qualty 0.1.21 → 0.1.25

package/bin/auth-ci-bundle.js

@@ -0,0 +1,348 @@
+import { gunzipSync, gzipSync } from "node:zlib";
+import { mkdirSync, readFileSync, writeFileSync, chmodSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+export const AUTH_BUNDLE_VERSION = 2;
+export const GITHUB_SECRET_MAX_BYTES = 64 * 1024;
+export const GITHUB_SECRET_SAFE_BYTES = GITHUB_SECRET_MAX_BYTES - 1024;
+export const AUTH_SECRET_PRIMARY = "QUALTY_AUTH_STATE_B64";
+export const AUTH_SHARDS_VARIABLE = "QUALTY_AUTH_SHARDS";
+export const AUTH_PROFILES_VARIABLE = "QUALTY_AUTH_PROFILES";
+export const MAX_AUTH_SHARDS = 10;
+
+const QUALTY_SHARED_CREDS_DIR = join(homedir(), ".qualty");
+
+export function safePathSegment(value, fallback = "default") {
+  const out = String(value || "")
+    .trim()
+    .replace(/[^a-zA-Z0-9._-]+/g, "_")
+    .replace(/^_+|_+$/g, "");
+  return out || fallback;
+}
+
+export function localAuthStatePath({ orgId, projectId, profile }) {
+  const orgSeg = safePathSegment(orgId || "default-org", "default-org");
+  const projectSeg = safePathSegment(projectId || "default-project", "default-project");
+  const profileSeg = safePathSegment(profile || "default", "default");
+  return join(QUALTY_SHARED_CREDS_DIR, "local-contexts", orgSeg, projectSeg, `${profileSeg}.json`);
+}
+
+export function authShardSecretName(shardIndex) {
+  const index = Number(shardIndex);
+  if (!Number.isInteger(index) || index < 1) {
+    throw new Error(`Invalid auth shard index: ${shardIndex}`);
+  }
+  return index === 1 ? AUTH_SECRET_PRIMARY : `${AUTH_SECRET_PRIMARY}_${index}`;
+}
+
+export function loadStorageStateFromPath(statePath) {
+  const raw = readFileSync(statePath, "utf8");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`Invalid auth JSON at ${statePath}: ${err.message}`);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`Invalid auth JSON at ${statePath}: expected an object`);
+  }
+  return parsed;
+}
+
+export function buildAuthBundleManifest({ orgId, projectId, profileEntries }) {
+  const profiles = {};
+  for (const entry of profileEntries) {
+    const name = String(entry.name || "").trim();
+    if (!name) continue;
+    const localProfileName =
+      String(entry.localProfileName || entry.local_profile_name || name).trim() || name;
+    const state =
+      entry.state && typeof entry.state === "object"
+        ? entry.state
+        : loadStorageStateFromPath(entry.statePath);
+    profiles[name] = {
+      local_profile_name: localProfileName,
+      state,
+    };
+  }
+  if (Object.keys(profiles).length === 0) {
+    throw new Error("No auth profiles to export.");
+  }
+  return {
+    version: AUTH_BUNDLE_VERSION,
+    org_id: String(orgId || "").trim(),
+    project_id: String(projectId || "").trim(),
+    profiles,
+  };
+}
+
+export function encodeAuthBundleManifest(manifest) {
+  const raw = Buffer.from(JSON.stringify(manifest), "utf8");
+  return {
+    encoding: "gzip+base64",
+    payload: gzipSync(raw).toString("base64"),
+    rawBytes: raw.length,
+  };
+}
+
+function isPlaywrightStorageState(value) {
+  return (
+    value &&
+    typeof value === "object" &&
+    !Array.isArray(value) &&
+    (Array.isArray(value.cookies) || Array.isArray(value.origins))
+  );
+}
+
+export function decodeAuthPayload(payloadB64) {
+  const trimmed = String(payloadB64 || "").trim();
+  if (!trimmed) {
+    throw new Error("Empty auth payload.");
+  }
+  let decoded;
+  try {
+    decoded = Buffer.from(trimmed, "base64");
+  } catch (err) {
+    throw new Error(`Invalid base64 auth payload: ${err.message}`);
+  }
+
+  let jsonText;
+  try {
+    jsonText = gunzipSync(decoded).toString("utf8");
+  } catch {
+    jsonText = decoded.toString("utf8");
+  }
+
+  let parsed;
+  try {
+    parsed = JSON.parse(jsonText);
+  } catch (err) {
+    throw new Error(`Auth payload is not valid JSON: ${err.message}`);
+  }
+
+  if (parsed?.version === AUTH_BUNDLE_VERSION && parsed?.profiles && typeof parsed.profiles === "object") {
+    return { format: "bundle", manifest: parsed };
+  }
+  if (isPlaywrightStorageState(parsed)) {
+    return { format: "legacy-single", state: parsed };
+  }
+  throw new Error("Unrecognized auth payload format.");
+}
+
+function manifestSubset(manifest, profileNames) {
+  const profiles = {};
+  for (const name of profileNames) {
+    if (manifest.profiles?.[name]) {
+      profiles[name] = manifest.profiles[name];
+    }
+  }
+  return {
+    version: AUTH_BUNDLE_VERSION,
+    org_id: manifest.org_id,
+    project_id: manifest.project_id,
+    profiles,
+  };
+}
+
+export function shardAuthBundleManifest(manifest) {
+  const profileNames = Object.keys(manifest.profiles || {});
+  if (profileNames.length === 0) {
+    throw new Error("Auth bundle has no profiles.");
+  }
+
+  const singles = profileNames.map((name) => {
+    const encoded = encodeAuthBundleManifest(manifestSubset(manifest, [name]));
+    return { name, encoded, bytes: Buffer.byteLength(encoded.payload, "utf8") };
+  });
+
+  const allEncoded = encodeAuthBundleManifest(manifest);
+  if (Buffer.byteLength(allEncoded.payload, "utf8") <= GITHUB_SECRET_SAFE_BYTES) {
+    return [
+      {
+        secretName: AUTH_SECRET_PRIMARY,
+        payload: allEncoded.payload,
+        encoding: allEncoded.encoding,
+        rawBytes: allEncoded.rawBytes,
+        profileNames,
+      },
+    ];
+  }
+
+  const shards = [];
+  let currentNames = [];
+  let currentBytes = 0;
+
+  const flush = () => {
+    if (currentNames.length === 0) return;
+    const encoded = encodeAuthBundleManifest(manifestSubset(manifest, currentNames));
+    const bytes = Buffer.byteLength(encoded.payload, "utf8");
+    if (bytes > GITHUB_SECRET_SAFE_BYTES) {
+      throw new Error(
+        `Profile "${currentNames.join(", ")}" is too large for a GitHub secret on its own ` +
+          `(${bytes} bytes; limit ~${GITHUB_SECRET_SAFE_BYTES}). Try a shorter-lived session.`
+      );
+    }
+    shards.push({
+      secretName: authShardSecretName(shards.length + 1),
+      payload: encoded.payload,
+      encoding: encoded.encoding,
+      rawBytes: encoded.rawBytes,
+      profileNames: [...currentNames],
+    });
+    currentNames = [];
+    currentBytes = 0;
+  };
+
+  for (const row of singles) {
+    if (row.bytes > GITHUB_SECRET_SAFE_BYTES) {
+      throw new Error(
+        `Profile "${row.name}" is too large for a GitHub secret (${row.bytes} bytes; limit ~${GITHUB_SECRET_SAFE_BYTES}).`
+      );
+    }
+    const nextNames = [...currentNames, row.name];
+    const nextEncoded = encodeAuthBundleManifest(manifestSubset(manifest, nextNames));
+    const nextBytes = Buffer.byteLength(nextEncoded.payload, "utf8");
+    if (nextBytes > GITHUB_SECRET_SAFE_BYTES && currentNames.length > 0) {
+      flush();
+    }
+    currentNames.push(row.name);
+    currentBytes = Buffer.byteLength(
+      encodeAuthBundleManifest(manifestSubset(manifest, currentNames)).payload,
+      "utf8"
+    );
+  }
+  flush();
+
+  if (shards.length > MAX_AUTH_SHARDS) {
+    throw new Error(
+      `Auth bundle requires ${shards.length} GitHub secrets (max ${MAX_AUTH_SHARDS}). ` +
+        "Export fewer profiles with --profiles or --suite-id / --ids."
+    );
+  }
+  return shards;
+}
+
+export function collectAuthShardPayloadsFromEnv(env = process.env) {
+  const payloads = [];
+  for (let index = 1; index <= MAX_AUTH_SHARDS; index += 1) {
+    const secretName = authShardSecretName(index);
+    const value = String(env[secretName] || "").trim();
+    if (!value) break;
+    payloads.push({ secretName, payload: value });
+  }
+  return payloads;
+}
+
+export function mergeAuthManifests(manifests) {
+  const mergedProfiles = {};
+  let orgId = "";
+  let projectId = "";
+  for (const manifest of manifests) {
+    orgId = orgId || String(manifest.org_id || "").trim();
+    projectId = projectId || String(manifest.project_id || "").trim();
+    for (const [name, entry] of Object.entries(manifest.profiles || {})) {
+      mergedProfiles[name] = entry;
+    }
+  }
+  return {
+    version: AUTH_BUNDLE_VERSION,
+    org_id: orgId,
+    project_id: projectId,
+    profiles: mergedProfiles,
+  };
+}
+
+export function restoreAuthBundleToDisk({
+  orgId,
+  projectId,
+  manifest,
+  fallbackProfile = "",
+}) {
+  const restored = [];
+  for (const [name, entry] of Object.entries(manifest.profiles || {})) {
+    const localProfileName =
+      String(entry?.local_profile_name || name).trim() || name;
+    const state = entry?.state;
+    if (!isPlaywrightStorageState(state)) {
+      throw new Error(`Profile "${name}" has invalid storage state in auth bundle.`);
+    }
+    const authFile = localAuthStatePath({
+      orgId,
+      projectId,
+      profile: localProfileName,
+    });
+    mkdirSync(join(authFile, ".."), { recursive: true });
+    writeFileSync(authFile, `${JSON.stringify(state)}\n`, "utf8");
+    try {
+      chmodSync(authFile, 0o600);
+    } catch {
+      // ignore
+    }
+    restored.push({ name, localProfileName, path: authFile });
+  }
+  return restored;
+}
+
+export function restoreLegacySingleAuthToDisk({ orgId, projectId, state, fallbackProfile }) {
+  const profile = String(fallbackProfile || "").trim();
+  if (!profile) {
+    throw new Error(
+      "Legacy single-profile auth payload requires QUALTY_AUTH_PROFILE (or --profile)."
+    );
+  }
+  const authFile = localAuthStatePath({ orgId, projectId, profile });
+  mkdirSync(join(authFile, ".."), { recursive: true });
+  writeFileSync(authFile, `${JSON.stringify(state)}\n`, "utf8");
+  try {
+    chmodSync(authFile, 0o600);
+  } catch {
+    // ignore
+  }
+  return [{ name: profile, localProfileName: profile, path: authFile }];
+}
+
+export function restoreAuthPayloadsToDisk({
+  payloads,
+  orgId,
+  projectId,
+  fallbackProfile = "",
+}) {
+  const manifests = [];
+  let legacySingle = null;
+
+  for (const row of payloads) {
+    const decoded = decodeAuthPayload(row.payload);
+    if (decoded.format === "bundle") {
+      manifests.push(decoded.manifest);
+      continue;
+    }
+    if (legacySingle) {
+      throw new Error("Multiple legacy single-profile auth payloads are not supported.");
+    }
+    legacySingle = decoded.state;
+  }
+
+  if (manifests.length > 0) {
+    const merged = mergeAuthManifests(manifests);
+    const effectiveOrgId = String(orgId || merged.org_id || "").trim();
+    const effectiveProjectId = String(projectId || merged.project_id || "").trim();
+    return restoreAuthBundleToDisk({
+      orgId: effectiveOrgId,
+      projectId: effectiveProjectId,
+      manifest: merged,
+      fallbackProfile,
+    });
+  }
+
+  if (legacySingle) {
+    return restoreLegacySingleAuthToDisk({
+      orgId,
+      projectId,
+      state: legacySingle,
+      fallbackProfile,
+    });
+  }
+
+  throw new Error("No auth payloads to restore.");
+}

