@automatify-au/cli 0.1.14 → 0.1.15

package/README.md

@@ -77,15 +77,25 @@ Minimum:
 - `TESTOPS_FORGE_ENDPOINT` for commands that call Forge contracts (`doctor`, `ingest`, `run`, `sync`)
 - `TESTOPS_FORGE_AUTH_TOKEN` from the one-time token shown in Forge `Operations -> CLI access`
 
-Local config helper:
+Local Jira auth helper on macOS/Windows:
+```bash
+printf "%s" "$JIRA_API_TOKEN" | automatify testops auth login \
+  --base-url https://automatify-com-au.atlassian.net \
+  --jira-email you@example.com \
+  --token-stdin
+automatify testops auth status
+```
+
+On Linux/CI, keep `JIRA_API_TOKEN` in the environment and run `auth login` without `--token-stdin`; the CLI stores only non-secret Jira settings. Use `automatify testops auth logout` to remove local Jira and Forge credentials while preserving non-secret URL/email settings. Environment variables are not modified by logout.
+
+Forge transport auth remains an advanced setting:
 ```bash
-automatify testops config set baseUrl https://automatify-com-au.atlassian.net
 automatify testops config set projectKey DEV
 automatify testops config set forgeEndpoint "<webtrigger-url>"
 printf "%s" "$TESTOPS_FORGE_AUTH_TOKEN" | automatify testops config set forgeAuthToken --stdin
 ```
 
-`forgeAuthToken` local storage uses macOS Keychain on macOS and current-user Windows DPAPI on Windows. Linux and CI should keep the token in `TESTOPS_FORGE_AUTH_TOKEN`. `.testops-cli.json` stores non-secret values plus, on Windows, only the DPAPI-protected blob. See [WINDOWS.md](./WINDOWS.md) for PowerShell setup and verification.
+Jira and Forge secrets use macOS Keychain on macOS and current-user Windows DPAPI on Windows. Linux and CI keep secrets in `JIRA_API_TOKEN` and `TESTOPS_FORGE_AUTH_TOKEN`. Existing plaintext local tokens remain readable for compatibility and can be migrated with `automatify testops config migrate-secrets`. See [AUTH.md](./AUTH.md) for the normal Jira auth workflow and [WINDOWS.md](./WINDOWS.md) for PowerShell setup and verification.
 
 Optional:
 - `TESTOPS_FORGE_TIMEOUT_MS`
@@ -114,6 +124,10 @@ All TestOps commands are invoked as `automatify testops <command>`:
   - `automatify testops bdd features export --output-dir ./features-export --feature-id <FEATURE_ID>`
 - `runs`
   - `automatify testops runs show --id <RUN_ID>`
+- `auth`
+  - `automatify testops auth login --base-url <JIRA_URL> --jira-email <EMAIL> --token-stdin`
+  - `automatify testops auth status`
+  - `automatify testops auth logout`
 - `config`
   - `automatify testops config show`
   - `automatify testops config validate`

package/dist/automatify.cjs

@@ -10765,10 +10765,170 @@ var Priority;
 
