@kolatts/pncli 1.8.0 → 1.9.0

package/dist/cli.js

@@ -7,7 +7,7 @@ import {
   setRepoConfigValue,
   writeGlobalConfig,
   writeRepoConfig
-} from "./chunk-S4SJLY4M.js";
+} from "./chunk-YR6GFJMV.js";
 import {
   ExitCode,
   PncliError,
@@ -18,13 +18,13 @@ import {
   setGlobalUser,
   success,
   warn
-} from "./chunk-QQ7UKWTU.js";
+} from "./chunk-QQZJQ5DP.js";
 import {
   AdoCoreClient
 } from "./chunk-VDL32PSG.js";
 
 // src/cli.ts
-import { Command } from "commander";
+import { Command as Command2 } from "commander";
 import { createRequire } from "module";
 
 // src/services/git/client.ts
@@ -771,7 +771,7 @@ function registerJiraCommands(program2) {
       fail(err, "jira", "get-issue", start);
     }
   });
-  jira.command("create-issue").description("Create a Jira issue").option("--project <key>", "Project key").option("--type <type>", "Issue type (Bug, Story, Task, ...)").requiredOption("--summary <text>", "Issue summary").option("--description <text>", "Issue description").option("--priority <name>", "Priority name").option("--assignee <accountId>", "Assignee account ID").option("--labels <labels>", "Comma-separated labels").option("--field <Name=value>", "Custom field value (repeatable)", (val, acc) => [...acc, val], []).action(async (opts) => {
+  jira.command("create-issue").description("Create a Jira issue").option("--project <key>", "Project key").option("--type <type>", "Issue type (Bug, Story, Task, ...)").requiredOption("--summary <text>", "Issue summary").option("--description <text>", "Issue description").option("--priority <name>", "Priority name").option("--assignee <accountId>", "Assignee account ID").option("--labels <labels>", "Comma-separated labels").option("--parent <key>", 'Parent issue key \u2014 creates an "is child of" link after creation').option("--field <Name=value>", "Custom field value (repeatable)", (val, acc) => [...acc, val], []).action(async (opts) => {
     const start = Date.now();
     try {
       const { client, fieldMap } = getClientAndFields(program2);
@@ -784,6 +784,14 @@ function registerJiraCommands(program2) {
       const customFieldValues = parseFieldArgs(opts.field, fieldMap);
       const data = await client.createIssue({ project, issueType, summary: opts.summary, description: opts.description, priority, assignee: opts.assignee, labels, customFieldValues });
       success(data, "jira", "create-issue", start);
+      if (opts.parent) {
+        try {
+          await client.linkIssue({ key: data.key, linkType: "is child of", target: opts.parent });
+        } catch (linkErr) {
+          warn(`Created ${data.key} but failed to link to parent ${opts.parent}: ${linkErr instanceof Error ? linkErr.message : linkErr}`);
+        }
+      }
+      return;
     } catch (err) {
       fail(err, "jira", "create-issue", start);
     }
@@ -2039,6 +2047,9 @@ function registerSdeCommands(program2) {
   });
 }
 
+// src/services/deps/commands.ts
+import { Option } from "commander";
+
 // src/services/deps/parsers/index.ts
 import fs from "fs";
 import path4 from "path";
@@ -2893,11 +2904,128 @@ async function checkPackagesForVulns(packages) {
   return allVulnerable;
 }
 
-// src/services/deps/clients/artifactory.ts
-var TIMEOUT_MS2 = 15e3;
-async function fetchWithTimeout2(url, token) {
+// src/services/deps/clients/sonatype.ts
+var SONATYPE_URL = "https://ossindex.sonatype.org";
+var BATCH_SIZE2 = 128;
+var TIMEOUT_MS2 = 3e4;
+async function fetchWithTimeout2(url, init) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), TIMEOUT_MS2);
+  try {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function toPurl(pkg2) {
+  switch (pkg2.ecosystem) {
+    case "npm": {
+      const encodedName = pkg2.name.startsWith("@") ? pkg2.name.replace("@", "%40") : pkg2.name;
+      return `pkg:npm/${encodedName}@${pkg2.version}`;
+    }
+    case "nuget":
+      return `pkg:nuget/${pkg2.name}@${pkg2.version}`;
+    case "maven": {
+      const colonIdx = pkg2.name.indexOf(":");
+      if (colonIdx !== -1) {
+        const groupId = pkg2.name.slice(0, colonIdx);
+        const artifactId = pkg2.name.slice(colonIdx + 1);
+        return `pkg:maven/${encodeURIComponent(groupId)}/${encodeURIComponent(artifactId)}@${pkg2.version}`;
+      }
+      return `pkg:maven/${encodeURIComponent(pkg2.name)}@${pkg2.version}`;
+    }
+    default:
+      return `pkg:generic/${encodeURIComponent(pkg2.name)}@${pkg2.version}`;
+  }
+}
+function inferSeverityFromCvss2(score) {
+  if (score >= 9) return "CRITICAL";
+  if (score >= 7) return "HIGH";
+  if (score >= 4) return "MEDIUM";
+  if (score > 0) return "LOW";
+  return "UNKNOWN";
+}
+function mapSonatypeVuln(v, pkg2) {
+  const refs = [v.reference, ...v.externalReferences ?? []].filter(Boolean);
+  const advice = `See ${v.reference} for remediation details for ${pkg2.name}@${pkg2.version}.`;
+  const cvePattern = /CVE-\d{4}-\d+/gi;
+  const searchText = [v.displayName, v.title, v.description].filter(Boolean).join(" ");
+  const aliases = [...new Set([...searchText.matchAll(cvePattern)].map((m) => m[0].toUpperCase()))];
+  return {
+    id: v.displayName || v.id,
+    summary: v.title || v.description,
+    severity: inferSeverityFromCvss2(v.cvssScore),
+    cvss: v.cvssScore > 0 ? v.cvssScore : null,
+    aliases,
+    remediation: {
+      fixAvailable: false,
+      fixedVersions: [],
+      advice
+    },
+    references: refs
+  };
+}
+async function queryBatch2(purls, packages) {
+  const res = await fetchWithTimeout2(`${SONATYPE_URL}/api/v3/component-report`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "application/json" },
+    body: JSON.stringify({ coordinates: purls })
+  });
+  if (res.status === 429) {
+    throw new Error(
+      "Sonatype OSS Index is rate-limiting requests from this IP. Create a free account at ossindex.sonatype.org and add your credentials to your pncli config to raise the limit."
