Merge branch 'feat/impersonate-user'

Bump to 1.23.0
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-19 18:25:10 +02:00 · 2026-10-19 18:25:08 +02:00 · 2026-10-19 18:25:02 +02:00 · 2026-10-19 18:14:29 +02:00 · 2026-10-19 18:14:24 +02:00 · 2026-10-19 18:14:18 +02:00
142 changed files with 10174 additions and 449 deletions
@@ -7,6 +7,177 @@ and this project follows [Semantic Versioning](https://semver.org/).

 ## [Unreleased]

+## [1.23.0] - 2026-10-19
+
+### Added
+
+- Impersonate user (Admin → Manage users → Impersonate): an admin can see the site exactly as a user does, to help with problems such as "my ticket isn't showing".
+  - A reason is required, and the session lasts at most 30 minutes.
+  - A bright "Viewing as [name]" banner with a countdown and "End impersonation" shows on every page.
+- Impersonation is strictly read-only.
+  - A server-side guard, mounted before every route, refuses any change (registrations, payments, refunds, cancellations, profile, consent, messages and everything else) made with an impersonation token.
+  - Viewing pages doesn't trigger the price refresh it normally does.
+  - Admins can't be impersonated, and the admin must have two-factor authentication on.
+- Impersonation is recorded in the audit log: start, end, reason, and every page and API call, including blocked attempts.
+  - The audit log page lists recent sessions with their full trail.
+- New setting: email users when an admin views their account (Site Settings → Legal → Support access; off by default).
+- New `/api/admin/impersonate` endpoints.
+  - Requires the `add_impersonation` database migration.
+
+## [1.22.0] - 2026-10-19
+
+### Added
+
+- Registration funnel stats (first-party, no third-party analytics), showing where people drop off between seeing an event and paying.
+  - A new cookie notice asks visitors once. Only those who choose "Allow" are counted, using a random anonymous visit id.
+  - We record the event page view and the start of registration. The submit and paid stages come from the registration itself.
+  - Only the stage, the traffic source and the device type are stored. No name, IP address or User-Agent is kept.
+- New report, **Registration funnel**: counts and conversion % per stage over a date range, a daily trend, and breakdowns by traffic source, device and ticket option.
+  - Selecting several events compares them.
+  - Sources come from `utm_source` links and from short links, which now add `?src=<alias>` when redirecting.
+- A "Conversion (past month)" tile on the supervisor and admin dashboards covers live events.
+- Raw visit records are rolled up into daily totals after 90 days by a daily job (`ANALYTICS_ROLLUP_ENABLED=false` to turn it off).
+- The privacy policy's cookies section now describes these statistics.
+- New `/api/analytics` endpoints.
+  - Requires the `add_funnel_analytics` database migration.
+
+## [1.21.0] - 2026-10-19
+
+### Added
+
+- Post-event feedback, set up in a new Feedback step in the event wizard.
+  - Questions use the form builder.
+  - You pick when it's sent (the default is the morning after the event) and who gets it: everyone who checked in, or everyone registered.
+  - Each person gets a personal link by email (and WhatsApp where they use it).
+  - Anyone who hasn't answered gets one reminder 3 days later.
+  - Answers can be anonymous or named.
+  - "Send now" is available, and the questions lock once people start answering.
+- New form field types: **Rating (1–5 stars)** and **Multiple choice**. They're used for feedback, and can also go on attendee forms (registration page, My Events, the kiosk, manual registration and Supervisor → Forms).
+- New report, **Feedback summary**:
+  - response rate;
+  - average rating per question, with star distribution;
+  - multiple-choice and yes/no breakdowns as bar charts;
+  - a list of text answers (with names unless the form is anonymous).
+  - Select several events to compare their ratings (e.g. Camp 2025 vs Camp 2026). Exports to PDF and Excel like other reports.
+- New `/api/feedback` endpoints and a job every 15 minutes (`FEEDBACK_JOB_ENABLED=false` to turn it off).
+  - Requires the `add_feedback_forms` database migration.
+
+## [1.20.0] - 2026-10-19
+
+### Added
+
+- Sponsor a spot: a new event setting, "Allow sponsorships" (event wizard → Sponsor a spot).
+  - It adds a "Sponsor a spot" button on the event page so people can fund a place for someone who can't afford it.
+  - Sponsors choose one or more whole spots (at the main ticket price) or a custom amount, and pay through Yoco. Guests just give a name and email.
+  - Sponsors can give anonymously, or add a name and a message for the organisers.
+  - An optional goal ("12 of 20 spots sponsored") and public progress bar.
+- Each sponsorship is recorded as a donation tagged to the event, in that event's sponsorship pool.
+  - Supervisors assign pool money to registrations with the existing donation assign/unassign flow, fully or partly.
+  - Under Payments → Donations, sponsorships are labelled, there's an "Only the sponsorship pool" filter, and the sponsor's message is shown.
+  - Who receives help is never shown to sponsors.
+- Sponsors get a "Thank you for sponsoring a spot" receipt.
+  - Automations has a new "Thank Your Sponsors" email for events with sponsorships.
+  - Email attendees can target an event's sponsors (`filter.audience: 'sponsors'`).
+- The Donations breakdown report has sponsorship pool columns per event: received, assigned and remaining.
+- New `/api/sponsorships` endpoints.
+  - Requires the `add_sponsorships` database migration.
+
+## [1.19.0] - 2026-10-19
+
+### Added
+
+- Rooms & groups (Supervisor → Rooms & groups), for camps and lockdowns: put attendees into rooms, cabins, small groups, teams or buses.
+  - Each event can have several allocation sets (e.g. "Rooms" and "Buses"). Each set has groups with an optional capacity, an optional gender restriction and an optional leader (a staff member).
+  - A drag-and-drop board puts people not yet placed on the left and groups, with capacity counters, on the right. Full groups and groups for the other gender won't accept a person.
+  - Auto-allocate fills groups evenly with everyone not yet placed, respecting capacity and gender. It can keep people on the same booking together or spread them out.
+  - Printable lists per group (with leader) and a master list. On youth events they can include medical and emergency details from consent forms; viewing those is recorded in the audit log.
+  - "Show on tickets" prints the group on each person's ticket and shows it in My Events.
+  - Email and WhatsApp attendees can be sent to one group ("Bus 2 leaves at 07:30"). Messages go to whoever booked for the people in it.
+  - Group leaders see their people under Staff → My groups. Medical details are shown to supervisors only.
+- New event setting "Ask each person's gender" (under Named attendees). It adds a gender choice for each named person on the registration page, at the door, on the kiosk, in manual registration and in My Events, and is needed for gender-split rooms.
+- New `/api/allocations` endpoints.
+  - Requires the `add_room_allocation` database migration.
+
+## [1.18.0] - 2026-10-19
+
+### Added
+
+- Ticket transfer. On My Events, "Transfer" hands a ticket to someone else before the event: enter their name and email or phone.
+  - The new holder gets the ticket by email/WhatsApp with a new QR code. If they're new, an inactive account is created and they get an activation link.
+  - The old QR code stops working, so screenshots of it won't scan. Scanning it says who the ticket was transferred to, and offline-mode sync flags it.
+  - For a ticket covering several people, one place is split off to the new holder.
+  - The payer stays responsible for the registration.
+- Transfer rules:
+  - Only before the event starts, and only for tickets that haven't been scanned.
+  - It can be turned off per event (new "Ticket transfer" setting in the event wizard, on by default). Supervisors can always transfer, from At the door → Tickets.
+  - On youth events, the new holder's date of birth, and a parent's details for a minor, are needed, and a new consent request is sent.
+  - The previous holder's attendee form answers and consent medical details are removed.
+  - Every transfer is recorded in the audit log.
+- New endpoints `POST /api/tickets/:id/transfer` and `GET /api/tickets/:id/transfers`.
+  - Requires the `add_ticket_transfer` database migration.
+
+## [1.17.0] - 2026-10-19
+
+### Added
+
+- Offline ticket scanning. While online, staff pick an event and section on the scanner and tap "Enable offline mode". The section (or the whole event) is locked to their device and its tickets are downloaded to the device.
+  - With no connection, scans are checked against that list and queued on the device.
+  - The panel shows when the list was downloaded and how many scans are waiting.
+  - Queued scans sync automatically when the device is back online (or with "Sync now"), and check-in messages go out then.
+  - "Release section" ends offline mode and deletes the list from the device.
+- Only one device can hold a section at a time (a whole-event lock clashes with every section). While a section is locked, other devices see who holds it and can't scan it, online or offline, so a ticket can never be redeemed twice by two offline devices.
+- Syncing is idempotent and never redeems more than is left on a ticket. Anything that needs a person to look goes into a sync report: tickets not found, cancelled registrations, used-up tickets, scans outside the locked section, and check-ins without consent.
+- Supervisor → Offline scanning page: active locks with force release (for a lost or flat phone; its scans still sync if it reconnects, and are flagged), and sync reports to review. Locks, releases, force-releases and syncs are recorded in the audit log.
+- The scanner is installable as an app (web app manifest), and a service worker caches the scanner page and its scripts so it opens with no connection.
+- The app now stays signed in with the last confirmed profile when it's reloaded without a connection, instead of sending the user to the login page.
+- New `/api/scan-locks` endpoints.
+  - Requires the `add_offline_scanning` database migration.
+
+### Changed
+
+- `POST /api/tickets/scan/:qrCode` now accepts `sectionId` and checks it on the server; this was previously only checked in the browser.
+  - It now refuses (423) scans in a section that another device has locked for offline scanning.
+
+## [1.16.0] - 2026-10-19
+
+### Added
+
+- Waitlist for sold-out tickets. A new event setting (event wizard → Visibility) turns it on, with how long offered places are held (24 hours by default) and whether someone can be offered fewer places than they asked for.
+  - Sold-out tickets show "Join waitlist" on the event page, the register page and the events list. Guests can join on events that allow guest registration.
+- When places free up, the next person is emailed/WhatsApped a claim link, and the places are held for them so nobody else can buy them. Places free up through a cancellation (by the person or staff), a smaller booking, or a raised stock limit.
+  - The claim link opens the register page with the places pre-selected, and works without logging in.
+  - Unclaimed offers expire (checked every 10 minutes) and move on to the next person.
+- People can leave a waitlist from My Events, which now lists their waitlists and any places held for them.
+- Supervisor → Waitlist page: the queue per event, with offer now (even over the stock limit), move up/down and remove.
+- The daily summary email shows each event's waitlist count.
+- New `/api/waitlist` endpoints. `POST /api/registrations` accepts `waitlistToken`.
+  - Requires the `add_waitlist` database migration.
+
+### Fixed
+
+- Manual registrations (Manual registration, At the door, the kiosk) and adding places to an existing booking never checked stock, so either could take an option over its stock limit. Both are now checked like a normal registration.
+- Stock is now counted in one place (`utils/stock.js`) for registration checks, `availableCount` and `isSoldOut`, including places held for waitlist offers.
+
+## [1.15.0] - 2026-10-19
+
+### Added
+
+- Parental consent for youth events. A new "Requires parental consent" event setting (event wizard → Visibility) has its own consent text and optional medical info, emergency contact and photo consent questions. It turns on named attendees automatically.
+  - Registering then needs a name and date of birth for every main-ticket place. Anyone under 18 on the event's start date needs a parent or guardian's name, email and phone.
+  - This applies on the registration page, manual registration, at the door, the kiosk, and when editing names in My Events.
+- The parent gets an email and a WhatsApp (always both) with a link to a new consent page (`/consent/<token>`). There they read the text, answer the optional questions, type their full name and confirm they're the parent or guardian, then give or decline.
+  - The system records the time, IP, device, signed name, and the exact consent text and version shown.
+  - Medical and emergency details are stored encrypted.
+  - The registrant and the event's notification recipients are told the outcome.
+- Tickets are still issued, but the scanner blocks check-in until consent is given, showing why. Supervisors can override, and the override is recorded in the audit log. On a youth event, a ticket with no named attendee counts as missing consent.
+- A daily 09:00 job reminds unanswered requests after 2 days, then every 3 days until the event. It also deletes medical and emergency details a set number of days after the event (Site Settings → Legal, default 30). `CONSENT_JOBS_ENABLED=false` turns it off.
+- Supervisor → Parental consent page: consent status per attendee, resend one or all pending requests, re-request consent after the consent text changes, and a printable, confidential medical & emergency list. Every view of the list is recorded in the audit log.
+- New reports: "Parental consent status" and "Medical & emergency list".
+- My Events shows each attendee's consent status, with a "Resend consent" button.
+- Anonymising or closing an account also clears that person's attendees' parent, date-of-birth, medical and emergency details.
+- New endpoints under `/api/consent`. `GET /api/tickets/scan-preview/:qrCode` now returns `consentStatus`, and `POST /api/tickets/scan/:qrCode` accepts `overrideConsent`.
+  - Requires the `add_parental_consent` database migration.
+
 ## [1.14.0] - 2026-10-19

 ### Added
@@ -134,6 +134,20 @@ Items & Pricing → Sections → Form → Visibility → Attachments**.
  added or changed later from My Events, and attendees can be sent a link to fill in
  their own form. Available on the registration page, manual registration, At the
  door and the kiosk.
+- **Waitlist** — on events with a waitlist, sold-out tickets show "Join waitlist"
+  (on the event page, the register page and the event list). When places free up — a
+  cancellation, a smaller booking or a higher stock limit — the next person is
+  emailed/WhatsApped a claim link and the places are held for them (24 hours by
+  default) so nobody else can buy them. Unclaimed offers expire and move on; people
+  who asked for more than came free can be offered what's free or skipped. Claiming
+  works without logging in. People can leave from My Events.
+- **Parental consent (youth events)** — on events that require it, every attendee
+  gives a date of birth; for anyone under 18, a parent or guardian gets an email and
+  a WhatsApp with a consent link. They read the event's consent text, optionally give
+  medical info, an emergency contact and photo consent, type their name to sign, and
+  give or decline. Tickets are issued but can't be checked in until consent is given
+  (supervisors can override, audited). Reminders go after 2 days, then every 3 days.
+  Medical details are encrypted and deleted a set number of days after the event.
 - **Coupon codes** — percentage, fixed-amount or free (comp) codes, entered under
  "Have a code?" on the registration page, in My Events (for unpaid registrations),
  manual registration, At the door and the kiosk. Codes can be limited to events,
@@ -157,6 +171,46 @@ Items & Pricing → Sections → Form → Visibility → Attachments**.
  Each payment records **who recorded it** as well as who it's for.
 - **Refunds** — negative payments against an original payment, netted against
  the original method.
+- **Impersonate user** (Admin → Manage users) — an admin with 2FA can view the site as a
+  user, to debug problems.
+  - It needs a reason, lasts at most 30 minutes, and shows a bright "Viewing as" banner
+    on every page.
+  - It is strictly read-only. A server-side guard refuses every write made with the
+    impersonation token before it reaches any route, and pages don't even refresh
+    prices while viewing.
+  - Admins can't be impersonated.
+  - The start, end, reason and every page and API call are in the audit log, with each
+    session's trail.
+  - Optional email to the user (`notify_user_on_impersonation`).
+- **Registration funnel stats** — first-party and consent-based, with no third-party analytics.
+  - A cookie notice asks once. Only visitors who allow it get a random visit id.
+  - We record event page views and registration starts. Submits and payments come
+    from the registration itself.
+  - Each record holds only the stage, the traffic source (utm_source, or the short-link
+    alias, which short links now pass as `?src=`) and the device type.
+  - The Registration funnel report shows counts and conversion per stage over a date
+    range, a daily trend, and breakdowns by source, device and ticket option.
+  - A "Conversion (past month)" tile on the supervisor/admin dashboards covers live
+    events.
+  - Raw rows are rolled up into daily totals after 90 days.
+- **Post-event feedback** — a Feedback step in the event wizard.
+  - Questions use the form builder, with new **star rating (1–5)** and **multiple
+    choice** types (also available on attendee forms).
+  - The form goes out at a chosen time to everyone who checked in, or to everyone
+    registered, each with a personal link (`/feedback/<token>`). One reminder goes
+    3 days later to anyone who hasn't answered.
+  - Answers can be anonymous or named. "Send now" is available, and the questions
+    lock once people have answered.
+- **Sponsor a spot** — per-event setting. A "Sponsor a spot" button on the event page
+  lets anyone, including guests, pay for one or more spots (at the main ticket price)
+  or any amount through Yoco. They can give anonymously or add a name and a message.
+  The money is a donation tagged to the event and goes into its sponsorship pool, which
+  supervisors assign to registrations with the usual donation flow.
+  - An optional public progress bar ("12 of 20 spots sponsored") with an optional goal.
+  - Sponsors get a thank-you receipt, and an Automations thank-you can go to all of an
+    event's sponsors.
+  - The Donations breakdown report shows each pool: received, assigned and remaining.
+  - Who is helped is never shown.
 - **Donations** — users can donate from their dashboard (`/dashboard/user/donate`).
  Supervisors can **assign** a donation (fully or partly) to someone's
  registration and **unassign** it later. Assignments are kept as separate
@@ -186,6 +240,13 @@ Items & Pricing → Sections → Form → Visibility → Attachments**.
 - **Check-in confirmation** — holders get an email/WhatsApp saying how many were
  checked in and how many remain.
 - **Scan stats** — recent scans and per-event scan counts.
+- **Offline scanning** — while online, a staff member locks an event section (or the
+  whole event) to their device and downloads its tickets. They can then keep scanning
+  with no connection; scans are queued on the device and sync automatically when it's
+  back online (never redeeming more than is left). Only one device can hold a section,
+  and while it's locked nobody else can scan it, online or offline. Problems found
+  while syncing go into a report for a supervisor. Supervisors can force-release a
+  lost device. The scanner can be added to the home screen (PWA) and opens offline.
 - **Printing** — A4 sheets (8 tickets per page) and A6 single tickets.
 - **Resend** — send tickets to a different email/phone at the door.

@@ -245,6 +306,15 @@ logout controls. Disconnected sessions are recovered automatically.
 - Registration detail: itemised bill (early-bird lines grouped), payments,
  **Invoice** and **Receipt** buttons, edit, cancel, **Make payment**.
 - Upcoming events and tickets side by side, with bulk ticket email/WhatsApp.
+- **Ticket transfer** — hand a ticket to someone else before the event (name plus
+  email/phone). They get a new ticket and QR code, and an inactive account with an
+  activation link if they're new. The old code stops working, and scanning it says it
+  was transferred, both online and in offline-mode sync reports. One place can be split
+  off a ticket covering several people. Billing stays with the payer. It's not allowed
+  once a ticket has been scanned, and it can be turned off per event (supervisors can
+  always transfer, from At the door → Tickets). On youth events the new holder needs
+  their own parental consent, and the previous holder's form answers are removed.
+  Every transfer is in the audit log.
 - **Payment history** (`/dashboard/user/payments`) — paginated, with filters by
  date, method and payment/refund.
 - **Donate** page.
@@ -285,6 +355,24 @@ logout controls. Disconnected sessions are recovered automatically.
  Reconcile (Yoco transactions), and Payment Link.
 - **Coupon codes** (`/dashboard/supervisor/coupons`) — create, edit and turn off
  discount codes, and see who used each one.
+- **Rooms & groups** (`/dashboard/supervisor/allocations`):
+  - Per event, allocation sets such as "Rooms", "Small groups" or "Buses". Each set
+    has groups with an optional capacity, gender restriction and leader (staff).
+  - A drag-and-drop board, plus auto-allocate: fill evenly, respecting capacity and
+    gender, keeping bookings together or splitting them.
+  - Printable per-group and master lists. On youth events they can include medical
+    details, and viewing those is audited.
+  - The group can show on tickets and in My Events.
+  - Email and WhatsApp attendees can be filtered to one group.
+  - Leaders see their people under Staff → **My groups**.
+  - Works on named attendees. Events can ask each person's gender.
+- **Offline scanning** (`/dashboard/supervisor/offline-scans`) — devices holding
+  offline locks (with force release) and sync reports to review.
+- **Waitlist** (`/dashboard/supervisor/waitlist`) — the queue per event: offer a
+  place now, move people up or down, or remove them.
+- **Parental consent** (`/dashboard/supervisor/consent`) — consent status per
+  attendee on youth events, resend (one or all pending), re-request after the
+  consent text changes, and a printable medical & emergency list (audited).
 - **Email attendees / WhatsApp attendees** — bulk and scheduled messaging.
 - **Forms** — view, filter, edit and print form responses.
 - **Reports** — see [Reports](#reports).
@@ -338,9 +426,9 @@ a viewer with its own filters, stat tiles and bar charts.
 | Category | Reports |
 |----------|---------|
 | Financial | Payments between dates · Revenue summary (by method) · Revenue detailed · Finance report (revenue & costs, after discounts) · Profit report · Discounts (coupon codes) |
-| Registration | Attendees per event (grouped by option) · Registration type counts · Master orders breakdown · Registration status breakdown (count by registration or ticket quantity) |
+| Registration | Registration funnel (views → started → submitted → paid, daily trend, by source / device / ticket option) · Attendees per event (grouped by option) · Registration type counts · Master orders breakdown · Registration status breakdown (count by registration or ticket quantity) · Parental consent status · Medical & emergency list · Feedback summary (response rate, average ratings, choice breakdowns, comments; compare events) |
 | Ticketing | Ticket usage summary |
-| Donations | Donations breakdown (used / unused per event) |
+| Donations | Donations breakdown (used / unused per event, plus the sponsorship pool) |
 | Cashup | Cashup reconciliation · Cashup audit trail |

 **Export:** Print, branded PDF download, styled Excel (`.xlsx`) workbook,
@@ -410,6 +498,10 @@ falling back to a general guide.
 |-----|----------|
 | Scheduled email/WhatsApp worker | Polls every 30 s (`SCHEDULED_EMAILS_INTERVAL_MS`) and purges sent jobs after 24 h |
 | Daily event summary email | 07:00 daily |
+| Waitlist: expire unclaimed offers, offer freed places | Every 10 minutes (`WAITLIST_JOB_ENABLED=false` to disable) |
+| Funnel analytics: roll raw visit rows older than 90 days into daily totals | Daily (`ANALYTICS_ROLLUP_ENABLED=false` to disable) |
+| Post-event feedback forms and their 3-day reminder | Every 15 minutes (`FEEDBACK_JOB_ENABLED=false` to disable) |
+| Parental consent reminders, and deleting medical details after events | 09:00 daily (`CONSENT_JOBS_ENABLED=false` to disable) |
 | Database backup (`pg_dump`, gzipped, 14-day retention) | 02:00 daily (`BACKUP_ENABLED=false` to disable) |
 | Temp file cleanup (files older than 7 days in `/temp`) | Daily |

@@ -442,9 +534,11 @@ falling back to a general guide.
 | `/contact`, `/legal/terms`, `/legal/privacy`, `/lockdown-rules` | Public | Info pages |
 | `/login`, `/register`, `/forgot-password`, `/reset-password`, `/activate-account` | Public | Accounts |
 | `/setup` | First run | Setup wizard |
+| `/consent/[token]` | Parent/guardian | Give or decline parental consent |
+| `/waitlist/claim/[token]` | Public | Claim a waitlist place |
 | `/self-service` | Supervisor-unlocked | Kiosk |
 | `/set-banner` | Supervisor | Site banner |
 | `/dashboard/user` (+ `/payments`, `/donate`, `/forms`, `/profile`, `/reset-password`) | User | My Events |
 | `/dashboard/staff` (+ `/ticket-scanning`, `/event-tickets`) | Staff | Staff tools |
-| `/dashboard/supervisor` (+ `/events`, `/event-options`, `/at-the-door`, `/manual`, `/manual-registration`, `/payments`, `/coupons`, `/email-attendees`, `/whatsapp-attendees`, `/forms`, `/reports`) | Supervisor | Supervisor tools |
+| `/dashboard/supervisor` (+ `/events`, `/event-options`, `/at-the-door`, `/manual`, `/manual-registration`, `/payments`, `/coupons`, `/waitlist`, `/consent`, `/offline-scans`, `/allocations`, `/email-attendees`, `/whatsapp-attendees`, `/forms`, `/reports`) | Supervisor | Supervisor tools |
 | `/dashboard/admin` (+ `/users`, `/registrations`, `/forms`, `/cashup`, `/cashup/[id]`, `/audit-log`, `/settings`) | Admin | Admin tools |
@@ -66,6 +66,8 @@ or Branding tab has been saved even once — the wizard always writes
 | `legal_io_email` | `"io@example.com"` | Rendered as a `mailto:` link, so the placeholder stays a syntactically valid address on the IANA-reserved `example.com` domain rather than a bracketed non-email string that would break the link. |
 | `legal_website_url` | `"example.com"` | Same reasoning — used to build an `https://` link. |
 | `legal_effective_date` | `"[not yet set]"` | Plain text only, no link — a bracketed placeholder is fine here. |
+| `notify_user_on_impersonation` | `"false"` | When `"true"`, a user is emailed (with the reason) whenever an admin views their account with Impersonate. Set under Site Settings → Legal → Support access. |
+| `consent_medical_retention_days` | `30` | Youth events: medical and emergency details from parental consent forms are deleted this many days after the event ends (daily 09:00 job). The consent record itself — who agreed, when, to which text — is kept. Set under Site Settings → Legal. |
 | `org_email` (as used on legal pages specifically) | `"privacy@example.com"` | Different fallback than `org_email`'s general default (blank) — also rendered as a `mailto:` link, so it needs to stay a valid-looking address. |

 ## WhatsApp
@@ -52,6 +52,11 @@ WAWP_INSTANCE_ID=your_wawp_instance_id
 DAILY_SUMMARY_ENABLED=true
 SCHEDULED_EMAILS_ENABLED=true
 SCHEDULED_EMAILS_INTERVAL_MS=30000
+# Daily 09:00 parental-consent job: reminders, and deleting medical details after events
+CONSENT_JOBS_ENABLED=true
+# Waitlist: expire unclaimed offers and offer freed places (every 10 minutes by default)
+WAITLIST_JOB_ENABLED=true
+# WAITLIST_JOB_INTERVAL_MS=600000
 # Nightly database backup at 02:00 (requires the `pg_dump` binary on this host).
 # Retention count is set via Admin → Site Settings → Backups (default 14).
 BACKUP_ENABLED=true
@@ -19,6 +19,15 @@ Tokens are issued by `POST /api/users/login`.
 - [Event Attachments](#event-attachments)
 - [Registrations](#registrations)
 - [Coupons](#coupons)
+- [Parental consent](#parental-consent)
+- [Waitlist](#waitlist)
+- [Offline scanning](#offline-scanning)
+- [Ticket transfer](#ticket-transfer)
+- [Rooms & groups](#rooms--groups)
+- [Sponsor a spot](#sponsor-a-spot)
+- [Post-event feedback](#post-event-feedback)
+- [Registration funnel](#registration-funnel)
+- [Impersonation](#impersonation)
 - [Payments](#payments)
 - [Tickets](#tickets)
 - [Broadcasts (Email)](#broadcasts-email)
@@ -276,6 +285,181 @@ For unauthenticated (guest) registration on events with `requiresAuth: false`:

 ---

+## Impersonation
+
+| Method | Path | Auth | Description |
+|--------|------|------|-------------|
+| POST | `/api/admin/impersonate/:userId` | admin (2FA on) | `{ reason }` → `{ token, session }`. The token acts as the user, is read-only, and lasts 30 minutes. Refused for admins and inactive users |
+| POST | `/api/admin/impersonate/end` | impersonation token | End the session |
+| POST | `/api/admin/impersonate/log` | impersonation token | `{ path }` — page viewed (audit trail) |
+| GET | `/api/admin/impersonate/current` | impersonation token | The live session |
+| GET | `/api/admin/impersonation-sessions` | admin | Sessions with their request trail |
+
+Read-only enforcement:
+- A guard mounted before every route returns `403 { code: "IMPERSONATION_READ_ONLY" }` for any non-GET/HEAD/OPTIONS request made with an impersonation token. The only exceptions are `end` and `log`. Blocked attempts are logged.
+- An ended or expired session gets `401 { code: "IMPERSONATION_ENDED" }`.
+- GET handlers skip side-effect writes (pricing refresh) while `req.readOnly` is set.
+
+## Registration funnel
+
+| Method | Path | Auth | Description |
+|--------|------|------|-------------|
+| POST | `/api/analytics/track` | public (rate-limited) | `{ sessionId, eventId, stage: 'view'\|'start', source? }` → always `204`. Bots are ignored; device type comes from the User-Agent |
+| GET | `/api/analytics/funnel?eventIds=&from=&to=` | supervisor+ | `{ totals, conversion, trend, bySource, byDevice, byOption, perEvent }` |
+
+How the stages are recorded:
+- `POST /api/registrations` accepts `analyticsSessionId`. It's stored on the registration and records the `submit` stage.
+- `paid` is read from that registration's status.
+- Counts are sessions that reached a stage or a later one.
+
+Data handling:
+- Sessions inactive for 90 days are rolled up into `AnalyticsDaily` by a daily job (`ANALYTICS_ROLLUP_ENABLED`).
+- `/api/stats/overview` now includes `funnel: { views, paid, conversion }` for live events over the past 30 days.
+
+## Post-event feedback
+
+| Method | Path | Auth | Description |
+|--------|------|------|-------------|
+| GET | `/api/feedback/event/:eventId` | supervisor+ | The event's feedback form (with `invited` / `responses` counts), or null |
+| PUT | `/api/feedback/event/:eventId` | supervisor+ | `{ sendAt, audience: 'checked_in'\|'all', anonymous, intro, fields[] }` — fields can't change once answered (409) |
+| DELETE | `/api/feedback/event/:eventId` | supervisor+ | Remove the form |
+| POST | `/api/feedback/event/:eventId/send-now` | supervisor+ | Send now (also invites anyone not yet invited) |
+| GET / POST | `/api/feedback/public/:token` | link holder | Load the form / submit `{ answers: { fieldId: value } }` once |
+| GET | `/api/feedback/summary?eventIds=a,b` | supervisor+ | Per event: invited, responses, response rate, and per question: rating average + distribution, choice counts, text answers (names only when not anonymous) |
+
+Notes:
+- New field types `rating` (answers `"1"`–`"5"`) and `multiple_choice` (`options`: array of strings). They can be used on attendee forms too.
+- Only HMACs of link tokens are stored, and a reminder issues a new link.
+- A job every 15 minutes (`FEEDBACK_JOB_ENABLED`, `FEEDBACK_JOB_INTERVAL_MS`) sends due forms, and sends one reminder 3 days later to people who haven't answered.
+
+## Sponsor a spot
+
+| Method | Path | Auth | Description |
+|--------|------|------|-------------|
+| GET | `/api/sponsorships/event/:eventId` | public | `{ enabled, open, spotPrice, showProgress, goalSpots, spotsFunded, sponsors }` — never recipients |
+| POST | `/api/sponsorships/checkout` | public (optional login) | `{ eventId, spots? \| amount?, anonymous?, sponsorName?, message?, name?, email? }` → Yoco `redirectUrl`. Guests give a name and email |
+| GET | `/api/sponsorships/event/:eventId/pool` | supervisor+ | `{ received, assigned, remaining, sponsors, spotsFunded, spotPrice, goalSpots }` |
+
+How the money is handled:
+- A spot costs the cheapest paid main ticket.
+- Yoco checkout metadata carries `type: 'sponsorship'`. The webhook records the payment as `isDonation` + `isSponsorship` against the event, together with `sponsorName`, `sponsorMessage` and `sponsorAnonymous`.
+- Pool funds are assigned with `PUT /api/payments/assign-donation`.
+
+Other changes:
+- Event fields: `allowSponsorships`, `sponsorshipGoalSpots`, `showSponsorshipProgress`.
+- `POST /api/events/:id/email-attendees` accepts `filter.audience: 'sponsors'`.
+- `POST /api/automations/schedule` jobs accept `audience: 'sponsors'`.
+
+## Rooms & groups
+
+| Method | Path | Auth | Description |
+|--------|------|------|-------------|
+| GET | `/api/allocations/event/:eventId` | supervisor+ | Board: sets (groups, assignments), named attendees, possible leaders, unnamed places |
+| POST | `/api/allocations/sets` | supervisor+ | `{ eventId, name, showOnTicket? }` |
+| PUT / DELETE | `/api/allocations/sets/:id` | supervisor+ | Rename / show on tickets; delete |
+| POST | `/api/allocations/sets/:id/groups` | supervisor+ | `{ name, capacity?, gender? ('male'\|'female'), leaderUserId? }` |
+| PUT / DELETE | `/api/allocations/groups/:id` | supervisor+ | Edit (can't drop below current members or break gender); delete (members become unassigned) |
+| PUT | `/api/allocations/sets/:id/assignments` | supervisor+ | `{ attendeeId, groupId }` (null unassigns); enforces capacity and gender |
+| DELETE | `/api/allocations/sets/:id/assignments` | supervisor+ | Clear the set |
+| POST | `/api/allocations/sets/:id/auto` | supervisor+ | `{ mode: 'together' \| 'split' }` — places everyone not yet placed |
+| GET | `/api/allocations/sets/:id/lists?medical=true` | supervisor+ | Groups with members for printing (medical view is audited) |
+| GET | `/api/allocations/my-groups` | staff+ | Groups the caller leads (medical details for supervisors only) |
+
+Related changes:
+- `Event.collectGender` makes a gender (`male` / `female`) required for each named attendee.
+- Email and WhatsApp attendees accept `filter.allocationGroupId`.
+
+## Ticket transfer
+
+| Method | Path | Auth | Description |
+|--------|------|------|-------------|
+| POST | `/api/tickets/:id/transfer` | payer, holder or supervisor+ | `{ name, email?, phone?, dateOfBirth?, parentName?, parentEmail?, parentPhone? }` (date of birth, plus parent details for a minor, on youth events) |
+| GET | `/api/tickets/:id/transfers` | payer, holder or staff+ | Transfer history |
+
+Rules:
+- Only before the event starts, and only for tickets that have never been scanned.
+- `Event.allowTicketTransfer` turns it off for non-supervisors.
+
+What a transfer does:
+- The new holder becomes the ticket's attendee and gets a new QR code. A shared ticket for several places has one place split off into its own ticket.
+- An account is matched by email/phone, or created inactive with an activation link.
+- The previous holder's attendee form answers are deleted, and the medical details on their consent are cleared. A minor on a youth event gets a new consent request.
+
+Old QR codes:
+- `scan-preview` and `scan` return `410 { code: "TICKET_TRANSFERRED" }`.
+- Offline sync reports them as `transferred`.
+- Each transfer is audited as `ticket_transferred`.
+
+## Offline scanning
+
+| Method | Path | Auth | Description |
+|--------|------|------|-------------|
+| GET | `/api/scan-locks?eventId=` | staff+ | Active offline locks for an event |
+| POST | `/api/scan-locks` | staff+ | Lock `{ eventId, sectionId?, deviceId, deviceName? }` to this device (409 if the scope is held elsewhere) |
+| GET | `/api/scan-locks/:id/snapshot?deviceId=` | staff+ | Tickets valid in the lock's scope (lock holder only) |
+| POST | `/api/scan-locks/:id/sync` | staff+ | `{ deviceId, scans: [{ clientScanId, qrCode, qty, scannedAt }] }` — idempotent; returns accepted, duplicates, conflicts |
+| DELETE | `/api/scan-locks/:id` | staff+ | Release (`{ deviceId }`, lock holder only) |
+| POST | `/api/scan-locks/:id/force-release` | supervisor+ | Release a lost device's lock |
+| GET | `/api/scan-locks/reports?eventId=&unreviewed=` | supervisor+ | Sync reports |
+| POST | `/api/scan-locks/reports/:id/review` | supervisor+ | Mark a report reviewed |
+
+How locks work:
+- One device per scope. A whole-event lock (`sectionId` null) clashes with every section lock on that event.
+- `POST /api/tickets/scan/:qrCode` now accepts `sectionId` and `deviceId`. It enforces the section on the server, and returns `423 { code: "SCAN_LOCKED" }` when another device holds a lock covering the ticket.
+
+How syncing works:
+- Synced scans never redeem more than is left on a ticket.
+- Conflicts are recorded in the sync report: `not_found`, `cancelled`, `wrong_scope`, `already_used`, `partly_used` and `consent`.
+- Check-in messages are sent after the sync.
+- Locks, releases, force-releases and syncs are written to the admin audit log.
+
+## Waitlist
+
+Events with `waitlistEnabled` (plus `waitlistOfferHours`, default 24, and `waitlistPartialOffers`, default true) take a queue for sold-out lines.
+
+| Method | Path | Auth | Description |
+|--------|------|------|-------------|
+| POST | `/api/waitlist` | optional | Join: `{ eventId, eventOptionId, variantId?, quantity }` (+ `guestName`, `guestEmail`, `guestPhone` when not logged in on a guest event). Only when the line can't cover the quantity |
+| GET | `/api/waitlist/mine` | user+ | My active entries |
+| DELETE | `/api/waitlist/:id` | user+ | Leave (an open offer moves on) |
+| GET | `/api/waitlist/claim/:token` | public | What a claim link offers |
+| GET | `/api/waitlist/events/:eventId` | staff+ | The queue for an event |
+| POST | `/api/waitlist/:id/offer` | supervisor+ | Offer now (`{ quantity? }`), even over the stock limit |
+| POST | `/api/waitlist/:id/move` | supervisor+ | `{ direction: "up" \| "down" }` |
+| POST | `/api/waitlist/:id/remove` | supervisor+ | Take someone off |
+
+How offers work:
+- Places held for a live offer count as taken everywhere stock is counted: `availableCount`, `isSoldOut` and registration stock checks.
+- Offers are made automatically when places free up: a cancellation, a smaller booking, or a raised stock limit.
+- A job every 10 minutes (`WAITLIST_JOB_ENABLED`, `WAITLIST_JOB_INTERVAL_MS`) expires unclaimed offers and re-offers.
+- Claiming means registering with `POST /api/registrations` plus `waitlistToken`. The token stands in for logging in, and the held places are released to the claimer.
+- Manual registration and adding places to an existing booking are now checked against stock too.
+
+## Parental consent
+
+Youth events (`requiresParentalConsent`, plus `consentText`, `consentCollectMedical`, `consentCollectEmergency` and `consentCollectPhoto` on the event) need every main place named with a `dateOfBirth`. Attendees under 18 on the start date also need `parentName`, `parentEmail` and `parentPhone`. Changing `consentText` bumps `consentTextVersion`.
+
+| Method | Path | Auth | Description |
+|--------|------|------|-------------|
+| GET | `/api/consent/:token` | public | What the parent sees: attendee, event, consent text, fields to fill in |
+| POST | `/api/consent/:token` | public | `{ decision: "give"\|"decline", signedName, isGuardian: true, medical?, emergency?, photoConsent? }` |
+| GET | `/api/consent/events/:eventId` | staff+ | Consent status per attendee, with counts |
+| POST | `/api/consent/requests/:id/resend` | user+ | Re-send one request with a new link (registrant or staff) |
+| POST | `/api/consent/events/:eventId/resend-pending` | supervisor+ | Re-send every pending request |
+| POST | `/api/consent/events/:eventId/rerequest` | supervisor+ | New requests for consent given on older text, and minors with none |
+| GET | `/api/consent/events/:eventId/medical` | supervisor+ | Decrypted medical & emergency list (audited as `medical_list_viewed`) |
+
+How requests work:
+- Requests go to the parent by both email and WhatsApp, whatever anyone's notification preference.
+- Links are random tokens; only an HMAC is stored. They expire when the event ends.
+- The answer stores the signed name, time, IP, device, and the exact text and version shown.
+- Medical and emergency details are AES-256-GCM encrypted. A daily job (09:00, `CONSENT_JOBS_ENABLED=false` to disable) sends reminders (day 2, then every 3 days) and deletes them `consent_medical_retention_days` (default 30) after the event.
+
+Check-in rules:
+- `GET /api/tickets/scan-preview/:qrCode` returns `consentStatus` (`not_required`, `missing`, `pending`, `given` or `declined`).
+- `POST /api/tickets/scan/:qrCode` returns `403 { code: "CONSENT_REQUIRED" }` unless consent is given.
+- Supervisors can pass `overrideConsent: true`, which is audited as `consent_override`.
+
 ## Coupons

 | Method | Path | Auth | Description |
@@ -1,12 +1,12 @@
 {
  "name": "event-management-backend",
-  "version": "1.14.0",
+  "version": "1.23.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "event-management-backend",
-      "version": "1.14.0",
+      "version": "1.23.0",
      "hasInstallScript": true,
      "dependencies": {
        "@prisma/client": "^5.4.2",
@@ -1,6 +1,6 @@
 {
  "name": "event-management-backend",
-  "version": "1.14.0",
+  "version": "1.23.0",
  "description": "Event Management System Backend",
  "main": "src/index.js",
  "scripts": {
@@ -0,0 +1,71 @@
+-- CreateEnum
+CREATE TYPE "ConsentStatus" AS ENUM ('pending', 'given', 'declined');
+
+-- AlterEnum
+-- This migration adds more than one value to an enum.
+-- With PostgreSQL versions 11 and earlier, this is not possible
+-- in a single migration. This can be worked around by creating
+-- multiple migrations, each migration adding only one value to
+-- the enum.
+
+
+ALTER TYPE "AdminAuditAction" ADD VALUE 'consent_override';
+ALTER TYPE "AdminAuditAction" ADD VALUE 'consent_rerequested';
+ALTER TYPE "AdminAuditAction" ADD VALUE 'medical_list_viewed';
+
+-- AlterTable
+ALTER TABLE "Attendee" ADD COLUMN     "parentEmail" TEXT,
+ADD COLUMN     "parentName" TEXT,
+ADD COLUMN     "parentPhone" TEXT;
+
+-- AlterTable
+ALTER TABLE "Event" ADD COLUMN     "consentCollectEmergency" BOOLEAN NOT NULL DEFAULT false,
+ADD COLUMN     "consentCollectMedical" BOOLEAN NOT NULL DEFAULT false,
+ADD COLUMN     "consentCollectPhoto" BOOLEAN NOT NULL DEFAULT false,
+ADD COLUMN     "consentText" TEXT,
+ADD COLUMN     "consentTextVersion" INTEGER NOT NULL DEFAULT 1,
+ADD COLUMN     "requiresParentalConsent" BOOLEAN NOT NULL DEFAULT false;
+
+-- CreateTable
+CREATE TABLE "ConsentRequest" (
+    "id" TEXT NOT NULL,
+    "attendeeId" TEXT NOT NULL,
+    "eventId" TEXT NOT NULL,
+    "tokenHash" TEXT NOT NULL,
+    "status" "ConsentStatus" NOT NULL DEFAULT 'pending',
+    "textVersion" INTEGER NOT NULL,
+    "consentText" TEXT NOT NULL,
+    "parentName" TEXT,
+    "parentEmail" TEXT,
+    "parentPhone" TEXT,
+    "signedName" TEXT,
+    "ip" TEXT,
+    "device" TEXT,
+    "medical" TEXT,
+    "emergency" TEXT,
+    "photoConsent" BOOLEAN,
+    "respondedAt" TIMESTAMP(3),
+    "lastSentAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "remindersSent" INTEGER NOT NULL DEFAULT 0,
+    "expiresAt" TIMESTAMP(3) NOT NULL,
+    "medicalPurgedAt" TIMESTAMP(3),
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "ConsentRequest_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "ConsentRequest_tokenHash_key" ON "ConsentRequest"("tokenHash");
+
+-- CreateIndex
+CREATE INDEX "ConsentRequest_attendeeId_createdAt_idx" ON "ConsentRequest"("attendeeId", "createdAt");
+
+-- CreateIndex
+CREATE INDEX "ConsentRequest_eventId_status_idx" ON "ConsentRequest"("eventId", "status");
+
+-- AddForeignKey
+ALTER TABLE "ConsentRequest" ADD CONSTRAINT "ConsentRequest_attendeeId_fkey" FOREIGN KEY ("attendeeId") REFERENCES "Attendee"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "ConsentRequest" ADD CONSTRAINT "ConsentRequest_eventId_fkey" FOREIGN KEY ("eventId") REFERENCES "Event"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
@@ -0,0 +1,63 @@
+-- CreateEnum
+CREATE TYPE "WaitlistStatus" AS ENUM ('waiting', 'offered', 'claimed', 'expired', 'removed', 'left');
+
+-- AlterTable
+ALTER TABLE "Event" ADD COLUMN     "waitlistEnabled" BOOLEAN NOT NULL DEFAULT false,
+ADD COLUMN     "waitlistOfferHours" INTEGER NOT NULL DEFAULT 24,
+ADD COLUMN     "waitlistPartialOffers" BOOLEAN NOT NULL DEFAULT true;
+
+-- CreateTable
+CREATE TABLE "WaitlistEntry" (
+    "id" TEXT NOT NULL,
+    "eventId" TEXT NOT NULL,
+    "eventOptionId" TEXT NOT NULL,
+    "variantId" TEXT,
+    "userId" TEXT NOT NULL,
+    "quantity" INTEGER NOT NULL,
+    "position" INTEGER NOT NULL,
+    "status" "WaitlistStatus" NOT NULL DEFAULT 'waiting',
+    "offeredQuantity" INTEGER,
+    "offerTokenHash" TEXT,
+    "offeredAt" TIMESTAMP(3),
+    "offerExpiresAt" TIMESTAMP(3),
+    "claimedAt" TIMESTAMP(3),
+    "registrationId" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "WaitlistEntry_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "WaitlistEntry_offerTokenHash_key" ON "WaitlistEntry"("offerTokenHash");
+
+-- CreateIndex
+CREATE INDEX "WaitlistEntry_eventId_status_position_idx" ON "WaitlistEntry"("eventId", "status", "position");
+
+-- CreateIndex
+CREATE INDEX "WaitlistEntry_eventOptionId_status_idx" ON "WaitlistEntry"("eventOptionId", "status");
+
+-- CreateIndex
+CREATE INDEX "WaitlistEntry_variantId_idx" ON "WaitlistEntry"("variantId");
+
+-- CreateIndex
+CREATE INDEX "WaitlistEntry_userId_idx" ON "WaitlistEntry"("userId");
+
+-- CreateIndex
+CREATE INDEX "WaitlistEntry_registrationId_idx" ON "WaitlistEntry"("registrationId");
+
+-- AddForeignKey
+ALTER TABLE "WaitlistEntry" ADD CONSTRAINT "WaitlistEntry_eventId_fkey" FOREIGN KEY ("eventId") REFERENCES "Event"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "WaitlistEntry" ADD CONSTRAINT "WaitlistEntry_eventOptionId_fkey" FOREIGN KEY ("eventOptionId") REFERENCES "EventOption"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "WaitlistEntry" ADD CONSTRAINT "WaitlistEntry_variantId_fkey" FOREIGN KEY ("variantId") REFERENCES "OptionVariant"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "WaitlistEntry" ADD CONSTRAINT "WaitlistEntry_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "WaitlistEntry" ADD CONSTRAINT "WaitlistEntry_registrationId_fkey" FOREIGN KEY ("registrationId") REFERENCES "Registration"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
@@ -0,0 +1,93 @@
+-- AlterEnum
+-- This migration adds more than one value to an enum.
+-- With PostgreSQL versions 11 and earlier, this is not possible
+-- in a single migration. This can be worked around by creating
+-- multiple migrations, each migration adding only one value to
+-- the enum.
+
+
+ALTER TYPE "AdminAuditAction" ADD VALUE 'scan_lock_acquired';
+ALTER TYPE "AdminAuditAction" ADD VALUE 'scan_lock_released';
+ALTER TYPE "AdminAuditAction" ADD VALUE 'scan_lock_force_released';
+ALTER TYPE "AdminAuditAction" ADD VALUE 'offline_sync';
+
+-- AlterTable
+ALTER TABLE "TicketUsage" ADD COLUMN     "clientScanId" TEXT,
+ADD COLUMN     "offline" BOOLEAN NOT NULL DEFAULT false,
+ADD COLUMN     "scanLockId" TEXT,
+ADD COLUMN     "syncedAt" TIMESTAMP(3);
+
+-- CreateTable
+CREATE TABLE "ScanLock" (
+    "id" TEXT NOT NULL,
+    "eventId" TEXT NOT NULL,
+    "sectionId" TEXT,
+    "deviceId" TEXT NOT NULL,
+    "deviceName" TEXT,
+    "userId" TEXT NOT NULL,
+    "lockedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "snapshotAt" TIMESTAMP(3),
+    "lastSyncAt" TIMESTAMP(3),
+    "releasedAt" TIMESTAMP(3),
+    "forceReleasedById" TEXT,
+
+    CONSTRAINT "ScanLock_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "OfflineSyncReport" (
+    "id" TEXT NOT NULL,
+    "scanLockId" TEXT NOT NULL,
+    "accepted" INTEGER NOT NULL DEFAULT 0,
+    "duplicates" INTEGER NOT NULL DEFAULT 0,
+    "conflicts" JSONB NOT NULL DEFAULT '[]',
+    "afterForceRelease" BOOLEAN NOT NULL DEFAULT false,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "reviewedAt" TIMESTAMP(3),
+    "reviewedById" TEXT,
+
+    CONSTRAINT "OfflineSyncReport_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "ScanLock_eventId_releasedAt_idx" ON "ScanLock"("eventId", "releasedAt");
+
+-- CreateIndex
+CREATE INDEX "ScanLock_userId_idx" ON "ScanLock"("userId");
+
+-- CreateIndex
+CREATE INDEX "ScanLock_sectionId_idx" ON "ScanLock"("sectionId");
+
+-- CreateIndex
+CREATE INDEX "ScanLock_forceReleasedById_idx" ON "ScanLock"("forceReleasedById");
+
+-- CreateIndex
+CREATE INDEX "OfflineSyncReport_scanLockId_idx" ON "OfflineSyncReport"("scanLockId");
+
+-- CreateIndex
+CREATE INDEX "OfflineSyncReport_reviewedById_idx" ON "OfflineSyncReport"("reviewedById");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "TicketUsage_clientScanId_key" ON "TicketUsage"("clientScanId");
+
+-- AddForeignKey
+ALTER TABLE "TicketUsage" ADD CONSTRAINT "TicketUsage_scanLockId_fkey" FOREIGN KEY ("scanLockId") REFERENCES "ScanLock"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "ScanLock" ADD CONSTRAINT "ScanLock_eventId_fkey" FOREIGN KEY ("eventId") REFERENCES "Event"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "ScanLock" ADD CONSTRAINT "ScanLock_sectionId_fkey" FOREIGN KEY ("sectionId") REFERENCES "Section"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "ScanLock" ADD CONSTRAINT "ScanLock_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "ScanLock" ADD CONSTRAINT "ScanLock_forceReleasedById_fkey" FOREIGN KEY ("forceReleasedById") REFERENCES "User"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "OfflineSyncReport" ADD CONSTRAINT "OfflineSyncReport_scanLockId_fkey" FOREIGN KEY ("scanLockId") REFERENCES "ScanLock"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "OfflineSyncReport" ADD CONSTRAINT "OfflineSyncReport_reviewedById_fkey" FOREIGN KEY ("reviewedById") REFERENCES "User"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
@@ -0,0 +1,36 @@
+-- AlterEnum
+ALTER TYPE "AdminAuditAction" ADD VALUE 'ticket_transferred';
+
+-- AlterTable
+ALTER TABLE "Event" ADD COLUMN     "allowTicketTransfer" BOOLEAN NOT NULL DEFAULT true;
+
+-- CreateTable
+CREATE TABLE "TicketTransfer" (
+    "id" TEXT NOT NULL,
+    "ticketId" TEXT NOT NULL,
+    "fromHolderName" TEXT NOT NULL,
+    "fromUserId" TEXT,
+    "toName" TEXT NOT NULL,
+    "toUserId" TEXT,
+    "byUserId" TEXT,
+    "oldQrCode" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "TicketTransfer_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "TicketTransfer_ticketId_idx" ON "TicketTransfer"("ticketId");
+
+-- CreateIndex
+CREATE INDEX "TicketTransfer_oldQrCode_idx" ON "TicketTransfer"("oldQrCode");
+
+-- AddForeignKey
+ALTER TABLE "TicketTransfer" ADD CONSTRAINT "TicketTransfer_ticketId_fkey" FOREIGN KEY ("ticketId") REFERENCES "Ticket"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "TicketTransfer" ADD CONSTRAINT "TicketTransfer_toUserId_fkey" FOREIGN KEY ("toUserId") REFERENCES "User"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "TicketTransfer" ADD CONSTRAINT "TicketTransfer_byUserId_fkey" FOREIGN KEY ("byUserId") REFERENCES "User"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
@@ -0,0 +1,78 @@
+-- AlterTable
+ALTER TABLE "Event" ADD COLUMN     "collectGender" BOOLEAN NOT NULL DEFAULT false;
+
+-- CreateTable
+CREATE TABLE "AllocationSet" (
+    "id" TEXT NOT NULL,
+    "eventId" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "showOnTicket" BOOLEAN NOT NULL DEFAULT false,
+    "order" INTEGER NOT NULL DEFAULT 0,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "AllocationSet_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "AllocationGroup" (
+    "id" TEXT NOT NULL,
+    "setId" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "capacity" INTEGER,
+    "gender" TEXT,
+    "leaderUserId" TEXT,
+    "order" INTEGER NOT NULL DEFAULT 0,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "AllocationGroup_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "AllocationAssignment" (
+    "id" TEXT NOT NULL,
+    "setId" TEXT NOT NULL,
+    "groupId" TEXT NOT NULL,
+    "attendeeId" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "AllocationAssignment_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "AllocationSet_eventId_idx" ON "AllocationSet"("eventId");
+
+-- CreateIndex
+CREATE INDEX "AllocationGroup_setId_idx" ON "AllocationGroup"("setId");
+
+-- CreateIndex
+CREATE INDEX "AllocationGroup_leaderUserId_idx" ON "AllocationGroup"("leaderUserId");
+
+-- CreateIndex
+CREATE INDEX "AllocationAssignment_groupId_idx" ON "AllocationAssignment"("groupId");
+
+-- CreateIndex
+CREATE INDEX "AllocationAssignment_attendeeId_idx" ON "AllocationAssignment"("attendeeId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "AllocationAssignment_setId_attendeeId_key" ON "AllocationAssignment"("setId", "attendeeId");
+
+-- AddForeignKey
+ALTER TABLE "AllocationSet" ADD CONSTRAINT "AllocationSet_eventId_fkey" FOREIGN KEY ("eventId") REFERENCES "Event"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "AllocationGroup" ADD CONSTRAINT "AllocationGroup_setId_fkey" FOREIGN KEY ("setId") REFERENCES "AllocationSet"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "AllocationGroup" ADD CONSTRAINT "AllocationGroup_leaderUserId_fkey" FOREIGN KEY ("leaderUserId") REFERENCES "User"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "AllocationAssignment" ADD CONSTRAINT "AllocationAssignment_setId_fkey" FOREIGN KEY ("setId") REFERENCES "AllocationSet"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "AllocationAssignment" ADD CONSTRAINT "AllocationAssignment_groupId_fkey" FOREIGN KEY ("groupId") REFERENCES "AllocationGroup"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "AllocationAssignment" ADD CONSTRAINT "AllocationAssignment_attendeeId_fkey" FOREIGN KEY ("attendeeId") REFERENCES "Attendee"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
@@ -0,0 +1,11 @@
+-- AlterTable
+ALTER TABLE "Event" ADD COLUMN     "allowSponsorships" BOOLEAN NOT NULL DEFAULT false,
+ADD COLUMN     "showSponsorshipProgress" BOOLEAN NOT NULL DEFAULT true,
+ADD COLUMN     "sponsorshipGoalSpots" INTEGER;
+
+-- AlterTable
+ALTER TABLE "Payment" ADD COLUMN     "isSponsorship" BOOLEAN NOT NULL DEFAULT false,
+ADD COLUMN     "sponsorAnonymous" BOOLEAN NOT NULL DEFAULT false,
+ADD COLUMN     "sponsorMessage" TEXT,
+ADD COLUMN     "sponsorName" TEXT;
+
@@ -0,0 +1,122 @@
+-- AlterEnum
+-- This migration adds more than one value to an enum.
+-- With PostgreSQL versions 11 and earlier, this is not possible
+-- in a single migration. This can be worked around by creating
+-- multiple migrations, each migration adding only one value to
+-- the enum.
+
+
+ALTER TYPE "FormFieldType" ADD VALUE 'rating';
+ALTER TYPE "FormFieldType" ADD VALUE 'multiple_choice';
+
+-- CreateTable
+CREATE TABLE "FeedbackForm" (
+    "id" TEXT NOT NULL,
+    "eventId" TEXT NOT NULL,
+    "sendAt" TIMESTAMP(3),
+    "audience" TEXT NOT NULL DEFAULT 'checked_in',
+    "anonymous" BOOLEAN NOT NULL DEFAULT false,
+    "intro" TEXT,
+    "sentAt" TIMESTAMP(3),
+    "reminderSentAt" TIMESTAMP(3),
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "FeedbackForm_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "FeedbackField" (
+    "id" TEXT NOT NULL,
+    "formId" TEXT NOT NULL,
+    "type" "FormFieldType" NOT NULL,
+    "label" TEXT NOT NULL,
+    "isRequired" BOOLEAN NOT NULL DEFAULT false,
+    "order" INTEGER NOT NULL DEFAULT 0,
+    "helpText" TEXT,
+    "options" JSONB,
+
+    CONSTRAINT "FeedbackField_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "FeedbackInvite" (
+    "id" TEXT NOT NULL,
+    "formId" TEXT NOT NULL,
+    "userId" TEXT NOT NULL,
+    "tokenHash" TEXT NOT NULL,
+    "sentAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "remindedAt" TIMESTAMP(3),
+    "respondedAt" TIMESTAMP(3),
+
+    CONSTRAINT "FeedbackInvite_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "FeedbackResponse" (
+    "id" TEXT NOT NULL,
+    "formId" TEXT NOT NULL,
+    "userId" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "FeedbackResponse_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "FeedbackAnswer" (
+    "id" TEXT NOT NULL,
+    "responseId" TEXT NOT NULL,
+    "fieldId" TEXT NOT NULL,
+    "value" TEXT NOT NULL,
+
+    CONSTRAINT "FeedbackAnswer_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "FeedbackForm_eventId_key" ON "FeedbackForm"("eventId");
+
+-- CreateIndex
+CREATE INDEX "FeedbackField_formId_idx" ON "FeedbackField"("formId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "FeedbackInvite_tokenHash_key" ON "FeedbackInvite"("tokenHash");
+
+-- CreateIndex
+CREATE INDEX "FeedbackInvite_userId_idx" ON "FeedbackInvite"("userId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "FeedbackInvite_formId_userId_key" ON "FeedbackInvite"("formId", "userId");
+
+-- CreateIndex
+CREATE INDEX "FeedbackResponse_formId_idx" ON "FeedbackResponse"("formId");
+
+-- CreateIndex
+CREATE INDEX "FeedbackAnswer_responseId_idx" ON "FeedbackAnswer"("responseId");
+
+-- CreateIndex
+CREATE INDEX "FeedbackAnswer_fieldId_idx" ON "FeedbackAnswer"("fieldId");
+
+-- AddForeignKey
+ALTER TABLE "FeedbackForm" ADD CONSTRAINT "FeedbackForm_eventId_fkey" FOREIGN KEY ("eventId") REFERENCES "Event"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "FeedbackField" ADD CONSTRAINT "FeedbackField_formId_fkey" FOREIGN KEY ("formId") REFERENCES "FeedbackForm"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "FeedbackInvite" ADD CONSTRAINT "FeedbackInvite_formId_fkey" FOREIGN KEY ("formId") REFERENCES "FeedbackForm"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "FeedbackInvite" ADD CONSTRAINT "FeedbackInvite_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "FeedbackResponse" ADD CONSTRAINT "FeedbackResponse_formId_fkey" FOREIGN KEY ("formId") REFERENCES "FeedbackForm"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "FeedbackResponse" ADD CONSTRAINT "FeedbackResponse_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "FeedbackAnswer" ADD CONSTRAINT "FeedbackAnswer_responseId_fkey" FOREIGN KEY ("responseId") REFERENCES "FeedbackResponse"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "FeedbackAnswer" ADD CONSTRAINT "FeedbackAnswer_fieldId_fkey" FOREIGN KEY ("fieldId") REFERENCES "FeedbackField"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
@@ -0,0 +1,47 @@
+-- AlterTable
+ALTER TABLE "Registration" ADD COLUMN     "analyticsSessionId" TEXT;
+
+-- CreateTable
+CREATE TABLE "AnalyticsEvent" (
+    "id" TEXT NOT NULL,
+    "sessionId" TEXT NOT NULL,
+    "eventId" TEXT NOT NULL,
+    "stage" TEXT NOT NULL,
+    "source" TEXT,
+    "device" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "AnalyticsEvent_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "AnalyticsDaily" (
+    "id" TEXT NOT NULL,
+    "eventId" TEXT NOT NULL,
+    "day" DATE NOT NULL,
+    "stage" TEXT NOT NULL,
+    "source" TEXT NOT NULL DEFAULT 'direct',
+    "device" TEXT NOT NULL DEFAULT 'unknown',
+    "sessions" INTEGER NOT NULL DEFAULT 0,
+
+    CONSTRAINT "AnalyticsDaily_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "AnalyticsEvent_eventId_createdAt_idx" ON "AnalyticsEvent"("eventId", "createdAt");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "AnalyticsEvent_sessionId_eventId_stage_key" ON "AnalyticsEvent"("sessionId", "eventId", "stage");
+
+-- CreateIndex
+CREATE INDEX "AnalyticsDaily_eventId_day_idx" ON "AnalyticsDaily"("eventId", "day");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "AnalyticsDaily_eventId_day_stage_source_device_key" ON "AnalyticsDaily"("eventId", "day", "stage", "source", "device");
+
+-- AddForeignKey
+ALTER TABLE "AnalyticsEvent" ADD CONSTRAINT "AnalyticsEvent_eventId_fkey" FOREIGN KEY ("eventId") REFERENCES "Event"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "AnalyticsDaily" ADD CONSTRAINT "AnalyticsDaily_eventId_fkey" FOREIGN KEY ("eventId") REFERENCES "Event"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
@@ -0,0 +1,55 @@
+-- AlterEnum
+-- This migration adds more than one value to an enum.
+-- With PostgreSQL versions 11 and earlier, this is not possible
+-- in a single migration. This can be worked around by creating
+-- multiple migrations, each migration adding only one value to
+-- the enum.
+
+
+ALTER TYPE "AdminAuditAction" ADD VALUE 'impersonation_started';
+ALTER TYPE "AdminAuditAction" ADD VALUE 'impersonation_ended';
+
+-- CreateTable
+CREATE TABLE "ImpersonationSession" (
+    "id" TEXT NOT NULL,
+    "adminId" TEXT NOT NULL,
+    "targetUserId" TEXT NOT NULL,
+    "reason" TEXT NOT NULL,
+    "startedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "expiresAt" TIMESTAMP(3) NOT NULL,
+    "endedAt" TIMESTAMP(3),
+    "endedReason" TEXT,
+
+    CONSTRAINT "ImpersonationSession_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "ImpersonationRequestLog" (
+    "id" TEXT NOT NULL,
+    "sessionId" TEXT NOT NULL,
+    "method" TEXT NOT NULL,
+    "path" TEXT NOT NULL,
+    "blocked" BOOLEAN NOT NULL DEFAULT false,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "ImpersonationRequestLog_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "ImpersonationSession_adminId_idx" ON "ImpersonationSession"("adminId");
+
+-- CreateIndex
+CREATE INDEX "ImpersonationSession_targetUserId_idx" ON "ImpersonationSession"("targetUserId");
+
+-- CreateIndex
+CREATE INDEX "ImpersonationRequestLog_sessionId_createdAt_idx" ON "ImpersonationRequestLog"("sessionId", "createdAt");
+
+-- AddForeignKey
+ALTER TABLE "ImpersonationSession" ADD CONSTRAINT "ImpersonationSession_adminId_fkey" FOREIGN KEY ("adminId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "ImpersonationSession" ADD CONSTRAINT "ImpersonationSession_targetUserId_fkey" FOREIGN KEY ("targetUserId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "ImpersonationRequestLog" ADD CONSTRAINT "ImpersonationRequestLog_sessionId_fkey" FOREIGN KEY ("sessionId") REFERENCES "ImpersonationSession"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
@@ -103,44 +103,79 @@ model User {
  couponsApplied    CouponRedemption[] @relation("CouponRedemptionAppliedBy")

  attendeeProfiles Attendee[]
-  heldTickets      Ticket[]   @relation("TicketHolder")
+  heldTickets      Ticket[]            @relation("TicketHolder")
+  waitlistEntries  WaitlistEntry[]
+  scanLocks        ScanLock[]          @relation("ScanLockOwner")
+  transfersTo      TicketTransfer[]    @relation("TransferRecipient")
+  transfersBy      TicketTransfer[]    @relation("TransferActor")
+  ledGroups        AllocationGroup[]   @relation("AllocationGroupLeader")
+  feedbackInvites  FeedbackInvite[]
+  feedbackGiven    FeedbackResponse[]
+  impersonationsDone ImpersonationSession[] @relation("ImpersonationAdmin")
+  impersonatedIn     ImpersonationSession[] @relation("ImpersonationTarget")
+  scanLocksForced  ScanLock[]          @relation("ScanLockForcedBy")
+  syncReportsDone  OfflineSyncReport[] @relation("SyncReportReviewer")

  twoFactorChallenges TwoFactorChallenge[]
  trustedDevices      TrustedDevice[]
 }

 model Event {
-  id                   String            @id @default(uuid())
-  title                String
-  description          String?
-  startDate            DateTime
-  endDate              DateTime
-  registrationDeadline DateTime?
-  goLiveAt             DateTime          @default(now())
-  price                Float
-  picture              String?
-  isActive             Boolean           @default(true)
-  isHidden             Boolean           @default(false)
-  requiresAuth         Boolean           @default(true)
-  requiresRegistration Boolean           @default(true)
+  id                      String            @id @default(uuid())
+  title                   String
+  description             String?
+  startDate               DateTime
+  endDate                 DateTime
+  registrationDeadline    DateTime?
+  goLiveAt                DateTime          @default(now())
+  price                   Float
+  picture                 String?
+  isActive                Boolean           @default(true)
+  isHidden                Boolean           @default(false)
+  requiresAuth            Boolean           @default(true)
+  requiresRegistration    Boolean           @default(true)
  // Lets a payer name each person on a group registration (one named ticket each).
-  allowNamedAttendees  Boolean           @default(false)
-  contactName          String?
-  contactPhone         String?
-  contactEmail         String?
-  location             String?
-  createdAt            DateTime          @default(now())
-  updatedAt            DateTime          @updatedAt
-  createdById          String?
-  createdBy            User?             @relation(fields: [createdById], references: [id], onDelete: SetNull)
-  redirectUrl          String?           @unique
-  eventOptions         EventOption[]
-  registrations        Registration[]
-  payments             Payment[]
-  tickets              Ticket[]
-  attachments          EventAttachment[]
-  form                 EventForm?
-  Section              Section[]
+  allowNamedAttendees     Boolean           @default(false)
+  // Youth event: every attendee gives a date of birth, and a parent/guardian must give
+  // consent for anyone under 18 before they can be checked in.
+  requiresParentalConsent Boolean           @default(false)
+  consentText             String?
+  consentTextVersion      Int               @default(1)
+  consentCollectMedical   Boolean           @default(false)
+  consentCollectEmergency Boolean           @default(false)
+  consentCollectPhoto     Boolean           @default(false)
+  // Waitlist for sold-out options: when places free up, the next person is offered
+  // them for waitlistOfferHours. waitlistPartialOffers: offer what's free even if it's
+  // fewer places than asked for (otherwise skip to the next person who fits).
+  waitlistEnabled         Boolean           @default(false)
+  allowTicketTransfer     Boolean           @default(true)
+  collectGender           Boolean           @default(false)
+  // Sponsor a spot: public donations into a bursary pool for this event.
+  allowSponsorships       Boolean           @default(false)
+  sponsorshipGoalSpots    Int?
+  showSponsorshipProgress Boolean           @default(true)
+  feedbackForm            FeedbackForm?
+  analyticsEvents         AnalyticsEvent[]
+  analyticsDaily          AnalyticsDaily[]
+  allocationSets          AllocationSet[]
+  waitlistOfferHours      Int               @default(24)
+  waitlistPartialOffers   Boolean           @default(true)
+  contactName             String?
+  contactPhone            String?
+  contactEmail            String?
+  location                String?
+  createdAt               DateTime          @default(now())
+  updatedAt               DateTime          @updatedAt
+  createdById             String?
+  createdBy               User?             @relation(fields: [createdById], references: [id], onDelete: SetNull)
+  redirectUrl             String?           @unique
+  eventOptions            EventOption[]
+  registrations           Registration[]
+  payments                Payment[]
+  tickets                 Ticket[]
+  attachments             EventAttachment[]
+  form                    EventForm?
+  Section                 Section[]

  cashupStatus     CashupStatus             @default(open)
  cashupDraft      Json?
@@ -156,8 +191,11 @@ model Event {

