@kernhq/module-hr 0.2.0 → 0.3.0

package/dist/server/services/ledger.js

@@ -0,0 +1,178 @@
+import { KernError, uuidv7 } from '@kernhq/kernel';
+import { and, eq, inArray, sql } from 'drizzle-orm';
+import { leaveBalanceCursor, leaveLedger, leaveRequestDays, leaveTypes } from '../schema.js';
+/** A minute count in whatever unit the type displays. Hours to one place, days to two. */
+export const toUnit = (minutes, unit) => unit === 'hour' ? Math.round((minutes / 60) * 10) / 10 : Math.round((minutes / (60 * 8)) * 100) / 100;
+/** Minutes in one working day. A constant here; a policy in Phase 4, per contract. */
+export const MINUTES_PER_DAY = 8 * 60;
+export class LedgerService {
+    /**
+     * Balances for one person, per leave type.
+     *
+     * Summed from the ledger rather than read from the cursor: the cursor exists to be locked, and a
+     * cache that is also the source of truth is a cache that eventually disagrees with it. The sum is
+     * one indexed aggregate over a person's own rows, which is small.
+     */
+    async balances(tx, workspaceId, personId, periodYear) {
+        const types = await tx
+            .select()
+            .from(leaveTypes)
+            .where(and(eq(leaveTypes.workspaceId, workspaceId), sql `${leaveTypes.archivedAt} is null`));
+        const sums = await tx
+            .select({
+            leaveTypeId: leaveLedger.leaveTypeId,
+            total: sql `coalesce(sum(${leaveLedger.amountMinutes}), 0)::int`,
+        })
+            .from(leaveLedger)
+            .where(and(eq(leaveLedger.workspaceId, workspaceId), eq(leaveLedger.personId, personId), eq(leaveLedger.periodYear, periodYear)))
+            .groupBy(leaveLedger.leaveTypeId);
+        const byType = new Map(sums.map((r) => [r.leaveTypeId, Number(r.total)]));
+        // Pending requests are not spent, but they are not available either — showing a balance that
+        // ignores them is how somebody books the same day twice and only finds out at approval.
+        const pending = await tx
+            .select({
+            leaveTypeId: sql `lr.leave_type_id`,
+            status: sql `lr.status`,
+            minutes: sql `coalesce(sum(lr.minutes), 0)::int`,
+        })
+            .from(sql `${leaveRequestDays} d join mod_hr.leave_requests lr on lr.id = d.request_id`)
+            .where(sql `d.workspace_id = ${workspaceId} and d.person_id = ${personId}
+            and lr.status in ('pending','approved')`)
+            .groupBy(sql `lr.leave_type_id, lr.status`);
+        const pendingBy = new Map();
+        const bookedBy = new Map();
+        for (const row of pending) {
+            const target = row.status === 'approved' ? bookedBy : pendingBy;
+            target.set(row.leaveTypeId, (target.get(row.leaveTypeId) ?? 0) + Number(row.minutes));
+        }
+        return types.map((type) => {
+            const balanceMinutes = byType.get(type.id) ?? 0;
+            const pendingMinutes = pendingBy.get(type.id) ?? 0;
+            return {
+                personId,
+                leaveTypeId: type.id,
+                leaveTypeName: type.name,
+                unit: type.unit,
+                periodYear,
+                balanceMinutes,
+                bookedMinutes: bookedBy.get(type.id) ?? 0,
+                pendingMinutes,
+                availableMinutes: balanceMinutes - pendingMinutes,
+                balance: toUnit(balanceMinutes, type.unit),
+                available: toUnit(balanceMinutes - pendingMinutes, type.unit),
+            };
+        });
+    }
+    /**
+     * Take the lock for one person and leave type, creating the cursor row if it is missing.
+     *
+     * Everything that *spends* balance must call this first, inside the same transaction. It returns
+     * the balance as of the moment the lock was acquired, which is the only balance safe to decide on.
