@knpkv/jira-clockify 1.5.0 → 1.6.1

package/README.md

@@ -10,35 +10,59 @@ Built with Effect-TS and [@opentui/react](https://github.com/anomalyco/opentui).
 pnpm add @knpkv/jira-clockify
 ```
 
-Or link globally:
+Or link globally from this repository. The linked `jcf` runs the build output, so build it and the
+workspace packages it imports first:
 
 ```bash
+pnpm --filter "@knpkv/jira-clockify..." build
 cd packages/jira-clockify && pnpm link --global
 ```
 
 ## Setup
 
-### 1. Jira OAuth
+Run `jcf` with nothing set up and it asks about each system in turn; either can be skipped and
+added later. `jcf auth status` shows what is connected and what to run next. Every step below can
+also be run on its own.
+
+### 1. Jira
 
 ```bash
-jcf auth jira create      # Opens Atlassian console — create OAuth 2.0 app
+jcf auth jira token        # Site, email and an API token from https://id.atlassian.com/manage-profile/security/api-tokens
+```
+
+The token is checked against Jira before it is saved to `~/.jcf/jira.json` (owner-only, `0600`) and is
+never printed. Only Jira Cloud addresses (`*.atlassian.net`) are accepted, so a typo or look-alike
+domain never receives the token. Classic and scoped tokens both work: a scoped token, which the
+site itself refuses, is used through Atlassian's gateway for that site (`api.atlassian.com/ex/jira/<cloud id>`). A failed check says whether the site, the token or the network was
+the problem.
+
+Advanced: connect through your own Atlassian OAuth app instead.
+
+```bash
+jcf auth jira create       # Opens Atlassian console — create OAuth 2.0 app
 jcf auth jira configure    # Set client ID and secret
 jcf auth jira login        # Authenticate via browser
 ```
 
+When both exist, the API token is used. `jcf auth jira logout` removes both.
+
 ### 2. Clockify API Key
 
 ```bash
 jcf auth clockify setup    # Enter API key from https://app.clockify.me/manage-api-keys
+jcf auth clockify setup --api-key <key> --workspace <name>   # For scripts; the key is visible to other processes
 ```
 
+Commands that need a system that is not connected fail with one line naming the command that
+connects it, and exit non-zero.
+
 ### 3. Configure Defaults
 
 ```bash
 jcf config set project     # Select default Clockify project
 jcf config set billable    # Set default billable flag
 jcf config set jql <jql>   # Set default JQL filter
-jcf config show            # Show current config
+jcf config show            # Show current config; marks values that are jcf's defaults
 jcf config reset           # Reset to defaults
 ```
 
@@ -96,8 +120,13 @@ jcf sync reconcile jira-to-clockify        # Fill Clockify from Jira
 jcf sync reconcile --agent claude             # Propose worklogs from local Claude Code sessions
 jcf sync reconcile --agent claude --calendar  # ...with an hour-by-hour grid of when it happened
 jcf sync reconcile --agent claude --json      # Reporting only: one JSON value, nothing logged
+jcf sync reconcile --agent claude --only clockify  # Read and write Clockify alone (or --only jira)
 ```
 
+An agent run reads both systems before it proposes anything, because a side it cannot read looks the
+same as a side with nothing recorded. If one is not connected the run stops before planning and says
+how to connect it, or to pass `--only` for the other one.
+
 `--agent claude` is for time _neither_ side recorded: it reads Claude Code and Codex transcripts,
 keeps work inside your session roots, and works out which issue each
 session belongs to and how long it accounts for, subtracts
@@ -319,12 +348,14 @@ Stored in `~/.jcf/`:
 ~/.jcf/
 ├── config.json      # JQL, project, billable defaults, session roots
 ├── clockify.json    # Clockify API key, workspace, user
+├── jira.json        # Jira site, cloud id, email, API token, account (0600)
 ├── poll.lock       # Kernel lock held by the active managed poll
 ├── poll.stamp      # Last managed poll attempt, including failures
 └── state.json       # Current timer state and polling authority
 ```
 
-Jira OAuth credentials stored via `@knpkv/atlassian-common` in `~/.config/atlassian/`.
+Jira OAuth credentials (the advanced path) are stored via `@knpkv/atlassian-common` in
+`~/.config/atlassian/`. That store holds OAuth logins only, so the API token lives in `~/.jcf/jira.json`.