  // Users who should receive registration/payment/daily-summary notifications for this
  // event. Falls back to `createdBy` when empty (see backend/src/utils/notifications.js).
-  notifyRecipients User[]        @relation("EventNotifyRecipients")
+  notifyRecipients User[]           @relation("EventNotifyRecipients")
  coupons          CouponEvent[]
+  consentRequests  ConsentRequest[]
+  waitlistEntries  WaitlistEntry[]
+  scanLocks        ScanLock[]

  @@index([createdById])
  @@index([closedById])
@@ -180,6 +218,7 @@ model EventOption {
  variants            OptionVariant[]
  costs               EventCost[]
  couponScopes        CouponOption[]
+  waitlistEntries     WaitlistEntry[]

  @@index([eventId])
 }
@@ -214,6 +253,7 @@ model OptionVariant {
  registrationOptions RegistrationOption[]
  earlyBirdTiers      EarlyBirdTier[]
  couponScopes        CouponOption[]
+  waitlistEntries     WaitlistEntry[]

  @@index([eventOptionId])
 }
@@ -230,6 +270,7 @@ model Registration {
  discountTotal       Float                @default(0)
  // Where named attendees' tickets go: all to the payer, or each to the attendee.
  ticketDelivery      TicketDelivery       @default(payer)
+  analyticsSessionId String?
  createdAt           DateTime             @default(now())
  updatedAt           DateTime             @updatedAt
  user                User                 @relation(fields: [userId], references: [id], onDelete: Restrict)
@@ -240,6 +281,7 @@ model Registration {
  formDrafts          FormDraft[]
  couponRedemptions   CouponRedemption[]
  attendees           Attendee[]
+  waitlistEntries     WaitlistEntry[]

  @@index([userId])
  @@index([eventId])
@@ -300,6 +342,11 @@ model Payment {
  registrationId    String?
  eventId           String?
  isDonation        Boolean           @default(false)
+  // A "sponsor a spot" donation (also isDonation): goes into the event's sponsorship pool.
+  isSponsorship     Boolean           @default(false)
+  sponsorName       String?
+  sponsorMessage    String?
+  sponsorAnonymous  Boolean           @default(false)
  externalId        String?           @unique
  status            String?
  originalPaymentId String?
@@ -341,6 +388,7 @@ model Ticket {
  user                 User               @relation(fields: [userId], references: [id], onDelete: Restrict)
  event                Event              @relation(fields: [eventId], references: [id], onDelete: Restrict)
  usages               TicketUsage[]
+  transfers            TicketTransfer[]

  @@index([holderUserId])
  @@index([eventId])
@@ -350,13 +398,20 @@ model Ticket {
 }

 model TicketUsage {
-  id               String   @id @default(uuid())
+  id               String    @id @default(uuid())
  ticketId         String
  scannedById      String
-  scannedAt        DateTime @default(now())
-  quantityRedeemed Int      @default(1)
-  ticket           Ticket   @relation(fields: [ticketId], references: [id], onDelete: Restrict)
-  scannedBy        User     @relation(fields: [scannedById], references: [id], onDelete: Restrict)
+  scannedAt        DateTime  @default(now())
+  quantityRedeemed Int       @default(1)
+  // Offline scanning: the device's id for the scan (makes syncing idempotent), and
+  // the offline lock it was made under.
+  clientScanId     String?   @unique
+  offline          Boolean   @default(false)
+  scanLockId       String?
+  syncedAt         DateTime?
+  ticket           Ticket    @relation(fields: [ticketId], references: [id], onDelete: Restrict)
+  scannedBy        User      @relation(fields: [scannedById], references: [id], onDelete: Restrict)
+  scanLock         ScanLock? @relation(fields: [scanLockId], references: [id], onDelete: SetNull)

  @@index([ticketId])
  @@index([scannedAt])
@@ -438,6 +493,16 @@ enum AdminAuditAction {
  coupon_updated
  coupon_disabled
  coupon_applied_manual
+  consent_override
+  consent_rerequested
+  medical_list_viewed
+  scan_lock_acquired
+  scan_lock_released
+  scan_lock_force_released
+  offline_sync
+  ticket_transferred
+  impersonation_started
+  impersonation_ended
 }

 // Append-only audit trail for admin/supervisor-initiated actions with money or
@@ -483,6 +548,8 @@ enum FormFieldType {
  numeric
  statement
  paragraph
+  rating
+  multiple_choice
 }

 model EventForm {
@@ -578,6 +645,7 @@ model Section {

  event          Event           @relation(fields: [eventId], references: [id], onDelete: Cascade)
  allowedOptions SectionOption[]
+  scanLocks      ScanLock[]

  @@index([eventId])
 }
@@ -690,167 +758,6 @@ model EventCashupPersonCountDenomination {
  @@index([countId])
 }

-// ─── Church Website Models (disabled — kept for reference, not active Prisma models) ──
-//
-// model Ministry {
-//   id          String             @id @default(uuid())
-//   slug        String             @unique
-//   title       String
-//   description String?
-//   image       String?
-//   isActive    Boolean            @default(true)
-//   order       Int                @default(0)
-//   leaderId    String?
-//   leader      TeamMember?        @relation(fields: [leaderId], references: [id], onDelete: SetNull)
-//   interests   MinistryInterest[]
-//   createdAt   DateTime           @default(now())
-//   updatedAt   DateTime           @updatedAt
-//
-//   @@index([isActive, order])
-//   @@index([leaderId])
-// }
-//
-// model TeamMember {
-//   id         String      @id @default(uuid())
-//   name       String
-//   title      String
-//   bio        String?
-//   photo      String?
-//   order      Int         @default(0)
-//   isActive   Boolean     @default(true)
-//   email      String?
-//   createdAt  DateTime    @default(now())
-//   updatedAt  DateTime    @updatedAt
-//   ministries Ministry[]
-//
-//   @@index([isActive, order])
-// }
-//
-// model ContentBlock {
-//   id        String   @id @default(uuid())
-//   page      String
-//   key       String
-//   value     String
-//   type      String   @default("text")
-//   updatedAt DateTime @updatedAt
-//
-//   @@unique([page, key])
-//   @@index([page])
-// }
-//
-// model ChurchDocument {
-//   id          String   @id @default(uuid())
-//   title       String
-//   description String?
-//   fileUrl     String
-//   category    String   @default("other")
-//   isPublic    Boolean  @default(true)
-//   uploadedAt  DateTime @default(now())
-//   updatedAt   DateTime @updatedAt
-// }
-//
-// model FellowshipGroup {
-//   id          String        @id @default(uuid())
-//   name        String
-//   description String?
-//   leader      String?
-//   isActive    Boolean       @default(true)
-//   order       Int           @default(0)
-//   members     ChurchMember[]
-//   createdAt   DateTime      @default(now())
-//   updatedAt   DateTime      @updatedAt
-//
-//   @@index([isActive, order])
-// }
-//
-// model ChurchMember {
-//   id                       String             @id @default(uuid())
-//   status                   String             @default("pending")
-//   mainName                 String
-//   mainEmail                String
-//   mainPhone                String?
-//   mainBirthday             DateTime?
-//   mainOccupation           String?
-//   mainEmploymentStatus     String?
-//   mainDateOfSalvation      DateTime?
-//   mainDateOfWaterBaptism   DateTime?
-//   mainHolySpiritBaptism    Boolean            @default(false)
-//   spouseName               String?
-//   spouseEmail              String?
-//   spousePhone              String?
-//   spouseBirthday           DateTime?
-//   spouseOccupation         String?
-//   spouseEmploymentStatus   String?
-//   spouseDateOfSalvation    DateTime?
-//   spouseDateOfWaterBaptism DateTime?
-//   spouseHolySpiritBaptism  Boolean?
-//   homeAddress              String?
-//   inFellowshipGroup        Boolean            @default(false)
-//   fellowshipGroupId        String?
-//   fellowshipGroup          FellowshipGroup?   @relation(fields: [fellowshipGroupId], references: [id], onDelete: SetNull)
-//   membershipConfirmed      Boolean            @default(false)
-//   notes                    String?
-//   appliedAt                DateTime           @default(now())
-//   approvedAt               DateTime?
-//   createdAt                DateTime           @default(now())
-//   updatedAt                DateTime           @updatedAt
-//   children                 ChurchChild[]
-//   ministryInterests        MinistryInterest[]
-//   donations                Donation[]
-//
-//   @@index([status])
-//   @@index([mainEmail])
-//   @@index([fellowshipGroupId])
-// }
-//
-// model ChurchChild {
-//   id        String       @id @default(uuid())
-//   memberId  String
-//   name      String
-//   birthday  DateTime?
-//   member    ChurchMember @relation(fields: [memberId], references: [id], onDelete: Cascade)
-//
-//   @@index([memberId])
-// }
-//
-// model MinistryInterest {
-//   id         String       @id @default(uuid())
-//   memberId   String
-//   ministryId String
-//   forSpouse  Boolean      @default(false)
-//   member     ChurchMember @relation(fields: [memberId], references: [id], onDelete: Cascade)
-//   ministry   Ministry     @relation(fields: [ministryId], references: [id], onDelete: Cascade)
-//
-//   @@unique([memberId, ministryId, forSpouse])
-//   @@index([memberId])
-//   @@index([ministryId])
-// }
-//
-// model Donation {
-//   id              String        @id @default(uuid())
-//   donorName       String?
-//   donorEmail      String?
-//   donorPhone      String?
-//   amount          Float
-//   method          String
-//   reference       String?
-//   note            String?
-//   isAnonymous     Boolean       @default(false)
-//   linkedMemberId  String?
-//   linkedMember    ChurchMember? @relation(fields: [linkedMemberId], references: [id], onDelete: SetNull)
-//   createdAt       DateTime      @default(now())
-//   updatedAt       DateTime      @updatedAt
-//
-//   @@index([linkedMemberId])
-//   @@index([createdAt])
-//   @@index([method])
-// }
-
-// ─── Coupon codes ─────────────────────────────────────────────────────────────
-// A code gives a percentage, fixed-amount or 100% (comp) discount on a registration.
-// The discount is locked into a CouponRedemption when applied, like early-bird
-// tranches: later pricing refreshes never re-price it (see utils/coupons.js).
-
 enum CouponType {
  percent
  fixed
@@ -951,6 +858,215 @@ enum TicketDelivery {

 // One named person on a group registration, for one main-ticket place. Gets their
 // own quantity-1 ticket and their own attendee form response.
+/// An admin viewing the site as another user (strictly read-only, at most 30 minutes).
+model ImpersonationSession {
+  id           String                    @id @default(uuid())
+  adminId      String
+  targetUserId String
+  reason       String
+  startedAt    DateTime                  @default(now())
+  expiresAt    DateTime
+  endedAt      DateTime?
+  endedReason  String? // 'ended' | 'expired'
+  admin        User                      @relation("ImpersonationAdmin", fields: [adminId], references: [id], onDelete: Cascade)
+  target       User                      @relation("ImpersonationTarget", fields: [targetUserId], references: [id], onDelete: Cascade)
+  requests     ImpersonationRequestLog[]
+
+  @@index([adminId])
+  @@index([targetUserId])
+}
+
+/// Every page viewed and API call made during an impersonation session.
+model ImpersonationRequestLog {
+  id        String               @id @default(uuid())
+  sessionId String
+  method    String
+  path      String
+  blocked   Boolean              @default(false)
+  createdAt DateTime             @default(now())
+  session   ImpersonationSession @relation(fields: [sessionId], references: [id], onDelete: Cascade)
+
+  @@index([sessionId, createdAt])
+}
+
+/// First-party funnel tracking (only after cookie consent): one row per anonymous
+/// session, event and stage ('view' | 'start' | 'submit'). "Paid" comes from the
+/// registration that carries the session id. Rows older than 90 days are rolled up
+/// into AnalyticsDaily and deleted.
+model AnalyticsEvent {
+  id        String   @id @default(uuid())
+  sessionId String
+  eventId   String
+  stage     String
+  source    String?
+  device    String?
+  createdAt DateTime @default(now())
+  event     Event    @relation(fields: [eventId], references: [id], onDelete: Cascade)
+
+  @@unique([sessionId, eventId, stage])
+  @@index([eventId, createdAt])
+}
+
+/// Rolled-up funnel counts: sessions that reached `stage`, per day, source and device.
+model AnalyticsDaily {
+  id       String   @id @default(uuid())
+  eventId  String
+  day      DateTime @db.Date
+  stage    String
+  source   String   @default("direct")
+  device   String   @default("unknown")
+  sessions Int      @default(0)
+  event    Event    @relation(fields: [eventId], references: [id], onDelete: Cascade)
+
+  @@unique([eventId, day, stage, source, device])
+  @@index([eventId, day])
+}
+
+/// Post-event survey. Sent at sendAt to checked-in attendees (or everyone registered),
+/// with one reminder 3 days later. anonymous responses aren't linked to a person.
+model FeedbackForm {
+  id             String             @id @default(uuid())
+  eventId        String             @unique
+  sendAt         DateTime?
+  audience       String             @default("checked_in") // 'checked_in' | 'all'
+  anonymous      Boolean            @default(false)
+  intro          String?
+  sentAt         DateTime?
+  reminderSentAt DateTime?
+  createdAt      DateTime           @default(now())
+  updatedAt      DateTime           @updatedAt
+  event          Event              @relation(fields: [eventId], references: [id], onDelete: Cascade)
+  fields         FeedbackField[]
+  invites        FeedbackInvite[]
+  responses      FeedbackResponse[]
+}
+
+model FeedbackField {
+  id         String           @id @default(uuid())
+  formId     String
+  type       FormFieldType
+  label      String
+  isRequired Boolean          @default(false)
+  order      Int              @default(0)
+  helpText   String?
+  options    Json?
+  form       FeedbackForm     @relation(fields: [formId], references: [id], onDelete: Cascade)
+  answers    FeedbackAnswer[]
+
+  @@index([formId])
+}
+
+/// Who was asked. tokenHash is the HMAC of the link token (the token itself isn't stored).
+model FeedbackInvite {
+  id          String       @id @default(uuid())
+  formId      String
+  userId      String
+  tokenHash   String       @unique
+  sentAt      DateTime     @default(now())
+  remindedAt  DateTime?
+  respondedAt DateTime?
+  form        FeedbackForm @relation(fields: [formId], references: [id], onDelete: Cascade)
+  user        User         @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@unique([formId, userId])
+  @@index([userId])
+}
+
+model FeedbackResponse {
+  id        String           @id @default(uuid())
+  formId    String
+  userId    String? // null when the form is anonymous
+  createdAt DateTime         @default(now())
+  form      FeedbackForm     @relation(fields: [formId], references: [id], onDelete: Cascade)
+  user      User?            @relation(fields: [userId], references: [id], onDelete: SetNull)
+  answers   FeedbackAnswer[]
+
+  @@index([formId])
+}
+
+model FeedbackAnswer {
+  id         String           @id @default(uuid())
+  responseId String
+  fieldId    String
+  value      String
+  response   FeedbackResponse @relation(fields: [responseId], references: [id], onDelete: Cascade)
+  field      FeedbackField    @relation(fields: [fieldId], references: [id], onDelete: Cascade)
+
+  @@index([responseId])
+  @@index([fieldId])
+}
+
+/// A way of splitting an event's attendees up: "Rooms", "Small groups", "Buses".
+model AllocationSet {
+  id           String                 @id @default(uuid())
+  eventId      String
+  name         String
+  showOnTicket Boolean                @default(false)
+  order        Int                    @default(0)
+  createdAt    DateTime               @default(now())
+  updatedAt    DateTime               @updatedAt
+  event        Event                  @relation(fields: [eventId], references: [id], onDelete: Cascade)
+  groups       AllocationGroup[]
+  assignments  AllocationAssignment[]
+
+  @@index([eventId])
+}
+
+/// One room / group / bus in a set. gender ('male' | 'female') restricts who can join.
+model AllocationGroup {
+  id           String                 @id @default(uuid())
+  setId        String
+  name         String
+  capacity     Int?
+  gender       String?
+  leaderUserId String?
+  order        Int                    @default(0)
+  createdAt    DateTime               @default(now())
+  updatedAt    DateTime               @updatedAt
+  set          AllocationSet          @relation(fields: [setId], references: [id], onDelete: Cascade)
+  leader       User?                  @relation("AllocationGroupLeader", fields: [leaderUserId], references: [id], onDelete: SetNull)
+  assignments  AllocationAssignment[]
+
+  @@index([setId])
+  @@index([leaderUserId])
+}
+
+/// An attendee placed in a group. One group per set.
+model AllocationAssignment {
+  id         String          @id @default(uuid())
+  setId      String
+  groupId    String
+  attendeeId String
+  createdAt  DateTime        @default(now())
+  set        AllocationSet   @relation(fields: [setId], references: [id], onDelete: Cascade)
+  group      AllocationGroup @relation(fields: [groupId], references: [id], onDelete: Cascade)
+  attendee   Attendee        @relation(fields: [attendeeId], references: [id], onDelete: Cascade)
+
+  @@unique([setId, attendeeId])
+  @@index([groupId])
+  @@index([attendeeId])
+}
+
+/// A ticket handed to someone else. oldQrCode is the code that stopped working (null
+/// when one place was split off a shared group ticket, whose code stays valid).
+model TicketTransfer {
+  id             String   @id @default(uuid())
+  ticketId       String
+  fromHolderName String
+  fromUserId     String?
+  toName         String
+  toUserId       String?
+  byUserId       String?
+  oldQrCode      String?
+  createdAt      DateTime @default(now())
+  ticket         Ticket   @relation(fields: [ticketId], references: [id], onDelete: Cascade)
+  toUser         User?    @relation("TransferRecipient", fields: [toUserId], references: [id], onDelete: SetNull)
+  byUser         User?    @relation("TransferActor", fields: [byUserId], references: [id], onDelete: SetNull)
+
+  @@index([ticketId])
+  @@index([oldQrCode])
+}
+
 model Attendee {
  id                   String              @id @default(uuid())
  registrationId       String
@@ -963,6 +1079,9 @@ model Attendee {
  userId               String? // existing account matched by email/phone
  dateOfBirth          DateTime?
  gender               String?
+  parentName           String?
+  parentEmail          String?
+  parentPhone          String?
  order                Int                 @default(0)
  createdAt            DateTime            @default(now())
  updatedAt            DateTime            @updatedAt
@@ -971,8 +1090,140 @@ model Attendee {
  user                 User?               @relation(fields: [userId], references: [id], onDelete: SetNull)
  ticket               Ticket?
  formResponses        FormResponse[]
+  consentRequests      ConsentRequest[]
+  allocations          AllocationAssignment[]

  @@index([registrationId])
  @@index([registrationOptionId])
  @@index([userId])
 }
+
+// ─── Parental consent ─────────────────────────────────────────────────────────
+
+enum ConsentStatus {
+  pending
+  given
+  declined
+}
+
+// A request for a parent/guardian to consent for one under-18 attendee. Only the hash
+// of the link token is stored. A new request (e.g. after the consent text changes)
+// supersedes earlier ones for the same attendee; the latest one decides check-in.
+model ConsentRequest {
+  id              String        @id @default(uuid())
+  attendeeId      String
+  eventId         String
+  tokenHash       String        @unique
+  status          ConsentStatus @default(pending)
+  textVersion     Int
+  consentText     String // the exact text the parent was shown
+  parentName      String?
+  parentEmail     String?
+  parentPhone     String?
+  signedName      String?
+  ip              String?
+  device          String?
+  medical         String? // encrypted JSON (utils/encryption.js); purged after the event
+  emergency       String? // encrypted JSON; purged after the event
+  photoConsent    Boolean?
+  respondedAt     DateTime?
+  lastSentAt      DateTime      @default(now())
+  remindersSent   Int           @default(0)
+  expiresAt       DateTime
+  medicalPurgedAt DateTime?
+  createdAt       DateTime      @default(now())
+  attendee        Attendee      @relation(fields: [attendeeId], references: [id], onDelete: Cascade)
+  event           Event         @relation(fields: [eventId], references: [id], onDelete: Cascade)
+
+  @@index([attendeeId, createdAt])
+  @@index([eventId, status])
+}
+
+// ─── Waitlist ─────────────────────────────────────────────────────────────────
+
+enum WaitlistStatus {
+  waiting
+  offered // places held for them until offerExpiresAt
+  claimed // they registered with the offer
+  expired // the offer ran out
+  removed // taken off by staff
+  left // they left the waitlist
+}
+
+model WaitlistEntry {
+  id              String         @id @default(uuid())
+  eventId         String
+  eventOptionId   String
+  variantId       String?
+  userId          String
+  quantity        Int
+  position        Int
+  status          WaitlistStatus @default(waiting)
+  offeredQuantity Int?
+  offerTokenHash  String?        @unique
+  offeredAt       DateTime?
+  offerExpiresAt  DateTime?
+  claimedAt       DateTime?
+  registrationId  String?
+  createdAt       DateTime       @default(now())
+  updatedAt       DateTime       @updatedAt
+  event           Event          @relation(fields: [eventId], references: [id], onDelete: Cascade)
+  eventOption     EventOption    @relation(fields: [eventOptionId], references: [id], onDelete: Cascade)
+  variant         OptionVariant? @relation(fields: [variantId], references: [id], onDelete: Cascade)
+  user            User           @relation(fields: [userId], references: [id], onDelete: Cascade)
+  registration    Registration?  @relation(fields: [registrationId], references: [id], onDelete: SetNull)
+
+  @@index([eventId, status, position])
+  @@index([eventOptionId, status])
+  @@index([variantId])
+  @@index([userId])
+  @@index([registrationId])
+}
+
+// ─── Offline scanning ─────────────────────────────────────────────────────────
+
+// Locks a section (or the whole event, sectionId null) to one device for offline
+// scanning, so two devices can never redeem the same ticket while offline.
+// One active (releasedAt null) lock per scope — enforced in utils/scanLocks.js.
+model ScanLock {
+  id                String              @id @default(uuid())
+  eventId           String
+  sectionId         String?
+  deviceId          String
+  deviceName        String?
+  userId            String
+  lockedAt          DateTime            @default(now())
+  snapshotAt        DateTime?
+  lastSyncAt        DateTime?
+  releasedAt        DateTime?
+  forceReleasedById String?
+  event             Event               @relation(fields: [eventId], references: [id], onDelete: Cascade)
+  section           Section?            @relation(fields: [sectionId], references: [id], onDelete: Cascade)
+  user              User                @relation("ScanLockOwner", fields: [userId], references: [id], onDelete: Cascade)
+  forceReleasedBy   User?               @relation("ScanLockForcedBy", fields: [forceReleasedById], references: [id], onDelete: SetNull)
+  usages            TicketUsage[]
+  syncReports       OfflineSyncReport[]
+
+  @@index([eventId, releasedAt])
+  @@index([userId])
+  @@index([sectionId])
+  @@index([forceReleasedById])
+}
+
+// One sync of queued offline scans; `conflicts` lists scans that needed a person to look.
+model OfflineSyncReport {
+  id                String    @id @default(uuid())
+  scanLockId        String
+  accepted          Int       @default(0)
+  duplicates        Int       @default(0)
+  conflicts         Json      @default("[]")
+  afterForceRelease Boolean   @default(false)
+  createdAt         DateTime  @default(now())
+  reviewedAt        DateTime?
+  reviewedById      String?
+  scanLock          ScanLock  @relation(fields: [scanLockId], references: [id], onDelete: Cascade)
+  reviewedBy        User?     @relation("SyncReportReviewer", fields: [reviewedById], references: [id], onDelete: SetNull)
+
+  @@index([scanLockId])
+  @@index([reviewedById])
+}
@@ -0,0 +1,323 @@
+const prisma = require('../config/db');
+const { safeErrorMessage } = require('../utils/errorUtils');
+const { logAdminAction } = require('../utils/adminAudit');
+const { getClientIp } = require('../utils/requestUtils');
+const { allocationError, cleanGender, joinBlocker, autoAllocate } = require('../utils/allocation');
+
+const SUPERVISORS = ['admin', 'supervisor'];
+const fail = (res, error) => res.status(error.statusCode || (res.statusCode === 200 ? 400 : res.statusCode)).json({ message: safeErrorMessage(error) });
+
+const cleanName = (v, what) => {
+  const name = String(v || '').trim();
+  if (!name) throw allocationError(`Enter a name for the ${what}.`);
+  return name.slice(0, 100);
+};
+const cleanCapacity = (v) => {
+  if (v === undefined || v === null || v === '') return null;
+  const n = parseInt(v, 10);
+  if (!Number.isFinite(n) || n < 1 || n > 10000) throw allocationError('Capacity must be a whole number of at least 1.');
+  return n;
+};
+
+/** Named attendees on the event's live registrations. */
+async function eventAttendees(eventId) {
+  return prisma.attendee.findMany({
+    where: { registration: { eventId, status: { not: 'cancelled' } } },
+    select: {
+      id: true, name: true, gender: true, dateOfBirth: true, registrationId: true, email: true, phone: true,
+      registration: { select: { user: { select: { name: true } } } },
+    },
+    orderBy: [{ registrationId: 'asc' }, { order: 'asc' }],
+  });
+}
+
+async function loadSet(id) {
+  const set = await prisma.allocationSet.findUnique({ where: { id }, include: { groups: { orderBy: { order: 'asc' } } } });
+  if (!set) throw allocationError('Allocation set not found', 404);
+  return set;
+}
+
+// @desc    Everything the allocation board needs for an event
+// @route   GET /api/allocations/event/:eventId
+// @access  Private/Supervisor
+const getBoard = async (req, res) => {
+  try {
+    const event = await prisma.event.findUnique({
+      where: { id: req.params.eventId },
+      select: { id: true, title: true, startDate: true, collectGender: true, allowNamedAttendees: true, requiresParentalConsent: true },
+    });
+    if (!event) throw allocationError('Event not found', 404);
+    const [sets, attendees, leaders, places] = await Promise.all([
+      prisma.allocationSet.findMany({
+        where: { eventId: event.id },
+        include: { groups: { orderBy: { order: 'asc' }, include: { leader: { select: { id: true, name: true } } } }, assignments: { select: { attendeeId: true, groupId: true } } },
+        orderBy: [{ order: 'asc' }, { createdAt: 'asc' }],
+      }),
+      eventAttendees(event.id),
+      prisma.user.findMany({ where: { role: { in: ['staff', 'supervisor', 'admin'] }, isActive: true }, select: { id: true, name: true }, orderBy: { name: 'asc' } }),
+      prisma.registrationOption.aggregate({
+        where: { registration: { eventId: event.id, status: { not: 'cancelled' } }, eventOption: { isMainTicket: true } },
+        _sum: { quantity: true },
+      }),
+    ]);
+    res.json({
+      event,
+      sets,
+      attendees: attendees.map(a => ({ id: a.id, name: a.name, gender: a.gender, dateOfBirth: a.dateOfBirth, registrationId: a.registrationId, bookedBy: a.registration.user?.name || '' })),
+      leaders,
+      unnamedPlaces: Math.max(0, (places._sum.quantity || 0) - attendees.length),
+    });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @route POST /api/allocations/sets   { eventId, name, showOnTicket? }
+const createSet = async (req, res) => {
+  try {
+    const { eventId, name, showOnTicket } = req.body || {};
+    if (!(await prisma.event.findUnique({ where: { id: String(eventId || '') }, select: { id: true } }))) throw allocationError('Event not found', 404);
+    const order = await prisma.allocationSet.count({ where: { eventId } });
+    res.status(201).json(await prisma.allocationSet.create({ data: { eventId, name: cleanName(name, 'set'), showOnTicket: showOnTicket === true, order } }));
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @route PUT /api/allocations/sets/:id   { name?, showOnTicket? }
+const updateSet = async (req, res) => {
+  try {
+    await loadSet(req.params.id);
+    const { name, showOnTicket } = req.body || {};
+    res.json(await prisma.allocationSet.update({
+      where: { id: req.params.id },
+      data: { ...(name !== undefined ? { name: cleanName(name, 'set') } : {}), ...(showOnTicket !== undefined ? { showOnTicket: showOnTicket === true } : {}) },
+    }));
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @route DELETE /api/allocations/sets/:id
+const deleteSet = async (req, res) => {
+  try {
+    await loadSet(req.params.id);
+    await prisma.allocationSet.delete({ where: { id: req.params.id } });
+    res.json({ message: 'Deleted' });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+async function groupData(body, setId, existing = null) {
+  const { name, capacity, gender, leaderUserId } = body || {};
+  const data = {};
+  if (name !== undefined || !existing) data.name = cleanName(name, 'group');
+  if (capacity !== undefined) data.capacity = cleanCapacity(capacity);
+  if (gender !== undefined) data.gender = cleanGender(gender);
+  if (leaderUserId !== undefined) {
+    if (leaderUserId) {
+      const leader = await prisma.user.findUnique({ where: { id: String(leaderUserId) }, select: { role: true } });
+      if (!leader || !['staff', 'supervisor', 'admin'].includes(leader.role)) throw allocationError('A group leader must be a staff member.');
+    }
+    data.leaderUserId = leaderUserId || null;
+  }
+  // Changing capacity or gender mustn't leave the group over capacity or mixed.
+  if (existing && (data.capacity !== undefined || data.gender !== undefined)) {
+    const members = await prisma.allocationAssignment.findMany({ where: { groupId: existing.id }, include: { attendee: { select: { name: true, gender: true } } } });
+    const next = { ...existing, ...data };
+    const blocker = joinBlocker(next, 0, members.map(m => m.attendee));
+    if (blocker) throw allocationError(`${blocker} Move people out first.`);
+  }
+  return data;
+}
+
+// @route POST /api/allocations/sets/:id/groups   { name, capacity?, gender?, leaderUserId? }
+const createGroup = async (req, res) => {
+  try {
+    const set = await loadSet(req.params.id);
+    const data = await groupData(req.body, set.id);
+    res.status(201).json(await prisma.allocationGroup.create({ data: { ...data, setId: set.id, order: set.groups.length } }));
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @route PUT /api/allocations/groups/:id
+const updateGroup = async (req, res) => {
+  try {
+    const group = await prisma.allocationGroup.findUnique({ where: { id: req.params.id } });
+    if (!group) throw allocationError('Group not found', 404);
+    const data = await groupData(req.body, group.setId, group);
+    res.json(await prisma.allocationGroup.update({ where: { id: group.id }, data }));
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @route DELETE /api/allocations/groups/:id   (its people go back to unassigned)
+const deleteGroup = async (req, res) => {
+  try {
+    await prisma.allocationGroup.delete({ where: { id: req.params.id } });
+    res.json({ message: 'Deleted' });
+  } catch (error) {
+    if (error.code === 'P2025') return res.status(404).json({ message: 'Group not found' });
+    fail(res, error);
+  }
+};
+
+// @desc    Put an attendee in a group (groupId null = unassign)
+// @route   PUT /api/allocations/sets/:id/assignments   { attendeeId, groupId }
+const assign = async (req, res) => {
+  try {
+    const set = await loadSet(req.params.id);
+    const { attendeeId, groupId } = req.body || {};
+    const attendee = await prisma.attendee.findFirst({
+      where: { id: String(attendeeId || ''), registration: { eventId: set.eventId, status: { not: 'cancelled' } } },
+      select: { id: true, name: true, gender: true },
+    });
+    if (!attendee) throw allocationError('Attendee not found for this event', 404);
+    if (!groupId) {
+      await prisma.allocationAssignment.deleteMany({ where: { setId: set.id, attendeeId: attendee.id } });
+      return res.json({ message: 'Unassigned' });
+    }
+    const group = set.groups.find(g => g.id === groupId);
+    if (!group) throw allocationError('Group not found in this set', 404);
+    await prisma.$transaction(async (tx) => {
+      await tx.$executeRaw`SELECT pg_advisory_xact_lock(hashtext(${'alloc:' + group.id}))`;
+      const count = await tx.allocationAssignment.count({ where: { groupId: group.id, NOT: { attendeeId: attendee.id } } });
+      const blocker = joinBlocker(group, count, [attendee]);
+      if (blocker) throw allocationError(blocker);
+      await tx.allocationAssignment.upsert({
+        where: { setId_attendeeId: { setId: set.id, attendeeId: attendee.id } },
+        update: { groupId: group.id },
+        create: { setId: set.id, groupId: group.id, attendeeId: attendee.id },
+      });
+    });
+    res.json({ message: `${attendee.name} → ${group.name}` });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    Place everyone not yet in a group
+// @route   POST /api/allocations/sets/:id/auto   { mode: 'together' | 'split' }
+const autoAssign = async (req, res) => {
+  try {
+    const set = await loadSet(req.params.id);
+    if (set.groups.length === 0) throw allocationError('Add some groups first.');
+    const mode = req.body?.mode === 'split' ? 'split' : 'together';
+    const result = await prisma.$transaction(async (tx) => {
+      await tx.$executeRaw`SELECT pg_advisory_xact_lock(hashtext(${'allocset:' + set.id}))`;
+      const [attendees, existing] = await Promise.all([
+        eventAttendees(set.eventId),
+        tx.allocationAssignment.findMany({ where: { setId: set.id } }),
+      ]);
+      const r = autoAllocate({ groups: set.groups, attendees, assigned: new Map(existing.map(a => [a.attendeeId, a.groupId])), mode });
+      if (r.placements.length) {
+        await tx.allocationAssignment.createMany({ data: r.placements.map(p => ({ setId: set.id, groupId: p.groupId, attendeeId: p.attendeeId })), skipDuplicates: true });
+      }
+      return r;
+    });
+    res.json({
+      placed: result.placements.length,
+      unplaced: result.unplaced.length,
+      message: `${result.placements.length} placed${result.unplaced.length ? `; ${result.unplaced.length} couldn't be placed (groups full, or gender doesn't match)` : ''}.`,
+    });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @route DELETE /api/allocations/sets/:id/assignments   (clear the whole set)
+const clearAssignments = async (req, res) => {
+  try {
+    const set = await loadSet(req.params.id);
+    const { count } = await prisma.allocationAssignment.deleteMany({ where: { setId: set.id } });
+    res.json({ message: `${count} removed from groups.` });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+/** Members of groups, with contact and (for supervisors) medical details. */
+async function groupMembers(groupIds, { withMedical }) {
+  const assignments = await prisma.allocationAssignment.findMany({
+    where: { groupId: { in: groupIds } },
+    include: {
+      attendee: {
+        select: {
+          id: true, name: true, gender: true, dateOfBirth: true, phone: true, parentName: true, parentPhone: true,
+          registration: { select: { user: { select: { name: true, phoneNumber: true } } } },
+        },
+      },
+    },
+    orderBy: { attendee: { name: 'asc' } },
+  });
+  let consent = new Map();
+  if (withMedical && assignments.length) {
+    const { latestRequestsFor, openJson } = require('../utils/consent');
+    const latest = await latestRequestsFor(assignments.map(a => a.attendeeId));
+    consent = new Map([...latest].map(([id, r]) => [id, r.status === 'given' ? { medical: openJson(r.medical), emergency: openJson(r.emergency) } : null]));
+  }
+  return assignments.map(a => ({
+    groupId: a.groupId,
+    id: a.attendee.id,
+    name: a.attendee.name,
+    gender: a.attendee.gender,
+    dateOfBirth: a.attendee.dateOfBirth,
+    phone: a.attendee.phone,
+    parentName: a.attendee.parentName,
+    parentPhone: a.attendee.parentPhone,
+    bookedBy: a.attendee.registration.user?.name || '',
+    bookedByPhone: a.attendee.registration.user?.phoneNumber || null,
+    ...(withMedical ? consent.get(a.attendee.id) || {} : {}),
+  }));
+}
+
+// @desc    Lists for printing: every group of a set, with members
+// @route   GET /api/allocations/sets/:id/lists?medical=true
+// @access  Private/Supervisor
+const getSetLists = async (req, res) => {
+  try {
+    const set = await prisma.allocationSet.findUnique({
+      where: { id: req.params.id },
+      include: { event: { select: { id: true, title: true, startDate: true } }, groups: { orderBy: { order: 'asc' }, include: { leader: { select: { name: true } } } } },
+    });
+    if (!set) throw allocationError('Allocation set not found', 404);
+    const withMedical = req.query.medical === 'true';
+    const members = await groupMembers(set.groups.map(g => g.id), { withMedical });
+    if (withMedical) {
+      logAdminAction({ actorId: req.user.id, actorRole: req.user.role, action: 'medical_list_viewed', targetType: 'AllocationSet', targetId: set.id, metadata: { eventId: set.eventId, attendees: members.length }, ip: getClientIp(req) });
+    }
+    res.json({ set: { id: set.id, name: set.name }, event: set.event, groups: set.groups.map(g => ({ id: g.id, name: g.name, capacity: g.capacity, gender: g.gender, leader: g.leader?.name || null, members: members.filter(m => m.groupId === g.id) })) });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    Groups the signed-in staff member leads, with their people
+// @route   GET /api/allocations/my-groups
+// @access  Private/Staff
+const getMyGroups = async (req, res) => {
+  try {
+    const groups = await prisma.allocationGroup.findMany({
+      where: { leaderUserId: req.user.id, set: { event: { endDate: { gte: new Date(Date.now() - 7 * 864e5) } } } },
+      include: { set: { include: { event: { select: { id: true, title: true, startDate: true } } } } },
+      orderBy: [{ set: { event: { startDate: 'asc' } } }, { order: 'asc' }],
+    });
+    const withMedical = SUPERVISORS.includes(req.user.role);
+    const members = await groupMembers(groups.map(g => g.id), { withMedical });
+    if (withMedical && members.length) {
+      logAdminAction({ actorId: req.user.id, actorRole: req.user.role, action: 'medical_list_viewed', targetType: 'AllocationGroup', targetId: null, metadata: { groups: groups.length, attendees: members.length }, ip: getClientIp(req) });
+    }
+    res.json({
+      medicalShown: withMedical,
+      groups: groups.map(g => ({ id: g.id, name: g.name, capacity: g.capacity, gender: g.gender, setName: g.set.name, event: g.set.event, members: members.filter(m => m.groupId === g.id) })),
+    });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+module.exports = { getBoard, createSet, updateSet, deleteSet, createGroup, updateGroup, deleteGroup, assign, autoAssign, clearAssignments, getSetLists, getMyGroups };
@@ -0,0 +1,44 @@
+const prisma = require('../config/db');
+const { safeErrorMessage } = require('../utils/errorUtils');
+const { track, funnelFor } = require('../utils/analytics');
+
+// @desc    Record a funnel step (event page view, registration started)
+// @route   POST /api/analytics/track   { sessionId, eventId, stage: 'view'|'start', source? }
+// @access  Public — only sent by browsers whose visitor accepted cookies
+const trackStage = async (req, res) => {
+  try {
+    const { sessionId, eventId, stage, source } = req.body || {};
+    await track({ sessionId, eventId, stage, source, userAgent: req.headers['user-agent'] });
+  } catch (e) {
+    console.warn('[analytics] track failed:', e?.message || e);
+  }
+  // Always a quiet 204 — tracking must never get in a visitor's way.
+  res.status(204).end();
+};
+
+// @desc    Registration funnel for one or more events
+// @route   GET /api/analytics/funnel?eventIds=a,b&from=YYYY-MM-DD&to=YYYY-MM-DD
+// @access  Private/Supervisor
+const getFunnel = async (req, res) => {
+  try {
+    const eventIds = String(req.query.eventIds || '').split(',').map(s => s.trim()).filter(Boolean).slice(0, 50);
+    if (eventIds.length === 0) { res.status(400); throw new Error('Choose at least one event'); }
+    const events = await prisma.event.findMany({ where: { id: { in: eventIds } }, select: { id: true, title: true } });
+    const total = await funnelFor(eventIds, { from: req.query.from, to: req.query.to });
+    // Per event too, so events can be compared.
+    const perEvent = [];
+    if (events.length > 1) {
+      for (const ev of events) {
+        const f = await funnelFor([ev.id], { from: req.query.from, to: req.query.to });
+        perEvent.push({ eventId: ev.id, title: ev.title, totals: f.totals, conversion: f.conversion });
+      }
+    } else if (events[0]) {
+      perEvent.push({ eventId: events[0].id, title: events[0].title, totals: total.totals, conversion: total.conversion });
+    }
+    res.json({ ...total, perEvent });
+  } catch (error) {
+    res.status(res.statusCode === 200 ? 400 : res.statusCode).json({ message: safeErrorMessage(error) });
+  }
+};
+
+module.exports = { trackStage, getFunnel };
@@ -24,7 +24,7 @@ async function scheduleAutomations(req, res) {
        html: j.html ? String(j.html) : undefined,
        text: (!j.html && j.text) ? String(j.text) : (j.text ? String(j.text) : undefined),
        template: 'custom',
-        filter: { status: undefined, attendeeIds: undefined },
+        filter: { status: undefined, attendeeIds: undefined, ...(j.audience === 'sponsors' ? { audience: 'sponsors' } : {}) },
      };
      if (j.promoEventId && typeof j.promoEventId === 'string') {
        payload.promoEventId = j.promoEventId;
@@ -0,0 +1,264 @@
+const prisma = require('../config/db');
+const { safeErrorMessage } = require('../utils/errorUtils');
+const { logAdminAction } = require('../utils/adminAudit');
+const { getClientIp } = require('../utils/requestUtils');
+const { describeUserAgent } = require('../utils/userAgent');
+const {
+  isMinor, consentStatusFor, validateConsentAnswer, sealJson, openJson, latestRequestsFor,
+  findRequestByToken, resendConsentRequest, createConsentRequest,
+} = require('../utils/consent');
+
+const STAFF = ['admin', 'supervisor', 'staff'];
+const fail = (res, error) => res.status(error.statusCode || (res.statusCode === 200 ? 400 : res.statusCode)).json({ message: safeErrorMessage(error) });
+
+// What the parent sees — never the registrant's contact details or other attendees.
+function publicView(request) {
+  const ev = request.event;
+  const latestForAttendee = request._isLatest !== false;
+  return {
+    status: request.status,
+    superseded: !latestForAttendee,
+    expired: new Date(request.expiresAt) < new Date(),
+    respondedAt: request.respondedAt,
+    attendeeName: request.attendee.name,
+    parentName: request.parentName,
+    consentText: request.consentText,
+    textVersion: request.textVersion,
+    event: { title: ev.title, startDate: ev.startDate, endDate: ev.endDate, location: ev.location },
+    collect: { medical: ev.consentCollectMedical, emergency: ev.consentCollectEmergency, photo: ev.consentCollectPhoto },
+  };
+}
+
+// @desc    Consent page data for a parent/guardian
+// @route   GET /api/consent/:token
+// @access  Public (the token is the credential)
+const getConsent = async (req, res) => {
+  try {
+    const request = await findRequestByToken(req.params.token);
+    if (!request) { res.status(404); throw new Error('This consent link is not valid. It may have been replaced by a newer one — check your latest message.'); }
+    const latest = (await latestRequestsFor([request.attendeeId])).get(request.attendeeId);
+    res.json(publicView({ ...request, _isLatest: latest?.id === request.id }));
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    Give or decline consent
+// @route   POST /api/consent/:token
+// @access  Public (the token is the credential)
+const answerConsent = async (req, res) => {
+  try {
+    const request = await findRequestByToken(req.params.token);
+    if (!request) { res.status(404); throw new Error('This consent link is not valid.'); }
+    if (request.status !== 'pending') { res.status(409); throw new Error(`Consent has already been ${request.status}.`); }
+    if (new Date(request.expiresAt) < new Date()) { res.status(410); throw new Error('This consent link has expired because the event has ended.'); }
+    const latest = (await latestRequestsFor([request.attendeeId])).get(request.attendeeId);
+    if (latest?.id !== request.id) { res.status(409); throw new Error('A newer consent request replaced this one — please use the link in your latest message.'); }
+
+    let answer;
+    try { answer = validateConsentAnswer(req.body || {}, request.event); } catch (e) { res.status(400); throw e; }
+
+    // Only flips pending → answered once, even if the form is submitted twice at once.
+    const updated = await prisma.consentRequest.updateMany({
+      where: { id: request.id, status: 'pending' },
+      data: {
+        status: answer.decision === 'give' ? 'given' : 'declined',
+        signedName: answer.signedName,
+        ip: getClientIp(req),
+        device: describeUserAgent(req.headers['user-agent']),
+        medical: sealJson(answer.medical),
+        emergency: sealJson(answer.emergency),
+        photoConsent: answer.photoConsent,
+        respondedAt: new Date(),
+      },
+    });
+    if (updated.count !== 1) { res.status(409); throw new Error('Consent has already been answered.'); }
+
+    notifyConsentAnswered(request.id).catch(e => console.error('[consent] notify failed:', e?.message || e));
+    res.json({ message: answer.decision === 'give' ? 'Thank you — consent has been given.' : 'Thank you — consent has been declined.', status: answer.decision === 'give' ? 'given' : 'declined' });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// Tells the registrant and the event's notify recipients how a parent answered.
+async function notifyConsentAnswered(requestId) {
+  const request = await prisma.consentRequest.findUnique({
+    where: { id: requestId },
+    include: {
+      attendee: { include: { registration: { include: { user: { select: { id: true, name: true, email: true, phoneNumber: true, notificationPreference: true } } } } } },
+      event: { include: { createdBy: { select: { id: true, name: true, email: true } }, notifyRecipients: { select: { id: true, name: true, email: true } } } },
+    },
+  });
+  if (!request) return;
+  const { sendMail, emailWrapper } = require('../utils/email');
+  const { shouldEmail, waText } = require('../utils/notify');
+  const { buildEventNotifyRecipientList } = require('../utils/notifications');
+  const given = request.status === 'given';
+  const verb = given ? 'given' : 'declined';
+  const who = request.attendee.name;
+  const ev = request.event.title;
+  const payer = request.attendee.registration.user;
+  const line = given
+    ? `${request.signedName} gave parental consent for ${who} for ${ev}.`
+    : `${request.signedName} declined parental consent for ${who} for ${ev}. ${who} can't be checked in — please contact the organisers about a refund.`;
+
+  const sends = [];
+  const payerHasEmail = payer?.email && !payer.email.endsWith('@guest.local') && !payer.email.endsWith('@deleted.invalid');
+  if (payerHasEmail && shouldEmail(payer) && payer.email !== request.parentEmail) {
+    sends.push(sendMail({ to: payer.email, subject: `Consent ${verb} for ${who}`, html: emailWrapper(`<p>${line}</p>`), text: line }));
+  }
+  if (payer) sends.push(waText(payer, line));
+  const staff = buildEventNotifyRecipientList(request.event);
+  if (staff.length) {
+    sends.push(sendMail({ to: staff.join(','), subject: `Consent ${verb}: ${who} — ${ev}`, html: emailWrapper(`<p>${line}</p>`), text: line }));
+  }
+  await Promise.allSettled(sends);
+}
+
+/** One row per attendee on the event, with consent state — for the consent tracker. */
+async function consentRows(eventId) {
+  const event = await prisma.event.findUnique({ where: { id: eventId } });
+  if (!event) return { event: null, rows: [] };
+  const attendees = await prisma.attendee.findMany({
+    where: { registration: { eventId, status: { not: 'cancelled' } } },
+    include: { registration: { select: { id: true, status: true, user: { select: { id: true, name: true, email: true } } } } },
+    orderBy: [{ registrationId: 'asc' }, { order: 'asc' }],
+  });
+  const latest = await latestRequestsFor(attendees.map(a => a.id));
+  const rows = attendees.map(a => {
+    const r = latest.get(a.id) || null;
+    return {
+      attendeeId: a.id,
+      name: a.name,
+      dateOfBirth: a.dateOfBirth,
+      minor: isMinor(a.dateOfBirth, event.startDate),
+      parentName: a.parentName, parentEmail: a.parentEmail, parentPhone: a.parentPhone,
+      registrationId: a.registrationId,
+      registrationStatus: a.registration.status,
+      bookedBy: a.registration.user,
+      status: consentStatusFor(a, event, r),
+      request: r && {
+        id: r.id, status: r.status, textVersion: r.textVersion, signedName: r.signedName, respondedAt: r.respondedAt,
+        lastSentAt: r.lastSentAt, remindersSent: r.remindersSent, photoConsent: r.photoConsent,
+        outdated: r.status === 'given' && r.textVersion < (event.consentTextVersion || 1),
+      },
+    };
+  });
+  return { event, rows };
+}
+
+// @desc    Consent status for every attendee on an event
+// @route   GET /api/consent/events/:eventId
+// @access  Private/Staff
+const listEventConsent = async (req, res) => {
+  try {
+    const { event, rows } = await consentRows(req.params.eventId);
+    if (!event) { res.status(404); throw new Error('Event not found'); }
+    const counts = rows.reduce((c, r) => { c[r.status] = (c[r.status] || 0) + 1; return c; }, {});
+    res.json({
+      event: { id: event.id, title: event.title, startDate: event.startDate, requiresParentalConsent: event.requiresParentalConsent, consentTextVersion: event.consentTextVersion },
+      counts,
+      rows,
+    });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    Re-send one consent request (with a fresh link)
+// @route   POST /api/consent/requests/:id/resend
+// @access  Private (the registrant, or staff)
+const resendRequest = async (req, res) => {
+  try {
+    const request = await prisma.consentRequest.findUnique({ where: { id: req.params.id }, include: { attendee: { include: { registration: true } } } });
+    if (!request) { res.status(404); throw new Error('Consent request not found'); }
+    if (request.attendee.registration.userId !== req.user.id && !STAFF.includes(req.user.role)) { res.status(403); throw new Error('Not authorized'); }
+    const latest = (await latestRequestsFor([request.attendeeId])).get(request.attendeeId);
+    if (latest?.id !== request.id) { res.status(400); throw new Error('A newer consent request has replaced this one.'); }
+    const sent = await resendConsentRequest(request.id);
+    res.json({ message: sent.length ? `Consent request re-sent by ${sent.join(' and ')}.` : 'The consent request could not be sent — check the parent\'s email and phone.' });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    Re-send every consent request still pending on an event
+// @route   POST /api/consent/events/:eventId/resend-pending
+// @access  Private/Supervisor
+const resendPending = async (req, res) => {
+  try {
+    const { rows } = await consentRows(req.params.eventId);
+    const pending = rows.filter(r => r.status === 'pending' && r.request);
+    let sent = 0;
+    for (const r of pending) {
+      try { if ((await resendConsentRequest(r.request.id)).length) sent += 1; } catch {}
+    }
+    res.json({ message: `Re-sent ${sent} of ${pending.length} pending request(s).`, sent, pending: pending.length });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    Ask again for consent where it was given on an older version of the text,
+//          and for minors who never got a request (e.g. names added later)
+// @route   POST /api/consent/events/:eventId/rerequest
+// @access  Private/Supervisor
+const rerequestConsent = async (req, res) => {
+  try {
+    const { event, rows } = await consentRows(req.params.eventId);
+    if (!event) { res.status(404); throw new Error('Event not found'); }
+    if (!event.requiresParentalConsent) { res.status(400); throw new Error('This event does not need parental consent.'); }
+    const targets = rows.filter(r => r.minor && r.registrationStatus !== 'cancelled' && (r.status === 'missing' || r.request?.outdated));
+    let created = 0;
+    for (const r of targets) {
+      if (!r.parentEmail && !r.parentPhone) continue;
+      const attendee = await prisma.attendee.findUnique({ where: { id: r.attendeeId } });
+      await createConsentRequest(attendee, event);
+      created += 1;
+    }
+    logAdminAction({
+      actorId: req.user.id, actorRole: req.user.role, action: 'consent_rerequested',
+      targetType: 'Event', targetId: event.id, metadata: { requests: created, textVersion: event.consentTextVersion },
+      ip: getClientIp(req),
+    });
+    res.json({ message: `Sent ${created} new consent request(s).`, created });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    Medical & emergency list for an event (decrypted) — every view is audited
+// @route   GET /api/consent/events/:eventId/medical
+// @access  Private/Supervisor
+const medicalList = async (req, res) => {
+  try {
+    const event = await prisma.event.findUnique({ where: { id: req.params.eventId } });
+    if (!event) { res.status(404); throw new Error('Event not found'); }
+    const { rows } = await consentRows(event.id);
+    const ids = rows.map(r => r.request?.id).filter(Boolean);
+    const full = ids.length ? await prisma.consentRequest.findMany({ where: { id: { in: ids } } }) : [];
+    const byId = new Map(full.map(r => [r.id, r]));
+    const list = rows
+      .filter(r => r.request && byId.get(r.request.id)?.status === 'given')
+      .map(r => {
+        const fr = byId.get(r.request.id);
+        return {
+          name: r.name, dateOfBirth: r.dateOfBirth,
+          parentName: r.parentName, parentPhone: r.parentPhone, parentEmail: r.parentEmail,
+          medical: openJson(fr.medical), emergency: openJson(fr.emergency), photoConsent: fr.photoConsent,
+          purged: !!fr.medicalPurgedAt,
+        };
+      });
+    logAdminAction({
+      actorId: req.user.id, actorRole: req.user.role, action: 'medical_list_viewed',
+      targetType: 'Event', targetId: event.id, metadata: { attendees: list.length },
+      ip: getClientIp(req),
+    });
+    res.json({ event: { id: event.id, title: event.title, startDate: event.startDate }, rows: list });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+module.exports = { getConsent, answerConsent, listEventConsent, resendRequest, resendPending, rerequestConsent, medicalList };
@@ -44,7 +44,7 @@ function toAbsoluteUrl(req, url) {
 // @access  Private/Admin
 const createEvent = async (req, res) => {
  try {
-    const { title, description, startDate, endDate, registrationDeadline, goLiveAt, price, picture, redirectUrl, isHidden, requiresAuth, requiresRegistration, allowNamedAttendees, contactName, contactPhone, contactEmail, location } = req.body;
+    const { title, description, startDate, endDate, registrationDeadline, goLiveAt, price, picture, redirectUrl, isHidden, requiresAuth, requiresRegistration, allowNamedAttendees, requiresParentalConsent, consentText, consentCollectMedical, consentCollectEmergency, consentCollectPhoto, waitlistEnabled, waitlistOfferHours, waitlistPartialOffers, allowTicketTransfer, collectGender, allowSponsorships, sponsorshipGoalSpots, showSponsorshipProgress, contactName, contactPhone, contactEmail, location } = req.body;

    const data = {
      id: uuidv4(),
@@ -62,7 +62,21 @@ const createEvent = async (req, res) => {
      isHidden: isHidden === true || isHidden === 'true',
      requiresAuth: requiresAuth === false || requiresAuth === 'false' ? false : true,
      requiresRegistration: requiresRegistration === false || requiresRegistration === 'false' ? false : true,
-      allowNamedAttendees: allowNamedAttendees === true || allowNamedAttendees === 'true',
+      // A youth event needs names (with dates of birth), so it always takes them.
+      allowNamedAttendees: allowNamedAttendees === true || allowNamedAttendees === 'true' || requiresParentalConsent === true,
+      requiresParentalConsent: requiresParentalConsent === true,
+      consentText: consentText ? String(consentText) : null,
+      consentCollectMedical: consentCollectMedical === true,
+      consentCollectEmergency: consentCollectEmergency === true,
+      consentCollectPhoto: consentCollectPhoto === true,
+      waitlistEnabled: waitlistEnabled === true,
+      allowTicketTransfer: allowTicketTransfer !== false,
+      collectGender: collectGender === true,
+      allowSponsorships: allowSponsorships === true,
+      sponsorshipGoalSpots: sponsorshipGoalSpots ? Math.max(1, parseInt(sponsorshipGoalSpots, 10) || 0) || null : null,
+      showSponsorshipProgress: showSponsorshipProgress !== false,
+      waitlistOfferHours: Math.min(168, Math.max(1, parseInt(waitlistOfferHours, 10) || 24)),
+      waitlistPartialOffers: waitlistPartialOffers !== false,
      contactName: contactName || null,
      contactPhone: contactPhone || null,
      contactEmail: contactEmail || null,
@@ -213,12 +227,8 @@ const getEvents = async (req, res) => {
        const limitedOpts = (ev.eventOptions || []).filter(o => (o.stockLimit || 0) > 0);
        let isSoldOut = false;
        if (limitedOpts.length > 0) {
-          const soldCounts = await Promise.all(limitedOpts.map(opt =>
-            prisma.registrationOption.aggregate({
-              where: { eventOptionId: opt.id, registration: { status: { not: 'cancelled' } } },
-              _sum: { quantity: true },
-            }).then(r => r._sum?.quantity || 0)
-          ));
+          const { takenCount } = require('../utils/stock');
+          const soldCounts = await Promise.all(limitedOpts.map(opt => takenCount({ eventOptionId: opt.id })));
          isSoldOut = limitedOpts.every((opt, i) => soldCounts[i] >= opt.stockLimit);
        }
        return { ...ev, picture: toAbsoluteUrl(req, ev.picture), isSoldOut };
@@ -419,22 +429,15 @@ const getEventById = async (req, res) => {
    try {
      if (canIncludeVariants) {
        eventOptionsWithStock = await Promise.all((event.eventOptions || []).map(async opt => {
-          // Total sold quantity for this option (all non-cancelled)
-          const soldAgg = await prisma.registrationOption.aggregate({
-            where: { eventOptionId: opt.id, registration: { status: { not: 'cancelled' } } },
-            _sum: { quantity: true }
-          });
-          const soldCount = soldAgg._sum?.quantity || 0;
+          // Taken = non-cancelled registrations + places held for live waitlist offers
+          const { takenCount } = require('../utils/stock');
+          const soldCount = await takenCount({ eventOptionId: opt.id });
          const availableCount = opt.stockLimit > 0 ? Math.max(0, opt.stockLimit - soldCount) : null;

