iobroker.time-tracker 0.2.0

package/build/lib/web/api.js

@@ -0,0 +1,2589 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var api_exports = {};
+__export(api_exports, {
+  MAX_BACKUP_UPLOAD_BYTES: () => MAX_BACKUP_UPLOAD_BYTES,
+  createApi: () => createApi
+});
+module.exports = __toCommonJS(api_exports);
+var import_node_crypto = require("node:crypto");
+var fs = __toESM(require("node:fs"));
+var import_audit = require("../db/repositories/audit");
+var import_rfid = require("../db/repositories/rfid");
+var import_auth = require("../services/auth");
+var import_errors = require("../errors");
+var import_seed = require("../db/seed");
+var import_punch = require("../domain/punch");
+var import_avatar = require("../domain/avatar");
+var import_labels = require("../reports/labels");
+var import_xls = require("../reports/xls");
+var import_pdf = require("../reports/pdf");
+var import_types = require("../reports/types");
+var import_time = require("../util/time");
+var import_cookies = require("./cookies");
+var import_events = require("./events");
+var import_pin_guard = require("./pin-guard");
+var import_problem = require("./problem");
+var import_router = require("./router");
+const XLSX_CONTENT_TYPE = "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet";
+const PDF_CONTENT_TYPE = "application/pdf";
+const MAX_BACKUP_UPLOAD_BYTES = 64 * 1024 * 1024;
+function requireString(body, field) {
+  const value = body[field];
+  if (typeof value !== "string" || !value.trim()) {
+    throw new import_errors.ValidationError(`${field} is required`);
+  }
+  return value.trim();
+}
+function optionalString(body, field) {
+  const value = body[field];
+  if (value === void 0 || value === null) {
+    return null;
+  }
+  if (typeof value !== "string") {
+    throw new import_errors.ValidationError(`${field} must be a string`);
+  }
+  return value.trim() || null;
+}
+function optionalNumber(body, field) {
+  const value = body[field];
+  if (value === void 0 || value === null) {
+    return null;
+  }
+  if (typeof value !== "number" || !Number.isFinite(value)) {
+    throw new import_errors.ValidationError(`${field} must be a number`);
+  }
+  return value;
+}
+const SECRET_SETTING_KEYS = ["secret", "password", "token", "hash", "apikey"];
+const JSON_SETTINGS = ["pause_staffel"];
+const MAX_STATISTICS_DAYS = 366;
+const TERMINAL_SESSION_MINUTES_DEFAULT = 15;
+function publicTerminal(terminal) {
+  return {
+    id: terminal.id,
+    name: terminal.name,
+    location: terminal.location,
+    pinRequired: terminal.pinRequired,
+    isActive: terminal.isActive,
+    expiresAt: terminal.expiresAt,
+    lastSeenAt: terminal.lastSeenAt,
+    createdAt: terminal.createdAt,
+    userIds: terminal.userIds
+  };
+}
+function editableSettings() {
+  return [...Object.keys(import_seed.SETTING_DEFAULTS), ...JSON_SETTINGS];
+}
+const HIDDEN_SETTING_KEYS = ["brand_logo", "brand_background"];
+function readableSettings(all) {
+  const result = {};
+  for (const [key, value] of Object.entries(all)) {
+    const lower = key.toLowerCase();
+    if (SECRET_SETTING_KEYS.some((marker) => lower.includes(marker))) {
+      continue;
+    }
+    if (HIDDEN_SETTING_KEYS.includes(key)) {
+      continue;
+    }
+    result[key] = value;
+  }
+  return result;
+}
+function isSettingValue(value, allowStructured) {
+  if (value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+    return typeof value !== "number" || Number.isFinite(value);
+  }
+  if (!allowStructured) {
+    return false;
+  }
+  if (Array.isArray(value)) {
+    return value.every((entry) => isSettingValue(entry, true));
+  }
+  return typeof value === "object" && Object.values(value).every((entry) => isSettingValue(entry, true));
+}
+function requireBoolean(body, field) {
+  const value = optionalBoolean(body, field);
+  if (value === null) {
+    throw new import_errors.ValidationError(`${field} is required`);
+  }
+  return value;
+}
+function readPeriod(year, month) {
+  const parsedYear = Number(year);
+  if (!Number.isInteger(parsedYear) || parsedYear < 2e3 || parsedYear > 2100) {
+    throw new import_errors.ValidationError(`year must be a four digit year between 2000 and 2100 (got ${JSON.stringify(year)})`);
+  }
+  if (month === null || month === void 0 || month === "") {
+    return { year: parsedYear, month: null };
+  }
+  const parsedMonth = Number(month);
+  if (!Number.isInteger(parsedMonth) || parsedMonth < 1 || parsedMonth > 12) {
+    throw new import_errors.ValidationError(`month must be between 1 and 12 (got ${JSON.stringify(month)})`);
+  }
+  return { year: parsedYear, month: parsedMonth };
+}
+function optionalNumberQuery(context, name, fallback) {
+  const raw = context.query(name);
+  if (raw === null) {
+    return fallback;
+  }
+  const value = Number(raw);
+  if (!Number.isInteger(value) || value < 0) {
+    throw new import_errors.ValidationError(`${name} must be a non-negative whole number (got ${raw})`);
+  }
+  return value;
+}
+function readRoleKeys(body) {
+  const value = body.roleKeys;
+  if (value === void 0 || value === null) {
+    return null;
+  }
+  if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) {
+    throw new import_errors.ValidationError("roleKeys must be an array of strings");
+  }
+  return value.map((entry) => entry.trim()).filter((entry) => entry.length > 0);
+}
+function readUserIds(body) {
+  const value = body.userIds;
+  if (value === void 0 || value === null) {
+    return null;
+  }
+  if (!Array.isArray(value) || value.some((entry) => !Number.isInteger(entry))) {
+    throw new import_errors.ValidationError("userIds must be an array of whole numbers");
+  }
+  return [...new Set(value)];
+}
+const PROFILE_FIELDS = [
+  "percent",
+  "weeklyHours",
+  "workdays",
+  "startDate",
+  "endDate",
+  "overtimeCarryover",
+  "vorholzeitPerYear",
+  "vacationCarryover",
+  "vacationPerYear",
+  "overtimeModel",
+  "holidayFlags",
+  "pausePaidMinutes"
+];
+function readProfilePatch(body) {
+  const patch = {};
+  const issues = [];
+  for (const [key, value] of Object.entries(body)) {
+    if (key === "reason") {
+      continue;
+    }
+    if (!PROFILE_FIELDS.includes(key)) {
+      issues.push({ path: key, message: "unknown field of a work profile" });
+      continue;
+    }
+    if (key === "percent") {
+      const percent = Number(value);
+      if (!Number.isInteger(percent) || percent < 0 || percent > 100) {
+        issues.push({ path: key, message: "must be a whole number between 0 and 100" });
+        continue;
+      }
+      patch.percent = percent;
+    } else if (key === "weeklyHours") {
+      const hours = Number(value);
+      if (!Number.isFinite(hours) || hours < 0 || hours > 168) {
+        issues.push({ path: key, message: "must be between 0 and 168" });
+        continue;
+      }
+      patch.weeklyHours = hours;
+    } else if (key === "workdays") {
+      if (typeof value !== "string") {
+        issues.push({ path: key, message: "must be a string of weekdays" });
+        continue;
+      }
+      const workdays = value.trim();
+      if (!/^\d(;\d)*$/.test(workdays) || workdays.split(";").some((day) => Number(day) > 6)) {
+        issues.push({ path: key, message: 'must be weekdays separated by ";" (0 = Sunday \u2026 6 = Saturday)' });
+        continue;
+      }
+      patch.workdays = workdays;
+    } else if (key === "overtimeModel") {
+      if (value !== "cumulative" && value !== "yearly" && value !== "monthly") {
+        issues.push({ path: key, message: "must be cumulative, yearly or monthly" });
+        continue;
+      }
+      patch.overtimeModel = value;
+    } else if (key === "startDate" || key === "endDate") {
+      if (value !== null && (!Number.isInteger(Number(value)) || Number(value) < 0)) {
+        issues.push({ path: key, message: "must be an instant in seconds or null" });
+        continue;
+      }
+      patch[key] = value === null ? null : Number(value);
+    } else if (key === "holidayFlags") {
+      if (value !== null && typeof value !== "string") {
+        issues.push({ path: key, message: "must be a JSON string or null" });
+        continue;
+      }
+      patch.holidayFlags = value;
+    } else if (key === "pausePaidMinutes") {
+      const minutes = Number(value);
+      if (!Number.isInteger(minutes) || minutes < 0 || minutes > 1440) {
+        issues.push({ path: key, message: "must be a whole number of minutes between 0 and 1440" });
+        continue;
+      }
+      patch.pausePaidMinutes = minutes;
+    } else {
+      const number = Number(value);
+      if (!Number.isInteger(number)) {
+        issues.push({ path: key, message: "must be a whole number of minutes" });
+        continue;
+      }
+      patch[key] = number;
+    }
+  }
+  if (issues.length > 0) {
+    throw new import_errors.ValidationError(`${issues.length} field(s) of the work profile are not valid`, issues);
+  }
+  return patch;
+}
+function publicUser(user) {
+  return {
+    id: user.id,
+    login: user.login,
+    displayName: user.displayName,
+    email: user.email,
+    rfidCard: user.rfidCard,
+    isActive: user.isActive,
+    mustChangePw: user.mustChangePw,
+    locale: user.locale,
+    language: user.locale,
+    timezone: user.timezone,
+    // the picture is served by its own route, so it never travels inside the JSON answer; the version in the
+    // query makes the browser fetch it again after a change
+    avatarUrl: user.avatar ? `/api/users/${user.id}/avatar?v=${user.updatedAt}` : null,
+    createdAt: user.createdAt,
+    updatedAt: user.updatedAt,
+    lastLoginAt: user.lastLoginAt
+  };
+}
+function optionalBoolean(body, field) {
+  const value = body[field];
+  if (value === void 0 || value === null) {
+    return null;
+  }
+  if (typeof value !== "boolean") {
+    throw new import_errors.ValidationError(`${field} must be a boolean`);
+  }
+  return value;
+}
+function numberParam(context, name) {
+  const raw = context.params[name];
+  const value = Number(raw);
+  if (!Number.isInteger(value)) {
+    throw new import_errors.ValidationError(`${name} must be a whole number (got ${raw})`);
+  }
+  return value;
+}
+function optionalDirection(body) {
+  const value = optionalString(body, "direction");
+  if (value === null) {
+    return "auto";
+  }
+  if (value !== "in" && value !== "out" && value !== "auto") {
+    throw new import_errors.ValidationError(`direction must be in, out or auto (got ${value})`);
+  }
+  return value;
+}
+function resolveScope(context, requested, ownPermission, otherPermission) {
+  if (!context.auth) {
+    throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+  }
+  const target = requested != null ? requested : context.auth.user.id;
+  if (target === context.auth.user.id) {
+    return target;
+  }
+  if (!context.auth.permissions.includes(otherPermission)) {
+    throw (0, import_problem.problem)(403, "permission_denied", `request rejected (permission_denied: ${otherPermission})`);
+  }
+  return target;
+}
+function buildEntriesCsv(entries, timeZone) {
+  var _a, _b;
+  const lines = ["date;time;direction;source;note"];
+  for (const entry of entries) {
+    const seconds = (0, import_time.utcToWallTime)(entry.tsUtc, timeZone) % 86400;
+    const hour = String(Math.floor(seconds / 3600)).padStart(2, "0");
+    const minute = String(Math.floor(seconds % 3600 / 60)).padStart(2, "0");
+    const note = `"${((_a = entry.note) != null ? _a : "").replace(/"/g, '""')}"`;
+    lines.push([entry.localDate, `${hour}:${minute}`, (_b = entry.direction) != null ? _b : "", entry.source, note].join(";"));
+  }
+  return Buffer.from(`\uFEFF${lines.join("\r\n")}\r
+`, "utf8");
+}
+function createApi(deps) {
+  var _a, _b, _c, _d;
+  const {
+    auth,
+    users,
+    entries,
+    absences,
+    holidays,
+    rules,
+    payouts,
+    terminals,
+    rfid,
+    triggers,
+    automations,
+    aggregation,
+    sync,
+    settings
+  } = deps;
+  const now = (_a = deps.now) != null ? _a : (() => Math.floor(Date.now() / 1e3));
+  const events = (_b = deps.events) != null ? _b : (0, import_events.createEventBus)();
+  const registered = [];
+  const router = (0, import_router.createRouter)({ auth, trustProxy: deps.trustProxy === true, now });
+  const pinGuard = (0, import_pin_guard.createPinGuard)();
+  const emit = (event) => {
+    events.publish({ ...event, atUtc: now() });
+  };
+  function requireInsideEditWindow(context, ownerId, tsUtc) {
+    const actor = context.auth;
+    if (!actor || actor.user.id !== ownerId || actor.permissions.includes("time.edit_other")) {
+      return;
+    }
+    const days = settings.getNumber("edit_window_days", 0);
+    if (days <= 0) {
+      return;
+    }
+    if (tsUtc < now() - days * 86400) {
+      throw (0, import_problem.problem)(
+        403,
+        "edit_window_closed",
+        `own punches may only be changed within ${days} day(s) (edit_window_days)`
+      );
+    }
+  }
+  const route = (method, path, routeSettings, handler) => {
+    const methods = Array.isArray(method) ? method : [method];
+    for (const entry of methods) {
+      registered.push({
+        method: entry,
+        path,
+        ...routeSettings.permission ? { permission: routeSettings.permission } : {}
+      });
+    }
+    router.add({
+      method,
+      path,
+      permission: routeSettings.permission,
+      requiresAuth: routeSettings.public !== true,
+      // `undefined` hands the decision to the router: a session cookie needs the CSRF token, a bearer
+      // client (integration, `x-session-token`) does not, because no foreign page can set that header.
