@kolatts/pncli 1.8.0 → 1.10.0

package/dist/cli.js

@@ -7,7 +7,7 @@ import {
   setRepoConfigValue,
   writeGlobalConfig,
   writeRepoConfig
-} from "./chunk-S4SJLY4M.js";
+} from "./chunk-O3LWAWSN.js";
 import {
   ExitCode,
   PncliError,
@@ -18,13 +18,13 @@ import {
   setGlobalUser,
   success,
   warn
-} from "./chunk-QQ7UKWTU.js";
+} from "./chunk-3XHTRFRX.js";
 import {
   AdoCoreClient
 } from "./chunk-VDL32PSG.js";
 
 // src/cli.ts
-import { Command } from "commander";
+import { Command as Command2 } from "commander";
 import { createRequire } from "module";
 
 // src/services/git/client.ts
@@ -771,7 +771,7 @@ function registerJiraCommands(program2) {
       fail(err, "jira", "get-issue", start);
     }
   });
-  jira.command("create-issue").description("Create a Jira issue").option("--project <key>", "Project key").option("--type <type>", "Issue type (Bug, Story, Task, ...)").requiredOption("--summary <text>", "Issue summary").option("--description <text>", "Issue description").option("--priority <name>", "Priority name").option("--assignee <accountId>", "Assignee account ID").option("--labels <labels>", "Comma-separated labels").option("--field <Name=value>", "Custom field value (repeatable)", (val, acc) => [...acc, val], []).action(async (opts) => {
+  jira.command("create-issue").description("Create a Jira issue").option("--project <key>", "Project key").option("--type <type>", "Issue type (Bug, Story, Task, ...)").requiredOption("--summary <text>", "Issue summary").option("--description <text>", "Issue description").option("--priority <name>", "Priority name").option("--assignee <accountId>", "Assignee account ID").option("--labels <labels>", "Comma-separated labels").option("--parent <key>", 'Parent issue key \u2014 creates an "is child of" link after creation').option("--field <Name=value>", "Custom field value (repeatable)", (val, acc) => [...acc, val], []).action(async (opts) => {
     const start = Date.now();
     try {
       const { client, fieldMap } = getClientAndFields(program2);
@@ -784,6 +784,14 @@ function registerJiraCommands(program2) {
       const customFieldValues = parseFieldArgs(opts.field, fieldMap);
       const data = await client.createIssue({ project, issueType, summary: opts.summary, description: opts.description, priority, assignee: opts.assignee, labels, customFieldValues });
       success(data, "jira", "create-issue", start);
+      if (opts.parent) {
+        try {
+          await client.linkIssue({ key: data.key, linkType: "is child of", target: opts.parent });
+        } catch (linkErr) {
+          warn(`Created ${data.key} but failed to link to parent ${opts.parent}: ${linkErr instanceof Error ? linkErr.message : linkErr}`);
+        }
+      }
+      return;
     } catch (err) {
       fail(err, "jira", "create-issue", start);
     }
@@ -2039,6 +2047,9 @@ function registerSdeCommands(program2) {
   });
 }
 
+// src/services/deps/commands.ts
+import { Option } from "commander";
+
 // src/services/deps/parsers/index.ts
 import fs from "fs";
 import path4 from "path";
@@ -2893,11 +2904,341 @@ async function checkPackagesForVulns(packages) {
   return allVulnerable;
 }
 
-// src/services/deps/clients/artifactory.ts
-var TIMEOUT_MS2 = 15e3;
-async function fetchWithTimeout2(url, token) {
+// src/services/deps/clients/sonatype.ts
+var SONATYPE_URL = "https://ossindex.sonatype.org";
+var BATCH_SIZE2 = 128;
+var TIMEOUT_MS2 = 3e4;
+async function fetchWithTimeout2(url, init) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), TIMEOUT_MS2);
+  try {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function toPurl(pkg2) {
+  switch (pkg2.ecosystem) {
+    case "npm": {
+      const encodedName = pkg2.name.startsWith("@") ? pkg2.name.replace("@", "%40") : pkg2.name;
+      return `pkg:npm/${encodedName}@${pkg2.version}`;
+    }
+    case "nuget":
+      return `pkg:nuget/${pkg2.name}@${pkg2.version}`;
+    case "maven": {
+      const colonIdx = pkg2.name.indexOf(":");
+      if (colonIdx !== -1) {
+        const groupId = pkg2.name.slice(0, colonIdx);
+        const artifactId = pkg2.name.slice(colonIdx + 1);
+        return `pkg:maven/${encodeURIComponent(groupId)}/${encodeURIComponent(artifactId)}@${pkg2.version}`;
+      }
+      return `pkg:maven/${encodeURIComponent(pkg2.name)}@${pkg2.version}`;
+    }
+    default:
+      return `pkg:generic/${encodeURIComponent(pkg2.name)}@${pkg2.version}`;
+  }
+}
+function inferSeverityFromCvss2(score) {
+  if (score >= 9) return "CRITICAL";
+  if (score >= 7) return "HIGH";
+  if (score >= 4) return "MEDIUM";
+  if (score > 0) return "LOW";
+  return "UNKNOWN";
+}
+function mapSonatypeVuln(v, pkg2) {
+  const refs = [v.reference, ...v.externalReferences ?? []].filter(Boolean);
+  const advice = `See ${v.reference} for remediation details for ${pkg2.name}@${pkg2.version}.`;
+  const cvePattern = /CVE-\d{4}-\d+/gi;
+  const searchText = [v.displayName, v.title, v.description].filter(Boolean).join(" ");
+  const aliases = [...new Set([...searchText.matchAll(cvePattern)].map((m) => m[0].toUpperCase()))];
+  return {
+    id: v.displayName || v.id,
+    summary: v.title || v.description,
+    severity: inferSeverityFromCvss2(v.cvssScore),
+    cvss: v.cvssScore > 0 ? v.cvssScore : null,
+    aliases,
+    remediation: {
+      fixAvailable: false,
+      fixedVersions: [],
+      advice
+    },
+    references: refs
+  };
+}
+async function queryBatch2(purls, packages) {
+  const res = await fetchWithTimeout2(`${SONATYPE_URL}/api/v3/component-report`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "application/json" },
+    body: JSON.stringify({ coordinates: purls })
+  });
+  if (res.status === 429) {
+    throw new Error(
+      "Sonatype OSS Index is rate-limiting requests from this IP. Create a free account at ossindex.sonatype.org and add your credentials to your pncli config to raise the limit."