          // Per-variant stock
          const variantsWithStock = await Promise.all((opt.variants || []).map(async v => {
            if (!v.stockLimit) return { ...v, soldCount: 0, availableCount: null };
-            const vAgg = await prisma.registrationOption.aggregate({
-              where: { variantId: v.id, registration: { status: { not: 'cancelled' } } },
-              _sum: { quantity: true }
-            });
-            const vSold = vAgg._sum?.quantity || 0;
+            const vSold = await takenCount({ eventOptionId: opt.id, variantId: v.id });
            return { ...v, soldCount: vSold, availableCount: Math.max(0, v.stockLimit - vSold) };
          }));

@@ -538,7 +541,7 @@ const updateEvent = async (req, res) => {
      ip: getClientIp(req),
    });

-    const { title, description, startDate, endDate, registrationDeadline, goLiveAt, price, picture, isActive, redirectUrl, isHidden, requiresAuth, requiresRegistration, allowNamedAttendees, contactName, contactPhone, contactEmail, location } = req.body;
+    const { title, description, startDate, endDate, registrationDeadline, goLiveAt, price, picture, isActive, redirectUrl, isHidden, requiresAuth, requiresRegistration, allowNamedAttendees, requiresParentalConsent, consentText, consentCollectMedical, consentCollectEmergency, consentCollectPhoto, waitlistEnabled, waitlistOfferHours, waitlistPartialOffers, allowTicketTransfer, collectGender, allowSponsorships, sponsorshipGoalSpots, showSponsorshipProgress, contactName, contactPhone, contactEmail, location } = req.body;

    const data = {
      title: title || event.title,
@@ -553,7 +556,26 @@ const updateEvent = async (req, res) => {
      isHidden: isHidden !== undefined ? (isHidden === true || isHidden === 'true') : (event.isHidden ?? false),
      requiresAuth: requiresAuth !== undefined ? !(requiresAuth === false || requiresAuth === 'false') : (event.requiresAuth ?? true),
      requiresRegistration: requiresRegistration !== undefined ? !(requiresRegistration === false || requiresRegistration === 'false') : (event.requiresRegistration ?? true),
-      allowNamedAttendees: allowNamedAttendees !== undefined ? (allowNamedAttendees === true || allowNamedAttendees === 'true') : event.allowNamedAttendees,
+      allowNamedAttendees: (requiresParentalConsent ?? event.requiresParentalConsent) === true
+        ? true
+        : (allowNamedAttendees !== undefined ? (allowNamedAttendees === true || allowNamedAttendees === 'true') : event.allowNamedAttendees),
+      requiresParentalConsent: requiresParentalConsent !== undefined ? requiresParentalConsent === true : event.requiresParentalConsent,
+      consentCollectMedical: consentCollectMedical !== undefined ? consentCollectMedical === true : event.consentCollectMedical,
+      consentCollectEmergency: consentCollectEmergency !== undefined ? consentCollectEmergency === true : event.consentCollectEmergency,
+      consentCollectPhoto: consentCollectPhoto !== undefined ? consentCollectPhoto === true : event.consentCollectPhoto,
+      waitlistEnabled: waitlistEnabled !== undefined ? waitlistEnabled === true : event.waitlistEnabled,
+      allowTicketTransfer: allowTicketTransfer !== undefined ? allowTicketTransfer !== false : event.allowTicketTransfer,
+      collectGender: collectGender !== undefined ? collectGender === true : event.collectGender,
+      allowSponsorships: allowSponsorships !== undefined ? allowSponsorships === true : event.allowSponsorships,
+      sponsorshipGoalSpots: sponsorshipGoalSpots !== undefined ? (sponsorshipGoalSpots ? Math.max(1, parseInt(sponsorshipGoalSpots, 10) || 0) || null : null) : event.sponsorshipGoalSpots,
+      showSponsorshipProgress: showSponsorshipProgress !== undefined ? showSponsorshipProgress !== false : event.showSponsorshipProgress,
+      waitlistOfferHours: waitlistOfferHours !== undefined ? Math.min(168, Math.max(1, parseInt(waitlistOfferHours, 10) || 24)) : event.waitlistOfferHours,
+      waitlistPartialOffers: waitlistPartialOffers !== undefined ? waitlistPartialOffers !== false : event.waitlistPartialOffers,
+      // Editing the consent text starts a new version; parents who already agreed keep
+      // their record of the old one (supervisors can re-request consent).
+      ...(consentText !== undefined && String(consentText || '') !== String(event.consentText || '')
+        ? { consentText: consentText ? String(consentText) : null, consentTextVersion: (event.consentTextVersion || 1) + 1 }
+        : {}),
      contactName: contactName !== undefined ? (contactName || null) : event.contactName,
      contactPhone: contactPhone !== undefined ? (contactPhone || null) : event.contactPhone,
      contactEmail: contactEmail !== undefined ? (contactEmail || null) : event.contactEmail,
@@ -882,6 +904,10 @@ const updateEventOption = async (req, res) => {
      }
    }

+    if (stockLimit !== undefined || variants !== undefined) {
+      require('../utils/waitlist').queueWaitlist(eventOption.eventId);
+    }
+
    const refreshed = await prisma.eventOption.findUnique({
      where: { id: updatedEventOption.id },
      include: { earlyBirdTiers: true, variants: { orderBy: { order: 'asc' } } }
@@ -1313,6 +1339,11 @@ const emailEventAttendees = async (req, res) => {
      where.status = 'cancelled';
    }

+    // Only registrations with someone in this allocation group ("everyone on Bus 2").
+    if (filter?.allocationGroupId) {
+      where.attendees = { some: { allocations: { some: { groupId: String(filter.allocationGroupId) } } } };
+    }
+
    // Optional explicit attendee selection by userIds
    const attendeeIds = Array.isArray(filter?.attendeeIds) ? filter.attendeeIds.filter((x) => typeof x === 'string' && x.trim().length > 0) : [];
    if (attendeeIds.length > 0) {
@@ -1363,6 +1394,24 @@ const emailEventAttendees = async (req, res) => {
    }
    const recipients = Array.from(uniqMap.values());

+    // Sponsors of this event instead of its attendees (e.g. the post-event thank-you).
+    if (filter?.audience === 'sponsors') {
+      recipients.length = 0;
+      registrations.length = 0;
+      const sponsorships = await prisma.payment.findMany({
+        where: { eventId, isDonation: true, isSponsorship: true, amount: { gt: 0 } },
+        include: { user: { select: { name: true, email: true, isActive: true } } },
+        orderBy: { createdAt: 'asc' },
+      });
+      const seen = new Set();
+      for (const s of sponsorships) {
+        const email = (s.user?.email || '').trim();
+        if (!email || email.endsWith('@guest.local') || email.endsWith('@deleted.invalid') || seen.has(email)) continue;
+        seen.add(email);
+        recipients.push({ email, name: s.sponsorName || s.user?.name || '' });
+      }
+    }
+
    if (dryRun) {
      return res.json({ eventId, matched: recipients.length, recipients: recipients.slice(0, 20) });
    }
@@ -1551,6 +1600,11 @@ const whatsappEventAttendees = async (req, res) => {
      where.status = 'cancelled';
    }

+    // Only registrations with someone in this allocation group ("everyone on Bus 2").
+    if (filter?.allocationGroupId) {
+      where.attendees = { some: { allocations: { some: { groupId: String(filter.allocationGroupId) } } } };
+    }
+
    const attendeeIds = Array.isArray(filter?.attendeeIds) ? filter.attendeeIds.filter((x) => typeof x === 'string' && x.trim().length > 0) : [];
    if (attendeeIds.length > 0) {
      where.userId = { in: attendeeIds };
@@ -0,0 +1,179 @@
+const prisma = require('../config/db');
+const { safeErrorMessage } = require('../utils/errorUtils');
+const { ANSWERABLE, feedbackError, cleanFields, cleanAnswer, summarise, sendFeedbackInvites, findInviteByToken } = require('../utils/feedback');
+
+const fail = (res, error) => res.status(error.statusCode || (res.statusCode === 200 ? 400 : res.statusCode)).json({ message: safeErrorMessage(error) });
+const shape = (fields) => JSON.stringify(fields.map(f => [f.type, f.label, f.isRequired, f.options || null, f.helpText || null]));
+
+async function formWithStats(eventId) {
+  const form = await prisma.feedbackForm.findUnique({ where: { eventId }, include: { fields: { orderBy: { order: 'asc' } } } });
+  if (!form) return null;
+  const [invited, responses] = await Promise.all([
+    prisma.feedbackInvite.count({ where: { formId: form.id } }),
+    prisma.feedbackResponse.count({ where: { formId: form.id } }),
+  ]);
+  return { ...form, invited, responses };
+}
+
+// @desc    An event's feedback form (with invite/response counts)
+// @route   GET /api/feedback/event/:eventId
+// @access  Private/Supervisor
+const getEventFeedback = async (req, res) => {
+  try {
+    res.json(await formWithStats(req.params.eventId));
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    Create or update an event's feedback form
+// @route   PUT /api/feedback/event/:eventId   { sendAt, audience, anonymous, intro, fields[] }
+// @access  Private/Supervisor
+const saveEventFeedback = async (req, res) => {
+  try {
+    const event = await prisma.event.findUnique({ where: { id: req.params.eventId }, select: { id: true, endDate: true } });
+    if (!event) throw feedbackError('Event not found', 404);
+    const { sendAt, audience, anonymous, intro, fields } = req.body || {};
+    const clean = cleanFields(fields);
+    let when = null;
+    if (sendAt) {
+      when = new Date(sendAt);
+      if (isNaN(when.getTime())) throw feedbackError('Enter a valid send time.');
+    }
+    const data = {
+      sendAt: when,
+      audience: audience === 'all' ? 'all' : 'checked_in',
+      anonymous: anonymous === true,
+      intro: intro ? String(intro).slice(0, 2000) : null,
+    };
+
+    const existing = await prisma.feedbackForm.findUnique({ where: { eventId: event.id }, include: { fields: { orderBy: { order: 'asc' } } } });
+    if (!existing) {
+      await prisma.feedbackForm.create({ data: { ...data, eventId: event.id, fields: { create: clean } } });
+    } else {
+      const answered = await prisma.feedbackResponse.count({ where: { formId: existing.id } });
+      const changed = shape(existing.fields) !== shape(clean);
+      if (answered > 0 && changed) throw feedbackError('People have already answered this feedback form, so its questions can’t be changed.', 409);
+      await prisma.$transaction(async (tx) => {
+        await tx.feedbackForm.update({ where: { id: existing.id }, data: existing.sentAt ? { ...data, sendAt: existing.sendAt } : data });
+        if (changed) {
+          await tx.feedbackField.deleteMany({ where: { formId: existing.id } });
+          await tx.feedbackField.createMany({ data: clean.map(f => ({ ...f, formId: existing.id, options: f.options ?? undefined })) });
+        }
+      });
+    }
+    res.json(await formWithStats(event.id));
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @route DELETE /api/feedback/event/:eventId
+const deleteEventFeedback = async (req, res) => {
+  try {
+    await prisma.feedbackForm.deleteMany({ where: { eventId: req.params.eventId } });
+    res.json({ message: 'Feedback form removed' });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    Send the feedback form now (instead of waiting for its send time)
+// @route   POST /api/feedback/event/:eventId/send-now
+// @access  Private/Supervisor
+const sendNow = async (req, res) => {
+  try {
+    const form = await prisma.feedbackForm.findUnique({ where: { eventId: req.params.eventId } });
+    if (!form) throw feedbackError('This event has no feedback form.', 404);
+    if (!form.sentAt) await prisma.feedbackForm.update({ where: { id: form.id }, data: { sentAt: new Date(), sendAt: form.sendAt || new Date() } });
+    // Also invites anyone who checked in after the first send.
+    const invited = await sendFeedbackInvites(form.id);
+    res.json({ invited, message: invited ? `Feedback form sent to ${invited} ${invited === 1 ? 'person' : 'people'}.` : 'Everyone has already been sent the form.' });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    The form behind a personal feedback link
+// @route   GET /api/feedback/public/:token
+// @access  Public (link holder)
+const getPublicForm = async (req, res) => {
+  try {
+    const invite = await findInviteByToken(req.params.token);
+    if (!invite) throw feedbackError('This feedback link isn’t valid (it may have been replaced by a newer one).', 404);
+    const { form } = invite;
+    res.json({
+      event: form.event,
+      name: invite.user?.name || '',
+      intro: form.intro,
+      anonymous: form.anonymous,
+      responded: !!invite.respondedAt,
+      fields: form.fields.map(f => ({ id: f.id, type: f.type, label: f.label, isRequired: f.isRequired, helpText: f.helpText, options: f.options })),
+    });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    Submit feedback (once per person)
+// @route   POST /api/feedback/public/:token   { answers: { fieldId: value } }
+// @access  Public (link holder)
+const submitPublicForm = async (req, res) => {
+  try {
+    const invite = await findInviteByToken(req.params.token);
+    if (!invite) throw feedbackError('This feedback link isn’t valid (it may have been replaced by a newer one).', 404);
+    if (invite.respondedAt) throw feedbackError('Thanks — you’ve already given feedback for this event.', 409);
+    const answers = req.body?.answers || {};
+    const rows = [];
+    for (const f of invite.form.fields.filter(x => ANSWERABLE.includes(x.type))) {
+      const value = cleanAnswer(f, answers[f.id]);
+      if (value !== null) rows.push({ fieldId: f.id, value });
+    }
+    if (rows.length === 0) throw feedbackError('Please answer at least one question.');
+    await prisma.$transaction(async (tx) => {
+      // Claim the invite first, so a double-submit can't create two responses.
+      const claimed = await tx.feedbackInvite.updateMany({ where: { id: invite.id, respondedAt: null }, data: { respondedAt: new Date() } });
+      if (claimed.count !== 1) throw feedbackError('Thanks — you’ve already given feedback for this event.', 409);
+      await tx.feedbackResponse.create({
+        data: { formId: invite.formId, userId: invite.form.anonymous ? null : invite.userId, answers: { create: rows } },
+      });
+    });
+    res.status(201).json({ message: 'Thank you for your feedback!' });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    Feedback summary for one or more events (for the report, and comparisons)
+// @route   GET /api/feedback/summary?eventIds=a,b
+// @access  Private/Supervisor
+const getSummary = async (req, res) => {
+  try {
+    const ids = String(req.query.eventIds || '').split(',').map(s => s.trim()).filter(Boolean).slice(0, 50);
+    const forms = await prisma.feedbackForm.findMany({
+      where: { eventId: { in: ids } },
+      include: {
+        event: { select: { id: true, title: true, startDate: true } },
+        fields: { orderBy: { order: 'asc' } },
+        responses: { include: { answers: true, user: { select: { name: true } } } },
+        _count: { select: { invites: true } },
+      },
+    });
+    const out = forms.map(form => {
+      const answers = form.responses.flatMap(r => r.answers.map(a => ({ fieldId: a.fieldId, value: a.value, ...(form.anonymous ? {} : { name: r.user?.name || '' }) })));
+      const invited = form._count.invites;
+      return {
+        eventId: form.event.id, title: form.event.title, startDate: form.event.startDate,
+        anonymous: form.anonymous, sentAt: form.sentAt,
+        invited, responses: form.responses.length,
+        responseRate: invited ? Math.round((form.responses.length / invited) * 100) : null,
+        questions: summarise(form.fields, answers),
+      };
+    }).sort((a, b) => new Date(a.startDate) - new Date(b.startDate));
+    res.json(out);
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+module.exports = { getEventFeedback, saveEventFeedback, deleteEventFeedback, sendNow, getPublicForm, submitPublicForm, getSummary };
@@ -0,0 +1,108 @@
+const jwt = require('jsonwebtoken');
+const prisma = require('../config/db');
+const { safeErrorMessage } = require('../utils/errorUtils');
+const { logAdminAction } = require('../utils/adminAudit');
+const { getClientIp } = require('../utils/requestUtils');
+const { MAX_MINUTES, impersonationBlocker, logRequest } = require('../utils/impersonation');
+
+const fail = (res, error) => res.status(error.statusCode || (res.statusCode === 200 ? 400 : res.statusCode)).json({ message: safeErrorMessage(error) });
+const err = (message, statusCode = 400) => Object.assign(new Error(message), { statusCode });
+
+// @desc    Start viewing the site as a user (read-only, 30 minutes)
+// @route   POST /api/admin/impersonate/:userId   { reason }
+// @access  Private/Admin (with 2FA)
+const startImpersonation = async (req, res) => {
+  try {
+    if (req.readOnly) throw err('End the current impersonation first.', 403);
+    const reason = String(req.body?.reason || '').trim();
+    if (reason.length < 5) throw err('Give a reason (at least a few words) — it is recorded in the audit log.');
+    const target = await prisma.user.findUnique({ where: { id: req.params.userId }, select: { id: true, name: true, email: true, role: true, isActive: true, tokenVersion: true } });
+    const blocker = impersonationBlocker(req.user, target);
+    if (blocker) throw err(blocker, target ? 403 : 404);
+
+    // One live session per admin.
+    await prisma.impersonationSession.updateMany({ where: { adminId: req.user.id, endedAt: null }, data: { endedAt: new Date(), endedReason: 'replaced' } });
+    const expiresAt = new Date(Date.now() + MAX_MINUTES * 60 * 1000);
+    const session = await prisma.impersonationSession.create({ data: { adminId: req.user.id, targetUserId: target.id, reason: reason.slice(0, 500), expiresAt } });
+    const token = jwt.sign({ id: target.id, role: target.role, tokenVersion: target.tokenVersion, imp: session.id }, process.env.JWT_SECRET, { expiresIn: `${MAX_MINUTES}m` });
+
+    logAdminAction({
+      actorId: req.user.id, actorRole: req.user.role, action: 'impersonation_started', targetType: 'User', targetId: target.id,
+      metadata: { sessionId: session.id, reason: session.reason, targetName: target.name, expiresAt }, ip: getClientIp(req),
+    });
+
+    // Optional: tell the user (Site Settings → Security).
+    const { getSettingSync } = require('../utils/settingsCache');
+    if (getSettingSync('notify_user_on_impersonation', 'false') === 'true' && target.email && !target.email.endsWith('@guest.local')) {
+      const { sendMail } = require('../utils/email');
+      const orgName = getSettingSync('org_name', process.env.ORG_NAME || 'Cross Code');
+      sendMail({
+        to: target.email,
+        subject: `An administrator viewed your account — ${orgName}`,
+        text: `Hi ${target.name || 'there'},\n\nAn administrator at ${orgName} viewed your account (read-only) to help with support.\nReason given: ${session.reason}\n\nNothing was changed. If you have questions, reply to this email.\n\n${orgName}`,
+      }).catch(() => {});
+    }
+
+    res.status(201).json({ token, session: { id: session.id, expiresAt, target: { id: target.id, name: target.name, email: target.email, role: target.role } } });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    End impersonation (called with the impersonation token)
+// @route   POST /api/admin/impersonate/end
+// @access  Impersonation token
+const endImpersonation = async (req, res) => {
+  try {
+    const sessionId = req.impersonation?.id;
+    if (!sessionId) throw err('Not impersonating.', 400);
+    const s = await prisma.impersonationSession.update({ where: { id: sessionId }, data: { endedAt: new Date(), endedReason: 'ended' } });
+    const count = await prisma.impersonationRequestLog.count({ where: { sessionId } });
+    logAdminAction({
+      actorId: s.adminId, actorRole: 'admin', action: 'impersonation_ended', targetType: 'User', targetId: s.targetUserId,
+      metadata: { sessionId, minutes: Math.round((Date.now() - s.startedAt.getTime()) / 60000), requests: count }, ip: getClientIp(req),
+    });
+    res.json({ message: 'Impersonation ended.' });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    Record a page the admin viewed while impersonating
+// @route   POST /api/admin/impersonate/log   { path }
+// @access  Impersonation token
+const logPageView = async (req, res) => {
+  if (req.impersonation?.id) logRequest(req.impersonation.id, 'PAGE', String(req.body?.path || '').slice(0, 500));
+  res.status(204).end();
+};
+
+// @desc    The current impersonation session (for the banner)
+// @route   GET /api/admin/impersonate/current
+// @access  Impersonation token
+const currentImpersonation = async (req, res) => {
+  const s = req.impersonation;
+  if (!s) return res.json(null);
+  res.json({ id: s.id, expiresAt: s.expiresAt, target: { id: req.user.id, name: req.user.name, email: req.user.email } });
+};
+
+// @desc    Impersonation sessions with their request trail (audit log page)
+// @route   GET /api/admin/impersonation-sessions
+// @access  Private/Admin
+const listSessions = async (req, res) => {
+  try {
+    const sessions = await prisma.impersonationSession.findMany({
+      orderBy: { startedAt: 'desc' },
+      take: Math.min(parseInt(req.query.limit, 10) || 50, 200),
+      include: {
+        admin: { select: { name: true, email: true } },
+        target: { select: { name: true, email: true } },
+        requests: { orderBy: { createdAt: 'asc' }, take: 500, select: { method: true, path: true, blocked: true, createdAt: true } },
+      },
+    });
+    res.json(sessions);
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+module.exports = { startImpersonation, endImpersonation, logPageView, currentImpersonation, listSessions };
@@ -10,11 +10,24 @@ const { getClientIp } = require('../utils/requestUtils');
 const { buildCouponLines, previewCoupon, applyCouponToRegistration, recalculateRegistrationDiscount, releaseRegistrationCoupons, describeCoupon } = require('../utils/coupons');
 const { lineKey, validateAttendees, createAttendees, namedPlacesByKey } = require('../utils/attendees');
 const { findAccountByContact } = require('../utils/accountMatch');
+const { ensureConsentRequests } = require('../utils/consent');
+const { takenCount } = require('../utils/stock');
+const { findOfferByToken, queueWaitlist } = require('../utils/waitlist');
+
+// Youth events: send parental consent requests for any new under-18 attendees. Runs in
+// the background so a slow mail/WhatsApp send never holds up the registration.
+function queueConsentRequests(registrationId) {
+  ensureConsentRequests(registrationId).catch(e => console.error('[consent] Failed to send requests:', e?.message || e));
+}

 // Named attendees for API responses, with whether their ticket has been issued/used.
 const ATTENDEES_INCLUDE = {
  orderBy: { order: 'asc' },
-  include: { ticket: { select: { id: true, isUsed: true } } },
+  include: {
+    ticket: { select: { id: true, isUsed: true } },
+    // Latest consent request (youth events) — it decides check-in.
+    consentRequests: { orderBy: { createdAt: 'desc' }, take: 1, select: { id: true, status: true, respondedAt: true, lastSentAt: true, textVersion: true } },
+  },
 };

 const TICKET_DELIVERY = ['payer', 'each'];
@@ -73,33 +86,22 @@ async function priceRequestedOption(eventOption, variantId, qty, buyer) {
 }

 /**
- * Check overall stock availability for an EventOption.
+ * Check overall stock availability for an EventOption. Places held for live waitlist
+ * offers count as taken, except the offer being claimed (`excludeEntryId`).
 * Returns { available: boolean, remaining: number|null }
 */
-async function checkOptionStock(option, requestedQty) {
+async function checkOptionStock(option, requestedQty, excludeEntryId = null) {
  if (!option.stockLimit || option.stockLimit === 0) return { available: true, remaining: null };
-
-  const soldAgg = await prisma.registrationOption.aggregate({
-    where: { eventOptionId: option.id, registration: { status: { not: 'cancelled' } } },
-    _sum: { quantity: true }
-  });
-  const sold = soldAgg._sum?.quantity || 0;
-  const remaining = option.stockLimit - sold;
+  const remaining = option.stockLimit - await takenCount({ eventOptionId: option.id }, { excludeEntryId });
  return { available: remaining >= requestedQty, remaining };
 }

 /**
- * Check stock availability for a specific variant.
+ * Check stock availability for a specific variant (same rules as checkOptionStock).
 */
-async function checkVariantStock(variant, requestedQty) {
+async function checkVariantStock(variant, requestedQty, excludeEntryId = null) {
  if (!variant.stockLimit || variant.stockLimit === 0) return { available: true, remaining: null };
-
-  const soldAgg = await prisma.registrationOption.aggregate({
-    where: { variantId: variant.id, registration: { status: { not: 'cancelled' } } },
-    _sum: { quantity: true }
-  });
-  const sold = soldAgg._sum?.quantity || 0;
-  const remaining = variant.stockLimit - sold;
+  const remaining = variant.stockLimit - await takenCount({ eventOptionId: variant.eventOptionId, variantId: variant.id }, { excludeEntryId });
  return { available: remaining >= requestedQty, remaining };
 }

@@ -108,7 +110,7 @@ async function checkVariantStock(variant, requestedQty) {
 // @access  Private
 const createRegistration = async (req, res) => {
  try {
-    const { eventId, options, guestName, guestEmail, guestPhone, couponCode, attendees, ticketDelivery } = req.body;
+    const { eventId, options, guestName, guestEmail, guestPhone, couponCode, attendees, ticketDelivery, waitlistToken, analyticsSessionId } = req.body;

    // Check if event exists
    const canIncludeVariants = !!(prisma && prisma.optionVariant && typeof prisma.optionVariant.findMany === 'function');
@@ -136,15 +138,26 @@ const createRegistration = async (req, res) => {
      throw new Error('This event is closed and no longer accepting registrations.');
    }

+    // A waitlist claim link: its token identifies the person and releases the places
+    // held for them. It works without logging in, the same way a consent link does.
+    let waitlistOffer = null;
+    if (waitlistToken) {
+      waitlistOffer = await findOfferByToken(waitlistToken);
+      if (!waitlistOffer || waitlistOffer.eventId !== eventId) { res.status(400); throw new Error('This waitlist link is not valid.'); }
+      if (waitlistOffer.status !== 'offered') { res.status(400); throw new Error(`This waitlist offer has ${waitlistOffer.status === 'claimed' ? 'already been used' : 'expired'}.`); }
+      if (new Date(waitlistOffer.offerExpiresAt) < new Date()) { res.status(400); throw new Error('This waitlist offer has expired.'); }
+      if (req.user && req.user.id !== waitlistOffer.userId) { res.status(403); throw new Error('This waitlist offer belongs to someone else.'); }
+    }
+
    // Enforce auth unless event explicitly opts out
    const eventRequiresAuth = event.requiresAuth !== false;
-    if (eventRequiresAuth && !req.user) {
+    if (eventRequiresAuth && !req.user && !waitlistOffer) {
      res.status(401);
      throw new Error('Authentication required for this event');
    }

    // Unauthenticated guest registration is only permitted for free events
-    if (!req.user) {
+    if (!req.user && !waitlistOffer) {
      const totalDueCheck = (event.eventOptions || []).reduce((sum, eo) => sum + (eo.price || 0), 0);
      // Also check against the requested options specifically
      const requestedTotal = (options || []).reduce((sum, opt) => {
@@ -161,6 +174,8 @@ const createRegistration = async (req, res) => {
    let userId;
    if (req.user) {
      userId = req.user.id;
+    } else if (waitlistOffer) {
+      userId = waitlistOffer.userId;
    } else {
      // Guest registration: find existing user by email or create inactive placeholder
      if (!guestEmail || !guestName) {
@@ -223,7 +238,7 @@ const createRegistration = async (req, res) => {

      // Check overall option stock
      try {
-        const stockCheck = await checkOptionStock(eventOption, qty);
+        const stockCheck = await checkOptionStock(eventOption, qty, waitlistOffer?.id);
        if (!stockCheck.available) {
          const err = new Error(`"${eventOption.name}" is sold out or does not have enough stock (${stockCheck.remaining ?? 0} remaining).`);
          err.isStockError = true;
@@ -243,7 +258,7 @@ const createRegistration = async (req, res) => {
          throw new Error(`Variant not found for option "${eventOption.name}"`);
        }
        try {
-          const vStock = await checkVariantStock(variant, qty);
+          const vStock = await checkVariantStock(variant, qty, waitlistOffer?.id);
          if (!vStock.available) {
            const err = new Error(`Variant "${variant.name}" is sold out (${vStock.remaining ?? 0} remaining).`);
            err.isStockError = true;
@@ -260,7 +275,8 @@ const createRegistration = async (req, res) => {
      let priceSnapshot = null;
      let appliedTierId = null;
      if (canIncludeTiers) {
-        ({ priceSnapshot, appliedTierId } = await priceRequestedOption(eventOption, variantId, qty, req.user));
+        const buyer = req.user || (waitlistOffer ? await prisma.user.findUnique({ where: { id: waitlistOffer.userId }, select: { id: true, role: true } }) : null);
+        ({ priceSnapshot, appliedTierId } = await priceRequestedOption(eventOption, variantId, qty, buyer));
      } else {
        priceSnapshot = variantPrice !== null && variantPrice !== undefined ? variantPrice : null;
      }
@@ -399,7 +415,16 @@ const createRegistration = async (req, res) => {
      });
    }

-    if (cleanAttendees.length > 0) await createAttendees(registration.id, cleanAttendees);
+    if (cleanAttendees.length > 0) {
+      await createAttendees(registration.id, cleanAttendees);
+      queueConsentRequests(registration.id);
+    }
+    if (waitlistOffer) {
+      await prisma.waitlistEntry.update({
+        where: { id: waitlistOffer.id },
+        data: { status: 'claimed', claimedAt: new Date(), registrationId: registration.id, offerTokenHash: null },
+      });
+    }
    if (ticketDelivery) {
      await prisma.registration.update({ where: { id: registration.id }, data: { ticketDelivery } });
    }
@@ -478,6 +503,12 @@ const createRegistration = async (req, res) => {
      }
    })();

+    // Funnel: this registration came from a tracked (cookie-consented) visit.
+    if (analyticsSessionId) {
+      const { recordSubmit } = require('../utils/analytics');
+      recordSubmit(registration, analyticsSessionId).catch(e => console.warn('[analytics] submit not recorded:', e?.message || e));
+    }
+
    res.status(201).json({ ...attachComputedTotals(registration), ...(couponError ? { couponError } : {}) });
  } catch (error) {
    res.status(400).json({ message: error.message });
@@ -555,7 +586,7 @@ const getUserRegistrations = async (req, res) => {
      where: { ...whereClause, status: { in: ['pending', 'partial_paid'] } },
      select: { id: true }
    });
-    if (staleCandidates.length > 0) {
+    if (staleCandidates.length > 0 && !req.readOnly) {
      await Promise.all(staleCandidates.map(r => refreshPricingForRegistration(r.id).catch(() => {})));
    }

@@ -632,7 +663,7 @@ const getRegistrationById = async (req, res) => {

    // See getUserRegistrations — keep an unpaid/partially-paid registration's price current
    // whenever it's viewed, not just at payment time.
-    if (registration.status === 'pending' || registration.status === 'partial_paid') {
+    if ((registration.status === 'pending' || registration.status === 'partial_paid') && !req.readOnly) {
      await refreshPricingForRegistration(registration.id).catch(() => {});
      registration = await prisma.registration.findUnique({ where: { id: req.params.id }, include });
    }
@@ -724,6 +755,7 @@ const updateRegistrationStatus = async (req, res) => {
    // paths land under the one 'registration_cancelled' filter in the audit log.
    if (status === 'cancelled' && registration.status !== 'cancelled') {
      await releaseRegistrationCoupons(req.params.id);
+      queueWaitlist(registration.eventId);
      logAdminAction({
        actorId: req.user.id,
        actorRole: req.user.role,
@@ -809,6 +841,7 @@ const cancelRegistration = async (req, res) => {
      }
    });
    await releaseRegistrationCoupons(req.params.id);
+    queueWaitlist(registration.eventId);

    // Only log when staff cancels on someone else's behalf — a routine self-service
    // cancellation isn't an admin action worth cluttering the audit trail with.
@@ -843,7 +876,7 @@ const getRegistrationsByEvent = async (req, res) => {
      where: { eventId: req.params.eventId, status: { in: ['pending', 'partial_paid'] } },
      select: { id: true }
    });
-    if (staleCandidates.length > 0) {
+    if (staleCandidates.length > 0 && !req.readOnly) {
      await Promise.all(staleCandidates.map(r => refreshPricingForRegistration(r.id).catch(() => {})));
    }

@@ -918,7 +951,8 @@ const createManualRegistration = async (req, res) => {
      throw new Error('At least one option must be selected');
    }

-    // Validate each option up front, before any account is created or changed.
+    // Validate each option up front, before any account is created or changed —
+    // including stock, which staff registrations previously skipped.
    for (const option of options) {
      const eventOption = event.eventOptions.find(eo => eo.id === option.eventOptionId);
      if (!eventOption) {
@@ -929,6 +963,14 @@ const createManualRegistration = async (req, res) => {
        res.status(400);
        throw new Error('Quantity must be at least 1');
      }
+      const variant = option.variantId ? (eventOption.variants || []).find(v => v.id === option.variantId) : null;
+      const oStock = await checkOptionStock(eventOption, option.quantity);
+      const vStock = variant ? await checkVariantStock(variant, option.quantity) : { available: true };
+      if (!oStock.available || !vStock.available) {
+        res.status(400);
+        const left = Math.max(0, Math.min(oStock.remaining ?? Infinity, vStock.remaining ?? Infinity));
+        throw new Error(`"${eventOption.name}${variant ? ` (${variant.name})` : ''}" is sold out or does not have enough stock (${left} remaining). Raise the stock limit to add more.`);
+      }
    }

    // Pricing (appliedTierId + priceSnapshot) depends on who the attendee is — Staff and
@@ -1241,7 +1283,10 @@ const createManualRegistration = async (req, res) => {

    const registrationId = registration.id;

-    if (cleanAttendees.length > 0) await createAttendees(registrationId, cleanAttendees);
+    if (cleanAttendees.length > 0) {
+      await createAttendees(registrationId, cleanAttendees);
+      queueConsentRequests(registrationId);
+    }
    if (ticketDelivery) await prisma.registration.update({ where: { id: registrationId }, data: { ticketDelivery } });

    if (couponCode && !couponError) {
@@ -1491,6 +1536,15 @@ const updateRegistrationOptions = async (req, res) => {
      let removalPlan = null;

      if (delta > 0) {
+        // Adding places needs stock, like a new registration does.
+        const oStock = await checkOptionStock(eventOption, delta);
+        const variant = variantId ? (eventOption.variants || []).find(v => v.id === variantId) : null;
+        const vStock = variant ? await checkVariantStock(variant, delta) : { available: true };
+        if (!oStock.available || !vStock.available) {
+          res.status(400);
+          const left = Math.max(0, Math.min(oStock.remaining ?? Infinity, vStock.remaining ?? Infinity));
+          throw new Error(`Only ${left} more "${eventOption.name}${variant ? ` (${variant.name})` : ''}" available.`);
+        }
        ({ priceSnapshot, appliedTierId } = await priceRequestedOption(eventOption, variantId, delta, registration.user));
        newTotalDue += existingTotal + delta * (priceSnapshot || 0);
      } else if (delta < 0) {
@@ -1669,6 +1723,7 @@ const updateRegistrationOptions = async (req, res) => {

    const { sendRegistrationUpdatedEmails } = require('../utils/notifications');
    sendRegistrationUpdatedEmails(registrationId).catch(e => console.error('Failed to send registration updated emails:', e));
+    if (resolvedUpdateOptions.some(o => o.delta < 0) || oldByKey.size > newKeys.size) queueWaitlist(registration.eventId);

    // If registration is now paid, regenerate tickets and send them
    if (updated.status === 'paid') {
@@ -2171,6 +2226,7 @@ const updateAttendees = async (req, res) => {
            where: { id: a.id },
            data: {
              name: c.name, email: c.email, phone: c.phone,
+              dateOfBirth: c.dateOfBirth, gender: c.gender, parentName: c.parentName, parentEmail: c.parentEmail, parentPhone: c.parentPhone,
              ...(contactChanged ? { userId: match?.user?.id || null } : {}),
            },
          });
@@ -2182,6 +2238,8 @@ const updateAttendees = async (req, res) => {
      if (ticketDelivery) await tx.registration.update({ where: { id: registration.id }, data: { ticketDelivery } });
    });

+    queueConsentRequests(registration.id);
+
    // Paid registrations: re-sync tickets and send any new ones.
    if (registration.status === 'paid') {
      const created = await generateTicketsForRegistration(registration.id);
@@ -0,0 +1,151 @@
+const prisma = require('../config/db');
+const { safeErrorMessage } = require('../utils/errorUtils');
+const { logAdminAction } = require('../utils/adminAudit');
+const { getClientIp } = require('../utils/requestUtils');
+const { LOCK_INCLUDE, activeLocks, acquireLock, snapshotFor, syncScans } = require('../utils/scanLocks');
+
+const SUPERVISORS = ['admin', 'supervisor'];
+const fail = (res, error) => res.status(error.statusCode || (res.statusCode === 200 ? 400 : res.statusCode)).json({ message: safeErrorMessage(error) });
+const audit = (req, action, lock, metadata = {}) => logAdminAction({
+  actorId: req.user.id, actorRole: req.user.role, action, targetType: 'ScanLock', targetId: lock.id,
+  metadata: { eventId: lock.eventId, sectionId: lock.sectionId, deviceName: lock.deviceName, ...metadata },
+  ip: getClientIp(req),
+});
+
+const lockView = (l) => ({
+  id: l.id, eventId: l.eventId, sectionId: l.sectionId, sectionName: l.section?.name || null,
+  deviceId: l.deviceId, deviceName: l.deviceName, user: l.user, lockedAt: l.lockedAt,
+  snapshotAt: l.snapshotAt, lastSyncAt: l.lastSyncAt, releasedAt: l.releasedAt,
+});
+
+/** The lock, if the caller is the person holding it on this device. */
+async function ownLock(req, res) {
+  const lock = await prisma.scanLock.findUnique({ where: { id: req.params.id }, include: LOCK_INCLUDE });
+  if (!lock) { res.status(404); throw new Error('Offline lock not found'); }
+  const deviceId = req.body?.deviceId || req.query?.deviceId;
+  if (lock.userId !== req.user.id || lock.deviceId !== deviceId) { res.status(403); throw new Error('This offline lock belongs to another device.'); }
+  return lock;
+}
+
+// @desc    Active offline locks for an event
+// @route   GET /api/scan-locks?eventId=
+// @access  Private/Staff
+const listLocks = async (req, res) => {
+  try {
+    if (!req.query.eventId) { res.status(400); throw new Error('eventId is required'); }
+    res.json((await activeLocks(String(req.query.eventId))).map(lockView));
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    Lock a section (or the whole event) to this device for offline scanning
+// @route   POST /api/scan-locks   { eventId, sectionId?, deviceId, deviceName? }
+// @access  Private/Staff
+const createLock = async (req, res) => {
+  try {
+    const { eventId, sectionId, deviceId, deviceName } = req.body || {};
+    if (!eventId) { res.status(400); throw new Error('eventId is required'); }
+    const lock = await acquireLock({ eventId, sectionId: sectionId || null, deviceId, deviceName, userId: req.user.id });
+    audit(req, 'scan_lock_acquired', lock);
+    res.status(201).json(lockView(lock));
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    Download the tickets valid for this lock, for offline scanning
+// @route   GET /api/scan-locks/:id/snapshot?deviceId=
+// @access  Private/Staff (lock holder)
+const getSnapshot = async (req, res) => {
+  try {
+    const lock = await ownLock(req, res);
+    if (lock.releasedAt) { res.status(410); throw new Error('This offline lock has been released.'); }
+    res.json({ lock: lockView(lock), ...(await snapshotFor(lock)) });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    Upload scans made offline
+// @route   POST /api/scan-locks/:id/sync   { deviceId, scans: [{ clientScanId, qrCode, qty, scannedAt }] }
+// @access  Private/Staff (lock holder — also after a release, so nothing made offline is lost)
+const syncLock = async (req, res) => {
+  try {
+    const lock = await ownLock(req, res);
+    const result = await syncScans(lock, req.body?.scans);
+    if (result.accepted || result.conflicts.length) {
+      audit(req, 'offline_sync', lock, { accepted: result.accepted, conflicts: result.conflicts.length, duplicates: result.duplicates, afterForceRelease: !!lock.forceReleasedById });
+    }
+    res.json({ accepted: result.accepted, duplicates: result.duplicates, conflicts: result.conflicts, reportId: result.report.id, released: !!lock.releasedAt });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    End offline mode (the device should sync first)
+// @route   DELETE /api/scan-locks/:id   { deviceId }
+// @access  Private/Staff (lock holder)
+const releaseLock = async (req, res) => {
+  try {
+    const lock = await ownLock(req, res);
+    if (!lock.releasedAt) {
+      await prisma.scanLock.update({ where: { id: lock.id }, data: { releasedAt: new Date() } });
+      audit(req, 'scan_lock_released', lock);
+    }
+    res.json({ message: 'Offline mode ended.' });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    Release someone else's lock (e.g. a lost or flat phone)
+// @route   POST /api/scan-locks/:id/force-release
+// @access  Private/Supervisor
+const forceRelease = async (req, res) => {
+  try {
+    const lock = await prisma.scanLock.findUnique({ where: { id: req.params.id }, include: LOCK_INCLUDE });
+    if (!lock) { res.status(404); throw new Error('Offline lock not found'); }
+    if (lock.releasedAt) return res.json({ message: 'Already released.' });
+    await prisma.scanLock.update({ where: { id: lock.id }, data: { releasedAt: new Date(), forceReleasedById: req.user.id } });
+    audit(req, 'scan_lock_force_released', lock, { heldBy: lock.user?.name });
+    res.json({ message: `Released. If ${lock.user?.name || 'that device'} reconnects, its offline scans will still sync and be flagged for review.` });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    Offline sync reports for an event (with anything that needs review)
+// @route   GET /api/scan-locks/reports?eventId=&unreviewed=true
+// @access  Private/Supervisor
+const listReports = async (req, res) => {
+  try {
+    const where = {
+      scanLock: { eventId: String(req.query.eventId || '') },
+      ...(req.query.unreviewed === 'true' ? { reviewedAt: null } : {}),
+    };
+    const reports = await prisma.offlineSyncReport.findMany({
+      where,
+      include: { scanLock: { include: LOCK_INCLUDE }, reviewedBy: { select: { name: true } } },
+      orderBy: { createdAt: 'desc' },
+      take: 200,
+    });
+    res.json(reports.map(r => ({ ...r, scanLock: lockView(r.scanLock) })));
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    Mark a sync report as reviewed
+// @route   POST /api/scan-locks/reports/:id/review
+// @access  Private/Supervisor
+const reviewReport = async (req, res) => {
+  try {
+    const report = await prisma.offlineSyncReport.update({ where: { id: req.params.id }, data: { reviewedAt: new Date(), reviewedById: req.user.id } });
+    res.json(report);
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+module.exports = { SUPERVISORS, listLocks, createLock, getSnapshot, syncLock, releaseLock, forceRelease, listReports, reviewReport };
@@ -0,0 +1,112 @@
+const axios = require('axios');
+const prisma = require('../config/db');
+const { safeErrorMessage } = require('../utils/errorUtils');
+const { sponsorshipError, spotPrice, sponsorshipCharge, poolSummary } = require('../utils/sponsorship');
+
+const fail = (res, error) => res.status(error.statusCode || error.response?.status || 400).json({ message: safeErrorMessage(error) });
+
+async function sponsorableEvent(eventId) {
+  const event = await prisma.event.findUnique({ where: { id: String(eventId || '') }, include: { eventOptions: { select: { isMainTicket: true, price: true } } } });
+  if (!event || !event.isActive) throw sponsorshipError('Event not found', 404);
+  if (!event.allowSponsorships) throw sponsorshipError('This event isn’t taking sponsorships.');
+  if (event.cashupStatus === 'closed' || new Date(event.endDate) < new Date()) throw sponsorshipError('This event has ended and is no longer taking sponsorships.');
+  return event;
+}
+
+async function poolFor(event) {
+  const sponsorships = await prisma.payment.findMany({ where: { eventId: event.id, isDonation: true, isSponsorship: true, amount: { gt: 0 } }, select: { id: true, amount: true } });
+  const legs = sponsorships.length
+    ? await prisma.payment.findMany({ where: { originalPaymentId: { in: sponsorships.map(s => s.id) }, isDonation: false }, select: { originalPaymentId: true, amount: true } })
+    : [];
+  return poolSummary(sponsorships, legs, spotPrice(event));
+}
+
+// @desc    Public sponsorship progress for an event (never names who was helped)
+// @route   GET /api/sponsorships/event/:eventId
+// @access  Public
+const getEventSponsorship = async (req, res) => {
+  try {
+    const event = await prisma.event.findUnique({ where: { id: req.params.eventId }, include: { eventOptions: { select: { isMainTicket: true, price: true } } } });
+    if (!event || !event.isActive || !event.allowSponsorships) return res.json({ enabled: false });
+    const pool = await poolFor(event);
+    const open = event.cashupStatus !== 'closed' && new Date(event.endDate) >= new Date();
+    res.json({
+      enabled: true,
+      open,
+      spotPrice: spotPrice(event),
+      showProgress: event.showSponsorshipProgress,
+      goalSpots: event.sponsorshipGoalSpots,
+      spotsFunded: event.showSponsorshipProgress ? pool.spotsFunded : null,
+      sponsors: event.showSponsorshipProgress ? pool.sponsors : null,
+    });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    Start a Yoco checkout to sponsor spots (or a custom amount) at an event
+// @route   POST /api/sponsorships/checkout   { eventId, spots? | amount?, anonymous?, sponsorName?, message?, name?, email?, phone? }
+// @access  Public (guests give a name and email for the receipt)
+const createSponsorCheckout = async (req, res) => {
+  try {
+    const { eventId, spots, amount, anonymous, sponsorName, message, name, email, phone } = req.body || {};
+    const event = await sponsorableEvent(eventId);
+    const charge = sponsorshipCharge({ spots, amount }, spotPrice(event));
+
+    let payer = req.user || null;
+    if (!payer) {
+      const { hasValidEmail, findOrCreateAccount } = require('../utils/accountMatch');
+      const cleanName = String(name || '').trim().slice(0, 100);
+      if (!cleanName) throw sponsorshipError('Enter your name.');
+      if (!hasValidEmail(email)) throw sponsorshipError('Enter your email address so we can send your receipt.');
+      // An existing account is reused; otherwise a quiet inactive one holds the receipt —
+      // no activation link is sent, since a sponsor doesn't need to log in.
+      payer = (await findOrCreateAccount({ name: cleanName, email: String(email).trim(), phone })).user;
+    }
+    const isAnonymous = anonymous === true;
+    const displayName = isAnonymous ? null : (String(sponsorName || '').trim() || payer.name || '').slice(0, 100) || null;
+    const note = String(message || '').trim().slice(0, 300) || null;
+
+    const base = (process.env.FRONTEND_URL || process.env.APP_BASE_URL || 'http://localhost:3001').replace(/\/$/, '');
+    const back = `${base}/events/${encodeURIComponent(event.id)}`;
+    const amountInCents = Math.round(charge.amount * 100);
+    const label = charge.spots ? `Sponsor ${charge.spots} spot${charge.spots > 1 ? 's' : ''} at ${event.title}` : `Sponsorship for ${event.title}`;
+    const checkoutData = {
+      amount: amountInCents,
+      currency: 'ZAR',
+      metadata: {
+        type: 'sponsorship', isDonation: true, eventId: event.id, eventTitle: event.title, userId: payer.id,
+        sponsorAnonymous: isAnonymous ? 'true' : 'false',
+        ...(displayName ? { sponsorName: displayName } : {}),
+        ...(note ? { sponsorMessage: note } : {}),
+        ...(charge.spots ? { spots: String(charge.spots) } : {}),
+      },
+      successUrl: `${back}?sponsored=1`,
+      cancelUrl: back,
+      failureUrl: `${back}?sponsored=failed`,
+      lineItems: [{ displayName: label, quantity: 1, pricingDetails: { price: amountInCents } }],
+    };
+    const response = await axios.post('https://payments.yoco.com/api/checkouts', checkoutData, {
+      headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${process.env.YOCO_SECRET_KEY}`, 'Idempotency-Key': `spon_${event.id}_${payer.id}_${amountInCents}_${Date.now()}` },
+    });
+    res.json({ redirectUrl: response.data.redirectUrl, checkoutId: response.data.id, amount: charge.amount });
+  } catch (error) {
+    if (error.response) console.error('Sponsor checkout error:', error.response.data || error.message);
+    fail(res, error);
+  }
+};
+
+// @desc    The sponsorship pool for an event (supervisors)
+// @route   GET /api/sponsorships/event/:eventId/pool
+// @access  Private/Supervisor
+const getPool = async (req, res) => {
+  try {
+    const event = await prisma.event.findUnique({ where: { id: req.params.eventId }, include: { eventOptions: { select: { isMainTicket: true, price: true } } } });
+    if (!event) throw sponsorshipError('Event not found', 404);
+    res.json({ eventId: event.id, spotPrice: spotPrice(event), goalSpots: event.sponsorshipGoalSpots, ...(await poolFor(event)) });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+module.exports = { getEventSponsorship, createSponsorCheckout, getPool, poolFor };
@@ -267,7 +267,21 @@ const getOverviewStats = async (req, res) => {
      ticketsSold: ticketSumById[r.eventId] || 0,
    }));

+    // Funnel conversion (event page views → paid) across live events, last 30 days.
+    let funnel = null;
+    try {
+      const live = await prisma.event.findMany({ where: { isActive: true, endDate: { gte: now } }, select: { id: true } });
+      if (live.length) {
+        const { funnelFor } = require('../utils/analytics');
+        const f = await funnelFor(live.map(e => e.id), { from: new Date(now.getTime() - 30 * 864e5).toISOString() });
+        if (f.totals.view > 0) funnel = { views: f.totals.view, paid: f.totals.paid, conversion: f.conversion.paid };
+      }
+    } catch (e) {
+      console.warn('[stats] funnel tile failed:', e?.message || e);
+    }
+
    res.json({
+      funnel,
      activeEvents,
      registrations: { thisMonth: thisRegistrations, lastMonth: lastRegistrations, pctChange: pctChange(thisRegistrations, lastRegistrations) },
      ticketsSold: { thisMonth: thisTicketsSold, lastMonth: lastTicketsSold, pctChange: pctChange(thisTicketsSold, lastTicketsSold) },
@@ -95,7 +95,12 @@ const getUserTickets = async (req, res) => {
            registration: true
          }
        },
-        attendee: { select: { id: true, name: true } },
+        attendee: {
+          select: {
+            id: true, name: true,
+            allocations: { where: { set: { showOnTicket: true } }, select: { group: { select: { name: true } }, set: { select: { name: true, order: true } } } },
+          },
+        },
        user: { select: { id: true, name: true } },
        event: true,
        usages: {
@@ -287,16 +292,22 @@ const getScanPreview = async (req, res) => {
    `;

    if (!rows || rows.length === 0) {
+      const { findTransferByOldCode, transferredMessage } = require('../utils/ticketTransfer');
+      const transfer = await findTransferByOldCode(req.params.qrCode);
+      if (transfer) return res.status(410).json({ message: transferredMessage(transfer), code: 'TICKET_TRANSFERRED' });
      res.status(404);
      throw new Error('Ticket not found');
    }

    const r = rows[0];
+    const { consentStatusForTickets } = require('../utils/consent');
+    const consentStatus = (await consentStatusForTickets([r.id])).get(r.id) || 'not_required';
    res.json({
      id:       r.id,
      quantity: Number(r.quantity),
      isUsed:   r.isUsed,
      eventId:  r.eventId,
+      consentStatus,
      registrationOption: {
        id: r.registrationOptionId,
        eventOption: { id: r.eventOptionId, name: r.eventOptionName },
@@ -348,6 +359,9 @@ const scanTicket = async (req, res) => {
    `;

    if (!rows || rows.length === 0) {
+      const { findTransferByOldCode, transferredMessage } = require('../utils/ticketTransfer');
+      const transfer = await findTransferByOldCode(req.params.qrCode);
+      if (transfer) return res.status(410).json({ message: transferredMessage(transfer), code: 'TICKET_TRANSFERRED' });
      res.status(404);
      throw new Error('Ticket not found');
    }
@@ -369,6 +383,27 @@ const scanTicket = async (req, res) => {
      return res.status(400).json({ message: 'Ticket belongs to a different event', ticket });
    }

+    // Section checks used to happen only in the browser; enforce them here too.
+    const sectionId = String((req.query?.sectionId || req.body?.sectionId) || '').trim() || null;
+    if (sectionId) {
+      const section = await prisma.section.findUnique({ where: { id: sectionId }, include: { allowedOptions: true } });
+      if (!section || section.eventId !== ticket.eventId) {
+        return res.status(400).json({ message: 'Section not found for this event', ticket });
+      }
+      if (!section.allowedOptions.some(o => o.eventOptionId === r.eventOptionId)) {
+        return res.status(400).json({ message: 'This ticket is not valid for this section', ticket });
+      }
+    }
+
+    // A section (or the whole event) locked to another device for offline scanning
+    // can't be scanned online — those scans would be invisible to the offline device.
+    const { blockingLock } = require('../utils/scanLocks');
+    const lock = await blockingLock({ eventId: ticket.eventId, optionId: r.eventOptionId }, { sectionId, deviceId: req.body?.deviceId || null });
+    if (lock) {
+      const scope = lock.section ? `"${lock.section.name}"` : 'This event';
+      return res.status(423).json({ message: `${scope} is offline-locked by ${lock.user?.name || 'another device'}${lock.deviceName ? ` on ${lock.deviceName}` : ''}. Scan it on that device, or ask a supervisor to release the lock.`, code: 'SCAN_LOCKED' });
+    }
+
    // Compute how many have already been redeemed
    const totalRedeemed = (ticket.usages || []).reduce((s, u) => s + (u.quantityRedeemed || 1), 0);
    const remaining = (ticket.quantity || 1) - totalRedeemed;
@@ -381,6 +416,25 @@ const scanTicket = async (req, res) => {
      });
    }

+    // Youth events: no check-in without parental consent, unless a supervisor overrides.
+    const { consentStatusForTickets } = require('../utils/consent');
+    const consentStatus = (await consentStatusForTickets([ticket.id])).get(ticket.id) || 'not_required';
+    if (!['not_required', 'given'].includes(consentStatus)) {
+      const canOverride = ['admin', 'supervisor'].includes(req.user?.role);
+      if (!(req.body?.overrideConsent === true && canOverride)) {
+        const why = consentStatus === 'declined' ? 'Parental consent was declined' : consentStatus === 'pending' ? 'Parental consent is still pending' : 'Parental consent is missing';
+        return res.status(403).json({ message: `${why} — this ticket can't be checked in.`, code: 'CONSENT_REQUIRED', consentStatus, canOverride, ticket });
+      }
+      const { logAdminAction } = require('../utils/adminAudit');
+      const { getClientIp } = require('../utils/requestUtils');
+      logAdminAction({
+        actorId: req.user.id, actorRole: req.user.role, action: 'consent_override',
+        targetType: 'Ticket', targetId: ticket.id,
+        metadata: { consentStatus, eventId: ticket.eventId },
+        ip: getClientIp(req),
+      });
+    }
+
    // Determine how many to redeem this scan (defaults to all remaining)
    const requestedQty = parseInt(req.body?.qty || req.body?.quantity) || remaining;
    const qtyToRedeem = Math.min(Math.max(1, requestedQty), remaining);
@@ -439,6 +493,7 @@ const getTicketsByEvent = async (req, res) => {
        registrationOption: { include: { eventOption: true, variant: true, registration: { select: { id: true } } } },
        user: { select: { id: true, name: true, email: true, phoneNumber: true } },
        attendee: { select: { id: true, name: true, email: true, phone: true } },
+        event: { select: { id: true, title: true, startDate: true, requiresParentalConsent: true, allowTicketTransfer: true, collectGender: true } },
        usages: { include: { scannedBy: { select: { id: true, name: true, email: true } } } }
      },
      orderBy: { createdAt: 'desc' },
@@ -648,6 +703,83 @@ const sendTicketsTo = async (req, res) => {
  }
 };

