@automatify-au/cli 0.1.14 → 0.1.16

package/dist/automatify.cjs

@@ -10765,10 +10765,170 @@ var Priority;
 
 // src/config.ts
 var import_node_fs = require("node:fs");
-var import_node_child_process = require("node:child_process");
 var import_node_path = __toESM(require("node:path"), 1);
-var DEFAULT_CONFIG_FILENAME = ".testops-cli.json";
+
+// src/secureStore.ts
+var import_node_child_process = require("node:child_process");
 var KEYCHAIN_SERVICE = "automatify-testops-cli";
+function errorText(error) {
+  return error instanceof Error && error.message ? error.message : "unknown secure-storage error";
+}
+function windowsProtectScript() {
+  return [
+    "Add-Type -AssemblyName System.Security",
+    "$plain = [Console]::In.ReadToEnd()",
+    "$bytes = [Text.Encoding]::UTF8.GetBytes($plain)",
+    "$cipher = [System.Security.Cryptography.ProtectedData]::Protect($bytes, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)",
+    "[Console]::Out.Write([Convert]::ToBase64String($cipher))"
+  ].join("; ");
+}
+function windowsUnprotectScript() {
+  return [
+    "Add-Type -AssemblyName System.Security",
+    "$encoded = [Console]::In.ReadToEnd()",
+    "$cipher = [Convert]::FromBase64String($encoded)",
+    "$bytes = [System.Security.Cryptography.ProtectedData]::Unprotect($cipher, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)",
+    "[Console]::Out.Write([Text.Encoding]::UTF8.GetString($bytes))"
+  ].join("; ");
+}
+function quoteSecurityInteractiveArg(value) {
+  if (/\r|\n|\0/.test(value)) {
+    throw new Error("macOS Keychain values cannot contain newline or NUL characters.");
+  }
+  return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+}
+function macOSKeychainWriteInput(account, value) {
+  return [
+    "add-generic-password",
+    "-U",
+    "-s",
+    quoteSecurityInteractiveArg(KEYCHAIN_SERVICE),
+    "-a",
+    quoteSecurityInteractiveArg(account),
+    "-w",
+    quoteSecurityInteractiveArg(value)
+  ].join(" ") + "\n";
+}
+function readSecureSecret(locator, deps = {}) {
+  const platform = deps.platform ?? process.platform;
+  const run = deps.execFileSync ?? import_node_child_process.execFileSync;
+  if (platform === "darwin") {
+    if (!locator.account) {
+      return locator.protectedValue ? {
+        status: "error",
+        message: "This config contains a Windows DPAPI value, but it is being read on macOS. Re-store the secret on this machine."
+      } : { status: "missing" };
+    }
+    try {
+      const value = run("security", ["find-generic-password", "-s", KEYCHAIN_SERVICE, "-a", locator.account, "-w"], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"]
+      }).trim();
+      return value ? { status: "available", value, source: "keychain" } : {
+        status: "error",
+        message: `macOS Keychain returned an empty value for account ${locator.account}. Re-store the secret.`
+      };
+    } catch (error) {
+      return {
+        status: "error",
+        message: `Unable to read macOS Keychain account ${locator.account}: ${errorText(error)}. Re-store the secret.`
+      };
+    }
+  }
+  if (platform === "win32") {
+    if (!locator.protectedValue) {
+      return locator.account ? {
+        status: "error",
+        message: "This config references a macOS Keychain secret, but it is being read on Windows. Re-store the secret for the current Windows user."
+      } : { status: "missing" };
+    }
+    try {
+      const value = run("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", windowsUnprotectScript()], {
+        input: locator.protectedValue,
+        encoding: "utf8",
+        stdio: ["pipe", "pipe", "pipe"]
+      }).trim();
+      return value ? { status: "available", value, source: "secure-store" } : {
+        status: "error",
+        message: "Windows DPAPI returned an empty value. Re-store the secret for the current Windows user."
+      };
+    } catch (error) {
+      return {
+        status: "error",
+        message: `Unable to decrypt the Windows DPAPI value for the current user: ${errorText(error)}. Re-store the secret.`
+      };
+    }
+  }
+  if (locator.account || locator.protectedValue) {
+    return {
+      status: "error",
+      message: "This config contains local secure-store metadata, but local secure storage is supported only on macOS and Windows. Use an environment variable on Linux/CI."
+    };
+  }
+  return { status: "missing" };
+}
+function writeSecureSecret(account, value, deps = {}) {
+  const platform = deps.platform ?? process.platform;
+  const run = deps.execFileSync ?? import_node_child_process.execFileSync;
+  if (platform === "darwin") {
+    try {
+      run("security", ["-q", "-i"], {
+        input: macOSKeychainWriteInput(account, value),
+        encoding: "utf8",
+        stdio: ["pipe", "ignore", "pipe"]
+      });
+    } catch {
+      throw new Error("Unable to store the secret in macOS Keychain.");
+    }
+    return { source: "keychain", account };
+  }
+  if (platform === "win32") {
+    let protectedValue;
+    try {
+      protectedValue = run("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", windowsProtectScript()], {
+        input: value,
+        encoding: "utf8",
+        stdio: ["pipe", "pipe", "pipe"]
+      }).trim();
+    } catch {
+      throw new Error("Unable to protect the secret with Windows DPAPI for the current user.");
+    }
+    if (!protectedValue) {
+      throw new Error("Windows DPAPI returned an empty protected value.");
+    }
+    return { source: "secure-store", protectedValue };
+  }
+  throw new Error(
+    "Secure local secret storage is supported on macOS and Windows only. On Linux/CI, keep secrets in environment variables."
+  );
+}
+function deleteSecureSecret(locator, deps = {}) {
+  const platform = deps.platform ?? process.platform;
+  const run = deps.execFileSync ?? import_node_child_process.execFileSync;
+  if (platform === "darwin") {
+    if (!locator.account) {
+      return { status: "missing" };
+    }
+    try {
+      run("security", ["delete-generic-password", "-s", KEYCHAIN_SERVICE, "-a", locator.account], {
+        stdio: ["ignore", "ignore", "pipe"]
+      });
+      return { status: "deleted" };
+    } catch (error) {
+      return {
+        status: "error",
+        message: `Unable to delete macOS Keychain account ${locator.account}: ${errorText(error)}.`
+      };
+    }
+  }
+  if (platform === "win32") {
+    return locator.protectedValue ? { status: "deleted" } : { status: "missing" };
+  }
+  return locator.account || locator.protectedValue ? { status: "deleted" } : { status: "missing" };
+}
+
+// src/config.ts
+var DEFAULT_CONFIG_FILENAME = ".testops-cli.json";
 function parseFlags(args) {
   const flags = {};
   const unknownFlags = [];
@@ -10802,6 +10962,15 @@ function parseFlags(args) {
 function toStringValue(value) {
   return typeof value === "string" ? value.trim() : "";
 }
+function firstStringValue(...values) {
+  for (const value of values) {
+    const normalized = toStringValue(value);
+    if (normalized) {
+      return normalized;
+    }
+  }
+  return "";
+}
 function readConfigFile(configPath) {
   if (!(0, import_node_fs.existsSync)(configPath)) {
     return {};
@@ -10814,6 +10983,27 @@ function readConfigFile(configPath) {
     return {};
   }
 }
+function readConfigFileForMutation(configPath) {
+  if (!(0, import_node_fs.existsSync)(configPath)) {
+    return { file: {} };
+  }
+  try {
+    const raw = (0, import_node_fs.readFileSync)(configPath, "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      return {
+        file: {},
+        error: `Unable to update config at ${configPath}: existing config must contain a JSON object.`
+      };
+    }
+    return { file: parsed };
+  } catch {
+    return {
+      file: {},
+      error: `Unable to update config at ${configPath}: existing config is not valid JSON. Fix or remove it before retrying.`
+    };
+  }
+}
 function writeConfigFile(configPath, file) {
   (0, import_node_fs.writeFileSync)(configPath, `${JSON.stringify(file, null, 2)}
 `, "utf8");
@@ -10833,63 +11023,46 @@ function readAuthMode(input) {
 function defaultKeychainAccount(configPath) {
   return import_node_path.default.resolve(configPath);
 }
-function readKeychainSecret(account) {
-  if (!account || process.platform !== "darwin") {
-    return "";
+function defaultJiraApiTokenKeychainAccount(configPath) {
+  return `${import_node_path.default.resolve(configPath)}:jiraApiToken`;
+}
+function valueFromPrecedence(key, flagValue, envValue, fileValue, fallback = "") {
+  if (flagValue) {
+    return { value: flagValue, source: "flag" };
   }
-  try {
-    return (0, import_node_child_process.execFileSync)("security", ["find-generic-password", "-s", KEYCHAIN_SERVICE, "-a", account, "-w"], {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
-  } catch {
-    return "";
+  if (envValue) {
+    return { value: envValue, source: "env" };
   }
-}
-function setKeychainSecret(account, value) {
-  if (process.platform !== "darwin") {
-    throw new Error("Keychain-backed secrets are only supported on macOS.");
+  if (fileValue) {
+    return { value: fileValue, source: "file" };
   }
-  (0, import_node_child_process.execFileSync)("security", ["add-generic-password", "-U", "-s", KEYCHAIN_SERVICE, "-a", account, "-w", value], {
-    stdio: ["ignore", "ignore", "pipe"]
-  });
+  if (fallback) {
+    return { value: fallback, source: "default" };
+  }
+  return { value: "", source: "default" };
 }
-function protectWindowsSecret(value) {
-  const script = [
-    "Add-Type -AssemblyName System.Security",
-    "$plain = [Console]::In.ReadToEnd()",
-    "$bytes = [Text.Encoding]::UTF8.GetBytes($plain)",
-    "$cipher = [System.Security.Cryptography.ProtectedData]::Protect($bytes, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)",
