workday-daemon 0.17.2 → 0.19.0

package/dist/push/tempo-approvals.js

@@ -0,0 +1,104 @@
+import { readFileSync, writeFileSync, existsSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { getDataDir } from '../core/config.js';
+import { APPROVAL_CACHE_FILE, APPROVAL_CACHE_TTL_MS } from '../core/constants.js';
+import { TempoClient, TempoApiError } from './tempo-client.js';
+import { getAccountId, isJiraConfigured } from './jira-client.js';
+import { getMonthRange } from './month-report.js';
+function getCachePath() {
+    return join(getDataDir(), APPROVAL_CACHE_FILE);
+}
+function readCache() {
+    const path = getCachePath();
+    if (!existsSync(path))
+        return {};
+    try {
+        return JSON.parse(readFileSync(path, 'utf-8'));
+    }
+    catch {
+        return {};
+    }
+}
+function writeCache(cache) {
+    try {
+        writeFileSync(getCachePath(), JSON.stringify(cache, null, 2), 'utf-8');
+    }
+    catch { /* best effort — cache is an optimization */ }
+}
+/** Drop the whole cache — Tempo-side timeSpentSeconds just changed. */
+export function invalidateApprovalCache() {
+    try {
+        rmSync(getCachePath(), { force: true });
+    }
+    catch { /* best effort */ }
+}
+function monthKey(year, month) {
+    return `${year}-${String(month).padStart(2, '0')}`;
+}
+function fromEntry(entry, fromCache) {
+    return {
+        available: true,
+        period: entry.period,
+        statusKey: entry.statusKey,
+        requiredSeconds: entry.requiredSeconds,
+        timeSpentSeconds: entry.timeSpentSeconds,
+        canSubmit: entry.canSubmit,
+        fromCache,
+    };
+}
+/** Empty degraded response — also used by callers with no secrets at all. */
+export function approvalUnavailable(reason) {
+    return {
+        available: false,
+        reason,
+        period: null,
+        statusKey: null,
+        requiredSeconds: null,
+        timeSpentSeconds: null,
+        canSubmit: false,
+        fromCache: false,
+    };
+}
+/**
+ * Timesheet approval for the period containing the given month (period =
+ * calendar month on approvalPeriod=MONTH instances). Needs both a Jira
+ * account (accountId lookup) and a Tempo token with approvals:view. Cached
+ * briefly; the cache is dropped after every successful push.
+ */
+export async function resolveMonthApproval(year, month, secrets, forceRefresh = false) {
+    if (!secrets.Tempo_Token || secrets.Tempo_Token.trim().length === 0 || !isJiraConfigured(secrets)) {
+        return approvalUnavailable('no-token');
+    }
+    const key = monthKey(year, month);
+    const cache = readCache();
+    const cached = cache[key];
+    if (!forceRefresh && cached
+        && Date.now() - Date.parse(cached.fetchedAt) < APPROVAL_CACHE_TTL_MS) {
+        return fromEntry(cached, true);
+    }
+    const { from } = getMonthRange(year, month);
+    try {
+        const accountId = await getAccountId(secrets);
+        const client = new TempoClient(secrets.Tempo_Token);
+        const raw = await client.getUserTimesheetApproval(accountId, from);
+        const entry = {
+            fetchedAt: new Date().toISOString(),
+            period: raw.period ?? null,
+            statusKey: raw.status?.key ?? null,
+            requiredSeconds: raw.requiredSeconds ?? null,
+            timeSpentSeconds: raw.timeSpentSeconds ?? null,
+            canSubmit: raw.actions?.submit !== undefined,
+        };
+        cache[key] = entry;
+        writeCache(cache);
+        return fromEntry(entry, false);
+    }
+    catch (err) {
+        if (err instanceof TempoApiError && err.status === 403)
+            return approvalUnavailable('scope');
+        if (cached)
+            return fromEntry(cached, true); // stale beats nothing
+        return approvalUnavailable('error');
+    }
+}
+//# sourceMappingURL=tempo-approvals.js.map