+      // `false` switches the check off completely — that is for the public routes, which run without a
+      // session, so a CSRF token could not exist yet.
+      requiresCsrf: routeSettings.csrf === false ? false : void 0,
+      rateLimit: routeSettings.rateLimit,
+      maxBodyBytes: routeSettings.maxBodyBytes,
+      handler
+    });
+  };
+  const sessionCookie = (context, token, expiresAt) => (0, import_cookies.serializeCookie)(import_cookies.SESSION_COOKIE, token, {
+    maxAgeSeconds: Math.max(0, expiresAt - now()),
+    secure: context.secure
+  });
+  const removeSessionCookie = (context) => (0, import_cookies.clearCookie)(import_cookies.SESSION_COOKIE, { secure: context.secure });
+  route(
+    "POST",
+    "/auth/login",
+    {
+      public: true,
+      csrf: false,
+      rateLimit: { name: "login", limit: (_c = deps.loginRateLimit) != null ? _c : 20, windowSeconds: 60 }
+    },
+    (context) => {
+      var _a2;
+      const body = context.jsonBody();
+      const result = auth.login({
+        login: requireString(body, "login"),
+        password: requireString(body, "password"),
+        userAgent: context.header("user-agent"),
+        ip: (_a2 = context.request.remoteAddress) != null ? _a2 : null,
+        now: now()
+      });
+      if (!result.ok) {
+        throw (0, import_problem.problem)(
+          result.error === "locked_out" ? 423 : 401,
+          result.error,
+          result.error === "locked_out" ? "too many failed attempts, try again later" : "login or password is not correct"
+        );
+      }
+      return (0, import_router.json)(
+        200,
+        {
+          token: result.token,
+          csrfToken: result.csrfToken,
+          expiresAt: result.expiresAt,
+          user: result.user
+        },
+        { "set-cookie": sessionCookie(context, result.token, result.expiresAt) }
+      );
+    }
+  );
+  route("POST", "/auth/logout", { csrf: true }, (context) => {
+    var _a2, _b2, _c2;
+    auth.logout({
+      token: context.sessionToken,
+      actorId: (_b2 = (_a2 = context.auth) == null ? void 0 : _a2.user.id) != null ? _b2 : null,
+      ip: (_c2 = context.request.remoteAddress) != null ? _c2 : null,
+      now: now()
+    });
+    return (0, import_router.noContent)(204, { "set-cookie": removeSessionCookie(context) });
+  });
+  route(
+    "GET",
+    "/auth/me",
+    {},
+    (context) => {
+      var _a2, _b2, _c2, _d2;
+      return (0, import_router.json)(200, {
+        user: (_a2 = context.auth) == null ? void 0 : _a2.user,
+        permissions: (_c2 = (_b2 = context.auth) == null ? void 0 : _b2.permissions) != null ? _c2 : [],
+        expiresAt: (_d2 = context.auth) == null ? void 0 : _d2.expiresAt,
+        // a client that only holds the cookie has no other way to learn the CSRF token of its session
+        csrfToken: context.auth ? auth.csrfToken(context.sessionToken) : void 0
+      });
+    }
+  );
+  route("POST", "/auth/password", { csrf: true }, (context) => {
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const password = requireString(context.jsonBody(), "password");
+    auth.setPassword({ userId: context.auth.user.id, password, actorId: context.auth.user.id, now: now() });
+    auth.revokeSessions({ userId: context.auth.user.id, actorId: context.auth.user.id, now: now() });
+    return (0, import_router.noContent)(204, { "set-cookie": removeSessionCookie(context) });
+  });
+  route("POST", "/auth/refresh", { csrf: true }, (context) => {
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const token = context.sessionToken;
+    return (0, import_router.json)(200, {
+      expiresAt: context.auth.expiresAt,
+      csrfToken: auth.csrfToken(token),
+      user: context.auth.user,
+      permissions: context.auth.permissions
+    });
+  });
+  const scopeUser = (context, ownPermission = "report.view_own", otherPermission = "report.view_other") => {
+    const raw = context.query("userId");
+    return resolveScope(context, raw ? Number(raw) : null, ownPermission, otherPermission);
+  };
+  const numberQuery = (context, name) => {
+    const raw = context.query(name);
+    const value = Number(raw);
+    if (raw === null || raw.trim() === "" || !Number.isInteger(value)) {
+      throw new import_errors.ValidationError(`${name} is required and must be a whole number`);
+    }
+    return value;
+  };
+  const punch = (context, options) => {
+    var _a2, _b2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const body = context.jsonBody();
+    const timestamp = now();
+    const user = users.findById(context.auth.user.id);
+    if (!user) {
+      throw new import_errors.NotFoundError(`user ${context.auth.user.id} not found`);
+    }
+    const requestedTs = (_a2 = optionalNumber(body, "tsUtc")) != null ? _a2 : timestamp;
+    const quickRoundMinutes = options.quick ? settings.getNumber("quick_round_minutes", 0) : 0;
+    const tsUtc = quickRoundMinutes > 0 ? (0, import_punch.roundToStep)(requestedTs, quickRoundMinutes, user.timezone) : requestedTs;
+    const stored = entries.insert({
+      userId: user.id,
+      tsUtc,
+      clientTsUtc: optionalNumber(body, "clientTsUtc"),
+      timeZone: user.timezone,
+      source: "web",
+      direction: optionalDirection(body),
+      idempotencyKey: optionalString(body, "idempotencyKey"),
+      note: optionalString(body, "note"),
+      actorId: user.id,
+      actorIp: (_b2 = context.request.remoteAddress) != null ? _b2 : null,
+      now: timestamp
+    });
+    const day = aggregation.recalculateDay(user.id, stored.entry.localDate, { now: timestamp });
+    emit({
+      type: "punch",
+      userId: user.id,
+      data: { entryId: stored.entry.id, created: stored.created, localDate: stored.entry.localDate }
+    });
+    return (0, import_router.json)(
+      201,
+      {
+        entry: stored.entry,
+        created: stored.created,
+        day,
+        ...quickRoundMinutes > 0 ? { rounded: { from: requestedTs, to: tsUtc, roundMinutes: quickRoundMinutes } } : {}
+      },
+      { location: `/entries/${stored.entry.id}` }
+    );
+  };
+  route(
+    "POST",
+    "/punch",
+    { permission: "time.punch", csrf: true, rateLimit: { name: "punch", limit: 60, windowSeconds: 60 } },
+    (context) => punch(context, { quick: false })
+  );
+  route(
+    "POST",
+    "/punch/quick",
+    { permission: "time.punch", csrf: true, rateLimit: { name: "punch", limit: 60, windowSeconds: 60 } },
+    (context) => punch(context, { quick: true })
+  );
+  route("GET", "/punch/status", { permission: "report.view_own" }, (context) => {
+    const userId = scopeUser(context);
+    const user = users.findById(userId);
+    if (!user) {
+      throw new import_errors.NotFoundError(`user ${userId} not found`);
+    }
+    const date = (0, import_time.localDate)(now(), user.timezone);
+    const day = aggregation.recalculateDay(userId, date, { now: now() });
+    const todayEntries = entries.listByRange(userId, date, date);
+    return (0, import_router.json)(200, {
+      date,
+      day,
+      hasOpenEntry: day.hasOpenEntry,
+      lastEntry: todayEntries.length > 0 ? todayEntries[todayEntries.length - 1] : null,
+      // what a punch would do right now, so a client does not have to derive it
+      nextDirection: day.hasOpenEntry ? "out" : "in"
+    });
+  });
+  route(
+    "POST",
+    "/entries/sync",
+    { permission: "time.punch", csrf: true, rateLimit: { name: "sync", limit: 30, windowSeconds: 60 } },
+    (context) => {
+      var _a2;
+      if (!context.auth) {
+        throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+      }
+      const body = context.jsonBody();
+      const user = users.findById(context.auth.user.id);
+      if (!user) {
+        throw new import_errors.NotFoundError(`user ${context.auth.user.id} not found`);
+      }
+      if (!Array.isArray(body.punches)) {
+        throw new import_errors.ValidationError("punches must be an array");
+      }
+      const result = sync.sync({
+        userId: user.id,
+        timeZone: user.timezone,
+        punches: body.punches.map((raw) => {
+          const punch2 = raw != null ? raw : {};
+          const tsUtc = optionalNumber(punch2, "tsUtc");
+          if (tsUtc === null) {
+            throw new import_errors.ValidationError("tsUtc is required for every queued punch");
+          }
+          return {
+            idempotencyKey: typeof punch2.idempotencyKey === "string" ? punch2.idempotencyKey : "",
+            tsUtc,
+            clientTsUtc: optionalNumber(punch2, "clientTsUtc"),
+            direction: optionalDirection(punch2),
+            note: optionalString(punch2, "note")
+          };
+        }),
+        actorId: user.id,
+        actorIp: (_a2 = context.request.remoteAddress) != null ? _a2 : null,
+        now: now()
+      });
+      emit({
+        type: "punch",
+        userId: user.id,
+        data: {
+          synced: result.accepted.filter((entry) => entry.created).length,
+          duplicates: result.accepted.filter((entry) => !entry.created).length,
+          conflicts: result.conflicts.length,
+          rejected: result.rejected.length,
+          days: result.recalculated.length
+        }
+      });
+      return (0, import_router.json)(200, result);
+    }
+  );
+  route(
+    "GET",
+    "/entries/conflicts",
+    { permission: "time.resolve_conflict" },
+    (context) => {
+      var _a2, _b2;
+      return (0, import_router.json)(200, { conflicts: sync.conflicts((_b2 = (_a2 = context.auth) == null ? void 0 : _a2.user.id) != null ? _b2 : 0) });
+    }
+  );
+  route("POST", "/entries/:id/resolve", { permission: "time.resolve_conflict", csrf: true }, (context) => {
+    var _a2, _b2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const body = context.jsonBody();
+    const action = requireString(body, "action");
+    if (action !== "accept" && action !== "dismiss") {
+      throw new import_errors.ValidationError(`action must be accept or dismiss (got ${action})`);
+    }
+    const result = sync.resolve({
+      entryId: numberParam(context, "id"),
+      action,
+      tsUtc: (_a2 = optionalNumber(body, "tsUtc")) != null ? _a2 : void 0,
+      reason: optionalString(body, "reason"),
+      actorId: context.auth.user.id,
+      actorIp: (_b2 = context.request.remoteAddress) != null ? _b2 : null,
+      now: now()
+    });
+    if (result.entry) {
+      emit({
+        type: "entry.update",
+        userId: result.entry.userId,
+        data: { entryId: result.entry.id, localDate: result.entry.localDate, resolved: action }
+      });
+    }
+    return (0, import_router.json)(200, result);
+  });
+  route("GET", "/aggregates/day", { permission: "report.view_own" }, (context) => {
+    var _a2, _b2;
+    const userId = scopeUser(context);
+    const from = context.query("from");
+    const to = (_a2 = context.query("to")) != null ? _a2 : from;
+    if (from && to) {
+      const range = aggregation.recalculateRange(userId, from, to, { now: now() });
+      return (0, import_router.json)(200, { from, to, ...range, days: aggregation.days(userId, from, to) });
+    }
+    const user = users.findById(userId);
+    if (!user) {
+      throw new import_errors.NotFoundError(`user ${userId} not found`);
+    }
+    const date = (_b2 = context.query("date")) != null ? _b2 : (0, import_time.localDate)(now(), user.timezone);
+    if (!/^\d{4}-\d{2}-\d{2}$/.test(date)) {
+      throw new import_errors.ValidationError(`date must be YYYY-MM-DD (got ${date})`);
+    }
+    return (0, import_router.json)(200, { day: aggregation.recalculateDay(userId, date, { now: now() }) });
+  });
+  route("GET", "/aggregates/month", { permission: "report.view_own" }, (context) => {
+    const userId = scopeUser(context);
+    const year = numberQuery(context, "year");
+    const requestedMonth = context.query("month");
+    if (!requestedMonth) {
+      const totals = aggregation.recalculateYear(userId, year, { now: now() });
+      const months = Array.from({ length: 12 }, (_, index) => aggregation.month(userId, year, index + 1));
+      return (0, import_router.json)(200, { year: totals, months });
+    }
+    const month = Number(requestedMonth);
+    if (!Number.isInteger(month) || month < 1 || month > 12) {
+      throw new import_errors.ValidationError(`month must be between 1 and 12 (got ${requestedMonth})`);
+    }
+    const monthly = aggregation.recalculateMonth(userId, year, month, { now: now() });
+    const yearly = aggregation.recalculateYear(userId, year, { now: now() });
+    return (0, import_router.json)(200, { month: monthly, year: yearly });
+  });
+  route("GET", "/aggregates/year", { permission: "report.view_own" }, (context) => {
+    const userId = scopeUser(context);
+    const year = numberQuery(context, "year");
+    return (0, import_router.json)(200, { year: aggregation.recalculateYear(userId, year, { now: now() }) });
+  });
+  route("GET", "/entries", { permission: "report.view_own" }, (context) => {
