Saved filters on list pages (1.49.2)

Manage registrations, Users, Events and Reports: save the current filters under a name, apply one with a click, star one as the default for the page (not applied over a deep link). Per person, stored on the server, removed when an account is anonymised. /api/saved-filters. Migration 20261028180000_saved_filters. Completes roadmap section 9. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merge branch 'feat/bulk-actions'
2026-10-28 14:57:34 +02:00 · 2026-10-28 14:43:01 +02:00 · 2026-10-28 14:43:00 +02:00 · 2026-10-28 14:17:23 +02:00 · 2026-10-28 14:17:22 +02:00 · 2026-10-28 14:02:56 +02:00
117 changed files with 7426 additions and 169 deletions
@@ -7,6 +7,208 @@ and this project follows [Semantic Versioning](https://semver.org/).

 ## [Unreleased]

+## [1.49.2] - 2026-10-28
+
+### Added
+
+- **Saved filters** on Manage registrations, Users, Events and Reports: set the filters, then
+  **Saved filters → Save** under a name; click one to apply it; **★** makes it the default, applied
+  when the page opens (but not over a link that already says what to show, such as the
+  dashboard's "Waiting for you"). Reports remember the report, events, dates, campus and the
+  past/inactive/closed options. Per person, stored on the server (up to 30 per page), removed when
+  an account is anonymised.
+- `/api/saved-filters` (list, save, rename/default, delete — your own only). Migration
+  `20261028180000_saved_filters`.
+
+## [1.49.1] - 2026-10-28
+
+### Added
+
+- **Bulk actions on registrations** (Admin → Manage registrations): tick registrations, or "Select
+  all shown" after filtering, and act on them at once —
+  - **Send a message** by email or WhatsApp, as an event update to the person who registered
+    (placeholders as on Email attendees);
+  - **Mark paid** — records what each still owes, by cash, EFT, card or other; paid registrations get
+    their tickets by email, as with a single payment;
+  - **Move to another ticket** (one event) — the same lines, issued tickets and QR codes move with
+    them, repriced at the new ticket's current price, so the difference shows as owing or overpaid;
+    places on the new ticket are checked first;
+  - **Put in a room or group** (one event) — their named people, with the group's capacity and
+    gender rules;
+  - **Export to Excel** (recorded in the access log, like other exports);
+  - **Cancel** — coupon uses released and the waitlist offered the places; no refund (record refunds
+    on the Payments page).
+  Each runs the same code as doing it one at a time (closed events, payment caps, coupons,
+  waitlist, privacy rules on messages), with a result per registration. Up to 500 at a time.
+- `POST /api/registrations/bulk` (campus-checked for every registration; payments and ticket moves
+  refused in licence read-only mode); `registrationIds` filter on the email and WhatsApp attendee
+  endpoints. Audit action `registrations_bulk` (migration `20261028170000_registrations_bulk`).
+
+## [1.49.0] - 2026-10-28
+
+### Added
+
+- **Today on the dashboard** (staff, supervisors, admins): what's on today — each event, or its
+  session today — with people checked in so far against places, children in now at kids church,
+  and volunteers here against rostered (and how many short). Supervisors and admins also see money
+  in today and over the last 7 days. Refreshes every 30 seconds; follows campus scoping.
+- **Waiting for you** (supervisors, admins): what needs someone, each linking to where it's dealt
+  with — unpaid registrations for events in the next two weeks, young people waiting for parental
+  consent, waitlists, cover requests, serving roles in the next week short of people, and for
+  admins past events to cash up, provider payments to reconcile, open privacy requests and failed
+  webhook deliveries.
+- **Command palette — Ctrl K (⌘K)** anywhere in the dashboard, or "Search or jump to…" on the
+  dashboards: pages, settings tabs and reports for the person's role, actions ("New event", "Scan
+  tickets", "Record a payment"…), and search — events for everyone; payments by amount ("R450") for
+  supervisors; people and registrations (by reference) for admins. Keyboard: ↑/↓, Enter, Esc.
+- Deep links: `/dashboard/supervisor/events?edit=<id>` and `?new=1`; `/dashboard/admin/registrations?q=&status=&event=`;
+  `/dashboard/admin/users?q=`.
+- `GET /api/dashboard/today`, `GET /api/dashboard/search?q=`.
+
+## [1.48.2] - 2026-10-28
+
+### Added
+
+- **Four demo seeds**, to match the church a demo is for — `npm run demo:small`, `demo:events`
+  (the original demo), `demo:ministry` and `demo:multicampus` from the repo root (`demo:list`
+  describes them; in `backend/` it's `npm run set-demo -- --profile=<name>`). New in the seeds:
+  multi-session courses with attendance and certificates, a "pick your days" conference, kids church
+  with families, children, rooms and check-ins (including some checked in right now), volunteer
+  rosters with QR check-ins and a cover request, an event series with followers and a season pass,
+  and three campuses with campus-limited staff. Campuses are switched on only for `multicampus`.
+  Series announcements and volunteer reminders are marked as sent, so the jobs don't email demo
+  people. See `backend/DEMO_DATA.md`.
+
+### Fixed
+
+- **`npm run set-demo` failed since 1.43.0** ("Event_createdById_fkey"): clearing the `Campus` table
+  with TRUNCATE … CASCADE also emptied `User` (it points at Campus for the home campus), deleting the
+  admin it keeps. Tables that `User` points at are now emptied with DELETE after the admin's links
+  to them are cleared.
+
+## [1.48.1] - 2026-10-28
+
+### Changed
+
+- **Built-in privacy notice brought up to date** with volunteer rosters (what is kept, reminders,
+  who sees the roster and cover requests), following an event series, season passes, webhooks
+  (connected systems, what they receive, 30-day copies), how people agree to the notice, and the
+  `cross_events_dismissed_notices` browser-storage item. Sites that haven't published their own
+  version show the new text straight away.
+- **Sites that published their own version** are now told: Admin → Privacy → Privacy notice lists
+  what changed in the built-in text since they last reviewed it, marks each section with new text
+  (**show it** / **Use the new text**), offers **Use all the new text**, and **Add** for built-in
+  sections the notice doesn't have. **Done — hide this** records the review
+  (`privacy_notice_builtin_reviewed`). Their own text is never changed without them; publish (with
+  "Significant change" if people should accept again) to make it live.
+
+### Fixed
+
+- **Agreeing to the notice when an account was made for you** — activating an account (made by
+  staff, at the door or by whoever registered you) now asks you to agree to the Terms of Use and
+  Privacy Policy, as sign-up does (consent log source "Account activation").
+- **Never accepted?** Anyone who has never accepted any version (accounts made for them, or from
+  before acceptances were recorded) is asked once after login ("Our privacy notice"), even while
+  the built-in notice is in use. Before, they were only asked after a version marked as a
+  significant change was published.
+- The "Change my cookie choice" button on the privacy page also shows above a cookie section an
+  admin wrote themselves (any section whose id mentions cookies), not only the built-in one.
+
+## [1.48.0] - 2026-10-28
+
+### Added
+
+- **Outbound webhooks** — Site settings → **Webhooks**: send what happens here to other systems
+  (ChurchSuite, Planning Center, Google Sheets through Zapier or Make…). Add an https address and
+  choose what to send: `registration.created`, `registration.paid`, `registration.cancelled`,
+  `payment.received`, `payment.refunded`, `ticket.checked_in`, `user.created`, `event.published`.
+- Each message is JSON `{ id, type, createdAt, data }` signed with the webhook's own secret
+  (`X-CrossEvents-Signature: t=…,v1=…`, HMAC-SHA256 of `<t>.<body>`; shown once, "New secret" to
+  rotate). **Send test**, a **delivery log** (30 days, with the full message and what came back) and
+  **Resend**. Failures are retried after 1 min, 5 min, 30 min, 2 h and 12 h, then marked failed.
+- Events are noticed in one place (a Prisma client extension in `config/db.js`), so every way of
+  registering, paying, cancelling, refunding or checking in is covered; each is checked again a
+  moment later, so a change that was rolled back sends nothing.
+- Safety and privacy: https addresses on public networks only (checked again at each send;
+  redirects aren't followed); each webhook is added to the POPIA operator register (marked inactive
+  when deleted); kids check-in and volunteer tickets are never sent; deliveries are deleted after 30
+  days and with an anonymised account.
+- New `webhooks` job (every minute, `WEBHOOKS_JOBS_ENABLED`); `WEBHOOKS_ENABLED=false` stops
+  noticing events. Audit action `webhook_endpoint_changed` (migration `20261028160000_webhooks`).
+
+## [1.47.4] - 2026-10-28
+
+### Fixed
+
+- **Update requested, then a newer version came out** — the Licence page said the newer version
+  was requested ("Version 1.47.3 is available. Update requested …") when the request was for an
+  older one, and there was no way to ask for the newer version; the update banner stayed hidden.
+  Now it shows the request ("You asked for version 1.47.0 on …") and, below it, that a newer
+  version has come out with **Ask for 1.47.3 instead** (Withdraw request stays). The banner shows
+  again and says to change the request. Changing it is audited as `hub_update_requested` with
+  `changedFrom`.
+- With Cross Events Hub 1.5.0 the Hub moves the open request on to the new version and emails the
+  provider once; with an older Hub the site withdraws the request and makes it again.
+
+## [1.47.3] - 2026-10-28
+
+### Added
+
+- **Season passes** — one price for a ticket at each of several events in a series. On the Event
+  series page supervisors make a pass (name, price, optional sale end) and tick which events and
+  which ticket (and variant) at each it includes; the form shows what they'd cost separately. Youth
+  (parental consent) events, staff-only tickets and per-session tickets can't be on a pass. Events
+  and price are fixed once someone has bought it (switch it off instead); campus-scoped supervisors
+  can only use their campuses' events.
+- **Buying** — on the series page signed-in people choose how many and buy: they're registered at
+  every event on the pass at once and pay once (a free pass gives the tickets straight away). If
+  online payment isn't possible the places stay booked and "Your passes" offers **Pay now**. A pass
+  stops selling when its first event starts.
+- **Money per event** — the price is split over the events in proportion to their normal ticket
+  prices (whole cents). Each registration's line is priced at its event's share, and the payment is
+  recorded as one payment per event (all linked to the purchase), so each event's cashup and reports
+  count only its part. Pass registrations aren't repriced by early-bird changes, take no coupon
+  codes, and their tickets can't be edited.
+- `/api/season-passes` (list, create, change, delete; `:id/buy`; `purchases/:id/checkout`; `mine`),
+  `passes` on `GET /api/series/by-slug/:slug`. Making, changing and buying passes is blocked in
+  licence read-only mode. Purchases are in "Download my data". Audit action `season_pass_changed`
+  (migration `20261028150000_season_pass`).
+
+## [1.47.2] - 2026-10-28
+
+### Added
+
+- **Series: year on year** report (Reports → Other) — pick a series and see each of its events side
+  by side, oldest first: registrations (not cancelled), tickets, income (as on the dashboard: refunds
+  counted, donations applied to orders left out) and people checked in (a multi-session event shows
+  the average per session), with the attendance rate and the change from the event before. Bar charts
+  of registrations and income; exports to PDF, Excel, email and WhatsApp like the other reports.
+  Campus-scoped staff see only their campuses' events. **Compare** on each series on the Event series
+  page opens it (`?report=seriesComparison&series=<id>`).
+- `GET /api/series/:id/compare`.
+
+## [1.47.1] - 2026-10-28
+
+### Added
+
+- **Event series** — group separate events (Camp 2025, Camp 2026; the monthly men's breakfast) on
+  one page. Supervisors make series on the new **Event series** page (name, web address,
+  description, picture) and put an event in one with the **Series** box in the event editor; a
+  copied event keeps its series. A series can have events at several campuses.
+- **Series page** `/series/<slug>`: what's coming up (event cards) and past events. Each event in a
+  series shows "Part of …" and **Next in this series** on its page.
+- **Follow a series** — signed-in people follow on the series page. When a new event in the series
+  goes live (and hasn't started) followers get one email, sent as News & announcements: only to
+  people opted in to news, with the unsubscribe link and one-click headers. New `series` job every
+  15 minutes (`SERIES_JOBS_ENABLED`); an event moved into another series is announced to that
+  series' followers.
+- Followed series are in "Download my data" and removed when an account is anonymised.
+- API: `/api/series` (list, create, change; delete for admins; `by-slug`; follow/unfollow),
+  `seriesId` on event create/update, `?series=<slug>` on `GET /api/events`, `series` and
+  `nextInSeries` on `GET /api/events/:id`. Creating and changing series is blocked in licence
+  read-only mode. Audit actions `series_created`, `series_updated`, `series_deleted` (migration
+  `20261028140000_event_series`).
+
 ## [1.47.0] - 2026-10-28

 ### Added
@@ -29,15 +29,16 @@ WhatsApp · PM2 for process management · optional Sentry for error monitoring.
 13. [Cashup & event costs](#cashup--event-costs)
 14. [Reports](#reports)
 15. [Site settings & setup wizard](#site-settings--setup-wizard)
-16. [Multi-campus](#multi-campus)
-17. [Kids check-in](#kids-check-in)
-18. [Volunteer rosters](#volunteer-rosters)
-19. [Accounts & security](#accounts--security)
-20. [Privacy (POPIA)](#privacy-popia)
-21. [Help system](#help-system)
-22. [Background jobs](#background-jobs)
-23. [Operations](#operations)
-24. [Page map](#page-map)
+16. [Event series](#event-series)
+17. [Multi-campus](#multi-campus)
+18. [Kids check-in](#kids-check-in)
+19. [Volunteer rosters](#volunteer-rosters)
+20. [Accounts & security](#accounts--security)
+21. [Privacy (POPIA)](#privacy-popia)
+22. [Help system](#help-system)
+23. [Background jobs](#background-jobs)
+24. [Operations](#operations)
+25. [Page map](#page-map)

 ---

@@ -413,9 +414,18 @@ logout controls. Disconnected sessions are recovered automatically.

 ## Supervisor tools

- **Dashboard** — KPIs (active events, revenue, donations, registrations,
-  tickets sold, each vs. the previous month), revenue trend chart, top events,
-  and recent scans. Tiles link to the matching report.
+- **Dashboard** — **Today** (each event or session on today: checked in so far
+  against places, children in now, volunteers here; money in today and this
+  week) and **Waiting for you** (unpaid registrations for the next two weeks,
+  parental consent outstanding, waitlists, cover requests, roster gaps; for
+  admins also cashups due, payments to reconcile, privacy requests, failed
+  webhooks — each links to where it's dealt with); then KPIs (active events,
+  revenue, donations, registrations, tickets sold, each vs. the previous month),
+  revenue trend chart, top events, and recent scans. Staff see Today too.
+- **Command palette (Ctrl K / ⌘K)** — anywhere in the dashboard: pages, settings
+  and reports for the role, actions ("New event", "Scan tickets"…), and search:
+  events; payments by amount ("R450") for supervisors; people and registrations
+  for admins. Follows campus scoping.
 - **Manage events** — the 9-step event wizard, ticket options, variants,
  sections, form and attachments.
 - **At the door** — search by name/phone/ticket ID, walk-in registration,
@@ -466,7 +476,14 @@ logout controls. Disconnected sessions are recovered automatically.
  [Privacy](#privacy-popia)).
 - **Registrations** — all registrations, with filters (event, status, text),
  status counts, revenue and outstanding totals, and per-registration options,
-  form answers and payments (with who recorded each one).
+  form answers and payments (with who recorded each one). **Bulk actions** on
+  ticked registrations (or all shown): message (email/WhatsApp), mark paid
+  (records the balance by method), move to another ticket (same tickets and QR
+  codes, repriced), put in a room or group, export to Excel, cancel — each
+  through the same rules as one at a time, with a result per registration.
+- **Saved filters** — on Manage registrations, Users, Events and Reports: name the
+  current filters, apply one with a click, star one as the default for the page
+  (not applied over a deep link). Per person, on the server.
 - **Cashup** — see below.
 - **Audit log** (`/dashboard/admin/audit-log`) — who did what and when for
  refunds, donation assign/unassign, manual registrations, staff
@@ -508,6 +525,7 @@ a viewer with its own filters, stat tiles and bar charts.
 | Ticketing | Ticket usage summary |
 | Donations | Donations breakdown (used / unused per event, plus the sponsorship pool) |
 | Cashup | Cashup reconciliation · Cashup audit trail |
+| Other | Series: year on year (a series' events side by side — registrations, tickets, income, checked in, attendance rate, change from the one before) |

 **Export:** Print, branded PDF download, styled Excel (`.xlsx`) workbook,
 Email (to yourself), or WhatsApp (the PDF to your own number). Dashboard tiles
@@ -539,6 +557,33 @@ See [SETTINGS.md](./SETTINGS.md) for the default of every setting.

 ---

+## Event series
+
+Separate events grouped on one page — every year's camp, the monthly men's breakfast (each event
+keeps its own registrations; for one event on several dates see multi-day events).
+
+- **Event series** page (supervisors): name, web address (`/series/<slug>`), description, picture;
+  each series lists its events (campus-scoped supervisors see only their campuses' events in it)
+  and its number of followers. Admins can delete a series (its events stay).
+- **Series box** in the event editor's Basic details. A copied event keeps its series. A series can
+  have events at several campuses.
+- **Public series page**: upcoming events as cards, then past events. Event pages in a series show
+  "Part of …" and **Next in this series** (the next public event in it).
+- **Follow a series**: signed-in people follow on the series page; when a new event in it goes live
+  (before it starts) they get one email, sent as News & announcements (opted-in only, with an
+  unsubscribe link). The `series` job runs every 15 minutes.
+- **Year on year**: Reports → Series: year on year (or **Compare** on the Event series page)
+  compares the series' events — registrations, tickets, income, checked in (average per session on
+  multi-session events), attendance rate — each against the one before.
+- **Season passes**: on the Event series page, a pass gives a ticket (and variant) at each event
+  ticked, at one price (optional sale end; stops when its first event starts; no youth events,
+  staff-only or per-session tickets). Buyers choose how many on the series page and are registered at
+  every event at once with one payment (or tickets at once when free; "Pay now" later if online
+  payment isn't possible). The price is split over the events in proportion to their normal prices;
+  each event gets its own registration line and payment for its share, so cashups stay per event.
+  Pass registrations aren't repriced, take no codes and can't be edited. Events and price lock once
+  sold.
+
 ## Multi-campus

 For a church with several campuses in one install (Site settings → Campuses, off by
@@ -700,8 +745,12 @@ and published, numbered versions (earlier ones stay readable with `?version=N`).
 Placeholders (`{org}`, `{ioName}`, `{ioEmail}`, `{website}`, `{orgEmail}`,
 `{medicalRetentionDays}`, `{operators}`) are filled in from Site settings and the
 operator register. A version marked as a significant change is accepted once by everyone
-after their next login; sign-up records the version accepted. The contact page shows the
-Information Officer.
+after their next login. People agree to the notice at sign-up and when they activate an account
+made for them; anyone who never has is asked once after login. When the built-in text changes
+in an update, a site with its own published version sees what changed in the editor, with each
+changed section marked (**Use the new text**, **Use all the new text**, **Add** missing sections,
+**Done — hide this**). The "Change my cookie choice" button shows above the cookie section. The
+contact page shows the Information Officer.

 **Registers and logs** (same admin page):

@@ -743,6 +792,23 @@ falling back to a general guide.

 ---

+## Outbound webhooks
+
+Site settings → **Webhooks** (admins): send what happens to other systems as it happens.
+
+- **Endpoints**: name, https address, and the event types to send — registration created / paid /
+  cancelled, payment received / refunded, ticket checked in, account created, event published.
+  Switch off, edit, delete, **Send test**, **New secret**.
+- **Messages**: JSON `{ id, type, createdAt, data }` (registration with items and totals, payment,
+  check-in with session, person, event); headers `X-CrossEvents-Event`, `X-CrossEvents-Delivery` and
+  `X-CrossEvents-Signature: t=<unix>,v1=<hex HMAC-SHA256 of "<t>.<body>">` with the endpoint's secret.
+- **Delivery log** per endpoint (30 days): status, tries, response code or error, the full message,
+  **Resend**. Retries after 1 min, 5 min, 30 min, 2 h, 12 h, then failed.
+- Every path that registers, pays, cancels, refunds or checks in is covered (Prisma client
+  extension); rolled-back changes send nothing. Kids check-in and volunteer tickets are never sent.
+- https and public addresses only (DNS checked at each send, redirects not followed). Each endpoint
+  is added to the operator register; deliveries are deleted after 30 days and with an account.
+
 ## Background jobs

 Timed jobs run on a job queue in Postgres (pg-boss, `backend/src/jobs/index.js`): each
@@ -762,6 +828,8 @@ can't start, the same jobs run on in-process timers.
 | `feedback` — post-event feedback forms and their 3-day reminder | Every 15 minutes (`FEEDBACK_JOB_ENABLED=false`) |
 | `sessions` — session reminders, and certificates for events that ended in the last 14 days | Every 5 minutes (`SESSION_JOBS_ENABLED=false`) |
 | `volunteers` — volunteer reminders the day before a shift | Every 15 minutes (`VOLUNTEER_JOBS_ENABLED=false`) |
+| `series` — email a series' followers when a new event in it goes live | Every 15 minutes (`SERIES_JOBS_ENABLED=false`) |
+| `webhooks` — send webhook deliveries that are due, retry failures, delete deliveries after 30 days | Every minute (`WEBHOOKS_JOBS_ENABLED=false`) |
 | `consent` — parental consent reminders, and deleting medical details after events | 09:00 daily (`CONSENT_JOBS_ENABLED=false`) |
 | `privacy` — remind admins of privacy requests due within a week or overdue | 08:00 daily (`PRIVACY_JOBS_ENABLED=false`) |
 | `retention` — delete/anonymise personal information past its retention period (Admin → Privacy → Retention) | 03:30 daily (`RETENTION_JOBS_ENABLED=false`) |
@@ -784,7 +852,8 @@ can't start, the same jobs run on in-process timers.
  created or edited; no new registrations or payments; tickets still scan, data can be exported).
  The site checks in 30 seconds after starting and after a licence key is connected. Admins see when an update is available, with
  **what's new** in each version, and press **Request update**, which tells the provider through the Hub (the site never updates
-  itself). A request can be **withdrawn**. **Not now** hides the update banner until the next version; urgent updates (security or
+  itself). A request can be **withdrawn**; when a newer version comes out after asking, the page shows
+  the version asked for and **Ask for … instead** moves the request on to the newer one. **Not now** hides the update banner until the next version; urgent updates (security or
  serious bug fixes) can't be put off and show a red banner.
 - **Notices from the provider** — maintenance and other messages the provider posts in the Hub show as a banner on the dashboard
  for site admins and supervisors, in their time window; each can be closed (per browser) and stays listed on Site settings →
@@ -816,6 +885,7 @@ can't start, the same jobs run on in-process timers.
 | `/` | Public | Home |
 | `/events`, `/events/[id]` | Public | Event list and detail |
 | `/campus/[slug]` | Public | A campus's page and its events (while campuses are on) |
+| `/series/[slug]` | Public | A series' page: upcoming and past events, Follow |
 | `/[alias]` | Public | Event short link |
 | `/register/[eventId]` | Public / User | Registration |
 | `/registration/success` | Public / User | Confirmation, form and pay |
@@ -117,6 +117,10 @@ Managed in the Payments tab (through `/api/payments/providers/settings` and `/ap
 | `retention_policies` | Inactive accounts 60 months (on), form answers 12, login history 24, payment details 24, children at kids check-in (`kids_profiles`) 6, audit/access logs 60 — all on | Admin → Privacy → Retention (JSON `{ policies: { key: { enabled, months } }, reviewedAt, reviewedBy }`). Minimums: inactive accounts and logs 12 months, login history and payment details 3, form answers and kids profiles 1; maximum 240. Saving marks them reviewed (readiness check). |
 | `retention_last_run` | — | When the `retention` job last ran and what it did (readiness check: within 2 days). |
 | `VOLUNTEER_JOBS_ENABLED` (env) | `true` | The `volunteers` job (every 15 minutes) that sends volunteer reminders the day before a shift. |
+| `WEBHOOKS_JOBS_ENABLED` (env) | `true` | The `webhooks` job (every minute): sends deliveries that are due (retries), picks up sends cut off by a restart, deletes deliveries older than 30 days. New events are sent straight away without it. |
+| `WEBHOOKS_ENABLED` (env) | `true` | `false` stops noticing events for outbound webhooks altogether (nothing new is queued). |
+| `WEBHOOKS_ALLOW_PRIVATE` (env) | `false` | `true` lets webhook endpoints use http and private or local addresses — for local testing only (the e2e tests set it). |
+| `SERIES_JOBS_ENABLED` (env) | `true` | The `series` job (every 15 minutes) that emails a series' followers once when a new event in it goes live (News & announcements: only people opted in to news). |
 | `RETENTION_JOBS_ENABLED` (env) | `true` | The nightly 03:30 `retention` job. Off means nothing expires automatically. |
 | `wawp_webhook_last_seen` | — | Set when WAWP's webhook arrives with the right secret; the readiness page uses it to check WhatsApp STOP is set up. |
 | `privacy_notice_draft` | — | The unpublished draft from Admin → Privacy → Privacy notice (JSON). Published versions are in the `PrivacyNotice` table. With no published version the built-in notice (`backend/src/utils/privacyNotice.js`) is shown. The notice's org name, Information Officer, website, emails and medical retention days come from the settings above when it's shown. |
@@ -12,6 +12,82 @@ Write for church admins, not developers: no environment variables, endpoints or
 developer log is CHANGELOG.md. A tagged version without a section here shows "No details given".
 -->

+## 1.49.2
+
+- **Saved filters.** On Manage registrations, Users, Events and Reports, save the filters you use
+  under a name and get back to them with one click. Star one and it's ready every time you open the
+  page. They're yours and follow you to any device.
+
+## 1.49.1
+
+- **Do many at once.** On Manage registrations, tick the people you want (or select everyone
+  shown after filtering) and send them a message, mark them paid, move them to another ticket, put
+  them in a room or group, export them to Excel, or cancel them.
+- Moving people to another ticket keeps their tickets and QR codes; the price follows the new
+  ticket, so any difference shows as owing.
+- You see what happened to each one, and anything that couldn't be done says why.
+
+## 1.49.0
+
+- **Today, at a glance.** The dashboard now starts with what's on today: each event with how many
+  people are checked in, children in at kids church, and volunteers here — plus money in today and
+  this week.
+- **Waiting for you.** One list of what needs someone — unpaid registrations, consent forms still
+  outstanding, waitlists, volunteers asking for cover, events to cash up — each a click away.
+- **Ctrl K to find anything.** Press Ctrl K anywhere in the dashboard to jump to a page or setting,
+  start "New event", or find an event, a payment by amount ("R450") or a person.
+
+## 1.48.2
+
+- No changes for churches in this version — it adds demo data for showing Cross Events to other
+  churches.
+
+## 1.48.1
+
+- **Privacy notice brought up to date** with volunteer rosters, event series, season passes and
+  webhooks. If you haven't published your own version, your site shows the new text straight away.
+- **Published your own version?** Admin → Privacy → Privacy notice now shows what changed in the
+  built-in text, section by section, so you can take the new wording with one click and publish.
+- **Everyone agrees to the notice once.** People whose account was made for them agree when they
+  activate it, and anyone who never has is asked once after they next log in.
+
+## 1.48.0
+
+- **Webhooks.** Connect Cross Events to other systems — ChurchSuite, Planning Center, a Google
+  Sheet through Zapier or Make. Choose what to send (new registrations, payments, check-ins, new
+  accounts, published events) in Site settings → Webhooks, and it goes out as it happens.
+- Every message is signed so the other system can trust it, failures are tried again
+  automatically, and a delivery log shows what was sent.
+- Each webhook is added to your operator register for POPIA. Children's details are never sent.
+
+## 1.47.4
+
+- **Asked for an update, and a newer one came out?** The Licence page now shows which version you
+  asked for, tells you when a newer one is out, and lets you ask for that one instead with one
+  button.
+
+## 1.47.3
+
+- **Season passes.** Sell a ticket for several events in a series at one price — say all of next
+  year's breakfasts. People buy it on the series page, pay once, and get a ticket for each event.
+- The money is shared out over the events in line with their normal ticket prices, so each event's
+  cashup shows its part.
+- Set passes up on the Event series page. A pass stops selling when its first event starts.
+
+## 1.47.2
+
+- **Compare a series year on year.** A new report puts the events in a series side by side —
+  registrations, tickets, income and how many came — with how much each went up or down from the
+  one before. Open it from Reports, or with **Compare** on the Event series page.
+
+## 1.47.1
+
+- **Event series.** Group events that come back — every year's camp, the monthly breakfast — on
+  one page that shows what's coming up and what's been. Each event in a series links to the next one.
+- **Follow a series.** People can follow a series and get an email when the next event in it is
+  out. It counts as news, so only people who chose to get news and announcements receive it.
+- A copied event stays in its series, and a series can have events at different campuses.
+
 ## 1.47.0

 - **Copy an event.** Running the same camp, course or breakfast again? Press **Copy** on the event
@@ -77,6 +77,11 @@ WAITLIST_JOB_ENABLED=true
 PAYMENT_STATUS_JOB_ENABLED=true
 # Volunteer rosters: reminders the day before a shift (every 15 minutes)
 VOLUNTEER_JOBS_ENABLED=true
+SERIES_JOBS_ENABLED=true
+WEBHOOKS_JOBS_ENABLED=true
+WEBHOOKS_ENABLED=true
+# Local testing only: lets webhook endpoints be http:// or on a private network
+WEBHOOKS_ALLOW_PRIVATE=false
 # Privacy (POPIA): daily 08:00 reminder to admins of data requests due within a week
 PRIVACY_JOBS_ENABLED=true
 # Privacy (POPIA): nightly 03:30 retention job (Admin → Privacy → Retention). Note: inactive
@@ -933,6 +933,99 @@ Allergies, medical and custody notes are stored encrypted. Staff routes are camp
 Since 1.46.0 board rooms also carry `rostered: [{ userId, name, checkedIn }]` (volunteers on a serving
 role linked to the room); checked-in ones are counted in `leaders`.

+## Saved filters
+
+Per person, on list pages `registrations`, `users`, `events`, `reports` (staff+; your own only — someone
+else's id answers 404).
+
+| Method | Path | Description |
+|--------|------|-------------|
+| GET | `/api/saved-filters?page=` | Mine for the page, default first |
+| POST | `/api/saved-filters` | `{ page, name, params, isDefault? }` — params: strings, numbers, booleans, lists of strings (≤ 4 KB); same name replaces; ≤ 30 per page |
+| PUT | `/api/saved-filters/:id` | `{ name?, isDefault? }` (one default per page) |
+| DELETE | `/api/saved-filters/:id` | Delete |
+
+## Bulk actions on registrations
+
+`POST /api/registrations/bulk` (supervisor+): `{ action, registrationIds: [...] (≤ 500), ...params }` →
+`{ action, done, skipped, failed, results: [{ id, ok, skipped?, message }] }`. Every id is campus-checked.
+
+| action | params | What happens |
+|--------|--------|--------------|
+| `markPaid` | `method`: cash/eft/card/other, `paidAt?` | A payment for what's still owed (as `POST /api/payments`); refused in licence read-only mode |
+| `cancel` | — | As cancelling one registration (coupons released, waitlist offered); no refund |
+| `moveOption` | `fromOptionId`, `toOptionId` (same event) | The lines, tickets and attendees move to the new ticket, repriced; status recalculated; places checked; refused in read-only mode |
+| `allocate` | `setId`, `groupId` | Each named person placed, as `PUT /api/allocations/sets/:id/assignments` |
+| `message` | `channel`: email/whatsapp, `subject` (email), `text` | Per event, as `POST /api/events/:id/email-attendees` / `whatsapp-attendees` with `filter.registrationIds`, kind "update" |
+
+## Dashboard and command palette
+
+| Method | Path | Auth | Description |
+|--------|------|------|-------------|
+| GET | `/api/dashboard/today` | staff+ | `{ events: [{ id, title, startsAt, endsAt, sessionLabel, places, checkedIn, kidsIn, volunteers }], money: { today, todayCount, week } \| null, pending: [{ key, label, count, href, tone }] }` — money and pending for supervisors/admins; campus-scoped |
+| GET | `/api/dashboard/search?q=` | staff+ | `{ results: [{ type: event\|payment\|person\|registration, id, title, subtitle, href }] }` — payments by amount for supervisors, people and registrations for admins |
+
+## Event series
+
+| Method | Path | Auth | Description |
+|--------|------|------|-------------|
+| GET | `/api/series` | supervisor+ | Every series with `followers`, `eventCount` and its events (campus-scoped: their campuses' events only) |
+| POST | `/api/series` | supervisor+ | Create: `{ name, slug?, description?, picture? }` (slug made from the name). 409 when the slug is taken |
+| PUT | `/api/series/:id` | supervisor+ | Change any of those fields |
+| DELETE | `/api/series/:id` | admin | Delete; events stay without a series, followers dropped |
+| GET | `/api/series/by-slug/:slug` | public | `{ id, name, slug, description, picture, upcoming, past, following }` — public events only |
+| POST / DELETE | `/api/series/:id/follow` | user | Follow / unfollow |
+| GET | `/api/series/:id/compare` | supervisor+ | Year on year: `{ series, events: [{ eventId, title, startDate, registrations, tickets, income, checkedIn, attendanceRate, sessions, change }] }`, oldest first; `change` is % against the event before. Scoped staff: their campuses' events only |
+
+Events take `seriesId` (null = none) on create and update; `GET /api/events?series=<slug>` lists one
+series; `GET /api/events/:id` includes `series` and `nextInSeries`. The `series` job emails
+followers once per event (`Event.seriesAnnouncedAt`) when it is public and hasn't started.
+
+## Outbound webhooks
+
+Admin only. Endpoints receive `POST` JSON `{ id: "evt_…", type, createdAt, data }` with headers
+`X-CrossEvents-Event`, `X-CrossEvents-Delivery` and `X-CrossEvents-Signature: t=<unix seconds>,v1=<hex>`
+where v1 = HMAC-SHA256(secret, `<t>.<raw body>`). Answer 2xx within 10 s; anything else is retried
+(1 min, 5 min, 30 min, 2 h, 12 h). The same `id` can arrive more than once — de-duplicate on it.
+
+| Type | `data` |
+|------|--------|
+| `registration.created` / `.paid` / `.cancelled` | `registration { id, status, totalDue, amountPaid, items[], seasonPassPurchaseId }`, `event`, `person` |
+| `payment.received` / `payment.refunded` | `payment { id, amount, method, provider, isDonation, registrationId }`, `event`, `person` |
+| `ticket.checked_in` | `checkIn { id, scannedAt, people, manual, offline, session }`, `ticket`, `event`, `person` |
+| `user.created` | `person { id, name, email, phone, role, createdAt }` |
+| `event.published` | `event { id, title, description, startDate, endDate, location, price, goLiveAt, url, campus, series }` |
+| `webhook.test` | `{ message }` (Send test) |
+
+| Method | Path | Description |
+|--------|------|-------------|
+| GET | `/api/outbound-webhooks` | Endpoints with last-week counts, and the event types |
+| POST | `/api/outbound-webhooks` | `{ name, url, events }` → endpoint plus `secret` (only here) |
+| PUT | `/api/outbound-webhooks/:id` | `{ name?, url?, events?, isActive? }` |
+| DELETE | `/api/outbound-webhooks/:id` | Endpoint and its deliveries |
+| POST | `/api/outbound-webhooks/:id/rotate-secret` | `{ secret }` |
+| POST | `/api/outbound-webhooks/:id/test` | `{ status, statusCode, error }` |
+| GET | `/api/outbound-webhooks/:id/deliveries?status=&limit=` | Delivery log |
+| POST | `/api/outbound-webhooks/deliveries/:id/resend` | Send again now |
+
+## Season passes
+
+| Method | Path | Auth | Description |
+|--------|------|------|-------------|
+| GET | `/api/season-passes?seriesId=` | supervisor+ | Passes with events, normal prices, `share` per event, `sold`, `unpaid` |
+| POST | `/api/season-passes` | supervisor+ | `{ seriesId, name, description?, price, saleEndsAt?, isActive?, items: [{ eventId, eventOptionId, variantId? }] }` |
+| PUT | `/api/season-passes/:id` | supervisor+ | Change it; events and price only while unsold (409) |
+| DELETE | `/api/season-passes/:id` | supervisor+ | Only while unsold |
+| POST | `/api/season-passes/:id/buy` | user | `{ quantity }` → `{ purchaseId, total, paid, redirectUrl, message }`; 409 when not on sale or too few places |
+| POST | `/api/season-passes/purchases/:id/checkout` | user (buyer) | A new checkout for what is still owed |
+| GET | `/api/season-passes/mine` | user | My purchases with their registrations |
+
+A purchase creates one `Registration` per event (`seasonPassPurchaseId`), its line priced at the
+event's share. The checkout's metadata is `{ type: 'season_pass', purchaseId }`; the webhook records
+one `Payment` per registration (`seasonPassPurchaseId`; only the first carries `externalId`).
+`PUT /api/registrations/:id/options` and `POST /api/registrations/:id/coupon` answer 409 for pass
+registrations.
+
 ## Volunteer rosters

 Volunteer rosters (1.46.0, `src/utils/volunteers.js`). A **serving role** belongs to an event, or to
@@ -1,10 +1,19 @@
 # Demo data

-`npm run set-demo` replaces everything in the database with a realistic set of demo data,
-for showing the platform to other churches. It stages six upcoming events with
-registrations, payments, tickets and people, and ten completed events from the past year
-with door sales, check-ins, feedback and cashups. That way every dashboard, report,
-check-in and cashup screen has something to show.
+The demo seeds replace everything in the database with a realistic set of demo data, for
+showing the platform to other churches. Pick the one that looks like the church you're
+showing it to:
+
+| Command (repo root) | For | What's in it |
+|---|---|---|
+| `npm run demo:small` | A small church, one congregation | 3 upcoming events (a sold-out breakfast with a waitlist, a family day, free carols), 4 past events with check-ins and cashups. No campuses, kids check-in, rosters, courses or series. |
+| `npm run demo:events` | Events and conferences (the original demo) | 6 upcoming events (coupons, variants, early birds, a youth camp with consent and cabins, bundles, donations) and 10 past events with every kind of cashup and funnel analytics. |
+| `npm run demo:ministry` | One campus with weekly ministry | The Alpha Course running now (sessions, attendance, late joining, certificates), a finished Marriage Course with certificates, a 3-day conference sold by day, **Kids Church** with families, children, rooms and check-ins, **volunteer rosters**, a **Men's Breakfast series** with followers and a **season pass**, plus a family day, women's conference and carols. |
+| `npm run demo:multicampus` | A church with several campuses | **Campuses** Central, North and South (switched on), events per campus and church-wide, home campuses, staff limited to a campus (Anri Botha → North, Daniel Pillay → South), the breakfast series moving between campuses, kids church and rosters at two campuses, and all the events-demo events spread over the campuses. |
+
+`npm run demo:list` prints the same list. Kids church always has a session **today** with
+children checked in right now, so the kids desk and room screens have something live to
+show on any day.

 > **This deletes real data.** Run it only against a database you're happy to wipe, such
 > as a dedicated demo deployment. It is not something to run on a live church site.
@@ -14,11 +23,15 @@ check-in and cashup screen has something to show.
 ## Running it

 ```bash
-cd backend
-npm run set-demo            # shows the database it will wipe and asks you to type "demo"
-npm run set-demo -- --yes   # no prompt (for scripts)
+npm run demo:ministry             # (repo root) shows the database it will wipe and asks you to type "demo"
+npm run demo:ministry -- --yes    # no prompt (for scripts)
+# or in backend/:
+npm run set-demo -- --profile=ministry --yes   # without --profile it seeds "events"
 ```

+The campuses setting is switched on for `multicampus` and off for the others (site settings
+are otherwise kept). **Restart the backend afterwards** so it picks the setting up.
+
 The script uses `DATABASE_URL` from `backend/.env`. To point it at another database
 for one run, set it in the environment first. A value already in the environment wins
 over `.env`:
@@ -145,7 +145,7 @@ npm run prisma:generate

 ### Demo data

-`npm run set-demo` wipes the database (keeping site settings and the admin account) and stages six upcoming demo events with registrations, payments and tickets. See [DEMO_DATA.md](DEMO_DATA.md).
+`npm run set-demo -- --profile=<small|events|ministry|multicampus>` wipes the database (keeping site settings and the admin account) and stages demo data for that kind of church; from the repo root it's `npm run demo:<name>` (`npm run demo:list` describes them). See [DEMO_DATA.md](DEMO_DATA.md).

 ---

@@ -1,12 +1,12 @@
 {
  "name": "event-management-backend",
-  "version": "1.47.0",
+  "version": "1.49.2",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "event-management-backend",
-      "version": "1.47.0",
+      "version": "1.49.2",
      "hasInstallScript": true,
      "dependencies": {
        "@prisma/adapter-pg": "^7.10.1",
@@ -1,6 +1,6 @@
 {
  "name": "event-management-backend",
-  "version": "1.47.0",
+  "version": "1.49.2",
  "description": "Event Management System Backend",
  "main": "src/index.js",
  "scripts": {
@@ -0,0 +1,59 @@
+-- AlterEnum
+-- This migration adds more than one value to an enum.
+-- With PostgreSQL versions 11 and earlier, this is not possible
+-- in a single migration. This can be worked around by creating
+-- multiple migrations, each migration adding only one value to
+-- the enum.
+
+
+ALTER TYPE "AdminAuditAction" ADD VALUE 'series_created';
+ALTER TYPE "AdminAuditAction" ADD VALUE 'series_updated';
+ALTER TYPE "AdminAuditAction" ADD VALUE 'series_deleted';
+
+-- AlterTable
+ALTER TABLE "Event" ADD COLUMN     "seriesAnnouncedAt" TIMESTAMP(3),
+ADD COLUMN     "seriesId" TEXT;
+
+-- CreateTable
+CREATE TABLE "EventSeries" (
+    "id" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "slug" TEXT NOT NULL,
+    "description" TEXT,
+    "picture" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "EventSeries_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "SeriesFollow" (
+    "id" TEXT NOT NULL,
+    "seriesId" TEXT NOT NULL,
+    "userId" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "SeriesFollow_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "EventSeries_slug_key" ON "EventSeries"("slug");
+
+-- CreateIndex
+CREATE INDEX "SeriesFollow_userId_idx" ON "SeriesFollow"("userId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "SeriesFollow_seriesId_userId_key" ON "SeriesFollow"("seriesId", "userId");
+
+-- CreateIndex
+CREATE INDEX "Event_seriesId_idx" ON "Event"("seriesId");
+
+-- AddForeignKey
+ALTER TABLE "Event" ADD CONSTRAINT "Event_seriesId_fkey" FOREIGN KEY ("seriesId") REFERENCES "EventSeries"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "SeriesFollow" ADD CONSTRAINT "SeriesFollow_seriesId_fkey" FOREIGN KEY ("seriesId") REFERENCES "EventSeries"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "SeriesFollow" ADD CONSTRAINT "SeriesFollow_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;
@@ -0,0 +1,102 @@
+-- AlterEnum
+ALTER TYPE "AdminAuditAction" ADD VALUE 'season_pass_changed';
+
+-- AlterTable
+ALTER TABLE "Payment" ADD COLUMN     "seasonPassPurchaseId" TEXT;
+
+-- AlterTable
+ALTER TABLE "Registration" ADD COLUMN     "seasonPassPurchaseId" TEXT;
+
+-- CreateTable
+CREATE TABLE "SeasonPass" (
+    "id" TEXT NOT NULL,
+    "seriesId" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "description" TEXT,
+    "price" DOUBLE PRECISION NOT NULL,
+    "isActive" BOOLEAN NOT NULL DEFAULT true,
+    "saleEndsAt" TIMESTAMP(3),
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "SeasonPass_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "SeasonPassItem" (
+    "id" TEXT NOT NULL,
+    "passId" TEXT NOT NULL,
+    "eventId" TEXT NOT NULL,
+    "eventOptionId" TEXT NOT NULL,
+    "variantId" TEXT,
+    "order" INTEGER NOT NULL DEFAULT 0,
+
+    CONSTRAINT "SeasonPassItem_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "SeasonPassPurchase" (
+    "id" TEXT NOT NULL,
+    "passId" TEXT NOT NULL,
+    "userId" TEXT NOT NULL,
+    "quantity" INTEGER NOT NULL,
+    "total" DOUBLE PRECISION NOT NULL,
+    "status" TEXT NOT NULL DEFAULT 'pending',
+    "checkoutId" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "SeasonPassPurchase_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "SeasonPass_seriesId_idx" ON "SeasonPass"("seriesId");
+
+-- CreateIndex
+CREATE INDEX "SeasonPassItem_eventId_idx" ON "SeasonPassItem"("eventId");
+
+-- CreateIndex
+CREATE INDEX "SeasonPassItem_eventOptionId_idx" ON "SeasonPassItem"("eventOptionId");
+
+-- CreateIndex
+CREATE INDEX "SeasonPassItem_variantId_idx" ON "SeasonPassItem"("variantId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "SeasonPassItem_passId_eventId_key" ON "SeasonPassItem"("passId", "eventId");
+
+-- CreateIndex
+CREATE INDEX "SeasonPassPurchase_passId_idx" ON "SeasonPassPurchase"("passId");
+
+-- CreateIndex
+CREATE INDEX "SeasonPassPurchase_userId_idx" ON "SeasonPassPurchase"("userId");
+
+-- CreateIndex
+CREATE INDEX "SeasonPassPurchase_checkoutId_idx" ON "SeasonPassPurchase"("checkoutId");
+
+-- AddForeignKey
+ALTER TABLE "SeasonPass" ADD CONSTRAINT "SeasonPass_seriesId_fkey" FOREIGN KEY ("seriesId") REFERENCES "EventSeries"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "SeasonPassItem" ADD CONSTRAINT "SeasonPassItem_passId_fkey" FOREIGN KEY ("passId") REFERENCES "SeasonPass"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "SeasonPassItem" ADD CONSTRAINT "SeasonPassItem_eventId_fkey" FOREIGN KEY ("eventId") REFERENCES "Event"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "SeasonPassItem" ADD CONSTRAINT "SeasonPassItem_eventOptionId_fkey" FOREIGN KEY ("eventOptionId") REFERENCES "EventOption"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "SeasonPassItem" ADD CONSTRAINT "SeasonPassItem_variantId_fkey" FOREIGN KEY ("variantId") REFERENCES "OptionVariant"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "SeasonPassPurchase" ADD CONSTRAINT "SeasonPassPurchase_passId_fkey" FOREIGN KEY ("passId") REFERENCES "SeasonPass"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "SeasonPassPurchase" ADD CONSTRAINT "SeasonPassPurchase_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "Registration" ADD CONSTRAINT "Registration_seasonPassPurchaseId_fkey" FOREIGN KEY ("seasonPassPurchaseId") REFERENCES "SeasonPassPurchase"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "Payment" ADD CONSTRAINT "Payment_seasonPassPurchaseId_fkey" FOREIGN KEY ("seasonPassPurchaseId") REFERENCES "SeasonPassPurchase"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
@@ -0,0 +1,54 @@
+-- AlterEnum
+ALTER TYPE "AdminAuditAction" ADD VALUE 'webhook_endpoint_changed';
+
+-- CreateTable
+CREATE TABLE "WebhookEndpoint" (
+    "id" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "url" TEXT NOT NULL,
+    "secret" TEXT NOT NULL,
+    "events" TEXT[],
+    "isActive" BOOLEAN NOT NULL DEFAULT true,
+    "operatorId" TEXT,
+    "lastSuccessAt" TIMESTAMP(3),
+    "lastFailureAt" TIMESTAMP(3),
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "WebhookEndpoint_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "WebhookDelivery" (
+    "id" TEXT NOT NULL,
+    "endpointId" TEXT NOT NULL,
+    "eventId" TEXT NOT NULL,
+    "type" TEXT NOT NULL,
+    "payload" JSONB NOT NULL,
+    "status" TEXT NOT NULL DEFAULT 'pending',
+    "attempts" INTEGER NOT NULL DEFAULT 0,
+    "nextAttemptAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "lastStatusCode" INTEGER,
+    "lastError" TEXT,
+    "deliveredAt" TIMESTAMP(3),
+    "userId" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "WebhookDelivery_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "WebhookDelivery_status_nextAttemptAt_idx" ON "WebhookDelivery"("status", "nextAttemptAt");
+
+-- CreateIndex
+CREATE INDEX "WebhookDelivery_endpointId_createdAt_idx" ON "WebhookDelivery"("endpointId", "createdAt");
+
+-- CreateIndex
+CREATE INDEX "WebhookDelivery_userId_idx" ON "WebhookDelivery"("userId");
+
+-- CreateIndex
+CREATE INDEX "WebhookDelivery_createdAt_idx" ON "WebhookDelivery"("createdAt");
+
+-- AddForeignKey
+ALTER TABLE "WebhookDelivery" ADD CONSTRAINT "WebhookDelivery_endpointId_fkey" FOREIGN KEY ("endpointId") REFERENCES "WebhookEndpoint"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
@@ -0,0 +1,3 @@
+-- AlterEnum
+ALTER TYPE "AdminAuditAction" ADD VALUE 'registrations_bulk';
+
@@ -0,0 +1,23 @@
+-- CreateTable
+CREATE TABLE "SavedFilter" (
+    "id" TEXT NOT NULL,
+    "userId" TEXT NOT NULL,
+    "page" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "params" JSONB NOT NULL,
+    "isDefault" BOOLEAN NOT NULL DEFAULT false,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "SavedFilter_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "SavedFilter_userId_page_idx" ON "SavedFilter"("userId", "page");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "SavedFilter_userId_page_name_key" ON "SavedFilter"("userId", "page", "name");
+
+-- AddForeignKey
+ALTER TABLE "SavedFilter" ADD CONSTRAINT "SavedFilter_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
@@ -162,6 +162,9 @@ model User {
  volunteerSlots      VolunteerSlot[] @relation("VolunteerSlotUser")
  volunteersAssigned  VolunteerSlot[] @relation("VolunteerSlotAssignedBy")
  volunteersCheckedIn VolunteerSlot[] @relation("VolunteerSlotCheckedInBy")
+  seriesFollows       SeriesFollow[]
+  seasonPassPurchases SeasonPassPurchase[]
+  savedFilters        SavedFilter[]
  swapsAsked          VolunteerSwap[] @relation("VolunteerSwapFrom")
  swapsTaken          VolunteerSwap[] @relation("VolunteerSwapTo")

@@ -319,10 +322,109 @@ model Event {
  volunteerOptionId      String?
  volunteerCheckInToken  String?          @unique

+  // Event series (1.47.1): separate events grouped on one series page (Camp 2025, Camp 2026).
+  // seriesAnnouncedAt: when followers were emailed that this event is out (once, when it goes live).
+  seriesId               String?
+  series                 EventSeries?     @relation(fields: [seriesId], references: [id], onDelete: SetNull)
+  seasonPassItems        SeasonPassItem[]
+  seriesAnnouncedAt      DateTime?
+
  @@index([createdById])
  @@index([closedById])
  @@index([reopenedById])
  @@index([campusId])
+  @@index([seriesId])
+}
+
+/// Separate events grouped together, e.g. every year's camp or the monthly men's breakfast.
+/// Not tied to a campus: a series can have events at several campuses.
+model EventSeries {
+  id          String         @id @default(uuid())
+  name        String
+  slug        String         @unique
+  description String?
+  picture     String?
+  createdAt   DateTime       @default(now())
+  updatedAt   DateTime       @updatedAt
+  events      Event[]
+  followers   SeriesFollow[]
+  passes      SeasonPass[]
+}
+
+/// Someone who wants to hear when a new event in the series is out (sent as news).
+model SeriesFollow {
+  id        String      @id @default(uuid())
+  seriesId  String
+  userId    String
+  createdAt DateTime    @default(now())
+  series    EventSeries @relation(fields: [seriesId], references: [id], onDelete: Cascade)
+  user      User        @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@unique([seriesId, userId])
+  @@index([userId])
+}
+
+/// A season pass (1.47.3): one price for a ticket at each of several events in a series. Buying
+/// it registers the buyer for every event on it in one checkout; the price is split across the
+/// events in proportion to their normal ticket prices (for each event's cashup).
+model SeasonPass {
+  id          String               @id @default(uuid())
+  seriesId    String
+  name        String
+  description String?
+  price       Float
+  isActive    Boolean              @default(true)
+  // Stops selling then (it always stops when the first event on it starts).
+  saleEndsAt  DateTime?
+  createdAt   DateTime             @default(now())
+  updatedAt   DateTime             @updatedAt
+  series      EventSeries          @relation(fields: [seriesId], references: [id], onDelete: Cascade)
+  items       SeasonPassItem[]
+  purchases   SeasonPassPurchase[]
+
+  @@index([seriesId])
+}
+
+/// One event on a pass: which ticket (and variant) the pass gives there.
+model SeasonPassItem {
+  id            String         @id @default(uuid())
+  passId        String
+  eventId       String
+  eventOptionId String
+  variantId     String?
+  order         Int            @default(0)
+  pass          SeasonPass     @relation(fields: [passId], references: [id], onDelete: Cascade)
+  event         Event          @relation(fields: [eventId], references: [id], onDelete: Cascade)
+  eventOption   EventOption    @relation(fields: [eventOptionId], references: [id], onDelete: Cascade)
+  variant       OptionVariant? @relation(fields: [variantId], references: [id], onDelete: Cascade)
+
+  @@unique([passId, eventId])
+  @@index([eventId])
+  @@index([eventOptionId])
+  @@index([variantId])
+}
+
+/// Someone's purchase of a pass: `quantity` passes, one registration per event.
+model SeasonPassPurchase {
+  id            String         @id @default(uuid())
+  passId        String
+  userId        String
+  quantity      Int
+  total         Float
+  // pending | paid | cancelled
+  status        String         @default("pending")
+  // The online checkout started for it (our ProviderCheckout id).
+  checkoutId    String?
+  createdAt     DateTime       @default(now())
+  updatedAt     DateTime       @updatedAt
+  pass          SeasonPass     @relation(fields: [passId], references: [id], onDelete: Restrict)
+  user          User           @relation(fields: [userId], references: [id], onDelete: Restrict)
+  registrations Registration[]
+  payments      Payment[]
+
+  @@index([passId])
+  @@index([userId])
+  @@index([checkoutId])
 }

 model EventOption {
@@ -346,6 +448,7 @@ model EventOption {
  couponScopes        CouponOption[]
  waitlistEntries     WaitlistEntry[]
  bundleItems         EventBundleItem[]
+  seasonPassItems     SeasonPassItem[]

  @@index([eventId])
 }
@@ -382,6 +485,7 @@ model OptionVariant {
  couponScopes        CouponOption[]
  waitlistEntries     WaitlistEntry[]
  bundleItems         EventBundleItem[]
+  seasonPassItems     SeasonPassItem[]

  @@index([eventOptionId])
 }
@@ -412,6 +516,10 @@ model Registration {
  formDrafts          FormDraft[]
  couponRedemptions   CouponRedemption[]
  bundleApplications  RegistrationBundle[]
+  // Season pass (1.47.3): one registration per event on the pass, its line priced at that
+  // event's share of the pass price (never repriced, no coupons, options not editable).
+  seasonPassPurchaseId String?
+  seasonPassPurchase   SeasonPassPurchase? @relation(fields: [seasonPassPurchaseId], references: [id], onDelete: SetNull)
  attendees           Attendee[]
  waitlistEntries     WaitlistEntry[]
  volunteerSlots      VolunteerSlot[]
@@ -502,6 +610,10 @@ model Payment {
  originalPayment   Payment?          @relation("SplitPayments", fields: [originalPaymentId], references: [id], onDelete: SetNull)
  splitPayments     Payment[]         @relation("SplitPayments")
  providerTransactions ProviderTransaction[]
+  // Season pass: one provider payment is recorded as one Payment per event on the pass (its
+  // share), all linked to the purchase. Only the first carries the provider's externalId.
+  seasonPassPurchaseId String?
+  seasonPassPurchase   SeasonPassPurchase? @relation(fields: [seasonPassPurchaseId], references: [id], onDelete: SetNull)

  @@index([userId])
  @@index([recordedById])
@@ -702,6 +814,12 @@ enum AdminAuditAction {
  volunteer_assigned
  volunteer_removed
  volunteer_checked_in_manual
+  series_created
+  series_updated
+  series_deleted
+  season_pass_changed
+  webhook_endpoint_changed
+  registrations_bulk
 }

 // Append-only audit trail for admin/supervisor-initiated actions with money or
@@ -2134,3 +2252,66 @@ model VolunteerSwap {
  @@index([roleId, status])
  @@index([slotId])
 }
+
+/// Outbound webhooks (1.48.0): a URL that is sent what happens here (registrations, payments,
+/// check-ins, new accounts, published events), signed with its own secret.
+model WebhookEndpoint {
+  id          String            @id @default(uuid())
+  name        String
+  url         String
+  // HMAC secret, encrypted (utils/encryption.js); shown to the admin once, when made or rotated.
+  secret      String
+  // Event types it gets, e.g. ["registration.paid", "ticket.checked_in"].
+  events      String[]
+  isActive    Boolean           @default(true)
+  // The operator register entry made for it (POPIA), if any.
+  operatorId  String?
+  lastSuccessAt DateTime?
+  lastFailureAt DateTime?
+  createdAt   DateTime          @default(now())
+  updatedAt   DateTime          @updatedAt
+  deliveries  WebhookDelivery[]
+}
+
+/// One message to one endpoint, with its retries. Kept 30 days.
+model WebhookDelivery {
+  id             String          @id @default(uuid())
+  endpointId     String
+  // The event's own id (the same for every endpoint it went to) and type.
+  eventId        String
+  type           String
+  payload        Json
+  // pending | sending | retrying | succeeded | failed
+  status         String          @default("pending")
+  attempts       Int             @default(0)
+  nextAttemptAt  DateTime        @default(now())
+  lastStatusCode Int?
+  lastError      String?
+  deliveredAt    DateTime?
+  // Whose personal information is in it, so it can be removed with their account.
+  userId         String?
+  createdAt      DateTime        @default(now())
+  endpoint       WebhookEndpoint @relation(fields: [endpointId], references: [id], onDelete: Cascade)
+
+  @@index([status, nextAttemptAt])
+  @@index([endpointId, createdAt])
+  @@index([userId])
+  @@index([createdAt])
+}
+
+/// A person's saved filters on a list page (1.49.2): `page` is the list (registrations, users,
+/// events, reports), `params` the filter values. At most one default per person and page.
+model SavedFilter {
+  id        String   @id @default(uuid())
+  userId    String
+  page      String
+  name      String
+  params    Json
+  isDefault Boolean  @default(false)
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+  user      User     @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@unique([userId, page, name])
+  @@index([userId, page])
+}
@@ -2,9 +2,19 @@
 * set-demo.js
 *
 * Replaces the database contents with demo data for showing the system to other
- * churches: six upcoming events with registrations, payments, tickets, attendee forms,
- * coupons, a waitlist, camp cabins, sponsorships, costs and funnel analytics, plus ten
- * completed events from the past year with door sales, check-ins, feedback and cashups.
+ * churches. Four profiles, for different kinds of church (see PROFILES below, or
+ * `npm run demo:list`):
+ *
+ *   small        One congregation, the essentials: a few events, payments, check-ins, cashups.
+ *   events       Events and conferences (the original demo, the default): six upcoming events
+ *                with coupons, a waitlist, camp cabins, sponsorships, bundles, costs and funnel
+ *                analytics, and ten completed events with door sales, feedback and cashups.
+ *   ministry     One campus with weekly ministry: a multi-session course (attendance and
+ *                certificates), a "pick your days" conference, kids church with kids check-in,
+ *                volunteer rosters, and a Men's Breakfast series with followers and a season pass.
+ *   multicampus  Three campuses: events per campus and church-wide, home campuses,
+ *                campus-limited staff, a series across campuses, kids check-in and rosters at two
+ *                campuses.
 *
 * Everything is removed first EXCEPT the site settings (AppSetting) and the admin
 * account (DEMO_ADMIN_EMAIL, default joshua@crosscode.co.za). Dates are relative to
@@ -13,10 +23,14 @@
 * No emails or WhatsApp messages are sent. Demo people use @example.com addresses and
 * have no phone numbers, so later reminders can't reach a real person.
 *
- * Usage:
- *   cd backend
- *   npm run set-demo            (asks for confirmation)
- *   npm run set-demo -- --yes   (no prompt)
+ * Campuses are switched on (site setting) for "multicampus" and off for the others; restart the
+ * backend afterwards so it picks the setting up.
+ *
+ * Usage (from the repo root):
+ *   npm run demo:small | demo:events | demo:ministry | demo:multicampus   (asks for confirmation)
+ *   npm run demo:list                                                     (what each one has)
+ * or in backend/:
+ *   npm run set-demo -- --profile=ministry --yes                          (no prompt)
 */

 'use strict';
@@ -38,6 +52,8 @@ const prisma = createPrismaClient();
 const ADMIN_EMAIL = (process.env.DEMO_ADMIN_EMAIL || 'joshua@crosscode.co.za').trim().toLowerCase();
 const DEMO_PASSWORD = 'Demo@1234';
 const SKIP_PROMPT = process.argv.includes('--yes') || process.argv.includes('-y');
+const PROFILE_NAME = (process.argv.find(a => a.startsWith('--profile=')) || '--profile=events').split('=')[1].trim().toLowerCase();
+const LIST_ONLY = process.argv.includes('--list');

 // Not truncated: migrations, site settings, users (all but the admin are deleted
 // separately) and the admin's own account-security rows.
@@ -161,13 +177,16 @@ const add = (model, row) => {
 };

 const INSERT_ORDER = [
-  'user', 'event', 'eventOption', 'optionVariant', 'earlyBirdTier', 'section', 'sectionOption',
+  'campus', 'user', 'eventSeries', 'event', 'eventSession', 'eventOption', 'optionVariant', 'earlyBirdTier', 'section', 'sectionOption',
  'eventForm', 'eventFormField', 'coupon', 'couponEvent', 'eventBundle', 'eventBundleItem',
+  'seasonPass', 'seasonPassItem', 'seasonPassPurchase',
  'registration', 'registrationOption', 'registrationOptionTranche', 'attendee', 'payment', 'ticket',
  'ticketUsage', 'couponRedemption', 'registrationBundle',
  'formResponse', 'formAnswer', 'consentRequest', 'waitlistEntry', 'allocationSet',
  'allocationGroup', 'allocationAssignment', 'eventCost', 'feedbackForm', 'feedbackField',
  'feedbackInvite', 'feedbackResponse', 'feedbackAnswer', 'analyticsEvent', 'analyticsDaily',
+  'certificate', 'seriesFollow', 'family', 'familyMember', 'child', 'authorisedAdult',
+  'kidsPickupCode', 'kidsCheckIn', 'kidsRoomDuty', 'servingRole', 'volunteerSlot', 'volunteerSwap',
 ];

 // Extra facts about demo people that aren't columns (kept out of the inserted rows).
@@ -314,6 +333,8 @@ function addRegistration(event, user, lines, { createdAt, pay = 'full', method =
      quantity: l.quantity,
      priceSnapshot: price,
      appliedTierId: tier ? tier.id : null,
+      // "Pick sessions" events: a per-session line.
+      sessionId: l.sessionId || null,
    });
    add('registrationOptionTranche', {
      id: uuidv4(),
@@ -823,8 +844,11 @@ const IMPROVEMENTS = [
 * donations { card, cash, amounts }, showRate, feedback (what people enjoyed), cashup.
 */
 function buildPastEvent(people, spec) {
+  // Each profile has its own selection of past events (`always`: built by a profile's extras).
+  if (!spec.always && profile.past && !profile.past.includes(spec.title)) return null;
  const { start } = spec;
  const event = addEvent({
+    ...(spec.seriesId ? { seriesId: spec.seriesId, seriesAnnouncedAt: start } : {}),
    title: spec.title,
    description: spec.description,
    startDate: start,
@@ -1189,6 +1213,524 @@ async function closePastEvents() {
  return results;
 }

