@kolatts/pncli 1.9.0 → 1.10.0

package/dist/cli.js

@@ -7,7 +7,7 @@ import {
   setRepoConfigValue,
   writeGlobalConfig,
   writeRepoConfig
-} from "./chunk-YR6GFJMV.js";
+} from "./chunk-O3LWAWSN.js";
 import {
   ExitCode,
   PncliError,
@@ -18,7 +18,7 @@ import {
   setGlobalUser,
   success,
   warn
-} from "./chunk-QQZJQ5DP.js";
+} from "./chunk-3XHTRFRX.js";
 import {
   AdoCoreClient
 } from "./chunk-VDL32PSG.js";
@@ -3021,11 +3021,224 @@ async function checkPackagesForVulnsViaSonatype(packages) {
   return allVulnerable;
 }
 
-// src/services/deps/clients/artifactory.ts
-var TIMEOUT_MS3 = 15e3;
-async function fetchWithTimeout3(url, token) {
+// src/services/deps/clients/sonatypeiq.ts
+var TIMEOUT_MS3 = 6e4;
+var MAX_POLL_ATTEMPTS = 10;
+var POLL_INTERVAL_MS = 2e3;
+var BATCH_SIZE3 = 128;
+async function fetchWithTimeout3(url, init) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), TIMEOUT_MS3);
+  try {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function buildBasicAuth(userCode, passcode) {
+  return `Basic ${Buffer.from(`${userCode}:${passcode}`).toString("base64")}`;
+}
+function threatLevelToSeverity(level) {
+  if (level >= 9) return "CRITICAL";
+  if (level >= 7) return "HIGH";
+  if (level >= 4) return "MEDIUM";
+  if (level > 0) return "LOW";
+  return "UNKNOWN";
+}
+function toPurl2(pkg2) {
+  switch (pkg2.ecosystem) {
+    case "npm": {
+      const encodedName = pkg2.name.startsWith("@") ? pkg2.name.replace("@", "%40") : pkg2.name;
+      return `pkg:npm/${encodedName}@${pkg2.version}`;
+    }
+    case "nuget":
+      return `pkg:nuget/${pkg2.name}@${pkg2.version}`;
+    case "maven": {
+      const colonIdx = pkg2.name.indexOf(":");
+      if (colonIdx !== -1) {
+        const groupId = pkg2.name.slice(0, colonIdx);
+        const artifactId = pkg2.name.slice(colonIdx + 1);
+        return `pkg:maven/${encodeURIComponent(groupId)}/${encodeURIComponent(artifactId)}@${pkg2.version}`;
+      }
+      return `pkg:maven/${encodeURIComponent(pkg2.name)}@${pkg2.version}`;
+    }
+    default:
+      return `pkg:generic/${encodeURIComponent(pkg2.name)}@${pkg2.version}`;
+  }
+}
+function mapViolationToVuln(violation) {
+  const cveRefs = violation.constraintViolations.flatMap(
+    (cv) => cv.reasons.filter((r) => r.reference?.type === "VULNERABILITY").map((r) => r.reference.value)
+  );
+  const id = cveRefs[0] ?? violation.policyId;
+  const severity = threatLevelToSeverity(violation.policyThreatLevel);
+  return {
+    id,
+    summary: violation.policyName,
+    severity,
+    cvss: null,
+    aliases: [...new Set(cveRefs)],
+    remediation: {
+      fixAvailable: false,
+      fixedVersions: [],
+      advice: `Policy violation: ${violation.policyName} (threat level ${violation.policyThreatLevel}). Check Sonatype IQ Server for details.`
+    },
+    references: []
+  };
+}
+function syntheticVulnsFromCounts(criticalCount, severeCount, moderateCount, pkgName) {
+  const vulns = [];
+  if (criticalCount > 0) {
+    vulns.push({
+      id: `iq-critical-${pkgName}`,
+      summary: `${criticalCount} critical vulnerability(ies) detected by Sonatype IQ`,
+      severity: "CRITICAL",
+      cvss: null,
+      aliases: [],
+      remediation: { fixAvailable: false, fixedVersions: [], advice: "Check Sonatype IQ Server for details." },
+      references: []
+    });
+  }
+  if (severeCount > 0) {
+    vulns.push({
+      id: `iq-high-${pkgName}`,
+      summary: `${severeCount} severe vulnerability(ies) detected by Sonatype IQ`,
+      severity: "HIGH",
+      cvss: null,
+      aliases: [],
+      remediation: { fixAvailable: false, fixedVersions: [], advice: "Check Sonatype IQ Server for details." },
+      references: []
+    });
+  }
+  if (moderateCount > 0) {
+    vulns.push({
+      id: `iq-medium-${pkgName}`,
+      summary: `${moderateCount} moderate vulnerability(ies) detected by Sonatype IQ`,
+      severity: "MEDIUM",
+      cvss: null,
+      aliases: [],
+      remediation: { fixAvailable: false, fixedVersions: [], advice: "Check Sonatype IQ Server for details." },
+      references: []
+    });
+  }
+  return vulns;
+}
+async function resolveApplicationInternalId(baseUrl, applicationId, auth) {