+    var _a2;
+    const userId = scopeUser(context);
+    const from = context.query("from");
+    const to = (_a2 = context.query("to")) != null ? _a2 : from;
+    if (!from || !to) {
+      throw new import_errors.ValidationError("from and to are required");
+    }
+    return (0, import_router.json)(200, { entries: entries.listByRange(userId, from, to) });
+  });
+  route("POST", "/entries", { permission: "time.edit_own", csrf: true }, (context) => {
+    var _a2, _b2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const body = context.jsonBody();
+    const target = Number((_a2 = context.query("userId")) != null ? _a2 : context.auth.user.id);
+    if (!Number.isInteger(target)) {
+      throw new import_errors.ValidationError("userId must be a whole number");
+    }
+    const own = target === context.auth.user.id;
+    if (!own && !context.auth.permissions.includes("time.edit_other")) {
+      throw (0, import_problem.problem)(403, "permission_denied", "request rejected (permission_denied: time.edit_other)");
+    }
+    const user = users.findById(target);
+    if (!user) {
+      throw new import_errors.NotFoundError(`user ${target} not found`);
+    }
+    const tsUtc = optionalNumber(body, "tsUtc");
+    if (tsUtc === null) {
+      throw new import_errors.ValidationError("tsUtc is required");
+    }
+    requireInsideEditWindow(context, target, tsUtc);
+    const timestamp = now();
+    const stored = entries.insert({
+      userId: target,
+      tsUtc,
+      clientTsUtc: optionalNumber(body, "clientTsUtc"),
+      timeZone: user.timezone,
+      source: own ? "web" : "admin",
+      direction: optionalDirection(body),
+      idempotencyKey: optionalString(body, "idempotencyKey"),
+      note: optionalString(body, "note"),
+      reason: optionalString(body, "reason"),
+      actorId: context.auth.user.id,
+      actorIp: (_b2 = context.request.remoteAddress) != null ? _b2 : null,
+      now: timestamp
+    });
+    const day = aggregation.recalculateDay(target, stored.entry.localDate, { now: timestamp });
+    emit({
+      type: "punch",
+      userId: target,
+      data: {
+        entryId: stored.entry.id,
+        created: stored.created,
+        localDate: stored.entry.localDate,
+        source: own ? "web" : "admin"
+      }
+    });
+    return (0, import_router.json)(
+      201,
+      { entry: stored.entry, created: stored.created, day },
+      { location: `/entries/${stored.entry.id}` }
+    );
+  });
+  const publicAbsence = (absence) => {
+    var _a2, _b2;
+    const type = absences.findType(absence.typeId);
+    return { ...absence, typeCode: (_a2 = type == null ? void 0 : type.code) != null ? _a2 : null, typeName: (_b2 = type == null ? void 0 : type.name) != null ? _b2 : null };
+  };
+  route("GET", "/absences", { permission: "report.view_own" }, (context) => {
+    const requested = context.query("userId") ? Number(context.query("userId")) : null;
+    const userId = resolveScope(context, requested, "report.view_own", "report.view_other");
+    const year = context.query("year") ? Number(context.query("year")) : void 0;
+    return (0, import_router.json)(200, {
+      absences: absences.listByUser(userId, year === void 0 ? {} : { year }).map(publicAbsence)
+    });
+  });
+  route("POST", "/absences", { permission: "absence.request", csrf: true }, (context) => {
+    var _a2, _b2, _c2, _d2, _e;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const body = context.jsonBody();
+    const userId = resolveScope(context, optionalNumber(body, "userId"), "absence.request", "absence.edit_other");
+    const status = optionalString(body, "status");
+    if (status !== null && status !== "taken" && status !== "planned") {
+      throw new import_errors.ValidationError(`status must be taken or planned (got ${status})`);
+    }
+    const created = absences.create({
+      userId,
+      typeCode: (_a2 = optionalString(body, "typeCode")) != null ? _a2 : void 0,
+      typeId: (_b2 = optionalNumber(body, "typeId")) != null ? _b2 : void 0,
+      dateFrom: requireString(body, "dateFrom"),
+      dateTo: (_c2 = optionalString(body, "dateTo")) != null ? _c2 : void 0,
+      dayPortion: (_d2 = optionalNumber(body, "dayPortion")) != null ? _d2 : void 0,
+      hours: optionalNumber(body, "hours"),
+      status: status != null ? status : void 0,
+      note: optionalString(body, "note"),
+      actorId: context.auth.user.id,
+      actorIp: (_e = context.request.remoteAddress) != null ? _e : null,
+      now: now()
+    });
+    emit({ type: "absence.change", userId, data: { absenceId: created.id, action: "created" } });
+    return (0, import_router.json)(201, { absence: publicAbsence(created) }, { location: `/absences/${created.id}` });
+  });
+  route("POST", "/absences/:id/status", { permission: "absence.approve", csrf: true }, (context) => {
+    var _a2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const status = requireString(context.jsonBody(), "status");
+    if (status !== "taken" && status !== "planned") {
+      throw new import_errors.ValidationError(`status must be taken or planned (got ${status})`);
+    }
+    const updated = absences.setStatus({
+      id: numberParam(context, "id"),
+      status,
+      actorId: context.auth.user.id,
+      actorIp: (_a2 = context.request.remoteAddress) != null ? _a2 : null,
+      now: now()
+    });
+    emit({ type: "absence.change", userId: updated.userId, data: { absenceId: updated.id, action: "status" } });
+    return (0, import_router.json)(200, { absence: publicAbsence(updated) });
+  });
+  const changeableAbsence = (context) => {
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const absence = absences.findById(numberParam(context, "id"));
+    if (!absence) {
+      throw new import_errors.NotFoundError(`absence ${context.params.id} not found`);
+    }
+    if (absence.userId !== context.auth.user.id && !context.auth.permissions.includes("absence.edit_other")) {
+      throw (0, import_problem.problem)(403, "permission_denied", "request rejected (permission_denied: absence.edit_other)");
+    }
+    return absence;
+  };
+  route("PATCH", "/absences/:id", { permission: "absence.request", csrf: true }, (context) => {
+    var _a2, _b2, _c2, _d2, _e, _f, _g, _h, _i, _j, _k, _l, _m;
+    const absence = changeableAbsence(context);
+    const body = context.jsonBody();
+    const status = optionalString(body, "status");
+    if (status !== null && status !== "taken" && status !== "planned") {
+      throw new import_errors.ValidationError(`status must be taken or planned (got ${status})`);
+    }
+    if (status !== null && !((_a2 = context.auth) == null ? void 0 : _a2.permissions.includes("absence.approve"))) {
+      throw (0, import_problem.problem)(403, "permission_denied", "request rejected (permission_denied: absence.approve)");
+    }
+    const patch = {
+      typeId: (_b2 = optionalNumber(body, "typeId")) != null ? _b2 : void 0,
+      typeCode: (_c2 = optionalString(body, "typeCode")) != null ? _c2 : void 0,
+      dateFrom: (_d2 = optionalString(body, "dateFrom")) != null ? _d2 : void 0,
+      dateTo: (_e = optionalString(body, "dateTo")) != null ? _e : void 0,
+      dayPortion: (_f = optionalNumber(body, "dayPortion")) != null ? _f : void 0,
+      ...Object.prototype.hasOwnProperty.call(body, "hours") ? { hours: optionalNumber(body, "hours") } : {},
+      ...Object.prototype.hasOwnProperty.call(body, "note") ? { note: optionalString(body, "note") } : {}
+    };
+    const hasFields = Object.values(patch).some((value) => value !== void 0);
+    if (status !== null) {
+      absences.setStatus({
+        id: absence.id,
+        status,
+        actorId: (_h = (_g = context.auth) == null ? void 0 : _g.user.id) != null ? _h : 0,
+        actorIp: (_i = context.request.remoteAddress) != null ? _i : null,
+        now: now()
+      });
+    }
+    const updated = hasFields ? absences.update({
+      id: absence.id,
+      patch,
+      reason: optionalString(body, "reason"),
+      actorId: (_k = (_j = context.auth) == null ? void 0 : _j.user.id) != null ? _k : 0,
+      actorIp: (_l = context.request.remoteAddress) != null ? _l : null,
+      now: now()
+    }) : (_m = absences.findById(absence.id)) != null ? _m : absence;
+    emit({ type: "absence.change", userId: updated.userId, data: { absenceId: updated.id, action: "updated" } });
+    return (0, import_router.json)(200, { absence: publicAbsence(updated) });
+  });
+  route("DELETE", "/absences/:id", { permission: "absence.request", csrf: true }, (context) => {
+    var _a2, _b2, _c2;
+    const absence = changeableAbsence(context);
+    const removed = absences.remove({
+      id: absence.id,
+      actorId: (_b2 = (_a2 = context.auth) == null ? void 0 : _a2.user.id) != null ? _b2 : 0,
+      actorIp: (_c2 = context.request.remoteAddress) != null ? _c2 : null,
+      now: now()
+    });
+    if (!removed) {
+      throw new import_errors.NotFoundError(`absence ${absence.id} not found`);
+    }
+    emit({ type: "absence.change", userId: absence.userId, data: { absenceId: absence.id, action: "deleted" } });
+    return (0, import_router.noContent)();
+  });
+  route(
+    "GET",
+    "/absence-types",
+    {},
+    (context) => {
+      var _a2, _b2;
+      return (0, import_router.json)(200, { types: absences.types({ userId: (_b2 = (_a2 = context.auth) == null ? void 0 : _a2.user.id) != null ? _b2 : null }) });
+    }
+  );
+  route("POST", "/absence-types", { permission: "absence.manage_types", csrf: true }, (context) => {
+    var _a2, _b2, _c2, _d2, _e;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const body = context.jsonBody();
+    const result = absences.upsertType({
+      userId: optionalNumber(body, "userId"),
+      code: requireString(body, "code"),
+      name: requireString(body, "name"),
+      paid: (_a2 = optionalBoolean(body, "paid")) != null ? _a2 : void 0,
+      factor: (_b2 = optionalNumber(body, "factor")) != null ? _b2 : void 0,
+      reduceVacation: (_c2 = optionalBoolean(body, "reduceVacation")) != null ? _c2 : void 0,
+      isActive: (_d2 = optionalBoolean(body, "isActive")) != null ? _d2 : void 0,
+      actorId: context.auth.user.id,
+      actorIp: (_e = context.request.remoteAddress) != null ? _e : null,
+      now: now()
+    });
+    return (0, import_router.json)(result.created ? 201 : 200, { type: result.type, created: result.created });
+  });
+  route("GET", "/holidays", { permission: "report.view_own" }, (context) => {
+    var _a2;
+    const year = numberQuery(context, "year");
+    const region = (_a2 = context.query("region")) != null ? _a2 : void 0;
+    return (0, import_router.json)(200, { year, region: region != null ? region : null, holidays: holidays.listByYear(year, region) });
+  });
+  route("POST", "/holidays", { permission: "holiday.manage", csrf: true }, (context) => {
+    var _a2, _b2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const body = context.jsonBody();
+    const created = holidays.add({
+      date: requireString(body, "date"),
+      name: requireString(body, "name"),
+      region: (_a2 = optionalString(body, "region")) != null ? _a2 : void 0,
+      actorId: context.auth.user.id,
+      actorIp: (_b2 = context.request.remoteAddress) != null ? _b2 : null,
+      now: now()
+    });
+    return (0, import_router.json)(201, { holiday: created }, { location: `/holidays/${created.id}` });
+  });
+  route("DELETE", "/holidays/:id", { permission: "holiday.manage", csrf: true }, (context) => {
+    var _a2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const removed = holidays.remove({
+      id: numberParam(context, "id"),
+      actorId: context.auth.user.id,
+      actorIp: (_a2 = context.request.remoteAddress) != null ? _a2 : null,
+      now: now()
+    });
+    if (!removed) {
+      throw new import_errors.NotFoundError(`holiday ${context.params.id} not found`);
+    }
+    return (0, import_router.noContent)();
+  });
+  route(
+    "GET",
+    "/settings",
+    { permission: "settings.view" },
+    () => (0, import_router.json)(200, { settings: readableSettings(settings.all()) })
+  );
+  route("PUT", "/settings", { permission: "settings.edit", csrf: true }, (context) => {
+    var _a2, _b2;
+    const body = context.jsonBody();
+    const changes = {};
+    for (const [key, value] of Object.entries(body)) {
+      if (!editableSettings().includes(key)) {
+        throw new import_errors.ValidationError(`setting "${key}" cannot be changed through the API`);
+      }
+      if (key === "brand_logo" || key === "brand_background") {
+        const raw = typeof value === "string" ? value.trim() : "";
+        if (raw !== "" && !(0, import_avatar.parseAvatarDataUrl)(raw, import_avatar.MAX_BRANDING_BYTES)) {
+          throw new import_errors.ValidationError(
+            `setting "${key}" must be a data URL of a png, jpeg, webp or gif of up to ${import_avatar.MAX_BRANDING_BYTES} bytes`