+     */
+    async lockAndRead(tx, workspaceId, personId, leaveTypeId, periodYear) {
+        await tx
+            .insert(leaveBalanceCursor)
+            .values({ id: uuidv7(), workspaceId, personId, leaveTypeId, periodYear })
+            .onConflictDoNothing();
+        await tx.execute(sql `
+      select 1 from ${leaveBalanceCursor}
+       where workspace_id = ${workspaceId}
+         and person_id = ${personId}
+         and leave_type_id = ${leaveTypeId}
+         and period_year = ${periodYear}
+         for update
+    `);
+        const [row] = await tx
+            .select({ total: sql `coalesce(sum(${leaveLedger.amountMinutes}), 0)::int` })
+            .from(leaveLedger)
+            .where(and(eq(leaveLedger.workspaceId, workspaceId), eq(leaveLedger.personId, personId), eq(leaveLedger.leaveTypeId, leaveTypeId), eq(leaveLedger.periodYear, periodYear)));
+        return Number(row?.total ?? 0);
+    }
+    /** Append an entry. The only way anything enters the ledger. */
+    async append(tx, workspaceId, entry) {
+        const [row] = await tx
+            .insert(leaveLedger)
+            .values({ id: uuidv7(), workspaceId, ...entry })
+            .returning();
+        await tx
+            .update(leaveBalanceCursor)
+            .set({
+            cachedBalanceMinutes: sql `${leaveBalanceCursor.cachedBalanceMinutes} + ${entry.amountMinutes}`,
+            asOfEntryId: row.id,
+            version: sql `${leaveBalanceCursor.version} + 1`,
+            updatedAt: new Date(),
+        })
+            .where(and(eq(leaveBalanceCursor.workspaceId, workspaceId), eq(leaveBalanceCursor.personId, entry.personId), eq(leaveBalanceCursor.leaveTypeId, entry.leaveTypeId), eq(leaveBalanceCursor.periodYear, entry.periodYear)));
+        return row;
+    }
+    /**
+     * Undo an entry by writing its opposite.
+     *
+     * Never a delete and never an update. A cancelled request has to leave both the consumption and
+     * the reversal visible, because "she booked it and then cancelled" and "she never booked it" are
+     * different facts and only one of them is true.
+     */
+    async reverse(tx, workspaceId, entryId, reason, actorId, on) {
+        const [original] = await tx
+            .select()
+            .from(leaveLedger)
+            .where(and(eq(leaveLedger.workspaceId, workspaceId), eq(leaveLedger.id, entryId)))
+            .limit(1);
+        if (!original)
+            throw KernError.notFound('Ledger entry');
+        const [already] = await tx
+            .select({ id: leaveLedger.id })
+            .from(leaveLedger)
+            .where(and(eq(leaveLedger.workspaceId, workspaceId), eq(leaveLedger.reversesEntryId, entryId)))
+            .limit(1);
+        // Reversing twice would credit the balance twice. The check is here rather than in a constraint
+        // because a partial unique index on a nullable column is easy to get subtly wrong, and this
+        // path is always inside a transaction that already holds the cursor lock.
