@knpkv/jira-cli 1.2.2 → 1.3.1

package/CHANGELOG.md

@@ -1,5 +1,129 @@
 # @knpkv/jira-cli
 
+## 1.3.1
+
+### Patch Changes
+
+- [#361](https://github.com/knpkv/npm/pull/361) [`676419e`](https://github.com/knpkv/npm/commit/676419e39c395dd4cfea6d9ffaee7d002a3f75e2) Thanks [@konopkov](https://github.com/konopkov)! - Upgrade the workspace to Effect 4.0.0-rc.109, pin the vendored Effect reference to that exact upstream release, guard source/package alignment, and bound Control Center test concurrency for reliable CI execution.
+- Updated dependencies [[`676419e`](https://github.com/knpkv/npm/commit/676419e39c395dd4cfea6d9ffaee7d002a3f75e2)]:
+  - @knpkv/agent-skills@0.3.1
+  - @knpkv/atlassian-common@1.4.1
+  - @knpkv/jira-api-client@1.1.1
+
+## 1.3.0
+
+### Minor Changes
+
+- [#366](https://github.com/knpkv/npm/pull/366) [`b08ca20`](https://github.com/knpkv/npm/commit/b08ca2004b3efcd72a695b44c72b56dae20afdfd) Thanks [@konopkov](https://github.com/konopkov)! - Add `jira version create` and `jira issue edit`, closing the two gaps that forced release scaffolding out of the CLI.
+
+  `jira version create --project <KEY> --name <NAME>` opens a new unreleased version, optionally with `--description`, `--start-date` and `--release-date`. The project key is resolved to the numeric `projectId` the endpoint requires, and dates are validated as ISO 8601 locally so a bad one names its own flag instead of returning an unattributed 400.
+
+  `jira issue edit <KEY>` edits fix versions and labels. Both fields are sets, so the incremental flags — `--add-fix-version`, `--remove-fix-version`, `--add-label`, `--remove-label` — are the ones to reach for: they go through Jira's `update` verb, which applies server-side and cannot clobber a concurrent edit. The replacing forms (`--fix-version`, `--label`) are still available and say in their help that they drop anything not listed. Passing both forms for one field is refused up front, because Jira's own error for that case does not name the offending field.
+
+- [#354](https://github.com/knpkv/npm/pull/354) [`2e26e30`](https://github.com/knpkv/npm/commit/2e26e3032ce527260a4e4d9fca8af43039f762d6) Thanks [@konopkov](https://github.com/konopkov)! - Add `jira version related-work sync` — reconcile a version's related-work links
+  against the given set instead of blindly appending.
+
+  Repeated `related-work add` calls pile up duplicate "Release notes" links every
+  time a release is re-scaffolded. `sync` takes the desired set as repeatable
+  `--link title=url` flags and adds only what is missing, matching on URL (the
+  only stable identity a link has — Jira assigns the id and the title is
+  editable, so a link retitled by hand is still recognised). Scoped to one
+  `--category` so reconciling `Communication` cannot disturb `Testing` links.
+  `--prune` opts into removing extras, which is off by default because links
+  added by hand in the Jira UI are legitimate; it removes surplus copies of a
+  desired URL too, since an existing pile-up is the case it exists to clean up.
+  Repeated `--link` flags for one URL collapse to a single link.
+
+  The planning step is exposed as the pure `planRelatedWorkSync` and covered by
+  tests, including that a second run is a no-op.
+
+- [#370](https://github.com/knpkv/npm/pull/370) [`27d2ca1`](https://github.com/knpkv/npm/commit/27d2ca18b0c0b0f8a252d461c0aaf10eb92e9ffc) Thanks [@konopkov](https://github.com/konopkov)! - Enforce the complete anti-slop rule set with zero accepted diagnostics and update affected APIs and implementations to satisfy the required contracts.
+
+### Patch Changes
+
+- [#358](https://github.com/knpkv/npm/pull/358) [`503d345`](https://github.com/knpkv/npm/commit/503d3459b419a3c9fd366715d5916e41086f493d) Thanks [@konopkov](https://github.com/konopkov)! - Make the OAuth refresh-token rotation atomic so an interrupted CLI cannot log
+  the user out.
+
+  Atlassian rotates refresh tokens: the refresh response carries a replacement and
+  the token that was sent is consumed server-side. `refreshTokenImpl` performed
+  the grant and then persisted the result in a separate, interruptible step, so a
+  fiber interrupt landing between the two destroyed the credential — the stored
+  refresh token was already spent, the replacement was never written, and the next
+  refresh failed with a 4xx. `getAccessToken` treats that failure as an expired
+  refresh token and deletes the token file, so the user was silently logged out
+  and had to run `jira auth login` again.
+
+  Nothing interrupted it before, which is why this had not surfaced. It becomes
+  reachable as soon as a caller kills the process: this runs during layer
+  construction on every CLI invocation, and `@knpkv/jira-clockify`'s nvim
+  statusline terminates the poll process when the editor closes. The grant and
+  the persist now share one `Effect.uninterruptible` region.