+          );
+        }
+        changes[key] = raw;
+        continue;
+      }
+      if (key === "brand_color") {
+        const raw = typeof value === "string" ? value.trim() : "";
+        if (raw !== "" && !/^#[0-9a-f]{3}([0-9a-f]{3})?$/i.test(raw)) {
+          throw new import_errors.ValidationError('setting "brand_color" must be a hex colour like "#1a2b3c"');
+        }
+        changes[key] = raw;
+        continue;
+      }
+      if (key === "pause_mode") {
+        if (value !== "auto" && value !== "punched" && value !== "staffel") {
+          throw new import_errors.ValidationError('setting "pause_mode" must be "auto", "punched" or "staffel"');
+        }
+        changes[key] = value;
+        continue;
+      }
+      if (!isSettingValue(value, JSON_SETTINGS.includes(key))) {
+        throw new import_errors.ValidationError(`setting "${key}" has an unsupported value`);
+      }
+      changes[key] = value;
+    }
+    if (Object.keys(changes).length === 0) {
+      throw new import_errors.ValidationError("no settings given");
+    }
+    for (const [key, value] of Object.entries(changes)) {
+      settings.set(key, value, (_b2 = (_a2 = context.auth) == null ? void 0 : _a2.user.id) != null ? _b2 : null, now());
+    }
+    return (0, import_router.json)(200, { settings: changes });
+  });
+  function replacePauseRules(context, userId) {
+    var _a2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const body = context.jsonBody();
+    if (!Array.isArray(body.pauseRules)) {
+      throw new import_errors.ValidationError("pauseRules must be an array");
+    }
+    const actor = {
+      actorId: context.auth.user.id,
+      actorIp: (_a2 = context.request.remoteAddress) != null ? _a2 : null,
+      now: now()
+    };
+    const wanted = body.pauseRules.map((raw) => {
+      var _a3, _b2;
+      const rule = raw != null ? raw : {};
+      return {
+        id: (_a3 = optionalNumber(rule, "id")) != null ? _a3 : void 0,
+        fromMin: Number(rule.fromMin),
+        toMin: optionalNumber(rule, "toMin"),
+        pauseMin: Number(rule.pauseMin),
+        isActive: (_b2 = optionalBoolean(rule, "isActive")) != null ? _b2 : void 0
+      };
+    });
+    const keep = new Set(wanted.map((rule) => rule.id).filter((value) => value !== void 0));
+    for (const existing of rules.listPauseRules({ userId, includeInactive: true })) {
+      if (!keep.has(existing.id)) {
+        rules.removePauseRule({ id: existing.id, ...actor });
+      }
+    }
+    return wanted.map(
+      (rule) => rules.savePauseRule({
+        ...rule.id !== void 0 ? { id: rule.id } : {},
+        userId,
+        fromMin: rule.fromMin,
+        toMin: rule.toMin,
+        pauseMin: rule.pauseMin,
+        ...rule.isActive !== void 0 ? { isActive: rule.isActive } : {},
+        ...actor
+      })
+    );
+  }
+  route(
+    "GET",
+    "/pause-rules",
+    { permission: "settings.view" },
+    () => (0, import_router.json)(200, { pauseRules: rules.listPauseRules({ userId: null, includeInactive: true }) })
+  );
+  route(
+    "PUT",
+    "/pause-rules",
+    { permission: "settings.edit", csrf: true },
+    (context) => (0, import_router.json)(200, { pauseRules: replacePauseRules(context, null) })
+  );
+  route("GET", "/users/:id/pause-rules", { permission: "user.view" }, (context) => {
+    const id = numberParam(context, "id");
+    if (!users.findById(id)) {
+      throw new import_errors.NotFoundError(`user ${id} not found`);
+    }
+    return (0, import_router.json)(200, { pauseRules: rules.listPauseRules({ userId: id, includeInactive: true }) });
+  });
+  route("PUT", "/users/:id/pause-rules", { permission: "user.edit", csrf: true }, (context) => {
+    const id = numberParam(context, "id");
+    if (!users.findById(id)) {
+      throw new import_errors.NotFoundError(`user ${id} not found`);
+    }
+    return (0, import_router.json)(200, { pauseRules: replacePauseRules(context, id) });
+  });
+  function replaceTriggerRules(context) {
+    var _a2, _b2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const body = context.jsonBody();
+    if (!Array.isArray(body.triggerRules)) {
+      throw new import_errors.ValidationError("triggerRules must be an array");
+    }
+    const actor = {
+      actorId: context.auth.user.id,
+      actorIp: (_a2 = context.request.remoteAddress) != null ? _a2 : null,
+      now: now()
+    };
+    const wanted = body.triggerRules.map((raw) => {
+      var _a3, _b3, _c2, _d2, _e, _f;
+      const rule = raw != null ? raw : {};
+      const mode = (_a3 = optionalString(rule, "mode")) != null ? _a3 : "condition";
+      const target = optionalNumber(rule, "userId");
+      if (mode === "condition" && target !== null && !users.findById(target)) {
+        throw new import_errors.ValidationError(`userId must reference an existing employee (got ${target})`);
+      }
+      if (mode === "user" && target !== null) {
+        throw new import_errors.ValidationError("mode user reads the employee from the state, userId has to stay empty");
+      }
+      return {
+        id: (_b3 = optionalNumber(rule, "id")) != null ? _b3 : void 0,
+        label: optionalString(rule, "label"),
+        sourceState: (_c2 = optionalString(rule, "sourceState")) != null ? _c2 : "",
+        mode,
+        condition: optionalString(rule, "condition"),
+        userId: target,
+        action: (_d2 = optionalString(rule, "action")) != null ? _d2 : "punch",
+        isActive: (_e = optionalBoolean(rule, "isActive")) != null ? _e : true,
+        cooldownSec: (_f = optionalNumber(rule, "cooldownSec")) != null ? _f : 0
+      };
+    });
+    const keep = new Set(wanted.map((rule) => rule.id).filter((value) => value !== void 0));
+    for (const existing of triggers.list({ includeInactive: true })) {
+      if (!keep.has(existing.id)) {
+        triggers.remove({ id: existing.id, ...actor });
+      }
+    }
+    const saved = wanted.map(
+      (rule) => triggers.save({
+        ...rule.id !== void 0 ? { id: rule.id } : {},
+        label: rule.label,
+        sourceState: rule.sourceState,
+        mode: rule.mode,
+        condition: rule.condition,
+        userId: rule.userId,
+        action: rule.action,
+        isActive: rule.isActive,
+        cooldownSec: rule.cooldownSec,
+        ...actor
+      })
+    );
+    (_b2 = deps.onTriggerRulesChanged) == null ? void 0 : _b2.call(deps);
+    return saved;
+  }
+  route(
+    "GET",
+    "/trigger-rules",
+    { permission: "settings.view" },
+    () => (0, import_router.json)(200, { triggerRules: triggers.list({ includeInactive: true }) })
+  );
+  route(
+    "PUT",
+    "/trigger-rules",
+    { permission: "settings.edit", csrf: true },
+    (context) => (0, import_router.json)(200, { triggerRules: replaceTriggerRules(context) })
+  );
+  function replaceAutomationRules(context) {
+    var _a2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const body = context.jsonBody();
+    if (!Array.isArray(body.automationRules)) {
+      throw new import_errors.ValidationError("automationRules must be an array");
+    }
+    const actor = {
+      actorId: context.auth.user.id,
+      actorIp: (_a2 = context.request.remoteAddress) != null ? _a2 : null,
+      now: now()
+    };
+    const wanted = body.automationRules.map((raw) => {
+      var _a3, _b2, _c2;
+      const rule = raw != null ? raw : {};
+      const target = optionalNumber(rule, "userId");
+      if (target !== null && !users.findById(target)) {
+        throw new import_errors.ValidationError(`userId must reference an existing employee (got ${target})`);
+      }
+      return {
+        id: (_a3 = optionalNumber(rule, "id")) != null ? _a3 : void 0,
+        label: optionalString(rule, "label"),
+        kind: (_b2 = optionalString(rule, "kind")) != null ? _b2 : "clockOut",
+        userId: target,
+        atMinute: optionalNumber(rule, "atMinute"),
+        afterMinutes: optionalNumber(rule, "afterMinutes"),
+        // the repository validates the selection and the repeat: a wrong entry comes back as a 400
+        weekdays: Array.isArray(rule.weekdays) ? rule.weekdays.map(Number) : void 0,
+        repeat: optionalString(rule, "repeat"),
+        isActive: (_c2 = optionalBoolean(rule, "isActive")) != null ? _c2 : true
+      };
+    });
+    const keep = new Set(wanted.map((rule) => rule.id).filter((value) => value !== void 0));
+    for (const existing of automations.list({ includeInactive: true })) {
+      if (!keep.has(existing.id)) {
+        automations.remove({ id: existing.id, ...actor });
+      }
+    }
+    return wanted.map(
+      (rule) => automations.save({
+        ...rule.id !== void 0 ? { id: rule.id } : {},
+        label: rule.label,
+        kind: rule.kind,
+        userId: rule.userId,
+        atMinute: rule.atMinute,
+        afterMinutes: rule.afterMinutes,
+        ...rule.weekdays === void 0 ? {} : { weekdays: rule.weekdays },
+        ...rule.repeat === void 0 ? {} : { repeat: rule.repeat },
+        isActive: rule.isActive,
+        ...actor
+      })
+    );
+  }
+  route(
+    "GET",
+    "/automation-rules",
+    { permission: "settings.view" },
+    () => (0, import_router.json)(200, { automationRules: automations.list({ includeInactive: true }) })
+  );
+  route(
+    "GET",
+    "/automation-rules/runs",
+    { permission: "settings.view" },
+    () => (0, import_router.json)(200, { runs: automations.runs({ limit: 20 }) })
+  );
+  route(
+    "PUT",
+    "/automation-rules",
+    { permission: "settings.edit", csrf: true },
+    (context) => (0, import_router.json)(200, { automationRules: replaceAutomationRules(context) })
+  );
+  const brandingVersion = (value) => (0, import_node_crypto.createHash)("sha256").update(value).digest("hex").slice(0, 12);
+  const brandingState = () => {
+    var _a2, _b2, _c2;
+    const color = ((_a2 = settings.get("brand_color")) != null ? _a2 : "").trim();
+    const logo = ((_b2 = settings.get("brand_logo")) != null ? _b2 : "").trim();
+    const background = ((_c2 = settings.get("brand_background")) != null ? _c2 : "").trim();
+    return {
+      color: color === "" ? null : color,
+      logoUrl: logo === "" ? null : `/api/branding/logo?v=${brandingVersion(logo)}`,
+      backgroundUrl: background === "" ? null : `/api/branding/background?v=${brandingVersion(background)}`
+    };
+  };
+  route("GET", "/branding", { public: true }, () => (0, import_router.json)(200, brandingState()));
+  route("GET", "/branding/logo", { public: true }, () => {
+    const image = (0, import_avatar.readAvatar)(settings.get("brand_logo"));
+    if (!image) {
+      throw new import_errors.NotFoundError("no logo is configured");
+    }
+    return (0, import_router.binary)(200, Buffer.from(image.base64, "base64"), image.contentType, {
+      "cache-control": "public, max-age=86400"
+    });
+  });
+  route("GET", "/branding/background", { public: true }, () => {
+    const image = (0, import_avatar.readAvatar)(settings.get("brand_background"));
+    if (!image) {
+      throw new import_errors.NotFoundError("no background is configured");
+    }
+    return (0, import_router.binary)(200, Buffer.from(image.base64, "base64"), image.contentType, {
+      "cache-control": "public, max-age=86400"
+    });
+  });
+  route(
+    "GET",
+    "/version",
+    { public: true },
+    () => {
+      var _a2;
+      return (0, import_router.json)(200, { name: "iobroker.time-tracker", version: (_a2 = deps.version) != null ? _a2 : "0.0.0" });
+    }
+  );
+  route("PATCH", "/entries/:id", { permission: "time.edit_own", csrf: true }, (context) => {
+    var _a2, _b2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const entryId = numberParam(context, "id");
+    const existing = entries.findById(entryId);
+    if (!existing) {
+      throw new import_errors.NotFoundError(`entry ${entryId} not found`);
+    }
+    if (existing.userId !== context.auth.user.id && !context.auth.permissions.includes("time.edit_other")) {
+      throw (0, import_problem.problem)(403, "permission_denied", "request rejected (permission_denied: time.edit_other)");
+    }
+    const body = context.jsonBody();
+    const revision = optionalNumber(body, "revision");
+    if (revision === null) {
+      throw new import_errors.ValidationError("revision is required");
+    }
+    requireInsideEditWindow(context, existing.userId, existing.tsUtc);
+    const wantedTs = optionalNumber(body, "tsUtc");
+    if (wantedTs !== null) {
+      requireInsideEditWindow(context, existing.userId, wantedTs);
+    }
+    const target = users.findById(existing.userId);
+    if (!target) {
+      throw new import_errors.NotFoundError(`user ${existing.userId} not found`);
+    }
+    const updated = entries.update({
+      id: entryId,
+      expectedRevision: revision,
+      patch: {
+        tsUtc: (_a2 = optionalNumber(body, "tsUtc")) != null ? _a2 : void 0,
+        note: optionalString(body, "note")
