@automatify-au/cli 0.1.15 → 0.1.17

package/dist/automatify.cjs

@@ -2894,8 +2894,8 @@ var require_utils = __commonJS({
       var result = transform[inputType][outputType](input);
       return result;
     };
-    exports2.resolve = function(path16) {
-      var parts = path16.split("/");
+    exports2.resolve = function(path17) {
+      var parts = path17.split("/");
       var result = [];
       for (var index = 0; index < parts.length; index++) {
         var part = parts[index];
@@ -8748,18 +8748,18 @@ var require_object = __commonJS({
       var object = new ZipObject(name, zipObjectContent, o);
       this.files[name] = object;
     };
-    var parentFolder = function(path16) {
-      if (path16.slice(-1) === "/") {
-        path16 = path16.substring(0, path16.length - 1);
+    var parentFolder = function(path17) {
+      if (path17.slice(-1) === "/") {
+        path17 = path17.substring(0, path17.length - 1);
       }
-      var lastSlash = path16.lastIndexOf("/");
-      return lastSlash > 0 ? path16.substring(0, lastSlash) : "";
+      var lastSlash = path17.lastIndexOf("/");
+      return lastSlash > 0 ? path17.substring(0, lastSlash) : "";
     };
-    var forceTrailingSlash = function(path16) {
-      if (path16.slice(-1) !== "/") {
-        path16 += "/";
+    var forceTrailingSlash = function(path17) {
+      if (path17.slice(-1) !== "/") {
+        path17 += "/";
       }
-      return path16;
+      return path17;
     };
     var folderAdd = function(name, createFolders) {
       createFolders = typeof createFolders !== "undefined" ? createFolders : defaults.createFolders;
@@ -10720,8 +10720,8 @@ function toJsonLine(data) {
 }
 
 // src/auto.ts
-var import_node_fs4 = require("node:fs");
-var import_node_path5 = __toESM(require("node:path"), 1);
+var import_node_fs5 = require("node:fs");
+var import_node_path6 = __toESM(require("node:path"), 1);
 
 // ../../packages/shared-types/dist/entitlements.js
 var UNLIMITED_ACTIVE_USERS = Number.MAX_SAFE_INTEGER;
@@ -10764,12 +10764,19 @@ var Priority;
 })(Priority || (Priority = {}));
 
 // src/config.ts
-var import_node_fs = require("node:fs");
-var import_node_path = __toESM(require("node:path"), 1);
+var import_node_fs2 = require("node:fs");
+var import_node_path2 = __toESM(require("node:path"), 1);
 
 // src/secureStore.ts
 var import_node_child_process = require("node:child_process");
+var import_node_crypto = require("node:crypto");
+var import_node_fs = require("node:fs");
+var import_node_path = __toESM(require("node:path"), 1);
 var KEYCHAIN_SERVICE = "automatify-testops-cli";
+var LINUX_SECURE_STORE_ENV = "TESTOPS_LINUX_SECURE_STORE";
+var LINUX_PROTECTED_PREFIX = "linux-aes-gcm-v1";
+var LINUX_JIRA_ACCOUNT_SUFFIX = ":jiraApiToken";
+var LINUX_KEY_FILENAME = ".testops-cli.key";
 function errorText(error) {
   return error instanceof Error && error.message ? error.message : "unknown secure-storage error";
 }
@@ -10809,11 +10816,85 @@ function macOSKeychainWriteInput(account, value) {
     quoteSecurityInteractiveArg(value)
   ].join(" ") + "\n";
 }
+function linuxSecureStoreEnabled() {
+  return process.env[LINUX_SECURE_STORE_ENV]?.trim() === "1";
+}
+function isLinuxProtectedValue(value) {
+  return Boolean(value?.startsWith(`${LINUX_PROTECTED_PREFIX}.`));
+}
+function linuxConfigPathForAccount(account) {
+  const normalized = account.endsWith(LINUX_JIRA_ACCOUNT_SUFFIX) ? account.slice(0, -LINUX_JIRA_ACCOUNT_SUFFIX.length) : account;
+  return import_node_path.default.resolve(normalized);
+}
+function linuxKeyPathForAccount(account) {
+  return import_node_path.default.join(import_node_path.default.dirname(linuxConfigPathForAccount(account)), LINUX_KEY_FILENAME);
+}
+function readLinuxKey(keyPath) {
+  const key = (0, import_node_fs.readFileSync)(keyPath);
+  if (key.length !== 32) {
+    throw new Error(`Linux secure-store key at ${keyPath} must be exactly 32 bytes.`);
+  }
+  return key;
+}
+function readOrCreateLinuxKey(keyPath) {
+  const directory = import_node_path.default.dirname(keyPath);
+  (0, import_node_fs.mkdirSync)(directory, { recursive: true, mode: 448 });
+  (0, import_node_fs.chmodSync)(directory, 448);
+  if ((0, import_node_fs.existsSync)(keyPath)) {
+    (0, import_node_fs.chmodSync)(keyPath, 384);
+    return readLinuxKey(keyPath);
+  }
+  const key = (0, import_node_crypto.randomBytes)(32);
+  try {
+    (0, import_node_fs.writeFileSync)(keyPath, key, { flag: "wx", mode: 384 });
+  } catch (error) {
+    if (error.code !== "EEXIST") {
+      throw error;
+    }
+  }
+  (0, import_node_fs.chmodSync)(keyPath, 384);
+  return readLinuxKey(keyPath);
+}
+function protectLinuxSecret(account, value) {
+  const keyPath = linuxKeyPathForAccount(account);
+  const key = readOrCreateLinuxKey(keyPath);
+  const iv = (0, import_node_crypto.randomBytes)(12);
+  const cipher = (0, import_node_crypto.createCipheriv)("aes-256-gcm", key, iv);
+  const ciphertext = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  const encodedKeyPath = Buffer.from(keyPath, "utf8").toString("base64url");
+  return [
+    LINUX_PROTECTED_PREFIX,
+    encodedKeyPath,
+    iv.toString("base64url"),
+    tag.toString("base64url"),
+    ciphertext.toString("base64url")
+  ].join(".");
+}
+function unprotectLinuxSecret(protectedValue) {
+  const parts = protectedValue.split(".");
+  if (parts.length !== 5 || parts[0] !== LINUX_PROTECTED_PREFIX) {
+    throw new Error("Unsupported Linux secure-store payload.");
+  }
+  const [, encodedKeyPath, encodedIv, encodedTag, encodedCiphertext] = parts;
+  const keyPath = Buffer.from(encodedKeyPath, "base64url").toString("utf8");
+  const key = readLinuxKey(keyPath);
+  const decipher = (0, import_node_crypto.createDecipheriv)("aes-256-gcm", key, Buffer.from(encodedIv, "base64url"));
+  decipher.setAuthTag(Buffer.from(encodedTag, "base64url"));
+  const plaintext = Buffer.concat([decipher.update(Buffer.from(encodedCiphertext, "base64url")), decipher.final()]);
+  return plaintext.toString("utf8");
+}
 function readSecureSecret(locator, deps = {}) {
   const platform = deps.platform ?? process.platform;
   const run = deps.execFileSync ?? import_node_child_process.execFileSync;
   if (platform === "darwin") {
     if (!locator.account) {
+      if (isLinuxProtectedValue(locator.protectedValue)) {
+        return {
+          status: "error",
+          message: "This config contains a Linux encrypted local-store value, but it is being read on macOS. Re-store the secret on this machine."
+        };
+      }
       return locator.protectedValue ? {
         status: "error",
         message: "This config contains a Windows DPAPI value, but it is being read on macOS. Re-store the secret on this machine."
@@ -10836,6 +10917,12 @@ function readSecureSecret(locator, deps = {}) {
     }
   }
   if (platform === "win32") {
+    if (isLinuxProtectedValue(locator.protectedValue)) {
+      return {
+        status: "error",
+        message: "This config contains a Linux encrypted local-store value, but it is being read on Windows. Re-store the secret for the current Windows user."
+      };
+    }
     if (!locator.protectedValue) {
       return locator.account ? {
         status: "error",
@@ -10855,14 +10942,40 @@ function readSecureSecret(locator, deps = {}) {
     } catch (error) {
       return {
         status: "error",
-        message: `Unable to decrypt the Windows DPAPI value for the current user: ${errorText(error)}. Re-store the secret.`
+        message: `Unable to decrypt the Windows DPAPI value for the current user: ${errorText(error)}. Re-store the secret for the current Windows user.`
+      };
+    }
+  }
+  if (platform === "linux" && linuxSecureStoreEnabled()) {
+    if (locator.account && !locator.protectedValue) {
+      return {
+        status: "error",
+        message: "This config references a macOS Keychain secret, but it is being read on Linux. Re-store the secret on this machine."
+      };
+    }
+    if (!locator.protectedValue) {
+      return { status: "missing" };
+    }
+    if (!isLinuxProtectedValue(locator.protectedValue)) {
+      return {
+        status: "error",
+        message: "This config contains a foreign protected value that cannot be decrypted by the Linux local store. Re-store the secret on this machine."
+      };
+    }
+    try {
+      const value = unprotectLinuxSecret(locator.protectedValue);
+      return value ? { status: "available", value, source: "secure-store" } : { status: "error", message: "Linux encrypted local store returned an empty value. Re-store the secret." };
+    } catch (error) {
+      return {
+        status: "error",
+        message: `Unable to decrypt the Linux encrypted local-store value: ${errorText(error)} Re-store the secret.`
       };
     }
   }
   if (locator.account || locator.protectedValue) {
     return {
       status: "error",
-      message: "This config contains local secure-store metadata, but local secure storage is supported only on macOS and Windows. Use an environment variable on Linux/CI."
+      message: "This config contains local secure-store metadata, but local secure storage is disabled on Linux/CI. Use environment variables or explicitly enable TESTOPS_LINUX_SECURE_STORE=1 on a trusted persistent Linux host."
     };
   }
   return { status: "missing" };
@@ -10898,8 +11011,15 @@ function writeSecureSecret(account, value, deps = {}) {
     }
     return { source: "secure-store", protectedValue };
   }
+  if (platform === "linux" && linuxSecureStoreEnabled()) {
+    try {
+      return { source: "secure-store", protectedValue: protectLinuxSecret(account, value) };
+    } catch {
+      throw new Error("Unable to store the secret in the Linux encrypted local store.");
+    }
+  }
   throw new Error(
-    "Secure local secret storage is supported on macOS and Windows only. On Linux/CI, keep secrets in environment variables."
+    "Secure local secret storage is supported on macOS and Windows. On trusted persistent Linux hosts, set TESTOPS_LINUX_SECURE_STORE=1; otherwise keep secrets in environment variables."
   );
 }
 function deleteSecureSecret(locator, deps = {}) {
@@ -10924,6 +11044,9 @@ function deleteSecureSecret(locator, deps = {}) {
   if (platform === "win32") {
     return locator.protectedValue ? { status: "deleted" } : { status: "missing" };
   }
+  if (platform === "linux") {
+    return locator.account || locator.protectedValue ? { status: "deleted" } : { status: "missing" };
+  }
   return locator.account || locator.protectedValue ? { status: "deleted" } : { status: "missing" };
 }
 
