API v2 registrations and payments (1.51.1)

- v2: register, get, cancel and checkout a registration (owner/admin only).
- Registration create/cancel moved to src/services/registrations.ts and online checkout to
  src/services/payments.ts; v1 controllers call the same services (ServiceError carries status).
- Typed frontend calls: npm run api:types writes openapi.json and schema.d.ts; apiV2() helper.
  Register page, Pay now and My Events cancel use v2; apiFetch reads v2 errors.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ls1vMdg2GYqbnKZmPaX1ot

CHANGELOG.md

@@ -7,6 +7,107 @@ and this project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [1.51.1] - 2026-10-29
+
+### Added
+
+- **API v2 registrations and payments:** `POST /registrations` (signed in, guest for free
+  events, or a waitlist link), `GET /registrations/{id}`, `POST /registrations/{id}/cancel` and
+  `POST /registrations/{id}/checkout` (online payment, with an optional donation; answers
+  `priceUpdated` with the new balance when an early-bird price ran out). Owners only (admins too);
+  someone else's registration is `NOT_FOUND`.
+- **Services in TypeScript:** making and cancelling registrations moved from
+  `registrationController.js` to `src/services/registrations.ts`, and paying a registration
+  online from `paymentController.js` to `src/services/payments.ts`. v1 and v2 run the same code;
+  `ServiceError` carries the HTTP status. `registrationController.js` is ~560 lines shorter.
+- **Typed frontend calls:** `npm run api:types` (repo root) writes the OpenAPI document to
+  `frontend/src/lib/api-v2/openapi.json` and generates `schema.d.ts` from it (openapi-typescript);
+  `apiV2(method, path, { params, query, body, authToken })` in `frontend/src/lib/apiV2.ts` checks
+  the path, parameters, body and answer. A backend test fails while the saved document is stale.
+
+### Changed
+
+- The register page, "Pay now" (registration success page and My Events) and cancelling on My
+  Events use API v2. `apiFetch` reads v2 errors (`error.message`, with `code`/`fields` in `data`).
+
+## [1.51.0] - 2026-10-29
+
+### Added
+
+- **API v2** (`/api/v2`), the groundwork for 2.0: every endpoint is declared once with zod
+  schemas (`src/v2/route.ts`). The declaration validates the request, strips the response to what
+  the schema lists, and generates the **OpenAPI 3.1** document (`GET /api/v2/openapi.json`, admin)
+  shown at **`/docs/v2`** (Swagger UI, served locally). One error shape
+  `{ error: { code, message, fields? } }` with stable codes, and one list shape
+  `{ data, meta: { page, limit, total, pages } }`. First endpoints (read-only): `GET /events`,
+  `GET /events/:id`, `GET /me`, `GET /me/registrations`. v1 (`/api/…`) is unchanged.
+- **TypeScript in the backend:** `tsconfig.json` (`allowJs`; `.ts` strict), `npm run build` →
+  `dist/`, `npm run typecheck`, `npm run dev` through tsx, Jest runs `.ts` via ts-jest. Typed
+  doors into JS modules in `src/v2/legacy.ts`.
+- Tests: `tests/v2.test.ts`, e2e `e2e/api-v2.spec.ts`.
+
+### Changed
+
+- The server moved from `backend/src/index.js` to `backend/src/app.js`. `src/index.js` is now a
+  launcher that runs the matching build in `dist/` (or compiles on the fly with tsx when there is
+  none), so existing PM2 configs keep working unchanged.
+- `scripts/deploy.sh` and `scripts/install.sh` build the backend (`npm ci --include=dev`, then
+  `npm run build`); a rollback to a release before 1.51.0 skips the build. The first update to
+  1.51.0 by an older deploy script still starts (it compiles at start-up); the next update builds.
+- e2e starts the backend with tsx.
+
+## [1.50.2] - 2026-10-29
+
+### Added
+
+- **Searchable event picker** (`components/shared/EventPicker.tsx`) instead of the plain event
+  dropdowns on staff and supervisor pages (scanner, event tickets, at the door, payments, manual,
+  email and WhatsApp attendees, forms, attendance, consent, waitlist, allocations, bundles, offline
+  scans, kids and volunteer set-up, manage registrations, the kiosk). It opens on upcoming events
+  (soonest first); past ones are behind **Show past events** (latest first), and typing searches
+  every event by name, campus or date. Keyboard: arrows, Page Up/Down, Enter, Escape.
+- **Reports:** the events list can be searched; "Select these N" / "Clear these" act on the matches.
+- **Site settings → Webhooks → How webhooks work:** what is sent and when, the envelope and
+  headers, retries and duplicates, checking the signature (Node.js and PHP), Zapier/Make set-up,
+  and a copyable example of every event type. `GET /api/outbound-webhooks` event types now carry
+  an `example`; `tests/webhooks.test.js` checks each one has the same shape as the real payload.
+
+### Changed
+
+- Pages that listed every event ever made in their dropdown (email and WhatsApp attendees, forms,
+  bundles, scanner, payments) now open on upcoming ones; their separate "Include past events"
+  checkboxes are gone (the picker has its own). Event tickets and Payments can now reach past
+  events too.
+- e2e: `pickEvent()` in `e2e/fixtures.ts`; `e2e/event-picker.spec.ts`.
+
+## [1.50.1] - 2026-10-29
+
+### Added
+
+- **Audit log:** search by person (name or email), target (type or `#id`) or IP, a Role filter,
+  **Clear filters**, and "21–40 of 312" under the list. The Action filter now lists every action
+  that can be logged (it was missing 35 — campuses, kids check-in, volunteers, series, season
+  passes, webhooks, bulk actions, Hub updates, certificates and more), sorted by name.
+- **Data requests:** search by name or email, and closed requests a page (50) at a time — the list
+  used to stop silently at 200.
+- **Webhook delivery log:** filter by status (failed, retrying, succeeded) and **Load older** —
+  it used to show only the latest 50.
+- API filters: `/api/registrations?unpaid=1&userId=`, `/api/payments?userId=&from=&donations=1`,
+  `/api/privacy/requests?search=&page=&limit=`, `/api/outbound-webhooks/:id/deliveries?before=`,
+  `/api/admin/audit-log?search=&role=`. Shared `components/shared/Pager.tsx`.
+
+### Fixed
+
+- Audit log: the **To** date left out that day's entries (it meant midnight at the start of the
+  day). Both dates are now whole days in the site's time zone.
+
+### Changed
+
+- **Payments** (supervisor) no longer downloads every payment and registration ever made when it
+  opens: it loads the latest payments, today's (for the totals), donations with what they were
+  applied to, and only registrations still owing. Refunds load the chosen person's own payments and
+  registrations when they're picked. Faster as the years add up; the page works the same.
+
 ## [1.50.0] - 2026-10-28
 
 ### Added

DEPLOYMENT.md

@@ -305,7 +305,8 @@ cd /opt/hope-events
 sudo -u hopeevents -H bash scripts/deploy.sh v1.41.2     # or no tag for the latest main
 ```
 
-It backs up the database, checks out the release, installs, migrates, builds and reloads PM2,
+It backs up the database, checks out the release, installs, migrates, builds (the backend too,
+since 1.51.0) and reloads PM2,
 and goes back to the previous version if anything fails first. `backend/.env`,
 `frontend/.env.production`, `ecosystem.config.js` and the nginx/frpc configs are not in git, so
 updates keep your changes from this guide.

FEATURES.md

@@ -415,6 +415,12 @@ logout controls. Disconnected sessions are recovered automatically.
 
 ## Supervisor tools
 
+- **Choosing an event** (staff and supervisor pages: scanner, event tickets, at the door, payments,
+  manual registration, email and WhatsApp, forms, attendance, consent, waitlist, allocations,
+  bundles, offline scans, kids and volunteer set-up, manage registrations, kiosk): a searchable
+  picker instead of a long dropdown. It opens on upcoming events, soonest first; **Show past
+  events** lists past ones (latest first), and typing searches every event by name, campus or date.
+  Arrow keys, Enter and Escape work. `components/shared/EventPicker.tsx`.
 - **Dashboard** — **Today** (each event or session on today: checked in so far
   against places, children in now, volunteers here; money in today and this
   week) and **Waiting for you** (unpaid registrations for the next two weeks,
@@ -489,7 +495,8 @@ logout controls. Disconnected sessions are recovered automatically.
 - **Audit log** (`/dashboard/admin/audit-log`) — who did what and when for
   refunds, donation assign/unassign, manual registrations, staff
   cancellations, event create/update/delete, settings changes, and coupon codes
-  (created, edited, turned off, applied or removed by staff).
+  (created, edited, turned off, applied or removed by staff), and every later feature's admin
+  actions. Search by person, target or IP; filter by action, role and dates; 50 a page.
 - **Site settings** — see below.
 
 ---
@@ -515,7 +522,7 @@ logout controls. Disconnected sessions are recovered automatically.
 
 ## Reports
 
-A full-width workspace with shared filters (events, date range with presets,
+A full-width workspace with shared filters (events, searchable, with "Select these N" for the matches; date range with presets,
 include past/inactive/closed) and a searchable grid of reports, each opening in
 a viewer with its own filters, stat tiles and bar charts.
 
@@ -774,7 +781,7 @@ contact page shows the Information Officer.
   and the people affected were told, and drafts of both notifications.
 - **Readiness** — a scored checklist of what's set up, each item linking to its fix.
 
-**For admins** — **Data requests** (`/dashboard/admin/data-requests`): correction and
+**For admins** — **Data requests** (`/dashboard/admin/data-requests`, searchable, closed ones paged): correction and
 deletion requests with a 30-day due date, emailed to the Information Officer and
 admins, reminded daily when due within a week. Completing a deletion anonymises the
 person: name, contact details, the people they registered, form answers, consent
@@ -816,11 +823,15 @@ Site settings → **Webhooks** (admins): send what happens to other systems as i
   check-in with session, person, event); headers `X-CrossEvents-Event`, `X-CrossEvents-Delivery` and
   `X-CrossEvents-Signature: t=<unix>,v1=<hex HMAC-SHA256 of "<t>.<body>">` with the endpoint's secret.
 - **Delivery log** per endpoint (30 days): status, tries, response code or error, the full message,
-  **Resend**. Retries after 1 min, 5 min, 30 min, 2 h, 12 h, then failed.
+  **Resend**; filter by status and **Load older**. Retries after 1 min, 5 min, 30 min, 2 h, 12 h, then failed.
 - Every path that registers, pays, cancels, refunds or checks in is covered (Prisma client
   extension); rolled-back changes send nothing. Kids check-in and volunteer tickets are never sent.
 - https and public addresses only (DNS checked at each send, redirects not followed). Each endpoint
   is added to the operator register; deliveries are deleted after 30 days and with an account.
+- **How webhooks work** (1.50.2), a guide on the tab (open until the first webhook is added): the
+  envelope and headers, retries and duplicates, checking the signature (Node.js and PHP examples),
+  Zapier/Make set-up, and a copyable example message for every event type. The examples come from
+  `EVENT_TYPES[].example` in `utils/webhooks.js`; a test keeps them the same shape as what is sent.
 
 ## Background jobs
 
@@ -878,7 +889,12 @@ can't start, the same jobs run on in-process timers.
 - **Sentry** error monitoring when `SENTRY_DSN` / `NEXT_PUBLIC_SENTRY_DSN` are
   set.
 - Unhandled promise rejections are logged and don't crash the server.
-- Backend status page (`/`) and built-in API docs page (`/docs`).
+- Backend status page (`/`) and built-in API docs page (`/docs`); **API v2** (`/api/v2`, 1.51.0)
+  with one error shape, paged lists and an OpenAPI 3.1 reference at `/docs/v2` (admins). Public
+  events, my account and registrations, registering, cancelling and paying online (1.51.1); the
+  frontend's v2 calls are typed from the OpenAPI document.
+- **TypeScript backend** (1.51.0): `.ts` files are checked strictly, `.js` compiles as it is;
+  deploys build `dist/`, which `src/index.js` runs.
 - **Tests** — Jest unit tests in `backend/tests` (`npm test`), and Playwright
   end-to-end tests in `e2e/` (`npm run test:e2e`) that start their own backend and
   frontend against a separate, freshly seeded database: public pages, free and paid

WHATS-NEW.md

@@ -12,6 +12,36 @@ Write for church admins, not developers: no environment variables, endpoints or
 developer log is CHANGELOG.md. A tagged version without a section here shows "No details given".
 -->
 
+## 1.51.1
+
+- **More groundwork for 2.0.** Registering, paying online and cancelling now run on the new
+  version of the server's connection to the app. They work just as before.
+
+## 1.51.0
+
+- **Groundwork for Cross Events 2.0.** Behind the scenes, the server is moving to a newer, safer
+  way of talking to the app, ready for the AI helpers in 2.0. Nothing changes in how you use
+  Cross Events.
+
+## 1.50.2
+
+- **Finding an event quickly.** Wherever staff and supervisors choose an event (the scanner, at
+  the door, payments, messages, forms, attendance and more) there is now a search box. The list
+  opens on upcoming events, past ones are one click away, and typing finds any event by name,
+  campus or date. The events list in Reports can be searched too.
+- **Webhook guide.** Site settings → Webhooks has a "How webhooks work" guide for whoever connects
+  another system: what is sent and when, how to check it came from you, and an example message for
+  every kind of event.
+
+## 1.50.1
+
+- **Finding things in long lists.** The audit log can be searched by person, what was changed or
+  IP address, filtered by role, and its action list now includes every kind of action. Data
+  requests can be searched and come a page at a time, and the webhook delivery log can show only
+  failed deliveries and load older ones.
+- **Fix:** the audit log's "To" date now includes that day.
+- **Faster Payments page** for churches with a few years of payments behind them.
+
 ## 1.50.0
 
 - **Easier for everyone to use.** The public pages, registration, payment, My Events and the

backend/API_DOCUMENTATION.md

@@ -2,6 +2,13 @@
 
 Full interactive docs (with request/response examples) are available at `GET /docs?token=<admin-jwt>` on the running backend.
 
+> **API v2 (1.51.0 on):** `/api/v2` is described by OpenAPI 3.1. The reference is at `/docs/v2`
+> (admin token), the document at `GET /api/v2/openapi.json` (admin). It is generated from the route
+> declarations, so it is not repeated here. v2 responses are `{ data }` (lists add
+> `meta: { page, limit, total, pages }`, `?page=&limit=` up to 100) and errors
+> `{ error: { code, message, fields? } }`. This file documents v1 (`/api/…`), which stays until 2.0. The frontend calls v2 through the typed
+> `apiV2()` helper (`frontend/src/lib/apiV2.ts`, types regenerated with `npm run api:types`).
+
 All authenticated requests require:
 ```
 Authorization: Bearer <jwt>
@@ -243,7 +250,7 @@ Accepted file types: `.pdf`, `.doc`, `.docx`, `.xls`, `.xlsx`, `.ppt`, `.pptx`,
 | PUT | `/api/registrations/:id/forms/draft` | optional | Save form draft |
 | POST | `/api/registrations/:id/forms/responses` | optional | Submit form responses |
 | PUT | `/api/registrations/:id/forms/responses` | supervisor+ | Replace form responses |
-| GET | `/api/registrations` | staff+ | All registrations |
+| GET | `/api/registrations?page=&limit=&unpaid=1&userId=` | staff+ | All registrations (a plain array; paged `{ data, total, page, limit, pages }` when `page` or `limit` is given). `unpaid=1`: still owing (pending, confirmed, partially paid); `userId`: one person's |
 | PUT | `/api/registrations/:id` | staff+ | Update registration status |
 | GET | `/api/registrations/event/:eventId` | staff+ | Registrations for an event |
 | POST | `/api/registrations/manual` | supervisor+ | Manual registration (accepts `couponCode`) |
@@ -570,7 +577,7 @@ The data subject's tools, unsubscribe links and the admin data-requests inbox (`
 | GET | `/api/privacy/unsubscribe/:token` | public (signed token) | What the link is for: an account (masked email, news state) or an address |
 | POST | `/api/privacy/unsubscribe/:token` | public (signed token) | `{ channels?: ["email","whatsapp"] }` — turn news off (default both) |
 | POST | `/api/privacy/unsubscribe/:token/one-click` | public (signed token) | RFC 8058 one-click (from the `List-Unsubscribe` header) — email news off. GET redirects to `/unsubscribe` |
-| GET | `/api/privacy/requests?status=open\|closed\|all` | admin | Data requests (not self-service downloads), with `overdue` and, for open deletions, `blockers` (registrations for events that haven't ended) |
+| GET | `/api/privacy/requests?status=open\|closed\|all&search=&page=&limit=` | admin | Data requests (not self-service downloads), 50 a page (`total`, `pages`), with `overdue` and, for open deletions, `blockers` (registrations for events that haven't ended). `search` matches name or email |
 | POST | `/api/privacy/requests/:id/complete` | admin | `{ response? }` (required for corrections; emailed). Deletion: anonymises the account — 409 while it has blockers. Audited as `data_request_completed` (+ `user_anonymised`) |
 | POST | `/api/privacy/requests/:id/reject` | admin | `{ response, cancelled?: bool }` — reject (or mark withdrawn); a deletion reopens the account. Audited as `data_request_rejected` |
 
@@ -643,7 +650,7 @@ Options and variants also accept an optional `staffPrice`, charged automatically
 | GET | `/api/payments/mypayments` | user+ | Own payments |
 | GET | `/api/payments/:id` | user+ | Payment by ID |
 | GET | `/api/payments/registration/:registrationId` | user+ | Payments for a registration |
-| GET | `/api/payments` | supervisor+ | All payments |
+| GET | `/api/payments?page=&limit=&userId=&from=&donations=1` | supervisor+ | Payments, newest first, paged (`limit` up to 200). `userId`: one person's; `from`: created on/after (ISO); `donations=1`: donations and the legs applying them |
 | GET | `/api/payments/event/:eventId` | staff+ | Payments for an event |
 | PUT | `/api/payments/assign-donation` | supervisor+ | Assign a donation payment to a registration |
 | POST | `/api/payments/refund` | supervisor+ | Create refund record |
@@ -999,13 +1006,13 @@ where v1 = HMAC-SHA256(secret, `<t>.<raw body>`). Answer 2xx within 10 s; anythi
 
 | Method | Path | Description |
 |--------|------|-------------|
-| GET | `/api/outbound-webhooks` | Endpoints with last-week counts, and the event types |
+| GET | `/api/outbound-webhooks` | Endpoints with last-week counts, and the event types (each with an `example` of its `data`) |
 | POST | `/api/outbound-webhooks` | `{ name, url, events }` → endpoint plus `secret` (only here) |
 | PUT | `/api/outbound-webhooks/:id` | `{ name?, url?, events?, isActive? }` |
 | DELETE | `/api/outbound-webhooks/:id` | Endpoint and its deliveries |
 | POST | `/api/outbound-webhooks/:id/rotate-secret` | `{ secret }` |
 | POST | `/api/outbound-webhooks/:id/test` | `{ status, statusCode, error }` |
-| GET | `/api/outbound-webhooks/:id/deliveries?status=&limit=` | Delivery log |
+| GET | `/api/outbound-webhooks/:id/deliveries?status=&limit=&before=` | Delivery log, newest first; `before` (a `createdAt`) loads older ones |
 | POST | `/api/outbound-webhooks/deliveries/:id/resend` | Send again now |
 
 ## Season passes

backend/README.md

@@ -152,14 +152,22 @@ npm run prisma:generate
 ## Running the Server
 
 ```bash
-# Development (auto-reload)
+# Development (auto-reload; runs the TypeScript in src/ through tsx)
 npm run dev
 
-# Production
+# Production: build once per update, then start (src/index.js runs the build in dist/)
+npm run build
 npm start
+
+# Type-check only
+npm run typecheck
 ```
 
-Visit `/` for the status page. Visit `/docs?token=<admin-jwt>` for full API documentation (admin only).
+Since 1.51.0 the backend is partly TypeScript (`allowJs`: `.js` compiles as it is, `.ts` is checked
+strictly). `src/index.js` is a small launcher: with plain Node it runs `dist/` when `dist/build.json`
+matches this version, otherwise it compiles on the fly with tsx. The server itself is `src/app.js`.
+
+Visit `/` for the status page. Visit `/docs?token=<admin-jwt>` for the v1 API documentation and `/docs/v2` for the v2 (OpenAPI) reference — both admin only.
 
 ---
 
@@ -532,6 +540,7 @@ Setup: Admin → Site Settings → **Yoco**. Paste the secret key (checked with
 ### PM2 (recommended)
 ```bash
 npm install -g pm2
+npm run build
 pm2 start src/index.js --name hope-events-api
 pm2 save && pm2 startup
 ```

backend/jest.config.js

@@ -1,4 +1,8 @@
 module.exports = {
   testEnvironment: 'node',
-  testMatch: ['**/tests/**/*.test.js'],
+  testMatch: ['**/tests/**/*.test.js', '**/tests/**/*.test.ts'],
+  // TypeScript (src/**/*.ts and tests) runs through ts-jest; plain JS is left as it is.
+  transform: { '^.+\\.ts$': ['ts-jest', { tsconfig: 'tsconfig.json' }] },
+  moduleFileExtensions: ['ts', 'js', 'json'],
+  modulePathIgnorePatterns: ['<rootDir>/dist/'],
 };

backend/package.json

@@ -1,11 +1,11 @@
 {
   "name": "event-management-backend",
-  "version": "1.50.0",
+  "version": "1.51.1",
   "description": "Event Management System Backend",
   "main": "src/index.js",
   "scripts": {
     "start": "node src/index.js",
-    "dev": "node --watch src/index.js",
+    "dev": "tsx watch src/index.js",
     "test": "jest",
     "postinstall": "prisma generate",
     "prisma:generate": "prisma generate",
@@ -14,7 +14,10 @@
     "prisma:reset": "prisma migrate reset --force",
     "migrate:env-to-db": "node scripts/migrate-env-to-db.js",
     "migrate:env-to-db:dry": "node scripts/migrate-env-to-db.js --dry-run",
-    "set-demo": "node scripts/set-demo.js"
+    "set-demo": "node scripts/set-demo.js",
+    "build": "tsc -p tsconfig.json && node -e \"require('fs').writeFileSync('dist/build.json', JSON.stringify({ version: require('./package.json').version, builtAt: new Date().toISOString() }))\"",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "openapi": "tsx scripts/openapi.ts"
   },
   "dependencies": {
     "@prisma/adapter-pg": "^7.10.1",
@@ -37,11 +40,23 @@
     "pg-boss": "^10.4.2",
     "qrcode": "^1.5.4",
     "raw-body": "^3.0.0",
-    "uuid": "^11.1.1"
+    "swagger-ui-dist": "^5.34.0",
+    "tsx": "^4.23.15",
+    "typescript": "^5.9.3",
+    "uuid": "^11.1.1",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
+    "@types/express": "^4.17.25",
+    "@types/jest": "^30.0.0",
+    "@types/jsonwebtoken": "^9.0.10",
+    "@types/node": "^20.19.43",
+    "@types/supertest": "^7.2.1",
+    "@types/swagger-ui-dist": "^3.30.6",
     "jest": "^30.4.2",
-    "prisma": "^7.10.1"
+    "prisma": "^7.10.1",
+    "supertest": "^7.3.1",
+    "ts-jest": "^29.4.15"
   },
   "overrides": {
     "uuid": "^11.1.1",
@@ -54,6 +69,8 @@
     "prisma@7.10.1": true,
     "@prisma/engines@7.10.1": true,
     "unrs-resolver@1.12.2": true,
-    "@parcel/watcher": false
+    "@parcel/watcher": false,
+    "@scarf/scarf": false,
+    "esbuild": false
   }
 }

backend/scripts/openapi.ts

@@ -0,0 +1,22 @@
+/**
+ * Writes the /api/v2 OpenAPI document to frontend/src/lib/api-v2/openapi.json, from which the
+ * frontend's types are generated (`npm run api:types` in the repo root does both). Run it after
+ * adding or changing a v2 route; tests/v2.test.ts fails while the saved copy is out of date.
+ */
+import 'dotenv/config';
+import fs from 'fs';
+import path from 'path';
+import { buildOpenApi } from '../src/v2/openapi';
+import '../src/v2';
+
+export const OPENAPI_FILE = path.join(__dirname, '..', '..', 'frontend', 'src', 'lib', 'api-v2', 'openapi.json');
+
+// The version is left out so a release bump doesn't change the file.
+export const currentDocument = () => JSON.stringify(buildOpenApi({ version: 'v2' }), null, 2) + '\n';
+
+if (require.main === module) {
+  fs.mkdirSync(path.dirname(OPENAPI_FILE), { recursive: true });
+  fs.writeFileSync(OPENAPI_FILE, currentDocument());
+  console.log(`Wrote ${path.relative(process.cwd(), OPENAPI_FILE)}`);
+  process.exit(0);
+}

backend/src/controllers/adminAuditController.js

@@ -6,8 +6,8 @@ const { safeErrorMessage } = require('../utils/errorUtils');
 // @access Admin
 const listAuditLog = async (req, res) => {
   try {
-    const { page, limit, actorId, action, from, to } = req.query;
-    const result = await getAdminAuditLog({ page, limit, actorId, action, from, to });
+    const { page, limit, actorId, action, role, from, to, search } = req.query;
+    const result = await getAdminAuditLog({ page, limit, actorId, action, role, from, to, search });
     res.json(result);
   } catch (e) {
     res.status(500).json({ message: safeErrorMessage(e) });

backend/src/controllers/outboundWebhookController.js

@@ -154,6 +154,9 @@ const test = async (req, res) => {
 const deliveries = async (req, res) => {
   try {
     const where = { endpointId: req.params.id, ...(req.query.status ? { status: String(req.query.status) } : {}) };
+    // "Load older": the next page is everything before the last one shown.
+    const before = req.query.before ? new Date(String(req.query.before)) : null;
+    if (before && !Number.isNaN(before.getTime())) where.createdAt = { lt: before };
     const rows = await prisma.webhookDelivery.findMany({
       where, orderBy: { createdAt: 'desc' }, take: Math.min(200, parseInt(req.query.limit, 10) || 50),
       select: { id: true, eventId: true, type: true, status: true, attempts: true, nextAttemptAt: true, lastStatusCode: true, lastError: true, deliveredAt: true, createdAt: true, payload: true },

backend/src/controllers/paymentController.js

@@ -6,7 +6,6 @@ const { computeDonationRemaining } = require('../utils/donationUtils');
 const { logAdminAction } = require('../utils/adminAudit');
 const { getClientIp } = require('../utils/requestUtils');
 const payments = require('../payments');
-const { createRegistrationCheckout } = require('../payments/checkouts');
 const { emailTickets } = require('./ticketController');
 const { safeErrorMessage } = require('../utils/errorUtils');
 const { assertEventOpen, assertRegistrationEventOpen } = require('../utils/cashupUtils');
@@ -354,7 +353,15 @@ const getPayments = async (req, res) => {
     // Campus-scoped supervisors: payments for events they can see (through the payment's event or
     // its registration's), so unlinked donations aren't listed for them.
     const scopeW = require('../utils/campusScope').eventWhere(await require('../utils/campusScope').scopeFor(req));
-    const where = Object.keys(scopeW).length ? { OR: [{ event: scopeW }, { registration: { event: scopeW } }] } : {};
+    const scopeWhere = Object.keys(scopeW).length ? { OR: [{ event: scopeW }, { registration: { event: scopeW } }] } : {};
+    // Narrowing filters: ?userId= (one person's), ?from= (on or after, e.g. today's start),
+    // ?donations=1 (donations and the legs that apply them to registrations).
+    const filters = [];
+    if (req.query.userId) filters.push({ userId: String(req.query.userId) });
+    const from = req.query.from ? new Date(String(req.query.from)) : null;
+    if (from && !Number.isNaN(from.getTime())) filters.push({ createdAt: { gte: from } });
+    if (['1', 'true'].includes(String(req.query.donations || ''))) filters.push({ OR: [{ isDonation: true }, { originalPaymentId: { not: null } }] });
+    const where = filters.length ? { AND: [scopeWhere, ...filters] } : scopeWhere;
     const [payments, total] = await prisma.$transaction([
       prisma.payment.findMany({ where, include, orderBy: { createdAt: 'desc' }, skip, take: limit }),
       prisma.payment.count({ where })
@@ -933,54 +940,14 @@ const createCheckout = async (req, res) => {
       throw new Error('Either registrationId or eventId is required');
     }
 
-    // A registration's balance
+    // A registration's balance (shared with POST /api/v2/registrations/:id/checkout)
     if (registrationId) {
-      const reg = await prisma.registration.findUnique({ where: { id: registrationId }, select: { userId: true, eventId: true, event: { select: { endDate: true } } } });
-      if (!reg) { res.status(404); throw new Error('Registration not found'); }
-      if (reg.userId !== userId && req.user.role !== 'admin' && req.user.role !== 'supervisor') {
-        res.status(403); throw new Error('Not authorized to create checkout for this registration');
-      }
-      // If event is in the past, block self-service payment (mirrors the registration-edit block)
-      if (req.user.role !== 'admin' && req.user.role !== 'supervisor' && reg.event?.endDate && new Date(reg.event.endDate).getTime() < Date.now()) {
-        res.status(400); throw new Error('This event has already ended; payment can no longer be made for this registration');
-      }
-      await assertEventOpen(reg.eventId, res);
-
-      // Refresh early-bird pricing — updates priceSnapshot if any tier has expired or sold out.
-      // Must run before the balance is worked out so the checkout charges the right price.
-      const { changed: priceChanged } = await refreshPricingForRegistration(registrationId);
-      if (priceChanged) {
-        const freshReg = await prisma.registration.findUnique({
-          where: { id: registrationId },
-          include: {
-            registrationOptions: { include: { eventOption: { include: { earlyBirdTiers: true } }, tranches: true } },
-            payments: true
-          }
-        });
-        const newTotal = computeRegistrationTotalDue(freshReg, new Date());
-        const totalPaid = (freshReg.payments || []).reduce((s, p) => s + p.amount, 0);
-        return res.status(200).json({
-          priceUpdated: true,
-          newTotal: Math.max(0, newTotal - totalPaid),
-          message: 'One or more early-bird prices have changed since your registration was created. Please review the updated total before proceeding.'
-        });
-      }
-
-      // Part of the balance (supervisor payments page)
-      if (amount && !isNaN(parseFloat(amount))) {
-        const result = await createRegistrationCheckout(registrationId, userId, { successUrl, cancelUrl, failureUrl, amount: parseFloat(amount), provider });
-        return res.status(200).json(result);
-      }
-
-      // Optional donation added at registration ("Donation amount" on the register form)
-      let donation = 0;
-      if (donationAmount !== undefined && donationAmount !== null && donationAmount !== '') {
-        donation = Math.round(parseFloat(donationAmount) * 100) / 100;
-        if (!(donation >= 0) || donation > 100000) { res.status(400); throw new Error('Invalid donation amount'); }
-        if (donation > 0 && donation < payments.MIN_ONLINE_AMOUNT) { res.status(400); throw new Error(`Minimum donation is R${payments.MIN_ONLINE_AMOUNT}`); }
-      }
-
-      const result = await createRegistrationCheckout(registrationId, userId, { successUrl, cancelUrl, failureUrl, donationAmount: donation, provider });
+      const { startRegistrationCheckout } = require('../services/payments');
+      const result = await startRegistrationCheckout(registrationId, req.user, {
+        amount: amount && !isNaN(parseFloat(amount)) ? parseFloat(amount) : null,
+        donationAmount: donationAmount === undefined || donationAmount === null || donationAmount === '' ? null : parseFloat(donationAmount),
+        successUrl, cancelUrl, failureUrl, provider,
+      });
       return res.status(200).json(result);
     }
 

backend/src/controllers/privacyController.js

@@ -227,12 +227,18 @@ const listRequests = async (req, res) => {
     const where = { selfService: false };
     if (status === 'open') where.status = 'open';
     else if (status === 'closed') where.status = { not: 'open' };
-    const rows = await prisma.dataRequest.findMany({
+    const q = String(req.query.search || '').trim().slice(0, 100);
+    if (q) where.OR = [{ name: { contains: q, mode: 'insensitive' } }, { email: { contains: q, mode: 'insensitive' } }];
+    // Closed requests pile up over the years, so they come a page at a time (newest first).
+    const limit = Math.min(200, Math.max(1, parseInt(req.query.limit, 10) || 50));
+    const page = Math.max(1, parseInt(req.query.page, 10) || 1);
+    const [rows, total] = await Promise.all([prisma.dataRequest.findMany({
       where,
       orderBy: status === 'open' ? { dueAt: 'asc' } : { createdAt: 'desc' },
-      take: 200,
+      take: limit,
+      skip: (page - 1) * limit,
       include: { handledBy: { select: { name: true } }, user: { select: { isActive: true, phoneNumber: true } } },
-    });
+    }), prisma.dataRequest.count({ where })]);
     const requests = await Promise.all(rows.map(async r => ({
       id: r.id, type: r.type, status: r.status, name: r.name, email: r.email, details: r.details, response: r.response,
       dueAt: r.dueAt, closedAt: r.closedAt, createdAt: r.createdAt, userId: r.userId,
@@ -240,8 +246,8 @@ const listRequests = async (req, res) => {
       overdue: r.status === 'open' && r.dueAt < new Date(),
       blockers: r.type === 'deletion' && r.status === 'open' && r.userId ? await privacy.deletionBlockers(r.userId) : [],
     })));
-    const openCount = status === 'open' ? requests.length : await prisma.dataRequest.count({ where: { selfService: false, status: 'open' } });
-    res.json({ requests, openCount });
+    const openCount = status === 'open' && !q ? total : await prisma.dataRequest.count({ where: { selfService: false, status: 'open' } });
+    res.json({ requests, openCount, total, page, limit, pages: Math.max(1, Math.ceil(total / limit)) });
   } catch (error) {
     fail(res, error);
   }

backend/src/controllers/registrationController.js

@@ -3,534 +3,33 @@ const { v4: uuidv4 } = require('uuid');
 const { generateTicketsForRegistration } = require('../utils/ticketUtils');
 const { emailTickets } = require('./ticketController');
 const { hashPassword } = require('../config/auth');
-const { resolveOptionPrice, resolveVariantTierPrice, computeRegistrationTotalDue, refreshPricingForRegistration, attachComputedTotals, attachComputedTotalsToList } = require('../utils/pricing');
+const { computeRegistrationTotalDue, refreshPricingForRegistration, attachComputedTotals, attachComputedTotalsToList } = require('../utils/pricing');
 const { assertEventOpen } = require('../utils/cashupUtils');
 const { logAdminAction } = require('../utils/adminAudit');
 const { getClientIp } = require('../utils/requestUtils');
-const { buildCouponLines, previewCoupon, applyCouponToRegistration, recalculateRegistrationDiscount, releaseRegistrationCoupons, describeCoupon } = require('../utils/coupons');
-const { lineKey, validateAttendees, createAttendees, namedPlacesByKey } = require('../utils/attendees');
+const { previewCoupon, applyCouponToRegistration, recalculateRegistrationDiscount, releaseRegistrationCoupons, describeCoupon } = require('../utils/coupons');
+const { validateAttendees, createAttendees, namedPlacesByKey } = require('../utils/attendees');
 const { findAccountByContact } = require('../utils/accountMatch');
-const { ensureConsentRequests } = require('../utils/consent');
-const { takenCount } = require('../utils/stock');
-const { findOfferByToken, queueWaitlist } = require('../utils/waitlist');
+const { queueWaitlist } = require('../utils/waitlist');
 const { reservedOptionIds } = require('../utils/volunteers');
 
-// Youth events: send parental consent requests for any new under-18 attendees. Runs in
-// the background so a slow mail/WhatsApp send never holds up the registration.
-function queueConsentRequests(registrationId) {
-  ensureConsentRequests(registrationId).catch(e => console.error('[consent] Failed to send requests:', e?.message || e));
-}
-
-// Named attendees for API responses, with whether their ticket has been issued/used.
-const ATTENDEES_INCLUDE = {
-  orderBy: { order: 'asc' },
-  include: {
-    ticket: { select: { id: true, isUsed: true } },
-    // Latest consent request (youth events) — it decides check-in.
-    consentRequests: { orderBy: { createdAt: 'desc' }, take: 1, select: { id: true, status: true, respondedAt: true, lastSentAt: true, textVersion: true } },
-  },
-};
-
-const TICKET_DELIVERY = ['payer', 'each'];
-
-/**
- * Places each line will have once `requested` is added to `existingLines` — used to
- * check attendee names against what's actually being bought.
- */
-function placesAfter(existingLines, requested) {
-  const out = {};
-  // Picked-session lines take no attendee names.
-  for (const l of [...(existingLines || []), ...(requested || [])].filter(x => !x.sessionId)) {
-    const k = lineKey(l.eventOptionId, l.variantId);
-    out[k] = (out[k] || 0) + Number(l.quantity || 0);
-  }
-  return out;
-}
-
-// Active coupon on a registration, for API responses (the discount itself is
-// Registration.discountTotal).
-const ACTIVE_COUPONS_INCLUDE = {
-  where: { releasedAt: null },
-  select: { id: true, discountAmount: true, createdAt: true, coupon: { select: { id: true, code: true, type: true, value: true, description: true } } },
-};
+// Shared with POST /api/v2/registrations: the registration service (TypeScript, 1.51.1).
+const registrationService = require('../services/registrations');
+const {
+  queueConsentRequests, ATTENDEES_INCLUDE, TICKET_DELIVERY, placesAfter, ACTIVE_COUPONS_INCLUDE,
+  pendingCouponLines, priceRequestedOption, checkOptionStock, checkVariantStock, isStaffRole,
+} = registrationService;
 const { BUNDLE_APPS_INCLUDE } = require('../utils/bundles');
-const { registrationClosesAt, wholeCourseClosesAt, expandPickLines, assertSessionCapacity, isPickOption, mergeSessionIds } = require('../utils/sessions');
-
-/**
- * Coupon lines for options that haven't been saved yet, so a code can be checked
- * before anything is created. Mirrors buildCouponLines for one tranche per option.
- */
-function pendingCouponLines(event, resolvedOptions) {
-  return buildCouponLines({
-    registrationOptions: resolvedOptions.map(o => ({
-      eventOptionId: o.eventOptionId,
-      variantId: o.variantId || null,
-      quantity: o.quantity,
-      eventOption: event.eventOptions.find(eo => eo.id === o.eventOptionId),
-      tranches: [{ quantity: o.quantity, priceSnapshot: o.priceSnapshot, appliedTierId: o.appliedTierId }],
-    })),
-  });
-}
-
-/**
- * Price one requested option for this buyer: early-bird tiers, then variant/option price,
- * then the staff price for Staff and above. Returns { priceSnapshot, appliedTierId }.
- */
-async function priceRequestedOption(eventOption, variantId, qty, buyer) {
-  try {
-    const resolved = variantId
-      ? await resolveVariantTierPrice(eventOption, variantId, qty, buyer)
-      : await resolveOptionPrice(eventOption, qty, buyer);
-    return { priceSnapshot: resolved.price, appliedTierId: resolved.tierId };
-  } catch (e) {
-    const variant = variantId ? (eventOption.variants || []).find(v => v.id === variantId) : null;
-    const price = variant && variant.price !== null && variant.price !== undefined ? variant.price : eventOption.price;
-    return { priceSnapshot: Number(price || 0), appliedTierId: null };
-  }
-}
-
-/**
- * Check overall stock availability for an EventOption. Places held for live waitlist
- * offers count as taken, except the offer being claimed (`excludeEntryId`).
- * Returns { available: boolean, remaining: number|null }
- */
-async function checkOptionStock(option, requestedQty, excludeEntryId = null, sessionId = null) {
-  if (!option.stockLimit || option.stockLimit === 0) return { available: true, remaining: null };
-  const remaining = option.stockLimit - await takenCount({ eventOptionId: option.id, sessionId }, { excludeEntryId });
-  return { available: remaining >= requestedQty, remaining };
-}
-
-/**
- * Check stock availability for a specific variant (same rules as checkOptionStock).
- */
-async function checkVariantStock(variant, requestedQty, excludeEntryId = null, sessionId = null) {
-  if (!variant.stockLimit || variant.stockLimit === 0) return { available: true, remaining: null };
-  const remaining = variant.stockLimit - await takenCount({ eventOptionId: variant.eventOptionId, variantId: variant.id, sessionId }, { excludeEntryId });
-  return { available: remaining >= requestedQty, remaining };
-}
+const { expandPickLines, assertSessionCapacity, isPickOption, mergeSessionIds } = require('../utils/sessions');
 
