@softspark/jira-mcp 1.14.4 → 1.15.0

package/CHANGELOG.md

@@ -7,6 +7,57 @@ Versioning follows [Semantic Versioning](https://semver.org/).
 
 ---
 
+## v1.15.0 -- Tempo worklogs and reports (2026-09-17)
+
+`@softspark/confluence-mcp` has no behaviour change in this release; it is bumped
+together with `@softspark/jira-mcp` per ADR-0002 and picks up the shared HTTP
+client's Bearer support without using it.
+
+### Added
+
+- **Tempo worklogs and reports.** Two new tools read Tempo Timesheets through
+  the Tempo Cloud REST API v4: `search_tempo_worklogs` lists worklogs in a date
+  range with issue keys and user names resolved, and `get_tempo_report` sums
+  hours by project, user and/or task in the order asked. Filters combine, so
+  "this person's hours on this project last month" is one call. Tempo v4
+  answers in numeric ids only, so every result is joined against Jira
+  (`issue/bulkfetch` for keys and summaries, `user/bulk` for names); an issue
+  the token cannot browse keeps its hours under `#<id>` rather than vanishing
+  from a total. A query past 50 000 worklogs fails instead of truncating.
+- **`jira-mcp config set-tempo-token`** stores the Tempo token next to the Jira
+  credential, on the default entry or per instance with `--url`. The token is
+  read from `--token` or `TEMPO_API_TOKEN`. An instance override never inherits
+  the default's Tempo token, because a Tempo token is bound to one site.
+  `tempo_api_url` in config.json selects a region host (`api.eu.tempo.io`,
+  `api.us.tempo.io`); the global host is the default.
+- **Bearer auth in the shared HTTP client.** `AtlassianHttpClient` takes a
+  `bearer_token` config alongside the Basic pair, so Tempo rides the same retry
+  and backoff loop as Jira and Confluence instead of a second `fetch` loop.
+- Four error classes: `TempoConnectionError`, `TempoAuthenticationError`,
+  `TempoPermissionError` and `TempoNotConfiguredError`. The last one is raised
+  before any network call when a site has no token.
+
+### Fixed
+
+- `config set-credentials` no longer drops a stored Tempo token when the Jira
+  token in the same slot is rotated.
+
+## v1.14.5 -- Build and packaging documented (2026-09-10)
+
+No code change in either package. The one thing a consumer gets that 1.14.4 did
+not give them is this changelog entry, since 1.14.4 is what made `CHANGELOG.md`
+reach the tarball in the first place.
+
+### Added
+
+- **`kb/reference/build-and-packaging.md`**, covering the two npm behaviours that
+  fail without an error message here and cost a release each. `ignore-scripts` in
+  `.npmrc` disables every lifecycle script, not only install hooks, so a
+  `prebuild`, `pretest` or `prepack` in package.json looks right and never runs;
+  both were confirmed by adding a hook and watching nothing happen. And a `files`
+  pattern is matched inside the package directory, with anything matching nothing
+  dropped silently, which is what hid the missing changelog through six releases.
+
 ## v1.14.4 -- The changelog actually ships (2026-09-09)
 
 ### Fixed

package/README.md

@@ -4,17 +4,17 @@
 
 [![CI](https://github.com/softspark/jira-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/softspark/jira-mcp/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/@softspark/jira-mcp)](https://www.npmjs.com/package/@softspark/jira-mcp)
-[![version](https://img.shields.io/badge/version-1.14.4-blue)](CHANGELOG.md)
+[![version](https://img.shields.io/badge/version-1.15.0-blue)](CHANGELOG.md)
 [![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE)
 
 ---
 
-## What's New in v1.14.4
+## What's New in v1.15.0
 
-- This package finally contains the `CHANGELOG.md` it has been listing in `files` since 1.12.0. The pattern resolved inside the package directory while the changelog sat at the repository root, so npm dropped it without a word.
-- Polish versions of all eight built-in comment templates ship with the package. Until now a templated comment was English on every project, including one configured for another language.
-- `jira-mcp template list-locales` shows which languages are available, and `jira-mcp template install-locale pl` installs them. Add `--keep-english` to keep the originals reachable as `<id>-en`.
-- Fixed in 1.14.1: `jira-mcp --help` now lists both new commands. 1.14.2 adds the test that would have caught it, on both binaries.
+- **Tempo worklogs and reports.** `search_tempo_worklogs` lists Tempo Timesheets entries in a date range with issue keys and user names resolved; `get_tempo_report` sums hours by project, user and/or task. Filters combine, so "this person's hours on this project last month" is one call.
+- Tempo REST API v4 answers in numeric ids only, so every result is joined against Jira. An issue the token cannot browse keeps its hours under `#<id>` instead of vanishing from a total.
+- `jira-mcp config set-tempo-token` stores the Tempo token next to the Jira credential, per site with `--url`. Nothing else needs it: without a token the two Tempo tools answer `TEMPO_NOT_CONFIGURED` and every other tool works as before.
+- Fixed: `config set-credentials` no longer drops a stored Tempo token when the Jira token is rotated.
 - Released together with `@softspark/confluence-mcp` under one version. See the [changelog](CHANGELOG.md).
 
 ## Table of Contents
@@ -63,6 +63,16 @@ jira-mcp config add-project
 
 All configuration lives in `~/.softspark/jira-mcp/` (created by `jira-mcp config init`). This is the standard config directory for all SoftSpark open-source tools.
 