+// ─── Profiles ────────────────────────────────────────────────────────────────
+
+const UPCOMING = {
+  mensBreakfast: buildMensBreakfast,
+  familyFunDay: buildFamilyFunDay,
+  womensConference: buildWomensConference,
+  youthCamp: buildYouthCamp,
+  carols: buildCarols,
+  marriageWeekend: buildMarriageWeekend,
+};
+
+/**
+ * upcoming: which of the six upcoming events (UPCOMING); past: titles of past events to build
+ * (null = all ten); extras: the newer features (series, courses, conference, kids, volunteers);
+ * campuses: three campuses, switched on.
+ */
+const PROFILES = {
+  small: {
+    title: 'Small church — one congregation, the essentials',
+    about: [
+      'Three upcoming events: a breakfast (sold out, with a waitlist), a family fun day and free carols.',
+      'Four past events with check-ins and cashups (one left open to cash up live).',
+      'No campuses, kids check-in, volunteer rosters, courses or series.',
+    ],
+    campuses: false,
+    upcoming: ['mensBreakfast', 'familyFunDay', 'carols'],
+    past: ['Church Family Picnic', 'Christmas Eve Candlelight Service', 'Easter Sunrise Service & Breakfast', 'Worship Night'],
+    extras: [],
+  },
+  events: {
+    title: 'Events & conferences — the full events demo (default)',
+    about: [
+      'Six upcoming events: breakfast with a waitlist, family day, women\'s conference (variants, early birds, coupons),',
+      'youth camp (parental consent, cabins, medical forms), free carols with donations, marriage weekend (bundles).',
+      'Ten past events with door sales, refunds, feedback and every kind of cashup; funnel analytics.',
+      'One campus; no kids check-in, rosters, courses or series.',
+    ],
+    campuses: false,
+    upcoming: Object.keys(UPCOMING),
+    past: null,
+    extras: [],
+  },
+  ministry: {
+    title: 'Weekly ministry — one campus, courses, kids church and volunteers',
+    about: [
+      'Alpha Course running now (7 weekly sessions, attendance per session, late joining, certificates) and a finished',
+      'Marriage Course with certificates issued; a 3-day leadership conference sold by day ("pick sessions").',
+      'Kids Church every Sunday with kids check-in: families, children (some allergies), rooms with ratios, past check-ins.',
+      'Volunteer rosters for kids church and the family day (sign-ups, QR check-ins, an open cover request).',
+      'A Men\'s Breakfast series (two past, three coming) with followers and a season pass; family day, women\'s conference, carols.',
+    ],
+    campuses: false,
+    upcoming: ['familyFunDay', 'womensConference', 'carols'],
+    past: ['Church Family Picnic', 'Christmas Eve Candlelight Service', 'Kids Holiday Club', 'Youth Winter Camp', 'Worship Night'],
+    extras: ['series', 'courses', 'conference', 'kids', 'volunteers'],
+  },
+  multicampus: {
+    title: 'Multi-campus church — three campuses',
+    about: [
+      'Campuses Central, North and South (switched on), events per campus and church-wide, home campuses for most people.',
+      'Staff limited to a campus: Anri Botha (North) and Daniel Pillay (South).',
+      'The Men\'s Breakfast series moves between the campuses, with followers and a season pass.',
+      'Kids church with kids check-in and volunteer rosters at Central and North.',
+      'All six upcoming and ten past events of the events demo, spread over the campuses.',
+    ],
+    campuses: true,
+    upcoming: ['familyFunDay', 'womensConference', 'youthCamp', 'carols', 'marriageWeekend'],
+    past: null,
+    extras: ['series', 'kids', 'volunteers'],
+  },
+};
+
+let profile = PROFILES[PROFILE_NAME];
+
+const hex = (bytes = 16) => crypto.randomBytes(bytes).toString('hex');
+let campuses = [];
+
+// ─── Campuses (multicampus) ──────────────────────────────────────────────────
+
+function buildCampuses() {
+  const campus = (name, slug, address, colour, defaultLocation, order) => add('campus', {
+    id: uuidv4(), name, slug, address, contactName: 'Lerato Khumalo', contactEmail: `${slug}@example.com`,
+    colour, defaultLocation, order, createdAt: addTime(NOW, -300 * DAY), updatedAt: NOW,
+  });
+  campuses = [
+    campus('Central', 'central', '12 Church Street, Hatfield, Pretoria', '#2563eb', 'Main auditorium', 0),
+    campus('North', 'north', '45 Zambezi Drive, Montana', '#16a34a', 'North campus hall', 1),
+    campus('South', 'south', '8 Lenchen Avenue, Centurion', '#ea580c', 'South campus hall', 2),
+  ];
+  for (const u of rows.user) if (u.role === 'user' && chance(0.85)) u.homeCampusId = pick(campuses).id;
+}
+
+/** Spreads the events over the campuses; the big ones stay church-wide. */
+function assignCampuses() {
+  const byTitle = {
+    'Family Fun Day': 1, 'Carols by Candlelight': 2, 'Youth Winter Camp': null, 'Christmas Eve Candlelight Service': 0,
+    'Rooted Women’s Conference': null, 'Ignite Summer Camp': null, 'Marriage Enrichment Weekend': null,
+  };
+  let i = 0;
+  for (const event of rows.event) {
+    if (event.campusId !== undefined && event.campusId !== null) continue; // set by its builder
+    if (event.seriesId || event.kidsCheckIn) continue;
+    const idx = event.title in byTitle ? byTitle[event.title] : (i++ % campuses.length);
+    event.campusId = idx === null ? null : campuses[idx].id;
+    if (idx !== null && event.location === 'Church hall') event.location = campuses[idx].defaultLocation;
+  }
+}
+
+/** Staff limited to one campus (a many-to-many, so it's set after the rows are in). */
+async function scopeStaff(tx) {
+  const byName = (first) => staffTeam.find(s => s.name.startsWith(first));
+  for (const [first, campusIdx] of [['Anri', 1], ['Daniel', 2]]) {
+    await tx.user.update({ where: { id: byName(first).id }, data: { scopedCampuses: { connect: [{ id: campuses[campusIdx].id }] } } });
+  }
+}
+
+// ─── Event series and a season pass ──────────────────────────────────────────
+
+function buildBreakfast(people, { start, title, sold }) {
+  const event = addEvent({
+    title,
+    description: 'A full breakfast, a guest speaker and an honest conversation about faith, work and family. Bring a friend.',
+    startDate: start,
+    endDate: addTime(start, 2.5 * HOUR),
+    registrationDeadline: addTime(start, -2 * DAY),
+    price: 150,
+    picture: IMG('photo-1414235077428-338989a2e8c0'),
+    location: 'Church hall',
+    contactName: 'Sipho Dlamini',
+  });
+  const ticket = addOption(event, { name: 'Breakfast ticket', price: 150, stockLimit: 60 });
+  addCost(event, 'Breakfast catering', 'per_item', 85, ticket);
+  for (const user of shuffle(people.men).slice(0, sold)) {
+    addRegistration(event, user, [line(ticket, 1)], { createdAt: pastDate(20, 1), ...payPlan({ card: 0.7, eft: 0.1, none: 0.2 }) });
+  }
+  return { event, ticket };
+}
+
+/**
+ * The Men's Breakfast as a series: two past breakfasts (cashed up), this month's (sold out) and two
+ * more, 18 followers, and a season pass for the next two with six bought. On the multi-campus demo
+ * each breakfast is at a different campus.
+ */
+function buildSeries(people) {
+  const series = add('eventSeries', {
+    id: uuidv4(), name: "Men's Breakfast", slug: 'mens-breakfast',
+    description: 'Once a month on a Saturday morning: a full breakfast, a guest speaker and an honest conversation about faith, work and family. Follow the series to hear when the next one is out.',
+    picture: IMG('photo-1414235077428-338989a2e8c0'), createdAt: addTime(NOW, -200 * DAY), updatedAt: NOW,
+  });
+  const campusAt = (i) => (profile.campuses ? campuses[i % campuses.length] : null);
+  const pastSpec = (title, daysAgo, speaker) => ({
+    always: true, seriesId: series.id, title, description: `Breakfast with ${speaker}.`,
+    start: lastWeekday(daysAgo, 6, 7, 30), hours: 2.5, picture: 'photo-1414235077428-338989a2e8c0', location: 'Church hall', pool: 'men',
+    options: [{ name: 'Breakfast ticket', price: 150 }],
+    costs: o => [['Breakfast catering', 'per_item', 85, o[0]]],
+    online: int(34, 42), onlinePay: { card: 80, eft: 15, none: 5 }, door: int(3, 8), doorPay: { cash: 70, card: 30 },
+    lines: o => [line(o[0], chance(0.2) ? 2 : 1)],
+    showRate: 0.9,
+    cashup: { close: 'quick', daysAfter: 3, notes: 'Quick closed — card and cash banked.' },
+  });
+  const past = [
+    buildPastEvent(people, pastSpec("Men's Breakfast: Fathers & Sons", 63, 'Pastor Ernest Molefe')),
+    buildPastEvent(people, pastSpec("Men's Breakfast: Faith at Work", 35, 'Thabo Nkosi')),
+  ];
+  const current = buildMensBreakfast(people);
+  const next = buildBreakfast(people, { start: nextWeekday(36, 6, 7, 30), title: "Men's Breakfast: Leading at Home", sold: 22 });
+  const later = buildBreakfast(people, { start: nextWeekday(64, 6, 7, 30), title: "Men's Breakfast: Money & Generosity", sold: 9 });
+  [...past, current, next.event, later.event].forEach((event, i) => {
+    event.seriesId = series.id;
+    // Followers were told when each came out (so the series job doesn't email demo people).
+    event.seriesAnnouncedAt = event.goLiveAt < NOW ? event.goLiveAt : NOW;
+    const campus = campusAt(i);
+    if (campus) { event.campusId = campus.id; event.location = campus.defaultLocation; }
+  });
+  for (const user of shuffle(people.men).slice(0, 18)) add('seriesFollow', { id: uuidv4(), seriesId: series.id, userId: user.id, createdAt: pastDate(150, 3) });
+
+  // Season pass: the next two breakfasts for R260 (R300 separately), R130 per event.
+  const pass = add('seasonPass', {
+    id: uuidv4(), seriesId: series.id, name: 'Next two breakfasts', description: 'Both of the next breakfasts for one price.',
+    price: 260, isActive: true, saleEndsAt: null, createdAt: addTime(NOW, -20 * DAY), updatedAt: NOW,
+  });
+  [next, later].forEach((b, order) => add('seasonPassItem', { id: uuidv4(), passId: pass.id, eventId: b.event.id, eventOptionId: b.ticket.id, variantId: null, order }));
+  for (const user of shuffle(people.men).slice(0, 6)) {
+    const at = pastDate(15, 1);
+    const purchase = add('seasonPassPurchase', { id: uuidv4(), passId: pass.id, userId: user.id, quantity: 1, total: 260, status: 'paid', checkoutId: null, createdAt: at, updatedAt: at });
+    [next, later].forEach((b, i) => {
+      const reg = add('registration', { id: uuidv4(), userId: user.id, eventId: b.event.id, status: 'paid', discountTotal: 0, bundleDiscount: 0, ticketDelivery: 'payer', analyticsSessionId: null, seasonPassPurchaseId: purchase.id, createdAt: at });
+      const ro = add('registrationOption', { id: uuidv4(), registrationId: reg.id, eventOptionId: b.ticket.id, variantId: null, quantity: 1, priceSnapshot: 130, appliedTierId: null, sessionId: null });
+      add('registrationOptionTranche', { id: uuidv4(), registrationOptionId: ro.id, quantity: 1, priceSnapshot: 130, appliedTierId: null, createdAt: at });
+      add('payment', {
+        id: uuidv4(), amount: 130, method: 'card', userId: user.id, recordedById: null, registrationId: reg.id, eventId: b.event.id,
+        status: 'completed', externalId: i === 0 ? `demo_${uuidv4().replace(/-/g, '')}` : null, seasonPassPurchaseId: purchase.id, createdAt: after(at, 2, 10),
+      });
+      add('ticket', { id: uuidv4(), qrCode: uuidv4(), registrationOptionId: ro.id, userId: user.id, eventId: b.event.id, quantity: 1, emailSent: true, createdAt: at });
+    });
+  }
+  return [current, next.event, later.event];
+}
+
+// ─── Courses and a pick-your-days conference (ministry) ──────────────────────
+
+function addSessions(event, first, count, { everyDays = 7, minutes = 120, labels = [], capacity = null } = {}) {
+  return Array.from({ length: count }, (_, k) => {
+    const startsAt = addTime(first, k * everyDays * DAY);
+    return add('eventSession', {
+      id: uuidv4(), eventId: event.id, label: labels[k] || null, startsAt, endsAt: addTime(startsAt, minutes * MINUTE),
+      order: k, capacity, location: null, createdAt: event.createdAt, updatedAt: NOW,
+    });
+  });
+}
+
+/** Check-ins per session that has ended, for the event's tickets. */
+function attendSessions(event, sessions, showRate) {
+  const attended = new Map();
+  for (const s of sessions.filter(x => x.endsAt < NOW)) {
+    for (const t of rows.ticket.filter(x => x.eventId === event.id)) {
+      if (!chance(showRate)) continue;
+      add('ticketUsage', { id: uuidv4(), ticketId: t.id, scannedById: pick(staffTeam).id, quantityRedeemed: t.quantity, sessionId: s.id, scannedAt: within(addTime(s.startsAt, -20 * MINUTE), addTime(s.startsAt, 15 * MINUTE)) });
+      attended.set(t.id, (attended.get(t.id) || 0) + 1);
+    }
+  }
+  return attended;
+}
+
+const CERTIFICATE = (min) => ({
+  template: 'classic', title: 'Certificate of Completion', signatureImage: '', sendOnIssue: false,
+  body: 'This certifies that {name} has completed {event}, attending {sessionsAttended} of {totalSessions} sessions.',
+  signatureName: 'Pastor Ernest Molefe', signatureRole: 'Senior Pastor', rule: { type: 'count', value: min },
+});
+
+function buildCourses(people) {
+  // Alpha: seven Wednesdays, three already held; late joining until week 4 at a pro-rata price.
+  const first = lastWeekday(15, 3, 18, 30);
+  const alpha = addEvent({
+    title: 'Alpha Course',
+    description: 'Seven Wednesday evenings exploring the big questions of life and faith — each with dinner, a short talk and honest conversation in small groups. Everyone is welcome; no question is off limits.',
+    startDate: first, endDate: addTime(first, (6 * 7) * DAY + 2 * HOUR), price: 250,
+    picture: IMG('photo-1529070538774-1843cb3265df'), location: 'Church hall',
+    scheduleType: 'sessions', attendanceMode: 'whole', lateJoinEnabled: true, latePricing: 'prorata', checkInWindow: 'whole_day',
+    certificatesEnabled: true, certificateConfig: CERTIFICATE(5),
+    goLiveAt: addTime(first, -35 * DAY), createdAt: addTime(first, -40 * DAY),
+  });
+  const alphaSessions = addSessions(alpha, first, 7, { labels: ['Is there more to life than this?', 'Who is Jesus?', 'Why did Jesus die?', 'How can I have faith?', 'Why and how do I pray?', 'How can I resist evil?', 'What about the church?'] });
+  alpha.lateJoinUntilSessionId = alphaSessions[3].id;
+  const alphaTicket = addOption(alpha, { name: 'Course (dinner included)', price: 250, stockLimit: 40 });
+  for (const user of shuffle(people.everyone).slice(0, 30)) {
+    addRegistration(alpha, user, [line(alphaTicket, 1)], { createdAt: daytimeBetween(addTime(first, -30 * DAY), addTime(first, -DAY)), ...payPlan({ card: 0.7, eft: 0.2, none: 0.1 }) });
+  }
+  attendSessions(alpha, alphaSessions, 0.85);
+
+  // Marriage Course: finished six weeks ago; certificates issued to couples who came to 5 of 6.
+  const mFirst = lastWeekday(80, 4, 19);
+  const marriage = addEvent({
+    title: 'The Marriage Course',
+    description: 'Six Thursday evenings for couples: a candle-lit dinner for two, a short talk and time to talk together — no group sharing.',
+    startDate: mFirst, endDate: addTime(mFirst, 35 * DAY + 2 * HOUR), price: 500,
+    picture: IMG('photo-1529634806980-85c3dd6d34ac'), location: 'Church hall',
+    scheduleType: 'sessions', attendanceMode: 'whole', checkInWindow: 'whole_day',
+    certificatesEnabled: true, certificateConfig: CERTIFICATE(5),
+    goLiveAt: addTime(mFirst, -40 * DAY), createdAt: addTime(mFirst, -45 * DAY),
+  });
+  const mSessions = addSessions(marriage, mFirst, 6, { labels: ['Building strong foundations', 'The art of communication', 'Resolving conflict', 'The power of forgiveness', 'Parents and in-laws', 'Love in action'] });
+  const couple = addOption(marriage, { name: 'Couple', price: 500, stockLimit: 16 });
+  for (const user of shuffle(people.everyone).slice(0, 14)) {
+    addRegistration(marriage, user, [line(couple, 1)], { createdAt: daytimeBetween(addTime(mFirst, -35 * DAY), addTime(mFirst, -2 * DAY)), payBy: mFirst, ...payPlan({ card: 0.75, eft: 0.25 }) });
+  }
+  const attended = attendSessions(marriage, mSessions, 0.88);
+  const issuedAt = addTime(mSessions[5].endsAt, DAY);
+  for (const t of rows.ticket.filter(x => x.eventId === marriage.id)) {
+    const n = attended.get(t.id) || 0;
+    if (n < 5) continue;
+    const owner = rows.user.find(u => u.id === t.userId);
+    add('certificate', { id: uuidv4(), eventId: marriage.id, ticketId: t.id, userId: owner.id, name: owner.name, code: hex(4).toUpperCase(), sessionsAttended: n, totalSessions: 6, manual: false, issuedAt, emailedAt: issuedAt });
+  }
+  return [alpha];
+}
+
+function buildLeadershipConference(people) {
+  const day1 = nextWeekday(40, 4, 8, 30);
+  const event = addEvent({
+    title: 'Lead Well Leadership Conference',
+    description: 'Three days for everyone who leads — small groups, ministries, teams at work. Come to all three, or pick the days you can make.',
+    startDate: day1, endDate: addTime(day1, 2 * DAY + 8 * HOUR), price: 650,
+    picture: IMG('photo-1540575467063-178a50c2df87'), location: 'Main auditorium',
+    scheduleType: 'sessions', attendanceMode: 'pick', checkInWindow: 'whole_day',
+  });
+  const days = addSessions(event, day1, 3, { everyDays: 1, minutes: 8 * 60, labels: ['Day 1 — Vision', 'Day 2 — Teams', 'Day 3 — Practice'], capacity: 150 });
+  const full = addOption(event, { name: 'Full conference pass', price: 650, sessionMode: 'all' });
+  addTier(full, { deadline: addTime(day1, -14 * DAY), price: 550, stockLimit: 40 });
+  const dayPass = addOption(event, { name: 'Day pass', price: 280, sessionMode: 'pick' });
+  const buyers = shuffle(people.everyone);
+  for (const user of buyers.splice(0, 34)) {
+    addRegistration(event, user, [line(full, chance(0.2) ? 2 : 1)], { createdAt: pastDate(30, 1), ...payPlan({ card: 0.8, eft: 0.12, none: 0.08 }) });
+  }
+  for (const user of buyers.splice(0, 26)) {
+    const picked = shuffle(days).slice(0, chance(0.4) ? 2 : 1);
+    addRegistration(event, user, picked.map(s => line(dayPass, 1, { sessionId: s.id })), { createdAt: pastDate(25, 1), ...payPlan({ card: 0.8, none: 0.2 }) });
+  }
+  return [event];
+}
+
+// ─── Kids church with kids check-in ──────────────────────────────────────────
+
+const ROOMS = [['Nursery', 0, 2, 3, 12], ['Little Ones', 3, 5, 6, 24], ['Explorers', 6, 9, 8, 30], ['Pre-teens', 10, 12, 10, 24]];
+const inFamily = new Set();
+const kidsChurches = [];
+
+function ageAt(dob, at) {
+  let age = at.getFullYear() - dob.getFullYear();
+  if (at.getMonth() < dob.getMonth() || (at.getMonth() === dob.getMonth() && at.getDate() < dob.getDate())) age--;
+  return Math.max(0, age);
+}
+
+/** A pickup code that's free on this occasion (4 characters, no look-alikes). */
+function kidsCode(taken) {
+  const { CODE_ALPHABET, CODE_LENGTH } = require('../src/utils/kids');
+  for (;;) {
+    let c = '';
+    for (let i = 0; i < CODE_LENGTH; i++) c += CODE_ALPHABET[int(0, CODE_ALPHABET.length - 1)];
+    if (!taken.has(c)) { taken.add(c); return c; }
+  }
+}
+
+/**
+ * Sunday kids church: a hidden event with a session every Sunday (four held, eight to come), the
+ * kids ticket and rooms, 16 families with their children and authorised adults, and check-ins
+ * and check-outs (with pickup codes, tickets and room duty) for the Sundays already held.
+ */
+function buildKidsChurch(people, campus = null) {
+  const { encrypt } = require('../src/utils/encryption');
+  const first = lastWeekday(28, 0, 9, 0);
+  const event = addEvent({
+    title: campus ? `Kids Church — ${campus.name}` : 'Kids Church',
+    description: 'Sunday kids church during the 09:00 service, for babies to 12-year-olds. Check in at the kids desk: each family gets a pickup code, and only someone with the code can collect.',
+    startDate: first, endDate: addTime(first, 77 * DAY + 90 * MINUTE), price: 0, isHidden: true,
+    scheduleType: 'sessions', attendanceMode: 'whole', checkInWindow: 'whole_day', kidsCheckIn: true,
+    location: campus ? `${campus.name} kids wing` : 'Kids wing', campusId: campus ? campus.id : null,
+    goLiveAt: addTime(first, -30 * DAY), createdAt: addTime(first, -32 * DAY),
+  });
+  const sessions = addSessions(event, first, 12, { minutes: 90 });
+  // A session today, so the desk and room screens have children in right now whatever day the
+  // demo is shown (on a Sunday it's that Sunday's session).
+  let live = sessions.find(s => s.startsAt.toDateString() === NOW.toDateString() && s.endsAt > NOW);
+  if (!live) {
+    const startsAt = new Date(NOW); startsAt.setMinutes(0, 0, 0); startsAt.setHours(Math.max(8, startsAt.getHours() - 1));
+    live = add('eventSession', { id: uuidv4(), eventId: event.id, label: 'Midweek Kids Club', startsAt, endsAt: addTime(startsAt, 3 * HOUR), order: 0, capacity: null, location: null, createdAt: event.createdAt, updatedAt: NOW });
+    sessions.push(live);
+    sessions.sort((a, b) => a.startsAt - b.startsAt).forEach((s, order) => { s.order = order; });
+  }
+  const option = addOption(event, { name: 'Kids check-in', price: 0 });
+  event.kidsOptionId = option.id;
+  const set = add('allocationSet', { id: uuidv4(), eventId: event.id, name: 'Kids rooms', showOnTicket: false, order: 0 });
+  event.kidsRoomSetId = set.id;
+  const rooms = ROOMS.map(([name, minAge, maxAge, ratio, capacity], order) => add('allocationGroup', { id: uuidv4(), setId: set.id, name, minAge, maxAge, ratio, capacity, order, gender: null, leaderUserId: null }));
+  const roomFor = age => rooms.find(r => age >= r.minAge && age <= r.maxAge) || rooms[rooms.length - 1];
+
+  const parents = shuffle(people.everyone).filter(u => !inFamily.has(u.id)).slice(0, 16);
+  const families = parents.map(parent => {
+    inFamily.add(parent.id);
+    const { last } = userMeta.get(parent.id);
+    const createdAt = pastDate(200, 40);
+    const family = add('family', { id: uuidv4(), name: `The ${last} family`, qrToken: hex(), createdAt, updatedAt: NOW });
+    add('familyMember', { id: uuidv4(), familyId: family.id, userId: parent.id, createdAt });
+    if (chance(0.5)) {
+      add('authorisedAdult', { id: uuidv4(), familyId: family.id, name: `${pick(chance(0.5) ? FEMALE_FIRST : MALE_FIRST)} ${last}`, phone: null, relationship: pick(['Grandmother', 'Grandfather', 'Aunt', 'Uncle']), createdAt });
+    }
+    const children = Array.from({ length: int(1, 3) }, () => {
+      const girl = chance(0.5);
+      const dob = new Date(NOW);
+      dob.setFullYear(dob.getFullYear() - int(1, 12), int(0, 11), int(1, 28));
+      dob.setHours(0, 0, 0, 0);
+      return add('child', {
+        id: uuidv4(), familyId: family.id, firstName: pick(girl ? GIRL_FIRST : BOY_FIRST), lastName: last, dateOfBirth: dob, gender: girl ? 'female' : 'male',
+        allergies: chance(0.15) ? encrypt(pick(['Peanuts', 'Tree nuts', 'Dairy', 'Eggs', 'Bee stings'])) : null,
+        medicalNotes: chance(0.06) ? encrypt('Asthma — inhaler in the nappy bag') : null,
+        custodyNotes: chance(0.04) ? encrypt('Only the mother or grandmother may collect') : null,
+        lastCheckInAt: null, createdAt, updatedAt: NOW,
+      });
+    });
+    return { parent, family, children };
+  });
+
+  const held = sessions.filter(s => s.endsAt < NOW);
+  const codes = new Map([...held, live].map(s => [s.id, new Set()]));
+  let liveFamilies = 0;
+  for (const f of families) {
+    const attending = held.filter(() => chance(0.75));
+    // About half the families are in right now (checked in, not yet collected).
+    const inNow = live.startsAt <= NOW && liveFamilies < 8 && chance(0.6);
+    if (inNow) { attending.push(live); liveFamilies++; }
+    if (!attending.length) continue;
+    // The desk's first check-in gives the parent a free kids registration: a named place and ticket per child.
+    const { regLines } = addRegistration(event, f.parent, [line(option, f.children.length, {
+      attendees: f.children.map(c => ({ name: `${c.firstName} ${c.lastName}`, dateOfBirth: c.dateOfBirth, gender: c.gender, parentName: f.parent.name, parentEmail: f.parent.email })),
+    })], { createdAt: addTime(attending[0].startsAt, -25 * MINUTE) });
+    const attendees = regLines[0].attendees;
+    for (const s of attending) {
+      const code = add('kidsPickupCode', { id: uuidv4(), eventId: event.id, occasion: s.id, code: kidsCode(codes.get(s.id)), familyId: f.family.id, createdAt: addTime(s.startsAt, -int(10, 20) * MINUTE) });
+      const isLive = s === live;
+      f.children.forEach((c, i) => {
+        if (!chance(0.92)) return;
+        const at = isLive
+          ? within(addTime(NOW, -50 * MINUTE), addTime(NOW, -5 * MINUTE))
+          : within(addTime(s.startsAt, -20 * MINUTE), addTime(s.startsAt, 10 * MINUTE));
+        const ticket = rows.ticket.find(t => t.attendeeId === attendees[i].id);
+        const desk = pick(staffTeam);
+        add('kidsCheckIn', {
+          id: uuidv4(), eventId: event.id, occasion: s.id, sessionId: s.id, childId: c.id, childName: `${c.firstName} ${c.lastName}`,
+          roomId: roomFor(ageAt(c.dateOfBirth, s.startsAt)).id, pickupCodeId: code.id, attendeeId: attendees[i].id, ticketId: ticket.id,
+          checkedInAt: at, checkedInById: desk.id,
+          checkedOutAt: isLive ? null : within(addTime(s.endsAt, -5 * MINUTE), addTime(s.endsAt, 15 * MINUTE)),
+          checkedOutById: isLive ? null : pick(staffTeam).id,
+          collectedBy: isLive ? null : chance(0.85) ? f.parent.name : 'Authorised adult', offline: false,
+        });
+        add('ticketUsage', { id: uuidv4(), ticketId: ticket.id, scannedById: desk.id, scannedAt: at, sessionId: s.id, quantityRedeemed: 1 });
+        if (!c.lastCheckInAt || at > c.lastCheckInAt) c.lastCheckInAt = at;
+      });
+    }
+  }
+  for (const s of [...held, live]) {
+    const isLive = s === live;
+    if (isLive && live.startsAt > NOW) continue;
+    for (const room of rooms) {
+      for (const leader of shuffle(staffTeam).slice(0, int(1, 2))) {
+        add('kidsRoomDuty', {
+          id: uuidv4(), roomId: room.id, occasion: s.id, userId: leader.id, fromRoster: false,
+          startedAt: isLive ? addTime(NOW, -55 * MINUTE) : addTime(s.startsAt, -15 * MINUTE),
+          endedAt: isLive ? null : addTime(s.endsAt, 10 * MINUTE),
+        });
+      }
+    }
+  }
+  kidsChurches.push({ event, sessions, rooms });
+  return [event];
+}
+
+// ─── Volunteer rosters ───────────────────────────────────────────────────────
+
+/**
+ * Serving roles with people on them. `roles`: [name, needed, room?]. For a held session or event
+ * the places are filled and most checked in (QR); later ones are partly signed up. Reminders are
+ * marked as sent, so the reminder job doesn't email demo people.
+ */
+function addRoster(people, event, { session = null, roles, rooms = [] }) {
+  const start = session ? session.startsAt : event.startDate;
+  const held = (session ? session.endsAt : event.endDate) < NOW;
+  const daysAway = (start - NOW) / DAY;
+  const pool = shuffle(people.everyone);
+  const slots = [];
+  roles.forEach(([name, needed, roomName], order) => {
+    const role = add('servingRole', {
+      id: uuidv4(), eventId: event.id, sessionId: session ? session.id : null, name, description: null, needed,
+      startsAt: null, endsAt: null, kidsRoomId: roomName ? rooms.find(r => r.name === roomName)?.id || null : null,
+      order, createdAt: addTime(NOW, -25 * DAY), updatedAt: NOW,
+    });
+    const filled = held ? needed : daysAway < 10 ? int(Math.max(0, needed - 1), needed) : int(0, Math.max(0, needed - 1));
+    for (const user of pool.splice(0, filled)) {
+      const checked = held && chance(0.9);
+      // Most scan the QR code themselves; now and then a staff member ticks them in.
+      const method = checked ? (chance(0.85) ? 'qr' : 'manual') : null;
+      slots.push(add('volunteerSlot', {
+        id: uuidv4(), roleId: role.id, userId: user.id, assignedById: chance(0.3) ? staffTeam[0].id : null,
+        checkedInAt: checked ? within(addTime(start, -40 * MINUTE), addTime(start, -5 * MINUTE)) : null,
+        checkedInById: method === 'qr' ? user.id : method ? pick(staffTeam).id : null, checkInMethod: method,
+        remindedAt: held ? addTime(start, -DAY) : NOW, registrationId: null, createdAt: pastDate(20, 1),
+      }));
+    }
+  });
+  return slots;
+}
+
+function buildVolunteers(people, built) {
+  for (const { event, sessions, rooms } of kidsChurches) {
+    event.volunteerCheckInToken = hex();
+    const kidsRoles = [['Welcome desk', 3], ['Nursery leader', 2, 'Nursery'], ['Little Ones leader', 2, 'Little Ones'], ['Explorers leader', 2, 'Explorers'], ['Pre-teens leader', 1, 'Pre-teens']];
+    const lastHeld = sessions.filter(s => s.endsAt < NOW).pop();
+    const coming = sessions.filter(s => s.startsAt > NOW).slice(0, 2);
+    if (lastHeld) addRoster(people, event, { session: lastHeld, roles: kidsRoles, rooms });
+    coming.forEach((session, i) => {
+      const slots = addRoster(people, event, { session, roles: kidsRoles, rooms });
+      // Someone can't make the next Sunday and has asked for cover.
+      if (i === 0 && slots.length) {
+        const slot = slots[0];
+        add('volunteerSwap', { id: uuidv4(), slotId: slot.id, roleId: slot.roleId, fromUserId: slot.userId, toUserId: null, note: 'Away for a family wedding — can anyone take this?', status: 'open', createdAt: pastDate(2) });
+      }
+    });
+  }
+  const dayEvent = built.find(e => e.title === 'Family Fun Day');
+  if (dayEvent) {
+    dayEvent.volunteerCheckInToken = hex();
+    addRoster(people, dayEvent, { roles: [['Parking marshals', 4], ['Welcome & info table', 3], ['First aid', 1], ['Coffee bar', 3], ['Jumping castle supervisors', 2]] });
+  }
+}
+
+/** The extras of the chosen profile, in order; returns the upcoming events they add. */
+function buildExtras(people, built) {
+  const out = [];
+  const has = (x) => profile.extras.includes(x);
+  if (has('series')) out.push(...buildSeries(people));
+  if (has('courses')) out.push(...buildCourses(people));
+  if (has('conference')) out.push(...buildLeadershipConference(people));
+  if (has('kids')) {
+    if (profile.campuses) for (const c of campuses.slice(0, 2)) out.push(...buildKidsChurch(people, c));
+    else out.push(...buildKidsChurch(people));
+  }
+  if (has('volunteers')) buildVolunteers(people, built.concat(out));
+  return out;
+}
+
+function listProfiles() {
+  console.log('\nDemo profiles — npm run demo:<name> (from the repo root):\n');
+  for (const [name, p] of Object.entries(PROFILES)) {
+    console.log(`  ${name.padEnd(12)} ${p.title}`);
+    for (const line of p.about) console.log(`  ${''.padEnd(12)}   ${line}`);
+    console.log('');
+  }
+}
+
 // ─── Funnel analytics ────────────────────────────────────────────────────────

 const SOURCES = { direct: 30, whatsapp: 35, facebook: 18, instagram: 10, email: 7 };
@@ -1198,7 +1740,8 @@ function buildAnalytics() {
  const { sessionsFrom, rollupRows, RAW_DAYS } = require('../src/utils/analytics');
  const rawCutoff = addTime(NOW, -RAW_DAYS * DAY);

-  for (const event of rows.event) {
+  // Hidden events (kids church) aren't shown publicly, so nobody "visits" them.
+  for (const event of rows.event.filter(e => !e.isHidden)) {
    const raw = [];
    const session = (stages, at) => {
      const sessionId = uuidv4();
@@ -1242,10 +1785,25 @@ function buildAnalytics() {

 async function clearData(tx) {
  const tables = await tx.$queryRaw`SELECT tablename FROM pg_tables WHERE schemaname = current_schema()`;
-  const toClear = tables.map(t => t.tablename).filter(t => !KEEP_TABLES.has(t));
+  // Tables the User table points at (e.g. Campus via homeCampusId): TRUNCATE ... CASCADE on them
+  // would truncate User too — and with it the admin we keep — so their rows are deleted instead,
+  // after the admin's links to them are cleared.
+  const userRefs = await tx.$queryRaw`
+    SELECT DISTINCT ref.relname AS table, att.attname AS column
+    FROM pg_constraint c
+    JOIN pg_class src ON src.oid = c.conrelid
+    JOIN pg_class ref ON ref.oid = c.confrelid
+    JOIN pg_attribute att ON att.attrelid = c.conrelid AND att.attnum = ANY (c.conkey)
+    WHERE c.contype = 'f' AND src.relname = 'User' AND ref.relname <> 'User'`;
+  const deleteInstead = new Set(userRefs.map(r => r.table));
+  const toClear = tables.map(t => t.tablename).filter(t => !KEEP_TABLES.has(t) && !deleteInstead.has(t));
  if (toClear.length) {
    await tx.$executeRawUnsafe(`TRUNCATE TABLE ${toClear.map(t => `"${t}"`).join(', ')} CASCADE`);
  }
+  if (userRefs.length) {
+    await tx.$executeRawUnsafe(`UPDATE "User" SET ${[...new Set(userRefs.map(r => `"${r.column}" = NULL`))].join(', ')}`);
+    for (const table of deleteInstead) await tx.$executeRawUnsafe(`DELETE FROM "${table}"`);
+  }
  // Their password resets, 2FA codes and trusted devices go with them (onDelete: Cascade).
  const { count } = await tx.user.deleteMany({ where: { id: { not: admin.id } } });
  await tx.securityEvent.deleteMany({ where: { OR: [{ userId: null }, { userId: { not: admin.id } }] } });
@@ -1269,6 +1827,7 @@ function describeDatabase() {
 }

 async function confirm(admin) {
+  console.log(`\nDemo profile "${PROFILE_NAME}": ${profile.title}`);
  if (SKIP_PROMPT) return true;
  console.log(`\nThis will DELETE all events, registrations, payments, tickets, coupons and users`);
  console.log(`in ${describeDatabase()}, keeping only the site settings and ${admin.email}.`);
@@ -1279,6 +1838,13 @@ async function confirm(admin) {
 }

 async function main() {
+  if (LIST_ONLY) { listProfiles(); return; }
+  if (!profile) {
+    console.error(`Unknown demo profile "${PROFILE_NAME}". Choose one of: ${Object.keys(PROFILES).join(', ')}.`);
+    listProfiles();
+    process.exitCode = 1;
+    return;
+  }
  admin = await prisma.user.findFirst({ where: { email: { equals: ADMIN_EMAIL, mode: 'insensitive' } } });
  if (!admin) {
    console.error(`Admin account ${ADMIN_EMAIL} was not found — nothing was changed.`);
@@ -1295,15 +1861,11 @@ async function main() {

  passwordHash = await bcrypt.hash(DEMO_PASSWORD, 10);
  const people = buildPeople();
-  const events = [
-    buildMensBreakfast(people),
-    buildFamilyFunDay(people),
-    buildWomensConference(people),
-    buildYouthCamp(people),
-    buildCarols(people),
-    buildMarriageWeekend(people),
-  ];
+  if (profile.campuses) buildCampuses();
+  const events = profile.upcoming.map(key => UPCOMING[key](people));
+  events.push(...buildExtras(people, events));
  buildPastEvents(people);
+  if (profile.campuses) assignCampuses();
  buildAnalytics();

  const cleared = await prisma.$transaction(async (tx) => {
@@ -1311,6 +1873,13 @@ async function main() {
    for (const model of INSERT_ORDER) {
      if (rows[model] && rows[model].length) await tx[model].createMany({ data: rows[model] });
    }
+    if (profile.campuses) await scopeStaff(tx);
+    // Campuses on for the multi-campus demo, off for the others (site settings are kept).
+    await tx.appSetting.upsert({
+      where: { key: 'campuses_enabled' },
+      update: { value: profile.campuses ? 'true' : 'false' },
+      create: { key: 'campuses_enabled', value: profile.campuses ? 'true' : 'false' },
+    });
    return result;
  }, { maxWait: 10 * 1000, timeout: 5 * 60 * 1000 });
  clearScheduledEmails();
@@ -1348,7 +1917,17 @@ async function main() {
    ].filter(Boolean).join(', ');
    console.log(`  ${event.startDate.toDateString().padEnd(16)} ${event.title.padEnd(34)} ${String(regs).padStart(3)} registrations, ${String(scans).padStart(3)} check-ins — ${CASHUP_LABELS[cashup.close]}${notes ? ` (${notes})` : ''}`);
  }
-  console.log(`\nCreated ${count('user')} users, ${count('payment')} payments, ${count('ticket')} tickets, ${count('ticketUsage')} check-ins, ${count('attendee')} named campers, ${count('feedbackResponse')} feedback responses, ${count('analyticsEvent') + count('analyticsDaily')} funnel rows.`);
+  console.log(`\nCreated ${count('user')} users, ${count('payment')} payments, ${count('ticket')} tickets, ${count('ticketUsage')} check-ins, ${count('attendee')} named attendees, ${count('feedbackResponse')} feedback responses, ${count('analyticsEvent') + count('analyticsDaily')} funnel rows.`);
+  const extras = [
+    count('campus') && `${count('campus')} campuses (on), 2 campus-limited staff`,
+    count('eventSeries') && `${count('eventSeries')} series with ${count('seriesFollow')} followers, ${count('seasonPassPurchase')} season passes sold`,
+    count('eventSession') && `${count('eventSession')} sessions`,
+    count('certificate') && `${count('certificate')} certificates`,
+    count('family') && `${count('family')} families, ${count('child')} children, ${count('kidsCheckIn')} kids check-ins`,
+    count('servingRole') && `${count('servingRole')} serving roles, ${count('volunteerSlot')} volunteers rostered, ${count('volunteerSwap')} cover request`,
+  ].filter(Boolean);
+  if (extras.length) console.log(`Also: ${extras.join('; ')}.`);
+  console.log(`Campuses are ${profile.campuses ? 'ON' : 'off'} — restart the backend so it picks the setting up.`);
  console.log(`\nKept: site settings and ${admin.email}.`);
  console.log(`Demo staff logins (password ${DEMO_PASSWORD}):`);
  for (const s of staffTeam) console.log(`  ${s.role.padEnd(10)} ${s.email}`);
@@ -3,7 +3,7 @@ const { PrismaPg } = require('@prisma/adapter-pg');

 // Prisma 7 talks to Postgres through the node-postgres driver adapter instead of
 // the old Rust engine. pg has no connect timeout by default; 5s matches Prisma 5.
-function createPrismaClient() {
+function createBaseClient() {
  const adapter = new PrismaPg({
    connectionString: process.env.DATABASE_URL,
    connectionTimeoutMillis: 5000,
@@ -11,6 +11,86 @@ function createPrismaClient() {
  return new PrismaClient({ adapter });
 }

+/**
+ * Outbound webhooks (utils/webhooks.js) notice what happens here, whichever code path does it:
+ * registrations made, paid or cancelled, payments and refunds, check-ins, new accounts, events
+ * becoming public. Noticing only queues; the record is read again before anything is sent, so a
+ * transaction that rolls back sends nothing. A failure here never affects the write itself.
+ */
+function withWebhooks(base) {
+  const notice = (type, id) => {
+    try { require('../utils/webhooks').notice(type, id); } catch (e) { console.warn('[webhooks] notice:', e?.message || e); }
+  };
+  const isPublic = e => !!e && e.isActive !== false && !e.isHidden;
+  // The status before an update (read outside the caller's transaction: the committed value).
+  const before = (model, where, select) => (where?.id ? base[model].findUnique({ where: { id: where.id }, select }).catch(() => null) : Promise.resolve(null));
+
+  return base.$extends({
+    query: {
+      registration: {
+        async create({ args, query }) {
+          const r = await query(args);
+          if (r?.id) {
+            notice('registration.created', r.id);
+            if (r.status === 'paid') notice('registration.paid', r.id);
+          }
+          return r;
+        },
+        async update({ args, query }) {
+          const status = args?.data?.status;
+          if (status !== 'paid' && status !== 'cancelled') return query(args);
+          const prev = await before('registration', args.where, { status: true });
+          const r = await query(args);
+          if (r?.id && prev && prev.status !== status) notice(status === 'paid' ? 'registration.paid' : 'registration.cancelled', r.id);
+          return r;
+        },
+      },
+      payment: {
+        async create({ args, query }) {
+          const p = await query(args);
+          // Applying an earlier donation to an order isn't new money (see cashupUtils.isDonationLeg).
+          const leg = p && !p.isDonation && p.originalPaymentId && p.amount > 0;
+          if (p?.id && !leg && p.amount !== 0) notice(p.amount < 0 ? 'payment.refunded' : 'payment.received', p.id);
+          return p;
+        },
+      },
+      ticketUsage: {
+        async create({ args, query }) {
+          const u = await query(args);
+          if (u?.id) notice('ticket.checked_in', u.id);
+          return u;
+        },
+      },
+      user: {
+        async create({ args, query }) {
+          const u = await query(args);
+          if (u?.id) notice('user.created', u.id);
+          return u;
+        },
+      },
+      event: {
+        async create({ args, query }) {
+          const e = await query(args);
+          if (e?.id && isPublic(e)) notice('event.published', e.id);
+          return e;
+        },
+        async update({ args, query }) {
+          const touches = args?.data && ('isActive' in args.data || 'isHidden' in args.data);
+          if (!touches) return query(args);
+          const prev = await before('event', args.where, { isActive: true, isHidden: true });
+          const e = await query(args);
+          if (e?.id && prev && !isPublic(prev) && isPublic(e)) notice('event.published', e.id);
+          return e;
+        },
+      },
+    },
+  });
+}
+
+function createPrismaClient() {
+  return withWebhooks(createBaseClient());
+}
+
 const prisma = createPrismaClient();

 module.exports = prisma;
@@ -11,6 +11,9 @@ const sessionsUtil = require('../utils/sessions');
 const { publicOptions } = require('../utils/volunteers');
 const { campusesEnabled, campusForEvent, campusWhere, resolveCampusFilter, EVENT_CAMPUS_SELECT } = require('../utils/campuses');
 const { scopeFor, canView, canManage, eventWhere: scopeEventWhere, withScope } = require('../utils/campusScope');
+const seriesUtil = require('../utils/series');
+
+const SERIES_SELECT = { select: { id: true, name: true, slug: true } };

 /** A campus-scoped supervisor may only create or move events to one of their campuses. */
 async function assertCampusAllowed(req, campusId) {
@@ -158,6 +161,7 @@ const createEvent = async (req, res) => {
    if (campusPick.error) { const err = new Error(campusPick.error); err.statusCode = 400; throw err; }
    // Not choosing a campus means all campuses, which a scoped supervisor can't create.
    await assertCampusAllowed(req, campusPick.campusId === undefined ? null : campusPick.campusId);
+    const seriesId = await seriesUtil.seriesForEvent(req.body.seriesId);

    const data = {
      id: uuidv4(),
@@ -195,6 +199,7 @@ const createEvent = async (req, res) => {
      contactEmail: contactEmail || null,
      location: location || null,
      ...(campusPick.campusId !== undefined ? { campusId: campusPick.campusId } : {}),
+      ...(seriesId ? { seriesId } : {}),
      ...scheduleData(req.body),
    };
    if (data.scheduleType === 'sessions') {
@@ -363,6 +368,8 @@ const getEvents = async (req, res) => {
    // ?campus=<slug or id>: that campus's events plus church-wide ones.
    const enabled = await campusesEnabled();
    const campusFilter = campusWhere(enabled ? await resolveCampusFilter(req.query.campus) : '', { enabled, withAllCampuses: true });
+    // ?series=<slug>: one series' events.
+    if (req.query.series) campusFilter.series = { slug: String(req.query.series) };
    try {
      events = await prisma.event.findMany({
        where: {
@@ -372,7 +379,7 @@ const getEvents = async (req, res) => {
          endDate: { gte: new Date() },
          ...campusFilter,
        },
-        include: { eventOptions: eventOptionsInclude, sessions: SESSIONS_INCLUDE, campus: { select: EVENT_CAMPUS_SELECT } }
+        include: { eventOptions: eventOptionsInclude, sessions: SESSIONS_INCLUDE, campus: { select: EVENT_CAMPUS_SELECT }, series: SERIES_SELECT }
      });
    } catch (e) {
      // Fallback if goLiveAt/isHidden not available yet (pre-migration)
@@ -471,6 +478,7 @@ const getEventsAll = async (req, res) => {
        form: { include: { fields: true } },
        sessions: SESSIONS_INCLUDE,
        campus: { select: EVENT_CAMPUS_SELECT },
+        series: SERIES_SELECT,
      },
      orderBy: { startDate: 'asc' }
    });
@@ -498,7 +506,7 @@ const getEventById = async (req, res) => {
    const optionInclude = canIncludeTiers
      ? { earlyBirdTiers: true, ...(canIncludeVariants ? { variants: { orderBy: { order: 'asc' } } } : {}) }
      : undefined;
-    const includeObj = { eventOptions: optionInclude ? { include: optionInclude } : true, sessions: SESSIONS_INCLUDE, campus: { select: EVENT_CAMPUS_SELECT } };
+    const includeObj = { eventOptions: optionInclude ? { include: optionInclude } : true, sessions: SESSIONS_INCLUDE, campus: { select: EVENT_CAMPUS_SELECT }, series: SERIES_SELECT };

    // Staff/supervisor/admin need the creator + notify-recipient list to populate the
    // event edit screen's Notifications step; public callers don't need this.
@@ -653,6 +661,7 @@ const getEventById = async (req, res) => {
      })),
      form,
      bundles: await require('./bundleController').publicBundlesForEvent(eventId).catch(() => []),
+      nextInSeries: await seriesUtil.nextInSeries(event).catch(() => null),
    }, bookings);
    res.json(mapped);
  } catch (error) {
@@ -742,6 +751,9 @@ const updateEvent = async (req, res) => {
    const campusPick = await campusForEvent(req.body.campusId, { enabled: await campusesEnabled(), currentCampusId: event.campusId });
    if (campusPick.error) throw new Error(campusPick.error);
    const campusChanged = campusPick.campusId !== undefined && campusPick.campusId !== event.campusId;
+    const seriesPick = await seriesUtil.seriesForEvent(req.body.seriesId);
+    // Moved into another series: that series' followers hear about it (once it's live).
+    const seriesChanged = seriesPick !== undefined && seriesPick !== event.seriesId;
    if (campusChanged) {
      try { await assertCampusAllowed(req, campusPick.campusId); } catch (e) { return res.status(403).json({ message: e.message }); }
    }
@@ -784,6 +796,7 @@ const updateEvent = async (req, res) => {
      contactEmail: contactEmail !== undefined ? (contactEmail || null) : event.contactEmail,
      location: location !== undefined ? (location || null) : event.location,
      ...(campusChanged ? { campusId: campusPick.campusId } : {}),
+      ...(seriesChanged ? { seriesId: seriesPick, seriesAnnouncedAt: null } : {}),
      updatedAt: new Date(),
      redirectUrl: redirectUrl !== undefined ? redirectUrl : event.redirectUrl,
      ...scheduleData(req.body, event),
@@ -1589,6 +1602,9 @@ const emailEventAttendees = async (req, res) => {
      // Prefer server-side filtering when possible
      where.userId = { in: attendeeIds };
    }
+    // Bulk actions (1.49.1): exactly the registrations ticked on the registrations list.
+    const registrationIds = Array.isArray(filter?.registrationIds) ? filter.registrationIds.filter((x) => typeof x === 'string' && x.trim()).slice(0, 2000) : [];
+    if (registrationIds.length > 0) where.id = { in: registrationIds };

    // Name/email substring filter (kept for backward compatibility)
    const nameQ = (filter && filter.name) ? String(filter.name).trim() : '';
@@ -1857,6 +1873,9 @@ const whatsappEventAttendees = async (req, res) => {
    if (attendeeIds.length > 0) {
      where.userId = { in: attendeeIds };
    }
+    // Bulk actions (1.49.1): exactly the registrations ticked on the registrations list.
+    const registrationIds = Array.isArray(filter?.registrationIds) ? filter.registrationIds.filter((x) => typeof x === 'string' && x.trim()).slice(0, 2000) : [];
+    if (registrationIds.length > 0) where.id = { in: registrationIds };

    const nameQ = (filter && filter.name) ? String(filter.name).trim() : '';
    const phoneQ = (filter && filter.phone) ? String(filter.phone).trim() : '';
@@ -13,10 +13,13 @@ function compareVersions(a, b) {
  return 0;
 }

-/** An update request still waiting: until this site runs the version that was asked for. */
-function pendingUpdateRequest(version, requestedAt, requestedVersion) {
+/**
+ * An update request still waiting: until this site runs the version that was asked for.
+ * `outdated`: a newer version than the one asked for is out, so the request can be changed to it.
+ */
+function pendingUpdateRequest(version, requestedAt, requestedVersion, latestVersion = null) {
  if (!requestedAt || !requestedVersion || compareVersions(version, requestedVersion) >= 0) return null;
-  return { requestedAt, version: requestedVersion };
+  return { requestedAt, version: requestedVersion, outdated: !!latestVersion && compareVersions(latestVersion, requestedVersion) > 0 };
 }

 const str = (v, max) => String(v ?? '').slice(0, max);
@@ -87,7 +90,7 @@ async function statusPayload({ fresh = false } = {}) {
    urgentUpdate,
    updateSnoozed: updateAvailable && updateSnoozed({ latestVersion: s.latestVersion, snoozedVersion: s.updateSnoozedVersion, urgent: urgentUpdate }),
    releases,
-    updateRequest: pendingUpdateRequest(APP_VERSION, s.updateRequestedAt, s.updateRequestedVersion),
+    updateRequest: pendingUpdateRequest(APP_VERSION, s.updateRequestedAt, s.updateRequestedVersion, s.latestVersion),
    notices: activeNotices(s.notices),
  };
 }
@@ -139,8 +142,11 @@ const heartbeatNow = async (req, res) => {
 const requestUpdate = async (req, res) => {
  try {
    const result = await hub.requestUpdate();
-    if (!result.alreadyRequested) {
-      logAdminAction({ actorId: req.user.id, actorRole: req.user.role, action: 'hub_update_requested', targetType: 'hub', metadata: { from: APP_VERSION, to: result.version }, ip: getClientIp(req) });
+    if (!result.alreadyRequested || result.changed) {
+      logAdminAction({
+        actorId: req.user.id, actorRole: req.user.role, action: 'hub_update_requested', targetType: 'hub',
+        metadata: { from: APP_VERSION, to: result.version, ...(result.changed ? { changedFrom: result.previousVersion || null } : {}) }, ip: getClientIp(req),
+      });
    }
    res.json(await statusPayload({ fresh: true }));
  } catch (e) {
@@ -0,0 +1,175 @@
+const prisma = require('../config/db');
+const { logAdminAction } = require('../utils/adminAudit');
+const { getClientIp } = require('../utils/requestUtils');
+const webhooks = require('../utils/webhooks');
+
+const fail = (res, error) => res.status(error.statusCode || 400).json({ message: error.message });
+
+const audit = (req, endpoint, action, metadata = {}) => logAdminAction({
+  actorId: req.user.id, actorRole: req.user.role, action: 'webhook_endpoint_changed', targetType: 'WebhookEndpoint', targetId: endpoint.id,
+  metadata: { action, name: endpoint.name, host: hostOf(endpoint.url), ...metadata }, ip: getClientIp(req),
+});
+
+function hostOf(url) {
+  try { return new URL(url).host; } catch { return null; }
+}
+
+/** What goes to an endpoint, in words, for its operator register entry. */
+function dataShared(events) {
+  const parts = [];
+  if (events.some(e => e.startsWith('registration.') || e === 'ticket.checked_in' || e.startsWith('payment.') || e === 'user.created')) {
+    parts.push('names, email addresses and phone numbers of people who register or have an account');
+  }
+  if (events.some(e => e.startsWith('registration.'))) parts.push('what they registered for and its status');
+  if (events.some(e => e.startsWith('payment.'))) parts.push('payment and refund amounts');
+  if (events.includes('ticket.checked_in')) parts.push('check-in times');
+  if (events.includes('event.published')) parts.push('published event details');
+  return parts.length ? `${parts.join('; ')}.` : 'Nothing yet (no event types chosen).';
+}
+
+function cleanEvents(list) {
+  const events = [...new Set((Array.isArray(list) ? list : []).map(String))].filter(t => webhooks.TYPES.has(t));
+  if (!events.length) throw webhooks.webhookError('Choose at least one thing to send');
+  return events;
+}
+
+function cleanName(name) {
+  const n = String(name || '').trim();
+  if (!n) throw webhooks.webhookError('Give the webhook a name, e.g. the service it goes to');
+  return n.slice(0, 100);
+}
+
+const view = e => ({
+  id: e.id, name: e.name, url: e.url, events: e.events, isActive: e.isActive, operatorId: e.operatorId,
+  lastSuccessAt: e.lastSuccessAt, lastFailureAt: e.lastFailureAt, createdAt: e.createdAt,
+});
+
+// @desc    Endpoints, the event types, and the last week's delivery counts per endpoint
+// @route   GET /api/outbound-webhooks
+// @access  Private/Admin
+const list = async (req, res) => {
+  try {
+    const endpoints = await prisma.webhookEndpoint.findMany({ orderBy: { createdAt: 'asc' } });
+    const since = new Date(Date.now() - 7 * 864e5);
+    const counts = await prisma.webhookDelivery.groupBy({ by: ['endpointId', 'status'], where: { createdAt: { gte: since } }, _count: { _all: true } });
+    res.json({
+      eventTypes: webhooks.EVENT_TYPES,
+      keepDays: webhooks.KEEP_DAYS,
+      endpoints: endpoints.map(e => ({
+        ...view(e),
+        lastWeek: Object.fromEntries(counts.filter(c => c.endpointId === e.id).map(c => [c.status, c._count._all])),
+      })),
+    });
+  } catch (error) { fail(res, error); }
+};
+
+// @desc    Add an endpoint: the secret is in this answer only. Also added to the operator register.
+// @route   POST /api/outbound-webhooks  { name, url, events }
+// @access  Private/Admin
+const create = async (req, res) => {
+  try {
+    const name = cleanName(req.body?.name);
+    const url = webhooks.cleanUrl(req.body?.url);
+    const events = cleanEvents(req.body?.events);
+    const secret = webhooks.newSecret();
+    const u = new URL(url);
+    // POPIA: whoever receives this is an operator of the church's personal information.
+    const operator = await prisma.operator.create({
+      data: { name: `${name} (webhook)`, purpose: 'Receives notifications from this site through a webhook', dataShared: dataShared(events), website: u.origin },
+    }).catch(() => null);
+    const endpoint = await prisma.webhookEndpoint.create({ data: { name, url, events, secret: webhooks.encrypt(secret), operatorId: operator?.id || null } });
+    webhooks.forgetEndpoints();
+    audit(req, endpoint, 'created', { events });
+    res.status(201).json({ ...view(endpoint), secret });
+  } catch (error) { fail(res, error); }
+};
+
+// @route   PUT /api/outbound-webhooks/:id  { name?, url?, events?, isActive? }
+// @access  Private/Admin
+const update = async (req, res) => {
+  try {
+    const current = await prisma.webhookEndpoint.findUnique({ where: { id: req.params.id } });
+    if (!current) return res.status(404).json({ message: 'Webhook not found' });
+    const data = {};
+    if (req.body?.name !== undefined) data.name = cleanName(req.body.name);
+    if (req.body?.url !== undefined) data.url = webhooks.cleanUrl(req.body.url);
+    if (req.body?.events !== undefined) data.events = cleanEvents(req.body.events);
+    if (req.body?.isActive !== undefined) data.isActive = req.body.isActive !== false;
+    const endpoint = await prisma.webhookEndpoint.update({ where: { id: current.id }, data });
+    if (current.operatorId && (data.events || data.url || data.name || data.isActive !== undefined)) {
+      await prisma.operator.update({
+        where: { id: current.operatorId },
+        data: { name: `${endpoint.name} (webhook)`, dataShared: dataShared(endpoint.events), website: new URL(endpoint.url).origin, active: endpoint.isActive },
+      }).catch(() => {});
+    }
+    webhooks.forgetEndpoints();
+    audit(req, endpoint, 'updated', { changedKeys: Object.keys(data) });
+    res.json(view(endpoint));
+  } catch (error) { fail(res, error); }
+};
+
+// @desc    Delete an endpoint and its delivery log; its operator entry is marked inactive
+// @route   DELETE /api/outbound-webhooks/:id
+// @access  Private/Admin
+const remove = async (req, res) => {
+  try {
+    const current = await prisma.webhookEndpoint.findUnique({ where: { id: req.params.id } });
+    if (!current) return res.status(404).json({ message: 'Webhook not found' });
+    await prisma.webhookEndpoint.delete({ where: { id: current.id } });
+    if (current.operatorId) await prisma.operator.update({ where: { id: current.operatorId }, data: { active: false } }).catch(() => {});
+    webhooks.forgetEndpoints();
+    audit(req, current, 'deleted');
+    res.json({ ok: true });
+  } catch (error) { fail(res, error); }
+};
+
+// @desc    A new secret (the old one stops working at once); in this answer only
+// @route   POST /api/outbound-webhooks/:id/rotate-secret
+// @access  Private/Admin
+const rotateSecret = async (req, res) => {
+  try {
+    const current = await prisma.webhookEndpoint.findUnique({ where: { id: req.params.id } });
+    if (!current) return res.status(404).json({ message: 'Webhook not found' });
+    const secret = webhooks.newSecret();
+    await prisma.webhookEndpoint.update({ where: { id: current.id }, data: { secret: webhooks.encrypt(secret) } });
+    audit(req, current, 'secret_rotated');
+    res.json({ secret });
+  } catch (error) { fail(res, error); }
+};
+
+// @desc    Send a "webhook.test" now and say what came back
+// @route   POST /api/outbound-webhooks/:id/test
+// @access  Private/Admin
+const test = async (req, res) => {
+  try {
+    if (!(await prisma.webhookEndpoint.findUnique({ where: { id: req.params.id }, select: { id: true } }))) return res.status(404).json({ message: 'Webhook not found' });
+    const d = await webhooks.sendTest(req.params.id);
+    res.json({ status: d?.status, statusCode: d?.lastStatusCode ?? null, error: d?.lastError || null });
+  } catch (error) { fail(res, error); }
+};
+
+// @desc    An endpoint's deliveries, newest first (?status=failed to filter)
+// @route   GET /api/outbound-webhooks/:id/deliveries
+// @access  Private/Admin
+const deliveries = async (req, res) => {
+  try {
+    const where = { endpointId: req.params.id, ...(req.query.status ? { status: String(req.query.status) } : {}) };
+    const rows = await prisma.webhookDelivery.findMany({
+      where, orderBy: { createdAt: 'desc' }, take: Math.min(200, parseInt(req.query.limit, 10) || 50),
+      select: { id: true, eventId: true, type: true, status: true, attempts: true, nextAttemptAt: true, lastStatusCode: true, lastError: true, deliveredAt: true, createdAt: true, payload: true },
+    });
+    res.json(rows);
+  } catch (error) { fail(res, error); }
+};
+
+// @desc    Send a delivery again now
+// @route   POST /api/outbound-webhooks/deliveries/:id/resend
+// @access  Private/Admin
+const resend = async (req, res) => {
+  try {
+    const d = await webhooks.resend(req.params.id);
+    res.json({ status: d?.status, statusCode: d?.lastStatusCode ?? null, error: d?.lastError || null });
+  } catch (error) { fail(res, error); }
+};
+
+module.exports = { list, create, update, remove, rotateSecret, test, deliveries, resend, dataShared };
@@ -65,12 +65,30 @@ const getNoticeDraft = async (req, res) => {
      placeholders: notice.PLACEHOLDERS,
      versions: await versionList(),
      builtIn: notice.defaultSections(),
+      // Changes to the built-in text since this site last reviewed them (only once it publishes its own).
+      builtInUpdates: await notice.builtInUpdates(),
    });
  } catch (error) {
    fail(res, error);
  }
 };

