@automatify-au/cli 0.1.10 → 0.1.12

package/dist/automatify.cjs

@@ -2894,8 +2894,8 @@ var require_utils = __commonJS({
       var result = transform[inputType][outputType](input);
       return result;
     };
-    exports2.resolve = function(path12) {
-      var parts = path12.split("/");
+    exports2.resolve = function(path16) {
+      var parts = path16.split("/");
       var result = [];
       for (var index = 0; index < parts.length; index++) {
         var part = parts[index];
@@ -8748,18 +8748,18 @@ var require_object = __commonJS({
       var object = new ZipObject(name, zipObjectContent, o);
       this.files[name] = object;
     };
-    var parentFolder = function(path12) {
-      if (path12.slice(-1) === "/") {
-        path12 = path12.substring(0, path12.length - 1);
+    var parentFolder = function(path16) {
+      if (path16.slice(-1) === "/") {
+        path16 = path16.substring(0, path16.length - 1);
       }
-      var lastSlash = path12.lastIndexOf("/");
-      return lastSlash > 0 ? path12.substring(0, lastSlash) : "";
+      var lastSlash = path16.lastIndexOf("/");
+      return lastSlash > 0 ? path16.substring(0, lastSlash) : "";
     };
-    var forceTrailingSlash = function(path12) {
-      if (path12.slice(-1) !== "/") {
-        path12 += "/";
+    var forceTrailingSlash = function(path16) {
+      if (path16.slice(-1) !== "/") {
+        path16 += "/";
       }
-      return path12;
+      return path16;
     };
     var folderAdd = function(name, createFolders) {
       createFolders = typeof createFolders !== "undefined" ? createFolders : defaults.createFolders;
@@ -9725,9 +9725,9 @@ var require_load = __commonJS({
 var require_lib3 = __commonJS({
   "../../node_modules/.pnpm/jszip@3.10.1/node_modules/jszip/lib/index.js"(exports2, module2) {
     "use strict";
-    function JSZip2() {
-      if (!(this instanceof JSZip2)) {
-        return new JSZip2();
+    function JSZip4() {
+      if (!(this instanceof JSZip4)) {
+        return new JSZip4();
       }
       if (arguments.length) {
         throw new Error("The constructor with parameters has been removed in JSZip 3.0, please check the upgrade guide.");
@@ -9736,7 +9736,7 @@ var require_lib3 = __commonJS({
       this.comment = null;
       this.root = "";
       this.clone = function() {
-        var newObj = new JSZip2();
+        var newObj = new JSZip4();
         for (var i in this) {
           if (typeof this[i] !== "function") {
             newObj[i] = this[i];
@@ -9745,16 +9745,16 @@ var require_lib3 = __commonJS({
         return newObj;
       };
     }
-    JSZip2.prototype = require_object();
-    JSZip2.prototype.loadAsync = require_load();
-    JSZip2.support = require_support();
-    JSZip2.defaults = require_defaults();
-    JSZip2.version = "3.10.1";
-    JSZip2.loadAsync = function(content, options) {
-      return new JSZip2().loadAsync(content, options);
+    JSZip4.prototype = require_object();
+    JSZip4.prototype.loadAsync = require_load();
+    JSZip4.support = require_support();
+    JSZip4.defaults = require_defaults();
+    JSZip4.version = "3.10.1";
+    JSZip4.loadAsync = function(content, options) {
+      return new JSZip4().loadAsync(content, options);
     };
-    JSZip2.external = require_external();
-    module2.exports = JSZip2;
+    JSZip4.external = require_external();
+    module2.exports = JSZip4;
   }
 });
 
@@ -10723,6 +10723,9 @@ function toJsonLine(data) {
 var import_node_fs4 = require("node:fs");
 var import_node_path5 = __toESM(require("node:path"), 1);
 
+// ../../packages/shared-types/dist/entitlements.js
+var UNLIMITED_ACTIVE_USERS = Number.MAX_SAFE_INTEGER;
+
 // ../../packages/shared-types/dist/index.js
 var TestCaseStatus;
 (function(TestCaseStatus2) {
@@ -12447,10 +12450,10 @@ function createAutoHandler(deps = {}) {
 }
 
 // src/allure.ts
-var import_node_path8 = __toESM(require("node:path"), 1);
-var import_node_fs7 = require("node:fs");
+var import_node_path10 = __toESM(require("node:path"), 1);
+var import_node_fs9 = require("node:fs");
 
-// ../../packages/jira-client/src/adf.ts
+// ../../packages/jira-client/dist/adf.js
 function paragraph(text = "") {
   return text ? { type: "paragraph", content: [{ type: "text", text }] } : { type: "paragraph" };
 }
@@ -12493,7 +12496,7 @@ function buildAllureEvidenceCommentAdf(input) {
   };
 }
 
-// ../../packages/jira-client/src/jiraClient.ts
+// ../../packages/jira-client/dist/jiraClient.js
 var import_node_fs5 = require("node:fs");
 var import_node_path6 = __toESM(require("node:path"), 1);
 function normalizeSite(site) {
@@ -12619,7 +12622,7 @@ async function addIssueComment(params) {
   };
 }
 
-// ../../packages/allure-core/src/parseAllureZip.ts
+// ../../packages/allure-core/dist/parseAllureZip.js
 var import_node_fs6 = require("node:fs");
 var import_node_path7 = __toESM(require("node:path"), 1);
 var import_jszip = __toESM(require_lib3(), 1);
@@ -12681,6 +12684,441 @@ async function parseAllureReportZip(zipPath) {
   };
 }
 
+// ../../packages/allure-core/dist/extractAllureZip.js
+var import_node_fs7 = require("node:fs");
+var import_node_path8 = __toESM(require("node:path"), 1);
+var import_jszip2 = __toESM(require_lib3(), 1);
+var INDEX_HTML = "index.html";
+var MISSING_INDEX_ERROR = "Could not find index.html. Please provide a generated Allure HTML report ZIP, not raw allure-results.";
+function findIndexEntry(paths) {
+  return paths.find((entryPath) => entryPath === INDEX_HTML) ?? paths.find((entryPath) => entryPath === `allure-report/${INDEX_HTML}`) ?? paths.find((entryPath) => entryPath.endsWith(`/${INDEX_HTML}`));
+}
+function ensureInsideRoot(rootDir, candidate) {
+  const resolved = import_node_path8.default.resolve(rootDir, candidate);
+  const rootWithSep = rootDir.endsWith(import_node_path8.default.sep) ? rootDir : rootDir + import_node_path8.default.sep;
+  if (resolved !== rootDir && !resolved.startsWith(rootWithSep)) {
+    throw new Error(`Refusing to write zip entry outside extract directory: ${candidate}`);
+  }
+  return resolved;
+}
+async function extractAllureReportZip(zipPath, extractDir) {
+  if (!(0, import_node_fs7.existsSync)(zipPath)) {
+    throw new Error(`Allure report ZIP not found: ${zipPath}`);
+  }
+  if (import_node_path8.default.extname(zipPath).toLowerCase() !== ".zip") {
+    throw new Error("Allure report must be a .zip file.");
+  }
+  const zip = await import_jszip2.default.loadAsync((0, import_node_fs7.readFileSync)(zipPath));
+  const entries = Object.entries(zip.files);
+  const filePaths = entries.filter(([, file]) => !file.dir).map(([entryPath]) => entryPath);
+  const indexEntry = findIndexEntry(filePaths);
+  if (!indexEntry) {
+    throw new Error(MISSING_INDEX_ERROR);
+  }
+  const resolvedExtract = import_node_path8.default.resolve(extractDir);
+  (0, import_node_fs7.mkdirSync)(resolvedExtract, { recursive: true });
+  for (const [entryPath, file] of entries) {
+    const target = ensureInsideRoot(resolvedExtract, entryPath);
+    if (file.dir) {
+      (0, import_node_fs7.mkdirSync)(target, { recursive: true });
+      continue;
+    }
+    (0, import_node_fs7.mkdirSync)(import_node_path8.default.dirname(target), { recursive: true });
+    const buffer = await file.async("nodebuffer");
+    (0, import_node_fs7.writeFileSync)(target, buffer);
+  }
+  const indexAbsolute = import_node_path8.default.join(resolvedExtract, indexEntry);
+  const rootDir = import_node_path8.default.dirname(indexAbsolute);
+  return {
+    zipPath,
+    extractDir: resolvedExtract,
+    rootDir,
+    indexPath: indexAbsolute
+  };
+}
+
+// ../../packages/allure-core/dist/parseAllureFailedTests.js
+var import_jszip3 = __toESM(require_lib3(), 1);
+
+// src/allureOpen.ts
+var import_node_fs8 = require("node:fs");
+var import_promises = require("node:fs/promises");
+var import_node_http = __toESM(require("node:http"), 1);
+var import_node_os = require("node:os");
+var import_node_path9 = __toESM(require("node:path"), 1);
+var import_node_child_process2 = require("node:child_process");
+function parseArgs2(args) {
+  const positionals = [];
+  const flags = {};
+  const boolFlags = /* @__PURE__ */ new Set();
+  const unknownFlags = [];
+  const valuedFlags = /* @__PURE__ */ new Set(["--port", "--host", "--extract-to"]);
+  const supportedBoolFlags = /* @__PURE__ */ new Set(["--keep", "--no-open", "--json", "--dry-run", "--verbose"]);
+  for (let i = 0; i < args.length; i += 1) {
+    const token = args[i];
+    if (!token.startsWith("--")) {
+      positionals.push(token);
+      continue;
+    }
+    if (supportedBoolFlags.has(token)) {
+      boolFlags.add(token);
+      continue;
+    }
+    if (!valuedFlags.has(token)) {
+      unknownFlags.push(token);
+      continue;
+    }
+    const value = args[i + 1];
+    if (!value || value.startsWith("--")) {
+      unknownFlags.push(token);
+      continue;
+    }
+    flags[token] = value;
+    i += 1;
+  }
+  return { positionals, flags, boolFlags, unknownFlags };
+}
+function parsePort(raw) {
+  if (raw === void 0) {
+    return { value: 0 };
+  }
+  const parsed = Number(raw);
+  if (!Number.isInteger(parsed) || parsed < 0 || parsed > 65535) {
+    return { value: 0, error: `Invalid --port value: ${raw}. Must be an integer between 0 and 65535.` };
+  }
+  return { value: parsed };
+}
+function normalizeError(error) {
+  return error instanceof Error ? error.message : "Unknown Allure open error.";
+}
+var MIME_TYPES = {
+  ".html": "text/html; charset=utf-8",
+  ".htm": "text/html; charset=utf-8",
+  ".js": "application/javascript; charset=utf-8",
+  ".mjs": "application/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".ico": "image/x-icon",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".ttf": "font/ttf",
+  ".otf": "font/otf",
+  ".eot": "application/vnd.ms-fontobject",
+  ".map": "application/json; charset=utf-8",
+  ".txt": "text/plain; charset=utf-8"
+};
+function contentTypeFor(filePath) {
+  return MIME_TYPES[import_node_path9.default.extname(filePath).toLowerCase()] ?? "application/octet-stream";
+}
+function resolveRequestedPath(rootDir, urlPath) {
+  let decoded;
+  try {
+    decoded = decodeURIComponent(urlPath.split("?")[0].split("#")[0]);
+  } catch {
+    return void 0;
+  }
+  const normalized = import_node_path9.default.normalize(decoded);
+  const trimmed = normalized.replace(/^[/\\]+/, "");
+  const candidate = import_node_path9.default.resolve(rootDir, trimmed);
+  const rootWithSep = rootDir.endsWith(import_node_path9.default.sep) ? rootDir : rootDir + import_node_path9.default.sep;
+  if (candidate !== rootDir && !candidate.startsWith(rootWithSep)) {
+    return void 0;
+  }
+  return candidate;
+}
+function createStaticServerStarter() {
+  return async ({ rootDir, host, port }) => {
+    const server = import_node_http.default.createServer((req, res) => {
+      if (!req.url || req.method !== "GET" && req.method !== "HEAD") {
+        res.statusCode = 405;
+        res.end("Method Not Allowed");
+        return;
+      }
+      const resolved = resolveRequestedPath(rootDir, req.url);
+      if (!resolved) {
+        res.statusCode = 400;
+        res.end("Bad Request");
+        return;
+      }
+      let target = resolved;
+      try {
+        const stat = (0, import_node_fs8.statSync)(target);
+        if (stat.isDirectory()) {
+          target = import_node_path9.default.join(target, "index.html");
+        }
+      } catch {
+        res.statusCode = 404;
+        res.end("Not Found");
+        return;
+      }
+      if (!(0, import_node_fs8.existsSync)(target)) {
+        res.statusCode = 404;
+        res.end("Not Found");
+        return;
+      }
+      res.setHeader("Content-Type", contentTypeFor(target));
+      if (req.method === "HEAD") {
+        res.statusCode = 200;
+        res.end();
+        return;
+      }
+      const stream = (0, import_node_fs8.createReadStream)(target);
+      stream.on("error", () => {
+        res.statusCode = 500;
+        res.end("Internal Server Error");
+      });
+      stream.pipe(res);
+    });
+    await new Promise((resolve, reject) => {
+      const onError = (err) => {
+        server.off("listening", onListening);
+        reject(err);
+      };
+      const onListening = () => {
+        server.off("error", onError);
+        resolve();
+      };
+      server.once("error", onError);
+      server.once("listening", onListening);
+      server.listen(port, host);
+    });
+    const address = server.address();
+    const actualPort = typeof address === "object" && address ? address.port : port;
+    const displayHost = host === "0.0.0.0" ? "127.0.0.1" : host;
+    const url = `http://${displayHost}:${actualPort}/`;
+    return {
+      url,
+      port: actualPort,
+      host,
+      close: () => new Promise((resolve, reject) => {
+        server.close((err) => err ? reject(err) : resolve());
+      })
+    };
+  };
+}
+function createOsBrowserOpener() {
+  return async (url) => {
+    const platform = process.platform;
+    let command;
+    let args;
+    if (platform === "darwin") {
+      command = "open";
+      args = [url];
+    } else if (platform === "win32") {
+      command = "cmd";
+      args = ["/c", "start", "", url];
+    } else {
+      command = "xdg-open";
+      args = [url];
+    }
+    try {
+      const child = (0, import_node_child_process2.spawn)(command, args, { stdio: "ignore", detached: true });
+      child.on("error", () => void 0);
+      child.unref();
+    } catch {
+    }
+  };
+}
+function waitForProcessSignals() {
+  return new Promise((resolve) => {
+    const cleanup = () => {
+      process.off("SIGINT", onSignal);
+      process.off("SIGTERM", onSignal);
+      resolve();
+    };
+    const onSignal = () => {
+      cleanup();
+    };
+    process.once("SIGINT", onSignal);
+    process.once("SIGTERM", onSignal);
+  });
+}
+function buildJsonOutput(params) {
+  const output = {
+    zipPath: params.zipPath,
+    dryRun: params.dryRun,
+    served: params.served,
+    opened: params.opened,
+    keep: params.keep,
+    extractDir: params.extractDir,
+    rootDir: params.rootDir,
+    indexPath: params.indexPath,
+    summary: {
+      total: params.summary.counts.total,
+      passed: params.summary.counts.passed,
+      failed: params.summary.counts.failed,
+      broken: params.summary.counts.broken,
+      skipped: params.summary.counts.skipped,
+      unknown: params.summary.counts.unknown
+    }
+  };
+  if (params.url) {
+    output.url = params.url;
+  }
+  if (params.port !== void 0) {
+    output.port = params.port;
+  }
+  if (params.host !== void 0) {
+    output.host = params.host;
+  }
+  return output;
+}
+function createAllureOpenHandler(deps = {}) {
+  const cwd = deps.cwd ?? process.cwd();
+  const parseZip = deps.parseAllureReportZip ?? parseAllureReportZip;
+  const extractZip = deps.extractAllureReportZip ?? extractAllureReportZip;
+  const createTempDir = deps.createTempDir ?? (() => (0, import_promises.mkdtemp)(import_node_path9.default.join((0, import_node_os.tmpdir)(), "automatify-allure-open-")));
+  const startServer = deps.startServer ?? createStaticServerStarter();
+  const openInBrowser = deps.openInBrowser ?? createOsBrowserOpener();
+  const waitForShutdown = deps.waitForShutdown ?? waitForProcessSignals;
+  const removeDir = deps.removeDir ?? ((dir) => (0, import_promises.rm)(dir, { recursive: true, force: true }));
+  const logger = deps.logger ?? console;
+  return async (request) => {
+    const parsed = parseArgs2(request.args);
+    const useJson = parsed.boolFlags.has("--json");
+    const dryRun = parsed.boolFlags.has("--dry-run");
+    const verbose = parsed.boolFlags.has("--verbose");
+    const keep = parsed.boolFlags.has("--keep");
+    const noOpen = parsed.boolFlags.has("--no-open");
+    const userExtractDir = parsed.flags["--extract-to"];
+    if (parsed.unknownFlags.length > 0) {
+      return {
+        exitCode: ExitCode.UsageError,
+        stderr: [`ERROR: Unknown or invalid flags: ${parsed.unknownFlags.join(", ")}`]
+      };
+    }
+    const [zipPathInput] = parsed.positionals;
+    if (!zipPathInput || parsed.positionals.length > 1) {
+      return {
+        exitCode: ExitCode.UsageError,
+        stderr: ["Usage: automatify testops allure open <zipPath> [options]"]
+      };
+    }
+    const portResult = parsePort(parsed.flags["--port"]);
+    if (portResult.error) {
+      return {
+        exitCode: ExitCode.UsageError,
+        stderr: [`ERROR: ${portResult.error}`]
+      };
+    }
+    const host = parsed.flags["--host"] ?? "127.0.0.1";
+    const zipPath = import_node_path9.default.resolve(cwd, zipPathInput);
+    let summary;
+    try {
+      summary = await parseZip(zipPath);
+    } catch (error) {
+      return {
+        exitCode: ExitCode.ValidationError,
+        stderr: [`ERROR: ${normalizeError(error)}`]
+      };
+    }
+    const extractDirRaw = userExtractDir ? import_node_path9.default.resolve(cwd, userExtractDir) : await createTempDir();
+    if (dryRun) {
+      const indexPath = import_node_path9.default.join(extractDirRaw, "index.html");
+      if (useJson) {
+        return {
+          exitCode: ExitCode.Success,
+          stdout: toJsonLine(buildJsonOutput({
+            zipPath,
+            dryRun: true,
+            served: false,
+            opened: false,
+            keep,
+            extractDir: extractDirRaw,
+            rootDir: extractDirRaw,
+            indexPath,
+            summary
+          }))
+        };
+      }
+      return {
+        exitCode: ExitCode.Success,
+        stdout: [
+          `Allure report ZIP: ${zipPath}`,
+          `Total: ${summary.counts.total} (passed ${summary.counts.passed}, failed ${summary.counts.failed}, broken ${summary.counts.broken}, skipped ${summary.counts.skipped}, unknown ${summary.counts.unknown})`,
+          `Dry run: would extract to ${extractDirRaw} and serve on http://${host}:${portResult.value === 0 ? "<auto>" : portResult.value}/`
+        ]
+      };
+    }
+    let extractResult;
+    try {
+      extractResult = await extractZip(zipPath, extractDirRaw);
+    } catch (error) {
+      if (!userExtractDir) {
+        await removeDir(extractDirRaw).catch(() => void 0);
+      }
+      return {
+        exitCode: ExitCode.ValidationError,
+        stderr: [`ERROR: ${normalizeError(error)}`]
+      };
+    }
+    let serverHandle;
+    try {
+      serverHandle = await startServer({
+        rootDir: extractResult.rootDir,
+        host,
+        port: portResult.value
+      });
+    } catch (error) {
+      if (!keep && !userExtractDir) {
+        await removeDir(extractResult.extractDir).catch(() => void 0);
+      }
+      return {
+        exitCode: ExitCode.TransportError,
+        stderr: [`ERROR: Could not start static server: ${normalizeError(error)}`]
+      };
+    }
+    let opened = false;
+    if (!noOpen) {
+      try {
+        await openInBrowser(serverHandle.url);
+        opened = true;
+      } catch {
+        opened = false;
+      }
+    }
+    if (useJson) {
+      logger.log(JSON.stringify(buildJsonOutput({
+        zipPath,
+        dryRun: false,
+        served: true,
+        opened,
+        keep,
+        extractDir: extractResult.extractDir,
+        rootDir: extractResult.rootDir,
+        indexPath: extractResult.indexPath,
+        url: serverHandle.url,
+        port: serverHandle.port,
+        host: serverHandle.host,
+        summary
+      })));
+    } else {
+      logger.log(`Allure report extracted to ${extractResult.extractDir}.`);
+      if (verbose) {
+        logger.log(`Index: ${extractResult.indexPath}`);
+      }
+      logger.log(`Serving at ${serverHandle.url}`);
+      logger.log(opened ? "Opened in your default browser." : "Browser open skipped.");
+      logger.log("Press Ctrl+C to stop the server.");
+    }
+    await waitForShutdown();
+    try {
+      await serverHandle.close();
+    } catch {
+    }
+    if (!keep && !userExtractDir) {
+      await removeDir(extractResult.extractDir).catch(() => void 0);
+    }
+    return { exitCode: ExitCode.Success };
+  };
+}
+
 // src/allure.ts
 var CONFIG_FLAGS2 = /* @__PURE__ */ new Set([
   "--config",
@@ -12691,7 +13129,7 @@ var CONFIG_FLAGS2 = /* @__PURE__ */ new Set([
   "--jira-email",
   "--jira-api-token"
 ]);
-function parseArgs2(args) {
+function parseArgs3(args) {
   const positionals = [];
   const flags = {};
   const boolFlags = /* @__PURE__ */ new Set();
@@ -12742,7 +13180,7 @@ function pickConfigArgs2(parsed) {
 function normalizeSite2(value) {
   return value.trim().replace(/\/+$/, "");
 }
-function normalizeError(error) {
+function normalizeError2(error) {
   return error instanceof Error ? error.message : "Unknown Allure upload error.";
 }
 function hasCredential(value) {
@@ -12847,7 +13285,7 @@ function buildDownloadJsonOutput(params) {
     outputPath: params.outputPath
   };
 }
-function buildJsonOutput(params) {
+function buildJsonOutput2(params) {
   const attachment = {
     filename: params.attachment.filename
   };
@@ -12887,19 +13325,24 @@ function createAllureHandler(deps = {}) {
   const createComment = deps.addIssueComment ?? addIssueComment;
   const listAttachments = deps.listIssueAttachments ?? listIssueAttachments;
   const downloadAttachment = deps.downloadIssueAttachment ?? downloadIssueAttachment;
-  return async (request) => {
+  const openHandler = createAllureOpenHandler({ cwd });
+  return async (request, context) => {
     const [subcommand, ...subArgs] = request.args;
+    if (subcommand === "open") {
+      return openHandler({ ...request, args: subArgs }, context);
+    }
     if (subcommand !== "upload" && subcommand !== "download") {
       return {
         exitCode: ExitCode.UsageError,
         stderr: [
           "Usage:",
           "  automatify testops allure upload <issueKey> <zipPath> [options]",
-          "  automatify testops allure download <issueKey> [options]"
+          "  automatify testops allure download <issueKey> [options]",
+          "  automatify testops allure open <zipPath> [options]"
         ]
       };
     }
-    const parsed = parseArgs2(subArgs);
+    const parsed = parseArgs3(subArgs);
     const useJson = parsed.boolFlags.has("--json");
     const dryRun = parsed.boolFlags.has("--dry-run");
     const verbose = parsed.boolFlags.has("--verbose");
@@ -12936,8 +13379,8 @@ function createAllureHandler(deps = {}) {
           attachmentId: parsed.flags["--attachment-id"],
           filename: parsed.flags["--filename"]
         });
-        const outputDir = import_node_path8.default.resolve(cwd, parsed.flags["--output-dir"] ?? ".");
-        const outputPath = import_node_path8.default.join(outputDir, selected.filename);
+        const outputDir = import_node_path10.default.resolve(cwd, parsed.flags["--output-dir"] ?? ".");
+        const outputPath = import_node_path10.default.join(outputDir, selected.filename);
         if (dryRun) {
           if (useJson) {
             return {
@@ -12960,8 +13403,8 @@ function createAllureHandler(deps = {}) {
             ]
           };
         }
-        (0, import_node_fs7.mkdirSync)(outputDir, { recursive: true });
-        if ((0, import_node_fs7.existsSync)(outputPath) && !force) {
+        (0, import_node_fs9.mkdirSync)(outputDir, { recursive: true });
+        if ((0, import_node_fs9.existsSync)(outputPath) && !force) {
           return {
             exitCode: ExitCode.ValidationError,
             stderr: [`ERROR: Output file already exists: ${outputPath}. Pass --force to overwrite.`]
@@ -12996,7 +13439,7 @@ function createAllureHandler(deps = {}) {
       } catch (error) {
         return {
           exitCode: ExitCode.RemoteError,
-          stderr: [`ERROR: ${normalizeError(error)}`]
+          stderr: [`ERROR: ${normalizeError2(error)}`]
         };
       }
     }
@@ -13008,8 +13451,8 @@ function createAllureHandler(deps = {}) {
       };
     }
     const resolved = resolveJiraConfig(parsed, env, cwd);
-    const zipPath = import_node_path8.default.resolve(cwd, zipPathInput);
-    const attachmentFilename = import_node_path8.default.basename(zipPath);
+    const zipPath = import_node_path10.default.resolve(cwd, zipPathInput);
+    const attachmentFilename = import_node_path10.default.basename(zipPath);
     if (!resolved.config) {
       return {
         exitCode: ExitCode.ValidationError,
@@ -13022,14 +13465,14 @@ function createAllureHandler(deps = {}) {
     } catch (error) {
       return {
         exitCode: ExitCode.ValidationError,
-        stderr: [`ERROR: ${normalizeError(error)}`]
+        stderr: [`ERROR: ${normalizeError2(error)}`]
       };
     }
     if (dryRun) {
       if (useJson) {
         return {
           exitCode: ExitCode.Success,
-          stdout: toJsonLine(buildJsonOutput({
+          stdout: toJsonLine(buildJsonOutput2({
             issueKey,
             uploaded: false,
             commentAdded: false,
@@ -13072,7 +13515,7 @@ function createAllureHandler(deps = {}) {
       if (useJson) {
         return {
           exitCode: ExitCode.Success,
-          stdout: toJsonLine(buildJsonOutput({
+          stdout: toJsonLine(buildJsonOutput2({
             issueKey,
             uploaded: true,
             commentAdded,
@@ -13096,15 +13539,15 @@ function createAllureHandler(deps = {}) {
     } catch (error) {
       return {
         exitCode: ExitCode.RemoteError,
-        stderr: [`ERROR: ${normalizeError(error)}`]
+        stderr: [`ERROR: ${normalizeError2(error)}`]
       };
     }
   };
 }
 