-    "[Console]::Out.Write([Convert]::ToBase64String($cipher))"
-  ].join("; ");
-  return (0, import_node_child_process.execFileSync)("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], {
-    input: value,
-    encoding: "utf8",
-    stdio: ["pipe", "pipe", "pipe"]
-  }).trim();
-}
-function unprotectWindowsSecret(protectedValue) {
-  if (!protectedValue || process.platform !== "win32") {
-    return "";
+function secureAccountForKey(key, file, configPath) {
+  if (key === "forgeAuthToken") {
+    return toStringValue(file.forgeAuthTokenKeychainAccount) || defaultKeychainAccount(configPath);
   }
-  const script = [
-    "Add-Type -AssemblyName System.Security",
-    "$encoded = [Console]::In.ReadToEnd()",
-    "$cipher = [Convert]::FromBase64String($encoded)",
-    "$bytes = [System.Security.Cryptography.ProtectedData]::Unprotect($cipher, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)",
-    "[Console]::Out.Write([Text.Encoding]::UTF8.GetString($bytes))"
-  ].join("; ");
-  try {
-    return (0, import_node_child_process.execFileSync)("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], {
-      input: protectedValue,
-      encoding: "utf8",
-      stdio: ["pipe", "pipe", "ignore"]
-    }).trim();
-  } catch {
-    return "";
+  return toStringValue(file.jiraApiTokenKeychainAccount) || defaultJiraApiTokenKeychainAccount(configPath);
+}
+function secureLocatorForKey(key, file) {
+  if (key === "forgeAuthToken") {
+    return {
+      account: toStringValue(file.forgeAuthTokenKeychainAccount) || void 0,
+      protectedValue: toStringValue(file.forgeAuthTokenProtected) || void 0
+    };
   }
+  return {
+    account: toStringValue(file.jiraApiTokenKeychainAccount) || void 0,
+    protectedValue: toStringValue(file.jiraApiTokenProtected) || void 0
+  };
 }
-function valueFromPrecedence(key, flagValue, envValue, fileValue, fallback = "") {
+function secretEnvironmentName(key) {
+  return key === "jiraApiToken" ? "JIRA_API_TOKEN" : "TESTOPS_FORGE_AUTH_TOKEN";
+}
+function resolveSecretValue(key, flagValue, envValue, fileValue, file) {
   if (flagValue) {
     return { value: flagValue, source: "flag" };
   }
@@ -10899,11 +11072,33 @@ function valueFromPrecedence(key, flagValue, envValue, fileValue, fallback = "")
   if (fileValue) {
     return { value: fileValue, source: "file" };
   }
-  if (fallback) {
-    return { value: fallback, source: "default" };
+  const secure = readSecureSecret(secureLocatorForKey(key, file));
+  if (secure.status === "available") {
+    return { value: secure.value, source: secure.source };
+  }
+  if (secure.status === "error") {
+    return { value: "", source: "default", error: `${key}: ${secure.message}` };
   }
   return { value: "", source: "default" };
 }
+function clearSecretFields(file, key) {
+  if (key === "forgeAuthToken") {
+    return {
+      ...file,
+      forgeAuthToken: void 0,
+      TESTOPS_FORGE_AUTH_TOKEN: void 0,
+      forgeAuthTokenKeychainAccount: void 0,
+      forgeAuthTokenProtected: void 0
+    };
+  }
+  return {
+    ...file,
+    jiraApiToken: void 0,
+    JIRA_API_TOKEN: void 0,
+    jiraApiTokenKeychainAccount: void 0,
+    jiraApiTokenProtected: void 0
+  };
+}
 function resolveCliConfig(args, env = process.env, cwd = process.cwd()) {
   const { flags, unknownFlags } = parseFlags(args);
   const configPathFlag = flags["--config"] ? import_node_path.default.resolve(cwd, flags["--config"]) : "";
@@ -10942,11 +11137,12 @@ function resolveCliConfig(args, env = process.env, cwd = process.cwd()) {
     toStringValue(env.JIRA_EMAIL),
     toStringValue(file.jiraEmail ?? file.JIRA_EMAIL)
   );
-  const jiraApiTokenResolved = valueFromPrecedence(
+  const jiraApiTokenResolved = resolveSecretValue(
     "jiraApiToken",
     toStringValue(flags["--jira-api-token"]),
     toStringValue(env.JIRA_API_TOKEN),
-    toStringValue(file.jiraApiToken ?? file.JIRA_API_TOKEN)
+    firstStringValue(file.jiraApiToken, file.JIRA_API_TOKEN),
+    file
   );
   const forgeEndpointResolved = valueFromPrecedence(
     "forgeEndpoint",
@@ -10960,11 +11156,13 @@ function resolveCliConfig(args, env = process.env, cwd = process.cwd()) {
     "",
     toStringValue(file.forgeAuthTokenKeychainAccount)
   );
-  const forgeAuthTokenFromEnv = toStringValue(env.TESTOPS_FORGE_AUTH_TOKEN);
-  const forgeAuthTokenFromFile = toStringValue(file.forgeAuthToken ?? file.TESTOPS_FORGE_AUTH_TOKEN);
-  const forgeAuthTokenFromKeychain = forgeAuthTokenFromEnv || forgeAuthTokenFromFile || !forgeAuthTokenKeychainAccountResolved.value ? "" : readKeychainSecret(forgeAuthTokenKeychainAccountResolved.value);
-  const forgeAuthTokenFromWindowsStore = forgeAuthTokenFromEnv || forgeAuthTokenFromFile || forgeAuthTokenFromKeychain ? "" : unprotectWindowsSecret(toStringValue(file.forgeAuthTokenProtected));
-  const forgeAuthTokenResolved = forgeAuthTokenFromEnv ? { value: forgeAuthTokenFromEnv, source: "env" } : forgeAuthTokenFromFile ? { value: forgeAuthTokenFromFile, source: "file" } : forgeAuthTokenFromKeychain ? { value: forgeAuthTokenFromKeychain, source: "keychain" } : forgeAuthTokenFromWindowsStore ? { value: forgeAuthTokenFromWindowsStore, source: "secure-store" } : { value: "", source: "default" };
+  const forgeAuthTokenResolved = resolveSecretValue(
+    "forgeAuthToken",
+    "",
+    toStringValue(env.TESTOPS_FORGE_AUTH_TOKEN),
+    firstStringValue(file.forgeAuthToken, file.TESTOPS_FORGE_AUTH_TOKEN),
+    file
+  );
   const config = {
     baseUrl: normalizeBaseUrl(baseUrlResolved.value),
     projectKey: projectKeyResolved.value,
@@ -10990,13 +11188,16 @@ function resolveCliConfig(args, env = process.env, cwd = process.cwd()) {
     configPath: configPathSource
   };
   const warnings = [];
+  const errors = [jiraApiTokenResolved.error, forgeAuthTokenResolved.error].filter(
+    (value) => Boolean(value)
+  );
   if (unknownFlags.length > 0) {
     warnings.push(`Ignored unknown config flags: ${unknownFlags.join(", ")}`);
   }
   if (!(0, import_node_fs.existsSync)(configPath) && sources.configPath !== "default") {
     warnings.push(`Config file not found at ${configPath}; using env/flags/defaults.`);
   }
-  return { values: config, sources, warnings };
+  return { values: config, sources, warnings, errors };
 }
 function maskSecret(value) {
   if (!value) {
@@ -11009,7 +11210,7 @@ function maskSecret(value) {
 }
 function validateResolvedConfig(resolution) {
   const { values } = resolution;
-  const errors = [];
+  const errors = [...resolution.errors];
   const warnings = [...resolution.warnings];
   if (!values.baseUrl) {
     errors.push("Missing required setting: JIRA_BASE_URL (flag/env/file).");
@@ -11024,10 +11225,8 @@ function validateResolvedConfig(resolution) {
     if (!values.jiraApiToken) {
       errors.push("Auth mode api-token requires JIRA_API_TOKEN.");
     }
-  } else {
-    if (values.jiraApiToken || values.jiraEmail) {
-      warnings.push("JIRA_EMAIL/JIRA_API_TOKEN were provided but auth mode is 'none'.");
-    }
+  } else if (values.jiraApiToken || values.jiraEmail) {
+    warnings.push("JIRA_EMAIL/JIRA_API_TOKEN were provided but auth mode is 'none'.");
   }
   return { ok: errors.length === 0, errors, warnings };
 }
@@ -11090,53 +11289,33 @@ function applyConfigSet(configPath, rawKey, value) {
       ]
     };
   }
-  const file = readConfigFile(configPath);
-  if (key === "forgeAuthToken") {
-    if (process.platform === "win32") {
-      try {
-        const protectedValue = protectWindowsSecret(value);
-        writeConfigFile(configPath, {
-          ...file,
-          forgeAuthToken: void 0,
-          TESTOPS_FORGE_AUTH_TOKEN: void 0,
-          forgeAuthTokenKeychainAccount: void 0,
-          forgeAuthTokenProtected: protectedValue
-        });
-        return {
-          exitCode: ExitCode.Success,
-          stdout: ["Config updated: forgeAuthToken protected with Windows DPAPI for the current user."]
-        };
-      } catch (error) {
-        return {
-          exitCode: ExitCode.ValidationError,
-          stderr: [
-            `Unable to store forgeAuthToken securely: ${error instanceof Error ? error.message : "unknown secure-storage error"}`
-          ]
-        };
-      }
-    }
-    if (process.platform !== "darwin") {
+  const mutable = readConfigFileForMutation(configPath);
+  if (mutable.error) {
+    return { exitCode: ExitCode.ValidationError, stderr: [mutable.error] };
+  }
+  const file = mutable.file;
+  if (key === "forgeAuthToken" || key === "jiraApiToken") {
+    const secretKey = key;
+    const account = secureAccountForKey(secretKey, file, configPath);
+    try {
+      const stored = writeSecureSecret(account, value);
+      const cleared = clearSecretFields(file, secretKey);
+      const nextFile2 = stored.source === "keychain" ? secretKey === "forgeAuthToken" ? { ...cleared, forgeAuthTokenKeychainAccount: stored.account } : { ...cleared, jiraApiTokenKeychainAccount: stored.account } : secretKey === "forgeAuthToken" ? { ...cleared, forgeAuthTokenProtected: stored.protectedValue } : { ...cleared, jiraApiTokenProtected: stored.protectedValue };
+      writeConfigFile(configPath, nextFile2);
+      const backend = stored.source === "keychain" ? "macOS Keychain" : "Windows DPAPI for the current user";
       return {
-        exitCode: ExitCode.UsageError,
+        exitCode: ExitCode.Success,
+        stdout: [`Config updated: ${secretKey} stored securely with ${backend}.`]
+      };
+    } catch (error) {
+      const unsupported = process.platform !== "darwin" && process.platform !== "win32";
+      return {
+        exitCode: unsupported ? ExitCode.UsageError : ExitCode.ValidationError,
         stderr: [
-          "Secure local forgeAuthToken storage is currently supported on macOS and Windows. On Linux/CI, set TESTOPS_FORGE_AUTH_TOKEN in the environment."