+// @desc    The built-in text changes have been gone through (the editor stops listing them)
+// @route   POST /api/privacy/notice/builtin-reviewed
+// @access  Private/Admin
+const markBuiltInReviewed = async (req, res) => {
+  try {
+    await notice.markBuiltInReviewed();
+    logAdminAction({
+      actorId: req.user.id, actorRole: req.user.role, action: 'settings_updated', targetType: 'privacy_notice',
+      metadata: { builtInReviewed: notice.BUILT_IN_REVISION }, ip: getClientIp(req),
+    });
+    res.json({ builtInUpdates: [] });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
 // @desc    Save the draft (body.sections)
 // @route   PUT /api/privacy/notice/draft
 // @access  Private/Admin
@@ -425,6 +443,7 @@ const updateBreach = async (req, res) => {
 };

 module.exports = {
+  markBuiltInReviewed,
  getReadiness,
  getRetention,
  saveRetention,
@@ -0,0 +1,146 @@
+const prisma = require('../config/db');
+const { logAdminAction } = require('../utils/adminAudit');
+const { getClientIp } = require('../utils/requestUtils');
+const { scopeFor, canManage } = require('../utils/campusScope');
+const passes = require('../utils/seasonPass');
+
+const fail = (res, error) => res.status(error.statusCode || 400).json({ message: error.message });
+
+const audit = (req, pass, action, metadata = {}) => logAdminAction({
+  actorId: req.user.id, actorRole: req.user.role, action: 'season_pass_changed', targetType: 'SeasonPass', targetId: pass.id,
+  metadata: { action, name: pass.name, ...metadata }, ip: getClientIp(req),
+});
+
+/** Campus-scoped supervisors may only put their own campuses' events on a pass. */
+async function assertCampuses(req, campusIds) {
+  const scope = await scopeFor(req);
+  if (scope && campusIds.some(c => !canManage(scope, c))) {
+    const err = new Error('You can only put events from your own campuses on a pass (not events for all campuses).');
+    err.statusCode = 403;
+    throw err;
+  }
+}
+
+const frontendUrl = () => String(process.env.FRONTEND_URL || process.env.APP_BASE_URL || 'http://localhost:3001').replace(/\/$/, '');
+
+// @desc    A series' passes with their events, shares, and how many were sold
+// @route   GET /api/season-passes?seriesId=
+// @access  Private/Supervisor
+const listPasses = async (req, res) => {
+  try {
+    const where = req.query.seriesId ? { seriesId: String(req.query.seriesId) } : {};
+    const rows = await prisma.seasonPass.findMany({ where, orderBy: { createdAt: 'asc' }, include: passes.PASS_INCLUDE });
+    const sold = await prisma.seasonPassPurchase.groupBy({ by: ['passId', 'status'], where: { passId: { in: rows.map(r => r.id) } }, _sum: { quantity: true } });
+    res.json(rows.map(p => ({
+      ...passes.passView(p),
+      sold: sold.filter(s => s.passId === p.id && s.status === 'paid').reduce((n, s) => n + (s._sum.quantity || 0), 0),
+      unpaid: sold.filter(s => s.passId === p.id && s.status === 'pending').reduce((n, s) => n + (s._sum.quantity || 0), 0),
+    })));
+  } catch (error) { fail(res, error); }
+};
+
+// @route   POST /api/season-passes  { seriesId, name, description?, price, saleEndsAt?, items: [{ eventId, eventOptionId, variantId? }] }
+// @access  Private/Supervisor
+const createPass = async (req, res) => {
+  try {
+    const seriesId = String(req.body?.seriesId || '');
+    if (!(await prisma.eventSeries.findUnique({ where: { id: seriesId }, select: { id: true } }))) return res.status(404).json({ message: 'Series not found' });
+    const { data, items } = await passes.cleanPassInput(req.body, seriesId);
+    await assertCampuses(req, items.map(i => i.campusId));
+    const pass = await prisma.seasonPass.create({
+      data: { ...data, seriesId, items: { create: items.map(({ campusId, ...i }) => i) } },
+    });
+    audit(req, pass, 'created', { events: items.length, price: pass.price });
+    res.status(201).json(passes.passView(await passes.loadPass(pass.id)));
+  } catch (error) { fail(res, error); }
+};
+
+// @desc    Change a pass. Its events can only change while nobody has bought it.
+// @route   PUT /api/season-passes/:id
+// @access  Private/Supervisor
+const updatePass = async (req, res) => {
+  try {
+    const current = await passes.loadPass(req.params.id);
+    await assertCampuses(req, current.items.map(i => i.event.campusId));
+    const { data, items } = await passes.cleanPassInput(req.body, current.seriesId, current);
+    const bought = await prisma.seasonPassPurchase.count({ where: { passId: current.id } });
+    if (bought > 0 && (items || (data.price !== undefined && data.price !== current.price))) {
+      return res.status(409).json({ message: 'People have bought this pass, so its events and price can\'t change. Switch it off and make a new one instead.' });
+    }
+    if (items) await assertCampuses(req, items.map(i => i.campusId));
+    await prisma.$transaction(async tx => {
+      await tx.seasonPass.update({ where: { id: current.id }, data });
+      if (items) {
+        await tx.seasonPassItem.deleteMany({ where: { passId: current.id } });
+        await tx.seasonPassItem.createMany({ data: items.map(({ campusId, ...i }) => ({ ...i, passId: current.id })) });
+      }
+    });
+    audit(req, current, 'updated', { changedKeys: [...Object.keys(data), ...(items ? ['items'] : [])] });
+    res.json(passes.passView(await passes.loadPass(current.id)));
+  } catch (error) { fail(res, error); }
+};
+
+// @desc    Delete a pass nobody has bought (otherwise switch it off)
+// @route   DELETE /api/season-passes/:id
+// @access  Private/Supervisor
+const deletePass = async (req, res) => {
+  try {
+    const current = await passes.loadPass(req.params.id);
+    await assertCampuses(req, current.items.map(i => i.event.campusId));
+    if (await prisma.seasonPassPurchase.count({ where: { passId: current.id } })) {
+      return res.status(409).json({ message: 'People have bought this pass, so it can\'t be deleted — switch it off instead.' });
+    }
+    await prisma.seasonPass.delete({ where: { id: current.id } });
+    audit(req, current, 'deleted');
+    res.json({ ok: true });
+  } catch (error) { fail(res, error); }
+};
+
+// @desc    Buy passes: registers the buyer at every event on it, then the checkout (or tickets, if free)
+// @route   POST /api/season-passes/:id/buy  { quantity, provider? }
+// @access  Private
+const buy = async (req, res) => {
+  try {
+    const pass = await prisma.seasonPass.findUnique({ where: { id: req.params.id }, select: { series: { select: { slug: true } } } });
+    if (!pass) return res.status(404).json({ message: 'Season pass not found' });
+    const back = `${frontendUrl()}/series/${pass.series.slug}`;
+    const result = await passes.buyPass(req.params.id, req.user.id, {
+      quantity: req.body?.quantity ?? 1, provider: req.body?.provider || null,
+      successUrl: `${back}?pass=paid`, cancelUrl: `${back}?pass=cancelled`, failureUrl: `${back}?pass=failed`,
+    });
+    res.status(201).json(result);
+  } catch (error) { fail(res, error); }
+};
+
+// @desc    Pay what's still owed on a purchase (a new checkout)
+// @route   POST /api/season-passes/purchases/:id/checkout
+// @access  Private (the buyer)
+const payPurchase = async (req, res) => {
+  try {
+    const purchase = await prisma.seasonPassPurchase.findUnique({ where: { id: req.params.id }, select: { userId: true, pass: { select: { series: { select: { slug: true } } } } } });
+    if (!purchase || purchase.userId !== req.user.id) return res.status(404).json({ message: 'Purchase not found' });
+    const back = `${frontendUrl()}/series/${purchase.pass.series.slug}`;
+    res.json(await passes.startPassCheckout(req.params.id, req.user.id, {
+      provider: req.body?.provider || null, successUrl: `${back}?pass=paid`, cancelUrl: `${back}?pass=cancelled`, failureUrl: `${back}?pass=failed`,
+    }));
+  } catch (error) { fail(res, error); }
+};
+
+// @desc    The signed-in person's pass purchases
+// @route   GET /api/season-passes/mine
+// @access  Private
+const myPurchases = async (req, res) => {
+  try {
+    const rows = await prisma.seasonPassPurchase.findMany({
+      where: { userId: req.user.id }, orderBy: { createdAt: 'desc' },
+      select: {
+        id: true, quantity: true, total: true, status: true, createdAt: true,
+        pass: { select: { id: true, name: true, series: { select: { name: true, slug: true } } } },
+        registrations: { select: { id: true, status: true, event: { select: { id: true, title: true, startDate: true } } } },
+      },
+    });
+    res.json(rows);
+  } catch (error) { fail(res, error); }
+};
+
+module.exports = { listPasses, createPass, updatePass, deletePass, buy, payPurchase, myPurchases };
@@ -0,0 +1,126 @@
+const prisma = require('../config/db');
+const { logAdminAction } = require('../utils/adminAudit');
+const { getClientIp } = require('../utils/requestUtils');
+const { cleanSeriesInput, publicEventWhere, splitEvents, follow, unfollow, compareSeries } = require('../utils/series');
+const { scopeFor, canView, eventWhere } = require('../utils/campusScope');
+const { EVENT_CAMPUS_SELECT } = require('../utils/campuses');
+
+const fail = (res, error) => res.status(error.statusCode || (error.code === 'P2002' ? 409 : 400)).json({
+  message: error.code === 'P2002' ? 'Another series already uses that web address' : error.message,
+});
+
+const audit = (req, action, series, metadata = {}) => logAdminAction({
+  actorId: req.user.id, actorRole: req.user.role, action, targetType: 'EventSeries', targetId: series.id,
+  metadata: { name: series.name, ...metadata }, ip: getClientIp(req),
+});
+
+// @desc    Every series, with its events (the ones this person may see) and number of followers
+// @route   GET /api/series
+// @access  Private/Supervisor
+const listSeries = async (req, res) => {
+  try {
+    const scope = await scopeFor(req);
+    const rows = await prisma.eventSeries.findMany({
+      orderBy: { name: 'asc' },
+      include: {
+        events: { orderBy: { startDate: 'desc' }, select: { id: true, title: true, startDate: true, endDate: true, isActive: true, isHidden: true, campusId: true, campus: { select: EVENT_CAMPUS_SELECT } } },
+        _count: { select: { followers: true, events: true } },
+      },
+    });
+    // A series spans campuses; campus-scoped staff see the series, but only their campuses' events in it.
+    res.json(rows.map(({ _count, events, ...s }) => ({
+      ...s,
+      followers: _count.followers,
+      eventCount: _count.events,
+      events: events.filter(e => canView(scope, e.campusId)),
+    })));
+  } catch (error) { fail(res, error); }
+};
+
+// @desc    Create a series
+// @route   POST /api/series
+// @access  Private/Supervisor
+const createSeries = async (req, res) => {
+  try {
+    const series = await prisma.eventSeries.create({ data: cleanSeriesInput(req.body) });
+    audit(req, 'series_created', series);
+    res.status(201).json(series);
+  } catch (error) { fail(res, error); }
+};
+
+// @desc    Rename a series or change its page
+// @route   PUT /api/series/:id
+// @access  Private/Supervisor
+const updateSeries = async (req, res) => {
+  try {
+    const current = await prisma.eventSeries.findUnique({ where: { id: req.params.id } });
+    if (!current) return res.status(404).json({ message: 'Series not found' });
+    const data = cleanSeriesInput(req.body, current);
+    const series = await prisma.eventSeries.update({ where: { id: current.id }, data });
+    audit(req, 'series_updated', series, { changedKeys: Object.keys(data) });
+    res.json(series);
+  } catch (error) { fail(res, error); }
+};
+
+// @desc    Delete a series (its events stay, just without a series; followers are dropped)
+// @route   DELETE /api/series/:id
+// @access  Private/Admin
+const deleteSeries = async (req, res) => {
+  try {
+    const current = await prisma.eventSeries.findUnique({ where: { id: req.params.id }, include: { _count: { select: { events: true, followers: true } } } });
+    if (!current) return res.status(404).json({ message: 'Series not found' });
+    if (await prisma.seasonPassPurchase.count({ where: { pass: { seriesId: current.id } } })) {
+      return res.status(409).json({ message: 'People have bought season passes for this series, so it can\'t be deleted.' });
+    }
+    await prisma.eventSeries.delete({ where: { id: current.id } });
+    audit(req, 'series_deleted', current, { events: current._count.events, followers: current._count.followers });
+    res.json({ ok: true });
+  } catch (error) { fail(res, error); }
+};
+
+// @desc    A series' public page: its details, upcoming and past public events, and whether the
+//          signed-in person follows it
+// @route   GET /api/series/by-slug/:slug
+// @access  Public
+const getSeriesBySlug = async (req, res) => {
+  try {
+    const series = await prisma.eventSeries.findUnique({
+      where: { slug: String(req.params.slug) },
+      select: { id: true, name: true, slug: true, description: true, picture: true },
+    });
+    if (!series) return res.status(404).json({ message: 'Series not found' });
+    const events = await prisma.event.findMany({
+      where: { ...publicEventWhere(), seriesId: series.id },
+      select: { id: true, title: true, startDate: true, endDate: true, location: true, campus: { select: EVENT_CAMPUS_SELECT } },
+    });
+    const { upcoming, past } = splitEvents(events);
+    const following = req.user ? !!(await prisma.seriesFollow.findUnique({ where: { seriesId_userId: { seriesId: series.id, userId: req.user.id } } })) : false;
+    // Season passes switched on (1.47.3); `unavailable` says why one can't be bought now.
+    const { passView, PASS_INCLUDE } = require('../utils/seasonPass');
+    const passes = (await prisma.seasonPass.findMany({ where: { seriesId: series.id, isActive: true }, orderBy: { createdAt: 'asc' }, include: PASS_INCLUDE }))
+      .map(p => passView(p))
+      .map(({ items, ...p }) => ({ ...p, items: items.map(({ campusId, ...i }) => i) }));
+    res.json({ ...series, upcoming, past, following, passes });
+  } catch (error) { fail(res, error); }
+};
+
+// @desc    Year-on-year: registrations, tickets, income and attendance per event in the series
+//          (the events this person may see), oldest first, with the change from the one before
+// @route   GET /api/series/:id/compare
+// @access  Private/Supervisor
+const compare = async (req, res) => {
+  try {
+    res.json(await compareSeries(req.params.id, { scopeWhere: eventWhere(await scopeFor(req)) }));
+  } catch (error) { fail(res, error); }
+};
+
+// @route   POST /api/series/:id/follow · DELETE /api/series/:id/follow
+// @access  Private
+const followSeries = async (req, res) => {
+  try { await follow(req.params.id, req.user.id); res.json({ following: true }); } catch (error) { fail(res, error); }
+};
+const unfollowSeries = async (req, res) => {
+  try { await unfollow(req.params.id, req.user.id); res.json({ following: false }); } catch (error) { fail(res, error); }
+};
+
+module.exports = { listSeries, createSeries, updateSeries, deleteSeries, getSeriesBySlug, followSeries, unfollowSeries, compare };
@@ -1114,6 +1114,13 @@ const activateAccount = async (req, res) => {
      select: { id: true, name: true, email: true, role: true, tokenVersion: true }
    });

+    // The activation form asks them to agree to the terms and privacy notice, as sign-up does.
+    // Without it (an older page) they're asked once after login instead.
+    if (req.body.acceptTerms === true) {
+      await require('../utils/privacyNotice').acceptNotice(user.id, { source: 'activation', ip: getClientIp(req) })
+        .catch(e => console.warn('[activate] notice acceptance not saved:', e?.message || e));
+    }
+
    // Send welcome email (skip guest/placeholder accounts)
    if (updated.email && !updated.email.endsWith('@guest.local')) {
      sendWelcomeEmail(updated).catch(() => {});
@@ -145,17 +145,36 @@ async function heartbeat() {
  }
 }

+/** a < b as x.y.z versions. */
+function olderThan(a, b) {
+  const pa = String(a || '').split('.').map(n => parseInt(n, 10) || 0);
+  const pb = String(b || '').split('.').map(n => parseInt(n, 10) || 0);
+  for (let i = 0; i < 3; i++) if (pa[i] !== pb[i]) return pa[i] < pb[i];
+  return false;
+}
+
 /**
 * Ask the Hub for this site to be updated (§3a). Joshua is told; the site never updates itself.
- * Returns { requestedAt, version, alreadyRequested }.
+ * Asking again after a newer version came out moves the request on to it (`changed`). A Hub before
+ * 1.5.0 can't do that (it doesn't send `changed`), so the old request is withdrawn and made again.
+ * Returns { requestedAt, version, alreadyRequested, changed, previousVersion }.
 */
 async function requestUpdate() {
-  let data;
-  try {
-    data = await signedPost('/api/installs/update-request', { protocolVersion: PROTOCOL_VERSION, version: report.APP_VERSION });
-  } catch (e) {
-    if (e.code === 'NOT_FOUND') throw new HubError('The Hub doesn\'t take update requests yet. Please contact your provider.', 'NOT_SUPPORTED', 502);
-    throw e;
+  const ask = async () => {
+    try {
+      return await signedPost('/api/installs/update-request', { protocolVersion: PROTOCOL_VERSION, version: report.APP_VERSION });
+    } catch (e) {
+      if (e.code === 'NOT_FOUND') throw new HubError('The Hub doesn\'t take update requests yet. Please contact your provider.', 'NOT_SUPPORTED', 502);
+      throw e;
+    }
+  };
+  let data = await ask();
+  if (data.alreadyRequested && data.changed === undefined) {
+    const asked = (await read(['hub_update_requested_version'])).hub_update_requested_version || null;
+    if (!asked || olderThan(asked, data.version)) {
+      await cancelUpdateRequest();
+      data = { ...(await ask()), changed: true, previousVersion: asked };
+    }
  }
  await save({ hub_update_requested_at: data.requestedAt, hub_update_requested_version: data.version || null });
  return data;
@@ -14,6 +14,13 @@ const BLOCKED = [
  ['POST', /^\/api\/events\/?$/],
  ['PUT', /^\/api\/events\/[^/]+\/?$/],
  ['POST', /^\/api\/events\/[^/]+\/copy-from\/?$/],
+  ['POST', /^\/api\/series\/?$/],
+  ['PUT', /^\/api\/series\/[^/]+\/?$/],
+  // Season passes: new or changed passes, and buying one (it makes registrations and payments).
+  ['POST', /^\/api\/season-passes\/?$/],
+  ['PUT', /^\/api\/season-passes\/[^/]+\/?$/],
+  ['POST', /^\/api\/season-passes\/[^/]+\/buy\/?$/],
+  ['POST', /^\/api\/season-passes\/purchases\/[^/]+\/checkout\/?$/],
  ['POST', /^\/api\/events\/[^/]+\/options\/?$/],
  ['PUT', /^\/api\/events\/options\/[^/]+\/?$/],
  ['POST', /^\/api\/events\/options\/[^/]+\/variants\/?$/],
@@ -185,6 +185,11 @@ app.use('/api/hub', require('./routes/hubRoutes'));
 app.use('/api/campuses', require('./routes/campusRoutes'));
 app.use('/api/kids', require('./routes/kidsRoutes'));
 app.use('/api/volunteers', require('./routes/volunteerRoutes'));
+app.use('/api/series', require('./routes/seriesRoutes'));
+app.use('/api/season-passes', require('./routes/seasonPassRoutes'));
+app.use('/api/outbound-webhooks', require('./routes/outboundWebhookRoutes'));
+app.use('/api/dashboard', require('./routes/dashboardRoutes'));
+app.use('/api/saved-filters', require('./routes/savedFilterRoutes'));
 app.use('/api/users', userRoutes);
 app.use('/api/events', eventRoutes);
 app.use('/api/registrations', registrationRoutes);
@@ -678,6 +683,8 @@ app.get('/docs', async (req, res) => {
        request:{ body:{ attendees:[{ id:'att-uuid-...', eventOptionId:'opt-uuid-...', name:'Sam Smith', email:'sam@example.com' },{ eventOptionId:'opt-uuid-...', name:'Alex Smith' }], ticketDelivery:'each' }},
        responses:[{ status:200, desc:'Saved', body:{ id:'reg-uuid-...', ticketDelivery:'each', attendees:[{ id:'att-uuid-...', name:'Sam Smith', ticket:{ id:'tkt-uuid-...', isUsed:false }}] }}]},
      { method:'POST', path:'/api/registrations/:id/attendees/:attendeeId/send-form-link', auth:'user+', desc:'Email/WhatsApp a named attendee the link to fill in their own attendee form' },
+      { method:'POST', path:'/api/registrations/bulk', auth:'supervisor+', desc:'Bulk actions on ticked registrations (up to 500), each run through the same code as doing it one at a time: action "markPaid" { method: cash|eft|card|other, paidAt? } records the balance; "cancel"; "moveOption" { fromOptionId, toOptionId } (same event); "allocate" { setId, groupId } places their named people; "message" { channel: email|whatsapp, subject?, text } sends an event update. Answers { action, done, skipped, failed, results: [{ id, ok, skipped?, message }] }. Campus-checked for every id; payments and ticket changes refused in licence read-only mode. Audited as registrations_bulk',
+        request:{ body:{ action:'markPaid', registrationIds:['reg-uuid-1','reg-uuid-2'], method:'cash' } } },
      { method:'POST', path:'/api/registrations/manual', auth:'supervisor+', desc:'Manually create a registration (at-the-door / walk-in). Resolves early-bird tier pricing (including per-variant tiers) and stores priceSnapshot + appliedTierId on each option. Creates or finds a matching user by email/phone. If a matching user is found, updates their notificationPreference and backfills a missing phone number or guest placeholder email with the newly supplied value (without overwriting existing contact info). Generates a Yoco checkout link for unpaid registrations to include in the self-service notification email.',
        request:{ body:{ eventId:'ev-uuid-...', user:{ name:'Jane Doe', email:'jane@example.com', phoneNumber:'0821234567' }, options:[{ eventOptionId:'opt-uuid-...', quantity:1, variantId:'var-uuid-...' }], notificationPreference:'email' }},
        responses:[{ status:201, desc:'Created', body:{ id:'reg-uuid-new', status:'pending' }}]},
@@ -997,6 +1004,55 @@ app.get('/docs', async (req, res) => {
      { method:'POST', path:'/api/kids/events/:eventId/sync', auth:'staff+', desc:'Sync an offline desk\'s check-ins and check-outs (idempotent by clientId). Audited as kids_offline_sync' },
    ]},

+    { title: 'Event series', base: '/api/series', endpoints: [
+      { method:'GET', path:'/api/series', auth:'supervisor+', desc:'Every series with followers, eventCount and its events (campus-scoped staff see only their campuses\' events in each)' },
+      { method:'POST', path:'/api/series', auth:'supervisor+', desc:'Create a series (slug made from the name when not given). Audited as series_created',
+        request:{ body:{ name:'Family Camp', slug:'family-camp', description:'Every year in March', picture:null } } },
+      { method:'PUT', path:'/api/series/:id', auth:'supervisor+', desc:'Change a series. Audited as series_updated' },
+      { method:'DELETE', path:'/api/series/:id', auth:'admin', desc:'Delete a series; its events stay without a series and followers are dropped. Audited as series_deleted' },
+      { method:'GET', path:'/api/series/by-slug/:slug', auth:'public', desc:'The series page: details, upcoming and past public events, and following (signed in)' },
+      { method:'POST', path:'/api/series/:id/follow', auth:'user', desc:'Follow a series: an email (News & announcements) when a new event in it goes live' },
+      { method:'DELETE', path:'/api/series/:id/follow', auth:'user', desc:'Unfollow a series' },
+      { method:'GET', path:'/api/series/:id/compare', auth:'supervisor+', desc:'Year on year: registrations, tickets, income (as on the dashboard), checked in (average per session on multi-session events) and attendance rate per event in the series, oldest first, with the % change from the one before. Campus-scoped staff: their campuses\x27 events only' },
+    ]},
+
+    { title: 'Saved filters', base: '/api/saved-filters', endpoints: [
+      { method:'GET', path:'/api/saved-filters?page=', auth:'staff+', desc:'My saved filters for a list page (registrations, users, events, reports), default first' },
+      { method:'POST', path:'/api/saved-filters', auth:'staff+', desc:'Save (or replace by name) a filter: { page, name, params, isDefault? }. Up to 30 per page; making one the default clears the old default',
+        request:{ body:{ page:'registrations', name:'Camp — unpaid', params:{ event:'ev-uuid', status:'pending' }, isDefault:false } } },
+      { method:'PUT', path:'/api/saved-filters/:id', auth:'staff+', desc:'Rename it, or make it (or stop it being) my default — my own only' },
+      { method:'DELETE', path:'/api/saved-filters/:id', auth:'staff+', desc:'Delete one of my saved filters' },
+    ]},
+
+    { title: 'Dashboard and command palette', base: '/api/dashboard', endpoints: [
+      { method:'GET', path:'/api/dashboard/today', auth:'staff+', desc:'Events on today (or with a session today): places, people checked in today, children in now, volunteers rostered/checked in. Supervisors and admins also get money in (today, last 7 days) and "waiting" items: unpaid registrations for the next two weeks, parental consent, waitlist, cover requests, roster gaps, and for admins cashups due, provider payments to reconcile, privacy requests, failed webhooks. Campus-scoped' },
+      { method:'GET', path:'/api/dashboard/search?q=', auth:'staff+', desc:'Command palette search: events; supervisors also payments by amount ("R450"); admins also people and registrations by reference. { results: [{ type, id, title, subtitle, href }] }' },
+    ]},
+
+    { title: 'Outbound webhooks', base: '/api/outbound-webhooks', endpoints: [
+      { method:'GET', path:'/api/outbound-webhooks', auth:'admin', desc:'Endpoints (with last-week delivery counts per status) and the event types: registration.created, registration.paid, registration.cancelled, payment.received, payment.refunded, ticket.checked_in, user.created, event.published' },
+      { method:'POST', path:'/api/outbound-webhooks', auth:'admin', desc:'Add an endpoint (https, public address). The answer holds the signing secret — shown only now. Also added to the POPIA operator register. Audited as webhook_endpoint_changed',
+        request:{ body:{ name:'ChurchSuite sync', url:'https://example.com/hooks/cross-events', events:['registration.paid','ticket.checked_in'] } } },
+      { method:'PUT', path:'/api/outbound-webhooks/:id', auth:'admin', desc:'Change name, url, events or isActive' },
+      { method:'DELETE', path:'/api/outbound-webhooks/:id', auth:'admin', desc:'Delete an endpoint and its deliveries (its operator entry is marked inactive)' },
+      { method:'POST', path:'/api/outbound-webhooks/:id/rotate-secret', auth:'admin', desc:'A new signing secret (the old one stops at once)' },
+      { method:'POST', path:'/api/outbound-webhooks/:id/test', auth:'admin', desc:'Send a webhook.test now; answers { status, statusCode, error }' },
+      { method:'GET', path:'/api/outbound-webhooks/:id/deliveries?status=&limit=', auth:'admin', desc:'Delivery log, newest first, with payloads (kept 30 days)' },
+      { method:'POST', path:'/api/outbound-webhooks/deliveries/:id/resend', auth:'admin', desc:'Send a delivery again now' },
+    ]},
+
+    { title: 'Season passes', base: '/api/season-passes', endpoints: [
+      { method:'GET', path:'/api/season-passes?seriesId=', auth:'supervisor+', desc:'A series\x27 passes: events, normal prices, each event\x27s share, sold and unpaid counts' },
+      { method:'POST', path:'/api/season-passes', auth:'supervisor+', desc:'Create a pass. Events must be in the series; not youth (consent) events, staff-only or per-session tickets. Campus-scoped supervisors: only their campuses\x27 events. Audited as season_pass_changed',
+        request:{ body:{ seriesId:'series-uuid', name:'2027 breakfasts', price:400, saleEndsAt:null, items:[{ eventId:'ev-uuid', eventOptionId:'opt-uuid', variantId:null }] } } },
+      { method:'PUT', path:'/api/season-passes/:id', auth:'supervisor+', desc:'Change a pass (events and price only while nobody has bought it; 409 otherwise)' },
+      { method:'DELETE', path:'/api/season-passes/:id', auth:'supervisor+', desc:'Delete a pass nobody has bought' },
+      { method:'POST', path:'/api/season-passes/:id/buy', auth:'user', desc:'Buy passes: a registration at every event (lines priced at each event\x27s share), then one checkout for the total (redirectUrl), or tickets straight away when free. 409 when not on sale or an event has too few places',
+        request:{ body:{ quantity:2 } }, responses:[{ status:201, desc:'Bought', body:{ purchaseId:'uuid', total:800, paid:false, redirectUrl:'https://…', provider:'yoco', message:null } }] },
+      { method:'POST', path:'/api/season-passes/purchases/:id/checkout', auth:'user', desc:'Pay what is still owed on my purchase (a new checkout)' },
+      { method:'GET', path:'/api/season-passes/mine', auth:'user', desc:'My pass purchases with their registrations' },
+    ]},
+
    { title: 'Volunteer rosters', base: '/api/volunteers', endpoints: [
      { method:'GET', path:'/api/volunteers/me', auth:'user', desc:'My shifts (upcoming and the last week), cover requests I could take, and events looking for volunteers' },
      { method:'GET', path:'/api/volunteers/events/:eventId', auth:'user', desc:'An event\'s serving roles: shift, how many are needed and signed up, whether I\'m in it, open cover requests' },
@@ -49,6 +49,14 @@ const JOBS = [
    name: 'volunteers', label: 'Volunteer reminders the day before a shift', cron: '*/15 * * * *', env: 'VOLUNTEER_JOBS_ENABLED',
    run: () => require('../utils/volunteers').runReminderJob(),
  },
+  {
+    name: 'webhooks', label: 'Outbound webhooks: send what is due, retry failures, delete deliveries after 30 days', cron: '* * * * *', env: 'WEBHOOKS_JOBS_ENABLED',
+    run: () => require('../utils/webhooks').runJob(),
+  },
+  {
+    name: 'series', label: 'Event series: tell followers when a new event goes live', cron: '*/15 * * * *', env: 'SERIES_JOBS_ENABLED',
+    run: () => require('../utils/series').runAnnounceJob(),
+  },
  {
    name: 'consent', label: 'Parental consent reminders and medical-detail deletion', cron: '0 9 * * *', env: 'CONSENT_JOBS_ENABLED',
    run: async () => {
@@ -19,6 +19,12 @@ async function checkoutPaid(checkout) {
  const refs = [checkout.id, checkout.externalId].filter(Boolean);
  const tx = await prisma.providerTransaction.findFirst({ where: { checkoutId: { in: refs }, paymentId: { not: null } }, select: { id: true } });
  if (tx) return true;
+  // A season pass checkout: paid once its purchase is.
+  const purchaseId = checkout.metadata?.purchaseId;
+  if (purchaseId) {
+    const purchase = await prisma.seasonPassPurchase.findUnique({ where: { id: String(purchaseId) }, select: { status: true } });
+    return purchase?.status === 'paid';
+  }
  const registrationId = checkout.metadata?.registrationId;
  if (!registrationId) return false;
  const reg = await prisma.registration.findUnique({ where: { id: String(registrationId) }, select: { status: true } });
@@ -71,7 +71,9 @@ const handleProviderWebhook = (providerId) => async (req, res) => {
        if (!existingRegistration) {
          const meta = tx.metadata || {};
          const isDonation = meta.type === 'donation' || !!meta.isDonation || !!meta.eventId;
-          if (!isDonation) {
+          // A season pass checkout belongs to its purchase, not to one registration.
+          const isSeasonPass = meta.type === 'season_pass' && !!meta.purchaseId;
+          if (!isDonation && !isSeasonPass) {
            try { await saveProviderTransaction(provider.id, event, body); } catch (e) { console.warn('Failed to save unreconciled transaction:', e?.message || e); }
            return res.status(200).json({
              success: true,
@@ -141,6 +143,11 @@ async function recordSucceededPayment(providerId, event, body) {
    return { status: 'already_processed', paymentId: existingPayment.id, externalId };
  }

+  // Season pass: split over the purchase's registrations, one Payment per event.
+  if (metadata.type === 'season_pass' && metadata.purchaseId) {
+    return require('../utils/seasonPass').recordPassPayment(providerId, event, body);
+  }
+
  let registration = null;
  const refs = event.checkoutRefs || [checkoutId].filter(Boolean);
  if (refs.length) registration = await prisma.registration.findFirst({ where: { checkoutId: { in: refs } }, include: REG_INCLUDE });
@@ -0,0 +1,23 @@
+const express = require('express');
+const router = express.Router();
+const { protect, staff } = require('../middleware/authMiddleware');
+const { scopeList } = require('../utils/campusScope');
+const dashboard = require('../utils/dashboard');
+
+// Both follow the person's campus scope inside utils/dashboard.js.
+
+// @desc    Today's events and how they're going, money in, and what's waiting (1.49.0)
+// @route   GET /api/dashboard/today
+// @access  Private/Staff (money and waiting items for supervisors and admins)
+router.get('/today', protect, staff, scopeList, async (req, res) => {
+  try { res.json(await dashboard.today(req)); } catch (e) { res.status(400).json({ message: e.message }); }
+});
+
+// @desc    Command palette search (?q=): events; supervisors also payments by amount; admins people and registrations
+// @route   GET /api/dashboard/search
+// @access  Private/Staff
+router.get('/search', protect, staff, scopeList, async (req, res) => {
+  try { res.json({ results: await dashboard.search(req, req.query.q) }); } catch (e) { res.status(400).json({ message: e.message }); }
+});
+
+module.exports = router;
@@ -0,0 +1,17 @@
+const express = require('express');
+const router = express.Router();
+const { list, create, update, remove, rotateSecret, test, deliveries, resend } = require('../controllers/outboundWebhookController');
+const { protect, admin } = require('../middleware/authMiddleware');
+
+// Outbound webhooks (1.48.0): admins only. Payment provider webhooks *into* the site are /api/webhooks/<provider>.
+router.use(protect, admin);
+router.get('/', list);
+router.post('/', create);
+router.post('/deliveries/:id/resend', resend);
+router.put('/:id', update);
+router.delete('/:id', remove);
+router.post('/:id/rotate-secret', rotateSecret);
+router.post('/:id/test', test);
+router.get('/:id/deliveries', deliveries);
+
+module.exports = router;
@@ -21,6 +21,7 @@ const {
  saveNoticeDraft,
  discardNoticeDraft,
  publishNotice,
+  markBuiltInReviewed,
  listOperators,
  createOperator,
  updateOperator,
@@ -64,6 +65,7 @@ router.get('/notice/draft', protect, admin, getNoticeDraft);
 router.put('/notice/draft', protect, admin, saveNoticeDraft);
 router.delete('/notice/draft', protect, admin, discardNoticeDraft);
 router.post('/notice/publish', protect, admin, publishNotice);
+router.post('/notice/builtin-reviewed', protect, admin, markBuiltInReviewed);

 // Admin: operator register, consent log, access log
 router.get('/operators', protect, admin, listOperators);
@@ -17,7 +17,8 @@ const {
  updateAttendees, sendAttendeeFormLink,
 } = require('../controllers/registrationController');
 const { protect, supervisor, staff, optionalAuth } = require('../middleware/authMiddleware');
-const { scopeEvent, scopeList } = require('../utils/campusScope');
+const { scopeEvent, scopeList, scopeBody } = require('../utils/campusScope');
+const { notOnSeasonPass } = require('../utils/seasonPass');

 // Campus-scoped staff (utils/campusScope.js). Routes open to the registration's owner as well
 // as to staff check staff against the registration's event, and let the owner through (ownerOk).
@@ -25,10 +26,10 @@ const { scopeEvent, scopeList } = require('../utils/campusScope');
 // Registration - auth optional when event doesn't require it
 router.post('/', optionalAuth, createRegistration);
 router.get('/myregistrations', protect, getUserRegistrations);
-router.put('/:id/options', protect, scopeEvent({ resolve: 'registration', ownerOk: true }), updateRegistrationOptions);
+router.put('/:id/options', protect, scopeEvent({ resolve: 'registration', ownerOk: true }), notOnSeasonPass, updateRegistrationOptions);
 router.delete('/:id', protect, scopeEvent({ resolve: 'registration', ownerOk: true }), cancelRegistration);
 router.post('/:id/send-invoice', protect, scopeEvent({ resolve: 'registration', ownerOk: true }), sendInvoice);
-router.post('/:id/coupon', protect, scopeEvent({ resolve: 'registration', ownerOk: true }), applyCoupon);
+router.post('/:id/coupon', protect, scopeEvent({ resolve: 'registration', ownerOk: true }), notOnSeasonPass, applyCoupon);
 router.delete('/:id/coupon', protect, staff, scopeEvent({ resolve: 'registration' }), removeCoupon);
 router.put('/:id/attendees', protect, scopeEvent({ resolve: 'registration', ownerOk: true }), updateAttendees);
 router.post('/:id/attendees/:attendeeId/send-form-link', protect, scopeEvent({ resolve: 'registration', ownerOk: true }), sendAttendeeFormLink);
@@ -45,5 +46,9 @@ router.get('/', protect, staff, scopeList, getRegistrations);
 router.put('/:id', protect, staff, scopeEvent({ resolve: 'registration' }), updateRegistrationStatus);
 router.get('/event/:eventId', protect, staff, scopeEvent(), getRegistrationsByEvent);
 router.post('/manual', protect, supervisor, scopeEvent({ from: req => req.body?.eventId }), createManualRegistration);
+// Bulk actions (1.49.1): every ticked registration must be one this person may manage.
+router.post('/bulk', protect, supervisor, scopeBody([['registrationIds', 'registration']], { orphan: 'deny' }), async (req, res) => {
+  try { res.json(await require('../utils/bulkRegistrations').runBulk(req, req.body || {})); } catch (e) { res.status(e.statusCode || 400).json({ message: e.message }); }
+});

 module.exports = router;
@@ -0,0 +1,24 @@
+const express = require('express');
+const router = express.Router();
+const { protect, staff } = require('../middleware/authMiddleware');
+const { campusIndependent } = require('../utils/campusScope');
+const filters = require('../utils/savedFilters');
+
+const OWN = campusIndependent('a person\'s own saved filters (the lists they filter are campus-checked themselves)');
+const fail = (res, e) => res.status(e.statusCode || 400).json({ message: e.message });
+
+// Saved filters on list pages (1.49.2) — always the signed-in person's own.
+router.get('/', protect, staff, OWN, async (req, res) => {
+  try { res.json(await filters.list(req.user.id, req.query.page)); } catch (e) { fail(res, e); }
+});
+router.post('/', protect, staff, OWN, async (req, res) => {
+  try { res.status(201).json(await filters.save(req.user.id, req.body || {})); } catch (e) { fail(res, e); }
+});
+router.put('/:id', protect, staff, OWN, async (req, res) => {
+  try { res.json(await filters.update(req.user.id, req.params.id, req.body || {})); } catch (e) { fail(res, e); }
+});
+router.delete('/:id', protect, staff, OWN, async (req, res) => {
+  try { await filters.remove(req.user.id, req.params.id); res.json({ ok: true }); } catch (e) { fail(res, e); }
+});
+
+module.exports = router;
@@ -0,0 +1,18 @@
+const express = require('express');
+const router = express.Router();
+const { listPasses, createPass, updatePass, deletePass, buy, payPurchase, myPurchases } = require('../controllers/seasonPassController');
+const { protect, supervisor } = require('../middleware/authMiddleware');
+const { campusIndependent } = require('../utils/campusScope');
+
+const SPANS = campusIndependent('a pass can span campuses; each event on it is checked against the person\'s campuses in the controller');
+
+router.get('/mine', protect, myPurchases);
+router.post('/:id/buy', protect, buy);
+router.post('/purchases/:id/checkout', protect, payPurchase);
+
+router.get('/', protect, supervisor, SPANS, listPasses);
+router.post('/', protect, supervisor, SPANS, createPass);
+router.put('/:id', protect, supervisor, SPANS, updatePass);
+router.delete('/:id', protect, supervisor, SPANS, deletePass);
+
+module.exports = router;
@@ -0,0 +1,21 @@
+const express = require('express');
+const router = express.Router();
+const { listSeries, createSeries, updateSeries, deleteSeries, getSeriesBySlug, followSeries, unfollowSeries, compare } = require('../controllers/seriesController');
+const { protect, admin, supervisor, optionalAuth } = require('../middleware/authMiddleware');
+const { campusIndependent, scopeList } = require('../utils/campusScope');
+
+const SPANS = campusIndependent('a series spans campuses; adding an event to one is checked on the event');
+
+router.get('/by-slug/:slug', optionalAuth, getSeriesBySlug);
+router.post('/:id/follow', protect, followSeries);
+router.delete('/:id/follow', protect, unfollowSeries);
+
+// The list filters each series' events by the person's campuses itself.
+router.get('/', protect, supervisor, SPANS, listSeries);
+router.post('/', protect, supervisor, SPANS, createSeries);
+router.put('/:id', protect, supervisor, SPANS, updateSeries);
+router.delete('/:id', protect, admin, deleteSeries);
+// Year-on-year report: only the events the person may see (filtered in the controller).
+router.get('/:id/compare', protect, supervisor, scopeList, compare);
+
+module.exports = router;
@@ -0,0 +1,192 @@
+/**
+ * Bulk actions on registrations (1.49.1): the registrations list lets a supervisor or admin tick
+ * many and act on them at once — mark paid, cancel, move to another ticket, put in a room or
+ * group, or send a message.
+ *
+ * Each action runs the same code as doing it one at a time (the controllers' own handlers, called
+ * in-process), so every rule still applies: closed events, payment caps and overpayments becoming
+ * donations, tickets and emails on payment, coupons released and the waitlist offered on
+ * cancelling, pricing on a ticket change, room capacity and gender, and the privacy rules and
+ * footers on messages. Results come back per registration; one failing doesn't stop the rest.
+ */
+
+const prisma = require('../config/db');
+
+const MAX = 500;
+const ACTIONS = ['markPaid', 'cancel', 'moveOption', 'allocate', 'message'];
+const METHODS = ['cash', 'eft', 'card', 'other'];
+
+function bulkError(message, statusCode = 400) {
+  const err = new Error(message);
+  err.statusCode = statusCode;
+  return err;
+}
+
+/** Calls an Express handler in-process; resolves to { ok, status, body }. */
+function call(handler, req) {
+  return new Promise((resolve) => {
+    const res = {
+      statusCode: 200,
+      status(code) { this.statusCode = code; return this; },
+      json(body) { resolve({ ok: this.statusCode < 400, status: this.statusCode, body }); return this; },
+      send(body) { resolve({ ok: this.statusCode < 400, status: this.statusCode, body }); return this; },
+    };
+    Promise.resolve(handler({ query: {}, params: {}, body: {}, headers: {}, ip: req.ip, ...req }, res))
+      .catch(e => resolve({ ok: false, status: 500, body: { message: e?.message || String(e) } }));
+  });
+}
+
+/** Who is asking, with their request's headers and socket (so audit entries keep the real IP). */
+const from = req => ({ user: req.user, headers: req.headers || {}, socket: req.socket });
+
+const messageOf = r => r.body?.message || (r.ok ? 'Done' : `Failed (${r.status})`);
+
+async function markPaid(req, regs, { method, paidAt }) {
+  if (!METHODS.includes(method)) throw bulkError('Choose how it was paid (cash, EFT, card or other)');
+  const { createPayment } = require('../controllers/paymentController');
+  const { refreshPricingForRegistration, computeRegistrationTotalDue } = require('./pricing');
+  const out = [];
+  for (const r of regs) {
+    if (r.status === 'cancelled') { out.push({ id: r.id, ok: false, message: 'Cancelled — not paid' }); continue; }
+    try { await refreshPricingForRegistration(r.id); } catch { /* the payment code refreshes too */ }
+    const fresh = await prisma.registration.findUnique({ where: { id: r.id }, include: { registrationOptions: { include: { eventOption: { include: { earlyBirdTiers: true } }, tranches: true } }, payments: true } });
+    const owed = Math.round((computeRegistrationTotalDue(fresh, new Date()) - fresh.payments.reduce((s, p) => s + p.amount, 0)) * 100) / 100;
+    if (owed <= 0) { out.push({ id: r.id, ok: true, skipped: true, message: 'Already paid' }); continue; }
+    const res = await call(createPayment, { ...from(req), body: { amount: owed, method, registrationId: r.id, userId: r.userId, ...(paidAt ? { paidAt } : {}) } });
+    out.push({ id: r.id, ok: res.ok, message: res.ok ? `R${owed.toFixed(2)} recorded` : messageOf(res) });
+  }
+  return out;
+}
+
+async function cancel(req, regs) {
+  const { cancelRegistration } = require('../controllers/registrationController');
+  const out = [];
+  for (const r of regs) {
+    if (r.status === 'cancelled') { out.push({ id: r.id, ok: true, skipped: true, message: 'Already cancelled' }); continue; }
+    const res = await call(cancelRegistration, { ...from(req), params: { id: r.id } });
+    out.push({ id: r.id, ok: res.ok, message: res.ok ? 'Cancelled' : messageOf(res) });
+  }
+  return out;
+}
+
+/**
+ * Moves every place on `fromOptionId` to `toOptionId`, keeping the same lines, tickets (and their
+ * QR codes) and named people — the editing screen can't take issued tickets away, but a move
+ * doesn't need to. Each moved line is repriced at the new ticket's current price (early birds and
+ * staff prices as for a new registration); the status follows what's now paid against owed, so
+ * moving up shows the difference owing and moving down shows the overpayment. Places on the new
+ * ticket are checked first.
+ */
+async function moveOption(req, regs, { fromOptionId, toOptionId }) {
+  if (!fromOptionId || !toOptionId || fromOptionId === toOptionId) throw bulkError('Choose the ticket to move from and the one to move to');
+  const options = await prisma.eventOption.findMany({ where: { id: { in: [fromOptionId, toOptionId] } }, include: { earlyBirdTiers: true, event: { select: { id: true, cashupStatus: true, kidsOptionId: true, volunteerOptionId: true } } } });
+  if (options.length !== 2 || options[0].eventId !== options[1].eventId) throw bulkError('Both tickets must belong to the same event');
+  const target = options.find(o => o.id === toOptionId);
+  const event = target.event;
+  if (event.cashupStatus === 'closed') throw bulkError('This event is closed. Reopen it (admin only) before making changes.');
+  if ([event.kidsOptionId, event.volunteerOptionId].includes(toOptionId)) throw bulkError('The kids and volunteer tickets are handed out by staff, not moved to');
+  const { resolveOptionPrice } = require('./pricing');
+  const { remainingFor } = require('./stock');
+  const { updateRegistrationStatus } = require('../payments/webhook');
+  const out = [];
+  for (const r of regs) {
+    if (r.eventId !== event.id) { out.push({ id: r.id, ok: false, message: 'Not for this event' }); continue; }
+    if (r.status === 'cancelled') { out.push({ id: r.id, ok: false, message: 'Cancelled' }); continue; }
+    if (r.seasonPassPurchaseId) { out.push({ id: r.id, ok: false, message: 'Part of a season pass — tickets can\'t be changed' }); continue; }
+    const lines = await prisma.registrationOption.findMany({ where: { registrationId: r.id, eventOptionId: fromOptionId, sessionId: null }, select: { id: true, quantity: true } });
+    if (!lines.length) { out.push({ id: r.id, ok: true, skipped: true, message: 'No such ticket to move' }); continue; }
+    const qty = lines.reduce((s, l) => s + l.quantity, 0);
+    const left = await remainingFor(target, null);
+    if (left !== null && left < qty) { out.push({ id: r.id, ok: false, message: `Only ${left} place${left === 1 ? '' : 's'} left on ${target.name}` }); continue; }
+    try {
+      const owner = await prisma.user.findUnique({ where: { id: r.userId }, select: { role: true } });
+      const { price, tierId } = await resolveOptionPrice(target, qty, owner);
+      await prisma.$transaction(async tx => {
+        for (const line of lines) {
+          await tx.registrationOption.update({ where: { id: line.id }, data: { eventOptionId: toOptionId, variantId: null, priceSnapshot: price, appliedTierId: tierId || null } });
+          await tx.registrationOptionTranche.deleteMany({ where: { registrationOptionId: line.id } });
+          await tx.registrationOptionTranche.create({ data: { registrationOptionId: line.id, quantity: line.quantity, priceSnapshot: price, appliedTierId: tierId || null } });
+          await tx.attendee.updateMany({ where: { registrationOptionId: line.id }, data: { eventOptionId: toOptionId, variantId: null } });
+        }
+      });
+      const updated = await updateRegistrationStatus(r.id);
+      const diff = Math.round(((updated.totalDue || 0) - (updated.totalPaid || 0)) * 100) / 100;
+      out.push({ id: r.id, ok: true, message: diff > 0 ? `Moved — R${diff.toFixed(2)} now owing` : diff < 0 ? `Moved — R${(-diff).toFixed(2)} overpaid` : 'Moved' });
+    } catch (e) {
+      out.push({ id: r.id, ok: false, message: e?.message || 'Couldn\'t move' });
+    }
+  }
+  return out;
+}
+
+async function allocate(req, regs, { setId, groupId }) {
+  if (!setId || !groupId) throw bulkError('Choose the group to put them in');
+  const { assign } = require('../controllers/allocationController');
+  const out = [];
+  for (const r of regs) {
+    const people = await prisma.attendee.findMany({ where: { registrationId: r.id }, select: { id: true, name: true } });
+    if (!people.length) { out.push({ id: r.id, ok: false, message: 'No named people on this registration to place' }); continue; }
+    const fails = [];
+    for (const a of people) {
+      const res = await call(assign, { ...from(req), params: { id: setId }, body: { attendeeId: a.id, groupId } });
+      if (!res.ok) fails.push(`${a.name}: ${messageOf(res)}`);
+    }
+    out.push({ id: r.id, ok: fails.length === 0, message: fails.length ? fails.join('; ') : `${people.length} placed` });
+  }
+  return out;
+}
+
+async function message(req, regs, { channel, subject, text }) {
+  if (!['email', 'whatsapp'].includes(channel)) throw bulkError('Choose email or WhatsApp');
+  if (!String(text || '').trim()) throw bulkError('Write the message');
+  if (channel === 'email' && !String(subject || '').trim()) throw bulkError('Give the email a subject');
+  const { emailEventAttendees, whatsappEventAttendees } = require('../controllers/eventController');
+  const byEvent = new Map();
+  for (const r of regs) byEvent.set(r.eventId, [...(byEvent.get(r.eventId) || []), r.id]);
+  const out = [];
+  for (const [eventId, ids] of byEvent) {
+    // An event update to the people ticked (they registered, so it goes even to those who opted out of news).
+    const body = channel === 'email'
+      ? { subject, text, kind: 'update', filter: { registrationIds: ids } }
+      : { message: text, kind: 'update', filter: { registrationIds: ids } };
+    const res = await call(channel === 'email' ? emailEventAttendees : whatsappEventAttendees, { ...from(req), params: { id: eventId }, body });
+    for (const id of ids) out.push({ id, ok: res.ok, message: res.ok ? `Sent with ${res.body?.sent ?? res.body?.matched ?? ids.length} for this event` : messageOf(res) });
+  }
+  return out;
+}
+
+/**
+ * Runs one bulk action. Returns { action, done, skipped, failed, results: [{ id, ok, skipped?, message }] }.
+ */
+async function runBulk(req, { action, registrationIds, ...params }) {
+  if (!ACTIONS.includes(action)) throw bulkError('Unknown bulk action');
+  const ids = [...new Set((Array.isArray(registrationIds) ? registrationIds : []).map(String))];
+  if (!ids.length) throw bulkError('Tick at least one registration');
+  if (ids.length > MAX) throw bulkError(`At most ${MAX} at a time`);
+  // Read-only licence: no new payments or ticket changes (cancelling and messaging still work).
+  if (['markPaid', 'moveOption'].includes(action)) {
+    const { licenceStatus } = require('../hub/licence');
+    const status = await licenceStatus().catch(() => null);
+    if (status?.readOnly) throw bulkError('This site is read-only (licence), so payments and ticket changes can\'t be recorded.', 403);
+  }
+  const regs = await prisma.registration.findMany({ where: { id: { in: ids } }, include: { registrationOptions: { select: { eventOptionId: true, variantId: true, quantity: true, sessionId: true } } } });
+  const missing = ids.filter(id => !regs.some(r => r.id === id)).map(id => ({ id, ok: false, message: 'Not found' }));
+  const run = { markPaid, cancel, moveOption, allocate, message }[action];
+  const results = [...missing, ...(await run(req, regs, params))];
+  const { logAdminAction } = require('./adminAudit');
+  const { getClientIp } = require('./requestUtils');
+  logAdminAction({
+    actorId: req.user.id, actorRole: req.user.role, action: 'registrations_bulk', targetType: 'Registration',
+    metadata: { bulk: action, registrations: ids.length, done: results.filter(r => r.ok && !r.skipped).length, failed: results.filter(r => !r.ok).length },
+    ip: getClientIp({ headers: {}, ...req }),
+  });
+  return {
+    action,
+    done: results.filter(r => r.ok && !r.skipped).length,
+    skipped: results.filter(r => r.skipped).length,
+    failed: results.filter(r => !r.ok).length,
+    results,
+  };
+}
+
+module.exports = { runBulk, ACTIONS, MAX };
@@ -0,0 +1,249 @@
+/**
+ * The home dashboard for staff, supervisors and admins (1.49.0): what's on today, money in, and
+ * what's waiting for someone — plus the search behind the Ctrl+K command palette.
+ *
+ * Everything follows the person's campus scope (utils/campusScope.js): a campus-limited
+ * supervisor sees their campuses' events and church-wide ones. Items only some roles can act on
+ * (cashups, provider payments, privacy requests, webhooks) are shown to those roles only.
+ */
+
+const prisma = require('../config/db');
+const { scopeFor, eventWhere } = require('./campusScope');
+
+const DAY = 864e5;
+// The same "real money" as the dashboards: everything except legs that apply an earlier donation.
+const EXCLUDE_DONATION_LEGS = { NOT: { AND: [{ isDonation: false }, { originalPaymentId: { not: null } }, { amount: { gt: 0 } }] } };
+
+function dayBounds(now = new Date()) {
+  const start = new Date(now); start.setHours(0, 0, 0, 0);
+  return { start, end: new Date(start.getTime() + DAY - 1) };
+}
+
+const isAdmin = req => req.user?.role === 'admin';
+const isSupervisor = req => ['admin', 'supervisor'].includes(req.user?.role);
+
+/** Events on today (single-date events running today, or a session today), with how it's going. */
+async function todaysEvents(scopeWhere, now = new Date()) {
+  const { start, end } = dayBounds(now);
+  const events = await prisma.event.findMany({
+    where: {
+      AND: [scopeWhere, { isActive: true }, {
+        OR: [
+          { scheduleType: 'single', startDate: { lte: end }, endDate: { gte: start } },
+          { scheduleType: 'sessions', sessions: { some: { startsAt: { gte: start, lte: end }, cancelledAt: null } } },
+        ],
+      }],
+    },
+    orderBy: { startDate: 'asc' },
+    select: {
+      id: true, title: true, startDate: true, endDate: true, location: true, scheduleType: true, kidsCheckIn: true, isHidden: true,
+      campus: { select: { id: true, name: true, slug: true, colour: true } },
+      sessions: { where: { startsAt: { gte: start, lte: end }, cancelledAt: null }, orderBy: { startsAt: 'asc' }, select: { id: true, label: true, startsAt: true, endsAt: true } },
+    },
+  });
+  return Promise.all(events.map(async e => {
+    const session = e.sessions[0] || null;
+    const [places, scans, kidsIn, roles] = await Promise.all([
+      prisma.ticket.aggregate({ where: { eventId: e.id, registrationOption: { registration: { status: { not: 'cancelled' } } } }, _sum: { quantity: true } }),
+      prisma.ticketUsage.aggregate({ where: { ticket: { eventId: e.id }, scannedAt: { gte: start, lte: end } }, _sum: { quantityRedeemed: true } }),
+      e.kidsCheckIn ? prisma.kidsCheckIn.count({ where: { eventId: e.id, checkedOutAt: null, checkedInAt: { gte: start, lte: end } } }) : Promise.resolve(null),
+      prisma.servingRole.findMany({
+        where: { eventId: e.id, OR: [{ sessionId: null }, ...(session ? [{ sessionId: session.id }] : [])] },
+        select: { needed: true, slots: { select: { checkedInAt: true } } },
+      }),
+    ]);
+    return {
+      id: e.id, title: e.title, location: e.location, campus: e.campus, isHidden: e.isHidden, kidsCheckIn: e.kidsCheckIn,
+      startsAt: session ? session.startsAt : e.startDate, endsAt: session ? session.endsAt : e.endDate,
+      sessionLabel: session ? session.label : null,
+      places: places._sum.quantity || 0,
+      checkedIn: scans._sum.quantityRedeemed || 0,
+      kidsIn,
+      volunteers: roles.length ? {
+        needed: roles.reduce((s, r) => s + r.needed, 0),
+        rostered: roles.reduce((s, r) => s + r.slots.length, 0),
+        checkedIn: roles.reduce((s, r) => s + r.slots.filter(x => x.checkedInAt).length, 0),
+      } : null,
+    };
+  }));
+}
+
+/** Money in today and over the last 7 days (the person's events, or everything for the unscoped). */
+async function moneyIn(scope, now = new Date()) {
+  const { start } = dayBounds(now);
+  const weekStart = new Date(start.getTime() - 6 * DAY);
+  const where = from => ({ ...EXCLUDE_DONATION_LEGS, createdAt: { gte: from }, ...(scope ? { event: eventWhere(scope) } : {}) });
+  const [today, week] = await Promise.all([
+    prisma.payment.aggregate({ where: where(start), _sum: { amount: true }, _count: { _all: true } }),
+    prisma.payment.aggregate({ where: where(weekStart), _sum: { amount: true } }),
+  ]);
+  return { today: today._sum.amount || 0, todayCount: today._count._all, week: week._sum.amount || 0 };
+}
+
+/**
+ * What's waiting for someone: each { key, label, count, href, tone }, only those with a count.
+ * `href` takes the person to where it's dealt with.
+ */
+async function pendingItems(req, scope, now = new Date()) {
+  const upcoming = { startDate: { gte: now } };
+  const scoped = (extra = {}) => ({ AND: [eventWhere(scope), extra] });
+  const soon = new Date(now.getTime() + 14 * DAY);
+  const week = new Date(now.getTime() + 7 * DAY);
+  const items = [];
+  const push = async (key, fn) => {
+    try {
+      const item = await fn();
+      if (item && item.count > 0) items.push({ key, ...item });
+    } catch (e) {
+      console.warn(`[dashboard] ${key}:`, e?.message || e);
+    }
+  };
+
+  await Promise.all([
+    push('unpaid', async () => ({
+      label: 'Unpaid or part-paid registrations for events in the next two weeks',
+      count: await prisma.registration.count({ where: { status: { in: ['pending', 'partial_paid'] }, event: scoped({ startDate: { gte: now, lte: soon }, isActive: true }) } }),
+      href: isAdmin(req) ? '/dashboard/admin/registrations?status=pending' : '/dashboard/supervisor/reports?report=regStatus',
+      tone: 'amber',
+    })),
+    push('consent', async () => {
+      const pending = await prisma.consentRequest.findMany({ where: { status: 'pending', event: scoped(upcoming) }, select: { attendeeId: true }, distinct: ['attendeeId'] });
+      const given = new Set((await prisma.consentRequest.findMany({ where: { status: 'given', attendeeId: { in: pending.map(p => p.attendeeId) } }, select: { attendeeId: true } })).map(g => g.attendeeId));
+      return { label: 'Young people still waiting for parental consent', count: pending.filter(p => !given.has(p.attendeeId)).length, href: '/dashboard/supervisor/consent', tone: 'rose' };
+    }),
+    push('waitlist', async () => ({
+      label: 'People on a waitlist',
+      count: await prisma.waitlistEntry.count({ where: { status: 'waiting', event: scoped(upcoming) } }),
+      href: '/dashboard/supervisor/waitlist',
+      tone: 'blue',
+    })),
+    push('cover', async () => ({
+      label: 'Volunteers asking for someone to cover their shift',
+      count: await prisma.volunteerSwap.count({ where: { status: 'open', role: { event: scoped({ endDate: { gte: now } }) } } }),
+      href: '/dashboard/supervisor/volunteers',
+      tone: 'violet',
+    })),
+    push('roster', async () => {
+      const roles = await prisma.servingRole.findMany({
+        where: {
+          event: scoped({ isActive: true }),
+          OR: [{ session: { startsAt: { gte: now, lte: week } } }, { sessionId: null, event: { startDate: { gte: now, lte: week } } }],
+        },
+        select: { needed: true, _count: { select: { slots: true } } },
+      });
+      return { label: 'Serving roles in the next week that still need people', count: roles.filter(r => r._count.slots < r.needed).length, href: '/dashboard/supervisor/volunteers', tone: 'violet' };
+    }),
+    isAdmin(req) && push('cashup', async () => ({
+      label: 'Past events still to cash up',
+      count: await prisma.event.count({ where: { cashupStatus: 'open', endDate: { lt: new Date(now.getTime() - DAY), gte: new Date(now.getTime() - 120 * DAY) }, payments: { some: {} } } }),
+      href: '/dashboard/admin/cashup',
+      tone: 'green',
+    })),
+    (isAdmin(req) || (isSupervisor(req) && !scope)) && push('reconcile', async () => ({
+      label: 'Online payments that didn\'t match a registration (reconcile them)',
+      count: await prisma.providerTransaction.count({ where: { reconciled: false, ignored: false } }),
+      href: '/dashboard/supervisor/payments',
+      tone: 'amber',
+    })),
+    isAdmin(req) && push('privacy', async () => ({
+      label: 'Privacy requests to answer',
+      count: await prisma.dataRequest.count({ where: { status: 'open' } }),
+      href: '/dashboard/admin/data-requests',
+      tone: 'rose',
+    })),
+    isAdmin(req) && push('webhooks', async () => ({
+      label: 'Webhook deliveries that failed this week',
+      count: await prisma.webhookDelivery.count({ where: { status: 'failed', createdAt: { gte: new Date(now.getTime() - 7 * DAY) } } }),
+      href: '/dashboard/admin/settings?tab=webhooks',
+      tone: 'rose',
+    })),
+  ].filter(Boolean));
+  const order = ['privacy', 'consent', 'unpaid', 'cover', 'roster', 'waitlist', 'reconcile', 'cashup', 'webhooks'];
+  return items.sort((a, b) => order.indexOf(a.key) - order.indexOf(b.key));
+}
+
+async function today(req, now = new Date()) {
+  const scope = await scopeFor(req);
+  const [events, money, pending] = await Promise.all([
+    todaysEvents(eventWhere(scope), now),
+    isSupervisor(req) ? moneyIn(scope, now) : Promise.resolve(null),
+    isSupervisor(req) ? pendingItems(req, scope, now) : Promise.resolve([]),
+  ]);
+  return { events, money, pending };
+}
+
+// ─── Command palette search ──────────────────────────────────────────────────
+
+/** "R450", "450", "r 450.50" → 450.5; anything else → null. Pure. */
+function amountOf(q) {
+  const m = /^r?\s*(\d{1,7}(?:[.,]\d{1,2})?)$/i.exec(String(q || '').trim());
+  return m ? parseFloat(m[1].replace(',', '.')) : null;
+}
+
+/**
+ * Results for the command palette: events (everyone with dashboard access), and for supervisors
+ * payments by amount ("R450"); for admins also people and registrations. Each { type, id, title,
+ * subtitle, href }. Up to 5 of each kind.
+ */
+async function search(req, rawQuery, now = new Date()) {
+  const q = String(rawQuery || '').trim().slice(0, 80);
+  if (q.length < 2) return [];
+  const scope = await scopeFor(req);
+  const contains = { contains: q, mode: 'insensitive' };
+  const out = [];
+  const supervisor = isSupervisor(req);
+  const fmtDate = d => new Date(d).toLocaleDateString('en-ZA', { day: 'numeric', month: 'short', year: 'numeric' });
+
+  const events = await prisma.event.findMany({
+    where: { AND: [eventWhere(scope), { title: contains }] },
+    orderBy: { startDate: 'desc' }, take: 5,
+    select: { id: true, title: true, startDate: true, isActive: true, campus: { select: { name: true } } },
+  });
+  for (const e of events) {
+    out.push({
+      type: 'event', id: e.id, title: e.title,
+      subtitle: [fmtDate(e.startDate), e.campus?.name, e.isActive ? null : 'inactive'].filter(Boolean).join(' · '),
+      href: supervisor ? `/dashboard/supervisor/events?edit=${e.id}` : `/events/${e.id}`,
+    });
+  }
+
+  const amount = amountOf(q);
+  if (supervisor && amount !== null) {
+    const payments = await prisma.payment.findMany({
+      where: { amount: { in: [amount, -amount] }, createdAt: { gte: new Date(now.getTime() - 365 * DAY) }, ...(scope ? { event: eventWhere(scope) } : {}) },
+      orderBy: { createdAt: 'desc' }, take: 5,
+      select: { id: true, amount: true, method: true, createdAt: true, registrationId: true, user: { select: { name: true } }, event: { select: { title: true } } },
+    });
+    for (const p of payments) {
+      out.push({
+        type: 'payment', id: p.id, title: `R${p.amount.toFixed(2)} — ${p.user?.name || 'Unknown'}`,
+        subtitle: [p.method, p.event?.title, fmtDate(p.createdAt)].filter(Boolean).join(' · '),
+        href: isAdmin(req) && p.registrationId ? `/dashboard/admin/registrations?q=${p.registrationId}` : '/dashboard/supervisor/payments',
+      });
+    }
+  }
+
+  if (isAdmin(req)) {
+    const people = await prisma.user.findMany({
+      where: { isActive: true, OR: [{ name: contains }, { email: contains }, { phoneNumber: { contains: q.replace(/\s+/g, '') } }] },
+      orderBy: { name: 'asc' }, take: 5,
+      select: { id: true, name: true, email: true, role: true },
+    });
+    for (const u of people) {
+      out.push({ type: 'person', id: u.id, title: u.name, subtitle: [u.email, u.role !== 'user' ? u.role : null].filter(Boolean).join(' · '), href: `/dashboard/admin/users?q=${encodeURIComponent(u.email || u.name)}` });
+    }
+    // A registration by its reference (the start of its id), as on emails and invoices.
+    if (/^[0-9a-f-]{6,36}$/i.test(q)) {
+      const regs = await prisma.registration.findMany({
+        where: { id: { startsWith: q.toLowerCase() } }, take: 5,
+        select: { id: true, status: true, user: { select: { name: true } }, event: { select: { title: true } } },
+      });
+      for (const r of regs) {
+        out.push({ type: 'registration', id: r.id, title: `Registration ${r.id.slice(0, 8)} — ${r.user?.name || ''}`.trim(), subtitle: [r.event?.title, r.status].filter(Boolean).join(' · '), href: `/dashboard/admin/registrations?q=${r.id}` });
+      }
+    }
+  }
+  return out;
+}
+
+module.exports = { today, todaysEvents, moneyIn, pendingItems, search, amountOf, dayBounds };
@@ -211,6 +211,8 @@ async function refreshPricingForRegistration(registrationId) {
    }
  });
  if (!registration) return { changed: false };
+  // A season pass line is priced at its event's share of the pass, never at the ticket's price.
+  if (registration.seasonPassPurchaseId) return { changed: false };

  const totalPaid = (registration.payments || []).reduce((sum, p) => sum + (p.amount || 0), 0);

@@ -463,6 +463,13 @@ async function anonymiseUser(userId, db = prisma) {
    // Volunteer rosters: shifts still to come are given up; past ones stay for hours served.
    const shiftsGivenUp = await require('./volunteers').forgetVolunteer(tx, userId);

+    // Event series they followed.
+    await tx.seriesFollow.deleteMany({ where: { userId } });
+    // Webhook deliveries about them (kept 30 days for the delivery log).
+    await tx.webhookDelivery.deleteMany({ where: { userId } });
+    // Their saved list filters (can hold search text, such as names).
+    await tx.savedFilter.deleteMany({ where: { userId } });
+
    return { attendees: attendeeIds.length, formAnswers: answers.count, providerRecords: txns.length + checkouts.length, familyDeleted, shiftsGivenUp };
  });

@@ -485,7 +492,7 @@ async function exportUserData(userId, db = prisma) {
  });
  if (!user) return null;

-  const [registrations, payments, tickets, waitlist, certificates, feedback, consents, security, requests, notices, family, volunteering] = await Promise.all([
+  const [registrations, payments, tickets, waitlist, certificates, feedback, consents, security, requests, notices, family, volunteering, seriesFollowed, seasonPasses] = await Promise.all([
    db.registration.findMany({
      where: { userId },
      orderBy: { createdAt: 'asc' },
@@ -511,6 +518,8 @@ async function exportUserData(userId, db = prisma) {
    db.noticeAcceptance.findMany({ where: { userId }, orderBy: { createdAt: 'desc' }, select: { version: true, source: true, createdAt: true } }),
    require('./kids').exportFamily(userId, db),
    require('./volunteers').exportVolunteering(userId, db),
+    require('./series').exportFollows(userId, db),
+    require('./seasonPass').exportPurchases(userId, db),
  ]);

  return {
@@ -554,6 +563,8 @@ async function exportUserData(userId, db = prisma) {
    dataRequests: requests,
    kidsFamily: family,
    volunteering,
+    seriesFollowed,
+    seasonPasses,
  };
 }