package/bin/qualty.js

@@ -9,17 +9,25 @@ import {
   readdirSync,
   writeFileSync,
 } from "node:fs";
-import { gzipSync } from "node:zlib";
 import { spawn, spawnSync } from "node:child_process";
 import { homedir, hostname } from "node:os";
 import { dirname, join } from "node:path";
 import { createInterface } from "node:readline/promises";
 import process from "node:process";
 import { rewriteUrlForLocalRun, runLocalCi, summarizeStorageStateFile, logAuthStateDiagnostics } from "./local-runner.js";
-
-/** Default Qualty API base URL (no trailing slash). Override with QUALTY_API_URL env. */
-//const DEFAULT_QUALTY_API_URL = "https://qualty-api-production.up.railway.app";
-const DEFAULT_QUALTY_API_URL = "http://127.0.0.1:8000";
+import {
+  AUTH_PROFILES_VARIABLE,
+  AUTH_SECRET_PRIMARY,
+  AUTH_SHARDS_VARIABLE,
+  authShardSecretName,
+  buildAuthBundleManifest,
+  collectAuthShardPayloadsFromEnv,
+  restoreAuthPayloadsToDisk,
+  shardAuthBundleManifest,
+} from "./auth-ci-bundle.js";
+
+/** CLI backend URL is fixed by Qualty distribution. */
+const DEFAULT_QUALTY_API_URL = "https://qualty-api-production.up.railway.app";
 