+// @desc    Transfer a ticket to someone else (new QR code; billing stays with the payer)
+// @route   POST /api/tickets/:id/transfer   { name, email?, phone?, dateOfBirth?, parentName?, parentEmail?, parentPhone? }
+// @access  Private (payer or holder; supervisors always)
+const transferTicketHandler = async (req, res) => {
+  try {
+    const { transferTicket } = require('../utils/ticketTransfer');
+    const { name, email, phone, dateOfBirth, gender, parentName, parentEmail, parentPhone } = req.body || {};
+    const r = await transferTicket({ ticketId: req.params.id, actor: req.user, name, email, phone, dateOfBirth, gender, parentName, parentEmail, parentPhone });
+
+    const { logAdminAction } = require('../utils/adminAudit');
+    const { getClientIp } = require('../utils/requestUtils');
+    logAdminAction({
+      actorId: req.user.id, actorRole: req.user.role, action: 'ticket_transferred', targetType: 'Ticket', targetId: r.target.id,
+      metadata: { eventId: r.event.id, registrationId: r.registrationId, from: r.fromHolderName, to: r.attendee.name, toUserId: r.toUser.id, split: !r.transfer.oldQrCode },
+      ip: getClientIp(req),
+    });
+
+    // Tell the new holder: activation link for a new account, their ticket, and
+    // anything they need to do themselves (consent, attendee form).
+    if (r.accountCreated) {
+      const { sendActivationLink } = require('./userController');
+      sendActivationLink(r.toUser);
+    }
+    const a = r.attendee;
+    const hasEmail = !!(a.email && a.email.includes('@'));
+    const recipient = { id: r.toUser.id, name: a.name, email: hasEmail ? a.email : null, phoneNumber: a.phone || null, notificationPreference: hasEmail && a.phone ? 'both' : hasEmail ? 'email' : 'whatsapp' };
+    const silent = { status: () => silent, json: () => silent };
+    emailTicketsInternal({ user: { id: r.target.userId }, body: { ticketIds: [r.target.id] }, _noSplit: true }, silent, recipient)
+      .catch(e => console.error('[transfer] ticket delivery failed:', e?.message || e));
+    if (r.needsConsent) {
+      const { createConsentRequest } = require('../utils/consent');
+      createConsentRequest(a, r.event).catch(e => console.error('[transfer] consent request failed:', e?.message || e));
+    }
+    const form = await prisma.eventForm.findUnique({ where: { eventId: r.event.id }, include: { fields: { select: { id: true } } } });
+    if (form && form.fields.length > 0) {
+      const { sendAttendeeFormLinkMessage } = require('../utils/notifications');
+      const full = await prisma.attendee.findUnique({ where: { id: a.id }, include: { registration: { include: { event: true, user: { select: { id: true, name: true } } } } } });
+      sendAttendeeFormLinkMessage(full).catch(() => {});
+    }
+
+    res.json({
+      message: `Ticket transferred to ${a.name}. We've sent them the new ticket${r.needsConsent ? ' and a parental consent request' : ''}. The old QR code no longer works.`,
+      ticketId: r.target.id,
+    });
+  } catch (error) {
+    res.status(error.statusCode || (res.statusCode === 200 ? 400 : res.statusCode)).json({ message: safeErrorMessage(error) });
+  }
+};
+
+// @desc    Transfer history of a ticket
+// @route   GET /api/tickets/:id/transfers
+// @access  Private (payer or holder; staff)
+const getTicketTransfers = async (req, res) => {
+  try {
+    const ticket = await prisma.ticket.findUnique({ where: { id: req.params.id }, select: { userId: true, holderUserId: true } });
+    if (!ticket) { res.status(404); throw new Error('Ticket not found'); }
+    const staffRole = ['admin', 'supervisor', 'staff'].includes(req.user.role);
+    if (!staffRole && ticket.userId !== req.user.id && ticket.holderUserId !== req.user.id) { res.status(403); throw new Error('Not authorized'); }
+    const transfers = await prisma.ticketTransfer.findMany({
+      where: { ticketId: req.params.id },
+      select: { id: true, fromHolderName: true, toName: true, createdAt: true, byUser: { select: { name: true } } },
+      orderBy: { createdAt: 'desc' },
+    });
+    res.json(transfers);
+  } catch (error) {
+    res.status(res.statusCode === 200 ? 400 : res.statusCode).json({ message: safeErrorMessage(error) });
+  }
+};
+
+/** "Room: Cabin 3 · Bus: Bus 2" for the sets shown on tickets, or ''. */
+function allocationLabel(attendee) {
+  return [...(attendee?.allocations || [])]
+    .sort((a, b) => (a.set?.order || 0) - (b.set?.order || 0))
+    .map(a => `${a.set.name}: ${a.group.name}`)
+    .join(' · ');
+}
+
 // Internal helper used by both emailTickets and sendTicketsTo
 async function emailTicketsInternal(req, res, userOverride) {
  const { ticketIds, registrationId } = req.body;
@@ -670,7 +802,7 @@ async function emailTicketsInternal(req, res, userOverride) {
  const ticketInclude = {
    event: true,
    registrationOption: { include: { eventOption: true, variant: true, registration: { select: { ticketDelivery: true } } } },
-    attendee: true,
+    attendee: { include: { allocations: { where: { set: { showOnTicket: true } }, include: { group: { select: { name: true } }, set: { select: { name: true, order: true } } } } } },
    user: { select: { name: true } },
    usages: true,
  };
@@ -771,7 +903,8 @@ async function emailTicketsInternal(req, res, userOverride) {
    doc.font('Helvetica').fontSize(10);
    const variantSuffix = ticket.registrationOption.variant ? ` — ${ticket.registrationOption.variant.name}` : '';
    doc.text(`Ticket Type: ${ticket.registrationOption.eventOption.name}${variantSuffix}`, x + 10, y + 30, { width: ticketWidth - 20 });
-    doc.text(ticket.attendee ? `Name: ${ticket.attendee.name}` : `Qty: ${ticket.quantity || 1}`, x + 10, y + 45, { width: ticketWidth - 20 });
+    const groupLabel = allocationLabel(ticket.attendee);
+    doc.text(ticket.attendee ? `Name: ${ticket.attendee.name}${groupLabel ? ` · ${groupLabel}` : ''}` : `Qty: ${ticket.quantity || 1}`, x + 10, y + 45, { width: ticketWidth - 20 });
    const eventDate = new Date(ticket.event.startDate);
    doc.text(`Date: ${new Intl.DateTimeFormat('en-GB', { day: '2-digit', month: 'long', year: 'numeric' }).format(eventDate)}`, x + 10, y + 60, { width: ticketWidth - 20 });
    doc.text(`Purchased by: ${ticket.user?.name || user.name}`, x + 10, y + 75, { width: ticketWidth - 20 });
@@ -845,5 +978,7 @@ module.exports = {
  emailTickets,
  sendTicketsTo,
  getRecentScans,
-  getScanStats
+  getScanStats,
+  transferTicketHandler,
+  getTicketTransfers
 };
@@ -888,6 +888,7 @@ const anonymizeUser = async (req, res) => {
      }
    });
    await clearTrustedDevices(req.params.id);
+    await require('../utils/consent').clearConsentDataForUser(req.params.id);

    res.json({ message: 'User data deleted' });
  } catch (error) {
@@ -1149,6 +1150,7 @@ const closeAccount = async (req, res) => {
        },
      });
      await clearTrustedDevices(req.user.id);
+      await require('../utils/consent').clearConsentDataForUser(req.user.id);
      // Send closure confirmation to the real address (before it was wiped)
      if (realEmail && !realEmail.endsWith('@deleted.invalid') && !realEmail.endsWith('@guest.local')) {
        const { sendMail, buildAccountClosedEmail } = require('../utils/email');
@@ -0,0 +1,195 @@
+const prisma = require('../config/db');
+const { v4: uuidv4 } = require('uuid');
+const { safeErrorMessage } = require('../utils/errorUtils');
+const { findAccountByContact } = require('../utils/accountMatch');
+const { remainingFor } = require('../utils/stock');
+const { ACTIVE, makeOffer, queueWaitlist, findOfferByToken } = require('../utils/waitlist');
+
+const fail = (res, error) => res.status(error.statusCode || (res.statusCode === 200 ? 400 : res.statusCode)).json({ message: safeErrorMessage(error) });
+
+const ENTRY_INCLUDE = {
+  event: { select: { id: true, title: true, startDate: true, picture: true } },
+  eventOption: { select: { id: true, name: true } },
+  variant: { select: { id: true, name: true } },
+};
+
+// @desc    Join the waitlist for a sold-out option
+// @route   POST /api/waitlist
+// @access  Public (login needed when the event requires it)
+// Body: { eventId, eventOptionId, variantId?, quantity, guestName?, guestEmail?, guestPhone? }
+const joinWaitlist = async (req, res) => {
+  try {
+    const { eventId, eventOptionId, variantId = null, quantity, guestName, guestEmail, guestPhone } = req.body || {};
+    const qty = parseInt(quantity, 10);
+    if (!eventId || !eventOptionId || !(qty >= 1)) { res.status(400); throw new Error('eventId, eventOptionId and a quantity of at least 1 are required'); }
+
+    const event = await prisma.event.findUnique({ where: { id: eventId }, include: { eventOptions: { include: { variants: true } } } });
+    if (!event || !event.isActive) { res.status(404); throw new Error('Event not found'); }
+    if (!event.waitlistEnabled) { res.status(400); throw new Error('This event does not have a waitlist.'); }
+    if (event.cashupStatus === 'closed' || new Date(event.endDate) < new Date()) { res.status(400); throw new Error('This event is no longer taking registrations.'); }
+    const option = event.eventOptions.find(o => o.id === eventOptionId);
+    if (!option) { res.status(400); throw new Error('Unknown ticket option for this event'); }
+    const variant = variantId ? (option.variants || []).find(v => v.id === variantId) : null;
+    if (variantId && !variant) { res.status(400); throw new Error('Unknown variant for this option'); }
+
+    const free = await remainingFor(option, variant);
+    if (free === null || free >= qty) { res.status(400); throw new Error('There are places available — you can register now.'); }
+
+    // Who's joining
+    let userId = req.user?.id;
+    if (!userId) {
+      if (event.requiresAuth !== false) { res.status(401); throw new Error('Log in to join the waitlist for this event.'); }
+      if (!guestName || !guestEmail) { res.status(400); throw new Error('Name and email are required to join the waitlist'); }
+      const match = await findAccountByContact({ email: guestEmail, phone: guestPhone });
+      if (match.conflict) { res.status(409); throw new Error('This email and phone number belong to two different accounts. Please log in, or check your details.'); }
+      userId = match.user?.id || (await prisma.user.create({
+        data: { id: uuidv4(), name: String(guestName).trim(), email: String(guestEmail).trim(), password: '', phoneNumber: guestPhone || null, isActive: false, updatedAt: new Date() },
+      })).id;
+    }
+
+    const existing = await prisma.waitlistEntry.findFirst({ where: { userId, eventOptionId, variantId, status: { in: ACTIVE } } });
+    if (existing) { res.status(409); throw new Error('You\'re already on the waitlist for this.'); }
+
+    const last = await prisma.waitlistEntry.aggregate({ where: { eventId }, _max: { position: true } });
+    const entry = await prisma.waitlistEntry.create({
+      data: { eventId, eventOptionId, variantId, userId, quantity: qty, position: (last._max.position || 0) + 1 },
+      include: ENTRY_INCLUDE,
+    });
+    const ahead = await prisma.waitlistEntry.count({ where: { eventId, eventOptionId, variantId, status: 'waiting', position: { lt: entry.position } } });
+    res.status(201).json({ ...entry, ahead, message: `You're on the waitlist${ahead ? ` — ${ahead} ahead of you` : ''}. We'll email or WhatsApp you if a place opens up.` });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    The caller's waitlist entries
+// @route   GET /api/waitlist/mine
+// @access  Private
+const myWaitlist = async (req, res) => {
+  try {
+    const entries = await prisma.waitlistEntry.findMany({
+      where: { userId: req.user.id, status: { in: ACTIVE }, event: { endDate: { gte: new Date() } } },
+      include: ENTRY_INCLUDE,
+      orderBy: { createdAt: 'desc' },
+    });
+    res.json(entries);
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    Leave the waitlist (an open offer is passed on)
+// @route   DELETE /api/waitlist/:id
+// @access  Private (owner)
+const leaveWaitlist = async (req, res) => {
+  try {
+    const entry = await prisma.waitlistEntry.findUnique({ where: { id: req.params.id } });
+    if (!entry || entry.userId !== req.user.id) { res.status(404); throw new Error('Waitlist entry not found'); }
+    if (!ACTIVE.includes(entry.status)) { res.status(400); throw new Error('You\'re no longer on this waitlist.'); }
+    await prisma.waitlistEntry.update({ where: { id: entry.id }, data: { status: 'left', offerTokenHash: null } });
+    if (entry.status === 'offered') queueWaitlist(entry.eventId);
+    res.json({ message: 'You\'ve left the waitlist.' });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    What a claim link offers
+// @route   GET /api/waitlist/claim/:token
+// @access  Public (the token is the credential)
+const claimInfo = async (req, res) => {
+  try {
+    const entry = await findOfferByToken(req.params.token);
+    if (!entry) { res.status(404); throw new Error('This waitlist link is not valid or has already been used.'); }
+    const expired = entry.status !== 'offered' || new Date(entry.offerExpiresAt) < new Date();
+    res.json({
+      status: expired ? 'expired' : 'offered',
+      eventId: entry.eventId,
+      eventTitle: entry.event.title,
+      eventStart: entry.event.startDate,
+      eventOptionId: entry.eventOptionId,
+      optionName: entry.eventOption.name,
+      variantId: entry.variantId,
+      variantName: entry.variant?.name || null,
+      quantity: entry.offeredQuantity,
+      requested: entry.quantity,
+      expiresAt: entry.offerExpiresAt,
+      name: entry.user?.name,
+    });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    The waitlist for an event
+// @route   GET /api/waitlist/events/:eventId
+// @access  Private/Staff
+const eventWaitlist = async (req, res) => {
+  try {
+    const entries = await prisma.waitlistEntry.findMany({
+      where: { eventId: req.params.eventId, ...(req.query.all === 'true' ? {} : { status: { in: [...ACTIVE, 'claimed', 'expired'] } }) },
+      include: { ...ENTRY_INCLUDE, user: { select: { id: true, name: true, email: true, phoneNumber: true } } },
+      orderBy: { position: 'asc' },
+    });
+    res.json(entries);
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    Offer a place to someone on the waitlist now (even without free stock)
+// @route   POST /api/waitlist/:id/offer
+// @access  Private/Supervisor
+const offerManually = async (req, res) => {
+  try {
+    const entry = await prisma.waitlistEntry.findUnique({ where: { id: req.params.id } });
+    if (!entry) { res.status(404); throw new Error('Waitlist entry not found'); }
+    if (!['waiting', 'expired'].includes(entry.status)) { res.status(400); throw new Error(`This person is ${entry.status === 'offered' ? 'already holding an offer' : `no longer waiting (${entry.status})`}.`); }
+    const qty = Math.max(1, Math.min(entry.quantity, parseInt(req.body?.quantity, 10) || entry.quantity));
+    const updated = await makeOffer(entry.id, qty);
+    res.json({ ...updated, message: `Offered ${qty} place(s); the claim link has been sent.` });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    Move someone up or down the queue
+// @route   POST /api/waitlist/:id/move   { direction: 'up' | 'down' }
+// @access  Private/Supervisor
+const moveEntry = async (req, res) => {
+  try {
+    const entry = await prisma.waitlistEntry.findUnique({ where: { id: req.params.id } });
+    if (!entry) { res.status(404); throw new Error('Waitlist entry not found'); }
+    const up = req.body?.direction === 'up';
+    const neighbour = await prisma.waitlistEntry.findFirst({
+      where: { eventId: entry.eventId, status: 'waiting', position: up ? { lt: entry.position } : { gt: entry.position } },
+      orderBy: { position: up ? 'desc' : 'asc' },
+    });
+    if (!neighbour) return res.json({ message: 'Already at the ' + (up ? 'front.' : 'back.') });
+    await prisma.$transaction([
+      prisma.waitlistEntry.update({ where: { id: entry.id }, data: { position: neighbour.position } }),
+      prisma.waitlistEntry.update({ where: { id: neighbour.id }, data: { position: entry.position } }),
+    ]);
+    res.json({ message: 'Moved.' });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    Take someone off the waitlist (an open offer is passed on)
+// @route   POST /api/waitlist/:id/remove
+// @access  Private/Supervisor
+const removeEntry = async (req, res) => {
+  try {
+    const entry = await prisma.waitlistEntry.findUnique({ where: { id: req.params.id } });
+    if (!entry) { res.status(404); throw new Error('Waitlist entry not found'); }
+    if (!ACTIVE.includes(entry.status)) { res.status(400); throw new Error('This person is not on the waitlist any more.'); }
+    await prisma.waitlistEntry.update({ where: { id: entry.id }, data: { status: 'removed', offerTokenHash: null } });
+    if (entry.status === 'offered') queueWaitlist(entry.eventId);
+    res.json({ message: 'Removed from the waitlist.' });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+module.exports = { joinWaitlist, myWaitlist, leaveWaitlist, claimInfo, eventWaitlist, offerManually, moveEntry, removeEntry };
@@ -325,7 +325,13 @@ const handlePaymentSucceeded = async (webhookData) => {
        userId: resolvedUserId,
        recordedById: resolvedUserId, // self-service webhook payment — payer is the recorder
        eventId: registration?.eventId || metadata?.eventId || null,
-        isDonation: !registration?.id
+        isDonation: !registration?.id,
+        ...(!registration?.id && metadata?.type === 'sponsorship' ? {
+          isSponsorship: true,
+          sponsorAnonymous: String(metadata.sponsorAnonymous) === 'true',
+          sponsorName: String(metadata.sponsorAnonymous) === 'true' ? null : (metadata.sponsorName ? String(metadata.sponsorName).slice(0, 100) : null),
+          sponsorMessage: metadata.sponsorMessage ? String(metadata.sponsorMessage).slice(0, 300) : null,
+        } : {})
      },
      include: {
        user: {
@@ -103,6 +103,10 @@ const globalLimiter = rateLimit({
 });
 app.use(globalLimiter);

+// Impersonation is strictly read-only: refuse every write made with an impersonation
+// token before it can reach any route (see utils/impersonation.js).
+app.use(require('./utils/impersonation').readOnlyGuard);
+
 // Raw body parsing middleware for webhooks
 app.use((req, res, next) => {
  if (req.path.startsWith('/api/webhooks')) {
@@ -176,6 +180,13 @@ app.use('/api', costRoutes);
 app.use('/api/cashups', cashupRoutes);
 app.use('/api/admin', adminRoutes);
 app.use('/api/coupons', require('./routes/couponRoutes'));
+app.use('/api/consent', require('./routes/consentRoutes'));
+app.use('/api/waitlist', require('./routes/waitlistRoutes'));
+app.use('/api/scan-locks', require('./routes/scanLockRoutes'));
+app.use('/api/allocations', require('./routes/allocationRoutes'));
+app.use('/api/sponsorships', require('./routes/sponsorshipRoutes'));
+app.use('/api/feedback', require('./routes/feedbackRoutes'));
+app.use('/api/analytics', require('./routes/analyticsRoutes'));
 app.use('/api/backups', backupRoutes);

 // Pre-warm the settings cache so synchronous helpers have DB values from startup
@@ -632,6 +643,94 @@ app.get('/docs', async (req, res) => {
        ]},
    ]},

+    { title: 'Impersonation', base: '/api/admin', endpoints: [
+      { method:'POST', path:'/api/admin/impersonate/:userId', auth:'admin (2FA)', desc:'View the site as a user — read-only token, 30 minutes, audited', request:{ body:{ reason:'Ticket not showing in My Events' }}, responses:[{ status:201, desc:'Started', body:{ token:'jwt…', session:{ id:'sess-uuid', expiresAt:'2025-07-10T08:45:00.000Z' }}}, { status:403, desc:'Not allowed', body:{ message:"Admins can't be impersonated." }}]},
+      { method:'POST', path:'/api/admin/impersonate/end', auth:'impersonation token', desc:'End the impersonation session' },
+      { method:'POST', path:'/api/admin/impersonate/log', auth:'impersonation token', desc:'Record a page viewed during the session' },
+      { method:'GET', path:'/api/admin/impersonate/current', auth:'impersonation token', desc:'The live impersonation session' },
+      { method:'GET', path:'/api/admin/impersonation-sessions', auth:'admin', desc:'Impersonation sessions with their request trail' },
+    ]},
+    { title: 'Registration funnel', base: '/api/analytics', endpoints: [
+      { method:'POST', path:'/api/analytics/track', auth:'Public (rate-limited)', desc:'Record a funnel step from a cookie-consented browser (always 204)',
+        request:{ body:{ sessionId:'random-uuid', eventId:'ev-uuid-...', stage:'view', source:'camp-2025' }}},
+      { method:'GET', path:'/api/analytics/funnel', auth:'supervisor+', desc:'Funnel for ?eventIds=a,b&from=&to= — totals, conversion, daily trend, by source/device/option' },
+    ]},
+    { title: 'Post-event feedback', base: '/api/feedback', endpoints: [
+      { method:'GET', path:'/api/feedback/event/:eventId', auth:'supervisor+', desc:'An event\'s feedback form, with invite and response counts' },
+      { method:'PUT', path:'/api/feedback/event/:eventId', auth:'supervisor+', desc:'Create/update the feedback form (questions lock once answered)',
+        request:{ body:{ sendAt:'2025-07-13T09:00:00.000Z', audience:'checked_in', anonymous:false, intro:'Thanks for coming!', fields:[{ type:'rating', label:'Overall?', isRequired:true }, { type:'multiple_choice', label:'Best part', options:['Worship','Talks'] }] }}},
+      { method:'DELETE', path:'/api/feedback/event/:eventId', auth:'supervisor+', desc:'Remove the feedback form' },
+      { method:'POST', path:'/api/feedback/event/:eventId/send-now', auth:'supervisor+', desc:'Send the feedback form now' },
+      { method:'GET', path:'/api/feedback/public/:token', auth:'Link holder', desc:'The form behind a personal feedback link' },
+      { method:'POST', path:'/api/feedback/public/:token', auth:'Link holder', desc:'Submit feedback once', request:{ body:{ answers:{ 'field-uuid':'5' } }}},
+      { method:'GET', path:'/api/feedback/summary', auth:'supervisor+', desc:'Feedback summary for ?eventIds=a,b (response rate, averages, breakdowns, comments)' },
+    ]},
+    { title: 'Sponsor a spot', base: '/api/sponsorships', endpoints: [
+      { method:'GET', path:'/api/sponsorships/event/:eventId', auth:'Public', desc:'Sponsorship progress for an event (spots funded, goal) — never who was helped',
+        responses:[{ status:200, desc:'Progress', body:{ enabled:true, open:true, spotPrice:450, showProgress:true, goalSpots:20, spotsFunded:12, sponsors:9 }}]},
+      { method:'POST', path:'/api/sponsorships/checkout', auth:'Public (optional login)', desc:'Start a Yoco checkout to sponsor spots or a custom amount; the money lands in the event sponsorship pool',
+        request:{ body:{ eventId:'ev-uuid-...', spots:2, anonymous:false, sponsorName:'The Smith family', message:'Have a great camp!', name:'Sam Smith', email:'sam@example.com' }},
+        responses:[{ status:200, desc:'Checkout created', body:{ redirectUrl:'https://pay.yoco.com/...', amount:900 }}]},
+      { method:'GET', path:'/api/sponsorships/event/:eventId/pool', auth:'supervisor+', desc:'Sponsorship pool totals: received, assigned, remaining' },
+    ]},
+    { title: 'Rooms & groups', base: '/api/allocations', endpoints: [
+      { method:'GET', path:'/api/allocations/event/:eventId', auth:'supervisor+', desc:'Allocation board: sets with groups and assignments, named attendees, possible leaders' },
+      { method:'POST', path:'/api/allocations/sets', auth:'supervisor+', desc:'Create an allocation set', request:{ body:{ eventId:'ev-uuid-...', name:'Rooms', showOnTicket:true }}},
+      { method:'PUT', path:'/api/allocations/sets/:id', auth:'supervisor+', desc:'Rename a set or show it on tickets' },
+      { method:'DELETE', path:'/api/allocations/sets/:id', auth:'supervisor+', desc:'Delete a set and its groups' },
+      { method:'POST', path:'/api/allocations/sets/:id/groups', auth:'supervisor+', desc:'Add a group', request:{ body:{ name:'Cabin 1', capacity:8, gender:'female', leaderUserId:'user-uuid-...' }}},
+      { method:'PUT', path:'/api/allocations/groups/:id', auth:'supervisor+', desc:'Edit a group' },
+      { method:'DELETE', path:'/api/allocations/groups/:id', auth:'supervisor+', desc:'Delete a group (its people become unassigned)' },
+      { method:'PUT', path:'/api/allocations/sets/:id/assignments', auth:'supervisor+', desc:'Place (or with groupId null, unplace) an attendee; enforces capacity and gender', request:{ body:{ attendeeId:'att-uuid-...', groupId:'grp-uuid-...' }}},
+      { method:'DELETE', path:'/api/allocations/sets/:id/assignments', auth:'supervisor+', desc:'Clear every assignment in a set' },
+      { method:'POST', path:'/api/allocations/sets/:id/auto', auth:'supervisor+', desc:'Auto-allocate everyone not yet placed', request:{ body:{ mode:'together' }}, responses:[{ status:200, desc:'Done', body:{ placed:12, unplaced:1 }}]},
+      { method:'GET', path:'/api/allocations/sets/:id/lists', auth:'supervisor+', desc:'Per-group lists for printing (?medical=true adds medical details; audited)' },
+      { method:'GET', path:'/api/allocations/my-groups', auth:'staff+', desc:'Groups the signed-in leader leads, with their people' },
+    ]},
+    { title: 'Ticket transfer', base: '/api/tickets', endpoints: [
+      { method:'POST', path:'/api/tickets/:id/transfer', auth:'payer, holder or supervisor+', desc:'Give a ticket to someone else before the event (new QR code; the old one stops working; billing stays with the payer)',
+        request:{ body:{ name:'Nia New', email:'nia@example.com', phone:'0821234567' }},
+        responses:[{ status:200, desc:'Transferred', body:{ message:'Ticket transferred to Nia New…', ticketId:'ticket-uuid-...' }}, { status:400, desc:'Not allowed', body:{ message:'This ticket has already been used (or partly used), so it can’t be transferred.' }}]},
+      { method:'GET', path:'/api/tickets/:id/transfers', auth:'payer, holder or staff+', desc:'Transfer history of a ticket' },
+    ]},
+    { title: 'Offline scanning', base: '/api/scan-locks', endpoints: [
+      { method:'GET', path:'/api/scan-locks', auth:'staff+', desc:'Active offline locks for an event (?eventId=)' },
+      { method:'POST', path:'/api/scan-locks', auth:'staff+', desc:'Lock a section (or the whole event) to this device for offline scanning',
+        request:{ body:{ eventId:'ev-uuid-...', sectionId:'sec-uuid-...', deviceId:'device-uuid', deviceName:'Chrome on Android' }},
+        responses:[{ status:201, desc:'Locked', body:{ id:'lock-uuid-...', sectionName:'Main hall' }}, { status:409, desc:'Held elsewhere', body:{ message:'"Main hall" is offline-locked by Ann on Chrome on Android.' }}]},
+      { method:'GET', path:'/api/scan-locks/:id/snapshot', auth:'staff+', desc:'Tickets valid in the lock scope, for the device to keep offline (lock holder, ?deviceId=)' },
+      { method:'POST', path:'/api/scan-locks/:id/sync', auth:'staff+', desc:'Upload offline scans (idempotent by clientScanId; capped at what is left on each ticket)',
+        request:{ body:{ deviceId:'device-uuid', scans:[{ clientScanId:'scan-uuid', qrCode:'qr-uuid', qty:1, scannedAt:'2025-07-10T08:15:00.000Z' }] }},
+        responses:[{ status:200, desc:'Synced', body:{ accepted:1, duplicates:0, conflicts:[] }}]},
+      { method:'DELETE', path:'/api/scan-locks/:id', auth:'staff+', desc:'End offline mode (lock holder)' },
+      { method:'POST', path:'/api/scan-locks/:id/force-release', auth:'supervisor+', desc:'Release a lost device\'s lock' },
+      { method:'GET', path:'/api/scan-locks/reports', auth:'supervisor+', desc:'Offline sync reports for an event' },
+      { method:'POST', path:'/api/scan-locks/reports/:id/review', auth:'supervisor+', desc:'Mark a sync report reviewed' },
+    ]},
+    { title: 'Waitlist', base: '/api/waitlist', endpoints: [
+      { method:'POST', path:'/api/waitlist', auth:'public', desc:'Join the waitlist for a sold-out line (login needed when the event requires it)',
+        request:{ body:{ eventId:'ev-uuid-...', eventOptionId:'opt-uuid-...', quantity:2 }},
+        responses:[{ status:201, desc:'Joined', body:{ id:'wl-uuid-...', status:'waiting', ahead:3 }}, { status:400, desc:'Places available', body:{ message:'There are places available — you can register now.' }}]},
+      { method:'GET', path:'/api/waitlist/mine', auth:'user+', desc:'My active waitlist entries' },
+      { method:'DELETE', path:'/api/waitlist/:id', auth:'user+', desc:'Leave the waitlist' },
+      { method:'GET', path:'/api/waitlist/claim/:token', auth:'public', desc:'What a claim link offers (rate-limited)' },
+      { method:'GET', path:'/api/waitlist/events/:eventId', auth:'staff+', desc:'The queue for an event' },
+      { method:'POST', path:'/api/waitlist/:id/offer', auth:'supervisor+', desc:'Offer places now, even over the stock limit' },
+      { method:'POST', path:'/api/waitlist/:id/move', auth:'supervisor+', desc:'Move up or down the queue', request:{ body:{ direction:'up' }} },
+      { method:'POST', path:'/api/waitlist/:id/remove', auth:'supervisor+', desc:'Take someone off the waitlist' },
+    ]},
+    { title: 'Parental consent', base: '/api/consent', endpoints: [
+      { method:'GET', path:'/api/consent/:token', auth:'public', desc:'Consent page data for a parent/guardian (the link token is the credential; rate-limited)',
+        responses:[{ status:200, desc:'Success', body:{ status:'pending', attendeeName:'Sam Smith', consentText:'I give permission…', event:{ title:'Youth Camp' }, collect:{ medical:true, emergency:true, photo:true } }}, { status:404, desc:'Unknown or replaced link', body:{ message:'This consent link is not valid.' }}]},
+      { method:'POST', path:'/api/consent/:token', auth:'public', desc:'Give or decline consent. Records name, time, IP, device and the consent text version; medical/emergency details are stored encrypted.',
+        request:{ body:{ decision:'give', signedName:'Pat Smith', isGuardian:true, medical:{ allergies:'Peanuts' }, emergency:{ name:'Gran', phone:'0821234567' }, photoConsent:true }},
+        responses:[{ status:200, desc:'Answered', body:{ status:'given' }}, { status:409, desc:'Already answered', body:{ message:'Consent has already been given.' }}]},
+      { method:'GET', path:'/api/consent/events/:eventId', auth:'staff+', desc:'Consent status for every attendee on an event' },
+      { method:'POST', path:'/api/consent/requests/:id/resend', auth:'user+', desc:'Re-send a pending request with a fresh link (registrant or staff)' },
+      { method:'POST', path:'/api/consent/events/:eventId/resend-pending', auth:'supervisor+', desc:'Re-send every pending request on an event' },
+      { method:'POST', path:'/api/consent/events/:eventId/rerequest', auth:'supervisor+', desc:'Ask again where consent was given on an older version of the text, or never requested' },
+      { method:'GET', path:'/api/consent/events/:eventId/medical', auth:'supervisor+', desc:'Decrypted medical & emergency list; every view is written to the admin audit log' },
+    ]},
    { title: 'Coupons', base: '/api/coupons', endpoints: [
      { method:'POST', path:'/api/coupons/validate', auth:'public', desc:'Check a code against a basket before registering; returns the discount. Login needed for restricted codes; staff can pass forUserId (or null for a walk-in).',
        request:{ body:{ code:'STAFF50', eventId:'ev-uuid-...', options:[{ eventOptionId:'opt-uuid-...', quantity:2 }] }},
@@ -1295,6 +1394,105 @@ app.listen(PORT, () => {
    console.warn('[daily summaries] Not scheduled:', e?.message || e);
  }

+  // Waitlist job — expire unclaimed offers and offer any free places to the next people.
+  try {
+    const enabled = String(process.env.WAITLIST_JOB_ENABLED || 'true').toLowerCase() !== 'false';
+    if (enabled) {
+      const { runWaitlistJob } = require('./utils/waitlist');
+      const everyMs = parseInt(process.env.WAITLIST_JOB_INTERVAL_MS || String(10 * 60 * 1000), 10);
+      setInterval(async () => {
+        try {
+          const r = await runWaitlistJob();
+          if (r.expired || r.offers) console.log(`[waitlist] ${r.expired} event(s) with expired offers, ${r.offers} new offer(s).`);
+        } catch (e) {
+          console.warn('[waitlist] Job failed:', e?.message || e);
+        }
+      }, everyMs);
+      console.log(`[waitlist] Job every ${Math.round(everyMs / 60000)} min.`);
+    } else {
+      console.log('[waitlist] Job disabled by env WAITLIST_JOB_ENABLED=false');
+    }
+  } catch (e) {
+    console.warn('[waitlist] Not scheduled:', e?.message || e);
+  }
+
+  // Funnel analytics — once a day, roll raw rows older than 90 days into daily totals.
+  try {
+    const enabled = String(process.env.ANALYTICS_ROLLUP_ENABLED || 'true').toLowerCase() !== 'false';
+    if (enabled) {
+      const { rollupOldEvents } = require('./utils/analytics');
+      const run = async () => {
+        try {
+          const n = await rollupOldEvents();
+          if (n) console.log(`[analytics] Rolled up ${n} session(s) older than 90 days.`);
+        } catch (e) {
+          console.warn('[analytics] Rollup failed:', e?.message || e);
+        }
+      };
+      setTimeout(run, 5 * 60 * 1000);
+      setInterval(run, 24 * 60 * 60 * 1000);
+      console.log('[analytics] Rollup daily.');
+    } else {
+      console.log('[analytics] Rollup disabled by env ANALYTICS_ROLLUP_ENABLED=false');
+    }
+  } catch (e) {
+    console.warn('[analytics] Not scheduled:', e?.message || e);
+  }
+
+  // Feedback job — send post-event feedback forms at their send time, and the one
+  // reminder 3 days later.
+  try {
+    const enabled = String(process.env.FEEDBACK_JOB_ENABLED || 'true').toLowerCase() !== 'false';
+    if (enabled) {
+      const { runFeedbackJob } = require('./utils/feedback');
+      const everyMs = parseInt(process.env.FEEDBACK_JOB_INTERVAL_MS || String(15 * 60 * 1000), 10);
+      setInterval(async () => {
+        try {
+          const r = await runFeedbackJob();
+          if (r.sent || r.reminded) console.log(`[feedback] ${r.sent} invite(s), ${r.reminded} reminder(s) sent.`);
+        } catch (e) {
+          console.warn('[feedback] Job failed:', e?.message || e);
+        }
+      }, everyMs);
+      console.log(`[feedback] Job every ${Math.round(everyMs / 60000)} min.`);
+    } else {
+      console.log('[feedback] Job disabled by env FEEDBACK_JOB_ENABLED=false');
+    }
+  } catch (e) {
+    console.warn('[feedback] Not scheduled:', e?.message || e);
+  }
+
+  // Daily parental-consent job — reminders for unanswered requests, and purging
+  // medical/emergency details a set number of days after each event.
+  try {
+    const enabled = String(process.env.CONSENT_JOBS_ENABLED || 'true').toLowerCase() !== 'false';
+    if (enabled) {
+      const { sendConsentReminders, purgeConsentMedicalData } = require('./utils/consent');
+      const runConsentJobs = async () => {
+        try {
+          const reminded = await sendConsentReminders(new Date());
+          const purged = await purgeConsentMedicalData(new Date());
+          if (reminded || purged) console.log(`[consent] Sent ${reminded} reminder(s), purged medical details on ${purged} request(s).`);
+        } catch (e) {
+          console.warn('[consent] Daily job failed:', e?.message || e);
+        }
+      };
+      const scheduleConsent = () => {
+        const now = new Date();
+        const next = new Date(now);
+        next.setHours(9, 0, 0, 0);
+        if (next <= now) next.setDate(next.getDate() + 1);
+        setTimeout(async () => { await runConsentJobs(); scheduleConsent(); }, next.getTime() - now.getTime());
+      };
+      scheduleConsent();
+      console.log('[consent] Scheduler initialized (09:00 local time).');
+    } else {
+      console.log('[consent] Scheduler disabled by env CONSENT_JOBS_ENABLED=false');
+    }
+  } catch (e) {
+    console.warn('[consent] Not scheduled:', e?.message || e);
+  }
+
  // Daily temp-file cleanup — removes files older than 7 days from /temp
  try {
    const { cleanupTempFiles } = require('./utils/cleanupTemp');
@@ -48,6 +48,17 @@ const protect = async (req, res, next) => {
        return next(new Error('User account is deactivated'));
      }

+      // An admin viewing as this user: only while the session is live, and read-only.
+      if (decoded.imp) {
+        const { liveSession } = require('../utils/impersonation');
+        const session = await liveSession(String(decoded.imp));
+        if (!session || session.targetUserId !== req.user.id) {
+          return res.status(401).json({ message: 'The impersonation session has ended.', code: 'IMPERSONATION_ENDED' });
+        }
+        req.impersonation = session;
+        req.readOnly = true;
+      }
+
      // Revocation check — tokenVersion in JWT must match DB
      // Old tokens without tokenVersion are treated as version 0
      const tokenVer = decoded.tokenVersion ?? 0;
@@ -60,7 +71,8 @@ const protect = async (req, res, next) => {
      // requirement (or the user's promotion) is sent back to log in, where they
      // enrol. The setup wizard's own token gets a short grace period.
      const inSetupGrace = decoded.setup === true && Date.now() / 1000 - (decoded.iat || 0) < SETUP_TOKEN_GRACE_SECONDS;
-      if (!inSetupGrace && (await mustEnrolTwoFactor(req.user))) {
+      // (An impersonating admin has already passed 2FA themselves.)
+      if (!inSetupGrace && !req.impersonation && (await mustEnrolTwoFactor(req.user))) {
        return res.status(401).json({
          message: 'Two-factor authentication is required for your role. Please log in again to set it up.',
          code: 'TWO_FACTOR_REQUIRED',
@@ -128,7 +140,17 @@ const optionalAuth = async (req, res, next) => {
      select: { id: true, name: true, email: true, role: true, isActive: true, createdAt: true, updatedAt: true, phoneNumber: true, tokenVersion: true }
    });
    if (user && user.isActive && (decoded.tokenVersion ?? 0) === user.tokenVersion) {
-      req.user = user;
+      if (decoded.imp) {
+        const { liveSession } = require('../utils/impersonation');
+        const session = await liveSession(String(decoded.imp));
+        req.readOnly = true;
+        if (session && session.targetUserId === user.id) {
+          req.user = user;
+          req.impersonation = session;
+        }
+      } else {
+        req.user = user;
+      }
    }
  } catch {
    // Token invalid or expired — proceed without user
@@ -1,8 +1,15 @@
 const express = require('express');
 const router = express.Router();
 const { listAuditLog } = require('../controllers/adminAuditController');
+const { startImpersonation, endImpersonation, logPageView, currentImpersonation, listSessions } = require('../controllers/impersonationController');
 const { protect, admin } = require('../middleware/authMiddleware');

 router.get('/audit-log', protect, admin, listAuditLog);
+router.get('/impersonation-sessions', protect, admin, listSessions);
+// Called with the impersonation token itself (which belongs to the viewed user).
+router.post('/impersonate/end', protect, endImpersonation);
+router.post('/impersonate/log', protect, logPageView);
+router.get('/impersonate/current', protect, currentImpersonation);
+router.post('/impersonate/:userId', protect, admin, startImpersonation);

 module.exports = router;
@@ -0,0 +1,22 @@
+const express = require('express');
+const router = express.Router();
+const {
+  getBoard, createSet, updateSet, deleteSet, createGroup, updateGroup, deleteGroup,
+  assign, autoAssign, clearAssignments, getSetLists, getMyGroups,
+} = require('../controllers/allocationController');
+const { protect, staff, supervisor } = require('../middleware/authMiddleware');
+
+router.get('/my-groups', protect, staff, getMyGroups);
+router.get('/event/:eventId', protect, supervisor, getBoard);
+router.post('/sets', protect, supervisor, createSet);
+router.put('/sets/:id', protect, supervisor, updateSet);
+router.delete('/sets/:id', protect, supervisor, deleteSet);
+router.get('/sets/:id/lists', protect, supervisor, getSetLists);
+router.post('/sets/:id/groups', protect, supervisor, createGroup);
+router.put('/sets/:id/assignments', protect, supervisor, assign);
+router.delete('/sets/:id/assignments', protect, supervisor, clearAssignments);
+router.post('/sets/:id/auto', protect, supervisor, autoAssign);
+router.put('/groups/:id', protect, supervisor, updateGroup);
+router.delete('/groups/:id', protect, supervisor, deleteGroup);
+
+module.exports = router;
@@ -0,0 +1,18 @@
+const express = require('express');
+const rateLimit = require('express-rate-limit');
+const router = express.Router();
+const { trackStage, getFunnel } = require('../controllers/analyticsController');
+const { protect, supervisor } = require('../middleware/authMiddleware');
+
+const trackLimiter = rateLimit({
+  windowMs: 60 * 1000,
+  max: 60,
+  standardHeaders: true,
+  legacyHeaders: false,
+  handler: (req, res) => res.status(204).end(), // silently drop floods
+});
+
+router.post('/track', trackLimiter, trackStage);
+router.get('/funnel', protect, supervisor, getFunnel);
+
+module.exports = router;
@@ -0,0 +1,20 @@
+const express = require('express');
+const rateLimit = require('express-rate-limit');
+const router = express.Router();
+const { getConsent, answerConsent, listEventConsent, resendRequest, resendPending, rerequestConsent, medicalList } = require('../controllers/consentController');
+const { protect, staff, supervisor } = require('../middleware/authMiddleware');
+
+// The token in the link is the parent's only credential, so keep guessing slow.
+const consentLimiter = rateLimit({ windowMs: 60 * 1000, max: 30, message: { message: 'Too many attempts. Please try again in a minute.' } });
+
+router.get('/events/:eventId', protect, staff, listEventConsent);
+router.post('/events/:eventId/resend-pending', protect, supervisor, resendPending);
+router.post('/events/:eventId/rerequest', protect, supervisor, rerequestConsent);
+router.get('/events/:eventId/medical', protect, supervisor, medicalList);
+router.post('/requests/:id/resend', protect, resendRequest);
+
+// Public consent page
+router.get('/:token', consentLimiter, getConsent);
+router.post('/:token', consentLimiter, answerConsent);
+
+module.exports = router;
@@ -0,0 +1,14 @@
+const express = require('express');
+const router = express.Router();
+const { getEventFeedback, saveEventFeedback, deleteEventFeedback, sendNow, getPublicForm, submitPublicForm, getSummary } = require('../controllers/feedbackController');
+const { protect, supervisor } = require('../middleware/authMiddleware');
+
+router.get('/public/:token', getPublicForm);
+router.post('/public/:token', submitPublicForm);
+router.get('/summary', protect, supervisor, getSummary);
+router.get('/event/:eventId', protect, supervisor, getEventFeedback);
+router.put('/event/:eventId', protect, supervisor, saveEventFeedback);
+router.delete('/event/:eventId', protect, supervisor, deleteEventFeedback);
+router.post('/event/:eventId/send-now', protect, supervisor, sendNow);
+
+module.exports = router;
@@ -0,0 +1,15 @@
+const express = require('express');
+const router = express.Router();
+const { listLocks, createLock, getSnapshot, syncLock, releaseLock, forceRelease, listReports, reviewReport } = require('../controllers/scanLockController');
+const { protect, staff, supervisor } = require('../middleware/authMiddleware');
+
+router.get('/', protect, staff, listLocks);
+router.post('/', protect, staff, createLock);
+router.get('/reports', protect, supervisor, listReports);
+router.post('/reports/:id/review', protect, supervisor, reviewReport);
+router.get('/:id/snapshot', protect, staff, getSnapshot);
+router.post('/:id/sync', protect, staff, syncLock);
+router.post('/:id/force-release', protect, supervisor, forceRelease);
+router.delete('/:id', protect, staff, releaseLock);
+
+module.exports = router;
@@ -0,0 +1,10 @@
+const express = require('express');
+const router = express.Router();
+const { getEventSponsorship, createSponsorCheckout, getPool } = require('../controllers/sponsorshipController');
+const { protect, supervisor, optionalAuth } = require('../middleware/authMiddleware');
+
+router.get('/event/:eventId', getEventSponsorship);
+router.get('/event/:eventId/pool', protect, supervisor, getPool);
+router.post('/checkout', optionalAuth, createSponsorCheckout);
+
+module.exports = router;
@@ -13,7 +13,9 @@ const {
  emailTickets,
  sendTicketsTo,
  getRecentScans,
-  getScanStats
+  getScanStats,
+  transferTicketHandler,
+  getTicketTransfers
 } = require('../controllers/ticketController');
 const { protect, admin, supervisor, staff } = require('../middleware/authMiddleware');

@@ -21,6 +23,8 @@ const { protect, admin, supervisor, staff } = require('../middleware/authMiddlew
 router.get('/mytickets', protect, getUserTickets);
 router.get('/:id', protect, getTicketById);
 router.post('/email', protect, emailTickets);
+router.post('/:id/transfer', protect, transferTicketHandler);
+router.get('/:id/transfers', protect, getTicketTransfers);

 // Staff routes
 router.post('/send-to', protect, staff, sendTicketsTo);
@@ -0,0 +1,19 @@
+const express = require('express');
+const rateLimit = require('express-rate-limit');
+const router = express.Router();
+const { joinWaitlist, myWaitlist, leaveWaitlist, claimInfo, eventWaitlist, offerManually, moveEntry, removeEntry } = require('../controllers/waitlistController');
+const { protect, staff, supervisor, optionalAuth } = require('../middleware/authMiddleware');
+
+// Claim links are credentials, so keep guessing slow.
+const claimLimiter = rateLimit({ windowMs: 60 * 1000, max: 30, message: { message: 'Too many attempts. Please try again in a minute.' } });
+
+router.post('/', optionalAuth, joinWaitlist);
+router.get('/mine', protect, myWaitlist);
+router.get('/claim/:token', claimLimiter, claimInfo);
+router.get('/events/:eventId', protect, staff, eventWaitlist);
+router.post('/:id/offer', protect, supervisor, offerManually);
+router.post('/:id/move', protect, supervisor, moveEntry);
+router.post('/:id/remove', protect, supervisor, removeEntry);
+router.delete('/:id', protect, leaveWaitlist);
+
+module.exports = router;
@@ -33,4 +33,35 @@ async function findAccountByContact({ email, phone: rawPhone }, db = prisma) {
  return { phone, emailUser, phoneUser, conflict, user: conflict ? null : (emailUser || phoneUser || null) };
 }

-module.exports = { findAccountByContact, hasValidEmail };
+/**
+ * The account for these contact details, or a new inactive one (same as guest
+ * registration: a placeholder email for phone-only people, a random password, and an
+ * activation link sent by the caller when `created` is true).
+ */
+async function findOrCreateAccount({ name, email, phone }, db = prisma) {
+  const match = await findAccountByContact({ email, phone }, db);
+  if (match.conflict) {
+    const err = new Error('That email address and phone number belong to two different accounts. Use just one of them.');
+    err.statusCode = 400;
+    throw err;
+  }
+  if (match.user) return { user: match.user, created: false };
+  const { v4: uuidv4 } = require('uuid');
+  const { hashPassword } = require('../config/auth');
+  const validEmail = hasValidEmail(email);
+  const user = await db.user.create({
+    data: {
+      id: uuidv4(),
+      name,
+      email: validEmail ? String(email).trim() : `guest+${uuidv4().slice(0, 8)}@guest.local`,
+      password: await hashPassword(uuidv4()),
+      phoneNumber: match.phone || null,
+      isActive: false,
+      notificationPreference: validEmail && match.phone ? 'both' : validEmail ? 'email' : 'whatsapp',
+      updatedAt: new Date(),
+    },
+  });
+  return { user, created: true };
+}
+
+module.exports = { findAccountByContact, findOrCreateAccount, hasValidEmail };
@@ -0,0 +1,107 @@
+/**
+ * Group / room allocation — placing named attendees into the groups of an allocation
+ * set ("Rooms", "Buses"…). Groups can have a capacity and a gender restriction.
+ * The placement rules and auto-allocate are pure, so they're unit-tested.
+ */
+
+const GENDERS = ['male', 'female'];
+
+function allocationError(message, statusCode = 400) {
+  const err = new Error(message);
+  err.statusCode = statusCode;
+  return err;
+}
+
+/** Normalises a gender value ('male' | 'female' | null); throws on anything else. */
+function cleanGender(value) {
+  if (value === undefined || value === null || value === '') return null;
+  const g = String(value).trim().toLowerCase();
+  if (!GENDERS.includes(g)) throw allocationError('Gender must be male or female.');
+  return g;
+}
+
+/**
+ * Why `attendees` can't all join `group` (which has `count` members already), or null. Pure.
+ * @param {object} group - { name, capacity?, gender? }
+ */
+function joinBlocker(group, count, attendees) {
+  if (group.capacity != null && count + attendees.length > group.capacity) {
+    return `${group.name} is full (${group.capacity} places).`;
+  }
+  if (group.gender) {
+    const wrong = attendees.find(a => a.gender !== group.gender);
+    if (wrong) return `${group.name} is for ${group.gender === 'male' ? 'males' : 'females'} only${wrong.gender ? '' : ` — ${wrong.name} has no gender recorded`}.`;
+  }
+  return null;
+}
+
+/**
+ * Places every unassigned attendee it can. Pure.
+ *
+ * Groups fill evenly (the emptiest group that fits goes first). With mode 'together',
+ * people on the same registration (siblings) stay in one group when a group can take
+ * them all, otherwise they're placed one by one. With mode 'split', people on the same
+ * registration (friends booking together) are spread across groups where possible.
+ *
+ * @param {object} p
+ * @param {Array} p.groups    - [{ id, name, capacity?, gender?, order? }]
+ * @param {Array} p.attendees - [{ id, name, registrationId, gender? }]
+ * @param {Map}   p.assigned  - attendeeId → groupId for attendees already placed
+ * @param {'together'|'split'} [p.mode]
+ * @returns {{ placements: {attendeeId, groupId}[], unplaced: string[] }}
+ */
+function autoAllocate({ groups, attendees, assigned = new Map(), mode = 'together' }) {
+  const count = new Map(groups.map(g => [g.id, 0]));
+  const regInGroup = new Map(groups.map(g => [g.id, new Map()]));
+  const byId = new Map(attendees.map(a => [a.id, a]));
+  const place = (groupId, a) => {
+    count.set(groupId, count.get(groupId) + 1);
+    const regs = regInGroup.get(groupId);
+    regs.set(a.registrationId, (regs.get(a.registrationId) || 0) + 1);
+  };
+  for (const [attendeeId, groupId] of assigned) {
+    const a = byId.get(attendeeId);
+    if (a && count.has(groupId)) place(groupId, a);
+  }
+
+  const todo = attendees.filter(a => !assigned.has(a.id));
+  let units;
+  if (mode === 'together') {
+    const byReg = new Map();
+    for (const a of todo) byReg.set(a.registrationId, [...(byReg.get(a.registrationId) || []), a]);
+    units = [...byReg.values()].sort((x, y) => y.length - x.length);
+  } else {
+    units = todo.map(a => [a]);
+  }
+
+  const orderOf = new Map(groups.map((g, i) => [g.id, g.order ?? i]));
+  const best = (members) => {
+    const reg = members[0].registrationId;
+    const fitting = groups.filter(g => !joinBlocker(g, count.get(g.id), members));
+    if (fitting.length === 0) return null;
+    fitting.sort((x, y) =>
+      (mode === 'split' ? (regInGroup.get(x.id).get(reg) || 0) - (regInGroup.get(y.id).get(reg) || 0) : 0)
+      || count.get(x.id) - count.get(y.id)
+      || orderOf.get(x.id) - orderOf.get(y.id));
+    return fitting[0];
+  };
+
+  const placements = [];
+  const unplaced = [];
+  const queue = [...units];
+  while (queue.length) {
+    const unit = queue.shift();
+    const g = best(unit);
+    if (g) {
+      for (const a of unit) { place(g.id, a); placements.push({ attendeeId: a.id, groupId: g.id }); }
+    } else if (unit.length > 1) {
+      // Can't keep them together — place them one by one instead.
+      queue.unshift(...unit.map(a => [a]));
+    } else {
+      unplaced.push(unit[0].id);
+    }
+  }
+  return { placements, unplaced };
+}
+
+module.exports = { GENDERS, allocationError, cleanGender, joinBlocker, autoAllocate };
@@ -0,0 +1,220 @@
+/**
+ * Registration funnel — first-party, consent-based tracking.
+ *
+ * The browser only tracks after the visitor accepts cookies: it keeps a random session
+ * id and reports 'view' (event page) and 'start' (registration page). 'submit' is
+ * recorded here when a registration arrives carrying that session id, and 'paid' is
+ * read from that registration's status, so no personal data is stored with the events —
+ * just a stage, a traffic source and a device type (worked out from the User-Agent,
+ * which isn't kept).
+ *
+ * Counts are "reached": a session counts at a stage if it got that far or further, so a
+ * visitor who went straight to the registration page still counts as a view. Raw rows
+ * older than 90 days are rolled up into AnalyticsDaily and deleted.
+ */
+
+const prisma = require('../config/db');
+
+const STAGES = ['view', 'start', 'submit', 'paid'];
+const TRACKED = ['view', 'start'];
+const RAW_DAYS = 90;
+const SESSION_RE = /^[a-zA-Z0-9-]{16,64}$/;
+
+const dayOf = (d) => new Date(d).toISOString().slice(0, 10);
+
+// ─── Pure helpers ─────────────────────────────────────────────────────────────
+
+const validSession = (sid) => typeof sid === 'string' && SESSION_RE.test(sid);
+
+/** 'mobile' | 'tablet' | 'desktop', or null for bots. Pure. */
+function deviceFromUA(ua) {
+  const s = String(ua || '');
+  if (!s || /bot|crawl|spider|slurp|preview|headless|lighthouse/i.test(s)) return null;
+  if (/iPad|Tablet|PlayBook|Silk|(Android(?!.*Mobile))/i.test(s)) return 'tablet';
+  if (/Mobi|iPhone|iPod|Android|Windows Phone/i.test(s)) return 'mobile';
+  return 'desktop';
+}
+
+/** A traffic source label: utm_source / short-link alias, tidied; 'direct' when none. Pure. */
+function cleanSource(src) {
+  const s = String(src || '').trim().toLowerCase().replace(/[^a-z0-9_.-]/g, '').slice(0, 50);
+  return s || 'direct';
+}
+
+/**
+ * One entry per session: the furthest stage reached, its source/device, and the day each
+ * stage was reached. Pure.
+ * @param {Array} events - [{ sessionId, stage, createdAt, source, device }]
+ * @param {Set} paidSessions - session ids whose registration is paid
+ */
+function sessionsFrom(events, paidSessions = new Set()) {
+  const map = new Map();
+  for (const e of [...events].sort((a, b) => new Date(a.createdAt) - new Date(b.createdAt))) {
+    const s = map.get(e.sessionId) || { sessionId: e.sessionId, reach: -1, source: null, device: null, days: {} };
+    const idx = STAGES.indexOf(e.stage);
+    if (idx > s.reach) s.reach = idx;
+    if (!s.days[e.stage]) s.days[e.stage] = dayOf(e.createdAt);
+    if (!s.source && e.source) s.source = e.source;
+    if (!s.device && e.device) s.device = e.device;
+    map.set(e.sessionId, s);
+  }
+  for (const s of map.values()) {
+    if (paidSessions.has(s.sessionId) && s.reach >= 2) { s.reach = 3; s.days.paid = s.days.submit; }
+    // A stage reached without its own event (e.g. no 'view' for a direct link) takes the
+    // day of the next stage that was recorded.
+    for (let i = STAGES.length - 1; i >= 0; i--) {
+      if (i <= s.reach && !s.days[STAGES[i]]) s.days[STAGES[i]] = s.days[STAGES[i + 1]];
+    }
+    s.source = s.source || 'direct';
+    s.device = s.device || 'unknown';
+  }
+  return [...map.values()];
+}
+
+/** Rows for AnalyticsDaily: sessions reaching each stage per day/source/device. Pure. */
+function rollupRows(sessions) {
+  const by = new Map();
+  for (const s of sessions) {
+    for (let i = 0; i <= s.reach; i++) {
+      const key = [s.days[STAGES[i]], STAGES[i], s.source, s.device].join('|');
+      by.set(key, (by.get(key) || 0) + 1);
+    }
+  }
+  return [...by.entries()].map(([key, n]) => {
+    const [day, stage, source, device] = key.split('|');
+    return { day, stage, source, device, sessions: n };
+  });
+}
+
+const emptyCounts = () => ({ view: 0, start: 0, submit: 0, paid: 0 });
+
+/**
+ * The funnel report from raw sessions plus rolled-up rows. Pure.
+ * @returns {{ totals, conversion, trend, bySource, byDevice }}
+ */
+function funnelReport(sessions, daily = []) {
+  const rows = [...rollupRows(sessions), ...daily.map(d => ({ ...d, day: typeof d.day === 'string' ? d.day.slice(0, 10) : dayOf(d.day) }))];
+  const totals = emptyCounts();
+  const trend = new Map(), bySource = new Map(), byDevice = new Map();
+  const add = (map, key, stage, n) => { const c = map.get(key) || emptyCounts(); c[stage] += n; map.set(key, c); };
+  for (const r of rows) {
+    totals[r.stage] += r.sessions;
+    add(trend, r.day, r.stage, r.sessions);
+    add(bySource, r.source, r.stage, r.sessions);
+    add(byDevice, r.device, r.stage, r.sessions);
+  }
+  const pct = (a, b) => (b ? Math.round((a / b) * 1000) / 10 : null);
+  const list = (map) => [...map.entries()].map(([key, c]) => ({ key, ...c, conversion: pct(c.paid, c.view) })).sort((a, b) => b.view - a.view);
+  return {
+    totals,
+    conversion: {
+      start: pct(totals.start, totals.view), submit: pct(totals.submit, totals.view), paid: pct(totals.paid, totals.view),
+      startToSubmit: pct(totals.submit, totals.start), submitToPaid: pct(totals.paid, totals.submit),
+    },
+    trend: [...trend.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([day, c]) => ({ day, ...c })),
+    bySource: list(bySource),
+    byDevice: list(byDevice),
+  };
+}
+
+// ─── Database ─────────────────────────────────────────────────────────────────
+
+/** Records a 'view' or 'start'. Repeats from the same session are ignored. */
+async function track({ sessionId, eventId, stage, source, userAgent }) {
+  if (!validSession(sessionId) || !TRACKED.includes(stage) || typeof eventId !== 'string') return false;
+  const device = deviceFromUA(userAgent);
+  if (!device) return false; // bots
+  const event = await prisma.event.findUnique({ where: { id: eventId }, select: { id: true } });
+  if (!event) return false;
+  await prisma.analyticsEvent.createMany({ data: [{ sessionId, eventId, stage, source: cleanSource(source), device }], skipDuplicates: true });
+  return true;
+}
+
+/** 'submit' for a registration made on the public registration page. */
+async function recordSubmit(registration, sessionId) {
+  if (!validSession(sessionId) || !registration?.id) return;
+  const first = await prisma.analyticsEvent.findFirst({ where: { sessionId, eventId: registration.eventId }, orderBy: { createdAt: 'asc' } });
+  await prisma.registration.updateMany({ where: { id: registration.id, analyticsSessionId: null }, data: { analyticsSessionId: sessionId } });
+  await prisma.analyticsEvent.createMany({
+    data: [{ sessionId, eventId: registration.eventId, stage: 'submit', source: first?.source || 'direct', device: first?.device || null }],
+    skipDuplicates: true,
+  });
+}
+
+async function paidSessionsFor(eventIds, sessionIds) {
+  if (!sessionIds.length) return new Set();
+  const regs = await prisma.registration.findMany({
+    where: { eventId: { in: eventIds }, status: 'paid', analyticsSessionId: { in: sessionIds } },
+    select: { analyticsSessionId: true },
+  });
+  return new Set(regs.map(r => r.analyticsSessionId));
+}
+
+/**
+ * The funnel for some events between two dates (by the day each stage was reached).
+ * Adds a by-ticket-option breakdown from the tracked registrations.
+ */
+async function funnelFor(eventIds, { from, to } = {}) {
+  const range = {};
+  if (from) range.gte = new Date(from);
+  if (to) { const t = new Date(to); t.setHours(23, 59, 59, 999); range.lte = t; }
+  const where = { eventId: { in: eventIds }, ...(from || to ? { createdAt: range } : {}) };
+  const events = await prisma.analyticsEvent.findMany({ where, select: { sessionId: true, stage: true, createdAt: true, source: true, device: true, eventId: true } });
+  // A session is per event (the same browser can look at several events).
+  const keyed = events.map(e => ({ ...e, sessionId: `${e.eventId}:${e.sessionId}` }));
+  const paidRaw = await paidSessionsFor(eventIds, [...new Set(events.map(e => e.sessionId))]);
+  const paid = new Set(events.filter(e => paidRaw.has(e.sessionId)).map(e => `${e.eventId}:${e.sessionId}`));
+  const daily = await prisma.analyticsDaily.findMany({
+    where: { eventId: { in: eventIds }, ...(from || to ? { day: range } : {}) },
+    select: { day: true, stage: true, source: true, device: true, sessions: true },
+  });
+  const report = funnelReport(sessionsFrom(keyed, paid), daily);
+
+  const regs = await prisma.registration.findMany({
+    where: { eventId: { in: eventIds }, analyticsSessionId: { not: null }, status: { not: 'cancelled' }, ...(from || to ? { createdAt: range } : {}) },
+    select: { status: true, registrationOptions: { select: { quantity: true, eventOption: { select: { name: true } }, variant: { select: { name: true } } } } },
+  });
+  const byOption = new Map();
+  for (const r of regs) {
+    for (const ro of r.registrationOptions) {
+      const key = ro.variant ? `${ro.eventOption.name} — ${ro.variant.name}` : ro.eventOption.name;
+      const c = byOption.get(key) || { key, submitted: 0, paid: 0 };
+      c.submitted += 1;
+      if (r.status === 'paid') c.paid += 1;
+      byOption.set(key, c);
+    }
+  }
+  return { ...report, byOption: [...byOption.values()].sort((a, b) => b.submitted - a.submitted) };
+}
+
+/** Rolls up sessions whose last activity is older than 90 days, then deletes their rows. */
+async function rollupOldEvents(now = new Date()) {
+  const cutoff = new Date(now.getTime() - RAW_DAYS * 864e5);
+  const groups = await prisma.analyticsEvent.groupBy({ by: ['eventId', 'sessionId'], _max: { createdAt: true }, having: { createdAt: { _max: { lt: cutoff } } } });
+  if (groups.length === 0) return 0;
+  const byEvent = new Map();
+  for (const g of groups) byEvent.set(g.eventId, [...(byEvent.get(g.eventId) || []), g.sessionId]);
+  let rolled = 0;
+  for (const [eventId, sessionIds] of byEvent) {
+    for (let i = 0; i < sessionIds.length; i += 500) {
+      const batch = sessionIds.slice(i, i + 500);
+      const events = await prisma.analyticsEvent.findMany({ where: { eventId, sessionId: { in: batch } } });
+      const paid = await paidSessionsFor([eventId], batch);
+      const rows = rollupRows(sessionsFrom(events, paid));
+      await prisma.$transaction(async (tx) => {
+        for (const r of rows) {
+          await tx.analyticsDaily.upsert({
+            where: { eventId_day_stage_source_device: { eventId, day: new Date(r.day), stage: r.stage, source: r.source, device: r.device } },
+            update: { sessions: { increment: r.sessions } },
+            create: { eventId, day: new Date(r.day), stage: r.stage, source: r.source, device: r.device, sessions: r.sessions },
+          });
+        }
+        await tx.analyticsEvent.deleteMany({ where: { eventId, sessionId: { in: batch } } });
+      });
+      rolled += batch.length;
+    }
+  }
+  return rolled;
+}
+
+module.exports = { STAGES, RAW_DAYS, validSession, deviceFromUA, cleanSource, sessionsFrom, rollupRows, funnelReport, track, recordSubmit, funnelFor, rollupOldEvents };
@@ -11,10 +11,16 @@
 *   accounts, in which case nothing is linked.
 * - Registration.ticketDelivery = 'each' sends each attendee their own ticket by
 *   email/WhatsApp; attendees with no contact details fall back to the payer.
+ * - Youth events (requiresParentalConsent): every main place must be named with a date
+ *   of birth, and anyone under 18 on the start date needs a parent/guardian name, email
+ *   and phone (see utils/consent.js).
 */

 const prisma = require('../config/db');
 const { findAccountByContact } = require('./accountMatch');
+const { isMinor } = require('./consent');
+
+const EMAIL_RE = /^[^@\s]+@[^@\s]+\.[^@\s]+$/;

 const lineKey = (eventOptionId, variantId) => `${eventOptionId}::${variantId || ''}`;

