@syndicalt/snow-cli 1.1.0 → 1.5.0

package/dist/index.js

@@ -321,8 +321,8 @@ Hint: PDI instances have lower transaction quotas. Wait a moment then retry, or
 
 // src/index.ts
 init_esm_shims();
-import { Command as Command7 } from "commander";
-import chalk7 from "chalk";
+import { Command as Command12 } from "commander";
+import chalk12 from "chalk";
 
 // src/commands/instance.ts
 init_esm_shims();
@@ -517,8 +517,8 @@ function printRecords(records, format) {
     return;
   }
   const naturalWidths = keys.map((k) => {
-    const maxVal = rows.reduce((max, row) => {
-      return Math.max(max, flattenValue(row[k]).length);
+    const maxVal = rows.reduce((max, row2) => {
+      return Math.max(max, flattenValue(row2[k]).length);
     }, k.length);
     return Math.min(maxVal, 60);
   });
@@ -528,9 +528,9 @@ function printRecords(records, format) {
   const divider = chalk2.dim(colWidths.map((w) => "\u2500".repeat(w)).join("  "));
   console.log(header);
   console.log(divider);
-  for (const row of rows) {
+  for (const row2 of rows) {
     const line = keys.map((k, i) => {
-      const val = flattenValue(row[k]);
+      const val = flattenValue(row2[k]);
       return val.length > colWidths[i] ? val.slice(0, colWidths[i] - 1) + "\u2026" : val.padEnd(colWidths[i]);
     }).join("  ");
     console.log(line);
@@ -631,8 +631,8 @@ function tableCommand() {
   );
   cmd.command("delete <table> <sys_id>").description("Delete a record").option("-y, --yes", "Skip confirmation prompt").action(async (table, sysId, opts) => {
     if (!opts.yes) {
-      const { confirm: confirm2 } = await import("@inquirer/prompts");
-      const ok = await confirm2({
+      const { confirm: confirm6 } = await import("@inquirer/prompts");
+      const ok = await confirm6({
         message: `Delete ${table}/${sysId}?`,
         default: false
       });
@@ -1323,6 +1323,17 @@ import { join as join3 } from "path";
 import { spawnSync } from "child_process";
 import chalk4 from "chalk";
 import ora3 from "ora";
+import { confirm as confirm2 } from "@inquirer/prompts";
+var SCRIPT_TABLES = [
+  { table: "sys_script_include", field: "script", label: "Script Include" },
+  { table: "sys_script", field: "script", label: "Business Rule" },
+  { table: "sys_script_client", field: "script", label: "Client Script" },
+  { table: "sys_ui_action", field: "script", label: "UI Action" },
+  { table: "sys_ui_page", field: "html", label: "UI Page (HTML)" },
+  { table: "sys_ui_page", field: "client_script", label: "UI Page (Client)" },
+  { table: "sys_ui_page", field: "processing_script", label: "UI Page (Server)" },
+  { table: "sysauto_script", field: "script", label: "Scheduled Job" }
+];
 function extensionForField(fieldName, fieldType) {
   if (fieldType === "html" || fieldName.endsWith("_html")) return ".html";
   if (fieldType === "css" || fieldName === "css") return ".css";
@@ -1386,8 +1397,8 @@ function scriptCommand() {
         console.error(chalk4.red(`Editor exited with code ${result.status ?? "?"}`));
         process.exit(result.status ?? 1);
       }
-      const { confirm: confirm2 } = await import("@inquirer/prompts");
-      const shouldPush = await confirm2({
+      const { confirm: confirm6 } = await import("@inquirer/prompts");
+      const shouldPush = await confirm6({
         message: `Push changes to ${instance.alias}?`,
         default: true
       });
@@ -1433,6 +1444,148 @@ function scriptCommand() {
       console.log(`${chalk4.cyan(f)}  ${chalk4.dim(modified)}`);
     }
   });
+  cmd.command("search <scope>").description("Search for a pattern across script fields in an app scope").requiredOption("-c, --contains <pattern>", "Text or regex pattern to search for").option("-t, --tables <tables>", "Comma-separated list of tables to search (default: all script tables)").option("--regex", "Treat --contains as a JavaScript regex").option("-l, --limit <n>", "Max records to fetch per table (default: 500)", "500").action(async (scope, opts) => {
+    const instance = requireActiveInstance();
+    const client = new ServiceNowClient(instance);
+    const limit = parseInt(opts.limit, 10) || 500;
+    const tables = opts.tables ? opts.tables.split(",").map((t) => t.trim()).flatMap(
+      (t) => SCRIPT_TABLES.filter((st) => st.table === t)
+    ) : SCRIPT_TABLES;
+    let matcher;
+    if (opts.regex) {
+      const re = new RegExp(opts.contains, "g");
+      matcher = (s) => re.test(s);
+    } else {
+      matcher = (s) => s.includes(opts.contains);
+    }
+    let totalMatches = 0;
+    for (const { table, field, label } of tables) {
+      const spinner = ora3(`Searching ${label} (${table}.${field})...`).start();
+      let records;
+      try {
+        records = await client.queryTable(table, {
+          sysparmQuery: `sys_scope.scope=${scope}^${field}ISNOTEMPTY`,
+          sysparmFields: `sys_id,name,${field}`,
+          sysparmLimit: limit
+        });
+        spinner.stop();
+      } catch (err) {
+        spinner.fail(chalk4.red(`${label}: ${err instanceof Error ? err.message : String(err)}`));
+        continue;
+      }
+      const matches = records.filter((r) => matcher(r[field] ?? ""));
+      if (matches.length === 0) continue;
+      console.log(chalk4.bold(`
+${label} \u2014 ${matches.length} match(es):`));
+      for (const r of matches) {
+        const content = r[field] ?? "";
+        const lines = content.split("\n");
+        const matchingLines = lines.map((line, i) => ({ line, num: i + 1 })).filter(({ line }) => matcher(line));
+        console.log(`  ${chalk4.cyan(r["name"] ?? r["sys_id"])}  ${chalk4.dim(r["sys_id"])}`);
+        for (const { line, num } of matchingLines.slice(0, 5)) {
+          const trimmed = line.trim().slice(0, 120);
+          console.log(`    ${chalk4.dim(`L${num}:`)} ${trimmed}`);
+        }
+        if (matchingLines.length > 5) {
+          console.log(chalk4.dim(`    ... and ${matchingLines.length - 5} more line(s)`));
+        }
+        totalMatches++;
+      }
+    }
+    console.log();
+    if (totalMatches === 0) {
+      console.log(chalk4.yellow(`No matches found for "${opts.contains}" in scope "${scope}".`));
+    } else {
+      console.log(chalk4.green(`Found matches in ${totalMatches} record(s).`));
+    }
+  });
+  cmd.command("replace <scope>").description("Find and replace text across script fields in an app scope").requiredOption("-f, --find <pattern>", "Text to find").requiredOption("-r, --replace <text>", "Replacement text").option("-t, --tables <tables>", "Comma-separated list of tables to target (default: all script tables)").option("--regex", "Treat --find as a JavaScript regex").option("-l, --limit <n>", "Max records to fetch per table (default: 500)", "500").option("--dry-run", "Show what would change without writing to the instance").option("--yes", "Skip confirmation prompt").action(async (scope, opts) => {
+    const instance = requireActiveInstance();
+    const client = new ServiceNowClient(instance);
+    const limit = parseInt(opts.limit, 10) || 500;
+    const tables = opts.tables ? opts.tables.split(",").map((t) => t.trim()).flatMap(
+      (t) => SCRIPT_TABLES.filter((st) => st.table === t)
+    ) : SCRIPT_TABLES;
+    const pattern = opts.regex ? new RegExp(opts.find, "g") : opts.find;
+    const doReplace = (s) => typeof pattern === "string" ? s.split(pattern).join(opts.replace) : s.replace(pattern, opts.replace);
+    const hasMatch = (s) => typeof pattern === "string" ? s.includes(pattern) : pattern.test(s);
+    const candidates = [];
+    for (const { table, field, label } of tables) {
+      const spinner = ora3(`Scanning ${label} (${table}.${field})...`).start();
+      let records;
+      try {
+        records = await client.queryTable(table, {
+          sysparmQuery: `sys_scope.scope=${scope}^${field}ISNOTEMPTY`,
+          sysparmFields: `sys_id,name,${field}`,
+          sysparmLimit: limit
+        });
+        spinner.stop();
+      } catch (err) {
+        spinner.fail(chalk4.red(`${label}: ${err instanceof Error ? err.message : String(err)}`));
+        continue;
+      }
+      for (const r of records) {
+        if (pattern instanceof RegExp) pattern.lastIndex = 0;
+        const original = r[field] ?? "";
