Add download for protocol visit photos (Task #660 )

Users could upload photos into Protocol "تصوير" albums but had no way to download them — clicking a photo only opened it inline. This adds per-photo downloads and a whole-album ZIP download. Backend: - objectStorage.ts: new exported extensionForContentType() mapping content types to file extensions (stored paths are extension-less UUIDs). - storage.ts: opt-in ?download=1 mode on GET /storage/objects/*path sets Content-Disposition: attachment (with optional ?name base + derived ext); default inline behavior and per-entity authz unchanged. - protocol.ts: new GET /protocol/photo-albums/:id/download streams all album photos as a ZIP (guarded by requireProtocolAccess), named from the album; unreadable objects are skipped rather than failing the archive. Empty album returns 404. - Added archiver@8 dependency (+@types/archiver dev). Frontend (protocol.tsx): - Per-photo download button (attachment, name = album-index) in album detail. - "تحميل الكل" / "Download all" ZIP button in album header; rendered disabled (not hidden) when the album has no photos. - Added photoDownloadSrc/albumDownloadSrc helpers, Download icon. - AR/EN locale strings protocol.photos.download / downloadAll. Notes / deviations: - archiver v8 is ESM-only with no callable default export; used `new ZipArchive(...)` instead of `archiver("zip")`. Recorded in memory. - Could not run authenticated e2e (seed admin password is a secret). Verified: api-server typecheck + build pass, tx-os typecheck passes, server healthy, new routes wired (401 auth-required not 404). Pre-existing typecheck errors in executive-meetings.ts / push.ts are unrelated and untouched.
2026-07-07 09:37:15 +00:00 · 2026-07-07 09:34:06 +00:00 · 2026-07-07 09:25:28 +00:00 · 2026-07-07 09:14:07 +00:00 · 2026-07-07 08:58:54 +00:00 · 2026-07-07 08:24:00 +00:00
22 changed files with 6645 additions and 8 deletions
@@ -119,3 +119,9 @@ id = "FXgAx0l684F40vfGD6lqD"
 uri = "file://attached_assets/generated_images/platform_architecture_ar.png"
 type = "image"
 title = "بنية المنصة — تخطيط احترافي"
+
+[[outputs]]
+id = "8gXcnoA-hNBH1c_T0ki__"
+uri = "file://dist/TX-latest.tar.gz"
+type = "unspecified"
+title = "TX-latest — كامل المشروع مع التاريخ (git bundle)"
@@ -24,6 +24,10 @@ args = "Start application"
 task = "workflow.run"
 args = "API"

+[[workflows.workflow.tasks]]
+task = "workflow.run"
+args = "tailscaled"
+
 [[workflows.workflow]]
 name = "Start application"
 author = "agent"
@@ -48,6 +52,17 @@ waitForPort = 8080
 [workflows.workflow.metadata]
 outputType = "console"

+[[workflows.workflow]]
+name = "tailscaled"
+author = "agent"
+
+[[workflows.workflow.tasks]]
+task = "shell.exec"
+args = "cd /tmp/tailscale_1.80.2_amd64 && ./tailscaled --tun=userspace-networking --socks5-server=localhost:1055 --outbound-http-proxy-listen=localhost:1055 --statedir=/tmp/tsstate --socket=/tmp/tsstate/tailscaled.sock"
+
+[workflows.workflow.metadata]
+outputType = "console"
+
 [agent]
 stack = "PNPM_WORKSPACE"
 expertMode = true
@@ -20,6 +20,7 @@
    "@workspace/api-zod": "workspace:*",
    "@workspace/db": "workspace:*",
    "arabic-persian-reshaper": "1.0.1",
+    "archiver": "^8.0.0",
    "bcryptjs": "^3.0.3",
    "bidi-js": "^1.0.3",
    "connect-pg-simple": "^10.0.0",
@@ -41,6 +42,7 @@
    "zod": "catalog:"
  },
  "devDependencies": {
+    "@types/archiver": "^8.0.0",
    "@types/bcryptjs": "^3.0.0",
    "@types/connect-pg-simple": "^7.0.3",
    "@types/cookie-parser": "^1.4.10",
@@ -5,10 +5,11 @@ import {
  servicesTable,
  executiveMeetingFontSettingsTable,
  executiveMeetingPdfArchivesTable,
+  protocolPhotosTable,
  rolesTable,
 } from "@workspace/db";
 import { eq, inArray, sql } from "drizzle-orm";
-import { getEffectiveRoleIds } from "../middlewares/auth";
+import { getEffectiveRoleIds, userHasPermission } from "../middlewares/auth";
 import { getVisibleAppsForUser } from "./appsVisibility";

 // Roles that gate read access to the Executive Meetings module.
@@ -152,6 +153,18 @@ export async function canUserReadObjectPath(
  const rows = (meeting as unknown as { rows?: unknown[] }).rows ?? [];
  if (rows.length > 0) return hasExecutiveAccess;

+  // 7. Protocol visit photos — gated by the protocol read permission
+  //    (`protocol.access`), the same scoped permission that makes the
+  //    Protocol tile visible. Never gated by role name (module convention).
+  const photo = await db
+    .select({ id: protocolPhotosTable.id })
+    .from(protocolPhotosTable)
+    .where(eq(protocolPhotosTable.objectPath, objectPath))
+    .limit(1);
+  if (photo.length > 0) {
+    return isAdmin || (await userHasPermission(userId, "protocol.access"));
+  }
+
  // Orphan path — no entity references it. Treat as not-found for
  // every role (including admin). This is what stops object
  // enumeration: even with admin credentials, you cannot probe
@@ -25,6 +25,30 @@ export class ObjectNotFoundError extends Error {
  }
 }

+// Map a stored object's content type to a sensible file extension so
+// downloads land with a usable name (stored paths are extension-less UUIDs).
+const CONTENT_TYPE_EXTENSIONS: Record<string, string> = {
+  "image/jpeg": "jpg",
+  "image/jpg": "jpg",
+  "image/png": "png",
+  "image/gif": "gif",
+  "image/webp": "webp",
+  "image/heic": "heic",
+  "image/heif": "heif",
+  "image/bmp": "bmp",
+  "image/tiff": "tiff",
+  "image/svg+xml": "svg",
+  "application/pdf": "pdf",
+};
+
+export function extensionForContentType(
+  contentType: string | undefined,
+): string {
+  if (!contentType) return "bin";
+  const base = contentType.split(";")[0].trim().toLowerCase();
+  return CONTENT_TYPE_EXTENSIONS[base] ?? "bin";
+}
+
 // ---------------------------------------------------------------------------
 // Driver interface
 // ---------------------------------------------------------------------------
@@ -253,3 +253,36 @@ export async function requireExecutiveAccess(
  next();
 }

+/**
+ * Gate any read access to the Public Relations & Protocol module. Guarded by
+ * the scoped `protocol.access` permission — the same permission that gates the
+ * home-screen tile (via app_permissions) — so backend usability aligns exactly
+ * with the visible permission grant. Finer-grained request / mutate / approve /
+ * rooms / audit capabilities are layered on top via scoped permissions in the
+ * routes file.
+ */
+export async function requireProtocolAccess(
+  req: Request,
+  res: Response,
+  next: NextFunction,
+): Promise<void> {
+  if (!req.session.userId) {
+    res.status(401).json({ error: "Unauthorized", code: "unauthorized" });
+    return;
+  }
+  const [user] = await db
+    .select({ isActive: usersTable.isActive })
+    .from(usersTable)
+    .where(eq(usersTable.id, req.session.userId));
+  if (!user || !user.isActive) {
+    res.status(401).json({ error: "Unauthorized", code: "unauthorized" });
+    return;
+  }
+  const ok = await userHasPermission(req.session.userId, "protocol.access");
+  if (!ok) {
+    res.status(403).json({ error: "Forbidden", code: "forbidden" });
+    return;
+  }
+  next();
+}
+
@@ -16,6 +16,7 @@ import groupsRouter from "./groups";
 import rolesRouter from "./roles";
 import auditRouter from "./audit";
 import executiveMeetingsRouter from "./executive-meetings";
+import protocolRouter from "./protocol";
 import pushRouter from "./push";
 import systemRouter from "./system";

@@ -38,6 +39,7 @@ router.use(groupsRouter);
 router.use(rolesRouter);
 router.use(auditRouter);
 router.use(executiveMeetingsRouter);
+router.use(protocolRouter);
 router.use(pushRouter);
 router.use(systemRouter);

@@ -4,7 +4,11 @@ import {
  RequestUploadUrlBody,
  RequestUploadUrlResponse,
 } from "@workspace/api-zod";
-import { ObjectStorageService, ObjectNotFoundError } from "../lib/objectStorage";
+import {
+  ObjectStorageService,
+  ObjectNotFoundError,
+  extensionForContentType,
+} from "../lib/objectStorage";
 import { canUserReadObjectPath } from "../lib/objectAuthz";
 import { requireAuth } from "../middlewares/auth";

@@ -109,6 +113,34 @@ router.get("/storage/objects/*path", requireAuth, async (req: Request, res: Resp
    res.status(response.status);
    response.headers.forEach((value, key) => res.setHeader(key, value));

+    // Opt-in force-download: `?download=1` serves the object as an
+    // attachment (Content-Disposition) so browsers save it instead of
+    // rendering inline. An optional `name` base is combined with the
+    // extension derived from the object's content type.
+    if (req.query.download !== undefined) {
+      const contentType = response.headers.get("content-type") ?? undefined;
+      const ext = extensionForContentType(contentType);
+      const baseRaw =
+        typeof req.query.name === "string" && req.query.name.trim()
+          ? req.query.name
+          : (wildcardPath.split("/").pop() ?? "download");
+      // Strip characters that would break the header or the filesystem.
+      const safeBase = baseRaw
+        .replace(/[\r\n"\\/]/g, "")
+        .replace(/[\u0000-\u001f]/g, "")
+        .trim()
+        .slice(0, 180) || "download";
+      const filename = `${safeBase}.${ext}`;
+      const asciiFallback =
+        filename.replace(/[^\x20-\x7e]/g, "_") || `download.${ext}`;
+      res.setHeader(
+        "Content-Disposition",
+        `attachment; filename="${asciiFallback}"; filename*=UTF-8''${encodeURIComponent(
+          filename,
+        )}`,
+      );
+    }
+
    if (response.body) {
      const nodeStream = Readable.fromWeb(response.body as ReadableStream<Uint8Array>);
      nodeStream.pipe(res);
@@ -27,6 +27,8 @@ import NotesPage from "@/pages/notes";
 import MyOrdersPage from "@/pages/my-orders";
 import OrdersIncomingPage from "@/pages/orders-incoming";
 import ExecutiveMeetingsPage from "@/pages/executive-meetings";
+import ProtocolPage from "@/pages/protocol";
+import ProtocolRequestPage from "@/pages/protocol-request";
 import EmbeddedAppPage from "@/pages/embedded-app";