+    );
+  }
+  if (!res.ok) {
+    throw new Error(`Sonatype OSS Index returned HTTP ${res.status}`);
+  }
+  const reports = await res.json();
+  const vulnerable = [];
+  const purlToPackage = /* @__PURE__ */ new Map();
+  for (let i = 0; i < purls.length; i++) {
+    purlToPackage.set(purls[i], packages[i]);
+  }
+  for (const report of reports) {
+    if (!report?.coordinates) continue;
+    const pkg2 = purlToPackage.get(report.coordinates);
+    if (!pkg2) continue;
+    const vulns = report.vulnerabilities ?? [];
+    if (vulns.length === 0) continue;
+    vulnerable.push({ ...pkg2, vulnerabilities: vulns.map((v) => mapSonatypeVuln(v, pkg2)) });
+  }
+  return vulnerable;
+}
+async function checkSonatypeConnectivity() {
+  try {
+    const res = await fetchWithTimeout2(`${SONATYPE_URL}/api/v3/component-report`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Accept: "application/json" },
+      body: JSON.stringify({ coordinates: [] })
+    });
+    return { reachable: res.ok || res.status === 400 };
+  } catch (err) {
+    return {
+      reachable: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+async function checkPackagesForVulnsViaSonatype(packages) {
+  const allVulnerable = [];
+  for (let i = 0; i < packages.length; i += BATCH_SIZE2) {
+    const chunk = packages.slice(i, i + BATCH_SIZE2);
+    const purls = chunk.map(toPurl);
+    const results = await queryBatch2(purls, chunk);
+    allVulnerable.push(...results);
+  }
+  return allVulnerable;
+}
+
+// src/services/deps/clients/artifactory.ts
+var TIMEOUT_MS3 = 15e3;
+async function fetchWithTimeout3(url, token) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS3);
   try {
     return await fetch(url, {
       headers: { Authorization: `Bearer ${token}` },
@@ -2933,7 +3061,7 @@ async function checkArtifactoryConnectivity(config) {
     };
   }
   try {
-    const res = await fetchWithTimeout2(`${config.baseUrl}/api/system/ping`, config.token);
+    const res = await fetchWithTimeout3(`${config.baseUrl}/api/system/ping`, config.token);
     if (res.status === 401 || res.status === 403) {
       return {
         reachable: true,
@@ -2983,7 +3111,7 @@ function repoForEcosystem(config, eco) {
 async function getLatestNpm(baseUrl, token, repoName, packageName) {
   try {
     const encoded = packageName.startsWith("@") ? packageName.replace("/", "%2F") : packageName;
-    const res = await fetchWithTimeout2(`${baseUrl}/api/npm/${repoName}/${encoded}`, token);
+    const res = await fetchWithTimeout3(`${baseUrl}/api/npm/${repoName}/${encoded}`, token);
     if (!res.ok) return null;
     const data = await res.json();
     return data["dist-tags"]?.latest ?? null;
@@ -2994,7 +3122,7 @@ async function getLatestNpm(baseUrl, token, repoName, packageName) {
 async function getLatestNuget(baseUrl, token, repoName, packageName) {
   try {
     const lower = packageName.toLowerCase();
-    const res = await fetchWithTimeout2(
+    const res = await fetchWithTimeout3(
       `${baseUrl}/api/nuget/v3/${repoName}/flatcontainer/${lower}/index.json`,
       token
     );
@@ -3010,7 +3138,7 @@ async function getLatestMaven(baseUrl, token, repoName, packageName) {
   const [groupId, artifactId] = packageName.split(":");
   if (!groupId || !artifactId) return null;
   try {
-    const res = await fetchWithTimeout2(
+    const res = await fetchWithTimeout3(
       `${baseUrl}/api/search/latestVersion?g=${encodeURIComponent(groupId)}&a=${encodeURIComponent(artifactId)}&repos=${repoName}`,
       token
     );
@@ -3060,7 +3188,7 @@ async function getOutdatedPackages(packages, config, filterType) {
 async function getLicenseNpm(baseUrl, token, repoName, packageName) {
   try {
     const encoded = packageName.startsWith("@") ? packageName.replace("/", "%2F") : packageName;
-    const res = await fetchWithTimeout2(`${baseUrl}/api/npm/${repoName}/${encoded}`, token);
+    const res = await fetchWithTimeout3(`${baseUrl}/api/npm/${repoName}/${encoded}`, token);
     if (!res.ok) return null;
     const data = await res.json();
     if (typeof data.license === "string") return data.license;
@@ -3073,7 +3201,7 @@ async function getLicenseNpm(baseUrl, token, repoName, packageName) {
 async function getLicenseNuget(baseUrl, token, repoName, packageName, version) {
   try {
     const lower = packageName.toLowerCase();
-    const res = await fetchWithTimeout2(
+    const res = await fetchWithTimeout3(
       `${baseUrl}/api/nuget/v3/${repoName}/registration/${lower}/${version}.json`,
       token
     );
@@ -3125,15 +3253,20 @@ async function detectTier(config) {
   cachedTier = { tier, osvReachable, artifactoryReachable };
   return cachedTier;
 }
+async function checkSonatypeReachable() {
+  const result = await checkSonatypeConnectivity();
+  return result.reachable;
+}
 async function buildConnectivityData(config) {
-  const [osvResult, artResult] = await Promise.all([
+  const [osvResult, artResult, sonatypeResult] = await Promise.all([
     checkOsvConnectivity(),
-    checkArtifactoryConnectivity(config.artifactory)
+    checkArtifactoryConnectivity(config.artifactory),
+    checkSonatypeConnectivity()
   ]);
   const artCfg = config.artifactory;
   let tier = "local";
   if (artResult.reachable && artResult.authenticated) tier = "artifactory";
-  if (osvResult.reachable) tier = "full";
