@automatify-au/cli 0.1.12 → 0.1.14

package/dist/automatify.cjs

@@ -10817,7 +10817,9 @@ function readConfigFile(configPath) {
 function writeConfigFile(configPath, file) {
   (0, import_node_fs.writeFileSync)(configPath, `${JSON.stringify(file, null, 2)}
 `, "utf8");
-  (0, import_node_fs.chmodSync)(configPath, 384);
+  if (process.platform !== "win32") {
+    (0, import_node_fs.chmodSync)(configPath, 384);
+  }
 }
 function normalizeBaseUrl(value) {
   if (value.endsWith("/")) {
@@ -10852,6 +10854,41 @@ function setKeychainSecret(account, value) {
     stdio: ["ignore", "ignore", "pipe"]
   });
 }
+function protectWindowsSecret(value) {
+  const script = [
+    "Add-Type -AssemblyName System.Security",
+    "$plain = [Console]::In.ReadToEnd()",
+    "$bytes = [Text.Encoding]::UTF8.GetBytes($plain)",
+    "$cipher = [System.Security.Cryptography.ProtectedData]::Protect($bytes, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)",
+    "[Console]::Out.Write([Convert]::ToBase64String($cipher))"
+  ].join("; ");
+  return (0, import_node_child_process.execFileSync)("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], {
+    input: value,
+    encoding: "utf8",
+    stdio: ["pipe", "pipe", "pipe"]
+  }).trim();
+}
+function unprotectWindowsSecret(protectedValue) {
+  if (!protectedValue || process.platform !== "win32") {
+    return "";
+  }
+  const script = [
+    "Add-Type -AssemblyName System.Security",
+    "$encoded = [Console]::In.ReadToEnd()",
+    "$cipher = [Convert]::FromBase64String($encoded)",
+    "$bytes = [System.Security.Cryptography.ProtectedData]::Unprotect($cipher, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)",
+    "[Console]::Out.Write([Text.Encoding]::UTF8.GetString($bytes))"
+  ].join("; ");
+  try {
+    return (0, import_node_child_process.execFileSync)("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], {
+      input: protectedValue,
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "ignore"]
+    }).trim();
+  } catch {
+    return "";
+  }
+}
 function valueFromPrecedence(key, flagValue, envValue, fileValue, fallback = "") {
   if (flagValue) {
     return { value: flagValue, source: "flag" };
@@ -10926,7 +10963,8 @@ function resolveCliConfig(args, env = process.env, cwd = process.cwd()) {
   const forgeAuthTokenFromEnv = toStringValue(env.TESTOPS_FORGE_AUTH_TOKEN);
   const forgeAuthTokenFromFile = toStringValue(file.forgeAuthToken ?? file.TESTOPS_FORGE_AUTH_TOKEN);
   const forgeAuthTokenFromKeychain = forgeAuthTokenFromEnv || forgeAuthTokenFromFile || !forgeAuthTokenKeychainAccountResolved.value ? "" : readKeychainSecret(forgeAuthTokenKeychainAccountResolved.value);
-  const forgeAuthTokenResolved = forgeAuthTokenFromEnv ? { value: forgeAuthTokenFromEnv, source: "env" } : forgeAuthTokenFromFile ? { value: forgeAuthTokenFromFile, source: "file" } : forgeAuthTokenFromKeychain ? { value: forgeAuthTokenFromKeychain, source: "keychain" } : { value: "", source: "default" };
+  const forgeAuthTokenFromWindowsStore = forgeAuthTokenFromEnv || forgeAuthTokenFromFile || forgeAuthTokenFromKeychain ? "" : unprotectWindowsSecret(toStringValue(file.forgeAuthTokenProtected));
+  const forgeAuthTokenResolved = forgeAuthTokenFromEnv ? { value: forgeAuthTokenFromEnv, source: "env" } : forgeAuthTokenFromFile ? { value: forgeAuthTokenFromFile, source: "file" } : forgeAuthTokenFromKeychain ? { value: forgeAuthTokenFromKeychain, source: "keychain" } : forgeAuthTokenFromWindowsStore ? { value: forgeAuthTokenFromWindowsStore, source: "secure-store" } : { value: "", source: "default" };
   const config = {
     baseUrl: normalizeBaseUrl(baseUrlResolved.value),
     projectKey: projectKeyResolved.value,
@@ -11054,12 +11092,44 @@ function applyConfigSet(configPath, rawKey, value) {
   }
   const file = readConfigFile(configPath);
   if (key === "forgeAuthToken") {
+    if (process.platform === "win32") {
+      try {
+        const protectedValue = protectWindowsSecret(value);
+        writeConfigFile(configPath, {
+          ...file,
+          forgeAuthToken: void 0,
+          TESTOPS_FORGE_AUTH_TOKEN: void 0,
+          forgeAuthTokenKeychainAccount: void 0,
+          forgeAuthTokenProtected: protectedValue
+        });
+        return {
+          exitCode: ExitCode.Success,
+          stdout: ["Config updated: forgeAuthToken protected with Windows DPAPI for the current user."]
+        };
+      } catch (error) {
+        return {
+          exitCode: ExitCode.ValidationError,
+          stderr: [
+            `Unable to store forgeAuthToken securely: ${error instanceof Error ? error.message : "unknown secure-storage error"}`
+          ]
+        };
+      }
+    }
+    if (process.platform !== "darwin") {
+      return {
+        exitCode: ExitCode.UsageError,
+        stderr: [
+          "Secure local forgeAuthToken storage is currently supported on macOS and Windows. On Linux/CI, set TESTOPS_FORGE_AUTH_TOKEN in the environment."
+        ]
+      };
+    }
     const account = toStringValue(file.forgeAuthTokenKeychainAccount) || defaultKeychainAccount(configPath);
     setKeychainSecret(account, value);
     const nextFile2 = {
       ...file,
       forgeAuthToken: void 0,
       TESTOPS_FORGE_AUTH_TOKEN: void 0,
+      forgeAuthTokenProtected: void 0,
       forgeAuthTokenKeychainAccount: account
     };
     writeConfigFile(configPath, nextFile2);
@@ -11093,7 +11163,11 @@ function createConfigHandler(env = process.env, cwd = process.cwd()) {
       if (validation.ok) {
         return {
           exitCode: ExitCode.Success,
-          stdout: ["Config validation: PASS", ...toDisplayLines(resolution), ...validation.warnings.map((line) => `WARN: ${line}`)]
+          stdout: [
+            "Config validation: PASS",
+            ...toDisplayLines(resolution),
+            ...validation.warnings.map((line) => `WARN: ${line}`)
+          ]
         };
       }
       return {
@@ -11506,9 +11580,11 @@ function normalizePath(pathValue) {
   return pathValue.replaceAll("\\", "/");
 }
 function discoverFeatureFiles(scannedFiles) {
-  const featurePaths = [...new Set(
-    scannedFiles.map((filePath) => normalizePath(filePath)).filter((filePath) => filePath.toLowerCase().endsWith(".feature"))
-  )].sort((a, b) => a.localeCompare(b));
+  const featurePaths = [
+    ...new Set(
+      scannedFiles.map((filePath) => normalizePath(filePath)).filter((filePath) => filePath.toLowerCase().endsWith(".feature"))
+    )
+  ].sort((a, b) => a.localeCompare(b));
   return {
     total: featurePaths.length,
     paths: featurePaths,
@@ -11747,12 +11823,7 @@ function scanProjectFiles(options) {
 }
 
 // src/auto.ts
-var DETERMINISTIC_STEPS = [
-  "detect",
-  "discover",
-  "map-preview",
-  "upload"
-];
+var DETERMINISTIC_STEPS = ["detect", "discover", "map-preview", "upload"];
 function parseArgs(args) {
   const flags = {};
   const boolFlags = /* @__PURE__ */ new Set();
@@ -12400,10 +12471,7 @@ function createAutoHandler(deps = {}) {
         const diagnostic = diagMissingProjectContext();
         return {
           exitCode: ExitCode.ValidationError,
-          stderr: [
-            `ERROR: ${diagnostic.code}: ${diagnostic.message}`,
-            `SUGGESTION: ${diagnostic.suggestion}`
-          ]
+          stderr: [`ERROR: ${diagnostic.code}: ${diagnostic.message}`, `SUGGESTION: ${diagnostic.suggestion}`]
         };
       }
       execution = await executeUploadFlow({
@@ -13024,17 +13092,19 @@ function createAllureOpenHandler(deps = {}) {
       if (useJson) {
         return {
           exitCode: ExitCode.Success,
-          stdout: toJsonLine(buildJsonOutput({
-            zipPath,
-            dryRun: true,
-            served: false,
-            opened: false,
-            keep,
