iobroker.time-tracker 0.7.0 → 0.7.1

package/README.md

@@ -22,7 +22,8 @@ PIN. All data stays on your own ioBroker host: no cloud, no subscription.
 - **Terminal for everybody**: badge (RFID/NFC) or PIN on a shared tablet, plus a board that shows who is at work
 - **Working time**: target time from weekly hours, employment level and working days; breaks (punched or by graduated rules), overtime models, carryover, vacation and public holidays
 - **Absences and vacation**: requests and approvals, half days, and a preview of the days already planned
-- **Corrections** by the administration (change, delete, add a punch or a whole day) — every change carries a reason and the history of a punch stays readable
+- **Corrections** by the administration (change, delete, add a punch or a whole day) — every change carries a reason and the history of a punch stays readable; the administration opens the day right in the month view of an employee
+- **Day notes**: an employee does not change his own times — he leaves a note for the administration (“forgot to clock in or out”), which the office books and marks as handled
 - **Monthly statements** as PDF and Excel, for the own account and — with the right — for every employee; statistics and payouts included
 - **Roles**: administrator, manager, employee; every decision is checked on the server
 - **Automations**: aggregates, live events and commands as ioBroker states
@@ -83,7 +84,7 @@ The adapter is configured in the **instance settings** of the ioBroker admin:
 | Session secret                      | secret for CSRF tokens (encrypted at rest; empty = generated once)                                                          |
 | Badge link secret (HMAC)            | secret for signed badge/NFC links (encrypted at rest); empty = generated on the first start and stored next to the database |
 | Session lifetime in minutes         | how long a login lasts                                                                                                      |
-| Days users may edit on their own    | how far back an employee may correct own punches                                                                            |
+| Days the offline queue accepts on its own | how far back the punches of the offline queue are accepted without a decision of the administration          |
 | Round quick punches to minutes      | rounding of the quick punch (0 = off)                                                                                       |
 | Calculate absences only until today | future absences do not reduce the target time                                                                               |
 | Subtract working time from absences | lets vacation turn into overtime                                                                                            |
@@ -107,15 +108,33 @@ The pause of a day appears in the month view of the app and in the monthly state
 
 ## Roles
 
-| Role       | May                                                                                          |
-| ---------- | -------------------------------------------------------------------------------------------- |
-| `employee` | punch, see the own month and year, request absences, edit own punches inside the edit window |
-| `manager`  | everything an employee may, plus statements and corrections for other employees              |
-| `admin`    | everything: employees, roles, terminals, settings, backups                                   |
+| Role       | May                                                                                                    |
+| ---------- | ------------------------------------------------------------------------------------------------------ |
+| `employee` | punch, see the own month and year, request absences, leave a note for the administration at one day     |
+| `manager`  | everything an employee may, plus punching, statements and corrections for other employees              |
+| `admin`    | everything except punching: employees, roles, terminals, settings, backups                              |
 
-The **edit window** (`edit_window_days`, default 7 days) is what an `employee` is bound by: an older punch is
-rejected with `edit_window_closed` and stays with the administration. Managers and admins are not bound by it.
-Employees correct their own day right in the month view — the pencil beside a day opens its punches.
+The **administrator** account is created by the installation and belongs to nobody: it administers the employees
+instead of working with them, so it does not punch (the role has no `time.punch`). Whoever also works gets the right
+back through the `employee` role — permissions are the union of the roles of an account. A `manager` punches and
+corrects.
+
+The **edit window** (`edit_window_days`, default 7 days) bounds what an account may do with a day of its own without
+a decision of the administration. Since times belong to the administration, it now matters for the **offline queue**:
+a queued punch that is older arrives as the conflict `too_old` and counts once the office accepts it. Managers and
+admins are not bound by it.
+
+### Times, corrections and notes
+
+Punching is what an employee does (`POST /punch`, the quick punch, the offline queue). A punch written **by hand** is
+a correction of the administration (`time.edit_other`) and carries a reason in the audit trail — the month view of an
+employee offers exactly that: the pencil beside a day adds a forgotten punch, corrects a time or removes one
+(`time.delete`).
+
+An employee who noticed a forgotten punch does **not** change the times: he opens the day in the month view and
+leaves a **note** for the office (`PUT /api/day-notes`, own days with `time.edit_own`). The administration reads it in
+the day row and in the day of that employee, books the day and marks the note as **handled**
+(`POST /api/day-notes/handled`) — it stays visible for the record.
 
 ## Web app, terminal and API
 
@@ -351,6 +370,25 @@ local SQLite file, access is role-based, and every correction is written to an a
 
 ### **WORK IN PROGRESS**
 
+### 0.7.1 (2026-09-24)
+
+- (Alex) fix: the correction dialog in the month view of an employee shows and changes **his** punches. It asked the
+  API without the employee, so the administration saw, moved and added punches of their own account — “add a punch”
+  even created one there
+- (Alex) change: times belong to the administration. An employee no longer changes own times (`POST /entries` and
+  every change of a time now need `time.edit_other`); instead he leaves a **note for the day** (“forgot to clock
+  out”), which the administration reads in the month view and marks as handled (new table `day_notes`, migration 25).
+  A queued punch of the offline queue that is older than the edit window arrives as the conflict `too_old`
+- (Alex) change: the **administrator** account belongs to nobody and does not punch any more — the role loses
+  `time.punch` (migration 26), and the dashboard explains what the account is for. A manager punches and corrects as
+  before; whoever also works gets the right back through the `employee` role
+- (Alex) fix: `GET /entries/conflicts` accepts `?userId=`, so the administration sees the conflict queue of an
+  employee
+- (Alex) fix: the list of the absence types writes “visible for everybody” at the types the employees may really
+  pick — it was written at the switched off ones and at nothing else
+- (Alex) fix: on a narrow phone the balance of a day (month) and of a month (statements) no longer runs over the
+  text — the pencil, the balance and the download buttons stand beside the text instead of being laid over it
+
 ### 0.7.0 (2026-09-24)
 
 - (Alex) new: an absence type can carry a **colour**, and the calendar paints a day with it — vacation and sickness are
@@ -383,14 +421,6 @@ local SQLite file, access is role-based, and every correction is written to an a
   `tsconfig.json` leaves the browser tests to their own `test/e2e/tsconfig.json` — they need the DOM types the
   adapter does not have
 
-### 0.4.3 (2026-09-22)
-
-- (Alex) change: “active” of an absence type now reads “**visible for everybody**” and means exactly that. Switched on,
-  the employees pick the type in the app and request it (vacation, further training); switched off, the type belongs to
-  the administration alone (sickness, accident, military service — such a note reaches a company on the same day and is
-  booked, not requested). The server refuses an employee a type that is not public (`403`), the administration sees
-  every type in its own lists, and sickness, accident and military service start switched off (migration 22)
-
 Older entries are kept in [`CHANGELOG_OLD.md`](CHANGELOG_OLD.md).
 
 ## Provenance

package/admin/i18n/de.json

@@ -6,7 +6,7 @@
 	"Bind address": "Bind-Adresse",
 	"Calculate absences only until today": "Abwesenheiten nur bis heute berechnen",
 	"Database file (empty = adapter data directory)": "Datenbankdatei (leer = Datenverzeichnis des Adapters)",
-	"Days users may edit on their own": "Tage, die Benutzer selbst bearbeiten dürfen",
+	"Days the offline queue accepts on its own": "Tage, die die Offline-Warteschlange selbst annimmt",
 	"Default language for new users": "Standardsprache für neue Benutzer",
 	"empty = a random password is written to the adapter log once; it has to be changed at the first login": "leer = ein Zufallspasswort wird einmalig ins Adapter-Log geschrieben; es muss bei der ersten Anmeldung geändert werden",
 	"empty = the adapter generates one once and stores it next to the database, so sessions survive restarts": "leer = der Adapter erzeugt einmalig eines und legt es neben der Datenbank ab, damit Sitzungen Neustarts überleben",

package/admin/i18n/en.json

@@ -1 +1 @@
-{"⚠️ First start: the first administrator is created when the instance starts for the first time. If the password field stays empty, the generated password is written ONCE into the ioBroker log (open “Logs” on the left, look for the yellow line with “created with the start password”) — both fields are in the tab “Migration and backup”. The app asks for a new password at the first login.":"⚠️ First start: the first administrator is created when the instance starts for the first time. If the password field stays empty, the generated password is written ONCE into the ioBroker log (open “Logs” on the left, look for the yellow line with “created with the start password”) — both fields are in the tab “Migration and backup”. The app asks for a new password at the first login.","⚠️ The account of the first administrator is created at the very first start. If the password field below stays empty, the adapter generates a random password and writes it ONCE into the ioBroker log: open “Logs” in the ioBroker admin on the left and look for the yellow line with “created with the start password” — that is the password for the first login. The app then asks for a new password right away. Enter your own password below instead if you want to skip that.":"⚠️ The account of the first administrator is created at the very first start. If the password field below stays empty, the adapter generates a random password and writes it ONCE into the ioBroker log: open “Logs” in the ioBroker admin on the left and look for the yellow line with “created with the start password” — that is the password for the first login. The app then asks for a new password right away. Enter your own password below instead if you want to skip that.","127.0.0.1 = only this machine":"127.0.0.1 = only this machine","Badge link secret (HMAC)":"Badge link secret (HMAC)","Bind address":"Bind address","Calculate absences only until today":"Calculate absences only until today","Database file (empty = adapter data directory)":"Database file (empty = adapter data directory)","Days users may edit on their own":"Days users may edit on their own","Default language for new users":"Default language for new users","empty = a random password is written to the adapter log once; it has to be changed at the first login":"empty = a random password is written to the adapter log once; it has to be changed at the first login","empty = the adapter generates one once and stores it next to the database, so sessions survive restarts":"empty = the adapter generates one once and stores it next to the database, so sessions survive restarts","Enable kiosk terminal":"Enable kiosk terminal","First start: the start password is in the ioBroker log":"First start: the start password is in the ioBroker log","General":"General","Holiday country":"Holiday country","Instance time zone":"Instance time zone","Keep database backups for days":"Keep database backups for days","Login of the first administrator":"Login of the first administrator","Migration and backup":"Migration and backup","only switch this on when a reverse proxy is in front of the adapter":"only switch this on when a reverse proxy is in front of the adapter","Port":"Port","Round quick punches to minutes (0 = off)":"Round quick punches to minutes (0 = off)","Security":"Security","Session lifetime in minutes":"Session lifetime in minutes","Session secret":"Session secret","Start password of the first administrator":"Start password of the first administrator","Subtract working time from absences":"Subtract working time from absences","the port of the web app, the API and the terminal; 8082 stays free for vis and web":"the port of the web app, the API and the terminal; 8082 stays free for vis and web","Time rules":"Time rules","Trust the reverse proxy (X-Forwarded-*)":"Trust the reverse proxy (X-Forwarded-*)","used once: the account is created when the instance has no administrator yet":"used once: the account is created when the instance has no administrator yet","time-tracker adapter settings":"Adapter settings for time-tracker"}
+{"⚠️ First start: the first administrator is created when the instance starts for the first time. If the password field stays empty, the generated password is written ONCE into the ioBroker log (open “Logs” on the left, look for the yellow line with “created with the start password”) — both fields are in the tab “Migration and backup”. The app asks for a new password at the first login.":"⚠️ First start: the first administrator is created when the instance starts for the first time. If the password field stays empty, the generated password is written ONCE into the ioBroker log (open “Logs” on the left, look for the yellow line with “created with the start password”) — both fields are in the tab “Migration and backup”. The app asks for a new password at the first login.","⚠️ The account of the first administrator is created at the very first start. If the password field below stays empty, the adapter generates a random password and writes it ONCE into the ioBroker log: open “Logs” in the ioBroker admin on the left and look for the yellow line with “created with the start password” — that is the password for the first login. The app then asks for a new password right away. Enter your own password below instead if you want to skip that.":"⚠️ The account of the first administrator is created at the very first start. If the password field below stays empty, the adapter generates a random password and writes it ONCE into the ioBroker log: open “Logs” in the ioBroker admin on the left and look for the yellow line with “created with the start password” — that is the password for the first login. The app then asks for a new password right away. Enter your own password below instead if you want to skip that.","127.0.0.1 = only this machine":"127.0.0.1 = only this machine","Badge link secret (HMAC)":"Badge link secret (HMAC)","Bind address":"Bind address","Calculate absences only until today":"Calculate absences only until today","Database file (empty = adapter data directory)":"Database file (empty = adapter data directory)","Days the offline queue accepts on its own":"Days the offline queue accepts on its own","Default language for new users":"Default language for new users","empty = a random password is written to the adapter log once; it has to be changed at the first login":"empty = a random password is written to the adapter log once; it has to be changed at the first login","empty = the adapter generates one once and stores it next to the database, so sessions survive restarts":"empty = the adapter generates one once and stores it next to the database, so sessions survive restarts","Enable kiosk terminal":"Enable kiosk terminal","First start: the start password is in the ioBroker log":"First start: the start password is in the ioBroker log","General":"General","Holiday country":"Holiday country","Instance time zone":"Instance time zone","Keep database backups for days":"Keep database backups for days","Login of the first administrator":"Login of the first administrator","Migration and backup":"Migration and backup","only switch this on when a reverse proxy is in front of the adapter":"only switch this on when a reverse proxy is in front of the adapter","Port":"Port","Round quick punches to minutes (0 = off)":"Round quick punches to minutes (0 = off)","Security":"Security","Session lifetime in minutes":"Session lifetime in minutes","Session secret":"Session secret","Start password of the first administrator":"Start password of the first administrator","Subtract working time from absences":"Subtract working time from absences","the port of the web app, the API and the terminal; 8082 stays free for vis and web":"the port of the web app, the API and the terminal; 8082 stays free for vis and web","Time rules":"Time rules","Trust the reverse proxy (X-Forwarded-*)":"Trust the reverse proxy (X-Forwarded-*)","used once: the account is created when the instance has no administrator yet":"used once: the account is created when the instance has no administrator yet","time-tracker adapter settings":"Adapter settings for time-tracker"}

