully resolved config (PATs masked)").action(() => {
+  confluence.command("get-labels").description("Get labels on a Confluence page").requiredOption("--id <page-id>", "Page ID").action(async (opts) => {
     const start = Date.now();
     try {
-      const resolved = loadConfig();
-      success(maskConfig(resolved), "config", "show", start);
+      const client = getClient3(program2);
+      const data = await client.getLabels(opts.id);
+      success(data, "confluence", "get-labels", start);
     } catch (err) {
-      fail(err, "config", "show", start);
+      fail(err, "confluence", "get-labels", start);
     }
   });
-  config.command("set").description("Set a config value by dot-notation key (e.g. jira.baseUrl https://...)").argument("<key>", "Config key in dot notation").argument("<value>", "Value to set").action((key, value) => {
+  confluence.command("search").description("Search Confluence with CQL").requiredOption("--cql <query>", 'CQL query string (e.g. "space=PROJ AND type=page")').option("--limit <n>", "Maximum number of results", "25").option("--start <n>", "Offset for first result", "0").option("--expand <fields>", "Comma-separated fields to expand").action(async (opts) => {
     const start = Date.now();
     try {
-      const opts = program2.optsWithGlobals();
-      setConfigValue(key, value, opts.config);
-      success({ key, value }, "config", "set", start);
+      const client = getClient3(program2);
+      const data = await client.search(opts.cql, {
+        limit: parseInt(opts.limit, 10),
+        start: parseInt(opts.start, 10),
+        expand: opts.expand
+      });
+      success(data, "confluence", "search", start);
     } catch (err) {
-      fail(err, "config", "set", start);
+      fail(err, "confluence", "search", start);
     }
   });
-  config.command("test").description("Test connectivity to configured services").action(() => {
+  confluence.command("create-page").description("Create a new Confluence page").requiredOption("--space <key>", "Space key").requiredOption("--title <title>", "Page title").requiredOption("--body <html>", "Page body (storage format HTML)").option("--parent-id <id>", "Parent page ID (to nest under a page)").option("--representation <format>", "Body format: storage (default) or wiki", "storage").action(async (opts) => {
     const start = Date.now();
-    success(
-      { message: "Service connectivity test available after Phase 2." },
-      "config",
-      "test",
-      start
-    );
+    try {
+      const client = getClient3(program2);
+      const data = await client.createPage({
+        spaceKey: opts.space,
+        title: opts.title,
+        body: opts.body,
+        parentId: opts.parentId,
+        representation: opts.representation
+      });
+      success(data, "confluence", "create-page", start);
+    } catch (err) {
+      fail(err, "confluence", "create-page", start);
+    }
   });
-}
-async function initGlobalConfig(start) {
-  process.stderr.write("pncli config init \u2014 Global configuration\n\n");
-  process.stderr.write("\u2500\u2500 Identity \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
-  const userEmail = await input({
-    message: "Your email address (used across Jira, Bitbucket, etc.):",
-    default: ""
+  confluence.command("update-page").description("Update a Confluence page (fetches current version automatically)").requiredOption("--id <page-id>", "Page ID").option("--title <title>", "New page title").option("--body <html>", "New page body (storage format HTML)").option("--status <status>", "Page status: current (default) or draft", "current").option("--representation <format>", "Body format: storage (default) or wiki", "storage").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const client = getClient3(program2);
+      const current = await client.getPage(opts.id, "version");
+      const nextVersion = current.version.number + 1;
+      const data = await client.updatePage(opts.id, {
+        version: nextVersion,
+        title: opts.title ?? current.title,
+        body: opts.body,
+        status: opts.status,
+        representation: opts.representation
+      });
+      success(data, "confluence", "update-page", start);
+    } catch (err) {
+      fail(err, "confluence", "update-page", start);
+    }
   });
-  const userId = await input({
-    message: "Your username / user ID:",
-    default: ""
+  confluence.command("delete-page").description("Delete a Confluence page").requiredOption("--id <page-id>", "Page ID").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const client = getClient3(program2);
+      await client.deletePage(opts.id);
+      success({ deleted: opts.id }, "confluence", "delete-page", start);
+    } catch (err) {
+      fail(err, "confluence", "delete-page", start);
+    }
   });
-  process.stderr.write("\n\u2500\u2500 Jira \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
-  const jiraBaseUrl = await input({
-    message: "Jira base URL (e.g. https://jira.your-company.com):",
-    default: ""
+  confluence.command("list-comments").description("List comments on a Confluence page").requiredOption("--id <page-id>", "Page ID").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const client = getClient3(program2);
+      const data = await client.listComments(opts.id);
+      success(data, "confluence", "list-comments", start);
+    } catch (err) {
+      fail(err, "confluence", "list-comments", start);
+    }
   });
-  const jiraApiToken = await password({
-    message: "Jira personal access token:"
+  confluence.command("add-comment").description("Add a comment to a Confluence page").requiredOption("--id <page-id>", "Page ID").requiredOption("--body <text>", "Comment body (storage format HTML)").option("--representation <format>", "Body format: storage (default) or wiki", "storage").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const client = getClient3(program2);
+      const data = await client.addComment(opts.id, opts.body, opts.representation);
+      success(data, "confluence", "add-comment", start);
+    } catch (err) {
+      fail(err, "confluence", "add-comment", start);
+    }
   });
-  process.stderr.write("\n\u2500\u2500 Bitbucket \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
-  const bitbucketBaseUrl = await input({
-    message: "Bitbucket Server base URL (e.g. https://bitbucket.your-company.com):",
-    default: ""
+  confluence.command("add-label").description("Add labels to a Confluence page").requiredOption("--id <page-id>", "Page ID").requiredOption("--labels <names>", "Comma-separated label names").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const client = getClient3(program2);
+      const labels = opts.labels.split(",").map((s) => s.trim()).filter(Boolean);
+      const data = await client.addLabel(opts.id, labels);
+      success(data, "confluence", "add-label", start);
+    } catch (err) {
+      fail(err, "confluence", "add-label", start);
+    }
+  });
+  confluence.command("remove-label").description("Remove a label from a Confluence page").requiredOption("--id <page-id>", "Page ID").requiredOption("--label <name>", "Label name to remove").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const client = getClient3(program2);
+      await client.removeLabel(opts.id, opts.label);
+      success({ removed: opts.label, from: opts.id }, "confluence", "remove-label", start);
+    } catch (err) {
+      fail(err, "confluence", "remove-label", start);
+    }
+  });
+  confluence.command("list-spaces").description("List Confluence spaces").option("--type <type>", "Space type: global or personal").option("--limit <n>", "Max results (default: all)").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const client = getClient3(program2);
+      const data = await client.listSpaces({
+        type: opts.type,
+        limit: opts.limit ? parseInt(opts.limit, 10) : void 0
+      });
+      success(data, "confluence", "list-spaces", start);
+    } catch (err) {
+      fail(err, "confluence", "list-spaces", start);
+    }
+  });
+  confluence.command("get-space").description("Get a Confluence space by key").requiredOption("--key <space-key>", "Space key").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const client = getClient3(program2);
+      const data = await client.getSpace(opts.key);
+      success(data, "confluence", "get-space", start);
+    } catch (err) {
+      fail(err, "confluence", "get-space", start);
+    }
+  });
+  confluence.command("list-attachments").description("List attachments on a Confluence page").requiredOption("--id <page-id>", "Page ID").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const client = getClient3(program2);
+      const data = await client.listAttachments(opts.id);
+      success(data, "confluence", "list-attachments", start);
+    } catch (err) {
+      fail(err, "confluence", "list-attachments", start);
+    }
+  });
+}
+
+// src/services/sonar/client.ts
+var API4 = "/api";
+var SonarClient = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async getStatus() {
+    return this.http.sonar(`${API4}/system/status`);
+  }
+  async getQualityGate(projectKey, branch) {
+    return this.http.sonar(`${API4}/qualitygates/project_status`, {
+      params: { projectKey, ...branch ? { branch } : {} }
+    });
+  }
+  async searchIssues(opts) {
+    return this.http.sonar(`${API4}/issues/search`, {
+      params: {
+        componentKeys: opts.projectKey,
+        severities: opts.severities,
+        types: opts.types,
+        statuses: opts.statuses,
+        branch: opts.branch,
+        resolved: opts.resolved !== void 0 ? String(opts.resolved) : void 0,
+        p: opts.page ?? 1,
+        ps: opts.pageSize ?? 100
+      }
+    });
+  }
+  async searchAllIssues(opts) {
+    return this.http.sonarPaginate(async (page, pageSize) => {
+      const resp = await this.http.sonar(`${API4}/issues/search`, {
+        params: {
+          componentKeys: opts.projectKey,
+          severities: opts.severities,
+          types: opts.types,
+          statuses: opts.statuses,
+          branch: opts.branch,
+          resolved: opts.resolved !== void 0 ? String(opts.resolved) : void 0,
+          p: page,
+          ps: pageSize
+        }
+      });
+      return { total: resp.total, p: resp.p, ps: resp.ps, items: resp.issues };
+    });
+  }
+  async getMeasures(opts) {
+    return this.http.sonar(`${API4}/measures/component`, {
+      params: {
+        component: opts.projectKey,
+        metricKeys: opts.metricKeys,
+        ...opts.branch ? { branch: opts.branch } : {}
+      }
+    });
+  }
+  async searchProjects(opts = {}) {
+    return this.http.sonar(`${API4}/projects/search`, {
+      params: {
+        q: opts.query,
+        p: opts.page ?? 1,
+        ps: opts.pageSize ?? 100
+      }
+    });
+  }
+  async searchAllProjects(query) {
+    return this.http.sonarPaginate(async (page, pageSize) => {
+      const resp = await this.http.sonar(`${API4}/projects/search`, {
+        params: { q: query, p: page, ps: pageSize }
+      });
+      return { total: resp.paging.total, p: resp.paging.pageIndex, ps: resp.paging.pageSize, items: resp.components };
+    });
+  }
+  async searchHotspots(opts) {
+    return this.http.sonar(`${API4}/hotspots/search`, {
+      params: {
+        projectKey: opts.projectKey,
+        status: opts.status,
+        resolution: opts.resolution,
+        branch: opts.branch,
+        p: opts.page ?? 1,