+  if (osvResult.reachable || sonatypeResult.reachable) tier = "full";
   cachedTier = {
     tier,
     osvReachable: osvResult.reachable,
@@ -3156,46 +3289,134 @@ async function buildConnectivityData(config) {
       url: "https://api.osv.dev",
       ...osvResult.error ? { error: osvResult.error } : {}
     },
+    sonatype: {
+      reachable: sonatypeResult.reachable,
+      url: "https://ossindex.sonatype.org",
+      ...sonatypeResult.error ? { error: sonatypeResult.error } : {}
+    },
     tier,
     capabilities: {
       scan: true,
       diff: true,
       outdated: artResult.reachable && artResult.authenticated,
       licenseCheck: artResult.reachable && artResult.authenticated,
-      cveCheck: osvResult.reachable
+      cveCheck: osvResult.reachable || sonatypeResult.reachable
     }
   };
 }
 
 // src/services/deps/frisk.ts
-async function runFrisk(config, opts) {
+function toErrorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+async function runFrisk(config, opts, source = "osv") {
   const repoRoot = getRepoRoot();
   if (!repoRoot) {
     throw new PncliError("Not inside a git repository.", 1);
   }
-  const { tier, osvReachable } = await detectTier(config);
-  if (!osvReachable) {
+  const { tier: baseTier, osvReachable } = await detectTier(config);
+  const sonatypeReachable = source !== "osv" ? await checkSonatypeReachable() : false;
+  const tier = sonatypeReachable ? "full" : baseTier;
+  if (source === "osv" && !osvReachable) {
     throw new PncliError(
       "deps frisk requires OSV.dev access but api.osv.dev is not reachable from this machine. Run 'pncli deps connectivity' to diagnose.",
       503
     );
   }
+  if (source === "sonatype" && !sonatypeReachable) {
+    throw new PncliError(
+      "deps frisk --source sonatype requires Sonatype OSS Index access but ossindex.sonatype.org is not reachable from this machine. Run 'pncli deps connectivity' to diagnose.",
+      503
+    );
+  }
+  if (source === "all" && !osvReachable && !sonatypeReachable) {
+    throw new PncliError(
+      "deps frisk requires either OSV.dev or Sonatype OSS Index access, but neither is reachable from this machine. Run 'pncli deps connectivity' to diagnose.",
+      503
+    );
+  }
+  const sourceErrors = [];
+  let sourcesQueried;
+  if (source === "all") {
+    if (!osvReachable) sourceErrors.push({ source: "osv", error: "api.osv.dev is not reachable \u2014 run pncli deps connectivity to diagnose." });
+    if (!sonatypeReachable) sourceErrors.push({ source: "sonatype", error: "ossindex.sonatype.org is not reachable \u2014 run pncli deps connectivity to diagnose." });
+    sourcesQueried = [
+      ...osvReachable ? ["osv"] : [],
+      ...sonatypeReachable ? ["sonatype"] : []
+    ];
+  } else {
+    sourcesQueried = [source];
+  }
   const scanOpts = {
     ...opts,
     includeTransitive: opts.includeTransitive ?? true
   };
   const scan = scanRepo(repoRoot, scanOpts);
   if (scan.packages.length === 0) {
-    return { tier, scanned: 0, vulnerable: 0, packages: [] };
+    return { tier, source, sourcesQueried, sourceErrors, scanned: 0, vulnerable: 0, packages: [] };
+  }
+  let vulnerable;
+  if (source === "sonatype") {
+    vulnerable = await checkPackagesForVulnsViaSonatype(scan.packages);
+  } else if (source === "all") {
+    const [osvSettled, sonatypeSettled] = await Promise.allSettled([
+      osvReachable ? checkPackagesForVulns(scan.packages) : Promise.resolve([]),
+      sonatypeReachable ? checkPackagesForVulnsViaSonatype(scan.packages) : Promise.resolve([])
+    ]);
+    if (osvReachable) {
+      if (osvSettled.status === "rejected") {
+        sourceErrors.push({ source: "osv", error: toErrorMessage(osvSettled.reason) });
+        sourcesQueried = sourcesQueried.filter((s) => s !== "osv");
+      }
+    }
+    if (sonatypeReachable) {
+      if (sonatypeSettled.status === "rejected") {
+        sourceErrors.push({ source: "sonatype", error: toErrorMessage(sonatypeSettled.reason) });
+        sourcesQueried = sourcesQueried.filter((s) => s !== "sonatype");
+      }
+    }
+    if (sourcesQueried.length === 0) {
+      throw new PncliError(
+        "All vulnerability sources failed during scanning. Run 'pncli deps connectivity' to diagnose.",
+        503
+      );
+    }
+    vulnerable = mergeVulnerablePackages(
+      osvSettled.status === "fulfilled" ? osvSettled.value : [],
+      sonatypeSettled.status === "fulfilled" ? sonatypeSettled.value : []
+    );
+  } else {
+    vulnerable = await checkPackagesForVulns(scan.packages);
   }
-  const vulnerable = await checkPackagesForVulns(scan.packages);
   return {
     tier,
+    source,
+    sourcesQueried,
+    sourceErrors,
     scanned: scan.packages.length,
     vulnerable: vulnerable.length,
     packages: vulnerable
   };
 }
+function mergeVulnerablePackages(osvResults, sonatypeResults) {
+  const byKey = /* @__PURE__ */ new Map();
+  for (const pkg2 of osvResults) {
+    const key = `${pkg2.ecosystem}:${pkg2.name}@${pkg2.version}`;
+    byKey.set(key, { ...pkg2 });
+  }
+  for (const pkg2 of sonatypeResults) {
+    const key = `${pkg2.ecosystem}:${pkg2.name}@${pkg2.version}`;
+    const existing = byKey.get(key);
+    if (existing) {
+      const existingIds = new Set(existing.vulnerabilities.map((v) => v.id));
