@7365admin1/core 3.52.7 → 3.52.8

package/dist/index.js

@@ -5931,6 +5931,7 @@ __export(src_exports, {
   CameraType: () => CameraType,
   ConsoleAuditAction: () => ConsoleAuditAction,
   ConsoleAuditTarget: () => ConsoleAuditTarget,
+  DEFAULT_SITE_TIMEZONE: () => DEFAULT_SITE_TIMEZONE,
   DEVICE_STATUS: () => DEVICE_STATUS,
   DOBStatus: () => DOBStatus,
   DUPLICATE_TERMS_VERSION_MESSAGE: () => DUPLICATE_TERMS_VERSION_MESSAGE,
@@ -6185,6 +6186,7 @@ __export(src_exports, {
   isSafeRelativePath: () => isSafeRelativePath,
   isSuperAdmin: () => isSuperAdmin,
   isTermsCurrent: () => isTermsCurrent,
+  isValidTimezone: () => isValidTimezone,
   manpowerDesignationsSchema: () => manpowerDesignationsSchema,
   manpowerEvents: () => manpowerEvents,
   manpowerMonitoringSchema: () => manpowerMonitoringSchema,
@@ -6204,6 +6206,7 @@ __export(src_exports, {
   occurrence_book_namespace_collection: () => occurrence_book_namespace_collection,
   online_forms_namespace_collection: () => online_forms_namespace_collection,
   orgSchema: () => orgSchema,
+  orgSiteScope: () => orgSiteScope,
   overnight_parking_requests_namespace_collection: () => overnight_parking_requests_namespace_collection,
   parseCameraChannel: () => parseCameraChannel,
   parseCameraHost: () => parseCameraHost,
@@ -6237,6 +6240,7 @@ __export(src_exports, {
   resolveDeviceHttp: () => resolveDeviceHttp,
   resolveHidPhysicalCardValue: () => resolveHidPhysicalCardValue,
   resolveInviteActor: () => resolveInviteActor,
+  resolveSiteTimezone: () => resolveSiteTimezone,
   robotSchema: () => robotSchema,
   rtspUrl: () => rtspUrl,
   schema: () => schema,
@@ -6393,6 +6397,7 @@ __export(src_exports, {
   sessionSchema: () => sessionSchema,
   setIO: () => setIO,
   shiftSchema: () => shiftSchema,
+  siteDayBounds: () => siteDayBounds,
   siteSchema: () => siteSchema,
   site_people_namespace_collection: () => site_people_namespace_collection,
   snapshotEndpoint: () => snapshotEndpoint,
@@ -12270,6 +12275,36 @@ var import_mongodb21 = require("mongodb");
 var import_node_server_utils22 = require("@7365admin1/node-server-utils");
 var import_joi9 = __toESM(require("joi"));
 var import_mongodb20 = require("mongodb");
+
+// src/utils/site-timezone.util.ts
+var import_moment_timezone = __toESM(require("moment-timezone"));
+var DEFAULT_SITE_TIMEZONE = "Asia/Singapore";
+function isValidTimezone(tz) {
+  return typeof tz === "string" && tz.length > 0 && !!import_moment_timezone.default.tz.zone(tz);
+}
+function resolveSiteTimezone(site) {
+  const tz = site?.timezone;
+  return isValidTimezone(tz) ? tz : DEFAULT_SITE_TIMEZONE;
+}
+function siteDayBounds(value, timezone) {
+  if (!value)
+    return null;
+  const tz = isValidTimezone(timezone) ? timezone : DEFAULT_SITE_TIMEZONE;
+  const isDateOnly = typeof value === "string" && /^\d{4}-\d{2}-\d{2}$/.test(value);
+  const m = isDateOnly ? import_moment_timezone.default.tz(value, "YYYY-MM-DD", tz) : typeof value === "string" ? import_moment_timezone.default.tz(value, import_moment_timezone.default.ISO_8601, tz) : import_moment_timezone.default.tz(value, tz);
+  if (!m.isValid())
+    return null;
+  return {
+    start: m.clone().startOf("day").toDate(),
+    end: m.clone().endOf("day").toDate(),
+    date: m.format("YYYY-MM-DD")
+  };
+}
+
+// src/models/site.model.ts
+function siteTimezoneValidator(value, helpers) {
+  return isValidTimezone(value) ? value : helpers.error("any.invalid");
+}
 var addressSchema = import_joi9.default.object({
   line1: import_joi9.default.string().min(3).required(),
   line2: import_joi9.default.string().allow("", null),
@@ -12377,6 +12412,7 @@ var siteSchema = import_joi9.default.object({
   orgId: import_joi9.default.string().hex().required(),
   customerId: import_joi9.default.string().hex().optional().allow("", null),
   address: addressSchema.optional(),
+  timezone: import_joi9.default.string().custom(siteTimezoneValidator, "IANA timezone").optional().default(DEFAULT_SITE_TIMEZONE),
   category: import_joi9.default.string().valid(...Object.values(SiteCategories)).default("commercial" /* COMMERCIAL */),
   deliveryCompanyList: import_joi9.default.array().items(import_joi9.default.string()).optional().allow(null),
   isOpenGate: import_joi9.default.boolean().optional().default(false),
@@ -12387,6 +12423,7 @@ var siteSchema = import_joi9.default.object({
 var updateSiteSchema = import_joi9.default.object({
   _id: import_joi9.default.string().hex().length(24).required(),
   address: updateAddressSchema.optional(),
+  timezone: import_joi9.default.string().custom(siteTimezoneValidator, "IANA timezone").optional(),
   metadata: metadataSchema3.optional(),
   deliveryCompanyList: import_joi9.default.array().items(import_joi9.default.string().trim()).optional().allow(null),
   isOpenGate: import_joi9.default.boolean().optional().allow(null),
@@ -12415,6 +12452,7 @@ function MSite(value) {
