@automatify-au/cli 0.1.13 → 0.1.15

package/dist/automatify.cjs

@@ -10765,10 +10765,170 @@ var Priority;
 
 // src/config.ts
 var import_node_fs = require("node:fs");
-var import_node_child_process = require("node:child_process");
 var import_node_path = __toESM(require("node:path"), 1);
-var DEFAULT_CONFIG_FILENAME = ".testops-cli.json";
+
+// src/secureStore.ts
+var import_node_child_process = require("node:child_process");
 var KEYCHAIN_SERVICE = "automatify-testops-cli";
+function errorText(error) {
+  return error instanceof Error && error.message ? error.message : "unknown secure-storage error";
+}
+function windowsProtectScript() {
+  return [
+    "Add-Type -AssemblyName System.Security",
+    "$plain = [Console]::In.ReadToEnd()",
+    "$bytes = [Text.Encoding]::UTF8.GetBytes($plain)",
+    "$cipher = [System.Security.Cryptography.ProtectedData]::Protect($bytes, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)",
+    "[Console]::Out.Write([Convert]::ToBase64String($cipher))"
+  ].join("; ");
+}
+function windowsUnprotectScript() {
+  return [
+    "Add-Type -AssemblyName System.Security",
+    "$encoded = [Console]::In.ReadToEnd()",
+    "$cipher = [Convert]::FromBase64String($encoded)",
+    "$bytes = [System.Security.Cryptography.ProtectedData]::Unprotect($cipher, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)",
+    "[Console]::Out.Write([Text.Encoding]::UTF8.GetString($bytes))"
+  ].join("; ");
+}
+function quoteSecurityInteractiveArg(value) {
+  if (/\r|\n|\0/.test(value)) {
+    throw new Error("macOS Keychain values cannot contain newline or NUL characters.");
+  }
+  return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+}
+function macOSKeychainWriteInput(account, value) {
+  return [
+    "add-generic-password",
+    "-U",
+    "-s",
+    quoteSecurityInteractiveArg(KEYCHAIN_SERVICE),
+    "-a",
+    quoteSecurityInteractiveArg(account),
+    "-w",
+    quoteSecurityInteractiveArg(value)
+  ].join(" ") + "\n";
+}
+function readSecureSecret(locator, deps = {}) {
+  const platform = deps.platform ?? process.platform;
+  const run = deps.execFileSync ?? import_node_child_process.execFileSync;
+  if (platform === "darwin") {
+    if (!locator.account) {
+      return locator.protectedValue ? {
+        status: "error",
+        message: "This config contains a Windows DPAPI value, but it is being read on macOS. Re-store the secret on this machine."
+      } : { status: "missing" };
+    }
+    try {
+      const value = run("security", ["find-generic-password", "-s", KEYCHAIN_SERVICE, "-a", locator.account, "-w"], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"]
+      }).trim();
+      return value ? { status: "available", value, source: "keychain" } : {
+        status: "error",
+        message: `macOS Keychain returned an empty value for account ${locator.account}. Re-store the secret.`
+      };
+    } catch (error) {
+      return {
+        status: "error",
+        message: `Unable to read macOS Keychain account ${locator.account}: ${errorText(error)}. Re-store the secret.`
+      };
+    }
+  }
+  if (platform === "win32") {
+    if (!locator.protectedValue) {
+      return locator.account ? {
+        status: "error",
+        message: "This config references a macOS Keychain secret, but it is being read on Windows. Re-store the secret for the current Windows user."
+      } : { status: "missing" };
+    }
+    try {
+      const value = run("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", windowsUnprotectScript()], {
+        input: locator.protectedValue,
+        encoding: "utf8",
+        stdio: ["pipe", "pipe", "pipe"]
+      }).trim();
+      return value ? { status: "available", value, source: "secure-store" } : {
+        status: "error",
+        message: "Windows DPAPI returned an empty value. Re-store the secret for the current Windows user."
+      };
+    } catch (error) {
+      return {
+        status: "error",
+        message: `Unable to decrypt the Windows DPAPI value for the current user: ${errorText(error)}. Re-store the secret.`
+      };
+    }
+  }
+  if (locator.account || locator.protectedValue) {
+    return {
+      status: "error",
+      message: "This config contains local secure-store metadata, but local secure storage is supported only on macOS and Windows. Use an environment variable on Linux/CI."
+    };
+  }
+  return { status: "missing" };
+}
+function writeSecureSecret(account, value, deps = {}) {
+  const platform = deps.platform ?? process.platform;
+  const run = deps.execFileSync ?? import_node_child_process.execFileSync;
+  if (platform === "darwin") {
+    try {
+      run("security", ["-q", "-i"], {
+        input: macOSKeychainWriteInput(account, value),
+        encoding: "utf8",
+        stdio: ["pipe", "ignore", "pipe"]
+      });
+    } catch {
+      throw new Error("Unable to store the secret in macOS Keychain.");
+    }
+    return { source: "keychain", account };
+  }
+  if (platform === "win32") {
+    let protectedValue;
+    try {
+      protectedValue = run("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", windowsProtectScript()], {
+        input: value,
+        encoding: "utf8",
+        stdio: ["pipe", "pipe", "pipe"]
+      }).trim();
+    } catch {
+      throw new Error("Unable to protect the secret with Windows DPAPI for the current user.");
+    }
+    if (!protectedValue) {
+      throw new Error("Windows DPAPI returned an empty protected value.");
+    }
+    return { source: "secure-store", protectedValue };
+  }
+  throw new Error(
+    "Secure local secret storage is supported on macOS and Windows only. On Linux/CI, keep secrets in environment variables."
+  );
+}
+function deleteSecureSecret(locator, deps = {}) {
+  const platform = deps.platform ?? process.platform;
+  const run = deps.execFileSync ?? import_node_child_process.execFileSync;
+  if (platform === "darwin") {
+    if (!locator.account) {
+      return { status: "missing" };
+    }
+    try {
+      run("security", ["delete-generic-password", "-s", KEYCHAIN_SERVICE, "-a", locator.account], {
+        stdio: ["ignore", "ignore", "pipe"]
+      });
+      return { status: "deleted" };
+    } catch (error) {
+      return {
+        status: "error",
+        message: `Unable to delete macOS Keychain account ${locator.account}: ${errorText(error)}.`
+      };
+    }
+  }
+  if (platform === "win32") {
+    return locator.protectedValue ? { status: "deleted" } : { status: "missing" };
+  }
+  return locator.account || locator.protectedValue ? { status: "deleted" } : { status: "missing" };
+}
+
+// src/config.ts
+var DEFAULT_CONFIG_FILENAME = ".testops-cli.json";
 function parseFlags(args) {
   const flags = {};
   const unknownFlags = [];
@@ -10802,6 +10962,15 @@ function parseFlags(args) {
 function toStringValue(value) {
   return typeof value === "string" ? value.trim() : "";
 }
+function firstStringValue(...values) {
+  for (const value of values) {
+    const normalized = toStringValue(value);
+    if (normalized) {
+      return normalized;
+    }
+  }
+  return "";
+}
 function readConfigFile(configPath) {
   if (!(0, import_node_fs.existsSync)(configPath)) {
     return {};
@@ -10814,10 +10983,33 @@ function readConfigFile(configPath) {
     return {};
   }
 }
+function readConfigFileForMutation(configPath) {
+  if (!(0, import_node_fs.existsSync)(configPath)) {
+    return { file: {} };
+  }
+  try {
+    const raw = (0, import_node_fs.readFileSync)(configPath, "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      return {
+        file: {},
+        error: `Unable to update config at ${configPath}: existing config must contain a JSON object.`
+      };
+    }
+    return { file: parsed };
+  } catch {
+    return {
+      file: {},
+      error: `Unable to update config at ${configPath}: existing config is not valid JSON. Fix or remove it before retrying.`
+    };
+  }
+}
 function writeConfigFile(configPath, file) {
   (0, import_node_fs.writeFileSync)(configPath, `${JSON.stringify(file, null, 2)}
 `, "utf8");
-  (0, import_node_fs.chmodSync)(configPath, 384);
+  if (process.platform !== "win32") {
+    (0, import_node_fs.chmodSync)(configPath, 384);
+  }
 }
 function normalizeBaseUrl(value) {
   if (value.endsWith("/")) {
@@ -10831,28 +11023,46 @@ function readAuthMode(input) {
 function defaultKeychainAccount(configPath) {
   return import_node_path.default.resolve(configPath);
 }
-function readKeychainSecret(account) {
-  if (!account || process.platform !== "darwin") {
-    return "";
+function defaultJiraApiTokenKeychainAccount(configPath) {
+  return `${import_node_path.default.resolve(configPath)}:jiraApiToken`;
+}
+function valueFromPrecedence(key, flagValue, envValue, fileValue, fallback = "") {
+  if (flagValue) {
+    return { value: flagValue, source: "flag" };
   }
-  try {
-    return (0, import_node_child_process.execFileSync)("security", ["find-generic-password", "-s", KEYCHAIN_SERVICE, "-a", account, "-w"], {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
-  } catch {
-    return "";
+  if (envValue) {
+    return { value: envValue, source: "env" };
   }
+  if (fileValue) {
+    return { value: fileValue, source: "file" };
+  }
+  if (fallback) {
+    return { value: fallback, source: "default" };
+  }
+  return { value: "", source: "default" };
 }
-function setKeychainSecret(account, value) {
-  if (process.platform !== "darwin") {
-    throw new Error("Keychain-backed secrets are only supported on macOS.");
+function secureAccountForKey(key, file, configPath) {
+  if (key === "forgeAuthToken") {
+    return toStringValue(file.forgeAuthTokenKeychainAccount) || defaultKeychainAccount(configPath);
   }
-  (0, import_node_child_process.execFileSync)("security", ["add-generic-password", "-U", "-s", KEYCHAIN_SERVICE, "-a", account, "-w", value], {
-    stdio: ["ignore", "ignore", "pipe"]
-  });
+  return toStringValue(file.jiraApiTokenKeychainAccount) || defaultJiraApiTokenKeychainAccount(configPath);
 }
-function valueFromPrecedence(key, flagValue, envValue, fileValue, fallback = "") {
+function secureLocatorForKey(key, file) {
+  if (key === "forgeAuthToken") {
+    return {
+      account: toStringValue(file.forgeAuthTokenKeychainAccount) || void 0,
+      protectedValue: toStringValue(file.forgeAuthTokenProtected) || void 0
+    };
+  }
+  return {
+    account: toStringValue(file.jiraApiTokenKeychainAccount) || void 0,
+    protectedValue: toStringValue(file.jiraApiTokenProtected) || void 0
+  };
+}
+function secretEnvironmentName(key) {
+  return key === "jiraApiToken" ? "JIRA_API_TOKEN" : "TESTOPS_FORGE_AUTH_TOKEN";
+}
+function resolveSecretValue(key, flagValue, envValue, fileValue, file) {
   if (flagValue) {
     return { value: flagValue, source: "flag" };
   }
@@ -10862,11 +11072,33 @@ function valueFromPrecedence(key, flagValue, envValue, fileValue, fallback = "")
   if (fileValue) {
     return { value: fileValue, source: "file" };
   }
-  if (fallback) {
-    return { value: fallback, source: "default" };
+  const secure = readSecureSecret(secureLocatorForKey(key, file));
+  if (secure.status === "available") {
+    return { value: secure.value, source: secure.source };
+  }
+  if (secure.status === "error") {
+    return { value: "", source: "default", error: `${key}: ${secure.message}` };
   }
   return { value: "", source: "default" };
 }
+function clearSecretFields(file, key) {
+  if (key === "forgeAuthToken") {
+    return {
+      ...file,
+      forgeAuthToken: void 0,
+      TESTOPS_FORGE_AUTH_TOKEN: void 0,
+      forgeAuthTokenKeychainAccount: void 0,
+      forgeAuthTokenProtected: void 0
+    };
+  }
+  return {
+    ...file,
+    jiraApiToken: void 0,
+    JIRA_API_TOKEN: void 0,
+    jiraApiTokenKeychainAccount: void 0,
+    jiraApiTokenProtected: void 0
+  };
+}
 function resolveCliConfig(args, env = process.env, cwd = process.cwd()) {
   const { flags, unknownFlags } = parseFlags(args);
   const configPathFlag = flags["--config"] ? import_node_path.default.resolve(cwd, flags["--config"]) : "";
@@ -10905,11 +11137,12 @@ function resolveCliConfig(args, env = process.env, cwd = process.cwd()) {
     toStringValue(env.JIRA_EMAIL),
     toStringValue(file.jiraEmail ?? file.JIRA_EMAIL)
   );
-  const jiraApiTokenResolved = valueFromPrecedence(
+  const jiraApiTokenResolved = resolveSecretValue(
     "jiraApiToken",
     toStringValue(flags["--jira-api-token"]),
     toStringValue(env.JIRA_API_TOKEN),
-    toStringValue(file.jiraApiToken ?? file.JIRA_API_TOKEN)
+    firstStringValue(file.jiraApiToken, file.JIRA_API_TOKEN),
+    file
   );
   const forgeEndpointResolved = valueFromPrecedence(
     "forgeEndpoint",
@@ -10923,10 +11156,13 @@ function resolveCliConfig(args, env = process.env, cwd = process.cwd()) {
     "",
     toStringValue(file.forgeAuthTokenKeychainAccount)
   );
-  const forgeAuthTokenFromEnv = toStringValue(env.TESTOPS_FORGE_AUTH_TOKEN);
-  const forgeAuthTokenFromFile = toStringValue(file.forgeAuthToken ?? file.TESTOPS_FORGE_AUTH_TOKEN);