@@ -10972,11 +11095,11 @@ function firstStringValue(...values) {
   return "";
 }
 function readConfigFile(configPath) {
-  if (!(0, import_node_fs.existsSync)(configPath)) {
+  if (!(0, import_node_fs2.existsSync)(configPath)) {
     return {};
   }
   try {
-    const raw = (0, import_node_fs.readFileSync)(configPath, "utf8");
+    const raw = (0, import_node_fs2.readFileSync)(configPath, "utf8");
     const parsed = JSON.parse(raw);
     return typeof parsed === "object" && parsed !== null ? parsed : {};
   } catch {
@@ -10984,11 +11107,11 @@ function readConfigFile(configPath) {
   }
 }
 function readConfigFileForMutation(configPath) {
-  if (!(0, import_node_fs.existsSync)(configPath)) {
+  if (!(0, import_node_fs2.existsSync)(configPath)) {
     return { file: {} };
   }
   try {
-    const raw = (0, import_node_fs.readFileSync)(configPath, "utf8");
+    const raw = (0, import_node_fs2.readFileSync)(configPath, "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
       return {
@@ -11005,10 +11128,10 @@ function readConfigFileForMutation(configPath) {
   }
 }
 function writeConfigFile(configPath, file) {
-  (0, import_node_fs.writeFileSync)(configPath, `${JSON.stringify(file, null, 2)}
+  (0, import_node_fs2.writeFileSync)(configPath, `${JSON.stringify(file, null, 2)}
 `, "utf8");
   if (process.platform !== "win32") {
-    (0, import_node_fs.chmodSync)(configPath, 384);
+    (0, import_node_fs2.chmodSync)(configPath, 384);
   }
 }
 function normalizeBaseUrl(value) {
@@ -11021,10 +11144,10 @@ function readAuthMode(input) {
   return input === "api-token" ? "api-token" : "none";
 }
 function defaultKeychainAccount(configPath) {
-  return import_node_path.default.resolve(configPath);
+  return import_node_path2.default.resolve(configPath);
 }
 function defaultJiraApiTokenKeychainAccount(configPath) {
-  return `${import_node_path.default.resolve(configPath)}:jiraApiToken`;
+  return `${import_node_path2.default.resolve(configPath)}:jiraApiToken`;
 }
 function valueFromPrecedence(key, flagValue, envValue, fileValue, fallback = "") {
   if (flagValue) {
@@ -11101,9 +11224,9 @@ function clearSecretFields(file, key) {
 }
 function resolveCliConfig(args, env = process.env, cwd = process.cwd()) {
   const { flags, unknownFlags } = parseFlags(args);
-  const configPathFlag = flags["--config"] ? import_node_path.default.resolve(cwd, flags["--config"]) : "";
+  const configPathFlag = flags["--config"] ? import_node_path2.default.resolve(cwd, flags["--config"]) : "";
   const configPathEnv = toStringValue(env.TESTOPS_CONFIG_PATH);
-  const configPath = configPathFlag || (configPathEnv ? import_node_path.default.resolve(cwd, configPathEnv) : import_node_path.default.resolve(cwd, DEFAULT_CONFIG_FILENAME));
+  const configPath = configPathFlag || (configPathEnv ? import_node_path2.default.resolve(cwd, configPathEnv) : import_node_path2.default.resolve(cwd, DEFAULT_CONFIG_FILENAME));
   const configPathSource = configPathFlag ? "flag" : configPathEnv ? "env" : "default";
   const file = readConfigFile(configPath);
   const baseUrlResolved = valueFromPrecedence(
@@ -11194,7 +11317,7 @@ function resolveCliConfig(args, env = process.env, cwd = process.cwd()) {
   if (unknownFlags.length > 0) {
     warnings.push(`Ignored unknown config flags: ${unknownFlags.join(", ")}`);
   }
-  if (!(0, import_node_fs.existsSync)(configPath) && sources.configPath !== "default") {
+  if (!(0, import_node_fs2.existsSync)(configPath) && sources.configPath !== "default") {
     warnings.push(`Config file not found at ${configPath}; using env/flags/defaults.`);
   }
   return { values: config, sources, warnings, errors };
@@ -11458,7 +11581,7 @@ function createConfigHandler(env = process.env, cwd = process.cwd()) {
       const [key, ...valueParts] = stripConfigPathArgs(subArgs);
       const normalizedKey = normalizeConfigSetKey(key ?? "");
       const readValueFromStdin = (normalizedKey === "forgeAuthToken" || normalizedKey === "jiraApiToken") && valueParts.length === 1 && valueParts[0] === "--stdin";
-      const value = readValueFromStdin ? (0, import_node_fs.readFileSync)(0, "utf8").trim() : valueParts.join(" ").trim();
+      const value = readValueFromStdin ? (0, import_node_fs2.readFileSync)(0, "utf8").trim() : valueParts.join(" ").trim();
       if (!key || !value) {
         return {
           exitCode: ExitCode.UsageError,
@@ -11773,7 +11896,7 @@ function diagExecutionNoWork() {
 }
 
 // src/autoDiscover.ts
-var import_node_path2 = __toESM(require("node:path"), 1);
+var import_node_path3 = __toESM(require("node:path"), 1);
 var RESULT_FOLDER_NAMES = /* @__PURE__ */ new Set([
   "results",
   "result",
@@ -11785,7 +11908,7 @@ var RESULT_FOLDER_NAMES = /* @__PURE__ */ new Set([
   "failsafe-reports"
 ]);
 function toPosix2(value) {
-  return value.split(import_node_path2.default.sep).join("/");
+  return value.split(import_node_path3.default.sep).join("/");
 }
 function isJUnitXmlArtifact(filePath) {
   const normalized = toPosix2(filePath);
@@ -11879,8 +12002,8 @@ function discoverFeatureFiles(scannedFiles) {
 }
 
 // src/autoMapping.ts
-var import_node_fs2 = require("node:fs");
-var import_node_path3 = __toESM(require("node:path"), 1);
+var import_node_fs3 = require("node:fs");
+var import_node_path4 = __toESM(require("node:path"), 1);
 var ISSUE_KEY_REGEX = /\b[A-Z][A-Z0-9]+-\d+\b/g;
 function normalizeName(value) {
   return value.trim().toLowerCase();
@@ -11890,10 +12013,10 @@ function extractIssueKeysFromText(text) {
   return [...new Set(found)].sort((a, b) => a.localeCompare(b));
 }
 function parseFeatureFile(featureAbsolutePath) {
-  if (!(0, import_node_fs2.existsSync)(featureAbsolutePath)) {
+  if (!(0, import_node_fs3.existsSync)(featureAbsolutePath)) {
     return { names: [], issueKeys: [] };
   }
-  const raw = (0, import_node_fs2.readFileSync)(featureAbsolutePath, "utf8");
+  const raw = (0, import_node_fs3.readFileSync)(featureAbsolutePath, "utf8");
   const lines = raw.split(/\r?\n/);
   const names = /* @__PURE__ */ new Set();
   const issueKeys = new Set(extractIssueKeysFromText(raw));
@@ -11951,7 +12074,7 @@ function buildMappingPreview(input) {
   const localNamesSet = /* @__PURE__ */ new Set();
   const issueCandidatesSet = /* @__PURE__ */ new Set();
   for (const featurePath of input.featurePaths) {
-    const absolutePath = import_node_path3.default.join(input.rootPath, featurePath);
+    const absolutePath = import_node_path4.default.join(input.rootPath, featurePath);
     const parsed = parseFeatureFile(absolutePath);
     for (const name of parsed.names) {
       localNamesSet.add(name);
@@ -12000,8 +12123,8 @@ function buildMappingPreview(input) {
 }
 
 // src/autoScanner.ts
-var import_node_fs3 = require("node:fs");
-var import_node_path4 = __toESM(require("node:path"), 1);
+var import_node_fs4 = require("node:fs");
+var import_node_path5 = __toESM(require("node:path"), 1);
 var DEFAULT_MAX_DEPTH = 5;
 var DEFAULT_EXCLUDED_DIRECTORIES = /* @__PURE__ */ new Set([
   ".cache",
@@ -12016,7 +12139,7 @@ var DEFAULT_EXCLUDED_DIRECTORIES = /* @__PURE__ */ new Set([
   "node_modules"
 ]);
 function normalizeRelativePath(value) {
-  return value.split(import_node_path4.default.sep).join("/");
+  return value.split(import_node_path5.default.sep).join("/");
 }
 function normalizePatterns(values) {
   if (!values) {
@@ -12070,16 +12193,16 @@ function scanProjectFiles(options) {
   const includePatterns = normalizePatterns(options.includePatterns);
   const excludePatterns = normalizePatterns(options.excludePatterns);
   const maxDepth = safeMaxDepth(options.maxDepth);
-  const rootPath = import_node_path4.default.resolve(options.rootPath);
+  const rootPath = import_node_path5.default.resolve(options.rootPath);
   const scannedFiles = [];
   const visit = (absoluteDirectory, depth) => {
     if (depth > maxDepth) {
       return;
     }
-    const entries = (0, import_node_fs3.readdirSync)(absoluteDirectory, { withFileTypes: true }).slice().sort((a, b) => a.name.localeCompare(b.name));
+    const entries = (0, import_node_fs4.readdirSync)(absoluteDirectory, { withFileTypes: true }).slice().sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
-      const absoluteEntryPath = import_node_path4.default.join(absoluteDirectory, entry.name);
-      const relativeEntryPath = normalizeRelativePath(import_node_path4.default.relative(rootPath, absoluteEntryPath));
+      const absoluteEntryPath = import_node_path5.default.join(absoluteDirectory, entry.name);
+      const relativeEntryPath = normalizeRelativePath(import_node_path5.default.relative(rootPath, absoluteEntryPath));
       if (!relativeEntryPath) {
         continue;
       }
@@ -12181,10 +12304,10 @@ function resolveRoot(rootFlag, cwd) {
   if (!rootFlag.trim()) {
     return cwd;
   }
-  return import_node_path5.default.resolve(cwd, rootFlag);
+  return import_node_path6.default.resolve(cwd, rootFlag);
 }
 function countScenariosInFeatureFile(featurePath) {
-  const lines = (0, import_node_fs4.readFileSync)(featurePath, "utf8").split(/\r?\n/).map((line) => line.trim().toLowerCase());
+  const lines = (0, import_node_fs5.readFileSync)(featurePath, "utf8").split(/\r?\n/).map((line) => line.trim().toLowerCase());
   let count = 0;
   for (const line of lines) {
     if (line.startsWith("scenario:") || line.startsWith("scenario outline:")) {
@@ -12196,8 +12319,8 @@ function countScenariosInFeatureFile(featurePath) {
 function buildScenarioStats(rootPath, featurePaths) {
   let scenarios = 0;
   for (const relativePath of featurePaths) {
-    const absolutePath = import_node_path5.default.join(rootPath, relativePath);
-    if (!(0, import_node_fs4.existsSync)(absolutePath)) {
+    const absolutePath = import_node_path6.default.join(rootPath, relativePath);
+    if (!(0, import_node_fs5.existsSync)(absolutePath)) {
       continue;
     }
     scenarios += countScenariosInFeatureFile(absolutePath);
@@ -12237,7 +12360,7 @@ function deriveFeatureNameFromGherkin(gherkin, fallbackPath) {
       return match[1].trim();
     }
   }
-  return import_node_path5.default.basename(fallbackPath, import_node_path5.default.extname(fallbackPath));
+  return import_node_path6.default.basename(fallbackPath, import_node_path6.default.extname(fallbackPath));
 }
 function mapStepStatus(status) {
   const normalized = status.trim().toLowerCase();
@@ -12253,13 +12376,13 @@ function mapStepStatus(status) {
   return StepResult.Blocked;
 }
 function parseCucumberRunsFromArtifact(rootPath, artifactPath) {
-  const absolutePath = import_node_path5.default.join(rootPath, artifactPath);
-  if (!(0, import_node_fs4.existsSync)(absolutePath)) {
+  const absolutePath = import_node_path6.default.join(rootPath, artifactPath);
+  if (!(0, import_node_fs5.existsSync)(absolutePath)) {
     return [];
   }
   let parsed;
   try {
-    parsed = JSON.parse((0, import_node_fs4.readFileSync)(absolutePath, "utf8"));
+    parsed = JSON.parse((0, import_node_fs5.readFileSync)(absolutePath, "utf8"));
   } catch {
     return [];
   }
@@ -12354,15 +12477,15 @@ async function executeUploadFlow(input) {
   const diagnostics = [];
   const orderedFeatures = [...input.featurePaths].sort((a, b) => a.localeCompare(b));
   for (const featurePath of orderedFeatures) {
-    const absolutePath = import_node_path5.default.join(input.rootPath, featurePath);
-    if (!(0, import_node_fs4.existsSync)(absolutePath)) {
+    const absolutePath = import_node_path6.default.join(input.rootPath, featurePath);
+    if (!(0, import_node_fs5.existsSync)(absolutePath)) {
       featureFailed += 1;
       const diagnostic = diagUploadFeatureFailure(featurePath, "missing feature file");
       errors.push(diagnostic.message);
       diagnostics.push(diagnostic);
       continue;
     }
-    const gherkin = (0, import_node_fs4.readFileSync)(absolutePath, "utf8");
+    const gherkin = (0, import_node_fs5.readFileSync)(absolutePath, "utf8");
     const name = deriveFeatureNameFromGherkin(gherkin, featurePath);
     const payload = {
       context: {
@@ -12701,7 +12824,7 @@ function createAutoHandler(deps = {}) {
         stderr: ["ERROR: --output must be either 'plain' or 'json'."]
       };
     }
-    if (!(0, import_node_fs4.existsSync)(rootPath)) {
+    if (!(0, import_node_fs5.existsSync)(rootPath)) {
       return {
         exitCode: ExitCode.ValidationError,
         stderr: [`ERROR: Root path does not exist: ${rootPath}`]
@@ -12804,8 +12927,8 @@ function createAutoHandler(deps = {}) {
 }
 
