qualty 0.1.27 → 0.1.30

package/bin/qualty.js

@@ -9,28 +9,19 @@ import {
   readdirSync,
   writeFileSync,
 } from "node:fs";
+import { gzipSync } from "node:zlib";
 import { spawn, spawnSync } from "node:child_process";
 import { homedir, hostname } from "node:os";
 import { dirname, join } from "node:path";
 import { createInterface } from "node:readline/promises";
 import process from "node:process";
 import { rewriteUrlForLocalRun, runLocalCi, summarizeStorageStateFile, logAuthStateDiagnostics } from "./local-runner.js";
-import {
-  AUTH_PROFILES_VARIABLE,
-  AUTH_SECRET_PRIMARY,
-  AUTH_SHARDS_VARIABLE,
-  authShardSecretName,
-  buildAuthBundleManifest,
-  collectAuthShardPayloadsFromEnv,
-  restoreAuthPayloadsToDisk,
-  shardAuthBundleManifest,
-} from "./auth-ci-bundle.js";
 
 /** CLI backend URL is fixed by Qualty distribution. */
 const DEFAULT_QUALTY_API_URL = "https://qualty-api-production.up.railway.app";
+// const DEFAULT_QUALTY_API_URL = "http://localhost:8000";
 
 const PROJECT_CONFIG_FILENAME = ".qualty.json";
-const DOTENV_FILENAME = ".env";
 const QUALTY_SHARED_CREDS_DIR = join(homedir(), ".qualty");
 const QUALTY_SHARED_CREDS_PATH = join(QUALTY_SHARED_CREDS_DIR, "credentials");
 
@@ -49,47 +40,6 @@ function getProjectConfigWritePath() {
   return findProjectConfigPath() || join(process.cwd(), PROJECT_CONFIG_FILENAME);
 }
 
-function findProjectDotenvPath() {
-  let current = process.cwd();
-  for (;;) {
-    const candidate = join(current, DOTENV_FILENAME);
-    if (existsSync(candidate)) return candidate;
-    const parent = dirname(current);
-    if (parent === current) return null;
-    current = parent;
-  }
-}
-
-function parseDotenvText(text) {
-  const out = {};
-  for (const raw of String(text || "").split("\n")) {
-    const line = raw.trim();
-    if (!line || line.startsWith("#") || !line.includes("=")) continue;
-    const eq = line.indexOf("=");
-    const key = line.slice(0, eq).trim();
-    let value = line.slice(eq + 1).trim();
-    if (
-      (value.startsWith('"') && value.endsWith('"'))
-      || (value.startsWith("'") && value.endsWith("'"))
-    ) {
-      value = value.slice(1, -1);
-    }
-    if (key) out[key] = value;
-  }
-  return out;
-}
-
-/** Project .env walked up from cwd (same resolution as Qualty MCP). */
-function loadProjectDotenv() {
-  const path = findProjectDotenvPath();
-  if (!path) return {};
-  try {
-    return parseDotenvText(readFileSync(path, "utf8"));
-  } catch {
-    return {};
-  }
-}
-
 function readSharedCredentials() {
   if (!existsSync(QUALTY_SHARED_CREDS_PATH)) return {};
   try {
@@ -166,14 +116,7 @@ function normalizeApiUrl(raw, { label = "API URL" } = {}) {
 }
 
 function qualtyBaseUrlFromEnv() {
-  const dotenv = loadProjectDotenv();
-  return String(
-    dotenv.QUALTY_BASE_URL
-      || dotenv.QUALTY_API_URL
-      || process.env.QUALTY_BASE_URL
-      || process.env.QUALTY_API_URL
-      || ""
-  ).trim();
+  return String(process.env.QUALTY_BASE_URL || process.env.QUALTY_API_URL || "").trim();
 }
 
 function resolveApiUrl(args = {}) {
@@ -191,14 +134,8 @@ function resolveApiUrl(args = {}) {
 }
 
 function resolveToken(args = {}) {
-  if (args.token) return String(args.token).trim();
-  const dotenv = loadProjectDotenv();
-  const fromDotenv = String(dotenv.QUALTY_API_TOKEN || "").trim();
-  if (fromDotenv) return fromDotenv;
-  const fromProcessEnv = String(process.env.QUALTY_API_TOKEN || "").trim();
-  if (fromProcessEnv) return fromProcessEnv;
   const creds = readSharedCredentials();
-  return String(creds.api_token || "").trim();
+  return args.token || process.env.QUALTY_API_TOKEN || creds.api_token || "";
 }
 