+          `Unable to store ${secretKey} securely: ${error instanceof Error ? error.message : "unknown secure-storage error"} Use ${secretEnvironmentName(secretKey)} on Linux/CI.`
         ]
       };
     }
-    const account = toStringValue(file.forgeAuthTokenKeychainAccount) || defaultKeychainAccount(configPath);
-    setKeychainSecret(account, value);
-    const nextFile2 = {
-      ...file,
-      forgeAuthToken: void 0,
-      TESTOPS_FORGE_AUTH_TOKEN: void 0,
-      forgeAuthTokenProtected: void 0,
-      forgeAuthTokenKeychainAccount: account
-    };
-    writeConfigFile(configPath, nextFile2);
-    return {
-      exitCode: ExitCode.Success,
-      stdout: [`Config updated: forgeAuthToken stored in macOS Keychain (${account}).`]
-    };
   }
   const nextFile = {
     ...file,
@@ -11148,6 +11327,101 @@ function applyConfigSet(configPath, rawKey, value) {
     stdout: [`Config updated: ${rawKey}.`]
   };
 }
+function configFileKeysFor(key) {
+  switch (key) {
+    case "baseUrl":
+      return ["baseUrl", "JIRA_BASE_URL"];
+    case "projectKey":
+      return ["projectKey", "JIRA_PROJECT_KEY"];
+    case "issueKey":
+      return ["issueKey", "JIRA_ISSUE_KEY"];
+    case "authMode":
+      return ["authMode", "TESTOPS_AUTH_MODE"];
+    case "jiraEmail":
+      return ["jiraEmail", "JIRA_EMAIL"];
+    case "forgeEndpoint":
+      return ["forgeEndpoint", "TESTOPS_FORGE_ENDPOINT"];
+    default:
+      return [key];
+  }
+}
+function applyConfigUnset(configPath, rawKey) {
+  const key = normalizeConfigSetKey(rawKey);
+  if (!key) {
+    return {
+      exitCode: ExitCode.UsageError,
+      stderr: ["Usage: automatify testops config unset <key>"]
+    };
+  }
+  const mutable = readConfigFileForMutation(configPath);
+  if (mutable.error) {
+    return { exitCode: ExitCode.ValidationError, stderr: [mutable.error] };
+  }
+  const file = mutable.file;
+  if (key === "forgeAuthToken" || key === "jiraApiToken") {
+    const secretKey = key;
+    const deleted = deleteSecureSecret(secureLocatorForKey(secretKey, file));
+    if (deleted.status === "error") {
+      return { exitCode: ExitCode.ValidationError, stderr: [deleted.message] };
+    }
+    writeConfigFile(configPath, clearSecretFields(file, secretKey));
+    return { exitCode: ExitCode.Success, stdout: [`Config removed: ${secretKey}.`] };
+  }
+  const next = { ...file };
+  for (const fileKey of configFileKeysFor(key)) {
+    delete next[fileKey];
+  }
+  writeConfigFile(configPath, next);
+  return { exitCode: ExitCode.Success, stdout: [`Config removed: ${rawKey}.`] };
+}
+function applyConfigMigrateSecrets(configPath) {
+  const mutable = readConfigFileForMutation(configPath);
+  if (mutable.error) {
+    return { exitCode: ExitCode.ValidationError, stderr: [mutable.error] };
+  }
+  const file = mutable.file;
+  const pending = [];
+  const jiraApiToken = firstStringValue(file.jiraApiToken, file.JIRA_API_TOKEN);
+  const forgeAuthToken = firstStringValue(file.forgeAuthToken, file.TESTOPS_FORGE_AUTH_TOKEN);
+  if (jiraApiToken) {
+    pending.push({ key: "jiraApiToken", value: jiraApiToken });
+  }
+  if (forgeAuthToken) {
+    pending.push({ key: "forgeAuthToken", value: forgeAuthToken });
+  }
+  if (pending.length === 0) {
+    return { exitCode: ExitCode.Success, stdout: ["No plaintext local secrets require migration."] };
+  }
+  const migrated = [];
+  for (const item of pending) {
+    const response = applyConfigSet(configPath, item.key, item.value);
+    if (response.exitCode !== ExitCode.Success) {
+      return {
+        exitCode: response.exitCode,
+        stdout: migrated.length > 0 ? [`Migrated before failure: ${migrated.join(", ")}.`] : void 0,
+        stderr: response.stderr
+      };
+    }
+    migrated.push(item.key);
+  }
+  return {
+    exitCode: ExitCode.Success,
+    stdout: [`Migrated plaintext secrets to secure storage: ${migrated.join(", ")}.`]
+  };
+}
+function stripConfigPathArgs(args) {
+  const operands = [];
+  for (let i = 0; i < args.length; i += 1) {
+    if (args[i] === "--config") {
+      if (args[i + 1] && !args[i + 1].startsWith("--")) {
+        i += 1;
+      }
+      continue;
+    }
+    operands.push(args[i]);
+  }
+  return operands;
+}
 function createConfigHandler(env = process.env, cwd = process.cwd()) {
   return (request) => {
     const [subcommand, ...subArgs] = request.args;
@@ -11156,7 +11430,11 @@ function createConfigHandler(env = process.env, cwd = process.cwd()) {
     if (subcommand === "show") {
       return {
         exitCode: ExitCode.Success,
-        stdout: [...toDisplayLines(resolution), ...validation.warnings.map((line) => `WARN: ${line}`)]
+        stdout: [
+          ...toDisplayLines(resolution),
+          ...validation.warnings.map((line) => `WARN: ${line}`),
+          ...resolution.errors.map((line) => `ERROR: ${line}`)
+        ]
       };
     }
     if (subcommand === "validate") {
@@ -11177,17 +11455,25 @@ function createConfigHandler(env = process.env, cwd = process.cwd()) {
       };
     }
     if (subcommand === "set") {
-      const [key, ...valueParts] = subArgs;
-      const readValueFromStdin = key === "forgeAuthToken" && valueParts.length === 1 && valueParts[0] === "--stdin";
+      const [key, ...valueParts] = stripConfigPathArgs(subArgs);
+      const normalizedKey = normalizeConfigSetKey(key ?? "");
+      const readValueFromStdin = (normalizedKey === "forgeAuthToken" || normalizedKey === "jiraApiToken") && valueParts.length === 1 && valueParts[0] === "--stdin";
       const value = readValueFromStdin ? (0, import_node_fs.readFileSync)(0, "utf8").trim() : valueParts.join(" ").trim();
       if (!key || !value) {
         return {
           exitCode: ExitCode.UsageError,
-          stderr: ["Usage: automatify testops config set <key> <value>"]
+          stderr: ["Usage: automatify testops config set <key> <value|--stdin>"]
         };
       }
       return applyConfigSet(resolution.values.configPath, key, value);
     }
+    if (subcommand === "unset") {
+      const [key] = stripConfigPathArgs(subArgs);
+      return applyConfigUnset(resolution.values.configPath, key ?? "");
+    }
+    if (subcommand === "migrate-secrets") {
+      return applyConfigMigrateSecrets(resolution.values.configPath);
+    }
     return {
       exitCode: ExitCode.UsageError,
       stderr: [`Unsupported config subcommand: ${subcommand}`]
@@ -13627,33 +13913,280 @@ function createAllureHandler(deps = {}) {
   };
 }
 
-// src/bdd.ts
+// src/auth.ts
 var import_node_fs10 = require("node:fs");
-var import_node_path11 = __toESM(require("node:path"), 1);
-var import_yazl = __toESM(require_yazl(), 1);
-
-// src/forgeClient.ts
-var ForgeClientError = class extends Error {
-  code;
-  status;
-  retryable;
-  constructor(input) {
-    super(input.message);
-    this.name = "ForgeClientError";
-    this.code = input.code;
-    this.status = input.status;
-    this.retryable = Boolean(input.retryable);
+function parseAuthArgs(args, allowLoginFlags) {
+  const configArgs = [];
+  const unknown = [];
+  let baseUrl = "";
+  let jiraEmail = "";
+  let tokenStdin = false;
+  for (let i = 0; i < args.length; i += 1) {
+    const token = args[i];
+    if (token === "--config") {
+      const value = args[i + 1];
+      if (!value || value.startsWith("--")) {
+        unknown.push(token);
+        continue;
+      }
+      configArgs.push(token, value);
+      i += 1;
+      continue;
+    }
+    if (allowLoginFlags && token === "--base-url") {
+      const value = args[i + 1];
+      if (!value || value.startsWith("--")) {
+        unknown.push(token);
+        continue;
+      }
+      baseUrl = value.trim();
+      i += 1;
+      continue;
+    }
+    if (allowLoginFlags && token === "--jira-email") {
+      const value = args[i + 1];
+      if (!value || value.startsWith("--")) {
+        unknown.push(token);
+        continue;
+      }
+      jiraEmail = value.trim();
+      i += 1;
+      continue;
+    }
+    if (allowLoginFlags && token === "--token-stdin") {
+      tokenStdin = true;
+      continue;
+    }
+    unknown.push(token);
   }
-};
-function isObject(value) {
-  return Boolean(value) && typeof value === "object";
+  return { configArgs, baseUrl, jiraEmail, tokenStdin, unknown };
 }
-function isServiceError(value) {
-  if (!isObject(value)) {
-    return false;
+function runConfigMutation(handler, args, context) {
+  const response = handler(
+    {
+      group: "config",
+      args,
+      rawArgs: ["config", ...args]
+    },
+    context
+  );
+  if (response instanceof Promise) {
+    throw new Error("Config mutations must remain synchronous.");
+  }
+  return response;
+}
+function sourceLabel(source) {
+  switch (source) {
+    case "keychain":
+      return "macOS Keychain";
+    case "secure-store":
+      return "Windows DPAPI";
+    case "env":
+      return "environment";
+    case "file":
+      return "legacy plaintext config";
+    case "flag":
+      return "command flag";
+    default:
+      return "not configured";
   }
-  const code = value.code;
-  const message = value.message;
+}
+function authState(parts) {
+  const populated = parts.filter(Boolean).length;
+  if (populated === 0) {
+    return "not configured";
+  }
+  return populated === parts.length ? "configured" : "incomplete";
+}
+function createStatusResponse(args, env, cwd) {
+  const parsed = parseAuthArgs(args, false);
+  if (parsed.unknown.length > 0) {
+    return {
+      exitCode: ExitCode.UsageError,
+      stderr: ["Unsupported auth status arguments. Only --config <path> is supported."]
+    };
+  }
+  const resolution = resolveCliConfig(parsed.configArgs, env, cwd);
+  const { values, sources } = resolution;
+  const jiraState = authState([values.baseUrl, values.jiraEmail, values.jiraApiToken]);
+  const forgeState = authState([values.forgeEndpoint, values.forgeAuthToken]);
+  const stdout = [
+    "Auth status (secret-safe):",
+    `  Jira: ${jiraState}`,
+    `    baseUrl: ${values.baseUrl || "<unset>"}`,
+    `    email: ${values.jiraEmail || "<unset>"}`,
+    `    apiToken: ${values.jiraApiToken ? `configured (${sourceLabel(sources.jiraApiToken)})` : "<unset>"}`,
+    `  Forge transport: ${forgeState}`,
+    `    endpoint: ${values.forgeEndpoint || "<unset>"}`,
+    `    authToken: ${values.forgeAuthToken ? `configured (${sourceLabel(sources.forgeAuthToken)})` : "<unset>"}`,
+    `  configPath: ${values.configPath}`
+  ];
+  if (resolution.errors.length > 0) {
+    return {
+      exitCode: ExitCode.ValidationError,
+      stdout,
+      stderr: resolution.errors.map((error) => `ERROR: ${error}`)
+    };
+  }
+  return { exitCode: ExitCode.Success, stdout };
+}
+function createLoginResponse(args, env, cwd, readStdin, platform, context) {
+  const parsed = parseAuthArgs(args, true);
+  if (parsed.unknown.length > 0) {
+    return {
+      exitCode: ExitCode.UsageError,
+      stderr: [
+        "Unsupported auth login arguments. Use --base-url, --jira-email, --token-stdin, and optional --config only.",
+        "Secrets must be provided through --token-stdin or environment variables, never as command-line values."
