@knpkv/jira-cli 1.2.3 → 1.4.0

package/test/JiraAuthRefresh.test.ts

@@ -0,0 +1,269 @@
+/**
+ * What a failed token refresh is allowed to do to the stored credential.
+ *
+ * Atlassian rotates refresh tokens, so a refresh that does not complete leaves
+ * the client unable to tell whether the grant landed. Deleting the profile in
+ * that state is unrecoverable and unattended — `JiraApiConfigLive` builds on
+ * every CLI invocation, and jcf's statusline runs one every 30 seconds — so a
+ * bad network window could silently log the user out with nobody watching.
+ *
+ * The rule: discard the stored token only when Atlassian actually rejected it
+ * (a 4xx). Anything else — timeout, transport failure — keeps the credential so
+ * the next run can retry.
+ */
+import { NodeFileSystem, NodePath, NodeServices } from "@effect/platform-node"
+import { describe, expect, it } from "@effect/vitest"
+import {
+  HomeDirectoryLive,
+  loadActiveProfileToken,
+  saveOAuthConfig,
+  saveProfileToken
+} from "@knpkv/atlassian-common/config"
+import { ConfigProvider } from "effect"
+import * as Deferred from "effect/Deferred"
+import * as Effect from "effect/Effect"
+import * as Fiber from "effect/Fiber"
+import * as FileSystem from "effect/FileSystem"
+import { HttpClient, HttpClientResponse } from "effect/http"
+import * as Layer from "effect/Layer"
+import { TestClock } from "effect/testing"
+import { JiraAuth, layer as jiraAuthLayer } from "../src/JiraAuth.js"
+
+const TOOL = "jira-cli"
+
+const expiredToken = {
+  access_token: "expired-access",
+  refresh_token: "rotating-refresh",
+  expires_at: 0,
+  token_type: "Bearer",
+  scope: "offline_access",
+  cloud_id: "cloud-1",
+  site_url: "https://example.atlassian.net"
+}
+
+const storage = Layer.mergeAll(NodeFileSystem.layer, NodePath.layer, HomeDirectoryLive)
+
+// JiraAuth also needs a spawner (browser launch during login) and Crypto (PKCE).
+// Without them the layer dies as a defect, which no `catchTag` would see — and
+// the assertions below would then pass without the refresh ever running.
+const authLayerWith = (client: Layer.Layer<HttpClient.HttpClient>) =>
+  jiraAuthLayer.pipe(Layer.provide(Layer.mergeAll(client, NodeServices.layer)))
+
+// A client that never answers — the stall case, driven by TestClock. It reports
+// when the request has actually been issued so the test can advance the clock at
+// a point where the refresh deadline is registered; adjusting before that would
+// move past the deadline before it exists and hang.
+const stalledClient = (issued: Deferred.Deferred<void>) =>
+  Layer.succeed(
+    HttpClient.HttpClient,
+    HttpClient.make(() => Effect.flatMap(Deferred.succeed(issued, undefined), () => Effect.never))
+  )
+
+const respondingClient = (status: number, body: string) =>
+  Layer.succeed(
+    HttpClient.HttpClient,
+    HttpClient.make((request) => Effect.succeed(HttpClientResponse.fromWeb(request, new Response(body, { status }))))
+  )
+
+// A client that answers with the one thing that does prove the token is dead.
+const rejectingClient = respondingClient(400, JSON.stringify({ error: "invalid_grant" }))
+
+// A rotation that only completes once the test says so, so interruption can be
+// aimed at the exact window between the grant and the token being persisted.
+const gatedClient = (issued: Deferred.Deferred<void>, release: Deferred.Deferred<void>) =>
+  Layer.succeed(
+    HttpClient.HttpClient,
+    HttpClient.make((request) =>
+      Effect.gen(function*() {
+        yield* Deferred.succeed(issued, undefined)
+        yield* Deferred.await(release)
+        return HttpClientResponse.fromWeb(
+          request,
+          new Response(
+            JSON.stringify({
+              access_token: "fresh-access",