-  const forgeAuthTokenFromKeychain = forgeAuthTokenFromEnv || forgeAuthTokenFromFile || !forgeAuthTokenKeychainAccountResolved.value ? "" : readKeychainSecret(forgeAuthTokenKeychainAccountResolved.value);
-  const forgeAuthTokenResolved = forgeAuthTokenFromEnv ? { value: forgeAuthTokenFromEnv, source: "env" } : forgeAuthTokenFromFile ? { value: forgeAuthTokenFromFile, source: "file" } : forgeAuthTokenFromKeychain ? { value: forgeAuthTokenFromKeychain, source: "keychain" } : { value: "", source: "default" };
+  const forgeAuthTokenResolved = resolveSecretValue(
+    "forgeAuthToken",
+    "",
+    toStringValue(env.TESTOPS_FORGE_AUTH_TOKEN),
+    firstStringValue(file.forgeAuthToken, file.TESTOPS_FORGE_AUTH_TOKEN),
+    file
+  );
   const config = {
     baseUrl: normalizeBaseUrl(baseUrlResolved.value),
     projectKey: projectKeyResolved.value,
@@ -10952,13 +11188,16 @@ function resolveCliConfig(args, env = process.env, cwd = process.cwd()) {
     configPath: configPathSource
   };
   const warnings = [];
+  const errors = [jiraApiTokenResolved.error, forgeAuthTokenResolved.error].filter(
+    (value) => Boolean(value)
+  );
   if (unknownFlags.length > 0) {
     warnings.push(`Ignored unknown config flags: ${unknownFlags.join(", ")}`);
   }
   if (!(0, import_node_fs.existsSync)(configPath) && sources.configPath !== "default") {
     warnings.push(`Config file not found at ${configPath}; using env/flags/defaults.`);
   }
-  return { values: config, sources, warnings };
+  return { values: config, sources, warnings, errors };
 }
 function maskSecret(value) {
   if (!value) {
@@ -10971,7 +11210,7 @@ function maskSecret(value) {
 }
 function validateResolvedConfig(resolution) {
   const { values } = resolution;
-  const errors = [];
+  const errors = [...resolution.errors];
   const warnings = [...resolution.warnings];
   if (!values.baseUrl) {
     errors.push("Missing required setting: JIRA_BASE_URL (flag/env/file).");
@@ -10986,10 +11225,8 @@ function validateResolvedConfig(resolution) {
     if (!values.jiraApiToken) {
       errors.push("Auth mode api-token requires JIRA_API_TOKEN.");
     }
-  } else {
-    if (values.jiraApiToken || values.jiraEmail) {
-      warnings.push("JIRA_EMAIL/JIRA_API_TOKEN were provided but auth mode is 'none'.");
-    }
+  } else if (values.jiraApiToken || values.jiraEmail) {
+    warnings.push("JIRA_EMAIL/JIRA_API_TOKEN were provided but auth mode is 'none'.");
   }
   return { ok: errors.length === 0, errors, warnings };
 }
@@ -11052,21 +11289,33 @@ function applyConfigSet(configPath, rawKey, value) {
       ]
     };
   }
-  const file = readConfigFile(configPath);
-  if (key === "forgeAuthToken") {
-    const account = toStringValue(file.forgeAuthTokenKeychainAccount) || defaultKeychainAccount(configPath);
-    setKeychainSecret(account, value);
-    const nextFile2 = {
-      ...file,
-      forgeAuthToken: void 0,
-      TESTOPS_FORGE_AUTH_TOKEN: void 0,
-      forgeAuthTokenKeychainAccount: account
-    };
-    writeConfigFile(configPath, nextFile2);
-    return {
-      exitCode: ExitCode.Success,
-      stdout: [`Config updated: forgeAuthToken stored in macOS Keychain (${account}).`]
-    };
+  const mutable = readConfigFileForMutation(configPath);
+  if (mutable.error) {
+    return { exitCode: ExitCode.ValidationError, stderr: [mutable.error] };
+  }
+  const file = mutable.file;
+  if (key === "forgeAuthToken" || key === "jiraApiToken") {
+    const secretKey = key;
+    const account = secureAccountForKey(secretKey, file, configPath);
+    try {
+      const stored = writeSecureSecret(account, value);
+      const cleared = clearSecretFields(file, secretKey);
+      const nextFile2 = stored.source === "keychain" ? secretKey === "forgeAuthToken" ? { ...cleared, forgeAuthTokenKeychainAccount: stored.account } : { ...cleared, jiraApiTokenKeychainAccount: stored.account } : secretKey === "forgeAuthToken" ? { ...cleared, forgeAuthTokenProtected: stored.protectedValue } : { ...cleared, jiraApiTokenProtected: stored.protectedValue };
+      writeConfigFile(configPath, nextFile2);
+      const backend = stored.source === "keychain" ? "macOS Keychain" : "Windows DPAPI for the current user";
+      return {
+        exitCode: ExitCode.Success,
+        stdout: [`Config updated: ${secretKey} stored securely with ${backend}.`]
+      };
+    } catch (error) {
+      const unsupported = process.platform !== "darwin" && process.platform !== "win32";
+      return {
+        exitCode: unsupported ? ExitCode.UsageError : ExitCode.ValidationError,
+        stderr: [
+          `Unable to store ${secretKey} securely: ${error instanceof Error ? error.message : "unknown secure-storage error"} Use ${secretEnvironmentName(secretKey)} on Linux/CI.`
+        ]
+      };
+    }
   }
   const nextFile = {
     ...file,
@@ -11078,6 +11327,101 @@ function applyConfigSet(configPath, rawKey, value) {
     stdout: [`Config updated: ${rawKey}.`]
   };
 }
+function configFileKeysFor(key) {
+  switch (key) {
+    case "baseUrl":
+      return ["baseUrl", "JIRA_BASE_URL"];
+    case "projectKey":
+      return ["projectKey", "JIRA_PROJECT_KEY"];
+    case "issueKey":
+      return ["issueKey", "JIRA_ISSUE_KEY"];
+    case "authMode":
+      return ["authMode", "TESTOPS_AUTH_MODE"];
+    case "jiraEmail":
+      return ["jiraEmail", "JIRA_EMAIL"];
+    case "forgeEndpoint":
+      return ["forgeEndpoint", "TESTOPS_FORGE_ENDPOINT"];
+    default:
+      return [key];
+  }
+}
+function applyConfigUnset(configPath, rawKey) {
+  const key = normalizeConfigSetKey(rawKey);
+  if (!key) {
+    return {
+      exitCode: ExitCode.UsageError,
+      stderr: ["Usage: automatify testops config unset <key>"]
+    };
+  }
+  const mutable = readConfigFileForMutation(configPath);
+  if (mutable.error) {
+    return { exitCode: ExitCode.ValidationError, stderr: [mutable.error] };
+  }
+  const file = mutable.file;
+  if (key === "forgeAuthToken" || key === "jiraApiToken") {
+    const secretKey = key;
+    const deleted = deleteSecureSecret(secureLocatorForKey(secretKey, file));
+    if (deleted.status === "error") {
+      return { exitCode: ExitCode.ValidationError, stderr: [deleted.message] };
+    }
+    writeConfigFile(configPath, clearSecretFields(file, secretKey));
+    return { exitCode: ExitCode.Success, stdout: [`Config removed: ${secretKey}.`] };
+  }
+  const next = { ...file };
+  for (const fileKey of configFileKeysFor(key)) {
+    delete next[fileKey];
+  }
+  writeConfigFile(configPath, next);
+  return { exitCode: ExitCode.Success, stdout: [`Config removed: ${rawKey}.`] };
+}
+function applyConfigMigrateSecrets(configPath) {
+  const mutable = readConfigFileForMutation(configPath);
+  if (mutable.error) {
+    return { exitCode: ExitCode.ValidationError, stderr: [mutable.error] };
+  }
+  const file = mutable.file;
+  const pending = [];
+  const jiraApiToken = firstStringValue(file.jiraApiToken, file.JIRA_API_TOKEN);
+  const forgeAuthToken = firstStringValue(file.forgeAuthToken, file.TESTOPS_FORGE_AUTH_TOKEN);
+  if (jiraApiToken) {
+    pending.push({ key: "jiraApiToken", value: jiraApiToken });
+  }
+  if (forgeAuthToken) {
+    pending.push({ key: "forgeAuthToken", value: forgeAuthToken });
+  }
+  if (pending.length === 0) {
+    return { exitCode: ExitCode.Success, stdout: ["No plaintext local secrets require migration."] };
+  }
+  const migrated = [];
+  for (const item of pending) {
+    const response = applyConfigSet(configPath, item.key, item.value);
+    if (response.exitCode !== ExitCode.Success) {
+      return {
+        exitCode: response.exitCode,
+        stdout: migrated.length > 0 ? [`Migrated before failure: ${migrated.join(", ")}.`] : void 0,
+        stderr: response.stderr
+      };
+    }
+    migrated.push(item.key);
+  }
+  return {
+    exitCode: ExitCode.Success,
+    stdout: [`Migrated plaintext secrets to secure storage: ${migrated.join(", ")}.`]
+  };
+}
+function stripConfigPathArgs(args) {
+  const operands = [];
+  for (let i = 0; i < args.length; i += 1) {
+    if (args[i] === "--config") {
+      if (args[i + 1] && !args[i + 1].startsWith("--")) {
+        i += 1;
+      }
+      continue;
+    }
+    operands.push(args[i]);
+  }
+  return operands;
+}
 function createConfigHandler(env = process.env, cwd = process.cwd()) {
   return (request) => {
     const [subcommand, ...subArgs] = request.args;
@@ -11086,14 +11430,22 @@ function createConfigHandler(env = process.env, cwd = process.cwd()) {
     if (subcommand === "show") {
       return {
         exitCode: ExitCode.Success,
-        stdout: [...toDisplayLines(resolution), ...validation.warnings.map((line) => `WARN: ${line}`)]
+        stdout: [
+          ...toDisplayLines(resolution),
+          ...validation.warnings.map((line) => `WARN: ${line}`),
+          ...resolution.errors.map((line) => `ERROR: ${line}`)
+        ]
       };
     }
     if (subcommand === "validate") {
       if (validation.ok) {
         return {
           exitCode: ExitCode.Success,
-          stdout: ["Config validation: PASS", ...toDisplayLines(resolution), ...validation.warnings.map((line) => `WARN: ${line}`)]
+          stdout: [
+            "Config validation: PASS",
+            ...toDisplayLines(resolution),
+            ...validation.warnings.map((line) => `WARN: ${line}`)
+          ]
         };
       }
       return {
@@ -11103,17 +11455,25 @@ function createConfigHandler(env = process.env, cwd = process.cwd()) {
       };
     }
     if (subcommand === "set") {
-      const [key, ...valueParts] = subArgs;
-      const readValueFromStdin = key === "forgeAuthToken" && valueParts.length === 1 && valueParts[0] === "--stdin";
+      const [key, ...valueParts] = stripConfigPathArgs(subArgs);
+      const normalizedKey = normalizeConfigSetKey(key ?? "");
+      const readValueFromStdin = (normalizedKey === "forgeAuthToken" || normalizedKey === "jiraApiToken") && valueParts.length === 1 && valueParts[0] === "--stdin";
       const value = readValueFromStdin ? (0, import_node_fs.readFileSync)(0, "utf8").trim() : valueParts.join(" ").trim();
       if (!key || !value) {
         return {
           exitCode: ExitCode.UsageError,
-          stderr: ["Usage: automatify testops config set <key> <value>"]
+          stderr: ["Usage: automatify testops config set <key> <value|--stdin>"]
         };
       }
       return applyConfigSet(resolution.values.configPath, key, value);
     }
+    if (subcommand === "unset") {
+      const [key] = stripConfigPathArgs(subArgs);
+      return applyConfigUnset(resolution.values.configPath, key ?? "");
+    }
+    if (subcommand === "migrate-secrets") {
+      return applyConfigMigrateSecrets(resolution.values.configPath);
+    }
     return {
       exitCode: ExitCode.UsageError,
       stderr: [`Unsupported config subcommand: ${subcommand}`]
@@ -11506,9 +11866,11 @@ function normalizePath(pathValue) {
   return pathValue.replaceAll("\\", "/");
 }
 function discoverFeatureFiles(scannedFiles) {
-  const featurePaths = [...new Set(
-    scannedFiles.map((filePath) => normalizePath(filePath)).filter((filePath) => filePath.toLowerCase().endsWith(".feature"))
-  )].sort((a, b) => a.localeCompare(b));
+  const featurePaths = [
+    ...new Set(
+      scannedFiles.map((filePath) => normalizePath(filePath)).filter((filePath) => filePath.toLowerCase().endsWith(".feature"))
+    )
+  ].sort((a, b) => a.localeCompare(b));
   return {
     total: featurePaths.length,
     paths: featurePaths,
@@ -11747,12 +12109,7 @@ function scanProjectFiles(options) {
 }
 
 // src/auto.ts
-var DETERMINISTIC_STEPS = [
-  "detect",
-  "discover",
-  "map-preview",
-  "upload"
-];
+var DETERMINISTIC_STEPS = ["detect", "discover", "map-preview", "upload"];
 function parseArgs(args) {
   const flags = {};
   const boolFlags = /* @__PURE__ */ new Set();
@@ -12400,10 +12757,7 @@ function createAutoHandler(deps = {}) {
         const diagnostic = diagMissingProjectContext();
         return {
           exitCode: ExitCode.ValidationError,
-          stderr: [
-            `ERROR: ${diagnostic.code}: ${diagnostic.message}`,
-            `SUGGESTION: ${diagnostic.suggestion}`
-          ]
+          stderr: [`ERROR: ${diagnostic.code}: ${diagnostic.message}`, `SUGGESTION: ${diagnostic.suggestion}`]
         };
       }
       execution = await executeUploadFlow({
@@ -13024,17 +13378,19 @@ function createAllureOpenHandler(deps = {}) {
       if (useJson) {
         return {
           exitCode: ExitCode.Success,
-          stdout: toJsonLine(buildJsonOutput({
-            zipPath,
-            dryRun: true,
-            served: false,
-            opened: false,
-            keep,
-            extractDir: extractDirRaw,
-            rootDir: extractDirRaw,
-            indexPath,
-            summary
-          }))
+          stdout: toJsonLine(
+            buildJsonOutput({
+              zipPath,
+              dryRun: true,
+              served: false,
+              opened: false,
+              keep,
+              extractDir: extractDirRaw,
+              rootDir: extractDirRaw,
+              indexPath,