     status: "active",
     createdAt: /* @__PURE__ */ new Date(),
     address: value.address,
+    timezone: value.timezone ?? DEFAULT_SITE_TIMEZONE,
     category: value.category,
     deliveryCompanyList: value.deliveryCompanyList ?? [],
     isOpenGate: value.isOpenGate,
@@ -13671,7 +13709,8 @@ function useCustomerSiteRepo() {
     limit = 10,
     sort = {},
     org = "",
-    status = "active"
+    status = "active",
+    siteScope = null
   }, session) {
     page = page > 0 ? page - 1 : 0;
     try {
@@ -13691,6 +13730,11 @@ function useCustomerSiteRepo() {
       page,
       limit
     };
+    if (siteScope) {
+      const scoped = siteScope.filter((id) => import_mongodb24.ObjectId.isValid(id));
+      query2.site = { $in: scoped.map((id) => new import_mongodb24.ObjectId(id)) };
+      cacheOptions.siteScope = scoped.length ? [...scoped].sort().join(",") : "no-site";
+    }
     if (search) {
       query2.$or = [{ name: { $regex: search, $options: "i" } }];
       cacheOptions.search = search;
@@ -13997,7 +14041,8 @@ var EMPTY = {
   name: "",
   isSuperAdmin: false,
   orgIds: [],
-  propertyManagementOrgIds: []
+  propertyManagementOrgIds: [],
+  memberships: []
 };
 async function resolveInviteActor(userId) {
   const id = userId?.toString() ?? "";
@@ -14024,12 +14069,36 @@ async function resolveInviteActor(userId) {
     )
   );
   const user = await db2.collection("users").findOne({ _id: new import_mongodb25.ObjectId(id) }, { projection: { name: 1 } });
+  const memberRoleIds = Array.from(
+    new Set(
+      members.map((m) => m.role?.toString?.() ?? "").filter((r) => r && import_mongodb25.ObjectId.isValid(r))
+    )
+  );
+  const orgLevelRoleIds = /* @__PURE__ */ new Set();
+  if (memberRoleIds.length) {
+    const memberRoles = await db2.collection("roles").find(
+      {
+        _id: { $in: memberRoleIds.map((r) => new import_mongodb25.ObjectId(r)) },
+        ...LIVE_ROLE
+      },
+      { projection: { site: 1 } }
+    ).toArray();
+    for (const role of memberRoles) {
+      if (!role.site)
+        orgLevelRoleIds.add(role._id.toString());
+    }
+  }
   return {
     id,
     name: user?.name ?? adminMember?.name ?? "",
     isSuperAdmin: isSuperAdmin2,
     orgIds,
-    propertyManagementOrgIds
+    propertyManagementOrgIds,
+    memberships: members.map((m) => ({
+      org: m.org?.toString?.() ?? "",
+      siteId: m.siteId?.toString?.() ?? "",
+      orgLevelRole: orgLevelRoleIds.has(m.role?.toString?.() ?? "")
+    }))
   };
 }
 async function hasOrgInvitation(userId, orgId) {
@@ -19714,6 +19783,11 @@ var schemaVisitorTransaction = import_joi21.default.object({
   ).optional().allow(null),
   unitName: import_joi21.default.string().optional().allow(null, ""),
   expiredAt: import_joi21.default.date().iso().optional().allow(null, ""),
+  // The calendar day this invitation is valid for, in the site's timezone.
+  // Stored as a bare YYYY-MM-DD so no offset conversion can shift the day.
+  arrivalDate: import_joi21.default.string().pattern(/^\d{4}-\d{2}-\d{2}$/).optional().allow(null, "").messages({
+    "string.pattern.base": "arrivalDate must be in YYYY-MM-DD format (e.g. 2026-09-02)"
+  }),
   arrivalTime: import_joi21.default.string().pattern(/^([01]\d|2[0-3]):([0-5]\d)$/).optional().allow(null, "").messages({
     "string.pattern.base": "arrivalTime must be in HH:mm format (e.g. 09:30, 18:45)"
   }),
@@ -19775,6 +19849,11 @@ var schemaSelfServiceVisitor = import_joi21.default.object({
   // value through that schema via MVisitorTransaction(), and Joi.date()
   // would have already coerced it to a Date object by then, failing there.
   expectedCheckIn: import_joi21.default.string().isoDate().required(),
+  // The calendar day this invitation is valid for, in the site's timezone.
+  // Stored as a bare YYYY-MM-DD so no offset conversion can shift the day.
+  arrivalDate: import_joi21.default.string().pattern(/^\d{4}-\d{2}-\d{2}$/).optional().allow(null, "").messages({
+    "string.pattern.base": "arrivalDate must be in YYYY-MM-DD format (e.g. 2026-09-02)"
+  }),
   arrivalTime: import_joi21.default.string().pattern(/^([01]\d|2[0-3]):([0-5]\d)$/).optional().allow(null, "").messages({ "string.pattern.base": "arrivalTime must be in HH:mm format" }),
   duration: import_joi21.default.number().integer().min(0).optional().allow(null, ""),
   isOvernightParking: import_joi21.default.boolean().optional().default(false),
@@ -19808,6 +19887,13 @@ var schemaSelfServiceVisitor = import_joi21.default.object({
 });
 var schemaUpdateVisTrans = import_joi21.default.object({
   _id: import_joi21.default.string().hex().length(24).required(),
+  // Accepted here so a caller that moves `expectedCheckIn` can move the day
+  // with it. Without this the two drift apart silently and the QR stays valid
+  // on the ORIGINAL day, which is the failure the day-window work exists to
+  // prevent.