+  const url = `${baseUrl.replace(/\/$/, "")}/api/v2/applications?publicId=${encodeURIComponent(applicationId)}`;
+  const res = await fetchWithTimeout3(url, {
+    method: "GET",
+    headers: { "Authorization": auth, "Accept": "application/json" }
+  });
+  if (!res.ok) return applicationId;
+  const data = await res.json();
+  if (data.applications && data.applications.length > 0) {
+    return data.applications[0].id;
+  }
+  return applicationId;
+}
+async function pollResults(baseUrl, resultsUrl, auth) {
+  for (let attempt = 0; attempt < MAX_POLL_ATTEMPTS; attempt++) {
+    if (attempt > 0) {
+      await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS * attempt));
+    }
+    const url = resultsUrl.startsWith("http") ? resultsUrl : `${baseUrl.replace(/\/$/, "")}${resultsUrl}`;
+    const res = await fetchWithTimeout3(url, {
+      method: "GET",
+      headers: { "Authorization": auth, "Accept": "application/json" }
+    });
+    if (!res.ok) {
+      throw new Error(`Sonatype IQ Server returned HTTP ${res.status} polling results`);
+    }
+    const data = await res.json();
+    if (!data.isQueued) return data;
+  }
+  throw new Error("Sonatype IQ Server evaluation timed out waiting for results.");
+}
+async function evaluateBatch(purls, packages, baseUrl, applicationId, auth) {
+  const url = `${baseUrl.replace(/\/$/, "")}/api/v2/evaluation/applications/${encodeURIComponent(applicationId)}`;
+  const res = await fetchWithTimeout3(url, {
+    method: "POST",
+    headers: { "Authorization": auth, "Content-Type": "application/json", "Accept": "application/json" },
+    body: JSON.stringify({ components: purls.map((p) => ({ packageUrl: p })) })
+  });
+  if (!res.ok) {
+    throw new Error(`Sonatype IQ Server returned HTTP ${res.status}`);
+  }
+  let data = await res.json();
+  if (data.isQueued && data.resultsUrl) {
+    data = await pollResults(baseUrl, data.resultsUrl, auth);
+  }
+  const components = data.components ?? [];
+  const vulnerable = [];
+  const purlToPackage = /* @__PURE__ */ new Map();
+  for (let i = 0; i < purls.length; i++) {
+    purlToPackage.set(purls[i], packages[i]);
+  }
+  for (const result of components) {
+    if (!result?.component?.packageUrl) continue;
+    const pkg2 = purlToPackage.get(result.component.packageUrl);
+    if (!pkg2) continue;
+    const criticalCount = result.criticalVulnerabilityCount ?? 0;
+    const severeCount = result.severeVulnerabilityCount ?? 0;
+    const moderateCount = result.moderateVulnerabilityCount ?? 0;
+    const totalVulns = criticalCount + severeCount + moderateCount;
+    const violations = result.policyData?.policyViolations ?? [];
+    const securityViolations = violations.filter((v) => v.policyThreatCategory === "SECURITY");
+    if (securityViolations.length === 0 && totalVulns === 0) continue;
+    const vulnerabilities = securityViolations.length > 0 ? securityViolations.map((v) => mapViolationToVuln(v)) : syntheticVulnsFromCounts(criticalCount, severeCount, moderateCount, pkg2.name);
+    vulnerable.push({ ...pkg2, vulnerabilities });
+  }
+  return vulnerable;
+}
+async function checkPackagesViaIqServer(packages, applicationId, config) {
+  const { baseUrl, userCode, passcode } = config.sonatypeiq;
+  if (!baseUrl) throw new Error("Sonatype IQ Server baseUrl not configured.");
+  if (!userCode || !passcode) throw new Error("Sonatype IQ Server credentials not configured.");
+  const auth = buildBasicAuth(userCode, passcode);
+  const internalId = await resolveApplicationInternalId(baseUrl, applicationId, auth);
+  const allVulnerable = [];
+  for (let i = 0; i < packages.length; i += BATCH_SIZE3) {
+    const chunk = packages.slice(i, i + BATCH_SIZE3);
+    const purls = chunk.map(toPurl2);
+    const results = await evaluateBatch(purls, chunk, baseUrl, internalId, auth);
+    allVulnerable.push(...results);
+  }
+  return allVulnerable;
+}
+async function checkSonatypeIqConnectivity(baseUrl, userCode, passcode) {
+  try {
+    const auth = buildBasicAuth(userCode, passcode);
+    const url = `${baseUrl.replace(/\/$/, "")}/api/v2/applications?limit=1`;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 1e4);
+    let res;
+    try {
+      res = await fetch(url, {
+        method: "GET",