+              refresh_token: "rotated-refresh",
+              expires_in: 3600,
+              scope: "offline_access",
+              token_type: "Bearer"
+            }),
+            { status: 200, headers: { "content-type": "application/json" } }
+          )
+        )
+      })
+    )
+  )
+
+// `HomeDirectoryLive` resolves HOME through the ambient ConfigProvider, so the
+// test home can be injected rather than set on `process.env` — a global that
+// parallel tests would race each other to overwrite and restore. The directory
+// is scoped, so it is removed when the effect finishes either way.
+const withHome = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+  Effect.gen(function*() {
+    const fs = yield* FileSystem.FileSystem
+    const home = yield* fs.makeTempDirectoryScoped({ prefix: "jcf-auth-" })
+    return yield* effect.pipe(
+      Effect.provide(ConfigProvider.layer(ConfigProvider.fromEnv({ env: { HOME: home } })))
+    )
+  }).pipe(Effect.scoped, Effect.provide(NodeFileSystem.layer))
+
+const storedToken = loadActiveProfileToken(TOOL).pipe(Effect.provide(storage))
+
+// Both the token and the client config have to be on disk, or `getConfig`
+// short-circuits the refresh before any request is made and the assertions
+// below would pass without exercising anything.
+const seedExpiredToken = Effect.gen(function*() {
+  yield* saveOAuthConfig(TOOL, { clientId: "client-1", clientSecret: "secret-1" })
+  yield* saveProfileToken(TOOL, expiredToken)
+}).pipe(Effect.provide(storage))
+
+describe("JiraAuth token refresh", () => {
+  it.effect("keeps the stored credential when the refresh never answers", () =>
+    withHome(Effect.gen(function*() {
+      yield* seedExpiredToken
+
+      const issued = yield* Deferred.make<void>()
+      const attempt = JiraAuth.pipe(
+        Effect.flatMap((auth) => auth.getAccessToken()),
+        Effect.provide(authLayerWith(stalledClient(issued))),
+        Effect.exit
+      )
+      const fiber = yield* attempt.pipe(Effect.forkChild({ startImmediately: true }))
+
+      yield* Deferred.await(issued)
+      yield* TestClock.adjust("31 seconds")
+      const exit = yield* Fiber.join(fiber)
+
+      expect(exit._tag).toBe("Failure")
+      // The point of the test: a stall is not evidence, so the token survives.
+      const after = yield* storedToken
+      expect(after?.refresh_token).toBe("rotating-refresh")
+    })))
+
+  // Rate limiting is the case this most needs to survive: several `jira`/`jcf`
+  // processes on one expired token hit the endpoint together, one wins the
+  // rotation and the rest get 429. Treating that as a verdict on the token
+  // would log the user out precisely when things are busiest.
+  it.effect("keeps the stored credential when the provider rate-limits", () =>
+    withHome(Effect.gen(function*() {
+      yield* seedExpiredToken
+
+      const exit = yield* JiraAuth.pipe(
+        Effect.flatMap((auth) => auth.getAccessToken()),
+        Effect.provide(authLayerWith(respondingClient(429, "Too Many Requests"))),
+        Effect.exit
+      )
+
+      expect(exit._tag).toBe("Failure")
+      const after = yield* storedToken
+      expect(after?.refresh_token).toBe("rotating-refresh")
+    })))
+
+  // `refreshToken` sends the client credentials in the body, so a wrong or
+  // rotated secret comes back as `400 invalid_client` — a config problem, not a
+  // dead token. Deleting here would destroy a working credential and force a
+  // re-login that fails identically until `jira auth configure` is run.
+  it.effect("keeps the stored credential when the client credentials are rejected", () =>
+    withHome(Effect.gen(function*() {
+      yield* seedExpiredToken
+
+      const exit = yield* JiraAuth.pipe(
+        Effect.flatMap((auth) => auth.getAccessToken()),