+        ps: opts.pageSize ?? 100
+      }
+    });
+  }
+  async searchAllHotspots(opts) {
+    return this.http.sonarPaginate(async (page, pageSize) => {
+      const resp = await this.http.sonar(`${API4}/hotspots/search`, {
+        params: {
+          projectKey: opts.projectKey,
+          status: opts.status,
+          resolution: opts.resolution,
+          branch: opts.branch,
+          p: page,
+          ps: pageSize
+        }
+      });
+      return { total: resp.paging.total, p: resp.paging.pageIndex, ps: resp.paging.pageSize, items: resp.hotspots };
+    });
+  }
+};
+
+// src/services/sonar/commands.ts
+var DEFAULT_METRICS = "coverage,duplicated_lines_density,bugs,vulnerabilities,code_smells,sqale_rating,reliability_rating,security_rating,ncloc";
+function getClient4(program2) {
+  const opts = program2.optsWithGlobals();
+  const config = loadConfig({ configPath: opts.config });
+  if (!config.sonar.baseUrl) throw new PncliError("SonarQube not configured. Run: pncli config init");
+  const http = createHttpClient(config, Boolean(opts.dryRun));
+  return { client: new SonarClient(http), config };
+}
+function resolveProject(config, cliProject) {
+  const project = cliProject ?? config.defaults.sonar.project;
+  if (!project) throw new PncliError("No project specified. Use --project or set defaults.sonar.project in config.");
+  return project;
+}
+function registerSonarCommands(program2) {
+  const sonar = program2.command("sonar").description("SonarQube Server operations");
+  sonar.command("quality-gate").description("Get quality gate status for a project").option("--project <key>", "SonarQube project key (or set defaults.sonar.project in config)").option("--branch <name>", "Branch name").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const { client, config } = getClient4(program2);
+      const projectKey = resolveProject(config, opts.project);
+      const data = await client.getQualityGate(projectKey, opts.branch);
+      success(data, "sonar", "quality-gate", start);
+    } catch (err) {
+      fail(err, "sonar", "quality-gate", start);
+    }
+  });
+  sonar.command("issues").description("Search/list issues for a project").option("--project <key>", "SonarQube project key (or set defaults.sonar.project in config)").option("--severities <list>", "Filter by severity: BLOCKER,CRITICAL,MAJOR,MINOR,INFO (comma-separated)").option("--types <list>", "Filter by type: BUG,VULNERABILITY,CODE_SMELL (comma-separated)").option("--statuses <list>", "Filter by status: OPEN,CONFIRMED,REOPENED,RESOLVED,CLOSED (comma-separated)").option("--branch <name>", "Branch name").option("--resolved <bool>", "Filter resolved issues: true or false").option("--page <n>", "Page number (1-based)", "1").option("--page-size <n>", "Results per page (max 500)", "100").option("--all", "Fetch all pages (ignores --page/--page-size)").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const { client, config } = getClient4(program2);
+      const projectKey = resolveProject(config, opts.project);
+      const baseOpts = {
+        projectKey,
+        severities: opts.severities,
+        types: opts.types,
+        statuses: opts.statuses,
+        branch: opts.branch,
+        resolved: opts.resolved !== void 0 ? opts.resolved === "true" : void 0
+      };
+      if (opts.all) {
+        const data = await client.searchAllIssues(baseOpts);
+        success(data, "sonar", "issues", start);
+      } else {
+        const data = await client.searchIssues({
+          ...baseOpts,
+          page: parseInt(opts.page, 10),
+          pageSize: parseInt(opts.pageSize, 10)
+        });
+        success(data, "sonar", "issues", start);
+      }
+    } catch (err) {
+      fail(err, "sonar", "issues", start);
+    }
+  });
+  sonar.command("measures").description("Get key metrics for a project").option("--project <key>", "SonarQube project key (or set defaults.sonar.project in config)").option("--metrics <list>", "Comma-separated metric keys", DEFAULT_METRICS).option("--branch <name>", "Branch name").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const { client, config } = getClient4(program2);
+      const projectKey = resolveProject(config, opts.project);
+      const data = await client.getMeasures({
+        projectKey,
+        metricKeys: opts.metrics,
+        branch: opts.branch
+      });
+      success(data, "sonar", "measures", start);
+    } catch (err) {
+      fail(err, "sonar", "measures", start);
+    }
+  });
+  sonar.command("projects").description("Search/list projects").option("--query <text>", "Search query").option("--page <n>", "Page number (1-based)", "1").option("--page-size <n>", "Results per page", "100").option("--all", "Fetch all pages").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const { client } = getClient4(program2);
+      if (opts.all) {
+        const data = await client.searchAllProjects(opts.query);
+        success(data, "sonar", "projects", start);
+      } else {
+        const data = await client.searchProjects({
+          query: opts.query,
+          page: parseInt(opts.page, 10),
+          pageSize: parseInt(opts.pageSize, 10)
+        });
+        success(data, "sonar", "projects", start);
+      }
+    } catch (err) {
+      fail(err, "sonar", "projects", start);
+    }
+  });
+  sonar.command("hotspots").description("List security hotspots for a project").option("--project <key>", "SonarQube project key (or set defaults.sonar.project in config)").option("--status <status>", "Filter: TO_REVIEW or REVIEWED").option("--resolution <list>", "Filter: FIXED,SAFE,ACKNOWLEDGED (comma-separated)").option("--branch <name>", "Branch name").option("--page <n>", "Page number (1-based)", "1").option("--page-size <n>", "Results per page", "100").option("--all", "Fetch all pages").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const { client, config } = getClient4(program2);
+      const projectKey = resolveProject(config, opts.project);
+      const baseOpts = {
+        projectKey,
+        status: opts.status,
+        resolution: opts.resolution,
+        branch: opts.branch
+      };
+      if (opts.all) {
+        const data = await client.searchAllHotspots(baseOpts);
+        success(data, "sonar", "hotspots", start);
+      } else {
+        const data = await client.searchHotspots({
+          ...baseOpts,
+          page: parseInt(opts.page, 10),
+          pageSize: parseInt(opts.pageSize, 10)
+        });
+        success(data, "sonar", "hotspots", start);
+      }
+    } catch (err) {
+      fail(err, "sonar", "hotspots", start);
+    }
+  });
+}
+
+// src/services/sde/client.ts
+var API5 = "/api/v2";
+function projectParams(opts, page, pageSize) {
+  return {
+    name: opts.name,
+    slug: opts.slug,
+    search: opts.search,
+    active: opts.active,
+    ordering: opts.ordering,
+    expand: opts.expand,
+    include: opts.include,
+    page,
+    page_size: pageSize
+  };
+}
+function taskParams(opts, page, pageSize) {
+  return {
+    phase: opts.phase,
+    priority: opts.priority,
+    status: opts.status,
+    assigned_to: opts.assignedTo,
+    source: opts.source,
+    verification: opts.verification,
+    tag: opts.tag,
+    accepted: opts.accepted,
+    relevant: opts.relevant,
+    expand: opts.expand,
+    include: opts.include,
+    page,
+    page_size: pageSize
+  };
+}
+function threatParams(opts, page, pageSize) {
+  return {
+    severity: opts.severity,
+    title: opts.title,
+    threat_id: opts.threatId,
+    capec_id: opts.capecId,
+    component_id: opts.componentId,
+    search: opts.search,
+    ordering: opts.ordering,
+    page,
+    page_size: pageSize
+  };
+}
+function userParams(opts, page, pageSize) {
+  return {
+    email: opts.email,
+    first_name: opts.firstName,
+    last_name: opts.lastName,
+    is_active: opts.isActive,
+    page,
+    page_size: pageSize
+  };
+}
+var SdeClient = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  async getServerInfo() {
+    return this.http.sde(`${API5}/server-info/`);
+  }
+  async getMe() {
+    return this.http.sde(`${API5}/users/me/`);
+  }
+  async getProject(projectId, expand, include) {
+    return this.http.sde(`${API5}/projects/${projectId}/`, {
+      params: { expand, include }
+    });
+  }
+  async getTask(projectId, taskId, expand, include) {
+    return this.http.sde(`${API5}/projects/${projectId}/tasks/${taskId}/`, {
+      params: { expand, include }
+    });
+  }
+  async listProjects(opts = {}) {
+    return this.http.sde(`${API5}/projects/`, {
+      params: projectParams(opts, opts.page ?? 1, opts.pageSize ?? 100)
+    });
+  }
+  async listAllProjects(opts = {}) {
+    return this.http.sdePaginate(async (page, pageSize) => {
+      const resp = await this.http.sde(`${API5}/projects/`, {
+        params: projectParams(opts, page, pageSize)
+      });
+      return { count: resp.count, results: resp.results };
+    });
+  }
+  async listTasks(opts) {
+    return this.http.sde(`${API5}/projects/${opts.projectId}/tasks/`, {
+      params: taskParams(opts, opts.page ?? 1, opts.pageSize ?? 100)
+    });
+  }
+  async listAllTasks(opts) {
+    return this.http.sdePaginate(async (page, pageSize) => {
+      const resp = await this.http.sde(`${API5}/projects/${opts.projectId}/tasks/`, {
+        params: taskParams(opts, page, pageSize)
+      });
+      return { count: resp.count, results: resp.results };
+    });
+  }
+  async listThreats(opts) {
+    return this.http.sde(`${API5}/projects/${opts.projectId}/threats/`, {
+      params: threatParams(opts, opts.page ?? 1, opts.pageSize ?? 100)
+    });
+  }
+  async listAllThreats(opts) {
+    return this.http.sdePaginate(async (page, pageSize) => {
+      const resp = await this.http.sde(`${API5}/projects/${opts.projectId}/threats/`, {
+        params: threatParams(opts, page, pageSize)
+      });
+      return { count: resp.count, results: resp.results };
+    });
+  }
+  async listUsers(opts = {}) {
+    return this.http.sde(`${API5}/users/`, {
+      params: userParams(opts, opts.page ?? 1, opts.pageSize ?? 100)
+    });
+  }
+  async listAllUsers(opts = {}) {
+    return this.http.sdePaginate(async (page, pageSize) => {
+      const resp = await this.http.sde(`${API5}/users/`, {
+        params: userParams(opts, page, pageSize)
+      });
+      return { count: resp.count, results: resp.results };
+    });
+  }
+};
+
+// src/services/sde/commands.ts
+function getClient5(program2) {
+  const opts = program2.optsWithGlobals();
+  const config = loadConfig({ configPath: opts.config });
+  if (!config.sde.baseUrl) throw new PncliError("SDElements not configured. Run: pncli config init");
+  const http = createHttpClient(config, Boolean(opts.dryRun));
+  return { client: new SdeClient(http), config };
+}
+function resolveProject2(config, cliProject) {
+  const project = cliProject ?? config.defaults.sde.project;
+  if (!project) throw new PncliError("No project specified. Use --project or set defaults.sde.project in config.");
+  if (!/^\d+$/.test(project)) throw new PncliError(`Invalid project ID: "${project}". SDElements project IDs must be positive integers.`);
+  const id = parseInt(project, 10);
+  if (id <= 0) throw new PncliError(`Invalid project ID: "${project}". SDElements project IDs must be positive integers.`);
+  return id;
+}
+function parsePage(val, flag) {
+  const n = parseInt(val, 10);
+  if (isNaN(n) || n < 1) throw new PncliError(`Invalid ${flag}: "${val}". Must be a positive integer.`);