+        if (!hasMatch(original)) continue;
+        if (pattern instanceof RegExp) pattern.lastIndex = 0;
+        const updated = doReplace(original);
+        candidates.push({
+          table,
+          field,
+          label,
+          sysId: r["sys_id"],
+          name: r["name"] ?? r["sys_id"],
+          original,
+          updated
+        });
+      }
+    }
+    if (candidates.length === 0) {
+      console.log(chalk4.yellow(`No matches found for "${opts.find}" in scope "${scope}".`));
+      return;
+    }
+    console.log(chalk4.bold(`
+${candidates.length} record(s) will be modified:
+`));
+    for (const c of candidates) {
+      console.log(`  ${chalk4.cyan(c.name)}  ${chalk4.dim(`${c.label} \u2014 ${c.table}/${c.sysId}`)}`);
+    }
+    console.log();
+    if (opts.dryRun) {
+      console.log(chalk4.yellow("Dry run \u2014 no changes made."));
+      return;
+    }
+    if (!opts.yes) {
+      const ok = await confirm2({
+        message: `Replace "${opts.find}" \u2192 "${opts.replace}" in ${candidates.length} record(s) on ${instance.alias}?`,
+        default: false
+      });
+      if (!ok) {
+        console.log(chalk4.dim("Aborted."));
+        return;
+      }
+    }
+    let successCount = 0;
+    let failCount = 0;
+    for (const c of candidates) {
+      const spinner = ora3(`Updating ${c.name}...`).start();
+      try {
+        await client.updateRecord(c.table, c.sysId, { [c.field]: c.updated });
+        spinner.succeed(chalk4.green(`Updated: ${c.name}`));
+        successCount++;
+      } catch (err) {
+        spinner.fail(chalk4.red(`Failed ${c.name}: ${err instanceof Error ? err.message : String(err)}`));
+        failCount++;
+      }
+    }
+    console.log();
+    if (failCount === 0) {
+      console.log(chalk4.green(`Replaced in ${successCount} record(s) successfully.`));
+    } else {
+      console.log(chalk4.yellow(`Replaced in ${successCount} record(s). ${failCount} failed.`));
+    }
+  });
   return cmd;
 }
 async function pushScript(client, table, sysId, field, filePath) {
@@ -3010,8 +3163,8 @@ async function confirmPush(build, dir, autoPush) {
   let shouldPush = autoPush ?? false;
   if (!shouldPush) {
     console.log();
-    const { confirm: confirm2 } = await import("@inquirer/prompts");
-    shouldPush = await confirm2({
+    const { confirm: confirm6 } = await import("@inquirer/prompts");
+    shouldPush = await confirm6({
       message: `Push ${build.artifacts.length} artifact(s) to ${chalk6.cyan(instance.alias)} (${instance.url})?`,
       default: false
     });
@@ -3076,7 +3229,7 @@ function printCodeBlock(code, label) {
   console.log(chalk6.dim("\u2500".repeat(width)));
 }
 async function runReview(build, buildDir) {
-  const { select: select2, confirm: confirm2 } = await import("@inquirer/prompts");
+  const { select: select2, confirm: confirm6 } = await import("@inquirer/prompts");
   const editor = resolveEditor2();
   let modified = false;
   console.log();
@@ -3122,7 +3275,7 @@ async function runReview(build, buildDir) {
     console.log();
     printCodeBlock(currentCode, `${artifactName} \u2014 ${fieldDef.label}`);
     console.log();
-    const shouldEdit = await confirm2({ message: "Open in editor to edit?", default: false });
+    const shouldEdit = await confirm6({ message: "Open in editor to edit?", default: false });
     if (shouldEdit) {
       const tmpFile = join4(tmpdir2(), `snow-review-${Date.now()}${fieldDef.ext}`);
       writeFileSync4(tmpFile, currentCode, "utf-8");
@@ -3423,52 +3576,1241 @@ ${chalk6.dim("Slash commands:")}
   return cmd;
 }
 
+// src/commands/bulk.ts
+init_esm_shims();
+init_config();
+init_client();
+import { Command as Command7 } from "commander";
+import chalk7 from "chalk";
+import ora6 from "ora";
+import { confirm as confirm3 } from "@inquirer/prompts";
+function parseSetArgs(setArgs) {
+  const fields = {};
+  for (const arg of setArgs) {
+    const eq = arg.indexOf("=");
+    if (eq === -1) {
+      console.error(chalk7.red(`Invalid --set value "${arg}": expected field=value`));
+      process.exit(1);
+    }
+    fields[arg.slice(0, eq)] = arg.slice(eq + 1);
+  }
+  return fields;
+}
+function renderPreviewTable(records, fields) {
+  const fieldNames = Object.keys(fields);
+  const headers = ["sys_id", "display_name", ...fieldNames.map((f) => `${f} (new)`)];
+  const rows = records.map((r) => {
+    const sysId = String(r["sys_id"] ?? "");
+    const displayName = String(r["name"] ?? r["short_description"] ?? r["number"] ?? r["sys_name"] ?? "");
+    return [sysId, displayName, ...fieldNames.map((f) => fields[f])];
+  });
+  const colWidths = headers.map(
+    (h, i) => Math.max(h.length, ...rows.map((r) => r[i]?.length ?? 0))
+  );
+  const divider = colWidths.map((w) => "-".repeat(w + 2)).join("+");
+  const fmt = (row2) => row2.map((cell, i) => ` ${cell.padEnd(colWidths[i])} `).join("|");
+  console.log(chalk7.bold(fmt(headers)));
+  console.log(divider);
+  for (const row2 of rows) {
+    console.log(fmt(row2));
+  }
+}
+function bulkCommand() {
+  const cmd = new Command7("bulk").description("Bulk operations on ServiceNow records");
+  cmd.command("update <table>").description("Update multiple records matching a query").requiredOption("-q, --query <query>", "ServiceNow encoded query to select records").option("-s, --set <field=value>", "Field to set (repeat for multiple fields)", (val, acc) => {
+    acc.push(val);
+    return acc;
+  }, []).option("-l, --limit <n>", "Max records to update (default: 200)", "200").option("--dry-run", "Preview which records would be updated without making changes").option("--yes", "Skip confirmation prompt").action(async (table, opts) => {
+    if (opts.set.length === 0) {
+      console.error(chalk7.red("At least one --set field=value is required."));
+      process.exit(1);
+    }
+    const fields = parseSetArgs(opts.set);
+    const limit = parseInt(opts.limit, 10);
+    if (isNaN(limit) || limit < 1) {
+      console.error(chalk7.red("--limit must be a positive integer"));
+      process.exit(1);
+    }
+    const instance = requireActiveInstance();
+    const client = new ServiceNowClient(instance);
+    const fetchSpinner = ora6(`Fetching records from ${table}...`).start();
+    let records;
+    try {
+      records = await client.queryTable(table, {
+        sysparmQuery: opts.query,
+        sysparmFields: `sys_id,name,short_description,number,sys_name`,
+        sysparmLimit: limit
+      });
+      fetchSpinner.stop();
+    } catch (err) {
+      fetchSpinner.fail();
+      console.error(chalk7.red(err instanceof Error ? err.message : String(err)));
+      process.exit(1);
+    }
+    if (records.length === 0) {
+      console.log(chalk7.yellow("No records matched the query."));
+      return;
+    }
+    console.log(chalk7.bold(`
+${records.length} record(s) will be updated on ${chalk7.cyan(instance.alias)}:`));
+    renderPreviewTable(records, fields);
+    console.log();
+    if (opts.dryRun) {
+      console.log(chalk7.yellow("Dry run \u2014 no changes made."));
+      return;
+    }
+    if (!opts.yes) {
+      const ok = await confirm3({
+        message: `Update ${records.length} record(s) in ${table}?`,
+        default: false
+      });
+      if (!ok) {
+        console.log(chalk7.dim("Aborted."));
+        return;
+      }
+    }
+    let successCount = 0;
+    let failCount = 0;
+    const updateSpinner = ora6(`Updating 0/${records.length}...`).start();
+    for (let i = 0; i < records.length; i++) {
+      const sysId = String(records[i]["sys_id"]);
+      updateSpinner.text = `Updating ${i + 1}/${records.length}...`;
+      try {
+        await client.updateRecord(table, sysId, fields);
+        successCount++;
+      } catch (err) {
+        failCount++;
+        updateSpinner.stop();
+        console.error(chalk7.red(`  Failed ${sysId}: ${err instanceof Error ? err.message : String(err)}`));
+        updateSpinner.start(`Updating ${i + 1}/${records.length}...`);
+      }
+    }
+    updateSpinner.stop();
+    if (failCount === 0) {
+      console.log(chalk7.green(`
+Updated ${successCount} record(s) successfully.`));
+    } else {
+      console.log(chalk7.yellow(`