+      ]
+    };
+  }
+  const current = resolveCliConfig(parsed.configArgs, env, cwd);
+  const baseUrl = parsed.baseUrl || env.JIRA_BASE_URL?.trim() || current.values.baseUrl;
+  const jiraEmail = parsed.jiraEmail || env.JIRA_EMAIL?.trim() || current.values.jiraEmail;
+  const stdinToken = parsed.tokenStdin ? readStdin().trim() : "";
+  const effectiveToken = stdinToken || env.JIRA_API_TOKEN?.trim() || current.values.jiraApiToken;
+  const missing = [];
+  if (!baseUrl) missing.push("--base-url or JIRA_BASE_URL");
+  if (!jiraEmail) missing.push("--jira-email or JIRA_EMAIL");
+  if (!effectiveToken) missing.push("--token-stdin, JIRA_API_TOKEN, or an existing stored token");
+  if (missing.length > 0) {
+    return {
+      exitCode: ExitCode.UsageError,
+      stderr: [
+        `Jira login is incomplete. Provide: ${missing.join(", ")}.`,
+        "Secrets are never accepted as normal command-line values."
+      ]
+    };
+  }
+  if (parsed.tokenStdin && platform !== "darwin" && platform !== "win32") {
+    return {
+      exitCode: ExitCode.UsageError,
+      stderr: [
+        "Local secure secret storage is supported only on macOS and Windows.",
+        "On Linux/CI, set JIRA_API_TOKEN in the environment and run auth login without --token-stdin."
+      ]
+    };
+  }
+  const configHandler = createConfigHandler(env, cwd);
+  const configSuffix = parsed.configArgs;
+  const steps = [];
+  if (stdinToken) {
+    steps.push({ label: "Jira API token", args: ["set", "jiraApiToken", stdinToken, ...configSuffix] });
+  }
+  steps.push(
+    { label: "Jira base URL", args: ["set", "baseUrl", baseUrl, ...configSuffix] },
+    { label: "Jira email", args: ["set", "jiraEmail", jiraEmail, ...configSuffix] },
+    { label: "auth mode", args: ["set", "authMode", "api-token", ...configSuffix] }
+  );
+  const completed = [];
+  for (const step of steps) {
+    const response = runConfigMutation(configHandler, step.args, context);
+    if (response.exitCode !== ExitCode.Success) {
+      return {
+        exitCode: response.exitCode,
+        stdout: completed.length > 0 ? [`Configured before failure: ${completed.join(", ")}.`] : void 0,
+        stderr: response.stderr
+      };
+    }
+    completed.push(step.label);
+  }
+  const tokenSource = stdinToken ? platform === "darwin" ? "macOS Keychain" : "Windows DPAPI" : sourceLabel(
+    current.sources.jiraApiToken === "default" && env.JIRA_API_TOKEN ? "env" : current.sources.jiraApiToken
+  );
+  return {
+    exitCode: ExitCode.Success,
+    stdout: [
+      "Jira login configured.",
+      `  baseUrl: ${baseUrl.replace(/\/$/, "")}`,
+      `  email: ${jiraEmail}`,
+      `  apiToken: configured (${tokenSource})`,
+      "Run `automatify testops auth status` to verify the resolved credentials."
+    ]
+  };
+}
+function createLogoutResponse(args, env, cwd, context) {
+  const parsed = parseAuthArgs(args, false);
+  if (parsed.unknown.length > 0) {
+    return {
+      exitCode: ExitCode.UsageError,
+      stderr: ["Unsupported auth logout arguments. Only --config <path> is supported."]
+    };
+  }
+  const configHandler = createConfigHandler(env, cwd);
+  const failures = [];
+  const removed = [];
+  for (const key of ["jiraApiToken", "forgeAuthToken"]) {
+    const response = runConfigMutation(configHandler, ["unset", key, ...parsed.configArgs], context);
+    if (response.exitCode === ExitCode.Success) {
+      removed.push(key);
+    } else {
+      failures.push(...response.stderr ?? [`Unable to remove ${key}.`]);
+    }
+  }
+  if (failures.length > 0) {
+    return {
+      exitCode: ExitCode.ValidationError,
+      stdout: removed.length > 0 ? [`Removed before failure: ${removed.join(", ")}.`] : void 0,
+      stderr: failures
+    };
+  }
+  const stdout = ["Local Jira and Forge credentials removed.", "Non-secret URL/email settings were preserved."];
+  if (env.JIRA_API_TOKEN || env.TESTOPS_FORGE_AUTH_TOKEN) {
+    stdout.push("Environment-provided credentials are unchanged and may still resolve as configured.");
+  }
+  return { exitCode: ExitCode.Success, stdout };
+}
+function createAuthHandler(deps = {}) {
+  const env = deps.env ?? process.env;
+  const cwd = deps.cwd ?? process.cwd();
+  const readStdin = deps.readStdin ?? (() => (0, import_node_fs10.readFileSync)(0, "utf8"));
+  const platform = deps.platform ?? process.platform;
+  return (request, context) => {
+    const [subcommand, ...args] = request.args;
+    if (subcommand === "status") {
+      return createStatusResponse(args, env, cwd);
+    }
+    if (subcommand === "login") {
+      return createLoginResponse(args, env, cwd, readStdin, platform, context);
+    }
+    if (subcommand === "logout") {
+      return createLogoutResponse(args, env, cwd, context);
+    }
+    return {
+      exitCode: ExitCode.UsageError,
+      stderr: ["Unsupported auth subcommand. Use login, status, or logout."]
+    };
+  };
+}
+
+// src/bdd.ts
+var import_node_fs11 = require("node:fs");
+var import_node_path11 = __toESM(require("node:path"), 1);
+var import_yazl = __toESM(require_yazl(), 1);
+
+// src/forgeClient.ts
+var ForgeClientError = class extends Error {
+  code;
+  status;
+  retryable;
+  constructor(input) {
+    super(input.message);
+    this.name = "ForgeClientError";
+    this.code = input.code;
+    this.status = input.status;
+    this.retryable = Boolean(input.retryable);
+  }
+};
+function isObject(value) {
+  return Boolean(value) && typeof value === "object";
+}
+function isServiceError(value) {
+  if (!isObject(value)) {
+    return false;
+  }
+  const code = value.code;
+  const message = value.message;
   return typeof code === "string" && typeof message === "string";
 }
 function normalizeServiceError(error) {
@@ -14053,7 +14586,7 @@ function toJsonExportManifestItems(items) {
 async function defaultCreateZipArchive(archivePath, entries) {
   await new Promise((resolve, reject) => {
     const zip = new import_yazl.ZipFile();
-    const output = zip.outputStream.pipe((0, import_node_fs10.createWriteStream)(archivePath));
+    const output = zip.outputStream.pipe((0, import_node_fs11.createWriteStream)(archivePath));
     output.on("close", () => resolve());
     output.on("error", reject);
     zip.outputStream.on("error", reject);
@@ -14083,10 +14616,10 @@ function missingProjectResponse() {
 function createBddHandler(deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const env = deps.env ?? process.env;
-  const mkdir = deps.mkdir ?? ((targetPath, options) => (0, import_node_fs10.mkdirSync)(targetPath, options));
-  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs10.readFileSync)(filePath, "utf8"));
-  const readDir = deps.readDir ?? ((dirPath) => (0, import_node_fs10.readdirSync)(dirPath));
-  const writeFile = deps.writeFile ?? ((filePath, content) => (0, import_node_fs10.writeFileSync)(filePath, content, "utf8"));
+  const mkdir = deps.mkdir ?? ((targetPath, options) => (0, import_node_fs11.mkdirSync)(targetPath, options));
+  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs11.readFileSync)(filePath, "utf8"));
+  const readDir = deps.readDir ?? ((dirPath) => (0, import_node_fs11.readdirSync)(dirPath));
+  const writeFile = deps.writeFile ?? ((filePath, content) => (0, import_node_fs11.writeFileSync)(filePath, content, "utf8"));
   const createZipArchive = deps.createZipArchive ?? defaultCreateZipArchive;
   return async (request, context) => {
     const [subcommand, ...restArgs] = request.args;
@@ -15179,9 +15712,10 @@ function resolveAllureJiraConfig(parsed, env, cwd) {
   const resolution = resolveCliConfig(pickConfigArgs5(parsed), env, cwd);
   const site = normalizeSite3(parsed.flags["--site"] ?? env.JIRA_SITE ?? resolution.values.baseUrl);
   const email = (parsed.flags["--email"] ?? resolution.values.jiraEmail).trim();
-  const apiToken = (parsed.flags["--api-token"] ?? resolution.values.jiraApiToken).trim();
+  const directApiToken = (parsed.flags["--api-token"] ?? "").trim();
+  const apiToken = (directApiToken || resolution.values.jiraApiToken).trim();
   const issueKey = (parsed.flags["--issue-key"] ?? "").trim();
-  const errors = [];
+  const errors = directApiToken ? [] : resolution.errors.filter((line) => line.startsWith("jiraApiToken:"));
   if (!hasValue(site)) {
     errors.push("Missing Jira site. Pass --site, set JIRA_SITE/JIRA_BASE_URL, or configure baseUrl.");
   }
@@ -15420,7 +15954,7 @@ function createDoctorHandler(deps = {}) {
 }
 
 // src/ingestFeature.ts
-var import_node_fs11 = require("node:fs");
+var import_node_fs12 = require("node:fs");
 var import_node_path12 = __toESM(require("node:path"), 1);
 var CONFIG_FLAGS6 = /* @__PURE__ */ new Set([
   "--config",
@@ -15507,8 +16041,8 @@ function normalizeError5(error) {
   return "Unknown ingest error.";
 }
 function createIngestFeatureHandler(deps = {}) {
-  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs11.readFileSync)(filePath, "utf8"));
-  const readStdin = deps.readStdin ?? (() => (0, import_node_fs11.readFileSync)(0, "utf8"));
+  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs12.readFileSync)(filePath, "utf8"));
+  const readStdin = deps.readStdin ?? (() => (0, import_node_fs12.readFileSync)(0, "utf8"));
   const cwd = deps.cwd ?? process.cwd();
   const env = deps.env ?? process.env;
   return async (request, context) => {
@@ -15571,75 +16105,573 @@ function createIngestFeatureHandler(deps = {}) {
         name,
         gherkin
       }
-    };
-    try {
-      const result = await context.invokeForgeContract("ingestBddFeature", payload);
-      if (!result.ok) {
+    };
+    try {
+      const result = await context.invokeForgeContract("ingestBddFeature", payload);
+      if (!result.ok) {
+        if (useJson) {
+          return {
+            exitCode: ExitCode.RemoteError,
+            stdout: toJsonLine({
+              action: "ingest-feature",