package/admin/i18n/es.json

@@ -6,7 +6,7 @@
 	"Bind address": "Dirección de escucha",
 	"Calculate absences only until today": "Calcular ausencias solo hasta hoy",
 	"Database file (empty = adapter data directory)": "Archivo de base de datos (vacío = directorio de datos del adaptador)",
-	"Days users may edit on their own": "Días que los usuarios pueden editar por su cuenta",
+	"Days the offline queue accepts on its own": "Días que la cola sin conexión acepta por sí sola",
 	"Default language for new users": "Idioma predeterminado para nuevos usuarios",
 	"empty = a random password is written to the adapter log once; it has to be changed at the first login": "vacío = se escribe una contraseña aleatoria una vez en el registro del adaptador; debe cambiarse en el primer inicio de sesión",
 	"empty = the adapter generates one once and stores it next to the database, so sessions survive restarts": "vacío = el adaptador genera uno una vez y lo guarda junto a la base de datos, para que las sesiones sobrevivan a los reinicios",

package/admin/i18n/fr.json

@@ -6,7 +6,7 @@
 	"Bind address": "Adresse d'écoute",
 	"Calculate absences only until today": "Calculer les absences uniquement jusqu'à aujourd'hui",
 	"Database file (empty = adapter data directory)": "Fichier de base de données (vide = répertoire de données de l'adaptateur)",
-	"Days users may edit on their own": "Jours pendant lesquels les utilisateurs peuvent modifier eux-mêmes",
+	"Days the offline queue accepts on its own": "Jours que la file hors ligne accepte d'elle-même",
 	"Default language for new users": "Langue par défaut pour les nouveaux utilisateurs",
 	"empty = a random password is written to the adapter log once; it has to be changed at the first login": "vide = un mot de passe aléatoire est écrit une fois dans le journal de l'adaptateur ; il doit être changé lors de la première connexion",
 	"empty = the adapter generates one once and stores it next to the database, so sessions survive restarts": "vide = l'adaptateur en génère un une fois et le stocke à côté de la base de données, pour que les sessions survivent aux redémarrages",

package/admin/i18n/it.json

@@ -6,7 +6,7 @@
 	"Bind address": "Indirizzo di ascolto",
 	"Calculate absences only until today": "Calcola le assenze solo fino ad oggi",
 	"Database file (empty = adapter data directory)": "File di database (vuoto = directory dei dati dell'adattatore)",
-	"Days users may edit on their own": "Giorni in cui gli utenti possono modificare autonomamente",
+	"Days the offline queue accepts on its own": "Giorni che la coda offline accetta da sola",
 	"Default language for new users": "Lingua predefinita per i nuovi utenti",
 	"empty = a random password is written to the adapter log once; it has to be changed at the first login": "vuoto = una password casuale viene scritta una volta nel log dell'adattatore; va cambiata al primo accesso",
 	"empty = the adapter generates one once and stores it next to the database, so sessions survive restarts": "vuoto = l'adattatore ne genera uno una volta e lo salva accanto al database, così le sessioni sopravvivono ai riavvii",

package/admin/i18n/nl.json

@@ -6,7 +6,7 @@
 	"Bind address": "Bindadres",
 	"Calculate absences only until today": "Bereken de afwezigheden tot en met vandaag",
 	"Database file (empty = adapter data directory)": "Databasebestand (leeg = adaptergegevensmap)",
-	"Days users may edit on their own": "Dagen waarop gebruikers zelf kunnen bewerken",
+	"Days the offline queue accepts on its own": "Dagen die de offlinewachtrij zelf aanneemt",
 	"Default language for new users": "Standaardtaal voor nieuwe gebruikers",
 	"empty = a random password is written to the adapter log once; it has to be changed at the first login": "leeg = er wordt eenmalig een willekeurig wachtwoord in het adapterlog geschreven; het moet bij de eerste aanmelding worden gewijzigd",
 	"empty = the adapter generates one once and stores it next to the database, so sessions survive restarts": "leeg = de adapter genereert er eenmalig een en bewaart het naast de database, zodat sessies herstarts overleven",

package/admin/i18n/pl.json

@@ -6,7 +6,7 @@
 	"Bind address": "Adres powiązania",
 	"Calculate absences only until today": "Oblicz nieobecności tylko do dzisiaj",
 	"Database file (empty = adapter data directory)": "Plik bazy danych (pusty = katalog danych adaptera)",
-	"Days users may edit on their own": "Dni, które użytkownicy mogą edytować samodzielnie",
+	"Days the offline queue accepts on its own": "Dni, które kolejka offline przyjmuje samodzielnie",
 	"Default language for new users": "Domyślny język dla nowych użytkowników",
 	"empty = a random password is written to the adapter log once; it has to be changed at the first login": "puste = losowe hasło zostanie jednorazowo zapisane w dzienniku adaptera; należy je zmienić przy pierwszym logowaniu",
 	"empty = the adapter generates one once and stores it next to the database, so sessions survive restarts": "puste = adapter wygeneruje raz wartość i zapisze ją obok bazy danych, aby sesje przetrwały restarty",

package/admin/i18n/pt.json

@@ -6,7 +6,7 @@
 	"Bind address": "Endereço de vinculação",
 	"Calculate absences only until today": "Calcular faltas apenas até hoje",
 	"Database file (empty = adapter data directory)": "Arquivo de banco de dados (vazio = diretório de dados do adaptador)",
-	"Days users may edit on their own": "Dias em que os usuários podem editar por conta própria",
+	"Days the offline queue accepts on its own": "Dias que a fila offline aceita por si só",
 	"Default language for new users": "Idioma padrão para novos usuários",
 	"empty = a random password is written to the adapter log once; it has to be changed at the first login": "vazio = uma senha aleatória é escrita uma vez no registro do adaptador; ela deve ser alterada no primeiro login",
 	"empty = the adapter generates one once and stores it next to the database, so sessions survive restarts": "vazio = o adaptador gera um valor uma vez e guarda-o junto à base de dados, para que as sessões sobrevivam aos reinícios",

package/admin/i18n/ru.json

@@ -6,7 +6,7 @@
 	"Bind address": "Адрес привязки",
 	"Calculate absences only until today": "Рассчитывать отсутствия только до сегодняшнего дня",
 	"Database file (empty = adapter data directory)": "Файл базы данных (пустой = каталог данных адаптера)",
-	"Days users may edit on their own": "Дни, когда пользователи могут редактировать самостоятельно",
+	"Days the offline queue accepts on its own": "Дни, которые офлайн-очередь принимает сама",
 	"Default language for new users": "Язык по умолчанию для новых пользователей",
 	"empty = a random password is written to the adapter log once; it has to be changed at the first login": "пусто = случайный пароль один раз записывается в журнал адаптера; его нужно сменить при первом входе",
 	"empty = the adapter generates one once and stores it next to the database, so sessions survive restarts": "пусто = адаптер один раз создаёт значение и сохраняет его рядом с базой данных, чтобы сессии переживали перезапуск",

package/admin/i18n/uk.json

@@ -6,7 +6,7 @@
 	"Bind address": "Адреса прив'язки",
 	"Calculate absences only until today": "Розраховувати відсутності лише до сьогодні",
 	"Database file (empty = adapter data directory)": "Файл бази даних (порожній = каталог даних адаптера)",
-	"Days users may edit on their own": "Дні, які користувачі можуть редагувати самостійно",
+	"Days the offline queue accepts on its own": "Дні, які офлайн-черга приймає самостійно",
 	"Default language for new users": "Мова за умовчанням для нових користувачів",
 	"empty = a random password is written to the adapter log once; it has to be changed at the first login": "порожньо = випадковий пароль один раз записується в журнал адаптера; його потрібно змінити під час першого входу",
 	"empty = the adapter generates one once and stores it next to the database, so sessions survive restarts": "порожньо = адаптер один раз створює значення і зберігає його поруч із базою даних, щоб сесії переживали перезапуск",

package/admin/i18n/zh-cn.json

@@ -6,7 +6,7 @@
 	"Bind address": "绑定地址",
 	"Calculate absences only until today": "仅计算今天之前的缺勤情况",
 	"Database file (empty = adapter data directory)": "数据库文件（空=适配器数据目录）",
-	"Days users may edit on their own": "用户可以自行编辑的天数",
+	"Days the offline queue accepts on its own": "离线队列自行接受的天数",
 	"Default language for new users": "新用户的默认语言",
 	"empty = a random password is written to the adapter log once; it has to be changed at the first login": "留空 = 随机密码会写入一次适配器日志；首次登录时必须修改",
 	"empty = the adapter generates one once and stores it next to the database, so sessions survive restarts": "留空 = 适配器会生成一次并保存在数据库旁边，这样会话在重启后仍然有效",

package/admin/jsonConfig.json

@@ -145,7 +145,7 @@
 				},
 				"editWindowDays": {
 					"type": "number",
-					"label": "Days users may edit on their own",
+					"label": "Days the offline queue accepts on its own",
 					"min": 0,
 					"max": 365,
 					"xs": 12,

package/build/lib/db/migrations.js

@@ -662,6 +662,45 @@ const migrations = [
 			UPDATE absence_types SET color = '#6a1b9a' WHERE color IS NULL AND code = 'W';
 			UPDATE absence_types SET color = '#795548' WHERE color IS NULL AND code = 'E';
 		`
+  },
+  {
+    version: 25,
+    name: "day notes: what an employee wants the administration to know about one day",
+    sql: `
+			-- An employee does not change punches any more; the day of a forgotten punch is corrected by the
+			-- administration. What the employee may do is leave a note for that day (\u201Cforgot to clock in or out\u201D),
+			-- so the message lives outside the punches: a day without a punch is exactly the case it is meant for.
+			-- One note per employee and day; the administration marks it as handled and keeps it for the record.
+			CREATE TABLE day_notes (
+				id          INTEGER PRIMARY KEY AUTOINCREMENT,
+				user_id     INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+				local_date  TEXT    NOT NULL,
+				note        TEXT    NOT NULL,
+				created_by  INTEGER REFERENCES users(id),
+				created_at  INTEGER NOT NULL,
+				updated_by  INTEGER REFERENCES users(id),
+				updated_at  INTEGER NOT NULL,
+				handled_at  INTEGER,
+				handled_by  INTEGER REFERENCES users(id)
+			);
+
+			CREATE UNIQUE INDEX idx_day_notes_user_date ON day_notes(user_id, local_date);
+			CREATE INDEX idx_day_notes_open ON day_notes(handled_at, local_date);
+			`
+  },
+  {
+    version: 26,
+    name: "roles: the administrator does not punch",
+    sql: `
+			-- The administrator account is created by the installation and belongs to nobody: it administers the
+			-- employees instead of working with them, so it needs no punch. Punching stays with the roles that
+			-- belong to a person: a manager corrects and punches, an employee punches. An administrator who also
+			-- works gets the right back through the employee role, because permissions are the union of the roles
+			-- of an account.
+			DELETE FROM role_permissions
+			 WHERE role_id = (SELECT id FROM roles WHERE key = 'admin')
+			   AND permission_id = (SELECT id FROM permissions WHERE key = 'time.punch');
+			`
   }
 ];
 // Annotate the CommonJS export names for ESM import in node:

package/build/lib/db/migrations.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/db/migrations.ts"],
-  "sourcesContent": ["/**\n * Versioned database migrations.\n *\n * The schema follows the internal specification (section 2). Rules:\n *  - Times are stored as UTC epoch seconds (INTEGER); durations as whole minutes.\n *  - Local date/time fields (`ts_local`, `local_date`) are derived caches of `ts_utc` + user time zone.\n *  - Migrations are never *reinterpreted*: a released migration keeps its effect for databases that already\n *    ran it, and every schema change comes as a new migration. Definitions that only freshly created\n *    databases ever see may be tidied up afterwards, as long as fresh and upgraded installations end up with\n *    the same schema (see migration 10, which cleans up behind migrations 1, 2 and 5).\n */\n\nimport type { Db } from \"./database\";\n\n/**\n * A single schema migration: either plain SQL or a JavaScript step for changes that SQL cannot express\n * (e.g. \u201Cdrop this column, but only when it is still there\u201D).\n */\nexport interface Migration {\n\t/** Monotonically increasing version number, applied in ascending order */\n\tversion: number;\n\t/** Short description, stored in `schema_migrations` for traceability */\n\tname: string;\n\t/** SQL statements (may contain several statements separated by semicolons) */\n\tsql?: string;\n\t/** JavaScript steps, run inside the same transaction as `sql` */\n\trun?: (db: Db) => void;\n}\n\n/**\n * Checks whether a table has a column.\n *\n * Migrations that clean up after older versions use this to stay safe for both kinds of database: one that was\n * created by an older version and one that was created by the current one (which never creates the column).\n *\n * @param db - open database handle\n * @param table - table name\n * @param column - column name\n * @returns true when the column exists\n */\nexport function hasColumn(db: Db, table: string, column: string): boolean {\n\tconst rows = db.prepare(`PRAGMA table_info(${table})`).all() as { name: string }[];\n\treturn rows.some(row => row.name === column);\n}\n\nexport const migrations: Migration[] = [\n\t{\n\t\tversion: 1,\n\t\tname: \"core: users, roles, permissions, work profiles, shift and pause rules, settings, sessions, audit, import runs\",\n\t\tsql: `\n\t\t\tCREATE TABLE users (\n\t\t\t\tid              INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tlogin           TEXT    NOT NULL UNIQUE,\n\t\t\t\tpassword_hash   TEXT    NOT NULL DEFAULT '',\n\t\t\t\tdisplay_name    TEXT    NOT NULL,\n\t\t\t\temail           TEXT,\n\t\t\t\trfid_card       TEXT,\n\t\t\t\tis_active       INTEGER NOT NULL DEFAULT 1,\n\t\t\t\tmust_change_pw  INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tlocale          TEXT    NOT NULL DEFAULT 'de-DE',\n\t\t\t\ttimezone        TEXT    NOT NULL DEFAULT 'Europe/Berlin',\n\t\t\t\tcreated_at      INTEGER NOT NULL,\n\t\t\t\tupdated_at      INTEGER NOT NULL,\n\t\t\t\tlast_login_at   INTEGER\n\t\t\t);\n\n\t\t\tCREATE TABLE roles (\n\t\t\t\tid    INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tkey   TEXT NOT NULL UNIQUE,\n\t\t\t\tname  TEXT NOT NULL\n\t\t\t);\n\n\t\t\tCREATE TABLE permissions (\n\t\t\t\tid   INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tkey  TEXT NOT NULL UNIQUE\n\t\t\t);\n\n\t\t\tCREATE TABLE role_permissions (\n\t\t\t\trole_id       INTEGER NOT NULL REFERENCES roles(id)       ON DELETE CASCADE,\n\t\t\t\tpermission_id INTEGER NOT NULL REFERENCES permissions(id) ON DELETE CASCADE,\n\t\t\t\tPRIMARY KEY (role_id, permission_id)\n\t\t\t);\n\n\t\t\tCREATE TABLE user_roles (\n\t\t\t\tuser_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\trole_id INTEGER NOT NULL REFERENCES roles(id) ON DELETE CASCADE,\n\t\t\t\tPRIMARY KEY (user_id, role_id)\n\t\t\t);\n\n\t\t\tCREATE TABLE work_profiles (\n\t\t\t\tuser_id              INTEGER PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\tpercent              REAL    NOT NULL DEFAULT 100,\n\t\t\t\tweekly_hours         REAL    NOT NULL DEFAULT 42.5,\n\t\t\t\tworkdays             TEXT    NOT NULL DEFAULT '0;1;1;1;1;1;0',\n\t\t\t\tstart_date           INTEGER,\n\t\t\t\tend_date             INTEGER,\n\t\t\t\tovertime_carryover   INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tvorholzeit_per_year  INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tvacation_carryover   REAL    NOT NULL DEFAULT 0,\n\t\t\t\tvacation_per_year    REAL    NOT NULL DEFAULT 0,\n\t\t\t\tovertime_model       TEXT    NOT NULL DEFAULT 'monthly'\n\t\t\t\t                     CHECK (overtime_model IN ('cumulative','yearly','monthly')),\n\t\t\t\tholiday_flags        TEXT\n\t\t\t);\n\n\t\t\tCREATE TABLE shift_rules (\n\t\t\t\tid          INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tuser_id     INTEGER REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\tday_of_week INTEGER CHECK (day_of_week IS NULL OR day_of_week BETWEEN 0 AND 6),\n\t\t\t\tfrom_min    INTEGER,\n\t\t\t\tto_min      INTEGER,\n\t\t\t\tsurcharge   REAL    NOT NULL DEFAULT 0,\n\t\t\t\tis_active   INTEGER NOT NULL DEFAULT 1\n\t\t\t);\n\n\t\t\tCREATE TABLE pause_rules (\n\t\t\t\tid        INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tuser_id   INTEGER REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\tfrom_min  INTEGER NOT NULL,\n\t\t\t\tto_min    INTEGER,\n\t\t\t\tpause_min INTEGER NOT NULL,\n\t\t\t\tis_active INTEGER NOT NULL DEFAULT 1,\n\t\t\t\tCHECK (to_min IS NULL OR to_min > from_min)\n\t\t\t);\n\n\t\t\tCREATE TABLE app_settings (\n\t\t\t\tkey        TEXT PRIMARY KEY,\n\t\t\t\tvalue      TEXT NOT NULL,\n\t\t\t\tupdated_at INTEGER NOT NULL\n\t\t\t);\n\n\t\t\tCREATE TABLE sessions (\n\t\t\t\tid         TEXT PRIMARY KEY,\n\t\t\t\tuser_id    INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\tcreated_at INTEGER NOT NULL,\n\t\t\t\texpires_at INTEGER NOT NULL,\n\t\t\t\tuser_agent TEXT,\n\t\t\t\tip         TEXT,\n\t\t\t\trevoked    INTEGER NOT NULL DEFAULT 0\n\t\t\t);\n\n\t\t\tCREATE TABLE audit_log (\n\t\t\t\tid        INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tat_utc    INTEGER NOT NULL,\n\t\t\t\tactor_id  INTEGER,\n\t\t\t\taction    TEXT NOT NULL,\n\t\t\t\tentity    TEXT,\n\t\t\t\tentity_id TEXT,\n\t\t\t\tdetail    TEXT,\n\t\t\t\tip        TEXT\n\t\t\t);\n\n\t\t\tCREATE TABLE import_runs (\n\t\t\t\tid               INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tsource           TEXT NOT NULL,\n\t\t\t\tsource_path      TEXT NOT NULL,\n\t\t\t\tstarted_at       INTEGER NOT NULL,\n\t\t\t\tfinished_at      INTEGER,\n\t\t\t\tmode             TEXT NOT NULL DEFAULT 'dry-run'\n\t\t\t\t                 CHECK (mode IN ('dry-run','commit')),\n\t\t\t\tstatus           TEXT NOT NULL DEFAULT 'running'\n\t\t\t\t                 CHECK (status IN ('running','ok','warnings','mismatch','failed')),\n\t\t\t\ttimezone_assumed TEXT,\n\t\t\t\tstats            TEXT,\n\t\t\t\twarnings         TEXT,\n\t\t\t\tactor_id         INTEGER REFERENCES users(id)\n\t\t\t);\n\t\t`,\n\t},\n\t{\n\t\tversion: 2,\n\t\tname: \"time: entries, audit, day/month/year aggregates, payouts\",\n\t\tsql: `\n\t\t\tCREATE TABLE time_entries (\n\t\t\t\tid              INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tuser_id         INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\tts_utc          INTEGER NOT NULL,\n\t\t\t\tclient_ts_utc   INTEGER,\n\t\t\t\tts_local        INTEGER NOT NULL,\n\t\t\t\tlocal_date      TEXT    NOT NULL,\n\t\t\t\tdirection       TEXT    NOT NULL DEFAULT 'auto'\n\t\t\t\t                CHECK (direction IN ('in','out','auto')),\n\t\t\t\tsource          TEXT    NOT NULL DEFAULT 'web'\n\t\t\t\t                CHECK (source IN ('web','nfc','terminal','api','admin','import')),\n\t\t\t\tidempotency_key TEXT,\n\t\t\t\tsync_state      TEXT    NOT NULL DEFAULT 'synced'\n\t\t\t\t                CHECK (sync_state IN ('synced','pending','conflict')),\n\t\t\t\trevision        INTEGER NOT NULL DEFAULT 1,\n\t\t\t\tnote            TEXT,\n\t\t\t\tcreated_by      INTEGER REFERENCES users(id),\n\t\t\t\tcreated_at      INTEGER NOT NULL,\n\t\t\t\tupdated_at      INTEGER NOT NULL,\n\t\t\t\tupdated_by      INTEGER REFERENCES users(id)\n\t\t\t);\n\n\t\t\tCREATE INDEX idx_entries_user_date ON time_entries(user_id, local_date);\n\t\t\tCREATE INDEX idx_entries_user_ts   ON time_entries(user_id, ts_utc);\n\t\t\tCREATE UNIQUE INDEX idx_entries_idem\n\t\t\t\tON time_entries(user_id, idempotency_key) WHERE idempotency_key IS NOT NULL;\n\n\t\t\tCREATE TABLE time_entry_audit (\n\t\t\t\tid         INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tentry_id   INTEGER,\n\t\t\t\tuser_id    INTEGER NOT NULL,\n\t\t\t\taction     TEXT    NOT NULL,\n\t\t\t\tchanges    TEXT,\n\t\t\t\told_ts_utc INTEGER,\n\t\t\t\tnew_ts_utc INTEGER,\n\t\t\t\trevision   INTEGER,\n\t\t\t\treason     TEXT,\n\t\t\t\tactor_id   INTEGER NOT NULL,\n\t\t\t\tactor_ip   TEXT,\n\t\t\t\tat_utc     INTEGER NOT NULL\n\t\t\t);\n\t\t\tCREATE INDEX idx_entry_audit_entry ON time_entry_audit(entry_id);\n\t\t`,\n\t},\n\t{\n\t\tversion: 3,\n\t\tname: \"aggregates: day, month, year and payouts\",\n\t\tsql: `\n\t\t\tCREATE TABLE day_aggregates (\n\t\t\t\tuser_id        INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\tlocal_date     TEXT    NOT NULL,\n\t\t\t\tworked_min     INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tbreak_min      INTEGER NOT NULL DEFAULT 0,\n\t\t\t\ttarget_min     INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tbalance_min    INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tabsence_code   TEXT,\n\t\t\t\tis_holiday     INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tfirst_in_utc   INTEGER,\n\t\t\t\tlast_out_utc   INTEGER,\n\t\t\t\thas_open_entry INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tupdated_at     INTEGER NOT NULL,\n\t\t\t\tPRIMARY KEY (user_id, local_date)\n\t\t\t);\n\n\t\t\tCREATE TABLE month_aggregates (\n\t\t\t\tuser_id       INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\tyear          INTEGER NOT NULL,\n\t\t\t\tmonth         INTEGER NOT NULL CHECK (month BETWEEN 1 AND 12),\n\t\t\t\tworked_min    INTEGER NOT NULL DEFAULT 0,\n\t\t\t\ttarget_min    INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tbalance_min   INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tovertime_min  INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tvacation_used REAL    NOT NULL DEFAULT 0,\n\t\t\t\tupdated_at    INTEGER NOT NULL,\n\t\t\t\tPRIMARY KEY (user_id, year, month)\n\t\t\t);\n\n\t\t\tCREATE TABLE year_aggregates (\n\t\t\t\tuser_id               INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\tyear                  INTEGER NOT NULL,\n\t\t\t\tworked_min            INTEGER NOT NULL DEFAULT 0,\n\t\t\t\ttarget_min            INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tovertime_min          INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tovertime_start        INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tvacation_days         REAL    NOT NULL DEFAULT 0,\n\t\t\t\tvacation_used         REAL    NOT NULL DEFAULT 0,\n\t\t\t\tvacation_left         REAL    NOT NULL DEFAULT 0,\n\t\t\t\tvacation_planned_days REAL    NOT NULL DEFAULT 0,\n\t\t\t\tsettled               INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tupdated_at            INTEGER NOT NULL,\n\t\t\t\tPRIMARY KEY (user_id, year)\n\t\t\t);\n\n\t\t\tCREATE TABLE payouts (\n\t\t\t\tid         INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tuser_id    INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\tyear       INTEGER NOT NULL,\n\t\t\t\tmonth      INTEGER,\n\t\t\t\tminutes    INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tamount     REAL,\n\t\t\t\tnote       TEXT,\n\t\t\t\tcreated_at INTEGER NOT NULL,\n\t\t\t\tcreated_by INTEGER REFERENCES users(id)\n\t\t\t);\n\t\t\tCREATE INDEX idx_payouts_user ON payouts(user_id, year, month);\n\t\t`,\n\t},\n\t{\n\t\tversion: 4,\n\t\tname: \"absence: types, absences, holidays\",\n\t\tsql: `\n\t\t\tCREATE TABLE absence_types (\n\t\t\t\tid              INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tuser_id         INTEGER REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\tcode            TEXT    NOT NULL,\n\t\t\t\tname            TEXT    NOT NULL,\n\t\t\t\tpaid            INTEGER NOT NULL DEFAULT 1,\n\t\t\t\tfactor          REAL    NOT NULL DEFAULT 100,\n\t\t\t\treduce_vacation INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tis_active       INTEGER NOT NULL DEFAULT 1\n\t\t\t);\n\n\t\t\tCREATE UNIQUE INDEX idx_absence_types_global\n\t\t\t\tON absence_types(code) WHERE user_id IS NULL;\n\t\t\tCREATE UNIQUE INDEX idx_absence_types_user\n\t\t\t\tON absence_types(user_id, code) WHERE user_id IS NOT NULL;\n\n\t\t\tCREATE TABLE absences (\n\t\t\t\tid          INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tuser_id     INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\ttype_id     INTEGER NOT NULL REFERENCES absence_types(id),\n\t\t\t\tdate_from   TEXT    NOT NULL,\n\t\t\t\tdate_to     TEXT    NOT NULL,\n\t\t\t\tday_portion REAL    NOT NULL DEFAULT 1 CHECK (day_portion > 0 AND day_portion <= 1),\n\t\t\t\thours       REAL,\n\t\t\t\tstatus      TEXT    NOT NULL DEFAULT 'taken'\n\t\t\t\t            CHECK (status IN ('taken','planned')),\n\t\t\t\tnote        TEXT,\n\t\t\t\tcreated_at  INTEGER NOT NULL,\n\t\t\t\tcreated_by  INTEGER REFERENCES users(id),\n\t\t\t\tCHECK (date_from <= date_to)\n\t\t\t);\n\t\t\tCREATE INDEX idx_absences_user_dates ON absences(user_id, date_from, date_to);\n\n\t\t\tCREATE TABLE holidays (\n\t\t\t\tid     INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tregion TEXT    NOT NULL DEFAULT 'global',\n\t\t\t\tyear   INTEGER NOT NULL,\n\t\t\t\tdate   TEXT    NOT NULL,\n\t\t\t\tname   TEXT    NOT NULL,\n\t\t\t\tUNIQUE (region, date)\n\t\t\t);\n\t\t\tCREATE INDEX idx_holidays_year ON holidays(year, region);\n\t\t`,\n\t},\n\t{\n\t\tversion: 5,\n\t\tname: \"devices: rfid tags and kiosk terminals\",\n\t\tsql: `\n\t\t\tCREATE TABLE rfid_tags (\n\t\t\t\tid           INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tuid          TEXT,\n\t\t\t\ttoken_hash   TEXT    NOT NULL,\n\t\t\t\tuser_id      INTEGER REFERENCES users(id) ON DELETE SET NULL,\n\t\t\t\tlabel        TEXT,\n\t\t\t\tis_active    INTEGER NOT NULL DEFAULT 1,\n\t\t\t\texpires_at   INTEGER,\n\t\t\t\tlast_used_at INTEGER,\n\t\t\t\tcreated_at   INTEGER NOT NULL\n\t\t\t);\n\t\t\tCREATE UNIQUE INDEX idx_rfid_uid ON rfid_tags(uid) WHERE uid IS NOT NULL;\n\n\t\t\tCREATE TABLE kiosk_terminals (\n\t\t\t\tid           INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tname         TEXT    NOT NULL,\n\t\t\t\tlocation     TEXT,\n\t\t\t\ttoken_hash   TEXT    NOT NULL,\n\t\t\t\tpin_required INTEGER NOT NULL DEFAULT 1,\n\t\t\t\tis_active    INTEGER NOT NULL DEFAULT 1,\n\t\t\t\texpires_at   INTEGER,\n\t\t\t\tlast_seen_at INTEGER,\n\t\t\t\tcreated_at   INTEGER NOT NULL\n\t\t\t);\n\t\t`,\n\t},\n\t{\n\t\tversion: 6,\n\t\tname: \"users: personal PIN for the kiosk terminal\",\n\t\tsql: `ALTER TABLE users ADD COLUMN pin_hash TEXT;`,\n\t},\n\t{\n\t\tversion: 7,\n\t\tname: \"kiosk terminals: short lived sessions\",\n\t\tsql: `\n\t\t\tALTER TABLE kiosk_terminals ADD COLUMN session_hash       TEXT;\n\t\t\tALTER TABLE kiosk_terminals ADD COLUMN session_expires_at INTEGER;\n\t\t`,\n\t},\n\t{\n\t\tversion: 8,\n\t\tname: \"defaults: time zone Europe/Zurich becomes Europe/Berlin\",\n\t\tsql: `\n\t\t\t-- The default time zone of the adapter is Europe/Berlin now. Migration 1 is append-only, so a new\n\t\t\t-- database already gets the new default with it; existing installations are adjusted here: every\n\t\t\t-- employee and every instance setting that still carries the old default is moved over. Values that\n\t\t\t-- were chosen deliberately keep their name \u2014 they only change when they are exactly the old default.\n\t\t\tUPDATE users        SET timezone = 'Europe/Berlin' WHERE timezone = 'Europe/Zurich';\n\t\t\tUPDATE app_settings SET value    = 'Europe/Berlin' WHERE key = 'timezone' AND value = 'Europe/Zurich';\n\t\t`,\n\t},\n\t{\n\t\tversion: 9,\n\t\tname: \"users: picture of the employee\",\n\t\tsql: `ALTER TABLE users ADD COLUMN avatar TEXT;`,\n\t},\n\t{\n\t\tversion: 10,\n\t\tname: \"drops the leftovers of the removed data import\",\n\t\trun: (db: Db): void => {\n\t\t\t// The adapter does not read data of another time tracking system any more, so the columns that existed\n\t\t\t// for it are dropped. Fresh databases never create them (migrations 1, 2 and 5 are clean), so every\n\t\t\t// step asks first: an upgraded database loses the columns, a fresh one has nothing to do.\n\t\t\tif (hasColumn(db, \"users\", \"legacy_sha1\")) {\n\t\t\t\tdb.exec(\"ALTER TABLE users DROP COLUMN legacy_sha1\");\n\t\t\t}\n\t\t\tif (hasColumn(db, \"work_profiles\", \"legacy_source\")) {\n\t\t\t\tdb.exec(\"ALTER TABLE work_profiles DROP COLUMN legacy_source\");\n\t\t\t}\n\n\t\t\t// rfid_tags carried the printed card number of that system as a second identifier. SQLite cannot drop\n\t\t\t// a column that a CHECK constraint mentions, so the table is rebuilt without it; existing rows keep\n\t\t\t// their id, their uid and their token hash, and the unique index on the uid is recreated.\n\t\t\tif (!hasColumn(db, \"rfid_tags\", \"legacy_code\")) {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tdb.exec(`\n\t\t\t\tCREATE TABLE rfid_tags_new (\n\t\t\t\t\tid           INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\t\tuid          TEXT,\n\t\t\t\t\ttoken_hash   TEXT    NOT NULL,\n\t\t\t\t\tuser_id      INTEGER REFERENCES users(id) ON DELETE SET NULL,\n\t\t\t\t\tlabel        TEXT,\n\t\t\t\t\tis_active    INTEGER NOT NULL DEFAULT 1,\n\t\t\t\t\texpires_at   INTEGER,\n\t\t\t\t\tlast_used_at INTEGER,\n\t\t\t\t\tcreated_at   INTEGER NOT NULL\n\t\t\t\t);\n\t\t\t\tINSERT INTO rfid_tags_new (id, uid, token_hash, user_id, label, is_active, expires_at, last_used_at, created_at)\n\t\t\t\t\tSELECT id, uid, token_hash, user_id, label, is_active, expires_at, last_used_at, created_at\n\t\t\t\t\tFROM rfid_tags;\n\t\t\t\tDROP TABLE rfid_tags;\n\t\t\t\tALTER TABLE rfid_tags_new RENAME TO rfid_tags;\n\t\t\t\tCREATE UNIQUE INDEX idx_rfid_uid ON rfid_tags(uid) WHERE uid IS NOT NULL;\n\t\t\t`);\n\t\t},\n\t},\n\t{\n\t\tversion: 11,\n\t\tname: \"terminals: the employees of a terminal\",\n\t\tsql: `\n\t\t\t-- A terminal stands at one place \u2014 an office, a workshop \u2014 and is meant for the employees that work\n\t\t\t-- there. No row for a terminal means \"all employees\", so terminals that existed before keep working\n\t\t\t-- exactly as they did.\n\t\t\tCREATE TABLE terminal_users (\n\t\t\t\tterminal_id INTEGER NOT NULL REFERENCES kiosk_terminals(id) ON DELETE CASCADE,\n\t\t\t\tuser_id     INTEGER NOT NULL REFERENCES users(id)           ON DELETE CASCADE,\n\t\t\t\tcreated_at  INTEGER NOT NULL,\n\t\t\t\tPRIMARY KEY (terminal_id, user_id)\n\t\t\t);\n\t\t\tCREATE INDEX idx_terminal_users_user ON terminal_users(user_id);\n\t\t`,\n\t},\n\t{\n\t\tversion: 12,\n\t\tname: \"work profiles: paid breaks\",\n\t\tsql: `ALTER TABLE work_profiles ADD COLUMN pause_paid INTEGER NOT NULL DEFAULT 0;`,\n\t},\n\t{\n\t\tversion: 13,\n\t\tname: \"work profiles: paid break minutes instead of the paid flag\",\n\t\trun: (db: Db): void => {\n\t\t\t// The flag became an amount: a company may pay a quarter of an hour and nothing more. A profile that had\n\t\t\t// the flag set keeps a fully paid break (a day has 1440 minutes), a fresh profile pays nothing at all.\n\t\t\tif (!hasColumn(db, \"work_profiles\", \"pause_paid_minutes\")) {\n\t\t\t\tdb.exec(\"ALTER TABLE work_profiles ADD COLUMN pause_paid_minutes INTEGER NOT NULL DEFAULT 0\");\n\t\t\t}\n\t\t\tif (hasColumn(db, \"work_profiles\", \"pause_paid\")) {\n\t\t\t\tdb.exec(\"UPDATE work_profiles SET pause_paid_minutes = 1440 WHERE pause_paid = 1\");\n\t\t\t\tdb.exec(\"ALTER TABLE work_profiles DROP COLUMN pause_paid\");\n\t\t\t}\n\t\t},\n\t},\n\t{\n\t\tversion: 14,\n\t\tname: \"day aggregates: paid break minutes\",\n\t\tsql: `ALTER TABLE day_aggregates ADD COLUMN paid_break_min INTEGER NOT NULL DEFAULT 0;`,\n\t},\n\t{\n\t\tversion: 15,\n\t\tname: \"trigger rules: ioBroker states that punch or set the presence\",\n\t\tsql: `\n\t\t\t-- A rule watches a state of another adapter (a fingerprint reader, a button, a door contact) and turns a\n\t\t\t-- write on it into a punch or a presence change. Mode \"condition\" fires when the value matches\n\t\t\t-- \"condition\" and punches for \"user_id\"; mode \"user\" posts the employee the value names. \"last_fired_at\"\n\t\t\t-- keeps a chatty reader in check together with \"cooldown_sec\".\n\t\t\tCREATE TABLE trigger_rules (\n\t\t\t\tid            INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tlabel         TEXT,\n\t\t\t\tsource_state  TEXT    NOT NULL,\n\t\t\t\tmode          TEXT    NOT NULL DEFAULT 'condition'\n\t\t\t\t\tCHECK (mode IN ('condition','user')),\n\t\t\t\tcondition     TEXT,\n\t\t\t\tuser_id       INTEGER REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\taction        TEXT    NOT NULL DEFAULT 'punch'\n\t\t\t\t\tCHECK (action IN ('punch','quickPunch','present','absent')),\n\t\t\t\tis_active     INTEGER NOT NULL DEFAULT 1,\n\t\t\t\tcooldown_sec  INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tlast_fired_at INTEGER,\n\t\t\t\tcreated_at    INTEGER NOT NULL,\n\t\t\t\tupdated_at    INTEGER NOT NULL\n\t\t\t);\n\t\t\tCREATE INDEX idx_trigger_rules_source ON trigger_rules(source_state);\n\t\t`,\n\t},\n\t{\n\t\tversion: 16,\n\t\tname: \"automation rules: what the adapter does on its own (clock out, reminders)\",\n\t\tsql: `\n\t\t\t-- A rule of the adapter itself, not of a foreign state: at a certain local time (clockOut, missingPunch)\n\t\t\t-- or after a while without a break (breakReminder) the adapter acts. \"user_id\" is NULL for every\n\t\t\t-- employee, so a company rule and a rule for one person can live side by side.\n\t\t\tCREATE TABLE automation_rules (\n\t\t\t\tid            INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tlabel         TEXT,\n\t\t\t\tkind          TEXT    NOT NULL\n\t\t\t\t\tCHECK (kind IN ('clockOut','missingPunch','breakReminder')),\n\t\t\t\tuser_id       INTEGER REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\tat_minute     INTEGER,\n\t\t\t\tafter_minutes INTEGER,\n\t\t\t\tis_active     INTEGER NOT NULL DEFAULT 1,\n\t\t\t\tcreated_at    INTEGER NOT NULL,\n\t\t\t\tupdated_at    INTEGER NOT NULL\n\t\t\t);\n\t\t\tCREATE INDEX idx_automation_rules_kind ON automation_rules(kind);\n\n\t\t\t-- What a rule already did: one row per rule, employee and local date keeps it at \"once a day\" and doubles\n\t\t\t-- as the log the administration shows. A punch that is already written is never written twice.\n\t\t\tCREATE TABLE automation_runs (\n\t\t\t\trule_id    INTEGER NOT NULL REFERENCES automation_rules(id) ON DELETE CASCADE,\n\t\t\t\tuser_id    INTEGER NOT NULL REFERENCES users(id)            ON DELETE CASCADE,\n\t\t\t\tlocal_date TEXT    NOT NULL,\n\t\t\t\tfired_at   INTEGER NOT NULL,\n\t\t\t\taction     TEXT    NOT NULL,\n\t\t\t\tPRIMARY KEY (rule_id, user_id, local_date)\n\t\t\t);\n\t\t\tCREATE INDEX idx_automation_runs_user ON automation_runs(user_id, local_date);\n\t\t`,\n\t},\n\t{\n\t\tversion: 17,\n\t\tname: \"automation rules: weekdays and a weekly instead of a daily guard\",\n\t\tsql: `\n\t\t\t-- A rule can be limited to certain weekdays: bit 0 is Monday \u2026 bit 6 is Sunday, 127 is every day.\n\t\t\tALTER TABLE automation_rules ADD COLUMN weekdays INTEGER NOT NULL DEFAULT 127;\n\n\t\t\t-- 'day' keeps the guard of one run per employee and date, 'week' allows one run per ISO week.\n\t\t\tALTER TABLE automation_rules ADD COLUMN repeat TEXT NOT NULL DEFAULT 'day';\n\n\t\t\t-- the guard column no longer holds a date only: for a weekly rule it is the ISO week (2026-W38), so the\n\t\t\t-- name says what it keeps. Existing rows stay valid \u2014 a date is the period of a daily rule.