@automatify-au/cli 0.1.12 → 0.1.13

package/README.md

@@ -261,7 +261,7 @@ Current authentication boundary:
 - Setup does not turn this into an all-user auth model. Customer-admin packaging and any future user-level authentication remain separate work.
 - The same callback key may be stored as a GitHub Actions repository secret only under the explicit `github-secrets` apply scope.
 
-Azure DevOps follow-up is deliberately outside this stage. The next adapter should reuse the same plan/apply/doctor orchestration and mutation scopes, map Azure organization/project/pipeline/ref fields into the existing `azureDevops` Forge profile config, manage callback pipeline variables through stdin/safe references, inspect pipeline metadata without queueing a run, and preserve the same confirmation/idempotency/redaction rules.
+Azure DevOps setup uses the same plan/apply/doctor safety boundary. Generate a plan with `--provider azure-devops`, mapping `--organization`, `--azure-project`, `--pipeline-id`, and `--ref` into the existing `azureDevops` Forge profile. Callback pipeline variables are accepted only through stdin or `--secret-ref key=env:NAME`; dry-run, explicit approval, idempotency, and redaction are identical to GitHub setup. Doctor inspects pipeline metadata and variable names only; it never queues a pipeline run.
 
 ## Allure Evidence for Jira
 

package/dist/automatify.cjs

@@ -16668,18 +16668,137 @@ var GitHubSetupProvider = class {
   }
 };
 
+// src/azureDevOpsSetupProvider.ts
+var isRecord3 = (v) => Boolean(v) && typeof v === "object" && !Array.isArray(v);
+async function adoGet(fetchImpl, url, token) {
+  const response = await fetchImpl(url, { headers: { accept: "application/json", ...token ? { authorization: `Basic ${Buffer.from(`:${token}`).toString("base64")}` } : {} } });
+  const text = await response.text();
+  let body = {};
+  try {
+    body = text ? JSON.parse(text) : {};
+  } catch {
+  }
+  return { ok: response.ok, status: response.status, body };
+}
+async function setAzurePipelineVariableWithRest(input, fetchImpl) {
+  const base = `https://dev.azure.com/${encodeURIComponent(input.organization)}/${encodeURIComponent(input.project)}/_apis/build/definitions/${encodeURIComponent(input.pipelineId)}`;
+  const auth = { authorization: `Basic ${Buffer.from(`:${input.token}`).toString("base64")}` };
+  const current = await adoGet(fetchImpl, `${base}?api-version=7.1`, input.token);
+  if (!current.ok || !isRecord3(current.body)) throw new Error(`Azure DevOps build definition could not be read (HTTP ${current.status}).`);
+  const variables = isRecord3(current.body.variables) ? { ...current.body.variables } : {};
+  variables[input.name] = { value: input.value, isSecret: true };
+  const query = new URLSearchParams({
+    "api-version": "7.1",
+    secretsSourceDefinitionId: String(current.body.id),
+    secretsSourceDefinitionRevision: String(current.body.revision)
+  });
+  const response = await fetchImpl(`${base}?${query.toString()}`, { method: "PUT", headers: { ...auth, "content-type": "application/json", accept: "application/json" }, body: JSON.stringify({ ...current.body, variables }) });
+  if (!response.ok) throw new Error(`Azure DevOps pipeline variable update failed (HTTP ${response.status}).`);
+}
+var AzureDevOpsSetupProvider = class {
+  name = "azure-devops";
+  fetchImpl;
+  setter;
+  constructor(deps = {}) {
+    this.fetchImpl = deps.fetchImpl ?? fetch;
+    this.setter = deps.setPipelineVariable ?? ((input) => setAzurePipelineVariableWithRest(input, this.fetchImpl));
+  }
+  async inspectExecutionDefinition(plan, token) {
+    const a = plan.azureDevOps;