+        headers: { "Authorization": auth, "Accept": "application/json" },
+        signal: controller.signal
+      });
+    } finally {
+      clearTimeout(timer);
+    }
+    if (res.status === 401 || res.status === 403) {
+      return { reachable: true, authenticated: false, error: `Authentication failed (HTTP ${res.status})` };
+    }
+    return { reachable: true, authenticated: res.ok };
+  } catch (err) {
+    return {
+      reachable: false,
+      authenticated: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+
+// src/services/deps/clients/artifactory.ts
+var TIMEOUT_MS4 = 15e3;
+async function fetchWithTimeout4(url, token) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS4);
   try {
     return await fetch(url, {
       headers: { Authorization: `Bearer ${token}` },
@@ -3061,7 +3274,7 @@ async function checkArtifactoryConnectivity(config) {
     };
   }
   try {
-    const res = await fetchWithTimeout3(`${config.baseUrl}/api/system/ping`, config.token);
+    const res = await fetchWithTimeout4(`${config.baseUrl}/api/system/ping`, config.token);
     if (res.status === 401 || res.status === 403) {
       return {
         reachable: true,
@@ -3111,7 +3324,7 @@ function repoForEcosystem(config, eco) {
 async function getLatestNpm(baseUrl, token, repoName, packageName) {
   try {
     const encoded = packageName.startsWith("@") ? packageName.replace("/", "%2F") : packageName;
-    const res = await fetchWithTimeout3(`${baseUrl}/api/npm/${repoName}/${encoded}`, token);
+    const res = await fetchWithTimeout4(`${baseUrl}/api/npm/${repoName}/${encoded}`, token);
     if (!res.ok) return null;
     const data = await res.json();
     return data["dist-tags"]?.latest ?? null;
@@ -3122,7 +3335,7 @@ async function getLatestNpm(baseUrl, token, repoName, packageName) {
 async function getLatestNuget(baseUrl, token, repoName, packageName) {
   try {
     const lower = packageName.toLowerCase();
-    const res = await fetchWithTimeout3(
+    const res = await fetchWithTimeout4(
       `${baseUrl}/api/nuget/v3/${repoName}/flatcontainer/${lower}/index.json`,
       token
     );
@@ -3138,7 +3351,7 @@ async function getLatestMaven(baseUrl, token, repoName, packageName) {
   const [groupId, artifactId] = packageName.split(":");
   if (!groupId || !artifactId) return null;
   try {
-    const res = await fetchWithTimeout3(
+    const res = await fetchWithTimeout4(
       `${baseUrl}/api/search/latestVersion?g=${encodeURIComponent(groupId)}&a=${encodeURIComponent(artifactId)}&repos=${repoName}`,
       token
     );
@@ -3188,7 +3401,7 @@ async function getOutdatedPackages(packages, config, filterType) {
 async function getLicenseNpm(baseUrl, token, repoName, packageName) {
   try {
     const encoded = packageName.startsWith("@") ? packageName.replace("/", "%2F") : packageName;
-    const res = await fetchWithTimeout3(`${baseUrl}/api/npm/${repoName}/${encoded}`, token);
+    const res = await fetchWithTimeout4(`${baseUrl}/api/npm/${repoName}/${encoded}`, token);
     if (!res.ok) return null;
     const data = await res.json();
     if (typeof data.license === "string") return data.license;
@@ -3201,7 +3414,7 @@ async function getLicenseNpm(baseUrl, token, repoName, packageName) {
 async function getLicenseNuget(baseUrl, token, repoName, packageName, version) {
   try {
     const lower = packageName.toLowerCase();
-    const res = await fetchWithTimeout3(
+    const res = await fetchWithTimeout4(
       `${baseUrl}/api/nuget/v3/${repoName}/registration/${lower}/${version}.json`,
       token
     );
@@ -3258,11 +3471,15 @@ async function checkSonatypeReachable() {
   return result.reachable;
 }
 async function buildConnectivityData(config) {
-  const [osvResult, artResult, sonatypeResult] = await Promise.all([
+  const iqCfg = config.sonatypeiq;
+  const iqConfigured = !!(iqCfg.baseUrl && iqCfg.userCode && iqCfg.passcode);
+  const checks = await Promise.all([
     checkOsvConnectivity(),
     checkArtifactoryConnectivity(config.artifactory),
-    checkSonatypeConnectivity()
+    checkSonatypeConnectivity(),
+    iqConfigured ? checkSonatypeIqConnectivity(iqCfg.baseUrl, iqCfg.userCode, iqCfg.passcode) : Promise.resolve(null)
   ]);