+  return n;
+}
+function validateActive(val, allowed) {
+  if (val === void 0) return void 0;
+  if (!allowed.includes(val)) {
+    throw new PncliError(`Invalid --active value: "${val}". Allowed: ${allowed.join(", ")}.`);
+  }
+  return val;
+}
+function registerSdeCommands(program2) {
+  const sde = program2.command("sde").description("SDElements operations (threat modeling, countermeasures, compliance)");
+  sde.command("server-info").description("Get server version and platform info (requires super-user)").action(async () => {
+    const start = Date.now();
+    try {
+      const { client } = getClient5(program2);
+      const data = await client.getServerInfo();
+      success(data, "sde", "server-info", start);
+    } catch (err) {
+      fail(err, "sde", "server-info", start);
+    }
+  });
+  sde.command("whoami").description("Get current authenticated user").action(async () => {
+    const start = Date.now();
+    try {
+      const { client } = getClient5(program2);
+      const data = await client.getMe();
+      success(data, "sde", "whoami", start);
+    } catch (err) {
+      fail(err, "sde", "whoami", start);
+    }
+  });
+  sde.command("users").description("List users").option("--email <email>", "Filter by email address").option("--first-name <name>", "Filter by first name").option("--last-name <name>", "Filter by last name").option("--active <bool>", "Filter by active status: true or false").option("--page <n>", "Page number (1-based)", "1").option("--page-size <n>", "Results per page", "100").option("--all", "Fetch all pages").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const { client } = getClient5(program2);
+      const baseOpts = {
+        email: opts.email,
+        firstName: opts.firstName,
+        lastName: opts.lastName,
+        isActive: validateActive(opts.active, ["true", "false"])
+      };
+      if (opts.all) {
+        const data = await client.listAllUsers(baseOpts);
+        success(data, "sde", "users", start);
+      } else {
+        const data = await client.listUsers({
+          ...baseOpts,
+          page: parsePage(opts.page, "--page"),
+          pageSize: parsePage(opts.pageSize, "--page-size")
+        });
+        success(data, "sde", "users", start);
+      }
+    } catch (err) {
+      fail(err, "sde", "users", start);
+    }
+  });
+  sde.command("projects").description("List projects").option("--name <name>", "Filter by project name").option("--search <text>", "Text search on name and profile").option("--active <val>", "Filter by active status: true, false, or all").option("--ordering <field>", "Sort by: name, created, updated (prefix with - for descending)").option("--expand <fields>", "Expand nested fields (comma-separated): application,business_unit,creator").option("--include <fields>", "Include extra fields (comma-separated): task_counts,permissions").option("--page <n>", "Page number (1-based)", "1").option("--page-size <n>", "Results per page", "100").option("--all", "Fetch all pages").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const { client } = getClient5(program2);
+      const baseOpts = {
+        name: opts.name,
+        search: opts.search,
+        active: validateActive(opts.active, ["true", "false", "all"]),
+        ordering: opts.ordering,
+        expand: opts.expand,
+        include: opts.include
+      };
+      if (opts.all) {
+        const data = await client.listAllProjects(baseOpts);
+        success(data, "sde", "projects", start);
+      } else {
+        const data = await client.listProjects({
+          ...baseOpts,
+          page: parsePage(opts.page, "--page"),
+          pageSize: parsePage(opts.pageSize, "--page-size")
+        });
+        success(data, "sde", "projects", start);
+      }
+    } catch (err) {
+      fail(err, "sde", "projects", start);
+    }
+  });
+  sde.command("project").description("Get a single project by ID").option("--id <id>", "Project ID (or set defaults.sde.project in config)").option("--expand <fields>", "Expand nested fields (comma-separated): application,business_unit,creator").option("--include <fields>", "Include extra fields (comma-separated): task_counts,permissions").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const { client, config } = getClient5(program2);
+      const projectId = resolveProject2(config, opts.id);
+      const data = await client.getProject(projectId, opts.expand, opts.include);
+      success(data, "sde", "project", start);
+    } catch (err) {
+      fail(err, "sde", "project", start);
+    }
+  });
+  sde.command("tasks").description("List countermeasures for a project").option("--project <id>", "Project ID (or set defaults.sde.project in config)").option("--phase <slug>", "Filter by phase slug (e.g. development, architecture-design)").option("--priority <n>", "Filter by priority (1-10)").option("--status <id>", "Filter by status ID (e.g. TS1, TS2)").option("--assigned-to <email>", "Filter by assignee email").option("--source <val>", "Filter by source: default, custom, manual, project").option("--verification <val>", "Filter by verification: pass, fail, partial, none").option("--tag <name>", "Filter by tag name").option("--accepted <bool>", "Filter by accepted status: true or false").option("--relevant <bool>", "Filter by relevant status: true or false").option("--expand <fields>", "Expand nested fields (comma-separated): status,phase,problem,text").option("--include <fields>", "Include extra fields (comma-separated): how_tos,last_note,references,regulation_sections").option("--page <n>", "Page number (1-based)", "1").option("--page-size <n>", "Results per page", "100").option("--all", "Fetch all pages").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const { client, config } = getClient5(program2);
+      const projectId = resolveProject2(config, opts.project);
+      const baseOpts = {
+        projectId,
+        phase: opts.phase,
+        priority: opts.priority,
+        status: opts.status,
+        assignedTo: opts.assignedTo,
+        source: opts.source,
+        verification: opts.verification,
+        tag: opts.tag,
+        accepted: opts.accepted,
+        relevant: opts.relevant,
+        expand: opts.expand,
+        include: opts.include
+      };
+      if (opts.all) {
+        const data = await client.listAllTasks(baseOpts);
+        success(data, "sde", "tasks", start);
+      } else {
+        const data = await client.listTasks({
+          ...baseOpts,
+          page: parsePage(opts.page, "--page"),
+          pageSize: parsePage(opts.pageSize, "--page-size")
+        });
+        success(data, "sde", "tasks", start);
+      }
+    } catch (err) {
+      fail(err, "sde", "tasks", start);
+    }
+  });
+  sde.command("task").description("Get a single countermeasure").option("--project <id>", "Project ID (or set defaults.sde.project in config)").requiredOption("--task <id>", "Task ID (e.g. T21)").option("--expand <fields>", "Expand nested fields (comma-separated): status,phase,problem,text").option("--include <fields>", "Include extra fields (comma-separated): how_tos,last_note,references").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const { client, config } = getClient5(program2);
+      const projectId = resolveProject2(config, opts.project);
+      const data = await client.getTask(projectId, opts.task, opts.expand, opts.include);
+      success(data, "sde", "task", start);
+    } catch (err) {
+      fail(err, "sde", "task", start);
+    }
+  });
+  sde.command("threats").description("List threats for a project").option("--project <id>", "Project ID (or set defaults.sde.project in config)").option("--severity <n>", "Filter by severity (1-10)").option("--search <text>", "Full-text search on title and threat ID").option("--ordering <field>", "Sort by: threat__severity, threat_id, status (prefix - for descending)").option("--capec-id <id>", "Filter by CAPEC attack pattern ID").option("--component-id <id>", "Filter by component ID").option("--page <n>", "Page number (1-based)", "1").option("--page-size <n>", "Results per page", "100").option("--all", "Fetch all pages").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const { client, config } = getClient5(program2);
+      const projectId = resolveProject2(config, opts.project);
+      const baseOpts = {
+        projectId,
+        severity: opts.severity,
+        search: opts.search,
+        ordering: opts.ordering,
+        capecId: opts.capecId,
+        componentId: opts.componentId
+      };
+      if (opts.all) {
+        const data = await client.listAllThreats(baseOpts);
+        success(data, "sde", "threats", start);
+      } else {
+        const data = await client.listThreats({
+          ...baseOpts,
+          page: parsePage(opts.page, "--page"),
+          pageSize: parsePage(opts.pageSize, "--page-size")
+        });
+        success(data, "sde", "threats", start);
+      }
+    } catch (err) {
+      fail(err, "sde", "threats", start);
+    }
+  });
+}
+
+// src/services/deps/parsers/index.ts
+import fs4 from "fs";
+import path5 from "path";
+import { execSync as execSync4, execFileSync as execFileSync2 } from "child_process";
+
+// src/services/deps/parsers/npm.ts
+import path2 from "path";
+function findNpmManifests(files) {
+  const lockFiles = new Set(
+    files.filter((f) => {
+      const base = path2.basename(f);
+      return base === "package-lock.json" || base === "yarn.lock" || base === "pnpm-lock.yaml";
+    })
+  );
+  const manifests = [];
+  for (const file of files) {
+    if (path2.basename(file) !== "package.json") continue;
+    if (file.split("/").includes("node_modules")) continue;
+    const dir = path2.dirname(file);
+    let lockFile;
+    for (const lf of ["package-lock.json", "yarn.lock", "pnpm-lock.yaml"]) {
+      const candidate = dir === "." ? lf : `${dir}/${lf}`;
+      if (lockFiles.has(candidate)) {
+        lockFile = candidate;
+        break;
+      }
+    }
+    manifests.push({ file, ecosystem: "npm", lockFile });
+  }
+  return manifests;
+}
+function parseNpmPackages(content, manifest, opts, lockContent) {
+  if (lockContent && manifest.lockFile) {
+    const base = path2.basename(manifest.lockFile);
+    if (base === "package-lock.json") {
+      const pkgs = parsePackageLock(lockContent, manifest.lockFile, opts);
+      if (pkgs.length > 0) return pkgs;
+    } else if (base === "yarn.lock") {
+      return parseYarnLock(lockContent, manifest.lockFile, opts, content);
+    } else if (base === "pnpm-lock.yaml") {
+      return parsePnpmLock(lockContent, manifest.lockFile, opts, content);
+    }
+  }
+  return parsePackageJson(content, manifest.file, opts);
+}
+function stripVersionPrefix(v) {
+  return v.replace(/^[\^~>=<* ]+/, "").split(/\s/)[0] ?? v;
+}
+function parsePackageJson(content, filePath, opts) {
+  let pkg2;
+  try {
+    pkg2 = JSON.parse(content);
+  } catch {
+    return [];
+  }
+  const packages = [];
+  for (const [name, version] of Object.entries(pkg2.dependencies ?? {})) {
+    packages.push({
+      name,
+      version: stripVersionPrefix(version),
+      ecosystem: "npm",
+      source: filePath,
+      type: "direct",
+      scope: "production"
+    });
+  }
+  if (opts.includeDev) {
+    for (const [name, version] of Object.entries(pkg2.devDependencies ?? {})) {
+      packages.push({
+        name,
+        version: stripVersionPrefix(version),
+        ecosystem: "npm",
