@automatify-au/cli 0.1.11 → 0.1.12

package/dist/automatify.cjs

@@ -2894,8 +2894,8 @@ var require_utils = __commonJS({
       var result = transform[inputType][outputType](input);
       return result;
     };
-    exports2.resolve = function(path14) {
-      var parts = path14.split("/");
+    exports2.resolve = function(path16) {
+      var parts = path16.split("/");
       var result = [];
       for (var index = 0; index < parts.length; index++) {
         var part = parts[index];
@@ -8748,18 +8748,18 @@ var require_object = __commonJS({
       var object = new ZipObject(name, zipObjectContent, o);
       this.files[name] = object;
     };
-    var parentFolder = function(path14) {
-      if (path14.slice(-1) === "/") {
-        path14 = path14.substring(0, path14.length - 1);
+    var parentFolder = function(path16) {
+      if (path16.slice(-1) === "/") {
+        path16 = path16.substring(0, path16.length - 1);
       }
-      var lastSlash = path14.lastIndexOf("/");
-      return lastSlash > 0 ? path14.substring(0, lastSlash) : "";
+      var lastSlash = path16.lastIndexOf("/");
+      return lastSlash > 0 ? path16.substring(0, lastSlash) : "";
     };
-    var forceTrailingSlash = function(path14) {
-      if (path14.slice(-1) !== "/") {
-        path14 += "/";
+    var forceTrailingSlash = function(path16) {
+      if (path16.slice(-1) !== "/") {
+        path16 += "/";
       }
-      return path14;
+      return path16;
     };
     var folderAdd = function(name, createFolders) {
       createFolders = typeof createFolders !== "undefined" ? createFolders : defaults.createFolders;
@@ -9725,9 +9725,9 @@ var require_load = __commonJS({
 var require_lib3 = __commonJS({
   "../../node_modules/.pnpm/jszip@3.10.1/node_modules/jszip/lib/index.js"(exports2, module2) {
     "use strict";
-    function JSZip3() {
-      if (!(this instanceof JSZip3)) {
-        return new JSZip3();
+    function JSZip4() {
+      if (!(this instanceof JSZip4)) {
+        return new JSZip4();
       }
       if (arguments.length) {
         throw new Error("The constructor with parameters has been removed in JSZip 3.0, please check the upgrade guide.");
@@ -9736,7 +9736,7 @@ var require_lib3 = __commonJS({
       this.comment = null;
       this.root = "";
       this.clone = function() {
-        var newObj = new JSZip3();
+        var newObj = new JSZip4();
         for (var i in this) {
           if (typeof this[i] !== "function") {
             newObj[i] = this[i];
@@ -9745,16 +9745,16 @@ var require_lib3 = __commonJS({
         return newObj;
       };
     }
-    JSZip3.prototype = require_object();
-    JSZip3.prototype.loadAsync = require_load();
-    JSZip3.support = require_support();
-    JSZip3.defaults = require_defaults();
-    JSZip3.version = "3.10.1";
-    JSZip3.loadAsync = function(content, options) {
-      return new JSZip3().loadAsync(content, options);
+    JSZip4.prototype = require_object();
+    JSZip4.prototype.loadAsync = require_load();
+    JSZip4.support = require_support();
+    JSZip4.defaults = require_defaults();
+    JSZip4.version = "3.10.1";
+    JSZip4.loadAsync = function(content, options) {
+      return new JSZip4().loadAsync(content, options);
     };
-    JSZip3.external = require_external();
-    module2.exports = JSZip3;
+    JSZip4.external = require_external();
+    module2.exports = JSZip4;
   }
 });
 
@@ -10723,6 +10723,9 @@ function toJsonLine(data) {
 var import_node_fs4 = require("node:fs");
 var import_node_path5 = __toESM(require("node:path"), 1);
 
+// ../../packages/shared-types/dist/entitlements.js
+var UNLIMITED_ACTIVE_USERS = Number.MAX_SAFE_INTEGER;
+
 // ../../packages/shared-types/dist/index.js
 var TestCaseStatus;
 (function(TestCaseStatus2) {
@@ -12450,7 +12453,7 @@ function createAutoHandler(deps = {}) {
 var import_node_path10 = __toESM(require("node:path"), 1);
 var import_node_fs9 = require("node:fs");
 
-// ../../packages/jira-client/src/adf.ts
+// ../../packages/jira-client/dist/adf.js
 function paragraph(text = "") {
   return text ? { type: "paragraph", content: [{ type: "text", text }] } : { type: "paragraph" };
 }
@@ -12493,7 +12496,7 @@ function buildAllureEvidenceCommentAdf(input) {
   };
 }
 
-// ../../packages/jira-client/src/jiraClient.ts
+// ../../packages/jira-client/dist/jiraClient.js
 var import_node_fs5 = require("node:fs");
 var import_node_path6 = __toESM(require("node:path"), 1);
 function normalizeSite(site) {
@@ -12619,7 +12622,7 @@ async function addIssueComment(params) {
   };
 }
 
-// ../../packages/allure-core/src/parseAllureZip.ts
+// ../../packages/allure-core/dist/parseAllureZip.js
 var import_node_fs6 = require("node:fs");
 var import_node_path7 = __toESM(require("node:path"), 1);
 var import_jszip = __toESM(require_lib3(), 1);
@@ -12681,7 +12684,7 @@ async function parseAllureReportZip(zipPath) {
   };
 }
 
-// ../../packages/allure-core/src/extractAllureZip.ts
+// ../../packages/allure-core/dist/extractAllureZip.js
 var import_node_fs7 = require("node:fs");
 var import_node_path8 = __toESM(require("node:path"), 1);
 var import_jszip2 = __toESM(require_lib3(), 1);
@@ -12734,6 +12737,9 @@ async function extractAllureReportZip(zipPath, extractDir) {
   };
 }
 
+// ../../packages/allure-core/dist/parseAllureFailedTests.js
+var import_jszip3 = __toESM(require_lib3(), 1);
+
 // src/allureOpen.ts
 var import_node_fs8 = require("node:fs");
 var import_promises = require("node:fs/promises");
@@ -16039,6 +16045,1486 @@ function createRunsHandler(deps = {}) {
   };
 }
 
+// src/setup.ts
+var import_node_fs14 = require("node:fs");
+var import_node_path15 = __toESM(require("node:path"), 1);
+
+// src/githubSetupProvider.ts
+var import_node_child_process4 = require("node:child_process");
+
+// src/setupPlan.ts
+var import_node_crypto = require("node:crypto");
+var import_node_fs13 = require("node:fs");
+var import_node_path14 = __toESM(require("node:path"), 1);
+var SETUP_PLAN_SCHEMA_VERSION = "automatify.testops.setup/v1";
+var SETUP_PLAN_KIND = "AutomatifyTestOpsSetupPlan";
+var ACTIONS = [
+  {
+    id: "write-workflow-file",
+    scope: "workflow-file",
+    summary: "Write the approved GitHub Actions workflow into the local repository checkout.",
+    mutates: "local-file"
+  },
+  {
+    id: "set-callback-secrets",
+    scope: "github-secrets",
+    summary: "Create missing GitHub Actions callback secrets without exposing their values.",
+    mutates: "github"
+  },
+  {
+    id: "upsert-jira-profile",
+    scope: "jira-profile",
+    summary: "Create or update the Jira scenario automation profile through Forge contracts.",
+    mutates: "jira"
+  }
+];
+function sha256(value) {
+  return (0, import_node_crypto.createHash)("sha256").update(value, "utf8").digest("hex");
+}
+function sortJsonValue(value) {
+  if (Array.isArray(value)) {
+    return value.map(sortJsonValue);
+  }
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, nested]) => [key, sortJsonValue(nested)])
+    );
+  }
+  return value;
+}
+function stableJson(value) {
+  return JSON.stringify(sortJsonValue(value));
+}
+function computePlanId(planWithoutId) {