package/dist/push/tempo-approvals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tempo-approvals.js","sourceRoot":"","sources":["../../src/push/tempo-approvals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAElF,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAclD,SAAS,YAAY;IACnB,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,mBAAmB,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAkB,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAoB;IACtC,IAAI,CAAC;QACH,aAAa,CAAC,YAAY,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC,CAAC,4CAA4C,CAAC,CAAC;AAC1D,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,uBAAuB;IACrC,IAAI,CAAC;QACH,MAAM,CAAC,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,KAAa;IAC3C,OAAO,GAAG,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,SAAS,CAAC,KAAyB,EAAE,SAAkB;IAC9D,OAAO;QACL,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS;KACV,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,MAAkC;IACpE,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,MAAM;QACN,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,IAAI;QACf,eAAe,EAAE,IAAI;QACrB,gBAAgB,EAAE,IAAI;QACtB,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,KAAK;KACjB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAY,EACZ,KAAa,EACb,OAAgB,EAChB,YAAY,GAAG,KAAK;IAEpB,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QAClG,OAAO,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,YAAY,IAAI,MAAM;WACtB,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,qBAAqB,EAAE,CAAC;QACvE,OAAO,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACnE,MAAM,KAAK,GAAuB;YAChC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;YAC1B,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI;YAClC,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,IAAI;YAC5C,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,IAAI,IAAI;YAC9C,SAAS,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS;SAC7C,CAAC;QACF,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnB,UAAU,CAAC,KAAK,CAAC,CAAC;QAClB,OAAO,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC5F,IAAI,MAAM;YAAE,OAAO,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,sBAAsB;QAClE,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;AACH,CAAC"}

package/dist/push/tempo-client.d.ts

@@ -14,6 +14,57 @@ export interface TempoWorkAttribute {
     readonly values?: readonly string[];
     readonly names?: Readonly<Record<string, string>>;
 }
+/** Worklog as the /4/worklogs list endpoints return it. */
+export interface RawTempoWorklog {
+    readonly tempoWorklogId: number;
+    readonly issue?: {
+        readonly id: number;
+    };
+    readonly issueId?: number;
+    readonly startDate: string;
+    readonly timeSpentSeconds: number;
+    readonly description?: string;
+    readonly updatedAt?: string;
+    readonly attributes?: {
+        readonly values?: ReadonlyArray<{
+            readonly key: string;
+            readonly value: string;
+        }>;
+    };
+}
+/** Map a raw API worklog to our full snapshot shape (description/activity/updatedAt kept). */
+export declare function mapTempoWorklog(raw: RawTempoWorklog): TempoWorklog;
+/** Tempo HTTP failure with the status preserved — 403 means "scope missing". */
+export declare class TempoApiError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+/** Raw /4/user-schedule day (DaySchedule in the Tempo OpenAPI spec). */
+export interface TempoScheduleDay {
+    readonly date: string;
+    readonly requiredSeconds: number;
+    readonly type: string;
+    readonly holiday?: {
+        readonly name?: string;
+        readonly description?: string;
+        readonly durationSeconds?: number;
+    };
+}
+/** Raw /4/timesheet-approvals/user response (TimesheetApproval in the spec). */
+export interface TempoTimesheetApproval {
+    readonly period: {
+        readonly from: string;
+        readonly to: string;
+    };
+    readonly requiredSeconds: number;
+    readonly timeSpentSeconds: number;
+    readonly status?: {
+        readonly key?: string;
+    };
+    readonly actions?: {
+        readonly submit?: unknown;
+    };
+}
 export declare class TempoClient {
     private readonly token;
     private lastRequestTime;
@@ -22,6 +73,18 @@ export declare class TempoClient {
     private request;
     /** Fetch user worklogs for a date range with pagination */
     getUserWorklogs(accountId: string, from: string, to: string): Promise<TempoWorklog[]>;
+    /**
+     * Day schedule of the token's user (requiredSeconds, day type, holiday).
+     * Needs scope schemes:view — 403 without it. Not paginated: the endpoint
+     * takes only from/to and returns every day of the range.
+     */
+    getUserSchedule(from: string, to: string): Promise<TempoScheduleDay[]>;
+    /**
+     * Current timesheet approval for the period containing `from` (period
+     * granularity comes from globalconfiguration.approvalPeriod). Needs scope
+     * approvals:view — 403 without it.