+    const url = `https://dev.azure.com/${encodeURIComponent(a.organization)}/${encodeURIComponent(a.project)}/_apis/build/definitions/${encodeURIComponent(a.pipelineId)}?api-version=${encodeURIComponent(a.apiVersion)}`;
+    const result = await adoGet(this.fetchImpl, url, token);
+    if (!result.ok) return { found: false, message: result.status === 404 ? "Azure DevOps pipeline was not found." : `Azure DevOps pipeline metadata could not be verified (HTTP ${result.status}).` };
+    const body = isRecord3(result.body) ? result.body : {};
+    const name = typeof body.name === "string" ? body.name : void 0;
+    return { found: true, active: true, path: name, message: `Azure DevOps pipeline ${name ?? a.pipelineId} is reachable. Inspection never queues a run.` };
+  }
+  async inspectCallbackSecretMetadata(plan, token) {
+    if (!token) return { verified: false, names: /* @__PURE__ */ new Set(), message: "Azure DevOps pipeline variable metadata was not verified because azureDevOpsAdminToken was not provided. Secret values are never readable." };
+    const a = plan.azureDevOps;
+    const url = `https://dev.azure.com/${encodeURIComponent(a.organization)}/${encodeURIComponent(a.project)}/_apis/build/definitions/${encodeURIComponent(a.pipelineId)}?api-version=${encodeURIComponent(a.apiVersion)}`;
+    const result = await adoGet(this.fetchImpl, url, token);
+    if (!result.ok) throw new Error(`Azure DevOps pipeline metadata request failed with HTTP ${result.status}.`);
+    const variables = isRecord3(result.body) && isRecord3(result.body.variables) ? result.body.variables : {};
+    return { verified: true, names: new Set(Object.keys(variables)), message: `Verified ${Object.keys(variables).length} Azure DevOps pipeline variable name(s); secret values remain unreadable.` };
+  }
+  async setCallbackSecret(plan, secret, value, adminToken) {
+    if (!this.setter) throw new Error("Azure DevOps pipeline variable setter is not configured; use the safe Azure CLI adapter.");
+    await this.setter({ organization: plan.azureDevOps.organization, project: plan.azureDevOps.project, pipelineId: plan.azureDevOps.pipelineId, name: secret.repositorySecretName, value, token: adminToken });
+  }
+};
+
+// src/azureDevOpsSetupPlan.ts
+var import_node_crypto2 = require("node:crypto");
+var digest = (v) => `sha256:${(0, import_node_crypto2.createHash)("sha256").update(JSON.stringify(v)).digest("hex")}`;
+var required = (value, field) => {
+  const result = value.trim();
+  if (!result) throw new Error(`${field} is required.`);
+  return result;
+};
+var variableName = (value, field) => {
+  const result = required(value, field).toUpperCase();
+  if (!/^[A-Z_][A-Z0-9_]*$/.test(result)) throw new Error(`${field} is invalid.`);
+  return result;
+};
+function buildAzureDevOpsSetupPlan(input) {
+  const projectKey = required(input.projectKey, "project key").toUpperCase();
+  if (!/^[A-Z][A-Z0-9_]{1,31}$/.test(projectKey)) throw new Error("project key is invalid.");
+  const organization = required(input.organization, "organization");
+  const azureProject = required(input.azureProject, "Azure project");
+  const pipelineId = required(input.pipelineId, "pipeline id");
+  if (!/^\d+$/.test(pipelineId)) throw new Error("pipeline id must be numeric.");
+  const ref = required(input.ref, "ref");
+  const apiVersion = required(input.apiVersion ?? "7.1", "api version");
+  const profileLabel = required(input.profileLabel, "profile label");
+  const endpointName = variableName(input.callbackEndpointVariableName, "callback endpoint variable name");
+  const tokenName = variableName(input.callbackAuthTokenVariableName, "callback auth token variable name");
+  if (endpointName === tokenName) throw new Error("callback variable names must be distinct.");