+      const newVulns = pkg2.vulnerabilities.filter((v) => !existingIds.has(v.id));
+      existing.vulnerabilities = [...existing.vulnerabilities, ...newVulns];
+    } else {
+      byKey.set(key, { ...pkg2 });
+    }
+  }
+  return [...byKey.values()];
+}
 
 // src/services/deps/outdated.ts
 async function runOutdated(config, opts, filterType) {
@@ -3270,7 +3491,7 @@ async function runLicenseCheck(config, opts) {
 // src/services/deps/commands.ts
 function registerDepsCommands(program2) {
   const deps = program2.command("deps").description("Dependency scanning, CVE detection, and license auditing");
-  deps.command("frisk").description("Scan all dependencies for CVEs and output remediation paths (requires OSV.dev)").option("--ecosystem <ecosystem>", "Filter to one ecosystem: npm, nuget, maven, all", "all").option("--direct-only", "Only scan direct dependencies (default: include transitive)", false).option("--include-dev", "Include dev/test dependencies", false).action(async (opts, cmd) => {
+  deps.command("frisk").description("Scan all dependencies for CVEs and output remediation paths (requires OSV.dev or Sonatype OSS Index)").option("--ecosystem <ecosystem>", "Filter to one ecosystem: npm, nuget, maven, all", "all").option("--direct-only", "Only scan direct dependencies (default: include transitive)", false).option("--include-dev", "Include dev/test dependencies", false).addOption(new Option("--source <source>", "Vulnerability source").choices(["osv", "sonatype", "all"]).default("osv")).action(async (opts, cmd) => {
     const startTime = Date.now();
     try {
       const globalOpts = cmd.optsWithGlobals();
@@ -3280,7 +3501,7 @@ function registerDepsCommands(program2) {
         includeTransitive: !opts.directOnly,
         includeDev: opts.includeDev
       };
-      const data = await runFrisk(config, scanOpts);
+      const data = await runFrisk(config, scanOpts, opts.source);
       success(data, "deps", "frisk", startTime);
     } catch (err) {
       fail(err, "deps", "frisk", startTime);
@@ -3346,7 +3567,7 @@ function registerDepsCommands(program2) {
       fail(err, "deps", "license-check", startTime);
     }
   });
-  deps.command("connectivity").description("Test network access to Artifactory and OSV.dev, report available tier").action(async (_opts, cmd) => {
+  deps.command("connectivity").description("Test network access to Artifactory, OSV.dev, and Sonatype OSS Index, report available tier").action(async (_opts, cmd) => {
     const startTime = Date.now();
     try {
       const globalOpts = cmd.optsWithGlobals();
@@ -3652,6 +3873,27 @@ function registerConfigCommands(program2) {
       } else {
         results.checkmarx = { ok: null, message: "not configured" };
       }
+      const snConfigured = cfg.servicenow.baseUrl && cfg.servicenow.username && (cfg.servicenow.password || cfg.servicenow.apiToken);
+      if (snConfigured) {
+        try {
+          await http.servicenow("/api/now/table/change_request", { params: { sysparm_limit: 1 } });
+          results.servicenow = { ok: true, message: "connected" };
+        } catch (err) {
+          results.servicenow = { ok: false, message: err instanceof Error ? err.message : String(err) };
+        }
+      } else {
+        results.servicenow = { ok: null, message: "not configured" };
+      }
+      if (cfg.contrast.apiKey && cfg.contrast.serviceKey && cfg.contrast.username && cfg.contrast.orgUuid) {
+        try {
+          await http.contrast(`/Contrast/api/ng/${cfg.contrast.orgUuid}/applications`, { params: { limit: 1 } });
+          results.contrast = { ok: true, message: "connected" };
+        } catch (err) {
+          results.contrast = { ok: false, message: err instanceof Error ? err.message : String(err) };
+        }
+      } else {
+        results.contrast = { ok: null, message: "not configured" };
+      }
       success(results, "config", "test", start);
     } catch (err) {
       fail(err, "config", "test", start);
@@ -3798,11 +4040,36 @@ function registerConfigCommands(program2) {
           results.checkmarx = categorize2(err);
         }
       }
+      const snCreds = cfg.servicenow.username && (cfg.servicenow.password || cfg.servicenow.apiToken);
+      if (!snCreds) {
+        results.servicenow = { status: "blank", message: "not configured" };
+      } else if (!cfg.servicenow.baseUrl) {
+        results.servicenow = { status: "error", message: "baseUrl not configured" };
+      } else {
+        try {
+          await http.servicenow("/api/now/table/change_request", { params: { sysparm_limit: 1 }, timeoutMs: 1e4 });
+          results.servicenow = { status: "valid", message: "ok" };
+        } catch (err) {
+          results.servicenow = categorize2(err);
+        }
+      }
+      if (!cfg.contrast.apiKey || !cfg.contrast.serviceKey || !cfg.contrast.username) {
+        results.contrast = { status: "blank", message: "not configured" };
+      } else if (!cfg.contrast.orgUuid) {
+        results.contrast = { status: "error", message: "orgUuid not configured" };
+      } else {
+        try {
+          await http.contrast(`/Contrast/api/ng/${cfg.contrast.orgUuid}/applications`, { params: { limit: 1 }, timeoutMs: 1e4 });
+          results.contrast = { status: "valid", message: "ok" };
+        } catch (err) {
+          results.contrast = categorize2(err);