+### 3. Tempo (optional)
+
+If the site runs Tempo Timesheets, create a Tempo API token (Tempo > Settings > API Integration) and store it next to the Jira credential:
+
+```bash
+jira-mcp config set-tempo-token --token TEMPO_TOKEN
+```
+
+That unlocks `search_tempo_worklogs` and `get_tempo_report`. Without it every other tool works as before. Sites pinned to a Tempo region set `tempo_api_url` in `config.json` (`https://api.eu.tempo.io/4` or `https://api.us.tempo.io/4`).
+
 ## CLI Commands
 
 | Command | Description |
@@ -83,6 +93,7 @@ All configuration lives in `~/.softspark/jira-mcp/` (created by `jira-mcp config
 | `jira-mcp config remove-project <key>` | Remove a project from config |
 | `jira-mcp config list-projects` | List all configured projects with language |
 | `jira-mcp config set-credentials` | Set API credentials |
+| `jira-mcp config set-tempo-token` | Set the Tempo API token (default site or `--url <jira-url>`) |
 | `jira-mcp config set-default <key>` | Set default project |
 | `jira-mcp config set-language <lang>` | Set global default language |
 | `jira-mcp config set-project-language <key> <lang>` | Set language for a specific project |
@@ -113,6 +124,8 @@ All configuration lives in `~/.softspark/jira-mcp/` (created by `jira-mcp config
 | `add_templated_comment` | Add comment using a template or raw markdown | `task_key`, `template_id?`, `variables?`, `markdown?`, `user_approved` |
 | `create_task` | Create a new Jira issue with explicit fields or a task template | `project_key`, `summary?`, `template_id?`, `variables?`, `description?`, `assignee_email?`, `labels?`, `epic_key?`, `parent_key?`, `original_estimate?` |
 | `search_tasks` | Search Jira issues with JQL (no caching) | `jql`, `max_results?`, `project_key?` |
+| `search_tempo_worklogs` | List Tempo worklogs in a date range, issue keys and user names resolved | `from`, `to`, `project_key?`, `task_key?`, `user_email?`, `limit?` |
+| `get_tempo_report` | Sum Tempo hours by project, user and/or task | `from`, `to`, `group_by?`, `project_key?`, `task_key?`, `user_email?` |
 
 ## Comment Templates
 
@@ -202,7 +215,7 @@ Or copy `rules/jira-mcp.md` to your ai-toolkit rules directory manually. The rul
 - **Sync before read** -- cache may be stale
 - **Status transitions** -- check valid transitions before changing status
 - **Time format** -- `"2h 30m"`, never days
-- **All 19 MCP tools** and **23 CLI commands** reference
+- **All 21 MCP tools** and **24 CLI commands** reference
 
 ### AI Toolkit Hooks
 
@@ -245,11 +258,11 @@ src/
       create.ts   Bulk task creation command
       create-monthly.ts  Monthly admin task automation
   config/         Configuration loading and Zod validation
-  connector/      Jira API client (built-in fetch, instance pool)
+  connector/      Jira and Tempo API clients (built-in fetch, instance pool)
   errors/         Typed error hierarchy
-  operations/     Business logic (status, comments, time tracking)
+  operations/     Business logic (status, comments, time tracking, Tempo reports)
   templates/      File-backed comment/task template loading and registries
-  tools/          MCP tool handlers (19 tools, one file per tool)
+  tools/          MCP tool handlers (21 tools, one file per tool)
   types/          Shared TypeScript types
   server.ts       MCP server setup and tool registration
   cli.ts          CLI entry point
@@ -271,11 +284,13 @@ src/
 
 **Per-instance credentials** -- different API tokens per Jira instance URL. Single-credential format still works (backward compatible). See [Configuration](kb/reference/configuration.md).
 
-**Supply chain protection** -- `ignore-scripts=true`, no axios, no dynamic requires. Self-contained 548KB library bundle, 1 runtime dep (commander).
+**Tempo worklogs and reports** -- `search_tempo_worklogs` and `get_tempo_report` read Tempo Timesheets (Cloud REST API v4) for hours per project, user or task over a date range, with Tempo's numeric ids resolved to issue keys and names through Jira. Needs a Tempo API token (`jira-mcp config set-tempo-token`); nothing else depends on it. See [API Reference](kb/reference/api.md).
+
+**Supply chain protection** -- `ignore-scripts=true`, no axios, no dynamic requires. Self-contained 561KB library bundle, 1 runtime dep (commander).
 
-**Typed error hierarchy** -- 26 error classes with machine-readable codes. Every tool returns structured `{ success, error, code }` responses. No stack traces leak to MCP clients.
+**Typed error hierarchy** -- 30 error classes with machine-readable codes. Every tool returns structured `{ success, error, code }` responses. No stack traces leak to MCP clients.
 
-**Strict TypeScript** -- `strict: true`, no `any`, `readonly` interfaces, Zod validation at all boundaries, 991 tests across 80 test files.
+**Strict TypeScript** -- `strict: true`, no `any`, `readonly` interfaces, Zod validation at all boundaries, 1093 tests across 85 test files.
 
 ## Documentation
 
@@ -283,7 +298,7 @@ src/
 |----------|-------------|
 | [Architecture](kb/reference/architecture.md) | System design and module overview |
 | [Local audit](kb/reference/audit.md) | JSON/SARIF formats, filesystem checks and hook permissions |
-| [API Reference](kb/reference/api.md) | All 19 MCP tools with schemas |
+| [API Reference](kb/reference/api.md) | All 21 MCP tools with schemas |
 | [Configuration](kb/reference/configuration.md) | Config files, env vars, multi-instance |
 | [ADF Format](kb/reference/adf.md) | Atlassian Document Format conversion |
 | [Caching](kb/reference/caching.md) | Task, workflow, and user caching |