 // src/config.ts
 var import_node_fs = require("node:fs");
-var import_node_child_process = require("node:child_process");
 var import_node_path = __toESM(require("node:path"), 1);
-var DEFAULT_CONFIG_FILENAME = ".testops-cli.json";
+
+// src/secureStore.ts
+var import_node_child_process = require("node:child_process");
 var KEYCHAIN_SERVICE = "automatify-testops-cli";
+function errorText(error) {
+  return error instanceof Error && error.message ? error.message : "unknown secure-storage error";
+}
+function windowsProtectScript() {
+  return [
+    "Add-Type -AssemblyName System.Security",
+    "$plain = [Console]::In.ReadToEnd()",
+    "$bytes = [Text.Encoding]::UTF8.GetBytes($plain)",
+    "$cipher = [System.Security.Cryptography.ProtectedData]::Protect($bytes, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)",
+    "[Console]::Out.Write([Convert]::ToBase64String($cipher))"
+  ].join("; ");
+}
+function windowsUnprotectScript() {
+  return [
+    "Add-Type -AssemblyName System.Security",
+    "$encoded = [Console]::In.ReadToEnd()",
+    "$cipher = [Convert]::FromBase64String($encoded)",
+    "$bytes = [System.Security.Cryptography.ProtectedData]::Unprotect($cipher, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)",
+    "[Console]::Out.Write([Text.Encoding]::UTF8.GetString($bytes))"
+  ].join("; ");
+}
+function quoteSecurityInteractiveArg(value) {
+  if (/\r|\n|\0/.test(value)) {
+    throw new Error("macOS Keychain values cannot contain newline or NUL characters.");
+  }
+  return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+}
+function macOSKeychainWriteInput(account, value) {
+  return [
+    "add-generic-password",
+    "-U",
+    "-s",
+    quoteSecurityInteractiveArg(KEYCHAIN_SERVICE),
+    "-a",
+    quoteSecurityInteractiveArg(account),
+    "-w",
+    quoteSecurityInteractiveArg(value)
+  ].join(" ") + "\n";
+}
+function readSecureSecret(locator, deps = {}) {
+  const platform = deps.platform ?? process.platform;
+  const run = deps.execFileSync ?? import_node_child_process.execFileSync;
+  if (platform === "darwin") {
+    if (!locator.account) {
+      return locator.protectedValue ? {
+        status: "error",
+        message: "This config contains a Windows DPAPI value, but it is being read on macOS. Re-store the secret on this machine."
+      } : { status: "missing" };
+    }
+    try {
+      const value = run("security", ["find-generic-password", "-s", KEYCHAIN_SERVICE, "-a", locator.account, "-w"], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"]
+      }).trim();
+      return value ? { status: "available", value, source: "keychain" } : {
+        status: "error",
+        message: `macOS Keychain returned an empty value for account ${locator.account}. Re-store the secret.`
+      };
+    } catch (error) {
+      return {
+        status: "error",
+        message: `Unable to read macOS Keychain account ${locator.account}: ${errorText(error)}. Re-store the secret.`
+      };
+    }
+  }
+  if (platform === "win32") {
+    if (!locator.protectedValue) {
+      return locator.account ? {
+        status: "error",
+        message: "This config references a macOS Keychain secret, but it is being read on Windows. Re-store the secret for the current Windows user."
+      } : { status: "missing" };
+    }
+    try {
+      const value = run("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", windowsUnprotectScript()], {
+        input: locator.protectedValue,
+        encoding: "utf8",
+        stdio: ["pipe", "pipe", "pipe"]
+      }).trim();
+      return value ? { status: "available", value, source: "secure-store" } : {
+        status: "error",
+        message: "Windows DPAPI returned an empty value. Re-store the secret for the current Windows user."
+      };
+    } catch (error) {
+      return {
+        status: "error",
+        message: `Unable to decrypt the Windows DPAPI value for the current user: ${errorText(error)}. Re-store the secret.`
+      };
+    }
+  }
+  if (locator.account || locator.protectedValue) {
+    return {
+      status: "error",
+      message: "This config contains local secure-store metadata, but local secure storage is supported only on macOS and Windows. Use an environment variable on Linux/CI."
+    };
+  }
+  return { status: "missing" };
+}
+function writeSecureSecret(account, value, deps = {}) {
+  const platform = deps.platform ?? process.platform;
+  const run = deps.execFileSync ?? import_node_child_process.execFileSync;
+  if (platform === "darwin") {
+    try {
+      run("security", ["-q", "-i"], {
+        input: macOSKeychainWriteInput(account, value),
+        encoding: "utf8",
+        stdio: ["pipe", "ignore", "pipe"]
+      });
+    } catch {
+      throw new Error("Unable to store the secret in macOS Keychain.");
+    }
+    return { source: "keychain", account };
+  }
+  if (platform === "win32") {
+    let protectedValue;
+    try {
+      protectedValue = run("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", windowsProtectScript()], {
+        input: value,
+        encoding: "utf8",
+        stdio: ["pipe", "pipe", "pipe"]
+      }).trim();
+    } catch {
+      throw new Error("Unable to protect the secret with Windows DPAPI for the current user.");
+    }
+    if (!protectedValue) {
+      throw new Error("Windows DPAPI returned an empty protected value.");
+    }
+    return { source: "secure-store", protectedValue };
+  }
+  throw new Error(
+    "Secure local secret storage is supported on macOS and Windows only. On Linux/CI, keep secrets in environment variables."
+  );
+}
+function deleteSecureSecret(locator, deps = {}) {
+  const platform = deps.platform ?? process.platform;
+  const run = deps.execFileSync ?? import_node_child_process.execFileSync;
+  if (platform === "darwin") {
+    if (!locator.account) {
+      return { status: "missing" };
+    }
+    try {
+      run("security", ["delete-generic-password", "-s", KEYCHAIN_SERVICE, "-a", locator.account], {
+        stdio: ["ignore", "ignore", "pipe"]
+      });
+      return { status: "deleted" };
+    } catch (error) {
+      return {
+        status: "error",
+        message: `Unable to delete macOS Keychain account ${locator.account}: ${errorText(error)}.`
+      };
+    }
+  }
+  if (platform === "win32") {
+    return locator.protectedValue ? { status: "deleted" } : { status: "missing" };
+  }
+  return locator.account || locator.protectedValue ? { status: "deleted" } : { status: "missing" };
+}
+
+// src/config.ts
+var DEFAULT_CONFIG_FILENAME = ".testops-cli.json";
 function parseFlags(args) {
   const flags = {};
   const unknownFlags = [];
@@ -10802,6 +10962,15 @@ function parseFlags(args) {
 function toStringValue(value) {
   return typeof value === "string" ? value.trim() : "";
 }
+function firstStringValue(...values) {
+  for (const value of values) {
+    const normalized = toStringValue(value);
+    if (normalized) {
+      return normalized;
+    }
+  }
+  return "";
+}
 function readConfigFile(configPath) {
   if (!(0, import_node_fs.existsSync)(configPath)) {
     return {};
@@ -10814,6 +10983,27 @@ function readConfigFile(configPath) {
     return {};
   }
 }
+function readConfigFileForMutation(configPath) {
+  if (!(0, import_node_fs.existsSync)(configPath)) {
+    return { file: {} };
+  }
+  try {
+    const raw = (0, import_node_fs.readFileSync)(configPath, "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      return {
+        file: {},
+        error: `Unable to update config at ${configPath}: existing config must contain a JSON object.`
+      };
+    }
+    return { file: parsed };
+  } catch {
+    return {
+      file: {},
+      error: `Unable to update config at ${configPath}: existing config is not valid JSON. Fix or remove it before retrying.`
+    };
+  }
+}
 function writeConfigFile(configPath, file) {
   (0, import_node_fs.writeFileSync)(configPath, `${JSON.stringify(file, null, 2)}
 `, "utf8");
@@ -10833,63 +11023,46 @@ function readAuthMode(input) {
 function defaultKeychainAccount(configPath) {
   return import_node_path.default.resolve(configPath);
 }
-function readKeychainSecret(account) {
-  if (!account || process.platform !== "darwin") {
-    return "";
+function defaultJiraApiTokenKeychainAccount(configPath) {
+  return `${import_node_path.default.resolve(configPath)}:jiraApiToken`;
+}
+function valueFromPrecedence(key, flagValue, envValue, fileValue, fallback = "") {
+  if (flagValue) {
+    return { value: flagValue, source: "flag" };
   }
-  try {
-    return (0, import_node_child_process.execFileSync)("security", ["find-generic-password", "-s", KEYCHAIN_SERVICE, "-a", account, "-w"], {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