@@ -614,6 +625,14 @@ async function dataExportPdf(data) {
    heading('Serving (volunteer rosters)');
    for (const s of data.volunteering) para(`${fmt(s.from)} — ${s.role}, ${s.event}${s.checkedIn ? ' (checked in)' : ''}`);
  }
+  if (data.seasonPasses?.length) {
+    heading('Season passes');
+    for (const s of data.seasonPasses) para(`${fmt(s.at)} — ${s.quantity} × ${s.pass}, R${Number(s.total).toFixed(2)} (${s.status})`);
+  }
+  if (data.seriesFollowed?.length) {
+    heading('Event series you follow');
+    for (const f of data.seriesFollowed) para(`${f.series} — since ${fmt(f.since)}`);
+  }
  if (data.feedback.length) {
    heading('Feedback you gave');
    for (const f of data.feedback) {
@@ -24,9 +24,9 @@ const DEFAULT_SECTIONS = [
    title: 'Plain English Summary',
    body: [
      "We respect your privacy — here's what you need to know:",
-      '• We only collect info needed to run events: registrations, payments, tickets, check-in and, for children\'s ministry, kids check-in.',
+      '• We only collect info needed to run events: registrations, payments, tickets, check-in, volunteer rosters and, for children\'s ministry, kids check-in.',
      "• Your information is kept in this site's own database, run by the hosting provider listed in section 9. It isn't shared with other organisations that use the same software.",
-      "• We don't sell your data, and only share it with the services listed in section 9, which process payments and deliver messages for us.",
+      "• We don't sell your data, and only share it with the services listed in section 9 — they process payments and deliver messages for us, and any other system we connect (such as church-management software) gets only the updates we chose.",
      '• If you register other people or pass a ticket on, we only use the email or phone number you type to contact them. We never show you whether someone has an account with us.',
      '• For youth events, a parent or guardian gives consent. Medical details are encrypted, seen only by the event leaders who need them, and deleted shortly after the event.',
      "• For kids check-in, parents add their children's details once. Allergies, medical and custody notes are encrypted, shown only to kids-ministry staff, and deleted when a child hasn't been checked in for a while (section 7). Children are collected with a pickup code.",
@@ -53,6 +53,8 @@ const DEFAULT_SECTIONS = [
      '• Security records: sign-ins, password changes and similar account events, with the time, IP address and device type, so we can alert you and investigate misuse.',
      '• Event information: events you register for, ticket selections (including the sessions you chose on multi-session events), discount codes used, attendee form answers, waitlist requests, ticket check-ins (when your ticket was scanned, per session), room or group allocations, and completion certificates issued to you.',
      '• Your home campus, if the organisation has more than one campus and you choose one.',
+      '• Serving (if you volunteer): the roles and shifts you sign up for or are given, requests to pass a shift on and who took it, when you checked in, and the hours you served.',
+      '• Event series you follow, and season passes you buy (a season pass registers you for each event on it, so each shows in your registrations).',
      "• Kids check-in (if you use it): your family's name, your children's names, dates of birth, gender, allergies, medical notes and custody notes, the adults you allow to collect them (name, phone number, relationship), and each check-in — when, which room, the pickup code, who checked them in and out, and who collected them (see section 8).",
      '• Details about other people you register (see section 3), parental consent details for youth events, and children at kids check-in (see section 8).',
      '• Payment information: processed by our payment provider (Yoco or PayFast); we receive only payment status, amount and reference numbers. If you sponsor a spot, we record the amount and, unless you give anonymously, the name and message you choose to add.',
@@ -90,6 +92,8 @@ const DEFAULT_SECTIONS = [
      '• Send optional reminders before sessions, and issue completion certificates (each has a code anyone can use to check it is genuine: the check shows the name on the certificate and the event).',
      '• Check children in and out at kids check-in, send you their pickup code, and ask you to come to the room if a leader needs you.',
      '• Show you the events of your home campus first, if the organisation has more than one campus.',
+      '• Run volunteer rosters: remind you the day before you serve, pass your shift on to someone who accepts it when you can\'t make it, and check you in when you arrive.',
+      '• Tell you when a new event in a series you follow comes out. This counts as news, so it\'s only sent if you get news and announcements.',
      '• Offer places from a waitlist, arrange rooms and groups, and ask for parental consent on youth events.',
      '• Send you an optional feedback form after an event, with one reminder.',
      '• Manage user accounts and event attendance records, and give support when you ask for help.',
@@ -106,7 +110,7 @@ const DEFAULT_SECTIONS = [
      '• Payment receipts.',
      '• Your event tickets (as a PDF document).',
      '• Security alerts such as new login notifications, password changes, and account closure confirmations, and sign-in codes if you chose WhatsApp for two-factor authentication.',
-      '• Session reminders, if the event sends them.',
+      '• Session reminders, if the event sends them, and volunteer reminders the day before you serve.',
      '• Kids check-in: your children\'s pickup code, and a request to come to the room if a leader needs you. These never include medical or custody details. If you ask the desk to, the pickup code is also sent to one of your authorised adults.',
      '• News and announcements, only if you asked for them on WhatsApp. Reply STOP to any of these to stop them.',
      'WhatsApp communications are delivered through WAWP (wawp.net), a third-party WhatsApp Business API provider. Your mobile number is transmitted to WAWP solely for the purpose of delivering your messages.',
@@ -133,6 +137,7 @@ const DEFAULT_SECTIONS = [
      'We keep personal information only as long as we need it:',
      '{retention}',
      "• Ticket lists downloaded to a staff member's scanner for offline check-in are deleted from that device when offline mode is ended.",
+      '• Copies of the updates sent to connected systems (webhooks, section 9) are kept for 30 days so problems can be checked, then deleted — and straight away when your account is deleted.',
      "• Family lists downloaded to a kids check-in desk for offline use stay on that device until the desk is synced and the list is refreshed or removed. Only kids-ministry staff can download them, and each download is recorded.",
      'You can ask for your account to be deleted at any time from the Privacy page in your account. Your account is closed straight away, and your personal information — your name and contact details, the people you registered, your form answers — is deleted within 30 days (after any upcoming event you registered for). Payment and registration records are kept without your name, because the law requires us to keep financial records.',
    ].join('\n'),
@@ -161,10 +166,12 @@ const DEFAULT_SECTIONS = [
      'We do not sell or rent your personal information. Outside our organisation, it is shared only with these service providers ("operators"), each only for its purpose:',
      '{operators}',
      '• Anyone we are required to share it with under South African law.',
+      'If we connect another system — for example our church-management software — through a webhook, it is listed above with what it receives. It gets only the updates we chose (such as new registrations, payments and check-ins), and never children\'s details from kids check-in.',
      'Within our organisation, people see only what they need:',
      "• Door staff see a ticket's holder name, ticket type and check-in status when scanning.",
      '• Group, room or bus leaders see the names, ages and contact numbers of the people in their group. Medical details from parental consent forms are shown to supervisors only.',
      "• Kids-ministry staff see the children checked in, with their allergies, medical and custody notes, the parents' names and phone numbers, and the adults allowed to collect them.",
+      '• Staff running a volunteer roster see who is serving in each role, their contact details, check-ins and hours. If you ask for someone to take over your shift, your first name, the role and any note you add are shown to the event\x27s other volunteers and others who could take it over.',
      '• If the organisation has several campuses, a staff member may be limited to their own campuses\' events.',
      '• Supervisors and administrators manage registrations, payments and communication for events. Every export of personal information (reports, attendance registers, lists) is recorded.',
      '• Support access: to help with a problem (for example, a ticket not showing), an administrator may view the site as you see it for up to 30 minutes. This is strictly read-only — nothing can be changed, paid, registered or sent on your behalf. A reason must be given, and the session and every page viewed are recorded. The organisation may choose to email you whenever this happens.',
@@ -205,6 +212,7 @@ const DEFAULT_SECTIONS = [
      '• hope_events_scan_device, hope_events_offline_lock and the "hope-events-offline-scan" database — on a staff member\'s scanner in offline mode: the device\'s id, the ticket list for the section being scanned, and scans waiting to upload. They are deleted when offline mode is ended. A copy of the scanner page is also cached so it opens without a connection.',
      '• hope_events_admin_token, hope_events_admin_user_cache and hope_events_impersonation — only while an administrator is using read-only support access (section 9), and removed when it ends.',
      "• hope_events_kids_event and hope_events_kids_room — on a kids check-in device: the event and room last chosen.",
+      '• cross_events_dismissed_notices — notices from the software provider (such as planned maintenance) that you have closed.',
      "• hope_events_kids_device and hope_events_kids_offline_… — on a kids check-in desk in offline mode: the device's id, the list of families and children (with allergies, medical and custody notes), pickup codes kept for the device, and check-ins waiting to sync.",
      'Optional — only if you click "Allow" on the cookie notice:',
      '• hope_events_analytics_sid — a random, anonymous visit id. With it we count, in our own statistics, how many visitors view an event, start registering, and complete a registration. We record only that step, where the visit came from (for example a short link or campaign link) and the type of device — never your name, IP address or browsing history. Detailed records become anonymous daily totals after 90 days. If you choose "No thanks", nothing is counted and no visit id is created.',
@@ -230,6 +238,7 @@ const DEFAULT_SECTIONS = [
    title: '13. Changes to This Notice',
    body: [
      'We may update this notice from time to time. Each update is published as a new version with its date, and earlier versions stay available on this page.',
+      'You are asked to agree to this notice when you create an account, or when you activate an account that was made for you (for example when someone registered you, or at the door). If you have never agreed to it — such as an account from before we asked — we ask once, the next time you log in.',
      'If a change is significant, we ask you to accept the new version the next time you log in.',
    ].join('\n'),
  },
@@ -253,6 +262,49 @@ const DEFAULT_SECTIONS = [
  },
 ];

+/**
+ * Changes to the built-in text, newest last. A site that published its own version keeps its own
+ * text, so the editor lists the changes made since the revision it last reviewed
+ * (`privacy_notice_builtin_reviewed`) and offers the new text section by section.
+ */
+const BUILT_IN_UPDATES = [
+  {
+    revision: '1.48.1',
+    summary: [
+      'Volunteer rosters: what is kept about people who serve, reminders, and who sees the roster.',
+      'Following an event series, and season passes.',
+      'Webhooks: other systems the organisation connects, what they receive, and that copies are kept 30 days.',
+      'How people agree to the notice: at sign-up, at account activation, or once after login if they never have.',
+      'A browser-storage item for closed provider notices.',
+    ],
+    sections: ['summary', 'information', 'use', 'whatsapp', 'retention', 'sharing', 'cookies', 'changes'],
+  },
+];
+const BUILT_IN_REVISION = BUILT_IN_UPDATES[BUILT_IN_UPDATES.length - 1].revision;
+const REVIEWED_KEY = 'privacy_notice_builtin_reviewed';
+
+function revisionLess(a, b) {
+  const pa = String(a || '0').split('.').map(Number);
+  const pb = String(b || '0').split('.').map(Number);
+  for (let i = 0; i < 3; i++) if ((pa[i] || 0) !== (pb[i] || 0)) return (pa[i] || 0) < (pb[i] || 0);
+  return false;
+}
+
+/**
+ * Built-in text changes this site hasn't reviewed yet. None while nothing is published (the site
+ * shows the built-in text, so it is always current).
+ */
+async function builtInUpdates(db = prisma) {
+  if (!(await latestNotice(db))) return [];
+  const row = await db.appSetting.findUnique({ where: { key: REVIEWED_KEY } });
+  return BUILT_IN_UPDATES.filter(u => !row?.value || revisionLess(row.value, u.revision));
+}
+
+/** The admin has gone through the built-in changes (taken what they want, or not). */
+async function markBuiltInReviewed(db = prisma) {
+  await db.appSetting.upsert({ where: { key: REVIEWED_KEY }, update: { value: BUILT_IN_REVISION }, create: { key: REVIEWED_KEY, value: BUILT_IN_REVISION } });
+}
+
 function defaultSections() {
  return DEFAULT_SECTIONS.map(s => ({ ...s }));
 }
@@ -340,11 +392,17 @@ async function requiredVersion(db = prisma) {
  return row ? row.version : null;
 }

-/** Whether someone must (re-)accept the notice before carrying on. */
+/**
+ * Whether someone must accept the notice before carrying on, and why: 'first' — they never
+ * accepted any version (an account made for them by staff, at the door or by someone who
+ * registered them, or from before acceptances were recorded); 'updated' — a version marked as a
+ * significant change came out after the one they accepted. false when nothing is needed.
+ */
 async function noticePromptPending(user, db = prisma) {
+  if (user.noticeVersionAccepted == null) return 'first';
  const required = await requiredVersion(db);
  if (required == null) return false;
-  return (user.noticeVersionAccepted ?? -1) < required;
+  return user.noticeVersionAccepted < required ? 'updated' : false;
 }

 /**
@@ -447,6 +505,11 @@ async function publish({ sections, changeSummary, requiresAcceptance, publishedB

 module.exports = {
  PLACEHOLDERS,
+  BUILT_IN_UPDATES,
+  BUILT_IN_REVISION,
+  builtInUpdates,
+  markBuiltInReviewed,
+  revisionLess,
  defaultSections,
  cleanSections,
  noticeContext,
@@ -0,0 +1,100 @@
+/**
+ * Saved filters (1.49.2): a person names the filters they use on a list page and applies them
+ * with one click; one per page can be their default (applied when the page opens). Stored per
+ * person on the server, so they follow them to any device. Only their own are ever read or changed.
+ */
+
+const prisma = require('../config/db');
+
+// The list pages that have saved filters, and who can open them.
+const PAGES = { registrations: 'admin', users: 'admin', events: 'supervisor', reports: 'supervisor' };
+const MAX_PER_PAGE = 30;
+const MAX_PARAMS_BYTES = 4000;
+
+function filterError(message, statusCode = 400) {
+  const err = new Error(message);
+  err.statusCode = statusCode;
+  return err;
+}
+
+function cleanPage(page) {
+  const p = String(page || '');
+  if (!PAGES[p]) throw filterError('Unknown list page');
+  return p;
+}
+
+function cleanName(name) {
+  const n = String(name || '').trim().replace(/\s+/g, ' ');
+  if (!n) throw filterError('Give the filter a name');
+  return n.slice(0, 60);
+}
+
+/** The filter values: a plain object of strings, numbers, booleans and lists of strings. Pure. */
+function cleanParams(params) {
+  if (!params || typeof params !== 'object' || Array.isArray(params)) throw filterError('Nothing to save');
+  const out = {};
+  for (const [k, v] of Object.entries(params)) {
+    if (!/^[a-zA-Z][a-zA-Z0-9_]{0,39}$/.test(k)) continue;
+    if (typeof v === 'string') out[k] = v.slice(0, 500);
+    else if (typeof v === 'number' && Number.isFinite(v)) out[k] = v;
+    else if (typeof v === 'boolean') out[k] = v;
+    else if (Array.isArray(v)) out[k] = v.filter(x => typeof x === 'string').slice(0, 200).map(x => x.slice(0, 100));
+  }
+  if (JSON.stringify(out).length > MAX_PARAMS_BYTES) throw filterError('Too much to save in one filter');
+  return out;
+}
+
+const view = f => ({ id: f.id, page: f.page, name: f.name, params: f.params, isDefault: f.isDefault, updatedAt: f.updatedAt });
+
+async function list(userId, page) {
+  const rows = await prisma.savedFilter.findMany({ where: { userId, page: cleanPage(page) }, orderBy: [{ isDefault: 'desc' }, { name: 'asc' }] });
+  return rows.map(view);
+}
+
+/** Saves (or replaces, by name) a filter. Making it the default clears the old default. */
+async function save(userId, { page, name, params, isDefault = false }) {
+  const p = cleanPage(page);
+  const n = cleanName(name);
+  const data = cleanParams(params);
+  const existing = await prisma.savedFilter.findUnique({ where: { userId_page_name: { userId, page: p, name: n } } });
+  if (!existing && (await prisma.savedFilter.count({ where: { userId, page: p } })) >= MAX_PER_PAGE) {
+    throw filterError(`You can keep up to ${MAX_PER_PAGE} filters on a page — delete one first`);
+  }
+  return prisma.$transaction(async tx => {
+    if (isDefault) await tx.savedFilter.updateMany({ where: { userId, page: p, isDefault: true }, data: { isDefault: false } });
+    const row = existing
+      ? await tx.savedFilter.update({ where: { id: existing.id }, data: { params: data, ...(isDefault ? { isDefault: true } : {}) } })
+      : await tx.savedFilter.create({ data: { userId, page: p, name: n, params: data, isDefault: !!isDefault } });
+    return view(row);
+  });
+}
+
+async function own(userId, id) {
+  const row = await prisma.savedFilter.findUnique({ where: { id: String(id) } });
+  if (!row || row.userId !== userId) throw filterError('Saved filter not found', 404);
+  return row;
+}
+
+/** Rename, or make (or stop being) the default. */
+async function update(userId, id, { name, isDefault }) {
+  const row = await own(userId, id);
+  return prisma.$transaction(async tx => {
+    if (isDefault === true) await tx.savedFilter.updateMany({ where: { userId, page: row.page, isDefault: true, NOT: { id: row.id } }, data: { isDefault: false } });
+    try {
+      return view(await tx.savedFilter.update({
+        where: { id: row.id },
+        data: { ...(name !== undefined ? { name: cleanName(name) } : {}), ...(isDefault !== undefined ? { isDefault: isDefault === true } : {}) },
+      }));
+    } catch (e) {
+      if (e?.code === 'P2002') throw filterError('You already have a filter with that name on this page');
+      throw e;
+    }
+  });
+}
+
+async function remove(userId, id) {
+  const row = await own(userId, id);
+  await prisma.savedFilter.delete({ where: { id: row.id } });
+}
+
+module.exports = { PAGES, MAX_PER_PAGE, cleanParams, cleanName, cleanPage, list, save, update, remove };
@@ -0,0 +1,361 @@
+/**
+ * Season passes (1.47.3): one price for a ticket at each of several events in a series.
+ *
+ * - A supervisor picks the events on the pass, and which ticket (and variant) at each.
+ * - Buying registers the buyer at every event on it at once (`quantity` places each) and starts
+ *   one online checkout for the total. A free pass gives the tickets straight away.
+ * - The price is split across the events in proportion to their normal ticket prices (whole
+ *   cents, `splitCents`), and each registration's line is priced at its event's share, so every
+ *   event's cashup and reports count only its part. Those lines are never repriced, take no
+ *   coupons, and can't be edited.
+ * - The payment comes back as one provider payment; it's recorded as one Payment per event
+ *   (`recordPassPayment`), all linked to the purchase.
+ * - A pass stops selling when the first event on it starts, at its sale end, or when switched off.
+ */
+
+const prisma = require('../config/db');
+const { v4: uuidv4 } = require('uuid');
+
+function passError(message, statusCode = 400) {
+  const err = new Error(message);
+  err.statusCode = statusCode;
+  return err;
+}
+
+const toCents = n => Math.round(Number(n || 0) * 100);
+
+/**
+ * Splits `totalCents` in proportion to `weights` (whole cents that add up exactly; the cents
+ * left over by rounding down go to the largest remainders). All weights zero → equal parts.
+ * Pure, for tests.
+ */
+function splitCents(totalCents, weights) {
+  if (!weights.length) return [];
+  const w = weights.map(x => Math.max(0, Number(x) || 0));
+  const sum = w.reduce((s, x) => s + x, 0);
+  const shares = sum > 0 ? w.map(x => (totalCents * x) / sum) : w.map(() => totalCents / w.length);
+  const out = shares.map(Math.floor);
+  let left = totalCents - out.reduce((s, x) => s + x, 0);
+  const order = shares.map((s, i) => ({ i, frac: s - Math.floor(s) })).sort((a, b) => b.frac - a.frac || a.i - b.i);
+  for (let k = 0; left > 0; k = (k + 1) % order.length, left--) out[order[k].i]++;
+  return out;
+}
+
+/** The normal price of one place on an item: the variant's own price, else the option's. */
+function normalPrice(item) {
+  const v = item.variant;
+  return Number(v && v.price !== null && v.price !== undefined ? v.price : item.eventOption?.price || 0);
+}
+
+/**
+ * Each item's share of the pass price (rand, one pass), in proportion to its normal price.
+ * Pure, for tests: items need eventOption.price (and variant.price when there is one).
+ */
+function itemShares(price, items) {
+  return splitCents(toCents(price), items.map(i => toCents(normalPrice(i)))).map(c => c / 100);
+}
+
+/**
+ * How much of a payment goes to each registration: each gets what it still owes, in order, and
+ * anything over goes to the last one. `dues` in rand. Pure, for tests.
+ */
+function allocate(dues, amount) {
+  let left = toCents(amount);
+  const out = dues.map(d => {
+    const take = Math.min(left, Math.max(0, toCents(d)));
+    left -= take;
+    return take;
+  });
+  if (left > 0 && out.length) out[out.length - 1] += left;
+  return out.map(c => c / 100);
+}
+
+const ITEM_INCLUDE = {
+  event: {
+    select: {
+      id: true, title: true, startDate: true, endDate: true, isActive: true, seriesId: true, campusId: true,
+      registrationDeadline: true, scheduleType: true, attendanceMode: true, lateJoinEnabled: true, lateJoinUntilSessionId: true,
+      requiresParentalConsent: true, requiresRegistration: true, cashupStatus: true, kidsOptionId: true, volunteerOptionId: true,
+      sessions: { select: { id: true, startsAt: true, endsAt: true, cancelledAt: true } },
+    },
+  },
+  eventOption: { select: { id: true, name: true, price: true, stockLimit: true, eventId: true, sessionMode: true } },
+  variant: { select: { id: true, name: true, price: true, stockLimit: true, eventOptionId: true } },
+};
+const PASS_INCLUDE = { items: { orderBy: { order: 'asc' }, include: ITEM_INCLUDE }, series: { select: { id: true, name: true, slug: true } } };
+
+/** Why a pass can't be bought right now, or null. */
+function notOnSale(pass, now = new Date()) {
+  if (!pass.isActive) return 'This pass isn\'t on sale.';
+  if (!pass.items.length) return 'This pass has no events yet.';
+  if (pass.saleEndsAt && new Date(pass.saleEndsAt) <= now) return 'This pass is no longer on sale.';
+  const { wholeCourseClosesAt } = require('./sessions');
+  for (const i of pass.items) {
+    if (!i.event.isActive || i.event.cashupStatus === 'closed') return `${i.event.title} isn't taking registrations.`;
+    if (new Date(i.event.startDate) <= now) return 'This pass stopped selling when its first event started.';
+    if (wholeCourseClosesAt(i.event, i.event.sessions) <= now) return `Registration for ${i.event.title} has closed.`;
+  }
+  return null;
+}
+
+/** A pass as shown to buyers and supervisors: its events with normal prices and shares. */
+function passView(pass, now = new Date()) {
+  const shares = itemShares(pass.price, pass.items);
+  const normalValue = Math.round(pass.items.reduce((s, i) => s + normalPrice(i), 0) * 100) / 100;
+  return {
+    id: pass.id, seriesId: pass.seriesId, name: pass.name, description: pass.description, price: pass.price,
+    isActive: pass.isActive, saleEndsAt: pass.saleEndsAt, series: pass.series,
+    normalValue, saving: Math.max(0, Math.round((normalValue - pass.price) * 100) / 100),
+    unavailable: notOnSale(pass, now),
+    items: pass.items.map((i, k) => ({
+      id: i.id, eventId: i.eventId, eventOptionId: i.eventOptionId, variantId: i.variantId,
+      eventTitle: i.event.title, startDate: i.event.startDate, endDate: i.event.endDate, campusId: i.event.campusId,
+      ticket: i.variant ? `${i.eventOption.name} — ${i.variant.name}` : i.eventOption.name,
+      normalPrice: normalPrice(i), share: shares[k],
+    })),
+  };
+}
+
+// ─── Setting passes up ───────────────────────────────────────────────────────
+
+/**
+ * Checks a create/update body against the series' events: each item is an event in the series
+ * with one of its tickets (not the staff-only kids/volunteer ones, not a per-session ticket) and
+ * no parental consent (a pass can't collect children's details). Returns the data to save and the
+ * events on it (for the campus check).
+ */
+async function cleanPassInput(body, seriesId, current = null, db = prisma) {
+  const data = {};
+  if (body.name !== undefined || !current) {
+    const name = String(body.name || '').trim();
+    if (!name) throw passError('Give the pass a name');
+    data.name = name.slice(0, 120);
+  }
+  if (body.description !== undefined) data.description = String(body.description || '').trim() || null;
+  if (body.price !== undefined || !current) {
+    const price = Number(body.price);
+    if (!(price >= 0) || !Number.isFinite(price)) throw passError('Enter the pass price (0 for free)');
+    data.price = Math.round(price * 100) / 100;
+  }
+  if (body.isActive !== undefined) data.isActive = body.isActive !== false;
+  if (body.saleEndsAt !== undefined) {
+    const d = body.saleEndsAt ? new Date(body.saleEndsAt) : null;
+    if (d && isNaN(d.getTime())) throw passError('The sale end date isn\'t valid');
+    data.saleEndsAt = d;
+  }
+
+  let items = null;
+  if (body.items !== undefined || !current) {
+    if (!Array.isArray(body.items) || body.items.length === 0) throw passError('Choose at least one event for the pass');
+    const seen = new Set();
+    items = [];
+    for (const [order, raw] of body.items.entries()) {
+      const eventId = String(raw?.eventId || '');
+      if (seen.has(eventId)) throw passError('Each event can only be on a pass once');
+      seen.add(eventId);
+      const event = await db.event.findUnique({
+        where: { id: eventId },
+        select: { id: true, title: true, seriesId: true, campusId: true, requiresParentalConsent: true, requiresRegistration: true, kidsOptionId: true, volunteerOptionId: true, scheduleType: true, attendanceMode: true, eventOptions: { select: { id: true, sessionMode: true, variants: { select: { id: true } } } } },
+      });
+      if (!event || event.seriesId !== seriesId) throw passError('Every event on a pass must be in its series');
+      if (event.requiresParentalConsent) throw passError(`${event.title} is a youth event (parental consent), so it can't be on a pass`);
+      if (event.requiresRegistration === false) throw passError(`${event.title} doesn't take registrations`);
+      const option = event.eventOptions.find(o => o.id === raw.eventOptionId);
+      if (!option || [event.kidsOptionId, event.volunteerOptionId].includes(option.id)) throw passError(`Choose a ticket for ${event.title}`);
+      if (event.scheduleType === 'sessions' && event.attendanceMode === 'pick' && option.sessionMode === 'pick') {
+        throw passError(`${event.title}: choose a ticket for all sessions, not a per-session one`);
+      }
+      const variantId = raw.variantId ? String(raw.variantId) : null;
+      if (variantId && !option.variants.some(v => v.id === variantId)) throw passError(`That variant isn't one of the ticket's at ${event.title}`);
+      items.push({ eventId, eventOptionId: option.id, variantId, order, campusId: event.campusId });
+    }
+  }
+  return { data, items };
+}
+
+async function loadPass(id, db = prisma) {
+  const pass = await db.seasonPass.findUnique({ where: { id }, include: PASS_INCLUDE });
+  if (!pass) throw passError('Season pass not found', 404);
+  return pass;
+}
+
+// ─── Buying ──────────────────────────────────────────────────────────────────
+
+/**
+ * Buys `quantity` passes for `userId`: a registration at each event (lines priced at the share),
+ * then one checkout for the total — or, for a free pass, the tickets straight away.
+ * @returns {Promise<{ purchaseId, total, paid, redirectUrl, provider, message }>}
+ */
+async function buyPass(passId, userId, { quantity = 1, provider = null, successUrl, cancelUrl, failureUrl } = {}) {
+  const qty = parseInt(quantity, 10);
+  if (!(qty >= 1 && qty <= 20)) throw passError('Choose how many passes (1 to 20)');
+  const pass = await loadPass(passId);
+  const reason = notOnSale(pass);
+  if (reason) throw passError(reason, 409);
+  const shares = itemShares(pass.price, pass.items);
+  const total = Math.round(pass.price * qty * 100) / 100;
+  const free = total === 0;
+
+  const { remainingFor } = require('./stock');
+  const purchase = await prisma.$transaction(async tx => {
+    // One buyer at a time per pass, so the last places can't be sold twice through passes.
+    await tx.$executeRaw`SELECT pg_advisory_xact_lock(hashtext(${'seasonpass:' + pass.id}))`;
+    for (const i of pass.items) {
+      const left = await remainingFor(i.eventOption, i.variant, { db: tx });
+      if (left !== null && left < qty) throw passError(`${i.event.title} has ${left === 0 ? 'no places' : `only ${left} place${left === 1 ? '' : 's'}`} left for ${i.variant ? i.variant.name : i.eventOption.name}`, 409);
+    }
+    const created = await tx.seasonPassPurchase.create({ data: { passId: pass.id, userId, quantity: qty, total, status: free ? 'paid' : 'pending' } });
+    for (const [k, i] of pass.items.entries()) {
+      const registration = await tx.registration.create({
+        data: { userId, eventId: i.eventId, status: free ? 'paid' : 'pending', seasonPassPurchaseId: created.id },
+      });
+      const line = await tx.registrationOption.create({
+        data: { registrationId: registration.id, eventOptionId: i.eventOptionId, variantId: i.variantId, quantity: qty, priceSnapshot: shares[k] },
+      });
+      await tx.registrationOptionTranche.create({ data: { registrationOptionId: line.id, quantity: qty, priceSnapshot: shares[k] } });
+    }
+    return created;
+  });
+
+  const registrations = await prisma.registration.findMany({ where: { seasonPassPurchaseId: purchase.id }, select: { id: true } });
+  if (free) {
+    const { generateTicketsForRegistration } = require('./ticketUtils');
+    for (const r of registrations) await generateTicketsForRegistration(r.id).catch(e => console.error('[season-pass] tickets:', e?.message || e));
+    emailTicketsFor(userId, registrations.map(r => r.id));
+    return { purchaseId: purchase.id, total, paid: true, redirectUrl: null, provider: null, message: 'Your tickets are ready.' };
+  }
+  return { purchaseId: purchase.id, total, paid: false, ...(await startPassCheckout(purchase.id, userId, { provider, successUrl, cancelUrl, failureUrl })) };
+}
+
+/**
+ * Starts (or restarts) the online checkout for what's still owed on a purchase. When online
+ * payment isn't possible (none set up, or under the minimum) the places stay booked unpaid and
+ * the buyer is told to pay the church.
+ */
+async function startPassCheckout(purchaseId, userId, { provider = null, successUrl, cancelUrl, failureUrl } = {}) {
+  const purchase = await prisma.seasonPassPurchase.findUnique({
+    where: { id: purchaseId },
+    include: {
+      pass: { select: { name: true } },
+      user: { select: { name: true, email: true } },
+      registrations: { include: { event: { select: { title: true } }, registrationOptions: { include: { tranches: true } }, payments: true } },
+    },
+  });
+  if (!purchase || purchase.userId !== userId) throw passError('Purchase not found', 404);
+  const { computeRegistrationTotalDue } = require('./pricing');
+  const owed = purchase.registrations
+    .filter(r => r.status !== 'cancelled')
+    .map(r => ({ r, due: Math.max(0, computeRegistrationTotalDue(r, new Date()) - r.payments.reduce((s, p) => s + p.amount, 0)) }))
+    .filter(x => x.due > 0.004);
+  const amountCents = owed.reduce((s, x) => s + toCents(x.due), 0);
+  if (amountCents <= 0) throw passError('This pass is already paid');
+
+  const payments = require('../payments');
+  try {
+    const checkout = await payments.createCheckout(provider, {
+      amountCents,
+      metadata: { type: 'season_pass', purchaseId: purchase.id, userId, passName: purchase.pass.name },
+      lineItems: owed.map(x => ({ name: `${purchase.pass.name}: ${x.r.event.title}`, quantity: 1, unitCents: toCents(x.due) })),
+      successUrl, cancelUrl, failureUrl,
+      payer: { name: purchase.user?.name || '', email: purchase.user?.email || '' },
+      description: purchase.pass.name,
+      idempotencyKey: `pass_${purchase.id}_${amountCents}_${Date.now()}`,
+    });
+    await prisma.seasonPassPurchase.update({ where: { id: purchase.id }, data: { checkoutId: checkout.checkoutId } });
+    return { redirectUrl: checkout.redirectUrl, provider: checkout.provider, message: null };
+  } catch (e) {
+    // Online payment not possible (switched off, not set up, or under the minimum): keep the places.
+    if (e.statusCode && (e.statusCode < 500 || e.statusCode === 503)) {
+      return { redirectUrl: null, provider: null, message: `Your places are booked. ${e.message}` };
+    }
+    throw e;
+  }
+}
+
+function emailTicketsFor(userId, registrationIds) {
+  (async () => {
+    const { emailTickets } = require('../controllers/ticketController');
+    for (const registrationId of registrationIds) {
+      const mockReq = { user: { id: userId }, body: { registrationId } };
+      const mockRes = { status: () => mockRes, json: () => {} };
+      try { await emailTickets(mockReq, mockRes); } catch (e) { console.error('[season-pass] emailing tickets:', e?.message || e); }
+    }
+  })();
+}
+
+/**
+ * A pass checkout was paid (webhook or status check): one Payment per registration on the
+ * purchase for what it owed, all linked to the purchase, then each registration's status and
+ * tickets. Idempotent on the provider's payment id (the first Payment carries it).
+ */
+async function recordPassPayment(providerId, event, body) {
+  const { externalId, amountCents, status, metadata = {}, methodType } = event.transaction;
+  const webhook = require('../payments/webhook');
+  const existing = await prisma.payment.findFirst({ where: { externalId } });
+  if (existing) {
+    await webhook.saveProviderTransaction(providerId, event, body, { reconciled: true, paymentId: existing.id }).catch(() => {});
+    return { status: 'already_processed', paymentId: existing.id, externalId };
+  }
+  const purchase = await prisma.seasonPassPurchase.findUnique({
+    where: { id: String(metadata.purchaseId || '') },
+    include: { registrations: { orderBy: { createdAt: 'asc' }, include: { registrationOptions: { include: { tranches: true } }, payments: true } } },
+  });
+  if (!purchase) throw passError(`Season pass purchase ${metadata.purchaseId} not found`, 404);
+
+  const { computeRegistrationTotalDue } = require('./pricing');
+  const regs = purchase.registrations.filter(r => r.status !== 'cancelled');
+  const dues = regs.map(r => Math.max(0, computeRegistrationTotalDue(r, new Date()) - r.payments.reduce((s, p) => s + p.amount, 0)));
+  const parts = allocate(dues, (amountCents || 0) / 100);
+  const method = methodType || 'card';
+  const paymentStatus = status === 'succeeded' ? 'completed' : status;
+
+  const created = [];
+  for (const [k, r] of regs.entries()) {
+    if (!(parts[k] > 0)) continue;
+    created.push(await prisma.payment.create({
+      data: {
+        id: uuidv4(), amount: parts[k], method, provider: providerId, status: paymentStatus,
+        externalId: created.length === 0 ? externalId : null,
+        registrationId: r.id, eventId: r.eventId, userId: purchase.userId, recordedById: purchase.userId,
+        seasonPassPurchaseId: purchase.id,
+      },
+    }));
+  }
+  const paidIds = [];
+  for (const r of regs) {
+    const updated = await webhook.updateRegistrationStatus(r.id);
+    if (updated.status === 'paid') paidIds.push(r.id);
+  }
+  if (paidIds.length === regs.length) await prisma.seasonPassPurchase.update({ where: { id: purchase.id }, data: { status: 'paid' } });
+  if (created[0]) await webhook.saveProviderTransaction(providerId, event, body, { reconciled: true, paymentId: created[0].id }).catch(() => {});
+
+  (async () => {
+    const { sendPaymentEmails } = require('./notifications');
+    for (const p of created) {
+      try { await sendPaymentEmails(p.id); } catch (e) { console.error('[season-pass] payment email:', e?.message || e); }
+    }
+  })();
+  emailTicketsFor(purchase.userId, paidIds);
+  return { status: 'success', purchaseId: purchase.id, payments: created.map(p => ({ id: p.id, amount: p.amount, eventId: p.eventId })) };
+}
+
+/** Route guard: a registration from a season pass keeps its lines as bought (no edits, no coupons). */
+function notOnSeasonPass(req, res, next) {
+  prisma.registration.findUnique({ where: { id: req.params.id }, select: { seasonPassPurchaseId: true } })
+    .then(r => (r?.seasonPassPurchaseId
+      ? res.status(409).json({ message: 'This registration is part of a season pass, so its tickets can\'t be changed and codes can\'t be added. Ask the organiser if something needs to change.' })
+      : next()))
+    .catch(next);
+}
+
+// ─── Privacy ─────────────────────────────────────────────────────────────────
+
+async function exportPurchases(userId, db = prisma) {
+  const rows = await db.seasonPassPurchase.findMany({ where: { userId }, orderBy: { createdAt: 'asc' }, select: { quantity: true, total: true, status: true, createdAt: true, pass: { select: { name: true } } } });
+  return rows.map(r => ({ pass: r.pass.name, quantity: r.quantity, total: r.total, status: r.status, at: r.createdAt }));
+}
+
+module.exports = {
+  splitCents, itemShares, allocate, normalPrice, notOnSale, passView, cleanPassInput, loadPass,
+  buyPass, startPassCheckout, recordPassPayment, notOnSeasonPass, exportPurchases, passError, PASS_INCLUDE,
+};
@@ -0,0 +1,240 @@
+/**
+ * Event series (1.47.1): separate events grouped on one series page — every year's camp, the
+ * monthly men's breakfast. A series isn't tied to a campus, so it can have events at several.
+ * Each event page links to the next public event in its series, and people can follow a series:
+ * when a new event in it goes live they get one email, sent as News & announcements (so only to
+ * people who opted in to news, with an unsubscribe link).
+ */
+
+const prisma = require('../config/db');
+const { slugify } = require('./campuses');
+
+function seriesError(message, statusCode = 400) {
+  const err = new Error(message);
+  err.statusCode = statusCode;
+  return err;
+}
+
+/** Events anyone can see: active, not hidden and live. */
+function publicEventWhere(now = new Date()) {
+  return { isActive: true, isHidden: false, goLiveAt: { lte: now } };
+}
+
+/** Name, slug, description and picture from a create/update body (`current` on update). */
+function cleanSeriesInput(body = {}, current = null) {
+  const data = {};
+  if (body.name !== undefined || !current) {
+    const name = String(body.name || '').trim();
+    if (!name) throw seriesError('Give the series a name');
+    if (name.length > 120) throw seriesError('The name is too long');
+    data.name = name;
+  }
+  if (body.slug !== undefined || !current) {
+    const slug = slugify(body.slug || data.name || current?.name);
+    if (!slug) throw seriesError('The web address needs letters or numbers');
+    data.slug = slug;
+  }
+  if (body.description !== undefined) data.description = String(body.description || '').trim() || null;
+  if (body.picture !== undefined) data.picture = String(body.picture || '').trim() || null;
+  return data;
+}
+
+/** The series to save on an event from a body's `seriesId`: undefined = leave as is, null = none. */
+async function seriesForEvent(seriesId, db = prisma) {
+  if (seriesId === undefined) return undefined;
+  if (!seriesId) return null;
+  const found = await db.eventSeries.findUnique({ where: { id: String(seriesId) }, select: { id: true } });
+  if (!found) throw seriesError('That series no longer exists');
+  return found.id;
+}
+
+const NEXT_SELECT = { id: true, title: true, startDate: true, endDate: true, location: true, redirectUrl: true };
+
+/**
+ * The next public event in the same series after `event` (starting later, not over yet), or null.
+ */
+async function nextInSeries(event, db = prisma, now = new Date()) {
+  if (!event?.seriesId) return null;
+  return db.event.findFirst({
+    where: { ...publicEventWhere(now), seriesId: event.seriesId, id: { not: event.id }, startDate: { gt: event.startDate }, endDate: { gte: now } },
+    orderBy: { startDate: 'asc' },
+    select: NEXT_SELECT,
+  });
+}
+
+/**
+ * Splits a series' public events into upcoming (not over yet, soonest first) and past (latest
+ * first). Pure, for the series page.
+ */
+function splitEvents(events, now = new Date()) {
+  const upcoming = events.filter(e => new Date(e.endDate) >= now).sort((a, b) => new Date(a.startDate) - new Date(b.startDate));
+  const past = events.filter(e => new Date(e.endDate) < now).sort((a, b) => new Date(b.startDate) - new Date(a.startDate));
+  return { upcoming, past };
+}
+
+// ─── Following ───────────────────────────────────────────────────────────────
+
+async function follow(seriesId, userId) {
+  const series = await prisma.eventSeries.findUnique({ where: { id: seriesId }, select: { id: true } });
+  if (!series) throw seriesError('Series not found', 404);
+  await prisma.seriesFollow.upsert({ where: { seriesId_userId: { seriesId, userId } }, create: { seriesId, userId }, update: {} });
+}
+
+async function unfollow(seriesId, userId) {
+  await prisma.seriesFollow.deleteMany({ where: { seriesId, userId } });
+}
+
+function frontendUrl() {
+  return String(process.env.FRONTEND_URL || process.env.APP_BASE_URL || 'http://localhost:3001').replace(/\/$/, '');
+}
+
+/**
+ * The `series` job: for each event in a series that is now public and hasn't started, email the
+ * series' followers once. The event is claimed first (seriesAnnouncedAt), so a slow run or two
+ * workers never send twice. An event made public after it started is never announced.
+ */
+async function runAnnounceJob(now = new Date()) {
+  const due = await prisma.event.findMany({
+    where: { ...publicEventWhere(now), seriesId: { not: null }, seriesAnnouncedAt: null, startDate: { gt: now } },
+    select: { id: true, title: true, startDate: true, location: true, redirectUrl: true, series: { select: { id: true, name: true, slug: true } } },
+    take: 50,
+  });
+  let announced = 0;
+  let sent = 0;
+  let skipped = 0;
+  for (const ev of due) {
+    const claimed = await prisma.event.updateMany({ where: { id: ev.id, seriesAnnouncedAt: null }, data: { seriesAnnouncedAt: now } });
+    if (!claimed.count) continue;
+    announced++;
+    const follows = await prisma.seriesFollow.findMany({
+      where: { seriesId: ev.series.id, user: { isActive: true } },
+      select: { user: { select: { id: true, name: true, email: true } } },
+    });
+    const { filterRecipients, bulkEmailFooter } = require('./privacy');
+    const { recipients, skipped: notNews } = await filterRecipients(
+      follows.filter(f => f.user.email).map(f => ({ email: f.user.email, name: f.user.name, userId: f.user.id })),
+      { channel: 'email', kind: 'news' },
+    );
+    skipped += notNews;
+    const { sendMail } = require('./email');
+    for (const r of recipients) {
+      const footer = bulkEmailFooter({ kind: 'news', recipient: r });
+      const msg = announcementEmail({ name: r.name, event: ev, series: ev.series });
+      try {
+        await sendMail({ to: r.email, subject: msg.subject, html: msg.html + footer.html, text: msg.text + footer.text, headers: footer.headers });
+        sent++;
+      } catch (e) {
+        try { console.warn('[series] failed to email', r.email, e?.message || e); } catch {}
+      }
+    }
+  }
+  return { announced, sent, skipped };
+}
+
+function announcementEmail({ name, event, series }) {
+  const { emailWrapper, ctaButton } = require('./email');
+  const esc = s => String(s || '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+  const when = new Date(event.startDate).toLocaleDateString('en-GB', { weekday: 'long', day: 'numeric', month: 'long', year: 'numeric' });
+  const url = `${frontendUrl()}/events/${event.id}`;
+  const seriesUrl = `${frontendUrl()}/series/${series.slug}`;
+  const subject = `New in ${series.name}: ${event.title}`;
+  const body = `
+    <p style="font-size:22px;font-weight:800;color:#0f172a;margin:0 0 8px 0;letter-spacing:-0.3px">${esc(event.title)}</p>
+    <p style="color:#64748b;font-size:14px;margin:0 0 24px 0">New in ${esc(series.name)}</p>
+    <p style="margin:0 0 16px 0;color:#374151">Hi <strong>${esc(name || 'there')}</strong>,</p>
+    <p style="margin:0 0 16px 0;color:#374151">You follow <strong>${esc(series.name)}</strong>, and the next one is out: <strong>${esc(event.title)}</strong> on ${esc(when)}${event.location ? `, ${esc(event.location)}` : ''}.</p>
+    ${ctaButton('See the event', url)}
+    <p style="margin:16px 0 0 0;font-size:13px;color:#64748b">To stop hearing about this series, unfollow it on <a href="${seriesUrl}" style="color:#64748b">its page</a>.</p>`;
+  const text = `Hi ${name || 'there'},\n\nYou follow ${series.name}, and the next one is out: ${event.title} on ${when}${event.location ? `, ${event.location}` : ''}.\n\nSee the event: ${url}\n\nTo stop hearing about this series, unfollow it on its page: ${seriesUrl}`;
+  return { subject, text, html: emailWrapper(body, { preheader: subject }) };
+}
+
+// ─── Year-on-year comparison (1.47.2) ────────────────────────────────────────
+
+// The same "real income" as the dashboard's top events: everything except the legs that apply an
+// earlier donation to an order (not new money). Refunds count, as negatives.
+const EXCLUDE_DONATION_LEGS = {
+  NOT: { AND: [{ isDonation: false }, { originalPaymentId: { not: null } }, { amount: { gt: 0 } }] },
+};
+
+const pct = (now, before) => (before > 0 ? Math.round(((now - before) / before) * 100) : null);
+
+/**
+ * Adds `change` to each row against the row before it (rows oldest first): the percentage up or
+ * down for registrations, tickets, income and checked in, null when there's nothing to compare.
+ * Pure, for tests.
+ */
+function withChanges(rows) {
+  return rows.map((r, i) => {
+    const prev = rows[i - 1];
+    return {
+      ...r,
+      change: prev
+        ? { registrations: pct(r.registrations, prev.registrations), tickets: pct(r.tickets, prev.tickets), income: pct(r.income, prev.income), checkedIn: pct(r.checkedIn, prev.checkedIn) }
+        : null,
+    };
+  });
+}
+
+/**
+ * Registrations, tickets, income and attendance for each event in a series that the person may
+ * see (`scopeWhere`, from campusScope.eventWhere), oldest first, with the change from the one
+ * before. Checked in: check-ins on a single-date event; on a multi-session event, the average per
+ * session that wasn't cancelled.
+ */
+async function compareSeries(seriesId, { scopeWhere = {} } = {}, db = prisma) {
+  const series = await db.eventSeries.findUnique({ where: { id: seriesId }, select: { id: true, name: true, slug: true } });
+  if (!series) throw seriesError('Series not found', 404);
+  const events = await db.event.findMany({
+    where: { AND: [{ seriesId }, scopeWhere] },
+    orderBy: { startDate: 'asc' },
+    select: {
+      id: true, title: true, startDate: true, endDate: true, scheduleType: true, isActive: true,
+      campus: { select: { id: true, name: true, slug: true, colour: true } },
+      _count: { select: { sessions: { where: { cancelledAt: null } } } },
+    },
+  });
+  const ids = events.map(e => e.id);
+  const [regs, tickets, income, usages] = ids.length ? await Promise.all([
+    db.registration.groupBy({ by: ['eventId'], where: { eventId: { in: ids }, status: { not: 'cancelled' } }, _count: { _all: true } }),
+    db.ticket.groupBy({ by: ['eventId'], where: { eventId: { in: ids } }, _sum: { quantity: true } }),
+    db.payment.groupBy({ by: ['eventId'], where: { ...EXCLUDE_DONATION_LEGS, eventId: { in: ids } }, _sum: { amount: true } }),
+    // People checked in (a group scan can let several in at once), per event through the ticket.
+    Promise.all(ids.map(async eventId => ({ eventId, n: (await db.ticketUsage.aggregate({ where: { ticket: { eventId } }, _sum: { quantityRedeemed: true } }))._sum.quantityRedeemed || 0 }))),
+  ]) : [[], [], [], []];
+  const map = (rows, pick) => new Map(rows.map(r => [r.eventId, pick(r)]));
+  const regBy = map(regs, r => r._count._all);
+  const ticketBy = map(tickets, r => r._sum.quantity || 0);
+  const incomeBy = map(income, r => r._sum.amount || 0);
+  const usageBy = map(usages, r => r.n);
+
+  const rows = events.map(e => {
+    const scans = usageBy.get(e.id) || 0;
+    const sessions = e.scheduleType === 'sessions' ? e._count.sessions : 0;
+    const t = ticketBy.get(e.id) || 0;
+    const checkedIn = sessions > 0 ? Math.round(scans / sessions) : scans;
+    return {
+      eventId: e.id, title: e.title, startDate: e.startDate, endDate: e.endDate, campus: e.campus, isActive: e.isActive,
+      sessions,
+      registrations: regBy.get(e.id) || 0,
+      tickets: t,
+      income: Math.round((incomeBy.get(e.id) || 0) * 100) / 100,
+      checkedIn,
+      attendanceRate: t > 0 ? Math.min(100, Math.round((checkedIn / t) * 100)) : null,
+    };
+  });
+  return { series, events: withChanges(rows) };
+}
+
+// ─── Privacy ─────────────────────────────────────────────────────────────────
+
+/** Series someone follows, for "Download my data". */
+async function exportFollows(userId, db = prisma) {
+  const rows = await db.seriesFollow.findMany({ where: { userId }, orderBy: { createdAt: 'asc' }, select: { createdAt: true, series: { select: { name: true } } } });
+  return rows.map(r => ({ series: r.series.name, since: r.createdAt }));
+}
+
+module.exports = {
+  publicEventWhere, cleanSeriesInput, seriesForEvent, nextInSeries, splitEvents,
+  follow, unfollow, runAnnounceJob, announcementEmail, exportFollows, seriesError, withChanges, compareSeries,
+};
@@ -0,0 +1,349 @@
+/**
+ * Outbound webhooks (1.48.0): admins add endpoints (Site settings → Webhooks) and choose event
+ * types; what happens here is POSTed to them as JSON, signed with the endpoint's secret.
+ *
+ * - Events are noticed in one place, a Prisma client extension (config/db.js), so every path that
+ *   creates a registration, marks it paid, records a payment, checks a ticket in… is covered.
+ * - `notice` only queues (in memory); about a second later `flush` reads the record again — a
+ *   transaction that rolled back, or a status that changed back, sends nothing — builds the
+ *   payload and stores one WebhookDelivery per endpoint that wants the type, then sends them.
+ * - Sending: `X-CrossEvents-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256 of "<t>.<body>">`
+ *   (like Stripe), 10 s timeout, redirects not followed, 2xx = delivered. Failures are retried
+ *   after 1 min, 5 min, 30 min, 2 h and 12 h, then marked failed (Resend on the delivery log).
+ * - Only https URLs on public addresses (no SSRF into the server's own network), unless
+ *   WEBHOOKS_ALLOW_PRIVATE=true (local testing).
+ * - Never sent: kids check-in and volunteer tickets (children's data stays here).
+ * - Deliveries hold personal information, so they're kept 30 days and removed with an account.
+ */
+
+const crypto = require('crypto');
+const dns = require('dns').promises;
+const net = require('net');
+const prisma = require('../config/db');
+const { encrypt, decrypt } = require('./encryption');
+
+const EVENT_TYPES = [
+  { type: 'registration.created', label: 'Registration made', description: 'Someone registers (online, at the door, by staff or with a season pass).' },
+  { type: 'registration.paid', label: 'Registration paid', description: 'A registration is paid in full — or made free.' },
+  { type: 'registration.cancelled', label: 'Registration cancelled', description: 'A registration is cancelled.' },
+  { type: 'payment.received', label: 'Payment received', description: 'Any payment or donation is recorded (online or by staff).' },
+  { type: 'payment.refunded', label: 'Payment refunded', description: 'A refund is recorded.' },
+  { type: 'ticket.checked_in', label: 'Ticket checked in', description: 'A ticket is scanned or ticked present.' },
+  { type: 'user.created', label: 'Account created', description: 'A new account is made.' },
+  { type: 'event.published', label: 'Event published', description: 'An event becomes public (made active and not hidden).' },
+];
+const TYPES = new Set(EVENT_TYPES.map(t => t.type));
+
+const RETRY_AFTER_MS = [60e3, 5 * 60e3, 30 * 60e3, 2 * 3600e3, 12 * 3600e3];
+const MAX_ATTEMPTS = RETRY_AFTER_MS.length + 1;
+const KEEP_DAYS = 30;
+const TIMEOUT_MS = 10000;
+
+function webhookError(message, statusCode = 400) {
+  const err = new Error(message);
+  err.statusCode = statusCode;
+  return err;
+}
+
+const allowPrivate = () => String(process.env.WEBHOOKS_ALLOW_PRIVATE || '').toLowerCase() === 'true';
+
+// ─── Endpoint addresses ──────────────────────────────────────────────────────
+
+/** Whether an IP address is private, loopback, link-local or otherwise not on the internet. */
+function isPrivateAddress(ip) {
+  if (net.isIPv4(ip)) {
+    const [a, b] = ip.split('.').map(Number);
+    return a === 10 || a === 127 || a === 0 || (a === 169 && b === 254) || (a === 172 && b >= 16 && b <= 31)
+      || (a === 192 && b === 168) || (a === 100 && b >= 64 && b <= 127) || a >= 224;
+  }
+  if (net.isIPv6(ip)) {
+    const v = ip.toLowerCase();
+    if (v === '::1' || v === '::') return true;
+    const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(v);
+    if (mapped) return isPrivateAddress(mapped[1]);
+    return /^f[cd]/.test(v) || /^fe[89ab]/.test(v);
+  }
+  return true;
+}
+
+/** A cleaned endpoint URL, or an error: https (http only for local testing), no user:password. */
+function cleanUrl(raw) {
+  let u;
+  try { u = new URL(String(raw || '').trim()); } catch { throw webhookError('Enter the full address, starting with https://'); }
+  if (u.protocol !== 'https:' && !(u.protocol === 'http:' && allowPrivate())) throw webhookError('The address must start with https://');
+  if (u.username || u.password) throw webhookError('Leave the user name and password out of the address');
+  if (!allowPrivate() && (u.hostname === 'localhost' || (net.isIP(u.hostname) && isPrivateAddress(u.hostname)))) {
+    throw webhookError('That address is on a private network — webhooks only go to public addresses');
+  }
+  return u.toString();
+}
+
+/** Refuses a host that resolves to a private address (checked at every send: DNS can change). */
+async function assertPublicHost(hostname) {
+  if (allowPrivate()) return;
+  const addresses = net.isIP(hostname) ? [{ address: hostname }] : await dns.lookup(hostname, { all: true });
+  if (!addresses.length || addresses.some(a => isPrivateAddress(a.address))) {
+    throw webhookError(`${hostname} points to a private network address`);
+  }
+}
+
+// ─── Signing ─────────────────────────────────────────────────────────────────
+
+const newSecret = () => `whsec_${crypto.randomBytes(24).toString('base64url')}`;
+
+/** The signature header for a body: t=<seconds>,v1=<hex HMAC-SHA256 of "<t>.<body>">. */
+function signatureHeader(secret, body, at = Date.now()) {
+  const t = Math.floor(at / 1000);
+  const v1 = crypto.createHmac('sha256', secret).update(`${t}.${body}`).digest('hex');
+  return `t=${t},v1=${v1}`;
+}
+
+// ─── Endpoints (cached for `notice`) ─────────────────────────────────────────
+
+let endpointCache = null;
+let endpointCacheAt = 0;
+async function activeEndpoints() {
+  if (!endpointCache || Date.now() - endpointCacheAt > 60e3) {
+    endpointCache = await prisma.webhookEndpoint.findMany({ where: { isActive: true }, select: { id: true, events: true } });
+    endpointCacheAt = Date.now();
+  }
+  return endpointCache;
+}
+function forgetEndpoints() { endpointCache = null; }
+
+// ─── Noticing events ─────────────────────────────────────────────────────────
+
+const queue = [];
+let flushTimer = null;
+const FLUSH_DELAY_MS = 1500;
+
+/**
+ * Something happened (from the Prisma extension). Queued and checked again shortly; never throws.
+ * `ref` is the record's id.
+ */
+function notice(type, ref) {
+  if (!TYPES.has(type) || !ref) return;
+  if (String(process.env.WEBHOOKS_ENABLED || 'true').toLowerCase() === 'false') return;
+  queue.push({ type, ref, at: new Date() });
+  if (!flushTimer) {
+    flushTimer = setTimeout(() => { flushTimer = null; flush().catch(e => console.warn('[webhooks] flush:', e?.message || e)); }, FLUSH_DELAY_MS);
+    flushTimer.unref?.();
+  }
+}
+
+/** Builds and stores the deliveries for what was noticed, then sends them. */
+async function flush() {
+  const items = queue.splice(0, queue.length);
+  if (!items.length) return [];
+  const endpoints = await activeEndpoints();
+  const made = [];
+  for (const item of items) {
+    const targets = endpoints.filter(e => e.events.includes(item.type));
+    if (!targets.length) continue;
+    let built;
+    try { built = await buildPayload(item.type, item.ref); } catch (e) { console.warn(`[webhooks] ${item.type} ${item.ref}:`, e?.message || e); continue; }
+    if (!built) continue;
+    const eventId = `evt_${crypto.randomUUID()}`;
+    const payload = { id: eventId, type: item.type, createdAt: item.at.toISOString(), data: built.data };
+    for (const ep of targets) {
+      made.push(await prisma.webhookDelivery.create({ data: { endpointId: ep.id, eventId, type: item.type, payload, userId: built.userId || null } }));
+    }
+  }
+  for (const d of made) await send(d.id).catch(e => console.warn('[webhooks] send:', e?.message || e));
+  return made;
+}
+
+// ─── Payloads ────────────────────────────────────────────────────────────────
+
+const frontendUrl = () => String(process.env.FRONTEND_URL || process.env.APP_BASE_URL || 'http://localhost:3001').replace(/\/$/, '');
+const person = u => (u ? { id: u.id, name: u.name, email: u.email, phone: u.phoneNumber || null } : null);
+const eventRef = e => (e ? { id: e.id, title: e.title, startDate: e.startDate, endDate: e.endDate } : null);
+const reservedIds = e => new Set([e?.kidsOptionId, e?.volunteerOptionId].filter(Boolean));
+const EVENT_SELECT = { id: true, title: true, startDate: true, endDate: true, kidsOptionId: true, volunteerOptionId: true };
+const USER_SELECT = { id: true, name: true, email: true, phoneNumber: true };
+
+async function registrationData(id, status) {
+  const r = await prisma.registration.findUnique({
+    where: { id },
+    include: {
+      event: { select: EVENT_SELECT }, user: { select: USER_SELECT }, payments: true,
+      registrationOptions: { include: { eventOption: { select: { id: true, name: true } }, variant: { select: { name: true } }, tranches: true } },
+    },
+  });
+  if (!r || (status && r.status !== status)) return null;
+  // Kids check-in and volunteer places are internal (and can be about children): never sent.
+  const reserved = reservedIds(r.event);
+  if (r.registrationOptions.length && r.registrationOptions.every(o => reserved.has(o.eventOptionId))) return null;
+  const { computeRegistrationTotalDue } = require('./pricing');
+  const totalDue = Math.round(computeRegistrationTotalDue(r, new Date()) * 100) / 100;
+  const paid = Math.round(r.payments.reduce((s, p) => s + p.amount, 0) * 100) / 100;
+  return {
+    userId: r.userId,
+    data: {
+      registration: {
+        id: r.id, status: r.status, createdAt: r.createdAt, totalDue, amountPaid: paid,
+        seasonPassPurchaseId: r.seasonPassPurchaseId || null,
+        items: r.registrationOptions.filter(o => !reserved.has(o.eventOptionId)).map(o => ({ ticket: o.eventOption?.name, variant: o.variant?.name || null, quantity: o.quantity, unitPrice: o.priceSnapshot })),
+      },
+      event: eventRef(r.event),
+      person: person(r.user),
+    },
+  };
+}
+
+async function buildPayload(type, ref) {
+  switch (type) {
+    case 'registration.created': return registrationData(ref);
+    case 'registration.paid': return registrationData(ref, 'paid');
+    case 'registration.cancelled': return registrationData(ref, 'cancelled');
+    case 'payment.received':
+    case 'payment.refunded': {
+      const p = await prisma.payment.findUnique({ where: { id: ref }, include: { user: { select: USER_SELECT }, event: { select: EVENT_SELECT } } });
+      if (!p) return null;
+      return {
+        userId: p.userId,
+        data: {
+          payment: { id: p.id, amount: p.amount, method: p.method, provider: p.provider || null, isDonation: p.isDonation, registrationId: p.registrationId, createdAt: p.createdAt },
+          event: eventRef(p.event),
+          person: person(p.user),
+        },
+      };
+    }
+    case 'ticket.checked_in': {
+      const u = await prisma.ticketUsage.findUnique({
+        where: { id: ref },
+        include: {
+          session: { select: { id: true, label: true, startsAt: true } },
+          ticket: { include: { event: { select: EVENT_SELECT }, user: { select: USER_SELECT }, holder: { select: USER_SELECT }, attendee: { select: { name: true } }, registrationOption: { select: { eventOptionId: true } } } },
+        },
+      });
+      if (!u) return null;
+      if (reservedIds(u.ticket.event).has(u.ticket.registrationOption?.eventOptionId)) return null;
+      // A transferred ticket belongs to its holder now.
+      const who = u.ticket.holder || u.ticket.user;
+      return {
+        userId: who?.id || u.ticket.userId,
+        data: {
+          checkIn: { id: u.id, scannedAt: u.scannedAt, people: u.quantityRedeemed, manual: u.manual, offline: u.offline, session: u.session || null },
+          ticket: { id: u.ticket.id, registrationOptionId: u.ticket.registrationOptionId, holderName: u.ticket.attendee?.name || who?.name || null },
+          event: eventRef(u.ticket.event),
+          person: person(who),
+        },
+      };
+    }
+    case 'user.created': {
+      const user = await prisma.user.findUnique({ where: { id: ref }, select: { ...USER_SELECT, role: true, createdAt: true } });
+      if (!user) return null;
+      return { userId: user.id, data: { person: { ...person(user), role: user.role, createdAt: user.createdAt } } };
+    }
+    case 'event.published': {
+      const e = await prisma.event.findUnique({
+        where: { id: ref },
+        select: { ...EVENT_SELECT, description: true, location: true, price: true, isActive: true, isHidden: true, goLiveAt: true, campus: { select: { name: true, slug: true } }, series: { select: { name: true, slug: true } } },
+      });
+      if (!e || !e.isActive || e.isHidden) return null;
+      return {
+        userId: null,
+        data: {
+          event: {
+            id: e.id, title: e.title, description: e.description, startDate: e.startDate, endDate: e.endDate, location: e.location,
+            price: e.price, goLiveAt: e.goLiveAt, url: `${frontendUrl()}/events/${e.id}`, campus: e.campus || null, series: e.series || null,
+          },
+        },
+      };
+    }
+    default: return null;
+  }
+}
+
+// ─── Sending ─────────────────────────────────────────────────────────────────
+
+/** The wait before the next try after `attempts` failed tries, or null when it's given up. Pure. */
+function retryDelay(attempts) {
+  return attempts < MAX_ATTEMPTS ? RETRY_AFTER_MS[attempts - 1] : null;
+}
+
+/** POSTs one delivery (claimed first, so two workers never send it twice). */
+async function send(deliveryId) {
+  const claimed = await prisma.webhookDelivery.updateMany({ where: { id: deliveryId, status: { in: ['pending', 'retrying'] } }, data: { status: 'sending', nextAttemptAt: new Date() } });
+  if (!claimed.count) return null;
+  const d = await prisma.webhookDelivery.findUnique({ where: { id: deliveryId }, include: { endpoint: true } });
+  const attempts = d.attempts + 1;
+  const body = JSON.stringify(d.payload);
+  let statusCode = null;
+  let error = null;
+  try {
+    if (!d.endpoint.isActive) throw webhookError('The endpoint is switched off');
+    const url = new URL(cleanUrl(d.endpoint.url));
+    await assertPublicHost(url.hostname);
+    const res = await fetch(url, {
+      method: 'POST',
+      redirect: 'manual',
+      signal: AbortSignal.timeout(TIMEOUT_MS),
+      headers: {
+        'Content-Type': 'application/json',
+        'User-Agent': 'CrossEvents-Webhooks/1',
+        'X-CrossEvents-Event': d.type,
+        'X-CrossEvents-Delivery': d.id,
+        'X-CrossEvents-Signature': signatureHeader(decrypt(d.endpoint.secret), body),
+      },
+      body,
+    });
+    statusCode = res.status;
+    if (res.status < 200 || res.status >= 300) error = `Answered ${res.status}${res.status >= 300 && res.status < 400 ? ' (redirects are not followed)' : ''}`;
+  } catch (e) {
+    error = e?.name === 'TimeoutError' ? `No answer within ${TIMEOUT_MS / 1000} seconds` : (e?.message || String(e));
+  }
+  const now = new Date();
+  const ok = !error;
+  const wait = ok ? null : retryDelay(attempts);
+  const updated = await prisma.webhookDelivery.update({
+    where: { id: d.id },
+    data: {
+      attempts, lastStatusCode: statusCode, lastError: error ? String(error).slice(0, 500) : null,
+      status: ok ? 'succeeded' : wait ? 'retrying' : 'failed',
+      deliveredAt: ok ? now : null,
+      nextAttemptAt: wait ? new Date(now.getTime() + wait) : now,
+    },
+  });
+  await prisma.webhookEndpoint.update({ where: { id: d.endpointId }, data: ok ? { lastSuccessAt: now } : { lastFailureAt: now } }).catch(() => {});
+  return updated;
+}
+
+/** The `webhooks` job: sends what's due, picks up sends cut off by a restart, prunes old deliveries. */
+async function runJob(now = new Date()) {
+  // A send is claimed with nextAttemptAt = now; one still "sending" 5 minutes later was cut off.
+  await prisma.webhookDelivery.updateMany({ where: { status: 'sending', nextAttemptAt: { lt: new Date(now.getTime() - 5 * 60e3) } }, data: { status: 'retrying' } });
+  const due = await prisma.webhookDelivery.findMany({ where: { status: { in: ['pending', 'retrying'] }, nextAttemptAt: { lte: now } }, orderBy: { nextAttemptAt: 'asc' }, take: 100, select: { id: true } });
+  let sent = 0;
+  let failed = 0;
+  for (const { id } of due) {
+    const r = await send(id).catch(() => null);
+    if (r?.status === 'succeeded') sent++;
+    else if (r) failed++;
+  }
+  const pruned = await prisma.webhookDelivery.deleteMany({ where: { createdAt: { lt: new Date(now.getTime() - KEEP_DAYS * 864e5) } } });
+  return { due: due.length, sent, failed, pruned: pruned.count };
+}
+
+/** Sends a delivery again now (a fresh try, whatever happened before). */
+async function resend(deliveryId) {
+  const d = await prisma.webhookDelivery.findUnique({ where: { id: deliveryId }, select: { id: true } });
+  if (!d) throw webhookError('Delivery not found', 404);
+  await prisma.webhookDelivery.update({ where: { id: d.id }, data: { status: 'pending', attempts: 0, nextAttemptAt: new Date() } });
+  return send(d.id);
+}
+
+/** A "webhook.test" delivery to one endpoint, sent at once. */
+async function sendTest(endpointId) {
+  const eventId = `evt_${crypto.randomUUID()}`;
+  const payload = { id: eventId, type: 'webhook.test', createdAt: new Date().toISOString(), data: { message: 'A test from Cross Events. If you can read this, the webhook works.' } };
+  const d = await prisma.webhookDelivery.create({ data: { endpointId, eventId, type: 'webhook.test', payload } });
+  return send(d.id);
+}
+
+module.exports = {
+  EVENT_TYPES, TYPES, MAX_ATTEMPTS, KEEP_DAYS,
+  isPrivateAddress, cleanUrl, assertPublicHost, newSecret, signatureHeader, encrypt,
+  notice, flush, buildPayload, retryDelay, send, runJob, resend, sendTest, forgetEndpoints, webhookError,
+};
@@ -0,0 +1,95 @@
+const mockDb = {
+  registration: { findMany: jest.fn(), findUnique: jest.fn() },
+  eventOption: { findMany: jest.fn() },
+  attendee: { findMany: jest.fn(), updateMany: jest.fn() },
+  registrationOption: { findMany: jest.fn(), update: jest.fn() },
+  registrationOptionTranche: { deleteMany: jest.fn(), create: jest.fn() },
+  user: { findUnique: jest.fn().mockResolvedValue({ role: "user" }) },
+  $transaction: jest.fn(fn => fn(mockDb)),
+};
+const mockLeft = jest.fn().mockResolvedValue(null);
+jest.mock("../src/utils/stock", () => ({ remainingFor: (...a) => mockLeft(...a) }));
+jest.mock("../src/utils/pricing", () => ({ resolveOptionPrice: jest.fn().mockResolvedValue({ price: 150, tierId: null }) }));
+const mockStatus = jest.fn();
+jest.mock("../src/payments/webhook", () => ({ updateRegistrationStatus: (...a) => mockStatus(...a) }));
+jest.mock('../src/config/db', () => mockDb);
+jest.mock('../src/utils/adminAudit', () => ({ logAdminAction: jest.fn() }));
+const mockLicence = jest.fn().mockResolvedValue({ readOnly: false });
+jest.mock('../src/hub/licence', () => ({ licenceStatus: (...a) => mockLicence(...a) }));
+const mockCancel = jest.fn();
+const mockUpdate = jest.fn();
+jest.mock('../src/controllers/registrationController', () => ({
+  cancelRegistration: (req, res) => mockCancel(req, res),
+  updateRegistrationOptions: (req, res) => mockUpdate(req, res),
+}));
+const mockAssign = jest.fn();
+jest.mock('../src/controllers/allocationController', () => ({ assign: (req, res) => mockAssign(req, res) }));
+const mockEmail = jest.fn();
+jest.mock('../src/controllers/eventController', () => ({ emailEventAttendees: (req, res) => mockEmail(req, res), whatsappEventAttendees: jest.fn() }));
+
+const bulk = require('../src/utils/bulkRegistrations');
+const { isBlocked } = require('../src/hub/readOnly');
+
+const req = { user: { id: 'sup', role: 'supervisor' } };
+const reg = (id, extra = {}) => ({ id, userId: `u-${id}`, eventId: 'ev1', status: 'pending', seasonPassPurchaseId: null, registrationOptions: [{ eventOptionId: 'adult', variantId: null, quantity: 1, sessionId: null }], ...extra });
+
+beforeEach(() => jest.clearAllMocks());
+
+test('the input is checked before anything runs', async () => {
+  await expect(bulk.runBulk(req, { action: 'explode', registrationIds: ['a'] })).rejects.toThrow('Unknown');
+  await expect(bulk.runBulk(req, { action: 'cancel', registrationIds: [] })).rejects.toThrow('Tick at least one');
+  await expect(bulk.runBulk(req, { action: 'cancel', registrationIds: Array.from({ length: 501 }, (_, i) => `r${i}`) })).rejects.toThrow('At most 500');
+});
+
+test('cancelling runs the normal cancel for each; already-cancelled ones are skipped; a refusal is reported', async () => {
+  mockDb.registration.findMany.mockResolvedValue([reg('a'), reg('b', { status: 'cancelled' }), reg('c')]);
+  mockCancel.mockImplementation((r, res) => (r.params.id === 'c' ? res.status(403).json({ message: 'has payments' }) : res.json({ message: 'Registration cancelled' })));
+  const out = await bulk.runBulk(req, { action: 'cancel', registrationIds: ['a', 'b', 'c', 'gone'] });
+  expect(out).toMatchObject({ done: 1, skipped: 1, failed: 2 });
+  expect(out.results.find(r => r.id === 'c')).toMatchObject({ ok: false, message: 'has payments' });
+  expect(out.results.find(r => r.id === 'gone')).toMatchObject({ ok: false, message: 'Not found' });
+  expect(mockCancel).toHaveBeenCalledTimes(2);
+  expect(mockCancel.mock.calls[0][0].user).toBe(req.user);
+});
+
+test('moving keeps the same lines and tickets, repriced; checks places; not other events or season passes', async () => {
+  mockDb.eventOption.findMany.mockResolvedValue([
+    { id: 'adult', eventId: 'ev1', name: 'Adult', event: { id: 'ev1', cashupStatus: 'open' } },
+    { id: 'vip', eventId: 'ev1', name: 'VIP', event: { id: 'ev1', cashupStatus: 'open' } },
+  ]);
+  mockDb.registration.findMany.mockResolvedValue([reg('a'), reg('b', { eventId: 'ev2' }), reg('c', { seasonPassPurchaseId: 'p1' }), reg('d')]);
+  mockDb.registrationOption.findMany.mockResolvedValue([{ id: 'line1', quantity: 1 }]);
+  mockLeft.mockResolvedValueOnce(null).mockResolvedValueOnce(0);
+  mockStatus.mockResolvedValue({ totalDue: 150, totalPaid: 100 });
+  const out = await bulk.runBulk(req, { action: 'moveOption', registrationIds: ['a', 'b', 'c', 'd'], fromOptionId: 'adult', toOptionId: 'vip' });
+  expect(out.results.find(r => r.id === 'a')).toMatchObject({ ok: true, message: 'Moved — R50.00 now owing' });
+  expect(mockDb.registrationOption.update).toHaveBeenCalledWith({ where: { id: 'line1' }, data: { eventOptionId: 'vip', variantId: null, priceSnapshot: 150, appliedTierId: null } });
+  expect(mockDb.attendee.updateMany).toHaveBeenCalledWith({ where: { registrationOptionId: 'line1' }, data: { eventOptionId: 'vip', variantId: null } });
+  expect(out.results.find(r => r.id === 'b').message).toBe('Not for this event');
+  expect(out.results.find(r => r.id === 'c').message).toMatch(/season pass/);
+  expect(out.results.find(r => r.id === 'd')).toMatchObject({ ok: false, message: 'Only 0 places left on VIP' });
+});
+
+test('payments and ticket changes are refused in licence read-only mode; cancelling is not', async () => {
+  mockLicence.mockResolvedValueOnce({ readOnly: true });
+  await expect(bulk.runBulk(req, { action: 'markPaid', registrationIds: ['a'], method: 'cash' })).rejects.toMatchObject({ statusCode: 403 });
+  expect(isBlocked('POST', '/api/registrations/bulk')).toBe(false);
+});
+
+test('allocating places each named person; a registration without names says so', async () => {
+  mockDb.registration.findMany.mockResolvedValue([reg('a'), reg('b')]);
+  mockDb.attendee.findMany.mockImplementation(({ where }) => Promise.resolve(where.registrationId === 'a' ? [{ id: 'p1', name: 'Amy' }, { id: 'p2', name: 'Ben' }] : []));
+  mockAssign.mockImplementation((r, res) => (r.body.attendeeId === 'p2' ? res.status(400).json({ message: 'Cabin 3 is full' }) : res.json({})));
+  const out = await bulk.runBulk(req, { action: 'allocate', registrationIds: ['a', 'b'], setId: 's1', groupId: 'g1' });
+  expect(out.results.find(r => r.id === 'a')).toMatchObject({ ok: false, message: 'Ben: Cabin 3 is full' });
+  expect(out.results.find(r => r.id === 'b').message).toMatch(/No named people/);
+});
+
+test('messages go per event as an event update to exactly the ticked registrations', async () => {
+  mockDb.registration.findMany.mockResolvedValue([reg('a'), reg('b'), reg('c', { eventId: 'ev2' })]);
+  mockEmail.mockImplementation((r, res) => res.json({ sent: r.body.filter.registrationIds.length }));
+  const out = await bulk.runBulk(req, { action: 'message', registrationIds: ['a', 'b', 'c'], channel: 'email', subject: 'Bus times', text: 'The bus leaves at 7:30.' });
+  expect(out.done).toBe(3);
+  expect(mockEmail.mock.calls.map(c => [c[0].params.id, c[0].body.filter.registrationIds, c[0].body.kind])).toEqual([['ev1', ['a', 'b'], 'update'], ['ev2', ['c'], 'update']]);
+  await expect(bulk.runBulk(req, { action: 'message', registrationIds: ['a'], channel: 'email', text: 'x' })).rejects.toThrow('subject');
+});
@@ -0,0 +1,86 @@
+const count = jest.fn().mockResolvedValue(2);
+const mockDb = {
+  registration: { count, findMany: jest.fn().mockResolvedValue([]) },
+  consentRequest: { findMany: jest.fn().mockResolvedValue([]) },
+  waitlistEntry: { count },
+  volunteerSwap: { count },
+  servingRole: { findMany: jest.fn().mockResolvedValue([{ needed: 3, _count: { slots: 1 } }, { needed: 2, _count: { slots: 2 } }]) },
+  event: { count, findMany: jest.fn().mockResolvedValue([]) },
+  providerTransaction: { count },
+  dataRequest: { count },
+  webhookDelivery: { count },
+  payment: { findMany: jest.fn().mockResolvedValue([]) },
+  user: { findMany: jest.fn().mockResolvedValue([]) },
+};
+jest.mock('../src/config/db', () => mockDb);
+const mockScope = jest.fn();
+jest.mock('../src/utils/campusScope', () => ({
+  scopeFor: (...a) => mockScope(...a),
+  eventWhere: scope => (scope ? { OR: [{ campusId: { in: scope.campusIds } }, { campusId: null }] } : {}),
+}));
+
+const dashboard = require('../src/utils/dashboard');
+
+beforeEach(() => jest.clearAllMocks());
+
+test('an amount typed in the palette', () => {
+  expect(dashboard.amountOf('R450')).toBe(450);
+  expect(dashboard.amountOf('r 450,50')).toBe(450.5);
+  expect(dashboard.amountOf('450.5')).toBe(450.5);
+  expect(dashboard.amountOf('Camp 2026')).toBeNull();
+  expect(dashboard.amountOf('')).toBeNull();
+});
+
+describe('what is waiting', () => {
+  test('admins see everything they can act on', async () => {
+    const items = await dashboard.pendingItems({ user: { role: 'admin' } }, null);
+    expect(items.map(i => i.key)).toEqual(['privacy', 'unpaid', 'cover', 'roster', 'waitlist', 'reconcile', 'cashup', 'webhooks']);
+    // Only roles still short of people count.
+    expect(items.find(i => i.key === 'roster').count).toBe(1);
+    expect(items.find(i => i.key === 'unpaid').href).toBe('/dashboard/admin/registrations?status=pending');
+  });
+
+  test('a campus-limited supervisor: no cashups, provider payments, privacy or webhooks; only their events', async () => {
+    const scope = { campusIds: ['north'] };
+    const items = await dashboard.pendingItems({ user: { role: 'supervisor' } }, scope);
+    expect(items.map(i => i.key)).toEqual(['unpaid', 'cover', 'roster', 'waitlist']);
+    expect(items.find(i => i.key === 'unpaid').href).toBe('/dashboard/supervisor/reports?report=regStatus');
+    const where = mockDb.registration.count.mock.calls[0][0].where;
+    expect(where.event.AND[0]).toEqual({ OR: [{ campusId: { in: ['north'] } }, { campusId: null }] });
+  });
+
+  test('items with nothing waiting are left out', async () => {
+    count.mockResolvedValue(0);
+    mockDb.servingRole.findMany.mockResolvedValueOnce([]);
+    expect(await dashboard.pendingItems({ user: { role: 'admin' } }, null)).toEqual([]);
+    count.mockResolvedValue(2);
+  });
+});
+
+describe('palette search', () => {
+  test('too short a query finds nothing', async () => {
+    expect(await dashboard.search({ user: { role: 'admin' } }, 'a')).toEqual([]);
+  });
+
+  test('staff get events only, linked to the public page', async () => {
+    mockScope.mockResolvedValue(null);
+    mockDb.event.findMany.mockResolvedValueOnce([{ id: 'e1', title: 'Camp 2026', startDate: new Date('2026-03-01'), isActive: true, campus: null }]);
+    const out = await dashboard.search({ user: { role: 'staff' } }, 'camp');
+    expect(out).toEqual([expect.objectContaining({ type: 'event', href: '/events/e1' })]);
+    expect(mockDb.user.findMany).not.toHaveBeenCalled();
+    expect(mockDb.payment.findMany).not.toHaveBeenCalled();
+  });
+
+  test('supervisors find payments by amount; admins also people', async () => {
+    mockScope.mockResolvedValue(null);
+    mockDb.payment.findMany.mockResolvedValueOnce([{ id: 'p1', amount: 450, method: 'card', createdAt: new Date(), registrationId: 'r1', user: { name: 'Thandi' }, event: { title: 'Camp' } }]);
+    const sup = await dashboard.search({ user: { role: 'supervisor' } }, 'R450');
+    expect(sup.find(r => r.type === 'payment')).toMatchObject({ title: 'R450.00 — Thandi', href: '/dashboard/supervisor/payments' });
+    expect(mockDb.payment.findMany.mock.calls[0][0].where.amount).toEqual({ in: [450, -450] });
+    expect(mockDb.user.findMany).not.toHaveBeenCalled();
+
+    mockDb.user.findMany.mockResolvedValueOnce([{ id: 'u1', name: 'Thandi Test', email: 't@test.local', role: 'user' }]);
+    const adm = await dashboard.search({ user: { role: 'admin' } }, 'thandi');
+    expect(adm.find(r => r.type === 'person')).toMatchObject({ href: '/dashboard/admin/users?q=t%40test.local' });
+  });
+});
@@ -148,12 +148,18 @@ test('version comparison for "update available"', () => {