+              summary
+            })
+          )
         };
       }
       return {
@@ -13084,20 +13440,24 @@ function createAllureOpenHandler(deps = {}) {
       }
     }
     if (useJson) {
-      logger.log(JSON.stringify(buildJsonOutput({
-        zipPath,
-        dryRun: false,
-        served: true,
-        opened,
-        keep,
-        extractDir: extractResult.extractDir,
-        rootDir: extractResult.rootDir,
-        indexPath: extractResult.indexPath,
-        url: serverHandle.url,
-        port: serverHandle.port,
-        host: serverHandle.host,
-        summary
-      })));
+      logger.log(
+        JSON.stringify(
+          buildJsonOutput({
+            zipPath,
+            dryRun: false,
+            served: true,
+            opened,
+            keep,
+            extractDir: extractResult.extractDir,
+            rootDir: extractResult.rootDir,
+            indexPath: extractResult.indexPath,
+            url: serverHandle.url,
+            port: serverHandle.port,
+            host: serverHandle.host,
+            summary
+          })
+        )
+      );
     } else {
       logger.log(`Allure report extracted to ${extractResult.extractDir}.`);
       if (verbose) {
@@ -13385,13 +13745,15 @@ function createAllureHandler(deps = {}) {
           if (useJson) {
             return {
               exitCode: ExitCode.Success,
-              stdout: toJsonLine(buildDownloadJsonOutput({
-                issueKey: issueKey2,
-                dryRun: true,
-                downloaded: false,
-                attachment: selected,
-                outputPath
-              }))
+              stdout: toJsonLine(
+                buildDownloadJsonOutput({
+                  issueKey: issueKey2,
+                  dryRun: true,
+                  downloaded: false,
+                  attachment: selected,
+                  outputPath
+                })
+              )
             };
           }
           return {
@@ -13418,13 +13780,15 @@ function createAllureHandler(deps = {}) {
         if (useJson) {
           return {
             exitCode: ExitCode.Success,
-            stdout: toJsonLine(buildDownloadJsonOutput({
-              issueKey: issueKey2,
-              dryRun: false,
-              downloaded: true,
-              attachment: downloaded,
-              outputPath
-            }))
+            stdout: toJsonLine(
+              buildDownloadJsonOutput({
+                issueKey: issueKey2,
+                dryRun: false,
+                downloaded: true,
+                attachment: downloaded,
+                outputPath
+              })
+            )
           };
         }
         return {
@@ -13472,14 +13836,16 @@ function createAllureHandler(deps = {}) {
       if (useJson) {
         return {
           exitCode: ExitCode.Success,
-          stdout: toJsonLine(buildJsonOutput2({
-            issueKey,
-            uploaded: false,
-            commentAdded: false,
-            dryRun: true,
-            summary,
-            attachment: { filename: attachmentFilename }
-          }))
+          stdout: toJsonLine(
+            buildJsonOutput2({
+              issueKey,
+              uploaded: false,
+              commentAdded: false,
+              dryRun: true,
+              summary,
+              attachment: { filename: attachmentFilename }
+            })
+          )
         };
       }
       return {
@@ -13515,14 +13881,16 @@ function createAllureHandler(deps = {}) {
       if (useJson) {
         return {
           exitCode: ExitCode.Success,
-          stdout: toJsonLine(buildJsonOutput2({
-            issueKey,
-            uploaded: true,
-            commentAdded,
-            dryRun: false,
-            summary,
-            attachment
-          }))
+          stdout: toJsonLine(
+            buildJsonOutput2({
+              issueKey,
+              uploaded: true,
+              commentAdded,
+              dryRun: false,
+              summary,
+              attachment
+            })
+          )
         };
       }
       return {
@@ -13545,8 +13913,255 @@ function createAllureHandler(deps = {}) {
   };
 }
 
+// src/auth.ts
+var import_node_fs10 = require("node:fs");
+function parseAuthArgs(args, allowLoginFlags) {
+  const configArgs = [];
+  const unknown = [];
+  let baseUrl = "";
+  let jiraEmail = "";
+  let tokenStdin = false;
+  for (let i = 0; i < args.length; i += 1) {
+    const token = args[i];
+    if (token === "--config") {
+      const value = args[i + 1];
+      if (!value || value.startsWith("--")) {
+        unknown.push(token);
+        continue;
+      }
+      configArgs.push(token, value);
+      i += 1;
+      continue;
+    }
+    if (allowLoginFlags && token === "--base-url") {
+      const value = args[i + 1];
+      if (!value || value.startsWith("--")) {
+        unknown.push(token);
+        continue;
+      }
+      baseUrl = value.trim();
+      i += 1;
+      continue;
+    }
+    if (allowLoginFlags && token === "--jira-email") {
+      const value = args[i + 1];
+      if (!value || value.startsWith("--")) {
+        unknown.push(token);
+        continue;
+      }
+      jiraEmail = value.trim();
+      i += 1;
+      continue;
+    }
+    if (allowLoginFlags && token === "--token-stdin") {
+      tokenStdin = true;
+      continue;
+    }
+    unknown.push(token);
+  }
+  return { configArgs, baseUrl, jiraEmail, tokenStdin, unknown };
+}
+function runConfigMutation(handler, args, context) {
+  const response = handler(
+    {
+      group: "config",
+      args,
+      rawArgs: ["config", ...args]
+    },
+    context
+  );
+  if (response instanceof Promise) {
+    throw new Error("Config mutations must remain synchronous.");
+  }
+  return response;
+}
+function sourceLabel(source) {
+  switch (source) {
+    case "keychain":
+      return "macOS Keychain";
+    case "secure-store":
+      return "Windows DPAPI";
+    case "env":
+      return "environment";
+    case "file":
+      return "legacy plaintext config";
+    case "flag":
+      return "command flag";
+    default:
+      return "not configured";
+  }
+}
+function authState(parts) {
+  const populated = parts.filter(Boolean).length;
+  if (populated === 0) {
+    return "not configured";
+  }
+  return populated === parts.length ? "configured" : "incomplete";
+}
+function createStatusResponse(args, env, cwd) {
+  const parsed = parseAuthArgs(args, false);
+  if (parsed.unknown.length > 0) {
+    return {
+      exitCode: ExitCode.UsageError,
+      stderr: ["Unsupported auth status arguments. Only --config <path> is supported."]
+    };
+  }
+  const resolution = resolveCliConfig(parsed.configArgs, env, cwd);
+  const { values, sources } = resolution;
+  const jiraState = authState([values.baseUrl, values.jiraEmail, values.jiraApiToken]);
+  const forgeState = authState([values.forgeEndpoint, values.forgeAuthToken]);
+  const stdout = [
+    "Auth status (secret-safe):",
+    `  Jira: ${jiraState}`,
+    `    baseUrl: ${values.baseUrl || "<unset>"}`,
+    `    email: ${values.jiraEmail || "<unset>"}`,
+    `    apiToken: ${values.jiraApiToken ? `configured (${sourceLabel(sources.jiraApiToken)})` : "<unset>"}`,
+    `  Forge transport: ${forgeState}`,
+    `    endpoint: ${values.forgeEndpoint || "<unset>"}`,
+    `    authToken: ${values.forgeAuthToken ? `configured (${sourceLabel(sources.forgeAuthToken)})` : "<unset>"}`,
+    `  configPath: ${values.configPath}`
+  ];
+  if (resolution.errors.length > 0) {
+    return {
+      exitCode: ExitCode.ValidationError,
+      stdout,
+      stderr: resolution.errors.map((error) => `ERROR: ${error}`)
+    };
+  }
+  return { exitCode: ExitCode.Success, stdout };
+}
+function createLoginResponse(args, env, cwd, readStdin, platform, context) {
+  const parsed = parseAuthArgs(args, true);
+  if (parsed.unknown.length > 0) {
+    return {
+      exitCode: ExitCode.UsageError,
+      stderr: [
+        "Unsupported auth login arguments. Use --base-url, --jira-email, --token-stdin, and optional --config only.",
+        "Secrets must be provided through --token-stdin or environment variables, never as command-line values."
+      ]
+    };
+  }
+  const current = resolveCliConfig(parsed.configArgs, env, cwd);
+  const baseUrl = parsed.baseUrl || env.JIRA_BASE_URL?.trim() || current.values.baseUrl;
+  const jiraEmail = parsed.jiraEmail || env.JIRA_EMAIL?.trim() || current.values.jiraEmail;
+  const stdinToken = parsed.tokenStdin ? readStdin().trim() : "";
+  const effectiveToken = stdinToken || env.JIRA_API_TOKEN?.trim() || current.values.jiraApiToken;
+  const missing = [];
+  if (!baseUrl) missing.push("--base-url or JIRA_BASE_URL");
+  if (!jiraEmail) missing.push("--jira-email or JIRA_EMAIL");
+  if (!effectiveToken) missing.push("--token-stdin, JIRA_API_TOKEN, or an existing stored token");
+  if (missing.length > 0) {
+    return {
+      exitCode: ExitCode.UsageError,
+      stderr: [
+        `Jira login is incomplete. Provide: ${missing.join(", ")}.`,
+        "Secrets are never accepted as normal command-line values."
+      ]
+    };
+  }
+  if (parsed.tokenStdin && platform !== "darwin" && platform !== "win32") {
+    return {
+      exitCode: ExitCode.UsageError,
+      stderr: [
+        "Local secure secret storage is supported only on macOS and Windows.",
+        "On Linux/CI, set JIRA_API_TOKEN in the environment and run auth login without --token-stdin."
+      ]
+    };
+  }
+  const configHandler = createConfigHandler(env, cwd);
+  const configSuffix = parsed.configArgs;
+  const steps = [];
+  if (stdinToken) {
+    steps.push({ label: "Jira API token", args: ["set", "jiraApiToken", stdinToken, ...configSuffix] });
+  }
+  steps.push(
+    { label: "Jira base URL", args: ["set", "baseUrl", baseUrl, ...configSuffix] },
+    { label: "Jira email", args: ["set", "jiraEmail", jiraEmail, ...configSuffix] },
+    { label: "auth mode", args: ["set", "authMode", "api-token", ...configSuffix] }
+  );
+  const completed = [];
+  for (const step of steps) {
+    const response = runConfigMutation(configHandler, step.args, context);
+    if (response.exitCode !== ExitCode.Success) {
+      return {
+        exitCode: response.exitCode,
+        stdout: completed.length > 0 ? [`Configured before failure: ${completed.join(", ")}.`] : void 0,
+        stderr: response.stderr
+      };
+    }
+    completed.push(step.label);
+  }
+  const tokenSource = stdinToken ? platform === "darwin" ? "macOS Keychain" : "Windows DPAPI" : sourceLabel(
+    current.sources.jiraApiToken === "default" && env.JIRA_API_TOKEN ? "env" : current.sources.jiraApiToken
+  );
+  return {
+    exitCode: ExitCode.Success,
+    stdout: [
+      "Jira login configured.",
+      `  baseUrl: ${baseUrl.replace(/\/$/, "")}`,
+      `  email: ${jiraEmail}`,
+      `  apiToken: configured (${tokenSource})`,
+      "Run `automatify testops auth status` to verify the resolved credentials."
+    ]
+  };
+}
+function createLogoutResponse(args, env, cwd, context) {
+  const parsed = parseAuthArgs(args, false);
+  if (parsed.unknown.length > 0) {
+    return {
+      exitCode: ExitCode.UsageError,
+      stderr: ["Unsupported auth logout arguments. Only --config <path> is supported."]
+    };
+  }
+  const configHandler = createConfigHandler(env, cwd);
+  const failures = [];
+  const removed = [];
+  for (const key of ["jiraApiToken", "forgeAuthToken"]) {
+    const response = runConfigMutation(configHandler, ["unset", key, ...parsed.configArgs], context);
+    if (response.exitCode === ExitCode.Success) {
+      removed.push(key);
+    } else {
+      failures.push(...response.stderr ?? [`Unable to remove ${key}.`]);
+    }
+  }
+  if (failures.length > 0) {
+    return {
+      exitCode: ExitCode.ValidationError,
+      stdout: removed.length > 0 ? [`Removed before failure: ${removed.join(", ")}.`] : void 0,
+      stderr: failures
+    };
+  }
+  const stdout = ["Local Jira and Forge credentials removed.", "Non-secret URL/email settings were preserved."];
+  if (env.JIRA_API_TOKEN || env.TESTOPS_FORGE_AUTH_TOKEN) {
+    stdout.push("Environment-provided credentials are unchanged and may still resolve as configured.");
+  }
+  return { exitCode: ExitCode.Success, stdout };
+}
+function createAuthHandler(deps = {}) {
+  const env = deps.env ?? process.env;
+  const cwd = deps.cwd ?? process.cwd();
+  const readStdin = deps.readStdin ?? (() => (0, import_node_fs10.readFileSync)(0, "utf8"));
+  const platform = deps.platform ?? process.platform;
+  return (request, context) => {
+    const [subcommand, ...args] = request.args;
+    if (subcommand === "status") {
+      return createStatusResponse(args, env, cwd);
+    }
+    if (subcommand === "login") {
+      return createLoginResponse(args, env, cwd, readStdin, platform, context);
+    }
+    if (subcommand === "logout") {
+      return createLogoutResponse(args, env, cwd, context);
+    }
+    return {
+      exitCode: ExitCode.UsageError,
+      stderr: ["Unsupported auth subcommand. Use login, status, or logout."]