 function resolveOrgId(args = {}) {
@@ -242,19 +179,11 @@ function usage() {
       "Usage:",
       "  qualty setup [--token <bearer-token>] [--org <org-id>]",
       "  qualty auth setup [--project <project-id>] [--profile <profile-name>] [--headed]",
-      "  qualty auth export [--project <project-id>] [--profile <profile-name>] [--org <org-id>]",
-      "               [--profiles <name1,name2>] [--repo <owner/repo>]",
-      "               [--output <path>] [--no-file] [--copy] [--set-secret | --set-github]",
-      "               Push login profile state to GitHub only (not API token, org, or project vars).",
-      "  qualty ci setup [--project <project-id>] [--profile <profile-name>] [--org <org-id>]",
-      "               [--all-profiles] [--profiles <name1,name2>]",
-      "               [--suite-id <suite-uuid>] [--ids <id1,id2>]  bundle login profiles required by tests",
-      "               [--url <api-base-url>] [--repo <owner/repo>]",
-      "               [--output <path>] [--no-file] [--copy] [--gzip] [--include-token]",
-      "               [--set-secret | --set-github]  gh: secrets (token, API URL, auth bundle) + variables",
-      "               [--cli-repo <owner/repo>] [--cli-ref <branch>]  Optional CI variables",
-      "  qualty auth restore-ci [--org <org-id>] [--project <project-id>] [--profile <fallback-profile>]",
-      "                   Reads QUALTY_AUTH_STATE_B64 (+ _2, _3, … shards) and writes ~/.qualty/local-contexts/…",
+      "  qualty auth export-ci [--project <project-id>] [--profile <profile-name>] [--org <org-id>]",
+      "                   [--url <api-base-url>] [--suite-id <suite-uuid>] [--repo <owner/repo>]",
+      "                   [--output <path>] [--no-file] [--copy] [--gzip] [--include-token]",
+      "                   [--set-secret | --set-github]  gh: secrets (token, API URL, auth) + variables (org, project, profile, …)",
+      "                   [--cli-repo <owner/repo>] [--cli-ref <branch>]  Optional CI variables",
       "  qualty connect --project <project-id> [--port 3000] [--token <bearer-token>] [--org <org-id>]",
       "  qualty run --project <project-id> [--suite-id <suite-id>] [--ids <id1,id2>] [--local] [--token <bearer-token>] [--org <org-id>]",
       "             [--poll-interval 5] [--timeout 30] [--fail-on-failure true] [--no-view-logs]",
@@ -265,7 +194,7 @@ function usage() {
       "  qualty resolve --project <project-id> [--suite-id <suite-id>] [--ids <id1,id2>] [--json] [--token <bearer-token>]",
       "",
       "Env vars:",
-      "  QUALTY_API_TOKEN  Project .env first (same as MCP), then process env, then ~/.qualty/credentials",
+      "  QUALTY_API_TOKEN  Bearer token used for auth",
       "  QUALTY_BASE_URL   API base URL when --url is not set (default: production)",
       "  QUALTY_LOCAL_CONCURRENCY  Local parallel workers for --local runs (default: 4)",
       "",
@@ -452,7 +381,9 @@ async function runSetup(args) {
 
   try {
     const currentOrgId = String(args.org || projectCfg.default_org_id || "");
-    const currentToken = resolveToken(args);
+    const currentToken = String(
+      args.token || process.env.QUALTY_API_TOKEN || sharedCreds.api_token || ""
+    );
 
     let token = "";
     if (args.token) {
@@ -599,10 +530,12 @@ function localAuthStatePath({ orgId, projectId, profile }) {
   return join(QUALTY_SHARED_CREDS_DIR, "local-contexts", orgSeg, projectSeg, `${profileSeg}.json`);
 }
 
-function ciSetupAuthBundleOutputPath(statePath) {
+function authExportCiOutputPath(statePath) {
   return statePath.replace(/\.json$/i, ".b64");
 }
 
+const GITHUB_SECRET_MAX_BYTES = 64 * 1024;
+
 function copyToClipboard(text) {
   if (process.platform === "darwin") {
     const result = spawnSync("pbcopy", { input: text, encoding: "utf8" });
@@ -668,8 +601,7 @@ function syncGithubCiConfig({
   orgId,
   projectId,
   profile,
-  profileNames,
-  authShards,
+  authPayload,
   apiUrl,
   token,
   suiteId,
@@ -681,9 +613,8 @@ function syncGithubCiConfig({
     results.push({ kind, name, ...outcome });
   };
 
-  for (const shard of authShards || []) {
-    record("secret", shard.secretName, setGithubSecret(shard.secretName, shard.payload, { repo }));
-  }
+  const authResult = setGithubSecret("QUALTY_AUTH_STATE_B64", authPayload, { repo });
+  record("secret", "QUALTY_AUTH_STATE_B64", authResult);
 
   if (token) {
     record("secret", "QUALTY_API_TOKEN", setGithubSecret("QUALTY_API_TOKEN", token, { repo }));
@@ -701,21 +632,7 @@ function syncGithubCiConfig({
 
   record("variable", "QUALTY_ORG_ID", setGithubVariable("QUALTY_ORG_ID", orgId, { repo }));
   record("variable", "QUALTY_PROJECT_ID", setGithubVariable("QUALTY_PROJECT_ID", String(projectId), { repo }));
-
-  const names = (profileNames || []).filter(Boolean);
-  if (names.length > 0) {
-    record("variable", AUTH_PROFILES_VARIABLE, setGithubVariable(AUTH_PROFILES_VARIABLE, names.join(","), { repo }));
-  }
-  if (profile) {
-    record("variable", "QUALTY_AUTH_PROFILE", setGithubVariable("QUALTY_AUTH_PROFILE", profile, { repo }));
-  }
-  if ((authShards || []).length > 1) {
-    record(
-      "variable",
-      AUTH_SHARDS_VARIABLE,
-      setGithubVariable(AUTH_SHARDS_VARIABLE, String(authShards.length), { repo })
-    );
-  }
+  record("variable", "QUALTY_AUTH_PROFILE", setGithubVariable("QUALTY_AUTH_PROFILE", profile, { repo }));
 
   if (suiteId) {
     record("variable", "QUALTY_SUITE_ID", setGithubVariable("QUALTY_SUITE_ID", String(suiteId), { repo }));
@@ -731,37 +648,6 @@ function syncGithubCiConfig({
   return results;
 }
 
-/**
- * Push only auth bundle secrets and auth-related repository variables (no API token or org/project).
- */
-function syncGithubAuthProfileOnly({ repo, profile, profileNames, authShards }) {
-  const results = [];
-  const record = (kind, name, outcome) => {
-    results.push({ kind, name, ...outcome });
-  };
-
-  for (const shard of authShards || []) {
-    record("secret", shard.secretName, setGithubSecret(shard.secretName, shard.payload, { repo }));
-  }
-
-  const names = (profileNames || []).filter(Boolean);
-  if (names.length > 0) {
-    record("variable", AUTH_PROFILES_VARIABLE, setGithubVariable(AUTH_PROFILES_VARIABLE, names.join(","), { repo }));
-  }
-  if (profile) {
-    record("variable", "QUALTY_AUTH_PROFILE", setGithubVariable("QUALTY_AUTH_PROFILE", profile, { repo }));
-  }
-  if ((authShards || []).length > 1) {
-    record(
-      "variable",
-      AUTH_SHARDS_VARIABLE,
-      setGithubVariable(AUTH_SHARDS_VARIABLE, String(authShards.length), { repo })
-    );
-  }
-
-  return results;
-}
-
 function printGithubSyncResults(results, { repo }) {
   const target = repo ? ` (repo ${repo})` : "";
   const printGroup = (title, rows) => {
@@ -842,7 +728,7 @@ function configStringValue(projectCfg, key, configPath) {
   );
 }
 