 // src/bdd.ts
-var import_node_fs8 = require("node:fs");
-var import_node_path9 = __toESM(require("node:path"), 1);
+var import_node_fs10 = require("node:fs");
+var import_node_path11 = __toESM(require("node:path"), 1);
 var import_yazl = __toESM(require_yazl(), 1);
 
 // src/forgeClient.ts
@@ -13269,7 +13712,7 @@ var CONFIG_FLAGS3 = /* @__PURE__ */ new Set([
   "--jira-email",
   "--jira-api-token"
 ]);
-function parseArgs3(args) {
+function parseArgs4(args) {
   const flags = {};
   const boolFlags = /* @__PURE__ */ new Set();
   const unknownFlags = [];
@@ -13316,7 +13759,7 @@ function pickConfigArgs3(parsed) {
   }
   return args;
 }
-function normalizeError2(error) {
+function normalizeError3(error) {
   if (error instanceof ForgeClientError) {
     return `${error.code}: ${error.message}`;
   }
@@ -13408,7 +13851,7 @@ function parseScenarioFeatureFile(raw, filePath) {
   }
   const scenarioTag = tags.map((tag) => tag.match(SCENARIO_METADATA_PATTERN)).find((match) => Boolean(match));
   const scenarioKeyFromTag = scenarioTag?.[1]?.trim().toUpperCase() ?? "";
-  const fileKeyMatch = import_node_path9.default.basename(filePath ?? "").match(/^(SC-\d+)\.feature$/i);
+  const fileKeyMatch = import_node_path11.default.basename(filePath ?? "").match(/^(SC-\d+)\.feature$/i);
   const scenarioKeyFromFile = fileKeyMatch?.[1]?.trim().toUpperCase() ?? "";
   const scenarioKey = scenarioKeyFromTag || scenarioKeyFromFile;
   if (scenarioKeyFromTag && scenarioKeyFromFile && scenarioKeyFromTag !== scenarioKeyFromFile) {
@@ -13526,7 +13969,7 @@ function toJsonExportManifestItems(items) {
 async function defaultCreateZipArchive(archivePath, entries) {
   await new Promise((resolve, reject) => {
     const zip = new import_yazl.ZipFile();
-    const output = zip.outputStream.pipe((0, import_node_fs8.createWriteStream)(archivePath));
+    const output = zip.outputStream.pipe((0, import_node_fs10.createWriteStream)(archivePath));
     output.on("close", () => resolve());
     output.on("error", reject);
     zip.outputStream.on("error", reject);
@@ -13556,14 +13999,14 @@ function missingProjectResponse() {
 function createBddHandler(deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const env = deps.env ?? process.env;
-  const mkdir = deps.mkdir ?? ((targetPath, options) => (0, import_node_fs8.mkdirSync)(targetPath, options));
-  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs8.readFileSync)(filePath, "utf8"));
-  const readDir = deps.readDir ?? ((dirPath) => (0, import_node_fs8.readdirSync)(dirPath));
-  const writeFile = deps.writeFile ?? ((filePath, content) => (0, import_node_fs8.writeFileSync)(filePath, content, "utf8"));
+  const mkdir = deps.mkdir ?? ((targetPath, options) => (0, import_node_fs10.mkdirSync)(targetPath, options));
+  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs10.readFileSync)(filePath, "utf8"));
+  const readDir = deps.readDir ?? ((dirPath) => (0, import_node_fs10.readdirSync)(dirPath));
+  const writeFile = deps.writeFile ?? ((filePath, content) => (0, import_node_fs10.writeFileSync)(filePath, content, "utf8"));
   const createZipArchive = deps.createZipArchive ?? defaultCreateZipArchive;
   return async (request, context) => {
     const [subcommand, ...restArgs] = request.args;
-    const parsed = parseArgs3(restArgs);
+    const parsed = parseArgs4(restArgs);
     const requestedFormat = (parsed.flags["--format"] ?? "").trim().toLowerCase();
     const outputFormat = parsed.boolFlags.has("--json") ? "json" : parsed.boolFlags.has("--feature") ? "feature" : requestedFormat || "text";
     const config = resolveCliConfig(pickConfigArgs3(parsed), env, cwd);
@@ -13603,7 +14046,7 @@ function createBddHandler(deps = {}) {
           stderr: ["ERROR: Missing required --output-dir for testops bdd features export."]
         };
       }
-      const outputDir = import_node_path9.default.resolve(cwd, outputDirFlag);
+      const outputDir = import_node_path11.default.resolve(cwd, outputDirFlag);
       try {
         const result = await context.invokeForgeContract("listBddFeatures", {
           context: {
@@ -13639,7 +14082,7 @@ function createBddHandler(deps = {}) {
 `
         }));
         for (let index = 0; index < features.length; index += 1) {
-          writeFile(import_node_path9.default.join(outputDir, fileNames[index]), exportEntries[index].content);
+          writeFile(import_node_path11.default.join(outputDir, fileNames[index]), exportEntries[index].content);
         }
         const manifest = {
           action: "bdd-features-export",
@@ -13652,7 +14095,7 @@ function createBddHandler(deps = {}) {
         };
         const manifestContent = `${JSON.stringify(manifest, null, 2)}
 `;
-        writeFile(import_node_path9.default.join(outputDir, "manifest.json"), manifestContent);
+        writeFile(import_node_path11.default.join(outputDir, "manifest.json"), manifestContent);
         const archivePath = `${outputDir}.zip`;
         if (zipRequested) {
           await createZipArchive(archivePath, [
@@ -13691,7 +14134,7 @@ function createBddHandler(deps = {}) {
       } catch (error) {
         return {
           exitCode: ExitCode.TransportError,
-          stderr: [`ERROR: ${normalizeError2(error)}`]
+          stderr: [`ERROR: ${normalizeError3(error)}`]
         };
       }
     }
@@ -13722,7 +14165,7 @@ function createBddHandler(deps = {}) {
               stderr: ["ERROR: Missing required --output-dir for testops bdd scenarios export."]
             };
           }
-          const outputDir = import_node_path9.default.resolve(cwd, outputDirFlag);
+          const outputDir = import_node_path11.default.resolve(cwd, outputDirFlag);
           const zipRequested = parsed.boolFlags.has("--zip");
           try {
             const scenariosResult = await context.invokeForgeContract("listBddScenarios", {
@@ -13757,7 +14200,7 @@ function createBddHandler(deps = {}) {
               const fileName = scenarioToExportFileName(scenario);
               const fileContent = `${scenarioToFeatureLines(scenario).join("\n")}
 `;
-              writeFile(import_node_path9.default.join(outputDir, fileName), fileContent);
+              writeFile(import_node_path11.default.join(outputDir, fileName), fileContent);
               return {
                 scenario,
                 fileName,
@@ -13783,7 +14226,7 @@ function createBddHandler(deps = {}) {
             };
             const manifestContent = `${JSON.stringify(manifest, null, 2)}
 `;
-            writeFile(import_node_path9.default.join(outputDir, "manifest.json"), manifestContent);
+            writeFile(import_node_path11.default.join(outputDir, "manifest.json"), manifestContent);
             const archivePath = `${outputDir}.zip`;
             if (zipRequested) {
               await createZipArchive(archivePath, [
@@ -13826,13 +14269,13 @@ function createBddHandler(deps = {}) {
           } catch (error) {
             return {
               exitCode: ExitCode.TransportError,
-              stderr: [`ERROR: ${normalizeError2(error)}`]
+              stderr: [`ERROR: ${normalizeError3(error)}`]
             };
           }
         }
         if (nested === "import") {
-          const sourceFile = parsed.flags["--file"] ? import_node_path9.default.resolve(cwd, parsed.flags["--file"]) : "";
-          const inputDir = parsed.flags["--input-dir"] ? import_node_path9.default.resolve(cwd, parsed.flags["--input-dir"]) : "";
+          const sourceFile = parsed.flags["--file"] ? import_node_path11.default.resolve(cwd, parsed.flags["--file"]) : "";
+          const inputDir = parsed.flags["--input-dir"] ? import_node_path11.default.resolve(cwd, parsed.flags["--input-dir"]) : "";
           const dryRun = parsed.boolFlags.has("--dry-run");
           if (!sourceFile && !inputDir) {
             return {
@@ -13841,7 +14284,7 @@ function createBddHandler(deps = {}) {
             };
           }
           try {
-            const scenarioFiles = sourceFile ? [sourceFile] : readDir(inputDir).filter((entry) => entry.toLowerCase().endsWith(".feature")).map((entry) => import_node_path9.default.join(inputDir, entry)).sort((left, right) => left.localeCompare(right));
+            const scenarioFiles = sourceFile ? [sourceFile] : readDir(inputDir).filter((entry) => entry.toLowerCase().endsWith(".feature")).map((entry) => import_node_path11.default.join(inputDir, entry)).sort((left, right) => left.localeCompare(right));
             if (scenarioFiles.length === 0) {
               return {
                 exitCode: ExitCode.ValidationError,
@@ -13980,7 +14423,7 @@ function createBddHandler(deps = {}) {
           } catch (error) {
             return {
               exitCode: ExitCode.TransportError,
-              stderr: [`ERROR: ${normalizeError2(error)}`]
+              stderr: [`ERROR: ${normalizeError3(error)}`]
             };
           }
         }
@@ -14083,7 +14526,7 @@ function createBddHandler(deps = {}) {
         } catch (error) {
           return {
             exitCode: ExitCode.TransportError,
-            stderr: [`ERROR: ${normalizeError2(error)}`]
+            stderr: [`ERROR: ${normalizeError3(error)}`]
           };
         }
       }
@@ -14136,7 +14579,7 @@ function createBddHandler(deps = {}) {
       } catch (error) {
         return {
           exitCode: ExitCode.TransportError,
-          stderr: [`ERROR: ${normalizeError2(error)}`]
+          stderr: [`ERROR: ${normalizeError3(error)}`]
         };
       }
     }
@@ -14157,7 +14600,7 @@ var CONFIG_FLAGS4 = /* @__PURE__ */ new Set([
   "--jira-email",
   "--jira-api-token"
 ]);
-function parseArgs4(args) {
+function parseArgs5(args) {
   const flags = {};
   const boolFlags = /* @__PURE__ */ new Set();
   const unknownFlags = [];
@@ -14195,7 +14638,7 @@ function pickConfigArgs4(parsed) {
   }
   return args;
 }
-function normalizeError3(error) {
+function normalizeError4(error) {
   if (error instanceof ForgeClientError) {
     return `${error.code}: ${error.message}`;
   }
@@ -14329,7 +14772,7 @@ function createCasesHandler(deps = {}) {
   const env = deps.env ?? process.env;
   return async (request, context) => {
     const [subcommand, ...restArgs] = request.args;
-    const parsed = parseArgs4(restArgs);
+    const parsed = parseArgs5(restArgs);
     const useJson = parsed.boolFlags.has("--json");
     const config = resolveCliConfig(pickConfigArgs4(parsed), env, cwd);
     const projectKey = config.values.projectKey;
@@ -14376,7 +14819,7 @@ function createCasesHandler(deps = {}) {
       } catch (error) {
         return {
           exitCode: ExitCode.TransportError,
-          stderr: [`ERROR: ${normalizeError3(error)}`]
+          stderr: [`ERROR: ${normalizeError4(error)}`]
         };
       }
     }
@@ -14418,7 +14861,7 @@ function createCasesHandler(deps = {}) {
       } catch (error) {
         return {
           exitCode: ExitCode.TransportError,
-          stderr: [`ERROR: ${normalizeError3(error)}`]
+          stderr: [`ERROR: ${normalizeError4(error)}`]
         };
       }
     }
@@ -14481,7 +14924,7 @@ function createCasesHandler(deps = {}) {
       } catch (error) {
         return {
           exitCode: ExitCode.TransportError,
-          stderr: [`ERROR: ${normalizeError3(error)}`]
+          stderr: [`ERROR: ${normalizeError4(error)}`]
         };
       }
     }
@@ -14544,7 +14987,7 @@ function createCasesHandler(deps = {}) {
       } catch (error) {
         return {
           exitCode: ExitCode.TransportError,
-          stderr: [`ERROR: ${normalizeError3(error)}`]
+          stderr: [`ERROR: ${normalizeError4(error)}`]
         };
       }
     }
@@ -14556,6 +14999,7 @@ function createCasesHandler(deps = {}) {
 }
 
 // src/doctor.ts
+var import_node_child_process3 = require("node:child_process");
 var CONFIG_FLAGS5 = /* @__PURE__ */ new Set([
   "--config",
   "--base-url",
@@ -14565,11 +15009,16 @@ var CONFIG_FLAGS5 = /* @__PURE__ */ new Set([
   "--jira-email",
   "--jira-api-token"
 ]);
-function parseArgs5(args) {
+var DIRECT_JIRA_FLAGS = /* @__PURE__ */ new Set([
+  "--site",
+  "--email",
+  "--api-token"
+]);
+function parseArgs6(args) {
   const flags = {};
   const boolFlags = /* @__PURE__ */ new Set();
   const unknownFlags = [];
-  const valuedFlags = /* @__PURE__ */ new Set([...CONFIG_FLAGS5]);
+  const valuedFlags = /* @__PURE__ */ new Set([...CONFIG_FLAGS5, ...DIRECT_JIRA_FLAGS]);
   const supportedBoolFlags = /* @__PURE__ */ new Set(["--json", "--check-context"]);
   for (let i = 0; i < args.length; i += 1) {
     const token = args[i];
@@ -14635,6 +15084,49 @@ function checkFromServiceResult(result) {
     message: `Forge endpoint reachable (service returned ${result.error.code}).`
   };
 }
+function normalizeSite3(value) {
+  return value.trim().replace(/\/+$/, "");
+}
+function hasValue(value) {
+  return value.trim().length > 0;
+}
+function resolveAllureJiraConfig(parsed, env, cwd) {
+  const resolution = resolveCliConfig(pickConfigArgs5(parsed), env, cwd);
+  const site = normalizeSite3(parsed.flags["--site"] ?? env.JIRA_SITE ?? resolution.values.baseUrl);
+  const email = (parsed.flags["--email"] ?? resolution.values.jiraEmail).trim();
+  const apiToken = (parsed.flags["--api-token"] ?? resolution.values.jiraApiToken).trim();
+  const issueKey = (parsed.flags["--issue-key"] ?? "").trim();
+  const errors = [];
+  if (!hasValue(site)) {
+    errors.push("Missing Jira site. Pass --site, set JIRA_SITE/JIRA_BASE_URL, or configure baseUrl.");
+  }
+  if (!hasValue(email)) {
+    errors.push("Missing Jira email. Pass --email or set JIRA_EMAIL.");
+  }
+  if (!hasValue(apiToken)) {
+    errors.push("Missing Jira API token. Pass --api-token or set JIRA_API_TOKEN.");
+  }
+  return { site, email, apiToken, issueKey, errors };
+}
+function commandCheck(deps, command, args, passMessage, warnMessage) {
+  try {
+    deps.execFileSync(command, [...args], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    return {
+      name: command,
+      status: "pass",
+      message: passMessage
+    };
+  } catch {
+    return {
+      name: command,
+      status: "warn",
+      message: warnMessage
+    };
+  }
+}
 function toJsonPayload(summary) {
   return {
     status: summary.status,
@@ -14667,9 +15159,11 @@ function toHumanLines2(summary) {
 function createDoctorHandler(deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const env = deps.env ?? process.env;
+  const runCommand = deps.execFileSync ?? import_node_child_process3.execFileSync;
+  const listAttachments = deps.listIssueAttachments ?? listIssueAttachments;
   return async (request, context) => {
-    const [, ...subArgs] = request.args;
-    const parsed = parseArgs5(subArgs);
+    const [subcommand, ...subArgs] = request.args;
+    const parsed = parseArgs6(subArgs);
     const useJson = parsed.boolFlags.has("--json");
     const enforceContextCheck = parsed.boolFlags.has("--check-context");
     const checks = [];
@@ -14685,10 +15179,74 @@ function createDoctorHandler(deps = {}) {
         stdout: useJson ? toJsonLine(toJsonPayload(summary2)) : toHumanLines2(summary2)
       };
     }
-    const configArgs = pickConfigArgs5(parsed);
-    const resolution = resolveCliConfig(configArgs, env, cwd);
-    const configValidation = validateCliConfigResolution(resolution);
-    checks.push({
+    if (subcommand === "allure") {
+      const config = resolveAllureJiraConfig(parsed, env, cwd);
+      checks.push({
+        name: "allure_jira_credentials",
+        status: config.errors.length === 0 ? "pass" : "fail",
+        message: config.errors.length === 0 ? "Jira site, email, and API token are configured for Allure upload/download." : config.errors.join(" ")
+      });
+      if (config.issueKey && config.errors.length === 0) {
+        try {
+          const attachments = await listAttachments({
+            site: config.site,
+            email: config.email,
+            apiToken: config.apiToken,
+            issueKey: config.issueKey
+          });
+          checks.push({
+            name: "allure_jira_issue_access",
+            status: "pass",
+            message: `Jira issue ${config.issueKey} is reachable; ${attachments.length} attachment(s) visible.`
+          });
+        } catch (error) {
+          checks.push({
+            name: "allure_jira_issue_access",
+            status: "fail",
+            message: normalizeConnectivityError(error)
+          });
+        }
+      } else if (!config.issueKey) {
+        checks.push({
+          name: "allure_jira_issue_access",
+          status: "skip",
+          message: "Issue access check skipped. Pass --issue-key to verify Jira read/download access for a specific issue."
+        });
+      }
+      checks.push(commandCheck(
+        { execFileSync: runCommand },
+        "unzip",
+        ["-v"],
+        "unzip is available for manual ZIP inspection.",
+        "unzip was not found. The future built-in opener can avoid this, but manual inspection will be less convenient."
+      ));
+      checks.push(commandCheck(
+        { execFileSync: runCommand },
+        "java",
+        ["-version"],
+        "Java is available for optional raw allure-results workflows.",
+        "Java was not found. This does not block generated Allure HTML ZIP upload/download/open; it only matters for raw allure-results generation."
+      ));
+      checks.push(commandCheck(
+        { execFileSync: runCommand },
+        "allure",
+        ["--version"],
+        "Allure CLI is available for optional raw allure-results workflows.",
+        "Allure CLI was not found. This does not block generated Allure HTML ZIP upload/download/open."
+      ));
+      const summary2 = {
+        status: computeOverallStatus(checks),
+        checks
+      };
+      return {
+        exitCode: pickDoctorExitCode(summary2),
+        stdout: useJson ? toJsonLine(toJsonPayload(summary2)) : toHumanLines2(summary2)
+      };
+    }
+    const configArgs = pickConfigArgs5(parsed);
+    const resolution = resolveCliConfig(configArgs, env, cwd);
+    const configValidation = validateCliConfigResolution(resolution);
+    checks.push({
       name: "config_completeness",
       status: configValidation.ok ? "pass" : "fail",
       message: configValidation.ok ? "Required config is present." : configValidation.errors.join(" ")
@@ -14773,8 +15331,8 @@ function createDoctorHandler(deps = {}) {
 }
 
 // src/ingestFeature.ts
-var import_node_fs9 = require("node:fs");
-var import_node_path10 = __toESM(require("node:path"), 1);
+var import_node_fs11 = require("node:fs");
+var import_node_path12 = __toESM(require("node:path"), 1);
 var CONFIG_FLAGS6 = /* @__PURE__ */ new Set([
   "--config",
   "--base-url",
@@ -14784,7 +15342,7 @@ var CONFIG_FLAGS6 = /* @__PURE__ */ new Set([
   "--jira-email",
   "--jira-api-token"
 ]);
-function parseArgs6(args) {
+function parseArgs7(args) {
   const flags = {};
   const boolFlags = /* @__PURE__ */ new Set();
   const unknownFlags = [];
@@ -14850,7 +15408,7 @@ function summarizeSuccess(result) {
   }
   return lines;
 }
-function normalizeError4(error) {
+function normalizeError5(error) {
   if (error instanceof ForgeClientError) {
     return `${error.code}: ${error.message}`;
   }
@@ -14860,18 +15418,18 @@ function normalizeError4(error) {
   return "Unknown ingest error.";
 }
 function createIngestFeatureHandler(deps = {}) {
-  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs9.readFileSync)(filePath, "utf8"));
-  const readStdin = deps.readStdin ?? (() => (0, import_node_fs9.readFileSync)(0, "utf8"));
+  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs11.readFileSync)(filePath, "utf8"));
+  const readStdin = deps.readStdin ?? (() => (0, import_node_fs11.readFileSync)(0, "utf8"));
   const cwd = deps.cwd ?? process.cwd();
   const env = deps.env ?? process.env;
   return async (request, context) => {
     const [, ...subArgs] = request.args;
-    const parsed = parseArgs6(subArgs);
+    const parsed = parseArgs7(subArgs);
     const configArgs = pickConfigArgs6(parsed);
     const config = resolveCliConfig(configArgs, env, cwd);
     const projectKey = config.values.projectKey;
     const issueKey = config.values.issueKey;
-    const sourceFile = parsed.flags["--file"] ? import_node_path10.default.resolve(cwd, parsed.flags["--file"]) : "";
+    const sourceFile = parsed.flags["--file"] ? import_node_path12.default.resolve(cwd, parsed.flags["--file"]) : "";
     const useStdin = parsed.boolFlags.has("--stdin");
     const useJson = parsed.boolFlags.has("--json");
     const sourceCount = Number(Boolean(sourceFile)) + Number(useStdin);
@@ -14887,7 +15445,7 @@ function createIngestFeatureHandler(deps = {}) {
     } catch (error) {
       return {
         exitCode: ExitCode.InternalError,
-        stderr: [`ERROR: Failed to read feature source: ${normalizeError4(error)}`]
+        stderr: [`ERROR: Failed to read feature source: ${normalizeError5(error)}`]
       };
     }
     const name = (parsed.flags["--name"] ?? deriveNameFromGherkin(gherkin)).trim();
@@ -14982,7 +15540,7 @@ function createIngestFeatureHandler(deps = {}) {
             status: "failed",
             featureName: name,
             source: useStdin ? "stdin" : sourceFile,
-            errorMessage: normalizeError4(error)
+            errorMessage: normalizeError5(error)
           })
         };
       }
@@ -14993,15 +15551,15 @@ function createIngestFeatureHandler(deps = {}) {
           `Feature: ${name}`,
           `Source: ${useStdin ? "stdin" : sourceFile}`
         ],
-        stderr: [`ERROR: ${normalizeError4(error)}`]
+        stderr: [`ERROR: ${normalizeError5(error)}`]
       };
     }
   };
 }
 
