@automatify-au/cli 0.1.11 → 0.1.13

package/dist/automatify.cjs

@@ -2894,8 +2894,8 @@ var require_utils = __commonJS({
       var result = transform[inputType][outputType](input);
       return result;
     };
-    exports2.resolve = function(path14) {
-      var parts = path14.split("/");
+    exports2.resolve = function(path16) {
+      var parts = path16.split("/");
       var result = [];
       for (var index = 0; index < parts.length; index++) {
         var part = parts[index];
@@ -8748,18 +8748,18 @@ var require_object = __commonJS({
       var object = new ZipObject(name, zipObjectContent, o);
       this.files[name] = object;
     };
-    var parentFolder = function(path14) {
-      if (path14.slice(-1) === "/") {
-        path14 = path14.substring(0, path14.length - 1);
+    var parentFolder = function(path16) {
+      if (path16.slice(-1) === "/") {
+        path16 = path16.substring(0, path16.length - 1);
       }
-      var lastSlash = path14.lastIndexOf("/");
-      return lastSlash > 0 ? path14.substring(0, lastSlash) : "";
+      var lastSlash = path16.lastIndexOf("/");
+      return lastSlash > 0 ? path16.substring(0, lastSlash) : "";
     };
-    var forceTrailingSlash = function(path14) {
-      if (path14.slice(-1) !== "/") {
-        path14 += "/";
+    var forceTrailingSlash = function(path16) {
+      if (path16.slice(-1) !== "/") {
+        path16 += "/";
       }
-      return path14;
+      return path16;
     };
     var folderAdd = function(name, createFolders) {
       createFolders = typeof createFolders !== "undefined" ? createFolders : defaults.createFolders;
@@ -9725,9 +9725,9 @@ var require_load = __commonJS({
 var require_lib3 = __commonJS({
   "../../node_modules/.pnpm/jszip@3.10.1/node_modules/jszip/lib/index.js"(exports2, module2) {
     "use strict";
-    function JSZip3() {
-      if (!(this instanceof JSZip3)) {
-        return new JSZip3();
+    function JSZip4() {
+      if (!(this instanceof JSZip4)) {
+        return new JSZip4();
       }
       if (arguments.length) {
         throw new Error("The constructor with parameters has been removed in JSZip 3.0, please check the upgrade guide.");
@@ -9736,7 +9736,7 @@ var require_lib3 = __commonJS({
       this.comment = null;
       this.root = "";
       this.clone = function() {
-        var newObj = new JSZip3();
+        var newObj = new JSZip4();
         for (var i in this) {
           if (typeof this[i] !== "function") {
             newObj[i] = this[i];
@@ -9745,16 +9745,16 @@ var require_lib3 = __commonJS({
         return newObj;
       };
     }
-    JSZip3.prototype = require_object();
-    JSZip3.prototype.loadAsync = require_load();
-    JSZip3.support = require_support();
-    JSZip3.defaults = require_defaults();
-    JSZip3.version = "3.10.1";
-    JSZip3.loadAsync = function(content, options) {
-      return new JSZip3().loadAsync(content, options);
+    JSZip4.prototype = require_object();
+    JSZip4.prototype.loadAsync = require_load();
+    JSZip4.support = require_support();
+    JSZip4.defaults = require_defaults();
+    JSZip4.version = "3.10.1";
+    JSZip4.loadAsync = function(content, options) {
+      return new JSZip4().loadAsync(content, options);
     };
-    JSZip3.external = require_external();
-    module2.exports = JSZip3;
+    JSZip4.external = require_external();
+    module2.exports = JSZip4;
   }
 });
 
@@ -10723,6 +10723,9 @@ function toJsonLine(data) {
 var import_node_fs4 = require("node:fs");
 var import_node_path5 = __toESM(require("node:path"), 1);
 
+// ../../packages/shared-types/dist/entitlements.js
+var UNLIMITED_ACTIVE_USERS = Number.MAX_SAFE_INTEGER;
+
 // ../../packages/shared-types/dist/index.js
 var TestCaseStatus;
 (function(TestCaseStatus2) {
@@ -12450,7 +12453,7 @@ function createAutoHandler(deps = {}) {
 var import_node_path10 = __toESM(require("node:path"), 1);
 var import_node_fs9 = require("node:fs");
 
-// ../../packages/jira-client/src/adf.ts
+// ../../packages/jira-client/dist/adf.js
 function paragraph(text = "") {
   return text ? { type: "paragraph", content: [{ type: "text", text }] } : { type: "paragraph" };
 }
@@ -12493,7 +12496,7 @@ function buildAllureEvidenceCommentAdf(input) {
   };
 }
 
-// ../../packages/jira-client/src/jiraClient.ts
+// ../../packages/jira-client/dist/jiraClient.js
 var import_node_fs5 = require("node:fs");
 var import_node_path6 = __toESM(require("node:path"), 1);
 function normalizeSite(site) {
@@ -12619,7 +12622,7 @@ async function addIssueComment(params) {
   };
 }
 
-// ../../packages/allure-core/src/parseAllureZip.ts
+// ../../packages/allure-core/dist/parseAllureZip.js
 var import_node_fs6 = require("node:fs");
 var import_node_path7 = __toESM(require("node:path"), 1);
 var import_jszip = __toESM(require_lib3(), 1);
@@ -12681,7 +12684,7 @@ async function parseAllureReportZip(zipPath) {
   };
 }
 
-// ../../packages/allure-core/src/extractAllureZip.ts
+// ../../packages/allure-core/dist/extractAllureZip.js
 var import_node_fs7 = require("node:fs");
 var import_node_path8 = __toESM(require("node:path"), 1);
 var import_jszip2 = __toESM(require_lib3(), 1);
@@ -12734,6 +12737,9 @@ async function extractAllureReportZip(zipPath, extractDir) {
   };
 }
 
+// ../../packages/allure-core/dist/parseAllureFailedTests.js
+var import_jszip3 = __toESM(require_lib3(), 1);
+
 // src/allureOpen.ts
 var import_node_fs8 = require("node:fs");
 var import_promises = require("node:fs/promises");
@@ -16039,6 +16045,1688 @@ function createRunsHandler(deps = {}) {
   };
 }
 
+// src/setup.ts
+var import_node_fs14 = require("node:fs");
+var import_node_path15 = __toESM(require("node:path"), 1);
+
+// src/githubSetupProvider.ts
+var import_node_child_process4 = require("node:child_process");
+
+// src/setupPlan.ts
+var import_node_crypto = require("node:crypto");
+var import_node_fs13 = require("node:fs");
+var import_node_path14 = __toESM(require("node:path"), 1);
+var SETUP_PLAN_SCHEMA_VERSION = "automatify.testops.setup/v1";
+var SETUP_PLAN_KIND = "AutomatifyTestOpsSetupPlan";
+var ACTIONS = [
+  {
+    id: "write-workflow-file",
+    scope: "workflow-file",
+    summary: "Write the approved GitHub Actions workflow into the local repository checkout.",
+    mutates: "local-file"
+  },
+  {
+    id: "set-callback-secrets",
+    scope: "github-secrets",
+    summary: "Create missing GitHub Actions callback secrets without exposing their values.",
+    mutates: "github"
+  },
+  {
+    id: "upsert-jira-profile",
+    scope: "jira-profile",
+    summary: "Create or update the Jira scenario automation profile through Forge contracts.",
+    mutates: "jira"
+  }
+];
+function sha256(value) {
+  return (0, import_node_crypto.createHash)("sha256").update(value, "utf8").digest("hex");
+}
+function sortJsonValue(value) {
+  if (Array.isArray(value)) {
+    return value.map(sortJsonValue);
+  }
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, nested]) => [key, sortJsonValue(nested)])
+    );
+  }
+  return value;
+}
+function stableJson(value) {
+  return JSON.stringify(sortJsonValue(value));
+}
+function computePlanId(planWithoutId) {
+  return `sha256:${sha256(stableJson(planWithoutId))}`;
+}
+function withoutPlanId(plan) {
+  const { planId: _planId, ...rest } = plan;
+  return rest;
+}
+function requireNonEmpty(value, field) {
+  const normalized = value.trim();
+  if (!normalized) {
+    throw new Error(`${field} is required.`);
+  }
+  return normalized;
+}
+function normalizeProjectKey(value) {
+  const normalized = requireNonEmpty(value, "project key").toUpperCase();
+  if (!/^[A-Z][A-Z0-9_]{1,31}$/.test(normalized)) {
+    throw new Error("project key must contain 2-32 uppercase letters, digits, or underscores and start with a letter.");
+  }
+  return normalized;
+}
+function normalizeRepoPart(value, field) {
+  const normalized = requireNonEmpty(value, field);
+  if (!/^[A-Za-z0-9_.-]+$/.test(normalized)) {
+    throw new Error(`${field} contains unsupported characters.`);
+  }
+  return normalized;
+}
+function normalizeWorkflowPath(value) {
+  const normalized = import_node_path14.default.posix.normalize(requireNonEmpty(value, "workflow path").replaceAll("\\", "/"));
+  if (import_node_path14.default.posix.isAbsolute(normalized) || normalized.startsWith("../") || !normalized.startsWith(".github/workflows/") || !/\.ya?ml$/i.test(normalized)) {
+    throw new Error("workflow path must be a relative .github/workflows/*.yml or *.yaml path without '..'.");
+  }
+  return normalized;
+}
+function normalizeSecretName(value, field) {
+  const normalized = requireNonEmpty(value, field).toUpperCase();
+  if (!/^[A-Z_][A-Z0-9_]*$/.test(normalized)) {
+    throw new Error(`${field} must be a valid GitHub Actions secret name.`);
+  }
+  return normalized;
+}
+function buildGitHubSetupPlan(input) {
+  const projectKey = normalizeProjectKey(input.projectKey);
+  const owner = normalizeRepoPart(input.owner, "GitHub owner");
+  const repository = normalizeRepoPart(input.repository, "GitHub repository");
+  const ref = requireNonEmpty(input.ref, "Git ref");
+  const workflowId = requireNonEmpty(input.workflowId, "workflow id");
+  const workflowPath = normalizeWorkflowPath(input.workflowPath);
+  const profileLabel = requireNonEmpty(input.profileLabel, "profile label");
+  const endpointSecretName = normalizeSecretName(
+    input.callbackEndpointSecretName,
+    "callback endpoint secret name"
+  );
+  const tokenSecretName = normalizeSecretName(
+    input.callbackAuthTokenSecretName,
+    "callback auth token secret name"
+  );
+  if (endpointSecretName === tokenSecretName) {
+    throw new Error("callback endpoint and auth token secret names must be different.");
+  }
+  const workflowContent = (0, import_node_fs13.readFileSync)(input.workflowSourcePath, "utf8");
+  if (!workflowContent.trim()) {
+    throw new Error("workflow source file is empty.");
+  }
+  if (!/\bworkflow_dispatch\s*:/m.test(workflowContent)) {
+    throw new Error("workflow source must declare workflow_dispatch so Forge can address it explicitly.");
+  }
+  for (const secretName of [endpointSecretName, tokenSecretName]) {
+    if (!workflowContent.includes(`secrets.${secretName}`)) {
+      throw new Error(`workflow source must reference GitHub Actions secret secrets.${secretName}.`);
+    }
+  }
+  const actions = input.setProjectDefault ? [
+    ...ACTIONS,
+    {
+      id: "set-project-default",
+      scope: "project-default",
+      summary: "Select the approved Jira automation profile as the project default through Forge contracts.",
+      mutates: "jira"
+    }
+  ] : [...ACTIONS];
+  const planWithoutId = {
+    schemaVersion: SETUP_PLAN_SCHEMA_VERSION,
+    kind: SETUP_PLAN_KIND,
+    provider: "github-actions",
+    project: { key: projectKey },
+    github: {
+      owner,
+      repository,
+      ref,
+      workflowId,
+      workflowFile: {
+        path: workflowPath,
+        sourcePath: import_node_path14.default.resolve(input.workflowSourcePath),
+        sha256: sha256(workflowContent)
+      },
+      requiredSecrets: [
+        {
+          repositorySecretName: endpointSecretName,
+          valueKey: "callbackEndpoint",
+          purpose: "Authenticated Forge callback endpoint used by the workflow."