-function missingCiSetupField(fieldLabel, { flag, configKey, configPath, hasFlag }) {
+function missingExportCiField(fieldLabel, { flag, configKey, configPath, hasFlag }) {
   const configHint = configPath
     ? `${PROJECT_CONFIG_FILENAME} at ${configPath} (${configKey})`
     : `${PROJECT_CONFIG_FILENAME} (not found walking up from ${process.cwd()})`;
@@ -858,22 +744,12 @@ function missingCiSetupField(fieldLabel, { flag, configKey, configPath, hasFlag
   ].join(" ");
 }
 
-function resolveCiSetupConfig(args, { requireProfile = true } = {}) {
+function resolveExportCiConfig(args) {
   const { configPath, config: projectCfg } = readProjectConfigStrict();
 
   const orgFromFlag = String(args.org || "").trim();
   const projectFromFlag = String(args.project || "").trim();
   const profileFromFlag = String(args.profile || args["auth-profile"] || "").trim();
-  const allProfiles = parseBoolean(args["all-profiles"], false);
-  const profilesList = String(args.profiles || "")
-    .split(",")
-    .map((part) => part.trim())
-    .filter(Boolean);
-  const suiteId = String(args["suite-id"] || args.suite || "").trim();
-  const explicitIds = String(args.ids || "")
-    .split(",")
-    .map((part) => part.trim())
-    .filter(Boolean);
 
   let orgId = orgFromFlag;
   if (!orgId) {
@@ -892,7 +768,7 @@ function resolveCiSetupConfig(args, { requireProfile = true } = {}) {
 
   if (!orgId) {
     throw new Error(
-      missingCiSetupField("org ID", {
+      missingExportCiField("org ID", {
         flag: "--org",
         configKey: "default_org_id",
         configPath,
@@ -902,7 +778,7 @@ function resolveCiSetupConfig(args, { requireProfile = true } = {}) {
   }
   if (!projectId) {
     throw new Error(
-      missingCiSetupField("project ID", {
+      missingExportCiField("project ID", {
         flag: "--project",
         configKey: "default_project_id",
         configPath,
@@ -910,12 +786,9 @@ function resolveCiSetupConfig(args, { requireProfile = true } = {}) {
       })
     );
   }
-
-  const hasMultiProfileMode =
-    allProfiles || profilesList.length > 0 || Boolean(suiteId) || explicitIds.length > 0;
-  if (requireProfile && !profile && !hasMultiProfileMode) {
+  if (!profile) {
     throw new Error(
-      missingCiSetupField("auth profile", {
+      missingExportCiField("auth profile", {
         flag: "--profile",
         configKey: "default_auth_profile",
         configPath,
@@ -931,163 +804,43 @@ function resolveCiSetupConfig(args, { requireProfile = true } = {}) {
     throw new Error(`Invalid API URL: ${err.message}`);
   }
 
-  return {
-    orgId,
-    projectId,
-    profile,
-    apiUrl,
-    configPath,
-    allProfiles,
-    profilesList,
-    suiteId,
-    explicitIds,
-  };
-}
-
-function jobUsesSavedLogin(job) {
-  if (!job) return false;
-  if (job.use_saved_login) return true;
-  if (job.saved_login_profile_id) return true;
-  const profile = job.saved_login_profile;
-  return Boolean(profile && typeof profile === "object" && (profile.id || profile.name));
-}
-
-async function fetchSavedLoginProfilesForProject({ apiUrl, token, orgId, projectId }) {
-  const payload = await apiRequest({
-    apiUrl,
-    token,
-    orgId,
-    path: `/api/v1/projects/${encodeURIComponent(String(projectId))}/saved-login-profiles`,
-  }).catch(() => []);
-  return Array.isArray(payload) ? payload : [];
-}
-
-function localProfileLabelFromApiRow(row, fallbackName = "") {
-  return String(row?.local_profile_name || row?.name || fallbackName || "").trim();
+  return { orgId, projectId, profile, apiUrl, configPath };
 }
 