+  const [osvResult, artResult, sonatypeResult, iqResult] = checks;
   const artCfg = config.artifactory;
   let tier = "local";
   if (artResult.reachable && artResult.authenticated) tier = "artifactory";
@@ -3294,13 +3511,21 @@ async function buildConnectivityData(config) {
       url: "https://ossindex.sonatype.org",
       ...sonatypeResult.error ? { error: sonatypeResult.error } : {}
     },
+    ...iqConfigured && iqResult ? {
+      sonatypeiq: {
+        reachable: iqResult.reachable,
+        authenticated: iqResult.authenticated,
+        url: iqCfg.baseUrl,
+        ...iqResult.error ? { error: iqResult.error } : {}
+      }
+    } : {},
     tier,
     capabilities: {
       scan: true,
       diff: true,
       outdated: artResult.reachable && artResult.authenticated,
       licenseCheck: artResult.reachable && artResult.authenticated,
-      cveCheck: osvResult.reachable || sonatypeResult.reachable
+      cveCheck: osvResult.reachable || sonatypeResult.reachable || (iqResult?.reachable && iqResult?.authenticated) === true
     }
   };
 }
@@ -3309,13 +3534,27 @@ async function buildConnectivityData(config) {
 function toErrorMessage(err) {
   return err instanceof Error ? err.message : String(err);
 }
-async function runFrisk(config, opts, source = "osv") {
+async function runFrisk(config, opts, source = "osv", applicationId) {
   const repoRoot = getRepoRoot();
   if (!repoRoot) {
     throw new PncliError("Not inside a git repository.", 1);
   }
+  if (source === "sonatypeiq") {
+    if (!config.sonatypeiq.baseUrl || !config.sonatypeiq.userCode || !config.sonatypeiq.passcode) {
+      throw new PncliError(
+        "deps frisk --source sonatypeiq requires Sonatype IQ Server to be configured. Run: pncli config init",
+        1
+      );
+    }
+    if (!applicationId) {
+      throw new PncliError(
+        "deps frisk --source sonatypeiq requires --application-id <id>. Use 'pncli sonatypeiq applications list' to find application IDs.",
+        1
+      );
+    }
+  }
   const { tier: baseTier, osvReachable } = await detectTier(config);
-  const sonatypeReachable = source !== "osv" ? await checkSonatypeReachable() : false;
+  const sonatypeReachable = source === "sonatype" || source === "all" ? await checkSonatypeReachable() : false;
   const tier = sonatypeReachable ? "full" : baseTier;
   if (source === "osv" && !osvReachable) {
     throw new PncliError(
@@ -3356,7 +3595,9 @@ async function runFrisk(config, opts, source = "osv") {
     return { tier, source, sourcesQueried, sourceErrors, scanned: 0, vulnerable: 0, packages: [] };
   }
   let vulnerable;
-  if (source === "sonatype") {
+  if (source === "sonatypeiq") {
+    vulnerable = await checkPackagesViaIqServer(scan.packages, applicationId, config);
+  } else if (source === "sonatype") {
     vulnerable = await checkPackagesForVulnsViaSonatype(scan.packages);
   } else if (source === "all") {
     const [osvSettled, sonatypeSettled] = await Promise.allSettled([
@@ -3491,7 +3732,7 @@ async function runLicenseCheck(config, opts) {
 // src/services/deps/commands.ts
 function registerDepsCommands(program2) {
   const deps = program2.command("deps").description("Dependency scanning, CVE detection, and license auditing");
-  deps.command("frisk").description("Scan all dependencies for CVEs and output remediation paths (requires OSV.dev or Sonatype OSS Index)").option("--ecosystem <ecosystem>", "Filter to one ecosystem: npm, nuget, maven, all", "all").option("--direct-only", "Only scan direct dependencies (default: include transitive)", false).option("--include-dev", "Include dev/test dependencies", false).addOption(new Option("--source <source>", "Vulnerability source").choices(["osv", "sonatype", "all"]).default("osv")).action(async (opts, cmd) => {
+  deps.command("frisk").description("Scan all dependencies for CVEs and output remediation paths (requires OSV.dev, Sonatype OSS Index, or Sonatype IQ Server)").option("--ecosystem <ecosystem>", "Filter to one ecosystem: npm, nuget, maven, all", "all").option("--direct-only", "Only scan direct dependencies (default: include transitive)", false).option("--include-dev", "Include dev/test dependencies", false).addOption(new Option("--source <source>", "Vulnerability source").choices(["osv", "sonatype", "sonatypeiq", "all"]).default("osv")).option("--application-id <id>", "Sonatype IQ Server application ID (required when --source sonatypeiq)").action(async (opts, cmd) => {