+
+  That region carries its own 30s deadline rather than relying on a caller's, for
+  two reasons. A caller's `Effect.timeout` would be inert — `timeout` is a race,
+  and racing an uninterruptible loser means waiting for it anyway. And an
+  uninterruptible region with no deadline of its own absorbs SIGINT/SIGTERM
+  entirely, since `NodeRuntime.runMain`'s signal handlers do nothing but interrupt
+  the main fiber — a hung `jira` command would stop responding to Ctrl-C. The
+  deadline forked inside the region is itself interruptible, so it does bound it.
+
+  Abandoning the round-trip still cannot prove the grant did not land — Atlassian
+  may consume and rotate the token after we stop listening, and no client-side
+  deadline changes that. So the deadline is paired with a second rule:
+  `getAccessToken` no longer deletes the stored token on any `step: "refresh"`
+  failure. It deletes only on the answers that actually mean the grant is dead —
+  the provider explicitly reporting `invalid_grant`, on a `400` or a `403` — using
+  the new `OAuthError.status` and `OAuthError.errorCode` from
+  `@knpkv/atlassian-common`. Previously a transport error or timeout deleted
+  the active profile outright, which turned a bad network window into an
+  unattended silent logout: `JiraApiConfigLive` builds on every CLI invocation,
+  and jcf's statusline runs one every 30 seconds.
+
+  The statuses deliberately left alone matter as much. `429` is the one this most
+  needs to survive — several `jira`/`jcf` processes on one expired token hit the
+  endpoint together, one wins the rotation and the rest are rate-limited. `408`
+  and `425` restate the timeout case. `407` and other middlebox replies never came
+  from Atlassian at all. `401` and `400 invalid_client` mean the client secret is
+  wrong, where the fix is `jira auth configure`, not a re-login that would fail
+  the same way. A bare `403` is left alone too: it is as likely to be a proxy or
+  WAF as Atlassian revoking anything. An unparseable body is no verdict at all.
+
+  Now an incomplete refresh normally costs a retry rather than the session. This
+  narrows the window rather than closing it: the atomicity is fiber-level, so a
+  SIGKILL after Atlassian has already rotated the token still loses the
+  replacement, and the next refresh then legitimately reports `invalid_grant`. No
+  client-side design can close that window against a hard kill.
+
+  Covered by tests: a refresh that never answers and one that is rate-limited both
+  leave the profile on disk, a `400` removes it, and an interrupt mid-rotation
+  still persists the replacement token.
+
+- [#361](https://github.com/knpkv/npm/pull/361) [`676419e`](https://github.com/knpkv/npm/commit/676419e39c395dd4cfea6d9ffaee7d002a3f75e2) Thanks [@konopkov](https://github.com/konopkov)! - Update Effect and effect-qb, migrate schema-tagged errors to the current Effect API, and adopt the dialect-scoped SQLite function and type APIs introduced by effect-qb 0.22.
+
+- [#357](https://github.com/knpkv/npm/pull/357) [`77e3257`](https://github.com/knpkv/npm/commit/77e3257743aacfaf9e11e016a60206f416c5fe79) Thanks [@konopkov](https://github.com/konopkov)! - Secure local control planes and CI credential boundaries. CodeCommit web now
+  uses a process-scoped owner session with CSRF protection and loopback-only
+  listeners; review sandboxes use authenticated loopback code-server instances,
+  digest-pinned images, constrained mounts, non-root execution, and dropped
+  capabilities. OAuth callback listeners validate state before accepting terminal
+  outcomes and bind explicitly to loopback. GitHub workflows pin external actions
+  to immutable commits and keep long-lived Atlassian credentials out of pull
+  request execution.
+- Updated dependencies [[`503d345`](https://github.com/knpkv/npm/commit/503d3459b419a3c9fd366715d5916e41086f493d), [`b08ca20`](https://github.com/knpkv/npm/commit/b08ca2004b3efcd72a695b44c72b56dae20afdfd), [`676419e`](https://github.com/knpkv/npm/commit/676419e39c395dd4cfea6d9ffaee7d002a3f75e2), [`b08ca20`](https://github.com/knpkv/npm/commit/b08ca2004b3efcd72a695b44c72b56dae20afdfd), [`27d2ca1`](https://github.com/knpkv/npm/commit/27d2ca18b0c0b0f8a252d461c0aaf10eb92e9ffc)]:
+  - @knpkv/atlassian-common@1.4.0
+  - @knpkv/agent-skills@0.3.0
+  - @knpkv/jira-api-client@1.1.0
+
+## 1.2.3
+
+### Patch Changes
+
+- [#343](https://github.com/knpkv/npm/pull/343) [`4def7db`](https://github.com/knpkv/npm/commit/4def7db2f400cf68218262994d67ed90a7154bf1) Thanks [@konopkov](https://github.com/konopkov)! - Align runtime ownership, cancellation, caching, time, failure handling, polling,
+  decoding, and executable entrypoints with Effect v4 idioms. Expose clock-injected
+  Atlassian token construction and expiry helpers, and enable workspace-wide
+  Effect diagnostics and prevention checks.