+        source: filePath,
+        type: "direct",
+        scope: "dev"
+      });
+    }
+  }
+  return packages;
+}
+function parsePackageLock(content, lockFilePath, opts) {
+  let lock;
+  try {
+    lock = JSON.parse(content);
+  } catch {
+    return [];
+  }
+  if ((lock.lockfileVersion ?? 1) < 2 || !lock.packages) return [];
+  const packages = [];
+  for (const [pkgPath, meta] of Object.entries(lock.packages)) {
+    if (pkgPath === "") continue;
+    if (!meta.version) continue;
+    const isDev = meta.dev === true || meta.devOptional === true;
+    if (isDev && !opts.includeDev) continue;
+    const withoutRoot = pkgPath.startsWith("node_modules/") ? pkgPath.slice("node_modules/".length) : pkgPath;
+    const segments = withoutRoot.split("/node_modules/");
+    const isTransitive = segments.length > 1;
+    if (isTransitive && !opts.includeTransitive) continue;
+    const name = segments[segments.length - 1] ?? pkgPath;
+    packages.push({
+      name,
+      version: meta.version,
+      ecosystem: "npm",
+      source: lockFilePath,
+      type: isTransitive ? "transitive" : "direct",
+      scope: isDev ? "dev" : "production"
+    });
+  }
+  return packages;
+}
+function parseYarnLock(content, lockFilePath, opts, packageJsonContent) {
+  let pkgJson;
+  try {
+    pkgJson = JSON.parse(packageJsonContent);
+  } catch {
+    pkgJson = {};
+  }
+  const directDeps = new Set(Object.keys(pkgJson.dependencies ?? {}));
+  const devDeps = new Set(Object.keys(pkgJson.devDependencies ?? {}));
+  const allDirectDeps = /* @__PURE__ */ new Set([...directDeps, ...devDeps]);
+  const packages = [];
+  const seen = /* @__PURE__ */ new Set();
+  const blockRegex = /^"?(@?[^@"\n][^"\n]*)@[^:]+:?\n\s+version "([^"]+)"/gm;
+  for (const match of content.matchAll(blockRegex)) {
+    const name = match[1].trim().replace(/^"|"$/g, "");
+    const version = match[2];
+    const key = `${name}@${version}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    const isDev = devDeps.has(name) && !directDeps.has(name);
+    if (isDev && !opts.includeDev) continue;
+    const isTransitive = !allDirectDeps.has(name);
+    if (isTransitive && !opts.includeTransitive) continue;
+    packages.push({
+      name,
+      version,
+      ecosystem: "npm",
+      source: lockFilePath,
+      type: isTransitive ? "transitive" : "direct",
+      scope: isDev ? "dev" : "production"
+    });
+  }
+  return packages;
+}
+function parsePnpmLock(content, lockFilePath, opts, packageJsonContent) {
+  let pkgJson;
+  try {
+    pkgJson = JSON.parse(packageJsonContent);
+  } catch {
+    pkgJson = {};
+  }
+  const directDeps = new Set(Object.keys(pkgJson.dependencies ?? {}));
+  const devDeps = new Set(Object.keys(pkgJson.devDependencies ?? {}));
+  const allDirectDeps = /* @__PURE__ */ new Set([...directDeps, ...devDeps]);
+  const packages = [];
+  const seen = /* @__PURE__ */ new Set();
+  const blockRegex = /^\s{2}(\/?@?[^@\s/][^@\s]*)@(\d[^:\s]*):\s*\n((?:\s{4}[^\n]+\n)*)/gm;
+  for (const match of content.matchAll(blockRegex)) {
+    const name = match[1].replace(/^\//, "");
+    const version = match[2];
+    const attrs = match[3] ?? "";
+    const key = `${name}@${version}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    const isDev = devDeps.has(name) && !directDeps.has(name) || /^\s+dev:\s*true/m.test(attrs);
+    if (isDev && !opts.includeDev) continue;
+    const isTransitive = !allDirectDeps.has(name);
+    if (isTransitive && !opts.includeTransitive) continue;
+    packages.push({
+      name,
+      version,
+      ecosystem: "npm",
+      source: lockFilePath,
+      type: isTransitive ? "transitive" : "direct",
+      scope: isDev ? "dev" : "production"
+    });
+  }
+  return packages;
+}
+
+// src/services/deps/parsers/nuget.ts
+import path3 from "path";
+var PROJ_EXTENSIONS = /* @__PURE__ */ new Set([".csproj", ".fsproj", ".vbproj"]);
+function findNugetManifests(files) {
+  const lockFiles = /* @__PURE__ */ new Map();
+  for (const f of files) {
+    if (path3.basename(f) === "packages.lock.json") {
+      lockFiles.set(path3.dirname(f), f);
+    }
+  }
+  const manifests = [];
+  for (const file of files) {
+    const base = path3.basename(file);
+    const ext = path3.extname(file);
+    if (PROJ_EXTENSIONS.has(ext) || base === "packages.config") {
+      const dir = path3.dirname(file);
+      const lockFile = lockFiles.get(dir);
+      manifests.push({ file, ecosystem: "nuget", lockFile });
+    }
+    if (base === "Directory.Packages.props") {
+      const dir = path3.dirname(file);
+      manifests.push({ file, ecosystem: "nuget", lockFile: lockFiles.get(dir) });
+    }
+  }
+  const deduped = [];
+  const seenLocks = /* @__PURE__ */ new Set();
+  for (const manifest of manifests) {
+    if (!manifest.lockFile) {
+      deduped.push(manifest);
+      continue;
+    }
+    if (!seenLocks.has(manifest.lockFile)) {
+      seenLocks.add(manifest.lockFile);
+      deduped.push(manifest);
+    }
+  }
+  return deduped;
+}
+function parseNugetPackages(content, manifest, opts, lockContent, propsContent) {
+  const base = path3.basename(manifest.file);
+  if (lockContent) {
+    return parsePackagesLock(lockContent, manifest.lockFile ?? manifest.file, opts);
+  }
+  if (base === "packages.config") {
+    return parsePackagesConfig(content, manifest.file);
+  }
+  if (base === "Directory.Packages.props") {
+    return parseDirectoryPackagesProps(content, manifest.file);
+  }
+  return parseCsproj(content, manifest.file, propsContent);
+}
+function parseCsproj(content, filePath, propsContent) {
+  const centralVersions = propsContent ? extractCentralVersions(propsContent) : /* @__PURE__ */ new Map();
+  const packages = [];
+  const singleLine = /<PackageReference\s+([^>]+?)\/>/gi;
+  const multiLine = /<PackageReference\s+([^>]+?)>([\s\S]*?)<\/PackageReference>/gi;
+  const extractFromAttrsAndInner = (attrs, inner) => {
+    const nameMatch = /\bInclude="([^"]+)"/i.exec(attrs);
+    if (!nameMatch) return;
+    const name = nameMatch[1];
+    let version;
+    const attrVersion = /\bVersion="([^"]+)"/i.exec(attrs);
+    if (attrVersion) {
+      version = attrVersion[1];
+    } else if (inner) {
+      const innerVersion = /<Version>([^<]+)<\/Version>/i.exec(inner);
+      if (innerVersion) version = innerVersion[1];
+    }
+    if (!version || version.startsWith("$(")) {
+      version = centralVersions.get(name) ?? centralVersions.get(name.toLowerCase());
+    }
+    if (!version) return;
+    packages.push({
+      name,
+      version,
+      ecosystem: "nuget",
+      source: filePath,
+      type: "direct",
+      scope: "production"
+    });
+  };
+  for (const m of content.matchAll(singleLine)) {
+    extractFromAttrsAndInner(m[1], "");
+  }
+  for (const m of content.matchAll(multiLine)) {
+    extractFromAttrsAndInner(m[1], m[2] ?? "");
+  }
+  return packages;
+}
+function extractCentralVersions(propsContent) {
+  const map = /* @__PURE__ */ new Map();
+  const regex = /<PackageVersion\s+Include="([^"]+)"\s+Version="([^"]+)"/gi;
+  for (const m of propsContent.matchAll(regex)) {
+    map.set(m[1], m[2]);
+    map.set(m[1].toLowerCase(), m[2]);
+  }
+  return map;
+}
+function parseDirectoryPackagesProps(content, filePath) {
+  const packages = [];
+  const regex = /<PackageVersion\s+Include="([^"]+)"\s+Version="([^"]+)"/gi;
+  for (const m of content.matchAll(regex)) {
+    packages.push({
+      name: m[1],
+      version: m[2],
+      ecosystem: "nuget",
+      source: filePath,
+      type: "direct",
+      scope: "production"
+    });
+  }
+  return packages;
+}
+function parsePackagesConfig(content, filePath) {
+  const packages = [];
+  const regex = /<package\s+id="([^"]+)"\s+version="([^"]+)"/gi;
+  for (const m of content.matchAll(regex)) {
+    packages.push({
+      name: m[1],
+      version: m[2],
+      ecosystem: "nuget",
+      source: filePath,
+      type: "direct",
+      scope: "production"
+    });
+  }
+  return packages;
+}
+function parsePackagesLock(content, filePath, opts) {
+  let lock;
+  try {
+    lock = JSON.parse(content);
+  } catch {
+    return [];
+  }
+  const packages = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const frameworkDeps of Object.values(lock.dependencies ?? {})) {
+    for (const [name, meta] of Object.entries(frameworkDeps)) {
+      const version = meta.resolved ?? "";
+      if (!version) continue;
+      const isTransitive = meta.type === "Transitive";
+      if (isTransitive && !opts.includeTransitive) continue;
+      const key = `${name}@${version}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      packages.push({
+        name,
+        version,
+        ecosystem: "nuget",
+        source: filePath,
+        type: isTransitive ? "transitive" : "direct",
+        scope: "production"
+      });
+    }
+  }
+  return packages;
+}
+
+// src/services/deps/parsers/maven.ts
+import path4 from "path";
+function findMavenManifests(files) {
+  const lockFiles = new Set(files.filter((f) => path4.basename(f) === "gradle.lockfile"));
+  const manifests = [];
+  for (const file of files) {
+    const base = path4.basename(file);
+    if (base === "pom.xml" || base === "build.gradle" || base === "build.gradle.kts") {
+      const dir = path4.dirname(file);
+      const lockCandidate = dir === "." ? "gradle.lockfile" : `${dir}/gradle.lockfile`;
+      const lockFile = lockFiles.has(lockCandidate) ? lockCandidate : void 0;
+      manifests.push({ file, ecosystem: "maven", lockFile });
+    }
+  }
+  return manifests;
+}
+function parseMavenPackages(content, manifest, opts, lockContent) {
+  const base = path4.basename(manifest.file);
+  if (lockContent && manifest.lockFile) {
+    return parseGradleLock(lockContent, manifest.lockFile, opts);
+  }
+  if (base === "pom.xml") {
+    return parsePomXml(content, manifest.file, opts);
+  }
+  if (base === "build.gradle" || base === "build.gradle.kts") {
+    return parseBuildGradle(content, manifest.file, opts);
+  }
+  return [];
+}
+function parsePomXml(content, filePath, opts) {
+  const props = extractPomProperties(content);
+  const managedVersions = extractDependencyManagement(content, props);
+  const withoutMgmt = content.replace(/<dependencyManagement>[\s\S]*?<\/dependencyManagement>/gi, "");
+  const packages = [];
+  const depRegex = /<dependency>([\s\S]*?)<\/dependency>/gi;
+  for (const match of withoutMgmt.matchAll(depRegex)) {
+    const inner = match[1];
+    const groupId = /<groupId>\s*([^<\s]+)\s*<\/groupId>/i.exec(inner)?.[1];
+    const artifactId = /<artifactId>\s*([^<\s]+)\s*<\/artifactId>/i.exec(inner)?.[1];
+    if (!groupId || !artifactId) continue;
+    const rawVersion = /<version>\s*([^<\s]+)\s*<\/version>/i.exec(inner)?.[1];
+    const resolvedVersion = resolveProperty(rawVersion ?? null, props) ?? managedVersions.get(`${groupId}:${artifactId}`);
+    if (!resolvedVersion) continue;
+    const scope = /<scope>\s*([^<\s]+)\s*<\/scope>/i.exec(inner)?.[1] ?? "compile";
+    const isDev = scope === "test" || scope === "provided";
+    if (isDev && !opts.includeDev) continue;
+    packages.push({
+      name: `${groupId}:${artifactId}`,
+      version: resolvedVersion,
+      ecosystem: "maven",
+      source: filePath,
+      type: "direct",
+      scope: isDev ? "dev" : "production"
+    });
+  }
+  return packages;
+}
+function extractPomProperties(content) {
+  const props = /* @__PURE__ */ new Map();
+  const propsMatch = /<properties>([\s\S]*?)<\/properties>/i.exec(content);