-async function resolveRequiredProfileNamesFromTests({
-  apiUrl,
-  token,
-  orgId,
-  projectId,
-  suiteId,
-  explicitIds,
-}) {
-  const jobsPayload = await resolveSavedJobs({
-    apiUrl,
-    token,
-    orgId,
-    projectId,
-    suiteId,
-    explicitIds,
-  });
-  const jobs = Array.isArray(jobsPayload)
-    ? jobsPayload
-    : Array.isArray(jobsPayload?.results)
-      ? jobsPayload.results
-      : Array.isArray(jobsPayload?.jobs)
-        ? jobsPayload.jobs
-        : [];
-  const names = new Set();
-  for (const job of jobs) {
-    if (!jobUsesSavedLogin(job)) continue;
-    const name = String(job?.saved_login_profile?.name || "").trim();
-    if (name) names.add(name);
-  }
-  return [...names];
-}
-
-async function resolveCiSetupProfileEntries({
-  orgId,
-  projectId,
-  profile,
-  allProfiles,
-  profilesList,
-  suiteId,
-  explicitIds,
-  apiUrl,
-  token,
-}) {
-  const apiProfiles = token
-    ? await fetchSavedLoginProfilesForProject({ apiUrl, token, orgId, projectId })
-    : [];
-
-  let requestedNames = [];
-  if (allProfiles) {
-    requestedNames = apiProfiles.map((row) => String(row?.name || "").trim()).filter(Boolean);
-    if (requestedNames.length === 0) {
-      requestedNames = listLocalAuthProfiles({ orgId, projectId });
-    }
-  } else if (profilesList.length > 0) {
-    requestedNames = profilesList;
-  } else if (suiteId || explicitIds.length > 0) {
-    if (!token) {
-      throw new Error("QUALTY_API_TOKEN is required to resolve profiles from --suite-id or --ids.");
-    }
-    requestedNames = await resolveRequiredProfileNamesFromTests({
-      apiUrl,
-      token,
-      orgId,
-      projectId,
-      suiteId,
-      explicitIds,
-    });
-    if (requestedNames.length === 0 && profile) {
-      requestedNames = [profile];
-    }
-  } else if (profile) {
-    requestedNames = [profile];
-  }
-
-  requestedNames = [...new Set(requestedNames.filter(Boolean))];
-  if (requestedNames.length === 0) {
-    throw new Error(
-      "No auth profiles selected. Pass --profile, --profiles, --all-profiles, or --suite-id / --ids."
-    );
-  }
-
-  const entries = [];
-  const missing = [];
-  for (const dashboardName of requestedNames) {
-    const apiRow = apiProfiles.find((row) => String(row?.name || "").trim() === dashboardName);
-    const localProfileName = localProfileLabelFromApiRow(apiRow, dashboardName) || dashboardName;
-    const statePath = localAuthStatePath({ orgId, projectId, profile: localProfileName });
-    if (!existsSync(statePath)) {
-      missing.push({ dashboardName, localProfileName, statePath });
-      continue;
-    }
-    entries.push({
-      name: dashboardName,
-      localProfileName,
-      statePath,
-    });
-  }
-
-  if (missing.length > 0) {
-    const lines = missing.map(
-      (row) =>
-        `  - "${row.dashboardName}" → ${row.statePath}\n    qualty auth setup --project ${projectId} --profile "${row.dashboardName}"`
-    );
-    throw new Error(["Local auth state missing for:", ...lines].join("\n"));
+function encodeAuthStateForGithubSecret(statePath, { gzip = false } = {}) {
+  const raw = readFileSync(statePath);
+  if (gzip) {
+    return {
+      encoding: "gzip+base64",
+      payload: gzipSync(raw).toString("base64"),
+      rawBytes: raw.length,
+    };
   }
-
-  return entries;
+  return {
+    encoding: "base64",
+    payload: raw.toString("base64"),
+    rawBytes: raw.length,
+  };
 }
 
-function githubAuthRestoreShell({ shardCount = 1 } = {}) {
-  const shardEnvLines = [];
-  for (let index = 1; index <= Math.max(1, shardCount); index += 1) {
-    const secretName = authShardSecretName(index);
-    shardEnvLines.push(`    ${secretName}: \${{ secrets.${secretName} }}`);
-  }
+function githubAuthRestoreShell({ orgId, projectId, profile }) {
   return [
-    `- name: Restore Qualty login states`,
+    `- name: Restore Qualty login state`,
     `  env:`,
-    ...shardEnvLines,
-    `    QUALTY_ORG_ID: \${{ vars.QUALTY_ORG_ID }}`,
-    `    QUALTY_PROJECT_ID: \${{ vars.QUALTY_PROJECT_ID }}`,
-    `  run: npx --yes qualty auth restore-ci`,
+    `    QUALTY_AUTH_STATE_B64: \${{ secrets.QUALTY_AUTH_STATE_B64 }}`,
+    `  run: |`,
+    `    set -euo pipefail`,
+    `    slug_segment() {`,
+    `      printf '%s' "$1" | sed -E 's/^[[:space:]]+|[[:space:]]+$//g; s/[^a-zA-Z0-9._-]+/_/g; s/^_+|_+$//g'`,
+    `    }`,
+    `    org_seg=$(slug_segment "$QUALTY_ORG_ID"); [ -n "$org_seg" ] || org_seg="default-org"`,
+    `    project_seg=$(slug_segment "$QUALTY_PROJECT_ID"); [ -n "$project_seg" ] || project_seg="default-project"`,
+    `    profile_seg=$(slug_segment "$QUALTY_AUTH_PROFILE"); [ -n "$profile_seg" ] || profile_seg="default"`,
+    `    auth_dir="$HOME/.qualty/local-contexts/\${org_seg}/\${project_seg}"`,
+    `    auth_file="\${auth_dir}/\${profile_seg}.json"`,
+    `    mkdir -p "$auth_dir"`,
+    `    echo "$QUALTY_AUTH_STATE_B64" | base64 -d | gunzip > "$auth_file"`,
+    `    test -s "$auth_file"`,
     ``,
     `- name: Run Qualty tests (local)`,
     `  env:`,
@@ -1098,311 +851,84 @@ function githubAuthRestoreShell({ shardCount = 1 } = {}) {
     `      --org "$QUALTY_ORG_ID" \\`,
     `      --project "$QUALTY_PROJECT_ID" \\`,
     `      --suite-id "YOUR-SUITE-UUID" \\`,
+    `      --auth-profile "$QUALTY_AUTH_PROFILE" \\`,
     `      --fail-on-failure true`,
-    `    # Omit --auth-profile when tests use different saved login profiles.`,
-    `    # Add --auth-profile "Profile Name" only to force one profile for the whole run.`,
   ].join("\n");
 }
 
-async function runAuthRestoreCi(args) {
-  const orgId = String(args.org || process.env.QUALTY_ORG_ID || "").trim();
-  const projectId = String(args.project || process.env.QUALTY_PROJECT_ID || "").trim();
-  const fallbackProfile = String(
-    args.profile || args["auth-profile"] || process.env.QUALTY_AUTH_PROFILE || ""
-  ).trim();
-
-  if (!orgId) {
-    throw new Error("Missing org ID. Set QUALTY_ORG_ID or pass --org.");
-  }
-  if (!projectId) {
-    throw new Error("Missing project ID. Set QUALTY_PROJECT_ID or pass --project.");
-  }
-
-  const payloads = collectAuthShardPayloadsFromEnv(process.env);
-  if (payloads.length === 0) {
-    throw new Error(
-      `Missing ${AUTH_SECRET_PRIMARY}. Run qualty ci setup --set-github (first time) or qualty auth export --set-github (profile refresh).`
-    );
-  }
-
-  const restored = restoreAuthPayloadsToDisk({
-    payloads,
-    orgId,
-    projectId,
-    fallbackProfile,
-  });
-
-  for (const row of restored) {
-    // eslint-disable-next-line no-console
-    console.log(`Restored login state: ${row.path} (profile "${row.name}")`);
-  }
-  // eslint-disable-next-line no-console
-  console.log(`Restored ${restored.length} login profile(s).`);
-}
+async function runAuthExportCi(args) {
+  const { orgId, projectId, profile, apiUrl, configPath } = resolveExportCiConfig(args);
+  const token = resolveToken(args);
 