+      },
+      reason: optionalString(body, "reason"),
+      actorId: context.auth.user.id,
+      actorIp: (_b2 = context.request.remoteAddress) != null ? _b2 : null,
+      timeZone: target.timezone,
+      now: now()
+    });
+    const day = aggregation.recalculateDay(updated.userId, updated.localDate, { now: now() });
+    emit({
+      type: "entry.update",
+      userId: updated.userId,
+      data: { entryId: updated.id, localDate: updated.localDate, revision: updated.revision }
+    });
+    return (0, import_router.json)(200, { entry: updated, day });
+  });
+  route("DELETE", "/entries/:id", { permission: "time.delete", csrf: true }, (context) => {
+    var _a2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const entryId = numberParam(context, "id");
+    const existing = entries.findById(entryId);
+    if (!existing) {
+      throw new import_errors.NotFoundError(`entry ${entryId} not found`);
+    }
+    entries.remove({
+      id: entryId,
+      actorId: context.auth.user.id,
+      reason: optionalString(context.optionalJsonBody(), "reason"),
+      actorIp: (_a2 = context.request.remoteAddress) != null ? _a2 : null,
+      now: now()
+    });
+    aggregation.recalculateDay(existing.userId, existing.localDate, { now: now() });
+    emit({
+      type: "entry.delete",
+      userId: existing.userId,
+      data: { entryId: existing.id, localDate: existing.localDate }
+    });
+    return (0, import_router.noContent)();
+  });
+  route("GET", "/entries/:id/audit", { permission: "audit.view" }, (context) => {
+    const entryId = numberParam(context, "id");
+    if (!entries.findById(entryId)) {
+      throw new import_errors.NotFoundError(`entry ${entryId} not found`);
+    }
+    return (0, import_router.json)(200, {
+      audit: (0, import_audit.readTimeEntryAudit)(deps.db, entryId).map((row) => {
+        var _a2, _b2;
+        return {
+          ...row,
+          actorName: (_b2 = (_a2 = users.findById(row.actorId)) == null ? void 0 : _a2.displayName) != null ? _b2 : null
+        };
+      })
+    });
+  });
+  route("GET", "/users", { permission: "user.view" }, (context) => {
+    var _a2;
+    const includeInactive = context.query("includeInactive") === "true";
+    const search = ((_a2 = context.query("q")) != null ? _a2 : "").trim().toLowerCase();
+    const limit = optionalNumberQuery(context, "limit", Number.MAX_SAFE_INTEGER);
+    const offset = optionalNumberQuery(context, "offset", 0);
+    const all = users.list({ includeInactive });
+    const filtered = search ? all.filter(
+      (user) => user.login.toLowerCase().includes(search) || user.displayName.toLowerCase().includes(search)
+    ) : all;
+    return (0, import_router.json)(200, {
+      total: filtered.length,
+      offset,
+      users: filtered.slice(offset, offset + limit).map((user) => ({
+        ...publicUser(user),
+        roles: users.roles(user.id)
+      }))
+    });
+  });
+  route("GET", "/users/:id", { permission: "user.view" }, (context) => {
+    const id = numberParam(context, "id");
+    const user = users.findById(id);
+    if (!user) {
+      throw new import_errors.NotFoundError(`user ${id} not found`);
+    }
+    return (0, import_router.json)(200, {
+      user: { ...publicUser(user), roles: users.roles(id), permissions: users.permissions(id) },
+      profile: users.getWorkProfile(id)
+    });
+  });
+  route("POST", "/users", { permission: "user.create", csrf: true }, (context) => {
+    var _a2, _b2, _c2, _d2, _e;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const body = context.jsonBody();
+    const password = requireString(body, "password");
+    const policyIssue = (0, import_auth.checkPasswordPolicy)(password);
+    if (policyIssue) {
+      throw new import_errors.ValidationError(policyIssue);
+    }
+    const created = users.create({
+      login: requireString(body, "login"),
+      displayName: requireString(body, "displayName"),
+      passwordHash: (0, import_auth.hashPassword)(password),
+      email: optionalString(body, "email"),
+      locale: (_a2 = optionalString(body, "locale")) != null ? _a2 : void 0,
+      timezone: (_b2 = optionalString(body, "timezone")) != null ? _b2 : void 0,
+      mustChangePw: (_c2 = optionalBoolean(body, "mustChangePw")) != null ? _c2 : void 0,
+      roleKeys: (_d2 = readRoleKeys(body)) != null ? _d2 : void 0,
+      actorId: context.auth.user.id,
+      actorIp: (_e = context.request.remoteAddress) != null ? _e : null,
+      now: now()
+    });
+    return (0, import_router.json)(
+      201,
+      { user: { ...publicUser(created), roles: users.roles(created.id) } },
+      { location: `/users/${created.id}` }
+    );
+  });
+  route("GET", "/roles", { permission: "user.view" }, () => (0, import_router.json)(200, { roles: users.roleCatalog() }));
+  route("GET", "/users/:id/avatar", { public: true }, (context) => {
+    var _a2, _b2, _c2;
+    const id = numberParam(context, "id");
+    const terminalSession = (_a2 = context.query("terminalSession")) != null ? _a2 : "";
+    const browserToken = (_c2 = (_b2 = context.header("x-session-token")) != null ? _b2 : (0, import_cookies.parseCookies)(context.header("cookie"))[import_cookies.SESSION_COOKIE]) != null ? _c2 : "";
+    const browserOk = browserToken !== "" && deps.auth.authenticate({ token: browserToken, permission: void 0, now: now() }).ok;
+    const terminalOk = terminalSession !== "" && terminals.findBySession(terminalSession, now()) !== null;
+    if (!browserOk && !terminalOk) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const user = users.findById(id);
+    const image = user ? (0, import_avatar.readAvatar)(user.avatar) : null;
+    if (!image) {
+      throw new import_errors.NotFoundError(`user ${id} has no picture`);
+    }
+    return (0, import_router.binary)(200, Buffer.from(image.base64, "base64"), image.contentType, {
+      "cache-control": "private, max-age=300"
+    });
+  });
+  route("PATCH", "/users/:id", { permission: "user.edit", csrf: true }, (context) => {
+    var _a2, _b2, _c2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const id = numberParam(context, "id");
+    if (!users.findById(id)) {
+      throw new import_errors.NotFoundError(`user ${id} not found`);
+    }
+    const body = context.jsonBody();
+    const roleKeys = readRoleKeys(body);
+    if (roleKeys !== null && !context.auth.permissions.includes("user.manage_roles")) {
+      throw (0, import_problem.problem)(403, "permission_denied", "request rejected (permission_denied: user.manage_roles)");
+    }
+    const password = optionalString(body, "password");
+    if (password !== null) {
+      const policyIssue = (0, import_auth.checkPasswordPolicy)(password);
+      if (policyIssue) {
+        throw new import_errors.ValidationError(policyIssue);
+      }
+    }
+    const patch = {};
+    if (Object.prototype.hasOwnProperty.call(body, "displayName")) {
+      patch.displayName = requireString(body, "displayName");
+    }
+    if (Object.prototype.hasOwnProperty.call(body, "email")) {
+      patch.email = optionalString(body, "email");
+    }
+    if (Object.prototype.hasOwnProperty.call(body, "locale")) {
+      patch.locale = requireString(body, "locale");
+    }
+    if (Object.prototype.hasOwnProperty.call(body, "timezone")) {
+      const timezone = requireString(body, "timezone");
+      if (!(0, import_time.isValidTimeZone)(timezone)) {
+        throw new import_errors.ValidationError(`timezone is not a valid IANA name (got ${timezone})`);
+      }
+      patch.timezone = timezone;
+    }
+    if (Object.prototype.hasOwnProperty.call(body, "rfidCard")) {
+      patch.rfidCard = optionalString(body, "rfidCard");
+    }
+    if (Object.prototype.hasOwnProperty.call(body, "mustChangePw")) {
+      patch.mustChangePw = requireBoolean(body, "mustChangePw");
+    }
+    const isActive = optionalBoolean(body, "isActive");
+    if (isActive !== null) {
+      if (isActive === false && id === context.auth.user.id) {
+        throw new import_errors.ValidationError("an account cannot deactivate itself");
+      }
+      patch.isActive = isActive;
+    }
+    if (password !== null) {
+      patch.passwordHash = (0, import_auth.hashPassword)(password);
+    }
+    if (Object.prototype.hasOwnProperty.call(body, "avatar")) {
+      const avatar = optionalString(body, "avatar");
+      if (avatar !== null && !(0, import_avatar.parseAvatarDataUrl)(avatar)) {
+        throw new import_errors.ValidationError(
+          `avatar must be a data URL of a png, jpeg, webp or gif of up to ${import_avatar.MAX_AVATAR_BYTES} bytes`
+        );
+      }
+      users.setAvatar({
+        userId: id,
+        avatar,
+        actorId: context.auth.user.id,
+        actorIp: (_a2 = context.request.remoteAddress) != null ? _a2 : null,
+        now: now()
+      });
+    }
+    const updated = users.update({
+      id,
+      patch,
+      reason: optionalString(body, "reason"),
+      actorId: context.auth.user.id,
+      actorIp: (_b2 = context.request.remoteAddress) != null ? _b2 : null,
+      now: now()
+    });
+    const roles = roleKeys ? users.setRoles({
+      userId: id,
+      roleKeys,
+      actorId: context.auth.user.id,
+      actorIp: (_c2 = context.request.remoteAddress) != null ? _c2 : null,
+      now: now()
+    }) : users.roles(id);
+    return (0, import_router.json)(200, { user: { ...publicUser(updated), roles } });
+  });
+  route("DELETE", "/users/:id", { permission: "user.deactivate", csrf: true }, (context) => {
+    var _a2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const id = numberParam(context, "id");
+    const target = users.findById(id);
+    if (!target) {
+      throw new import_errors.NotFoundError(`user ${id} not found`);
+    }
+    if (!target.isActive) {
+      throw new import_errors.NotFoundError(`user ${id} is already deactivated`);
+    }
+    if (id === context.auth.user.id) {
+      throw new import_errors.ValidationError("an account cannot deactivate itself");
+    }
+    users.update({
+      id,
+      patch: { isActive: false },
+      reason: optionalString(context.optionalJsonBody(), "reason"),
+      actorId: context.auth.user.id,
+      actorIp: (_a2 = context.request.remoteAddress) != null ? _a2 : null,
+      now: now()
+    });
+    return (0, import_router.noContent)();
+  });
+  route("GET", "/users/:id/profile", { permission: "user.view" }, (context) => {
+    const id = numberParam(context, "id");
+    if (!users.findById(id)) {
+      throw new import_errors.NotFoundError(`user ${id} not found`);
+    }
+    return (0, import_router.json)(200, { profile: users.getWorkProfile(id) });
+  });
+  route("PUT", "/users/:id/profile", { permission: "user.edit", csrf: true }, (context) => {
+    var _a2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const id = numberParam(context, "id");
+    if (!users.findById(id)) {
+      throw new import_errors.NotFoundError(`user ${id} not found`);
+    }
+    const body = context.jsonBody();
+    const profile = users.saveWorkProfile({
+      userId: id,
+      profile: readProfilePatch(body),
+      actorId: context.auth.user.id,
+      actorIp: (_a2 = context.request.remoteAddress) != null ? _a2 : null,
+      now: now()
+    });
+    return (0, import_router.json)(200, { profile });
+  });
+  route("GET", "/users/:id/shift-rules", { permission: "user.view" }, (context) => {
+    const id = numberParam(context, "id");
+    if (!users.findById(id)) {
+      throw new import_errors.NotFoundError(`user ${id} not found`);
+    }
+    return (0, import_router.json)(200, { shiftRules: rules.shiftRules(id, { includeInactive: true }) });
+  });
+  route("PUT", "/users/:id/shift-rules", { permission: "user.edit", csrf: true }, (context) => {
+    var _a2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const id = numberParam(context, "id");
+    if (!users.findById(id)) {
+      throw new import_errors.NotFoundError(`user ${id} not found`);
+    }
+    const body = context.jsonBody();
+    if (!Array.isArray(body.shiftRules)) {
+      throw new import_errors.ValidationError("shiftRules must be an array");
+    }
+    const actor = {
+      actorId: context.auth.user.id,
+      actorIp: (_a2 = context.request.remoteAddress) != null ? _a2 : null,
+      now: now()
+    };
+    const wanted = body.shiftRules.map((raw) => {
+      var _a3, _b2;
+      const rule = raw != null ? raw : {};
+      return {
+        id: (_a3 = optionalNumber(rule, "id")) != null ? _a3 : void 0,
+        surcharge: Number(rule.surcharge),
+        dayOfWeek: optionalNumber(rule, "dayOfWeek"),
+        fromMin: optionalNumber(rule, "fromMin"),
+        toMin: optionalNumber(rule, "toMin"),
+        isActive: (_b2 = optionalBoolean(rule, "isActive")) != null ? _b2 : void 0
+      };
+    });
+    const keep = new Set(wanted.map((rule) => rule.id).filter((value) => value !== void 0));