-  } catch {
-    return "";
+  if (envValue) {
+    return { value: envValue, source: "env" };
   }
-}
-function setKeychainSecret(account, value) {
-  if (process.platform !== "darwin") {
-    throw new Error("Keychain-backed secrets are only supported on macOS.");
+  if (fileValue) {
+    return { value: fileValue, source: "file" };
   }
-  (0, import_node_child_process.execFileSync)("security", ["add-generic-password", "-U", "-s", KEYCHAIN_SERVICE, "-a", account, "-w", value], {
-    stdio: ["ignore", "ignore", "pipe"]
-  });
+  if (fallback) {
+    return { value: fallback, source: "default" };
+  }
+  return { value: "", source: "default" };
 }
-function protectWindowsSecret(value) {
-  const script = [
-    "Add-Type -AssemblyName System.Security",
-    "$plain = [Console]::In.ReadToEnd()",
-    "$bytes = [Text.Encoding]::UTF8.GetBytes($plain)",
-    "$cipher = [System.Security.Cryptography.ProtectedData]::Protect($bytes, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)",
-    "[Console]::Out.Write([Convert]::ToBase64String($cipher))"
-  ].join("; ");
-  return (0, import_node_child_process.execFileSync)("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], {
-    input: value,
-    encoding: "utf8",
-    stdio: ["pipe", "pipe", "pipe"]
-  }).trim();
-}
-function unprotectWindowsSecret(protectedValue) {
-  if (!protectedValue || process.platform !== "win32") {
-    return "";
+function secureAccountForKey(key, file, configPath) {
+  if (key === "forgeAuthToken") {
+    return toStringValue(file.forgeAuthTokenKeychainAccount) || defaultKeychainAccount(configPath);
   }
-  const script = [
-    "Add-Type -AssemblyName System.Security",
-    "$encoded = [Console]::In.ReadToEnd()",
-    "$cipher = [Convert]::FromBase64String($encoded)",
-    "$bytes = [System.Security.Cryptography.ProtectedData]::Unprotect($cipher, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)",
-    "[Console]::Out.Write([Text.Encoding]::UTF8.GetString($bytes))"
-  ].join("; ");
-  try {
-    return (0, import_node_child_process.execFileSync)("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], {
-      input: protectedValue,
-      encoding: "utf8",
-      stdio: ["pipe", "pipe", "ignore"]
-    }).trim();
-  } catch {
-    return "";
+  return toStringValue(file.jiraApiTokenKeychainAccount) || defaultJiraApiTokenKeychainAccount(configPath);
+}
+function secureLocatorForKey(key, file) {
+  if (key === "forgeAuthToken") {
+    return {
+      account: toStringValue(file.forgeAuthTokenKeychainAccount) || void 0,
+      protectedValue: toStringValue(file.forgeAuthTokenProtected) || void 0
+    };
   }
+  return {
+    account: toStringValue(file.jiraApiTokenKeychainAccount) || void 0,
+    protectedValue: toStringValue(file.jiraApiTokenProtected) || void 0
+  };
 }
-function valueFromPrecedence(key, flagValue, envValue, fileValue, fallback = "") {
+function secretEnvironmentName(key) {
+  return key === "jiraApiToken" ? "JIRA_API_TOKEN" : "TESTOPS_FORGE_AUTH_TOKEN";
+}
+function resolveSecretValue(key, flagValue, envValue, fileValue, file) {
   if (flagValue) {
     return { value: flagValue, source: "flag" };
   }
@@ -10899,11 +11072,33 @@ function valueFromPrecedence(key, flagValue, envValue, fileValue, fallback = "")
   if (fileValue) {
     return { value: fileValue, source: "file" };
   }
-  if (fallback) {
-    return { value: fallback, source: "default" };
+  const secure = readSecureSecret(secureLocatorForKey(key, file));
+  if (secure.status === "available") {
+    return { value: secure.value, source: secure.source };
+  }
+  if (secure.status === "error") {
+    return { value: "", source: "default", error: `${key}: ${secure.message}` };
   }
   return { value: "", source: "default" };
 }
+function clearSecretFields(file, key) {
+  if (key === "forgeAuthToken") {
+    return {
+      ...file,
+      forgeAuthToken: void 0,
+      TESTOPS_FORGE_AUTH_TOKEN: void 0,
+      forgeAuthTokenKeychainAccount: void 0,
+      forgeAuthTokenProtected: void 0
+    };
+  }
+  return {
+    ...file,
+    jiraApiToken: void 0,
+    JIRA_API_TOKEN: void 0,
+    jiraApiTokenKeychainAccount: void 0,
+    jiraApiTokenProtected: void 0
+  };
+}
 function resolveCliConfig(args, env = process.env, cwd = process.cwd()) {
   const { flags, unknownFlags } = parseFlags(args);
   const configPathFlag = flags["--config"] ? import_node_path.default.resolve(cwd, flags["--config"]) : "";
@@ -10942,11 +11137,12 @@ function resolveCliConfig(args, env = process.env, cwd = process.cwd()) {
     toStringValue(env.JIRA_EMAIL),
     toStringValue(file.jiraEmail ?? file.JIRA_EMAIL)
   );
-  const jiraApiTokenResolved = valueFromPrecedence(
+  const jiraApiTokenResolved = resolveSecretValue(
     "jiraApiToken",
     toStringValue(flags["--jira-api-token"]),
     toStringValue(env.JIRA_API_TOKEN),
-    toStringValue(file.jiraApiToken ?? file.JIRA_API_TOKEN)
+    firstStringValue(file.jiraApiToken, file.JIRA_API_TOKEN),
+    file
   );
   const forgeEndpointResolved = valueFromPrecedence(
     "forgeEndpoint",
@@ -10960,11 +11156,13 @@ function resolveCliConfig(args, env = process.env, cwd = process.cwd()) {
     "",
     toStringValue(file.forgeAuthTokenKeychainAccount)
   );
-  const forgeAuthTokenFromEnv = toStringValue(env.TESTOPS_FORGE_AUTH_TOKEN);
-  const forgeAuthTokenFromFile = toStringValue(file.forgeAuthToken ?? file.TESTOPS_FORGE_AUTH_TOKEN);
-  const forgeAuthTokenFromKeychain = forgeAuthTokenFromEnv || forgeAuthTokenFromFile || !forgeAuthTokenKeychainAccountResolved.value ? "" : readKeychainSecret(forgeAuthTokenKeychainAccountResolved.value);
-  const forgeAuthTokenFromWindowsStore = forgeAuthTokenFromEnv || forgeAuthTokenFromFile || forgeAuthTokenFromKeychain ? "" : unprotectWindowsSecret(toStringValue(file.forgeAuthTokenProtected));
-  const forgeAuthTokenResolved = forgeAuthTokenFromEnv ? { value: forgeAuthTokenFromEnv, source: "env" } : forgeAuthTokenFromFile ? { value: forgeAuthTokenFromFile, source: "file" } : forgeAuthTokenFromKeychain ? { value: forgeAuthTokenFromKeychain, source: "keychain" } : forgeAuthTokenFromWindowsStore ? { value: forgeAuthTokenFromWindowsStore, source: "secure-store" } : { value: "", source: "default" };
+  const forgeAuthTokenResolved = resolveSecretValue(
+    "forgeAuthToken",
+    "",
+    toStringValue(env.TESTOPS_FORGE_AUTH_TOKEN),
+    firstStringValue(file.forgeAuthToken, file.TESTOPS_FORGE_AUTH_TOKEN),
+    file
+  );
   const config = {
     baseUrl: normalizeBaseUrl(baseUrlResolved.value),
     projectKey: projectKeyResolved.value,
@@ -10990,13 +11188,16 @@ function resolveCliConfig(args, env = process.env, cwd = process.cwd()) {
     configPath: configPathSource
   };
   const warnings = [];
+  const errors = [jiraApiTokenResolved.error, forgeAuthTokenResolved.error].filter(
+    (value) => Boolean(value)
+  );
   if (unknownFlags.length > 0) {
     warnings.push(`Ignored unknown config flags: ${unknownFlags.join(", ")}`);
   }
   if (!(0, import_node_fs.existsSync)(configPath) && sources.configPath !== "default") {
     warnings.push(`Config file not found at ${configPath}; using env/flags/defaults.`);
   }
-  return { values: config, sources, warnings };
+  return { values: config, sources, warnings, errors };
 }
 function maskSecret(value) {
   if (!value) {
@@ -11009,7 +11210,7 @@ function maskSecret(value) {
 }
 function validateResolvedConfig(resolution) {
   const { values } = resolution;
-  const errors = [];
+  const errors = [...resolution.errors];
   const warnings = [...resolution.warnings];
   if (!values.baseUrl) {
     errors.push("Missing required setting: JIRA_BASE_URL (flag/env/file).");
@@ -11024,10 +11225,8 @@ function validateResolvedConfig(resolution) {
     if (!values.jiraApiToken) {
       errors.push("Auth mode api-token requires JIRA_API_TOKEN.");
     }
-  } else {
-    if (values.jiraApiToken || values.jiraEmail) {
-      warnings.push("JIRA_EMAIL/JIRA_API_TOKEN were provided but auth mode is 'none'.");
-    }
+  } else if (values.jiraApiToken || values.jiraEmail) {
+    warnings.push("JIRA_EMAIL/JIRA_API_TOKEN were provided but auth mode is 'none'.");
   }
   return { ok: errors.length === 0, errors, warnings };
 }
@@ -11090,53 +11289,33 @@ function applyConfigSet(configPath, rawKey, value) {
       ]
     };
   }
-  const file = readConfigFile(configPath);
-  if (key === "forgeAuthToken") {
-    if (process.platform === "win32") {
-      try {
-        const protectedValue = protectWindowsSecret(value);
-        writeConfigFile(configPath, {
-          ...file,
-          forgeAuthToken: void 0,
-          TESTOPS_FORGE_AUTH_TOKEN: void 0,