 // src/allure.ts
-var import_node_path10 = __toESM(require("node:path"), 1);
-var import_node_fs9 = require("node:fs");
+var import_node_path11 = __toESM(require("node:path"), 1);
+var import_node_fs10 = require("node:fs");
 
 // ../../packages/jira-client/dist/adf.js
 function paragraph(text = "") {
@@ -12851,8 +12974,8 @@ function buildAllureEvidenceCommentAdf(input) {
 }
 
 // ../../packages/jira-client/dist/jiraClient.js
-var import_node_fs5 = require("node:fs");
-var import_node_path6 = __toESM(require("node:path"), 1);
+var import_node_fs6 = require("node:fs");
+var import_node_path7 = __toESM(require("node:path"), 1);
 function normalizeSite(site) {
   return site.trim().replace(/\/+$/, "");
 }
@@ -12865,10 +12988,10 @@ async function readError(response) {
 }
 async function uploadIssueAttachment(params) {
   const site = normalizeSite(params.site);
-  const filename = import_node_path6.default.basename(params.filePath);
-  const fileStat = (0, import_node_fs5.statSync)(params.filePath);
+  const filename = import_node_path7.default.basename(params.filePath);
+  const fileStat = (0, import_node_fs6.statSync)(params.filePath);
   const body = new FormData();
-  const fileBuffer = (0, import_node_fs5.readFileSync)(params.filePath);
+  const fileBuffer = (0, import_node_fs6.readFileSync)(params.filePath);
   body.append("file", new Blob([new Uint8Array(fileBuffer)], { type: "application/zip" }), filename);
   const response = await fetch(`${site}/rest/api/3/issue/${encodeURIComponent(params.issueKey)}/attachments`, {
     method: "POST",
@@ -12937,7 +13060,7 @@ async function downloadIssueAttachment(params) {
     throw new Error(`Jira attachment download failed: ${await readError(response)}`);
   }
   const bytes = new Uint8Array(await response.arrayBuffer());
-  (0, import_node_fs5.writeFileSync)(params.outputPath, bytes);
+  (0, import_node_fs6.writeFileSync)(params.outputPath, bytes);
   return {
     filename: params.attachment.filename,
     id: params.attachment.id,
@@ -12977,8 +13100,8 @@ async function addIssueComment(params) {
 }
 
 // ../../packages/allure-core/dist/parseAllureZip.js
-var import_node_fs6 = require("node:fs");
-var import_node_path7 = __toESM(require("node:path"), 1);
+var import_node_fs7 = require("node:fs");
+var import_node_path8 = __toESM(require("node:path"), 1);
 var import_jszip = __toESM(require_lib3(), 1);
 var SUMMARY_PATH_SUFFIX = "/widgets/summary.json";
 var MISSING_SUMMARY_ERROR = "Could not find widgets/summary.json. Please upload a generated Allure HTML report ZIP, not raw allure-results.";
@@ -13006,13 +13129,13 @@ function parseCounts(summary) {
   };
 }
 async function parseAllureReportZip(zipPath) {
-  if (!(0, import_node_fs6.existsSync)(zipPath)) {
+  if (!(0, import_node_fs7.existsSync)(zipPath)) {
     throw new Error(`Allure report ZIP not found: ${zipPath}`);
   }
-  if (import_node_path7.default.extname(zipPath).toLowerCase() !== ".zip") {
+  if (import_node_path8.default.extname(zipPath).toLowerCase() !== ".zip") {
     throw new Error("Allure report must be a .zip file.");
   }
-  const zip = await import_jszip.default.loadAsync((0, import_node_fs6.readFileSync)(zipPath));
+  const zip = await import_jszip.default.loadAsync((0, import_node_fs7.readFileSync)(zipPath));
   const filePaths = Object.keys(zip.files).filter((entryPath) => !zip.files[entryPath]?.dir);
   const summaryPath = findSummaryPath(filePaths);
   if (!summaryPath) {
@@ -13039,8 +13162,8 @@ async function parseAllureReportZip(zipPath) {
 }
 
 // ../../packages/allure-core/dist/extractAllureZip.js
-var import_node_fs7 = require("node:fs");
-var import_node_path8 = __toESM(require("node:path"), 1);
+var import_node_fs8 = require("node:fs");
+var import_node_path9 = __toESM(require("node:path"), 1);
 var import_jszip2 = __toESM(require_lib3(), 1);
 var INDEX_HTML = "index.html";
 var MISSING_INDEX_ERROR = "Could not find index.html. Please provide a generated Allure HTML report ZIP, not raw allure-results.";
@@ -13048,41 +13171,41 @@ function findIndexEntry(paths) {
   return paths.find((entryPath) => entryPath === INDEX_HTML) ?? paths.find((entryPath) => entryPath === `allure-report/${INDEX_HTML}`) ?? paths.find((entryPath) => entryPath.endsWith(`/${INDEX_HTML}`));
 }
 function ensureInsideRoot(rootDir, candidate) {
-  const resolved = import_node_path8.default.resolve(rootDir, candidate);
-  const rootWithSep = rootDir.endsWith(import_node_path8.default.sep) ? rootDir : rootDir + import_node_path8.default.sep;
+  const resolved = import_node_path9.default.resolve(rootDir, candidate);
+  const rootWithSep = rootDir.endsWith(import_node_path9.default.sep) ? rootDir : rootDir + import_node_path9.default.sep;
   if (resolved !== rootDir && !resolved.startsWith(rootWithSep)) {
     throw new Error(`Refusing to write zip entry outside extract directory: ${candidate}`);
   }
   return resolved;
 }
 async function extractAllureReportZip(zipPath, extractDir) {
-  if (!(0, import_node_fs7.existsSync)(zipPath)) {
+  if (!(0, import_node_fs8.existsSync)(zipPath)) {
     throw new Error(`Allure report ZIP not found: ${zipPath}`);
   }
-  if (import_node_path8.default.extname(zipPath).toLowerCase() !== ".zip") {
+  if (import_node_path9.default.extname(zipPath).toLowerCase() !== ".zip") {
     throw new Error("Allure report must be a .zip file.");
   }
-  const zip = await import_jszip2.default.loadAsync((0, import_node_fs7.readFileSync)(zipPath));
+  const zip = await import_jszip2.default.loadAsync((0, import_node_fs8.readFileSync)(zipPath));
   const entries = Object.entries(zip.files);
   const filePaths = entries.filter(([, file]) => !file.dir).map(([entryPath]) => entryPath);
   const indexEntry = findIndexEntry(filePaths);
   if (!indexEntry) {
     throw new Error(MISSING_INDEX_ERROR);
   }
-  const resolvedExtract = import_node_path8.default.resolve(extractDir);
-  (0, import_node_fs7.mkdirSync)(resolvedExtract, { recursive: true });
+  const resolvedExtract = import_node_path9.default.resolve(extractDir);
+  (0, import_node_fs8.mkdirSync)(resolvedExtract, { recursive: true });
   for (const [entryPath, file] of entries) {
     const target = ensureInsideRoot(resolvedExtract, entryPath);
     if (file.dir) {
-      (0, import_node_fs7.mkdirSync)(target, { recursive: true });
+      (0, import_node_fs8.mkdirSync)(target, { recursive: true });
       continue;
     }
-    (0, import_node_fs7.mkdirSync)(import_node_path8.default.dirname(target), { recursive: true });
+    (0, import_node_fs8.mkdirSync)(import_node_path9.default.dirname(target), { recursive: true });
     const buffer = await file.async("nodebuffer");
-    (0, import_node_fs7.writeFileSync)(target, buffer);
+    (0, import_node_fs8.writeFileSync)(target, buffer);
   }
-  const indexAbsolute = import_node_path8.default.join(resolvedExtract, indexEntry);
-  const rootDir = import_node_path8.default.dirname(indexAbsolute);
+  const indexAbsolute = import_node_path9.default.join(resolvedExtract, indexEntry);
+  const rootDir = import_node_path9.default.dirname(indexAbsolute);
   return {
     zipPath,
     extractDir: resolvedExtract,
@@ -13095,11 +13218,11 @@ async function extractAllureReportZip(zipPath, extractDir) {
 var import_jszip3 = __toESM(require_lib3(), 1);
 