+     */
+    getUserTimesheetApproval(accountId: string, from: string): Promise<TempoTimesheetApproval>;
     /** Fetch all work attributes (e.g. _Activity_ STATIC_LIST values). */
     getWorkAttributes(): Promise<TempoWorkAttribute[]>;
     /** Build the shared worklog body. activity defaults to Development; description omitted when empty. */

package/dist/push/tempo-client.js

@@ -1,4 +1,25 @@
 import { TEMPO_BASE_URL, TEMPO_RATE_LIMIT_MS, ACTIVITY_ATTRIBUTE_KEY, DEFAULT_ACTIVITY } from '../core/constants.js';
+/** Map a raw API worklog to our full snapshot shape (description/activity/updatedAt kept). */
+export function mapTempoWorklog(raw) {
+    const activity = raw.attributes?.values?.find(v => v.key === ACTIVITY_ATTRIBUTE_KEY)?.value;
+    return {
+        tempoWorklogId: raw.tempoWorklogId,
+        issueId: raw.issue?.id ?? raw.issueId ?? 0,
+        startDate: raw.startDate,
+        timeSpentSeconds: raw.timeSpentSeconds,
+        ...(raw.description !== undefined ? { description: raw.description } : {}),
+        ...(activity !== undefined ? { activity } : {}),
+        ...(raw.updatedAt !== undefined ? { updatedAt: raw.updatedAt } : {}),
+    };
+}
+/** Tempo HTTP failure with the status preserved — 403 means "scope missing". */
+export class TempoApiError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
 export class TempoClient {
     token;
     lastRequestTime = 0;
@@ -29,7 +50,7 @@ export class TempoClient {
         });
         if (!res.ok) {
             const text = await res.text();
-            throw new Error(`Tempo API ${res.status} ${method} ${path}: ${text.slice(0, 300)}`);
+            throw new TempoApiError(res.status, `Tempo API ${res.status} ${method} ${path}: ${text.slice(0, 300)}`);
         }
         // DELETE returns 204 No Content
         if (res.status === 204)
@@ -45,21 +66,36 @@ export class TempoClient {
             const path = `/4/worklogs/user/${encodeURIComponent(accountId)}`
                 + `?from=${from}&to=${to}&offset=${offset}&limit=${limit}`;
             const response = await this.request('GET', path);
-            for (const wl of response.results ?? []) {
-                allWorklogs.push({
-                    tempoWorklogId: wl.tempoWorklogId,
-                    issueId: wl.issue?.id ?? wl.issueId ?? 0,
-                    startDate: wl.startDate,
-                    timeSpentSeconds: wl.timeSpentSeconds,
-                });
+            const items = response.results ?? [];
+            for (const wl of items) {
+                allWorklogs.push(mapTempoWorklog(wl));
             }
-            const meta = response.metadata;
-            if (!meta || offset + limit >= meta.count)
+            // metadata.count is the PAGE size, not the total — the only reliable
+            // "more pages" signal is metadata.next (verified live 2026-07-07).
+            if (!response.metadata?.next || items.length === 0)
                 break;
             offset += limit;
         }
         return allWorklogs;
     }
+    /**
+     * Day schedule of the token's user (requiredSeconds, day type, holiday).
+     * Needs scope schemes:view — 403 without it. Not paginated: the endpoint
+     * takes only from/to and returns every day of the range.
+     */
+    async getUserSchedule(from, to) {
+        const response = await this.request('GET', `/4/user-schedule?from=${from}&to=${to}`);
+        return response.results ?? [];
+    }
+    /**
+     * Current timesheet approval for the period containing `from` (period
+     * granularity comes from globalconfiguration.approvalPeriod). Needs scope
+     * approvals:view — 403 without it.
+     */
+    async getUserTimesheetApproval(accountId, from) {
+        const path = `/4/timesheet-approvals/user/${encodeURIComponent(accountId)}?from=${from}`;
+        return await this.request('GET', path);
+    }
     /** Fetch all work attributes (e.g. _Activity_ STATIC_LIST values). */
     async getWorkAttributes() {
         const response = await this.request('GET', '/4/work-attributes?limit=100');