 
 ## License
 

package/dist/package.json

@@ -1,15 +1,25 @@
 {
     "name": "@knpkv/jira-clockify",
-    "version": "1.5.0",
+    "version": "1.6.1",
     "description": "TUI for Jira-Clockify time tracking, attachable to neovim",
     "license": "MIT",
     "author": "knpkv",
     "type": "module",
-    "main": "src/index.ts",
+    "main": "dist/src/index.js",
+    "types": "src/index.ts",
     "exports": {
-        ".": "./src/index.ts",
-        "./testing.js": "./src/testing/fakeHeadless.ts",
-        "./*.js": "./src/*.ts"
+        ".": {
+            "types": "./src/index.ts",
+            "default": "./dist/src/index.js"
+        },
+        "./testing.js": {
+            "types": "./src/testing/fakeHeadless.ts",
+            "default": "./dist/src/testing/fakeHeadless.js"
+        },
+        "./*.js": {
+            "types": "./src/*.ts",
+            "default": "./dist/src/*.js"
+        }
     },
     "bin": {
         "jcf": "dist/src/bin.js"

package/dist/src/bin.js

@@ -5,22 +5,33 @@
  * @module
  */
 import { NodeRuntime } from "@effect/platform-node";
-import { Effect } from "effect";
+import { Console, Data, Effect } from "effect";
 import { Command } from "effect/cli";
 import * as Runtime from "effect/Runtime";
 import * as Stdio from "effect/Stdio";
+import pkg from "../package.json" with { type: "json" };
 import { HeadlessLayer } from "./cli/layers.js";
 import { root } from "./cli/root.js";
 import { reportUnhandled } from "./cli/runtimeFailure.js";
+import { unknownCommandLine } from "./cli/unknownCommand.js";
 const processArgv = Effect.gen(function* () {
     const stdio = yield* Stdio.Stdio;
     const args = yield* stdio.args;
     return args;
 });
-const cli = Command.runWith(root, {
-    version: "0.1.0"
-});
-const program = reportUnhandled(processArgv.pipe(Effect.flatMap((argv) => cli(argv)))).pipe(
+const cli = Command.runWith(root, { version: pkg.version });
+/** An unknown command fails with one line, before effect/cli prints the whole help above it. */
+class UnknownCommand extends Data.TaggedError("UnknownCommand") {
+    [Runtime.errorReported] = false;
+}
+const program = reportUnhandled(processArgv.pipe(Effect.flatMap((argv) => Effect.gen(function* () {
+    const unknown = unknownCommandLine(argv, root);
+    if (unknown !== undefined) {
+        yield* Console.error(unknown);
+        return yield* new UnknownCommand();
+    }
+    return yield* cli(argv);
+})))).pipe(
 // This *is* the entry point: the one place the whole layer graph is composed and provided.
 // @effect-diagnostics-next-line strictEffectProvide:off
 Effect.provide(HeadlessLayer));

package/dist/src/bin.js.map

@@ -1 +1 @@
-{"version":3,"file":"bin.js","sourceRoot":"","sources":["../../src/bin.ts"],"names":[],"mappings":";AACA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACpC,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAA;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAEzD,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAA;IAChC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAA;IAC9B,OAAO,IAAI,CAAA;AACb,CAAC,CAAC,CAAA;AAEF,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE;IAChC,OAAO,EAAE,OAAO;CACjB,CAAC,CAAA;AAEF,MAAM,OAAO,GAAG,eAAe,CAAC,WAAW,CAAC,IAAI,CAC9C,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CACpC,CAAC,CAAC,IAAI;AACL,2FAA2F;AAC3F,wDAAwD;AACxD,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAC9B,CAAA;AAED,gFAAgF;AAChF,8EAA8E;AAC9E,2EAA2E;AAC3E,8EAA8E;AAC9E,8EAA8E;AAC9E,sEAAsE;AACtE,MAAM,iBAAiB,GAAqB,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AAEjH,mGAAmG;AACnG,oEAAoE;AACpE,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAA"}
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../../src/bin.ts"],"names":[],"mappings":";AACA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACpC,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAA;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAE5D,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAA;IAChC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAA;IAC9B,OAAO,IAAI,CAAA;AACb,CAAC,CAAC,CAAA;AAEF,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;AAE3D,gGAAgG;AAChG,MAAM,cAAe,SAAQ,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAK;IAC/C,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,KAAK,CAAA;CAClD;AAED,MAAM,OAAO,GAAG,eAAe,CAAC,WAAW,CAAC,IAAI,CAC9C,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACtB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC9C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC7B,OAAO,KAAK,CAAC,CAAC,IAAI,cAAc,EAAE,CAAA;IACpC,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC,CAAC,CACH,CACF,CAAC,CAAC,IAAI;AACL,2FAA2F;AAC3F,wDAAwD;AACxD,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAC9B,CAAA;AAED,gFAAgF;AAChF,8EAA8E;AAC9E,2EAA2E;AAC3E,8EAA8E;AAC9E,8EAA8E;AAC9E,sEAAsE;AACtE,MAAM,iBAAiB,GAAqB,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AAEjH,mGAAmG;AACnG,oEAAoE;AACpE,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAA"}

package/dist/src/cli/CommandFailed.d.ts

@@ -0,0 +1,27 @@
+/**
+ * A command that could not do its job, with the one line that says why and what to run.