 test('an update request shows until the site runs the version asked for', () => {
  const at = '2026-10-27T09:00:00.000Z';
-  expect(pendingUpdateRequest('1.41.2', at, '1.42.0')).toEqual({ requestedAt: at, version: '1.42.0' });
+  expect(pendingUpdateRequest('1.41.2', at, '1.42.0')).toEqual({ requestedAt: at, version: '1.42.0', outdated: false });
  expect(pendingUpdateRequest('1.42.0', at, '1.42.0')).toBeNull();
  expect(pendingUpdateRequest('1.43.0', at, '1.42.0')).toBeNull();
  expect(pendingUpdateRequest('1.41.2', null, null)).toBeNull();
 });

+test('a request for a version that has since been overtaken can be changed', () => {
+  const at = '2026-10-27T09:00:00.000Z';
+  expect(pendingUpdateRequest('1.46.2', at, '1.47.0', '1.47.3')).toEqual({ requestedAt: at, version: '1.47.0', outdated: true });
+  expect(pendingUpdateRequest('1.46.2', at, '1.47.3', '1.47.3')).toEqual({ requestedAt: at, version: '1.47.3', outdated: false });
+});
+
 describe("what's new", () => {
  const releases = [
    { version: '1.46.0', notes: 'Older', urgent: false, releasedAt: '2026-10-20T10:00:00.000Z' },
@@ -0,0 +1,67 @@
+// Asking for an update again after a newer version came out: the request moves on to it — on the
+// Hub itself (1.5.0, `changed`), or by withdrawing and asking again with an older Hub.
+const mockSettings = new Map();
+jest.mock('../src/config/db', () => ({
+  appSetting: {
+    findMany: jest.fn(async ({ where }) => [...mockSettings].filter(([key]) => where.key.in.includes(key)).map(([key, value]) => ({ key, value }))),
+    upsert: jest.fn(async ({ where, create }) => { mockSettings.set(where.key, create.value); }),
+    deleteMany: jest.fn(async ({ where }) => { mockSettings.delete(where.key); }),
+  },
+}));
+jest.mock('../src/hub/report', () => ({ APP_VERSION: '1.46.2' }));
+
+const { encrypt } = require('../src/utils/encryption');
+const hub = require('../src/hub/client');
+
+const reply = (status, body) => ({ ok: status < 400, status, json: async () => body });
+
+describe('changing an update request', () => {
+  let calls;
+  beforeEach(() => {
+    mockSettings.clear();
+    mockSettings.set('hub_install_id', 'install-1');
+    mockSettings.set('hub_install_secret', encrypt('secret'));
+    mockSettings.set('hub_update_requested_at', '2026-10-20T09:00:00.000Z');
+    mockSettings.set('hub_update_requested_version', '1.47.0');
+    calls = [];
+  });
+  afterEach(() => { delete global.fetch; });
+
+  test('Hub 1.5.0 moves the open request on to the latest version', async () => {
+    global.fetch = jest.fn(async url => {
+      calls.push(new URL(url).pathname);
+      return reply(200, { requestedAt: '2026-10-28T09:00:00.000Z', version: '1.47.3', alreadyRequested: true, changed: true, previousVersion: '1.47.0' });
+    });
+    const out = await hub.requestUpdate();
+    expect(calls).toEqual(['/api/installs/update-request']);
+    expect(out).toMatchObject({ version: '1.47.3', changed: true, previousVersion: '1.47.0' });
+    expect(mockSettings.get('hub_update_requested_version')).toBe('1.47.3');
+    expect(mockSettings.get('hub_update_requested_at')).toBe('2026-10-28T09:00:00.000Z');
+  });
+
+  test('an older Hub (no `changed`): the old request is withdrawn and made again', async () => {
+    let open = true;
+    global.fetch = jest.fn(async url => {
+      const path = new URL(url).pathname;
+      calls.push(path);
+      if (path.endsWith('/cancel')) { open = false; return reply(200, { cancelled: true }); }
+      return open
+        ? reply(200, { requestedAt: '2026-10-20T09:00:00.000Z', version: '1.47.3', alreadyRequested: true })
+        : reply(201, { requestedAt: '2026-10-28T09:00:00.000Z', version: '1.47.3', alreadyRequested: false });
+    });
+    const out = await hub.requestUpdate();
+    expect(calls).toEqual(['/api/installs/update-request', '/api/installs/update-request/cancel', '/api/installs/update-request']);
+    expect(out).toMatchObject({ version: '1.47.3', changed: true, previousVersion: '1.47.0' });
+    expect(mockSettings.get('hub_update_requested_version')).toBe('1.47.3');
+  });
+
+  test('asking again for the version already asked for changes nothing', async () => {
+    mockSettings.set('hub_update_requested_version', '1.47.3');
+    global.fetch = jest.fn(async url => {
+      calls.push(new URL(url).pathname);
+      return reply(200, { requestedAt: '2026-10-20T09:00:00.000Z', version: '1.47.3', alreadyRequested: true });
+    });
+    await hub.requestUpdate();
+    expect(calls).toEqual(['/api/installs/update-request']);
+  });
+});
@@ -60,18 +60,23 @@ describe('cleanSections', () => {
 });

 describe('noticePromptPending', () => {
-  test('nobody is asked while no version needs re-acceptance', async () => {
+  test('someone who never accepted any version is asked once (first)', async () => {
    prisma.privacyNotice.findFirst.mockResolvedValue(null);
-    expect(await notice.noticePromptPending({ noticeVersionAccepted: null })).toBe(false);
+    expect(await notice.noticePromptPending({ noticeVersionAccepted: null })).toBe('first');
+  });
+
+  test('nobody else is asked while no version needs re-acceptance', async () => {
+    prisma.privacyNotice.findFirst.mockResolvedValue(null);
+    expect(await notice.noticePromptPending({ noticeVersionAccepted: 0 })).toBe(false);
  });

  test('asked when they accepted an older version than the newest one that needs it', async () => {
    prisma.privacyNotice.findFirst.mockResolvedValue({ version: 3 });
-    expect(await notice.noticePromptPending({ noticeVersionAccepted: 2 })).toBe(true);
-    expect(await notice.noticePromptPending({ noticeVersionAccepted: null })).toBe(true);
+    expect(await notice.noticePromptPending({ noticeVersionAccepted: 2 })).toBe('updated');
+    expect(await notice.noticePromptPending({ noticeVersionAccepted: 0 })).toBe('updated');
    expect(await notice.noticePromptPending({ noticeVersionAccepted: 3 })).toBe(false);
    expect(await notice.noticePromptPending({ noticeVersionAccepted: 5 })).toBe(false);
-    expect(prisma.privacyNotice.findFirst.mock.calls[0][0].where).toEqual({ requiresAcceptance: true });
+    expect(prisma.privacyNotice.findFirst.mock.calls.at(-1)[0].where).toEqual({ requiresAcceptance: true });
  });
 });

@@ -107,3 +112,32 @@ describe('reportRowCount', () => {
    expect(reportRowCount(null)).toBe(0);
  });
 });
+
+describe('changes to the built-in text', () => {
+  test('a site that never published shows the built-in text, so there is nothing to review', async () => {
+    prisma.privacyNotice.findFirst.mockResolvedValue(null);
+    expect(await notice.builtInUpdates()).toEqual([]);
+  });
+
+  test('a site with its own version is shown the changes it has not reviewed', async () => {
+    prisma.privacyNotice.findFirst.mockResolvedValue({ version: 2 });
+    prisma.appSetting.findUnique.mockResolvedValue(null);
+    expect((await notice.builtInUpdates()).map(u => u.revision)).toContain('1.48.1');
+    prisma.appSetting.findUnique.mockResolvedValue({ value: notice.BUILT_IN_REVISION });
+    expect(await notice.builtInUpdates()).toEqual([]);
+  });
+
+  test('every changed section exists in the built-in text', () => {
+    const ids = notice.defaultSections().map(s => s.id);
+    for (const u of notice.BUILT_IN_UPDATES) for (const id of u.sections) expect(ids).toContain(id);
+    expect(notice.revisionLess('1.47.9', '1.48.1')).toBe(true);
+    expect(notice.revisionLess('1.48.10', '1.48.9')).toBe(false);
+  });
+
+  test('the built-in text covers the features since 1.46', () => {
+    const all = notice.defaultSections().map(s => s.body).join('\n');
+    for (const words of ['volunteer', 'series you follow', 'season pass', 'webhook', 'cross_events_dismissed_notices', 'activate an account']) {
+      expect([words, all.toLowerCase().includes(words.toLowerCase())]).toEqual([words, true]);
+    }
+  });
+});
@@ -0,0 +1,41 @@
+const mockDb = {
+  savedFilter: { findMany: jest.fn(), findUnique: jest.fn(), count: jest.fn(), create: jest.fn(), update: jest.fn(), updateMany: jest.fn(), delete: jest.fn() },
+  $transaction: jest.fn(fn => fn(mockDb)),
+};
+jest.mock('../src/config/db', () => mockDb);
+const filters = require('../src/utils/savedFilters');
+
+beforeEach(() => jest.clearAllMocks());
+
+test('only simple filter values are kept', () => {
+  expect(filters.cleanParams({ q: 'Thandi', status: 'pending', past: true, events: ['a', 'b', 3], n: 2, nested: { x: 1 }, 'bad key': 'x', fn: null })).toEqual({ q: 'Thandi', status: 'pending', past: true, events: ['a', 'b'], n: 2 });
+  expect(() => filters.cleanParams(null)).toThrow('Nothing to save');
+  expect(() => filters.cleanParams({ q: 'x'.repeat(500), a: 'x'.repeat(500), b: 'x'.repeat(500), c: 'x'.repeat(500), d: 'x'.repeat(500), e: 'x'.repeat(500), f: 'x'.repeat(500), g: 'x'.repeat(500), h: 'x'.repeat(500) })).toThrow('Too much');
+});
+
+test('pages and names are checked', async () => {
+  await expect(filters.list('u1', 'secrets')).rejects.toThrow('Unknown list page');
+  expect(() => filters.cleanName('   ')).toThrow('name');
+  expect(filters.cleanName('  Camp   — unpaid ')).toBe('Camp — unpaid');
+});
+
+test('saving a default clears the old default; saving the same name replaces it', async () => {
+  mockDb.savedFilter.findUnique.mockResolvedValue({ id: 'f1' });
+  mockDb.savedFilter.update.mockImplementation(async ({ data }) => ({ id: 'f1', page: 'registrations', name: 'Unpaid', ...data }));
+  await filters.save('u1', { page: 'registrations', name: 'Unpaid', params: { status: 'pending' }, isDefault: true });
+  expect(mockDb.savedFilter.updateMany).toHaveBeenCalledWith({ where: { userId: 'u1', page: 'registrations', isDefault: true }, data: { isDefault: false } });
+  expect(mockDb.savedFilter.create).not.toHaveBeenCalled();
+});
+
+test('at most 30 per page', async () => {
+  mockDb.savedFilter.findUnique.mockResolvedValue(null);
+  mockDb.savedFilter.count.mockResolvedValue(30);
+  await expect(filters.save('u1', { page: 'events', name: 'One more', params: { q: 'x' } })).rejects.toThrow('up to 30');
+});
+
+test('someone else\'s saved filter is "not found"', async () => {
+  mockDb.savedFilter.findUnique.mockResolvedValue({ id: 'f9', userId: 'someone-else', page: 'users' });
+  await expect(filters.remove('u1', 'f9')).rejects.toMatchObject({ statusCode: 404 });
+  await expect(filters.update('u1', 'f9', { name: 'Mine now' })).rejects.toMatchObject({ statusCode: 404 });
+  expect(mockDb.savedFilter.delete).not.toHaveBeenCalled();
+});
@@ -0,0 +1,120 @@
+const mockDb = {
+  payment: { findFirst: jest.fn(), create: jest.fn() },
+  seasonPassPurchase: { findUnique: jest.fn(), update: jest.fn() },
+  registration: { findUnique: jest.fn() },
+};
+jest.mock('../src/config/db', () => mockDb);
+const mockStatus = jest.fn();
+const mockSaveTx = jest.fn();
+jest.mock('../src/payments/webhook', () => ({
+  updateRegistrationStatus: (...a) => mockStatus(...a),
+  saveProviderTransaction: (...a) => mockSaveTx(...a),
+}));
+jest.mock('../src/utils/notifications', () => ({ sendPaymentEmails: jest.fn().mockResolvedValue() }));
+jest.mock('../src/controllers/ticketController', () => ({ emailTickets: jest.fn().mockResolvedValue() }));
+
+const pass = require('../src/utils/seasonPass');
+const { isBlocked } = require('../src/hub/readOnly');
+
+describe('season passes', () => {
+  describe('splitting the price', () => {
+    test('in proportion to normal prices, in whole cents that add up', () => {
+      // R400 pass: a R300 camp and two R50 breakfasts.
+      expect(pass.splitCents(40000, [30000, 5000, 5000])).toEqual([30000, 5000, 5000]);
+      // R100 over three equal events: the odd cent goes to the first.
+      expect(pass.splitCents(10000, [5000, 5000, 5000])).toEqual([3334, 3333, 3333]);
+      const parts = pass.splitCents(9999, [1234, 5678, 91]);
+      expect(parts.reduce((s, x) => s + x, 0)).toBe(9999);
+    });
+
+    test('free tickets everywhere: split equally', () => {
+      expect(pass.splitCents(9000, [0, 0, 0])).toEqual([3000, 3000, 3000]);
+    });
+
+    test('a variant\'s own price counts, else the ticket\'s', () => {
+      const items = [
+        { eventOption: { price: 300 }, variant: { price: 200 } },
+        { eventOption: { price: 50 }, variant: { price: null } },
+        { eventOption: { price: 50 }, variant: null },
+      ];
+      expect(pass.itemShares(240, items)).toEqual([160, 40, 40]);
+    });
+  });
+
+  test('a payment pays what each registration owes, in order; anything over goes to the last', () => {
+    expect(pass.allocate([160, 40, 40], 240)).toEqual([160, 40, 40]);
+    expect(pass.allocate([160, 40, 40], 100)).toEqual([100, 0, 0]);
+    expect(pass.allocate([0, 40, 40], 90)).toEqual([0, 40, 50]);
+  });
+
+  describe('when a pass is on sale', () => {
+    const now = new Date('2027-01-10T08:00:00Z');
+    const item = (start, extra = {}) => ({ event: { title: 'Breakfast', isActive: true, cashupStatus: 'open', startDate: new Date(start), endDate: new Date(start), scheduleType: 'single', sessions: [], ...extra } });
+    const base = { isActive: true, saleEndsAt: null, items: [item('2027-02-01T07:00:00Z'), item('2027-03-01T07:00:00Z')] };
+
+    test('on sale before the first event starts', () => {
+      expect(pass.notOnSale(base, now)).toBeNull();
+    });
+    test('stops when the first event starts, at the sale end, or switched off', () => {
+      expect(pass.notOnSale({ ...base, items: [item('2027-01-09T07:00:00Z'), ...base.items] }, now)).toMatch(/first event started/);
+      expect(pass.notOnSale({ ...base, saleEndsAt: new Date('2027-01-01') }, now)).toMatch(/no longer on sale/);
+      expect(pass.notOnSale({ ...base, isActive: false }, now)).toMatch(/isn't on sale/);
+      expect(pass.notOnSale({ ...base, items: [item('2027-02-01T07:00:00Z', { registrationDeadline: new Date('2027-01-05') })] }, now)).toMatch(/has closed/);
+    });
+  });
+
+  describe('recording the payment', () => {
+    const regs = [
+      { id: 'r1', eventId: 'camp', status: 'pending', createdAt: 1, registrationOptions: [{ quantity: 2, priceSnapshot: 160, tranches: [{ quantity: 2, priceSnapshot: 160 }] }], payments: [] },
+      { id: 'r2', eventId: 'b1', status: 'pending', createdAt: 2, registrationOptions: [{ quantity: 2, priceSnapshot: 40, tranches: [{ quantity: 2, priceSnapshot: 40 }] }], payments: [] },
+    ];
+    const event = { transaction: { externalId: 'ext-1', amountCents: 40000, status: 'succeeded', methodType: 'card', metadata: { type: 'season_pass', purchaseId: 'pp1' } } };
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+      mockDb.payment.findFirst.mockResolvedValue(null);
+      mockDb.seasonPassPurchase.findUnique.mockResolvedValue({ id: 'pp1', userId: 'u1', registrations: regs });
+      mockDb.payment.create.mockImplementation(({ data }) => Promise.resolve(data));
+      mockStatus.mockResolvedValue({ status: 'paid' });
+      mockSaveTx.mockResolvedValue();
+    });
+
+    test('one payment per event for its share; only the first carries the provider id', async () => {
+      const out = await pass.recordPassPayment('yoco', event, {});
+      const made = mockDb.payment.create.mock.calls.map(c => c[0].data);
+      expect(made.map(p => [p.registrationId, p.eventId, p.amount, p.externalId, p.seasonPassPurchaseId])).toEqual([
+        ['r1', 'camp', 320, 'ext-1', 'pp1'],
+        ['r2', 'b1', 80, null, 'pp1'],
+      ]);
+      expect(made.every(p => p.isDonation === undefined && p.originalPaymentId === undefined)).toBe(true);
+      expect(mockStatus).toHaveBeenCalledTimes(2);
+      expect(mockDb.seasonPassPurchase.update).toHaveBeenCalledWith({ where: { id: 'pp1' }, data: { status: 'paid' } });
+      expect(mockSaveTx.mock.calls[0][3]).toEqual({ reconciled: true, paymentId: made[0].id });
+      expect(out.status).toBe('success');
+    });
+
+    test('the same provider payment twice is recorded once', async () => {
+      mockDb.payment.findFirst.mockResolvedValue({ id: 'already' });
+      const out = await pass.recordPassPayment('yoco', event, {});
+      expect(out).toMatchObject({ status: 'already_processed', paymentId: 'already' });
+      expect(mockDb.payment.create).not.toHaveBeenCalled();
+    });
+  });
+
+  test('a registration from a pass can\'t be edited or take a code', async () => {
+    mockDb.registration.findUnique.mockResolvedValue({ seasonPassPurchaseId: 'pp1' });
+    const res = { status: jest.fn(() => res), json: jest.fn() };
+    const next = jest.fn();
+    pass.notOnSeasonPass({ params: { id: 'r1' } }, res, next);
+    await new Promise(r => setImmediate(r));
+    expect(res.status).toHaveBeenCalledWith(409);
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  test('making, changing and buying passes is blocked in licence read-only mode', () => {
+    expect(isBlocked('POST', '/api/season-passes')).toBe(true);
+    expect(isBlocked('PUT', '/api/season-passes/p1')).toBe(true);
+    expect(isBlocked('POST', '/api/season-passes/p1/buy')).toBe(true);
+    expect(isBlocked('POST', '/api/season-passes/purchases/pp1/checkout')).toBe(true);
+  });
+});
@@ -0,0 +1,135 @@
+const mockDb = {
+  event: { findMany: jest.fn(), updateMany: jest.fn() },
+  seriesFollow: { findMany: jest.fn() },
+};
+jest.mock('../src/config/db', () => mockDb);
+const mockFilter = jest.fn();
+jest.mock('../src/utils/privacy', () => ({
+  filterRecipients: (...a) => mockFilter(...a),
+  bulkEmailFooter: () => ({ html: '<p>unsubscribe</p>', text: '\nunsubscribe', headers: { 'List-Unsubscribe': '<x>' } }),
+}));
+const mockSend = jest.fn();
+jest.mock('../src/utils/email', () => ({
+  sendMail: (...a) => mockSend(...a),
+  emailWrapper: body => `<html>${body}</html>`,
+  ctaButton: (label, url) => `<a href="${url}">${label}</a>`,
+}));
+
+const series = require('../src/utils/series');
+const { isBlocked } = require('../src/hub/readOnly');
+
+describe('event series', () => {
+  test('a new series needs a name; the web address comes from it', () => {
+    expect(() => series.cleanSeriesInput({ name: '  ' })).toThrow('name');
+    expect(series.cleanSeriesInput({ name: "Men's Breakfast", description: ' Monthly ' })).toEqual({ name: "Men's Breakfast", slug: 'men-s-breakfast', description: 'Monthly' });
+    expect(series.cleanSeriesInput({ name: 'Camp', slug: 'Family Camp!' }).slug).toBe('family-camp');
+  });
+
+  test('changing a series only touches what was sent', () => {
+    expect(series.cleanSeriesInput({ description: '' }, { name: 'Camp' })).toEqual({ description: null });
+  });
+
+  test('upcoming soonest first, past latest first', () => {
+    const now = new Date('2026-06-01T00:00:00Z');
+    const ev = (id, start, end) => ({ id, startDate: new Date(start), endDate: new Date(end) });
+    const { upcoming, past } = series.splitEvents([
+      ev('2024', '2024-03-01', '2024-03-04'), ev('2027', '2027-03-01', '2027-03-04'),
+      ev('2025', '2025-03-01', '2025-03-04'), ev('2026', '2026-05-30', '2026-06-02'),
+    ], now);
+    expect(upcoming.map(e => e.id)).toEqual(['2026', '2027']);
+    expect(past.map(e => e.id)).toEqual(['2025', '2024']);
+  });
+
+  test('creating and changing series is blocked in licence read-only mode; following is not', () => {
+    expect(isBlocked('POST', '/api/series')).toBe(true);
+    expect(isBlocked('PUT', '/api/series/abc')).toBe(true);
+    expect(isBlocked('POST', '/api/series/abc/follow')).toBe(false);
+  });
+
+  describe('year-on-year comparison', () => {
+    test('each event against the one before it', () => {
+      const rows = series.withChanges([
+        { registrations: 40, tickets: 50, income: 10000, checkedIn: 45 },
+        { registrations: 50, tickets: 50, income: 9000, checkedIn: 0 },
+        { registrations: 25, tickets: 60, income: 9000, checkedIn: 30 },
+      ]);
+      expect(rows[0].change).toBeNull();
+      expect(rows[1].change).toEqual({ registrations: 25, tickets: 0, income: -10, checkedIn: -100 });
+      // Nothing to compare with after a zero.
+      expect(rows[2].change).toEqual({ registrations: -50, tickets: 20, income: 0, checkedIn: null });
+    });
+
+    test('counts per event, check-ins averaged per session, only events in scope', async () => {
+      const db = {
+        eventSeries: { findUnique: jest.fn().mockResolvedValue({ id: 's1', name: 'Family Camp', slug: 'family-camp' }) },
+        event: {
+          findMany: jest.fn().mockResolvedValue([
+            { id: 'e25', title: 'Camp 2025', startDate: new Date('2025-03-01'), endDate: new Date('2025-03-04'), scheduleType: 'single', isActive: true, campus: null, _count: { sessions: 0 } },
+            { id: 'e26', title: 'Camp 2026', startDate: new Date('2026-03-01'), endDate: new Date('2026-03-04'), scheduleType: 'sessions', isActive: true, campus: null, _count: { sessions: 3 } },
+          ]),
+        },
+        registration: { groupBy: jest.fn().mockResolvedValue([{ eventId: 'e25', _count: { _all: 40 } }, { eventId: 'e26', _count: { _all: 50 } }]) },
+        ticket: { groupBy: jest.fn().mockResolvedValue([{ eventId: 'e25', _sum: { quantity: 50 } }, { eventId: 'e26', _sum: { quantity: 60 } }]) },
+        payment: { groupBy: jest.fn().mockResolvedValue([{ eventId: 'e25', _sum: { amount: 10000 } }, { eventId: 'e26', _sum: { amount: 12000.456 } }]) },
+        ticketUsage: { aggregate: jest.fn(({ where }) => Promise.resolve({ _sum: { quantityRedeemed: where.ticket.eventId === 'e25' ? 45 : 150 } })) },
+      };
+      const scopeWhere = { OR: [{ campusId: { in: ['north'] } }, { campusId: null }] };
+      const out = await series.compareSeries('s1', { scopeWhere }, db);
+      expect(db.event.findMany.mock.calls[0][0].where).toEqual({ AND: [{ seriesId: 's1' }, scopeWhere] });
+      expect(out.events.map(e => [e.title, e.registrations, e.tickets, e.income, e.checkedIn, e.attendanceRate])).toEqual([
+        ['Camp 2025', 40, 50, 10000, 45, 90],
+        ['Camp 2026', 50, 60, 12000.46, 50, 83], // 150 check-ins over 3 sessions
+      ]);
+      expect(out.events[1].change).toEqual({ registrations: 25, tickets: 20, income: 20, checkedIn: 11 });
+    });
+
+    test('an unknown series is a 404', async () => {
+      const db = { eventSeries: { findUnique: jest.fn().mockResolvedValue(null) } };
+      await expect(series.compareSeries('nope', {}, db)).rejects.toMatchObject({ statusCode: 404 });
+    });
+  });
+
+  describe('announcing a new event to followers', () => {
+    const now = new Date('2026-06-01T08:00:00Z');
+    const event = { id: 'e1', title: 'Camp 2027', startDate: new Date('2027-03-01T08:00:00Z'), location: 'The farm', series: { id: 's1', name: 'Family Camp', slug: 'family-camp' } };
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+      mockDb.event.findMany.mockResolvedValue([event]);
+      mockDb.seriesFollow.findMany.mockResolvedValue([
+        { user: { id: 'u1', name: 'Thandi', email: 'thandi@test.local' } },
+        { user: { id: 'u2', name: 'No News', email: 'nonews@test.local' } },
+      ]);
+      // Only Thandi opted in to news.
+      mockFilter.mockImplementation(async list => ({ recipients: list.filter(r => r.userId === 'u1'), skipped: list.length - 1 }));
+      mockSend.mockResolvedValue();
+    });
+
+    test('only public events in a series that have not started and were not announced yet', async () => {
+      mockDb.event.updateMany.mockResolvedValue({ count: 1 });
+      await series.runAnnounceJob(now);
+      const where = mockDb.event.findMany.mock.calls[0][0].where;
+      expect(where).toMatchObject({ isActive: true, isHidden: false, goLiveAt: { lte: now }, seriesId: { not: null }, seriesAnnouncedAt: null, startDate: { gt: now } });
+    });
+
+    test('emails followers who want news, as news', async () => {
+      mockDb.event.updateMany.mockResolvedValue({ count: 1 });
+      const out = await series.runAnnounceJob(now);
+      expect(out).toEqual({ announced: 1, sent: 1, skipped: 1 });
+      expect(mockFilter.mock.calls[0][1]).toEqual({ channel: 'email', kind: 'news' });
+      const mail = mockSend.mock.calls[0][0];
+      expect(mail.to).toBe('thandi@test.local');
+      expect(mail.subject).toBe('New in Family Camp: Camp 2027');
+      expect(mail.html).toContain('/events/e1');
+      expect(mail.html).toContain('unsubscribe');
+      expect(mail.headers['List-Unsubscribe']).toBeTruthy();
+    });
+
+    test('an event another run already claimed is not sent again', async () => {
+      mockDb.event.updateMany.mockResolvedValue({ count: 0 });
+      const out = await series.runAnnounceJob(now);
+      expect(out).toEqual({ announced: 0, sent: 0, skipped: 0 });
+      expect(mockSend).not.toHaveBeenCalled();
+    });
+  });
+});
@@ -0,0 +1,115 @@
+const mockDb = {
+  webhookEndpoint: { findMany: jest.fn(), update: jest.fn().mockResolvedValue({}) },
+  webhookDelivery: { updateMany: jest.fn(), findUnique: jest.fn(), update: jest.fn(), create: jest.fn(), findMany: jest.fn(), deleteMany: jest.fn() },
+  user: { findUnique: jest.fn() },
+  registration: { findUnique: jest.fn() },
+};
+jest.mock('../src/config/db', () => mockDb);
+
+const crypto = require('crypto');
+const webhooks = require('../src/utils/webhooks');
+const { encrypt } = require('../src/utils/encryption');
+
+describe('outbound webhooks', () => {
+  afterEach(() => { delete global.fetch; delete process.env.WEBHOOKS_ALLOW_PRIVATE; jest.clearAllMocks(); });
+
+  describe('where they may go', () => {
+    test('private, loopback and link-local addresses are refused', () => {
+      for (const ip of ['10.1.2.3', '127.0.0.1', '192.168.0.10', '172.16.5.5', '172.31.255.1', '169.254.169.254', '100.64.0.1', '0.0.0.0', '::1', 'fd00::1', 'fe80::1', '::ffff:10.0.0.1']) {
+        expect([ip, webhooks.isPrivateAddress(ip)]).toEqual([ip, true]);
+      }
+      for (const ip of ['8.8.8.8', '172.32.0.1', '93.184.216.34', '2606:4700::1111']) {
+        expect([ip, webhooks.isPrivateAddress(ip)]).toEqual([ip, false]);
+      }
+    });
+
+    test('https only, no passwords in the address, no private hosts', () => {
+      expect(webhooks.cleanUrl(' https://hooks.example.com/x?y=1 ')).toBe('https://hooks.example.com/x?y=1');
+      expect(() => webhooks.cleanUrl('http://hooks.example.com/x')).toThrow('https://');
+      expect(() => webhooks.cleanUrl('https://user:pw@hooks.example.com/')).toThrow('password');
+      expect(() => webhooks.cleanUrl('https://localhost/x')).toThrow('private');
+      expect(() => webhooks.cleanUrl('https://10.0.0.5/x')).toThrow('private');
+      expect(() => webhooks.cleanUrl('not a url')).toThrow('https://');
+    });
+
+    test('local testing can allow http and private addresses', () => {
+      process.env.WEBHOOKS_ALLOW_PRIVATE = 'true';
+      expect(webhooks.cleanUrl('http://localhost:5199/hook')).toBe('http://localhost:5199/hook');
+    });
+  });
+
+  test('the signature can be checked by the receiver', () => {
+    const body = JSON.stringify({ id: 'evt_1', type: 'registration.paid' });
+    const header = webhooks.signatureHeader('whsec_abc', body, 1_800_000_000_000);
+    const [, t, v1] = /^t=(\d+),v1=([0-9a-f]{64})$/.exec(header);
+    expect(t).toBe('1800000000');
+    expect(v1).toBe(crypto.createHmac('sha256', 'whsec_abc').update(`${t}.${body}`).digest('hex'));
+  });
+
+  test('retries after 1 min, 5 min, 30 min, 2 h and 12 h, then gives up', () => {
+    expect([1, 2, 3, 4, 5, 6].map(webhooks.retryDelay)).toEqual([60e3, 300e3, 1800e3, 7200e3, 43200e3, null]);
+  });
+
+  describe('sending', () => {
+    const delivery = (extra = {}) => ({
+      id: 'd1', endpointId: 'ep1', type: 'registration.paid', attempts: 0, payload: { id: 'evt_1', type: 'registration.paid', data: {} },
+      endpoint: { id: 'ep1', url: 'https://93.184.216.34/hook', isActive: true, secret: encrypt('whsec_s') }, ...extra,
+    });
+    beforeEach(() => {
+      mockDb.webhookDelivery.updateMany.mockResolvedValue({ count: 1 });
+      mockDb.webhookDelivery.update.mockImplementation(async ({ data }) => ({ id: 'd1', ...data }));
+    });
+
+    test('a 2xx answer is delivered, signed, without following redirects', async () => {
+      mockDb.webhookDelivery.findUnique.mockResolvedValue(delivery());
+      global.fetch = jest.fn().mockResolvedValue({ status: 204 });
+      const out = await webhooks.send('d1');
+      expect(out.status).toBe('succeeded');
+      const [, init] = global.fetch.mock.calls[0];
+      expect(init.redirect).toBe('manual');
+      expect(init.headers['X-CrossEvents-Event']).toBe('registration.paid');
+      expect(init.headers['X-CrossEvents-Signature']).toMatch(/^t=\d+,v1=[0-9a-f]{64}$/);
+      expect(mockDb.webhookEndpoint.update.mock.calls[0][0].data).toHaveProperty('lastSuccessAt');
+    });
+
+    test('a failure is retried later, and given up after the last try', async () => {
+      mockDb.webhookDelivery.findUnique.mockResolvedValue(delivery());
+      global.fetch = jest.fn().mockResolvedValue({ status: 500 });
+      expect((await webhooks.send('d1'))).toMatchObject({ status: 'retrying', attempts: 1, lastStatusCode: 500, lastError: 'Answered 500' });
+
+      mockDb.webhookDelivery.findUnique.mockResolvedValue(delivery({ attempts: 5 }));
+      global.fetch = jest.fn().mockRejectedValue(new Error('connect ECONNREFUSED'));
+      expect((await webhooks.send('d1'))).toMatchObject({ status: 'failed', attempts: 6, lastError: 'connect ECONNREFUSED' });
+    });
+
+    test('a redirect is not delivered', async () => {
+      mockDb.webhookDelivery.findUnique.mockResolvedValue(delivery());
+      global.fetch = jest.fn().mockResolvedValue({ status: 302 });
+      expect((await webhooks.send('d1')).lastError).toMatch(/redirects are not followed/);
+    });
+
+    test('a delivery someone else is already sending is left alone', async () => {
+      mockDb.webhookDelivery.updateMany.mockResolvedValue({ count: 0 });
+      global.fetch = jest.fn();
+      expect(await webhooks.send('d1')).toBeNull();
+      expect(global.fetch).not.toHaveBeenCalled();
+    });
+  });
+
+  test('what happened is checked again, then one delivery per endpoint that wants it', async () => {
+    webhooks.forgetEndpoints();
+    mockDb.webhookEndpoint.findMany.mockResolvedValue([{ id: 'a', events: ['user.created'] }, { id: 'b', events: ['registration.paid'] }, { id: 'c', events: ['user.created', 'event.published'] }]);
+    mockDb.user.findUnique.mockResolvedValue({ id: 'u1', name: 'Thandi', email: 't@test.local', phoneNumber: null, role: 'user', createdAt: new Date() });
+    // A registration that was paid but changed back before the check: nothing is sent.
+    mockDb.registration.findUnique.mockResolvedValue({ id: 'r1', status: 'pending' });
+    mockDb.webhookDelivery.create.mockImplementation(async ({ data }) => ({ id: `d-${data.endpointId}`, ...data }));
+    mockDb.webhookDelivery.updateMany.mockResolvedValue({ count: 0 });
+    webhooks.notice('user.created', 'u1');
+    webhooks.notice('registration.paid', 'r1');
+    webhooks.notice('not.a.type', 'x');
+    const made = await webhooks.flush();
+    expect(made.map(d => [d.endpointId, d.type, d.userId])).toEqual([['a', 'user.created', 'u1'], ['c', 'user.created', 'u1']]);
+    expect(made[0].eventId).toBe(made[1].eventId);
+    expect(made[0].payload.data.person).toMatchObject({ id: 'u1', email: 't@test.local' });
+  });
+});
@@ -1,6 +1,6 @@
 # Handover — where things stand and how to carry on

-Last updated: 2026-10-28, after **1.47.0** (and Hub 1.4.0). The plan itself is in
+Last updated: 2026-10-28, after **1.49.2** (and Hub 1.5.0). The plan itself is in
 [ROADMAP-v2.md](./ROADMAP-v2.md) (decisions table at the end); the previous round of
 features is in [FEATURES-ROUND-1.md](./FEATURES-ROUND-1.md).

@@ -14,6 +14,16 @@ encrypted settings unreadable or break existing installs.

 | Version | What |
 |---------|------|
+| 1.49.2 | **Saved filters** (§9 part 3) on registrations, users, events and reports (`/api/saved-filters`, `components/shared/SavedFilters.tsx`). Migration `20261028180000_saved_filters` |
+| 1.49.1 | **Bulk actions** on Manage registrations (§9 part 2): message, mark paid, move ticket, allocate, export, cancel (`POST /api/registrations/bulk`, `utils/bulkRegistrations.js`). Migration `20261028170000_registrations_bulk` |
+| 1.49.0 | **Dashboard and command palette** (§9 part 1): Today and Waiting for you on the staff/supervisor/admin dashboards (`GET /api/dashboard/today`), Ctrl+K palette (`GET /api/dashboard/search`, pages in `lib/commandPages.ts`), deep links on events/registrations/users |
+| 1.48.2 | Four demo seeds (`npm run demo:small|events|ministry|multicampus`, `demo:list`); fixes `set-demo`, broken since 1.43.0 by TRUNCATE CASCADE through `User.homeCampusId` |
+| 1.48.1 | Built-in privacy notice updated (rosters, series, season passes, webhooks, acceptance); editor shows built-in changes to sites with their own version; activation asks for agreement; never-accepted users asked once after login |
+| 1.48.0 | **Outbound webhooks** (§8): Site settings → Webhooks, 8 event types, signed deliveries with retries and a delivery log, operator register entry per endpoint. Migration `20261028160000_webhooks` |
+| 1.47.4 | Fix: an update request for a version that has since been overtaken shows as such, with **Ask for … instead** (and the banner again). Hub 1.5.0 moves the open request on (`changed`); with an older Hub `requestUpdate` withdraws and asks again |
+| 1.47.3 | **Season passes** (§6 part 4): passes on the Event series page, buy on the series page (a registration per event, one checkout), price split by normal prices, one Payment per event from the webhook. Migration `20261028150000_season_pass` |
+| 1.47.2 | **Series: year on year** report (§6 part 3): `GET /api/series/:id/compare` (`compareSeries` in `utils/series.js`), report `seriesComparison` in `ReportsV2`, "Compare" on the Event series page |
+| 1.47.1 | **Event series** (§6 part 2): Event series page, Series box on events, public `/series/<slug>`, "Next in this series", follow (News & announcements email from the `series` job when a new event goes live). Migration `20261028140000_event_series` |
 | 1.47.0 | **Copy an event** (§6 part 1): "Copy" opens the event editor filled in from the source (campus, sessions, options, tiers, sections, form, recipients, feedback, certificates); "New start" moves every date; allocation groups and (admins) costs copied by `POST /api/events/:id/copy-from`. No registrations, coupons, attachments, kids check-in or volunteer roles |
 | 1.46.0 | **Volunteer rosters** (§5): serving roles per event or session, anyone signs up (or supervisors assign), day-before reminders, "can't make it" swaps that happen on accept (notify recipients emailed), self check-in with the event's QR code or by staff, kids-room roles count as leaders on duty, free volunteer ticket off by default, roster sheet and hours served. Also fixes the 1.45.0 kids ticket being offered publicly |
 | 1.46.1 | Removed the Gitea CI workflow (no runner): test, lint and deploy by hand |
@@ -48,8 +58,7 @@ encrypted settings unreadable or break existing installs.
 Hub 1.1.0 is deployed with update requests rolled out, and `scripts/install.sh` has been tried on
 a test server (both done 2026-10-28).

-1. **Event series** (§6), one patch per part: **1.47.1 series** (can span campuses), **1.47.2
-   year-on-year reports**, **1.47.3 season pass** — then **1.48.0 — outbound webhooks** (§8).
+1. **1.50.0 — Languages (Afrikaans first)** (§10), then 1.51.0 accessibility (§11).

 ## Working on this repo

@@ -163,7 +172,15 @@ a test server (both done 2026-10-28).
  (renders whatever `/api/privacy/notice` returns), admin `app/dashboard/admin/privacy` +
  `components/admin/privacy/*`, prompt `components/shared/NoticePrompt.tsx` (via
  `PrivacyPrompts.tsx`: notice first, then the news question). **Changing the built-in text
-  changes the live notice only for installs that haven't published a version yet.**
+  changes the live notice only for installs that haven't published a version yet** — so every
+  change to `DEFAULT_SECTIONS` must also add an entry to `BUILT_IN_UPDATES` (the release, a summary,
+  the section ids changed). Sites with their own version then see it in the editor until they press
+  "Done — hide this" (AppSetting `privacy_notice_builtin_reviewed`). A test checks the ids exist.
+- Accepting the notice: sign-up (`source: 'signup'`), account activation (`'activation'`, the form's
+  terms box) and the after-login prompt (`'prompt'`). `noticePromptPending` is `'first'` for anyone
+  who never accepted (`noticeVersionAccepted` null) and `'updated'` when a significant version came
+  out later. The e2e seed sets `noticeVersionAccepted: 0` so the prompt doesn't cover every test.
+- The cookie button on the privacy page shows above any section whose id contains "cookie".
 - Access log: `utils/accessLog.js` (`logDataAccess(req, { action, what, eventId, records })`).
  **Any new bulk export or list of personal data should call it** and get a label in
  `ACCESS_ACTIONS`. Operators: `Operator` table, seeded in the 1.39.0 migration.
@@ -297,6 +314,107 @@ a test server (both done 2026-10-28).
  costs are admin-only) via `POST /api/events/:id/copy-from`. Tests: `tests/eventClone.test.js`,
  e2e "copy an event" in `supervisor.spec.ts`.

+## Where event series live (1.47.1)
+
+- `backend/src/utils/series.js` — input cleaning, `seriesForEvent`, `nextInSeries` (next public event
+  starting later), `splitEvents`, follow/unfollow, the `series` job (`runAnnounceJob`: public, not
+  started, `seriesAnnouncedAt` null → claimed, then followers filtered with `filterRecipients` as
+  news), `exportFollows`. Tests: `tests/series.test.js`; e2e `series.spec.ts`.
+- `controllers/seriesController.js` + `routes/seriesRoutes.js` (`/api/series`, campus-independent:
+  the list filters each series' events by scope). Event create/update take `seriesId`; changing it
+  clears `seriesAnnouncedAt` so the new series' followers hear.
+- `SeriesFollow` is personal data: in `anonymiseUser` and `exportUserData`. No retention rule of its
+  own — follows go when the account is anonymised.
+- Frontend: `app/dashboard/supervisor/series`, `app/series/[slug]`, `components/events/SeriesLinks.tsx`,
+  `FollowSeriesButton.tsx` (asks the API itself: the page is cached for everyone), the Series box in
+  the event editor. Series pages aren't in the sitemap yet (no public list endpoint).
+
+## Where season passes live (1.47.3)
+
+- `backend/src/utils/seasonPass.js` — `splitCents` / `itemShares` (the price over the events by
+  normal price, whole cents), `notOnSale`, `passView`, `cleanPassInput`, `buyPass` (advisory lock per
+  pass, stock checked per item, a registration per event with a tranche at the share),
+  `startPassCheckout` (checkout metadata `{ type: 'season_pass', purchaseId }`), `recordPassPayment`
+  (called from `payments/webhook.js` `recordSucceededPayment`; `allocate` pays each registration what
+  it owes; first Payment carries `externalId`), `notOnSeasonPass` (route guard on options edit and
+  coupons), `exportPurchases`. Tests: `tests/seasonPass.test.js`; e2e in `series.spec.ts`.
+- `refreshPricingForRegistration` skips pass registrations; `payments/status.js` treats a pass
+  checkout as paid once its purchase is.
+- Frontend: `components/series/SeasonPassesPanel.tsx` (Event series page),
+  `components/series/SeasonPassOffers.tsx` (series page: buy, "Your passes", Pay now).
+- Not built yet: buying a pass at the door or by staff, cancelling a whole purchase in one go
+  (staff cancel and refund each event's registration), one combined payment email (each event's
+  payment sends its own).
+
+## Where outbound webhooks live (1.48.0)
+
+- **Noticing:** `backend/src/config/db.js` wraps the Prisma client with `$extends` query hooks
+  (registration create/update to paid or cancelled, payment create, ticketUsage create, user create,
+  event create/update to public). **New code gets webhooks for free** as long as it writes through
+  `prisma` (`updateMany` isn't hooked). Hooks only call `notice`; never put slow work there.
+- `backend/src/utils/webhooks.js` — event types, the in-memory queue (`notice` → `flush` after 1.5 s,
+  which re-reads the record and skips it if it changed back), payload builders (kids/volunteer tickets
+  left out), `send` (claim, SSRF check, sign, 10 s timeout, retry schedule), `runJob` (`webhooks` job:
+  due retries, stuck sends, 30-day prune), `resend`, `sendTest`. Queued events are lost if the
+  process stops in that 1.5 s (no outbox table yet).
+- `controllers/outboundWebhookController.js` + `routes/outboundWebhookRoutes.js`
+  (`/api/outbound-webhooks`, admin). Operator register entry per endpoint (`operatorId`).
+- **Adding an event type:** add it to `EVENT_TYPES`, a case in `buildPayload`, a hook in `db.js` if
+  needed, and a line in `dataShared` (operator register text).
+- Frontend: `components/admin/WebhooksTab.tsx`. Tests: `tests/webhooks.test.js`, e2e
+  `webhooks.spec.ts` (runs a receiver on localhost:5199; e2e backend has `WEBHOOKS_ALLOW_PRIVATE`).
+
+## Demo data (1.48.2)
+
+- `backend/scripts/set-demo.js` builds everything in memory and writes it with `createMany` in one
+  transaction (so no webhooks fire). `PROFILES` says which of the six upcoming events, which past
+  events (by title) and which extras (`series`, `courses`, `conference`, `kids`, `volunteers`) each
+  profile gets, and whether campuses are on. **A new feature that's worth demoing** gets a builder
+  and an extra; add its tables to `INSERT_ORDER` (parents first).
+- Keep jobs quiet: set anything a job would act on as already done (`seriesAnnouncedAt`,
+  `remindedAt`, certificates issued). Demo people use @example.com and no phone numbers.
+- `clearData` truncates every table except settings and users, but deletes (not truncates) tables
+  that `User` points at — TRUNCATE CASCADE would empty `User` with them.
+- Tried by seeding all four into a throwaway database and calling the API (events, series page and
+  report, season pass, kids board, roster, attendance registers, certificate check, cashups, campus
+  scoping).
+
+## Where the dashboard and palette live (1.49.0)
+
+- `backend/src/utils/dashboard.js` — `todaysEvents`, `moneyIn`, `pendingItems` (each item counted
+  separately, failures logged and skipped; role-only items for admins), `search` (+ `amountOf`).
+  Everything goes through `eventWhere(scopeFor(req))`. Routes: `routes/dashboardRoutes.js`.
+  **A new "something needs doing" count** goes in `pendingItems` (with its link and the `order`).
+- Frontend: `components/dashboard/TodayPanel.tsx`, `components/shared/CommandPalette.tsx` (mounted in
+  `app/dashboard/layout.tsx`; `CommandPaletteButton` on the dashboards), `lib/commandPages.ts` —
+  **a new page or setting tab should be added there** with its roles.
+- Deep links read `window.location.search` once on load (no Suspense needed).
+- Tests: `tests/dashboard.test.js`, e2e `dashboard.spec.ts`.
+
+## Where bulk actions live (1.49.1)
+
+- `backend/src/utils/bulkRegistrations.js` — `runBulk` checks the input (≤ 500, licence read-only for
+  payments and moves) and runs one action per registration, collecting a result for each. Most
+  actions **call the existing Express handlers in-process** (`call(handler, req)`, with the original
+  request's user, headers and socket so audits keep the IP): `createPayment`, `cancelRegistration`,
+  `allocationController.assign`, `emailEventAttendees` / `whatsappEventAttendees` (new
+  `filter.registrationIds`). **Change a rule in those handlers and bulk follows.**
+- Moving tickets is its own code (`moveOption`): the edit handler refuses to remove issued tickets,
+  so the lines are re-pointed in place (tickets and QR codes kept), repriced with `resolveOptionPrice`,
+  attendees moved, then `updateRegistrationStatus`.
+- Frontend: `components/admin/RegistrationBulkBar.tsx` on `app/dashboard/admin/registrations`. Export
+  goes through `/api/reports/excel` (access-logged). Tests: `tests/bulkRegistrations.test.js`, e2e
+  `bulk.spec.ts`.
+
+## Saved filters (1.49.2)
+
+- `backend/src/utils/savedFilters.js` (`PAGES` is the list of pages with saved filters; values are
+  cleaned to simple types) + `routes/savedFilterRoutes.js`. Removed in `anonymiseUser`.
+- `components/shared/SavedFilters.tsx` takes the page's current filter values and an `onApply`;
+  `skipDefault` when the URL already says what to show. **Adding it to another list page:** add the
+  page to `PAGES` (and the component's `page` type), then pass the values in and apply them out.
+- e2e `saved-filters.spec.ts` (deletes what it saves).
+
 ## Known gaps / follow-ups

 - WhatsApp STOP only works once someone pastes the webhook URL from Site settings → WhatsApp
@@ -34,8 +34,10 @@ Wallet passes are removed from scope (2026-10-28), so everything after volunteer
 up by one. 1.45.0 **kids check-in** shipped (fully digital: pickup codes, sticker panel, rooms with
 ratios, offline desk). 1.46.0 **volunteer rosters** shipped (roles per event or session, sign-ups and
 assigning, swaps on accept, QR self check-in, kids-room roles on duty, optional volunteer ticket).
-Event series and cloning ships as 1.47.0–1.47.3 (2026-10-28); 1.47.0 **copy an event** shipped.
-**Next: 1.47.1 Event series.**
+Event series and cloning ships as 1.47.0–1.47.3 (2026-10-28); 1.47.0 **copy an event** and 1.47.1 **event series** (series page, Next in this series, follow) 1.47.2 **year-on-year
+report** and 1.47.3 **season passes** shipped — §6 is done. 1.48.0 **outbound webhooks** shipped. 1.49.0 **dashboard (Today, Waiting for you) and Ctrl+K palette**
+shipped; 1.49.1 **bulk actions** and 1.49.2 **saved filters** shipped — §9 is done. **Next: 1.50.0
+Languages (Afrikaans first).**

 **Repositories:**

@@ -470,12 +472,16 @@ year-on-year reports, **1.47.3** season pass.
  groups, cost template (admins) and sessions. A "New start" moves every date with it. Of the
  newer features only the **campus** is copied — not kids check-in or volunteer roles. No
  registrations, **no coupons**.
- **Series (1.47.1):** group separate events (Camp 2025, Camp 2026; monthly Men's
+- **Series (1.47.1 ✅):** group separate events (Camp 2025, Camp 2026; monthly Men's
  Breakfast) on one series page, with "Next in this series" and a series
-  follow/notify option. **A series can span several campuses.**
- **Year-on-year reports (1.47.2):** registrations, income and attendance compared
+  follow/notify option. **A series can span several campuses.** Following is **News &
+  announcements** (opted-in only, unsubscribe link); followers get one email when a new event in the
+  series goes live.
+- **Year-on-year reports (1.47.2 ✅):** registrations, income and attendance compared
  across events in a series.
- **Season pass (1.47.3):** a bundle across events in a series (extends event bundles).
+- **Season pass (1.47.3 ✅):** a bundle across events in a series. One checkout registers the buyer at
+  every event on the pass; the supervisor picks the events (and ticket at each); the price is split
+  in proportion to the events' normal prices for each event's cashup (2026-10-28).