package/dist/push/tempo-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"tempo-client.js","sourceRoot":"","sources":["../../src/push/tempo-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAoBrH,MAAM,OAAO,WAAW;IACL,KAAK,CAAS;IACvB,eAAe,GAAW,CAAC,CAAC;IAEpC,YAAmB,KAAa;QAC9B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC;QAClD,IAAI,OAAO,GAAG,mBAAmB,EAAE,CAAC;YAClC,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,IAAY,EAAE,IAAc;QAChE,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,GAAG,cAAc,GAAG,IAAI,EAAE,CAAC;QACvC,MAAM,OAAO,GAA2B;YACtC,eAAe,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;YACvC,QAAQ,EAAE,kBAAkB;SAC7B,CAAC;QACF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAC/C,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC5D,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,MAAM,IAAI,MAAM,IAAI,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,gCAAgC;QAChC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,CAAC;QAClC,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAED,2DAA2D;IACpD,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,IAAY,EAAE,EAAU;QACtE,MAAM,WAAW,GAAmB,EAAE,CAAC;QACvC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,MAAM,KAAK,GAAG,EAAE,CAAC;QAEjB,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,oBAAoB,kBAAkB,CAAC,SAAS,CAAC,EAAE;kBAC5D,SAAS,IAAI,OAAO,EAAE,WAAW,MAAM,UAAU,KAAK,EAAE,CAAC;YAC7D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAS9C,CAAC;YAEF,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;gBACxC,WAAW,CAAC,IAAI,CAAC;oBACf,cAAc,EAAE,EAAE,CAAC,cAAc;oBACjC,OAAO,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,IAAI,CAAC;oBACxC,SAAS,EAAE,EAAE,CAAC,SAAS;oBACvB,gBAAgB,EAAE,EAAE,CAAC,gBAAgB;iBACtC,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC;YAC/B,IAAI,CAAC,IAAI,IAAI,MAAM,GAAG,KAAK,IAAI,IAAI,CAAC,KAAK;gBAAE,MAAM;YACjD,MAAM,IAAI,KAAK,CAAC;QAClB,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,sEAAsE;IAC/D,KAAK,CAAC,iBAAiB;QAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,8BAA8B,CAExE,CAAC;QACF,OAAO,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,uGAAuG;IAC/F,gBAAgB,CAAC,MAA2B;QAClD,MAAM,IAAI,GAA4B;YACpC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,UAAU;YACrB,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,IAAI,gBAAgB,EAAE,CAAC;SAC1F,CAAC;QACF,IAAI,MAAM,CAAC,WAAW;YAAE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2BAA2B;IACpB,KAAK,CAAC,aAAa,CAAC,MAA2B;QACpD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAwC,CAAC;IACnH,CAAC;IAED,iCAAiC;IAC1B,KAAK,CAAC,aAAa,CAAC,SAAiB,EAAE,MAA2B;QACvE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,eAAe,SAAS,EAAE,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAwC,CAAC;IAC/H,CAAC;IAED,uBAAuB;IAChB,KAAK,CAAC,aAAa,CAAC,SAAiB;QAC1C,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,eAAe,SAAS,EAAE,CAAC,CAAC;IAC3D,CAAC;CACF"}
+{"version":3,"file":"tempo-client.js","sourceRoot":"","sources":["../../src/push/tempo-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAgCrH,8FAA8F;AAC9F,MAAM,UAAU,eAAe,CAAC,GAAoB;IAClD,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,sBAAsB,CAAC,EAAE,KAAK,CAAC;IAC5F,OAAO;QACL,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,GAAG,CAAC,OAAO,IAAI,CAAC;QAC1C,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,GAAG,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtB,MAAM,CAAS;IAE/B,YAAmB,MAAc,EAAE,OAAe;QAChD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAuBD,MAAM,OAAO,WAAW;IACL,KAAK,CAAS;IACvB,eAAe,GAAW,CAAC,CAAC;IAEpC,YAAmB,KAAa;QAC9B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC;QAClD,IAAI,OAAO,GAAG,mBAAmB,EAAE,CAAC;YAClC,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,IAAY,EAAE,IAAc;QAChE,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,GAAG,cAAc,GAAG,IAAI,EAAE,CAAC;QACvC,MAAM,OAAO,GAA2B;YACtC,eAAe,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;YACvC,QAAQ,EAAE,kBAAkB;SAC7B,CAAC;QACF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAC/C,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC5D,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,GAAG,CAAC,MAAM,IAAI,MAAM,IAAI,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1G,CAAC;QAED,gCAAgC;QAChC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,CAAC;QAClC,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAED,2DAA2D;IACpD,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,IAAY,EAAE,EAAU;QACtE,MAAM,WAAW,GAAmB,EAAE,CAAC;QACvC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,MAAM,KAAK,GAAG,EAAE,CAAC;QAEjB,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,oBAAoB,kBAAkB,CAAC,SAAS,CAAC,EAAE;kBAC5D,SAAS,IAAI,OAAO,EAAE,WAAW,MAAM,UAAU,KAAK,EAAE,CAAC;YAC7D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAG9C,CAAC;YAEF,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;YACrC,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;gBACvB,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC;YACxC,CAAC;YAED,qEAAqE;YACrE,mEAAmE;YACnE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM;YAC1D,MAAM,IAAI,KAAK,CAAC;QAClB,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,eAAe,CAAC,IAAY,EAAE,EAAU;QACnD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,yBAAyB,IAAI,OAAO,EAAE,EAAE,CAElF,CAAC;QACF,OAAO,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,wBAAwB,CAAC,SAAiB,EAAE,IAAY;QACnE,MAAM,IAAI,GAAG,+BAA+B,kBAAkB,