+        },
+        {
+          repositorySecretName: tokenSecretName,
+          valueKey: "callbackAuthToken",
+          purpose: "Project-admin CLI key used by the workflow for Forge callbacks."
+        }
+      ],
+      guidance: {
+        authentication: "Prefer a GitHub App installation token or a fine-grained token with only the repository permissions required for workflow inspection, secrets administration, and workflow dispatch from Forge.",
+        permissions: [
+          "Actions: read (doctor) and write only when the Forge profile must dispatch workflow runs.",
+          "Secrets: read/write metadata only for the explicit github-secrets apply scope.",
+          "Contents: read for doctor; this command never creates commits or pull requests."
+        ],
+        remoteChangesExcluded: [
+          "accounts",
+          "credentials",
+          "commits",
+          "pull requests",
+          "workflow runs"
+        ]
+      }
+    },
+    jiraProfile: {
+      label: profileLabel,
+      enabled: input.enabled,
+      provider: "githubActions",
+      config: {
+        owner,
+        repo: repository,
+        workflowId,
+        ref
+      },
+      setProjectDefault: input.setProjectDefault
+    },
+    actions,
+    smokeValidation: [
+      {
+        id: "workflow-content",
+        verifies: "Local and remote workflow content/path without dispatching it.",
+        triggersExternalRun: false
+      },
+      {
+        id: "callback-secret-metadata",
+        verifies: "Required GitHub repository secret names exist; secret values remain unreadable.",
+        triggersExternalRun: false
+      },
+      {
+        id: "jira-profile",
+        verifies: "The Forge automation profile and optional project default match the plan.",
+        triggersExternalRun: false
+      }
+    ],
+    rollback: [
+      {
+        actionId: "write-workflow-file",
+        strategy: "Restore the previous file through version control or delete the newly created uncommitted file.",
+        automatic: false
+      },
+      {
+        actionId: "set-callback-secrets",
+        strategy: "Rotate or delete the named GitHub repository secrets manually; previous secret values cannot be read or restored.",
+        automatic: false
+      },
+      {
+        actionId: "upsert-jira-profile",
+        strategy: "Restore the pre-apply profile fields captured in the apply report, or delete a newly created unused profile through the existing Forge contract.",
+        automatic: false
+      },
+      ...input.setProjectDefault ? [
+        {
+          actionId: "set-project-default",
+          strategy: "Restore the pre-apply default profile id captured in the apply report.",
+          automatic: false
+        }
+      ] : []
+    ],
+    followUp: {
+      azureDevOps: "Add an Azure DevOps provider adapter over this schema/action boundary, mapping pipeline variables and the existing azureDevops Forge profile config without changing setup apply orchestration."
+    }
+  };
+  return {
+    ...planWithoutId,
+    planId: computePlanId(planWithoutId)
+  };
+}
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function hasExactKeys(value, keys) {
+  const actual = Object.keys(value).sort();
+  const expected = [...keys].sort();
+  return actual.length === expected.length && actual.every((key, index) => key === expected[index]);
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+function validateRequiredSecrets(value, errors) {
+  if (!Array.isArray(value) || value.length !== 2) {
+    errors.push("github.requiredSecrets must contain exactly the callback endpoint and callback auth token metadata.");
+    return false;
+  }
+  const keys = /* @__PURE__ */ new Set();
+  const repositoryNames = /* @__PURE__ */ new Set();
+  for (const [index, secret] of value.entries()) {
+    if (!isRecord(secret) || !hasExactKeys(secret, ["repositorySecretName", "valueKey", "purpose"])) {
+      errors.push(`github.requiredSecrets[${index}] has an invalid shape.`);
+      continue;
+    }
+    if (!isNonEmptyString(secret.repositorySecretName) || !/^[A-Z_][A-Z0-9_]*$/.test(secret.repositorySecretName)) {
+      errors.push(`github.requiredSecrets[${index}].repositorySecretName is invalid.`);
+    } else {
+      repositoryNames.add(secret.repositorySecretName);
+    }
+    if (secret.valueKey !== "callbackEndpoint" && secret.valueKey !== "callbackAuthToken") {
+      errors.push(`github.requiredSecrets[${index}].valueKey is invalid.`);
+    } else {
+      keys.add(secret.valueKey);
+    }
+    if (!isNonEmptyString(secret.purpose)) {
+      errors.push(`github.requiredSecrets[${index}].purpose is required.`);
+    }
+  }
+  if (!keys.has("callbackEndpoint") || !keys.has("callbackAuthToken")) {
+    errors.push("github.requiredSecrets must map both callbackEndpoint and callbackAuthToken.");
+  }
+  if (repositoryNames.size !== 2) {
+    errors.push("github.requiredSecrets must use two distinct repository secret names.");
+  }
+  return errors.length === 0;
+}
+function validateActions(value, setDefault, errors) {
+  const expected = setDefault ? [
+    { id: "write-workflow-file", scope: "workflow-file", mutates: "local-file" },
+    { id: "set-callback-secrets", scope: "github-secrets", mutates: "github" },
+    { id: "upsert-jira-profile", scope: "jira-profile", mutates: "jira" },
+    { id: "set-project-default", scope: "project-default", mutates: "jira" }
+  ] : [
+    { id: "write-workflow-file", scope: "workflow-file", mutates: "local-file" },
+    { id: "set-callback-secrets", scope: "github-secrets", mutates: "github" },
+    { id: "upsert-jira-profile", scope: "jira-profile", mutates: "jira" }
+  ];
+  if (!Array.isArray(value) || value.length !== expected.length) {
+    errors.push("actions do not match the required setup mutation scopes.");
+    return false;
+  }
+  value.forEach((action, index) => {
+    if (!isRecord(action) || !hasExactKeys(action, ["id", "scope", "summary", "mutates"])) {
+      errors.push(`actions[${index}] has an invalid shape.`);
+      return;
+    }
+    const expectedAction = expected[index];
+    if (action.id !== expectedAction.id || action.scope !== expectedAction.scope || action.mutates !== expectedAction.mutates) {
+      errors.push(`actions[${index}] must be ${expectedAction.id}/${expectedAction.scope}/${expectedAction.mutates}.`);
+    }
+    if (!isNonEmptyString(action.id) || !isNonEmptyString(action.summary)) {
+      errors.push(`actions[${index}] requires id and summary.`);
+    }
+    if (!["local-file", "github", "jira"].includes(action.mutates)) {
+      errors.push(`actions[${index}].mutates is invalid.`);
+    }
+  });
+  return errors.length === 0;
+}
+function validateGuidance(value, errors) {
+  if (!isRecord(value) || !hasExactKeys(value, ["authentication", "permissions", "remoteChangesExcluded"])) {
+    errors.push("github.guidance has an invalid shape.");
+    return;
+  }
+  if (!isNonEmptyString(value.authentication)) {
+    errors.push("github.guidance.authentication is required.");
+  }
+  if (!Array.isArray(value.permissions) || value.permissions.length === 0 || !value.permissions.every(isNonEmptyString)) {
+    errors.push("github.guidance.permissions must be a non-empty string array.");
+  }
+  const expectedExclusions = ["accounts", "credentials", "commits", "pull requests", "workflow runs"];
+  if (!Array.isArray(value.remoteChangesExcluded) || value.remoteChangesExcluded.length !== expectedExclusions.length || !value.remoteChangesExcluded.every((item, index) => item === expectedExclusions[index])) {
+    errors.push("github.guidance.remoteChangesExcluded must be a string array.");
+  }
+}
+function validateSmokeAndRollback(smoke, rollback, setDefault, errors) {
+  const expectedSmokeIds = ["workflow-content", "callback-secret-metadata", "jira-profile"];
+  if (!Array.isArray(smoke) || smoke.length !== expectedSmokeIds.length) {
+    errors.push("smokeValidation must contain the three provider checks.");
+  } else {
+    smoke.forEach((check, index) => {
+      if (!isRecord(check) || !hasExactKeys(check, ["id", "verifies", "triggersExternalRun"]) || check.id !== expectedSmokeIds[index] || !isNonEmptyString(check.verifies) || check.triggersExternalRun !== false) {
+        errors.push(`smokeValidation[${index}] has an invalid shape or could trigger an external run.`);
+      }
+    });
+  }
+  const expectedRollbackIds = setDefault ? ["write-workflow-file", "set-callback-secrets", "upsert-jira-profile", "set-project-default"] : ["write-workflow-file", "set-callback-secrets", "upsert-jira-profile"];
+  if (!Array.isArray(rollback) || rollback.length !== expectedRollbackIds.length) {
+    errors.push("rollback must cover every mutation action.");
+  } else {
+    rollback.forEach((step, index) => {
+      if (!isRecord(step) || !hasExactKeys(step, ["actionId", "strategy", "automatic"]) || step.actionId !== expectedRollbackIds[index] || !isNonEmptyString(step.strategy) || step.automatic !== false) {
+        errors.push(`rollback[${index}] has an invalid shape or action id.`);
+      }
+    });
+  }
+}
+function validateSetupPlan(value) {
+  const errors = [];
+  if (!isRecord(value)) {
+    return { ok: false, errors: ["Plan must be a JSON object."] };
+  }
+  if (!hasExactKeys(value, [
+    "schemaVersion",
+    "kind",
+    "planId",
+    "provider",
+    "project",
+    "github",