 // src/runUpload.ts
-var import_node_fs10 = require("node:fs");
-var import_node_path11 = __toESM(require("node:path"), 1);
+var import_node_fs12 = require("node:fs");
+var import_node_path13 = __toESM(require("node:path"), 1);
 var STEP_RESULTS = [
   StepResult.Passed,
   StepResult.Failed,
@@ -15017,7 +15575,7 @@ var CONFIG_FLAGS7 = /* @__PURE__ */ new Set([
   "--jira-email",
   "--jira-api-token"
 ]);
-function parseArgs7(args) {
+function parseArgs8(args) {
   const flags = {};
   const boolFlags = /* @__PURE__ */ new Set();
   const unknownFlags = [];
@@ -15063,7 +15621,7 @@ function pickConfigArgs7(parsed) {
   }
   return configArgs;
 }
-function normalizeError5(error) {
+function normalizeError6(error) {
   if (error instanceof ForgeClientError) {
     return `${error.code}: ${error.message}`;
   }
@@ -15142,19 +15700,19 @@ function summarizeRunResult(result) {
   return lines;
 }
 function createRunUploadHandler(deps = {}) {
-  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs10.readFileSync)(filePath, "utf8"));
-  const readStdin = deps.readStdin ?? (() => (0, import_node_fs10.readFileSync)(0, "utf8"));
+  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs12.readFileSync)(filePath, "utf8"));
+  const readStdin = deps.readStdin ?? (() => (0, import_node_fs12.readFileSync)(0, "utf8"));
   const cwd = deps.cwd ?? process.cwd();
   const env = deps.env ?? process.env;
   return async (request, context) => {
     const [, ...subArgs] = request.args;
-    const parsed = parseArgs7(subArgs);
+    const parsed = parseArgs8(subArgs);
     const configArgs = pickConfigArgs7(parsed);
     const config = resolveCliConfig(configArgs, env, cwd);
     const projectKey = config.values.projectKey;
     const issueKey = config.values.issueKey;
     const testCaseKey = parsed.flags["--test-case-key"]?.trim().toUpperCase() ?? "";
-    const sourceFile = parsed.flags["--file"] ? import_node_path11.default.resolve(cwd, parsed.flags["--file"]) : "";
+    const sourceFile = parsed.flags["--file"] ? import_node_path13.default.resolve(cwd, parsed.flags["--file"]) : "";
     const useStdin = parsed.boolFlags.has("--stdin");
     const useJson = parsed.boolFlags.has("--json");
     const sourceCount = Number(Boolean(sourceFile)) + Number(useStdin);
@@ -15182,7 +15740,7 @@ function createRunUploadHandler(deps = {}) {
     } catch (error) {
       return {
         exitCode: ExitCode.InternalError,
-        stderr: [`ERROR: Failed to read run payload source: ${normalizeError5(error)}`]
+        stderr: [`ERROR: Failed to read run payload source: ${normalizeError6(error)}`]
       };
     }
     const payloadFromSource = parseRunPayload(raw);
@@ -15212,7 +15770,7 @@ function createRunUploadHandler(deps = {}) {
       } catch (error) {
         return {
           exitCode: ExitCode.TransportError,
-          stderr: [`ERROR: ${normalizeError5(error)}`]
+          stderr: [`ERROR: ${normalizeError6(error)}`]
         };
       }
     }
@@ -15292,7 +15850,7 @@ function createRunUploadHandler(deps = {}) {
             featureName: runInput.featureName,
             scenarioName: runInput.scenarioName,
             executedAt: runInput.executedAt,
-            errorMessage: normalizeError5(error)
+            errorMessage: normalizeError6(error)
           })
         };
       }
@@ -15304,7 +15862,7 @@ function createRunUploadHandler(deps = {}) {
           `Scenario: ${runInput.scenarioName}`,
           `ExecutedAt: ${runInput.executedAt}`
         ],
-        stderr: [`ERROR: ${normalizeError5(error)}`]
+        stderr: [`ERROR: ${normalizeError6(error)}`]
       };
     }
   };
@@ -15320,7 +15878,7 @@ var CONFIG_FLAGS8 = /* @__PURE__ */ new Set([
   "--jira-email",
   "--jira-api-token"
 ]);
-function parseArgs8(args) {
+function parseArgs9(args) {
   const flags = {};
   const boolFlags = /* @__PURE__ */ new Set();
   const unknownFlags = [];
@@ -15358,7 +15916,7 @@ function pickConfigArgs8(parsed) {
   }
   return args;
 }
-function normalizeError6(error) {
+function normalizeError7(error) {
   if (error instanceof ForgeClientError) {
     return `${error.code}: ${error.message}`;
   }
@@ -15422,7 +15980,7 @@ function createRunsHandler(deps = {}) {
   const env = deps.env ?? process.env;
   return async (request, context) => {
     const [subcommand, ...restArgs] = request.args;
-    const parsed = parseArgs8(restArgs);
+    const parsed = parseArgs9(restArgs);
     const useJson = parsed.boolFlags.has("--json");
     const config = resolveCliConfig(pickConfigArgs8(parsed), env, cwd);
     const projectKey = config.values.projectKey;
@@ -15476,7 +16034,7 @@ function createRunsHandler(deps = {}) {
       } catch (error) {
         return {
           exitCode: ExitCode.TransportError,
-          stderr: [`ERROR: ${normalizeError6(error)}`]
+          stderr: [`ERROR: ${normalizeError7(error)}`]
         };
       }
     }
@@ -15487,175 +16045,1655 @@ function createRunsHandler(deps = {}) {
   };
 }
 