\n\t\t\tALTER TABLE automation_runs RENAME COLUMN local_date TO period;\n\t\t`,\n\t},\n\t{\n\t\tversion: 18,\n\t\tname: \"automation rules: the kind clockIn (punch in somebody who is missing)\",\n\t\tsql: `\n\t\t\t-- A fourth kind joins the rules: 'clockIn' punches an employee in who is still missing at the configured\n\t\t\t-- time (the decision makes sure nobody is clocked in already). SQLite cannot change a CHECK constraint in\n\t\t\t-- place, so the table is rebuilt \u2014 and because automation_runs belongs to it with ON DELETE CASCADE, the\n\t\t\t-- run log is copied first: dropping the parent would take it with it.\n\t\t\tCREATE TABLE automation_runs_copy (\n\t\t\t\trule_id    INTEGER NOT NULL,\n\t\t\t\tuser_id    INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\tperiod     TEXT    NOT NULL,\n\t\t\t\tfired_at   INTEGER NOT NULL,\n\t\t\t\taction     TEXT    NOT NULL,\n\t\t\t\tPRIMARY KEY (rule_id, user_id, period)\n\t\t\t);\n\t\t\tINSERT INTO automation_runs_copy (rule_id, user_id, period, fired_at, action)\n\t\t\t\tSELECT rule_id, user_id, period, fired_at, action FROM automation_runs;\n\n\t\t\tCREATE TABLE automation_rules_new (\n\t\t\t\tid            INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tlabel         TEXT,\n\t\t\t\tkind          TEXT    NOT NULL\n\t\t\t\t\tCHECK (kind IN ('clockIn','clockOut','missingPunch','breakReminder')),\n\t\t\t\tuser_id       INTEGER REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\tat_minute     INTEGER,\n\t\t\t\tafter_minutes INTEGER,\n\t\t\t\tweekdays      INTEGER NOT NULL DEFAULT 127,\n\t\t\t\trepeat        TEXT    NOT NULL DEFAULT 'day',\n\t\t\t\tis_active     INTEGER NOT NULL DEFAULT 1,\n\t\t\t\tcreated_at    INTEGER NOT NULL,\n\t\t\t\tupdated_at    INTEGER NOT NULL\n\t\t\t);\n\t\t\tINSERT INTO automation_rules_new\n\t\t\t\t(id, label, kind, user_id, at_minute, after_minutes, weekdays, repeat, is_active, created_at, updated_at)\n\t\t\t\tSELECT id, label, kind, user_id, at_minute, after_minutes, weekdays, repeat, is_active, created_at, updated_at\n\t\t\t\tFROM automation_rules;\n\n\t\t\tDROP TABLE automation_runs;\n\t\t\tDROP TABLE automation_rules;\n\t\t\tALTER TABLE automation_rules_new RENAME TO automation_rules;\n\t\t\t-- the runs keep their user reference; the reference to the rule is kept by the repository, which deletes\n\t\t\t-- the runs of a rule together with it\n\t\t\tALTER TABLE automation_runs_copy RENAME TO automation_runs;\n\n\t\t\tCREATE INDEX idx_automation_rules_kind ON automation_rules(kind);\n\t\t\tCREATE INDEX idx_automation_runs_user ON automation_runs(user_id, period);\n\t\t`,\n\t},\n\t{\n\t\tversion: 19,\n\t\tname: \"holidays: a stable key next to the name, so the app can translate the seeded days\",\n\t\tsql: `\n\t\t\t-- The seeded holidays carry an English name. The key says which day it is, so the web app shows it in the\n\t\t\t-- language of the display; a day somebody added by hand has no key and keeps its own name.\n\t\t\tALTER TABLE holidays ADD COLUMN key TEXT;\n\n\t\t\t-- the days that are already stored get their key from the date\n\t\t\tUPDATE holidays SET key = 'newYear'    WHERE key IS NULL AND date LIKE '%-01-01';\n\t\t\tUPDATE holidays SET key = 'epiphany'   WHERE key IS NULL AND date LIKE '%-01-06';\n\t\t\tUPDATE holidays SET key = 'labourDay'  WHERE key IS NULL AND date LIKE '%-05-01';\n\t\t\tUPDATE holidays SET key = 'nationalDay' WHERE key IS NULL AND (date LIKE '%-08-01' OR date LIKE '%-10-26');\n\t\t\tUPDATE holidays SET key = 'assumption' WHERE key IS NULL AND date LIKE '%-08-15';\n\t\t\tUPDATE holidays SET key = 'germanUnity' WHERE key IS NULL AND date LIKE '%-10-03';\n\t\t\tUPDATE holidays SET key = 'allSaints'  WHERE key IS NULL AND date LIKE '%-11-01';\n\t\t\tUPDATE holidays SET key = 'immaculateConception' WHERE key IS NULL AND date LIKE '%-12-08';\n\t\t\tUPDATE holidays SET key = 'christmas'  WHERE key IS NULL AND date LIKE '%-12-25';\n\t\t\tUPDATE holidays SET key = 'boxingDay'  WHERE key IS NULL AND date LIKE '%-12-26';\n\t\t\t-- the movable feasts carry their English name, which is unique enough to find them again\n\t\t\tUPDATE holidays SET key = 'goodFriday'   WHERE key IS NULL AND name = 'Good Friday';\n\t\t\tUPDATE holidays SET key = 'easterMonday' WHERE key IS NULL AND name = 'Easter Monday';\n\t\t\tUPDATE holidays SET key = 'ascension'    WHERE key IS NULL AND name = 'Ascension Day';\n\t\t\tUPDATE holidays SET key = 'whitMonday'   WHERE key IS NULL AND name = 'Whit Monday';\n\t\t\tUPDATE holidays SET key = 'corpusChristi' WHERE key IS NULL AND name = 'Corpus Christi';\n\t\t`,\n\t},\n\t{\n\t\tversion: 20,\n\t\tname: \"work profiles: whether the presence card shows the working time of the day\",\n\t\tsql: `\n\t\t\t-- The presence screen is visible before the PIN is entered, so showing the worked time of an employee\n\t\t\t-- is a decision of the administration, per employee. Off by default.\n\t\t\tALTER TABLE work_profiles ADD COLUMN show_worked_time INTEGER NOT NULL DEFAULT 0;\n\t\t`,\n\t},\n\t{\n\t\tversion: 21,\n\t\tname: \"absences: approval by the administration (requested, approved, rejected)\",\n\t\trun: (db: Db): void => {\n\t\t\t// An employee requests, the administration decides. `approval` is separate from `status`, which keeps\n\t\t\t// saying whether the days are planned or already taken: a request can be planned and still wait for\n\t\t\t// its decision. Everything that exists before this migration counts as approved, so no figure changes\n\t\t\t// for a running installation; a request of an employee starts as `requested`.\n\t\t\tif (!hasColumn(db, \"absences\", \"approval\")) {\n\t\t\t\tdb.exec(\n\t\t\t\t\t\"ALTER TABLE absences ADD COLUMN approval TEXT NOT NULL DEFAULT 'approved' \" +\n\t\t\t\t\t\t\"CHECK (approval IN ('requested','approved','rejected'))\",\n\t\t\t\t);\n\t\t\t}\n\t\t\t// Who decided when and why \u2014 a rejection without a reason is not much use to the employee.\n\t\t\tif (!hasColumn(db, \"absences\", \"decided_at\")) {\n\t\t\t\tdb.exec(\"ALTER TABLE absences ADD COLUMN decided_at INTEGER\");\n\t\t\t}\n\t\t\tif (!hasColumn(db, \"absences\", \"decided_by\")) {\n\t\t\t\tdb.exec(\"ALTER TABLE absences ADD COLUMN decided_by INTEGER REFERENCES users(id) ON DELETE SET NULL\");\n\t\t\t}\n\t\t\tif (!hasColumn(db, \"absences\", \"decision_note\")) {\n\t\t\t\tdb.exec(\"ALTER TABLE absences ADD COLUMN decision_note TEXT\");\n\t\t\t}\n\t\t\t// The administration looks at the open requests first, so they get an index of their own.\n\t\t\tdb.exec(\"CREATE INDEX IF NOT EXISTS idx_absences_approval ON absences(approval, date_from)\");\n\t\t},\n\t},\n\t{\n\t\tversion: 22,\n\t\tname: \"absence types: sickness, accident and military are for the administration only\",\n\t\tsql: `\n\t\t\t-- A sickness note usually reaches a company on the same day, so nobody \u201Crequests\u201D it: the administration\n\t\t\t-- books it. \u201CVisible for everybody\u201D (is_active) therefore starts switched off for these three types, so an\n\t\t\t-- employee does not find them in the app. The administration can switch it on again in the card of the\n\t\t\t-- absence types at any time.\n\t\t\tUPDATE absence_types SET is_active = 0\n\t\t\t WHERE user_id IS NULL AND code IN ('K','U','M') AND is_active = 1;\n\t\t`,\n\t},\n\t{\n\t\tversion: 23,\n\t\tname: \"users: a private token for the calendar feed\",\n\t\tsql: `\n\t\t\t-- Everybody can subscribe to the own absences in a calendar app (Google, Outlook, Apple). The feed is a\n\t\t\t-- public route with a secret in the URL, so the token belongs to one employee and can be rotated: a new\n\t\t\t-- token makes the old link invalid. A missing token simply means \u201Cno feed yet\u201D.\n\t\t\tALTER TABLE users ADD COLUMN calendar_token TEXT;\n\t\t\tCREATE UNIQUE INDEX idx_users_calendar_token ON users(calendar_token) WHERE calendar_token IS NOT NULL;\n\t\t`,\n\t},\n\t{\n\t\tversion: 24,\n\t\tname: \"absence types: a colour for the calendar\",\n\t\tsql: `\n\t\t\t-- The calendar grid marks an absence with the colour of its type, so vacation and sickness are told apart at\n\t\t\t-- a glance. The seeded types get their colour here; an empty value keeps the default of the display.\n\t\t\tALTER TABLE absence_types ADD COLUMN color TEXT;\n\t\t\tUPDATE absence_types SET color = '#2e7d32' WHERE color IS NULL AND code = 'F';\n\t\t\tUPDATE absence_types SET color = '#c62828' WHERE color IS NULL AND code = 'K';\n\t\t\tUPDATE absence_types SET color = '#ef6c00' WHERE color IS NULL AND code = 'U';\n\t\t\tUPDATE absence_types SET color = '#455a64' WHERE color IS NULL AND code = 'M';\n\t\t\tUPDATE absence_types SET color = '#1565c0' WHERE color IS NULL AND code = 'I';\n\t\t\tUPDATE absence_types SET color = '#6a1b9a' WHERE color IS NULL AND code = 'W';\n\t\t\tUPDATE absence_types SET color = '#795548' WHERE color IS NULL AND code = 'E';\n\t\t`,\n\t},\n];\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAwCO,SAAS,UAAU,IAAQ,OAAe,QAAyB;AACzE,QAAM,OAAO,GAAG,QAAQ,qBAAqB,KAAK,GAAG,EAAE,IAAI;AAC3D,SAAO,KAAK,KAAK,SAAO,IAAI,SAAS,MAAM;AAC5C;AAEO,MAAM,aAA0B;AAAA,EACtC;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuHN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4CN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA2DN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4CN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA,EACN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA,EAIN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA,EACN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK,CAAC,OAAiB;AAItB,UAAI,UAAU,IAAI,SAAS,aAAa,GAAG;AAC1C,WAAG,KAAK,2CAA2C;AAAA,MACpD;AACA,UAAI,UAAU,IAAI,iBAAiB,eAAe,GAAG;AACpD,WAAG,KAAK,qDAAqD;AAAA,MAC9D;AAKA,UAAI,CAAC,UAAU,IAAI,aAAa,aAAa,GAAG;AAC/C;AAAA,MACD;AACA,SAAG,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAkBP;AAAA,IACF;AAAA,EACD;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA,EACN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK,CAAC,OAAiB;AAGtB,UAAI,CAAC,UAAU,IAAI,iBAAiB,oBAAoB,GAAG;AAC1D,WAAG,KAAK,oFAAoF;AAAA,MAC7F;AACA,UAAI,UAAU,IAAI,iBAAiB,YAAY,GAAG;AACjD,WAAG,KAAK,yEAAyE;AACjF,WAAG,KAAK,kDAAkD;AAAA,MAC3D;AAAA,IACD;AAAA,EACD;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA,EACN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA8BN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA6CN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,EAKN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK,CAAC,OAAiB;AAKtB,UAAI,CAAC,UAAU,IAAI,YAAY,UAAU,GAAG;AAC3C,WAAG;AAAA,UACF;AAAA,QAED;AAAA,MACD;AAEA,UAAI,CAAC,UAAU,IAAI,YAAY,YAAY,GAAG;AAC7C,WAAG,KAAK,oDAAoD;AAAA,MAC7D;AACA,UAAI,CAAC,UAAU,IAAI,YAAY,YAAY,GAAG;AAC7C,WAAG,KAAK,4FAA4F;AAAA,MACrG;AACA,UAAI,CAAC,UAAU,IAAI,YAAY,eAAe,GAAG;AAChD,WAAG,KAAK,oDAAoD;AAAA,MAC7D;AAEA,SAAG,KAAK,mFAAmF;AAAA,IAC5F;AAAA,EACD;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAON;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYN;AACD;",