+    };
+  };
+}
+
 // src/bdd.ts
-var import_node_fs10 = require("node:fs");
+var import_node_fs11 = require("node:fs");
 var import_node_path11 = __toESM(require("node:path"), 1);
 var import_yazl = __toESM(require_yazl(), 1);
 
@@ -13860,9 +14475,11 @@ function parseScenarioFeatureFile(raw, filePath) {
   if (!featureName || !scenarioName || !scenarioKey || steps.length === 0 || scenarioCount !== 1) {
     return null;
   }
-  const linkedIssueKeys = [...new Set(
-    tags.map((tag) => tag.replace(/^@/, "").trim().toUpperCase()).filter((tag) => ISSUE_KEY_PATTERN.test(tag))
-  )];
+  const linkedIssueKeys = [
+    ...new Set(
+      tags.map((tag) => tag.replace(/^@/, "").trim().toUpperCase()).filter((tag) => ISSUE_KEY_PATTERN.test(tag))
+    )
+  ];
   return {
     scenarioKey,
     featureName,
@@ -13969,7 +14586,7 @@ function toJsonExportManifestItems(items) {
 async function defaultCreateZipArchive(archivePath, entries) {
   await new Promise((resolve, reject) => {
     const zip = new import_yazl.ZipFile();
-    const output = zip.outputStream.pipe((0, import_node_fs10.createWriteStream)(archivePath));
+    const output = zip.outputStream.pipe((0, import_node_fs11.createWriteStream)(archivePath));
     output.on("close", () => resolve());
     output.on("error", reject);
     zip.outputStream.on("error", reject);
@@ -13999,10 +14616,10 @@ function missingProjectResponse() {
 function createBddHandler(deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const env = deps.env ?? process.env;
-  const mkdir = deps.mkdir ?? ((targetPath, options) => (0, import_node_fs10.mkdirSync)(targetPath, options));
-  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs10.readFileSync)(filePath, "utf8"));
-  const readDir = deps.readDir ?? ((dirPath) => (0, import_node_fs10.readdirSync)(dirPath));
-  const writeFile = deps.writeFile ?? ((filePath, content) => (0, import_node_fs10.writeFileSync)(filePath, content, "utf8"));
+  const mkdir = deps.mkdir ?? ((targetPath, options) => (0, import_node_fs11.mkdirSync)(targetPath, options));
+  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs11.readFileSync)(filePath, "utf8"));
+  const readDir = deps.readDir ?? ((dirPath) => (0, import_node_fs11.readdirSync)(dirPath));
+  const writeFile = deps.writeFile ?? ((filePath, content) => (0, import_node_fs11.writeFileSync)(filePath, content, "utf8"));
   const createZipArchive = deps.createZipArchive ?? defaultCreateZipArchive;
   return async (request, context) => {
     const [subcommand, ...restArgs] = request.args;
@@ -14060,7 +14677,9 @@ function createBddHandler(deps = {}) {
             stderr: [`ERROR: ${result.error.code}: ${result.error.message}`]
           };
         }
-        const features = (featureId ? result.data.filter((feature) => feature.id === featureId) : result.data).sort((left, right) => left.payload.name.localeCompare(right.payload.name) || left.createdAt.localeCompare(right.createdAt));
+        const features = (featureId ? result.data.filter((feature) => feature.id === featureId) : result.data).sort(
+          (left, right) => left.payload.name.localeCompare(right.payload.name) || left.createdAt.localeCompare(right.createdAt)
+        );
         if (featureId && features.length === 0) {
           return {
             exitCode: ExitCode.RemoteError,
@@ -14180,7 +14799,9 @@ function createBddHandler(deps = {}) {
                 stderr: [`ERROR: ${scenariosResult.error.code}: ${scenariosResult.error.message}`]
               };
             }
-            const selectedScenarios = exportAll ? [...scenariosResult.data].sort((left, right) => (left.key ?? left.id).localeCompare(right.key ?? right.id)) : scenariosResult.data.filter(
+            const selectedScenarios = exportAll ? [...scenariosResult.data].sort(
+              (left, right) => (left.key ?? left.id).localeCompare(right.key ?? right.id)
+            ) : scenariosResult.data.filter(
               (item) => item.id === scenarioSelector2 || (item.key ?? "").toUpperCase() === scenarioSelector2.toUpperCase()
             );
             if (!exportAll && selectedScenarios.length === 0) {
@@ -14326,7 +14947,9 @@ function createBddHandler(deps = {}) {
               if (!scenario) {
                 return {
                   exitCode: ExitCode.RemoteError,
-                  stderr: [`ERROR: NOT_FOUND: BDD scenario ${parsedScenario.scenarioKey} was not found in this project.`]
+                  stderr: [
+                    `ERROR: NOT_FOUND: BDD scenario ${parsedScenario.scenarioKey} was not found in this project.`
+                  ]
                 };
               }
               const nextTags = parsedScenario.tags.filter((tag) => !SCENARIO_METADATA_PATTERN.test(tag));
@@ -14432,7 +15055,9 @@ function createBddHandler(deps = {}) {
         if (!scenarioId && !testCaseKey) {
           return {
             exitCode: ExitCode.ValidationError,
-            stderr: ["ERROR: Provide either --id <SCENARIO_ID> or --test-case-key <TC-197> for testops bdd scenarios run."]
+            stderr: [
+              "ERROR: Provide either --id <SCENARIO_ID> or --test-case-key <TC-197> for testops bdd scenarios run."
+            ]
           };
         }
         try {
@@ -14706,10 +15331,7 @@ function listToLines(items) {
   if (items.length === 0) {
     return ["Test cases: 0", "No test cases found for the selected context."];
   }
-  return [
-    `Test cases: ${items.length}`,
-    ...items.map((item) => `- ${item.key} [${item.status}] ${item.title}`)
-  ];
+  return [`Test cases: ${items.length}`, ...items.map((item) => `- ${item.key} [${item.status}] ${item.title}`)];
 }
 function showToLines(testCase) {
   return [
@@ -15009,11 +15631,7 @@ var CONFIG_FLAGS5 = /* @__PURE__ */ new Set([
   "--jira-email",
   "--jira-api-token"
 ]);
-var DIRECT_JIRA_FLAGS = /* @__PURE__ */ new Set([
-  "--site",
-  "--email",
-  "--api-token"
-]);
+var DIRECT_JIRA_FLAGS = /* @__PURE__ */ new Set(["--site", "--email", "--api-token"]);
 function parseArgs6(args) {
   const flags = {};
   const boolFlags = /* @__PURE__ */ new Set();
@@ -15094,9 +15712,10 @@ function resolveAllureJiraConfig(parsed, env, cwd) {
   const resolution = resolveCliConfig(pickConfigArgs5(parsed), env, cwd);
   const site = normalizeSite3(parsed.flags["--site"] ?? env.JIRA_SITE ?? resolution.values.baseUrl);
   const email = (parsed.flags["--email"] ?? resolution.values.jiraEmail).trim();
-  const apiToken = (parsed.flags["--api-token"] ?? resolution.values.jiraApiToken).trim();
+  const directApiToken = (parsed.flags["--api-token"] ?? "").trim();
+  const apiToken = (directApiToken || resolution.values.jiraApiToken).trim();
   const issueKey = (parsed.flags["--issue-key"] ?? "").trim();
-  const errors = [];
+  const errors = directApiToken ? [] : resolution.errors.filter((line) => line.startsWith("jiraApiToken:"));
   if (!hasValue(site)) {
     errors.push("Missing Jira site. Pass --site, set JIRA_SITE/JIRA_BASE_URL, or configure baseUrl.");
   }
@@ -15213,27 +15832,33 @@ function createDoctorHandler(deps = {}) {
           message: "Issue access check skipped. Pass --issue-key to verify Jira read/download access for a specific issue."
         });
       }
-      checks.push(commandCheck(
-        { execFileSync: runCommand },
-        "unzip",
-        ["-v"],
-        "unzip is available for manual ZIP inspection.",
-        "unzip was not found. The future built-in opener can avoid this, but manual inspection will be less convenient."
-      ));
-      checks.push(commandCheck(
-        { execFileSync: runCommand },
-        "java",
-        ["-version"],
-        "Java is available for optional raw allure-results workflows.",
-        "Java was not found. This does not block generated Allure HTML ZIP upload/download/open; it only matters for raw allure-results generation."
-      ));
-      checks.push(commandCheck(
-        { execFileSync: runCommand },
-        "allure",
-        ["--version"],
-        "Allure CLI is available for optional raw allure-results workflows.",
-        "Allure CLI was not found. This does not block generated Allure HTML ZIP upload/download/open."
-      ));
+      checks.push(
+        commandCheck(
+          { execFileSync: runCommand },
+          "unzip",
+          ["-v"],
+          "unzip is available for manual ZIP inspection.",
+          "unzip was not found. The future built-in opener can avoid this, but manual inspection will be less convenient."
+        )
+      );
+      checks.push(
+        commandCheck(
+          { execFileSync: runCommand },
+          "java",
+          ["-version"],
+          "Java is available for optional raw allure-results workflows.",
+          "Java was not found. This does not block generated Allure HTML ZIP upload/download/open; it only matters for raw allure-results generation."
+        )
+      );
+      checks.push(
+        commandCheck(
+          { execFileSync: runCommand },
+          "allure",
+          ["--version"],
+          "Allure CLI is available for optional raw allure-results workflows.",
+          "Allure CLI was not found. This does not block generated Allure HTML ZIP upload/download/open."
+        )
+      );
       const summary2 = {
         status: computeOverallStatus(checks),
         checks
@@ -15272,9 +15897,7 @@ function createDoctorHandler(deps = {}) {
         message: "Forge endpoint is configured."
       });
     }
-    const hasContext = Boolean(
-      resolution.values.projectKey || resolution.values.issueKey
-    );
+    const hasContext = Boolean(resolution.values.projectKey || resolution.values.issueKey);
     if (enforceContextCheck || hasContext) {
       if (!hasContext) {
         checks.push({
@@ -15331,7 +15954,7 @@ function createDoctorHandler(deps = {}) {
 }
 
 // src/ingestFeature.ts
-var import_node_fs11 = require("node:fs");
+var import_node_fs12 = require("node:fs");
 var import_node_path12 = __toESM(require("node:path"), 1);
 var CONFIG_FLAGS6 = /* @__PURE__ */ new Set([
   "--config",
@@ -15418,8 +16041,8 @@ function normalizeError5(error) {
   return "Unknown ingest error.";
 }
 function createIngestFeatureHandler(deps = {}) {
-  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs11.readFileSync)(filePath, "utf8"));
-  const readStdin = deps.readStdin ?? (() => (0, import_node_fs11.readFileSync)(0, "utf8"));
+  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs12.readFileSync)(filePath, "utf8"));
+  const readStdin = deps.readStdin ?? (() => (0, import_node_fs12.readFileSync)(0, "utf8"));
   const cwd = deps.cwd ?? process.cwd();
   const env = deps.env ?? process.env;
   return async (request, context) => {
@@ -15501,11 +16124,7 @@ function createIngestFeatureHandler(deps = {}) {
         }
         return {
           exitCode: ExitCode.RemoteError,
-          stdout: [
-            "Feature ingestion: FAILED",
-            `Feature: ${name}`,
-            `Source: ${useStdin ? "stdin" : sourceFile}`
-          ],
+          stdout: ["Feature ingestion: FAILED", `Feature: ${name}`, `Source: ${useStdin ? "stdin" : sourceFile}`],
           stderr: [`ERROR: ${result.error.code}: ${result.error.message}`]
         };
       }
@@ -15546,11 +16165,7 @@ function createIngestFeatureHandler(deps = {}) {
       }
       return {
         exitCode: ExitCode.TransportError,
-        stdout: [
-          "Feature ingestion: FAILED",
-          `Feature: ${name}`,
-          `Source: ${useStdin ? "stdin" : sourceFile}`
-        ],
+        stdout: ["Feature ingestion: FAILED", `Feature: ${name}`, `Source: ${useStdin ? "stdin" : sourceFile}`],
         stderr: [`ERROR: ${normalizeError5(error)}`]
       };
     }
@@ -15558,7 +16173,7 @@ function createIngestFeatureHandler(deps = {}) {
 }
 
 // src/runUpload.ts
-var import_node_fs12 = require("node:fs");
+var import_node_fs13 = require("node:fs");
 var import_node_path13 = __toESM(require("node:path"), 1);
 var STEP_RESULTS = [
   StepResult.Passed,
@@ -15700,8 +16315,8 @@ function summarizeRunResult(result) {
   return lines;
 }
 function createRunUploadHandler(deps = {}) {
-  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs12.readFileSync)(filePath, "utf8"));
-  const readStdin = deps.readStdin ?? (() => (0, import_node_fs12.readFileSync)(0, "utf8"));
+  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs13.readFileSync)(filePath, "utf8"));
+  const readStdin = deps.readStdin ?? (() => (0, import_node_fs13.readFileSync)(0, "utf8"));
   const cwd = deps.cwd ?? process.cwd();
   const env = deps.env ?? process.env;
   return async (request, context) => {
@@ -16046,7 +16661,7 @@ function createRunsHandler(deps = {}) {
 }
 
 // src/setup.ts
-var import_node_fs14 = require("node:fs");
+var import_node_fs15 = require("node:fs");
 var import_node_path15 = __toESM(require("node:path"), 1);
 
 // src/githubSetupProvider.ts
@@ -16054,7 +16669,7 @@ var import_node_child_process4 = require("node:child_process");
 
 // src/setupPlan.ts
 var import_node_crypto = require("node:crypto");
-var import_node_fs13 = require("node:fs");
+var import_node_fs14 = require("node:fs");
 var import_node_path14 = __toESM(require("node:path"), 1);
 var SETUP_PLAN_SCHEMA_VERSION = "automatify.testops.setup/v1";
 var SETUP_PLAN_KIND = "AutomatifyTestOpsSetupPlan";
@@ -16145,18 +16760,12 @@ function buildGitHubSetupPlan(input) {
   const workflowId = requireNonEmpty(input.workflowId, "workflow id");
   const workflowPath = normalizeWorkflowPath(input.workflowPath);
   const profileLabel = requireNonEmpty(input.profileLabel, "profile label");
-  const endpointSecretName = normalizeSecretName(
-    input.callbackEndpointSecretName,
-    "callback endpoint secret name"
-  );
-  const tokenSecretName = normalizeSecretName(
-    input.callbackAuthTokenSecretName,
-    "callback auth token secret name"
-  );
+  const endpointSecretName = normalizeSecretName(input.callbackEndpointSecretName, "callback endpoint secret name");
+  const tokenSecretName = normalizeSecretName(input.callbackAuthTokenSecretName, "callback auth token secret name");
   if (endpointSecretName === tokenSecretName) {
     throw new Error("callback endpoint and auth token secret names must be different.");
   }
-  const workflowContent = (0, import_node_fs13.readFileSync)(input.workflowSourcePath, "utf8");
+  const workflowContent = (0, import_node_fs14.readFileSync)(input.workflowSourcePath, "utf8");
   if (!workflowContent.trim()) {
     throw new Error("workflow source file is empty.");
   }
@@ -16211,13 +16820,7 @@ function buildGitHubSetupPlan(input) {
           "Secrets: read/write metadata only for the explicit github-secrets apply scope.",
           "Contents: read for doctor; this command never creates commits or pull requests."