+ *
+ * Fail with it instead of printing and returning: the command boundary (`reportUnhandled`) prints
+ * the message once on stderr, and the process exits non-zero so a script can tell.
+ *
+ * @module
+ */
+import { Effect, Stdio } from "effect";
+import { JiraAccess } from "../services/JiraAccess.js";
+declare const CommandFailed_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "CommandFailed";
+} & Readonly<A>;
+export declare class CommandFailed extends CommandFailed_base<{
+    readonly message: string;
+}> {
+}
+/** Fails unless Jira is connected, naming the command that connects it. */
+export declare const requireJira: Effect.Effect<import("../services/JiraAccess.js").JiraConnection, CommandFailed, JiraAccess>;
+/** Fails before a prompt when nobody can answer it, saying what to run instead. */
+export declare const requireTerminal: (instead: string) => Effect.Effect<void, CommandFailed, Stdio.Stdio>;
+/** Any failure with a message, as the one line the command prints. */
+export declare const toCommandFailed: (error: {
+    readonly message: string;
+}) => CommandFailed;
+export {};
+//# sourceMappingURL=CommandFailed.d.ts.map

package/dist/src/cli/CommandFailed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CommandFailed.d.ts","sourceRoot":"","sources":["../../../src/cli/CommandFailed.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAQ,MAAM,EAAU,KAAK,EAAE,MAAM,QAAQ,CAAA;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;;;;AAGtD,qBAAa,aAAc,SAAQ,mBAAkC;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;CAAG;AAErG,2EAA2E;AAC3E,eAAO,MAAM,WAAW,8FAMvB,CAAA;AAED,mFAAmF;AACnF,eAAO,MAAM,eAAe,YAAa,MAAM,oDAO5C,CAAA;AAEH,sEAAsE;AACtE,eAAO,MAAM,eAAe,UAAW;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,aACvB,CAAA"}

package/dist/src/cli/CommandFailed.js

@@ -0,0 +1,25 @@
+/**
+ * A command that could not do its job, with the one line that says why and what to run.
+ *
+ * Fail with it instead of printing and returning: the command boundary (`reportUnhandled`) prints
+ * the message once on stderr, and the process exits non-zero so a script can tell.
+ *
+ * @module
+ */
+import { Data, Effect, Option, Stdio } from "effect";
+import { JiraAccess } from "../services/JiraAccess.js";
+import { NOT_LOGGED_IN_HINT } from "../utils/hints.js";
+export class CommandFailed extends Data.TaggedError("CommandFailed") {
+}
+/** Fails unless Jira is connected, naming the command that connects it. */
+export const requireJira = JiraAccess.use((access) => access.connection).pipe(Effect.mapError((error) => new CommandFailed({ message: error.message })), Effect.flatMap(Option.match({
+    onNone: () => Effect.fail(new CommandFailed({ message: NOT_LOGGED_IN_HINT })),
+    onSome: Effect.succeed
+})));
+/** Fails before a prompt when nobody can answer it, saying what to run instead. */
+export const requireTerminal = (instead) => Stdio.Stdio.use((stdio) => stdio.stdinIsTerminal).pipe(Effect.flatMap((terminal) => terminal
+    ? Effect.void
+    : Effect.fail(new CommandFailed({ message: `This step needs an interactive terminal. ${instead}` }))));
+/** Any failure with a message, as the one line the command prints. */
+export const toCommandFailed = (error) => new CommandFailed({ message: error.message });
+//# sourceMappingURL=CommandFailed.js.map

package/dist/src/cli/CommandFailed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CommandFailed.js","sourceRoot":"","sources":["../../../src/cli/CommandFailed.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAEtD,MAAM,OAAO,aAAc,SAAQ,IAAI,CAAC,WAAW,CAAC,eAAe,CAA+B;CAAG;AAErG,2EAA2E;AAC3E,MAAM,CAAC,MAAM,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAC3E,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,EACzE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;IAC1B,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC7E,MAAM,EAAE,MAAM,CAAC,OAAO;CACvB,CAAC,CAAC,CACJ,CAAA;AAED,mFAAmF;AACnF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAe,EAAE,EAAE,CACjD,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,CACpD,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1B,QAAQ;IACN,CAAC,CAAC,MAAM,CAAC,IAAI;IACb,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,4CAA4C,OAAO,EAAE,EAAE,CAAC,CAAC,CACvG,CACF,CAAA;AAEH,sEAAsE;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAmC,EAAiB,EAAE,CACpF,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA"}

package/dist/src/cli/auth.d.ts

@@ -1,8 +1,10 @@
 import { JiraAuth } from "@knpkv/jira-cli/JiraAuth";
-import { Effect } from "effect";
+import { Effect, Option } from "effect";
 import { Command, Prompt } from "effect/cli";
 import * as HttpClient from "effect/http/HttpClient";
 import { ClockifyAuth } from "../services/ClockifyAuth.js";
+import { JiraAccess } from "../services/JiraAccess.js";
+import { CommandFailed } from "./CommandFailed.js";
 declare const InvalidClockifyApiKeyError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "InvalidClockifyApiKeyError";
 } & Readonly<A>;
@@ -38,8 +40,26 @@ export declare const loadClockifyAccount: (client: import("@knpkv/clockify-api-c
         readonly name: string;
     }[];
 }, ClockifyRequestError | InvalidClockifyApiKeyError, never>;
-export declare const clockifySetup: Command.Command<"setup", {}, {}, ClockifyRequestError | InvalidClockifyApiKeyError | import("effect/Terminal").QuitError, ClockifyAuth | HttpClient.HttpClient | Prompt.Environment>;
+/**
+ * Asks for a site, email and API token, checks them against Jira and saves them. The token is read
+ * without echo and never printed; a failed check names its cause and saves nothing.