 const PROJECT_CONFIG_FILENAME = ".qualty.json";
 const QUALTY_SHARED_CREDS_DIR = join(homedir(), ".qualty");
@@ -66,6 +74,10 @@ function projectIdFromConfig(projectCfg, fallback = "") {
   return String(fallback || projectCfg.default_project_id || "").trim();
 }
 
+function orgIdFromConfig(projectCfg, fallback = "") {
+  return String(fallback || projectCfg.default_org_id || "").trim();
+}
+
 function authProfileFromConfig(projectCfg, fallback = "") {
   return String(fallback || projectCfg.default_auth_profile || "").trim();
 }
@@ -94,9 +106,39 @@ function writeProjectConfig(updates) {
   writeFileSync(configPath, `${JSON.stringify(next, null, 2)}\n`, "utf8");
 }
 
+function normalizeApiUrl(raw, { label = "API URL" } = {}) {
+  const trimmed = String(raw || "").trim();
+  if (!trimmed) {
+    throw new Error(`${label} is empty.`);
+  }
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    throw new Error(`${label} is not a valid URL: ${trimmed}`);
+  }
+  if (!["http:", "https:"].includes(parsed.protocol)) {
+    throw new Error(`${label} must use http or https (got ${parsed.protocol}).`);
+  }
+  return trimmed.replace(/\/$/, "");
+}
+
+function qualtyBaseUrlFromEnv() {
+  return String(process.env.QUALTY_BASE_URL || process.env.QUALTY_API_URL || "").trim();
+}
+
 function resolveApiUrl(args = {}) {
-  void args;
-  return String(process.env.QUALTY_API_URL || DEFAULT_QUALTY_API_URL).replace(/\/$/, "");
+  const fromFlag = String(args.url || args["api-url"] || "").trim();
+  const fromEnv = qualtyBaseUrlFromEnv();
+  const raw = fromFlag || fromEnv || DEFAULT_QUALTY_API_URL;
+  const label = fromFlag
+    ? "--url"
+    : process.env.QUALTY_BASE_URL
+      ? "QUALTY_BASE_URL"
+      : fromEnv
+        ? "QUALTY_API_URL"
+        : "default API URL";
+  return normalizeApiUrl(raw, { label });
 }
 
 function resolveToken(args = {}) {
@@ -106,7 +148,7 @@ function resolveToken(args = {}) {
 
 function resolveOrgId(args = {}) {
   const projectCfg = readProjectConfig();
-  return args.org || process.env.QUALTY_ORG_ID || projectCfg.default_org_id || "";
+  return orgIdFromConfig(projectCfg, args.org);
 }
 
 function maskSecret(secret) {
@@ -145,11 +187,15 @@ function usage() {
       "Usage:",
       "  qualty setup [--token <bearer-token>] [--org <org-id>]",
       "  qualty auth setup [--project <project-id>] [--profile <profile-name>] [--headed]",
-      "  qualty auth export-ci --project <project-id> [--profile <profile-name>] [--org <org-id>]",
-      "                   [--suite-id <suite-uuid>] [--repo <owner/repo>]",
+      "  qualty auth export-ci [--project <project-id>] [--profile <profile-name>] [--org <org-id>]",
+      "                   [--all-profiles] [--profiles <name1,name2>]",
+      "                   [--suite-id <suite-uuid>] [--ids <id1,id2>]  export profiles required by tests",
+      "                   [--url <api-base-url>] [--repo <owner/repo>]",
       "                   [--output <path>] [--no-file] [--copy] [--gzip] [--include-token]",
-      "                   [--set-secret | --set-github]  gh: secrets (token, API URL, auth) + variables (org, project, profile, …)",
+      "                   [--set-secret | --set-github]  gh: secrets (token, API URL, auth bundle) + variables",
       "                   [--cli-repo <owner/repo>] [--cli-ref <branch>]  Optional CI variables",
+      "  qualty auth restore-ci [--org <org-id>] [--project <project-id>] [--profile <fallback-profile>]",
+      "                   Reads QUALTY_AUTH_STATE_B64 (+ _2, _3, … shards) and writes ~/.qualty/local-contexts/…",
       "  qualty connect --project <project-id> [--port 3000] [--token <bearer-token>] [--org <org-id>]",
       "  qualty run --project <project-id> [--suite-id <suite-id>] [--ids <id1,id2>] [--local] [--token <bearer-token>] [--org <org-id>]",
       "             [--poll-interval 5] [--timeout 30] [--fail-on-failure true] [--no-view-logs]",
@@ -161,9 +207,11 @@ function usage() {
       "",
       "Env vars:",
       "  QUALTY_API_TOKEN  Bearer token used for auth",
-      "  QUALTY_API_URL    API base URL (default: bundled CLI default)",
-      "  QUALTY_ORG_ID     Org context override (default: .qualty.json default_org_id)",
+      "  QUALTY_BASE_URL   API base URL when --url is not set (default: production)",
       "  QUALTY_LOCAL_CONCURRENCY  Local parallel workers for --local runs (default: 4)",
+      "",
+      "Config (.qualty.json): default_org_id, default_project_id, default_auth_profile",
+      "  CLI flags (--org, --project, --profile, --url) override config values.",
     ].join("\n")
   );
 }
@@ -371,7 +419,7 @@ async function runSetup(args) {
     let currentOrgName = "";
     try {
       const orgResp = await apiRequest({
-        apiUrl: resolveApiUrl({}, {}),
+        apiUrl: resolveApiUrl({}),
         token,
         orgId: "",
         path: "/api/v1/orgs",
@@ -440,7 +488,7 @@ async function runSetup(args) {
     }
 
     if (!orgId) {
-      throw new Error("Org ID is required. Re-run setup and provide QUALTY_ORG_ID.");
+      throw new Error("Org ID is required. Re-run setup and enter your org ID when prompted.");
     }
 
     writeSharedCredentials(token);
@@ -498,8 +546,6 @@ function authExportCiOutputPath(statePath) {
   return statePath.replace(/\.json$/i, ".b64");
 }
 