+- Updated dependencies [[`4def7db`](https://github.com/knpkv/npm/commit/4def7db2f400cf68218262994d67ed90a7154bf1), [`a9d5408`](https://github.com/knpkv/npm/commit/a9d54085f6fc25cde1d5b298f50cb6e06e2bc93f)]:
+  - @knpkv/atlassian-common@1.3.0
+
 ## 1.2.2
 
 ### Patch Changes

package/README.md

@@ -43,6 +43,12 @@ Opens Atlassian Developer Console. Create a new OAuth 2.0 (3LO) app with:
 http://localhost:8585/callback
 ```
 
+The provider-facing callback URL and callback listener both use `localhost`, so
+the browser and listener select the same loopback family on IPv4-only and
+IPv6-only hosts. Requests with a missing
+or mismatched OAuth state are rejected without consuming the pending login, so
+only the provider callback carrying the expected state can complete or fail it.
+
 ### 2. Configure Credentials
 
 ```bash
@@ -112,6 +118,30 @@ jira issue attachment upload PROJ-123 ./evidence.svg --document ./PROJ-123.md
 
 The command uploads the file, replaces exactly one matching placeholder with the remote attachment reference, and includes hidden `jiraAttachment` metadata so later parses keep the Jira attachment identity.
 
+### Edit an issue
+
+Edit an issue's list-valued fields (fix versions and labels).
+
+```bash
+jira issue edit PROJ-123 --add-fix-version "OOB 100" --add-label release-notes
+jira issue edit PROJ-123 --remove-fix-version "OOB 99" --json
+```
+
+| Option                 | Description                                                    | Default |
+| ---------------------- | -------------------------------------------------------------- | ------- |
+| `--add-fix-version`    | Add a fix version by name, keeping existing ones (repeatable)  | -       |
+| `--remove-fix-version` | Remove a fix version by name (repeatable)                      | -       |
+| `--fix-version`        | Replace the fix versions with exactly these names (repeatable) | -       |
+| `--add-label`          | Add a label, keeping existing ones (repeatable)                | -       |
+| `--remove-label`       | Remove a label (repeatable)                                    | -       |
+| `--label`              | Replace the labels with exactly these (repeatable)             | -       |
+| `--json`               | Output as JSON                                                 | `false` |
+
+Both fields are sets, so prefer the incremental flags: the replacing forms
+(`--fix-version`, `--label`) silently drop every value not listed. A replacing
+flag cannot be combined with its own incremental flags. Requires the
+`write:jira-work` scope.
+
 ### Output Formats
 
 **Multi (default):** One markdown file per issue with YAML front-matter.
@@ -162,6 +192,28 @@ jira version get 10042 --json
 
 The version id is the **numeric** id (e.g. `10042`); use `version list` to find it.
 
+### Create a version
+
+```bash
+jira version create --project PROJ --name "OOB 100"
+jira version create --project PROJ --name "OOB 100" \
+  --description "Q3 release" \
+  --start-date 2026-01-05 \
+  --release-date 2026-01-19 \
+  --json
+```
+
+| Option           | Alias | Description                           | Default |
+| ---------------- | ----- | ------------------------------------- | ------- |
+| `--project`      | `-p`  | Jira project key (e.g. `PROJ`)        | -       |
+| `--name`         |       | Version name (e.g. `"OOB 100"`)       | -       |
+| `--description`  | `-d`  | Version description                   | -       |
+| `--start-date`   |       | Start date, ISO 8601 (`yyyy-mm-dd`)   | -       |
+| `--release-date` |       | Release date, ISO 8601 (`yyyy-mm-dd`) | -       |
+| `--json`         |       | Output as JSON                        | `false` |
+
+The version is created unreleased. Requires the `manage:jira-project` scope.
+
 ### Set the description
 
 ```bash
@@ -180,10 +232,22 @@ jira version related-work add 10042 \
   --title "Release notes" \
   --url "https://example.atlassian.net/wiki/spaces/PROJ/pages/123" \
   --category Communication
+
+# Reconcile the category to exactly this set — idempotent, safe to re-run
+jira version related-work sync 10042 \
+  --link "Release notes=https://example.atlassian.net/wiki/spaces/PROJ/pages/123" \
+  --link "Test report=https://example.atlassian.net/wiki/spaces/PROJ/pages/124" \
+  --category Communication \
+  --prune
 ```
 
 `related-work add` requires the `write:jira-work` scope.