     const startTime = Date.now();
     try {
       const globalOpts = cmd.optsWithGlobals();
@@ -3501,7 +3742,7 @@ function registerDepsCommands(program2) {
         includeTransitive: !opts.directOnly,
         includeDev: opts.includeDev
       };
-      const data = await runFrisk(config, scanOpts, opts.source);
+      const data = await runFrisk(config, scanOpts, opts.source, opts.applicationId);
       success(data, "deps", "frisk", startTime);
     } catch (err) {
       fail(err, "deps", "frisk", startTime);
@@ -3894,6 +4135,16 @@ function registerConfigCommands(program2) {
       } else {
         results.contrast = { ok: null, message: "not configured" };
       }
+      if (cfg.sonatypeiq.baseUrl && cfg.sonatypeiq.userCode && cfg.sonatypeiq.passcode) {
+        try {
+          await http.sonatypeiq("/api/v2/applications", { params: { limit: 1 } });
+          results.sonatypeiq = { ok: true, message: "connected" };
+        } catch (err) {
+          results.sonatypeiq = { ok: false, message: err instanceof Error ? err.message : String(err) };
+        }
+      } else {
+        results.sonatypeiq = { ok: null, message: "not configured" };
+      }
       success(results, "config", "test", start);
     } catch (err) {
       fail(err, "config", "test", start);
@@ -4065,11 +4316,23 @@ function registerConfigCommands(program2) {
           results.contrast = categorize2(err);
         }
       }
+      if (!cfg.sonatypeiq.userCode || !cfg.sonatypeiq.passcode) {
+        results.sonatypeiq = { status: "blank", message: "not configured" };
+      } else if (!cfg.sonatypeiq.baseUrl) {
+        results.sonatypeiq = { status: "error", message: "baseUrl not configured" };
+      } else {
+        try {
+          await http.sonatypeiq("/api/v2/applications", { params: { limit: 1 }, timeoutMs: 1e4 });
+          results.sonatypeiq = { status: "valid", message: "ok" };
+        } catch (err) {
+          results.sonatypeiq = categorize2(err);
+        }
+      }
       const statuses = Object.values(results).map((r) => r.status);
       if (statuses.includes("invalid")) process.exitCode = ExitCode.AUTH_ERROR;
       else if (statuses.includes("error")) process.exitCode = ExitCode.NETWORK_ERROR;
       if (cmdOpts.output === "table") {
-        const services = ["jira", "bitbucket", "confluence", "sonar", "sde", "ado", "jenkins", "udeploy", "artifactory", "checkmarx", "servicenow", "contrast"];
+        const services = ["jira", "bitbucket", "confluence", "sonar", "sde", "ado", "jenkins", "udeploy", "artifactory", "checkmarx", "servicenow", "contrast", "sonatypeiq"];
         const labelWidth = 14;
         const statusWidth = 9;
         for (const svc of services) {
@@ -4083,7 +4346,7 @@ function registerConfigCommands(program2) {
         process.stdout.write("\n");
       } else {
         if (opts.pretty) {
-          const services = ["jira", "bitbucket", "confluence", "sonar", "sde", "ado", "jenkins", "udeploy", "artifactory", "checkmarx", "servicenow", "contrast"];
+          const services = ["jira", "bitbucket", "confluence", "sonar", "sde", "ado", "jenkins", "udeploy", "artifactory", "checkmarx", "servicenow", "contrast", "sonatypeiq"];
           const labelWidth = 14;
           const statusWidth = 9;
           for (const svc of services) {
@@ -4471,6 +4734,47 @@ async function initGlobalConfig(start) {
       }
     }
   }
+  process.stderr.write("\n\u2500\u2500 Sonatype IQ Server \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
+  const useSonatypeIq = await confirm({
+    message: "Configure Sonatype IQ Server for dependency vulnerability scanning?",
+    default: false
+  });
+  let sonatypeIqBaseUrl = "";
+  let sonatypeIqUserCode = "";
+  let sonatypeIqPasscode = "";
+  if (useSonatypeIq) {
+    process.stderr.write("  User Token credentials are found in your IQ Server profile under User Token.\n");
+    sonatypeIqBaseUrl = await input({
+      message: "Sonatype IQ Server base URL (e.g. https://iq.your-company.com):",