+              status: "failed",
+              featureName: name,
+              source: useStdin ? "stdin" : sourceFile,
+              errorCode: result.error.code,
+              errorMessage: result.error.message
+            })
+          };
+        }
+        return {
+          exitCode: ExitCode.RemoteError,
+          stdout: ["Feature ingestion: FAILED", `Feature: ${name}`, `Source: ${useStdin ? "stdin" : sourceFile}`],
+          stderr: [`ERROR: ${result.error.code}: ${result.error.message}`]
+        };
+      }
+      if (useJson) {
+        const details = summarizeSuccess(result);
+        return {
+          exitCode: ExitCode.Success,
+          stdout: toJsonLine({
+            action: "ingest-feature",
+            status: "success",
+            featureName: name,
+            source: useStdin ? "stdin" : sourceFile,
+            details
+          })
+        };
+      }
+      return {
+        exitCode: ExitCode.Success,
+        stdout: [
+          "Feature ingestion: SUCCESS",
+          `Feature: ${name}`,
+          `Source: ${useStdin ? "stdin" : sourceFile}`,
+          ...summarizeSuccess(result)
+        ]
+      };
+    } catch (error) {
+      if (useJson) {
+        return {
+          exitCode: ExitCode.TransportError,
+          stdout: toJsonLine({
+            action: "ingest-feature",
+            status: "failed",
+            featureName: name,
+            source: useStdin ? "stdin" : sourceFile,
+            errorMessage: normalizeError5(error)
+          })
+        };
+      }
+      return {
+        exitCode: ExitCode.TransportError,
+        stdout: ["Feature ingestion: FAILED", `Feature: ${name}`, `Source: ${useStdin ? "stdin" : sourceFile}`],
+        stderr: [`ERROR: ${normalizeError5(error)}`]
+      };
+    }
+  };
+}
+
+// src/profiles.ts
+var CONFIG_FLAGS7 = /* @__PURE__ */ new Set([
+  "--config",
+  "--base-url",
+  "--project-key",
+  "--issue-key",
+  "--auth-mode",
+  "--jira-email",
+  "--jira-api-token"
+]);
+function parseArgs8(args) {
+  const flags = {};
+  const boolFlags = /* @__PURE__ */ new Set();
+  const unknownFlags = [];
+  const supportedValueFlags = /* @__PURE__ */ new Set(["--id", ...CONFIG_FLAGS7]);
+  const supportedBoolFlags = /* @__PURE__ */ new Set(["--json", "--dry-run", "--confirm", "--detach"]);
+  for (let index = 0; index < args.length; index += 1) {
+    const token = args[index];
+    if (!token.startsWith("--")) {
+      unknownFlags.push(token);
+      continue;
+    }
+    if (supportedBoolFlags.has(token)) {
+      boolFlags.add(token);
+      continue;
+    }
+    if (!supportedValueFlags.has(token)) {
+      unknownFlags.push(token);
+      continue;
+    }
+    const value = args[index + 1];
+    if (!value || value.startsWith("--")) {
+      unknownFlags.push(token);
+      continue;
+    }
+    flags[token] = value;
+    index += 1;
+  }
+  return { flags, boolFlags, unknownFlags };
+}
+function pickConfigArgs7(parsed) {
+  const args = [];
+  for (const [flag, value] of Object.entries(parsed.flags)) {
+    if (CONFIG_FLAGS7.has(flag)) {
+      args.push(flag, value);
+    }
+  }
+  return args;
+}
+function normalizeError6(error) {
+  if (error instanceof ForgeClientError) {
+    return `${error.code}: ${error.message}`;
+  }
+  if (error instanceof Error) {
+    return error.message;
+  }
+  return "Unknown profiles command error.";
+}
+function missingProjectResponse3() {
+  return {
+    exitCode: ExitCode.ValidationError,
+    stderr: ["ERROR: Missing project context. Set JIRA_PROJECT_KEY or pass --project-key."]
+  };
+}
+function confirmationRequiredResponse(command) {
+  return {
+    exitCode: ExitCode.ValidationError,
+    stderr: [`ERROR: ${command} is destructive and requires --confirm. Use --dry-run first to preview the cleanup.`]
+  };
+}
+function remoteErrorResponse(code, message, stdout = []) {
+  return {
+    exitCode: ExitCode.RemoteError,
+    stdout,
+    stderr: [`ERROR: ${code}: ${message}`]
+  };
+}
+function toJsonProfile(profile) {
+  return {
+    id: profile.id,
+    label: profile.label,
+    provider: profile.provider,
+    endpointSummary: profile.endpointSummary,
+    enabled: profile.enabled,
+    isProjectDefault: profile.isProjectDefault ?? false,
+    hasSecret: profile.hasSecret,
+    createdAt: profile.createdAt,
+    updatedAt: profile.updatedAt,
+    lastUsedAt: profile.lastUsedAt ?? null
+  };
+}
+function toJsonBinding(automation) {
+  return {
+    id: automation.id,
+    scenarioId: automation.scenarioId,
+    label: automation.label,
+    profileId: automation.profileId ?? null,
+    profileLabel: automation.profileLabel ?? null,
+    materializedFromProjectDefault: automation.materializedFromProjectDefault ?? false,
+    enabled: automation.enabled
+  };
+}
+function profileLines(profiles) {
+  if (profiles.length === 0) {
+    return ["Automation profiles: 0", "No automation profiles found for the selected project."];
+  }
+  return [
+    `Automation profiles: ${profiles.length}`,
+    ...profiles.map((profile) => {
+      const flags = [profile.isProjectDefault ? "default" : "", profile.enabled ? "enabled" : "disabled"].filter(
+        Boolean
+      );
+      return `- ${profile.id} [${flags.join(", ")}] ${profile.label} (${profile.provider}) ${profile.endpointSummary}`;
+    })
+  ];
+}
+function bindingLines(bindings) {
+  return bindings.map(
+    (binding) => `- ${binding.id} scenario=${binding.scenarioId} ${binding.label}` + (binding.materializedFromProjectDefault ? " [project-default materialized]" : "")
+  );
+}
+function profileBindings(automations, profileId) {
+  return automations.filter((automation) => automation.mode === "profile" && automation.profileId === profileId);
+}
+function allProfileBindings(automations) {
+  return automations.filter((automation) => automation.mode === "profile");
+}
+function createProfilesHandler(deps = {}) {
+  const cwd = deps.cwd ?? process.cwd();
+  const env = deps.env ?? process.env;
+  return async (request, context) => {
+    const [subcommand, ...restArgs] = request.args;
+    const parsed = parseArgs8(restArgs);
+    const useJson = parsed.boolFlags.has("--json");
+    const dryRun = parsed.boolFlags.has("--dry-run");
+    const confirmed = parsed.boolFlags.has("--confirm");
+    const detach = parsed.boolFlags.has("--detach");
+    const profileId = parsed.flags["--id"]?.trim() ?? "";
+    const config = resolveCliConfig(pickConfigArgs7(parsed), env, cwd);
+    const projectKey = config.values.projectKey;
+    const issueKey = config.values.issueKey;
+    const forgeContext = {
+      projectKey: projectKey || void 0,
+      issueKey: issueKey || void 0
+    };
+    if (parsed.unknownFlags.length > 0) {
+      return {
+        exitCode: ExitCode.UsageError,
+        stderr: [`ERROR: Unknown or invalid arguments: ${parsed.unknownFlags.join(", ")}`]
+      };
+    }
+    if (!projectKey) {
+      return missingProjectResponse3();
+    }
+    if (dryRun && confirmed) {
+      return {
+        exitCode: ExitCode.UsageError,
+        stderr: ["ERROR: Use either --dry-run or --confirm, not both."]
+      };
+    }
+    if (subcommand === "list") {
+      if (dryRun || confirmed || detach || profileId) {
+        return {
+          exitCode: ExitCode.UsageError,
+          stderr: ["ERROR: profiles list accepts only configuration flags and optional --json."]
+        };
+      }
+      try {
+        const result = await context.invokeForgeContract("listScenarioAutomationProfiles", {
+          context: forgeContext
+        });
+        if (!result.ok) {
+          return remoteErrorResponse(result.error.code, result.error.message);
+        }
+        if (useJson) {
+          return {
+            exitCode: ExitCode.Success,
+            stdout: toJsonLine({
+              action: "profiles-list",
+              projectKey,
+              count: result.data.length,
+              items: result.data.map(toJsonProfile)
+            })
+          };
+        }
+        return {
+          exitCode: ExitCode.Success,
+          stdout: profileLines(result.data)
+        };
+      } catch (error) {
+        return {
+          exitCode: ExitCode.TransportError,
+          stderr: [`ERROR: ${normalizeError6(error)}`]
+        };
+      }
+    }
+    if (subcommand === "detach") {
+      if (!profileId) {
+        return {
+          exitCode: ExitCode.ValidationError,
+          stderr: ["ERROR: Missing required --id <PROFILE_ID> for profiles detach."]
+        };
+      }
+      if (detach) {
+        return {
+          exitCode: ExitCode.UsageError,
+          stderr: [
+            "ERROR: --detach is only valid with profiles delete; profiles detach already performs that operation."
+          ]
+        };
+      }
+      if (!dryRun && !confirmed) {
+        return confirmationRequiredResponse("profiles detach");
+      }
+      try {
+        const result = await context.invokeForgeContract("listScenarioAutomations", {
+          context: forgeContext
+        });
+        if (!result.ok) {
+          return remoteErrorResponse(result.error.code, result.error.message);
+        }
+        const bindings = profileBindings(result.data, profileId);
+        if (dryRun) {
+          if (useJson) {
+            return {
+              exitCode: ExitCode.Success,
+              stdout: toJsonLine({
+                action: "profiles-detach",
+                dryRun: true,
+                projectKey,
+                profileId,
+                bindingCount: bindings.length,
+                bindings: bindings.map(toJsonBinding)
+              })
+            };
+          }
+          return {
+            exitCode: ExitCode.Success,
+            stdout: [
+              `Dry run: profile ${profileId} has ${bindings.length} automation binding(s) to detach.`,
+              ...bindingLines(bindings),
+              "No changes made."