-// src/suites.ts
-var CONFIG_FLAGS9 = /* @__PURE__ */ new Set([
-  "--config",
-  "--base-url",
-  "--project-key",
-  "--issue-key",
-  "--auth-mode",
-  "--jira-email",
-  "--jira-api-token"
-]);
-function parseArgs9(args) {
-  const flags = {};
-  const boolFlags = /* @__PURE__ */ new Set();
-  const unknownFlags = [];
-  const supportedValueFlags = /* @__PURE__ */ new Set(["--key", ...CONFIG_FLAGS9]);
-  const supportedBoolFlags = /* @__PURE__ */ new Set(["--json"]);
-  for (let index = 0; index < args.length; index += 1) {
-    const token = args[index];
-    if (!token.startsWith("--")) {
-      continue;
-    }
-    if (supportedBoolFlags.has(token)) {
-      boolFlags.add(token);
-      continue;
-    }
-    if (!supportedValueFlags.has(token)) {
-      unknownFlags.push(token);
-      continue;
-    }
-    const value = args[index + 1];
-    if (!value || value.startsWith("--")) {
-      unknownFlags.push(token);
-      continue;
-    }
-    flags[token] = value;
-    index += 1;
-  }
-  return { flags, boolFlags, unknownFlags };
-}
-function pickConfigArgs9(parsed) {
-  const args = [];
-  for (const [flag, value] of Object.entries(parsed.flags)) {
-    if (CONFIG_FLAGS9.has(flag)) {
-      args.push(flag, value);
-    }
+// src/setup.ts
+var import_node_fs14 = require("node:fs");
+var import_node_path15 = __toESM(require("node:path"), 1);
+
+// src/githubSetupProvider.ts
+var import_node_child_process4 = require("node:child_process");
+
+// src/setupPlan.ts
+var import_node_crypto = require("node:crypto");
+var import_node_fs13 = require("node:fs");
+var import_node_path14 = __toESM(require("node:path"), 1);
+var SETUP_PLAN_SCHEMA_VERSION = "automatify.testops.setup/v1";
+var SETUP_PLAN_KIND = "AutomatifyTestOpsSetupPlan";
+var ACTIONS = [
+  {
+    id: "write-workflow-file",
+    scope: "workflow-file",
+    summary: "Write the approved GitHub Actions workflow into the local repository checkout.",
+    mutates: "local-file"
+  },
+  {
+    id: "set-callback-secrets",
+    scope: "github-secrets",
+    summary: "Create missing GitHub Actions callback secrets without exposing their values.",
+    mutates: "github"
+  },
+  {
+    id: "upsert-jira-profile",
+    scope: "jira-profile",
+    summary: "Create or update the Jira scenario automation profile through Forge contracts.",
+    mutates: "jira"
   }
-  return args;
+];
+function sha256(value) {
+  return (0, import_node_crypto.createHash)("sha256").update(value, "utf8").digest("hex");
 }
-function normalizeError7(error) {
-  if (error instanceof ForgeClientError) {
-    return `${error.code}: ${error.message}`;
+function sortJsonValue(value) {
+  if (Array.isArray(value)) {
+    return value.map(sortJsonValue);
   }
-  if (error instanceof Error) {
-    return error.message;
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, nested]) => [key, sortJsonValue(nested)])
+    );
   }
-  return "Unknown suites command error.";
+  return value;
 }
-function toJsonSuite(suite) {
-  return {
-    id: suite.id,
-    key: suite.key,
-    name: suite.name,
-    description: suite.description ?? null,
-    linkedIssueKeys: [...suite.linkedIssueKeys ?? []],
-    createdAt: suite.createdAt,
-    updatedAt: suite.updatedAt
-  };
+function stableJson(value) {
+  return JSON.stringify(sortJsonValue(value));
 }
-function toJsonCase2(testCase) {
-  return {
-    id: testCase.id,
-    key: testCase.key,
-    title: testCase.title,
-    status: testCase.status,
-    description: testCase.description ?? null,
-    linkedIssueKeys: [...testCase.linkedIssueKeys ?? []],
-    createdAt: testCase.createdAt,
-    updatedAt: testCase.updatedAt
-  };
+function computePlanId(planWithoutId) {
+  return `sha256:${sha256(stableJson(planWithoutId))}`;
 }
-function suitesToLines(items) {
-  if (items.length === 0) {
-    return ["Test suites: 0", "No test suites found for the selected context."];
+function withoutPlanId(plan) {
+  const { planId: _planId, ...rest } = plan;
+  return rest;
+}
+function requireNonEmpty(value, field) {
+  const normalized = value.trim();
+  if (!normalized) {
+    throw new Error(`${field} is required.`);
   }
-  return [
-    `Test suites: ${items.length}`,
-    ...items.map((item) => `- ${item.key} ${item.name}`)
-  ];
+  return normalized;
 }
-function suiteToLines(suite) {
-  return [
-    `Test suite: ${suite.key}`,
-    `Name: ${suite.name}`,
-    `Description: ${suite.description ?? "none"}`,
-    `Linked issues: ${(suite.linkedIssueKeys ?? []).join(", ") || "none"}`,
-    `Created: ${suite.createdAt}`,
-    `Updated: ${suite.updatedAt}`
-  ];
+function normalizeProjectKey(value) {
+  const normalized = requireNonEmpty(value, "project key").toUpperCase();
+  if (!/^[A-Z][A-Z0-9_]{1,31}$/.test(normalized)) {
+    throw new Error("project key must contain 2-32 uppercase letters, digits, or underscores and start with a letter.");
+  }
+  return normalized;
 }
-function suiteCasesToLines(suite, items) {
-  if (items.length === 0) {
-    return [
-      `Suite test cases: 0`,
-      `Suite: ${suite.key} ${suite.name}`,
-      "No test cases are currently linked to this suite."
-    ];
+function normalizeRepoPart(value, field) {
+  const normalized = requireNonEmpty(value, field);
+  if (!/^[A-Za-z0-9_.-]+$/.test(normalized)) {
+    throw new Error(`${field} contains unsupported characters.`);
   }
-  return [
-    `Suite test cases: ${items.length}`,
-    `Suite: ${suite.key} ${suite.name}`,
-    ...items.map((item) => `- ${item.key} [${item.status}] ${item.title}`)
-  ];
+  return normalized;
 }
-function missingProjectResponse4() {
-  return {
-    exitCode: ExitCode.ValidationError,
-    stderr: ["ERROR: Missing project context. Set JIRA_PROJECT_KEY or pass --project-key."]
-  };
+function normalizeWorkflowPath(value) {
+  const normalized = import_node_path14.default.posix.normalize(requireNonEmpty(value, "workflow path").replaceAll("\\", "/"));
+  if (import_node_path14.default.posix.isAbsolute(normalized) || normalized.startsWith("../") || !normalized.startsWith(".github/workflows/") || !/\.ya?ml$/i.test(normalized)) {
+    throw new Error("workflow path must be a relative .github/workflows/*.yml or *.yaml path without '..'.");
+  }
+  return normalized;
 }
-function missingKeyResponse2(commandPath) {
+function normalizeSecretName(value, field) {
+  const normalized = requireNonEmpty(value, field).toUpperCase();
+  if (!/^[A-Z_][A-Z0-9_]*$/.test(normalized)) {
+    throw new Error(`${field} must be a valid GitHub Actions secret name.`);
+  }
+  return normalized;
+}
+function buildGitHubSetupPlan(input) {
+  const projectKey = normalizeProjectKey(input.projectKey);
+  const owner = normalizeRepoPart(input.owner, "GitHub owner");
+  const repository = normalizeRepoPart(input.repository, "GitHub repository");
+  const ref = requireNonEmpty(input.ref, "Git ref");
+  const workflowId = requireNonEmpty(input.workflowId, "workflow id");
+  const workflowPath = normalizeWorkflowPath(input.workflowPath);
+  const profileLabel = requireNonEmpty(input.profileLabel, "profile label");
+  const endpointSecretName = normalizeSecretName(
+    input.callbackEndpointSecretName,
+    "callback endpoint secret name"
+  );
+  const tokenSecretName = normalizeSecretName(
+    input.callbackAuthTokenSecretName,
+    "callback auth token secret name"
+  );
+  if (endpointSecretName === tokenSecretName) {
+    throw new Error("callback endpoint and auth token secret names must be different.");
+  }
+  const workflowContent = (0, import_node_fs13.readFileSync)(input.workflowSourcePath, "utf8");
+  if (!workflowContent.trim()) {
+    throw new Error("workflow source file is empty.");
+  }
+  if (!/\bworkflow_dispatch\s*:/m.test(workflowContent)) {
+    throw new Error("workflow source must declare workflow_dispatch so Forge can address it explicitly.");
+  }
+  for (const secretName of [endpointSecretName, tokenSecretName]) {
+    if (!workflowContent.includes(`secrets.${secretName}`)) {
+      throw new Error(`workflow source must reference GitHub Actions secret secrets.${secretName}.`);
+    }
+  }
+  const actions = input.setProjectDefault ? [
+    ...ACTIONS,
+    {
+      id: "set-project-default",
+      scope: "project-default",
+      summary: "Select the approved Jira automation profile as the project default through Forge contracts.",
+      mutates: "jira"
+    }
+  ] : [...ACTIONS];
+  const planWithoutId = {
+    schemaVersion: SETUP_PLAN_SCHEMA_VERSION,
+    kind: SETUP_PLAN_KIND,
+    provider: "github-actions",
+    project: { key: projectKey },
+    github: {
+      owner,
+      repository,
+      ref,
+      workflowId,
+      workflowFile: {
+        path: workflowPath,
+        sourcePath: import_node_path14.default.resolve(input.workflowSourcePath),
+        sha256: sha256(workflowContent)
+      },
+      requiredSecrets: [
+        {
+          repositorySecretName: endpointSecretName,
+          valueKey: "callbackEndpoint",
+          purpose: "Authenticated Forge callback endpoint used by the workflow."
+        },
+        {
+          repositorySecretName: tokenSecretName,
+          valueKey: "callbackAuthToken",
+          purpose: "Project-admin CLI key used by the workflow for Forge callbacks."
+        }
+      ],
+      guidance: {
+        authentication: "Prefer a GitHub App installation token or a fine-grained token with only the repository permissions required for workflow inspection, secrets administration, and workflow dispatch from Forge.",
+        permissions: [
+          "Actions: read (doctor) and write only when the Forge profile must dispatch workflow runs.",
+          "Secrets: read/write metadata only for the explicit github-secrets apply scope.",
+          "Contents: read for doctor; this command never creates commits or pull requests."
+        ],
+        remoteChangesExcluded: [
+          "accounts",
+          "credentials",
+          "commits",
+          "pull requests",
+          "workflow runs"
+        ]
+      }
+    },
+    jiraProfile: {
+      label: profileLabel,
+      enabled: input.enabled,
+      provider: "githubActions",
+      config: {
+        owner,
+        repo: repository,
+        workflowId,
+        ref
+      },
+      setProjectDefault: input.setProjectDefault
+    },
+    actions,
+    smokeValidation: [
+      {
+        id: "workflow-content",
+        verifies: "Local and remote workflow content/path without dispatching it.",
+        triggersExternalRun: false
+      },
+      {
+        id: "callback-secret-metadata",
+        verifies: "Required GitHub repository secret names exist; secret values remain unreadable.",
+        triggersExternalRun: false
+      },
+      {
+        id: "jira-profile",
+        verifies: "The Forge automation profile and optional project default match the plan.",
+        triggersExternalRun: false
+      }
+    ],
+    rollback: [
+      {
+        actionId: "write-workflow-file",
+        strategy: "Restore the previous file through version control or delete the newly created uncommitted file.",
+        automatic: false
+      },
+      {
+        actionId: "set-callback-secrets",
+        strategy: "Rotate or delete the named GitHub repository secrets manually; previous secret values cannot be read or restored.",
+        automatic: false
+      },
+      {
+        actionId: "upsert-jira-profile",
+        strategy: "Restore the pre-apply profile fields captured in the apply report, or delete a newly created unused profile through the existing Forge contract.",
+        automatic: false
+      },
+      ...input.setProjectDefault ? [
+        {
+          actionId: "set-project-default",
+          strategy: "Restore the pre-apply default profile id captured in the apply report.",
+          automatic: false
+        }
+      ] : []
+    ],
+    followUp: {
+      azureDevOps: "Add an Azure DevOps provider adapter over this schema/action boundary, mapping pipeline variables and the existing azureDevops Forge profile config without changing setup apply orchestration."
+    }
+  };
   return {
-    exitCode: ExitCode.ValidationError,
-    stderr: [`ERROR: Missing required --key for ${commandPath}.`]
+    ...planWithoutId,
+    planId: computePlanId(planWithoutId)
   };
 }
-function createSuitesHandler(deps = {}) {
-  const cwd = deps.cwd ?? process.cwd();
-  const env = deps.env ?? process.env;
-  return async (request, context) => {
-    const [subcommand, ...restArgs] = request.args;
-    const parsed = parseArgs9(restArgs);
-    const useJson = parsed.boolFlags.has("--json");
-    const config = resolveCliConfig(pickConfigArgs9(parsed), env, cwd);
-    const projectKey = config.values.projectKey;
-    const issueKey = config.values.issueKey;
-    if (parsed.unknownFlags.length > 0) {
-      return {
-        exitCode: ExitCode.UsageError,
-        stderr: [`ERROR: Unknown or invalid flags: ${parsed.unknownFlags.join(", ")}`]
-      };
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function hasExactKeys(value, keys) {
+  const actual = Object.keys(value).sort();
+  const expected = [...keys].sort();
+  return actual.length === expected.length && actual.every((key, index) => key === expected[index]);
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+function validateRequiredSecrets(value, errors) {
+  if (!Array.isArray(value) || value.length !== 2) {
+    errors.push("github.requiredSecrets must contain exactly the callback endpoint and callback auth token metadata.");
+    return false;
+  }
+  const keys = /* @__PURE__ */ new Set();
+  const repositoryNames = /* @__PURE__ */ new Set();
+  for (const [index, secret] of value.entries()) {
+    if (!isRecord(secret) || !hasExactKeys(secret, ["repositorySecretName", "valueKey", "purpose"])) {
+      errors.push(`github.requiredSecrets[${index}] has an invalid shape.`);
+      continue;
     }
-    if (!projectKey) {
-      return missingProjectResponse4();
+    if (!isNonEmptyString(secret.repositorySecretName) || !/^[A-Z_][A-Z0-9_]*$/.test(secret.repositorySecretName)) {
+      errors.push(`github.requiredSecrets[${index}].repositorySecretName is invalid.`);
+    } else {
+      repositoryNames.add(secret.repositorySecretName);
     }
-    if (subcommand === "list") {
-      try {
-        const result = await context.invokeForgeContract("listTestSuites", {
-          context: {
-            projectKey,
-            issueKey: issueKey || void 0
-          }
-        });
-        if (!result.ok) {
-          return {
-            exitCode: ExitCode.RemoteError,
-            stderr: [`ERROR: ${result.error.code}: ${result.error.message}`]
-          };
-        }
-        if (useJson) {
-          return {
-            exitCode: ExitCode.Success,
-            stdout: toJsonLine({
-              action: "suites-list",
-              projectKey,
-              issueKey: issueKey || null,
-              count: result.data.length,
-              items: result.data.map((item) => toJsonSuite(item))
-            })
-          };