+  return `sha256:${sha256(stableJson(planWithoutId))}`;
+}
+function withoutPlanId(plan) {
+  const { planId: _planId, ...rest } = plan;
+  return rest;
+}
+function requireNonEmpty(value, field) {
+  const normalized = value.trim();
+  if (!normalized) {
+    throw new Error(`${field} is required.`);
+  }
+  return normalized;
+}
+function normalizeProjectKey(value) {
+  const normalized = requireNonEmpty(value, "project key").toUpperCase();
+  if (!/^[A-Z][A-Z0-9_]{1,31}$/.test(normalized)) {
+    throw new Error("project key must contain 2-32 uppercase letters, digits, or underscores and start with a letter.");
+  }
+  return normalized;
+}
+function normalizeRepoPart(value, field) {
+  const normalized = requireNonEmpty(value, field);
+  if (!/^[A-Za-z0-9_.-]+$/.test(normalized)) {
+    throw new Error(`${field} contains unsupported characters.`);
+  }
+  return normalized;
+}
+function normalizeWorkflowPath(value) {
+  const normalized = import_node_path14.default.posix.normalize(requireNonEmpty(value, "workflow path").replaceAll("\\", "/"));
+  if (import_node_path14.default.posix.isAbsolute(normalized) || normalized.startsWith("../") || !normalized.startsWith(".github/workflows/") || !/\.ya?ml$/i.test(normalized)) {
+    throw new Error("workflow path must be a relative .github/workflows/*.yml or *.yaml path without '..'.");
+  }
+  return normalized;
+}
+function normalizeSecretName(value, field) {
+  const normalized = requireNonEmpty(value, field).toUpperCase();
+  if (!/^[A-Z_][A-Z0-9_]*$/.test(normalized)) {
+    throw new Error(`${field} must be a valid GitHub Actions secret name.`);
+  }
+  return normalized;
+}
+function buildGitHubSetupPlan(input) {
+  const projectKey = normalizeProjectKey(input.projectKey);
+  const owner = normalizeRepoPart(input.owner, "GitHub owner");
+  const repository = normalizeRepoPart(input.repository, "GitHub repository");
+  const ref = requireNonEmpty(input.ref, "Git ref");
+  const workflowId = requireNonEmpty(input.workflowId, "workflow id");
+  const workflowPath = normalizeWorkflowPath(input.workflowPath);
+  const profileLabel = requireNonEmpty(input.profileLabel, "profile label");
+  const endpointSecretName = normalizeSecretName(
+    input.callbackEndpointSecretName,
+    "callback endpoint secret name"
+  );
+  const tokenSecretName = normalizeSecretName(
+    input.callbackAuthTokenSecretName,
+    "callback auth token secret name"
+  );
+  if (endpointSecretName === tokenSecretName) {
+    throw new Error("callback endpoint and auth token secret names must be different.");
+  }
+  const workflowContent = (0, import_node_fs13.readFileSync)(input.workflowSourcePath, "utf8");
+  if (!workflowContent.trim()) {
+    throw new Error("workflow source file is empty.");
+  }
+  if (!/\bworkflow_dispatch\s*:/m.test(workflowContent)) {
+    throw new Error("workflow source must declare workflow_dispatch so Forge can address it explicitly.");
+  }
+  for (const secretName of [endpointSecretName, tokenSecretName]) {
+    if (!workflowContent.includes(`secrets.${secretName}`)) {
+      throw new Error(`workflow source must reference GitHub Actions secret secrets.${secretName}.`);
+    }
+  }
+  const actions = input.setProjectDefault ? [
+    ...ACTIONS,
+    {
+      id: "set-project-default",
+      scope: "project-default",
+      summary: "Select the approved Jira automation profile as the project default through Forge contracts.",
+      mutates: "jira"
+    }
+  ] : [...ACTIONS];
+  const planWithoutId = {
+    schemaVersion: SETUP_PLAN_SCHEMA_VERSION,
+    kind: SETUP_PLAN_KIND,
+    provider: "github-actions",
+    project: { key: projectKey },
+    github: {
+      owner,
+      repository,
+      ref,
+      workflowId,
+      workflowFile: {
+        path: workflowPath,
+        sourcePath: import_node_path14.default.resolve(input.workflowSourcePath),
+        sha256: sha256(workflowContent)
+      },
+      requiredSecrets: [
+        {
+          repositorySecretName: endpointSecretName,
+          valueKey: "callbackEndpoint",
+          purpose: "Authenticated Forge callback endpoint used by the workflow."
+        },
+        {
+          repositorySecretName: tokenSecretName,
+          valueKey: "callbackAuthToken",
+          purpose: "Project-admin CLI key used by the workflow for Forge callbacks."
+        }
+      ],
+      guidance: {
+        authentication: "Prefer a GitHub App installation token or a fine-grained token with only the repository permissions required for workflow inspection, secrets administration, and workflow dispatch from Forge.",
+        permissions: [
+          "Actions: read (doctor) and write only when the Forge profile must dispatch workflow runs.",
+          "Secrets: read/write metadata only for the explicit github-secrets apply scope.",
+          "Contents: read for doctor; this command never creates commits or pull requests."
+        ],
+        remoteChangesExcluded: [
+          "accounts",
+          "credentials",
+          "commits",
+          "pull requests",
+          "workflow runs"
+        ]
+      }
+    },
+    jiraProfile: {
+      label: profileLabel,
+      enabled: input.enabled,
+      provider: "githubActions",
+      config: {
+        owner,
+        repo: repository,
+        workflowId,
+        ref
+      },
+      setProjectDefault: input.setProjectDefault
+    },
+    actions,
+    smokeValidation: [
+      {
+        id: "workflow-content",
+        verifies: "Local and remote workflow content/path without dispatching it.",
+        triggersExternalRun: false
+      },
+      {
+        id: "callback-secret-metadata",
+        verifies: "Required GitHub repository secret names exist; secret values remain unreadable.",
+        triggersExternalRun: false
+      },
+      {
+        id: "jira-profile",
+        verifies: "The Forge automation profile and optional project default match the plan.",
+        triggersExternalRun: false
+      }
+    ],
+    rollback: [
+      {
+        actionId: "write-workflow-file",
+        strategy: "Restore the previous file through version control or delete the newly created uncommitted file.",
+        automatic: false
+      },
+      {
+        actionId: "set-callback-secrets",
+        strategy: "Rotate or delete the named GitHub repository secrets manually; previous secret values cannot be read or restored.",
+        automatic: false
+      },
+      {
+        actionId: "upsert-jira-profile",
+        strategy: "Restore the pre-apply profile fields captured in the apply report, or delete a newly created unused profile through the existing Forge contract.",
+        automatic: false
+      },
+      ...input.setProjectDefault ? [
+        {
+          actionId: "set-project-default",
+          strategy: "Restore the pre-apply default profile id captured in the apply report.",
+          automatic: false
+        }
+      ] : []
+    ],
+    followUp: {
+      azureDevOps: "Add an Azure DevOps provider adapter over this schema/action boundary, mapping pipeline variables and the existing azureDevops Forge profile config without changing setup apply orchestration."