-            extractDir: extractDirRaw,
-            rootDir: extractDirRaw,
-            indexPath,
-            summary
-          }))
+          stdout: toJsonLine(
+            buildJsonOutput({
+              zipPath,
+              dryRun: true,
+              served: false,
+              opened: false,
+              keep,
+              extractDir: extractDirRaw,
+              rootDir: extractDirRaw,
+              indexPath,
+              summary
+            })
+          )
         };
       }
       return {
@@ -13084,20 +13154,24 @@ function createAllureOpenHandler(deps = {}) {
       }
     }
     if (useJson) {
-      logger.log(JSON.stringify(buildJsonOutput({
-        zipPath,
-        dryRun: false,
-        served: true,
-        opened,
-        keep,
-        extractDir: extractResult.extractDir,
-        rootDir: extractResult.rootDir,
-        indexPath: extractResult.indexPath,
-        url: serverHandle.url,
-        port: serverHandle.port,
-        host: serverHandle.host,
-        summary
-      })));
+      logger.log(
+        JSON.stringify(
+          buildJsonOutput({
+            zipPath,
+            dryRun: false,
+            served: true,
+            opened,
+            keep,
+            extractDir: extractResult.extractDir,
+            rootDir: extractResult.rootDir,
+            indexPath: extractResult.indexPath,
+            url: serverHandle.url,
+            port: serverHandle.port,
+            host: serverHandle.host,
+            summary
+          })
+        )
+      );
     } else {
       logger.log(`Allure report extracted to ${extractResult.extractDir}.`);
       if (verbose) {
@@ -13385,13 +13459,15 @@ function createAllureHandler(deps = {}) {
           if (useJson) {
             return {
               exitCode: ExitCode.Success,
-              stdout: toJsonLine(buildDownloadJsonOutput({
-                issueKey: issueKey2,
-                dryRun: true,
-                downloaded: false,
-                attachment: selected,
-                outputPath
-              }))
+              stdout: toJsonLine(
+                buildDownloadJsonOutput({
+                  issueKey: issueKey2,
+                  dryRun: true,
+                  downloaded: false,
+                  attachment: selected,
+                  outputPath
+                })
+              )
             };
           }
           return {
@@ -13418,13 +13494,15 @@ function createAllureHandler(deps = {}) {
         if (useJson) {
           return {
             exitCode: ExitCode.Success,
-            stdout: toJsonLine(buildDownloadJsonOutput({
-              issueKey: issueKey2,
-              dryRun: false,
-              downloaded: true,
-              attachment: downloaded,
-              outputPath
-            }))
+            stdout: toJsonLine(
+              buildDownloadJsonOutput({
+                issueKey: issueKey2,
+                dryRun: false,
+                downloaded: true,
+                attachment: downloaded,
+                outputPath
+              })
+            )
           };
         }
         return {
@@ -13472,14 +13550,16 @@ function createAllureHandler(deps = {}) {
       if (useJson) {
         return {
           exitCode: ExitCode.Success,
-          stdout: toJsonLine(buildJsonOutput2({
-            issueKey,
-            uploaded: false,
-            commentAdded: false,
-            dryRun: true,
-            summary,
-            attachment: { filename: attachmentFilename }
-          }))
+          stdout: toJsonLine(
+            buildJsonOutput2({
+              issueKey,
+              uploaded: false,
+              commentAdded: false,
+              dryRun: true,
+              summary,
+              attachment: { filename: attachmentFilename }
+            })
+          )
         };
       }
       return {
@@ -13515,14 +13595,16 @@ function createAllureHandler(deps = {}) {
       if (useJson) {
         return {
           exitCode: ExitCode.Success,
-          stdout: toJsonLine(buildJsonOutput2({
-            issueKey,
-            uploaded: true,
-            commentAdded,
-            dryRun: false,
-            summary,
-            attachment
-          }))
+          stdout: toJsonLine(
+            buildJsonOutput2({
+              issueKey,
+              uploaded: true,
+              commentAdded,
+              dryRun: false,
+              summary,
+              attachment
+            })
+          )
         };
       }
       return {
@@ -13860,9 +13942,11 @@ function parseScenarioFeatureFile(raw, filePath) {
   if (!featureName || !scenarioName || !scenarioKey || steps.length === 0 || scenarioCount !== 1) {
     return null;
   }
-  const linkedIssueKeys = [...new Set(
-    tags.map((tag) => tag.replace(/^@/, "").trim().toUpperCase()).filter((tag) => ISSUE_KEY_PATTERN.test(tag))
-  )];
+  const linkedIssueKeys = [
+    ...new Set(
+      tags.map((tag) => tag.replace(/^@/, "").trim().toUpperCase()).filter((tag) => ISSUE_KEY_PATTERN.test(tag))
+    )
+  ];
   return {
     scenarioKey,
     featureName,
@@ -14060,7 +14144,9 @@ function createBddHandler(deps = {}) {
             stderr: [`ERROR: ${result.error.code}: ${result.error.message}`]
           };
         }
-        const features = (featureId ? result.data.filter((feature) => feature.id === featureId) : result.data).sort((left, right) => left.payload.name.localeCompare(right.payload.name) || left.createdAt.localeCompare(right.createdAt));
+        const features = (featureId ? result.data.filter((feature) => feature.id === featureId) : result.data).sort(
+          (left, right) => left.payload.name.localeCompare(right.payload.name) || left.createdAt.localeCompare(right.createdAt)
+        );
         if (featureId && features.length === 0) {
           return {
             exitCode: ExitCode.RemoteError,
@@ -14180,7 +14266,9 @@ function createBddHandler(deps = {}) {
                 stderr: [`ERROR: ${scenariosResult.error.code}: ${scenariosResult.error.message}`]
               };
             }
-            const selectedScenarios = exportAll ? [...scenariosResult.data].sort((left, right) => (left.key ?? left.id).localeCompare(right.key ?? right.id)) : scenariosResult.data.filter(
+            const selectedScenarios = exportAll ? [...scenariosResult.data].sort(
+              (left, right) => (left.key ?? left.id).localeCompare(right.key ?? right.id)
+            ) : scenariosResult.data.filter(
               (item) => item.id === scenarioSelector2 || (item.key ?? "").toUpperCase() === scenarioSelector2.toUpperCase()
             );
             if (!exportAll && selectedScenarios.length === 0) {
@@ -14326,7 +14414,9 @@ function createBddHandler(deps = {}) {
               if (!scenario) {
                 return {
                   exitCode: ExitCode.RemoteError,
-                  stderr: [`ERROR: NOT_FOUND: BDD scenario ${parsedScenario.scenarioKey} was not found in this project.`]
+                  stderr: [
+                    `ERROR: NOT_FOUND: BDD scenario ${parsedScenario.scenarioKey} was not found in this project.`
+                  ]
                 };
               }
               const nextTags = parsedScenario.tags.filter((tag) => !SCENARIO_METADATA_PATTERN.test(tag));
@@ -14432,7 +14522,9 @@ function createBddHandler(deps = {}) {
         if (!scenarioId && !testCaseKey) {
           return {
             exitCode: ExitCode.ValidationError,
-            stderr: ["ERROR: Provide either --id <SCENARIO_ID> or --test-case-key <TC-197> for testops bdd scenarios run."]
+            stderr: [
+              "ERROR: Provide either --id <SCENARIO_ID> or --test-case-key <TC-197> for testops bdd scenarios run."