-const GITHUB_SECRET_MAX_BYTES = 64 * 1024;
-
 function copyToClipboard(text) {
   if (process.platform === "darwin") {
     const result = spawnSync("pbcopy", { input: text, encoding: "utf8" });
@@ -565,7 +611,8 @@ function syncGithubCiConfig({
   orgId,
   projectId,
   profile,
-  authPayload,
+  profileNames,
+  authShards,
   apiUrl,
   token,
   suiteId,
@@ -577,8 +624,9 @@ function syncGithubCiConfig({
     results.push({ kind, name, ...outcome });
   };
 
-  const authResult = setGithubSecret("QUALTY_AUTH_STATE_B64", authPayload, { repo });
-  record("secret", "QUALTY_AUTH_STATE_B64", authResult);
+  for (const shard of authShards || []) {
+    record("secret", shard.secretName, setGithubSecret(shard.secretName, shard.payload, { repo }));
+  }
 
   if (token) {
     record("secret", "QUALTY_API_TOKEN", setGithubSecret("QUALTY_API_TOKEN", token, { repo }));
@@ -590,19 +638,27 @@ function syncGithubCiConfig({
   }
 
   const apiUrlNorm = String(apiUrl || "").replace(/\/$/, "");
-  const isLocalDefault = apiUrlNorm === "http://127.0.0.1:8000";
-  if (apiUrlNorm && !isLocalDefault) {
-    record("secret", "QUALTY_API_URL", setGithubSecret("QUALTY_API_URL", apiUrlNorm, { repo }));
-  } else {
-    record("secret", "QUALTY_API_URL", {
-      ok: false,
-      reason: "Set QUALTY_API_URL to your dev/prod API (not localhost) before export-ci.",
-    });
+  if (apiUrlNorm) {
+    record("secret", "QUALTY_BASE_URL", setGithubSecret("QUALTY_BASE_URL", apiUrlNorm, { repo }));
   }
 
   record("variable", "QUALTY_ORG_ID", setGithubVariable("QUALTY_ORG_ID", orgId, { repo }));
   record("variable", "QUALTY_PROJECT_ID", setGithubVariable("QUALTY_PROJECT_ID", String(projectId), { repo }));
-  record("variable", "QUALTY_AUTH_PROFILE", setGithubVariable("QUALTY_AUTH_PROFILE", profile, { repo }));
+
+  const names = (profileNames || []).filter(Boolean);
+  if (names.length > 0) {
+    record("variable", AUTH_PROFILES_VARIABLE, setGithubVariable(AUTH_PROFILES_VARIABLE, names.join(","), { repo }));
+  }
+  if (profile) {
+    record("variable", "QUALTY_AUTH_PROFILE", setGithubVariable("QUALTY_AUTH_PROFILE", profile, { repo }));
+  }
+  if ((authShards || []).length > 1) {
+    record(
+      "variable",
+      AUTH_SHARDS_VARIABLE,
+      setGithubVariable(AUTH_SHARDS_VARIABLE, String(authShards.length), { repo })
+    );
+  }
 
   if (suiteId) {
     record("variable", "QUALTY_SUITE_ID", setGithubVariable("QUALTY_SUITE_ID", String(suiteId), { repo }));
@@ -649,123 +705,425 @@ function printGithubSyncResults(results, { repo }) {
   console.log("");
 }
 
-function encodeAuthStateForGithubSecret(statePath, { gzip = false } = {}) {
-  const raw = readFileSync(statePath);
-  if (gzip) {
-    return {
-      encoding: "gzip+base64",
-      payload: gzipSync(raw).toString("base64"),
-      rawBytes: raw.length,
-    };
+function readProjectConfigStrict() {
+  const configPath = findProjectConfigPath();
+  if (!configPath) {
+    return { configPath: null, config: {} };
   }
+  let raw;
+  try {
+    raw = readFileSync(configPath, "utf8");
+  } catch (err) {
+    throw new Error(
+      `Could not read ${PROJECT_CONFIG_FILENAME} at ${configPath}: ${err.message}`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(
+      [
+        `Invalid ${PROJECT_CONFIG_FILENAME} at ${configPath}: ${err.message}`,
+        "Fix the JSON syntax or pass --org, --project, and --profile on the command line.",
+      ].join("\n")
+    );
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(
+      [
+        `Invalid ${PROJECT_CONFIG_FILENAME} at ${configPath}: expected a JSON object.`,
+        "Fix the file or pass --org, --project, and --profile on the command line.",
+      ].join("\n")
+    );
+  }
+  return { configPath, config: parsed };
+}
+
+function configStringValue(projectCfg, key, configPath) {
+  const value = projectCfg[key];
+  if (value === undefined || value === null || value === "") return "";
+  if (typeof value === "string" || typeof value === "number") {
+    return String(value).trim();
+  }
+  const where = configPath
+    ? `${PROJECT_CONFIG_FILENAME} at ${configPath}`
+    : PROJECT_CONFIG_FILENAME;
+  throw new Error(
+    `Invalid ${key} in ${where}: expected a string or number, got ${typeof value}.`
+  );
+}
+
+function missingExportCiField(fieldLabel, { flag, configKey, configPath, hasFlag }) {
+  const configHint = configPath
+    ? `${PROJECT_CONFIG_FILENAME} at ${configPath} (${configKey})`
+    : `${PROJECT_CONFIG_FILENAME} (not found walking up from ${process.cwd()})`;
+  if (hasFlag) {
+    return [
+      `Missing ${fieldLabel}: ${flag} was empty.`,
+      `Set ${configKey} in ${configHint} or pass a non-empty ${flag}.`,
+    ].join(" ");
+  }
+  return [
+    `Missing ${fieldLabel}.`,
+    `Pass ${flag} or set ${configKey} in ${configHint}.`,
+  ].join(" ");
+}
+
+function resolveExportCiConfig(args, { requireProfile = true } = {}) {
+  const { configPath, config: projectCfg } = readProjectConfigStrict();
+
+  const orgFromFlag = String(args.org || "").trim();
+  const projectFromFlag = String(args.project || "").trim();
+  const profileFromFlag = String(args.profile || args["auth-profile"] || "").trim();
+  const allProfiles = parseBoolean(args["all-profiles"], false);
+  const profilesList = String(args.profiles || "")
+    .split(",")
+    .map((part) => part.trim())
+    .filter(Boolean);
+  const suiteId = String(args["suite-id"] || args.suite || "").trim();
+  const explicitIds = String(args.ids || "")
+    .split(",")
+    .map((part) => part.trim())
+    .filter(Boolean);
+
+  let orgId = orgFromFlag;
+  if (!orgId) {
+    orgId = configStringValue(projectCfg, "default_org_id", configPath);
+  }
+
+  let projectId = projectFromFlag;
+  if (!projectId) {
+    projectId = configStringValue(projectCfg, "default_project_id", configPath);
+  }
+
+  let profile = profileFromFlag;
+  if (!profile) {
+    profile = configStringValue(projectCfg, "default_auth_profile", configPath);
+  }
+
+  if (!orgId) {
+    throw new Error(
+      missingExportCiField("org ID", {
+        flag: "--org",
+        configKey: "default_org_id",
+        configPath,
+        hasFlag: Boolean(orgFromFlag),
+      })
+    );
+  }
+  if (!projectId) {
+    throw new Error(
+      missingExportCiField("project ID", {
+        flag: "--project",
+        configKey: "default_project_id",
+        configPath,
+        hasFlag: Boolean(projectFromFlag),
+      })
+    );
+  }
+
+  const hasMultiProfileMode =
+    allProfiles || profilesList.length > 0 || Boolean(suiteId) || explicitIds.length > 0;
+  if (requireProfile && !profile && !hasMultiProfileMode) {
+    throw new Error(
+      missingExportCiField("auth profile", {
+        flag: "--profile",
+        configKey: "default_auth_profile",
+        configPath,
+        hasFlag: Boolean(profileFromFlag),
+      })
+    );
+  }
+
+  let apiUrl;
+  try {
+    apiUrl = resolveApiUrl(args);
+  } catch (err) {
+    throw new Error(`Invalid API URL: ${err.message}`);
+  }
+
   return {
-    encoding: "base64",
-    payload: raw.toString("base64"),
-    rawBytes: raw.length,
+    orgId,
+    projectId,
+    profile,
+    apiUrl,
+    configPath,
+    allProfiles,
+    profilesList,
+    suiteId,
+    explicitIds,
   };
 }
 