+    if (secret.valueKey !== "callbackEndpoint" && secret.valueKey !== "callbackAuthToken") {
+      errors.push(`github.requiredSecrets[${index}].valueKey is invalid.`);
+    } else {
+      keys.add(secret.valueKey);
+    }
+    if (!isNonEmptyString(secret.purpose)) {
+      errors.push(`github.requiredSecrets[${index}].purpose is required.`);
+    }
+  }
+  if (!keys.has("callbackEndpoint") || !keys.has("callbackAuthToken")) {
+    errors.push("github.requiredSecrets must map both callbackEndpoint and callbackAuthToken.");
+  }
+  if (repositoryNames.size !== 2) {
+    errors.push("github.requiredSecrets must use two distinct repository secret names.");
+  }
+  return errors.length === 0;
+}
+function validateActions(value, setDefault, errors) {
+  const expected = setDefault ? [
+    { id: "write-workflow-file", scope: "workflow-file", mutates: "local-file" },
+    { id: "set-callback-secrets", scope: "github-secrets", mutates: "github" },
+    { id: "upsert-jira-profile", scope: "jira-profile", mutates: "jira" },
+    { id: "set-project-default", scope: "project-default", mutates: "jira" }
+  ] : [
+    { id: "write-workflow-file", scope: "workflow-file", mutates: "local-file" },
+    { id: "set-callback-secrets", scope: "github-secrets", mutates: "github" },
+    { id: "upsert-jira-profile", scope: "jira-profile", mutates: "jira" }
+  ];
+  if (!Array.isArray(value) || value.length !== expected.length) {
+    errors.push("actions do not match the required setup mutation scopes.");
+    return false;
+  }
+  value.forEach((action, index) => {
+    if (!isRecord(action) || !hasExactKeys(action, ["id", "scope", "summary", "mutates"])) {
+      errors.push(`actions[${index}] has an invalid shape.`);
+      return;
+    }
+    const expectedAction = expected[index];
+    if (action.id !== expectedAction.id || action.scope !== expectedAction.scope || action.mutates !== expectedAction.mutates) {
+      errors.push(`actions[${index}] must be ${expectedAction.id}/${expectedAction.scope}/${expectedAction.mutates}.`);
+    }
+    if (!isNonEmptyString(action.id) || !isNonEmptyString(action.summary)) {
+      errors.push(`actions[${index}] requires id and summary.`);
+    }
+    if (!["local-file", "github", "jira"].includes(action.mutates)) {
+      errors.push(`actions[${index}].mutates is invalid.`);
+    }
+  });
+  return errors.length === 0;
+}
+function validateGuidance(value, errors) {
+  if (!isRecord(value) || !hasExactKeys(value, ["authentication", "permissions", "remoteChangesExcluded"])) {
+    errors.push("github.guidance has an invalid shape.");
+    return;
+  }
+  if (!isNonEmptyString(value.authentication)) {
+    errors.push("github.guidance.authentication is required.");
+  }
+  if (!Array.isArray(value.permissions) || value.permissions.length === 0 || !value.permissions.every(isNonEmptyString)) {
+    errors.push("github.guidance.permissions must be a non-empty string array.");
+  }
+  const expectedExclusions = ["accounts", "credentials", "commits", "pull requests", "workflow runs"];
+  if (!Array.isArray(value.remoteChangesExcluded) || value.remoteChangesExcluded.length !== expectedExclusions.length || !value.remoteChangesExcluded.every((item, index) => item === expectedExclusions[index])) {
+    errors.push("github.guidance.remoteChangesExcluded must be a string array.");
+  }
+}
+function validateSmokeAndRollback(smoke, rollback, setDefault, errors) {
+  const expectedSmokeIds = ["workflow-content", "callback-secret-metadata", "jira-profile"];
+  if (!Array.isArray(smoke) || smoke.length !== expectedSmokeIds.length) {
+    errors.push("smokeValidation must contain the three provider checks.");
+  } else {
+    smoke.forEach((check, index) => {
+      if (!isRecord(check) || !hasExactKeys(check, ["id", "verifies", "triggersExternalRun"]) || check.id !== expectedSmokeIds[index] || !isNonEmptyString(check.verifies) || check.triggersExternalRun !== false) {
+        errors.push(`smokeValidation[${index}] has an invalid shape or could trigger an external run.`);
+      }
+    });
+  }
+  const expectedRollbackIds = setDefault ? ["write-workflow-file", "set-callback-secrets", "upsert-jira-profile", "set-project-default"] : ["write-workflow-file", "set-callback-secrets", "upsert-jira-profile"];
+  if (!Array.isArray(rollback) || rollback.length !== expectedRollbackIds.length) {
+    errors.push("rollback must cover every mutation action.");
+  } else {
+    rollback.forEach((step, index) => {
+      if (!isRecord(step) || !hasExactKeys(step, ["actionId", "strategy", "automatic"]) || step.actionId !== expectedRollbackIds[index] || !isNonEmptyString(step.strategy) || step.automatic !== false) {
+        errors.push(`rollback[${index}] has an invalid shape or action id.`);
+      }
+    });
+  }
+}
+function validateSetupPlan(value) {
+  const errors = [];
+  if (!isRecord(value)) {
+    return { ok: false, errors: ["Plan must be a JSON object."] };
+  }
+  if (!hasExactKeys(value, [
+    "schemaVersion",
+    "kind",
+    "planId",
+    "provider",
+    "project",
+    "github",
+    "jiraProfile",
+    "actions",
+    "smokeValidation",
+    "rollback",
+    "followUp"
+  ])) {
+    errors.push("Plan has missing or unsupported top-level fields.");
+  }
+  if (value.schemaVersion !== SETUP_PLAN_SCHEMA_VERSION) {
+    errors.push(`schemaVersion must be ${SETUP_PLAN_SCHEMA_VERSION}.`);
+  }
+  if (value.kind !== SETUP_PLAN_KIND) {
+    errors.push(`kind must be ${SETUP_PLAN_KIND}.`);
+  }
+  if (value.provider !== "github-actions") {
+    errors.push("provider must be github-actions for this plan version.");
+  }
+  if (!isNonEmptyString(value.planId) || !value.planId.startsWith("sha256:")) {
+    errors.push("planId must be a sha256 identifier.");
+  }
+  if (!isRecord(value.project) || !hasExactKeys(value.project, ["key"]) || !isNonEmptyString(value.project.key) || !/^[A-Z][A-Z0-9_]{1,31}$/.test(value.project.key)) {
+    errors.push("project.key is required.");
+  }
+  const github = value.github;
+  if (!isRecord(github) || !hasExactKeys(github, [
+    "owner",
+    "repository",
+    "ref",
+    "workflowId",
+    "workflowFile",
+    "requiredSecrets",
+    "guidance"
+  ])) {
+    errors.push("github has an invalid shape.");
+  } else {
+    for (const field of ["owner", "repository", "ref", "workflowId"]) {
+      if (!isNonEmptyString(github[field])) {
+        errors.push(`github.${field} is required.`);
+      }
+    }
+    if (isNonEmptyString(github.owner) && !/^[A-Za-z0-9_.-]+$/.test(github.owner)) {
+      errors.push("github.owner contains unsupported characters.");
+    }
+    if (isNonEmptyString(github.repository) && !/^[A-Za-z0-9_.-]+$/.test(github.repository)) {
+      errors.push("github.repository contains unsupported characters.");
+    }
+    if (!isRecord(github.workflowFile) || !hasExactKeys(github.workflowFile, ["path", "sourcePath", "sha256"])) {
+      errors.push("github.workflowFile has an invalid shape.");
+    } else {
+      if (!isNonEmptyString(github.workflowFile.path)) {
+        errors.push("github.workflowFile.path is required.");
+      } else {
+        try {
+          normalizeWorkflowPath(github.workflowFile.path);
+        } catch (error) {
+          errors.push(error instanceof Error ? error.message : "github.workflowFile.path is invalid.");
+        }
+      }
+      if (!isNonEmptyString(github.workflowFile.sourcePath)) {
+        errors.push("github.workflowFile.sourcePath is required.");
+      }
+      if (typeof github.workflowFile.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(github.workflowFile.sha256)) {
+        errors.push("github.workflowFile.sha256 must be a lowercase SHA-256 digest.");
+      }
+    }
+    validateRequiredSecrets(github.requiredSecrets, errors);
+    validateGuidance(github.guidance, errors);
+  }
+  const profile = value.jiraProfile;
+  let setDefault = false;
+  if (!isRecord(profile) || !hasExactKeys(profile, ["label", "enabled", "provider", "config", "setProjectDefault"])) {
+    errors.push("jiraProfile has an invalid shape.");
+  } else {
+    setDefault = profile.setProjectDefault === true;
+    if (!isNonEmptyString(profile.label)) {
+      errors.push("jiraProfile.label is required.");
+    }
+    if (typeof profile.enabled !== "boolean" || typeof profile.setProjectDefault !== "boolean") {
+      errors.push("jiraProfile enabled/default flags must be booleans.");
+    }
+    if (profile.provider !== "githubActions") {
+      errors.push("jiraProfile.provider must be githubActions.");
+    }
+    if (!isRecord(profile.config) || !hasExactKeys(profile.config, ["owner", "repo", "workflowId", "ref"])) {
+      errors.push("jiraProfile.config has an invalid shape.");
+    } else if (isRecord(github)) {
+      if (profile.config.owner !== github.owner || profile.config.repo !== github.repository || profile.config.workflowId !== github.workflowId || profile.config.ref !== github.ref) {
+        errors.push("jiraProfile.config must match the GitHub repository/ref/workflow fields.");
+      }
+    }
+  }
+  validateActions(value.actions, setDefault, errors);
+  validateSmokeAndRollback(value.smokeValidation, value.rollback, setDefault, errors);
+  if (!isRecord(value.followUp) || !hasExactKeys(value.followUp, ["azureDevOps"]) || !isNonEmptyString(value.followUp.azureDevOps)) {
+    errors.push("followUp.azureDevOps is required.");
+  }
+  if (errors.length === 0) {
+    const plan = value;
+    if (plan.planId !== computePlanId(withoutPlanId(plan))) {
+      errors.push("planId does not match the plan contents.");
+    }
+  }
+  return errors.length === 0 ? { ok: true, errors: [], plan: value } : { ok: false, errors };
+}
+function hashSetupContent(value) {
+  return sha256(value);
+}
+
+// src/githubSetupProvider.ts
+function isRecord2(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function safeGitHubMessage(body, fallback) {
+  if (isRecord2(body) && typeof body.message === "string") {
+    return body.message.slice(0, 500);
+  }
+  return fallback;
+}
+async function githubApi(fetchImpl, url, token) {
+  const response = await fetchImpl(url, {
+    method: "GET",
+    headers: {
+      accept: "application/vnd.github+json",
+      "x-github-api-version": "2022-11-28",
+      ...token ? { authorization: `Bearer ${token}` } : {}
+    }
+  });
+  const text = await response.text();
+  let body = {};
+  if (text) {
+    try {
+      body = JSON.parse(text);
+    } catch {
+      body = {};
+    }
+  }
+  return { ok: response.ok, status: response.status, body };
+}
+async function setGitHubRepositorySecretWithCli(input) {
+  await new Promise((resolve, reject) => {
+    const child = (0, import_node_child_process4.spawn)(
+      "gh",
+      ["secret", "set", input.name, "--repo", `${input.owner}/${input.repository}`],
+      {
+        shell: false,
+        stdio: ["pipe", "ignore", "pipe"],
+        env: {
+          ...process.env,
+          GH_TOKEN: input.adminToken
+        }
+      }
+    );
+    let stderr = "";
+    child.stderr.setEncoding("utf8");
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk;
+    });
+    child.on("error", (error) => {
+      reject(new Error(`Unable to start GitHub CLI: ${error.message}`));
+    });
+    child.on("close", (code) => {
+      if (code === 0) {
+        resolve();
+        return;
+      }
+      const suffix = stderr.trim() ? ` ${stderr.trim().slice(0, 500)}` : "";
+      reject(new Error(`GitHub CLI could not set repository secret ${input.name}.${suffix}`));
+    });
+    child.stdin.end(input.value, "utf8");
+  });
+}
+var GitHubSetupProvider = class {
+  name = "github-actions";
+  fetchImpl;
+  secretSetter;
+  constructor(deps = {}) {
+    this.fetchImpl = deps.fetchImpl ?? fetch;
+    this.secretSetter = deps.setRepositorySecret ?? setGitHubRepositorySecretWithCli;
+  }
+  async inspectExecutionDefinition(plan, token) {
+    const { owner, repository, workflowId, ref, workflowFile } = plan.github;
+    const workflowUrl = `https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}/actions/workflows/${encodeURIComponent(workflowId)}`;
+    const workflow = await githubApi(this.fetchImpl, workflowUrl, token);
+    if (!workflow.ok) {
+      if (workflow.status === 404) {
+        return {
+          found: false,
+          message: "Workflow is not registered on GitHub. Commit the local workflow to the repository default branch before expecting workflow_dispatch to be available."
+        };
+      }
+      return {
+        found: false,
+        message: `GitHub workflow metadata could not be verified (HTTP ${workflow.status}: ${safeGitHubMessage(workflow.body, "request failed")}).`
+      };
+    }
+    const workflowPath = isRecord2(workflow.body) && typeof workflow.body.path === "string" ? workflow.body.path.replace(/^\//, "") : void 0;
+    const state = isRecord2(workflow.body) && typeof workflow.body.state === "string" ? workflow.body.state : void 0;
+    const contentUrl = `https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}/contents/${workflowFile.path.split("/").map(encodeURIComponent).join("/")}?ref=${encodeURIComponent(ref)}`;
+    const content = await githubApi(this.fetchImpl, contentUrl, token);
+    let contentSha256;
+    if (content.ok && isRecord2(content.body) && typeof content.body.content === "string") {
+      try {
+        const decoded = Buffer.from(content.body.content.replace(/\s/g, ""), "base64").toString("utf8");
+        contentSha256 = hashSetupContent(decoded);
+      } catch {
+        contentSha256 = void 0;
+      }
+    }
+    return {
+      found: true,
+      active: state === "active",
+      path: workflowPath,
+      contentSha256,
+      message: state !== "active" ? `GitHub workflow is registered but its state is ${state ?? "unknown"}.` : workflowPath !== workflowFile.path ? `GitHub workflow path ${workflowPath ?? "<unknown>"} does not match ${workflowFile.path}.` : contentSha256 === workflowFile.sha256 ? "GitHub workflow is active and its content matches the approved plan." : "GitHub workflow metadata is reachable, but the approved ref content could not be confirmed as an exact plan match."
+    };
+  }
+  async inspectCallbackSecretMetadata(plan, adminToken) {
+    if (!adminToken) {
+      return {
+        verified: false,
+        names: /* @__PURE__ */ new Set(),
+        message: "Repository secret metadata was not verified because githubAdminToken was not provided. Secret values are never readable."
+      };
+    }
+    const { owner, repository } = plan.github;
+    const url = `https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}/actions/secrets?per_page=100`;
+    const response = await githubApi(this.fetchImpl, url, adminToken);
+    if (!response.ok) {
+      throw new Error(
+        `GitHub repository secret metadata request failed with HTTP ${response.status}: ${safeGitHubMessage(response.body, "request failed")}`
+      );
+    }
+    const names = /* @__PURE__ */ new Set();
+    if (isRecord2(response.body) && Array.isArray(response.body.secrets)) {
+      for (const item of response.body.secrets) {