+            ]
           };
         }
         try {
@@ -14706,10 +14798,7 @@ function listToLines(items) {
   if (items.length === 0) {
     return ["Test cases: 0", "No test cases found for the selected context."];
   }
-  return [
-    `Test cases: ${items.length}`,
-    ...items.map((item) => `- ${item.key} [${item.status}] ${item.title}`)
-  ];
+  return [`Test cases: ${items.length}`, ...items.map((item) => `- ${item.key} [${item.status}] ${item.title}`)];
 }
 function showToLines(testCase) {
   return [
@@ -15009,11 +15098,7 @@ var CONFIG_FLAGS5 = /* @__PURE__ */ new Set([
   "--jira-email",
   "--jira-api-token"
 ]);
-var DIRECT_JIRA_FLAGS = /* @__PURE__ */ new Set([
-  "--site",
-  "--email",
-  "--api-token"
-]);
+var DIRECT_JIRA_FLAGS = /* @__PURE__ */ new Set(["--site", "--email", "--api-token"]);
 function parseArgs6(args) {
   const flags = {};
   const boolFlags = /* @__PURE__ */ new Set();
@@ -15213,27 +15298,33 @@ function createDoctorHandler(deps = {}) {
           message: "Issue access check skipped. Pass --issue-key to verify Jira read/download access for a specific issue."
         });
       }
-      checks.push(commandCheck(
-        { execFileSync: runCommand },
-        "unzip",
-        ["-v"],
-        "unzip is available for manual ZIP inspection.",
-        "unzip was not found. The future built-in opener can avoid this, but manual inspection will be less convenient."
-      ));
-      checks.push(commandCheck(
-        { execFileSync: runCommand },
-        "java",
-        ["-version"],
-        "Java is available for optional raw allure-results workflows.",
-        "Java was not found. This does not block generated Allure HTML ZIP upload/download/open; it only matters for raw allure-results generation."
-      ));
-      checks.push(commandCheck(
-        { execFileSync: runCommand },
-        "allure",
-        ["--version"],
-        "Allure CLI is available for optional raw allure-results workflows.",
-        "Allure CLI was not found. This does not block generated Allure HTML ZIP upload/download/open."
-      ));
+      checks.push(
+        commandCheck(
+          { execFileSync: runCommand },
+          "unzip",
+          ["-v"],
+          "unzip is available for manual ZIP inspection.",
+          "unzip was not found. The future built-in opener can avoid this, but manual inspection will be less convenient."
+        )
+      );
+      checks.push(
+        commandCheck(
+          { execFileSync: runCommand },
+          "java",
+          ["-version"],
+          "Java is available for optional raw allure-results workflows.",
+          "Java was not found. This does not block generated Allure HTML ZIP upload/download/open; it only matters for raw allure-results generation."
+        )
+      );
+      checks.push(
+        commandCheck(
+          { execFileSync: runCommand },
+          "allure",
+          ["--version"],
+          "Allure CLI is available for optional raw allure-results workflows.",
+          "Allure CLI was not found. This does not block generated Allure HTML ZIP upload/download/open."
+        )
+      );
       const summary2 = {
         status: computeOverallStatus(checks),
         checks
@@ -15272,9 +15363,7 @@ function createDoctorHandler(deps = {}) {
         message: "Forge endpoint is configured."
       });
     }
-    const hasContext = Boolean(
-      resolution.values.projectKey || resolution.values.issueKey
-    );
+    const hasContext = Boolean(resolution.values.projectKey || resolution.values.issueKey);
     if (enforceContextCheck || hasContext) {
       if (!hasContext) {
         checks.push({
@@ -15501,11 +15590,7 @@ function createIngestFeatureHandler(deps = {}) {
         }
         return {
           exitCode: ExitCode.RemoteError,
-          stdout: [
-            "Feature ingestion: FAILED",
-            `Feature: ${name}`,
-            `Source: ${useStdin ? "stdin" : sourceFile}`
-          ],
+          stdout: ["Feature ingestion: FAILED", `Feature: ${name}`, `Source: ${useStdin ? "stdin" : sourceFile}`],
           stderr: [`ERROR: ${result.error.code}: ${result.error.message}`]
         };
       }
@@ -15546,11 +15631,7 @@ function createIngestFeatureHandler(deps = {}) {
       }
       return {
         exitCode: ExitCode.TransportError,
-        stdout: [
-          "Feature ingestion: FAILED",
-          `Feature: ${name}`,
-          `Source: ${useStdin ? "stdin" : sourceFile}`
-        ],
+        stdout: ["Feature ingestion: FAILED", `Feature: ${name}`, `Source: ${useStdin ? "stdin" : sourceFile}`],
         stderr: [`ERROR: ${normalizeError5(error)}`]
       };
     }
@@ -16145,14 +16226,8 @@ function buildGitHubSetupPlan(input) {
   const workflowId = requireNonEmpty(input.workflowId, "workflow id");
   const workflowPath = normalizeWorkflowPath(input.workflowPath);
   const profileLabel = requireNonEmpty(input.profileLabel, "profile label");
-  const endpointSecretName = normalizeSecretName(
-    input.callbackEndpointSecretName,
-    "callback endpoint secret name"
-  );
-  const tokenSecretName = normalizeSecretName(
-    input.callbackAuthTokenSecretName,
-    "callback auth token secret name"
-  );
+  const endpointSecretName = normalizeSecretName(input.callbackEndpointSecretName, "callback endpoint secret name");
+  const tokenSecretName = normalizeSecretName(input.callbackAuthTokenSecretName, "callback auth token secret name");
   if (endpointSecretName === tokenSecretName) {
     throw new Error("callback endpoint and auth token secret names must be different.");
   }
@@ -16211,13 +16286,7 @@ function buildGitHubSetupPlan(input) {
           "Secrets: read/write metadata only for the explicit github-secrets apply scope.",
           "Contents: read for doctor; this command never creates commits or pull requests."
         ],
-        remoteChangesExcluded: [
-          "accounts",
-          "credentials",
-          "commits",
-          "pull requests",
-          "workflow runs"
-        ]
+        remoteChangesExcluded: ["accounts", "credentials", "commits", "pull requests", "workflow runs"]
       }
     },
     jiraProfile: {
@@ -16435,15 +16504,7 @@ function validateSetupPlan(value) {
     errors.push("project.key is required.");
   }
   const github = value.github;
-  if (!isRecord(github) || !hasExactKeys(github, [
-    "owner",
-    "repository",
-    "ref",
-    "workflowId",
-    "workflowFile",
-    "requiredSecrets",
-    "guidance"
-  ])) {
+  if (!isRecord(github) || !hasExactKeys(github, ["owner", "repository", "ref", "workflowId", "workflowFile", "requiredSecrets", "guidance"])) {
     errors.push("github has an invalid shape.");
   } else {
     for (const field of ["owner", "repository", "ref", "workflowId"]) {
@@ -16520,6 +16581,8 @@ function hashSetupContent(value) {
 }
 
 // src/githubSetupProvider.ts
+var GITHUB_SECRET_PAGE_SIZE = 100;
+var MAX_GITHUB_SECRET_PAGES = 100;
 function isRecord2(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -16551,18 +16614,14 @@ async function githubApi(fetchImpl, url, token) {
 }
 async function setGitHubRepositorySecretWithCli(input) {
   await new Promise((resolve, reject) => {
-    const child = (0, import_node_child_process4.spawn)(
-      "gh",
-      ["secret", "set", input.name, "--repo", `${input.owner}/${input.repository}`],
-      {
-        shell: false,
-        stdio: ["pipe", "ignore", "pipe"],
-        env: {
-          ...process.env,
-          GH_TOKEN: input.adminToken
-        }
+    const child = (0, import_node_child_process4.spawn)("gh", ["secret", "set", input.name, "--repo", `${input.owner}/${input.repository}`], {
+      shell: false,
+      stdio: ["pipe", "ignore", "pipe"],
+      env: {
+        ...process.env,
+        GH_TOKEN: input.adminToken
       }
-    );
+    });
     let stderr = "";
     child.stderr.setEncoding("utf8");
     child.stderr.on("data", (chunk) => {
@@ -16622,6 +16681,7 @@ var GitHubSetupProvider = class {
     return {
       found: true,
       active: state === "active",
+      state,
       path: workflowPath,
       contentSha256,
       message: state !== "active" ? `GitHub workflow is registered but its state is ${state ?? "unknown"}.` : workflowPath !== workflowFile.path ? `GitHub workflow path ${workflowPath ?? "<unknown>"} does not match ${workflowFile.path}.` : contentSha256 === workflowFile.sha256 ? "GitHub workflow is active and its content matches the approved plan." : "GitHub workflow metadata is reachable, but the approved ref content could not be confirmed as an exact plan match."