-          forgeAuthTokenKeychainAccount: void 0,
-          forgeAuthTokenProtected: protectedValue
-        });
-        return {
-          exitCode: ExitCode.Success,
-          stdout: ["Config updated: forgeAuthToken protected with Windows DPAPI for the current user."]
-        };
-      } catch (error) {
-        return {
-          exitCode: ExitCode.ValidationError,
-          stderr: [
-            `Unable to store forgeAuthToken securely: ${error instanceof Error ? error.message : "unknown secure-storage error"}`
-          ]
-        };
-      }
-    }
-    if (process.platform !== "darwin") {
+  const mutable = readConfigFileForMutation(configPath);
+  if (mutable.error) {
+    return { exitCode: ExitCode.ValidationError, stderr: [mutable.error] };
+  }
+  const file = mutable.file;
+  if (key === "forgeAuthToken" || key === "jiraApiToken") {
+    const secretKey = key;
+    const account = secureAccountForKey(secretKey, file, configPath);
+    try {
+      const stored = writeSecureSecret(account, value);
+      const cleared = clearSecretFields(file, secretKey);
+      const nextFile2 = stored.source === "keychain" ? secretKey === "forgeAuthToken" ? { ...cleared, forgeAuthTokenKeychainAccount: stored.account } : { ...cleared, jiraApiTokenKeychainAccount: stored.account } : secretKey === "forgeAuthToken" ? { ...cleared, forgeAuthTokenProtected: stored.protectedValue } : { ...cleared, jiraApiTokenProtected: stored.protectedValue };
+      writeConfigFile(configPath, nextFile2);
+      const backend = stored.source === "keychain" ? "macOS Keychain" : "Windows DPAPI for the current user";
       return {
-        exitCode: ExitCode.UsageError,
+        exitCode: ExitCode.Success,
+        stdout: [`Config updated: ${secretKey} stored securely with ${backend}.`]
+      };
+    } catch (error) {
+      const unsupported = process.platform !== "darwin" && process.platform !== "win32";
+      return {
+        exitCode: unsupported ? ExitCode.UsageError : ExitCode.ValidationError,
         stderr: [
-          "Secure local forgeAuthToken storage is currently supported on macOS and Windows. On Linux/CI, set TESTOPS_FORGE_AUTH_TOKEN in the environment."
+          `Unable to store ${secretKey} securely: ${error instanceof Error ? error.message : "unknown secure-storage error"} Use ${secretEnvironmentName(secretKey)} on Linux/CI.`
         ]
       };
     }
-    const account = toStringValue(file.forgeAuthTokenKeychainAccount) || defaultKeychainAccount(configPath);
-    setKeychainSecret(account, value);
-    const nextFile2 = {
-      ...file,
-      forgeAuthToken: void 0,
-      TESTOPS_FORGE_AUTH_TOKEN: void 0,
-      forgeAuthTokenProtected: void 0,
-      forgeAuthTokenKeychainAccount: account
-    };
-    writeConfigFile(configPath, nextFile2);
-    return {
-      exitCode: ExitCode.Success,
-      stdout: [`Config updated: forgeAuthToken stored in macOS Keychain (${account}).`]
-    };
   }
   const nextFile = {
     ...file,
@@ -11148,6 +11327,101 @@ function applyConfigSet(configPath, rawKey, value) {
     stdout: [`Config updated: ${rawKey}.`]
   };
 }
+function configFileKeysFor(key) {
+  switch (key) {
+    case "baseUrl":
+      return ["baseUrl", "JIRA_BASE_URL"];
+    case "projectKey":
+      return ["projectKey", "JIRA_PROJECT_KEY"];
+    case "issueKey":
+      return ["issueKey", "JIRA_ISSUE_KEY"];
+    case "authMode":
+      return ["authMode", "TESTOPS_AUTH_MODE"];
+    case "jiraEmail":
+      return ["jiraEmail", "JIRA_EMAIL"];
+    case "forgeEndpoint":
+      return ["forgeEndpoint", "TESTOPS_FORGE_ENDPOINT"];
+    default:
+      return [key];
+  }
+}
+function applyConfigUnset(configPath, rawKey) {
+  const key = normalizeConfigSetKey(rawKey);
+  if (!key) {
+    return {
+      exitCode: ExitCode.UsageError,
+      stderr: ["Usage: automatify testops config unset <key>"]
+    };
+  }
+  const mutable = readConfigFileForMutation(configPath);
+  if (mutable.error) {
+    return { exitCode: ExitCode.ValidationError, stderr: [mutable.error] };
+  }
+  const file = mutable.file;
+  if (key === "forgeAuthToken" || key === "jiraApiToken") {
+    const secretKey = key;
+    const deleted = deleteSecureSecret(secureLocatorForKey(secretKey, file));
+    if (deleted.status === "error") {
+      return { exitCode: ExitCode.ValidationError, stderr: [deleted.message] };
+    }
+    writeConfigFile(configPath, clearSecretFields(file, secretKey));
+    return { exitCode: ExitCode.Success, stdout: [`Config removed: ${secretKey}.`] };
+  }
+  const next = { ...file };
+  for (const fileKey of configFileKeysFor(key)) {
+    delete next[fileKey];
+  }
+  writeConfigFile(configPath, next);
+  return { exitCode: ExitCode.Success, stdout: [`Config removed: ${rawKey}.`] };
+}
+function applyConfigMigrateSecrets(configPath) {
+  const mutable = readConfigFileForMutation(configPath);
+  if (mutable.error) {
+    return { exitCode: ExitCode.ValidationError, stderr: [mutable.error] };
+  }
+  const file = mutable.file;
+  const pending = [];
+  const jiraApiToken = firstStringValue(file.jiraApiToken, file.JIRA_API_TOKEN);
+  const forgeAuthToken = firstStringValue(file.forgeAuthToken, file.TESTOPS_FORGE_AUTH_TOKEN);
+  if (jiraApiToken) {
+    pending.push({ key: "jiraApiToken", value: jiraApiToken });
+  }
+  if (forgeAuthToken) {
+    pending.push({ key: "forgeAuthToken", value: forgeAuthToken });
+  }
+  if (pending.length === 0) {
+    return { exitCode: ExitCode.Success, stdout: ["No plaintext local secrets require migration."] };
+  }
+  const migrated = [];
+  for (const item of pending) {
+    const response = applyConfigSet(configPath, item.key, item.value);
+    if (response.exitCode !== ExitCode.Success) {
+      return {
+        exitCode: response.exitCode,
+        stdout: migrated.length > 0 ? [`Migrated before failure: ${migrated.join(", ")}.`] : void 0,
+        stderr: response.stderr
+      };
+    }
+    migrated.push(item.key);
+  }
+  return {
+    exitCode: ExitCode.Success,
+    stdout: [`Migrated plaintext secrets to secure storage: ${migrated.join(", ")}.`]
+  };
+}
+function stripConfigPathArgs(args) {
+  const operands = [];
+  for (let i = 0; i < args.length; i += 1) {
+    if (args[i] === "--config") {
+      if (args[i + 1] && !args[i + 1].startsWith("--")) {
+        i += 1;
+      }
+      continue;
+    }
+    operands.push(args[i]);
+  }
+  return operands;
+}
 function createConfigHandler(env = process.env, cwd = process.cwd()) {
   return (request) => {
     const [subcommand, ...subArgs] = request.args;
@@ -11156,7 +11430,11 @@ function createConfigHandler(env = process.env, cwd = process.cwd()) {
     if (subcommand === "show") {
       return {
         exitCode: ExitCode.Success,
-        stdout: [...toDisplayLines(resolution), ...validation.warnings.map((line) => `WARN: ${line}`)]
+        stdout: [
+          ...toDisplayLines(resolution),
+          ...validation.warnings.map((line) => `WARN: ${line}`),
+          ...resolution.errors.map((line) => `ERROR: ${line}`)
+        ]
       };
     }
     if (subcommand === "validate") {
@@ -11177,17 +11455,25 @@ function createConfigHandler(env = process.env, cwd = process.cwd()) {
       };
     }
     if (subcommand === "set") {
-      const [key, ...valueParts] = subArgs;
-      const readValueFromStdin = key === "forgeAuthToken" && valueParts.length === 1 && valueParts[0] === "--stdin";
+      const [key, ...valueParts] = stripConfigPathArgs(subArgs);
+      const normalizedKey = normalizeConfigSetKey(key ?? "");
+      const readValueFromStdin = (normalizedKey === "forgeAuthToken" || normalizedKey === "jiraApiToken") && valueParts.length === 1 && valueParts[0] === "--stdin";
       const value = readValueFromStdin ? (0, import_node_fs.readFileSync)(0, "utf8").trim() : valueParts.join(" ").trim();
       if (!key || !value) {
         return {
           exitCode: ExitCode.UsageError,
-          stderr: ["Usage: automatify testops config set <key> <value>"]
+          stderr: ["Usage: automatify testops config set <key> <value|--stdin>"]
         };
       }
       return applyConfigSet(resolution.values.configPath, key, value);
     }
+    if (subcommand === "unset") {
+      const [key] = stripConfigPathArgs(subArgs);
+      return applyConfigUnset(resolution.values.configPath, key ?? "");
+    }
+    if (subcommand === "migrate-secrets") {
+      return applyConfigMigrateSecrets(resolution.values.configPath);
+    }
     return {
       exitCode: ExitCode.UsageError,
       stderr: [`Unsupported config subcommand: ${subcommand}`]
@@ -13627,8 +13913,255 @@ function createAllureHandler(deps = {}) {
   };
 }
 