+  arrivalDate: import_joi21.default.string().pattern(/^\d{4}-\d{2}-\d{2}$/).optional().allow(null, "").messages({
+    "string.pattern.base": "arrivalDate must be in YYYY-MM-DD format (e.g. 2026-09-02)"
+  }),
   name: import_joi21.default.string().optional().allow(null, ""),
   type: import_joi21.default.string().valid(...PERSON_TYPES).optional().allow(null, ""),
   org: import_joi21.default.string().hex().length(24).optional().allow(null, ""),
@@ -20038,6 +20124,7 @@ function MVisitorTransaction(value) {
       remarks: "",
       updatedBy: value.inviterId ?? ""
     } : null,
+    arrivalDate: value.arrivalDate,
     arrivalTime: value.arrivalTime,
     duration: value.duration,
     members: value.members
@@ -20046,7 +20133,7 @@ function MVisitorTransaction(value) {
 
 // src/repositories/visitor-transaction.repo.ts
 var import_mongodb40 = require("mongodb");
-var import_moment_timezone = __toESM(require("moment-timezone"));
+var import_moment_timezone2 = __toESM(require("moment-timezone"));
 
 // src/utils/compile-handlebars.ts
 var import_handlebars = __toESM(require_lib());
@@ -20877,7 +20964,7 @@ function useVisitorTransactionRepo() {
     const baseUrl = APP_MAIN;
     const qrLink = `${baseUrl}/resident/invite/register/${updatedDocument?._id}`;
     const logo = `${baseUrl}/images/resident/dark/seven-365.svg`;
-    const arrivalDate = updatedDocument?.expectedCheckIn ? (0, import_moment_timezone.default)(updatedDocument.expectedCheckIn).tz("Asia/Singapore").format("DD/MM/YYYY") : "No Arrival Date";
+    const arrivalDate = updatedDocument?.expectedCheckIn ? (0, import_moment_timezone2.default)(updatedDocument.expectedCheckIn).tz("Asia/Singapore").format("DD/MM/YYYY") : "No Arrival Date";
     const isLead = !updatedDocument?.leadId;
     const memberRows = isLead && Array.isArray(updatedDocument?.members) ? updatedDocument.members.map((member, index) => ({
       position: index + 1,
@@ -24695,6 +24782,22 @@ function selectHealthTargets(cameraIds, cap, isValidId) {
     truncated: unique.length > limit
   };
 }
+function orgSiteScope(params) {
+  const org = idOf(params.org);
+  if (!org)
+    return null;
+  const inOrg = params.memberships.filter(
+    (membership) => idOf(membership.org) === org
+  );
+  if (inOrg.some(
+    (membership) => !idOf(membership.siteId) || membership.orgLevelRole === true
+  )) {
+    return null;
+  }
+  return Array.from(
+    new Set(inOrg.map((membership) => idOf(membership.siteId)).filter(Boolean))
+  );
+}
 
 // src/utils/camera-capability.util.ts
 var CAMERA_CAPABILITIES = [
@@ -40004,7 +40107,7 @@ var deleteVehicleRequestSchema = import_joi55.default.object({
 });
 
 // src/utils/vehicle-import.util.ts
-var import_moment_timezone2 = __toESM(require("moment-timezone"));
+var import_moment_timezone3 = __toESM(require("moment-timezone"));
 var SITE_TIME_ZONE = "Asia/Singapore";
 var DEFAULT_YEARS = 10;
 var CELL_FORMATS = [
@@ -40016,13 +40119,13 @@ var CELL_FORMATS = [
 ];
 function parseExpiryDate(value) {
   if (!value) {
-    return import_moment_timezone2.default.tz(SITE_TIME_ZONE).add(DEFAULT_YEARS, "years").toISOString();
+    return import_moment_timezone3.default.tz(SITE_TIME_ZONE).add(DEFAULT_YEARS, "years").toISOString();
   }
-  const wallClock = value instanceof Date ? import_moment_timezone2.default.utc(value).format("YYYY-MM-DDTHH:mm:ss") : String(value).trim();
+  const wallClock = value instanceof Date ? import_moment_timezone3.default.utc(value).format("YYYY-MM-DDTHH:mm:ss") : String(value).trim();
   if (!wallClock) {
-    return import_moment_timezone2.default.tz(SITE_TIME_ZONE).add(DEFAULT_YEARS, "years").toISOString();
+    return import_moment_timezone3.default.tz(SITE_TIME_ZONE).add(DEFAULT_YEARS, "years").toISOString();
   }
-  const parsed = import_moment_timezone2.default.tz(wallClock, CELL_FORMATS, SITE_TIME_ZONE);
+  const parsed = import_moment_timezone3.default.tz(wallClock, CELL_FORMATS, SITE_TIME_ZONE);
   return parsed.isValid() ? parsed.toISOString() : void 0;
 }
 
@@ -41761,13 +41864,16 @@ function useCustomerSiteController() {
     });
     try {
       await requireOrgAccess(req, org);
+      const actor = await resolveInviteActor(callerId(req));
+      const siteScope = actor.isSuperAdmin ? null : orgSiteScope({ memberships: actor.memberships, org });
       const data = await _getAll({
         search,
         page,
         limit,
         sort: sortObj,
         org,
-        status
+        status,
+        siteScope
       });
       res.json(data);
       return;
@@ -42213,7 +42319,7 @@ function MAttendance(value) {
 
 // src/repositories/attendance.repository.ts
 var import_mongodb77 = require("mongodb");
-var import_moment_timezone3 = __toESM(require("moment-timezone"));
+var import_moment_timezone4 = __toESM(require("moment-timezone"));
 var import_node_server_utils124 = require("@7365admin1/node-server-utils");
 function useAttendanceRepository() {
   const db2 = import_node_server_utils124.useAtlas.getDb();
@@ -42278,11 +42384,11 @@ function useAttendanceRepository() {
       cacheOptions.search = search;
     }
     const singaporeTz = "Asia/Singapore";
-    const normalizedStartDate = typeof startDate === "string" ? startDate : (0, import_moment_timezone3.default)(startDate).tz(singaporeTz).format("YYYY-MM-DD");
-    const normalizedEndDate = typeof endDate === "string" ? endDate : (0, import_moment_timezone3.default)(endDate).tz(singaporeTz).format("YYYY-MM-DD");
+    const normalizedStartDate = typeof startDate === "string" ? startDate : (0, import_moment_timezone4.default)(startDate).tz(singaporeTz).format("YYYY-MM-DD");
+    const normalizedEndDate = typeof endDate === "string" ? endDate : (0, import_moment_timezone4.default)(endDate).tz(singaporeTz).format("YYYY-MM-DD");
     if (startDate && endDate) {
-      const startOfDay = import_moment_timezone3.default.tz(normalizedStartDate, "YYYY-MM-DD", singaporeTz).startOf("day").toDate();