@@ -34,27 +40,67 @@ function attendeeError(message) {
 * @param {object} [namedByKey] - places on those lines already named (and being kept)
 */
 function validateAttendees(event, placesByKey, attendees, namedByKey = {}) {
-  if (!attendees || attendees.length === 0) return [];
-  if (!event.allowNamedAttendees) throw attendeeError('This event doesn\'t take attendee names.');
-  if (!Array.isArray(attendees)) throw attendeeError('attendees must be a list');
+  const consent = !!event.requiresParentalConsent;
+  if ((!attendees || attendees.length === 0) && !consent) return [];
+  if (!event.allowNamedAttendees && !consent) throw attendeeError('This event doesn\'t take attendee names.');
+  if (!Array.isArray(attendees || [])) throw attendeeError('attendees must be a list');

  const countByKey = {};
-  return attendees.map((a, i) => {
+  const cleaned = (attendees || []).map((a, i) => {
    const option = (event.eventOptions || []).find(o => o.id === a?.eventOptionId);
    if (!option) throw attendeeError(`Attendee ${i + 1}: unknown ticket option.`);
    if (!option.isMainTicket) throw attendeeError(`Attendee ${i + 1}: names can only be given for "${option.name}" main tickets.`);
    const name = String(a.name || '').trim();
    if (!name) throw attendeeError(`Attendee ${i + 1}: enter a name.`);
    const email = String(a.email || '').trim() || null;
-    if (email && !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) throw attendeeError(`Attendee ${i + 1}: "${email}" isn't a valid email address.`);
+    if (email && !EMAIL_RE.test(email)) throw attendeeError(`Attendee ${i + 1}: "${email}" isn't a valid email address.`);
    const phone = String(a.phone || '').trim() || null;
    const key = lineKey(a.eventOptionId, a.variantId);
    countByKey[key] = (countByKey[key] || 0) + 1;
    if (countByKey[key] + (namedByKey[key] || 0) > (placesByKey[key] || 0)) {
      throw attendeeError(`More names than "${option.name}" tickets.`);
    }
-    return { eventOptionId: a.eventOptionId, variantId: a.variantId || null, name, email, phone };
+
+    // Date of birth (always kept if given) and, for youth events, parent details.
+    let dateOfBirth = null;
+    if (a.dateOfBirth) {
+      dateOfBirth = new Date(a.dateOfBirth);
+      if (isNaN(dateOfBirth.getTime()) || dateOfBirth > new Date()) throw attendeeError(`${name}: enter a valid date of birth.`);
+    } else if (consent) {
+      throw attendeeError(`${name}: enter a date of birth.`);
+    }
+    let gender = null;
+    if (a.gender) {
+      gender = String(a.gender).trim().toLowerCase();
+      if (!['male', 'female'].includes(gender)) throw attendeeError(`${name}: gender must be male or female.`);
+    } else if (event.collectGender) {
+      throw attendeeError(`${name}: choose a gender.`);
+    }
+    const parentName = String(a.parentName || '').trim() || null;
+    const parentEmail = String(a.parentEmail || '').trim() || null;
+    const parentPhone = String(a.parentPhone || '').trim() || null;
+    if (consent && isMinor(dateOfBirth, event.startDate)) {
+      if (!parentName || !parentEmail || !parentPhone) {
+        throw attendeeError(`${name} is under 18, so a parent or guardian's name, email and phone are needed for consent.`);
+      }
+      if (!EMAIL_RE.test(parentEmail)) throw attendeeError(`${name}: "${parentEmail}" isn't a valid parent email address.`);
+    }
+    return { eventOptionId: a.eventOptionId, variantId: a.variantId || null, name, email, phone, dateOfBirth, gender, parentName, parentEmail, parentPhone };
  });
+
+  // Youth events need every main place named (with a date of birth).
+  if (consent) {
+    for (const o of event.eventOptions || []) {
+      if (!o.isMainTicket) continue;
+      for (const [key, places] of Object.entries(placesByKey)) {
+        if (!key.startsWith(`${o.id}::`)) continue;
+        if ((countByKey[key] || 0) + (namedByKey[key] || 0) < places) {
+          throw attendeeError(`This is a youth event — add a name and date of birth for every "${o.name}" ticket.`);
+        }
+      }
+    }
+  }
+  return cleaned;
 }

 /**
@@ -147,6 +193,11 @@ async function createAttendees(registrationId, attendees, db = prisma) {
        name: a.name,
        email: a.email,
        phone: a.phone,
+        dateOfBirth: a.dateOfBirth || null,
+        gender: a.gender || null,
+        parentName: a.parentName || null,
+        parentEmail: a.parentEmail || null,
+        parentPhone: a.parentPhone || null,
        userId: match.user?.id || null,
        order,
      },
@@ -0,0 +1,332 @@
+/**
+ * Parental consent for youth events.
+ *
+ * Rules:
+ * - On an event with requiresParentalConsent, every attendee gives a date of birth.
+ *   Anyone under 18 on the event's start date needs a parent/guardian (name, email,
+ *   phone), who is sent a consent request by email AND WhatsApp — regardless of anyone's
+ *   notification preference.
+ * - A request's link token is random; only its HMAC is stored. Links expire when the
+ *   event ends and can be re-sent (which issues a new token).
+ * - The parent's answer records the time, IP, device, typed name, and the exact consent
+ *   text and version they saw. Medical/emergency details are stored encrypted and purged
+ *   a set number of days after the event (setting consent_medical_retention_days).
+ * - Tickets are issued as normal but can't be checked in until consent is given — the
+ *   latest request for the attendee decides. On a consent event, a ticket with no named
+ *   attendee is treated as missing consent. Supervisors can override (audited).
+ * - Reminders go 2 days after the request, then every 3 days, until answered or the event.
+ */
+
+const crypto = require('crypto');
+const prisma = require('../config/db');
+
+const DAY = 24 * 60 * 60 * 1000;
+const FIRST_REMINDER_AFTER = 2 * DAY;
+const REMINDER_EVERY = 3 * DAY;
+const DEFAULT_RETENTION_DAYS = 30;
+
+function consentError(message, statusCode = 400) {
+  const err = new Error(message);
+  err.statusCode = statusCode;
+  return err;
+}
+
+// ─── Pure helpers ─────────────────────────────────────────────────────────────
+
+/** Whole years old on `onDate`. */
+function ageOn(dateOfBirth, onDate) {
+  const dob = new Date(dateOfBirth);
+  const on = new Date(onDate);
+  let age = on.getUTCFullYear() - dob.getUTCFullYear();
+  const beforeBirthday = on.getUTCMonth() < dob.getUTCMonth()
+    || (on.getUTCMonth() === dob.getUTCMonth() && on.getUTCDate() < dob.getUTCDate());
+  if (beforeBirthday) age -= 1;
+  return age;
+}
+
+/** Under 18 on the event's start date. */
+function isMinor(dateOfBirth, eventStart) {
+  if (!dateOfBirth) return false;
+  return ageOn(dateOfBirth, eventStart) < 18;
+}
+
+/**
+ * Consent state for one attendee: 'not_required' | 'missing' | 'pending' | 'given' | 'declined'.
+ * `latest` is the attendee's most recent ConsentRequest (or null).
+ */
+function consentStatusFor(attendee, event, latest) {
+  if (!event?.requiresParentalConsent) return 'not_required';
+  if (!attendee) return 'missing'; // unnamed place on a consent event
+  if (!isMinor(attendee.dateOfBirth, event.startDate)) return 'not_required';
+  if (!latest) return 'missing';
+  return latest.status;
+}
+
+/** Whether a pending request is due a reminder now. */
+function reminderDue(request, now = new Date()) {
+  if (!request || request.status !== 'pending') return false;
+  const t = new Date(now).getTime();
+  if (t >= new Date(request.expiresAt).getTime()) return false;
+  const gap = request.remindersSent === 0 ? FIRST_REMINDER_AFTER : REMINDER_EVERY;
+  return t - new Date(request.lastSentAt).getTime() >= gap;
+}
+
+const str = (v, max = 500) => String(v ?? '').trim().slice(0, max);
+
+/**
+ * Checks a parent's answer on the consent page. Pure. Returns the cleaned answer.
+ * @param {object} body  - { decision: 'give'|'decline', signedName, isGuardian, medical, emergency, photoConsent }
+ * @param {object} event - with consentCollectMedical / Emergency / Photo
+ */
+function validateConsentAnswer(body, event) {
+  const decision = body?.decision;
+  if (decision !== 'give' && decision !== 'decline') throw consentError('Choose to give or decline consent.');
+  const signedName = str(body.signedName, 200);
+  if (signedName.length < 2) throw consentError('Type your full name to sign.');
+  if (body.isGuardian !== true) throw consentError('Confirm that you are the parent or legal guardian.');
+
+  const out = { decision, signedName, medical: null, emergency: null, photoConsent: null };
+  if (decision === 'decline') return out;
+
+  if (event.consentCollectMedical) {
+    const m = body.medical || {};
+    out.medical = {
+      allergies: str(m.allergies), medication: str(m.medication),
+      conditions: str(m.conditions), medicalAid: str(m.medicalAid, 200),
+    };
+  }
+  if (event.consentCollectEmergency) {
+    const em = body.emergency || {};
+    out.emergency = { name: str(em.name, 200), phone: str(em.phone, 40), relationship: str(em.relationship, 100) };
+    if (!out.emergency.name || !out.emergency.phone) throw consentError('Add an emergency contact name and phone number.');
+  }
+  if (event.consentCollectPhoto) {
+    if (body.photoConsent !== true && body.photoConsent !== false) throw consentError('Answer the photo consent question.');
+    out.photoConsent = body.photoConsent;
+  }
+  return out;
+}
+
+// ─── Tokens ───────────────────────────────────────────────────────────────────
+
+const hashToken = (token) => crypto.createHmac('sha256', process.env.JWT_SECRET || '').update(`consent:${token}`).digest('hex');
+const newToken = () => crypto.randomBytes(24).toString('hex');
+
+function consentLink(token) {
+  const base = (process.env.FRONTEND_URL || process.env.APP_BASE_URL || 'http://localhost:3001').split(',')[0].trim().replace(/\/$/, '');
+  return `${base}/consent/${token}`;
+}
+
+// ─── Encryption of medical/emergency details ──────────────────────────────────
+
+function sealJson(value) {
+  if (!value) return null;
+  const { encrypt } = require('./encryption');
+  return encrypt(JSON.stringify(value));
+}
+
+function openJson(value) {
+  if (!value) return null;
+  try {
+    const { decrypt } = require('./encryption');
+    return JSON.parse(decrypt(value));
+  } catch {
+    return null;
+  }
+}
+
+// ─── Database helpers ─────────────────────────────────────────────────────────
+
+/** Latest request per attendee id. */
+async function latestRequestsFor(attendeeIds, db = prisma) {
+  if (!attendeeIds.length) return new Map();
+  const rows = await db.consentRequest.findMany({ where: { attendeeId: { in: attendeeIds } }, orderBy: { createdAt: 'desc' } });
+  const out = new Map();
+  for (const r of rows) if (!out.has(r.attendeeId)) out.set(r.attendeeId, r);
+  return out;
+}
+
+async function sendConsentMessage(request, token, { reminder = false } = {}) {
+  const { sendMail, emailWrapper, ctaButton, fallbackLink } = require('./email');
+  const { waTextAny } = require('./notify');
+  const { isValidZAPhone } = require('./whatsapp');
+  const { getSettingSync } = require('./settingsCache');
+  const orgName = getSettingSync('org_name', process.env.ORG_NAME || 'Cross Code');
+  const ff = `-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif`;
+
+  const event = request.event || await prisma.event.findUnique({ where: { id: request.eventId } });
+  const attendee = request.attendee || await prisma.attendee.findUnique({ where: { id: request.attendeeId } });
+  const link = consentLink(token);
+  const when = event?.startDate ? new Date(event.startDate).toLocaleDateString('en-GB', { day: 'numeric', month: 'long', year: 'numeric' }) : '';
+  const subject = `${reminder ? 'Reminder: ' : ''}Consent needed for ${attendee.name} — ${event.title}`;
+  const intro = `${attendee.name} has been registered for <strong>${event.title}</strong>${when ? ` on <strong>${when}</strong>` : ''}. As their parent or guardian, please review the details and give (or decline) consent.`;
+  const sent = [];
+
+  if (request.parentEmail && request.parentEmail.includes('@')) {
+    const html = emailWrapper(`
+      <p style="font-size:22px;font-weight:800;color:#0f172a;margin:0 0 8px 0">${reminder ? 'A reminder: ' : ''}Parental consent needed</p>
+      <p style="margin:0 0 8px 0;color:#374151;font-family:${ff}">Hi <strong>${request.parentName || 'there'}</strong>,</p>
+      <p style="margin:0 0 24px 0;color:#374151;font-family:${ff}">${intro}</p>
+      ${ctaButton('Review and give consent', link)}
+      ${fallbackLink(link)}
+      <p style="font-size:13px;color:#64748b;margin:16px 0 0 0;font-family:${ff}">${attendee.name} can't be checked in at the event until consent is given.</p>
+    `, { preheader: `Consent needed for ${attendee.name}` });
+    try {
+      await sendMail({ to: request.parentEmail, subject, html, text: `Hi ${request.parentName || 'there'},\n\n${intro.replace(/<[^>]+>/g, '')}\n\nReview and give consent: ${link}\n\n${orgName}` });
+      sent.push('email');
+    } catch (e) {
+      console.warn('[consent] email failed:', e?.message || e);
+    }
+  }
+  if (request.parentPhone && isValidZAPhone(request.parentPhone)) {
+    await waTextAny({ name: request.parentName, phoneNumber: request.parentPhone },
+      `${reminder ? '⏰ Reminder: ' : ''}Hi ${request.parentName || 'there'}, ${attendee.name} has been registered for *${event.title}*${when ? ` on ${when}` : ''}. Please give (or decline) parental consent here: ${link}`);
+    sent.push('WhatsApp');
+  }
+  return sent;
+}
+
+/**
+ * Creates (and sends) a consent request for an attendee. Earlier requests stay as the
+ * record of what was agreed before; this one now decides check-in.
+ */
+async function createConsentRequest(attendee, event) {
+  const token = newToken();
+  const request = await prisma.consentRequest.create({
+    data: {
+      attendeeId: attendee.id,
+      eventId: event.id,
+      tokenHash: hashToken(token),
+      textVersion: event.consentTextVersion || 1,
+      consentText: event.consentText || '',
+      parentName: attendee.parentName,
+      parentEmail: attendee.parentEmail,
+      parentPhone: attendee.parentPhone,
+      expiresAt: event.endDate,
+    },
+  });
+  const sent = await sendConsentMessage({ ...request, event, attendee }, token);
+  return { request, sent };
+}
+
+/**
+ * Makes sure every under-18 attendee on a registration has a consent request — creates
+ * and sends one for anyone who has none yet, or whose parent details have changed since.
+ */
+async function ensureConsentRequests(registrationId) {
+  const reg = await prisma.registration.findUnique({ where: { id: registrationId }, include: { event: true, attendees: true } });
+  if (!reg || !reg.event.requiresParentalConsent || reg.status === 'cancelled') return 0;
+  const minors = reg.attendees.filter(a => isMinor(a.dateOfBirth, reg.event.startDate));
+  const latest = await latestRequestsFor(minors.map(a => a.id));
+  let created = 0;
+  for (const a of minors) {
+    const r = latest.get(a.id);
+    const parentChanged = r && (r.parentEmail !== a.parentEmail || r.parentPhone !== a.parentPhone);
+    if (!r || (parentChanged && r.status !== 'given')) {
+      await createConsentRequest(a, reg.event);
+      created += 1;
+    }
+  }
+  return created;
+}
+
+/** Re-sends a request with a fresh link (the old link stops working). */
+async function resendConsentRequest(requestId) {
+  const request = await prisma.consentRequest.findUnique({ where: { id: requestId }, include: { event: true, attendee: true } });
+  if (!request) throw consentError('Consent request not found', 404);
+  if (request.status !== 'pending') throw consentError(`Consent has already been ${request.status}.`);
+  if (new Date(request.expiresAt) < new Date()) throw consentError('This event has ended.');
+  const token = newToken();
+  await prisma.consentRequest.update({ where: { id: request.id }, data: { tokenHash: hashToken(token), lastSentAt: new Date() } });
+  return sendConsentMessage(request, token, { reminder: true });
+}
+
+async function findRequestByToken(token) {
+  if (!token || typeof token !== 'string' || token.length > 100) return null;
+  return prisma.consentRequest.findUnique({
+    where: { tokenHash: hashToken(token) },
+    include: { event: true, attendee: { include: { registration: { include: { user: { select: { id: true, name: true, email: true, phoneNumber: true, notificationPreference: true } } } } } } },
+  });
+}
+
+/**
+ * Consent state for each ticket id — for the scan gate and staff screens.
+ * @returns {Promise<Map<string, string>>} ticketId → consent status
+ */
+async function consentStatusForTickets(ticketIds) {
+  const tickets = await prisma.ticket.findMany({ where: { id: { in: ticketIds } }, include: { event: true, attendee: true } });
+  const latest = await latestRequestsFor(tickets.map(t => t.attendeeId).filter(Boolean));
+  const out = new Map();
+  for (const t of tickets) {
+    out.set(t.id, consentStatusFor(t.attendee, t.event, t.attendeeId ? latest.get(t.attendeeId) : null));
+  }
+  return out;
+}
+
+/** Daily job: reminders for unanswered requests. */
+async function sendConsentReminders(now = new Date()) {
+  const pending = await prisma.consentRequest.findMany({
+    where: { status: 'pending', expiresAt: { gt: now } },
+    include: { event: true, attendee: true },
+  });
+  // Only the latest request per attendee is still live.
+  const latest = await latestRequestsFor([...new Set(pending.map(r => r.attendeeId))]);
+  let sent = 0;
+  for (const r of pending) {
+    if (latest.get(r.attendeeId)?.id !== r.id || !reminderDue(r, now)) continue;
+    if (new Date(r.event.startDate) <= now) continue; // the event has started
+    const token = newToken();
+    await prisma.consentRequest.update({ where: { id: r.id }, data: { tokenHash: hashToken(token), lastSentAt: now, remindersSent: { increment: 1 } } });
+    await sendConsentMessage(r, token, { reminder: true }).catch(e => console.warn('[consent] reminder failed:', e?.message || e));
+    sent += 1;
+  }
+  return sent;
+}
+
+/** Daily job: delete medical/emergency details a set number of days after the event. */
+async function purgeConsentMedicalData(now = new Date()) {
+  const { getSettingSync } = require('./settingsCache');
+  const days = Math.max(0, parseInt(getSettingSync('consent_medical_retention_days', String(DEFAULT_RETENTION_DAYS)), 10) || DEFAULT_RETENTION_DAYS);
+  const cutoff = new Date(new Date(now).getTime() - days * DAY);
+  const res = await prisma.consentRequest.updateMany({
+    where: { medicalPurgedAt: null, event: { endDate: { lt: cutoff } }, OR: [{ medical: { not: null } }, { emergency: { not: null } }] },
+    data: { medical: null, emergency: null, medicalPurgedAt: now },
+  });
+  return res.count;
+}
+
+/** Clears parent, medical and emergency details for a person's registrations (anonymise). */
+async function clearConsentDataForUser(userId, db = prisma) {
+  const attendees = await db.attendee.findMany({ where: { OR: [{ userId }, { registration: { userId } }] }, select: { id: true } });
+  const ids = attendees.map(a => a.id);
+  if (!ids.length) return 0;
+  await db.attendee.updateMany({ where: { id: { in: ids } }, data: { parentName: null, parentEmail: null, parentPhone: null, dateOfBirth: null, email: null, phone: null } });
+  const res = await db.consentRequest.updateMany({
+    where: { attendeeId: { in: ids } },
+    data: { medical: null, emergency: null, parentName: null, parentEmail: null, parentPhone: null, ip: null, device: null, medicalPurgedAt: new Date() },
+  });
+  return res.count;
+}
+
+module.exports = {
+  DEFAULT_RETENTION_DAYS,
+  consentError,
+  ageOn,
+  isMinor,
+  consentStatusFor,
+  reminderDue,
+  validateConsentAnswer,
+  hashToken,
+  consentLink,
+  sealJson,
+  openJson,
+  latestRequestsFor,
+  createConsentRequest,
+  ensureConsentRequests,
+  resendConsentRequest,
+  findRequestByToken,
+  consentStatusForTickets,
+  sendConsentReminders,
+  purgeConsentMedicalData,
+  clearConsentDataForUser,
+};
@@ -0,0 +1,230 @@
+/**
+ * Post-event feedback.
+ *
+ * A FeedbackForm is sent once, at its sendAt, to everyone who checked in (or everyone
+ * registered), with one reminder 3 days later to those who haven't answered. Each person
+ * gets a personal link; only an HMAC of its token is stored, and a reminder issues a new
+ * link. Anonymous forms record who has answered (so reminders skip them) but never link
+ * the answers to the person.
+ */
+
+const crypto = require('crypto');
+const prisma = require('../config/db');
+
+const ANSWERABLE = ['text', 'numeric', 'date', 'yes_no', 'rating', 'multiple_choice'];
+const ALL_TYPES = [...ANSWERABLE, 'statement', 'paragraph'];
+const REMINDER_AFTER_MS = 3 * 864e5;
+
+function feedbackError(message, statusCode = 400) {
+  const err = new Error(message);
+  err.statusCode = statusCode;
+  return err;
+}
+
+const hashToken = (token) => crypto.createHmac('sha256', process.env.JWT_SECRET || '').update(`feedback:${token}`).digest('hex');
+const newToken = () => crypto.randomBytes(24).toString('hex');
+function feedbackLink(token) {
+  const base = (process.env.FRONTEND_URL || process.env.APP_BASE_URL || 'http://localhost:3001').split(',')[0].trim().replace(/\/$/, '');
+  return `${base}/feedback/${token}`;
+}
+
+// ─── Pure helpers ─────────────────────────────────────────────────────────────
+
+/** Checks and tidies the questions from the form builder. Pure. */
+function cleanFields(fields) {
+  if (!Array.isArray(fields)) throw feedbackError('fields must be a list');
+  const out = fields.filter(f => f && String(f.label || '').trim()).map((f, i) => {
+    if (!ALL_TYPES.includes(f.type)) throw feedbackError(`Question ${i + 1}: unknown type "${f.type}".`);
+    const label = String(f.label).trim().slice(0, 500);
+    let options = null;
+    if (f.type === 'multiple_choice') {
+      options = [...new Set((Array.isArray(f.options) ? f.options : []).map(o => String(o || '').trim()).filter(Boolean))].slice(0, 20);
+      if (options.length < 2) throw feedbackError(`"${label}": a multiple-choice question needs at least two choices.`);
+    }
+    return {
+      type: f.type, label, order: i, options,
+      isRequired: ANSWERABLE.includes(f.type) && !!f.isRequired,
+      helpText: f.helpText ? String(f.helpText).slice(0, 1000) : null,
+    };
+  });
+  if (out.length > 50) throw feedbackError('A feedback form can have at most 50 questions.');
+  if (!out.some(f => ANSWERABLE.includes(f.type))) throw feedbackError('Add at least one question.');
+  return out;
+}
+
+/** The stored value for one answer (null when blank); throws when it's invalid. Pure. */
+function cleanAnswer(field, raw) {
+  if (raw === undefined || raw === null || String(raw).trim() === '') {
+    if (field.isRequired) throw feedbackError(`Please answer: ${field.label}`);
+    return null;
+  }
+  const v = String(raw).trim();
+  switch (field.type) {
+    case 'rating': {
+      const n = Number(v);
+      if (!Number.isInteger(n) || n < 1 || n > 5) throw feedbackError(`"${field.label}": choose 1 to 5 stars.`);
+      return String(n);
+    }
+    case 'multiple_choice':
+      if (!(field.options || []).includes(v)) throw feedbackError(`"${field.label}": choose one of the options.`);
+      return v;
+    case 'yes_no':
+      if (!['yes', 'no'].includes(v.toLowerCase())) throw feedbackError(`"${field.label}": answer yes or no.`);
+      return v.toLowerCase();
+    case 'numeric':
+      if (!Number.isFinite(Number(v))) throw feedbackError(`"${field.label}": enter a number.`);
+      return v;
+    case 'date':
+      if (isNaN(new Date(v).getTime())) throw feedbackError(`"${field.label}": enter a valid date.`);
+      return v.slice(0, 10);
+    default:
+      return v.slice(0, 4000);
+  }
+}
+
+/**
+ * Per-question summary. Pure.
+ * @param {Array} fields  - [{ id, type, label, options }]
+ * @param {Array} answers - [{ fieldId, value, name? }]  (name: respondent, for named forms)
+ */
+function summarise(fields, answers) {
+  const by = new Map();
+  for (const a of answers) by.set(a.fieldId, [...(by.get(a.fieldId) || []), a]);
+  const round1 = (n) => Math.round(n * 10) / 10;
+  return fields.filter(f => ANSWERABLE.includes(f.type)).map(f => {
+    const list = by.get(f.id) || [];
+    const base = { fieldId: f.id, type: f.type, label: f.label, answered: list.length };
+    if (f.type === 'rating') {
+      const nums = list.map(a => Number(a.value)).filter(n => n >= 1 && n <= 5);
+      const distribution = [1, 2, 3, 4, 5].map(star => ({ label: `${star}★`, value: nums.filter(n => n === star).length }));
+      return { ...base, average: nums.length ? round1(nums.reduce((s, n) => s + n, 0) / nums.length) : null, distribution };
+    }
+    if (f.type === 'multiple_choice' || f.type === 'yes_no') {
+      const choices = f.type === 'yes_no' ? ['yes', 'no'] : (f.options || []);
+      return { ...base, counts: choices.map(c => ({ label: f.type === 'yes_no' ? (c === 'yes' ? 'Yes' : 'No') : c, value: list.filter(a => a.value === c).length })) };
+    }
+    if (f.type === 'numeric') {
+      const nums = list.map(a => Number(a.value)).filter(Number.isFinite);
+      return { ...base, average: nums.length ? round1(nums.reduce((s, n) => s + n, 0) / nums.length) : null };
+    }
+    return { ...base, texts: list.map(a => ({ value: a.value, ...(a.name ? { name: a.name } : {}) })) };
+  });
+}
+
+// ─── Sending ──────────────────────────────────────────────────────────────────
+
+/** People to ask: those who checked in (a scan on their ticket), or everyone registered. */
+async function feedbackRecipients(form) {
+  const tickets = await prisma.ticket.findMany({
+    where: {
+      eventId: form.eventId,
+      registrationOption: { registration: { status: { not: 'cancelled' } } },
+      ...(form.audience === 'all' ? {} : { usages: { some: {} } }),
+    },
+    select: { userId: true, holderUserId: true, attendee: { select: { userId: true } } },
+  });
+  const ids = new Set(tickets.map(t => t.holderUserId || t.attendee?.userId || t.userId));
+  if (form.audience === 'all') {
+    const regs = await prisma.registration.findMany({ where: { eventId: form.eventId, status: { not: 'cancelled' } }, select: { userId: true } });
+    regs.forEach(r => ids.add(r.userId));
+  }
+  if (ids.size === 0) return [];
+  return prisma.user.findMany({ where: { id: { in: [...ids] } }, select: { id: true, name: true, email: true, phoneNumber: true, notificationPreference: true } });
+}
+
+async function sendFeedbackMessage(user, event, token, { reminder = false } = {}) {
+  const { sendMail, emailWrapper, ctaButton, fallbackLink } = require('./email');
+  const { waTextAny } = require('./notify');
+  const { isValidZAPhone } = require('./whatsapp');
+  const ff = `-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif`;
+  const link = feedbackLink(token);
+  const subject = `${reminder ? 'Reminder: ' : ''}How was ${event.title}?`;
+  const emailOk = !!(user.email && user.email.includes('@') && !user.email.endsWith('@guest.local') && !user.email.endsWith('@deleted.invalid'));
+  const sent = [];
+  if (emailOk) {
+    const html = emailWrapper(`
+      <p style="font-size:22px;font-weight:800;color:#0f172a;margin:0 0 8px 0">${reminder ? 'A quick reminder — ' : ''}How was ${event.title}?</p>
+      <p style="margin:0 0 8px 0;color:#374151;font-family:${ff}">Hi <strong>${user.name || 'there'}</strong>,</p>
+      <p style="margin:0 0 24px 0;color:#374151;font-family:${ff}">Thank you for coming to <strong>${event.title}</strong>. We'd love to hear what you thought — it only takes a minute.</p>
+      ${ctaButton('Give feedback', link)}
+      ${fallbackLink(link)}
+    `, { preheader: `Tell us about ${event.title}` });
+    try {
+      await sendMail({ to: user.email, subject, html, text: `Hi ${user.name || 'there'},\n\nThank you for coming to ${event.title}. We'd love to hear what you thought: ${link}` });
+      sent.push('email');
+    } catch (e) {
+      console.warn('[feedback] email failed:', e?.message || e);
+    }
+  }
+  const wantsWA = ['whatsapp', 'both'].includes(user.notificationPreference) || !emailOk;
+  if (wantsWA && user.phoneNumber && isValidZAPhone(user.phoneNumber)) {
+    await waTextAny(user, `${reminder ? '⏰ ' : ''}Hi ${user.name || 'there'}, thank you for coming to *${event.title}*! We'd love your feedback — it only takes a minute: ${link}`);
+    sent.push('WhatsApp');
+  }
+  return sent;
+}
+
+/** Sends the form to everyone not yet invited. Returns how many were invited. */
+async function sendFeedbackInvites(formId) {
+  const form = await prisma.feedbackForm.findUnique({ where: { id: formId }, include: { event: true, invites: { select: { userId: true } } } });
+  if (!form) return 0;
+  const already = new Set(form.invites.map(i => i.userId));
+  const people = (await feedbackRecipients(form)).filter(u => !already.has(u.id));
+  for (const user of people) {
+    const token = newToken();
+    try {
+      await prisma.feedbackInvite.create({ data: { formId: form.id, userId: user.id, tokenHash: hashToken(token) } });
+    } catch (e) {
+      if (e.code === 'P2002') continue; // invited by a concurrent run
+      throw e;
+    }
+    await sendFeedbackMessage(user, form.event, token).catch(e => console.warn('[feedback] send failed:', e?.message || e));
+  }
+  return people.length;
+}
+
+/** The single reminder: a fresh link for everyone who hasn't answered. */
+async function sendFeedbackReminders(formId) {
+  const form = await prisma.feedbackForm.findUnique({ where: { id: formId }, include: { event: true } });
+  const invites = await prisma.feedbackInvite.findMany({
+    where: { formId, respondedAt: null, remindedAt: null },
+    include: { user: { select: { id: true, name: true, email: true, phoneNumber: true, notificationPreference: true } } },
+  });
+  for (const inv of invites) {
+    const token = newToken();
+    await prisma.feedbackInvite.update({ where: { id: inv.id }, data: { tokenHash: hashToken(token), remindedAt: new Date() } });
+    await sendFeedbackMessage(inv.user, form.event, token, { reminder: true }).catch(e => console.warn('[feedback] reminder failed:', e?.message || e));
+  }
+  return invites.length;
+}
+
+/** Background job: send forms whose time has come, and reminders 3 days after. */
+async function runFeedbackJob(now = new Date()) {
+  let sent = 0, reminded = 0;
+  const due = await prisma.feedbackForm.findMany({ where: { sentAt: null, sendAt: { lte: now } }, select: { id: true } });
+  for (const f of due) {
+    // Claim it first so two servers (or overlapping runs) never both send.
+    const claimed = await prisma.feedbackForm.updateMany({ where: { id: f.id, sentAt: null }, data: { sentAt: now } });
+    if (claimed.count === 1) sent += await sendFeedbackInvites(f.id);
+  }
+  const remind = await prisma.feedbackForm.findMany({ where: { reminderSentAt: null, sentAt: { lte: new Date(now.getTime() - REMINDER_AFTER_MS) } }, select: { id: true } });
+  for (const f of remind) {
+    const claimed = await prisma.feedbackForm.updateMany({ where: { id: f.id, reminderSentAt: null }, data: { reminderSentAt: now } });
+    if (claimed.count === 1) reminded += await sendFeedbackReminders(f.id);
+  }
+  return { sent, reminded };
+}
+
+async function findInviteByToken(token) {
+  if (!token || typeof token !== 'string' || token.length > 200) return null;
+  return prisma.feedbackInvite.findUnique({
+    where: { tokenHash: hashToken(token) },
+    include: { user: { select: { id: true, name: true } }, form: { include: { event: { select: { id: true, title: true, startDate: true, endDate: true } }, fields: { orderBy: { order: 'asc' } } } } },
+  });
+}
+
+module.exports = {
+  ANSWERABLE, ALL_TYPES, REMINDER_AFTER_MS, feedbackError, hashToken, feedbackLink,
+  cleanFields, cleanAnswer, summarise,
+  feedbackRecipients, sendFeedbackInvites, sendFeedbackReminders, runFeedbackJob, findInviteByToken,
+};
@@ -0,0 +1,80 @@
+/**
+ * Admin "view as user" — strictly read-only.
+ *
+ * An impersonation token is an ordinary JWT for the target user plus an `imp` claim (the
+ * ImpersonationSession id), valid for at most 30 minutes. Three layers keep it read-only:
+ *  1. readOnlyGuard (mounted before every route): any request carrying an impersonation
+ *     token that isn't GET/HEAD/OPTIONS is refused, apart from ending the session and
+ *     logging page views. No controller can be reached for a write.
+ *  2. protect / optionalAuth check the session is live and set req.readOnly.
+ *  3. GET handlers that write as a side effect (price refresh on view) skip it when
+ *     req.readOnly is set.
+ * The only rows an impersonation session writes are its own session and request log.
+ */
+
+const jwt = require('jsonwebtoken');
+const prisma = require('../config/db');
+
+const MAX_MINUTES = 30;
+const SAFE_METHODS = ['GET', 'HEAD', 'OPTIONS'];
+const ALLOWED_WRITES = ['/api/admin/impersonate/end', '/api/admin/impersonate/log'];
+
+/** The `imp` claim of a bearer token, or null (no token, invalid token, or not impersonating). */
+function impersonationClaim(req) {
+  const h = req.headers.authorization;
+  if (!h || !h.startsWith('Bearer ')) return null;
+  try {
+    const decoded = jwt.verify(h.slice(7), process.env.JWT_SECRET, { algorithms: ['HS256'] });
+    return decoded.imp ? String(decoded.imp) : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Whether this request may go ahead while impersonating. Pure. */
+function allowedWhileImpersonating(method, path) {
+  if (SAFE_METHODS.includes(String(method).toUpperCase())) return true;
+  const p = String(path || '').split('?')[0].replace(/\/+$/, '');
+  return method.toUpperCase() === 'POST' && ALLOWED_WRITES.includes(p);
+}
+
+function logRequest(sessionId, method, path, blocked = false) {
+  prisma.impersonationRequestLog.create({ data: { sessionId, method, path: String(path).slice(0, 500), blocked } }).catch(() => {});
+}
+
+/** Layer 1 — mounted in index.js before every route (webhooks never carry user tokens). */
+function readOnlyGuard(req, res, next) {
+  const sessionId = impersonationClaim(req);
+  if (!sessionId) return next();
+  const path = req.originalUrl || req.url;
+  if (!allowedWhileImpersonating(req.method, path)) {
+    logRequest(sessionId, req.method, path, true);
+    return res.status(403).json({ message: 'Read-only while viewing as another user. End impersonation to make changes.', code: 'IMPERSONATION_READ_ONLY' });
+  }
+  if (SAFE_METHODS.includes(req.method) && path.startsWith('/api/')) logRequest(sessionId, req.method, path);
+  next();
+}
+
+/** Layer 2 — the live session for an `imp` claim, or null when ended/expired. */
+async function liveSession(sessionId) {
+  const s = await prisma.impersonationSession.findUnique({ where: { id: sessionId } });
+  if (!s || s.endedAt) return null;
+  if (s.expiresAt <= new Date()) {
+    await prisma.impersonationSession.updateMany({ where: { id: s.id, endedAt: null }, data: { endedAt: new Date(), endedReason: 'expired' } });
+    return null;
+  }
+  return s;
+}
+
+/** Why `admin` can't view as `target`, or null. Pure. */
+function impersonationBlocker(admin, target) {
+  if (!admin || admin.role !== 'admin') return 'Only admins can view as another user.';
+  if (!admin.twoFactorEnabled) return 'Turn on two-factor authentication for your account first.';
+  if (!target) return 'User not found.';
+  if (target.id === admin.id) return "You can't view as yourself.";
+  if (target.role === 'admin') return "Admins can't be impersonated.";
+  if (!target.isActive) return 'That account is deactivated.';
+  return null;
+}
+
+module.exports = { MAX_MINUTES, impersonationClaim, allowedWhileImpersonating, readOnlyGuard, liveSession, impersonationBlocker, logRequest };
@@ -533,7 +533,7 @@ function buildPaymentReceipt(payment) {
  }

  // Donation receipt
-  const subject = `Donation received – ${eventTitle}`;
+  const subject = payment.isSponsorship ? `Thank you for sponsoring a spot – ${eventTitle}` : `Donation received – ${eventTitle}`;
  const preheader = `Thank you for your donation of ${fmtAmount(payment.amount)} to ${eventTitle}.`;
  const body = `
    <p style="font-size:22px;font-weight:800;color:#0f172a;margin:0 0 8px 0;letter-spacing:-0.3px">Thank you for your donation!</p>
@@ -541,7 +541,7 @@ function buildPaymentReceipt(payment) {

    <p style="margin:0 0 4px 0;color:#374151;font-family:${ff}">Hi <strong>${payment.user?.name || 'there'}</strong>,</p>
    <p style="margin:0 0 28px 0;color:#374151;font-family:${ff}">
-      We received your donation of <strong>${fmtAmount(payment.amount)}</strong> to <strong>${eventTitle}</strong>. Your support means the world to us.
+      We received your donation of <strong>${fmtAmount(payment.amount)}</strong> to <strong>${eventTitle}</strong>. Your support means the world to us.${payment.isSponsorship ? ' It goes into the sponsorship pool and helps someone attend who otherwise couldn’t.' : ''}
    </p>

    ${callout(`<strong style="font-size:15px">${fmtAmount(payment.amount)} donated</strong><br/>
@@ -832,7 +832,7 @@ function buildRefundEmail(payment) {

 // ─── Daily event summary ──────────────────────────────────────────────────────

-function buildDailySummary(ev, registrations, payments, now) {
+function buildDailySummary(ev, registrations, payments, now, waitlistCount = 0) {
  const org = getOrg();
  const subject = `Daily summary: ${ev.title} — ${new Date(now).toLocaleDateString('en-GB', { day: 'numeric', month: 'long', year: 'numeric' })}`;

@@ -917,6 +917,7 @@ function buildDailySummary(ev, registrations, payments, now) {
        ${statsRow('Total registrations', totalRegistrations)}
        ${statsRow('Confirmed paid', paidCount, '#059669')}
        ${statsRow('Awaiting payment', pendingCount, '#d97706')}
+        ${ev.waitlistEnabled ? statsRow('On the waitlist', waitlistCount, '#7c3aed') : ''}
        <td style="text-align:center;padding:16px">
          <div style="font-size:24px;font-weight:800;color:#2563eb;font-family:${ff}">${fmtAmount(totalRevenue)}</div>
          <div style="font-size:12px;color:#64748b;margin-top:4px;font-family:${ff}">Total collected</div>
@@ -939,7 +940,7 @@ function buildDailySummary(ev, registrations, payments, now) {
    `Daily Summary — ${ev.title}`,
    new Date(now).toLocaleDateString(),
    '',
-    `Registrations: ${totalRegistrations} | Paid: ${paidCount} | Pending: ${pendingCount} | Revenue: ${fmtAmount(totalRevenue)}`,
+    `Registrations: ${totalRegistrations} | Paid: ${paidCount} | Pending: ${pendingCount}${ev.waitlistEnabled ? ` | Waitlist: ${waitlistCount}` : ''} | Revenue: ${fmtAmount(totalRevenue)}`,
    '',
    'Registrations:',
    ...(regRows.length ? regRows.map(r => `  ${r.name} <${r.email}> — ${r.status} — due: ${fmtAmount(r.totalDue)} paid: ${fmtAmount(r.totalPaid)} balance: ${fmtAmount(r.balance)}`) : ['  (none)']),
@@ -1457,7 +1458,10 @@ async function sendDailyEventSummaries(now = new Date()) {
        orderBy: { createdAt: 'asc' },
      });

-      const { subject, text, html } = buildDailySummary(ev, registrations, payments, now);
+      const waitlistCount = ev.waitlistEnabled
+        ? await prisma.waitlistEntry.count({ where: { eventId: ev.id, status: { in: ['waiting', 'offered'] } } })
+        : 0;
+      const { subject, text, html } = buildDailySummary(ev, registrations, payments, now, waitlistCount);
      const to = buildEventNotifyRecipientList(ev);
      if (to.length) await sendMail({ to: to.join(','), subject, html, text });
    }));
@@ -1503,6 +1507,7 @@ async function sendAttendeeFormLinkMessage(attendee) {
 }