 // src/allureOpen.ts
-var import_node_fs8 = require("node:fs");
+var import_node_fs9 = require("node:fs");
 var import_promises = require("node:fs/promises");
 var import_node_http = __toESM(require("node:http"), 1);
 var import_node_os = require("node:os");
-var import_node_path9 = __toESM(require("node:path"), 1);
+var import_node_path10 = __toESM(require("node:path"), 1);
 var import_node_child_process2 = require("node:child_process");
 function parseArgs2(args) {
   const positionals = [];
@@ -13168,7 +13291,7 @@ var MIME_TYPES = {
   ".txt": "text/plain; charset=utf-8"
 };
 function contentTypeFor(filePath) {
-  return MIME_TYPES[import_node_path9.default.extname(filePath).toLowerCase()] ?? "application/octet-stream";
+  return MIME_TYPES[import_node_path10.default.extname(filePath).toLowerCase()] ?? "application/octet-stream";
 }
 function resolveRequestedPath(rootDir, urlPath) {
   let decoded;
@@ -13177,10 +13300,10 @@ function resolveRequestedPath(rootDir, urlPath) {
   } catch {
     return void 0;
   }
-  const normalized = import_node_path9.default.normalize(decoded);
+  const normalized = import_node_path10.default.normalize(decoded);
   const trimmed = normalized.replace(/^[/\\]+/, "");
-  const candidate = import_node_path9.default.resolve(rootDir, trimmed);
-  const rootWithSep = rootDir.endsWith(import_node_path9.default.sep) ? rootDir : rootDir + import_node_path9.default.sep;
+  const candidate = import_node_path10.default.resolve(rootDir, trimmed);
+  const rootWithSep = rootDir.endsWith(import_node_path10.default.sep) ? rootDir : rootDir + import_node_path10.default.sep;
   if (candidate !== rootDir && !candidate.startsWith(rootWithSep)) {
     return void 0;
   }
@@ -13202,16 +13325,16 @@ function createStaticServerStarter() {
       }
       let target = resolved;
       try {
-        const stat = (0, import_node_fs8.statSync)(target);
+        const stat = (0, import_node_fs9.statSync)(target);
         if (stat.isDirectory()) {
-          target = import_node_path9.default.join(target, "index.html");
+          target = import_node_path10.default.join(target, "index.html");
         }
       } catch {
         res.statusCode = 404;
         res.end("Not Found");
         return;
       }
-      if (!(0, import_node_fs8.existsSync)(target)) {
+      if (!(0, import_node_fs9.existsSync)(target)) {
         res.statusCode = 404;
         res.end("Not Found");
         return;
@@ -13222,7 +13345,7 @@ function createStaticServerStarter() {
         res.end();
         return;
       }
-      const stream = (0, import_node_fs8.createReadStream)(target);
+      const stream = (0, import_node_fs9.createReadStream)(target);
       stream.on("error", () => {
         res.statusCode = 500;
         res.end("Internal Server Error");
@@ -13327,7 +13450,7 @@ function createAllureOpenHandler(deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const parseZip = deps.parseAllureReportZip ?? parseAllureReportZip;
   const extractZip = deps.extractAllureReportZip ?? extractAllureReportZip;
-  const createTempDir = deps.createTempDir ?? (() => (0, import_promises.mkdtemp)(import_node_path9.default.join((0, import_node_os.tmpdir)(), "automatify-allure-open-")));
+  const createTempDir = deps.createTempDir ?? (() => (0, import_promises.mkdtemp)(import_node_path10.default.join((0, import_node_os.tmpdir)(), "automatify-allure-open-")));
   const startServer = deps.startServer ?? createStaticServerStarter();
   const openInBrowser = deps.openInBrowser ?? createOsBrowserOpener();
   const waitForShutdown = deps.waitForShutdown ?? waitForProcessSignals;
@@ -13362,7 +13485,7 @@ function createAllureOpenHandler(deps = {}) {
       };
     }
     const host = parsed.flags["--host"] ?? "127.0.0.1";
-    const zipPath = import_node_path9.default.resolve(cwd, zipPathInput);
+    const zipPath = import_node_path10.default.resolve(cwd, zipPathInput);
     let summary;
     try {
       summary = await parseZip(zipPath);
@@ -13372,9 +13495,9 @@ function createAllureOpenHandler(deps = {}) {
         stderr: [`ERROR: ${normalizeError(error)}`]
       };
     }
-    const extractDirRaw = userExtractDir ? import_node_path9.default.resolve(cwd, userExtractDir) : await createTempDir();
+    const extractDirRaw = userExtractDir ? import_node_path10.default.resolve(cwd, userExtractDir) : await createTempDir();
     if (dryRun) {
-      const indexPath = import_node_path9.default.join(extractDirRaw, "index.html");
+      const indexPath = import_node_path10.default.join(extractDirRaw, "index.html");
       if (useJson) {
         return {
           exitCode: ExitCode.Success,
@@ -13739,8 +13862,8 @@ function createAllureHandler(deps = {}) {
           attachmentId: parsed.flags["--attachment-id"],
           filename: parsed.flags["--filename"]
         });
-        const outputDir = import_node_path10.default.resolve(cwd, parsed.flags["--output-dir"] ?? ".");
-        const outputPath = import_node_path10.default.join(outputDir, selected.filename);
+        const outputDir = import_node_path11.default.resolve(cwd, parsed.flags["--output-dir"] ?? ".");
+        const outputPath = import_node_path11.default.join(outputDir, selected.filename);
         if (dryRun) {
           if (useJson) {
             return {
@@ -13765,8 +13888,8 @@ function createAllureHandler(deps = {}) {
             ]
           };
         }
-        (0, import_node_fs9.mkdirSync)(outputDir, { recursive: true });
-        if ((0, import_node_fs9.existsSync)(outputPath) && !force) {
+        (0, import_node_fs10.mkdirSync)(outputDir, { recursive: true });
+        if ((0, import_node_fs10.existsSync)(outputPath) && !force) {
           return {
             exitCode: ExitCode.ValidationError,
             stderr: [`ERROR: Output file already exists: ${outputPath}. Pass --force to overwrite.`]
@@ -13815,8 +13938,8 @@ function createAllureHandler(deps = {}) {
       };
     }
     const resolved = resolveJiraConfig(parsed, env, cwd);
-    const zipPath = import_node_path10.default.resolve(cwd, zipPathInput);
-    const attachmentFilename = import_node_path10.default.basename(zipPath);
+    const zipPath = import_node_path11.default.resolve(cwd, zipPathInput);
+    const attachmentFilename = import_node_path11.default.basename(zipPath);
     if (!resolved.config) {
       return {
         exitCode: ExitCode.ValidationError,
@@ -13914,7 +14037,7 @@ function createAllureHandler(deps = {}) {
 }
 
 // src/auth.ts
-var import_node_fs10 = require("node:fs");
+var import_node_fs11 = require("node:fs");
 function parseAuthArgs(args, allowLoginFlags) {
   const configArgs = [];
   const unknown = [];
@@ -13980,7 +14103,7 @@ function sourceLabel(source) {
     case "keychain":
       return "macOS Keychain";
     case "secure-store":
-      return "Windows DPAPI";
+      return "local secure store";
     case "env":
       return "environment";
     case "file":
@@ -14059,12 +14182,13 @@ function createLoginResponse(args, env, cwd, readStdin, platform, context) {
       ]
     };
   }
-  if (parsed.tokenStdin && platform !== "darwin" && platform !== "win32") {
+  const linuxSecureStoreEnabled2 = platform === "linux" && env.TESTOPS_LINUX_SECURE_STORE?.trim() === "1";
+  if (parsed.tokenStdin && platform !== "darwin" && platform !== "win32" && !linuxSecureStoreEnabled2) {
     return {
       exitCode: ExitCode.UsageError,
       stderr: [
-        "Local secure secret storage is supported only on macOS and Windows.",
-        "On Linux/CI, set JIRA_API_TOKEN in the environment and run auth login without --token-stdin."
+        "Local secure secret storage is enabled by default only on macOS and Windows.",
+        "On Linux/CI, either set TESTOPS_LINUX_SECURE_STORE=1 on a trusted persistent host or keep JIRA_API_TOKEN in the environment and run auth login without --token-stdin."
       ]
     };
   }
@@ -14091,7 +14215,7 @@ function createLoginResponse(args, env, cwd, readStdin, platform, context) {
     }
     completed.push(step.label);
   }
-  const tokenSource = stdinToken ? platform === "darwin" ? "macOS Keychain" : "Windows DPAPI" : sourceLabel(
+  const tokenSource = stdinToken ? platform === "darwin" ? "macOS Keychain" : platform === "win32" ? "Windows DPAPI" : "Linux encrypted local store" : sourceLabel(
     current.sources.jiraApiToken === "default" && env.JIRA_API_TOKEN ? "env" : current.sources.jiraApiToken
   );
   return {
@@ -14140,7 +14264,7 @@ function createLogoutResponse(args, env, cwd, context) {
 function createAuthHandler(deps = {}) {
   const env = deps.env ?? process.env;
   const cwd = deps.cwd ?? process.cwd();
-  const readStdin = deps.readStdin ?? (() => (0, import_node_fs10.readFileSync)(0, "utf8"));
+  const readStdin = deps.readStdin ?? (() => (0, import_node_fs11.readFileSync)(0, "utf8"));
   const platform = deps.platform ?? process.platform;
   return (request, context) => {
     const [subcommand, ...args] = request.args;
@@ -14161,8 +14285,8 @@ function createAuthHandler(deps = {}) {
 }
 
 // src/bdd.ts
-var import_node_fs11 = require("node:fs");
-var import_node_path11 = __toESM(require("node:path"), 1);
+var import_node_fs12 = require("node:fs");
+var import_node_path12 = __toESM(require("node:path"), 1);
 var import_yazl = __toESM(require_yazl(), 1);
 
 // src/forgeClient.ts
@@ -14466,7 +14590,7 @@ function parseScenarioFeatureFile(raw, filePath) {
   }
   const scenarioTag = tags.map((tag) => tag.match(SCENARIO_METADATA_PATTERN)).find((match) => Boolean(match));
   const scenarioKeyFromTag = scenarioTag?.[1]?.trim().toUpperCase() ?? "";
-  const fileKeyMatch = import_node_path11.default.basename(filePath ?? "").match(/^(SC-\d+)\.feature$/i);
+  const fileKeyMatch = import_node_path12.default.basename(filePath ?? "").match(/^(SC-\d+)\.feature$/i);
   const scenarioKeyFromFile = fileKeyMatch?.[1]?.trim().toUpperCase() ?? "";
   const scenarioKey = scenarioKeyFromTag || scenarioKeyFromFile;
   if (scenarioKeyFromTag && scenarioKeyFromFile && scenarioKeyFromTag !== scenarioKeyFromFile) {
@@ -14586,7 +14710,7 @@ function toJsonExportManifestItems(items) {
 async function defaultCreateZipArchive(archivePath, entries) {
   await new Promise((resolve, reject) => {
     const zip = new import_yazl.ZipFile();
-    const output = zip.outputStream.pipe((0, import_node_fs11.createWriteStream)(archivePath));
+    const output = zip.outputStream.pipe((0, import_node_fs12.createWriteStream)(archivePath));
     output.on("close", () => resolve());
     output.on("error", reject);
     zip.outputStream.on("error", reject);
@@ -14616,10 +14740,10 @@ function missingProjectResponse() {
 function createBddHandler(deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const env = deps.env ?? process.env;
-  const mkdir = deps.mkdir ?? ((targetPath, options) => (0, import_node_fs11.mkdirSync)(targetPath, options));
-  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs11.readFileSync)(filePath, "utf8"));
-  const readDir = deps.readDir ?? ((dirPath) => (0, import_node_fs11.readdirSync)(dirPath));
-  const writeFile = deps.writeFile ?? ((filePath, content) => (0, import_node_fs11.writeFileSync)(filePath, content, "utf8"));
+  const mkdir = deps.mkdir ?? ((targetPath, options) => (0, import_node_fs12.mkdirSync)(targetPath, options));
+  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs12.readFileSync)(filePath, "utf8"));
+  const readDir = deps.readDir ?? ((dirPath) => (0, import_node_fs12.readdirSync)(dirPath));
+  const writeFile = deps.writeFile ?? ((filePath, content) => (0, import_node_fs12.writeFileSync)(filePath, content, "utf8"));
   const createZipArchive = deps.createZipArchive ?? defaultCreateZipArchive;
   return async (request, context) => {
     const [subcommand, ...restArgs] = request.args;
@@ -14663,7 +14787,7 @@ function createBddHandler(deps = {}) {
           stderr: ["ERROR: Missing required --output-dir for testops bdd features export."]
         };
       }
-      const outputDir = import_node_path11.default.resolve(cwd, outputDirFlag);
+      const outputDir = import_node_path12.default.resolve(cwd, outputDirFlag);
       try {
         const result = await context.invokeForgeContract("listBddFeatures", {
           context: {
@@ -14701,7 +14825,7 @@ function createBddHandler(deps = {}) {
 `
         }));
         for (let index = 0; index < features.length; index += 1) {
-          writeFile(import_node_path11.default.join(outputDir, fileNames[index]), exportEntries[index].content);
+          writeFile(import_node_path12.default.join(outputDir, fileNames[index]), exportEntries[index].content);
         }
         const manifest = {
           action: "bdd-features-export",
@@ -14714,7 +14838,7 @@ function createBddHandler(deps = {}) {
         };
         const manifestContent = `${JSON.stringify(manifest, null, 2)}
 `;
-        writeFile(import_node_path11.default.join(outputDir, "manifest.json"), manifestContent);
+        writeFile(import_node_path12.default.join(outputDir, "manifest.json"), manifestContent);
         const archivePath = `${outputDir}.zip`;
         if (zipRequested) {
           await createZipArchive(archivePath, [
@@ -14784,7 +14908,7 @@ function createBddHandler(deps = {}) {
               stderr: ["ERROR: Missing required --output-dir for testops bdd scenarios export."]
             };
           }
-          const outputDir = import_node_path11.default.resolve(cwd, outputDirFlag);
+          const outputDir = import_node_path12.default.resolve(cwd, outputDirFlag);
           const zipRequested = parsed.boolFlags.has("--zip");
           try {
             const scenariosResult = await context.invokeForgeContract("listBddScenarios", {
@@ -14821,7 +14945,7 @@ function createBddHandler(deps = {}) {
               const fileName = scenarioToExportFileName(scenario);
               const fileContent = `${scenarioToFeatureLines(scenario).join("\n")}
 `;
-              writeFile(import_node_path11.default.join(outputDir, fileName), fileContent);
+              writeFile(import_node_path12.default.join(outputDir, fileName), fileContent);
               return {
                 scenario,
                 fileName,
@@ -14847,7 +14971,7 @@ function createBddHandler(deps = {}) {
             };
             const manifestContent = `${JSON.stringify(manifest, null, 2)}
 `;
-            writeFile(import_node_path11.default.join(outputDir, "manifest.json"), manifestContent);
+            writeFile(import_node_path12.default.join(outputDir, "manifest.json"), manifestContent);
             const archivePath = `${outputDir}.zip`;
             if (zipRequested) {
               await createZipArchive(archivePath, [
@@ -14895,8 +15019,8 @@ function createBddHandler(deps = {}) {
           }
         }
         if (nested === "import") {
-          const sourceFile = parsed.flags["--file"] ? import_node_path11.default.resolve(cwd, parsed.flags["--file"]) : "";
-          const inputDir = parsed.flags["--input-dir"] ? import_node_path11.default.resolve(cwd, parsed.flags["--input-dir"]) : "";
+          const sourceFile = parsed.flags["--file"] ? import_node_path12.default.resolve(cwd, parsed.flags["--file"]) : "";
+          const inputDir = parsed.flags["--input-dir"] ? import_node_path12.default.resolve(cwd, parsed.flags["--input-dir"]) : "";
           const dryRun = parsed.boolFlags.has("--dry-run");
           if (!sourceFile && !inputDir) {
             return {
@@ -14905,7 +15029,7 @@ function createBddHandler(deps = {}) {
             };
           }
           try {
-            const scenarioFiles = sourceFile ? [sourceFile] : readDir(inputDir).filter((entry) => entry.toLowerCase().endsWith(".feature")).map((entry) => import_node_path11.default.join(inputDir, entry)).sort((left, right) => left.localeCompare(right));
+            const scenarioFiles = sourceFile ? [sourceFile] : readDir(inputDir).filter((entry) => entry.toLowerCase().endsWith(".feature")).map((entry) => import_node_path12.default.join(inputDir, entry)).sort((left, right) => left.localeCompare(right));
             if (scenarioFiles.length === 0) {
               return {
                 exitCode: ExitCode.ValidationError,
@@ -15954,8 +16078,8 @@ function createDoctorHandler(deps = {}) {
 }
 