 // @desc    Create a new registration
 // @route   POST /api/registrations
 // @access  Private
 const createRegistration = async (req, res) => {
   try {
-    const { eventId, options, guestName, guestEmail, guestPhone, couponCode, attendees, ticketDelivery, waitlistToken, analyticsSessionId } = req.body;
-
-    // Check if event exists
-    const canIncludeVariants = !!(prisma && prisma.optionVariant && typeof prisma.optionVariant.findMany === 'function');
-    const canIncludeTiers = !!(prisma && prisma.earlyBirdTier && typeof prisma.earlyBirdTier.findMany === 'function');
-    const optionInclude = canIncludeTiers
-      ? { earlyBirdTiers: true, ...(canIncludeVariants ? { variants: true } : {}) }
-      : true;
-    const event = await prisma.event.findUnique({
-      where: { id: eventId },
-      include: { eventOptions: optionInclude ? { include: optionInclude } : true, sessions: true }
-    });
-
-    if (!event) {
-      res.status(404);
-      throw new Error('Event not found');
-    }
-
-    if (!event.isActive) {
-      res.status(400);
-      throw new Error('Event is not active');
-    }
-
-    if (event.cashupStatus === 'closed') {
-      res.status(400);
-      throw new Error('This event is closed and no longer accepting registrations.');
-    }
-
-    // A waitlist claim link: its token identifies the person and releases the places
-    // held for them. It works without logging in, the same way a consent link does.
-    let waitlistOffer = null;
-    if (waitlistToken) {
-      waitlistOffer = await findOfferByToken(waitlistToken);
-      if (!waitlistOffer || waitlistOffer.eventId !== eventId) { res.status(400); throw new Error('This waitlist link is not valid.'); }
-      if (waitlistOffer.status !== 'offered') { res.status(400); throw new Error(`This waitlist offer has ${waitlistOffer.status === 'claimed' ? 'already been used' : 'expired'}.`); }
-      if (new Date(waitlistOffer.offerExpiresAt) < new Date()) { res.status(400); throw new Error('This waitlist offer has expired.'); }
-      if (req.user && req.user.id !== waitlistOffer.userId) { res.status(403); throw new Error('This waitlist offer belongs to someone else.'); }
-    }
-
-    // Enforce auth unless event explicitly opts out
-    const eventRequiresAuth = event.requiresAuth !== false;
-    if (eventRequiresAuth && !req.user && !waitlistOffer) {
-      res.status(401);
-      throw new Error('Authentication required for this event');
-    }
-
-    // Unauthenticated guest registration is only permitted for free events
-    if (!req.user && !waitlistOffer) {
-      const totalDueCheck = (event.eventOptions || []).reduce((sum, eo) => sum + (eo.price || 0), 0);
-      // Also check against the requested options specifically
-      const requestedTotal = (options || []).reduce((sum, opt) => {
-        const eo = event.eventOptions.find(o => o.id === opt.eventOptionId);
-        return sum + ((eo?.price || 0) * (opt.quantity || 1));
-      }, 0);
-      if (requestedTotal > 0) {
-        res.status(400);
-        throw new Error('Guest registration is only available for free events. Please create an account to pay for tickets.');
-      }
-    }
-
-    // Resolve userId — authenticated or guest
-    let userId;
-    if (req.user) {
-      userId = req.user.id;
-    } else if (waitlistOffer) {
-      userId = waitlistOffer.userId;
-    } else {
-      // Guest registration: find existing user by email or create inactive placeholder
-      if (!guestEmail || !guestName) {
-        res.status(400);
-        throw new Error('Name and email are required for unauthenticated registration');
-      }
-      const match = await findAccountByContact({ email: guestEmail, phone: guestPhone });
-      if (match.conflict) {
-        res.status(409);
-        throw new Error('This email and phone number belong to two different accounts. Please log in, or check your details.');
-      }
-      const existingGuest = match.user;
-      if (existingGuest) {
-        userId = existingGuest.id;
-      } else {
-        const newGuest = await prisma.user.create({
-          data: {
-            id: uuidv4(),
-            name: guestName,
-            email: guestEmail,
-            password: '',
-            phoneNumber: guestPhone || null,
-            isActive: false,
-            updatedAt: new Date(),
-          }
-        });
-        userId = newGuest.id;
-      }
-    }
-
-    // Enforce registration cutoff for public registrations (multi-day events close when
-    // the first session starts, or later with late joining — see utils/sessions.js).
-    const now = new Date();
-    if (now >= registrationClosesAt(event, event.sessions)) {
-      res.status(400);
-      throw new Error('Registration is closed for this event');
-    }
-
-    // Validate options
-    if (!options || !Array.isArray(options) || options.length === 0) {
-      res.status(400);
-      throw new Error('At least one option must be selected');
-    }
-
-    // "Pick sessions" options become one line per chosen session; whole-course tickets
-    // on such an event still close when the whole course does.
-    const lines = expandPickLines(event, options, { now });
-    // (An all-sessions ticket with sessions ticked is checked per session instead.)
-    if (event.attendanceMode === 'pick' && lines.some(l => !l.sessionId && !l.sessionIds?.length) && now >= wholeCourseClosesAt(event, event.sessions)) {
-      res.status(400);
-      throw new Error('Whole-course tickets are no longer on sale — choose the sessions you want instead.');
-    }
-    await assertSessionCapacity(event, lines, undefined, { excludeEntryId: waitlistOffer?.id });
-
-    // Validate each option and resolve prices / check stock.
-    // Options are independent of each other, so resolve them concurrently. Errors are marked
-    // with `.isStockError` rather than relying on shared `res.statusCode` (which would race
-    // across concurrent iterations) — the outer catch always responds 400 regardless.
-    // The kids check-in and volunteer tickets are handed out by staff, never sold.
-    const reserved = new Set(isStaffRole(req.user?.role) ? [] : reservedOptionIds(event));
-    const resolvedOptions = await Promise.all(lines.map(async (option) => {
-      const eventOption = event.eventOptions.find(eo => eo.id === option.eventOptionId);
-      if (!eventOption || reserved.has(eventOption.id)) {
-        throw new Error(`Option with ID ${option.eventOptionId} not found for this event`);
-      }
-      if (!option.quantity || option.quantity < 1) {
-        throw new Error('Quantity must be at least 1');
-      }
-
-      const qty = option.quantity;
-
-      // Check overall option stock
-      try {
-        const stockCheck = await checkOptionStock(eventOption, qty, waitlistOffer?.id, option.sessionId);
-        if (!stockCheck.available) {
-          const err = new Error(`"${eventOption.name}" is sold out or does not have enough stock (${stockCheck.remaining ?? 0} remaining).`);
-          err.isStockError = true;
-          throw err;
-        }
-      } catch (e) {
-        if (e.isStockError) throw e; // propagate stock errors
-        // If stock check function fails (pre-migration), continue without stock check
-      }
-
-      // Check variant stock (if a variant is selected)
-      let variantId = option.variantId || null;
-      let variantPrice = null;
-      if (variantId && canIncludeVariants) {
-        const variant = (eventOption.variants || []).find(v => v.id === variantId);
-        if (!variant) {
-          throw new Error(`Variant not found for option "${eventOption.name}"`);
-        }
-        try {
-          const vStock = await checkVariantStock(variant, qty, waitlistOffer?.id, option.sessionId);
-          if (!vStock.available) {
-            const err = new Error(`Variant "${variant.name}" is sold out (${vStock.remaining ?? 0} remaining).`);
-            err.isStockError = true;
-            throw err;
-          }
-        } catch (e) {
-          if (e.isStockError) throw e;
-        }
-        variantPrice = variant.price; // null = use option price
-      }
-
-      // Resolve price: variant-level tiers take priority, then option-level tiers, then
-      // base prices, then the staff price for Staff and above.
-      let priceSnapshot = null;
-      let appliedTierId = null;
-      if (canIncludeTiers) {
-        const buyer = req.user || (waitlistOffer ? await prisma.user.findUnique({ where: { id: waitlistOffer.userId }, select: { id: true, role: true } }) : null);
-        ({ priceSnapshot, appliedTierId } = await priceRequestedOption(eventOption, variantId, qty, buyer));
-      } else {
-        priceSnapshot = variantPrice !== null && variantPrice !== undefined ? variantPrice : null;
-      }
-      if (priceSnapshot === null) priceSnapshot = eventOption.price;
-
-      return { ...option, variantId, appliedTierId, priceSnapshot };
-    }));
-
-    // Check a coupon code before anything is saved, so a bad code doesn't leave a
-    // half-made registration behind. It's applied (and re-checked under a lock) below.
-    if (couponCode) {
-      const buyer = req.user ? { id: req.user.id, role: req.user.role, email: req.user.email } : null;
-      await previewCoupon({ code: couponCode, eventId, user: buyer, lines: pendingCouponLines(event, resolvedOptions) });
-    }
-
-    // Check for existing non-cancelled registration for this user+event → merge instead
-    const existingReg = await prisma.registration.findFirst({
-      where: { userId, eventId, status: { not: 'cancelled' } },
-      include: { registrationOptions: true }
-    });
-
-    // Attendee names are checked against the places the registration will have after
-    // this purchase, counting names already given on an existing registration.
-    const cleanAttendees = validateAttendees(
-      event,
-      placesAfter(existingReg?.registrationOptions, resolvedOptions),
-      attendees,
-      existingReg ? await namedPlacesByKey(existingReg.id) : {}
-    );
-    if (ticketDelivery !== undefined && !TICKET_DELIVERY.includes(ticketDelivery)) {
-      res.status(400);
-      throw new Error("ticketDelivery must be 'payer' or 'each'");
-    }
-
-    let registration;
-    let isNewRegistration = false;
-    if (existingReg) {
-      // Merge: add a new price tranche per requested option into the existing registration.
-      // Never overwrite an existing row's priceSnapshot/quantity in place — that would blend
-      // tickets bought at different early-bird prices into a single (wrong) price. Each
-      // purchase gets its own tranche; the RegistrationOption row stays a maintained aggregate.
-      for (const opt of resolvedOptions) {
-        // Match on eventOptionId + variantId (+ session, for picked sessions) for correct row
-        const existing = existingReg.registrationOptions.find(
-          ro => ro.eventOptionId === opt.eventOptionId && (ro.variantId || null) === (opt.variantId || null) && (ro.sessionId || null) === (opt.sessionId || null)
-        );
-        if (existing) {
-          await prisma.$transaction([
-            prisma.registrationOptionTranche.create({
-              data: {
-                id: uuidv4(),
-                registrationOptionId: existing.id,
-                quantity: opt.quantity,
-                priceSnapshot: opt.priceSnapshot,
-                appliedTierId: opt.appliedTierId || null,
-              }
-            }),
-            prisma.registrationOption.update({
-              where: { id: existing.id },
-              data: { quantity: existing.quantity + opt.quantity, priceSnapshot: opt.priceSnapshot, appliedTierId: opt.appliedTierId || null, ...(existing.sessionId ? {} : { sessionIds: mergeSessionIds(existing.sessionIds, opt.sessionIds) }) }
-            })
-          ]);
-        } else {
-          await prisma.registrationOption.create({
-            data: {
-              id: uuidv4(),
-              registrationId: existingReg.id,
-              eventOptionId: opt.eventOptionId,
-              quantity: opt.quantity,
-              variantId: opt.variantId || null,
-              sessionId: opt.sessionId || null,
-              sessionIds: opt.sessionIds || [],
-              appliedTierId: opt.appliedTierId || null,
-              priceSnapshot: opt.priceSnapshot,
-              tranches: {
-                create: [{
-                  id: uuidv4(),
-                  quantity: opt.quantity,
-                  priceSnapshot: opt.priceSnapshot,
-                  appliedTierId: opt.appliedTierId || null,
-                }]
-              }
-            }
-          });
-        }
-      }
-      // Only downgrade from paid if the newly added items actually cost something
-      const newItemsCost = resolvedOptions.reduce((sum, opt) => {
-        return sum + ((opt.priceSnapshot || 0) * (opt.quantity || 0));
-      }, 0);
-      if (existingReg.status === 'paid' && newItemsCost > 0) {
-        await prisma.registration.update({ where: { id: existingReg.id }, data: { status: 'partial_paid', updatedAt: new Date() } });
-      } else {
-        await prisma.registration.update({ where: { id: existingReg.id }, data: { updatedAt: new Date() } });
-      }
-      registration = await prisma.registration.findUnique({
-        where: { id: existingReg.id },
-        include: {
-          registrationOptions: { include: { eventOption: true, tranches: true } },
-          event: true,
-          user: { select: { id: true, name: true, email: true, phoneNumber: true } }
-        }
-      });
-    } else {
-      isNewRegistration = true;
-      // Create new registration
-      const registrationId = uuidv4();
-      registration = await prisma.registration.create({
-        data: {
-          id: registrationId,
-          userId,
-          eventId,
-          updatedAt: new Date(),
-          registrationOptions: {
-            create: resolvedOptions.map(option => ({
-              id: uuidv4(),
-              eventOptionId: option.eventOptionId,
-              quantity: option.quantity,
-              variantId: option.variantId || null,
-              sessionId: option.sessionId || null,
-              sessionIds: option.sessionIds || [],
-              appliedTierId: option.appliedTierId || null,
-              priceSnapshot: option.priceSnapshot,
-              tranches: {
-                create: [{
-                  id: uuidv4(),
-                  quantity: option.quantity,
-                  priceSnapshot: option.priceSnapshot,
-                  appliedTierId: option.appliedTierId || null,
-                }]
-              }
-            }))
-          }
-        },
-        include: {
-          registrationOptions: { include: { eventOption: true, tranches: true } },
-          event: true,
-          user: { select: { id: true, name: true, email: true, phoneNumber: true } }
-        }
-      });
-    }
-
-    if (cleanAttendees.length > 0) {
-      await createAttendees(registration.id, cleanAttendees);
-      queueConsentRequests(registration.id);
-    }
-    if (waitlistOffer) {
-      await prisma.waitlistEntry.update({
-        where: { id: waitlistOffer.id },
-        data: { status: 'claimed', claimedAt: new Date(), registrationId: registration.id, offerTokenHash: null },
-      });
-    }
-    if (ticketDelivery) {
-      await prisma.registration.update({ where: { id: registration.id }, data: { ticketDelivery } });
-    }
-
-    // Bundle deals, then the coupon (or re-work an existing one over the merged items).
-    let couponError = null;
-    const hasDiscount = (await recalculateRegistrationDiscount(registration.id)) > 0;
-    if (couponCode) {
-      try {
-        await applyCouponToRegistration({ registrationId: registration.id, code: couponCode });
-      } catch (e) {
-        // Lost a race for the last use since the check above — keep the registration.
-        if (!e.isCouponError) throw e;
-        couponError = e.message;
-      }
-    }
-    if (couponCode || hasDiscount || !isNewRegistration || cleanAttendees.length > 0 || ticketDelivery) {
-      registration = await prisma.registration.findUnique({
-        where: { id: registration.id },
-        include: {
-          registrationOptions: { include: { eventOption: true, tranches: true } },
-          event: true,
-          user: { select: { id: true, name: true, email: true, phoneNumber: true } },
-          couponRedemptions: ACTIVE_COUPONS_INCLUDE,
-
-          bundleApplications: BUNDLE_APPS_INCLUDE,
-          attendees: ATTENDEES_INCLUDE,
-        }
-      });
-    }
-
-    // If total due is zero, mark as paid and generate/update tickets if no required form
-    let freeTicketMockReq = null, freeTicketMockRes = null;
-    try {
-      const totalDue = computeRegistrationTotalDue(registration, new Date());
-      if (totalDue === 0) {
-        // Mark paid (no-op if already paid)
-        if (registration.status !== 'paid') {
-          await prisma.registration.update({ where: { id: registration.id }, data: { status: 'paid', updatedAt: new Date() } });
-        }
-        // check if event has a required form
-        let hasRequiredForm = false;
-        try {
-          const form = await prisma.eventForm.findUnique({ where: { eventId: registration.eventId } });
-          hasRequiredForm = !!(form && form.isRequired);
-        } catch {}
-        if (!hasRequiredForm) {
-          // Same generator as paid registrations: a ticket per named attendee, and one
-          // shared quantity ticket for the rest of each line.
-          await generateTicketsForRegistration(registration.id);
-          // Capture for chained email — tickets sent after registration confirmation
-          freeTicketMockReq = { user: { id: registration.userId }, body: { registrationId: registration.id } };
-          freeTicketMockRes = { status: () => freeTicketMockRes, json: () => {} };
-        }
-
-        // reflect status change in the returned object
-        registration.status = 'paid';
-      }
-    } catch (e) {
-      // ignore errors in auto-generation path; manual generation remains available
-    }
-
-    // Fire-and-forget: registration email first, then tickets (guarantees order)
-    const { sendRegistrationEmails, sendRegistrationUpdatedEmails } = require('../utils/notifications');
-    const _regId = registration.id;
-    const _freeTicketReq = freeTicketMockReq;
-    const _freeTicketRes = freeTicketMockRes;
-    (async () => {
-      try {
-        if (isNewRegistration) {
-          await sendRegistrationEmails(_regId);
-        } else {
-          await sendRegistrationUpdatedEmails(_regId);
-        }
-      } catch (e) { console.error('Failed to send registration emails:', e); }
-      if (_freeTicketReq) {
-        try { await emailTickets(_freeTicketReq, _freeTicketRes); } catch (e) { console.error('Error emailing tickets for free registration:', e); }
-      }
-    })();
-
-    // Funnel: this registration came from a tracked (cookie-consented) visit.
-    if (analyticsSessionId) {
-      const { recordSubmit } = require('../utils/analytics');
-      recordSubmit(registration, analyticsSessionId).catch(e => console.warn('[analytics] submit not recorded:', e?.message || e));
-    }
-
-    res.status(201).json({ ...attachComputedTotals(registration), ...(couponError ? { couponError } : {}) });
+    const actor = req.user ? { id: req.user.id, role: req.user.role, email: req.user.email } : null;
+    const { registration, couponError } = await registrationService.createRegistration(req.body || {}, actor);
+    res.status(201).json({ ...registration, ...(couponError ? { couponError } : {}) });
   } catch (error) {
     res.status(400).json({ message: error.message });
   }
@@ -569,7 +68,13 @@ const getRegistrations = async (req, res) => {
     // array of every registration) working unchanged; callers that pass either param get back
     // the { data, total, page, limit, pages } shape used by /api/payments and /api/users.
     // Campus-scoped staff: registrations for events they can see.
-    const where = await require('../utils/campusScope').listWhere(req, 'event');
+    const scopeWhere = await require('../utils/campusScope').listWhere(req, 'event');
+    // Narrowing filters, so callers needn't download every registration ever made:
+    // ?unpaid=1 — still owing (not paid or cancelled); ?userId= — one person's.
+    const filters = [];
+    if (['1', 'true'].includes(String(req.query.unpaid || ''))) filters.push({ status: { in: ['pending', 'confirmed', 'partial_paid'] } });
+    if (req.query.userId) filters.push({ userId: String(req.query.userId) });
+    const where = filters.length ? { AND: [scopeWhere, ...filters] } : scopeWhere;
     if (typeof req.query.page === 'undefined' && typeof req.query.limit === 'undefined') {
       const registrations = await prisma.registration.findMany({ where, include });
       return res.json(attachComputedTotalsToList(registrations));
@@ -821,71 +326,7 @@ const updateRegistrationStatus = async (req, res) => {
 // @access  Private
 const cancelRegistration = async (req, res) => {
   try {
-    const registration = await prisma.registration.findUnique({
-      where: { id: req.params.id },
-      include: { event: { select: { endDate: true } } }
-    });
-
-    if (!registration) {
-      res.status(404);
-      throw new Error('Registration not found');
-    }
-
-    // Check if user is authorized to cancel this registration
-    if (registration.userId !== req.user.id && req.user.role !== 'admin') {
-      res.status(403);
-      throw new Error('Not authorized to cancel this registration');
-    }
-
-    // If event is in the past, block self-cancellation (mirrors the edit-block above)
-    if (req.user.role !== 'admin' && registration.event?.endDate && new Date(registration.event.endDate).getTime() < Date.now()) {
-      res.status(400);
-      throw new Error('This event has already ended; registration can no longer be cancelled');
-    }
-
-    await assertEventOpen(registration.eventId, res);
-
-    // Check if registration can be cancelled
-    if (registration.status === 'cancelled') {
-      res.status(400);
-      throw new Error('Registration is already cancelled');
-    }
-
-    // Non-admins cannot cancel a registration that has payments against it
-    if (req.user.role !== 'admin') {
-      const paymentCount = await prisma.payment.count({
-        where: { registrationId: registration.id, amount: { gt: 0 } }
-      });
-      if (paymentCount > 0) {
-        res.status(403);
-        throw new Error('This registration has payments recorded against it and cannot be self-cancelled. Please contact the organisation for assistance.');
-      }
-    }
-
-    const updatedRegistration = await prisma.registration.update({
-      where: { id: req.params.id },
-      data: {
-        status: 'cancelled',
-        updatedAt: new Date()
-      }
-    });
-    await releaseRegistrationCoupons(req.params.id);
-    queueWaitlist(registration.eventId);
-
-    // Only log when staff cancels on someone else's behalf — a routine self-service
-    // cancellation isn't an admin action worth cluttering the audit trail with.
-    if (registration.userId !== req.user.id) {
-      logAdminAction({
-        actorId: req.user.id,
-        actorRole: req.user.role,
-        action: 'registration_cancelled',
-        targetType: 'Registration',
-        targetId: req.params.id,
-        metadata: { registrationOwnerId: registration.userId },
-        ip: getClientIp(req),
-      });
-    }
-
+    const updatedRegistration = await registrationService.cancelRegistration(req.params.id, req.user, getClientIp(req));
     res.json({ message: 'Registration cancelled', registration: updatedRegistration });
   } catch (error) {
     res.status(400).json({ message: error.message });
@@ -2147,7 +1588,6 @@ async function syncStatusAfterDiscount(registrationId) {
   return status;
 }
 
-const isStaffRole = (role) => ['admin', 'supervisor', 'staff'].includes(role);
 
 // @desc    Apply a coupon code to an existing registration
 // @route   POST /api/registrations/:id/coupon

backend/src/services/errors.ts

@@ -0,0 +1,19 @@
+/**
+ * An error from a service (src/services/*) with the HTTP status it means. v2 turns it into its
+ * error shape by the status (v2/errors.ts); v1 controllers keep answering as they always did.
+ */
+export class ServiceError extends Error {
+  readonly statusCode: number;
+  /** Extra, e.g. couponError or a code the caller can switch on. */
+  readonly code?: string;
+
+  constructor(statusCode: number, message: string, code?: string) {
+    super(message);
+    this.statusCode = statusCode;
+    this.code = code;
+  }
+}
+
+export const fail = (statusCode: number, message: string, code?: string): never => {
+  throw new ServiceError(statusCode, message, code);
+};

backend/src/services/payments.ts

@@ -0,0 +1,88 @@
+/**
+ * Paying a registration online (1.51.1). Moved from paymentController.createCheckout so
+ * POST /api/payments/checkout (v1) and POST /api/v2/registrations/:id/checkout share it.
+ */
+import { prisma } from '../v2/legacy';
+import { fail, ServiceError } from './errors';
+import type { Role } from './registrations';
+
+/* eslint-disable @typescript-eslint/no-explicit-any -- the JS helpers below aren't typed yet */
+const payments = require('../payments') as { MIN_ONLINE_AMOUNT: number };
+const { createRegistrationCheckout } = require('../payments/checkouts') as {
+  createRegistrationCheckout(registrationId: string, userId: string, opts: { successUrl?: string; cancelUrl?: string; failureUrl?: string; donationAmount?: number; amount?: number | null; provider?: string | null }): Promise<{
+    checkoutId: string; redirectUrl: string; provider: string; amount: number; registration: { id: string; eventId: string; eventTitle: string };
+  }>;
+};
+const pricing = require('../utils/pricing') as {
+  refreshPricingForRegistration(id: string): Promise<{ changed: boolean }>;
+  computeRegistrationTotalDue(registration: any, at: Date): number;
+};
+const { assertEventOpen } = require('../utils/cashupUtils') as { assertEventOpen(eventId: string): Promise<unknown> };
+
+export type CheckoutOptions = {
+  /** Pay only this much of the balance (staff taking part payments). */
+  amount?: number | null;
+  /** An optional donation added on top (the register form's "Donation amount"). */
+  donationAmount?: number | null;
+  provider?: string | null;
+  successUrl?: string;
+  cancelUrl?: string;
+  failureUrl?: string;
+};
+
+export type CheckoutResult =
+  | { priceUpdated: true; newTotal: number; message: string }
+  | { priceUpdated?: false; checkoutId: string; redirectUrl: string; provider: string; amount: number; registration: { id: string; eventId: string; eventTitle: string } };
+
+/**
+ * Starts an online payment for what's owed on a registration (the owner, or a supervisor or
+ * admin). If an early-bird price ran out since it was made, nothing is charged: the caller is
+ * told the new total to show first.
+ */
+export async function startRegistrationCheckout(registrationId: string, actor: { id: string; role: Role }, opts: CheckoutOptions = {}): Promise<CheckoutResult> {
+  const reg = await prisma.registration.findUnique({ where: { id: registrationId }, select: { userId: true, eventId: true, event: { select: { endDate: true } } } });
+  if (!reg) return fail(404, 'Registration not found');
+  const staffSide = actor.role === 'admin' || actor.role === 'supervisor';
+  if (reg.userId !== actor.id && !staffSide) fail(403, 'Not authorized to create checkout for this registration');
+  // If event is in the past, block self-service payment (mirrors the registration-edit block)
+  if (!staffSide && reg.event?.endDate && new Date(reg.event.endDate).getTime() < Date.now()) {
+    fail(400, 'This event has already ended; payment can no longer be made for this registration');
+  }
+  try {
+    await assertEventOpen(reg.eventId);
+  } catch (e: any) {
+    throw new ServiceError(e.message === 'Event not found' ? 404 : 400, e.message);
+  }
+
+  // Refresh early-bird pricing — updates priceSnapshot if any tier has expired or sold out.
+  // Must run before the balance is worked out so the checkout charges the right price.
+  const { changed } = await pricing.refreshPricingForRegistration(registrationId);
+  if (changed) {
+    const fresh = await prisma.registration.findUniqueOrThrow({
+      where: { id: registrationId },
+      include: { registrationOptions: { include: { eventOption: { include: { earlyBirdTiers: true } }, tranches: true } }, payments: true },
+    });
+    const newTotal = pricing.computeRegistrationTotalDue(fresh, new Date());
+    const totalPaid = fresh.payments.reduce((s, p) => s + p.amount, 0);
+    return {
+      priceUpdated: true,
+      newTotal: Math.max(0, newTotal - totalPaid),
+      message: 'One or more early-bird prices have changed since your registration was created. Please review the updated total before proceeding.',
+    };
+  }
+
+  const urls = { successUrl: opts.successUrl, cancelUrl: opts.cancelUrl, failureUrl: opts.failureUrl, provider: opts.provider ?? null };
+
+  // Part of the balance (supervisor payments page)
+  if (opts.amount !== undefined && opts.amount !== null && !isNaN(Number(opts.amount))) {
+    return createRegistrationCheckout(registrationId, actor.id, { ...urls, amount: Number(opts.amount) });
+  }
+
+  let donation = 0;
+  if (opts.donationAmount !== undefined && opts.donationAmount !== null) {
+    donation = Math.round(Number(opts.donationAmount) * 100) / 100;
+    if (!(donation >= 0) || donation > 100000) fail(400, 'Invalid donation amount');
+    if (donation > 0 && donation < payments.MIN_ONLINE_AMOUNT) fail(400, `Minimum donation is R${payments.MIN_ONLINE_AMOUNT}`);
+  }
+  return createRegistrationCheckout(registrationId, actor.id, { ...urls, donationAmount: donation });
+}

backend/src/services/registrations.ts

@@ -0,0 +1,497 @@
+/**
+ * Making and cancelling registrations (1.51.1). Moved here from registrationController.js so
+ * POST /api/registrations (v1) and POST /api/v2/registrations run the same code. Errors are
+ * ServiceErrors carrying their HTTP status.
+ */
+import { v4 as uuidv4 } from 'uuid';
+import { prisma } from '../v2/legacy';
+import { fail, ServiceError } from './errors';
+
+/* eslint-disable @typescript-eslint/no-explicit-any -- the JS helpers below aren't typed yet */
+const { generateTicketsForRegistration } = require('../utils/ticketUtils') as { generateTicketsForRegistration(id: string): Promise<unknown> };
+const pricing = require('../utils/pricing') as {
+  resolveOptionPrice(option: any, qty: number, buyer: any): Promise<{ price: number; tierId: string | null }>;
+  resolveVariantTierPrice(option: any, variantId: string, qty: number, buyer: any): Promise<{ price: number; tierId: string | null }>;
+  computeRegistrationTotalDue(registration: any, at: Date): number;
+  attachComputedTotals<T>(registration: T): T & { totalDueComputed: number };
+};
+const coupons = require('../utils/coupons') as {
+  buildCouponLines(registration: any): any[];
+  previewCoupon(args: { code: string; eventId: string; user: any; lines: any[] }): Promise<unknown>;
+  applyCouponToRegistration(args: { registrationId: string; code: string }): Promise<unknown>;
+  recalculateRegistrationDiscount(registrationId: string): Promise<number>;
+  releaseRegistrationCoupons(registrationId: string): Promise<unknown>;
+};
+const attendeesUtil = require('../utils/attendees') as {
+  lineKey(eventOptionId: string, variantId?: string | null): string;
+  validateAttendees(event: any, places: Record<string, number>, attendees: unknown, existing: Record<string, number>): any[];
+  createAttendees(registrationId: string, attendees: any[]): Promise<unknown>;
+  namedPlacesByKey(registrationId: string): Promise<Record<string, number>>;
+};
+const { findAccountByContact } = require('../utils/accountMatch') as { findAccountByContact(c: { email?: string; phone?: string }): Promise<{ user: { id: string } | null; conflict?: boolean }> };
+const { ensureConsentRequests } = require('../utils/consent') as { ensureConsentRequests(registrationId: string): Promise<unknown> };
+const { takenCount } = require('../utils/stock') as { takenCount(where: object, opts?: { excludeEntryId?: string | null }): Promise<number> };
+const waitlist = require('../utils/waitlist') as { findOfferByToken(token: string): Promise<any>; queueWaitlist(eventId: string): void };
+const { reservedOptionIds } = require('../utils/volunteers') as { reservedOptionIds(event: any): string[] };
+const { BUNDLE_APPS_INCLUDE } = require('../utils/bundles') as { BUNDLE_APPS_INCLUDE: any };
+const sessions = require('../utils/sessions') as {
+  registrationClosesAt(event: any, sessions: any[]): Date;
+  wholeCourseClosesAt(event: any, sessions: any[]): Date;
+  expandPickLines(event: any, options: any[], opts: { now: Date }): any[];
+  assertSessionCapacity(event: any, lines: any[], registrationId?: string, opts?: { excludeEntryId?: string }): Promise<void>;
+  mergeSessionIds(a: string[] | null | undefined, b: string[] | null | undefined): string[];
+};
+const { assertEventOpen } = require('../utils/cashupUtils') as { assertEventOpen(eventId: string, res?: unknown): Promise<unknown> };
+const { logAdminAction } = require('../utils/adminAudit') as { logAdminAction(entry: object): Promise<void> };
+
+export type Role = 'admin' | 'supervisor' | 'staff' | 'user';
+export type Actor = { id: string; role: Role; email?: string } | null;
+
+export const TICKET_DELIVERY = ['payer', 'each'] as const;
+export const isStaffRole = (role: string | undefined | null): boolean => ['admin', 'supervisor', 'staff'].includes(String(role));
+
+// Named attendees for API responses, with whether their ticket has been issued/used.
+export const ATTENDEES_INCLUDE = {
+  orderBy: { order: 'asc' as const },
+  include: {
+    ticket: { select: { id: true, isUsed: true } },
+    // Latest consent request (youth events) — it decides check-in.
+    consentRequests: { orderBy: { createdAt: 'desc' as const }, take: 1, select: { id: true, status: true, respondedAt: true, lastSentAt: true, textVersion: true } },
+  },
+};
+
+// Active coupon on a registration, for API responses (the discount itself is
+// Registration.discountTotal).
+export const ACTIVE_COUPONS_INCLUDE = {
+  where: { releasedAt: null },
+  select: { id: true, discountAmount: true, createdAt: true, coupon: { select: { id: true, code: true, type: true, value: true, description: true } } },
+};
+
+// Youth events: send parental consent requests for any new under-18 attendees. Runs in
+// the background so a slow mail/WhatsApp send never holds up the registration.
+export function queueConsentRequests(registrationId: string): void {
+  ensureConsentRequests(registrationId).catch((e: any) => console.error('[consent] Failed to send requests:', e?.message || e));
+}
+
+type Line = { eventOptionId: string; variantId?: string | null; sessionId?: string | null; quantity: number | string };
+
+/**
+ * Places each line will have once `requested` is added to `existingLines` — used to
+ * check attendee names against what's actually being bought.
+ */
+export function placesAfter(existingLines: Line[] | undefined, requested: Line[] | undefined): Record<string, number> {
+  const out: Record<string, number> = {};
+  // Picked-session lines take no attendee names.
+  for (const l of [...(existingLines || []), ...(requested || [])].filter(x => !x.sessionId)) {
+    const k = attendeesUtil.lineKey(l.eventOptionId, l.variantId);
+    out[k] = (out[k] || 0) + Number(l.quantity || 0);
+  }
+  return out;
+}
+
+/**
+ * Coupon lines for options that haven't been saved yet, so a code can be checked
+ * before anything is created. Mirrors buildCouponLines for one tranche per option.
+ */
+export function pendingCouponLines(event: { eventOptions: { id: string }[] }, resolvedOptions: any[]): any[] {
+  return coupons.buildCouponLines({
+    registrationOptions: resolvedOptions.map(o => ({
+      eventOptionId: o.eventOptionId,
+      variantId: o.variantId || null,
+      quantity: o.quantity,
+      eventOption: event.eventOptions.find(eo => eo.id === o.eventOptionId),
+      tranches: [{ quantity: o.quantity, priceSnapshot: o.priceSnapshot, appliedTierId: o.appliedTierId }],
+    })),
+  });
+}
+
+/**
+ * Price one requested option for this buyer: early-bird tiers, then variant/option price,
+ * then the staff price for Staff and above. Returns { priceSnapshot, appliedTierId }.
+ */
+export async function priceRequestedOption(eventOption: any, variantId: string | null, qty: number, buyer: any): Promise<{ priceSnapshot: number; appliedTierId: string | null }> {
+  try {
+    const resolved = variantId
+      ? await pricing.resolveVariantTierPrice(eventOption, variantId, qty, buyer)
+      : await pricing.resolveOptionPrice(eventOption, qty, buyer);
+    return { priceSnapshot: resolved.price, appliedTierId: resolved.tierId };
+  } catch {
+    const variant = variantId ? (eventOption.variants || []).find((v: any) => v.id === variantId) : null;
+    const price = variant && variant.price !== null && variant.price !== undefined ? variant.price : eventOption.price;
+    return { priceSnapshot: Number(price || 0), appliedTierId: null };
+  }
+}
+
+/**
+ * Check overall stock availability for an EventOption. Places held for live waitlist
+ * offers count as taken, except the offer being claimed (`excludeEntryId`).
+ */
+export async function checkOptionStock(option: { id: string; stockLimit: number }, requestedQty: number, excludeEntryId: string | null = null, sessionId: string | null = null) {
+  if (!option.stockLimit || option.stockLimit === 0) return { available: true, remaining: null as number | null };
+  const remaining = option.stockLimit - await takenCount({ eventOptionId: option.id, sessionId }, { excludeEntryId });
+  return { available: remaining >= requestedQty, remaining };
+}
+
+/** Check stock availability for a specific variant (same rules as checkOptionStock). */
+export async function checkVariantStock(variant: { id: string; eventOptionId: string; stockLimit: number | null }, requestedQty: number, excludeEntryId: string | null = null, sessionId: string | null = null) {
+  if (!variant.stockLimit || variant.stockLimit === 0) return { available: true, remaining: null as number | null };
+  const remaining = variant.stockLimit - await takenCount({ eventOptionId: variant.eventOptionId, variantId: variant.id, sessionId }, { excludeEntryId });
+  return { available: remaining >= requestedQty, remaining };
+}
+
+export type RequestedOption = { eventOptionId: string; quantity: number; variantId?: string | null; sessionIds?: string[] };
+export type CreateRegistrationInput = {
+  eventId: string;
+  options: RequestedOption[];
+  guestName?: string;
+  guestEmail?: string;
+  guestPhone?: string;
+  couponCode?: string;
+  attendees?: unknown[];
+  ticketDelivery?: string;
+  waitlistToken?: string;
+  analyticsSessionId?: string;
+};
+
+const FULL_INCLUDE = {
+  registrationOptions: { include: { eventOption: true, tranches: true } },
+  event: true,
+  user: { select: { id: true, name: true, email: true, phoneNumber: true } },
+} as const;
+
+/**
+ * Registers someone for an event (online, a guest for a free event, or with a waitlist link):
+ * checks the event is open, prices each line (early-bird, variant, staff price), checks stock
+ * and session places, adds to an existing registration for the same person and event, applies
+ * bundle deals and a coupon, and issues tickets straight away when nothing is owed.
+ */
+export async function createRegistration(input: CreateRegistrationInput, actor: Actor) {
+  try {
+    return await create(input, actor);
+  } catch (e: any) {
+    // The helpers (coupons, attendee names, session places…) throw plain Errors written for
+    // people; like v1, those are the caller's problem (400) unless they carry a status.
+    if (e instanceof ServiceError || /^P\d{4}$/.test(String(e?.code || ''))) throw e;
+    throw new ServiceError(e?.statusCode || 400, e?.message || 'Registration failed');
+  }
+}
+
+async function create(input: CreateRegistrationInput, actor: Actor) {
+  const { eventId, options, guestName, guestEmail, guestPhone, couponCode, attendees, ticketDelivery, waitlistToken, analyticsSessionId } = input;
+
+  const event = await prisma.event.findUnique({
+    where: { id: eventId },
+    include: { eventOptions: { include: { earlyBirdTiers: true, variants: true } }, sessions: true },
+  });
+  if (!event) return fail(404, 'Event not found');
+  if (!event.isActive) return fail(400, 'Event is not active');
+  if (event.cashupStatus === 'closed') return fail(400, 'This event is closed and no longer accepting registrations.');
+
+  // A waitlist claim link: its token identifies the person and releases the places
+  // held for them. It works without logging in, the same way a consent link does.
+  let waitlistOffer: any = null;
+  if (waitlistToken) {
+    waitlistOffer = await waitlist.findOfferByToken(waitlistToken);
+    if (!waitlistOffer || waitlistOffer.eventId !== eventId) fail(400, 'This waitlist link is not valid.');
+    if (waitlistOffer.status !== 'offered') fail(400, `This waitlist offer has ${waitlistOffer.status === 'claimed' ? 'already been used' : 'expired'}.`);
+    if (new Date(waitlistOffer.offerExpiresAt) < new Date()) fail(400, 'This waitlist offer has expired.');
+    if (actor && actor.id !== waitlistOffer.userId) fail(403, 'This waitlist offer belongs to someone else.');
+  }
+
+  // Enforce auth unless event explicitly opts out
+  if (event.requiresAuth !== false && !actor && !waitlistOffer) fail(401, 'Authentication required for this event');
+
+  // Unauthenticated guest registration is only permitted for free events
+  if (!actor && !waitlistOffer) {
+    const requestedTotal = (options || []).reduce((sum, opt) => {
+      const eo = event.eventOptions.find(o => o.id === opt.eventOptionId);
+      return sum + ((eo?.price || 0) * (opt.quantity || 1));
+    }, 0);
+    if (requestedTotal > 0) fail(400, 'Guest registration is only available for free events. Please create an account to pay for tickets.');
+  }
+
+  // Resolve userId — authenticated or guest
+  let userId: string;
+  if (actor) {
+    userId = actor.id;
+  } else if (waitlistOffer) {
+    userId = waitlistOffer.userId;
+  } else {
+    // Guest registration: find existing user by email or create inactive placeholder
+    if (!guestEmail || !guestName) return fail(400, 'Name and email are required for unauthenticated registration');
+    const match = await findAccountByContact({ email: guestEmail, phone: guestPhone });
+    if (match.conflict) fail(409, 'This email and phone number belong to two different accounts. Please log in, or check your details.');
+    if (match.user) {
+      userId = match.user.id;
+    } else {
+      const newGuest = await prisma.user.create({
+        data: { id: uuidv4(), name: guestName, email: guestEmail, password: '', phoneNumber: guestPhone || null, isActive: false, updatedAt: new Date() },
+      });
+      userId = newGuest.id;
+    }
+  }
+
+  // Enforce registration cutoff for public registrations (multi-day events close when
+  // the first session starts, or later with late joining — see utils/sessions.js).
+  const now = new Date();
+  if (now >= sessions.registrationClosesAt(event, event.sessions)) fail(400, 'Registration is closed for this event');
+
+  if (!options || !Array.isArray(options) || options.length === 0) fail(400, 'At least one option must be selected');
+
+  // "Pick sessions" options become one line per chosen session; whole-course tickets
+  // on such an event still close when the whole course does.
+  const lines = sessions.expandPickLines(event, options, { now });
+  // (An all-sessions ticket with sessions ticked is checked per session instead.)
+  if (event.attendanceMode === 'pick' && lines.some(l => !l.sessionId && !l.sessionIds?.length) && now >= sessions.wholeCourseClosesAt(event, event.sessions)) {
+    fail(400, 'Whole-course tickets are no longer on sale — choose the sessions you want instead.');
+  }
+  await sessions.assertSessionCapacity(event, lines, undefined, { excludeEntryId: waitlistOffer?.id });
+
+  // Validate each option and resolve prices / check stock. Options are independent of each
+  // other, so resolve them concurrently. The kids check-in and volunteer tickets are handed
+  // out by staff, never sold.
+  const reserved = new Set(isStaffRole(actor?.role) ? [] : reservedOptionIds(event));
+  const buyerFor = async () => actor || (waitlistOffer ? await prisma.user.findUnique({ where: { id: waitlistOffer.userId }, select: { id: true, role: true } }) : null);
+  const resolvedOptions = await Promise.all(lines.map(async (option: any) => {
+    const eventOption = event.eventOptions.find(eo => eo.id === option.eventOptionId);
+    if (!eventOption || reserved.has(eventOption.id)) fail(400, `Option with ID ${option.eventOptionId} not found for this event`);
+    if (!option.quantity || option.quantity < 1) fail(400, 'Quantity must be at least 1');
+    const qty = option.quantity;
+
+    // (A failing count doesn't block the sale — only a real shortage does.)
+    const stockCheck = await checkOptionStock(eventOption!, qty, waitlistOffer?.id, option.sessionId).catch(() => ({ available: true, remaining: null }));
+    if (!stockCheck.available) fail(400, `"${eventOption!.name}" is sold out or does not have enough stock (${stockCheck.remaining ?? 0} remaining).`);
+
+    const variantId: string | null = option.variantId || null;
+    if (variantId) {
+      const variant = (eventOption!.variants || []).find(v => v.id === variantId);
+      if (!variant) return fail(400, `Variant not found for option "${eventOption!.name}"`);
+      const vStock = await checkVariantStock(variant, qty, waitlistOffer?.id, option.sessionId).catch(() => ({ available: true, remaining: null }));
+      if (!vStock.available) fail(400, `Variant "${variant.name}" is sold out (${vStock.remaining ?? 0} remaining).`);
+    }
+
+    // Variant-level tiers take priority, then option-level tiers, then base prices, then
+    // the staff price for Staff and above.
+    const { priceSnapshot, appliedTierId } = await priceRequestedOption(eventOption, variantId, qty, await buyerFor());
+    return { ...option, variantId, appliedTierId, priceSnapshot: priceSnapshot ?? eventOption!.price };
+  }));
+
+  // Check a coupon code before anything is saved, so a bad code doesn't leave a
+  // half-made registration behind. It's applied (and re-checked under a lock) below.
+  if (couponCode) {
+    const buyer = actor ? { id: actor.id, role: actor.role, email: actor.email } : null;
+    await coupons.previewCoupon({ code: couponCode, eventId, user: buyer, lines: pendingCouponLines(event, resolvedOptions) });
+  }
+
+  // Check for existing non-cancelled registration for this user+event → merge instead
+  const existingReg = await prisma.registration.findFirst({
+    where: { userId, eventId, status: { not: 'cancelled' } },
+    include: { registrationOptions: true },
+  });
+
+  // Attendee names are checked against the places the registration will have after
+  // this purchase, counting names already given on an existing registration.
+  const cleanAttendees = attendeesUtil.validateAttendees(
+    event,
+    placesAfter(existingReg?.registrationOptions, resolvedOptions),
+    attendees,
+    existingReg ? await attendeesUtil.namedPlacesByKey(existingReg.id) : {},
+  );
+  if (ticketDelivery !== undefined && !(TICKET_DELIVERY as readonly string[]).includes(ticketDelivery)) fail(400, "ticketDelivery must be 'payer' or 'each'");
+
+  let registrationId: string;
+  let isNewRegistration = false;
+  if (existingReg) {
+    // Merge: add a new price tranche per requested option into the existing registration.
+    // Never overwrite an existing row's priceSnapshot/quantity in place — that would blend
+    // tickets bought at different early-bird prices into a single (wrong) price. Each
+    // purchase gets its own tranche; the RegistrationOption row stays a maintained aggregate.
+    for (const opt of resolvedOptions) {
+      // Match on eventOptionId + variantId (+ session, for picked sessions) for correct row
+      const existing = existingReg.registrationOptions.find(
+        ro => ro.eventOptionId === opt.eventOptionId && (ro.variantId || null) === (opt.variantId || null) && (ro.sessionId || null) === (opt.sessionId || null),
+      );
+      if (existing) {
+        await prisma.$transaction([
+          prisma.registrationOptionTranche.create({
+            data: { id: uuidv4(), registrationOptionId: existing.id, quantity: opt.quantity, priceSnapshot: opt.priceSnapshot, appliedTierId: opt.appliedTierId || null },
+          }),
+          prisma.registrationOption.update({
+            where: { id: existing.id },
+            data: { quantity: existing.quantity + opt.quantity, priceSnapshot: opt.priceSnapshot, appliedTierId: opt.appliedTierId || null, ...(existing.sessionId ? {} : { sessionIds: sessions.mergeSessionIds(existing.sessionIds, opt.sessionIds) }) },
+          }),
+        ]);
+      } else {
+        await prisma.registrationOption.create({
+          data: {
+            id: uuidv4(),
+            registrationId: existingReg.id,
+            eventOptionId: opt.eventOptionId,
+            quantity: opt.quantity,
+            variantId: opt.variantId || null,
+            sessionId: opt.sessionId || null,
+            sessionIds: opt.sessionIds || [],
+            appliedTierId: opt.appliedTierId || null,
+            priceSnapshot: opt.priceSnapshot,
+            tranches: { create: [{ id: uuidv4(), quantity: opt.quantity, priceSnapshot: opt.priceSnapshot, appliedTierId: opt.appliedTierId || null }] },
+          },
+        });
+      }
+    }
+    // Only downgrade from paid if the newly added items actually cost something
+    const newItemsCost = resolvedOptions.reduce((sum, opt) => sum + ((opt.priceSnapshot || 0) * (opt.quantity || 0)), 0);
+    await prisma.registration.update({
+      where: { id: existingReg.id },
+      data: existingReg.status === 'paid' && newItemsCost > 0 ? { status: 'partial_paid', updatedAt: new Date() } : { updatedAt: new Date() },
+    });
+    registrationId = existingReg.id;
+  } else {
+    isNewRegistration = true;
+    registrationId = uuidv4();
+    await prisma.registration.create({
+      data: {
+        id: registrationId,
+        userId,
+        eventId,
+        updatedAt: new Date(),
+        registrationOptions: {
+          create: resolvedOptions.map(option => ({
+            id: uuidv4(),
+            eventOptionId: option.eventOptionId,
+            quantity: option.quantity,
+            variantId: option.variantId || null,
+            sessionId: option.sessionId || null,
+            sessionIds: option.sessionIds || [],
+            appliedTierId: option.appliedTierId || null,
+            priceSnapshot: option.priceSnapshot,
+            tranches: { create: [{ id: uuidv4(), quantity: option.quantity, priceSnapshot: option.priceSnapshot, appliedTierId: option.appliedTierId || null }] },
+          })),
+        },
+      },
+    });
+  }
+
+  if (cleanAttendees.length > 0) {
+    await attendeesUtil.createAttendees(registrationId, cleanAttendees);
+    queueConsentRequests(registrationId);
+  }
+  if (waitlistOffer) {
+    await prisma.waitlistEntry.update({
+      where: { id: waitlistOffer.id },
+      data: { status: 'claimed', claimedAt: new Date(), registrationId, offerTokenHash: null },
+    });
+  }
+  if (ticketDelivery) {
+    await prisma.registration.update({ where: { id: registrationId }, data: { ticketDelivery: ticketDelivery as 'payer' | 'each' } });
+  }
+
+  // Bundle deals, then the coupon (or re-work an existing one over the merged items).
+  let couponError: string | null = null;
+  await coupons.recalculateRegistrationDiscount(registrationId);
+  if (couponCode) {
+    try {
+      await coupons.applyCouponToRegistration({ registrationId, code: couponCode });
+    } catch (e: any) {
+      // Lost a race for the last use since the check above — keep the registration.
+      if (!e.isCouponError) throw e;
+      couponError = e.message;
+    }
+  }
+  const load = () => prisma.registration.findUniqueOrThrow({
+    where: { id: registrationId },
+    include: { ...FULL_INCLUDE, couponRedemptions: ACTIVE_COUPONS_INCLUDE, bundleApplications: BUNDLE_APPS_INCLUDE, attendees: ATTENDEES_INCLUDE },
+  });
+  let registration = await load();
+
+  // Nothing owed: mark paid and issue tickets (unless a required form comes first).
+  let emailTicketsAfter = false;
+  try {
+    if (pricing.computeRegistrationTotalDue(registration, new Date()) === 0) {
+      if (registration.status !== 'paid') {
+        await prisma.registration.update({ where: { id: registrationId }, data: { status: 'paid', updatedAt: new Date() } });
+      }
+      const form = await prisma.eventForm.findUnique({ where: { eventId: registration.eventId } }).catch(() => null);
+      if (!(form && form.isRequired)) {
+        // Same generator as paid registrations: a ticket per named attendee, and one
+        // shared quantity ticket for the rest of each line.
+        await generateTicketsForRegistration(registrationId);
+        emailTicketsAfter = true;
+      }
+      registration = { ...registration, status: 'paid' };
+    }
+  } catch {
+    // ignore errors in auto-generation path; manual generation remains available
+  }
+
+  // Fire-and-forget: registration email first, then tickets (guarantees order)
+  const notifications = require('../utils/notifications') as { sendRegistrationEmails(id: string): Promise<unknown>; sendRegistrationUpdatedEmails(id: string): Promise<unknown> };
+  const ownerId = registration.userId;
+  void (async () => {
+    try {
+      if (isNewRegistration) await notifications.sendRegistrationEmails(registrationId);
+      else await notifications.sendRegistrationUpdatedEmails(registrationId);
+    } catch (e) { console.error('Failed to send registration emails:', e); }
+    if (emailTicketsAfter) {
+      try {
+        const { emailTickets } = require('../controllers/ticketController') as { emailTickets(req: unknown, res: unknown): Promise<unknown> };
+        const res: { status(): unknown; json(): void } = { status: () => res, json: () => {} };
+        await emailTickets({ user: { id: ownerId }, body: { registrationId } }, res);
+      } catch (e) { console.error('Error emailing tickets for free registration:', e); }
+    }
+  })();
+
+  // Funnel: this registration came from a tracked (cookie-consented) visit.
+  if (analyticsSessionId) {
+    const { recordSubmit } = require('../utils/analytics') as { recordSubmit(reg: unknown, sessionId: string): Promise<unknown> };
+    recordSubmit(registration, analyticsSessionId).catch((e: any) => console.warn('[analytics] submit not recorded:', e?.message || e));
+  }
+
+  return { registration: pricing.attachComputedTotals(registration), isNew: isNewRegistration, couponError };
+}
+
+/**
+ * Cancels a registration: the owner (not after the event, not once anything is paid) or an
+ * admin. Releases its coupon and offers its places to the waitlist.
+ */
+export async function cancelRegistration(registrationId: string, actor: { id: string; role: Role }, ip?: string) {
+  const registration = await prisma.registration.findUnique({
+    where: { id: registrationId },
+    include: { event: { select: { endDate: true } } },
+  });
+  if (!registration) return fail(404, 'Registration not found');
+
+  if (registration.userId !== actor.id && actor.role !== 'admin') fail(403, 'Not authorized to cancel this registration');
+
+  // If event is in the past, block self-cancellation (mirrors the edit block)
+  if (actor.role !== 'admin' && registration.event?.endDate && new Date(registration.event.endDate).getTime() < Date.now()) {
+    fail(400, 'This event has already ended; registration can no longer be cancelled');
+  }
+
+  try {
+    await assertEventOpen(registration.eventId);
+  } catch (e: any) {
+    throw new ServiceError(e.message === 'Event not found' ? 404 : 400, e.message);
+  }
+
+  if (registration.status === 'cancelled') fail(400, 'Registration is already cancelled');
+
+  // Non-admins cannot cancel a registration that has payments against it
+  if (actor.role !== 'admin') {
+    const paymentCount = await prisma.payment.count({ where: { registrationId: registration.id, amount: { gt: 0 } } });
+    if (paymentCount > 0) fail(403, 'This registration has payments recorded against it and cannot be self-cancelled. Please contact the organisation for assistance.');
+  }
+
+  const updated = await prisma.registration.update({ where: { id: registrationId }, data: { status: 'cancelled', updatedAt: new Date() } });
+  await coupons.releaseRegistrationCoupons(registrationId);
+  waitlist.queueWaitlist(registration.eventId);
+
+  // Only log when staff cancels on someone else's behalf — a routine self-service
+  // cancellation isn't an admin action worth cluttering the audit trail with.
+  if (registration.userId !== actor.id) {
+    logAdminAction({
+      actorId: actor.id, actorRole: actor.role, action: 'registration_cancelled', targetType: 'Registration', targetId: registrationId,
+      metadata: { registrationOwnerId: registration.userId }, ip,
+    });
+  }
+  return updated;
+}

backend/src/utils/adminAudit.js

@@ -21,16 +21,44 @@ async function logAdminAction({ actorId, actorRole, action, targetType, targetId
   }
 }
 