+    }
+  };
+  return {
+    ...planWithoutId,
+    planId: computePlanId(planWithoutId)
+  };
+}
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function hasExactKeys(value, keys) {
+  const actual = Object.keys(value).sort();
+  const expected = [...keys].sort();
+  return actual.length === expected.length && actual.every((key, index) => key === expected[index]);
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+function validateRequiredSecrets(value, errors) {
+  if (!Array.isArray(value) || value.length !== 2) {
+    errors.push("github.requiredSecrets must contain exactly the callback endpoint and callback auth token metadata.");
+    return false;
+  }
+  const keys = /* @__PURE__ */ new Set();
+  const repositoryNames = /* @__PURE__ */ new Set();
+  for (const [index, secret] of value.entries()) {
+    if (!isRecord(secret) || !hasExactKeys(secret, ["repositorySecretName", "valueKey", "purpose"])) {
+      errors.push(`github.requiredSecrets[${index}] has an invalid shape.`);
+      continue;
+    }
+    if (!isNonEmptyString(secret.repositorySecretName) || !/^[A-Z_][A-Z0-9_]*$/.test(secret.repositorySecretName)) {
+      errors.push(`github.requiredSecrets[${index}].repositorySecretName is invalid.`);
+    } else {
+      repositoryNames.add(secret.repositorySecretName);
+    }
+    if (secret.valueKey !== "callbackEndpoint" && secret.valueKey !== "callbackAuthToken") {
+      errors.push(`github.requiredSecrets[${index}].valueKey is invalid.`);
+    } else {
+      keys.add(secret.valueKey);
+    }
+    if (!isNonEmptyString(secret.purpose)) {
+      errors.push(`github.requiredSecrets[${index}].purpose is required.`);
+    }
+  }
+  if (!keys.has("callbackEndpoint") || !keys.has("callbackAuthToken")) {
+    errors.push("github.requiredSecrets must map both callbackEndpoint and callbackAuthToken.");
+  }
+  if (repositoryNames.size !== 2) {
+    errors.push("github.requiredSecrets must use two distinct repository secret names.");
+  }
+  return errors.length === 0;
+}
+function validateActions(value, setDefault, errors) {
+  const expected = setDefault ? [
+    { id: "write-workflow-file", scope: "workflow-file", mutates: "local-file" },
+    { id: "set-callback-secrets", scope: "github-secrets", mutates: "github" },
+    { id: "upsert-jira-profile", scope: "jira-profile", mutates: "jira" },
+    { id: "set-project-default", scope: "project-default", mutates: "jira" }
+  ] : [
+    { id: "write-workflow-file", scope: "workflow-file", mutates: "local-file" },
+    { id: "set-callback-secrets", scope: "github-secrets", mutates: "github" },
+    { id: "upsert-jira-profile", scope: "jira-profile", mutates: "jira" }
+  ];
+  if (!Array.isArray(value) || value.length !== expected.length) {
+    errors.push("actions do not match the required setup mutation scopes.");
+    return false;
+  }
+  value.forEach((action, index) => {
+    if (!isRecord(action) || !hasExactKeys(action, ["id", "scope", "summary", "mutates"])) {
+      errors.push(`actions[${index}] has an invalid shape.`);
+      return;
+    }
+    const expectedAction = expected[index];
+    if (action.id !== expectedAction.id || action.scope !== expectedAction.scope || action.mutates !== expectedAction.mutates) {
+      errors.push(`actions[${index}] must be ${expectedAction.id}/${expectedAction.scope}/${expectedAction.mutates}.`);
+    }
+    if (!isNonEmptyString(action.id) || !isNonEmptyString(action.summary)) {
+      errors.push(`actions[${index}] requires id and summary.`);
+    }
+    if (!["local-file", "github", "jira"].includes(action.mutates)) {
+      errors.push(`actions[${index}].mutates is invalid.`);
+    }
+  });
+  return errors.length === 0;
+}
+function validateGuidance(value, errors) {
+  if (!isRecord(value) || !hasExactKeys(value, ["authentication", "permissions", "remoteChangesExcluded"])) {
+    errors.push("github.guidance has an invalid shape.");
+    return;
+  }
+  if (!isNonEmptyString(value.authentication)) {
+    errors.push("github.guidance.authentication is required.");
+  }
+  if (!Array.isArray(value.permissions) || value.permissions.length === 0 || !value.permissions.every(isNonEmptyString)) {
+    errors.push("github.guidance.permissions must be a non-empty string array.");
+  }
+  const expectedExclusions = ["accounts", "credentials", "commits", "pull requests", "workflow runs"];
+  if (!Array.isArray(value.remoteChangesExcluded) || value.remoteChangesExcluded.length !== expectedExclusions.length || !value.remoteChangesExcluded.every((item, index) => item === expectedExclusions[index])) {
+    errors.push("github.guidance.remoteChangesExcluded must be a string array.");
+  }
+}
+function validateSmokeAndRollback(smoke, rollback, setDefault, errors) {
+  const expectedSmokeIds = ["workflow-content", "callback-secret-metadata", "jira-profile"];
+  if (!Array.isArray(smoke) || smoke.length !== expectedSmokeIds.length) {
+    errors.push("smokeValidation must contain the three provider checks.");
+  } else {
+    smoke.forEach((check, index) => {
+      if (!isRecord(check) || !hasExactKeys(check, ["id", "verifies", "triggersExternalRun"]) || check.id !== expectedSmokeIds[index] || !isNonEmptyString(check.verifies) || check.triggersExternalRun !== false) {
+        errors.push(`smokeValidation[${index}] has an invalid shape or could trigger an external run.`);
+      }
+    });
+  }
+  const expectedRollbackIds = setDefault ? ["write-workflow-file", "set-callback-secrets", "upsert-jira-profile", "set-project-default"] : ["write-workflow-file", "set-callback-secrets", "upsert-jira-profile"];
+  if (!Array.isArray(rollback) || rollback.length !== expectedRollbackIds.length) {
+    errors.push("rollback must cover every mutation action.");
+  } else {
+    rollback.forEach((step, index) => {
+      if (!isRecord(step) || !hasExactKeys(step, ["actionId", "strategy", "automatic"]) || step.actionId !== expectedRollbackIds[index] || !isNonEmptyString(step.strategy) || step.automatic !== false) {
+        errors.push(`rollback[${index}] has an invalid shape or action id.`);
+      }
+    });
+  }
+}
+function validateSetupPlan(value) {
+  const errors = [];
+  if (!isRecord(value)) {
+    return { ok: false, errors: ["Plan must be a JSON object."] };
+  }
+  if (!hasExactKeys(value, [
+    "schemaVersion",
+    "kind",
+    "planId",
+    "provider",
+    "project",
+    "github",
+    "jiraProfile",
+    "actions",
+    "smokeValidation",
+    "rollback",
+    "followUp"
+  ])) {
+    errors.push("Plan has missing or unsupported top-level fields.");
+  }
+  if (value.schemaVersion !== SETUP_PLAN_SCHEMA_VERSION) {
+    errors.push(`schemaVersion must be ${SETUP_PLAN_SCHEMA_VERSION}.`);
+  }
+  if (value.kind !== SETUP_PLAN_KIND) {
+    errors.push(`kind must be ${SETUP_PLAN_KIND}.`);
+  }
+  if (value.provider !== "github-actions") {
+    errors.push("provider must be github-actions for this plan version.");
+  }
+  if (!isNonEmptyString(value.planId) || !value.planId.startsWith("sha256:")) {
+    errors.push("planId must be a sha256 identifier.");
+  }
+  if (!isRecord(value.project) || !hasExactKeys(value.project, ["key"]) || !isNonEmptyString(value.project.key) || !/^[A-Z][A-Z0-9_]{1,31}$/.test(value.project.key)) {
+    errors.push("project.key is required.");
+  }
+  const github = value.github;
+  if (!isRecord(github) || !hasExactKeys(github, [
+    "owner",
+    "repository",
+    "ref",
+    "workflowId",
+    "workflowFile",
+    "requiredSecrets",
+    "guidance"
+  ])) {
+    errors.push("github has an invalid shape.");
+  } else {
+    for (const field of ["owner", "repository", "ref", "workflowId"]) {
+      if (!isNonEmptyString(github[field])) {
+        errors.push(`github.${field} is required.`);
+      }
+    }
+    if (isNonEmptyString(github.owner) && !/^[A-Za-z0-9_.-]+$/.test(github.owner)) {
+      errors.push("github.owner contains unsupported characters.");
+    }
+    if (isNonEmptyString(github.repository) && !/^[A-Za-z0-9_.-]+$/.test(github.repository)) {
+      errors.push("github.repository contains unsupported characters.");
+    }
+    if (!isRecord(github.workflowFile) || !hasExactKeys(github.workflowFile, ["path", "sourcePath", "sha256"])) {
+      errors.push("github.workflowFile has an invalid shape.");
+    } else {
+      if (!isNonEmptyString(github.workflowFile.path)) {
+        errors.push("github.workflowFile.path is required.");
+      } else {
+        try {
+          normalizeWorkflowPath(github.workflowFile.path);
+        } catch (error) {
+          errors.push(error instanceof Error ? error.message : "github.workflowFile.path is invalid.");
+        }
+      }
+      if (!isNonEmptyString(github.workflowFile.sourcePath)) {
+        errors.push("github.workflowFile.sourcePath is required.");
+      }
+      if (typeof github.workflowFile.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(github.workflowFile.sha256)) {
+        errors.push("github.workflowFile.sha256 must be a lowercase SHA-256 digest.");
+      }
+    }
+    validateRequiredSecrets(github.requiredSecrets, errors);
+    validateGuidance(github.guidance, errors);
+  }
+  const profile = value.jiraProfile;
+  let setDefault = false;
+  if (!isRecord(profile) || !hasExactKeys(profile, ["label", "enabled", "provider", "config", "setProjectDefault"])) {
+    errors.push("jiraProfile has an invalid shape.");
+  } else {
+    setDefault = profile.setProjectDefault === true;
+    if (!isNonEmptyString(profile.label)) {
+      errors.push("jiraProfile.label is required.");
+    }
+    if (typeof profile.enabled !== "boolean" || typeof profile.setProjectDefault !== "boolean") {