+        }
+      }
       const statuses = Object.values(results).map((r) => r.status);
       if (statuses.includes("invalid")) process.exitCode = ExitCode.AUTH_ERROR;
       else if (statuses.includes("error")) process.exitCode = ExitCode.NETWORK_ERROR;
       if (cmdOpts.output === "table") {
-        const services = ["jira", "bitbucket", "confluence", "sonar", "sde", "ado", "jenkins", "udeploy", "artifactory", "checkmarx"];
+        const services = ["jira", "bitbucket", "confluence", "sonar", "sde", "ado", "jenkins", "udeploy", "artifactory", "checkmarx", "servicenow", "contrast"];
         const labelWidth = 14;
         const statusWidth = 9;
         for (const svc of services) {
@@ -3816,7 +4083,7 @@ function registerConfigCommands(program2) {
         process.stdout.write("\n");
       } else {
         if (opts.pretty) {
-          const services = ["jira", "bitbucket", "confluence", "sonar", "sde", "ado", "jenkins", "udeploy", "artifactory", "checkmarx"];
+          const services = ["jira", "bitbucket", "confluence", "sonar", "sde", "ado", "jenkins", "udeploy", "artifactory", "checkmarx", "servicenow", "contrast"];
           const labelWidth = 14;
           const statusWidth = 9;
           for (const svc of services) {
@@ -4149,6 +4416,114 @@ async function initGlobalConfig(start) {
       }
     }
   }
+  process.stderr.write("\n\u2500\u2500 ServiceNow \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+  const useServiceNow = await confirm({
+    message: "Configure ServiceNow for change management?",
+    default: false
+  });
+  let servicenowBaseUrl = "";
+  let servicenowUsername = "";
+  let servicenowPassword = "";
+  let servicenowApiToken = "";
+  if (useServiceNow) {
+    servicenowBaseUrl = await input({
+      message: "ServiceNow instance URL (e.g. https://mycompany.service-now.com):",
+      default: ""
+    });
+    servicenowUsername = await input({
+      message: "ServiceNow username:",
+      default: ""
+    });
+    const snUseToken = await confirm({
+      message: "Authenticate with an API token instead of a password?",
+      default: false
+    });
+    if (snUseToken) {
+      servicenowApiToken = await password({
+        message: "ServiceNow API token:",
+        validate: (v) => v.length > 0 || "Token cannot be blank"
+      });
+    } else {
+      servicenowPassword = await password({
+        message: "ServiceNow password:",
+        validate: (v) => v.length > 0 || "Password cannot be blank"
+      });
+    }
+    const snHasCreds = servicenowBaseUrl && servicenowUsername && (servicenowPassword || servicenowApiToken);
+    if (snHasCreds) {
+      process.stderr.write("\n  Verifying connection...\n");
+      try {
+        const tempConfig = {
+          ...loadConfig(),
+          servicenow: {
+            baseUrl: servicenowBaseUrl,
+            username: servicenowUsername,
+            password: servicenowPassword || void 0,
+            apiToken: servicenowApiToken || void 0
+          }
+        };
+        const tempHttp = createHttpClient(tempConfig);
+        await tempHttp.servicenow("/api/now/table/change_request", { params: { sysparm_limit: 1 } });
+        process.stderr.write("  Connected.\n");
+      } catch (err) {
+        warn(`Could not connect to ServiceNow: ${err instanceof Error ? err.message : String(err)}`);
+        warn("Config will be saved anyway. Check your URL and credentials and re-run pncli config init or pncli config test.");
+      }
+    }
+  }
+  process.stderr.write("\n\u2500\u2500 Contrast IAST \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+  const useContrast = await confirm({
+    message: "Configure Contrast Security IAST for vulnerability findings?",
+    default: false
+  });
+  let contrastBaseUrl = "";
+  let contrastOrgUuid = "";
+  let contrastUsername = "";
+  let contrastApiKey = "";
+  let contrastServiceKey = "";
+  if (useContrast) {
+    process.stderr.write("  Find your credentials in Contrast under User Settings \u2192 Your Keys.\n");
+    contrastBaseUrl = await input({
+      message: "Contrast base URL (leave blank for cloud: https://app.contrastsecurity.com):",
+      default: ""
+    });
+    contrastOrgUuid = await input({
+      message: "Organization UUID:",
+      default: ""
+    });
+    contrastUsername = await input({
+      message: "Username (email):",
+      default: ""
+    });
+    contrastApiKey = await password({
+      message: "API key:"
+    });
+    contrastServiceKey = await password({
+      message: "Service key:"
+    });
+    const contrastHasCreds = contrastOrgUuid && contrastUsername && contrastApiKey && contrastServiceKey;
+    if (contrastHasCreds) {
+      process.stderr.write("\n  Verifying connection...\n");
+      try {
+        const tempConfig = {
+          ...loadConfig(),
+          contrast: {
+            baseUrl: contrastBaseUrl || void 0,
+            orgUuid: contrastOrgUuid,
+            username: contrastUsername,
+            apiKey: contrastApiKey,
+            serviceKey: contrastServiceKey
+          }
+        };
+        const tempHttp = createHttpClient(tempConfig);
+        await tempHttp.contrast(`/Contrast/api/ng/${contrastOrgUuid}/applications`, { params: { limit: 1 } });
+        process.stderr.write("  Connected.\n");
+      } catch (err) {