+ */
+export declare const connectJiraWithToken: (given: {
+    readonly site: Option.Option<string>;
+    readonly email: Option.Option<string>;
+}) => Effect.Effect<import("../services/JiraAccess.js").StoredToken, CommandFailed, JiraAccess | import("effect/Stdio").Stdio | Prompt.Environment>;
+/**
+ * Asks for a Clockify API key (unless given), checks it, picks a workspace and saves it. A key that
+ * Clockify refuses, a failed request and an account with no workspace each fail with their own line.
+ */
+export declare const connectClockify: (given: Option.Option<string>, workspaceName?: Option.Option<string>) => Effect.Effect<undefined, CommandFailed, ClockifyAuth | HttpClient.HttpClient | import("effect/Stdio").Stdio | Prompt.Environment>;
+export declare const clockifySetup: Command.Command<"setup", {
+    readonly apiKey: Option.Option<string>;
+    readonly workspace: Option.Option<string>;
+}, {}, CommandFailed, ClockifyAuth | HttpClient.HttpClient | import("effect/Stdio").Stdio | Prompt.Environment>;
+/** Both systems' status lines, Jira first. */
+export declare const printAuthStatus: Effect.Effect<void, never, ClockifyAuth | HttpClient.HttpClient | JiraAccess>;
 /** Top-level `auth` command with jira/clockify/status subcommands. */
-export declare const auth: Command.Command<"auth", {} | {}, {}, ClockifyRequestError | InvalidClockifyApiKeyError | import("effect/Terminal").QuitError | (import("@knpkv/atlassian-common").FileSystemError | import("@knpkv/atlassian-common").HomeDirectoryError | import("effect/PlatformError").PlatformError), import("effect/process/ChildProcessSpawner").ChildProcessSpawner | ClockifyAuth | HttpClient.HttpClient | JiraAuth | Prompt.Environment>;
+export declare const auth: Command.Command<"auth", {} | {}, {}, CommandFailed, import("effect/process/ChildProcessSpawner").ChildProcessSpawner | ClockifyAuth | HttpClient.HttpClient | JiraAccess | JiraAuth | import("effect/Stdio").Stdio | Prompt.Environment>;
 export {};
 //# sourceMappingURL=auth.d.ts.map

package/dist/src/cli/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/cli/auth.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAA;AACnD,OAAO,EAAiB,MAAM,EAAuC,MAAM,QAAQ,CAAA;AACnF,OAAO,EAAE,OAAO,EAAmB,MAAM,EAAE,MAAM,YAAY,CAAA;AAC7D,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAA;AAGpD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;;;;AAE1D,qBAAa,0BAA2B,SAAQ,gCAA+C,EAAE,CAAC;IAChG,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED;;;;GAIG;AACH,qBAAa,oBAAqB,SAAQ,0BAAyC;IACjF,QAAQ,CAAC,SAAS,EAAE,eAAe,GAAG,qBAAqB,CAAA;IAC3D,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CACxB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAG7B;CACF;AAsBD;;;GAGG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;4DAoB/B,CAAA;AAmHD,eAAO,MAAM,aAAa,sLA8DzB,CAAA;AAgED,sEAAsE;AACtE,eAAO,MAAM,IAAI,oaAEhB,CAAA"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/cli/auth.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAA;AACnD,OAAO,EAAiB,MAAM,EAAE,MAAM,EAA+B,MAAM,QAAQ,CAAA;AACnF,OAAO,EAAE,OAAO,EAAmB,MAAM,EAAE,MAAM,YAAY,CAAA;AAC7D,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAA;AAGpD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAEtD,OAAO,EAAE,aAAa,EAAoC,MAAM,oBAAoB,CAAA;;;;AAEpF,qBAAa,0BAA2B,SAAQ,gCAA+C,EAAE,CAAC;IAChG,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED;;;;GAIG;AACH,qBAAa,oBAAqB,SAAQ,0BAAyC;IACjF,QAAQ,CAAC,SAAS,EAAE,eAAe,GAAG,qBAAqB,CAAA;IAC3D,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CACxB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAG7B;CACF;AAsBD;;;GAGG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;4DAoB/B,CAAA;AAQD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,UAAW;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;CACtC,kJAoBE,CAAA;AA2IH;;;GAGG;AACH,eAAO,MAAM,eAAe,UACnB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,kBACb,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,sIAmDnC,CAAA;AAEH,eAAO,MAAM,aAAa;;;+GAayC,CAAA;AAiCnE,8CAA8C;AAC9C,eAAO,MAAM,eAAe,+EAG1B,CAAA;AAMF,sEAAsE;AACtE,eAAO,MAAM,IAAI,0OAGhB,CAAA"}