+  if (!propsMatch) return props;
+  const propRegex = /<([a-zA-Z0-9._-]+)>\s*([^<]+)\s*<\/\1>/g;
+  for (const m of propsMatch[1].matchAll(propRegex)) {
+    props.set(m[1], m[2].trim());
+  }
+  return props;
+}
+function extractDependencyManagement(content, props) {
+  const versions = /* @__PURE__ */ new Map();
+  const mgmtMatch = /<dependencyManagement>([\s\S]*?)<\/dependencyManagement>/i.exec(content);
+  if (!mgmtMatch) return versions;
+  const depRegex = /<dependency>([\s\S]*?)<\/dependency>/gi;
+  for (const m of mgmtMatch[1].matchAll(depRegex)) {
+    const inner = m[1];
+    const groupId = /<groupId>\s*([^<\s]+)\s*<\/groupId>/i.exec(inner)?.[1];
+    const artifactId = /<artifactId>\s*([^<\s]+)\s*<\/artifactId>/i.exec(inner)?.[1];
+    const rawVersion = /<version>\s*([^<\s]+)\s*<\/version>/i.exec(inner)?.[1];
+    if (!groupId || !artifactId || !rawVersion) continue;
+    const resolved = resolveProperty(rawVersion, props);
+    if (resolved) versions.set(`${groupId}:${artifactId}`, resolved);
+  }
+  return versions;
+}
+function resolveProperty(value, props) {
+  if (!value) return null;
+  const resolved = value.replace(/\$\{([^}]+)\}/g, (_, key) => props.get(key) ?? `\${${key}}`);
+  return /\$\{[^}]+\}/.test(resolved) ? null : resolved;
+}
+var GRADLE_DEV_CONFIGS = /* @__PURE__ */ new Set(["testImplementation", "testCompileOnly", "testRuntimeOnly", "testApi"]);
+function parseBuildGradle(content, filePath, opts) {
+  const packages = [];
+  const seen = /* @__PURE__ */ new Set();
+  const stringNotation = /\b(\w+)\s*\(?\s*['"]([^:'"]+):([^:'"]+):([^'"]+)['"]\s*\)?/g;
+  for (const m of content.matchAll(stringNotation)) {
+    const config = m[1];
+    const groupId = m[2];
+    const artifactId = m[3];
+    const version = m[4].split("@")[0];
+    const isDev = GRADLE_DEV_CONFIGS.has(config);
+    if (isDev && !opts.includeDev) continue;
+    const name = `${groupId}:${artifactId}`;
+    const key = `${name}@${version}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    packages.push({
+      name,
+      version,
+      ecosystem: "maven",
+      source: filePath,
+      type: "direct",
+      scope: isDev ? "dev" : "production"
+    });
+  }
+  const mapNotation = /\b(\w+)\s+group:\s*['"]([^'"]+)['"]\s*,\s*name:\s*['"]([^'"]+)['"]\s*,\s*version:\s*['"]([^'"]+)['"]/g;
+  for (const m of content.matchAll(mapNotation)) {
+    const config = m[1];
+    const groupId = m[2];
+    const artifactId = m[3];
+    const version = m[4];
+    const isDev = GRADLE_DEV_CONFIGS.has(config);
+    if (isDev && !opts.includeDev) continue;
+    const name = `${groupId}:${artifactId}`;
+    const key = `${name}@${version}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    packages.push({
+      name,
+      version,
+      ecosystem: "maven",
+      source: filePath,
+      type: "direct",
+      scope: isDev ? "dev" : "production"
+    });
+  }
+  return packages;
+}
+function parseGradleLock(content, filePath, opts) {
+  const packages = [];
+  const seen = /* @__PURE__ */ new Set();
+  const lineRegex = /^([^:#\s]+):([^:#\s]+):([^=\s]+)=(.+)$/gm;
+  for (const m of content.matchAll(lineRegex)) {
+    const groupId = m[1];
+    const artifactId = m[2];
+    const version = m[3];
+    const configs = m[4].split(",").map((s) => s.trim());
+    const isDev = configs.every((c) => GRADLE_DEV_CONFIGS.has(c));
+    if (isDev && !opts.includeDev) continue;
+    const name = `${groupId}:${artifactId}`;
+    const key = `${name}@${version}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    packages.push({
+      name,
+      version,
+      ecosystem: "maven",
+      source: filePath,
+      type: "direct",
+      scope: isDev ? "dev" : "production"
+    });
+  }
+  return packages;
+}
+
+// src/services/deps/parsers/index.ts
+function getRepoFiles(repoRoot) {
+  try {
+    const out = execSync4("git ls-files --cached --others --exclude-standard", {
+      encoding: "utf8",
+      cwd: repoRoot,
+      maxBuffer: 10 * 1024 * 1024
+    });
+    return out.trim().split("\n").filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+function readFile(repoRoot, relPath) {
+  try {
+    return fs4.readFileSync(path5.join(repoRoot, relPath), "utf8");
+  } catch {
+    return null;
+  }
+}
+function readFileAtRef(repoRoot, ref, relPath) {
+  try {
+    return execFileSync2("git", ["show", `${ref}:${relPath}`], {
+      encoding: "utf8",
+      cwd: repoRoot,
+      stdio: ["pipe", "pipe", "pipe"],
+      maxBuffer: 10 * 1024 * 1024
+    });
+  } catch {
+    return null;
+  }
+}
+function findPropsContent(manifestFile, readFn) {
+  let dir = path5.dirname(manifestFile);
+  for (let depth = 0; depth < 10; depth++) {
+    const candidate = dir === "." ? "Directory.Packages.props" : `${dir}/Directory.Packages.props`;
+    const content = readFn(candidate);
+    if (content) return content;
+    if (dir === ".") break;
+    dir = path5.dirname(dir);
+  }
+  return null;
+}
+function parseManifests(manifests, opts, readFn) {
+  const allPackages = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const manifest of manifests) {
+    const content = readFn(manifest.file);
+    if (!content) continue;
+    const lockContent = manifest.lockFile ? readFn(manifest.lockFile) ?? void 0 : void 0;
+    let pkgs = [];
+    if (manifest.ecosystem === "npm") {
+      pkgs = parseNpmPackages(content, manifest, opts, lockContent);
+    } else if (manifest.ecosystem === "nuget") {
+      const propsContent = findPropsContent(manifest.file, readFn) ?? void 0;
+      pkgs = parseNugetPackages(content, manifest, opts, lockContent, propsContent);
+    } else if (manifest.ecosystem === "maven") {
+      pkgs = parseMavenPackages(content, manifest, opts, lockContent);
+    }
+    for (const pkg2 of pkgs) {
+      const key = `${pkg2.ecosystem}:${pkg2.name}@${pkg2.version}:${pkg2.source}`;
+      if (!seen.has(key)) {
+        seen.add(key);
+        allPackages.push(pkg2);
+      }
+    }
+  }
+  return allPackages;
+}
+function scanRepo(repoRoot, opts = {}) {
+  const files = getRepoFiles(repoRoot);
+  const eco = opts.ecosystem ?? "all";
+  const npmManifests = eco === "all" || eco === "npm" ? findNpmManifests(files) : [];
+  const nugetManifests = eco === "all" || eco === "nuget" ? findNugetManifests(files) : [];
+  const mavenManifests = eco === "all" || eco === "maven" ? findMavenManifests(files) : [];
+  const manifests = [...npmManifests, ...nugetManifests, ...mavenManifests];
+  const packages = parseManifests(manifests, opts, (rel) => readFile(repoRoot, rel));
+  return buildScanData(manifests, packages);
+}
+function scanRepoAtRef(repoRoot, ref, opts = {}) {
+  const eco = opts.ecosystem ?? "all";
+  let files = [];
+  try {
+    const out = execFileSync2("git", ["ls-tree", "-r", "--name-only", ref], {
+      encoding: "utf8",
+      cwd: repoRoot,
+      stdio: ["pipe", "pipe", "pipe"],
+      maxBuffer: 10 * 1024 * 1024
+    });
+    files = out.trim().split("\n").filter(Boolean);
+  } catch {
+    return buildScanData([], []);
+  }
+  const npmManifests = eco === "all" || eco === "npm" ? findNpmManifests(files) : [];
+  const nugetManifests = eco === "all" || eco === "nuget" ? findNugetManifests(files) : [];
+  const mavenManifests = eco === "all" || eco === "maven" ? findMavenManifests(files) : [];
+  const manifests = [...npmManifests, ...nugetManifests, ...mavenManifests];
+  const packages = parseManifests(manifests, opts, (rel) => readFileAtRef(repoRoot, ref, rel));
+  return buildScanData(manifests, packages);
+}
+function buildScanData(manifests, packages) {
+  const ecosystemSet = new Set(manifests.map((m) => m.ecosystem));
+  const byEcosystem = {};
+  const byType = { direct: 0, transitive: 0 };
+  const byScope = { production: 0, dev: 0 };
+  for (const pkg2 of packages) {
+    byEcosystem[pkg2.ecosystem] = (byEcosystem[pkg2.ecosystem] ?? 0) + 1;
+    byType[pkg2.type] = (byType[pkg2.type] ?? 0) + 1;
+    byScope[pkg2.scope] = (byScope[pkg2.scope] ?? 0) + 1;
+  }
+  return {
+    ecosystems: Array.from(ecosystemSet),
+    manifests,
+    packages,
+    summary: {
+      totalPackages: packages.length,
+      byEcosystem,
+      byType,
+      byScope
+    }
+  };
+}
+
+// src/services/deps/scan.ts
+function runScan(config, opts) {
+  void config;
+  const repoRoot = getRepoRoot2();
+  if (!repoRoot) {
+    throw new PncliError("Not inside a git repository. deps commands require a git repo root.", 1);
+  }
+  return scanRepo(repoRoot, opts);
+}
+
+// src/services/deps/semver.ts
+function parse(v) {
+  const clean = v.replace(/^[^0-9]*/, "");
+  const dashIdx = clean.indexOf("-");
+  const plusIdx = clean.indexOf("+");
+  const metaStart = plusIdx > -1 ? plusIdx : Infinity;
+  const preStart = dashIdx > -1 && dashIdx < metaStart ? dashIdx : Infinity;
+  const numeric = clean.slice(0, Math.min(preStart, metaStart));
+  const preRelease = preStart < Infinity ? clean.slice(preStart + 1, metaStart < Infinity ? metaStart : void 0) : "";
+  const parts = numeric.split(".").map((n) => parseInt(n, 10) || 0);
+  return { major: parts[0] ?? 0, minor: parts[1] ?? 0, patch: parts[2] ?? 0, preRelease };
+}
+function compareSemver(a, b) {
+  const av = parse(a);
+  const bv = parse(b);
+  if (av.major !== bv.major) return av.major - bv.major;
+  if (av.minor !== bv.minor) return av.minor - bv.minor;
+  if (av.patch !== bv.patch) return av.patch - bv.patch;
+  if (!av.preRelease && bv.preRelease) return 1;
+  if (av.preRelease && !bv.preRelease) return -1;
+  if (av.preRelease && bv.preRelease) return av.preRelease.localeCompare(bv.preRelease);
+  return 0;
+}
+function isNewer(current, latest) {
+  return compareSemver(latest, current) > 0;
+}
+function updateType(current, latest) {
+  const cv = parse(current);
+  const lv = parse(latest);
+  if (lv.major > cv.major) return "major";
+  if (lv.minor > cv.minor) return "minor";
+  return "patch";
+}
+function isDowngrade(from, to) {
+  return compareSemver(to, from) < 0;
+}
+
+// src/services/deps/diff.ts
+function runDiff(config, from, to, opts) {
+  void config;
+  const repoRoot = getRepoRoot2();
+  if (!repoRoot) {
+    throw new PncliError("Not inside a git repository.", 1);
+  }
+  const fromScan = scanRepoAtRef(repoRoot, from, opts);
+  const toScan = to ? scanRepoAtRef(repoRoot, to, opts) : scanRepo(repoRoot, opts);
+  const fromMap = /* @__PURE__ */ new Map();
+  const toMap = /* @__PURE__ */ new Map();
+  for (const pkg2 of fromScan.packages) {
+    const key = `${pkg2.ecosystem}:${pkg2.name}:${pkg2.source}`;
+    fromMap.set(key, pkg2.version);
+  }
+  for (const pkg2 of toScan.packages) {
+    const key = `${pkg2.ecosystem}:${pkg2.name}:${pkg2.source}`;
+    toMap.set(key, pkg2.version);
+  }
+  const changes = [];
+  const allKeys = /* @__PURE__ */ new Set([...fromMap.keys(), ...toMap.keys()]);
+  for (const key of allKeys) {
+    const parts = key.split(":");
+    const eco = parts[0];
+    const source = parts[parts.length - 1] ?? "";
+    const name = parts.slice(1, -1).join(":");
+    const fromVer = fromMap.get(key) ?? null;
+    const toVer = toMap.get(key) ?? null;
+    let change;
+    if (!fromVer) {
+      change = "added";
+    } else if (!toVer) {
+      change = "removed";
+    } else if (fromVer === toVer) {
+      continue;
+    } else {
+      change = isDowngrade(fromVer, toVer) ? "downgraded" : "upgraded";
+    }
+    changes.push({ name, ecosystem: eco, change, from: fromVer, to: toVer, source });