-// Paginated listing for the admin audit-log page, with optional actor/action/date filters.
-async function getAdminAuditLog({ page = 1, limit = 50, actorId, action, from, to } = {}) {
+const DATE_ONLY = /^\d{4}-\d{2}-\d{2}$/;
+const DAY_MS = 24 * 60 * 60 * 1000;
+// A date (YYYY-MM-DD) means midnight in the server's time zone (APP_TIMEZONE), not UTC.
+const startOf = (v) => new Date(DATE_ONLY.test(v) ? `${v}T00:00:00` : v);
+
+// The Prisma filter for the audit-log page. Dates (YYYY-MM-DD) are whole days, so `to`
+// includes that day. `search` matches the person (name or email), the target type or id,
+// or the IP.
+function auditLogWhere({ actorId, action, role, from, to, search } = {}) {
   const where = {};
   if (actorId) where.actorId = actorId;
   if (action) where.action = action;
+  if (role) where.actorRole = role;
   if (from || to) {
     where.createdAt = {};
-    if (from) where.createdAt.gte = new Date(from);
-    if (to) where.createdAt.lte = new Date(to);
+    if (from) where.createdAt.gte = startOf(from);
+    if (to) {
+      if (DATE_ONLY.test(to)) where.createdAt.lt = new Date(startOf(to).getTime() + DAY_MS);
+      else where.createdAt.lte = new Date(to);
+    }
   }
+  const q = String(search || '').trim().slice(0, 100);
+  if (q) {
+    const contains = { contains: q, mode: 'insensitive' };
+    where.OR = [
+      { actor: { name: contains } },
+      { actor: { email: contains } },
+      { targetType: contains },
+      { targetId: { startsWith: q.replace(/^#/, '') } },
+      { ip: { startsWith: q } },
+    ];
+  }
+  return where;
+}
+
+// Paginated listing for the admin audit-log page.
+async function getAdminAuditLog({ page = 1, limit = 50, ...filters } = {}) {
+  const where = auditLogWhere(filters);
 
   const take = Math.min(Math.max(Number(limit) || 50, 1), 200);
   const skip = (Math.max(Number(page) || 1, 1) - 1) * take;
@@ -49,4 +77,4 @@ async function getAdminAuditLog({ page = 1, limit = 50, actorId, action, from, t
   return { rows, total, page: Math.max(Number(page) || 1, 1), limit: take };
 }
 
-module.exports = { logAdminAction, getAdminAuditLog };
+module.exports = { logAdminAction, getAdminAuditLog, auditLogWhere };

backend/src/utils/webhooks.js

@@ -34,6 +34,48 @@ const EVENT_TYPES = [
 ];
 const TYPES = new Set(EVENT_TYPES.map(t => t.type));
 
+// What `data` looks like for each type — shown in Site settings → Webhooks so whoever builds the
+// receiving side knows what arrives. tests/webhooks.test.js checks these match buildPayload.
+const EXAMPLE_EVENT = { id: 'c1a2b3c4-0000-4000-8000-000000000001', title: 'Youth Camp 2026', startDate: '2026-12-04T16:00:00.000Z', endDate: '2026-12-06T12:00:00.000Z' };
+const EXAMPLE_PERSON = { id: 'u1a2b3c4-0000-4000-8000-000000000002', name: 'Thandi Mokoena', email: 'thandi@example.com', phone: '+27821234567' };
+const exampleRegistration = (status, amountPaid) => ({
+  registration: {
+    id: 'r1a2b3c4-0000-4000-8000-000000000003', status, createdAt: '2026-10-29T08:15:00.000Z', totalDue: 1200, amountPaid,
+    seasonPassPurchaseId: null,
+    items: [{ ticket: 'Camper', variant: 'Bunk bed', quantity: 2, unitPrice: 600 }],
+  },
+  event: EXAMPLE_EVENT,
+  person: EXAMPLE_PERSON,
+});
+const examplePayment = (amount) => ({
+  payment: { id: 'p1a2b3c4-0000-4000-8000-000000000004', amount, method: 'card', provider: 'yoco', isDonation: false, registrationId: 'r1a2b3c4-0000-4000-8000-000000000003', createdAt: '2026-10-29T08:16:00.000Z' },
+  event: EXAMPLE_EVENT,
+  person: EXAMPLE_PERSON,
+});
+const EXAMPLES = {
+  'registration.created': exampleRegistration('pending', 0),
+  'registration.paid': exampleRegistration('paid', 1200),
+  'registration.cancelled': exampleRegistration('cancelled', 0),
+  'payment.received': examplePayment(1200),
+  // Refunds are recorded as negative payments.
+  'payment.refunded': examplePayment(-600),
+  'ticket.checked_in': {
+    checkIn: { id: 't1a2b3c4-0000-4000-8000-000000000005', scannedAt: '2026-12-04T16:20:00.000Z', people: 1, manual: false, offline: false, session: { id: 's1a2b3c4-0000-4000-8000-000000000006', label: 'Friday evening', startsAt: '2026-12-04T16:00:00.000Z' } },
+    ticket: { id: 'k1a2b3c4-0000-4000-8000-000000000007', registrationOptionId: 'o1a2b3c4-0000-4000-8000-000000000008', holderName: 'Thandi Mokoena' },
+    event: EXAMPLE_EVENT,
+    person: EXAMPLE_PERSON,
+  },
+  'user.created': { person: { ...EXAMPLE_PERSON, role: 'user', createdAt: '2026-10-29T08:10:00.000Z' } },
+  'event.published': {
+    event: {
+      ...EXAMPLE_EVENT, description: 'A weekend away for grades 8–12.', location: 'Camp Joy, Magaliesburg', price: 600,
+      goLiveAt: '2026-10-29T06:00:00.000Z', url: 'https://events.example.org/events/c1a2b3c4-0000-4000-8000-000000000001',
+      campus: { name: 'North', slug: 'north' }, series: null,
+    },
+  },
+};
+for (const t of EVENT_TYPES) t.example = EXAMPLES[t.type];
+
 const RETRY_AFTER_MS = [60e3, 5 * 60e3, 30 * 60e3, 2 * 3600e3, 12 * 3600e3];
 const MAX_ATTEMPTS = RETRY_AFTER_MS.length + 1;
 const KEEP_DAYS = 30;

backend/src/v2/errors.ts

@@ -0,0 +1,82 @@
+import type { ErrorRequestHandler, RequestHandler } from 'express';
+import { ZodError } from 'zod';
+
+/**
+ * /api/v2 errors all look the same:
+ *   { "error": { "code": "VALIDATION_FAILED", "message": "…", "fields": { "limit": "…" } } }
+ * `code` is stable (clients switch on it), `message` is for people, `fields` only on validation.
+ */
+export type ErrorCode =
+  | 'VALIDATION_FAILED'
+  | 'UNAUTHENTICATED'
+  | 'FORBIDDEN'
+  | 'NOT_FOUND'
+  | 'CONFLICT'
+  | 'RATE_LIMITED'
+  | 'READ_ONLY'
+  | 'INTERNAL';
+
+export const ERROR_STATUS: Record<ErrorCode, number> = {
+  VALIDATION_FAILED: 400,
+  UNAUTHENTICATED: 401,
+  FORBIDDEN: 403,
+  NOT_FOUND: 404,
+  CONFLICT: 409,
+  RATE_LIMITED: 429,
+  READ_ONLY: 423,
+  INTERNAL: 500,
+};
+
+export class ApiError extends Error {
+  readonly code: ErrorCode;
+  readonly status: number;
+  readonly fields?: Record<string, string>;
+
+  constructor(code: ErrorCode, message: string, fields?: Record<string, string>) {
+    super(message);
+    this.code = code;
+    this.status = ERROR_STATUS[code];
+    this.fields = fields;
+  }
+}
+
+export const notFound = (what = 'That'): ApiError => new ApiError('NOT_FOUND', `${what} wasn't found.`);
+
+/** "limit" or "items.0.quantity" → the first problem with it. */
+export function zodFields(err: ZodError): Record<string, string> {
+  const fields: Record<string, string> = {};
+  for (const issue of err.issues) {
+    const key = issue.path.length ? issue.path.join('.') : '_';
+    if (!fields[key]) fields[key] = issue.message;
+  }
+  return fields;
+}
+
+const STATUS_CODE: Record<number, ErrorCode> = { 400: 'VALIDATION_FAILED', 401: 'UNAUTHENTICATED', 403: 'FORBIDDEN', 404: 'NOT_FOUND', 409: 'CONFLICT', 423: 'READ_ONLY', 429: 'RATE_LIMITED' };
+const PRISMA_CODE: Record<string, ErrorCode> = { P2002: 'CONFLICT', P2025: 'NOT_FOUND', P2003: 'CONFLICT' };
+
+type LegacyError = Error & { statusCode?: number; status?: number; code?: string };
+
+/** Turns anything thrown (ApiError, zod, Prisma, the v1 auth middleware's errors) into the v2 shape. */
+export function toApiError(err: unknown, responseStatus: number): ApiError {
+  if (err instanceof ApiError) return err;
+  if (err instanceof ZodError) return new ApiError('VALIDATION_FAILED', 'Some of what was sent is not valid.', zodFields(err));
+  const e = (err || {}) as LegacyError;
+  if (typeof e.code === 'string' && PRISMA_CODE[e.code]) {
+    return new ApiError(PRISMA_CODE[e.code], e.code === 'P2002' ? 'A record with that value already exists.' : e.code === 'P2025' ? 'Record not found.' : 'A related record prevents this.');
+  }
+  // The shared v1 middleware (protect, staff…) sets res.status() and passes an Error;
+  // utils throw errors with statusCode. Those messages are written for people already.
+  const status = e.statusCode || e.status || (responseStatus >= 400 ? responseStatus : 500);
+  const code = STATUS_CODE[status];
+  if (code) return new ApiError(code, e.message || 'Request failed.');
+  return new ApiError('INTERNAL', 'Something went wrong on the server.');
+}
+
+export const errorHandler: ErrorRequestHandler = (err, req, res, _next) => {
+  const apiErr = toApiError(err, res.statusCode);
+  if (apiErr.code === 'INTERNAL') console.error('[api/v2]', req.method, req.originalUrl, err);
+  res.status(apiErr.status).json({ error: { code: apiErr.code, message: apiErr.message, ...(apiErr.fields ? { fields: apiErr.fields } : {}) } });
+};
+
+export const notFoundHandler: RequestHandler = (_req, _res, next) => next(new ApiError('NOT_FOUND', 'There is no such API endpoint.'));

backend/src/v2/index.ts

@@ -0,0 +1,93 @@
+import express, { Router } from 'express';
+import path from 'path';
+import { mount, routes } from './route';
+import { buildOpenApi } from './openapi';
+import { errorHandler, notFoundHandler } from './errors';
+import auth from '../middleware/authMiddleware';
+// Resources: importing one registers its routes.
+import './resources/events';
+import './resources/me';
+import './resources/registrations';
+
+const pkg = require('../../package.json') as { version: string };
+
+/** /api/v2 — see route.ts for how endpoints are declared, openapi.ts for the docs. */
+export function v2Router(): Router {
+  const router = express.Router();
+
+  // The API description is for the people building on it (admins), like /docs.
+  router.get('/openapi.json', auth.protect, auth.admin, (_req, res) => {
+    res.json(buildOpenApi({ version: pkg.version }));
+  });
+
+  mount(router, routes);
+  router.use(notFoundHandler);
+  router.use(errorHandler);
+  return router;
+}
+
+/**
+ * /docs/v2: Swagger UI (served from swagger-ui-dist, nothing from a CDN). The page itself is
+ * public; it asks for an admin token and uses it to load openapi.json and to try requests.
+ */
+export function v2DocsRouter(): Router {
+  const router = express.Router();
+  const assets = path.dirname(require.resolve('swagger-ui-dist/package.json'));
+  router.use('/assets', express.static(assets, { index: false, maxAge: '1d' }));
+  router.get('/', (_req, res) => {
+    res.type('html').send(DOCS_HTML);
+  });
+  return router;
+}
+
+const DOCS_HTML = `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Cross Events API v2</title>
+  <link rel="stylesheet" href="/docs/v2/assets/swagger-ui.css">
+  <style>
+    body { margin: 0; font-family: system-ui, sans-serif; }
+    #login { max-width: 40rem; margin: 3rem auto; padding: 0 1rem; }
+    #login input { width: 100%; padding: .5rem; font: inherit; border: 1px solid #9ca3af; border-radius: 6px; box-sizing: border-box; }
+    #login button { margin-top: .75rem; padding: .5rem 1rem; font: inherit; background: #1d4ed8; color: #fff; border: 0; border-radius: 6px; cursor: pointer; }
+    #login .err { color: #b91c1c; margin-top: .5rem; }
+  </style>
+</head>
+<body>
+  <main id="login" hidden>
+    <h1>Cross Events API v2</h1>
+    <p>The API reference is for admins. Paste your admin token (after signing in, it's under <code>hope_events_token</code> in the browser's local storage).</p>
+    <label for="token">Admin token</label>
+    <input id="token" autocomplete="off">
+    <button id="go" type="button">Show the API</button>
+    <p class="err" id="err" role="alert"></p>
+  </main>
+  <div id="ui"></div>
+  <script src="/docs/v2/assets/swagger-ui-bundle.js"></script>
+  <script>
+  (function () {
+    var params = new URLSearchParams(location.search);
+    var token = params.get('token') || sessionStorage.getItem('v2docs_token') || localStorage.getItem('hope_events_token') || '';
+    function show(t) {
+      fetch('/api/v2/openapi.json', { headers: { Authorization: 'Bearer ' + t } }).then(function (r) {
+        if (!r.ok) return r.json().then(function (b) { throw new Error((b.error && b.error.message) || r.statusText); });
+        return r.json();
+      }).then(function (spec) {
+        sessionStorage.setItem('v2docs_token', t);
+        if (params.has('token')) history.replaceState(null, '', location.pathname);
+        document.getElementById('login').hidden = true;
+        var ui = SwaggerUIBundle({ spec: spec, dom_id: '#ui', deepLinking: true, persistAuthorization: false });
+        ui.preauthorizeApiKey('bearerAuth', t);
+      }).catch(function (e) {
+        document.getElementById('login').hidden = false;
+        document.getElementById('err').textContent = t ? 'That token did not work: ' + e.message : '';
+      });
+    }
+    document.getElementById('go').addEventListener('click', function () { show(document.getElementById('token').value.trim()); });
+    show(token);
+  })();
+  </script>
+</body>
+</html>`;

backend/src/v2/legacy.ts

@@ -0,0 +1,32 @@
+/**
+ * Typed doors into the JavaScript side of the backend. TypeScript infers loose types from the
+ * .js files (the Prisma client is built by a function, helpers have defaulted options), so v2
+ * code imports them from here instead. When a module is converted to TypeScript, its line here
+ * goes and callers import it directly.
+ */
+import type { PrismaClient } from '@prisma/client';
+
+// The client in config/db.js only adds query hooks (webhooks), so its models are PrismaClient's.
+export const prisma = require('../config/db') as PrismaClient;
+
+type CampusFilter = '' | 'all' | string;
+const campuses = require('../utils/campuses') as {
+  campusesEnabled(): Promise<boolean>;
+  resolveCampusFilter(value: string | undefined): Promise<CampusFilter>;
+  campusWhere(filter: CampusFilter, opts: { enabled: boolean; withAllCampuses?: boolean }): object;
+};
+export const { campusesEnabled, resolveCampusFilter, campusWhere } = campuses;
+
+export const { publicEventWhere } = require('../utils/series') as {
+  publicEventWhere(now?: Date): { isActive: true; isHidden: false; goLiveAt: { lte: Date } };
+};
+
+type OptionLike = { id: string; price: number; earlyBirdTiers?: unknown[] };
+export const { publicOptions } = require('../utils/volunteers') as {
+  publicOptions<O extends { id: string }>(event: { eventOptions?: O[]; kidsOptionId?: string | null; volunteerOptionId?: string | null }): O[];
+};
+
+export const { getEffectiveUnitPrice, computeRegistrationTotalDue } = require('../utils/pricing') as {
+  getEffectiveUnitPrice(option: OptionLike, referenceTime: Date | null, atTime: Date): number;
+  computeRegistrationTotalDue(registration: object, atTime: Date): number;
+};

backend/src/v2/openapi.ts

@@ -0,0 +1,106 @@
+import { z } from 'zod';
+import { routes as allRoutes, type AnyRoute, type Access } from './route';
+import { ERROR_STATUS } from './errors';
+
+/**
+ * The OpenAPI 3.1 document for /api/v2, built from the route declarations (route.ts), so it is
+ * always what the code does. Served at /api/v2/openapi.json, shown at /docs/v2.
+ */
+
+type JsonSchema = Record<string, unknown>;
+
+const toSchema = (schema: z.ZodType, io: 'input' | 'output'): JsonSchema => {
+  const { $schema: _drop, ...rest } = z.toJSONSchema(schema, { io, unrepresentable: 'any' }) as JsonSchema;
+  return rest;
+};
+
+const ACCESS_TEXT: Record<Access, string> = {
+  public: 'Anyone.',
+  optional: 'Anyone; signed-in staff may see more.',
+  user: 'Any signed-in person.',
+  staff: 'Staff, supervisors and admins.',
+  supervisor: 'Supervisors and admins.',
+  admin: 'Admins only.',
+};
+
+const errorSchema = {
+  type: 'object',
+  required: ['error'],
+  properties: {
+    error: {
+      type: 'object',
+      required: ['code', 'message'],
+      properties: {
+        code: { type: 'string', enum: Object.keys(ERROR_STATUS) },
+        message: { type: 'string' },
+        fields: { type: 'object', additionalProperties: { type: 'string' }, description: 'Per-field problems (VALIDATION_FAILED only)' },
+      },
+    },
+  },
+};
+
+const errorResponse = (description: string) => ({ description, content: { 'application/json': { schema: { $ref: '#/components/schemas/Error' } } } });
+
+function parameters(def: AnyRoute) {
+  const out: JsonSchema[] = [];
+  const add = (schema: z.ZodType | undefined, where: 'path' | 'query') => {
+    if (!schema) return;
+    const json = toSchema(schema, 'input') as { properties?: Record<string, JsonSchema>; required?: string[] };
+    for (const [name, prop] of Object.entries(json.properties || {})) {
+      const { description, ...propSchema } = prop as JsonSchema & { description?: string };
+      out.push({ name, in: where, required: where === 'path' || (json.required || []).includes(name), ...(description ? { description } : {}), schema: propSchema });
+    }
+  };
+  add(def.params, 'path');
+  add(def.query, 'query');
+  return out;
+}
+
+export function buildOpenApi(opts: { version: string; serverUrl?: string; list?: AnyRoute[] }) {
+  const list = opts.list ?? allRoutes;
+  const paths: Record<string, Record<string, unknown>> = {};
+  for (const def of list) {
+    const path = def.path.replace(/:(\w+)/g, '{$1}');
+    const secured = def.access !== 'public' && def.access !== 'optional';
+    paths[path] ||= {};
+    paths[path][def.method] = {
+      tags: [def.tag],
+      summary: def.summary,
+      description: [def.description, `**Who:** ${ACCESS_TEXT[def.access]}`].filter(Boolean).join('\n\n'),
+      operationId: `${def.method}${path.replace(/[{}]/g, '').split('/').map(s => s.charAt(0).toUpperCase() + s.slice(1)).join('')}`,
+      ...(secured ? { security: [{ bearerAuth: [] }] } : def.access === 'optional' ? { security: [{}, { bearerAuth: [] }] } : {}),
+      parameters: parameters(def),
+      ...(def.body ? { requestBody: { required: true, content: { 'application/json': { schema: toSchema(def.body, 'input') } } } } : {}),
+      responses: {
+        [String(def.status ?? 200)]: { description: 'OK', content: { 'application/json': { schema: toSchema(def.response, 'output') } } },
+        ...(def.params || def.query || def.body ? { 400: errorResponse('Validation failed (VALIDATION_FAILED)') } : {}),
+        ...(secured ? { 401: errorResponse('Not signed in (UNAUTHENTICATED)') } : {}),
+        ...(secured && def.access !== 'user' ? { 403: errorResponse('Not allowed for this role (FORBIDDEN)') } : {}),
+        ...(def.params ? { 404: errorResponse('Not found (NOT_FOUND)') } : {}),
+      },
+    };
+  }
+  return {
+    openapi: '3.1.0',
+    info: {
+      title: 'Cross Events API',
+      version: opts.version,
+      description: [
+        'Version 2 of the Cross Events API. Every response is JSON:',
+        '- a single item is `{ "data": { … } }`;',
+        '- a list is `{ "data": [ … ], "meta": { "page", "limit", "total", "pages" } }`, paged with `?page=` and `?limit=` (at most 100);',
+        '- an error is `{ "error": { "code", "message", "fields"? } }` with a stable `code`.',
+        '',
+        'Dates are ISO 8601 in UTC; amounts are in rand. Sign in through the app and send the token as `Authorization: Bearer <token>`.',
+        'Version 1 (`/api/…`) keeps working while the app moves over; it will be removed in 2.0.',
+      ].join('\n'),
+    },
+    servers: [{ url: opts.serverUrl ?? '/api/v2' }],
+    tags: Array.from(new Set(list.map(r => r.tag))).map(name => ({ name })),
+    paths,
+    components: {
+      securitySchemes: { bearerAuth: { type: 'http', scheme: 'bearer', bearerFormat: 'JWT' } },
+      schemas: { Error: errorSchema },
+    },
+  };
+}

backend/src/v2/paging.ts

@@ -0,0 +1,28 @@
+import { z } from 'zod';
+
+/** `?page=2&limit=25` on every v2 list (limit 1–100, default 25). */
+export const pageQuery = z.object({
+  page: z.coerce.number().int().min(1).default(1).describe('Page number, from 1'),
+  limit: z.coerce.number().int().min(1).max(100).default(25).describe('Items per page (at most 100)'),
+});
+export type PageQuery = z.infer<typeof pageQuery>;
+
+export const pageMeta = z.object({
+  page: z.number().int(),
+  limit: z.number().int(),
+  total: z.number().int().describe('Items across all pages'),
+  pages: z.number().int().describe('Number of pages (at least 1)'),
+});
+
+/** The response shape of a v2 list: `{ data: [...], meta: { page, limit, total, pages } }`. */
+export const paged = <T extends z.ZodType>(item: T) => z.object({ data: z.array(item), meta: pageMeta });
+
+/** The response shape of a single v2 resource: `{ data: {...} }`. */
+export const single = <T extends z.ZodType>(item: T) => z.object({ data: item });
+
+/** Prisma's skip/take for a page. */
+export const skipTake = ({ page, limit }: PageQuery) => ({ skip: (page - 1) * limit, take: limit });
+
+export function pageOf<T>(data: T[], total: number, { page, limit }: PageQuery) {
+  return { data, meta: { page, limit, total, pages: Math.max(1, Math.ceil(total / limit)) } };
+}

backend/src/v2/resources/events.ts

@@ -0,0 +1,130 @@
+import { z } from 'zod';
+import { defineRoute } from '../route';
+import { notFound } from '../errors';
+import { pageQuery, paged, single, skipTake, pageOf } from '../paging';
+import { absoluteUrl, campusRef, id, idParams, iso, isoDate, seriesRef } from '../schemas';
+import { prisma, campusesEnabled, campusWhere, resolveCampusFilter, publicEventWhere, publicOptions, getEffectiveUnitPrice } from '../legacy';
+
+const eventSummary = z.object({
+  id,
+  title: z.string(),
+  startDate: isoDate,
+  endDate: isoDate,
+  location: z.string().nullable(),
+  price: z.number().describe('The headline price in rand (0 = free)'),
+  pictureUrl: z.string().nullable(),
+  requiresRegistration: z.boolean(),
+  scheduleType: z.enum(['single', 'sessions']),
+  campus: campusRef.nullable().describe('null = for all campuses (or campuses are off)'),
+  series: seriesRef.nullable(),
+});
+
+const ticketOption = z.object({
+  id,
+  name: z.string(),
+  price: z.number().describe('The normal price in rand'),
+  currentPrice: z.number().describe('What it costs now (an early-bird price while one runs)'),
+  isMainTicket: z.boolean(),
+  sessionMode: z.enum(['all', 'pick']).describe('"pick" = the buyer chooses sessions'),
+});
+
+const session = z.object({
+  id,
+  label: z.string().nullable(),
+  startsAt: isoDate,
+  endsAt: isoDate,
+  location: z.string().nullable(),
+  cancelled: z.boolean(),
+});
+
+const eventDetail = eventSummary.extend({
+  description: z.string().nullable(),
+  registrationDeadline: isoDate.nullable(),
+  ticketOptions: z.array(ticketOption),
+  sessions: z.array(session).describe('Multi-day events only; empty otherwise'),
+});
+
+const SUMMARY_SELECT = {
+  id: true, title: true, startDate: true, endDate: true, location: true, price: true, picture: true,
+  requiresRegistration: true, scheduleType: true,
+  campus: { select: { id: true, name: true, slug: true } },
+  series: { select: { id: true, name: true, slug: true } },
+} as const;
+
+type SummaryRow = {
+  id: string; title: string; startDate: Date; endDate: Date; location: string | null; price: number; picture: string | null;
+  requiresRegistration: boolean; scheduleType: 'single' | 'sessions';
+  campus: { id: string; name: string; slug: string } | null; series: { id: string; name: string; slug: string } | null;
+};
+
+const toSummary = (req: Parameters<typeof absoluteUrl>[0], e: SummaryRow): z.input<typeof eventSummary> => ({
+  id: e.id, title: e.title, startDate: iso(e.startDate), endDate: iso(e.endDate), location: e.location ?? null,
+  price: e.price, pictureUrl: absoluteUrl(req, e.picture), requiresRegistration: e.requiresRegistration,
+  scheduleType: e.scheduleType, campus: e.campus ?? null, series: e.series ?? null,
+});
+
+export const listEvents = defineRoute({
+  method: 'get',
+  path: '/events',
+  tag: 'Events',
+  summary: 'Upcoming public events',
+  description: 'Events anyone can see (active, not hidden, live) that have not ended, soonest first.',
+  access: 'public',
+  query: pageQuery.extend({
+    q: z.string().trim().max(100).optional().describe('Search the title'),
+    campus: z.string().max(64).optional().describe("A campus id or slug (its events plus church-wide ones), or 'all' for church-wide events only"),
+    series: z.string().max(120).optional().describe('A series slug'),
+  }),
+  response: paged(eventSummary),
+  async handler({ query, req }) {
+    const now = new Date();
+    const enabled = await campusesEnabled();
+    const and: object[] = [publicEventWhere(now), { endDate: { gte: now } }];
+    if (query.campus) and.push(campusWhere(await resolveCampusFilter(query.campus), { enabled, withAllCampuses: true }));
+    if (query.series) and.push({ series: { slug: query.series } });
+    if (query.q) and.push({ title: { contains: query.q, mode: 'insensitive' } });
+    const where = { AND: and };
+    const [rows, total] = await Promise.all([
+      prisma.event.findMany({ where, select: SUMMARY_SELECT, orderBy: [{ startDate: 'asc' }, { id: 'asc' }], ...skipTake(query) }),
+      prisma.event.count({ where }),
+    ]);
+    return pageOf((rows as SummaryRow[]).map(e => toSummary(req, e)), total, query);
+  },
+});
+
+export const getEvent = defineRoute({
+  method: 'get',
+  path: '/events/:id',
+  tag: 'Events',
+  summary: 'One public event',
+  description: 'With its ticket options (internal kids check-in and volunteer tickets left out) and sessions. Hidden events can be fetched by id (they are unlisted, not private).',
+  access: 'public',
+  params: idParams,
+  response: single(eventDetail),
+  async handler({ params, req }) {
+    const now = new Date();
+    const { isHidden: _hiddenOk, ...visible } = publicEventWhere(now);
+    const e = await prisma.event.findFirst({
+      where: { id: params.id, ...visible },
+      select: {
+        ...SUMMARY_SELECT, description: true, registrationDeadline: true, kidsOptionId: true, volunteerOptionId: true,
+        eventOptions: { include: { earlyBirdTiers: true }, orderBy: [{ isMainTicket: 'desc' }, { name: 'asc' }] },
+        sessions: { orderBy: { startsAt: 'asc' } },
+      },
+    });
+    if (!e) throw notFound('That event');
+    const options = publicOptions(e);
+    return {
+      data: {
+        ...toSummary(req, e as unknown as SummaryRow),
+        description: e.description ?? null,
+        registrationDeadline: iso(e.registrationDeadline),
+        ticketOptions: options.map(o => ({
+          id: o.id, name: o.name, price: o.price, currentPrice: getEffectiveUnitPrice(o, null, now),
+          isMainTicket: o.isMainTicket, sessionMode: o.sessionMode,
+        })),
+        sessions: e.sessions.map(s => ({ id: s.id, label: s.label, startsAt: iso(s.startsAt), endsAt: iso(s.endsAt), location: s.location, cancelled: !!s.cancelledAt })),
+      },
+    };
+  },
+});

backend/src/v2/resources/me.ts

@@ -0,0 +1,58 @@
+import { z } from 'zod';
+import { defineRoute } from '../route';
+import { ApiError } from '../errors';
+import { pageQuery, paged, single, skipTake, pageOf } from '../paging';
+import { id, iso, isoDate } from '../schemas';
+import { prisma } from '../legacy';
+import { registrationSummary, SUMMARY_INCLUDE, toSummary } from './registrations';
+
+const me = z.object({
+  id,
+  name: z.string(),
+  email: z.string(),
+  phone: z.string().nullable(),
+  role: z.enum(['admin', 'supervisor', 'staff', 'user']),
+  twoFactorEnabled: z.boolean(),
+  createdAt: isoDate,
+});
+
+export const getMe = defineRoute({
+  method: 'get',
+  path: '/me',
+  tag: 'Me',
+  summary: 'The signed-in person',
+  access: 'user',
+  response: single(me),
+  async handler({ user }) {
+    const u = await prisma.user.findUnique({
+      where: { id: user!.id },
+      select: { id: true, name: true, email: true, phoneNumber: true, role: true, twoFactorEnabled: true, createdAt: true },
+    });
+    if (!u) throw new ApiError('UNAUTHENTICATED', 'User not found');
+    return { data: { id: u.id, name: u.name, email: u.email, phone: u.phoneNumber ?? null, role: u.role, twoFactorEnabled: !!u.twoFactorEnabled, createdAt: iso(u.createdAt) } };
+  },
+});
+
+export const listMyRegistrations = defineRoute({
+  method: 'get',
+  path: '/me/registrations',
+  tag: 'Me',
+  summary: 'My registrations',
+  description: 'Newest first. By default only ones for events that have not ended, and not cancelled; `past=true` lists everything.',
+  access: 'user',
+  query: pageQuery.extend({
+    past: z.enum(['true', 'false']).default('false').transform(v => v === 'true').describe('Include past and cancelled registrations'),
+  }),
+  response: paged(registrationSummary),
+  async handler({ query, user }) {
+    const now = new Date();
+    const where = query.past
+      ? { userId: user!.id }
+      : { userId: user!.id, status: { not: 'cancelled' as const }, event: { endDate: { gte: now } } };
+    const [rows, total] = await Promise.all([
+      prisma.registration.findMany({ where, include: SUMMARY_INCLUDE, orderBy: [{ createdAt: 'desc' }, { id: 'desc' }], ...skipTake(query) }),
+      prisma.registration.count({ where }),
+    ]);
+    return pageOf(rows.map(r => toSummary(r, now)), total, query);
+  },
+});

backend/src/v2/resources/registrations.ts

@@ -0,0 +1,187 @@
+import { z } from 'zod';
+import { defineRoute, type ApiUser } from '../route';
+import { ApiError, notFound } from '../errors';
+import { single } from '../paging';
+import { eventRef, id, idParams, iso, isoDate } from '../schemas';
+import { prisma, computeRegistrationTotalDue } from '../legacy';
+import { createRegistration, cancelRegistration } from '../../services/registrations';
+import { startRegistrationCheckout } from '../../services/payments';
+
+const STATUSES = ['pending', 'confirmed', 'partial_paid', 'paid', 'cancelled'] as const;
+
+/** A registration as v2 shows it to its owner. Also used by GET /me/registrations. */
+export const registrationSummary = z.object({
+  id,
+  status: z.enum(STATUSES),
+  createdAt: isoDate,
+  event: eventRef,
+  items: z.array(z.object({
+    ticket: z.string(),
+    variant: z.string().nullable(),
+    quantity: z.number().int(),
+    unitPrice: z.number(),
+  })),
+  totalDue: z.number().describe('In rand, after discounts'),
+  amountPaid: z.number().describe('In rand (refunds subtracted)'),
+  balance: z.number().describe('totalDue − amountPaid; 0 or less = nothing owing'),
+});
+
+const r2 = (n: number) => Math.round(n * 100) / 100;
+
+export const SUMMARY_INCLUDE = {
+  event: { select: { id: true, title: true, startDate: true, endDate: true } },
+  registrationOptions: { include: { eventOption: { include: { earlyBirdTiers: true } }, variant: { select: { name: true, price: true } }, tranches: true } },
+  payments: { select: { amount: true, createdAt: true } },
+} as const;
+
+type SummaryRow = {
+  id: string; status: (typeof STATUSES)[number]; createdAt: Date;
+  event: { id: string; title: string; startDate: Date; endDate: Date };
+  registrationOptions: { quantity: number; priceSnapshot: number | null; eventOption: { name: string; price: number } | null; variant: { name: string } | null }[];
+  payments: { amount: number }[];
+};
+
+export function toSummary(r: SummaryRow, now = new Date()): z.input<typeof registrationSummary> {
+  const totalDue = r2(computeRegistrationTotalDue(r, now));
+  const amountPaid = r2(r.payments.reduce((s, p) => s + p.amount, 0));
+  return {
+    id: r.id,
+    status: r.status,
+    createdAt: iso(r.createdAt),
+    event: { id: r.event.id, title: r.event.title, startDate: iso(r.event.startDate), endDate: iso(r.event.endDate) },
+    items: r.registrationOptions.map(o => ({ ticket: o.eventOption?.name ?? '', variant: o.variant?.name ?? null, quantity: o.quantity, unitPrice: o.priceSnapshot ?? o.eventOption?.price ?? 0 })),
+    totalDue,
+    amountPaid,
+    balance: r2(totalDue - amountPaid),
+  };
+}
+
+/** The owner's registration (admins may see anyone's); others get NOT_FOUND, not a hint it exists. */
+async function ownRegistration(registrationId: string, user: ApiUser) {
+  const r = await prisma.registration.findUnique({ where: { id: registrationId }, include: SUMMARY_INCLUDE });
+  if (!r || (r.userId !== user.id && user.role !== 'admin')) throw notFound('That registration');
+  return r;
+}
+
+const attendee = z.object({
+  eventOptionId: id,
+  variantId: id.nullish(),
+  name: z.string().trim().min(1).max(200),
+  email: z.string().trim().max(200).nullish(),
+  phone: z.string().trim().max(40).nullish(),
+  dateOfBirth: z.string().max(40).nullish().describe('YYYY-MM-DD (youth events)'),
+  gender: z.string().max(20).nullish(),
+  parentName: z.string().max(200).nullish(),
+  parentEmail: z.string().max(200).nullish(),
+  parentPhone: z.string().max(40).nullish(),
+});
+
+export const register = defineRoute({
+  method: 'post',
+  path: '/registrations',
+  tag: 'Registrations',
+  summary: 'Register for an event',
+  description: [
+    'Signed in, or as a guest for a free event that allows it (`guest` then required), or with a waitlist link (`waitlistToken`).',
+    'Registering again for the same event adds to the existing registration. When nothing is owed it is marked paid and tickets are issued; otherwise pay with `POST /registrations/{id}/checkout`.',
+    'A coupon that was valid when checked but used up a moment later is reported in `couponError`; the registration is still made.',
+  ].join('\n\n'),
+  access: 'optional',
+  status: 201,
+  body: z.object({
+    eventId: id,
+    options: z.array(z.object({
+      eventOptionId: id,
+      quantity: z.number().int().min(1).max(1000),
+      variantId: id.nullish(),
+      sessionIds: z.array(id).max(200).optional().describe('"Pick sessions" tickets: the sessions chosen'),
+    })).min(1).max(50),
+    guest: z.object({ name: z.string().trim().min(1).max(200), email: z.email().max(200), phone: z.string().trim().max(40).optional() }).optional(),
+    couponCode: z.string().trim().max(60).optional(),
+    attendees: z.array(attendee).max(500).optional().describe('Names for the places (events that collect them)'),
+    ticketDelivery: z.enum(['payer', 'each']).optional().describe('With attendees: tickets to the payer, or to each attendee'),
+    waitlistToken: z.string().max(200).optional(),
+    analyticsSessionId: z.string().max(100).optional(),
+  }),
+  response: single(registrationSummary.extend({
+    isNew: z.boolean().describe('false = added to an existing registration'),
+    couponError: z.string().nullable(),
+  })),
+  async handler({ body, user }) {
+    const { registration, isNew, couponError } = await createRegistration({
+      eventId: body.eventId,
+      options: body.options.map(o => ({ ...o, variantId: o.variantId ?? null })),
+      guestName: body.guest?.name,
+      guestEmail: body.guest?.email,
+      guestPhone: body.guest?.phone,
+      couponCode: body.couponCode,
+      attendees: body.attendees,
+      ticketDelivery: body.ticketDelivery,
+      waitlistToken: body.waitlistToken,
+      analyticsSessionId: body.analyticsSessionId,
+    }, user ? { id: user.id, role: user.role, email: user.email } : null);
+    const fresh = await prisma.registration.findUniqueOrThrow({ where: { id: registration.id }, include: SUMMARY_INCLUDE });
+    return { data: { ...toSummary(fresh), isNew, couponError } };
+  },
+});
+
+export const getRegistration = defineRoute({
+  method: 'get',
+  path: '/registrations/:id',
+  tag: 'Registrations',
+  summary: 'One of my registrations',
+  access: 'user',
+  params: idParams,
+  response: single(registrationSummary),
+  async handler({ params, user }) {
+    return { data: toSummary(await ownRegistration(params.id, user!)) };
+  },
+});
+
+export const cancel = defineRoute({
+  method: 'post',
+  path: '/registrations/:id/cancel',
+  tag: 'Registrations',
+  summary: 'Cancel my registration',
+  description: 'Not after the event has ended, and not once anything has been paid (the church can do that). Its places go to the waitlist.',
+  access: 'user',
+  params: idParams,
+  response: single(registrationSummary),
+  async handler({ params, user, req }) {
+    await ownRegistration(params.id, user!);
+    const { getClientIp } = require('../../utils/requestUtils') as { getClientIp(req: unknown): string };
+    await cancelRegistration(params.id, user!, getClientIp(req));
+    return { data: toSummary(await ownRegistration(params.id, user!)) };
+  },
+});
+
+export const checkout = defineRoute({
+  method: 'post',
+  path: '/registrations/:id/checkout',
+  tag: 'Registrations',
+  summary: 'Pay what I owe online',
+  description: [
+    'Starts a payment with the church\'s provider (Yoco or PayFast) and returns where to send the person (`redirectUrl`).',
+    'If an early-bird price ran out since the registration was made, nothing is started: `priceUpdated` is true with the new amount owing — show it, then call again.',
+  ].join('\n\n'),
+  access: 'user',
+  params: idParams,
+  body: z.object({
+    donationAmount: z.number().min(0).max(100000).optional().describe('An optional donation added on top, in rand'),
+    provider: z.string().max(40).optional().describe('yoco or payfast (default: the first one switched on)'),
+    successUrl: z.url().max(2000).optional(),
+    cancelUrl: z.url().max(2000).optional(),
+    failureUrl: z.url().max(2000).optional(),
+  }),
+  response: single(z.discriminatedUnion('priceUpdated', [
+    z.object({ priceUpdated: z.literal(true), newBalance: z.number(), message: z.string() }),
+    z.object({ priceUpdated: z.literal(false), checkoutId: z.string(), redirectUrl: z.string(), provider: z.string(), amount: z.number().describe('Charged now, in rand (with any donation)') }),
+  ])),
+  async handler({ params, body, user }) {
+    await ownRegistration(params.id, user!);
+    const result = await startRegistrationCheckout(params.id, user!, body);
+    if (result.priceUpdated) return { data: { priceUpdated: true as const, newBalance: result.newTotal, message: result.message } };
+    if (!result.redirectUrl) throw new ApiError('INTERNAL', 'The payment provider did not return a payment page.');
+    return { data: { priceUpdated: false as const, checkoutId: result.checkoutId, redirectUrl: result.redirectUrl, provider: result.provider, amount: result.amount } };
+  },
+});