+      default: ""
+    });
+    sonatypeIqUserCode = await input({
+      message: "User Code (from User Token):",
+      default: ""
+    });
+    sonatypeIqPasscode = await password({
+      message: "Passcode (from User Token):"
+    });
+    if (sonatypeIqBaseUrl && sonatypeIqUserCode && sonatypeIqPasscode) {
+      process.stderr.write("\n  Verifying connection...\n");
+      try {
+        const tempConfig = {
+          ...loadConfig(),
+          sonatypeiq: {
+            baseUrl: sonatypeIqBaseUrl,
+            userCode: sonatypeIqUserCode,
+            passcode: sonatypeIqPasscode
+          }
+        };
+        const tempHttp = createHttpClient(tempConfig);
+        await tempHttp.sonatypeiq("/api/v2/applications", { params: { limit: 1 } });
+        process.stderr.write("  Connected.\n");
+      } catch (err) {
+        warn(`Could not connect to Sonatype IQ Server: ${err instanceof Error ? err.message : String(err)}`);
+        warn("Config will be saved anyway. Check your URL and credentials and re-run pncli config init or pncli config test.");
+      }
+    }
+  }
   process.stderr.write("\n\u2500\u2500 Contrast IAST \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n");
   const useContrast = await confirm({
     message: "Configure Contrast Security IAST for vulnerability findings?",
@@ -4634,6 +4938,13 @@ async function initGlobalConfig(start) {
         serviceKey: contrastServiceKey || void 0
       }
     } : {},
+    ...useSonatypeIq && sonatypeIqBaseUrl ? {
+      sonatypeiq: {
+        baseUrl: sonatypeIqBaseUrl,
+        userCode: sonatypeIqUserCode || void 0,
+        passcode: sonatypeIqPasscode || void 0
+      }
+    } : {},
     defaults: {
       jira: {
         project: jiraProject || void 0
@@ -5538,11 +5849,11 @@ function registerAdoRepoCommands(ado) {
       const start = Date.now();
       try {
         const globalOpts = ado.optsWithGlobals();
-        const { loadConfig: lc } = await import("./config-3VKBM32K.js");
+        const { loadConfig: lc } = await import("./config-NCI2BTQG.js");
         const config = lc({ configPath: globalOpts.config });
         const { collection, project, repo: repo2, gitClient } = getAdoContext(ado, true);
         const { AdoCoreClient: AdoCoreClient2 } = await import("./core-SWYVXOQ4.js");
-        const { createHttpClient: createHttpClient2 } = await import("./http-GVHZQCEY.js");
+        const { createHttpClient: createHttpClient2 } = await import("./http-L2P23H2D.js");
         const http = createHttpClient2(config, Boolean(globalOpts.dryRun));
         const coreClient = new AdoCoreClient2(http);
         const me = await coreClient.getConnectionData(collection);
@@ -6154,7 +6465,7 @@ var UdeployClient = class {
 };
 
 // src/services/udeploy/commands.ts
-var POLL_INTERVAL_MS = 5e3;
+var POLL_INTERVAL_MS2 = 5e3;
 var DEFAULT_TIMEOUT_MS = 10 * 60 * 1e3;
 function getClient8(program2) {
   const opts = program2.optsWithGlobals();
@@ -6265,7 +6576,7 @@ function registerUdeployCommands(program2) {
         if (elapsed >= timeoutMs) {
           throw new PncliError(`Timed out after ${timeoutMs}ms waiting for request ${requestId}`, 1);
         }
-        await sleep(POLL_INTERVAL_MS);
+        await sleep(POLL_INTERVAL_MS2);
         const status = await client.getRequestStatus(requestId);
         if (status.status === "CLOSED") {
           const outcome = { requestId, status: status.status, result: status.result, elapsed_ms: Date.now() - start };
@@ -6584,19 +6895,87 @@ function registerContrastCommands(program2) {
   });
 }
 
+// src/services/sonatypeiq/commands.ts
+function getHttpClient(program2) {
+  const opts = program2.optsWithGlobals();
+  const config = loadConfig({ configPath: opts.config });
+  if (!config.sonatypeiq.baseUrl) throw new PncliError("Sonatype IQ Server baseUrl not configured. Run: pncli config init");
+  if (!config.sonatypeiq.userCode || !config.sonatypeiq.passcode) throw new PncliError("Sonatype IQ Server credentials not configured. Run: pncli config init");
+  const http = createHttpClient(config, Boolean(opts.dryRun));
+  return http;
+}
+function registerSonatypeIqCommands(program2) {