 ---

@@ -496,7 +502,9 @@ year-on-year reports, **1.47.3** season pass.

 ## 8. Outbound webhooks

-Let other systems react to what happens in Cross Events.
+Let other systems react to what happens in Cross Events. (Shipped in 1.48.0: Site settings →
+Webhooks; events noticed through a Prisma client extension; each endpoint added to the operator
+register; deliveries kept 30 days.)

 - Admin adds endpoints and picks events: `registration.created`,
  `registration.paid`, `registration.cancelled`, `payment.refunded`,
@@ -510,6 +518,9 @@ Let other systems react to what happens in Cross Events.

 ## 9. Admin dashboard, command palette, bulk actions

+Three releases (2026-10-28): **1.49.0** dashboard (Today, Waiting for you) and the Ctrl+K command
+palette ✅; **1.49.1** bulk actions ✅; **1.49.2** saved filters ✅.
+
 - **Dashboard** as supervisors' home: today's events/sessions, check-ins so
  far, money in (today/week), pending items (unreconciled payments, consent
  outstanding, waitlist offers, data requests), alerts.
@@ -960,8 +971,8 @@ income justify the hardware:
 | 6 | 1.41.0 ✅ – 1.42.0 ✅ + Hub 1.0 ✅ – 1.1 ✅ | Install/update scripts, `/health`, licence step in `/setup`, "Connect to Hub", heartbeat, licence states — plus the **Hub** app (separate repo); rename to Cross Events (1.41.3); Request update (1.42.0 / Hub 1.1.0) | Must exist before the first church is sold; Hope Family Church registers as install #1 |
 | 7 | 1.43.0 ✅ – 1.44.0 ✅ | **Multi-campus**: 1.43.0 campuses (settings, events, public filter and landing pages, home campus, filters, messages, summaries); 1.44.0 campus-scoped staff | Kids rooms and volunteer roles are per campus, so campuses come first; scoping is split out because it's security-heavy |
 | 8 | 1.45.0 ✅ – 1.46.0 ✅ | Kids check-in, Volunteer rosters | Depend on sessions and campuses |
-| 9 | 1.47.0 ✅ – 1.47.3, 1.48.0 | Event series & cloning (1.47.0 clone, 1.47.1 series, 1.47.2 year-on-year reports, 1.47.3 season pass), Outbound webhooks (Wallet passes removed from scope) | Smaller, independent wins |
-| 10 | 1.49.0 – 1.51.0 | Admin dashboard/Ctrl+K/bulk actions, Afrikaans, Accessibility pass | Polish before the big release |
+| 9 | 1.47.0 ✅ – 1.47.3 ✅, 1.48.0 ✅ | Event series & cloning (1.47.0 clone, 1.47.1 series, 1.47.2 year-on-year reports, 1.47.3 season pass), Outbound webhooks (Wallet passes removed from scope) | Smaller, independent wins |
+| 10 | 1.49.0 ✅ – 1.49.2 ✅, 1.50.0 – 1.51.0 | Admin dashboard/Ctrl+K/bulk actions, Afrikaans, Accessibility pass | Polish before the big release |
 | 11 | 1.52.0 | TypeScript backend + OpenAPI + `/api/v2` alongside v1 | The breaking-change groundwork |
 | 12 | **2.0.0** | **AI helpers** (§15 — headline feature: draft an event, summarise reports and feedback, draft messages, improve text; through the Hub with a rand cap per licence), v1 API removed, migration guide, marketing site/docs for selling | The release. AI needs the Hub (phase 6) for the key, metering and caps |

@@ -1015,7 +1026,7 @@ feature.
 | — | Wallet passes | **Removed from scope** (2026-10-28); everything after volunteer rosters moves up by one |
 | — | Kids check-in (1.45.0) | One release. **Fully digital** — no label printers: pickup code on the parent's phone, a "write on the sticker" panel for blank stickers. Staff desk only (no kiosk). Anyone with the pickup code can collect; families list authorised adults without accounts. Child profiles deleted after 6 months without a check-in (2026-10-28) |
 | — | Volunteer rosters (1.46.0) | Anyone with an account can volunteer. Roles are per event (or per session) — rosters cover one event/session and never repeat. A swap needs no approval: it happens once someone accepts, and the event's notify recipients are emailed. Volunteers check in by scanning a QR code or are checked in by staff. The free volunteer ticket is off by default and chosen per event. A role linked to a kids room counts its checked-in volunteers as leaders on duty for the room's ratio (2026-10-28) |
-| — | Event series and cloning (1.47.x) | One release per part: 1.47.0 clone, 1.47.1 series, 1.47.2 year-on-year reports, 1.47.3 season pass. A clone opens the New event popup filled in from the source, so everything is set there before saving. Of the newer features a clone copies only the campus (not kids check-in or volunteer roles); coupons are never copied. A series can span several campuses (2026-10-28) |
+| — | Event series and cloning (1.47.x) | One release per part: 1.47.0 clone, 1.47.1 series, 1.47.2 year-on-year reports, 1.47.3 season pass. A clone opens the New event popup filled in from the source, so everything is set there before saving. Of the newer features a clone copies only the campus (not kids check-in or volunteer roles); coupons are never copied. A series can span several campuses. Following a series is **News & announcements**; copies keep the source's certificate and reminder settings. Season pass: one checkout registers for every event on it, the supervisor picks the events, the price is split in proportion to normal prices (2026-10-28) |
 | — | POPIA: WhatsApp STOP | In 1.38.0, via WAWP's incoming `message` webhook with a secret in the URL (WAWP doesn't sign webhooks) (2026-10-23) |