+            ]
+          };
+        }
+        const deletedIds = [];
+        for (const binding of bindings) {
+          const deleted = await context.invokeForgeContract("deleteScenarioAutomation", {
+            context: forgeContext,
+            automationId: binding.id
+          });
+          if (!deleted.ok) {
+            return remoteErrorResponse(deleted.error.code, deleted.error.message, [
+              `Detached ${deletedIds.length} of ${bindings.length} automation binding(s) before the failure.`
+            ]);
+          }
+          deletedIds.push(binding.id);
+        }
         if (useJson) {
           return {
-            exitCode: ExitCode.RemoteError,
+            exitCode: ExitCode.Success,
             stdout: toJsonLine({
-              action: "ingest-feature",
-              status: "failed",
-              featureName: name,
-              source: useStdin ? "stdin" : sourceFile,
-              errorCode: result.error.code,
-              errorMessage: result.error.message
+              action: "profiles-detach",
+              dryRun: false,
+              projectKey,
+              profileId,
+              detachedCount: deletedIds.length,
+              detachedAutomationIds: deletedIds
             })
           };
         }
         return {
-          exitCode: ExitCode.RemoteError,
-          stdout: ["Feature ingestion: FAILED", `Feature: ${name}`, `Source: ${useStdin ? "stdin" : sourceFile}`],
-          stderr: [`ERROR: ${result.error.code}: ${result.error.message}`]
+          exitCode: ExitCode.Success,
+          stdout: [`Detached ${deletedIds.length} automation binding(s) from profile ${profileId}.`]
+        };
+      } catch (error) {
+        return {
+          exitCode: ExitCode.TransportError,
+          stderr: [`ERROR: ${normalizeError6(error)}`]
         };
       }
-      if (useJson) {
-        const details = summarizeSuccess(result);
+    }
+    if (subcommand === "delete") {
+      if (!profileId) {
         return {
-          exitCode: ExitCode.Success,
-          stdout: toJsonLine({
-            action: "ingest-feature",
-            status: "success",
-            featureName: name,
-            source: useStdin ? "stdin" : sourceFile,
-            details
-          })
+          exitCode: ExitCode.ValidationError,
+          stderr: ["ERROR: Missing required --id <PROFILE_ID> for profiles delete."]
         };
       }
-      return {
-        exitCode: ExitCode.Success,
-        stdout: [
-          "Feature ingestion: SUCCESS",
-          `Feature: ${name}`,
-          `Source: ${useStdin ? "stdin" : sourceFile}`,
-          ...summarizeSuccess(result)
-        ]
-      };
-    } catch (error) {
-      if (useJson) {
+      if (!dryRun && !confirmed) {
+        return confirmationRequiredResponse("profiles delete");
+      }
+      try {
+        let bindings = [];
+        if (detach || dryRun) {
+          const automations = await context.invokeForgeContract("listScenarioAutomations", {
+            context: forgeContext
+          });
+          if (!automations.ok) {
+            return remoteErrorResponse(automations.error.code, automations.error.message);
+          }
+          bindings = profileBindings(automations.data, profileId);
+        }
+        if (dryRun) {
+          if (useJson) {
+            return {
+              exitCode: ExitCode.Success,
+              stdout: toJsonLine({
+                action: "profiles-delete",
+                dryRun: true,
+                projectKey,
+                profileId,
+                detach,
+                bindingCount: bindings.length,
+                bindings: bindings.map(toJsonBinding)
+              })
+            };
+          }
+          return {
+            exitCode: ExitCode.Success,
+            stdout: [
+              `Dry run: profile ${profileId} would be deleted.`,
+              detach ? `The command would first detach ${bindings.length} automation binding(s).` : `The command would not detach ${bindings.length} automation binding(s); Forge will block deletion if the profile is in use.`,
+              ...bindingLines(bindings),
+              "No changes made."
+            ]
+          };
+        }
+        const detachedIds = [];
+        if (detach) {
+          for (const binding of bindings) {
+            const deletedBinding = await context.invokeForgeContract("deleteScenarioAutomation", {
+              context: forgeContext,
+              automationId: binding.id
+            });
+            if (!deletedBinding.ok) {
+              return remoteErrorResponse(deletedBinding.error.code, deletedBinding.error.message, [
+                `Detached ${detachedIds.length} of ${bindings.length} automation binding(s); profile ${profileId} was not deleted.`
+              ]);
+            }
+            detachedIds.push(binding.id);
+          }
+        }
+        const deletedProfile = await context.invokeForgeContract("deleteScenarioAutomationProfile", {
+          context: forgeContext,
+          profileId
+        });
+        if (!deletedProfile.ok) {
+          return remoteErrorResponse(deletedProfile.error.code, deletedProfile.error.message, [
+            `Detached ${detachedIds.length} automation binding(s) before profile deletion was rejected.`
+          ]);
+        }
+        if (useJson) {
+          return {
+            exitCode: ExitCode.Success,
+            stdout: toJsonLine({
+              action: "profiles-delete",
+              dryRun: false,
+              projectKey,
+              profileId,
+              detachedCount: detachedIds.length,
+              detachedAutomationIds: detachedIds,
+              deleted: true
+            })
+          };
+        }
+        return {
+          exitCode: ExitCode.Success,
+          stdout: [
+            `Deleted automation profile ${profileId}.`,
+            detach ? `Detached ${detachedIds.length} automation binding(s) first.` : "No automatic detach was requested."
+          ]
+        };
+      } catch (error) {
         return {
           exitCode: ExitCode.TransportError,
-          stdout: toJsonLine({
-            action: "ingest-feature",
-            status: "failed",
-            featureName: name,
-            source: useStdin ? "stdin" : sourceFile,
-            errorMessage: normalizeError5(error)
+          stderr: [`ERROR: ${normalizeError6(error)}`]
+        };
+      }
+    }
+    if (subcommand === "clear") {
+      if (profileId || detach) {
+        return {
+          exitCode: ExitCode.UsageError,
+          stderr: [
+            "ERROR: profiles clear clears every profile and profile-based binding; do not pass --id or --detach."
+          ]
+        };
+      }
+      if (!dryRun && !confirmed) {
+        return confirmationRequiredResponse("profiles clear");
+      }
+      try {
+        const [profilesResult, automationsResult] = await Promise.all([
+          context.invokeForgeContract("listScenarioAutomationProfiles", {
+            context: forgeContext
+          }),
+          context.invokeForgeContract("listScenarioAutomations", {
+            context: forgeContext
           })
+        ]);
+        if (!profilesResult.ok) {
+          return remoteErrorResponse(profilesResult.error.code, profilesResult.error.message);
+        }
+        if (!automationsResult.ok) {
+          return remoteErrorResponse(automationsResult.error.code, automationsResult.error.message);
+        }
+        const profiles = profilesResult.data;
+        const bindings = allProfileBindings(automationsResult.data);
+        if (dryRun) {
+          if (useJson) {
+            return {
+              exitCode: ExitCode.Success,
+              stdout: toJsonLine({
+                action: "profiles-clear",
+                dryRun: true,
+                projectKey,
+                profileCount: profiles.length,
+                bindingCount: bindings.length,
+                profiles: profiles.map(toJsonProfile),
+                bindings: bindings.map(toJsonBinding)
+              })
+            };
+          }
+          return {
+            exitCode: ExitCode.Success,
+            stdout: [
+              `Dry run: would detach ${bindings.length} profile-based automation binding(s) and delete ${profiles.length} automation profile(s).`,
+              ...bindingLines(bindings),
+              ...profiles.map((profile) => `- profile ${profile.id} ${profile.label}`),
+              "Direct (non-profile) scenario automations are preserved.",
+              "No changes made."
+            ]
+          };
+        }
+        const detachedIds = [];
+        for (const binding of bindings) {
+          const deletedBinding = await context.invokeForgeContract("deleteScenarioAutomation", {
+            context: forgeContext,
+            automationId: binding.id
+          });
+          if (!deletedBinding.ok) {
+            return remoteErrorResponse(deletedBinding.error.code, deletedBinding.error.message, [
+              `Detached ${detachedIds.length} of ${bindings.length} profile-based automation binding(s). No profiles were deleted after the failure.`
+            ]);
+          }
+          detachedIds.push(binding.id);
+        }
+        const deletedProfileIds = [];
+        for (const profile of profiles) {
+          const deletedProfile = await context.invokeForgeContract("deleteScenarioAutomationProfile", {
+            context: forgeContext,
+            profileId: profile.id
+          });
+          if (!deletedProfile.ok) {
+            return remoteErrorResponse(deletedProfile.error.code, deletedProfile.error.message, [
+              `Detached ${detachedIds.length} profile-based automation binding(s).`,
+              `Deleted ${deletedProfileIds.length} of ${profiles.length} automation profile(s) before the failure.`
+            ]);
+          }
+          deletedProfileIds.push(profile.id);
+        }
+        if (useJson) {
+          return {
+            exitCode: ExitCode.Success,
+            stdout: toJsonLine({
+              action: "profiles-clear",
+              dryRun: false,
+              projectKey,
+              detachedCount: detachedIds.length,
+              detachedAutomationIds: detachedIds,
+              deletedProfileCount: deletedProfileIds.length,
+              deletedProfileIds
+            })
+          };
+        }
+        return {
+          exitCode: ExitCode.Success,
+          stdout: [
+            `Detached ${detachedIds.length} profile-based automation binding(s).`,
+            `Deleted ${deletedProfileIds.length} automation profile(s).`,
+            "Direct (non-profile) scenario automations were preserved."
+          ]
+        };
+      } catch (error) {
+        return {
+          exitCode: ExitCode.TransportError,
+          stderr: [`ERROR: ${normalizeError6(error)}`]
         };
       }
-      return {
-        exitCode: ExitCode.TransportError,
-        stdout: ["Feature ingestion: FAILED", `Feature: ${name}`, `Source: ${useStdin ? "stdin" : sourceFile}`],
-        stderr: [`ERROR: ${normalizeError5(error)}`]
-      };
     }
+    return {
+      exitCode: ExitCode.UsageError,
+      stderr: ["ERROR: Unsupported profiles subcommand. Use: list, detach, delete, or clear."]