+    );
+  }
+  if (!res.ok) {
+    throw new Error(`Sonatype OSS Index returned HTTP ${res.status}`);
+  }
+  const reports = await res.json();
+  const vulnerable = [];
+  const purlToPackage = /* @__PURE__ */ new Map();
+  for (let i = 0; i < purls.length; i++) {
+    purlToPackage.set(purls[i], packages[i]);
+  }
+  for (const report of reports) {
+    if (!report?.coordinates) continue;
+    const pkg2 = purlToPackage.get(report.coordinates);
+    if (!pkg2) continue;
+    const vulns = report.vulnerabilities ?? [];
+    if (vulns.length === 0) continue;
+    vulnerable.push({ ...pkg2, vulnerabilities: vulns.map((v) => mapSonatypeVuln(v, pkg2)) });
+  }
+  return vulnerable;
+}
+async function checkSonatypeConnectivity() {
+  try {
+    const res = await fetchWithTimeout2(`${SONATYPE_URL}/api/v3/component-report`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Accept: "application/json" },
+      body: JSON.stringify({ coordinates: [] })
+    });
+    return { reachable: res.ok || res.status === 400 };
+  } catch (err) {
+    return {
+      reachable: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+async function checkPackagesForVulnsViaSonatype(packages) {
+  const allVulnerable = [];
+  for (let i = 0; i < packages.length; i += BATCH_SIZE2) {
+    const chunk = packages.slice(i, i + BATCH_SIZE2);
+    const purls = chunk.map(toPurl);
+    const results = await queryBatch2(purls, chunk);
+    allVulnerable.push(...results);
+  }
+  return allVulnerable;
+}
+
+// src/services/deps/clients/sonatypeiq.ts
+var TIMEOUT_MS3 = 6e4;
+var MAX_POLL_ATTEMPTS = 10;
+var POLL_INTERVAL_MS = 2e3;
+var BATCH_SIZE3 = 128;
+async function fetchWithTimeout3(url, init) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS3);
+  try {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function buildBasicAuth(userCode, passcode) {
+  return `Basic ${Buffer.from(`${userCode}:${passcode}`).toString("base64")}`;
+}
+function threatLevelToSeverity(level) {
+  if (level >= 9) return "CRITICAL";
+  if (level >= 7) return "HIGH";
+  if (level >= 4) return "MEDIUM";
+  if (level > 0) return "LOW";
+  return "UNKNOWN";
+}
+function toPurl2(pkg2) {
+  switch (pkg2.ecosystem) {
+    case "npm": {
+      const encodedName = pkg2.name.startsWith("@") ? pkg2.name.replace("@", "%40") : pkg2.name;
+      return `pkg:npm/${encodedName}@${pkg2.version}`;
+    }
+    case "nuget":
+      return `pkg:nuget/${pkg2.name}@${pkg2.version}`;
+    case "maven": {
+      const colonIdx = pkg2.name.indexOf(":");
+      if (colonIdx !== -1) {
+        const groupId = pkg2.name.slice(0, colonIdx);
+        const artifactId = pkg2.name.slice(colonIdx + 1);
+        return `pkg:maven/${encodeURIComponent(groupId)}/${encodeURIComponent(artifactId)}@${pkg2.version}`;
+      }
+      return `pkg:maven/${encodeURIComponent(pkg2.name)}@${pkg2.version}`;
+    }
+    default:
+      return `pkg:generic/${encodeURIComponent(pkg2.name)}@${pkg2.version}`;
+  }
+}
+function mapViolationToVuln(violation) {
+  const cveRefs = violation.constraintViolations.flatMap(
+    (cv) => cv.reasons.filter((r) => r.reference?.type === "VULNERABILITY").map((r) => r.reference.value)
+  );
+  const id = cveRefs[0] ?? violation.policyId;
+  const severity = threatLevelToSeverity(violation.policyThreatLevel);
+  return {
+    id,
+    summary: violation.policyName,
+    severity,
+    cvss: null,
+    aliases: [...new Set(cveRefs)],
+    remediation: {
+      fixAvailable: false,
+      fixedVersions: [],
+      advice: `Policy violation: ${violation.policyName} (threat level ${violation.policyThreatLevel}). Check Sonatype IQ Server for details.`
+    },
+    references: []
+  };
+}
+function syntheticVulnsFromCounts(criticalCount, severeCount, moderateCount, pkgName) {
+  const vulns = [];
+  if (criticalCount > 0) {
+    vulns.push({
+      id: `iq-critical-${pkgName}`,
+      summary: `${criticalCount} critical vulnerability(ies) detected by Sonatype IQ`,
+      severity: "CRITICAL",
+      cvss: null,
+      aliases: [],
+      remediation: { fixAvailable: false, fixedVersions: [], advice: "Check Sonatype IQ Server for details." },
+      references: []
+    });
+  }
+  if (severeCount > 0) {
+    vulns.push({
+      id: `iq-high-${pkgName}`,
+      summary: `${severeCount} severe vulnerability(ies) detected by Sonatype IQ`,
+      severity: "HIGH",
+      cvss: null,
+      aliases: [],
+      remediation: { fixAvailable: false, fixedVersions: [], advice: "Check Sonatype IQ Server for details." },
+      references: []
+    });
+  }
+  if (moderateCount > 0) {
+    vulns.push({
+      id: `iq-medium-${pkgName}`,
+      summary: `${moderateCount} moderate vulnerability(ies) detected by Sonatype IQ`,
+      severity: "MEDIUM",
+      cvss: null,
+      aliases: [],
+      remediation: { fixAvailable: false, fixedVersions: [], advice: "Check Sonatype IQ Server for details." },
+      references: []
+    });
+  }
+  return vulns;
+}
+async function resolveApplicationInternalId(baseUrl, applicationId, auth) {
+  const url = `${baseUrl.replace(/\/$/, "")}/api/v2/applications?publicId=${encodeURIComponent(applicationId)}`;
+  const res = await fetchWithTimeout3(url, {
+    method: "GET",
+    headers: { "Authorization": auth, "Accept": "application/json" }
+  });
+  if (!res.ok) return applicationId;
+  const data = await res.json();
+  if (data.applications && data.applications.length > 0) {
+    return data.applications[0].id;
+  }
+  return applicationId;
+}
+async function pollResults(baseUrl, resultsUrl, auth) {
+  for (let attempt = 0; attempt < MAX_POLL_ATTEMPTS; attempt++) {
+    if (attempt > 0) {
+      await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS * attempt));
+    }
+    const url = resultsUrl.startsWith("http") ? resultsUrl : `${baseUrl.replace(/\/$/, "")}${resultsUrl}`;
+    const res = await fetchWithTimeout3(url, {
+      method: "GET",
+      headers: { "Authorization": auth, "Accept": "application/json" }
+    });
+    if (!res.ok) {
+      throw new Error(`Sonatype IQ Server returned HTTP ${res.status} polling results`);
+    }
+    const data = await res.json();
+    if (!data.isQueued) return data;
+  }
+  throw new Error("Sonatype IQ Server evaluation timed out waiting for results.");
+}
+async function evaluateBatch(purls, packages, baseUrl, applicationId, auth) {
+  const url = `${baseUrl.replace(/\/$/, "")}/api/v2/evaluation/applications/${encodeURIComponent(applicationId)}`;
+  const res = await fetchWithTimeout3(url, {
+    method: "POST",
+    headers: { "Authorization": auth, "Content-Type": "application/json", "Accept": "application/json" },
+    body: JSON.stringify({ components: purls.map((p) => ({ packageUrl: p })) })
+  });
+  if (!res.ok) {
+    throw new Error(`Sonatype IQ Server returned HTTP ${res.status}`);
+  }
+  let data = await res.json();
+  if (data.isQueued && data.resultsUrl) {
+    data = await pollResults(baseUrl, data.resultsUrl, auth);
+  }
+  const components = data.components ?? [];
+  const vulnerable = [];
+  const purlToPackage = /* @__PURE__ */ new Map();
+  for (let i = 0; i < purls.length; i++) {
+    purlToPackage.set(purls[i], packages[i]);
+  }
+  for (const result of components) {
+    if (!result?.component?.packageUrl) continue;
+    const pkg2 = purlToPackage.get(result.component.packageUrl);
+    if (!pkg2) continue;
+    const criticalCount = result.criticalVulnerabilityCount ?? 0;
+    const severeCount = result.severeVulnerabilityCount ?? 0;
+    const moderateCount = result.moderateVulnerabilityCount ?? 0;
+    const totalVulns = criticalCount + severeCount + moderateCount;
+    const violations = result.policyData?.policyViolations ?? [];
+    const securityViolations = violations.filter((v) => v.policyThreatCategory === "SECURITY");
+    if (securityViolations.length === 0 && totalVulns === 0) continue;
+    const vulnerabilities = securityViolations.length > 0 ? securityViolations.map((v) => mapViolationToVuln(v)) : syntheticVulnsFromCounts(criticalCount, severeCount, moderateCount, pkg2.name);
+    vulnerable.push({ ...pkg2, vulnerabilities });
+  }
+  return vulnerable;
+}
+async function checkPackagesViaIqServer(packages, applicationId, config) {
+  const { baseUrl, userCode, passcode } = config.sonatypeiq;
+  if (!baseUrl) throw new Error("Sonatype IQ Server baseUrl not configured.");
+  if (!userCode || !passcode) throw new Error("Sonatype IQ Server credentials not configured.");