 const queryClient = new QueryClient({
@@ -73,6 +75,8 @@ function Router() {
        <Route path="/my-orders" component={MyOrdersPage} />
        <Route path="/orders/incoming" component={OrdersIncomingPage} />
        <Route path="/meetings" component={ExecutiveMeetingsPage} />
+        <Route path="/protocol" component={ProtocolPage} />
+        <Route path="/protocol/:tab" component={ProtocolPage} />
        {/* Back-compat redirect: the page used to live at
            /executive-meetings. Stored PDFs, email links, and bookmarks
            still point there, so catch the old path (and any deep
@@ -94,7 +98,16 @@ function App() {
    <QueryClientProvider client={queryClient}>
      <TooltipProvider>
        <WouterRouter base={import.meta.env.BASE_URL.replace(/\/$/, "")}>
-          <Router />
+          {/* The public room booking request form must render for logged-OUT
+              guests, so it lives OUTSIDE <Router> (and thus outside
+              AuthProvider, which redirects unauthenticated users to /login).
+              The catch-all falls through to the authenticated app. */}
+          <Switch>
+            <Route path="/protocol/request" component={ProtocolRequestPage} />
+            <Route>
+              <Router />
+            </Route>
+          </Switch>
        </WouterRouter>
        <Toaster />
      </TooltipProvider>
@@ -0,0 +1,224 @@
+import * as React from "react";
+import { CalendarClock } from "lucide-react";
+import { cn } from "@/lib/utils";
+import { Button } from "@/components/ui/button";
+import { Calendar } from "@/components/ui/calendar";
+import {
+  Popover,
+  PopoverContent,
+  PopoverTrigger,
+} from "@/components/ui/popover";
+
+const AR_LATN = "ar-u-nu-latn";
+
+function pad(n: number): string {
+  return String(n).padStart(2, "0");
+}
+
+// Value contract: local wall-clock string "YYYY-MM-DDTHH:mm" (same shape a
+// native datetime-local input produces) or "" when nothing is selected.
+function parseValue(value: string): Date | undefined {
+  if (!value) return undefined;
+  const d = new Date(value);
+  return Number.isNaN(d.getTime()) ? undefined : d;
+}
+
+function toValue(d: Date): string {
+  return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}T${pad(
+    d.getHours(),
+  )}:${pad(d.getMinutes())}`;
+}
+
+function to24(hour12: number, period: "am" | "pm"): number {
+  if (period === "am") return hour12 === 12 ? 0 : hour12;
+  return hour12 === 12 ? 12 : hour12 + 12;
+}
+
+const HOURS_12 = Array.from({ length: 12 }, (_, i) => i + 1);
+const MINUTES = Array.from({ length: 12 }, (_, i) => i * 5);
+
+function TimeColumn({
+  values,
+  active,
+  onSelect,
+  format,
+  ariaLabel,
+}: {
+  values: number[];
+  active: number;
+  onSelect: (v: number) => void;
+  format: (v: number) => string;
+  ariaLabel: string;
+}) {
+  const activeRef = React.useRef<HTMLButtonElement>(null);
+  React.useEffect(() => {
+    activeRef.current?.scrollIntoView({ block: "center" });
+  }, [active]);
+
+  return (
+    <div
+      role="listbox"
+      aria-label={ariaLabel}
+      className="h-40 w-14 overflow-y-auto rounded-md border p-1"
+    >
+      <div className="flex flex-col gap-1">
+        {values.map((v) => {
+          const isActive = v === active;
+          return (
+            <Button
+              key={v}
+              ref={isActive ? activeRef : undefined}
+              type="button"
+              size="sm"
+              variant={isActive ? "default" : "ghost"}
+              className="h-8 w-full shrink-0"
+              onClick={() => onSelect(v)}
+            >
+              {format(v)}
+            </Button>
+          );
+        })}
+      </div>
+    </div>
+  );
+}
+
+export function DateTimePicker({
+  id,
+  value,
+  onChange,
+  placeholder = "اختر التاريخ والوقت",
+  disabled,
+  minDate,
+}: {
+  id?: string;
+  value: string;
+  onChange: (v: string) => void;
+  placeholder?: string;
+  disabled?: boolean;
+  minDate?: Date;
+}) {
+  const [open, setOpen] = React.useState(false);
+  const selected = parseValue(value);
+
+  const hour12 = selected ? selected.getHours() % 12 || 12 : 9;
+  const minute = selected ? selected.getMinutes() : 0;
+  const period: "am" | "pm" = selected
+    ? selected.getHours() < 12
+      ? "am"
+      : "pm"
+    : "am";
+
+  const baseDate = (): Date => {
+    if (selected) return new Date(selected);
+    const d = minDate ? new Date(minDate) : new Date();
+    d.setHours(9, 0, 0, 0);
+    return d;
+  };
+
+  const commit = (next: Date) => onChange(toValue(next));
+
+  const handleDay = (day: Date | undefined) => {
+    if (!day) return;
+    const base = baseDate();
+    const next = new Date(day);
+    next.setHours(base.getHours(), base.getMinutes(), 0, 0);
+    commit(next);
+  };
+
+  const handleHour = (h: number) => {
+    const next = baseDate();
+    next.setHours(to24(h, period), next.getMinutes(), 0, 0);
+    commit(next);
+  };
+
+  const handleMinute = (m: number) => {
+    const next = baseDate();
+    next.setMinutes(m, 0, 0);
+    commit(next);
+  };
+
+  const handlePeriod = (p: "am" | "pm") => {
+    const next = baseDate();
+    next.setHours(to24(hour12, p), next.getMinutes(), 0, 0);
+    commit(next);
+  };
+
+  const label = selected
+    ? new Intl.DateTimeFormat(AR_LATN, {
+        dateStyle: "medium",
+        timeStyle: "short",
+      }).format(selected)
+    : placeholder;
+
+  return (
+    <Popover open={open} onOpenChange={setOpen}>
+      <PopoverTrigger asChild>
+        <Button
+          id={id}
+          type="button"
+          variant="outline"
+          disabled={disabled}
+          className={cn(
+            "w-full justify-between font-normal",
+            !selected && "text-muted-foreground",
+          )}
+        >
+          <span className="truncate">{label}</span>
+          <CalendarClock className="size-4 shrink-0 opacity-60" />
+        </Button>
+      </PopoverTrigger>
+      <PopoverContent className="w-auto p-0" align="start">
+        <Calendar
+          mode="single"
+          selected={selected}
+          onSelect={handleDay}
+          defaultMonth={selected ?? minDate ?? new Date()}
+          disabled={minDate ? { before: minDate } : undefined}
+          autoFocus
+        />
+        <div className="border-t p-3">
+          <div className="mb-2 text-center text-xs font-medium text-muted-foreground">
+            الوقت
+          </div>
+          <div className="flex items-stretch justify-center gap-2">
+            <TimeColumn
+              values={HOURS_12}
+              active={hour12}
+              onSelect={handleHour}
+              format={pad}
+              ariaLabel="الساعة"
+            />
+            <div className="flex items-center text-muted-foreground">:</div>
+            <TimeColumn
+              values={MINUTES}
+              active={minute}
+              onSelect={handleMinute}
+              format={pad}
+              ariaLabel="الدقيقة"
+            />
+            <div className="flex flex-col justify-center gap-1">
+              {(["am", "pm"] as const).map((p) => (
+                <Button
+                  key={p}
+                  type="button"
+                  size="sm"
+                  variant={period === p ? "default" : "outline"}
+                  className="h-8 w-12"
+                  onClick={() => handlePeriod(p)}
+                >
+                  {p === "am" ? "ص" : "م"}
+                </Button>
+              ))}
+            </div>
+          </div>
+        </div>
+        <div className="flex justify-end border-t p-2">
+          <Button type="button" size="sm" onClick={() => setOpen(false)}>
+            تم
+          </Button>
+        </div>
+      </PopoverContent>
+    </Popover>
+  );
+}
@@ -971,7 +971,9 @@
    "appName": "نظام Tx",
    "previous": "السابق",
    "next": "التالي",
-    "empty": "(فارغ)"
+    "empty": "(فارغ)",
+    "back": "رجوع",
+    "confirmDelete": "تأكيد الحذف"
  },
  "embeddedFrame": {
    "title": "تطبيق مدمج",
@@ -1656,5 +1658,144 @@
      "saved": "تم الحفظ",
      "reset": "إعادة الافتراضي"
    }
+  },
+  "protocol": {
+    "title": "العلاقات العامة والمراسم",
+    "notes": "ملاحظات",
+    "statusLabel": "الحالة",
+    "confirmReject": "هل أنت متأكد من رفض هذا الطلب؟",
+    "confirmDelete": "لا يمكن التراجع عن هذا الإجراء.",
+    "tabs": {
+      "dashboard": "لوحة المعلومات",
+      "bookings": "حجوزات القاعات",
+      "external": "اللقاءات الخارجية",
+      "gifts": "الإهداءات",
+      "issues": "طلبات الصرف",
+      "photos": "تصوير",
+      "reports": "التقارير",
+      "audit": "سجل النشاط",
+      "rooms": "القاعات"
+    },
+    "status": {
+      "pending": "قيد الانتظار",
+      "approved": "معتمد",
+      "rejected": "مرفوض",
+      "cancelled": "ملغى",
+      "issued": "تم الصرف",
+      "scheduled": "مجدول",
+      "completed": "منجز"
+    },
+    "giftKind": {
+      "gift": "هدية",
+      "shield": "درع"
+    },
+    "actions": {
+      "approve": "اعتماد",
+      "reject": "رفض",
+      "cancel": "إلغاء",
+      "approveIssue": "اعتماد وصرف"
+    },
+    "errors": {
+      "generic": "تعذّر إتمام العملية."
+    },
+    "dashboard": {
+      "activeRooms": "القاعات المتاحة",
+      "todayBookings": "حجوزات اليوم",
+      "pendingBookings": "حجوزات بانتظار الاعتماد",
+      "upcomingExternal": "لقاءات خارجية قادمة",
+      "giftStock": "إجمالي مخزون الهدايا",
+      "pendingIssues": "طلبات صرف معلّقة",
+      "roomsAvailableNow": "القاعات المتاحة الآن",
+      "giftsIssuedThisMonth": "الدروع المصروفة هذا الشهر"
+    },
+    "bookings": {
+      "new": "حجز جديد",
+      "edit": "تعديل الحجز",
+      "empty": "لا توجد حجوزات.",
+      "requester": "مقدّم الطلب",
+      "org": "الجهة",
+      "phone": "الهاتف",
+      "attendeeCount": "عدد الحضور",
+      "publicRequest": "طلب عام",
+      "roomLabel": "القاعة",
+      "titleLabel": "عنوان الحجز",
+      "startsAt": "من",
+      "endsAt": "إلى",
+      "viewList": "قائمة",
+      "viewCalendar": "تقويم",
+      "shareLinkTitle": "رابط الحجز العام (للمشاركة مع الضيوف)",
+      "copyLink": "نسخ الرابط",
+      "linkCopied": "تم نسخ الرابط",
+      "linkCopyFailed": "تعذّر نسخ الرابط"
+    },
+    "external": {
+      "new": "لقاء جديد",
+      "edit": "تعديل اللقاء",
+      "empty": "لا توجد لقاءات خارجية.",
+      "titleLabel": "عنوان اللقاء",
+      "party": "الجهة",
+      "location": "المكان",
+      "startsAt": "التاريخ والوقت"
+    },
+    "gifts": {
+      "new": "صنف جديد",
+      "edit": "تعديل الصنف",
+      "empty": "لا توجد أصناف.",
+      "stock": "المخزون",
+      "nameAr": "الاسم (عربي)",
+      "nameEn": "الاسم (إنجليزي)",
+      "kind": "النوع"
+    },
+    "rooms": {
+      "new": "قاعة جديدة",
+      "edit": "تعديل القاعة",
+      "title": "القاعات",
+      "inactive": "غير مفعّلة",
+      "nameAr": "الاسم (عربي)",
+      "nameEn": "الاسم (إنجليزي)",
+      "capacity": "السعة",
+      "location": "الموقع",
+      "active": "مفعّلة",
+      "isActive": "مفعّلة",
+      "empty": "لا توجد قاعات."
+    },
+    "issues": {
+      "new": "طلب صرف",
+      "empty": "لا توجد طلبات صرف.",
+      "recipient": "المستفيد",
+      "gift": "الصنف",
+      "occasion": "المناسبة",
+      "quantity": "الكمية"
+    },
+    "photos": {
+      "newAlbum": "ألبوم جديد",
+      "editAlbum": "تعديل الألبوم",
+      "albumName": "اسم الألبوم",
+      "linkMeeting": "ربط بلقاء خارجي",
+      "noMeeting": "بدون ربط",
+      "addPhotos": "إضافة صور",
+      "download": "تنزيل",
+      "downloadAll": "تنزيل الكل",
+      "uploading": "جارٍ الرفع",
+      "emptyAlbums": "لا توجد ألبومات.",
+      "emptyPhotos": "لا توجد صور في هذا الألبوم.",
+      "confirmDeleteAlbum": "سيتم حذف الألبوم وجميع صوره. لا يمكن التراجع.",
+      "confirmDeletePhoto": "سيتم حذف هذه الصورة. لا يمكن التراجع."
+    },
+    "reports": {
+      "byRoom": "الحجوزات حسب القاعة",
+      "byGift": "الصرف حسب الصنف",
+      "room": "القاعة",
+      "gift": "الصنف",
+      "total": "الإجمالي",
+      "requests": "الطلبات",
+      "issued": "المصروفة",
+      "issuedQty": "الكمية المصروفة",
+      "empty": "لا توجد بيانات.",
+      "byExternal": "اللقاءات الخارجية حسب الحالة"
+    },
+    "audit": {
+      "empty": "لا يوجد نشاط."
+    }
  }
 }
@@ -883,7 +883,9 @@
    "appName": "Tx OS",
    "previous": "Previous",
    "next": "Next",
-    "empty": "(empty)"
+    "empty": "(empty)",
+    "back": "Back",
+    "confirmDelete": "Confirm delete"
  },
  "embeddedFrame": {
    "title": "Embedded app",
@@ -1529,5 +1531,144 @@
      "saved": "Saved",
      "reset": "Reset to default"
    }
+  },
+  "protocol": {
+    "title": "Public Relations & Protocol",
+    "notes": "Notes",
+    "statusLabel": "Status",
+    "confirmReject": "Are you sure you want to reject this request?",
+    "confirmDelete": "This action cannot be undone.",
+    "tabs": {
+      "dashboard": "Dashboard",
+      "bookings": "Room Bookings",
+      "external": "External Meetings",
+      "gifts": "Dedications",
+      "issues": "Issuance Requests",
+      "photos": "Photos",
+      "reports": "Reports",
+      "audit": "Activity Log",
+      "rooms": "Rooms"
+    },
+    "status": {
+      "pending": "Pending",
+      "approved": "Approved",
+      "rejected": "Rejected",
+      "cancelled": "Cancelled",
+      "issued": "Issued",
+      "scheduled": "Scheduled",
+      "completed": "Completed"
+    },
+    "giftKind": {
+      "gift": "Gift",
+      "shield": "Shield"
+    },
+    "actions": {
+      "approve": "Approve",
+      "reject": "Reject",
+      "cancel": "Cancel",
+      "approveIssue": "Approve & issue"
+    },
+    "errors": {
+      "generic": "The operation could not be completed."
+    },
+    "dashboard": {
+      "activeRooms": "Active rooms",
+      "todayBookings": "Today's bookings",
+      "pendingBookings": "Bookings awaiting approval",
+      "upcomingExternal": "Upcoming external meetings",
+      "giftStock": "Total gift stock",
+      "pendingIssues": "Pending issuance requests",
+      "roomsAvailableNow": "Rooms available now",
+      "giftsIssuedThisMonth": "Gifts issued this month"
+    },
+    "bookings": {
+      "new": "New booking",
+      "edit": "Edit booking",
+      "empty": "No bookings yet.",
+      "requester": "Requester",
+      "org": "Organization",
+      "phone": "Phone",
+      "attendeeCount": "Attendees",
+      "publicRequest": "Public request",
+      "roomLabel": "Room",
+      "titleLabel": "Booking title",
+      "startsAt": "From",
+      "endsAt": "To",
+      "viewList": "List",
+      "viewCalendar": "Calendar",
+      "shareLinkTitle": "Public booking link (share with guests)",
+      "copyLink": "Copy link",
+      "linkCopied": "Link copied",
+      "linkCopyFailed": "Could not copy the link"
+    },
+    "external": {
+      "new": "New meeting",
+      "edit": "Edit meeting",
+      "empty": "No external meetings yet.",
+      "titleLabel": "Meeting title",
+      "party": "Party",
+      "location": "Location",
+      "startsAt": "Date & time"
+    },
+    "gifts": {
+      "new": "New item",
+      "edit": "Edit item",
+      "empty": "No items yet.",
+      "stock": "Stock",
+      "nameAr": "Name (Arabic)",
+      "nameEn": "Name (English)",
+      "kind": "Kind"
+    },
+    "rooms": {
+      "new": "New room",
+      "edit": "Edit room",
+      "title": "Rooms",
+      "inactive": "inactive",
+      "nameAr": "Name (Arabic)",
+      "nameEn": "Name (English)",
+      "capacity": "Capacity",
+      "location": "Location",
+      "active": "Active",
+      "isActive": "Active",
+      "empty": "No rooms."
+    },
+    "issues": {
+      "new": "Issuance request",
+      "empty": "No issuance requests yet.",
+      "recipient": "Recipient",
+      "gift": "Item",
+      "occasion": "Occasion",
+      "quantity": "Quantity"
+    },
+    "photos": {
+      "newAlbum": "New album",
+      "editAlbum": "Edit album",
+      "albumName": "Album name",
+      "linkMeeting": "Link to external meeting",
+      "noMeeting": "No link",
+      "addPhotos": "Add photos",
+      "download": "Download",
+      "downloadAll": "Download all",
+      "uploading": "Uploading",
+      "emptyAlbums": "No albums yet.",
+      "emptyPhotos": "No photos in this album.",
+      "confirmDeleteAlbum": "This deletes the album and all its photos. This cannot be undone.",
+      "confirmDeletePhoto": "This photo will be deleted. This cannot be undone."
+    },
+    "reports": {
+      "byRoom": "Bookings by room",
+      "byGift": "Issuance by item",
+      "room": "Room",
+      "gift": "Item",
+      "total": "Total",
+      "requests": "Requests",
+      "issued": "Issued",
+      "issuedQty": "Issued qty",
+      "empty": "No data.",
+      "byExternal": "External meetings by status"
+    },
+    "audit": {
+      "empty": "No activity yet."
+    }
  }
 }
@@ -4637,7 +4637,7 @@ function MeetingRow({
        return (
          <td
            key="meeting"
-            className={`border border-gray-300 px-3 py-3 align-middle text-[#0B1E3F] relative group`}
+            className={`border border-gray-300 px-3 py-3 align-middle text-center ${meeting.isExternal ? "text-[#dc2626]" : "text-[#0B1E3F]"} relative group`}
            style={tintedCellStyle(col, true)}
          >
            <EditableCell
@@ -4670,7 +4670,7 @@ function MeetingRow({
        return (
          <td
            key="attendees"
-            className="border border-gray-300 px-3 py-3 align-middle relative group"
+            className="border border-gray-300 px-3 py-3 align-middle text-center relative group"
            style={tintedCellStyle(col, false)}
          >
            <AttendeesCell
@@ -0,0 +1,364 @@
+import { useEffect, useMemo, useState } from "react";
+import { useQuery } from "@tanstack/react-query";
+import { CalendarClock, CheckCircle2, Loader2 } from "lucide-react";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Textarea } from "@/components/ui/textarea";
+import { Label } from "@/components/ui/label";
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from "@/components/ui/select";
+import { DateTimePicker } from "@/components/date-time-picker";
+
+const API = `${import.meta.env.BASE_URL}api`;
+
+type PublicRoom = { id: number; nameAr: string; nameEn: string };
+
+type FormState = {
+  requesterName: string;
+  title: string;
+  requesterPhone: string;
+  requesterOrg: string;
+  attendeeCount: string;
+  roomId: string;
+  startsAt: string;
+  endsAt: string;
+  notes: string;
+  website: string; // honeypot
+};
+
+const EMPTY: FormState = {
+  requesterName: "",
+  title: "",
+  requesterPhone: "",
+  requesterOrg: "",
+  attendeeCount: "",
+  roomId: "",
+  startsAt: "",
+  endsAt: "",
+  notes: "",
+  website: "",
+};
+
+function localToIso(v: string): string {
+  return new Date(v).toISOString();
+}
+
+export default function ProtocolRequestPage() {
+  // This page is public (no auth). Force RTL Arabic regardless of any
+  // stored language preference so a guest always sees the intended form.
+  useEffect(() => {
+    const prevDir = document.documentElement.dir;
+    const prevLang = document.documentElement.lang;
+    document.documentElement.dir = "rtl";
+    document.documentElement.lang = "ar";
+    return () => {
+      // Restore the app's direction/language so navigating away from this
+      // public page doesn't leave the rest of the app forced into RTL Arabic.
+      document.documentElement.dir = prevDir;
+      document.documentElement.lang = prevLang;
+    };
+  }, []);
+
+  const rooms = useQuery<PublicRoom[]>({
+    queryKey: ["protocol-public", "rooms"],
+    queryFn: async () => {
+      const r = await fetch(`${API}/protocol/public/rooms`);
+      if (!r.ok) throw new Error("rooms");
+      return r.json();
+    },
+  });
+
+  const [form, setForm] = useState<FormState>(EMPTY);
+  const [submitting, setSubmitting] = useState(false);
+  const [done, setDone] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const set = <K extends keyof FormState>(k: K, v: FormState[K]) =>
+    setForm((f) => ({ ...f, [k]: v }));
+
+  const canSubmit = useMemo(() => {
+    return (
+      form.requesterName.trim().length > 0 &&
+      form.title.trim().length > 0 &&
+      form.requesterPhone.trim().length >= 3 &&
+      form.roomId !== "" &&
+      form.startsAt !== "" &&
+      form.endsAt !== "" &&
+      new Date(form.startsAt) < new Date(form.endsAt)
+    );
+  }, [form]);
+
+  const onSubmit = async (e: React.FormEvent) => {
+    e.preventDefault();
+    setError(null);
+    if (!canSubmit || submitting) return;
+    setSubmitting(true);
+    try {
+      const res = await fetch(`${API}/protocol/public/booking-requests`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          roomId: Number(form.roomId),
+          title: form.title.trim(),
+          requesterName: form.requesterName.trim(),
+          requesterPhone: form.requesterPhone.trim(),
+          requesterOrg: form.requesterOrg.trim() || null,
+          attendeeCount:
+            form.attendeeCount.trim() === ""
+              ? null
+              : Number(form.attendeeCount),
+          startsAt: localToIso(form.startsAt),
+          endsAt: localToIso(form.endsAt),
+          notes: form.notes.trim() || null,
+          website: form.website,
+        }),
+      });
+      if (res.ok) {
+        setDone(true);
+        return;
+      }
+      let msg = "تعذّر إرسال الطلب، يرجى المحاولة مرة أخرى.";
+      try {
+        const data = await res.json();
+        if (data?.error && typeof data.error === "string") msg = data.error;
+      } catch {
+        // keep default message
+      }
+      if (res.status === 429) {
+        msg = "لقد أرسلت طلبات كثيرة، يرجى المحاولة لاحقاً.";
+      }
+      setError(msg);
+    } catch {
+      setError("تعذّر الاتصال بالخادم، تحقق من الاتصال وحاول مجدداً.");
+    } finally {
+      setSubmitting(false);
+    }
+  };
+
+  if (done) {
+    return (
+      <div
+        dir="rtl"
+        className="min-h-screen bg-slate-50 flex items-center justify-center p-4"
+      >
+        <div className="w-full max-w-md bg-white rounded-2xl border border-slate-200 shadow-sm p-8 text-center">
+          <CheckCircle2 className="w-14 h-14 text-emerald-500 mx-auto mb-4" />
+          <h1 className="text-xl font-bold text-slate-800 mb-2">
+            تم استلام طلبك
+          </h1>
+          <p className="text-slate-500 leading-relaxed">
+            سيقوم فريق المراسم بمراجعة طلب الحجز والتواصل معك على رقم الهاتف
+            المُدخل لتأكيد الموعد.
+          </p>
+          <Button
+            className="mt-6"
+            variant="outline"
+            onClick={() => {
+              setForm(EMPTY);
+              setDone(false);
+            }}
+          >
+            إرسال طلب آخر
+          </Button>
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <div dir="rtl" className="min-h-screen bg-slate-50 py-8 px-4">
+      <div className="w-full max-w-xl mx-auto">
+        <div className="flex items-center gap-3 mb-6">
+          <div className="w-11 h-11 rounded-xl bg-sky-500/10 text-sky-600 flex items-center justify-center">
+            <CalendarClock className="w-6 h-6" />
+          </div>
+          <div>
+            <h1 className="text-xl font-bold text-slate-800">طلب حجز قاعة</h1>
+            <p className="text-sm text-slate-500">
+              يرجى تعبئة البيانات وسيتواصل معك فريق المراسم للتأكيد.
+            </p>
+          </div>
+        </div>
+
+        <form
+          onSubmit={onSubmit}
+          className="bg-white rounded-2xl border border-slate-200 shadow-sm p-6 space-y-5"
+        >
+          {/* Honeypot: hidden from real users, catches bots. */}
+          <div className="hidden" aria-hidden="true">
+            <label>
+              Website
+              <input
+                type="text"
+                tabIndex={-1}
+                autoComplete="off"
+                value={form.website}
+                onChange={(e) => set("website", e.target.value)}
+              />
+            </label>
+          </div>
+
+          <div className="space-y-2">
+            <Label htmlFor="requesterName">
+              الاسم الكامل <span className="text-rose-500">*</span>
+            </Label>
+            <Input
+              id="requesterName"
+              value={form.requesterName}
+              onChange={(e) => set("requesterName", e.target.value)}
+              placeholder="الاسم الثلاثي"
+              required
+            />
+          </div>
+
+          <div className="space-y-2">
+            <Label htmlFor="title">
+              عنوان الاجتماع <span className="text-rose-500">*</span>
+            </Label>
+            <Input
+              id="title"
+              value={form.title}
+              onChange={(e) => set("title", e.target.value)}
+              placeholder="موضوع أو عنوان الاجتماع"
+              required
+            />
+          </div>
+
+          <div className="space-y-2">
+            <Label htmlFor="requesterPhone">
+              رقم الهاتف للتواصل <span className="text-rose-500">*</span>
+            </Label>
+            <Input
+              id="requesterPhone"
+              type="tel"
+              inputMode="tel"
+              dir="ltr"
+              className="text-right"
+              value={form.requesterPhone}
+              onChange={(e) => set("requesterPhone", e.target.value)}
+              placeholder="05xxxxxxxx"
+              required
+            />
+          </div>
+
+          <div className="space-y-2">
+            <Label htmlFor="requesterOrg">الجهة / المؤسسة</Label>
+            <Input
+              id="requesterOrg"
+              value={form.requesterOrg}
+              onChange={(e) => set("requesterOrg", e.target.value)}
+              placeholder="اسم الجهة أو المؤسسة (اختياري)"
+            />
+          </div>
+
+          <div className="space-y-2">
+            <Label htmlFor="attendeeCount">عدد الحضور</Label>
+            <Input
+              id="attendeeCount"
+              type="number"
+              inputMode="numeric"
+              min={1}
+              value={form.attendeeCount}
+              onChange={(e) => set("attendeeCount", e.target.value)}
+              placeholder="العدد المتوقع للحضور (اختياري)"
+            />
+          </div>
+
+          <div className="space-y-2">
+            <Label htmlFor="room">
+              القاعة <span className="text-rose-500">*</span>
+            </Label>
+            <Select
+              value={form.roomId}
+              onValueChange={(v) => set("roomId", v)}
+            >
+              <SelectTrigger id="room">
+                <SelectValue
+                  placeholder={
+                    rooms.isLoading ? "جارٍ التحميل…" : "اختر القاعة"
+                  }
+                />
+              </SelectTrigger>
+              <SelectContent>
+                {(rooms.data ?? []).map((r) => (
+                  <SelectItem key={r.id} value={String(r.id)}>
+                    {r.nameAr || r.nameEn}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+            {rooms.isError && (
+              <p className="text-xs text-rose-500">
+                تعذّر تحميل قائمة القاعات، يرجى تحديث الصفحة.
+              </p>
+            )}
+          </div>
+
+          <div className="grid grid-cols-1 sm:grid-cols-2 gap-4">
+            <div className="space-y-2">
+              <Label htmlFor="startsAt">
+                من <span className="text-rose-500">*</span>
+              </Label>
+              <DateTimePicker
+                id="startsAt"
+                value={form.startsAt}
+                onChange={(v) => set("startsAt", v)}
+                placeholder="اختر تاريخ ووقت البداية"
+              />
+            </div>
+            <div className="space-y-2">
+              <Label htmlFor="endsAt">
+                إلى <span className="text-rose-500">*</span>
+              </Label>
+              <DateTimePicker
+                id="endsAt"
+                value={form.endsAt}
+                onChange={(v) => set("endsAt", v)}
+                placeholder="اختر تاريخ ووقت النهاية"
+                minDate={form.startsAt ? new Date(form.startsAt) : undefined}
+              />
+            </div>
+          </div>
+          {form.startsAt !== "" &&
+            form.endsAt !== "" &&
+            new Date(form.startsAt) >= new Date(form.endsAt) && (
+              <p className="text-xs text-rose-500 -mt-2">
+                يجب أن يكون وقت البداية قبل وقت النهاية.
+              </p>
+            )}
+
+          <div className="space-y-2">
+            <Label htmlFor="notes">ملاحظات</Label>
+            <Textarea
+              id="notes"
+              value={form.notes}
+              onChange={(e) => set("notes", e.target.value)}
+              placeholder="أي تفاصيل إضافية (اختياري)"
+              rows={3}
+            />
+          </div>
+
+          {error && (
+            <div className="rounded-lg bg-rose-50 border border-rose-200 text-rose-700 text-sm px-3 py-2">
+              {error}
+            </div>
+          )}
+
+          <Button
+            type="submit"
+            className="w-full"
+            disabled={!canSubmit || submitting}
+          >
+            {submitting && <Loader2 className="w-4 h-4 animate-spin" />}
+            إرسال الطلب
+          </Button>
+        </form>
+      </div>
+    </div>
+  );
+}
@@ -27,6 +27,7 @@ export const BUILTIN_APP_SLUGS = [
  "executive-meetings",
  "calendar",
  "documents",
+  "protocol",
 ] as const;