+    };
   };
 }
 
 // src/runUpload.ts
-var import_node_fs12 = require("node:fs");
+var import_node_fs13 = require("node:fs");
 var import_node_path13 = __toESM(require("node:path"), 1);
 var STEP_RESULTS = [
   StepResult.Passed,
@@ -15647,7 +16679,7 @@ var STEP_RESULTS = [
   StepResult.Skipped,
   StepResult.Blocked
 ];
-var CONFIG_FLAGS7 = /* @__PURE__ */ new Set([
+var CONFIG_FLAGS8 = /* @__PURE__ */ new Set([
   "--config",
   "--base-url",
   "--project-key",
@@ -15656,7 +16688,7 @@ var CONFIG_FLAGS7 = /* @__PURE__ */ new Set([
   "--jira-email",
   "--jira-api-token"
 ]);
-function parseArgs8(args) {
+function parseArgs9(args) {
   const flags = {};
   const boolFlags = /* @__PURE__ */ new Set();
   const unknownFlags = [];
@@ -15667,7 +16699,7 @@ function parseArgs8(args) {
     "--feature-name",
     "--scenario-name",
     "--executed-at",
-    ...CONFIG_FLAGS7
+    ...CONFIG_FLAGS8
   ]);
   const supportedBoolFlags = /* @__PURE__ */ new Set(["--stdin", "--json"]);
   for (let i = 0; i < args.length; i += 1) {
@@ -15693,16 +16725,16 @@ function parseArgs8(args) {
   }
   return { flags, boolFlags, unknownFlags };
 }
-function pickConfigArgs7(parsed) {
+function pickConfigArgs8(parsed) {
   const configArgs = [];
   for (const [flag, value] of Object.entries(parsed.flags)) {
-    if (CONFIG_FLAGS7.has(flag)) {
+    if (CONFIG_FLAGS8.has(flag)) {
       configArgs.push(flag, value);
     }
   }
   return configArgs;
 }
-function normalizeError6(error) {
+function normalizeError7(error) {
   if (error instanceof ForgeClientError) {
     return `${error.code}: ${error.message}`;
   }
@@ -15781,14 +16813,14 @@ function summarizeRunResult(result) {
   return lines;
 }
 function createRunUploadHandler(deps = {}) {
-  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs12.readFileSync)(filePath, "utf8"));
-  const readStdin = deps.readStdin ?? (() => (0, import_node_fs12.readFileSync)(0, "utf8"));
+  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs13.readFileSync)(filePath, "utf8"));
+  const readStdin = deps.readStdin ?? (() => (0, import_node_fs13.readFileSync)(0, "utf8"));
   const cwd = deps.cwd ?? process.cwd();
   const env = deps.env ?? process.env;
   return async (request, context) => {
     const [, ...subArgs] = request.args;
-    const parsed = parseArgs8(subArgs);
-    const configArgs = pickConfigArgs7(parsed);
+    const parsed = parseArgs9(subArgs);
+    const configArgs = pickConfigArgs8(parsed);
     const config = resolveCliConfig(configArgs, env, cwd);
     const projectKey = config.values.projectKey;
     const issueKey = config.values.issueKey;
@@ -15821,7 +16853,7 @@ function createRunUploadHandler(deps = {}) {
     } catch (error) {
       return {
         exitCode: ExitCode.InternalError,
-        stderr: [`ERROR: Failed to read run payload source: ${normalizeError6(error)}`]
+        stderr: [`ERROR: Failed to read run payload source: ${normalizeError7(error)}`]
       };
     }
     const payloadFromSource = parseRunPayload(raw);
@@ -15851,7 +16883,7 @@ function createRunUploadHandler(deps = {}) {
       } catch (error) {
         return {
           exitCode: ExitCode.TransportError,
-          stderr: [`ERROR: ${normalizeError6(error)}`]
+          stderr: [`ERROR: ${normalizeError7(error)}`]
         };
       }
     }
@@ -15931,7 +16963,7 @@ function createRunUploadHandler(deps = {}) {
             featureName: runInput.featureName,
             scenarioName: runInput.scenarioName,
             executedAt: runInput.executedAt,
-            errorMessage: normalizeError6(error)
+            errorMessage: normalizeError7(error)
           })
         };
       }
@@ -15943,14 +16975,14 @@ function createRunUploadHandler(deps = {}) {
           `Scenario: ${runInput.scenarioName}`,
           `ExecutedAt: ${runInput.executedAt}`
         ],
-        stderr: [`ERROR: ${normalizeError6(error)}`]
+        stderr: [`ERROR: ${normalizeError7(error)}`]
       };
     }
   };
 }
 
 // src/runs.ts
-var CONFIG_FLAGS8 = /* @__PURE__ */ new Set([
+var CONFIG_FLAGS9 = /* @__PURE__ */ new Set([
   "--config",
   "--base-url",
   "--project-key",
@@ -15959,11 +16991,11 @@ var CONFIG_FLAGS8 = /* @__PURE__ */ new Set([
   "--jira-email",
   "--jira-api-token"
 ]);
-function parseArgs9(args) {
+function parseArgs10(args) {
   const flags = {};
   const boolFlags = /* @__PURE__ */ new Set();
   const unknownFlags = [];
-  const supportedValueFlags = /* @__PURE__ */ new Set(["--id", ...CONFIG_FLAGS8]);
+  const supportedValueFlags = /* @__PURE__ */ new Set(["--id", ...CONFIG_FLAGS9]);
   const supportedBoolFlags = /* @__PURE__ */ new Set(["--json"]);
   for (let index = 0; index < args.length; index += 1) {
     const token = args[index];
@@ -15988,16 +17020,16 @@ function parseArgs9(args) {
   }
   return { flags, boolFlags, unknownFlags };
 }
-function pickConfigArgs8(parsed) {
+function pickConfigArgs9(parsed) {
   const args = [];
   for (const [flag, value] of Object.entries(parsed.flags)) {
-    if (CONFIG_FLAGS8.has(flag)) {
+    if (CONFIG_FLAGS9.has(flag)) {
       args.push(flag, value);
     }
   }
   return args;
 }
-function normalizeError7(error) {
+function normalizeError8(error) {
   if (error instanceof ForgeClientError) {
     return `${error.code}: ${error.message}`;
   }
@@ -16050,7 +17082,7 @@ function runToLines(run) {
   }
   return lines;
 }
-function missingProjectResponse3() {
+function missingProjectResponse4() {
   return {
     exitCode: ExitCode.ValidationError,
     stderr: ["ERROR: Missing project context. Set JIRA_PROJECT_KEY or pass --project-key."]
@@ -16061,9 +17093,9 @@ function createRunsHandler(deps = {}) {
   const env = deps.env ?? process.env;
   return async (request, context) => {
     const [subcommand, ...restArgs] = request.args;
-    const parsed = parseArgs9(restArgs);
+    const parsed = parseArgs10(restArgs);
     const useJson = parsed.boolFlags.has("--json");
-    const config = resolveCliConfig(pickConfigArgs8(parsed), env, cwd);
+    const config = resolveCliConfig(pickConfigArgs9(parsed), env, cwd);
     const projectKey = config.values.projectKey;
     const issueKey = config.values.issueKey;
     if (parsed.unknownFlags.length > 0) {
@@ -16073,7 +17105,7 @@ function createRunsHandler(deps = {}) {
       };
     }
     if (!projectKey) {
-      return missingProjectResponse3();
+      return missingProjectResponse4();
     }
     if (subcommand === "show") {
       const runId = parsed.flags["--id"]?.trim() ?? "";
@@ -16115,7 +17147,7 @@ function createRunsHandler(deps = {}) {
       } catch (error) {
         return {
           exitCode: ExitCode.TransportError,
-          stderr: [`ERROR: ${normalizeError7(error)}`]
+          stderr: [`ERROR: ${normalizeError8(error)}`]
         };
       }
     }
@@ -16127,7 +17159,7 @@ function createRunsHandler(deps = {}) {
 }
 
 // src/setup.ts
-var import_node_fs14 = require("node:fs");
+var import_node_fs15 = require("node:fs");
 var import_node_path15 = __toESM(require("node:path"), 1);
 
 // src/githubSetupProvider.ts
@@ -16135,7 +17167,7 @@ var import_node_child_process4 = require("node:child_process");
 
 // src/setupPlan.ts
 var import_node_crypto = require("node:crypto");
-var import_node_fs13 = require("node:fs");
+var import_node_fs14 = require("node:fs");
 var import_node_path14 = __toESM(require("node:path"), 1);
 var SETUP_PLAN_SCHEMA_VERSION = "automatify.testops.setup/v1";
 var SETUP_PLAN_KIND = "AutomatifyTestOpsSetupPlan";
@@ -16231,7 +17263,7 @@ function buildGitHubSetupPlan(input) {
   if (endpointSecretName === tokenSecretName) {
     throw new Error("callback endpoint and auth token secret names must be different.");
   }
-  const workflowContent = (0, import_node_fs13.readFileSync)(input.workflowSourcePath, "utf8");
+  const workflowContent = (0, import_node_fs14.readFileSync)(input.workflowSourcePath, "utf8");
   if (!workflowContent.trim()) {
     throw new Error("workflow source file is empty.");
   }
@@ -17095,7 +18127,7 @@ function defaultReadStdin() {
     process.stdin.on("error", reject);
   });
 }
-function parseArgs10(args, valueFlags, boolFlags, allowApplyCollections = false) {
+function parseArgs11(args, valueFlags, boolFlags, allowApplyCollections = false) {
   const flags = {};
   const enabled = /* @__PURE__ */ new Set();
   const approvals = [];
@@ -17177,7 +18209,7 @@ function loadPlan(planPath, cwd) {
   const absolute = import_node_path15.default.resolve(cwd, planPath);
   let parsed;
   try {
-    parsed = JSON.parse((0, import_node_fs14.readFileSync)(absolute, "utf8"));
+    parsed = JSON.parse((0, import_node_fs15.readFileSync)(absolute, "utf8"));
   } catch (error) {
     throw new SetupCommandError(
       "PLAN_READ_ERROR",
@@ -17416,7 +18448,7 @@ function resolveWorkflowTarget(plan, repoRoot) {
 function applyWorkflowFile(plan, repoRoot, dryRun) {
   const action = plan.actions.find((item) => item.scope === "workflow-file");
   const target = resolveWorkflowTarget(plan, repoRoot);
-  const sourceContent = (0, import_node_fs14.readFileSync)(plan.github.workflowFile.sourcePath, "utf8");
+  const sourceContent = (0, import_node_fs15.readFileSync)(plan.github.workflowFile.sourcePath, "utf8");
   if (hashSetupContent(sourceContent) !== plan.github.workflowFile.sha256) {
     throw new SetupCommandError(
       "WORKFLOW_SOURCE_CHANGED",
@@ -17424,8 +18456,8 @@ function applyWorkflowFile(plan, repoRoot, dryRun) {
       ExitCode.ValidationError
     );
   }
-  const existed = (0, import_node_fs14.existsSync)(target);
-  const previousContent = existed ? (0, import_node_fs14.readFileSync)(target, "utf8") : void 0;
+  const existed = (0, import_node_fs15.existsSync)(target);
+  const previousContent = existed ? (0, import_node_fs15.readFileSync)(target, "utf8") : void 0;
   const matches = previousContent !== void 0 && hashSetupContent(previousContent) === plan.github.workflowFile.sha256;
   if (matches) {
     return {
@@ -17437,8 +18469,8 @@ function applyWorkflowFile(plan, repoRoot, dryRun) {
     };
   }
   if (!dryRun) {