+      errors.push("jiraProfile enabled/default flags must be booleans.");
+    }
+    if (profile.provider !== "githubActions") {
+      errors.push("jiraProfile.provider must be githubActions.");
+    }
+    if (!isRecord(profile.config) || !hasExactKeys(profile.config, ["owner", "repo", "workflowId", "ref"])) {
+      errors.push("jiraProfile.config has an invalid shape.");
+    } else if (isRecord(github)) {
+      if (profile.config.owner !== github.owner || profile.config.repo !== github.repository || profile.config.workflowId !== github.workflowId || profile.config.ref !== github.ref) {
+        errors.push("jiraProfile.config must match the GitHub repository/ref/workflow fields.");
+      }
+    }
+  }
+  validateActions(value.actions, setDefault, errors);
+  validateSmokeAndRollback(value.smokeValidation, value.rollback, setDefault, errors);
+  if (!isRecord(value.followUp) || !hasExactKeys(value.followUp, ["azureDevOps"]) || !isNonEmptyString(value.followUp.azureDevOps)) {
+    errors.push("followUp.azureDevOps is required.");
+  }
+  if (errors.length === 0) {
+    const plan = value;
+    if (plan.planId !== computePlanId(withoutPlanId(plan))) {
+      errors.push("planId does not match the plan contents.");
+    }
+  }
+  return errors.length === 0 ? { ok: true, errors: [], plan: value } : { ok: false, errors };
+}
+function hashSetupContent(value) {
+  return sha256(value);
+}
+
+// src/githubSetupProvider.ts
+function isRecord2(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function safeGitHubMessage(body, fallback) {
+  if (isRecord2(body) && typeof body.message === "string") {
+    return body.message.slice(0, 500);
+  }
+  return fallback;
+}
+async function githubApi(fetchImpl, url, token) {
+  const response = await fetchImpl(url, {
+    method: "GET",
+    headers: {
+      accept: "application/vnd.github+json",
+      "x-github-api-version": "2022-11-28",
+      ...token ? { authorization: `Bearer ${token}` } : {}
+    }
+  });
+  const text = await response.text();
+  let body = {};
+  if (text) {
+    try {
+      body = JSON.parse(text);
+    } catch {
+      body = {};
+    }
+  }
+  return { ok: response.ok, status: response.status, body };
+}
+async function setGitHubRepositorySecretWithCli(input) {
+  await new Promise((resolve, reject) => {
+    const child = (0, import_node_child_process4.spawn)(
+      "gh",
+      ["secret", "set", input.name, "--repo", `${input.owner}/${input.repository}`],
+      {
+        shell: false,
+        stdio: ["pipe", "ignore", "pipe"],
+        env: {
+          ...process.env,
+          GH_TOKEN: input.adminToken
+        }
+      }
+    );
+    let stderr = "";
+    child.stderr.setEncoding("utf8");
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk;
+    });
+    child.on("error", (error) => {
+      reject(new Error(`Unable to start GitHub CLI: ${error.message}`));
+    });
+    child.on("close", (code) => {
+      if (code === 0) {
+        resolve();
+        return;
+      }
+      const suffix = stderr.trim() ? ` ${stderr.trim().slice(0, 500)}` : "";
+      reject(new Error(`GitHub CLI could not set repository secret ${input.name}.${suffix}`));
+    });
+    child.stdin.end(input.value, "utf8");
+  });
+}
+var GitHubSetupProvider = class {
+  name = "github-actions";
+  fetchImpl;
+  secretSetter;
+  constructor(deps = {}) {
+    this.fetchImpl = deps.fetchImpl ?? fetch;
+    this.secretSetter = deps.setRepositorySecret ?? setGitHubRepositorySecretWithCli;
+  }
+  async inspectExecutionDefinition(plan, token) {
+    const { owner, repository, workflowId, ref, workflowFile } = plan.github;
+    const workflowUrl = `https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}/actions/workflows/${encodeURIComponent(workflowId)}`;
+    const workflow = await githubApi(this.fetchImpl, workflowUrl, token);
+    if (!workflow.ok) {
+      if (workflow.status === 404) {
+        return {
+          found: false,
+          message: "Workflow is not registered on GitHub. Commit the local workflow to the repository default branch before expecting workflow_dispatch to be available."
+        };
+      }
+      return {
+        found: false,
+        message: `GitHub workflow metadata could not be verified (HTTP ${workflow.status}: ${safeGitHubMessage(workflow.body, "request failed")}).`
+      };
+    }
+    const workflowPath = isRecord2(workflow.body) && typeof workflow.body.path === "string" ? workflow.body.path.replace(/^\//, "") : void 0;
+    const state = isRecord2(workflow.body) && typeof workflow.body.state === "string" ? workflow.body.state : void 0;
+    const contentUrl = `https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}/contents/${workflowFile.path.split("/").map(encodeURIComponent).join("/")}?ref=${encodeURIComponent(ref)}`;
+    const content = await githubApi(this.fetchImpl, contentUrl, token);
+    let contentSha256;
+    if (content.ok && isRecord2(content.body) && typeof content.body.content === "string") {
+      try {
+        const decoded = Buffer.from(content.body.content.replace(/\s/g, ""), "base64").toString("utf8");
+        contentSha256 = hashSetupContent(decoded);
+      } catch {
+        contentSha256 = void 0;
+      }
+    }
+    return {
+      found: true,
+      active: state === "active",
+      path: workflowPath,
+      contentSha256,
+      message: state !== "active" ? `GitHub workflow is registered but its state is ${state ?? "unknown"}.` : workflowPath !== workflowFile.path ? `GitHub workflow path ${workflowPath ?? "<unknown>"} does not match ${workflowFile.path}.` : contentSha256 === workflowFile.sha256 ? "GitHub workflow is active and its content matches the approved plan." : "GitHub workflow metadata is reachable, but the approved ref content could not be confirmed as an exact plan match."
+    };
+  }
+  async inspectCallbackSecretMetadata(plan, adminToken) {
+    if (!adminToken) {
+      return {
+        verified: false,
+        names: /* @__PURE__ */ new Set(),
+        message: "Repository secret metadata was not verified because githubAdminToken was not provided. Secret values are never readable."
+      };
+    }
+    const { owner, repository } = plan.github;
+    const url = `https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}/actions/secrets?per_page=100`;
+    const response = await githubApi(this.fetchImpl, url, adminToken);
+    if (!response.ok) {
+      throw new Error(
+        `GitHub repository secret metadata request failed with HTTP ${response.status}: ${safeGitHubMessage(response.body, "request failed")}`
+      );
+    }
+    const names = /* @__PURE__ */ new Set();
+    if (isRecord2(response.body) && Array.isArray(response.body.secrets)) {
+      for (const item of response.body.secrets) {
+        if (isRecord2(item) && typeof item.name === "string") {
+          names.add(item.name);
+        }
+      }
+    }
+    return {
+      verified: true,
+      names,
+      message: `Verified ${names.size} GitHub repository secret name(s); values remain unreadable.`
+    };
+  }
+  async setCallbackSecret(plan, secret, value, adminToken) {
+    await this.secretSetter({
+      owner: plan.github.owner,
+      repository: plan.github.repository,
+      name: secret.repositorySecretName,
+      value,
+      adminToken
+    });
+  }
+};
+
+// src/setup.ts
+var APPLY_RESULT_SCHEMA_VERSION = "automatify.testops.setup.apply/v1";
+var DOCTOR_RESULT_SCHEMA_VERSION = "automatify.testops.setup.doctor/v1";
+var SECRET_KEYS = [
+  "githubProviderToken",
+  "githubAdminToken",
+  "callbackEndpoint",
+  "callbackAuthToken"
+];
+var MUTATION_SCOPES = [
+  "workflow-file",
+  "github-secrets",
+  "jira-profile",
+  "project-default"
+];
+var SetupCommandError = class extends Error {
+  cliCode;
+  exitCode;
+  constructor(cliCode, message, exitCode) {
+    super(message);
+    this.name = "SetupCommandError";
+    this.cliCode = cliCode;
+    this.exitCode = exitCode;
+  }
+};
+var PLAN_VALUE_FLAGS = /* @__PURE__ */ new Set([
+  "--provider",
+  "--project-key",
+  "--owner",
+  "--repo",
+  "--ref",
+  "--workflow-id",
+  "--workflow-path",
+  "--workflow-source",
+  "--profile-label",
+  "--callback-endpoint-secret-name",
+  "--callback-auth-token-secret-name"
+]);
+var APPLY_VALUE_FLAGS = /* @__PURE__ */ new Set(["--plan", "--repo-root"]);
+var APPLY_BOOL_FLAGS = /* @__PURE__ */ new Set([
+  "--confirm",
+  "--dry-run",
+  "--secrets-stdin",
+  "--rotate-secrets",
+  "--rotate-provider-token"
+]);
+function defaultReadStdin() {
+  return new Promise((resolve, reject) => {
+    let value = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (chunk) => {
+      value += chunk;
+    });
+    process.stdin.on("end", () => resolve(value));
+    process.stdin.on("error", reject);
+  });
+}
+function parseArgs10(args, valueFlags, boolFlags, allowApplyCollections = false) {
+  const flags = {};
+  const enabled = /* @__PURE__ */ new Set();
+  const approvals = [];
+  const secretRefs = [];
+  const errors = [];
+  for (let index = 0; index < args.length; index += 1) {
+    const token = args[index];
+    if (!token.startsWith("--")) {
+      errors.push(`Unexpected positional argument at index ${index}.`);
+      continue;
+    }
+    if (boolFlags.has(token)) {
+      enabled.add(token);
+      continue;
+    }
+    if (allowApplyCollections && (token === "--approve" || token === "--secret-ref")) {
+      const value2 = args[index + 1];
+      if (!value2 || value2.startsWith("--")) {
+        errors.push(`${token} requires a value.`);
+        continue;