+    "jiraProfile",
+    "actions",
+    "smokeValidation",
+    "rollback",
+    "followUp"
+  ])) {
+    errors.push("Plan has missing or unsupported top-level fields.");
+  }
+  if (value.schemaVersion !== SETUP_PLAN_SCHEMA_VERSION) {
+    errors.push(`schemaVersion must be ${SETUP_PLAN_SCHEMA_VERSION}.`);
+  }
+  if (value.kind !== SETUP_PLAN_KIND) {
+    errors.push(`kind must be ${SETUP_PLAN_KIND}.`);
+  }
+  if (value.provider !== "github-actions") {
+    errors.push("provider must be github-actions for this plan version.");
+  }
+  if (!isNonEmptyString(value.planId) || !value.planId.startsWith("sha256:")) {
+    errors.push("planId must be a sha256 identifier.");
+  }
+  if (!isRecord(value.project) || !hasExactKeys(value.project, ["key"]) || !isNonEmptyString(value.project.key) || !/^[A-Z][A-Z0-9_]{1,31}$/.test(value.project.key)) {
+    errors.push("project.key is required.");
+  }
+  const github = value.github;
+  if (!isRecord(github) || !hasExactKeys(github, [
+    "owner",
+    "repository",
+    "ref",
+    "workflowId",
+    "workflowFile",
+    "requiredSecrets",
+    "guidance"
+  ])) {
+    errors.push("github has an invalid shape.");
+  } else {
+    for (const field of ["owner", "repository", "ref", "workflowId"]) {
+      if (!isNonEmptyString(github[field])) {
+        errors.push(`github.${field} is required.`);
+      }
+    }
+    if (isNonEmptyString(github.owner) && !/^[A-Za-z0-9_.-]+$/.test(github.owner)) {
+      errors.push("github.owner contains unsupported characters.");
+    }
+    if (isNonEmptyString(github.repository) && !/^[A-Za-z0-9_.-]+$/.test(github.repository)) {
+      errors.push("github.repository contains unsupported characters.");
+    }
+    if (!isRecord(github.workflowFile) || !hasExactKeys(github.workflowFile, ["path", "sourcePath", "sha256"])) {
+      errors.push("github.workflowFile has an invalid shape.");
+    } else {
+      if (!isNonEmptyString(github.workflowFile.path)) {
+        errors.push("github.workflowFile.path is required.");
+      } else {
+        try {
+          normalizeWorkflowPath(github.workflowFile.path);
+        } catch (error) {
+          errors.push(error instanceof Error ? error.message : "github.workflowFile.path is invalid.");
+        }
+      }
+      if (!isNonEmptyString(github.workflowFile.sourcePath)) {
+        errors.push("github.workflowFile.sourcePath is required.");
+      }
+      if (typeof github.workflowFile.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(github.workflowFile.sha256)) {
+        errors.push("github.workflowFile.sha256 must be a lowercase SHA-256 digest.");
+      }
+    }
+    validateRequiredSecrets(github.requiredSecrets, errors);
+    validateGuidance(github.guidance, errors);
+  }
+  const profile = value.jiraProfile;
+  let setDefault = false;
+  if (!isRecord(profile) || !hasExactKeys(profile, ["label", "enabled", "provider", "config", "setProjectDefault"])) {
+    errors.push("jiraProfile has an invalid shape.");
+  } else {
+    setDefault = profile.setProjectDefault === true;
+    if (!isNonEmptyString(profile.label)) {
+      errors.push("jiraProfile.label is required.");
+    }
+    if (typeof profile.enabled !== "boolean" || typeof profile.setProjectDefault !== "boolean") {
+      errors.push("jiraProfile enabled/default flags must be booleans.");
+    }
+    if (profile.provider !== "githubActions") {
+      errors.push("jiraProfile.provider must be githubActions.");
+    }
+    if (!isRecord(profile.config) || !hasExactKeys(profile.config, ["owner", "repo", "workflowId", "ref"])) {
+      errors.push("jiraProfile.config has an invalid shape.");
+    } else if (isRecord(github)) {
+      if (profile.config.owner !== github.owner || profile.config.repo !== github.repository || profile.config.workflowId !== github.workflowId || profile.config.ref !== github.ref) {
+        errors.push("jiraProfile.config must match the GitHub repository/ref/workflow fields.");
+      }
+    }
+  }
+  validateActions(value.actions, setDefault, errors);
+  validateSmokeAndRollback(value.smokeValidation, value.rollback, setDefault, errors);
+  if (!isRecord(value.followUp) || !hasExactKeys(value.followUp, ["azureDevOps"]) || !isNonEmptyString(value.followUp.azureDevOps)) {
+    errors.push("followUp.azureDevOps is required.");
+  }
+  if (errors.length === 0) {
+    const plan = value;
+    if (plan.planId !== computePlanId(withoutPlanId(plan))) {
+      errors.push("planId does not match the plan contents.");
+    }
+  }
+  return errors.length === 0 ? { ok: true, errors: [], plan: value } : { ok: false, errors };
+}
+function hashSetupContent(value) {
+  return sha256(value);
+}
+
+// src/githubSetupProvider.ts
+function isRecord2(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function safeGitHubMessage(body, fallback) {
+  if (isRecord2(body) && typeof body.message === "string") {
+    return body.message.slice(0, 500);
+  }
+  return fallback;
+}
+async function githubApi(fetchImpl, url, token) {
+  const response = await fetchImpl(url, {
+    method: "GET",
+    headers: {
+      accept: "application/vnd.github+json",
+      "x-github-api-version": "2022-11-28",
+      ...token ? { authorization: `Bearer ${token}` } : {}
+    }
+  });
+  const text = await response.text();
+  let body = {};
+  if (text) {
+    try {
+      body = JSON.parse(text);
+    } catch {
+      body = {};
+    }
+  }
+  return { ok: response.ok, status: response.status, body };
+}
+async function setGitHubRepositorySecretWithCli(input) {
+  await new Promise((resolve, reject) => {
+    const child = (0, import_node_child_process4.spawn)(
+      "gh",
+      ["secret", "set", input.name, "--repo", `${input.owner}/${input.repository}`],
+      {
+        shell: false,
+        stdio: ["pipe", "ignore", "pipe"],
+        env: {
+          ...process.env,
+          GH_TOKEN: input.adminToken
+        }
+      }
+    );
+    let stderr = "";
+    child.stderr.setEncoding("utf8");
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk;
+    });
+    child.on("error", (error) => {
+      reject(new Error(`Unable to start GitHub CLI: ${error.message}`));
+    });
+    child.on("close", (code) => {
+      if (code === 0) {
+        resolve();
+        return;
+      }
+      const suffix = stderr.trim() ? ` ${stderr.trim().slice(0, 500)}` : "";
+      reject(new Error(`GitHub CLI could not set repository secret ${input.name}.${suffix}`));
+    });
+    child.stdin.end(input.value, "utf8");
+  });
+}
+var GitHubSetupProvider = class {
+  name = "github-actions";
+  fetchImpl;
+  secretSetter;
+  constructor(deps = {}) {
+    this.fetchImpl = deps.fetchImpl ?? fetch;
+    this.secretSetter = deps.setRepositorySecret ?? setGitHubRepositorySecretWithCli;
+  }
+  async inspectExecutionDefinition(plan, token) {
+    const { owner, repository, workflowId, ref, workflowFile } = plan.github;
+    const workflowUrl = `https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}/actions/workflows/${encodeURIComponent(workflowId)}`;
+    const workflow = await githubApi(this.fetchImpl, workflowUrl, token);
+    if (!workflow.ok) {
+      if (workflow.status === 404) {
+        return {
+          found: false,
+          message: "Workflow is not registered on GitHub. Commit the local workflow to the repository default branch before expecting workflow_dispatch to be available."
+        };
+      }
+      return {
+        found: false,
+        message: `GitHub workflow metadata could not be verified (HTTP ${workflow.status}: ${safeGitHubMessage(workflow.body, "request failed")}).`
+      };
+    }
+    const workflowPath = isRecord2(workflow.body) && typeof workflow.body.path === "string" ? workflow.body.path.replace(/^\//, "") : void 0;
+    const state = isRecord2(workflow.body) && typeof workflow.body.state === "string" ? workflow.body.state : void 0;
+    const contentUrl = `https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}/contents/${workflowFile.path.split("/").map(encodeURIComponent).join("/")}?ref=${encodeURIComponent(ref)}`;
+    const content = await githubApi(this.fetchImpl, contentUrl, token);
+    let contentSha256;
+    if (content.ok && isRecord2(content.body) && typeof content.body.content === "string") {
+      try {
+        const decoded = Buffer.from(content.body.content.replace(/\s/g, ""), "base64").toString("utf8");
+        contentSha256 = hashSetupContent(decoded);
+      } catch {
+        contentSha256 = void 0;
+      }
+    }
+    return {
+      found: true,
+      active: state === "active",
+      path: workflowPath,
+      contentSha256,
+      message: state !== "active" ? `GitHub workflow is registered but its state is ${state ?? "unknown"}.` : workflowPath !== workflowFile.path ? `GitHub workflow path ${workflowPath ?? "<unknown>"} does not match ${workflowFile.path}.` : contentSha256 === workflowFile.sha256 ? "GitHub workflow is active and its content matches the approved plan." : "GitHub workflow metadata is reachable, but the approved ref content could not be confirmed as an exact plan match."
+    };
+  }
+  async inspectCallbackSecretMetadata(plan, adminToken) {
+    if (!adminToken) {
+      return {
+        verified: false,
+        names: /* @__PURE__ */ new Set(),
+        message: "Repository secret metadata was not verified because githubAdminToken was not provided. Secret values are never readable."