@@ -16636,25 +16696,52 @@ var GitHubSetupProvider = class {
       };
     }
     const { owner, repository } = plan.github;
-    const url = `https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}/actions/secrets?per_page=100`;
-    const response = await githubApi(this.fetchImpl, url, adminToken);
-    if (!response.ok) {
-      throw new Error(
-        `GitHub repository secret metadata request failed with HTTP ${response.status}: ${safeGitHubMessage(response.body, "request failed")}`
-      );
-    }
+    const baseUrl = `https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}/actions/secrets`;
     const names = /* @__PURE__ */ new Set();
-    if (isRecord2(response.body) && Array.isArray(response.body.secrets)) {
-      for (const item of response.body.secrets) {
+    let totalCount;
+    let pagesRead = 0;
+    for (let page = 1; page <= MAX_GITHUB_SECRET_PAGES; page += 1) {
+      const url = `${baseUrl}?per_page=${GITHUB_SECRET_PAGE_SIZE}&page=${page}`;
+      const response = await githubApi(this.fetchImpl, url, adminToken);
+      if (!response.ok) {
+        throw new Error(
+          `GitHub repository secret metadata request failed on page ${page} with HTTP ${response.status}: ${safeGitHubMessage(response.body, "request failed")}`
+        );
+      }
+      const body = isRecord2(response.body) ? response.body : {};
+      if (totalCount === void 0 && typeof body.total_count === "number" && Number.isFinite(body.total_count)) {
+        totalCount = Math.max(0, Math.trunc(body.total_count));
+      }
+      const secrets = Array.isArray(body.secrets) ? body.secrets : [];
+      const before = names.size;
+      for (const item of secrets) {
         if (isRecord2(item) && typeof item.name === "string") {
           names.add(item.name);
         }
       }
+      pagesRead = page;
+      if (totalCount !== void 0 && names.size >= totalCount) {
+        break;
+      }
+      if (secrets.length < GITHUB_SECRET_PAGE_SIZE) {
+        if (totalCount !== void 0 && names.size < totalCount) {
+          throw new Error(
+            `GitHub repository secret metadata pagination ended early after ${names.size} of ${totalCount} secret name(s).`
+          );
+        }
+        break;
+      }
+      if (names.size === before) {
+        throw new Error("GitHub repository secret metadata pagination made no progress.");
+      }
+      if (page === MAX_GITHUB_SECRET_PAGES) {
+        throw new Error(`GitHub repository secret metadata exceeded ${MAX_GITHUB_SECRET_PAGES} pages.`);
+      }
     }
     return {
       verified: true,
       names,
-      message: `Verified ${names.size} GitHub repository secret name(s); values remain unreadable.`
+      message: `Verified ${names.size} GitHub repository secret name(s) across ${pagesRead} page(s); values remain unreadable.`
     };
   }
   async setCallbackSecret(plan, secret, value, adminToken) {
@@ -16668,18 +16755,295 @@ var GitHubSetupProvider = class {
   }
 };
 
+// src/azureDevOpsSetupProvider.ts
+var isRecord3 = (v) => Boolean(v) && typeof v === "object" && !Array.isArray(v);
+async function adoGet(fetchImpl, url, token) {
+  const response = await fetchImpl(url, {
+    headers: {
+      accept: "application/json",
+      ...token ? { authorization: `Basic ${Buffer.from(`:${token}`).toString("base64")}` } : {}
+    }
+  });
+  const text = await response.text();
+  let body = {};
+  try {
+    body = text ? JSON.parse(text) : {};
+  } catch {
+  }
+  return { ok: response.ok, status: response.status, body };
+}
+async function setAzurePipelineVariableWithRest(input, fetchImpl) {
+  const base = `https://dev.azure.com/${encodeURIComponent(input.organization)}/${encodeURIComponent(input.project)}/_apis/build/definitions/${encodeURIComponent(input.pipelineId)}`;
+  const auth = { authorization: `Basic ${Buffer.from(`:${input.token}`).toString("base64")}` };
+  const current = await adoGet(fetchImpl, `${base}?api-version=7.1`, input.token);
+  if (!current.ok || !isRecord3(current.body))
+    throw new Error(`Azure DevOps build definition could not be read (HTTP ${current.status}).`);
+  const variables = isRecord3(current.body.variables) ? { ...current.body.variables } : {};
+  variables[input.name] = { value: input.value, isSecret: true };
+  const query = new URLSearchParams({
+    "api-version": "7.1",
+    secretsSourceDefinitionId: String(current.body.id),
+    secretsSourceDefinitionRevision: String(current.body.revision)
+  });
+  const response = await fetchImpl(`${base}?${query.toString()}`, {
+    method: "PUT",
+    headers: { ...auth, "content-type": "application/json", accept: "application/json" },
+    body: JSON.stringify({ ...current.body, variables })
+  });
+  if (!response.ok) throw new Error(`Azure DevOps pipeline variable update failed (HTTP ${response.status}).`);
+}
+function azurePipelineStateMessage(name, queueStatus) {
+  switch (queueStatus) {
+    case "enabled":
+      return `Azure DevOps pipeline ${name} is reachable and enabled. Inspection never queues a run.`;
+    case "paused":
+      return `Azure DevOps pipeline ${name} is reachable but paused; builds may be queued but will not start until the definition is enabled.`;
+    case "disabled":
+      return `Azure DevOps pipeline ${name} is reachable but disabled; new builds cannot be queued until the definition is enabled.`;
+    default:
+      return `Azure DevOps pipeline ${name} is reachable, but its queue status is ${queueStatus ?? "unknown"}.`;
+  }
+}
+var AzureDevOpsSetupProvider = class {
+  name = "azure-devops";
+  fetchImpl;
+  setter;
+  constructor(deps = {}) {
+    this.fetchImpl = deps.fetchImpl ?? fetch;
+    this.setter = deps.setPipelineVariable ?? ((input) => setAzurePipelineVariableWithRest(input, this.fetchImpl));
+  }
+  async inspectExecutionDefinition(plan, token) {
+    const a = plan.azureDevOps;
+    const url = `https://dev.azure.com/${encodeURIComponent(a.organization)}/${encodeURIComponent(a.project)}/_apis/build/definitions/${encodeURIComponent(a.pipelineId)}?api-version=${encodeURIComponent(a.apiVersion)}`;
+    const result = await adoGet(this.fetchImpl, url, token);
+    if (!result.ok)
+      return {
+        found: false,
+        message: result.status === 404 ? "Azure DevOps pipeline was not found." : `Azure DevOps pipeline metadata could not be verified (HTTP ${result.status}).`
+      };
+    const body = isRecord3(result.body) ? result.body : {};
+    const name = typeof body.name === "string" ? body.name : a.pipelineId;
+    const queueStatus = typeof body.queueStatus === "string" ? body.queueStatus : void 0;
+    return {
+      found: true,
+      active: queueStatus === "enabled",
+      state: queueStatus,
+      path: name,
+      message: azurePipelineStateMessage(name, queueStatus)
+    };
+  }
+  async inspectCallbackSecretMetadata(plan, token) {
+    if (!token)
+      return {
+        verified: false,
+        names: /* @__PURE__ */ new Set(),
+        message: "Azure DevOps pipeline variable metadata was not verified because azureDevOpsAdminToken was not provided. Secret values are never readable."