backend/src/v2/route.ts

@@ -0,0 +1,105 @@
+import type { Request, RequestHandler, Response, Router } from 'express';
+import { z } from 'zod';
+import { ApiError } from './errors';
+import auth from '../middleware/authMiddleware';
+
+/**
+ * Every /api/v2 endpoint is declared with `defineRoute`: method, path, who may call it, and zod
+ * schemas for the params, query, body and response. The same declaration
+ *   - validates the request (400 VALIDATION_FAILED with per-field messages),
+ *   - checks the response against its schema and strips anything it doesn't list (so a field
+ *     can't leak by being added to a Prisma include), and
+ *   - becomes the OpenAPI document (openapi.ts) — the docs can't drift from the code.
+ */
+
+export type Access = 'public' | 'optional' | 'user' | 'staff' | 'supervisor' | 'admin';
+
+/** The signed-in person, as the auth middleware puts it on the request. */
+export type ApiUser = { id: string; name: string; email: string; role: 'admin' | 'supervisor' | 'staff' | 'user' };
+
+export type Ctx<P, Q, B> = {
+  params: P;
+  query: Q;
+  body: B;
+  user: ApiUser | null;
+  req: Request;
+  res: Response;
+};
+
+type Schema = z.ZodType;
+type Infer<S> = S extends z.ZodType ? z.infer<S> : undefined;
+
+export type RouteDef<P extends Schema | undefined, Q extends Schema | undefined, B extends Schema | undefined, R extends Schema> = {
+  method: 'get' | 'post' | 'put' | 'patch' | 'delete';
+  /** Express-style, relative to /api/v2: "/events/:id". */
+  path: string;
+  summary: string;
+  description?: string;
+  tag: string;
+  access: Access;
+  /**
+   * Staff and supervisor routes must say how they treat campus-scoped staff (see
+   * utils/campusScope.js and tests/campusScopeRoutes.test.js) — e.g. "scopeEvent(params.id)".
+   */
+  campusScope?: string;
+  params?: P;
+  query?: Q;
+  body?: B;
+  response: R;
+  /** HTTP status on success (default 200). */
+  status?: number;
+  handler: (ctx: Ctx<Infer<P>, Infer<Q>, Infer<B>>) => Promise<z.input<R>> | z.input<R>;
+};
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export type AnyRoute = RouteDef<any, any, any, any>;
+
+export const routes: AnyRoute[] = [];
+
+const ACCESS: Record<Access, RequestHandler[]> = {
+  public: [],
+  optional: [auth.optionalAuth],
+  user: [auth.protect],
+  staff: [auth.protect, auth.staff],
+  supervisor: [auth.protect, auth.supervisor],
+  admin: [auth.protect, auth.admin],
+};
+
+export function defineRoute<P extends Schema | undefined, Q extends Schema | undefined, B extends Schema | undefined, R extends Schema>(def: RouteDef<P, Q, B, R>): RouteDef<P, Q, B, R> {
+  if ((def.access === 'staff' || def.access === 'supervisor') && !def.campusScope) {
+    throw new Error(`${def.method.toUpperCase()} /api/v2${def.path}: staff and supervisor routes must declare campusScope`);
+  }
+  routes.push(def as AnyRoute);
+  return def;
+}
+
+const parse = <S extends Schema | undefined>(schema: S, value: unknown): Infer<S> =>
+  (schema ? schema.parse(value) : undefined) as Infer<S>;
+
+/** Adds every defined route to the router. */
+export function mount(router: Router, list: AnyRoute[] = routes): void {
+  for (const def of list) {
+    const run: RequestHandler = async (req, res, next) => {
+      try {
+        const ctx = {
+          params: parse(def.params, req.params),
+          query: parse(def.query, req.query),
+          body: parse(def.body, req.body ?? {}),
+          user: (req as Request & { user?: ApiUser }).user ?? null,
+          req,
+          res,
+        };
+        const result = await def.handler(ctx);
+        const checked = def.response.safeParse(result);
+        if (!checked.success) {
+          console.error(`[api/v2] ${def.method.toUpperCase()} ${def.path}: response doesn't match its schema`, checked.error.issues);
+          throw new ApiError('INTERNAL', 'Something went wrong on the server.');
+        }
+        res.status(def.status ?? 200).json(checked.data);
+      } catch (err) {
+        next(err);
+      }
+    };
+    router[def.method](def.path, ...ACCESS[def.access], run);
+  }
+}

backend/src/v2/schemas.ts

@@ -0,0 +1,27 @@
+import { z } from 'zod';
+import type { Request } from 'express';
+
+/** Shared pieces of v2 schemas. Dates go out as ISO 8601 strings (UTC). */
+
+export const isoDate = z.iso.datetime();
+export const id = z.string().min(1).max(64);
+export const idParams = z.object({ id: id.describe('The id') });
+
+/** A Date (or date string) as ISO 8601, for building responses. */
+export function iso(d: Date | string): string;
+export function iso(d: Date | string | null | undefined): string | null;
+export function iso(d: Date | string | null | undefined): string | null {
+  return d == null ? null : new Date(d).toISOString();
+}
+
+/** A stored picture path ("/uploads/…") as an absolute URL on the host the request came to. */
+export function absoluteUrl(req: Request, url: string | null | undefined): string | null {
+  const raw = String(url || '').trim();
+  if (!raw) return null;
+  if (/^https?:\/\//.test(raw)) return raw;
+  return `${req.protocol}://${req.get('host')}${raw.startsWith('/') ? '' : '/'}${raw}`;
+}
+
+export const campusRef = z.object({ id, name: z.string(), slug: z.string() });
+export const seriesRef = z.object({ id, name: z.string(), slug: z.string() });
+export const eventRef = z.object({ id, title: z.string(), startDate: isoDate, endDate: isoDate });

backend/tests/adminAudit.test.js

@@ -0,0 +1,40 @@
+jest.mock('../src/config/db', () => ({}));
+
+const { auditLogWhere } = require('../src/utils/adminAudit');
+
+describe('auditLogWhere', () => {
+  test('no filters → everything', () => {
+    expect(auditLogWhere({})).toEqual({});
+  });
+
+  test('a "to" date includes that whole day', () => {
+    const where = auditLogWhere({ from: '2026-10-01', to: '2026-10-28' });
+    expect(where.createdAt.gte).toEqual(new Date('2026-10-01T00:00:00'));
+    expect(where.createdAt.lt).toEqual(new Date('2026-10-29T00:00:00'));
+    expect(where.createdAt.lte).toBeUndefined();
+  });
+
+  test('a full timestamp is used as given', () => {
+    const where = auditLogWhere({ to: '2026-10-28T10:00:00.000Z' });
+    expect(where.createdAt.lte).toEqual(new Date('2026-10-28T10:00:00.000Z'));
+  });
+
+  test('action and role filter exactly', () => {
+    expect(auditLogWhere({ action: 'refund_created', role: 'supervisor' })).toEqual({ action: 'refund_created', actorRole: 'supervisor' });
+  });
+
+  test('search looks at the person, the target and the IP', () => {
+    const where = auditLogWhere({ search: '  #ab12  ' });
+    expect(where.OR).toEqual([
+      { actor: { name: { contains: '#ab12', mode: 'insensitive' } } },
+      { actor: { email: { contains: '#ab12', mode: 'insensitive' } } },
+      { targetType: { contains: '#ab12', mode: 'insensitive' } },
+      { targetId: { startsWith: 'ab12' } },
+      { ip: { startsWith: '#ab12' } },
+    ]);
+  });
+
+  test('a blank search is ignored', () => {
+    expect(auditLogWhere({ search: '   ' }).OR).toBeUndefined();
+  });
+});

backend/tests/v2.test.ts

@@ -0,0 +1,239 @@
+import express from 'express';
+import request from 'supertest';
+
+// /api/v2 (1.51.0): the route declarations validate requests, shape responses and errors the same
+// way everywhere, and produce the OpenAPI document.
+
+const mockDb = {
+  event: { findMany: jest.fn(), count: jest.fn(), findFirst: jest.fn() },
+  user: { findUnique: jest.fn() },
+  registration: { findMany: jest.fn(), count: jest.fn(), findUnique: jest.fn(), findUniqueOrThrow: jest.fn() },
+};
+jest.mock('../src/config/db', () => mockDb);
+jest.mock('../src/utils/campuses', () => ({
+  campusesEnabled: jest.fn().mockResolvedValue(false),
+  resolveCampusFilter: jest.fn(async (v: string) => v),
+  campusWhere: jest.fn(() => ({})),
+}));
+
+// Signed in as whoever the test says (the real middleware checks JWTs against the database).
+let signedIn: { id: string; role: string } | null = null;
+jest.mock('../src/middleware/authMiddleware', () => {
+  const deny = (status: number, message: string) => (_req: unknown, res: { status(n: number): void }, next: (e: Error) => void) => { res.status(status); next(new Error(message)); };
+  return {
+    protect: (req: { user?: unknown }, res: { status(n: number): void }, next: (e?: Error) => void) => (signedIn ? ((req.user = signedIn), next()) : deny(401, 'Not authorized, no token')(req, res, next as (e: Error) => void)),
+    optionalAuth: (req: { user?: unknown }, _res: unknown, next: () => void) => { if (signedIn) req.user = signedIn; next(); },
+    admin: (req: { user?: { role: string } }, res: { status(n: number): void }, next: (e?: Error) => void) => (req.user?.role === 'admin' ? next() : deny(403, 'Not authorized as an admin')(req, res, next as (e: Error) => void)),
+    staff: jest.fn(), supervisor: jest.fn(),
+  };
+});
+
+// The services are tested through v1 (e2e); here only how v2 calls them and maps their answers.
+const mockServices = { createRegistration: jest.fn(), cancelRegistration: jest.fn(), startRegistrationCheckout: jest.fn() };
+jest.mock('../src/services/registrations', () => ({ createRegistration: (...a: unknown[]) => mockServices.createRegistration(...a), cancelRegistration: (...a: unknown[]) => mockServices.cancelRegistration(...a) }));
+jest.mock('../src/services/payments', () => ({ startRegistrationCheckout: (...a: unknown[]) => mockServices.startRegistrationCheckout(...a) }));
+
+import { v2Router } from '../src/v2';
+import { ServiceError } from '../src/services/errors';
+import { routes } from '../src/v2/route';
+import { buildOpenApi } from '../src/v2/openapi';
+
+const app = express();
+app.use(express.json());
+app.use('/api/v2', v2Router());
+
+const event = (over: Record<string, unknown> = {}) => ({
+  id: 'e1', title: 'Youth Camp', startDate: new Date('2026-12-04T16:00:00Z'), endDate: new Date('2026-12-06T12:00:00Z'),
+  location: 'Camp Joy', price: 600, picture: '/uploads/events/camp.jpg', requiresRegistration: true, scheduleType: 'single',
+  campus: null, series: { id: 's1', name: 'Camps', slug: 'camps' }, ...over,
+});
+
+beforeEach(() => { signedIn = null; jest.clearAllMocks(); });
+
+describe('GET /api/v2/events', () => {
+  test('a page of public events, with meta and ISO dates', async () => {
+    mockDb.event.findMany.mockResolvedValue([event()]);
+    mockDb.event.count.mockResolvedValue(31);
+    const res = await request(app).get('/api/v2/events?page=2&limit=10&q=camp');
+    expect(res.status).toBe(200);
+    expect(res.body.meta).toEqual({ page: 2, limit: 10, total: 31, pages: 4 });
+    expect(res.body.data[0]).toMatchObject({ id: 'e1', startDate: '2026-12-04T16:00:00.000Z', series: { slug: 'camps' } });
+    expect(res.body.data[0].pictureUrl).toMatch(/^http:\/\/127\.0\.0\.1:\d+\/uploads\/events\/camp\.jpg$/);
+    const args = mockDb.event.findMany.mock.calls[0][0];
+    expect(args).toMatchObject({ skip: 10, take: 10 });
+    expect(args.where.AND).toEqual(expect.arrayContaining([{ isActive: true, isHidden: false, goLiveAt: { lte: expect.any(Date) } }, { title: { contains: 'camp', mode: 'insensitive' } }]));
+  });
+
+  test('fields the schema does not list are never sent', async () => {
+    mockDb.event.findMany.mockResolvedValue([event({ cashupStatus: 'closed', createdById: 'u9' })]);
+    mockDb.event.count.mockResolvedValue(1);
+    const res = await request(app).get('/api/v2/events');
+    expect(Object.keys(res.body.data[0]).sort()).toEqual(['campus', 'endDate', 'id', 'location', 'pictureUrl', 'price', 'requiresRegistration', 'scheduleType', 'series', 'startDate', 'title']);
+  });
+
+  test('a bad query is a VALIDATION_FAILED error naming the field', async () => {
+    const res = await request(app).get('/api/v2/events?limit=500&page=0');
+    expect(res.status).toBe(400);
+    expect(res.body.error.code).toBe('VALIDATION_FAILED');
+    expect(Object.keys(res.body.error.fields).sort()).toEqual(['limit', 'page']);
+    expect(mockDb.event.findMany).not.toHaveBeenCalled();
+  });
+});
+
+describe('GET /api/v2/events/:id', () => {
+  test('leaves out kids and volunteer tickets and shows the early-bird price now', async () => {
+    mockDb.event.findFirst.mockResolvedValue({
+      ...event(), description: 'A weekend away', registrationDeadline: null, kidsOptionId: 'kids', volunteerOptionId: null,
+      eventOptions: [
+        { id: 'o1', name: 'Camper', price: 600, isMainTicket: true, sessionMode: 'all', earlyBirdTiers: [{ id: 't', price: 500, deadline: new Date(Date.now() + 864e5), stockLimit: 0 }] },
+        { id: 'kids', name: 'Kids check-in', price: 0, isMainTicket: false, sessionMode: 'all', earlyBirdTiers: [] },
+      ],
+      sessions: [],
+    });
+    const res = await request(app).get('/api/v2/events/e1');
+    expect(res.status).toBe(200);
+    expect(res.body.data.ticketOptions).toEqual([{ id: 'o1', name: 'Camper', price: 600, currentPrice: 500, isMainTicket: true, sessionMode: 'all' }]);
+  });
+
+  test('an unknown or private event is NOT_FOUND', async () => {
+    mockDb.event.findFirst.mockResolvedValue(null);
+    const res = await request(app).get('/api/v2/events/nope');
+    expect(res.status).toBe(404);
+    expect(res.body).toEqual({ error: { code: 'NOT_FOUND', message: "That event wasn't found." } });
+  });
+});
+
+describe('me', () => {
+  test('signed out is UNAUTHENTICATED in the v2 shape', async () => {
+    const res = await request(app).get('/api/v2/me');
+    expect(res.status).toBe(401);
+    expect(res.body.error.code).toBe('UNAUTHENTICATED');
+  });
+
+  test('my registrations with totals and what is owing', async () => {
+    signedIn = { id: 'u1', role: 'user' };
+    mockDb.registration.findMany.mockResolvedValue([{
+      id: 'r1', status: 'partial_paid', createdAt: new Date('2026-10-01T10:00:00Z'), discountTotal: 0,
+      event: { id: 'e1', title: 'Youth Camp', startDate: new Date('2026-12-04T16:00:00Z'), endDate: new Date('2026-12-06T12:00:00Z') },
+      registrationOptions: [{ quantity: 2, priceSnapshot: 600, eventOption: { name: 'Camper', price: 600, earlyBirdTiers: [] }, variant: null, tranches: [] }],
+      payments: [{ amount: 500, createdAt: new Date() }],
+    }]);
+    mockDb.registration.count.mockResolvedValue(1);
+    const res = await request(app).get('/api/v2/me/registrations');
+    expect(res.status).toBe(200);
+    expect(res.body.data[0]).toMatchObject({ id: 'r1', totalDue: 1200, amountPaid: 500, balance: 700, items: [{ ticket: 'Camper', variant: null, quantity: 2, unitPrice: 600 }] });
+    expect(mockDb.registration.findMany.mock.calls[0][0].where).toMatchObject({ userId: 'u1', status: { not: 'cancelled' } });
+  });
+});
+
+describe('the API description', () => {
+  test('openapi.json is for admins', async () => {
+    signedIn = { id: 'u1', role: 'user' };
+    expect((await request(app).get('/api/v2/openapi.json')).body.error.code).toBe('FORBIDDEN');
+    signedIn = { id: 'a1', role: 'admin' };
+    const res = await request(app).get('/api/v2/openapi.json');
+    expect(res.status).toBe(200);
+    expect(res.body.openapi).toBe('3.1.0');
+  });
+
+  test('every route is described, with its parameters, auth and response', () => {
+    const doc = buildOpenApi({ version: 'test' });
+    for (const r of routes) {
+      const op = (doc.paths as Record<string, Record<string, Record<string, unknown>>>)[r.path.replace(/:(\w+)/g, '{$1}')][r.method];
+      expect(op).toBeDefined();
+      expect(op.responses).toHaveProperty(String(r.status ?? 200));
+    }
+    const list = doc.paths['/events'].get as { parameters: { name: string; in: string }[]; security?: unknown };
+    expect(list.parameters.map(p => p.name)).toEqual(['page', 'limit', 'q', 'campus', 'series']);
+    expect(list.security).toBeUndefined();
+    expect((doc.paths['/me'].get as { security: unknown }).security).toEqual([{ bearerAuth: [] }]);
+    expect((doc.paths['/events/{id}'].get as { parameters: { name: string; in: string; required: boolean }[] }).parameters[0]).toMatchObject({ name: 'id', in: 'path', required: true });
+  });
+
+  test('an unknown v2 path is a v2 NOT_FOUND', async () => {
+    const res = await request(app).get('/api/v2/nothing-here');
+    expect(res.status).toBe(404);
+    expect(res.body.error.code).toBe('NOT_FOUND');
+  });
+});
+
+describe('registrations', () => {
+  const row = (over: Record<string, unknown> = {}) => ({
+    id: 'r1', userId: 'u1', status: 'pending', createdAt: new Date('2026-10-01T10:00:00Z'), discountTotal: 0,
+    event: { id: 'e1', title: 'Youth Camp', startDate: new Date('2026-12-04T16:00:00Z'), endDate: new Date('2026-12-06T12:00:00Z') },
+    registrationOptions: [{ quantity: 1, priceSnapshot: 600, eventOption: { name: 'Camper', price: 600, earlyBirdTiers: [] }, variant: null, tranches: [] }],
+    payments: [], ...over,
+  });
+
+  test('registering passes a guest through and answers 201 with what is owing', async () => {
+    mockServices.createRegistration.mockResolvedValue({ registration: { id: 'r1' }, isNew: true, couponError: null });
+    mockDb.registration.findUniqueOrThrow.mockResolvedValue(row());
+    const res = await request(app).post('/api/v2/registrations').send({
+      eventId: 'e1', options: [{ eventOptionId: 'o1', quantity: 1 }], guest: { name: 'Thandi', email: 'thandi@example.com' },
+    });
+    expect(res.status).toBe(201);
+    expect(res.body.data).toMatchObject({ id: 'r1', isNew: true, couponError: null, totalDue: 600, balance: 600 });
+    expect(mockServices.createRegistration).toHaveBeenCalledWith(expect.objectContaining({ eventId: 'e1', guestName: 'Thandi', guestEmail: 'thandi@example.com' }), null);
+  });
+
+  test('a bad body never reaches the service', async () => {
+    const res = await request(app).post('/api/v2/registrations').send({ eventId: 'e1', options: [{ eventOptionId: 'o1', quantity: 0 }], guest: { name: 'T', email: 'not-an-email' } });
+    expect(res.status).toBe(400);
+    expect(Object.keys(res.body.error.fields).sort()).toEqual(['guest.email', 'options.0.quantity']);
+    expect(mockServices.createRegistration).not.toHaveBeenCalled();
+  });
+
+  test("the service's errors keep their meaning", async () => {
+    mockServices.createRegistration.mockRejectedValueOnce(new ServiceError(401, 'Authentication required for this event'));
+    const res = await request(app).post('/api/v2/registrations').send({ eventId: 'e1', options: [{ eventOptionId: 'o1', quantity: 1 }] });
+    expect(res.status).toBe(401);
+    expect(res.body.error).toEqual({ code: 'UNAUTHENTICATED', message: 'Authentication required for this event' });
+
+    mockServices.createRegistration.mockRejectedValueOnce(new ServiceError(400, '"Camper" is sold out or does not have enough stock (0 remaining).'));
+    const sold = await request(app).post('/api/v2/registrations').send({ eventId: 'e1', options: [{ eventOptionId: 'o1', quantity: 1 }] });
+    expect(sold.body.error.code).toBe('VALIDATION_FAILED');
+  });
+
+  test("someone else's registration is NOT_FOUND, and can't be cancelled or paid", async () => {
+    signedIn = { id: 'u2', role: 'user' };
+    mockDb.registration.findUnique.mockResolvedValue(row());
+    for (const [method, path] of [['get', '/api/v2/registrations/r1'], ['post', '/api/v2/registrations/r1/cancel'], ['post', '/api/v2/registrations/r1/checkout']] as const) {
+      const res = await request(app)[method](path).send({});
+      expect([path, res.status]).toEqual([path, 404]);
+    }
+    expect(mockServices.cancelRegistration).not.toHaveBeenCalled();
+    expect(mockServices.startRegistrationCheckout).not.toHaveBeenCalled();
+  });
+
+  test('cancelling my registration', async () => {
+    signedIn = { id: 'u1', role: 'user' };
+    mockDb.registration.findUnique.mockResolvedValueOnce(row()).mockResolvedValueOnce(row({ status: 'cancelled' }));
+    mockServices.cancelRegistration.mockResolvedValue({});
+    const res = await request(app).post('/api/v2/registrations/r1/cancel');
+    expect(res.status).toBe(200);
+    expect(res.body.data.status).toBe('cancelled');
+  });
+
+  test('checkout: the payment page, or the new balance when an early-bird price ran out', async () => {
+    signedIn = { id: 'u1', role: 'user' };
+    mockDb.registration.findUnique.mockResolvedValue(row());
+    mockServices.startRegistrationCheckout.mockResolvedValueOnce({ checkoutId: 'c1', redirectUrl: 'https://pay.example/c1', provider: 'yoco', amount: 650, registration: {} });
+    const pay = await request(app).post('/api/v2/registrations/r1/checkout').send({ donationAmount: 50 });
+    expect(pay.body.data).toEqual({ priceUpdated: false, checkoutId: 'c1', redirectUrl: 'https://pay.example/c1', provider: 'yoco', amount: 650 });
+    expect(mockServices.startRegistrationCheckout).toHaveBeenCalledWith('r1', signedIn, { donationAmount: 50 });
+
+    mockServices.startRegistrationCheckout.mockResolvedValueOnce({ priceUpdated: true, newTotal: 700, message: 'Prices changed' });
+    const changed = await request(app).post('/api/v2/registrations/r1/checkout').send({});
+    expect(changed.body.data).toEqual({ priceUpdated: true, newBalance: 700, message: 'Prices changed' });
+  });
+});
+
+describe('the frontend types', () => {
+  test('frontend/src/lib/api-v2/openapi.json is up to date (run `npm run api:types` in the repo root)', () => {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const { OPENAPI_FILE, currentDocument } = require('../scripts/openapi');
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const saved = require('fs').readFileSync(OPENAPI_FILE, 'utf8').replace(/\r\n/g, '\n');
+    expect(saved).toBe(currentDocument());
+  });
+});

backend/tests/webhooks.test.js

@@ -3,8 +3,12 @@ const mockDb = {
   webhookDelivery: { updateMany: jest.fn(), findUnique: jest.fn(), update: jest.fn(), create: jest.fn(), findMany: jest.fn(), deleteMany: jest.fn() },
   user: { findUnique: jest.fn() },
   registration: { findUnique: jest.fn() },
+  payment: { findUnique: jest.fn() },
+  ticketUsage: { findUnique: jest.fn() },
+  event: { findUnique: jest.fn() },
 };
 jest.mock('../src/config/db', () => mockDb);
+jest.mock('../src/utils/pricing', () => ({ computeRegistrationTotalDue: () => 1200 }));
 
 const crypto = require('crypto');
 const webhooks = require('../src/utils/webhooks');
@@ -112,4 +116,25 @@ describe('outbound webhooks', () => {
     expect(made[0].eventId).toBe(made[1].eventId);
     expect(made[0].payload.data.person).toMatchObject({ id: 'u1', email: 't@test.local' });
   });
+  // The examples shown in Site settings → Webhooks must have the same shape as what is sent.
+  test('each event type has an example shaped like the real payload', async () => {
+    const shape = (v) => (v && typeof v === 'object' && !(v instanceof Date) && !Array.isArray(v)
+      ? Object.fromEntries(Object.keys(v).sort().map(k => [k, shape(v[k])]))
+      : Array.isArray(v) ? v.map(shape) : '·');
+    const ev = { id: 'e1', title: 'Camp', startDate: new Date(), endDate: new Date(), kidsOptionId: null, volunteerOptionId: null };
+    const user = { id: 'u1', name: 'T', email: 't@x', phoneNumber: '+27' };
+    const reg = (status) => ({ id: 'r1', status, createdAt: new Date(), userId: 'u1', seasonPassPurchaseId: null, event: ev, user, payments: [{ amount: 1200 }],
+      registrationOptions: [{ eventOptionId: 'o1', quantity: 2, priceSnapshot: 600, eventOption: { id: 'o1', name: 'Camper' }, variant: { name: 'Bunk' }, tranches: [] }] });
+    mockDb.payment.findUnique.mockResolvedValue({ id: 'p1', amount: 1200, method: 'card', provider: 'yoco', isDonation: false, registrationId: 'r1', createdAt: new Date(), userId: 'u1', user, event: ev });
+    mockDb.ticketUsage.findUnique.mockResolvedValue({ id: 't1', scannedAt: new Date(), quantityRedeemed: 1, manual: false, offline: false, session: { id: 's1', label: 'Fri', startsAt: new Date() },
+      ticket: { id: 'k1', userId: 'u1', registrationOptionId: 'o1', event: ev, user, holder: null, attendee: { name: 'T' }, registrationOption: { eventOptionId: 'o1' } } });
+    mockDb.user.findUnique.mockResolvedValue({ ...user, role: 'user', createdAt: new Date() });
+    mockDb.event.findUnique.mockResolvedValue({ ...ev, description: 'd', location: 'l', price: 600, isActive: true, isHidden: false, goLiveAt: new Date(), campus: { name: 'N', slug: 'n' }, series: null });
+    for (const t of webhooks.EVENT_TYPES) {
+      const status = { 'registration.paid': 'paid', 'registration.cancelled': 'cancelled' }[t.type] || 'pending';
+      mockDb.registration.findUnique.mockResolvedValue(reg(status));
+      const built = await webhooks.buildPayload(t.type, 'x');
+      expect([t.type, shape(t.example)]).toEqual([t.type, shape(built.data)]);
+    }
+  });
 });

backend/tsconfig.json

@@ -0,0 +1,25 @@
+{
+  // The backend is moving to TypeScript a file at a time (1.51.0): .js files are compiled as they
+  // are (not type-checked), .ts files are checked strictly. `npm run build` writes dist/, which is
+  // what production runs (dist/index.js); dev and the e2e tests run src/ through tsx.
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "commonjs",
+    "moduleResolution": "node",
+    "lib": ["ES2023"],
+    "rootDir": "src",
+    "outDir": "dist",
+    "allowJs": true,
+    "checkJs": false,
+    "strict": true,
+    "noImplicitOverride": true,
+    "noFallthroughCasesInSwitch": true,
+    "esModuleInterop": true,
+    "resolveJsonModule": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "sourceMap": true,
+    "types": ["node", "jest"]
+  },
+  "include": ["src"]
+}

docs/HANDOVER.md

@@ -1,6 +1,6 @@
 # Handover — where things stand and how to carry on
 
-Last updated: 2026-10-28, after **1.50.0** (and Hub 1.5.0). The plan itself is in
+Last updated: 2026-10-29, after **1.51.1** (and Hub 1.5.0). The plan itself is in
 [ROADMAP-v2.md](./ROADMAP-v2.md) (decisions table at the end); the previous round of
 features is in [FEATURES-ROUND-1.md](./FEATURES-ROUND-1.md).
 
@@ -14,6 +14,10 @@ encrypted settings unreadable or break existing installs.
 
 | Version | What |
 |---------|------|
+| 1.51.1 | **v2 registrations and payments**: register, get, cancel, checkout; create/cancel moved to `src/services/registrations.ts`, online checkout to `src/services/payments.ts` (v1 uses them too); typed frontend calls (`apiV2`, `npm run api:types`); register page, Pay now and My Events cancel on v2 |
+| 1.51.0 | **TypeScript backend + `/api/v2` foundations** (§14): tsconfig (`allowJs`), build to `dist/`, launcher `src/index.js` → `src/app.js`; v2 route declarations with zod → validation, response stripping and OpenAPI 3.1 at `/docs/v2`; first endpoints events, event, me, my registrations. Tests `tests/v2.test.ts`, e2e `e2e/api-v2.spec.ts` |
+| 1.50.2 | Searchable **event picker** (`components/shared/EventPicker.tsx`) on staff/supervisor pages and the kiosk; searchable reports events list; **How webhooks work** guide on Site settings → Webhooks (examples from `EVENT_TYPES[].example`). e2e `e2e/event-picker.spec.ts` |
+| 1.50.1 | Long lists: audit-log search/role filter/all actions and inclusive To date, data-request search and paging, webhook-delivery status filter and Load older, supervisor Payments loads only what it needs (`unpaid`, `userId`, `from`, `donations` filters). `components/shared/Pager.tsx`; e2e `e2e/long-lists.spec.ts` |
 | 1.50.0 | **Accessibility pass** (§11, WCAG 2.2 AA) on public pages, auth, registration, payment, My Events and the kiosk: skip link, focus ring, labelled fields, named quantity buttons, announced errors, `ModalOverlay` popups (focus trap, Escape), contrast and underlined in-text links, reduce-motion; Branding warns about a too-light primary colour. axe + keyboard e2e in `e2e/accessibility.spec.ts` |
 | 1.49.2 | **Saved filters** (§9 part 3) on registrations, users, events and reports (`/api/saved-filters`, `components/shared/SavedFilters.tsx`). Migration `20261028180000_saved_filters` |
 | 1.49.1 | **Bulk actions** on Manage registrations (§9 part 2): message, mark paid, move ticket, allocate, export, cancel (`POST /api/registrations/bulk`, `utils/bulkRegistrations.js`). Migration `20261028170000_registrations_bulk` |
@@ -59,12 +63,14 @@ encrypted settings unreadable or break existing installs.
 Hub 1.1.0 is deployed with update requests rolled out, and `scripts/install.sh` has been tried on
 a test server (both done 2026-10-28).
 
-1. **1.50.1 — pagination and search on long lists**: check the Audit log and the other pages whose
-   data grows large (registrations, users, payments, messages, access/consent logs, background
-   jobs, webhooks deliveries …) for server-side paging, search and filters, and add them where
-   missing (Joshua, 2026-10-28).
-2. **1.51.0 — TypeScript backend, OpenAPI and `/api/v2`** (§14), then **2.0.0 — AI helpers** (§15).
+1. **1.51.2 — v2 check-in and accounts** (ticket scan and manual check-in, sign up, log in,
+   profile; move them into TS services as 1.51.1 did), then **1.51.3 — the rest of v2, Express 5,
+   v1 deprecation headers and v2-shaped global middleware**, then **2.0.0 — AI helpers** (§15).
    Languages (Afrikaans, §10) are removed from scope (2026-10-28).
+2. AI rules decided 2026-10-29 (see §15 in the roadmap): the AI buttons show only when the
+   licence's monthly cap is above R0, and are disabled (not hidden) once it's reached. The Hub
+   charges the real cost plus a markup % (a default and a per-licence override) and counts the cap
+   in charged rand. AI endpoints are `/api/v2` only.
 
 ## Working on this repo
 
@@ -80,7 +86,7 @@ a test server (both done 2026-10-28).
   full log; WHATS-NEW.md is what churches see before updating (the Hub reads it from main every
   15 minutes, for tagged versions only and sets the latest version from the tags — nothing to do in the Hub).
 - **Docs to keep in step:** CHANGELOG.md, FEATURES.md, README.md, SETTINGS.md,
-  backend/API_DOCUMENTATION.md, the `/docs` route list in `backend/src/index.js`, and
+  backend/API_DOCUMENTATION.md, the `/docs` route list in `backend/src/app.js` (v2 documents itself), and
   in-app help in `frontend/src/content/help/` (register new pages in `registry.ts`).
 - **Prisma migrations:** `npx prisma migrate dev --create-only --name x` against a local
   DB. Prisma 7 keeps adding an unrelated `_EventNotifyRecipients` primary-key/index
@@ -436,6 +442,60 @@ a test server (both done 2026-10-28).
   weren't in §11's scope; many of their labels still aren't tied to fields and they use hand-made
   popups. Do them when those pages are next worked on.
 
+## Long lists (1.50.1)
+
+- A list that grows for ever must page on the server (`page`/`limit`, `total`, `pages`) or load
+  older items with a `before` cursor, and offer a search. `components/shared/Pager.tsx` renders
+  "21–40 of 312 · Prev · Next". Already paged: users, registrations (Manage registrations), events,
+  payments, audit log, consent/access logs, data requests, My payments.
+- **Audit-log actions:** a new `AdminAuditAction` needs a label in `ACTION_LABELS`
+  (`app/dashboard/admin/audit-log/page.tsx`) — the filter is built from that list.
+- **Still loading everything (fine for now, watch as installs grow):** user pickers that call
+  `fetchAllUsers` (Payments, Email/WhatsApp attendees, Forms, Manual) — a server-side search
+  picker would replace them; the coupons list; `GET /api/registrations` without `page` (other callers still use the plain array).
+
+## TypeScript and API v2 (1.51.0)
+
+- **Starting the backend:** PM2 runs `src/index.js`, a launcher. With plain Node it runs
+  `dist/app.js` when `dist/build.json` has this version; otherwise tsx compiles on the fly (with a
+  warning). tsx and typescript are runtime dependencies for that fallback. `npm run dev` and e2e
+  use tsx, so they never pick up a stale `dist/`. The server is `src/app.js`.
+- **Paths:** `dist/` mirrors `src/`, so `path.join(__dirname, '..', '..', 'public')` works from
+  both. Non-code files in `src/` aren't copied (the favicon is read from `src/`).
+- **New code in TypeScript.** Convert a JS module when a release touches it; until then import it
+  through `src/v2/legacy.ts` with a typed signature. TypeScript infers loose types from JS (the
+  Prisma client especially), so v2 code takes `prisma` from there, typed as `PrismaClient`.
+- **A v2 endpoint** is `defineRoute({ method, path, tag, summary, access, params?, query?, body?,
+  response, handler })` in `src/v2/resources/<area>.ts`, imported in `src/v2/index.ts`. Lists use
+  `pageQuery`, `paged()` and `pageOf()`; single items `single()`. Dates go out as ISO strings
+  (`iso()`), so response schemas use `isoDate`. Throw `ApiError(code, message)` or `notFound()`.
+  The response is parsed by its schema: unknown fields are dropped, and a mismatch is a 500 plus a
+  log line (tests catch it). Staff/supervisor routes must declare `campusScope` (start-up fails
+  otherwise).
+- **Services** (`src/services/*.ts`, 1.51.1): business logic both API versions call. Throw
+  `ServiceError(status, message)` (`fail()`); v1 controllers keep their old answers (mostly 400
+  for any error), v2 maps the status to its codes. Helper errors without a status count as 400,
+  like v1. JS helpers are required with a typed signature at the top of each service.
+- **Frontend v2 calls:** `apiV2("post", "/registrations/{id}/cancel", { params: { id }, authToken })`
+  (`frontend/src/lib/apiV2.ts`). After adding or changing a v2 route run `npm run api:types` in the
+  repo root and commit `frontend/src/lib/api-v2/` (`tests/v2.test.ts` fails while it's stale).
+- Not yet v2-shaped: the global middleware in front of every route (rate limit, impersonation
+  read-only guard, licence read-only) still answers `{ message }`. Do that with 1.51.2.
+
+## Event picker and webhook guide (1.50.2)
+
+- **Choosing an event:** use `EventPicker` (`components/shared/EventPicker.tsx`), not a `<select>`.
+  Give it the whole list (`/api/events/all?includePast=true`); it opens on upcoming events, keeps
+  past ones behind "Show past events", and searches all of them. `emptyLabel` adds a clearable
+  choice ("All events"), `graceHours` keeps just-ended events current (the scanner uses 12),
+  `describe` adds detail per row, and `defaultEventId(events)` picks the next upcoming one. In e2e,
+  `pickEvent(page, title)` from `e2e/fixtures.ts`.
+- `/api/events/all` still returns full events (options, form, sessions) — fine for a few hundred;
+  a slim `?fields=` mode would help if a church gets into the thousands.
+- **Webhook examples:** a new webhook event type needs an entry in `EXAMPLES` in
+  `utils/webhooks.js`; `tests/webhooks.test.js` fails if an example and `buildPayload` differ in
+  shape.
+
 ## Known gaps / follow-ups
 
 - WhatsApp STOP only works once someone pastes the webhook URL from Site settings → WhatsApp
@@ -446,8 +506,6 @@ a test server (both done 2026-10-28).
   real WAWP webhook is `/api/whatsapp/webhook`. Remove the stub in a later release.
 - There's no log of individual messages sent, so "Download my data" can't include "messages
   sent to you" yet.
-- The audit-log page's action filter list was already missing newer actions before 1.38.0
-  (only the three privacy ones were added).
 