+  }
+  const summary = { added: 0, removed: 0, upgraded: 0, downgraded: 0, unchanged: 0 };
+  for (const c of changes) summary[c.change]++;
+  summary.unchanged = [...allKeys].filter((k) => {
+    const fv = fromMap.get(k);
+    const tv = toMap.get(k);
+    return fv !== void 0 && tv !== void 0 && fv === tv;
+  }).length;
+  return { from, to: to ?? "working tree", changes, summary };
+}
+
+// src/services/deps/clients/osv.ts
+var OSV_URL = "https://api.osv.dev";
+var BATCH_SIZE = 500;
+var TIMEOUT_MS = 3e4;
+var OSV_ECOSYSTEM = {
+  npm: "npm",
+  nuget: "NuGet",
+  maven: "Maven"
+};
+async function fetchWithTimeout2(url, init) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
+  try {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function checkOsvConnectivity() {
+  try {
+    const res = await fetchWithTimeout2(`${OSV_URL}/v1/querybatch`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ queries: [] })
+    });
+    return { reachable: res.ok || res.status === 400 };
+  } catch (err) {
+    return {
+      reachable: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+function extractRemediation(vuln, pkg2) {
+  const fixedVersions = [];
+  for (const affected of vuln.affected ?? []) {
+    for (const range of affected.ranges ?? []) {
+      if (range.type === "SEMVER" || range.type === "ECOSYSTEM") {
+        for (const event of range.events ?? []) {
+          if (event.fixed) fixedVersions.push(event.fixed);
+        }
+      }
+    }
+  }
+  const unique = [...new Set(fixedVersions)];
+  const fixAvailable = unique.length > 0;
+  const advice = fixAvailable ? `Upgrade ${pkg2.name} to ${unique.join(" or ")}` : `No fix available yet for ${pkg2.name}. Monitor ${vuln.id} for updates.`;
+  return { fixAvailable, fixedVersions: unique, advice };
+}
+function extractSeverity(vuln) {
+  const dbSpecific = vuln.database_specific ?? {};
+  const dbSeverity = typeof dbSpecific["severity"] === "string" ? dbSpecific["severity"] : void 0;
+  let cvss = null;
+  const rawCvss = dbSpecific["cvss"];
+  if (typeof rawCvss === "number") {
+    cvss = rawCvss;
+  } else if (rawCvss && typeof rawCvss === "object" && "score" in rawCvss) {
+    const score = rawCvss["score"];
+    if (typeof score === "number") cvss = score;
+  }
+  for (const s of vuln.severity ?? []) {
+    const score = parseFloat(s.score);
+    if (!isNaN(score) && score >= 0 && score <= 10) {
+      cvss = score;
+      break;
+    }
+  }
+  return {
+    severity: dbSeverity ?? inferSeverityFromCvss(cvss),
+    cvss
+  };
+}
+function inferSeverityFromCvss(cvss) {
+  if (cvss === null) return "UNKNOWN";
+  if (cvss >= 9) return "CRITICAL";
+  if (cvss >= 7) return "HIGH";
+  if (cvss >= 4) return "MEDIUM";
+  return "LOW";
+}
+function mapVuln(vuln, pkg2) {
+  const { severity, cvss } = extractSeverity(vuln);
+  return {
+    id: vuln.id,
+    summary: vuln.summary ?? "",
+    severity,
+    cvss,
+    aliases: vuln.aliases ?? [],
+    remediation: extractRemediation(vuln, pkg2),
+    references: (vuln.references ?? []).map((r) => r.url ?? "").filter(Boolean)
+  };
+}
+async function queryBatch(queries, packages) {
+  const res = await fetchWithTimeout2(`${OSV_URL}/v1/querybatch`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ queries })
+  });
+  if (!res.ok) {
+    throw new Error(`OSV.dev returned HTTP ${res.status}`);
+  }
+  const data = await res.json();
+  const vulnerable = [];
+  for (let i = 0; i < data.results.length; i++) {
+    const result = data.results[i];
+    const pkg2 = packages[i];
+    if (!result || !pkg2) continue;
+    const vulns = result.vulns ?? [];
+    if (vulns.length === 0) continue;
+    vulnerable.push({
+      ...pkg2,
+      vulnerabilities: vulns.map((v) => mapVuln(v, pkg2))
+    });
+  }
+  return vulnerable;
+}
+async function checkPackagesForVulns(packages) {
+  const allVulnerable = [];
+  for (let i = 0; i < packages.length; i += BATCH_SIZE) {
+    const chunk = packages.slice(i, i + BATCH_SIZE);
+    const queries = chunk.map((pkg2) => ({
+      package: {
+        name: pkg2.name,
+        ecosystem: OSV_ECOSYSTEM[pkg2.ecosystem] ?? pkg2.ecosystem
+      },
+      version: pkg2.version
+    }));
+    const results = await queryBatch(queries, chunk);
+    allVulnerable.push(...results);
+  }
+  return allVulnerable;
+}
+
+// src/services/deps/clients/artifactory.ts
+var TIMEOUT_MS2 = 15e3;
+async function fetchWithTimeout3(url, token) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS2);
+  try {
+    return await fetch(url, {
+      headers: { Authorization: `Bearer ${token}` },
+      signal: controller.signal
+    });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function checkArtifactoryConnectivity(config) {
+  if (!config.baseUrl && !config.token) {
+    return {
+      reachable: false,
+      authenticated: false,
+      configured: false,
+      error: "Artifactory is not configured"
+    };
+  }
+  if (!config.baseUrl) {
+    return {
+      reachable: false,
+      authenticated: false,
+      configured: false,
+      error: "Artifactory baseUrl is not set"
+    };
+  }
+  if (!config.token) {
+    return {
+      reachable: false,
+      authenticated: false,
+      configured: false,
+      error: "Artifactory token is not set"
+    };
+  }
+  try {
+    const res = await fetchWithTimeout3(`${config.baseUrl}/api/system/ping`, config.token);
+    if (res.status === 401 || res.status === 403) {
+      return {
+        reachable: true,
+        authenticated: false,
+        configured: true,
+        error: "Artifactory token is invalid or lacks permissions"
+      };
+    }
+    return { reachable: res.ok, authenticated: res.ok, configured: true };
+  } catch (err) {
+    return {
+      reachable: false,
+      authenticated: false,
+      configured: true,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+function requireArtifactory(config, command) {
+  if (!config.baseUrl && !config.token) {
+    throw new PncliError(
+      `${command} requires Artifactory. Add the following to ~/.pncli/config.json:
+  "artifactory": { "baseUrl": "https://artifactory.company.com", "token": "your-token" }
+Or set PNCLI_ARTIFACTORY_BASE_URL and PNCLI_ARTIFACTORY_TOKEN environment variables.`,
+      503
+    );
+  }
+  if (!config.baseUrl) {
+    throw new PncliError(
+      `${command} requires an Artifactory URL. Set artifactory.baseUrl in ~/.pncli/config.json or PNCLI_ARTIFACTORY_BASE_URL.`,
+      503
+    );
+  }
+  if (!config.token) {
+    throw new PncliError(
+      `${command} requires an Artifactory token. Set artifactory.token in ~/.pncli/config.json or PNCLI_ARTIFACTORY_TOKEN.`,
+      503
+    );
+  }
+}
+function repoForEcosystem(config, eco) {
+  if (eco === "npm") return config.npmRepo;
+  if (eco === "nuget") return config.nugetRepo;
+  if (eco === "maven") return config.mavenRepo;
+  return void 0;
+}
+async function getLatestNpm(baseUrl, token, repoName, packageName) {
+  try {
+    const encoded = packageName.startsWith("@") ? packageName.replace("/", "%2F") : packageName;
+    const res = await fetchWithTimeout3(`${baseUrl}/api/npm/${repoName}/${encoded}`, token);
+    if (!res.ok) return null;
+    const data = await res.json();
+    return data["dist-tags"]?.latest ?? null;
+  } catch {
+    return null;
+  }
+}
+async function getLatestNuget(baseUrl, token, repoName, packageName) {
+  try {
+    const lower = packageName.toLowerCase();
+    const res = await fetchWithTimeout3(
+      `${baseUrl}/api/nuget/v3/${repoName}/flatcontainer/${lower}/index.json`,
+      token
+    );
+    if (!res.ok) return null;
+    const data = await res.json();
+    const versions = data.versions ?? [];
+    return versions[versions.length - 1] ?? null;
+  } catch {
+    return null;
+  }
+}
+async function getLatestMaven(baseUrl, token, repoName, packageName) {
+  const [groupId, artifactId] = packageName.split(":");
+  if (!groupId || !artifactId) return null;
+  try {
+    const res = await fetchWithTimeout3(
+      `${baseUrl}/api/search/latestVersion?g=${encodeURIComponent(groupId)}&a=${encodeURIComponent(artifactId)}&repos=${repoName}`,
+      token
+    );
+    if (!res.ok) return null;
+    const text = await res.text();
+    return text.trim() || null;
+  } catch {
+    return null;
+  }
+}
+async function getOutdatedPackages(packages, config, filterType) {
+  const { baseUrl, token } = config;
+  if (!baseUrl || !token) return { outdated: [], uncheckedEcosystems: [] };
+  const outdated = [];
+  const unchecked = /* @__PURE__ */ new Set();
+  for (const pkg2 of packages) {
+    const repoName = repoForEcosystem(config, pkg2.ecosystem);
+    if (!repoName) {
+      unchecked.add(pkg2.ecosystem);
+      continue;
+    }
+    let latest = null;
+    if (pkg2.ecosystem === "npm") {
+      latest = await getLatestNpm(baseUrl, token, repoName, pkg2.name);
+    } else if (pkg2.ecosystem === "nuget") {
+      latest = await getLatestNuget(baseUrl, token, repoName, pkg2.name);
+    } else if (pkg2.ecosystem === "maven") {
+      latest = await getLatestMaven(baseUrl, token, repoName, pkg2.name);
+    }
+    if (!latest || !isNewer(pkg2.version, latest)) continue;
+    const type = updateType(pkg2.version, latest);
+    if (filterType) {
+      const order = { major: 3, minor: 2, patch: 1 };
+      if (order[type] < order[filterType]) continue;
+    }
+    outdated.push({
+      name: pkg2.name,
+      ecosystem: pkg2.ecosystem,
+      current: pkg2.version,
+      latest,
+      updateType: type,
+      source: pkg2.source
+    });
+  }
+  return { outdated, uncheckedEcosystems: [...unchecked] };
+}
+async function getLicenseNpm(baseUrl, token, repoName, packageName) {
+  try {
+    const encoded = packageName.startsWith("@") ? packageName.replace("/", "%2F") : packageName;
+    const res = await fetchWithTimeout3(`${baseUrl}/api/npm/${repoName}/${encoded}`, token);
+    if (!res.ok) return null;
+    const data = await res.json();
+    if (typeof data.license === "string") return data.license;
+    if (typeof data.license === "object" && data.license !== null) return data.license.type ?? null;
+    return null;
+  } catch {
+    return null;
+  }
+}
+async function getLicenseNuget(baseUrl, token, repoName, packageName, version) {
+  try {
+    const lower = packageName.toLowerCase();
+    const res = await fetchWithTimeout3(
+      `${baseUrl}/api/nuget/v3/${repoName}/registration/${lower}/${version}.json`,
+      token
+    );
+    if (!res.ok) return null;
+    const data = await res.json();
+    return data.licenseExpression ?? (data.licenseUrl ? "See licenseUrl" : null);
+  } catch {
+    return null;
+  }
+}
+async function getLicensedPackages(packages, config) {
+  const { baseUrl, token } = config;
+  if (!baseUrl || !token) return [];
+  const result = [];
+  for (const pkg2 of packages) {
+    const repoName = repoForEcosystem(config, pkg2.ecosystem);
+    let license = null;
+    if (repoName) {
+      if (pkg2.ecosystem === "npm") {
+        license = await getLicenseNpm(baseUrl, token, repoName, pkg2.name);
+      } else if (pkg2.ecosystem === "nuget") {
+        license = await getLicenseNuget(baseUrl, token, repoName, pkg2.name, pkg2.version);
+      }
+    }
+    result.push({
+      name: pkg2.name,
+      version: pkg2.version,
+      ecosystem: pkg2.ecosystem,
+      source: pkg2.source,
+      license
+    });
+  }
+  return result;
+}
+
+// src/services/deps/connectivity.ts
+var cachedTier = null;