+        Effect.provide(authLayerWith(respondingClient(400, JSON.stringify({ error: "invalid_client" })))),
+        Effect.exit
+      )
+
+      expect(exit._tag).toBe("Failure")
+      const after = yield* storedToken
+      expect(after?.refresh_token).toBe("rotating-refresh")
+    })))
+
+  // A bare 403 is as likely to be a proxy or WAF as Atlassian revoking
+  // anything, so the code has to say so explicitly.
+  it.effect("keeps the stored credential on a 403 that does not say invalid_grant", () =>
+    withHome(Effect.gen(function*() {
+      yield* seedExpiredToken
+
+      const exit = yield* JiraAuth.pipe(
+        Effect.flatMap((auth) => auth.getAccessToken()),
+        Effect.provide(authLayerWith(respondingClient(403, "<html>Forbidden</html>"))),
+        Effect.exit
+      )
+
+      expect(exit._tag).toBe("Failure")
+      const after = yield* storedToken
+      expect(after?.refresh_token).toBe("rotating-refresh")
+    })))
+
+  it.effect("discards the stored credential on a 403 revocation", () =>
+    withHome(Effect.gen(function*() {
+      yield* seedExpiredToken
+
+      const exit = yield* JiraAuth.pipe(
+        Effect.flatMap((auth) => auth.getAccessToken()),
+        Effect.provide(authLayerWith(respondingClient(403, JSON.stringify({ error: "invalid_grant" })))),
+        Effect.exit
+      )
+
+      expect(exit._tag).toBe("Failure")
+      const after = yield* storedToken
+      expect(after).toBeNull()
+    })))
+
+  // An unparseable body is no verdict at all, so the conservative reading wins.
+  it.effect("keeps the stored credential when the error body is unparseable", () =>
+    withHome(Effect.gen(function*() {
+      yield* seedExpiredToken
+
+      const exit = yield* JiraAuth.pipe(
+        Effect.flatMap((auth) => auth.getAccessToken()),
+        Effect.provide(authLayerWith(respondingClient(400, "not json at all"))),
+        Effect.exit
+      )
+
+      expect(exit._tag).toBe("Failure")
+      const after = yield* storedToken
+      expect(after?.refresh_token).toBe("rotating-refresh")
+    })))
+
+  // The atomicity half: once the grant is out, the replacement must reach disk
+  // even though the caller has already given up on the fiber.
+  it.effect("persists the rotated token even when interrupted mid-rotation", () =>
+    withHome(Effect.gen(function*() {
+      yield* seedExpiredToken
+      const issued = yield* Deferred.make<void>()
+      const release = yield* Deferred.make<void>()
+
+      const fiber = yield* JiraAuth.pipe(
+        Effect.flatMap((auth) => auth.getAccessToken()),
+        Effect.provide(authLayerWith(gatedClient(issued, release))),
+        Effect.exit,
+        Effect.forkChild({ startImmediately: true })
+      )
+
+      yield* Deferred.await(issued) // the grant is in flight
+      const interrupting = yield* Fiber.interrupt(fiber).pipe(Effect.forkChild({ startImmediately: true }))
+      yield* Deferred.succeed(release, undefined) // now let it answer
+      yield* Fiber.join(interrupting)
+
+      // The interrupt could not tear the rotation in half, so the replacement
+      // is on disk rather than lost with the token it consumed.
+      const after = yield* storedToken
+      expect(after?.refresh_token).toBe("rotated-refresh")
+    })))
+
+  it.effect("discards the stored credential only when the provider rejects it", () =>
+    withHome(Effect.gen(function*() {
+      yield* seedExpiredToken
+
+      const exit = yield* JiraAuth.pipe(
+        Effect.flatMap((auth) => auth.getAccessToken()),
+        Effect.provide(authLayerWith(rejectingClient)),
+        Effect.exit
+      )
+
+      expect(exit._tag).toBe("Failure")
+      const after = yield* storedToken
+      expect(after).toBeNull()
+    })))
+})