+Updated ${successCount} record(s). ${failCount} failed.`));
+    }
+  });
+  return cmd;
+}
+
+// src/commands/user.ts
+init_esm_shims();
+init_config();
+init_client();
+import { Command as Command8 } from "commander";
+import chalk8 from "chalk";
+import ora7 from "ora";
+import { confirm as confirm4 } from "@inquirer/prompts";
+async function resolveUser(client, query) {
+  const isSysId = /^[0-9a-f]{32}$/i.test(query);
+  const snQuery = isSysId ? `sys_id=${query}` : `user_name=${query}^ORemail=${query}^ORname=${query}`;
+  const res = await client.queryTable("sys_user", {
+    sysparmQuery: snQuery,
+    sysparmFields: "sys_id,name,user_name,email",
+    sysparmLimit: 2
+  });
+  if (res.length === 0) throw new Error(`User not found: ${query}`);
+  if (res.length > 1) throw new Error(`Ambiguous user query "${query}" \u2014 matched multiple users. Use sys_id or user_name.`);
+  return { sysId: res[0].sys_id, name: `${res[0].name} (${res[0].user_name})` };
+}
+async function resolveGroup(client, query) {
+  const isSysId = /^[0-9a-f]{32}$/i.test(query);
+  const snQuery = isSysId ? `sys_id=${query}` : `name=${query}`;
+  const res = await client.queryTable("sys_user_group", {
+    sysparmQuery: snQuery,
+    sysparmFields: "sys_id,name",
+    sysparmLimit: 2
+  });
+  if (res.length === 0) throw new Error(`Group not found: ${query}`);
+  if (res.length > 1) throw new Error(`Ambiguous group query "${query}" \u2014 matched multiple groups. Use sys_id or exact name.`);
+  return { sysId: res[0].sys_id, name: res[0].name };
+}
+async function resolveRole(client, query) {
+  const isSysId = /^[0-9a-f]{32}$/i.test(query);
+  const snQuery = isSysId ? `sys_id=${query}` : `name=${query}`;
+  const res = await client.queryTable("sys_user_role", {
+    sysparmQuery: snQuery,
+    sysparmFields: "sys_id,name",
+    sysparmLimit: 2
+  });
+  if (res.length === 0) throw new Error(`Role not found: ${query}`);
+  if (res.length > 1) throw new Error(`Ambiguous role "${query}" \u2014 use sys_id or exact name.`);
+  return { sysId: res[0].sys_id, name: res[0].name };
+}
+function userCommand() {
+  const cmd = new Command8("user").description("Manage ServiceNow users, groups, and roles");
+  cmd.command("add-to-group <user> <group>").description("Add a user to a group").option("--yes", "Skip confirmation").action(async (userQuery, groupQuery, opts) => {
+    const instance = requireActiveInstance();
+    const client = new ServiceNowClient(instance);
+    const spinner = ora7("Resolving user and group...").start();
+    let user;
+    let group;
+    try {
+      [user, group] = await Promise.all([
+        resolveUser(client, userQuery),
+        resolveGroup(client, groupQuery)
+      ]);
+      spinner.stop();
+    } catch (err) {
+      spinner.fail();
+      console.error(chalk8.red(err instanceof Error ? err.message : String(err)));
+      process.exit(1);
+    }
+    const existing = await client.queryTable("sys_user_grmember", {
+      sysparmQuery: `user=${user.sysId}^group=${group.sysId}`,
+      sysparmFields: "sys_id",
+      sysparmLimit: 1
+    });
+    if (existing.length > 0) {
+      console.log(chalk8.yellow(`${user.name} is already a member of ${group.name}.`));
+      return;
+    }
+    console.log(`Add ${chalk8.cyan(user.name)} to group ${chalk8.cyan(group.name)} on ${chalk8.bold(instance.alias)}?`);
+    if (!opts.yes) {
+      const ok = await confirm4({ message: "Proceed?", default: true });
+      if (!ok) {
+        console.log(chalk8.dim("Aborted."));
+        return;
+      }
+    }
+    const addSpinner = ora7("Adding to group...").start();
+    try {
+      await client.createRecord("sys_user_grmember", { user: user.sysId, group: group.sysId });
+      addSpinner.succeed(chalk8.green(`Added ${user.name} to ${group.name}.`));
+    } catch (err) {
+      addSpinner.fail();
+      console.error(chalk8.red(err instanceof Error ? err.message : String(err)));
+      process.exit(1);
+    }
+  });
+  cmd.command("remove-from-group <user> <group>").description("Remove a user from a group").option("--yes", "Skip confirmation").action(async (userQuery, groupQuery, opts) => {
+    const instance = requireActiveInstance();
+    const client = new ServiceNowClient(instance);
+    const spinner = ora7("Resolving user and group...").start();
+    let user;
+    let group;
+    try {
+      [user, group] = await Promise.all([
+        resolveUser(client, userQuery),
+        resolveGroup(client, groupQuery)
+      ]);
+      spinner.stop();
+    } catch (err) {
+      spinner.fail();
+      console.error(chalk8.red(err instanceof Error ? err.message : String(err)));
+      process.exit(1);
+    }
+    const members = await client.queryTable("sys_user_grmember", {
+      sysparmQuery: `user=${user.sysId}^group=${group.sysId}`,
+      sysparmFields: "sys_id",
+      sysparmLimit: 1
+    });
+    if (members.length === 0) {
+      console.log(chalk8.yellow(`${user.name} is not a member of ${group.name}.`));
+      return;
+    }
+    console.log(`Remove ${chalk8.cyan(user.name)} from group ${chalk8.cyan(group.name)} on ${chalk8.bold(instance.alias)}?`);
+    if (!opts.yes) {
+      const ok = await confirm4({ message: "Proceed?", default: false });
+      if (!ok) {
+        console.log(chalk8.dim("Aborted."));
+        return;
+      }
+    }
+    const removeSpinner = ora7("Removing from group...").start();
+    try {
+      await client.deleteRecord("sys_user_grmember", members[0].sys_id);
+      removeSpinner.succeed(chalk8.green(`Removed ${user.name} from ${group.name}.`));
+    } catch (err) {
+      removeSpinner.fail();
+      console.error(chalk8.red(err instanceof Error ? err.message : String(err)));
+      process.exit(1);
+    }
+  });
+  cmd.command("assign-role <user> <role>").description("Assign a role to a user").option("--yes", "Skip confirmation").action(async (userQuery, roleQuery, opts) => {
+    const instance = requireActiveInstance();
+    const client = new ServiceNowClient(instance);
+    const spinner = ora7("Resolving user and role...").start();
+    let user;
+    let role;
+    try {
+      [user, role] = await Promise.all([
+        resolveUser(client, userQuery),
+        resolveRole(client, roleQuery)
+      ]);
+      spinner.stop();
+    } catch (err) {
+      spinner.fail();
+      console.error(chalk8.red(err instanceof Error ? err.message : String(err)));
+      process.exit(1);
+    }
+    const existing = await client.queryTable("sys_user_has_role", {
+      sysparmQuery: `user=${user.sysId}^role=${role.sysId}`,
+      sysparmFields: "sys_id",
+      sysparmLimit: 1
+    });
+    if (existing.length > 0) {
+      console.log(chalk8.yellow(`${user.name} already has role ${role.name}.`));
+      return;
+    }
+    console.log(`Assign role ${chalk8.cyan(role.name)} to ${chalk8.cyan(user.name)} on ${chalk8.bold(instance.alias)}?`);
+    if (!opts.yes) {
+      const ok = await confirm4({ message: "Proceed?", default: true });
+      if (!ok) {
+        console.log(chalk8.dim("Aborted."));
+        return;
+      }
+    }
+    const assignSpinner = ora7("Assigning role...").start();
+    try {
+      await client.createRecord("sys_user_has_role", { user: user.sysId, role: role.sysId });
+      assignSpinner.succeed(chalk8.green(`Assigned role ${role.name} to ${user.name}.`));
+    } catch (err) {
+      assignSpinner.fail();
+      console.error(chalk8.red(err instanceof Error ? err.message : String(err)));
+      process.exit(1);
+    }
+  });
+  cmd.command("remove-role <user> <role>").description("Remove a role from a user").option("--yes", "Skip confirmation").action(async (userQuery, roleQuery, opts) => {
+    const instance = requireActiveInstance();
+    const client = new ServiceNowClient(instance);
+    const spinner = ora7("Resolving user and role...").start();
+    let user;
+    let role;
+    try {
+      [user, role] = await Promise.all([
+        resolveUser(client, userQuery),
+        resolveRole(client, roleQuery)
+      ]);
+      spinner.stop();
+    } catch (err) {
+      spinner.fail();
+      console.error(chalk8.red(err instanceof Error ? err.message : String(err)));
+      process.exit(1);
+    }
+    const existing = await client.queryTable("sys_user_has_role", {