 // src/ingestFeature.ts
-var import_node_fs12 = require("node:fs");
-var import_node_path12 = __toESM(require("node:path"), 1);
+var import_node_fs13 = require("node:fs");
+var import_node_path13 = __toESM(require("node:path"), 1);
 var CONFIG_FLAGS6 = /* @__PURE__ */ new Set([
   "--config",
   "--base-url",
@@ -16041,8 +16165,8 @@ function normalizeError5(error) {
   return "Unknown ingest error.";
 }
 function createIngestFeatureHandler(deps = {}) {
-  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs12.readFileSync)(filePath, "utf8"));
-  const readStdin = deps.readStdin ?? (() => (0, import_node_fs12.readFileSync)(0, "utf8"));
+  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs13.readFileSync)(filePath, "utf8"));
+  const readStdin = deps.readStdin ?? (() => (0, import_node_fs13.readFileSync)(0, "utf8"));
   const cwd = deps.cwd ?? process.cwd();
   const env = deps.env ?? process.env;
   return async (request, context) => {
@@ -16052,7 +16176,7 @@ function createIngestFeatureHandler(deps = {}) {
     const config = resolveCliConfig(configArgs, env, cwd);
     const projectKey = config.values.projectKey;
     const issueKey = config.values.issueKey;
-    const sourceFile = parsed.flags["--file"] ? import_node_path12.default.resolve(cwd, parsed.flags["--file"]) : "";
+    const sourceFile = parsed.flags["--file"] ? import_node_path13.default.resolve(cwd, parsed.flags["--file"]) : "";
     const useStdin = parsed.boolFlags.has("--stdin");
     const useJson = parsed.boolFlags.has("--json");
     const sourceCount = Number(Boolean(sourceFile)) + Number(useStdin);
@@ -16172,16 +16296,514 @@ function createIngestFeatureHandler(deps = {}) {
   };
 }
 