-async function runAuthExport(args) {
-  if (
-    parseBoolean(args["all-profiles"], false) ||
-    String(args["suite-id"] || args.suite || "").trim() ||
-    String(args.ids || "")
-      .split(",")
-      .map((part) => part.trim())
-      .filter(Boolean).length > 0
-  ) {
+  const statePath = localAuthStatePath({ orgId, projectId, profile });
+  if (!existsSync(statePath)) {
     throw new Error(
-      "qualty auth export only updates login profile secrets. For full CI bootstrap use: qualty ci setup"
+      [
+        "Local auth state not found:",
+        `  ${statePath}`,
+        "",
+        "Create it first:",
+        `  qualty auth setup --project ${projectId} --profile "${profile}"`,
+        configPath ? `  (org/project/profile from ${configPath})` : "",
+      ]
+        .filter(Boolean)
+        .join("\n")
     );
   }
 
-  const profilesList = String(args.profiles || "")
-    .split(",")
-    .map((part) => part.trim())
-    .filter(Boolean);
-  const { orgId, projectId, profile, apiUrl, configPath } = resolveCiSetupConfig(args, {
-    requireProfile: profilesList.length === 0,
-  });
-  const token = resolveToken(args);
-
-  const profileEntries = await resolveCiSetupProfileEntries({
-    orgId,
-    projectId,
-    profile,
-    allProfiles: false,
-    profilesList,
-    suiteId: "",
-    explicitIds: [],
-    apiUrl,
-    token,
-  });
-  const profileNames = profileEntries.map((entry) => entry.name);
-  const primaryProfile = profile || profileNames[0] || "";
-
-  const manifest = buildAuthBundleManifest({ orgId, projectId, profileEntries });
-  const authShards = shardAuthBundleManifest(manifest);
-  const primaryShard = authShards[0];
-
   const setGithubFlag =
     parseBoolean(args["set-github"], false) || parseBoolean(args["set-secret"], false);
-  const noFile = parseBoolean(args["no-file"], false);
-  const outputPath = noFile
-    ? String(args.output || "").trim()
-    : String(args.output || "").trim() ||
-      ciSetupAuthBundleOutputPath(
-        localAuthStatePath({ orgId, projectId, profile: profileEntries[0].localProfileName })
-      );
-  const copyToClipboardFlag = parseBoolean(args.copy, false);
-  const githubRepo = String(args.repo || "").trim();
-
-  if (outputPath) {
-    writeFileSync(outputPath, primaryShard.payload, "utf8");
-    try {
-      chmodSync(outputPath, 0o600);
-    } catch {
-      // ignore platforms that do not support chmod
-    }
-    for (let index = 1; index < authShards.length; index += 1) {
-      const shard = authShards[index];
-      const shardPath = outputPath.replace(/(\.[^./]+)?$/, `_${index + 1}$1`);
-      writeFileSync(shardPath, shard.payload, "utf8");
-      try {
-        chmodSync(shardPath, 0o600);
-      } catch {
-        // ignore
-      }
-    }
-  }
-
-  const skipPayloadPrint = Boolean(outputPath || copyToClipboardFlag || setGithubFlag);
-  const totalSecretBytes = authShards.reduce(
-    (sum, shard) => sum + Buffer.byteLength(shard.payload, "utf8"),
-    0
-  );
-
-  // eslint-disable-next-line no-console
-  console.log("");
-  // eslint-disable-next-line no-console
-  console.log("=== Qualty → GitHub Actions (login profiles only) ===");
-  // eslint-disable-next-line no-console
-  console.log("");
-  // eslint-disable-next-line no-console
-  console.log(
-    `Auth bundle: ${profileNames.length} profile(s), ${authShards.length} secret shard(s), ${totalSecretBytes} bytes total`
-  );
-  for (const shard of authShards) {
-    // eslint-disable-next-line no-console
-    console.log(
-      `  - ${shard.secretName}: ${shard.profileNames.join(", ")} (${Buffer.byteLength(shard.payload, "utf8")} bytes)`
+  // CI path: one format only — gzip then base64 in QUALTY_AUTH_STATE_B64 (no separate gzip flag).
+  let gzip = parseBoolean(args.gzip, false) || setGithubFlag;
+  let encoded;
+  try {
+    encoded = encodeAuthStateForGithubSecret(statePath, { gzip });
+  } catch (err) {
+    throw new Error(
+      `Could not read auth state at ${statePath}: ${err.message}`
     );
   }
-  // eslint-disable-next-line no-console
-  console.log("");
-  if (outputPath) {
-    // eslint-disable-next-line no-console
-    console.log(`Wrote ${AUTH_SECRET_PRIMARY} to ${outputPath}`);
-    for (let index = 1; index < authShards.length; index += 1) {
-      const shard = authShards[index];
-      const shardPath = outputPath.replace(/(\.[^./]+)?$/, `_${index + 1}$1`);
-      // eslint-disable-next-line no-console
-      console.log(`Wrote ${shard.secretName} to ${shardPath}`);
+  let secretBytes = Buffer.byteLength(encoded.payload, "utf8");
+  if (!gzip && secretBytes > GITHUB_SECRET_MAX_BYTES - 1024) {
+    gzip = true;
+    try {
+      encoded = encodeAuthStateForGithubSecret(statePath, { gzip: true });
+    } catch (err) {
+      throw new Error(
+        `Could not gzip auth state at ${statePath}: ${err.message}`
+      );
     }
-    // eslint-disable-next-line no-console
-    console.log("");
+    secretBytes = Buffer.byteLength(encoded.payload, "utf8");
   }
-  if (setGithubFlag) {
-    const syncResults = syncGithubAuthProfileOnly({
-      repo: githubRepo,
-      profile: primaryProfile,
-      profileNames,
-      authShards,
-    });
-    printGithubSyncResults(syncResults, { repo: githubRepo });
-    const failedAuth = syncResults.filter((row) => row.kind === "secret" && !row.ok);
-    if (failedAuth.length > 0 && outputPath) {
-      // eslint-disable-next-line no-console
-      console.log("  Manual auth secrets:");
-      authShards.forEach((shard, index) => {
-        const shardPath =
-          index === 0 ? outputPath : outputPath.replace(/(\.[^./]+)?$/, `_${index + 1}$1`);
-        // eslint-disable-next-line no-console
-        console.log(`    gh secret set ${shard.secretName} < ${shardPath}`);
-      });
-      // eslint-disable-next-line no-console
-      console.log("");
-    }
-  } else {
-    // eslint-disable-next-line no-console
-    console.log("GitHub secrets (login state only — does not update QUALTY_API_TOKEN or org/project):");
-    // eslint-disable-next-line no-console
-    console.log("");
-    for (const shard of authShards) {
-      // eslint-disable-next-line no-console
-      console.log("---");
-      // eslint-disable-next-line no-console
-      console.log(`Name:  ${shard.secretName}`);
-      if (skipPayloadPrint) {
-        // eslint-disable-next-line no-console
-        console.log(
-          `Value: (see file above${copyToClipboardFlag && shard.secretName === AUTH_SECRET_PRIMARY ? " or clipboard" : ""})`
-        );
-      } else {
-        // eslint-disable-next-line no-console
-        console.log("Value:");
-        // eslint-disable-next-line no-console
-        console.log(shard.payload);
-      }
-    }
-    // eslint-disable-next-line no-console
-    console.log("---");
-    // eslint-disable-next-line no-console
-    console.log("");
-    // eslint-disable-next-line no-console
-    console.log(
-      "Re-run with --set-github from this repo's git root to push via gh (after qualty ci setup for first-time CI)."
+  if (secretBytes > GITHUB_SECRET_MAX_BYTES - 1024) {
+    throw new Error(
+      `Auth state is too large for a GitHub secret (${secretBytes} bytes; limit ~64 KB). ` +
+        "Try a shorter-lived session, fewer cookies, or contact Qualty support."
     );
-    // eslint-disable-next-line no-console
-    console.log("");
-  }
-  if (copyToClipboardFlag) {
-    if (copyToClipboard(primaryShard.payload)) {
-      // eslint-disable-next-line no-console
-      console.log(`✓ Copied ${AUTH_SECRET_PRIMARY} to clipboard.`);
-    } else {
-      // eslint-disable-next-line no-console
-      console.log("Could not copy to clipboard on this machine.");
-    }
-    // eslint-disable-next-line no-console
-    console.log("");
-  }
-  for (const entry of profileEntries) {
-    // eslint-disable-next-line no-console
-    console.log(`Profile "${entry.name}" → ${entry.statePath}`);
   }
-  if (configPath) {
-    // eslint-disable-next-line no-console
-    console.log(`Config: ${configPath}`);
-  }
-  // eslint-disable-next-line no-console
-  console.log("");
-  // eslint-disable-next-line no-console
-  console.log(
-    "When login expires, re-run qualty auth setup then qualty auth export --set-github (or qualty ci setup for a full refresh)."
-  );
-  // eslint-disable-next-line no-console
-  console.log("");
-}
 