         ],
-        remoteChangesExcluded: [
-          "accounts",
-          "credentials",
-          "commits",
-          "pull requests",
-          "workflow runs"
-        ]
+        remoteChangesExcluded: ["accounts", "credentials", "commits", "pull requests", "workflow runs"]
       }
     },
     jiraProfile: {
@@ -16435,15 +17038,7 @@ function validateSetupPlan(value) {
     errors.push("project.key is required.");
   }
   const github = value.github;
-  if (!isRecord(github) || !hasExactKeys(github, [
-    "owner",
-    "repository",
-    "ref",
-    "workflowId",
-    "workflowFile",
-    "requiredSecrets",
-    "guidance"
-  ])) {
+  if (!isRecord(github) || !hasExactKeys(github, ["owner", "repository", "ref", "workflowId", "workflowFile", "requiredSecrets", "guidance"])) {
     errors.push("github has an invalid shape.");
   } else {
     for (const field of ["owner", "repository", "ref", "workflowId"]) {
@@ -16520,6 +17115,8 @@ function hashSetupContent(value) {
 }
 
 // src/githubSetupProvider.ts
+var GITHUB_SECRET_PAGE_SIZE = 100;
+var MAX_GITHUB_SECRET_PAGES = 100;
 function isRecord2(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -16551,18 +17148,14 @@ async function githubApi(fetchImpl, url, token) {
 }
 async function setGitHubRepositorySecretWithCli(input) {
   await new Promise((resolve, reject) => {
-    const child = (0, import_node_child_process4.spawn)(
-      "gh",
-      ["secret", "set", input.name, "--repo", `${input.owner}/${input.repository}`],
-      {
-        shell: false,
-        stdio: ["pipe", "ignore", "pipe"],
-        env: {
-          ...process.env,
-          GH_TOKEN: input.adminToken
-        }
+    const child = (0, import_node_child_process4.spawn)("gh", ["secret", "set", input.name, "--repo", `${input.owner}/${input.repository}`], {
+      shell: false,
+      stdio: ["pipe", "ignore", "pipe"],
+      env: {
+        ...process.env,
+        GH_TOKEN: input.adminToken
       }
-    );
+    });
     let stderr = "";
     child.stderr.setEncoding("utf8");
     child.stderr.on("data", (chunk) => {
@@ -16622,6 +17215,7 @@ var GitHubSetupProvider = class {
     return {
       found: true,
       active: state === "active",
+      state,
       path: workflowPath,
       contentSha256,
       message: state !== "active" ? `GitHub workflow is registered but its state is ${state ?? "unknown"}.` : workflowPath !== workflowFile.path ? `GitHub workflow path ${workflowPath ?? "<unknown>"} does not match ${workflowFile.path}.` : contentSha256 === workflowFile.sha256 ? "GitHub workflow is active and its content matches the approved plan." : "GitHub workflow metadata is reachable, but the approved ref content could not be confirmed as an exact plan match."
@@ -16636,25 +17230,52 @@ var GitHubSetupProvider = class {
       };
     }
     const { owner, repository } = plan.github;
-    const url = `https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}/actions/secrets?per_page=100`;
-    const response = await githubApi(this.fetchImpl, url, adminToken);
-    if (!response.ok) {
-      throw new Error(
-        `GitHub repository secret metadata request failed with HTTP ${response.status}: ${safeGitHubMessage(response.body, "request failed")}`
-      );
-    }
+    const baseUrl = `https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}/actions/secrets`;
     const names = /* @__PURE__ */ new Set();
-    if (isRecord2(response.body) && Array.isArray(response.body.secrets)) {
-      for (const item of response.body.secrets) {
+    let totalCount;
+    let pagesRead = 0;
+    for (let page = 1; page <= MAX_GITHUB_SECRET_PAGES; page += 1) {
+      const url = `${baseUrl}?per_page=${GITHUB_SECRET_PAGE_SIZE}&page=${page}`;
+      const response = await githubApi(this.fetchImpl, url, adminToken);
+      if (!response.ok) {
+        throw new Error(
+          `GitHub repository secret metadata request failed on page ${page} with HTTP ${response.status}: ${safeGitHubMessage(response.body, "request failed")}`
+        );
+      }
+      const body = isRecord2(response.body) ? response.body : {};
+      if (totalCount === void 0 && typeof body.total_count === "number" && Number.isFinite(body.total_count)) {
+        totalCount = Math.max(0, Math.trunc(body.total_count));
+      }
+      const secrets = Array.isArray(body.secrets) ? body.secrets : [];
+      const before = names.size;
+      for (const item of secrets) {
         if (isRecord2(item) && typeof item.name === "string") {
           names.add(item.name);
         }
       }
+      pagesRead = page;
+      if (totalCount !== void 0 && names.size >= totalCount) {
+        break;
+      }
+      if (secrets.length < GITHUB_SECRET_PAGE_SIZE) {
+        if (totalCount !== void 0 && names.size < totalCount) {
+          throw new Error(
+            `GitHub repository secret metadata pagination ended early after ${names.size} of ${totalCount} secret name(s).`
+          );
+        }
+        break;
+      }
+      if (names.size === before) {
+        throw new Error("GitHub repository secret metadata pagination made no progress.");
+      }
+      if (page === MAX_GITHUB_SECRET_PAGES) {
+        throw new Error(`GitHub repository secret metadata exceeded ${MAX_GITHUB_SECRET_PAGES} pages.`);
+      }
     }
     return {
       verified: true,
       names,
-      message: `Verified ${names.size} GitHub repository secret name(s); values remain unreadable.`
+      message: `Verified ${names.size} GitHub repository secret name(s) across ${pagesRead} page(s); values remain unreadable.`
     };
   }
   async setCallbackSecret(plan, secret, value, adminToken) {
@@ -16671,7 +17292,12 @@ var GitHubSetupProvider = class {
 // src/azureDevOpsSetupProvider.ts
 var isRecord3 = (v) => Boolean(v) && typeof v === "object" && !Array.isArray(v);
 async function adoGet(fetchImpl, url, token) {
-  const response = await fetchImpl(url, { headers: { accept: "application/json", ...token ? { authorization: `Basic ${Buffer.from(`:${token}`).toString("base64")}` } : {} } });
+  const response = await fetchImpl(url, {
+    headers: {
+      accept: "application/json",
+      ...token ? { authorization: `Basic ${Buffer.from(`:${token}`).toString("base64")}` } : {}
+    }
+  });
   const text = await response.text();
   let body = {};
   try {
@@ -16684,7 +17310,8 @@ async function setAzurePipelineVariableWithRest(input, fetchImpl) {
   const base = `https://dev.azure.com/${encodeURIComponent(input.organization)}/${encodeURIComponent(input.project)}/_apis/build/definitions/${encodeURIComponent(input.pipelineId)}`;
   const auth = { authorization: `Basic ${Buffer.from(`:${input.token}`).toString("base64")}` };
   const current = await adoGet(fetchImpl, `${base}?api-version=7.1`, input.token);
-  if (!current.ok || !isRecord3(current.body)) throw new Error(`Azure DevOps build definition could not be read (HTTP ${current.status}).`);
+  if (!current.ok || !isRecord3(current.body))
+    throw new Error(`Azure DevOps build definition could not be read (HTTP ${current.status}).`);
   const variables = isRecord3(current.body.variables) ? { ...current.body.variables } : {};
   variables[input.name] = { value: input.value, isSecret: true };
   const query = new URLSearchParams({
@@ -16692,9 +17319,25 @@ async function setAzurePipelineVariableWithRest(input, fetchImpl) {
     secretsSourceDefinitionId: String(current.body.id),
     secretsSourceDefinitionRevision: String(current.body.revision)
   });
-  const response = await fetchImpl(`${base}?${query.toString()}`, { method: "PUT", headers: { ...auth, "content-type": "application/json", accept: "application/json" }, body: JSON.stringify({ ...current.body, variables }) });
+  const response = await fetchImpl(`${base}?${query.toString()}`, {
+    method: "PUT",
+    headers: { ...auth, "content-type": "application/json", accept: "application/json" },
+    body: JSON.stringify({ ...current.body, variables })
+  });
   if (!response.ok) throw new Error(`Azure DevOps pipeline variable update failed (HTTP ${response.status}).`);
 }
+function azurePipelineStateMessage(name, queueStatus) {
+  switch (queueStatus) {
+    case "enabled":
+      return `Azure DevOps pipeline ${name} is reachable and enabled. Inspection never queues a run.`;
+    case "paused":
+      return `Azure DevOps pipeline ${name} is reachable but paused; builds may be queued but will not start until the definition is enabled.`;
+    case "disabled":
+      return `Azure DevOps pipeline ${name} is reachable but disabled; new builds cannot be queued until the definition is enabled.`;
+    default:
+      return `Azure DevOps pipeline ${name} is reachable, but its queue status is ${queueStatus ?? "unknown"}.`;
+  }
+}
 var AzureDevOpsSetupProvider = class {
   name = "azure-devops";
   fetchImpl;
@@ -16707,23 +17350,51 @@ var AzureDevOpsSetupProvider = class {
     const a = plan.azureDevOps;
     const url = `https://dev.azure.com/${encodeURIComponent(a.organization)}/${encodeURIComponent(a.project)}/_apis/build/definitions/${encodeURIComponent(a.pipelineId)}?api-version=${encodeURIComponent(a.apiVersion)}`;
     const result = await adoGet(this.fetchImpl, url, token);
-    if (!result.ok) return { found: false, message: result.status === 404 ? "Azure DevOps pipeline was not found." : `Azure DevOps pipeline metadata could not be verified (HTTP ${result.status}).` };
+    if (!result.ok)
+      return {
+        found: false,
+        message: result.status === 404 ? "Azure DevOps pipeline was not found." : `Azure DevOps pipeline metadata could not be verified (HTTP ${result.status}).`
+      };
     const body = isRecord3(result.body) ? result.body : {};
-    const name = typeof body.name === "string" ? body.name : void 0;
-    return { found: true, active: true, path: name, message: `Azure DevOps pipeline ${name ?? a.pipelineId} is reachable. Inspection never queues a run.` };
+    const name = typeof body.name === "string" ? body.name : a.pipelineId;
+    const queueStatus = typeof body.queueStatus === "string" ? body.queueStatus : void 0;
+    return {
+      found: true,
+      active: queueStatus === "enabled",
+      state: queueStatus,
+      path: name,
+      message: azurePipelineStateMessage(name, queueStatus)
+    };
   }
   async inspectCallbackSecretMetadata(plan, token) {
-    if (!token) return { verified: false, names: /* @__PURE__ */ new Set(), message: "Azure DevOps pipeline variable metadata was not verified because azureDevOpsAdminToken was not provided. Secret values are never readable." };
+    if (!token)
+      return {
+        verified: false,
+        names: /* @__PURE__ */ new Set(),
+        message: "Azure DevOps pipeline variable metadata was not verified because azureDevOpsAdminToken was not provided. Secret values are never readable."
+      };
     const a = plan.azureDevOps;
     const url = `https://dev.azure.com/${encodeURIComponent(a.organization)}/${encodeURIComponent(a.project)}/_apis/build/definitions/${encodeURIComponent(a.pipelineId)}?api-version=${encodeURIComponent(a.apiVersion)}`;
     const result = await adoGet(this.fetchImpl, url, token);
     if (!result.ok) throw new Error(`Azure DevOps pipeline metadata request failed with HTTP ${result.status}.`);
     const variables = isRecord3(result.body) && isRecord3(result.body.variables) ? result.body.variables : {};
-    return { verified: true, names: new Set(Object.keys(variables)), message: `Verified ${Object.keys(variables).length} Azure DevOps pipeline variable name(s); secret values remain unreadable.` };
+    return {
+      verified: true,
+      names: new Set(Object.keys(variables)),
+      message: `Verified ${Object.keys(variables).length} Azure DevOps pipeline variable name(s); secret values remain unreadable.`
+    };
   }
   async setCallbackSecret(plan, secret, value, adminToken) {
-    if (!this.setter) throw new Error("Azure DevOps pipeline variable setter is not configured; use the safe Azure CLI adapter.");
-    await this.setter({ organization: plan.azureDevOps.organization, project: plan.azureDevOps.project, pipelineId: plan.azureDevOps.pipelineId, name: secret.repositorySecretName, value, token: adminToken });
+    if (!this.setter)
+      throw new Error("Azure DevOps pipeline variable setter is not configured; use the safe Azure CLI adapter.");
+    await this.setter({
+      organization: plan.azureDevOps.organization,
+      project: plan.azureDevOps.project,
+      pipelineId: plan.azureDevOps.pipelineId,
+      name: secret.repositorySecretName,
+      value,
+      token: adminToken
+    });
   }
 };
 
@@ -16753,30 +17424,138 @@ function buildAzureDevOpsSetupPlan(input) {
   const endpointName = variableName(input.callbackEndpointVariableName, "callback endpoint variable name");
   const tokenName = variableName(input.callbackAuthTokenVariableName, "callback auth token variable name");
   if (endpointName === tokenName) throw new Error("callback variable names must be distinct.");
-  const requiredSecrets = [{ repositorySecretName: endpointName, valueKey: "callbackEndpoint", purpose: "Forge callback endpoint pipeline variable." }, { repositorySecretName: tokenName, valueKey: "callbackAuthToken", purpose: "Forge callback auth token pipeline variable." }];
-  const scopes = ["provider-secrets", "jira-profile", ...input.setProjectDefault ? ["project-default"] : []];
-  const actions = scopes.map((scope) => ({ id: scope === "provider-secrets" ? "set-provider-secrets" : scope === "jira-profile" ? "upsert-jira-profile" : "set-project-default", scope, summary: `Apply ${scope} for Azure DevOps.`, mutates: "jira" }));
-  const withoutId = { schemaVersion: "automatify.testops.setup/v1", kind: "AutomatifyTestOpsSetupPlan", provider: "azure-devops", project: { key: projectKey }, azureDevOps: { organization, project: azureProject, pipelineId, ref, apiVersion, requiredSecrets, guidance: { authentication: "Use an Azure DevOps PAT with least-privilege pipeline read/manage-variable access.", permissions: ["Pipelines: read for doctor; manage variables only for explicit provider-secrets apply."], remoteChangesExcluded: ["accounts", "credentials", "commits", "pull requests", "pipeline runs"] } }, jiraProfile: { label: profileLabel, enabled: input.enabled, provider: "azureDevops", config: { organization, project: azureProject, pipelineId, apiVersion, bodyTemplate: JSON.stringify({ resources: { repositories: { self: { refName: ref } } } }) }, setProjectDefault: input.setProjectDefault }, actions, smokeValidation: [{ id: "pipeline-content", verifies: "Azure DevOps pipeline metadata without queueing a run.", triggersExternalRun: false }, { id: "pipeline-variable-metadata", verifies: "Required variable names; values remain unreadable.", triggersExternalRun: false }, { id: "jira-profile", verifies: "Forge automation profile and optional default.", triggersExternalRun: false }], rollback: actions.map((a) => ({ actionId: a.id, strategy: "Restore the previous state manually; secret values cannot be read back.", automatic: false })), followUp: { azureDevOps: "Azure DevOps setup is implemented through this provider-neutral plan/apply/doctor boundary." } };
+  const requiredSecrets = [
+    {
+      repositorySecretName: endpointName,
+      valueKey: "callbackEndpoint",
+      purpose: "Forge callback endpoint pipeline variable."