+// src/profiles.ts
+var CONFIG_FLAGS7 = /* @__PURE__ */ new Set([
+  "--config",
+  "--base-url",
+  "--project-key",
+  "--issue-key",
+  "--auth-mode",
+  "--jira-email",
+  "--jira-api-token"
+]);
+function parseArgs8(args) {
+  const flags = {};
+  const boolFlags = /* @__PURE__ */ new Set();
+  const unknownFlags = [];
+  const supportedValueFlags = /* @__PURE__ */ new Set(["--id", ...CONFIG_FLAGS7]);
+  const supportedBoolFlags = /* @__PURE__ */ new Set(["--json", "--dry-run", "--confirm", "--detach"]);
+  for (let index = 0; index < args.length; index += 1) {
+    const token = args[index];
+    if (!token.startsWith("--")) {
+      unknownFlags.push(token);
+      continue;
+    }
+    if (supportedBoolFlags.has(token)) {
+      boolFlags.add(token);
+      continue;
+    }
+    if (!supportedValueFlags.has(token)) {
+      unknownFlags.push(token);
+      continue;
+    }
+    const value = args[index + 1];
+    if (!value || value.startsWith("--")) {
+      unknownFlags.push(token);
+      continue;
+    }
+    flags[token] = value;
+    index += 1;
+  }
+  return { flags, boolFlags, unknownFlags };
+}
+function pickConfigArgs7(parsed) {
+  const args = [];
+  for (const [flag, value] of Object.entries(parsed.flags)) {
+    if (CONFIG_FLAGS7.has(flag)) {
+      args.push(flag, value);
+    }
+  }
+  return args;
+}
+function normalizeError6(error) {
+  if (error instanceof ForgeClientError) {
+    return `${error.code}: ${error.message}`;
+  }
+  if (error instanceof Error) {
+    return error.message;
+  }
+  return "Unknown profiles command error.";
+}
+function missingProjectResponse3() {
+  return {
+    exitCode: ExitCode.ValidationError,
+    stderr: ["ERROR: Missing project context. Set JIRA_PROJECT_KEY or pass --project-key."]
+  };
+}
+function confirmationRequiredResponse(command) {
+  return {
+    exitCode: ExitCode.ValidationError,
+    stderr: [`ERROR: ${command} is destructive and requires --confirm. Use --dry-run first to preview the cleanup.`]
+  };
+}
+function remoteErrorResponse(code, message, stdout = []) {
+  return {
+    exitCode: ExitCode.RemoteError,
+    stdout,
+    stderr: [`ERROR: ${code}: ${message}`]
+  };
+}
+function toJsonProfile(profile) {
+  return {
+    id: profile.id,
+    label: profile.label,
+    provider: profile.provider,
+    endpointSummary: profile.endpointSummary,
+    enabled: profile.enabled,
+    isProjectDefault: profile.isProjectDefault ?? false,
+    hasSecret: profile.hasSecret,
+    createdAt: profile.createdAt,
+    updatedAt: profile.updatedAt,
+    lastUsedAt: profile.lastUsedAt ?? null
+  };
+}
+function toJsonBinding(automation) {
+  return {
+    id: automation.id,
+    scenarioId: automation.scenarioId,
+    label: automation.label,
+    profileId: automation.profileId ?? null,
+    profileLabel: automation.profileLabel ?? null,
+    materializedFromProjectDefault: automation.materializedFromProjectDefault ?? false,
+    enabled: automation.enabled
+  };
+}
+function profileLines(profiles) {
+  if (profiles.length === 0) {
+    return ["Automation profiles: 0", "No automation profiles found for the selected project."];
+  }
+  return [
+    `Automation profiles: ${profiles.length}`,
+    ...profiles.map((profile) => {
+      const flags = [profile.isProjectDefault ? "default" : "", profile.enabled ? "enabled" : "disabled"].filter(
+        Boolean
+      );
+      return `- ${profile.id} [${flags.join(", ")}] ${profile.label} (${profile.provider}) ${profile.endpointSummary}`;
+    })
+  ];
+}
+function bindingLines(bindings) {
+  return bindings.map(
+    (binding) => `- ${binding.id} scenario=${binding.scenarioId} ${binding.label}` + (binding.materializedFromProjectDefault ? " [project-default materialized]" : "")
+  );
+}
+function profileBindings(automations, profileId) {
+  return automations.filter((automation) => automation.mode === "profile" && automation.profileId === profileId);
+}
+function allProfileBindings(automations) {
+  return automations.filter((automation) => automation.mode === "profile");
+}
+function createProfilesHandler(deps = {}) {
+  const cwd = deps.cwd ?? process.cwd();
+  const env = deps.env ?? process.env;
+  return async (request, context) => {
+    const [subcommand, ...restArgs] = request.args;
+    const parsed = parseArgs8(restArgs);
+    const useJson = parsed.boolFlags.has("--json");
+    const dryRun = parsed.boolFlags.has("--dry-run");
+    const confirmed = parsed.boolFlags.has("--confirm");
+    const detach = parsed.boolFlags.has("--detach");
+    const profileId = parsed.flags["--id"]?.trim() ?? "";
+    const config = resolveCliConfig(pickConfigArgs7(parsed), env, cwd);
+    const projectKey = config.values.projectKey;
+    const issueKey = config.values.issueKey;
+    const forgeContext = {
+      projectKey: projectKey || void 0,
+      issueKey: issueKey || void 0
+    };
+    if (parsed.unknownFlags.length > 0) {
+      return {
+        exitCode: ExitCode.UsageError,
+        stderr: [`ERROR: Unknown or invalid arguments: ${parsed.unknownFlags.join(", ")}`]
+      };
+    }
+    if (!projectKey) {
+      return missingProjectResponse3();
+    }
+    if (dryRun && confirmed) {
+      return {
+        exitCode: ExitCode.UsageError,
+        stderr: ["ERROR: Use either --dry-run or --confirm, not both."]
+      };
+    }
+    if (subcommand === "list") {
+      if (dryRun || confirmed || detach || profileId) {
+        return {
+          exitCode: ExitCode.UsageError,
+          stderr: ["ERROR: profiles list accepts only configuration flags and optional --json."]
+        };
+      }
+      try {
+        const result = await context.invokeForgeContract("listScenarioAutomationProfiles", {
+          context: forgeContext
+        });
+        if (!result.ok) {
+          return remoteErrorResponse(result.error.code, result.error.message);
+        }
+        if (useJson) {
+          return {
+            exitCode: ExitCode.Success,
+            stdout: toJsonLine({
+              action: "profiles-list",
+              projectKey,
+              count: result.data.length,
+              items: result.data.map(toJsonProfile)
+            })
+          };
+        }
+        return {
+          exitCode: ExitCode.Success,
+          stdout: profileLines(result.data)
+        };
+      } catch (error) {
+        return {
+          exitCode: ExitCode.TransportError,
+          stderr: [`ERROR: ${normalizeError6(error)}`]
+        };
+      }
+    }
+    if (subcommand === "detach") {
+      if (!profileId) {
+        return {
+          exitCode: ExitCode.ValidationError,
+          stderr: ["ERROR: Missing required --id <PROFILE_ID> for profiles detach."]
+        };
+      }
+      if (detach) {
+        return {
+          exitCode: ExitCode.UsageError,
+          stderr: [
+            "ERROR: --detach is only valid with profiles delete; profiles detach already performs that operation."
+          ]
+        };
+      }
+      if (!dryRun && !confirmed) {
+        return confirmationRequiredResponse("profiles detach");
+      }
+      try {
+        const result = await context.invokeForgeContract("listScenarioAutomations", {
+          context: forgeContext
+        });
+        if (!result.ok) {
+          return remoteErrorResponse(result.error.code, result.error.message);
+        }
+        const bindings = profileBindings(result.data, profileId);
+        if (dryRun) {
+          if (useJson) {
+            return {
+              exitCode: ExitCode.Success,
+              stdout: toJsonLine({
+                action: "profiles-detach",
+                dryRun: true,
+                projectKey,
+                profileId,
+                bindingCount: bindings.length,
+                bindings: bindings.map(toJsonBinding)
+              })
+            };
+          }
+          return {
+            exitCode: ExitCode.Success,
+            stdout: [
+              `Dry run: profile ${profileId} has ${bindings.length} automation binding(s) to detach.`,
+              ...bindingLines(bindings),
+              "No changes made."
+            ]
+          };
+        }
+        const deletedIds = [];
+        for (const binding of bindings) {
+          const deleted = await context.invokeForgeContract("deleteScenarioAutomation", {
+            context: forgeContext,
+            automationId: binding.id
+          });
+          if (!deleted.ok) {
+            return remoteErrorResponse(deleted.error.code, deleted.error.message, [
+              `Detached ${deletedIds.length} of ${bindings.length} automation binding(s) before the failure.`
+            ]);
+          }
+          deletedIds.push(binding.id);
+        }
+        if (useJson) {
+          return {
+            exitCode: ExitCode.Success,
+            stdout: toJsonLine({
+              action: "profiles-detach",
+              dryRun: false,
+              projectKey,
+              profileId,
+              detachedCount: deletedIds.length,
+              detachedAutomationIds: deletedIds
+            })
+          };
+        }
+        return {
+          exitCode: ExitCode.Success,
+          stdout: [`Detached ${deletedIds.length} automation binding(s) from profile ${profileId}.`]
+        };
+      } catch (error) {
+        return {
+          exitCode: ExitCode.TransportError,
+          stderr: [`ERROR: ${normalizeError6(error)}`]
+        };
+      }
+    }
+    if (subcommand === "delete") {
+      if (!profileId) {
+        return {
+          exitCode: ExitCode.ValidationError,
+          stderr: ["ERROR: Missing required --id <PROFILE_ID> for profiles delete."]
+        };
+      }
+      if (!dryRun && !confirmed) {
+        return confirmationRequiredResponse("profiles delete");
+      }
+      try {
+        let bindings = [];
+        if (detach || dryRun) {
+          const automations = await context.invokeForgeContract("listScenarioAutomations", {
+            context: forgeContext
+          });
+          if (!automations.ok) {
+            return remoteErrorResponse(automations.error.code, automations.error.message);
+          }
+          bindings = profileBindings(automations.data, profileId);
+        }
+        if (dryRun) {
+          if (useJson) {
+            return {
+              exitCode: ExitCode.Success,
+              stdout: toJsonLine({
+                action: "profiles-delete",
+                dryRun: true,
+                projectKey,
+                profileId,
+                detach,
+                bindingCount: bindings.length,
+                bindings: bindings.map(toJsonBinding)
+              })
+            };
+          }
+          return {
+            exitCode: ExitCode.Success,
+            stdout: [
+              `Dry run: profile ${profileId} would be deleted.`,
+              detach ? `The command would first detach ${bindings.length} automation binding(s).` : `The command would not detach ${bindings.length} automation binding(s); Forge will block deletion if the profile is in use.`,
+              ...bindingLines(bindings),
+              "No changes made."
+            ]
+          };
+        }
+        const detachedIds = [];
+        if (detach) {
+          for (const binding of bindings) {
+            const deletedBinding = await context.invokeForgeContract("deleteScenarioAutomation", {
+              context: forgeContext,
+              automationId: binding.id
+            });
+            if (!deletedBinding.ok) {
+              return remoteErrorResponse(deletedBinding.error.code, deletedBinding.error.message, [
+                `Detached ${detachedIds.length} of ${bindings.length} automation binding(s); profile ${profileId} was not deleted.`
+              ]);
+            }
+            detachedIds.push(binding.id);
+          }
+        }
+        const deletedProfile = await context.invokeForgeContract("deleteScenarioAutomationProfile", {
+          context: forgeContext,
+          profileId
+        });
+        if (!deletedProfile.ok) {
+          return remoteErrorResponse(deletedProfile.error.code, deletedProfile.error.message, [
+            `Detached ${detachedIds.length} automation binding(s) before profile deletion was rejected.`
+          ]);
+        }
+        if (useJson) {
+          return {
+            exitCode: ExitCode.Success,
+            stdout: toJsonLine({
+              action: "profiles-delete",
+              dryRun: false,
+              projectKey,
+              profileId,
+              detachedCount: detachedIds.length,
+              detachedAutomationIds: detachedIds,
+              deleted: true
+            })
+          };
+        }
+        return {
+          exitCode: ExitCode.Success,
+          stdout: [
+            `Deleted automation profile ${profileId}.`,
+            detach ? `Detached ${detachedIds.length} automation binding(s) first.` : "No automatic detach was requested."
+          ]
+        };
+      } catch (error) {
+        return {
+          exitCode: ExitCode.TransportError,
+          stderr: [`ERROR: ${normalizeError6(error)}`]
+        };
+      }
+    }
+    if (subcommand === "clear") {
+      if (profileId || detach) {
+        return {
+          exitCode: ExitCode.UsageError,
+          stderr: [
+            "ERROR: profiles clear clears every profile and profile-based binding; do not pass --id or --detach."
+          ]
+        };
+      }
+      if (!dryRun && !confirmed) {
+        return confirmationRequiredResponse("profiles clear");
+      }
+      try {
+        const [profilesResult, automationsResult] = await Promise.all([
+          context.invokeForgeContract("listScenarioAutomationProfiles", {
+            context: forgeContext
+          }),
+          context.invokeForgeContract("listScenarioAutomations", {
+            context: forgeContext
+          })
+        ]);
+        if (!profilesResult.ok) {
+          return remoteErrorResponse(profilesResult.error.code, profilesResult.error.message);
+        }
+        if (!automationsResult.ok) {
+          return remoteErrorResponse(automationsResult.error.code, automationsResult.error.message);
+        }
+        const profiles = profilesResult.data;
+        const bindings = allProfileBindings(automationsResult.data);
+        if (dryRun) {
+          if (useJson) {
+            return {
+              exitCode: ExitCode.Success,
+              stdout: toJsonLine({
+                action: "profiles-clear",
+                dryRun: true,
+                projectKey,
+                profileCount: profiles.length,
+                bindingCount: bindings.length,
+                profiles: profiles.map(toJsonProfile),
+                bindings: bindings.map(toJsonBinding)
+              })
+            };
+          }
+          return {
+            exitCode: ExitCode.Success,
+            stdout: [
+              `Dry run: would detach ${bindings.length} profile-based automation binding(s) and delete ${profiles.length} automation profile(s).`,
+              ...bindingLines(bindings),
+              ...profiles.map((profile) => `- profile ${profile.id} ${profile.label}`),
+              "Direct (non-profile) scenario automations are preserved.",
+              "No changes made."
+            ]
+          };
+        }
+        const detachedIds = [];
+        for (const binding of bindings) {
+          const deletedBinding = await context.invokeForgeContract("deleteScenarioAutomation", {
+            context: forgeContext,
+            automationId: binding.id
+          });
+          if (!deletedBinding.ok) {
+            return remoteErrorResponse(deletedBinding.error.code, deletedBinding.error.message, [
+              `Detached ${detachedIds.length} of ${bindings.length} profile-based automation binding(s). No profiles were deleted after the failure.`
+            ]);
+          }
+          detachedIds.push(binding.id);
+        }
+        const deletedProfileIds = [];
+        for (const profile of profiles) {
+          const deletedProfile = await context.invokeForgeContract("deleteScenarioAutomationProfile", {
+            context: forgeContext,
+            profileId: profile.id
+          });
+          if (!deletedProfile.ok) {
+            return remoteErrorResponse(deletedProfile.error.code, deletedProfile.error.message, [
+              `Detached ${detachedIds.length} profile-based automation binding(s).`,
+              `Deleted ${deletedProfileIds.length} of ${profiles.length} automation profile(s) before the failure.`
+            ]);
+          }
+          deletedProfileIds.push(profile.id);
+        }
+        if (useJson) {
+          return {
+            exitCode: ExitCode.Success,
+            stdout: toJsonLine({
+              action: "profiles-clear",
+              dryRun: false,
+              projectKey,
+              detachedCount: detachedIds.length,
+              detachedAutomationIds: detachedIds,
+              deletedProfileCount: deletedProfileIds.length,
+              deletedProfileIds
+            })
+          };
+        }
+        return {
+          exitCode: ExitCode.Success,
+          stdout: [
+            `Detached ${detachedIds.length} profile-based automation binding(s).`,
+            `Deleted ${deletedProfileIds.length} automation profile(s).`,
+            "Direct (non-profile) scenario automations were preserved."
+          ]
+        };
+      } catch (error) {
+        return {
+          exitCode: ExitCode.TransportError,
+          stderr: [`ERROR: ${normalizeError6(error)}`]
+        };
+      }
+    }
+    return {
+      exitCode: ExitCode.UsageError,
+      stderr: ["ERROR: Unsupported profiles subcommand. Use: list, detach, delete, or clear."]
+    };
+  };
+}
+
 // src/runUpload.ts
-var import_node_fs13 = require("node:fs");
-var import_node_path13 = __toESM(require("node:path"), 1);
+var import_node_fs14 = require("node:fs");
+var import_node_path14 = __toESM(require("node:path"), 1);
 var STEP_RESULTS = [
   StepResult.Passed,
   StepResult.Failed,
   StepResult.Skipped,
   StepResult.Blocked
 ];
-var CONFIG_FLAGS7 = /* @__PURE__ */ new Set([
+var CONFIG_FLAGS8 = /* @__PURE__ */ new Set([
   "--config",
   "--base-url",
   "--project-key",
@@ -16190,7 +16812,7 @@ var CONFIG_FLAGS7 = /* @__PURE__ */ new Set([
   "--jira-email",
   "--jira-api-token"
 ]);
-function parseArgs8(args) {
+function parseArgs9(args) {
   const flags = {};
   const boolFlags = /* @__PURE__ */ new Set();
   const unknownFlags = [];
@@ -16201,7 +16823,7 @@ function parseArgs8(args) {
     "--feature-name",
     "--scenario-name",
     "--executed-at",
-    ...CONFIG_FLAGS7
+    ...CONFIG_FLAGS8
   ]);
   const supportedBoolFlags = /* @__PURE__ */ new Set(["--stdin", "--json"]);
   for (let i = 0; i < args.length; i += 1) {
@@ -16227,16 +16849,16 @@ function parseArgs8(args) {
   }
   return { flags, boolFlags, unknownFlags };
 }
-function pickConfigArgs7(parsed) {
+function pickConfigArgs8(parsed) {
   const configArgs = [];
   for (const [flag, value] of Object.entries(parsed.flags)) {
-    if (CONFIG_FLAGS7.has(flag)) {
+    if (CONFIG_FLAGS8.has(flag)) {
       configArgs.push(flag, value);
     }
   }
   return configArgs;
 }
-function normalizeError6(error) {
+function normalizeError7(error) {
   if (error instanceof ForgeClientError) {
     return `${error.code}: ${error.message}`;
   }
@@ -16315,19 +16937,19 @@ function summarizeRunResult(result) {
   return lines;
 }
 function createRunUploadHandler(deps = {}) {
-  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs13.readFileSync)(filePath, "utf8"));
-  const readStdin = deps.readStdin ?? (() => (0, import_node_fs13.readFileSync)(0, "utf8"));
+  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs14.readFileSync)(filePath, "utf8"));
+  const readStdin = deps.readStdin ?? (() => (0, import_node_fs14.readFileSync)(0, "utf8"));
   const cwd = deps.cwd ?? process.cwd();
   const env = deps.env ?? process.env;
   return async (request, context) => {
     const [, ...subArgs] = request.args;
-    const parsed = parseArgs8(subArgs);
-    const configArgs = pickConfigArgs7(parsed);
+    const parsed = parseArgs9(subArgs);
+    const configArgs = pickConfigArgs8(parsed);
     const config = resolveCliConfig(configArgs, env, cwd);
     const projectKey = config.values.projectKey;
     const issueKey = config.values.issueKey;
     const testCaseKey = parsed.flags["--test-case-key"]?.trim().toUpperCase() ?? "";
-    const sourceFile = parsed.flags["--file"] ? import_node_path13.default.resolve(cwd, parsed.flags["--file"]) : "";
+    const sourceFile = parsed.flags["--file"] ? import_node_path14.default.resolve(cwd, parsed.flags["--file"]) : "";
     const useStdin = parsed.boolFlags.has("--stdin");
     const useJson = parsed.boolFlags.has("--json");
     const sourceCount = Number(Boolean(sourceFile)) + Number(useStdin);
@@ -16355,7 +16977,7 @@ function createRunUploadHandler(deps = {}) {
     } catch (error) {
       return {
         exitCode: ExitCode.InternalError,
-        stderr: [`ERROR: Failed to read run payload source: ${normalizeError6(error)}`]
+        stderr: [`ERROR: Failed to read run payload source: ${normalizeError7(error)}`]
       };
     }
     const payloadFromSource = parseRunPayload(raw);
@@ -16385,7 +17007,7 @@ function createRunUploadHandler(deps = {}) {
       } catch (error) {
         return {
           exitCode: ExitCode.TransportError,
-          stderr: [`ERROR: ${normalizeError6(error)}`]
+          stderr: [`ERROR: ${normalizeError7(error)}`]
         };
       }
     }
@@ -16465,7 +17087,7 @@ function createRunUploadHandler(deps = {}) {
             featureName: runInput.featureName,
             scenarioName: runInput.scenarioName,
             executedAt: runInput.executedAt,
-            errorMessage: normalizeError6(error)
+            errorMessage: normalizeError7(error)
           })
         };
       }
@@ -16477,14 +17099,14 @@ function createRunUploadHandler(deps = {}) {
           `Scenario: ${runInput.scenarioName}`,
           `ExecutedAt: ${runInput.executedAt}`
         ],
-        stderr: [`ERROR: ${normalizeError6(error)}`]
+        stderr: [`ERROR: ${normalizeError7(error)}`]
       };
     }
   };
 }
 