+      };
+    }
+    const { owner, repository } = plan.github;
+    const url = `https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}/actions/secrets?per_page=100`;
+    const response = await githubApi(this.fetchImpl, url, adminToken);
+    if (!response.ok) {
+      throw new Error(
+        `GitHub repository secret metadata request failed with HTTP ${response.status}: ${safeGitHubMessage(response.body, "request failed")}`
+      );
+    }
+    const names = /* @__PURE__ */ new Set();
+    if (isRecord2(response.body) && Array.isArray(response.body.secrets)) {
+      for (const item of response.body.secrets) {
+        if (isRecord2(item) && typeof item.name === "string") {
+          names.add(item.name);
+        }
+      }
+    }
+    return {
+      verified: true,
+      names,
+      message: `Verified ${names.size} GitHub repository secret name(s); values remain unreadable.`
+    };
+  }
+  async setCallbackSecret(plan, secret, value, adminToken) {
+    await this.secretSetter({
+      owner: plan.github.owner,
+      repository: plan.github.repository,
+      name: secret.repositorySecretName,
+      value,
+      adminToken
+    });
+  }
+};
+
+// src/azureDevOpsSetupProvider.ts
+var isRecord3 = (v) => Boolean(v) && typeof v === "object" && !Array.isArray(v);
+async function adoGet(fetchImpl, url, token) {
+  const response = await fetchImpl(url, { headers: { accept: "application/json", ...token ? { authorization: `Basic ${Buffer.from(`:${token}`).toString("base64")}` } : {} } });
+  const text = await response.text();
+  let body = {};
+  try {
+    body = text ? JSON.parse(text) : {};
+  } catch {
+  }
+  return { ok: response.ok, status: response.status, body };
+}
+async function setAzurePipelineVariableWithRest(input, fetchImpl) {
+  const base = `https://dev.azure.com/${encodeURIComponent(input.organization)}/${encodeURIComponent(input.project)}/_apis/build/definitions/${encodeURIComponent(input.pipelineId)}`;
+  const auth = { authorization: `Basic ${Buffer.from(`:${input.token}`).toString("base64")}` };
+  const current = await adoGet(fetchImpl, `${base}?api-version=7.1`, input.token);
+  if (!current.ok || !isRecord3(current.body)) throw new Error(`Azure DevOps build definition could not be read (HTTP ${current.status}).`);
+  const variables = isRecord3(current.body.variables) ? { ...current.body.variables } : {};
+  variables[input.name] = { value: input.value, isSecret: true };
+  const query = new URLSearchParams({
+    "api-version": "7.1",
+    secretsSourceDefinitionId: String(current.body.id),
+    secretsSourceDefinitionRevision: String(current.body.revision)
+  });
+  const response = await fetchImpl(`${base}?${query.toString()}`, { method: "PUT", headers: { ...auth, "content-type": "application/json", accept: "application/json" }, body: JSON.stringify({ ...current.body, variables }) });
+  if (!response.ok) throw new Error(`Azure DevOps pipeline variable update failed (HTTP ${response.status}).`);
+}
+var AzureDevOpsSetupProvider = class {
+  name = "azure-devops";
+  fetchImpl;
+  setter;
+  constructor(deps = {}) {
+    this.fetchImpl = deps.fetchImpl ?? fetch;
+    this.setter = deps.setPipelineVariable ?? ((input) => setAzurePipelineVariableWithRest(input, this.fetchImpl));
+  }
+  async inspectExecutionDefinition(plan, token) {
+    const a = plan.azureDevOps;
+    const url = `https://dev.azure.com/${encodeURIComponent(a.organization)}/${encodeURIComponent(a.project)}/_apis/build/definitions/${encodeURIComponent(a.pipelineId)}?api-version=${encodeURIComponent(a.apiVersion)}`;
+    const result = await adoGet(this.fetchImpl, url, token);
+    if (!result.ok) return { found: false, message: result.status === 404 ? "Azure DevOps pipeline was not found." : `Azure DevOps pipeline metadata could not be verified (HTTP ${result.status}).` };
+    const body = isRecord3(result.body) ? result.body : {};
+    const name = typeof body.name === "string" ? body.name : void 0;
+    return { found: true, active: true, path: name, message: `Azure DevOps pipeline ${name ?? a.pipelineId} is reachable. Inspection never queues a run.` };
+  }
+  async inspectCallbackSecretMetadata(plan, token) {
+    if (!token) return { verified: false, names: /* @__PURE__ */ new Set(), message: "Azure DevOps pipeline variable metadata was not verified because azureDevOpsAdminToken was not provided. Secret values are never readable." };
+    const a = plan.azureDevOps;
+    const url = `https://dev.azure.com/${encodeURIComponent(a.organization)}/${encodeURIComponent(a.project)}/_apis/build/definitions/${encodeURIComponent(a.pipelineId)}?api-version=${encodeURIComponent(a.apiVersion)}`;
+    const result = await adoGet(this.fetchImpl, url, token);
+    if (!result.ok) throw new Error(`Azure DevOps pipeline metadata request failed with HTTP ${result.status}.`);
+    const variables = isRecord3(result.body) && isRecord3(result.body.variables) ? result.body.variables : {};
+    return { verified: true, names: new Set(Object.keys(variables)), message: `Verified ${Object.keys(variables).length} Azure DevOps pipeline variable name(s); secret values remain unreadable.` };
+  }
+  async setCallbackSecret(plan, secret, value, adminToken) {
+    if (!this.setter) throw new Error("Azure DevOps pipeline variable setter is not configured; use the safe Azure CLI adapter.");
+    await this.setter({ organization: plan.azureDevOps.organization, project: plan.azureDevOps.project, pipelineId: plan.azureDevOps.pipelineId, name: secret.repositorySecretName, value, token: adminToken });
+  }
+};
+
+// src/azureDevOpsSetupPlan.ts
+var import_node_crypto2 = require("node:crypto");
+var digest = (v) => `sha256:${(0, import_node_crypto2.createHash)("sha256").update(JSON.stringify(v)).digest("hex")}`;
+var required = (value, field) => {
+  const result = value.trim();
+  if (!result) throw new Error(`${field} is required.`);
+  return result;
+};
+var variableName = (value, field) => {
+  const result = required(value, field).toUpperCase();
+  if (!/^[A-Z_][A-Z0-9_]*$/.test(result)) throw new Error(`${field} is invalid.`);
+  return result;
+};
+function buildAzureDevOpsSetupPlan(input) {
+  const projectKey = required(input.projectKey, "project key").toUpperCase();
+  if (!/^[A-Z][A-Z0-9_]{1,31}$/.test(projectKey)) throw new Error("project key is invalid.");
+  const organization = required(input.organization, "organization");
+  const azureProject = required(input.azureProject, "Azure project");
+  const pipelineId = required(input.pipelineId, "pipeline id");
+  if (!/^\d+$/.test(pipelineId)) throw new Error("pipeline id must be numeric.");
+  const ref = required(input.ref, "ref");
+  const apiVersion = required(input.apiVersion ?? "7.1", "api version");
+  const profileLabel = required(input.profileLabel, "profile label");
+  const endpointName = variableName(input.callbackEndpointVariableName, "callback endpoint variable name");
+  const tokenName = variableName(input.callbackAuthTokenVariableName, "callback auth token variable name");
+  if (endpointName === tokenName) throw new Error("callback variable names must be distinct.");
+  const requiredSecrets = [{ repositorySecretName: endpointName, valueKey: "callbackEndpoint", purpose: "Forge callback endpoint pipeline variable." }, { repositorySecretName: tokenName, valueKey: "callbackAuthToken", purpose: "Forge callback auth token pipeline variable." }];
+  const scopes = ["provider-secrets", "jira-profile", ...input.setProjectDefault ? ["project-default"] : []];
+  const actions = scopes.map((scope) => ({ id: scope === "provider-secrets" ? "set-provider-secrets" : scope === "jira-profile" ? "upsert-jira-profile" : "set-project-default", scope, summary: `Apply ${scope} for Azure DevOps.`, mutates: "jira" }));
+  const withoutId = { schemaVersion: "automatify.testops.setup/v1", kind: "AutomatifyTestOpsSetupPlan", provider: "azure-devops", project: { key: projectKey }, azureDevOps: { organization, project: azureProject, pipelineId, ref, apiVersion, requiredSecrets, guidance: { authentication: "Use an Azure DevOps PAT with least-privilege pipeline read/manage-variable access.", permissions: ["Pipelines: read for doctor; manage variables only for explicit provider-secrets apply."], remoteChangesExcluded: ["accounts", "credentials", "commits", "pull requests", "pipeline runs"] } }, jiraProfile: { label: profileLabel, enabled: input.enabled, provider: "azureDevops", config: { organization, project: azureProject, pipelineId, apiVersion, bodyTemplate: JSON.stringify({ resources: { repositories: { self: { refName: ref } } } }) }, setProjectDefault: input.setProjectDefault }, actions, smokeValidation: [{ id: "pipeline-content", verifies: "Azure DevOps pipeline metadata without queueing a run.", triggersExternalRun: false }, { id: "pipeline-variable-metadata", verifies: "Required variable names; values remain unreadable.", triggersExternalRun: false }, { id: "jira-profile", verifies: "Forge automation profile and optional default.", triggersExternalRun: false }], rollback: actions.map((a) => ({ actionId: a.id, strategy: "Restore the previous state manually; secret values cannot be read back.", automatic: false })), followUp: { azureDevOps: "Azure DevOps setup is implemented through this provider-neutral plan/apply/doctor boundary." } };
+  return { ...withoutId, planId: digest(withoutId) };
+}
+function validateAzureDevOpsSetupPlan(value) {
+  const errors = [];
+  const record = value;
+  const exact = (v, keys) => Boolean(v && typeof v === "object" && !Array.isArray(v) && Object.keys(v).sort().join() === [...keys].sort().join());
+  if (!exact(value, ["schemaVersion", "kind", "planId", "provider", "project", "azureDevOps", "jiraProfile", "actions", "smokeValidation", "rollback", "followUp"])) errors.push("Plan has missing or unsupported top-level fields.");
+  if (record?.schemaVersion !== "automatify.testops.setup/v1" || record?.kind !== "AutomatifyTestOpsSetupPlan" || record?.provider !== "azure-devops") errors.push("Plan schema, kind, or provider is invalid.");
+  if (!exact(record?.project, ["key"]) || !/^[A-Z][A-Z0-9_]{1,31}$/.test(record?.project?.key ?? "")) errors.push("project.key is invalid.");
+  const a = record?.azureDevOps;
+  if (!exact(a, ["organization", "project", "pipelineId", "ref", "apiVersion", "requiredSecrets", "guidance"]) || ![a?.organization, a?.project, a?.ref, a?.apiVersion].every((x) => typeof x === "string" && x.trim()) || !/^\d+$/.test(a?.pipelineId ?? "")) errors.push("azureDevOps has an invalid shape or fields.");
+  if (!Array.isArray(a?.requiredSecrets) || a.requiredSecrets.length !== 2 || new Set(a.requiredSecrets.map((s) => s.repositorySecretName)).size !== 2 || new Set(a.requiredSecrets.map((s) => s.valueKey)).size !== 2 || !a.requiredSecrets.some((s) => s.valueKey === "callbackEndpoint") || !a.requiredSecrets.some((s) => s.valueKey === "callbackAuthToken") || !a.requiredSecrets.every((s) => exact(s, ["repositorySecretName", "valueKey", "purpose"]) && /^[A-Z_][A-Z0-9_]*$/.test(s.repositorySecretName) && s.purpose)) errors.push("azureDevOps.requiredSecrets is invalid.");
+  const p = record?.jiraProfile;
+  if (!exact(p, ["label", "enabled", "provider", "config", "setProjectDefault"]) || p?.provider !== "azureDevops" || !exact(p?.config, ["organization", "project", "pipelineId", "apiVersion", "bodyTemplate"]) || p.config.organization !== a?.organization || p.config.project !== a?.project || p.config.pipelineId !== a?.pipelineId || p.config.apiVersion !== a?.apiVersion) errors.push("jiraProfile/config is invalid or inconsistent.");