+      }
+      (token === "--approve" ? approvals : secretRefs).push(value2);
+      index += 1;
+      continue;
+    }
+    if (!valueFlags.has(token)) {
+      errors.push(`Unknown option ${token}.`);
+      continue;
+    }
+    const value = args[index + 1];
+    if (!value || value.startsWith("--")) {
+      errors.push(`${token} requires a value.`);
+      continue;
+    }
+    flags[token] = value;
+    index += 1;
+  }
+  return { flags, boolFlags: enabled, approvals, secretRefs, errors };
+}
+function jsonResponse(payload, exitCode = ExitCode.Success) {
+  return {
+    exitCode,
+    stdout: [JSON.stringify(payload)]
+  };
+}
+function errorPayload(code, message, diagnostics = []) {
+  return {
+    schemaVersion: APPLY_RESULT_SCHEMA_VERSION,
+    status: "failed",
+    error: {
+      code,
+      message,
+      diagnostics
+    }
+  };
+}
+function safeErrorMessage(error, secrets = { values: {}, sources: {} }) {
+  let message = error instanceof Error ? error.message : "Unknown setup error.";
+  for (const secret of Object.values(secrets.values)) {
+    if (secret) {
+      message = message.split(secret).join("[REDACTED]");
+    }
+  }
+  return message.replace(/Bearer\s+[A-Za-z0-9._~+\/-]+/gi, "Bearer [REDACTED]").replace(/token[=:]\s*[^\s,;]+/gi, "token=[REDACTED]");
+}
+function exitCodeForError(error) {
+  if (error instanceof SetupCommandError) {
+    return error.exitCode;
+  }
+  if (error instanceof ForgeClientError) {
+    return error.code === "NETWORK_ERROR" || error.code === "TIMEOUT_ERROR" ? ExitCode.TransportError : ExitCode.RemoteError;
+  }
+  return ExitCode.RemoteError;
+}
+function errorCodeForError(error, fallback) {
+  return error instanceof SetupCommandError ? error.cliCode : fallback;
+}
+function loadPlan(planPath, cwd) {
+  const absolute = import_node_path15.default.resolve(cwd, planPath);
+  let parsed;
+  try {
+    parsed = JSON.parse((0, import_node_fs14.readFileSync)(absolute, "utf8"));
+  } catch (error) {
+    throw new SetupCommandError(
+      "PLAN_READ_ERROR",
+      `Could not read setup plan JSON: ${error instanceof Error ? error.message : "unknown error"}`,
+      ExitCode.ValidationError
+    );
+  }
+  const validation = validateSetupPlan(parsed);
+  if (!validation.ok || !validation.plan) {
+    throw new SetupCommandError(
+      "PLAN_VALIDATION_ERROR",
+      `Setup plan validation failed: ${validation.errors.join(" ")}`,
+      ExitCode.ValidationError
+    );
+  }
+  return validation.plan;
+}
+function isSecretKey(value) {
+  return SECRET_KEYS.includes(value);
+}
+async function resolveSecrets(parsed, deps) {
+  const values = {};
+  const sources = {};
+  if (parsed.boolFlags.has("--secrets-stdin")) {
+    const raw = await deps.readStdin();
+    let envelope;
+    try {
+      envelope = JSON.parse(raw);
+    } catch {
+      throw new SetupCommandError(
+        "SECRET_INPUT_ERROR",
+        "Secret stdin must be a JSON object. Input content was not retained or printed.",
+        ExitCode.ValidationError
+      );
+    }
+    if (!envelope || typeof envelope !== "object" || Array.isArray(envelope)) {
+      throw new SetupCommandError("SECRET_INPUT_ERROR", "Secret stdin must be a JSON object.", ExitCode.ValidationError);
+    }
+    for (const [key, value] of Object.entries(envelope)) {
+      if (!isSecretKey(key)) {
+        throw new SetupCommandError("SECRET_INPUT_ERROR", `Secret stdin contains unsupported key ${key}.`, ExitCode.ValidationError);
+      }
+      if (typeof value !== "string" || !value.trim()) {
+        throw new SetupCommandError("SECRET_INPUT_ERROR", `Secret stdin key ${key} must be a non-empty string.`, ExitCode.ValidationError);
+      }
+      values[key] = value.trim();
+      sources[key] = "stdin";
+    }
+  }
+  for (const reference of parsed.secretRefs) {
+    const separator = reference.indexOf("=");
+    const key = separator > 0 ? reference.slice(0, separator) : "";
+    const target = separator > 0 ? reference.slice(separator + 1) : "";
+    if (!isSecretKey(key) || !target.startsWith("env:")) {
+      throw new SetupCommandError(
+        "SECRET_REFERENCE_ERROR",
+        "Secret references must use <supported-key>=env:<VARIABLE_NAME>.",
+        ExitCode.ValidationError
+      );
+    }
+    const envName = target.slice(4);
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(envName)) {
+      throw new SetupCommandError("SECRET_REFERENCE_ERROR", `Secret reference for ${key} has an invalid environment variable name.`, ExitCode.ValidationError);
+    }
+    if (sources[key]) {
+      throw new SetupCommandError("SECRET_REFERENCE_ERROR", `Secret ${key} was provided more than once.`, ExitCode.ValidationError);
+    }
+    const value = deps.env[envName]?.trim();
+    if (!value) {
+      throw new SetupCommandError(
+        "SECRET_REFERENCE_ERROR",
+        `Secret reference for ${key} points to an empty or missing environment variable.`,
+        ExitCode.ValidationError
+      );
+    }
+    values[key] = value;
+    sources[key] = "env-ref";
+  }
+  return { values, sources };
+}
+function approvedScopes(plan, parsed, dryRun) {
+  const planScopes = plan.actions.map((action) => action.scope);
+  const requested = parsed.approvals.length === 0 && dryRun ? ["all"] : parsed.approvals;
+  if (requested.length === 0) {
+    throw new SetupCommandError(
+      "APPROVAL_REQUIRED",
+      "At least one --approve <scope> is required for apply. Use --approve all to approve every planned action.",
+      ExitCode.UsageError
+    );
+  }
+  const expanded = /* @__PURE__ */ new Set();
+  for (const scope of requested) {
+    if (scope === "all") {
+      planScopes.forEach((item) => expanded.add(item));
+      continue;
+    }
+    if (!MUTATION_SCOPES.includes(scope)) {
+      throw new SetupCommandError("APPROVAL_ERROR", `Unsupported approval scope ${scope}.`, ExitCode.UsageError);
+    }
+    if (!planScopes.includes(scope)) {
+      throw new SetupCommandError("APPROVAL_ERROR", `Approval scope ${scope} is not present in this plan.`, ExitCode.UsageError);
+    }
+    expanded.add(scope);
+  }
+  return planScopes.filter((scope) => expanded.has(scope));
+}
+function requireServiceData(result, contract) {
+  if (!result.ok) {
+    throw new Error(`${contract} failed: ${result.error.code}: ${result.error.message}`);
+  }
+  return result.data;
+}
+function findMatchingProfile(profiles, plan) {
+  const matches = profiles.filter((profile) => profile.label === plan.jiraProfile.label);
+  if (matches.length > 1) {
+    throw new SetupCommandError(
+      "AMBIGUOUS_PROFILE",
+      `More than one Jira automation profile has label ${plan.jiraProfile.label}; rename duplicates before applying this deterministic plan.`,
+      ExitCode.ValidationError
+    );
+  }
+  return matches[0];
+}
+function profileMatches(profile, plan) {
+  const config = profile.config;
+  return profile.provider === "githubActions" && profile.label === plan.jiraProfile.label && profile.enabled === plan.jiraProfile.enabled && config.owner === plan.jiraProfile.config.owner && config.repo === plan.jiraProfile.config.repo && config.workflowId === plan.jiraProfile.config.workflowId && config.ref === plan.jiraProfile.config.ref;
+}
+function previousProfileState(profile) {
+  if (!profile) {
+    return { existed: false };
+  }
+  return {
+    existed: true,
+    id: profile.id,
+    label: profile.label,
+    provider: profile.provider,
+    enabled: profile.enabled,
+    wasProjectDefault: Boolean(profile.isProjectDefault),
+    hadSecret: profile.hasSecret
+  };
+}
+async function prepareState(plan, scopes, secrets, context, deps, dryRun, rotateSecrets, rotateProviderToken) {
+  let profiles = [];
+  let matchingProfile;
+  let currentDefaultProfileId;
+  if (scopes.includes("jira-profile") || scopes.includes("project-default")) {
+    profiles = requireServiceData(
+      await context.invokeForgeContract("listScenarioAutomationProfiles", {
+        context: { projectKey: plan.project.key }
+      }),
+      "listScenarioAutomationProfiles"
+    );
+    matchingProfile = findMatchingProfile(profiles, plan);
+    currentDefaultProfileId = profiles.find((profile) => profile.isProjectDefault)?.id;
+    const needsProviderToken = scopes.includes("jira-profile") && (!matchingProfile?.hasSecret || rotateProviderToken);
+    if (needsProviderToken && !dryRun && !secrets.values.githubProviderToken) {
+      throw new SetupCommandError(
+        "SECRET_INPUT_REQUIRED",
+        "githubProviderToken is required to create this Jira profile, restore a missing provider secret, or rotate the provider token.",
+        ExitCode.ValidationError
+      );
+    }
+  }
+  let repositorySecretNames;
+  if (scopes.includes("github-secrets")) {
+    if (!dryRun && !secrets.values.githubAdminToken) {
+      throw new SetupCommandError(
+        "SECRET_INPUT_REQUIRED",
+        "githubAdminToken is required for the approved github-secrets scope.",
+        ExitCode.ValidationError
+      );
+    }
+    if (secrets.values.githubAdminToken) {
+      const inspection = await deps.githubProvider.inspectCallbackSecretMetadata(
+        plan,
+        secrets.values.githubAdminToken
+      );
+      repositorySecretNames = inspection.names;
+      const secretsToWrite = plan.github.requiredSecrets.filter(
+        (secret) => rotateSecrets || !repositorySecretNames?.has(secret.repositorySecretName)
+      );
+      if (!dryRun) {
+        for (const secret of secretsToWrite) {
+          if (!secrets.values[secret.valueKey]) {
+            throw new SetupCommandError(
+              "SECRET_INPUT_REQUIRED",