+  const requiredSecrets = [{ repositorySecretName: endpointName, valueKey: "callbackEndpoint", purpose: "Forge callback endpoint pipeline variable." }, { repositorySecretName: tokenName, valueKey: "callbackAuthToken", purpose: "Forge callback auth token pipeline variable." }];
+  const scopes = ["provider-secrets", "jira-profile", ...input.setProjectDefault ? ["project-default"] : []];
+  const actions = scopes.map((scope) => ({ id: scope === "provider-secrets" ? "set-provider-secrets" : scope === "jira-profile" ? "upsert-jira-profile" : "set-project-default", scope, summary: `Apply ${scope} for Azure DevOps.`, mutates: "jira" }));
+  const withoutId = { schemaVersion: "automatify.testops.setup/v1", kind: "AutomatifyTestOpsSetupPlan", provider: "azure-devops", project: { key: projectKey }, azureDevOps: { organization, project: azureProject, pipelineId, ref, apiVersion, requiredSecrets, guidance: { authentication: "Use an Azure DevOps PAT with least-privilege pipeline read/manage-variable access.", permissions: ["Pipelines: read for doctor; manage variables only for explicit provider-secrets apply."], remoteChangesExcluded: ["accounts", "credentials", "commits", "pull requests", "pipeline runs"] } }, jiraProfile: { label: profileLabel, enabled: input.enabled, provider: "azureDevops", config: { organization, project: azureProject, pipelineId, apiVersion, bodyTemplate: JSON.stringify({ resources: { repositories: { self: { refName: ref } } } }) }, setProjectDefault: input.setProjectDefault }, actions, smokeValidation: [{ id: "pipeline-content", verifies: "Azure DevOps pipeline metadata without queueing a run.", triggersExternalRun: false }, { id: "pipeline-variable-metadata", verifies: "Required variable names; values remain unreadable.", triggersExternalRun: false }, { id: "jira-profile", verifies: "Forge automation profile and optional default.", triggersExternalRun: false }], rollback: actions.map((a) => ({ actionId: a.id, strategy: "Restore the previous state manually; secret values cannot be read back.", automatic: false })), followUp: { azureDevOps: "Azure DevOps setup is implemented through this provider-neutral plan/apply/doctor boundary." } };
+  return { ...withoutId, planId: digest(withoutId) };
+}
+function validateAzureDevOpsSetupPlan(value) {
+  const errors = [];
+  const record = value;
+  const exact = (v, keys) => Boolean(v && typeof v === "object" && !Array.isArray(v) && Object.keys(v).sort().join() === [...keys].sort().join());
+  if (!exact(value, ["schemaVersion", "kind", "planId", "provider", "project", "azureDevOps", "jiraProfile", "actions", "smokeValidation", "rollback", "followUp"])) errors.push("Plan has missing or unsupported top-level fields.");
+  if (record?.schemaVersion !== "automatify.testops.setup/v1" || record?.kind !== "AutomatifyTestOpsSetupPlan" || record?.provider !== "azure-devops") errors.push("Plan schema, kind, or provider is invalid.");
+  if (!exact(record?.project, ["key"]) || !/^[A-Z][A-Z0-9_]{1,31}$/.test(record?.project?.key ?? "")) errors.push("project.key is invalid.");
+  const a = record?.azureDevOps;
+  if (!exact(a, ["organization", "project", "pipelineId", "ref", "apiVersion", "requiredSecrets", "guidance"]) || ![a?.organization, a?.project, a?.ref, a?.apiVersion].every((x) => typeof x === "string" && x.trim()) || !/^\d+$/.test(a?.pipelineId ?? "")) errors.push("azureDevOps has an invalid shape or fields.");
+  if (!Array.isArray(a?.requiredSecrets) || a.requiredSecrets.length !== 2 || new Set(a.requiredSecrets.map((s) => s.repositorySecretName)).size !== 2 || new Set(a.requiredSecrets.map((s) => s.valueKey)).size !== 2 || !a.requiredSecrets.some((s) => s.valueKey === "callbackEndpoint") || !a.requiredSecrets.some((s) => s.valueKey === "callbackAuthToken") || !a.requiredSecrets.every((s) => exact(s, ["repositorySecretName", "valueKey", "purpose"]) && /^[A-Z_][A-Z0-9_]*$/.test(s.repositorySecretName) && s.purpose)) errors.push("azureDevOps.requiredSecrets is invalid.");