-// src/bdd.ts
+// src/auth.ts
 var import_node_fs10 = require("node:fs");
+function parseAuthArgs(args, allowLoginFlags) {
+  const configArgs = [];
+  const unknown = [];
+  let baseUrl = "";
+  let jiraEmail = "";
+  let tokenStdin = false;
+  for (let i = 0; i < args.length; i += 1) {
+    const token = args[i];
+    if (token === "--config") {
+      const value = args[i + 1];
+      if (!value || value.startsWith("--")) {
+        unknown.push(token);
+        continue;
+      }
+      configArgs.push(token, value);
+      i += 1;
+      continue;
+    }
+    if (allowLoginFlags && token === "--base-url") {
+      const value = args[i + 1];
+      if (!value || value.startsWith("--")) {
+        unknown.push(token);
+        continue;
+      }
+      baseUrl = value.trim();
+      i += 1;
+      continue;
+    }
+    if (allowLoginFlags && token === "--jira-email") {
+      const value = args[i + 1];
+      if (!value || value.startsWith("--")) {
+        unknown.push(token);
+        continue;
+      }
+      jiraEmail = value.trim();
+      i += 1;
+      continue;
+    }
+    if (allowLoginFlags && token === "--token-stdin") {
+      tokenStdin = true;
+      continue;
+    }
+    unknown.push(token);
+  }
+  return { configArgs, baseUrl, jiraEmail, tokenStdin, unknown };
+}
+function runConfigMutation(handler, args, context) {
+  const response = handler(
+    {
+      group: "config",
+      args,
+      rawArgs: ["config", ...args]
+    },
+    context
+  );
+  if (response instanceof Promise) {
+    throw new Error("Config mutations must remain synchronous.");
+  }
+  return response;
+}
+function sourceLabel(source) {
+  switch (source) {
+    case "keychain":
+      return "macOS Keychain";
+    case "secure-store":
+      return "Windows DPAPI";
+    case "env":
+      return "environment";
+    case "file":
+      return "legacy plaintext config";
+    case "flag":
+      return "command flag";
+    default:
+      return "not configured";
+  }
+}
+function authState(parts) {
+  const populated = parts.filter(Boolean).length;
+  if (populated === 0) {
+    return "not configured";
+  }
+  return populated === parts.length ? "configured" : "incomplete";
+}
+function createStatusResponse(args, env, cwd) {
+  const parsed = parseAuthArgs(args, false);
+  if (parsed.unknown.length > 0) {
+    return {
+      exitCode: ExitCode.UsageError,
+      stderr: ["Unsupported auth status arguments. Only --config <path> is supported."]
+    };
+  }
+  const resolution = resolveCliConfig(parsed.configArgs, env, cwd);
+  const { values, sources } = resolution;
+  const jiraState = authState([values.baseUrl, values.jiraEmail, values.jiraApiToken]);
+  const forgeState = authState([values.forgeEndpoint, values.forgeAuthToken]);
+  const stdout = [
+    "Auth status (secret-safe):",
+    `  Jira: ${jiraState}`,
+    `    baseUrl: ${values.baseUrl || "<unset>"}`,
+    `    email: ${values.jiraEmail || "<unset>"}`,
+    `    apiToken: ${values.jiraApiToken ? `configured (${sourceLabel(sources.jiraApiToken)})` : "<unset>"}`,
+    `  Forge transport: ${forgeState}`,
+    `    endpoint: ${values.forgeEndpoint || "<unset>"}`,
+    `    authToken: ${values.forgeAuthToken ? `configured (${sourceLabel(sources.forgeAuthToken)})` : "<unset>"}`,
+    `  configPath: ${values.configPath}`
+  ];
+  if (resolution.errors.length > 0) {
+    return {
+      exitCode: ExitCode.ValidationError,
+      stdout,
+      stderr: resolution.errors.map((error) => `ERROR: ${error}`)
+    };
+  }
+  return { exitCode: ExitCode.Success, stdout };
+}
+function createLoginResponse(args, env, cwd, readStdin, platform, context) {
+  const parsed = parseAuthArgs(args, true);
+  if (parsed.unknown.length > 0) {
+    return {
+      exitCode: ExitCode.UsageError,
+      stderr: [
+        "Unsupported auth login arguments. Use --base-url, --jira-email, --token-stdin, and optional --config only.",
+        "Secrets must be provided through --token-stdin or environment variables, never as command-line values."
+      ]
+    };
+  }
+  const current = resolveCliConfig(parsed.configArgs, env, cwd);
+  const baseUrl = parsed.baseUrl || env.JIRA_BASE_URL?.trim() || current.values.baseUrl;
+  const jiraEmail = parsed.jiraEmail || env.JIRA_EMAIL?.trim() || current.values.jiraEmail;
+  const stdinToken = parsed.tokenStdin ? readStdin().trim() : "";
+  const effectiveToken = stdinToken || env.JIRA_API_TOKEN?.trim() || current.values.jiraApiToken;
+  const missing = [];
+  if (!baseUrl) missing.push("--base-url or JIRA_BASE_URL");
+  if (!jiraEmail) missing.push("--jira-email or JIRA_EMAIL");
+  if (!effectiveToken) missing.push("--token-stdin, JIRA_API_TOKEN, or an existing stored token");
+  if (missing.length > 0) {
+    return {
+      exitCode: ExitCode.UsageError,
+      stderr: [
+        `Jira login is incomplete. Provide: ${missing.join(", ")}.`,
+        "Secrets are never accepted as normal command-line values."
+      ]
+    };
+  }
+  if (parsed.tokenStdin && platform !== "darwin" && platform !== "win32") {
+    return {
+      exitCode: ExitCode.UsageError,
+      stderr: [
+        "Local secure secret storage is supported only on macOS and Windows.",
+        "On Linux/CI, set JIRA_API_TOKEN in the environment and run auth login without --token-stdin."
+      ]
+    };
+  }
+  const configHandler = createConfigHandler(env, cwd);
+  const configSuffix = parsed.configArgs;
+  const steps = [];
+  if (stdinToken) {
+    steps.push({ label: "Jira API token", args: ["set", "jiraApiToken", stdinToken, ...configSuffix] });
+  }
+  steps.push(
+    { label: "Jira base URL", args: ["set", "baseUrl", baseUrl, ...configSuffix] },
+    { label: "Jira email", args: ["set", "jiraEmail", jiraEmail, ...configSuffix] },
+    { label: "auth mode", args: ["set", "authMode", "api-token", ...configSuffix] }
+  );
+  const completed = [];
+  for (const step of steps) {
+    const response = runConfigMutation(configHandler, step.args, context);
+    if (response.exitCode !== ExitCode.Success) {
+      return {
+        exitCode: response.exitCode,
+        stdout: completed.length > 0 ? [`Configured before failure: ${completed.join(", ")}.`] : void 0,
+        stderr: response.stderr
+      };
+    }
+    completed.push(step.label);
+  }
+  const tokenSource = stdinToken ? platform === "darwin" ? "macOS Keychain" : "Windows DPAPI" : sourceLabel(
+    current.sources.jiraApiToken === "default" && env.JIRA_API_TOKEN ? "env" : current.sources.jiraApiToken
+  );
+  return {
+    exitCode: ExitCode.Success,
+    stdout: [
+      "Jira login configured.",
+      `  baseUrl: ${baseUrl.replace(/\/$/, "")}`,
+      `  email: ${jiraEmail}`,
+      `  apiToken: configured (${tokenSource})`,
+      "Run `automatify testops auth status` to verify the resolved credentials."
+    ]
+  };
+}
+function createLogoutResponse(args, env, cwd, context) {
+  const parsed = parseAuthArgs(args, false);
+  if (parsed.unknown.length > 0) {
+    return {
+      exitCode: ExitCode.UsageError,
+      stderr: ["Unsupported auth logout arguments. Only --config <path> is supported."]
+    };
+  }
+  const configHandler = createConfigHandler(env, cwd);
+  const failures = [];
+  const removed = [];
+  for (const key of ["jiraApiToken", "forgeAuthToken"]) {
+    const response = runConfigMutation(configHandler, ["unset", key, ...parsed.configArgs], context);
+    if (response.exitCode === ExitCode.Success) {
+      removed.push(key);
+    } else {
+      failures.push(...response.stderr ?? [`Unable to remove ${key}.`]);
+    }
+  }
+  if (failures.length > 0) {
+    return {
+      exitCode: ExitCode.ValidationError,
+      stdout: removed.length > 0 ? [`Removed before failure: ${removed.join(", ")}.`] : void 0,
+      stderr: failures
+    };
+  }
+  const stdout = ["Local Jira and Forge credentials removed.", "Non-secret URL/email settings were preserved."];
+  if (env.JIRA_API_TOKEN || env.TESTOPS_FORGE_AUTH_TOKEN) {
+    stdout.push("Environment-provided credentials are unchanged and may still resolve as configured.");
+  }
+  return { exitCode: ExitCode.Success, stdout };
+}
+function createAuthHandler(deps = {}) {
+  const env = deps.env ?? process.env;
+  const cwd = deps.cwd ?? process.cwd();
+  const readStdin = deps.readStdin ?? (() => (0, import_node_fs10.readFileSync)(0, "utf8"));
+  const platform = deps.platform ?? process.platform;
+  return (request, context) => {
+    const [subcommand, ...args] = request.args;
+    if (subcommand === "status") {
+      return createStatusResponse(args, env, cwd);
+    }
+    if (subcommand === "login") {
+      return createLoginResponse(args, env, cwd, readStdin, platform, context);
+    }
+    if (subcommand === "logout") {
+      return createLogoutResponse(args, env, cwd, context);
+    }
+    return {
+      exitCode: ExitCode.UsageError,
+      stderr: ["Unsupported auth subcommand. Use login, status, or logout."]
+    };
+  };
+}
+
+// src/bdd.ts
+var import_node_fs11 = require("node:fs");
 var import_node_path11 = __toESM(require("node:path"), 1);
 var import_yazl = __toESM(require_yazl(), 1);
 