 export type BuiltinAppSlug = (typeof BUILTIN_APP_SLUGS)[number];
@@ -14,4 +14,5 @@ export * from "./audit-logs";
 export * from "./role-audit";
 export * from "./permission-audit";
 export * from "./executive-meetings";
+export * from "./protocol";
 export * from "./push-subscriptions";
@@ -0,0 +1,384 @@
+import {
+  pgTable,
+  serial,
+  integer,
+  varchar,
+  text,
+  timestamp,
+  jsonb,
+  boolean,
+  index,
+} from "drizzle-orm/pg-core";
+import { createInsertSchema } from "drizzle-zod";
+import { z } from "zod/v4";
+import { usersTable } from "./users";
+
+// ---------------------------------------------------------------------------
+// Public Relations & Protocol module ("العلاقات العامة والمراسم").
+//
+// A completely standalone module. Every table is prefixed `protocol_` and has
+// no foreign keys into the Executive Meetings tables, so the two modules stay
+// fully independent. Only `usersTable` (the shared account table) is
+// referenced, and always with `on delete set null` so removing a user never
+// cascades into protocol history.
+// ---------------------------------------------------------------------------
+
+// Status values for room bookings and gift issuances. The overlap /
+// conflict-prevention rule only considers "pending" and "approved" rows as
+// occupying a room; "rejected" and "cancelled" free the slot again.
+export const PROTOCOL_BOOKING_STATUSES = [
+  "pending",
+  "approved",
+  "rejected",
+  "cancelled",
+] as const;
+export type ProtocolBookingStatus =
+  (typeof PROTOCOL_BOOKING_STATUSES)[number];
+
+export const PROTOCOL_ISSUE_STATUSES = [
+  "pending",
+  "approved",
+  "rejected",
+  "issued",
+] as const;
+export type ProtocolIssueStatus = (typeof PROTOCOL_ISSUE_STATUSES)[number];
+
+// Gift catalogue kinds: a regular gift or a commemorative shield (درع).
+export const PROTOCOL_GIFT_KINDS = ["gift", "shield"] as const;
+export type ProtocolGiftKind = (typeof PROTOCOL_GIFT_KINDS)[number];
+
+// ---------------------------------------------------------------------------
+// Rooms
+// ---------------------------------------------------------------------------
+export const protocolRoomsTable = pgTable(
+  "protocol_rooms",
+  {
+    id: serial("id").primaryKey(),
+    nameAr: varchar("name_ar", { length: 200 }).notNull(),
+    nameEn: varchar("name_en", { length: 200 }).notNull().default(""),
+    capacity: integer("capacity"),
+    location: varchar("location", { length: 300 }),
+    isActive: boolean("is_active").notNull().default(true),
+    sortOrder: integer("sort_order").notNull().default(0),
+    createdBy: integer("created_by").references(() => usersTable.id, {
+      onDelete: "set null",
+    }),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow()
+      .$onUpdate(() => new Date()),
+  },
+  (t) => ({
+    activeIdx: index("protocol_rooms_active_idx").on(t.isActive),
+  }),
+);
+
+// ---------------------------------------------------------------------------
+// Room bookings
+// ---------------------------------------------------------------------------
+export const protocolRoomBookingsTable = pgTable(
+  "protocol_room_bookings",
+  {
+    id: serial("id").primaryKey(),
+    roomId: integer("room_id")
+      .notNull()
+      .references(() => protocolRoomsTable.id, { onDelete: "cascade" }),
+    title: varchar("title", { length: 500 }).notNull(),
+    requesterName: varchar("requester_name", { length: 300 }),
+    // Guest-supplied contact phone. Only populated for public
+    // (self-service) booking requests; internal bookings leave it null.
+    requesterPhone: varchar("requester_phone", { length: 40 }),
+    // The requester's organization / entity (الجهة). Optional even for
+    // public requests; always null for internal bookings unless set.
+    requesterOrg: varchar("requester_org", { length: 300 }),
+    // Expected number of attendees (عدد الحضور). Optional; supplied by the
+    // guest on a public request or by staff on an internal booking.
+    attendeeCount: integer("attendee_count"),
+    // Provenance marker. "internal" for bookings created by authenticated
+    // protocol staff through the app; "public" for guest requests coming in
+    // via the no-login booking-request link. Defaults to "internal" so all
+    // pre-existing rows are treated as internal.
+    source: varchar("source", { length: 20 }).notNull().default("internal"),
+    // Full timestamps so bookings can span any part of a day. The overlap
+    // rule compares [startsAt, endsAt) intervals per room.
+    startsAt: timestamp("starts_at", { withTimezone: true }).notNull(),
+    endsAt: timestamp("ends_at", { withTimezone: true }).notNull(),
+    status: varchar("status", { length: 20 }).notNull().default("pending"),
+    notes: text("notes"),
+    createdBy: integer("created_by").references(() => usersTable.id, {
+      onDelete: "set null",
+    }),
+    approvedBy: integer("approved_by").references(() => usersTable.id, {
+      onDelete: "set null",
+    }),
+    approvedAt: timestamp("approved_at", { withTimezone: true }),
+    rejectionReason: text("rejection_reason"),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow()
+      .$onUpdate(() => new Date()),
+  },
+  (t) => ({
+    roomIdx: index("protocol_bookings_room_idx").on(t.roomId),
+    startIdx: index("protocol_bookings_start_idx").on(t.startsAt),
+    statusIdx: index("protocol_bookings_status_idx").on(t.status),
+  }),
+);
+
+// ---------------------------------------------------------------------------
+// External protocol meetings (اجتماعات ومراسم خارجية) — independent from the
+// Executive Meetings module's is_external flag.
+// ---------------------------------------------------------------------------
+export const protocolExternalMeetingsTable = pgTable(
+  "protocol_external_meetings",
+  {
+    id: serial("id").primaryKey(),
+    title: varchar("title", { length: 500 }).notNull(),
+    // The visiting party / external delegation.
+    partyName: varchar("party_name", { length: 300 }),
+    location: varchar("location", { length: 300 }),
+    startsAt: timestamp("starts_at", { withTimezone: true }).notNull(),
+    endsAt: timestamp("ends_at", { withTimezone: true }),
+    // Lifecycle: pending -> approved | rejected, then optionally
+    // completed | cancelled. Mirrors the booking / gift-issue approval flow.
+    status: varchar("status", { length: 20 }).notNull().default("pending"),
+    notes: text("notes"),
+    createdBy: integer("created_by").references(() => usersTable.id, {
+      onDelete: "set null",
+    }),
+    approvedBy: integer("approved_by").references(() => usersTable.id, {
+      onDelete: "set null",
+    }),
+    approvedAt: timestamp("approved_at", { withTimezone: true }),
+    rejectionReason: text("rejection_reason"),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow()
+      .$onUpdate(() => new Date()),
+  },
+  (t) => ({
+    startIdx: index("protocol_ext_meetings_start_idx").on(t.startsAt),
+    statusIdx: index("protocol_ext_meetings_status_idx").on(t.status),
+  }),
+);
+
+// ---------------------------------------------------------------------------
+// Gifts & shields catalogue
+// ---------------------------------------------------------------------------
+export const protocolGiftsTable = pgTable(
+  "protocol_gifts",
+  {
+    id: serial("id").primaryKey(),
+    nameAr: varchar("name_ar", { length: 300 }).notNull(),
+    nameEn: varchar("name_en", { length: 300 }).notNull().default(""),
+    kind: varchar("kind", { length: 20 }).notNull().default("gift"),
+    descriptionAr: text("description_ar"),
+    descriptionEn: text("description_en"),
+    imageUrl: varchar("image_url", { length: 500 }),
+    // Running stock count. Issuing an approved gift decrements this.
+    quantityInStock: integer("quantity_in_stock").notNull().default(0),
+    isActive: boolean("is_active").notNull().default(true),
+    createdBy: integer("created_by").references(() => usersTable.id, {
+      onDelete: "set null",
+    }),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow()
+      .$onUpdate(() => new Date()),
+  },
+  (t) => ({
+    kindIdx: index("protocol_gifts_kind_idx").on(t.kind),
+  }),
+);
+
+// ---------------------------------------------------------------------------
+// Gift issuances (صرف الهدايا/الدروع)
+// ---------------------------------------------------------------------------
+export const protocolGiftIssuesTable = pgTable(
+  "protocol_gift_issues",
+  {
+    id: serial("id").primaryKey(),
+    giftId: integer("gift_id")
+      .notNull()
+      .references(() => protocolGiftsTable.id, { onDelete: "restrict" }),
+    recipientName: varchar("recipient_name", { length: 300 }).notNull(),
+    occasion: varchar("occasion", { length: 300 }),
+    quantity: integer("quantity").notNull().default(1),
+    issuedAt: timestamp("issued_at", { withTimezone: true }),
+    status: varchar("status", { length: 20 }).notNull().default("pending"),
+    notes: text("notes"),
+    createdBy: integer("created_by").references(() => usersTable.id, {
+      onDelete: "set null",
+    }),
+    approvedBy: integer("approved_by").references(() => usersTable.id, {
+      onDelete: "set null",
+    }),
+    approvedAt: timestamp("approved_at", { withTimezone: true }),
+    rejectionReason: text("rejection_reason"),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow()
+      .$onUpdate(() => new Date()),
+  },
+  (t) => ({
+    giftIdx: index("protocol_gift_issues_gift_idx").on(t.giftId),
+    statusIdx: index("protocol_gift_issues_status_idx").on(t.status),
+  }),
+);
+
+// ---------------------------------------------------------------------------
+// Visit photo albums (صور الزيارات) — "تصوير" tab.
+//
+// An album groups photographs of a visit. It may optionally be linked to an
+// external protocol meeting (اللقاءات الخارجية); the link is `set null` so
+// deleting the meeting never removes the album. The album cover is derived at
+// query time from the first photo (by sortOrder), so there is no circular
+// album <-> photo foreign key to keep in sync.
+// ---------------------------------------------------------------------------
+export const protocolPhotoAlbumsTable = pgTable(
+  "protocol_photo_albums",
+  {
+    id: serial("id").primaryKey(),
+    name: varchar("name", { length: 300 }).notNull(),
+    externalMeetingId: integer("external_meeting_id").references(
+      () => protocolExternalMeetingsTable.id,
+      { onDelete: "set null" },
+    ),
+    createdBy: integer("created_by").references(() => usersTable.id, {
+      onDelete: "set null",
+    }),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow()
+      .$onUpdate(() => new Date()),
+  },
+  (t) => ({
+    meetingIdx: index("protocol_albums_meeting_idx").on(t.externalMeetingId),
+  }),
+);
+
+// ---------------------------------------------------------------------------
+// Photos inside an album. Each photo references a private object-storage path
+// (`/objects/<id>`) served through the authorized object endpoint. Deleting an
+// album cascades to its photos.
+// ---------------------------------------------------------------------------
+export const protocolPhotosTable = pgTable(
+  "protocol_photos",
+  {
+    id: serial("id").primaryKey(),
+    albumId: integer("album_id")
+      .notNull()
+      .references(() => protocolPhotoAlbumsTable.id, { onDelete: "cascade" }),
+    objectPath: varchar("object_path", { length: 500 }).notNull(),
+    sortOrder: integer("sort_order").notNull().default(0),
+    uploadedBy: integer("uploaded_by").references(() => usersTable.id, {
+      onDelete: "set null",
+    }),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    albumIdx: index("protocol_photos_album_idx").on(t.albumId),
+    pathIdx: index("protocol_photos_path_idx").on(t.objectPath),
+  }),
+);
+
+// ---------------------------------------------------------------------------
+// Audit log (scoped to the protocol module only)
+// ---------------------------------------------------------------------------
+export const protocolAuditLogsTable = pgTable(
+  "protocol_audit_logs",
+  {
+    id: serial("id").primaryKey(),
+    action: varchar("action", { length: 100 }).notNull(),
+    entityType: varchar("entity_type", { length: 50 }).notNull(),
+    entityId: integer("entity_id"),
+    oldValue: jsonb("old_value"),
+    newValue: jsonb("new_value"),
+    performedBy: integer("performed_by").references(() => usersTable.id, {
+      onDelete: "set null",
+    }),
+    performedAt: timestamp("performed_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    entityIdx: index("protocol_audit_entity_idx").on(t.entityType, t.entityId),
+    performedAtIdx: index("protocol_audit_performed_at_idx").on(t.performedAt),
+  }),
+);
+
+// ---------------------------------------------------------------------------
+// Insert schemas / row types
+// ---------------------------------------------------------------------------
+export const insertProtocolRoomSchema = createInsertSchema(
+  protocolRoomsTable,
+).omit({ id: true, createdAt: true, updatedAt: true });
+export type InsertProtocolRoom = z.infer<typeof insertProtocolRoomSchema>;
+export type ProtocolRoom = typeof protocolRoomsTable.$inferSelect;
+
+export const insertProtocolRoomBookingSchema = createInsertSchema(
+  protocolRoomBookingsTable,
+).omit({ id: true, createdAt: true, updatedAt: true });
+export type InsertProtocolRoomBooking = z.infer<
+  typeof insertProtocolRoomBookingSchema
+>;
+export type ProtocolRoomBooking = typeof protocolRoomBookingsTable.$inferSelect;
+
+export const insertProtocolExternalMeetingSchema = createInsertSchema(
+  protocolExternalMeetingsTable,
+).omit({ id: true, createdAt: true, updatedAt: true });
+export type InsertProtocolExternalMeeting = z.infer<
+  typeof insertProtocolExternalMeetingSchema
+>;
+export type ProtocolExternalMeeting =
+  typeof protocolExternalMeetingsTable.$inferSelect;
+
+export const insertProtocolGiftSchema = createInsertSchema(
+  protocolGiftsTable,
+).omit({ id: true, createdAt: true, updatedAt: true });
+export type InsertProtocolGift = z.infer<typeof insertProtocolGiftSchema>;
+export type ProtocolGift = typeof protocolGiftsTable.$inferSelect;
+
+export const insertProtocolGiftIssueSchema = createInsertSchema(
+  protocolGiftIssuesTable,
+).omit({ id: true, createdAt: true, updatedAt: true });
+export type InsertProtocolGiftIssue = z.infer<
+  typeof insertProtocolGiftIssueSchema
+>;
+export type ProtocolGiftIssue = typeof protocolGiftIssuesTable.$inferSelect;
+
+export const insertProtocolPhotoAlbumSchema = createInsertSchema(
+  protocolPhotoAlbumsTable,
+).omit({ id: true, createdAt: true, updatedAt: true });
+export type InsertProtocolPhotoAlbum = z.infer<
+  typeof insertProtocolPhotoAlbumSchema
+>;
+export type ProtocolPhotoAlbum = typeof protocolPhotoAlbumsTable.$inferSelect;
+
+export const insertProtocolPhotoSchema = createInsertSchema(
+  protocolPhotosTable,
+).omit({ id: true, createdAt: true });
+export type InsertProtocolPhoto = z.infer<typeof insertProtocolPhotoSchema>;
+export type ProtocolPhoto = typeof protocolPhotosTable.$inferSelect;
+
+export type ProtocolAuditLog = typeof protocolAuditLogsTable.$inferSelect;
@@ -90,6 +90,9 @@ importers:
      arabic-persian-reshaper:
        specifier: 1.0.1
        version: 1.0.1
+      archiver:
+        specifier: ^8.0.0
+        version: 8.0.0
      bcryptjs:
        specifier: ^3.0.3
        version: 3.0.3
@@ -148,6 +151,9 @@ importers:
        specifier: 'catalog:'
        version: 3.25.76
    devDependencies:
+      '@types/archiver':
+        specifier: ^8.0.0
+        version: 8.0.0
      '@types/bcryptjs':
        specifier: ^3.0.0
        version: 3.0.0
@@ -2434,6 +2440,7 @@ packages:
  '@smithy/core@3.24.1':
    resolution: {integrity: sha512-3mT7o4qQyUWttYnVK3A0Z/u3Xha3E81tXn32Tz6vjZiUXhBrkEivpw1hBYfh84iFF9CSzkBU9Y1DJ3Q6RQ231g==}
    engines: {node: '>=18.0.0'}
+    deprecated: Deprecated due to bug in browser bundling instructions https://github.com/smithy-lang/smithy-typescript/issues/2025