package/test/VersionService.test.ts

@@ -1,10 +1,10 @@
 import { describe, expect, it } from "@effect/vitest"
 import { JiraApiClient, make } from "@knpkv/jira-api-client"
 import * as Effect from "effect/Effect"
+import * as HttpClient from "effect/http/HttpClient"
+import * as HttpClientResponse from "effect/http/HttpClientResponse"
 import * as Layer from "effect/Layer"
 import * as Redacted from "effect/Redacted"
-import * as HttpClient from "effect/unstable/http/HttpClient"
-import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse"
 import { stripEmails } from "../src/commands/version.js"
 import type { Version } from "../src/VersionService.js"
 import {

package/test/commandTree.test.ts

@@ -1,9 +1,9 @@
 import { describe, expect, it } from "@effect/vitest"
+import { Command } from "effect/cli"
 import * as Effect from "effect/Effect"
 import * as Layer from "effect/Layer"
 import * as Ref from "effect/Ref"
 import * as Terminal from "effect/Terminal"
-import { Command } from "effect/unstable/cli"
 import { AttachmentService } from "../src/AttachmentService.js"
 import { issueCommand } from "../src/commands/issue.js"
 import { versionCommand } from "../src/commands/version.js"
@@ -20,6 +20,9 @@ interface CommandCalls {
   readonly versionUpdate: number
   readonly relatedWorkList: number
   readonly relatedWorkAdd: number
+  readonly relatedWorkDelete: number
+  readonly issueEdit: number
+  readonly versionCreate: number
   readonly writeMulti: number
 }
 
@@ -28,10 +31,13 @@ const emptyCalls: CommandCalls = {
   issueAttachmentUpload: 0,
   issueSearch: 0,
   relatedWorkAdd: 0,
+  relatedWorkDelete: 0,
   relatedWorkList: 0,
   versionGet: 0,
   versionList: 0,
   versionUpdate: 0,
+  issueEdit: 0,
+  versionCreate: 0,
   writeMulti: 0
 }
 
@@ -117,6 +123,10 @@ const CommandServicesLayer = (calls: Ref.Ref<CommandCalls>) =>
           Ref.update(calls, (state) => ({ ...state, issueGet: state.issueGet + 1 })).pipe(
             Effect.as(sampleIssue)
           ),
+        edit: () =>
+          Ref.update(calls, (state) => ({ ...state, issueEdit: state.issueEdit + 1 })).pipe(
+            Effect.as(sampleIssue)
+          ),
         search: () => Effect.die("IssueService.search should not be called"),
         searchAll: () =>
           Ref.update(calls, (state) => ({ ...state, issueSearch: state.issueSearch + 1 })).pipe(
@@ -138,6 +148,12 @@ const CommandServicesLayer = (calls: Ref.Ref<CommandCalls>) =>
           Ref.update(calls, (state) => ({ ...state, relatedWorkAdd: state.relatedWorkAdd + 1 })).pipe(
             Effect.as(sampleRelatedWork)
           ),
+        createVersion: () =>
+          Ref.update(calls, (state) => ({ ...state, versionCreate: state.versionCreate + 1 })).pipe(
+            Effect.as(sampleVersion)
+          ),
+        deleteRelatedWork: () =>
+          Ref.update(calls, (state) => ({ ...state, relatedWorkDelete: state.relatedWorkDelete + 1 })),
         getVersion: () =>
           Ref.update(calls, (state) => ({ ...state, versionGet: state.versionGet + 1 })).pipe(
             Effect.as(sampleVersion)
@@ -261,6 +277,21 @@ describe("Jira command tree", () => {
         calls,
         output
       )
+      // The sample related work already links this URL, so the reconcile keeps
+      // it and adds nothing — what this covers is that the command resolves and
+      // the service's new deleteRelatedWork member is actually wired up.
+      const relatedWorkSyncExit = yield* runJiraCommand(
+        [
+          "version",
+          "related-work",
+          "sync",
+          "10042",
+          "--link",
+          `Release notes=${sampleRelatedWork.url}`
+        ],
+        calls,
+        output
+      )
       const legacyViewExit = yield* runJiraCommand(["version", "view", "10042"], calls, legacyViewOutput)
       const legacySetExit = yield* runJiraCommand(
         [
@@ -289,16 +320,141 @@ describe("Jira command tree", () => {
       expect(updateExit._tag).toBe("Success")
       expect(relatedWorkListExit._tag).toBe("Success")
       expect(relatedWorkAddExit._tag).toBe("Success")
+      expect(relatedWorkSyncExit._tag).toBe("Success")
       expect(legacyViewExit._tag).toBe("Failure")
       expect(legacySetExit._tag).toBe("Failure")
       expect(legacyRelatedWorkExit._tag).toBe("Failure")
 