+        if (isRecord2(item) && typeof item.name === "string") {
+          names.add(item.name);
+        }
+      }
+    }
+    return {
+      verified: true,
+      names,
+      message: `Verified ${names.size} GitHub repository secret name(s); values remain unreadable.`
+    };
+  }
+  async setCallbackSecret(plan, secret, value, adminToken) {
+    await this.secretSetter({
+      owner: plan.github.owner,
+      repository: plan.github.repository,
+      name: secret.repositorySecretName,
+      value,
+      adminToken
+    });
+  }
+};
+
+// src/setup.ts
+var APPLY_RESULT_SCHEMA_VERSION = "automatify.testops.setup.apply/v1";
+var DOCTOR_RESULT_SCHEMA_VERSION = "automatify.testops.setup.doctor/v1";
+var SECRET_KEYS = [
+  "githubProviderToken",
+  "githubAdminToken",
+  "callbackEndpoint",
+  "callbackAuthToken"
+];
+var MUTATION_SCOPES = [
+  "workflow-file",
+  "github-secrets",
+  "jira-profile",
+  "project-default"
+];
+var SetupCommandError = class extends Error {
+  cliCode;
+  exitCode;
+  constructor(cliCode, message, exitCode) {
+    super(message);
+    this.name = "SetupCommandError";
+    this.cliCode = cliCode;
+    this.exitCode = exitCode;
+  }
+};
+var PLAN_VALUE_FLAGS = /* @__PURE__ */ new Set([
+  "--provider",
+  "--project-key",
+  "--owner",
+  "--repo",
+  "--ref",
+  "--workflow-id",
+  "--workflow-path",
+  "--workflow-source",
+  "--profile-label",
+  "--callback-endpoint-secret-name",
+  "--callback-auth-token-secret-name"
+]);
+var APPLY_VALUE_FLAGS = /* @__PURE__ */ new Set(["--plan", "--repo-root"]);
+var APPLY_BOOL_FLAGS = /* @__PURE__ */ new Set([
+  "--confirm",
+  "--dry-run",
+  "--secrets-stdin",
+  "--rotate-secrets",
+  "--rotate-provider-token"
+]);
+function defaultReadStdin() {
+  return new Promise((resolve, reject) => {
+    let value = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (chunk) => {
+      value += chunk;
+    });
+    process.stdin.on("end", () => resolve(value));
+    process.stdin.on("error", reject);
+  });
+}
+function parseArgs10(args, valueFlags, boolFlags, allowApplyCollections = false) {
+  const flags = {};
+  const enabled = /* @__PURE__ */ new Set();
+  const approvals = [];
+  const secretRefs = [];
+  const errors = [];
+  for (let index = 0; index < args.length; index += 1) {
+    const token = args[index];
+    if (!token.startsWith("--")) {
+      errors.push(`Unexpected positional argument at index ${index}.`);
+      continue;
+    }
+    if (boolFlags.has(token)) {
+      enabled.add(token);
+      continue;
+    }
+    if (allowApplyCollections && (token === "--approve" || token === "--secret-ref")) {
+      const value2 = args[index + 1];
+      if (!value2 || value2.startsWith("--")) {
+        errors.push(`${token} requires a value.`);
+        continue;
+      }
+      (token === "--approve" ? approvals : secretRefs).push(value2);
+      index += 1;
+      continue;
+    }
+    if (!valueFlags.has(token)) {
+      errors.push(`Unknown option ${token}.`);
+      continue;
+    }
+    const value = args[index + 1];
+    if (!value || value.startsWith("--")) {
+      errors.push(`${token} requires a value.`);
+      continue;
+    }
+    flags[token] = value;
+    index += 1;
+  }
+  return { flags, boolFlags: enabled, approvals, secretRefs, errors };
+}
+function jsonResponse(payload, exitCode = ExitCode.Success) {
+  return {
+    exitCode,
+    stdout: [JSON.stringify(payload)]
+  };
+}
+function errorPayload(code, message, diagnostics = []) {
+  return {
+    schemaVersion: APPLY_RESULT_SCHEMA_VERSION,
+    status: "failed",
+    error: {
+      code,
+      message,
+      diagnostics
+    }
+  };
+}
+function safeErrorMessage(error, secrets = { values: {}, sources: {} }) {
+  let message = error instanceof Error ? error.message : "Unknown setup error.";
+  for (const secret of Object.values(secrets.values)) {
+    if (secret) {
+      message = message.split(secret).join("[REDACTED]");
+    }
+  }
+  return message.replace(/Bearer\s+[A-Za-z0-9._~+\/-]+/gi, "Bearer [REDACTED]").replace(/token[=:]\s*[^\s,;]+/gi, "token=[REDACTED]");
+}
+function exitCodeForError(error) {
+  if (error instanceof SetupCommandError) {
+    return error.exitCode;
+  }
+  if (error instanceof ForgeClientError) {
+    return error.code === "NETWORK_ERROR" || error.code === "TIMEOUT_ERROR" ? ExitCode.TransportError : ExitCode.RemoteError;
+  }
+  return ExitCode.RemoteError;
+}
+function errorCodeForError(error, fallback) {
+  return error instanceof SetupCommandError ? error.cliCode : fallback;
+}
+function loadPlan(planPath, cwd) {
+  const absolute = import_node_path15.default.resolve(cwd, planPath);
+  let parsed;
+  try {
+    parsed = JSON.parse((0, import_node_fs14.readFileSync)(absolute, "utf8"));
+  } catch (error) {
+    throw new SetupCommandError(
+      "PLAN_READ_ERROR",
+      `Could not read setup plan JSON: ${error instanceof Error ? error.message : "unknown error"}`,
+      ExitCode.ValidationError
+    );
+  }
+  const validation = validateSetupPlan(parsed);
+  if (!validation.ok || !validation.plan) {
+    throw new SetupCommandError(
+      "PLAN_VALIDATION_ERROR",
+      `Setup plan validation failed: ${validation.errors.join(" ")}`,
+      ExitCode.ValidationError
+    );
+  }
+  return validation.plan;
+}
+function isSecretKey(value) {
+  return SECRET_KEYS.includes(value);
+}
+async function resolveSecrets(parsed, deps) {
+  const values = {};
+  const sources = {};
+  if (parsed.boolFlags.has("--secrets-stdin")) {
+    const raw = await deps.readStdin();
+    let envelope;
+    try {
+      envelope = JSON.parse(raw);
+    } catch {
+      throw new SetupCommandError(
+        "SECRET_INPUT_ERROR",
+        "Secret stdin must be a JSON object. Input content was not retained or printed.",
+        ExitCode.ValidationError
+      );
+    }
+    if (!envelope || typeof envelope !== "object" || Array.isArray(envelope)) {
+      throw new SetupCommandError("SECRET_INPUT_ERROR", "Secret stdin must be a JSON object.", ExitCode.ValidationError);
+    }
+    for (const [key, value] of Object.entries(envelope)) {
+      if (!isSecretKey(key)) {
+        throw new SetupCommandError("SECRET_INPUT_ERROR", `Secret stdin contains unsupported key ${key}.`, ExitCode.ValidationError);
+      }
+      if (typeof value !== "string" || !value.trim()) {
+        throw new SetupCommandError("SECRET_INPUT_ERROR", `Secret stdin key ${key} must be a non-empty string.`, ExitCode.ValidationError);
+      }
+      values[key] = value.trim();
+      sources[key] = "stdin";
+    }
+  }
+  for (const reference of parsed.secretRefs) {
+    const separator = reference.indexOf("=");
+    const key = separator > 0 ? reference.slice(0, separator) : "";
+    const target = separator > 0 ? reference.slice(separator + 1) : "";
+    if (!isSecretKey(key) || !target.startsWith("env:")) {
+      throw new SetupCommandError(
+        "SECRET_REFERENCE_ERROR",
+        "Secret references must use <supported-key>=env:<VARIABLE_NAME>.",
+        ExitCode.ValidationError
+      );
+    }
+    const envName = target.slice(4);
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(envName)) {
+      throw new SetupCommandError("SECRET_REFERENCE_ERROR", `Secret reference for ${key} has an invalid environment variable name.`, ExitCode.ValidationError);
+    }
+    if (sources[key]) {
+      throw new SetupCommandError("SECRET_REFERENCE_ERROR", `Secret ${key} was provided more than once.`, ExitCode.ValidationError);
+    }
+    const value = deps.env[envName]?.trim();
+    if (!value) {
+      throw new SetupCommandError(
+        "SECRET_REFERENCE_ERROR",
+        `Secret reference for ${key} points to an empty or missing environment variable.`,
+        ExitCode.ValidationError
+      );
+    }
+    values[key] = value;
+    sources[key] = "env-ref";
+  }
+  return { values, sources };
+}
+function approvedScopes(plan, parsed, dryRun) {
+  const planScopes = plan.actions.map((action) => action.scope);
+  const requested = parsed.approvals.length === 0 && dryRun ? ["all"] : parsed.approvals;
+  if (requested.length === 0) {
+    throw new SetupCommandError(
+      "APPROVAL_REQUIRED",
+      "At least one --approve <scope> is required for apply. Use --approve all to approve every planned action.",
+      ExitCode.UsageError
+    );
+  }
+  const expanded = /* @__PURE__ */ new Set();
+  for (const scope of requested) {
+    if (scope === "all") {
+      planScopes.forEach((item) => expanded.add(item));
+      continue;
+    }
+    if (!MUTATION_SCOPES.includes(scope)) {
+      throw new SetupCommandError("APPROVAL_ERROR", `Unsupported approval scope ${scope}.`, ExitCode.UsageError);
+    }
+    if (!planScopes.includes(scope)) {
+      throw new SetupCommandError("APPROVAL_ERROR", `Approval scope ${scope} is not present in this plan.`, ExitCode.UsageError);
+    }
+    expanded.add(scope);
+  }
+  return planScopes.filter((scope) => expanded.has(scope));
+}
+function requireServiceData(result, contract) {
+  if (!result.ok) {
+    throw new Error(`${contract} failed: ${result.error.code}: ${result.error.message}`);
+  }
+  return result.data;
+}
+function findMatchingProfile(profiles, plan) {
+  const matches = profiles.filter((profile) => profile.label === plan.jiraProfile.label);
+  if (matches.length > 1) {
+    throw new SetupCommandError(
+      "AMBIGUOUS_PROFILE",
+      `More than one Jira automation profile has label ${plan.jiraProfile.label}; rename duplicates before applying this deterministic plan.`,
+      ExitCode.ValidationError
+    );
+  }
+  return matches[0];
+}
+function profileMatches(profile, plan) {
+  const config = profile.config;
+  return profile.provider === "githubActions" && profile.label === plan.jiraProfile.label && profile.enabled === plan.jiraProfile.enabled && config.owner === plan.jiraProfile.config.owner && config.repo === plan.jiraProfile.config.repo && config.workflowId === plan.jiraProfile.config.workflowId && config.ref === plan.jiraProfile.config.ref;
+}
+function previousProfileState(profile) {
+  if (!profile) {
+    return { existed: false };
+  }
+  return {
+    existed: true,
+    id: profile.id,
+    label: profile.label,
+    provider: profile.provider,
+    enabled: profile.enabled,
+    wasProjectDefault: Boolean(profile.isProjectDefault),
+    hadSecret: profile.hasSecret
+  };
+}
+async function prepareState(plan, scopes, secrets, context, deps, dryRun, rotateSecrets, rotateProviderToken) {
+  let profiles = [];
+  let matchingProfile;
+  let currentDefaultProfileId;
+  if (scopes.includes("jira-profile") || scopes.includes("project-default")) {
+    profiles = requireServiceData(
+      await context.invokeForgeContract("listScenarioAutomationProfiles", {
+        context: { projectKey: plan.project.key }
+      }),
+      "listScenarioAutomationProfiles"
+    );
+    matchingProfile = findMatchingProfile(profiles, plan);
+    currentDefaultProfileId = profiles.find((profile) => profile.isProjectDefault)?.id;
+    const needsProviderToken = scopes.includes("jira-profile") && (!matchingProfile?.hasSecret || rotateProviderToken);
+    if (needsProviderToken && !dryRun && !secrets.values.githubProviderToken) {
+      throw new SetupCommandError(
+        "SECRET_INPUT_REQUIRED",
+        "githubProviderToken is required to create this Jira profile, restore a missing provider secret, or rotate the provider token.",
+        ExitCode.ValidationError
+      );
+    }
+  }
+  let repositorySecretNames;
+  if (scopes.includes("github-secrets")) {
+    if (!dryRun && !secrets.values.githubAdminToken) {
+      throw new SetupCommandError(
+        "SECRET_INPUT_REQUIRED",
+        "githubAdminToken is required for the approved github-secrets scope.",
+        ExitCode.ValidationError
+      );
+    }
+    if (secrets.values.githubAdminToken) {
+      const inspection = await deps.githubProvider.inspectCallbackSecretMetadata(
+        plan,
+        secrets.values.githubAdminToken
+      );
+      repositorySecretNames = inspection.names;
+      const secretsToWrite = plan.github.requiredSecrets.filter(
+        (secret) => rotateSecrets || !repositorySecretNames?.has(secret.repositorySecretName)
+      );
+      if (!dryRun) {
+        for (const secret of secretsToWrite) {
+          if (!secrets.values[secret.valueKey]) {
+            throw new SetupCommandError(
+              "SECRET_INPUT_REQUIRED",
+              `${secret.valueKey} is required to create or rotate ${secret.repositorySecretName}.`,
+              ExitCode.ValidationError
+            );
+          }
+        }
+      }
+    }
+  }
+  return { profiles, matchingProfile, currentDefaultProfileId, repositorySecretNames };
+}
+function rollbackFor(plan, actionId) {
+  return plan.rollback.find((item) => item.actionId === actionId)?.strategy ?? "Review the plan rollback section.";
+}
+function resolveWorkflowTarget(plan, repoRoot) {
+  const resolvedRoot = import_node_path15.default.resolve(repoRoot);
+  const target = import_node_path15.default.resolve(resolvedRoot, plan.github.workflowFile.path);
+  if (target !== resolvedRoot && !target.startsWith(`${resolvedRoot}${import_node_path15.default.sep}`)) {
+    throw new SetupCommandError(
+      "WORKFLOW_PATH_ERROR",
+      "Workflow target escapes the approved repository root.",
+      ExitCode.ValidationError
+    );
+  }
+  return target;
+}
+function applyWorkflowFile(plan, repoRoot, dryRun) {
+  const action = plan.actions.find((item) => item.scope === "workflow-file");
+  const target = resolveWorkflowTarget(plan, repoRoot);
+  const sourceContent = (0, import_node_fs14.readFileSync)(plan.github.workflowFile.sourcePath, "utf8");
+  if (hashSetupContent(sourceContent) !== plan.github.workflowFile.sha256) {
+    throw new SetupCommandError(
+      "WORKFLOW_SOURCE_CHANGED",
+      "Workflow source content no longer matches the approved plan hash; generate a new plan before applying.",
+      ExitCode.ValidationError
+    );
+  }
+  const existed = (0, import_node_fs14.existsSync)(target);
+  const previousContent = existed ? (0, import_node_fs14.readFileSync)(target, "utf8") : void 0;
+  const matches = previousContent !== void 0 && hashSetupContent(previousContent) === plan.github.workflowFile.sha256;
+  if (matches) {
+    return {
+      id: action.id,
+      scope: action.scope,
+      status: "skipped",
+      message: "Local workflow file already matches the approved content hash.",
+      rollback: { available: false, guidance: "No workflow file mutation occurred." }
+    };
+  }
+  if (!dryRun) {
+    (0, import_node_fs14.mkdirSync)(import_node_path15.default.dirname(target), { recursive: true });
+    (0, import_node_fs14.writeFileSync)(target, sourceContent, { encoding: "utf8", mode: 420 });
+  }
+  return {
+    id: action.id,
+    scope: action.scope,
+    status: dryRun ? "planned" : existed ? "updated" : "created",
+    message: dryRun ? `${existed ? "Update" : "Create"} ${plan.github.workflowFile.path} with sha256 ${plan.github.workflowFile.sha256}.` : `${existed ? "Updated" : "Created"} ${plan.github.workflowFile.path}.`,