@@ -14053,7 +14586,7 @@ function toJsonExportManifestItems(items) {
 async function defaultCreateZipArchive(archivePath, entries) {
   await new Promise((resolve, reject) => {
     const zip = new import_yazl.ZipFile();
-    const output = zip.outputStream.pipe((0, import_node_fs10.createWriteStream)(archivePath));
+    const output = zip.outputStream.pipe((0, import_node_fs11.createWriteStream)(archivePath));
     output.on("close", () => resolve());
     output.on("error", reject);
     zip.outputStream.on("error", reject);
@@ -14083,10 +14616,10 @@ function missingProjectResponse() {
 function createBddHandler(deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const env = deps.env ?? process.env;
-  const mkdir = deps.mkdir ?? ((targetPath, options) => (0, import_node_fs10.mkdirSync)(targetPath, options));
-  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs10.readFileSync)(filePath, "utf8"));
-  const readDir = deps.readDir ?? ((dirPath) => (0, import_node_fs10.readdirSync)(dirPath));
-  const writeFile = deps.writeFile ?? ((filePath, content) => (0, import_node_fs10.writeFileSync)(filePath, content, "utf8"));
+  const mkdir = deps.mkdir ?? ((targetPath, options) => (0, import_node_fs11.mkdirSync)(targetPath, options));
+  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs11.readFileSync)(filePath, "utf8"));
+  const readDir = deps.readDir ?? ((dirPath) => (0, import_node_fs11.readdirSync)(dirPath));
+  const writeFile = deps.writeFile ?? ((filePath, content) => (0, import_node_fs11.writeFileSync)(filePath, content, "utf8"));
   const createZipArchive = deps.createZipArchive ?? defaultCreateZipArchive;
   return async (request, context) => {
     const [subcommand, ...restArgs] = request.args;
@@ -15179,9 +15712,10 @@ function resolveAllureJiraConfig(parsed, env, cwd) {
   const resolution = resolveCliConfig(pickConfigArgs5(parsed), env, cwd);
   const site = normalizeSite3(parsed.flags["--site"] ?? env.JIRA_SITE ?? resolution.values.baseUrl);
   const email = (parsed.flags["--email"] ?? resolution.values.jiraEmail).trim();
-  const apiToken = (parsed.flags["--api-token"] ?? resolution.values.jiraApiToken).trim();
+  const directApiToken = (parsed.flags["--api-token"] ?? "").trim();
+  const apiToken = (directApiToken || resolution.values.jiraApiToken).trim();
   const issueKey = (parsed.flags["--issue-key"] ?? "").trim();
-  const errors = [];
+  const errors = directApiToken ? [] : resolution.errors.filter((line) => line.startsWith("jiraApiToken:"));
   if (!hasValue(site)) {
     errors.push("Missing Jira site. Pass --site, set JIRA_SITE/JIRA_BASE_URL, or configure baseUrl.");
   }
@@ -15420,7 +15954,7 @@ function createDoctorHandler(deps = {}) {
 }
 