+  "sourcesContent": ["/**\n * Versioned database migrations.\n *\n * The schema follows the internal specification (section 2). Rules:\n *  - Times are stored as UTC epoch seconds (INTEGER); durations as whole minutes.\n *  - Local date/time fields (`ts_local`, `local_date`) are derived caches of `ts_utc` + user time zone.\n *  - Migrations are never *reinterpreted*: a released migration keeps its effect for databases that already\n *    ran it, and every schema change comes as a new migration. Definitions that only freshly created\n *    databases ever see may be tidied up afterwards, as long as fresh and upgraded installations end up with\n *    the same schema (see migration 10, which cleans up behind migrations 1, 2 and 5).\n */\n\nimport type { Db } from \"./database\";\n\n/**\n * A single schema migration: either plain SQL or a JavaScript step for changes that SQL cannot express\n * (e.g. \u201Cdrop this column, but only when it is still there\u201D).\n */\nexport interface Migration {\n\t/** Monotonically increasing version number, applied in ascending order */\n\tversion: number;\n\t/** Short description, stored in `schema_migrations` for traceability */\n\tname: string;\n\t/** SQL statements (may contain several statements separated by semicolons) */\n\tsql?: string;\n\t/** JavaScript steps, run inside the same transaction as `sql` */\n\trun?: (db: Db) => void;\n}\n\n/**\n * Checks whether a table has a column.\n *\n * Migrations that clean up after older versions use this to stay safe for both kinds of database: one that was\n * created by an older version and one that was created by the current one (which never creates the column).\n *\n * @param db - open database handle\n * @param table - table name\n * @param column - column name\n * @returns true when the column exists\n */\nexport function hasColumn(db: Db, table: string, column: string): boolean {\n\tconst rows = db.prepare(`PRAGMA table_info(${table})`).all() as { name: string }[];\n\treturn rows.some(row => row.name === column);\n}\n\nexport const migrations: Migration[] = [\n\t{\n\t\tversion: 1,\n\t\tname: \"core: users, roles, permissions, work profiles, shift and pause rules, settings, sessions, audit, import runs\",\n\t\tsql: `\n\t\t\tCREATE TABLE users (\n\t\t\t\tid              INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tlogin           TEXT    NOT NULL UNIQUE,\n\t\t\t\tpassword_hash   TEXT    NOT NULL DEFAULT '',\n\t\t\t\tdisplay_name    TEXT    NOT NULL,\n\t\t\t\temail           TEXT,\n\t\t\t\trfid_card       TEXT,\n\t\t\t\tis_active       INTEGER NOT NULL DEFAULT 1,\n\t\t\t\tmust_change_pw  INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tlocale          TEXT    NOT NULL DEFAULT 'de-DE',\n\t\t\t\ttimezone        TEXT    NOT NULL DEFAULT 'Europe/Berlin',\n\t\t\t\tcreated_at      INTEGER NOT NULL,\n\t\t\t\tupdated_at      INTEGER NOT NULL,\n\t\t\t\tlast_login_at   INTEGER\n\t\t\t);\n\n\t\t\tCREATE TABLE roles (\n\t\t\t\tid    INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tkey   TEXT NOT NULL UNIQUE,\n\t\t\t\tname  TEXT NOT NULL\n\t\t\t);\n\n\t\t\tCREATE TABLE permissions (\n\t\t\t\tid   INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tkey  TEXT NOT NULL UNIQUE\n\t\t\t);\n\n\t\t\tCREATE TABLE role_permissions (\n\t\t\t\trole_id       INTEGER NOT NULL REFERENCES roles(id)       ON DELETE CASCADE,\n\t\t\t\tpermission_id INTEGER NOT NULL REFERENCES permissions(id) ON DELETE CASCADE,\n\t\t\t\tPRIMARY KEY (role_id, permission_id)\n\t\t\t);\n\n\t\t\tCREATE TABLE user_roles (\n\t\t\t\tuser_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\trole_id INTEGER NOT NULL REFERENCES roles(id) ON DELETE CASCADE,\n\t\t\t\tPRIMARY KEY (user_id, role_id)\n\t\t\t);\n\n\t\t\tCREATE TABLE work_profiles (\n\t\t\t\tuser_id              INTEGER PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\tpercent              REAL    NOT NULL DEFAULT 100,\n\t\t\t\tweekly_hours         REAL    NOT NULL DEFAULT 42.5,\n\t\t\t\tworkdays             TEXT    NOT NULL DEFAULT '0;1;1;1;1;1;0',\n\t\t\t\tstart_date           INTEGER,\n\t\t\t\tend_date             INTEGER,\n\t\t\t\tovertime_carryover   INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tvorholzeit_per_year  INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tvacation_carryover   REAL    NOT NULL DEFAULT 0,\n\t\t\t\tvacation_per_year    REAL    NOT NULL DEFAULT 0,\n\t\t\t\tovertime_model       TEXT    NOT NULL DEFAULT 'monthly'\n\t\t\t\t                     CHECK (overtime_model IN ('cumulative','yearly','monthly')),\n\t\t\t\tholiday_flags        TEXT\n\t\t\t);\n\n\t\t\tCREATE TABLE shift_rules (\n\t\t\t\tid          INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tuser_id     INTEGER REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\tday_of_week INTEGER CHECK (day_of_week IS NULL OR day_of_week BETWEEN 0 AND 6),\n\t\t\t\tfrom_min    INTEGER,\n\t\t\t\tto_min      INTEGER,\n\t\t\t\tsurcharge   REAL    NOT NULL DEFAULT 0,\n\t\t\t\tis_active   INTEGER NOT NULL DEFAULT 1\n\t\t\t);\n\n\t\t\tCREATE TABLE pause_rules (\n\t\t\t\tid        INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tuser_id   INTEGER REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\tfrom_min  INTEGER NOT NULL,\n\t\t\t\tto_min    INTEGER,\n\t\t\t\tpause_min INTEGER NOT NULL,\n\t\t\t\tis_active INTEGER NOT NULL DEFAULT 1,\n\t\t\t\tCHECK (to_min IS NULL OR to_min > from_min)\n\t\t\t);\n\n\t\t\tCREATE TABLE app_settings (\n\t\t\t\tkey        TEXT PRIMARY KEY,\n\t\t\t\tvalue      TEXT NOT NULL,\n\t\t\t\tupdated_at INTEGER NOT NULL\n\t\t\t);\n\n\t\t\tCREATE TABLE sessions (\n\t\t\t\tid         TEXT PRIMARY KEY,\n\t\t\t\tuser_id    INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\tcreated_at INTEGER NOT NULL,\n\t\t\t\texpires_at INTEGER NOT NULL,\n\t\t\t\tuser_agent TEXT,\n\t\t\t\tip         TEXT,\n\t\t\t\trevoked    INTEGER NOT NULL DEFAULT 0\n\t\t\t);\n\n\t\t\tCREATE TABLE audit_log (\n\t\t\t\tid        INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tat_utc    INTEGER NOT NULL,\n\t\t\t\tactor_id  INTEGER,\n\t\t\t\taction    TEXT NOT NULL,\n\t\t\t\tentity    TEXT,\n\t\t\t\tentity_id TEXT,\n\t\t\t\tdetail    TEXT,\n\t\t\t\tip        TEXT\n\t\t\t);\n\n\t\t\tCREATE TABLE import_runs (\n\t\t\t\tid               INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tsource           TEXT NOT NULL,\n\t\t\t\tsource_path      TEXT NOT NULL,\n\t\t\t\tstarted_at       INTEGER NOT NULL,\n\t\t\t\tfinished_at      INTEGER,\n\t\t\t\tmode             TEXT NOT NULL DEFAULT 'dry-run'\n\t\t\t\t                 CHECK (mode IN ('dry-run','commit')),\n\t\t\t\tstatus           TEXT NOT NULL DEFAULT 'running'\n\t\t\t\t                 CHECK (status IN ('running','ok','warnings','mismatch','failed')),\n\t\t\t\ttimezone_assumed TEXT,\n\t\t\t\tstats            TEXT,\n\t\t\t\twarnings         TEXT,\n\t\t\t\tactor_id         INTEGER REFERENCES users(id)\n\t\t\t);\n\t\t`,\n\t},\n\t{\n\t\tversion: 2,\n\t\tname: \"time: entries, audit, day/month/year aggregates, payouts\",\n\t\tsql: `\n\t\t\tCREATE TABLE time_entries (\n\t\t\t\tid              INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tuser_id         INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\tts_utc          INTEGER NOT NULL,\n\t\t\t\tclient_ts_utc   INTEGER,\n\t\t\t\tts_local        INTEGER NOT NULL,\n\t\t\t\tlocal_date      TEXT    NOT NULL,\n\t\t\t\tdirection       TEXT    NOT NULL DEFAULT 'auto'\n\t\t\t\t                CHECK (direction IN ('in','out','auto')),\n\t\t\t\tsource          TEXT    NOT NULL DEFAULT 'web'\n\t\t\t\t                CHECK (source IN ('web','nfc','terminal','api','admin','import')),\n\t\t\t\tidempotency_key TEXT,\n\t\t\t\tsync_state      TEXT    NOT NULL DEFAULT 'synced'\n\t\t\t\t                CHECK (sync_state IN ('synced','pending','conflict')),\n\t\t\t\trevision        INTEGER NOT NULL DEFAULT 1,\n\t\t\t\tnote            TEXT,\n\t\t\t\tcreated_by      INTEGER REFERENCES users(id),\n\t\t\t\tcreated_at      INTEGER NOT NULL,\n\t\t\t\tupdated_at      INTEGER NOT NULL,\n\t\t\t\tupdated_by      INTEGER REFERENCES users(id)\n\t\t\t);\n\n\t\t\tCREATE INDEX idx_entries_user_date ON time_entries(user_id, local_date);\n\t\t\tCREATE INDEX idx_entries_user_ts   ON time_entries(user_id, ts_utc);\n\t\t\tCREATE UNIQUE INDEX idx_entries_idem\n\t\t\t\tON time_entries(user_id, idempotency_key) WHERE idempotency_key IS NOT NULL;\n\n\t\t\tCREATE TABLE time_entry_audit (\n\t\t\t\tid         INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tentry_id   INTEGER,\n\t\t\t\tuser_id    INTEGER NOT NULL,\n\t\t\t\taction     TEXT    NOT NULL,\n\t\t\t\tchanges    TEXT,\n\t\t\t\told_ts_utc INTEGER,\n\t\t\t\tnew_ts_utc INTEGER,\n\t\t\t\trevision   INTEGER,\n\t\t\t\treason     TEXT,\n\t\t\t\tactor_id   INTEGER NOT NULL,\n\t\t\t\tactor_ip   TEXT,\n\t\t\t\tat_utc     INTEGER NOT NULL\n\t\t\t);\n\t\t\tCREATE INDEX idx_entry_audit_entry ON time_entry_audit(entry_id);\n\t\t`,\n\t},\n\t{\n\t\tversion: 3,\n\t\tname: \"aggregates: day, month, year and payouts\",\n\t\tsql: `\n\t\t\tCREATE TABLE day_aggregates (\n\t\t\t\tuser_id        INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\tlocal_date     TEXT    NOT NULL,\n\t\t\t\tworked_min     INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tbreak_min      INTEGER NOT NULL DEFAULT 0,\n\t\t\t\ttarget_min     INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tbalance_min    INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tabsence_code   TEXT,\n\t\t\t\tis_holiday     INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tfirst_in_utc   INTEGER,\n\t\t\t\tlast_out_utc   INTEGER,\n\t\t\t\thas_open_entry INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tupdated_at     INTEGER NOT NULL,\n\t\t\t\tPRIMARY KEY (user_id, local_date)\n\t\t\t);\n\n\t\t\tCREATE TABLE month_aggregates (\n\t\t\t\tuser_id       INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\tyear          INTEGER NOT NULL,\n\t\t\t\tmonth         INTEGER NOT NULL CHECK (month BETWEEN 1 AND 12),\n\t\t\t\tworked_min    INTEGER NOT NULL DEFAULT 0,\n\t\t\t\ttarget_min    INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tbalance_min   INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tovertime_min  INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tvacation_used REAL    NOT NULL DEFAULT 0,\n\t\t\t\tupdated_at    INTEGER NOT NULL,\n\t\t\t\tPRIMARY KEY (user_id, year, month)\n\t\t\t);\n\n\t\t\tCREATE TABLE year_aggregates (\n\t\t\t\tuser_id               INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\tyear                  INTEGER NOT NULL,\n\t\t\t\tworked_min            INTEGER NOT NULL DEFAULT 0,\n\t\t\t\ttarget_min            INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tovertime_min          INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tovertime_start        INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tvacation_days         REAL    NOT NULL DEFAULT 0,\n\t\t\t\tvacation_used         REAL    NOT NULL DEFAULT 0,\n\t\t\t\tvacation_left         REAL    NOT NULL DEFAULT 0,\n\t\t\t\tvacation_planned_days REAL    NOT NULL DEFAULT 0,\n\t\t\t\tsettled               INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tupdated_at            INTEGER NOT NULL,\n\t\t\t\tPRIMARY KEY (user_id, year)\n\t\t\t);\n\n\t\t\tCREATE TABLE payouts (\n\t\t\t\tid         INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tuser_id    INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\tyear       INTEGER NOT NULL,\n\t\t\t\tmonth      INTEGER,\n\t\t\t\tminutes    INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tamount     REAL,\n\t\t\t\tnote       TEXT,\n\t\t\t\tcreated_at INTEGER NOT NULL,\n\t\t\t\tcreated_by INTEGER REFERENCES users(id)\n\t\t\t);\n\t\t\tCREATE INDEX idx_payouts_user ON payouts(user_id, year, month);\n\t\t`,\n\t},\n\t{\n\t\tversion: 4,\n\t\tname: \"absence: types, absences, holidays\",\n\t\tsql: `\n\t\t\tCREATE TABLE absence_types (\n\t\t\t\tid              INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tuser_id         INTEGER REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\tcode            TEXT    NOT NULL,\n\t\t\t\tname            TEXT    NOT NULL,\n\t\t\t\tpaid            INTEGER NOT NULL DEFAULT 1,\n\t\t\t\tfactor          REAL    NOT NULL DEFAULT 100,\n\t\t\t\treduce_vacation INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tis_active       INTEGER NOT NULL DEFAULT 1\n\t\t\t);\n\n\t\t\tCREATE UNIQUE INDEX idx_absence_types_global\n\t\t\t\tON absence_types(code) WHERE user_id IS NULL;\n\t\t\tCREATE UNIQUE INDEX idx_absence_types_user\n\t\t\t\tON absence_types(user_id, code) WHERE user_id IS NOT NULL;\n\n\t\t\tCREATE TABLE absences (\n\t\t\t\tid          INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tuser_id     INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\ttype_id     INTEGER NOT NULL REFERENCES absence_types(id),\n\t\t\t\tdate_from   TEXT    NOT NULL,\n\t\t\t\tdate_to     TEXT    NOT NULL,\n\t\t\t\tday_portion REAL    NOT