+  const auth = buildBasicAuth(userCode, passcode);
+  const internalId = await resolveApplicationInternalId(baseUrl, applicationId, auth);
+  const allVulnerable = [];
+  for (let i = 0; i < packages.length; i += BATCH_SIZE3) {
+    const chunk = packages.slice(i, i + BATCH_SIZE3);
+    const purls = chunk.map(toPurl2);
+    const results = await evaluateBatch(purls, chunk, baseUrl, internalId, auth);
+    allVulnerable.push(...results);
+  }
+  return allVulnerable;
+}
+async function checkSonatypeIqConnectivity(baseUrl, userCode, passcode) {
+  try {
+    const auth = buildBasicAuth(userCode, passcode);
+    const url = `${baseUrl.replace(/\/$/, "")}/api/v2/applications?limit=1`;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 1e4);
+    let res;
+    try {
+      res = await fetch(url, {
+        method: "GET",
+        headers: { "Authorization": auth, "Accept": "application/json" },
+        signal: controller.signal
+      });
+    } finally {
+      clearTimeout(timer);
+    }
+    if (res.status === 401 || res.status === 403) {
+      return { reachable: true, authenticated: false, error: `Authentication failed (HTTP ${res.status})` };
+    }
+    return { reachable: true, authenticated: res.ok };
+  } catch (err) {
+    return {
+      reachable: false,
+      authenticated: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+
+// src/services/deps/clients/artifactory.ts
+var TIMEOUT_MS4 = 15e3;
+async function fetchWithTimeout4(url, token) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS4);
   try {
     return await fetch(url, {
       headers: { Authorization: `Bearer ${token}` },
@@ -2933,7 +3274,7 @@ async function checkArtifactoryConnectivity(config) {
     };
   }
   try {
-    const res = await fetchWithTimeout2(`${config.baseUrl}/api/system/ping`, config.token);
+    const res = await fetchWithTimeout4(`${config.baseUrl}/api/system/ping`, config.token);
     if (res.status === 401 || res.status === 403) {
       return {
         reachable: true,
@@ -2983,7 +3324,7 @@ function repoForEcosystem(config, eco) {
 async function getLatestNpm(baseUrl, token, repoName, packageName) {
   try {
     const encoded = packageName.startsWith("@") ? packageName.replace("/", "%2F") : packageName;
-    const res = await fetchWithTimeout2(`${baseUrl}/api/npm/${repoName}/${encoded}`, token);
+    const res = await fetchWithTimeout4(`${baseUrl}/api/npm/${repoName}/${encoded}`, token);
     if (!res.ok) return null;
     const data = await res.json();
     return data["dist-tags"]?.latest ?? null;
@@ -2994,7 +3335,7 @@ async function getLatestNpm(baseUrl, token, repoName, packageName) {
 async function getLatestNuget(baseUrl, token, repoName, packageName) {
   try {
     const lower = packageName.toLowerCase();
-    const res = await fetchWithTimeout2(
+    const res = await fetchWithTimeout4(
       `${baseUrl}/api/nuget/v3/${repoName}/flatcontainer/${lower}/index.json`,
       token
     );
@@ -3010,7 +3351,7 @@ async function getLatestMaven(baseUrl, token, repoName, packageName) {
   const [groupId, artifactId] = packageName.split(":");
   if (!groupId || !artifactId) return null;
   try {
-    const res = await fetchWithTimeout2(
+    const res = await fetchWithTimeout4(
       `${baseUrl}/api/search/latestVersion?g=${encodeURIComponent(groupId)}&a=${encodeURIComponent(artifactId)}&repos=${repoName}`,
       token
     );
@@ -3060,7 +3401,7 @@ async function getOutdatedPackages(packages, config, filterType) {
 async function getLicenseNpm(baseUrl, token, repoName, packageName) {
   try {
     const encoded = packageName.startsWith("@") ? packageName.replace("/", "%2F") : packageName;
-    const res = await fetchWithTimeout2(`${baseUrl}/api/npm/${repoName}/${encoded}`, token);
+    const res = await fetchWithTimeout4(`${baseUrl}/api/npm/${repoName}/${encoded}`, token);
     if (!res.ok) return null;
     const data = await res.json();
     if (typeof data.license === "string") return data.license;
@@ -3073,7 +3414,7 @@ async function getLicenseNpm(baseUrl, token, repoName, packageName) {
 async function getLicenseNuget(baseUrl, token, repoName, packageName, version) {
   try {
     const lower = packageName.toLowerCase();
-    const res = await fetchWithTimeout2(
+    const res = await fetchWithTimeout4(
       `${baseUrl}/api/nuget/v3/${repoName}/registration/${lower}/${version}.json`,
       token
     );
@@ -3125,15 +3466,24 @@ async function detectTier(config) {
   cachedTier = { tier, osvReachable, artifactoryReachable };
   return cachedTier;
 }
+async function checkSonatypeReachable() {
+  const result = await checkSonatypeConnectivity();
+  return result.reachable;
+}
 async function buildConnectivityData(config) {
-  const [osvResult, artResult] = await Promise.all([
+  const iqCfg = config.sonatypeiq;
+  const iqConfigured = !!(iqCfg.baseUrl && iqCfg.userCode && iqCfg.passcode);
+  const checks = await Promise.all([
     checkOsvConnectivity(),
-    checkArtifactoryConnectivity(config.artifactory)
+    checkArtifactoryConnectivity(config.artifactory),
+    checkSonatypeConnectivity(),
+    iqConfigured ? checkSonatypeIqConnectivity(iqCfg.baseUrl, iqCfg.userCode, iqCfg.passcode) : Promise.resolve(null)
   ]);
+  const [osvResult, artResult, sonatypeResult, iqResult] = checks;
   const artCfg = config.artifactory;
   let tier = "local";
   if (artResult.reachable && artResult.authenticated) tier = "artifactory";
-  if (osvResult.reachable) tier = "full";
+  if (osvResult.reachable || sonatypeResult.reachable) tier = "full";
   cachedTier = {
     tier,
     osvReachable: osvResult.reachable,
@@ -3156,46 +3506,158 @@ async function buildConnectivityData(config) {
       url: "https://api.osv.dev",
       ...osvResult.error ? { error: osvResult.error } : {}
     },
+    sonatype: {
+      reachable: sonatypeResult.reachable,
+      url: "https://ossindex.sonatype.org",
+      ...sonatypeResult.error ? { error: sonatypeResult.error } : {}
+    },
+    ...iqConfigured && iqResult ? {
+      sonatypeiq: {
+        reachable: iqResult.reachable,
+        authenticated: iqResult.authenticated,
+        url: iqCfg.baseUrl,
+        ...iqResult.error ? { error: iqResult.error } : {}
+      }
+    } : {},
     tier,
     capabilities: {
       scan: true,
       diff: true,
       outdated: artResult.reachable && artResult.authenticated,
       licenseCheck: artResult.reachable && artResult.authenticated,
-      cveCheck: osvResult.reachable
+      cveCheck: osvResult.reachable || sonatypeResult.reachable || (iqResult?.reachable && iqResult?.authenticated) === true
     }
   };
 }
 
 // src/services/deps/frisk.ts
-async function runFrisk(config, opts) {
+function toErrorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+async function runFrisk(config, opts, source = "osv", applicationId) {
   const repoRoot = getRepoRoot();
   if (!repoRoot) {
     throw new PncliError("Not inside a git repository.", 1);
   }
-  const { tier, osvReachable } = await detectTier(config);
-  if (!osvReachable) {
+  if (source === "sonatypeiq") {
+    if (!config.sonatypeiq.baseUrl || !config.sonatypeiq.userCode || !config.sonatypeiq.passcode) {
+      throw new PncliError(
+        "deps frisk --source sonatypeiq requires Sonatype IQ Server to be configured. Run: pncli config init",
+        1
+      );
+    }
+    if (!applicationId) {
+      throw new PncliError(
+        "deps frisk --source sonatypeiq requires --application-id <id>. Use 'pncli sonatypeiq applications list' to find application IDs.",
+        1
+      );
+    }
+  }
+  const { tier: baseTier, osvReachable } = await detectTier(config);
+  const sonatypeReachable = source === "sonatype" || source === "all" ? await checkSonatypeReachable() : false;
+  const tier = sonatypeReachable ? "full" : baseTier;
+  if (source === "osv" && !osvReachable) {
     throw new PncliError(
       "deps frisk requires OSV.dev access but api.osv.dev is not reachable from this machine. Run 'pncli deps connectivity' to diagnose.",
       503
     );
   }
+  if (source === "sonatype" && !sonatypeReachable) {
+    throw new PncliError(
+      "deps frisk --source sonatype requires Sonatype OSS Index access but ossindex.sonatype.org is not reachable from this machine. Run 'pncli deps connectivity' to diagnose.",
+      503
+    );
+  }
+  if (source === "all" && !osvReachable && !sonatypeReachable) {
+    throw new PncliError(