-function githubAuthRestoreShell({ orgId, projectId, profile }) {
-  const orgSeg = safePathSegment(orgId, "default-org");
-  const projectSeg = safePathSegment(projectId, "default-project");
-  const profileSeg = safePathSegment(profile, "default");
+function jobUsesSavedLogin(job) {
+  if (!job) return false;
+  if (job.use_saved_login) return true;
+  if (job.saved_login_profile_id) return true;
+  const profile = job.saved_login_profile;
+  return Boolean(profile && typeof profile === "object" && (profile.id || profile.name));
+}
+
+async function fetchSavedLoginProfilesForProject({ apiUrl, token, orgId, projectId }) {
+  const payload = await apiRequest({
+    apiUrl,
+    token,
+    orgId,
+    path: `/api/v1/projects/${encodeURIComponent(String(projectId))}/saved-login-profiles`,
+  }).catch(() => []);
+  return Array.isArray(payload) ? payload : [];
+}
+
+function localProfileLabelFromApiRow(row, fallbackName = "") {
+  return String(row?.local_profile_name || row?.name || fallbackName || "").trim();
+}
+
+async function resolveRequiredProfileNamesFromTests({
+  apiUrl,
+  token,
+  orgId,
+  projectId,
+  suiteId,
+  explicitIds,
+}) {
+  const jobsPayload = await resolveSavedJobs({
+    apiUrl,
+    token,
+    orgId,
+    projectId,
+    suiteId,
+    explicitIds,
+  });
+  const jobs = Array.isArray(jobsPayload)
+    ? jobsPayload
+    : Array.isArray(jobsPayload?.results)
+      ? jobsPayload.results
+      : Array.isArray(jobsPayload?.jobs)
+        ? jobsPayload.jobs
+        : [];
+  const names = new Set();
+  for (const job of jobs) {
+    if (!jobUsesSavedLogin(job)) continue;
+    const name = String(job?.saved_login_profile?.name || "").trim();
+    if (name) names.add(name);
+  }
+  return [...names];
+}
+
+async function resolveExportProfileEntries({
+  orgId,
+  projectId,
+  profile,
+  allProfiles,
+  profilesList,
+  suiteId,
+  explicitIds,
+  apiUrl,
+  token,
+}) {
+  const apiProfiles = token
+    ? await fetchSavedLoginProfilesForProject({ apiUrl, token, orgId, projectId })
+    : [];
+
+  let requestedNames = [];
+  if (allProfiles) {
+    requestedNames = apiProfiles.map((row) => String(row?.name || "").trim()).filter(Boolean);
+    if (requestedNames.length === 0) {
+      requestedNames = listLocalAuthProfiles({ orgId, projectId });
+    }
+  } else if (profilesList.length > 0) {
+    requestedNames = profilesList;
+  } else if (suiteId || explicitIds.length > 0) {
+    if (!token) {
+      throw new Error("QUALTY_API_TOKEN is required to resolve profiles from --suite-id or --ids.");
+    }
+    requestedNames = await resolveRequiredProfileNamesFromTests({
+      apiUrl,
+      token,
+      orgId,
+      projectId,
+      suiteId,
+      explicitIds,
+    });
+    if (requestedNames.length === 0 && profile) {
+      requestedNames = [profile];
+    }
+  } else if (profile) {
+    requestedNames = [profile];
+  }
+
+  requestedNames = [...new Set(requestedNames.filter(Boolean))];
+  if (requestedNames.length === 0) {
+    throw new Error(
+      "No auth profiles selected. Pass --profile, --profiles, --all-profiles, or --suite-id / --ids."
+    );
+  }
+
+  const entries = [];
+  const missing = [];
+  for (const dashboardName of requestedNames) {
+    const apiRow = apiProfiles.find((row) => String(row?.name || "").trim() === dashboardName);
+    const localProfileName = localProfileLabelFromApiRow(apiRow, dashboardName) || dashboardName;
+    const statePath = localAuthStatePath({ orgId, projectId, profile: localProfileName });
+    if (!existsSync(statePath)) {
+      missing.push({ dashboardName, localProfileName, statePath });
+      continue;
+    }
+    entries.push({
+      name: dashboardName,
+      localProfileName,
+      statePath,
+    });
+  }
+
+  if (missing.length > 0) {
+    const lines = missing.map(
+      (row) =>
+        `  - "${row.dashboardName}" → ${row.statePath}\n    qualty auth setup --project ${projectId} --profile "${row.dashboardName}"`
+    );
+    throw new Error(["Local auth state missing for:", ...lines].join("\n"));
+  }
+
+  return entries;
+}
+
+function githubAuthRestoreShell({ shardCount = 1 } = {}) {
+  const shardEnvLines = [];
+  for (let index = 1; index <= Math.max(1, shardCount); index += 1) {
+    const secretName = authShardSecretName(index);
+    shardEnvLines.push(`    ${secretName}: \${{ secrets.${secretName} }}`);
+  }
   return [
-    `- name: Restore Qualty login state`,
+    `- name: Restore Qualty login states`,
     `  env:`,
-    `    QUALTY_AUTH_STATE_B64: \${{ secrets.QUALTY_AUTH_STATE_B64 }}`,
-    `  run: |`,
-    `    AUTH_DIR="$HOME/.qualty/local-contexts/${orgSeg}/${projectSeg}"`,
-    `    mkdir -p "$AUTH_DIR"`,
-    `    echo "$QUALTY_AUTH_STATE_B64" | base64 -d | gunzip > "$AUTH_DIR/${profileSeg}.json"`,
-    `    test -s "$AUTH_DIR/${profileSeg}.json"`,
+    ...shardEnvLines,
+    `    QUALTY_ORG_ID: \${{ vars.QUALTY_ORG_ID }}`,
+    `    QUALTY_PROJECT_ID: \${{ vars.QUALTY_PROJECT_ID }}`,
+    `  run: npx --yes qualty auth restore-ci`,
     ``,
-    `- name: Run Qualty (local)`,
+    `- name: Run Qualty tests (local)`,
     `  env:`,
     `    QUALTY_API_TOKEN: \${{ secrets.QUALTY_API_TOKEN }}`,
-    `    QUALTY_ORG_ID: \${{ vars.QUALTY_ORG_ID }}`,
+    `    QUALTY_BASE_URL: \${{ secrets.QUALTY_BASE_URL }}`,
     `  run: |`,
-    `    npx qualty@latest run --local \\`,
-    `      --project ${projectId} \\`,
-    `      --suite-id YOUR_SUITE_UUID \\`,
-    `      --auth-profile "${profile}" \\`,
+    `    npx --yes qualty run --local \\`,
+    `      --org "$QUALTY_ORG_ID" \\`,
+    `      --project "$QUALTY_PROJECT_ID" \\`,
+    `      --suite-id "YOUR-SUITE-UUID" \\`,
     `      --fail-on-failure true`,
+    `    # Omit --auth-profile when tests use different saved login profiles.`,
+    `    # Add --auth-profile "Profile Name" only to force one profile for the whole run.`,
   ].join("\n");
 }
 