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC;QACzF,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAA2B,CAAC;IACnE,CAAC;IAED,sEAAsE;IAC/D,KAAK,CAAC,iBAAiB;QAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,8BAA8B,CAExE,CAAC;QACF,OAAO,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,uGAAuG;IAC/F,gBAAgB,CAAC,MAA2B;QAClD,MAAM,IAAI,GAA4B;YACpC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,UAAU;YACrB,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,IAAI,gBAAgB,EAAE,CAAC;SAC1F,CAAC;QACF,IAAI,MAAM,CAAC,WAAW;YAAE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2BAA2B;IACpB,KAAK,CAAC,aAAa,CAAC,MAA2B;QACpD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAwC,CAAC;IACnH,CAAC;IAED,iCAAiC;IAC1B,KAAK,CAAC,aAAa,CAAC,SAAiB,EAAE,MAA2B;QACvE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,eAAe,SAAS,EAAE,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAwC,CAAC;IAC/H,CAAC;IAED,uBAAuB;IAChB,KAAK,CAAC,aAAa,CAAC,SAAiB;QAC1C,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,eAAe,SAAS,EAAE,CAAC,CAAC;IAC3D,CAAC;CACF"}

package/dist/push/tempo-pusher.d.ts

@@ -1,7 +1,7 @@
-import { type AppConfig, type Secrets, type TaskDayReport, type TempoWorklog, type JiraIssue, type PushPlanEntry, type PushLogEntry, type PushResult, type PushResponse } from '../core/types.js';
+import { type AppConfig, type Secrets, type PushPlanEntry, type PushResult, type PushResponse } from '../core/types.js';
 import { TempoClient } from './tempo-client.js';
-/** Build a plan by comparing report entries with push log and existing Tempo worklogs */
-export declare function buildPushPlan(report: readonly TaskDayReport[], jiraMap: Map<string, JiraIssue>, pushLog: Record<string, PushLogEntry>, tempoWorklogs: readonly TempoWorklog[]): PushPlanEntry[];
+import { buildPushPlan } from './reconcile.js';
+export { buildPushPlan };
 /** Execute mutations from the plan, update push log */
 export declare function executePlan(plan: readonly PushPlanEntry[], tempoClient: TempoClient, accountId: string): Promise<PushResult>;
 interface RunPushOptions {
@@ -11,7 +11,7 @@ interface RunPushOptions {
     readonly config: AppConfig;
     readonly secrets: Secrets;
     readonly filePath?: string;
+    readonly force?: boolean;
 }
 /** Full push pipeline: build report → resolve Jira → fetch Tempo → plan → execute */
 export declare function runPush(options: RunPushOptions): Promise<PushResponse>;
-export {};

package/dist/push/tempo-pusher.js

@@ -1,161 +1,21 @@
-import { readFileSync, writeFileSync, existsSync } from 'node:fs';
-import { join } from 'node:path';
-import { getDataDir } from '../core/config.js';
+import { readFileSync } from 'node:fs';
 import { readDailyLog, writeDailyLog } from '../core/daily-log.js';
-import { PUSH_LOG_FILE, TEMPO_TOLERANCE_SECONDS } from '../core/constants.js';
 import { DayStatus } from '../core/types.js';
 import { buildReport } from './report-builder.js';
 import { getAccountId, resolveIssueIds } from './jira-client.js';
 import { TempoClient } from './tempo-client.js';
-// ─── Push log persistence ────────────────────────────────────────────────
-function getPushLogPath() {
-    return join(getDataDir(), PUSH_LOG_FILE);
-}
-function loadPushLog() {
-    const path = getPushLogPath();
-    if (!existsSync(path))
-        return {};
-    try {
-        return JSON.parse(readFileSync(path, 'utf-8'));
-    }
-    catch {
-        return {};
-    }
-}
-function savePushLog(log) {
-    writeFileSync(getPushLogPath(), JSON.stringify(log, null, 2), 'utf-8');
-}
-function pushLogKey(date, task, entryId) {
-    return entryId ? `${date}|${task}|m:${entryId}` : `${date}|${task}`;
-}
+import { invalidateApprovalCache } from './tempo-approvals.js';
+import { loadPushLog, savePushLog, pushLogKey, loadTombstones, removeTombstonesByWorklogIds } from './push-log.js';
+import { refreshSnapshotsInRange } from './tempo-snapshot.js';
+import { buildPushPlan, formatHours } from './reconcile.js';
 // ─── Push plan ───────────────────────────────────────────────────────────
-/** Build a plan by comparing report entries with push log and existing Tempo worklogs */
-export function buildPushPlan(report, jiraMap, pushLog, tempoWorklogs) {
-    const plan = [];
-    // Index Tempo worklogs by (date, issueId) for fast lookup
-    const tempoByKey = new Map();
-    for (const wl of tempoWorklogs) {
-        const key = `${wl.startDate}|${wl.issueId}`;
-        const list = tempoByKey.get(key) ?? [];
-        list.push(wl);
-        tempoByKey.set(key, list);
-    }
-    // Worklogs we own as MANUAL entries — excluded from the session aggregate so a
-    // session line never treats its own task's manual worklogs as extra/foreign.