-      const endOfDay = import_moment_timezone3.default.tz(normalizedEndDate, "YYYY-MM-DD", singaporeTz).endOf("day").toDate();
+      const startOfDay = import_moment_timezone4.default.tz(normalizedStartDate, "YYYY-MM-DD", singaporeTz).startOf("day").toDate();
+      const endOfDay = import_moment_timezone4.default.tz(normalizedEndDate, "YYYY-MM-DD", singaporeTz).endOf("day").toDate();
       query2.$expr = {
         $and: [
           { $gte: [{ $toDate: "$checkIn.timestamp" }, startOfDay] },
@@ -42295,7 +42401,7 @@ function useAttendanceRepository() {
       query2.$expr = {
         $gte: [
           { $toDate: "$checkIn.timestamp" },
-          import_moment_timezone3.default.tz(normalizedStartDate, "YYYY-MM-DD", singaporeTz).startOf("day").toDate()
+          import_moment_timezone4.default.tz(normalizedStartDate, "YYYY-MM-DD", singaporeTz).startOf("day").toDate()
         ]
       };
       cacheOptions.startDate = normalizedStartDate;
@@ -42303,7 +42409,7 @@ function useAttendanceRepository() {
       query2.$expr = {
         $lte: [
           { $toDate: "$checkIn.timestamp" },
-          import_moment_timezone3.default.tz(normalizedEndDate, "YYYY-MM-DD", singaporeTz).endOf("day").toDate()
+          import_moment_timezone4.default.tz(normalizedEndDate, "YYYY-MM-DD", singaporeTz).endOf("day").toDate()
         ]
       };
       cacheOptions.endDate = normalizedEndDate;
@@ -42416,11 +42522,11 @@ function useAttendanceRepository() {
       cacheOptions.search = search;
     }
     const singaporeTz = "Asia/Singapore";
-    const normalizedStartDate = typeof startDate === "string" ? startDate : (0, import_moment_timezone3.default)(startDate).tz(singaporeTz).format("YYYY-MM-DD");
-    const normalizedEndDate = typeof endDate === "string" ? endDate : (0, import_moment_timezone3.default)(endDate).tz(singaporeTz).format("YYYY-MM-DD");
+    const normalizedStartDate = typeof startDate === "string" ? startDate : (0, import_moment_timezone4.default)(startDate).tz(singaporeTz).format("YYYY-MM-DD");
+    const normalizedEndDate = typeof endDate === "string" ? endDate : (0, import_moment_timezone4.default)(endDate).tz(singaporeTz).format("YYYY-MM-DD");
     if (startDate && endDate) {
-      const startOfDay = import_moment_timezone3.default.tz(normalizedStartDate, "YYYY-MM-DD", singaporeTz).startOf("day").toDate();
-      const endOfDay = import_moment_timezone3.default.tz(normalizedEndDate, "YYYY-MM-DD", singaporeTz).endOf("day").toDate();
+      const startOfDay = import_moment_timezone4.default.tz(normalizedStartDate, "YYYY-MM-DD", singaporeTz).startOf("day").toDate();
+      const endOfDay = import_moment_timezone4.default.tz(normalizedEndDate, "YYYY-MM-DD", singaporeTz).endOf("day").toDate();
       query2.$expr = {
         $and: [
           { $gte: [{ $toDate: "$checkIn.timestamp" }, startOfDay] },
@@ -42433,7 +42539,7 @@ function useAttendanceRepository() {
       query2.$expr = {
         $gte: [
           { $toDate: "$checkIn.timestamp" },
-          import_moment_timezone3.default.tz(normalizedStartDate, "YYYY-MM-DD", singaporeTz).startOf("day").toDate()
+          import_moment_timezone4.default.tz(normalizedStartDate, "YYYY-MM-DD", singaporeTz).startOf("day").toDate()
         ]
       };
       cacheOptions.startDate = normalizedStartDate;
@@ -42441,7 +42547,7 @@ function useAttendanceRepository() {
       query2.$expr = {
         $lte: [
           { $toDate: "$checkIn.timestamp" },
-          import_moment_timezone3.default.tz(normalizedEndDate, "YYYY-MM-DD", singaporeTz).endOf("day").toDate()
+          import_moment_timezone4.default.tz(normalizedEndDate, "YYYY-MM-DD", singaporeTz).endOf("day").toDate()
         ]
       };
       cacheOptions.endDate = normalizedEndDate;
@@ -52159,6 +52265,16 @@ function useVisitorTransactionService() {
       );
       const isAutoApprovedInvitation = settings?.isAutoApprovedInvitation === true;
       value.checkIn = null;
+      if (!value.arrivalDate && value.expectedCheckIn) {
+        let timezone;
+        try {
+          const site = await _getSiteById(inviter?.site);
+          timezone = resolveSiteTimezone(site);
+        } catch {
+          timezone = resolveSiteTimezone(null);
+        }
+        value.arrivalDate = siteDayBounds(value.expectedCheckIn, timezone)?.date ?? null;
+      }
       const payload = {
         ...value,
         block: inviter?.block?.toString(),
@@ -52219,18 +52335,31 @@ function useVisitorTransactionService() {
     }
     try {
       session.startTransaction();
+      const refId = (value) => {
+        if (!value)
+          return void 0;
+        const id = typeof value === "object" && "_id" in value ? value._id : value;
+        return id ? String(id) : void 0;
+      };
       const memberPayload = {
-        block: lead.block ? String(lead.block) : void 0,
-        level: lead.level ? String(lead.level) : void 0,
-        unit: lead.unit ? String(lead.unit) : void 0,
-        unitName: lead.unitName,
-        org: lead.org ? String(lead.org) : void 0,
-        site: lead.site ? String(lead.site) : void 0,
+        block: refId(lead.block),
+        level: refId(lead.level),
+        unit: refId(lead.unit),
+        // The same $lookup leaves the unit's name on the joined object, which
+        // is the better source when the stored scalar is absent.
+        unitName: lead.unitName ?? lead.unit?.name,
+        org: refId(lead.org),
+        site: refId(lead.site),
         type: lead.type,
         contractorType: lead.contractorType,
         company: lead.company,
         purpose: lead.purpose,
         expectedCheckIn: lead.expectedCheckIn ? new Date(lead.expectedCheckIn).toISOString() : void 0,
+        // Carried so each member's QR is gated on the same calendar day as the
+        // lead's. Without it a member falls back to deriving the day from
+        // `expectedCheckIn`, which is the same answer today but drifts the
+        // moment the lead's day is edited.