 module.exports = {
+  buildEventNotifyRecipientList,
  sendAttendeeFormLinkMessage,
  sendRegistrationEmails,
  sendRegistrationUpdatedEmails,
@@ -0,0 +1,218 @@
+/**
+ * Offline scanning — locks, snapshots and syncing.
+ *
+ * Rules:
+ * - Offline mode is per section (or the whole event), and only one device may hold a
+ *   scope at a time: while offline, devices can't see each other's scans, so two
+ *   devices on the same scope could redeem one ticket twice. A whole-event lock clashes
+ *   with every section of that event, and a section lock with the whole event.
+ * - While a scope is locked, other devices can't scan it online either.
+ * - The lock holder downloads a snapshot of valid tickets; scans made offline are
+ *   queued on the device and synced later. Syncing is idempotent (each scan carries a
+ *   clientScanId) and never redeems more than is left on a ticket.
+ * - Anything that needs a person to look — unknown ticket, cancelled registration, used
+ *   up, outside the locked scope, consent not given — goes into an OfflineSyncReport.
+ * - A supervisor can force-release a lock (lost phone). If that device syncs later its
+ *   scans are still recorded, and the report is flagged.
+ */
+
+const prisma = require('../config/db');
+
+function lockError(message, statusCode = 400) {
+  const err = new Error(message);
+  err.statusCode = statusCode;
+  return err;
+}
+
+// ─── Pure helpers ─────────────────────────────────────────────────────────────
+
+/** Whether a new lock on `sectionId` (null = whole event) clashes with `existing`. */
+function locksClash(existing, sectionId) {
+  if (!existing.sectionId || !sectionId) return true;
+  return existing.sectionId === sectionId;
+}
+
+/**
+ * Whether `lock` covers a scan of a ticket with option `optionId`. When the scanner has
+ * picked a section, only a lock on that section (or the whole event) covers it; with no
+ * section picked, any lock on a section that admits the ticket does.
+ * @param {object} lock - { sectionId, section?: { allowedOptions: [{ eventOptionId }] } }
+ */
+function lockCovers(lock, { sectionId = null, optionId }) {
+  if (!lock.sectionId) return true;
+  if (sectionId) return sectionId === lock.sectionId;
+  return (lock.section?.allowedOptions || []).some(o => o.eventOptionId === optionId);
+}
+
+/**
+ * What to do with one synced scan, given the ticket as the server sees it now. Pure.
+ * @param {object|null} ticket - { remaining, cancelled, inScope, consentOk }
+ * @param {number} qty - quantity the device redeemed
+ * @returns {{ redeem: number, conflict: string|null }}
+ */
+function judgeSyncedScan(ticket, qty) {
+  if (!ticket) return { redeem: 0, conflict: 'not_found' };
+  if (ticket.transferred) return { redeem: 0, conflict: 'transferred' };
+  if (ticket.cancelled) return { redeem: 0, conflict: 'cancelled' };
+  if (!ticket.inScope) return { redeem: 0, conflict: 'wrong_scope' };
+  if (ticket.remaining <= 0) return { redeem: 0, conflict: 'already_used' };
+  const redeem = Math.min(Math.max(1, qty || 1), ticket.remaining);
+  if (!ticket.consentOk) return { redeem, conflict: 'consent' };
+  return { redeem, conflict: redeem < (qty || 1) ? 'partly_used' : null };
+}
+
+const CONFLICT_TEXT = {
+  not_found: 'Ticket not found',
+  transferred: 'Old QR code of a ticket that was transferred to someone else',
+  cancelled: 'Registration was cancelled',
+  wrong_scope: 'Ticket is not valid for this section',
+  already_used: 'Ticket had already been fully used',
+  partly_used: 'Fewer places were left than were checked in offline',
+  consent: 'Checked in without parental consent',
+};
+
+// ─── Database helpers ─────────────────────────────────────────────────────────
+
+const LOCK_INCLUDE = {
+  section: { include: { allowedOptions: true } },
+  user: { select: { id: true, name: true } },
+};
+
+async function activeLocks(eventId, db = prisma) {
+  return db.scanLock.findMany({ where: { eventId, releasedAt: null }, include: LOCK_INCLUDE, orderBy: { lockedAt: 'asc' } });
+}
+
+/** Locks a scope to this device. Re-locking by the same device and person returns the existing lock. */
+async function acquireLock({ eventId, sectionId = null, deviceId, deviceName, userId }) {
+  if (!deviceId || typeof deviceId !== 'string' || deviceId.length > 100) throw lockError('A device id is required');
+  return prisma.$transaction(async (tx) => {
+    await tx.$executeRaw`SELECT pg_advisory_xact_lock(hashtext(${'scanlock:' + eventId}))`;
+    const event = await tx.event.findUnique({ where: { id: eventId } });
+    if (!event) throw lockError('Event not found', 404);
+    if (sectionId) {
+      const section = await tx.section.findUnique({ where: { id: sectionId } });
+      if (!section || section.eventId !== eventId) throw lockError('Section not found for this event', 404);
+    }
+    const existing = await activeLocks(eventId, tx);
+    const same = existing.find(l => (l.sectionId || null) === (sectionId || null) && l.deviceId === deviceId && l.userId === userId);
+    if (same) return same;
+    const clash = existing.find(l => locksClash(l, sectionId));
+    if (clash) {
+      const scope = clash.section ? `"${clash.section.name}"` : 'the whole event';
+      throw lockError(`${scope} is offline-locked by ${clash.user.name}${clash.deviceName ? ` on ${clash.deviceName}` : ''}.`, 409);
+    }
+    return tx.scanLock.create({ data: { eventId, sectionId: sectionId || null, deviceId, deviceName: deviceName ? String(deviceName).slice(0, 100) : null, userId }, include: LOCK_INCLUDE });
+  });
+}
+
+/**
+ * The lock (other than the scanner's own device) that stops this online scan, or null.
+ * @param {object} ticket - { eventId, optionId }
+ */
+async function blockingLock(ticket, { sectionId = null, deviceId = null } = {}) {
+  const locks = await activeLocks(ticket.eventId);
+  return locks.find(l => l.deviceId !== deviceId && lockCovers(l, { sectionId, optionId: ticket.optionId })) || null;
+}
+
+/** Tickets valid in a lock's scope, for the device to keep offline. */
+async function snapshotFor(lock) {
+  const optionIds = lock.section ? lock.section.allowedOptions.map(o => o.eventOptionId) : null;
+  const tickets = await prisma.ticket.findMany({
+    where: {
+      eventId: lock.eventId,
+      registrationOption: { registration: { status: { not: 'cancelled' } }, ...(optionIds ? { eventOptionId: { in: optionIds } } : {}) },
+    },
+    include: {
+      usages: { select: { quantityRedeemed: true } },
+      attendee: { select: { name: true } },
+      user: { select: { name: true } },
+      registrationOption: { include: { eventOption: { select: { id: true, name: true, isMainTicket: true } }, variant: { select: { name: true } } } },
+    },
+  });
+  const { consentStatusForTickets } = require('./consent');
+  const consent = await consentStatusForTickets(tickets.map(t => t.id));
+  const snapshotAt = new Date();
+  await prisma.scanLock.update({ where: { id: lock.id }, data: { snapshotAt } });
+  return {
+    snapshotAt,
+    tickets: tickets.map(t => {
+      const redeemed = t.usages.reduce((s, u) => s + (u.quantityRedeemed || 1), 0);
+      return {
+        id: t.id,
+        qrCode: t.qrCode,
+        holder: t.attendee?.name || t.user?.name || '',
+        bookedBy: t.attendee ? t.user?.name || '' : '',
+        option: t.registrationOption.eventOption.name,
+        variant: t.registrationOption.variant?.name || null,
+        quantity: t.quantity || 1,
+        remaining: Math.max(0, (t.quantity || 1) - redeemed),
+        consentStatus: consent.get(t.id) || 'not_required',
+      };
+    }),
+  };
+}
+
+/**
+ * Records queued offline scans. Each scan: { clientScanId, qrCode, qty, scannedAt }.
+ * @returns {Promise<{ accepted, duplicates, conflicts, report }>}
+ */
+async function syncScans(lock, scans) {
+  const results = { accepted: 0, duplicates: 0, conflicts: [] };
+  const optionIds = lock.section ? new Set(lock.section.allowedOptions.map(o => o.eventOptionId)) : null;
+  const { consentStatusForTickets } = require('./consent');
+  const checkIns = [];
+
+  for (const scan of (scans || []).slice(0, 2000)) {
+    const clientScanId = String(scan?.clientScanId || '').slice(0, 100);
+    if (!clientScanId) continue;
+    if (await prisma.ticketUsage.findUnique({ where: { clientScanId } })) { results.duplicates += 1; continue; }
+
+    const qty = Math.max(1, parseInt(scan.qty, 10) || 1);
+    const scannedAt = scan.scannedAt && !isNaN(new Date(scan.scannedAt)) ? new Date(scan.scannedAt) : new Date();
+    const ticket = await prisma.ticket.findUnique({
+      where: { qrCode: String(scan.qrCode || '') },
+      include: { usages: true, registrationOption: { include: { registration: { select: { status: true } }, eventOption: { select: { isMainTicket: true } } } } },
+    });
+    let state = null;
+    if (!ticket) {
+      const { findTransferByOldCode } = require('./ticketTransfer');
+      if (await findTransferByOldCode(scan.qrCode)) state = { transferred: true };
+    } else if (ticket.eventId === lock.eventId) {
+      const redeemed = ticket.usages.reduce((s, u) => s + (u.quantityRedeemed || 1), 0);
+      const consent = (await consentStatusForTickets([ticket.id])).get(ticket.id);
+      state = {
+        remaining: (ticket.quantity || 1) - redeemed,
+        cancelled: ticket.registrationOption.registration.status === 'cancelled',
+        inScope: !optionIds || optionIds.has(ticket.registrationOption.eventOptionId),
+        consentOk: ['not_required', 'given'].includes(consent),
+      };
+    }
+    const verdict = judgeSyncedScan(state, qty);
+    if (verdict.redeem > 0) {
+      await prisma.ticketUsage.create({
+        data: { ticketId: ticket.id, scannedById: lock.userId, scannedAt, quantityRedeemed: verdict.redeem, clientScanId, offline: true, scanLockId: lock.id, syncedAt: new Date() },
+      });
+      await prisma.ticket.update({ where: { id: ticket.id }, data: { isUsed: state.remaining - verdict.redeem <= 0, updatedAt: new Date() } });
+      results.accepted += 1;
+      if (ticket.registrationOption.eventOption.isMainTicket) {
+        checkIns.push({ ticketId: ticket.id, qty: verdict.redeem, total: (ticket.quantity || 1) - state.remaining + verdict.redeem, left: state.remaining - verdict.redeem });
+      }
+    }
+    if (verdict.conflict) {
+      results.conflicts.push({ clientScanId, qrCode: scan.qrCode, ticketId: ticket?.id || null, qty, redeemed: verdict.redeem, scannedAt, reason: verdict.conflict, message: CONFLICT_TEXT[verdict.conflict] });
+    }
+  }
+
+  await prisma.scanLock.update({ where: { id: lock.id }, data: { lastSyncAt: new Date() } });
+  const report = await prisma.offlineSyncReport.create({
+    data: { scanLockId: lock.id, accepted: results.accepted, duplicates: results.duplicates, conflicts: results.conflicts, afterForceRelease: !!lock.forceReleasedById },
+  });
+
+  // Check-in confirmations go out after sync, not at the moment of the offline scan.
+  const { sendCheckInEmails } = require('./notifications');
+  for (const c of checkIns) sendCheckInEmails(c.ticketId, c.qty, c.total, c.left).catch(() => {});
+
+  return { ...results, report };
+}
+
+module.exports = { lockError, locksClash, lockCovers, judgeSyncedScan, CONFLICT_TEXT, LOCK_INCLUDE, activeLocks, acquireLock, blockingLock, snapshotFor, syncScans };
@@ -0,0 +1,72 @@
+/**
+ * Sponsor a spot — public donations into an event's bursary pool.
+ *
+ * A sponsorship is an ordinary event donation (isDonation) also flagged isSponsorship,
+ * so supervisors hand it out with the existing assign/unassign-donation flow. These
+ * helpers are pure: what one spot costs, what a sponsor is charged, and the pool totals.
+ */
+
+const { computeDonationRemaining } = require('./donationUtils');
+
+const MIN_AMOUNT = 15; // Yoco's minimum charge, same as other donations
+const MAX_SPOTS = 100;
+const MAX_AMOUNT = 100000;
+
+function sponsorshipError(message, statusCode = 400) {
+  const err = new Error(message);
+  err.statusCode = statusCode;
+  return err;
+}
+
+/** The price of one spot: the cheapest paid main ticket (or the event price), or null if free. */
+function spotPrice(event) {
+  const prices = (event.eventOptions || [])
+    .filter(o => o.isMainTicket && Number(o.price) > 0)
+    .map(o => Number(o.price));
+  if (prices.length) return Math.min(...prices);
+  return Number(event.price) > 0 ? Number(event.price) : null;
+}
+
+/**
+ * What the sponsor pays: `spots` whole spots, or a custom `amount`.
+ * @returns {{ amount: number, spots: number|null }}
+ */
+function sponsorshipCharge({ spots, amount }, price) {
+  if (spots !== undefined && spots !== null && spots !== '') {
+    const n = Number(spots);
+    if (!Number.isInteger(n) || n < 1 || n > MAX_SPOTS) throw sponsorshipError(`Choose between 1 and ${MAX_SPOTS} spots.`);
+    if (!price) throw sponsorshipError('This event has no ticket price — enter an amount instead.');
+    return { amount: Math.round(n * price * 100) / 100, spots: n };
+  }
+  const a = Math.round(Number(amount) * 100) / 100;
+  if (!Number.isFinite(a) || a <= 0) throw sponsorshipError('Enter an amount, or choose a number of spots.');
+  if (a < MIN_AMOUNT) throw sponsorshipError(`The minimum is R${MIN_AMOUNT}.`);
+  if (a > MAX_AMOUNT) throw sponsorshipError(`For gifts over R${MAX_AMOUNT.toLocaleString('en-ZA')}, please contact us directly.`);
+  return { amount: a, spots: null };
+}
+
+/**
+ * Pool totals for an event.
+ * @param {Array} sponsorships - sponsorship donation payments [{ id, amount }]
+ * @param {Array} legs         - payments with originalPaymentId set (assignments, refunds)
+ * @param {number|null} price  - one spot
+ */
+function poolSummary(sponsorships, legs, price) {
+  const legsBy = new Map();
+  for (const l of legs || []) legsBy.set(l.originalPaymentId, [...(legsBy.get(l.originalPaymentId) || []), l]);
+  let received = 0, remaining = 0;
+  for (const s of sponsorships || []) {
+    received += Number(s.amount) || 0;
+    remaining += Math.max(0, computeDonationRemaining(s.amount, legsBy.get(s.id) || []));
+  }
+  const round = (n) => Math.round(n * 100) / 100;
+  return {
+    received: round(received),
+    assigned: round(received - remaining),
+    remaining: round(remaining),
+    sponsors: (sponsorships || []).length,
+    spotsFunded: price ? Math.floor((received + 0.001) / price) : null,
+  };
+}
+
+module.exports = { MIN_AMOUNT, MAX_SPOTS, sponsorshipError, spotPrice, sponsorshipCharge, poolSummary };
@@ -0,0 +1,52 @@
+/**
+ * Ticket stock — the one place that decides how many places are taken.
+ *
+ * Taken = places on registrations that aren't cancelled + places held for a live
+ * waitlist offer (until it expires). An option's stock limit covers all its variants;
+ * a variant can also have its own limit. 0 means unlimited.
+ */
+
+const prisma = require('../config/db');
+
+/**
+ * @param {{ eventOptionId: string, variantId?: string|null }} line - variantId given → that variant only
+ * @param {{ excludeEntryId?: string, db?: object }} [opts] - excludeEntryId: ignore this
+ *   waitlist offer's hold (the person claiming it)
+ */
+async function takenCount({ eventOptionId, variantId = null }, { excludeEntryId = null, db = prisma } = {}) {
+  const scope = variantId ? { variantId } : { eventOptionId };
+  const [registered, held] = await Promise.all([
+    db.registrationOption.aggregate({
+      where: { ...scope, registration: { status: { not: 'cancelled' } } },
+      _sum: { quantity: true },
+    }),
+    db.waitlistEntry.aggregate({
+      where: {
+        ...scope,
+        status: 'offered',
+        offerExpiresAt: { gt: new Date() },
+        ...(excludeEntryId ? { id: { not: excludeEntryId } } : {}),
+      },
+      _sum: { offeredQuantity: true },
+    }),
+  ]);
+  return (registered._sum?.quantity || 0) + (held._sum?.offeredQuantity || 0);
+}
+
+/**
+ * Places still free on a line: the tighter of the option and variant limits.
+ * @returns {Promise<number|null>} null when unlimited
+ */
+async function remainingFor(option, variant, opts = {}) {
+  const limits = [];
+  if (option?.stockLimit > 0) {
+    limits.push(option.stockLimit - await takenCount({ eventOptionId: option.id }, opts));
+  }
+  if (variant?.stockLimit > 0) {
+    limits.push(variant.stockLimit - await takenCount({ eventOptionId: option.id, variantId: variant.id }, opts));
+  }
+  if (limits.length === 0) return null;
+  return Math.max(0, Math.min(...limits));
+}
+
+module.exports = { takenCount, remainingFor };
@@ -0,0 +1,140 @@
+/**
+ * Ticket transfer — handing a ticket to someone else before the event.
+ *
+ * - The new holder becomes the ticket's attendee (name, contact details, account). The
+ *   payer stays responsible for the registration; billing doesn't move.
+ * - The QR code is replaced, so screenshots of the old ticket stop working. The old code
+ *   is kept on the TicketTransfer so scanners can say "transferred" instead of "not found".
+ * - A shared (unnamed) ticket for several places has one place split off into a new
+ *   ticket for the new holder; the rest stay on the shared ticket and its code.
+ * - The previous holder's attendee form answers are removed, and on youth events the new
+ *   holder needs their own parental consent.
+ */
+
+const { v4: uuidv4 } = require('uuid');
+const prisma = require('../config/db');
+const { validateAttendees } = require('./attendees');
+const { isMinor } = require('./consent');
+
+const SUPERVISORS = ['admin', 'supervisor'];
+
+function transferError(message, statusCode = 400) {
+  const err = new Error(message);
+  err.statusCode = statusCode;
+  return err;
+}
+
+/**
+ * Why this ticket can't be transferred by `actor`, or null when it can. Pure.
+ * @param {object} t - { userId, holderUserId, usages[], event: { startDate, allowTicketTransfer }, registrationStatus }
+ * @param {object} actor - { id, role }
+ */
+function transferBlocker(t, actor, now = new Date()) {
+  const supervisor = SUPERVISORS.includes(actor.role);
+  if (!supervisor && t.userId !== actor.id && t.holderUserId !== actor.id) return { status: 403, message: 'Only the person who booked or holds this ticket can transfer it.' };
+  if (t.registrationStatus === 'cancelled') return { status: 400, message: 'This registration was cancelled.' };
+  if (new Date(t.event.startDate) <= now) return { status: 400, message: 'Tickets can only be transferred before the event starts.' };
+  if ((t.usages || []).length > 0) return { status: 400, message: 'This ticket has already been used (or partly used), so it can’t be transferred.' };
+  if (t.event.allowTicketTransfer === false && !supervisor) return { status: 400, message: 'Ticket transfers are turned off for this event.' };
+  return null;
+}
+
+/**
+ * Transfers a ticket. Returns what the caller needs to notify people afterwards.
+ * @param {object} input - { ticketId, actor, name, email?, phone?, dateOfBirth?, parentName?, parentEmail?, parentPhone? }
+ */
+async function transferTicket({ ticketId, actor, ...holder }) {
+  const { findOrCreateAccount } = require('./accountMatch');
+  const ticket = await prisma.ticket.findUnique({
+    where: { id: ticketId },
+    include: {
+      usages: { select: { id: true } },
+      attendee: true,
+      holder: { select: { id: true, name: true } },
+      user: { select: { id: true, name: true } },
+      event: { include: { eventOptions: true } },
+      registrationOption: { include: { registration: { select: { id: true, status: true } } } },
+    },
+  });
+  if (!ticket) throw transferError('Ticket not found', 404);
+  const blocker = transferBlocker({ ...ticket, registrationStatus: ticket.registrationOption.registration.status }, actor);
+  if (blocker) throw transferError(blocker.message, blocker.status);
+
+  const ro = ticket.registrationOption;
+  const event = ticket.event;
+  // Same rules as naming an attendee at registration (incl. date of birth and parent
+  // details on youth events), for exactly one place.
+  const [clean] = validateAttendees({ ...event, allowNamedAttendees: true }, { [`${ro.eventOptionId}::${ro.variantId || ''}`]: 1 }, [{
+    eventOptionId: ro.eventOptionId, variantId: ro.variantId, ...holder,
+  }]);
+  if (!clean.email && !clean.phone) throw transferError('Enter an email address or phone number for the new holder, so we can send them the ticket.');
+
+  const { user: toUser, created } = await findOrCreateAccount({ name: clean.name, email: clean.email, phone: clean.phone });
+  const currentHolderId = ticket.attendee ? ticket.attendee.userId || ticket.holderUserId : ticket.holderUserId || ticket.userId;
+  if (currentHolderId && currentHolderId === toUser.id) throw transferError(`${clean.name} already holds this ticket.`);
+
+  const fromHolderName = ticket.attendee?.name || ticket.holder?.name || ticket.user?.name || '';
+  const attendeeData = {
+    name: clean.name, email: clean.email, phone: clean.phone, userId: toUser.id,
+    dateOfBirth: clean.dateOfBirth, gender: clean.gender, parentName: clean.parentName, parentEmail: clean.parentEmail, parentPhone: clean.parentPhone,
+  };
+
+  const result = await prisma.$transaction(async (tx) => {
+    // Re-check inside the transaction: a scan or another transfer may have just happened.
+    const fresh = await tx.ticket.findUnique({ where: { id: ticket.id }, include: { usages: { select: { id: true } } } });
+    if (!fresh || fresh.qrCode !== ticket.qrCode || fresh.usages.length > 0) throw transferError('This ticket changed while you were transferring it. Please try again.', 409);
+
+    let target, attendee, oldQrCode;
+    if (ticket.attendeeId) {
+      attendee = await tx.attendee.update({ where: { id: ticket.attendeeId }, data: attendeeData });
+      // The previous holder's answers and medical details aren't the new holder's.
+      await tx.formResponse.deleteMany({ where: { attendeeId: attendee.id } });
+      await tx.consentRequest.updateMany({ where: { attendeeId: attendee.id }, data: { medical: null, emergency: null, medicalPurgedAt: new Date() } });
+      target = await tx.ticket.update({ where: { id: ticket.id }, data: { qrCode: uuidv4(), holderUserId: toUser.id, emailSent: false } });
+      oldQrCode = ticket.qrCode;
+    } else {
+      const order = await tx.attendee.count({ where: { registrationId: ro.registration.id } });
+      attendee = await tx.attendee.create({
+        data: { registrationId: ro.registration.id, registrationOptionId: ro.id, eventOptionId: ro.eventOptionId, variantId: ro.variantId, order, ...attendeeData },
+      });
+      if ((ticket.quantity || 1) > 1) {
+        // Split one place off the shared ticket; its code stays valid for the rest.
+        await tx.ticket.update({ where: { id: ticket.id }, data: { quantity: ticket.quantity - 1 } });
+        target = await tx.ticket.create({
+          data: { qrCode: uuidv4(), registrationOptionId: ro.id, userId: ticket.userId, eventId: ticket.eventId, quantity: 1, attendeeId: attendee.id, holderUserId: toUser.id },
+        });
+        oldQrCode = null;
+      } else {
+        target = await tx.ticket.update({ where: { id: ticket.id }, data: { qrCode: uuidv4(), attendeeId: attendee.id, holderUserId: toUser.id, emailSent: false } });
+        oldQrCode = ticket.qrCode;
+      }
+    }
+    const transfer = await tx.ticketTransfer.create({
+      data: { ticketId: target.id, fromHolderName, fromUserId: currentHolderId || null, toName: clean.name, toUserId: toUser.id, byUserId: actor.id, oldQrCode },
+    });
+    return { target, attendee, transfer };
+  });
+
+  return {
+    ...result,
+    toUser,
+    accountCreated: created,
+    fromHolderName,
+    event,
+    registrationId: ro.registration.id,
+    needsConsent: !!event.requiresParentalConsent && isMinor(clean.dateOfBirth, event.startDate),
+  };
+}
+
+/** The transfer that retired this QR code, if any. */
+async function findTransferByOldCode(qrCode) {
+  if (!qrCode) return null;
+  return prisma.ticketTransfer.findFirst({ where: { oldQrCode: String(qrCode) }, orderBy: { createdAt: 'desc' } });
+}
+
+function transferredMessage(transfer) {
+  const when = new Date(transfer.createdAt).toLocaleDateString('en-ZA', { day: 'numeric', month: 'short' });
+  return `This ticket was transferred to ${transfer.toName} on ${when}. The old QR code no longer works — ask for the new ticket.`;
+}
+
+module.exports = { transferError, transferBlocker, transferTicket, findTransferByOldCode, transferredMessage };
@@ -0,0 +1,201 @@
+/**
+ * Waitlist for sold-out ticket options.
+ *
+ * Rules:
+ * - Only on events with waitlistEnabled, and only for a line that's actually sold out.
+ * - When places free up (a cancellation, a smaller booking, a raised stock limit, or an
+ *   offer expiring), processWaitlist offers them to the next people in line. An offer
+ *   holds the places for event.waitlistOfferHours — they count as taken (utils/stock.js)
+ *   so the public site can't sell them — and sends a claim link by email/WhatsApp.
+ * - If fewer places are free than someone asked for: with waitlistPartialOffers they're
+ *   offered what's free; otherwise they're skipped for the next person who fits.
+ * - Claiming = registering with the link (createRegistration's waitlistToken). Early-bird
+ *   and coupon rules apply as usual. An unclaimed offer expires and moves on.
+ */
+
+const crypto = require('crypto');
+const prisma = require('../config/db');
+const { remainingFor } = require('./stock');
+
+const ACTIVE = ['waiting', 'offered'];
+
+function waitlistError(message, statusCode = 400) {
+  const err = new Error(message);
+  err.statusCode = statusCode;
+  return err;
+}
+
+const hashToken = (token) => crypto.createHmac('sha256', process.env.JWT_SECRET || '').update(`waitlist:${token}`).digest('hex');
+
+function claimLink(token) {
+  const base = (process.env.FRONTEND_URL || process.env.APP_BASE_URL || 'http://localhost:3001').split(',')[0].trim().replace(/\/$/, '');
+  return `${base}/waitlist/claim/${token}`;
+}
+
+/**
+ * Who gets offered what, given the free places on a line. Pure.
+ * @param {Array} waiting - entries in queue order [{ id, quantity }]
+ * @param {number} free - places free
+ * @param {boolean} partial - offer what's free when it's less than asked for
+ * @returns {Array<{ entryId: string, quantity: number }>}
+ */
+function pickOffers(waiting, free, partial) {
+  const offers = [];
+  let left = free;
+  for (const entry of waiting) {
+    if (left <= 0) break;
+    if (entry.quantity <= left) {
+      offers.push({ entryId: entry.id, quantity: entry.quantity });
+      left -= entry.quantity;
+    } else if (partial) {
+      // First in line gets what's free; nobody behind them jumps the queue.
+      offers.push({ entryId: entry.id, quantity: left });
+      left = 0;
+    }
+    // else: skip to the next person who fits
+  }
+  return offers;
+}
+
+async function notifyOffer(entry, token) {
+  const { sendMail, emailWrapper, ctaButton, fallbackLink } = require('./email');
+  const { shouldEmail, waText, waTextAny } = require('./notify');
+  const ff = `-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif`;
+  const user = entry.user;
+  const link = claimLink(token);
+  const item = `${entry.eventOption.name}${entry.variant ? ` (${entry.variant.name})` : ''}`;
+  const until = new Date(entry.offerExpiresAt).toLocaleString('en-GB', { day: 'numeric', month: 'long', hour: '2-digit', minute: '2-digit' });
+  const partialNote = entry.offeredQuantity < entry.quantity
+    ? ` You asked for ${entry.quantity}; ${entry.offeredQuantity} came free, and you can take those now.` : '';
+  const line = `${entry.offeredQuantity} × ${item} for ${entry.event.title} ${entry.offeredQuantity === 1 ? 'is' : 'are'} now available for you.${partialNote} We'll hold ${entry.offeredQuantity === 1 ? 'it' : 'them'} until ${until}.`;
+
+  const hasEmail = user?.email && !user.email.endsWith('@guest.local') && !user.email.endsWith('@deleted.invalid');
+  const sends = [];
+  if (hasEmail && shouldEmail(user)) {
+    const html = emailWrapper(`
+      <p style="font-size:22px;font-weight:800;color:#0f172a;margin:0 0 8px 0">A place has opened up!</p>
+      <p style="margin:0 0 8px 0;color:#374151;font-family:${ff}">Hi <strong>${user.name}</strong>,</p>
+      <p style="margin:0 0 24px 0;color:#374151;font-family:${ff}">${line}</p>
+      ${ctaButton('Claim my place', link)}
+      ${fallbackLink(link)}
+    `, { preheader: `Your waitlist place for ${entry.event.title}` });
+    sends.push(sendMail({ to: user.email, subject: `A place is available: ${entry.event.title}`, html, text: `Hi ${user.name},\n\n${line}\n\nClaim it here: ${link}` }));
+  }
+  const wa = `🎟️ Hi ${user?.name || 'there'}, ${line} Claim it here: ${link}`;
+  sends.push(hasEmail ? waText(user, wa) : waTextAny(user, wa));
+  await Promise.allSettled(sends);
+}
+
+const OFFER_INCLUDE = { event: true, eventOption: true, variant: true, user: { select: { id: true, name: true, email: true, phoneNumber: true, notificationPreference: true } } };
+
+/** Puts an entry on offer (inside the caller's transaction); returns the raw token. */
+async function writeOffer(db, entry, quantity, hours) {
+  const token = crypto.randomBytes(24).toString('hex');
+  await db.waitlistEntry.update({
+    where: { id: entry.id },
+    data: {
+      status: 'offered',
+      offeredQuantity: quantity,
+      offerTokenHash: hashToken(token),
+      offeredAt: new Date(),
+      offerExpiresAt: new Date(Date.now() + (hours || 24) * 60 * 60 * 1000),
+    },
+  });
+  return token;
+}
+
+async function notifyOffers(offers) {
+  for (const { entryId, token } of offers) {
+    const entry = await prisma.waitlistEntry.findUnique({ where: { id: entryId }, include: OFFER_INCLUDE });
+    if (entry) notifyOffer(entry, token).catch(e => console.warn('[waitlist] notify failed:', e?.message || e));
+  }
+}
+
+/** Offers `quantity` places to one entry (e.g. a supervisor's manual offer) and notifies. */
+async function makeOffer(entryId, quantity) {
+  const entry = await prisma.waitlistEntry.findUnique({ where: { id: entryId }, include: { event: true } });
+  const token = await writeOffer(prisma, entry, quantity, entry.event.waitlistOfferHours);
+  await notifyOffers([{ entryId, token }]);
+  return prisma.waitlistEntry.findUnique({ where: { id: entryId } });
+}
+
+/**
+ * Offers any free places on an event to the people waiting for them. Safe to call any
+ * time places might have freed up; runs one event at a time under an advisory lock.
+ * @returns {Promise<number>} offers made
+ */
+async function processWaitlist(eventId) {
+  const event = await prisma.event.findUnique({
+    where: { id: eventId },
+    include: { eventOptions: { include: { variants: true } } },
+  });
+  if (!event || !event.waitlistEnabled || !event.isActive || event.cashupStatus === 'closed') return 0;
+  if (new Date(event.endDate) < new Date()) return 0;
+
+  const made = [];
+  await prisma.$transaction(async (tx) => {
+    await tx.$executeRaw`SELECT pg_advisory_xact_lock(hashtext(${'waitlist:' + eventId}))`;
+    const waiting = await tx.waitlistEntry.findMany({ where: { eventId, status: 'waiting' }, orderBy: { position: 'asc' } });
+    const lines = [...new Map(waiting.map(w => [`${w.eventOptionId}::${w.variantId || ''}`, w])).values()];
+    for (const sample of lines) {
+      const option = event.eventOptions.find(o => o.id === sample.eventOptionId);
+      const variant = sample.variantId ? (option?.variants || []).find(v => v.id === sample.variantId) : null;
+      if (!option) continue;
+      const free = await remainingFor(option, variant, { db: tx });
+      if (free === null || free <= 0) continue;
+      const queue = waiting.filter(w => w.eventOptionId === sample.eventOptionId && (w.variantId || null) === (sample.variantId || null));
+      for (const offer of pickOffers(queue, free, event.waitlistPartialOffers)) {
+        const token = await writeOffer(tx, { id: offer.entryId }, offer.quantity, event.waitlistOfferHours);
+        made.push({ entryId: offer.entryId, token });
+      }
+    }
+  }, { timeout: 20000 });
+  await notifyOffers(made);
+  return made.length;
+}
+
+/** Marks lapsed offers as expired. @returns event ids that now have places to re-offer. */
+async function expireOffers(now = new Date()) {
+  const lapsed = await prisma.waitlistEntry.findMany({ where: { status: 'offered', offerExpiresAt: { lte: now } }, select: { id: true, eventId: true } });
+  if (lapsed.length === 0) return [];
+  await prisma.waitlistEntry.updateMany({ where: { id: { in: lapsed.map(l => l.id) } }, data: { status: 'expired', offerTokenHash: null } });
+  return [...new Set(lapsed.map(l => l.eventId))];
+}
+
+/** Background job: expire lapsed offers, then re-offer free places everywhere waiting. */
+async function runWaitlistJob() {
+  const expiredEvents = await expireOffers();
+  const waitingEvents = await prisma.waitlistEntry.findMany({ where: { status: 'waiting' }, distinct: ['eventId'], select: { eventId: true } });
+  const ids = new Set([...expiredEvents, ...waitingEvents.map(w => w.eventId)]);
+  let offers = 0;
+  for (const id of ids) offers += await processWaitlist(id).catch(() => 0);
+  return { expired: expiredEvents.length, offers };
+}
+
+/** Fire-and-forget re-offer after something freed places on an event. */
+function queueWaitlist(eventId) {
+  if (!eventId) return;
+  processWaitlist(eventId).catch(e => console.warn('[waitlist] process failed:', e?.message || e));
+}
+
+/** A live offer from its claim token, or null. */
+async function findOfferByToken(token) {
+  if (!token || typeof token !== 'string' || token.length > 100) return null;
+  return prisma.waitlistEntry.findUnique({
+    where: { offerTokenHash: hashToken(token) },
+    include: { event: true, eventOption: true, variant: true, user: { select: { id: true, name: true } } },
+  });
+}
+
+module.exports = {
+  ACTIVE,
+  waitlistError,
+  hashToken,
+  pickOffers,
+  makeOffer,
+  processWaitlist,
+  expireOffers,
+  runWaitlistJob,
+  queueWaitlist,
+  findOfferByToken,
+};
@@ -0,0 +1,84 @@
+const { joinBlocker, autoAllocate, cleanGender } = require('../src/utils/allocation');
+
+const person = (id, registrationId, gender = null) => ({ id, name: id, registrationId, gender });
+const groupsOf = (result) => {
+  const out = {};
+  for (const p of result.placements) (out[p.groupId] = out[p.groupId] || []).push(p.attendeeId);
+  return out;
+};
+
+describe('cleanGender', () => {
+  test('accepts male/female in any case, blank as null', () => {
+    expect(cleanGender('Male')).toBe('male');
+    expect(cleanGender('')).toBeNull();
+    expect(() => cleanGender('other')).toThrow();
+  });
+});
+
+describe('joinBlocker', () => {
+  test('capacity', () => {
+    expect(joinBlocker({ name: 'Cabin 1', capacity: 2 }, 1, [person('a', 'r')])).toBeNull();
+    expect(joinBlocker({ name: 'Cabin 1', capacity: 2 }, 2, [person('a', 'r')])).toMatch(/full/);
+  });
+
+  test('gender', () => {
+    expect(joinBlocker({ name: 'Boys', gender: 'male' }, 0, [person('a', 'r', 'male')])).toBeNull();
+    expect(joinBlocker({ name: 'Boys', gender: 'male' }, 0, [person('a', 'r', 'female')])).toMatch(/males only/);
+    expect(joinBlocker({ name: 'Boys', gender: 'male' }, 0, [person('a', 'r')])).toMatch(/no gender recorded/);
+  });
+});
+
+describe('autoAllocate', () => {
+  test('fills groups evenly', () => {
+    const groups = [{ id: 'g1', name: 'A' }, { id: 'g2', name: 'B' }];
+    const attendees = ['a', 'b', 'c', 'd'].map(id => person(id, id));
+    const r = autoAllocate({ groups, attendees });
+    const g = groupsOf(r);
+    expect(g.g1.length).toBe(2);
+    expect(g.g2.length).toBe(2);
+    expect(r.unplaced).toEqual([]);
+  });
+
+  test('respects capacity and reports who could not be placed', () => {
+    const groups = [{ id: 'g1', name: 'A', capacity: 1 }];
+    const r = autoAllocate({ groups, attendees: [person('a', 'r1'), person('b', 'r2')] });
+    expect(r.placements.length).toBe(1);
+    expect(r.unplaced.length).toBe(1);
+  });
+
+  test('respects gender', () => {
+    const groups = [{ id: 'boys', name: 'Boys', gender: 'male' }, { id: 'girls', name: 'Girls', gender: 'female' }];
+    const r = autoAllocate({ groups, attendees: [person('a', 'r1', 'male'), person('b', 'r2', 'female'), person('c', 'r3')] });
+    expect(groupsOf(r)).toEqual({ boys: ['a'], girls: ['b'] });
+    expect(r.unplaced).toEqual(['c']);
+  });
+
+  test('keeps a registration together when a group can take them all', () => {
+    const groups = [{ id: 'g1', name: 'A', capacity: 3 }, { id: 'g2', name: 'B', capacity: 3 }];
+    const attendees = [person('s1', 'fam'), person('s2', 'fam'), person('x', 'solo')];
+    const g = groupsOf(autoAllocate({ groups, attendees, mode: 'together' }));
+    const famGroup = Object.keys(g).find(k => g[k].includes('s1'));
+    expect(g[famGroup]).toContain('s2');
+  });
+
+  test('places siblings one by one when no group fits them all', () => {
+    const groups = [{ id: 'boys', name: 'Boys', gender: 'male' }, { id: 'girls', name: 'Girls', gender: 'female' }];
+    const r = autoAllocate({ groups, attendees: [person('bro', 'fam', 'male'), person('sis', 'fam', 'female')], mode: 'together' });
+    expect(groupsOf(r)).toEqual({ boys: ['bro'], girls: ['sis'] });
+  });
+
+  test('split mode spreads a registration across groups', () => {
+    const groups = [{ id: 'g1', name: 'A' }, { id: 'g2', name: 'B' }];
+    const attendees = [person('f1', 'friends'), person('f2', 'friends')];
+    const g = groupsOf(autoAllocate({ groups, attendees, mode: 'split' }));
+    expect(g.g1.length).toBe(1);
+    expect(g.g2.length).toBe(1);
+  });
+
+  test('counts people already placed and leaves them where they are', () => {
+    const groups = [{ id: 'g1', name: 'A', capacity: 2 }, { id: 'g2', name: 'B', capacity: 2 }];
+    const attendees = [person('a', 'r1'), person('b', 'r2'), person('c', 'r3')];
+    const r = autoAllocate({ groups, attendees, assigned: new Map([['a', 'g1'], ['b', 'g1']]) });
+    expect(r.placements).toEqual([{ attendeeId: 'c', groupId: 'g2' }]);
+  });
+});
@@ -0,0 +1,70 @@
+const { deviceFromUA, cleanSource, sessionsFrom, rollupRows, funnelReport } = require('../src/utils/analytics');
+
+const ev = (sessionId, stage, day, extra = {}) => ({ sessionId, stage, createdAt: `${day}T10:00:00Z`, ...extra });
+
+describe('deviceFromUA', () => {
+  test('mobile, tablet, desktop and bots', () => {
+    expect(deviceFromUA('Mozilla/5.0 (iPhone; CPU iPhone OS 17_0) Mobile/15E148')).toBe('mobile');
+    expect(deviceFromUA('Mozilla/5.0 (Linux; Android 14; SM-X200) Safari')).toBe('tablet');
+    expect(deviceFromUA('Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120')).toBe('desktop');
+    expect(deviceFromUA('Googlebot/2.1')).toBeNull();
+    expect(deviceFromUA('')).toBeNull();
+  });
+});
+
+describe('cleanSource', () => {
+  test('tidies, defaulting to direct', () => {
+    expect(cleanSource(' Facebook ')).toBe('facebook');
+    expect(cleanSource('camp-2025<script>')).toBe('camp-2025script');
+    expect(cleanSource('')).toBe('direct');
+  });
+});
+
+describe('sessionsFrom', () => {
+  test('a session counts as having reached every earlier stage', () => {
+    const [s] = sessionsFrom([ev('a', 'start', '2026-01-02')]);
+    expect(s.reach).toBe(1);
+    expect(s.days.view).toBe('2026-01-02');
+  });
+
+  test('paid only counts for sessions that submitted', () => {
+    const out = sessionsFrom([ev('a', 'view', '2026-01-01', { source: 'fb', device: 'mobile' }), ev('a', 'submit', '2026-01-03'), ev('b', 'view', '2026-01-01')], new Set(['a', 'b']));
+    const a = out.find(s => s.sessionId === 'a');
+    expect(a.reach).toBe(3);
+    expect(a.days.paid).toBe('2026-01-03');
+    expect(a.source).toBe('fb');
+    expect(out.find(s => s.sessionId === 'b').reach).toBe(0);
+  });
+});
+
+describe('funnelReport', () => {
+  const sessions = sessionsFrom([
+    ev('a', 'view', '2026-01-01', { source: 'fb', device: 'mobile' }), ev('a', 'start', '2026-01-01'), ev('a', 'submit', '2026-01-01'),
+    ev('b', 'view', '2026-01-01', { source: 'fb', device: 'desktop' }), ev('b', 'start', '2026-01-02'),
+    ev('c', 'view', '2026-01-02', { device: 'mobile' }),
+    ev('d', 'view', '2026-01-02', { device: 'mobile' }),
+  ], new Set(['a']));
+
+  test('counts and conversion per stage', () => {
+    const r = funnelReport(sessions);
+    expect(r.totals).toEqual({ view: 4, start: 2, submit: 1, paid: 1 });
+    expect(r.conversion.start).toBe(50);
+    expect(r.conversion.paid).toBe(25);
+    expect(r.conversion.startToSubmit).toBe(50);
+  });
+
+  test('daily trend and breakdowns', () => {
+    const r = funnelReport(sessions);
+    expect(r.trend).toEqual([{ day: '2026-01-01', view: 2, start: 1, submit: 1, paid: 1 }, { day: '2026-01-02', view: 2, start: 1, submit: 0, paid: 0 }]);
+    expect(r.bySource.find(s => s.key === 'fb')).toMatchObject({ view: 2, paid: 1, conversion: 50 });
+    expect(r.bySource.find(s => s.key === 'direct').view).toBe(2);
+    expect(r.byDevice.find(s => s.key === 'mobile').view).toBe(3);
+  });
+
+  test('rolled-up rows add to the raw counts', () => {
+    const daily = rollupRows(sessionsFrom([ev('x', 'view', '2025-10-01'), ev('x', 'submit', '2025-10-01')], new Set(['x'])));
+    expect(daily.find(r => r.stage === 'paid').sessions).toBe(1);
+    const r = funnelReport(sessions, daily);
+    expect(r.totals).toEqual({ view: 5, start: 3, submit: 2, paid: 2 });
+  });
+});
@@ -15,7 +15,7 @@ describe('validateAttendees', () => {
      { eventOptionId: 'kid', name: '  Sam ', email: ' ', phone: '0821234567' },
      { eventOptionId: 'kid', name: 'Alex', email: 'alex@example.com' },
    ]);
-    expect(out).toEqual([
+    expect(out).toMatchObject([
      { eventOptionId: 'kid', variantId: null, name: 'Sam', email: null, phone: '0821234567' },
      { eventOptionId: 'kid', variantId: null, name: 'Alex', email: 'alex@example.com', phone: null },
    ]);
@@ -0,0 +1,135 @@
+process.env.JWT_SECRET = 'test-secret';
+
+const { ageOn, isMinor, consentStatusFor, reminderDue, validateConsentAnswer, hashToken } = require('../src/utils/consent');
+const { validateAttendees, lineKey } = require('../src/utils/attendees');
+
+const START = new Date('2026-12-10T08:00:00Z');
+const DAY = 24 * 60 * 60 * 1000;
+
+describe('ageOn / isMinor', () => {
+  test('counts whole years, turning a year older on the birthday', () => {
+    expect(ageOn('2008-12-10', START)).toBe(18);
+    expect(ageOn('2008-12-11', START)).toBe(17);
+    expect(ageOn('2010-01-01', START)).toBe(16);
+  });
+
+  test('under 18 on the event start date', () => {
+    expect(isMinor('2008-12-11', START)).toBe(true);
+    expect(isMinor('2008-12-10', START)).toBe(false);
+    expect(isMinor(null, START)).toBe(false);
+  });
+});
+
+describe('consentStatusFor', () => {
+  const event = { requiresParentalConsent: true, startDate: START };
+  const kid = { dateOfBirth: '2012-05-01' };
+
+  test('only needed on youth events, for minors', () => {
+    expect(consentStatusFor(kid, { ...event, requiresParentalConsent: false }, null)).toBe('not_required');
+    expect(consentStatusFor({ dateOfBirth: '1990-01-01' }, event, null)).toBe('not_required');
+  });
+
+  test('a minor with no request, or an unnamed ticket, is missing consent', () => {
+    expect(consentStatusFor(kid, event, null)).toBe('missing');
+    expect(consentStatusFor(null, event, null)).toBe('missing');
+  });
+
+  test('otherwise the latest request decides', () => {
+    expect(consentStatusFor(kid, event, { status: 'pending' })).toBe('pending');
+    expect(consentStatusFor(kid, event, { status: 'given' })).toBe('given');
+    expect(consentStatusFor(kid, event, { status: 'declined' })).toBe('declined');
+  });
+});
+
+describe('reminderDue', () => {
+  const now = new Date('2026-12-01T10:00:00Z');
+  const req = (over) => ({ status: 'pending', remindersSent: 0, lastSentAt: new Date(now.getTime() - 1 * DAY), expiresAt: START, ...over });
+
+  test('first reminder 2 days after the request', () => {
+    expect(reminderDue(req({}), now)).toBe(false);
+    expect(reminderDue(req({ lastSentAt: new Date(now.getTime() - 2 * DAY) }), now)).toBe(true);
+  });
+
+  test('then every 3 days', () => {
+    expect(reminderDue(req({ remindersSent: 1, lastSentAt: new Date(now.getTime() - 2 * DAY) }), now)).toBe(false);
+    expect(reminderDue(req({ remindersSent: 1, lastSentAt: new Date(now.getTime() - 3 * DAY) }), now)).toBe(true);
+  });
+
+  test('never once answered or expired', () => {
+    expect(reminderDue(req({ status: 'given', lastSentAt: new Date(0) }), now)).toBe(false);
+    expect(reminderDue(req({ lastSentAt: new Date(0), expiresAt: new Date(now.getTime() - 1) }), now)).toBe(false);
+  });
+});
+
+describe('validateConsentAnswer', () => {
+  const event = { consentCollectMedical: true, consentCollectEmergency: true, consentCollectPhoto: true };
+  const ok = { decision: 'give', signedName: 'Pat Parent', isGuardian: true, medical: { allergies: 'Peanuts' }, emergency: { name: 'Gran', phone: '0821234567' }, photoConsent: false };
+
+  test('accepts a complete answer and keeps only known fields', () => {
+    const out = validateConsentAnswer({ ...ok, extra: 'x' }, event);
+    expect(out).toEqual({
+      decision: 'give', signedName: 'Pat Parent',
+      medical: { allergies: 'Peanuts', medication: '', conditions: '', medicalAid: '' },
+      emergency: { name: 'Gran', phone: '0821234567', relationship: '' },
+      photoConsent: false,
+    });
+  });
+
+  test('needs a decision, a typed name and the guardian tick', () => {
+    expect(() => validateConsentAnswer({ ...ok, decision: 'maybe' }, event)).toThrow(/give or decline/);
+    expect(() => validateConsentAnswer({ ...ok, signedName: ' ' }, event)).toThrow(/full name/);
+    expect(() => validateConsentAnswer({ ...ok, isGuardian: false }, event)).toThrow(/parent or legal guardian/);
+  });
+
+  test('needs an emergency contact and a photo answer when asked for', () => {
+    expect(() => validateConsentAnswer({ ...ok, emergency: {} }, event)).toThrow(/emergency contact/);
+    expect(() => validateConsentAnswer({ ...ok, photoConsent: undefined }, event)).toThrow(/photo/);
+  });
+
+  test('declining needs no extra details', () => {
+    expect(validateConsentAnswer({ decision: 'decline', signedName: 'Pat', isGuardian: true }, event))
+      .toEqual({ decision: 'decline', signedName: 'Pat', medical: null, emergency: null, photoConsent: null });
+  });
+});
+
+describe('hashToken', () => {
+  test('is stable and never the token itself', () => {
+    expect(hashToken('abc')).toBe(hashToken('abc'));
+    expect(hashToken('abc')).not.toContain('abc');
+    expect(hashToken('abc')).not.toBe(hashToken('abd'));
+  });
+});
+
+describe('validateAttendees on a youth event', () => {
+  const event = {
+    requiresParentalConsent: true, allowNamedAttendees: true, startDate: START,
+    eventOptions: [{ id: 'kid', name: 'Camper', isMainTicket: true }, { id: 'shirt', name: 'T-shirt', isMainTicket: false }],
+  };
+  const places = { [lineKey('kid', null)]: 2, [lineKey('shirt', null)]: 1 };
+  const parent = { parentName: 'Pat', parentEmail: 'pat@example.com', parentPhone: '0821234567' };
+
+  test('every main place must be named', () => {
+    expect(() => validateAttendees(event, places, [{ eventOptionId: 'kid', name: 'A', dateOfBirth: '1990-01-01' }])).toThrow(/every "Camper" ticket/);
+  });
+
+  test('a date of birth is required', () => {
+    expect(() => validateAttendees(event, places, [{ eventOptionId: 'kid', name: 'A' }, { eventOptionId: 'kid', name: 'B' }])).toThrow(/date of birth/);
+  });
+
+  test('minors need full parent details; adults do not', () => {
+    expect(() => validateAttendees(event, places, [
+      { eventOptionId: 'kid', name: 'Kid', dateOfBirth: '2014-03-03', parentName: 'Pat' },
+      { eventOptionId: 'kid', name: 'Leader', dateOfBirth: '1990-01-01' },
+    ])).toThrow(/under 18/);
+    const out = validateAttendees(event, places, [
+      { eventOptionId: 'kid', name: 'Kid', dateOfBirth: '2014-03-03', ...parent },
+      { eventOptionId: 'kid', name: 'Leader', dateOfBirth: '1990-01-01' },
+    ]);
+    expect(out[0]).toMatchObject({ name: 'Kid', parentEmail: 'pat@example.com' });
+    expect(out[0].dateOfBirth).toBeInstanceOf(Date);
+  });
+
+  test('a date of birth in the future is refused', () => {
+    expect(() => validateAttendees(event, { [lineKey('kid', null)]: 1 }, [{ eventOptionId: 'kid', name: 'A', dateOfBirth: '2999-01-01' }])).toThrow(/valid date of birth/);
+  });
+});
@@ -0,0 +1,68 @@
+const { cleanFields, cleanAnswer, summarise } = require('../src/utils/feedback');
+
+describe('cleanFields', () => {
+  test('keeps labelled questions in order, tidying choices', () => {
+    const out = cleanFields([
+      { type: 'rating', label: ' Overall ', isRequired: true },
+      { type: 'text', label: '' },
+      { type: 'multiple_choice', label: 'Best part', options: ['Worship', ' Talks ', 'Worship', ''] },
+      { type: 'statement', label: 'Thanks!', isRequired: true },
+    ]);
+    expect(out.map(f => [f.type, f.label, f.order])).toEqual([['rating', 'Overall', 0], ['multiple_choice', 'Best part', 1], ['statement', 'Thanks!', 2]]);
+    expect(out[1].options).toEqual(['Worship', 'Talks']);
+    expect(out[2].isRequired).toBe(false);
+  });
+
+  test('rejects bad forms', () => {
+    expect(() => cleanFields([{ type: 'stars', label: 'X' }])).toThrow(/unknown type/);
+    expect(() => cleanFields([{ type: 'multiple_choice', label: 'X', options: ['only one'] }])).toThrow(/two choices/);
+    expect(() => cleanFields([{ type: 'statement', label: 'Hello' }])).toThrow(/at least one question/);
+  });
+});
+
+describe('cleanAnswer', () => {
+  test('ratings are whole stars from 1 to 5', () => {
+    expect(cleanAnswer({ type: 'rating', label: 'R' }, '4')).toBe('4');
+    expect(() => cleanAnswer({ type: 'rating', label: 'R' }, '6')).toThrow();
+    expect(() => cleanAnswer({ type: 'rating', label: 'R' }, '3.5')).toThrow();
+  });
+
+  test('multiple choice must be one of the options', () => {
+    const f = { type: 'multiple_choice', label: 'M', options: ['A', 'B'] };
+    expect(cleanAnswer(f, 'B')).toBe('B');
+    expect(() => cleanAnswer(f, 'C')).toThrow();
+  });
+
+  test('required questions need an answer; optional ones may be blank', () => {
+    expect(() => cleanAnswer({ type: 'text', label: 'Why?', isRequired: true }, ' ')).toThrow(/Please answer/);
+    expect(cleanAnswer({ type: 'text', label: 'Why?' }, '')).toBeNull();
+    expect(cleanAnswer({ type: 'yes_no', label: 'Again?' }, 'YES')).toBe('yes');
+  });
+});
+
+describe('summarise', () => {
+  const fields = [
+    { id: 'r', type: 'rating', label: 'Overall' },
+    { id: 'm', type: 'multiple_choice', label: 'Best part', options: ['Worship', 'Talks'] },
+    { id: 't', type: 'text', label: 'Comments' },
+    { id: 's', type: 'statement', label: 'Thanks' },
+  ];
+  const answers = [
+    { fieldId: 'r', value: '5' }, { fieldId: 'r', value: '4' }, { fieldId: 'r', value: '4' },
+    { fieldId: 'm', value: 'Talks' }, { fieldId: 'm', value: 'Talks' }, { fieldId: 'm', value: 'Worship' },
+    { fieldId: 't', value: 'Loved it', name: 'Ann' },
+  ];
+
+  test('averages ratings with a star distribution', () => {
+    const [r] = summarise(fields, answers);
+    expect(r.average).toBe(4.3);
+    expect(r.distribution.map(d => d.value)).toEqual([0, 0, 0, 2, 1]);
+  });
+
+  test('counts choices and lists text answers; skips statements', () => {
+    const out = summarise(fields, answers);
+    expect(out.length).toBe(3);
+    expect(out[1].counts).toEqual([{ label: 'Worship', value: 1 }, { label: 'Talks', value: 2 }]);
+    expect(out[2].texts).toEqual([{ value: 'Loved it', name: 'Ann' }]);
+  });
+});
@@ -0,0 +1,43 @@
+const { allowedWhileImpersonating, impersonationBlocker } = require('../src/utils/impersonation');
+
+describe('allowedWhileImpersonating', () => {
+  test('reads are allowed', () => {
+    expect(allowedWhileImpersonating('GET', '/api/registrations/myregistrations')).toBe(true);
+    expect(allowedWhileImpersonating('HEAD', '/api/events')).toBe(true);
+    expect(allowedWhileImpersonating('OPTIONS', '/api/payments')).toBe(true);
+  });
+
+  test('every write is refused', () => {
+    for (const m of ['POST', 'PUT', 'PATCH', 'DELETE']) {
+      expect(allowedWhileImpersonating(m, '/api/registrations')).toBe(false);
+      expect(allowedWhileImpersonating(m, '/api/payments/yoco-checkout')).toBe(false);
+      expect(allowedWhileImpersonating(m, '/api/users/profile')).toBe(false);
+    }
+  });
+
+  test('except ending the session and logging page views', () => {
+    expect(allowedWhileImpersonating('POST', '/api/admin/impersonate/end')).toBe(true);
+    expect(allowedWhileImpersonating('POST', '/api/admin/impersonate/log?x=1')).toBe(true);
+    expect(allowedWhileImpersonating('DELETE', '/api/admin/impersonate/end')).toBe(false);
+    expect(allowedWhileImpersonating('POST', '/api/admin/impersonate/end/../../users')).toBe(false);
+  });
+});
+
+describe('impersonationBlocker', () => {
+  const admin = { id: 'a', role: 'admin', twoFactorEnabled: true };
+  const user = { id: 'u', role: 'user', isActive: true };
+
+  test('an admin with 2FA can view a user', () => {
+    expect(impersonationBlocker(admin, user)).toBeNull();
+    expect(impersonationBlocker(admin, { ...user, role: 'supervisor' })).toBeNull();
+  });
+
+  test('refusals', () => {
+    expect(impersonationBlocker({ ...admin, role: 'supervisor' }, user)).toMatch(/Only admins/);
+    expect(impersonationBlocker({ ...admin, twoFactorEnabled: false }, user)).toMatch(/two-factor/);
+    expect(impersonationBlocker(admin, { ...user, role: 'admin' })).toMatch(/Admins can't/);
+    expect(impersonationBlocker(admin, { ...admin })).toMatch(/yourself/);
+    expect(impersonationBlocker(admin, { ...user, isActive: false })).toMatch(/deactivated/);
+    expect(impersonationBlocker(admin, null)).toMatch(/not found/);
+  });
+});
@@ -0,0 +1,54 @@
+const { locksClash, lockCovers, judgeSyncedScan } = require('../src/utils/scanLocks');
+
+describe('locksClash', () => {
+  test('a whole-event lock clashes with everything', () => {
+    expect(locksClash({ sectionId: null }, 'hall')).toBe(true);
+    expect(locksClash({ sectionId: 'hall' }, null)).toBe(true);
+  });
+
+  test('section locks only clash with the same section', () => {
+    expect(locksClash({ sectionId: 'hall' }, 'hall')).toBe(true);
+    expect(locksClash({ sectionId: 'hall' }, 'dinner')).toBe(false);
+  });
+});
+
+describe('lockCovers', () => {
+  const dinnerLock = { sectionId: 'dinner', section: { allowedOptions: [{ eventOptionId: 'meal' }] } };
+
+  test('a whole-event lock covers every scan', () => {
+    expect(lockCovers({ sectionId: null }, { sectionId: 'x', optionId: 'y' })).toBe(true);
+  });
+
+  test('with a section picked, only that section is covered', () => {
+    expect(lockCovers(dinnerLock, { sectionId: 'dinner', optionId: 'meal' })).toBe(true);
+    expect(lockCovers(dinnerLock, { sectionId: 'hall', optionId: 'meal' })).toBe(false);
+  });
+
+  test('with no section picked, tickets the locked section admits are covered', () => {
+    expect(lockCovers(dinnerLock, { optionId: 'meal' })).toBe(true);
+    expect(lockCovers(dinnerLock, { optionId: 'entry' })).toBe(false);
+  });
+});
+
+describe('judgeSyncedScan', () => {
+  const ok = { remaining: 2, cancelled: false, inScope: true, consentOk: true };
+
+  test('records a normal scan', () => {
+    expect(judgeSyncedScan(ok, 1)).toEqual({ redeem: 1, conflict: null });
+  });
+
+  test('never redeems more than is left', () => {
+    expect(judgeSyncedScan(ok, 3)).toEqual({ redeem: 2, conflict: 'partly_used' });
+    expect(judgeSyncedScan({ ...ok, remaining: 0 }, 1)).toEqual({ redeem: 0, conflict: 'already_used' });
+  });
+
+  test('flags unknown, cancelled and out-of-scope tickets without recording them', () => {
+    expect(judgeSyncedScan(null, 1)).toEqual({ redeem: 0, conflict: 'not_found' });
+    expect(judgeSyncedScan({ ...ok, cancelled: true }, 1)).toEqual({ redeem: 0, conflict: 'cancelled' });
+    expect(judgeSyncedScan({ ...ok, inScope: false }, 1)).toEqual({ redeem: 0, conflict: 'wrong_scope' });
+  });
+
+  test('records but flags a check-in without consent', () => {
+    expect(judgeSyncedScan({ ...ok, consentOk: false }, 1)).toEqual({ redeem: 1, conflict: 'consent' });
+  });
+});
@@ -0,0 +1,44 @@
+const { spotPrice, sponsorshipCharge, poolSummary } = require('../src/utils/sponsorship');
+
+describe('spotPrice', () => {
+  test('is the cheapest paid main ticket', () => {
+    expect(spotPrice({ price: 0, eventOptions: [
+      { isMainTicket: true, price: 450 }, { isMainTicket: true, price: 300 }, { isMainTicket: false, price: 50 }, { isMainTicket: true, price: 0 },
+    ] })).toBe(300);
+  });
+
+  test('falls back to the event price, or null for free events', () => {
+    expect(spotPrice({ price: 200, eventOptions: [] })).toBe(200);
+    expect(spotPrice({ price: 0, eventOptions: [{ isMainTicket: true, price: 0 }] })).toBeNull();
+  });
+});
+
+describe('sponsorshipCharge', () => {
+  test('whole spots cost the spot price each', () => {
+    expect(sponsorshipCharge({ spots: 3 }, 450)).toEqual({ amount: 1350, spots: 3 });
+  });
+
+  test('a custom amount is taken as given (2 decimals)', () => {
+    expect(sponsorshipCharge({ amount: '120.555' }, 450)).toEqual({ amount: 120.56, spots: null });
+  });
+
+  test('rejects bad input', () => {
+    expect(() => sponsorshipCharge({ spots: 0 }, 450)).toThrow(/between 1/);
+    expect(() => sponsorshipCharge({ spots: 1.5 }, 450)).toThrow();
+    expect(() => sponsorshipCharge({ spots: 1 }, null)).toThrow(/no ticket price/);
+    expect(() => sponsorshipCharge({ amount: 10 }, 450)).toThrow(/minimum/);
+    expect(() => sponsorshipCharge({}, 450)).toThrow();
+  });
+});
+
+describe('poolSummary', () => {
+  test('received, assigned and remaining, with spots funded', () => {
+    const sponsorships = [{ id: 'a', amount: 900 }, { id: 'b', amount: 300 }];
+    const legs = [{ originalPaymentId: 'a', amount: 450 }, { originalPaymentId: 'b', amount: -100 }];
+    expect(poolSummary(sponsorships, legs, 450)).toEqual({ received: 1200, assigned: 550, remaining: 650, sponsors: 2, spotsFunded: 2 });
+  });
+
+  test('no spot count for free events', () => {
+    expect(poolSummary([{ id: 'a', amount: 50 }], [], null).spotsFunded).toBeNull();
+  });
+});
@@ -0,0 +1,46 @@
+const { transferBlocker } = require('../src/utils/ticketTransfer');
+const { judgeSyncedScan } = require('../src/utils/scanLocks');
+
+describe('transferBlocker', () => {
+  const now = new Date('2026-10-01T10:00:00Z');
+  const ticket = {
+    userId: 'payer', holderUserId: 'holder', usages: [], registrationStatus: 'paid',
+    event: { startDate: '2026-10-05T08:00:00Z', allowTicketTransfer: true },
+  };
+  const user = (id, role = 'user') => ({ id, role });
+
+  test('the payer and the holder can transfer', () => {
+    expect(transferBlocker(ticket, user('payer'), now)).toBeNull();
+    expect(transferBlocker(ticket, user('holder'), now)).toBeNull();
+  });
+
+  test('anyone else needs to be a supervisor', () => {
+    expect(transferBlocker(ticket, user('someone'), now).status).toBe(403);
+    expect(transferBlocker(ticket, user('staffer', 'staff'), now).status).toBe(403);
+    expect(transferBlocker(ticket, user('sup', 'supervisor'), now)).toBeNull();
+  });
+
+  test('not once the event has started', () => {
+    expect(transferBlocker({ ...ticket, event: { ...ticket.event, startDate: '2026-10-01T09:00:00Z' } }, user('sup', 'supervisor'), now).message).toMatch(/before the event starts/);
+  });
+
+  test('not once any of it has been scanned', () => {
+    expect(transferBlocker({ ...ticket, usages: [{ id: 'u1' }] }, user('payer'), now).message).toMatch(/already been used/);
+  });
+
+  test('not for a cancelled registration', () => {
+    expect(transferBlocker({ ...ticket, registrationStatus: 'cancelled' }, user('payer'), now)).not.toBeNull();
+  });
+
+  test('turned off per event, except for supervisors', () => {
+    const off = { ...ticket, event: { ...ticket.event, allowTicketTransfer: false } };
+    expect(transferBlocker(off, user('payer'), now).message).toMatch(/turned off/);
+    expect(transferBlocker(off, user('admin', 'admin'), now)).toBeNull();
+  });
+});
+
+describe('offline sync of a transferred code', () => {
+  test('is flagged and not recorded', () => {
+    expect(judgeSyncedScan({ transferred: true }, 1)).toEqual({ redeem: 0, conflict: 'transferred' });
+  });
+});
@@ -0,0 +1,31 @@
+const { pickOffers } = require('../src/utils/waitlist');
+
+const q = (...qs) => qs.map((quantity, i) => ({ id: `e${i + 1}`, quantity }));
+
+describe('pickOffers', () => {
+  test('offers people in order while places last', () => {
+    expect(pickOffers(q(1, 2, 1), 3, true)).toEqual([
+      { entryId: 'e1', quantity: 1 },
+      { entryId: 'e2', quantity: 2 },
+    ]);
+  });
+
+  test('nothing free, no offers', () => {
+    expect(pickOffers(q(1), 0, true)).toEqual([]);
+  });
+
+  test('partial offers: the first in line gets what is free, nobody jumps ahead', () => {
+    expect(pickOffers(q(3, 1), 2, true)).toEqual([{ entryId: 'e1', quantity: 2 }]);
+  });
+
+  test('without partial offers, skips to the next person who fits', () => {
+    expect(pickOffers(q(3, 1, 1), 2, false)).toEqual([
+      { entryId: 'e2', quantity: 1 },
+      { entryId: 'e3', quantity: 1 },
+    ]);
+  });
+
+  test('without partial offers, nobody fits', () => {
+    expect(pickOffers(q(3, 4), 2, false)).toEqual([]);
+  });
+});
@@ -1,13 +1,14 @@
 {
  "name": "hope-events-frontend",
-  "version": "1.14.0",
+  "version": "1.23.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "hope-events-frontend",
-      "version": "1.14.0",
+      "version": "1.23.0",
      "dependencies": {
+        "@dnd-kit/core": "^6.3.1",
        "@hookform/resolvers": "^5.2.1",
        "@radix-ui/react-accordion": "^1.2.11",
        "@radix-ui/react-alert-dialog": "^1.1.14",
@@ -31,6 +32,7 @@
        "class-variance-authority": "^0.7.1",
        "clsx": "^2.1.1",
        "date-fns": "^4.1.0",
+        "idb": "^8.0.4",
        "lucide-react": "^0.536.0",
        "next": "^15.5.24",
        "qrcode": "^1.5.4",
@@ -342,6 +344,45 @@
      "integrity": "sha512-lwYN/vDPeNRULcepoE/LO2Pgx+7/RV+S9ARfbc9lr2DtGkOD7pAiruHvbR1RX3Qyf6ja47EWJDMsNK5vK08DJg==",
      "license": "MIT"
    },
+    "node_modules/@dnd-kit/accessibility": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/@dnd-kit/accessibility/-/accessibility-3.1.1.tgz",
+      "integrity": "sha512-2P+YgaXF+gRsIihwwY1gCsQSYnu9Zyj2py8kY5fFvUM1qm2WA2u639R6YNVfU4GWr+ZM5mqEsfHZZLoRONbemw==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.0.0"
+      },
+      "peerDependencies": {
+        "react": ">=16.8.0"
+      }
+    },
+    "node_modules/@dnd-kit/core": {
+      "version": "6.3.1",
+      "resolved": "https://registry.npmjs.org/@dnd-kit/core/-/core-6.3.1.tgz",
+      "integrity": "sha512-xkGBRQQab4RLwgXxoqETICr6S5JlogafbhNsidmrkVv2YRs5MLwpjoF2qpiGjQt8S9AoxtIV603s0GIUpY5eYQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@dnd-kit/accessibility": "^3.1.1",
+        "@dnd-kit/utilities": "^3.2.2",
+        "tslib": "^2.0.0"
+      },
+      "peerDependencies": {
+        "react": ">=16.8.0",
+        "react-dom": ">=16.8.0"
+      }
+    },
+    "node_modules/@dnd-kit/utilities": {
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/@dnd-kit/utilities/-/utilities-3.2.2.tgz",
+      "integrity": "sha512-+MKAJEOfaBe5SmV6t34p80MMKhjvUz0vRrvVJbPT0WElzaOJ/1xs+D+KDv+tD/NE5ujfrChEcshd4fLn0wpiqg==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.0.0"
+      },
+      "peerDependencies": {
+        "react": ">=16.8.0"
+      }
+    },
    "node_modules/@emnapi/core": {
      "version": "1.10.0",
      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.10.0.tgz",
@@ -869,9 +910,6 @@
      "cpu": [
        "arm"
      ],
-      "libc": [
-        "glibc"
-      ],
      "license": "LGPL-3.0-or-later",
      "optional": true,
      "os": [
@@ -888,9 +926,6 @@
      "cpu": [
        "arm64"
      ],
-      "libc": [
-        "glibc"
-      ],
      "license": "LGPL-3.0-or-later",
      "optional": true,
      "os": [
@@ -907,9 +942,6 @@
      "cpu": [
        "ppc64"
      ],
-      "libc": [
-        "glibc"
-      ],
      "license": "LGPL-3.0-or-later",
      "optional": true,
      "os": [
@@ -926,9 +958,6 @@
      "cpu": [
        "riscv64"
      ],
-      "libc": [
-        "glibc"
-      ],
      "license": "LGPL-3.0-or-later",
      "optional": true,
      "os": [
@@ -945,9 +974,6 @@
      "cpu": [
        "s390x"
      ],
-      "libc": [
-        "glibc"
-      ],
      "license": "LGPL-3.0-or-later",
      "optional": true,
      "os": [
@@ -964,9 +990,6 @@
      "cpu": [
        "x64"
      ],
-      "libc": [
-        "glibc"
-      ],
      "license": "LGPL-3.0-or-later",
      "optional": true,
      "os": [
@@ -983,9 +1006,6 @@
      "cpu": [
        "arm64"
      ],
-      "libc": [
-        "musl"
-      ],
      "license": "LGPL-3.0-or-later",
      "optional": true,
      "os": [
@@ -1002,9 +1022,6 @@
      "cpu": [
        "x64"
      ],
-      "libc": [
-        "musl"
-      ],
      "license": "LGPL-3.0-or-later",
      "optional": true,
      "os": [
@@ -1021,9 +1038,6 @@
      "cpu": [
        "arm"
      ],
-      "libc": [
-        "glibc"
-      ],
      "license": "Apache-2.0",
      "optional": true,
      "os": [
@@ -1046,9 +1060,6 @@
      "cpu": [
        "arm64"
      ],
-      "libc": [
-        "glibc"
-      ],
      "license": "Apache-2.0",
      "optional": true,
      "os": [
@@ -1071,9 +1082,6 @@
      "cpu": [
        "ppc64"
      ],
-      "libc": [
-        "glibc"
-      ],
      "license": "Apache-2.0",
      "optional": true,
      "os": [
@@ -1096,9 +1104,6 @@
      "cpu": [
        "riscv64"
      ],
-      "libc": [
-        "glibc"
-      ],
      "license": "Apache-2.0",
      "optional": true,
      "os": [
@@ -1121,9 +1126,6 @@
      "cpu": [
        "s390x"
      ],
-      "libc": [
-        "glibc"
-      ],
      "license": "Apache-2.0",
      "optional": true,
      "os": [
@@ -1146,9 +1148,6 @@
      "cpu": [
        "x64"
      ],
-      "libc": [
-        "glibc"
-      ],
      "license": "Apache-2.0",
      "optional": true,
      "os": [
@@ -1171,9 +1170,6 @@
      "cpu": [
        "arm64"
      ],
-      "libc": [
-        "musl"
-      ],
      "license": "Apache-2.0",
      "optional": true,
      "os": [
@@ -1196,9 +1192,6 @@
      "cpu": [
        "x64"
      ],
-      "libc": [
-        "musl"
-      ],
      "license": "Apache-2.0",
      "optional": true,
      "os": [
@@ -1455,9 +1448,6 @@
      "cpu": [
        "arm64"
      ],
-      "libc": [
-        "glibc"
-      ],
      "license": "MIT",
      "optional": true,
      "os": [
@@ -1474,9 +1464,6 @@
      "cpu": [
        "arm64"
      ],
-      "libc": [
-        "musl"
-      ],
      "license": "MIT",
      "optional": true,
      "os": [
@@ -1493,9 +1480,6 @@
      "cpu": [
        "x64"
      ],
-      "libc": [
-        "glibc"
-      ],
      "license": "MIT",
      "optional": true,
      "os": [
@@ -1512,9 +1496,6 @@
      "cpu": [
        "x64"
      ],
-      "libc": [
-        "musl"
-      ],
      "license": "MIT",
      "optional": true,
      "os": [
@@ -6865,6 +6846,12 @@
        "node": ">= 6"
      }
    },
+    "node_modules/idb": {
+      "version": "8.0.4",
+      "resolved": "https://registry.npmjs.org/idb/-/idb-8.0.4.tgz",
+      "integrity": "sha512-jd0ITCrN+Zah4J7R/Z2jnR3W7A4BXDAjmo62MwWuSjxCiueUAf7X5rbodEdidWzeknwXHmLpdZkoiiCppNi30Q==",
+      "license": "ISC"
+    },
    "node_modules/ignore": {
      "version": "5.3.2",
      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
@@ -1,6 +1,6 @@
 {
  "name": "hope-events-frontend",
-  "version": "1.14.0",
+  "version": "1.23.0",
  "private": true,
  "scripts": {
    "dev": "next dev --turbopack",
@@ -9,6 +9,7 @@
    "lint": "next lint"
  },
  "dependencies": {
+    "@dnd-kit/core": "^6.3.1",
    "@hookform/resolvers": "^5.2.1",
    "@radix-ui/react-accordion": "^1.2.11",
    "@radix-ui/react-alert-dialog": "^1.1.14",
@@ -32,6 +33,7 @@
    "class-variance-authority": "^0.7.1",
    "clsx": "^2.1.1",
    "date-fns": "^4.1.0",
+    "idb": "^8.0.4",
    "lucide-react": "^0.536.0",
    "next": "^15.5.24",
    "qrcode": "^1.5.4",
@@ -0,0 +1,67 @@
+/*
+ * Service worker for offline ticket scanning.
+ *
+ * Only the scanner page and the static files it needs are cached:
+ * - /_next/static/* (hashed, never change): cache-first.
+ * - The scanner page itself: network-first, falling back to the cached copy offline.
+ * - The page can ask (postMessage { type: 'cache-urls', urls }) for the files it has
+ *   loaded to be cached up front, so it works offline straight after "Enable offline mode".
+ * API calls are never cached — offline scans go through IndexedDB instead.
+ */
+const CACHE = 'hope-scanner-v1';
+const SCANNER_PATH = '/dashboard/staff/ticket-scanning';
+
+self.addEventListener('install', () => self.skipWaiting());
+self.addEventListener('activate', (event) => {
+  event.waitUntil((async () => {
+    const keys = await caches.keys();
+    await Promise.all(keys.filter(k => k.startsWith('hope-scanner-') && k !== CACHE).map(k => caches.delete(k)));
+    await self.clients.claim();
+  })());
+});
+
+self.addEventListener('message', (event) => {
+  const data = event.data || {};
+  if (data.type !== 'cache-urls' || !Array.isArray(data.urls)) return;
+  event.waitUntil((async () => {
+    const cache = await caches.open(CACHE);
+    const sameOrigin = data.urls.filter(u => {
+      try { return new URL(u, self.location.origin).origin === self.location.origin; } catch { return false; }
+    });
+    await Promise.all(sameOrigin.map(u => cache.add(u).catch(() => {})));
+  })());
+});
+
+self.addEventListener('fetch', (event) => {
+  const req = event.request;
+  if (req.method !== 'GET') return;
+  const url = new URL(req.url);
+  if (url.origin !== self.location.origin) return;
+
+  if (url.pathname.startsWith('/_next/static/')) {
+    event.respondWith((async () => {
+      const cache = await caches.open(CACHE);
+      const hit = await cache.match(req);
+      if (hit) return hit;
+      const res = await fetch(req);
+      if (res.ok) cache.put(req, res.clone());
+      return res;
+    })());
+    return;
+  }
+
+  if (url.pathname === SCANNER_PATH) {
+    event.respondWith((async () => {
+      const cache = await caches.open(CACHE);
+      try {
+        const res = await fetch(req);
+        if (res.ok) cache.put(SCANNER_PATH, res.clone());
+        return res;
+      } catch {
+        const hit = (await cache.match(req, { ignoreSearch: true })) || (await cache.match(SCANNER_PATH));
+        if (hit) return hit;
+        throw new Error('offline and not cached');
+      }
+    })());
+  }
+});
@@ -40,7 +40,7 @@ export default async function EventRedirectPage({ params }: { params: Promise<{
    }

    if (event.isLive || event.isActive) {
-        redirect(`/events/${event.id}`);
+        redirect(`/events/${event.id}?src=${encodeURIComponent(redirectUrl)}`);
    }

    return (
@@ -0,0 +1,181 @@
+"use client";
+import React, { useEffect, useState } from "react";
+import { useParams } from "next/navigation";
+import { Navbar } from "@/components/layout/Navbar";
+import { Footer } from "@/components/layout/Footer";
+import { apiFetch, ApiError } from "@/lib/api";
+import { formatDate } from "@/lib/date";
+import { ShieldCheck, CheckCircle2, XCircle } from "lucide-react";
+
+type ConsentInfo = {
+  status: "pending" | "given" | "declined";
+  superseded: boolean;
+  expired: boolean;
+  respondedAt: string | null;
+  attendeeName: string;
+  parentName: string | null;
+  consentText: string;
+  event: { title: string; startDate: string; endDate: string; location: string | null };
+  collect: { medical: boolean; emergency: boolean; photo: boolean };
+};
+
+const inputCls = "w-full border rounded-lg px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-brand-400";
+
+/** Public page a parent/guardian opens from their consent email or WhatsApp. */
+export default function ConsentPage() {
+  const params = useParams<{ token: string }>();
+  const token = params?.token;
+  const [info, setInfo] = useState<ConsentInfo | null>(null);
+  const [loadError, setLoadError] = useState<string | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [busy, setBusy] = useState(false);
+  const [done, setDone] = useState<"given" | "declined" | null>(null);
+
+  const [signedName, setSignedName] = useState("");
+  const [isGuardian, setIsGuardian] = useState(false);
+  const [medical, setMedical] = useState({ allergies: "", medication: "", conditions: "", medicalAid: "" });
+  const [emergency, setEmergency] = useState({ name: "", phone: "", relationship: "" });
+  const [photoConsent, setPhotoConsent] = useState<boolean | null>(null);
+
+  useEffect(() => {
+    if (!token) return;
+    apiFetch<ConsentInfo>(`/api/consent/${encodeURIComponent(token)}`)
+      .then(res => { setInfo(res); setSignedName(res.parentName || ""); })
+      .catch(e => setLoadError(e instanceof ApiError ? e.message : "Couldn't load this consent request."));
+  }, [token]);
+
+  const submit = async (decision: "give" | "decline") => {
+    if (!token || !info) return;
+    setError(null);
+    if (decision === "give" && info.collect.photo && photoConsent === null) { setError("Please answer the photo consent question."); return; }
+    setBusy(true);
+    try {
+      await apiFetch(`/api/consent/${encodeURIComponent(token)}`, {
+        method: "POST",
+        body: {
+          decision, signedName, isGuardian,
+          ...(decision === "give" && info.collect.medical ? { medical } : {}),
+          ...(decision === "give" && info.collect.emergency ? { emergency } : {}),
+          ...(decision === "give" && info.collect.photo ? { photoConsent } : {}),
+        },
+      });
+      setDone(decision === "give" ? "given" : "declined");
+    } catch (e) {
+      setError(e instanceof ApiError ? e.message : "Couldn't save your answer. Please try again.");
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  const open = info && info.status === "pending" && !info.superseded && !info.expired && !done;
+
+  return (
+    <div className="min-h-screen flex flex-col">
+      <Navbar />
+      <main className="flex-1 px-4 py-10 max-w-2xl mx-auto w-full">
+        <div className="flex items-center gap-3 mb-4">
+          <div className="w-10 h-10 rounded-xl bg-brand-50 flex items-center justify-center shrink-0">
+            <ShieldCheck className="w-5 h-5 text-brand-600" />
+          </div>
+          <h1 className="text-2xl font-semibold text-gray-900">Parental consent</h1>
+        </div>
+
+        {loadError && <div className="border rounded-xl p-4 bg-red-50 text-red-800 text-sm">{loadError}</div>}
+        {!info && !loadError && <div className="text-sm text-gray-600">Loading…</div>}
+
+        {info && (
+          <div className="border rounded-xl p-5 bg-white shadow-sm space-y-4">
+            <div>
+              <div className="text-sm text-gray-500">Event</div>
+              <div className="font-semibold text-gray-900">{info.event.title}</div>
+              <div className="text-sm text-gray-600">
+                {formatDate(new Date(info.event.startDate))}{info.event.endDate ? ` – ${formatDate(new Date(info.event.endDate))}` : ""}
+                {info.event.location ? ` · ${info.event.location}` : ""}
+              </div>
+            </div>
+            <div>
+              <div className="text-sm text-gray-500">Attendee</div>
+              <div className="font-semibold text-gray-900">{info.attendeeName}</div>
+            </div>
+
+            {(done || info.status !== "pending") && (
+              <div className={`flex items-start gap-2 rounded-lg p-3 text-sm ${(done || info.status) === "given" ? "bg-green-50 text-green-800" : "bg-amber-50 text-amber-900"}`}>
+                {(done || info.status) === "given" ? <CheckCircle2 className="w-5 h-5 shrink-0" /> : <XCircle className="w-5 h-5 shrink-0" />}
+                <span>
+                  {(done || info.status) === "given" ? "Consent has been given. Thank you!" : "Consent has been declined. The organisers have been told."}
+                  {!done && info.respondedAt && ` (${formatDate(new Date(info.respondedAt))})`}
+                </span>
+              </div>
+            )}
+            {!done && info.status === "pending" && info.superseded && (
+              <div className="rounded-lg p-3 text-sm bg-amber-50 text-amber-900">A newer consent request has replaced this one. Please use the link in your latest message.</div>
+            )}
+            {!done && info.status === "pending" && info.expired && (
+              <div className="rounded-lg p-3 text-sm bg-gray-100 text-gray-700">This consent link has expired because the event has ended.</div>
+            )}
+
+            {open && (
+              <>
+                <div>
+                  <div className="text-sm font-medium text-gray-800 mb-1">Please read</div>
+                  <div className="text-sm text-gray-700 whitespace-pre-line border rounded-lg p-3 bg-gray-50 max-h-72 overflow-y-auto">{info.consentText || "The organisers haven't added any consent text."}</div>
+                </div>
+
+                {info.collect.medical && (
+                  <fieldset className="space-y-2">
+                    <legend className="text-sm font-medium text-gray-800">Medical information <span className="font-normal text-gray-500">(kept confidential and deleted after the event)</span></legend>
+                    <textarea className={inputCls} rows={2} placeholder="Allergies" value={medical.allergies} onChange={e => setMedical({ ...medical, allergies: e.target.value })} aria-label="Allergies" />
+                    <textarea className={inputCls} rows={2} placeholder="Medication" value={medical.medication} onChange={e => setMedical({ ...medical, medication: e.target.value })} aria-label="Medication" />
+                    <textarea className={inputCls} rows={2} placeholder="Medical conditions" value={medical.conditions} onChange={e => setMedical({ ...medical, conditions: e.target.value })} aria-label="Medical conditions" />
+                    <input className={inputCls} placeholder="Medical aid (scheme and number)" value={medical.medicalAid} onChange={e => setMedical({ ...medical, medicalAid: e.target.value })} aria-label="Medical aid" />
+                  </fieldset>
+                )}
+
+                {info.collect.emergency && (
+                  <fieldset className="space-y-2">
+                    <legend className="text-sm font-medium text-gray-800">Emergency contact</legend>
+                    <div className="grid grid-cols-1 sm:grid-cols-3 gap-2">
+                      <input className={inputCls} placeholder="Name" value={emergency.name} onChange={e => setEmergency({ ...emergency, name: e.target.value })} aria-label="Emergency contact name" />
+                      <input type="tel" className={inputCls} placeholder="Phone" value={emergency.phone} onChange={e => setEmergency({ ...emergency, phone: e.target.value })} aria-label="Emergency contact phone" />
+                      <input className={inputCls} placeholder="Relationship" value={emergency.relationship} onChange={e => setEmergency({ ...emergency, relationship: e.target.value })} aria-label="Relationship" />
+                    </div>
+                  </fieldset>
+                )}
+
+                {info.collect.photo && (
+                  <fieldset>
+                    <legend className="text-sm font-medium text-gray-800 mb-1">May {info.attendeeName} appear in event photos and videos?</legend>
+                    <label className="inline-flex items-center gap-2 text-sm mr-4"><input type="radio" name="photo" checked={photoConsent === true} onChange={() => setPhotoConsent(true)} /> Yes</label>
+                    <label className="inline-flex items-center gap-2 text-sm"><input type="radio" name="photo" checked={photoConsent === false} onChange={() => setPhotoConsent(false)} /> No</label>
+                  </fieldset>
+                )}
+
+                <div className="space-y-2 border-t pt-4">
+                  <label className="block text-sm font-medium text-gray-800">Type your full name to sign</label>
+                  <input className={inputCls} value={signedName} onChange={e => setSignedName(e.target.value)} aria-label="Your full name" />
+                  <label className="flex items-start gap-2 text-sm text-gray-700">
+                    <input type="checkbox" className="mt-0.5" checked={isGuardian} onChange={e => setIsGuardian(e.target.checked)} />
+                    <span>I am the parent or legal guardian of {info.attendeeName}.</span>
+                  </label>
+                </div>
+
+                {error && <div className="p-3 border rounded bg-red-50 text-red-800 text-sm">{error}</div>}
+
+                <div className="flex flex-wrap gap-3">
+                  <button onClick={() => submit("give")} disabled={busy || !isGuardian || signedName.trim().length < 2} className="px-4 py-2 rounded-lg bg-brand-600 text-white text-sm font-medium hover:bg-brand-700 disabled:opacity-50">
+                    {busy ? "Saving…" : "Give consent"}
+                  </button>
+                  <button onClick={() => submit("decline")} disabled={busy || !isGuardian || signedName.trim().length < 2} className="px-4 py-2 rounded-lg border border-gray-300 text-gray-700 text-sm font-medium hover:bg-gray-50 disabled:opacity-50">
+                    Decline
+                  </button>
+                </div>
+                <p className="text-xs text-gray-500">We record your typed name, the time, and the device you used, together with the text above.</p>
+              </>
+            )}
+          </div>
+        )}
+      </main>
+      <Footer />
+    </div>
+  );
+}
@@ -22,6 +22,16 @@ const ACTIONS = [
  "coupon_updated",
  "coupon_disabled",
  "coupon_applied_manual",
+  "consent_override",
+  "consent_rerequested",
+  "medical_list_viewed",
+  "scan_lock_acquired",
+  "scan_lock_released",
+  "scan_lock_force_released",
+  "offline_sync",
+  "ticket_transferred",
+  "impersonation_started",
+  "impersonation_ended",
 ] as const;

 const ACTION_LABELS: Record<string, string> = {
@@ -38,6 +48,16 @@ const ACTION_LABELS: Record<string, string> = {
  coupon_updated: "Coupon edited",
  coupon_disabled: "Coupon turned off",
  coupon_applied_manual: "Coupon applied/removed by staff",
+  consent_override: "Consent overridden at check-in",
+  consent_rerequested: "Consent re-requested",
+  medical_list_viewed: "Medical list viewed",
+  scan_lock_acquired: "Offline scanning started",
+  scan_lock_released: "Offline scanning ended",
+  scan_lock_force_released: "Offline lock force-released",
+  offline_sync: "Offline scans synced",
+  ticket_transferred: "Ticket transferred",
+  impersonation_started: "Impersonation started",
+  impersonation_ended: "Impersonation ended",
 };

 interface AuditLogEntry {
@@ -65,6 +85,49 @@ function formatMetadata(metadata: Record<string, unknown> | null): string {
  }
 }