+  const ids = p?.setProjectDefault ? ["set-provider-secrets", "upsert-jira-profile", "set-project-default"] : ["set-provider-secrets", "upsert-jira-profile"];
+  const scopes = p?.setProjectDefault ? ["provider-secrets", "jira-profile", "project-default"] : ["provider-secrets", "jira-profile"];
+  if (!Array.isArray(record?.actions) || record.actions.map((x) => x.id).join() !== ids.join() || !record.actions.every((x, i) => exact(x, ["id", "scope", "summary", "mutates"]) && x.scope === scopes[i] && x.mutates === "jira")) errors.push("actions are invalid.");
+  const smokeIds = ["pipeline-content", "pipeline-variable-metadata", "jira-profile"];
+  if (!Array.isArray(record?.smokeValidation) || record.smokeValidation.length !== 3 || !record.smokeValidation.every((x, i) => exact(x, ["id", "verifies", "triggersExternalRun"]) && x.id === smokeIds[i] && x.triggersExternalRun === false)) errors.push("smokeValidation is invalid.");
+  if (!Array.isArray(record?.rollback) || record.rollback.length !== ids.length || !record.rollback.every((x, i) => exact(x, ["actionId", "strategy", "automatic"]) && x.actionId === ids[i] && x.automatic === false)) errors.push("rollback is invalid.");
+  if (errors.length === 0) {
+    const { planId, ...rest } = record;
+    if (planId !== digest(rest)) errors.push("planId does not match the plan contents.");
+  }
+  return errors.length ? { ok: false, errors } : { ok: true, errors, plan: value };
+}
+
+// src/setup.ts
+var APPLY_RESULT_SCHEMA_VERSION = "automatify.testops.setup.apply/v1";
+var DOCTOR_RESULT_SCHEMA_VERSION = "automatify.testops.setup.doctor/v1";
+var SECRET_KEYS = [
+  "githubProviderToken",
+  "githubAdminToken",
+  "azureDevOpsProviderToken",
+  "azureDevOpsAdminToken",
+  "callbackEndpoint",
+  "callbackAuthToken"
+];
+var MUTATION_SCOPES = [
+  "workflow-file",
+  "github-secrets",
+  "provider-secrets",
+  "jira-profile",
+  "project-default"
+];
+var SetupCommandError = class extends Error {
+  cliCode;
+  exitCode;
+  constructor(cliCode, message, exitCode) {
+    super(message);
+    this.name = "SetupCommandError";
+    this.cliCode = cliCode;
+    this.exitCode = exitCode;
+  }
+};
+var PLAN_VALUE_FLAGS = /* @__PURE__ */ new Set([
+  "--provider",
+  "--project-key",
+  "--owner",
+  "--repo",
+  "--ref",
+  "--workflow-id",
+  "--workflow-path",
+  "--workflow-source",
+  "--profile-label",
+  "--callback-endpoint-secret-name",
+  "--callback-auth-token-secret-name",
+  "--organization",
+  "--azure-project",
+  "--pipeline-id",
+  "--api-version",
+  "--callback-endpoint-variable-name",
+  "--callback-auth-token-variable-name"
+]);
+var APPLY_VALUE_FLAGS = /* @__PURE__ */ new Set(["--plan", "--repo-root"]);
+var APPLY_BOOL_FLAGS = /* @__PURE__ */ new Set([
+  "--confirm",
+  "--dry-run",
+  "--secrets-stdin",
+  "--rotate-secrets",
+  "--rotate-provider-token"
+]);
+function defaultReadStdin() {
+  return new Promise((resolve, reject) => {
+    let value = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (chunk) => {
+      value += chunk;
+    });
+    process.stdin.on("end", () => resolve(value));
+    process.stdin.on("error", reject);
+  });
+}
+function parseArgs10(args, valueFlags, boolFlags, allowApplyCollections = false) {
+  const flags = {};
+  const enabled = /* @__PURE__ */ new Set();
+  const approvals = [];
+  const secretRefs = [];
+  const errors = [];
+  for (let index = 0; index < args.length; index += 1) {
+    const token = args[index];
+    if (!token.startsWith("--")) {
+      errors.push(`Unexpected positional argument at index ${index}.`);
+      continue;
+    }
+    if (boolFlags.has(token)) {
+      enabled.add(token);
+      continue;
+    }
+    if (allowApplyCollections && (token === "--approve" || token === "--secret-ref")) {
+      const value2 = args[index + 1];
+      if (!value2 || value2.startsWith("--")) {
+        errors.push(`${token} requires a value.`);
+        continue;
+      }
+      (token === "--approve" ? approvals : secretRefs).push(value2);
+      index += 1;
+      continue;
+    }
+    if (!valueFlags.has(token)) {
+      errors.push(`Unknown option ${token}.`);
+      continue;
+    }
+    const value = args[index + 1];
+    if (!value || value.startsWith("--")) {
+      errors.push(`${token} requires a value.`);
+      continue;
+    }
+    flags[token] = value;
+    index += 1;
+  }
+  return { flags, boolFlags: enabled, approvals, secretRefs, errors };
+}
+function jsonResponse(payload, exitCode = ExitCode.Success) {
+  return {
+    exitCode,
+    stdout: [JSON.stringify(payload)]
+  };
+}
+function errorPayload(code, message, diagnostics = []) {
+  return {
+    schemaVersion: APPLY_RESULT_SCHEMA_VERSION,
+    status: "failed",
+    error: {
+      code,
+      message,
+      diagnostics
+    }
+  };
+}
+function safeErrorMessage(error, secrets = { values: {}, sources: {} }) {
+  let message = error instanceof Error ? error.message : "Unknown setup error.";
+  for (const secret of Object.values(secrets.values)) {
+    if (secret) {
+      message = message.split(secret).join("[REDACTED]");
+    }
+  }
+  return message.replace(/Bearer\s+[A-Za-z0-9._~+\/-]+/gi, "Bearer [REDACTED]").replace(/token[=:]\s*[^\s,;]+/gi, "token=[REDACTED]");
+}
+function exitCodeForError(error) {
+  if (error instanceof SetupCommandError) {
+    return error.exitCode;
+  }
+  if (error instanceof ForgeClientError) {
+    return error.code === "NETWORK_ERROR" || error.code === "TIMEOUT_ERROR" ? ExitCode.TransportError : ExitCode.RemoteError;
+  }
+  return ExitCode.RemoteError;
+}
+function errorCodeForError(error, fallback) {
+  return error instanceof SetupCommandError ? error.cliCode : fallback;
+}
+function loadPlan(planPath, cwd) {
+  const absolute = import_node_path15.default.resolve(cwd, planPath);
+  let parsed;
+  try {
+    parsed = JSON.parse((0, import_node_fs14.readFileSync)(absolute, "utf8"));
+  } catch (error) {
+    throw new SetupCommandError(
+      "PLAN_READ_ERROR",
+      `Could not read setup plan JSON: ${error instanceof Error ? error.message : "unknown error"}`,
+      ExitCode.ValidationError
+    );
+  }
+  const validation = isAzurePlanValue(parsed) ? validateAzureDevOpsSetupPlan(parsed) : validateSetupPlan(parsed);
+  if (!validation.ok || !validation.plan) {
+    throw new SetupCommandError(
+      "PLAN_VALIDATION_ERROR",
+      `Setup plan validation failed: ${validation.errors.join(" ")}`,
+      ExitCode.ValidationError
+    );
+  }
+  return validation.plan;
+}
+function isAzurePlanValue(value) {
+  return Boolean(value && typeof value === "object" && value.provider === "azure-devops");
+}
+function isSecretKey(value) {
+  return SECRET_KEYS.includes(value);
+}
+async function resolveSecrets(parsed, deps) {
+  const values = {};
+  const sources = {};
+  if (parsed.boolFlags.has("--secrets-stdin")) {
+    const raw = await deps.readStdin();
+    let envelope;
+    try {
+      envelope = JSON.parse(raw);
+    } catch {
+      throw new SetupCommandError(
+        "SECRET_INPUT_ERROR",
+        "Secret stdin must be a JSON object. Input content was not retained or printed.",
+        ExitCode.ValidationError
+      );
+    }
+    if (!envelope || typeof envelope !== "object" || Array.isArray(envelope)) {
+      throw new SetupCommandError("SECRET_INPUT_ERROR", "Secret stdin must be a JSON object.", ExitCode.ValidationError);
+    }
+    for (const [key, value] of Object.entries(envelope)) {
+      if (!isSecretKey(key)) {
+        throw new SetupCommandError("SECRET_INPUT_ERROR", `Secret stdin contains unsupported key ${key}.`, ExitCode.ValidationError);
+      }
+      if (typeof value !== "string" || !value.trim()) {
+        throw new SetupCommandError("SECRET_INPUT_ERROR", `Secret stdin key ${key} must be a non-empty string.`, ExitCode.ValidationError);
+      }
+      values[key] = value.trim();
+      sources[key] = "stdin";
+    }
+  }
+  for (const reference of parsed.secretRefs) {
+    const separator = reference.indexOf("=");
+    const key = separator > 0 ? reference.slice(0, separator) : "";
+    const target = separator > 0 ? reference.slice(separator + 1) : "";
+    if (!isSecretKey(key) || !target.startsWith("env:")) {
+      throw new SetupCommandError(
+        "SECRET_REFERENCE_ERROR",
+        "Secret references must use <supported-key>=env:<VARIABLE_NAME>.",
+        ExitCode.ValidationError
+      );
+    }
+    const envName = target.slice(4);
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(envName)) {
+      throw new SetupCommandError("SECRET_REFERENCE_ERROR", `Secret reference for ${key} has an invalid environment variable name.`, ExitCode.ValidationError);
+    }
+    if (sources[key]) {
+      throw new SetupCommandError("SECRET_REFERENCE_ERROR", `Secret ${key} was provided more than once.`, ExitCode.ValidationError);
+    }
+    const value = deps.env[envName]?.trim();
+    if (!value) {
+      throw new SetupCommandError(
+        "SECRET_REFERENCE_ERROR",
+        `Secret reference for ${key} points to an empty or missing environment variable.`,
+        ExitCode.ValidationError
+      );
+    }
+    values[key] = value;
+    sources[key] = "env-ref";
+  }
+  return { values, sources };
+}
+function approvedScopes(plan, parsed, dryRun) {
+  const planScopes = plan.actions.map((action) => action.scope);
+  const requested = parsed.approvals.length === 0 && dryRun ? ["all"] : parsed.approvals;
+  if (requested.length === 0) {
+    throw new SetupCommandError(
+      "APPROVAL_REQUIRED",
+      "At least one --approve <scope> is required for apply. Use --approve all to approve every planned action.",
+      ExitCode.UsageError
+    );
+  }
+  const expanded = /* @__PURE__ */ new Set();
+  for (const scope of requested) {
+    if (scope === "all") {
+      planScopes.forEach((item) => expanded.add(item));
+      continue;
+    }
+    if (!MUTATION_SCOPES.includes(scope)) {
+      throw new SetupCommandError("APPROVAL_ERROR", `Unsupported approval scope ${scope}.`, ExitCode.UsageError);
+    }
+    if (!planScopes.includes(scope)) {
+      throw new SetupCommandError("APPROVAL_ERROR", `Approval scope ${scope} is not present in this plan.`, ExitCode.UsageError);
+    }
+    expanded.add(scope);
+  }
+  return planScopes.filter((scope) => expanded.has(scope));
+}
+function requireServiceData(result, contract) {
+  if (!result.ok) {
+    throw new Error(`${contract} failed: ${result.error.code}: ${result.error.message}`);
+  }
+  return result.data;
+}
+function findMatchingProfile(profiles, plan) {
+  const matches = profiles.filter((profile) => profile.label === plan.jiraProfile.label);
+  if (matches.length > 1) {
+    throw new SetupCommandError(
+      "AMBIGUOUS_PROFILE",
+      `More than one Jira automation profile has label ${plan.jiraProfile.label}; rename duplicates before applying this deterministic plan.`,
+      ExitCode.ValidationError
+    );
+  }
+  return matches[0];
+}
+function profileMatches(profile, plan) {
+  const config = profile.config;
+  return profile.provider === "githubActions" && profile.label === plan.jiraProfile.label && profile.enabled === plan.jiraProfile.enabled && config.owner === plan.jiraProfile.config.owner && config.repo === plan.jiraProfile.config.repo && config.workflowId === plan.jiraProfile.config.workflowId && config.ref === plan.jiraProfile.config.ref;
+}
+function previousProfileState(profile) {
+  if (!profile) {
+    return { existed: false };
+  }
+  return {
+    existed: true,
+    id: profile.id,
+    label: profile.label,
+    provider: profile.provider,
+    enabled: profile.enabled,
+    wasProjectDefault: Boolean(profile.isProjectDefault),
+    hadSecret: profile.hasSecret
+  };