 
+`related-work sync` is what a release scaffold should use: repeated `add` calls pile up duplicate links, while
+`sync` matches on URL (the only stable identity a link has, since Jira assigns the id and the title is editable)
+and adds only what is missing. `--prune` additionally removes links in the category that are not in the desired
+set, including surplus copies of a URL that _is_ desired. Other categories are never touched.
+
 ## Auth Commands
 
 ```bash

package/dist/AttachmentService.d.ts

@@ -11,10 +11,10 @@ export interface UploadAttachmentInput {
     readonly filename?: string | undefined;
     readonly mediaType?: string | undefined;
 }
-export interface AttachmentServiceShape {
+export interface AttachmentServiceContract {
     readonly uploadToIssue: (issueIdOrKey: string, input: UploadAttachmentInput) => Effect.Effect<Attachment, JiraApiError>;
 }
-declare const AttachmentService_base: Context.ServiceClass<AttachmentService, "@knpkv/jira-cli/AttachmentService", AttachmentServiceShape>;
+declare const AttachmentService_base: Context.ServiceClass<AttachmentService, "@knpkv/jira-cli/AttachmentService", AttachmentServiceContract>;
 export declare class AttachmentService extends AttachmentService_base {
 }
 export declare const layer: Layer.Layer<AttachmentService, never, JiraApiClient | FileSystem.FileSystem | Path.Path>;

package/dist/AttachmentService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AttachmentService.d.ts","sourceRoot":"","sources":["../src/AttachmentService.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AACtD,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAA;AAC/C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAA;AAEnC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACxC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,aAAa,EAAE,CACtB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,qBAAqB,KACzB,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;CAC7C;;AAED,qBAAa,iBAAkB,SAAQ,sBAGC;CAAG;AAwE3C,eAAO,MAAM,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,EAAE,aAAa,GAAG,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CACzE,CAAA"}
+{"version":3,"file":"AttachmentService.d.ts","sourceRoot":"","sources":["../src/AttachmentService.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AACtD,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAA;AAC/C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAA;AAEnC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACxC;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,aAAa,EAAE,CACtB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,qBAAqB,KACzB,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;CAC7C;;AAED,qBAAa,iBAAkB,SAAQ,sBAGC;CAAG;AAwE3C,eAAO,MAAM,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,EAAE,aAAa,GAAG,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CACzE,CAAA"}

package/dist/AttachmentService.js

@@ -56,7 +56,7 @@ const make = Effect.gen(function* () {
         const result = yield* client.uploadAttachment(issueIdOrKey, {
             bytes,
             filename,
-            ...(input.mediaType === undefined ? {} : { mediaType: input.mediaType })
+            ...(!(input.mediaType === undefined) && { mediaType: input.mediaType })
         }).pipe(Effect.mapError((cause) => new JiraApiError({ message: `Failed to upload attachment to ${issueIdOrKey}`, cause })));
         return yield* decodeFirstUploadedAttachment(result);
     });

package/dist/AttachmentService.js.map

@@ -1 +1 @@
-{"version":3,"file":"AttachmentService.js","sourceRoot":"","sources":["../src/AttachmentService.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAA;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AACtD,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAA;AAC/C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAA;AACnC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAehD,MAAM,OAAO,iBAAkB,SAAQ,OAAO,CAAC,OAAO,EAGnD,CAAC,mCAAmC,CAAC;CAAG;AAE3C,MAAM,wBAAwB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7C,EAAE,EAAE,MAAM,CAAC,MAAM;IACjB,QAAQ,EAAE,MAAM,CAAC,MAAM;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;CACpD,CAAC,CAAA;AAEF,MAAM,wBAAwB,GAAG,CAAC,GAAY,EAA2C,EAAE,CACzF,MAAM,CAAC,mBAAmB,CAAC,wBAAwB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAC5D,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,8CAA8C,EAAE,KAAK,EAAE,CAAC,CAAC,EAChH,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;IACxB,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1F,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,kEAAkE,EAAE,CAAC,CAClG,CAAA;IACH,CAAC;IACD,MAAM,SAAS,GAAG,4BAA4B,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAA;IACjG,OAAO,MAAM,CAAC,OAAO,CAAC;QACpB,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,EAAE,MAAM,CAAC,OAAO;QACnB,SAAS;QACT,QAAQ,EAAE,SAAS,IAAI,EAAE;QACzB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC;KACvB,CAAC,CAAA;AACJ,CAAC,CAAC,CACH,CAAA;AAEH,MAAM,6BAA6B,GAAG,CAAC,GAAY,EAA2C,EAAE;IAC9F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC,CAAC,CAAA;IAC9F,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;IACpB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,CAAC,CAAA;IACjG,CAAC;IACD,OAAO,wBAAwB,CAAC,KAAK,CAAC,CAAA;AACxC,CAAC,CAAA;AAED,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,aAAa,CAAA;IACnC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAA;IACvC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA;IAE7B,MAAM,aAAa,GAA4C,CAAC,YAAY,EAAE,KAAK,EAAE,EAAE,CACrF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CACnD,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,kCAAkC,KAAK,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CACzF,CACF,CAAA;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAChE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,YAAY,EAAE;YAC1D,KAAK;YACL,QAAQ;YACR,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;SACzE,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,kCAAkC,YAAY,EAAE,EAAE,KAAK,EAAE,CAAC,CACvF,CACF,CAAA;QAED,OAAO,KAAK,CAAC,CAAC,6BAA6B,CAAC,MAAM,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;IAEJ,OAAO,iBAAiB,CAAC,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,CAAA;AAChD,CAAC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,KAAK,GAA6F,KAAK;KACjH,MAAM,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAA"}
+{"version":3,"file":"AttachmentService.js","sourceRoot":"","sources":["../src/AttachmentService.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAA;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AACtD,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAA;AAC/C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAA;AACnC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAehD,MAAM,OAAO,iBAAkB,SAAQ,OAAO,CAAC,OAAO,EAGnD,CAAC,mCAAmC,CAAC;CAAG;AAE3C,MAAM,wBAAwB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7C,EAAE,EAAE,MAAM,CAAC,MAAM;IACjB,QAAQ,EAAE,MAAM,CAAC,MAAM;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;CACpD,CAAC,CAAA;AAEF,MAAM,wBAAwB,GAAG,CAAgB,GAAkB,EAA2C,EAAE,CAC9G,MAAM,CAAC,mBAAmB,CAAC,wBAAwB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAC5D,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,8CAA8C,EAAE,KAAK,EAAE,CAAC,CAAC,EAChH,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;IACxB,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1F,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,kEAAkE,EAAE,CAAC,CAClG,CAAA;IACH,CAAC;IACD,MAAM,SAAS,GAAG,4BAA4B,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAA;IACjG,OAAO,MAAM,CAAC,OAAO,CAAC;QACpB,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,EAAE,MAAM,CAAC,OAAO;QACnB,SAAS;QACT,QAAQ,EAAE,SAAS,IAAI,EAAE;QACzB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC;KACvB,CAAC,CAAA;AACJ,CAAC,CAAC,CACH,CAAA;AAEH,MAAM,6BAA6B,GAAG,CAAgB,GAAkB,EAA2C,EAAE;IACnH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC,CAAC,CAAA;IAC9F,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;IACpB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,CAAC,CAAA;IACjG,CAAC;IACD,OAAO,wBAAwB,CAAC,KAAK,CAAC,CAAA;AACxC,CAAC,CAAA;AAED,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,aAAa,CAAA;IACnC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAA;IACvC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA;IAE7B,MAAM,aAAa,GAA+C,CAAC,YAAY,EAAE,KAAK,EAAE,EAAE,CACxF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CACnD,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,kCAAkC,KAAK,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CACzF,CACF,CAAA;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAChE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,YAAY,EAAE;YAC1D,KAAK;YACL,QAAQ;YACR,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;SACxE,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,kCAAkC,YAAY,EAAE,EAAE,KAAK,EAAE,CAAC,CACvF,CACF,CAAA;QAED,OAAO,KAAK,CAAC,CAAC,6BAA6B,CAAC,MAAM,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;IAEJ,OAAO,iBAAiB,CAAC,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,CAAA;AAChD,CAAC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,KAAK,GAA6F,KAAK;KACjH,MAAM,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAA"}

package/dist/IssueService.d.ts

@@ -81,12 +81,86 @@ export interface SearchResult {
     readonly nextPageToken: string | null;
     readonly maxResults: number;
 }
+/**
+ * Edits to apply to an issue's list-valued fields.
+ *
+ * `add`/`remove` are incremental and `set` replaces. Prefer the incremental pair:
+ * `fixVersions` and `labels` are **sets**, so a `set` that forgets an existing
+ * value silently drops it — the failure mode when scripting a release scope.
+ *
+ * An empty array reads as "not supplied", not as "clear the field". The CLI's
+ * repeatable flags use `Options.atLeast(0)`, which reports an absent flag as
+ * `[]`, so treating `[]` as a replacement would turn every unpassed flag into a
+ * destructive clear. The consequence is that clearing a field outright is not
+ * currently expressible; it needs an explicit `--clear-*` flag (or a
+ * presence-aware option type) rather than a reinterpretation of `[]`.