 - At the door, per-session tickets are booked on new registrations only; editing an
   existing registration leaves its booked sessions as they are (the backend refuses

docs/ROADMAP-v2.md

@@ -38,8 +38,9 @@ Event series and cloning ships as 1.47.0–1.47.3 (2026-10-28); 1.47.0 **copy an
 report** and 1.47.3 **season passes** shipped — §6 is done. 1.48.0 **outbound webhooks** shipped. 1.49.0 **dashboard (Today, Waiting for you) and Ctrl+K palette**
 shipped; 1.49.1 **bulk actions** and 1.49.2 **saved filters** shipped — §9 is done. Languages
 (Afrikaans) are removed from scope (2026-10-28), so everything after moves up by one. 1.50.0 **accessibility
-pass** shipped. **Next: 1.50.1 pagination and search on long lists** (Audit log and other
-large lists), then 1.51.0 TypeScript backend / `/api/v2`.
+pass** shipped. 1.50.1 **pagination and search on long lists** and 1.50.2 **event picker and webhook guide** shipped. 1.51.0 **TypeScript backend and `/api/v2`
+foundations** and 1.51.1 **v2 registrations and payments** shipped. **Next: 1.51.2 v2 check-in and
+accounts, then 1.51.3.**
 
 **Repositories:**
 
@@ -879,11 +880,34 @@ an install (one leaked install would leak it for everyone), so:
   the install secret like the heartbeat. The Hub adds the key, calls Claude, and returns
   the result. Still **install → Hub only** — the Hub never reaches into an install.
 - **The Hub meters every call** in rand: tokens used × the model's price × an exchange rate
-  Joshua sets in the Hub (with an optional margin). Usage is kept per install per month.
+  Joshua sets in the Hub × **(1 + markup)**. Usage is kept per install per month, as both the
+  real cost and the charged (marked-up) amount.
+- **Markup** (decided 2026-10-29): one percentage set in the Hub (a default for every licence,
+  with an override per licence), e.g. 40%. It does two jobs: it covers Joshua if a month's real
+  usage runs a little over (exchange-rate moves, a last call that costs more than expected), and
+  it is his profit on AI. Churches only ever see the charged amount in rand. The real cost, the
+  markup and the profit are shown only in the Hub.
 - **Monthly rand cap per licence**, set by Joshua in the Hub to match what the church pays
-  (e.g. R0 = AI off, R50, R200). The licence's cap is the first per-plan limit. At 80% the
-  install's admins get a warning email; at 100% the helpers are switched off until the next
-  month (or until Joshua raises the cap). Optional per-user daily limit against runaway use.
+  (e.g. R0 = AI off, R50, R200). The licence's cap is the first per-plan limit. The cap is
+  counted in **charged** rand, so the real spend can never be more than cap ÷ (1 + markup).
+- **Hard stop, checked before each call:** the Hub refuses a call when *charged so far + the
+  worst case for this call* (its prompt plus the helper's `max_tokens`, priced with markup) would
+  pass the cap. A month can't run over by more than the markup already covers, even with
+  several people clicking at once (the check and the usage record happen in one transaction).
+  At 80% the install's admins get a warning email. Optional per-user daily limit against
+  runaway use.
+- **The buttons follow the cap** (decided 2026-10-29):
+  - **Cap R0** (or AI off on the licence, or the install not connected to the Hub): the AI
+    buttons are **not shown at all**, anywhere.
+  - **Cap above R0, room left:** the buttons show and work.
+  - **Cap reached:** the buttons stay where they are but are **disabled**, with a tooltip like
+    "This month's AI allowance is used up — it renews on 1 December". They come back by
+    themselves next month, or as soon as Joshua raises the cap.
+  - The install learns this from `GET /api/v2/ai/status` → `{ enabled, capReached, renewsOn,
+    helpers }`. The answer is cached briefly from the Hub and refreshed after every call.
+    Every AI call also returns the new status, so the buttons disable straight after the call
+    that used up the cap. The backend checks again on each request, so a stale page can't get
+    past the cap.
 - **Admins see their usage** in Site settings → AI: used this month (R and number of uses),
   the cap, a daily chart, use per helper and per person, and an on/off switch per helper.
 - If the Hub or Claude is unavailable, the buttons say so; nothing else in the app is affected.
@@ -904,7 +928,12 @@ an install (one leaked install would leak it for everyone), so:
 
 - Install: `backend/src/ai/` — one client for the Hub's AI endpoint, one prompt + schema
   per helper, usage shown from the Hub. Feature flag per helper, all off when the licence
-  has no AI or the Hub isn't connected.
+  has no AI or the Hub isn't connected. The AI endpoints exist **only in `/api/v2`**
+  (`/api/v2/ai/status`, `/api/v2/ai/<helper>`), built on 1.51's schemas and error format.
+  The frontend has one `useAiStatus()` hook and an `<AiButton>` that hides, enables or
+  disables itself from it.
+- Hub: real cost and charged amount per call; the markup default and per-licence override;
+  a per-install month view with **cost, charged and profit**; the cap check before each call.
 - Hub: the AI proxy, metering, caps, warnings, an exchange-rate setting, and a per-install
   usage view for Joshua (alongside the existing install detail page).
 - A small **eval set** (example event descriptions, reports, notes, with what a good answer
@@ -978,8 +1007,8 @@ income justify the hardware:
 | 7 | 1.43.0 ✅ – 1.44.0 ✅ | **Multi-campus**: 1.43.0 campuses (settings, events, public filter and landing pages, home campus, filters, messages, summaries); 1.44.0 campus-scoped staff | Kids rooms and volunteer roles are per campus, so campuses come first; scoping is split out because it's security-heavy |
 | 8 | 1.45.0 ✅ – 1.46.0 ✅ | Kids check-in, Volunteer rosters | Depend on sessions and campuses |
 | 9 | 1.47.0 ✅ – 1.47.3 ✅, 1.48.0 ✅ | Event series & cloning (1.47.0 clone, 1.47.1 series, 1.47.2 year-on-year reports, 1.47.3 season pass), Outbound webhooks (Wallet passes removed from scope) | Smaller, independent wins |
-| 10 | 1.49.0 ✅ – 1.49.2 ✅, 1.50.0 ✅, 1.50.1 | Admin dashboard/Ctrl+K/bulk actions/saved filters, Accessibility pass, pagination and search on long lists (Afrikaans removed from scope) | Polish before the big release |
-| 11 | 1.51.0 | TypeScript backend + OpenAPI + `/api/v2` alongside v1 | The breaking-change groundwork |
+| 10 | 1.49.0 ✅ – 1.49.2 ✅, 1.50.0 ✅, 1.50.1 ✅, 1.50.2 ✅ | Admin dashboard/Ctrl+K/bulk actions/saved filters, Accessibility pass, pagination and search on long lists, event picker and webhook guide (Afrikaans removed from scope) | Polish before the big release |
+| 11 | 1.51.0 ✅, 1.51.1 ✅, 1.51.2, 1.51.3 | TypeScript backend + OpenAPI + `/api/v2` alongside v1: 1.51.0 foundations (build, launcher, route declarations, errors, paging, OpenAPI at `/docs/v2`, first read endpoints); 1.51.1 registrations and payments as TS services, typed frontend calls; 1.51.2 check-in and accounts; 1.51.3 the rest, Express 5, v1 deprecation headers | The breaking-change groundwork |
 | 12 | **2.0.0** | **AI helpers** (§15 — headline feature: draft an event, summarise reports and feedback, draft messages, improve text; through the Hub with a rand cap per licence), v1 API removed, migration guide, marketing site/docs for selling | The release. AI needs the Hub (phase 6) for the key, metering and caps |
 
 Each phase should add matching help content (`frontend/src/content/help/`),
@@ -1017,6 +1046,7 @@ feature.
 | — | AI in 2.0 | The **headline feature of 2.0**: one-button helpers only (draft an event, summarise reports and feedback, draft messages, improve text) — no chat yet (2026-10-24) |
 | — | AI provider and key | One provider, **Claude** (Haiku 5.5 to start, for cost). Joshua provides the key; installs call AI **through the Hub**, which holds the key and meters usage (2026-10-24) |
 | — | AI cost limits | A **monthly rand cap per install**, set in the Hub per licence to match what the church pays; admins see their usage in Site settings → AI (2026-10-24) |
+| — | AI buttons and markup | AI buttons show only when the licence's monthly cap is **above R0**. When the cap is reached they stay visible but **disabled** until next month or until the cap is raised. Usage is charged at the real cost **plus a markup %** set in the Hub (a default, plus an override per licence). The markup covers small overruns and is the profit. The cap is counted in charged rand, and each call is checked against its worst-case cost before it's sent (2026-10-29) |
 | — | AI later | Ask AI (read-only, tools only), help/navigation assistant, actions with confirmation, more helpers, and long-term **self-hosted** AI behind the same Hub endpoint — not tied to versions (2026-10-24) |
 | — | POPIA: message kinds | Bulk messages are either **Event updates** (to registrants — still sent after unsubscribing) or **News & announcements** (marketing — opt-in, one-click unsubscribe). Every bulk email links to the preferences (2026-10-23) |
 | — | POPIA: existing users | Kept opted in to news (logged as "existing account"), asked once at their next login to confirm or opt out. New sign-ups choose with an unticked box (2026-10-23) |

e2e/accessibility.spec.ts

@@ -1,6 +1,6 @@
 import AxeBuilder from "@axe-core/playwright";
 import type { Page } from "@playwright/test";
-import { test, expect, seed, loginAs } from "./fixtures";
+import { test, expect, seed, loginAs, pickEvent } from "./fixtures";
 
 // WCAG 2.2 AA checks (axe-core) on the pages visitors and members use, so the
 // accessibility pass (1.50.0) doesn't regress.
@@ -75,8 +75,7 @@ test.describe("accessibility (WCAG 2.2 AA)", () => {
     await page.getByRole("button", { name: "Sign In" }).click();
     await expect(page.getByText("Signed in as supervisor")).toBeVisible();
     await check(page, "kiosk event picker");
-    const value = await page.locator("option", { hasText: "E2E Free Evening" }).getAttribute("value");
-    await page.locator("select").selectOption(value!);
+    await pickEvent(page, "E2E Free Evening");
     await page.getByRole("button", { name: "Start Kiosk" }).click();
     await expect(page.getByRole("heading", { name: "E2E Free Evening" })).toBeVisible();
     await check(page, "kiosk form");
@@ -106,8 +105,7 @@ test.describe("keyboard", () => {
     await page.getByLabel("Email").fill(seed().users.supervisor.email);
     await page.getByLabel("Password", { exact: true }).fill("E2e-password-123");
     await page.getByRole("button", { name: "Sign In" }).click();
-    const value = await page.locator("option", { hasText: "E2E Free Evening" }).getAttribute("value");
-    await page.getByLabel("Event").selectOption(value!);
+    await pickEvent(page, "E2E Free Evening");
     await page.getByRole("button", { name: "Start Kiosk" }).click();
 
     const opener = page.getByRole("button", { name: "Change Event" });

e2e/api-v2.spec.ts

@@ -0,0 +1,65 @@
+import { test, expect, seed, API } from "./fixtures";
+
+// /api/v2 (1.51.0) against the real server and database: paged public events, the v2 error
+// shape, the signed-in person, and the OpenAPI reference at /docs/v2.
+test.describe("API v2", () => {
+  test("public events come a page at a time; errors have a code", async ({ request }) => {
+    const res = await request.get(`${API}/api/v2/events?limit=2`);
+    expect(res.ok()).toBe(true);
+    const body = await res.json();
+    expect(body.data).toHaveLength(2);
+    expect(body.meta).toMatchObject({ page: 1, limit: 2 });
+    expect(body.meta.total).toBeGreaterThan(2);
+
+    const search = await (await request.get(`${API}/api/v2/events?q=free%20evening`)).json();
+    expect(search.data.map((e: { title: string }) => e.title)).toEqual(["E2E Free Evening"]);
+
+    const one = await (await request.get(`${API}/api/v2/events/${seed().events.paid}`)).json();
+    expect(one.data.ticketOptions.length).toBeGreaterThan(0);
+
+    const bad = await request.get(`${API}/api/v2/events?limit=1000`);
+    expect(bad.status()).toBe(400);
+    expect((await bad.json()).error).toMatchObject({ code: "VALIDATION_FAILED", fields: { limit: expect.any(String) } });
+
+    const missing = await request.get(`${API}/api/v2/events/00000000-0000-4000-8000-000000000000`);
+    expect((await missing.json()).error.code).toBe("NOT_FOUND");
+  });
+
+  test("me and my registrations need a token", async ({ request }) => {
+    expect((await request.get(`${API}/api/v2/me`)).status()).toBe(401);
+    const headers = { Authorization: `Bearer ${seed().users.user.token}` };
+    const me = await (await request.get(`${API}/api/v2/me`, { headers })).json();
+    expect(me.data).toMatchObject({ id: seed().users.user.id, role: "user" });
+    const regs = await (await request.get(`${API}/api/v2/me/registrations?past=true`, { headers })).json();
+    expect(regs.meta).toMatchObject({ page: 1, limit: 25 });
+    expect(regs.data.length).toBe(Math.min(25, regs.meta.total));
+  });
+
+  test("register for a free event, then cancel it", async ({ request }) => {
+    const headers = { Authorization: `Bearer ${seed().users.staff.token}` };
+    const event = (await (await request.get(`${API}/api/v2/events/${seed().events.free}`)).json()).data;
+    const made = await request.post(`${API}/api/v2/registrations`, { headers, data: { eventId: event.id, options: [{ eventOptionId: event.ticketOptions[0].id, quantity: 1 }] } });
+    expect(made.status()).toBe(201);
+    const reg = (await made.json()).data;
+    expect(reg).toMatchObject({ status: "paid", balance: 0, event: { id: event.id } });
+
+    const someoneElse = await request.post(`${API}/api/v2/registrations/${reg.id}/cancel`, { headers: { Authorization: `Bearer ${seed().users.user.token}` } });
+    expect((await someoneElse.json()).error.code).toBe("NOT_FOUND");
+
+    const cancelled = await request.post(`${API}/api/v2/registrations/${reg.id}/cancel`, { headers });
+    expect((await cancelled.json()).data.status).toBe("cancelled");
+    const again = await request.post(`${API}/api/v2/registrations/${reg.id}/cancel`, { headers });
+    expect((await again.json()).error).toMatchObject({ code: "VALIDATION_FAILED", message: "Registration is already cancelled" });
+  });
+
+  test("an admin can read the OpenAPI reference at /docs/v2", async ({ page, request }) => {
+    const headers = { Authorization: `Bearer ${seed().users.user.token}` };
+    expect((await request.get(`${API}/api/v2/openapi.json`, { headers })).status()).toBe(403);
+
+    await page.goto(`${API}/docs/v2?token=${seed().users.admin.token}`);
+    await expect(page.getByRole("heading", { name: /Cross Events API/ })).toBeVisible();
+    await expect(page.locator(".opblock-summary-path", { hasText: "/events/{id}" })).toBeVisible();
+    // The token isn't left in the address bar.
+    expect(page.url()).not.toContain("token=");
+  });
+});

e2e/event-picker.spec.ts

@@ -0,0 +1,52 @@
+import AxeBuilder from "@axe-core/playwright";
+import { test, expect, loginAs, api } from "./fixtures";
+
+// 1.50.2: event dropdowns are a searchable picker — upcoming events first, past ones a click
+// away, and typing searches them all.
+test.describe("event picker", () => {
+  test("opens on upcoming events; past ones are behind a button or found by searching", async ({ page }) => {
+    const start = new Date(Date.now() - 40 * 864e5);
+    await api(page, "supervisor", "POST", "/api/events", {
+      title: "E2E Picker Old Gathering", description: "A past event for the picker test.", price: 0, location: "1 Test Street, Pretoria",
+      startDate: start.toISOString(), endDate: new Date(start.getTime() + 2 * 3600e3).toISOString(),
+    });
+
+    await loginAs(page, "supervisor");
+    await page.goto("/dashboard/supervisor/email-attendees");
+    await page.getByRole("button", { name: /^Event: Select an event/ }).click();
+    const list = page.getByRole("listbox", { name: "Events" });
+    await expect(list.getByRole("option", { name: /E2E Free Evening/ })).toBeVisible();
+    await expect(list.getByRole("option", { name: /E2E Picker Old Gathering/ })).toHaveCount(0);
+    // The open picker passes the WCAG 2.2 AA checks.
+    const axe = await new AxeBuilder({ page }).include("[data-testid=event-picker]").withTags(["wcag2a", "wcag2aa", "wcag21a", "wcag21aa", "wcag22aa"]).analyze();
+    expect(axe.violations.map((v) => `${v.id}: ${v.nodes.map((n) => n.target.join(" ")).join(", ")}`)).toEqual([]);
+
+    await page.getByRole("button", { name: /^Show past events/ }).click();
+    await expect(list.getByRole("option", { name: /E2E Picker Old Gathering/ })).toBeVisible();
+    await page.getByRole("button", { name: "Hide past events" }).click();
+
+    // Searching finds past events too; the keyboard chooses.
+    const search = page.getByRole("combobox", { name: "Search events" });
+    await search.fill("old gathering");
+    await expect(list.getByRole("option")).toHaveCount(1);
+    await search.press("Enter");
+    await expect(page.getByRole("button", { name: /^Event: E2E Picker Old Gathering/ })).toBeFocused();
+
+    // Escape closes without changing anything.
+    await page.keyboard.press("ArrowDown");
+    await expect(list).toBeVisible();
+    await page.keyboard.press("Escape");
+    await expect(list).toBeHidden();
+    await expect(page.getByRole("button", { name: /^Event: E2E Picker Old Gathering/ })).toBeVisible();
+  });
+
+  test("the reports event list can be searched", async ({ page }) => {
+    await loginAs(page, "admin");
+    await page.goto("/dashboard/supervisor/reports");
+    await page.getByRole("button", { name: /^Events:/ }).click();
+    await page.getByRole("button", { name: "Clear", exact: true }).click();
+    await page.getByLabel("Search events").fill("alpha");
+    await page.getByRole("button", { name: /^Select these 1$/ }).click();
+    await expect(page.getByRole("button", { name: "Events: E2E Alpha Course" })).toBeVisible();
+  });
+});

e2e/fixtures.ts

@@ -51,4 +51,12 @@ export async function api<T = unknown>(page: Page, role: Role, method: string, u
   return (text ? JSON.parse(text) : null) as T;
 }
 
+/** Chooses an event in an EventPicker (the first on the page, or the one labelled `label`) by searching its title. */
+export async function pickEvent(page: Page, title: string, label?: string) {
+  const button = label ? page.getByRole("button", { name: new RegExp(`^${label}:`) }) : page.getByTestId("event-picker").first().getByRole("button").first();
+  await button.click();
+  await page.getByRole("combobox", { name: /^Search/ }).fill(title);
+  await page.getByRole("option", { name: new RegExp(title) }).first().click();
+}
+
 export { expect };

e2e/kids.spec.ts

@@ -1,4 +1,4 @@
-import { test, expect, seed, loginAs } from "./fixtures";
+import { test, expect, seed, loginAs, pickEvent } from "./fixtures";
 
 // Kids check-in (1.45.0): a supervisor sets it up, a parent adds a child, the desk checks the child
 // in (pickup code + sticker panel), the parent sees the code, and a wrong code is refused before
@@ -7,7 +7,7 @@ test.describe.serial("kids check-in", () => {
   test("a supervisor sets up the kids ticket, a room and switches it on", async ({ page }) => {
     await loginAs(page, "supervisor");
     await page.goto("/dashboard/supervisor/kids");
-    await page.getByRole("combobox").first().selectOption(seed().events.kids);
+    await pickEvent(page, "E2E Kids Church");
     await page.getByRole("button", { name: /Add a free "Kids check-in" ticket/ }).click();
     await expect(page.getByLabel("Kids ticket")).not.toHaveValue("");
     await page.getByRole("button", { name: /Add "Kids rooms"/ }).click();

e2e/long-lists.spec.ts

@@ -0,0 +1,51 @@
+import { test, expect, seed, loginAs, api } from "./fixtures";
+
+// 1.50.1: long lists load a page (or just what's needed) at a time, with search and filters.
+test.describe("long lists", () => {
+  test("Payments: today, recent and a person's payments for a refund", async ({ page }) => {
+    // A donation recorded today for the seeded user (on an event no other test totals up).
+    await api(page, "supervisor", "POST", "/api/payments", {
+      amount: 77, method: "cash", isDonation: true, eventId: seed().events.conference, userId: seed().users.user.id,
+    });
+
+    await loginAs(page, "supervisor");
+    await page.goto("/dashboard/supervisor/payments");
+    await expect(page.getByText("R 77.00").first()).toBeVisible();
+
+    // Refund: picking the person loads their payments.
+    await page.locator("label", { hasText: "Refund" }).first().click();
+    await page.getByPlaceholder("Search by name, email or phone…").last().fill(seed().users.user.name);
+    await page.getByRole("button", { name: new RegExp(seed().users.user.name) }).first().click();
+    await expect(page.locator("option", { hasText: "R 77.00" })).toHaveCount(1);
+  });
+
+  test("Payments API: narrowing filters", async ({ page }) => {
+    const userId = seed().users.user.id;
+    const mine = await api<{ data: { userId: string }[] }>(page, "supervisor", "GET", `/api/payments?userId=${userId}&limit=200`);
+    expect(mine.data.length).toBeGreaterThan(0);
+    expect(mine.data.every((p) => p.userId === userId)).toBe(true);
+
+    const unpaid = await api<{ status: string }[]>(page, "supervisor", "GET", "/api/registrations?unpaid=1");
+    expect(unpaid.every((r) => ["pending", "confirmed", "partial_paid"].includes(r.status))).toBe(true);
+  });
+
+  test("Audit log: search and the full list of actions", async ({ page }) => {
+    await loginAs(page, "admin");
+    await page.goto("/dashboard/admin/audit-log");
+    const action = page.getByLabel("Action");
+    await expect(action.locator("option", { hasText: "Bulk action on registrations" })).toHaveCount(1);
+    await expect(action.locator("option", { hasText: "Webhook added, changed or deleted" })).toHaveCount(1);
+
+    await page.getByLabel("Search").fill("nobody-matches-this-xyz");
+    await expect(page.getByText("No matching audit entries.")).toBeVisible();
+    await expect(page.getByText(/0 actions match the filters/)).toBeVisible();
+    await page.getByRole("button", { name: "Clear filters" }).click();
+    await expect(page.getByLabel("Search")).toHaveValue("");
+  });
+
+  test("Data requests: search", async ({ page }) => {
+    const res = await api<{ requests: unknown[]; total: number }>(page, "admin", "GET", "/api/privacy/requests?status=closed&search=nobody-matches-this-xyz");
+    expect(res.requests).toEqual([]);
+    expect(res.total).toBe(0);
+  });
+});

e2e/pick-sessions.spec.ts

@@ -1,4 +1,4 @@
-import { test, expect, seed, loginAs, api } from "./fixtures";
+import { test, expect, seed, loginAs, api, pickEvent } from "./fixtures";
 
 type Registration = { id: string; eventId: string; user?: { name: string }; registrationOptions: { sessionId?: string | null; sessionIds?: string[]; priceSnapshot: number; quantity: number }[] };
 type WaitlistEntry = { eventId: string; sessionId: string | null; quantity: number };
@@ -67,12 +67,11 @@ test.describe("pick sessions", () => {
   test("at the door: book a class for a walk-in", async ({ page }) => {
     await loginAs(page, "supervisor");
     await page.goto("/dashboard/supervisor/at-the-door");
-    const value = await page.locator("option", { hasText: "E2E Drop-in Class" }).getAttribute("value");
     // The page picks a default event once its list loads; choose ours after that.
     await page.waitForLoadState("networkidle");
-    await page.locator("select").first().selectOption(value!);
+    await pickEvent(page, "E2E Drop-in Class");
     await page.waitForLoadState("networkidle");
-    await expect(page.locator("select").first()).toHaveValue(value!);
+    await expect(page.getByRole("button", { name: /^Event: E2E Drop-in Class/ })).toBeVisible();
 
     await page.getByPlaceholder("Name, email or phone…").fill("Door Walk In");
     await page.getByText('New attendee "Door Walk In"…').click();

e2e/sessions.spec.ts

@@ -1,4 +1,4 @@
-import { test, expect, seed, loginAs, api } from "./fixtures";
+import { test, expect, seed, loginAs, api, pickEvent } from "./fixtures";
 
 test.describe("multi-day events", () => {
   test("check-in is once per session, and the register and certificates follow", async ({ page }) => {
@@ -44,7 +44,7 @@ test.describe("multi-day events", () => {
   test("the scanner offers today's session for a multi-day event", async ({ page }) => {
     await loginAs(page, "staff");
     await page.goto("/dashboard/staff/ticket-scanning");
-    await page.locator("select").first().selectOption({ label: "E2E Alpha Course" });
+    await pickEvent(page, "E2E Alpha Course");
     await expect(page.locator("select", { has: page.locator("option", { hasText: "Today's session" }) })).toBeVisible();
     await expect(page.getByText("Today's session (Week 2)")).toBeAttached();
   });

e2e/supervisor.spec.ts

@@ -1,4 +1,4 @@
-import { test, expect, seed, loginAs, api } from "./fixtures";
+import { test, expect, seed, loginAs, api, pickEvent } from "./fixtures";
 
 type EventRow = { id: string; title: string; scheduleType?: string; sessions?: { cancelled?: boolean }[] };
 
@@ -80,8 +80,7 @@ test.describe("supervisor tools", () => {
     await page.getByPlaceholder("••••••••").fill("E2e-password-123");
     await page.getByRole("button", { name: "Sign In" }).click();
     await expect(page.getByText("Signed in as supervisor")).toBeVisible();
-    const value = await page.locator("option", { hasText: "E2E Free Evening" }).getAttribute("value");
-    await page.locator("select").selectOption(value!);
+    await pickEvent(page, "E2E Free Evening");
     await page.getByRole("button", { name: "Start Kiosk" }).click();
 
     await expect(page.getByRole("heading", { name: "E2E Free Evening" })).toBeVisible();

e2e/webhooks.spec.ts

@@ -67,4 +67,20 @@ test.describe.serial("outbound webhooks", () => {
     await endpoint.getByRole("button", { name: "Delivery log" }).click();
     await expect(endpoint.getByTestId("webhook-delivery").filter({ hasText: "user.created" })).toContainText("succeeded");
   });
+
+  test("the guide explains the signature and shows an example of each event", async ({ page }) => {
+    await loginAs(page, "admin");
+    await page.goto("/dashboard/admin/settings?tab=webhooks");
+    const guide = page.getByTestId("webhook-guide");
+    const toggle = guide.getByRole("button", { name: /How webhooks work/ });
+    await expect(toggle).toBeVisible();
+    if ((await toggle.getAttribute("aria-expanded")) !== "true") await toggle.click();
+    await expect(guide).toContainText("X-CrossEvents-Signature");
+    await guide.getByRole("button", { name: /registration.paid/ }).click();
+    const example = guide.getByTestId("webhook-example-registration.paid");
+    await expect(example).toContainText("\"type\": \"registration.paid\"");
+    await expect(example).toContainText("\"amountPaid\"");
+    await guide.getByRole("button", { name: "PHP" }).click();
+    await expect(guide).toContainText("hash_hmac");
+  });
 });

frontend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "hope-events-frontend",
-  "version": "1.50.0",
+  "version": "1.51.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "hope-events-frontend",
-      "version": "1.50.0",
+      "version": "1.51.1",
       "dependencies": {
         "@dnd-kit/core": "^6.3.1",
         "@hookform/resolvers": "^5.2.1",
@@ -54,6 +54,7 @@
         "autoprefixer": "^10.4.21",
         "eslint": "^9",
         "eslint-config-next": "^15.5.24",
+        "openapi-typescript": "^7.13.0",
         "postcss": "^8.5.6",
         "tailwindcss": "3.4",
         "typescript": "^5"
@@ -2770,6 +2771,99 @@
       "integrity": "sha512-JtyZR+mqgBibTo8xea3B6ZRmzZiM/YeVBtUkas6zMuXjAlfIFIW2FgqeM9eLyvEaYX66vr6DJMK+4U6LV0KhNw==",
       "license": "MIT"
     },
+    "node_modules/@redocly/ajv": {
+      "version": "8.11.2",
+      "resolved": "https://registry.npmjs.org/@redocly/ajv/-/ajv-8.11.2.tgz",
+      "integrity": "sha512-io1JpnwtIcvojV7QKDUSIuMN/ikdOUd1ReEnUnMKGfDVridQZ31J0MmIuqwuRjWDZfmvr+Q0MqCcfHM2gTivOg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fast-deep-equal": "^3.1.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2",
+        "uri-js-replace": "^1.0.1"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/@redocly/config": {
+      "version": "0.22.0",
+      "resolved": "https://registry.npmjs.org/@redocly/config/-/config-0.22.0.tgz",
+      "integrity": "sha512-gAy93Ddo01Z3bHuVdPWfCwzgfaYgMdaZPcfL7JZ7hWJoK9V0lXDbigTWkhiPFAaLWzbOJ+kbUQG1+XwIm0KRGQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@redocly/openapi-core": {
+      "version": "1.34.22",
+      "resolved": "https://registry.npmjs.org/@redocly/openapi-core/-/openapi-core-1.34.22.tgz",
+      "integrity": "sha512-dEyx4uHh6Pc6ZkdU9Xe8rA4h12Odq6QKU/fqseBn07xwVwskhHiF3KHhqmw5BR+jAiFTvKTmwCafFql/k1pSzA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@redocly/ajv": "8.11.2",
+        "@redocly/config": "0.22.0",
+        "colorette": "1.4.0",
+        "https-proxy-agent": "7.0.6",
+        "js-levenshtein": "1.1.6",
+        "js-yaml": "4.3.2",
+        "minimatch": "5.1.9",
+        "pluralize": "8.0.0",
+        "yaml-ast-parser": "0.0.43"
+      },
+      "engines": {
+        "node": ">=18.17.0",
+        "npm": ">=9.5.0"
+      }
+    },
+    "node_modules/@redocly/openapi-core/node_modules/agent-base": {
+      "version": "7.1.4",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
+      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/@redocly/openapi-core/node_modules/brace-expansion": {
+      "version": "2.1.7",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz",
+      "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0"
+      }
+    },
+    "node_modules/@redocly/openapi-core/node_modules/https-proxy-agent": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
+      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.2",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/@redocly/openapi-core/node_modules/minimatch": {
+      "version": "5.1.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.9.tgz",
+      "integrity": "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/@rollup/plugin-commonjs": {
       "version": "28.0.1",
       "resolved": "https://registry.npmjs.org/@rollup/plugin-commonjs/-/plugin-commonjs-28.0.1.tgz",
@@ -4650,6 +4744,16 @@
         "ajv": "^8.8.2"
       }
     },
+    "node_modules/ansi-colors": {
+      "version": "4.1.3",
+      "resolved": "https://registry.npmjs.org/ansi-colors/-/ansi-colors-4.1.3.tgz",
+      "integrity": "sha512-/6w/C21Pm1A7aZitlI5Ni/2J6FFQN8i1Cvz3kHABAAbw93v/NlvKdVOqz7CCWz/3iv/JplRSEEZ83XION15ovw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/ansi-regex": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
@@ -5208,6 +5312,13 @@
         "url": "https://github.com/chalk/chalk?sponsor=1"
       }
     },
+    "node_modules/change-case": {
+      "version": "5.4.4",
+      "resolved": "https://registry.npmjs.org/change-case/-/change-case-5.4.4.tgz",
+      "integrity": "sha512-HRQyTk2/YPEkt9TnUPbOpr64Uw3KOicFWPVBb+xiHvd6eBx/qPr9xqfBFDT8P2vWsvvz4jbEkfDe71W3VyNu2w==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/chokidar": {
       "version": "3.6.0",
       "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-3.6.0.tgz",
@@ -5316,6 +5427,13 @@
       "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
       "license": "MIT"
     },
+    "node_modules/colorette": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/colorette/-/colorette-1.4.0.tgz",
+      "integrity": "sha512-Y2oEozpomLn7Q3HFP7dpww7AtMJplbM9lGZP6RDfHqmbeRjiwRg4n6VM6j4KLmRke85uWEI7JqF17f3pqdRA0g==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/commander": {
       "version": "4.1.1",
       "resolved": "https://registry.npmjs.org/commander/-/commander-4.1.1.tgz",
@@ -6903,6 +7021,19 @@
         "node": ">=0.8.19"
       }
     },
+    "node_modules/index-to-position": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/index-to-position/-/index-to-position-1.2.0.tgz",
+      "integrity": "sha512-Yg7+ztRkqslMAS2iFaU+Oa4KTSidr63OsFGlOrJoW981kIYO3CGCS3wA95P1mUi/IVSJkn0D479KTJpVpvFNuw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/internal-slot": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/internal-slot/-/internal-slot-1.1.0.tgz",
@@ -7446,6 +7577,16 @@
         "jiti": "bin/jiti.js"
       }
     },
+    "node_modules/js-levenshtein": {
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/js-levenshtein/-/js-levenshtein-1.1.6.tgz",
+      "integrity": "sha512-X2BB11YZtrRqY4EnQcLX5Rh373zbK4alC1FW7D7MBhL2gtcC17cTnr6DmfHZeS0s2rTHjUTMMHfG7gO8SSdw+g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/js-tokens": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
@@ -7498,8 +7639,7 @@
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
       "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/json-stable-stringify-without-jsonify": {
       "version": "1.0.1",
@@ -8134,6 +8274,50 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/openapi-typescript": {
+      "version": "7.13.0",
+      "resolved": "https://registry.npmjs.org/openapi-typescript/-/openapi-typescript-7.13.0.tgz",
+      "integrity": "sha512-EFP392gcqXS7ntPvbhBzbF8TyBA+baIYEm791Hy5YkjDYKTnk/Tn5OQeKm5BIZvJihpp8Zzr4hzx0Irde1LNGQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@redocly/openapi-core": "^1.34.6",
+        "ansi-colors": "^4.1.3",
+        "change-case": "^5.4.4",
+        "parse-json": "^8.3.0",
+        "supports-color": "^10.2.2",
+        "yargs-parser": "^21.1.1"
+      },
+      "bin": {
+        "openapi-typescript": "bin/cli.js"
+      },
+      "peerDependencies": {
+        "typescript": "^5.x"
+      }
+    },
+    "node_modules/openapi-typescript/node_modules/supports-color": {
+      "version": "10.2.2",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-10.2.2.tgz",
+      "integrity": "sha512-SS+jx45GF1QjgEXQx4NJZV9ImqmO2NPz5FNsIHrsDjh2YsHnawpan7SNQ1o8NuhrbHZy9AZhIoCUiCeaW/C80g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/supports-color?sponsor=1"
+      }
+    },
+    "node_modules/openapi-typescript/node_modules/yargs-parser": {
+      "version": "21.1.1",
+      "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-21.1.1.tgz",
+      "integrity": "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==",
+      "dev": true,
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/optionator": {
       "version": "0.9.4",
       "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz",
@@ -8223,6 +8407,37 @@
         "node": ">=6"
       }
     },
+    "node_modules/parse-json": {
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/parse-json/-/parse-json-8.3.0.tgz",
+      "integrity": "sha512-ybiGyvspI+fAoRQbIPRddCcSTV9/LsJbf0e/S85VLowVGzRmokfneg2kwVW/KU5rOXrPSbF1qAKPMgNTqqROQQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/code-frame": "^7.26.2",
+        "index-to-position": "^1.1.0",
+        "type-fest": "^4.39.1"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/parse-json/node_modules/type-fest": {
+      "version": "4.41.0",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-4.41.0.tgz",
+      "integrity": "sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA==",
+      "dev": true,
+      "license": "(MIT OR CC0-1.0)",
+      "engines": {
+        "node": ">=16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/path-exists": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
@@ -8300,6 +8515,16 @@
         "node": ">= 6"
       }
     },
+    "node_modules/pluralize": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/pluralize/-/pluralize-8.0.0.tgz",
+      "integrity": "sha512-Nc3IT5yHzflTfbjgqWcCPpo7DaKy4FnpB0l/zCAW0Tc7jxAiuqSxHasntB3D7887LSrA93kDJ9IXovxJYxyLCA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=4"
+      }
+    },
     "node_modules/pngjs": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/pngjs/-/pngjs-5.0.0.tgz",
@@ -8813,7 +9038,6 @@
       "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
       "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=0.10.0"
       }
@@ -10051,6 +10275,13 @@
         "punycode": "^2.1.0"
       }
     },
+    "node_modules/uri-js-replace": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/uri-js-replace/-/uri-js-replace-1.0.2.tgz",
+      "integrity": "sha512-VeBBt/nMxedczht3KDL2yBBMJqIxpCQLMZp3UJ1otcWwUHdQW4IiyHpJivExzSK+FdxTowRfGL4FmwDqH9+S8Q==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/use-callback-ref": {
       "version": "1.3.3",
       "resolved": "https://registry.npmjs.org/use-callback-ref/-/use-callback-ref-1.3.3.tgz",
@@ -10328,6 +10559,13 @@
       "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==",
       "license": "ISC"
     },
+    "node_modules/yaml-ast-parser": {
+      "version": "0.0.43",
+      "resolved": "https://registry.npmjs.org/yaml-ast-parser/-/yaml-ast-parser-0.0.43.tgz",
+      "integrity": "sha512-2PTINUwsRqSd+s8XxKaJWQlUuEMHJQyEuh2edBbW8KNJz0SJPwUSD2zRWqezFEdN7IzAgeuYHFUCF7o8zRdZ0A==",
+      "dev": true,
+      "license": "Apache-2.0"
+    },
     "node_modules/yargs": {
       "version": "15.4.1",
       "resolved": "https://registry.npmjs.org/yargs/-/yargs-15.4.1.tgz",

frontend/package.json

@@ -1,12 +1,13 @@
 {
   "name": "hope-events-frontend",
-  "version": "1.50.0",
+  "version": "1.51.1",
   "private": true,
   "scripts": {
     "dev": "next dev --turbopack",
     "build": "next build",
     "start": "next start",
-    "lint": "next lint"
+    "lint": "next lint",
+    "api:types": "openapi-typescript src/lib/api-v2/openapi.json -o src/lib/api-v2/schema.d.ts"
   },
   "dependencies": {
     "@dnd-kit/core": "^6.3.1",
@@ -55,6 +56,7 @@
     "autoprefixer": "^10.4.21",
     "eslint": "^9",
     "eslint-config-next": "^15.5.24",
+    "openapi-typescript": "^7.13.0",
     "postcss": "^8.5.6",
     "tailwindcss": "3.4",
     "typescript": "^5"

frontend/src/app/dashboard/admin/audit-log/page.tsx

@@ -10,50 +10,6 @@ import { Table, TableHeader, TableBody, TableRow, TableHead, TableCell } from "@
 import { errorMessage } from "@/lib/utils";
 import { BackLink } from "@/components/shared/BackLink";
 
-const ACTIONS = [
-  "refund_created",
-  "donation_assigned",
-  "donation_unassigned",
-  "registration_created_manual",
-  "registration_cancelled",
-  "event_created",
-  "event_updated",
-  "event_deleted",
-  "settings_updated",
-  "coupon_created",
-  "coupon_updated",
-  "coupon_disabled",
-  "coupon_applied_manual",
-  "bundle_created",
-  "bundle_updated",
-  "bundle_deleted",
-  "consent_override",
-  "consent_rerequested",
-  "medical_list_viewed",
-  "scan_lock_acquired",
-  "scan_lock_released",
-  "scan_lock_force_released",
-  "offline_sync",
-  "ticket_transferred",
-  "impersonation_started",
-  "impersonation_ended",
-  "yoco_config_updated",
-  "yoco_webhook_registered",
-  "yoco_webhook_deleted",
-  "data_request_completed",
-  "data_request_rejected",
-  "user_anonymised",
-  "privacy_notice_published",
-  "operator_created",
-  "operator_updated",
-  "operator_deleted",
-  "retention_policies_updated",
-  "retention_run",
-  "breach_recorded",
-  "breach_updated",
-  "hub_connected",
-] as const;
-
 const ACTION_LABELS: Record<string, string> = {
   refund_created: "Refund created",
   donation_assigned: "Donation assigned",
@@ -122,8 +78,23 @@ const ACTION_LABELS: Record<string, string> = {
   series_deleted: "Event series deleted",
   season_pass_changed: "Season pass created, changed or deleted",
   registrations_bulk: "Bulk action on registrations",
+  attendance_marked: "Attendance marked",
+  attendance_unmarked: "Attendance unmarked",
+  certificate_issued: "Certificate issued",
+  certificate_revoked: "Certificate revoked",
+  event_sessions_changed: "Event sessions changed",
+  job_run_manual: "Background job run by hand",
+  payfast_config_updated: "PayFast settings changed",
+  payment_providers_updated: "Payment providers changed",
+  webhook_endpoint_changed: "Webhook added, changed or deleted",
 };
 
+// Every action that can be logged (keep in step with AdminAuditAction in schema.prisma),
+// sorted by label for the filter.
+const ACTION_OPTIONS = Object.entries(ACTION_LABELS).sort((x, y) => x[1].localeCompare(y[1]));
+
+const ROLES = ["admin", "supervisor", "staff"] as const;
+
 interface AuditLogEntry {
   id: string;
   actorId: string | null;
@@ -212,16 +183,32 @@ export default function AdminAuditLogPage() {
   const totalPages = Math.max(1, Math.ceil(total / pageSize));
 
   const [actionFilter, setActionFilter] = useState<string>("");
+  const [roleFilter, setRoleFilter] = useState<string>("");
+  const [searchInput, setSearchInput] = useState<string>("");
+  const [search, setSearch] = useState<string>("");
   const [fromFilter, setFromFilter] = useState<string>("");
   const [toFilter, setToFilter] = useState<string>("");
 
   const buildQuery = useCallback((p: number) => {
     const qs = new URLSearchParams({ page: String(p), limit: String(pageSize) });
     if (actionFilter) qs.set("action", actionFilter);
+    if (roleFilter) qs.set("role", roleFilter);
+    if (search) qs.set("search", search);
     if (fromFilter) qs.set("from", fromFilter);
     if (toFilter) qs.set("to", toFilter);
     return `/api/admin/audit-log?${qs.toString()}`;
-  }, [actionFilter, fromFilter, toFilter]);
+  }, [actionFilter, roleFilter, search, fromFilter, toFilter]);
+
+  // Search as you type, once typing pauses.
+  useEffect(() => {
+    const t = setTimeout(() => setSearch(searchInput.trim()), 350);
+    return () => clearTimeout(t);
+  }, [searchInput]);
+
+  const filtered = !!(actionFilter || roleFilter || search || fromFilter || toFilter);
+  const clearFilters = () => {
+    setActionFilter(""); setRoleFilter(""); setSearchInput(""); setSearch(""); setFromFilter(""); setToFilter("");
+  };
 
   const load = useCallback(async (p = 1) => {
     if (!token) return;
@@ -251,7 +238,7 @@ export default function AdminAuditLogPage() {
         <div>
           <BackLink href="/dashboard/admin" />
           <h1 className="text-2xl font-semibold text-gray-900 mt-0.5">Admin Audit Log</h1>
-          <p className="text-sm text-gray-500">{total} action{total !== 1 ? "s" : ""} recorded</p>
+          <p className="text-sm text-gray-500">{total} action{total !== 1 ? "s" : ""} {filtered ? "match the filters" : "recorded"}</p>
         </div>
       </div>
 
@@ -262,25 +249,48 @@ export default function AdminAuditLogPage() {
       )}
       {isAdmin && token && <ImpersonationSessions token={token} />}
 
-      {error && <div className="mb-3 p-3 border rounded bg-red-50 text-red-800 text-sm">{error}</div>}
+      {error && <div role="alert" className="mb-3 p-3 border rounded bg-red-50 text-red-800 text-sm">{error}</div>}
 
       <div className="border rounded-xl p-4 bg-white shadow-sm">
         <div className="flex flex-wrap items-end gap-3 mb-4">
+          <div className="flex-1 min-w-[14rem]">
+            <label htmlFor="audit-search" className="block text-xs text-gray-600 mb-1">Search</label>
+            <input
+              id="audit-search"
+              type="search"
+              className="w-full border rounded px-2 py-1.5 text-sm"
+              placeholder="Person, target (e.g. Event or #id) or IP"
+              value={searchInput}
+              onChange={e => setSearchInput(e.target.value)}
+            />
+          </div>
           <div>
-            <label className="block text-xs text-gray-600 mb-1">Action</label>
-            <select className="border rounded px-2 py-1.5 text-sm" value={actionFilter} onChange={e => setActionFilter(e.target.value)}>
+            <label htmlFor="audit-action" className="block text-xs text-gray-600 mb-1">Action</label>
+            <select id="audit-action" className="border rounded px-2 py-1.5 text-sm max-w-[16rem]" value={actionFilter} onChange={e => setActionFilter(e.target.value)}>
               <option value="">All actions</option>
-              {ACTIONS.map(a => <option key={a} value={a}>{ACTION_LABELS[a]}</option>)}
+              {ACTION_OPTIONS.map(([a, label]) => <option key={a} value={a}>{label}</option>)}
             </select>
           </div>
           <div>
-            <label className="block text-xs text-gray-600 mb-1">From</label>
-            <input type="date" className="border rounded px-2 py-1.5 text-sm" value={fromFilter} onChange={e => setFromFilter(e.target.value)} />
+            <label htmlFor="audit-role" className="block text-xs text-gray-600 mb-1">Role</label>
+            <select id="audit-role" className="border rounded px-2 py-1.5 text-sm" value={roleFilter} onChange={e => setRoleFilter(e.target.value)}>
+              <option value="">Any role</option>
+              {ROLES.map(r => <option key={r} value={r} className="capitalize">{r[0].toUpperCase() + r.slice(1)}</option>)}
+            </select>
           </div>
           <div>
-            <label className="block text-xs text-gray-600 mb-1">To</label>
-            <input type="date" className="border rounded px-2 py-1.5 text-sm" value={toFilter} onChange={e => setToFilter(e.target.value)} />
+            <label htmlFor="audit-from" className="block text-xs text-gray-600 mb-1">From</label>
+            <input id="audit-from" type="date" className="border rounded px-2 py-1.5 text-sm" value={fromFilter} onChange={e => setFromFilter(e.target.value)} />
           </div>
+          <div>
+            <label htmlFor="audit-to" className="block text-xs text-gray-600 mb-1">To</label>
+            <input id="audit-to" type="date" className="border rounded px-2 py-1.5 text-sm" value={toFilter} min={fromFilter || undefined} onChange={e => setToFilter(e.target.value)} />
+          </div>
+          {filtered && (
+            <button className="text-sm px-2 py-1.5 rounded text-brand-700 hover:bg-brand-50" onClick={clearFilters}>
+              Clear filters
+            </button>
+          )}
           <button className="text-sm px-2 py-1.5 rounded bg-gray-100 hover:bg-gray-200" onClick={() => load(page)} disabled={fetching}>
             {fetching ? "Refreshing…" : "Refresh"}
           </button>
@@ -307,9 +317,9 @@ export default function AdminAuditLogPage() {
                       <div className="text-xs text-gray-500">{e.actor.email}</div>
                     </>
                   ) : (
-                    <span className="text-gray-400 italic">Deleted user</span>
+                    <span className="text-gray-500 italic">Deleted user</span>
                   )}
-                  <div className="text-xs text-gray-400 capitalize">{e.actorRole}</div>
+                  <div className="text-xs text-gray-500 capitalize">{e.actorRole}</div>
                 </TableCell>
                 <TableCell>{ACTION_LABELS[e.action] || e.action}</TableCell>
                 <TableCell className="text-xs text-gray-600">{e.targetType}{e.targetId ? ` #${e.targetId.slice(0, 8)}` : ""}</TableCell>
@@ -323,7 +333,7 @@ export default function AdminAuditLogPage() {
             )}
             {fetching && (
               <TableRow>
-                <TableCell colSpan={5} className="text-gray-400">Loading…</TableCell>
+                <TableCell colSpan={5} className="text-gray-500">Loading…</TableCell>
               </TableRow>
             )}
           </TableBody>
@@ -331,7 +341,7 @@ export default function AdminAuditLogPage() {
 
         {totalPages > 1 && (
           <div className="flex items-center justify-between mt-4 text-sm">
-            <span className="text-gray-500">Page {page} of {totalPages}</span>
+            <span className="text-gray-500">{(page - 1) * pageSize + 1}–{Math.min(page * pageSize, total)} of {total} · page {page} of {totalPages}</span>
             <div className="flex gap-1">
               <button
                 className="px-2 py-1 rounded bg-gray-100 hover:bg-gray-200 disabled:opacity-40"

frontend/src/app/dashboard/admin/data-requests/page.tsx

@@ -4,6 +4,7 @@ import React, { useCallback, useEffect, useState } from "react";
 import Link from "next/link";
 import { useAuth } from "@/hooks/useAuth";
 import { apiFetch } from "@/lib/api";
+import { Pager } from "@/components/shared/Pager";
 import { useDismissingState } from "@/hooks/useDismissingState";
 import { Inbox, AlertTriangle } from "lucide-react";
 import { errorMessage } from "@/lib/utils";
@@ -135,18 +136,33 @@ export default function DataRequestsPage() {
   const [view, setView] = useState<"open" | "closed">("open");
   const [requests, setRequests] = useState<DataRequest[] | null>(null);
   const [openCount, setOpenCount] = useState(0);
+  const [page, setPage] = useState(1);
+  const [total, setTotal] = useState(0);
+  const [searchInput, setSearchInput] = useState("");
+  const [search, setSearch] = useState("");
+  const pageSize = 50;
+
+  // Search once typing pauses; a new search or tab starts at page 1.
+  useEffect(() => {
+    const t = setTimeout(() => setSearch(searchInput.trim()), 350);
+    return () => clearTimeout(t);
+  }, [searchInput]);
+  useEffect(() => { setPage(1); }, [view, search]);
   const [msg, setMsg] = useDismissingState<Msg>(null);
 
   const load = useCallback(async () => {
     if (!token) return;
     try {
-      const res = await apiFetch<{ requests: DataRequest[]; openCount: number }>(`/api/privacy/requests?status=${view}`, { authToken: token });
+      const qs = new URLSearchParams({ status: view, page: String(page), limit: String(pageSize) });
+      if (search) qs.set("search", search);
+      const res = await apiFetch<{ requests: DataRequest[]; openCount: number; total: number }>(`/api/privacy/requests?${qs.toString()}`, { authToken: token });
       setRequests(res.requests);
       setOpenCount(res.openCount);
+      setTotal(res.total ?? res.requests.length);
     } catch (e) {
       setMsg({ type: "err", text: errorMessage(e) || "Could not load requests." });
     }
-  }, [token, view, setMsg]);
+  }, [token, view, page, search, setMsg]);
   useEffect(() => { setRequests(null); load(); }, [load]);
 
   return (
@@ -163,20 +179,28 @@ export default function DataRequestsPage() {
         </p>
       </div>
 