+      sysparmQuery: `user=${user.sysId}^role=${role.sysId}`,
+      sysparmFields: "sys_id",
+      sysparmLimit: 1
+    });
+    if (existing.length === 0) {
+      console.log(chalk8.yellow(`${user.name} does not have role ${role.name}.`));
+      return;
+    }
+    console.log(`Remove role ${chalk8.cyan(role.name)} from ${chalk8.cyan(user.name)} on ${chalk8.bold(instance.alias)}?`);
+    if (!opts.yes) {
+      const ok = await confirm4({ message: "Proceed?", default: false });
+      if (!ok) {
+        console.log(chalk8.dim("Aborted."));
+        return;
+      }
+    }
+    const removeSpinner = ora7("Removing role...").start();
+    try {
+      await client.deleteRecord("sys_user_has_role", existing[0].sys_id);
+      removeSpinner.succeed(chalk8.green(`Removed role ${role.name} from ${user.name}.`));
+    } catch (err) {
+      removeSpinner.fail();
+      console.error(chalk8.red(err instanceof Error ? err.message : String(err)));
+      process.exit(1);
+    }
+  });
+  return cmd;
+}
+
+// src/commands/attachment.ts
+init_esm_shims();
+init_config();
+init_client();
+import { Command as Command9 } from "commander";
+import { writeFileSync as writeFileSync5, mkdirSync as mkdirSync5, existsSync as existsSync4 } from "fs";
+import { join as join5, basename as basename2 } from "path";
+import { createReadStream, statSync as statSync2 } from "fs";
+import chalk9 from "chalk";
+import ora8 from "ora";
+function humanSize(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+async function listAttachments(client, table, sysId) {
+  const res = await client.get("/api/now/attachment", {
+    params: {
+      sysparm_query: `table_name=${table}^table_sys_id=${sysId}`,
+      sysparm_fields: "sys_id,file_name,content_type,size_bytes,table_name,table_sys_id",
+      sysparm_limit: 500
+    }
+  });
+  return res.result ?? [];
+}
+async function downloadAttachment(client, attSysId) {
+  const res = await client.getAxiosInstance().get(
+    `/api/now/attachment/${attSysId}/file`,
+    { responseType: "arraybuffer" }
+  );
+  return Buffer.from(res.data);
+}
+function attachmentCommand() {
+  const cmd = new Command9("attachment").alias("att").description("Manage ServiceNow record attachments");
+  cmd.command("list <table> <sys_id>").alias("ls").description("List attachments on a record").action(async (table, sysId) => {
+    const instance = requireActiveInstance();
+    const client = new ServiceNowClient(instance);
+    const spinner = ora8("Fetching attachments...").start();
+    let attachments;
+    try {
+      attachments = await listAttachments(client, table, sysId);
+      spinner.stop();
+    } catch (err) {
+      spinner.fail();
+      console.error(chalk9.red(err instanceof Error ? err.message : String(err)));
+      process.exit(1);
+    }
+    if (attachments.length === 0) {
+      console.log(chalk9.dim("No attachments found."));
+      return;
+    }
+    console.log(chalk9.bold(`
+${attachments.length} attachment(s) on ${table}/${sysId}:
+`));
+    const nameWidth = Math.max(9, ...attachments.map((a) => a.file_name.length));
+    const typeWidth = Math.max(12, ...attachments.map((a) => a.content_type.length));
+    console.log(
+      chalk9.bold(
+        `${"File name".padEnd(nameWidth)}  ${"Content-Type".padEnd(typeWidth)}  Size       sys_id`
+      )
+    );
+    console.log(`${"-".repeat(nameWidth)}  ${"-".repeat(typeWidth)}  ---------  ${"-".repeat(32)}`);
+    for (const att of attachments) {
+      const size = humanSize(parseInt(att.size_bytes, 10) || 0);
+      console.log(
+        `${chalk9.cyan(att.file_name.padEnd(nameWidth))}  ${att.content_type.padEnd(typeWidth)}  ${size.padStart(9)}  ${chalk9.dim(att.sys_id)}`
+      );
+    }
+  });
+  cmd.command("pull <table> <sys_id>").description("Download attachment(s) from a record").option("-a, --all", "Download all attachments").option("-n, --name <file_name>", "Download a specific attachment by file name").option("-o, --out <dir>", "Output directory (default: current directory)").action(async (table, sysId, opts) => {
+    if (!opts.all && !opts.name) {
+      console.error(chalk9.red("Specify --all to download all attachments, or --name <file_name> for one."));
+      process.exit(1);
+    }
+    const instance = requireActiveInstance();
+    const client = new ServiceNowClient(instance);
+    const outDir = opts.out ?? ".";
+    if (!existsSync4(outDir)) mkdirSync5(outDir, { recursive: true });
+    const spinner = ora8("Fetching attachment list...").start();
+    let attachments;
+    try {
+      attachments = await listAttachments(client, table, sysId);
+      spinner.stop();
+    } catch (err) {
+      spinner.fail();
+      console.error(chalk9.red(err instanceof Error ? err.message : String(err)));
+      process.exit(1);
+    }
+    if (attachments.length === 0) {
+      console.log(chalk9.dim("No attachments found."));
+      return;
+    }
+    let targets = attachments;
+    if (opts.name) {
+      targets = attachments.filter((a) => a.file_name === opts.name);
+      if (targets.length === 0) {
+        console.error(chalk9.red(`No attachment named "${opts.name}" found.`));
+        process.exit(1);
+      }
+    }
+    let downloaded = 0;
+    for (const att of targets) {
+      const dlSpinner = ora8(`Downloading ${att.file_name}...`).start();
+      try {
+        const buf = await downloadAttachment(client, att.sys_id);
+        const dest = join5(outDir, att.file_name);
+        writeFileSync5(dest, buf);
+        dlSpinner.succeed(chalk9.green(`Saved: ${dest} (${humanSize(buf.length)})`));
+        downloaded++;
+      } catch (err) {
+        dlSpinner.fail(chalk9.red(`Failed ${att.file_name}: ${err instanceof Error ? err.message : String(err)}`));
+      }
+    }
+    if (targets.length > 1) {
+      console.log(chalk9.bold(`
+${downloaded}/${targets.length} downloaded to ${outDir}`));
+    }
+  });
+  cmd.command("push <table> <sys_id> <file>").description("Upload a file as an attachment to a record").option("-t, --type <content-type>", "Override Content-Type (auto-detected by default)").action(async (table, sysId, file, opts) => {
+    if (!existsSync4(file)) {
+      console.error(chalk9.red(`File not found: ${file}`));
+      process.exit(1);
+    }
+    const instance = requireActiveInstance();
+    const client = new ServiceNowClient(instance);
+    const fileName = basename2(file);
+    const stat = statSync2(file);
+    const contentType = opts.type ?? guessContentType(fileName);
+    const spinner = ora8(`Uploading ${fileName} (${humanSize(stat.size)})...`).start();
+    try {
+      const stream = createReadStream(file);
+      const res = await client.getAxiosInstance().post(
+        "/api/now/attachment/file",
+        stream,
+        {
+          params: {
+            table_name: table,
+            table_sys_id: sysId,
+            file_name: fileName
+          },
+          headers: {
+            "Content-Type": contentType,
+            "Content-Length": stat.size
+          },
+          maxBodyLength: Infinity,
+          maxContentLength: Infinity
+        }
+      );
+      const created = res.data.result;
+      spinner.succeed(
+        chalk9.green(`Uploaded: ${created.file_name} (${humanSize(parseInt(created.size_bytes, 10))}) \u2014 sys_id: ${created.sys_id}`)
+      );
+    } catch (err) {
+      spinner.fail();
+      console.error(chalk9.red(err instanceof Error ? err.message : String(err)));
+      process.exit(1);
+    }
+  });
+  return cmd;
+}
+function guessContentType(fileName) {
+  const ext = fileName.slice(fileName.lastIndexOf(".")).toLowerCase();
+  const map = {
+    ".pdf": "application/pdf",
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+    ".svg": "image/svg+xml",
+    ".txt": "text/plain",
+    ".csv": "text/csv",
+    ".xml": "application/xml",
+    ".json": "application/json",
+    ".zip": "application/zip",
+    ".js": "application/javascript",
+    ".html": "text/html",
+    ".css": "text/css",
+    ".md": "text/markdown",
+    ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
+  };
+  return map[ext] ?? "application/octet-stream";
+}
+
+// src/commands/updateset.ts
+init_esm_shims();
+init_config();
+init_client();