+              `${secret.valueKey} is required to create or rotate ${secret.repositorySecretName}.`,
+              ExitCode.ValidationError
+            );
+          }
+        }
+      }
+    }
+  }
+  return { profiles, matchingProfile, currentDefaultProfileId, repositorySecretNames };
+}
+function rollbackFor(plan, actionId) {
+  return plan.rollback.find((item) => item.actionId === actionId)?.strategy ?? "Review the plan rollback section.";
+}
+function resolveWorkflowTarget(plan, repoRoot) {
+  const resolvedRoot = import_node_path15.default.resolve(repoRoot);
+  const target = import_node_path15.default.resolve(resolvedRoot, plan.github.workflowFile.path);
+  if (target !== resolvedRoot && !target.startsWith(`${resolvedRoot}${import_node_path15.default.sep}`)) {
+    throw new SetupCommandError(
+      "WORKFLOW_PATH_ERROR",
+      "Workflow target escapes the approved repository root.",
+      ExitCode.ValidationError
+    );
+  }
+  return target;
+}
+function applyWorkflowFile(plan, repoRoot, dryRun) {
+  const action = plan.actions.find((item) => item.scope === "workflow-file");
+  const target = resolveWorkflowTarget(plan, repoRoot);
+  const sourceContent = (0, import_node_fs14.readFileSync)(plan.github.workflowFile.sourcePath, "utf8");
+  if (hashSetupContent(sourceContent) !== plan.github.workflowFile.sha256) {
+    throw new SetupCommandError(
+      "WORKFLOW_SOURCE_CHANGED",
+      "Workflow source content no longer matches the approved plan hash; generate a new plan before applying.",
+      ExitCode.ValidationError
+    );
+  }
+  const existed = (0, import_node_fs14.existsSync)(target);
+  const previousContent = existed ? (0, import_node_fs14.readFileSync)(target, "utf8") : void 0;
+  const matches = previousContent !== void 0 && hashSetupContent(previousContent) === plan.github.workflowFile.sha256;
+  if (matches) {
+    return {
+      id: action.id,
+      scope: action.scope,
+      status: "skipped",
+      message: "Local workflow file already matches the approved content hash.",
+      rollback: { available: false, guidance: "No workflow file mutation occurred." }
+    };
+  }
+  if (!dryRun) {
+    (0, import_node_fs14.mkdirSync)(import_node_path15.default.dirname(target), { recursive: true });
+    (0, import_node_fs14.writeFileSync)(target, sourceContent, { encoding: "utf8", mode: 420 });
+  }
+  return {
+    id: action.id,
+    scope: action.scope,
+    status: dryRun ? "planned" : existed ? "updated" : "created",
+    message: dryRun ? `${existed ? "Update" : "Create"} ${plan.github.workflowFile.path} with sha256 ${plan.github.workflowFile.sha256}.` : `${existed ? "Updated" : "Created"} ${plan.github.workflowFile.path}.`,
+    rollback: {
+      available: !dryRun,
+      guidance: rollbackFor(plan, action.id),
+      previousState: {
+        existed,
+        sha256: previousContent === void 0 ? null : hashSetupContent(previousContent)
+      }
+    }
+  };
+}
+async function applyGitHubSecrets(plan, state, secrets, deps, dryRun, rotateSecrets) {
+  const action = plan.actions.find((item) => item.scope === "github-secrets");
+  const names = state.repositorySecretNames;
+  const pending = plan.github.requiredSecrets.filter(
+    (secret) => rotateSecrets || !names?.has(secret.repositorySecretName)
+  );
+  if (names && pending.length === 0) {
+    return {
+      id: action.id,
+      scope: action.scope,
+      status: "skipped",
+      message: "All required GitHub repository secret names already exist; values remain unreadable and were not overwritten.",
+      rollback: { available: false, guidance: "No GitHub secret mutation occurred." }
+    };
+  }
+  if (dryRun) {
+    return {
+      id: action.id,
+      scope: action.scope,
+      status: "planned",
+      message: names ? `Set ${pending.map((secret) => secret.repositorySecretName).join(", ")}; values will be read only from approved secret input.` : "Inspect required GitHub secret metadata, then create missing names from approved secret input.",
+      rollback: { available: false, guidance: rollbackFor(plan, action.id) }
+    };
+  }
+  const adminToken = secrets.values.githubAdminToken;
+  for (const secret of pending) {
+    await deps.githubProvider.setCallbackSecret(
+      plan,
+      secret,
+      secrets.values[secret.valueKey],
+      adminToken
+    );
+  }
+  return {
+    id: action.id,
+    scope: action.scope,
+    status: "updated",
+    message: `Set ${pending.length} GitHub repository secret(s). Values were not printed or placed in process arguments.`,
+    rollback: { available: false, guidance: rollbackFor(plan, action.id) }
+  };
+}
+async function applyJiraProfile(plan, state, secrets, context, dryRun, rotateProviderToken) {
+  const action = plan.actions.find((item) => item.scope === "jira-profile");
+  const current = state.matchingProfile;
+  const matches = current ? profileMatches(current, plan) : false;
+  if (current && matches && current.hasSecret && !rotateProviderToken) {
+    return {
+      profile: current,
+      result: {
+        id: action.id,
+        scope: action.scope,
+        status: "skipped",
+        message: "Jira automation profile already matches the plan and has a stored provider secret.",
+        rollback: { available: false, guidance: "No Jira profile mutation occurred." }
+      }
+    };
+  }
+  if (dryRun) {
+    const plannedProfile = current ?? {
+      id: "<created-by-forge>",
+      projectKey: plan.project.key,
+      label: plan.jiraProfile.label,
+      provider: "githubActions",
+      authType: "bearer",
+      method: "POST",
+      endpointSummary: "<computed-by-forge>",
+      config: plan.jiraProfile.config,
+      enabled: plan.jiraProfile.enabled,
+      hasSecret: Boolean(secrets.values.githubProviderToken),
+      createdAt: "",
+      updatedAt: ""
+    };
+    return {
+      profile: plannedProfile,
+      result: {
+        id: action.id,
+        scope: action.scope,
+        status: "planned",
+        message: `${current ? "Update" : "Create"} the Jira automation profile through upsertScenarioAutomationProfile.`,
+        rollback: {
+          available: false,
+          guidance: rollbackFor(plan, action.id),
+          previousState: previousProfileState(current)
+        }
+      }
+    };
+  }
+  const secretToken = !current?.hasSecret || rotateProviderToken ? secrets.values.githubProviderToken : void 0;
+  const profile = requireServiceData(
+    await context.invokeForgeContract("upsertScenarioAutomationProfile", {
+      context: { projectKey: plan.project.key },
+      input: {
+        profileId: current?.id,
+        label: plan.jiraProfile.label,
+        provider: "githubActions",
+        config: plan.jiraProfile.config,
+        enabled: plan.jiraProfile.enabled,
+        secretToken
+      }
+    }),
+    "upsertScenarioAutomationProfile"
+  );
+  return {
+    profile,
+    result: {
+      id: action.id,
+      scope: action.scope,
+      status: current ? "updated" : "created",
+      message: `${current ? "Updated" : "Created"} Jira automation profile ${plan.jiraProfile.label} through the existing Forge contract.`,
+      rollback: {
+        available: true,
+        guidance: rollbackFor(plan, action.id),
+        previousState: previousProfileState(current)
+      }
+    }
+  };
+}
+async function applyProjectDefault(plan, state, profile, context, dryRun) {
+  const action = plan.actions.find((item) => item.scope === "project-default");
+  if (state.currentDefaultProfileId === profile.id) {
+    return {
+      id: action.id,
+      scope: action.scope,
+      status: "skipped",
+      message: "Jira automation profile is already the project default.",
+      rollback: { available: false, guidance: "No project-default mutation occurred." }
+    };
+  }
+  if (!dryRun) {
+    requireServiceData(
+      await context.invokeForgeContract("setScenarioAutomationDefaultProfile", {
+        context: { projectKey: plan.project.key },
+        profileId: profile.id
+      }),
+      "setScenarioAutomationDefaultProfile"
+    );
+  }
+  return {
+    id: action.id,
+    scope: action.scope,
+    status: dryRun ? "planned" : "updated",
+    message: dryRun ? "Set the planned Jira automation profile as project default through setScenarioAutomationDefaultProfile." : "Set the Jira automation profile as project default through the existing Forge contract.",
+    rollback: {
+      available: !dryRun,
+      guidance: rollbackFor(plan, action.id),
+      previousState: { profileId: state.currentDefaultProfileId ?? null }
+    }
+  };
+}
+function doctorStatus(checks) {
+  if (checks.some((check) => check.status === "fail")) return "fail";
+  if (checks.some((check) => check.status === "warn")) return "warn";
+  return "pass";
+}
+async function inspectPlan(plan, repoRoot, secrets, context, deps) {
+  const checks = [];
+  let forgeTransportFailure = false;
+  const target = resolveWorkflowTarget(plan, repoRoot);
+  if (!(0, import_node_fs14.existsSync)(target)) {
+    checks.push({
+      id: "workflow-local",
+      status: "fail",
+      message: `Local workflow file ${plan.github.workflowFile.path} does not exist.`
+    });
+  } else {
+    const localHash = hashSetupContent((0, import_node_fs14.readFileSync)(target, "utf8"));
+    checks.push({
+      id: "workflow-local",
+      status: localHash === plan.github.workflowFile.sha256 ? "pass" : "fail",
+      message: localHash === plan.github.workflowFile.sha256 ? "Local workflow content matches the approved plan hash." : "Local workflow content differs from the approved plan hash."