+        if (already)
+            throw KernError.conflict('That entry has already been reversed');
+        return this.append(tx, workspaceId, {
+            personId: original.personId,
+            leaveTypeId: original.leaveTypeId,
+            kind: 'reversal',
+            amountMinutes: -original.amountMinutes,
+            effectiveOn: on,
+            periodYear: original.periodYear,
+            requestId: original.requestId,
+            reversesEntryId: original.id,
+            reason,
+            createdBy: actorId,
+        });
+    }
+    /** Every entry a request produced, for cancelling it. */
+    async entriesFor(tx, workspaceId, requestId) {
+        return tx
+            .select()
+            .from(leaveLedger)
+            .where(and(eq(leaveLedger.workspaceId, workspaceId), eq(leaveLedger.requestId, requestId)));
+    }
+    /** Rebuild every cursor from the ledger. Cheap insurance after a bulk import or a bad migration. */
+    async rebuildCursors(tx, workspaceId, personIds) {
+        if (!personIds.length)
+            return;
+        await tx.execute(sql `
+      update ${leaveBalanceCursor} c
+         set cached_balance_minutes = coalesce(s.total, 0),
+             version = c.version + 1,
+             updated_at = now()
+        from (
+          select person_id, leave_type_id, period_year, sum(amount_minutes)::int as total
+            from ${leaveLedger}
+           where workspace_id = ${workspaceId}
+             and person_id in (${sql.join(personIds.map((p) => sql `${p}`), sql `, `)})
+           group by 1, 2, 3
+        ) s
+       where c.workspace_id = ${workspaceId}
+         and c.person_id = s.person_id
+         and c.leave_type_id = s.leave_type_id
+         and c.period_year = s.period_year
+    `);
+    }
+}
+export const yearOf = (isoDate) => Number(isoDate.slice(0, 4));
+export { inArray };
+//# sourceMappingURL=ledger.js.map

package/dist/server/services/ledger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger.js","sourceRoot":"","sources":["../../../src/server/services/ledger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAW,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC3D,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAEnD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AA6B5F,0FAA0F;AAC1F,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,IAAY,EAAU,EAAE,CAC9D,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAA;AAEvG,sFAAsF;AACtF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,CAAA;AAErC,MAAM,OAAO,aAAa;IACxB;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CAAC,EAAM,EAAE,WAAmB,EAAE,QAAgB,EAAE,UAAkB;QAC9E,MAAM,KAAK,GAAG,MAAM,EAAE;aACnB,MAAM,EAAE;aACR,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,GAAG,CAAA,GAAG,UAAU,CAAC,UAAU,UAAU,CAAC,CAAC,CAAA;QAE7F,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC;YACN,WAAW,EAAE,WAAW,CAAC,WAAW;YACpC,KAAK,EAAE,GAAG,CAAQ,gBAAgB,WAAW,CAAC,aAAa,YAAY;SACxE,CAAC;aACD,IAAI,CAAC,WAAW,CAAC;aACjB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,EACxC,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAClC,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,UAAU,CAAC,CACvC,CACF;aACA,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;QACnC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAEzE,6FAA6F;QAC7F,wFAAwF;QACxF,MAAM,OAAO,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC;YACN,WAAW,EAAE,GAAG,CAAQ,kBAAkB;YAC1C,MAAM,EAAE,GAAG,CAAQ,WAAW;YAC9B,OAAO,EAAE,GAAG,CAAQ,mCAAmC;SACxD,CAAC;aACD,IAAI,CAAC,GAAG,CAAA,GAAG,gBAAgB,0DAA0D,CAAC;aACtF,KAAK,CACJ,GAAG,CAAA,oBAAoB,WAAW,sBAAsB,QAAQ;oDACpB,CAC7C;aACA,OAAO,CAAC,GAAG,CAAA,6BAA6B,CAAC,CAAA;QAE5C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAA;QAC3C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAA;QAC1C,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;YAC/D,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAA;QACvF,CAAC;QAED,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACxB,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAA;YAC/C,MAAM,cAAc,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAA;YAClD,OAAO;gBACL,QAAQ;gBACR,WAAW,EAAE,IAAI,CAAC,EAAE;gBACpB,aAAa,EAAE,IAAI,CAAC,IAAI;gBACxB,IAAI,EAAE,IAAI,CAAC,IAAmC;gBAC9C,UAAU;gBACV,cAAc;gBACd,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;gBACzC,cAAc;gBACd,gBAAgB,EAAE,cAAc,GAAG,cAAc;gBACjD,OAAO,EAAE,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC;gBAC1C,SAAS,EAAE,MAAM,CAAC,cAAc,GAAG,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC;aAC9D,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CACf,EAAM,EACN,WAAmB,EACnB,QAAgB,EAChB,WAAmB,EACnB,UAAkB;QAElB,MAAM,EAAE;aACL,MAAM,CAAC,kBAAkB,CAAC;aAC1B,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;aACxE,mBAAmB,EAAE,CAAA;QAExB,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;sBACF,kBAAkB;8BACV,WAAW;2BACd,QAAQ;+BACJ,WAAW;6BACb,UAAU;;KAElC,CAAC,CAAA;QAEF,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAQ,gBAAgB,WAAW,CAAC,aAAa,YAAY,EAAE,CAAC;aACnF,IAAI,CAAC,WAAW,CAAC;aACjB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,EACxC,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAClC,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,EACxC,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,UAAU,CAAC,CACvC,CACF,CAAA;QACH,OAAO,MAAM,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,CAAA;IAChC,CAAC;IAED,gEAAgE;IAChE,KAAK,CAAC,MAAM,CACV,EAAM,EACN,WAAmB,EACnB,KAYC;QAED,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,WAAW,CAAC;aACnB,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,GAAG,KAAK,EAAE,CAAC;aAC/C,SAAS,EAAE,CAAA;QACd,MAAM,EAAE;aACL,MAAM,CAAC,kBAAkB,CAAC;aAC1B,GAAG,CAAC;YACH,oBAAoB,EAAE,GAAG,CAAA,GAAG,kBAAkB,CAAC,oBAAoB,MAAM,KAAK,CAAC,aAAa,EAAE;YAC9F,WAAW,EAAE,GAAI,CAAC,EAAE;YACpB,OAAO,EAAE,GAAG,CAAA,GAAG,kBAAkB,CAAC,OAAO,MAAM;YAC/C,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;aACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,kBAAkB,CAAC,WAAW,EAAE,WAAW,CAAC,EAC/C,EAAE,CAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAC/C,EAAE,CAAC,kBAAkB,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,EACrD,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CACpD,CACF,CAAA;QACH,OAAO,GAAI,CAAA;IACb,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CACX,EAAM,EACN,WAAmB,EACnB,OAAe,EACf,MAAc,EACd,OAAsB,EACtB,EAAU;QAEV,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,EAAE;aACR,IAAI,CAAC,WAAW,CAAC;aACjB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;aACjF,KAAK,CAAC,CAAC,CAAC,CAAA;QACX,IAAI,CAAC,QAAQ;YAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;QAEvD,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC;aAC9B,IAAI,CAAC,WAAW,CAAC;aACjB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;aAC9F,KAAK,CAAC,CAAC,CAAC,CAAA;QACX,gGAAgG;QAChG,4FAA4F;QAC5F,0EAA0E;QAC1E,IAAI,OAAO;YAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,sCAAsC,CAAC,CAAA;QAE7E,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE;YAClC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,IAAI,EAAE,UAAU;YAChB,aAAa,EAAE,CAAC,QAAQ,CAAC,aAAa;YACtC,WAAW,EAAE,EAAE;YACf,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,eAAe,EAAE,QAAQ,CAAC,EAAE;YAC5B,MAAM;YACN,SAAS,EAAE,OAAO;SACnB,CAAC,CAAA;IACJ,CAAC;IAED,yDAAyD;IACzD,KAAK,CAAC,UAAU,CAAC,EAAM,EAAE,WAAmB,EAAE,SAAiB;QAC7D,OAAO,EAAE;aACN,MAAM,EAAE;aACR,IAAI,CAAC,WAAW,CAAC;aACjB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAA;IAC/F,CAAC;IAED,oGAAoG;IACpG,KAAK,CAAC,cAAc,CAAC,EAAM,EAAE,WAAmB,EAAE,SAAmB;QACnE,IAAI,CAAC,SAAS,CAAC,MAAM;YAAE,OAAM;QAC7B,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;eACT,kBAAkB;;;;;;mBAMd,WAAW;kCACI,WAAW;iCACZ,GAAG,CAAC,IAAI,CAC1B,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAA,GAAG,CAAC,EAAE,CAAC,EAC/B,GAAG,CAAA,IAAI,CACR;;;gCAGkB,WAAW;;;;KAItC,CAAC,CAAA;IACJ,CAAC;CACF;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAC9E,OAAO,EAAE,OAAO,EAAE,CAAA"}

package/dist/server/services/people.d.ts

@@ -22,7 +22,6 @@ export declare class PeopleService {
         createdAt: string;
         updatedAt: string;
         id: string;
-        workspaceId: string;
         userId: string | null;
         employeeNo: string | null;
         displayName: string;
@@ -33,6 +32,7 @@ export declare class PeopleService {
         hiredOn: string | null;
         terminatedOn: string | null;
         timezone: string | null;
+        workspaceId: string;
     };
     static toEmployment(row: EmploymentRow): {
         employmentType: EmploymentType;
@@ -100,10 +100,10 @@ export declare class PeopleService {
         workspaceId: string;
         personId: string;
         effectiveFrom: string;
-        officeId: string;
-        isPrimary: boolean;
         effectiveTo: string | null;
         reason: string | null;
+        officeId: string;
+        isPrimary: boolean;
     };
     today: () => string;
 }

package/migrations/0002_leave.sql

@@ -0,0 +1,237 @@
+CREATE TABLE "mod_hr"."approval_chains" (
+	"id" uuid PRIMARY KEY DEFAULT uuidv7() NOT NULL,
+	"workspace_id" uuid NOT NULL,
+	"name" text NOT NULL,
+	"subject_type" text NOT NULL,
+	"spec" jsonb NOT NULL,
+	"is_default" boolean DEFAULT false NOT NULL,
+	"archived_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "mod_hr"."approval_decisions" (
+	"id" uuid PRIMARY KEY DEFAULT uuidv7() NOT NULL,
+	"workspace_id" uuid NOT NULL,
+	"step_id" uuid NOT NULL,
+	"approver_id" uuid NOT NULL,
+	"on_behalf_of_id" uuid,
+	"decision" text NOT NULL,
+	"comment" text,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "mod_hr"."approval_requests" (
+	"id" uuid PRIMARY KEY DEFAULT uuidv7() NOT NULL,
+	"workspace_id" uuid NOT NULL,
+	"subject_type" text NOT NULL,
+	"subject_id" uuid NOT NULL,
+	"summary" text DEFAULT '' NOT NULL,
+	"chain" jsonb NOT NULL,
+	"status" text DEFAULT 'pending' NOT NULL,
+	"current_step" integer DEFAULT 0 NOT NULL,
+	"requested_by" uuid,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"decided_at" timestamp with time zone,
+	"version" integer DEFAULT 0 NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "mod_hr"."approval_steps" (
+	"id" uuid PRIMARY KEY DEFAULT uuidv7() NOT NULL,
+	"workspace_id" uuid NOT NULL,
+	"request_id" uuid NOT NULL,
+	"step_index" integer NOT NULL,
+	"name" text DEFAULT '' NOT NULL,
+	"mode" text DEFAULT 'any' NOT NULL,
+	"min_approvals" integer DEFAULT 1 NOT NULL,
+	"approver_ids" uuid[] DEFAULT '{}'::uuid[] NOT NULL,
+	"status" text DEFAULT 'pending' NOT NULL,
+	"due_at" timestamp with time zone,
+	"escalated_at" timestamp with time zone
+);
+--> statement-breakpoint
+CREATE TABLE "mod_hr"."delegations" (
+	"id" uuid PRIMARY KEY DEFAULT uuidv7() NOT NULL,