-async function runAuthExportCi(args) {
-  const orgId = resolveOrgId(args);
-  const token = resolveToken(args);
-  const projectCfg = readProjectConfig();
-  const projectId = projectIdFromConfig(projectCfg, args.project);
-  const profile = authProfileFromConfig(
-    projectCfg,
-    args.profile || args["auth-profile"]
-  );
+async function runAuthRestoreCi(args) {
+  const orgId = String(args.org || process.env.QUALTY_ORG_ID || "").trim();
+  const projectId = String(args.project || process.env.QUALTY_PROJECT_ID || "").trim();
+  const fallbackProfile = String(
+    args.profile || args["auth-profile"] || process.env.QUALTY_AUTH_PROFILE || ""
+  ).trim();
 
   if (!orgId) {
-    throw new Error("Missing org. Pass --org, set QUALTY_ORG_ID, or add default_org_id to .qualty.json.");
+    throw new Error("Missing org ID. Set QUALTY_ORG_ID or pass --org.");
   }
   if (!projectId) {
-    throw new Error("Missing project. Pass --project (or run qualty auth setup first).");
-  }
-  if (!profile) {
-    throw new Error('Missing profile. Pass --profile "your-profile" (or run qualty auth setup first).');
+    throw new Error("Missing project ID. Set QUALTY_PROJECT_ID or pass --project.");
   }
 
-  const statePath = localAuthStatePath({ orgId, projectId, profile });
-  if (!existsSync(statePath)) {
+  const payloads = collectAuthShardPayloadsFromEnv(process.env);
+  if (payloads.length === 0) {
     throw new Error(
-      [
-        `Local auth state not found:`,
-        `  ${statePath}`,
-        "",
-        "Create it first:",
-        `  qualty auth setup --project ${projectId} --profile "${profile}"`,
-      ].join("\n")
+      `Missing ${AUTH_SECRET_PRIMARY}. Run qualty auth export-ci --set-github from your app repo.`
     );
   }
 
-  const setGithubFlag =
-    parseBoolean(args["set-github"], false) || parseBoolean(args["set-secret"], false);
-  // CI path: one format only — gzip then base64 in QUALTY_AUTH_STATE_B64 (no separate gzip flag).
-  let gzip = parseBoolean(args.gzip, false) || setGithubFlag;
-  let encoded = encodeAuthStateForGithubSecret(statePath, { gzip });
-  let secretBytes = Buffer.byteLength(encoded.payload, "utf8");
-  if (!gzip && secretBytes > GITHUB_SECRET_MAX_BYTES - 1024) {
-    gzip = true;
-    encoded = encodeAuthStateForGithubSecret(statePath, { gzip: true });
-    secretBytes = Buffer.byteLength(encoded.payload, "utf8");
-  }
-  if (secretBytes > GITHUB_SECRET_MAX_BYTES - 1024) {
-    throw new Error(
-      `Auth state is too large for a GitHub secret (${secretBytes} bytes; limit ~64 KB). ` +
-        "Try a shorter-lived session, fewer cookies, or contact Qualty support."
-    );
+  const restored = restoreAuthPayloadsToDisk({
+    payloads,
+    orgId,
+    projectId,
+    fallbackProfile,
+  });
+
+  for (const row of restored) {
+    // eslint-disable-next-line no-console
+    console.log(`Restored login state: ${row.path} (profile "${row.name}")`);
   }
+  // eslint-disable-next-line no-console
+  console.log(`Restored ${restored.length} login profile(s).`);
+}
 