 ## Still open
@@ -144,12 +144,19 @@ Signed exactly like the heartbeat.
 POST /api/installs/update-request
 X-Hub-Install / X-Hub-Timestamp / X-Hub-Signature   (as in §3)
 { "protocolVersion": 1, "version": "1.41.2" }
-→ 201 { "requestedAt": "2026-10-27T09:00:00.000Z", "version": "1.42.0", "alreadyRequested": false }
-→ 200 { …, "alreadyRequested": true }    // a request is already open: not emailed again
+→ 201 { "requestedAt": "2026-10-27T09:00:00.000Z", "version": "1.42.0", "alreadyRequested": false, "changed": false }
+→ 200 { …, "alreadyRequested": true, "changed": false }    // a request for the latest is already open: not emailed again
+→ 200 { …, "alreadyRequested": true, "changed": true, "previousVersion": "1.42.0" }
+                                         // the open request was for an older version: it now asks for the latest
 ```

 - The Hub opens an `update_requested` alert on the install (shown under Alerts) and emails the
  alert address once. It is resolved when a heartbeat reports a newer version than before.
+- **Changing a request (Hub 1.5.0):** when a request is open for a version that has since been
+  overtaken, asking again moves it on to the latest version — the alert says "latest is 1.47.3
+  (changed from 1.47.0)" and the alert address is emailed once about the change. `version` is
+  always the version now asked for. A Hub before 1.5.0 doesn't send `changed`; installs then
+  withdraw the request and ask again (two emails, same result).
 - `409 UP_TO_DATE` — the install already runs the Hub's latest version (or none is set).
 - Errors as in §3 (`INSTALL_NOT_FOUND`, `STALE_REQUEST`, `BAD_SIGNATURE`). Rate-limited (10 an
  hour per IP). A Hub older than this section answers `404 NOT_FOUND`.
@@ -0,0 +1,86 @@
+import { test, expect, loginAs, api } from "./fixtures";
+
+// Bulk actions on the registrations list (1.49.1): tick several, mark them paid, move them to
+// another ticket, cancel — each through the same rules as one at a time.
+type Ev = { id: string; eventOptions?: { id: string; name: string; isMainTicket?: boolean }[] };
+type Reg = { id: string; status: string; registrationOptions?: { eventOptionId: string; quantity: number }[]; payments?: { amount: number; method: string }[] };
+
+test.describe.serial("bulk actions on registrations", () => {
+  let event: Ev;
+  let main: string;
+  let vip: string;
+  const regs: string[] = [];
+
+  test.beforeAll(async ({ browser }) => {
+    const page = await browser.newPage();
+    const start = new Date(Date.now() + 20 * 864e5);
+    event = await api<Ev>(page, "admin", "POST", "/api/events", {
+      title: "E2E Bulk Night", startDate: start.toISOString(), endDate: new Date(start.getTime() + 3 * 3600e3).toISOString(),
+      price: 100, location: "Church hall",
+    });
+    const full = await api<Ev>(page, "admin", "GET", `/api/events/${event.id}`);
+    main = full.eventOptions!.find(o => o.isMainTicket)!.id;
+    vip = (await api<{ id: string }>(page, "admin", "POST", `/api/events/${event.id}/options`, { name: "VIP", price: 150, isMainTicket: true })).id;
+    for (const role of ["staff", "supervisor", "user"] as const) {
+      regs.push((await api<{ id: string }>(page, role, "POST", "/api/registrations", { eventId: event.id, options: [{ eventOptionId: main, quantity: 1 }] })).id);
+    }
+    await page.close();
+  });
+
+  const openList = async (page: import("@playwright/test").Page) => {
+    await loginAs(page, "admin");
+    await page.goto(`/dashboard/admin/registrations?event=${event.id}`);
+    await expect(page.getByText("3 of", { exact: false })).toBeVisible();
+  };
+
+  test("tick all and mark them paid in cash", async ({ page }) => {
+    await openList(page);
+    await page.getByLabel("Select all shown").check();
+    const bar = page.getByTestId("bulk-bar");
+    await expect(bar).toContainText("3 selected");
+    await bar.getByLabel("Bulk action").selectOption("markPaid");
+    await bar.getByLabel("Paid by").selectOption("cash");
+    page.once("dialog", d => d.accept());
+    await bar.getByRole("button", { name: /Mark paid/ }).click();
+    await expect(page.getByTestId("bulk-result")).toContainText("3 done");
+
+    for (const id of regs) {
+      const r = await api<Reg>(page, "admin", "GET", `/api/registrations/${id}`);
+      expect(r.status).toBe("paid");
+      expect(r.payments?.map(p => [p.amount, p.method])).toEqual([[100, "cash"]]);
+    }
+  });
+
+  test("move two to the VIP ticket; cancel the third", async ({ page }) => {
+    await openList(page);
+    const rows = page.locator("li").filter({ has: page.getByRole("checkbox", { name: /^Select / }) });
+    await rows.nth(0).getByRole("checkbox").check();
+    await rows.nth(1).getByRole("checkbox").check();
+    const bar = page.getByTestId("bulk-bar");
+    await bar.getByLabel("Bulk action").selectOption("moveOption");
+    await bar.getByLabel("Move from").selectOption(main);
+    await bar.getByLabel("Move to").selectOption(vip);
+    page.once("dialog", d => d.accept());
+    await bar.getByRole("button", { name: /Move to another ticket/ }).click();
+    await expect(page.getByTestId("bulk-result")).toContainText("2 done");
+
+    const moved = await Promise.all(regs.map(id => api<Reg>(page, "admin", "GET", `/api/registrations/${id}`)));
+    const onVip = moved.filter(r => r.registrationOptions?.some(o => o.eventOptionId === vip));
+    expect(onVip).toHaveLength(2);
+    // R150 now, R100 paid: they owe the difference.
+    expect(onVip.every(r => r.status === "partial_paid")).toBe(true);
+
+    await bar.getByRole("button", { name: "Clear selection" }).click();
+    const left = moved.find(r => !r.registrationOptions?.some(o => o.eventOptionId === vip))!;
+    await page.getByRole("checkbox", { name: /^Select / }).nth(2).check();
+    const selectedId = (await api<Reg>(page, "admin", "GET", `/api/registrations/${left.id}`)).id;
+    expect(selectedId).toBe(left.id);
+    const bar2 = page.getByTestId("bulk-bar");
+    await bar2.getByLabel("Bulk action").selectOption("cancel");
+    page.once("dialog", d => d.accept());
+    await bar2.getByRole("button", { name: /Cancel — 1/ }).click();
+    await expect(page.getByTestId("bulk-result")).toContainText("1 done");
+    const cancelled = (await Promise.all(regs.map(id => api<Reg>(page, "admin", "GET", `/api/registrations/${id}`)))).filter(r => r.status === "cancelled");
+    expect(cancelled).toHaveLength(1);
+  });
+});
@@ -0,0 +1,49 @@
+import { test, expect, loginAs } from "./fixtures";
+
+// Dashboard "Today" and "Waiting for you", and the Ctrl+K command palette (1.49.0).
+test.describe("dashboard and command palette", () => {
+  test("the admin dashboard shows what's on today and what's waiting", async ({ page }) => {
+    await loginAs(page, "admin");
+    await page.goto("/dashboard/admin");
+    const today = page.getByTestId("today-panel");
+    await expect(today).toBeVisible();
+    // Seeded on today: the hidden kids church and serving Sunday.
+    await expect(today.getByTestId("today-events")).toContainText("E2E Serving Sunday");
+    await expect(today.getByText("Waiting for you")).toBeVisible();
+  });
+
+  test("Ctrl+K finds an event and opens it", async ({ page }) => {
+    await loginAs(page, "supervisor");
+    await page.goto("/dashboard/supervisor");
+    await expect(page.getByTestId("today-panel")).toBeVisible();
+    await page.keyboard.press("Control+k");
+    const dialog = page.getByRole("dialog", { name: "Go to or search" });
+    await expect(dialog).toBeVisible();
+    await dialog.getByRole("combobox", { name: "Search" }).fill("Paid Conference");
+    await expect(dialog.getByRole("option", { name: /E2E Paid Conference/ })).toBeVisible();
+    await page.keyboard.press("Enter");
+    await expect(page).toHaveURL(/\/dashboard\/supervisor\/events/);
+    await expect(page.getByRole("heading", { name: "Edit Event" })).toBeVisible();
+    await expect(page.getByPlaceholder("Event title")).toHaveValue("E2E Paid Conference");
+  });
+
+  test("the palette's actions and pages follow the role", async ({ page }) => {
+    await loginAs(page, "supervisor");
+    await page.goto("/dashboard/supervisor");
+    await page.getByRole("button", { name: /Search or jump to/ }).click();
+    const dialog = page.getByRole("dialog", { name: "Go to or search" });
+    await dialog.getByRole("combobox", { name: "Search" }).fill("new event");
+    await dialog.getByRole("option", { name: "New event" }).click();
+    await expect(page.getByRole("heading", { name: "New Event" })).toBeVisible();
+
+    // Staff don't get admin pages.
+    await loginAs(page, "staff");
+    await page.goto("/dashboard/staff");
+    await page.keyboard.press("Control+k");
+    const staffDialog = page.getByRole("dialog", { name: "Go to or search" });
+    await staffDialog.getByRole("combobox", { name: "Search" }).fill("users");
+    await expect(staffDialog.getByRole("option", { name: "Users" })).toHaveCount(0);
+    await staffDialog.getByRole("combobox", { name: "Search" }).fill("scan");
+    await expect(staffDialog.getByRole("option", { name: "Scan tickets" })).toBeVisible();
+  });
+});
@@ -11,6 +11,7 @@ export type Seed = {
  course: { sessions: { id: string; label: string }[]; ticketId: string; qrCode: string };
  unsubscribeToken: string;
  newsPromptUser: { id: string; token: string };
+  noticeFirstUser: { id: string; token: string };
  retention: { toWarn: string; toAnonymise: string };
 };

@@ -11,7 +11,7 @@ test.describe("privacy notice, operators and access log (POPIA)", () => {
  // A version that needs accepting is published below; accept it for every seeded account
  // afterwards so later test files don't meet the prompt.
  test.afterAll(async ({ request }) => {
-    const tokens = [...(["admin", "supervisor", "staff", "user"] as Role[]).map(r => seed().users[r].token), seed().newsPromptUser.token];
+    const tokens = [...(["admin", "supervisor", "staff", "user"] as Role[]).map(r => seed().users[r].token), seed().newsPromptUser.token, seed().noticeFirstUser.token];
    for (const token of tokens) {
      await request.post(`${API}/api/privacy/me/notice/accept`, { headers: { Authorization: `Bearer ${token}` } });
    }
@@ -55,6 +55,52 @@ test.describe("privacy notice, operators and access log (POPIA)", () => {
    await api(page, "admin", "DELETE", `/api/privacy/operators/${op.id}`);
  });

+  test("after publishing its own version, the editor points out new built-in text", async ({ page }) => {
+    // The published version came from the built-in text; put an older wording back in one changed
+    // section so it shows as having new text.
+    const draft = await api<Draft>(page, "admin", "GET", "/api/privacy/notice/draft");
+    const sections = draft.sections.map(s => (s.id === "changes" ? { ...s, body: "We may update this notice from time to time." } : s));
+    await api(page, "admin", "PUT", "/api/privacy/notice/draft", { sections });
+
+    await loginAs(page, "admin");
+    await page.goto("/dashboard/admin/privacy?tab=notice");
+    const banner = page.getByTestId("builtin-updates");
+    await expect(banner).toContainText("The built-in privacy notice has been updated");
+    await expect(banner).toContainText("How people agree to the notice");
+    const marked = page.getByTestId("section-has-new-text");
+    await expect(marked).toHaveCount(1);
+    await marked.getByText("New built-in text for this section — show it").click();
+    await marked.getByRole("button", { name: "Use the new text" }).click();
+    await expect(page.getByTestId("section-has-new-text")).toHaveCount(0);
+    await page.getByRole("button", { name: "Save draft" }).click();
+    await expect(page.getByText("Draft saved.")).toBeVisible();
+
+    await banner.getByRole("button", { name: "Done — hide this" }).click();
+    await expect(page.getByTestId("builtin-updates")).toHaveCount(0);
+    await page.reload();
+    await expect(page.getByLabel("1. Introduction text")).toBeVisible();
+    await expect(page.getByTestId("builtin-updates")).toHaveCount(0);
+    await api(page, "admin", "DELETE", "/api/privacy/notice/draft");
+  });
+
+  test("someone who never accepted the notice is asked once, after login", async ({ page }) => {
+    await page.addInitScript(token => localStorage.setItem("hope_events_token", token), seed().noticeFirstUser.token);
+    await page.goto("/dashboard/user");
+    const dialog = page.getByRole("dialog", { name: "Our privacy notice" });
+    await expect(dialog).toBeVisible();
+    await expect(dialog).toContainText("It explains what we keep about you");
+    await dialog.getByRole("button", { name: "I accept" }).click();
+    await expect(dialog).toBeHidden();
+    await page.reload();
+    await expect(page.getByText("My Events").first()).toBeVisible();
+    await expect(page.getByRole("dialog", { name: "Our privacy notice" })).toHaveCount(0);
+  });
+
+  test("the cookie button stays on a published notice", async ({ page }) => {
+    await page.goto("/legal/privacy");
+    await expect(page.getByRole("button", { name: "Change my cookie choice" })).toBeVisible();
+  });
+
  test("a significant change is accepted once, after login", async ({ page }) => {
    const draft = await api<Draft>(page, "admin", "GET", "/api/privacy/notice/draft");
    // Re-acceptance needs a summary of what changed.
@@ -0,0 +1,33 @@
+import { test, expect, loginAs } from "./fixtures";
+
+// Saved filters on list pages (1.49.2): save the current filters, make them the default (applied
+// when the page opens), and delete them again.
+test("an admin saves a registrations filter as the default, and deletes it", async ({ page }) => {
+  await loginAs(page, "admin");
+  await page.goto("/dashboard/admin/registrations");
+  const status = page.locator("select").filter({ has: page.locator("option", { hasText: "All statuses" }) });
+  await status.selectOption("cancelled");
+
+  const saved = page.getByTestId("saved-filters");
+  await saved.getByRole("button", { name: /Saved filters/ }).click();
+  await saved.getByLabel("Save the current filters as").fill("Cancelled ones");
+  await saved.getByLabel("Use when this page opens").check();
+  await saved.getByRole("button", { name: "Save", exact: true }).click();
+  await expect(saved.getByRole("button", { name: "Cancelled ones" }).first()).toBeVisible();
+
+  // The default is applied when the page opens…
+  await page.reload();
+  await expect(status).toHaveValue("cancelled");
+  await expect(saved.getByRole("button", { name: /Cancelled ones/ }).first()).toBeVisible();
+
+  // …but not over a link that says what to show.
+  await page.goto("/dashboard/admin/registrations?status=paid");
+  await expect(status).toHaveValue("paid");
+
+  await saved.getByRole("button", { name: /Saved filters/ }).click();
+  page.once("dialog", d => d.accept());
+  await saved.getByRole("button", { name: "Delete Cancelled ones" }).click();
+  await expect(saved.getByText("No saved filters yet")).toBeVisible();
+  await page.goto("/dashboard/admin/registrations");
+  await expect(status).toHaveValue("");
+});
@@ -0,0 +1,114 @@
+import { test, expect, loginAs, api, seed, API } from "./fixtures";
+
+// Event series (1.47.1): a supervisor makes a series, events join it, the public series page
+// lists them, an event page links to the next one, a user follows it, and the series job tells
+// followers once when a new event goes live.
+type Created = { id: string; title: string };
+type Series = { id: string; slug: string; name: string };
+type JobRun = { queued: boolean; output: { announced: number; sent: number; skipped: number } };
+
+const day = 24 * 60 * 60 * 1000;
+const event = (title: string, startsInDays: number, seriesId: string) => {
+  const start = new Date(Date.now() + startsInDays * day);
+  return { title, description: "A breakfast for the tests.", startDate: start.toISOString(), endDate: new Date(start.getTime() + 2 * 60 * 60 * 1000).toISOString(), price: 0, location: "1 Test Street, Pretoria", seriesId };
+};
+
+test.describe.serial("event series", () => {
+  let series: Series;
+  let past: Created;
+  let next: Created;
+
+  test("a supervisor makes a series", async ({ page }) => {
+    await loginAs(page, "supervisor");
+    await page.goto("/dashboard/supervisor/series");
+    await page.getByRole("button", { name: "+ New series" }).click();
+    await page.getByLabel("Name").fill("E2E Breakfast");
+    await page.getByLabel("Description").fill("Men's breakfast, once a month.");
+    await page.getByRole("button", { name: "Create series" }).click();
+    await expect(page.getByRole("status")).toContainText("E2E Breakfast");
+    await expect(page.getByTestId("series-row").filter({ hasText: "E2E Breakfast" })).toContainText("/series/e2e-breakfast");
+
+    const all = await api<Series[]>(page, "supervisor", "GET", "/api/series");
+    series = all.find((s) => s.name === "E2E Breakfast")!;
+    past = await api<Created>(page, "supervisor", "POST", "/api/events", event("E2E Breakfast (last month)", -30, series.id));
+    next = await api<Created>(page, "supervisor", "POST", "/api/events", event("E2E Breakfast (next month)", 30, series.id));
+    // Both are live already; announce them now so only the event made after following counts below.
+    await api<JobRun>(page, "admin", "POST", "/api/admin/jobs/series/run");
+  });
+
+  test("the series page lists what's coming up and what's past", async ({ page }) => {
+    await page.goto(`/series/${series.slug}`);
+    await expect(page.getByRole("heading", { name: "E2E Breakfast", exact: true })).toBeVisible();
+    await expect(page.getByText("E2E Breakfast (next month)")).toBeVisible();
+    await expect(page.getByTestId("series-past")).toContainText("E2E Breakfast (last month)");
+  });
+
+  test("an event page links to its series and the next event in it", async ({ page }) => {
+    await page.goto(`/events/${past.id}`);
+    await expect(page.getByTestId("event-series")).toContainText("Part of E2E Breakfast");
+    await page.getByTestId("next-in-series").click();
+    await expect(page).toHaveURL(new RegExp(`/events/${next.id}`));
+  });
+
+  test("a user follows the series and hears once about a new event", async ({ page }) => {
+    await loginAs(page, "user");
+    await page.goto(`/series/${series.slug}`);
+    await page.getByRole("button", { name: "Follow this series" }).click();
+    await expect(page.getByRole("button", { name: "Unfollow" })).toBeVisible();
+
+    await api<Created>(page, "supervisor", "POST", "/api/events", event("E2E Breakfast (in two months)", 60, series.id));
+    const first = await api<JobRun>(page, "admin", "POST", "/api/admin/jobs/series/run");
+    expect(first.output.announced).toBe(1);
+    const again = await api<JobRun>(page, "admin", "POST", "/api/admin/jobs/series/run");
+    expect(again.output.announced).toBe(0);
+  });
+
+  test("season pass: a supervisor sets one up, a user buys two, each event gets its share", async ({ page }) => {
+    await loginAs(page, "supervisor");
+    await page.goto("/dashboard/supervisor/series");
+    const row = page.getByTestId("series-row").filter({ hasText: "E2E Breakfast" });
+    await row.getByRole("button", { name: "+ New pass" }).click();
+    await row.getByLabel("Pass name").fill("E2E Breakfast pass");
+    await row.getByLabel("Price (R)").fill("30");
+    // The two upcoming breakfasts are ticked; both tickets are free normally, so the split is equal.
+    await row.getByRole("button", { name: "Create pass" }).click();
+    await expect(row.getByTestId("season-pass")).toContainText("E2E Breakfast pass");
+    await expect(row.getByTestId("season-pass")).toContainText("share R 15.00");
+
+    // E2E has no online payment provider, so the places are booked and wait for payment.
+    await loginAs(page, "user");
+    await page.goto(`/series/${series.slug}`);
+    const offer = page.getByTestId("season-pass-offer").filter({ hasText: "E2E Breakfast pass" });
+    await offer.getByLabel("How many of E2E Breakfast pass").selectOption("2");
+    await offer.getByRole("button", { name: "Buy · R 60.00" }).click();
+    await expect(page.getByTestId("season-pass-offers").getByRole("status")).toContainText("Your places are booked");
+    await expect(page.getByTestId("my-passes")).toContainText("2 × E2E Breakfast pass");
+    await expect(page.getByTestId("my-passes").getByRole("button", { name: "Pay now" })).toBeVisible();
+
+    type Mine = { id: string; total: number; registrations: { id: string; event: { title: string } }[] }[];
+    const [purchase] = await api<Mine>(page, "user", "GET", "/api/season-passes/mine");
+    expect(purchase.total).toBe(60);
+    expect(purchase.registrations.map((r) => r.event.title).sort()).toEqual(["E2E Breakfast (in two months)", "E2E Breakfast (next month)"]);
+    // Each event's registration owes its share: 2 × R15.
+    type Reg = { id: string; totalDueComputed?: number; registrationOptions: { quantity: number; priceSnapshot: number }[] };
+    const regs = await api<Reg[]>(page, "supervisor", "GET", `/api/registrations/event/${next.id}`);
+    const fromPass = regs.find((r) => r.id === purchase.registrations.find((x) => x.event.title === "E2E Breakfast (next month)")!.id)!;
+    expect(fromPass.registrationOptions[0]).toMatchObject({ quantity: 2, priceSnapshot: 15 });
+
+    // A pass registration keeps its tickets as bought: no codes.
+    const res = await page.request.post(`${API}/api/registrations/${fromPass.id}/coupon`, {
+      headers: { Authorization: `Bearer ${seed().users.user.token}` }, data: { code: "ANY" },
+    });
+    expect(res.status()).toBe(409);
+  });
+
+  test("year on year: the series report compares its events, oldest first", async ({ page }) => {
+    await loginAs(page, "supervisor");
+    await page.goto("/dashboard/supervisor/series");
+    await page.getByTestId("series-row").filter({ hasText: "E2E Breakfast" }).getByRole("link", { name: "Compare" }).click();
+    const rows = page.getByTestId("comparison-row");
+    await expect(rows).toHaveCount(3);
+    await expect(rows.first()).toContainText("E2E Breakfast (last month)");
+    await expect(rows.last()).toContainText("E2E Breakfast (in two months)");
+  });
+});
@@ -48,10 +48,10 @@ async function seed(url) {
  });

  const password = await hashPassword('E2e-password-123');
-  // Opted in to news and already asked (newsAskedAt), so the one-time news question
-  // doesn't cover the dashboards in every test.
+  // Opted in to news and already asked (newsAskedAt), and accepted the built-in privacy notice
+  // (version 0), so neither one-time question covers the dashboards in every test.
  const mk = (role, name, email, phoneNumber) => prisma.user.create({
-    data: { name, email, phoneNumber, role, password, isActive: true, updatedAt: new Date(), newsEmail: true, newsWhatsApp: true, newsAskedAt: new Date() },
+    data: { name, email, phoneNumber, role, password, isActive: true, updatedAt: new Date(), newsEmail: true, newsWhatsApp: true, newsAskedAt: new Date(), noticeVersionAccepted: 0 },
  });
  const users = {
    admin: await mk('admin', 'Ada Admin', 'admin@e2e.test', '0820000001'),
@@ -195,7 +195,12 @@ async function seed(url) {
    course: { sessions: course.sessions.map(s => ({ id: s.id, label: s.label })), ticketId: ticket.id, qrCode: ticket.qrCode },
    // An account that has never answered the news question (asked once after login).
    newsPromptUser: await (async () => {
-      const u = await prisma.user.create({ data: { name: 'Nomsa New', email: 'prompt@e2e.test', role: 'user', password, isActive: true, updatedAt: new Date(), newsEmail: true } });
+      const u = await prisma.user.create({ data: { name: 'Nomsa New', email: 'prompt@e2e.test', role: 'user', password, isActive: true, updatedAt: new Date(), newsEmail: true, noticeVersionAccepted: 0 } });
+      return { id: u.id, token: generateToken(u.id, u.role, 0) };
+    })(),
+    // An account made for someone (never accepted the privacy notice): asked once after login.
+    noticeFirstUser: await (async () => {
+      const u = await prisma.user.create({ data: { name: 'Pieter Placed', email: 'placed@e2e.test', role: 'user', password, isActive: true, updatedAt: new Date(), newsEmail: true, newsAskedAt: new Date() } });
      return { id: u.id, token: generateToken(u.id, u.role, 0) };
    })(),
    // Retention: two accounts untouched for six years — one not yet warned, one warned 40 days
@@ -0,0 +1,70 @@
+import http from "http";
+import crypto from "crypto";
+import { test, expect, loginAs, API } from "./fixtures";
+
+// Outbound webhooks (1.48.0): an admin adds an endpoint (a receiver this test runs on localhost),
+// sends a test, and a new account is delivered — signed with the endpoint's secret.
+type Received = { headers: http.IncomingHttpHeaders; body: string };
+const RECEIVER_PORT = 5199;
+
+test.describe.serial("outbound webhooks", () => {
+  const received: Received[] = [];
+  let server: http.Server;
+  let secret = "";
+
+  test.beforeAll(async () => {
+    server = http.createServer((req, res) => {
+      let body = "";
+      req.on("data", c => { body += c; });
+      req.on("end", () => { received.push({ headers: req.headers, body }); res.writeHead(200).end("ok"); });
+    });
+    await new Promise<void>(resolve => server.listen(RECEIVER_PORT, resolve));
+  });
+  test.afterAll(async () => { await new Promise(resolve => server.close(resolve)); });
+
+  const signed = (r: Received) => {
+    const m = /^t=(\d+),v1=([0-9a-f]{64})$/.exec(String(r.headers["x-crossevents-signature"]));
+    return !!m && crypto.createHmac("sha256", secret).update(`${m[1]}.${r.body}`).digest("hex") === m[2];
+  };
+
+  test("an admin adds a webhook and sends a test", async ({ page }) => {
+    await loginAs(page, "admin");
+    await page.goto("/dashboard/admin/settings?tab=webhooks");
+    await page.getByRole("button", { name: "+ Add webhook" }).click();
+    await page.getByLabel("Name").fill("E2E receiver");
+    await page.getByLabel("Address (https)").fill(`http://localhost:${RECEIVER_PORT}/hook`);
+    await page.getByText("Account created", { exact: true }).click();
+    await page.getByText("Registration made", { exact: true }).click();
+    await page.getByRole("button", { name: "Add webhook" }).click();
+
+    await expect(page.getByTestId("webhook-secret")).toBeVisible();
+    secret = (await page.getByTestId("webhook-secret").locator("code").first().innerText()).trim();
+    expect(secret).toMatch(/^whsec_/);
+    await page.getByRole("button", { name: "I've saved it" }).click();
+
+    const endpoint = page.getByTestId("webhook-endpoint").filter({ hasText: "E2E receiver" });
+    await endpoint.getByRole("button", { name: "Send test" }).click();
+    await expect(page.getByRole("status")).toContainText("Test delivered (answered 200)");
+    const testHook = received.find(r => r.headers["x-crossevents-event"] === "webhook.test");
+    expect(testHook && signed(testHook)).toBe(true);
+  });
+
+  test("a new account is sent, signed, and shows in the delivery log", async ({ page, request }) => {
+    const email = `webhook-${Date.now()}@test.local`;
+    const res = await request.post(`${API}/api/users`, { data: { name: "Webhook Person", email, password: "E2e-password-123", phoneNumber: "0820000123" } });
+    expect(res.ok()).toBe(true);
+
+    await expect.poll(() => received.filter(r => r.headers["x-crossevents-event"] === "user.created").length, { timeout: 15000 }).toBeGreaterThan(0);
+    const hook = received.find(r => r.headers["x-crossevents-event"] === "user.created")!;
+    expect(signed(hook)).toBe(true);
+    const body = JSON.parse(hook.body);
+    expect(body).toMatchObject({ type: "user.created", data: { person: { name: "Webhook Person", email } } });
+    expect(body.id).toMatch(/^evt_/);
+
+    await loginAs(page, "admin");
+    await page.goto("/dashboard/admin/settings?tab=webhooks");
+    const endpoint = page.getByTestId("webhook-endpoint").filter({ hasText: "E2E receiver" });
+    await endpoint.getByRole("button", { name: "Delivery log" }).click();
+    await expect(endpoint.getByTestId("webhook-delivery").filter({ hasText: "user.created" })).toContainText("succeeded");
+  });
+});
@@ -1,12 +1,12 @@
 {
  "name": "hope-events-frontend",
-  "version": "1.47.0",
+  "version": "1.49.2",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "hope-events-frontend",
-      "version": "1.47.0",
+      "version": "1.49.2",
      "dependencies": {
        "@dnd-kit/core": "^6.3.1",
        "@hookform/resolvers": "^5.2.1",
@@ -1,6 +1,6 @@
 {
  "name": "hope-events-frontend",
-  "version": "1.47.0",
+  "version": "1.49.2",
  "private": true,
  "scripts": {
    "dev": "next dev --turbopack",
@@ -1,5 +1,6 @@
 "use client";
 import React, { Suspense, useMemo, useState } from "react";
+import Link from "next/link";
 import { Navbar } from "@/components/layout/Navbar";
 import { Footer } from "@/components/layout/Footer";
 import { apiFetch } from "@/lib/api";
@@ -16,8 +17,11 @@ function ActivateAccountContent() {
  const [confirm, setConfirm] = useState("");
  const [status, setStatus] = useState<string | null>(null);
  const [loading, setLoading] = useState(false);
+  // An account made for them (by staff, at the door, or by whoever registered them): they agree
+  // to the terms and privacy notice here, as at sign-up.
+  const [accepted, setAccepted] = useState(false);

-  const canSubmit = useMemo(() => password.length >= 8 && password === confirm && !!token, [password, confirm, token]);
+  const canSubmit = useMemo(() => password.length >= 8 && password === confirm && !!token && accepted, [password, confirm, token, accepted]);

  const submit = async (e: React.FormEvent) => {
    e.preventDefault();
@@ -25,7 +29,7 @@ function ActivateAccountContent() {
    try {
      setLoading(true);
      setStatus(null);
-      const data = await apiFetch<{ token?: string }>("/api/users/activate", { method: "POST", body: { token, password } });
+      const data = await apiFetch<{ token?: string }>("/api/users/activate", { method: "POST", body: { token, password, acceptTerms: accepted } });
      // Auto-login: save the session token (under the key AuthContext reads) and load the
      // dashboard fresh so the new session is picked up.
      if (data?.token) saveToken(data.token);
@@ -64,6 +68,14 @@ function ActivateAccountContent() {
            {password && confirm && password !== confirm && (
              <p className="text-xs text-red-600">Passwords do not match.</p>
            )}
+            <div className="flex items-start gap-2">
+              <input id="terms" type="checkbox" checked={accepted} onChange={e => setAccepted(e.target.checked)} className="mt-1 h-4 w-4 border-gray-300 rounded accent-brand-600" required />
+              <label htmlFor="terms" className="text-sm text-gray-700 leading-snug">
+                I confirm that I&apos;ve read and agree to the{" "}
+                <Link href="/legal/terms" target="_blank" className="text-brand-600 hover:underline">Terms of Use</Link> and{" "}
+                <Link href="/legal/privacy" target="_blank" className="text-brand-600 hover:underline">Privacy Policy</Link>.
+              </label>
+            </div>
            <button disabled={loading || !canSubmit} className="px-4 py-2 rounded bg-brand-600 hover:bg-brand-700 text-white disabled:opacity-60 w-full py-2.5 font-medium">
              {loading ? "Activating…" : "Activate my account"}
            </button>
@@ -117,6 +117,11 @@ const ACTION_LABELS: Record<string, string> = {
  volunteer_assigned: "Volunteer put on a roster",
  volunteer_removed: "Volunteer taken off a roster",
  volunteer_checked_in_manual: "Volunteer checked in by hand",
+  series_created: "Event series created",
+  series_updated: "Event series changed",
+  series_deleted: "Event series deleted",
+  season_pass_changed: "Season pass created, changed or deleted",
+  registrations_bulk: "Bulk action on registrations",
 };

 interface AuditLogEntry {
@@ -9,7 +9,7 @@ import { useVisiblePolling } from "@/hooks/useVisiblePolling";
 import {
  Calendar, Banknote, Gift, Users, Ticket, QrCode, ClipboardList,
  UserPlus, FileText, MessageCircle, BarChart2, Mail, Wallet, DoorOpen, History, TicketPercent, ShieldCheck, ListChecks, WifiOff, BedDouble, Filter, ClipboardCheck, Inbox,
-  Baby, HandHeart,
+  Baby, HandHeart, Layers,
 } from "lucide-react";
 import { StatCard, StatCardRow } from "@/components/shared/StatCard";
 import { QuickActionTile, QuickActionGrid } from "@/components/shared/QuickActionTile";
@@ -17,6 +17,8 @@ import { AreaTrendChart } from "@/components/charts/AreaTrendChart";
 import { Table, TableHeader, TableBody, TableRow, TableHead, TableCell } from "@/components/ui/table";
 import type { DashboardStats, PaymentStats } from "@/types";
 import { CampusFilter } from "@/components/shared/CampusFilter";
+import { TodayPanel } from "@/components/dashboard/TodayPanel";
+import { CommandPaletteButton } from "@/components/shared/CommandPalette";

 const formatRand = (n: number) => `R ${(n || 0).toFixed(2)}`;
 const formatRandAxis = (n: number) => `R${new Intl.NumberFormat(undefined, { notation: "compact", maximumFractionDigits: 1 }).format(n)}`;
@@ -26,6 +28,7 @@ const REPORTS_URL = "/dashboard/supervisor/reports";
 const QUICK_ACTIONS = [
  { href: "/dashboard/admin/users", label: "Manage users", description: "Create, edit, change roles and passwords", icon: Users },
  { href: "/dashboard/supervisor/events", label: "Manage events", description: "Create, edit, and update ticket types", icon: Calendar },
+  { href: "/dashboard/supervisor/series", label: "Event series", description: "Group events like every year's camp on one page", icon: Layers },
  { href: "/dashboard/admin/registrations", label: "Manage registrations", description: "Cancel, update status, and search registrations", icon: ClipboardList },
  { href: "/dashboard/supervisor/manual", label: "Manual registration", description: "Register a guest and issue tickets", icon: UserPlus },
  { href: "/dashboard/supervisor/at-the-door", label: "At the door", description: "Walk-ins, payments, ticket printing", icon: DoorOpen },
@@ -123,11 +126,19 @@ export default function AdminDashboardPage() {
  return (
    <div className="max-w-6xl mx-auto w-full overflow-x-hidden">
      <div className="mb-6">
-        <h1 className="text-2xl font-semibold text-gray-900">Welcome back{user ? `, ${user.name}` : ""} 👋</h1>
-        <p className="text-sm text-gray-500 mt-1">Here&apos;s what&apos;s happening with your events today.</p>
-        <CampusFilter value={campus} onChange={setCampus} everyLabel="All campuses (church-wide total)" className="mt-3" id="dashboard-campus" mine />
+        <div className="flex flex-wrap items-start justify-between gap-3">
+          <div>
+            <h1 className="text-2xl font-semibold text-gray-900">Welcome back{user ? `, ${user.name}` : ""} 👋</h1>
+            <p className="text-sm text-gray-500 mt-1">Here&apos;s what&apos;s happening with your events today.</p>
+          </div>
+          <CommandPaletteButton />
+        </div>
      </div>

+      <TodayPanel supervisor />
+
+      <CampusFilter value={campus} onChange={setCampus} everyLabel="All campuses (church-wide total)" className="mb-3" id="dashboard-campus" mine />
+
      {!isAdmin && (
        <div className="p-3 border rounded bg-yellow-50 text-yellow-800 text-sm mb-4">
          You need admin access to use these tools.
@@ -9,6 +9,8 @@ import { ClipboardList } from "lucide-react";
 import { errorMessage } from "@/lib/utils";
 import type { Event, FormResponse, Registration } from "@/types";
 import { BackLink } from "@/components/shared/BackLink";
+import { RegistrationBulkBar } from "@/components/admin/RegistrationBulkBar";
+import { SavedFilters } from "@/components/shared/SavedFilters";

 const STATUS_OPTIONS = ["pending", "confirmed", "partial_paid", "paid", "cancelled"] as const;

@@ -54,6 +56,20 @@ export default function AdminRegistrationsPage() {
  const [includePastEvents, setIncludePastEvents] = useState(false);
  const [includeInactiveEvents, setIncludeInactiveEvents] = useState(false);

+  // Deep links (the dashboard's "Waiting for you" list and the Ctrl+K palette): ?q=, ?status=, ?event=.
+  // A search by reference may be for a past event's registration, so past events are included then.
+  useEffect(() => {
+    const params = new URLSearchParams(window.location.search);
+    const q = params.get("q");
+    if (q) { setQuery(q); setIncludePastEvents(true); }
+    if (params.get("status")) setStatusFilter(params.get("status") || "");
+    if (params.get("event")) setEventFilter(params.get("event") || "");
+  }, []);
+
+  // Ticked for a bulk action (1.49.1).
+  const [selected, setSelected] = useState<Set<string>>(new Set());
+  const toggleSelected = (id: string) => setSelected(prev => { const s = new Set(prev); if (s.has(id)) s.delete(id); else s.add(id); return s; });
+
  // Expanded rows + form responses cache
  const [expanded, setExpanded] = useState<Set<string>>(new Set());
  const [formResponses, setFormResponses] = useState<Record<string, FormResponse[]>>({});
@@ -163,6 +179,10 @@ export default function AdminRegistrationsPage() {
    });
  }, [registrations, query, eventFilter, statusFilter, eventIds]);

+  // Only ticked registrations still shown by the filters are acted on.
+  const selectedRegs = useMemo(() => filtered.filter(r => selected.has(r.id)), [filtered, selected]);
+  const allShownSelected = filtered.length > 0 && filtered.every(r => selected.has(r.id));
+
  const statusColor = (s: string) => {
    if (s === "paid") return "text-green-700 bg-green-50";
    if (s === "confirmed") return "text-blue-700 bg-blue-50";
@@ -273,11 +293,30 @@ export default function AdminRegistrationsPage() {
          <button className="text-sm px-2 py-1.5 rounded bg-gray-100 hover:bg-gray-200" onClick={loadRegistrations} disabled={loadingRegs}>
            {loadingRegs ? "Loading…" : "Refresh"}
          </button>
+          <SavedFilters
+            page="registrations"
+            value={{ q: query, event: eventFilter, status: statusFilter, past: includePastEvents, inactive: includeInactiveEvents }}
+            onApply={p => {
+              setQuery(String(p.q || "")); setEventFilter(String(p.event || "")); setStatusFilter(String(p.status || ""));
+              setIncludePastEvents(p.past === true); setIncludeInactiveEvents(p.inactive === true);
+            }}
+            skipDefault={typeof window !== "undefined" && /[?&](q|status|event)=/.test(window.location.search)}
+          />
        </div>
        <div className="mt-2 text-xs text-gray-500">{filtered.length} of {registrations.length} registrations</div>
      </div>

+      {token && selectedRegs.length > 0 && (
+        <RegistrationBulkBar selected={selectedRegs} events={events} token={token} onClear={() => setSelected(new Set())} onDone={loadRegistrations} />
+      )}
+
      <div className="border rounded-xl bg-white shadow-sm">
+        {filtered.length > 0 && (
+          <label className="flex items-center gap-2 px-3 py-2 border-b text-xs text-gray-600 cursor-pointer">
+            <input type="checkbox" aria-label="Select all shown" checked={allShownSelected} onChange={e => setSelected(e.target.checked ? new Set(filtered.map(r => r.id)) : new Set())} />
+            Select all {filtered.length} shown
+          </label>
+        )}
        <ul className="divide-y text-sm">
          {filtered.map((r) => {
            const totalDue = totalDueFor(r);
@@ -291,6 +330,10 @@ export default function AdminRegistrationsPage() {
              <li key={r.id} className="hover:bg-gray-50">
                <div className="p-3 cursor-pointer" onClick={() => toggleExpand(r)}>
                  <div className="flex items-start justify-between gap-2">
+                    <input
+                      type="checkbox" className="mt-1 shrink-0" aria-label={`Select ${r.user?.name || r.userId}`}
+                      checked={selected.has(r.id)} onClick={e => e.stopPropagation()} onChange={() => toggleSelected(r.id)}
+                    />
                    <div className="flex-1 min-w-0">
                      <div className="flex items-center gap-2 flex-wrap">
                        <span className="font-medium">{r.user?.name || r.userId}</span>
@@ -7,20 +7,21 @@ import Link from "next/link";
 import { apiFetch, ApiError, API_BASE, resolveToApiOrigin } from "@/lib/api";
 import { useSiteSettings } from "@/contexts/SiteSettingsContext";
 import { useDismissingState } from "@/hooks/useDismissingState";
-import { Building2, Palette, Bell, Mail, Scale, MessageCircle, CreditCard, DatabaseBackup, Timer, KeyRound, MapPinned, type LucideIcon } from "lucide-react";
+import { Building2, Palette, Bell, Mail, Scale, MessageCircle, CreditCard, DatabaseBackup, Timer, KeyRound, MapPinned, type LucideIcon, Webhook } from "lucide-react";
 import { ColorPickerField } from "@/components/admin/ColorPickerField";
 import { BrandingPreviewPanel } from "@/components/admin/BrandingPreviewPanel";
 import { BackupsTab } from "@/components/admin/BackupsTab";
 import { JobsTab } from "@/components/admin/JobsTab";
 import { PaymentsTab } from "@/components/admin/PaymentsTab";
 import { LicenceTab } from "@/components/admin/LicenceTab";
+import { WebhooksTab } from "@/components/admin/WebhooksTab";
 import { CampusesTab } from "@/components/admin/CampusesTab";
 import { extractDominantColors } from "@/lib/extractColors";
 import { mapsSearchUrl } from "@/lib/maps";
 import { errorMessage } from "@/lib/utils";
 import { BackLink } from "@/components/shared/BackLink";

-type TabId = "organisation" | "campuses" | "branding" | "notifications" | "email" | "legal" | "whatsapp" | "payments" | "backups" | "jobs" | "licence";
+type TabId = "organisation" | "campuses" | "branding" | "notifications" | "email" | "legal" | "whatsapp" | "payments" | "webhooks" | "backups" | "jobs" | "licence";

 const TABS: { id: TabId; label: string; icon: LucideIcon }[] = [
  { id: "organisation",  label: "Organisation",  icon: Building2 },
@@ -31,6 +32,7 @@ const TABS: { id: TabId; label: string; icon: LucideIcon }[] = [
  { id: "legal",         label: "Legal",         icon: Scale },
  { id: "whatsapp",      label: "WhatsApp",      icon: MessageCircle },
  { id: "payments",      label: "Payments",      icon: CreditCard },
+  { id: "webhooks",      label: "Webhooks",      icon: Webhook },
  { id: "backups",       label: "Backups",       icon: DatabaseBackup },
  { id: "jobs",          label: "Background jobs", icon: Timer },
  { id: "licence",       label: "Licence",       icon: KeyRound },
@@ -716,6 +718,7 @@ function SiteSettingsPageInner() {

        {/* ── Backups ───────────────────────────────────────────────────────── */}
        {activeTab === "backups" && <BackupsTab active={activeTab === "backups"} />}
+        {activeTab === "webhooks" && <WebhooksTab active={activeTab === "webhooks"} />}
        {activeTab === "jobs" && <JobsTab active={activeTab === "jobs"} />}
        {activeTab === "licence" && <LicenceTab active={activeTab === "licence"} />}
        {activeTab === "campuses" && <CampusesTab active={activeTab === "campuses"} />}
@@ -12,6 +12,7 @@ import { errorMessage } from "@/lib/utils";
 import type { Paginated } from "@/types";
 import { BackLink } from "@/components/shared/BackLink";
 import { useCampuses } from "@/hooks/useCampuses";
+import { SavedFilters } from "@/components/shared/SavedFilters";

 interface UserItem {
  id: string;
@@ -58,6 +59,12 @@ export default function AdminUsersPage() {
  const [roleFilter, setRoleFilter] = useState<Role | "">("");
  const [activeFilter, setActiveFilter] = useState<"" | "true" | "false">("");

+  // ?q= (the Ctrl+K palette links here with a person's email).
+  useEffect(() => {
+    const q = new URLSearchParams(window.location.search).get("q");
+    if (q) { setQuery(q); setDebouncedQuery(q); }
+  }, []);
+
  // Debounce search
  useEffect(() => {
    const t = setTimeout(() => setDebouncedQuery(query), 350);
@@ -353,6 +360,17 @@ export default function AdminUsersPage() {
              <option value="false">Inactive only</option>
            </select>
          </div>
+          <SavedFilters
+            page="users" className="self-end"
+            value={{ q: query, role: roleFilter, active: activeFilter }}
+            onApply={p => {
+              const q = String(p.q || "");
+              setQuery(q); setDebouncedQuery(q);
+              setRoleFilter(String(p.role || "") as Role | "");
+              setActiveFilter(String(p.active || "") as "" | "true" | "false");
+            }}
+            skipDefault={typeof window !== "undefined" && /[?&]q=/.test(window.location.search)}
+          />
          <div>
            <label className="block text-xs text-gray-600 mb-1">Per page</label>
            <select className="border rounded px-2 py-1.5 text-sm" value={pageSize} onChange={e => handlePageSizeChange(Number(e.target.value))}>
@@ -9,6 +9,7 @@ import { Sidebar, MobileSidebar } from "@/components/layout/Sidebar";
 import { PrivacyPrompts } from "@/components/shared/PrivacyPrompts";
 import { LicenceBanner } from "@/components/shared/LicenceBanner";
 import { ProviderNotices } from "@/components/shared/ProviderNotices";
+import { CommandPalette } from "@/components/shared/CommandPalette";

 // The sidebar shows only on these exact routes — each role's dashboard root,
 // plus Profile & Security and Site Settings (matching the redesign
@@ -92,6 +93,7 @@ export default function DashboardLayout({ children }: { children: React.ReactNod
        <LicenceBanner />
        <ProviderNotices />
        <PrivacyPrompts />
+        <CommandPalette />
        <MobileSidebar />
        <div className="flex-1 flex min-h-0">
          <Sidebar />
@@ -110,6 +112,7 @@ export default function DashboardLayout({ children }: { children: React.ReactNod
      <LicenceBanner />
      <ProviderNotices />
      <PrivacyPrompts />
+      <CommandPalette />
      <main className="flex-1 p-6 bg-gray-50">{children}</main>
      <Footer />
    </div>
@@ -11,6 +11,8 @@ import { StatCard, StatCardRow } from "@/components/shared/StatCard";
 import { QuickActionTile, QuickActionGrid } from "@/components/shared/QuickActionTile";
 import type { DashboardStats, RecentScan, ScanStats } from "@/types";
 import { CampusScopeNote } from "@/components/shared/CampusFilter";
+import { TodayPanel } from "@/components/dashboard/TodayPanel";
+import { CommandPaletteButton } from "@/components/shared/CommandPalette";

 const QUICK_ACTIONS = [
  { href: "/dashboard/staff/ticket-scanning", label: "Scan tickets", description: "Use your device camera to validate tickets", icon: QrCode },
@@ -76,11 +78,18 @@ export default function StaffDashboardPage() {
  return (
    <div className="max-w-6xl mx-auto w-full">
      <div className="mb-6">
-        <h1 className="text-2xl font-semibold text-gray-900">Welcome back{user ? `, ${user.name}` : ""} 👋</h1>
-        <p className="text-sm text-gray-500 mt-1">Here&apos;s today&apos;s scanning activity.</p>
+        <div className="flex flex-wrap items-start justify-between gap-3">
+          <div>
+            <h1 className="text-2xl font-semibold text-gray-900">Welcome back{user ? `, ${user.name}` : ""} 👋</h1>
+            <p className="text-sm text-gray-500 mt-1">Here&apos;s today&apos;s scanning activity.</p>
+          </div>
+          <CommandPaletteButton />
+        </div>
        <CampusScopeNote className="mt-2" />
      </div>

+      <TodayPanel supervisor={false} />
+
      {!canView && (
        <div className="p-3 border rounded bg-yellow-50 text-yellow-800 text-sm mb-4">
          You need staff, supervisor, or admin access to use staff tools.
@@ -10,10 +10,11 @@ import { useDismissingState } from "@/hooks/useDismissingState";
 import { useSiteSettings } from "@/contexts/SiteSettingsContext";
 import { useMyCampuses } from "@/hooks/useCampuses";
 import { CampusBadge, CampusFilter, matchesCampus } from "@/components/shared/CampusFilter";
+import { SavedFilters } from "@/components/shared/SavedFilters";
 import { Calendar, Copy } from "lucide-react";
 import { ChoicesEditor } from "@/components/shared/FormFieldExtras";
 import { errorMessage } from "@/lib/utils";
-import type { Event, EventAttachment, EventFormField, EventOption, Paginated, Section } from "@/types";
+import type { Event, EventAttachment, EventFormField, EventOption, EventSeries, Paginated, Section } from "@/types";
 import { BackLink } from "@/components/shared/BackLink";
 import {
  SessionsEditor, AttendanceSettings, keyed, sortSessions, sessionsProblem, defaultCertificate,
@@ -833,6 +834,7 @@ interface EventDraft {
  requiresRegistration: boolean; contactName: string; contactPhone: string; contactEmail: string;
  location: string; allowNamedAttendees: boolean;
  campusId: string; // "" = all campuses
+  seriesId: string; // "" = not in a series
  requiresParentalConsent: boolean; consentText: string;
  consentCollectMedical: boolean; consentCollectEmergency: boolean; consentCollectPhoto: boolean;
  waitlistEnabled: boolean; waitlistOfferHours: string; waitlistPartialOffers: boolean;
@@ -849,6 +851,7 @@ const blankDraft = (location = ""): EventDraft => ({
  requiresRegistration: true, contactName: "", contactPhone: "", contactEmail: "",
  location, allowNamedAttendees: false,
  campusId: "",
+  seriesId: "",
  requiresParentalConsent: false, consentText: "",
  consentCollectMedical: true, consentCollectEmergency: true, consentCollectPhoto: true,
  waitlistEnabled: false, waitlistOfferHours: "24", waitlistPartialOffers: true,
@@ -942,6 +945,7 @@ function EventModal({ mode, event: ev, source, onClose, onSuccess }: EventModalP
    contactName: base.contactName || "", contactPhone: base.contactPhone || "", contactEmail: base.contactEmail || "",
    location: base.location || "",
    campusId: base.campusId || "",
+    seriesId: base.seriesId || "",
    scheduleType: base.scheduleType === "sessions" ? "sessions" : "single",
    attendanceMode: base.attendanceMode === "pick" ? "pick" : "whole",
  } : blankDraft(settings.org_address || ""));
@@ -958,6 +962,13 @@ function EventModal({ mode, event: ev, source, onClose, onSuccess }: EventModalP
    });
  }, [mode, campusInfo.scoped, campusInfo.campuses, settings.org_address]);

+  // Series to choose from (Basic Details).
+  const [seriesList, setSeriesList] = useState<EventSeries[]>([]);
+  useEffect(() => {
+    if (!token) return;
+    apiFetch<EventSeries[]>("/api/series", { authToken: token }).then(l => setSeriesList(Array.isArray(l) ? l : [])).catch(() => {});
+  }, [token]);
+
  // ── multi-day schedule + attendance settings ──
  // A copy leaves out cancelled sessions and saves the rest as new ones; each keeps the source
  // session's id as its key so "late joining until" still points at the same session.
@@ -1394,6 +1405,7 @@ function EventModal({ mode, event: ev, source, onClose, onSuccess }: EventModalP
        location: draft.location.trim(),
        // Only sent while campuses are on; the server ignores it otherwise.
        ...(campusInfo.enabled ? { campusId: draft.campusId || null } : {}),
+        seriesId: draft.seriesId || null,
      };

      let notice: { eventId: string; moved: number; cancelled: number } | null = null;
@@ -1627,6 +1639,14 @@ function EventModal({ mode, event: ev, source, onClose, onSuccess }: EventModalP
                  <p className="text-[10px] text-gray-400 mt-0.5">&quot;All campuses&quot; events show at every campus — for church-wide conferences and camps.</p>
                </div>
              )}
+              <div>
+                <label className="block text-xs text-gray-600 mb-1" htmlFor="event-series">Series</label>
+                <select id="event-series" className="w-full border rounded px-3 py-2 text-sm bg-white" value={draft.seriesId} onChange={e => upd({ seriesId: e.target.value })}>
+                  <option value="">Not in a series</option>
+                  {seriesList.map(s => <option key={s.id} value={s.id}>{s.name}</option>)}
+                </select>
+                <p className="text-[10px] text-gray-400 mt-0.5">Groups separate events, like every year&apos;s camp, on one page with &quot;Next in this series&quot;. <a href="/dashboard/supervisor/series" target="_blank" className="underline">Manage series</a></p>
+              </div>
              <div>
                <label className="block text-xs text-gray-600 mb-1">Location</label>
                <input className="w-full border rounded px-3 py-2 text-sm" value={draft.location} onChange={e => upd({ location: e.target.value })} placeholder="e.g. 123 Church St, City" />
@@ -1999,6 +2019,7 @@ function EventCard({ ev, onEdit, onCopy }: { ev: Event; onEdit: () => void; onCo
          {ev.isHidden && <span className="text-[10px] px-1.5 py-0.5 rounded bg-gray-100 text-gray-500">Hidden</span>}
          {isClosed && <span className="text-[10px] px-1.5 py-0.5 rounded bg-rose-50 text-rose-700">Closed</span>}
          <CampusBadge campus={ev.campus} />
+          {ev.series && <span className="text-[10px] px-1.5 py-0.5 rounded bg-brand-50 text-brand-700">{ev.series.name}</span>}
        </div>
        <div className="text-xs text-gray-500 mt-0.5">
          {scheduleSummary(ev) || <>{ev.startDate ? new Date(ev.startDate).toLocaleDateString() : ""}{ev.endDate ? ` – ${new Date(ev.endDate).toLocaleDateString()}` : ""}</>}
@@ -2093,6 +2114,19 @@ export default function ManageEventsPage() {
  };
  const closeModal = () => { setModalMode(null); setEditingEvent(null); setCopyFrom(null); };

+  // Deep links (the Ctrl+K palette): ?edit=<eventId> opens that event, ?new=1 a new one.
+  const deepLinked = useRef(false);
+  useEffect(() => {
+    if (deepLinked.current || !token) return;
+    deepLinked.current = true;
+    const params = new URLSearchParams(window.location.search);
+    const edit = params.get("edit");
+    if (edit) openEdit({ id: edit } as Event);
+    else if (params.get("new") === "1") openCreate();
+    if (edit || params.get("new")) window.history.replaceState(null, "", window.location.pathname);
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [token]);
+
  return (
    <div className="max-w-4xl mx-auto w-full p-6">
      <div className="flex items-center justify-between mb-6 flex-wrap gap-3">
@@ -2126,6 +2160,14 @@ export default function ManageEventsPage() {
        <label className="flex items-center gap-2 cursor-pointer">
          <input type="checkbox" checked={showClosed} onChange={e => setShowClosed(e.target.checked)} /> Show closed
        </label>
+        <SavedFilters
+          page="events"
+          value={{ q: search, campus, past: includePast, inactive: showInactive, closed: showClosed }}
+          onApply={p => {
+            setSearch(String(p.q || "")); setCampus(String(p.campus || ""));
+            setIncludePast(p.past === true); setShowInactive(p.inactive === true); setShowClosed(p.closed === true);
+          }}
+        />
        {loadingEvents && <span className="text-xs text-gray-500">Loading…</span>}
      </div>

@@ -9,7 +9,7 @@ import { useVisiblePolling } from "@/hooks/useVisiblePolling";
 import {
  Calendar, Banknote, Gift, Users, Ticket, QrCode, DoorOpen, Wallet,
  UserPlus, FileText, MessageCircle, BarChart2, Mail, TicketPercent, ShieldCheck, ListChecks, WifiOff, BedDouble, Filter, ClipboardCheck,
-  Baby, HandHeart,
+  Baby, HandHeart, Layers,
 } from "lucide-react";
 import { StatCard, StatCardRow } from "@/components/shared/StatCard";
 import { QuickActionTile, QuickActionGrid } from "@/components/shared/QuickActionTile";
@@ -17,6 +17,8 @@ import { AreaTrendChart } from "@/components/charts/AreaTrendChart";
 import { Table, TableHeader, TableBody, TableRow, TableHead, TableCell } from "@/components/ui/table";
 import type { DashboardStats, PaymentStats, RecentScan, ScanStats } from "@/types";
 import { CampusFilter, CampusScopeNote } from "@/components/shared/CampusFilter";
+import { TodayPanel } from "@/components/dashboard/TodayPanel";
+import { CommandPaletteButton } from "@/components/shared/CommandPalette";

 const formatRand = (n: number) => `R ${(n || 0).toFixed(2)}`;
 const formatRandAxis = (n: number) => `R${new Intl.NumberFormat(undefined, { notation: "compact", maximumFractionDigits: 1 }).format(n)}`;
@@ -26,6 +28,7 @@ const REPORTS_URL = "/dashboard/supervisor/reports";
 const QUICK_ACTIONS = [
  { href: "/dashboard/supervisor/manual", label: "Manual registration", description: "Register a guest and issue tickets", icon: UserPlus },
  { href: "/dashboard/supervisor/events", label: "Manage events", description: "Create, edit, and update ticket types", icon: Calendar },
+  { href: "/dashboard/supervisor/series", label: "Event series", description: "Group events like every year's camp on one page", icon: Layers },
  { href: "/dashboard/supervisor/payments", label: "Payments & donations", description: "Manual payments and assignment", icon: Wallet },
  { href: "/dashboard/supervisor/allocations", label: "Rooms & groups", description: "Put attendees into rooms, groups or buses", icon: BedDouble },
  { href: "/dashboard/staff/kids", label: "Kids check-in", description: "Check children in and out with pickup codes", icon: Baby },
@@ -119,12 +122,20 @@ export default function SupervisorDashboardPage() {
  return (
    <div className="max-w-6xl mx-auto w-full overflow-x-hidden">
      <div className="mb-6">
-        <h1 className="text-2xl font-semibold text-gray-900">Welcome back{user ? `, ${user.name}` : ""} 👋</h1>
-        <p className="text-sm text-gray-500 mt-1">Here&apos;s what&apos;s happening with your events today.</p>
-        <CampusFilter value={campus} onChange={setCampus} everyLabel="All campuses (church-wide total)" className="mt-3" id="dashboard-campus" mine />
+        <div className="flex flex-wrap items-start justify-between gap-3">
+          <div>
+            <h1 className="text-2xl font-semibold text-gray-900">Welcome back{user ? `, ${user.name}` : ""} 👋</h1>
+            <p className="text-sm text-gray-500 mt-1">Here&apos;s what&apos;s happening with your events today.</p>
+          </div>
+          <CommandPaletteButton />
+        </div>
        <CampusScopeNote className="mt-2" />
      </div>

+      <TodayPanel supervisor />
+
+      <CampusFilter value={campus} onChange={setCampus} everyLabel="All campuses (church-wide total)" className="mb-3" id="dashboard-campus" mine />
+
      {!canView && (
        <div className="p-3 border rounded bg-yellow-50 text-yellow-800 text-sm mb-4">
          You need supervisor or admin access to use these tools.
@@ -0,0 +1,197 @@
+"use client";
+
+import React, { useCallback, useEffect, useState } from "react";
+import Link from "next/link";
+import { useRouter } from "next/navigation";
+import { Layers, ExternalLink, Users, BarChart3 } from "lucide-react";
+import { useAuth } from "@/hooks/useAuth";
+import { apiFetch } from "@/lib/api";
+import { errorMessage } from "@/lib/utils";
+import { BackLink } from "@/components/shared/BackLink";
+import { CampusBadge } from "@/components/shared/CampusFilter";
+import { SeasonPassesPanel } from "@/components/series/SeasonPassesPanel";
+import type { EventSeries } from "@/types";
+
+type Draft = { id?: string; name: string; slug: string; description: string; picture: string };
+const blank: Draft = { name: "", slug: "", description: "", picture: "" };
+
+function SeriesForm({ draft, onChange, onSave, onCancel, saving }: { draft: Draft; onChange: (d: Draft) => void; onSave: () => void; onCancel: () => void; saving: boolean }) {
+  const upd = (patch: Partial<Draft>) => onChange({ ...draft, ...patch });
+  return (
+    <div className="border rounded-xl p-4 bg-gray-50 space-y-3" data-testid="series-form">
+      <div className="grid sm:grid-cols-2 gap-3">
+        <div>
+          <label className="block text-xs text-gray-600 mb-1" htmlFor="series-name">Name</label>
+          <input id="series-name" className="w-full border rounded px-3 py-2 text-sm" value={draft.name} onChange={e => upd({ name: e.target.value })} placeholder="e.g. Family Camp" />
+        </div>
+        <div>
+          <label className="block text-xs text-gray-600 mb-1" htmlFor="series-slug">Web address</label>
+          <div className="flex items-center text-sm">
+            <span className="text-gray-400 mr-1">/series/</span>
+            <input id="series-slug" className="w-full border rounded px-3 py-2 text-sm" value={draft.slug} onChange={e => upd({ slug: e.target.value })} placeholder="made from the name" />
+          </div>
+        </div>
+      </div>
+      <div>
+        <label className="block text-xs text-gray-600 mb-1" htmlFor="series-description">Description</label>
+        <textarea id="series-description" rows={3} className="w-full border rounded px-3 py-2 text-sm" value={draft.description} onChange={e => upd({ description: e.target.value })} placeholder="Shown at the top of the series page" />
+      </div>
+      <div>
+        <label className="block text-xs text-gray-600 mb-1" htmlFor="series-picture">Picture (web address, optional)</label>
+        <input id="series-picture" className="w-full border rounded px-3 py-2 text-sm" value={draft.picture} onChange={e => upd({ picture: e.target.value })} placeholder="https://…" />
+      </div>
+      <div className="flex gap-2">
+        <button type="button" onClick={onSave} disabled={saving || !draft.name.trim()} className="px-4 py-1.5 text-sm rounded bg-brand-600 text-white hover:bg-brand-700 disabled:opacity-50 font-medium">
+          {saving ? "Saving…" : draft.id ? "Save series" : "Create series"}
+        </button>
+        <button type="button" onClick={onCancel} className="px-3 py-1.5 text-sm rounded border bg-white hover:bg-gray-50">Cancel</button>
+      </div>
+    </div>
+  );
+}
+
+export default function SeriesPage() {
+  const { user, loading, token } = useAuth();
+  const router = useRouter();
+  const isAdmin = user?.role === "admin";
+  const canView = user?.role === "admin" || user?.role === "supervisor";
+
+  useEffect(() => {
+    if (!loading && !user) router.replace("/login");
+  }, [user, loading, router]);
+
+  const [list, setList] = useState<EventSeries[]>([]);
+  const [error, setError] = useState<string | null>(null);
+  const [notice, setNotice] = useState<string | null>(null);
+  const [draft, setDraft] = useState<Draft | null>(null);
+  const [saving, setSaving] = useState(false);
+
+  const load = useCallback(async () => {
+    if (!token) return;
+    try {
+      setList(await apiFetch<EventSeries[]>("/api/series", { authToken: token }));
+    } catch (e) {
+      setError(errorMessage(e) || "Couldn't load the series");
+    }
+  }, [token]);
+  useEffect(() => { load(); }, [load]);
+
+  const save = async () => {
+    if (!draft) return;
+    setSaving(true); setError(null); setNotice(null);
+    try {
+      const body = { name: draft.name, slug: draft.slug || undefined, description: draft.description, picture: draft.picture };
+      await apiFetch(draft.id ? `/api/series/${draft.id}` : "/api/series", { method: draft.id ? "PUT" : "POST", authToken: token || undefined, body });
+      setNotice(draft.id ? "Series saved." : `"${draft.name.trim()}" created — choose it in the event editor to add events.`);
+      setDraft(null);
+      await load();
+    } catch (e) {
+      setError(errorMessage(e) || "Couldn't save the series");
+    } finally {
+      setSaving(false);
+    }
+  };
+
+  const remove = async (s: EventSeries) => {
+    if (!window.confirm(`Delete "${s.name}"? Its ${s.eventCount} event${s.eventCount === 1 ? "" : "s"} stay, just without a series, and ${s.followers} follower${s.followers === 1 ? "" : "s"} won't hear about new ones.`)) return;
+    setError(null); setNotice(null);
+    try {
+      await apiFetch(`/api/series/${s.id}`, { method: "DELETE", authToken: token || undefined });
+      setNotice(`"${s.name}" deleted.`);
+      await load();
+    } catch (e) {
+      setError(errorMessage(e) || "Couldn't delete the series");
+    }
+  };
+
+  const now = Date.now();
+
+  return (
+    <div className="max-w-4xl mx-auto w-full p-6">
+      <div className="flex items-center justify-between mb-6 flex-wrap gap-3">
+        <div className="flex items-center gap-3">
+          <div className="w-10 h-10 rounded-xl bg-brand-50 flex items-center justify-center shrink-0">
+            <Layers className="w-5 h-5 text-brand-600" />
+          </div>
+          <div>
+            <BackLink href="/dashboard" />
+            <h1 className="text-2xl font-semibold text-gray-900 mt-0.5">Event series</h1>
+            <p className="text-sm text-gray-500 mt-0.5">Group events like every year&apos;s camp on one page</p>
+          </div>
+        </div>
+        {!draft && (
+          <button type="button" className="px-4 py-2 text-sm rounded-lg bg-brand-600 text-white hover:bg-brand-700 shadow-sm font-medium" onClick={() => { setDraft({ ...blank }); setNotice(null); }}>+ New series</button>
+        )}
+      </div>
+
+      {!canView && !loading && <div className="p-3 border rounded bg-yellow-50 text-yellow-800 text-sm mb-4">You need supervisor or admin access.</div>}
+      {error && <div className="p-3 mb-3 border rounded bg-red-50 text-red-700 text-sm">{error}</div>}
+      {notice && <div className="p-3 mb-3 border rounded bg-green-50 text-green-800 text-sm" role="status">{notice}</div>}
+
+      {draft && !draft.id && (
+        <div className="mb-4"><SeriesForm draft={draft} onChange={setDraft} onSave={save} onCancel={() => setDraft(null)} saving={saving} /></div>
+      )}
+
+      {list.length === 0 ? (
+        <p className="text-sm text-gray-500 border rounded-xl bg-white p-4">No series yet. A series groups separate events — Camp 2025, Camp 2026 — on one page, with &quot;Next in this series&quot; and followers.</p>
+      ) : (
+        <ul className="space-y-3">
+          {list.map(s => (
+            <li key={s.id} className="border rounded-xl bg-white shadow-sm p-4" data-testid="series-row">
+              {draft?.id === s.id ? (
+                <SeriesForm draft={draft} onChange={setDraft} onSave={save} onCancel={() => setDraft(null)} saving={saving} />
+              ) : (
+                <>
+                  <div className="flex items-start justify-between gap-3 flex-wrap">
+                    <div className="min-w-0">
+                      <div className="font-medium text-gray-900">{s.name}</div>
+                      <div className="text-xs text-gray-500 mt-0.5 flex items-center gap-3 flex-wrap">
+                        <Link href={`/series/${s.slug}`} target="_blank" className="inline-flex items-center gap-1 text-brand-700 hover:underline">/series/{s.slug} <ExternalLink className="w-3 h-3" /></Link>
+                        <span className="inline-flex items-center gap-1"><Users className="w-3 h-3" /> {s.followers} follower{s.followers === 1 ? "" : "s"}</span>
+                      </div>
+                      {s.description && <p className="text-sm text-gray-600 mt-1 whitespace-pre-line">{s.description}</p>}
+                    </div>
+                    <div className="flex gap-2 shrink-0">
+                      {s.events.length > 0 && (
+                        <Link href={`/dashboard/supervisor/reports?report=seriesComparison&series=${s.id}`} className="inline-flex items-center gap-1 text-xs px-3 py-1.5 rounded border bg-white hover:bg-gray-50">
+                          <BarChart3 className="w-3.5 h-3.5" /> Compare
+                        </Link>
+                      )}
+                      <button type="button" className="text-xs px-3 py-1.5 rounded border bg-white hover:bg-gray-50"
+                        onClick={() => { setDraft({ id: s.id, name: s.name, slug: s.slug, description: s.description || "", picture: s.picture || "" }); setNotice(null); }}>Edit</button>
+                      {isAdmin && <button type="button" className="text-xs px-3 py-1.5 rounded bg-red-50 text-red-700 border border-red-200" onClick={() => remove(s)}>Delete</button>}
+                    </div>
+                  </div>
+                  <div className="mt-3">
+                    {s.events.length === 0 ? (
+                      <p className="text-xs text-gray-500">No events yet — choose this series in the event editor (Basic details).</p>
+                    ) : (
+                      <ul className="divide-y border rounded-lg">
+                        {s.events.map(e => (
+                          <li key={e.id} className="px-3 py-2 flex items-center justify-between gap-2 text-sm flex-wrap">
+                            <span className="flex items-center gap-2 min-w-0">
+                              <span className="truncate">{e.title}</span>
+                              {!e.isActive && <span className="text-[10px] px-1.5 py-0.5 rounded bg-gray-100 text-gray-500">Inactive</span>}
+                              {e.isHidden && <span className="text-[10px] px-1.5 py-0.5 rounded bg-gray-100 text-gray-500">Hidden</span>}
+                              {new Date(e.endDate).getTime() < now && <span className="text-[10px] px-1.5 py-0.5 rounded bg-amber-50 text-amber-700">Past</span>}
+                              <CampusBadge campus={e.campus} />
+                            </span>
+                            <span className="text-xs text-gray-500">{new Date(e.startDate).toLocaleDateString()}</span>
+                          </li>
+                        ))}
+                      </ul>
+                    )}
+                    {s.eventCount > s.events.length && (
+                      <p className="text-[11px] text-gray-400 mt-1">{s.eventCount - s.events.length} more at other campuses.</p>
+                    )}
+                  </div>
+                  {s.events.length > 0 && <SeasonPassesPanel seriesId={s.id} seriesSlug={s.slug} />}
+                </>
+              )}
+            </li>
+          ))}
+        </ul>
+      )}
+    </div>
+  );
+}
@@ -24,6 +24,7 @@ type Msg = { type: "ok" | "err"; text: string } | null;

 const SOURCE_LABEL: Record<string, string> = {
  signup: "when you signed up",
+  activation: "when you activated your account",
  privacy_centre: "in your privacy settings",
  prompt: "when we asked after logging in",
  unsubscribe_link: "with an unsubscribe link",
@@ -55,13 +55,16 @@ type Event = {
  sessions?: EventSession[];
  registrationClosesAt?: string;
  lateJoin?: LateJoinInfo | null;
+  series?: EventSeriesRef | null;
+  nextInSeries?: NextInSeries | null;
 };

 import { apiFetch, ApiError, resolveToApiOrigin } from "@/lib/api";
 import { ApiImage } from "@/components/shared/ApiImage";
 import { formatDateTimeRange } from "@/lib/date";
 import { BundleOffers } from "@/components/shared/BundleDeals";
-import type { EventSession, LateJoinInfo, PublicBundle } from "@/types";
+import type { EventSeriesRef, EventSession, LateJoinInfo, NextInSeries, PublicBundle } from "@/types";
+import { SeriesLinks } from "@/components/events/SeriesLinks";
 import { isPickOption, latePrice, registrationClosesAt, scheduleSummary } from "@/lib/sessions";
 import { SessionSchedule } from "@/components/events/SessionSchedule";
 import { appUrl, appName } from "@/lib/siteConfig";
@@ -222,6 +225,8 @@ export default async function EventDetailPage({ params }: { params: Promise<{ id

            <p className="text-gray-700 whitespace-pre-line">{event.description}</p>

+            <SeriesLinks series={event.series} next={event.nextInSeries} />
+
            {event.scheduleType === "sessions" && (event.sessions || []).length > 0 && (
              <SessionSchedule sessions={event.sessions || []} defaultLocation={event.location} />
            )}
@@ -0,0 +1,110 @@
+import { Metadata } from "next";
+import Link from "next/link";
+import { notFound } from "next/navigation";
+import { Navbar } from "@/components/layout/Navbar";
+import { Footer } from "@/components/layout/Footer";
+import { EventCard } from "@/components/events/EventCard";
+import { ApiImage } from "@/components/shared/ApiImage";
+import { CampusBadge } from "@/components/shared/CampusFilter";
+import { FollowSeriesButton } from "@/components/events/FollowSeriesButton";
+import { SeasonPassOffers } from "@/components/series/SeasonPassOffers";
+import { Suspense } from "react";
+import { apiFetch, apiFetchListForPrerender, ApiError } from "@/lib/api";
+import { formatDateTimeRange } from "@/lib/date";
+import { ArrowLeft, CalendarX, Layers } from "lucide-react";
+import type { Event as FullEvent, SeasonPassView } from "@/types";
+
+export const revalidate = 60;
+
+type Event = React.ComponentProps<typeof EventCard>["event"] & { cashupStatus?: string; nextSession?: { startsAt: string } | null };
+type PastEvent = { id: string; title: string; startDate: string; endDate: string; campus?: FullEvent["campus"] };
+type Series = { id: string; name: string; slug: string; description: string | null; picture: string | null; past: PastEvent[]; passes?: SeasonPassView[] };
+
+async function loadSeries(slug: string): Promise<Series | null> {
+  try {
+    return await apiFetch<Series>(`/api/series/by-slug/${encodeURIComponent(slug)}`, { nextOptions: { next: { revalidate } } });
+  } catch (e) {
+    if (e instanceof ApiError && e.status === 404) return null;
+    throw e;
+  }
+}
+
+export async function generateMetadata({ params }: { params: Promise<{ slug: string }> }): Promise<Metadata> {
+  const { slug } = await params;
+  const series = await loadSeries(slug);
+  if (!series) return {};
+  return {
+    title: series.name,
+    description: series.description || `Every ${series.name} event, past and upcoming.`,
+    alternates: { canonical: `/series/${series.slug}` },
+  };
+}
+
+/** A series' page: what it is, the upcoming events in it (any campus), and past ones. */
+export default async function SeriesPage({ params }: { params: Promise<{ slug: string }> }) {
+  const { slug } = await params;
+  const series = await loadSeries(slug);
+  if (!series) notFound();
+
+  const events = await apiFetchListForPrerender<Event>(`/api/events?series=${encodeURIComponent(series.slug)}`, { nextOptions: { next: { revalidate } } });
+  const now = Date.now();
+  const upcoming = (events || [])
+    .filter(e => e.cashupStatus !== "closed" && new Date(e.endDate || e.startDate).getTime() > now)
+    .sort((a, b) => new Date(a.nextSession?.startsAt || a.startDate).getTime() - new Date(b.nextSession?.startsAt || b.startDate).getTime());
+
+  return (
+    <div className="min-h-screen flex flex-col">
+      <Navbar />
+      <main className="flex-1 py-10 px-4 max-w-7xl mx-auto w-full">
+        <Link href="/events" className="inline-flex items-center gap-1 text-sm text-gray-500 hover:text-gray-700 mb-4">
+          <ArrowLeft className="w-4 h-4" /> All events
+        </Link>
+        <div className="border rounded-2xl p-6 mb-8 bg-white shadow-sm flex flex-col sm:flex-row gap-6">
+          {series.picture && <ApiImage src={series.picture} alt="" className="w-full sm:w-56 aspect-video object-cover rounded-xl shrink-0" />}
+          <div className="min-w-0 flex-1">
+            <p className="text-xs uppercase tracking-wide text-brand-700 flex items-center gap-1"><Layers className="w-3.5 h-3.5" /> Series</p>
+            <h1 className="text-2xl sm:text-3xl font-bold text-gray-900 mt-1">{series.name}</h1>
+            {series.description && <p className="text-gray-700 mt-2 whitespace-pre-line">{series.description}</p>}
+            <div className="mt-4">
+              <FollowSeriesButton slug={series.slug} />
+            </div>
+          </div>
+        </div>
+
+        <Suspense fallback={null}>
+          <SeasonPassOffers slug={series.slug} passes={series.passes || []} />
+        </Suspense>
+
+        <h2 className="text-xl font-semibold text-gray-900 mb-4">Coming up</h2>
+        {upcoming.length === 0 ? (
+          <div className="text-center py-12 border rounded-xl bg-gray-50 mb-10">
+            <CalendarX className="w-8 h-8 text-gray-300 mx-auto mb-2" />
+            <p className="text-gray-500 text-sm">Nothing planned yet — follow the series to hear when the next one is out.</p>
+          </div>
+        ) : (
+          <div className="grid gap-6 md:grid-cols-3 sm:grid-cols-2 mb-10">
+            {upcoming.map(event => <EventCard key={event.id} event={event} />)}
+          </div>
+        )}
+
+        {series.past.length > 0 && (
+          <>
+            <h2 className="text-xl font-semibold text-gray-900 mb-3">Past events</h2>
+            <ul className="border rounded-xl bg-white divide-y" data-testid="series-past">
+              {series.past.map(e => (
+                <li key={e.id} className="px-4 py-3 flex flex-wrap items-center justify-between gap-2">
+                  <span className="font-medium text-gray-800">{e.title}</span>
+                  <span className="text-sm text-gray-500 flex items-center gap-2">
+                    <CampusBadge campus={e.campus} className="text-[10px]" />
+                    {formatDateTimeRange(e.startDate, e.endDate)}
+                  </span>
+                </li>
+              ))}
+            </ul>
+          </>
+        )}
+      </main>
+      <Footer />
+    </div>
+  );
+}
@@ -23,6 +23,7 @@ const STATE: Record<string, string> = {
 const when = (d: string | null) => (d ? new Date(d).toLocaleString("en-GB", { day: "numeric", month: "short", hour: "2-digit", minute: "2-digit" }) : "—");

 function describeCron(cron: string): string {
+  if (cron === "* * * * *") return "Every minute";
  const m = /^\*\/(\d+) \* \* \* \*$/.exec(cron);
  if (m) return `Every ${m[1]} minutes`;
  const d = /^(\d+) (\d+) \* \* \*$/.exec(cron);
@@ -24,7 +24,8 @@ export type HubStatus = {
  urgentUpdate: boolean;
  updateSnoozed: boolean;
  releases: HubRelease[];
-  updateRequest: { requestedAt: string; version: string } | null;
+  // `outdated`: a newer version than the one asked for is out (the request can be changed to it).
+  updateRequest: { requestedAt: string; version: string; outdated?: boolean } | null;
  notices: HubNotice[];
 };

@@ -138,6 +139,8 @@ export function LicenceTab({ active }: { active: boolean }) {
    }
  };
  const requestUpdate = () => updateAction("/api/hub/update-request", undefined, "Update requested. Your provider has been told and will update the site.");
+  // Same request again: the Hub moves the open request on to the latest version.
+  const changeRequest = () => updateAction("/api/hub/update-request", undefined, `Request changed to version ${status?.latestVersion}. Your provider has been told.`);
  const withdrawRequest = () => {
    if (!confirm("Withdraw the update request? Your provider is told not to update the site for now.")) return;
    updateAction("/api/hub/update-request/cancel", undefined, "Update request withdrawn. Your provider has been told.");
@@ -208,12 +211,26 @@ export function LicenceTab({ active }: { active: boolean }) {
              </p>
            )}
            {status.updateRequest ? (
-              <div className="flex flex-wrap items-center gap-3">
-                <p className="text-gray-600">Version {status.latestVersion} is available. Update requested on {fmt(status.updateRequest.requestedAt)} — your provider will install it.</p>
-                {status.connected && (
-                  <button onClick={withdrawRequest} disabled={busy} className="inline-flex items-center gap-1.5 px-3 py-1.5 rounded-lg border text-sm hover:bg-gray-50 disabled:opacity-50">
-                    <Undo2 className="w-4 h-4" /> Withdraw request
-                  </button>
+              <div className="space-y-2" data-testid="update-request">
+                <div className="flex flex-wrap items-center gap-3">
+                  <p className="text-gray-600">
+                    You asked for version <strong>{status.updateRequest.version}</strong> on {fmt(status.updateRequest.requestedAt)} — your provider will install it.
+                  </p>
+                  {status.connected && (
+                    <button onClick={withdrawRequest} disabled={busy} className="inline-flex items-center gap-1.5 px-3 py-1.5 rounded-lg border text-sm hover:bg-gray-50 disabled:opacity-50">
+                      <Undo2 className="w-4 h-4" /> Withdraw request
+                    </button>
+                  )}
+                </div>
+                {status.updateRequest.outdated && (
+                  <div className="flex flex-wrap items-center gap-3 rounded-lg border border-brand-200 bg-brand-50 p-3">
+                    <p className="text-brand-800">Version <strong>{status.latestVersion}</strong> has come out since. Ask for it instead, and your provider installs that one.</p>
+                    {status.connected && (
+                      <button onClick={changeRequest} disabled={busy} className="inline-flex items-center gap-1.5 px-3 py-1.5 rounded-lg bg-brand-600 text-white text-sm font-medium hover:bg-brand-700 disabled:opacity-50">
+                        <ArrowUpCircle className="w-4 h-4" /> {busy ? "Working…" : `Ask for ${status.latestVersion} instead`}
+                      </button>
+                    )}
+                  </div>
                )}
              </div>
            ) : (
@@ -0,0 +1,198 @@
+"use client";
+
+import React, { useEffect, useMemo, useState } from "react";
+import { CheckSquare, X, Download } from "lucide-react";
+import { apiFetch, API_BASE } from "@/lib/api";
+import { errorMessage } from "@/lib/utils";
+import { downloadReportExcel } from "@/lib/export";
+import type { Event, Registration } from "@/types";
+
+type Action = "" | "message" | "markPaid" | "moveOption" | "allocate" | "cancel" | "export";
+type Result = { id: string; ok: boolean; skipped?: boolean; message: string };
+type BulkResponse = { action: string; done: number; skipped: number; failed: number; results: Result[] };
+type AllocationSet = { id: string; name: string; groups: { id: string; name: string }[] };
+
+const ACTIONS: [Action, string][] = [
+  ["message", "Send a message"],
+  ["markPaid", "Mark paid (record the balance)"],
+  ["moveOption", "Move to another ticket"],
+  ["allocate", "Put in a room or group"],
+  ["export", "Export to Excel"],
+  ["cancel", "Cancel"],
+];
+
+const owing = (r: Registration) => {
+  const due = Number(r.totalDueComputed ?? 0);
+  const paid = (r.payments || []).reduce((s, p) => s + (p.amount || 0), 0);
+  return Math.max(0, due - paid);
+};
+
+/**
+ * The bar above the registrations list while some are ticked (1.49.1): one action for all of
+ * them, run through the same rules as doing it one at a time, with a result per registration.
+ */
+export function RegistrationBulkBar({ selected, events, token, onClear, onDone }: {
+  selected: Registration[]; events: Event[]; token: string; onClear: () => void; onDone: () => void;
+}) {
+  const [action, setAction] = useState<Action>("");
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [result, setResult] = useState<BulkResponse | null>(null);
+  // Per-action inputs.
+  const [channel, setChannel] = useState<"email" | "whatsapp">("email");
+  const [subject, setSubject] = useState("");
+  const [text, setText] = useState("");
+  const [method, setMethod] = useState("cash");
+  const [fromOptionId, setFromOptionId] = useState("");
+  const [toOptionId, setToOptionId] = useState("");
+  const [sets, setSets] = useState<AllocationSet[]>([]);
+  const [groupKey, setGroupKey] = useState("");
+
+  const eventIds = useMemo(() => [...new Set(selected.map(r => r.eventId))], [selected]);
+  const oneEvent = eventIds.length === 1 ? events.find(e => e.id === eventIds[0]) || null : null;
+  const options = useMemo(() => (oneEvent?.eventOptions || []).filter(o => o.id !== oneEvent?.kidsOptionId && o.id !== oneEvent?.volunteerOptionId), [oneEvent]);
+  const totalOwing = useMemo(() => selected.filter(r => r.status !== "cancelled").reduce((s, r) => s + owing(r), 0), [selected]);
+
+  useEffect(() => {
+    if (action !== "allocate" || !oneEvent) { setSets([]); return; }
+    apiFetch<{ sets?: AllocationSet[] }>(`/api/allocations/event/${oneEvent.id}`, { authToken: token })
+      .then(b => setSets((b.sets || []).filter(s => s.groups.length)))
+      .catch(() => setSets([]));
+  }, [action, oneEvent, token]);
+
+  const needsOneEvent = (action === "moveOption" || action === "allocate") && !oneEvent;
+
+  const exportSelected = async () => {
+    await downloadReportExcel(API_BASE, token, {
+      title: "Registrations", subtitle: `${selected.length} selected · ${new Date().toLocaleString()}`, kind: "table", orientation: "landscape",
+      table: {
+        columns: ["Reference", "Name", "Email", "Phone", "Event", "Status", "Total", "Paid", "Owing", "Tickets"],
+        rows: selected.map(r => {
+          const paid = (r.payments || []).reduce((s, p) => s + (p.amount || 0), 0);
+          return [
+            String(r.id).slice(0, 8), r.user?.name || "", r.user?.email || "", r.user?.phoneNumber || "", r.event?.title || "", r.status,
+            `R ${Number(r.totalDueComputed ?? 0).toFixed(2)}`, `R ${paid.toFixed(2)}`, `R ${owing(r).toFixed(2)}`,
+            (r.registrationOptions || []).map(o => `${o.quantity} × ${o.eventOption?.name || ""}${o.variant?.name ? ` (${o.variant.name})` : ""}`).join(", "),
+          ];
+        }),
+      },
+    });
+  };
+
+  const run = async () => {
+    setError(null); setResult(null);
+    if (action === "export") {
+      setBusy(true);
+      try { await exportSelected(); } catch (e) { setError(errorMessage(e) || "Couldn't export"); } finally { setBusy(false); }
+      return;
+    }
+    const confirmText: Record<string, string> = {
+      cancel: `Cancel ${selected.length} registration(s)? Cancelling doesn't refund — record refunds on the Payments page. Coupon uses are released and the waitlist is offered the places.`,
+      markPaid: `Record ${method.toUpperCase()} payments for what ${selected.length} registration(s) still owe (about R ${totalOwing.toFixed(2)})? Paid registrations get their tickets by email.`,
+      moveOption: `Move ${selected.length} registration(s) to the other ticket? Tickets already issued move with them (same QR code). The price follows the new ticket, so anything now owing or overpaid shows on each registration.`,
+      message: `Send this ${channel === "email" ? "email" : "WhatsApp"} to the people on ${selected.length} registration(s)?`,
+      allocate: `Put the named people on ${selected.length} registration(s) in this group?`,
+    };
+    if (!confirm(confirmText[action])) return;
+    const [setId, groupId] = groupKey.split("::");
+    const params = action === "message" ? { channel, subject, text }
+      : action === "markPaid" ? { method }
+      : action === "moveOption" ? { fromOptionId, toOptionId }
+      : action === "allocate" ? { setId, groupId }
+      : {};
+    setBusy(true);
+    try {
+      const res = await apiFetch<BulkResponse>("/api/registrations/bulk", { method: "POST", authToken: token, body: { action, registrationIds: selected.map(r => r.id), ...params } });
+      setResult(res);
+      onDone();
+    } catch (e) {
+      setError(errorMessage(e) || "Couldn't do that");
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  const ready = !busy && !needsOneEvent && (
+    action === "export" || action === "cancel"
+    || (action === "markPaid" && !!method)
+    || (action === "message" && text.trim() && (channel === "whatsapp" || subject.trim()))
+    || (action === "moveOption" && fromOptionId && toOptionId && fromOptionId !== toOptionId)
+    || (action === "allocate" && !!groupKey)
+  );
+  const nameOf = (id: string) => selected.find(r => r.id === id)?.user?.name || id.slice(0, 8);
+
+  return (
+    <div className="border border-brand-200 bg-brand-50/60 rounded-xl p-3 mb-3 space-y-3" data-testid="bulk-bar">
+      <div className="flex flex-wrap items-center gap-2">
+        <CheckSquare className="w-4 h-4 text-brand-700" />
+        <span className="text-sm font-medium text-brand-900">{selected.length} selected</span>
+        <select aria-label="Bulk action" className="border rounded px-2 py-1.5 text-sm bg-white" value={action} onChange={e => { setAction(e.target.value as Action); setResult(null); setError(null); }}>
+          <option value="">Choose an action…</option>
+          {ACTIONS.map(([v, l]) => <option key={v} value={v}>{l}</option>)}
+        </select>
+        <button type="button" onClick={onClear} className="ml-auto inline-flex items-center gap-1 text-xs text-gray-600 hover:text-gray-900"><X className="w-3.5 h-3.5" /> Clear selection</button>
+      </div>
+
+      {needsOneEvent && <p className="text-xs text-amber-800">Tick registrations from one event only (filter by event) to {action === "moveOption" ? "move tickets" : "put people in a group"}.</p>}
+
+      {action === "message" && (
+        <div className="space-y-2">
+          <div className="flex gap-3 text-sm">
+            <label className="flex items-center gap-1"><input type="radio" checked={channel === "email"} onChange={() => setChannel("email")} /> Email</label>
+            <label className="flex items-center gap-1"><input type="radio" checked={channel === "whatsapp"} onChange={() => setChannel("whatsapp")} /> WhatsApp</label>
+          </div>
+          {channel === "email" && <input aria-label="Subject" className="w-full border rounded px-3 py-1.5 text-sm" placeholder="Subject" value={subject} onChange={e => setSubject(e.target.value)} />}
+          <textarea aria-label="Message" rows={4} className="w-full border rounded px-3 py-1.5 text-sm" placeholder="Hi {name}, …" value={text} onChange={e => setText(e.target.value)} />
+          <p className="text-[11px] text-gray-500">Sent as an event update to the person who registered. You can use {"{name}"}, {"{eventTitle}"} and {"{eventStart}"}.</p>
+        </div>
+      )}
+      {action === "markPaid" && (
+        <label className="text-sm flex items-center gap-2">Paid by
+          <select aria-label="Paid by" className="border rounded px-2 py-1.5 text-sm bg-white" value={method} onChange={e => setMethod(e.target.value)}>
+            <option value="cash">Cash</option><option value="eft">EFT</option><option value="card">Card (card machine)</option><option value="other">Other</option>
+          </select>
+          <span className="text-xs text-gray-500">Records what each still owes (about R {totalOwing.toFixed(2)} in all).</span>
+        </label>
+      )}
+      {action === "moveOption" && oneEvent && (
+        <div className="flex flex-wrap gap-2 items-center text-sm">
+          <select aria-label="Move from" className="border rounded px-2 py-1.5 bg-white" value={fromOptionId} onChange={e => setFromOptionId(e.target.value)}>
+            <option value="">From ticket…</option>{options.map(o => <option key={o.id} value={o.id}>{o.name}</option>)}
+          </select>
+          →
+          <select aria-label="Move to" className="border rounded px-2 py-1.5 bg-white" value={toOptionId} onChange={e => setToOptionId(e.target.value)}>
+            <option value="">To ticket…</option>{options.filter(o => o.id !== fromOptionId).map(o => <option key={o.id} value={o.id}>{o.name} (R{Number(o.price).toFixed(0)})</option>)}
+          </select>
+        </div>
+      )}
+      {action === "allocate" && oneEvent && (
+        sets.length === 0 ? <p className="text-xs text-gray-600">This event has no rooms or groups yet — set them up under Rooms &amp; groups.</p> : (
+          <select aria-label="Group" className="border rounded px-2 py-1.5 text-sm bg-white" value={groupKey} onChange={e => setGroupKey(e.target.value)}>
+            <option value="">Choose a group…</option>
+            {sets.map(s => <optgroup key={s.id} label={s.name}>{s.groups.map(g => <option key={g.id} value={`${s.id}::${g.id}`}>{g.name}</option>)}</optgroup>)}
+          </select>
+        )
+      )}
+      {action === "cancel" && <p className="text-xs text-gray-700">Cancelling doesn&apos;t refund anyone — record refunds on the Payments page.</p>}
+
+      {action && (
+        <button type="button" disabled={!ready} onClick={run} className={`inline-flex items-center gap-1.5 px-4 py-1.5 text-sm rounded font-medium disabled:opacity-50 ${action === "cancel" ? "bg-red-600 text-white hover:bg-red-700" : "bg-brand-600 text-white hover:bg-brand-700"}`}>
+          {action === "export" && <Download className="w-4 h-4" />}
+          {busy ? "Working…" : `${ACTIONS.find(a => a[0] === action)?.[1]} — ${selected.length}`}
+        </button>
+      )}
+
+      {error && <div className="p-2 border rounded bg-red-50 text-red-700 text-sm">{error}</div>}
+      {result && (
+        <div className="p-2 border rounded bg-white text-sm" role="status" data-testid="bulk-result">
+          <div><strong>{result.done}</strong> done{result.skipped ? `, ${result.skipped} skipped` : ""}{result.failed ? `, ${result.failed} not done` : ""}.</div>
+          {result.results.filter(r => !r.ok || r.skipped).length > 0 && (
+            <ul className="mt-1 text-xs text-gray-700 max-h-40 overflow-auto">
+              {result.results.filter(r => !r.ok || r.skipped).map(r => <li key={r.id}><span className={r.ok ? "text-gray-500" : "text-red-700"}>{nameOf(r.id)}</span>: {r.message}</li>)}
+            </ul>
+          )}
+        </div>
+      )}
+    </div>
+  );
+}
@@ -0,0 +1,249 @@
+"use client";
+
+import React, { useCallback, useEffect, useState } from "react";
+import { Webhook, Send, RefreshCw, KeyRound, Trash2, Pencil, Copy, ChevronDown, ChevronRight, RotateCcw } from "lucide-react";
+import { useAuth } from "@/hooks/useAuth";
+import { apiFetch } from "@/lib/api";
+import { errorMessage } from "@/lib/utils";
+
+type EventType = { type: string; label: string; description: string };
+type Endpoint = {
+  id: string; name: string; url: string; events: string[]; isActive: boolean;
+  lastSuccessAt: string | null; lastFailureAt: string | null; createdAt: string;
+  lastWeek?: Record<string, number>;
+};
+type Delivery = {
+  id: string; eventId: string; type: string; status: string; attempts: number; nextAttemptAt: string;
+  lastStatusCode: number | null; lastError: string | null; deliveredAt: string | null; createdAt: string; payload: unknown;
+};
+type ListResponse = { eventTypes: EventType[]; keepDays: number; endpoints: Endpoint[] };
+type Draft = { id?: string; name: string; url: string; events: string[] };
+
+const when = (d: string | null) => (d ? new Date(d).toLocaleString("en-GB", { day: "numeric", month: "short", hour: "2-digit", minute: "2-digit" }) : "—");
+const STATUS: Record<string, string> = {
+  succeeded: "bg-green-50 text-green-800", failed: "bg-red-50 text-red-700", retrying: "bg-amber-50 text-amber-800",
+  pending: "bg-gray-100 text-gray-600", sending: "bg-blue-50 text-blue-700",
+};
+
+/** Shown once after adding an endpoint or making a new secret. */
+function SecretBox({ secret, onClose }: { secret: string; onClose: () => void }) {