       expect(yield* Ref.get(calls)).toMatchObject({
         relatedWorkAdd: 1,
-        relatedWorkList: 1,
+        // The desired link already exists, so sync neither adds nor deletes.
+        relatedWorkDelete: 0,
+        relatedWorkList: 2,
         versionGet: 1,
         versionList: 1,
         versionUpdate: 1
       })
     }))
+
+  // `--link " =url"` and `--link "title= "` both have a non-empty span either
+  // side of the `=`, so a check on the separator position alone lets them
+  // through and Jira receives a link with an empty title or url.
+  it.effect("rejects a --link whose title or url is only whitespace", () =>
+    Effect.gen(function*() {
+      const calls = yield* Ref.make(emptyCalls)
+      const output = yield* Ref.make("")
+
+      const blankTitle = yield* runJiraCommand(
+        ["version", "related-work", "sync", "10042", "--link", " =https://example.atlassian.net/wiki/pages/1"],
+        calls,
+        output
+      )
+      const blankUrl = yield* runJiraCommand(
+        ["version", "related-work", "sync", "10042", "--link", "Release notes=   "],
+        calls,
+        output
+      )
+
+      expect(blankTitle._tag).toBe("Failure")
+      expect(blankUrl._tag).toBe("Failure")
+      // Rejected before the remote write, not after it.
+      expect(yield* Ref.get(calls)).toMatchObject({
+        relatedWorkAdd: 0,
+        relatedWorkDelete: 0,
+        relatedWorkList: 0
+      })
+    }))
+
+  // The nearby valid fixture: surrounding whitespace is normalized, not
+  // rejected.
+  it.effect("normalizes a --link padded with whitespace", () =>
+    Effect.gen(function*() {
+      const calls = yield* Ref.make(emptyCalls)
+      const output = yield* Ref.make("")
+
+      const exit = yield* runJiraCommand(
+        ["version", "related-work", "sync", "10042", "--link", `  Release notes = ${sampleRelatedWork.url}  `],
+        calls,
+        output
+      )
+
+      expect(exit._tag).toBe("Success")
+      // Matched the existing link by URL, so nothing was added or removed.
+      expect(yield* Ref.get(calls)).toMatchObject({
+        relatedWorkAdd: 0,
+        relatedWorkDelete: 0,
+        relatedWorkList: 1
+      })
+    }))
+
+  it.effect("wires up issue edit and reaches IssueService.edit", () =>
+    Effect.gen(function*() {
+      const calls = yield* Ref.make(emptyCalls)
+      const output = yield* Ref.make("")
+
+      const exit = yield* runJiraCommand(
+        ["issue", "edit", "PROJ-123", "--add-fix-version", "OOB 100", "--add-label", "domain:oob"],
+        calls,
+        output
+      )
+
+      expect(exit._tag).toBe("Success")
+      expect(yield* Ref.get(calls)).toMatchObject({ issueEdit: 1 })
+    }))
+
+  // `Options.atLeast(0)` reports an absent repeatable flag as `[]`, which
+  // `buildEditIssuePayload` reads as "not supplied". Pin that here: with only
+  // one flag passed the command must still resolve, rather than the other five
+  // empty arrays being taken as replacements that clear their fields.
+  it.effect("treats the repeatable flags a caller omits as absent", () =>
+    Effect.gen(function*() {
+      const calls = yield* Ref.make(emptyCalls)
+      const output = yield* Ref.make("")
+
+      const exit = yield* runJiraCommand(
+        ["issue", "edit", "PROJ-123", "--add-label", "domain:oob"],
+        calls,
+        output
+      )
+
+      expect(exit._tag).toBe("Success")
+      expect(yield* Ref.get(calls)).toMatchObject({ issueEdit: 1 })
+    }))
+
+  // Note: `issue edit PROJ-123` with no flags parses fine and reaches the
+  // service — the "nothing to edit" refusal lives in `buildEditIssuePayload`
+  // inside `IssueService.edit`, which this suite stubs out. That path is covered
+  // by editIssuePayload.test.ts and remoteWrites.test.ts.
+
+  it.effect("wires up version create and reaches VersionService.createVersion", () =>
+    Effect.gen(function*() {
+      const calls = yield* Ref.make(emptyCalls)
+      const output = yield* Ref.make("")
+
+      const exit = yield* runJiraCommand(
+        ["version", "create", "--project", "PROJ", "--name", "OOB 100"],
+        calls,
+        output
+      )
+
+      expect(exit._tag).toBe("Success")
+      expect(yield* Ref.get(calls)).toMatchObject({ versionCreate: 1 })
+    }))
+
+  // Shape-only date validation would let this through and Jira would answer
+  // with an unattributed 400 — after the version was already created.
+  it.effect("rejects a non-existent --start-date before the remote write", () =>
+    Effect.gen(function*() {
+      const calls = yield* Ref.make(emptyCalls)
+      const output = yield* Ref.make("")
+
+      const exit = yield* runJiraCommand(
+        ["version", "create", "--project", "PROJ", "--name", "OOB 100", "--start-date", "2026-02-30"],
+        calls,
+        output
+      )
+
+      expect(exit._tag).toBe("Failure")
+      expect(yield* Ref.get(calls)).toMatchObject({ versionCreate: 0 })
+    }))
 })