  '@smithy/credential-provider-imds@4.3.1':
    resolution: {integrity: sha512-0S/acwHnqX4WrjXzhdiDRxsG2s9SC0cpPIK9nZ1R6UOHd+j7uL28+4bHu22urbLk2TVw3fkp6na/+fkUt/pLNQ==}
@@ -2888,6 +2895,9 @@ packages:
  '@transloadit/prettier-bytes@0.3.5':
    resolution: {integrity: sha512-xF4A3d/ZyX2LJWeQZREZQw+qFX4TGQ8bGVP97OLRt6sPO6T0TNHBFTuRHOJh7RNmYOBmQ9MHxpolD9bXihpuVA==}

+  '@types/archiver@8.0.0':
+    resolution: {integrity: sha512-YpXPbEuv9+eUIPPQWUPahj3cvs9isWRuF+J4z+KbdYVDO3rWorWQFxUVHnwPu2AgKwvgpki5F2VMX0Xx+mX45A==}
+
  '@types/babel__core@7.20.5':
    resolution: {integrity: sha512-qoQprZvz5wQFJwMDqeseRXWv3rqMvhgpbXFfVyWhbx9X47POIA6i/+dXefEmZKoAgOaTdaIgNSMqMIU61yRyzA==}

@@ -2996,6 +3006,9 @@ packages:
  '@types/react@19.2.14':
    resolution: {integrity: sha512-ilcTH/UniCkMdtexkoCN0bI7pMcJDvmQFPvuPvmEaYA/NSfFTAgdUSLAoVjaRJm7+6PvcM+q1zYOwS4wTYMF9w==}