package/dist/src/cli/auth.js

@@ -10,6 +10,9 @@ import { Command, Flag as Options, Prompt } from "effect/cli";
 import * as HttpClient from "effect/http/HttpClient";
 import * as ChildProcess from "effect/process/ChildProcess";
 import { ClockifyAuth } from "../services/ClockifyAuth.js";
+import { JiraAccess } from "../services/JiraAccess.js";
+import { CONNECT_JIRA_COMMAND } from "../utils/hints.js";
+import { CommandFailed, requireTerminal, toCommandFailed } from "./CommandFailed.js";
 export class InvalidClockifyApiKeyError extends Data.TaggedError("InvalidClockifyApiKeyError") {
     get message() {
         return "Invalid API key — check the value and try again";
@@ -53,11 +56,38 @@ export const loadClockifyAccount = Effect.fn("ClockifyAuth.loadClockifyAccount")
     return { user, workspaces };
 });
 // ---------------------------------------------------------------------------
-// Jira OAuth
+// Jira
 // ---------------------------------------------------------------------------
+const apiTokenPage = "https://id.atlassian.com/manage-profile/security/api-tokens";
+/**
+ * Asks for a site, email and API token, checks them against Jira and saves them. The token is read
+ * without echo and never printed; a failed check names its cause and saves nothing.
+ */
+export const connectJiraWithToken = (given) => Effect.gen(function* () {
+    const access = yield* JiraAccess;
+    yield* requireTerminal(`Run ${CONNECT_JIRA_COMMAND} in a terminal to enter the API token.`);
+    yield* Console.log(`Create an API token at ${apiTokenPage}, then paste it here.`);
+    const site = Option.isSome(given.site)
+        ? given.site.value
+        : yield* Prompt.String({ message: "Jira address (your-team.atlassian.net):" });
+    const email = Option.isSome(given.email)
+        ? given.email.value
+        : yield* Prompt.String({ message: "Email you sign in to Atlassian with:" });
+    const apiToken = yield* Prompt.Password({ message: "API token:" });
+    yield* Console.log("Checking with Jira...");
+    const verified = yield* access.verifyToken({ site, email, apiToken });
+    yield* access.saveToken(verified);
+    yield* Console.log(`Jira connected: ${verified.displayName} on ${verified.siteUrl}.`);
+    return verified;
+}).pipe(Effect.catchTag("QuitError", () => Effect.fail(new CommandFailed({ message: "Jira was not connected." }))), Effect.mapError(toCommandFailed));
+const jiraToken = Command.make("token", {
+    site: Options.String("site").pipe(Options.withDescription("Your Jira address, such as your-team.atlassian.net"), Options.optional),
+    email: Options.String("email").pipe(Options.withDescription("The email you sign in to Atlassian with"), Options.optional)
+}, (given) => Effect.asVoid(connectJiraWithToken(given))).pipe(Command.withDescription("Connect Jira with an API token (recommended)"));
 const jiraCreate = Command.make("create", {}, () => Effect.gen(function* () {
     yield* Console.log(`
-Create OAuth app in Atlassian Developer Console:
+Advanced: connect Jira through your own Atlassian OAuth app.
+For most people ${CONNECT_JIRA_COMMAND} is simpler.