+    },
+    {
+      repositorySecretName: tokenName,
+      valueKey: "callbackAuthToken",
+      purpose: "Forge callback auth token pipeline variable."
+    }
+  ];
+  const scopes = [
+    "provider-secrets",
+    "jira-profile",
+    ...input.setProjectDefault ? ["project-default"] : []
+  ];
+  const actions = scopes.map((scope) => ({
+    id: scope === "provider-secrets" ? "set-provider-secrets" : scope === "jira-profile" ? "upsert-jira-profile" : "set-project-default",
+    scope,
+    summary: `Apply ${scope} for Azure DevOps.`,
+    mutates: "jira"
+  }));
+  const withoutId = {
+    schemaVersion: "automatify.testops.setup/v1",
+    kind: "AutomatifyTestOpsSetupPlan",
+    provider: "azure-devops",
+    project: { key: projectKey },
+    azureDevOps: {
+      organization,
+      project: azureProject,
+      pipelineId,
+      ref,
+      apiVersion,
+      requiredSecrets,
+      guidance: {
+        authentication: "Use an Azure DevOps PAT with least-privilege pipeline read/manage-variable access.",
+        permissions: ["Pipelines: read for doctor; manage variables only for explicit provider-secrets apply."],
+        remoteChangesExcluded: ["accounts", "credentials", "commits", "pull requests", "pipeline runs"]
+      }
+    },
+    jiraProfile: {
+      label: profileLabel,
+      enabled: input.enabled,
+      provider: "azureDevops",
+      config: {
+        organization,
+        project: azureProject,
+        pipelineId,
+        apiVersion,
+        bodyTemplate: JSON.stringify({ resources: { repositories: { self: { refName: ref } } } })
+      },
+      setProjectDefault: input.setProjectDefault
+    },
+    actions,
+    smokeValidation: [
+      {
+        id: "pipeline-content",
+        verifies: "Azure DevOps pipeline metadata without queueing a run.",
+        triggersExternalRun: false
+      },
+      {
+        id: "pipeline-variable-metadata",
+        verifies: "Required variable names; values remain unreadable.",
+        triggersExternalRun: false
+      },
+      {
+        id: "jira-profile",
+        verifies: "Forge automation profile and optional default.",
+        triggersExternalRun: false
+      }
+    ],
+    rollback: actions.map((a) => ({
+      actionId: a.id,
+      strategy: "Restore the previous state manually; secret values cannot be read back.",
+      automatic: false
+    })),
+    followUp: {
+      azureDevOps: "Azure DevOps setup is implemented through this provider-neutral plan/apply/doctor boundary."
+    }
+  };
   return { ...withoutId, planId: digest(withoutId) };
 }
 function validateAzureDevOpsSetupPlan(value) {
   const errors = [];
   const record = value;
-  const exact = (v, keys) => Boolean(v && typeof v === "object" && !Array.isArray(v) && Object.keys(v).sort().join() === [...keys].sort().join());
-  if (!exact(value, ["schemaVersion", "kind", "planId", "provider", "project", "azureDevOps", "jiraProfile", "actions", "smokeValidation", "rollback", "followUp"])) errors.push("Plan has missing or unsupported top-level fields.");
-  if (record?.schemaVersion !== "automatify.testops.setup/v1" || record?.kind !== "AutomatifyTestOpsSetupPlan" || record?.provider !== "azure-devops") errors.push("Plan schema, kind, or provider is invalid.");
-  if (!exact(record?.project, ["key"]) || !/^[A-Z][A-Z0-9_]{1,31}$/.test(record?.project?.key ?? "")) errors.push("project.key is invalid.");
+  const exact = (v, keys) => Boolean(
+    v && typeof v === "object" && !Array.isArray(v) && Object.keys(v).sort().join() === [...keys].sort().join()
+  );
+  if (!exact(value, [
+    "schemaVersion",
+    "kind",
+    "planId",
+    "provider",
+    "project",
+    "azureDevOps",
+    "jiraProfile",
+    "actions",
+    "smokeValidation",
+    "rollback",
+    "followUp"
+  ]))
+    errors.push("Plan has missing or unsupported top-level fields.");
+  if (record?.schemaVersion !== "automatify.testops.setup/v1" || record?.kind !== "AutomatifyTestOpsSetupPlan" || record?.provider !== "azure-devops")
+    errors.push("Plan schema, kind, or provider is invalid.");
+  if (!exact(record?.project, ["key"]) || !/^[A-Z][A-Z0-9_]{1,31}$/.test(record?.project?.key ?? ""))
+    errors.push("project.key is invalid.");
   const a = record?.azureDevOps;
-  if (!exact(a, ["organization", "project", "pipelineId", "ref", "apiVersion", "requiredSecrets", "guidance"]) || ![a?.organization, a?.project, a?.ref, a?.apiVersion].every((x) => typeof x === "string" && x.trim()) || !/^\d+$/.test(a?.pipelineId ?? "")) errors.push("azureDevOps has an invalid shape or fields.");
-  if (!Array.isArray(a?.requiredSecrets) || a.requiredSecrets.length !== 2 || new Set(a.requiredSecrets.map((s) => s.repositorySecretName)).size !== 2 || new Set(a.requiredSecrets.map((s) => s.valueKey)).size !== 2 || !a.requiredSecrets.some((s) => s.valueKey === "callbackEndpoint") || !a.requiredSecrets.some((s) => s.valueKey === "callbackAuthToken") || !a.requiredSecrets.every((s) => exact(s, ["repositorySecretName", "valueKey", "purpose"]) && /^[A-Z_][A-Z0-9_]*$/.test(s.repositorySecretName) && s.purpose)) errors.push("azureDevOps.requiredSecrets is invalid.");
+  if (!exact(a, ["organization", "project", "pipelineId", "ref", "apiVersion", "requiredSecrets", "guidance"]) || ![a?.organization, a?.project, a?.ref, a?.apiVersion].every((x) => typeof x === "string" && x.trim()) || !/^\d+$/.test(a?.pipelineId ?? ""))
+    errors.push("azureDevOps has an invalid shape or fields.");
+  if (!Array.isArray(a?.requiredSecrets) || a.requiredSecrets.length !== 2 || new Set(a.requiredSecrets.map((s) => s.repositorySecretName)).size !== 2 || new Set(a.requiredSecrets.map((s) => s.valueKey)).size !== 2 || !a.requiredSecrets.some((s) => s.valueKey === "callbackEndpoint") || !a.requiredSecrets.some((s) => s.valueKey === "callbackAuthToken") || !a.requiredSecrets.every(
+    (s) => exact(s, ["repositorySecretName", "valueKey", "purpose"]) && /^[A-Z_][A-Z0-9_]*$/.test(s.repositorySecretName) && s.purpose
+  ))
+    errors.push("azureDevOps.requiredSecrets is invalid.");
   const p = record?.jiraProfile;
-  if (!exact(p, ["label", "enabled", "provider", "config", "setProjectDefault"]) || p?.provider !== "azureDevops" || !exact(p?.config, ["organization", "project", "pipelineId", "apiVersion", "bodyTemplate"]) || p.config.organization !== a?.organization || p.config.project !== a?.project || p.config.pipelineId !== a?.pipelineId || p.config.apiVersion !== a?.apiVersion) errors.push("jiraProfile/config is invalid or inconsistent.");
+  if (!exact(p, ["label", "enabled", "provider", "config", "setProjectDefault"]) || p?.provider !== "azureDevops" || !exact(p?.config, ["organization", "project", "pipelineId", "apiVersion", "bodyTemplate"]) || p.config.organization !== a?.organization || p.config.project !== a?.project || p.config.pipelineId !== a?.pipelineId || p.config.apiVersion !== a?.apiVersion)
+    errors.push("jiraProfile/config is invalid or inconsistent.");
   const ids = p?.setProjectDefault ? ["set-provider-secrets", "upsert-jira-profile", "set-project-default"] : ["set-provider-secrets", "upsert-jira-profile"];
   const scopes = p?.setProjectDefault ? ["provider-secrets", "jira-profile", "project-default"] : ["provider-secrets", "jira-profile"];
-  if (!Array.isArray(record?.actions) || record.actions.map((x) => x.id).join() !== ids.join() || !record.actions.every((x, i) => exact(x, ["id", "scope", "summary", "mutates"]) && x.scope === scopes[i] && x.mutates === "jira")) errors.push("actions are invalid.");
+  if (!Array.isArray(record?.actions) || record.actions.map((x) => x.id).join() !== ids.join() || !record.actions.every(
+    (x, i) => exact(x, ["id", "scope", "summary", "mutates"]) && x.scope === scopes[i] && x.mutates === "jira"
+  ))
+    errors.push("actions are invalid.");
   const smokeIds = ["pipeline-content", "pipeline-variable-metadata", "jira-profile"];
-  if (!Array.isArray(record?.smokeValidation) || record.smokeValidation.length !== 3 || !record.smokeValidation.every((x, i) => exact(x, ["id", "verifies", "triggersExternalRun"]) && x.id === smokeIds[i] && x.triggersExternalRun === false)) errors.push("smokeValidation is invalid.");
-  if (!Array.isArray(record?.rollback) || record.rollback.length !== ids.length || !record.rollback.every((x, i) => exact(x, ["actionId", "strategy", "automatic"]) && x.actionId === ids[i] && x.automatic === false)) errors.push("rollback is invalid.");
+  if (!Array.isArray(record?.smokeValidation) || record.smokeValidation.length !== 3 || !record.smokeValidation.every(
+    (x, i) => exact(x, ["id", "verifies", "triggersExternalRun"]) && x.id === smokeIds[i] && x.triggersExternalRun === false
+  ))
+    errors.push("smokeValidation is invalid.");
+  if (!Array.isArray(record?.rollback) || record.rollback.length !== ids.length || !record.rollback.every(
+    (x, i) => exact(x, ["actionId", "strategy", "automatic"]) && x.actionId === ids[i] && x.automatic === false
+  ))
+    errors.push("rollback is invalid.");
   if (errors.length === 0) {
     const { planId, ...rest } = record;
     if (planId !== digest(rest)) errors.push("planId does not match the plan contents.");
@@ -16932,7 +17711,7 @@ function loadPlan(planPath, cwd) {
   const absolute = import_node_path15.default.resolve(cwd, planPath);
   let parsed;
   try {
-    parsed = JSON.parse((0, import_node_fs14.readFileSync)(absolute, "utf8"));
+    parsed = JSON.parse((0, import_node_fs15.readFileSync)(absolute, "utf8"));
   } catch (error) {
     throw new SetupCommandError(
       "PLAN_READ_ERROR",
@@ -16972,14 +17751,26 @@ async function resolveSecrets(parsed, deps) {
       );
     }
     if (!envelope || typeof envelope !== "object" || Array.isArray(envelope)) {
-      throw new SetupCommandError("SECRET_INPUT_ERROR", "Secret stdin must be a JSON object.", ExitCode.ValidationError);
+      throw new SetupCommandError(
+        "SECRET_INPUT_ERROR",
+        "Secret stdin must be a JSON object.",
+        ExitCode.ValidationError
+      );
     }
     for (const [key, value] of Object.entries(envelope)) {
       if (!isSecretKey(key)) {
-        throw new SetupCommandError("SECRET_INPUT_ERROR", `Secret stdin contains unsupported key ${key}.`, ExitCode.ValidationError);
+        throw new SetupCommandError(
+          "SECRET_INPUT_ERROR",
+          `Secret stdin contains unsupported key ${key}.`,
+          ExitCode.ValidationError
+        );
       }
       if (typeof value !== "string" || !value.trim()) {
-        throw new SetupCommandError("SECRET_INPUT_ERROR", `Secret stdin key ${key} must be a non-empty string.`, ExitCode.ValidationError);
+        throw new SetupCommandError(
+          "SECRET_INPUT_ERROR",
+          `Secret stdin key ${key} must be a non-empty string.`,
+          ExitCode.ValidationError
+        );
       }
       values[key] = value.trim();
       sources[key] = "stdin";
@@ -16998,10 +17789,18 @@ async function resolveSecrets(parsed, deps) {
     }
     const envName = target.slice(4);
     if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(envName)) {
-      throw new SetupCommandError("SECRET_REFERENCE_ERROR", `Secret reference for ${key} has an invalid environment variable name.`, ExitCode.ValidationError);
+      throw new SetupCommandError(
+        "SECRET_REFERENCE_ERROR",
+        `Secret reference for ${key} has an invalid environment variable name.`,
+        ExitCode.ValidationError
+      );
     }
     if (sources[key]) {
-      throw new SetupCommandError("SECRET_REFERENCE_ERROR", `Secret ${key} was provided more than once.`, ExitCode.ValidationError);
+      throw new SetupCommandError(
+        "SECRET_REFERENCE_ERROR",
+        `Secret ${key} was provided more than once.`,
+        ExitCode.ValidationError
+      );
     }
     const value = deps.env[envName]?.trim();
     if (!value) {
@@ -17036,7 +17835,11 @@ function approvedScopes(plan, parsed, dryRun) {
       throw new SetupCommandError("APPROVAL_ERROR", `Unsupported approval scope ${scope}.`, ExitCode.UsageError);
     }
     if (!planScopes.includes(scope)) {
-      throw new SetupCommandError("APPROVAL_ERROR", `Approval scope ${scope} is not present in this plan.`, ExitCode.UsageError);
+      throw new SetupCommandError(
+        "APPROVAL_ERROR",
+        `Approval scope ${scope} is not present in this plan.`,
+        ExitCode.UsageError
+      );
     }
     expanded.add(scope);
   }
@@ -17109,10 +17912,7 @@ async function prepareState(plan, scopes, secrets, context, deps, dryRun, rotate
       );
     }
     if (secrets.values.githubAdminToken) {
-      const inspection = await deps.githubProvider.inspectCallbackSecretMetadata(
-        plan,
-        secrets.values.githubAdminToken
-      );
+      const inspection = await deps.githubProvider.inspectCallbackSecretMetadata(plan, secrets.values.githubAdminToken);