+  '@types/readdir-glob@1.1.5':
+    resolution: {integrity: sha512-raiuEPUYqXu+nvtY2Pe8s8FEmZ3x5yAH4VkLdihcPdalvsHltomrRC9BzuStrJ9yk06470hS0Crw0f1pXqD+Hg==}
+
  '@types/retry@0.12.2':
    resolution: {integrity: sha512-XISRgDJ2Tc5q4TRqvgJtzsRkFYNJzZrhTdtMoGVBttwzzQJkPnS3WWTFc7kuDRoPtPakl+T+OfdEUjYJj7Jbow==}

@@ -3101,6 +3114,10 @@ packages:
    peerDependencies:
      vite: ^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0

+  abort-controller@3.0.0:
+    resolution: {integrity: sha512-h8lQ8tacZYnR3vNQTgibj+tODHI5/+l06Au2Pcriv/Gmet0eaj4TwWH41sO9wnHDiQsEj19q0drzdWdeAHtweg==}
+    engines: {node: '>=6.5'}
+
  accepts@1.3.8:
    resolution: {integrity: sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==}
    engines: {node: '>= 0.6'}
@@ -3143,6 +3160,10 @@ packages:
  arabic-persian-reshaper@1.0.1:
    resolution: {integrity: sha512-VYBjkhz6o4W1Xt4mD2LAReljJpLSw5CUZMqSBDIQRvFgUSlTKEYghapgBWvkeMWF4W+KF3Fm+/z8EywJU4PBeg==}

+  archiver@8.0.0:
+    resolution: {integrity: sha512-fV1orZfsnPn9BaSByR/qE67rJCLJEy2Ox5bq7nJh+jquWaNh6Sfec75kJ2T6PtdGUbPQlrVoSVCEOa5SdiTQ1g==}
+    engines: {node: '>=18'}
+
  argparse@2.0.1:
    resolution: {integrity: sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==}

@@ -3153,13 +3174,69 @@ packages:
  asn1.js@5.4.1:
    resolution: {integrity: sha512-+I//4cYPccV8LdmBLiX8CYvf9Sp3vQsrqu2QNXRcrbiWvcx/UdlFiqUJJzxRQxgsZmvhXhn4cSKeSmoFjVdupA==}

+  async@3.2.6:
+    resolution: {integrity: sha512-htCUDlxyyCLMgaM3xXg0C0LW2xqfuQ6p05pCEIsXuyQ+a1koYKTuBMzRNwmybfLgvJDMd0r1LTn4+E0Ti6C2AA==}
+
  atomic-sleep@1.0.0:
    resolution: {integrity: sha512-kNOjDqAh7px0XWNI+4QbzoiR/nTkHAWNud2uvnJquD1/x5a7EQZMJT0AczqK0Qn67oY/TTQ1LbUKajZpp3I9tQ==}
    engines: {node: '>=8.0.0'}

+  b4a@1.8.1:
+    resolution: {integrity: sha512-aiqre1Nr0B/6DgE2N5vwTc+2/oQZ4Wh1t4NznYY4E00y8LCt6NqdRv81so00oo27D8MVKTpUa/MwUUtBLXCoDw==}
+    peerDependencies:
+      react-native-b4a: '*'
+    peerDependenciesMeta:
+      react-native-b4a:
+        optional: true
+
  balanced-match@1.0.2:
    resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==}

+  balanced-match@4.0.4:
+    resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==}
+    engines: {node: 18 || 20 || >=22}
+
+  bare-events@2.9.1:
+    resolution: {integrity: sha512-Z0oHEHAFDZkffN8Qc39zNZjQlMDkPJRyyyZieU1VH7u8c5S+qHZ2S8ixdKIAxEjfHO7FJxXmJWgteOghVanIsg==}
+    peerDependencies:
+      bare-abort-controller: '*'
+    peerDependenciesMeta:
+      bare-abort-controller:
+        optional: true
+
+  bare-fs@4.7.3:
+    resolution: {integrity: sha512-xRgplks8SvcKkdlv2M6Z2LZmRsmqd+x0nXXGXeMEjwdibj1HSDrlnqBRLeYdMvsgCox7Bq0e+DHwfczOfsn6IA==}
+    engines: {bare: '>=1.16.0'}
+    peerDependencies:
+      bare-buffer: '*'
+    peerDependenciesMeta:
+      bare-buffer:
+        optional: true
+
+  bare-os@3.9.3:
+    resolution: {integrity: sha512-fF4Q7QsyKVF5Rj0qvI8BgUNjqzC2JvQlpTaPLjVJVxYVUX5Zr9un+y3w1HmA4nNKdFmRBT8z/WmrjvXzXVerKQ==}
+    engines: {bare: '>=1.14.0'}
+
+  bare-path@3.0.1:
+    resolution: {integrity: sha512-ghj2DSK/2e99a1anTVPCV4m4YIYtrbXhfM7V3D7XZLOTsybnYyaJloymGqssQc8l/or0UoDyRtNQkmkEF/ysgQ==}
+
+  bare-stream@2.13.3:
+    resolution: {integrity: sha512-Kc+brLqvEqGkjyfiwJmImAOqLZL7OsoLKuavx+hJjgVV3nLTOjloJyPMFxjUPerGGHrNH0fLU06jjykMLWrERQ==}
+    peerDependencies:
+      bare-abort-controller: '*'
+      bare-buffer: '*'
+      bare-events: '*'
+    peerDependenciesMeta:
+      bare-abort-controller:
+        optional: true
+      bare-buffer:
+        optional: true
+      bare-events:
+        optional: true
+
+  bare-url@2.4.5:
+    resolution: {integrity: sha512-K+y9xF1tN+CdPu4qWwr0QiK1Al07eFPGYK5M2pDXcmHdMdgC/tT/bpmMe1hrmRHaidKLkXrC+cRNYf3XVDUhSQ==}
+
  base64-js@0.0.8:
    resolution: {integrity: sha512-3XSA2cR/h/73EzlXXdU6YNycmYI7+kicTxks4eJg2g39biHR84slg2+des+p7iHYhbRg/udIS4TD53WabcOUkw==}
    engines: {node: '>= 0.4'}
@@ -3196,6 +3273,10 @@ packages:
  brace-expansion@2.0.2:
    resolution: {integrity: sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==}

+  brace-expansion@5.0.7:
+    resolution: {integrity: sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==}
+    engines: {node: 18 || 20 || >=22}
+
  braces@3.0.3:
    resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==}
    engines: {node: '>=8'}
@@ -3211,12 +3292,19 @@ packages:
    engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
    hasBin: true

+  buffer-crc32@1.0.0:
+    resolution: {integrity: sha512-Db1SbgBS/fg/392AblrMJk97KggmvYhr4pB5ZIMTWtaivCPMWLkmb7m21cJvpvgK+J3nsU2CmmixNBZx4vFj/w==}
+    engines: {node: '>=8.0.0'}
+
  buffer-equal-constant-time@1.0.1:
    resolution: {integrity: sha512-zRpUiDwd/xk6ADqPMATG8vc9VPrkck7T07OIx0gnjmJAnHnTVXNQG3vfvWNuiZIkwu9KrKdA1iJKfsfTVxE6NA==}

  buffer-from@1.1.2:
    resolution: {integrity: sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==}

+  buffer@6.0.3:
+    resolution: {integrity: sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==}
+
  bytes@3.1.2:
    resolution: {integrity: sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==}
    engines: {node: '>= 0.8'}
@@ -3270,6 +3358,10 @@ packages:
  compare-versions@6.1.1:
    resolution: {integrity: sha512-4hm4VPpIecmlg59CHXnRDnqGplJFrbLG4aFEl5vl6cK1u76ws3LLvX7ikFnTDl5vo39sjWD6AaDPYodJp/NNHg==}

+  compress-commons@7.0.1:
+    resolution: {integrity: sha512-g0S8KAD8qf4+V//pr3BfB1aBnARLXNz2Gx+jmHU0LEriUuoQUOPOulVquHKTJ8+EAIIO7fhseNDr9wK5Q9FKBQ==}
+    engines: {node: '>=18'}
+
  connect-pg-simple@10.0.0:
    resolution: {integrity: sha512-pBGVazlqiMrackzCr0eKhn4LO5trJXsOX0nQoey9wCOayh80MYtThCbq8eoLsjpiWgiok/h+1/uti9/2/Una8A==}
    engines: {node: ^18.18.0 || ^20.9.0 || >=22.0.0}
@@ -3303,10 +3395,22 @@ packages:
    resolution: {integrity: sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==}
    engines: {node: '>= 0.6'}

+  core-util-is@1.0.3:
+    resolution: {integrity: sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==}
+
  cors@2.8.6:
    resolution: {integrity: sha512-tJtZBBHA6vjIAaF6EnIaq6laBBP9aq/Y3ouVJjEfoHbRBcHBAHYcMh/w8LDrk2PvIMMq8gmopa5D4V8RmbrxGw==}
    engines: {node: '>= 0.10'}

+  crc-32@1.2.2:
+    resolution: {integrity: sha512-ROmzCKrTnOwybPcJApAA6WBWij23HVfGVNKqqrZpuyZOHqK2CwHSvpGuyt/UNNvaIjEd8X5IFGp4Mh+Ie1IHJQ==}
+    engines: {node: '>=0.8'}
+    hasBin: true
+
+  crc32-stream@7.0.1:
+    resolution: {integrity: sha512-IBWsY8xznyQrcHn8h4bC8/4ErNke5elzgG8GcqF4RFPw6aHkWWRc7Tgw6upjaTX/CT/yQgqYENkxYsTYN+hW2g==}
+    engines: {node: '>=18'}
+
  cross-spawn@7.0.6:
    resolution: {integrity: sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==}
    engines: {node: '>= 8'}
@@ -3662,12 +3766,23 @@ packages:
    resolution: {integrity: sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==}
    engines: {node: '>= 0.6'}

+  event-target-shim@5.0.1:
+    resolution: {integrity: sha512-i/2XbnSz/uxRCU6+NdVJgKWDTM427+MqYbkQzD321DuCQJUqOuJKIA0IM2+W2xtYHdKOmZ4dR6fExsd4SXL+WQ==}
+    engines: {node: '>=6'}
+
  eventemitter3@4.0.7:
    resolution: {integrity: sha512-8guHBZCwKnFhYdHr2ysuRWErTwhoN2X8XELRlrRwpmfeY2jjuUN4taQMsULKUVo1K4DvZl+0pgfyoysHxvmvEw==}

  eventemitter3@5.0.4:
    resolution: {integrity: sha512-mlsTRyGaPBjPedk6Bvw+aqbsXDtoAyAzm5MO7JgU+yVRyMQ5O8bD4Kcci7BS85f93veegeCPkL8R4GLClnjLFw==}

+  events-universal@1.0.1:
+    resolution: {integrity: sha512-LUd5euvbMLpwOF8m6ivPCbhQeSiYVNb8Vs0fQ8QjXo0JTkEHpz8pxdQf0gStltaPpw0Cca8b39KxvK9cfKRiAw==}
+
+  events@3.3.0:
+    resolution: {integrity: sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==}
+    engines: {node: '>=0.8.x'}
+
  execa@9.6.1:
    resolution: {integrity: sha512-9Be3ZoN4LmYR90tUoVu2te2BsbzHfhJyfEiAVfz7N5/zv+jduIfLrV2xdQXOHbaD6KgpGdO9PRPM1Y4Q9QkPkA==}
    engines: {node: ^18.19.0 || >=20.5.0}
@@ -3699,6 +3814,9 @@ packages:
    resolution: {integrity: sha512-jt2DW/aNFNwke7AUd+Z+e6pz39KO5rzdbbFCg2sGafS4mk13MI7Z8O5z9cADNn5lhGODIgLwug6TZO2ctf7kcw==}
    engines: {node: '>=6.0.0'}

+  fast-fifo@1.3.2:
+    resolution: {integrity: sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ==}
+
  fast-glob@3.3.3:
    resolution: {integrity: sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==}
    engines: {node: '>=8.6.0'}
@@ -3873,6 +3991,9 @@ packages:
    resolution: {integrity: sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==}
    engines: {node: '>=0.10.0'}

+  ieee754@1.2.1:
+    resolution: {integrity: sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==}
+
  ignore@7.0.5:
    resolution: {integrity: sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==}
    engines: {node: '>= 4'}
@@ -3937,6 +4058,9 @@ packages:
    resolution: {integrity: sha512-mE00Gnza5EEB3Ds0HfMyllZzbBrmLOX3vfWoj9A9PEnTfratQ/BcaJOuMhnkhjXvb2+FkY3VuHqtAGpTPmglFQ==}
    engines: {node: '>=18'}

+  isarray@1.0.0:
+    resolution: {integrity: sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==}
+
  isexe@2.0.0:
    resolution: {integrity: sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==}

@@ -3984,6 +4108,10 @@ packages:
  jws@4.0.1:
    resolution: {integrity: sha512-EKI/M/yqPncGUUh44xz0PxSidXFr/+r0pA70+gIYhjv+et7yxM+s29Y+VGDkovRofQem0fs7Uvf4+YmAdyRduA==}

+  lazystream@1.0.1:
+    resolution: {integrity: sha512-b94GiNHQNy6JNTrt5w6zNyffMrNkXZb3KTkCZJb2V1xaEGCk093vkZ2jk3tpaeP33/OiXC+WvK9AxUebnf5nbw==}
+    engines: {node: '>= 0.6.3'}
+
  leven@4.1.0:
    resolution: {integrity: sha512-KZ9W9nWDT7rF7Dazg8xyLHGLrmpgq2nVNFUckhqdW3szVP6YhCpp/RAnpmVExA9JvrMynjwSLVrEj3AepHR6ew==}
    engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
@@ -4145,6 +4273,10 @@ packages:
  minimalistic-assert@1.0.1:
    resolution: {integrity: sha512-UtJcAD4yEaGtjPezWuO9wC4nwUnVH/8/Im3yEHQP4b67cXlD/Qr9hdITCU1xDbSEXg2XKNaP8jsReV7vQd00/A==}

+  minimatch@10.2.5:
+    resolution: {integrity: sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==}
+    engines: {node: 18 || 20 || >=22}
+
  minimatch@9.0.9:
    resolution: {integrity: sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==}
    engines: {node: '>=16 || 14 >=14.17'}
@@ -4201,6 +4333,10 @@ packages:
    resolution: {integrity: sha512-pkjE4mkBzQjdJT4/UmlKl3pX0rC9fZmjh7c6C9o7lv66Ac6w9WCnzPzhbPNxwZAzlF4mdq4CSWB5+FbK6FWCow==}
    engines: {node: '>=6.0.0'}

+  normalize-path@3.0.0:
+    resolution: {integrity: sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==}
+    engines: {node: '>=0.10.0'}
+
  npm-run-path@6.0.0:
    resolution: {integrity: sha512-9qny7Z9DsQU8Ou39ERsPU4OZQlSTP47ShQzuKZ6PRXpYLtIFgl/DEBYEXKlvcEa+9tHVcK8CF81Y2V72qaZhWA==}
    engines: {node: '>=18'}
@@ -4417,9 +4553,16 @@ packages:
    resolution: {integrity: sha512-gjVS5hOP+M3wMm5nmNOucbIrqudzs9v/57bWRHQWLYklXqoXKrVfYW2W9+glfGsqtPgpiz5WwyEEB+ksXIx3gQ==}
    engines: {node: '>=18'}