-async function runCiSetup(args) {
-  const {
-    orgId,
-    projectId,
-    profile,
-    apiUrl,
-    configPath,
-    allProfiles,
-    profilesList,
-    suiteId: configSuiteId,
-    explicitIds,
-  } = resolveCiSetupConfig(args);
-  const token = resolveToken(args);
-
-  const profileEntries = await resolveCiSetupProfileEntries({
-    orgId,
-    projectId,
-    profile,
-    allProfiles,
-    profilesList,
-    suiteId: configSuiteId,
-    explicitIds,
-    apiUrl,
-    token,
-  });
-  const profileNames = profileEntries.map((entry) => entry.name);
-  const primaryProfile = profile || profileNames[0] || "";
-
-  const manifest = buildAuthBundleManifest({ orgId, projectId, profileEntries });
-  const authShards = shardAuthBundleManifest(manifest);
-  const primaryShard = authShards[0];
-
-  const setGithubFlag =
-    parseBoolean(args["set-github"], false) || parseBoolean(args["set-secret"], false);
   const noFile = parseBoolean(args["no-file"], false);
   const outputPath = noFile
     ? String(args.output || "").trim()
-    : String(args.output || "").trim() ||
-      ciSetupAuthBundleOutputPath(
-        localAuthStatePath({ orgId, projectId, profile: profileEntries[0].localProfileName })
-      );
+    : String(args.output || "").trim() || authExportCiOutputPath(statePath);
   const copyToClipboardFlag = parseBoolean(args.copy, false);
   const githubRepo = String(args.repo || "").trim();
-  const suiteId = String(args["suite-id"] || args.suite || configSuiteId || "").trim();
+  const suiteId = String(args["suite-id"] || args.suite || "").trim();
   const cliRepo = String(args["cli-repo"] || "").trim();
   const cliRef = String(args["cli-ref"] || "").trim();
 
   if (outputPath) {
-    writeFileSync(outputPath, primaryShard.payload, "utf8");
+    writeFileSync(outputPath, encoded.payload, "utf8");
     try {
       chmodSync(outputPath, 0o600);
     } catch {
       // ignore platforms that do not support chmod
     }
-    for (let index = 1; index < authShards.length; index += 1) {
-      const shard = authShards[index];
-      const shardPath = outputPath.replace(/(\.[^./]+)?$/, `_${index + 1}$1`);
-      writeFileSync(shardPath, shard.payload, "utf8");
-      try {
-        chmodSync(shardPath, 0o600);
-      } catch {
-        // ignore
-      }
-    }
   }
 
   const includeToken = parseBoolean(args["include-token"], false);
+  const profileSeg = safePathSegment(profile, "default");
   const skipPayloadPrint = Boolean(outputPath || copyToClipboardFlag || setGithubFlag);
-  const totalSecretBytes = authShards.reduce(
-    (sum, shard) => sum + Buffer.byteLength(shard.payload, "utf8"),
-    0
-  );
 