+        warn(`Could not connect to Contrast: ${err instanceof Error ? err.message : String(err)}`);
+        warn("Config will be saved anyway. Check your credentials and re-run pncli config init or pncli config test.");
+      }
+    }
+  }
   process.stderr.write("\n\u2500\u2500 Defaults \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
   const jiraProject = await input({
     message: "Default Jira project key (optional):",
@@ -4242,6 +4617,23 @@ async function initGlobalConfig(start) {
         password: checkmarxPassword || void 0
       }
     } : {},
+    ...useServiceNow && servicenowBaseUrl ? {
+      servicenow: {
+        baseUrl: servicenowBaseUrl,
+        username: servicenowUsername || void 0,
+        ...servicenowApiToken ? { apiToken: servicenowApiToken } : {},
+        ...servicenowPassword ? { password: servicenowPassword } : {}
+      }
+    } : {},
+    ...useContrast && contrastOrgUuid ? {
+      contrast: {
+        ...contrastBaseUrl ? { baseUrl: contrastBaseUrl } : {},
+        orgUuid: contrastOrgUuid,
+        username: contrastUsername || void 0,
+        apiKey: contrastApiKey || void 0,
+        serviceKey: contrastServiceKey || void 0
+      }
+    } : {},
     defaults: {
       jira: {
         project: jiraProject || void 0
@@ -4697,7 +5089,7 @@ function registerAdoWorkCommands(ado) {
       fail(err, "ado", "work-get", start);
     }
   });
-  work.command("create").description("Create a work item").requiredOption("--type <type>", "Work item type (e.g. Bug, Task, User Story)").requiredOption("--title <title>", "Work item title").option("--description <text>", "Description").option("--assignee <user>", "Assigned to (display name or email)").option("--priority <n>", "Priority (1-4)").option("--field <name=value>", "Additional field (repeatable)", (v, acc) => {
+  work.command("create").description("Create a work item").requiredOption("--type <type>", "Work item type (e.g. Bug, Task, User Story)").requiredOption("--title <title>", "Work item title").option("--description <text>", "Description").option("--assignee <user>", "Assigned to (display name or email)").option("--priority <n>", "Priority (1-4)").option("--parent <id>", "Parent work item ID \u2014 creates a parent link after creation").option("--field <name=value>", "Additional field (repeatable)", (v, acc) => {
     acc.push(v);
     return acc;
   }, []).action(async (opts) => {
@@ -4719,6 +5111,17 @@ function registerAdoWorkCommands(ado) {
       ];
       const data = await workClient.createWorkItem(collection, project, opts.type, patch);
       success(data, "ado", "work-create", start);
+      if (opts.parent) {
+        try {
+          const baseUrl = config.ado.baseUrl?.replace(/\/$/, "");
+          const targetUrl = `${baseUrl}/${encodeURIComponent(collection)}/_apis/wit/workitems/${opts.parent}`;
+          const linkPatch = [{ op: "add", path: "/relations/-", value: { rel: "System.LinkTypes.Hierarchy-Reverse", url: targetUrl } }];
+          await workClient.updateWorkItem(collection, data.id, linkPatch);
+        } catch (linkErr) {
+          warn(`Created #${data.id} but failed to link to parent ${opts.parent}: ${linkErr instanceof Error ? linkErr.message : linkErr}`);
+        }
+      }
+      return;
     } catch (err) {
       fail(err, "ado", "work-create", start);
     }
@@ -5135,11 +5538,11 @@ function registerAdoRepoCommands(ado) {
       const start = Date.now();
       try {
         const globalOpts = ado.optsWithGlobals();
-        const { loadConfig: lc } = await import("./config-PXL632ZX.js");
+        const { loadConfig: lc } = await import("./config-3VKBM32K.js");
         const config = lc({ configPath: globalOpts.config });
         const { collection, project, repo: repo2, gitClient } = getAdoContext(ado, true);
         const { AdoCoreClient: AdoCoreClient2 } = await import("./core-SWYVXOQ4.js");
-        const { createHttpClient: createHttpClient2 } = await import("./http-TID3W235.js");
+        const { createHttpClient: createHttpClient2 } = await import("./http-GVHZQCEY.js");
         const http = createHttpClient2(config, Boolean(globalOpts.dryRun));
         const coreClient = new AdoCoreClient2(http);
         const me = await coreClient.getConnectionData(collection);
@@ -6007,6 +6410,180 @@ function registerCheckmarxCommands(program2) {
   });
 }
 
+// src/services/servicenow/commands.ts
+function getHttp(program2) {
+  const opts = program2.optsWithGlobals();
+  const config = loadConfig({ configPath: opts.config });
+  if (!config.servicenow.baseUrl) throw new PncliError("ServiceNow not configured. Run: pncli config init");
+  return createHttpClient(config, Boolean(opts.dryRun));
+}
+function registerServiceNowCommands(program2) {
+  const sn = program2.command("servicenow").description("ServiceNow operations");
+  const change = sn.command("change").description("Change request operations");
+  change.command("list").description("List change requests").option("--state <state>", "Filter by state (e.g. -1=Pending, 1=Open, 2=Work in Progress, 3=Closed Complete)").option("--assigned-to <user>", "Filter by assigned user sys_id or display name").option("--limit <n>", "Maximum number of results", "25").option("--fields <fields>", "Comma-separated field names to return").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const http = getHttp(program2);