-      <div className="flex gap-2 mb-4">
+      <div className="flex flex-wrap items-center gap-2 mb-4">
         {(["open", "closed"] as const).map(v => (
-          <button key={v} onClick={() => setView(v)} className={`px-3 py-1.5 rounded-lg text-sm font-medium ${view === v ? "bg-brand-600 text-white" : "bg-white border text-gray-700 hover:bg-gray-50"}`}>
+          <button key={v} onClick={() => setView(v)} aria-pressed={view === v} className={`px-3 py-1.5 rounded-lg text-sm font-medium ${view === v ? "bg-brand-600 text-white" : "bg-white border text-gray-700 hover:bg-gray-50"}`}>
             {v === "open" ? `Open${openCount ? ` (${openCount})` : ""}` : "Closed"}
           </button>
         ))}
+        <input
+          type="search"
+          aria-label="Search by name or email"
+          placeholder="Search by name or email"
+          className="ml-auto border rounded-lg px-3 py-1.5 text-sm w-full sm:w-64"
+          value={searchInput}
+          onChange={e => setSearchInput(e.target.value)}
+        />
       </div>
 
       {msg && <div className={`mb-4 p-3 rounded-lg text-sm ${msg.type === "ok" ? "bg-green-50 text-green-800 border border-green-200" : "bg-red-50 text-red-800 border border-red-200"}`}>{msg.text}</div>}
 
       {requests === null ? (
-        <p className="text-sm text-gray-400">Loading…</p>
+        <p className="text-sm text-gray-500">Loading…</p>
       ) : requests.length === 0 ? (
-        <p className="text-sm text-gray-500">{view === "open" ? "No open requests." : "No closed requests yet."}</p>
+        <p className="text-sm text-gray-500">{search ? "No requests match your search." : view === "open" ? "No open requests." : "No closed requests yet."}</p>
       ) : view === "open" ? (
         <ul className="space-y-3">
           {requests.map(r => <OpenRequest key={r.id} request={r} token={token!} onDone={m => { setMsg(m); load(); }} />)}
@@ -189,13 +213,14 @@ export default function DataRequestsPage() {
                 <span className="font-medium text-gray-900">{TYPE_LABEL[r.type]}</span>
                 <span className="text-gray-700">— {r.name}</span>
                 <span className={`text-xs px-2 py-0.5 rounded-full ${STATUS_TONE[r.status]}`}>{r.status}</span>
-                <span className="ml-auto text-xs text-gray-400">{r.closedAt ? `Closed ${fmtDate(r.closedAt)}` : ""}{r.handledBy ? ` by ${r.handledBy}` : ""}</span>
+                <span className="ml-auto text-xs text-gray-500">{r.closedAt ? `Closed ${fmtDate(r.closedAt)}` : ""}{r.handledBy ? ` by ${r.handledBy}` : ""}</span>
               </div>
               {r.response && <p className="text-gray-600 mt-1 whitespace-pre-line">{r.response}</p>}
             </li>
           ))}
         </ul>
       )}
+      <Pager page={page} pageSize={pageSize} total={total} onPage={setPage} />
     </div>
   );
 }

frontend/src/app/dashboard/admin/registrations/page.tsx

@@ -11,6 +11,7 @@ import type { Event, FormResponse, Registration } from "@/types";
 import { BackLink } from "@/components/shared/BackLink";
 import { RegistrationBulkBar } from "@/components/admin/RegistrationBulkBar";
 import { SavedFilters } from "@/components/shared/SavedFilters";
+import { EventPicker } from "@/components/shared/EventPicker";
 
 const STATUS_OPTIONS = ["pending", "confirmed", "partial_paid", "paid", "cancelled"] as const;
 
@@ -265,13 +266,8 @@ export default function AdminRegistrationsPage() {
             />
           </div>
           <div>
-            <label className="block text-xs text-gray-600 mb-1">Event</label>
-            <select className="border rounded px-2 py-1.5 text-sm max-w-48" value={eventFilter} onChange={e => setEventFilter(e.target.value)}>
-              <option value="">All events</option>
-              {events.map(ev => (
-                <option key={ev.id} value={ev.id}>{ev.title}</option>
-              ))}
-            </select>
+            <label className="block text-xs text-gray-600 mb-1" htmlFor="registrations-event">Event</label>
+            <EventPicker id="registrations-event" className="min-w-[14rem]" events={events} value={eventFilter} onChange={setEventFilter} emptyLabel="All events" />
             <div className="flex items-center gap-3 mt-1.5 text-xs text-gray-500">
               <label className="flex items-center gap-1 cursor-pointer">
                 <input type="checkbox" checked={includePastEvents} onChange={e => setIncludePastEvents(e.target.checked)} />

frontend/src/app/dashboard/staff/event-tickets/page.tsx

@@ -12,6 +12,7 @@ import { Ticket } from "lucide-react";
 import { errorMessage } from "@/lib/utils";
 import type { Event, Ticket as TicketRecord } from "@/types";
 import { BackLink } from "@/components/shared/BackLink";
+import { EventPicker } from "@/components/shared/EventPicker";
 
 function EventTicketsContent() {
   const { token, user } = useAuth();
@@ -40,7 +41,7 @@ function EventTicketsContent() {
     (async () => {
       try {
         if (!token) return;
-        const evs = await apiFetch<Event[]>("/api/events/all", { authToken: token });
+        const evs = await apiFetch<Event[]>("/api/events/all?includePast=true", { authToken: token });
         const now = Date.now();
         const active = (evs || []).filter((ev) => {
           const t = new Date(ev.endDate).getTime();
@@ -169,12 +170,14 @@ function EventTicketsContent() {
         )}
 
         <div className="flex flex-col sm:flex-row sm:flex-wrap sm:items-center gap-2 mb-4">
-          <label className="text-sm text-gray-700 shrink-0">Event</label>
-          <select
-              className="border rounded px-3 py-2 w-full sm:w-64 max-w-full"
+          <label className="text-sm text-gray-700 shrink-0" htmlFor="tickets-event">Event</label>
+          <EventPicker
+              id="tickets-event"
+              className="w-full sm:w-72"
+              events={events}
+              emptyLabel="All events"
               value={eventId}
-              onChange={(e) => {
-                const v = e.target.value;
+              onChange={(v) => {
                 setEventId(v);
                 setSelectedUserId("");
                 router.replace(
@@ -185,14 +188,7 @@ function EventTicketsContent() {
                     }`
                 );
               }}
-          >
-            <option value="">All events</option>
-            {events.map((ev) => (
-                <option key={ev.id} value={ev.id}>
-                  {ev.title}
-                </option>
-            ))}
-          </select>
+          />
 
           <label className="text-sm text-gray-700 sm:ml-4 shrink-0">User</label>
           <select

frontend/src/app/dashboard/staff/ticket-scanning/page.tsx

@@ -11,6 +11,7 @@ import { OfflineScanPanel } from "@/components/scanner/OfflineScanPanel";
 import type { SnapshotTicket } from "@/lib/offlineScan";
 import { errorMessage } from "@/lib/utils";
 import type { Event, RecentScan, ScanStats, Section } from "@/types";
+import { EventPicker } from "@/components/shared/EventPicker";
 import { activeSessions, currentSessionLabel, formatSessionWhen, sessionLabel } from "@/lib/sessions";
 import { BackLink } from "@/components/shared/BackLink";
 
@@ -72,7 +73,6 @@ export default function TicketScanningPage() {
 
   // Event selection state
   const [allEvents, setAllEvents] = useState<Event[]>([]);
-  const [includePastEvents, setIncludePastEvents] = useState(false);
   const [selectedEventId, setSelectedEventId] = useState<string>("all");
   const [loadingEvents, setLoadingEvents] = useState<boolean>(false);
   const [sections, setSections] = useState<Section[]>([]);
@@ -98,14 +98,12 @@ export default function TicketScanningPage() {
     })();
   }, [token]);
 
-  const events = useMemo(() => {
-    if (includePastEvents) return allEvents;
-    const cutoff = Date.now() - 12 * 60 * 60 * 1000;
-    return allEvents.filter(ev => {
-      const t = new Date(ev.endDate).getTime();
-      return !isNaN(t) && t >= cutoff;
-    });
-  }, [allEvents, includePastEvents]);
+  // The picker: every event, with the offline-locked one even if it has gone from the list.
+  const pickerEvents = useMemo(() => {
+    const lock = offline.lock;
+    if (!lock || allEvents.some(ev => ev.id === lock.eventId)) return allEvents;
+    return [...allEvents, { id: lock.eventId, title: lock.eventTitle, startDate: new Date().toISOString() } as Event];
+  }, [allEvents, offline.lock]);
 
   const selectedEvent = useMemo(() => allEvents.find(ev => ev.id === selectedEventId) || null, [allEvents, selectedEventId]);
   const eventSessions = useMemo(() => selectedEvent?.scheduleType === "sessions" ? activeSessions(selectedEvent.sessions) : [], [selectedEvent]);
@@ -360,23 +358,18 @@ export default function TicketScanningPage() {
 
           {/* Event filter */}
           <div className="flex flex-col sm:flex-row sm:flex-wrap sm:items-center gap-2 mb-3">
-            <label className="text-sm text-gray-700 shrink-0">Event</label>
-            <select
-              className="border rounded px-3 py-2 w-full sm:w-56 max-w-full"
-              value={selectedEventId}
-              onChange={(e) => setSelectedEventId(e.target.value)}
+            <label className="text-sm text-gray-700 shrink-0" htmlFor="scan-event">Event</label>
+            {/* Events that ended in the last 12 hours still count as current (late scanning). */}
+            <EventPicker
+              id="scan-event"
+              className="w-full sm:w-72"
+              events={pickerEvents}
+              value={selectedEventId === "all" ? "" : selectedEventId}
+              onChange={id => setSelectedEventId(id || "all")}
+              emptyLabel="All events"
+              graceHours={12}
               disabled={!!offline.lock}
-            >
-              <option value="all">All events</option>
-              {offline.lock && !events.some(ev => ev.id === offline.lock!.eventId) && <option value={offline.lock.eventId}>{offline.lock.eventTitle}</option>}
-              {events.map((ev) => (
-                <option key={ev.id} value={ev.id}>{ev.title}</option>
-              ))}
-            </select>
-            <label className="flex items-center gap-1.5 text-sm text-gray-600 cursor-pointer">
-              <input type="checkbox" checked={includePastEvents} onChange={e => setIncludePastEvents(e.target.checked)} />
-              Include past events
-            </label>
+            />
             {loadingEvents && <span className="text-xs text-gray-500">Loading events…</span>}
           </div>
           {sections.length > 0 && (
@@ -418,7 +411,7 @@ export default function TicketScanningPage() {
             offline={offline}
             token={token}
             eventId={selectedEventId}
-            eventTitle={events.find(ev => ev.id === selectedEventId)?.title || offline.lock?.eventTitle || ""}
+            eventTitle={allEvents.find(ev => ev.id === selectedEventId)?.title || offline.lock?.eventTitle || ""}
             sectionId={selectedSectionId !== "all" ? selectedSectionId : null}
             sectionName={sections.find(s => s.id === selectedSectionId)?.name || null}
             onError={setError}

frontend/src/app/dashboard/staff/volunteers/page.tsx

@@ -4,13 +4,13 @@ import React, { useEffect, useState } from "react";
 import { useAuth } from "@/hooks/useAuth";
 import { apiFetch } from "@/lib/api";
 import { errorMessage } from "@/lib/utils";
-import { formatDate } from "@/lib/date";
 import { useDismissingState } from "@/hooks/useDismissingState";
 import { BackLink } from "@/components/shared/BackLink";
 import { RosterSheet } from "@/components/volunteers/RosterSheet";
 import { CheckInQr } from "@/components/volunteers/CheckInQr";
 import { HandHeart } from "lucide-react";
 import type { RosterEvent } from "@/lib/volunteers";
+import { EventPicker } from "@/components/shared/EventPicker";
 
 /** Staff → Volunteers: the roster on the day — who's here, ticking people in, and the check-in QR code. */
 export default function StaffVolunteersPage() {
@@ -48,13 +48,10 @@ export default function StaffVolunteersPage() {
       {events && !events.length && <div className="p-3 border rounded bg-amber-50 text-amber-800 text-sm">No events have volunteer rosters yet. A supervisor adds serving roles under Supervisor → Volunteer rosters.</div>}
       {events && events.length > 0 && (
         <div className="flex flex-wrap gap-2 items-end print:hidden">
-          <label className="text-sm">
-            <span className="block text-xs text-gray-500 mb-1">Event</span>
-            <select className="border rounded-lg px-3 py-2 text-sm min-w-[14rem]" value={eventId} onChange={e => setEventId(e.target.value)}>
-              {!eventId && <option value="">Choose an event…</option>}
-              {events.map(e => <option key={e.id} value={e.id}>{e.title} · {formatDate(new Date(e.startDate))}</option>)}
-            </select>
-          </label>
+          <div className="text-sm">
+            <label className="block text-xs text-gray-500 mb-1" htmlFor="staff-volunteers-event">Event</label>
+            <EventPicker id="staff-volunteers-event" className="w-full" events={events} value={eventId} onChange={setEventId} />
+          </div>
           {eventId && <button onClick={() => setShowQr(q => !q)} className="px-3 py-2 rounded-lg border text-sm">{showQr ? "Show the roster" : "Show the check-in QR code"}</button>}
         </div>
       )}

frontend/src/app/dashboard/supervisor/allocations/page.tsx

@@ -5,12 +5,12 @@ import { useAuth } from "@/hooks/useAuth";
 import { useRouter } from "next/navigation";
 import { DndContext, DragEndEvent, PointerSensor, TouchSensor, useDraggable, useDroppable, useSensor, useSensors } from "@dnd-kit/core";
 import { apiFetch } from "@/lib/api";
-import { formatDate } from "@/lib/date";
 import { useDismissingState } from "@/hooks/useDismissingState";
 import { BedDouble, Plus, Wand2, Printer, Trash2, Pencil, Eraser } from "lucide-react";
 import { errorMessage } from "@/lib/utils";
 import type { Event } from "@/types";
 import { BackLink } from "@/components/shared/BackLink";
+import { EventPicker } from "@/components/shared/EventPicker";
 
 type Group = { id: string; name: string; capacity: number | null; gender: "male" | "female" | null; leaderUserId: string | null; leader?: { id: string; name: string } | null };
 type AllocSet = { id: string; name: string; showOnTicket: boolean; groups: Group[]; assignments: { attendeeId: string; groupId: string }[] };
@@ -222,10 +222,8 @@ export default function AllocationsPage() {
         <div className="space-y-4">
           <div className="flex flex-wrap items-end gap-3">
             <div>
-              <label className="block text-xs text-gray-600 mb-1">Event</label>
-              <select className="border rounded-lg px-3 py-2 text-sm min-w-[16rem]" value={eventId} onChange={e => { setEventId(e.target.value); setSetId(""); }}>
-                {events.map(ev => <option key={ev.id} value={ev.id}>{ev.title} ({formatDate(new Date(ev.startDate))})</option>)}
-              </select>
+              <label className="block text-xs text-gray-600 mb-1" htmlFor="allocations-event">Event</label>
+              <EventPicker id="allocations-event" label="Event" events={events} value={eventId} onChange={id => { setEventId(id); setSetId(""); }} />
             </div>
             {board && (
               <div className="flex flex-wrap items-center gap-1">

frontend/src/app/dashboard/supervisor/at-the-door/page.tsx

@@ -18,6 +18,7 @@ import { printTicketCards, ticketTypeLabel as ticketLabel } from "@/lib/ticketPr
 import { bookableSessions, choosesSessions, isPickOption, todaysSession } from "@/lib/sessions";
 import { SessionPicker } from "@/components/events/SessionPicker";
 import type { Event, EventOption, PublicBundle, Registration, Ticket as TicketRecord, UserSummary } from "@/types";
+import { EventPicker } from "@/components/shared/EventPicker";
 
 type NewAttendee = { name: string; email: string | null; phone: string | null; notifPref: "email" | "whatsapp" | "both" };
 
@@ -426,18 +427,7 @@ export default function AtTheDoorPage() {
                         <h1 className="text-2xl font-semibold text-gray-900 mt-0.5">At The Door</h1>
                     </div>
                 </div>
-                <select
-                    className="border rounded px-3 py-2 text-sm w-full sm:w-72 max-w-full"
-                    value={eventId}
-                    onChange={e => setEventId(e.target.value)}
-                >
-                    <option value="">Select event…</option>
-                    {events.map(ev => (
-                        <option key={ev.id} value={ev.id}>
-                            {ev.title}
-                        </option>
-                    ))}
-                </select>
+                <EventPicker className="w-full sm:w-72" events={events} value={eventId} onChange={setEventId} placeholder="Select event" />
                 <button
                     className="px-3 py-1.5 text-sm rounded bg-gray-100 hover:bg-gray-200 shrink-0 self-start sm:self-auto"
                     onClick={() => router.push("/dashboard")}

frontend/src/app/dashboard/supervisor/attendance/page.tsx

@@ -7,10 +7,10 @@ import { useAuth } from "@/hooks/useAuth";
 import { apiFetch, API_BASE } from "@/lib/api";
 import { useDismissingState } from "@/hooks/useDismissingState";
 import { errorMessage } from "@/lib/utils";
-import { formatDate } from "@/lib/date";
 import { fetchApiFile, saveBlob } from "@/lib/export";
 import type { AttendanceRegister, AttendanceRow, Event } from "@/types";
 import { BackLink } from "@/components/shared/BackLink";
+import { EventPicker } from "@/components/shared/EventPicker";
 
 type Filter = "all" | "completed" | "not_completed" | "missed_recent";
 
@@ -154,13 +154,8 @@ function AttendancePageInner() {
         <div className="border rounded-xl p-4 bg-white shadow-sm space-y-4">
           <div className="flex flex-wrap items-end gap-3">
             <div>
-              <label className="block text-xs text-gray-600 mb-1">Event</label>
-              <select className="border rounded-lg px-3 py-2 text-sm min-w-[16rem] max-w-full" value={eventId} onChange={e => setEventId(e.target.value)}>
-                {events.length === 0 && <option value="">No events</option>}
-                {events.map(ev => (
-                  <option key={ev.id} value={ev.id}>{ev.title} ({formatDate(new Date(ev.startDate))}{ev.scheduleType === "sessions" ? ` · ${(ev.sessions || []).filter(s => !s.cancelled).length} sessions` : ""})</option>
-                ))}
-              </select>
+              <label className="block text-xs text-gray-600 mb-1" htmlFor="attendance-event">Event</label>
+              <EventPicker id="attendance-event" label="Event" events={events} value={eventId} onChange={id => { setEventId(id); }} placeholder="No events" />
             </div>
             <div className="relative">
               <Search className="w-4 h-4 text-gray-400 absolute left-2.5 top-1/2 -translate-y-1/2" />

frontend/src/app/dashboard/supervisor/bundles/page.tsx

@@ -9,6 +9,7 @@ import { Gift, Plus, X, Trash2, Pencil, Power, CalendarClock } from "lucide-reac
 import { errorMessage } from "@/lib/utils";
 import { BackLink } from "@/components/shared/BackLink";
 import type { BundleGroupPricing, BundleKind, EventBundle } from "@/types";
+import { EventPicker, defaultEventId } from "@/components/shared/EventPicker";
 
 type OptionLite = { id: string; name: string; price: number; variants?: { id: string; name: string; price?: number | null }[] };
 type EventLite = { id: string; title: string; startDate: string; endDate?: string; eventOptions: OptionLite[] };
@@ -56,7 +57,6 @@ const fmtRand = (n: number) => `R ${(n || 0).toFixed(2)}`;
 // fieldCls has no width, for fields sized by their row (inputCls is full width).
 const fieldCls = "border rounded-lg px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-brand-400";
 const inputCls = `w-full ${fieldCls}`;
-const isPast = (ev: EventLite) => new Date(ev.endDate || ev.startDate).getTime() < Date.now();
 
 const KIND_INFO: Record<BundleKind, { label: string; hint: string; example: string }> = {
   exact: { label: "Exact set", hint: "These tickets in these numbers", example: "2 adults + 3 kids for R220" },
@@ -92,7 +92,6 @@ export default function BundlesPage() {
   }, [user, loading, router]);
 
   const [allEvents, setAllEvents] = useState<EventLite[]>([]);
-  const [showPast, setShowPast] = useState(false);
   const [eventId, setEventId] = useState("");
   const [bundles, setBundles] = useState<EventBundle[]>([]);
   const [fetching, setFetching] = useState(false);
@@ -107,19 +106,12 @@ export default function BundlesPage() {
       .catch(e => setError(errorMessage(e) || "Failed to load events"));
   }, [token, canView, setError]);
 
-  // Upcoming events soonest first; past ones (when shown) after them, most recent first.
-  const events = useMemo(() => {
-    const upcoming = allEvents.filter(e => !isPast(e)).sort((a, b) => new Date(a.startDate).getTime() - new Date(b.startDate).getTime());
-    const past = allEvents.filter(isPast).sort((a, b) => new Date(b.startDate).getTime() - new Date(a.startDate).getTime());
-    return showPast ? [...upcoming, ...past] : upcoming;
-  }, [allEvents, showPast]);
-
-  // Keep the picked event while it's in the list; otherwise start on the next upcoming one.
+  // Start on the next upcoming event (or the latest one).
   useEffect(() => {
-    if (!events.some(e => e.id === eventId)) setEventId(events[0]?.id || "");
-  }, [events, eventId]);
+    if (!allEvents.some(e => e.id === eventId)) setEventId(defaultEventId(allEvents));
+  }, [allEvents, eventId]);
 
-  const event = events.find(e => e.id === eventId) || null;
+  const event = allEvents.find(e => e.id === eventId) || null;
   const options = event?.eventOptions || [];
 
   const load = useCallback(async () => {
@@ -194,17 +186,9 @@ export default function BundlesPage() {
         <div className="border rounded-xl p-4 bg-white shadow-sm">
           <div className="flex flex-col sm:flex-row sm:items-end gap-3 mb-4">
             <div className="w-full sm:w-auto">
-              <label className="block text-xs text-gray-600 mb-1">Event</label>
-              <select className="border rounded-lg px-3 py-2 text-sm w-full sm:min-w-[20rem]" value={eventId} onChange={e => setEventId(e.target.value)}>
-                {events.length === 0 && <option value="">{showPast ? "No events" : "No upcoming events"}</option>}
-                {events.map(ev => (
-                  <option key={ev.id} value={ev.id}>{ev.title} ({fmtDate(ev.startDate)}){isPast(ev) ? " · past" : ""}</option>
-                ))}
-              </select>
+              <label className="block text-xs text-gray-600 mb-1" htmlFor="bundles-event">Event</label>
+              <EventPicker id="bundles-event" className="w-full sm:min-w-[20rem]" events={allEvents} value={eventId} onChange={setEventId} placeholder="No events" />
             </div>
-            <label className="flex items-center gap-2 text-sm text-gray-700 sm:pb-2">
-              <input type="checkbox" checked={showPast} onChange={e => setShowPast(e.target.checked)} /> Show past events
-            </label>
           </div>
 
           {event && options.length === 0 && (

frontend/src/app/dashboard/supervisor/consent/page.tsx

@@ -11,6 +11,7 @@ import { Table, TableHeader, TableBody, TableRow, TableHead, TableCell } from "@
 import { errorMessage } from "@/lib/utils";
 import type { Event, ConsentRow, MedicalRow } from "@/types";
 import { BackLink } from "@/components/shared/BackLink";
+import { EventPicker, defaultEventId } from "@/components/shared/EventPicker";
 
 
 const STATUS_STYLE: Record<ConsentRow["status"], { label: string; cls: string }> = {
@@ -49,7 +50,7 @@ export default function ConsentTrackerPage() {
       .then(evs => {
         const youth = (evs || []).filter(e => e.requiresParentalConsent);
         setEvents(youth);
-        if (!eventId && youth.length) setEventId(youth[youth.length - 1].id);
+        if (!eventId && youth.length) setEventId(defaultEventId(youth));
       })
       .catch(e => setError(e?.message || "Failed to load events"));
     // eslint-disable-next-line react-hooks/exhaustive-deps
@@ -149,11 +150,8 @@ export default function ConsentTrackerPage() {
         <div className="border rounded-xl p-4 bg-white shadow-sm">
           <div className="flex flex-wrap items-end gap-3 mb-4">
             <div>
-              <label className="block text-xs text-gray-600 mb-1">Youth event</label>
-              <select className="border rounded-lg px-3 py-2 text-sm min-w-[16rem]" value={eventId} onChange={e => setEventId(e.target.value)}>
-                {events.length === 0 && <option value="">No youth events</option>}
-                {events.map(ev => <option key={ev.id} value={ev.id}>{ev.title} ({formatDate(new Date(ev.startDate))})</option>)}
-              </select>
+              <label className="block text-xs text-gray-600 mb-1" htmlFor="consent-event">Youth event</label>
+              <EventPicker id="consent-event" label="Youth event" events={events} value={eventId} onChange={id => { setEventId(id); }} placeholder="No youth events" />
             </div>
             <div>
               <label className="block text-xs text-gray-600 mb-1">Show</label>

frontend/src/app/dashboard/supervisor/email-attendees/page.tsx

@@ -12,6 +12,7 @@ import type { Event, MessageSendResult, Registration, User } from "@/types";
 import { BackLink } from "@/components/shared/BackLink";
 import { MessageKindPicker, matchedText, type MessageKind } from "@/components/shared/MessageKindPicker";
 import { CampusAudiencePicker } from "@/components/shared/CampusAudiencePicker";
+import { EventPicker } from "@/components/shared/EventPicker";
 
 type Attendee = { id: string; name: string; email: string; pref: string };
 type TemplateKey = 'custom'|'payment_reminder'|'event_reminder'|'tickets';
@@ -190,16 +191,8 @@ function EmailAttendeesPageInner() {
   const [tab, setTab] = useState<'attendees'|'automations'|'broadcasts'|'scheduled'>('attendees');
 
   const [allEvents, setAllEvents] = useState<Event[]>([]);
-  const [evIncludePast, setEvIncludePast] = useState(false);
-
-  const events = useMemo(() => {
-    const now = Date.now();
-    if (evIncludePast) return allEvents;
-    return allEvents.filter(ev => {
-      const t = new Date(ev.endDate).getTime();
-      return !isNaN(t) && t > now;
-    });
-  }, [allEvents, evIncludePast]);
+  // Every event; the pickers open on upcoming ones and keep past ones a click away.
+  const events = allEvents;
 
   const loadEvents = useCallback(async () => {
     try {
@@ -544,18 +537,9 @@ function EmailAttendeesPageInner() {
             <div>
               <label className="block text-xs text-gray-600 mb-1">Event</label>
               <div className="flex gap-2 items-center">
-                <select className="border rounded px-3 py-2 text-sm flex-1 min-w-0 max-w-full" value={eventId} onChange={e => setEventId(e.target.value)}>
-                  <option value="">Select an event…</option>
-                  {events.map(ev => (
-                    <option key={ev.id} value={ev.id}>{ev.title}{ev.endDate && new Date(ev.endDate) < new Date() ? ' (past)' : ''}</option>
-                  ))}
-                </select>
+                <EventPicker className="w-full" events={events} value={eventId} onChange={setEventId} placeholder="Select an event" />
                 {loadingEvents && <span className="text-xs text-gray-500">Loading…</span>}
               </div>
-              <label className="flex items-center gap-1.5 text-xs text-gray-500 mt-1 cursor-pointer">
-                <input type="checkbox" checked={evIncludePast} onChange={e => setEvIncludePast(e.target.checked)} />
-                Include past events
-              </label>
             </div>
 
             <div className="grid sm:grid-cols-3 gap-3">
@@ -740,12 +724,7 @@ function EmailAttendeesPageInner() {
               </div>
               <div>
                 <label className="block text-xs text-gray-600 mb-1">Event (optional for placeholders)</label>
-                <select className="w-full border rounded px-3 py-2 text-sm" value={broadcastEventId} onChange={e => setBroadcastEventId(e.target.value)}>
-                  <option value="">No event</option>
-                  {events.map(ev => (
-                    <option key={ev.id} value={ev.id}>{ev.title}</option>
-                  ))}
-                </select>
+                <EventPicker className="w-full" events={events} value={broadcastEventId} onChange={setBroadcastEventId} emptyLabel="No event" />
               </div>
             </div>
 
@@ -1122,12 +1101,7 @@ With gratitude`);
     <div className="grid gap-4">
       <div>
         <label className="block text-xs text-gray-600 mb-1">Event</label>
-        <select className="w-full border rounded px-3 py-2 text-sm" value={autoEventId} onChange={e => setAutoEventId(e.target.value)}>
-          <option value="">Select an event…</option>
-          {(events||[]).map((ev) => (
-            <option key={ev.id} value={ev.id}>{ev.title}</option>
-          ))}
-        </select>
+        <EventPicker className="w-full" events={events} value={autoEventId} onChange={setAutoEventId} placeholder="Select an event" />
       </div>
 
       <div className="grid gap-4">
@@ -1219,12 +1193,7 @@ With gratitude`);
           <div className="grid sm:grid-cols-2 gap-3 mb-2">
             <div>
               <label className="block text-xs text-gray-600 mb-1">Promo Event</label>
-              <select className="w-full border rounded px-3 py-2 text-sm" value={promoEventId} onChange={e => setPromoEventId(e.target.value)}>
-                <option value="">Select event to promote…</option>
-                {(events||[]).map((ev) => (
-                  <option key={ev.id} value={ev.id}>{ev.title}</option>
-                ))}
-              </select>
+              <EventPicker className="w-full" events={events} value={promoEventId} onChange={setPromoEventId} placeholder="Select event to promote" />
             </div>
             <div>
               <label className="block text-xs text-gray-600 mb-1">Send at</label>

frontend/src/app/dashboard/supervisor/event-options/page.tsx

@@ -9,6 +9,7 @@ import { Ticket } from "lucide-react";
 import { errorMessage } from "@/lib/utils";
 import type { Event, EventOption } from "@/types";
 import { BackLink } from "@/components/shared/BackLink";
+import { EventPicker } from "@/components/shared/EventPicker";
 
 // Format a Date (or date-like input) to the value expected by <input type="datetime-local">
 // This returns local time (browser timezone) as YYYY-MM-DDTHH:mm
@@ -228,12 +229,7 @@ function EventOptionsContent() {
 
       <div className="border rounded-xl p-4 bg-white shadow-sm mb-6">
         <div className="text-lg font-semibold mb-3">Select event</div>
-        <select className="w-full border rounded px-3 py-2 text-sm" value={selectedEventId} onChange={e => setSelectedEventId(e.target.value)}>
-          <option value="">Select an event…</option>
-          {events.map(ev => (
-            <option key={ev.id} value={ev.id}>{ev.title}</option>
-          ))}
-        </select>
+        <EventPicker className="w-full" events={events} value={selectedEventId} onChange={setSelectedEventId} placeholder="Select an event" />
         {selectedEventId && (
           <div className="mt-3 text-xs text-gray-600">
             {(() => {

frontend/src/app/dashboard/supervisor/forms/page.tsx

@@ -10,6 +10,7 @@ import { FileText } from "lucide-react";
 import { errorMessage } from "@/lib/utils";
 import type { Event, EventForm, FormResponse, Registration, User } from "@/types";
 import { BackLink } from "@/components/shared/BackLink";
+import { EventPicker } from "@/components/shared/EventPicker";
 
 type FormFieldType = 'yes_no' | 'text' | 'date' | 'numeric' | 'statement' | 'paragraph' | 'rating' | 'multiple_choice';
 
@@ -493,19 +494,8 @@ export default function FormsBrowserPage() {
             <div className="text-base font-semibold mb-3">Filters</div>
             <div className="grid sm:grid-cols-2 lg:grid-cols-4 gap-3 items-end">
               <div className="lg:col-span-2">
-                <label className="block text-xs text-gray-600 mb-1">Event</label>
-                <select
-                  className="border rounded px-2 py-1.5 text-sm w-full"
-                  value={selectedEventId}
-                  onChange={e => setSelectedEventId(e.target.value)}
-                >
-                  <option value="">All events</option>
-                  {events.map(ev => (
-                    <option key={ev.id} value={ev.id}>
-                      {ev.title}{!ev.isActive ? ' (inactive)' : ''}{ev.endDate && new Date(ev.endDate) < new Date() ? ' (past)' : ''}
-                    </option>
-                  ))}
-                </select>
+                <label className="block text-xs text-gray-600 mb-1" htmlFor="forms-view-event">Event</label>
+                <EventPicker id="forms-view-event" className="w-full" events={events} value={selectedEventId} onChange={setSelectedEventId} emptyLabel="All events" />
                 <div className="flex items-center gap-3 mt-1 text-xs text-gray-500">
                   <label className="flex items-center gap-1 cursor-pointer">
                     <input type="checkbox" checked={evIncludePast} onChange={e => setEvIncludePast(e.target.checked)} /> Include past events
@@ -629,18 +619,9 @@ export default function FormsBrowserPage() {
         <div className="border rounded-xl p-4 bg-white shadow-sm">
           <div className="text-base font-semibold mb-3">Edit form structure</div>
           <div className="mb-4">
-            <label className="block text-xs text-gray-600 mb-1">Select event</label>
-            <select
-              className="border rounded px-2 py-1.5 text-sm w-full sm:max-w-sm"
-              value={selectedEventId}
-              onChange={e => { setSelectedEventId(e.target.value); setFormLoadedFor(""); }}
-            >
-              <option value="">Choose an event…</option>
-              {allEvents.map(ev => (
-                <option key={ev.id} value={ev.id}>{ev.title}{!ev.isActive ? ' (inactive)' : ''}</option>
-              ))}
-            </select>
-            <div className="text-xs text-gray-400 mt-1">All events shown (including inactive/past) so you can edit historical forms.</div>
+            <label className="block text-xs text-gray-600 mb-1" htmlFor="forms-manage-event">Select event</label>
+            <EventPicker id="forms-manage-event" className="w-full sm:max-w-sm" events={allEvents} value={selectedEventId} onChange={id => { setSelectedEventId(id); setFormLoadedFor(""); }} />
+            <div className="text-xs text-gray-500 mt-1">Inactive and past events are included (search, or Show past events), so you can edit historical forms.</div>
             {formLoading && <span className="text-xs text-gray-400 mt-1 block">Loading form…</span>}
           </div>
           {!selectedEventId ? (
@@ -678,10 +659,7 @@ export default function FormsBrowserPage() {
           <div className="grid sm:grid-cols-2 gap-3 mb-4 items-end">
             <div>
               <label className="block text-xs text-gray-600 mb-1">Event</label>
-              <select className="border rounded px-2 py-1.5 text-sm w-full" value={fillEventId} onChange={e => setFillEventId(e.target.value)}>
-                <option value="">Select event…</option>
-                {allEvents.map(ev => (<option key={ev.id} value={ev.id}>{ev.title}</option>))}
-              </select>
+              <EventPicker className="w-full" events={allEvents} value={fillEventId} onChange={setFillEventId} placeholder="Select event" />
             </div>
             <div>
               <label className="block text-xs text-gray-600 mb-1">Registration</label>

frontend/src/app/dashboard/supervisor/kids/page.tsx

@@ -5,10 +5,10 @@ import Link from "next/link";
 import { useAuth } from "@/hooks/useAuth";
 import { apiFetch } from "@/lib/api";
 import { errorMessage } from "@/lib/utils";
-import { formatDate } from "@/lib/date";
 import { useDismissingState } from "@/hooks/useDismissingState";
 import { Baby, Plus, Trash2 } from "lucide-react";
 import { BackLink } from "@/components/shared/BackLink";
+import { EventPicker } from "@/components/shared/EventPicker";
 
 type Room = { id: string; name: string; capacity: number | null; minAge: number | null; maxAge: number | null; ratio: number | null; order: number };
 type Settings = {
@@ -96,13 +96,10 @@ export default function KidsSetupPage() {
         </div>
       </div>
 
-      <label className="text-sm block max-w-md">
-        <span className="block text-xs text-gray-500 mb-1">Event</span>
-        <select className="w-full border rounded-lg px-3 py-2 text-sm" value={eventId} onChange={e => setEventId(e.target.value)}>
-          <option value="">Choose an event…</option>
-          {events.map(e => <option key={e.id} value={e.id}>{e.title} · {formatDate(new Date(e.startDate))}{e.kidsCheckIn ? " · kids check-in on" : ""}</option>)}
-        </select>
-      </label>
+      <div className="text-sm block max-w-md">
+        <label className="block text-xs text-gray-500 mb-1" htmlFor="kids-setup-event">Event</label>
+        <EventPicker id="kids-setup-event" className="w-full" events={events} value={eventId} onChange={setEventId} describe={e => (e.kidsCheckIn ? "kids check-in on" : null)} />
+      </div>
 
       {msg && <div role="status" className={`mt-3 p-3 rounded-lg text-sm ${msg.type === "ok" ? "bg-green-50 text-green-800 border border-green-200" : "bg-red-50 text-red-800 border border-red-200"}`}>{msg.text}</div>}
 

frontend/src/app/dashboard/supervisor/manual/page.tsx

@@ -16,6 +16,7 @@ import { choosesSessions, isPickOption } from "@/lib/sessions";
 import { SessionPicker } from "@/components/events/SessionPicker";
 import type { Event, EventOption, PublicBundle, Registration, RegistrationOption, User } from "@/types";
 import { BackLink } from "@/components/shared/BackLink";
+import { EventPicker } from "@/components/shared/EventPicker";
 
 // ─── Pricing helpers ─────────────────────────────────────────────────────────
 
@@ -430,12 +431,7 @@ export default function ManualRegistrationPage() {
       <div className="grid md:grid-cols-2 gap-6">
         <div className="border rounded-xl p-4 bg-white shadow-sm">
           <div className="text-lg font-semibold mb-3">1) Choose event</div>
-          <select className="w-full border rounded px-3 py-2 text-sm" value={selectedEventId} onChange={e => setSelectedEventId(e.target.value)}>
-            <option value="">Select an event…</option>
-            {events.map(ev => (
-              <option key={ev.id} value={ev.id}>{ev.title}</option>
-            ))}
-          </select>
+          <EventPicker className="w-full" events={events} value={selectedEventId} onChange={setSelectedEventId} placeholder="Select an event" />
           {selectedEventId && (
             <div className="mt-3 text-xs text-gray-600">
               {(() => {

frontend/src/app/dashboard/supervisor/offline-scans/page.tsx

@@ -4,12 +4,12 @@ import React, { useCallback, useEffect, useMemo, useState } from "react";
 import { useAuth } from "@/hooks/useAuth";
 import { useRouter } from "next/navigation";
 import { apiFetch } from "@/lib/api";
-import { formatDate } from "@/lib/date";
 import { useDismissingState } from "@/hooks/useDismissingState";
 import { WifiOff, Unlock, CheckCircle2 } from "lucide-react";
 import { errorMessage } from "@/lib/utils";
 import type { Event } from "@/types";
 import { BackLink } from "@/components/shared/BackLink";
+import { EventPicker } from "@/components/shared/EventPicker";
 
 type Lock = { id: string; sectionName: string | null; deviceName: string | null; user: { name: string }; lockedAt: string; snapshotAt: string | null; lastSyncAt: string | null };
 type Report = {
@@ -101,10 +101,8 @@ export default function OfflineScansPage() {
         <div className="space-y-4">
           <div className="flex flex-wrap items-end gap-3">
             <div>
-              <label className="block text-xs text-gray-600 mb-1">Event</label>
-              <select className="border rounded-lg px-3 py-2 text-sm min-w-[16rem]" value={eventId} onChange={e => setEventId(e.target.value)}>
-                {events.map(ev => <option key={ev.id} value={ev.id}>{ev.title} ({formatDate(new Date(ev.startDate))})</option>)}
-              </select>
+              <label className="block text-xs text-gray-600 mb-1" htmlFor="offline-scans-event">Event</label>
+              <EventPicker id="offline-scans-event" label="Event" events={events} value={eventId} onChange={id => { setEventId(id); }} />
             </div>
             <label className="flex items-center gap-2 text-sm text-gray-700 pb-2">
               <input type="checkbox" checked={onlyOpen} onChange={e => setOnlyOpen(e.target.checked)} /> Only reports that need review

frontend/src/app/dashboard/supervisor/payments/page.tsx

@@ -13,6 +13,7 @@ import type { Event, Payment, Registration, User } from "@/types";
 import { BackLink } from "@/components/shared/BackLink";
 import { useOnlinePayments } from "@/lib/onlinePayments";
 import { WaitingForPayment } from "@/components/payments/WaitingForPayment";
+import { EventPicker } from "@/components/shared/EventPicker";
 
 // A donation is never mutated once created — assigning it to a registration creates a separate
 // "leg" Payment row (isDonation:false, originalPaymentId -> the donation, amount > 0) instead.
@@ -53,6 +54,19 @@ type ProviderTx = {
   note?: string | null;
 };
 
+// What each registration still owes. The backend attaches a tranche-aware totalDueComputed
+// (exact even when a line spans multiple early-bird prices); otherwise estimate it here.
+function computeOutstanding(list: Registration[]): Outstanding {
+  const now = new Date();
+  const map: Outstanding = {};
+  for (const r of list) {
+    const totalDue = r.totalDueComputed ?? (r.registrationOptions || []).reduce((sum, opt) => sum + registrationOptionUnitPrice(opt, null, now) * (opt.quantity || 0), 0);
+    const totalPaid = (r.payments || []).reduce((sum, p) => sum + (p.amount || 0), 0);
+    map[r.id] = { totalDue, totalPaid, outstanding: Math.max(0, totalDue - totalPaid) };
+  }
+  return map;
+}
+
 function RegistrationOptions({ regs, regOutstanding }: {
   regs: Registration[];
   regOutstanding: Record<string, { totalDue: number; totalPaid: number; outstanding: number }>;
@@ -161,7 +175,11 @@ function PaymentsContent() {
     if (!user) router.replace("/login");
   }, [user, loading, router]);
 
-  const [payments, setPayments] = useState<Payment[]>([]);
+  // Not every payment ever made: the latest few for "Recent payments", today's for the totals,
+  // and donations with the legs that apply them (for assigning and the assigned list).
+  const [recentPayments, setRecentPayments] = useState<Payment[]>([]);
+  const [todayPayments, setTodayPayments] = useState<Payment[]>([]);
+  const [donationPayments, setDonationPayments] = useState<Payment[]>([]);
   const [loadingList, setLoadingList] = useState(false);
   const [error, setError] = useDismissingState<string | null>(null);
   const [info, setInfo] = useDismissingState<string | null>(null);
@@ -173,8 +191,15 @@ function PaymentsContent() {
     if (!token) return;
     try {
       setLoadingList(true);
-      const list = await fetchAllPayments(token);
-      setPayments(list.sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime()));
+      const start = new Date(); start.setHours(0, 0, 0, 0);
+      const [recent, today, donations] = await Promise.all([
+        apiFetch<{ data: Payment[] }>("/api/payments?page=1&limit=40", { authToken: token }),
+        fetchAllPayments(token, { from: start.toISOString() }),
+        fetchAllPayments(token, { donations: "1" }),
+      ]);
+      setRecentPayments(recent?.data || []);
+      setTodayPayments(today);
+      setDonationPayments(donations);
     } catch (e) {
       setError(errorMessage(e) || "Failed to load payments");
     } finally {
@@ -184,25 +209,16 @@ function PaymentsContent() {
 
   useEffect(() => { loadPayments(); }, [loadPayments]);
 