+  const p = record?.jiraProfile;
+  if (!exact(p, ["label", "enabled", "provider", "config", "setProjectDefault"]) || p?.provider !== "azureDevops" || !exact(p?.config, ["organization", "project", "pipelineId", "apiVersion", "bodyTemplate"]) || p.config.organization !== a?.organization || p.config.project !== a?.project || p.config.pipelineId !== a?.pipelineId || p.config.apiVersion !== a?.apiVersion) errors.push("jiraProfile/config is invalid or inconsistent.");
+  const ids = p?.setProjectDefault ? ["set-provider-secrets", "upsert-jira-profile", "set-project-default"] : ["set-provider-secrets", "upsert-jira-profile"];
+  const scopes = p?.setProjectDefault ? ["provider-secrets", "jira-profile", "project-default"] : ["provider-secrets", "jira-profile"];
+  if (!Array.isArray(record?.actions) || record.actions.map((x) => x.id).join() !== ids.join() || !record.actions.every((x, i) => exact(x, ["id", "scope", "summary", "mutates"]) && x.scope === scopes[i] && x.mutates === "jira")) errors.push("actions are invalid.");
+  const smokeIds = ["pipeline-content", "pipeline-variable-metadata", "jira-profile"];
+  if (!Array.isArray(record?.smokeValidation) || record.smokeValidation.length !== 3 || !record.smokeValidation.every((x, i) => exact(x, ["id", "verifies", "triggersExternalRun"]) && x.id === smokeIds[i] && x.triggersExternalRun === false)) errors.push("smokeValidation is invalid.");
+  if (!Array.isArray(record?.rollback) || record.rollback.length !== ids.length || !record.rollback.every((x, i) => exact(x, ["actionId", "strategy", "automatic"]) && x.actionId === ids[i] && x.automatic === false)) errors.push("rollback is invalid.");
+  if (errors.length === 0) {
+    const { planId, ...rest } = record;
+    if (planId !== digest(rest)) errors.push("planId does not match the plan contents.");
+  }
+  return errors.length ? { ok: false, errors } : { ok: true, errors, plan: value };
+}
+
 // src/setup.ts
 var APPLY_RESULT_SCHEMA_VERSION = "automatify.testops.setup.apply/v1";
 var DOCTOR_RESULT_SCHEMA_VERSION = "automatify.testops.setup.doctor/v1";
 var SECRET_KEYS = [
   "githubProviderToken",
   "githubAdminToken",
+  "azureDevOpsProviderToken",
+  "azureDevOpsAdminToken",
   "callbackEndpoint",
   "callbackAuthToken"
 ];
 var MUTATION_SCOPES = [
   "workflow-file",
   "github-secrets",
+  "provider-secrets",
   "jira-profile",
   "project-default"
 ];
@@ -16704,7 +16823,13 @@ var PLAN_VALUE_FLAGS = /* @__PURE__ */ new Set([
   "--workflow-source",
   "--profile-label",
   "--callback-endpoint-secret-name",
-  "--callback-auth-token-secret-name"
+  "--callback-auth-token-secret-name",
+  "--organization",
+  "--azure-project",
+  "--pipeline-id",
+  "--api-version",
+  "--callback-endpoint-variable-name",
+  "--callback-auth-token-variable-name"
 ]);
 var APPLY_VALUE_FLAGS = /* @__PURE__ */ new Set(["--plan", "--repo-root"]);
 var APPLY_BOOL_FLAGS = /* @__PURE__ */ new Set([
@@ -16815,7 +16940,7 @@ function loadPlan(planPath, cwd) {
       ExitCode.ValidationError
     );
   }
-  const validation = validateSetupPlan(parsed);
+  const validation = isAzurePlanValue(parsed) ? validateAzureDevOpsSetupPlan(parsed) : validateSetupPlan(parsed);
   if (!validation.ok || !validation.plan) {
     throw new SetupCommandError(
       "PLAN_VALIDATION_ERROR",
@@ -16825,6 +16950,9 @@ function loadPlan(planPath, cwd) {
   }
   return validation.plan;
 }
+function isAzurePlanValue(value) {