+      const params = {
+        sysparm_limit: opts.limit ? parseInt(opts.limit, 10) : 25,
+        sysparm_display_value: "true"
+      };
+      const sanitize = (v) => v.replace(/\^/g, "");
+      const queries = [];
+      if (opts.state !== void 0) queries.push(`state=${sanitize(opts.state)}`);
+      if (opts.assignedTo) queries.push(`assigned_to=${sanitize(opts.assignedTo)}`);
+      if (queries.length) params["sysparm_query"] = queries.join("^");
+      if (opts.fields) params["sysparm_fields"] = opts.fields;
+      const data = await http.servicenow("/api/now/table/change_request", { params });
+      success(data.result, "servicenow", "change list", start);
+    } catch (err) {
+      fail(err, "servicenow", "change list", start);
+    }
+  });
+  change.command("get").description("Get a change request by sys_id or number").requiredOption("--id <id>", "Change request sys_id or number (e.g. CHG0001234)").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const http = getHttp(program2);
+      if (opts.id.toUpperCase().startsWith("CHG")) {
+        const list = await http.servicenow("/api/now/table/change_request", {
+          params: { sysparm_query: `number=${opts.id}`, sysparm_display_value: "true", sysparm_limit: 1 }
+        });
+        if (!list.result.length) throw new PncliError(`Change request not found: ${opts.id}`, 1);
+        success(list.result[0], "servicenow", "change get", start);
+        return;
+      }
+      const data = await http.servicenow(`/api/now/table/change_request/${opts.id}`, {
+        params: { sysparm_display_value: "true" }
+      });
+      success(data.result, "servicenow", "change get", start);
+    } catch (err) {
+      fail(err, "servicenow", "change get", start);
+    }
+  });
+  change.command("create").description("Create a change request").requiredOption("--short-description <text>", "Short description (title)").option("--description <text>", "Full description").option("--type <type>", "Change type: normal, standard, or emergency", "normal").option("--priority <n>", "Priority: 1=Critical, 2=High, 3=Moderate, 4=Low").option("--assigned-to <user>", "Assigned user sys_id").option("--assignment-group <group>", "Assignment group sys_id").option("--start-date <datetime>", "Planned start date (yyyy-MM-dd HH:mm:ss)").option("--end-date <datetime>", "Planned end date (yyyy-MM-dd HH:mm:ss)").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const http = getHttp(program2);
+      const body = {
+        short_description: opts.shortDescription,
+        type: opts.type ?? "normal"
+      };
+      if (opts.description) body["description"] = opts.description;
+      if (opts.priority) body["priority"] = opts.priority;
+      if (opts.assignedTo) body["assigned_to"] = opts.assignedTo;
+      if (opts.assignmentGroup) body["assignment_group"] = opts.assignmentGroup;
+      if (opts.startDate) body["start_date"] = opts.startDate;
+      if (opts.endDate) body["end_date"] = opts.endDate;
+      const data = await http.servicenow("/api/now/table/change_request", {
+        method: "POST",
+        body
+      });
+      success(data.result, "servicenow", "change create", start);
+    } catch (err) {
+      fail(err, "servicenow", "change create", start);
+    }
+  });
+  change.command("update").description("Update a change request").requiredOption("--id <sys_id>", "Change request sys_id").option("--short-description <text>", "New short description").option("--description <text>", "New description").option("--state <state>", "New state value").option("--priority <n>", "New priority").option("--assigned-to <user>", "New assigned user sys_id").option("--start-date <datetime>", "New planned start date").option("--end-date <datetime>", "New planned end date").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const http = getHttp(program2);
+      const body = {};
+      if (opts.shortDescription) body["short_description"] = opts.shortDescription;
+      if (opts.description) body["description"] = opts.description;
+      if (opts.state !== void 0) body["state"] = opts.state;
+      if (opts.priority) body["priority"] = opts.priority;
+      if (opts.assignedTo) body["assigned_to"] = opts.assignedTo;
+      if (opts.startDate) body["start_date"] = opts.startDate;
+      if (opts.endDate) body["end_date"] = opts.endDate;
+      if (Object.keys(body).length === 0) throw new PncliError("No fields to update. Provide at least one option besides --id.", 1);
+      const data = await http.servicenow(`/api/now/table/change_request/${opts.id}`, {
+        method: "PATCH",
+        body
+      });
+      success(data.result, "servicenow", "change update", start);
+    } catch (err) {
+      fail(err, "servicenow", "change update", start);
+    }
+  });
+  change.command("close").description("Close a change request (state=3)").requiredOption("--id <sys_id>", "Change request sys_id").option("--close-notes <text>", "Closure notes").option("--close-code <code>", "Close code (e.g. successful, unsuccessful)").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const http = getHttp(program2);
+      const body = { state: 3 };
+      if (opts.closeNotes) body["close_notes"] = opts.closeNotes;
+      if (opts.closeCode) body["close_code"] = opts.closeCode;