+	"workspace_id" uuid NOT NULL,
+	"from_person_id" uuid NOT NULL,
+	"to_person_id" uuid NOT NULL,
+	"subject_type" text,
+	"starts_on" date NOT NULL,
+	"ends_on" date NOT NULL,
+	"reason" text,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "mod_hr"."leave_balance_cursor" (
+	"id" uuid PRIMARY KEY DEFAULT uuidv7() NOT NULL,
+	"workspace_id" uuid NOT NULL,
+	"person_id" uuid NOT NULL,
+	"leave_type_id" uuid NOT NULL,
+	"period_year" integer NOT NULL,
+	"cached_balance_minutes" integer DEFAULT 0 NOT NULL,
+	"as_of_entry_id" uuid,
+	"version" integer DEFAULT 0 NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "mod_hr"."leave_ledger" (
+	"id" uuid PRIMARY KEY DEFAULT uuidv7() NOT NULL,
+	"workspace_id" uuid NOT NULL,
+	"person_id" uuid NOT NULL,
+	"leave_type_id" uuid NOT NULL,
+	"kind" text NOT NULL,
+	"amount_minutes" integer NOT NULL,
+	"effective_on" date NOT NULL,
+	"period_year" integer NOT NULL,
+	"request_id" uuid,
+	"reverses_entry_id" uuid,
+	"policy_hash" text,
+	"reason" text,
+	"created_by" uuid,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "mod_hr"."leave_request_days" (
+	"id" uuid PRIMARY KEY DEFAULT uuidv7() NOT NULL,
+	"workspace_id" uuid NOT NULL,
+	"request_id" uuid NOT NULL,
+	"person_id" uuid NOT NULL,
+	"date" date NOT NULL,
+	"fraction" numeric(3, 2) DEFAULT '1' NOT NULL,
+	"counted" boolean DEFAULT true NOT NULL,
+	"status" text DEFAULT 'pending' NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "mod_hr"."leave_requests" (
+	"id" uuid PRIMARY KEY DEFAULT uuidv7() NOT NULL,
+	"workspace_id" uuid NOT NULL,
+	"person_id" uuid NOT NULL,
+	"leave_type_id" uuid NOT NULL,
+	"starts_on" date NOT NULL,
+	"ends_on" date NOT NULL,
+	"start_part" text DEFAULT 'full' NOT NULL,
+	"end_part" text DEFAULT 'full' NOT NULL,
+	"hours" numeric(5, 2),
+	"working_days" numeric(6, 2) DEFAULT '0' NOT NULL,
+	"minutes" integer DEFAULT 0 NOT NULL,
+	"status" text DEFAULT 'pending' NOT NULL,
+	"reason" text,
+	"document_file_id" uuid,
+	"approval_request_id" uuid,
+	"idempotency_key" text,
+	"decided_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "mod_hr"."leave_types" (
+	"id" uuid PRIMARY KEY DEFAULT uuidv7() NOT NULL,
+	"workspace_id" uuid NOT NULL,
+	"key" text NOT NULL,
+	"name" text NOT NULL,
+	"paid" boolean DEFAULT true NOT NULL,
+	"unit" text DEFAULT 'day' NOT NULL,
+	"color" text,
+	"icon" text,
+	"requires_document_after_days" integer,
+	"counts_working_days_only" boolean DEFAULT true NOT NULL,
+	"allow_negative" boolean DEFAULT false NOT NULL,
+	"max_negative_minutes" integer DEFAULT 0 NOT NULL,
+	"order" integer DEFAULT 0 NOT NULL,
+	"archived_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX "hr_approval_chains_idx" ON "mod_hr"."approval_chains" USING btree ("workspace_id","subject_type","archived_at");--> statement-breakpoint
+CREATE UNIQUE INDEX "hr_approval_decisions_uq" ON "mod_hr"."approval_decisions" USING btree ("step_id","approver_id");--> statement-breakpoint
+CREATE INDEX "hr_approval_requests_subject_idx" ON "mod_hr"."approval_requests" USING btree ("workspace_id","subject_type","subject_id");--> statement-breakpoint
+CREATE INDEX "hr_approval_requests_status_idx" ON "mod_hr"."approval_requests" USING btree ("workspace_id","status");--> statement-breakpoint
+CREATE UNIQUE INDEX "hr_approval_steps_uq" ON "mod_hr"."approval_steps" USING btree ("request_id","step_index");--> statement-breakpoint
+CREATE INDEX "hr_approval_steps_due_idx" ON "mod_hr"."approval_steps" USING btree ("workspace_id","status","due_at");--> statement-breakpoint