+  return Boolean(value && typeof value === "object" && value.provider === "azure-devops");
+}
 function isSecretKey(value) {
   return SECRET_KEYS.includes(value);
 }
@@ -17320,7 +17448,27 @@ function planCommand(args, deps) {
   if (parsed.errors.length > 0) {
     return jsonResponse(errorPayload("USAGE_ERROR", "Invalid setup plan arguments.", parsed.errors), ExitCode.UsageError);
   }
-  if ((parsed.flags["--provider"] ?? "github-actions") !== "github-actions") {
+  const provider = parsed.flags["--provider"] ?? "github-actions";
+  if (provider === "azure-devops") {
+    try {
+      return jsonResponse(buildAzureDevOpsSetupPlan({
+        projectKey: parsed.flags["--project-key"] ?? "",
+        organization: parsed.flags["--organization"] ?? "",
+        azureProject: parsed.flags["--azure-project"] ?? "",
+        pipelineId: parsed.flags["--pipeline-id"] ?? "",
+        ref: parsed.flags["--ref"] ?? "main",
+        apiVersion: parsed.flags["--api-version"],
+        profileLabel: parsed.flags["--profile-label"] ?? "Azure DevOps",
+        enabled: !parsed.boolFlags.has("--disabled"),
+        setProjectDefault: parsed.boolFlags.has("--set-default"),
+        callbackEndpointVariableName: parsed.flags["--callback-endpoint-variable-name"] ?? "TESTOPS_FORGE_ENDPOINT",
+        callbackAuthTokenVariableName: parsed.flags["--callback-auth-token-variable-name"] ?? "TESTOPS_FORGE_AUTH_TOKEN"
+      }));
+    } catch (error) {
+      return jsonResponse(errorPayload("VALIDATION_ERROR", safeErrorMessage(error)), ExitCode.ValidationError);
+    }
+  }
+  if (provider !== "github-actions") {
     return jsonResponse(
       errorPayload("VALIDATION_ERROR", "Only github-actions is implemented in this stage; Azure DevOps is the documented next adapter."),
       ExitCode.ValidationError
@@ -17369,8 +17517,11 @@ async function applyCommand(args, context, deps) {
   const actionResults = [];
   try {
     const plan = loadPlan(planPath, deps.cwd);
-    const scopes = approvedScopes(plan, parsed, dryRun);
     secrets = await resolveSecrets(parsed, deps);
+    if (plan.provider === "azure-devops") {
+      return await applyAzureCommand(plan, parsed, context, deps, secrets);
+    }
+    const scopes = approvedScopes(plan, parsed, dryRun);
     const repoRoot = import_node_path15.default.resolve(deps.cwd, parsed.flags["--repo-root"] ?? ".");
     const rotateSecrets = parsed.boolFlags.has("--rotate-secrets");
     const rotateProviderToken = parsed.boolFlags.has("--rotate-provider-token");
@@ -17469,6 +17620,40 @@ async function applyCommand(args, context, deps) {
     );
   }
 }
+async function applyAzureCommand(plan, parsed, context, deps, secrets) {
+  const dryRun = parsed.boolFlags.has("--dry-run");
+  const scopes = approvedScopes(plan, parsed, dryRun);
+  const profiles = requireServiceData(await context.invokeForgeContract("listScenarioAutomationProfiles", { context: { projectKey: plan.project.key } }), "listScenarioAutomationProfiles");
+  const current = profiles.find((item) => item.label === plan.jiraProfile.label);
+  if (!dryRun && scopes.includes("provider-secrets") && !secrets.values.azureDevOpsAdminToken) throw new SetupCommandError("SECRET_INPUT_REQUIRED", "azureDevOpsAdminToken is required for the approved Azure DevOps pipeline-variable scope.", ExitCode.ValidationError);
+  const results = [];
+  const secretNames = scopes.includes("provider-secrets") && secrets.values.azureDevOpsAdminToken ? (await deps.azureProvider.inspectCallbackSecretMetadata(plan, secrets.values.azureDevOpsAdminToken)).names : void 0;
+  let appliedProfile = current;
+  for (const action of plan.actions) {
+    if (!scopes.includes(action.scope)) {