+      };
+    const a = plan.azureDevOps;
+    const url = `https://dev.azure.com/${encodeURIComponent(a.organization)}/${encodeURIComponent(a.project)}/_apis/build/definitions/${encodeURIComponent(a.pipelineId)}?api-version=${encodeURIComponent(a.apiVersion)}`;
+    const result = await adoGet(this.fetchImpl, url, token);
+    if (!result.ok) throw new Error(`Azure DevOps pipeline metadata request failed with HTTP ${result.status}.`);
+    const variables = isRecord3(result.body) && isRecord3(result.body.variables) ? result.body.variables : {};
+    return {
+      verified: true,
+      names: new Set(Object.keys(variables)),
+      message: `Verified ${Object.keys(variables).length} Azure DevOps pipeline variable name(s); secret values remain unreadable.`
+    };
+  }
+  async setCallbackSecret(plan, secret, value, adminToken) {
+    if (!this.setter)
+      throw new Error("Azure DevOps pipeline variable setter is not configured; use the safe Azure CLI adapter.");
+    await this.setter({
+      organization: plan.azureDevOps.organization,
+      project: plan.azureDevOps.project,
+      pipelineId: plan.azureDevOps.pipelineId,
+      name: secret.repositorySecretName,
+      value,
+      token: adminToken
+    });
+  }
+};
+
+// src/azureDevOpsSetupPlan.ts
+var import_node_crypto2 = require("node:crypto");
+var digest = (v) => `sha256:${(0, import_node_crypto2.createHash)("sha256").update(JSON.stringify(v)).digest("hex")}`;
+var required = (value, field) => {
+  const result = value.trim();
+  if (!result) throw new Error(`${field} is required.`);
+  return result;
+};
+var variableName = (value, field) => {
+  const result = required(value, field).toUpperCase();
+  if (!/^[A-Z_][A-Z0-9_]*$/.test(result)) throw new Error(`${field} is invalid.`);
+  return result;
+};
+function buildAzureDevOpsSetupPlan(input) {
+  const projectKey = required(input.projectKey, "project key").toUpperCase();
+  if (!/^[A-Z][A-Z0-9_]{1,31}$/.test(projectKey)) throw new Error("project key is invalid.");
+  const organization = required(input.organization, "organization");
+  const azureProject = required(input.azureProject, "Azure project");
+  const pipelineId = required(input.pipelineId, "pipeline id");
+  if (!/^\d+$/.test(pipelineId)) throw new Error("pipeline id must be numeric.");
+  const ref = required(input.ref, "ref");
+  const apiVersion = required(input.apiVersion ?? "7.1", "api version");
+  const profileLabel = required(input.profileLabel, "profile label");
+  const endpointName = variableName(input.callbackEndpointVariableName, "callback endpoint variable name");
+  const tokenName = variableName(input.callbackAuthTokenVariableName, "callback auth token variable name");
+  if (endpointName === tokenName) throw new Error("callback variable names must be distinct.");
+  const requiredSecrets = [
+    {
+      repositorySecretName: endpointName,
+      valueKey: "callbackEndpoint",
+      purpose: "Forge callback endpoint pipeline variable."
+    },
+    {
+      repositorySecretName: tokenName,
+      valueKey: "callbackAuthToken",
+      purpose: "Forge callback auth token pipeline variable."
+    }
+  ];
+  const scopes = [
+    "provider-secrets",
+    "jira-profile",
+    ...input.setProjectDefault ? ["project-default"] : []
+  ];
+  const actions = scopes.map((scope) => ({
+    id: scope === "provider-secrets" ? "set-provider-secrets" : scope === "jira-profile" ? "upsert-jira-profile" : "set-project-default",
+    scope,
+    summary: `Apply ${scope} for Azure DevOps.`,
+    mutates: "jira"
+  }));
+  const withoutId = {
+    schemaVersion: "automatify.testops.setup/v1",
+    kind: "AutomatifyTestOpsSetupPlan",
+    provider: "azure-devops",
+    project: { key: projectKey },
+    azureDevOps: {
+      organization,
+      project: azureProject,
+      pipelineId,
+      ref,
+      apiVersion,
+      requiredSecrets,
+      guidance: {
+        authentication: "Use an Azure DevOps PAT with least-privilege pipeline read/manage-variable access.",
+        permissions: ["Pipelines: read for doctor; manage variables only for explicit provider-secrets apply."],
+        remoteChangesExcluded: ["accounts", "credentials", "commits", "pull requests", "pipeline runs"]
+      }
+    },
+    jiraProfile: {
+      label: profileLabel,
+      enabled: input.enabled,
+      provider: "azureDevops",
+      config: {
+        organization,
+        project: azureProject,
+        pipelineId,
+        apiVersion,
+        bodyTemplate: JSON.stringify({ resources: { repositories: { self: { refName: ref } } } })
+      },
+      setProjectDefault: input.setProjectDefault
+    },
+    actions,
+    smokeValidation: [
+      {
+        id: "pipeline-content",
+        verifies: "Azure DevOps pipeline metadata without queueing a run.",
+        triggersExternalRun: false
+      },
+      {
+        id: "pipeline-variable-metadata",
+        verifies: "Required variable names; values remain unreadable.",
+        triggersExternalRun: false
+      },
+      {
+        id: "jira-profile",
+        verifies: "Forge automation profile and optional default.",
+        triggersExternalRun: false
+      }
+    ],
+    rollback: actions.map((a) => ({
+      actionId: a.id,
+      strategy: "Restore the previous state manually; secret values cannot be read back.",
+      automatic: false
+    })),
+    followUp: {
+      azureDevOps: "Azure DevOps setup is implemented through this provider-neutral plan/apply/doctor boundary."
+    }
+  };
+  return { ...withoutId, planId: digest(withoutId) };
+}
+function validateAzureDevOpsSetupPlan(value) {
+  const errors = [];
+  const record = value;
+  const exact = (v, keys) => Boolean(
+    v && typeof v === "object" && !Array.isArray(v) && Object.keys(v).sort().join() === [...keys].sort().join()
+  );
+  if (!exact(value, [
+    "schemaVersion",
+    "kind",
+    "planId",
+    "provider",
+    "project",
+    "azureDevOps",
+    "jiraProfile",
+    "actions",
+    "smokeValidation",
+    "rollback",
+    "followUp"
+  ]))
+    errors.push("Plan has missing or unsupported top-level fields.");
+  if (record?.schemaVersion !== "automatify.testops.setup/v1" || record?.kind !== "AutomatifyTestOpsSetupPlan" || record?.provider !== "azure-devops")
+    errors.push("Plan schema, kind, or provider is invalid.");
+  if (!exact(record?.project, ["key"]) || !/^[A-Z][A-Z0-9_]{1,31}$/.test(record?.project?.key ?? ""))
+    errors.push("project.key is invalid.");
+  const a = record?.azureDevOps;
+  if (!exact(a, ["organization", "project", "pipelineId", "ref", "apiVersion", "requiredSecrets", "guidance"]) || ![a?.organization, a?.project, a?.ref, a?.apiVersion].every((x) => typeof x === "string" && x.trim()) || !/^\d+$/.test(a?.pipelineId ?? ""))
+    errors.push("azureDevOps has an invalid shape or fields.");
+  if (!Array.isArray(a?.requiredSecrets) || a.requiredSecrets.length !== 2 || new Set(a.requiredSecrets.map((s) => s.repositorySecretName)).size !== 2 || new Set(a.requiredSecrets.map((s) => s.valueKey)).size !== 2 || !a.requiredSecrets.some((s) => s.valueKey === "callbackEndpoint") || !a.requiredSecrets.some((s) => s.valueKey === "callbackAuthToken") || !a.requiredSecrets.every(
+    (s) => exact(s, ["repositorySecretName", "valueKey", "purpose"]) && /^[A-Z_][A-Z0-9_]*$/.test(s.repositorySecretName) && s.purpose
+  ))
+    errors.push("azureDevOps.requiredSecrets is invalid.");
+  const p = record?.jiraProfile;
+  if (!exact(p, ["label", "enabled", "provider", "config", "setProjectDefault"]) || p?.provider !== "azureDevops" || !exact(p?.config, ["organization", "project", "pipelineId", "apiVersion", "bodyTemplate"]) || p.config.organization !== a?.organization || p.config.project !== a?.project || p.config.pipelineId !== a?.pipelineId || p.config.apiVersion !== a?.apiVersion)
+    errors.push("jiraProfile/config is invalid or inconsistent.");
+  const ids = p?.setProjectDefault ? ["set-provider-secrets", "upsert-jira-profile", "set-project-default"] : ["set-provider-secrets", "upsert-jira-profile"];
+  const scopes = p?.setProjectDefault ? ["provider-secrets", "jira-profile", "project-default"] : ["provider-secrets", "jira-profile"];
+  if (!Array.isArray(record?.actions) || record.actions.map((x) => x.id).join() !== ids.join() || !record.actions.every(
+    (x, i) => exact(x, ["id", "scope", "summary", "mutates"]) && x.scope === scopes[i] && x.mutates === "jira"
+  ))
+    errors.push("actions are invalid.");
+  const smokeIds = ["pipeline-content", "pipeline-variable-metadata", "jira-profile"];