-    (0, import_node_fs14.mkdirSync)(import_node_path15.default.dirname(target), { recursive: true });
-    (0, import_node_fs14.writeFileSync)(target, sourceContent, { encoding: "utf8", mode: 420 });
+    (0, import_node_fs15.mkdirSync)(import_node_path15.default.dirname(target), { recursive: true });
+    (0, import_node_fs15.writeFileSync)(target, sourceContent, { encoding: "utf8", mode: 420 });
   }
   return {
     id: action.id,
@@ -17608,14 +18640,14 @@ async function inspectPlan(plan, repoRoot, secrets, context, deps) {
   const checks = [];
   let forgeTransportFailure = false;
   const target = resolveWorkflowTarget(plan, repoRoot);
-  if (!(0, import_node_fs14.existsSync)(target)) {
+  if (!(0, import_node_fs15.existsSync)(target)) {
     checks.push({
       id: "workflow-local",
       status: "fail",
       message: `Local workflow file ${plan.github.workflowFile.path} does not exist.`
     });
   } else {
-    const localHash = hashSetupContent((0, import_node_fs14.readFileSync)(target, "utf8"));
+    const localHash = hashSetupContent((0, import_node_fs15.readFileSync)(target, "utf8"));
     checks.push({
       id: "workflow-local",
       status: localHash === plan.github.workflowFile.sha256 ? "pass" : "fail",
@@ -17705,7 +18737,7 @@ async function inspectPlan(plan, repoRoot, secrets, context, deps) {
   };
 }
 function planCommand(args, deps) {
-  const parsed = parseArgs10(args, PLAN_VALUE_FLAGS, /* @__PURE__ */ new Set(["--set-default", "--disabled"]));
+  const parsed = parseArgs11(args, PLAN_VALUE_FLAGS, /* @__PURE__ */ new Set(["--set-default", "--disabled"]));
   if (parsed.errors.length > 0) {
     return jsonResponse(
       errorPayload("USAGE_ERROR", "Invalid setup plan arguments.", parsed.errors),
@@ -17764,7 +18796,7 @@ function planCommand(args, deps) {
   }
 }
 async function applyCommand(args, context, deps) {
-  const parsed = parseArgs10(args, APPLY_VALUE_FLAGS, APPLY_BOOL_FLAGS, true);
+  const parsed = parseArgs11(args, APPLY_VALUE_FLAGS, APPLY_BOOL_FLAGS, true);
   if (parsed.errors.length > 0) {
     return jsonResponse(
       errorPayload("USAGE_ERROR", "Invalid setup apply arguments.", parsed.errors),
@@ -18007,7 +19039,7 @@ async function applyAzureCommand(plan, parsed, context, deps, secrets) {
   });
 }
 async function doctorCommand(args, context, deps) {
-  const parsed = parseArgs10(args, APPLY_VALUE_FLAGS, /* @__PURE__ */ new Set(["--secrets-stdin"]), true);
+  const parsed = parseArgs11(args, APPLY_VALUE_FLAGS, /* @__PURE__ */ new Set(["--secrets-stdin"]), true);
   if (parsed.approvals.length > 0) {
     return jsonResponse(errorPayload("USAGE_ERROR", "setup doctor does not accept --approve."), ExitCode.UsageError);
   }
@@ -18120,7 +19152,7 @@ function createSetupHandler(overrides = {}) {
 }
 
 // src/suites.ts
-var CONFIG_FLAGS9 = /* @__PURE__ */ new Set([
+var CONFIG_FLAGS10 = /* @__PURE__ */ new Set([
   "--config",
   "--base-url",
   "--project-key",
@@ -18129,11 +19161,11 @@ var CONFIG_FLAGS9 = /* @__PURE__ */ new Set([
   "--jira-email",
   "--jira-api-token"
 ]);
-function parseArgs11(args) {
+function parseArgs12(args) {
   const flags = {};
   const boolFlags = /* @__PURE__ */ new Set();
   const unknownFlags = [];
-  const supportedValueFlags = /* @__PURE__ */ new Set(["--key", ...CONFIG_FLAGS9]);
+  const supportedValueFlags = /* @__PURE__ */ new Set(["--key", ...CONFIG_FLAGS10]);
   const supportedBoolFlags = /* @__PURE__ */ new Set(["--json"]);
   for (let index = 0; index < args.length; index += 1) {
     const token = args[index];
@@ -18158,16 +19190,16 @@ function parseArgs11(args) {
   }
   return { flags, boolFlags, unknownFlags };
 }
-function pickConfigArgs9(parsed) {
+function pickConfigArgs10(parsed) {
   const args = [];
   for (const [flag, value] of Object.entries(parsed.flags)) {
-    if (CONFIG_FLAGS9.has(flag)) {
+    if (CONFIG_FLAGS10.has(flag)) {
       args.push(flag, value);
     }
   }
   return args;
 }
-function normalizeError8(error) {
+function normalizeError9(error) {
   if (error instanceof ForgeClientError) {
     return `${error.code}: ${error.message}`;
   }
@@ -18229,7 +19261,7 @@ function suiteCasesToLines(suite, items) {
     ...items.map((item) => `- ${item.key} [${item.status}] ${item.title}`)
   ];
 }
-function missingProjectResponse4() {
+function missingProjectResponse5() {
   return {
     exitCode: ExitCode.ValidationError,
     stderr: ["ERROR: Missing project context. Set JIRA_PROJECT_KEY or pass --project-key."]
@@ -18246,9 +19278,9 @@ function createSuitesHandler(deps = {}) {
   const env = deps.env ?? process.env;
   return async (request, context) => {
     const [subcommand, ...restArgs] = request.args;
-    const parsed = parseArgs11(restArgs);
+    const parsed = parseArgs12(restArgs);
     const useJson = parsed.boolFlags.has("--json");
-    const config = resolveCliConfig(pickConfigArgs9(parsed), env, cwd);
+    const config = resolveCliConfig(pickConfigArgs10(parsed), env, cwd);
     const projectKey = config.values.projectKey;
     const issueKey = config.values.issueKey;
     if (parsed.unknownFlags.length > 0) {
@@ -18258,7 +19290,7 @@ function createSuitesHandler(deps = {}) {
       };
     }
     if (!projectKey) {
-      return missingProjectResponse4();
+      return missingProjectResponse5();
     }
     if (subcommand === "list") {
       try {
@@ -18293,7 +19325,7 @@ function createSuitesHandler(deps = {}) {
       } catch (error) {
         return {
           exitCode: ExitCode.TransportError,
-          stderr: [`ERROR: ${normalizeError8(error)}`]
+          stderr: [`ERROR: ${normalizeError9(error)}`]
         };
       }
     }
@@ -18334,7 +19366,7 @@ function createSuitesHandler(deps = {}) {
       } catch (error) {
         return {
           exitCode: ExitCode.TransportError,
-          stderr: [`ERROR: ${normalizeError8(error)}`]
+          stderr: [`ERROR: ${normalizeError9(error)}`]
         };
       }
     }
@@ -18398,7 +19430,7 @@ function createSuitesHandler(deps = {}) {
       } catch (error) {
         return {
           exitCode: ExitCode.TransportError,
-          stderr: [`ERROR: ${normalizeError8(error)}`]
+          stderr: [`ERROR: ${normalizeError9(error)}`]
         };
       }
     }
@@ -18410,7 +19442,7 @@ function createSuitesHandler(deps = {}) {
 }
 
 // src/sync.ts
-var CONFIG_FLAGS10 = /* @__PURE__ */ new Set([
+var CONFIG_FLAGS11 = /* @__PURE__ */ new Set([
   "--config",
   "--base-url",
   "--project-key",
@@ -18420,11 +19452,11 @@ var CONFIG_FLAGS10 = /* @__PURE__ */ new Set([
   "--jira-api-token"
 ]);
 var RECONCILE_CONFIRM_TOKEN = "RECONCILE";
-function parseArgs12(args) {
+function parseArgs13(args) {
   const flags = {};
   const boolFlags = /* @__PURE__ */ new Set();
   const unknownFlags = [];
-  const supportedValueFlags = /* @__PURE__ */ new Set(["--confirm", ...CONFIG_FLAGS10]);
+  const supportedValueFlags = /* @__PURE__ */ new Set(["--confirm", ...CONFIG_FLAGS11]);
   const supportedBoolFlags = /* @__PURE__ */ new Set(["--json"]);
   for (let i = 0; i < args.length; i += 1) {
     const token = args[i];
@@ -18449,16 +19481,16 @@ function parseArgs12(args) {
   }
   return { flags, boolFlags, unknownFlags };
 }
-function pickConfigArgs10(parsed) {
+function pickConfigArgs11(parsed) {
   const args = [];
   for (const [flag, value] of Object.entries(parsed.flags)) {
-    if (CONFIG_FLAGS10.has(flag)) {
+    if (CONFIG_FLAGS11.has(flag)) {
       args.push(flag, value);
     }
   }
   return args;
 }
-function normalizeError9(error) {
+function normalizeError10(error) {
   if (error instanceof ForgeClientError) {
     return `${error.code}: ${error.message}`;
   }
@@ -18509,9 +19541,9 @@ function createSyncHandler(deps = {}) {
   const env = deps.env ?? process.env;
   return async (request, context) => {
     const [subcommand, ...restArgs] = request.args;
-    const parsed = parseArgs12(restArgs);
+    const parsed = parseArgs13(restArgs);
     const useJson = parsed.boolFlags.has("--json");
-    const config = resolveCliConfig(pickConfigArgs10(parsed), env, cwd);
+    const config = resolveCliConfig(pickConfigArgs11(parsed), env, cwd);
     const projectKey = config.values.projectKey;
     const issueKey = config.values.issueKey;
     if (parsed.unknownFlags.length > 0) {
@@ -18561,7 +19593,7 @@ function createSyncHandler(deps = {}) {
       } catch (error) {
         return {
           exitCode: ExitCode.TransportError,
-          stderr: [`ERROR: ${normalizeError9(error)}`]
+          stderr: [`ERROR: ${normalizeError10(error)}`]
         };
       }
     }
@@ -18607,7 +19639,7 @@ function createSyncHandler(deps = {}) {
       } catch (error) {
         return {
           exitCode: ExitCode.TransportError,
-          stderr: [`ERROR: ${normalizeError9(error)}`]
+          stderr: [`ERROR: ${normalizeError10(error)}`]
         };
       }
     }
@@ -18626,6 +19658,12 @@ var COMMAND_REGISTRY = [
     subcommands: ["upload", "download", "open"],
     handler: createAllureHandler()
   },
+  {
+    name: "auth",
+    description: "Secret-safe Jira authentication login, status, and logout commands",
+    subcommands: ["login", "status", "logout"],
+    handler: createAuthHandler()
+  },
   {
     name: "auto",
     description: "Smart auto-ingestion command contract (MVP staged)",
@@ -18648,7 +19686,7 @@ var COMMAND_REGISTRY = [
   {
     name: "config",
     description: "Configuration and auth bootstrap commands",
-    subcommands: ["show", "validate", "set"],
+    subcommands: ["show", "validate", "set", "unset", "migrate-secrets"],
     handler: createConfigHandler()
   },
   {
@@ -18657,6 +19695,12 @@ var COMMAND_REGISTRY = [
     subcommands: ["feature"],
     handler: createIngestFeatureHandler()
   },
+  {
+    name: "profiles",
+    description: "Automation profile inspection, detach, delete, and demo cleanup commands",
+    subcommands: ["list", "detach", "delete", "clear"],
+    handler: createProfilesHandler()
+  },
   {
     name: "run",
     description: "Execution result upload commands",