-  // Load registrations for dropdowns.
-  // GET /api/registrations already embeds each registration's `payments`, so outstanding
-  // balances are computed from that in one pass — no per-registration follow-up requests.
+  // Registrations still owing (not paid or cancelled), for the dropdowns. GET /api/registrations
+  // embeds each registration's `payments`, so balances come from that in one pass. Refunds load
+  // the chosen person's own registrations (including paid ones) when needed.
   const loadRegistrations = useCallback(async () => {
     if (!token) return;
     try {
       setLoadingRegs(true);
-      const regs = await apiFetch<Registration[]>("/api/registrations", { authToken: token });
+      const regs = await apiFetch<Registration[]>("/api/registrations?unpaid=1", { authToken: token });
       const list = Array.isArray(regs) ? regs : [];
-      const now = new Date();
-      const map: Outstanding = {};
-      for (const r of list) {
-        // Backend attaches a tranche-aware totalDueComputed (exact even when a line spans
-        // multiple early-bird prices) — fall back to the old client-side estimate otherwise.
-        const totalDue = r.totalDueComputed ?? (r.registrationOptions || []).reduce((sum, opt) => sum + registrationOptionUnitPrice(opt, null, now) * (opt.quantity || 0), 0);
-        const totalPaid = (r.payments || []).reduce((s, p) => s + (p.amount || 0), 0);
-        map[r.id] = { totalDue, totalPaid, outstanding: Math.max(0, totalDue - totalPaid) };
-      }
-      setRegOutstanding(map);
+      setRegOutstanding(computeOutstanding(list));
       // Sort by createdAt desc
       const sorted = list.sort((a,b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());
       setRegistrations(sorted);
@@ -352,22 +368,20 @@ function PaymentsContent() {
     if (uid) setSelectedUserId(String(uid));
   }, [registrationId, registrations]);
 
-  const [eventsIncludePast, setEventsIncludePast] = useState(false);
   const [eventsIncludeInactive, setEventsIncludeInactive] = useState(false);
 
   useEffect(() => {
     (async () => {
       try {
         if (!token) return;
-        const params = new URLSearchParams();
-        if (eventsIncludePast) params.set("includePast", "true");
+        // Past events too: the pickers open on upcoming ones and keep past ones a click away.
+        const params = new URLSearchParams({ includePast: "true" });
         if (eventsIncludeInactive) params.set("includeInactive", "true");
-        const qs = params.toString() ? `?${params.toString()}` : "";
-        const evs = await apiFetch<Event[]>(`/api/events/all${qs}`, { authToken: token });
+        const evs = await apiFetch<Event[]>(`/api/events/all?${params.toString()}`, { authToken: token });
         setEvents(evs || []);
       } catch {}
     })();
-  }, [token, eventsIncludePast, eventsIncludeInactive]);
+  }, [token, eventsIncludeInactive]);
 
   useEffect(() => {
     // Keep inputs sensible when toggling donation
@@ -420,11 +434,11 @@ function PaymentsContent() {
   const todayTotals = useMemo(() => {
     const start = new Date(); start.setHours(0,0,0,0);
     // Exclude donation-application legs — that money was already counted once, as the donation.
-    const today = payments.filter(p => new Date(p.createdAt).getTime() >= start.getTime() && !isDonationLeg(p));
+    const today = todayPayments.filter(p => new Date(p.createdAt).getTime() >= start.getTime() && !isDonationLeg(p));
     const revenue = today.reduce((s,p)=> s + (p.amount||0), 0);
     const donations = today.filter(p => p.isDonation).length;
     return { revenue, donations, count: today.length };
-  }, [payments]);
+  }, [todayPayments]);
 
   const [mode, setMode] = useState<'payment'|'refund'|'donation'|'reconcile'|'link'>("payment");
 
@@ -650,10 +664,7 @@ function PaymentsContent() {
                                 </div>
                                 <div>
                                   <label className="block text-xs text-gray-600 mb-1">Event</label>
-                                  <select className="w-full border rounded px-3 py-2 text-sm" value={reconcileForm.eventId} onChange={e => setReconcileForm(prev => ({ ...prev, eventId: e.target.value }))}>
-                                    <option value="">Select event…</option>
-                                    {events.map(ev => (<option key={ev.id} value={ev.id}>{ev.title}</option>))}
-                                  </select>
+                                  <EventPicker className="w-full" events={events} value={reconcileForm.eventId} onChange={id => setReconcileForm(prev => ({ ...prev, eventId: id }))} placeholder="Select event" />
                                 </div>
                                 <div className="flex gap-2">
                                   <button className="px-3 py-1.5 rounded bg-emerald-600 text-white text-sm disabled:opacity-50" disabled={!reconcileForm.eventId || reconcileForm.submitting} onClick={submitReconcile}>{reconcileForm.submitting ? 'Saving…' : 'Confirm'}</button>
@@ -707,15 +718,8 @@ function PaymentsContent() {
               </div>
               <div>
                 <label className="block text-xs text-gray-600 mb-1">Event (for donations)</label>
-                <select className="w-full border rounded px-3 py-2 text-sm" value={eventId} onChange={e => setEventId(e.target.value)} disabled={!isDonation}>
-                  <option value="">Select event…</option>
-                  {events.map(ev => (<option key={ev.id} value={ev.id}>{ev.title}</option>))}
-                </select>
+                <EventPicker className="w-full" events={events} value={eventId} onChange={setEventId} placeholder="Select event" disabled={!isDonation} />
                 <div className="flex items-center gap-4 mt-1.5 text-xs text-gray-500">
-                  <label className="flex items-center gap-1 cursor-pointer">
-                    <input type="checkbox" checked={eventsIncludePast} onChange={e => setEventsIncludePast(e.target.checked)} />
-                    Include past events
-                  </label>
                   {user?.role === "admin" && (
                     <label className="flex items-center gap-1 cursor-pointer">
                       <input type="checkbox" checked={eventsIncludeInactive} onChange={e => setEventsIncludeInactive(e.target.checked)} />
@@ -741,10 +745,7 @@ function PaymentsContent() {
           {mode === 'refund' && (
             <>
               <RefundSection
-                payments={payments}
                 allUsers={allUsers}
-                regsForUser={(uid:string)=> registrations.filter((r)=> String(r.user?.id||r.userId)===String(uid))}
-                regOutstanding={regOutstanding}
                 onDone={async()=>{ await Promise.all([loadPayments(), loadRegistrations()]); setInfo('Refund recorded'); }}
               />
               {loadingUsers && <div className="text-xs text-gray-500">Loading users…</div>}
@@ -754,7 +755,7 @@ function PaymentsContent() {
           {mode === 'donation' && (
             <>
               <DonationAssignSection
-                payments={payments}
+                payments={donationPayments}
                 allUsers={allUsers}
                 registrations={registrations}
                 regOutstanding={regOutstanding}
@@ -762,7 +763,7 @@ function PaymentsContent() {
               />
               {loadingUsers && <div className="text-xs text-gray-500">Loading users…</div>}
               <AssignedDonationsList
-                payments={payments}
+                payments={donationPayments}
                 onDone={async()=>{ await Promise.all([loadPayments(), loadRegistrations()]); setInfo('Donation unassigned'); }}
               />
             </>
@@ -815,7 +816,7 @@ function PaymentsContent() {
               {loadingList && <span className="text-xs text-gray-500">Loading…</span>}
             </div>
             <ul className="text-sm space-y-2 max-h-[520px] overflow-auto pr-2">
-              {payments.filter(p => !isDonationLeg(p)).slice(0, 25).map(p => {
+              {recentPayments.filter(p => !isDonationLeg(p)).slice(0, 25).map(p => {
                 const amt = p.amount || 0;
                 const isRefund = amt < 0;
                 return (
@@ -834,7 +835,7 @@ function PaymentsContent() {
                   </li>
                 );
               })}
-              {payments.length === 0 && <li className="text-gray-500">No payments yet.</li>}
+              {recentPayments.length === 0 && <li className="text-gray-500">No payments yet.</li>}
             </ul>
           </div>
         </div>
@@ -864,14 +865,13 @@ function PaymentsContent() {
 }
 
 type RefundSectionProps = {
-  payments: Payment[];
   allUsers: User[];
-  regsForUser: (userId: string) => Registration[];
-  regOutstanding: Outstanding;
   onDone: () => void | Promise<void>;
 };
 
-function RefundSection({ payments, allUsers, regsForUser, regOutstanding, onDone }: RefundSectionProps) {
+// The chosen person's own payments and registrations (paid ones too) are loaded when they're
+// picked, rather than every payment and registration up front.
+function RefundSection({ allUsers, onDone }: RefundSectionProps) {
   const { token } = useAuth();
   const [userId, setUserId] = useState<string>("");
   const [target, setTarget] = useState<'payment'|'registration'>('payment');
@@ -883,10 +883,28 @@ function RefundSection({ payments, allUsers, regsForUser, regOutstanding, onDone
   const [submitting, setSubmitting] = useState(false);
   const [err, setErr] = useState<string | null>(null);
 
-  const paymentsForUser = useMemo(() => {
-    if (!userId) return [];
-    return payments.filter(p => String(p.userId) === String(userId) && (p.amount || 0) > 0);
-  }, [payments, userId]);
+  const [payments, setPayments] = useState<Payment[]>([]);
+  const [regs, setRegs] = useState<Registration[]>([]);
+  const [loadingUser, setLoadingUser] = useState(false);
+  useEffect(() => {
+    setPayments([]); setRegs([]);
+    if (!userId || !token) return;
+    let cancelled = false;
+    setLoadingUser(true);
+    Promise.all([
+      fetchAllPayments(token, { userId }),
+      apiFetch<Registration[]>(`/api/registrations?userId=${encodeURIComponent(userId)}`, { authToken: token }),
+    ]).then(([p, r]) => {
+      if (cancelled) return;
+      setPayments(p);
+      setRegs((Array.isArray(r) ? r : []).sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime()));
+    }).catch((e) => { if (!cancelled) setErr(errorMessage(e) || "Couldn't load this person's payments"); })
+      .finally(() => { if (!cancelled) setLoadingUser(false); });
+    return () => { cancelled = true; };
+  }, [userId, token]);
+  const regOutstanding = useMemo(() => computeOutstanding(regs), [regs]);
+
+  const paymentsForUser = useMemo(() => payments.filter(p => (p.amount || 0) > 0), [payments]);
 
   useEffect(() => {
     // Reset dependent fields on changes
@@ -907,7 +925,6 @@ function RefundSection({ payments, allUsers, regsForUser, regOutstanding, onDone
     }
   }, [paymentId, target, payments]);
 
-  const regs = useMemo(() => regsForUser(userId), [regsForUser, userId]);
 
   const submitRefund = async () => {
     if (!token) return;
@@ -948,6 +965,7 @@ function RefundSection({ payments, allUsers, regsForUser, regOutstanding, onDone
       <div className="grid gap-2">
         <label className="text-xs text-gray-600">User</label>
         <UserSearchField allUsers={allUsers} value={userId} onChange={uid => setUserId(uid)} />
+        {loadingUser && <div className="text-xs text-gray-500" role="status">Loading their payments…</div>}
         <label className="text-xs text-gray-600 mt-2">Refund target</label>
         <div className="flex gap-4 text-sm">
           <label className="flex items-center gap-2"><input type="radio" name="refundTarget" checked={target==='payment'} onChange={()=>setTarget('payment')} /> Payment</label>

frontend/src/app/dashboard/supervisor/volunteers/page.tsx

@@ -4,13 +4,13 @@ import React, { useCallback, useEffect, useState } from "react";
 import { useAuth } from "@/hooks/useAuth";
 import { apiFetch } from "@/lib/api";
 import { errorMessage } from "@/lib/utils";
-import { formatDate } from "@/lib/date";
 import { useDismissingState } from "@/hooks/useDismissingState";
 import { BackLink } from "@/components/shared/BackLink";
 import { RosterSheet } from "@/components/volunteers/RosterSheet";
 import { CheckInQr } from "@/components/volunteers/CheckInQr";
 import { HandHeart } from "lucide-react";
 import { hoursText, type HoursRow, type RosterEvent } from "@/lib/volunteers";
+import { EventPicker } from "@/components/shared/EventPicker";
 
 type Settings = {
   event: { id: string; title: string; volunteerOptionId: string | null };
@@ -91,13 +91,10 @@ export default function VolunteerRostersPage() {
         </div>
       </div>
 
-      <label className="text-sm block max-w-md print:hidden">
-        <span className="block text-xs text-gray-500 mb-1">Event</span>
-        <select className="w-full border rounded-lg px-3 py-2 text-sm" value={eventId} onChange={e => setEventId(e.target.value)}>
-          <option value="">Choose an event…</option>
-          {events.map(e => <option key={e.id} value={e.id}>{e.title} · {formatDate(new Date(e.startDate))}{e.roles ? ` · ${e.roles} role${e.roles === 1 ? "" : "s"}` : ""}</option>)}
-        </select>
-      </label>
+      <div className="text-sm block max-w-md print:hidden">
+        <label className="block text-xs text-gray-500 mb-1" htmlFor="volunteers-event">Event</label>
+        <EventPicker id="volunteers-event" className="w-full" events={events} value={eventId} onChange={setEventId} describe={e => (e.roles ? `${e.roles} role${e.roles === 1 ? "" : "s"}` : null)} />
+      </div>
 
       {msg && <div role="status" className={`mt-3 p-3 rounded-lg text-sm print:hidden ${msg.type === "ok" ? "bg-green-50 text-green-800 border border-green-200" : "bg-red-50 text-red-800 border border-red-200"}`}>{msg.text}</div>}
 

frontend/src/app/dashboard/supervisor/waitlist/page.tsx

@@ -12,6 +12,7 @@ import { errorMessage } from "@/lib/utils";
 import { entryLineName } from "@/lib/waitlist";
 import type { Event } from "@/types";
 import { BackLink } from "@/components/shared/BackLink";
+import { EventPicker } from "@/components/shared/EventPicker";
 
 type Entry = {
   id: string;
@@ -117,11 +118,8 @@ export default function WaitlistPage() {
         <div className="border rounded-xl p-4 bg-white shadow-sm">
           <div className="flex flex-wrap items-end gap-3 mb-4">
             <div>
-              <label className="block text-xs text-gray-600 mb-1">Event</label>
-              <select className="border rounded-lg px-3 py-2 text-sm min-w-[16rem]" value={eventId} onChange={e => setEventId(e.target.value)}>
-                {events.length === 0 && <option value="">No events with a waitlist</option>}
-                {events.map(ev => <option key={ev.id} value={ev.id}>{ev.title} ({formatDate(new Date(ev.startDate))})</option>)}
-              </select>
+              <label className="block text-xs text-gray-600 mb-1" htmlFor="waitlist-event">Event</label>
+              <EventPicker id="waitlist-event" label="Event" events={events} value={eventId} onChange={id => { setEventId(id); }} placeholder="No events with a waitlist" />
             </div>
             {selected && (
               <p className="text-xs text-gray-500">

frontend/src/app/dashboard/supervisor/whatsapp-attendees/page.tsx

@@ -12,6 +12,7 @@ import type { Event, MessageSendResult, Registration, User } from "@/types";
 import { BackLink } from "@/components/shared/BackLink";
 import { MessageKindPicker, matchedText, type MessageKind } from "@/components/shared/MessageKindPicker";
 import { CampusAudiencePicker } from "@/components/shared/CampusAudiencePicker";
+import { EventPicker } from "@/components/shared/EventPicker";
 
 // Attendee with preference info
 type Attendee = { id: string; name: string; phone: string; pref: string };
@@ -263,12 +264,7 @@ function WAAutomationsPanel({ events, token, onInfo, onError }: { events: Event[
     <div className="grid gap-4">
       <div>
         <label className="block text-xs text-gray-600 mb-1">Event</label>
-        <select className="w-full border rounded px-3 py-2 text-sm" value={autoEventId} onChange={(e) => setAutoEventId(e.target.value)}>
-          <option value="">Select an event…</option>
-          {(events || []).map((ev) => (
-            <option key={ev.id} value={ev.id}>{ev.title}</option>
-          ))}
-        </select>
+        <EventPicker className="w-full" events={events} value={autoEventId} onChange={setAutoEventId} placeholder="Select an event" />
       </div>
 
       <div className="grid gap-4">
@@ -328,12 +324,7 @@ function WAAutomationsPanel({ events, token, onInfo, onError }: { events: Event[
           <div className="grid sm:grid-cols-2 gap-3 mb-2">
             <div>
               <label className="block text-xs text-gray-600 mb-1">Promo Event</label>
-              <select className="w-full border rounded px-3 py-2 text-sm" value={promoEventId} onChange={(e) => setPromoEventId(e.target.value)}>
-                <option value="">Select event to promote…</option>
-                {(events || []).map((ev) => (
-                  <option key={ev.id} value={ev.id}>{ev.title}</option>
-                ))}
-              </select>
+              <EventPicker className="w-full" events={events} value={promoEventId} onChange={setPromoEventId} placeholder="Select event to promote" />
             </div>
             <div>
               <label className="block text-xs text-gray-600 mb-1">Send at</label>
@@ -379,13 +370,8 @@ function WhatsAppAttendeesPageInner() {
   const [tab, setTab] = useState<"attendees" | "automations" | "broadcasts" | "scheduled">("attendees");
   const [loadingEvents, setLoadingEvents] = useState(false);
   const [allEvents, setAllEvents] = useState<Event[]>([]);
-  const [evIncludePast, setEvIncludePast] = useState(false);
-
-  const events = useMemo(() => {
-    const now = Date.now();
-    if (evIncludePast) return allEvents;
-    return allEvents.filter((ev) => !isNaN(new Date(ev.endDate).getTime()) && new Date(ev.endDate).getTime() > now);
-  }, [allEvents, evIncludePast]);
+  // Every event; the pickers open on upcoming ones and keep past ones a click away.
+  const events = allEvents;
 
   useEffect(() => {
     const loadEvents = async () => {
@@ -651,18 +637,9 @@ function WhatsAppAttendeesPageInner() {
             <div>
               <label className="block text-xs text-gray-600 mb-1">Event</label>
               <div className="flex gap-2 items-center">
-                <select className="border rounded px-3 py-2 text-sm flex-1 min-w-0" value={eventId} onChange={(e) => setEventId(e.target.value)}>
-                  <option value="">Select an event…</option>
-                  {events.map((ev) => (
-                    <option key={ev.id} value={ev.id}>{ev.title}{ev.endDate && new Date(ev.endDate) < new Date() ? " (past)" : ""}</option>
-                  ))}
-                </select>
+                <EventPicker className="w-full" events={events} value={eventId} onChange={setEventId} placeholder="Select an event" />
                 {loadingEvents && <span className="text-xs text-gray-500">Loading…</span>}
               </div>
-              <label className="flex items-center gap-1.5 text-xs text-gray-500 mt-1 cursor-pointer">
-                <input type="checkbox" checked={evIncludePast} onChange={(e) => setEvIncludePast(e.target.checked)} />
-                Include past events
-              </label>
             </div>
 
             <div className="grid sm:grid-cols-3 gap-3">
@@ -814,12 +791,7 @@ function WhatsAppAttendeesPageInner() {
               </div>
               <div>
                 <label className="block text-xs text-gray-600 mb-1">Event (optional for placeholders)</label>
-                <select className="w-full border rounded px-3 py-2 text-sm" value={broadcastEventId} onChange={(e) => setBroadcastEventId(e.target.value)}>
-                  <option value="">No event</option>
-                  {events.map((ev) => (
-                    <option key={ev.id} value={ev.id}>{ev.title}</option>
-                  ))}
-                </select>
+                <EventPicker className="w-full" events={events} value={broadcastEventId} onChange={setBroadcastEventId} emptyLabel="No event" />
               </div>
             </div>
 

frontend/src/app/dashboard/user/page.tsx

@@ -2,6 +2,7 @@
 import React, { useEffect, useMemo, useState } from "react";
 import { useAuth } from "@/hooks/useAuth";
 import { apiFetch, createFullPaymentCheckout } from "@/lib/api";
+import { apiV2 } from "@/lib/apiV2";
 import { useOnlinePayments } from "@/lib/onlinePayments";
 import { useRouter } from "next/navigation";
 import { formatDate } from "@/lib/date";
@@ -454,10 +455,7 @@ export default function UserDashboardPage() {
     if (!token || !activeRegId) return;
     setCancelLoading(true);
     try {
-      await apiFetch(`/api/registrations/${encodeURIComponent(activeRegId)}`, {
-        method: 'DELETE',
-        authToken: token,
-      });
+      await apiV2("post", "/registrations/{id}/cancel", { params: { id: activeRegId }, authToken: token });
       const myRegs = await apiFetch<Registration[]>(`/api/registrations/myregistrations?showPast=${showPast ? '1' : '0'}`, { authToken: token });
       setRegistrations(myRegs);
       setActiveRegId(null);

frontend/src/app/register/[eventId]/RegisterForm.tsx

@@ -3,6 +3,7 @@
 import React, { useEffect, useMemo, useState } from "react";
 import { useAuth } from "@/hooks/useAuth";
 import { apiFetch } from "@/lib/api";
+import { apiV2 } from "@/lib/apiV2";
 import { useOnlinePayments } from "@/lib/onlinePayments";
 import { CouponCodeField, AppliedCoupon } from "@/components/shared/CouponCodeField";
 import { BundleBuilder, BundleOffers, BundleSavings, useBundleQuote } from "@/components/shared/BundleDeals";
@@ -552,6 +553,15 @@ export default function RegisterForm({ event: baseEvent }: { event: RegisterEven
       setError(`The minimum donation is R${MIN_DONATION}. Choose None to skip it.`);
       return;
     }
+    // Registers through API v2; returns the new registration (balance = what's owed now).
+    const register = async (extra: { couponCode?: string; waitlistToken?: string; guest?: { name: string; email: string; phone?: string } }, authToken?: string | null) => {
+      const named = namedAttendees();
+      const { data } = await apiV2("post", "/registrations", {
+        body: { eventId, options: items, analyticsSessionId: analyticsSessionId(), ...(named.length > 0 ? { attendees: named, ticketDelivery: delivery } : {}), ...extra },
+        authToken,
+      });
+      return data;
+    };
     const donationParam = donation > 0 ? `&donation=${encodeURIComponent(donation.toFixed(2))}` : "";
 
     // Claim link without logging in: the link identifies the person.
@@ -559,11 +569,8 @@ export default function RegisterForm({ event: baseEvent }: { event: RegisterEven
       try {
         setError(null);
         setCreatingRegistration(true);
-        const res = await apiFetch<{ id: string; totalDueComputed?: number }>("/api/registrations", {
-          method: "POST",
-          body: { eventId, options: items, waitlistToken, analyticsSessionId: analyticsSessionId(), ...(namedAttendees().length > 0 ? { attendees: namedAttendees(), ticketDelivery: delivery } : {}) },
-        });
-        if (res?.id) window.location.href = `/registration/success?registrationId=${encodeURIComponent(res.id)}&totalDue=${encodeURIComponent((res.totalDueComputed ?? payable).toFixed(2))}`;
+        const res = await register({ waitlistToken });
+        window.location.href = `/registration/success?registrationId=${encodeURIComponent(res.id)}&totalDue=${encodeURIComponent(Math.max(0, res.balance).toFixed(2))}`;
       } catch (e) {
         setError(errorMessage(e) || "Registration failed");
       } finally {
@@ -581,21 +588,10 @@ export default function RegisterForm({ event: baseEvent }: { event: RegisterEven
       try {
         setError(null);
         setCreatingRegistration(true);
-        const res = await apiFetch<{ id: string; totalDueComputed?: number; couponError?: string }>("/api/registrations", {
-          method: "POST",
-          body: {
-            eventId,
-            options: items,
-            ...(coupon ? { couponCode: coupon.code } : {}),
-            analyticsSessionId: analyticsSessionId(),
-            ...(namedAttendees().length > 0 ? { attendees: namedAttendees(), ticketDelivery: delivery } : {}),
-            ...(waitlistToken ? { waitlistToken } : {}),
-          },
-          authToken: token,
-        });
-        if (res?.id) {
+        const res = await register({ ...(coupon ? { couponCode: coupon.code } : {}), ...(waitlistToken ? { waitlistToken } : {}) }, token);
+        {
           const hasForm = !!(event?.form && Array.isArray(event.form.fields) && event.form.fields.length > 0);
-          const due = res.totalDueComputed ?? payable;
+          const due = Math.max(0, res.balance);
           const next = hasForm
             ? `/forms?registrationId=${encodeURIComponent(res.id)}${donationParam}`
             : `/registration/success?registrationId=${encodeURIComponent(res.id)}&totalDue=${encodeURIComponent((due || 0).toFixed(2))}${donationParam}`;
@@ -628,15 +624,8 @@ export default function RegisterForm({ event: baseEvent }: { event: RegisterEven
     try {
       setError(null);
       setCreatingRegistration(true);
-      const res = await apiFetch<{ id: string }>("/api/registrations", {
-        method: "POST",
-        body: {
-          eventId, options: items, guestName: guestName.trim(), guestEmail: guestEmail.trim(), guestPhone: guestPhone.trim() || undefined,
-          analyticsSessionId: analyticsSessionId(),
-          ...(namedAttendees().length > 0 ? { attendees: namedAttendees(), ticketDelivery: delivery } : {}),
-        },
-      });
-      if (res?.id) {
+      const res = await register({ guest: { name: guestName.trim(), email: guestEmail.trim(), ...(guestPhone.trim() ? { phone: guestPhone.trim() } : {}) } });
+      {
         const hasForm = !!(event?.form && Array.isArray(event.form.fields) && event.form.fields.length > 0);
         if (hasForm) {
           window.location.href = `/forms?registrationId=${encodeURIComponent(res.id)}`;

frontend/src/app/self-service/page.tsx

@@ -12,6 +12,7 @@ import type { Event, PublicBundle, Registration } from "@/types";
 import { choosesSessions, isPickOption } from "@/lib/sessions";
 import { SessionPicker } from "@/components/events/SessionPicker";
 import { ModalOverlay } from "@/components/shared/ModalOverlay";
+import { EventPicker } from "@/components/shared/EventPicker";
 
 // ─── Types ────────────────────────────────────────────────────────────────────
 type EarlyBirdTier = { deadline: string; price: number; order?: number; variantId?: string | null };
@@ -841,19 +842,7 @@ export default function SelfServicePage() {
                 ) : (
                   <div>
                     <label htmlFor="kiosk-event" className="block text-sm font-medium text-gray-700 mb-1">Event</label>
-                    <select
-                      id="kiosk-event"
-                      value={selectedEventId}
-                      onChange={(e) => setSelectedEventId(e.target.value)}
-                      className="w-full border border-gray-300 rounded-xl px-4 py-3 text-base focus:outline-none focus:ring-2 focus:ring-brand-500"
-                    >
-                      <option value="">— Select an event —</option>
-                      {events.map((ev) => (
-                        <option key={ev.id} value={ev.id}>
-                          {ev.title} ({fmtDate(ev.startDate)})
-                        </option>
-                      ))}
-                    </select>
+                    <EventPicker id="kiosk-event" className="w-full text-base" events={events} value={selectedEventId} onChange={setSelectedEventId} placeholder="Select an event" />
                   </div>
                 )}
                 {selectedEvent && (

frontend/src/components/admin/WebhookGuide.tsx

@@ -0,0 +1,172 @@
+"use client";
+
+import React, { useState } from "react";
+import { BookOpen, ChevronDown, ChevronRight, Copy } from "lucide-react";
+
+type EventType = { type: string; label: string; description: string; example?: unknown };
+
+const RETRIES = "1 minute, 5 minutes, 30 minutes, 2 hours and 12 hours";
+
+const VERIFY_NODE = `// Node.js / Express — check the signature before trusting a request.
+const crypto = require("crypto");
+const SECRET = process.env.CROSSEVENTS_WEBHOOK_SECRET; // whsec_…
+
+app.post("/crossevents-hook", express.raw({ type: "application/json" }), (req, res) => {
+  const header = req.get("X-CrossEvents-Signature") || "";   // t=1767225600,v1=5f0c…
+  const { t, v1 } = Object.fromEntries(header.split(",").map(p => p.split("=")));
+  const body = req.body.toString("utf8");                     // the raw body, unparsed
+  const expected = crypto.createHmac("sha256", SECRET).update(\`\${t}.\${body}\`).digest("hex");
+  const fresh = Math.abs(Date.now() / 1000 - Number(t)) < 300; // within 5 minutes
+  if (!fresh || !v1 || !crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(expected))) {
+    return res.status(400).send("bad signature");
+  }
+  const event = JSON.parse(body);
+  // Deliveries can repeat: skip an event.id you've already handled.
+  res.sendStatus(200); // answer quickly, then do the slow work
+  handle(event);
+});`;
+
+const VERIFY_PHP = `<?php // PHP — check the signature before trusting a request.
+$secret = getenv('CROSSEVENTS_WEBHOOK_SECRET');
+$body   = file_get_contents('php://input');
+parse_str(str_replace(',', '&', $_SERVER['HTTP_X_CROSSEVENTS_SIGNATURE'] ?? ''), $sig);
+$expected = hash_hmac('sha256', $sig['t'] . '.' . $body, $secret);
+if (abs(time() - (int) $sig['t']) > 300 || !hash_equals($expected, $sig['v1'] ?? '')) {
+  http_response_code(400); exit('bad signature');
+}
+$event = json_decode($body, true);
+http_response_code(200);`;
+
+function CopyButton({ text, label = "Copy" }: { text: string; label?: string }) {
+  const [done, setDone] = useState(false);
+  return (
+    <button type="button" className="inline-flex items-center gap-1 px-2 py-0.5 rounded border bg-white text-[11px] hover:bg-gray-50"
+      onClick={() => { navigator.clipboard?.writeText(text).then(() => { setDone(true); setTimeout(() => setDone(false), 1500); }).catch(() => {}); }}>
+      <Copy className="w-3 h-3" aria-hidden /> {done ? "Copied" : label}
+    </button>
+  );
+}
+
+function Code({ text }: { text: string }) {
+  return (
+    <div className="relative">
+      <div className="absolute right-2 top-2"><CopyButton text={text} /></div>
+      <pre className="max-h-80 overflow-auto rounded-lg bg-gray-900 text-gray-100 p-3 pr-20 text-[11px] leading-relaxed">{text}</pre>
+    </div>
+  );
+}
+
+const H = ({ children }: { children: React.ReactNode }) => <h4 className="text-sm font-semibold text-gray-900 mt-4 mb-1.5">{children}</h4>;
+
+/**
+ * Site settings → Webhooks → "How webhooks work": what arrives, when, how to check it's from us,
+ * and an example of every event type, for whoever builds the receiving side.
+ */
+export function WebhookGuide({ eventTypes, keepDays, defaultOpen = false }: { eventTypes: EventType[]; keepDays: number; defaultOpen?: boolean }) {
+  const [open, setOpen] = useState(defaultOpen);
+  const [openType, setOpenType] = useState<string | null>(null);
+  const [lang, setLang] = useState<"node" | "php">("node");
+  const envelope = (t: EventType) => JSON.stringify({ id: "evt_3f9c2a1e-6d4b-4c8e-9a51-2b7d0e6f1c34", type: t.type, createdAt: "2026-10-29T08:16:01.512Z", data: t.example ?? {} }, null, 2);
+
+  return (
+    <section className="border rounded-xl bg-white" data-testid="webhook-guide">
+      <button type="button" aria-expanded={open} onClick={() => setOpen(o => !o)} className="w-full flex items-center gap-2 px-4 py-3 text-left">
+        {open ? <ChevronDown className="w-4 h-4 text-gray-500" aria-hidden /> : <ChevronRight className="w-4 h-4 text-gray-500" aria-hidden />}
+        <BookOpen className="w-4 h-4 text-brand-700" aria-hidden />
+        <span className="font-medium text-gray-900">How webhooks work</span>
+        <span className="text-xs text-gray-500">what is sent, the signature, and an example of each event</span>
+      </button>
+
+      {open && (
+        <div className="px-4 pb-4 text-sm text-gray-700 border-t">
+          <H>What happens</H>
+          <ol className="list-decimal pl-5 space-y-1">
+            <li>Something happens here, such as a registration or a payment, that one of your webhooks is set to send.</li>
+            <li>A second or two later, an <code>HTTP POST</code> with a JSON body goes to that webhook&apos;s address. Everything is sent from the server; nothing comes from people&apos;s browsers.</li>
+            <li>Your side answers with any <code>2xx</code> status within 10 seconds, and the delivery is done.</li>
+            <li>
+              Anything else counts as a failure: another status, no answer, or a redirect (redirects aren&apos;t followed). The delivery is tried again after {RETRIES}, then marked <em>failed</em>.
+              You can send any delivery again from its <em>Delivery log</em>.
+            </li>
+          </ol>
+
+          <H>Using it without writing code</H>
+          <p>
+            In Zapier, use <strong>Webhooks by Zapier → Catch Hook</strong>; in Make, use <strong>Webhooks → Custom webhook</strong>. Paste the address it gives you here, choose the events, then click <em>Send test</em>. The fields in the examples below become available to map into ChurchSuite, Planning Center, a spreadsheet, Mailchimp and so on.
+          </p>
+
+          <H>What arrives</H>
+          <p className="mb-2">Every request has the same envelope. <code>data</code> depends on the type (see the examples below).</p>
+          <div className="overflow-x-auto">
+            <table className="min-w-full text-xs border rounded">
+              <thead className="bg-gray-50 text-left"><tr><th className="px-2 py-1.5">Field</th><th className="px-2 py-1.5">Meaning</th></tr></thead>
+              <tbody className="divide-y">
+                <tr><td className="px-2 py-1.5"><code>id</code></td><td className="px-2 py-1.5">The event&apos;s id (<code>evt_…</code>). It stays the same on retries, so use it to skip events you&apos;ve already handled.</td></tr>
+                <tr><td className="px-2 py-1.5"><code>type</code></td><td className="px-2 py-1.5">The event type, e.g. <code>registration.paid</code>. The <em>Send test</em> button sends <code>webhook.test</code>.</td></tr>
+                <tr><td className="px-2 py-1.5"><code>createdAt</code></td><td className="px-2 py-1.5">When it happened (ISO 8601, UTC).</td></tr>
+                <tr><td className="px-2 py-1.5"><code>data</code></td><td className="px-2 py-1.5">The details. Amounts are in rand; dates are ISO 8601 in UTC.</td></tr>
+              </tbody>
+            </table>
+          </div>
+          <p className="mt-3 mb-2">Headers:</p>
+          <div className="overflow-x-auto">
+            <table className="min-w-full text-xs border rounded">
+              <tbody className="divide-y">
+                <tr><td className="px-2 py-1.5 whitespace-nowrap"><code>Content-Type</code></td><td className="px-2 py-1.5"><code>application/json</code></td></tr>
+                <tr><td className="px-2 py-1.5 whitespace-nowrap"><code>User-Agent</code></td><td className="px-2 py-1.5"><code>CrossEvents-Webhooks/1</code></td></tr>
+                <tr><td className="px-2 py-1.5 whitespace-nowrap"><code>X-CrossEvents-Event</code></td><td className="px-2 py-1.5">The event type, the same as <code>type</code>.</td></tr>
+                <tr><td className="px-2 py-1.5 whitespace-nowrap"><code>X-CrossEvents-Delivery</code></td><td className="px-2 py-1.5">This delivery&apos;s id. Each webhook gets its own, and it&apos;s the same on retries.</td></tr>
+                <tr><td className="px-2 py-1.5 whitespace-nowrap"><code>X-CrossEvents-Signature</code></td><td className="px-2 py-1.5"><code>t=&lt;unix seconds&gt;,v1=&lt;signature&gt;</code>, explained below.</td></tr>
+              </tbody>
+            </table>
+          </div>
+
+          <H>Checking it came from here</H>
+          <p className="mb-2">
+            Anyone who knows the address could post to it, so check the signature before acting on a request. <code>v1</code> is the HMAC-SHA256, in hex, of <code>t</code>, a full stop, and the raw request body (<code>&lt;t&gt;.&lt;body&gt;</code>). It&apos;s keyed with the webhook&apos;s signing secret, the <code>whsec_…</code> shown once when you add the webhook or make a new secret.
+            Work it out on the raw body before parsing the JSON, compare in constant time, and reject a <code>t</code> more than 5 minutes old.
+          </p>
+          <div className="flex gap-1 mb-2" role="group" aria-label="Example language">
+            {(["node", "php"] as const).map(l => (
+              <button key={l} type="button" aria-pressed={lang === l} onClick={() => setLang(l)}
+                className={`px-2 py-0.5 rounded text-xs border ${lang === l ? "bg-brand-600 text-white border-brand-600" : "bg-white hover:bg-gray-50"}`}>
+                {l === "node" ? "Node.js" : "PHP"}
+              </button>
+            ))}
+          </div>
+          <Code text={lang === "node" ? VERIFY_NODE : VERIFY_PHP} />
+
+          <H>Good to know</H>
+          <ul className="list-disc pl-5 space-y-1">
+            <li>An event can arrive more than once, for example after a retry or a manual resend, so use <code>id</code> to skip ones you&apos;ve already handled.</li>
+            <li>Events can arrive out of order. Use <code>createdAt</code> and the record&apos;s <code>status</code>, not the order they arrive in.</li>
+            <li>Each payload is built about a second after the event, from the record as it is then, and retries send that same payload. If a registration is paid and then changed back within that second, nothing is sent.</li>
+            <li>Kids check-in and volunteer tickets are never sent. A registration made only of those sends nothing, and those lines are left out of <code>items</code>.</li>
+            <li>Only <code>https</code> addresses on the public internet are allowed. Each webhook&apos;s log keeps what was sent for {keepDays} days.</li>
+            <li>Turning a webhook off stops new deliveries to it. Deleting it removes its log too.</li>
+          </ul>
+
+          <H>Event types and examples</H>
+          <ul className="border rounded-lg divide-y">
+            {eventTypes.map(t => (
+              <li key={t.type}>
+                <button type="button" aria-expanded={openType === t.type} onClick={() => setOpenType(openType === t.type ? null : t.type)}
+                  className="w-full flex items-start gap-2 px-3 py-2 text-left hover:bg-gray-50">
+                  {openType === t.type ? <ChevronDown className="w-4 h-4 mt-0.5 text-gray-500 shrink-0" aria-hidden /> : <ChevronRight className="w-4 h-4 mt-0.5 text-gray-500 shrink-0" aria-hidden />}
+                  <span className="flex-1">
+                    <code className="text-xs font-semibold text-gray-900">{t.type}</code> <span className="text-gray-900">· {t.label}</span>
+                    <span className="block text-xs text-gray-500">{t.description}</span>
+                  </span>
+                </button>
+                {openType === t.type && <div className="px-3 pb-3" data-testid={`webhook-example-${t.type}`}><Code text={envelope(t)} /></div>}
+              </li>
+            ))}
+            <li className="px-3 py-2 text-xs text-gray-600">
+              <code className="font-semibold text-gray-900">webhook.test</code> · Sent by <em>Send test</em>. <code>data</code> is <code>{`{ "message": "…" }`}</code>, so your side can answer 2xx and ignore it.
+            </li>
+          </ul>
+        </div>
+      )}
+    </section>
+  );
+}

frontend/src/components/admin/WebhooksTab.tsx

@@ -5,8 +5,9 @@ import { Webhook, Send, RefreshCw, KeyRound, Trash2, Pencil, Copy, ChevronDown,
 import { useAuth } from "@/hooks/useAuth";
 import { apiFetch } from "@/lib/api";
 import { errorMessage } from "@/lib/utils";
+import { WebhookGuide } from "./WebhookGuide";
 
-type EventType = { type: string; label: string; description: string };
+type EventType = { type: string; label: string; description: string; example?: unknown };
 type Endpoint = {
   id: string; name: string; url: string; events: string[]; isActive: boolean;
   lastSuccessAt: string | null; lastFailureAt: string | null; createdAt: string;
@@ -20,6 +21,9 @@ type ListResponse = { eventTypes: EventType[]; keepDays: number; endpoints: Endp
 type Draft = { id?: string; name: string; url: string; events: string[] };
 
 const when = (d: string | null) => (d ? new Date(d).toLocaleString("en-GB", { day: "numeric", month: "short", hour: "2-digit", minute: "2-digit" }) : "—");
+// Deliveries shown at a time in the log ("Load older" fetches the next lot).
+const PAGE = 50;
+
 const STATUS: Record<string, string> = {
   succeeded: "bg-green-50 text-green-800", failed: "bg-red-50 text-red-700", retrying: "bg-amber-50 text-amber-800",
   pending: "bg-gray-100 text-gray-600", sending: "bg-blue-50 text-blue-700",
@@ -50,21 +54,46 @@ function Deliveries({ endpointId, token }: { endpointId: string; token: string }
   const [rows, setRows] = useState<Delivery[] | null>(null);
   const [open, setOpen] = useState<string | null>(null);
   const [busy, setBusy] = useState<string | null>(null);
+  const [status, setStatus] = useState("");
+  const [more, setMore] = useState(false);
+  const fetchPage = useCallback((before?: string) => {
+    const qs = new URLSearchParams({ limit: String(PAGE) });
+    if (status) qs.set("status", status);
+    if (before) qs.set("before", before);
+    return apiFetch<Delivery[]>(`/api/outbound-webhooks/${endpointId}/deliveries?${qs.toString()}`, { authToken: token }).catch(() => [] as Delivery[]);
+  }, [endpointId, token, status]);
   const load = useCallback(async () => {
-    setRows(await apiFetch<Delivery[]>(`/api/outbound-webhooks/${endpointId}/deliveries`, { authToken: token }).catch(() => []));
-  }, [endpointId, token]);
+    const page = await fetchPage();
+    setRows(page);
+    setMore(page.length === PAGE);
+  }, [fetchPage]);
   useEffect(() => { load(); }, [load]);
+  const loadOlder = async () => {
+    if (!rows?.length) return;
+    const page = await fetchPage(rows[rows.length - 1].createdAt);
+    setRows([...rows, ...page]);
+    setMore(page.length === PAGE);
+  };
   const resend = async (id: string) => {
     setBusy(id);
     await apiFetch(`/api/outbound-webhooks/deliveries/${id}/resend`, { method: "POST", authToken: token }).catch(() => {});
     setBusy(null);
     load();
   };
-  if (!rows) return <p className="text-xs text-gray-400">Loading…</p>;
-  if (!rows.length) return <p className="text-xs text-gray-500">Nothing sent yet.</p>;
+  if (!rows) return <p className="text-xs text-gray-500">Loading…</p>;
+  if (!rows.length && !status) return <p className="text-xs text-gray-500">Nothing sent yet.</p>;
   return (
     <div className="space-y-1" data-testid="webhook-deliveries">
-      <div className="flex justify-end"><button type="button" onClick={load} className="inline-flex items-center gap-1 text-xs text-gray-600 hover:text-gray-900"><RefreshCw className="w-3 h-3" /> Refresh</button></div>
+      <div className="flex items-center justify-between gap-2">
+        <select aria-label="Show deliveries" className="border rounded px-2 py-1 text-xs" value={status} onChange={e => setStatus(e.target.value)}>
+          <option value="">All deliveries</option>
+          <option value="failed">Failed</option>
+          <option value="retrying">Retrying</option>
+          <option value="succeeded">Succeeded</option>
+        </select>
+        <button type="button" onClick={load} className="inline-flex items-center gap-1 text-xs text-gray-600 hover:text-gray-900"><RefreshCw className="w-3 h-3" aria-hidden="true" /> Refresh</button>
+      </div>
+      {!rows.length && <p className="text-xs text-gray-500">None with this status.</p>}
       <ul className="divide-y border rounded-lg bg-white">
         {rows.map(d => (
           <li key={d.id} className="text-xs" data-testid="webhook-delivery">
@@ -89,6 +118,11 @@ function Deliveries({ endpointId, token }: { endpointId: string; token: string }
           </li>
         ))}
       </ul>
+      {more && (
+        <div className="flex justify-center">
+          <button type="button" onClick={loadOlder} className="text-xs px-3 py-1 rounded border bg-white hover:bg-gray-50">Load older</button>
+        </div>
+      )}
     </div>
   );
 }
@@ -155,7 +189,7 @@ export function WebhooksTab({ active }: { active: boolean }) {
 
   const toggleEvent = (type: string) => setDraft(d => d && ({ ...d, events: d.events.includes(type) ? d.events.filter(t => t !== type) : [...d.events, type] }));
 
-  if (!data) return msg ? <p className="text-sm text-red-700">{msg.text}</p> : <p className="text-sm text-gray-400">Loading…</p>;
+  if (!data) return msg ? <p className="text-sm text-red-700">{msg.text}</p> : <p className="text-sm text-gray-500">Loading…</p>;
   const label = (type: string) => data.eventTypes.find(t => t.type === type)?.label || type;
 
   return (
@@ -174,6 +208,8 @@ export function WebhooksTab({ active }: { active: boolean }) {
         Webhooks send personal information (names, email addresses, phone numbers) to the service you choose, so each one is added to your operator register. Make sure you have an agreement with that service. What was sent is kept {data.keepDays} days for the delivery log. Children&apos;s details from kids check-in are never sent.
       </p>
 
