@happyvertical/smrt-timesheets 0.55.7 → 0.55.9

package/dist/index.js

@@ -1,8 +1,8 @@
-import { a as validateDurationHours, i as ServiceTimeEntryCollection, n as SERVICE_TIME_ENTRY_FROZEN_FIELDS, r as ServiceTimeEntry, t as SERVICE_DURATION_HOURS_EVIDENCE } from "./chunks/service-time-entry-BgvjPHTB.js";
-import { a as AttendanceReplay, i as AttendancePunchCollection, n as AttendanceBreakCollection, o as AttendanceReplayCollection, r as AttendancePunch, t as AttendanceBreak } from "./chunks/models-BO5bsZHw.js";
+import { a as validateDurationHours, i as ServiceTimeEntryCollection, n as SERVICE_TIME_ENTRY_FROZEN_FIELDS, r as ServiceTimeEntry, t as SERVICE_DURATION_HOURS_EVIDENCE } from "./chunks/service-time-entry-CyOH_lNy.js";
+import { a as AttendanceReplay, i as AttendancePunchCollection, n as AttendanceBreakCollection, o as AttendanceReplayCollection, r as AttendancePunch, t as AttendanceBreak } from "./chunks/models-BUY_DX-t.js";
 import { SERVICE_TIME_ENTRY_STATUS_TRANSITIONS } from "./types.js";
 import { AttendanceConflict, AttendanceService } from "./attendance.js";
-import { a as PeriodTimecard, c as TimecardAdjustmentCollection, o as PeriodTimecardCollection, s as TimecardAdjustment, t as PeriodRollupService } from "./chunks/rollup-BUbDKkHe.js";
+import { a as PeriodTimecard, c as TimecardAdjustmentCollection, o as PeriodTimecardCollection, s as TimecardAdjustment, t as PeriodRollupService } from "./chunks/rollup-CDEujV25.js";
 import { TIMESHEETS_MODULE_META, TIMESHEETS_UI_SLOTS } from "./ui.js";
 import { SmrtCollection, SmrtObject, ValidationError, field, foreignKey, smrt } from "@happyvertical/smrt-core";
 import { TenantScoped, tenantId } from "@happyvertical/smrt-tenancy";

package/dist/manifest.json

@@ -2,7 +2,7 @@
   "version": "1.0.0",
   "timestamp": 0,
   "packageName": "@happyvertical/smrt-timesheets",
-  "packageVersion": "0.55.7",
+  "packageVersion": "0.55.9",
   "objects": {
     "@happyvertical/smrt-timesheets:AttendancePunch": {
       "name": "attendancepunch",
@@ -3363,5 +3363,15 @@
     "@happyvertical/smrt-core",
     "@happyvertical/smrt-tenancy"
   ],
+  "browser": {
+    "status": "server-only",
+    "issues": [
+      "#3624"
+    ],
+    "reason": "node:crypto",
+    "via": [
+      "@happyvertical/smrt-tenancy"
+    ]
+  },
   "stampsConstructors": true
 }

package/dist/rollup.js

@@ -1,2 +1,2 @@
-import { a as PeriodTimecard, c as TimecardAdjustmentCollection, o as PeriodTimecardCollection, s as TimecardAdjustment, t as PeriodRollupService } from "./chunks/rollup-BUbDKkHe.js";
+import { a as PeriodTimecard, c as TimecardAdjustmentCollection, o as PeriodTimecardCollection, s as TimecardAdjustment, t as PeriodRollupService } from "./chunks/rollup-CDEujV25.js";
 export { PeriodRollupService, PeriodTimecard, PeriodTimecardCollection, TimecardAdjustment, TimecardAdjustmentCollection };