+  process-nextick-args@2.0.1:
+    resolution: {integrity: sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==}
+
  process-warning@5.0.0:
    resolution: {integrity: sha512-a39t9ApHNx2L4+HBnQKqxxHNs1r7KF+Intd8Q/g1bUh6q0WIp9voPXJ/x0j+ZL45KF1pJd9+q2jLIRMfvEshkA==}

+  process@0.11.10:
+    resolution: {integrity: sha512-cdGef/drWFoydD1JsMzuFf8100nZl+GT+yacc2bEced5f9Rjk4z+WtFUTBu9PhOi9j/jfmBPu0mMEY4wIdAF8A==}
+    engines: {node: '>= 0.6.0'}
+
  prop-types@15.8.1:
    resolution: {integrity: sha512-oj87CgZICdulUohogVAR7AjlC0327U4el4L6eAvOqCeudMDVU0NThNaV+b9Df4dXgSP1gXMTnPdhfe/2qDH5cg==}

@@ -4592,6 +4735,17 @@ packages:
    resolution: {integrity: sha512-FS+XFBNvn3GTAWq26joslQgWNoFu08F4kl0J4CgdNKADkdSGXQyTCnKteIAJy96Br6YbpEU1LSzV5dYtjMkMDg==}
    engines: {node: '>=0.10.0'}

+  readable-stream@2.3.8:
+    resolution: {integrity: sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==}
+
+  readable-stream@4.7.0:
+    resolution: {integrity: sha512-oIGGmcpTLwPga8Bn6/Z75SVaH1z5dUut2ibSyAMVhmUggWpmDn2dapB0n7f8nwaSiRtepAsfJyfXIO5DCVAODg==}
+    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
+
+  readdir-glob@3.0.0:
+    resolution: {integrity: sha512-AhNB2KgKeVJr16nK9LLZbJNWnYoT23ZrumNKFDebHBdkC8KHSqWo871JAUhoWC/RtjEVdqNMFpM6qrwRbaUqpw==}
+    engines: {node: '>=18'}
+
  readdirp@4.1.2:
    resolution: {integrity: sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg==}
    engines: {node: '>= 14.18.0'}
@@ -4610,6 +4764,7 @@ packages:
  recharts@2.15.4:
    resolution: {integrity: sha512-UT/q6fwS3c1dHbXv2uFgYJ9BMFHu3fwnd7AYZaEQhXuYQ4hgsxLvsUXzGdKeZrW5xopzDCvuA2N41WJ88I7zIw==}
    engines: {node: '>=14'}
+    deprecated: 1.x and 2.x branches are no longer active. Bump to Recharts v3 to receive latest features and bugfixes. See https://github.com/recharts/recharts/wiki/3.0-migration-guide
    peerDependencies:
      react: 19.1.0
      react-dom: 19.1.0
@@ -4654,6 +4809,9 @@ packages:
  run-parallel@1.2.0:
    resolution: {integrity: sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==}

+  safe-buffer@5.1.2:
+    resolution: {integrity: sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==}
+
  safe-buffer@5.2.1:
    resolution: {integrity: sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==}

@@ -4771,10 +4929,19 @@ packages:
    resolution: {integrity: sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==}
    engines: {node: '>= 0.8'}

+  streamx@2.28.0:
+    resolution: {integrity: sha512-1Yowhzjf0ivGMrTIkY9hav5TxobO9qIVqUE41fiCGMGgc3CLlf4MY+9AHmZqBWgDTue0fY9zWjYFVyf6Diuobw==}
+
  string-argv@0.3.2:
    resolution: {integrity: sha512-aqD2Q0144Z+/RqG52NeHEkZauTAUWJO8c6yTftGJKO3Tja5tUgIfmIl6kExvhtxSDP7fXB6DvzkfMpCd/F3G+Q==}
    engines: {node: '>=0.6.19'}

+  string_decoder@1.1.1:
+    resolution: {integrity: sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==}
+
+  string_decoder@1.3.0:
+    resolution: {integrity: sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==}
+
  strip-ansi@6.0.1:
    resolution: {integrity: sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==}
    engines: {node: '>=8'}
@@ -4805,6 +4972,15 @@ packages:
    resolution: {integrity: sha512-g9ljZiwki/LfxmQADO3dEY1CbpmXT5Hm2fJ+QaGKwSXUylMybePR7/67YW7jOrrvjEgL1Fmz5kzyAjWVWLlucg==}
    engines: {node: '>=6'}

+  tar-stream@3.2.0:
+    resolution: {integrity: sha512-ojzvCvVaNp6aOTFmG7jaRD0meowIAuPc3cMMhSgKiVWws1GyHbGd/xvnyuRKcKlMpt3qvxx6r0hreCNITP9hIg==}
+
+  teex@1.0.1:
+    resolution: {integrity: sha512-eYE6iEI62Ni1H8oIa7KlDU6uQBtqr4Eajni3wX7rpfXD8ysFx8z0+dri+KWEPWpBsxXfxu58x/0jvTVT1ekOSg==}
+
+  text-decoder@1.2.7:
+    resolution: {integrity: sha512-vlLytXkeP4xvEq2otHeJfSQIRyWxo/oZGEbXrtEEF9Hnmrdly59sUbzZ/QgyWuLYHctCHxFF4tRQZNQ9k60ExQ==}
+
  thread-stream@3.1.0:
    resolution: {integrity: sha512-OqyPZ9u96VohAyMfJykzmivOrY2wfMSf3C5TtFJVgN+Hm6aj+voFhlK+kZEIv2FBh1X6Xp3DlnCOfEQ3B2J86A==}

@@ -4829,6 +5005,7 @@ packages:
  tsconfck@3.1.6:
    resolution: {integrity: sha512-ks6Vjr/jEw0P1gmOVwutM3B7fWxoWBL2KRDb1JfqGVawBmO5UsvmWOQFGHBPl5yxYz4eERr19E6L7NMv+Fej4w==}
    engines: {node: ^18 || >=20}
+    deprecated: unmaintained
    hasBin: true
    peerDependencies:
      typescript: ^5.0.0
@@ -5058,6 +5235,10 @@ packages:
    resolution: {integrity: sha512-CzhO+pFNo8ajLM2d2IW/R93ipy99LWjtwblvC1RsoSUMZgyLbYFr221TnSNT7GjGdYui6P459mw9JH/g/zW2ug==}
    engines: {node: '>=18'}

+  zip-stream@7.0.5:
+    resolution: {integrity: sha512-dSvYKdvLsAHCDqPOhIwk/q5CvuWtTB3Dgpoe0uVEFjTzIOAmsQpprX25InCvrvJsirEbu1OHyy67n/kAj1Sw/w==}
+    engines: {node: '>=18'}
+
  zod@3.25.76:
    resolution: {integrity: sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==}

@@ -7417,6 +7598,11 @@ snapshots:

  '@transloadit/prettier-bytes@0.3.5': {}

+  '@types/archiver@8.0.0':
+    dependencies:
+      '@types/node': 25.3.5
+      '@types/readdir-glob': 1.1.5
+
  '@types/babel__core@7.20.5':
    dependencies:
      '@babel/parser': 7.29.0
@@ -7548,6 +7734,10 @@ snapshots:
    dependencies:
      csstype: 3.2.3

+  '@types/readdir-glob@1.1.5':
+    dependencies:
+      '@types/node': 25.3.5
+
  '@types/retry@0.12.2': {}

  '@types/sanitize-html@2.16.1':
@@ -7673,6 +7863,10 @@ snapshots:
    transitivePeerDependencies:
      - supports-color

+  abort-controller@3.0.0:
+    dependencies:
+      event-target-shim: 5.0.1
+
  accepts@1.3.8:
    dependencies:
      mime-types: 2.1.35
@@ -7708,6 +7902,22 @@ snapshots:

  arabic-persian-reshaper@1.0.1: {}

+  archiver@8.0.0:
+    dependencies:
+      async: 3.2.6
+      buffer-crc32: 1.0.0
+      is-stream: 4.0.1
+      lazystream: 1.0.1
+      normalize-path: 3.0.0
+      readable-stream: 4.7.0
+      readdir-glob: 3.0.0
+      tar-stream: 3.2.0
+      zip-stream: 7.0.5
+    transitivePeerDependencies:
+      - bare-abort-controller
+      - bare-buffer
+      - react-native-b4a
+
  argparse@2.0.1: {}

  aria-hidden@1.2.6:
@@ -7721,10 +7931,49 @@ snapshots:
      minimalistic-assert: 1.0.1
      safer-buffer: 2.1.2

+  async@3.2.6: {}
+
  atomic-sleep@1.0.0: {}

+  b4a@1.8.1: {}
+
  balanced-match@1.0.2: {}

+  balanced-match@4.0.4: {}
+
+  bare-events@2.9.1: {}
+
+  bare-fs@4.7.3:
+    dependencies:
+      bare-events: 2.9.1
+      bare-path: 3.0.1
+      bare-stream: 2.13.3(bare-events@2.9.1)
+      bare-url: 2.4.5
+      fast-fifo: 1.3.2
+    transitivePeerDependencies:
+      - bare-abort-controller
+      - react-native-b4a
+
+  bare-os@3.9.3: {}
+
+  bare-path@3.0.1:
+    dependencies:
+      bare-os: 3.9.3
+
+  bare-stream@2.13.3(bare-events@2.9.1):
+    dependencies:
+      b4a: 1.8.1
+      streamx: 2.28.0
+      teex: 1.0.1
+    optionalDependencies:
+      bare-events: 2.9.1
+    transitivePeerDependencies:
+      - react-native-b4a
+
+  bare-url@2.4.5:
+    dependencies:
+      bare-path: 3.0.1
+
  base64-js@0.0.8: {}

  base64-js@1.5.1: {}
@@ -7761,6 +8010,10 @@ snapshots:
    dependencies:
      balanced-match: 1.0.2

+  brace-expansion@5.0.7:
+    dependencies:
+      balanced-match: 4.0.4
+
  braces@3.0.3:
    dependencies:
      fill-range: 7.1.1
@@ -7781,10 +8034,17 @@ snapshots:
      node-releases: 2.0.36
      update-browserslist-db: 1.2.3(browserslist@4.28.1)

+  buffer-crc32@1.0.0: {}
+
  buffer-equal-constant-time@1.0.1: {}

  buffer-from@1.1.2: {}

+  buffer@6.0.3:
+    dependencies:
+      base64-js: 1.5.1
+      ieee754: 1.2.1
+
  bytes@3.1.2: {}

  call-bind-apply-helpers@1.0.2:
@@ -7835,6 +8095,14 @@ snapshots:

  compare-versions@6.1.1: {}

+  compress-commons@7.0.1:
+    dependencies:
+      crc-32: 1.2.2
+      crc32-stream: 7.0.1
+      is-stream: 4.0.1
+      normalize-path: 3.0.0
+      readable-stream: 4.7.0
+
  connect-pg-simple@10.0.0:
    dependencies:
      pg: 8.20.0
@@ -7860,11 +8128,20 @@ snapshots:

  cookie@0.7.2: {}

+  core-util-is@1.0.3: {}
+
  cors@2.8.6:
    dependencies:
      object-assign: 4.1.1
      vary: 1.1.2

+  crc-32@1.2.2: {}
+
+  crc32-stream@7.0.1:
+    dependencies:
+      crc-32: 1.2.2
+      readable-stream: 4.7.0
+
  cross-spawn@7.0.6:
    dependencies:
      path-key: 3.1.1
@@ -8182,10 +8459,20 @@ snapshots:

  etag@1.8.1: {}

+  event-target-shim@5.0.1: {}
+
  eventemitter3@4.0.7: {}

  eventemitter3@5.0.4: {}

+  events-universal@1.0.1:
+    dependencies:
+      bare-events: 2.9.1
+    transitivePeerDependencies:
+      - bare-abort-controller
+
+  events@3.3.0: {}
+
  execa@9.6.1:
    dependencies:
      '@sindresorhus/merge-streams': 4.0.0
@@ -8260,6 +8547,8 @@ snapshots:

  fast-equals@5.4.0: {}

+  fast-fifo@1.3.2: {}
+
  fast-glob@3.3.3:
    dependencies:
      '@nodelib/fs.stat': 2.0.5
@@ -8452,6 +8741,8 @@ snapshots:
    dependencies:
      safer-buffer: 2.1.2

+  ieee754@1.2.1: {}
+
  ignore@7.0.5: {}

  inherits@2.0.4: {}
@@ -8489,6 +8780,8 @@ snapshots:

  is-unicode-supported@2.1.0: {}

+  isarray@1.0.0: {}
+
  isexe@2.0.0: {}

  jiti@2.6.1: {}
@@ -8528,6 +8821,10 @@ snapshots:
      jwa: 2.0.1
      safe-buffer: 5.2.1

+  lazystream@1.0.1:
+    dependencies:
+      readable-stream: 2.3.8
+
  leven@4.1.0: {}

  lightningcss-android-arm64@1.31.1:
@@ -8656,6 +8953,10 @@ snapshots:

  minimalistic-assert@1.0.1: {}

+  minimatch@10.2.5:
+    dependencies:
+      brace-expansion: 5.0.7
+
  minimatch@9.0.9:
    dependencies:
      brace-expansion: 2.0.2
@@ -8693,6 +8994,8 @@ snapshots:

  nodemailer@8.0.7: {}

+  normalize-path@3.0.0: {}
+
  npm-run-path@6.0.0:
    dependencies:
      path-key: 4.0.0
@@ -8935,8 +9238,12 @@ snapshots:
    dependencies:
      parse-ms: 4.0.0

+  process-nextick-args@2.0.1: {}
+
  process-warning@5.0.0: {}

+  process@0.11.10: {}
+
  prop-types@15.8.1:
    dependencies:
      loose-envify: 1.4.0
@@ -9132,6 +9439,28 @@ snapshots:

  react@19.1.0: {}

+  readable-stream@2.3.8:
+    dependencies:
+      core-util-is: 1.0.3
+      inherits: 2.0.4
+      isarray: 1.0.0
+      process-nextick-args: 2.0.1
+      safe-buffer: 5.1.2
+      string_decoder: 1.1.1
+      util-deprecate: 1.0.2
+
+  readable-stream@4.7.0:
+    dependencies:
+      abort-controller: 3.0.0
+      buffer: 6.0.3
+      events: 3.3.0
+      process: 0.11.10
+      string_decoder: 1.3.0
+
+  readdir-glob@3.0.0:
+    dependencies:
+      minimatch: 10.2.5
+
  readdirp@4.1.2: {}

  readdirp@5.0.0: {}
@@ -9216,6 +9545,8 @@ snapshots:
    dependencies:
      queue-microtask: 1.2.3