+    });
+  }
+  try {
+    const workflow = await deps.githubProvider.inspectExecutionDefinition(
+      plan,
+      secrets.values.githubProviderToken ?? secrets.values.githubAdminToken
+    );
+    const exact = workflow.found && workflow.active && workflow.path === plan.github.workflowFile.path && workflow.contentSha256 === plan.github.workflowFile.sha256;
+    checks.push({
+      id: "workflow-github",
+      status: exact ? "pass" : workflow.found && (workflow.path !== plan.github.workflowFile.path || workflow.active === false) ? "fail" : "warn",
+      message: workflow.message
+    });
+  } catch (error) {
+    checks.push({
+      id: "workflow-github",
+      status: "warn",
+      message: `GitHub workflow could not be verified: ${safeErrorMessage(error, secrets)}`
+    });
+  }
+  try {
+    const secretInspection = await deps.githubProvider.inspectCallbackSecretMetadata(
+      plan,
+      secrets.values.githubAdminToken
+    );
+    if (!secretInspection.verified) {
+      checks.push({ id: "callback-secret-metadata", status: "warn", message: secretInspection.message });
+    } else {
+      const missing = plan.github.requiredSecrets.filter(
+        (secret) => !secretInspection.names.has(secret.repositorySecretName)
+      );
+      checks.push({
+        id: "callback-secret-metadata",
+        status: missing.length === 0 ? "pass" : "fail",
+        message: missing.length === 0 ? "All required GitHub repository secret names exist; values remain unreadable and were not printed." : `Missing GitHub repository secret name(s): ${missing.map((item) => item.repositorySecretName).join(", ")}.`
+      });
+    }
+  } catch (error) {
+    checks.push({
+      id: "callback-secret-metadata",
+      status: "warn",
+      message: `GitHub repository secret metadata could not be verified: ${safeErrorMessage(error, secrets)}`
+    });
+  }
+  try {
+    const profiles = requireServiceData(
+      await context.invokeForgeContract("listScenarioAutomationProfiles", {
+        context: { projectKey: plan.project.key }
+      }),
+      "listScenarioAutomationProfiles"
+    );
+    const profile = findMatchingProfile(profiles, plan);
+    const profileOk = Boolean(profile && profileMatches(profile, plan) && profile.hasSecret);
+    checks.push({
+      id: "jira-profile",
+      status: profileOk ? "pass" : "fail",
+      message: profileOk ? "Jira automation profile fields match the plan and Forge reports a stored provider secret." : "Jira automation profile is missing, differs from the plan, or lacks a provider secret."
+    });
+    if (plan.jiraProfile.setProjectDefault) {
+      checks.push({
+        id: "jira-project-default",
+        status: profile?.isProjectDefault ? "pass" : "fail",
+        message: profile?.isProjectDefault ? "Jira automation profile is the project default." : "Jira automation profile is not the project default."
+      });
+    }
+  } catch (error) {
+    forgeTransportFailure = error instanceof ForgeClientError && (error.code === "NETWORK_ERROR" || error.code === "TIMEOUT_ERROR");
+    checks.push({
+      id: "jira-profile",
+      status: "fail",
+      message: `Jira automation profile could not be verified: ${safeErrorMessage(error, secrets)}`
+    });
+  }
+  const status = doctorStatus(checks);
+  return {
+    schemaVersion: DOCTOR_RESULT_SCHEMA_VERSION,
+    planId: plan.planId,
+    provider: "github-actions",
+    status,
+    exitCode: forgeTransportFailure ? ExitCode.TransportError : status === "fail" ? ExitCode.ValidationError : ExitCode.Success,
+    externalRunTriggered: false,
+    checks
+  };
+}
+function planCommand(args, deps) {
+  const parsed = parseArgs10(args, PLAN_VALUE_FLAGS, /* @__PURE__ */ new Set(["--set-default", "--disabled"]));
+  if (parsed.errors.length > 0) {
+    return jsonResponse(errorPayload("USAGE_ERROR", "Invalid setup plan arguments.", parsed.errors), ExitCode.UsageError);
+  }
+  if ((parsed.flags["--provider"] ?? "github-actions") !== "github-actions") {
+    return jsonResponse(
+      errorPayload("VALIDATION_ERROR", "Only github-actions is implemented in this stage; Azure DevOps is the documented next adapter."),
+      ExitCode.ValidationError
+    );
+  }
+  try {
+    const plan = buildGitHubSetupPlan({
+      projectKey: parsed.flags["--project-key"] ?? "",
+      owner: parsed.flags["--owner"] ?? "",
+      repository: parsed.flags["--repo"] ?? "",
+      ref: parsed.flags["--ref"] ?? "main",
+      workflowId: parsed.flags["--workflow-id"] ?? "scenario-dispatch.yml",
+      workflowPath: parsed.flags["--workflow-path"] ?? ".github/workflows/scenario-dispatch.yml",
+      workflowSourcePath: import_node_path15.default.resolve(deps.cwd, parsed.flags["--workflow-source"] ?? ""),
+      profileLabel: parsed.flags["--profile-label"] ?? "GitHub Actions",
+      enabled: !parsed.boolFlags.has("--disabled"),
+      setProjectDefault: parsed.boolFlags.has("--set-default"),
+      callbackEndpointSecretName: parsed.flags["--callback-endpoint-secret-name"] ?? "TESTOPS_FORGE_ENDPOINT",
+      callbackAuthTokenSecretName: parsed.flags["--callback-auth-token-secret-name"] ?? "TESTOPS_FORGE_AUTH_TOKEN"
+    });
+    return jsonResponse(plan);
+  } catch (error) {
+    return jsonResponse(
+      errorPayload("VALIDATION_ERROR", safeErrorMessage(error)),
+      ExitCode.ValidationError
+    );
+  }
+}
+async function applyCommand(args, context, deps) {
+  const parsed = parseArgs10(args, APPLY_VALUE_FLAGS, APPLY_BOOL_FLAGS, true);
+  if (parsed.errors.length > 0) {
+    return jsonResponse(errorPayload("USAGE_ERROR", "Invalid setup apply arguments.", parsed.errors), ExitCode.UsageError);
+  }
+  const planPath = parsed.flags["--plan"];
+  if (!planPath) {
+    return jsonResponse(errorPayload("USAGE_ERROR", "--plan <file> is required."), ExitCode.UsageError);
+  }
+  const dryRun = parsed.boolFlags.has("--dry-run");
+  if (!dryRun && !parsed.boolFlags.has("--confirm")) {
+    return jsonResponse(
+      errorPayload("CONFIRMATION_REQUIRED", "Mutating apply requires --confirm plus explicit --approve scopes."),
+      ExitCode.UsageError
+    );
+  }
+  let secrets = { values: {}, sources: {} };
+  const actionResults = [];
+  try {
+    const plan = loadPlan(planPath, deps.cwd);
+    const scopes = approvedScopes(plan, parsed, dryRun);
+    secrets = await resolveSecrets(parsed, deps);
+    const repoRoot = import_node_path15.default.resolve(deps.cwd, parsed.flags["--repo-root"] ?? ".");
+    const rotateSecrets = parsed.boolFlags.has("--rotate-secrets");
+    const rotateProviderToken = parsed.boolFlags.has("--rotate-provider-token");
+    const state = await prepareState(
+      plan,
+      scopes,
+      secrets,
+      context,
+      deps,
+      dryRun,
+      rotateSecrets,
+      rotateProviderToken
+    );
+    let appliedProfile = state.matchingProfile;
+    for (const action of plan.actions) {
+      if (!scopes.includes(action.scope)) {
+        actionResults.push({
+          id: action.id,
+          scope: action.scope,
+          status: "skipped",