+async function detectTier(config) {
+  if (cachedTier) return cachedTier;
+  const [osvResult, artResult] = await Promise.all([
+    checkOsvConnectivity(),
+    checkArtifactoryConnectivity(config.artifactory)
+  ]);
+  const artifactoryReachable = artResult.reachable && artResult.authenticated;
+  const osvReachable = osvResult.reachable;
+  let tier = "local";
+  if (artifactoryReachable) tier = "artifactory";
+  if (osvReachable) tier = "full";
+  cachedTier = { tier, osvReachable, artifactoryReachable };
+  return cachedTier;
+}
+async function buildConnectivityData(config) {
+  const [osvResult, artResult] = await Promise.all([
+    checkOsvConnectivity(),
+    checkArtifactoryConnectivity(config.artifactory)
+  ]);
+  const artCfg = config.artifactory;
+  let tier = "local";
+  if (artResult.reachable && artResult.authenticated) tier = "artifactory";
+  if (osvResult.reachable) tier = "full";
+  cachedTier = {
+    tier,
+    osvReachable: osvResult.reachable,
+    artifactoryReachable: artResult.reachable && artResult.authenticated
+  };
+  return {
+    artifactory: {
+      reachable: artResult.reachable,
+      url: artCfg.baseUrl ?? "(not configured)",
+      authenticated: artResult.authenticated,
+      repositories: {
+        npm: artCfg.npmRepo ?? "(not configured)",
+        nuget: artCfg.nugetRepo ?? "(not configured)",
+        maven: artCfg.mavenRepo ?? "(not configured)"
+      },
+      ...artResult.error ? { error: artResult.error } : {}
+    },
+    osv: {
+      reachable: osvResult.reachable,
+      url: "https://api.osv.dev",
+      ...osvResult.error ? { error: osvResult.error } : {}
+    },
+    tier,
+    capabilities: {
+      scan: true,
+      diff: true,
+      outdated: artResult.reachable && artResult.authenticated,
+      licenseCheck: artResult.reachable && artResult.authenticated,
+      cveCheck: osvResult.reachable
+    }
+  };
+}
+
+// src/services/deps/frisk.ts
+async function runFrisk(config, opts) {
+  const repoRoot = getRepoRoot2();
+  if (!repoRoot) {
+    throw new PncliError("Not inside a git repository.", 1);
+  }
+  const { tier, osvReachable } = await detectTier(config);
+  if (!osvReachable) {
+    throw new PncliError(
+      "deps frisk requires OSV.dev access but api.osv.dev is not reachable from this machine. Run 'pncli deps connectivity' to diagnose.",
+      503
+    );
+  }
+  const scanOpts = {
+    ...opts,
+    includeTransitive: opts.includeTransitive ?? true
+  };
+  const scan = scanRepo(repoRoot, scanOpts);
+  if (scan.packages.length === 0) {
+    return { tier, scanned: 0, vulnerable: 0, packages: [] };
+  }
+  const vulnerable = await checkPackagesForVulns(scan.packages);
+  return {
+    tier,
+    scanned: scan.packages.length,
+    vulnerable: vulnerable.length,
+    packages: vulnerable
+  };
+}
+
+// src/services/deps/outdated.ts
+async function runOutdated(config, opts, filterType) {
+  const repoRoot = getRepoRoot2();
+  if (!repoRoot) {
+    throw new PncliError("Not inside a git repository.", 1);
+  }
+  requireArtifactory(config.artifactory, "deps outdated");
+  const { artifactoryReachable } = await detectTier(config);
+  if (!artifactoryReachable) {
+    throw new PncliError(
+      `Artifactory at ${config.artifactory.baseUrl} is not reachable or authentication failed. Run 'pncli deps connectivity' to diagnose.`,
+      503
+    );
+  }
+  const scan = scanRepo(repoRoot, { ...opts, includeTransitive: false });
+  const directPackages = scan.packages.filter((p) => p.type === "direct");
+  const { outdated, uncheckedEcosystems } = await getOutdatedPackages(
+    directPackages,
+    config.artifactory,
+    filterType
+  );
+  const summary = { total: outdated.length, major: 0, minor: 0, patch: 0 };
+  for (const pkg2 of outdated) summary[pkg2.updateType]++;
+  return {
+    source: "artifactory",
+    artifactoryUrl: config.artifactory.baseUrl ?? "",
+    outdated,
+    uncheckedEcosystems,
+    summary
+  };
+}
+
+// src/services/deps/license-check.ts
+async function runLicenseCheck(config, opts) {
+  const repoRoot = getRepoRoot2();
+  if (!repoRoot) {
+    throw new PncliError("Not inside a git repository.", 1);
+  }
+  requireArtifactory(config.artifactory, "deps license-check");
+  const { artifactoryReachable } = await detectTier(config);
+  if (!artifactoryReachable) {
+    throw new PncliError(
+      `Artifactory at ${config.artifactory.baseUrl} is not reachable or authentication failed. Run 'pncli deps connectivity' to diagnose.`,
+      503
+    );
+  }
+  const scan = scanRepo(repoRoot, { ...opts, includeTransitive: false });
+  const directPackages = scan.packages.filter((p) => p.type === "direct");
+  const licensed = await getLicensedPackages(directPackages, config.artifactory);
+  const byLicense = {};
+  let unknown = 0;
+  for (const pkg2 of licensed) {
+    if (!pkg2.license) {
+      unknown++;
+    } else {
+      byLicense[pkg2.license] = (byLicense[pkg2.license] ?? 0) + 1;
+    }
+  }
+  return {
+    source: "artifactory",
+    artifactoryUrl: config.artifactory.baseUrl ?? "",
+    packages: licensed,
+    summary: {
+      total: licensed.length,
+      byLicense,
+      unknown
+    }
+  };
+}
+
+// src/services/deps/commands.ts
+function registerDepsCommands(program2) {
+  const deps = program2.command("deps").description("Dependency scanning, CVE detection, and license auditing");
+  deps.command("frisk").description("Scan all dependencies for CVEs and output remediation paths (requires OSV.dev)").option("--ecosystem <ecosystem>", "Filter to one ecosystem: npm, nuget, maven, all", "all").option("--direct-only", "Only scan direct dependencies (default: include transitive)", false).option("--include-dev", "Include dev/test dependencies", false).action(async (opts, cmd) => {
+    const startTime = Date.now();
+    try {
+      const globalOpts = cmd.optsWithGlobals();
+      const config = loadConfig({ configPath: globalOpts.config });
+      const scanOpts = {
+        ecosystem: opts.ecosystem,
+        includeTransitive: !opts.directOnly,
+        includeDev: opts.includeDev
+      };
+      const data = await runFrisk(config, scanOpts);
+      success(data, "deps", "frisk", startTime);
+    } catch (err) {
+      fail(err, "deps", "frisk", startTime);
+    }
+  });
+  deps.command("scan").description("Inventory all dependencies from manifest files (local only, no network)").option("--ecosystem <ecosystem>", "Filter to one ecosystem: npm, nuget, maven, all", "all").option("--include-transitive", "Include transitive dependencies", false).option("--include-dev", "Include dev/test dependencies", false).action((opts, cmd) => {
+    const startTime = Date.now();
+    try {
+      const globalOpts = cmd.optsWithGlobals();
+      const config = loadConfig({ configPath: globalOpts.config });
+      const scanOpts = {
+        ecosystem: opts.ecosystem,
+        includeTransitive: opts.includeTransitive,
+        includeDev: opts.includeDev
+      };
+      const data = runScan(config, scanOpts);
+      success(data, "deps", "scan", startTime);
+    } catch (err) {
+      fail(err, "deps", "scan", startTime);
+    }
+  });
+  deps.command("diff").description("Show dependency changes between two git refs (local only, no network)").requiredOption("--from <ref>", "Base git ref (commit, tag, or branch)").option("--to <ref>", "Target git ref (default: working tree)").option("--ecosystem <ecosystem>", "Filter to one ecosystem: npm, nuget, maven, all", "all").option("--include-dev", "Include dev/test dependencies", false).action((opts, cmd) => {
+    const startTime = Date.now();
+    try {
+      const globalOpts = cmd.optsWithGlobals();
+      const config = loadConfig({ configPath: globalOpts.config });
+      const scanOpts = {
+        ecosystem: opts.ecosystem,
+        includeTransitive: true,
+        includeDev: opts.includeDev
+      };
+      const data = runDiff(config, opts.from, opts.to ?? null, scanOpts);
+      success(data, "deps", "diff", startTime);
+    } catch (err) {
+      fail(err, "deps", "diff", startTime);
+    }
+  });
+  deps.command("outdated").description("Check for newer versions available in Artifactory (requires Artifactory)").option("--ecosystem <ecosystem>", "Filter to one ecosystem: npm, nuget, maven, all", "all").option("--major", "Only show major version bumps").option("--minor", "Only show minor version bumps or higher").option("--patch", "Only show patch version bumps or higher").action(async (opts, cmd) => {
+    const startTime = Date.now();
+    try {
+      const globalOpts = cmd.optsWithGlobals();
+      const config = loadConfig({ configPath: globalOpts.config });
+      const scanOpts = { ecosystem: opts.ecosystem };
+      const filterType = opts.major ? "major" : opts.minor ? "minor" : opts.patch ? "patch" : void 0;
+      const data = await runOutdated(config, scanOpts, filterType);
+      success(data, "deps", "outdated", startTime);
+    } catch (err) {
+      fail(err, "deps", "outdated", startTime);
+    }
+  });
+  deps.command("license-check").description("Report licenses for all direct dependencies via Artifactory (requires Artifactory)").option("--ecosystem <ecosystem>", "Filter to one ecosystem: npm, nuget, maven, all", "all").option("--include-dev", "Include dev/test dependencies", false).action(async (opts, cmd) => {
+    const startTime = Date.now();
+    try {
+      const globalOpts = cmd.optsWithGlobals();
+      const config = loadConfig({ configPath: globalOpts.config });
+      const scanOpts = {
+        ecosystem: opts.ecosystem,
+        includeDev: opts.includeDev
+      };
+      const data = await runLicenseCheck(config, scanOpts);
+      success(data, "deps", "license-check", startTime);
+    } catch (err) {
+      fail(err, "deps", "license-check", startTime);
+    }
+  });
+  deps.command("connectivity").description("Test network access to Artifactory and OSV.dev, report available tier").action(async (_opts, cmd) => {
+    const startTime = Date.now();
+    try {
+      const globalOpts = cmd.optsWithGlobals();
+      const config = loadConfig({ configPath: globalOpts.config });
+      const data = await buildConnectivityData(config);
+      success(data, "deps", "connectivity", startTime);
+    } catch (err) {
+      fail(err, "deps", "connectivity", startTime);
+    }
+  });
+}
+
+// src/services/config/commands.ts
+import { input, password, confirm } from "@inquirer/prompts";
+import fs5 from "fs";
+function registerConfigCommands(program2) {
+  const config = program2.command("config").description("Manage pncli configuration");
+  config.command("init").description("Interactive setup wizard").option("--repo", "Write repo config (.pncli.json) instead of global config").action(async (opts) => {
+    const start = Date.now();
+    try {
+      if (opts.repo) {
+        await initRepoConfig(start);
+      } else {
+        await initGlobalConfig(start);
+      }
+    } catch (err) {
+      if (err instanceof Error && err.message.includes("User force closed")) {
+        process.stderr.write("\nSetup cancelled.\n");
+        process.exitCode = ExitCode.GENERAL_ERROR;
+        return;
+      }
+      fail(err, "config", "init", start);
+    }
+  });
+  config.command("show").description("Print fully resolved config (PATs masked)").action(() => {
+    const start = Date.now();
+    try {
+      const resolved = loadConfig();
+      success(maskConfig(resolved), "config", "show", start);
+    } catch (err) {