package/dist/smrt-knowledge.json

@@ -3,12 +3,12 @@
   "sensitiveFieldsExcluded": true,
   "generatedAt": "1970-01-01T00:00:00.000Z",
   "packageName": "@happyvertical/smrt-timesheets",
-  "packageVersion": "0.55.7",
+  "packageVersion": "0.55.9",
   "sourceManifestPath": "dist/manifest.json",
   "agentDocPath": "AGENTS.md",
   "sourceHashes": {
-    "manifest": "6d9d4ed76849f9d425eb167f9764284d1e17c2b90c377ffcd9c2444f8f34fc01",
-    "packageJson": "b70bf71da216769b64f6ae7ab0aaff1a87e3f9242b530b9e7c087abc59b99761",
+    "manifest": "b3ca503a3cc91c8b9e4b8cb75b679c5f764d3ccd0114c151c1b6814add51e0b5",
+    "packageJson": "1c17f42e91d724b1573f006607243258b138c9adaee77db8718c2a60c629dc54",
     "agents": "46a4e8437424b494645e90ce4a4869be04956c5da6a42f89697cbd3ab2199a7e",
     "moduleDoc:agents/period-rollup.md": "5fb741659d81dbef2e4850c10c2d65f09e3f5a83e8a88e2e0f19585f25158a6a"
   },
@@ -1937,5 +1937,15 @@
       "module": "period-rollup",
       "content": "# Period timecards\n\n`@happyvertical/smrt-timesheets/rollup` exports `PeriodRollupService`,\n`PeriodTimecard`, `TimecardAdjustment`, their collections, and resolver types.\nThe package root also exports them. SQLite and PostgreSQL are supported.\nCreate application tables through normal migrations; neither service provisions\nschema. The attendance option additionally requires the attendance tables.\n\nConstruct a service only after authenticating and authorizing its trusted\n`{ tenantId, profileId }` scope. A conflicting ambient tenant is rejected.\n`options.actorProfileId` records a separately authorized supervisor; it defaults\nto the subject profile for self confirmation/correction. Never accept this\ntrusted scope or attribution unchecked from request input. Profile authorization\nis consumer-owned; the service filters every source/card/adjustment read by its\ntrusted subject and tenant. Generic API, CLI and MCP surfaces are closed by\ndefault; consumer registry overrides may further restrict them (#3318).\n\n## Resolver contract\n\n`periodFor(at, actor)` supplies half-open UTC `startsAt`/`endsAt`, an IANA\n`timezone`, a nonempty policy `version`, and a JSON `rules` snapshot.\nThe consumer owns period length, calendar start day, timezone and DST, overtime\nthresholds, holidays and classification. The requested instant must be inside\nthe window. Overlapping windows for existing cards are rejected: introduce a new\ncalendar at a boundary after existing windows, and use adjustments for already\nconfirmed periods.\n\n`classify(period, sources, actor)` returns nonnegative safe integer\n`regularSeconds` and `overtimeSeconds`, whose sum must equal source seconds.\nInputs are detached so resolver mutation cannot rewrite evidence. Resolver\nexceptions, malformed windows, invalid timezone, fractional/unsafe totals and\nnonconserving classification abort the transaction. No Alberta or other\njurisdiction rule is assumed, and no pay rate or money is stored.\n\nA configurable UTC calendar example (illustrative policy, not payroll advice):\n\n```ts\nimport { PeriodRollupService, type PeriodRulesResolver } from\n  '@happyvertical/smrt-timesheets/rollup';\n\nconst settings = {\n  lengthDays: 14, startDay: 1, timezone: 'UTC', // 0 = Sunday\n  anchor: '2026-01-05T00:00:00Z', // aligned Monday; anchors fortnight phase\n  thresholdSeconds: 80 * 3600,\n  holidays: ['2026-12-25'],\n};\nconst resolver: PeriodRulesResolver = {\n  async periodFor(at) {\n    const anchor = new Date(settings.anchor);\n    if (anchor.getUTCDay() !== settings.startDay || settings.timezone !== 'UTC')\n      throw new Error('Use a timezone-aware calendar resolver for local periods');\n    const length = settings.lengthDays * 86400000;\n    const start = anchor.getTime() +\n      Math.floor((at.getTime() - anchor.getTime()) / length) * length;\n    return {\n      startsAt: new Date(start), endsAt: new Date(start + length),\n      timezone: settings.timezone, version: 'shop-policy-v1', rules: settings,\n    };\n  },\n  async classify(period, sources) {\n    const rules = period.rules as typeof settings;\n    // This example assigns a contribution to its clipped start's UTC date.\n    // Local daily rules should split contributions at their own local midnight.