+async function runAuthExportCi(args) {
+  const {
+    orgId,
+    projectId,
+    profile,
+    apiUrl,
+    configPath,
+    allProfiles,
+    profilesList,
+    suiteId: exportSuiteId,
+    explicitIds,
+  } = resolveExportCiConfig(args);
+  const token = resolveToken(args);
+
+  const profileEntries = await resolveExportProfileEntries({
+    orgId,
+    projectId,
+    profile,
+    allProfiles,
+    profilesList,
+    suiteId: exportSuiteId,
+    explicitIds,
+    apiUrl,
+    token,
+  });
+  const profileNames = profileEntries.map((entry) => entry.name);
+  const primaryProfile = profile || profileNames[0] || "";
+
+  const manifest = buildAuthBundleManifest({ orgId, projectId, profileEntries });
+  const authShards = shardAuthBundleManifest(manifest);
+  const primaryShard = authShards[0];
+
+  const setGithubFlag =
+    parseBoolean(args["set-github"], false) || parseBoolean(args["set-secret"], false);
   const noFile = parseBoolean(args["no-file"], false);
   const outputPath = noFile
     ? String(args.output || "").trim()
-    : String(args.output || "").trim() || authExportCiOutputPath(statePath);
+    : String(args.output || "").trim() ||
+      authExportCiOutputPath(
+        localAuthStatePath({ orgId, projectId, profile: profileEntries[0].localProfileName })
+      );
   const copyToClipboardFlag = parseBoolean(args.copy, false);
   const githubRepo = String(args.repo || "").trim();
-  const suiteId = String(args["suite-id"] || args.suite || "").trim();
+  const suiteId = String(args["suite-id"] || args.suite || exportSuiteId || "").trim();
   const cliRepo = String(args["cli-repo"] || "").trim();
   const cliRef = String(args["cli-ref"] || "").trim();
-  const apiUrl = resolveApiUrl(args);
 
   if (outputPath) {
-    writeFileSync(outputPath, encoded.payload, "utf8");
+    writeFileSync(outputPath, primaryShard.payload, "utf8");
     try {
       chmodSync(outputPath, 0o600);
     } catch {
       // ignore platforms that do not support chmod
     }
+    for (let index = 1; index < authShards.length; index += 1) {
+      const shard = authShards[index];
+      const shardPath = outputPath.replace(/(\.[^./]+)?$/, `_${index + 1}$1`);
+      writeFileSync(shardPath, shard.payload, "utf8");
+      try {
+        chmodSync(shardPath, 0o600);
+      } catch {
+        // ignore
+      }
+    }
   }
 
   const includeToken = parseBoolean(args["include-token"], false);
-  const profileSeg = safePathSegment(profile, "default");
   const skipPayloadPrint = Boolean(outputPath || copyToClipboardFlag || setGithubFlag);
+  const totalSecretBytes = authShards.reduce(
+    (sum, shard) => sum + Buffer.byteLength(shard.payload, "utf8"),
+    0
+  );
 