+}
+async function prepareState(plan, scopes, secrets, context, deps, dryRun, rotateSecrets, rotateProviderToken) {
+  let profiles = [];
+  let matchingProfile;
+  let currentDefaultProfileId;
+  if (scopes.includes("jira-profile") || scopes.includes("project-default")) {
+    profiles = requireServiceData(
+      await context.invokeForgeContract("listScenarioAutomationProfiles", {
+        context: { projectKey: plan.project.key }
+      }),
+      "listScenarioAutomationProfiles"
+    );
+    matchingProfile = findMatchingProfile(profiles, plan);
+    currentDefaultProfileId = profiles.find((profile) => profile.isProjectDefault)?.id;
+    const needsProviderToken = scopes.includes("jira-profile") && (!matchingProfile?.hasSecret || rotateProviderToken);
+    if (needsProviderToken && !dryRun && !secrets.values.githubProviderToken) {
+      throw new SetupCommandError(
+        "SECRET_INPUT_REQUIRED",
+        "githubProviderToken is required to create this Jira profile, restore a missing provider secret, or rotate the provider token.",
+        ExitCode.ValidationError
+      );
+    }
+  }
+  let repositorySecretNames;
+  if (scopes.includes("github-secrets")) {
+    if (!dryRun && !secrets.values.githubAdminToken) {
+      throw new SetupCommandError(
+        "SECRET_INPUT_REQUIRED",
+        "githubAdminToken is required for the approved github-secrets scope.",
+        ExitCode.ValidationError
+      );
+    }
+    if (secrets.values.githubAdminToken) {
+      const inspection = await deps.githubProvider.inspectCallbackSecretMetadata(
+        plan,
+        secrets.values.githubAdminToken
+      );
+      repositorySecretNames = inspection.names;
+      const secretsToWrite = plan.github.requiredSecrets.filter(
+        (secret) => rotateSecrets || !repositorySecretNames?.has(secret.repositorySecretName)
+      );
+      if (!dryRun) {
+        for (const secret of secretsToWrite) {
+          if (!secrets.values[secret.valueKey]) {
+            throw new SetupCommandError(
+              "SECRET_INPUT_REQUIRED",
+              `${secret.valueKey} is required to create or rotate ${secret.repositorySecretName}.`,
+              ExitCode.ValidationError
+            );
+          }
+        }
+      }
+    }
+  }
+  return { profiles, matchingProfile, currentDefaultProfileId, repositorySecretNames };
+}
+function rollbackFor(plan, actionId) {
+  return plan.rollback.find((item) => item.actionId === actionId)?.strategy ?? "Review the plan rollback section.";
+}
+function resolveWorkflowTarget(plan, repoRoot) {
+  const resolvedRoot = import_node_path15.default.resolve(repoRoot);
+  const target = import_node_path15.default.resolve(resolvedRoot, plan.github.workflowFile.path);
+  if (target !== resolvedRoot && !target.startsWith(`${resolvedRoot}${import_node_path15.default.sep}`)) {
+    throw new SetupCommandError(
+      "WORKFLOW_PATH_ERROR",
+      "Workflow target escapes the approved repository root.",
+      ExitCode.ValidationError
+    );
+  }
+  return target;
+}
+function applyWorkflowFile(plan, repoRoot, dryRun) {
+  const action = plan.actions.find((item) => item.scope === "workflow-file");
+  const target = resolveWorkflowTarget(plan, repoRoot);
+  const sourceContent = (0, import_node_fs14.readFileSync)(plan.github.workflowFile.sourcePath, "utf8");
+  if (hashSetupContent(sourceContent) !== plan.github.workflowFile.sha256) {
+    throw new SetupCommandError(
+      "WORKFLOW_SOURCE_CHANGED",
+      "Workflow source content no longer matches the approved plan hash; generate a new plan before applying.",
+      ExitCode.ValidationError
+    );
+  }
+  const existed = (0, import_node_fs14.existsSync)(target);
+  const previousContent = existed ? (0, import_node_fs14.readFileSync)(target, "utf8") : void 0;
+  const matches = previousContent !== void 0 && hashSetupContent(previousContent) === plan.github.workflowFile.sha256;
+  if (matches) {
+    return {
+      id: action.id,
+      scope: action.scope,
+      status: "skipped",
+      message: "Local workflow file already matches the approved content hash.",
+      rollback: { available: false, guidance: "No workflow file mutation occurred." }
+    };
+  }
+  if (!dryRun) {
+    (0, import_node_fs14.mkdirSync)(import_node_path15.default.dirname(target), { recursive: true });
+    (0, import_node_fs14.writeFileSync)(target, sourceContent, { encoding: "utf8", mode: 420 });
+  }
+  return {
+    id: action.id,
+    scope: action.scope,
+    status: dryRun ? "planned" : existed ? "updated" : "created",
+    message: dryRun ? `${existed ? "Update" : "Create"} ${plan.github.workflowFile.path} with sha256 ${plan.github.workflowFile.sha256}.` : `${existed ? "Updated" : "Created"} ${plan.github.workflowFile.path}.`,
+    rollback: {
+      available: !dryRun,
+      guidance: rollbackFor(plan, action.id),
+      previousState: {
+        existed,
+        sha256: previousContent === void 0 ? null : hashSetupContent(previousContent)
+      }
+    }
+  };
+}
+async function applyGitHubSecrets(plan, state, secrets, deps, dryRun, rotateSecrets) {
+  const action = plan.actions.find((item) => item.scope === "github-secrets");
+  const names = state.repositorySecretNames;
+  const pending = plan.github.requiredSecrets.filter(
+    (secret) => rotateSecrets || !names?.has(secret.repositorySecretName)
+  );
+  if (names && pending.length === 0) {
+    return {
+      id: action.id,
+      scope: action.scope,
+      status: "skipped",
+      message: "All required GitHub repository secret names already exist; values remain unreadable and were not overwritten.",
+      rollback: { available: false, guidance: "No GitHub secret mutation occurred." }
+    };
+  }
+  if (dryRun) {
+    return {
+      id: action.id,
+      scope: action.scope,
+      status: "planned",
+      message: names ? `Set ${pending.map((secret) => secret.repositorySecretName).join(", ")}; values will be read only from approved secret input.` : "Inspect required GitHub secret metadata, then create missing names from approved secret input.",
+      rollback: { available: false, guidance: rollbackFor(plan, action.id) }
+    };
+  }
+  const adminToken = secrets.values.githubAdminToken;
+  for (const secret of pending) {
+    await deps.githubProvider.setCallbackSecret(
+      plan,
+      secret,
+      secrets.values[secret.valueKey],
+      adminToken
+    );
+  }
+  return {
+    id: action.id,
+    scope: action.scope,
+    status: "updated",
+    message: `Set ${pending.length} GitHub repository secret(s). Values were not printed or placed in process arguments.`,
+    rollback: { available: false, guidance: rollbackFor(plan, action.id) }
+  };
+}
+async function applyJiraProfile(plan, state, secrets, context, dryRun, rotateProviderToken) {
+  const action = plan.actions.find((item) => item.scope === "jira-profile");
+  const current = state.matchingProfile;
+  const matches = current ? profileMatches(current, plan) : false;
+  if (current && matches && current.hasSecret && !rotateProviderToken) {
+    return {
+      profile: current,
+      result: {
+        id: action.id,
+        scope: action.scope,
+        status: "skipped",
+        message: "Jira automation profile already matches the plan and has a stored provider secret.",
+        rollback: { available: false, guidance: "No Jira profile mutation occurred." }
+      }
+    };
+  }
+  if (dryRun) {
+    const plannedProfile = current ?? {
+      id: "<created-by-forge>",
+      projectKey: plan.project.key,
+      label: plan.jiraProfile.label,
+      provider: "githubActions",
+      authType: "bearer",
+      method: "POST",
+      endpointSummary: "<computed-by-forge>",
+      config: plan.jiraProfile.config,
+      enabled: plan.jiraProfile.enabled,
+      hasSecret: Boolean(secrets.values.githubProviderToken),
+      createdAt: "",
+      updatedAt: ""
+    };
+    return {
+      profile: plannedProfile,
+      result: {
+        id: action.id,
+        scope: action.scope,
+        status: "planned",
+        message: `${current ? "Update" : "Create"} the Jira automation profile through upsertScenarioAutomationProfile.`,
+        rollback: {
+          available: false,
+          guidance: rollbackFor(plan, action.id),
+          previousState: previousProfileState(current)
+        }
+      }
+    };
+  }
+  const secretToken = !current?.hasSecret || rotateProviderToken ? secrets.values.githubProviderToken : void 0;
+  const profile = requireServiceData(
+    await context.invokeForgeContract("upsertScenarioAutomationProfile", {
+      context: { projectKey: plan.project.key },
+      input: {
+        profileId: current?.id,
+        label: plan.jiraProfile.label,
+        provider: "githubActions",
+        config: plan.jiraProfile.config,
+        enabled: plan.jiraProfile.enabled,
+        secretToken
+      }
+    }),
+    "upsertScenarioAutomationProfile"
+  );
+  return {
+    profile,
+    result: {
+      id: action.id,
+      scope: action.scope,
+      status: current ? "updated" : "created",
+      message: `${current ? "Updated" : "Created"} Jira automation profile ${plan.jiraProfile.label} through the existing Forge contract.`,
+      rollback: {
+        available: true,
+        guidance: rollbackFor(plan, action.id),
+        previousState: previousProfileState(current)
+      }
+    }
+  };
+}
+async function applyProjectDefault(plan, state, profile, context, dryRun) {
+  const action = plan.actions.find((item) => item.scope === "project-default");
+  if (state.currentDefaultProfileId === profile.id) {
+    return {
+      id: action.id,
+      scope: action.scope,
+      status: "skipped",
+      message: "Jira automation profile is already the project default.",
+      rollback: { available: false, guidance: "No project-default mutation occurred." }
+    };
+  }
+  if (!dryRun) {
+    requireServiceData(
+      await context.invokeForgeContract("setScenarioAutomationDefaultProfile", {
+        context: { projectKey: plan.project.key },
+        profileId: profile.id
+      }),
+      "setScenarioAutomationDefaultProfile"
+    );
+  }
+  return {
+    id: action.id,
+    scope: action.scope,
+    status: dryRun ? "planned" : "updated",
+    message: dryRun ? "Set the planned Jira automation profile as project default through setScenarioAutomationDefaultProfile." : "Set the Jira automation profile as project default through the existing Forge contract.",
+    rollback: {
+      available: !dryRun,
+      guidance: rollbackFor(plan, action.id),
+      previousState: { profileId: state.currentDefaultProfileId ?? null }
+    }
+  };
+}
+function doctorStatus(checks) {
+  if (checks.some((check) => check.status === "fail")) return "fail";
+  if (checks.some((check) => check.status === "warn")) return "warn";
+  return "pass";
+}
+async function inspectPlan(plan, repoRoot, secrets, context, deps) {
+  const checks = [];
+  let forgeTransportFailure = false;
+  const target = resolveWorkflowTarget(plan, repoRoot);
+  if (!(0, import_node_fs14.existsSync)(target)) {
+    checks.push({
+      id: "workflow-local",
+      status: "fail",
+      message: `Local workflow file ${plan.github.workflowFile.path} does not exist.`
+    });
+  } else {
+    const localHash = hashSetupContent((0, import_node_fs14.readFileSync)(target, "utf8"));
+    checks.push({
+      id: "workflow-local",
+      status: localHash === plan.github.workflowFile.sha256 ? "pass" : "fail",
+      message: localHash === plan.github.workflowFile.sha256 ? "Local workflow content matches the approved plan hash." : "Local workflow content differs from the approved plan hash."