-    const manualOwnedTempoIds = new Set();
-    for (const [key, logEntry] of Object.entries(pushLog)) {
-        if (key.includes('|m:'))
-            manualOwnedTempoIds.add(logEntry.tempoWorklogId);
-    }
-    // Track which Tempo worklogs are accounted for by our report
-    const accountedTempoIds = new Set();
-    for (const entry of report) {
-        const jira = jiraMap.get(entry.task);
-        if (!jira) {
-            plan.push({
-                date: entry.date, task: entry.task, targetSeconds: entry.totalSeconds,
-                action: 'error', detail: 'Unresolved in Jira',
-                kind: entry.kind, entryId: entry.entryId, description: entry.description, activity: entry.activity,
-            });
-            continue;
-        }
-        const tempoMatches = tempoByKey.get(`${entry.date}|${jira.issueId}`) ?? [];
-        // ── Manual entry: its own worklog, keyed by entryId (stable across edits) ──
-        if (entry.kind === 'manual') {
-            const base = {
-                date: entry.date, task: entry.task, targetSeconds: entry.totalSeconds,
-                issueId: jira.issueId, kind: 'manual',
-                entryId: entry.entryId, description: entry.description, activity: entry.activity,
-            };
-            const key = pushLogKey(entry.date, entry.task, entry.entryId);
-            const logEntry = pushLog[key];
-            const live = logEntry && tempoMatches.some(w => w.tempoWorklogId === logEntry.tempoWorklogId)
-                ? logEntry : null;
-            if (live) {
-                accountedTempoIds.add(live.tempoWorklogId);
-                const timeDrift = Math.abs(live.timeSpentSeconds - entry.totalSeconds) > TEMPO_TOLERANCE_SECONDS;
-                const textDrift = (live.description ?? '') !== (entry.description ?? '')
-                    || (live.activity ?? '') !== (entry.activity ?? '');
-                if (!timeDrift && !textDrift) {
-                    plan.push({ ...base, action: 'skip', detail: `Already pushed (${formatHours(live.timeSpentSeconds)})`, existingWorklogId: live.tempoWorklogId });
-                }
-                else {
-                    const detail = timeDrift
-                        ? `${formatHours(live.timeSpentSeconds)} → ${formatHours(entry.totalSeconds)}`
-                        : 'text/activity changed';
-                    plan.push({ ...base, action: 'update', detail, existingWorklogId: live.tempoWorklogId });
-                }
-            }
-            else {
-                // No live worklog of ours — create. Foreign worklogs on the same issue+date
-                // are irrelevant: this entry has its own identity (entryId).
-                plan.push({ ...base, action: 'create', detail: `New (${formatHours(entry.totalSeconds)})` });
-            }
-            continue;
-        }
-        // ── Session aggregate: one worklog per (date, task) ──
-        const base = {
-            date: entry.date, task: entry.task, targetSeconds: entry.totalSeconds,
-            issueId: jira.issueId, kind: 'session',
-        };
-        const logEntry = pushLog[pushLogKey(entry.date, entry.task)];
-        // Drop manual-owned worklogs: they belong to manual lines, not this aggregate.
-        const sessionMatches = tempoMatches.filter(w => !manualOwnedTempoIds.has(w.tempoWorklogId));
-        const validLogEntry = logEntry && sessionMatches.some(w => w.tempoWorklogId === logEntry.tempoWorklogId)
-            ? logEntry : null;
-        if (validLogEntry) {
-            accountedTempoIds.add(validLogEntry.tempoWorklogId);
-            const diff = Math.abs(validLogEntry.timeSpentSeconds - entry.totalSeconds);
-            if (diff <= TEMPO_TOLERANCE_SECONDS) {
-                plan.push({ ...base, action: 'skip', detail: `Already pushed (${formatHours(validLogEntry.timeSpentSeconds)})`, existingWorklogId: validLogEntry.tempoWorklogId });
-            }
-            else {
-                plan.push({ ...base, action: 'update', detail: `${formatHours(validLogEntry.timeSpentSeconds)} → ${formatHours(entry.totalSeconds)}`, existingWorklogId: validLogEntry.tempoWorklogId });
-            }
-            for (const wl of sessionMatches)
-                accountedTempoIds.add(wl.tempoWorklogId);
-        }
-        else if (sessionMatches.length > 0) {
-            for (const wl of sessionMatches)
-                accountedTempoIds.add(wl.tempoWorklogId);
-            const existingTotal = sessionMatches.reduce((s, w) => s + w.timeSpentSeconds, 0);
-            const diff = Math.abs(existingTotal - entry.totalSeconds);
-            if (diff <= TEMPO_TOLERANCE_SECONDS) {
-                plan.push({ ...base, action: 'skip', detail: `Exists in Tempo (${formatHours(existingTotal)})`, extraWorklogIds: sessionMatches.map(w => w.tempoWorklogId) });
-            }
-            else {
-                plan.push({ ...base, action: 'create', detail: `Tempo has ${formatHours(existingTotal)}, adding ${formatHours(entry.totalSeconds)}`, extraWorklogIds: sessionMatches.map(w => w.tempoWorklogId) });
-            }
-        }
-        else {
-            plan.push({ ...base, action: 'create', detail: `New (${formatHours(entry.totalSeconds)})` });
-        }
-    }
-    // Tempo-only worklogs (not matched by our report) — show, never mutate.