+type ImpSession = {
+  id: string; reason: string; startedAt: string; expiresAt: string; endedAt: string | null; endedReason: string | null;
+  admin: { name: string; email: string }; target: { name: string; email: string };
+  requests: { method: string; path: string; blocked: boolean; createdAt: string }[];
+};
+
+/** "View as" sessions, each with the trail of pages and API calls made during it. */
+function ImpersonationSessions({ token }: { token: string }) {
+  const [sessions, setSessions] = useState<ImpSession[]>([]);
+  const [open, setOpen] = useState<string | null>(null);
+  useEffect(() => {
+    apiFetch<ImpSession[]>("/api/admin/impersonation-sessions?limit=20", { authToken: token }).then(setSessions).catch(() => setSessions([]));
+  }, [token]);
+  if (sessions.length === 0) return null;
+  return (
+    <div className="border rounded-xl bg-white shadow-sm p-4 mb-4">
+      <div className="font-semibold mb-2">Impersonation sessions</div>
+      <ul className="divide-y text-sm">
+        {sessions.map(s => (
+          <li key={s.id} className="py-2">
+            <button className="w-full text-left flex flex-wrap items-baseline justify-between gap-2" onClick={() => setOpen(open === s.id ? null : s.id)}>
+              <span><strong>{s.admin.name}</strong> viewed as <strong>{s.target.name}</strong> — “{s.reason}”</span>
+              <span className="text-xs text-gray-500">
+                {new Date(s.startedAt).toLocaleString()} · {s.endedAt ? `${s.endedReason || "ended"} ${new Date(s.endedAt).toLocaleTimeString()}` : new Date(s.expiresAt) > new Date() ? "active" : "expired"} · {s.requests.length} request(s){s.requests.some(r => r.blocked) ? ` · ${s.requests.filter(r => r.blocked).length} blocked` : ""}
+              </span>
+            </button>
+            {open === s.id && (
+              <ul className="mt-2 text-xs font-mono bg-gray-50 rounded p-2 max-h-64 overflow-auto space-y-0.5">
+                {s.requests.map((r, i) => (
+                  <li key={i} className={r.blocked ? "text-red-700" : "text-gray-700"}>
+                    {new Date(r.createdAt).toLocaleTimeString()} {r.method} {r.path}{r.blocked ? "  (blocked — read-only)" : ""}
+                  </li>
+                ))}
+                {s.requests.length === 0 && <li className="text-gray-500">No requests recorded.</li>}
+              </ul>
+            )}
+          </li>
+        ))}
+      </ul>
+    </div>
+  );
+}
+
 export default function AdminAuditLogPage() {
  const { user, loading, token } = useAuth();
  const router = useRouter();
@@ -132,6 +195,7 @@ export default function AdminAuditLogPage() {
          You need admin access to view the audit log.
        </div>
      )}
+      {isAdmin && token && <ImpersonationSessions token={token} />}

      {error && <div className="mb-3 p-3 border rounded bg-red-50 text-red-800 text-sm">{error}</div>}

@@ -8,7 +8,7 @@ import { useStableState } from "@/hooks/useStableState";
 import { useVisiblePolling } from "@/hooks/useVisiblePolling";
 import {
  Calendar, Banknote, Gift, Users, Ticket, QrCode, ClipboardList,
-  UserPlus, FileText, MessageCircle, BarChart2, Mail, Wallet, DoorOpen, History, TicketPercent,
+  UserPlus, FileText, MessageCircle, BarChart2, Mail, Wallet, DoorOpen, History, TicketPercent, ShieldCheck, ListChecks, WifiOff, BedDouble, Filter,
 } from "lucide-react";
 import { StatCard, StatCardRow } from "@/components/shared/StatCard";
 import { QuickActionTile, QuickActionGrid } from "@/components/shared/QuickActionTile";
@@ -27,6 +27,10 @@ const QUICK_ACTIONS = [
  { href: "/dashboard/supervisor/manual", label: "Manual registration", description: "Register a guest and issue tickets", icon: UserPlus },
  { href: "/dashboard/supervisor/at-the-door", label: "At the door", description: "Walk-ins, payments, ticket printing", icon: DoorOpen },
  { href: "/dashboard/supervisor/payments", label: "Payments & donations", description: "Manual payments and assignment", icon: Wallet },
+  { href: "/dashboard/supervisor/allocations", label: "Rooms & groups", description: "Put attendees into rooms, groups or buses", icon: BedDouble },
+  { href: "/dashboard/supervisor/offline-scans", label: "Offline scanning", description: "Devices scanning offline and their synced scans", icon: WifiOff },
+  { href: "/dashboard/supervisor/waitlist", label: "Waitlist", description: "People waiting for sold-out tickets", icon: ListChecks },
+  { href: "/dashboard/supervisor/consent", label: "Parental consent", description: "Youth events: consent status and medical list", icon: ShieldCheck },
  { href: "/dashboard/supervisor/coupons", label: "Coupon codes", description: "Discounts for staff, leaders and promotions", icon: TicketPercent },
  { href: "/dashboard/staff/ticket-scanning", label: "Open scanner", description: "Use your device camera to validate tickets", icon: QrCode },
  { href: "/dashboard/supervisor/reports", label: "Reports", description: "View, export, and email reports", icon: BarChart2 },
@@ -39,6 +43,7 @@ const QUICK_ACTIONS = [

 type OverviewMetric = { thisMonth: number; lastMonth: number; pctChange: number | null };
 type Overview = {
+  funnel?: { views: number; paid: number; conversion: number | null } | null;
  activeEvents: number;
  registrations: OverviewMetric;
  ticketsSold: OverviewMetric;
@@ -116,12 +121,15 @@ export default function AdminDashboardPage() {
        </div>
      )}

-      <StatCardRow>
+      <StatCardRow cols={overview?.funnel ? 6 : 5}>
        <StatCard icon={Calendar} label="Active events" value={overview ? formatCount(overview.activeEvents) : "—"} tone="brand" href="/dashboard/supervisor/events" linkLabel="View all events" />
        <StatCard icon={Banknote} label="Revenue (past month)" value={overview ? formatRand(overview.revenue.thisMonth) : "—"} tone="green" href={`${REPORTS_URL}?report=revenue&range=trailing_month`} linkLabel="View report" delta={overview ? { value: overview.revenue.pctChange } : undefined} />
        <StatCard icon={Gift} label="Donations (past month)" value={overview ? formatRand(overview.donations.thisMonth) : "—"} tone="rose" href={`${REPORTS_URL}?report=donations&range=trailing_month`} linkLabel="View report" delta={overview ? { value: overview.donations.pctChange } : undefined} />
        <StatCard icon={Users} label="Registrations (past month)" value={overview ? formatCount(overview.registrations.thisMonth) : "—"} tone="blue" href="/dashboard/admin/registrations" linkLabel="View registrations" delta={overview ? { value: overview.registrations.pctChange } : undefined} />
        <StatCard icon={Ticket} label="Tickets sold (past month)" value={overview ? formatCount(overview.ticketsSold.thisMonth) : "—"} tone="amber" href={`${REPORTS_URL}?report=usage&range=trailing_month`} linkLabel="View report" delta={overview ? { value: overview.ticketsSold.pctChange } : undefined} />
+        {overview?.funnel && (
+          <StatCard icon={Filter} label="Conversion (past month)" value={overview.funnel.conversion != null ? `${overview.funnel.conversion}%` : "—"} tone="violet" href={`${REPORTS_URL}?report=funnel&range=trailing_month`} linkLabel={`${overview.funnel.paid} of ${overview.funnel.views} visits`} />
+        )}
      </StatCardRow>

      <div className="border rounded-xl p-4 bg-white shadow-sm my-6">
@@ -136,6 +136,8 @@ function SiteSettingsPageInner() {
  const [legalIoEmail, setLegalIoEmail] = useState("");
  const [legalWebsiteUrl, setLegalWebsiteUrl] = useState("");
  const [legalEffectiveDate, setLegalEffectiveDate] = useState("");
+  const [consentRetentionDays, setConsentRetentionDays] = useState("30");
+  const [notifyOnImpersonation, setNotifyOnImpersonation] = useState(false);

  // ── Load all settings once ────────────────────────────────────────────────
  useEffect(() => {
@@ -171,6 +173,8 @@ function SiteSettingsPageInner() {
        setLegalIoEmail(s.legal_io_email || "");
        setLegalWebsiteUrl(s.legal_website_url || "");
        setLegalEffectiveDate(s.legal_effective_date || "");
+        setConsentRetentionDays(s.consent_medical_retention_days || "30");
+        setNotifyOnImpersonation(s.notify_user_on_impersonation === "true");
      })
      .catch((e: any) => setResult({ ok: false, message: e?.message || "Failed to load settings" }))
      .finally(() => setLoadingInitial(false));
@@ -319,6 +323,8 @@ function SiteSettingsPageInner() {
    legal_io_email:       legalIoEmail.trim(),
    legal_website_url:    legalWebsiteUrl.trim(),
    legal_effective_date: legalEffectiveDate.trim(),
+    consent_medical_retention_days: String(Math.max(0, parseInt(consentRetentionDays, 10) || 0)),
+    notify_user_on_impersonation: notifyOnImpersonation ? "true" : "false",
  });

  const handleTestSmtp = async () => {
@@ -658,6 +664,23 @@ function SiteSettingsPageInner() {
              </div>
            </div>

+            <div className="border-t pt-4">
+              <p className="text-sm font-medium text-gray-700 mb-3">Youth events</p>
+              <Field label="Delete medical & emergency details this many days after an event">
+                <input type="number" min="0" className={`${inputCls} sm:w-32`}
+                  value={consentRetentionDays} onChange={e => setConsentRetentionDays(e.target.value)} />
+              </Field>
+              <p className="text-xs text-gray-500 mt-1">Collected on parental consent forms. The consent record itself (who agreed, and when) is kept.</p>
+            </div>
+
+            <div className="border-t pt-4">
+              <p className="text-sm font-medium text-gray-700 mb-3">Support access</p>
+              <label className="flex items-start gap-2 text-sm cursor-pointer">
+                <input type="checkbox" className="mt-0.5" checked={notifyOnImpersonation} onChange={e => setNotifyOnImpersonation(e.target.checked)} />
+                <span>Email a user when an admin views their account with &quot;Impersonate&quot; (read-only support access), including the reason given</span>
+              </label>
+            </div>
+
            <SaveBar saving={saving} onSave={saveLegal} result={result} />
          </div>
        )}
@@ -5,6 +5,7 @@ import { useAuth } from "@/hooks/useAuth";
 import { useRouter } from "next/navigation";
 import { apiFetch } from "@/lib/api";
 import { useDismissingState } from "@/hooks/useDismissingState";
+import { beginImpersonation } from "@/lib/impersonation";
 import { Users as UsersIcon } from "lucide-react";
 import { RoleBadge, type Role as RoleBadgeRole } from "@/components/shared/RoleBadge";

@@ -187,6 +188,23 @@ export default function AdminUsersPage() {
    }
  };

+  const [impTarget, setImpTarget] = useState<{ id: string; name: string } | null>(null);
+  const [impReason, setImpReason] = useState("");
+  const [impBusy, setImpBusy] = useState(false);
+  const [impError, setImpError] = useState<string | null>(null);
+  const startImpersonation = async () => {
+    if (!impTarget || !token) return;
+    setImpBusy(true);
+    setImpError(null);
+    try {
+      const res = await apiFetch<any>(`/api/admin/impersonate/${encodeURIComponent(impTarget.id)}`, { method: "POST", authToken: token, body: { reason: impReason } });
+      beginImpersonation(res);
+    } catch (e: any) {
+      setImpError(e?.message || "Couldn't start impersonation");
+      setImpBusy(false);
+    }
+  };
+
  const resetTwoFactor = async (id: string, name: string, role: string) => {
    // Admins and supervisors can't go without 2FA: a reset just makes them set it up
    // again (on a channel that works) at their next login.
@@ -222,6 +240,24 @@ export default function AdminUsersPage() {
    }
  };

+  const impersonateModal = impTarget && (
+    <div className="fixed inset-0 bg-black/40 flex items-center justify-center z-50" onClick={() => !impBusy && setImpTarget(null)}>
+      <div className="bg-white rounded-xl shadow-lg max-w-md w-full mx-4 p-5 space-y-3" onClick={e => e.stopPropagation()}>
+        <h3 className="text-lg font-semibold">View as {impTarget.name}</h3>
+        <p className="text-sm text-gray-600">You&apos;ll see the site exactly as they do, for up to 30 minutes. It&apos;s strictly read-only: nothing can be registered, paid, changed or sent. The session, your reason and every page you open are recorded in the audit log.</p>
+        <div>
+          <label className="block text-xs text-gray-600 mb-1">Reason (required)</label>
+          <textarea className="w-full border rounded-lg px-3 py-2 text-sm" rows={2} value={impReason} onChange={e => setImpReason(e.target.value)} placeholder="e.g. Says their ticket isn't showing in My Events" maxLength={500} autoFocus />
+        </div>
+        {impError && <div className="p-2 rounded bg-red-50 text-red-800 text-sm">{impError}</div>}
+        <div className="flex justify-end gap-2">
+          <button className="px-3 py-1.5 text-sm rounded bg-gray-100 hover:bg-gray-200" onClick={() => setImpTarget(null)} disabled={impBusy}>Cancel</button>
+          <button className="px-3 py-1.5 text-sm rounded bg-violet-600 text-white hover:bg-violet-700 disabled:opacity-50" onClick={startImpersonation} disabled={impBusy || impReason.trim().length < 5}>{impBusy ? "Starting…" : "Start viewing"}</button>
+        </div>
+      </div>
+    </div>
+  );
+
  return (
    <div className="max-w-6xl mx-auto w-full p-6">
      <div className="flex items-center justify-between mb-4 flex-wrap gap-3">
@@ -367,6 +403,9 @@ export default function AdminUsersPage() {
                  <td className="p-2">
                    <div className="flex gap-1 flex-wrap">
                      <button className="px-2 py-1 text-xs rounded bg-gray-100 hover:bg-gray-200" onClick={() => startEdit(u)}>Edit</button>
+                      {user?.role === "admin" && u.role !== "admin" && u.isActive && (
+                        <button className="px-2 py-1 text-xs rounded bg-violet-600 text-white hover:bg-violet-700" onClick={() => { setImpTarget({ id: u.id, name: u.name }); setImpReason(""); setImpError(null); }} title="See the site exactly as this user sees it (read-only, 30 minutes, audited)">Impersonate</button>
+                      )}
                      <button className="px-2 py-1 text-xs rounded bg-amber-500 text-white hover:bg-amber-600" onClick={() => revokeUserSessions(u.id, u.name)} title="Force this user to sign in again on every device where they're currently logged in">Sign out everywhere</button>
                      {u.twoFactorEnabled && (
                        <button className="px-2 py-1 text-xs rounded bg-amber-500 text-white hover:bg-amber-600" onClick={() => resetTwoFactor(u.id, u.name, u.role)} title={u.role === "admin" || u.role === "supervisor" ? "Reset two-factor authentication — they set it up again at their next login" : "Turn off two-factor authentication for a user who can no longer receive their codes"}>Reset 2FA</button>
@@ -498,6 +537,7 @@ export default function AdminUsersPage() {
          </div>
        </div>
      )}
+      {impersonateModal}
    </div>
  );
 }
@@ -0,0 +1,96 @@
+"use client";
+
+import React, { useEffect, useState } from "react";
+import { useAuth } from "@/hooks/useAuth";
+import { useRouter } from "next/navigation";
+import { apiFetch } from "@/lib/api";
+import { formatDate } from "@/lib/date";
+import { Users } from "lucide-react";
+
+type Member = {
+  id: string; name: string; gender: string | null; dateOfBirth: string | null; phone: string | null;
+  parentName: string | null; parentPhone: string | null; bookedBy: string; bookedByPhone: string | null;
+  medical?: Record<string, string> | null; emergency?: Record<string, string> | null;
+};
+type MyGroup = { id: string; name: string; capacity: number | null; setName: string; event: { id: string; title: string; startDate: string }; members: Member[] };
+
+const ageOn = (dob: string | null, on: string) => {
+  if (!dob) return null;
+  const d = new Date(dob), e = new Date(on);
+  let age = e.getFullYear() - d.getFullYear();
+  if (e.getMonth() < d.getMonth() || (e.getMonth() === d.getMonth() && e.getDate() < d.getDate())) age -= 1;
+  return age;
+};
+
+/** Groups the signed-in staff member leads (rooms, small groups, buses) and who's in them. */
+export default function MyGroupsPage() {
+  const { token } = useAuth();
+  const router = useRouter();
+  const [data, setData] = useState<{ medicalShown: boolean; groups: MyGroup[] } | null>(null);
+  const [error, setError] = useState<string | null>(null);
+
+  useEffect(() => {
+    if (!token) return;
+    apiFetch<{ medicalShown: boolean; groups: MyGroup[] }>("/api/allocations/my-groups", { authToken: token })
+      .then(setData).catch(e => setError(e?.message || "Failed to load your groups"));
+  }, [token]);
+
+  return (
+    <div className="max-w-4xl mx-auto w-full p-6">
+      <div className="flex items-center gap-3 mb-4">
+        <div className="w-10 h-10 rounded-xl bg-brand-50 flex items-center justify-center shrink-0">
+          <Users className="w-5 h-5 text-brand-600" />
+        </div>
+        <div>
+          <button className="text-xs text-brand-600 hover:underline" onClick={() => router.push("/dashboard")}>← Back to dashboard</button>
+          <h1 className="text-2xl font-semibold text-gray-900 mt-0.5">My groups</h1>
+          <p className="text-sm text-gray-500">Rooms, small groups and buses you lead</p>
+        </div>
+      </div>
+      {error && <div className="mb-3 p-3 border rounded bg-red-50 text-red-800 text-sm">{error}</div>}
+      {data && data.groups.length === 0 && <p className="text-sm text-gray-600">You aren&apos;t leading any groups for upcoming events.</p>}
+      <div className="space-y-4">
+        {data?.groups.map(g => (
+          <section key={g.id} className="border rounded-xl p-4 bg-white shadow-sm">
+            <div className="flex flex-wrap items-baseline justify-between gap-2 mb-2">
+              <h2 className="font-semibold">{g.name} <span className="text-sm font-normal text-gray-500">· {g.setName}</span></h2>
+              <span className="text-xs text-gray-500">{g.event.title} · {formatDate(new Date(g.event.startDate))} · {g.members.length}{g.capacity ? ` / ${g.capacity}` : ""} people</span>
+            </div>
+            {g.members.length === 0 ? <p className="text-sm text-gray-500">Nobody has been placed in this group yet.</p> : (
+              <div className="overflow-x-auto">
+                <table className="w-full text-sm">
+                  <thead><tr className="text-left text-xs text-gray-500 border-b">
+                    <th className="py-1 pr-3">Name</th><th className="py-1 pr-3">Age</th><th className="py-1 pr-3">Contact</th>
+                    {data.medicalShown && <th className="py-1 pr-3">Medical</th>}
+                  </tr></thead>
+                  <tbody>
+                    {g.members.map(m => {
+                      const age = ageOn(m.dateOfBirth, g.event.startDate);
+                      return (
+                        <tr key={m.id} className="border-b last:border-0 align-top">
+                          <td className="py-1.5 pr-3 font-medium">{m.name}</td>
+                          <td className="py-1.5 pr-3">{age ?? "—"}</td>
+                          <td className="py-1.5 pr-3 text-xs">
+                            {m.phone && <div>{m.phone}</div>}
+                            {m.parentName ? <div>Parent: {m.parentName}{m.parentPhone ? ` · ${m.parentPhone}` : ""}</div> : m.bookedBy && <div>Booked by {m.bookedBy}{m.bookedByPhone ? ` · ${m.bookedByPhone}` : ""}</div>}
+                          </td>
+                          {data.medicalShown && (
+                            <td className="py-1.5 pr-3 text-xs">
+                              {m.medical ? Object.values(m.medical).filter(Boolean).join("; ") || "—" : "—"}
+                              {m.emergency && Object.values(m.emergency).some(Boolean) && <div className="text-gray-500">Emergency: {Object.values(m.emergency).filter(Boolean).join(", ")}</div>}
+                            </td>
+                          )}
+                        </tr>
+                      );
+                    })}
+                  </tbody>
+                </table>
+              </div>
+            )}
+          </section>
+        ))}
+      </div>
+      {data && !data.medicalShown && data.groups.length > 0 && <p className="text-xs text-gray-500 mt-3">Medical details are only shown to supervisors. Ask one if you need them.</p>}
+    </div>
+  );
+}
@@ -6,13 +6,14 @@ import { useRouter } from "next/navigation";
 import { apiFetch } from "@/lib/api";
 import { useStableState } from "@/hooks/useStableState";
 import { useVisiblePolling } from "@/hooks/useVisiblePolling";
-import { QrCode, Ticket, Activity, UserCheck, Clock } from "lucide-react";
+import { QrCode, Ticket, Activity, UserCheck, Clock, Users } from "lucide-react";
 import { StatCard, StatCardRow } from "@/components/shared/StatCard";
 import { QuickActionTile, QuickActionGrid } from "@/components/shared/QuickActionTile";

 const QUICK_ACTIONS = [
  { href: "/dashboard/staff/ticket-scanning", label: "Scan tickets", description: "Use your device camera to validate tickets", icon: QrCode },
  { href: "/dashboard/staff/event-tickets", label: "Event tickets & printing", description: "Browse event tickets and print lists", icon: Ticket },
+  { href: "/dashboard/staff/my-groups", label: "My groups", description: "Rooms and groups you lead", icon: Users },
 ] as const;

 export default function StaffDashboardPage() {
@@ -7,6 +7,9 @@ import { apiFetch } from "@/lib/api";
 import { useDismissingState } from "@/hooks/useDismissingState";
 import { useRouter } from "next/navigation";
 import { QrCode } from "lucide-react";
+import { useOfflineScanning } from "@/components/scanner/useOfflineScanning";
+import { OfflineScanPanel } from "@/components/scanner/OfflineScanPanel";
+import type { SnapshotTicket } from "@/lib/offlineScan";

 export default function TicketScanningPage() {
  const router = useRouter();
@@ -17,6 +20,7 @@ export default function TicketScanningPage() {
  const [alreadyUsedModal, setAlreadyUsedModal] = useState<{ message: string; ticket?: any } | null>(null);
  const [errorModal, setErrorModal] = useState<string | null>(null);
  const { token, user } = useAuth();
+  const offline = useOfflineScanning(token);
  const [recentScans, setRecentScans] = useState<any[]>([]);
  const [stats, setStats] = useState<any | null>(null);
  const [loadingStats, setLoadingStats] = useState<boolean>(false);
@@ -34,8 +38,12 @@ export default function TicketScanningPage() {
    qrCode: string;
    ticket: any;
    remaining: number;
+    offlineTicket?: SnapshotTicket; // scanned against the downloaded list (offline mode)
  } | null>(null);
  const [confirmQty, setConfirmQty] = useState(1);
+  // Youth events: the preview says whether parental consent allows check-in.
+  const consentBlocked = !!confirmModal && !['not_required', 'given', undefined].includes(confirmModal.ticket?.consentStatus);
+  const canOverrideConsent = user?.role === 'admin' || user?.role === 'supervisor';
  const [confirmQtyRaw, setConfirmQtyRaw] = useState("1");

  // Event selection state
@@ -93,6 +101,16 @@ export default function TicketScanningPage() {
    })();
  }, [selectedEventId, token]);

+  // In offline mode the event and section are fixed to the locked scope.
+  useEffect(() => {
+    if (!offline.lock) return;
+    setSelectedEventId(offline.lock.eventId);
+  }, [offline.lock]);
+  useEffect(() => {
+    if (!offline.lock) return;
+    setSelectedSectionId(offline.lock.sectionId || "all");
+  }, [offline.lock, sections]);
+
  // Bug fix: stop the scanner when the event or section filter changes so stale scan
  // context is never used. The user must press "Scan Ticket" again to resume.
  const isFirstFilterRender = useRef(true);
@@ -111,6 +129,32 @@ export default function TicketScanningPage() {
        return;
      }

+      // Offline mode: check the ticket against the list downloaded to this device.
+      if (offline.lock) {
+        const t = await offline.findTicket(text);
+        if (!t) { setErrorModal("Not found in the offline ticket list. Check at the door desk."); return; }
+        if (t.remaining <= 0) { setAlreadyUsedModal({ message: "Ticket has already been fully used", ticket: { id: t.id } }); return; }
+        if (!["not_required", "given"].includes(t.consentStatus)) {
+          setErrorModal(t.consentStatus === "declined" ? "Parental consent was declined — this ticket can't be checked in." : "Parental consent is missing or pending — this ticket can't be checked in offline. Check at the door desk.");
+          return;
+        }
+        setConfirmQty(t.remaining);
+        setConfirmQtyRaw(String(t.remaining));
+        setConfirmModal({
+          qrCode: text,
+          remaining: t.remaining,
+          offlineTicket: t,
+          ticket: {
+            id: t.id, quantity: t.quantity, consentStatus: t.consentStatus,
+            event: { title: offline.lock.eventTitle },
+            registrationOption: { eventOption: { name: t.option }, variant: t.variant ? { name: t.variant } : null },
+            attendee: t.bookedBy ? { name: t.holder } : null,
+            user: { name: t.bookedBy || t.holder },
+          },
+        });
+        return;
+      }
+
      // Always preview first to validate the ticket before showing confirm step
      // Uses the lightweight scan-preview endpoint (only fetches fields needed for the confirm modal)
      let preview: any;
@@ -165,11 +209,11 @@ export default function TicketScanningPage() {
    }
  }

-  async function commitScan() {
+  async function commitScan(overrideConsent = false) {
    if (!confirmModal || !token) return;

    // Capture everything before clearing modal state
-    const { qrCode, ticket, remaining } = confirmModal;
+    const { qrCode, ticket, remaining, offlineTicket } = confirmModal;
    const qty = confirmQty;
    const baseName = ticket?.registrationOption?.eventOption?.name || "Ticket";
    const variantName = ticket?.registrationOption?.variant?.name;
@@ -191,6 +235,17 @@ export default function TicketScanningPage() {
      total: ticket?.quantity || 1,
    });

+    // Offline mode: saved on this device, synced when there's a connection.
+    if (offlineTicket) {
+      try {
+        await offline.scanLocally(offlineTicket, qty);
+      } catch (e: any) {
+        setSuccessModal(null);
+        setErrorModal(e?.message || "Couldn't save the scan on this device");
+      }
+      return;
+    }
+
    // Background write — reverse the optimistic update on failure
    try {
      const url = `/api/tickets/scan/${encodeURIComponent(qrCode)}${
@@ -199,7 +254,12 @@ export default function TicketScanningPage() {
      await apiFetch<any>(url, {
        method: "POST",
        authToken: token,
-        body: { qty },
+        body: {
+          qty,
+          deviceId: offline.deviceId(),
+          ...(selectedSectionId && selectedSectionId !== "all" ? { sectionId: selectedSectionId } : {}),
+          ...(overrideConsent ? { overrideConsent: true } : {}),
+        },
      });
      refreshStatsAndRecent();
    } catch (e: any) {
@@ -267,8 +327,10 @@ export default function TicketScanningPage() {
              className="border rounded px-3 py-2 w-full sm:w-56 max-w-full"
              value={selectedEventId}
              onChange={(e) => setSelectedEventId(e.target.value)}
+              disabled={!!offline.lock}
            >
              <option value="all">All events</option>
+              {offline.lock && !events.some(ev => ev.id === offline.lock!.eventId) && <option value={offline.lock.eventId}>{offline.lock.eventTitle}</option>}
              {events.map((ev) => (
                <option key={ev.id} value={ev.id}>{ev.title}</option>
              ))}
@@ -286,6 +348,7 @@ export default function TicketScanningPage() {
                className="border rounded px-3 py-2 w-full sm:w-56 max-w-full"
                value={selectedSectionId}
                onChange={(e) => setSelectedSectionId(e.target.value)}
+                disabled={!!offline.lock}
              >
                <option value="all">All sections</option>
                {sections.map(section => (
@@ -296,6 +359,16 @@ export default function TicketScanningPage() {
            </div>
          )}

+          <OfflineScanPanel
+            offline={offline}
+            token={token}
+            eventId={selectedEventId}
+            eventTitle={events.find(ev => ev.id === selectedEventId)?.title || offline.lock?.eventTitle || ""}
+            sectionId={selectedSectionId !== "all" ? selectedSectionId : null}
+            sectionName={sections.find(s => s.id === selectedSectionId)?.name || null}
+            onError={setError}
+            onInfo={setScanInfo}
+          />
          <QRScanner
            ref={scannerRef}
            onResult={handleResult}
@@ -383,6 +456,17 @@ export default function TicketScanningPage() {
              <div><span className="font-medium">Remaining:</span> <span className={confirmModal.remaining < (confirmModal.ticket?.quantity || 1) ? 'text-amber-600 font-semibold' : 'text-green-700 font-semibold'}>{confirmModal.remaining}</span></div>
            </div>

+            {consentBlocked && (
+              <div className="mb-4 rounded-lg border border-red-200 bg-red-50 p-3 text-sm text-red-800">
+                <div className="font-semibold">
+                  {confirmModal.ticket?.consentStatus === 'declined' ? 'Parental consent was declined'
+                    : confirmModal.ticket?.consentStatus === 'pending' ? 'Parental consent is still pending'
+                    : 'Parental consent is missing'}
+                </div>
+                <div className="mt-1">This person can&apos;t be checked in until a parent or guardian gives consent.{canOverrideConsent ? ' As a supervisor you can override this — it is recorded in the audit log.' : ' Ask a supervisor.'}</div>
+              </div>
+            )}
+
            {(confirmModal.ticket?.quantity || 1) > 1 && (
              <div className="mb-4">
                <label className="block text-sm font-medium text-gray-700 mb-1">Qty to redeem (max {confirmModal.remaining})</label>
@@ -411,12 +495,23 @@ export default function TicketScanningPage() {
              >
                Cancel
              </button>
-              <button
-                onClick={commitScan}
-                className="flex-1 px-4 py-2 rounded-lg bg-brand-600 text-white text-sm font-semibold hover:bg-brand-700"
-              >
-                Confirm Scan
-              </button>
+              {consentBlocked ? (
+                canOverrideConsent && (
+                  <button
+                    onClick={() => commitScan(true)}
+                    className="flex-1 px-4 py-2 rounded-lg bg-red-600 text-white text-sm font-semibold hover:bg-red-700"
+                  >
+                    Override and check in
+                  </button>
+                )
+              ) : (
+                <button
+                  onClick={() => commitScan()}
+                  className="flex-1 px-4 py-2 rounded-lg bg-brand-600 text-white text-sm font-semibold hover:bg-brand-700"
+                >
+                  Confirm Scan
+                </button>
+              )}
            </div>
          </div>
        </div>
@@ -0,0 +1,314 @@
+"use client";
+
+import React, { useCallback, useEffect, useMemo, useState } from "react";
+import { useAuth } from "@/hooks/useAuth";
+import { useRouter } from "next/navigation";
+import { DndContext, DragEndEvent, PointerSensor, TouchSensor, useDraggable, useDroppable, useSensor, useSensors } from "@dnd-kit/core";
+import { apiFetch } from "@/lib/api";
+import { formatDate } from "@/lib/date";
+import { useDismissingState } from "@/hooks/useDismissingState";
+import { BedDouble, Plus, Wand2, Printer, Trash2, Pencil, Eraser } from "lucide-react";
+
+type Group = { id: string; name: string; capacity: number | null; gender: "male" | "female" | null; leaderUserId: string | null; leader?: { id: string; name: string } | null };
+type AllocSet = { id: string; name: string; showOnTicket: boolean; groups: Group[]; assignments: { attendeeId: string; groupId: string }[] };
+type Person = { id: string; name: string; gender: string | null; dateOfBirth: string | null; registrationId: string; bookedBy: string };
+type Board = { event: { id: string; title: string; startDate: string; collectGender: boolean; requiresParentalConsent: boolean }; sets: AllocSet[]; attendees: Person[]; leaders: { id: string; name: string }[]; unnamedPlaces: number };
+
+const UNASSIGNED = "unassigned";
+const esc = (s: unknown) => String(s ?? "").replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[c]!));
+const genderLabel = (g: string | null) => (g === "male" ? "Male" : g === "female" ? "Female" : "");
+const ageOn = (dob: string | null, on: string) => {
+  if (!dob) return null;
+  const d = new Date(dob), e = new Date(on);
+  let age = e.getFullYear() - d.getFullYear();
+  if (e.getMonth() < d.getMonth() || (e.getMonth() === d.getMonth() && e.getDate() < d.getDate())) age -= 1;
+  return age;
+};
+
+function PersonChip({ person, eventStart }: { person: Person; eventStart: string }) {
+  const { attributes, listeners, setNodeRef, transform, isDragging } = useDraggable({ id: person.id });
+  const age = ageOn(person.dateOfBirth, eventStart);
+  return (
+    <div
+      ref={setNodeRef}
+      {...listeners}
+      {...attributes}
+      style={transform ? { transform: `translate(${transform.x}px, ${transform.y}px)`, zIndex: 50 } : undefined}
+      className={`px-2 py-1.5 rounded-lg border bg-white text-sm cursor-grab active:cursor-grabbing select-none touch-none ${isDragging ? "shadow-lg ring-2 ring-brand-300" : "shadow-sm"}`}
+      title={person.bookedBy ? `Booked by ${person.bookedBy}` : undefined}
+    >
+      <span className="font-medium">{person.name}</span>
+      <span className="text-xs text-gray-500">
+        {[genderLabel(person.gender), age != null ? `${age}` : "", person.bookedBy ? `· ${person.bookedBy}` : ""].filter(Boolean).map(s => ` ${s}`).join("")}
+      </span>
+    </div>
+  );
+}
+
+function Column({ id, title, subtitle, full, children, actions }: { id: string; title: string; subtitle?: string; full?: boolean; children: React.ReactNode; actions?: React.ReactNode }) {
+  const { setNodeRef, isOver } = useDroppable({ id });
+  return (
+    <div ref={setNodeRef} className={`rounded-xl border p-3 min-h-[8rem] transition-colors ${isOver ? "bg-brand-50 border-brand-300" : full ? "bg-gray-50" : "bg-white"}`}>
+      <div className="flex items-start justify-between gap-2 mb-2">
+        <div>
+          <div className="font-semibold text-sm">{title}</div>
+          {subtitle && <div className={`text-xs ${full ? "text-amber-700" : "text-gray-500"}`}>{subtitle}</div>}
+        </div>
+        {actions}
+      </div>
+      <div className="space-y-1.5">{children}</div>
+    </div>
+  );
+}
+
+export default function AllocationsPage() {
+  const { user, loading, token } = useAuth();
+  const router = useRouter();
+  const canView = useMemo(() => user?.role === "admin" || user?.role === "supervisor", [user]);
+  useEffect(() => { if (!loading && !user) router.replace("/login"); }, [user, loading, router]);
+
+  const [events, setEvents] = useState<any[]>([]);
+  const [eventId, setEventId] = useState("");
+  const [board, setBoard] = useState<Board | null>(null);
+  const [setId, setSetId] = useState("");
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useDismissingState<string | null>(null);
+  const [info, setInfo] = useDismissingState<string | null>(null);
+  const [groupForm, setGroupForm] = useState<{ id?: string; name: string; capacity: string; gender: string; leaderUserId: string } | null>(null);
+  const [newSetName, setNewSetName] = useState("");
+  const sensors = useSensors(useSensor(PointerSensor, { activationConstraint: { distance: 5 } }), useSensor(TouchSensor, { activationConstraint: { delay: 150, tolerance: 5 } }));
+
+  useEffect(() => {
+    if (!token || !canView) return;
+    apiFetch<any[]>("/api/events/all?includePast=true", { authToken: token })
+      .then(evs => {
+        const upcoming = (evs || []).filter(e => new Date(e.endDate).getTime() > Date.now() - 7 * 864e5)
+          .sort((a, b) => new Date(a.startDate).getTime() - new Date(b.startDate).getTime());
+        setEvents(upcoming);
+        if (upcoming.length) setEventId(id => id || upcoming[0].id);
+      })
+      .catch(e => setError(e?.message || "Failed to load events"));
+  }, [token, canView, setError]);
+
+  const load = useCallback(async () => {
+    if (!token || !eventId) return;
+    try {
+      const b = await apiFetch<Board>(`/api/allocations/event/${encodeURIComponent(eventId)}`, { authToken: token });
+      setBoard(b);
+      setSetId(id => (b.sets.some(s => s.id === id) ? id : b.sets[0]?.id || ""));
+    } catch (e: any) {
+      setError(e?.message || "Failed to load allocations");
+    }
+  }, [token, eventId, setError]);
+  useEffect(() => { load(); }, [load]);
+
+  const current = board?.sets.find(s => s.id === setId) || null;
+  const groupOf = useMemo(() => new Map((current?.assignments || []).map(a => [a.attendeeId, a.groupId])), [current]);
+  const membersOf = (groupId: string) => (board?.attendees || []).filter(p => groupOf.get(p.id) === groupId);
+  const unassigned = (board?.attendees || []).filter(p => !groupOf.has(p.id));
+
+  const call = async <T,>(path: string, method: string, body?: unknown): Promise<T> =>
+    apiFetch<T>(path, { method, authToken: token!, ...(body !== undefined ? { body } : {}) });
+
+  const onDragEnd = async (e: DragEndEvent) => {
+    if (!current || !e.over) return;
+    const attendeeId = String(e.active.id);
+    const target = String(e.over.id);
+    const groupId = target === UNASSIGNED ? null : target;
+    if ((groupOf.get(attendeeId) || null) === groupId) return;
+    // Optimistic move; reload on failure.
+    setBoard(b => b && ({
+      ...b,
+      sets: b.sets.map(s => s.id !== current.id ? s : {
+        ...s,
+        assignments: [...s.assignments.filter(a => a.attendeeId !== attendeeId), ...(groupId ? [{ attendeeId, groupId }] : [])],
+      }),
+    }));
+    try {
+      await call(`/api/allocations/sets/${current.id}/assignments`, "PUT", { attendeeId, groupId });
+    } catch (err: any) {
+      setError(err?.message || "Couldn't move them");
+      load();
+    }
+  };
+
+  const run = async (fn: () => Promise<string | void>) => {
+    setBusy(true);
+    try {
+      const msg = await fn();
+      if (msg) setInfo(msg);
+      await load();
+    } catch (e: any) {
+      setError(e?.message || "Something went wrong");
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  const addSet = () => run(async () => {
+    const s = await call<{ id: string }>("/api/allocations/sets", "POST", { eventId, name: newSetName || "Rooms" });
+    setNewSetName("");
+    setSetId(s.id);
+  });
+  const saveGroup = () => groupForm && current && run(async () => {
+    const body = { name: groupForm.name, capacity: groupForm.capacity || null, gender: groupForm.gender || null, leaderUserId: groupForm.leaderUserId || null };
+    if (groupForm.id) await call(`/api/allocations/groups/${groupForm.id}`, "PUT", body);
+    else await call(`/api/allocations/sets/${current.id}/groups`, "POST", body);
+    setGroupForm(null);
+  });
+
+  const printLists = async (master: boolean, medical: boolean) => {
+    if (!current || !board) return;
+    try {
+      const data = await apiFetch<any>(`/api/allocations/sets/${current.id}/lists${medical ? "?medical=true" : ""}`, { authToken: token! });
+      const w = window.open("", "_blank");
+      if (!w) return;
+      const row = (m: any) => `<tr><td>${esc(m.name)}</td><td>${esc(genderLabel(m.gender))}</td><td>${esc(ageOn(m.dateOfBirth, board.event.startDate) ?? "")}</td>`
+        + `<td>${esc(m.phone || m.parentPhone || m.bookedByPhone || "")}</td><td>${esc(m.parentName || m.bookedBy || "")}</td>`
+        + (medical ? `<td>${esc(m.medical ? Object.values(m.medical).filter(Boolean).join("; ") : "")}</td><td>${esc(m.emergency ? Object.values(m.emergency).filter(Boolean).join(", ") : "")}</td>` : "") + `</tr>`;
+      const head = `<tr><th>Name</th><th>Gender</th><th>Age</th><th>Phone</th><th>Parent / booked by</th>${medical ? "<th>Medical</th><th>Emergency contact</th>" : ""}</tr>`;
+      let body = "";
+      if (master) {
+        const all = data.groups.flatMap((g: any) => g.members.map((m: any) => ({ ...m, group: g.name }))).sort((a: any, b: any) => a.name.localeCompare(b.name));
+        body = `<h1>${esc(data.event.title)} — ${esc(data.set.name)} (master list)</h1><table><tr><th>${esc(data.set.name)}</th>${head.slice(4)}${all.map((m: any) => row(m).replace("<tr>", `<tr><td>${esc(m.group)}</td>`)).join("")}</table>`;
+      } else {
+        body = data.groups.map((g: any) => `<section><h1>${esc(data.event.title)} — ${esc(g.name)}</h1>`
+          + `<p>${esc(data.set.name)}${g.leader ? ` · Leader: ${esc(g.leader)}` : ""} · ${g.members.length}${g.capacity ? ` / ${g.capacity}` : ""} people</p>`
+          + `<table>${head}${g.members.map(row).join("")}</table></section>`).join("");
+      }
+      w.document.write(`<!doctype html><html><head><title>${esc(data.set.name)}</title><style>
+        body{font-family:Arial,sans-serif;font-size:11pt;margin:12mm} h1{font-size:15pt;margin:0 0 2mm} p{margin:0 0 3mm;color:#555}
+        table{border-collapse:collapse;width:100%;margin-bottom:6mm} th,td{border:1px solid #bbb;padding:3px 6px;text-align:left;vertical-align:top} th{background:#f1f1f1}
+        section{page-break-after:always} section:last-child{page-break-after:auto}
+      </style></head><body>${body}<script>window.onload=function(){window.print()}</script></body></html>`);
+      w.document.close();
+    } catch (e: any) {
+      setError(e?.message || "Couldn't load the lists");
+    }
+  };
+
+  return (
+    <div className="max-w-7xl mx-auto w-full p-6">
+      <div className="flex items-center gap-3 mb-4">
+        <div className="w-10 h-10 rounded-xl bg-brand-50 flex items-center justify-center shrink-0">
+          <BedDouble className="w-5 h-5 text-brand-600" />
+        </div>
+        <div>
+          <button className="text-xs text-brand-600 hover:underline" onClick={() => router.push("/dashboard")}>← Back to dashboard</button>
+          <h1 className="text-2xl font-semibold text-gray-900 mt-0.5">Rooms &amp; groups</h1>
+          <p className="text-sm text-gray-500">Put attendees into rooms, small groups, teams or buses</p>
+        </div>
+      </div>
+
+      {!canView && <div className="p-3 border rounded bg-yellow-50 text-yellow-800 text-sm mb-4">You need supervisor access to manage allocations.</div>}
+      {error && <div className="mb-3 p-3 border rounded bg-red-50 text-red-800 text-sm">{error}</div>}
+      {info && <div className="mb-3 p-3 border rounded bg-green-50 text-green-800 text-sm">{info}</div>}
+
+      {canView && (
+        <div className="space-y-4">
+          <div className="flex flex-wrap items-end gap-3">
+            <div>
+              <label className="block text-xs text-gray-600 mb-1">Event</label>
+              <select className="border rounded-lg px-3 py-2 text-sm min-w-[16rem]" value={eventId} onChange={e => { setEventId(e.target.value); setSetId(""); }}>
+                {events.map(ev => <option key={ev.id} value={ev.id}>{ev.title} ({formatDate(new Date(ev.startDate))})</option>)}
+              </select>
+            </div>
+            {board && (
+              <div className="flex flex-wrap items-center gap-1">
+                {board.sets.map(s => (
+                  <button key={s.id} onClick={() => setSetId(s.id)} className={`px-3 py-1.5 text-sm rounded-lg border ${s.id === setId ? "bg-brand-600 text-white border-brand-600" : "bg-white hover:bg-gray-50"}`}>{s.name}</button>
+                ))}
+                <input className="border rounded-lg px-2 py-1.5 text-sm w-36" placeholder="New set, e.g. Buses" value={newSetName} onChange={e => setNewSetName(e.target.value)} onKeyDown={e => { if (e.key === "Enter") addSet(); }} />
+                <button onClick={addSet} disabled={busy} className="inline-flex items-center gap-1 px-2.5 py-1.5 text-sm rounded-lg border hover:bg-gray-50"><Plus className="w-4 h-4" /> Add set</button>
+              </div>
+            )}
+          </div>
+
+          {board && board.attendees.length === 0 && (
+            <div className="p-3 border rounded bg-amber-50 text-amber-900 text-sm">
+              No named attendees yet. Allocation works per person, so it needs names — turn on &quot;Named attendees&quot; for the event{board.event.collectGender ? "" : " (and \"Ask each person's gender\" if rooms are split by gender)"}.
+            </div>
+          )}
+          {board && board.unnamedPlaces > 0 && (
+            <p className="text-xs text-gray-500">{board.unnamedPlaces} place(s) have no name yet, so they can&apos;t be placed until the person booking adds names.</p>
+          )}
+
+          {current && board && (
+            <>
+              <div className="flex flex-wrap items-center gap-2 border rounded-xl p-3 bg-white">
+                <label className="flex items-center gap-2 text-sm cursor-pointer">
+                  <input type="checkbox" checked={current.showOnTicket} onChange={e => run(async () => { await call(`/api/allocations/sets/${current.id}`, "PUT", { showOnTicket: e.target.checked }); })} />
+                  Show {current.name.toLowerCase()} on tickets and in My Events
+                </label>
+                <div className="ml-auto flex flex-wrap gap-2">
+                  <button disabled={busy} onClick={() => run(async () => (await call<{ message: string }>(`/api/allocations/sets/${current.id}/auto`, "POST", { mode: "together" })).message)} className="inline-flex items-center gap-1 px-2.5 py-1.5 text-sm rounded-lg bg-brand-600 text-white hover:bg-brand-700 disabled:opacity-50" title="Fill groups evenly, keeping people on the same booking (e.g. siblings) together where possible"><Wand2 className="w-4 h-4" /> Auto-allocate (keep bookings together)</button>
+                  <button disabled={busy} onClick={() => run(async () => (await call<{ message: string }>(`/api/allocations/sets/${current.id}/auto`, "POST", { mode: "split" })).message)} className="inline-flex items-center gap-1 px-2.5 py-1.5 text-sm rounded-lg border hover:bg-gray-50 disabled:opacity-50" title="Fill groups evenly, spreading people on the same booking across groups">Auto-allocate (split bookings)</button>
+                  <button onClick={() => printLists(false, false)} className="inline-flex items-center gap-1 px-2.5 py-1.5 text-sm rounded-lg border hover:bg-gray-50"><Printer className="w-4 h-4" /> Group lists</button>
+                  <button onClick={() => printLists(true, false)} className="inline-flex items-center gap-1 px-2.5 py-1.5 text-sm rounded-lg border hover:bg-gray-50"><Printer className="w-4 h-4" /> Master list</button>
+                  {board.event.requiresParentalConsent && (
+                    <button onClick={() => printLists(false, true)} className="inline-flex items-center gap-1 px-2.5 py-1.5 text-sm rounded-lg border hover:bg-gray-50" title="Includes medical details from consent forms. Viewing is recorded in the audit log."><Printer className="w-4 h-4" /> Lists with medical info</button>
+                  )}
+                  <button disabled={busy} onClick={() => run(async () => (await call<{ message: string }>(`/api/allocations/sets/${current.id}/assignments`, "DELETE")).message)} className="inline-flex items-center gap-1 px-2.5 py-1.5 text-sm rounded-lg border hover:bg-gray-50 disabled:opacity-50"><Eraser className="w-4 h-4" /> Clear</button>
+                  <button disabled={busy} onClick={() => run(async () => { await call(`/api/allocations/sets/${current.id}`, "DELETE"); setSetId(""); return `Deleted ${current.name}.`; })} className="inline-flex items-center gap-1 px-2.5 py-1.5 text-sm rounded-lg border text-red-700 hover:bg-red-50 disabled:opacity-50"><Trash2 className="w-4 h-4" /> Delete set</button>
+                </div>
+              </div>
+
+              {groupForm ? (
+                <div className="border rounded-xl p-3 bg-white flex flex-wrap items-end gap-2">
+                  <div><label className="block text-xs text-gray-600 mb-1">Name</label><input className="border rounded-lg px-2 py-1.5 text-sm" value={groupForm.name} onChange={e => setGroupForm({ ...groupForm, name: e.target.value })} placeholder="Cabin 1" autoFocus /></div>
+                  <div><label className="block text-xs text-gray-600 mb-1">Capacity</label><input type="number" min="1" className="border rounded-lg px-2 py-1.5 text-sm w-24" value={groupForm.capacity} onChange={e => setGroupForm({ ...groupForm, capacity: e.target.value })} placeholder="No limit" /></div>
+                  <div><label className="block text-xs text-gray-600 mb-1">Gender</label>
+                    <select className="border rounded-lg px-2 py-1.5 text-sm" value={groupForm.gender} onChange={e => setGroupForm({ ...groupForm, gender: e.target.value })}>
+                      <option value="">Anyone</option><option value="male">Males only</option><option value="female">Females only</option>
+                    </select>
+                  </div>
+                  <div><label className="block text-xs text-gray-600 mb-1">Leader</label>
+                    <select className="border rounded-lg px-2 py-1.5 text-sm" value={groupForm.leaderUserId} onChange={e => setGroupForm({ ...groupForm, leaderUserId: e.target.value })}>
+                      <option value="">None</option>
+                      {board.leaders.map(l => <option key={l.id} value={l.id}>{l.name}</option>)}
+                    </select>
+                  </div>
+                  <button disabled={busy || !groupForm.name.trim()} onClick={saveGroup} className="px-3 py-1.5 text-sm rounded-lg bg-brand-600 text-white disabled:opacity-50">{groupForm.id ? "Save" : "Add group"}</button>
+                  <button onClick={() => setGroupForm(null)} className="px-3 py-1.5 text-sm rounded-lg bg-gray-100">Cancel</button>
+                </div>
+              ) : (
+                <button onClick={() => setGroupForm({ name: "", capacity: "", gender: "", leaderUserId: "" })} className="inline-flex items-center gap-1 px-2.5 py-1.5 text-sm rounded-lg border hover:bg-gray-50"><Plus className="w-4 h-4" /> Add a group to {current.name}</button>
+              )}
+
+              <DndContext sensors={sensors} onDragEnd={onDragEnd}>
+                <div className="grid grid-cols-1 md:grid-cols-[minmax(14rem,1fr)_3fr] gap-4 items-start">
+                  <div className="md:sticky md:top-4">
+                    <Column id={UNASSIGNED} title="Not placed yet" subtitle={`${unassigned.length} people · drag them into a group`}>
+                      {unassigned.map(p => <PersonChip key={p.id} person={p} eventStart={board.event.startDate} />)}
+                    </Column>
+                  </div>
+                  <div className="grid grid-cols-1 sm:grid-cols-2 xl:grid-cols-3 gap-3">
+                    {current.groups.length === 0 && <p className="text-sm text-gray-500">Add groups (rooms, cabins, buses…) to start placing people.</p>}
+                    {current.groups.map(g => {
+                      const members = membersOf(g.id);
+                      const full = g.capacity != null && members.length >= g.capacity;
+                      const subtitle = [`${members.length}${g.capacity ? ` / ${g.capacity}` : ""}${full ? " · full" : ""}`, g.gender ? (g.gender === "male" ? "males" : "females") : "", g.leader ? `leader ${g.leader.name}` : ""].filter(Boolean).join(" · ");
+                      return (
+                        <Column key={g.id} id={g.id} title={g.name} subtitle={subtitle} full={full} actions={
+                          <div className="flex gap-1 shrink-0">
+                            <button aria-label={`Edit ${g.name}`} onClick={() => setGroupForm({ id: g.id, name: g.name, capacity: g.capacity ? String(g.capacity) : "", gender: g.gender || "", leaderUserId: g.leaderUserId || "" })} className="p-1 rounded hover:bg-gray-100"><Pencil className="w-3.5 h-3.5" /></button>
+                            <button aria-label={`Delete ${g.name}`} onClick={() => run(async () => { await call(`/api/allocations/groups/${g.id}`, "DELETE"); return `${g.name} deleted; its people are back in "Not placed yet".`; })} className="p-1 rounded hover:bg-red-50 text-red-700"><Trash2 className="w-3.5 h-3.5" /></button>
+                          </div>
+                        }>
+                          {members.map(p => <PersonChip key={p.id} person={p} eventStart={board.event.startDate} />)}
+                        </Column>
+                      );
+                    })}
+                  </div>
+                </div>
+              </DndContext>
+            </>
+          )}
+          {board && board.sets.length === 0 && board.attendees.length > 0 && (
+            <p className="text-sm text-gray-600">Start by adding a set, e.g. &quot;Rooms&quot;, &quot;Small groups&quot; or &quot;Buses&quot;. An event can have several.</p>
+          )}
+        </div>
+      )}
+    </div>
+  );
+}
@@ -7,7 +7,8 @@ import { apiFetch } from "@/lib/api";
 import { scoreUser } from "@/lib/fuzzyMatch";
 import { useDismissingState } from "@/hooks/useDismissingState";
 import { CouponCodeField, AppliedCoupon } from "@/components/shared/CouponCodeField";
-import { AttendeeNamesEditor, AttendeeEntries, TicketDelivery, attendeesPayload } from "@/components/shared/AttendeeNamesEditor";
+import { TransferTicketModal, canOfferTransfer } from "@/components/shared/TransferTicketModal";
+import { AttendeeNamesEditor, AttendeeEntries, TicketDelivery, attendeesPayload, consentDetailsMissing } from "@/components/shared/AttendeeNamesEditor";
 import { DoorOpen, UserPlus, CreditCard, CheckSquare, Ticket, RotateCcw, type LucideIcon } from "lucide-react";

 type Mode = "registration" | "payment" | "checkin" | "tickets" | "refund";
@@ -104,6 +105,8 @@ export default function AtTheDoorPage() {
    const [pendingUser, setPendingUser] = useState<any | null>(null);
    const [doorCoupon, setDoorCoupon] = useState<AppliedCoupon | null>(null);
    const [doorAllowsNames, setDoorAllowsNames] = useState(false);
+    const [doorYouthStart, setDoorYouthStart] = useState<string | null>(null);
+    const [doorCollectGender, setDoorCollectGender] = useState(false);
    const [doorNaming, setDoorNaming] = useState(false);
    const [doorEntries, setDoorEntries] = useState<AttendeeEntries>({});
    const [doorDelivery, setDoorDelivery] = useState<TicketDelivery>("payer");
@@ -160,7 +163,9 @@ export default function AtTheDoorPage() {
                });

                setEventOptions(ev.options || ev.eventOptions || []);
-                setDoorAllowsNames(!!ev.allowNamedAttendees);
+                setDoorAllowsNames(!!ev.allowNamedAttendees || !!ev.requiresParentalConsent);
+                setDoorYouthStart(ev.requiresParentalConsent ? ev.startDate : null);
+                setDoorCollectGender(!!ev.collectGender);
            } catch {
                setEventOptions([]);
            }
@@ -230,6 +235,11 @@ export default function AtTheDoorPage() {
            }
        }