 // src/runs.ts
-var CONFIG_FLAGS8 = /* @__PURE__ */ new Set([
+var CONFIG_FLAGS9 = /* @__PURE__ */ new Set([
   "--config",
   "--base-url",
   "--project-key",
@@ -16493,11 +17115,11 @@ var CONFIG_FLAGS8 = /* @__PURE__ */ new Set([
   "--jira-email",
   "--jira-api-token"
 ]);
-function parseArgs9(args) {
+function parseArgs10(args) {
   const flags = {};
   const boolFlags = /* @__PURE__ */ new Set();
   const unknownFlags = [];
-  const supportedValueFlags = /* @__PURE__ */ new Set(["--id", ...CONFIG_FLAGS8]);
+  const supportedValueFlags = /* @__PURE__ */ new Set(["--id", ...CONFIG_FLAGS9]);
   const supportedBoolFlags = /* @__PURE__ */ new Set(["--json"]);
   for (let index = 0; index < args.length; index += 1) {
     const token = args[index];
@@ -16522,16 +17144,16 @@ function parseArgs9(args) {
   }
   return { flags, boolFlags, unknownFlags };
 }
-function pickConfigArgs8(parsed) {
+function pickConfigArgs9(parsed) {
   const args = [];
   for (const [flag, value] of Object.entries(parsed.flags)) {
-    if (CONFIG_FLAGS8.has(flag)) {
+    if (CONFIG_FLAGS9.has(flag)) {
       args.push(flag, value);
     }
   }
   return args;
 }
-function normalizeError7(error) {
+function normalizeError8(error) {
   if (error instanceof ForgeClientError) {
     return `${error.code}: ${error.message}`;
   }
@@ -16584,7 +17206,7 @@ function runToLines(run) {
   }
   return lines;
 }
-function missingProjectResponse3() {
+function missingProjectResponse4() {
   return {
     exitCode: ExitCode.ValidationError,
     stderr: ["ERROR: Missing project context. Set JIRA_PROJECT_KEY or pass --project-key."]
@@ -16595,9 +17217,9 @@ function createRunsHandler(deps = {}) {
   const env = deps.env ?? process.env;
   return async (request, context) => {
     const [subcommand, ...restArgs] = request.args;
-    const parsed = parseArgs9(restArgs);
+    const parsed = parseArgs10(restArgs);
     const useJson = parsed.boolFlags.has("--json");
-    const config = resolveCliConfig(pickConfigArgs8(parsed), env, cwd);
+    const config = resolveCliConfig(pickConfigArgs9(parsed), env, cwd);
     const projectKey = config.values.projectKey;
     const issueKey = config.values.issueKey;
     if (parsed.unknownFlags.length > 0) {
@@ -16607,7 +17229,7 @@ function createRunsHandler(deps = {}) {
       };
     }
     if (!projectKey) {
-      return missingProjectResponse3();
+      return missingProjectResponse4();
     }
     if (subcommand === "show") {
       const runId = parsed.flags["--id"]?.trim() ?? "";
@@ -16649,7 +17271,7 @@ function createRunsHandler(deps = {}) {
       } catch (error) {
         return {
           exitCode: ExitCode.TransportError,
-          stderr: [`ERROR: ${normalizeError7(error)}`]
+          stderr: [`ERROR: ${normalizeError8(error)}`]
         };
       }
     }
@@ -16661,16 +17283,16 @@ function createRunsHandler(deps = {}) {
 }
 
 // src/setup.ts
-var import_node_fs15 = require("node:fs");
-var import_node_path15 = __toESM(require("node:path"), 1);
+var import_node_fs16 = require("node:fs");
+var import_node_path16 = __toESM(require("node:path"), 1);
 
 // src/githubSetupProvider.ts
 var import_node_child_process4 = require("node:child_process");
 
 // src/setupPlan.ts
-var import_node_crypto = require("node:crypto");
-var import_node_fs14 = require("node:fs");
-var import_node_path14 = __toESM(require("node:path"), 1);
+var import_node_crypto2 = require("node:crypto");
+var import_node_fs15 = require("node:fs");
+var import_node_path15 = __toESM(require("node:path"), 1);
 var SETUP_PLAN_SCHEMA_VERSION = "automatify.testops.setup/v1";
 var SETUP_PLAN_KIND = "AutomatifyTestOpsSetupPlan";
 var ACTIONS = [
@@ -16694,7 +17316,7 @@ var ACTIONS = [
   }
 ];
 function sha256(value) {
-  return (0, import_node_crypto.createHash)("sha256").update(value, "utf8").digest("hex");
+  return (0, import_node_crypto2.createHash)("sha256").update(value, "utf8").digest("hex");
 }
 function sortJsonValue(value) {
   if (Array.isArray(value)) {
@@ -16739,8 +17361,8 @@ function normalizeRepoPart(value, field) {
   return normalized;
 }
 function normalizeWorkflowPath(value) {
-  const normalized = import_node_path14.default.posix.normalize(requireNonEmpty(value, "workflow path").replaceAll("\\", "/"));
-  if (import_node_path14.default.posix.isAbsolute(normalized) || normalized.startsWith("../") || !normalized.startsWith(".github/workflows/") || !/\.ya?ml$/i.test(normalized)) {
+  const normalized = import_node_path15.default.posix.normalize(requireNonEmpty(value, "workflow path").replaceAll("\\", "/"));
+  if (import_node_path15.default.posix.isAbsolute(normalized) || normalized.startsWith("../") || !normalized.startsWith(".github/workflows/") || !/\.ya?ml$/i.test(normalized)) {
     throw new Error("workflow path must be a relative .github/workflows/*.yml or *.yaml path without '..'.");
   }
   return normalized;
@@ -16765,7 +17387,7 @@ function buildGitHubSetupPlan(input) {
   if (endpointSecretName === tokenSecretName) {
     throw new Error("callback endpoint and auth token secret names must be different.");
   }
-  const workflowContent = (0, import_node_fs14.readFileSync)(input.workflowSourcePath, "utf8");
+  const workflowContent = (0, import_node_fs15.readFileSync)(input.workflowSourcePath, "utf8");
   if (!workflowContent.trim()) {
     throw new Error("workflow source file is empty.");
   }
@@ -16798,7 +17420,7 @@ function buildGitHubSetupPlan(input) {
       workflowId,
       workflowFile: {
         path: workflowPath,
-        sourcePath: import_node_path14.default.resolve(input.workflowSourcePath),
+        sourcePath: import_node_path15.default.resolve(input.workflowSourcePath),
         sha256: sha256(workflowContent)
       },
       requiredSecrets: [
@@ -17399,8 +18021,8 @@ var AzureDevOpsSetupProvider = class {
 };
 
 // src/azureDevOpsSetupPlan.ts
-var import_node_crypto2 = require("node:crypto");
-var digest = (v) => `sha256:${(0, import_node_crypto2.createHash)("sha256").update(JSON.stringify(v)).digest("hex")}`;
+var import_node_crypto3 = require("node:crypto");
+var digest = (v) => `sha256:${(0, import_node_crypto3.createHash)("sha256").update(JSON.stringify(v)).digest("hex")}`;
 var required = (value, field) => {
   const result = value.trim();
   if (!result) throw new Error(`${field} is required.`);
@@ -17629,7 +18251,7 @@ function defaultReadStdin() {
     process.stdin.on("error", reject);
   });
 }
-function parseArgs10(args, valueFlags, boolFlags, allowApplyCollections = false) {
+function parseArgs11(args, valueFlags, boolFlags, allowApplyCollections = false) {
   const flags = {};
   const enabled = /* @__PURE__ */ new Set();
   const approvals = [];
@@ -17708,10 +18330,10 @@ function errorCodeForError(error, fallback) {
   return error instanceof SetupCommandError ? error.cliCode : fallback;
 }
 function loadPlan(planPath, cwd) {
-  const absolute = import_node_path15.default.resolve(cwd, planPath);
+  const absolute = import_node_path16.default.resolve(cwd, planPath);
   let parsed;
   try {
-    parsed = JSON.parse((0, import_node_fs15.readFileSync)(absolute, "utf8"));
+    parsed = JSON.parse((0, import_node_fs16.readFileSync)(absolute, "utf8"));
   } catch (error) {
     throw new SetupCommandError(
       "PLAN_READ_ERROR",
@@ -17936,9 +18558,9 @@ function rollbackFor(plan, actionId) {
   return plan.rollback.find((item) => item.actionId === actionId)?.strategy ?? "Review the plan rollback section.";
 }
 function resolveWorkflowTarget(plan, repoRoot) {
-  const resolvedRoot = import_node_path15.default.resolve(repoRoot);
-  const target = import_node_path15.default.resolve(resolvedRoot, plan.github.workflowFile.path);
-  if (target !== resolvedRoot && !target.startsWith(`${resolvedRoot}${import_node_path15.default.sep}`)) {
+  const resolvedRoot = import_node_path16.default.resolve(repoRoot);
+  const target = import_node_path16.default.resolve(resolvedRoot, plan.github.workflowFile.path);
+  if (target !== resolvedRoot && !target.startsWith(`${resolvedRoot}${import_node_path16.default.sep}`)) {
     throw new SetupCommandError(
       "WORKFLOW_PATH_ERROR",
       "Workflow target escapes the approved repository root.",
@@ -17950,7 +18572,7 @@ function resolveWorkflowTarget(plan, repoRoot) {
 function applyWorkflowFile(plan, repoRoot, dryRun) {
   const action = plan.actions.find((item) => item.scope === "workflow-file");
   const target = resolveWorkflowTarget(plan, repoRoot);
-  const sourceContent = (0, import_node_fs15.readFileSync)(plan.github.workflowFile.sourcePath, "utf8");
+  const sourceContent = (0, import_node_fs16.readFileSync)(plan.github.workflowFile.sourcePath, "utf8");
   if (hashSetupContent(sourceContent) !== plan.github.workflowFile.sha256) {
     throw new SetupCommandError(
       "WORKFLOW_SOURCE_CHANGED",
@@ -17958,8 +18580,8 @@ function applyWorkflowFile(plan, repoRoot, dryRun) {
       ExitCode.ValidationError
     );
   }
-  const existed = (0, import_node_fs15.existsSync)(target);
-  const previousContent = existed ? (0, import_node_fs15.readFileSync)(target, "utf8") : void 0;
+  const existed = (0, import_node_fs16.existsSync)(target);
+  const previousContent = existed ? (0, import_node_fs16.readFileSync)(target, "utf8") : void 0;
   const matches = previousContent !== void 0 && hashSetupContent(previousContent) === plan.github.workflowFile.sha256;
   if (matches) {
     return {
@@ -17971,8 +18593,8 @@ function applyWorkflowFile(plan, repoRoot, dryRun) {
     };
   }
   if (!dryRun) {
-    (0, import_node_fs15.mkdirSync)(import_node_path15.default.dirname(target), { recursive: true });
-    (0, import_node_fs15.writeFileSync)(target, sourceContent, { encoding: "utf8", mode: 420 });
+    (0, import_node_fs16.mkdirSync)(import_node_path16.default.dirname(target), { recursive: true });
+    (0, import_node_fs16.writeFileSync)(target, sourceContent, { encoding: "utf8", mode: 420 });
   }
   return {
     id: action.id,
@@ -18142,14 +18764,14 @@ async function inspectPlan(plan, repoRoot, secrets, context, deps) {
   const checks = [];
   let forgeTransportFailure = false;
   const target = resolveWorkflowTarget(plan, repoRoot);
-  if (!(0, import_node_fs15.existsSync)(target)) {
+  if (!(0, import_node_fs16.existsSync)(target)) {
     checks.push({
       id: "workflow-local",
       status: "fail",
       message: `Local workflow file ${plan.github.workflowFile.path} does not exist.`
     });
   } else {
-    const localHash = hashSetupContent((0, import_node_fs15.readFileSync)(target, "utf8"));
+    const localHash = hashSetupContent((0, import_node_fs16.readFileSync)(target, "utf8"));
     checks.push({
       id: "workflow-local",
       status: localHash === plan.github.workflowFile.sha256 ? "pass" : "fail",
@@ -18239,7 +18861,7 @@ async function inspectPlan(plan, repoRoot, secrets, context, deps) {
   };
 }
 function planCommand(args, deps) {
-  const parsed = parseArgs10(args, PLAN_VALUE_FLAGS, /* @__PURE__ */ new Set(["--set-default", "--disabled"]));
+  const parsed = parseArgs11(args, PLAN_VALUE_FLAGS, /* @__PURE__ */ new Set(["--set-default", "--disabled"]));
   if (parsed.errors.length > 0) {
     return jsonResponse(
       errorPayload("USAGE_ERROR", "Invalid setup plan arguments.", parsed.errors),
@@ -18285,7 +18907,7 @@ function planCommand(args, deps) {
       ref: parsed.flags["--ref"] ?? "main",
       workflowId: parsed.flags["--workflow-id"] ?? "scenario-dispatch.yml",
       workflowPath: parsed.flags["--workflow-path"] ?? ".github/workflows/scenario-dispatch.yml",
-      workflowSourcePath: import_node_path15.default.resolve(deps.cwd, parsed.flags["--workflow-source"] ?? ""),
+      workflowSourcePath: import_node_path16.default.resolve(deps.cwd, parsed.flags["--workflow-source"] ?? ""),
       profileLabel: parsed.flags["--profile-label"] ?? "GitHub Actions",
       enabled: !parsed.boolFlags.has("--disabled"),
       setProjectDefault: parsed.boolFlags.has("--set-default"),
@@ -18298,7 +18920,7 @@ function planCommand(args, deps) {
   }
 }
 async function applyCommand(args, context, deps) {
-  const parsed = parseArgs10(args, APPLY_VALUE_FLAGS, APPLY_BOOL_FLAGS, true);
+  const parsed = parseArgs11(args, APPLY_VALUE_FLAGS, APPLY_BOOL_FLAGS, true);
   if (parsed.errors.length > 0) {
     return jsonResponse(
       errorPayload("USAGE_ERROR", "Invalid setup apply arguments.", parsed.errors),
@@ -18325,7 +18947,7 @@ async function applyCommand(args, context, deps) {
       return await applyAzureCommand(plan, parsed, context, deps, secrets);
     }
     const scopes = approvedScopes(plan, parsed, dryRun);
-    const repoRoot = import_node_path15.default.resolve(deps.cwd, parsed.flags["--repo-root"] ?? ".");
+    const repoRoot = import_node_path16.default.resolve(deps.cwd, parsed.flags["--repo-root"] ?? ".");
     const rotateSecrets = parsed.boolFlags.has("--rotate-secrets");
     const rotateProviderToken = parsed.boolFlags.has("--rotate-provider-token");
     const state = await prepareState(plan, scopes, secrets, context, deps, dryRun, rotateSecrets, rotateProviderToken);
@@ -18541,7 +19163,7 @@ async function applyAzureCommand(plan, parsed, context, deps, secrets) {
   });
 }
 async function doctorCommand(args, context, deps) {
-  const parsed = parseArgs10(args, APPLY_VALUE_FLAGS, /* @__PURE__ */ new Set(["--secrets-stdin"]), true);
+  const parsed = parseArgs11(args, APPLY_VALUE_FLAGS, /* @__PURE__ */ new Set(["--secrets-stdin"]), true);
   if (parsed.approvals.length > 0) {
     return jsonResponse(errorPayload("USAGE_ERROR", "setup doctor does not accept --approve."), ExitCode.UsageError);
   }
@@ -18617,7 +19239,7 @@ async function doctorCommand(args, context, deps) {
         exitCode
       );
     }
-    const repoRoot = import_node_path15.default.resolve(deps.cwd, parsed.flags["--repo-root"] ?? ".");
+    const repoRoot = import_node_path16.default.resolve(deps.cwd, parsed.flags["--repo-root"] ?? ".");
     const summary = await inspectPlan(plan, repoRoot, secrets, context, deps);
     return jsonResponse(summary, summary.exitCode);
   } catch (error) {
@@ -18654,7 +19276,7 @@ function createSetupHandler(overrides = {}) {
 }
 