+ *
+ * @category Types
+ */
+export interface EditIssueInput {
+    readonly addFixVersions?: ReadonlyArray<string>;
+    readonly removeFixVersions?: ReadonlyArray<string>;
+    readonly setFixVersions?: ReadonlyArray<string>;
+    readonly addLabels?: ReadonlyArray<string>;
+    readonly removeLabels?: ReadonlyArray<string>;
+    readonly setLabels?: ReadonlyArray<string>;
+}
+/** Any JSON value, matching what the generated client accepts for field values. */
+type JsonValue = string | number | boolean | null | ReadonlyArray<JsonValue> | {
+    readonly [key: string]: JsonValue;
+};
+/** One entry in Jira's `update` map. */
+interface FieldOperation {
+    readonly add?: JsonValue;
+    readonly remove?: JsonValue;
+}
+/** A `PUT /issue/{key}` body: `fields` replaces, `update` applies operations. */
+interface EditIssuePayload {
+    readonly fields?: {
+        readonly [field: string]: JsonValue;
+    };
+    readonly update?: {
+        readonly [field: string]: ReadonlyArray<FieldOperation>;
+    };
+}
+/**
+ * Outcome of {@link buildEditIssuePayload}: either a body to send, or the
+ * reason the requested edit is not expressible as one.
+ *
+ * Tagged rather than discriminated by property presence, so a caller matches on
+ * `_tag` and a future third outcome cannot narrow silently.
+ *
+ * @category Types
+ */
+export type EditIssuePayloadResult = {
+    readonly _tag: "Payload";
+    readonly payload: EditIssuePayload;
+} | {
+    readonly _tag: "Invalid";
+    readonly reason: string;
+};
+/**
+ * Build the `PUT /issue/{key}` body for an {@link EditIssueInput}.
+ *
+ * Incremental edits go through Jira's `update` verb rather than a
+ * read-modify-write on `fields`: the server applies them atomically, so a
+ * concurrent edit cannot be clobbered and no extra GET is needed.
+ *
+ * Jira rejects a field that appears in both `fields` and `update`, and the error
+ * it returns does not name the field — so that combination is caught here with a
+ * message that does.
+ *
+ * Pure so the payload shape can be tested without the API.
+ *
+ * @category Utilities
+ */
+export declare const buildEditIssuePayload: (input: EditIssueInput) => EditIssuePayloadResult;
 /**
  * IssueService interface.
  *
  * @category Services
  */
-export interface IssueServiceShape {
+export interface IssueServiceContract {
     /** Get a single issue by key */
     readonly getByKey: (key: string) => Effect.Effect<Issue, JiraApiError>;
     /** Search issues by JQL query */
@@ -95,8 +169,13 @@ export interface IssueServiceShape {
     readonly searchAll: (jql: string, options?: {
         readonly maxResults?: number;
     }) => Effect.Effect<ReadonlyArray<Issue>, JiraApiError>;
+    /**
+     * Edit an issue's list-valued fields (fixVersions, labels) and return the
+     * issue as it stands afterwards. Needs `write:jira-work`.
+     */
+    readonly edit: (key: string, input: EditIssueInput) => Effect.Effect<Issue, JiraApiError>;
 }
-declare const IssueService_base: Context.ServiceClass<IssueService, "@knpkv/jira-cli/IssueService", IssueServiceShape>;
+declare const IssueService_base: Context.ServiceClass<IssueService, "@knpkv/jira-cli/IssueService", IssueServiceContract>;
 /**
  * IssueService tag.
  *
@@ -121,6 +200,6 @@ export declare class IssueService extends IssueService_base {
  *
  * @category Layers
  */
-export declare const layer: Layer.Layer<IssueService, never, SiteUrl | JiraApiClient>;
+export declare const layer: Layer.Layer<IssueService, never, JiraApiClient | SiteUrl>;
 export {};
 //# sourceMappingURL=IssueService.d.ts.map

package/dist/IssueService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IssueService.d.ts","sourceRoot":"","sources":["../src/IssueService.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AACtD,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAErC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;;AAEhD;;;;GAIG;AACH,qBAAa,OAAQ,SAAQ,YAA6D;CAAG;AAE7F;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,uFAAuF;IACvF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;IACtB,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACtC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,UAAU,CAAC,CAAA;IAC/C,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,CAAA;IACzC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,CAAA;IACrC,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAwBD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,gCAAgC;IAChC,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;IACtE,iCAAiC;IACjC,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,KAAK,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,CAAA;IACpG,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,EAAE,CAClB,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KACvC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC,CAAA;CACvD;;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,YAAa,SAAQ,iBAGC;CAAG;AAqOtC;;;;GAIG;AACH,eAAO,MAAM,KAAK,2DAAmC,CAAA"}
+{"version":3,"file":"IssueService.d.ts","sourceRoot":"","sources":["../src/IssueService.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AACtD,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAGrC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;;AAEhD;;;;GAIG;AACH,qBAAa,OAAQ,SAAQ,YAA6D;CAAG;AAE7F;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,uFAAuF;IACvF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;IACtB,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACtC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,UAAU,CAAC,CAAA;IAC/C,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,CAAA;IACzC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,CAAA;IACrC,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AA2BD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IAC/C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IAClD,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IAC/C,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IAC1C,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CAC3C;AAED,mFAAmF;AACnF,KAAK,SAAS,GACV,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,GACJ,aAAa,CAAC,SAAS,CAAC,GACxB;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAA;AAEzC,wCAAwC;AACxC,UAAU,cAAc;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAA;CAC5B;AAED,iFAAiF;AACjF,UAAU,gBAAgB;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAA;IACzD,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,CAAC,cAAc,CAAC,CAAA;KAAE,CAAA;CAC9E;AAgBD;;;;;;;;GAQG;AACH,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,GAChE;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,UACzB,cAAc,KACpB,sBA4DF,CAAA;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,gCAAgC;IAChC,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;IACtE,iCAAiC;IACjC,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,KAAK,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,CAAA;IACpG,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,EAAE,CAClB,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KACvC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC,CAAA;IACtD;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;CAC1F;;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,YAAa,SAAQ,iBAGC;CAAG;AA+PtC;;;;GAIG;AACH,eAAO,MAAM,KAAK,2DAAmC,CAAA"}

package/dist/IssueService.js

@@ -8,7 +8,7 @@
  *   like `extractDisplayName` and `extractNameArray`.