 
 1. Browser will open to create a new OAuth 2.0 (3LO) app
 2. Enter app name (e.g., "jcf")
@@ -74,12 +104,15 @@ Create OAuth app in Atlassian Developer Console:
     const url = "https://developer.atlassian.com/console/myapps/create-3lo-app/";
     const exitCode = (command) => Effect.scoped(command.pipe(Effect.flatMap((handle) => handle.exitCode)));
     yield* exitCode(ChildProcess.make("open", [url])).pipe(Effect.catch(() => exitCode(ChildProcess.make("xdg-open", [url]))), Effect.catch(() => exitCode(ChildProcess.make("rundll32.exe", ["url.dll,FileProtocolHandler", url]))), Effect.asVoid, Effect.catch(() => Effect.void));
-}));
+})).pipe(Command.withDescription("Advanced: open the Atlassian console to create your own OAuth app"));
 const jiraConfigure = Command.make("configure", {
     clientId: Options.String("client-id").pipe(Options.withDescription("OAuth client ID"), Options.optional),
     clientSecret: Options.String("client-secret").pipe(Options.withDescription("OAuth client secret"), Options.optional)
 }, ({ clientId, clientSecret }) => Effect.gen(function* () {
     const auth = yield* JiraAuth;
+    if (Option.isNone(clientId) || Option.isNone(clientSecret)) {
+        yield* requireTerminal("Pass --client-id and --client-secret.");
+    }
     const id = Option.isSome(clientId)
         ? clientId.value
         : yield* Prompt.String({ message: "Enter OAuth client ID:" });
@@ -88,126 +121,114 @@ const jiraConfigure = Command.make("configure", {
         : yield* Prompt.String({ message: "Enter OAuth client secret:" });
     yield* auth.configure({ clientId: id, clientSecret: secret });
     yield* Console.log("OAuth configured. Run: jcf auth jira login");
-}));
+}).pipe(Effect.mapError(toCommandFailed))).pipe(Command.withDescription("Advanced: store your OAuth app's client ID and secret"));
 const jiraLogin = Command.make("login", { site: Options.String("site").pipe(Options.withDescription("Jira site URL"), Options.optional) }, ({ site }) => Effect.gen(function* () {
     const auth = yield* JiraAuth;
+    if (!(yield* auth.isConfigured())) {
+        return yield* new CommandFailed({
+            message: `No OAuth app is configured. Run ${CONNECT_JIRA_COMMAND} to use an API token instead, ` +
+                "or jcf auth jira configure to set up your own OAuth app."
+        });
+    }
     const result = yield* auth.login(Option.isSome(site) ? { siteUrl: site.value } : undefined);
     if (Array.isArray(result) && result.length > 0) {
         yield* Console.log("\nRe-run with --site <url> to select a specific site.");
     }
-}).pipe(Effect.catch((e) => Console.log(`Error: ${Predicate.hasProperty(e, "message") ? String(e.message) : String(e)}`))));
+}).pipe(Effect.mapError(toCommandFailed))).pipe(Command.withDescription("Advanced: sign in through your OAuth app in the browser"));
 const jiraLogout = Command.make("logout", {}, () => Effect.gen(function* () {
+    const access = yield* JiraAccess;
     const auth = yield* JiraAuth;
-    yield* auth.logout();
-    yield* Console.log("Logged out from Jira");
-}).pipe(Effect.catch((e) => Console.log(`Error: ${Predicate.hasProperty(e, "message") ? String(e.message) : String(e)}`))));
-const jiraStatus = Command.make("status", {}, () => Effect.gen(function* () {
-    const auth = yield* JiraAuth;
-    const user = yield* auth.getCurrentUser();
-    if (user) {
-        yield* Console.log(`Jira: ✓ logged in as ${user.name} (${user.email})`);
-    }
-    else {
-        yield* Console.log("Jira: ✗ not logged in");
-        yield* Console.log("  Run: jcf auth jira create → configure → login");
-    }
-}).pipe(Effect.catch(() => Console.log("Jira: ✗ not configured"))));
-const authJira = Command.make("jira", {}, () => Console.log("Jira auth: create, configure, login, logout, status"))
-    .pipe(Command.withSubcommands([jiraCreate, jiraConfigure, jiraLogin, jiraLogout, jiraStatus]));
+    const removedToken = yield* access.removeToken;
+    const oauth = yield* auth.isLoggedIn();
+    if (oauth)
+        yield* auth.logout();
+    yield* Console.log(removedToken || oauth ? "Jira disconnected." : "Jira was not connected.");
+}).pipe(Effect.mapError(toCommandFailed))).pipe(Command.withDescription("Disconnect Jira: remove the API token and sign out of OAuth"));
+/** One line saying how Jira is connected, or what to run when it is not. */
+const jiraStatusLine = JiraAccess.use((access) => access.connection).pipe(Effect.map(Option.match({
+    onNone: () => `Jira:     not connected. Run ${CONNECT_JIRA_COMMAND}`,
+    onSome: (connection) => `Jira:     connected as ${connection.displayName === "" ? "unknown user" : connection.displayName} on ` +
+        `${connection.siteUrl} (${connection.method === "api-token" ? "API token" : "OAuth app"})`
+})), Effect.catch((error) => Effect.succeed(`Jira:     ${error.message}`)));
+const jiraStatus = Command.make("status", {}, () => Effect.flatMap(jiraStatusLine, Console.log)).pipe(Command.withDescription("Show whether Jira is connected, and how"));
+const authJira = Command.make("jira", {}, () => Console.log(`Connect Jira: ${CONNECT_JIRA_COMMAND}. Run jcf auth jira --help for every option.`)).pipe(Command.withDescription("Connect Jira with an API token, or with your own OAuth app (advanced)"), Command.withSubcommands([jiraToken, jiraStatus, jiraLogout, jiraCreate, jiraConfigure, jiraLogin]));
 // ---------------------------------------------------------------------------
 // Clockify API key
 // ---------------------------------------------------------------------------
-export const clockifySetup = Command.make("setup", {}, () => Effect.gen(function* () {
+const clockifyBaseUrl = "https://api.clockify.me/api";
+/**
+ * Asks for a Clockify API key (unless given), checks it, picks a workspace and saves it. A key that
+ * Clockify refuses, a failed request and an account with no workspace each fail with their own line.