+        arrivalDate: lead.arrivalDate,
         arrivalTime: lead.arrivalTime,
         duration: lead.duration,
         isOvernightParking: lead.isOvernightParking,
@@ -52322,7 +52451,7 @@ function useVisitorTransactionService() {
 
 // src/controllers/visitor-transaction.controller.ts
 var import_joi67 = __toESM(require("joi"));
-var import_moment_timezone4 = __toESM(require("moment-timezone"));
+var import_moment_timezone5 = __toESM(require("moment-timezone"));
 var import_mongodb88 = require("mongodb");
 var import_node_server_utils137 = require("@7365admin1/node-server-utils");
 
@@ -52330,6 +52459,15 @@ var import_node_server_utils137 = require("@7365admin1/node-server-utils");
 var import_joi66 = __toESM(require("joi"));
 var schemaInviteVisitor = import_joi66.default.object({
   expectedCheckIn: import_joi66.default.string().isoDate().required(),
+  // The calendar day the invitation is valid for, as the resident picked it.
+  // A bare YYYY-MM-DD carries no offset, so no conversion between the phone's
+  // zone and the site's can move it onto a neighbouring day - which is exactly
+  // what `expectedCheckIn` alone cannot guarantee. Optional so that already
+  // installed builds, which send only `expectedCheckIn`, keep working; the
+  // server falls back to deriving the day from it in the site's zone.
+  arrivalDate: import_joi66.default.string().pattern(/^\d{4}-\d{2}-\d{2}$/).optional().allow(null, "").messages({
+    "string.pattern.base": "arrivalDate must be in YYYY-MM-DD format (e.g. 2026-09-02)"
+  }),
   arrivalTime: import_joi66.default.string().pattern(/^([01]\d|2[0-3]):([0-5]\d)$/).optional().allow(null, "").messages({
     "string.pattern.base": "arrivalTime must be in HH:mm format (e.g. 09:30, 18:45)"
   }),
@@ -56398,7 +56536,7 @@ async function sendSelfServicePassEmail(record, occasion, remarks) {
   if (!to)
     return;
   const previewLink = `${APP_PROPERTY_MANAGEMENT}/public-view/visitor-onboarding/pass/${String(record._id ?? "")}`;
-  const arrivalDate = record.expectedCheckIn ? (0, import_moment_timezone4.default)(record.expectedCheckIn).format("DD/MM/YYYY") : "N/A";
+  const arrivalDate = record.expectedCheckIn ? (0, import_moment_timezone5.default)(record.expectedCheckIn).format("DD/MM/YYYY") : "N/A";
   const html = occasion === "rejected" ? compile_handlebars_default({
     handlebar: "self-service-visitor-rejected",
     context: {
@@ -56946,6 +57084,7 @@ function useVisitorTransactionController() {
     }
     const {
       expectedCheckIn,
+      arrivalDate,
       arrivalTime,
       duration,
       name,
@@ -56963,6 +57102,10 @@ function useVisitorTransactionController() {
     } = value;
     const rest = {
       expectedCheckIn,
+      // Fall back to the day `expectedCheckIn` lands on in the SITE's zone, so
+      // rows written by older builds still carry an explicit day. Resolved in
+      // the invite service, which is where the site id is known.
+      arrivalDate,
       arrivalTime,
       duration,
       name,
@@ -77362,7 +77505,7 @@ var import_mongodb147 = require("mongodb");
 var import_moment = __toESM(require("moment"));
 
 // src/utils/dashboard-metrics.util.ts
-var import_moment_timezone5 = __toESM(require("moment-timezone"));
+var import_moment_timezone6 = __toESM(require("moment-timezone"));
 var DASHBOARD_TIMEZONE = "Asia/Singapore";
 var PERIOD_UNITS = {
   thisWeek: { boundary: "isoWeek", step: "week" },
@@ -77373,7 +77516,7 @@ function unitsOf(period) {
   return PERIOD_UNITS[period] ?? DAY_UNIT;
 }
 function at(now) {
-  return now === void 0 || now === null ? import_moment_timezone5.default.tz(DASHBOARD_TIMEZONE) : import_moment_timezone5.default.tz(now, DASHBOARD_TIMEZONE);
+  return now === void 0 || now === null ? import_moment_timezone6.default.tz(DASHBOARD_TIMEZONE) : import_moment_timezone6.default.tz(now, DASHBOARD_TIMEZONE);
 }
 function getPeriodRange(period, now) {
   const { boundary } = unitsOf(period);
@@ -79107,7 +79250,7 @@ var import_node_server_utils238 = require("@7365admin1/node-server-utils");
 
 // src/utils/hrmlabs-attendance.util.ts
 var import_axios3 = __toESM(require("axios"));
-var import_moment_timezone6 = __toESM(require("moment-timezone"));
+var import_moment_timezone7 = __toESM(require("moment-timezone"));
 var default_early_checkIn = 4;
 async function hrmLabsAuthentication({
   authUrl,
@@ -79179,13 +79322,13 @@ function filterByShiftTime(attendance, shiftData, timezone, format2) {
   return attendance.filter((item) => {
     if (!item.checkIn)
       return false;
-    const checkInLocal = (0, import_moment_timezone6.default)(item.checkIn, format2);
+    const checkInLocal = (0, import_moment_timezone7.default)(item.checkIn, format2);
     if (!checkInLocal.isValid())
       return false;
     const [startHour, startMinute] = shiftData.checkIn.split(":").map(Number);
     const [endHour, endMinute] = shiftData.checkOut.split(":").map(Number);
-    const shiftStart = (0, import_moment_timezone6.default)(checkInLocal).set({ hour: startHour, minute: startMinute, second: 0, millisecond: 0 }).subtract(default_early_checkIn, "hour");
-    const shiftEnd = (0, import_moment_timezone6.default)(checkInLocal).set({
+    const shiftStart = (0, import_moment_timezone7.default)(checkInLocal).set({ hour: startHour, minute: startMinute, second: 0, millisecond: 0 }).subtract(default_early_checkIn, "hour");
+    const shiftEnd = (0, import_moment_timezone7.default)(checkInLocal).set({
       hour: endHour,
       minute: endMinute,
       second: 0,
@@ -79277,18 +79420,18 @@ function totalCountPerShift(attendance, shiftData, timezone, format2) {