  * - **Rendered fields**: Requests include `expand: "renderedFields"` to get HTML-rendered
  *   descriptions and comments, falling back to plain text.
- * - **Pagination guard**: {@link IssueServiceShape.searchAll} iterates pages using
+ * - **Pagination guard**: {@link IssueServiceContract.searchAll} iterates pages using
  *   `nextPageToken` with a MAX_PAGES (1000) safety limit.
  *
  * **Common tasks**
@@ -24,6 +24,7 @@ import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Predicate from "effect/Predicate";
+import * as Schema from "effect/Schema";
 import { JiraApiError } from "./JiraCliError.js";
 /**
  * Site URL configuration for issue links.
@@ -32,15 +33,91 @@ import { JiraApiError } from "./JiraCliError.js";
  */
 export class SiteUrl extends Context.Service()("@knpkv/jira-cli/SiteUrl") {
 }
-const recordOrEmpty = (value) => Predicate.isReadonlyObject(value) ? value : {};
-const recordArray = (value) => Array.isArray(value) ? value.filter(Predicate.isReadonlyObject) : [];
+const JsonObject = Schema.Record(Schema.String, Schema.Json);
+const isJsonObject = Schema.is(JsonObject);
+const recordOrEmpty = (value) => isJsonObject(value) ? value : {};
+const recordArray = (value) => Array.isArray(value) ? value.filter(isJsonObject) : [];
 const parseSearchJqlResponse = (value) => {
     const record = recordOrEmpty(value);
-    const nextPageToken = typeof record.nextPageToken === "string" ? record.nextPageToken : undefined;
+    const nextPageToken = Predicate.isString(record.nextPageToken) ? record.nextPageToken : undefined;
     return {
         issues: Array.isArray(record.issues) ? record.issues : [],
-        isLast: typeof record.isLast === "boolean" ? record.isLast : nextPageToken === undefined,
-        ...(nextPageToken !== undefined ? { nextPageToken } : {})
+        isLast: Predicate.isBoolean(record.isLast) ? record.isLast : nextPageToken === undefined,
+        ...((nextPageToken !== undefined) && { nextPageToken })
+    };
+};
+/**
+ * Build the `PUT /issue/{key}` body for an {@link EditIssueInput}.
+ *
+ * Incremental edits go through Jira's `update` verb rather than a
+ * read-modify-write on `fields`: the server applies them atomically, so a
+ * concurrent edit cannot be clobbered and no extra GET is needed.
+ *
+ * Jira rejects a field that appears in both `fields` and `update`, and the error
+ * it returns does not name the field — so that combination is caught here with a
+ * message that does.
+ *
+ * Pure so the payload shape can be tested without the API.
+ *
+ * @category Utilities
+ */
+export const buildEditIssuePayload = (input) => {
+    const fields = {};
+    const update = {};
+    const specs = [
+        {
+            field: "fixVersions",
+            flag: "fix-version",
+            set: input.setFixVersions,
+            add: input.addFixVersions,
+            remove: input.removeFixVersions,
+            // fixVersions entries are objects keyed by name.
+            wrap: (name) => ({ name })
+        },
+        {
+            field: "labels",
+            flag: "label",
+            set: input.setLabels,
+            add: input.addLabels,
+            remove: input.removeLabels,
+            // Labels are bare strings.
+            wrap: (label) => label
+        }
+    ];
+    for (const spec of specs) {
+        // An empty repeatable flag arrives as `[]`, which means "not passed" rather
+        // than "replace with nothing" — treating it as a set would clear the field.