+    });
+  }
+  try {
+    const workflow = await deps.githubProvider.inspectExecutionDefinition(
+      plan,
+      secrets.values.githubProviderToken ?? secrets.values.githubAdminToken
+    );
+    const exact = workflow.found && workflow.active && workflow.path === plan.github.workflowFile.path && workflow.contentSha256 === plan.github.workflowFile.sha256;
+    checks.push({
+      id: "workflow-github",
+      status: exact ? "pass" : workflow.found && (workflow.path !== plan.github.workflowFile.path || workflow.active === false) ? "fail" : "warn",
+      message: workflow.message
+    });
+  } catch (error) {
+    checks.push({
+      id: "workflow-github",
+      status: "warn",
+      message: `GitHub workflow could not be verified: ${safeErrorMessage(error, secrets)}`
+    });
+  }
+  try {
+    const secretInspection = await deps.githubProvider.inspectCallbackSecretMetadata(
+      plan,
+      secrets.values.githubAdminToken
+    );
+    if (!secretInspection.verified) {
+      checks.push({ id: "callback-secret-metadata", status: "warn", message: secretInspection.message });
+    } else {
+      const missing = plan.github.requiredSecrets.filter(
+        (secret) => !secretInspection.names.has(secret.repositorySecretName)
+      );
+      checks.push({
+        id: "callback-secret-metadata",
+        status: missing.length === 0 ? "pass" : "fail",
+        message: missing.length === 0 ? "All required GitHub repository secret names exist; values remain unreadable and were not printed." : `Missing GitHub repository secret name(s): ${missing.map((item) => item.repositorySecretName).join(", ")}.`
+      });
+    }
+  } catch (error) {
+    checks.push({
+      id: "callback-secret-metadata",
+      status: "warn",
+      message: `GitHub repository secret metadata could not be verified: ${safeErrorMessage(error, secrets)}`
+    });
+  }
+  try {
+    const profiles = requireServiceData(
+      await context.invokeForgeContract("listScenarioAutomationProfiles", {
+        context: { projectKey: plan.project.key }
+      }),
+      "listScenarioAutomationProfiles"
+    );
+    const profile = findMatchingProfile(profiles, plan);
+    const profileOk = Boolean(profile && profileMatches(profile, plan) && profile.hasSecret);
+    checks.push({
+      id: "jira-profile",
+      status: profileOk ? "pass" : "fail",
+      message: profileOk ? "Jira automation profile fields match the plan and Forge reports a stored provider secret." : "Jira automation profile is missing, differs from the plan, or lacks a provider secret."
+    });
+    if (plan.jiraProfile.setProjectDefault) {
+      checks.push({
+        id: "jira-project-default",
+        status: profile?.isProjectDefault ? "pass" : "fail",
+        message: profile?.isProjectDefault ? "Jira automation profile is the project default." : "Jira automation profile is not the project default."
+      });
+    }
+  } catch (error) {
+    forgeTransportFailure = error instanceof ForgeClientError && (error.code === "NETWORK_ERROR" || error.code === "TIMEOUT_ERROR");
+    checks.push({
+      id: "jira-profile",
+      status: "fail",
+      message: `Jira automation profile could not be verified: ${safeErrorMessage(error, secrets)}`
+    });
+  }
+  const status = doctorStatus(checks);
+  return {
+    schemaVersion: DOCTOR_RESULT_SCHEMA_VERSION,
+    planId: plan.planId,
+    provider: "github-actions",
+    status,
+    exitCode: forgeTransportFailure ? ExitCode.TransportError : status === "fail" ? ExitCode.ValidationError : ExitCode.Success,
+    externalRunTriggered: false,
+    checks
+  };
+}
+function planCommand(args, deps) {
+  const parsed = parseArgs10(args, PLAN_VALUE_FLAGS, /* @__PURE__ */ new Set(["--set-default", "--disabled"]));
+  if (parsed.errors.length > 0) {
+    return jsonResponse(errorPayload("USAGE_ERROR", "Invalid setup plan arguments.", parsed.errors), ExitCode.UsageError);
+  }
+  const provider = parsed.flags["--provider"] ?? "github-actions";
+  if (provider === "azure-devops") {
+    try {
+      return jsonResponse(buildAzureDevOpsSetupPlan({
+        projectKey: parsed.flags["--project-key"] ?? "",
+        organization: parsed.flags["--organization"] ?? "",
+        azureProject: parsed.flags["--azure-project"] ?? "",
+        pipelineId: parsed.flags["--pipeline-id"] ?? "",
+        ref: parsed.flags["--ref"] ?? "main",
+        apiVersion: parsed.flags["--api-version"],
+        profileLabel: parsed.flags["--profile-label"] ?? "Azure DevOps",
+        enabled: !parsed.boolFlags.has("--disabled"),
+        setProjectDefault: parsed.boolFlags.has("--set-default"),
+        callbackEndpointVariableName: parsed.flags["--callback-endpoint-variable-name"] ?? "TESTOPS_FORGE_ENDPOINT",
+        callbackAuthTokenVariableName: parsed.flags["--callback-auth-token-variable-name"] ?? "TESTOPS_FORGE_AUTH_TOKEN"
+      }));
+    } catch (error) {
+      return jsonResponse(errorPayload("VALIDATION_ERROR", safeErrorMessage(error)), ExitCode.ValidationError);
+    }
+  }
+  if (provider !== "github-actions") {
+    return jsonResponse(
+      errorPayload("VALIDATION_ERROR", "Only github-actions is implemented in this stage; Azure DevOps is the documented next adapter."),
+      ExitCode.ValidationError
+    );
+  }
+  try {
+    const plan = buildGitHubSetupPlan({
+      projectKey: parsed.flags["--project-key"] ?? "",
+      owner: parsed.flags["--owner"] ?? "",
+      repository: parsed.flags["--repo"] ?? "",
+      ref: parsed.flags["--ref"] ?? "main",
+      workflowId: parsed.flags["--workflow-id"] ?? "scenario-dispatch.yml",
+      workflowPath: parsed.flags["--workflow-path"] ?? ".github/workflows/scenario-dispatch.yml",
+      workflowSourcePath: import_node_path15.default.resolve(deps.cwd, parsed.flags["--workflow-source"] ?? ""),
+      profileLabel: parsed.flags["--profile-label"] ?? "GitHub Actions",
+      enabled: !parsed.boolFlags.has("--disabled"),
+      setProjectDefault: parsed.boolFlags.has("--set-default"),
+      callbackEndpointSecretName: parsed.flags["--callback-endpoint-secret-name"] ?? "TESTOPS_FORGE_ENDPOINT",
+      callbackAuthTokenSecretName: parsed.flags["--callback-auth-token-secret-name"] ?? "TESTOPS_FORGE_AUTH_TOKEN"
+    });
+    return jsonResponse(plan);
+  } catch (error) {
+    return jsonResponse(
+      errorPayload("VALIDATION_ERROR", safeErrorMessage(error)),
+      ExitCode.ValidationError
+    );
+  }
+}
+async function applyCommand(args, context, deps) {
+  const parsed = parseArgs10(args, APPLY_VALUE_FLAGS, APPLY_BOOL_FLAGS, true);
+  if (parsed.errors.length > 0) {
+    return jsonResponse(errorPayload("USAGE_ERROR", "Invalid setup apply arguments.", parsed.errors), ExitCode.UsageError);
+  }
+  const planPath = parsed.flags["--plan"];
+  if (!planPath) {
+    return jsonResponse(errorPayload("USAGE_ERROR", "--plan <file> is required."), ExitCode.UsageError);
+  }
+  const dryRun = parsed.boolFlags.has("--dry-run");
+  if (!dryRun && !parsed.boolFlags.has("--confirm")) {
+    return jsonResponse(
+      errorPayload("CONFIRMATION_REQUIRED", "Mutating apply requires --confirm plus explicit --approve scopes."),
+      ExitCode.UsageError
+    );
+  }
+  let secrets = { values: {}, sources: {} };
+  const actionResults = [];
+  try {
+    const plan = loadPlan(planPath, deps.cwd);
+    secrets = await resolveSecrets(parsed, deps);
+    if (plan.provider === "azure-devops") {
+      return await applyAzureCommand(plan, parsed, context, deps, secrets);
+    }
+    const scopes = approvedScopes(plan, parsed, dryRun);
+    const repoRoot = import_node_path15.default.resolve(deps.cwd, parsed.flags["--repo-root"] ?? ".");
+    const rotateSecrets = parsed.boolFlags.has("--rotate-secrets");
+    const rotateProviderToken = parsed.boolFlags.has("--rotate-provider-token");
+    const state = await prepareState(
+      plan,
+      scopes,
+      secrets,
+      context,
+      deps,
+      dryRun,
+      rotateSecrets,
+      rotateProviderToken
+    );
+    let appliedProfile = state.matchingProfile;
+    for (const action of plan.actions) {
+      if (!scopes.includes(action.scope)) {
+        actionResults.push({
+          id: action.id,
+          scope: action.scope,
+          status: "skipped",
+          message: "Action was not in the explicit approval scope.",
+          rollback: { available: false, guidance: "No mutation occurred." }
+        });
+        continue;
+      }
+      try {
+        if (action.scope === "workflow-file") {
+          actionResults.push(applyWorkflowFile(plan, repoRoot, dryRun));
+        } else if (action.scope === "github-secrets") {
+          actionResults.push(await applyGitHubSecrets(plan, state, secrets, deps, dryRun, rotateSecrets));
+        } else if (action.scope === "jira-profile") {
+          const applied = await applyJiraProfile(
+            plan,
+            state,
+            secrets,
+            context,
+            dryRun,
+            rotateProviderToken
+          );
+          appliedProfile = applied.profile;
+          actionResults.push(applied.result);
+        } else if (action.scope === "project-default") {
+          if (!appliedProfile) {
+            throw new SetupCommandError(
+              "PROFILE_REQUIRED",
+              "Project-default apply requires an existing or approved Jira automation profile.",
+              ExitCode.ValidationError
+            );
+          }
+          actionResults.push(await applyProjectDefault(plan, state, appliedProfile, context, dryRun));
+        }
+      } catch (error) {
+        actionResults.push({
+          id: action.id,
+          scope: action.scope,
+          status: "failed",
+          message: safeErrorMessage(error, secrets),
+          rollback: {
+            available: false,
+            guidance: rollbackFor(plan, action.id)
+          }
+        });
+        throw error;
+      }
+    }
+    const doctor = dryRun ? void 0 : await inspectPlan(plan, repoRoot, secrets, context, deps);
+    return jsonResponse(
+      {
+        schemaVersion: APPLY_RESULT_SCHEMA_VERSION,
+        planId: plan.planId,
+        provider: plan.provider,
+        status: dryRun ? "dry-run" : doctor?.status === "fail" ? "applied-with-validation-failures" : doctor?.status === "warn" ? "applied-with-warnings" : "applied",
+        dryRun,
+        confirmed: !dryRun,
+        approvedScopes: scopes,
+        secretInputs: Object.entries(secrets.sources).map(([key, source]) => ({ key, source })),
+        actions: actionResults,
+        smokeValidation: doctor ?? {
+          status: "not-run",
+          externalRunTriggered: false,
+          message: "Dry-run performs no mutations and does not require remote smoke validation. Run setup doctor for read-only verification."
+        }
+      },
+      doctor?.exitCode ?? ExitCode.Success
+    );
+  } catch (error) {
+    const message = safeErrorMessage(error, secrets);
+    return jsonResponse(
+      {
+        ...errorPayload(errorCodeForError(error, "APPLY_FAILED"), message, [
+          "Review each completed action and its rollback guidance; GitHub secret values cannot be restored automatically."