     data = uniqueAttendanceData.filter((item) => {
       if (!item.checkIn)
         return false;
-      const checkInLocal = (0, import_moment_timezone6.default)(item.checkIn, format2);
+      const checkInLocal = (0, import_moment_timezone7.default)(item.checkIn, format2);
       if (!checkInLocal.isValid())
         return false;
       const [startHour, startMinute] = shift.checkIn.split(":").map(Number);
       const [endHour, endMinute] = shift.checkOut.split(":").map(Number);
-      const shiftStart = (0, import_moment_timezone6.default)(checkInLocal).set({
+      const shiftStart = (0, import_moment_timezone7.default)(checkInLocal).set({
         hour: startHour,
         minute: startMinute,
         second: 0,
         millisecond: 0
       }).subtract(default_early_checkIn, "hour");
-      const shiftEnd = (0, import_moment_timezone6.default)(checkInLocal).set({
+      const shiftEnd = (0, import_moment_timezone7.default)(checkInLocal).set({
         hour: endHour,
         minute: endMinute,
         second: 0,
@@ -79318,11 +79461,11 @@ function filterByStatus(attendance, shiftData, timezone, format2, status) {
   return attendance.filter((item) => {
     if (!item.checkIn)
       return false;
-    const checkInLocal = (0, import_moment_timezone6.default)(item.checkIn, format2);
+    const checkInLocal = (0, import_moment_timezone7.default)(item.checkIn, format2);
     if (!checkInLocal.isValid())
       return false;
     const [lateHour, lateMinute] = shiftData.lateCheckInAlert.split(":").map(Number);
-    const lateLoginTime = (0, import_moment_timezone6.default)(checkInLocal).set({
+    const lateLoginTime = (0, import_moment_timezone7.default)(checkInLocal).set({
       hour: lateHour,
       minute: lateMinute,
       second: 0,
@@ -79394,14 +79537,14 @@ async function totalCountPerStatus(attendance, shiftName, shiftData, timezone, f
       } = item;
       if (!checkInStr || seenGlobal.has(identificationNumber))
         continue;
-      const checkIn = (0, import_moment_timezone6.default)(checkInStr, format2);
-      const checkOut = checkOutStr ? (0, import_moment_timezone6.default)(checkOutStr, format2) : null;
-      const checkOutChecker = checkOut ? (0, import_moment_timezone6.default)(checkOutStr, format2) : checkIn;
+      const checkIn = (0, import_moment_timezone7.default)(checkInStr, format2);
+      const checkOut = checkOutStr ? (0, import_moment_timezone7.default)(checkOutStr, format2) : null;
+      const checkOutChecker = checkOut ? (0, import_moment_timezone7.default)(checkOutStr, format2) : checkIn;
       if (!checkIn.isValid())
         continue;
-      const shiftStart = (0, import_moment_timezone6.default)(checkIn).set({ ...shiftStartTime, second: 59, millisecond: 59 }).subtract(default_early_checkIn, "hour");
-      const shiftEnd = (0, import_moment_timezone6.default)(checkOutChecker).set({ ...shiftEndTime, second: 0, millisecond: 0 }).subtract(default_early_checkIn, "hour");
-      const lateCheckIn = (0, import_moment_timezone6.default)(checkIn).set({
+      const shiftStart = (0, import_moment_timezone7.default)(checkIn).set({ ...shiftStartTime, second: 59, millisecond: 59 }).subtract(default_early_checkIn, "hour");
+      const shiftEnd = (0, import_moment_timezone7.default)(checkOutChecker).set({ ...shiftEndTime, second: 0, millisecond: 0 }).subtract(default_early_checkIn, "hour");
+      const lateCheckIn = (0, import_moment_timezone7.default)(checkIn).set({
         ...lateTime,
         second: 59,
         millisecond: 59
@@ -79439,8 +79582,8 @@ async function chartCountData(attendance, shiftData, timezone, format2, totalShi
     const [hour, minute] = timeStr.split(":").map(Number);
     return { hour, minute };
   };
-  const startDate = (0, import_moment_timezone6.default)(startDateStr, "DD-MM-YYYY");
-  const endDate = (0, import_moment_timezone6.default)(endDateStr, "DD-MM-YYYY");
+  const startDate = (0, import_moment_timezone7.default)(startDateStr, "DD-MM-YYYY");
+  const endDate = (0, import_moment_timezone7.default)(endDateStr, "DD-MM-YYYY");
   const daysInRange = [];
   for (let day = startDate.clone(); day.isSameOrBefore(endDate); day.add(1, "day")) {
     daysInRange.push(day.format("DD-MM-YYYY"));
@@ -79511,7 +79654,7 @@ async function chartCountData(attendance, shiftData, timezone, format2, totalShi
           } = item;
           if (!checkInStr)
             continue;
-          const checkIn = (0, import_moment_timezone6.default)(checkInStr, format2);
+          const checkIn = (0, import_moment_timezone7.default)(checkInStr, format2);
           if (!checkIn.isValid())
             continue;
           const dayKey = `${identificationNumber}-${checkIn.format(
@@ -79520,10 +79663,10 @@ async function chartCountData(attendance, shiftData, timezone, format2, totalShi
           if (seenPerDay.has(dayKey))
             continue;
           seenPerDay.add(dayKey);
-          const checkOut = checkOutStr ? (0, import_moment_timezone6.default)(checkOutStr, format2) : checkIn;
-          const shiftStart = (0, import_moment_timezone6.default)(checkIn).set({ ...shiftStartTime, second: 59, millisecond: 59 }).subtract(default_early_checkIn, "hour");
-          const shiftEnd = (0, import_moment_timezone6.default)(checkOut).set({ ...shiftEndTime, second: 0, millisecond: 0 }).subtract(default_early_checkIn, "hour");
-          const lateCheckIn = (0, import_moment_timezone6.default)(checkIn).set({
+          const checkOut = checkOutStr ? (0, import_moment_timezone7.default)(checkOutStr, format2) : checkIn;