+      "deps frisk requires either OSV.dev or Sonatype OSS Index access, but neither is reachable from this machine. Run 'pncli deps connectivity' to diagnose.",
+      503
+    );
+  }
+  const sourceErrors = [];
+  let sourcesQueried;
+  if (source === "all") {
+    if (!osvReachable) sourceErrors.push({ source: "osv", error: "api.osv.dev is not reachable \u2014 run pncli deps connectivity to diagnose." });
+    if (!sonatypeReachable) sourceErrors.push({ source: "sonatype", error: "ossindex.sonatype.org is not reachable \u2014 run pncli deps connectivity to diagnose." });
+    sourcesQueried = [
+      ...osvReachable ? ["osv"] : [],
+      ...sonatypeReachable ? ["sonatype"] : []
+    ];
+  } else {
+    sourcesQueried = [source];
+  }
   const scanOpts = {
     ...opts,
     includeTransitive: opts.includeTransitive ?? true
   };
   const scan = scanRepo(repoRoot, scanOpts);
   if (scan.packages.length === 0) {
-    return { tier, scanned: 0, vulnerable: 0, packages: [] };
+    return { tier, source, sourcesQueried, sourceErrors, scanned: 0, vulnerable: 0, packages: [] };
+  }
+  let vulnerable;
+  if (source === "sonatypeiq") {
+    vulnerable = await checkPackagesViaIqServer(scan.packages, applicationId, config);
+  } else if (source === "sonatype") {
+    vulnerable = await checkPackagesForVulnsViaSonatype(scan.packages);
+  } else if (source === "all") {
+    const [osvSettled, sonatypeSettled] = await Promise.allSettled([
+      osvReachable ? checkPackagesForVulns(scan.packages) : Promise.resolve([]),
+      sonatypeReachable ? checkPackagesForVulnsViaSonatype(scan.packages) : Promise.resolve([])
+    ]);
+    if (osvReachable) {
+      if (osvSettled.status === "rejected") {
+        sourceErrors.push({ source: "osv", error: toErrorMessage(osvSettled.reason) });
+        sourcesQueried = sourcesQueried.filter((s) => s !== "osv");
+      }
+    }
+    if (sonatypeReachable) {
+      if (sonatypeSettled.status === "rejected") {
+        sourceErrors.push({ source: "sonatype", error: toErrorMessage(sonatypeSettled.reason) });
+        sourcesQueried = sourcesQueried.filter((s) => s !== "sonatype");
+      }
+    }
+    if (sourcesQueried.length === 0) {
+      throw new PncliError(
+        "All vulnerability sources failed during scanning. Run 'pncli deps connectivity' to diagnose.",
+        503
+      );
+    }
+    vulnerable = mergeVulnerablePackages(
+      osvSettled.status === "fulfilled" ? osvSettled.value : [],
+      sonatypeSettled.status === "fulfilled" ? sonatypeSettled.value : []
+    );
+  } else {
+    vulnerable = await checkPackagesForVulns(scan.packages);
   }
-  const vulnerable = await checkPackagesForVulns(scan.packages);
   return {
     tier,
+    source,
+    sourcesQueried,
+    sourceErrors,
     scanned: scan.packages.length,
     vulnerable: vulnerable.length,
     packages: vulnerable
   };
 }
+function mergeVulnerablePackages(osvResults, sonatypeResults) {
+  const byKey = /* @__PURE__ */ new Map();
+  for (const pkg2 of osvResults) {
+    const key = `${pkg2.ecosystem}:${pkg2.name}@${pkg2.version}`;
+    byKey.set(key, { ...pkg2 });
+  }
+  for (const pkg2 of sonatypeResults) {
+    const key = `${pkg2.ecosystem}:${pkg2.name}@${pkg2.version}`;
+    const existing = byKey.get(key);
+    if (existing) {
+      const existingIds = new Set(existing.vulnerabilities.map((v) => v.id));
+      const newVulns = pkg2.vulnerabilities.filter((v) => !existingIds.has(v.id));
+      existing.vulnerabilities = [...existing.vulnerabilities, ...newVulns];
+    } else {
+      byKey.set(key, { ...pkg2 });
+    }
+  }
+  return [...byKey.values()];
+}
 
 // src/services/deps/outdated.ts
 async function runOutdated(config, opts, filterType) {
@@ -3270,7 +3732,7 @@ async function runLicenseCheck(config, opts) {
 // src/services/deps/commands.ts
 function registerDepsCommands(program2) {
   const deps = program2.command("deps").description("Dependency scanning, CVE detection, and license auditing");
-  deps.command("frisk").description("Scan all dependencies for CVEs and output remediation paths (requires OSV.dev)").option("--ecosystem <ecosystem>", "Filter to one ecosystem: npm, nuget, maven, all", "all").option("--direct-only", "Only scan direct dependencies (default: include transitive)", false).option("--include-dev", "Include dev/test dependencies", false).action(async (opts, cmd) => {
+  deps.command("frisk").description("Scan all dependencies for CVEs and output remediation paths (requires OSV.dev, Sonatype OSS Index, or Sonatype IQ Server)").option("--ecosystem <ecosystem>", "Filter to one ecosystem: npm, nuget, maven, all", "all").option("--direct-only", "Only scan direct dependencies (default: include transitive)", false).option("--include-dev", "Include dev/test dependencies", false).addOption(new Option("--source <source>", "Vulnerability source").choices(["osv", "sonatype", "sonatypeiq", "all"]).default("osv")).option("--application-id <id>", "Sonatype IQ Server application ID (required when --source sonatypeiq)").action(async (opts, cmd) => {
     const startTime = Date.now();
     try {
       const globalOpts = cmd.optsWithGlobals();
@@ -3280,7 +3742,7 @@ function registerDepsCommands(program2) {
         includeTransitive: !opts.directOnly,
         includeDev: opts.includeDev
       };
-      const data = await runFrisk(config, scanOpts);
+      const data = await runFrisk(config, scanOpts, opts.source, opts.applicationId);
       success(data, "deps", "frisk", startTime);
     } catch (err) {
       fail(err, "deps", "frisk", startTime);
@@ -3346,7 +3808,7 @@ function registerDepsCommands(program2) {
       fail(err, "deps", "license-check", startTime);
     }
   });
-  deps.command("connectivity").description("Test network access to Artifactory and OSV.dev, report available tier").action(async (_opts, cmd) => {
+  deps.command("connectivity").description("Test network access to Artifactory, OSV.dev, and Sonatype OSS Index, report available tier").action(async (_opts, cmd) => {
     const startTime = Date.now();
     try {
       const globalOpts = cmd.optsWithGlobals();
@@ -3652,6 +4114,37 @@ function registerConfigCommands(program2) {
       } else {
         results.checkmarx = { ok: null, message: "not configured" };
       }
+      const snConfigured = cfg.servicenow.baseUrl && cfg.servicenow.username && (cfg.servicenow.password || cfg.servicenow.apiToken);
+      if (snConfigured) {
+        try {
+          await http.servicenow("/api/now/table/change_request", { params: { sysparm_limit: 1 } });
+          results.servicenow = { ok: true, message: "connected" };
+        } catch (err) {
+          results.servicenow = { ok: false, message: err instanceof Error ? err.message : String(err) };
+        }
+      } else {
+        results.servicenow = { ok: null, message: "not configured" };
+      }
+      if (cfg.contrast.apiKey && cfg.contrast.serviceKey && cfg.contrast.username && cfg.contrast.orgUuid) {
+        try {
+          await http.contrast(`/Contrast/api/ng/${cfg.contrast.orgUuid}/applications`, { params: { limit: 1 } });
+          results.contrast = { ok: true, message: "connected" };
+        } catch (err) {
+          results.contrast = { ok: false, message: err instanceof Error ? err.message : String(err) };
+        }
+      } else {
+        results.contrast = { ok: null, message: "not configured" };
+      }
+      if (cfg.sonatypeiq.baseUrl && cfg.sonatypeiq.userCode && cfg.sonatypeiq.passcode) {
+        try {
+          await http.sonatypeiq("/api/v2/applications", { params: { limit: 1 } });
+          results.sonatypeiq = { ok: true, message: "connected" };
+        } catch (err) {
+          results.sonatypeiq = { ok: false, message: err instanceof Error ? err.message : String(err) };
+        }
+      } else {
+        results.sonatypeiq = { ok: null, message: "not configured" };
+      }
       success(results, "config", "test", start);
     } catch (err) {
       fail(err, "config", "test", start);
@@ -3798,11 +4291,48 @@ function registerConfigCommands(program2) {
           results.checkmarx = categorize2(err);
         }
       }
+      const snCreds = cfg.servicenow.username && (cfg.servicenow.password || cfg.servicenow.apiToken);
+      if (!snCreds) {
+        results.servicenow = { status: "blank", message: "not configured" };
+      } else if (!cfg.servicenow.baseUrl) {
+        results.servicenow = { status: "error", message: "baseUrl not configured" };
+      } else {
+        try {