 // src/suites.ts
-var CONFIG_FLAGS9 = /* @__PURE__ */ new Set([
+var CONFIG_FLAGS10 = /* @__PURE__ */ new Set([
   "--config",
   "--base-url",
   "--project-key",
@@ -18663,11 +19285,11 @@ var CONFIG_FLAGS9 = /* @__PURE__ */ new Set([
   "--jira-email",
   "--jira-api-token"
 ]);
-function parseArgs11(args) {
+function parseArgs12(args) {
   const flags = {};
   const boolFlags = /* @__PURE__ */ new Set();
   const unknownFlags = [];
-  const supportedValueFlags = /* @__PURE__ */ new Set(["--key", ...CONFIG_FLAGS9]);
+  const supportedValueFlags = /* @__PURE__ */ new Set(["--key", ...CONFIG_FLAGS10]);
   const supportedBoolFlags = /* @__PURE__ */ new Set(["--json"]);
   for (let index = 0; index < args.length; index += 1) {
     const token = args[index];
@@ -18692,16 +19314,16 @@ function parseArgs11(args) {
   }
   return { flags, boolFlags, unknownFlags };
 }
-function pickConfigArgs9(parsed) {
+function pickConfigArgs10(parsed) {
   const args = [];
   for (const [flag, value] of Object.entries(parsed.flags)) {
-    if (CONFIG_FLAGS9.has(flag)) {
+    if (CONFIG_FLAGS10.has(flag)) {
       args.push(flag, value);
     }
   }
   return args;
 }
-function normalizeError8(error) {
+function normalizeError9(error) {
   if (error instanceof ForgeClientError) {
     return `${error.code}: ${error.message}`;
   }
@@ -18763,7 +19385,7 @@ function suiteCasesToLines(suite, items) {
     ...items.map((item) => `- ${item.key} [${item.status}] ${item.title}`)
   ];
 }
-function missingProjectResponse4() {
+function missingProjectResponse5() {
   return {
     exitCode: ExitCode.ValidationError,
     stderr: ["ERROR: Missing project context. Set JIRA_PROJECT_KEY or pass --project-key."]
@@ -18780,9 +19402,9 @@ function createSuitesHandler(deps = {}) {
   const env = deps.env ?? process.env;
   return async (request, context) => {
     const [subcommand, ...restArgs] = request.args;
-    const parsed = parseArgs11(restArgs);
+    const parsed = parseArgs12(restArgs);
     const useJson = parsed.boolFlags.has("--json");
-    const config = resolveCliConfig(pickConfigArgs9(parsed), env, cwd);
+    const config = resolveCliConfig(pickConfigArgs10(parsed), env, cwd);
     const projectKey = config.values.projectKey;
     const issueKey = config.values.issueKey;
     if (parsed.unknownFlags.length > 0) {
@@ -18792,7 +19414,7 @@ function createSuitesHandler(deps = {}) {
       };
     }
     if (!projectKey) {
-      return missingProjectResponse4();
+      return missingProjectResponse5();
     }
     if (subcommand === "list") {
       try {
@@ -18827,7 +19449,7 @@ function createSuitesHandler(deps = {}) {
       } catch (error) {
         return {
           exitCode: ExitCode.TransportError,
-          stderr: [`ERROR: ${normalizeError8(error)}`]
+          stderr: [`ERROR: ${normalizeError9(error)}`]
         };
       }
     }
@@ -18868,7 +19490,7 @@ function createSuitesHandler(deps = {}) {
       } catch (error) {
         return {
           exitCode: ExitCode.TransportError,
-          stderr: [`ERROR: ${normalizeError8(error)}`]
+          stderr: [`ERROR: ${normalizeError9(error)}`]
         };
       }
     }
@@ -18932,7 +19554,7 @@ function createSuitesHandler(deps = {}) {
       } catch (error) {
         return {
           exitCode: ExitCode.TransportError,
-          stderr: [`ERROR: ${normalizeError8(error)}`]
+          stderr: [`ERROR: ${normalizeError9(error)}`]
         };
       }
     }
@@ -18944,7 +19566,7 @@ function createSuitesHandler(deps = {}) {
 }
 
 // src/sync.ts
-var CONFIG_FLAGS10 = /* @__PURE__ */ new Set([
+var CONFIG_FLAGS11 = /* @__PURE__ */ new Set([
   "--config",
   "--base-url",
   "--project-key",
@@ -18954,11 +19576,11 @@ var CONFIG_FLAGS10 = /* @__PURE__ */ new Set([
   "--jira-api-token"
 ]);
 var RECONCILE_CONFIRM_TOKEN = "RECONCILE";
-function parseArgs12(args) {
+function parseArgs13(args) {
   const flags = {};
   const boolFlags = /* @__PURE__ */ new Set();
   const unknownFlags = [];
-  const supportedValueFlags = /* @__PURE__ */ new Set(["--confirm", ...CONFIG_FLAGS10]);
+  const supportedValueFlags = /* @__PURE__ */ new Set(["--confirm", ...CONFIG_FLAGS11]);
   const supportedBoolFlags = /* @__PURE__ */ new Set(["--json"]);
   for (let i = 0; i < args.length; i += 1) {
     const token = args[i];
@@ -18983,16 +19605,16 @@ function parseArgs12(args) {
   }
   return { flags, boolFlags, unknownFlags };
 }
-function pickConfigArgs10(parsed) {
+function pickConfigArgs11(parsed) {
   const args = [];
   for (const [flag, value] of Object.entries(parsed.flags)) {
-    if (CONFIG_FLAGS10.has(flag)) {
+    if (CONFIG_FLAGS11.has(flag)) {
       args.push(flag, value);
     }
   }
   return args;
 }
-function normalizeError9(error) {
+function normalizeError10(error) {
   if (error instanceof ForgeClientError) {
     return `${error.code}: ${error.message}`;
   }
@@ -19043,9 +19665,9 @@ function createSyncHandler(deps = {}) {
   const env = deps.env ?? process.env;
   return async (request, context) => {
     const [subcommand, ...restArgs] = request.args;
-    const parsed = parseArgs12(restArgs);
+    const parsed = parseArgs13(restArgs);
     const useJson = parsed.boolFlags.has("--json");
-    const config = resolveCliConfig(pickConfigArgs10(parsed), env, cwd);
+    const config = resolveCliConfig(pickConfigArgs11(parsed), env, cwd);
     const projectKey = config.values.projectKey;
     const issueKey = config.values.issueKey;
     if (parsed.unknownFlags.length > 0) {
@@ -19095,7 +19717,7 @@ function createSyncHandler(deps = {}) {
       } catch (error) {
         return {
           exitCode: ExitCode.TransportError,
-          stderr: [`ERROR: ${normalizeError9(error)}`]
+          stderr: [`ERROR: ${normalizeError10(error)}`]
         };
       }
     }
@@ -19141,7 +19763,7 @@ function createSyncHandler(deps = {}) {
       } catch (error) {
         return {
           exitCode: ExitCode.TransportError,
-          stderr: [`ERROR: ${normalizeError9(error)}`]
+          stderr: [`ERROR: ${normalizeError10(error)}`]
         };
       }
     }
@@ -19197,6 +19819,12 @@ var COMMAND_REGISTRY = [
     subcommands: ["feature"],
     handler: createIngestFeatureHandler()
   },
+  {
+    name: "profiles",
+    description: "Automation profile inspection, detach, delete, and demo cleanup commands",
+    subcommands: ["list", "detach", "delete", "clear"],
+    handler: createProfilesHandler()
+  },
   {
     name: "run",
     description: "Execution result upload commands",