Technical
Architecture.

Every agency operates inside its own MariaDB database, eliminating cross-tenant SQL joins or row-level leakage by design.

Resolves the authenticated session's companyId with timeout protection and routes queries to the isolated tenant pool.

Schema upgrades apply atomically and idempotently across cap_master and all tenant_* databases prior to build swap.

Production builds compile inside a separate directory on a pre-equipped Alpine container while live traffic continues uninterrupted.

Directory swap and container restart complete in under 2–5 seconds, verified against a hardened /api/health endpoint that exposes zero internal server metadata.

Session cookies (user_id, session_sig, access_token, sa_token) are verified at the Edge before reaching application routes.

Beneficiary accounts (CLIENT / linked USER) route directly to /portal, and logout deterministically clears all tenant and superadmin session tokens.

Compatible with Google Authenticator, Authy, and 1Password; re-generating a QR secret preserves active 2FA enforcement until verified.

Protects TOTP challenge verification against automated guessing attacks while enforcing requireRole(['ADMIN', 'PLANNER']) on sensitive mutations.

Continuously computes Active (checked-in), Late > 15 min / Unassigned, Upcoming Today, and Completed shifts.

Coordinators get the Live Control Tower, field staff get a mobile Field Hub (QR Scanner, Schedule, Leave, HR Vault), and families get a dedicated Portal Hub.

Excludes staff on approved leave, overlapping shifts, or beneficiary incompatibility blacklists automatically.

Ranks conflict-free caregivers by exact GPS distance and estimated travel minutes, resetting shift status cleanly upon reassignment.

Stores building, floor, door/keybox codes, emergency contacts, legal guardians, and GIR 1–6 autonomy evaluations.

Propagates couple titles cleanly across client dossiers, quotes, contracts, invoices, and annual tax certificates.

Validates plan start/end windows (inclusive of end-of-day timestamps), monthly hour caps, funder hourly rates, and beneficiary co-pay percentages.

Captures or uploads staff portraits with 4:5 aspect cropping, generating print-ready PVC CR80 cards and bulk photo ZIP exports.

Allows families or inspectors to scan an employee's badge QR and confirm active employment status in real time across isolated tenant databases.

Flags expiring ID cards, residence permits, driving licenses, and medical certificates 30 days ahead.

Applies schedule edits to a single shift or future occurrences while checking rest periods and shift overlaps.

Automatically splits shift durations across regular hours, Sundays/Fridays, night hours, and statutory or Islamic public holidays.

Adapts currency (EUR / QAR), VAT (5.5% / 0%), workweek (Mon–Sun / Sun–Thu), QID & WPS IBAN validation, and 1-click legal contract packs.

When offline, the scan payload (client QR, exact timestamp, GPS coordinates, touch signature) is sealed with a SHA-256 digest in IndexedDB.

Upon 4G/Wi-Fi reconnection, queued scans replay chronologically, honoring the authentic basement timestamp within bounded anti-spoof windows and purging permanent invalid scans.

Caches scanner assets for zero-network boot while explicitly bypassing /login and redirected responses so authenticated sessions never stale.

Scans the selected month for unclosed shifts, absent/cancelled comments, expired APA/PCH plans, missing rates, and incomplete SEPA mandates.

Generates /ECH 30J summary PDFs and semicolon-delimited reconciliation CSVs across APAP, AMPAP, AMPHP, PCHAD, and PCHED in a single ZIP download.

Builds bank-compliant XML batches strictly from validated non-draft invoices (DRAFT and CANCELLED excluded) with creditor ICS/IBAN/BIC validation.

Outbound bulk invoice and reminder emails are disabled by default at the code and settings level—nothing leaves until an administrator explicitly toggles the switch.

Families view live schedules, active APA/PCH hour meters, finalized invoices with real agency IBAN/BIC, and download annual 50% tax credit PDFs in one click.

Tracks SEPA, CESU, wire, check, cash, and card settlements, balance regularizations, sequentially chained credit notes, and FEC / Quadra / Silae exports.

Supports remote single-signer links (/sign/[token]) and live multi-employee QR room sessions (/session-live/[id]), embedding signature graphics, IP, timestamp, and hash into the PDF.

Extracts structured fields from IDs and social aid notifications while protecting historical imported files in read-only archival mode.

Centralizes family/staff call traceability (/dashboard/calls), team chat (/dashboard/chat), and WhatsApp schedule sharing (/api/webhook/whatsapp).

Delivers bilingual step-by-step interactive data-tour spotlights tailored separately for back-office coordinators and mobile field workers.

Imports legacy clients, staff, and funding plans cleanly, and exports on-demand compressed .sql.gz backups of the agency's isolated database.

Internal Copilot queries execute strictly within the authenticated user's RBAC permissions and isolated tenant database.

Treasury, Billing, Security Scanner, and Developer agents are guarded by syntax/delimiter validators, full tsc --noEmit verification, and automatic rollback.

Generates a compliant UN/CEFACT Cross-Industry Invoice (urn:cen.eu:en16931:2017) and attaches factur-x.xml inside rendered invoices via AFRelationship.Alternative.

Computes regular, rest-day, holiday, night (21:00–06:00) hours & Haversine GPS mileage for Silae/WPS exports, and reconciles bank CSV credits & SEPA rejections in 1 click.

Connects post-scan caregiver tags to coordinator alerts and /portal/liaison, backed by Schema.org JSON-LD, dynamic sitemap.ts, and live /api/health latency probes.