 // src/ingestFeature.ts
-var import_node_fs11 = require("node:fs");
+var import_node_fs12 = require("node:fs");
 var import_node_path12 = __toESM(require("node:path"), 1);
 var CONFIG_FLAGS6 = /* @__PURE__ */ new Set([
   "--config",
@@ -15507,8 +16041,8 @@ function normalizeError5(error) {
   return "Unknown ingest error.";
 }
 function createIngestFeatureHandler(deps = {}) {
-  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs11.readFileSync)(filePath, "utf8"));
-  const readStdin = deps.readStdin ?? (() => (0, import_node_fs11.readFileSync)(0, "utf8"));
+  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs12.readFileSync)(filePath, "utf8"));
+  const readStdin = deps.readStdin ?? (() => (0, import_node_fs12.readFileSync)(0, "utf8"));
   const cwd = deps.cwd ?? process.cwd();
   const env = deps.env ?? process.env;
   return async (request, context) => {
@@ -15639,7 +16173,7 @@ function createIngestFeatureHandler(deps = {}) {
 }
 
 // src/runUpload.ts
-var import_node_fs12 = require("node:fs");
+var import_node_fs13 = require("node:fs");
 var import_node_path13 = __toESM(require("node:path"), 1);
 var STEP_RESULTS = [
   StepResult.Passed,
@@ -15781,8 +16315,8 @@ function summarizeRunResult(result) {
   return lines;
 }
 function createRunUploadHandler(deps = {}) {
-  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs12.readFileSync)(filePath, "utf8"));
-  const readStdin = deps.readStdin ?? (() => (0, import_node_fs12.readFileSync)(0, "utf8"));
+  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs13.readFileSync)(filePath, "utf8"));
+  const readStdin = deps.readStdin ?? (() => (0, import_node_fs13.readFileSync)(0, "utf8"));
   const cwd = deps.cwd ?? process.cwd();
   const env = deps.env ?? process.env;
   return async (request, context) => {
@@ -16127,7 +16661,7 @@ function createRunsHandler(deps = {}) {
 }
 