+          message: "Action was not in the explicit approval scope.",
+          rollback: { available: false, guidance: "No mutation occurred." }
+        });
+        continue;
+      }
+      try {
+        if (action.scope === "workflow-file") {
+          actionResults.push(applyWorkflowFile(plan, repoRoot, dryRun));
+        } else if (action.scope === "github-secrets") {
+          actionResults.push(await applyGitHubSecrets(plan, state, secrets, deps, dryRun, rotateSecrets));
+        } else if (action.scope === "jira-profile") {
+          const applied = await applyJiraProfile(
+            plan,
+            state,
+            secrets,
+            context,
+            dryRun,
+            rotateProviderToken
+          );
+          appliedProfile = applied.profile;
+          actionResults.push(applied.result);
+        } else if (action.scope === "project-default") {
+          if (!appliedProfile) {
+            throw new SetupCommandError(
+              "PROFILE_REQUIRED",
+              "Project-default apply requires an existing or approved Jira automation profile.",
+              ExitCode.ValidationError
+            );
+          }
+          actionResults.push(await applyProjectDefault(plan, state, appliedProfile, context, dryRun));
+        }
+      } catch (error) {
+        actionResults.push({
+          id: action.id,
+          scope: action.scope,
+          status: "failed",
+          message: safeErrorMessage(error, secrets),
+          rollback: {
+            available: false,
+            guidance: rollbackFor(plan, action.id)
+          }
+        });
+        throw error;
+      }
+    }
+    const doctor = dryRun ? void 0 : await inspectPlan(plan, repoRoot, secrets, context, deps);
+    return jsonResponse(
+      {
+        schemaVersion: APPLY_RESULT_SCHEMA_VERSION,
+        planId: plan.planId,
+        provider: plan.provider,
+        status: dryRun ? "dry-run" : doctor?.status === "fail" ? "applied-with-validation-failures" : doctor?.status === "warn" ? "applied-with-warnings" : "applied",
+        dryRun,
+        confirmed: !dryRun,
+        approvedScopes: scopes,
+        secretInputs: Object.entries(secrets.sources).map(([key, source]) => ({ key, source })),
+        actions: actionResults,
+        smokeValidation: doctor ?? {
+          status: "not-run",
+          externalRunTriggered: false,
+          message: "Dry-run performs no mutations and does not require remote smoke validation. Run setup doctor for read-only verification."
+        }
+      },
+      doctor?.exitCode ?? ExitCode.Success
+    );
+  } catch (error) {
+    const message = safeErrorMessage(error, secrets);
+    return jsonResponse(
+      {
+        ...errorPayload(errorCodeForError(error, "APPLY_FAILED"), message, [
+          "Review each completed action and its rollback guidance; GitHub secret values cannot be restored automatically."
+        ]),
+        actions: actionResults
+      },
+      exitCodeForError(error)
+    );
+  }
+}
+async function doctorCommand(args, context, deps) {
+  const parsed = parseArgs10(
+    args,
+    APPLY_VALUE_FLAGS,
+    /* @__PURE__ */ new Set(["--secrets-stdin"]),
+    true
+  );
+  if (parsed.approvals.length > 0) {
+    return jsonResponse(errorPayload("USAGE_ERROR", "setup doctor does not accept --approve."), ExitCode.UsageError);
+  }
+  if (parsed.errors.length > 0) {
+    return jsonResponse(errorPayload("USAGE_ERROR", "Invalid setup doctor arguments.", parsed.errors), ExitCode.UsageError);
+  }
+  const planPath = parsed.flags["--plan"];
+  if (!planPath) {
+    return jsonResponse(errorPayload("USAGE_ERROR", "--plan <file> is required."), ExitCode.UsageError);
+  }
+  let secrets = { values: {}, sources: {} };
+  try {
+    const plan = loadPlan(planPath, deps.cwd);
+    secrets = await resolveSecrets(parsed, deps);
+    const repoRoot = import_node_path15.default.resolve(deps.cwd, parsed.flags["--repo-root"] ?? ".");
+    const summary = await inspectPlan(plan, repoRoot, secrets, context, deps);
+    return jsonResponse(summary, summary.exitCode);
+  } catch (error) {
+    return jsonResponse(
+      errorPayload(errorCodeForError(error, "DOCTOR_FAILED"), safeErrorMessage(error, secrets)),
+      exitCodeForError(error)
+    );
+  }
+}
+function createSetupHandler(overrides = {}) {
+  const deps = {
+    cwd: overrides.cwd ?? process.cwd(),
+    env: overrides.env ?? process.env,
+    readStdin: overrides.readStdin ?? defaultReadStdin,
+    githubProvider: overrides.githubProvider ?? new GitHubSetupProvider(overrides.githubProviderDeps)
+  };
+  return async (request, context) => {
+    const [subcommand, ...args] = request.args;
+    if (subcommand === "plan") {
+      return planCommand(args, deps);
+    }
+    if (subcommand === "apply") {
+      return applyCommand(args, context, deps);
+    }
+    if (subcommand === "doctor") {
+      return doctorCommand(args, context, deps);
+    }
+    return jsonResponse(
+      errorPayload("USAGE_ERROR", `Unsupported setup subcommand ${subcommand ?? "<missing>"}.`),
+      ExitCode.UsageError
+    );
+  };
+}
+
 // src/suites.ts
 var CONFIG_FLAGS9 = /* @__PURE__ */ new Set([
   "--config",
@@ -16049,7 +17535,7 @@ var CONFIG_FLAGS9 = /* @__PURE__ */ new Set([
   "--jira-email",
   "--jira-api-token"
 ]);
-function parseArgs10(args) {
+function parseArgs11(args) {
   const flags = {};
   const boolFlags = /* @__PURE__ */ new Set();
   const unknownFlags = [];
@@ -16169,7 +17655,7 @@ function createSuitesHandler(deps = {}) {
   const env = deps.env ?? process.env;
   return async (request, context) => {
     const [subcommand, ...restArgs] = request.args;
-    const parsed = parseArgs10(restArgs);
+    const parsed = parseArgs11(restArgs);
     const useJson = parsed.boolFlags.has("--json");
     const config = resolveCliConfig(pickConfigArgs9(parsed), env, cwd);
     const projectKey = config.values.projectKey;
@@ -16343,7 +17829,7 @@ var CONFIG_FLAGS10 = /* @__PURE__ */ new Set([
   "--jira-api-token"
 ]);
 var RECONCILE_CONFIRM_TOKEN = "RECONCILE";
-function parseArgs11(args) {
+function parseArgs12(args) {
   const flags = {};
   const boolFlags = /* @__PURE__ */ new Set();
   const unknownFlags = [];
@@ -16432,7 +17918,7 @@ function createSyncHandler(deps = {}) {
   const env = deps.env ?? process.env;
   return async (request, context) => {
     const [subcommand, ...restArgs] = request.args;
-    const parsed = parseArgs11(restArgs);
+    const parsed = parseArgs12(restArgs);
     const useJson = parsed.boolFlags.has("--json");
     const config = resolveCliConfig(pickConfigArgs10(parsed), env, cwd);
     const projectKey = config.values.projectKey;
@@ -16592,6 +18078,12 @@ var COMMAND_REGISTRY = [
     subcommands: ["show"],
     handler: createRunsHandler()
   },
+  {
+    name: "setup",
+    description: "Plan, apply, and verify provider onboarding without duplicating Forge domain logic",
+    subcommands: ["plan", "apply", "doctor"],
+    handler: createSetupHandler()
+  },
   {
     name: "suites",
     description: "Hierarchy-aware suite browse commands",