   // eslint-disable-next-line no-console
   console.log("");
@@ -773,20 +1131,29 @@ async function runAuthExportCi(args) {
   console.log("=== Qualty → GitHub Actions (secrets & variables) ===");
   // eslint-disable-next-line no-console
   console.log("");
-  if (encoded.encoding === "gzip+base64") {
-    // eslint-disable-next-line no-console
-    console.log(`Auth state: gzip+base64 (${encoded.rawBytes} bytes raw → ${secretBytes} bytes secret)`);
-  } else {
+  // eslint-disable-next-line no-console
+  console.log(
+    `Auth bundle: ${profileNames.length} profile(s), ${authShards.length} secret shard(s), ${totalSecretBytes} bytes total`
+  );
+  for (const shard of authShards) {
     // eslint-disable-next-line no-console
-    console.log(`Auth state: base64 (${encoded.rawBytes} bytes raw → ${secretBytes} bytes secret)`);
+    console.log(
+      `  - ${shard.secretName}: ${shard.profileNames.join(", ")} (${Buffer.byteLength(shard.payload, "utf8")} bytes)`
+    );
   }
   // eslint-disable-next-line no-console
   console.log("");
   if (outputPath) {
     // eslint-disable-next-line no-console
-    console.log(`Wrote QUALTY_AUTH_STATE_B64 to ${outputPath}`);
+    console.log(`Wrote ${AUTH_SECRET_PRIMARY} to ${outputPath}`);
+    for (let index = 1; index < authShards.length; index += 1) {
+      const shard = authShards[index];
+      const shardPath = outputPath.replace(/(\.[^./]+)?$/, `_${index + 1}$1`);
+      // eslint-disable-next-line no-console
+      console.log(`Wrote ${shard.secretName} to ${shardPath}`);
+    }
     // eslint-disable-next-line no-console
-    console.log(`  gh secret set QUALTY_AUTH_STATE_B64 < ${outputPath}`);
+    console.log(`  gh secret set ${AUTH_SECRET_PRIMARY} < ${outputPath}`);
     // eslint-disable-next-line no-console
     console.log("");
   }
@@ -795,8 +1162,9 @@ async function runAuthExportCi(args) {
       repo: githubRepo,
       orgId,
       projectId,
-      profile,
-      authPayload: encoded.payload,
+      profile: primaryProfile,
+      profileNames,
+      authShards,
       apiUrl,
       token,
       suiteId,
@@ -804,25 +1172,27 @@ async function runAuthExportCi(args) {
       cliRef,
     });
     printGithubSyncResults(syncResults, { repo: githubRepo });
-    const authRow = syncResults.find((r) => r.name === "QUALTY_AUTH_STATE_B64");
-    if (!authRow?.ok && outputPath) {
+    const failedAuth = syncResults.filter((row) => row.kind === "secret" && !row.ok);
+    if (failedAuth.length > 0 && outputPath) {
       // eslint-disable-next-line no-console
-      console.log(`  Manual auth secret: gh secret set QUALTY_AUTH_STATE_B64 < ${outputPath}`);
+      console.log("  Manual auth secrets:");
+      authShards.forEach((shard, index) => {
+        const shardPath =
+          index === 0 ? outputPath : outputPath.replace(/(\.[^./]+)?$/, `_${index + 1}$1`);
+        // eslint-disable-next-line no-console
+        console.log(`    gh secret set ${shard.secretName} < ${shardPath}`);
+      });
       // eslint-disable-next-line no-console
       console.log("");
     }
   }
   if (copyToClipboardFlag) {
-    if (copyToClipboard(encoded.payload)) {
+    if (copyToClipboard(primaryShard.payload)) {
       // eslint-disable-next-line no-console
-      console.log("✓ Copied QUALTY_AUTH_STATE_B64 to clipboard. Paste into GitHub → Settings → Secrets.");
+      console.log(`✓ Copied ${AUTH_SECRET_PRIMARY} to clipboard.`);
     } else {
       // eslint-disable-next-line no-console
       console.log("Could not copy to clipboard on this machine.");
-      if (outputPath) {
-        // eslint-disable-next-line no-console
-        console.log(`  Use the file instead: ${outputPath}`);
-      }
     }
     // eslint-disable-next-line no-console
     console.log("");
@@ -832,10 +1202,16 @@ async function runAuthExportCi(args) {
     console.log(
       "1. GitHub Actions config was pushed via gh (secrets + repository variables — see sync above). Fix any ✗ manually."
     );
-    if (!suiteId) {
+    if (!suiteId && !exportSuiteId && explicitIds.length === 0) {
       // eslint-disable-next-line no-console
       console.log(
-        "   Tip: re-run with --suite-id <uuid> to set QUALTY_SUITE_ID (or set it in the GitHub UI)."
+        "   Tip: pass --suite-id or --ids to export only login profiles required by those tests."
+      );
+    }
+    if (authShards.length > 1) {
+      // eslint-disable-next-line no-console
+      console.log(
+        `   Auth was split across ${authShards.length} secrets. Add optional shard env vars to your workflow restore step.`
       );
     }
     // eslint-disable-next-line no-console
@@ -870,13 +1246,35 @@ async function runAuthExportCi(args) {
     // eslint-disable-next-line no-console
     console.log("---");
     // eslint-disable-next-line no-console
-    console.log("Name:  QUALTY_AUTH_PROFILE");
+    console.log(`Name:  ${AUTH_PROFILES_VARIABLE}`);
     // eslint-disable-next-line no-console
     console.log("Value:");
     // eslint-disable-next-line no-console
-    console.log(profile);
+    console.log(profileNames.join(","));
     // eslint-disable-next-line no-console
-    console.log(`  gh variable set QUALTY_AUTH_PROFILE --body "${profile}"`);
+    console.log(`  gh variable set ${AUTH_PROFILES_VARIABLE} --body "${profileNames.join(",")}"`);
+    if (primaryProfile) {
+      // eslint-disable-next-line no-console
+      console.log("---");
+      // eslint-disable-next-line no-console
+      console.log("Name:  QUALTY_AUTH_PROFILE");
+      // eslint-disable-next-line no-console
+      console.log("Value:");
+      // eslint-disable-next-line no-console
+      console.log(primaryProfile);
+      // eslint-disable-next-line no-console
+      console.log(`  gh variable set QUALTY_AUTH_PROFILE --body "${primaryProfile}"`);
+    }
+    if (authShards.length > 1) {
+      // eslint-disable-next-line no-console
+      console.log("---");
+      // eslint-disable-next-line no-console
+      console.log(`Name:  ${AUTH_SHARDS_VARIABLE}`);
+      // eslint-disable-next-line no-console
+      console.log("Value:");
+      // eslint-disable-next-line no-console
+      console.log(String(authShards.length));
+    }
     // eslint-disable-next-line no-console
     console.log("---");
     // eslint-disable-next-line no-console
@@ -917,20 +1315,20 @@ async function runAuthExportCi(args) {
       // eslint-disable-next-line no-console
       console.log("(create in Qualty → Account → API tokens; must start with qlty_ci_)");
     }
-    // eslint-disable-next-line no-console
-    console.log("---");
-    // eslint-disable-next-line no-console
-    console.log("Name:  QUALTY_AUTH_STATE_B64");
-    if (skipPayloadPrint) {
+    for (const shard of authShards) {
       // eslint-disable-next-line no-console
-      console.log(
-        `Value: (see file above${copyToClipboardFlag ? " or clipboard" : ""})`
-      );
-    } else {
-      // eslint-disable-next-line no-console
-      console.log("Value:");
+      console.log("---");
       // eslint-disable-next-line no-console
-      console.log(encoded.payload);
+      console.log(`Name:  ${shard.secretName}`);
+      if (skipPayloadPrint) {
+        // eslint-disable-next-line no-console
+        console.log(`Value: (see file above${copyToClipboardFlag && shard.secretName === AUTH_SECRET_PRIMARY ? " or clipboard" : ""})`);
+      } else {
+        // eslint-disable-next-line no-console
+        console.log("Value:");
+        // eslint-disable-next-line no-console
+        console.log(shard.payload);
+      }
     }
     // eslint-disable-next-line no-console
     console.log("---");
@@ -944,17 +1342,24 @@ async function runAuthExportCi(args) {
   // eslint-disable-next-line no-console
   console.log("");
   // eslint-disable-next-line no-console
-  console.log(githubAuthRestoreShell({ orgId, projectId, profile }));
+  console.log(githubAuthRestoreShell({ shardCount: authShards.length }));
   // eslint-disable-next-line no-console
   console.log("");
-  // eslint-disable-next-line no-console
-  console.log(`Local file: ${statePath}`);
-  // eslint-disable-next-line no-console
-  console.log(`Profile flag: --auth-profile "${profile}" (file on disk: ${profileSeg}.json)`);
+  for (const entry of profileEntries) {
+    // eslint-disable-next-line no-console
+    console.log(`Profile "${entry.name}" → ${entry.statePath}`);
+  }
+  if (profileNames.length === 1) {
+    // eslint-disable-next-line no-console
+    console.log(`Optional override: --auth-profile "${profileNames[0]}"`);
+  } else {
+    // eslint-disable-next-line no-console
+    console.log("Omit --auth-profile in CI so each test uses its dashboard saved login profile.");
+  }
   // eslint-disable-next-line no-console
   console.log("");
   // eslint-disable-next-line no-console
-  console.log("When login expires, re-run qualty auth setup and qualty auth export-ci to refresh the secret.");
+  console.log("When login expires, re-run qualty auth setup and qualty auth export-ci to refresh secrets.");
   // eslint-disable-next-line no-console
   console.log("");
 }
@@ -2100,7 +2505,11 @@ async function main() {
       await runAuthExportCi(args);
       return;
     }
-    throw new Error("Unknown auth subcommand. Use: qualty auth setup | qualty auth export-ci");
+    if (sub === "restore-ci") {
+      await runAuthRestoreCi(args);
+      return;
+    }
+    throw new Error("Unknown auth subcommand. Use: qualty auth setup | qualty auth export-ci | qualty auth restore-ci");
   }
   if (command === "run") {
     if (parseBoolean(args.local, false)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qualty",
-  "version": "0.1.21",
+  "version": "0.1.25",
   "description": "Qualty CLI for localhost and CI test runs",
   "bin": {
     "qualty": "bin/qualty.js"