+import { Command as Command10 } from "commander";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync6, mkdirSync as mkdirSync6, existsSync as existsSync5 } from "fs";
+import { join as join6 } from "path";
+import chalk10 from "chalk";
+import ora9 from "ora";
+import { confirm as confirm5 } from "@inquirer/prompts";
+async function resolveUpdateSet(client, query) {
+  const isSysId = /^[0-9a-f]{32}$/i.test(query);
+  const snQuery = isSysId ? `sys_id=${query}` : `nameCONTAINS${query}`;
+  const res = await client.queryTable("sys_update_set", {
+    sysparmQuery: snQuery,
+    sysparmFields: "sys_id,name,description,state,application,is_default,sys_created_by,sys_created_on",
+    sysparmDisplayValue: "true",
+    sysparmLimit: isSysId ? 1 : 5
+  });
+  if (res.length === 0) throw new Error(`Update set not found: "${query}"`);
+  if (res.length > 1) {
+    const names = res.map((s) => `  ${chalk10.cyan(s.name)}  (${s.sys_id})`).join("\n");
+    throw new Error(`Ambiguous update set name "${query}" \u2014 matched ${res.length}:
+${names}
+Use sys_id or a more specific name.`);
+  }
+  return res[0];
+}
+async function getCurrentUpdateSet(client) {
+  const prefs = await client.queryTable("sys_user_preference", {
+    sysparmQuery: "name=sys_update_set^userISEMPTY^ORuser.user_name=javascript:gs.getUserName()",
+    sysparmFields: "value",
+    sysparmLimit: 1
+  });
+  const prefSysId = prefs[0]?.value;
+  if (prefSysId) {
+    const sets = await client.queryTable("sys_update_set", {
+      sysparmQuery: `sys_id=${prefSysId}`,
+      sysparmFields: "sys_id,name,description,state,application,is_default,sys_created_by,sys_created_on",
+      sysparmDisplayValue: "true",
+      sysparmLimit: 1
+    });
+    if (sets.length > 0) return sets[0];
+  }
+  const defaults = await client.queryTable("sys_update_set", {
+    sysparmQuery: "state=in progress^is_default=true",
+    sysparmFields: "sys_id,name,description,state,application,is_default,sys_created_by,sys_created_on",
+    sysparmDisplayValue: "true",
+    sysparmLimit: 1
+  });
+  return defaults[0] ?? null;
+}
+async function setCurrentUpdateSet(client, updateSetSysId) {
+  const existing = await client.queryTable("sys_user_preference", {
+    sysparmQuery: "name=sys_update_set^userISEMPTY",
+    sysparmFields: "sys_id",
+    sysparmLimit: 1
+  });
+  if (existing.length > 0) {
+    await client.updateRecord("sys_user_preference", existing[0].sys_id, { value: updateSetSysId });
+  } else {
+    await client.createRecord("sys_user_preference", { name: "sys_update_set", value: updateSetSysId });
+  }
+}
+function displaySet(set) {
+  const app = typeof set.application === "object" ? set.application.display_value : set.application;
+  const isDefault = set.is_default === "true" || set.is_default === "1";
+  const stateColor = set.state === "in progress" ? chalk10.green : set.state === "complete" ? chalk10.blue : chalk10.dim;
+  console.log(`${chalk10.bold(set.name)}${isDefault ? chalk10.yellow("  \u2605 active") : ""}`);
+  console.log(`  sys_id:   ${chalk10.dim(set.sys_id)}`);
+  console.log(`  state:    ${stateColor(set.state)}`);
+  console.log(`  app:      ${app || chalk10.dim("Global")}`);
+  console.log(`  created:  ${set.sys_created_on} by ${set.sys_created_by}`);
+  if (set.description) console.log(`  desc:     ${set.description}`);
+}
+function updatesetCommand() {
+  const cmd = new Command10("updateset").alias("us").description("Manage ServiceNow update sets");
+  cmd.command("list").alias("ls").description("List update sets on the instance").option("-s, --state <state>", 'Filter by state: "in progress", "complete", "ignore" (default: all)').option("-l, --limit <n>", "Max results (default: 50)", "50").action(async (opts) => {
+    const instance = requireActiveInstance();
+    const client = new ServiceNowClient(instance);
+    const limit = parseInt(opts.limit, 10) || 50;
+    const query = opts.state ? `state=${opts.state}` : "state!=ignore";
+    const spinner = ora9("Fetching update sets...").start();
+    let sets;
+    try {
+      sets = await client.queryTable("sys_update_set", {
+        sysparmQuery: `${query}^ORDERBYDESCsys_created_on`,
+        sysparmFields: "sys_id,name,state,application,is_default,sys_created_by,sys_created_on",
+        sysparmDisplayValue: "true",
+        sysparmLimit: limit
+      });
+      spinner.stop();
+    } catch (err) {
+      spinner.fail();
+      console.error(chalk10.red(err instanceof Error ? err.message : String(err)));
+      process.exit(1);
+    }
+    if (sets.length === 0) {
+      console.log(chalk10.dim("No update sets found."));
+      return;
+    }
+    const appLabel = (s) => (typeof s.application === "object" ? s.application.display_value : s.application) || "Global";
+    const nameWidth = Math.max(4, ...sets.map((s) => s.name.length));
+    const stateWidth = Math.max(5, ...sets.map((s) => s.state.length));
+    const appWidth = Math.max(11, ...sets.map((s) => appLabel(s).length));
+    console.log(chalk10.bold(
+      `${"Name".padEnd(nameWidth)}  ${"State".padEnd(stateWidth)}  ${"Application".padEnd(appWidth)}  ${"Created by".padEnd(16)}  Created on`
+    ));
+    console.log(`${"-".repeat(nameWidth)}  ${"-".repeat(stateWidth)}  ${"-".repeat(appWidth)}  ${"-".repeat(16)}  ${"-".repeat(19)}`);
+    for (const s of sets) {
+      const isDefault = s.is_default === "true" || s.is_default === "1";
+      const stateStr = s.state === "in progress" ? chalk10.green(s.state.padEnd(stateWidth)) : chalk10.dim(s.state.padEnd(stateWidth));
+      const marker = isDefault ? chalk10.yellow(" \u2605") : "  ";
+      const app = appLabel(s);
+      console.log(`${chalk10.cyan(s.name.padEnd(nameWidth))}${marker}  ${stateStr}  ${app.padEnd(appWidth)}  ${s.sys_created_by.padEnd(16)}  ${s.sys_created_on}`);
+    }
+  });
+  cmd.command("current").description("Show the currently active update set").action(async () => {
+    const instance = requireActiveInstance();
+    const client = new ServiceNowClient(instance);
+    const spinner = ora9("Fetching current update set...").start();
+    let current;
+    try {
+      current = await getCurrentUpdateSet(client);
+      spinner.stop();
+    } catch (err) {
+      spinner.fail();
+      console.error(chalk10.red(err instanceof Error ? err.message : String(err)));
+      process.exit(1);
+    }
+    if (!current) {
+      console.log(chalk10.yellow("No active update set found. Use `snow updateset set <name>` to activate one."));
+      return;
+    }
+    displaySet(current);
+  });
+  cmd.command("set <name>").description("Set the active update set (stored in sys_user_preference)").action(async (nameOrId) => {
+    const instance = requireActiveInstance();
+    const client = new ServiceNowClient(instance);
+    const spinner = ora9("Resolving update set...").start();
+    let set;
+    try {
+      set = await resolveUpdateSet(client, nameOrId);
+      spinner.stop();
+    } catch (err) {
+      spinner.fail();
+      console.error(chalk10.red(err instanceof Error ? err.message : String(err)));
+      process.exit(1);
+    }
+    const setSpinner = ora9(`Activating "${set.name}"...`).start();
+    try {
+      await setCurrentUpdateSet(client, set.sys_id);
+      setSpinner.succeed(chalk10.green(`Active update set: ${set.name}`));
+    } catch (err) {
+      setSpinner.fail();
+      console.error(chalk10.red(err instanceof Error ? err.message : String(err)));
+      process.exit(1);
+    }
+  });
+  cmd.command("show <name>").description("Show details and captured items for an update set").option("-l, --limit <n>", "Max captured items to show (default: 100)", "100").action(async (nameOrId, opts) => {
+    const instance = requireActiveInstance();
+    const client = new ServiceNowClient(instance);
+    const limit = parseInt(opts.limit, 10) || 100;
+    const spinner = ora9("Fetching update set...").start();
+    let set;
+    try {
+      set = await resolveUpdateSet(client, nameOrId);
+      spinner.stop();
+    } catch (err) {
+      spinner.fail();
+      console.error(chalk10.red(err instanceof Error ? err.message : String(err)));
+      process.exit(1);
+    }
+    displaySet(set);