 // src/setup.ts
-var import_node_fs14 = require("node:fs");
+var import_node_fs15 = require("node:fs");
 var import_node_path15 = __toESM(require("node:path"), 1);
 
 // src/githubSetupProvider.ts
@@ -16135,7 +16669,7 @@ var import_node_child_process4 = require("node:child_process");
 
 // src/setupPlan.ts
 var import_node_crypto = require("node:crypto");
-var import_node_fs13 = require("node:fs");
+var import_node_fs14 = require("node:fs");
 var import_node_path14 = __toESM(require("node:path"), 1);
 var SETUP_PLAN_SCHEMA_VERSION = "automatify.testops.setup/v1";
 var SETUP_PLAN_KIND = "AutomatifyTestOpsSetupPlan";
@@ -16231,7 +16765,7 @@ function buildGitHubSetupPlan(input) {
   if (endpointSecretName === tokenSecretName) {
     throw new Error("callback endpoint and auth token secret names must be different.");
   }
-  const workflowContent = (0, import_node_fs13.readFileSync)(input.workflowSourcePath, "utf8");
+  const workflowContent = (0, import_node_fs14.readFileSync)(input.workflowSourcePath, "utf8");
   if (!workflowContent.trim()) {
     throw new Error("workflow source file is empty.");
   }
@@ -17177,7 +17711,7 @@ function loadPlan(planPath, cwd) {
   const absolute = import_node_path15.default.resolve(cwd, planPath);
   let parsed;
   try {
-    parsed = JSON.parse((0, import_node_fs14.readFileSync)(absolute, "utf8"));
+    parsed = JSON.parse((0, import_node_fs15.readFileSync)(absolute, "utf8"));
   } catch (error) {
     throw new SetupCommandError(
       "PLAN_READ_ERROR",
@@ -17416,7 +17950,7 @@ function resolveWorkflowTarget(plan, repoRoot) {
 function applyWorkflowFile(plan, repoRoot, dryRun) {
   const action = plan.actions.find((item) => item.scope === "workflow-file");
   const target = resolveWorkflowTarget(plan, repoRoot);
-  const sourceContent = (0, import_node_fs14.readFileSync)(plan.github.workflowFile.sourcePath, "utf8");
+  const sourceContent = (0, import_node_fs15.readFileSync)(plan.github.workflowFile.sourcePath, "utf8");
   if (hashSetupContent(sourceContent) !== plan.github.workflowFile.sha256) {
     throw new SetupCommandError(
       "WORKFLOW_SOURCE_CHANGED",
@@ -17424,8 +17958,8 @@ function applyWorkflowFile(plan, repoRoot, dryRun) {
       ExitCode.ValidationError
     );
   }
-  const existed = (0, import_node_fs14.existsSync)(target);
-  const previousContent = existed ? (0, import_node_fs14.readFileSync)(target, "utf8") : void 0;
+  const existed = (0, import_node_fs15.existsSync)(target);
+  const previousContent = existed ? (0, import_node_fs15.readFileSync)(target, "utf8") : void 0;
   const matches = previousContent !== void 0 && hashSetupContent(previousContent) === plan.github.workflowFile.sha256;
   if (matches) {
     return {
@@ -17437,8 +17971,8 @@ function applyWorkflowFile(plan, repoRoot, dryRun) {
     };
   }
   if (!dryRun) {
-    (0, import_node_fs14.mkdirSync)(import_node_path15.default.dirname(target), { recursive: true });
-    (0, import_node_fs14.writeFileSync)(target, sourceContent, { encoding: "utf8", mode: 420 });
+    (0, import_node_fs15.mkdirSync)(import_node_path15.default.dirname(target), { recursive: true });
+    (0, import_node_fs15.writeFileSync)(target, sourceContent, { encoding: "utf8", mode: 420 });
   }
   return {
     id: action.id,
@@ -17608,14 +18142,14 @@ async function inspectPlan(plan, repoRoot, secrets, context, deps) {
   const checks = [];
   let forgeTransportFailure = false;
   const target = resolveWorkflowTarget(plan, repoRoot);
-  if (!(0, import_node_fs14.existsSync)(target)) {
+  if (!(0, import_node_fs15.existsSync)(target)) {
     checks.push({
       id: "workflow-local",
       status: "fail",
       message: `Local workflow file ${plan.github.workflowFile.path} does not exist.`
     });
   } else {
-    const localHash = hashSetupContent((0, import_node_fs14.readFileSync)(target, "utf8"));
+    const localHash = hashSetupContent((0, import_node_fs15.readFileSync)(target, "utf8"));
     checks.push({
       id: "workflow-local",
       status: localHash === plan.github.workflowFile.sha256 ? "pass" : "fail",
@@ -18626,6 +19160,12 @@ var COMMAND_REGISTRY = [
     subcommands: ["upload", "download", "open"],
     handler: createAllureHandler()
   },
+  {
+    name: "auth",
+    description: "Secret-safe Jira authentication login, status, and logout commands",
+    subcommands: ["login", "status", "logout"],
+    handler: createAuthHandler()
+  },
   {
     name: "auto",
     description: "Smart auto-ingestion command contract (MVP staged)",
@@ -18648,7 +19188,7 @@ var COMMAND_REGISTRY = [
   {
     name: "config",
     description: "Configuration and auth bootstrap commands",
-    subcommands: ["show", "validate", "set"],
+    subcommands: ["show", "validate", "set", "unset", "migrate-secrets"],
     handler: createConfigHandler()
   },
   {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automatify-au/cli",
-  "version": "0.1.14",
+  "version": "0.1.15",
   "description": "Forge-first CLI for Automatify Jira TestOps",
   "type": "module",
   "bin": {