+      results.push({ id: action.id, scope: action.scope, status: "skipped", message: "Action was not in the explicit approval scope.", rollback: { available: false, guidance: "No mutation occurred." } });
+      continue;
+    }
+    if (action.scope === "provider-secrets") {
+      const pending = plan.azureDevOps.requiredSecrets.filter((item) => parsed.boolFlags.has("--rotate-secrets") || !secretNames?.has(item.repositorySecretName));
+      if (!dryRun && pending.some((item) => !secrets.values[item.valueKey])) throw new SetupCommandError("SECRET_INPUT_REQUIRED", "Azure DevOps callback secrets are required for approved pipeline variable changes.", ExitCode.ValidationError);
+      if (!dryRun) for (const item of pending) await deps.azureProvider.setCallbackSecret(plan, item, secrets.values[item.valueKey], secrets.values.azureDevOpsAdminToken);
+      results.push({ id: action.id, scope: action.scope, status: dryRun ? "planned" : pending.length ? "updated" : "skipped", message: "Azure DevOps pipeline variable names are managed without printing secret values.", rollback: { available: false, guidance: rollbackFor(plan, action.id) } });
+    } else if (action.scope === "jira-profile") {
+      const rotateProvider = parsed.boolFlags.has("--rotate-provider-token");
+      if (!dryRun && (!current?.hasSecret || rotateProvider) && !secrets.values.azureDevOpsProviderToken) throw new SetupCommandError("SECRET_INPUT_REQUIRED", "azureDevOpsProviderToken is required to create or rotate the Azure provider PAT.", ExitCode.ValidationError);
+      const profile = dryRun ? current ?? { id: "<created-by-forge>", projectKey: plan.project.key, label: plan.jiraProfile.label, provider: "azureDevops", authType: "basicPat", method: "POST", endpointSummary: "<computed-by-forge>", config: plan.jiraProfile.config, enabled: plan.jiraProfile.enabled, hasSecret: false, createdAt: "", updatedAt: "" } : requireServiceData(await context.invokeForgeContract("upsertScenarioAutomationProfile", { context: { projectKey: plan.project.key }, input: { profileId: current?.id, label: plan.jiraProfile.label, provider: "azureDevops", config: plan.jiraProfile.config, enabled: plan.jiraProfile.enabled, secretToken: !current?.hasSecret || rotateProvider ? secrets.values.azureDevOpsProviderToken : void 0 } }), "upsertScenarioAutomationProfile");
+      appliedProfile = profile;
+      results.push({ id: action.id, scope: action.scope, status: dryRun ? "planned" : current ? "updated" : "created", message: "Azure DevOps Jira automation profile applied through the existing Forge contract.", rollback: { available: !dryRun, guidance: rollbackFor(plan, action.id) } });
+    } else if (action.scope === "project-default" && appliedProfile && !dryRun) {
+      requireServiceData(await context.invokeForgeContract("setScenarioAutomationDefaultProfile", { context: { projectKey: plan.project.key }, profileId: appliedProfile.id }), "setScenarioAutomationDefaultProfile");
+      results.push({ id: action.id, scope: action.scope, status: "updated", message: "Set the Azure DevOps Jira automation profile as project default.", rollback: { available: true, guidance: rollbackFor(plan, action.id) } });
+    } else if (action.scope === "project-default") {
+      results.push({ id: action.id, scope: action.scope, status: "planned", message: "Set the Azure DevOps Jira automation profile as project default.", rollback: { available: false, guidance: rollbackFor(plan, action.id) } });
+    }
+  }
+  return jsonResponse({ schemaVersion: APPLY_RESULT_SCHEMA_VERSION, planId: plan.planId, provider: plan.provider, status: dryRun ? "dry-run" : "applied", dryRun, confirmed: !dryRun, approvedScopes: scopes, actions: results, smokeValidation: { status: "not-run", externalRunTriggered: false } });