+  safe-buffer@5.1.2: {}
+
  safe-buffer@5.2.1: {}

  safe-stable-stringify@2.5.0: {}
@@ -9369,8 +9700,25 @@ snapshots:

  statuses@2.0.2: {}

+  streamx@2.28.0:
+    dependencies:
+      events-universal: 1.0.1
+      fast-fifo: 1.3.2
+      text-decoder: 1.2.7
+    transitivePeerDependencies:
+      - bare-abort-controller
+      - react-native-b4a
+
  string-argv@0.3.2: {}

+  string_decoder@1.1.1:
+    dependencies:
+      safe-buffer: 5.1.2
+
+  string_decoder@1.3.0:
+    dependencies:
+      safe-buffer: 5.2.1
+
  strip-ansi@6.0.1:
    dependencies:
      ansi-regex: 5.0.1
@@ -9391,6 +9739,30 @@ snapshots:

  tapable@2.3.0: {}

+  tar-stream@3.2.0:
+    dependencies:
+      b4a: 1.8.1
+      bare-fs: 4.7.3
+      fast-fifo: 1.3.2
+      streamx: 2.28.0
+    transitivePeerDependencies:
+      - bare-abort-controller
+      - bare-buffer
+      - react-native-b4a
+
+  teex@1.0.1:
+    dependencies:
+      streamx: 2.28.0
+    transitivePeerDependencies:
+      - bare-abort-controller
+      - react-native-b4a
+
+  text-decoder@1.2.7:
+    dependencies:
+      b4a: 1.8.1
+    transitivePeerDependencies:
+      - react-native-b4a
+
  thread-stream@3.1.0:
    dependencies:
      real-require: 0.2.0
@@ -9590,6 +9962,12 @@ snapshots:

  yoctocolors@2.1.2: {}

+  zip-stream@7.0.5:
+    dependencies:
+      compress-commons: 7.0.1
+      normalize-path: 3.0.0
+      readable-stream: 4.7.0
+
  zod@3.25.76: {}

  zod@4.3.6: {}
@@ -1,5 +1,6 @@
 {pkgs}: {
  deps = [
+    pkgs.srt-live-server
    pkgs.expat
    pkgs.xorg.libxcb
    pkgs.xorg.libXrandr
@@ -18,8 +18,9 @@ import {
  executiveMeetingsTable,
  executiveMeetingAttendeesTable,
  executiveMeetingNotificationsTable,
+  protocolRoomsTable,
 } from "@workspace/db";
-import { eq, sql } from "drizzle-orm";
+import { eq, inArray, sql } from "drizzle-orm";
 import bcrypt from "bcryptjs";

 async function main() {
@@ -327,6 +328,19 @@ async function main() {
      isSystem: false,
      sortOrder: 7,
    },
+    {
+      slug: "protocol",
+      nameAr: "العلاقات العامة والمراسم",
+      nameEn: "Public Relations & Protocol",
+      descriptionAr: "حجز القاعات والاجتماعات الخارجية والهدايا والدروع",
+      descriptionEn: "Room bookings, external meetings, gifts and shields",
+      iconName: "Handshake",
+      route: "/protocol",
+      color: "#0ea5e9",
+      isActive: true,
+      isSystem: false,
+      sortOrder: 9,
+    },
  ];

  // Drift guard: every built-in slug (those with hardcoded routes in the
@@ -345,6 +359,7 @@ async function main() {
    "executive-meetings": "/meetings",
    calendar: "/calendar",
    documents: "/documents",
+    protocol: "/protocol",
  };
  for (const a of apps) {
    if ((BUILTIN_APP_SLUGS as readonly string[]).includes(a.slug)) {
@@ -763,6 +778,196 @@ async function main() {
    }
  }