+ */
+export const connectClockify = (given, workspaceName = Option.none()) => Effect.gen(function* () {
     const auth = yield* ClockifyAuth;
-    yield* Console.log("Clockify API Key Setup");
-    yield* Console.log("Get your API key from: https://app.clockify.me/manage-api-keys");
-    yield* Console.log("");
-    const apiKey = yield* Prompt.String({ message: "Enter API key:" });
-    if (!apiKey) {
-        yield* Console.log("No API key provided, aborting.");
-        return;
+    if (Option.isNone(given)) {
+        yield* requireTerminal("Pass the key with --api-key, or run jcf auth clockify setup in a terminal.");
+        yield* Console.log("Get your API key from https://app.clockify.me/manage-api-keys");
     }
-    yield* Console.log("Validating...");
+    const apiKey = Option.isSome(given)
+        ? given.value
+        : Redacted.value(yield* Prompt.Password({ message: "Clockify API key:" }));
+    if (apiKey.trim() === "") {
+        return yield* new CommandFailed({ message: "No API key given; Clockify was not connected." });
+    }
+    yield* Console.log("Checking with Clockify...");
     const httpClient = yield* HttpClient.HttpClient;
-    const client = makeClockifyApi(httpClient, {
-        apiKey: Redacted.make(apiKey),
-        baseUrl: "https://api.clockify.me/api"
-    });
+    const client = makeClockifyApi(httpClient, { apiKey: Redacted.make(apiKey), baseUrl: clockifyBaseUrl });
     const { user, workspaces } = yield* loadClockifyAccount(client);
-    yield* Console.log(`Authenticated as: ${user.name} (${user.email})`);
-    if (workspaces.length === 0) {
-        yield* Console.log("No workspaces found.");
-        return;
-    }
-    yield* Console.log("");
-    yield* Console.log("Workspaces:");
-    for (let i = 0; i < workspaces.length; i++) {
-        const workspace = workspaces[i];
-        if (workspace !== undefined) {
-            yield* Console.log(`  ${i + 1}. ${workspace.name}`);
-        }
+    const [first] = workspaces;
+    if (first === undefined) {
+        return yield* new CommandFailed({
+            message: "This Clockify account has no workspace. Create one at https://app.clockify.me, then run this again."
+        });
     }
-    let selectedIdx = 0;
-    if (workspaces.length > 1) {
-        const choice = yield* Prompt.String({ message: `Select workspace (1-${workspaces.length}):` });
-        selectedIdx = Math.max(0, Math.min(workspaces.length - 1, parseInt(choice, 10) - 1));
+    const names = workspaces.map((candidate) => candidate.name).join(", ");
+    const workspace = Option.isSome(workspaceName)
+        ? workspaces.find((candidate) => candidate.name === workspaceName.value || candidate.id === workspaceName.value)
+        : workspaces.length === 1
+            ? first
+            : yield* requireTerminal(`This key can use ${workspaces.length} workspaces; pass --workspace with one of: ${names}.`)
+                .pipe(Effect.andThen(Prompt.Select({
+                message: "Workspace:",
+                choices: workspaces.map((candidate) => ({ title: candidate.name, value: candidate }))
+            })));
+    if (workspace === undefined) {
+        return yield* new CommandFailed({
+            message: `No workspace named "${Option.getOrElse(workspaceName, () => "")}" for this key. Its workspaces: ${names}.`
+        });
     }
-    const workspace = workspaces[selectedIdx];
-    yield* Console.log(`Selected: ${workspace.name}`);
-    yield* auth.save({
-        apiKey,
-        workspaceId: workspace.id,
-        userId: user.id,
-        baseUrl: "https://api.clockify.me/api"
-    });
-    yield* Console.log("");
-    yield* Console.log("Clockify configured! Saved to ~/.jcf/clockify.json");
-}));
-const clockifyStatus = Command.make("status", {}, () => Effect.gen(function* () {
+    yield* auth.save({ apiKey, workspaceId: workspace.id, userId: user.id, baseUrl: clockifyBaseUrl });
+    yield* Console.log(`Clockify connected: ${user.name ?? user.email ?? user.id}, workspace ${workspace.name}.`);
+}).pipe(Effect.catchTag("QuitError", () => Effect.fail(new CommandFailed({ message: "Clockify was not connected." }))), Effect.mapError(toCommandFailed));
+export const clockifySetup = Command.make("setup", {
+    apiKey: Options.String("api-key").pipe(Options.withDescription("Clockify API key, for scripts; without it the key is asked for and not echoed"), Options.optional),