+  const sonatypeiq = program2.command("sonatypeiq").description("Sonatype IQ Server operations");
+  const applications = sonatypeiq.command("applications").description("Application operations");
+  applications.command("list").description("List all applications in Sonatype IQ Server").option("--organization-id <id>", "Filter by organization ID").action(async (opts) => {
+    const startTime = Date.now();
+    try {
+      const http = getHttpClient(program2);
+      const params = {};
+      if (opts.organizationId) params["organizationId"] = opts.organizationId;
+      const data = await http.sonatypeiq("/api/v2/applications", { params });
+      success(data, "sonatypeiq", "applications list", startTime);
+    } catch (err) {
+      fail(err, "sonatypeiq", "applications list", startTime);
+    }
+  });
+  applications.command("get").description("Get an application by its public ID").requiredOption("--public-id <id>", "Application public ID").action(async (opts) => {
+    const startTime = Date.now();
+    try {
+      const http = getHttpClient(program2);
+      const data = await http.sonatypeiq("/api/v2/applications", {
+        params: { publicId: opts.publicId }
+      });
+      success(data, "sonatypeiq", "applications get", startTime);
+    } catch (err) {
+      fail(err, "sonatypeiq", "applications get", startTime);
+    }
+  });
+  const organizations = sonatypeiq.command("organizations").description("Organization operations");
+  organizations.command("list").description("List all organizations in Sonatype IQ Server").action(async () => {
+    const startTime = Date.now();
+    try {
+      const http = getHttpClient(program2);
+      const data = await http.sonatypeiq("/api/v2/organizations");
+      success(data, "sonatypeiq", "organizations list", startTime);
+    } catch (err) {
+      fail(err, "sonatypeiq", "organizations list", startTime);
+    }
+  });
+  const policies = sonatypeiq.command("policies").description("Policy operations");
+  policies.command("list").description("List all policies").option("--organization-id <id>", "Filter by organization ID").action(async (opts) => {
+    const startTime = Date.now();
+    try {
+      const http = getHttpClient(program2);
+      const path6 = opts.organizationId ? `/api/v2/policies/organization/${encodeURIComponent(opts.organizationId)}` : "/api/v2/policies";
+      const data = await http.sonatypeiq(path6);
+      success(data, "sonatypeiq", "policies list", startTime);
+    } catch (err) {
+      fail(err, "sonatypeiq", "policies list", startTime);
+    }
+  });
+}
+
 // src/services/skills/commands.ts
 import fs3 from "fs";
 import path5 from "path";
 import os from "os";
-var GITHUB_API = "https://api.github.com/repos/kolatts/pncli/contents/skills";
-var RAW_BASE = "https://raw.githubusercontent.com/kolatts/pncli/main/skills";
+import { fileURLToPath } from "url";
 var AGENT_PATHS = {
   "github-copilot": { project: ".agents/skills", user: path5.join(os.homedir(), ".copilot/skills") },
   "claude-code": { project: ".claude/skills", user: path5.join(os.homedir(), ".claude/skills") }
 };
+function getBundledSkillsDir() {
+  try {
+    const thisFile = fileURLToPath(import.meta.url);
+    return path5.resolve(path5.dirname(thisFile), "..", "skills");
+  } catch {
+    return "";
+  }
+}
 function registerSkillsCommands(program2) {
   const skills = program2.command("skills").description("Manage pncli Claude Code skills");
-  skills.command("install").description("Download latest pncli skills into the current repo").option("--agent <agent>", "Target agent host: github-copilot | claude-code", "github-copilot").option("--scope <scope>", "Installation scope: project | user", "project").option("--target <dir>", "Override install directory (ignores --agent and --scope)").action(async (opts) => {
+  skills.command("install").description("Install pncli skills into the current repo").option("--agent <agent>", "Target agent host: github-copilot | claude-code", "github-copilot").option("--scope <scope>", "Installation scope: project | user", "project").option("--target <dir>", "Override install directory (ignores --agent and --scope)").action((opts) => {
     const start = Date.now();
     try {
       let targetDir;