+    for (const existing of rules.shiftRules(id, { includeInactive: true })) {
+      if (!keep.has(existing.id)) {
+        rules.removeShiftRule({ id: existing.id, ...actor });
+      }
+    }
+    const saved = wanted.map(
+      (rule) => rules.saveShiftRule({
+        ...rule.id !== void 0 ? { id: rule.id } : {},
+        userId: id,
+        surcharge: rule.surcharge,
+        ...rule.dayOfWeek !== null ? { dayOfWeek: rule.dayOfWeek } : {},
+        ...rule.fromMin !== null ? { fromMin: rule.fromMin } : {},
+        ...rule.toMin !== null ? { toMin: rule.toMin } : {},
+        ...rule.isActive !== void 0 ? { isActive: rule.isActive } : {},
+        ...actor
+      })
+    );
+    return (0, import_router.json)(200, { shiftRules: saved });
+  });
+  route("GET", "/payouts", { permission: "payout.view" }, (context) => {
+    var _a2, _b2, _c2;
+    const requested = context.query("userId");
+    const userId = requested ? Number(requested) : (_b2 = (_a2 = context.auth) == null ? void 0 : _a2.user.id) != null ? _b2 : 0;
+    if (!Number.isInteger(userId)) {
+      throw new import_errors.ValidationError("userId must be a whole number");
+    }
+    const period = readPeriod(context.query("year"), context.query("month"));
+    const list = payouts.list(
+      userId,
+      period.month === null ? { year: period.year } : { year: period.year, month: period.month }
+    );
+    return (0, import_router.json)(200, {
+      userId,
+      ...period,
+      totalMinutes: payouts.sumMinutes(userId, period.year, (_c2 = period.month) != null ? _c2 : void 0),
+      payouts: list
+    });
+  });
+  route("POST", "/payouts", { permission: "payout.create", csrf: true }, (context) => {
+    var _a2, _b2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const body = context.jsonBody();
+    const target = Number((_a2 = body.userId) != null ? _a2 : context.auth.user.id);
+    if (!Number.isInteger(target) || !users.findById(target)) {
+      throw new import_errors.ValidationError("userId must reference an existing employee");
+    }
+    const period = readPeriod(body.year, body.month);
+    const minutes = optionalNumber(body, "minutes");
+    if (minutes === null || !Number.isInteger(minutes) || minutes === 0) {
+      throw new import_errors.ValidationError("minutes must be a non-zero whole number");
+    }
+    const created = payouts.create({
+      userId: target,
+      ...period,
+      minutes,
+      amount: optionalNumber(body, "amount"),
+      note: optionalString(body, "note"),
+      actorId: context.auth.user.id,
+      actorIp: (_b2 = context.request.remoteAddress) != null ? _b2 : null,
+      now: now()
+    });
+    return (0, import_router.json)(201, { payout: created }, { location: `/payouts/${created.id}` });
+  });
+  route("PATCH", "/payouts/:id", { permission: "payout.create", csrf: true }, (context) => {
+    var _a2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const id = numberParam(context, "id");
+    if (!payouts.findById(id)) {
+      throw new import_errors.NotFoundError(`payout ${id} not found`);
+    }
+    const body = context.jsonBody();
+    const minutes = optionalNumber(body, "minutes");
+    if (minutes !== null && (!Number.isInteger(minutes) || minutes === 0)) {
+      throw new import_errors.ValidationError("minutes must be a non-zero whole number");
+    }
+    const updated = payouts.update({
+      id,
+      patch: {
+        ...minutes !== null ? { minutes } : {},
+        ...Object.prototype.hasOwnProperty.call(body, "amount") ? { amount: optionalNumber(body, "amount") } : {},
+        ...Object.prototype.hasOwnProperty.call(body, "note") ? { note: optionalString(body, "note") } : {}
+      },
+      actorId: context.auth.user.id,
+      actorIp: (_a2 = context.request.remoteAddress) != null ? _a2 : null,
+      now: now()
+    });
+    return (0, import_router.json)(200, { payout: updated });
+  });
+  route("DELETE", "/payouts/:id", { permission: "payout.create", csrf: true }, (context) => {
+    var _a2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const removed = payouts.remove({
+      id: numberParam(context, "id"),
+      actorId: context.auth.user.id,
+      actorIp: (_a2 = context.request.remoteAddress) != null ? _a2 : null,
+      now: now()
+    });
+    if (!removed) {
+      throw new import_errors.NotFoundError(`payout ${context.params.id} not found`);
+    }
+    return (0, import_router.noContent)();
+  });
+  route(
+    "POST",
+    "/entries/bulk",
+    { permission: "time.import", csrf: true, rateLimit: { name: "import", limit: 10, windowSeconds: 60 } },
+    (context) => {
+      if (!context.auth) {
+        throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+      }
+      const body = context.jsonBody();
+      if (!Array.isArray(body.entries)) {
+        throw new import_errors.ValidationError("entries must be an array");
+      }
+      const actor = context.auth;
+      const timestamp = now();
+      const touched = /* @__PURE__ */ new Map();
+      const results = [];
+      body.entries.forEach((raw, index) => {
+        var _a2, _b2;
+        try {
+          const item = raw != null ? raw : {};
+          const target = Number((_a2 = item.userId) != null ? _a2 : actor.user.id);
+          if (!Number.isInteger(target)) {
+            throw new import_errors.ValidationError("userId must be a whole number");
+          }
+          if (target !== actor.user.id && !actor.permissions.includes("time.edit_other")) {
+            throw (0, import_problem.problem)(
+              403,
+              "permission_denied",
+              "request rejected (permission_denied: time.edit_other)"
+            );
+          }
+          const user = users.findById(target);
+          if (!user) {
+            throw new import_errors.NotFoundError(`user ${target} not found`);
+          }
+          const tsUtc = optionalNumber(item, "tsUtc");
+          if (tsUtc === null) {
+            throw new import_errors.ValidationError("tsUtc is required");
+          }
+          const stored = entries.insert({
+            userId: target,
+            tsUtc,
+            clientTsUtc: optionalNumber(item, "clientTsUtc"),
+            timeZone: user.timezone,
+            source: "import",
+            direction: optionalDirection(item),
+            idempotencyKey: optionalString(item, "idempotencyKey"),
+            note: optionalString(item, "note"),
+            actorId: actor.user.id,
+            actorIp: (_b2 = context.request.remoteAddress) != null ? _b2 : null,
+            now: timestamp
+          });
+          touched.set(`${target}|${stored.entry.localDate}`, target);
+          results.push({ index, entryId: stored.entry.id });
+        } catch (error) {
+          const details = (0, import_problem.toProblem)(error).problem;
+          results.push({ index, error: details.code });
+        }
+      });
+      for (const key of touched.keys()) {
+        const [userId, localDate2] = key.split("|");
+        aggregation.recalculateDay(Number(userId), localDate2, { now: timestamp });
+      }
+      const imported = results.filter((result) => result.entryId !== void 0).length;
+      for (const [key, userId] of touched) {
+        emit({
+          type: "punch",
+          userId,
+          data: { imported: true, localDate: key.split("|")[1], source: "import" }
+        });
+      }
+      return (0, import_router.json)(200, {
+        imported,
+        failed: results.length - imported,
+        recalculatedDays: touched.size,
+        results
+      });
+    }
+  );
+  route("GET", "/reports/statistics", { permission: "report.statistics" }, (context) => {
+    var _a2, _b2;
+    const from = context.query("from");
+    const to = (_a2 = context.query("to")) != null ? _a2 : from;
+    if (!from || !to) {
+      throw new import_errors.ValidationError("from and to are required");
+    }
+    if (from > to) {
+      throw new import_errors.ValidationError(`from (${from}) must not be after to (${to})`);
+    }
+    const days = (0, import_time.dateRange)(from, to).length;
+    if (days > MAX_STATISTICS_DAYS) {
+      throw new import_errors.ValidationError(`the range may cover at most ${MAX_STATISTICS_DAYS} days (got ${days})`);
+    }
+    const requested = context.query("userId");
+    if (requested) {
+      if (!((_b2 = context.auth) == null ? void 0 : _b2.permissions.includes("report.view_other"))) {
+        throw (0, import_problem.problem)(403, "permission_denied", "request rejected (permission_denied: report.view_other)");
+      }
+    }
+    const employees = requested ? [Number(requested)] : users.list({ includeInactive: false }).map((user) => user.id);
+    if (employees.some((id) => !Number.isInteger(id) || !users.findById(id))) {
+      throw new import_errors.ValidationError("userId must reference an existing employee");
+    }
+    const timestamp = now();
+    const rows = employees.map((userId) => {
+      var _a3;
+      const user = users.findById(userId);
+      const range = aggregation.recalculateRange(userId, from, to, { now: timestamp });
+      return {
+        userId,
+        displayName: (_a3 = user == null ? void 0 : user.displayName) != null ? _a3 : "",
+        ...range
+      };
+    });
+    return (0, import_router.json)(200, {
+      from,
+      to,
+      users: rows,
+      totals: rows.reduce(
+        (sum, row) => ({
+          workedMin: sum.workedMin + row.workedMin,
+          targetMin: sum.targetMin + row.targetMin,
+          balanceMin: sum.balanceMin + row.balanceMin,
+          openDays: sum.openDays + row.openDays
+        }),
+        { workedMin: 0, targetMin: 0, balanceMin: 0, openDays: 0 }
+      )
+    });
+  });
+  const requireKiosk = () => {
+    if (deps.kioskEnabled !== true) {
+      throw (0, import_problem.problem)(403, "kiosk_disabled", "the kiosk terminal is switched off in the adapter settings");
+    }
+  };
+  const TERMINAL_SESSION_MINUTES = (_d = deps.terminalSessionMinutes) != null ? _d : TERMINAL_SESSION_MINUTES_DEFAULT;
+  const requireTerminal = (context) => {
+    requireKiosk();
+    const body = context.optionalJsonBody();
+    const fromBody = typeof body.terminalSession === "string" ? body.terminalSession : null;
+    const session = fromBody != null ? fromBody : context.query("terminalSession");
+    if (!session) {
+      throw (0, import_problem.problem)(401, "no_session", "terminal session is missing");
+    }
+    const terminal = terminals.findBySession(session, now());
+    if (!terminal) {
+      throw (0, import_problem.problem)(401, "no_session", "terminal session is not valid any more");
+    }
+    return terminal;
+  };
+  route(
+    "GET",
+    "/terminal/status",
+    { public: true },
+    () => {
+      var _a2, _b2;
+      return (0, import_router.json)(200, {
+        enabled: deps.kioskEnabled === true,
+        serverTime: now(),
+        timezone: (_a2 = settings.get("timezone")) != null ? _a2 : "Europe/Berlin",
+        version: (_b2 = deps.version) != null ? _b2 : "0.0.0"
+      });
+    }
+  );
+  route(
+    "POST",
+    "/terminal/session",
+    { public: true, csrf: false, rateLimit: { name: "terminal-session", limit: 30, windowSeconds: 60 } },
+    (context) => {
+      requireKiosk();
+      const body = context.jsonBody();
+      const deviceToken = requireString(body, "deviceToken");
+      const terminal = terminals.findByToken(deviceToken, now());
+      if (!terminal) {
+        throw (0, import_problem.problem)(401, "invalid_credentials", "the device token is not valid any more");
+      }
+      const started = terminals.startSession({
+        id: terminal.id,
+        ttlMinutes: TERMINAL_SESSION_MINUTES,
+        now: now()
+      });
+      return (0, import_router.json)(200, {
+        terminalSession: started.terminalSession,
+        expiresAt: started.expiresAt,
+        terminal: {
+          name: terminal.name,
+          location: terminal.location,
+          pinRequired: terminal.pinRequired
+        }
+      });
+    }
+  );
+  route("POST", "/terminal/heartbeat", { public: true, csrf: false }, (context) => {
+    var _a2, _b2;
+    const terminal = requireTerminal(context);
+    const extended = terminals.touch({
+      id: terminal.id,
+      ttlMinutes: TERMINAL_SESSION_MINUTES,
+      now: now()
+    });
+    return (0, import_router.json)(200, {
+      status: "ok",
+      serverTime: now(),
+      timezone: (_a2 = settings.get("timezone")) != null ? _a2 : "Europe/Berlin",
+      version: (_b2 = deps.version) != null ? _b2 : "0.0.0",
+      expiresAt: extended.expiresAt
+    });
+  });
+  route(
+    "GET",
+    "/terminal/users",
+    { public: true, rateLimit: { name: "terminal-users", limit: 60, windowSeconds: 60 } },
+    (context) => {
+      var _a2;
+      const terminal = requireTerminal(context);
+      const timestamp = now();
+      const terminalSession = (_a2 = context.query("terminalSession")) != null ? _a2 : "";