+    workspace: Options.String("workspace").pipe(Options.withDescription("Workspace name or id, when the key can use more than one"), Options.optional)
+}, ({ apiKey, workspace }) => connectClockify(apiKey, workspace)).pipe(Command.withDescription("Connect Clockify with an API key"));
+/** One line saying which Clockify workspace is connected, or what to run when none is. */
+const clockifyStatusLine = Effect.gen(function* () {
     const auth = yield* ClockifyAuth;
-    const configured = yield* auth.isConfigured;
-    if (!configured) {
-        yield* Console.log("Clockify: ✗ not configured");
-        yield* Console.log("  Run: jcf auth clockify setup");
-        return;
+    if (!(yield* auth.isConfigured))
+        return "Clockify: not connected. Run jcf auth clockify setup";
+    const config = yield* auth.getConfig;
+    const httpClient = yield* HttpClient.HttpClient;
+    const account = yield* Effect.result(loadClockifyAccount(makeClockifyApi(httpClient, config)));
+    if (account._tag === "Failure") {
+        return `Clockify: connected, workspace ${config.workspaceId} (could not read its name: ${account.failure.message})`;
     }
-    const config = yield* auth.getConfig.pipe(Effect.catch((e) => Console.log(`Clockify: error — ${e.message}`).pipe(Effect.flatMap(() => Effect.fail(e)))));
-    yield* Console.log("Clockify: ✓ authenticated");
-    yield* Console.log(`  Workspace: ${config.workspaceId}`);
-    yield* Console.log(`  User: ${config.userId}`);
-}).pipe(Effect.catch(() => Effect.void)));
-const authClockify = Command.make("clockify", {}, () => Console.log("Clockify auth: setup, status")).pipe(Command.withSubcommands([clockifySetup, clockifyStatus]));
+    const name = account.success.workspaces.find((workspace) => workspace.id === config.workspaceId)?.name;
+    return `Clockify: connected, workspace ${name ?? `${config.workspaceId}, which this key can no longer see`}`;
+}).pipe(Effect.catch((error) => Effect.succeed(`Clockify: ${error.message}. Run jcf auth clockify setup`)));
+const clockifyStatus = Command.make("status", {}, () => Effect.flatMap(clockifyStatusLine, Console.log)).pipe(Command.withDescription("Show whether Clockify is connected, and to which workspace"));
+const authClockify = Command.make("clockify", {}, () => Console.log("Connect Clockify: jcf auth clockify setup. Run jcf auth clockify --help for every option.")).pipe(Command.withDescription("Connect Clockify with an API key"), Command.withSubcommands([clockifySetup, clockifyStatus]));
 // ---------------------------------------------------------------------------
 // Combined status
 // ---------------------------------------------------------------------------
-const authStatus = Command.make("status", {}, () => Effect.gen(function* () {
-    yield* Console.log("=== Auth Status ===");
-    yield* Console.log("");
-    // Jira
-    const jira = yield* JiraAuth;
-    const jiraUser = yield* jira.getCurrentUser().pipe(Effect.catch(() => Effect.succeed(null)));
-    if (jiraUser) {
-        yield* Console.log(`Jira:     ✓ ${jiraUser.name} (${jiraUser.email})`);
-    }
-    else {
-        yield* Console.log("Jira:     ✗ not logged in");
-    }
-    // Clockify
-    const clockifyAuth = yield* ClockifyAuth;
-    const clockifyOk = yield* clockifyAuth.isConfigured;
-    if (clockifyOk) {
-        const cfg = yield* clockifyAuth.getConfig.pipe(Effect.catch(() => Effect.succeed(null)));
-        if (cfg) {
-            yield* Console.log(`Clockify: ✓ workspace ${cfg.workspaceId}`);
-        }
-        else {
-            yield* Console.log("Clockify: ✗ config corrupt");
-        }
-    }
-    else {
-        yield* Console.log("Clockify: ✗ not configured");
-    }
-}));
+/** Both systems' status lines, Jira first. */
+export const printAuthStatus = Effect.gen(function* () {
+    yield* Console.log(yield* jiraStatusLine);
+    yield* Console.log(yield* clockifyStatusLine);
+});
+const authStatus = Command.make("status", {}, () => printAuthStatus).pipe(Command.withDescription("Show whether Jira and Clockify are connected"));
 /** Top-level `auth` command with jira/clockify/status subcommands. */
-export const auth = Command.make("auth", {}, () => Console.log("Auth: jira, clockify, status")).pipe(Command.withSubcommands([authJira, authClockify, authStatus]));
+export const auth = Command.make("auth", {}, () => printAuthStatus).pipe(Command.withDescription("Connect Jira and Clockify, and see which are connected"), Command.withSubcommands([authJira, authClockify, authStatus]));
 //# sourceMappingURL=auth.js.map