+          await http.servicenow("/api/now/table/change_request", { params: { sysparm_limit: 1 }, timeoutMs: 1e4 });
+          results.servicenow = { status: "valid", message: "ok" };
+        } catch (err) {
+          results.servicenow = categorize2(err);
+        }
+      }
+      if (!cfg.contrast.apiKey || !cfg.contrast.serviceKey || !cfg.contrast.username) {
+        results.contrast = { status: "blank", message: "not configured" };
+      } else if (!cfg.contrast.orgUuid) {
+        results.contrast = { status: "error", message: "orgUuid not configured" };
+      } else {
+        try {
+          await http.contrast(`/Contrast/api/ng/${cfg.contrast.orgUuid}/applications`, { params: { limit: 1 }, timeoutMs: 1e4 });
+          results.contrast = { status: "valid", message: "ok" };
+        } catch (err) {
+          results.contrast = categorize2(err);
+        }
+      }
+      if (!cfg.sonatypeiq.userCode || !cfg.sonatypeiq.passcode) {
+        results.sonatypeiq = { status: "blank", message: "not configured" };
+      } else if (!cfg.sonatypeiq.baseUrl) {
+        results.sonatypeiq = { status: "error", message: "baseUrl not configured" };
+      } else {
+        try {
+          await http.sonatypeiq("/api/v2/applications", { params: { limit: 1 }, timeoutMs: 1e4 });
+          results.sonatypeiq = { status: "valid", message: "ok" };
+        } catch (err) {
+          results.sonatypeiq = categorize2(err);
+        }
+      }
       const statuses = Object.values(results).map((r) => r.status);
       if (statuses.includes("invalid")) process.exitCode = ExitCode.AUTH_ERROR;
       else if (statuses.includes("error")) process.exitCode = ExitCode.NETWORK_ERROR;
       if (cmdOpts.output === "table") {
-        const services = ["jira", "bitbucket", "confluence", "sonar", "sde", "ado", "jenkins", "udeploy", "artifactory", "checkmarx"];
+        const services = ["jira", "bitbucket", "confluence", "sonar", "sde", "ado", "jenkins", "udeploy", "artifactory", "checkmarx", "servicenow", "contrast", "sonatypeiq"];
         const labelWidth = 14;
         const statusWidth = 9;
         for (const svc of services) {
@@ -3816,7 +4346,7 @@ function registerConfigCommands(program2) {
         process.stdout.write("\n");
       } else {
         if (opts.pretty) {
-          const services = ["jira", "bitbucket", "confluence", "sonar", "sde", "ado", "jenkins", "udeploy", "artifactory", "checkmarx"];
+          const services = ["jira", "bitbucket", "confluence", "sonar", "sde", "ado", "jenkins", "udeploy", "artifactory", "checkmarx", "servicenow", "contrast", "sonatypeiq"];
           const labelWidth = 14;
           const statusWidth = 9;
           for (const svc of services) {
@@ -4149,6 +4679,155 @@ async function initGlobalConfig(start) {
       }
     }
   }
+  process.stderr.write("\n\u2500\u2500 ServiceNow \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+  const useServiceNow = await confirm({
+    message: "Configure ServiceNow for change management?",
+    default: false
+  });
+  let servicenowBaseUrl = "";
+  let servicenowUsername = "";
+  let servicenowPassword = "";
+  let servicenowApiToken = "";
+  if (useServiceNow) {
+    servicenowBaseUrl = await input({
+      message: "ServiceNow instance URL (e.g. https://mycompany.service-now.com):",
+      default: ""
+    });
+    servicenowUsername = await input({
+      message: "ServiceNow username:",
+      default: ""
+    });
+    const snUseToken = await confirm({
+      message: "Authenticate with an API token instead of a password?",
+      default: false
+    });
+    if (snUseToken) {
+      servicenowApiToken = await password({
+        message: "ServiceNow API token:",
+        validate: (v) => v.length > 0 || "Token cannot be blank"
+      });
+    } else {
+      servicenowPassword = await password({
+        message: "ServiceNow password:",
+        validate: (v) => v.length > 0 || "Password cannot be blank"
+      });
+    }
+    const snHasCreds = servicenowBaseUrl && servicenowUsername && (servicenowPassword || servicenowApiToken);
+    if (snHasCreds) {
+      process.stderr.write("\n  Verifying connection...\n");
+      try {
+        const tempConfig = {
+          ...loadConfig(),
+          servicenow: {
+            baseUrl: servicenowBaseUrl,
+            username: servicenowUsername,
+            password: servicenowPassword || void 0,
+            apiToken: servicenowApiToken || void 0
+          }
+        };
+        const tempHttp = createHttpClient(tempConfig);
+        await tempHttp.servicenow("/api/now/table/change_request", { params: { sysparm_limit: 1 } });
+        process.stderr.write("  Connected.\n");
+      } catch (err) {
+        warn(`Could not connect to ServiceNow: ${err instanceof Error ? err.message : String(err)}`);
+        warn("Config will be saved anyway. Check your URL and credentials and re-run pncli config init or pncli config test.");
+      }
+    }
+  }
+  process.stderr.write("\n\u2500\u2500 Sonatype IQ Server \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+  const useSonatypeIq = await confirm({
+    message: "Configure Sonatype IQ Server for dependency vulnerability scanning?",
+    default: false
+  });
+  let sonatypeIqBaseUrl = "";
+  let sonatypeIqUserCode = "";
+  let sonatypeIqPasscode = "";
+  if (useSonatypeIq) {
+    process.stderr.write("  User Token credentials are found in your IQ Server profile under User Token.\n");
+    sonatypeIqBaseUrl = await input({
+      message: "Sonatype IQ Server base URL (e.g. https://iq.your-company.com):",
+      default: ""
+    });
+    sonatypeIqUserCode = await input({
+      message: "User Code (from User Token):",
+      default: ""
+    });
+    sonatypeIqPasscode = await password({
+      message: "Passcode (from User Token):"
+    });
+    if (sonatypeIqBaseUrl && sonatypeIqUserCode && sonatypeIqPasscode) {
+      process.stderr.write("\n  Verifying connection...\n");
+      try {
+        const tempConfig = {
+          ...loadConfig(),
+          sonatypeiq: {
+            baseUrl: sonatypeIqBaseUrl,
+            userCode: sonatypeIqUserCode,
+            passcode: sonatypeIqPasscode
+          }
+        };
+        const tempHttp = createHttpClient(tempConfig);
+        await tempHttp.sonatypeiq("/api/v2/applications", { params: { limit: 1 } });
+        process.stderr.write("  Connected.\n");
+      } catch (err) {
+        warn(`Could not connect to Sonatype IQ Server: ${err instanceof Error ? err.message : String(err)}`);
+        warn("Config will be saved anyway. Check your URL and credentials and re-run pncli config init or pncli config test.");
+      }
+    }
+  }
+  process.stderr.write("\n\u2500\u2500 Contrast IAST \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+  const useContrast = await confirm({
+    message: "Configure Contrast Security IAST for vulnerability findings?",
+    default: false
+  });
+  let contrastBaseUrl = "";
+  let contrastOrgUuid = "";
+  let contrastUsername = "";
+  let contrastApiKey = "";
+  let contrastServiceKey = "";
+  if (useContrast) {
+    process.stderr.write("  Find your credentials in Contrast under User Settings \u2192 Your Keys.\n");
+    contrastBaseUrl = await input({
+      message: "Contrast base URL (leave blank for cloud: https://app.contrastsecurity.com):",
+      default: ""
+    });
+    contrastOrgUuid = await input({
+      message: "Organization UUID:",
+      default: ""
+    });
+    contrastUsername = await input({
+      message: "Username (email):",
+      default: ""
+    });
+    contrastApiKey = await password({
+      message: "API key:"
+    });
+    contrastServiceKey = await password({
+      message: "Service key:"
+    });
+    const contrastHasCreds = contrastOrgUuid && contrastUsername && contrastApiKey && contrastServiceKey;
+    if (contrastHasCreds) {
+      process.stderr.write("\n  Verifying connection...\n");
+      try {
+        const tempConfig = {
+          ...loadConfig(),
+          contrast: {
+            baseUrl: contrastBaseUrl || void 0,
+            orgUuid: contrastOrgUuid,
+            username: contrastUsername,
+            apiKey: contrastApiKey,
+            serviceKey: contrastServiceKey
+          }
+        };
+        const tempHttp = createHttpClient(tempConfig);
+        await tempHttp.contrast(`/Contrast/api/ng/${contrastOrgUuid}/applications`, { params: { limit: 1 } });
+        process.stderr.write("  Connected.\n");
+      } catch (err) {