+  const [copied, setCopied] = useState(false);
+  return (
+    <div className="rounded-lg border border-amber-200 bg-amber-50 p-3 text-sm space-y-2" data-testid="webhook-secret">
+      <p className="font-medium text-amber-900">Signing secret — copy it now, it won&apos;t be shown again</p>
+      <div className="flex items-center gap-2">
+        <code className="flex-1 break-all rounded bg-white border px-2 py-1 text-xs">{secret}</code>
+        <button type="button" className="inline-flex items-center gap-1 px-2 py-1 rounded border bg-white text-xs hover:bg-gray-50"
+          onClick={() => { navigator.clipboard?.writeText(secret).then(() => setCopied(true)).catch(() => {}); }}>
+          <Copy className="w-3.5 h-3.5" /> {copied ? "Copied" : "Copy"}
+        </button>
+      </div>
+      <p className="text-xs text-amber-900">
+        Each request has an <code>X-CrossEvents-Signature: t=…,v1=…</code> header: v1 is the HMAC-SHA256 (hex) of <code>&lt;t&gt;.&lt;body&gt;</code> with this secret. Check it, and that t is recent, before trusting a request.
+      </p>
+      <button type="button" className="text-xs underline text-amber-900" onClick={onClose}>I&apos;ve saved it</button>
+    </div>
+  );
+}
+
+function Deliveries({ endpointId, token }: { endpointId: string; token: string }) {
+  const [rows, setRows] = useState<Delivery[] | null>(null);
+  const [open, setOpen] = useState<string | null>(null);
+  const [busy, setBusy] = useState<string | null>(null);
+  const load = useCallback(async () => {
+    setRows(await apiFetch<Delivery[]>(`/api/outbound-webhooks/${endpointId}/deliveries`, { authToken: token }).catch(() => []));
+  }, [endpointId, token]);
+  useEffect(() => { load(); }, [load]);
+  const resend = async (id: string) => {
+    setBusy(id);
+    await apiFetch(`/api/outbound-webhooks/deliveries/${id}/resend`, { method: "POST", authToken: token }).catch(() => {});
+    setBusy(null);
+    load();
+  };
+  if (!rows) return <p className="text-xs text-gray-400">Loading…</p>;
+  if (!rows.length) return <p className="text-xs text-gray-500">Nothing sent yet.</p>;
+  return (
+    <div className="space-y-1" data-testid="webhook-deliveries">
+      <div className="flex justify-end"><button type="button" onClick={load} className="inline-flex items-center gap-1 text-xs text-gray-600 hover:text-gray-900"><RefreshCw className="w-3 h-3" /> Refresh</button></div>
+      <ul className="divide-y border rounded-lg bg-white">
+        {rows.map(d => (
+          <li key={d.id} className="text-xs" data-testid="webhook-delivery">
+            <div className="flex flex-wrap items-center gap-2 px-3 py-2">
+              <button type="button" onClick={() => setOpen(open === d.id ? null : d.id)} className="text-gray-500" aria-label="Show what was sent">
+                {open === d.id ? <ChevronDown className="w-3.5 h-3.5" /> : <ChevronRight className="w-3.5 h-3.5" />}
+              </button>
+              <span className="text-gray-500 w-28">{when(d.createdAt)}</span>
+              <code className="font-medium">{d.type}</code>
+              <span className={`px-1.5 py-0.5 rounded ${STATUS[d.status] || "bg-gray-100"}`}>{d.status}</span>
+              <span className="text-gray-500">
+                {d.attempts} tr{d.attempts === 1 ? "y" : "ies"}{d.lastStatusCode ? ` · ${d.lastStatusCode}` : ""}{d.status === "retrying" ? ` · next ${when(d.nextAttemptAt)}` : ""}
+              </span>
+              {d.lastError && <span className="text-red-700 truncate max-w-[16rem]" title={d.lastError}>{d.lastError}</span>}
+              {d.status !== "sending" && (
+                <button type="button" disabled={busy === d.id} onClick={() => resend(d.id)} className="ml-auto inline-flex items-center gap-1 px-2 py-0.5 rounded border bg-white hover:bg-gray-50 disabled:opacity-50">
+                  <RotateCcw className="w-3 h-3" /> Resend
+                </button>
+              )}
+            </div>
+            {open === d.id && <pre className="mx-3 mb-2 max-h-64 overflow-auto rounded bg-gray-50 p-2 text-[11px]">{JSON.stringify(d.payload, null, 2)}</pre>}
+          </li>
+        ))}
+      </ul>
+    </div>
+  );
+}
+
+// Settings → Webhooks: send what happens here (registrations, payments, check-ins…) to other systems.
+export function WebhooksTab({ active }: { active: boolean }) {
+  const { token } = useAuth();
+  const [data, setData] = useState<ListResponse | null>(null);
+  const [draft, setDraft] = useState<Draft | null>(null);
+  const [secret, setSecret] = useState<{ endpointId: string; value: string } | null>(null);
+  const [openLog, setOpenLog] = useState<string | null>(null);
+  const [busy, setBusy] = useState(false);
+  const [msg, setMsg] = useState<{ type: "ok" | "err"; text: string } | null>(null);
+
+  const load = useCallback(async () => {
+    if (!token) return;
+    try { setData(await apiFetch<ListResponse>("/api/outbound-webhooks", { authToken: token })); } catch (e) { setMsg({ type: "err", text: errorMessage(e) || "Couldn't load webhooks" }); }
+  }, [token]);
+  useEffect(() => { if (active) load(); }, [active, load]);
+
+  const run = async (fn: () => Promise<void>) => {
+    setBusy(true); setMsg(null);
+    try { await fn(); } catch (e) { setMsg({ type: "err", text: errorMessage(e) || "Something went wrong" }); } finally { setBusy(false); }
+  };
+
+  const save = () => run(async () => {
+    if (!draft) return;
+    const body = { name: draft.name, url: draft.url, events: draft.events };
+    if (draft.id) {
+      await apiFetch(`/api/outbound-webhooks/${draft.id}`, { method: "PUT", authToken: token || undefined, body });
+      setMsg({ type: "ok", text: "Webhook saved." });
+    } else {
+      const made = await apiFetch<Endpoint & { secret: string }>("/api/outbound-webhooks", { method: "POST", authToken: token || undefined, body });
+      setSecret({ endpointId: made.id, value: made.secret });
+      setMsg({ type: "ok", text: `"${made.name}" added, and listed in the operator register (Admin → Privacy).` });
+    }
+    setDraft(null);
+    await load();
+  });
+
+  const toggle = (e: Endpoint) => run(async () => {
+    await apiFetch(`/api/outbound-webhooks/${e.id}`, { method: "PUT", authToken: token || undefined, body: { isActive: !e.isActive } });
+    await load();
+  });
+  const test = (e: Endpoint) => run(async () => {
+    const r = await apiFetch<{ status: string; statusCode: number | null; error: string | null }>(`/api/outbound-webhooks/${e.id}/test`, { method: "POST", authToken: token || undefined });
+    setMsg(r.status === "succeeded"
+      ? { type: "ok", text: `Test delivered (answered ${r.statusCode}).` }
+      : { type: "err", text: `Test not delivered: ${r.error || "no answer"}. It will be retried; see the delivery log.` });
+    if (openLog === e.id) setOpenLog(null);
+    await load();
+  });
+  const rotate = (e: Endpoint) => run(async () => {
+    if (!confirm(`Make a new secret for "${e.name}"? The old one stops working at once, so update the receiving side straight away.`)) return;
+    const r = await apiFetch<{ secret: string }>(`/api/outbound-webhooks/${e.id}/rotate-secret`, { method: "POST", authToken: token || undefined });
+    setSecret({ endpointId: e.id, value: r.secret });
+  });
+  const remove = (e: Endpoint) => run(async () => {
+    if (!confirm(`Delete "${e.name}" and its delivery log?`)) return;
+    await apiFetch(`/api/outbound-webhooks/${e.id}`, { method: "DELETE", authToken: token || undefined });
+    setMsg({ type: "ok", text: "Webhook deleted. Its operator register entry is marked inactive." });
+    await load();
+  });
+
+  const toggleEvent = (type: string) => setDraft(d => d && ({ ...d, events: d.events.includes(type) ? d.events.filter(t => t !== type) : [...d.events, type] }));
+
+  if (!data) return msg ? <p className="text-sm text-red-700">{msg.text}</p> : <p className="text-sm text-gray-400">Loading…</p>;
+  const label = (type: string) => data.eventTypes.find(t => t.type === type)?.label || type;
+
+  return (
+    <div className="space-y-5">
+      <div className="flex items-start justify-between gap-3 flex-wrap">
+        <div>
+          <h2 className="text-lg font-semibold text-gray-900 flex items-center gap-2"><Webhook className="w-5 h-5" /> Webhooks</h2>
+          <p className="text-sm text-gray-500 max-w-2xl">
+            Send what happens here — registrations, payments, check-ins, new accounts — to another system as it happens (e.g. ChurchSuite or Planning Center through Zapier or Make).
+          </p>
+        </div>
+        {!draft && <button type="button" onClick={() => { setMsg(null); setDraft({ name: "", url: "", events: [] }); }} className="px-4 py-2 text-sm rounded-lg bg-brand-600 text-white hover:bg-brand-700 font-medium">+ Add webhook</button>}
+      </div>
+
+      <p className="text-xs text-gray-600 bg-gray-50 border rounded-lg p-3">
+        Webhooks send personal information (names, email addresses, phone numbers) to the service you choose, so each one is added to your operator register. Make sure you have an agreement with that service. What was sent is kept {data.keepDays} days for the delivery log. Children&apos;s details from kids check-in are never sent.
+      </p>
+
+      {msg && <div className={`p-3 border rounded text-sm ${msg.type === "ok" ? "bg-green-50 text-green-800" : "bg-red-50 text-red-700"}`} role="status">{msg.text}</div>}
+      {secret && <SecretBox secret={secret.value} onClose={() => setSecret(null)} />}
+
+      {draft && (
+        <div className="border rounded-xl p-4 space-y-3 bg-white" data-testid="webhook-form">
+          <div className="grid sm:grid-cols-2 gap-3">
+            <div>
+              <label className="block text-xs text-gray-600 mb-1" htmlFor="webhook-name">Name</label>
+              <input id="webhook-name" className="w-full border rounded px-3 py-2 text-sm" value={draft.name} onChange={e => setDraft({ ...draft, name: e.target.value })} placeholder="e.g. ChurchSuite sync" />
+            </div>
+            <div>
+              <label className="block text-xs text-gray-600 mb-1" htmlFor="webhook-url">Address (https)</label>
+              <input id="webhook-url" className="w-full border rounded px-3 py-2 text-sm" value={draft.url} onChange={e => setDraft({ ...draft, url: e.target.value })} placeholder="https://…" />
+            </div>
+          </div>
+          <div>
+            <div className="text-xs text-gray-600 mb-1">Send when</div>
+            <div className="grid sm:grid-cols-2 gap-2">
+              {data.eventTypes.map(t => (
+                <label key={t.type} className="flex items-start gap-2 text-sm border rounded-lg p-2 cursor-pointer hover:bg-gray-50">
+                  <input type="checkbox" className="mt-1" checked={draft.events.includes(t.type)} onChange={() => toggleEvent(t.type)} />
+                  <span><span className="font-medium">{t.label}</span> <code className="text-[10px] text-gray-500">{t.type}</code><span className="block text-xs text-gray-500">{t.description}</span></span>
+                </label>
+              ))}
+            </div>
+          </div>
+          <div className="flex gap-2">
+            <button type="button" disabled={busy || !draft.name.trim() || !draft.url.trim() || !draft.events.length} onClick={save} className="px-4 py-1.5 text-sm rounded bg-brand-600 text-white hover:bg-brand-700 disabled:opacity-50 font-medium">
+              {busy ? "Saving…" : draft.id ? "Save webhook" : "Add webhook"}
+            </button>
+            <button type="button" onClick={() => setDraft(null)} className="px-3 py-1.5 text-sm rounded border bg-white hover:bg-gray-50">Cancel</button>
+          </div>
+        </div>
+      )}
+
+      {data.endpoints.length === 0 && !draft ? (
+        <p className="text-sm text-gray-500 border rounded-xl p-4">No webhooks yet.</p>
+      ) : (
+        <ul className="space-y-3">
+          {data.endpoints.map(e => (
+            <li key={e.id} className="border rounded-xl p-4 bg-white space-y-2" data-testid="webhook-endpoint">
+              <div className="flex flex-wrap items-start justify-between gap-3">
+                <div className="min-w-0">
+                  <div className="font-medium text-gray-900 flex items-center gap-2">
+                    {e.name}
+                    {!e.isActive && <span className="text-[10px] px-1.5 py-0.5 rounded bg-gray-100 text-gray-500">Off</span>}
+                  </div>
+                  <div className="text-xs text-gray-500 break-all">{e.url}</div>
+                  <div className="mt-1 flex flex-wrap gap-1">{e.events.map(t => <span key={t} className="text-[10px] px-1.5 py-0.5 rounded bg-brand-50 text-brand-700">{label(t)}</span>)}</div>
+                  <div className="mt-1 text-xs text-gray-500">
+                    Last delivered {when(e.lastSuccessAt)}{e.lastFailureAt && <> · last failure {when(e.lastFailureAt)}</>}
+                    {e.lastWeek && Object.keys(e.lastWeek).length > 0 && <> · this week: {Object.entries(e.lastWeek).map(([s, n]) => `${n} ${s}`).join(", ")}</>}
+                  </div>
+                </div>
+                <div className="flex flex-wrap gap-2">
+                  <button type="button" disabled={busy} onClick={() => test(e)} className="inline-flex items-center gap-1 text-xs px-2.5 py-1.5 rounded border bg-white hover:bg-gray-50 disabled:opacity-50"><Send className="w-3.5 h-3.5" /> Send test</button>
+                  <button type="button" onClick={() => { setMsg(null); setDraft({ id: e.id, name: e.name, url: e.url, events: e.events }); }} className="inline-flex items-center gap-1 text-xs px-2.5 py-1.5 rounded border bg-white hover:bg-gray-50"><Pencil className="w-3.5 h-3.5" /> Edit</button>
+                  <button type="button" disabled={busy} onClick={() => toggle(e)} className="text-xs px-2.5 py-1.5 rounded border bg-white hover:bg-gray-50 disabled:opacity-50">{e.isActive ? "Switch off" : "Switch on"}</button>
+                  <button type="button" disabled={busy} onClick={() => rotate(e)} className="inline-flex items-center gap-1 text-xs px-2.5 py-1.5 rounded border bg-white hover:bg-gray-50 disabled:opacity-50"><KeyRound className="w-3.5 h-3.5" /> New secret</button>
+                  <button type="button" disabled={busy} onClick={() => remove(e)} className="inline-flex items-center gap-1 text-xs px-2.5 py-1.5 rounded bg-red-50 text-red-700 border border-red-200 disabled:opacity-50"><Trash2 className="w-3.5 h-3.5" /> Delete</button>
+                </div>
+              </div>
+              <button type="button" onClick={() => setOpenLog(openLog === e.id ? null : e.id)} className="inline-flex items-center gap-1 text-xs text-brand-700 hover:underline">
+                {openLog === e.id ? <ChevronDown className="w-3.5 h-3.5" /> : <ChevronRight className="w-3.5 h-3.5" />} Delivery log
+              </button>
+              {openLog === e.id && token && <Deliveries endpointId={e.id} token={token} />}
+            </li>
+          ))}
+        </ul>
+      )}
+    </div>
+  );
+}
@@ -28,7 +28,7 @@ type ParentalRow = { id: string; at: string | null; child: string; event: string
 type LogResponse<T> = { rows: T[]; total: number; pageSize: number };

 const SOURCE: Record<string, string> = {
-  signup: "Sign-up", privacy_centre: "Privacy page", prompt: "Asked after login", unsubscribe_link: "Unsubscribe link",
+  signup: "Sign-up", activation: "Account activation", privacy_centre: "Privacy page", prompt: "Asked after login", unsubscribe_link: "Unsubscribe link",
  whatsapp_stop: "Replied STOP", existing_account: "Existing account (1.38.0)", admin: "Administrator",
 };

@@ -2,13 +2,15 @@

 import React, { useCallback, useEffect, useState } from "react";
 import Link from "next/link";
-import { ArrowUp, ArrowDown, Trash2, Plus, RotateCcw, Eye, PencilLine } from "lucide-react";
+import { ArrowUp, ArrowDown, Trash2, Plus, RotateCcw, Eye, PencilLine, Sparkles } from "lucide-react";
 import { apiFetch } from "@/lib/api";
 import { errorMessage } from "@/lib/utils";
 import { PrivacyNoticeSection, type NoticeSection } from "@/components/shared/PrivacyNoticeSection";

 type Version = { version: number; publishedAt: string; changeSummary: string | null; requiresAcceptance: boolean; publishedBy: string | null; acceptances: number };
-type Draft = { sections: NoticeSection[]; rendered: NoticeSection[]; isDraft: boolean; savedAt: string | null; versions: Version[]; builtIn: NoticeSection[] };
+// Changes to the built-in text since this site last reviewed them (only once it has published its own).
+type BuiltInUpdate = { revision: string; summary: string[]; sections: string[] };
+type Draft = { sections: NoticeSection[]; rendered: NoticeSection[]; isDraft: boolean; savedAt: string | null; versions: Version[]; builtIn: NoticeSection[]; builtInUpdates?: BuiltInUpdate[] };
 type Msg = { type: "ok" | "err"; text: string } | null;

 const PLACEHOLDER_HELP: [string, string][] = [
@@ -106,10 +108,45 @@ export function NoticeEditor({ token }: { token: string }) {
    }
  };

+  // The built-in text changed since this site last looked: hide the list once the admin has been through it.
+  const markReviewed = async () => {
+    setBusy(true);
+    try {
+      await apiFetch("/api/privacy/notice/builtin-reviewed", { method: "POST", authToken: token });
+      setDraft(d => (d ? { ...d, builtInUpdates: [] } : d));
+      setMsg({ type: "ok", text: "Done. Remember to save the draft and publish if you took any new text." });
+    } catch (e) {
+      setMsg({ type: "err", text: errorMessage(e) || "Could not save." });
+    } finally {
+      setBusy(false);
+    }
+  };
+
  if (!draft) return msg ? <p className="text-sm text-red-700">{msg.text}</p> : <p className="text-sm text-gray-400">Loading…</p>;

  const builtInById = new Map(draft.builtIn.map(s => [s.id, s]));
  const current = draft.versions[0];
+  const updates = draft.builtInUpdates || [];
+  const updatedIds = new Set(updates.flatMap(u => u.sections));
+  const differs = (s: NoticeSection) => { const b = builtInById.get(s.id); return !!b && (b.body !== s.body || b.title !== s.title); };
+  // Built-in sections this notice doesn't have (removed, or new in the built-in text).
+  const missing = draft.builtIn.filter(b => !sections.some(s => s.id === b.id));
+  const pendingIds = sections.filter(s => updatedIds.has(s.id) && differs(s)).map(s => s.id);
+  /** Puts a built-in section back where it sits in the built-in text. */
+  const addBuiltIn = (b: NoticeSection) => {
+    const order = draft.builtIn.map(x => x.id);
+    const after = order.slice(0, order.indexOf(b.id)).reverse().find(id => sections.some(s => s.id === id));
+    const at = after ? sections.findIndex(s => s.id === after) + 1 : 0;
+    change([...sections.slice(0, at), { ...b }, ...sections.slice(at)]);
+  };
+  const useAllNew = () => {
+    if (!confirm("Replace every changed section with the new built-in text? Your own wording in those sections is replaced (other sections stay as they are). Nothing is public until you publish.")) return;
+    const next = sections.map(s => {
+      const b = updatedIds.has(s.id) ? builtInById.get(s.id) : undefined;
+      return b ? { ...b } : s;
+    });
+    change(next);
+  };

  return (
    <div className="space-y-5">
@@ -148,6 +185,24 @@ export function NoticeEditor({ token }: { token: string }) {
        {dirty && <span className="self-center text-xs text-amber-700">Unsaved changes</span>}
      </div>

+      {updates.length > 0 && (
+        <div className="border border-amber-200 bg-amber-50 rounded-xl p-4 text-sm text-amber-900 space-y-2" data-testid="builtin-updates">
+          <div className="flex items-center gap-2 font-medium"><Sparkles className="w-4 h-4" /> The built-in privacy notice has been updated</div>
+          <p>Your published notice keeps your own text, so the new wording from Cross Events {updates.map(u => u.revision).join(", ")} isn&apos;t in it yet:</p>
+          <ul className="list-disc pl-5">{updates.flatMap(u => u.summary).map((line, i) => <li key={i}>{line}</li>)}</ul>
+          <p>
+            {pendingIds.length > 0
+              ? <>Sections with new text are marked below. Use the new text where you want it (it replaces your wording in that section), then save the draft and publish.</>
+              : <>Your draft already has the new text in every changed section. Save the draft and publish to make it live.</>}
+            {" "}Tick &quot;Significant change&quot; when publishing if people should accept it again.
+          </p>
+          <div className="flex flex-wrap gap-2">
+            {pendingIds.length > 0 && <button onClick={useAllNew} disabled={busy} className="px-3 py-1.5 rounded-lg bg-amber-600 text-white text-sm font-medium hover:bg-amber-700 disabled:opacity-50">Use all the new text</button>}
+            <button onClick={markReviewed} disabled={busy} className="px-3 py-1.5 rounded-lg border border-amber-300 bg-white text-sm hover:bg-amber-100 disabled:opacity-50">Done — hide this</button>
+          </div>
+        </div>
+      )}
+
      {msg && <div className={`p-3 rounded-lg text-sm ${msg.type === "ok" ? "bg-green-50 text-green-800 border border-green-200" : "bg-red-50 text-red-800 border border-red-200"}`}>{msg.text}</div>}

      {publishing && (
@@ -182,8 +237,9 @@ export function NoticeEditor({ token }: { token: string }) {
        <div className="space-y-3">
          {sections.map((s, i) => {
            const original = builtInById.get(s.id);
+            const hasNew = updatedIds.has(s.id) && differs(s);
            return (
-              <div key={`${s.id}-${i}`} className="border rounded-xl p-3 bg-white">
+              <div key={`${s.id}-${i}`} className={`border rounded-xl p-3 bg-white ${hasNew ? "border-amber-300" : ""}`} data-testid={hasNew ? "section-has-new-text" : undefined}>
                <div className="flex items-center gap-2 mb-2">
                  <input className={`${inputCls} font-medium`} value={s.title} onChange={e => update(i, { title: e.target.value })} aria-label="Section title" />
                  <button onClick={() => move(i, -1)} disabled={i === 0} className="p-1.5 rounded hover:bg-gray-100 disabled:opacity-30" aria-label="Move up"><ArrowUp className="w-4 h-4" /></button>
@@ -194,9 +250,27 @@ export function NoticeEditor({ token }: { token: string }) {
                  <button onClick={() => confirm(`Remove "${s.title}"?`) && change(sections.filter((_, j) => j !== i))} className="p-1.5 rounded hover:bg-red-50 text-red-600" aria-label="Remove section"><Trash2 className="w-4 h-4" /></button>
                </div>
                <textarea className={`${inputCls} font-mono text-xs`} rows={Math.min(18, Math.max(3, s.body.split("\n").length + 1))} value={s.body} onChange={e => update(i, { body: e.target.value })} aria-label={`${s.title} text`} />
+                {hasNew && original && (
+                  <details className="mt-2 text-xs">
+                    <summary className="cursor-pointer text-amber-800 font-medium">New built-in text for this section — show it</summary>
+                    <pre className="mt-2 whitespace-pre-wrap rounded-lg bg-amber-50 border border-amber-200 p-2 font-mono text-[11px] text-gray-700">{original.body}</pre>
+                    <button onClick={() => update(i, { title: original.title, body: original.body })} className="mt-2 px-3 py-1.5 rounded-lg bg-amber-600 text-white hover:bg-amber-700">Use the new text</button>
+                  </details>
+                )}
              </div>
            );
          })}
+          {missing.length > 0 && (
+            <div className="border border-dashed rounded-xl p-3 text-sm text-gray-600 space-y-1">
+              <div className="font-medium text-gray-800">Built-in sections not in your notice</div>
+              {missing.map(b => (
+                <div key={b.id} className="flex items-center justify-between gap-2">
+                  <span>{b.title}{updatedIds.has(b.id) && <span className="ml-1 text-xs text-amber-700">(new text)</span>}</span>
+                  <button onClick={() => addBuiltIn(b)} className="inline-flex items-center gap-1 px-2 py-1 rounded border bg-white text-xs hover:bg-gray-50"><Plus className="w-3.5 h-3.5" /> Add</button>
+                </div>
+              ))}
+            </div>
+          )}
          <button onClick={() => change([...sections, { id: `section-${sections.length + 1}`, title: "New section", body: "" }])} className="inline-flex items-center gap-1.5 px-3 py-1.5 rounded-lg border bg-white text-sm hover:bg-gray-50">
            <Plus className="w-4 h-4" /> Add section
          </button>
@@ -0,0 +1,122 @@
+"use client";
+
+import React, { useCallback, useEffect, useState } from "react";
+import Link from "next/link";
+import { CalendarClock, ArrowRight, Baby, HandHeart, UserCheck, Banknote, Inbox, CheckCircle2 } from "lucide-react";
+import { useAuth } from "@/hooks/useAuth";
+import { apiFetch } from "@/lib/api";
+import { useVisiblePolling } from "@/hooks/useVisiblePolling";
+import { CampusBadge } from "@/components/shared/CampusFilter";
+import type { Event } from "@/types";
+
+type TodayEvent = {
+  id: string; title: string; location: string | null; campus: Event["campus"]; isHidden: boolean; kidsCheckIn: boolean;
+  startsAt: string; endsAt: string; sessionLabel: string | null;
+  places: number; checkedIn: number; kidsIn: number | null;
+  volunteers: { needed: number; rostered: number; checkedIn: number } | null;
+};
+type Pending = { key: string; label: string; count: number; href: string; tone: string };
+type Today = { events: TodayEvent[]; money: { today: number; todayCount: number; week: number } | null; pending: Pending[] };
+
+const TONE: Record<string, string> = {
+  amber: "bg-amber-50 text-amber-800", rose: "bg-rose-50 text-rose-700", blue: "bg-blue-50 text-blue-700",
+  violet: "bg-violet-50 text-violet-700", green: "bg-green-50 text-green-700",
+};
+const time = (d: string) => new Date(d).toLocaleTimeString(undefined, { hour: "2-digit", minute: "2-digit" });
+const rand = (n: number) => `R ${n.toFixed(2)}`;
+
+/**
+ * The top of every staff dashboard (1.49.0): what's on today and how it's going, and — for
+ * supervisors and admins — money in and what's waiting for someone, each linking to where it's
+ * dealt with. Refreshes every 30 seconds while the tab is visible.
+ */
+export function TodayPanel({ supervisor }: { supervisor: boolean }) {
+  const { token } = useAuth();
+  const [data, setData] = useState<Today | null>(null);
+  const load = useCallback(async () => {
+    if (!token) return;
+    try { setData(await apiFetch<Today>("/api/dashboard/today", { authToken: token })); } catch { /* keep what's shown */ }
+  }, [token]);
+  useEffect(() => { load(); }, [load]);
+  useVisiblePolling(load, 30000, !!token);
+
+  if (!data) return null;
+  return (
+    <div className={`grid gap-6 mb-6 ${supervisor ? "lg:grid-cols-3" : ""}`} data-testid="today-panel">
+      <div className={`border rounded-xl p-4 bg-white shadow-sm min-w-0 ${supervisor ? "lg:col-span-2" : ""}`}>
+        <div className="flex items-center gap-2 mb-3">
+          <CalendarClock className="w-5 h-5 text-brand-600" />
+          <h2 className="text-lg font-semibold">Today</h2>
+          <span className="text-xs text-gray-500">{new Date().toLocaleDateString(undefined, { weekday: "long", day: "numeric", month: "long" })}</span>
+        </div>
+        {data.events.length === 0 ? (
+          <p className="text-sm text-gray-500">Nothing on today.</p>
+        ) : (
+          <ul className="divide-y" data-testid="today-events">
+            {data.events.map(e => {
+              const pct = e.places ? Math.min(100, Math.round((e.checkedIn / e.places) * 100)) : 0;
+              return (
+                <li key={e.id} className="py-3 first:pt-0 last:pb-0">
+                  <div className="flex flex-wrap items-start justify-between gap-2">
+                    <div className="min-w-0">
+                      <div className="font-medium text-gray-900 flex items-center gap-2 flex-wrap">
+                        {e.title}{e.sessionLabel && <span className="text-xs font-normal text-gray-500">· {e.sessionLabel}</span>}
+                        <CampusBadge campus={e.campus} />
+                      </div>
+                      <div className="text-xs text-gray-500">{time(e.startsAt)}–{time(e.endsAt)}{e.location ? ` · ${e.location}` : ""}</div>
+                    </div>
+                    <Link href={e.kidsCheckIn ? "/dashboard/staff/kids" : `/dashboard/staff/ticket-scanning`} className="inline-flex items-center gap-1 text-xs text-brand-700 hover:underline shrink-0">
+                      {e.kidsCheckIn ? "Kids desk" : "Scanner"} <ArrowRight className="w-3 h-3" />
+                    </Link>
+                  </div>
+                  <div className="mt-2 flex flex-wrap gap-x-4 gap-y-1 text-xs text-gray-600">
+                    {!e.kidsCheckIn && (
+                      <span className="inline-flex items-center gap-1.5">
+                        <UserCheck className="w-3.5 h-3.5" /> {e.checkedIn} of {e.places} checked in
+                        <span className="inline-block w-20 h-1.5 rounded bg-gray-100 overflow-hidden"><span className="block h-full bg-brand-500" style={{ width: `${pct}%` }} /></span>
+                      </span>
+                    )}
+                    {e.kidsIn !== null && <span className="inline-flex items-center gap-1"><Baby className="w-3.5 h-3.5" /> {e.kidsIn} children in now</span>}
+                    {e.volunteers && (
+                      <span className="inline-flex items-center gap-1"><HandHeart className="w-3.5 h-3.5" /> {e.volunteers.checkedIn} of {e.volunteers.rostered} volunteers here{e.volunteers.rostered < e.volunteers.needed ? ` (${e.volunteers.needed - e.volunteers.rostered} short)` : ""}</span>
+                    )}
+                  </div>
+                </li>
+              );
+            })}
+          </ul>
+        )}
+        {data.money && (
+          <div className="mt-4 pt-3 border-t flex flex-wrap gap-x-6 gap-y-1 text-sm">
+            <span className="inline-flex items-center gap-1.5"><Banknote className="w-4 h-4 text-green-600" /> Today <strong>{rand(data.money.today)}</strong> <span className="text-xs text-gray-500">({data.money.todayCount} payment{data.money.todayCount === 1 ? "" : "s"})</span></span>
+            <span>Last 7 days <strong>{rand(data.money.week)}</strong></span>
+          </div>
+        )}
+      </div>
+
+      {supervisor && (
+        <div className="border rounded-xl p-4 bg-white shadow-sm min-w-0">
+          <div className="flex items-center gap-2 mb-3">
+            <Inbox className="w-5 h-5 text-brand-600" />
+            <h2 className="text-lg font-semibold">Waiting for you</h2>
+          </div>
+          {data.pending.length === 0 ? (
+            <p className="text-sm text-gray-500 inline-flex items-center gap-1.5"><CheckCircle2 className="w-4 h-4 text-green-600" /> All caught up.</p>
+          ) : (
+            <ul className="space-y-2" data-testid="waiting">
+              {data.pending.map(p => (
+                <li key={p.key}>
+                  <Link href={p.href} className="flex items-center gap-3 rounded-lg px-2 py-1.5 hover:bg-gray-50">
+                    <span className={`min-w-[2rem] text-center text-sm font-semibold rounded-md px-1.5 py-0.5 ${TONE[p.tone] || "bg-gray-100 text-gray-700"}`}>{p.count}</span>
+                    <span className="text-sm text-gray-700 flex-1">{p.label}</span>
+                    <ArrowRight className="w-3.5 h-3.5 text-gray-400" />
+                  </Link>
+                </li>
+              ))}
+            </ul>
+          )}
+        </div>
+      )}
+    </div>
+  );
+}
@@ -0,0 +1,61 @@
+"use client";
+
+import { useEffect, useState } from "react";
+import { Bell, BellOff } from "lucide-react";
+import { useAuth } from "@/hooks/useAuth";
+import { apiFetch } from "@/lib/api";
+import { errorMessage } from "@/lib/utils";
+
+/** Follow / unfollow a series. Signed out, it links to the login page and back. */
+export function FollowSeriesButton({ slug }: { slug: string }) {
+  const { user, token, loading } = useAuth();
+  const [following, setFollowing] = useState<boolean | null>(null);
+  const [seriesId, setSeriesId] = useState<string | null>(null);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  // The page itself is cached for everyone, so whether this person follows (and the series as it
+  // is now) is asked separately.
+  useEffect(() => {
+    if (!token) return;
+    apiFetch<{ id: string; following: boolean }>(`/api/series/by-slug/${encodeURIComponent(slug)}`, { authToken: token })
+      .then(s => { setSeriesId(s.id); setFollowing(!!s.following); })
+      .catch(() => setFollowing(null));
+  }, [slug, token]);
+
+  if (loading) return null;
+  if (!user) {
+    return (
+      <a href={`/login?redirect=/series/${slug}`} className="inline-flex items-center gap-1.5 px-4 py-2 text-sm rounded-lg border bg-white hover:bg-gray-50">
+        <Bell className="w-4 h-4" /> Log in to follow
+      </a>
+    );
+  }
+
+  const toggle = async () => {
+    setBusy(true); setError(null);
+    try {
+      const res = await apiFetch<{ following: boolean }>(`/api/series/${seriesId}/follow`, { method: following ? "DELETE" : "POST", authToken: token || undefined });
+      setFollowing(res.following);
+    } catch (e) {
+      setError(errorMessage(e) || "Couldn't change that");
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  return (
+    <div>
+      <button type="button" onClick={toggle} disabled={busy || following === null || !seriesId}
+        className={`inline-flex items-center gap-1.5 px-4 py-2 text-sm rounded-lg font-medium disabled:opacity-50 ${following ? "border bg-white text-gray-700 hover:bg-gray-50" : "bg-brand-600 text-white hover:bg-brand-700"}`}>
+        {following ? <><BellOff className="w-4 h-4" /> Unfollow</> : <><Bell className="w-4 h-4" /> Follow this series</>}
+      </button>
+      <p className="text-xs text-gray-500 mt-1.5" role="status">
+        {following
+          ? "You'll get an email when a new event in this series is out (if you get news and announcements from us)."
+          : "Get an email when the next one is out."}
+      </p>
+      {error && <p className="text-xs text-red-600 mt-1">{error}</p>}
+    </div>
+  );
+}
@@ -0,0 +1,27 @@
+import Link from "next/link";
+import { ArrowRight, Layers } from "lucide-react";
+import { formatDateTimeRange } from "@/lib/date";
+import type { EventSeriesRef, NextInSeries } from "@/types";
+
+/** On an event page: the series it belongs to, and the next event in that series. */
+export function SeriesLinks({ series, next }: { series?: EventSeriesRef | null; next?: NextInSeries | null }) {
+  if (!series) return null;
+  return (
+    <div className="border rounded-xl p-4 bg-white shadow-sm space-y-2" data-testid="event-series">
+      <p className="text-sm text-gray-600 flex items-center gap-1.5">
+        <Layers className="w-4 h-4 shrink-0 text-brand-600" />
+        Part of <Link href={`/series/${series.slug}`} className="font-medium text-brand-700 hover:underline">{series.name}</Link>
+      </p>
+      {next && (
+        <Link href={`/events/${next.id}`} className="flex items-center justify-between gap-3 rounded-lg bg-brand-50 px-3 py-2 hover:bg-brand-100" data-testid="next-in-series">
+          <span className="min-w-0">
+            <span className="block text-[11px] uppercase tracking-wide text-brand-700">Next in this series</span>
+            <span className="block text-sm font-medium text-gray-900 truncate">{next.title}</span>
+            <span className="block text-xs text-gray-500">{formatDateTimeRange(next.startDate, next.endDate)}</span>
+          </span>
+          <ArrowRight className="w-4 h-4 shrink-0 text-brand-700" />
+        </Link>
+      )}
+    </div>
+  );
+}
@@ -18,6 +18,7 @@ import {
  HeartPulse,
  MessageSquareHeart,
  Filter,
+  Layers,
 } from "lucide-react";

 export type ReportCategory = "Financial" | "Registration" | "Ticketing" | "Donations" | "Cashup" | "Other";
@@ -42,6 +43,7 @@ export const REPORTS = [
  { key: "funnel", label: "Registration funnel", description: "Event page views → started → submitted → paid, with trend and sources", category: "Registration", icon: Filter, fields: 5 },
  { key: "feedbackSummary", label: "Feedback summary", description: "Post-event feedback: ratings, choices and comments; compare events", category: "Registration", icon: MessageSquareHeart, fields: 4 },
  { key: "medicalList", label: "Medical & emergency list", description: "Youth events: confidential list for leaders (audited)", category: "Registration", icon: HeartPulse, fields: 5 },
+  { key: "seriesComparison", label: "Series: year on year", description: "Registrations, income and attendance compared across the events in a series", category: "Other", icon: Layers, fields: 6 },
  { key: "discounts", label: "Discounts (codes & bundles)", description: "Uses and value given away per code, bundle deal and event", category: "Financial", icon: TicketPercent, fields: 4 },
 ] as const satisfies ReadonlyArray<{
  key: string;
@@ -5,7 +5,7 @@ import { useSearchParams } from "next/navigation";
 import { useAuth } from "@/hooks/useAuth";
 import { apiFetch, API_BASE } from "@/lib/api";
 import { downloadReportExcel, emailReportPdf, whatsappReportPdf, viewReportPdf, type ReportPdfPayload } from "@/lib/export";
-import { Printer, Mail, FileSpreadsheet, MessageCircle, ShoppingCart, CreditCard, Gift, Clock, HandHeart, Search, TrendingUp, TicketPercent, ShieldCheck, Star, MessageSquareHeart, Send, Eye, MousePointerClick, BadgeCheck } from "lucide-react";
+import { Printer, Mail, FileSpreadsheet, MessageCircle, ShoppingCart, CreditCard, Gift, Clock, HandHeart, Search, TrendingUp, TicketPercent, ShieldCheck, Star, MessageSquareHeart, Send, Eye, MousePointerClick, BadgeCheck, Users, Ticket as TicketIcon } from "lucide-react";
 import { REPORTS, type ReportKey } from "./ReportCatalog";
 import ReportsShell from "./ReportsShell";
 import ReportViewerModal, { ReportActionButton } from "./ReportViewerModal";
@@ -15,7 +15,8 @@ import { AreaTrendChart } from "@/components/charts/AreaTrendChart";
 import { errorMessage } from "@/lib/utils";
 import { registrationOptionUnitPrice } from "@/lib/pricing";
 import { CampusFilter, matchesCampus } from "@/components/shared/CampusFilter";
-import type { ConsentRow, Event, EventCashup, EventFinancials, MedicalRow, Payment, Registration, Ticket, UserSummary } from "@/types";
+import { SavedFilters } from "@/components/shared/SavedFilters";
+import type { ConsentRow, Event, EventCashup, EventFinancials, EventSeries, MedicalRow, Payment, Registration, SeriesComparison, Ticket, UserSummary } from "@/types";

 const METHOD_KEYS = ["cash", "card", "eft", "other"] as const;
 const METHOD_LABEL: Record<string, string> = { cash: "Cash", card: "Card", eft: "EFT", other: "Other" };
@@ -147,6 +148,9 @@ type FunnelReport = {
  perEvent?: { eventId: string; title: string; totals: FunnelCounts; conversion: FunnelConversion }[];
 };

+/** "+12%", "−5%", "no change" — a year-on-year change. */
+const changeLabel = (c: number) => (c > 0 ? `+${c}%` : c < 0 ? `−${Math.abs(c)}%` : "no change");
+
 // Simple MultiSelect control used in filters
 export default function ReportsV2({ backHref }: { backHref?: string } = {}) {
  const { token, user } = useAuth();
@@ -241,6 +245,18 @@ export default function ReportsV2({ backHref }: { backHref?: string } = {}) {
  const [feedbackRows, setFeedbackRows] = useState<FeedbackEventSummary[]>([]);
  // Registration funnel for the selected events (null until viewed).
  const [funnel, setFunnel] = useState<FunnelReport | null>(null);
+  // Series: year on year — picked by series, not by the events selection.
+  const [seriesList, setSeriesList] = useState<EventSeries[]>([]);
+  const [compareSeriesId, setCompareSeriesId] = useState<string>("");
+  const [comparison, setComparison] = useState<SeriesComparison | null>(null);
+  useEffect(() => {
+    if (!token) return;
+    apiFetch<EventSeries[]>("/api/series", { authToken: token }).then(l => {
+      const list = Array.isArray(l) ? l : [];
+      setSeriesList(list);
+      setCompareSeriesId(id => id || list[0]?.id || "");
+    }).catch(() => {});
+  }, [token]);

  // Deep-linking: dashboards link here with ?report=<key>&range=trailing_month to jump
  // straight into a specific report, pre-filtered to every currently-visible event and the
@@ -259,6 +275,8 @@ export default function ReportsV2({ backHref }: { backHref?: string } = {}) {
    deepLinkHandledRef.current = true;
    setReport(reportParam as ReportKey);
    setSelectedEventIds(filteredEvents.map((e) => e.id));
+    const seriesParam = searchParams.get("series");
+    if (seriesParam) setCompareSeriesId(seriesParam);
    if (searchParams.get("range") === "trailing_month") {
      const now = new Date();
      const start = new Date(now.getFullYear(), now.getMonth(), now.getDate() - 30);
@@ -527,6 +545,10 @@ export default function ReportsV2({ backHref }: { backHref?: string } = {}) {
        setFeedbackRows(await loadFeedback(selectedEventIds));
      } else if (report === "medicalList") {
        setMedicalRows(await loadConsent(selectedEventIds, "medical"));
+      } else if (report === "seriesComparison") {
+        setComparison(compareSeriesId && token
+          ? await apiFetch<SeriesComparison>(`/api/series/${encodeURIComponent(compareSeriesId)}/compare`, { authToken: token }).catch(() => null)
+          : null);
      }
      setReady(true);
    } finally {
@@ -959,6 +981,24 @@ export default function ReportsV2({ backHref }: { backHref?: string } = {}) {
  // mirror exactly what the on-screen report shows above its table, computed the same way.
  const buildReportPayload = (): ReportPdfPayload | null => {
    const subtitle = `Generated ${new Date().toLocaleString()}`;
+    if (report === "seriesComparison") {
+      if (!comparison) return null;
+      const withChange = (v: string, c: number | null | undefined) => (c == null ? v : `${v} (${changeLabel(c)})`);
+      return {
+        title: `${comparison.series.name}: year on year`, subtitle, kind: "table", orientation: "landscape",
+        note: "Each change is against the event before. Checked in on a multi-session event is the average per session. Income leaves out donations applied to orders (counted when they were given).",
+        ...(comparison.events.length > 1 ? { chart: { title: "Income, by event", data: comparison.events.map(e => ({ label: e.title, value: e.income, displayValue: `R ${e.income.toFixed(2)}` })) } } : {}),
+        table: {
+          columns: ["Event", "Date", "Registrations", "Tickets", "Income", "Checked in", "Attendance"],
+          rows: comparison.events.map(e => [
+            e.title, new Date(e.startDate).toLocaleDateString(),
+            withChange(String(e.registrations), e.change?.registrations), withChange(String(e.tickets), e.change?.tickets),
+            withChange(`R ${e.income.toFixed(2)}`, e.change?.income), withChange(String(e.checkedIn), e.change?.checkedIn),
+            e.attendanceRate != null ? `${e.attendanceRate}%` : "—",
+          ]),
+        },
+      };
+    }
    if (report === "payments") {
      return {
        title: 'Payments Report', subtitle, kind: 'table', orientation: 'portrait',
@@ -1372,6 +1412,7 @@ export default function ReportsV2({ backHref }: { backHref?: string } = {}) {
    discounts: "Discounts Report",
    consentStatus: "Parental Consent Status",
    medicalList: "Medical & Emergency List",
+    seriesComparison: "Series: year on year",
  };

  const doPrintPdf = async () => {
@@ -1412,7 +1453,18 @@ export default function ReportsV2({ backHref }: { backHref?: string } = {}) {
  // Report-specific filters shown inside the popup — whatever each report had beyond the
  // universal Events/Date range, which now live in the sidebar (ReportsShell) instead. `null`
  // when a report has none, so the modal chrome shows its own fallback note.
-  const reportSpecificFilters = report === "attendees" ? (
+  const reportSpecificFilters = report === "seriesComparison" ? (
+    <div className="flex flex-wrap items-center gap-3">
+      <label className="text-sm">
+        <span className="mr-2">Series</span>
+        <select className="border rounded px-2 py-1 text-sm" value={compareSeriesId} onChange={e => setCompareSeriesId(e.target.value)} aria-label="Series">
+          {seriesList.length === 0 && <option value="">No series yet</option>}
+          {seriesList.map(s => <option key={s.id} value={s.id}>{s.name}</option>)}
+        </select>
+      </label>
+      <span className="text-xs text-gray-500">Press refresh after changing the series. The events selection on the left doesn&apos;t apply.</span>
+    </div>
+  ) : report === "attendees" ? (
    <div className="flex flex-wrap items-center gap-3">
      <label className="text-sm">
        <span className="mr-2">Event</span>
@@ -1461,15 +1513,29 @@ export default function ReportsV2({ backHref }: { backHref?: string } = {}) {
      )}
      {error && <div className="p-3 mb-3 border rounded bg-red-50 text-red-700 text-sm">{error}</div>}

-      <CampusFilter
-        value={campus}
-        onChange={v => { setCampus(v); setSelectedEventIds([]); }}
-        withChurchWide
-        everyLabel="All campuses (church-wide total)"
-        className="mb-3"
-        id="reports-campus"
-        mine
-      />
+      <div className="flex flex-wrap items-start gap-3 mb-3">
+        <CampusFilter
+          value={campus}
+          onChange={v => { setCampus(v); setSelectedEventIds([]); }}
+          withChurchWide
+          everyLabel="All campuses (church-wide total)"
+          id="reports-campus"
+          mine
+        />
+        <SavedFilters
+          page="reports"
+          value={{ report, events: selectedEventIds, from: dateFrom, to: dateTo, campus, past: showPastEvents, inactive: showInactiveEvents, closed: showClosedEvents }}
+          onApply={p => {
+            if (typeof p.report === "string" && REPORTS.some(r => r.key === p.report)) setReport(p.report as ReportKey);
+            setCampus(String(p.campus || ""));
+            setShowPastEvents(p.past === true); setShowInactiveEvents(p.inactive === true); setShowClosedEvents(p.closed !== false);
+            setSelectedEventIds(Array.isArray(p.events) ? p.events : []);
+            setDateFrom(String(p.from || "")); setDateTo(String(p.to || ""));
+            setReady(false);
+          }}
+          skipDefault={!!searchParams.get("report")}
+        />
+      </div>

      <ReportsShell
        events={filteredEvents}
@@ -1869,6 +1935,60 @@ export default function ReportsV2({ backHref }: { backHref?: string } = {}) {
              })()}
            </div>
          )}
+          {report === "seriesComparison" && (
+            <div data-testid="series-comparison">
+              {!comparison ? (
+                <div className="text-sm text-gray-500">{seriesList.length === 0 ? "No series yet — make one on the Event series page and put events in it." : "Choose a series above."}</div>
+              ) : comparison.events.length === 0 ? (
+                <div className="text-sm text-gray-500">{comparison.series.name} has no events yet (or none at your campuses).</div>
+              ) : (() => {
+                const last = comparison.events[comparison.events.length - 1];
+                const change = (c: number | null | undefined) => c == null ? null : <span className={`ml-1 text-xs ${c > 0 ? "text-green-700" : c < 0 ? "text-rose-700" : "text-gray-500"}`}>{changeLabel(c)}</span>;
+                return (
+                  <>
+                    <StatTileRow>
+                      <StatTile icon={Users} label={`Registrations, ${last.title}`} value={`${last.registrations}${last.change?.registrations != null ? ` (${changeLabel(last.change.registrations)})` : ""}`} tone="violet" />
+                      <StatTile icon={TrendingUp} label="Income" value={`R ${last.income.toFixed(2)}${last.change?.income != null ? ` (${changeLabel(last.change.income)})` : ""}`} tone="green" />
+                      <StatTile icon={TicketIcon} label="Attendance" value={last.attendanceRate != null ? `${last.attendanceRate}%` : "—"} tone="blue" />
+                    </StatTileRow>
+                    {comparison.events.length > 1 && (
+                      <div className="mt-4 grid md:grid-cols-2 gap-4">
+                        <div className="border border-gray-100 rounded-xl p-4">
+                          <div className="text-xs text-gray-500 mb-3">Registrations, by event</div>
+                          <HorizontalBarChart data={comparison.events.map(e => ({ label: e.title, value: e.registrations }))} valueFormatter={v => String(v)} />
+                        </div>
+                        <div className="border border-gray-100 rounded-xl p-4">
+                          <div className="text-xs text-gray-500 mb-3">Income, by event</div>
+                          <HorizontalBarChart data={comparison.events.map(e => ({ label: e.title, value: e.income }))} valueFormatter={v => `R ${v.toFixed(2)}`} />
+                        </div>
+                      </div>
+                    )}
+                    <div className="mt-4 overflow-x-auto">
+                      <table className="w-full text-sm">
+                        <thead><tr className="text-left text-xs text-gray-500 border-b">
+                          <th className="py-2 pr-3">Event</th><th className="py-2 pr-3">Date</th><th className="py-2 pr-3">Registrations</th><th className="py-2 pr-3">Tickets</th><th className="py-2 pr-3">Income</th><th className="py-2 pr-3">Checked in</th><th className="py-2">Attendance</th>
+                        </tr></thead>
+                        <tbody>
+                          {comparison.events.map(e => (
+                            <tr key={e.eventId} className="border-b last:border-0" data-testid="comparison-row">
+                              <td className="py-2 pr-3 font-medium">{e.title}{e.campus && <span className="ml-1 text-[10px] text-gray-500">· {e.campus.name}</span>}</td>
+                              <td className="py-2 pr-3 text-gray-600">{new Date(e.startDate).toLocaleDateString()}</td>
+                              <td className="py-2 pr-3">{e.registrations}{change(e.change?.registrations)}</td>
+                              <td className="py-2 pr-3">{e.tickets}{change(e.change?.tickets)}</td>
+                              <td className="py-2 pr-3">R {e.income.toFixed(2)}{change(e.change?.income)}</td>
+                              <td className="py-2 pr-3">{e.checkedIn}{e.sessions > 0 && <span className="text-[10px] text-gray-500"> avg/session</span>}{change(e.change?.checkedIn)}</td>
+                              <td className="py-2">{e.attendanceRate != null ? `${e.attendanceRate}%` : "—"}</td>
+                            </tr>
+                          ))}
+                        </tbody>
+                      </table>
+                    </div>
+                    <p className="text-xs text-gray-500 mt-3">Each change is against the event before. Income leaves out donations applied to orders (they count when they were given).</p>
+                  </>
+                );
+              })()}
+            </div>
+          )}
          {report === "feedbackSummary" && (
            <div>
              {feedbackSummary.perEvent.length === 0 ? (
@@ -0,0 +1,141 @@
+"use client";
+
+import React, { useCallback, useEffect, useState } from "react";
+import { Ticket, CheckCircle2 } from "lucide-react";
+import { useSearchParams } from "next/navigation";
+import { useAuth } from "@/hooks/useAuth";
+import { apiFetch } from "@/lib/api";
+import { errorMessage } from "@/lib/utils";
+import { formatDateTimeRange } from "@/lib/date";
+import type { SeasonPassPurchase, SeasonPassView } from "@/types";
+
+const rand = (n: number) => `R ${n.toFixed(2)}`;
+type BuyResult = { purchaseId: string; total: number; paid: boolean; redirectUrl: string | null; message: string | null };
+
+/**
+ * The season passes on a series page: what each includes and costs, Buy (registers you for every
+ * event on it, then one payment), and your own passes for this series with "Pay now" when unpaid.
+ */
+export function SeasonPassOffers({ slug, passes: initial }: { slug: string; passes: SeasonPassView[] }) {
+  const { user, token, loading } = useAuth();
+  const params = useSearchParams();
+  const [qty, setQty] = useState<Record<string, number>>({});
+  const [busy, setBusy] = useState<string | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [notice, setNotice] = useState<string | null>(null);
+  const [mine, setMine] = useState<SeasonPassPurchase[]>([]);
+  // The page is cached for everyone; ask for the passes as they are now.
+  const [passes, setPasses] = useState<SeasonPassView[]>(initial);
+  useEffect(() => {
+    apiFetch<{ passes?: SeasonPassView[] }>(`/api/series/by-slug/${encodeURIComponent(slug)}`).then(s => setPasses(s.passes || [])).catch(() => {});
+  }, [slug]);
+
+  const loadMine = useCallback(async () => {
+    if (!token) return;
+    const list = await apiFetch<SeasonPassPurchase[]>("/api/season-passes/mine", { authToken: token }).catch(() => []);
+    setMine(list.filter(p => p.pass.series.slug === slug && p.status !== "cancelled"));
+  }, [token, slug]);
+  useEffect(() => { loadMine(); }, [loadMine]);
+
+  const returned = params.get("pass");
+
+  const go = (res: BuyResult | { redirectUrl: string | null; message: string | null }) => {
+    if (res.redirectUrl) { window.location.href = res.redirectUrl; return; }
+    setNotice(res.message || "Done.");
+    loadMine();
+  };
+
+  const buy = async (p: SeasonPassView) => {
+    setBusy(p.id); setError(null); setNotice(null);
+    try {
+      go(await apiFetch<BuyResult>(`/api/season-passes/${p.id}/buy`, { method: "POST", authToken: token || undefined, body: { quantity: qty[p.id] || 1 } }));
+    } catch (e) {
+      setError(errorMessage(e) || "Couldn't buy the pass");
+    } finally {
+      setBusy(null);
+    }
+  };
+
+  const pay = async (purchaseId: string) => {
+    setBusy(purchaseId); setError(null); setNotice(null);
+    try {
+      go(await apiFetch<{ redirectUrl: string | null; message: string | null }>(`/api/season-passes/purchases/${purchaseId}/checkout`, { method: "POST", authToken: token || undefined }));
+    } catch (e) {
+      setError(errorMessage(e) || "Couldn't start the payment");
+    } finally {
+      setBusy(null);
+    }
+  };
+
+  if (passes.length === 0 && mine.length === 0) return null;
+
+  return (
+    <section className="mb-10" data-testid="season-pass-offers">
+      <h2 className="text-xl font-semibold text-gray-900 mb-1 flex items-center gap-2"><Ticket className="w-5 h-5 text-brand-600" /> Season passes</h2>
+      <p className="text-sm text-gray-500 mb-4">One payment, a ticket for every event on the pass.</p>
+      {returned === "paid" && <div className="p-3 mb-3 border rounded bg-green-50 text-green-800 text-sm">Thank you! Your tickets are on their way by email once the payment comes through.</div>}
+      {(returned === "cancelled" || returned === "failed") && <div className="p-3 mb-3 border rounded bg-amber-50 text-amber-800 text-sm">The payment didn&apos;t go through. Your places are kept — use &quot;Pay now&quot; below to try again.</div>}
+      {notice && <div className="p-3 mb-3 border rounded bg-green-50 text-green-800 text-sm" role="status">{notice}</div>}
+      {error && <div className="p-3 mb-3 border rounded bg-red-50 text-red-700 text-sm">{error}</div>}
+
+      {mine.length > 0 && (
+        <div className="border rounded-xl bg-white p-4 mb-4" data-testid="my-passes">
+          <div className="text-sm font-medium text-gray-900 mb-2">Your passes</div>
+          <ul className="space-y-2">
+            {mine.map(m => (
+              <li key={m.id} className="flex flex-wrap items-center justify-between gap-2 text-sm">
+                <span>{m.quantity} × {m.pass.name} · {rand(m.total)} · {m.status === "paid" ? <span className="text-green-700 inline-flex items-center gap-1"><CheckCircle2 className="w-3.5 h-3.5" /> paid — tickets in My events</span> : <span className="text-amber-700">not paid yet</span>}</span>
+                {m.status === "pending" && (
+                  <button type="button" disabled={busy === m.id} onClick={() => pay(m.id)} className="px-3 py-1.5 text-xs rounded bg-brand-600 text-white hover:bg-brand-700 disabled:opacity-50">Pay now</button>
+                )}
+              </li>
+            ))}
+          </ul>
+        </div>
+      )}
+
+      <div className="grid gap-4 md:grid-cols-2">
+        {passes.map(p => (
+          <div key={p.id} className="border rounded-xl bg-white shadow-sm p-5" data-testid="season-pass-offer">
+            <div className="flex items-start justify-between gap-3">
+              <div>
+                <h3 className="font-semibold text-gray-900">{p.name}</h3>
+                {p.description && <p className="text-sm text-gray-600 mt-0.5">{p.description}</p>}
+              </div>
+              <div className="text-right shrink-0">
+                <div className="text-lg font-bold text-gray-900">{p.price === 0 ? "Free" : rand(p.price)}</div>
+                {p.saving > 0 && <div className="text-xs text-green-700">save {rand(p.saving)}</div>}
+              </div>
+            </div>
+            <ul className="mt-3 space-y-1 text-sm text-gray-700">
+              {p.items.map(i => (
+                <li key={i.id} className="flex justify-between gap-2">
+                  <span className="min-w-0"><span className="font-medium">{i.eventTitle}</span> <span className="text-gray-500 text-xs">· {formatDateTimeRange(i.startDate, i.endDate)} · {i.ticket}</span></span>
+                </li>
+              ))}
+            </ul>
+            <div className="mt-4">
+              {p.unavailable ? (
+                <p className="text-sm text-gray-500">{p.unavailable}</p>
+              ) : loading ? null : !user ? (
+                <a href={`/login?redirect=/series/${slug}`} className="inline-block px-4 py-2 text-sm rounded-lg border bg-white hover:bg-gray-50">Log in to buy</a>
+              ) : (
+                <div className="flex items-center gap-2">
+                  <label className="text-sm text-gray-600 flex items-center gap-1.5">
+                    How many
+                    <select aria-label={`How many of ${p.name}`} className="border rounded px-2 py-1 text-sm" value={qty[p.id] || 1} onChange={e => setQty({ ...qty, [p.id]: Number(e.target.value) })}>
+                      {Array.from({ length: 10 }, (_, k) => k + 1).map(n => <option key={n} value={n}>{n}</option>)}
+                    </select>
+                  </label>
+                  <button type="button" disabled={busy === p.id} onClick={() => buy(p)} className="px-4 py-2 text-sm rounded-lg bg-brand-600 text-white hover:bg-brand-700 font-medium disabled:opacity-50">
+                    {busy === p.id ? "Booking…" : p.price === 0 ? "Get the pass" : `Buy · ${rand(p.price * (qty[p.id] || 1))}`}
+                  </button>
+                </div>
+              )}
+            </div>
+          </div>
+        ))}
+      </div>
+    </section>
+  );
+}
@@ -0,0 +1,207 @@
+"use client";
+
+import React, { useCallback, useEffect, useMemo, useState } from "react";
+import { Ticket } from "lucide-react";
+import { useAuth } from "@/hooks/useAuth";
+import { apiFetch } from "@/lib/api";
+import { errorMessage } from "@/lib/utils";
+import type { Event, SeasonPassView } from "@/types";
+
+type ItemDraft = { eventId: string; on: boolean; eventOptionId: string; variantId: string };
+type Draft = { id?: string; name: string; description: string; price: string; saleEndsAt: string; isActive: boolean; items: ItemDraft[] };
+
+const rand = (n: number) => `R ${n.toFixed(2)}`;
+
+/** The staff-only kids and volunteer tickets aren't sold on a pass. */
+const sellable = (ev: Event) => (ev.eventOptions || []).filter(o => o.id !== ev.kidsOptionId && o.id !== ev.volunteerOptionId && !(ev.attendanceMode === "pick" && o.sessionMode === "pick"));
+
+/**
+ * A series' season passes on the Event series page: what's on each, sold so far, and a form to
+ * make or change one (events and price are fixed once someone has bought it).
+ */
+export function SeasonPassesPanel({ seriesId, seriesSlug }: { seriesId: string; seriesSlug: string }) {
+  const { token } = useAuth();
+  const [passes, setPasses] = useState<SeasonPassView[]>([]);
+  const [events, setEvents] = useState<Event[]>([]);
+  // The series' events have arrived (the pass form needs them before it can be saved).
+  const [loaded, setLoaded] = useState(false);
+  const [draft, setDraft] = useState<Draft | null>(null);
+  const [saving, setSaving] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const load = useCallback(async () => {
+    if (!token) return;
+    const [p, all] = await Promise.all([
+      apiFetch<SeasonPassView[]>(`/api/season-passes?seriesId=${encodeURIComponent(seriesId)}`, { authToken: token }).catch(() => []),
+      apiFetch<Event[]>("/api/events/all?includeInactive=true", { authToken: token }).catch(() => []),
+    ]);
+    setPasses(p);
+    // Upcoming events in this series that take registrations, not youth events.
+    setEvents((all || []).filter(e => e.seriesId === seriesId && e.requiresRegistration !== false && !e.requiresParentalConsent).sort((a, b) => a.startDate.localeCompare(b.startDate)));
+    setLoaded(true);
+  }, [token, seriesId]);
+  useEffect(() => { load(); }, [load]);
+
+  // A pass's own events; events without a row yet (a new pass, or still loading) take the default:
+  // ticked on a new pass, with the first ticket that can be sold.
+  const passItems = (p: SeasonPassView): ItemDraft[] => p.items.map(i => ({ eventId: i.eventId, on: true, eventOptionId: i.eventOptionId, variantId: i.variantId || "" }));
+  const itemFor = (d: Draft, ev: Event): ItemDraft => d.items.find(i => i.eventId === ev.id)
+    || { eventId: ev.id, on: !d.id, eventOptionId: sellable(ev)[0]?.id || "", variantId: "" };
+
+  const openNew = () => { setError(null); setDraft({ name: "", description: "", price: "", saleEndsAt: "", isActive: true, items: [] }); };
+  const openEdit = (p: SeasonPassView) => {
+    setError(null);
+    setDraft({ id: p.id, name: p.name, description: p.description || "", price: String(p.price), saleEndsAt: p.saleEndsAt ? p.saleEndsAt.slice(0, 16) : "", isActive: p.isActive, items: passItems(p) });
+  };
+  const editing = draft?.id ? passes.find(p => p.id === draft.id) : null;
+  const locked = !!editing && ((editing.sold || 0) + (editing.unpaid || 0)) > 0;
+
+  // What the chosen tickets cost separately, to show the saving while typing the price.
+  const normalValue = useMemo(() => (draft ? events.map(ev => itemFor(draft, ev)) : []).filter(i => i.on).reduce((s, i) => {
+    const ev = events.find(e => e.id === i.eventId);
+    const opt = ev?.eventOptions?.find(o => o.id === i.eventOptionId);
+    const v = opt?.variants?.find(x => x.id === i.variantId);
+    return s + Number(v?.price ?? opt?.price ?? 0);
+  }, 0), [draft, events]);
+
+  const save = async () => {
+    if (!draft) return;
+    setSaving(true); setError(null);
+    try {
+      const body = {
+        seriesId, name: draft.name, description: draft.description, isActive: draft.isActive,
+        saleEndsAt: draft.saleEndsAt ? new Date(draft.saleEndsAt).toISOString() : null,
+        ...(locked ? {} : {
+          price: Number(draft.price),
+          items: events.map(ev => itemFor(draft, ev)).filter(i => i.on).map(i => ({ eventId: i.eventId, eventOptionId: i.eventOptionId, variantId: i.variantId || null })),
+        }),
+      };
+      await apiFetch(draft.id ? `/api/season-passes/${draft.id}` : "/api/season-passes", { method: draft.id ? "PUT" : "POST", authToken: token || undefined, body });
+      setDraft(null);
+      await load();
+    } catch (e) {
+      setError(errorMessage(e) || "Couldn't save the pass");
+    } finally {
+      setSaving(false);
+    }
+  };
+
+  const remove = async (p: SeasonPassView) => {
+    if (!window.confirm(`Delete "${p.name}"?`)) return;
+    try {
+      await apiFetch(`/api/season-passes/${p.id}`, { method: "DELETE", authToken: token || undefined });
+      await load();
+    } catch (e) {
+      setError(errorMessage(e) || "Couldn't delete the pass");
+    }
+  };
+
+  const updItem = (ev: Event, patch: Partial<ItemDraft>) => setDraft(d => d && ({ ...d, items: [...d.items.filter(i => i.eventId !== ev.id), { ...itemFor(d, ev), ...patch }] }));
+
+  return (
+    <div className="mt-3 border-t pt-3" data-testid="season-passes">
+      <div className="flex items-center justify-between gap-2 mb-2">
+        <div className="text-xs font-medium text-gray-700 flex items-center gap-1"><Ticket className="w-3.5 h-3.5" /> Season passes</div>
+        {!draft && <button type="button" className="text-xs px-2.5 py-1 rounded border bg-white hover:bg-gray-50" onClick={openNew}>+ New pass</button>}
+      </div>
+      {error && <div className="p-2 mb-2 border rounded bg-red-50 text-red-700 text-xs">{error}</div>}
+
+      {passes.length === 0 && !draft && <p className="text-xs text-gray-500">No passes. A pass sells a ticket for several events in this series at one price.</p>}
+      <ul className="space-y-2">
+        {passes.map(p => (
+          <li key={p.id} className="border rounded-lg p-3 text-sm bg-gray-50/50" data-testid="season-pass">
+            <div className="flex items-start justify-between gap-2 flex-wrap">
+              <div>
+                <span className="font-medium">{p.name}</span> · {rand(p.price)}
+                {p.saving > 0 && <span className="text-xs text-green-700"> (saves {rand(p.saving)})</span>}
+                {!p.isActive && <span className="ml-1 text-[10px] px-1.5 py-0.5 rounded bg-gray-100 text-gray-500">Off</span>}
+                <div className="text-xs text-gray-500 mt-0.5">{p.sold || 0} sold{p.unpaid ? ` · ${p.unpaid} not paid yet` : ""}{p.unavailable && p.isActive ? ` · ${p.unavailable}` : ""}</div>
+              </div>
+              <div className="flex gap-2">
+                <a href={`/series/${seriesSlug}`} target="_blank" rel="noreferrer" className="text-xs px-2 py-1 rounded border bg-white hover:bg-gray-50">View</a>
+                <button type="button" className="text-xs px-2 py-1 rounded border bg-white hover:bg-gray-50" onClick={() => openEdit(p)}>Edit</button>
+                {!(p.sold || p.unpaid) && <button type="button" className="text-xs px-2 py-1 rounded bg-red-50 text-red-700 border border-red-200" onClick={() => remove(p)}>Delete</button>}
+              </div>
+            </div>
+            <ul className="mt-2 text-xs text-gray-600 space-y-0.5">
+              {p.items.map(i => (
+                <li key={i.id}>{i.eventTitle} ({new Date(i.startDate).toLocaleDateString()}) — {i.ticket}: normally {rand(i.normalPrice)}, share {rand(i.share)}</li>
+              ))}
+            </ul>
+          </li>
+        ))}
+      </ul>
+
+      {draft && (
+        <div className="border rounded-lg p-3 bg-white space-y-3 mt-2" data-testid="season-pass-form">
+          <div className="grid sm:grid-cols-3 gap-3">
+            <div className="sm:col-span-2">
+              <label className="block text-xs text-gray-600 mb-1" htmlFor="pass-name">Pass name</label>
+              <input id="pass-name" className="w-full border rounded px-2 py-1.5 text-sm" value={draft.name} onChange={e => setDraft({ ...draft, name: e.target.value })} placeholder="e.g. All 2027 breakfasts" />
+            </div>
+            <div>
+              <label className="block text-xs text-gray-600 mb-1" htmlFor="pass-price">Price (R)</label>
+              <input id="pass-price" type="number" min="0" step="1" disabled={locked} className="w-full border rounded px-2 py-1.5 text-sm disabled:bg-gray-50" value={draft.price} onChange={e => setDraft({ ...draft, price: e.target.value })} />
+            </div>
+          </div>
+          <div>
+            <label className="block text-xs text-gray-600 mb-1" htmlFor="pass-description">Description (optional)</label>
+            <input id="pass-description" className="w-full border rounded px-2 py-1.5 text-sm" value={draft.description} onChange={e => setDraft({ ...draft, description: e.target.value })} />
+          </div>
+          <div>
+            <div className="text-xs text-gray-600 mb-1">Events on the pass</div>
+            {locked && <p className="text-[11px] text-amber-700 mb-1">People have bought this pass, so its events and price can&apos;t change — switch it off and make a new one.</p>}
+            {!loaded ? <p className="text-xs text-gray-500">Loading events…</p> : events.length === 0 ? <p className="text-xs text-gray-500">This series has no events that take registrations yet.</p> : (
+              <ul className="space-y-1.5">
+                {events.map(ev => {
+                  const item = itemFor(draft, ev);
+                  const opts = sellable(ev);
+                  const variants = opts.find(o => o.id === item.eventOptionId)?.variants || [];
+                  return (
+                    <li key={ev.id} className="flex flex-wrap items-center gap-2 text-sm">
+                      <label className="flex items-center gap-1.5 min-w-0 flex-1">
+                        <input type="checkbox" disabled={locked} checked={item.on} onChange={e => updItem(ev, { on: e.target.checked })} />
+                        <span className="truncate">{ev.title}</span>
+                        <span className="text-xs text-gray-500">{new Date(ev.startDate).toLocaleDateString()}</span>
+                      </label>
+                      {item.on && (
+                        <>
+                          <select aria-label={`Ticket for ${ev.title}`} disabled={locked} className="border rounded px-2 py-1 text-xs" value={item.eventOptionId} onChange={e => updItem(ev, { eventOptionId: e.target.value, variantId: "" })}>
+                            {opts.map(o => <option key={o.id} value={o.id}>{o.name} (R{Number(o.price).toFixed(0)})</option>)}
+                          </select>
+                          {variants.length > 0 && (
+                            <select aria-label={`Variant for ${ev.title}`} disabled={locked} className="border rounded px-2 py-1 text-xs" value={item.variantId} onChange={e => updItem(ev, { variantId: e.target.value })}>
+                              <option value="">Any / none</option>
+                              {variants.map(v => <option key={v.id} value={v.id}>{v.name}</option>)}
+                            </select>
+                          )}
+                        </>
+                      )}
+                    </li>
+                  );
+                })}
+              </ul>
+            )}
+            {!locked && normalValue > 0 && (
+              <p className="text-[11px] text-gray-500 mt-1">Bought separately: {rand(normalValue)}{draft.price !== "" && Number(draft.price) < normalValue ? ` — the pass saves ${rand(normalValue - Number(draft.price))}` : ""}. The price is split over the events in proportion to these prices for each event&apos;s cashup.</p>
+            )}
+          </div>
+          <div className="grid sm:grid-cols-2 gap-3 items-end">
+            <div>
+              <label className="block text-xs text-gray-600 mb-1" htmlFor="pass-sale-ends">Stop selling at (optional)</label>
+              <input id="pass-sale-ends" type="datetime-local" className="w-full border rounded px-2 py-1.5 text-sm" value={draft.saleEndsAt} onChange={e => setDraft({ ...draft, saleEndsAt: e.target.value })} />
+              <p className="text-[10px] text-gray-400 mt-0.5">It always stops when the first event on it starts.</p>
+            </div>
+            <label className="flex items-center gap-2 text-sm"><input type="checkbox" checked={draft.isActive} onChange={e => setDraft({ ...draft, isActive: e.target.checked })} /> On sale</label>
+          </div>
+          <div className="flex gap-2">
+            <button type="button" onClick={save} disabled={saving || !loaded || !draft.name.trim() || (!locked && draft.price === "")} className="px-3 py-1.5 text-sm rounded bg-brand-600 text-white hover:bg-brand-700 disabled:opacity-50 font-medium">
+              {saving ? "Saving…" : draft.id ? "Save pass" : "Create pass"}
+            </button>
+            <button type="button" onClick={() => setDraft(null)} className="px-3 py-1.5 text-sm rounded border bg-white hover:bg-gray-50">Cancel</button>
+          </div>
+        </div>
+      )}
+    </div>
+  );
+}
@@ -0,0 +1,150 @@
+"use client";
+
+import React, { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { useRouter } from "next/navigation";
+import { Search, Calendar, User, Banknote, ClipboardList, CornerDownLeft, Zap, FileText, Settings, BarChart2 } from "lucide-react";
+import { useAuth } from "@/hooks/useAuth";
+import { apiFetch } from "@/lib/api";
+import { matchPages, type CommandPage } from "@/lib/commandPages";
+
+type Result = { type: "event" | "payment" | "person" | "registration"; id: string; title: string; subtitle: string; href: string };
+type Item = { key: string; group: string; title: string; subtitle?: string; href: string; icon: React.ElementType };
+
+const RESULT_GROUP: Record<Result["type"], [string, React.ElementType]> = {
+  event: ["Events", Calendar], payment: ["Payments", Banknote], person: ["People", User], registration: ["Registrations", ClipboardList],
+};
+const PAGE_ICON: Record<CommandPage["group"], React.ElementType> = { Actions: Zap, Pages: FileText, Settings, Reports: BarChart2 };
+
+/** Opens with Ctrl+K / ⌘K (or the event below) for staff, supervisors and admins. */
+export const OPEN_PALETTE_EVENT = "cross-events:open-palette";
+
+/**
+ * Ctrl+K command palette (1.49.0): jump to a page, setting or report, start an action ("New
+ * event"), or find an event, a payment by amount ("R450"), a person or a registration — what the
+ * person may see. ↑/↓ to move, Enter to open, Esc to close.
+ */
+export function CommandPalette() {
+  const { user, token } = useAuth();
+  const router = useRouter();
+  const role = user?.role || "user";
+  const allowed = role === "staff" || role === "supervisor" || role === "admin";
+  const [open, setOpen] = useState(false);
+  const [query, setQuery] = useState("");
+  const [results, setResults] = useState<Result[]>([]);
+  const [active, setActive] = useState(0);
+  const inputRef = useRef<HTMLInputElement>(null);
+  const listRef = useRef<HTMLUListElement>(null);
+
+  useEffect(() => {
+    if (!allowed) return;
+    const onKey = (e: KeyboardEvent) => {
+      if ((e.ctrlKey || e.metaKey) && e.key.toLowerCase() === "k") {
+        e.preventDefault();
+        setOpen(o => !o);
+      }
+    };
+    const onOpen = () => setOpen(true);
+    window.addEventListener("keydown", onKey);
+    window.addEventListener(OPEN_PALETTE_EVENT, onOpen);
+    return () => { window.removeEventListener("keydown", onKey); window.removeEventListener(OPEN_PALETTE_EVENT, onOpen); };
+  }, [allowed]);
+
+  useEffect(() => {
+    if (open) { setQuery(""); setResults([]); setActive(0); setTimeout(() => inputRef.current?.focus(), 0); }
+  }, [open]);
+
+  // Search as they type (after a short pause); pages are matched here, instantly.
+  useEffect(() => {
+    if (!open || !token) return;
+    const q = query.trim();
+    if (q.length < 2) { setResults([]); return; }
+    const timer = setTimeout(() => {
+      apiFetch<{ results: Result[] }>(`/api/dashboard/search?q=${encodeURIComponent(q)}`, { authToken: token })
+        .then(r => setResults(r.results || []))
+        .catch(() => setResults([]));
+    }, 200);
+    return () => clearTimeout(timer);
+  }, [query, open, token]);
+
+  const items = useMemo<Item[]>(() => {
+    const pages = matchPages(role, query).slice(0, query.trim() ? 8 : 10).map(p => ({ key: `page:${p.href}`, group: p.group, title: p.label, href: p.href, icon: PAGE_ICON[p.group] }));
+    const found = results.map(r => ({ key: `${r.type}:${r.id}`, group: RESULT_GROUP[r.type][0], title: r.title, subtitle: r.subtitle, href: r.href, icon: RESULT_GROUP[r.type][1] }));
+    return query.trim() ? [...found, ...pages] : pages;
+  }, [role, query, results]);
+
+  useEffect(() => { setActive(a => Math.min(a, Math.max(0, items.length - 1))); }, [items.length]);
+  useEffect(() => { listRef.current?.querySelector(`[data-index="${active}"]`)?.scrollIntoView({ block: "nearest" }); }, [active]);
+
+  const go = useCallback((item: Item | undefined) => {
+    if (!item) return;
+    setOpen(false);
+    router.push(item.href);
+  }, [router]);
+
+  if (!allowed || !open) return null;
+
+  const onKeyDown = (e: React.KeyboardEvent) => {
+    if (e.key === "Escape") { e.preventDefault(); setOpen(false); }
+    else if (e.key === "ArrowDown") { e.preventDefault(); setActive(a => Math.min(items.length - 1, a + 1)); }
+    else if (e.key === "ArrowUp") { e.preventDefault(); setActive(a => Math.max(0, a - 1)); }
+    else if (e.key === "Enter") { e.preventDefault(); go(items[active]); }
+  };
+
+  let lastGroup = "";
+  return (
+    <div className="fixed inset-0 z-[60] flex items-start justify-center bg-black/40 p-4 pt-[12vh]" onMouseDown={() => setOpen(false)}>
+      <div role="dialog" aria-modal="true" aria-label="Go to or search" className="w-full max-w-xl rounded-xl bg-white shadow-2xl overflow-hidden" onMouseDown={e => e.stopPropagation()}>
+        <div className="flex items-center gap-2 border-b px-3">
+          <Search className="w-4 h-4 text-gray-400 shrink-0" />
+          <input
+            ref={inputRef} value={query} onChange={e => { setQuery(e.target.value); setActive(0); }} onKeyDown={onKeyDown}
+            placeholder={role === "admin" ? "Go to a page, or find an event, person, payment (R450)…" : role === "supervisor" ? "Go to a page, or find an event or payment (R450)…" : "Go to a page or find an event…"}
+            className="flex-1 py-3 text-sm outline-none bg-transparent" aria-label="Search" role="combobox" aria-expanded="true" aria-controls="palette-results"
+            aria-activedescendant={items[active] ? `palette-item-${active}` : undefined}
+          />
+          <kbd className="text-[10px] text-gray-400 border rounded px-1.5 py-0.5">Esc</kbd>
+        </div>
+        <ul id="palette-results" ref={listRef} role="listbox" className="max-h-[55vh] overflow-y-auto py-1" data-testid="palette-results">
+          {items.length === 0 && <li className="px-4 py-6 text-sm text-gray-500 text-center">{query.trim().length < 2 ? "Type to search." : "Nothing found."}</li>}
+          {items.map((item, i) => {
+            const header = item.group !== lastGroup ? item.group : null;
+            lastGroup = item.group;
+            const Icon = item.icon;
+            return (
+              <React.Fragment key={item.key}>
+                {header && <li className="px-4 pt-2 pb-1 text-[11px] font-semibold uppercase tracking-wide text-gray-400" role="presentation">{header}</li>}
+                <li
+                  id={`palette-item-${i}`} data-index={i} role="option" aria-selected={i === active}
+                  className={`mx-1 flex items-center gap-3 rounded-lg px-3 py-2 cursor-pointer ${i === active ? "bg-brand-50" : "hover:bg-gray-50"}`}
+                  onMouseMove={() => setActive(i)} onClick={() => go(item)}
+                >
+                  <Icon className="w-4 h-4 text-gray-500 shrink-0" />
+                  <span className="min-w-0 flex-1">
+                    <span className="block text-sm text-gray-900 truncate">{item.title}</span>
+                    {item.subtitle && <span className="block text-xs text-gray-500 truncate">{item.subtitle}</span>}
+                  </span>
+                  {i === active && <CornerDownLeft className="w-3.5 h-3.5 text-gray-400" />}
+                </li>
+              </React.Fragment>
+            );
+          })}
+        </ul>
+        <div className="border-t px-4 py-2 text-[11px] text-gray-400 flex gap-4">
+          <span>↑↓ to move</span><span>Enter to open</span><span>Ctrl K to open or close</span>
+        </div>
+      </div>
+    </div>
+  );
+}
+
+/** A button that opens the palette (for people who don't use the keyboard shortcut). */
+export function CommandPaletteButton({ className = "" }: { className?: string }) {
+  const { user } = useAuth();
+  if (!user || !["staff", "supervisor", "admin"].includes(user.role || "")) return null;
+  return (
+    <button type="button" onClick={() => window.dispatchEvent(new Event(OPEN_PALETTE_EVENT))}
+      className={`inline-flex items-center gap-2 rounded-lg border bg-white px-3 py-1.5 text-sm text-gray-500 hover:bg-gray-50 ${className}`}>
+      <Search className="w-4 h-4" /> Search or jump to… <kbd className="ml-2 text-[10px] border rounded px-1.5 py-0.5">Ctrl K</kbd>
+    </button>
+  );
+}
@@ -52,17 +52,21 @@ export function LicenceBanner() {
      </div>
    );
  }
-  // Once an update has been requested there's nothing more for the admin to do. "Not now" hides it
-  // until the next version, except for urgent (security or serious bug) updates.
-  if (status.urgentUpdate && !status.updateRequest) {
+  // Once the latest version has been requested there's nothing more for the admin to do. A request
+  // for a version that has since been overtaken shows again, to change it. "Not now" hides it until
+  // the next version, except for urgent (security or serious bug) updates.
+  const request = status.updateRequest;
+  const awaiting = !!request && !request.outdated;
+  const ask = request?.outdated ? <>You asked for {request.version}; change your request in {link}</> : <>Please request the update in {link}</>;
+  if (status.urgentUpdate && !awaiting) {
    return (
      <div role="alert" className="bg-red-50 border-b border-red-200 text-red-800 text-sm px-4 py-2 flex items-center gap-2">
        <ShieldAlert className="w-4 h-4 shrink-0" />
-        <span>Cross Events {status.latestVersion} fixes a security problem or a serious bug (this site runs {status.version}). Please request the update in {link}</span>
+        <span>Cross Events {status.latestVersion} fixes a security problem or a serious bug (this site runs {status.version}). {ask}</span>
      </div>
    );
  }
-  if (status.updateAvailable && !status.updateRequest && !status.updateSnoozed) {
+  if (status.updateAvailable && !awaiting && !status.updateSnoozed) {
    const notNow = async () => {
      setBusy(true);
      try { setStatus(await apiFetch<HubStatus>("/api/hub/update-snooze", { method: "POST", authToken: token, body: { snooze: true } })); } catch { /* the Licence page shows why */ }
@@ -72,7 +76,7 @@ export function LicenceBanner() {
      <div role="status" className="bg-brand-50 border-b border-brand-100 text-brand-800 text-sm px-4 py-2 flex flex-wrap items-center gap-x-3 gap-y-1">
        <span className="flex items-center gap-2">
          <ArrowUpCircle className="w-4 h-4 shrink-0" />
-          <span>Cross Events {status.latestVersion} is available (this site runs {status.version}). See what&apos;s new and request it in {link}</span>
+          <span>Cross Events {status.latestVersion} is available (this site runs {status.version}). {request?.outdated ? <>You asked for {request.version}; see what&apos;s new and change your request in {link}</> : <>See what&apos;s new and request it in {link}</>}</span>
        </span>
        <button onClick={notNow} disabled={busy} className="ml-auto inline-flex items-center gap-1 rounded-md px-2 py-0.5 text-brand-700 hover:bg-brand-100 disabled:opacity-50" title="Hide this until the next version comes out">
          <BellOff className="w-3.5 h-3.5" /> Not now
@@ -9,11 +9,12 @@ import { errorMessage } from "@/lib/utils";
 import type { PublicNotice } from "@/components/shared/PrivacyNoticeSection";

 /**
- * POPIA: a privacy notice version marked as a significant change has been published, and
- * this person accepted an older one. Asked once after login; it can't be waved away, but the
- * notice and the Privacy page (to delete the account instead) stay reachable.
+ * POPIA: asked once after login when this person never accepted the privacy notice (an account
+ * made for them, or from before acceptances were recorded) — reason "first" — or a version marked
+ * as a significant change came out after the one they accepted ("updated"). It can't be waved
+ * away, but the notice and the Privacy page (to delete the account instead) stay reachable.
 */
-export function NoticePrompt({ onDone }: { onDone: () => void }) {
+export function NoticePrompt({ reason = "updated", onDone }: { reason?: "first" | "updated"; onDone: () => void }) {
  const { token } = useAuth();
  const [notice, setNotice] = useState<PublicNotice | null>(null);
  const [saving, setSaving] = useState(false);
@@ -40,7 +41,7 @@ export function NoticePrompt({ onDone }: { onDone: () => void }) {
  };

  // The newest version that needed accepting, for "what changed".
-  const changes = notice.versions.find(v => v.requiresAcceptance)?.changeSummary || notice.changeSummary;
+  const changes = reason === "updated" ? notice.versions.find(v => v.requiresAcceptance)?.changeSummary || notice.changeSummary : null;

  return (
    <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/40 p-4" role="dialog" aria-modal="true" aria-labelledby="notice-prompt-title">
@@ -49,7 +50,7 @@ export function NoticePrompt({ onDone }: { onDone: () => void }) {
          <div className="w-9 h-9 rounded-lg flex items-center justify-center bg-brand-50 text-brand-600 shrink-0">
            <ScrollText className="w-5 h-5" />
          </div>
-          <h2 id="notice-prompt-title" className="text-lg font-semibold text-gray-900">We&apos;ve updated our privacy notice</h2>
+          <h2 id="notice-prompt-title" className="text-lg font-semibold text-gray-900">{reason === "first" ? "Our privacy notice" : <>We&apos;ve updated our privacy notice</>}</h2>
        </div>
        {changes && (
          <div className="mb-3 p-3 rounded-lg bg-gray-50 border text-sm text-gray-700 whitespace-pre-line">
@@ -57,6 +58,7 @@ export function NoticePrompt({ onDone }: { onDone: () => void }) {
          </div>
        )}
        <p className="text-sm text-gray-600 mb-5">
+          {reason === "first" && <>It explains what we keep about you and why, and your rights. </>}
          Please read the <Link href="/legal/privacy" target="_blank" className="text-brand-600 hover:underline">privacy notice</Link> and
          accept it to carry on using your account. If you don&apos;t agree, you can{" "}
          <Link href="/dashboard/user/privacy" className="text-brand-600 hover:underline">delete your account</Link> instead.
@@ -42,7 +42,8 @@ export function PrivacyNoticeSection({ section, first = false }: { section: Noti
      ) : (
        <h3 className="text-xl font-semibold text-brand-600 mb-3">{section.title}</h3>
      )}
-      {section.id === "cookies" && (
+      {/* Above the cookie section: the built-in "cookies" one, or one an admin wrote about cookies. */}
+      {/cookie/i.test(section.id) && (
        <CookieSettingsButton className="mb-3 px-3 py-1.5 text-sm rounded-lg border border-brand-300 text-brand-700 hover:bg-brand-50">
          Change my cookie choice
        </CookieSettingsButton>
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
joshuaandClaude Opus 5.5	e40803cbbc	Saved filters on list pages (1.49.2) Manage registrations, Users, Events and Reports: save the current filters under a name, apply one with a click, star one as the default for the page (not applied over a deep link). Per person, stored on the server, removed when an account is anonymised. /api/saved-filters. Migration 20261028180000_saved_filters. Completes roadmap section 9. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-28 14:57:34 +02:00
joshua	fc393a90c1	Merge branch 'feat/bulk-actions'	2026-10-28 14:43:01 +02:00
joshuaandClaude Opus 5.5	c1211db8cf	Bulk actions on registrations (1.49.1) Manage registrations: tick registrations (or all shown) and message them (email/WhatsApp event update), mark them paid (the balance, by method), move them to another ticket (same tickets and QR codes, repriced, places checked), put their people in a room or group, export to Excel, or cancel. Each runs the same handlers as doing it one at a time, with a result per registration. POST /api/registrations/bulk, campus-checked per id. Migration 20261028170000_registrations_bulk. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-28 14:43:00 +02:00
joshua	fb42d6ac19	Merge branch 'feat/dashboard-palette'	2026-10-28 14:17:23 +02:00
joshuaandClaude Opus 5.5	2fc9e08f89	Dashboard Today and Waiting for you; Ctrl+K command palette (1.49.0) Staff, supervisor and admin dashboards start with what's on today (checked in vs places, children in now, volunteers here; money in today and this week for supervisors) and, for supervisors and admins, what's waiting for someone (unpaid registrations, consent, waitlists, cover requests, roster gaps; for admins cashups, reconciling, privacy requests, failed webhooks), each linking to where it's dealt with. Ctrl+K opens a palette of pages, settings, reports and actions for the role, with search: events, payments by amount, people and registrations (admins). All campus-scoped. Bulk actions and saved filters follow as 1.49.1 and 1.49.2. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-28 14:17:22 +02:00
joshua	78bcd7cc7c	Merge branch 'feat/demo-seeds'	2026-10-28 14:02:56 +02:00
joshuaandClaude Opus 5.5	37731a4696	Four demo seeds; fix set-demo wiping the admin (1.48.2) npm run demo:small \| demo:events \| demo:ministry \| demo:multicampus (demo:list describes them; set-demo -- --profile=<name> in backend/). New builders: courses with sessions, attendance and certificates, a pick-your-days conference, kids church with families, rooms and live check-ins, volunteer rosters, a series with followers and a season pass, and three campuses with campus-limited staff. set-demo had failed since 1.43.0: TRUNCATE CASCADE on Campus also emptied User (homeCampusId), deleting the admin it keeps. Tables that User points at are now emptied with DELETE. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-28 14:02:56 +02:00
joshua	4752516b15	Merge branch 'fix/privacy-notice-draft'	2026-10-28 13:15:57 +02:00
joshuaandClaude Opus 5.5	5dea712b72	Privacy notice: built-in text up to date, review flow, acceptance (1.48.1) The built-in notice now covers volunteer rosters, event series, season passes, webhooks, how people agree to it, and the provider-notices storage item. Sites with their own published version see what changed in the editor (sections marked, use new text per section or all, add missing sections, "Done - hide this"). Account activation asks for agreement to the terms and notice; anyone who never accepted is asked once after login. The cookie button shows above any cookie section. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-28 13:15:57 +02:00
joshua	f1714f9286	Merge branch 'feat/webhooks'	2026-10-28 13:00:59 +02:00
joshuaandClaude Opus 5.5	c0d01ce993	Outbound webhooks (1.48.0) Site settings -> Webhooks: admins add https endpoints and choose event types (registration created/paid/cancelled, payment received/refunded, ticket checked in, account created, event published). Events are noticed by a Prisma client extension so every write path is covered, re-checked before sending, and delivered as signed JSON (X-CrossEvents-Signature, HMAC-SHA256) with retries, a 30-day delivery log, Send test and Resend. Public https addresses only; each endpoint is added to the operator register; kids and volunteer tickets are never sent. New `webhooks` job. Migration 20261028160000_webhooks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-28 13:00:59 +02:00
joshua	0414854dec	Merge branch 'fix/update-request-newer'	2026-10-28 12:16:56 +02:00
joshuaandClaude Opus 5.5	dd537a1a16	Fix: update request for an older version than the latest (1.47.4) After asking for an update, a newer version coming out made the Licence page claim the newer version was requested, with no way to ask for it. Now it shows the version asked for, that a newer one is out, and "Ask for X instead"; the banner shows again. Hub 1.5.0 moves the open request on (`changed`); with an older Hub the site withdraws and asks again. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-28 12:16:56 +02:00
joshua	2240c8a703	Merge branch 'feat/season-pass'	2026-10-28 11:19:58 +02:00
joshuaandClaude Opus 5.5	a7c8148588	Season passes (1.47.3) A pass sells a ticket at each of several events in a series for one price. Supervisors set passes up on the Event series page (events and ticket per event; fixed once sold). Buying on the series page registers the buyer at every event at once with one checkout (free passes give tickets straight away; Pay now if online payment isn't possible). The price is split over the events in proportion to their normal prices: each registration line is priced at its share and the webhook records one Payment per event, so cashups stay per event. Pass registrations aren't repriced, take no coupons and can't be edited. Migration 20261028150000_season_pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-28 11:19:58 +02:00
joshua	96d1e67b85	Merge branch 'feat/series-reports'	2026-10-28 10:57:04 +02:00
joshuaandClaude Opus 5.5	e5d615e398	Series: year on year report (1.47.2) New report (Reports -> Other, or "Compare" on the Event series page): each event in a series side by side, oldest first - registrations, tickets, income (dashboard definition), people checked in (average per session on multi-session events) and attendance rate, with the change from the event before. Exports like the other reports; campus-scoped staff see only their campuses' events. GET /api/series/:id/compare. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-28 10:57:04 +02:00
joshua	0253a1d5fa	Merge branch 'feat/event-series'	2026-10-28 10:29:59 +02:00
joshuaandClaude Opus 5.5	740897635f	Event series (1.47.1) Group separate events (Camp 2025, Camp 2026) on a series page at /series/<slug> with upcoming and past events. Events join a series from the event editor (copies keep it); a series can span campuses. Event pages show "Part of ..." and "Next in this series". Signed-in people can follow a series; the new `series` job emails followers once when a new event in it goes live, as News & announcements (opted-in only, with unsubscribe). Follows are in the data export and removed on anonymising. Migration 20261028140000_event_series. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-28 10:29:59 +02:00
joshua	7ae0b6d23b	Merge branch 'feat/event-clone'	2026-10-28 10:01:18 +02:00