[
  {
    "type": "create_table",
    "description": "Create unified users table for centralized user management",
    "database": "kiosk_users",
    "check_query": "SHOW TABLES LIKE 'users'",
    "sql": "CREATE TABLE `users` (\n  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,\n  `username` varchar(50) DEFAULT NULL COMMENT 'Login username, unique when set',\n  `email` varchar(150) DEFAULT NULL COMMENT 'Email address',\n  `password` varchar(255) DEFAULT NULL COMMENT 'Hashed password (Argon2id preferred)',\n  `displayName` varchar(150) DEFAULT NULL COMMENT 'Display name shown in UI',\n  `firstName` varchar(50) DEFAULT NULL,\n  `lastName` varchar(50) DEFAULT NULL,\n  `phone` varchar(20) DEFAULT NULL,\n  `photoUrl` varchar(500) DEFAULT NULL COMMENT 'Profile photo URL',\n  `avatarOverride` tinyint(1) NOT NULL DEFAULT 0 COMMENT 'Allow custom avatar vs synced photo',\n  `position` varchar(100) DEFAULT NULL COMMENT 'Job title/position',\n  `hourlyRate` decimal(10,2) DEFAULT NULL,\n  `hireDate` date DEFAULT NULL,\n  `terminationDate` date DEFAULT NULL,\n  `leaveStartDate` date DEFAULT NULL,\n  `leaveEndDate` date DEFAULT NULL,\n  `emergencyContactName` varchar(100) DEFAULT NULL,\n  `emergencyContactPhone` varchar(20) DEFAULT NULL,\n  `source` enum('homegrown','wheniwork','homebase','system') NOT NULL DEFAULT 'system' COMMENT 'Data source provider',\n  `externalId` varchar(50) DEFAULT NULL COMMENT 'ID in external system',\n  `lastSyncedAt` timestamp NULL DEFAULT NULL COMMENT 'Last sync from external provider',\n  `canLogin` tinyint(1) NOT NULL DEFAULT 0 COMMENT 'Whether user can authenticate',\n  `accountType` enum('employee','user','admin','system') NOT NULL DEFAULT 'employee' COMMENT 'Account type for access control',\n  `enabled` tinyint(1) NOT NULL DEFAULT 1 COMMENT 'Account enabled flag',\n  `active` tinyint(1) NOT NULL DEFAULT 0 COMMENT 'Account activated flag',\n  `activationToken` varchar(255) DEFAULT NULL COMMENT 'Account activation token',\n  `activationTokenExpiresAt` timestamp NULL DEFAULT NULL,\n  `passwordResetToken` varchar(255) DEFAULT NULL COMMENT 'Password reset token',\n  `passwordResetExpiresAt` timestamp NULL DEFAULT NULL,\n  `mfaEnabled` tinyint(1) NOT NULL DEFAULT 0,\n  `mfaSecret` varchar(255) DEFAULT NULL COMMENT 'Encrypted TOTP secret',\n  `mfaBackupCodes` json DEFAULT NULL COMMENT 'Hashed backup codes array',\n  `mfaVerifiedAt` timestamp NULL DEFAULT NULL,\n  `locale` varchar(10) NOT NULL DEFAULT 'en_US',\n  `dailyReport` tinyint(1) NOT NULL DEFAULT 0 COMMENT 'Receive daily report emails',\n  `timezone` varchar(50) NOT NULL DEFAULT 'America/Los_Angeles',\n  `createdAt` timestamp NOT NULL DEFAULT current_timestamp(),\n  `updatedAt` timestamp NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),\n  `lastLoginAt` timestamp NULL DEFAULT NULL,\n  `lastLoginIp` varchar(45) DEFAULT NULL COMMENT 'IPv4 or IPv6 address',\n  `failedLoginAttempts` int(10) NOT NULL DEFAULT 0,\n  `lockedUntil` timestamp NULL DEFAULT NULL COMMENT 'Account lockout expiration',\n  PRIMARY KEY (`id`),\n  UNIQUE KEY `uk_username` (`username`),\n  KEY `idx_email` (`email`),\n  KEY `idx_external` (`source`, `externalId`),\n  KEY `idx_canLogin` (`canLogin`),\n  KEY `idx_accountType` (`accountType`),\n  KEY `idx_active` (`enabled`, `active`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='Unified users table - single source of truth for all user data'"
  }
]