+  if (!Array.isArray(record?.smokeValidation) || record.smokeValidation.length !== 3 || !record.smokeValidation.every(
+    (x, i) => exact(x, ["id", "verifies", "triggersExternalRun"]) && x.id === smokeIds[i] && x.triggersExternalRun === false
+  ))
+    errors.push("smokeValidation is invalid.");
+  if (!Array.isArray(record?.rollback) || record.rollback.length !== ids.length || !record.rollback.every(
+    (x, i) => exact(x, ["actionId", "strategy", "automatic"]) && x.actionId === ids[i] && x.automatic === false
+  ))
+    errors.push("rollback is invalid.");
+  if (errors.length === 0) {
+    const { planId, ...rest } = record;
+    if (planId !== digest(rest)) errors.push("planId does not match the plan contents.");
+  }
+  return errors.length ? { ok: false, errors } : { ok: true, errors, plan: value };
+}
+
 // src/setup.ts
 var APPLY_RESULT_SCHEMA_VERSION = "automatify.testops.setup.apply/v1";
 var DOCTOR_RESULT_SCHEMA_VERSION = "automatify.testops.setup.doctor/v1";
 var SECRET_KEYS = [
   "githubProviderToken",
   "githubAdminToken",
+  "azureDevOpsProviderToken",
+  "azureDevOpsAdminToken",
   "callbackEndpoint",
   "callbackAuthToken"
 ];
 var MUTATION_SCOPES = [
   "workflow-file",
   "github-secrets",
+  "provider-secrets",
   "jira-profile",
   "project-default"
 ];
@@ -16704,7 +17068,13 @@ var PLAN_VALUE_FLAGS = /* @__PURE__ */ new Set([
   "--workflow-source",
   "--profile-label",
   "--callback-endpoint-secret-name",
-  "--callback-auth-token-secret-name"
+  "--callback-auth-token-secret-name",
+  "--organization",
+  "--azure-project",
+  "--pipeline-id",
+  "--api-version",
+  "--callback-endpoint-variable-name",
+  "--callback-auth-token-variable-name"
 ]);
 var APPLY_VALUE_FLAGS = /* @__PURE__ */ new Set(["--plan", "--repo-root"]);
 var APPLY_BOOL_FLAGS = /* @__PURE__ */ new Set([
@@ -16815,7 +17185,7 @@ function loadPlan(planPath, cwd) {
       ExitCode.ValidationError
     );
   }
-  const validation = validateSetupPlan(parsed);
+  const validation = isAzurePlanValue(parsed) ? validateAzureDevOpsSetupPlan(parsed) : validateSetupPlan(parsed);
   if (!validation.ok || !validation.plan) {
     throw new SetupCommandError(
       "PLAN_VALIDATION_ERROR",
@@ -16825,6 +17195,9 @@ function loadPlan(planPath, cwd) {
   }
   return validation.plan;
 }
+function isAzurePlanValue(value) {
+  return Boolean(value && typeof value === "object" && value.provider === "azure-devops");
+}
 function isSecretKey(value) {
   return SECRET_KEYS.includes(value);
 }
@@ -16844,14 +17217,26 @@ async function resolveSecrets(parsed, deps) {
       );
     }
     if (!envelope || typeof envelope !== "object" || Array.isArray(envelope)) {
-      throw new SetupCommandError("SECRET_INPUT_ERROR", "Secret stdin must be a JSON object.", ExitCode.ValidationError);
+      throw new SetupCommandError(
+        "SECRET_INPUT_ERROR",
+        "Secret stdin must be a JSON object.",
+        ExitCode.ValidationError
+      );
     }
     for (const [key, value] of Object.entries(envelope)) {
       if (!isSecretKey(key)) {
-        throw new SetupCommandError("SECRET_INPUT_ERROR", `Secret stdin contains unsupported key ${key}.`, ExitCode.ValidationError);
+        throw new SetupCommandError(
+          "SECRET_INPUT_ERROR",
+          `Secret stdin contains unsupported key ${key}.`,
+          ExitCode.ValidationError
+        );
       }
       if (typeof value !== "string" || !value.trim()) {
-        throw new SetupCommandError("SECRET_INPUT_ERROR", `Secret stdin key ${key} must be a non-empty string.`, ExitCode.ValidationError);
+        throw new SetupCommandError(
+          "SECRET_INPUT_ERROR",
+          `Secret stdin key ${key} must be a non-empty string.`,
+          ExitCode.ValidationError
+        );
       }
       values[key] = value.trim();
       sources[key] = "stdin";
@@ -16870,10 +17255,18 @@ async function resolveSecrets(parsed, deps) {
     }
     const envName = target.slice(4);
     if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(envName)) {
-      throw new SetupCommandError("SECRET_REFERENCE_ERROR", `Secret reference for ${key} has an invalid environment variable name.`, ExitCode.ValidationError);
+      throw new SetupCommandError(
+        "SECRET_REFERENCE_ERROR",
+        `Secret reference for ${key} has an invalid environment variable name.`,
+        ExitCode.ValidationError
+      );
     }
     if (sources[key]) {
-      throw new SetupCommandError("SECRET_REFERENCE_ERROR", `Secret ${key} was provided more than once.`, ExitCode.ValidationError);
+      throw new SetupCommandError(
+        "SECRET_REFERENCE_ERROR",
+        `Secret ${key} was provided more than once.`,
+        ExitCode.ValidationError
+      );
     }
     const value = deps.env[envName]?.trim();
     if (!value) {
@@ -16908,7 +17301,11 @@ function approvedScopes(plan, parsed, dryRun) {
       throw new SetupCommandError("APPROVAL_ERROR", `Unsupported approval scope ${scope}.`, ExitCode.UsageError);
     }
     if (!planScopes.includes(scope)) {
-      throw new SetupCommandError("APPROVAL_ERROR", `Approval scope ${scope} is not present in this plan.`, ExitCode.UsageError);
+      throw new SetupCommandError(
+        "APPROVAL_ERROR",
+        `Approval scope ${scope} is not present in this plan.`,
+        ExitCode.UsageError
+      );
     }
     expanded.add(scope);
   }
@@ -16981,10 +17378,7 @@ async function prepareState(plan, scopes, secrets, context, deps, dryRun, rotate
       );
     }
     if (secrets.values.githubAdminToken) {
-      const inspection = await deps.githubProvider.inspectCallbackSecretMetadata(
-        plan,
-        secrets.values.githubAdminToken
-      );
+      const inspection = await deps.githubProvider.inspectCallbackSecretMetadata(plan, secrets.values.githubAdminToken);
       repositorySecretNames = inspection.names;
       const secretsToWrite = plan.github.requiredSecrets.filter(
         (secret) => rotateSecrets || !repositorySecretNames?.has(secret.repositorySecretName)
@@ -17087,12 +17481,7 @@ async function applyGitHubSecrets(plan, state, secrets, deps, dryRun, rotateSecr
   }
   const adminToken = secrets.values.githubAdminToken;
   for (const secret of pending) {
-    await deps.githubProvider.setCallbackSecret(
-      plan,
-      secret,
-      secrets.values[secret.valueKey],
-      adminToken
-    );
+    await deps.githubProvider.setCallbackSecret(plan, secret, secrets.values[secret.valueKey], adminToken);
   }
   return {
     id: action.id,
@@ -17318,11 +17707,39 @@ async function inspectPlan(plan, repoRoot, secrets, context, deps) {
 function planCommand(args, deps) {
   const parsed = parseArgs10(args, PLAN_VALUE_FLAGS, /* @__PURE__ */ new Set(["--set-default", "--disabled"]));
   if (parsed.errors.length > 0) {
-    return jsonResponse(errorPayload("USAGE_ERROR", "Invalid setup plan arguments.", parsed.errors), ExitCode.UsageError);
+    return jsonResponse(
+      errorPayload("USAGE_ERROR", "Invalid setup plan arguments.", parsed.errors),
+      ExitCode.UsageError
+    );
   }
-  if ((parsed.flags["--provider"] ?? "github-actions") !== "github-actions") {
+  const provider = parsed.flags["--provider"] ?? "github-actions";
+  if (provider === "azure-devops") {
+    try {
+      return jsonResponse(
+        buildAzureDevOpsSetupPlan({
+          projectKey: parsed.flags["--project-key"] ?? "",
+          organization: parsed.flags["--organization"] ?? "",
+          azureProject: parsed.flags["--azure-project"] ?? "",
+          pipelineId: parsed.flags["--pipeline-id"] ?? "",
+          ref: parsed.flags["--ref"] ?? "main",
+          apiVersion: parsed.flags["--api-version"],
+          profileLabel: parsed.flags["--profile-label"] ?? "Azure DevOps",
+          enabled: !parsed.boolFlags.has("--disabled"),
+          setProjectDefault: parsed.boolFlags.has("--set-default"),
+          callbackEndpointVariableName: parsed.flags["--callback-endpoint-variable-name"] ?? "TESTOPS_FORGE_ENDPOINT",
+          callbackAuthTokenVariableName: parsed.flags["--callback-auth-token-variable-name"] ?? "TESTOPS_FORGE_AUTH_TOKEN"
+        })
+      );
+    } catch (error) {
+      return jsonResponse(errorPayload("VALIDATION_ERROR", safeErrorMessage(error)), ExitCode.ValidationError);
+    }
+  }
+  if (provider !== "github-actions") {
     return jsonResponse(
-      errorPayload("VALIDATION_ERROR", "Only github-actions is implemented in this stage; Azure DevOps is the documented next adapter."),
+      errorPayload(
+        "VALIDATION_ERROR",
+        "Only github-actions is implemented in this stage; Azure DevOps is the documented next adapter."