+}
 async function doctorCommand(args, context, deps) {
   const parsed = parseArgs10(
     args,
@@ -17490,6 +17675,22 @@ async function doctorCommand(args, context, deps) {
   try {
     const plan = loadPlan(planPath, deps.cwd);
     secrets = await resolveSecrets(parsed, deps);
+    if (plan.provider === "azure-devops") {
+      const checks = [];
+      const inspection = await deps.azureProvider.inspectExecutionDefinition(plan, secrets.values.azureDevOpsProviderToken ?? secrets.values.azureDevOpsAdminToken);
+      checks.push({ id: "pipeline-azure", status: inspection.found ? "pass" : "fail", message: inspection.message });
+      const variables = await deps.azureProvider.inspectCallbackSecretMetadata(plan, secrets.values.azureDevOpsAdminToken);
+      const missing = plan.azureDevOps.requiredSecrets.filter((item) => !variables.names.has(item.repositorySecretName));
+      checks.push({ id: "callback-secret-metadata", status: variables.verified && missing.length === 0 ? "pass" : variables.verified ? "fail" : "warn", message: variables.message });
+      const profiles = requireServiceData(await context.invokeForgeContract("listScenarioAutomationProfiles", { context: { projectKey: plan.project.key } }), "listScenarioAutomationProfiles");
+      const profile = profiles.find((item) => item.label === plan.jiraProfile.label);
+      const config = profile?.config;
+      const matches = profile?.provider === "azureDevops" && profile.enabled === plan.jiraProfile.enabled && profile.hasSecret && config?.organization === plan.jiraProfile.config.organization && config?.project === plan.jiraProfile.config.project && config?.pipelineId === plan.jiraProfile.config.pipelineId && config?.apiVersion === plan.jiraProfile.config.apiVersion && config?.bodyTemplate === plan.jiraProfile.config.bodyTemplate;
+      checks.push({ id: "jira-profile", status: matches ? "pass" : "fail", message: matches ? "Jira automation profile fields match and Forge reports a stored provider secret." : "Jira automation profile is missing, differs, or lacks provider secret metadata." });
+      if (plan.jiraProfile.setProjectDefault) checks.push({ id: "jira-project-default", status: profile?.isProjectDefault ? "pass" : "fail", message: profile?.isProjectDefault ? "Jira automation profile is the project default." : "Jira automation profile is not the project default." });
+      const status = doctorStatus(checks);
+      return jsonResponse({ schemaVersion: DOCTOR_RESULT_SCHEMA_VERSION, planId: plan.planId, provider: plan.provider, status, exitCode: status === "fail" ? ExitCode.ValidationError : ExitCode.Success, externalRunTriggered: false, checks });
+    }
     const repoRoot = import_node_path15.default.resolve(deps.cwd, parsed.flags["--repo-root"] ?? ".");
     const summary = await inspectPlan(plan, repoRoot, secrets, context, deps);
     return jsonResponse(summary, summary.exitCode);
@@ -17505,7 +17706,8 @@ function createSetupHandler(overrides = {}) {
     cwd: overrides.cwd ?? process.cwd(),
     env: overrides.env ?? process.env,
     readStdin: overrides.readStdin ?? defaultReadStdin,
-    githubProvider: overrides.githubProvider ?? new GitHubSetupProvider(overrides.githubProviderDeps)
+    githubProvider: overrides.githubProvider ?? new GitHubSetupProvider(overrides.githubProviderDeps),
+    azureProvider: overrides.azureProvider ?? new AzureDevOpsSetupProvider()
   };
   return async (request, context) => {
     const [subcommand, ...args] = request.args;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automatify-au/cli",
-  "version": "0.1.12",
+  "version": "0.1.13",
   "description": "Forge-first CLI for Automatify Jira TestOps",
   "type": "module",
   "bin": {