package/test/editIssuePayload.test.ts

@@ -0,0 +1,103 @@
+import { describe, expect, it } from "@effect/vitest"
+import { isIsoDate } from "../src/commands/version.js"
+import { buildEditIssuePayload } from "../src/IssueService.js"
+
+const payloadOf = (result: ReturnType<typeof buildEditIssuePayload>) => {
+  if (result._tag === "Invalid") throw new Error(`expected a payload, got invalid: ${result.reason}`)
+  return result.payload
+}
+
+const errorOf = (result: ReturnType<typeof buildEditIssuePayload>): string => {
+  if (result._tag === "Payload") throw new Error("expected an invalid result, got a payload")
+  return result.reason
+}
+
+describe("buildEditIssuePayload", () => {
+  // The reason this helper exists: attaching a ticket to a release must not
+  // disturb the releases it is already in, so an add goes through `update`
+  // rather than replacing `fields.fixVersions`.
+  it("sends an added fix version as an incremental update, not a replacement", () => {
+    const payload = payloadOf(buildEditIssuePayload({ addFixVersions: ["OOB 100"] }))
+
+    expect(payload.update).toEqual({ fixVersions: [{ add: { name: "OOB 100" } }] })
+    expect(payload.fields).toBeUndefined()
+  })
+
+  it("wraps fix versions as objects and labels as bare strings", () => {
+    const payload = payloadOf(
+      buildEditIssuePayload({ addFixVersions: ["OOB 100"], addLabels: ["domain:oob"] })
+    )
+
+    expect(payload.update).toEqual({
+      fixVersions: [{ add: { name: "OOB 100" } }],
+      labels: [{ add: "domain:oob" }]
+    })
+  })
+
+  it("combines adds and removes for the same field in one call", () => {
+    const payload = payloadOf(
+      buildEditIssuePayload({ addFixVersions: ["OOB 100"], removeFixVersions: ["OOB 99"] })
+    )
+
+    expect(payload.update).toEqual({
+      fixVersions: [{ add: { name: "OOB 100" } }, { remove: { name: "OOB 99" } }]
+    })
+  })
+
+  it("sends a replacement through fields", () => {
+    const payload = payloadOf(buildEditIssuePayload({ setFixVersions: ["OOB 100"] }))
+
+    expect(payload.fields).toEqual({ fixVersions: [{ name: "OOB 100" }] })
+    expect(payload.update).toBeUndefined()
+  })
+
+  // Jira rejects a field named in both `fields` and `update`, and its error does
+  // not say which field — so the combination is refused here instead.
+  it("refuses a replacement combined with an increment on the same field", () => {
+    const message = errorOf(
+      buildEditIssuePayload({ setFixVersions: ["OOB 100"], addFixVersions: ["OOB 99"] })
+    )
+
+    expect(message).toContain("--fix-version cannot be combined")