+        warn(`Could not connect to Contrast: ${err instanceof Error ? err.message : String(err)}`);
+        warn("Config will be saved anyway. Check your credentials and re-run pncli config init or pncli config test.");
+      }
+    }
+  }
   process.stderr.write("\n\u2500\u2500 Defaults \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
   const jiraProject = await input({
     message: "Default Jira project key (optional):",
@@ -4242,6 +4921,30 @@ async function initGlobalConfig(start) {
         password: checkmarxPassword || void 0
       }
     } : {},
+    ...useServiceNow && servicenowBaseUrl ? {
+      servicenow: {
+        baseUrl: servicenowBaseUrl,
+        username: servicenowUsername || void 0,
+        ...servicenowApiToken ? { apiToken: servicenowApiToken } : {},
+        ...servicenowPassword ? { password: servicenowPassword } : {}
+      }
+    } : {},
+    ...useContrast && contrastOrgUuid ? {
+      contrast: {
+        ...contrastBaseUrl ? { baseUrl: contrastBaseUrl } : {},
+        orgUuid: contrastOrgUuid,
+        username: contrastUsername || void 0,
+        apiKey: contrastApiKey || void 0,
+        serviceKey: contrastServiceKey || void 0
+      }
+    } : {},
+    ...useSonatypeIq && sonatypeIqBaseUrl ? {
+      sonatypeiq: {
+        baseUrl: sonatypeIqBaseUrl,
+        userCode: sonatypeIqUserCode || void 0,
+        passcode: sonatypeIqPasscode || void 0
+      }
+    } : {},
     defaults: {
       jira: {
         project: jiraProject || void 0
@@ -4697,7 +5400,7 @@ function registerAdoWorkCommands(ado) {
       fail(err, "ado", "work-get", start);
     }
   });
-  work.command("create").description("Create a work item").requiredOption("--type <type>", "Work item type (e.g. Bug, Task, User Story)").requiredOption("--title <title>", "Work item title").option("--description <text>", "Description").option("--assignee <user>", "Assigned to (display name or email)").option("--priority <n>", "Priority (1-4)").option("--field <name=value>", "Additional field (repeatable)", (v, acc) => {
+  work.command("create").description("Create a work item").requiredOption("--type <type>", "Work item type (e.g. Bug, Task, User Story)").requiredOption("--title <title>", "Work item title").option("--description <text>", "Description").option("--assignee <user>", "Assigned to (display name or email)").option("--priority <n>", "Priority (1-4)").option("--parent <id>", "Parent work item ID \u2014 creates a parent link after creation").option("--field <name=value>", "Additional field (repeatable)", (v, acc) => {
     acc.push(v);
     return acc;
   }, []).action(async (opts) => {
@@ -4719,6 +5422,17 @@ function registerAdoWorkCommands(ado) {
       ];
       const data = await workClient.createWorkItem(collection, project, opts.type, patch);
       success(data, "ado", "work-create", start);
+      if (opts.parent) {
+        try {
+          const baseUrl = config.ado.baseUrl?.replace(/\/$/, "");
+          const targetUrl = `${baseUrl}/${encodeURIComponent(collection)}/_apis/wit/workitems/${opts.parent}`;
+          const linkPatch = [{ op: "add", path: "/relations/-", value: { rel: "System.LinkTypes.Hierarchy-Reverse", url: targetUrl } }];
+          await workClient.updateWorkItem(collection, data.id, linkPatch);
+        } catch (linkErr) {
+          warn(`Created #${data.id} but failed to link to parent ${opts.parent}: ${linkErr instanceof Error ? linkErr.message : linkErr}`);
+        }
+      }
+      return;
     } catch (err) {
       fail(err, "ado", "work-create", start);
     }
@@ -5135,11 +5849,11 @@ function registerAdoRepoCommands(ado) {
       const start = Date.now();
       try {
         const globalOpts = ado.optsWithGlobals();
-        const { loadConfig: lc } = await import("./config-PXL632ZX.js");
+        const { loadConfig: lc } = await import("./config-NCI2BTQG.js");
         const config = lc({ configPath: globalOpts.config });
         const { collection, project, repo: repo2, gitClient } = getAdoContext(ado, true);
         const { AdoCoreClient: AdoCoreClient2 } = await import("./core-SWYVXOQ4.js");
-        const { createHttpClient: createHttpClient2 } = await import("./http-TID3W235.js");
+        const { createHttpClient: createHttpClient2 } = await import("./http-L2P23H2D.js");
         const http = createHttpClient2(config, Boolean(globalOpts.dryRun));
         const coreClient = new AdoCoreClient2(http);
         const me = await coreClient.getConnectionData(collection);
@@ -5751,7 +6465,7 @@ var UdeployClient = class {
 };
 
 // src/services/udeploy/commands.ts
-var POLL_INTERVAL_MS = 5e3;
+var POLL_INTERVAL_MS2 = 5e3;
 var DEFAULT_TIMEOUT_MS = 10 * 60 * 1e3;
 function getClient8(program2) {
   const opts = program2.optsWithGlobals();
@@ -5862,7 +6576,7 @@ function registerUdeployCommands(program2) {
         if (elapsed >= timeoutMs) {
           throw new PncliError(`Timed out after ${timeoutMs}ms waiting for request ${requestId}`, 1);
         }
-        await sleep(POLL_INTERVAL_MS);
+        await sleep(POLL_INTERVAL_MS2);
         const status = await client.getRequestStatus(requestId);
         if (status.status === "CLOSED") {
           const outcome = { requestId, status: status.status, result: status.result, elapsed_ms: Date.now() - start };
@@ -6007,19 +6721,261 @@ function registerCheckmarxCommands(program2) {
   });
 }
 
+// src/services/servicenow/commands.ts
+function getHttp(program2) {
+  const opts = program2.optsWithGlobals();
+  const config = loadConfig({ configPath: opts.config });
+  if (!config.servicenow.baseUrl) throw new PncliError("ServiceNow not configured. Run: pncli config init");
+  return createHttpClient(config, Boolean(opts.dryRun));
+}
+function registerServiceNowCommands(program2) {
+  const sn = program2.command("servicenow").description("ServiceNow operations");
+  const change = sn.command("change").description("Change request operations");
+  change.command("list").description("List change requests").option("--state <state>", "Filter by state (e.g. -1=Pending, 1=Open, 2=Work in Progress, 3=Closed Complete)").option("--assigned-to <user>", "Filter by assigned user sys_id or display name").option("--limit <n>", "Maximum number of results", "25").option("--fields <fields>", "Comma-separated field names to return").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const http = getHttp(program2);
+      const params = {
+        sysparm_limit: opts.limit ? parseInt(opts.limit, 10) : 25,
+        sysparm_display_value: "true"
+      };
+      const sanitize = (v) => v.replace(/\^/g, "");
+      const queries = [];
+      if (opts.state !== void 0) queries.push(`state=${sanitize(opts.state)}`);
+      if (opts.assignedTo) queries.push(`assigned_to=${sanitize(opts.assignedTo)}`);
+      if (queries.length) params["sysparm_query"] = queries.join("^");
+      if (opts.fields) params["sysparm_fields"] = opts.fields;
+      const data = await http.servicenow("/api/now/table/change_request", { params });
+      success(data.result, "servicenow", "change list", start);
+    } catch (err) {
+      fail(err, "servicenow", "change list", start);
+    }
+  });
+  change.command("get").description("Get a change request by sys_id or number").requiredOption("--id <id>", "Change request sys_id or number (e.g. CHG0001234)").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const http = getHttp(program2);
+      if (opts.id.toUpperCase().startsWith("CHG")) {
+        const list = await http.servicenow("/api/now/table/change_request", {
+          params: { sysparm_query: `number=${opts.id}`, sysparm_display_value: "true", sysparm_limit: 1 }
+        });
+        if (!list.result.length) throw new PncliError(`Change request not found: ${opts.id}`, 1);
+        success(list.result[0], "servicenow", "change get", start);
+        return;
+      }
+      const data = await http.servicenow(`/api/now/table/change_request/${opts.id}`, {
+        params: { sysparm_display_value: "true" }
+      });
+      success(data.result, "servicenow", "change get", start);
+    } catch (err) {
+      fail(err, "servicenow", "change get", start);
+    }
+  });