+      ),
       ExitCode.ValidationError
     );
   }
@@ -17343,16 +17760,16 @@ function planCommand(args, deps) {
     });
     return jsonResponse(plan);
   } catch (error) {
-    return jsonResponse(
-      errorPayload("VALIDATION_ERROR", safeErrorMessage(error)),
-      ExitCode.ValidationError
-    );
+    return jsonResponse(errorPayload("VALIDATION_ERROR", safeErrorMessage(error)), ExitCode.ValidationError);
   }
 }
 async function applyCommand(args, context, deps) {
   const parsed = parseArgs10(args, APPLY_VALUE_FLAGS, APPLY_BOOL_FLAGS, true);
   if (parsed.errors.length > 0) {
-    return jsonResponse(errorPayload("USAGE_ERROR", "Invalid setup apply arguments.", parsed.errors), ExitCode.UsageError);
+    return jsonResponse(
+      errorPayload("USAGE_ERROR", "Invalid setup apply arguments.", parsed.errors),
+      ExitCode.UsageError
+    );
   }
   const planPath = parsed.flags["--plan"];
   if (!planPath) {
@@ -17369,21 +17786,15 @@ async function applyCommand(args, context, deps) {
   const actionResults = [];
   try {
     const plan = loadPlan(planPath, deps.cwd);
-    const scopes = approvedScopes(plan, parsed, dryRun);
     secrets = await resolveSecrets(parsed, deps);
+    if (plan.provider === "azure-devops") {
+      return await applyAzureCommand(plan, parsed, context, deps, secrets);
+    }
+    const scopes = approvedScopes(plan, parsed, dryRun);
     const repoRoot = import_node_path15.default.resolve(deps.cwd, parsed.flags["--repo-root"] ?? ".");
     const rotateSecrets = parsed.boolFlags.has("--rotate-secrets");
     const rotateProviderToken = parsed.boolFlags.has("--rotate-provider-token");
-    const state = await prepareState(
-      plan,
-      scopes,
-      secrets,
-      context,
-      deps,
-      dryRun,
-      rotateSecrets,
-      rotateProviderToken
-    );
+    const state = await prepareState(plan, scopes, secrets, context, deps, dryRun, rotateSecrets, rotateProviderToken);
     let appliedProfile = state.matchingProfile;
     for (const action of plan.actions) {
       if (!scopes.includes(action.scope)) {
@@ -17402,14 +17813,7 @@ async function applyCommand(args, context, deps) {
         } else if (action.scope === "github-secrets") {
           actionResults.push(await applyGitHubSecrets(plan, state, secrets, deps, dryRun, rotateSecrets));
         } else if (action.scope === "jira-profile") {
-          const applied = await applyJiraProfile(
-            plan,
-            state,
-            secrets,
-            context,
-            dryRun,
-            rotateProviderToken
-          );
+          const applied = await applyJiraProfile(plan, state, secrets, context, dryRun, rotateProviderToken);
           appliedProfile = applied.profile;
           actionResults.push(applied.result);
         } else if (action.scope === "project-default") {
@@ -17469,18 +17873,149 @@ async function applyCommand(args, context, deps) {
     );
   }
 }
-async function doctorCommand(args, context, deps) {
-  const parsed = parseArgs10(
-    args,
-    APPLY_VALUE_FLAGS,
-    /* @__PURE__ */ new Set(["--secrets-stdin"]),
-    true
+async function applyAzureCommand(plan, parsed, context, deps, secrets) {
+  const dryRun = parsed.boolFlags.has("--dry-run");
+  const scopes = approvedScopes(plan, parsed, dryRun);
+  const profiles = requireServiceData(
+    await context.invokeForgeContract("listScenarioAutomationProfiles", { context: { projectKey: plan.project.key } }),
+    "listScenarioAutomationProfiles"
   );
+  const current = profiles.find((item) => item.label === plan.jiraProfile.label);
+  if (!dryRun && scopes.includes("provider-secrets") && !secrets.values.azureDevOpsAdminToken)
+    throw new SetupCommandError(
+      "SECRET_INPUT_REQUIRED",
+      "azureDevOpsAdminToken is required for the approved Azure DevOps pipeline-variable scope.",
+      ExitCode.ValidationError
+    );
+  const results = [];
+  const secretNames = scopes.includes("provider-secrets") && secrets.values.azureDevOpsAdminToken ? (await deps.azureProvider.inspectCallbackSecretMetadata(plan, secrets.values.azureDevOpsAdminToken)).names : void 0;
+  let appliedProfile = current;
+  for (const action of plan.actions) {
+    if (!scopes.includes(action.scope)) {
+      results.push({
+        id: action.id,
+        scope: action.scope,
+        status: "skipped",
+        message: "Action was not in the explicit approval scope.",
+        rollback: { available: false, guidance: "No mutation occurred." }
+      });
+      continue;
+    }
+    if (action.scope === "provider-secrets") {
+      const pending = plan.azureDevOps.requiredSecrets.filter(
+        (item) => parsed.boolFlags.has("--rotate-secrets") || !secretNames?.has(item.repositorySecretName)
+      );
+      if (!dryRun && pending.some((item) => !secrets.values[item.valueKey]))
+        throw new SetupCommandError(
+          "SECRET_INPUT_REQUIRED",
+          "Azure DevOps callback secrets are required for approved pipeline variable changes.",
+          ExitCode.ValidationError
+        );
+      if (!dryRun)
+        for (const item of pending)
+          await deps.azureProvider.setCallbackSecret(
+            plan,
+            item,
+            secrets.values[item.valueKey],
+            secrets.values.azureDevOpsAdminToken
+          );
+      results.push({
+        id: action.id,
+        scope: action.scope,
+        status: dryRun ? "planned" : pending.length ? "updated" : "skipped",
+        message: "Azure DevOps pipeline variable names are managed without printing secret values.",
+        rollback: { available: false, guidance: rollbackFor(plan, action.id) }
+      });
+    } else if (action.scope === "jira-profile") {
+      const rotateProvider = parsed.boolFlags.has("--rotate-provider-token");
+      if (!dryRun && (!current?.hasSecret || rotateProvider) && !secrets.values.azureDevOpsProviderToken)
+        throw new SetupCommandError(
+          "SECRET_INPUT_REQUIRED",
+          "azureDevOpsProviderToken is required to create or rotate the Azure provider PAT.",
+          ExitCode.ValidationError
+        );
+      const profile = dryRun ? current ?? {
+        id: "<created-by-forge>",
+        projectKey: plan.project.key,
+        label: plan.jiraProfile.label,
+        provider: "azureDevops",
+        authType: "basicPat",
+        method: "POST",
+        endpointSummary: "<computed-by-forge>",
+        config: plan.jiraProfile.config,
+        enabled: plan.jiraProfile.enabled,
+        hasSecret: false,
+        createdAt: "",
+        updatedAt: ""
+      } : requireServiceData(
+        await context.invokeForgeContract("upsertScenarioAutomationProfile", {
+          context: { projectKey: plan.project.key },
+          input: {
+            profileId: current?.id,
+            label: plan.jiraProfile.label,
+            provider: "azureDevops",
+            config: plan.jiraProfile.config,
+            enabled: plan.jiraProfile.enabled,
+            secretToken: !current?.hasSecret || rotateProvider ? secrets.values.azureDevOpsProviderToken : void 0
+          }
+        }),
+        "upsertScenarioAutomationProfile"