+CREATE INDEX "hr_delegations_idx" ON "mod_hr"."delegations" USING btree ("workspace_id","to_person_id","starts_on");--> statement-breakpoint
+CREATE UNIQUE INDEX "hr_balance_cursor_uq" ON "mod_hr"."leave_balance_cursor" USING btree ("workspace_id","person_id","leave_type_id","period_year");--> statement-breakpoint
+CREATE INDEX "hr_ledger_person_idx" ON "mod_hr"."leave_ledger" USING btree ("workspace_id","person_id","leave_type_id","effective_on");--> statement-breakpoint
+CREATE INDEX "hr_ledger_request_idx" ON "mod_hr"."leave_ledger" USING btree ("workspace_id","request_id");--> statement-breakpoint
+CREATE INDEX "hr_ledger_year_idx" ON "mod_hr"."leave_ledger" USING btree ("workspace_id","period_year");--> statement-breakpoint
+CREATE INDEX "hr_leave_days_person_idx" ON "mod_hr"."leave_request_days" USING btree ("workspace_id","person_id","date");--> statement-breakpoint
+CREATE INDEX "hr_leave_days_request_idx" ON "mod_hr"."leave_request_days" USING btree ("request_id");--> statement-breakpoint
+CREATE INDEX "hr_leave_requests_person_idx" ON "mod_hr"."leave_requests" USING btree ("workspace_id","person_id","starts_on");--> statement-breakpoint
+CREATE INDEX "hr_leave_requests_status_idx" ON "mod_hr"."leave_requests" USING btree ("workspace_id","status","starts_on");--> statement-breakpoint
+CREATE UNIQUE INDEX "hr_leave_requests_idem_uq" ON "mod_hr"."leave_requests" USING btree ("workspace_id","idempotency_key");--> statement-breakpoint
+CREATE UNIQUE INDEX "hr_leave_types_ws_key_uq" ON "mod_hr"."leave_types" USING btree ("workspace_id","key");--> statement-breakpoint
+-- ---------------------------------------------------------------------------------------------
+-- Row-level security on the new tenant tables.
+alter table "mod_hr"."leave_types" enable row level security;--> statement-breakpoint
+alter table "mod_hr"."leave_types" force row level security;--> statement-breakpoint
+create policy "leave_types_ws_isolation" on "mod_hr"."leave_types"
+  using (workspace_id::text = current_setting('app.workspace_id', true))
+  with check (workspace_id::text = current_setting('app.workspace_id', true));--> statement-breakpoint
+
+alter table "mod_hr"."leave_ledger" enable row level security;--> statement-breakpoint
+alter table "mod_hr"."leave_ledger" force row level security;--> statement-breakpoint
+create policy "leave_ledger_ws_isolation" on "mod_hr"."leave_ledger"
+  using (workspace_id::text = current_setting('app.workspace_id', true))
+  with check (workspace_id::text = current_setting('app.workspace_id', true));--> statement-breakpoint
+
+alter table "mod_hr"."leave_balance_cursor" enable row level security;--> statement-breakpoint
+alter table "mod_hr"."leave_balance_cursor" force row level security;--> statement-breakpoint
+create policy "leave_balance_cursor_ws_isolation" on "mod_hr"."leave_balance_cursor"
+  using (workspace_id::text = current_setting('app.workspace_id', true))
+  with check (workspace_id::text = current_setting('app.workspace_id', true));--> statement-breakpoint
+
+alter table "mod_hr"."leave_requests" enable row level security;--> statement-breakpoint
+alter table "mod_hr"."leave_requests" force row level security;--> statement-breakpoint
+create policy "leave_requests_ws_isolation" on "mod_hr"."leave_requests"
+  using (workspace_id::text = current_setting('app.workspace_id', true))
+  with check (workspace_id::text = current_setting('app.workspace_id', true));--> statement-breakpoint
+