+  change.command("create").description("Create a change request").requiredOption("--short-description <text>", "Short description (title)").option("--description <text>", "Full description").option("--type <type>", "Change type: normal, standard, or emergency", "normal").option("--priority <n>", "Priority: 1=Critical, 2=High, 3=Moderate, 4=Low").option("--assigned-to <user>", "Assigned user sys_id").option("--assignment-group <group>", "Assignment group sys_id").option("--start-date <datetime>", "Planned start date (yyyy-MM-dd HH:mm:ss)").option("--end-date <datetime>", "Planned end date (yyyy-MM-dd HH:mm:ss)").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const http = getHttp(program2);
+      const body = {
+        short_description: opts.shortDescription,
+        type: opts.type ?? "normal"
+      };
+      if (opts.description) body["description"] = opts.description;
+      if (opts.priority) body["priority"] = opts.priority;
+      if (opts.assignedTo) body["assigned_to"] = opts.assignedTo;
+      if (opts.assignmentGroup) body["assignment_group"] = opts.assignmentGroup;
+      if (opts.startDate) body["start_date"] = opts.startDate;
+      if (opts.endDate) body["end_date"] = opts.endDate;
+      const data = await http.servicenow("/api/now/table/change_request", {
+        method: "POST",
+        body
+      });
+      success(data.result, "servicenow", "change create", start);
+    } catch (err) {
+      fail(err, "servicenow", "change create", start);
+    }
+  });
+  change.command("update").description("Update a change request").requiredOption("--id <sys_id>", "Change request sys_id").option("--short-description <text>", "New short description").option("--description <text>", "New description").option("--state <state>", "New state value").option("--priority <n>", "New priority").option("--assigned-to <user>", "New assigned user sys_id").option("--start-date <datetime>", "New planned start date").option("--end-date <datetime>", "New planned end date").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const http = getHttp(program2);
+      const body = {};
+      if (opts.shortDescription) body["short_description"] = opts.shortDescription;
+      if (opts.description) body["description"] = opts.description;
+      if (opts.state !== void 0) body["state"] = opts.state;
+      if (opts.priority) body["priority"] = opts.priority;
+      if (opts.assignedTo) body["assigned_to"] = opts.assignedTo;
+      if (opts.startDate) body["start_date"] = opts.startDate;
+      if (opts.endDate) body["end_date"] = opts.endDate;
+      if (Object.keys(body).length === 0) throw new PncliError("No fields to update. Provide at least one option besides --id.", 1);
+      const data = await http.servicenow(`/api/now/table/change_request/${opts.id}`, {
+        method: "PATCH",
+        body
+      });
+      success(data.result, "servicenow", "change update", start);
+    } catch (err) {
+      fail(err, "servicenow", "change update", start);
+    }
+  });
+  change.command("close").description("Close a change request (state=3)").requiredOption("--id <sys_id>", "Change request sys_id").option("--close-notes <text>", "Closure notes").option("--close-code <code>", "Close code (e.g. successful, unsuccessful)").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const http = getHttp(program2);
+      const body = { state: 3 };
+      if (opts.closeNotes) body["close_notes"] = opts.closeNotes;
+      if (opts.closeCode) body["close_code"] = opts.closeCode;
+      const data = await http.servicenow(`/api/now/table/change_request/${opts.id}`, {
+        method: "PATCH",
+        body
+      });
+      success(data.result, "servicenow", "change close", start);
+    } catch (err) {
+      fail(err, "servicenow", "change close", start);
+    }
+  });
+}
+
+// src/services/contrast/commands.ts
+function getHttpAndOrg(program2) {
+  const opts = program2.optsWithGlobals();
+  const config = loadConfig({ configPath: opts.config });
+  if (!config.contrast.apiKey || !config.contrast.serviceKey || !config.contrast.username) throw new PncliError("Contrast not configured. Run: pncli config init");
+  if (!config.contrast.orgUuid) throw new PncliError("Contrast org UUID not configured. Run: pncli config set contrast.orgUuid <uuid>");
+  const http = createHttpClient(config, Boolean(opts.dryRun));
+  return { http, orgUuid: config.contrast.orgUuid };
+}
+function registerContrastCommands(program2) {
+  const contrast = program2.command("contrast").description("Contrast IAST operations");
+  const apps = contrast.command("apps").description("Application operations");
+  apps.command("list").description("List applications in the organization").option("--limit <n>", "Maximum number of results", "25").option("--offset <n>", "Pagination offset", "0").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const { http, orgUuid } = getHttpAndOrg(program2);
+      const data = await http.contrast(`/Contrast/api/ng/${orgUuid}/applications`, {
+        params: {
+          limit: opts.limit ? parseInt(opts.limit, 10) : 25,
+          offset: opts.offset ? parseInt(opts.offset, 10) : 0
+        }
+      });
+      success(data, "contrast", "apps list", start);
+    } catch (err) {
+      fail(err, "contrast", "apps list", start);
+    }
+  });
+  const findings = contrast.command("findings").description("Vulnerability findings operations");
+  findings.command("list").description("List vulnerability findings for an application").requiredOption("--app <app-id>", "Application ID (UUID)").option("--severity <level>", "Filter by severity: CRITICAL, HIGH, MEDIUM, LOW, NOTE").option("--status <status>", "Filter by status: REPORTED, CONFIRMED, SUSPICIOUS, NOT_A_PROBLEM, REMEDIATED, FIXED").option("--limit <n>", "Maximum number of results", "25").option("--offset <n>", "Pagination offset", "0").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const { http, orgUuid } = getHttpAndOrg(program2);
+      const params = {
+        limit: opts.limit ? parseInt(opts.limit, 10) : 25,
+        offset: opts.offset ? parseInt(opts.offset, 10) : 0
+      };
+      if (opts.severity) params["severities"] = opts.severity;
+      if (opts.status) params["statuses"] = opts.status;
+      const data = await http.contrast(
+        `/Contrast/api/ng/${orgUuid}/traces/${opts.app}/filter`,
+        { params }
+      );
+      success(data, "contrast", "findings list", start);
+    } catch (err) {
+      fail(err, "contrast", "findings list", start);
+    }
+  });
+  findings.command("get").description("Get details for a specific vulnerability finding").requiredOption("--app <app-id>", "Application ID (UUID)").requiredOption("--trace <trace-id>", "Trace/finding UUID").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const { http, orgUuid } = getHttpAndOrg(program2);
+      const data = await http.contrast(
+        `/Contrast/api/ng/${orgUuid}/traces/${opts.app}/trace/${opts.trace}`
+      );
+      success(data, "contrast", "findings get", start);
+    } catch (err) {
+      fail(err, "contrast", "findings get", start);
+    }
+  });
+}
+
+// src/services/sonatypeiq/commands.ts
+function getHttpClient(program2) {
+  const opts = program2.optsWithGlobals();
+  const config = loadConfig({ configPath: opts.config });
+  if (!config.sonatypeiq.baseUrl) throw new PncliError("Sonatype IQ Server baseUrl not configured. Run: pncli config init");
+  if (!config.sonatypeiq.userCode || !config.sonatypeiq.passcode) throw new PncliError("Sonatype IQ Server credentials not configured. Run: pncli config init");
+  const http = createHttpClient(config, Boolean(opts.dryRun));
+  return http;
+}
+function registerSonatypeIqCommands(program2) {
+  const sonatypeiq = program2.command("sonatypeiq").description("Sonatype IQ Server operations");
+  const applications = sonatypeiq.command("applications").description("Application operations");
+  applications.command("list").description("List all applications in Sonatype IQ Server").option("--organization-id <id>", "Filter by organization ID").action(async (opts) => {
+    const startTime = Date.now();
+    try {
+      const http = getHttpClient(program2);
+      const params = {};
+      if (opts.organizationId) params["organizationId"] = opts.organizationId;
+      const data = await http.sonatypeiq("/api/v2/applications", { params });
+      success(data, "sonatypeiq", "applications list", startTime);
+    } catch (err) {
+      fail(err, "sonatypeiq", "applications list", startTime);
+    }
+  });
+  applications.command("get").description("Get an application by its public ID").requiredOption("--public-id <id>", "Application public ID").action(async (opts) => {
+    const startTime = Date.now();
+    try {
+      const http = getHttpClient(program2);