+      const data = await http.servicenow(`/api/now/table/change_request/${opts.id}`, {
+        method: "PATCH",
+        body
+      });
+      success(data.result, "servicenow", "change close", start);
+    } catch (err) {
+      fail(err, "servicenow", "change close", start);
+    }
+  });
+}
+
+// src/services/contrast/commands.ts
+function getHttpAndOrg(program2) {
+  const opts = program2.optsWithGlobals();
+  const config = loadConfig({ configPath: opts.config });
+  if (!config.contrast.apiKey || !config.contrast.serviceKey || !config.contrast.username) throw new PncliError("Contrast not configured. Run: pncli config init");
+  if (!config.contrast.orgUuid) throw new PncliError("Contrast org UUID not configured. Run: pncli config set contrast.orgUuid <uuid>");
+  const http = createHttpClient(config, Boolean(opts.dryRun));
+  return { http, orgUuid: config.contrast.orgUuid };
+}
+function registerContrastCommands(program2) {
+  const contrast = program2.command("contrast").description("Contrast IAST operations");
+  const apps = contrast.command("apps").description("Application operations");
+  apps.command("list").description("List applications in the organization").option("--limit <n>", "Maximum number of results", "25").option("--offset <n>", "Pagination offset", "0").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const { http, orgUuid } = getHttpAndOrg(program2);
+      const data = await http.contrast(`/Contrast/api/ng/${orgUuid}/applications`, {
+        params: {
+          limit: opts.limit ? parseInt(opts.limit, 10) : 25,
+          offset: opts.offset ? parseInt(opts.offset, 10) : 0
+        }
+      });
+      success(data, "contrast", "apps list", start);
+    } catch (err) {
+      fail(err, "contrast", "apps list", start);
+    }
+  });
+  const findings = contrast.command("findings").description("Vulnerability findings operations");
+  findings.command("list").description("List vulnerability findings for an application").requiredOption("--app <app-id>", "Application ID (UUID)").option("--severity <level>", "Filter by severity: CRITICAL, HIGH, MEDIUM, LOW, NOTE").option("--status <status>", "Filter by status: REPORTED, CONFIRMED, SUSPICIOUS, NOT_A_PROBLEM, REMEDIATED, FIXED").option("--limit <n>", "Maximum number of results", "25").option("--offset <n>", "Pagination offset", "0").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const { http, orgUuid } = getHttpAndOrg(program2);
+      const params = {
+        limit: opts.limit ? parseInt(opts.limit, 10) : 25,
+        offset: opts.offset ? parseInt(opts.offset, 10) : 0
+      };
+      if (opts.severity) params["severities"] = opts.severity;
+      if (opts.status) params["statuses"] = opts.status;
+      const data = await http.contrast(
+        `/Contrast/api/ng/${orgUuid}/traces/${opts.app}/filter`,
+        { params }
+      );
+      success(data, "contrast", "findings list", start);
+    } catch (err) {
+      fail(err, "contrast", "findings list", start);
+    }
+  });
+  findings.command("get").description("Get details for a specific vulnerability finding").requiredOption("--app <app-id>", "Application ID (UUID)").requiredOption("--trace <trace-id>", "Trace/finding UUID").action(async (opts) => {
+    const start = Date.now();
+    try {
+      const { http, orgUuid } = getHttpAndOrg(program2);
+      const data = await http.contrast(
+        `/Contrast/api/ng/${orgUuid}/traces/${opts.app}/trace/${opts.trace}`
+      );
+      success(data, "contrast", "findings get", start);
+    } catch (err) {
+      fail(err, "contrast", "findings get", start);
+    }
+  });
+}
+
 // src/services/skills/commands.ts
 import fs3 from "fs";
 import path5 from "path";
@@ -6165,7 +6742,7 @@ if (!process.env.PNCLI_VERIFY_TLS) {
 var require2 = createRequire(import.meta.url);
 var pkg = require2("../package.json");
 var TAGLINE = "One command does what three meetings couldn't.";
-var program = new Command();
+var program = new Command2();
 program.name("pncli").description(`The Paperwork Nightmare CLI \u2014 ${TAGLINE}`).version(`${pkg.version} \u2014 ${TAGLINE}`, "-v, --version").option("--pretty", "Human-readable formatted output", false).option("--verbose", "Include full response metadata", false).option("--dry-run", "Print API requests without executing", false).option("--config <path>", "Override global config file location").option("--output-file <path>", "Write JSON output to file instead of stdout");
 program.hook("preAction", (thisCommand) => {
   const opts = thisCommand.optsWithGlobals();
@@ -6193,6 +6770,8 @@ registerJenkinsCommands(program);
 registerArtifactoryCommands(program);
 registerUdeployCommands(program);
 registerCheckmarxCommands(program);
+registerServiceNowCommands(program);
+registerContrastCommands(program);
 registerSkillsCommands(program);
 program.addHelpText("after", `
 Services:
@@ -6208,6 +6787,8 @@ Services:
   artifactory  Artifactory (repos, artifact search, build info, properties)
   udeploy      IBM UrbanCode Deploy (component versions, deployment processes)
   checkmarx    Checkmarx CxSAST (projects, scans, scan statistics)
+  servicenow   ServiceNow (change requests)
+  contrast     Contrast IAST (applications, vulnerability findings)
   config       Manage pncli configuration
   skills       Download and manage Claude Code skills
 `);