+    const itemSpinner = ora9("Fetching captured items...").start();
+    let items;
+    try {
+      items = await client.queryTable("sys_update_xml", {
+        sysparmQuery: `update_set=${set.sys_id}^ORDERBYtype`,
+        sysparmFields: "sys_id,name,type,target_name,action,sys_created_on",
+        sysparmLimit: limit
+      });
+      itemSpinner.stop();
+    } catch (err) {
+      itemSpinner.fail();
+      console.error(chalk10.red(err instanceof Error ? err.message : String(err)));
+      process.exit(1);
+    }
+    if (items.length === 0) {
+      console.log(chalk10.dim("\n  No captured items."));
+      return;
+    }
+    console.log(chalk10.bold(`
+  ${items.length} captured item(s):
+`));
+    const typeWidth = Math.max(4, ...items.map((i) => i.type.length));
+    const actionWidth = Math.max(6, ...items.map((i) => i.action.length));
+    console.log(chalk10.bold(`  ${"Type".padEnd(typeWidth)}  ${"Action".padEnd(actionWidth)}  Target`));
+    console.log(`  ${"-".repeat(typeWidth)}  ${"-".repeat(actionWidth)}  ${"-".repeat(40)}`);
+    for (const item of items) {
+      const actionColor = item.action === "INSERT_OR_UPDATE" ? chalk10.green : item.action === "DELETE" ? chalk10.red : chalk10.dim;
+      console.log(`  ${item.type.padEnd(typeWidth)}  ${actionColor(item.action.padEnd(actionWidth))}  ${item.target_name}`);
+    }
+    if (items.length === limit) {
+      console.log(chalk10.dim(`
+  (showing first ${limit} items \u2014 use --limit to increase)`));
+    }
+  });
+  cmd.command("capture <name>").description("Capture specific records into an update set by temporarily making it active").requiredOption("-a, --add <table:sys_id>", "Record to capture as table:sys_id (repeat for multiple)", (val, acc) => {
+    acc.push(val);
+    return acc;
+  }, []).option("--yes", "Skip confirmation").action(async (nameOrId, opts) => {
+    const instance = requireActiveInstance();
+    const client = new ServiceNowClient(instance);
+    const records = [];
+    for (const entry of opts.add) {
+      const colon = entry.indexOf(":");
+      if (colon === -1) {
+        console.error(chalk10.red(`Invalid format "${entry}" \u2014 expected table:sys_id`));
+        process.exit(1);
+      }
+      records.push({ table: entry.slice(0, colon), sysId: entry.slice(colon + 1) });
+    }
+    const spinner = ora9("Resolving update set...").start();
+    let set;
+    let previousSet;
+    try {
+      [set, previousSet] = await Promise.all([
+        resolveUpdateSet(client, nameOrId),
+        getCurrentUpdateSet(client)
+      ]);
+      spinner.stop();
+    } catch (err) {
+      spinner.fail();
+      console.error(chalk10.red(err instanceof Error ? err.message : String(err)));
+      process.exit(1);
+    }
+    console.log(chalk10.bold(`Capture into update set: ${set.name}`));
+    for (const r of records) console.log(`  ${chalk10.cyan(r.table)}  ${chalk10.dim(r.sysId)}`);
+    console.log(chalk10.dim("\n  Method: temporarily activates the update set, patches each record (no-op), then restores."));
+    if (!opts.yes) {
+      const ok = await confirm5({ message: "Proceed?", default: true });
+      if (!ok) {
+        console.log(chalk10.dim("Aborted."));
+        return;
+      }
+    }
+    const activateSpinner = ora9(`Activating "${set.name}"...`).start();
+    try {
+      await setCurrentUpdateSet(client, set.sys_id);
+      activateSpinner.succeed();
+    } catch (err) {
+      activateSpinner.fail();
+      console.error(chalk10.red(err instanceof Error ? err.message : String(err)));
+      process.exit(1);
+    }
+    let captureFailures = 0;
+    for (const { table, sysId } of records) {
+      const captureSpinner = ora9(`Capturing ${table}/${sysId}...`).start();
+      try {
+        const record = await client.getRecord(table, sysId, { sysparmFields: "sys_id" });
+        await client.updateRecord(table, record.sys_id, { sys_mod_count: record["sys_mod_count"] });
+        captureSpinner.succeed(chalk10.green(`Captured: ${table}/${sysId}`));
+      } catch (err) {
+        captureSpinner.fail(chalk10.red(`Failed ${table}/${sysId}: ${err instanceof Error ? err.message : String(err)}`));
+        captureFailures++;
+      }
+    }
+    if (previousSet) {
+      const restoreSpinner = ora9(`Restoring active update set to "${previousSet.name}"...`).start();
+      try {
+        await setCurrentUpdateSet(client, previousSet.sys_id);
+        restoreSpinner.succeed();
+      } catch {
+        restoreSpinner.fail(chalk10.yellow("Could not restore previous update set \u2014 run `snow updateset set` manually."));
+      }
+    }
+    if (captureFailures === 0) {
+      console.log(chalk10.green(`
+Captured ${records.length} record(s) into "${set.name}".`));
+    } else {
+      console.log(chalk10.yellow(`
+Captured ${records.length - captureFailures}/${records.length} record(s).`));
+    }
+  });
+  cmd.command("export <name>").description("Export an update set as an XML file").option("-o, --out <dir>", "Output directory (default: current directory)", ".").action(async (nameOrId, opts) => {
+    const instance = requireActiveInstance();
+    const client = new ServiceNowClient(instance);
+    const resolveSpinner = ora9("Resolving update set...").start();
+    let set;
+    try {
+      set = await resolveUpdateSet(client, nameOrId);
+      resolveSpinner.stop();
+    } catch (err) {
+      resolveSpinner.fail();
+      console.error(chalk10.red(err instanceof Error ? err.message : String(err)));
+      process.exit(1);
+    }
+    const exportSpinner = ora9(`Exporting "${set.name}"...`).start();
+    let xmlContent;
+    try {
+      const res = await client.getAxiosInstance().get(
+        "/export_update_set.do",
+        {
+          params: { type: "XML", sys_id: set.sys_id },
+          responseType: "text"
+        }
+      );
+      xmlContent = res.data;
+      exportSpinner.stop();
+    } catch (err) {
+      exportSpinner.fail();
+      console.error(chalk10.red(err instanceof Error ? err.message : String(err)));
+      process.exit(1);
+    }
+    if (!existsSync5(opts.out)) mkdirSync6(opts.out, { recursive: true });
+    const safeName = set.name.replace(/[^a-z0-9_-]/gi, "_");
+    const outPath = join6(opts.out, `${safeName}.xml`);
+    writeFileSync6(outPath, xmlContent, "utf-8");
+    console.log(chalk10.green(`Exported to: ${outPath}`));
+  });
+  cmd.command("apply <xml-file>").description("Import an update set XML into an instance (creates a Retrieved Update Set record)").option("-t, --target <alias>", "Target instance alias (default: active instance)").option("--yes", "Skip confirmation").action(async (xmlFile, opts) => {
+    if (!existsSync5(xmlFile)) {
+      console.error(chalk10.red(`File not found: ${xmlFile}`));
+      process.exit(1);
+    }
+    const xmlContent = readFileSync5(xmlFile, "utf-8");
+    const nameMatch = xmlContent.match(/<update_set[^>]*>[\s\S]*?<name>([^<]+)<\/name>/);
+    const xmlName = nameMatch ? nameMatch[1] : xmlFile;
+    let instance;
+    if (opts.target) {
+      const config = loadConfig();
+      instance = config.instances[opts.target];
+      if (!instance) {
+        console.error(chalk10.red(`Instance alias not found: ${opts.target}`));
+        process.exit(1);
+      }
+    } else {
+      instance = requireActiveInstance();
+    }
+    console.log(`Import ${chalk10.cyan(xmlName)} \u2192 ${chalk10.bold(instance.alias)} (${instance.url})`);
+    if (!opts.yes) {
+      const ok = await confirm5({ message: "Proceed?", default: true });
+      if (!ok) {
+        console.log(chalk10.dim("Aborted."));
+        return;
+      }
+    }
+    const client = new ServiceNowClient(instance);
+    const importSpinner = ora9("Uploading update set XML...").start();
+    let remoteSetSysId;
+    try {
+      const res = await client.createRecord("sys_remote_update_set", {
+        name: xmlName,
+        payload: xmlContent,
+        state: "loaded"
+      });
+      remoteSetSysId = res.sys_id;
+      importSpinner.succeed(chalk10.green(`Created retrieved update set: ${remoteSetSysId}`));
+    } catch (err) {
+      importSpinner.fail();
+      console.error(chalk10.red(err instanceof Error ? err.message : String(err)));
+      process.exit(1);
+    }