-    for (const wl of tempoWorklogs) {
-        if (accountedTempoIds.has(wl.tempoWorklogId))
-            continue;
-        let taskKey = `issue:${wl.issueId}`;
-        for (const [key, jira] of jiraMap) {
-            if (jira.issueId === wl.issueId) {
-                taskKey = key;
-                break;
-            }
-        }
-        plan.push({
-            date: wl.startDate, task: taskKey, targetSeconds: wl.timeSpentSeconds,
-            action: 'skip', detail: `Tempo only (${formatHours(wl.timeSpentSeconds)})`,
-            existingWorklogId: wl.tempoWorklogId, kind: 'session',
-        });
-    }
-    // Sort by date, then task
-    plan.sort((a, b) => a.date.localeCompare(b.date) || a.task.localeCompare(b.task));
-    return plan;
-}
+// The diff engine lives in reconcile.ts; re-exported here for existing callers.
+export { buildPushPlan };
 // ─── Execute plan ────────────────────────────────────────────────────────
 /** Execute mutations from the plan, update push log */
 export async function executePlan(plan, tempoClient, accountId) {
     const pushLog = loadPushLog();
+    const deletedWorklogIds = new Set();
     let posted = 0;
     let updated = 0;
     let deleted = 0;
@@ -227,15 +87,49 @@ export async function executePlan(plan, tempoClient, accountId) {
                 }
                 break;
             }
+            case 'delete': {
+                if (!entry.existingWorklogId) {
+                    failed++;
+                    break;
+                }
+                try {
+                    await tempoClient.deleteWorklog(entry.existingWorklogId);
+                    delete pushLog[key]; // stray ownership, if any
+                    deletedWorklogIds.add(entry.existingWorklogId);
+                    deleted++;
+                    console.log(`  DEL  ${entry.date} ${entry.task} ${formatHours(entry.targetSeconds)}`);
+                }
+                catch (err) {
+                    failed++;
+                    console.error(`  FAIL DEL ${entry.date} ${entry.task}: ${err instanceof Error ? err.message : String(err)}`);
+                }
+                break;
+            }
             case 'error':
                 failed++;
                 break;
         }
     }
     savePushLog(pushLog);
+    if (deletedWorklogIds.size > 0) {
+        removeTombstonesByWorklogIds(deletedWorklogIds);
+    }
     return { posted, updated, deleted, skipped, failed };
 }
 // ─── Mark daily logs as pushed ───────────────────────────────────────────
+/** Dates in [from, to] whose local day file exists — the stray-delete guard. */
+function collectDatesWithData(from, to) {
+    const dates = new Set();
+    const current = new Date(from + 'T12:00:00Z');
+    const end = new Date(to + 'T12:00:00Z');
+    while (current <= end) {
+        const date = current.toISOString().slice(0, 10);
+        if (readDailyLog(date))
+            dates.add(date);
+        current.setUTCDate(current.getUTCDate() + 1);
+    }
+    return dates;
+}
 function markDaysPushed(from, to) {
     const current = new Date(from + 'T12:00:00Z');
     const end = new Date(to + 'T12:00:00Z');
@@ -255,7 +149,7 @@ function markDaysPushed(from, to) {
 }
 /** Full push pipeline: build report → resolve Jira → fetch Tempo → plan → execute */
 export async function runPush(options) {
-    const { from, to, commit, config, secrets, filePath } = options;
+    const { from, to, commit, config, secrets, filePath, force } = options;
     // Step 1: Build or load report
     let report;
     if (filePath) {
@@ -268,7 +162,15 @@ export async function runPush(options) {
         report = buildReport(from, to, config);
         console.log(`Built report: ${report.length} entries (${from} → ${to})`);
     }
-    if (report.length === 0) {
+    // Local deletions may still need Tempo-side propagation even when the
+    // report is empty (a fully cleared pushed day, tombstoned entries).