+      const data = await http.sonatypeiq("/api/v2/applications", {
+        params: { publicId: opts.publicId }
+      });
+      success(data, "sonatypeiq", "applications get", startTime);
+    } catch (err) {
+      fail(err, "sonatypeiq", "applications get", startTime);
+    }
+  });
+  const organizations = sonatypeiq.command("organizations").description("Organization operations");
+  organizations.command("list").description("List all organizations in Sonatype IQ Server").action(async () => {
+    const startTime = Date.now();
+    try {
+      const http = getHttpClient(program2);
+      const data = await http.sonatypeiq("/api/v2/organizations");
+      success(data, "sonatypeiq", "organizations list", startTime);
+    } catch (err) {
+      fail(err, "sonatypeiq", "organizations list", startTime);
+    }
+  });
+  const policies = sonatypeiq.command("policies").description("Policy operations");
+  policies.command("list").description("List all policies").option("--organization-id <id>", "Filter by organization ID").action(async (opts) => {
+    const startTime = Date.now();
+    try {
+      const http = getHttpClient(program2);
+      const path6 = opts.organizationId ? `/api/v2/policies/organization/${encodeURIComponent(opts.organizationId)}` : "/api/v2/policies";
+      const data = await http.sonatypeiq(path6);
+      success(data, "sonatypeiq", "policies list", startTime);
+    } catch (err) {
+      fail(err, "sonatypeiq", "policies list", startTime);
+    }
+  });
+}
+
 // src/services/skills/commands.ts
 import fs3 from "fs";
 import path5 from "path";
 import os from "os";
-var GITHUB_API = "https://api.github.com/repos/kolatts/pncli/contents/skills";
-var RAW_BASE = "https://raw.githubusercontent.com/kolatts/pncli/main/skills";
+import { fileURLToPath } from "url";
 var AGENT_PATHS = {
   "github-copilot": { project: ".agents/skills", user: path5.join(os.homedir(), ".copilot/skills") },
   "claude-code": { project: ".claude/skills", user: path5.join(os.homedir(), ".claude/skills") }
 };
+function getBundledSkillsDir() {
+  try {
+    const thisFile = fileURLToPath(import.meta.url);
+    return path5.resolve(path5.dirname(thisFile), "..", "skills");
+  } catch {
+    return "";
+  }
+}
 function registerSkillsCommands(program2) {
   const skills = program2.command("skills").description("Manage pncli Claude Code skills");
-  skills.command("install").description("Download latest pncli skills into the current repo").option("--agent <agent>", "Target agent host: github-copilot | claude-code", "github-copilot").option("--scope <scope>", "Installation scope: project | user", "project").option("--target <dir>", "Override install directory (ignores --agent and --scope)").action(async (opts) => {
+  skills.command("install").description("Install pncli skills into the current repo").option("--agent <agent>", "Target agent host: github-copilot | claude-code", "github-copilot").option("--scope <scope>", "Installation scope: project | user", "project").option("--target <dir>", "Override install directory (ignores --agent and --scope)").action((opts) => {
     const start = Date.now();
     try {
       let targetDir;
@@ -6033,19 +6989,22 @@ function registerSkillsCommands(program2) {
         const scopePath = opts.scope === "user" ? agentConfig.user : agentConfig.project;
         targetDir = path5.resolve(scopePath);
       }
-      warn("Fetching skill list from GitHub...");
-      const listRes = await fetch(GITHUB_API, {
-        headers: { "Accept": "application/vnd.github.v3+json", "User-Agent": "pncli" }
-      });
-      if (!listRes.ok) {
-        throw new Error(`GitHub API returned ${listRes.status}: ${await listRes.text()}`);
+      const resolvedTarget = path5.resolve(targetDir);
+      const bundledDir = getBundledSkillsDir();
+      let skillDirs = [];
+      if (bundledDir !== "") {
+        try {
+          skillDirs = fs3.readdirSync(bundledDir).filter(
+            (name) => fs3.existsSync(path5.join(bundledDir, name, "SKILL.md"))
+          );
+        } catch {
+        }
       }
-      const entries = await listRes.json();
-      const skillDirs = entries.filter((e) => e.type === "dir").map((e) => e.name);
       if (skillDirs.length === 0) {
-        throw new Error("No skills found in the pncli repository");
+        throw new Error("No bundled skills found. Reinstall pncli to get the latest version: npm install -g @kolatts/pncli");
       }
-      const resolvedTarget = path5.resolve(targetDir);
+      const installed = [];
+      const failed = [];
       for (const skillName of skillDirs) {
         const existingDir = path5.resolve(targetDir, skillName);
         if (!existingDir.startsWith(resolvedTarget + path5.sep)) continue;
@@ -6053,25 +7012,15 @@ function registerSkillsCommands(program2) {
           fs3.rmSync(existingDir, { recursive: true, force: true });
         }
       }
-      warn(`Found ${skillDirs.length} skills. Downloading to ${targetDir}...`);
-      const installed = [];
-      const failed = [];
+      warn(`Installing ${skillDirs.length} bundled skill(s) to ${targetDir}...`);
       for (const skillName of skillDirs) {
         const skillDir = path5.resolve(targetDir, skillName);
         if (!skillDir.startsWith(resolvedTarget + path5.sep)) {
           failed.push(skillName);
           continue;
         }
-        const skillUrl = `${RAW_BASE}/${skillName}/SKILL.md`;
         try {
-          const res = await fetch(skillUrl, {
-            headers: { "User-Agent": "pncli" }
-          });
-          if (!res.ok) {
-            failed.push(skillName);
-            continue;
-          }
-          const content = await res.text();
+          const content = fs3.readFileSync(path5.join(bundledDir, skillName, "SKILL.md"), "utf8");
           fs3.mkdirSync(skillDir, { recursive: true });
           fs3.writeFileSync(path5.join(skillDir, "SKILL.md"), content, "utf8");
           installed.push(skillName);
@@ -6081,7 +7030,7 @@ function registerSkillsCommands(program2) {
       }
       warn(`Installed ${installed.length} skill(s) to ${targetDir}`);
       if (failed.length > 0) {
-        warn(`Failed to download: ${failed.join(", ")}`);
+        warn(`Failed to install: ${failed.join(", ")}`);
       }
       success({
         installed,
@@ -6089,7 +7038,8 @@ function registerSkillsCommands(program2) {
         target: targetDir,
         total: installed.length,
         agent: opts.target ? "custom" : opts.agent,
-        scope: opts.target ? "custom" : opts.scope
+        scope: opts.target ? "custom" : opts.scope,
+        source: "bundled"
       }, "skills", "install", start);
     } catch (err) {
       fail(err, "skills", "install", start);
@@ -6165,7 +7115,7 @@ if (!process.env.PNCLI_VERIFY_TLS) {
 var require2 = createRequire(import.meta.url);
 var pkg = require2("../package.json");
 var TAGLINE = "One command does what three meetings couldn't.";
-var program = new Command();
+var program = new Command2();
 program.name("pncli").description(`The Paperwork Nightmare CLI \u2014 ${TAGLINE}`).version(`${pkg.version} \u2014 ${TAGLINE}`, "-v, --version").option("--pretty", "Human-readable formatted output", false).option("--verbose", "Include full response metadata", false).option("--dry-run", "Print API requests without executing", false).option("--config <path>", "Override global config file location").option("--output-file <path>", "Write JSON output to file instead of stdout");
 program.hook("preAction", (thisCommand) => {
   const opts = thisCommand.optsWithGlobals();
@@ -6193,6 +7143,9 @@ registerJenkinsCommands(program);
 registerArtifactoryCommands(program);
 registerUdeployCommands(program);
 registerCheckmarxCommands(program);
+registerServiceNowCommands(program);
+registerContrastCommands(program);
+registerSonatypeIqCommands(program);
 registerSkillsCommands(program);
 program.addHelpText("after", `
 Services:
@@ -6208,6 +7161,9 @@ Services:
   artifactory  Artifactory (repos, artifact search, build info, properties)
   udeploy      IBM UrbanCode Deploy (component versions, deployment processes)
   checkmarx    Checkmarx CxSAST (projects, scans, scan statistics)
+  servicenow   ServiceNow (change requests)
+  contrast     Contrast IAST (applications, vulnerability findings)
+  sonatypeiq   Sonatype IQ Server (applications, organizations, policies)
   config       Manage pncli configuration
   skills       Download and manage Claude Code skills
 `);