   // eslint-disable-next-line no-console
   console.log("");
@@ -1410,29 +936,20 @@ async function runCiSetup(args) {
   console.log("=== Qualty → GitHub Actions (secrets & variables) ===");
   // eslint-disable-next-line no-console
   console.log("");
-  // eslint-disable-next-line no-console
-  console.log(
-    `Auth bundle: ${profileNames.length} profile(s), ${authShards.length} secret shard(s), ${totalSecretBytes} bytes total`
-  );
-  for (const shard of authShards) {
+  if (encoded.encoding === "gzip+base64") {
     // eslint-disable-next-line no-console
-    console.log(
-      `  - ${shard.secretName}: ${shard.profileNames.join(", ")} (${Buffer.byteLength(shard.payload, "utf8")} bytes)`
-    );
+    console.log(`Auth state: gzip+base64 (${encoded.rawBytes} bytes raw → ${secretBytes} bytes secret)`);
+  } else {
+    // eslint-disable-next-line no-console
+    console.log(`Auth state: base64 (${encoded.rawBytes} bytes raw → ${secretBytes} bytes secret)`);
   }
   // eslint-disable-next-line no-console
   console.log("");
   if (outputPath) {
     // eslint-disable-next-line no-console
-    console.log(`Wrote ${AUTH_SECRET_PRIMARY} to ${outputPath}`);
-    for (let index = 1; index < authShards.length; index += 1) {
-      const shard = authShards[index];
-      const shardPath = outputPath.replace(/(\.[^./]+)?$/, `_${index + 1}$1`);
-      // eslint-disable-next-line no-console
-      console.log(`Wrote ${shard.secretName} to ${shardPath}`);
-    }
+    console.log(`Wrote QUALTY_AUTH_STATE_B64 to ${outputPath}`);
     // eslint-disable-next-line no-console
-    console.log(`  gh secret set ${AUTH_SECRET_PRIMARY} < ${outputPath}`);
+    console.log(`  gh secret set QUALTY_AUTH_STATE_B64 < ${outputPath}`);
     // eslint-disable-next-line no-console
     console.log("");
   }
@@ -1441,9 +958,8 @@ async function runCiSetup(args) {
       repo: githubRepo,
       orgId,
       projectId,
-      profile: primaryProfile,
-      profileNames,
-      authShards,
+      profile,
+      authPayload: encoded.payload,
       apiUrl,
       token,
       suiteId,
@@ -1451,27 +967,25 @@ async function runCiSetup(args) {
       cliRef,
     });
     printGithubSyncResults(syncResults, { repo: githubRepo });
-    const failedAuth = syncResults.filter((row) => row.kind === "secret" && !row.ok);
-    if (failedAuth.length > 0 && outputPath) {
+    const authRow = syncResults.find((r) => r.name === "QUALTY_AUTH_STATE_B64");
+    if (!authRow?.ok && outputPath) {
       // eslint-disable-next-line no-console
-      console.log("  Manual auth secrets:");
-      authShards.forEach((shard, index) => {
-        const shardPath =
-          index === 0 ? outputPath : outputPath.replace(/(\.[^./]+)?$/, `_${index + 1}$1`);
-        // eslint-disable-next-line no-console
-        console.log(`    gh secret set ${shard.secretName} < ${shardPath}`);
-      });
+      console.log(`  Manual auth secret: gh secret set QUALTY_AUTH_STATE_B64 < ${outputPath}`);
       // eslint-disable-next-line no-console
       console.log("");
     }
   }
   if (copyToClipboardFlag) {
-    if (copyToClipboard(primaryShard.payload)) {
+    if (copyToClipboard(encoded.payload)) {
       // eslint-disable-next-line no-console
-      console.log(`✓ Copied ${AUTH_SECRET_PRIMARY} to clipboard.`);
+      console.log("✓ Copied QUALTY_AUTH_STATE_B64 to clipboard. Paste into GitHub → Settings → Secrets.");
     } else {
       // eslint-disable-next-line no-console
       console.log("Could not copy to clipboard on this machine.");
+      if (outputPath) {
+        // eslint-disable-next-line no-console
+        console.log(`  Use the file instead: ${outputPath}`);
+      }
     }
     // eslint-disable-next-line no-console
     console.log("");
@@ -1481,16 +995,10 @@ async function runCiSetup(args) {
     console.log(
       "1. GitHub Actions config was pushed via gh (secrets + repository variables — see sync above). Fix any ✗ manually."
     );
-    if (!suiteId && !configSuiteId && explicitIds.length === 0) {
-      // eslint-disable-next-line no-console
-      console.log(
-        "   Tip: pass --suite-id or --ids to bundle only login profiles required by those tests."
-      );
-    }
-    if (authShards.length > 1) {
+    if (!suiteId) {
       // eslint-disable-next-line no-console
       console.log(
-        `   Auth was split across ${authShards.length} secrets. Add optional shard env vars to your workflow restore step.`
+        "   Tip: hardcode --suite-id or --ids in your workflow (see templates/github-actions/qualty-local-pr.yml)."
       );
     }
     // eslint-disable-next-line no-console
@@ -1525,35 +1033,13 @@ async function runCiSetup(args) {
     // eslint-disable-next-line no-console
     console.log("---");
     // eslint-disable-next-line no-console
-    console.log(`Name:  ${AUTH_PROFILES_VARIABLE}`);
+    console.log("Name:  QUALTY_AUTH_PROFILE");
     // eslint-disable-next-line no-console
     console.log("Value:");
     // eslint-disable-next-line no-console
-    console.log(profileNames.join(","));
+    console.log(profile);
     // eslint-disable-next-line no-console
-    console.log(`  gh variable set ${AUTH_PROFILES_VARIABLE} --body "${profileNames.join(",")}"`);
-    if (primaryProfile) {
-      // eslint-disable-next-line no-console