\n    let regular = 0;\n    let holiday = 0;\n    for (const source of sources) {\n      if (rules.holidays.includes(source.startsAt.slice(0, 10))) holiday += source.seconds;\n      else regular += source.seconds;\n    }\n    return {\n      regularSeconds: Math.min(regular, rules.thresholdSeconds),\n      overtimeSeconds: holiday + Math.max(0, regular - rules.thresholdSeconds),\n    };\n  },\n};\nconst rollups = new PeriodRollupService(db, authorizedSubject, resolver,\n  { attendance: true, actorProfileId: authenticatedSupervisorProfileId });\nconst card = await rollups.rollup(new Date());\nawait rollups.confirm(card.id!);\nawait rollups.adjust(card.id!, {\n  operationId: requestId, regularSeconds: 900, overtimeSeconds: 0,\n  reason: 'Approved correction after confirmation',\n});\nconst effectiveSeconds = await rollups.totals(card.id!);\n```\n\nA timezone-aware resolver must compute each local boundary separately: a local\nday crossing DST is not necessarily 86400 seconds. Resolvers can use an app's\nexisting calendar library; no new timezone dependency or implicit default is\nintroduced here.\n\n## Evidence and immutability\n\nDecimal-hours-only entries have no measured integer seconds. The seconds-only\nrollup rejects these sources explicitly when their approval instant falls in the\nrequested period; it never rounds them or counts null as\nzero. Use an hours-aware consumer policy for that source representation.\n\nOnly approved human `ServiceTimeEntry` rows for the subject count; corrected\nancestors do not. Correction chains must remain within that subject/tenant and\npoint to corrected parents. Multiple approved descendants of one root are\nrejected as ambiguous rather than double-counted. Entries with both `startedAt`\nand `endedAt` allocate their declared seconds\nproportionally across the period using exact integer prefix division, preserving\nseconds over adjacent periods. Unbounded entries count at `startedAt`, or, when\nabsent, `approvedAt`; an end-only timestamp does not create an interval. Missing\nboth attribution timestamps is an error. This is time attribution, not a\nclaim that a manual entry has a continuous wall-clock duration.\n\nWith `attendance: true`, closed punches without `reviewRequired` count, excluding\nunpaid breaks and retaining paid breaks. Open/review-required punches do not\ncount. Linked attendance is authoritative: its evidence entry and any approved\ncorrection descendants are excluded, including when the punch is still under\nreview or outside the requested period. Unlinked approved work entries and\nattendance both count; consumers must link overlapping evidence explicitly.\nSource snapshots preserve each paid attendance segment and entry identity.\n\nRepeated rollup updates one open card per tenant/person/start; a confirmed card\ncannot be recomputed. Confirmation is attributed and idempotent. Model save,\ncollection create/update/upsert and object/collection delete cannot bypass the\nservice. Model mutation capabilities are per-instance and not exported.\nDirect SQL is a trusted administrative boundary, not an exposed application API.\nProfile/card foreign keys restrict deletion to preserve history.\n\nAdjustments contain signed integer regular/overtime deltas, reason, operation\nkey and actor attribution. A retry reuses its row only for the exact same\npayload and actor. Effective totals may never become negative or unsafe.\nAdjustments never alter the confirmed row or source snapshot. Undo an adjustment\nwith a separately attributed compensating adjustment, never deletion.\n\nAll service mutations use a root transaction, transaction-bound collections,\nembedded writer serialization or a PostgreSQL tenant/person advisory lock.\nOutputs are reloaded on the root executor after commit. Rollup reads are an\napplication snapshot: subsequent source approvals/corrections appear on the\nnext open rollup, and confirmed cards require explicit adjustments.\n"
     }
-  ]
+  ],
+  "browser": {
+    "status": "server-only",
+    "issues": [
+      "#3624"
+    ],
+    "reason": "node:crypto",
+    "via": [
+      "@happyvertical/smrt-tenancy"
+    ]
+  }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyvertical/smrt-timesheets",
-  "version": "0.55.7",
+  "version": "0.55.9",
   "smrtJsdoc": "strict",
   "description": "Shared time entries for the SMRT framework: who worked how long on what, approval and correction, with immutable charge and compensation snapshots",
   "type": "module",
@@ -39,11 +39,11 @@
     }
   },
   "dependencies": {
-    "@happyvertical/smrt-core": "0.55.7",
-    "@happyvertical/smrt-tenancy": "0.55.7",
-    "@happyvertical/smrt-types": "0.55.7",
-    "@happyvertical/smrt-ui": "0.55.7",
-    "@happyvertical/sql": "^0.102.5"
+    "@happyvertical/smrt-core": "0.55.9",
+    "@happyvertical/smrt-tenancy": "0.55.9",
+    "@happyvertical/smrt-types": "0.55.9",
+    "@happyvertical/smrt-ui": "0.55.9",
+    "@happyvertical/sql": "^0.103.1"
   },
   "peerDependencies": {
     "svelte": "^5.57.0"
@@ -54,7 +54,7 @@
     }
   },
   "devDependencies": {
-    "@happyvertical/smrt-vitest": "0.55.7",
+    "@happyvertical/smrt-vitest": "0.55.9",
     "@sveltejs/package": "^2.5.8",
     "@sveltejs/vite-plugin-svelte": "^7.3.0",
     "@types/node": "24.13.6",