NULL DEFAULT 1 CHECK (day_portion > 0 AND day_portion <= 1),\n\t\t\t\thours       REAL,\n\t\t\t\tstatus      TEXT    NOT NULL DEFAULT 'taken'\n\t\t\t\t            CHECK (status IN ('taken','planned')),\n\t\t\t\tnote        TEXT,\n\t\t\t\tcreated_at  INTEGER NOT NULL,\n\t\t\t\tcreated_by  INTEGER REFERENCES users(id),\n\t\t\t\tCHECK (date_from <= date_to)\n\t\t\t);\n\t\t\tCREATE INDEX idx_absences_user_dates ON absences(user_id, date_from, date_to);\n\n\t\t\tCREATE TABLE holidays (\n\t\t\t\tid     INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tregion TEXT    NOT NULL DEFAULT 'global',\n\t\t\t\tyear   INTEGER NOT NULL,\n\t\t\t\tdate   TEXT    NOT NULL,\n\t\t\t\tname   TEXT    NOT NULL,\n\t\t\t\tUNIQUE (region, date)\n\t\t\t);\n\t\t\tCREATE INDEX idx_holidays_year ON holidays(year, region);\n\t\t`,\n\t},\n\t{\n\t\tversion: 5,\n\t\tname: \"devices: rfid tags and kiosk terminals\",\n\t\tsql: `\n\t\t\tCREATE TABLE rfid_tags (\n\t\t\t\tid           INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tuid          TEXT,\n\t\t\t\ttoken_hash   TEXT    NOT NULL,\n\t\t\t\tuser_id      INTEGER REFERENCES users(id) ON DELETE SET NULL,\n\t\t\t\tlabel        TEXT,\n\t\t\t\tis_active    INTEGER NOT NULL DEFAULT 1,\n\t\t\t\texpires_at   INTEGER,\n\t\t\t\tlast_used_at INTEGER,\n\t\t\t\tcreated_at   INTEGER NOT NULL\n\t\t\t);\n\t\t\tCREATE UNIQUE INDEX idx_rfid_uid ON rfid_tags(uid) WHERE uid IS NOT NULL;\n\n\t\t\tCREATE TABLE kiosk_terminals (\n\t\t\t\tid           INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tname         TEXT    NOT NULL,\n\t\t\t\tlocation     TEXT,\n\t\t\t\ttoken_hash   TEXT    NOT NULL,\n\t\t\t\tpin_required INTEGER NOT NULL DEFAULT 1,\n\t\t\t\tis_active    INTEGER NOT NULL DEFAULT 1,\n\t\t\t\texpires_at   INTEGER,\n\t\t\t\tlast_seen_at INTEGER,\n\t\t\t\tcreated_at   INTEGER NOT NULL\n\t\t\t);\n\t\t`,\n\t},\n\t{\n\t\tversion: 6,\n\t\tname: \"users: personal PIN for the kiosk terminal\",\n\t\tsql: `ALTER TABLE users ADD COLUMN pin_hash TEXT;`,\n\t},\n\t{\n\t\tversion: 7,\n\t\tname: \"kiosk terminals: short lived sessions\",\n\t\tsql: `\n\t\t\tALTER TABLE kiosk_terminals ADD COLUMN session_hash       TEXT;\n\t\t\tALTER TABLE kiosk_terminals ADD COLUMN session_expires_at INTEGER;\n\t\t`,\n\t},\n\t{\n\t\tversion: 8,\n\t\tname: \"defaults: time zone Europe/Zurich becomes Europe/Berlin\",\n\t\tsql: `\n\t\t\t-- The default time zone of the adapter is Europe/Berlin now. Migration 1 is append-only, so a new\n\t\t\t-- database already gets the new default with it; existing installations are adjusted here: every\n\t\t\t-- employee and every instance setting that still carries the old default is moved over. Values that\n\t\t\t-- were chosen deliberately keep their name \u2014 they only change when they are exactly the old default.\n\t\t\tUPDATE users        SET timezone = 'Europe/Berlin' WHERE timezone = 'Europe/Zurich';\n\t\t\tUPDATE app_settings SET value    = 'Europe/Berlin' WHERE key = 'timezone' AND value = 'Europe/Zurich';\n\t\t`,\n\t},\n\t{\n\t\tversion: 9,\n\t\tname: \"users: picture of the employee\",\n\t\tsql: `ALTER TABLE users ADD COLUMN avatar TEXT;`,\n\t},\n\t{\n\t\tversion: 10,\n\t\tname: \"drops the leftovers of the removed data import\",\n\t\trun: (db: Db): void => {\n\t\t\t// The adapter does not read data of another time tracking system any more, so the columns that existed\n\t\t\t// for it are dropped. Fresh databases never create them (migrations 1, 2 and 5 are clean), so every\n\t\t\t// step asks first: an upgraded database loses the columns, a fresh one has nothing to do.\n\t\t\tif (hasColumn(db, \"users\", \"legacy_sha1\")) {\n\t\t\t\tdb.exec(\"ALTER TABLE users DROP COLUMN legacy_sha1\");\n\t\t\t}\n\t\t\tif (hasColumn(db, \"work_profiles\", \"legacy_source\")) {\n\t\t\t\tdb.exec(\"ALTER TABLE work_profiles DROP COLUMN legacy_source\");\n\t\t\t}\n\n\t\t\t// rfid_tags carried the printed card number of that system as a second identifier. SQLite cannot drop\n\t\t\t// a column that a CHECK constraint mentions, so the table is rebuilt without it; existing rows keep\n\t\t\t// their id, their uid and their token hash, and the unique index on the uid is recreated.\n\t\t\tif (!hasColumn(db, \"rfid_tags\", \"legacy_code\")) {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tdb.exec(`\n\t\t\t\tCREATE TABLE rfid_tags_new (\n\t\t\t\t\tid           INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\t\tuid          TEXT,\n\t\t\t\t\ttoken_hash   TEXT    NOT NULL,\n\t\t\t\t\tuser_id      INTEGER REFERENCES users(id) ON DELETE SET NULL,\n\t\t\t\t\tlabel        TEXT,\n\t\t\t\t\tis_active    INTEGER NOT NULL DEFAULT 1,\n\t\t\t\t\texpires_at   INTEGER,\n\t\t\t\t\tlast_used_at INTEGER,\n\t\t\t\t\tcreated_at   INTEGER NOT NULL\n\t\t\t\t);\n\t\t\t\tINSERT INTO rfid_tags_new (id, uid, token_hash, user_id, label, is_active, expires_at, last_used_at, created_at)\n\t\t\t\t\tSELECT id, uid, token_hash, user_id, label, is_active, expires_at, last_used_at, created_at\n\t\t\t\t\tFROM rfid_tags;\n\t\t\t\tDROP TABLE rfid_tags;\n\t\t\t\tALTER TABLE rfid_tags_new RENAME TO rfid_tags;\n\t\t\t\tCREATE UNIQUE INDEX idx_rfid_uid ON rfid_tags(uid) WHERE uid IS NOT NULL;\n\t\t\t`);\n\t\t},\n\t},\n\t{\n\t\tversion: 11,\n\t\tname: \"terminals: the employees of a terminal\",\n\t\tsql: `\n\t\t\t-- A terminal stands at one place \u2014 an office, a workshop \u2014 and is meant for the employees that work\n\t\t\t-- there. No row for a terminal means \"all employees\", so terminals that existed before keep working\n\t\t\t-- exactly as they did.\n\t\t\tCREATE TABLE terminal_users (\n\t\t\t\tterminal_id INTEGER NOT NULL REFERENCES kiosk_terminals(id) ON DELETE CASCADE,\n\t\t\t\tuser_id     INTEGER NOT NULL REFERENCES users(id)           ON DELETE CASCADE,\n\t\t\t\tcreated_at  INTEGER NOT NULL,\n\t\t\t\tPRIMARY KEY (terminal_id, user_id)\n\t\t\t);\n\t\t\tCREATE INDEX idx_terminal_users_user ON terminal_users(user_id);\n\t\t`,\n\t},\n\t{\n\t\tversion: 12,\n\t\tname: \"work profiles: paid breaks\",\n\t\tsql: `ALTER TABLE work_profiles ADD COLUMN pause_paid INTEGER NOT NULL DEFAULT 0;`,\n\t},\n\t{\n\t\tversion: 13,\n\t\tname: \"work profiles: paid break minutes instead of the paid flag\",\n\t\trun: (db: Db): void => {\n\t\t\t// The flag became an amount: a company may pay a quarter of an hour and nothing more. A profile that had\n\t\t\t// the flag set keeps a fully paid break (a day has 1440 minutes), a fresh profile pays nothing at all.\n\t\t\tif (!hasColumn(db, \"work_profiles\", \"pause_paid_minutes\")) {\n\t\t\t\tdb.exec(\"ALTER TABLE work_profiles ADD COLUMN pause_paid_minutes INTEGER NOT NULL DEFAULT 0\");\n\t\t\t}\n\t\t\tif (hasColumn(db, \"work_profiles\", \"pause_paid\")) {\n\t\t\t\tdb.exec(\"UPDATE work_profiles SET pause_paid_minutes = 1440 WHERE pause_paid = 1\");\n\t\t\t\tdb.exec(\"ALTER TABLE work_profiles DROP COLUMN pause_paid\");\n\t\t\t}\n\t\t},\n\t},\n\t{\n\t\tversion: 14,\n\t\tname: \"day aggregates: paid break minutes\",\n\t\tsql: `ALTER TABLE day_aggregates ADD COLUMN paid_break_min INTEGER NOT NULL DEFAULT 0;`,\n\t},\n\t{\n\t\tversion: 15,\n\t\tname: \"trigger rules: ioBroker states that punch or set the presence\",\n\t\tsql: `\n\t\t\t-- A rule watches a state of another adapter (a fingerprint reader, a button, a door contact) and turns a\n\t\t\t-- write on it into a punch or a presence change. Mode \"condition\" fires when the value matches\n\t\t\t-- \"condition\" and punches for \"user_id\"; mode \"user\" posts the employee the value names. \"last_fired_at\"\n\t\t\t-- keeps a chatty reader in check together with \"cooldown_sec\".\n\t\t\tCREATE TABLE trigger_rules (\n\t\t\t\tid            INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tlabel         TEXT,\n\t\t\t\tsource_state  TEXT    NOT NULL,\n\t\t\t\tmode          TEXT    NOT NULL DEFAULT 'condition'\n\t\t\t\t\tCHECK (mode IN ('condition','user')),\n\t\t\t\tcondition     TEXT,\n\t\t\t\tuser_id       INTEGER REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\taction        TEXT    NOT NULL DEFAULT 'punch'\n\t\t\t\t\tCHECK (action IN ('punch','quickPunch','present','absent')),\n\t\t\t\tis_active     INTEGER NOT NULL DEFAULT 1,\n\t\t\t\tcooldown_sec  INTEGER NOT NULL DEFAULT 0,\n\t\t\t\tlast_fired_at INTEGER,\n\t\t\t\tcreated_at    INTEGER NOT NULL,\n\t\t\t\tupdated_at    INTEGER NOT NULL\n\t\t\t);\n\t\t\tCREATE INDEX idx_trigger_rules_source ON trigger_rules(source_state);\n\t\t`,\n\t},\n\t{\n\t\tversion: 16,\n\t\tname: \"automation rules: what the adapter does on its own (clock out, reminders)\",\n\t\tsql: `\n\t\t\t-- A rule of the adapter itself, not of a foreign state: at a certain local time (clockOut, missingPunch)\n\t\t\t-- or after a while without a break (breakReminder) the adapter acts. \"user_id\" is NULL for every\n\t\t\t-- employee, so a company rule and a rule for one person can live side by side.\n\t\t\tCREATE TABLE automation_rules (\n\t\t\t\tid            INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tlabel         TEXT,\n\t\t\t\tkind          TEXT    NOT NULL\n\t\t\t\t\tCHECK (kind IN ('clockOut','missingPunch','breakReminder')),\n\t\t\t\tuser_id       INTEGER REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\tat_minute     INTEGER,\n\t\t\t\tafter_minutes INTEGER,\n\t\t\t\tis_active     INTEGER NOT NULL DEFAULT 1,\n\t\t\t\tcreated_at    INTEGER NOT NULL,\n\t\t\t\tupdated_at    INTEGER NOT NULL\n\t\t\t);\n\t\t\tCREATE INDEX idx_automation_rules_kind ON automation_rules(kind);\n\n\t\t\t-- What a rule already did: one row per rule, employee and local date keeps it at \"once a day\" and doubles\n\t\t\t-- as the log the administration shows. A punch that is already written is never written twice.\n\t\t\tCREATE TABLE automation_runs (\n\t\t\t\trule_id    INTEGER NOT NULL REFERENCES automation_rules(id) ON DELETE CASCADE,\n\t\t\t\tuser_id    INTEGER NOT NULL REFERENCES users(id)            ON DELETE CASCADE,\n\t\t\t\tlocal_date TEXT    NOT NULL,\n\t\t\t\tfired_at   INTEGER NOT NULL,\n\t\t\t\taction     TEXT    NOT NULL,\n\t\t\t\tPRIMARY KEY (rule_id, user_id, local_date)\n\t\t\t);\n\t\t\tCREATE INDEX idx_automation_runs_user ON automation_runs(user_id, local_date);\n\t\t`,\n\t},\n\t{\n\t\tversion: 17,\n\t\tname: \"automation rules: weekdays and a weekly instead of a daily guard\",\n\t\tsql: `\n\t\t\t-- A rule can be limited to certain weekdays: bit 0 is Monday \u2026 bit 6 is Sunday, 127 is every day.\n\t\t\tALTER TABLE automation_rules ADD COLUMN weekdays INTEGER NOT NULL DEFAULT 127;\n\n\t\t\t-- 'day' keeps the guard of one run per employee and date, 'week' allows one run per ISO week.\n\t\t\tALTER TABLE automation_rules ADD COLUMN repeat TEXT NOT NULL DEFAULT 'day';\n\n\t\t\t-- the guard column no longer holds a date only: for a weekly rule it is the ISO week (2026-W38), so the\n\t\t\t-- name says what it keeps. Existing rows stay valid \u2014 a date is the period of a daily rule.\n\t\t\tALTER TABLE automation_runs RENAME COLUMN local_date TO period;\n\t\t`,\n\t},\n\t{\n\t\tversion: 18,\n\t\tname: \"automation rules: the kind clockIn (punch in somebody who is missing)\",\n\t\tsql: `\n\t\t\t-- A fourth kind joins the rules: 'clockIn' punches an employee in who is still missing at the configured\n\t\t\t-- time (the decision makes sure nobody is clocked in already). SQLite cannot change a CHECK constraint in\n\t\t\t-- place, so the table is rebuilt \u2014 and because automation_runs belongs to it with ON DELETE CASCADE, the\n\t\t\t-- run log is copied first: dropping the parent would take it with it.