+    console.log();
+    console.log(chalk10.bold("Next steps in ServiceNow:"));
+    console.log(`  1. Navigate to ${chalk10.cyan("System Update Sets \u2192 Retrieved Update Sets")}`);
+    console.log(`  2. Open ${chalk10.cyan(xmlName)}`);
+    console.log(`  3. Click ${chalk10.cyan("Preview Update Set")} \u2192 resolve any conflicts`);
+    console.log(`  4. Click ${chalk10.cyan("Commit Update Set")}`);
+    console.log();
+    console.log(chalk10.dim(`  Direct link: ${instance.url}/sys_remote_update_set.do?sys_id=${remoteSetSysId}`));
+  });
+  cmd.command("diff <set1> <set2>").description("Compare captured items between two update sets").option("-l, --limit <n>", "Max captured items per set (default: 500)", "500").action(async (nameOrId1, nameOrId2, opts) => {
+    const instance = requireActiveInstance();
+    const client = new ServiceNowClient(instance);
+    const limit = parseInt(opts.limit, 10) || 500;
+    const spinner = ora9("Fetching both update sets...").start();
+    let set1, set2;
+    let items1, items2;
+    try {
+      [set1, set2] = await Promise.all([
+        resolveUpdateSet(client, nameOrId1),
+        resolveUpdateSet(client, nameOrId2)
+      ]);
+      const fetchItems = (sysId) => client.queryTable("sys_update_xml", {
+        sysparmQuery: `update_set=${sysId}`,
+        sysparmFields: "sys_id,name,type,target_name,action,sys_created_on",
+        sysparmLimit: limit
+      });
+      [items1, items2] = await Promise.all([fetchItems(set1.sys_id), fetchItems(set2.sys_id)]);
+      spinner.stop();
+    } catch (err) {
+      spinner.fail();
+      console.error(chalk10.red(err instanceof Error ? err.message : String(err)));
+      process.exit(1);
+    }
+    const map1 = new Map(items1.map((i) => [i.target_name, i]));
+    const map2 = new Map(items2.map((i) => [i.target_name, i]));
+    const onlyIn1 = [];
+    const onlyIn2 = [];
+    const inBoth = [];
+    for (const [key, item] of map1) {
+      if (map2.has(key)) inBoth.push({ item1: item, item2: map2.get(key) });
+      else onlyIn1.push(item);
+    }
+    for (const [key, item] of map2) {
+      if (!map1.has(key)) onlyIn2.push(item);
+    }
+    console.log(chalk10.bold(`
+Diff: ${chalk10.cyan(set1.name)} \u2190 \u2192 ${chalk10.cyan(set2.name)}
+`));
+    console.log(`  Items in ${chalk10.cyan(set1.name)}: ${items1.length}`);
+    console.log(`  Items in ${chalk10.cyan(set2.name)}: ${items2.length}`);
+    console.log();
+    if (onlyIn1.length > 0) {
+      console.log(chalk10.red(`  Only in "${set1.name}" (${onlyIn1.length}):`));
+      for (const i of onlyIn1) {
+        console.log(`    ${chalk10.red("\u2212")} ${i.type.padEnd(30)} ${i.target_name}`);
+      }
+      console.log();
+    }
+    if (onlyIn2.length > 0) {
+      console.log(chalk10.green(`  Only in "${set2.name}" (${onlyIn2.length}):`));
+      for (const i of onlyIn2) {
+        console.log(`    ${chalk10.green("+")} ${i.type.padEnd(30)} ${i.target_name}`);
+      }
+      console.log();
+    }
+    if (inBoth.length > 0) {
+      console.log(chalk10.dim(`  In both (${inBoth.length}):`));
+      for (const { item1, item2 } of inBoth) {
+        const actionChanged = item1.action !== item2.action;
+        const marker = actionChanged ? chalk10.yellow("~") : chalk10.dim("=");
+        const detail = actionChanged ? chalk10.yellow(` [action: ${item1.action} \u2192 ${item2.action}]`) : "";
+        console.log(`    ${marker} ${item1.type.padEnd(30)} ${item1.target_name}${detail}`);
+      }
+      console.log();
+    }
+    const summary = [
+      onlyIn1.length > 0 ? chalk10.red(`${onlyIn1.length} removed`) : "",
+      onlyIn2.length > 0 ? chalk10.green(`${onlyIn2.length} added`) : "",
+      inBoth.filter(({ item1, item2 }) => item1.action !== item2.action).length > 0 ? chalk10.yellow(`${inBoth.filter(({ item1, item2 }) => item1.action !== item2.action).length} changed`) : "",
+      chalk10.dim(`${inBoth.filter(({ item1, item2 }) => item1.action === item2.action).length} unchanged`)
+    ].filter(Boolean).join("  ");
+    console.log(`  ${summary}`);
+  });
+  return cmd;
+}
+
+// src/commands/status.ts
+init_esm_shims();
+init_config();
+init_client();
+import { Command as Command11 } from "commander";
+import chalk11 from "chalk";
+import ora10 from "ora";
+async function countRecords(client, table, query) {
+  const res = await client.get(
+    `/api/now/stats/${table}`,
+    { params: { sysparm_count: true, sysparm_query: query } }
+  );
+  return parseInt(res.result?.stats?.count ?? "0", 10);
+}
+var DIVIDER = chalk11.dim("\u2500".repeat(52));
+var NA = chalk11.dim("N/A");
+function section(title) {
+  console.log();
+  console.log(chalk11.bold.cyan(`  ${title}`));
+  console.log(chalk11.dim(`  ${"\u2500".repeat(title.length)}`));
+}
+function row(label, value, width = 22) {
+  console.log(`  ${label.padEnd(width)}${value}`);
+}
+async function fetchVersion(client, debug = false) {
+  const props = await client.queryTable("sys_properties", {
+    sysparmQuery: "nameSTARTSWITHglide.build",
+    sysparmFields: "name,value",
+    sysparmLimit: 50
+  });
+  if (debug) {
+    console.log(chalk11.dim(`  [debug] glide.build.* properties returned (${props.length}):`));
+    for (const p of props) {
+      console.log(chalk11.dim(`    ${p.name} = ${JSON.stringify(p.value)}`));
+    }
+  }
+  if (props.length === 0) throw new Error("No glide.build.* properties accessible");
+  const val = (key) => {
+    const p = props.find((r) => r.name === key);
+    const raw = p?.value;
+    if (!raw) return "";
+    if (typeof raw === "object" && raw !== null) {
+      return raw["value"] ?? raw["display_value"] ?? "";
+    }
+    return String(raw).trim();
+  };
+  const buildtag = val("glide.buildtag.last");
+  const date = val("glide.build.date");
+  if (!buildtag) throw new Error("glide.buildtag.last is empty or not accessible");
+  const dateShort = date.match(/^(\d{2})-(\d{2})-(\d{4})/) ? `${date.slice(6, 10)}-${date.slice(0, 2)}-${date.slice(3, 5)}` : date.replace(/_\d+$/, "");
+  return { version: buildtag, date: dateShort };
+}
+async function fetchNodes(client) {
+  const nodes = await client.queryTable("sys_cluster_state", {
+    sysparmFields: "node_name,status",
+    sysparmLimit: 50
+  });
+  const active = nodes.filter((n) => n.status === "Online" || n.status === "online").length;
+  return { active: active || nodes.length, total: nodes.length };
+}
+async function fetchActiveUsers(client) {
+  return countRecords(client, "sys_user", "active=true");
+}
+async function fetchCustomApps(client) {
+  return countRecords(client, "sys_app", "active=true^scopeSTARTSWITHx_");
+}
+async function fetchCustomTables(client) {
+  return countRecords(client, "sys_db_object", "nameSTARTSWITHx_");
+}
+async function fetchInProgressUpdateSets(client) {
+  return client.queryTable("sys_update_set", {
+    sysparmQuery: "state=in progress^ORDERBYDESCsys_created_on",
+    sysparmFields: "name,sys_created_by",
+    sysparmLimit: 5
+  });
+}
+async function fetchSyslogErrors(client) {
+  const [count, recent] = await Promise.all([
+    countRecords(client, "syslog", "level=error^sys_created_on>javascript:gs.hoursAgo(1)"),
+    client.queryTable("syslog", {
+      sysparmQuery: "level=error^sys_created_on>javascript:gs.hoursAgo(1)^ORDERBYDESCsys_created_on",
+      sysparmFields: "sys_created_on,message",
+      sysparmLimit: 3
+    })
+  ]);
+  return { count, recent };
+}
+async function fetchSchedulerErrors(client) {
+  const [count, recent] = await Promise.all([
+    countRecords(client, "syslog", "level=error^sys_created_on>javascript:gs.hoursAgo(24)^source=SCHEDULER"),
+    client.queryTable("syslog", {
+      sysparmQuery: "level=error^sys_created_on>javascript:gs.hoursAgo(24)^source=SCHEDULER^ORDERBYDESCsys_created_on",
+      sysparmFields: "message",
+      sysparmLimit: 3
+    })
+  ]);
+  return { count, recent };
+}
+function statusCommand() {
+  const cmd = new Command11("status").description("Show a health and stats overview of the active instance").option("--no-errors", "Skip the syslog error sections (faster for restricted users)").option("--debug", "Print raw property values to help diagnose N/A sections").action(async (opts) => {