+          const shiftStart = (0, import_moment_timezone7.default)(checkIn).set({ ...shiftStartTime, second: 59, millisecond: 59 }).subtract(default_early_checkIn, "hour");
+          const shiftEnd = (0, import_moment_timezone7.default)(checkOut).set({ ...shiftEndTime, second: 0, millisecond: 0 }).subtract(default_early_checkIn, "hour");
+          const lateCheckIn = (0, import_moment_timezone7.default)(checkIn).set({
             ...lateTime,
             second: 59,
             millisecond: 59
@@ -79826,7 +79969,7 @@ var MManpowerRemarks = class {
 
 // src/repositories/manpower-remarks.repo.ts
 var import_mongodb151 = require("mongodb");
-var import_moment_timezone7 = __toESM(require("moment-timezone"));
+var import_moment_timezone8 = __toESM(require("moment-timezone"));
 function useManpowerRemarksRepo() {
   const db2 = import_node_server_utils239.useAtlas.getDb();
   if (!db2) {
@@ -79880,7 +80023,7 @@ function useManpowerRemarksRepo() {
       page = page ? page - 1 : 0;
       limit = limit || 10;
       const searchQuery = {};
-      const nowSGT = (0, import_moment_timezone7.default)().tz("Asia/Singapore");
+      const nowSGT = (0, import_moment_timezone8.default)().tz("Asia/Singapore");
       searchQuery.serviceProviderId = new import_mongodb151.ObjectId(serviceProviderId);
       if (search != "") {
         searchQuery.siteName = { $regex: search, $options: "i" };
@@ -79992,7 +80135,7 @@ function useManpowerRemarksRepo() {
 }
 
 // src/services/manpower-monitoring.service.ts
-var import_moment_timezone8 = __toESM(require("moment-timezone"));
+var import_moment_timezone9 = __toESM(require("moment-timezone"));
 function useManpowerMonitoringSrvc() {
   const {
     createManpowerMonitoringSettings: _createManpowerMonitoringSettings
@@ -80010,10 +80153,10 @@ function useManpowerMonitoringSrvc() {
     const morningAlertFrequencyMins = payload?.shifts?.[payload.shiftType][0]?.alertFrequencyMins;
     const afternoonAlertFrequencyMins = payload.shiftType == "3-shifts" ? payload?.shifts?.[payload.shiftType][1]?.alertFrequencyMins : null;
     const nightAlertFrequencyMins = payload.shiftType == "3-shifts" ? payload?.shifts?.[payload.shiftType][2]?.alertFrequencyMins : payload?.shifts?.[payload.shiftType][1]?.alertFrequencyMins;
-    const morningAlertTime = import_moment_timezone8.default.tz(morningCheckInTime, "HH:mm", "Asia/Singapore").add(morningAlertFrequencyMins, "minutes").format("HH:mm");
-    const afternoonAlertTime = afternoonCheckInTime ? import_moment_timezone8.default.tz(afternoonCheckInTime, "HH:mm", "Asia/Singapore").add(afternoonAlertFrequencyMins, "minutes").format("HH:mm") : "";
-    const nightAlertTime = import_moment_timezone8.default.tz(nightCheckInTime, "HH:mm", "Asia/Singapore").add(nightAlertFrequencyMins, "minutes").format("HH:mm");
-    const nowSGT = (0, import_moment_timezone8.default)().tz("Asia/Singapore");
+    const morningAlertTime = import_moment_timezone9.default.tz(morningCheckInTime, "HH:mm", "Asia/Singapore").add(morningAlertFrequencyMins, "minutes").format("HH:mm");
+    const afternoonAlertTime = afternoonCheckInTime ? import_moment_timezone9.default.tz(afternoonCheckInTime, "HH:mm", "Asia/Singapore").add(afternoonAlertFrequencyMins, "minutes").format("HH:mm") : "";
+    const nightAlertTime = import_moment_timezone9.default.tz(nightCheckInTime, "HH:mm", "Asia/Singapore").add(nightAlertFrequencyMins, "minutes").format("HH:mm");
+    const nowSGT = (0, import_moment_timezone9.default)().tz("Asia/Singapore");
     try {
       const remarksPayload = {
         siteId: payload.siteId,
@@ -82385,7 +82528,7 @@ function useManpowerSitesCtrl() {
 // src/utils/cron.util.ts
 var import_node_server_utils256 = require("@7365admin1/node-server-utils");
 var import_mongodb156 = require("mongodb");
-var import_moment_timezone9 = __toESM(require("moment-timezone"));
+var import_moment_timezone10 = __toESM(require("moment-timezone"));
 var createManpowerRemarksDaily = async () => {
   const db2 = import_node_server_utils256.useAtlas.getDb();
   if (!db2) {
@@ -82396,9 +82539,9 @@ var createManpowerRemarksDaily = async () => {
   const remarks = db2.collection("manpower-remarks");
   const serviceProviders = db2.collection("site.service-providers");
   const items = [];
-  const yesterday = (0, import_moment_timezone9.default)().tz("Asia/Singapore").subtract(1, "days").format("DD-MM-YYYY");
+  const yesterday = (0, import_moment_timezone10.default)().tz("Asia/Singapore").subtract(1, "days").format("DD-MM-YYYY");
   try {
-    const nowSGT = (0, import_moment_timezone9.default)().tz("Asia/Singapore");
+    const nowSGT = (0, import_moment_timezone10.default)().tz("Asia/Singapore");
     const servideProvider = await serviceProviders.findOne({
       name: { $regex: process.env.HRMLABS_DOMAIN, $options: "i" }
     });
@@ -82436,9 +82579,9 @@ var createManpowerRemarksDaily = async () => {
         const morningAlertFrequencyMins = setting?.shifts?.[shiftType][0]?.alertFrequencyMins;
         const afternoonAlertFrequencyMins = shiftType == "3-shifts" ? setting?.shifts?.[shiftType][1]?.alertFrequencyMins : null;
         const nightAlertFrequencyMins = shiftType == "3-shifts" ? setting?.shifts?.[shiftType][2]?.alertFrequencyMins : setting?.shifts?.[shiftType][1]?.alertFrequencyMins;
-        const morningAlertTime = import_moment_timezone9.default.tz(morningCheckInTime, "HH:mm", "Asia/Singapore").add(morningAlertFrequencyMins, "minutes").format("HH:mm");