+        const set = spec.set !== undefined && spec.set.length > 0 ? spec.set : undefined;
+        const increments = [
+            ...(spec.add ?? []).map((value) => ({ add: spec.wrap(value) })),
+            ...(spec.remove ?? []).map((value) => ({ remove: spec.wrap(value) }))
+        ];
+        if (set !== undefined && increments.length > 0) {
+            return {
+                _tag: "Invalid",
+                reason: `--${spec.flag} cannot be combined with --add-${spec.flag}/--remove-${spec.flag}; ` +
+                    `--${spec.flag} replaces the whole list.`
+            };
+        }
+        if (set !== undefined)
+            fields[spec.field] = set.map(spec.wrap);
+        else if (increments.length > 0)
+            update[spec.field] = increments;
+    }
+    const hasFields = Object.keys(fields).length > 0;
+    const hasUpdate = Object.keys(update).length > 0;
+    if (!hasFields && !hasUpdate) {
+        return {
+            _tag: "Invalid",
+            reason: "Nothing to edit. Pass at least one of --add-fix-version, --remove-fix-version, --fix-version, --add-label, --remove-label or --label."
+        };
+    }
+    return {
+        _tag: "Payload",
+        payload: {
+            ...(hasFields && { fields }),
+            ...(hasUpdate && { update })
+        }
     };
 };
 /**
@@ -84,12 +161,12 @@ const FIELDS = [
 const extractDisplayName = (field) => {
     if (field === null || field === undefined)
         return null;
-    if (typeof field === "string")
+    if (Predicate.isString(field))
         return field;
     if (Predicate.isReadonlyObject(field)) {
-        if (typeof field.displayName === "string")
+        if (Predicate.isString(field.displayName))
             return field.displayName;
-        if (typeof field.name === "string")
+        if (Predicate.isString(field.name))
             return field.name;
     }
     return null;
@@ -102,10 +179,10 @@ const extractNameArray = (field) => {
         return [];
     return field
         .map((item) => {
-        if (typeof item === "string")
+        if (Predicate.isString(item))
             return item;
         if (Predicate.isReadonlyObject(item)) {
-            if (typeof item.name === "string")
+            if (Predicate.isString(item.name))
                 return item.name;
         }
         return null;
@@ -134,7 +211,7 @@ const mapIssue = (bean, baseUrl) => {
     const attachmentField = fields["attachment"];
     const attachments = Array.isArray(attachmentField)
         ? recordArray(attachmentField).map((att) => {
-            const mediaType = normalizeAttachmentMediaType(undefined, typeof att["mimeType"] === "string" ? att["mimeType"] : null);
+            const mediaType = normalizeAttachmentMediaType(undefined, Predicate.isString(att["mimeType"]) ? att["mimeType"] : null);
             return {
                 id: String(att["id"] ?? ""),
                 filename: String(att["filename"] ?? ""),
@@ -164,13 +241,13 @@ const mapIssue = (bean, baseUrl) => {
         return {
             id: commentId,
             author: extractDisplayName(author) ?? "Unknown",
-            body: typeof renderedBody === "string" ? renderedBody : String(c["body"] ?? ""),
+            body: Predicate.isString(renderedBody) ? renderedBody : String(c["body"] ?? ""),
             created: parseDate(c["created"]),
             updated: parseDate(c["updated"])
         };
     });
     // Use rendered description (HTML) if available
-    const description = typeof renderedFields["description"] === "string"
+    const description = Predicate.isString(renderedFields["description"])
         ? renderedFields["description"]
         : String(fields["description"] ?? "");
     return {
@@ -207,7 +284,7 @@ const make = Effect.gen(function* () {
         params: {
             jql,
             maxResults,
-            ...(nextPageToken ? { nextPageToken } : {}),
+            ...(nextPageToken && { nextPageToken }),
             fields: FIELDS,
             expand: "renderedFields"
         }
@@ -250,7 +327,25 @@ const make = Effect.gen(function* () {
         }
         return allIssues;
     });
-    return IssueService.of({ getByKey, search, searchAll });
+    const edit = (key, input) => Effect.gen(function* () {
+        const built = buildEditIssuePayload(input);
+        if (built._tag === "Invalid")
+            return yield* Effect.fail(new JiraApiError({ message: built.reason }));
+        yield* client.editIssue(key, { payload: built.payload }).pipe(Effect.mapError((cause) => new JiraApiError({ message: `Failed to edit issue ${key}`, cause })));
+        // The 204 carries no body, so re-read to report the resulting state.
+        //
+        // Past this point the edit is already committed, so a failed read-back must
+        // not be reported as a failed edit: a caller told "edit failed" may redo a
+        // change that already landed. `returnIssue` would close the window, but the
+        // endpoint takes no `fields`, so the returned issue can silently omit what
+        // `getByKey` asks for — quietly wrong data in place of a loud error.
+        return yield* getByKey(key).pipe(Effect.mapError((cause) => new JiraApiError({
+            message: `Edited issue ${key}, but reading it back failed, so the result below is unverified. ` +
+                `The edit was applied — do not repeat it.`,
+            cause
+        })));
+    });
+    return IssueService.of({ getByKey, search, searchAll, edit });
 });
 /**
  * Layer for IssueService.