+      const candidates = users.list({ includeInactive: false });
+      const visible = terminal.userIds.length === 0 ? candidates : candidates.filter((user) => terminal.userIds.includes(user.id));
+      return (0, import_router.json)(200, {
+        users: visible.map((user) => {
+          var _a3;
+          return {
+            id: user.id,
+            displayName: user.displayName,
+            present: ((_a3 = aggregation.day(user.id, (0, import_time.localDate)(timestamp, user.timezone))) == null ? void 0 : _a3.hasOpenEntry) === true,
+            // the picture is fetched by the browser from its own route; the session of this device travels
+            // in the query, so a plain `<img>` can load it
+            avatarUrl: user.avatar ? `/api/users/${user.id}/avatar?terminalSession=${encodeURIComponent(terminalSession)}&v=${user.updatedAt}` : null
+          };
+        })
+      });
+    }
+  );
+  route(
+    "POST",
+    "/terminal/punch",
+    { public: true, csrf: false, rateLimit: { name: "terminal-punch", limit: 60, windowSeconds: 60 } },
+    (context) => {
+      var _a2, _b2;
+      const terminal = requireTerminal(context);
+      const body = context.jsonBody();
+      const badge = optionalString(body, "badge");
+      const pin = optionalString(body, "pin");
+      const targetId = optionalNumber(body, "userId");
+      if (badge === null && targetId === null) {
+        throw new import_errors.ValidationError("a badge or a userId is required");
+      }
+      if (badge === null && terminal.pinRequired && pin === null) {
+        throw new import_errors.ValidationError("a userId together with the PIN is required");
+      }
+      const user = badge !== null ? users.findByRfidCard(badge) : users.findById(targetId != null ? targetId : 0);
+      if (!user || !user.isActive) {
+        throw (0, import_problem.problem)(401, "invalid_credentials", "badge or PIN is not known");
+      }
+      const blocked = pinGuard.state({ userId: user.id, now: now() });
+      if (blocked.locked) {
+        throw (0, import_problem.problem)(423, "locked_out", `too many wrong PINs, try again in ${blocked.retryAfterSeconds} s`);
+      }
+      const pinMatches = pin !== null && user.pinHash !== null && (0, import_auth.verifyPassword)(pin, user.pinHash);
+      if (terminal.pinRequired ? !pinMatches : pin !== null && !pinMatches) {
+        pinGuard.fail({ userId: user.id, now: now() });
+        throw (0, import_problem.problem)(401, "invalid_credentials", "badge or PIN is not known");
+      }
+      pinGuard.reset(user.id);
+      const timestamp = now();
+      const stored = entries.insert({
+        userId: user.id,
+        tsUtc: (_a2 = optionalNumber(body, "tsUtc")) != null ? _a2 : timestamp,
+        timeZone: user.timezone,
+        source: "terminal",
+        direction: optionalDirection(body),
+        note: optionalString(body, "note"),
+        actorId: user.id,
+        actorIp: (_b2 = context.request.remoteAddress) != null ? _b2 : null,
+        now: timestamp
+      });
+      const day = aggregation.recalculateDay(user.id, stored.entry.localDate, { now: timestamp });
+      terminals.touch({ id: terminal.id, ttlMinutes: TERMINAL_SESSION_MINUTES, now: timestamp });
+      emit({
+        type: "terminal.punch",
+        userId: user.id,
+        data: {
+          entryId: stored.entry.id,
+          localDate: stored.entry.localDate,
+          terminalId: terminal.id,
+          terminalName: terminal.name
+        }
+      });
+      return (0, import_router.json)(201, {
+        user: { id: user.id, displayName: user.displayName },
+        entry: {
+          id: stored.entry.id,
+          tsUtc: stored.entry.tsUtc,
+          direction: stored.entry.direction,
+          localDate: stored.entry.localDate
+        },
+        day: {
+          workedMin: day.workedMin,
+          targetMin: day.targetMin,
+          balanceMin: day.balanceMin,
+          hasOpenEntry: day.hasOpenEntry
+        }
+      });
+    }
+  );
+  route(
+    "GET",
+    "/terminals",
+    { permission: "terminal.manage" },
+    () => (0, import_router.json)(200, { terminals: terminals.list({ includeInactive: true }).map(publicTerminal) })
+  );
+  route("POST", "/terminals", { permission: "terminal.manage", csrf: true }, (context) => {
+    var _a2, _b2, _c2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const body = context.jsonBody();
+    const created = terminals.create({
+      name: requireString(body, "name"),
+      location: optionalString(body, "location"),
+      pinRequired: (_a2 = optionalBoolean(body, "pinRequired")) != null ? _a2 : void 0,
+      userIds: (_b2 = readUserIds(body)) != null ? _b2 : void 0,
+      ttlDays: optionalNumber(body, "ttlDays"),
+      actorId: context.auth.user.id,
+      actorIp: (_c2 = context.request.remoteAddress) != null ? _c2 : null,
+      now: now()
+    });
+    return (0, import_router.json)(
+      201,
+      { terminal: publicTerminal(created.terminal), deviceToken: created.deviceToken },
+      { location: `/terminals/${created.terminal.id}` }
+    );
+  });
+  route("PUT", "/terminals/:id/users", { permission: "terminal.manage", csrf: true }, (context) => {
+    var _a2, _b2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const id = numberParam(context, "id");
+    const body = context.jsonBody();
+    const userIds = (_a2 = readUserIds(body)) != null ? _a2 : [];
+    for (const userId of userIds) {
+      if (!users.findById(userId)) {
+        throw new import_errors.ValidationError(`user ${userId} does not exist`);
+      }
+    }
+    const terminal = terminals.setUsers({
+      id,
+      userIds,
+      actorId: context.auth.user.id,
+      actorIp: (_b2 = context.request.remoteAddress) != null ? _b2 : null,
+      now: now()
+    });
+    return (0, import_router.json)(200, { terminal: publicTerminal(terminal) });
+  });
+  route("DELETE", "/terminals/:id", { permission: "terminal.manage", csrf: true }, (context) => {
+    var _a2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const revoked = terminals.revoke({
+      id: numberParam(context, "id"),
+      actorId: context.auth.user.id,
+      actorIp: (_a2 = context.request.remoteAddress) != null ? _a2 : null,
+      now: now()
+    });
+    if (!revoked) {
+      throw new import_errors.NotFoundError(`terminal ${context.params.id} not found or already revoked`);
+    }
+    return (0, import_router.noContent)();
+  });
+  route("POST", "/users/:id/pin", { permission: "user.edit", csrf: true }, (context) => {
+    var _a2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const id = numberParam(context, "id");
+    if (!users.findById(id)) {
+      throw new import_errors.NotFoundError(`user ${id} not found`);
+    }
+    const body = context.jsonBody();
+    const pin = optionalString(body, "pin");
+    if (pin !== null && !/^\d{4,8}$/.test(pin)) {
+      throw new import_errors.ValidationError("pin must be 4 to 8 digits");
+    }
+    users.setPin({
+      userId: id,
+      // a PIN is a secret of the same weight as a password, so it is hashed the same way
+      pinHash: pin === null ? null : (0, import_auth.hashPassword)(pin),
+      actorId: context.auth.user.id,
+      actorIp: (_a2 = context.request.remoteAddress) != null ? _a2 : null,
+      now: now()
+    });
+    return (0, import_router.noContent)();
+  });
+  const requireHmacSecret = () => {
+    var _a2;
+    const secret = (_a2 = deps.hmacSecret) != null ? _a2 : "";
+    if (!secret) {
+      throw (0, import_problem.problem)(403, "not_configured", "no HMAC secret is configured for signed tag links");
+    }
+    return secret;
+  };
+  const tagLink = (context, token) => {
+    var _a2;
+    const host = (_a2 = context.header("host")) != null ? _a2 : "localhost";
+    const scheme = host.includes("://") ? "" : `${context.secure ? "https" : "http"}://`;
+    return `${scheme}${host}/?tag=${token}`;
+  };
+  const reissueLink = (context, tag, ttlDays, label) => {
+    var _a2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    if (tag.userId === null) {
+      throw new import_errors.ValidationError("the badge has no employee any more \u2014 give it one first");
+    }
+    const timestamp = now();
+    const expiresAt = timestamp + ttlDays * 86400;
+    const signature = (0, import_rfid.signTag)(requireHmacSecret(), tag.uid, tag.userId, expiresAt);
+    const updated = rfid.update({
+      id: tag.id,
+      userId: tag.userId,
+      expiresAt,
+      signature,
+      activate: true,
+      ...label === void 0 ? {} : { label },
+      actorId: context.auth.user.id,
+      actorIp: (_a2 = context.request.remoteAddress) != null ? _a2 : null,
+      now: timestamp
+    });
+    if (!updated) {
+      throw new import_errors.NotFoundError(`tag ${tag.id} not found`);
+    }
+    return { tag: updated, token: (0, import_rfid.buildTagToken)(updated.uid, tag.userId, expiresAt, signature) };
+  };
+  route(
+    "GET",
+    "/rfid/tags",
+    { permission: "rfid.manage" },
+    () => (0, import_router.json)(200, { tags: rfid.list({ includeInactive: true }) })
+  );
+  route("POST", "/rfid/tags", { permission: "rfid.manage", csrf: true }, (context) => {
+    var _a2, _b2, _c2, _d2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const secret = requireHmacSecret();
+    const body = context.jsonBody();
+    const target = Number((_a2 = body.userId) != null ? _a2 : context.auth.user.id);
+    if (!Number.isInteger(target) || !users.findById(target)) {
+      throw new import_errors.ValidationError("userId must reference an existing employee");
+    }
+    const ttlDays = (_b2 = optionalNumber(body, "ttlDays")) != null ? _b2 : 365;
+    if (!Number.isInteger(ttlDays) || ttlDays <= 0) {
+      throw new import_errors.ValidationError(`ttlDays must be a positive whole number (got ${ttlDays})`);
+    }
+    const timestamp = now();
+    const expiresAt = timestamp + ttlDays * 86400;
+    const uid = (_c2 = optionalString(body, "uid")) != null ? _c2 : (0, import_rfid.newTagUid)();
+    const signature = (0, import_rfid.signTag)(secret, uid, target, expiresAt);
+    const tag = rfid.create({
+      uid,
+      userId: target,
+      signature,
+      label: optionalString(body, "label"),
+      expiresAt,
+      actorId: context.auth.user.id,
+      actorIp: (_d2 = context.request.remoteAddress) != null ? _d2 : null,
+      now: timestamp
+    });
+    const token = (0, import_rfid.buildTagToken)(uid, target, expiresAt, signature);
+    return (0, import_router.json)(201, { tag, token, url: tagLink(context, token) }, { location: `/rfid/tags/${tag.id}` });
+  });
+  route("DELETE", "/rfid/tags/:id", { permission: "rfid.manage", csrf: true }, (context) => {
+    var _a2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const revoked = rfid.revoke({
+      id: numberParam(context, "id"),
+      actorId: context.auth.user.id,
+      actorIp: (_a2 = context.request.remoteAddress) != null ? _a2 : null,
+      now: now()
+    });
+    if (!revoked) {
+      throw new import_errors.NotFoundError(`tag ${context.params.id} not found or already revoked`);
+    }
+    return (0, import_router.noContent)();
+  });
+  route("DELETE", "/rfid/tags/:id/permanent", { permission: "rfid.manage", csrf: true }, (context) => {
+    var _a2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const removed = rfid.remove({
+      id: numberParam(context, "id"),
+      actorId: context.auth.user.id,
+      actorIp: (_a2 = context.request.remoteAddress) != null ? _a2 : null,
+      now: now()
+    });
+    if (!removed) {
+      throw new import_errors.NotFoundError(`tag ${context.params.id} not found`);
+    }
+    return (0, import_router.noContent)();
+  });
+  route("PATCH", "/rfid/tags/:id", { permission: "rfid.manage", csrf: true }, (context) => {
+    var _a2, _b2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const id = numberParam(context, "id");
+    const body = context.jsonBody();
+    const current = rfid.findById(id);
+    if (!current) {
+      throw new import_errors.NotFoundError(`tag ${context.params.id} not found`);
+    }
+    const userId = body.userId === void 0 ? current.userId : Number(body.userId);
+    if (userId === null || !Number.isInteger(userId) || !users.findById(userId)) {
+      throw new import_errors.ValidationError("userId must reference an existing employee");
+    }
+    const ttlDays = (_a2 = optionalNumber(body, "ttlDays")) != null ? _a2 : void 0;
+    if (ttlDays !== void 0 && (!Number.isInteger(ttlDays) || ttlDays <= 0)) {
+      throw new import_errors.ValidationError(`ttlDays must be a positive whole number (got ${ttlDays})`);
+    }
+    const label = body.label === void 0 ? void 0 : optionalString(body, "label");
+    if (userId !== current.userId || ttlDays !== void 0) {
+      const signed = reissueLink(context, { ...current, userId }, ttlDays != null ? ttlDays : 365, label);