-        const afternoonAlertTime = afternoonCheckInTime ? import_moment_timezone9.default.tz(afternoonCheckInTime, "HH:mm", "Asia/Singapore").add(afternoonAlertFrequencyMins, "minutes").format("HH:mm") : "";
-        const nightAlertTime = import_moment_timezone9.default.tz(nightCheckInTime, "HH:mm", "Asia/Singapore").add(nightAlertFrequencyMins, "minutes").format("HH:mm");
+        const morningAlertTime = import_moment_timezone10.default.tz(morningCheckInTime, "HH:mm", "Asia/Singapore").add(morningAlertFrequencyMins, "minutes").format("HH:mm");
+        const afternoonAlertTime = afternoonCheckInTime ? import_moment_timezone10.default.tz(afternoonCheckInTime, "HH:mm", "Asia/Singapore").add(afternoonAlertFrequencyMins, "minutes").format("HH:mm") : "";
+        const nightAlertTime = import_moment_timezone10.default.tz(nightCheckInTime, "HH:mm", "Asia/Singapore").add(nightAlertFrequencyMins, "minutes").format("HH:mm");
         const remark2 = {
           siteId: site.siteId,
           siteName: site.siteName,
@@ -82495,14 +82638,14 @@ var createManpowerRemarksDaily = async () => {
 };
 var updateRemarksisAcknowledged = async () => {
   const { getAttendanceDataCount: _getAttendanceDataCount } = useHrmLabsAttendanceSrvc();
-  const nowSGT = (0, import_moment_timezone9.default)().tz("Asia/Singapore").format("DD-MM-YYYY");
+  const nowSGT = (0, import_moment_timezone10.default)().tz("Asia/Singapore").format("DD-MM-YYYY");
   const db2 = import_node_server_utils256.useAtlas.getDb();
   if (!db2) {
     throw new Error("Unable to connect to server.");
   }
   const namespace_collection = "manpower-remarks";
   const remarks = db2.collection(namespace_collection);
-  const timeNow = (0, import_moment_timezone9.default)().tz("Asia/Singapore").format("HH:mm");
+  const timeNow = (0, import_moment_timezone10.default)().tz("Asia/Singapore").format("HH:mm");
   const settings = db2.collection("manpower-settings");
   try {
     const matchingDocs = await remarks.find({
@@ -82630,9 +82773,9 @@ var updateRemarksStatusEod = async () => {
   }
   const remarks = db2.collection("manpower-remarks");
   const settings = db2.collection("manpower-settings");
-  const nowSGT = (0, import_moment_timezone9.default)().tz("Asia/Singapore").format("DD-MM-YYYY");
-  const yesterdaySGT = (0, import_moment_timezone9.default)().tz("Asia/Singapore").subtract(1, "days").format("DD-MM-YYYY");
-  const timeNow = (0, import_moment_timezone9.default)().tz("Asia/Singapore").format("HH:mm");
+  const nowSGT = (0, import_moment_timezone10.default)().tz("Asia/Singapore").format("DD-MM-YYYY");
+  const yesterdaySGT = (0, import_moment_timezone10.default)().tz("Asia/Singapore").subtract(1, "days").format("DD-MM-YYYY");
+  const timeNow = (0, import_moment_timezone10.default)().tz("Asia/Singapore").format("HH:mm");
   const docs = await remarks.find({
     $or: [
       // Morning & Afternoon from today
@@ -82768,7 +82911,7 @@ var isWithinHour = (alertTime, timeNow) => {
 // src/events/manpower.event.ts
 var import_node_server_utils257 = require("@7365admin1/node-server-utils");
 var import_mongodb157 = require("mongodb");
-var import_moment_timezone10 = __toESM(require("moment-timezone"));
+var import_moment_timezone11 = __toESM(require("moment-timezone"));
 async function manpowerEvents(io) {
   let intervalId = null;
   let activeConnections = 0;
@@ -82780,9 +82923,9 @@ async function manpowerEvents(io) {
     }
     const remarks = db2.collection("manpower-remarks");
     const settings = db2.collection("manpower-settings");
-    const selectedDateMoment = import_moment_timezone10.default.tz(date, "DD-MM-YYYY", "Asia/Singapore");
+    const selectedDateMoment = import_moment_timezone11.default.tz(date, "DD-MM-YYYY", "Asia/Singapore");
     const selectedDateSGT = selectedDateMoment.format("DD-MM-YYYY");
-    const currentSGT = (0, import_moment_timezone10.default)().tz("Asia/Singapore");
+    const currentSGT = (0, import_moment_timezone11.default)().tz("Asia/Singapore");
     const docs = await remarks.find({
       createdAtSGT: selectedDateSGT,
       $or: [
@@ -82804,7 +82947,7 @@ async function manpowerEvents(io) {
       }
       if (currentSGT.isSame(selectedDateMoment, "day")) {
         if (currentSGT.isSameOrAfter(
-          import_moment_timezone10.default.tz("19:55", "HH:mm", "Asia/Singapore")
+          import_moment_timezone11.default.tz("19:55", "HH:mm", "Asia/Singapore")
         )) {
           shiftsToCheck.push({ index: 2, key: "nightShift" });
         }
@@ -91258,6 +91401,7 @@ function useNotificationPreferenceController() {
   CameraType,
   ConsoleAuditAction,
   ConsoleAuditTarget,
+  DEFAULT_SITE_TIMEZONE,
   DEVICE_STATUS,
   DOBStatus,
   DUPLICATE_TERMS_VERSION_MESSAGE,
@@ -91512,6 +91656,7 @@ function useNotificationPreferenceController() {
   isSafeRelativePath,
   isSuperAdmin,
   isTermsCurrent,
+  isValidTimezone,
   manpowerDesignationsSchema,
   manpowerEvents,
   manpowerMonitoringSchema,
@@ -91531,6 +91676,7 @@ function useNotificationPreferenceController() {
   occurrence_book_namespace_collection,
   online_forms_namespace_collection,
   orgSchema,
+  orgSiteScope,
   overnight_parking_requests_namespace_collection,
   parseCameraChannel,
   parseCameraHost,
@@ -91564,6 +91710,7 @@ function useNotificationPreferenceController() {
   resolveDeviceHttp,
   resolveHidPhysicalCardValue,
   resolveInviteActor,
+  resolveSiteTimezone,
   robotSchema,
   rtspUrl,
   schema,
@@ -91720,6 +91867,7 @@ function useNotificationPreferenceController() {
   sessionSchema,
   setIO,
   shiftSchema,
+  siteDayBounds,
   siteSchema,
   site_people_namespace_collection,
   snapshotEndpoint,