       repositorySecretNames = inspection.names;
       const secretsToWrite = plan.github.requiredSecrets.filter(
         (secret) => rotateSecrets || !repositorySecretNames?.has(secret.repositorySecretName)
@@ -17150,7 +17950,7 @@ function resolveWorkflowTarget(plan, repoRoot) {
 function applyWorkflowFile(plan, repoRoot, dryRun) {
   const action = plan.actions.find((item) => item.scope === "workflow-file");
   const target = resolveWorkflowTarget(plan, repoRoot);
-  const sourceContent = (0, import_node_fs14.readFileSync)(plan.github.workflowFile.sourcePath, "utf8");
+  const sourceContent = (0, import_node_fs15.readFileSync)(plan.github.workflowFile.sourcePath, "utf8");
   if (hashSetupContent(sourceContent) !== plan.github.workflowFile.sha256) {
     throw new SetupCommandError(
       "WORKFLOW_SOURCE_CHANGED",
@@ -17158,8 +17958,8 @@ function applyWorkflowFile(plan, repoRoot, dryRun) {
       ExitCode.ValidationError
     );
   }
-  const existed = (0, import_node_fs14.existsSync)(target);
-  const previousContent = existed ? (0, import_node_fs14.readFileSync)(target, "utf8") : void 0;
+  const existed = (0, import_node_fs15.existsSync)(target);
+  const previousContent = existed ? (0, import_node_fs15.readFileSync)(target, "utf8") : void 0;
   const matches = previousContent !== void 0 && hashSetupContent(previousContent) === plan.github.workflowFile.sha256;
   if (matches) {
     return {
@@ -17171,8 +17971,8 @@ function applyWorkflowFile(plan, repoRoot, dryRun) {
     };
   }
   if (!dryRun) {
-    (0, import_node_fs14.mkdirSync)(import_node_path15.default.dirname(target), { recursive: true });
-    (0, import_node_fs14.writeFileSync)(target, sourceContent, { encoding: "utf8", mode: 420 });
+    (0, import_node_fs15.mkdirSync)(import_node_path15.default.dirname(target), { recursive: true });
+    (0, import_node_fs15.writeFileSync)(target, sourceContent, { encoding: "utf8", mode: 420 });
   }
   return {
     id: action.id,
@@ -17215,12 +18015,7 @@ async function applyGitHubSecrets(plan, state, secrets, deps, dryRun, rotateSecr
   }
   const adminToken = secrets.values.githubAdminToken;
   for (const secret of pending) {
-    await deps.githubProvider.setCallbackSecret(
-      plan,
-      secret,
-      secrets.values[secret.valueKey],
-      adminToken
-    );
+    await deps.githubProvider.setCallbackSecret(plan, secret, secrets.values[secret.valueKey], adminToken);
   }
   return {
     id: action.id,
@@ -17347,14 +18142,14 @@ async function inspectPlan(plan, repoRoot, secrets, context, deps) {
   const checks = [];
   let forgeTransportFailure = false;
   const target = resolveWorkflowTarget(plan, repoRoot);
-  if (!(0, import_node_fs14.existsSync)(target)) {
+  if (!(0, import_node_fs15.existsSync)(target)) {
     checks.push({
       id: "workflow-local",
       status: "fail",
       message: `Local workflow file ${plan.github.workflowFile.path} does not exist.`
     });
   } else {
-    const localHash = hashSetupContent((0, import_node_fs14.readFileSync)(target, "utf8"));
+    const localHash = hashSetupContent((0, import_node_fs15.readFileSync)(target, "utf8"));
     checks.push({
       id: "workflow-local",
       status: localHash === plan.github.workflowFile.sha256 ? "pass" : "fail",
@@ -17446,31 +18241,39 @@ async function inspectPlan(plan, repoRoot, secrets, context, deps) {
 function planCommand(args, deps) {
   const parsed = parseArgs10(args, PLAN_VALUE_FLAGS, /* @__PURE__ */ new Set(["--set-default", "--disabled"]));
   if (parsed.errors.length > 0) {
-    return jsonResponse(errorPayload("USAGE_ERROR", "Invalid setup plan arguments.", parsed.errors), ExitCode.UsageError);
+    return jsonResponse(
+      errorPayload("USAGE_ERROR", "Invalid setup plan arguments.", parsed.errors),
+      ExitCode.UsageError
+    );
   }
   const provider = parsed.flags["--provider"] ?? "github-actions";
   if (provider === "azure-devops") {
     try {
-      return jsonResponse(buildAzureDevOpsSetupPlan({
-        projectKey: parsed.flags["--project-key"] ?? "",
-        organization: parsed.flags["--organization"] ?? "",
-        azureProject: parsed.flags["--azure-project"] ?? "",
-        pipelineId: parsed.flags["--pipeline-id"] ?? "",
-        ref: parsed.flags["--ref"] ?? "main",
-        apiVersion: parsed.flags["--api-version"],
-        profileLabel: parsed.flags["--profile-label"] ?? "Azure DevOps",
-        enabled: !parsed.boolFlags.has("--disabled"),
-        setProjectDefault: parsed.boolFlags.has("--set-default"),
-        callbackEndpointVariableName: parsed.flags["--callback-endpoint-variable-name"] ?? "TESTOPS_FORGE_ENDPOINT",
-        callbackAuthTokenVariableName: parsed.flags["--callback-auth-token-variable-name"] ?? "TESTOPS_FORGE_AUTH_TOKEN"
-      }));
+      return jsonResponse(
+        buildAzureDevOpsSetupPlan({
+          projectKey: parsed.flags["--project-key"] ?? "",
+          organization: parsed.flags["--organization"] ?? "",
+          azureProject: parsed.flags["--azure-project"] ?? "",
+          pipelineId: parsed.flags["--pipeline-id"] ?? "",
+          ref: parsed.flags["--ref"] ?? "main",
+          apiVersion: parsed.flags["--api-version"],
+          profileLabel: parsed.flags["--profile-label"] ?? "Azure DevOps",
+          enabled: !parsed.boolFlags.has("--disabled"),
+          setProjectDefault: parsed.boolFlags.has("--set-default"),
+          callbackEndpointVariableName: parsed.flags["--callback-endpoint-variable-name"] ?? "TESTOPS_FORGE_ENDPOINT",
+          callbackAuthTokenVariableName: parsed.flags["--callback-auth-token-variable-name"] ?? "TESTOPS_FORGE_AUTH_TOKEN"
+        })
+      );
     } catch (error) {
       return jsonResponse(errorPayload("VALIDATION_ERROR", safeErrorMessage(error)), ExitCode.ValidationError);
     }
   }
   if (provider !== "github-actions") {
     return jsonResponse(
-      errorPayload("VALIDATION_ERROR", "Only github-actions is implemented in this stage; Azure DevOps is the documented next adapter."),
+      errorPayload(
+        "VALIDATION_ERROR",
+        "Only github-actions is implemented in this stage; Azure DevOps is the documented next adapter."
+      ),
       ExitCode.ValidationError
     );
   }
@@ -17491,16 +18294,16 @@ function planCommand(args, deps) {
     });
     return jsonResponse(plan);
   } catch (error) {
-    return jsonResponse(
-      errorPayload("VALIDATION_ERROR", safeErrorMessage(error)),
-      ExitCode.ValidationError
-    );
+    return jsonResponse(errorPayload("VALIDATION_ERROR", safeErrorMessage(error)), ExitCode.ValidationError);
   }
 }
 async function applyCommand(args, context, deps) {
   const parsed = parseArgs10(args, APPLY_VALUE_FLAGS, APPLY_BOOL_FLAGS, true);
   if (parsed.errors.length > 0) {
-    return jsonResponse(errorPayload("USAGE_ERROR", "Invalid setup apply arguments.", parsed.errors), ExitCode.UsageError);
+    return jsonResponse(
+      errorPayload("USAGE_ERROR", "Invalid setup apply arguments.", parsed.errors),
+      ExitCode.UsageError
+    );
   }
   const planPath = parsed.flags["--plan"];
   if (!planPath) {
@@ -17525,16 +18328,7 @@ async function applyCommand(args, context, deps) {
     const repoRoot = import_node_path15.default.resolve(deps.cwd, parsed.flags["--repo-root"] ?? ".");
     const rotateSecrets = parsed.boolFlags.has("--rotate-secrets");
     const rotateProviderToken = parsed.boolFlags.has("--rotate-provider-token");
-    const state = await prepareState(
-      plan,
-      scopes,
-      secrets,
-      context,
-      deps,
-      dryRun,
-      rotateSecrets,
-      rotateProviderToken
-    );
+    const state = await prepareState(plan, scopes, secrets, context, deps, dryRun, rotateSecrets, rotateProviderToken);
     let appliedProfile = state.matchingProfile;
     for (const action of plan.actions) {
       if (!scopes.includes(action.scope)) {
@@ -17553,14 +18347,7 @@ async function applyCommand(args, context, deps) {
         } else if (action.scope === "github-secrets") {
           actionResults.push(await applyGitHubSecrets(plan, state, secrets, deps, dryRun, rotateSecrets));
         } else if (action.scope === "jira-profile") {
-          const applied = await applyJiraProfile(
-            plan,
-            state,
-            secrets,
-            context,
-            dryRun,
-            rotateProviderToken
-          );
+          const applied = await applyJiraProfile(plan, state, secrets, context, dryRun, rotateProviderToken);
           appliedProfile = applied.profile;
           actionResults.push(applied.result);
         } else if (action.scope === "project-default") {
@@ -17623,49 +18410,146 @@ async function applyCommand(args, context, deps) {
 async function applyAzureCommand(plan, parsed, context, deps, secrets) {
   const dryRun = parsed.boolFlags.has("--dry-run");
   const scopes = approvedScopes(plan, parsed, dryRun);
-  const profiles = requireServiceData(await context.invokeForgeContract("listScenarioAutomationProfiles", { context: { projectKey: plan.project.key } }), "listScenarioAutomationProfiles");
+  const profiles = requireServiceData(
+    await context.invokeForgeContract("listScenarioAutomationProfiles", { context: { projectKey: plan.project.key } }),
+    "listScenarioAutomationProfiles"
+  );
   const current = profiles.find((item) => item.label === plan.jiraProfile.label);
-  if (!dryRun && scopes.includes("provider-secrets") && !secrets.values.azureDevOpsAdminToken) throw new SetupCommandError("SECRET_INPUT_REQUIRED", "azureDevOpsAdminToken is required for the approved Azure DevOps pipeline-variable scope.", ExitCode.ValidationError);
+  if (!dryRun && scopes.includes("provider-secrets") && !secrets.values.azureDevOpsAdminToken)
+    throw new SetupCommandError(
+      "SECRET_INPUT_REQUIRED",
+      "azureDevOpsAdminToken is required for the approved Azure DevOps pipeline-variable scope.",
+      ExitCode.ValidationError
+    );
   const results = [];
   const secretNames = scopes.includes("provider-secrets") && secrets.values.azureDevOpsAdminToken ? (await deps.azureProvider.inspectCallbackSecretMetadata(plan, secrets.values.azureDevOpsAdminToken)).names : void 0;
   let appliedProfile = current;
   for (const action of plan.actions) {
     if (!scopes.includes(action.scope)) {
-      results.push({ id: action.id, scope: action.scope, status: "skipped", message: "Action was not in the explicit approval scope.", rollback: { available: false, guidance: "No mutation occurred." } });
+      results.push({
+        id: action.id,
+        scope: action.scope,
+        status: "skipped",
+        message: "Action was not in the explicit approval scope.",
+        rollback: { available: false, guidance: "No mutation occurred." }
+      });
       continue;
     }
     if (action.scope === "provider-secrets") {
-      const pending = plan.azureDevOps.requiredSecrets.filter((item) => parsed.boolFlags.has("--rotate-secrets") || !secretNames?.has(item.repositorySecretName));
-      if (!dryRun && pending.some((item) => !secrets.values[item.valueKey])) throw new SetupCommandError("SECRET_INPUT_REQUIRED", "Azure DevOps callback secrets are required for approved pipeline variable changes.", ExitCode.ValidationError);
-      if (!dryRun) for (const item of pending) await deps.azureProvider.setCallbackSecret(plan, item, secrets.values[item.valueKey], secrets.values.azureDevOpsAdminToken);
-      results.push({ id: action.id, scope: action.scope, status: dryRun ? "planned" : pending.length ? "updated" : "skipped", message: "Azure DevOps pipeline variable names are managed without printing secret values.", rollback: { available: false, guidance: rollbackFor(plan, action.id) } });
+      const pending = plan.azureDevOps.requiredSecrets.filter(
+        (item) => parsed.boolFlags.has("--rotate-secrets") || !secretNames?.has(item.repositorySecretName)
+      );
+      if (!dryRun && pending.some((item) => !secrets.values[item.valueKey]))
+        throw new SetupCommandError(
+          "SECRET_INPUT_REQUIRED",
+          "Azure DevOps callback secrets are required for approved pipeline variable changes.",
+          ExitCode.ValidationError
+        );
+      if (!dryRun)
+        for (const item of pending)
+          await deps.azureProvider.setCallbackSecret(
+            plan,
+            item,
+            secrets.values[item.valueKey],
+            secrets.values.azureDevOpsAdminToken
+          );
+      results.push({
+        id: action.id,
+        scope: action.scope,
+        status: dryRun ? "planned" : pending.length ? "updated" : "skipped",
+        message: "Azure DevOps pipeline variable names are managed without printing secret values.",
+        rollback: { available: false, guidance: rollbackFor(plan, action.id) }
+      });