+      return (0, import_router.json)(200, { tag: signed.tag, token: signed.token, url: tagLink(context, signed.token) });
+    }
+    const changed = rfid.update({
+      id,
+      userId,
+      ...label === void 0 ? {} : { label },
+      actorId: context.auth.user.id,
+      actorIp: (_b2 = context.request.remoteAddress) != null ? _b2 : null,
+      now: now()
+    });
+    if (!changed) {
+      throw new import_errors.NotFoundError(`tag ${context.params.id} not found`);
+    }
+    return (0, import_router.json)(200, { tag: changed });
+  });
+  route("POST", "/rfid/tags/:id/link", { permission: "rfid.manage", csrf: true }, (context) => {
+    var _a2;
+    if (!context.auth) {
+      throw (0, import_problem.problem)(401, "no_session", "request rejected (no_session)");
+    }
+    const tag = rfid.findById(numberParam(context, "id"));
+    if (!tag) {
+      throw new import_errors.NotFoundError(`tag ${context.params.id} not found`);
+    }
+    const ttlDays = (_a2 = optionalNumber(context.jsonBody(), "ttlDays")) != null ? _a2 : 365;
+    if (!Number.isInteger(ttlDays) || ttlDays <= 0) {
+      throw new import_errors.ValidationError(`ttlDays must be a positive whole number (got ${ttlDays})`);
+    }
+    const signed = reissueLink(context, tag, ttlDays);
+    return (0, import_router.json)(200, { tag: signed.tag, token: signed.token, url: tagLink(context, signed.token) });
+  });
+  route(
+    "POST",
+    "/rfid/scan",
+    { public: true, csrf: false, rateLimit: { name: "rfid-scan", limit: 30, windowSeconds: 60 } },
+    (context) => {
+      var _a2, _b2, _c2;
+      const secret = requireHmacSecret();
+      const body = context.jsonBody();
+      const parsed = (0, import_rfid.parseTagToken)(requireString(body, "token"));
+      if (!parsed) {
+        throw new import_errors.ValidationError("token is not valid");
+      }
+      const expected = (0, import_rfid.signTag)(secret, parsed.uid, parsed.userId, parsed.expiresAt);
+      if (!(0, import_rfid.sameSignature)(expected, parsed.signature)) {
+        throw (0, import_problem.problem)(401, "invalid_credentials", "the tag is not valid any more");
+      }
+      const tag = rfid.verify({
+        uid: parsed.uid,
+        userId: parsed.userId,
+        signature: parsed.signature,
+        now: now()
+      });
+      if (!tag) {
+        throw (0, import_problem.problem)(401, "invalid_credentials", "the tag is not valid any more");
+      }
+      const user = users.findById((_a2 = tag.userId) != null ? _a2 : 0);
+      if (!user || !user.isActive) {
+        throw (0, import_problem.problem)(401, "user_inactive", "the owner of the tag is not active");
+      }
+      const timestamp = now();
+      const stored = entries.insert({
+        userId: user.id,
+        tsUtc: (_b2 = optionalNumber(body, "tsUtc")) != null ? _b2 : timestamp,
+        timeZone: user.timezone,
+        source: "nfc",
+        direction: optionalDirection(body),
+        note: optionalString(body, "note"),
+        actorId: user.id,
+        actorIp: (_c2 = context.request.remoteAddress) != null ? _c2 : null,
+        now: timestamp
+      });
+      rfid.touch({ id: tag.id, now: timestamp });
+      const day = aggregation.recalculateDay(user.id, stored.entry.localDate, { now: timestamp });
+      emit({
+        type: "rfid.scan",
+        userId: user.id,
+        data: {
+          entryId: stored.entry.id,
+          localDate: stored.entry.localDate,
+          tagId: tag.id,
+          uid: tag.uid
+        }
+      });
+      return (0, import_router.json)(201, {
+        user: { id: user.id, displayName: user.displayName },
+        entry: {
+          id: stored.entry.id,
+          tsUtc: stored.entry.tsUtc,
+          localDate: stored.entry.localDate
+        },
+        day: {
+          workedMin: day.workedMin,
+          targetMin: day.targetMin,
+          balanceMin: day.balanceMin,
+          hasOpenEntry: day.hasOpenEntry
+        }
+      });
+    }
+  );
+  const monthlyReport = (context) => {
+    var _a2;
+    const userId = scopeUser(context);
+    const user = users.findById(userId);
+    if (!user) {
+      throw new import_errors.NotFoundError(`user ${userId} not found`);
+    }
+    const year = numberQuery(context, "year");
+    const month = numberQuery(context, "month");
+    if (month < 1 || month > 12) {
+      throw new import_errors.ValidationError(`month must be between 1 and 12 (got ${month})`);
+    }
+    const prefix = `${year}-${String(month).padStart(2, "0")}`;
+    const first = `${prefix}-01`;
+    const lastDay = new Date(Date.UTC(year, month, 0)).getUTCDate();
+    const last = `${prefix}-${String(lastDay).padStart(2, "0")}`;
+    const timestamp = now();
+    aggregation.recalculateRange(userId, first, last, { now: timestamp });
+    const { labels, language } = (0, import_labels.reportLabels)(user.locale);
+    return {
+      year,
+      month,
+      login: user.login,
+      input: {
+        user: { displayName: user.displayName, login: user.login, timezone: user.timezone },
+        labels,
+        language,
+        locale: user.locale || "en",
+        year,
+        month,
+        days: aggregation.days(userId, first, last),
+        absences: absences.withTypesInRange(userId, first, last).map((absence) => ({
+          typeCode: absence.typeCode,
+          typeName: absence.typeName,
+          dateFrom: absence.dateFrom,
+          dateTo: absence.dateTo,
+          dayPortion: absence.dayPortion,
+          hours: absence.hours
+        })),
+        generatedAt: timestamp,
+        generator: `time-tracker ${(_a2 = deps.version) != null ? _a2 : ""}`.trim()
+      }
+    };
+  };
+  route(
+    "GET",
+    "/reports/csv",
+    { permission: "report.view_own", rateLimit: { name: "export", limit: 20, windowSeconds: 60 } },
+    (context) => {
+      const { year, month, login } = monthlyReport(context);
+      const author = users.findById(scopeUser(context));
+      if (!author) {
+        throw new import_errors.NotFoundError("user not found");
+      }
+      const prefix = `${year}-${String(month).padStart(2, "0")}`;
+      const lastDay = new Date(Date.UTC(year, month, 0)).getUTCDate();
+      const csv = buildEntriesCsv(
+        entries.listByRange(author.id, `${prefix}-01`, `${prefix}-${String(lastDay).padStart(2, "0")}`),
+        author.timezone
+      );
+      return (0, import_router.binary)(200, csv, "text/csv; charset=utf-8", {
+        "content-disposition": `attachment; filename="${(0, import_types.reportFileName)(login, year, month, "csv")}"`,
+        "cache-control": "no-store"
+      });
+    }
+  );
+  route(
+    "GET",
+    "/reports/xls",
+    { permission: "report.view_own", rateLimit: { name: "export", limit: 20, windowSeconds: 60 } },
+    async (context) => {
+      const { input, year, month, login } = monthlyReport(context);
+      const workbook = await (0, import_xls.buildMonthReport)(input);
+      return (0, import_router.binary)(200, workbook, XLSX_CONTENT_TYPE, {
+        "content-disposition": `attachment; filename="${(0, import_types.reportFileName)(login, year, month, "xlsx")}"`,
+        "cache-control": "no-store"
+      });
+    }
+  );
+  route(
+    "GET",
+    "/reports/pdf",
+    { permission: "report.view_own", rateLimit: { name: "export", limit: 20, windowSeconds: 60 } },
+    async (context) => {
+      var _a2;
+      const { input, year, month, login } = monthlyReport(context);
+      let statement;
+      try {
+        statement = await (0, import_pdf.buildMonthStatement)({
+          ...input,
+          // a Unicode font is only needed for scripts the built-in fonts cannot show (see the renderer)
+          fontPath: (_a2 = settings.get("report_font_path")) != null ? _a2 : ""
+        });
+      } catch (error) {
+        if (error instanceof import_errors.ValidationError && error.message.includes("Unicode font")) {
+          throw (0, import_problem.problem)(
+            422,
+            "report_font_missing",
+            "this language needs a Unicode font: set report_font_path to a .ttf/.otf file that covers the script"
+          );
+        }
+        throw error;
+      }
+      return (0, import_router.binary)(200, statement, PDF_CONTENT_TYPE, {
+        "content-disposition": `attachment; filename="${(0, import_types.reportFileName)(login, year, month, "pdf")}"`,
+        "cache-control": "no-store"
+      });
+    }
+  );
+  if (deps.backup) {
+    const backup = deps.backup;
+    route(
+      "GET",
+      "/backup",
+      { permission: "backup.run" },
+      () => (0, import_router.json)(200, {
+        retentionDays: settings.getNumber("backup_retention_days", 30),
+        backups: backup.list(),
+        // a restore that waits for the next start, so the screen can say so
+        pending: backup.pending()
+      })
+    );
+    route("GET", "/backup/:name", { permission: "backup.run" }, (context) => {
+      const wanted = context.params.name;
+      const file = backup.list().find((entry) => entry.name === wanted);
+      if (!file) {
+        throw new import_errors.NotFoundError(`backup ${wanted} not found`);
+      }
+      return (0, import_router.binary)(200, fs.readFileSync(file.file), "application/vnd.sqlite3", {
+        "content-disposition": `attachment; filename="${file.name}"`,
+        "cache-control": "no-store"
+      });
+    });
+    route(
+      "POST",
+      "/backup",
+      { permission: "backup.run", csrf: true, rateLimit: { name: "backup", limit: 10, windowSeconds: 60 } },
+      (context) => {
+        var _a2, _b2;
+        const created = backup.create({
+          actorId: (_b2 = (_a2 = context.auth) == null ? void 0 : _a2.user.id) != null ? _b2 : null,
+          reason: "api"
+        });
+        emit({ type: "backup.create", userId: null, data: { backup: created.backup.name } });
+        return (0, import_router.json)(201, { backup: created.backup, removed: created.removed });
+      }
+    );
+    route(
+      "DELETE",
+      "/backup/:name",
+      { permission: "backup.run", csrf: true, rateLimit: { name: "backup", limit: 10, windowSeconds: 60 } },
+      (context) => {
+        var _a2, _b2;
+        try {
+          backup.remove(context.params.name, { actorId: (_b2 = (_a2 = context.auth) == null ? void 0 : _a2.user.id) != null ? _b2 : null, reason: "api" });
+        } catch (error) {
+          if (error instanceof import_errors.ValidationError) {
+            throw new import_errors.NotFoundError(error.message);
+          }
+          throw error;
+        }
+        return (0, import_router.noContent)(204);
+      }
+    );
+    route(
+      "POST",
+      "/backup/restore",
+      {
+        permission: "backup.run",
+        csrf: true,
+        rateLimit: { name: "backup", limit: 10, windowSeconds: 60 },
+        maxBodyBytes: MAX_BACKUP_UPLOAD_BYTES
+      },
+      (context) => {
+        var _a2, _b2, _c2, _d2, _e, _f, _g;
+        const upload = ((_a2 = context.header("content-type")) != null ? _a2 : "").toLowerCase().startsWith("application/octet-stream");
+        try {
+          if (upload) {
+            const pending2 = backup.queueRestore(context.rawBody(), {
+              name: (_b2 = context.query("name")) != null ? _b2 : void 0,
+              actorId: (_d2 = (_c2 = context.auth) == null ? void 0 : _c2.user.id) != null ? _d2 : null,
+              reason: (_e = context.query("reason")) != null ? _e : void 0
+            });
+            return (0, import_router.json)(201, { pending: pending2 });
+          }
+          const body = context.jsonBody();
+          const name = typeof body.name === "string" ? body.name.trim() : "";
+          if (name === "") {
+            throw (0, import_problem.problem)(400, "backup_invalid", "the request needs `name` with one of the listed backups");
+          }
+          const pending = backup.queueExistingBackup(name, {
+            actorId: (_g = (_f = context.auth) == null ? void 0 : _f.user.id) != null ? _g : null,
+            reason: typeof body.reason === "string" ? body.reason : void 0
+          });
+          return (0, import_router.json)(201, { pending });
+        } catch (error) {
+          if (error instanceof import_errors.ValidationError) {
+            throw (0, import_problem.problem)(400, "backup_invalid", error.message);
+          }
+          throw error;
+        }
+      }
+    );
+  }
+  route(
+    "GET",
+    "/health",
+    { public: true },
+    () => {
+      var _a2;
+      return (0, import_router.json)(200, {
+        status: "ok",
+        holidayCountry: (_a2 = settings.get("holiday_country")) != null ? _a2 : "DE",
+        time: now()
+      });
+    }
+  );
+  route("GET", "/routes", { public: true }, () => (0, import_router.json)(200, { routes: registered }));
+  return { router, routes: () => registered.slice(), events };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  MAX_BACKUP_UPLOAD_BYTES,
+  createApi
+});
+//# sourceMappingURL=api.js.map