+  })
+
+  it("allows replacing one field while incrementing the other", () => {
+    const payload = payloadOf(
+      buildEditIssuePayload({ setFixVersions: ["OOB 100"], addLabels: ["domain:oob"] })
+    )
+
+    expect(payload.fields).toEqual({ fixVersions: [{ name: "OOB 100" }] })
+    expect(payload.update).toEqual({ labels: [{ add: "domain:oob" }] })
+  })
+
+  it("refuses an edit that would send nothing", () => {
+    expect(errorOf(buildEditIssuePayload({}))).toContain("Nothing to edit")
+  })
+
+  // Empty repeatable flags arrive as `[]`, which must read as "not passed"
+  // rather than "replace with nothing" — the latter would clear the field.
+  it("treats empty flag arrays as absent rather than as a clear", () => {
+    expect(errorOf(buildEditIssuePayload({ setFixVersions: [], addLabels: [] }))).toContain("Nothing to edit")
+  })
+})
+
+describe("isIsoDate", () => {
+  it("accepts an ISO date", () => {
+    expect(isIsoDate("2026-08-12")).toBe(true)
+  })
+
+  it.each([
+    ["12-08-2026", "day first"],
+    ["2026-8-12", "unpadded month"],
+    ["2026-08-12T00:00:00Z", "timestamp"],
+    ["", "empty"]
+  ])("rejects %s (%s)", (value) => {
+    expect(isIsoDate(value)).toBe(false)
+  })
+
+  // Shape-only validation would let these through and Jira would answer with an
+  // unattributed 400.
+  it.each(["2026-02-30", "2026-13-01", "2026-00-10"])("rejects the non-existent date %s", (value) => {
+    expect(isIsoDate(value)).toBe(false)
+  })
+})

package/test/frontmatter.test.ts

@@ -1,4 +1,6 @@
 import { describe, expect, it } from "@effect/vitest"
+import * as Predicate from "effect/Predicate"
+import type * as Schema from "effect/Schema"
 import * as yaml from "js-yaml"
 import { extractFrontMatter, serializeIssue } from "../src/internal/frontmatter.js"
 import type { Issue } from "../src/IssueService.js"
@@ -8,10 +10,10 @@ import type { Issue } from "../src/IssueService.js"
  * directly. We avoid gray-matter's default parser here because it calls the
  * removed `safeLoad` — the same incompatibility this module works around.
  */
-const parseFrontMatter = (output: string): Record<string, unknown> => {
+const parseFrontMatter = (output: string): Record<string, Schema.Json> => {
   const match = output.match(/^---\n([\s\S]*?)\n---/)
   const parsed = match ? yaml.load(match[1]) : {}
-  return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)
+  return parsed !== null && Predicate.isObjectOrArray(parsed) && !Array.isArray(parsed)
     ? Object.fromEntries(Object.entries(parsed))
     : {}
 }