-      console.log("---");
-      // eslint-disable-next-line no-console
-      console.log("Name:  QUALTY_AUTH_PROFILE");
-      // eslint-disable-next-line no-console
-      console.log("Value:");
-      // eslint-disable-next-line no-console
-      console.log(primaryProfile);
-      // eslint-disable-next-line no-console
-      console.log(`  gh variable set QUALTY_AUTH_PROFILE --body "${primaryProfile}"`);
-    }
-    if (authShards.length > 1) {
-      // eslint-disable-next-line no-console
-      console.log("---");
-      // eslint-disable-next-line no-console
-      console.log(`Name:  ${AUTH_SHARDS_VARIABLE}`);
-      // eslint-disable-next-line no-console
-      console.log("Value:");
-      // eslint-disable-next-line no-console
-      console.log(String(authShards.length));
-    }
+    console.log(`  gh variable set QUALTY_AUTH_PROFILE --body "${profile}"`);
     // eslint-disable-next-line no-console
     console.log("---");
     // eslint-disable-next-line no-console
@@ -1594,20 +1080,20 @@ async function runCiSetup(args) {
       // eslint-disable-next-line no-console
       console.log("(create in Qualty → Account → API tokens; must start with qlty_ci_)");
     }
-    for (const shard of authShards) {
+    // eslint-disable-next-line no-console
+    console.log("---");
+    // eslint-disable-next-line no-console
+    console.log("Name:  QUALTY_AUTH_STATE_B64");
+    if (skipPayloadPrint) {
       // eslint-disable-next-line no-console
-      console.log("---");
+      console.log(
+        `Value: (see file above${copyToClipboardFlag ? " or clipboard" : ""})`
+      );
+    } else {
       // eslint-disable-next-line no-console
-      console.log(`Name:  ${shard.secretName}`);
-      if (skipPayloadPrint) {
-        // eslint-disable-next-line no-console
-        console.log(`Value: (see file above${copyToClipboardFlag && shard.secretName === AUTH_SECRET_PRIMARY ? " or clipboard" : ""})`);
-      } else {
-        // eslint-disable-next-line no-console
-        console.log("Value:");
-        // eslint-disable-next-line no-console
-        console.log(shard.payload);
-      }
+      console.log("Value:");
+      // eslint-disable-next-line no-console
+      console.log(encoded.payload);
     }
     // eslint-disable-next-line no-console
     console.log("---");
@@ -1621,26 +1107,17 @@ async function runCiSetup(args) {
   // eslint-disable-next-line no-console
   console.log("");
   // eslint-disable-next-line no-console
-  console.log(githubAuthRestoreShell({ shardCount: authShards.length }));
+  console.log(githubAuthRestoreShell({ orgId, projectId, profile }));
   // eslint-disable-next-line no-console
   console.log("");
-  for (const entry of profileEntries) {
-    // eslint-disable-next-line no-console
-    console.log(`Profile "${entry.name}" → ${entry.statePath}`);
-  }
-  if (profileNames.length === 1) {
-    // eslint-disable-next-line no-console
-    console.log(`Optional override: --auth-profile "${profileNames[0]}"`);
-  } else {
-    // eslint-disable-next-line no-console
-    console.log("Omit --auth-profile in CI so each test uses its dashboard saved login profile.");
-  }
+  // eslint-disable-next-line no-console
+  console.log(`Local file: ${statePath}`);
+  // eslint-disable-next-line no-console
+  console.log(`Profile flag: --auth-profile "${profile}" (file on disk: ${profileSeg}.json)`);
   // eslint-disable-next-line no-console
   console.log("");
   // eslint-disable-next-line no-console
-  console.log(
-    "When login expires, re-run qualty auth setup and qualty auth export --set-github (or qualty ci setup --set-github for a full refresh)."
-  );
+  console.log("When login expires, re-run qualty auth setup and qualty auth export-ci to refresh the secret.");
   // eslint-disable-next-line no-console
   console.log("");
 }
@@ -2753,8 +2230,8 @@ async function runAuthSetup(args) {
     console.log("");
     // eslint-disable-next-line no-console
     console.log(
-      `[qualty][auth] Push this profile to GitHub Actions:\n` +
-        `  qualty auth export --project ${project.id} --profile "${profile}" --set-github`
+      `[qualty][auth] For GitHub Actions secrets, run:\n` +
+        `  qualty auth export-ci --project ${project.id} --profile "${profile}"`
     );
   } finally {
     rl.close();
@@ -2776,29 +2253,17 @@ async function main() {
     await runSetup(args);
     return;
   }
-  if (command === "ci") {
-    const sub = args._[1];
-    if (sub === "setup") {
-      await runCiSetup(args);
-      return;
-    }
-    throw new Error("Unknown ci subcommand. Use: qualty ci setup");
-  }
   if (command === "auth") {
     const sub = args._[1];
     if (sub === "setup") {
       await runAuthSetup(args);
       return;
     }
-    if (sub === "export") {
-      await runAuthExport(args);
-      return;
-    }
-    if (sub === "restore-ci") {
-      await runAuthRestoreCi(args);
+    if (sub === "export-ci") {
+      await runAuthExportCi(args);
       return;
     }
-    throw new Error("Unknown auth subcommand. Use: qualty auth setup | qualty auth export | qualty auth restore-ci");
+    throw new Error("Unknown auth subcommand. Use: qualty auth setup | qualty auth export-ci");
   }
   if (command === "run") {
     if (parseBoolean(args.local, false)) {