+      );
+      appliedProfile = profile;
+      results.push({
+        id: action.id,
+        scope: action.scope,
+        status: dryRun ? "planned" : current ? "updated" : "created",
+        message: "Azure DevOps Jira automation profile applied through the existing Forge contract.",
+        rollback: { available: !dryRun, guidance: rollbackFor(plan, action.id) }
+      });
+    } else if (action.scope === "project-default" && appliedProfile && !dryRun) {
+      requireServiceData(
+        await context.invokeForgeContract("setScenarioAutomationDefaultProfile", {
+          context: { projectKey: plan.project.key },
+          profileId: appliedProfile.id
+        }),
+        "setScenarioAutomationDefaultProfile"
+      );
+      results.push({
+        id: action.id,
+        scope: action.scope,
+        status: "updated",
+        message: "Set the Azure DevOps Jira automation profile as project default.",
+        rollback: { available: true, guidance: rollbackFor(plan, action.id) }
+      });
+    } else if (action.scope === "project-default") {
+      results.push({
+        id: action.id,
+        scope: action.scope,
+        status: "planned",
+        message: "Set the Azure DevOps Jira automation profile as project default.",
+        rollback: { available: false, guidance: rollbackFor(plan, action.id) }
+      });
+    }
+  }
+  return jsonResponse({
+    schemaVersion: APPLY_RESULT_SCHEMA_VERSION,
+    planId: plan.planId,
+    provider: plan.provider,
+    status: dryRun ? "dry-run" : "applied",
+    dryRun,
+    confirmed: !dryRun,
+    approvedScopes: scopes,
+    actions: results,
+    smokeValidation: { status: "not-run", externalRunTriggered: false }
+  });
+}
+async function doctorCommand(args, context, deps) {
+  const parsed = parseArgs10(args, APPLY_VALUE_FLAGS, /* @__PURE__ */ new Set(["--secrets-stdin"]), true);
   if (parsed.approvals.length > 0) {
     return jsonResponse(errorPayload("USAGE_ERROR", "setup doctor does not accept --approve."), ExitCode.UsageError);
   }
   if (parsed.errors.length > 0) {
-    return jsonResponse(errorPayload("USAGE_ERROR", "Invalid setup doctor arguments.", parsed.errors), ExitCode.UsageError);
+    return jsonResponse(
+      errorPayload("USAGE_ERROR", "Invalid setup doctor arguments.", parsed.errors),
+      ExitCode.UsageError
+    );
   }
   const planPath = parsed.flags["--plan"];
   if (!planPath) {
@@ -17490,6 +18025,64 @@ async function doctorCommand(args, context, deps) {
   try {
     const plan = loadPlan(planPath, deps.cwd);
     secrets = await resolveSecrets(parsed, deps);
+    if (plan.provider === "azure-devops") {
+      const checks = [];
+      const inspection = await deps.azureProvider.inspectExecutionDefinition(
+        plan,
+        secrets.values.azureDevOpsProviderToken ?? secrets.values.azureDevOpsAdminToken
+      );
+      checks.push({
+        id: "pipeline-azure",
+        status: inspection.found && inspection.active === true ? "pass" : "fail",
+        message: inspection.message
+      });
+      const variables = await deps.azureProvider.inspectCallbackSecretMetadata(
+        plan,
+        secrets.values.azureDevOpsAdminToken
+      );
+      const missing = plan.azureDevOps.requiredSecrets.filter(
+        (item) => !variables.names.has(item.repositorySecretName)
+      );
+      checks.push({
+        id: "callback-secret-metadata",
+        status: variables.verified && missing.length === 0 ? "pass" : variables.verified ? "fail" : "warn",
+        message: variables.message
+      });
+      const profiles = requireServiceData(
+        await context.invokeForgeContract("listScenarioAutomationProfiles", {
+          context: { projectKey: plan.project.key }
+        }),
+        "listScenarioAutomationProfiles"
+      );
+      const profile = profiles.find((item) => item.label === plan.jiraProfile.label);
+      const config = profile?.config;
+      const matches = profile?.provider === "azureDevops" && profile.enabled === plan.jiraProfile.enabled && profile.hasSecret && config?.organization === plan.jiraProfile.config.organization && config?.project === plan.jiraProfile.config.project && config?.pipelineId === plan.jiraProfile.config.pipelineId && config?.apiVersion === plan.jiraProfile.config.apiVersion && config?.bodyTemplate === plan.jiraProfile.config.bodyTemplate;
+      checks.push({
+        id: "jira-profile",
+        status: matches ? "pass" : "fail",
+        message: matches ? "Jira automation profile fields match and Forge reports a stored provider secret." : "Jira automation profile is missing, differs, or lacks provider secret metadata."
+      });
+      if (plan.jiraProfile.setProjectDefault)
+        checks.push({
+          id: "jira-project-default",
+          status: profile?.isProjectDefault ? "pass" : "fail",
+          message: profile?.isProjectDefault ? "Jira automation profile is the project default." : "Jira automation profile is not the project default."
+        });
+      const status = doctorStatus(checks);
+      const exitCode = status === "fail" ? ExitCode.ValidationError : ExitCode.Success;
+      return jsonResponse(
+        {
+          schemaVersion: DOCTOR_RESULT_SCHEMA_VERSION,
+          planId: plan.planId,
+          provider: plan.provider,
+          status,
+          exitCode,
+          externalRunTriggered: false,
+          checks
+        },
+        exitCode
+      );
+    }
     const repoRoot = import_node_path15.default.resolve(deps.cwd, parsed.flags["--repo-root"] ?? ".");
     const summary = await inspectPlan(plan, repoRoot, secrets, context, deps);
     return jsonResponse(summary, summary.exitCode);
@@ -17505,7 +18098,8 @@ function createSetupHandler(overrides = {}) {
     cwd: overrides.cwd ?? process.cwd(),
     env: overrides.env ?? process.env,
     readStdin: overrides.readStdin ?? defaultReadStdin,
-    githubProvider: overrides.githubProvider ?? new GitHubSetupProvider(overrides.githubProviderDeps)
+    githubProvider: overrides.githubProvider ?? new GitHubSetupProvider(overrides.githubProviderDeps),
+    azureProvider: overrides.azureProvider ?? new AzureDevOpsSetupProvider()
   };
   return async (request, context) => {
     const [subcommand, ...args] = request.args;
@@ -17609,10 +18203,7 @@ function suitesToLines(items) {
   if (items.length === 0) {
     return ["Test suites: 0", "No test suites found for the selected context."];
   }
-  return [
-    `Test suites: ${items.length}`,
-    ...items.map((item) => `- ${item.key} ${item.name}`)
-  ];
+  return [`Test suites: ${items.length}`, ...items.map((item) => `- ${item.key} ${item.name}`)];
 }
 function suiteToLines(suite) {
   return [
@@ -18179,9 +18770,7 @@ function buildHelpText(registry = COMMAND_REGISTRY, experimentalSyncEnabled = fa
     "Available command groups:"
   ];
   for (const command of visibleCommands) {
-    lines.push(
-      `  ${command.name.padEnd(12)} ${command.description}${formatSubcommands(command.subcommands)}`
-    );
+    lines.push(`  ${command.name.padEnd(12)} ${command.description}${formatSubcommands(command.subcommands)}`);
   }
   lines.push(
     "",