+      <WebhookGuide eventTypes={data.eventTypes} keepDays={data.keepDays} defaultOpen={data.endpoints.length === 0} />
+
       {msg && <div className={`p-3 border rounded text-sm ${msg.type === "ok" ? "bg-green-50 text-green-800" : "bg-red-50 text-red-700"}`} role="status">{msg.text}</div>}
       {secret && <SecretBox secret={secret.value} onClose={() => setSecret(null)} />}
 

frontend/src/components/reports/EventsDropdown.tsx

@@ -1,14 +1,18 @@
 "use client";
 
-import React, { useEffect, useRef, useState } from "react";
-import { ChevronDown } from "lucide-react";
+import React, { useEffect, useMemo, useRef, useState } from "react";
+import { ChevronDown, Search } from "lucide-react";
 
+// The reports sidebar's events multi-select. With many events, the search box narrows the list
+// and "Select all" picks only what matches.
 export default function EventsDropdown({ options, value, onChange }: {
-  options: { value: string; label: string }[];
+  // `hint`: shown beside the title (the date) and searched too.
+  options: { value: string; label: string; hint?: string }[];
   value: string[];
   onChange: (v: string[]) => void;
 }) {
   const [open, setOpen] = useState(false);
+  const [query, setQuery] = useState("");
   const ref = useRef<HTMLDivElement>(null);
 
   useEffect(() => {
@@ -19,9 +23,23 @@ export default function EventsDropdown({ options, value, onChange }: {
     return () => document.removeEventListener("mousedown", onClick);
   }, []);
 
+  const shown = useMemo(() => {
+    const words = query.trim().toLowerCase().split(/\s+/).filter(Boolean);
+    if (!words.length) return options;
+    return options.filter(o => {
+      const hay = `${o.label} ${o.hint || ""}`.toLowerCase();
+      return words.every(w => hay.includes(w));
+    });
+  }, [options, query]);
+
   const toggle = (v: string) => {
     onChange(value.includes(v) ? value.filter(x => x !== v) : [...value, v]);
   };
+  const selectShown = () => onChange(Array.from(new Set([...value, ...shown.map(o => o.value)])));
+  const clearShown = () => {
+    const drop = new Set(shown.map(o => o.value));
+    onChange(query.trim() ? value.filter(v => !drop.has(v)) : []);
+  };
 
   const summary = value.length === 0
     ? "No events selected"
@@ -35,25 +53,43 @@ export default function EventsDropdown({ options, value, onChange }: {
     <div className="relative" ref={ref}>
       <button
         type="button"
+        aria-expanded={open}
+        aria-label={`Events: ${summary}`}
         onClick={() => setOpen(o => !o)}
         className="w-full flex items-center justify-between gap-2 border rounded-lg px-3 py-2 text-sm bg-white hover:bg-gray-50"
       >
         <span className="truncate text-left">{summary}</span>
-        <ChevronDown className={"w-4 h-4 text-gray-400 shrink-0 transition-transform " + (open ? "rotate-180" : "")} />
+        <ChevronDown className={"w-4 h-4 text-gray-500 shrink-0 transition-transform " + (open ? "rotate-180" : "")} aria-hidden />
       </button>
       {open && (
-        <div className="absolute z-20 mt-1 left-0 right-0 bg-white border rounded-lg shadow-lg max-h-64 overflow-auto p-1">
-          <div className="flex items-center justify-between px-2 py-1.5 text-xs text-gray-500 border-b mb-1">
-            <button type="button" className="hover:underline" onClick={() => onChange(options.map(o => o.value))}>Select all</button>
-            <button type="button" className="hover:underline" onClick={() => onChange([])}>Clear</button>
+        <div className="absolute z-20 mt-1 left-0 right-0 min-w-[16rem] bg-white border rounded-lg shadow-lg p-1">
+          <div className="flex items-center gap-2 px-2 border-b">
+            <Search className="w-3.5 h-3.5 text-gray-500 shrink-0" aria-hidden />
+            <input
+              autoFocus
+              type="text"
+              aria-label="Search events"
+              placeholder="Search events…"
+              className="flex-1 py-1.5 text-sm outline-none bg-transparent"
+              value={query}
+              onChange={e => setQuery(e.target.value)}
+              onKeyDown={e => { if (e.key === "Escape") setOpen(false); }}
+            />
+          </div>
+          <div className="flex items-center justify-between px-2 py-1.5 text-xs text-gray-600 border-b mb-1">
+            <button type="button" className="hover:underline" onClick={selectShown}>{query.trim() ? `Select these ${shown.length}` : "Select all"}</button>
+            <button type="button" className="hover:underline" onClick={clearShown}>{query.trim() ? "Clear these" : "Clear"}</button>
+          </div>
+          <div className="max-h-64 overflow-auto">
+            {shown.map(opt => (
+              <label key={opt.value} className="flex items-center gap-2 px-2 py-1.5 text-sm rounded hover:bg-gray-50 cursor-pointer">
+                <input type="checkbox" checked={value.includes(opt.value)} onChange={() => toggle(opt.value)} />
+                <span className="truncate flex-1">{opt.label}</span>
+                {opt.hint && <span className="shrink-0 text-xs text-gray-500">{opt.hint}</span>}
+              </label>
+            ))}
+            {shown.length === 0 && <div className="px-2 py-1.5 text-xs text-gray-500">{options.length ? "No events match." : "No events available."}</div>}
           </div>
-          {options.map(opt => (
-            <label key={opt.value} className="flex items-center gap-2 px-2 py-1.5 text-sm rounded hover:bg-gray-50 cursor-pointer">
-              <input type="checkbox" checked={value.includes(opt.value)} onChange={() => toggle(opt.value)} />
-              <span className="truncate">{opt.label}</span>
-            </label>
-          ))}
-          {options.length === 0 && <div className="px-2 py-1.5 text-xs text-gray-400">No events available.</div>}
         </div>
       )}
     </div>

frontend/src/components/reports/ReportsShell.tsx

@@ -6,7 +6,7 @@ import { BackLink } from "@/components/shared/BackLink";
 import { REPORTS, REPORT_CATEGORIES, type ReportKey, type ReportCategory } from "./ReportCatalog";
 import EventsDropdown from "./EventsDropdown";
 
-type EventLite = { id: string; title: string };
+type EventLite = { id: string; title: string; startDate?: string };
 type DatePreset = "all_time" | "this_month" | "last_month" | "this_year" | "custom";
 
 export default function ReportsShell({
@@ -93,7 +93,7 @@ export default function ReportsShell({
 
           <div>
             <div className="text-xs font-medium text-gray-600 mb-1">Events</div>
-            <EventsDropdown options={events.map(ev => ({ value: ev.id, label: ev.title }))} value={selectedEventIds} onChange={setSelectedEventIds} />
+            <EventsDropdown options={events.map(ev => ({ value: ev.id, label: ev.title, hint: ev.startDate ? new Date(ev.startDate).toLocaleDateString("en-GB", { day: "numeric", month: "short", year: "numeric" }) : undefined }))} value={selectedEventIds} onChange={setSelectedEventIds} />
           </div>
 
           <div className="space-y-1.5 text-sm">

frontend/src/components/shared/EventPicker.tsx

@@ -0,0 +1,259 @@
+"use client";
+
+import React, { useEffect, useId, useMemo, useRef, useState } from "react";
+import { ChevronDown, Search, X } from "lucide-react";
+
+export type PickerEvent = {
+  id: string;
+  title: string;
+  startDate: string;
+  endDate?: string | null;
+  campus?: { name: string } | null;
+  isActive?: boolean;
+};
+
+// Search results shown at once; typing more narrows them.
+const MAX_RESULTS = 60;
+
+const shortDate = (d: string) => new Date(d).toLocaleDateString("en-GB", { day: "numeric", month: "short", year: "numeric" });
+const isPast = (ev: PickerEvent, cutoff: number) => new Date(ev.endDate || ev.startDate).getTime() < cutoff;
+
+/**
+ * A searchable event chooser in place of a long <select>. Opens on upcoming events (soonest
+ * first); past events (latest first) are one click away, and typing searches every event it
+ * was given by title, campus or date. `emptyLabel` adds a "no event" choice (e.g. "All events").
+ */
+export function EventPicker<E extends PickerEvent>({ events, value, onChange, emptyLabel, placeholder = "Choose an event", label = "Event", id, className = "", disabled = false, graceHours = 0, describe }: {
+  events: E[];
+  value: string;
+  onChange: (id: string, event: E | null) => void;
+  emptyLabel?: string;
+  placeholder?: string;
+  // Accessible name (visually hidden unless the page gives its own <label htmlFor={id}>).
+  label?: string;
+  id?: string;
+  className?: string;
+  disabled?: boolean;
+  // An event still counts as current this many hours after it ends (e.g. late scanning).
+  graceHours?: number;
+  // Extra detail after the date in the list, e.g. "3 roles".
+  describe?: (ev: E) => string | null | undefined;
+}) {
+  const autoId = useId();
+  const buttonId = id || `event-picker-${autoId}`;
+  const listId = `${buttonId}-list`;
+  const [open, setOpen] = useState(false);
+  const [query, setQuery] = useState("");
+  const [showPast, setShowPast] = useState(false);
+  const [active, setActive] = useState(0);
+  const rootRef = useRef<HTMLDivElement>(null);
+  const buttonRef = useRef<HTMLButtonElement>(null);
+  const inputRef = useRef<HTMLInputElement>(null);
+  const listRef = useRef<HTMLUListElement>(null);
+  const selected = events.find(e => e.id === value) || null;
+
+  const { upcoming, past } = useMemo(() => {
+    const cutoff = Date.now() - graceHours * 3600e3;
+    const up: E[] = [];
+    const old: E[] = [];
+    for (const ev of events) (isPast(ev, cutoff) ? old : up).push(ev);
+    up.sort((a, b) => +new Date(a.startDate) - +new Date(b.startDate));
+    old.sort((a, b) => +new Date(b.startDate) - +new Date(a.startDate));
+    return { upcoming: up, past: old };
+  }, [events, graceHours]);
+
+  // What the list shows: [heading | event | "none"] rows. Only events and "none" are choosable.
+  const { rows, hidden } = useMemo(() => {
+    type Row = { kind: "head"; text: string } | { kind: "none" } | { kind: "event"; ev: E; past: boolean };
+    const out: Row[] = [];
+    const q = query.trim().toLowerCase();
+    if (q) {
+      const words = q.split(/\s+/);
+      const hit = (ev: E) => {
+        const hay = `${ev.title} ${ev.campus?.name || ""} ${shortDate(ev.startDate)}`.toLowerCase();
+        return words.every(w => hay.includes(w));
+      };
+      const up = upcoming.filter(hit);
+      const old = past.filter(hit);
+      const all = [...up.map(ev => ({ ev, past: false })), ...old.map(ev => ({ ev, past: true }))];
+      all.slice(0, MAX_RESULTS).forEach(r => out.push({ kind: "event", ...r }));
+      return { rows: out, hidden: Math.max(0, all.length - MAX_RESULTS) };
+    }
+    if (emptyLabel) out.push({ kind: "none" });
+    if (upcoming.length) {
+      if (past.length) out.push({ kind: "head", text: "Upcoming" });
+      upcoming.forEach(ev => out.push({ kind: "event", ev, past: false }));
+    }
+    if (showPast && past.length) {
+      out.push({ kind: "head", text: "Past" });
+      past.forEach(ev => out.push({ kind: "event", ev, past: true }));
+    }
+    return { rows: out, hidden: 0 };
+  }, [query, upcoming, past, showPast, emptyLabel]);
+
+  const choosable = rows.map((r, i) => (r.kind === "head" ? -1 : i)).filter(i => i >= 0);
+
+  // Open on the chosen event; a past one shows the past list too.
+  const openList = () => {
+    if (disabled) return;
+    setQuery("");
+    const pastPick = !!selected && past.some(e => e.id === selected.id);
+    setShowPast(pastPick);
+    setOpen(true);
+  };
+  useEffect(() => {
+    if (!open) return;
+    inputRef.current?.focus();
+    const at = rows.findIndex(r => (r.kind === "event" ? r.ev.id === value : r.kind === "none" && !value));
+    setActive(at >= 0 ? at : (choosable[0] ?? 0));
+    // Only when it opens.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [open]);
+  useEffect(() => {
+    listRef.current?.querySelector(`[data-row="${active}"]`)?.scrollIntoView({ block: "nearest" });
+  }, [active, open]);
+  useEffect(() => {
+    if (!open) return;
+    const onDown = (e: MouseEvent) => { if (!rootRef.current?.contains(e.target as Node)) setOpen(false); };
+    document.addEventListener("mousedown", onDown);
+    return () => document.removeEventListener("mousedown", onDown);
+  }, [open]);
+
+  const close = () => { setOpen(false); buttonRef.current?.focus(); };
+  const choose = (i: number) => {
+    const r = rows[i];
+    if (!r || r.kind === "head") return;
+    if (r.kind === "none") onChange("", null);
+    else onChange(r.ev.id, r.ev);
+    close();
+  };
+  const move = (step: number) => {
+    if (!choosable.length) return;
+    const at = choosable.indexOf(active);
+    const next = at < 0 ? 0 : Math.min(choosable.length - 1, Math.max(0, at + step));
+    setActive(choosable[next]);
+  };
+  const onKey = (e: React.KeyboardEvent) => {
+    if (e.key === "ArrowDown") { e.preventDefault(); move(1); }
+    else if (e.key === "ArrowUp") { e.preventDefault(); move(-1); }
+    else if (e.key === "PageDown") { e.preventDefault(); move(10); }
+    else if (e.key === "PageUp") { e.preventDefault(); move(-10); }
+    else if (e.key === "Enter") { e.preventDefault(); choose(active); }
+    else if (e.key === "Escape") { e.preventDefault(); e.stopPropagation(); close(); }
+    else if (e.key === "Tab") setOpen(false);
+  };
+
+  const buttonText = selected ? selected.title : (emptyLabel || placeholder);
+
+  return (
+    <div ref={rootRef} className={`relative inline-block min-w-[16rem] max-w-full ${className}`} data-testid="event-picker">
+      <button
+        ref={buttonRef}
+        id={buttonId}
+        type="button"
+        disabled={disabled}
+        aria-haspopup="listbox"
+        aria-expanded={open}
+        aria-label={`${label}: ${buttonText}`}
+        onClick={() => (open ? setOpen(false) : openList())}
+        onKeyDown={e => { if (e.key === "ArrowDown" && !open) { e.preventDefault(); openList(); } }}
+        className="w-full flex items-center gap-2 border rounded-lg px-3 py-2 text-sm bg-white text-left hover:bg-gray-50 disabled:opacity-50 disabled:cursor-not-allowed"
+      >
+        <span className={`flex-1 truncate ${selected ? "text-gray-900" : "text-gray-600"}`}>
+          {buttonText}
+          {selected && <span className="text-gray-500"> · {shortDate(selected.startDate)}</span>}
+        </span>
+        <ChevronDown className="w-4 h-4 text-gray-500 shrink-0" aria-hidden />
+      </button>
+
+      {open && (
+        <div className="absolute z-40 mt-1 w-full min-w-[18rem] sm:min-w-[24rem] rounded-lg border bg-white shadow-lg">
+          <div className="flex items-center gap-2 border-b px-3">
+            <Search className="w-4 h-4 text-gray-500 shrink-0" aria-hidden />
+            <input
+              ref={inputRef}
+              type="text"
+              role="combobox"
+              aria-expanded="true"
+              aria-controls={listId}
+              aria-autocomplete="list"
+              aria-activedescendant={rows[active] && rows[active].kind !== "head" ? `${listId}-${active}` : undefined}
+              aria-label={`Search ${label.toLowerCase()}s`}
+              placeholder="Search by name, campus or date…"
+              className="flex-1 py-2 text-sm outline-none bg-transparent"
+              value={query}
+              onChange={e => { setQuery(e.target.value); setActive(0); }}
+              onKeyDown={onKey}
+            />
+            {query && (
+              <button type="button" aria-label="Clear search" className="text-gray-500 hover:text-gray-800" onClick={() => { setQuery(""); inputRef.current?.focus(); }}>
+                <X className="w-4 h-4" aria-hidden />
+              </button>
+            )}
+          </div>
+          <ul ref={listRef} id={listId} role="listbox" aria-label={`${label}s`} className="max-h-72 overflow-y-auto py-1">
+            {rows.map((r, i) => {
+              if (r.kind === "head") {
+                return <li key={`h-${r.text}`} role="presentation" className="px-3 pt-2 pb-1 text-[11px] font-semibold uppercase tracking-wide text-gray-500">{r.text}</li>;
+              }
+              const isSel = r.kind === "none" ? !value : r.ev.id === value;
+              return (
+                <li
+                  key={r.kind === "none" ? "none" : r.ev.id}
+                  id={`${listId}-${i}`}
+                  data-row={i}
+                  role="option"
+                  aria-selected={isSel}
+                  onMouseDown={e => e.preventDefault()}
+                  onClick={() => choose(i)}
+                  onMouseMove={() => active !== i && setActive(i)}
+                  className={`px-3 py-1.5 text-sm cursor-pointer ${i === active ? "bg-brand-50" : ""} ${isSel ? "font-medium" : ""}`}
+                >
+                  {r.kind === "none" ? (
+                    <span className="text-gray-700">{emptyLabel}</span>
+                  ) : (
+                    <span className="flex items-baseline gap-2">
+                      <span className="flex-1 min-w-0 truncate text-gray-900">{r.ev.title}</span>
+                      <span className="shrink-0 text-xs text-gray-600">
+                        {r.ev.campus?.name ? `${r.ev.campus.name} · ` : ""}{shortDate(r.ev.startDate)}{r.past && query ? " · past" : ""}{r.ev.isActive === false ? " · inactive" : ""}{describe?.(r.ev) ? ` · ${describe(r.ev)}` : ""}
+                      </span>
+                    </span>
+                  )}
+                </li>
+              );
+            })}
+            {!rows.some(r => r.kind === "event") && (
+              <li role="presentation" className="px-3 py-2 text-sm text-gray-500">
+                {query ? "No events match." : past.length ? "No upcoming events." : "No events."}
+              </li>
+            )}
+          </ul>
+          <div className="flex items-center justify-between gap-2 border-t px-3 py-1.5 text-xs text-gray-600" aria-live="polite">
+            <span>
+              {query
+                ? `${rows.filter(r => r.kind === "event").length + hidden} match${rows.filter(r => r.kind === "event").length + hidden === 1 ? "" : "es"}${hidden ? ` · showing the first ${MAX_RESULTS}, keep typing` : ""}`
+                : `${upcoming.length} upcoming${showPast ? ` · ${past.length} past` : ""}`}
+            </span>
+            {!query && past.length > 0 && (
+              <button type="button" className="text-brand-700 hover:underline" onClick={() => { setShowPast(s => !s); inputRef.current?.focus(); }}>
+                {showPast ? "Hide past events" : `Show past events (${past.length})`}
+              </button>
+            )}
+          </div>
+        </div>
+      )}
+    </div>
+  );
+}
+
+/** The event a page opens on: the next one coming up, or else the most recent. */
+export function defaultEventId(events: PickerEvent[], now = Date.now()): string {
+  let next: PickerEvent | null = null;
+  let last: PickerEvent | null = null;
+  for (const ev of events) {
+    const start = new Date(ev.startDate).getTime();
+    if (!isPast(ev, now)) { if (!next || start < new Date(next.startDate).getTime()) next = ev; }
+    else if (!last || start > new Date(last.startDate).getTime()) last = ev;
+  }
+  return (next || last)?.id || "";
+}

frontend/src/components/shared/Pager.tsx

@@ -0,0 +1,28 @@
+"use client";
+
+/**
+ * "21–40 of 312 · ← Prev · Next →" under a server-paged list. Hidden when everything fits on
+ * one page.
+ */
+export function Pager({ page, pageSize, total, onPage, busy }: {
+  page: number;
+  pageSize: number;
+  total: number;
+  onPage: (page: number) => void;
+  busy?: boolean;
+}) {
+  const pages = Math.max(1, Math.ceil(total / pageSize));
+  if (pages <= 1) return null;
+  const btn = "px-2 py-1 rounded bg-gray-100 hover:bg-gray-200 disabled:opacity-40";
+  return (
+    <nav aria-label="Pages" className="flex items-center justify-between mt-4 text-sm">
+      <span className="text-gray-500">
+        {(page - 1) * pageSize + 1}–{Math.min(page * pageSize, total)} of {total} · page {page} of {pages}
+      </span>
+      <div className="flex gap-1">
+        <button className={btn} disabled={page <= 1 || busy} onClick={() => onPage(page - 1)}>← Prev</button>
+        <button className={btn} disabled={page >= pages || busy} onClick={() => onPage(page + 1)}>Next →</button>
+      </div>
+    </nav>
+  );
+}

frontend/src/content/help/site-settings.tsx

@@ -1,5 +1,5 @@
 import React from "react";
-import { Building2, Palette, Bell, Mail, Scale, MessageCircle, LayoutDashboard, Timer, Play, CreditCard, ArrowUpDown, KeyRound, ArrowUpCircle, MapPinned, Archive, Users, BellOff, Megaphone, Webhook, Send } from "lucide-react";
+import { Building2, Palette, Bell, Mail, Scale, MessageCircle, LayoutDashboard, Timer, Play, CreditCard, ArrowUpDown, KeyRound, ArrowUpCircle, MapPinned, Archive, Users, BellOff, Megaphone, Webhook, Send, BookOpen } from "lucide-react";
 import { GuideItem } from "@/components/shared/GuideItem";
 import type { HelpContent } from "./types";
 
@@ -164,6 +164,9 @@ export const siteSettingsHelpContent: HelpContent = {
             <GuideItem icon={Send} title="Test and delivery log" tone="green">
               &quot;Send test&quot; sends a test message straight away. The delivery log shows everything sent in the last 30 days, what came back, and the full message. Anything that fails is tried again after 1 minute, 5 minutes, 30 minutes, 2 hours and 12 hours; &quot;Resend&quot; tries again now.
             </GuideItem>
+            <GuideItem icon={BookOpen} title="How webhooks work" tone="gray">
+              Open &quot;How webhooks work&quot; on the Webhooks tab for whoever sets up the receiving side: what is sent and when, the headers, how to check the signature (with Node.js and PHP examples), and an example message for every event type that you can copy. It opens by itself until you&apos;ve added a webhook.
+            </GuideItem>
             <GuideItem icon={Scale} title="Privacy" tone="amber">
               Webhooks send names, email addresses and phone numbers, so each webhook is added to your operator register (Admin → Privacy) — have an agreement with the service. Children&apos;s details from kids check-in are never sent. Switch a webhook off or delete it at any time.
             </GuideItem>

frontend/src/lib/api-v2/schema.d.ts

@@ -0,0 +1,838 @@
+/**
+ * This file was auto-generated by openapi-typescript.
+ * Do not make direct changes to the file.
+ */
+
+export interface paths {
+    "/events": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Upcoming public events
+         * @description Events anyone can see (active, not hidden, live) that have not ended, soonest first.
+         *
+         *     **Who:** Anyone.
+         */
+        get: operations["getEvents"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/events/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * One public event
+         * @description With its ticket options (internal kids check-in and volunteer tickets left out) and sessions. Hidden events can be fetched by id (they are unlisted, not private).
+         *
+         *     **Who:** Anyone.
+         */
+        get: operations["getEventsId"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/registrations": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Register for an event
+         * @description Signed in, or as a guest for a free event that allows it (`guest` then required), or with a waitlist link (`waitlistToken`).
+         *
+         *     Registering again for the same event adds to the existing registration. When nothing is owed it is marked paid and tickets are issued; otherwise pay with `POST /registrations/{id}/checkout`.
+         *
+         *     A coupon that was valid when checked but used up a moment later is reported in `couponError`; the registration is still made.
+         *
+         *     **Who:** Anyone; signed-in staff may see more.
+         */
+        post: operations["postRegistrations"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/registrations/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * One of my registrations
+         * @description **Who:** Any signed-in person.
+         */
+        get: operations["getRegistrationsId"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/registrations/{id}/cancel": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Cancel my registration
+         * @description Not after the event has ended, and not once anything has been paid (the church can do that). Its places go to the waitlist.
+         *
+         *     **Who:** Any signed-in person.
+         */
+        post: operations["postRegistrationsIdCancel"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/registrations/{id}/checkout": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Pay what I owe online
+         * @description Starts a payment with the church's provider (Yoco or PayFast) and returns where to send the person (`redirectUrl`).
+         *
+         *     If an early-bird price ran out since the registration was made, nothing is started: `priceUpdated` is true with the new amount owing — show it, then call again.
+         *
+         *     **Who:** Any signed-in person.
+         */
+        post: operations["postRegistrationsIdCheckout"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/me": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * The signed-in person
+         * @description **Who:** Any signed-in person.
+         */
+        get: operations["getMe"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/me/registrations": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * My registrations
+         * @description Newest first. By default only ones for events that have not ended, and not cancelled; `past=true` lists everything.
+         *
+         *     **Who:** Any signed-in person.
+         */
+        get: operations["getMeRegistrations"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+}
+export type webhooks = Record<string, never>;
+export interface components {
+    schemas: {
+        Error: {
+            error: {
+                /** @enum {string} */
+                code: "VALIDATION_FAILED" | "UNAUTHENTICATED" | "FORBIDDEN" | "NOT_FOUND" | "CONFLICT" | "RATE_LIMITED" | "READ_ONLY" | "INTERNAL";
+                message: string;
+                /** @description Per-field problems (VALIDATION_FAILED only) */
+                fields?: {
+                    [key: string]: string;
+                };
+            };
+        };
+    };
+    responses: never;
+    parameters: never;
+    requestBodies: never;
+    headers: never;
+    pathItems: never;
+}
+export type $defs = Record<string, never>;
+export interface operations {
+    getEvents: {
+        parameters: {
+            query?: {
+                /** @description Page number, from 1 */
+                page?: number;
+                /** @description Items per page (at most 100) */
+                limit?: number;
+                /** @description Search the title */
+                q?: string;
+                /** @description A campus id or slug (its events plus church-wide ones), or 'all' for church-wide events only */
+                campus?: string;
+                /** @description A series slug */
+                series?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: {
+                            id: string;
+                            title: string;
+                            /** Format: date-time */
+                            startDate: string;
+                            /** Format: date-time */
+                            endDate: string;
+                            location: string | null;
+                            /** @description The headline price in rand (0 = free) */
+                            price: number;
+                            pictureUrl: string | null;
+                            requiresRegistration: boolean;
+                            /** @enum {string} */
+                            scheduleType: "single" | "sessions";
+                            /** @description null = for all campuses (or campuses are off) */
+                            campus: {
+                                id: string;
+                                name: string;
+                                slug: string;
+                            } | null;
+                            series: {
+                                id: string;
+                                name: string;
+                                slug: string;
+                            } | null;
+                        }[];
+                        meta: {
+                            page: number;
+                            limit: number;
+                            /** @description Items across all pages */
+                            total: number;
+                            /** @description Number of pages (at least 1) */
+                            pages: number;
+                        };
+                    };
+                };
+            };
+            /** @description Validation failed (VALIDATION_FAILED) */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    getEventsId: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The id */
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: {
+                            id: string;
+                            title: string;
+                            /** Format: date-time */
+                            startDate: string;
+                            /** Format: date-time */
+                            endDate: string;
+                            location: string | null;
+                            /** @description The headline price in rand (0 = free) */
+                            price: number;
+                            pictureUrl: string | null;
+                            requiresRegistration: boolean;
+                            /** @enum {string} */
+                            scheduleType: "single" | "sessions";
+                            /** @description null = for all campuses (or campuses are off) */
+                            campus: {
+                                id: string;
+                                name: string;
+                                slug: string;
+                            } | null;
+                            series: {
+                                id: string;
+                                name: string;
+                                slug: string;
+                            } | null;
+                            description: string | null;
+                            registrationDeadline: string | null;
+                            ticketOptions: {
+                                id: string;
+                                name: string;
+                                /** @description The normal price in rand */
+                                price: number;
+                                /** @description What it costs now (an early-bird price while one runs) */
+                                currentPrice: number;
+                                isMainTicket: boolean;
+                                /**
+                                 * @description "pick" = the buyer chooses sessions
+                                 * @enum {string}
+                                 */
+                                sessionMode: "all" | "pick";
+                            }[];
+                            /** @description Multi-day events only; empty otherwise */
+                            sessions: {
+                                id: string;
+                                label: string | null;
+                                /** Format: date-time */
+                                startsAt: string;
+                                /** Format: date-time */
+                                endsAt: string;
+                                location: string | null;
+                                cancelled: boolean;
+                            }[];
+                        };
+                    };
+                };
+            };
+            /** @description Validation failed (VALIDATION_FAILED) */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description Not found (NOT_FOUND) */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    postRegistrations: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    eventId: string;
+                    options: {
+                        eventOptionId: string;
+                        quantity: number;
+                        variantId?: string | null;
+                        /** @description "Pick sessions" tickets: the sessions chosen */
+                        sessionIds?: string[];
+                    }[];
+                    guest?: {
+                        name: string;
+                        /** Format: email */
+                        email: string;
+                        phone?: string;
+                    };
+                    couponCode?: string;
+                    /** @description Names for the places (events that collect them) */
+                    attendees?: {
+                        eventOptionId: string;
+                        variantId?: string | null;
+                        name: string;
+                        email?: string | null;
+                        phone?: string | null;
+                        /** @description YYYY-MM-DD (youth events) */
+                        dateOfBirth?: string | null;
+                        gender?: string | null;
+                        parentName?: string | null;
+                        parentEmail?: string | null;
+                        parentPhone?: string | null;
+                    }[];
+                    /**
+                     * @description With attendees: tickets to the payer, or to each attendee
+                     * @enum {string}
+                     */
+                    ticketDelivery?: "payer" | "each";
+                    waitlistToken?: string;
+                    analyticsSessionId?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description OK */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: {
+                            id: string;
+                            /** @enum {string} */
+                            status: "pending" | "confirmed" | "partial_paid" | "paid" | "cancelled";
+                            /** Format: date-time */
+                            createdAt: string;
+                            event: {
+                                id: string;
+                                title: string;
+                                /** Format: date-time */
+                                startDate: string;
+                                /** Format: date-time */
+                                endDate: string;
+                            };
+                            items: {
+                                ticket: string;
+                                variant: string | null;
+                                quantity: number;
+                                unitPrice: number;
+                            }[];
+                            /** @description In rand, after discounts */
+                            totalDue: number;
+                            /** @description In rand (refunds subtracted) */
+                            amountPaid: number;
+                            /** @description totalDue − amountPaid; 0 or less = nothing owing */
+                            balance: number;
+                            /** @description false = added to an existing registration */
+                            isNew: boolean;
+                            couponError: string | null;
+                        };
+                    };
+                };
+            };
+            /** @description Validation failed (VALIDATION_FAILED) */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    getRegistrationsId: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The id */
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: {
+                            id: string;
+                            /** @enum {string} */
+                            status: "pending" | "confirmed" | "partial_paid" | "paid" | "cancelled";
+                            /** Format: date-time */
+                            createdAt: string;
+                            event: {
+                                id: string;
+                                title: string;
+                                /** Format: date-time */
+                                startDate: string;
+                                /** Format: date-time */
+                                endDate: string;
+                            };
+                            items: {
+                                ticket: string;
+                                variant: string | null;
+                                quantity: number;
+                                unitPrice: number;
+                            }[];
+                            /** @description In rand, after discounts */
+                            totalDue: number;
+                            /** @description In rand (refunds subtracted) */
+                            amountPaid: number;
+                            /** @description totalDue − amountPaid; 0 or less = nothing owing */
+                            balance: number;
+                        };
+                    };
+                };
+            };
+            /** @description Validation failed (VALIDATION_FAILED) */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description Not signed in (UNAUTHENTICATED) */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description Not found (NOT_FOUND) */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    postRegistrationsIdCancel: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The id */
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: {
+                            id: string;
+                            /** @enum {string} */
+                            status: "pending" | "confirmed" | "partial_paid" | "paid" | "cancelled";
+                            /** Format: date-time */
+                            createdAt: string;
+                            event: {
+                                id: string;
+                                title: string;
+                                /** Format: date-time */
+                                startDate: string;
+                                /** Format: date-time */
+                                endDate: string;
+                            };
+                            items: {
+                                ticket: string;
+                                variant: string | null;
+                                quantity: number;
+                                unitPrice: number;
+                            }[];
+                            /** @description In rand, after discounts */
+                            totalDue: number;
+                            /** @description In rand (refunds subtracted) */
+                            amountPaid: number;
+                            /** @description totalDue − amountPaid; 0 or less = nothing owing */
+                            balance: number;
+                        };
+                    };
+                };
+            };
+            /** @description Validation failed (VALIDATION_FAILED) */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description Not signed in (UNAUTHENTICATED) */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description Not found (NOT_FOUND) */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    postRegistrationsIdCheckout: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The id */
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description An optional donation added on top, in rand */
+                    donationAmount?: number;
+                    /** @description yoco or payfast (default: the first one switched on) */
+                    provider?: string;
+                    /** Format: uri */
+                    successUrl?: string;
+                    /** Format: uri */
+                    cancelUrl?: string;
+                    /** Format: uri */
+                    failureUrl?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: {
+                            /** @constant */
+                            priceUpdated: true;
+                            newBalance: number;
+                            message: string;
+                        } | {
+                            /** @constant */
+                            priceUpdated: false;
+                            checkoutId: string;
+                            redirectUrl: string;
+                            provider: string;
+                            /** @description Charged now, in rand (with any donation) */
+                            amount: number;
+                        };
+                    };
+                };
+            };
+            /** @description Validation failed (VALIDATION_FAILED) */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description Not signed in (UNAUTHENTICATED) */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description Not found (NOT_FOUND) */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    getMe: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: {
+                            id: string;
+                            name: string;
+                            email: string;
+                            phone: string | null;
+                            /** @enum {string} */
+                            role: "admin" | "supervisor" | "staff" | "user";
+                            twoFactorEnabled: boolean;
+                            /** Format: date-time */
+                            createdAt: string;
+                        };
+                    };
+                };
+            };
+            /** @description Not signed in (UNAUTHENTICATED) */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+    getMeRegistrations: {
+        parameters: {
+            query?: {
+                /** @description Page number, from 1 */
+                page?: number;
+                /** @description Items per page (at most 100) */
+                limit?: number;
+                /** @description Include past and cancelled registrations */
+                past?: "true" | "false";
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: {
+                            id: string;
+                            /** @enum {string} */
+                            status: "pending" | "confirmed" | "partial_paid" | "paid" | "cancelled";
+                            /** Format: date-time */
+                            createdAt: string;
+                            event: {
+                                id: string;
+                                title: string;
+                                /** Format: date-time */
+                                startDate: string;
+                                /** Format: date-time */
+                                endDate: string;
+                            };
+                            items: {
+                                ticket: string;
+                                variant: string | null;
+                                quantity: number;
+                                unitPrice: number;
+                            }[];
+                            /** @description In rand, after discounts */
+                            totalDue: number;
+                            /** @description In rand (refunds subtracted) */
+                            amountPaid: number;
+                            /** @description totalDue − amountPaid; 0 or less = nothing owing */
+                            balance: number;
+                        }[];
+                        meta: {
+                            page: number;
+                            limit: number;
+                            /** @description Items across all pages */
+                            total: number;
+                            /** @description Number of pages (at least 1) */
+                            pages: number;
+                        };
+                    };
+                };
+            };
+            /** @description Validation failed (VALIDATION_FAILED) */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description Not signed in (UNAUTHENTICATED) */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
+}

frontend/src/lib/api.ts

@@ -74,8 +74,9 @@ export function resolveToApiOrigin(urlOrPath: string | null | undefined): string
   return API_BASE ? `${API_BASE}${raw}` : raw;
 }
 
-// The parsed JSON body of a failed request — the backend always sends `message`, and
-// some routes add a machine-readable `code` or extra detail fields.
+// The parsed JSON body of a failed request — v1 sends `message` (some routes add a
+// machine-readable `code` or extra detail fields); for v2 it is the `error` object
+// (`code`, `message`, and `fields` on validation errors).
 export type ApiErrorData = { message?: string; code?: string; [key: string]: unknown };
 
 export class ApiError extends Error {
@@ -122,6 +123,11 @@ export async function apiFetch<T = unknown>(path: string, options: ApiOptions =
       const json = JSON.parse(text);
       if (json?.message && typeof json.message === "string") message = json.message;
       data = json;
+      // /api/v2 errors: { error: { code, message, fields? } }
+      if (json?.error && typeof json.error === "object" && typeof json.error.message === "string") {
+        message = json.error.message;
+        data = { ...json.error };
+      }
     } catch { /* not JSON — use raw text */ }
     // An admin/supervisor session from before 2FA was required for their role:
     // end it and send them to log in, where they enrol.
@@ -198,21 +204,23 @@ export function fetchAllPayments(token: string, params: Record<string, string> =
   return fetchAllPages<Payment>("/api/payments", token, params);
 }
 
-// Creates an online checkout (default payment provider) for a registration's full remaining balance.
-// Omitting `amount` makes the backend charge the full remainder rather than a partial amount —
-// partial-amount checkouts are only ever created from the supervisor payments dashboard.
+// Starts an online payment for everything still owed on one of my registrations (API v2), with
+// an optional donation on top. Partial amounts are only taken from the supervisor payments page.
 export type CheckoutResponse = { redirectUrl?: string; priceUpdated?: boolean; newTotal?: number; message?: string };
 
-export function createFullPaymentCheckout(token: string, registrationId: string, donationAmount?: number): Promise<CheckoutResponse> {
-  return apiFetch<CheckoutResponse>("/api/payments/checkout", {
-    method: "POST",
+export async function createFullPaymentCheckout(token: string, registrationId: string, donationAmount?: number): Promise<CheckoutResponse> {
+  const { apiV2 } = await import("@/lib/apiV2");
+  const { data } = await apiV2("post", "/registrations/{id}/checkout", {
+    params: { id: registrationId },
     authToken: token,
     body: {
-      registrationId,
       ...(donationAmount && donationAmount > 0 ? { donationAmount } : {}),
       successUrl: window.location.origin + "/payment/success",
       cancelUrl: window.location.origin + "/payment/cancel",
       failureUrl: window.location.origin + "/payment/failure",
     },
   });
+  // The price changed since registering: nothing was started — show the new amount owing.
+  if (data.priceUpdated) return { priceUpdated: true, newTotal: data.newBalance, message: data.message };
+  return { redirectUrl: data.redirectUrl };
 }

frontend/src/lib/apiV2.ts

@@ -0,0 +1,44 @@
+import { apiFetch } from "@/lib/api";
+import type { paths } from "@/lib/api-v2/schema";
+
+/**
+ * Typed calls to /api/v2. The types come from the backend's OpenAPI document
+ * (`npm run api:types` in the repo root regenerates src/lib/api-v2/), so a path, its parameters,
+ * its body and its answer are all checked by TypeScript:
+ *
+ *   const { data, meta } = await apiV2("get", "/events", { query: { q: "camp", limit: 10 } });
+ *   const { data } = await apiV2("post", "/registrations/{id}/cancel", { params: { id }, authToken });
+ *
+ * Errors throw ApiError (from apiFetch) with the v2 `code` and `fields` in `.data`.
+ */
+
+type Method = "get" | "post" | "put" | "patch" | "delete";
+type PathsWith<M extends Method> = { [P in keyof paths]: paths[P][M] extends { responses: unknown } ? P : never }[keyof paths];
+type Op<P extends keyof paths, M extends Method> = NonNullable<paths[P][M]>;
+
+type Json<T> = T extends { content: { "application/json": infer J } } ? J : never;
+type Responses<O> = O extends { responses: infer R } ? R : never;
+/** The 2xx answer's JSON. */
+export type V2Result<P extends keyof paths, M extends Method> = Json<Responses<Op<P, M>>[Extract<keyof Responses<Op<P, M>>, 200 | 201>]>;
+
+type PathParams<O> = O extends { parameters: { path: infer X } } ? (X extends Record<string, unknown> ? X : never) : never;
+type QueryParams<O> = O extends { parameters: { query?: infer X } } ? X : never;
+type Body<O> = O extends { requestBody: { content: { "application/json": infer B } } } ? B : never;
+
+type IfAny<T, Then> = [T] extends [never] ? object : Then;
+export type V2Options<P extends keyof paths, M extends Method> =
+  { authToken?: string | null }
+  & IfAny<PathParams<Op<P, M>>, { params: PathParams<Op<P, M>> }>
+  & IfAny<QueryParams<Op<P, M>>, { query?: QueryParams<Op<P, M>> }>
+  & IfAny<Body<Op<P, M>>, { body: Body<Op<P, M>> }>;
+
+export function apiV2<M extends Method, P extends PathsWith<M>>(method: M, path: P, ...[options]: object extends V2Options<P, M> ? [V2Options<P, M>?] : [V2Options<P, M>]): Promise<V2Result<P, M>> {
+  const opts = (options || {}) as { authToken?: string | null; params?: Record<string, string>; query?: Record<string, unknown>; body?: unknown };
+  let url = String(path).replace(/\{(\w+)\}/g, (_, name: string) => encodeURIComponent(String(opts.params?.[name] ?? "")));
+  const qs = new URLSearchParams();
+  for (const [k, v] of Object.entries(opts.query || {})) {
+    if (v !== undefined && v !== null && v !== "") qs.set(k, String(v));
+  }
+  if (qs.toString()) url += `?${qs.toString()}`;
+  return apiFetch<V2Result<P, M>>(`/api/v2${url}`, { method: method.toUpperCase(), authToken: opts.authToken, body: opts.body });
+}

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "hope-events",
-  "version": "1.50.0",
+  "version": "1.51.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "hope-events",
-      "version": "1.50.0",
+      "version": "1.51.1",
       "license": "ISC",
       "devDependencies": {
         "@axe-core/playwright": "^4.14.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "hope-events",
-  "version": "1.50.0",
+  "version": "1.51.1",
   "main": "index.js",
   "scripts": {
     "dev:backend": "cd backend && npm run dev",
@@ -16,7 +16,8 @@
     "demo:small": "npm --prefix backend run set-demo -- --profile=small",
     "demo:events": "npm --prefix backend run set-demo -- --profile=events",
     "demo:ministry": "npm --prefix backend run set-demo -- --profile=ministry",
-    "demo:multicampus": "npm --prefix backend run set-demo -- --profile=multicampus"
+    "demo:multicampus": "npm --prefix backend run set-demo -- --profile=multicampus",
+    "api:types": "npm --prefix backend run openapi && npm --prefix frontend run api:types"
   },
   "keywords": [],
   "author": "",

playwright.config.ts

@@ -32,7 +32,8 @@ export default defineConfig({
   projects: [{ name: "chromium", use: { ...devices["Desktop Chrome"] } }],
   webServer: [
     {
-      command: "node ../e2e/support/prepare-db.js && node src/index.js",
+      // tsx runs the TypeScript straight from src/ (never a stale dist/ build).
+      command: "node ../e2e/support/prepare-db.js && npx tsx src/index.js",
       cwd: "backend",
       url: `http://localhost:${API_PORT}/api/settings/needs-setup`,
       timeout: 180_000,

scripts/deploy.sh

@@ -63,7 +63,8 @@ rollback() {
   clear_pm2_config
   git checkout -q "$PREVIOUS"
   restore_pm2_config
-  (cd backend && npm ci --silent) || true
+  # Releases from 1.51.0 on have a TypeScript build; older ones run src/ as it is.
+  (cd backend && npm ci --include=dev --silent && { ! grep -q '"build":' package.json || npm run build --silent; }) || true
   (cd frontend && npm ci --silent && npm run build --silent) || true
 }
 trap rollback ERR
@@ -76,8 +77,9 @@ if [ ! -f "$PM2_CONFIG" ]; then
   echo "    Created $PM2_CONFIG from the example — check its app names and port."
 fi
 
-echo "==> Backend: install and migrate"
-(cd backend && npm ci && npm run prisma:deploy)
+echo "==> Backend: install, migrate and build"
+# --include=dev: the TypeScript build needs the type packages even where NODE_ENV=production.
+(cd backend && npm ci --include=dev && npm run prisma:deploy && npm run build)
 
 echo "==> Frontend: install and build"
 (cd frontend && npm ci && npm run build)

scripts/install.sh

@@ -125,7 +125,7 @@ chown "$APP_USER:$APP_USER" "$DIR/backend/.env" "$DIR/frontend/.env.production"
 chmod 600 "$DIR/backend/.env"
 
 step "Install, migrate, build"
-as_app "cd '$DIR/backend' && npm ci --no-audit --no-fund && npx prisma migrate deploy && npx prisma generate"
+as_app "cd '$DIR/backend' && npm ci --include=dev --no-audit --no-fund && npx prisma migrate deploy && npx prisma generate && npm run build"
 as_app "cd '$DIR/frontend' && npm ci --no-audit --no-fund && npm run build"
 
 step "Start with PM2"