     } else if (action.scope === "jira-profile") {
       const rotateProvider = parsed.boolFlags.has("--rotate-provider-token");
-      if (!dryRun && (!current?.hasSecret || rotateProvider) && !secrets.values.azureDevOpsProviderToken) throw new SetupCommandError("SECRET_INPUT_REQUIRED", "azureDevOpsProviderToken is required to create or rotate the Azure provider PAT.", ExitCode.ValidationError);
-      const profile = dryRun ? current ?? { id: "<created-by-forge>", projectKey: plan.project.key, label: plan.jiraProfile.label, provider: "azureDevops", authType: "basicPat", method: "POST", endpointSummary: "<computed-by-forge>", config: plan.jiraProfile.config, enabled: plan.jiraProfile.enabled, hasSecret: false, createdAt: "", updatedAt: "" } : requireServiceData(await context.invokeForgeContract("upsertScenarioAutomationProfile", { context: { projectKey: plan.project.key }, input: { profileId: current?.id, label: plan.jiraProfile.label, provider: "azureDevops", config: plan.jiraProfile.config, enabled: plan.jiraProfile.enabled, secretToken: !current?.hasSecret || rotateProvider ? secrets.values.azureDevOpsProviderToken : void 0 } }), "upsertScenarioAutomationProfile");
+      if (!dryRun && (!current?.hasSecret || rotateProvider) && !secrets.values.azureDevOpsProviderToken)
+        throw new SetupCommandError(
+          "SECRET_INPUT_REQUIRED",
+          "azureDevOpsProviderToken is required to create or rotate the Azure provider PAT.",
+          ExitCode.ValidationError
+        );
+      const profile = dryRun ? current ?? {
+        id: "<created-by-forge>",
+        projectKey: plan.project.key,
+        label: plan.jiraProfile.label,
+        provider: "azureDevops",
+        authType: "basicPat",
+        method: "POST",
+        endpointSummary: "<computed-by-forge>",
+        config: plan.jiraProfile.config,
+        enabled: plan.jiraProfile.enabled,
+        hasSecret: false,
+        createdAt: "",
+        updatedAt: ""
+      } : requireServiceData(
+        await context.invokeForgeContract("upsertScenarioAutomationProfile", {
+          context: { projectKey: plan.project.key },
+          input: {
+            profileId: current?.id,
+            label: plan.jiraProfile.label,
+            provider: "azureDevops",
+            config: plan.jiraProfile.config,
+            enabled: plan.jiraProfile.enabled,
+            secretToken: !current?.hasSecret || rotateProvider ? secrets.values.azureDevOpsProviderToken : void 0
+          }
+        }),
+        "upsertScenarioAutomationProfile"
+      );
       appliedProfile = profile;
-      results.push({ id: action.id, scope: action.scope, status: dryRun ? "planned" : current ? "updated" : "created", message: "Azure DevOps Jira automation profile applied through the existing Forge contract.", rollback: { available: !dryRun, guidance: rollbackFor(plan, action.id) } });
+      results.push({
+        id: action.id,
+        scope: action.scope,
+        status: dryRun ? "planned" : current ? "updated" : "created",
+        message: "Azure DevOps Jira automation profile applied through the existing Forge contract.",
+        rollback: { available: !dryRun, guidance: rollbackFor(plan, action.id) }
+      });
     } else if (action.scope === "project-default" && appliedProfile && !dryRun) {
-      requireServiceData(await context.invokeForgeContract("setScenarioAutomationDefaultProfile", { context: { projectKey: plan.project.key }, profileId: appliedProfile.id }), "setScenarioAutomationDefaultProfile");
-      results.push({ id: action.id, scope: action.scope, status: "updated", message: "Set the Azure DevOps Jira automation profile as project default.", rollback: { available: true, guidance: rollbackFor(plan, action.id) } });
+      requireServiceData(
+        await context.invokeForgeContract("setScenarioAutomationDefaultProfile", {
+          context: { projectKey: plan.project.key },
+          profileId: appliedProfile.id
+        }),
+        "setScenarioAutomationDefaultProfile"
+      );
+      results.push({
+        id: action.id,
+        scope: action.scope,
+        status: "updated",
+        message: "Set the Azure DevOps Jira automation profile as project default.",
+        rollback: { available: true, guidance: rollbackFor(plan, action.id) }
+      });
     } else if (action.scope === "project-default") {
-      results.push({ id: action.id, scope: action.scope, status: "planned", message: "Set the Azure DevOps Jira automation profile as project default.", rollback: { available: false, guidance: rollbackFor(plan, action.id) } });
+      results.push({
+        id: action.id,
+        scope: action.scope,
+        status: "planned",
+        message: "Set the Azure DevOps Jira automation profile as project default.",
+        rollback: { available: false, guidance: rollbackFor(plan, action.id) }
+      });
     }
   }
-  return jsonResponse({ schemaVersion: APPLY_RESULT_SCHEMA_VERSION, planId: plan.planId, provider: plan.provider, status: dryRun ? "dry-run" : "applied", dryRun, confirmed: !dryRun, approvedScopes: scopes, actions: results, smokeValidation: { status: "not-run", externalRunTriggered: false } });
+  return jsonResponse({
+    schemaVersion: APPLY_RESULT_SCHEMA_VERSION,
+    planId: plan.planId,
+    provider: plan.provider,
+    status: dryRun ? "dry-run" : "applied",
+    dryRun,
+    confirmed: !dryRun,
+    approvedScopes: scopes,
+    actions: results,
+    smokeValidation: { status: "not-run", externalRunTriggered: false }
+  });
 }
 async function doctorCommand(args, context, deps) {
-  const parsed = parseArgs10(
-    args,
-    APPLY_VALUE_FLAGS,
-    /* @__PURE__ */ new Set(["--secrets-stdin"]),
-    true
-  );
+  const parsed = parseArgs10(args, APPLY_VALUE_FLAGS, /* @__PURE__ */ new Set(["--secrets-stdin"]), true);
   if (parsed.approvals.length > 0) {
     return jsonResponse(errorPayload("USAGE_ERROR", "setup doctor does not accept --approve."), ExitCode.UsageError);
   }
   if (parsed.errors.length > 0) {
-    return jsonResponse(errorPayload("USAGE_ERROR", "Invalid setup doctor arguments.", parsed.errors), ExitCode.UsageError);
+    return jsonResponse(
+      errorPayload("USAGE_ERROR", "Invalid setup doctor arguments.", parsed.errors),
+      ExitCode.UsageError
+    );
   }
   const planPath = parsed.flags["--plan"];
   if (!planPath) {
@@ -17677,19 +18561,61 @@ async function doctorCommand(args, context, deps) {
     secrets = await resolveSecrets(parsed, deps);
     if (plan.provider === "azure-devops") {
       const checks = [];
-      const inspection = await deps.azureProvider.inspectExecutionDefinition(plan, secrets.values.azureDevOpsProviderToken ?? secrets.values.azureDevOpsAdminToken);
-      checks.push({ id: "pipeline-azure", status: inspection.found ? "pass" : "fail", message: inspection.message });
-      const variables = await deps.azureProvider.inspectCallbackSecretMetadata(plan, secrets.values.azureDevOpsAdminToken);
-      const missing = plan.azureDevOps.requiredSecrets.filter((item) => !variables.names.has(item.repositorySecretName));
-      checks.push({ id: "callback-secret-metadata", status: variables.verified && missing.length === 0 ? "pass" : variables.verified ? "fail" : "warn", message: variables.message });
-      const profiles = requireServiceData(await context.invokeForgeContract("listScenarioAutomationProfiles", { context: { projectKey: plan.project.key } }), "listScenarioAutomationProfiles");
+      const inspection = await deps.azureProvider.inspectExecutionDefinition(
+        plan,
+        secrets.values.azureDevOpsProviderToken ?? secrets.values.azureDevOpsAdminToken
+      );
+      checks.push({
+        id: "pipeline-azure",
+        status: inspection.found && inspection.active === true ? "pass" : "fail",
+        message: inspection.message
+      });
+      const variables = await deps.azureProvider.inspectCallbackSecretMetadata(
+        plan,
+        secrets.values.azureDevOpsAdminToken
+      );
+      const missing = plan.azureDevOps.requiredSecrets.filter(
+        (item) => !variables.names.has(item.repositorySecretName)
+      );
+      checks.push({
+        id: "callback-secret-metadata",
+        status: variables.verified && missing.length === 0 ? "pass" : variables.verified ? "fail" : "warn",
+        message: variables.message
+      });
+      const profiles = requireServiceData(
+        await context.invokeForgeContract("listScenarioAutomationProfiles", {
+          context: { projectKey: plan.project.key }
+        }),
+        "listScenarioAutomationProfiles"
+      );
       const profile = profiles.find((item) => item.label === plan.jiraProfile.label);
       const config = profile?.config;
       const matches = profile?.provider === "azureDevops" && profile.enabled === plan.jiraProfile.enabled && profile.hasSecret && config?.organization === plan.jiraProfile.config.organization && config?.project === plan.jiraProfile.config.project && config?.pipelineId === plan.jiraProfile.config.pipelineId && config?.apiVersion === plan.jiraProfile.config.apiVersion && config?.bodyTemplate === plan.jiraProfile.config.bodyTemplate;
-      checks.push({ id: "jira-profile", status: matches ? "pass" : "fail", message: matches ? "Jira automation profile fields match and Forge reports a stored provider secret." : "Jira automation profile is missing, differs, or lacks provider secret metadata." });
-      if (plan.jiraProfile.setProjectDefault) checks.push({ id: "jira-project-default", status: profile?.isProjectDefault ? "pass" : "fail", message: profile?.isProjectDefault ? "Jira automation profile is the project default." : "Jira automation profile is not the project default." });
+      checks.push({
+        id: "jira-profile",
+        status: matches ? "pass" : "fail",
+        message: matches ? "Jira automation profile fields match and Forge reports a stored provider secret." : "Jira automation profile is missing, differs, or lacks provider secret metadata."
+      });
+      if (plan.jiraProfile.setProjectDefault)
+        checks.push({
+          id: "jira-project-default",
+          status: profile?.isProjectDefault ? "pass" : "fail",
+          message: profile?.isProjectDefault ? "Jira automation profile is the project default." : "Jira automation profile is not the project default."
+        });
       const status = doctorStatus(checks);
-      return jsonResponse({ schemaVersion: DOCTOR_RESULT_SCHEMA_VERSION, planId: plan.planId, provider: plan.provider, status, exitCode: status === "fail" ? ExitCode.ValidationError : ExitCode.Success, externalRunTriggered: false, checks });
+      const exitCode = status === "fail" ? ExitCode.ValidationError : ExitCode.Success;
+      return jsonResponse(
+        {
+          schemaVersion: DOCTOR_RESULT_SCHEMA_VERSION,
+          planId: plan.planId,
+          provider: plan.provider,
+          status,
+          exitCode,
+          externalRunTriggered: false,
+          checks
+        },
+        exitCode
+      );
     }
     const repoRoot = import_node_path15.default.resolve(deps.cwd, parsed.flags["--repo-root"] ?? ".");
     const summary = await inspectPlan(plan, repoRoot, secrets, context, deps);
@@ -17811,10 +18737,7 @@ function suitesToLines(items) {
   if (items.length === 0) {
     return ["Test suites: 0", "No test suites found for the selected context."];
   }
-  return [
-    `Test suites: ${items.length}`,
-    ...items.map((item) => `- ${item.key} ${item.name}`)
-  ];
+  return [`Test suites: ${items.length}`, ...items.map((item) => `- ${item.key} ${item.name}`)];
 }
 function suiteToLines(suite) {
   return [
@@ -18237,6 +19160,12 @@ var COMMAND_REGISTRY = [
     subcommands: ["upload", "download", "open"],
     handler: createAllureHandler()
   },
+  {
+    name: "auth",
+    description: "Secret-safe Jira authentication login, status, and logout commands",
+    subcommands: ["login", "status", "logout"],
+    handler: createAuthHandler()
+  },
   {
     name: "auto",
     description: "Smart auto-ingestion command contract (MVP staged)",
@@ -18259,7 +19188,7 @@ var COMMAND_REGISTRY = [
   {
     name: "config",
     description: "Configuration and auth bootstrap commands",
-    subcommands: ["show", "validate", "set"],
+    subcommands: ["show", "validate", "set", "unset", "migrate-secrets"],
     handler: createConfigHandler()
   },
   {
@@ -18381,9 +19310,7 @@ function buildHelpText(registry = COMMAND_REGISTRY, experimentalSyncEnabled = fa
     "Available command groups:"
   ];
   for (const command of visibleCommands) {
-    lines.push(
-      `  ${command.name.padEnd(12)} ${command.description}${formatSubcommands(command.subcommands)}`
-    );
+    lines.push(`  ${command.name.padEnd(12)} ${command.description}${formatSubcommands(command.subcommands)}`);
   }
   lines.push(
     "",