+      fail(err, "config", "show", start);
+    }
+  });
+  config.command("set").description("Set a config value by dot-notation key (e.g. jira.baseUrl https://...)").argument("<key>", "Config key in dot notation").argument("<value>", "Value to set").action((key, value) => {
+    const start = Date.now();
+    try {
+      const opts = program2.optsWithGlobals();
+      setConfigValue(key, value, opts.config);
+      success({ key, value }, "config", "set", start);
+    } catch (err) {
+      fail(err, "config", "set", start);
+    }
+  });
+  config.command("test").description("Test connectivity to configured services").action(async () => {
+    const start = Date.now();
+    try {
+      const opts = program2.optsWithGlobals();
+      const cfg = loadConfig({ configPath: opts.config });
+      const http = createHttpClient(cfg);
+      const results = {};
+      if (cfg.jira.baseUrl) {
+        try {
+          await http.jira("/rest/api/2/myself");
+          results.jira = { ok: true, message: "connected" };
+        } catch (err) {
+          results.jira = { ok: false, message: err instanceof Error ? err.message : String(err) };
+        }
+      } else {
+        results.jira = { ok: null, message: "not configured" };
+      }
+      if (cfg.bitbucket.baseUrl) {
+        try {
+          await http.bitbucket("/rest/api/1.0/application-properties");
+          results.bitbucket = { ok: true, message: "connected" };
+        } catch (err) {
+          results.bitbucket = { ok: false, message: err instanceof Error ? err.message : String(err) };
+        }
+      } else {
+        results.bitbucket = { ok: null, message: "not configured" };
+      }
+      if (cfg.confluence.baseUrl) {
+        try {
+          await http.confluence("/rest/api/space", { params: { limit: 1 } });
+          results.confluence = { ok: true, message: "connected" };
+        } catch (err) {
+          results.confluence = { ok: false, message: err instanceof Error ? err.message : String(err) };
+        }
+      } else {
+        results.confluence = { ok: null, message: "not configured" };
+      }
+      if (cfg.sonar.baseUrl) {
+        try {
+          await http.sonar("/api/system/status");
+          results.sonar = { ok: true, message: "connected" };
+        } catch (err) {
+          results.sonar = { ok: false, message: err instanceof Error ? err.message : String(err) };
+        }
+      } else {
+        results.sonar = { ok: null, message: "not configured" };
+      }
+      if (cfg.sde.baseUrl) {
+        try {
+          await http.sde("/api/v2/users/me/");
+          results.sde = { ok: true, message: "connected" };
+        } catch (err) {
+          results.sde = { ok: false, message: err instanceof Error ? err.message : String(err) };
+        }
+      } else {
+        results.sde = { ok: null, message: "not configured" };
+      }
+      success(results, "config", "test", start);
+    } catch (err) {
+      fail(err, "config", "test", start);
+    }
+  });
+}
+async function initGlobalConfig(start) {
+  process.stderr.write("pncli config init \u2014 Global configuration\n\n");
+  process.stderr.write("\u2500\u2500 Identity \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+  const userEmail = await input({
+    message: "Your email address (used across Jira, Bitbucket, etc.):",
+    default: ""
+  });
+  const userId = await input({
+    message: "Your username / user ID:",
+    default: ""
+  });
+  process.stderr.write("\n\u2500\u2500 Jira \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+  const jiraBaseUrl = await input({
+    message: "Jira base URL (e.g. https://jira.your-company.com):",
+    default: ""
+  });
+  const jiraApiToken = await password({
+    message: "Jira personal access token:"
+  });
+  process.stderr.write("\n\u2500\u2500 Bitbucket \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+  const bitbucketBaseUrl = await input({
+    message: "Bitbucket Server base URL (e.g. https://bitbucket.your-company.com):",
+    default: ""
   });
   const bitbucketPat = await password({
     message: "Bitbucket personal access token:"
   });
+  process.stderr.write("\n\u2500\u2500 Confluence \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+  const confluenceBaseUrl = await input({
+    message: "Confluence base URL (e.g. https://confluence.your-company.com):",
+    default: ""
+  });
+  const confluenceApiToken = await password({
+    message: "Confluence personal access token:"
+  });
+  process.stderr.write("\n\u2500\u2500 Artifactory \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+  const useArtifactory = await confirm({
+    message: "Configure Artifactory for dependency commands (deps outdated, deps license-check)?",
+    default: false
+  });
+  let artifactoryBaseUrl = "";
+  let artifactoryToken = "";
+  let npmRepo = "";
+  let nugetRepo = "";
+  let mavenRepo = "";
+  if (useArtifactory) {
+    artifactoryBaseUrl = await input({
+      message: "Artifactory base URL (e.g. https://artifactory.company.com):",
+      default: ""
+    });
+    artifactoryToken = await password({
+      message: "Artifactory API token:"
+    });
+    process.stderr.write("\nConfigure which ecosystems you use (skip any that don't apply):\n");
+    const useNpm = await confirm({ message: "  Use npm packages from Artifactory?", default: true });
+    if (useNpm) {
+      npmRepo = await input({ message: "  npm repository name:", default: "npm-remote" });
+    }
+    const useNuget = await confirm({ message: "  Use NuGet packages from Artifactory?", default: false });
+    if (useNuget) {
+      nugetRepo = await input({ message: "  NuGet repository name:", default: "nuget-remote" });
+    }
+    const useMaven = await confirm({ message: "  Use Maven packages from Artifactory?", default: false });
+    if (useMaven) {
+      mavenRepo = await input({ message: "  Maven repository name:", default: "libs-release" });
+    }
+  }
+  process.stderr.write("\n\u2500\u2500 SonarQube \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+  const useSonar = await confirm({
+    message: "Configure SonarQube Server for code quality checks?",
+    default: false
+  });
+  let sonarBaseUrl = "";
+  let sonarToken = "";
+  if (useSonar) {
+    sonarBaseUrl = await input({
+      message: "SonarQube Server base URL (e.g. https://sonar.your-company.com):",
+      default: ""
+    });
+    sonarToken = await password({
+      message: "SonarQube personal access token:"
+    });
+  }
+  process.stderr.write("\n\u2500\u2500 SDElements \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+  const useSde = await confirm({
+    message: "Configure SDElements for threat modeling and countermeasure queries?",
+    default: false
+  });
+  let sdeBaseUrl = "";
+  let sdeToken = "";
+  if (useSde) {
+    sdeBaseUrl = await input({
+      message: "SDElements base URL\n  Cloud-hosted: https://your-org.sdelements.com\n  On-premise:   https://sde.your-company.com\n  URL: ",
+      default: ""
+    });
+    sdeToken = await password({
+      message: "SDElements API token:"
+    });
+  }
   process.stderr.write("\n\u2500\u2500 Defaults \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
   const jiraProject = await input({
     message: "Default Jira project key (optional):",
     default: ""
   });
+  const sonarProject = useSonar ? await input({
+    message: "Default SonarQube project key (optional):",
+    default: ""
+  }) : "";
+  const sdeProject = useSde ? await input({
+    message: "Default SDElements project ID (optional, numeric):",
+    default: ""
+  }) : "";
   process.stderr.write("\n");
   const confirmed = await confirm({
     message: "Write config to ~/.pncli/config.json?",
@@ -1537,7 +4064,8 @@ async function initGlobalConfig(start) {
   });
   if (!confirmed) {
     process.stderr.write("Aborted.\n");
-    process.exit(0);
+    process.exitCode = ExitCode.SUCCESS;
+    return;
   }
   writeGlobalConfig({
     user: {
@@ -1552,10 +4080,47 @@ async function initGlobalConfig(start) {
       baseUrl: bitbucketBaseUrl || void 0,
       pat: bitbucketPat || void 0
     },
+    ...confluenceBaseUrl || confluenceApiToken ? {
+      confluence: {
+        baseUrl: confluenceBaseUrl || void 0,
+        apiToken: confluenceApiToken || void 0
+      }
+    } : {},
+    ...useArtifactory ? {
+      artifactory: {
+        baseUrl: artifactoryBaseUrl || void 0,
+        token: artifactoryToken || void 0,
+        npmRepo: npmRepo || void 0,
+        nugetRepo: nugetRepo || void 0,
+        mavenRepo: mavenRepo || void 0
+      }
+    } : {},
+    ...useSonar ? {
+      sonar: {
+        baseUrl: sonarBaseUrl || void 0,
+        token: sonarToken || void 0
+      }
+    } : {},
+    ...useSde ? {
+      sde: {
+        baseUrl: sdeBaseUrl || void 0,
+        token: sdeToken || void 0
+      }
+    } : {},
     defaults: {
       jira: {
         project: jiraProject || void 0
-      }
+      },
+      ...useSonar && sonarProject ? {
+        sonar: {
+          project: sonarProject || void 0
+        }
+      } : {},
+      ...useSde && sdeProject ? {
+        sde: {
+          project: sdeProject || void 0
+        }
+      } : {}
     }
   });
   const configPath = getGlobalConfigPath();
@@ -1586,16 +4151,18 @@ async function initRepoConfig(start) {
   });
   if (!confirmed) {
     process.stderr.write("Aborted.\n");
-    process.exit(0);
+    process.exitCode = ExitCode.SUCCESS;
+    return;
   }
-  if (fs2.existsSync(".pncli.json")) {
+  if (fs5.existsSync(".pncli.json")) {
     const overwrite = await confirm({
       message: ".pncli.json already exists. Overwrite?",
       default: false
     });
     if (!overwrite) {
       process.stderr.write("Aborted.\n");
-      process.exit(0);
+      process.exitCode = ExitCode.SUCCESS;
+      return;
     }
   }
   writeRepoConfig({
@@ -1614,6 +4181,9 @@ async function initRepoConfig(start) {
 }
 
 // src/cli.ts
+if (!process.env.PNCLI_VERIFY_TLS) {
+  process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
+}
 var require2 = createRequire(import.meta.url);
 var pkg = require2("../package.json");
 var TAGLINE = "One command does what three meetings couldn't.";
@@ -1636,21 +4206,24 @@ registerJiraCommands(program);
 registerBitbucketCommands(program);
 registerConfluenceCommands(program);
 registerSonarCommands(program);
-registerArtifactoryCommands(program);
+registerSdeCommands(program);
+registerDepsCommands(program);
 registerConfigCommands(program);
 program.addHelpText("after", `
 Services:
   git          Local git operations (status, diff, log, branch)
-  jira         Jira Data Cloud (coming soon)
-  bitbucket    Bitbucket Server (coming soon)
-  confluence   Confluence (coming soon)
-  sonar        SonarQube (coming soon)
-  artifactory  Artifactory (coming soon)
+  deps         Dependency scanning, CVE detection, license auditing
+  jira         Jira Data Cloud
+  bitbucket    Bitbucket Server
+  confluence   Confluence
+  sonar        SonarQube Server (quality gates, issues, metrics, hotspots)
+  sde          SDElements (threat modeling, countermeasures, compliance)
   config       Manage pncli configuration
 `);
 program.parseAsync(process.argv).catch((err) => {
+  if (process.exitCode !== void 0) return;
   process.stderr.write(`Fatal: ${err instanceof Error ? err.message : String(err)}
 `);
-  process.exit(1);
+  process.exitCode = ExitCode.GENERAL_ERROR;
 });
 //# sourceMappingURL=cli.js.map