+  // Public Relations & Protocol: roles.
+  const protocolRoles = [
+    {
+      name: "protocol_super_admin",
+      descriptionAr: "المدير العام للعلاقات العامة والمراسم",
+      descriptionEn: "Protocol Super Admin",
+      isSystem: 1,
+    },
+    {
+      name: "protocol_pr_manager",
+      descriptionAr: "مدير العلاقات العامة",
+      descriptionEn: "PR Manager",
+      isSystem: 1,
+    },
+    {
+      name: "protocol_officer",
+      descriptionAr: "موظف المراسم",
+      descriptionEn: "Protocol Officer",
+      isSystem: 1,
+    },
+    {
+      name: "protocol_requester",
+      descriptionAr: "مقدم الطلب",
+      descriptionEn: "Requester",
+      isSystem: 1,
+    },
+    {
+      name: "protocol_viewer",
+      descriptionAr: "مشاهد العلاقات العامة والمراسم",
+      descriptionEn: "Protocol Viewer",
+      isSystem: 1,
+    },
+  ];
+  await db.insert(rolesTable).values(protocolRoles).onConflictDoNothing();
+  console.log("Protocol roles created");
+
+  // Scoped protocol permissions. `protocol.access` also gates the home-screen
+  // tile (via app_permissions); the rest guard individual route capabilities.
+  // Route middleware authorizes by these permissions, never by role name, so
+  // an admin can delegate any capability by granting the permission.
+  const protocolPermissions = [
+    {
+      name: "protocol.access",
+      descriptionAr: "الوصول إلى وحدة العلاقات العامة والمراسم",
+      descriptionEn: "Access the Public Relations & Protocol module",
+    },
+    {
+      name: "protocol.request",
+      descriptionAr: "تقديم طلبات الحجز وإصدار الدروع",
+      descriptionEn: "Submit protocol booking and gift-issue requests",
+    },
+    {
+      name: "protocol.mutate",
+      descriptionAr: "إنشاء وتعديل سجلات العلاقات العامة والمراسم",
+      descriptionEn: "Create and edit protocol records",
+    },
+    {
+      name: "protocol.approve",
+      descriptionAr: "اعتماد أو رفض الحجوزات وإصدارات الدروع",
+      descriptionEn: "Approve or reject protocol bookings and gift issues",
+    },
+    {
+      name: "protocol.rooms.manage",
+      descriptionAr: "إدارة سجل القاعات",
+      descriptionEn: "Manage the protocol rooms registry",
+    },
+    {
+      name: "protocol.audit.read",
+      descriptionAr: "عرض سجل تدقيق العلاقات العامة والمراسم",
+      descriptionEn: "View the protocol audit log",
+    },
+  ];
+  await db
+    .insert(permissionsTable)
+    .values(protocolPermissions)
+    .onConflictDoNothing();
+
+  // Map each protocol permission to the roles that should hold it. Capabilities
+  // are additive: super admin holds everything, viewer only reads.
+  const protocolRolePermMap: Record<string, string[]> = {
+    "protocol.access": [
+      "admin",
+      "protocol_super_admin",
+      "protocol_pr_manager",
+      "protocol_officer",
+      "protocol_requester",
+      "protocol_viewer",
+    ],
+    "protocol.request": [
+      "admin",
+      "protocol_super_admin",
+      "protocol_pr_manager",
+      "protocol_officer",
+      "protocol_requester",
+    ],
+    "protocol.mutate": [
+      "admin",
+      "protocol_super_admin",
+      "protocol_pr_manager",
+      "protocol_officer",
+    ],
+    "protocol.approve": [
+      "admin",
+      "protocol_super_admin",
+      "protocol_pr_manager",
+    ],
+    "protocol.rooms.manage": ["admin", "protocol_super_admin"],
+    "protocol.audit.read": [
+      "admin",
+      "protocol_super_admin",
+      "protocol_pr_manager",
+    ],
+  };
+
+  const allRolesForProtocol = await db.select().from(rolesTable);
+  const roleIdByName = new Map(allRolesForProtocol.map((r) => [r.name, r.id]));
+  const allProtocolPerms = await db
+    .select()
+    .from(permissionsTable)
+    .where(
+      inArray(
+        permissionsTable.name,
+        protocolPermissions.map((p) => p.name),
+      ),
+    );
+  const permIdByName = new Map(allProtocolPerms.map((p) => [p.name, p.id]));
+
+  const rolePermValues: { roleId: number; permissionId: number }[] = [];
+  for (const [permName, roleNames] of Object.entries(protocolRolePermMap)) {
+    const permId = permIdByName.get(permName);
+    if (permId === undefined) continue;
+    for (const roleName of roleNames) {
+      const roleId = roleIdByName.get(roleName);
+      if (roleId === undefined) continue;
+      rolePermValues.push({ roleId, permissionId: permId });
+    }
+  }
+  if (rolePermValues.length > 0) {
+    await db
+      .insert(rolePermissionsTable)
+      .values(rolePermValues)
+      .onConflictDoNothing();
+  }
+  console.log("Protocol scoped permissions mapped to roles");
+
+  const protocolAccessPermId = permIdByName.get("protocol.access");
+  if (protocolAccessPermId !== undefined) {
+    const [protocolApp] = await db
+      .select()
+      .from(appsTable)
+      .where(eq(appsTable.slug, "protocol"));
+    if (protocolApp) {
+      await db
+        .insert(appPermissionsTable)
+        .values({ appId: protocolApp.id, permissionId: protocolAccessPermId })
+        .onConflictDoNothing();
+      console.log(
+        "App permissions set: protocol app restricted to protocol.access permission",
+      );
+    }
+  }
+
+  // Public Relations & Protocol: three default meeting rooms. Only seeded
+  // when the table is empty so admins can rename/remove them freely without
+  // re-seeds bringing them back.
+  const existingRooms = await db
+    .select({ id: protocolRoomsTable.id })
+    .from(protocolRoomsTable)
+    .limit(1);
+  if (existingRooms.length === 0) {
+    await db.insert(protocolRoomsTable).values([
+      {
+        nameAr: "قاعة الاجتماعات الرئيسية",
+        nameEn: "Main Meeting Hall",
+        sortOrder: 1,
+      },
+      {
+        nameAr: "قاعة كبار الزوار",
+        nameEn: "VIP Guests Hall",
+        sortOrder: 2,
+      },
+      {
+        nameAr: "قاعة الاجتماعات التنفيذية",
+        nameEn: "Executive Meetings Hall",
+        sortOrder: 3,
+      },
+    ]);
+    console.log("Protocol default rooms created");
+  }
+
  // Executive meetings: sample data for today (idempotent per-date).
  //
  // Opt-in only — a vanilla self-hosted install should start with an
Author	SHA1	Message	Date
Replit Agent	e2564e2a66	Add download for protocol visit photos (Task #660 ) Users could upload photos into Protocol "تصوير" albums but had no way to download them — clicking a photo only opened it inline. This adds per-photo downloads and a whole-album ZIP download. Backend: - objectStorage.ts: new exported extensionForContentType() mapping content types to file extensions (stored paths are extension-less UUIDs). - storage.ts: opt-in ?download=1 mode on GET /storage/objects/*path sets Content-Disposition: attachment (with optional ?name base + derived ext); default inline behavior and per-entity authz unchanged. - protocol.ts: new GET /protocol/photo-albums/:id/download streams all album photos as a ZIP (guarded by requireProtocolAccess), named from the album; unreadable objects are skipped rather than failing the archive. Empty album returns 404. - Added archiver@8 dependency (+@types/archiver dev). Frontend (protocol.tsx): - Per-photo download button (attachment, name = album-index) in album detail. - "تحميل الكل" / "Download all" ZIP button in album header; rendered disabled (not hidden) when the album has no photos. - Added photoDownloadSrc/albumDownloadSrc helpers, Download icon. - AR/EN locale strings protocol.photos.download / downloadAll. Notes / deviations: - archiver v8 is ESM-only with no callable default export; used `new ZipArchive(...)` instead of `archiver("zip")`. Recorded in memory. - Could not run authenticated e2e (seed admin password is a secret). Verified: api-server typecheck + build pass, tx-os typecheck passes, server healthy, new routes wired (401 auth-required not 404). Pre-existing typecheck errors in executive-meetings.ts / push.ts are unrelated and untouched.	2026-07-07 09:37:15 +00:00
Replit Agent	56c8bcfb85	Add download for protocol visit photos (Task #660 ) Users could upload photos into Protocol "تصوير" albums but had no way to download them — clicking a photo only opened it inline. This adds per-photo downloads and a whole-album ZIP download. Backend: - objectStorage.ts: new exported extensionForContentType() mapping content types to file extensions (stored paths are extension-less UUIDs). - storage.ts: opt-in ?download=1 mode on GET /storage/objects/*path sets Content-Disposition: attachment (with optional ?name base + derived ext); default inline behavior and per-entity authz unchanged. - protocol.ts: new GET /protocol/photo-albums/:id/download streams all album photos as a ZIP (guarded by requireProtocolAccess), named from the album; unreadable objects are skipped rather than failing the archive. Empty album returns 404. - Added archiver@8 dependency (+@types/archiver dev). Frontend (protocol.tsx): - Per-photo download button (attachment, name = album-index) in album detail. - "تحميل الكل" / "Download all" ZIP button in album header (hidden when empty). - Added photoDownloadSrc/albumDownloadSrc helpers, Download icon. - AR/EN locale strings protocol.photos.download / downloadAll. Notes / deviations: - archiver v8 is ESM-only with no callable default export; used `new ZipArchive(...)` instead of `archiver("zip")`. Recorded in memory. - Could not run authenticated e2e (seed admin password is a secret). Verified: api-server typecheck + build pass, tx-os typecheck passes, server healthy, new routes wired (401 auth-required not 404). Pre-existing typecheck errors in executive-meetings.ts / push.ts are unrelated and untouched.	2026-07-07 09:34:06 +00:00
Replit Agent	3a2f70c831	Transitioned from Plan to Build mode Replit-Commit-Author: Agent Replit-Commit-Session-Id: 77cfe984-2c65-4152-bb7a-0df28274fe66 Replit-Commit-Checkpoint-Type: full_checkpoint Replit-Commit-Event-Id: cc157e6f-25a1-4ce4-84d1-2949a36d40a4 Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/c3c252e4-c83d-40ca-9fff-99a3ea60701e/77cfe984-2c65-4152-bb7a-0df28274fe66/1OXOhLE Replit-Helium-Checkpoint-Created: true	2026-07-07 09:25:28 +00:00
Replit Agent	3f3c9671f5	Add functionality to manage visit photos and albums for protocols Introduce new database tables for photo albums and photos, add API endpoints for CRUD operations on albums and photos, and implement frontend components for managing photo albums. Replit-Commit-Author: Agent Replit-Commit-Session-Id: 77cfe984-2c65-4152-bb7a-0df28274fe66 Replit-Commit-Checkpoint-Type: full_checkpoint Replit-Commit-Event-Id: ad3facca-9626-4e19-95c0-125e6d3bc7e2 Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/c3c252e4-c83d-40ca-9fff-99a3ea60701e/77cfe984-2c65-4152-bb7a-0df28274fe66/1OXOhLE Replit-Helium-Checkpoint-Created: true	2026-07-07 09:14:07 +00:00
Replit Agent	9dd8c32d6d	Transitioned from Plan to Build mode Replit-Commit-Author: Agent Replit-Commit-Session-Id: 77cfe984-2c65-4152-bb7a-0df28274fe66 Replit-Commit-Checkpoint-Type: full_checkpoint Replit-Commit-Event-Id: 738505dd-e8e3-41e3-85df-c28000513ea0 Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/c3c252e4-c83d-40ca-9fff-99a3ea60701e/77cfe984-2c65-4152-bb7a-0df28274fe66/bJodRQl Replit-Helium-Checkpoint-Created: true	2026-07-07 08:58:54 +00:00
Replit Agent	aaa2d0b48d	Make external meeting titles display in red Update the styling of the MeetingRow component to conditionally apply red text color to the meeting title when the `isExternal` property is true. Replit-Commit-Author: Agent Replit-Commit-Session-Id: 77cfe984-2c65-4152-bb7a-0df28274fe66 Replit-Commit-Checkpoint-Type: full_checkpoint Replit-Commit-Event-Id: 1f41191d-7d28-4e72-bd38-191f56bae01b Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/c3c252e4-c83d-40ca-9fff-99a3ea60701e/77cfe984-2c65-4152-bb7a-0df28274fe66/bJodRQl Replit-Helium-Checkpoint-Created: true	2026-07-07 08:24:00 +00:00
Replit Agent	ea204894aa	Update tab name for dedications in protocol app Rename "Gifts & Shields" to "Dedications" in English and "الهدايا والدروع" to "الإهداءات" in Arabic within the protocol app's locale files. Replit-Commit-Author: Agent Replit-Commit-Session-Id: 77cfe984-2c65-4152-bb7a-0df28274fe66 Replit-Commit-Checkpoint-Type: full_checkpoint Replit-Commit-Event-Id: 4fc9b8d2-3d7b-4f65-b980-61b4ffc1e22d Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/c3c252e4-c83d-40ca-9fff-99a3ea60701e/77cfe984-2c65-4152-bb7a-0df28274fe66/bJodRQl Replit-Helium-Checkpoint-Created: true	2026-07-07 08:06:53 +00:00
Replit Agent	16e30e1bb1	Add project bundle for offline transfer and backup Add a new asset metadata entry for the TX-latest.tar.gz project bundle. Replit-Commit-Author: Agent Replit-Commit-Session-Id: 77cfe984-2c65-4152-bb7a-0df28274fe66 Replit-Commit-Checkpoint-Type: full_checkpoint Replit-Commit-Event-Id: ba675b94-b057-4118-8161-797925b5bbb8 Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/c3c252e4-c83d-40ca-9fff-99a3ea60701e/77cfe984-2c65-4152-bb7a-0df28274fe66/bJodRQl Replit-Helium-Checkpoint-Created: true	2026-07-06 14:13:26 +00:00
Replit Agent	17950daa5e	feat(protocol): shareable public booking link bar in Room Bookings Task #655: staff need a one-click way to copy and share the public (no-login) room-booking link with guests. - Add a link bar at the top of the "حجوزات القاعات" (Room Bookings) section showing the absolute public URL, with a "نسخ الرابط" copy button that gives toast + a temporary "تم النسخ" confirmation state. - URL is built from window.location.origin + BASE_URL (trailing slash stripped) + "/protocol/request", so it works on root and subpath deploys and when pasted into a browser/WhatsApp. - Clipboard uses navigator.clipboard with a textarea+execCommand fallback; fallback now checks execCommand's return and reports failure (destructive toast) instead of falsely showing success. Textarea is removed in a finally block. Copied-state timer stored in a ref and cleared on repeat clicks to avoid a reset race. - URL text forced dir="ltr" inside the RTL layout; new i18n keys (shareLinkTitle, copyLink, linkCopied, linkCopyFailed) added under protocol.bookings in both ar.json and en.json. Verified: tsc typecheck passes; /protocol serves 200; module transforms cleanly via Vite; architect review issues (fallback false-success, timer race) fixed.	2026-07-06 12:20:17 +00:00
Replit Agent	323472eec0	Transitioned from Plan to Build mode Replit-Commit-Author: Agent Replit-Commit-Session-Id: 77cfe984-2c65-4152-bb7a-0df28274fe66 Replit-Commit-Checkpoint-Type: full_checkpoint Replit-Commit-Event-Id: f62b3d4a-2b74-4d08-886a-87517e159301 Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/c3c252e4-c83d-40ca-9fff-99a3ea60701e/77cfe984-2c65-4152-bb7a-0df28274fe66/OsTuUKE Replit-Helium-Checkpoint-Created: true	2026-07-06 12:16:35 +00:00
Replit Agent	457eff44c4	Add professional Arabic date and time picker to booking form Introduce a custom DateTimePicker component for improved date and time selection in the protocol request form, replacing native inputs with an Arabic-localized, RTL-compatible interface. Replit-Commit-Author: Agent Replit-Commit-Session-Id: 77cfe984-2c65-4152-bb7a-0df28274fe66 Replit-Commit-Checkpoint-Type: full_checkpoint Replit-Commit-Event-Id: 8b01db58-6cde-464b-bd7d-46bd031e467f Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/c3c252e4-c83d-40ca-9fff-99a3ea60701e/77cfe984-2c65-4152-bb7a-0df28274fe66/OsTuUKE Replit-Helium-Checkpoint-Created: true	2026-07-06 11:40:36 +00:00
Replit Agent	2a194de12c	Add attendee count field to booking requests and display it Updates API schemas and database to include attendee count for bookings, modifies the public request form to accept this new optional field, and displays the attendee count on the booking details. Replit-Commit-Author: Agent Replit-Commit-Session-Id: 77cfe984-2c65-4152-bb7a-0df28274fe66 Replit-Commit-Checkpoint-Type: full_checkpoint Replit-Commit-Event-Id: 9c655ed7-866c-454d-b646-e458df854c65 Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/c3c252e4-c83d-40ca-9fff-99a3ea60701e/77cfe984-2c65-4152-bb7a-0df28274fe66/OsTuUKE Replit-Helium-Checkpoint-Created: true	2026-07-06 11:33:58 +00:00
Replit Agent	62c38a508f	Add public interface for submitting room booking requests Introduces a new public-facing API endpoint and UI for submitting room booking requests without authentication, including rate limiting and input validation. Replit-Commit-Author: Agent Replit-Commit-Session-Id: 77cfe984-2c65-4152-bb7a-0df28274fe66 Replit-Commit-Checkpoint-Type: full_checkpoint Replit-Commit-Event-Id: 5352d582-4c15-426c-84ce-4ba3fa0d5cd8 Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/c3c252e4-c83d-40ca-9fff-99a3ea60701e/77cfe984-2c65-4152-bb7a-0df28274fe66/OsTuUKE Replit-Helium-Checkpoint-Created: true	2026-07-06 11:18:14 +00:00
Replit Agent	6c5ae9d437	Transitioned from Plan to Build mode Replit-Commit-Author: Agent Replit-Commit-Session-Id: 77cfe984-2c65-4152-bb7a-0df28274fe66 Replit-Commit-Checkpoint-Type: full_checkpoint Replit-Commit-Event-Id: 34b757e2-71fa-4d1c-8840-e8c61b98d0f2 Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/c3c252e4-c83d-40ca-9fff-99a3ea60701e/77cfe984-2c65-4152-bb7a-0df28274fe66/9SfnFMU Replit-Helium-Checkpoint-Created: true	2026-07-06 11:05:30 +00:00
Replit Agent	5d76d25eb7	Move navigation to a vertical sidebar on the right for better layout Restructures the page layout to move the navigation tabs from a horizontal bar to a vertical sidebar on the right, enhancing RTL support. Replit-Commit-Author: Agent Replit-Commit-Session-Id: 77cfe984-2c65-4152-bb7a-0df28274fe66 Replit-Commit-Checkpoint-Type: full_checkpoint Replit-Commit-Event-Id: ec325dd2-ed6f-4785-8de9-93ec3207af08 Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/c3c252e4-c83d-40ca-9fff-99a3ea60701e/77cfe984-2c65-4152-bb7a-0df28274fe66/9SfnFMU Replit-Helium-Checkpoint-Created: true	2026-07-06 10:13:41 +00:00
Replit Agent	5fe5194349	Task #649 : Public Relations & Protocol module (bookings, external meetings, gifts) Separate additive module, fully independent from executive-meetings. All tables prefixed protocol_, routes under /protocol, Arabic-first RTL UI. This session: addressed code-review rejection by switching protocol authorization from hardcoded role-name checks to scoped permission checks. - auth.ts: requireProtocolAccess now guards on the "protocol.access" permission (same permission that gates the home-screen tile via app_permissions), so backend read access aligns with tile visibility. - protocol.ts: replaced role-name helpers with makeRequirePerm + PROTOCOL_PERMS map (protocol.access / request / mutate / approve / rooms.manage / audit.read). Booking auto-approve and /protocol/me capabilities now derive from permissions. - seed.ts: seeds all 6 scoped permissions and maps them to admin + the 5 protocol roles (access:6, request:5, mutate:4, approve:3, audit:3, rooms:2 role grants). Verified: typecheck clean (tx-os, api-server protocol/auth, scripts), seed applied, DB mappings confirmed, /api/protocol/me returns 401 unauth. Architect review PASS. Deviations: none from spec. Frontend already consumed capability flags from /me, so no frontend changes were needed for the permission switch.	2026-07-06 09:54:30 +00:00
Replit Agent	5e460920c7	Task #649 : complete Public Relations & Protocol module (fix 8 review gaps) Addresses the 8 spec gaps that blocked prior completion, all additive and scoped to the protocol_* module / /protocol routes. executive-meetings untouched. Backend (api-server/routes/protocol.ts, lib/db schema, seed): - External meetings create as "pending" (status dropped from create schema); added approve + reject endpoints with state-conditional WHERE status='pending' and 409 on contention; patch status enum restricted to completed/cancelled. - Added approvedBy/approvedAt/rejectionReason columns + status index; default status now "pending". - Booking reject and gift-issue reject made state-conditional (409 on 0 rows). - Dashboard: roomsAvailableNow (NOT EXISTS), giftsIssuedThisMonth/Qty; upcomingExternal filtered to future pending\|approved. - Reports: added externalMeetings summary counts by status. - Seed: room names corrected (AR + EN). Frontend (tx-os/pages/protocol.tsx, App.tsx, locales): - URL-synced tabs under /protocol/:tab (slug<->tab maps). - Dedicated Rooms tab (moved out of Gifts); RoomDialog isActive toggle. - External approve/reject buttons + rejectionReason display; ExternalDialog create omits status, edit limited to completed/cancelled. - Dashboard cards clickable to navigate; reports external section. - Bookings list/calendar (grouped-by-day) view toggle. - New i18n keys in ar.json + en.json. Verification: tx-os + protocol.ts typecheck clean; drizzle push + re-seed done; both workflows restarted; /api/protocol/me returns 401 unauth; architect re-review approved. Pre-existing typecheck errors in executive-meetings.ts and push.ts are unrelated and were not touched. Note: had to rebuild lib/db declarations (tsc --build --force) so api-server project references picked up the new schema columns.	2026-07-06 09:46:12 +00:00
Replit Agent	2322b77b8d	Add Public Relations & Protocol module (Task #649 ) New, fully separate app module "العلاقات العامة والمراسم / Public Relations and Protocol". Does not touch executive-meetings; all new tables are prefixed protocol_ and are additive-only, routes under /protocol. Includes: - 6 protocol_ tables (rooms, room bookings, external meetings, gifts, gift issues, audit log) in lib/db. - API routes + role-scoped middleware (protocol_super_admin, pr_manager, officer, requester, viewer) with requireProtocolAccess gating. - Room-booking conflict prevention (overlap rule newStart<existingEnd AND newEnd>existingStart vs pending/approved) with AR error message. - Gifts/shields (دروع) registry + issuance with stock tracking. - Bilingual AR/EN frontend page (tabs + dialogs) at /protocol, app tile, i18n keys, and seed data (roles, permission, default rooms). Concurrency/security hardening from code review: - All role guards now validate users.isActive (inactive-user bypass fix). - Per-room SELECT ... FOR UPDATE lock serializes booking check-then-write. - Approve paths re-read inside the transaction and use state-conditional updates (WHERE ... AND status='pending' RETURNING). - Gift issuance claims the issue conditionally, then does an atomic conditional stock decrement; failure rolls back the claim. Verified: drizzle push (6 tables), seed, frontend + api-server typecheck (only pre-existing errors in untouched files), unauth gating returns 401, conflict predicate confirmed. Architect review PASS.	2026-07-06 09:25:40 +00:00
Replit Agent	62470c580d	Transitioned from Plan to Build mode Replit-Commit-Author: Agent Replit-Commit-Session-Id: 77cfe984-2c65-4152-bb7a-0df28274fe66 Replit-Commit-Checkpoint-Type: full_checkpoint Replit-Commit-Event-Id: e4960c19-0ee6-410c-95a5-24eefd66c0b7 Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/c3c252e4-c83d-40ca-9fff-99a3ea60701e/77cfe984-2c65-4152-bb7a-0df28274fe66/sVsVYJx Replit-Helium-Checkpoint-Created: true	2026-07-06 08:59:30 +00:00
Replit Agent	bb0ecaa9f9	Saved progress at the end of the loop Replit-Commit-Author: Agent Replit-Commit-Session-Id: 77cfe984-2c65-4152-bb7a-0df28274fe66 Replit-Commit-Checkpoint-Type: full_checkpoint Replit-Commit-Event-Id: 353dbbfd-1386-43a2-879c-a2aa2797108e Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/c3c252e4-c83d-40ca-9fff-99a3ea60701e/77cfe984-2c65-4152-bb7a-0df28274fe66/sVsVYJx Replit-Helium-Checkpoint-Created: true	2026-07-05 13:20:41 +00:00
Replit Agent	72f5526866	Add a live server for development and testing purposes Install the srt-live-server package as a dependency in replit.nix. Replit-Commit-Author: Agent Replit-Commit-Session-Id: 77cfe984-2c65-4152-bb7a-0df28274fe66 Replit-Commit-Checkpoint-Type: full_checkpoint Replit-Commit-Event-Id: 36525074-60aa-4921-9b2e-78a74f24bd4f Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/c3c252e4-c83d-40ca-9fff-99a3ea60701e/77cfe984-2c65-4152-bb7a-0df28274fe66/fKZh36i Replit-Helium-Checkpoint-Created: true	2026-07-05 13:11:31 +00:00
Replit Agent	4c291269f1	Center meeting and attendee information within table cells Apply 'text-center' class directly to the table data (td) elements for meeting and attendee columns to ensure consistent alignment with the time column. Replit-Commit-Author: Agent Replit-Commit-Session-Id: 77cfe984-2c65-4152-bb7a-0df28274fe66 Replit-Commit-Checkpoint-Type: full_checkpoint Replit-Commit-Event-Id: ddb4304d-b474-4cc9-adee-c11f7a7c1674 Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/c3c252e4-c83d-40ca-9fff-99a3ea60701e/77cfe984-2c65-4152-bb7a-0df28274fe66/fKZh36i Replit-Helium-Checkpoint-Created: true	2026-07-05 12:37:08 +00:00