\n\t\t\tCREATE TABLE automation_runs_copy (\n\t\t\t\trule_id    INTEGER NOT NULL,\n\t\t\t\tuser_id    INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\tperiod     TEXT    NOT NULL,\n\t\t\t\tfired_at   INTEGER NOT NULL,\n\t\t\t\taction     TEXT    NOT NULL,\n\t\t\t\tPRIMARY KEY (rule_id, user_id, period)\n\t\t\t);\n\t\t\tINSERT INTO automation_runs_copy (rule_id, user_id, period, fired_at, action)\n\t\t\t\tSELECT rule_id, user_id, period, fired_at, action FROM automation_runs;\n\n\t\t\tCREATE TABLE automation_rules_new (\n\t\t\t\tid            INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tlabel         TEXT,\n\t\t\t\tkind          TEXT    NOT NULL\n\t\t\t\t\tCHECK (kind IN ('clockIn','clockOut','missingPunch','breakReminder')),\n\t\t\t\tuser_id       INTEGER REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\tat_minute     INTEGER,\n\t\t\t\tafter_minutes INTEGER,\n\t\t\t\tweekdays      INTEGER NOT NULL DEFAULT 127,\n\t\t\t\trepeat        TEXT    NOT NULL DEFAULT 'day',\n\t\t\t\tis_active     INTEGER NOT NULL DEFAULT 1,\n\t\t\t\tcreated_at    INTEGER NOT NULL,\n\t\t\t\tupdated_at    INTEGER NOT NULL\n\t\t\t);\n\t\t\tINSERT INTO automation_rules_new\n\t\t\t\t(id, label, kind, user_id, at_minute, after_minutes, weekdays, repeat, is_active, created_at, updated_at)\n\t\t\t\tSELECT id, label, kind, user_id, at_minute, after_minutes, weekdays, repeat, is_active, created_at, updated_at\n\t\t\t\tFROM automation_rules;\n\n\t\t\tDROP TABLE automation_runs;\n\t\t\tDROP TABLE automation_rules;\n\t\t\tALTER TABLE automation_rules_new RENAME TO automation_rules;\n\t\t\t-- the runs keep their user reference; the reference to the rule is kept by the repository, which deletes\n\t\t\t-- the runs of a rule together with it\n\t\t\tALTER TABLE automation_runs_copy RENAME TO automation_runs;\n\n\t\t\tCREATE INDEX idx_automation_rules_kind ON automation_rules(kind);\n\t\t\tCREATE INDEX idx_automation_runs_user ON automation_runs(user_id, period);\n\t\t`,\n\t},\n\t{\n\t\tversion: 19,\n\t\tname: \"holidays: a stable key next to the name, so the app can translate the seeded days\",\n\t\tsql: `\n\t\t\t-- The seeded holidays carry an English name. The key says which day it is, so the web app shows it in the\n\t\t\t-- language of the display; a day somebody added by hand has no key and keeps its own name.\n\t\t\tALTER TABLE holidays ADD COLUMN key TEXT;\n\n\t\t\t-- the days that are already stored get their key from the date\n\t\t\tUPDATE holidays SET key = 'newYear'    WHERE key IS NULL AND date LIKE '%-01-01';\n\t\t\tUPDATE holidays SET key = 'epiphany'   WHERE key IS NULL AND date LIKE '%-01-06';\n\t\t\tUPDATE holidays SET key = 'labourDay'  WHERE key IS NULL AND date LIKE '%-05-01';\n\t\t\tUPDATE holidays SET key = 'nationalDay' WHERE key IS NULL AND (date LIKE '%-08-01' OR date LIKE '%-10-26');\n\t\t\tUPDATE holidays SET key = 'assumption' WHERE key IS NULL AND date LIKE '%-08-15';\n\t\t\tUPDATE holidays SET key = 'germanUnity' WHERE key IS NULL AND date LIKE '%-10-03';\n\t\t\tUPDATE holidays SET key = 'allSaints'  WHERE key IS NULL AND date LIKE '%-11-01';\n\t\t\tUPDATE holidays SET key = 'immaculateConception' WHERE key IS NULL AND date LIKE '%-12-08';\n\t\t\tUPDATE holidays SET key = 'christmas'  WHERE key IS NULL AND date LIKE '%-12-25';\n\t\t\tUPDATE holidays SET key = 'boxingDay'  WHERE key IS NULL AND date LIKE '%-12-26';\n\t\t\t-- the movable feasts carry their English name, which is unique enough to find them again\n\t\t\tUPDATE holidays SET key = 'goodFriday'   WHERE key IS NULL AND name = 'Good Friday';\n\t\t\tUPDATE holidays SET key = 'easterMonday' WHERE key IS NULL AND name = 'Easter Monday';\n\t\t\tUPDATE holidays SET key = 'ascension'    WHERE key IS NULL AND name = 'Ascension Day';\n\t\t\tUPDATE holidays SET key = 'whitMonday'   WHERE key IS NULL AND name = 'Whit Monday';\n\t\t\tUPDATE holidays SET key = 'corpusChristi' WHERE key IS NULL AND name = 'Corpus Christi';\n\t\t`,\n\t},\n\t{\n\t\tversion: 20,\n\t\tname: \"work profiles: whether the presence card shows the working time of the day\",\n\t\tsql: `\n\t\t\t-- The presence screen is visible before the PIN is entered, so showing the worked time of an employee\n\t\t\t-- is a decision of the administration, per employee. Off by default.\n\t\t\tALTER TABLE work_profiles ADD COLUMN show_worked_time INTEGER NOT NULL DEFAULT 0;\n\t\t`,\n\t},\n\t{\n\t\tversion: 21,\n\t\tname: \"absences: approval by the administration (requested, approved, rejected)\",\n\t\trun: (db: Db): void => {\n\t\t\t// An employee requests, the administration decides. `approval` is separate from `status`, which keeps\n\t\t\t// saying whether the days are planned or already taken: a request can be planned and still wait for\n\t\t\t// its decision. Everything that exists before this migration counts as approved, so no figure changes\n\t\t\t// for a running installation; a request of an employee starts as `requested`.\n\t\t\tif (!hasColumn(db, \"absences\", \"approval\")) {\n\t\t\t\tdb.exec(\n\t\t\t\t\t\"ALTER TABLE absences ADD COLUMN approval TEXT NOT NULL DEFAULT 'approved' \" +\n\t\t\t\t\t\t\"CHECK (approval IN ('requested','approved','rejected'))\",\n\t\t\t\t);\n\t\t\t}\n\t\t\t// Who decided when and why \u2014 a rejection without a reason is not much use to the employee.\n\t\t\tif (!hasColumn(db, \"absences\", \"decided_at\")) {\n\t\t\t\tdb.exec(\"ALTER TABLE absences ADD COLUMN decided_at INTEGER\");\n\t\t\t}\n\t\t\tif (!hasColumn(db, \"absences\", \"decided_by\")) {\n\t\t\t\tdb.exec(\"ALTER TABLE absences ADD COLUMN decided_by INTEGER REFERENCES users(id) ON DELETE SET NULL\");\n\t\t\t}\n\t\t\tif (!hasColumn(db, \"absences\", \"decision_note\")) {\n\t\t\t\tdb.exec(\"ALTER TABLE absences ADD COLUMN decision_note TEXT\");\n\t\t\t}\n\t\t\t// The administration looks at the open requests first, so they get an index of their own.\n\t\t\tdb.exec(\"CREATE INDEX IF NOT EXISTS idx_absences_approval ON absences(approval, date_from)\");\n\t\t},\n\t},\n\t{\n\t\tversion: 22,\n\t\tname: \"absence types: sickness, accident and military are for the administration only\",\n\t\tsql: `\n\t\t\t-- A sickness note usually reaches a company on the same day, so nobody \u201Crequests\u201D it: the administration\n\t\t\t-- books it. \u201CVisible for everybody\u201D (is_active) therefore starts switched off for these three types, so an\n\t\t\t-- employee does not find them in the app. The administration can switch it on again in the card of the\n\t\t\t-- absence types at any time.\n\t\t\tUPDATE absence_types SET is_active = 0\n\t\t\t WHERE user_id IS NULL AND code IN ('K','U','M') AND is_active = 1;\n\t\t`,\n\t},\n\t{\n\t\tversion: 23,\n\t\tname: \"users: a private token for the calendar feed\",\n\t\tsql: `\n\t\t\t-- Everybody can subscribe to the own absences in a calendar app (Google, Outlook, Apple). The feed is a\n\t\t\t-- public route with a secret in the URL, so the token belongs to one employee and can be rotated: a new\n\t\t\t-- token makes the old link invalid. A missing token simply means \u201Cno feed yet\u201D.\n\t\t\tALTER TABLE users ADD COLUMN calendar_token TEXT;\n\t\t\tCREATE UNIQUE INDEX idx_users_calendar_token ON users(calendar_token) WHERE calendar_token IS NOT NULL;\n\t\t`,\n\t},\n\t{\n\t\tversion: 24,\n\t\tname: \"absence types: a colour for the calendar\",\n\t\tsql: `\n\t\t\t-- The calendar grid marks an absence with the colour of its type, so vacation and sickness are told apart at\n\t\t\t-- a glance. The seeded types get their colour here; an empty value keeps the default of the display.\n\t\t\tALTER TABLE absence_types ADD COLUMN color TEXT;\n\t\t\tUPDATE absence_types SET color = '#2e7d32' WHERE color IS NULL AND code = 'F';\n\t\t\tUPDATE absence_types SET color = '#c62828' WHERE color IS NULL AND code = 'K';\n\t\t\tUPDATE absence_types SET color = '#ef6c00' WHERE color IS NULL AND code = 'U';\n\t\t\tUPDATE absence_types SET color = '#455a64' WHERE color IS NULL AND code = 'M';\n\t\t\tUPDATE absence_types SET color = '#1565c0' WHERE color IS NULL AND code = 'I';\n\t\t\tUPDATE absence_types SET color = '#6a1b9a' WHERE color IS NULL AND code = 'W';\n\t\t\tUPDATE absence_types SET color = '#795548' WHERE color IS NULL AND code = 'E';\n\t\t`,\n\t},\n\t{\n\t\tversion: 25,\n\t\tname: \"day notes: what an employee wants the administration to know about one day\",\n\t\tsql: `\n\t\t\t-- An employee does not change punches any more; the day of a forgotten punch is corrected by the\n\t\t\t-- administration. What the employee may do is leave a note for that day (\u201Cforgot to clock in or out\u201D),\n\t\t\t-- so the message lives outside the punches: a day without a punch is exactly the case it is meant for.\n\t\t\t-- One note per employee and day; the administration marks it as handled and keeps it for the record.\n\t\t\tCREATE TABLE day_notes (\n\t\t\t\tid          INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\tuser_id     INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n\t\t\t\tlocal_date  TEXT    NOT NULL,\n\t\t\t\tnote        TEXT    NOT NULL,\n\t\t\t\tcreated_by  INTEGER REFERENCES users(id),\n\t\t\t\tcreated_at  INTEGER NOT NULL,\n\t\t\t\tupdated_by  INTEGER REFERENCES users(id),\n\t\t\t\tupdated_at  INTEGER NOT NULL,\n\t\t\t\thandled_at  INTEGER,\n\t\t\t\thandled_by  INTEGER REFERENCES users(id)\n\t\t\t);\n\n\t\t\tCREATE UNIQUE INDEX idx_day_notes_user_date ON day_notes(user_id, local_date);\n\t\t\tCREATE INDEX idx_day_notes_open ON day_notes(handled_at, local_date);\n\t\t\t`,\n\t},\n\t{\n\t\tversion: 26,\n\t\tname: \"roles: the administrator does not punch\",\n\t\tsql: `\n\t\t\t-- The administrator account is created by the installation and belongs to nobody: it administers the\n\t\t\t-- employees instead of working with them, so it needs no punch. Punching stays with the roles that\n\t\t\t-- belong to a person: a manager corrects and punches, an employee punches. An administrator who also\n\t\t\t-- works gets the right back through the employee role, because permissions are the union of the roles\n\t\t\t-- of an account.\n\t\t\tDELETE FROM role_permissions\n\t\t\t WHERE role_id = (SELECT id FROM roles WHERE key = 'admin')\n\t\t\t   AND permission_id = (SELECT id FROM permissions WHERE key = 'time.punch');\n\t\t\t`,\n\t},\n];\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAwCO,SAAS,UAAU,IAAQ,OAAe,QAAyB;AACzE,QAAM,OAAO,GAAG,QAAQ,qBAAqB,KAAK,GAAG,EAAE,IAAI;AAC3D,SAAO,KAAK,KAAK,SAAO,IAAI,SAAS,MAAM;AAC5C;AAEO,MAAM,aAA0B;AAAA,EACtC;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuHN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4CN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA2DN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4CN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA,EACN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA,EAIN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA,EACN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK,CAAC,OAAiB;AAItB,UAAI,UAAU,IAAI,SAAS,aAAa,GAAG;AAC1C,WAAG,KAAK,2CAA2C;AAAA,MACpD;AACA,UAAI,UAAU,IAAI,iBAAiB,eAAe,GAAG;AACpD,WAAG,KAAK,qDAAqD;AAAA,MAC9D;AAKA,UAAI,CAAC,UAAU,IAAI,aAAa,aAAa,GAAG;AAC/C;AAAA,MACD;AACA,SAAG,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAkBP;AAAA,IACF;AAAA,EACD;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA,EACN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK,CAAC,OAAiB;AAGtB,UAAI,CAAC,UAAU,IAAI,iBAAiB,oBAAoB,GAAG;AAC1D,WAAG,KAAK,oFAAoF;AAAA,MAC7F;AACA,UAAI,UAAU,IAAI,iBAAiB,YAAY,GAAG;AACjD,WAAG,KAAK,yEAAyE;AACjF,WAAG,KAAK,kDAAkD;AAAA,MAC3D;AAAA,IACD;AAAA,EACD;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA,EACN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA8BN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA6CN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,EAKN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK,CAAC,OAAiB;AAKtB,UAAI,CAAC,UAAU,IAAI,YAAY,UAAU,GAAG;AAC3C,WAAG;AAAA,UACF;AAAA,QAED;AAAA,MACD;AAEA,UAAI,CAAC,UAAU,IAAI,YAAY,YAAY,GAAG;AAC7C,WAAG,KAAK,oDAAoD;AAAA,MAC7D;AACA,UAAI,CAAC,UAAU,IAAI,YAAY,YAAY,GAAG;AAC7C,WAAG,KAAK,4FAA4F;AAAA,MACrG;AACA,UAAI,CAAC,UAAU,IAAI,YAAY,eAAe,GAAG;AAChD,WAAG,KAAK,oDAAoD;AAAA,MAC7D;AAEA,SAAG,KAAK,mFAAmF;AAAA,IAC5F;AAAA,EACD;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAON;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBN;AAAA,EACA;AAAA,IACC,SAAS;AAAA,IACT,MAAM;AAAA,IACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUN;AACD;",
   "names": []
 }