+    rollback: {
+      available: !dryRun,
+      guidance: rollbackFor(plan, action.id),
+      previousState: {
+        existed,
+        sha256: previousContent === void 0 ? null : hashSetupContent(previousContent)
+      }
+    }
+  };
+}
+async function applyGitHubSecrets(plan, state, secrets, deps, dryRun, rotateSecrets) {
+  const action = plan.actions.find((item) => item.scope === "github-secrets");
+  const names = state.repositorySecretNames;
+  const pending = plan.github.requiredSecrets.filter(
+    (secret) => rotateSecrets || !names?.has(secret.repositorySecretName)
+  );
+  if (names && pending.length === 0) {
+    return {
+      id: action.id,
+      scope: action.scope,
+      status: "skipped",
+      message: "All required GitHub repository secret names already exist; values remain unreadable and were not overwritten.",
+      rollback: { available: false, guidance: "No GitHub secret mutation occurred." }
+    };
+  }
+  if (dryRun) {
+    return {
+      id: action.id,
+      scope: action.scope,
+      status: "planned",
+      message: names ? `Set ${pending.map((secret) => secret.repositorySecretName).join(", ")}; values will be read only from approved secret input.` : "Inspect required GitHub secret metadata, then create missing names from approved secret input.",
+      rollback: { available: false, guidance: rollbackFor(plan, action.id) }
+    };
+  }
+  const adminToken = secrets.values.githubAdminToken;
+  for (const secret of pending) {
+    await deps.githubProvider.setCallbackSecret(
+      plan,
+      secret,
+      secrets.values[secret.valueKey],
+      adminToken
+    );
+  }
+  return {
+    id: action.id,
+    scope: action.scope,
+    status: "updated",
+    message: `Set ${pending.length} GitHub repository secret(s). Values were not printed or placed in process arguments.`,
+    rollback: { available: false, guidance: rollbackFor(plan, action.id) }
+  };
+}
+async function applyJiraProfile(plan, state, secrets, context, dryRun, rotateProviderToken) {
+  const action = plan.actions.find((item) => item.scope === "jira-profile");
+  const current = state.matchingProfile;
+  const matches = current ? profileMatches(current, plan) : false;
+  if (current && matches && current.hasSecret && !rotateProviderToken) {
+    return {
+      profile: current,
+      result: {
+        id: action.id,
+        scope: action.scope,
+        status: "skipped",
+        message: "Jira automation profile already matches the plan and has a stored provider secret.",
+        rollback: { available: false, guidance: "No Jira profile mutation occurred." }
+      }
+    };
+  }
+  if (dryRun) {
+    const plannedProfile = current ?? {
+      id: "<created-by-forge>",
+      projectKey: plan.project.key,
+      label: plan.jiraProfile.label,
+      provider: "githubActions",
+      authType: "bearer",
+      method: "POST",
+      endpointSummary: "<computed-by-forge>",
+      config: plan.jiraProfile.config,
+      enabled: plan.jiraProfile.enabled,
+      hasSecret: Boolean(secrets.values.githubProviderToken),
+      createdAt: "",
+      updatedAt: ""
+    };
+    return {
+      profile: plannedProfile,
+      result: {
+        id: action.id,
+        scope: action.scope,
+        status: "planned",
+        message: `${current ? "Update" : "Create"} the Jira automation profile through upsertScenarioAutomationProfile.`,
+        rollback: {
+          available: false,
+          guidance: rollbackFor(plan, action.id),
+          previousState: previousProfileState(current)
+        }
+      }
+    };
+  }
+  const secretToken = !current?.hasSecret || rotateProviderToken ? secrets.values.githubProviderToken : void 0;
+  const profile = requireServiceData(
+    await context.invokeForgeContract("upsertScenarioAutomationProfile", {
+      context: { projectKey: plan.project.key },
+      input: {
+        profileId: current?.id,
+        label: plan.jiraProfile.label,
+        provider: "githubActions",
+        config: plan.jiraProfile.config,
+        enabled: plan.jiraProfile.enabled,
+        secretToken
+      }
+    }),
+    "upsertScenarioAutomationProfile"
+  );
+  return {
+    profile,
+    result: {
+      id: action.id,
+      scope: action.scope,
+      status: current ? "updated" : "created",
+      message: `${current ? "Updated" : "Created"} Jira automation profile ${plan.jiraProfile.label} through the existing Forge contract.`,
+      rollback: {
+        available: true,
+        guidance: rollbackFor(plan, action.id),
+        previousState: previousProfileState(current)
+      }
+    }
+  };
+}
+async function applyProjectDefault(plan, state, profile, context, dryRun) {
+  const action = plan.actions.find((item) => item.scope === "project-default");
+  if (state.currentDefaultProfileId === profile.id) {
+    return {
+      id: action.id,
+      scope: action.scope,
+      status: "skipped",
+      message: "Jira automation profile is already the project default.",
+      rollback: { available: false, guidance: "No project-default mutation occurred." }
+    };
+  }
+  if (!dryRun) {
+    requireServiceData(
+      await context.invokeForgeContract("setScenarioAutomationDefaultProfile", {
+        context: { projectKey: plan.project.key },
+        profileId: profile.id
+      }),
+      "setScenarioAutomationDefaultProfile"
+    );
+  }
+  return {
+    id: action.id,
+    scope: action.scope,
+    status: dryRun ? "planned" : "updated",
+    message: dryRun ? "Set the planned Jira automation profile as project default through setScenarioAutomationDefaultProfile." : "Set the Jira automation profile as project default through the existing Forge contract.",
+    rollback: {
+      available: !dryRun,
+      guidance: rollbackFor(plan, action.id),
+      previousState: { profileId: state.currentDefaultProfileId ?? null }
+    }
+  };
+}
+function doctorStatus(checks) {
+  if (checks.some((check) => check.status === "fail")) return "fail";
+  if (checks.some((check) => check.status === "warn")) return "warn";
+  return "pass";
+}
+async function inspectPlan(plan, repoRoot, secrets, context, deps) {
+  const checks = [];
+  let forgeTransportFailure = false;
+  const target = resolveWorkflowTarget(plan, repoRoot);
+  if (!(0, import_node_fs14.existsSync)(target)) {
+    checks.push({
+      id: "workflow-local",
+      status: "fail",
+      message: `Local workflow file ${plan.github.workflowFile.path} does not exist.`
+    });
+  } else {
+    const localHash = hashSetupContent((0, import_node_fs14.readFileSync)(target, "utf8"));
+    checks.push({
+      id: "workflow-local",
+      status: localHash === plan.github.workflowFile.sha256 ? "pass" : "fail",
+      message: localHash === plan.github.workflowFile.sha256 ? "Local workflow content matches the approved plan hash." : "Local workflow content differs from the approved plan hash."
+    });
+  }
+  try {
+    const workflow = await deps.githubProvider.inspectExecutionDefinition(
+      plan,
+      secrets.values.githubProviderToken ?? secrets.values.githubAdminToken
+    );
+    const exact = workflow.found && workflow.active && workflow.path === plan.github.workflowFile.path && workflow.contentSha256 === plan.github.workflowFile.sha256;
+    checks.push({
+      id: "workflow-github",
+      status: exact ? "pass" : workflow.found && (workflow.path !== plan.github.workflowFile.path || workflow.active === false) ? "fail" : "warn",
+      message: workflow.message
+    });
+  } catch (error) {
+    checks.push({
+      id: "workflow-github",
+      status: "warn",
+      message: `GitHub workflow could not be verified: ${safeErrorMessage(error, secrets)}`
+    });
+  }
+  try {
+    const secretInspection = await deps.githubProvider.inspectCallbackSecretMetadata(
+      plan,
+      secrets.values.githubAdminToken
+    );
+    if (!secretInspection.verified) {
+      checks.push({ id: "callback-secret-metadata", status: "warn", message: secretInspection.message });
+    } else {
+      const missing = plan.github.requiredSecrets.filter(
+        (secret) => !secretInspection.names.has(secret.repositorySecretName)
+      );
+      checks.push({
+        id: "callback-secret-metadata",
+        status: missing.length === 0 ? "pass" : "fail",
+        message: missing.length === 0 ? "All required GitHub repository secret names exist; values remain unreadable and were not printed." : `Missing GitHub repository secret name(s): ${missing.map((item) => item.repositorySecretName).join(", ")}.`
+      });
+    }
+  } catch (error) {
+    checks.push({
+      id: "callback-secret-metadata",
+      status: "warn",
+      message: `GitHub repository secret metadata could not be verified: ${safeErrorMessage(error, secrets)}`
+    });
+  }
+  try {
+    const profiles = requireServiceData(
+      await context.invokeForgeContract("listScenarioAutomationProfiles", {
+        context: { projectKey: plan.project.key }
+      }),
+      "listScenarioAutomationProfiles"
+    );
+    const profile = findMatchingProfile(profiles, plan);
+    const profileOk = Boolean(profile && profileMatches(profile, plan) && profile.hasSecret);
+    checks.push({
+      id: "jira-profile",
+      status: profileOk ? "pass" : "fail",
+      message: profileOk ? "Jira automation profile fields match the plan and Forge reports a stored provider secret." : "Jira automation profile is missing, differs from the plan, or lacks a provider secret."
+    });
+    if (plan.jiraProfile.setProjectDefault) {
+      checks.push({
+        id: "jira-project-default",
+        status: profile?.isProjectDefault ? "pass" : "fail",
+        message: profile?.isProjectDefault ? "Jira automation profile is the project default." : "Jira automation profile is not the project default."
+      });
+    }
+  } catch (error) {
+    forgeTransportFailure = error instanceof ForgeClientError && (error.code === "NETWORK_ERROR" || error.code === "TIMEOUT_ERROR");
+    checks.push({
+      id: "jira-profile",
+      status: "fail",
+      message: `Jira automation profile could not be verified: ${safeErrorMessage(error, secrets)}`
+    });
+  }
+  const status = doctorStatus(checks);
+  return {
+    schemaVersion: DOCTOR_RESULT_SCHEMA_VERSION,
+    planId: plan.planId,
+    provider: "github-actions",
+    status,
+    exitCode: forgeTransportFailure ? ExitCode.TransportError : status === "fail" ? ExitCode.ValidationError : ExitCode.Success,
+    externalRunTriggered: false,
+    checks
+  };
+}
+function planCommand(args, deps) {
+  const parsed = parseArgs10(args, PLAN_VALUE_FLAGS, /* @__PURE__ */ new Set(["--set-default", "--disabled"]));
+  if (parsed.errors.length > 0) {
+    return jsonResponse(errorPayload("USAGE_ERROR", "Invalid setup plan arguments.", parsed.errors), ExitCode.UsageError);
+  }
+  if ((parsed.flags["--provider"] ?? "github-actions") !== "github-actions") {
+    return jsonResponse(
+      errorPayload("VALIDATION_ERROR", "Only github-actions is implemented in this stage; Azure DevOps is the documented next adapter."),
+      ExitCode.ValidationError
+    );
+  }
+  try {
+    const plan = buildGitHubSetupPlan({
+      projectKey: parsed.flags["--project-key"] ?? "",
+      owner: parsed.flags["--owner"] ?? "",
+      repository: parsed.flags["--repo"] ?? "",
+      ref: parsed.flags["--ref"] ?? "main",
+      workflowId: parsed.flags["--workflow-id"] ?? "scenario-dispatch.yml",
+      workflowPath: parsed.flags["--workflow-path"] ?? ".github/workflows/scenario-dispatch.yml",
+      workflowSourcePath: import_node_path15.default.resolve(deps.cwd, parsed.flags["--workflow-source"] ?? ""),
+      profileLabel: parsed.flags["--profile-label"] ?? "GitHub Actions",
+      enabled: !parsed.boolFlags.has("--disabled"),
+      setProjectDefault: parsed.boolFlags.has("--set-default"),
+      callbackEndpointSecretName: parsed.flags["--callback-endpoint-secret-name"] ?? "TESTOPS_FORGE_ENDPOINT",
+      callbackAuthTokenSecretName: parsed.flags["--callback-auth-token-secret-name"] ?? "TESTOPS_FORGE_AUTH_TOKEN"
+    });
+    return jsonResponse(plan);
+  } catch (error) {
+    return jsonResponse(
+      errorPayload("VALIDATION_ERROR", safeErrorMessage(error)),
+      ExitCode.ValidationError
+    );
+  }
+}
+async function applyCommand(args, context, deps) {
+  const parsed = parseArgs10(args, APPLY_VALUE_FLAGS, APPLY_BOOL_FLAGS, true);
+  if (parsed.errors.length > 0) {
+    return jsonResponse(errorPayload("USAGE_ERROR", "Invalid setup apply arguments.", parsed.errors), ExitCode.UsageError);
+  }
+  const planPath = parsed.flags["--plan"];
+  if (!planPath) {
+    return jsonResponse(errorPayload("USAGE_ERROR", "--plan <file> is required."), ExitCode.UsageError);
+  }
+  const dryRun = parsed.boolFlags.has("--dry-run");
+  if (!dryRun && !parsed.boolFlags.has("--confirm")) {
+    return jsonResponse(
+      errorPayload("CONFIRMATION_REQUIRED", "Mutating apply requires --confirm plus explicit --approve scopes."),
+      ExitCode.UsageError
+    );
+  }
+  let secrets = { values: {}, sources: {} };
+  const actionResults = [];
+  try {
+    const plan = loadPlan(planPath, deps.cwd);
+    const scopes = approvedScopes(plan, parsed, dryRun);
+    secrets = await resolveSecrets(parsed, deps);
+    const repoRoot = import_node_path15.default.resolve(deps.cwd, parsed.flags["--repo-root"] ?? ".");
+    const rotateSecrets = parsed.boolFlags.has("--rotate-secrets");
+    const rotateProviderToken = parsed.boolFlags.has("--rotate-provider-token");
+    const state = await prepareState(
+      plan,
+      scopes,
+      secrets,
+      context,
+      deps,
+      dryRun,
+      rotateSecrets,
+      rotateProviderToken
+    );
+    let appliedProfile = state.matchingProfile;
+    for (const action of plan.actions) {
+      if (!scopes.includes(action.scope)) {
+        actionResults.push({
+          id: action.id,
+          scope: action.scope,
+          status: "skipped",
+          message: "Action was not in the explicit approval scope.",
+          rollback: { available: false, guidance: "No mutation occurred." }
+        });
+        continue;
+      }
+      try {
+        if (action.scope === "workflow-file") {
+          actionResults.push(applyWorkflowFile(plan, repoRoot, dryRun));
+        } else if (action.scope === "github-secrets") {
+          actionResults.push(await applyGitHubSecrets(plan, state, secrets, deps, dryRun, rotateSecrets));
+        } else if (action.scope === "jira-profile") {
+          const applied = await applyJiraProfile(
+            plan,
+            state,
+            secrets,
+            context,
+            dryRun,
+            rotateProviderToken
+          );
+          appliedProfile = applied.profile;
+          actionResults.push(applied.result);
+        } else if (action.scope === "project-default") {
+          if (!appliedProfile) {
+            throw new SetupCommandError(
+              "PROFILE_REQUIRED",