+    const instance = requireActiveInstance();
+    const client = new ServiceNowClient(instance);
+    const spinner = ora10("Fetching instance stats...").start();
+    const [
+      versionResult,
+      nodesResult,
+      activeUsersResult,
+      customAppsResult,
+      customTablesResult,
+      updateSetsResult,
+      syslogResult,
+      schedulerResult
+    ] = await Promise.allSettled([
+      fetchVersion(client, opts.debug),
+      fetchNodes(client),
+      fetchActiveUsers(client),
+      fetchCustomApps(client),
+      fetchCustomTables(client),
+      fetchInProgressUpdateSets(client),
+      opts.errors ? fetchSyslogErrors(client) : Promise.reject(new Error("skipped")),
+      opts.errors ? fetchSchedulerErrors(client) : Promise.reject(new Error("skipped"))
+    ]);
+    spinner.stop();
+    console.log();
+    console.log(DIVIDER);
+    console.log(`  ${chalk11.bold("snow-cli")}  \xB7  ${chalk11.cyan(instance.alias)}  ${chalk11.dim(instance.url)}`);
+    console.log(DIVIDER);
+    section("Instance");
+    if (versionResult.status === "fulfilled") {
+      row("Version", chalk11.white(versionResult.value.version));
+      if (versionResult.value.date) {
+        row("Last updated", chalk11.dim(versionResult.value.date));
+      }
+    } else {
+      const reason = opts.debug ? NA + chalk11.dim(`  (${versionResult.reason?.message ?? "unknown error"})`) : NA;
+      row("Version", reason);
+    }
+    if (nodesResult.status === "fulfilled") {
+      const { active, total } = nodesResult.value;
+      const nodeStr = total === 0 ? NA : total === 1 ? chalk11.white("1 (single-node)") : `${chalk11.white(String(active))} active / ${total} total`;
+      row("Cluster nodes", nodeStr);
+    } else {
+      row("Cluster nodes", NA);
+    }
+    section("Users");
+    if (activeUsersResult.status === "fulfilled") {
+      row("Active users", chalk11.white(activeUsersResult.value.toLocaleString()));
+    } else {
+      row("Active users", NA);
+    }
+    section("Development");
+    if (customAppsResult.status === "fulfilled") {
+      row("Custom apps", chalk11.white(String(customAppsResult.value)));
+    } else {
+      row("Custom apps", NA);
+    }
+    if (customTablesResult.status === "fulfilled") {
+      row("Custom tables", chalk11.white(String(customTablesResult.value)));
+    } else {
+      row("Custom tables", NA);
+    }
+    if (updateSetsResult.status === "fulfilled") {
+      const sets = updateSetsResult.value;
+      const countStr = sets.length === 0 ? chalk11.dim("none") : sets.length === 5 ? chalk11.yellow(`${sets.length}+ in progress`) : chalk11.white(`${sets.length} in progress`);
+      row("Update sets", countStr);
+      for (const s of sets) {
+        const truncName = s.name.length > 32 ? s.name.slice(0, 31) + "\u2026" : s.name;
+        console.log(`  ${"".padEnd(22)}${chalk11.dim("\u2022 ")}${truncName}  ${chalk11.dim(s.sys_created_by)}`);
+      }
+    } else {
+      row("Update sets", NA);
+    }
+    if (!opts.errors) {
+      console.log();
+      console.log(chalk11.dim("  (error sections skipped \u2014 pass --errors to include)"));
+    } else {
+      section("Syslog errors  (last hour)");
+      if (syslogResult.status === "fulfilled") {
+        const { count, recent } = syslogResult.value;
+        const countColor = count === 0 ? chalk11.green : count < 10 ? chalk11.yellow : chalk11.red;
+        row("Error count", countColor(String(count)));
+        for (const e of recent) {
+          const time = e.sys_created_on.slice(11, 19);
+          const msg = e.message.replace(/\s+/g, " ").trim().slice(0, 60);
+          console.log(`  ${"".padEnd(22)}${chalk11.dim(`[${time}]`)} ${msg}`);
+        }
+      } else {
+        row("Error count", NA + chalk11.dim("  (no access to syslog)"));
+      }
+      section("Scheduler errors  (last 24h)");
+      if (schedulerResult.status === "fulfilled") {
+        const { count, recent } = schedulerResult.value;
+        const countColor = count === 0 ? chalk11.green : count < 5 ? chalk11.yellow : chalk11.red;
+        row("Failed jobs", countColor(String(count)));
+        for (const e of recent) {
+          const msg = e.message.replace(/\s+/g, " ").trim().slice(0, 60);
+          console.log(`  ${"".padEnd(22)}${chalk11.dim("\u2022 ")}${msg}`);
+        }
+      } else {
+        row("Failed jobs", NA + chalk11.dim("  (no access to syslog)"));
+      }
+    }
+    console.log();
+    console.log(DIVIDER);
+    console.log();
+  });
+  return cmd;
+}
+
 // src/index.ts
-import { readFileSync as readFileSync4 } from "fs";
+import { readFileSync as readFileSync6 } from "fs";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { join as join5, dirname as dirname2 } from "path";
+import { join as join7, dirname as dirname2 } from "path";
 var __filename2 = fileURLToPath2(import.meta.url);
 var __dirname2 = dirname2(__filename2);
 function getVersion() {
   try {
     const pkg = JSON.parse(
-      readFileSync4(join5(__dirname2, "..", "package.json"), "utf-8")
+      readFileSync6(join7(__dirname2, "..", "package.json"), "utf-8")
     );
     return pkg.version;
   } catch {
     return "0.0.0";
   }
 }
-var program = new Command7();
-program.name("snow").description(chalk7.bold("snow") + " \u2014 ServiceNow CLI: query tables, edit scripts, and generate apps with AI").version(getVersion(), "-v, --version", "Output the current version").addHelpText(
+var program = new Command12();
+program.name("snow").description(chalk12.bold("snow") + " \u2014 ServiceNow CLI: query tables, edit scripts, and generate apps with AI").version(getVersion(), "-v, --version", "Output the current version").addHelpText(
   "after",
   `
-${chalk7.bold("Examples:")}
-  ${chalk7.dim("# Add a ServiceNow instance")}
+${chalk12.bold("Examples:")}
+  ${chalk12.dim("# Add a ServiceNow instance")}
   snow instance add
 
-  ${chalk7.dim("# Query records from a table")}
+  ${chalk12.dim("# Query records from a table")}
   snow table get incident -q "active=true" -l 10
 
-  ${chalk7.dim("# View the schema for a table")}
+  ${chalk12.dim("# View the schema for a table")}
   snow schema incident
 
-  ${chalk7.dim("# Pull a script field, edit it, and push back")}
+  ${chalk12.dim("# Pull a script field, edit it, and push back")}
   snow script pull sys_script_include <sys_id> script
 
-  ${chalk7.dim("# Configure an LLM provider (OpenAI, Anthropic, xAI/Grok, or Ollama)")}
+  ${chalk12.dim("# Configure an LLM provider (OpenAI, Anthropic, xAI/Grok, or Ollama)")}
   snow provider set openai
   snow provider set anthropic
   snow provider set xai
   snow provider set ollama --model llama3
 
-  ${chalk7.dim("# Generate a ServiceNow app and export as an update set XML")}
+  ${chalk12.dim("# Generate a ServiceNow app and export as an update set XML")}
   snow ai build "Create a script include that auto-routes incidents by category"
 
-  ${chalk7.dim("# Generate and immediately push artifacts to the active instance")}
+  ${chalk12.dim("# Generate and immediately push artifacts to the active instance")}
   snow ai build "Create a business rule that sets priority on incident insert" --push
 
-  ${chalk7.dim("# Interactive multi-turn app builder")}
+  ${chalk12.dim("# Interactive multi-turn app builder")}
   snow ai chat
 `
 );
@@ -3476,6 +4818,11 @@ program.addCommand(instanceCommand());
 program.addCommand(tableCommand());
 program.addCommand(schemaCommand());
 program.addCommand(scriptCommand());
+program.addCommand(bulkCommand());
+program.addCommand(userCommand());
+program.addCommand(attachmentCommand());
+program.addCommand(updatesetCommand());
+program.addCommand(statusCommand());
 program.addCommand(providerCommand());
 program.addCommand(aiCommand());
 program.command("instances", { hidden: true }).description("Alias for `snow instance list`").action(() => {
@@ -3483,6 +4830,6 @@ program.command("instances", { hidden: true }).description("Alias for `snow inst
   sub.parse(["node", "snow", "list"]);
 });
 program.parseAsync(process.argv).catch((err) => {
-  console.error(chalk7.red(err instanceof Error ? err.message : String(err)));
+  console.error(chalk12.red(err instanceof Error ? err.message : String(err)));
   process.exit(1);
 });