@@ -6610,19 +6989,22 @@ function registerSkillsCommands(program2) {
         const scopePath = opts.scope === "user" ? agentConfig.user : agentConfig.project;
         targetDir = path5.resolve(scopePath);
       }
-      warn("Fetching skill list from GitHub...");
-      const listRes = await fetch(GITHUB_API, {
-        headers: { "Accept": "application/vnd.github.v3+json", "User-Agent": "pncli" }
-      });
-      if (!listRes.ok) {
-        throw new Error(`GitHub API returned ${listRes.status}: ${await listRes.text()}`);
+      const resolvedTarget = path5.resolve(targetDir);
+      const bundledDir = getBundledSkillsDir();
+      let skillDirs = [];
+      if (bundledDir !== "") {
+        try {
+          skillDirs = fs3.readdirSync(bundledDir).filter(
+            (name) => fs3.existsSync(path5.join(bundledDir, name, "SKILL.md"))
+          );
+        } catch {
+        }
       }
-      const entries = await listRes.json();
-      const skillDirs = entries.filter((e) => e.type === "dir").map((e) => e.name);
       if (skillDirs.length === 0) {
-        throw new Error("No skills found in the pncli repository");
+        throw new Error("No bundled skills found. Reinstall pncli to get the latest version: npm install -g @kolatts/pncli");
       }
-      const resolvedTarget = path5.resolve(targetDir);
+      const installed = [];
+      const failed = [];
       for (const skillName of skillDirs) {
         const existingDir = path5.resolve(targetDir, skillName);
         if (!existingDir.startsWith(resolvedTarget + path5.sep)) continue;
@@ -6630,25 +7012,15 @@ function registerSkillsCommands(program2) {
           fs3.rmSync(existingDir, { recursive: true, force: true });
         }
       }
-      warn(`Found ${skillDirs.length} skills. Downloading to ${targetDir}...`);
-      const installed = [];
-      const failed = [];
+      warn(`Installing ${skillDirs.length} bundled skill(s) to ${targetDir}...`);
       for (const skillName of skillDirs) {
         const skillDir = path5.resolve(targetDir, skillName);
         if (!skillDir.startsWith(resolvedTarget + path5.sep)) {
           failed.push(skillName);
           continue;
         }
-        const skillUrl = `${RAW_BASE}/${skillName}/SKILL.md`;
         try {
-          const res = await fetch(skillUrl, {
-            headers: { "User-Agent": "pncli" }
-          });
-          if (!res.ok) {
-            failed.push(skillName);
-            continue;
-          }
-          const content = await res.text();
+          const content = fs3.readFileSync(path5.join(bundledDir, skillName, "SKILL.md"), "utf8");
           fs3.mkdirSync(skillDir, { recursive: true });
           fs3.writeFileSync(path5.join(skillDir, "SKILL.md"), content, "utf8");
           installed.push(skillName);
@@ -6658,7 +7030,7 @@ function registerSkillsCommands(program2) {
       }
       warn(`Installed ${installed.length} skill(s) to ${targetDir}`);
       if (failed.length > 0) {
-        warn(`Failed to download: ${failed.join(", ")}`);
+        warn(`Failed to install: ${failed.join(", ")}`);
       }
       success({
         installed,
@@ -6666,7 +7038,8 @@ function registerSkillsCommands(program2) {
         target: targetDir,
         total: installed.length,
         agent: opts.target ? "custom" : opts.agent,
-        scope: opts.target ? "custom" : opts.scope
+        scope: opts.target ? "custom" : opts.scope,
+        source: "bundled"
       }, "skills", "install", start);
     } catch (err) {
       fail(err, "skills", "install", start);
@@ -6772,6 +7145,7 @@ registerUdeployCommands(program);
 registerCheckmarxCommands(program);
 registerServiceNowCommands(program);
 registerContrastCommands(program);
+registerSonatypeIqCommands(program);
 registerSkillsCommands(program);
 program.addHelpText("after", `
 Services:
@@ -6789,6 +7163,7 @@ Services:
   checkmarx    Checkmarx CxSAST (projects, scans, scan statistics)
   servicenow   ServiceNow (change requests)
   contrast     Contrast IAST (applications, vulnerability findings)
+  sonatypeiq   Sonatype IQ Server (applications, organizations, policies)
   config       Manage pncli configuration
   skills       Download and manage Claude Code skills
 `);