+              "Project-default apply requires an existing or approved Jira automation profile.",
+              ExitCode.ValidationError
+            );
+          }
+          actionResults.push(await applyProjectDefault(plan, state, appliedProfile, context, dryRun));
+        }
+      } catch (error) {
+        actionResults.push({
+          id: action.id,
+          scope: action.scope,
+          status: "failed",
+          message: safeErrorMessage(error, secrets),
+          rollback: {
+            available: false,
+            guidance: rollbackFor(plan, action.id)
+          }
+        });
+        throw error;
+      }
+    }
+    const doctor = dryRun ? void 0 : await inspectPlan(plan, repoRoot, secrets, context, deps);
+    return jsonResponse(
+      {
+        schemaVersion: APPLY_RESULT_SCHEMA_VERSION,
+        planId: plan.planId,
+        provider: plan.provider,
+        status: dryRun ? "dry-run" : doctor?.status === "fail" ? "applied-with-validation-failures" : doctor?.status === "warn" ? "applied-with-warnings" : "applied",
+        dryRun,
+        confirmed: !dryRun,
+        approvedScopes: scopes,
+        secretInputs: Object.entries(secrets.sources).map(([key, source]) => ({ key, source })),
+        actions: actionResults,
+        smokeValidation: doctor ?? {
+          status: "not-run",
+          externalRunTriggered: false,
+          message: "Dry-run performs no mutations and does not require remote smoke validation. Run setup doctor for read-only verification."
+        }
+      },
+      doctor?.exitCode ?? ExitCode.Success
+    );
+  } catch (error) {
+    const message = safeErrorMessage(error, secrets);
+    return jsonResponse(
+      {
+        ...errorPayload(errorCodeForError(error, "APPLY_FAILED"), message, [
+          "Review each completed action and its rollback guidance; GitHub secret values cannot be restored automatically."
+        ]),
+        actions: actionResults
+      },
+      exitCodeForError(error)
+    );
+  }
+}
+async function doctorCommand(args, context, deps) {
+  const parsed = parseArgs10(
+    args,
+    APPLY_VALUE_FLAGS,
+    /* @__PURE__ */ new Set(["--secrets-stdin"]),
+    true
+  );
+  if (parsed.approvals.length > 0) {
+    return jsonResponse(errorPayload("USAGE_ERROR", "setup doctor does not accept --approve."), ExitCode.UsageError);
+  }
+  if (parsed.errors.length > 0) {
+    return jsonResponse(errorPayload("USAGE_ERROR", "Invalid setup doctor arguments.", parsed.errors), ExitCode.UsageError);
+  }
+  const planPath = parsed.flags["--plan"];
+  if (!planPath) {
+    return jsonResponse(errorPayload("USAGE_ERROR", "--plan <file> is required."), ExitCode.UsageError);
+  }
+  let secrets = { values: {}, sources: {} };
+  try {
+    const plan = loadPlan(planPath, deps.cwd);
+    secrets = await resolveSecrets(parsed, deps);
+    const repoRoot = import_node_path15.default.resolve(deps.cwd, parsed.flags["--repo-root"] ?? ".");
+    const summary = await inspectPlan(plan, repoRoot, secrets, context, deps);
+    return jsonResponse(summary, summary.exitCode);
+  } catch (error) {
+    return jsonResponse(
+      errorPayload(errorCodeForError(error, "DOCTOR_FAILED"), safeErrorMessage(error, secrets)),
+      exitCodeForError(error)
+    );
+  }
+}
+function createSetupHandler(overrides = {}) {
+  const deps = {
+    cwd: overrides.cwd ?? process.cwd(),
+    env: overrides.env ?? process.env,
+    readStdin: overrides.readStdin ?? defaultReadStdin,
+    githubProvider: overrides.githubProvider ?? new GitHubSetupProvider(overrides.githubProviderDeps)
+  };
+  return async (request, context) => {
+    const [subcommand, ...args] = request.args;
+    if (subcommand === "plan") {
+      return planCommand(args, deps);
+    }
+    if (subcommand === "apply") {
+      return applyCommand(args, context, deps);
+    }
+    if (subcommand === "doctor") {
+      return doctorCommand(args, context, deps);
+    }
+    return jsonResponse(
+      errorPayload("USAGE_ERROR", `Unsupported setup subcommand ${subcommand ?? "<missing>"}.`),
+      ExitCode.UsageError
+    );
+  };
+}
+
+// src/suites.ts
+var CONFIG_FLAGS9 = /* @__PURE__ */ new Set([
+  "--config",
+  "--base-url",
+  "--project-key",
+  "--issue-key",
+  "--auth-mode",
+  "--jira-email",
+  "--jira-api-token"
+]);
+function parseArgs11(args) {
+  const flags = {};
+  const boolFlags = /* @__PURE__ */ new Set();
+  const unknownFlags = [];
+  const supportedValueFlags = /* @__PURE__ */ new Set(["--key", ...CONFIG_FLAGS9]);
+  const supportedBoolFlags = /* @__PURE__ */ new Set(["--json"]);
+  for (let index = 0; index < args.length; index += 1) {
+    const token = args[index];
+    if (!token.startsWith("--")) {
+      continue;
+    }
+    if (supportedBoolFlags.has(token)) {
+      boolFlags.add(token);
+      continue;
+    }
+    if (!supportedValueFlags.has(token)) {
+      unknownFlags.push(token);
+      continue;
+    }
+    const value = args[index + 1];
+    if (!value || value.startsWith("--")) {
+      unknownFlags.push(token);
+      continue;
+    }
+    flags[token] = value;
+    index += 1;
+  }
+  return { flags, boolFlags, unknownFlags };
+}
+function pickConfigArgs9(parsed) {
+  const args = [];
+  for (const [flag, value] of Object.entries(parsed.flags)) {
+    if (CONFIG_FLAGS9.has(flag)) {
+      args.push(flag, value);
+    }
+  }
+  return args;
+}
+function normalizeError8(error) {
+  if (error instanceof ForgeClientError) {
+    return `${error.code}: ${error.message}`;
+  }
+  if (error instanceof Error) {
+    return error.message;
+  }
+  return "Unknown suites command error.";
+}
+function toJsonSuite(suite) {
+  return {
+    id: suite.id,
+    key: suite.key,
+    name: suite.name,
+    description: suite.description ?? null,
+    linkedIssueKeys: [...suite.linkedIssueKeys ?? []],
+    createdAt: suite.createdAt,
+    updatedAt: suite.updatedAt
+  };
+}
+function toJsonCase2(testCase) {
+  return {
+    id: testCase.id,
+    key: testCase.key,
+    title: testCase.title,
+    status: testCase.status,
+    description: testCase.description ?? null,
+    linkedIssueKeys: [...testCase.linkedIssueKeys ?? []],
+    createdAt: testCase.createdAt,
+    updatedAt: testCase.updatedAt
+  };
+}
+function suitesToLines(items) {
+  if (items.length === 0) {
+    return ["Test suites: 0", "No test suites found for the selected context."];
+  }
+  return [
+    `Test suites: ${items.length}`,
+    ...items.map((item) => `- ${item.key} ${item.name}`)
+  ];
+}
+function suiteToLines(suite) {
+  return [
+    `Test suite: ${suite.key}`,
+    `Name: ${suite.name}`,
+    `Description: ${suite.description ?? "none"}`,
+    `Linked issues: ${(suite.linkedIssueKeys ?? []).join(", ") || "none"}`,
+    `Created: ${suite.createdAt}`,
+    `Updated: ${suite.updatedAt}`
+  ];
+}
+function suiteCasesToLines(suite, items) {
+  if (items.length === 0) {
+    return [
+      `Suite test cases: 0`,
+      `Suite: ${suite.key} ${suite.name}`,
+      "No test cases are currently linked to this suite."
+    ];
+  }
+  return [
+    `Suite test cases: ${items.length}`,
+    `Suite: ${suite.key} ${suite.name}`,
+    ...items.map((item) => `- ${item.key} [${item.status}] ${item.title}`)
+  ];
+}
+function missingProjectResponse4() {
+  return {
+    exitCode: ExitCode.ValidationError,
+    stderr: ["ERROR: Missing project context. Set JIRA_PROJECT_KEY or pass --project-key."]
+  };
+}
+function missingKeyResponse2(commandPath) {
+  return {
+    exitCode: ExitCode.ValidationError,
+    stderr: [`ERROR: Missing required --key for ${commandPath}.`]
+  };
+}
+function createSuitesHandler(deps = {}) {
+  const cwd = deps.cwd ?? process.cwd();
+  const env = deps.env ?? process.env;
+  return async (request, context) => {
+    const [subcommand, ...restArgs] = request.args;
+    const parsed = parseArgs11(restArgs);
+    const useJson = parsed.boolFlags.has("--json");
+    const config = resolveCliConfig(pickConfigArgs9(parsed), env, cwd);
+    const projectKey = config.values.projectKey;
+    const issueKey = config.values.issueKey;
+    if (parsed.unknownFlags.length > 0) {
+      return {
+        exitCode: ExitCode.UsageError,
+        stderr: [`ERROR: Unknown or invalid flags: ${parsed.unknownFlags.join(", ")}`]
+      };
+    }
+    if (!projectKey) {
+      return missingProjectResponse4();
+    }
+    if (subcommand === "list") {
+      try {
+        const result = await context.invokeForgeContract("listTestSuites", {
+          context: {
+            projectKey,
+            issueKey: issueKey || void 0
+          }
+        });
+        if (!result.ok) {
+          return {
+            exitCode: ExitCode.RemoteError,
+            stderr: [`ERROR: ${result.error.code}: ${result.error.message}`]
+          };
+        }
+        if (useJson) {
+          return {
+            exitCode: ExitCode.Success,
+            stdout: toJsonLine({
+              action: "suites-list",
+              projectKey,
+              issueKey: issueKey || null,
+              count: result.data.length,
+              items: result.data.map((item) => toJsonSuite(item))
+            })
+          };
         }
         return {
           exitCode: ExitCode.Success,
@@ -15664,7 +17702,7 @@ function createSuitesHandler(deps = {}) {
       } catch (error) {
         return {
           exitCode: ExitCode.TransportError,
-          stderr: [`ERROR: ${normalizeError7(error)}`]
+          stderr: [`ERROR: ${normalizeError8(error)}`]
         };
       }
     }
@@ -15705,7 +17743,7 @@ function createSuitesHandler(deps = {}) {
       } catch (error) {
         return {
           exitCode: ExitCode.TransportError,
-          stderr: [`ERROR: ${normalizeError7(error)}`]
+          stderr: [`ERROR: ${normalizeError8(error)}`]
         };
       }
     }
@@ -15769,7 +17807,7 @@ function createSuitesHandler(deps = {}) {
       } catch (error) {
         return {
           exitCode: ExitCode.TransportError,
-          stderr: [`ERROR: ${normalizeError7(error)}`]
+          stderr: [`ERROR: ${normalizeError8(error)}`]
         };
       }
     }
@@ -15791,7 +17829,7 @@ var CONFIG_FLAGS10 = /* @__PURE__ */ new Set([
   "--jira-api-token"
 ]);
 var RECONCILE_CONFIRM_TOKEN = "RECONCILE";
-function parseArgs10(args) {
+function parseArgs12(args) {
   const flags = {};
   const boolFlags = /* @__PURE__ */ new Set();
   const unknownFlags = [];
@@ -15829,7 +17867,7 @@ function pickConfigArgs10(parsed) {
   }
   return args;
 }
-function normalizeError8(error) {
+function normalizeError9(error) {
   if (error instanceof ForgeClientError) {
     return `${error.code}: ${error.message}`;
   }
@@ -15880,7 +17918,7 @@ function createSyncHandler(deps = {}) {
   const env = deps.env ?? process.env;
   return async (request, context) => {
     const [subcommand, ...restArgs] = request.args;
-    const parsed = parseArgs10(restArgs);
+    const parsed = parseArgs12(restArgs);
     const useJson = parsed.boolFlags.has("--json");
     const config = resolveCliConfig(pickConfigArgs10(parsed), env, cwd);
     const projectKey = config.values.projectKey;
@@ -15932,7 +17970,7 @@ function createSyncHandler(deps = {}) {
       } catch (error) {
         return {
           exitCode: ExitCode.TransportError,
-          stderr: [`ERROR: ${normalizeError8(error)}`]
+          stderr: [`ERROR: ${normalizeError9(error)}`]
         };
       }
     }
@@ -15978,7 +18016,7 @@ function createSyncHandler(deps = {}) {
       } catch (error) {
         return {
           exitCode: ExitCode.TransportError,
-          stderr: [`ERROR: ${normalizeError8(error)}`]
+          stderr: [`ERROR: ${normalizeError9(error)}`]
         };
       }
     }
@@ -15993,8 +18031,8 @@ function createSyncHandler(deps = {}) {
 var COMMAND_REGISTRY = [
   {
     name: "allure",
-    description: "Allure evidence upload/download commands for Jira issues",
-    subcommands: ["upload", "download"],
+    description: "Allure evidence upload/download/open commands for Jira issues",
+    subcommands: ["upload", "download", "open"],
     handler: createAllureHandler()
   },
   {
@@ -16040,6 +18078,12 @@ var COMMAND_REGISTRY = [
     subcommands: ["show"],
     handler: createRunsHandler()
   },
+  {
+    name: "setup",
+    description: "Plan, apply, and verify provider onboarding without duplicating Forge domain logic",
+    subcommands: ["plan", "apply", "doctor"],
+    handler: createSetupHandler()
+  },
   {
     name: "suites",
     description: "Hierarchy-aware suite browse commands",
@@ -16049,7 +18093,7 @@ var COMMAND_REGISTRY = [
   {
     name: "doctor",
     description: "Preflight and health checks",
-    subcommands: ["check"],
+    subcommands: ["check", "allure"],
     handler: createDoctorHandler()
   },
   {
@@ -16234,6 +18278,7 @@ function showTopLevelHelp() {
     "",
     "Available products:",
     "  testops       TestOps \u2014 test management, BDD, execution, reporting",
+    "  allure        Allure evidence diagnostics and local report workflows (doctor, open)",
     "",
     "Boundary:",
     "  Thin client over Forge contracts or Jira Cloud APIs.",
@@ -16243,6 +18288,29 @@ function showTopLevelHelp() {
     console.log(line);
   }
 }
+function showAllureHelp() {
+  const lines = [
+    "Automatify Allure",
+    "",
+    "Usage:",
+    "  automatify allure doctor [options]",
+    "  automatify allure open <zipPath> [options]",
+    "",
+    "Commands:",
+    "  doctor        Check local Allure/Jira readiness",
+    "  open          Extract a generated Allure HTML report ZIP and serve it locally",
+    "",
+    "Examples:",
+    "  automatify allure doctor",
+    "  automatify allure doctor --json",
+    "  automatify allure doctor --issue-key ABC-123",
+    "  automatify allure open ./allure-report.zip",
+    "  automatify allure open ./allure-report.zip --port 8080 --no-open"
+  ];
+  for (const line of lines) {
+    console.log(line);
+  }
+}
 async function main() {
   const args = process.argv.slice(2);
   const [productArg, ...restArgs] = args;
@@ -16251,6 +18319,28 @@ async function main() {
     process.exitCode = 0;
     return;
   }
+  if (productArg === "allure") {
+    const [commandArg, ...commandRest] = restArgs;
+    if (!commandArg || commandArg === "--help" || commandArg === "-h" || commandArg === "help") {
+      showAllureHelp();
+      process.exitCode = 0;
+      return;
+    }
+    if (commandArg === "doctor") {
+      const exitCode2 = await runCli(["doctor", "allure", ...commandRest]);
+      process.exitCode = exitCode2;
+      return;
+    }
+    if (commandArg === "open") {
+      const exitCode2 = await runCli(["allure", "open", ...commandRest]);
+      process.exitCode = exitCode2;
+      return;
+    }
+    console.error(`Unknown allure command: ${commandArg}`);
+    console.error("Run `automatify allure --help` to see available commands.");
+    process.exitCode = 1;
+    return;
+  }
   if (productArg !== "testops") {
     console.error(`Unknown product: ${productArg}`);
     console.error("Run `automatify --help` to see available products.");