+    const pushLog = loadPushLog();
+    const rangeTombstones = loadTombstones().filter(t => t.date >= from && t.date <= to);
+    const hasRangeOwnership = Object.keys(pushLog).some(k => {
+        const date = k.slice(0, 10);
+        return date >= from && date <= to;
+    });
+    if (report.length === 0 && rangeTombstones.length === 0 && !hasRangeOwnership) {
         return { dryRun: !commit, plan: [], result: { posted: 0, updated: 0, deleted: 0, skipped: 0, failed: 0 } };
     }
     // Step 2: Resolve Jira issue IDs
@@ -288,20 +190,52 @@ export async function runPush(options) {
     console.log(`Fetching Tempo worklogs (${from} → ${to})...`);
     const tempoWorklogs = await tempoClient.getUserWorklogs(accountId, from, to);
     console.log(`Found ${tempoWorklogs.length} existing worklog(s)`);
-    // Step 4: Build plan
-    const pushLog = loadPushLog();
-    const plan = buildPushPlan(report, jiraMap, pushLog, tempoWorklogs);
+    // Step 4: Build plan. Tombstones whose worklog is already gone from Tempo
+    // (deleted remotely too) have nothing left to do — purge them silently.
+    const aliveIds = new Set(tempoWorklogs.map(w => w.tempoWorklogId));
+    const deadTombstones = rangeTombstones.filter(t => !aliveIds.has(t.tempoWorklogId));
+    if (deadTombstones.length > 0) {
+        removeTombstonesByWorklogIds(new Set(deadTombstones.map(t => t.tempoWorklogId)));
+    }
+    const plan = buildPushPlan(report, jiraMap, pushLog, tempoWorklogs, {
+        tombstones: rangeTombstones.filter(t => aliveIds.has(t.tempoWorklogId)),
+        from,
+        to,
+        datesWithData: collectDatesWithData(from, to),
+    });
     if (!commit) {
         return { dryRun: true, plan };
     }
+    // Conflict gate: "local wins" is a choice, not a default. A commit push
+    // that would overwrite Tempo-side edits stops here until the caller
+    // explicitly forces it — nothing (conflicted or not) is executed.
+    if (!force) {
+        const conflicted = plan.filter(e => e.conflict);
+        if (conflicted.length > 0) {
+            console.log(`Push blocked: ${conflicted.length} worklog(s) edited in Tempo since our push.`);
+            return { dryRun: false, plan, blockedByConflicts: true };
+        }
+    }
     // Step 5: Execute
-    const actionable = plan.filter(e => e.action === 'create' || e.action === 'update');
+    const actionable = plan.filter(e => e.action === 'create' || e.action === 'update' || e.action === 'delete');
     if (actionable.length === 0) {
         console.log('Nothing to push.');
+        // Parity with Tempo is still a successful sync — seal the days, or an
+        // edited-then-reverted day stays Outdated forever (no mutation ever
+        // triggers the seal below). Plan errors (unresolved Jira) block it.
+        if (!plan.some(e => e.action === 'error')) {
+            markDaysPushed(from, to);
+        }
         return { dryRun: false, plan, result: { posted: 0, updated: 0, deleted: 0, skipped: 0, failed: 0 } };
     }
     console.log(`Executing ${actionable.length} mutation(s)...`);
     const result = await executePlan(plan, tempoClient, accountId);
+    // Tempo-side state changed: approval cache is stale; worklog snapshots are
+    // refetched right away so month statuses turn diff-based after every push.
+    if (result.posted > 0 || result.updated > 0 || result.deleted > 0) {
+        invalidateApprovalCache();
+        await refreshSnapshotsInRange(from, to, secrets, accountId);
+    }
     // Seal the day only on a clean push. A failed mutation (network, Jira limit, etc.)
     // must NOT mark the day pushed, or it would silently drop out of future syncs.
     if (result.failed === 0) {
@@ -312,12 +246,4 @@ export async function runPush(options) {
     }
     return { dryRun: false, plan, result };
 }
-// ─── Helpers ─────────────────────────────────────────────────────────────
-function formatHours(seconds) {
-    const hours = seconds / 3600;
-    const rounded1 = parseFloat(hours.toFixed(1));
-    if (Math.abs(hours - rounded1) < 0.01)
-        return `${hours.toFixed(1)}h`;
-    return `${hours.toFixed(2)}h`;
-}
 //# sourceMappingURL=tempo-pusher.js.map