+alter table "mod_hr"."leave_request_days" enable row level security;--> statement-breakpoint
+alter table "mod_hr"."leave_request_days" force row level security;--> statement-breakpoint
+create policy "leave_request_days_ws_isolation" on "mod_hr"."leave_request_days"
+  using (workspace_id::text = current_setting('app.workspace_id', true))
+  with check (workspace_id::text = current_setting('app.workspace_id', true));--> statement-breakpoint
+
+alter table "mod_hr"."approval_chains" enable row level security;--> statement-breakpoint
+alter table "mod_hr"."approval_chains" force row level security;--> statement-breakpoint
+create policy "approval_chains_ws_isolation" on "mod_hr"."approval_chains"
+  using (workspace_id::text = current_setting('app.workspace_id', true))
+  with check (workspace_id::text = current_setting('app.workspace_id', true));--> statement-breakpoint
+
+alter table "mod_hr"."approval_requests" enable row level security;--> statement-breakpoint
+alter table "mod_hr"."approval_requests" force row level security;--> statement-breakpoint
+create policy "approval_requests_ws_isolation" on "mod_hr"."approval_requests"
+  using (workspace_id::text = current_setting('app.workspace_id', true))
+  with check (workspace_id::text = current_setting('app.workspace_id', true));--> statement-breakpoint
+
+alter table "mod_hr"."approval_steps" enable row level security;--> statement-breakpoint
+alter table "mod_hr"."approval_steps" force row level security;--> statement-breakpoint
+create policy "approval_steps_ws_isolation" on "mod_hr"."approval_steps"
+  using (workspace_id::text = current_setting('app.workspace_id', true))
+  with check (workspace_id::text = current_setting('app.workspace_id', true));--> statement-breakpoint
+
+alter table "mod_hr"."approval_decisions" enable row level security;--> statement-breakpoint
+alter table "mod_hr"."approval_decisions" force row level security;--> statement-breakpoint
+create policy "approval_decisions_ws_isolation" on "mod_hr"."approval_decisions"
+  using (workspace_id::text = current_setting('app.workspace_id', true))
+  with check (workspace_id::text = current_setting('app.workspace_id', true));--> statement-breakpoint
+
+alter table "mod_hr"."delegations" enable row level security;--> statement-breakpoint
+alter table "mod_hr"."delegations" force row level security;--> statement-breakpoint
+create policy "delegations_ws_isolation" on "mod_hr"."delegations"
+  using (workspace_id::text = current_setting('app.workspace_id', true))
+  with check (workspace_id::text = current_setting('app.workspace_id', true));--> statement-breakpoint
+
+-- ---------------------------------------------------------------------------------------------
+-- The invariant that keeps a balance honest under concurrency.
+--
+-- Two overlapping requests can both read the same balance, both see enough for the last day, and
+-- both succeed — leaving somebody minus a day and nobody able to say which request caused it. The
+-- cursor lock serialises the *spend*; this index refuses the *overlap*, so a person cannot hold two
+-- live requests covering one date whatever the application layer believes.
+--
+-- Partial on purpose: a cancelled or rejected request must not block rebooking the same day, and a
+-- weekend inside a range is not counted so it does not conflict with anything either.
+create unique index "hr_leave_days_no_double_booking"
+  on "mod_hr"."leave_request_days" (workspace_id, person_id, date)
+  where counted and status in ('pending', 'approved');