+        ]),
+        actions: actionResults
+      },
+      exitCodeForError(error)
+    );
+  }
+}
+async function applyAzureCommand(plan, parsed, context, deps, secrets) {
+  const dryRun = parsed.boolFlags.has("--dry-run");
+  const scopes = approvedScopes(plan, parsed, dryRun);
+  const profiles = requireServiceData(await context.invokeForgeContract("listScenarioAutomationProfiles", { context: { projectKey: plan.project.key } }), "listScenarioAutomationProfiles");
+  const current = profiles.find((item) => item.label === plan.jiraProfile.label);
+  if (!dryRun && scopes.includes("provider-secrets") && !secrets.values.azureDevOpsAdminToken) throw new SetupCommandError("SECRET_INPUT_REQUIRED", "azureDevOpsAdminToken is required for the approved Azure DevOps pipeline-variable scope.", ExitCode.ValidationError);
+  const results = [];
+  const secretNames = scopes.includes("provider-secrets") && secrets.values.azureDevOpsAdminToken ? (await deps.azureProvider.inspectCallbackSecretMetadata(plan, secrets.values.azureDevOpsAdminToken)).names : void 0;
+  let appliedProfile = current;
+  for (const action of plan.actions) {
+    if (!scopes.includes(action.scope)) {
+      results.push({ id: action.id, scope: action.scope, status: "skipped", message: "Action was not in the explicit approval scope.", rollback: { available: false, guidance: "No mutation occurred." } });
+      continue;
+    }
+    if (action.scope === "provider-secrets") {
+      const pending = plan.azureDevOps.requiredSecrets.filter((item) => parsed.boolFlags.has("--rotate-secrets") || !secretNames?.has(item.repositorySecretName));
+      if (!dryRun && pending.some((item) => !secrets.values[item.valueKey])) throw new SetupCommandError("SECRET_INPUT_REQUIRED", "Azure DevOps callback secrets are required for approved pipeline variable changes.", ExitCode.ValidationError);
+      if (!dryRun) for (const item of pending) await deps.azureProvider.setCallbackSecret(plan, item, secrets.values[item.valueKey], secrets.values.azureDevOpsAdminToken);
+      results.push({ id: action.id, scope: action.scope, status: dryRun ? "planned" : pending.length ? "updated" : "skipped", message: "Azure DevOps pipeline variable names are managed without printing secret values.", rollback: { available: false, guidance: rollbackFor(plan, action.id) } });
+    } else if (action.scope === "jira-profile") {
+      const rotateProvider = parsed.boolFlags.has("--rotate-provider-token");
+      if (!dryRun && (!current?.hasSecret || rotateProvider) && !secrets.values.azureDevOpsProviderToken) throw new SetupCommandError("SECRET_INPUT_REQUIRED", "azureDevOpsProviderToken is required to create or rotate the Azure provider PAT.", ExitCode.ValidationError);
+      const profile = dryRun ? current ?? { id: "<created-by-forge>", projectKey: plan.project.key, label: plan.jiraProfile.label, provider: "azureDevops", authType: "basicPat", method: "POST", endpointSummary: "<computed-by-forge>", config: plan.jiraProfile.config, enabled: plan.jiraProfile.enabled, hasSecret: false, createdAt: "", updatedAt: "" } : requireServiceData(await context.invokeForgeContract("upsertScenarioAutomationProfile", { context: { projectKey: plan.project.key }, input: { profileId: current?.id, label: plan.jiraProfile.label, provider: "azureDevops", config: plan.jiraProfile.config, enabled: plan.jiraProfile.enabled, secretToken: !current?.hasSecret || rotateProvider ? secrets.values.azureDevOpsProviderToken : void 0 } }), "upsertScenarioAutomationProfile");
+      appliedProfile = profile;
+      results.push({ id: action.id, scope: action.scope, status: dryRun ? "planned" : current ? "updated" : "created", message: "Azure DevOps Jira automation profile applied through the existing Forge contract.", rollback: { available: !dryRun, guidance: rollbackFor(plan, action.id) } });
+    } else if (action.scope === "project-default" && appliedProfile && !dryRun) {
+      requireServiceData(await context.invokeForgeContract("setScenarioAutomationDefaultProfile", { context: { projectKey: plan.project.key }, profileId: appliedProfile.id }), "setScenarioAutomationDefaultProfile");
+      results.push({ id: action.id, scope: action.scope, status: "updated", message: "Set the Azure DevOps Jira automation profile as project default.", rollback: { available: true, guidance: rollbackFor(plan, action.id) } });
+    } else if (action.scope === "project-default") {
+      results.push({ id: action.id, scope: action.scope, status: "planned", message: "Set the Azure DevOps Jira automation profile as project default.", rollback: { available: false, guidance: rollbackFor(plan, action.id) } });
+    }
+  }
+  return jsonResponse({ schemaVersion: APPLY_RESULT_SCHEMA_VERSION, planId: plan.planId, provider: plan.provider, status: dryRun ? "dry-run" : "applied", dryRun, confirmed: !dryRun, approvedScopes: scopes, actions: results, smokeValidation: { status: "not-run", externalRunTriggered: false } });
+}
+async function doctorCommand(args, context, deps) {
+  const parsed = parseArgs10(
+    args,
+    APPLY_VALUE_FLAGS,
+    /* @__PURE__ */ new Set(["--secrets-stdin"]),
+    true
+  );
+  if (parsed.approvals.length > 0) {
+    return jsonResponse(errorPayload("USAGE_ERROR", "setup doctor does not accept --approve."), ExitCode.UsageError);
+  }
+  if (parsed.errors.length > 0) {
+    return jsonResponse(errorPayload("USAGE_ERROR", "Invalid setup doctor arguments.", parsed.errors), ExitCode.UsageError);
+  }
+  const planPath = parsed.flags["--plan"];
+  if (!planPath) {
+    return jsonResponse(errorPayload("USAGE_ERROR", "--plan <file> is required."), ExitCode.UsageError);
+  }
+  let secrets = { values: {}, sources: {} };
+  try {
+    const plan = loadPlan(planPath, deps.cwd);
+    secrets = await resolveSecrets(parsed, deps);
+    if (plan.provider === "azure-devops") {
+      const checks = [];
+      const inspection = await deps.azureProvider.inspectExecutionDefinition(plan, secrets.values.azureDevOpsProviderToken ?? secrets.values.azureDevOpsAdminToken);
+      checks.push({ id: "pipeline-azure", status: inspection.found ? "pass" : "fail", message: inspection.message });
+      const variables = await deps.azureProvider.inspectCallbackSecretMetadata(plan, secrets.values.azureDevOpsAdminToken);
+      const missing = plan.azureDevOps.requiredSecrets.filter((item) => !variables.names.has(item.repositorySecretName));
+      checks.push({ id: "callback-secret-metadata", status: variables.verified && missing.length === 0 ? "pass" : variables.verified ? "fail" : "warn", message: variables.message });
+      const profiles = requireServiceData(await context.invokeForgeContract("listScenarioAutomationProfiles", { context: { projectKey: plan.project.key } }), "listScenarioAutomationProfiles");
+      const profile = profiles.find((item) => item.label === plan.jiraProfile.label);
+      const config = profile?.config;
+      const matches = profile?.provider === "azureDevops" && profile.enabled === plan.jiraProfile.enabled && profile.hasSecret && config?.organization === plan.jiraProfile.config.organization && config?.project === plan.jiraProfile.config.project && config?.pipelineId === plan.jiraProfile.config.pipelineId && config?.apiVersion === plan.jiraProfile.config.apiVersion && config?.bodyTemplate === plan.jiraProfile.config.bodyTemplate;
+      checks.push({ id: "jira-profile", status: matches ? "pass" : "fail", message: matches ? "Jira automation profile fields match and Forge reports a stored provider secret." : "Jira automation profile is missing, differs, or lacks provider secret metadata." });
+      if (plan.jiraProfile.setProjectDefault) checks.push({ id: "jira-project-default", status: profile?.isProjectDefault ? "pass" : "fail", message: profile?.isProjectDefault ? "Jira automation profile is the project default." : "Jira automation profile is not the project default." });
+      const status = doctorStatus(checks);
+      return jsonResponse({ schemaVersion: DOCTOR_RESULT_SCHEMA_VERSION, planId: plan.planId, provider: plan.provider, status, exitCode: status === "fail" ? ExitCode.ValidationError : ExitCode.Success, externalRunTriggered: false, checks });
+    }
+    const repoRoot = import_node_path15.default.resolve(deps.cwd, parsed.flags["--repo-root"] ?? ".");
+    const summary = await inspectPlan(plan, repoRoot, secrets, context, deps);
+    return jsonResponse(summary, summary.exitCode);
+  } catch (error) {
+    return jsonResponse(
+      errorPayload(errorCodeForError(error, "DOCTOR_FAILED"), safeErrorMessage(error, secrets)),
+      exitCodeForError(error)
+    );
+  }
+}
+function createSetupHandler(overrides = {}) {
+  const deps = {
+    cwd: overrides.cwd ?? process.cwd(),
+    env: overrides.env ?? process.env,
+    readStdin: overrides.readStdin ?? defaultReadStdin,
+    githubProvider: overrides.githubProvider ?? new GitHubSetupProvider(overrides.githubProviderDeps),
+    azureProvider: overrides.azureProvider ?? new AzureDevOpsSetupProvider()
+  };
+  return async (request, context) => {
+    const [subcommand, ...args] = request.args;
+    if (subcommand === "plan") {
+      return planCommand(args, deps);
+    }
+    if (subcommand === "apply") {
+      return applyCommand(args, context, deps);
+    }
+    if (subcommand === "doctor") {
+      return doctorCommand(args, context, deps);
+    }
+    return jsonResponse(
+      errorPayload("USAGE_ERROR", `Unsupported setup subcommand ${subcommand ?? "<missing>"}.`),
+      ExitCode.UsageError
+    );
+  };
+}
+
 // src/suites.ts
 var CONFIG_FLAGS9 = /* @__PURE__ */ new Set([
   "--config",
@@ -16049,7 +17737,7 @@ var CONFIG_FLAGS9 = /* @__PURE__ */ new Set([
   "--jira-email",
   "--jira-api-token"
 ]);
-function parseArgs10(args) {
+function parseArgs11(args) {
   const flags = {};
   const boolFlags = /* @__PURE__ */ new Set();
   const unknownFlags = [];
@@ -16169,7 +17857,7 @@ function createSuitesHandler(deps = {}) {
   const env = deps.env ?? process.env;
   return async (request, context) => {
     const [subcommand, ...restArgs] = request.args;
-    const parsed = parseArgs10(restArgs);
+    const parsed = parseArgs11(restArgs);
     const useJson = parsed.boolFlags.has("--json");
     const config = resolveCliConfig(pickConfigArgs9(parsed), env, cwd);
     const projectKey = config.values.projectKey;
@@ -16343,7 +18031,7 @@ var CONFIG_FLAGS10 = /* @__PURE__ */ new Set([
   "--jira-api-token"
 ]);
 var RECONCILE_CONFIRM_TOKEN = "RECONCILE";
-function parseArgs11(args) {
+function parseArgs12(args) {
   const flags = {};
   const boolFlags = /* @__PURE__ */ new Set();
   const unknownFlags = [];
@@ -16432,7 +18120,7 @@ function createSyncHandler(deps = {}) {
   const env = deps.env ?? process.env;
   return async (request, context) => {
     const [subcommand, ...restArgs] = request.args;
-    const parsed = parseArgs11(restArgs);
+    const parsed = parseArgs12(restArgs);
     const useJson = parsed.boolFlags.has("--json");
     const config = resolveCliConfig(pickConfigArgs10(parsed), env, cwd);
     const projectKey = config.values.projectKey;
@@ -16592,6 +18280,12 @@ var COMMAND_REGISTRY = [
     subcommands: ["show"],
     handler: createRunsHandler()
   },
+  {
+    name: "setup",
+    description: "Plan, apply, and verify provider onboarding without duplicating Forge domain logic",
+    subcommands: ["plan", "apply", "doctor"],
+    handler: createSetupHandler()
+  },
   {
     name: "suites",
     description: "Hierarchy-aware suite browse commands",