+        if (!pendingEditReg && doorYouthStart) {
+            const missing = consentDetailsMissing(eventOptions, (o, v) => quantities[v ? `${o}::${v}` : o] || 0, doorEntries, doorYouthStart);
+            if (missing) { setError(missing); return; }
+        }
+
        setConfirming(true);
        try {
            if (pendingEditReg) {
@@ -272,7 +282,7 @@ export default function AtTheDoorPage() {
                        options: opts,
                        notificationPreference: pendingUser.notifPref,
                        ...(doorCoupon ? { couponCode: doorCoupon.code } : {}),
-                        ...(doorAllowsNames && doorNaming && attendeesPayload(eventOptions, (o, v) => quantities[v ? `${o}::${v}` : o] || 0, doorEntries).length > 0
+                        ...(doorAllowsNames && (doorNaming || doorYouthStart) && attendeesPayload(eventOptions, (o, v) => quantities[v ? `${o}::${v}` : o] || 0, doorEntries).length > 0
                            ? { attendees: attendeesPayload(eventOptions, (o, v) => quantities[v ? `${o}::${v}` : o] || 0, doorEntries), ticketDelivery: doorDelivery }
                            : {}),
                    }
@@ -505,6 +515,8 @@ export default function AtTheDoorPage() {
                    enabled: doorNaming, onEnabledChange: setDoorNaming,
                    entries: doorEntries, onEntriesChange: setDoorEntries,
                    delivery: doorDelivery, onDeliveryChange: setDoorDelivery,
+                    consentEventStart: doorYouthStart || undefined,
+                    collectGender: doorCollectGender,
                } : null}
            />
            <DonationModal
@@ -861,6 +873,8 @@ function DoorTicketsPanel({ token, eventId }: any) {
    const [allTickets, setAllTickets] = useState<any[]>([]);
    const [loading, setLoading] = useState(false);
    const [sendTarget, setSendTarget] = useState<any | null>(null);
+    const [transferTarget, setTransferTarget] = useState<any | null>(null);
+    const [notice, setNotice] = useState<string | null>(null);

    // Load all tickets for the event once
    useEffect(() => {
@@ -992,6 +1006,7 @@ function DoorTicketsPanel({ token, eventId }: any) {
                </div>
            )}

+            {notice && <div className="mt-2 p-2 rounded bg-green-50 text-green-800 text-sm">{notice}</div>}
            <div className="mt-3 space-y-2 max-h-96 overflow-auto">
                {tickets.map(t => (
                    <div
@@ -1000,8 +1015,11 @@ function DoorTicketsPanel({ token, eventId }: any) {
                    >
                        <div className="text-sm">
                            <div className="font-medium">
-                                {t.user?.name || "Guest"}
+                                {t.attendee?.name || t.user?.name || "Guest"}
                            </div>
+                            {t.attendee?.name && t.user?.name && t.attendee.name !== t.user.name && (
+                                <div className="text-xs text-gray-500">Booked by {t.user.name}</div>
+                            )}
                            <div className="text-xs text-gray-500">
                                {ticketLabel(t)}
                            </div>
@@ -1020,6 +1038,14 @@ function DoorTicketsPanel({ token, eventId }: any) {
                            >
                                Send
                            </button>
+                            {canOfferTransfer(t, t.event, true) && (
+                                <button
+                                    onClick={() => setTransferTarget(t)}
+                                    className="px-3 py-1 text-xs rounded border hover:bg-gray-50"
+                                >
+                                    Transfer
+                                </button>
+                            )}
                        </div>
                    </div>
                ))}
@@ -1031,6 +1057,15 @@ function DoorTicketsPanel({ token, eventId }: any) {
                )}
            </div>

+            {transferTarget && (
+                <TransferTicketModal
+                    ticket={transferTarget}
+                    event={transferTarget.event}
+                    token={token}
+                    onClose={() => setTransferTarget(null)}
+                    onDone={(msg) => { setTransferTarget(null); setNotice(msg); load(); }}
+                />
+            )}
            {sendTarget && (
                <SendTicketsModal
                    open={true}
@@ -0,0 +1,251 @@
+"use client";
+
+import React, { useCallback, useEffect, useMemo, useState } from "react";
+import { useAuth } from "@/hooks/useAuth";
+import { useRouter, useSearchParams } from "next/navigation";
+import { apiFetch } from "@/lib/api";
+import { formatDate } from "@/lib/date";
+import { useDismissingState } from "@/hooks/useDismissingState";
+import { ShieldCheck, Send, RefreshCw, HeartPulse, Printer } from "lucide-react";
+import { Table, TableHeader, TableBody, TableRow, TableHead, TableCell } from "@/components/ui/table";
+
+type ConsentRow = {
+  attendeeId: string;
+  name: string;
+  dateOfBirth: string | null;
+  minor: boolean;
+  parentName: string | null;
+  parentEmail: string | null;
+  parentPhone: string | null;
+  registrationStatus: string;
+  bookedBy: { name: string; email: string };
+  status: "not_required" | "missing" | "pending" | "given" | "declined";
+  request: { id: string; status: string; textVersion: number; signedName: string | null; respondedAt: string | null; lastSentAt: string; remindersSent: number; photoConsent: boolean | null; outdated: boolean } | null;
+};
+type MedicalRow = {
+  name: string; dateOfBirth: string | null; parentName: string | null; parentPhone: string | null; parentEmail: string | null;
+  medical: { allergies: string; medication: string; conditions: string; medicalAid: string } | null;
+  emergency: { name: string; phone: string; relationship: string } | null;
+  photoConsent: boolean | null; purged: boolean;
+};
+
+const STATUS_STYLE: Record<ConsentRow["status"], { label: string; cls: string }> = {
+  not_required: { label: "Not needed (18+)", cls: "bg-gray-100 text-gray-600" },
+  missing: { label: "No request", cls: "bg-red-100 text-red-800" },
+  pending: { label: "Pending", cls: "bg-amber-100 text-amber-800" },
+  given: { label: "Given", cls: "bg-green-100 text-green-800" },
+  declined: { label: "Declined", cls: "bg-red-100 text-red-800" },
+};
+
+const esc = (s: unknown) => String(s ?? "").replace(/[&<>"]/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" }[c] as string));
+
+export default function ConsentTrackerPage() {
+  const { user, loading, token } = useAuth();
+  const router = useRouter();
+  const search = useSearchParams();
+  const canView = useMemo(() => ["admin", "supervisor", "staff"].includes(user?.role || ""), [user]);
+  const isSupervisor = user?.role === "admin" || user?.role === "supervisor";
+
+  useEffect(() => {
+    if (loading) return;
+    if (!user) router.replace("/login");
+  }, [user, loading, router]);
+
+  const [events, setEvents] = useState<any[]>([]);
+  const [eventId, setEventId] = useState<string>(search.get("eventId") || "");
+  const [data, setData] = useState<{ event: any; counts: Record<string, number>; rows: ConsentRow[] } | null>(null);
+  const [filter, setFilter] = useState<"minors" | "all" | "waiting">("minors");
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useDismissingState<string | null>(null);
+  const [info, setInfo] = useDismissingState<string | null>(null);
+
+  useEffect(() => {
+    if (!token || !canView) return;
+    apiFetch<any[]>("/api/events/all?includePast=true", { authToken: token })
+      .then(evs => {
+        const youth = (evs || []).filter(e => e.requiresParentalConsent);
+        setEvents(youth);
+        if (!eventId && youth.length) setEventId(youth[youth.length - 1].id);
+      })
+      .catch(e => setError(e?.message || "Failed to load events"));
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [token, canView]);
+
+  const load = useCallback(async () => {
+    if (!token || !eventId) return;
+    setBusy(true);
+    try {
+      setData(await apiFetch(`/api/consent/events/${encodeURIComponent(eventId)}`, { authToken: token }));
+    } catch (e: any) {
+      setError(e?.message || "Failed to load consent status");
+    } finally {
+      setBusy(false);
+    }
+  }, [token, eventId, setError]);
+
+  useEffect(() => { load(); }, [load]);
+
+  const rows = useMemo(() => {
+    const all = data?.rows || [];
+    if (filter === "all") return all;
+    if (filter === "waiting") return all.filter(r => ["missing", "pending", "declined"].includes(r.status) || r.request?.outdated);
+    return all.filter(r => r.minor);
+  }, [data, filter]);
+
+  const outdatedCount = (data?.rows || []).filter(r => r.request?.outdated || (r.minor && r.status === "missing")).length;
+
+  const act = async (fn: () => Promise<{ message: string }>) => {
+    setBusy(true);
+    try {
+      const res = await fn();
+      setInfo(res.message);
+      await load();
+    } catch (e: any) {
+      setError(e?.message || "Something went wrong");
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  const resendOne = (r: ConsentRow) => act(() => apiFetch(`/api/consent/requests/${r.request!.id}/resend`, { method: "POST", authToken: token! }));
+  const resendAll = () => act(() => apiFetch(`/api/consent/events/${eventId}/resend-pending`, { method: "POST", authToken: token! }));
+  const rerequest = () => act(() => apiFetch(`/api/consent/events/${eventId}/rerequest`, { method: "POST", authToken: token! }));
+
+  // Printable list for camp leaders. Opening it is recorded in the audit log.
+  const printMedical = async () => {
+    try {
+      const res = await apiFetch<{ event: any; rows: MedicalRow[] }>(`/api/consent/events/${eventId}/medical`, { authToken: token! });
+      const w = window.open("", "_blank");
+      if (!w) { setError("Allow pop-ups to print the medical list."); return; }
+      const rowsHtml = res.rows.map(r => `
+        <tr>
+          <td><strong>${esc(r.name)}</strong><br/><small>${r.dateOfBirth ? esc(formatDate(new Date(r.dateOfBirth))) : ""}</small></td>
+          <td>${r.purged ? "<em>Deleted after the event</em>" : `
+            ${r.medical?.allergies ? `<div><b>Allergies:</b> ${esc(r.medical.allergies)}</div>` : ""}
+            ${r.medical?.medication ? `<div><b>Medication:</b> ${esc(r.medical.medication)}</div>` : ""}
+            ${r.medical?.conditions ? `<div><b>Conditions:</b> ${esc(r.medical.conditions)}</div>` : ""}
+            ${r.medical?.medicalAid ? `<div><b>Medical aid:</b> ${esc(r.medical.medicalAid)}</div>` : ""}`}</td>
+          <td>${r.emergency ? `${esc(r.emergency.name)}${r.emergency.relationship ? ` (${esc(r.emergency.relationship)})` : ""}<br/>${esc(r.emergency.phone)}` : ""}</td>
+          <td>${esc(r.parentName)}<br/>${esc(r.parentPhone)}</td>
+          <td>${r.photoConsent === null ? "" : r.photoConsent ? "Yes" : "No"}</td>
+        </tr>`).join("");
+      w.document.write(`<!doctype html><html><head><meta charset="utf-8"/><title>Medical &amp; emergency list — ${esc(res.event.title)}</title>
+        <style>body{font-family:system-ui,sans-serif;margin:24px;font-size:12px}h1{font-size:18px;margin:0 0 4px}p{color:#555;margin:0 0 12px}
+        table{width:100%;border-collapse:collapse}th,td{border:1px solid #ccc;padding:6px;vertical-align:top;text-align:left}th{background:#f3f4f6}
+        .conf{color:#b91c1c;font-weight:600}</style></head><body>
+        <h1>Medical &amp; emergency list — ${esc(res.event.title)}</h1>
+        <p class="conf">Confidential — for event leaders only. Do not leave unattended; destroy after the event.</p>
+        <table><thead><tr><th>Attendee</th><th>Medical</th><th>Emergency contact</th><th>Parent / guardian</th><th>Photos</th></tr></thead>
+        <tbody>${rowsHtml || '<tr><td colspan="5">No consent given yet.</td></tr>'}</tbody></table>
+        <script>window.onload=()=>window.print()</script></body></html>`);
+      w.document.close();
+    } catch (e: any) {
+      setError(e?.message || "Failed to load the medical list");
+    }
+  };
+
+  return (
+    <div className="max-w-6xl mx-auto w-full p-6">
+      <div className="flex items-center gap-3 mb-4">
+        <div className="w-10 h-10 rounded-xl bg-brand-50 flex items-center justify-center shrink-0">
+          <ShieldCheck className="w-5 h-5 text-brand-600" />
+        </div>
+        <div>
+          <button className="text-xs text-brand-600 hover:underline" onClick={() => router.push("/dashboard")}>← Back to dashboard</button>
+          <h1 className="text-2xl font-semibold text-gray-900 mt-0.5">Parental consent</h1>
+          <p className="text-sm text-gray-500">Youth events: who still needs a parent&apos;s consent before check-in</p>
+        </div>
+      </div>
+
+      {!canView && <div className="p-3 border rounded bg-yellow-50 text-yellow-800 text-sm mb-4">You need staff access to view consent status.</div>}
+      {error && <div className="mb-3 p-3 border rounded bg-red-50 text-red-800 text-sm">{error}</div>}
+      {info && <div className="mb-3 p-3 border rounded bg-green-50 text-green-800 text-sm">{info}</div>}
+
+      {canView && (
+        <div className="border rounded-xl p-4 bg-white shadow-sm">
+          <div className="flex flex-wrap items-end gap-3 mb-4">
+            <div>
+              <label className="block text-xs text-gray-600 mb-1">Youth event</label>
+              <select className="border rounded-lg px-3 py-2 text-sm min-w-[16rem]" value={eventId} onChange={e => setEventId(e.target.value)}>
+                {events.length === 0 && <option value="">No youth events</option>}
+                {events.map(ev => <option key={ev.id} value={ev.id}>{ev.title} ({formatDate(new Date(ev.startDate))})</option>)}
+              </select>
+            </div>
+            <div>
+              <label className="block text-xs text-gray-600 mb-1">Show</label>
+              <select className="border rounded-lg px-3 py-2 text-sm" value={filter} onChange={e => setFilter(e.target.value as typeof filter)}>
+                <option value="minors">Under 18s</option>
+                <option value="waiting">Still to sort out</option>
+                <option value="all">Everyone</option>
+              </select>
+            </div>
+            {isSupervisor && eventId && (
+              <div className="flex flex-wrap gap-2 ml-auto">
+                <button onClick={resendAll} disabled={busy || !(data?.counts?.pending)} className="inline-flex items-center gap-1.5 px-3 py-2 rounded-lg border text-sm hover:bg-gray-50 disabled:opacity-50"><Send className="w-4 h-4" /> Resend to all pending</button>
+                <button onClick={rerequest} disabled={busy || outdatedCount === 0} title="For consent given on an older version of the text, or under 18s who never got a request" className="inline-flex items-center gap-1.5 px-3 py-2 rounded-lg border text-sm hover:bg-gray-50 disabled:opacity-50"><RefreshCw className="w-4 h-4" /> Re-request consent ({outdatedCount})</button>
+                <button onClick={printMedical} disabled={busy} className="inline-flex items-center gap-1.5 px-3 py-2 rounded-lg bg-brand-600 text-white text-sm hover:bg-brand-700 disabled:opacity-50"><HeartPulse className="w-4 h-4" /> <Printer className="w-4 h-4" /> Medical &amp; emergency list</button>
+              </div>
+            )}
+          </div>
+
+          {data && (
+            <div className="flex flex-wrap gap-2 mb-3 text-xs">
+              {(["given", "pending", "declined", "missing"] as const).map(s => (
+                <span key={s} className={`px-2 py-1 rounded-full font-medium ${STATUS_STYLE[s].cls}`}>{STATUS_STYLE[s].label}: {data.counts?.[s] || 0}</span>
+              ))}
+            </div>
+          )}
+
+          <div className="overflow-x-auto">
+            <Table>
+              <TableHeader>
+                <TableRow>
+                  <TableHead>Attendee</TableHead>
+                  <TableHead>Parent / guardian</TableHead>
+                  <TableHead>Consent</TableHead>
+                  <TableHead>Booked by</TableHead>
+                  <TableHead className="text-right">Actions</TableHead>
+                </TableRow>
+              </TableHeader>
+              <TableBody>
+                {rows.map(r => {
+                  const st = STATUS_STYLE[r.status];
+                  return (
+                    <TableRow key={r.attendeeId}>
+                      <TableCell>
+                        <div className="font-medium">{r.name}</div>
+                        <div className="text-xs text-gray-500">{r.dateOfBirth ? formatDate(new Date(r.dateOfBirth)) : "No date of birth"}</div>
+                      </TableCell>
+                      <TableCell className="text-sm">
+                        {r.parentName ? <>
+                          <div>{r.parentName}</div>
+                          <div className="text-xs text-gray-500">{[r.parentEmail, r.parentPhone].filter(Boolean).join(" · ")}</div>
+                        </> : <span className="text-gray-400">—</span>}
+                      </TableCell>
+                      <TableCell>
+                        <span className={`text-xs px-2 py-0.5 rounded-full font-medium ${st.cls}`}>{st.label}</span>
+                        {r.request?.outdated && <div className="text-xs text-amber-700 mt-1">Given on an older version of the text</div>}
+                        {r.request?.respondedAt && <div className="text-xs text-gray-500 mt-1">{r.request.signedName} · {formatDate(new Date(r.request.respondedAt))}</div>}
+                        {r.status === "pending" && r.request && <div className="text-xs text-gray-500 mt-1">Sent {formatDate(new Date(r.request.lastSentAt))}{r.request.remindersSent ? ` · ${r.request.remindersSent} reminder(s)` : ""}</div>}
+                      </TableCell>
+                      <TableCell className="text-sm">{r.bookedBy?.name}<div className="text-xs text-gray-500">{r.registrationStatus}</div></TableCell>
+                      <TableCell className="text-right">
+                        {r.status === "pending" && r.request && (
+                          <button onClick={() => resendOne(r)} disabled={busy} className="px-2 py-1 text-xs rounded border hover:bg-gray-50">Resend</button>
+                        )}
+                      </TableCell>
+                    </TableRow>
+                  );
+                })}
+                {!busy && rows.length === 0 && (
+                  <TableRow><TableCell colSpan={5} className="text-center text-sm text-gray-500 py-8">{eventId ? "No attendees to show." : "Pick a youth event."}</TableCell></TableRow>
+                )}
+              </TableBody>
+            </Table>
+          </div>
+          <p className="text-xs text-gray-500 mt-3">Reminders go out automatically 2 days after a request, then every 3 days until the event. Medical details are deleted a set number of days after the event (Site Settings → Legal).</p>
+        </div>
+      )}
+    </div>
+  );
+}
@@ -6,6 +6,7 @@ import { useRouter, useSearchParams } from "next/navigation";
 import { apiFetch, fetchAllUsers } from "@/lib/api";
 import { useDismissingState } from "@/hooks/useDismissingState";
 import { Mail, Users, Zap, Clock } from "lucide-react";
+import { AllocationGroupFilter } from "@/components/shared/AllocationGroupFilter";

 type Attendee = { id: string; name: string; email: string; pref: string };

@@ -336,6 +337,7 @@ function EmailAttendeesPageInner() {
  const [subjectDirty, setSubjectDirty] = useState(false);
  const [bodyDirty, setBodyDirty] = useState(false);
  const [status, setStatus] = useState<'any'|'paid'|'unpaid'|'partial_paid'|'cancelled'>("any");
+  const [groupId, setGroupId] = useState("");
  // Attendees list and selection
  const [attendees, setAttendees] = useState<Attendee[]>([]);
  const [selectedAttendeeIds, setSelectedAttendeeIds] = useState<string[]>([]);
@@ -420,7 +422,7 @@ function EmailAttendeesPageInner() {
      }
      const payload: any = {
        subject: subject || "(no subject)",
-        filter: { status: status !== 'any' ? status : undefined, attendeeIds: selectedAttendeeIds && selectedAttendeeIds.length ? selectedAttendeeIds : undefined },
+        filter: { status: status !== 'any' ? status : undefined, attendeeIds: selectedAttendeeIds && selectedAttendeeIds.length ? selectedAttendeeIds : undefined, allocationGroupId: groupId || undefined },
        dryRun: true,
        template: templateKey,
      };
@@ -460,7 +462,7 @@ function EmailAttendeesPageInner() {
      setSending(true);
      const payload: any = {
        subject,
-        filter: { status: status !== 'any' ? status : undefined, attendeeIds: selectedAttendeeIds && selectedAttendeeIds.length ? selectedAttendeeIds : undefined },
+        filter: { status: status !== 'any' ? status : undefined, attendeeIds: selectedAttendeeIds && selectedAttendeeIds.length ? selectedAttendeeIds : undefined, allocationGroupId: groupId || undefined },
        template: templateKey,
      };
      if (templateKey !== 'tickets') {
@@ -607,6 +609,7 @@ function EmailAttendeesPageInner() {
                  <option value="cancelled">Cancelled</option>
                </select>
              </div>
+              <AllocationGroupFilter token={token} eventId={eventId} value={groupId} onChange={setGroupId} />
            </div>

            {templateKey !== 'tickets' ? (
@@ -659,7 +662,7 @@ function EmailAttendeesPageInner() {
                  const whenIso = new Date(scheduledAtLocal).toISOString();
                  const payload = {
                    subject,
-                    filter: { status: status !== 'any' ? status : undefined, attendeeIds: selectedAttendeeIds && selectedAttendeeIds.length ? selectedAttendeeIds : undefined },
+                    filter: { status: status !== 'any' ? status : undefined, attendeeIds: selectedAttendeeIds && selectedAttendeeIds.length ? selectedAttendeeIds : undefined, allocationGroupId: groupId || undefined },
                    template: templateKey,
                    scheduledAt: whenIso,
                  } as any;
@@ -986,6 +989,16 @@ function AutomationsPanel({ events, token, onInfo, onError }:{ events: any[]; to
  const [enablePre, setEnablePre] = React.useState(true);
  const [enableFinal, setEnableFinal] = React.useState(true);
  const [enableThanks, setEnableThanks] = React.useState(true);
+  // Sponsors of "sponsor a spot" events get their own thank-you.
+  const [enableSponsors, setEnableSponsors] = React.useState(true);
+  const [sponsorSubject, setSponsorSubject] = React.useState('Thank you for sponsoring a spot at {{event.title}}');
+  const [sponsorBody, setSponsorBody] = React.useState(`Hi {{name}}
+
+Thank you for sponsoring a spot at {{event.title}}. Because of you, someone was able to be there who otherwise couldn't.
+
+[add a highlight or two]
+
+With gratitude`);
  const [enablePromo, setEnablePromo] = React.useState(false);

  // Subjects/Bodies
@@ -1061,6 +1074,11 @@ function AutomationsPanel({ events, token, onInfo, onError }:{ events: any[]; to
        if (thanksBody.trim().startsWith('<')) payload.html = thanksBody; else payload.text = thanksBody;
        jobs.push(payload);
      }
+      if (currentEvent?.allowSponsorships && enableSponsors && sponsorSubject.trim() && sponsorBody.trim() && thanksWhen) {
+        const payload: any = { subject: sponsorSubject, scheduledAt: new Date(thanksWhen).toISOString(), audience: 'sponsors' };
+        if (sponsorBody.trim().startsWith('<')) payload.html = sponsorBody; else payload.text = sponsorBody;
+        jobs.push(payload);
+      }
      if (enablePromo && promoSubject.trim() && promoBody.trim() && promoWhen) {
        const payload: any = { subject: promoSubject, scheduledAt: new Date(promoWhen).toISOString(), promoEventId: promoEventId || undefined };
        if (promoBody.trim().startsWith('<')) payload.html = promoBody; else payload.text = promoBody;
@@ -1157,6 +1175,20 @@ function AutomationsPanel({ events, token, onInfo, onError }:{ events: any[]; to
          <textarea className="w-full border rounded px-3 py-2 text-sm" rows={5} value={thanksBody} onChange={e => setThanksBody(e.target.value)} />
        </fieldset>

+        {currentEvent?.allowSponsorships && (
+          <fieldset className="border rounded p-3">
+            <legend className="text-sm font-medium">Thank Your Sponsors</legend>
+            <label className="inline-flex items-center gap-2 text-sm mb-2">
+              <input type="checkbox" checked={enableSponsors} onChange={e => setEnableSponsors(e.target.checked)} /> Enable
+            </label>
+            <p className="text-xs text-gray-500 mb-2">Goes to everyone who sponsored a spot at this event, at the same time as the thank-you above.</p>
+            <label className="block text-xs text-gray-600 mb-1">Subject</label>
+            <input className="w-full border rounded px-3 py-2 text-sm" value={sponsorSubject} onChange={e => setSponsorSubject(e.target.value)} />
+            <label className="block text-xs text-gray-600 mb-1 mt-2">Message</label>
+            <textarea className="w-full border rounded px-3 py-2 text-sm" rows={5} value={sponsorBody} onChange={e => setSponsorBody(e.target.value)} />
+          </fieldset>
+        )}
+
        <fieldset className="border rounded p-3">
          <legend className="text-sm font-medium">Next Event Promo</legend>
          <div className="flex items-center gap-4 mb-2">
@@ -8,9 +8,12 @@ import { apiFetch, resolveToApiOrigin } from "@/lib/api";
 import { useDismissingState } from "@/hooks/useDismissingState";
 import { useSiteSettings } from "@/contexts/SiteSettingsContext";
 import { Calendar } from "lucide-react";
+import { ChoicesEditor } from "@/components/shared/FormFieldExtras";

 // ─── helpers ────────────────────────────────────────────────────────────────

+const cleanChoices = (opts: unknown): string[] => (Array.isArray(opts) ? opts.map(o => String(o).trim()).filter(Boolean) : []);
+
 function toLocalDT(input: string | Date | null | undefined): string {
  if (!input) return "";
  const d = new Date(input);
@@ -40,7 +43,7 @@ function DTInput({ label, value, onChange, hint, required }: { label: string; va

 // ─── types ───────────────────────────────────────────────────────────────────

-type FormFieldType = "yes_no" | "text" | "date" | "numeric" | "statement" | "paragraph";
+type FormFieldType = "yes_no" | "text" | "date" | "numeric" | "statement" | "paragraph" | "rating" | "multiple_choice";
 type EventFormDef = { isRequired: boolean; fields: { id?: string; type: FormFieldType; label: string; isRequired?: boolean; order?: number; helpText?: string | null; options?: any }[] };

 type Tier = { id?: string; deadline: string; price: string; stockLimit: string; order?: number };
@@ -97,7 +100,13 @@ function UploadImageButton({ onUploaded, label = "Upload image" }: { onUploaded:
  );
 }

-function FormBuilder({ value, onChange }: { value: EventFormDef; onChange: (v: EventFormDef) => void }) {
+function FormBuilder({ value, onChange, title = "Registration Form Fields", gateLabel = "Required before tickets generate" }: {
+  value: EventFormDef;
+  onChange: (v: EventFormDef) => void;
+  title?: string;
+  /** Label of the "form must be filled in" switch; null hides it (feedback forms). */
+  gateLabel?: string | null;
+}) {
  const fields = value.fields || [];
  const add = (type: FormFieldType) => onChange({ ...value, fields: [...fields, { type, label: "", isRequired: false, helpText: "" }] });
  const upd = (idx: number, patch: any) => { const c = fields.slice(); c[idx] = { ...c[idx], ...patch }; onChange({ ...value, fields: c }); };
@@ -107,15 +116,17 @@ function FormBuilder({ value, onChange }: { value: EventFormDef; onChange: (v: E
    if (t < 0 || t >= c.length) return;
    [c[idx], c[t]] = [c[t], c[idx]]; onChange({ ...value, fields: c });
  };
-  const typeLabel = (t: FormFieldType) => ({ text: "Text", numeric: "Number", date: "Date", yes_no: "Yes/No", statement: "Statement", paragraph: "Heading" }[t] || t);
+  const typeLabel = (t: FormFieldType) => ({ text: "Text", numeric: "Number", date: "Date", yes_no: "Yes/No", statement: "Statement", paragraph: "Heading", rating: "Rating", multiple_choice: "Multiple choice" }[t] || t);
  return (
    <div className="border rounded-lg p-3 bg-gray-50">
      <div className="flex items-center justify-between mb-3">
-        <div className="text-sm font-semibold">Registration Form Fields</div>
-        <label className="text-xs flex items-center gap-1.5 cursor-pointer">
-          <input type="checkbox" checked={!!value.isRequired} onChange={e => onChange({ ...value, isRequired: e.target.checked })} />
-          Required before tickets generate
-        </label>
+        <div className="text-sm font-semibold">{title}</div>
+        {gateLabel && (
+          <label className="text-xs flex items-center gap-1.5 cursor-pointer">
+            <input type="checkbox" checked={!!value.isRequired} onChange={e => onChange({ ...value, isRequired: e.target.checked })} />
+            {gateLabel}
+          </label>
+        )}
      </div>
      {fields.length === 0
        ? <p className="text-xs text-gray-500 italic mb-3">No fields yet.</p>
@@ -134,7 +145,8 @@ function FormBuilder({ value, onChange }: { value: EventFormDef; onChange: (v: E
                <div className="flex flex-wrap gap-2 mb-1.5">
                  <select className="border rounded px-2 py-1 text-xs" value={f.type} onChange={e => upd(idx, { type: e.target.value })}>
                    <option value="text">Text</option><option value="numeric">Number</option><option value="date">Date</option>
-                    <option value="yes_no">Yes/No</option><option value="statement">Statement</option><option value="paragraph">Heading+para</option>
+                    <option value="yes_no">Yes/No</option><option value="rating">Rating (1–5 stars)</option><option value="multiple_choice">Multiple choice</option>
+                    <option value="statement">Statement</option><option value="paragraph">Heading+para</option>
                  </select>
                  {f.type !== "statement" && f.type !== "paragraph" && (
                    <label className="text-xs flex items-center gap-1 cursor-pointer">
@@ -143,6 +155,7 @@ function FormBuilder({ value, onChange }: { value: EventFormDef; onChange: (v: E
                  )}
                </div>
                <input className="border rounded px-2 py-1 text-sm w-full mb-1" placeholder={f.type === "paragraph" ? "Heading text" : "Label"} value={f.label} onChange={e => upd(idx, { label: e.target.value })} />
+                {f.type === "multiple_choice" && <ChoicesEditor options={f.options} onChange={opts => upd(idx, { options: opts })} />}
                {f.type === "paragraph"
                  ? <textarea className="border rounded px-2 py-1 text-xs w-full" rows={2} placeholder="Body text" value={f.helpText || ""} onChange={e => upd(idx, { helpText: e.target.value })} />
                  : f.type !== "statement"
@@ -154,6 +167,8 @@ function FormBuilder({ value, onChange }: { value: EventFormDef; onChange: (v: E
        )}
      <div className="flex gap-2 flex-wrap">
        <button type="button" className="text-xs px-3 py-1.5 rounded bg-brand-600 text-white hover:bg-brand-700" onClick={() => add("text")}>+ Question</button>
+        <button type="button" className="text-xs px-3 py-1.5 rounded bg-gray-200 text-gray-700" onClick={() => add("rating")}>+ Rating</button>
+        <button type="button" className="text-xs px-3 py-1.5 rounded bg-gray-200 text-gray-700" onClick={() => add("multiple_choice")}>+ Multiple choice</button>
        <button type="button" className="text-xs px-3 py-1.5 rounded bg-gray-200 text-gray-700" onClick={() => add("statement")}>+ Statement</button>
        <button type="button" className="text-xs px-3 py-1.5 rounded bg-gray-200 text-gray-700" onClick={() => add("paragraph")}>+ Heading</button>
      </div>
@@ -759,8 +774,8 @@ function NotifyRecipientsManager({ eventId, creator, initialRecipients }: { even

 // ─── steps ───────────────────────────────────────────────────────────────────

-const STEPS = ["Basic Details", "Items & Pricing", "Sections", "Form", "Visibility", "Notifications", "Attachments"] as const;
-type StepIdx = 0 | 1 | 2 | 3 | 4 | 5 | 6;
+const STEPS = ["Basic Details", "Items & Pricing", "Sections", "Form", "Visibility", "Notifications", "Attachments", "Feedback"] as const;
+type StepIdx = 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7;
 const PRICING_SUBSTEPS = ["Options", "Variants", "Early Birds"] as const;
 type PricingSubstep = 0 | 1 | 2;

@@ -770,6 +785,11 @@ interface EventDraft {
  redirectUrl: string; isActive: boolean; isHidden: boolean; requiresAuth: boolean;
  requiresRegistration: boolean; contactName: string; contactPhone: string; contactEmail: string;
  location: string; allowNamedAttendees: boolean;
+  requiresParentalConsent: boolean; consentText: string;
+  consentCollectMedical: boolean; consentCollectEmergency: boolean; consentCollectPhoto: boolean;
+  waitlistEnabled: boolean; waitlistOfferHours: string; waitlistPartialOffers: boolean;
+  allowTicketTransfer: boolean; collectGender: boolean;
+  allowSponsorships: boolean; sponsorshipGoalSpots: string; showSponsorshipProgress: boolean;
 }

 const blankDraft = (location = ""): EventDraft => ({
@@ -778,6 +798,11 @@ const blankDraft = (location = ""): EventDraft => ({
  redirectUrl: "", isActive: true, isHidden: false, requiresAuth: true,
  requiresRegistration: true, contactName: "", contactPhone: "", contactEmail: "",
  location, allowNamedAttendees: false,
+  requiresParentalConsent: false, consentText: "",
+  consentCollectMedical: true, consentCollectEmergency: true, consentCollectPhoto: true,
+  waitlistEnabled: false, waitlistOfferHours: "24", waitlistPartialOffers: true,
+  allowTicketTransfer: true, collectGender: false,
+  allowSponsorships: false, sponsorshipGoalSpots: "", showSponsorshipProgress: true,
 });

 const blankOptions = (): OptionDraft[] => [
@@ -813,6 +838,12 @@ function EventModal({ mode, event: ev, onClose, onSuccess }: EventModalProps) {
    isActive: ev.isActive !== false, isHidden: !!ev.isHidden, requiresAuth: ev.requiresAuth !== false,
    requiresRegistration: ev.requiresRegistration !== false,
    allowNamedAttendees: !!ev.allowNamedAttendees,
+    requiresParentalConsent: !!ev.requiresParentalConsent, consentText: ev.consentText || "",
+    consentCollectMedical: !!ev.consentCollectMedical, consentCollectEmergency: !!ev.consentCollectEmergency, consentCollectPhoto: !!ev.consentCollectPhoto,
+    waitlistEnabled: !!ev.waitlistEnabled, waitlistOfferHours: String(ev.waitlistOfferHours ?? 24), waitlistPartialOffers: ev.waitlistPartialOffers !== false,
+    allowTicketTransfer: ev.allowTicketTransfer !== false,
+    collectGender: !!ev.collectGender,
+    allowSponsorships: !!ev.allowSponsorships, sponsorshipGoalSpots: ev.sponsorshipGoalSpots ? String(ev.sponsorshipGoalSpots) : "", showSponsorshipProgress: ev.showSponsorshipProgress !== false,
    contactName: ev.contactName || "", contactPhone: ev.contactPhone || "", contactEmail: ev.contactEmail || "",
    location: ev.location || "",
  } : blankDraft(settings.org_address || ""));
@@ -863,10 +894,57 @@ function EventModal({ mode, event: ev, onClose, onSuccess }: EventModalProps) {
    if (mode !== "edit" || !ev?.id || formLoadedRef.current) return;
    apiFetch<any>(`/api/events/${ev.id}`).then(full => {
      const f = full?.form;
-      if (f) setFormDef({ isRequired: !!f.isRequired, fields: (f.fields || []).map((x: any) => ({ id: x.id, type: x.type, label: x.label, isRequired: !!x.isRequired, helpText: x.helpText || "" })) });
+      if (f) setFormDef({ isRequired: !!f.isRequired, fields: (f.fields || []).map((x: any) => ({ id: x.id, type: x.type, label: x.label, isRequired: !!x.isRequired, helpText: x.helpText || "", options: x.options || undefined })) });
    }).catch(() => {}).finally(() => { formLoadedRef.current = true; });
  }, [mode, ev?.id]);

+  // ── post-event feedback ──
+  const [fbEnabled, setFbEnabled] = useState(false);
+  const [fbDef, setFbDef] = useState<EventFormDef>({ isRequired: false, fields: [] });
+  const [fbSettings, setFbSettings] = useState({ sendAt: "", audience: "checked_in", anonymous: false, intro: "" });
+  const [fbMeta, setFbMeta] = useState<{ sentAt: string | null; invited: number; responses: number } | null>(null);
+  useEffect(() => {
+    if (mode !== "edit" || !ev?.id || !token) return;
+    apiFetch<any>(`/api/feedback/event/${ev.id}`, { authToken: token }).then(f => {
+      if (!f) return;
+      setFbEnabled(true);
+      setFbDef({ isRequired: false, fields: (f.fields || []).map((x: any) => ({ id: x.id, type: x.type, label: x.label, isRequired: !!x.isRequired, helpText: x.helpText || "", options: x.options || undefined })) });
+      setFbSettings({ sendAt: toLocalDT(f.sendAt), audience: f.audience || "checked_in", anonymous: !!f.anonymous, intro: f.intro || "" });
+      setFbMeta({ sentAt: f.sentAt, invited: f.invited, responses: f.responses });
+    }).catch(() => {});
+  }, [mode, ev?.id, token]);
+  const enableFeedback = (on: boolean) => {
+    setFbEnabled(on);
+    if (on && fbDef.fields.length === 0) {
+      setFbDef({ isRequired: false, fields: [
+        { type: "rating", label: "Overall, how would you rate the event?", isRequired: true, helpText: "" },
+        { type: "rating", label: "How would you rate the organisation?", isRequired: false, helpText: "" },
+        { type: "text", label: "What did you enjoy most?", isRequired: false, helpText: "" },
+        { type: "text", label: "What could we do better?", isRequired: false, helpText: "" },
+      ] });
+    }
+    if (on && !fbSettings.sendAt && draft.endDate) {
+      const next = new Date(draft.endDate);
+      next.setDate(next.getDate() + 1);
+      next.setHours(9, 0, 0, 0);
+      setFbSettings(s => ({ ...s, sendAt: toLocalDT(next) }));
+    }
+  };
+  const saveFeedback = async (eventId: string) => {
+    if (fbEnabled) {
+      await apiFetch(`/api/feedback/event/${eventId}`, {
+        method: "PUT", authToken: token || undefined,
+        body: {
+          sendAt: fbSettings.sendAt ? new Date(fbSettings.sendAt).toISOString() : null,
+          audience: fbSettings.audience, anonymous: fbSettings.anonymous, intro: fbSettings.intro || null,
+          fields: fbDef.fields.filter(f => f.label?.trim()).map((f, i) => ({ type: f.type, label: f.label, isRequired: !!f.isRequired, order: i, helpText: f.helpText || null, options: f.type === "multiple_choice" ? cleanChoices(f.options) : undefined })),
+        },
+      });
+    } else if (fbMeta) {
+      await apiFetch(`/api/feedback/event/${eventId}`, { method: "DELETE", authToken: token || undefined });
+    }
+  };
+
  const upd = (patch: Partial<EventDraft>) => setDraft(d => ({ ...d, ...patch }));

  // ── auto-fill first option's price from the event base price (create mode only, until the
@@ -905,7 +983,7 @@ function EventModal({ mode, event: ev, onClose, onSuccess }: EventModalProps) {
      if (mode === "edit") {
        await apiFetch(`/api/events/${eventId}`, {
          method: "PUT", authToken: token || undefined,
-          body: { form: { isRequired: !!formDef.isRequired, fields: formDef.fields.filter(f => f.label?.trim()).map((f, i) => ({ type: f.type, label: f.label, isRequired: !!f.isRequired, order: i, helpText: f.helpText || null })) } }
+          body: { form: { isRequired: !!formDef.isRequired, fields: formDef.fields.filter(f => f.label?.trim()).map((f, i) => ({ type: f.type, label: f.label, isRequired: !!f.isRequired, order: i, helpText: f.helpText || null, options: f.type === "multiple_choice" ? cleanChoices(f.options) : undefined })) } }
        });
      }
      return;
@@ -956,7 +1034,7 @@ function EventModal({ mode, event: ev, onClose, onSuccess }: EventModalProps) {
          // Handle form save (edit only)
          await apiFetch(`/api/events/${eventId}`, {
            method: "PUT", authToken: token || undefined,
-            body: { form: { isRequired: !!formDef.isRequired, fields: formDef.fields.filter(f => f.label?.trim()).map((f, i) => ({ type: f.type, label: f.label, isRequired: !!f.isRequired, order: i, helpText: f.helpText || null })) } }
+            body: { form: { isRequired: !!formDef.isRequired, fields: formDef.fields.filter(f => f.label?.trim()).map((f, i) => ({ type: f.type, label: f.label, isRequired: !!f.isRequired, order: i, helpText: f.helpText || null, options: f.type === "multiple_choice" ? cleanChoices(f.options) : undefined })) } }
          });
        } else {
          // New option added during edit
@@ -1086,7 +1164,20 @@ function EventModal({ mode, event: ev, onClose, onSuccess }: EventModalProps) {
        picture: draft.picture || undefined, isHidden: draft.isHidden, requiresAuth: draft.requiresAuth,
        redirectUrl: draft.redirectUrl?.trim().replace(/\s+/g, "-") || undefined,
        requiresRegistration: draft.requiresRegistration,
-        allowNamedAttendees: draft.allowNamedAttendees,
+        allowNamedAttendees: draft.allowNamedAttendees || draft.requiresParentalConsent,
+        requiresParentalConsent: draft.requiresParentalConsent,
+        consentText: draft.consentText,
+        consentCollectMedical: draft.consentCollectMedical,
+        consentCollectEmergency: draft.consentCollectEmergency,
+        consentCollectPhoto: draft.consentCollectPhoto,
+        waitlistEnabled: draft.waitlistEnabled,
+        allowTicketTransfer: draft.allowTicketTransfer,
+        collectGender: draft.collectGender,
+        allowSponsorships: draft.allowSponsorships,
+        sponsorshipGoalSpots: draft.allowSponsorships && draft.sponsorshipGoalSpots ? parseInt(draft.sponsorshipGoalSpots, 10) || null : null,
+        showSponsorshipProgress: draft.showSponsorshipProgress,
+        waitlistOfferHours: parseInt(draft.waitlistOfferHours, 10) || 24,
+        waitlistPartialOffers: draft.waitlistPartialOffers,
        contactName: draft.contactName || undefined,
        contactPhone: draft.contactPhone || undefined,
        contactEmail: draft.contactEmail || undefined,
@@ -1098,13 +1189,15 @@ function EventModal({ mode, event: ev, onClose, onSuccess }: EventModalProps) {
        await apiFetch(`/api/events/${ev.id}`, { method: "PUT", authToken: token || undefined, body });
        await saveOptions(ev.id);
        // Form is saved inside saveOptions for edit mode; avoid double call
+        await saveFeedback(ev.id);
      } else {
        if (formDef.isRequired || formDef.fields.length > 0) {
-          body.form = { isRequired: !!formDef.isRequired, fields: formDef.fields.filter(f => f.label?.trim()).map((f, i) => ({ type: f.type, label: f.label, isRequired: !!f.isRequired, order: i, helpText: f.helpText || null })) };
+          body.form = { isRequired: !!formDef.isRequired, fields: formDef.fields.filter(f => f.label?.trim()).map((f, i) => ({ type: f.type, label: f.label, isRequired: !!f.isRequired, order: i, helpText: f.helpText || null, options: f.type === "multiple_choice" ? cleanChoices(f.options) : undefined })) };
        }
        const created: any = await apiFetch("/api/events", { method: "POST", authToken: token || undefined, body });
        if (created?.id) {
          await saveOptions(created.id);
+          await saveFeedback(created.id);
          // Fetch event to get final option IDs for sections
          const fullEvent: any = await apiFetch(`/api/events/${created.id}`).catch(() => null);
          const createdOptions = fullEvent?.eventOptions || [];
@@ -1328,6 +1421,46 @@ function EventModal({ mode, event: ev, onClose, onSuccess }: EventModalProps) {
            </div>
          )}

+          {step === 7 && (
+            <div className="space-y-3">
+              <p className="text-xs text-gray-500">Ask people what they thought, automatically after the event. Responses appear in Reports → Feedback summary.</p>
+              <label className="flex items-start gap-2 text-sm cursor-pointer">
+                <input type="checkbox" className="mt-0.5" checked={fbEnabled} onChange={e => enableFeedback(e.target.checked)} />
+                <span><strong>Send a feedback form after the event</strong></span>
+              </label>
+              {fbEnabled && (
+                <>
+                  {fbMeta?.sentAt && (
+                    <div className="text-xs rounded bg-green-50 text-green-800 p-2">Sent {new Date(fbMeta.sentAt).toLocaleString()} to {fbMeta.invited} {fbMeta.invited === 1 ? "person" : "people"} · {fbMeta.responses} response(s).{fbMeta.responses > 0 ? " The questions can't be changed now that people have answered." : ""}</div>
+                  )}
+                  <div className="grid sm:grid-cols-2 gap-3">
+                    <div>
+                      <label className="block text-xs text-gray-600 mb-1">Send at</label>
+                      <input type="datetime-local" className="border rounded px-2 py-1.5 text-sm w-full" value={fbSettings.sendAt} disabled={!!fbMeta?.sentAt} onChange={e => setFbSettings(s => ({ ...s, sendAt: e.target.value }))} />
+                    </div>
+                    <div>
+                      <label className="block text-xs text-gray-600 mb-1">Send to</label>
+                      <select className="border rounded px-2 py-1.5 text-sm w-full" value={fbSettings.audience} onChange={e => setFbSettings(s => ({ ...s, audience: e.target.value }))}>
+                        <option value="checked_in">Everyone who checked in</option>
+                        <option value="all">Everyone registered</option>
+                      </select>
+                    </div>
+                  </div>
+                  <label className="flex items-start gap-2 text-sm cursor-pointer">
+                    <input type="checkbox" className="mt-0.5" checked={fbSettings.anonymous} onChange={e => setFbSettings(s => ({ ...s, anonymous: e.target.checked }))} />
+                    <span>Anonymous — answers aren&apos;t linked to people&apos;s names</span>
+                  </label>
+                  <div>
+                    <label className="block text-xs text-gray-600 mb-1">Intro (optional)</label>
+                    <textarea className="border rounded px-2 py-1.5 text-sm w-full" rows={2} value={fbSettings.intro} onChange={e => setFbSettings(s => ({ ...s, intro: e.target.value }))} placeholder="Thanks for coming! Tell us how it went." />
+                  </div>
+                  <p className="text-xs text-gray-500">Anyone who hasn&apos;t answered gets one reminder 3 days later.</p>
+                  <FormBuilder value={fbDef} onChange={setFbDef} title="Feedback questions" gateLabel={null} />
+                </>
+              )}
+            </div>
+          )}
+
          {/* ── Step 4: Visibility ── */}
          {step === 4 && (
            <div className="space-y-3">
@@ -1345,6 +1478,12 @@ function EventModal({ mode, event: ev, onClose, onSuccess }: EventModalProps) {
                  <input type="checkbox" className="mt-0.5" checked={draft.allowNamedAttendees} onChange={e => upd({ allowNamedAttendees: e.target.checked })} />
                  <span><strong>Named attendees (group tickets)</strong> — someone registering several people can give each a name, so each gets their own ticket and attendee form</span>
                </label>
+                {(draft.allowNamedAttendees || draft.requiresParentalConsent) && (
+                  <label className="flex items-start gap-2 text-sm cursor-pointer ml-6">
+                    <input type="checkbox" className="mt-0.5" checked={draft.collectGender} onChange={e => upd({ collectGender: e.target.checked })} />
+                    <span><strong>Ask each person&apos;s gender</strong> — needed to split rooms or cabins by gender (Rooms &amp; groups)</span>
+                  </label>
+                )}
                {mode === "edit" && (
                  <label className="flex items-start gap-2 text-sm cursor-pointer">
                    <input type="checkbox" className="mt-0.5" checked={draft.isActive} onChange={e => upd({ isActive: e.target.checked })} />
@@ -1352,6 +1491,78 @@ function EventModal({ mode, event: ev, onClose, onSuccess }: EventModalProps) {
                  </label>
                )}
              </div>
+
+              <div className="border rounded-lg p-4 bg-gray-50 space-y-3">
+                <div className="text-xs font-semibold text-gray-500 uppercase tracking-wide mb-1">Waitlist</div>
+                <label className="flex items-start gap-2 text-sm cursor-pointer">
+                  <input type="checkbox" className="mt-0.5" checked={draft.waitlistEnabled} onChange={e => upd({ waitlistEnabled: e.target.checked })} />
+                  <span><strong>Waitlist for sold-out tickets</strong> — people can join a queue; when places free up, the next person is offered them and has a set time to claim</span>
+                </label>
+                {draft.waitlistEnabled && (
+                  <>
+                    <label className="flex items-center gap-2 text-sm">
+                      Hold offered places for
+                      <input type="number" min="1" max="168" className="border rounded px-2 py-1 text-sm w-20" value={draft.waitlistOfferHours} onChange={e => upd({ waitlistOfferHours: e.target.value })} />
+                      hours
+                    </label>
+                    <label className="flex items-start gap-2 text-sm cursor-pointer">
+                      <input type="checkbox" className="mt-0.5" checked={draft.waitlistPartialOffers} onChange={e => upd({ waitlistPartialOffers: e.target.checked })} />
+                      <span>When fewer places free up than someone asked for, offer them what&apos;s free (otherwise skip to the next person who fits)</span>
+                    </label>
+                  </>
+                )}
+              </div>
+
+              <div className="border rounded-lg p-4 bg-gray-50 space-y-3">
+                <div className="text-xs font-semibold text-gray-500 uppercase tracking-wide mb-1">Sponsor a spot</div>
+                <label className="flex items-start gap-2 text-sm cursor-pointer">
+                  <input type="checkbox" className="mt-0.5" checked={draft.allowSponsorships} onChange={e => upd({ allowSponsorships: e.target.checked })} />
+                  <span><strong>Allow sponsorships</strong> — a &quot;Sponsor a spot&quot; button on the event page lets people pay for spots (or any amount) for those who can&apos;t afford to come. The money goes into a sponsorship pool you assign under Payments → Donations</span>
+                </label>
+                {draft.allowSponsorships && (
+                  <>
+                    <label className="flex items-center gap-2 text-sm">
+                      Goal
+                      <input type="number" min="1" className="border rounded px-2 py-1 text-sm w-20" value={draft.sponsorshipGoalSpots} onChange={e => upd({ sponsorshipGoalSpots: e.target.value })} placeholder="—" />
+                      spots (optional)
+                    </label>
+                    <label className="flex items-start gap-2 text-sm cursor-pointer">
+                      <input type="checkbox" className="mt-0.5" checked={draft.showSponsorshipProgress} onChange={e => upd({ showSponsorshipProgress: e.target.checked })} />
+                      <span>Show progress on the event page (&quot;12 of 20 spots sponsored&quot;)</span>
+                    </label>
+                  </>
+                )}
+              </div>
+
+              <div className="border rounded-lg p-4 bg-gray-50 space-y-3">
+                <div className="text-xs font-semibold text-gray-500 uppercase tracking-wide mb-1">Ticket transfer</div>
+                <label className="flex items-start gap-2 text-sm cursor-pointer">
+                  <input type="checkbox" className="mt-0.5" checked={draft.allowTicketTransfer} onChange={e => upd({ allowTicketTransfer: e.target.checked })} />
+                  <span><strong>Let people transfer their tickets</strong> — before the event, a ticket that hasn&apos;t been scanned can be handed to someone else, who gets a new QR code (supervisors can always transfer)</span>
+                </label>
+              </div>
+
+              <div className="border rounded-lg p-4 bg-gray-50 space-y-3">
+                <div className="text-xs font-semibold text-gray-500 uppercase tracking-wide mb-1">Youth event</div>
+                <label className="flex items-start gap-2 text-sm cursor-pointer">
+                  <input type="checkbox" className="mt-0.5" checked={draft.requiresParentalConsent} onChange={e => upd({ requiresParentalConsent: e.target.checked, ...(e.target.checked ? { allowNamedAttendees: true } : {}) })} />
+                  <span><strong>Requires parental consent</strong> — every attendee gives a date of birth; for anyone under 18, a parent or guardian is asked by email and WhatsApp to give consent before they can be checked in</span>
+                </label>
+                {draft.requiresParentalConsent && (
+                  <>
+                    <div>
+                      <label className="block text-xs text-gray-600 mb-1">Consent text (shown to the parent)</label>
+                      <textarea className="w-full border rounded px-2 py-1.5 text-sm" rows={6} value={draft.consentText} onChange={e => upd({ consentText: e.target.value })}
+                        placeholder="e.g. I give permission for my child to take part in all activities, including transport, and for leaders to arrange medical treatment in an emergency." />
+                      {mode === "edit" && <p className="text-[11px] text-gray-500 mt-1">Changing this starts a new version. Parents who already agreed keep their record; use &quot;Re-request consent&quot; on the Parental consent page to ask them again.</p>}
+                    </div>
+                    <div className="text-xs text-gray-600">Also ask the parent for:</div>
+                    <label className="flex items-center gap-2 text-sm"><input type="checkbox" checked={draft.consentCollectMedical} onChange={e => upd({ consentCollectMedical: e.target.checked })} /> Medical info (allergies, medication, conditions, medical aid)</label>
+                    <label className="flex items-center gap-2 text-sm"><input type="checkbox" checked={draft.consentCollectEmergency} onChange={e => upd({ consentCollectEmergency: e.target.checked })} /> An emergency contact</label>
+                    <label className="flex items-center gap-2 text-sm"><input type="checkbox" checked={draft.consentCollectPhoto} onChange={e => upd({ consentCollectPhoto: e.target.checked })} /> Photo consent (yes/no)</label>
+                  </>
+                )}
+              </div>
            </div>
          )}

@@ -1,4 +1,5 @@
 "use client";
+import { ExtraFieldInput, isExtraFieldType, ChoicesEditor } from "@/components/shared/FormFieldExtras";

 import React, { useEffect, useMemo, useState } from "react";
 import { useAuth } from "@/hooks/useAuth";
@@ -7,7 +8,7 @@ import { apiFetch, fetchAllUsers } from "@/lib/api";
 import { useDismissingState } from "@/hooks/useDismissingState";
 import { FileText } from "lucide-react";

-type FormFieldType = 'yes_no' | 'text' | 'date' | 'numeric' | 'statement' | 'paragraph';
+type FormFieldType = 'yes_no' | 'text' | 'date' | 'numeric' | 'statement' | 'paragraph' | 'rating' | 'multiple_choice';

 type EventFormDef = { isRequired: boolean; fields: { id?: string; type: FormFieldType; label: string; isRequired?: boolean; order?: number; helpText?: string|null; options?: any }[] };

@@ -36,7 +37,7 @@ function FormBuilder({ value, onChange }: { value: EventFormDef; onChange: (v: E
  };

  const typeLabel = (type: FormFieldType) => {
-    const labels: Record<FormFieldType, string> = { text: 'Text', numeric: 'Number', date: 'Date', yes_no: 'Yes/No', statement: 'Statement', paragraph: 'Heading' };
+    const labels: Record<FormFieldType, string> = { text: 'Text', numeric: 'Number', date: 'Date', yes_no: 'Yes/No', statement: 'Statement', paragraph: 'Heading', rating: 'Rating', multiple_choice: 'Multiple choice' };
    return labels[type] || type;
  };

@@ -73,6 +74,8 @@ function FormBuilder({ value, onChange }: { value: EventFormDef; onChange: (v: E
                  <option value="numeric">Number</option>
                  <option value="date">Date</option>
                  <option value="yes_no">Yes / No</option>
+                  <option value="rating">Rating (1–5 stars)</option>
+                  <option value="multiple_choice">Multiple choice</option>
                  <option value="statement">Statement (display text)</option>
                  <option value="paragraph">Heading + paragraph</option>
                </select>
@@ -89,6 +92,7 @@ function FormBuilder({ value, onChange }: { value: EventFormDef; onChange: (v: E
                value={f.label}
                onChange={e => updateField(idx, { label: e.target.value })}
              />
+              {f.type === 'multiple_choice' && <ChoicesEditor options={f.options} onChange={opts => updateField(idx, { options: opts })} />}
              {f.type === 'paragraph' ? (
                <textarea
                  className="border rounded px-2 py-1 text-xs w-full"
@@ -288,7 +292,7 @@ export default function FormsBrowserPage() {
      const evFull = await apiFetch<any>(`/api/events/${encodeURIComponent(eventId)}`);
      const f = evFull?.form;
      if (f && Array.isArray(f.fields)) {
-        setFormDef({ isRequired: !!f.isRequired, fields: f.fields.map((x: any) => ({ id: x.id, type: x.type, label: x.label, isRequired: !!x.isRequired, order: x.order, helpText: x.helpText || '' })) });
+        setFormDef({ isRequired: !!f.isRequired, fields: f.fields.map((x: any) => ({ id: x.id, type: x.type, label: x.label, isRequired: !!x.isRequired, order: x.order, helpText: x.helpText || '', options: x.options || undefined })) });
      } else {
        setFormDef({ isRequired: false, fields: [] });
      }
@@ -310,7 +314,7 @@ export default function FormsBrowserPage() {
    if (!token || !selectedEventId) return;
    setError(null); setInfo(null);
    try {
-      const fields = (formDef.fields || []).filter(f => (f.label || '').trim().length > 0).map((f, i) => ({ type: f.type, label: f.label, isRequired: !!f.isRequired && f.type !== 'statement' && f.type !== 'paragraph', order: i, helpText: f.helpText || null }));
+      const fields = (formDef.fields || []).filter(f => (f.label || '').trim().length > 0).map((f, i) => ({ type: f.type, label: f.label, isRequired: !!f.isRequired && f.type !== 'statement' && f.type !== 'paragraph', order: i, helpText: f.helpText || null, options: f.type === 'multiple_choice' && Array.isArray(f.options) ? f.options.map((o: any) => String(o).trim()).filter(Boolean) : undefined }));
      await apiFetch(`/api/events/${encodeURIComponent(selectedEventId)}`, { method: 'PUT', authToken: token, body: { form: { isRequired: !!formDef.isRequired, fields } } });
      setInfo('Form saved');
    } catch (e:any) {
@@ -362,7 +366,7 @@ export default function FormsBrowserPage() {
          const evFull = await apiFetch<any>(`/api/events/${encodeURIComponent(reg.event.id)}`);
          const f = evFull?.form;
          if (f && Array.isArray(f.fields)) {
-            setFillForm({ isRequired: !!f.isRequired, fields: f.fields.map((x:any)=>({ id:x.id, type:x.type, label:x.label, isRequired:!!x.isRequired, order:x.order, helpText:x.helpText||'' })) });
+            setFillForm({ isRequired: !!f.isRequired, fields: f.fields.map((x:any)=>({ id:x.id, type:x.type, label:x.label, isRequired:!!x.isRequired, order:x.order, helpText:x.helpText||'', options: x.options || undefined })) });
          } else {
            setFillForm({ isRequired: false, fields: [] });
          }
@@ -710,6 +714,9 @@ export default function FormsBrowserPage() {
                        {f.type === 'date' && (
                          <input type="date" className="border rounded px-2 py-1 text-sm w-full" value={resp.answers[f.id]||''} onChange={e=> setAnswer(idx, f.id!, e.target.value)} />
                        )}
+                        {isExtraFieldType(f.type) && (
+                          <ExtraFieldInput field={f} idPrefix={`r${idx}`} value={resp.answers[f.id!]||''} onChange={v => setAnswer(idx, f.id!, v)} />
+                        )}
                        {f.type === 'yes_no' && (
                          <select className="border rounded px-2 py-1 text-sm w-full" value={resp.answers[f.id]||''} onChange={e=> setAnswer(idx, f.id!, e.target.value)}>
                            <option value="">Select…</option>
@@ -1,4 +1,5 @@
 "use client";
+import { ExtraFieldInput, isExtraFieldType } from "@/components/shared/FormFieldExtras";

 import React, { useEffect, useState } from "react";
 import { useAuth } from "@/hooks/useAuth";
@@ -7,7 +8,7 @@ import { apiFetch } from "@/lib/api";
 import { useDismissingState } from "@/hooks/useDismissingState";
 import { UserPlus } from "lucide-react";

-type FormField = { id: string; type: 'yes_no'|'text'|'date'|'numeric'|'statement'|'paragraph'; label: string; isRequired?: boolean; helpText?: string|null };
+type FormField = { id: string; type: 'yes_no'|'text'|'date'|'numeric'|'statement'|'paragraph'|'rating'|'multiple_choice'; label: string; isRequired?: boolean; helpText?: string|null; options?: unknown };

 export default function ManualRegistrationPage() {
  const { user, token, loading } = useAuth();
@@ -178,7 +179,9 @@ function AttendeeFormsSection({ registration, form, formsData, setFormsData }: {
                ) : (
                  <>
                    <label className="block text-xs text-gray-600 mb-1">{f.label}{f.isRequired ? ' *' : ''}</label>
-                    {f.type === 'yes_no' ? (
+                    {isExtraFieldType(f.type) ? (
+                      <ExtraFieldInput field={f} idPrefix={`a${idx}`} value={formsData[idx]?.[f.id] || ''} onChange={v => update(idx, f.id, v)} />
+                    ) : f.type === 'yes_no' ? (
                      <select className="border rounded px-2 py-1 text-sm" value={formsData[idx]?.[f.id] || ''} onChange={e => update(idx, f.id, e.target.value)}>
                        <option value="">Select</option>
                        <option value="yes">Yes</option>
@@ -7,7 +7,7 @@ import { apiFetch, fetchAllUsers } from "@/lib/api";
 import { scoreUser } from "@/lib/fuzzyMatch";
 import { useDismissingState } from "@/hooks/useDismissingState";
 import { CouponCodeField, AppliedCoupon } from "@/components/shared/CouponCodeField";
-import { AttendeeNamesEditor, AttendeeEntries, TicketDelivery, attendeesPayload } from "@/components/shared/AttendeeNamesEditor";
+import { AttendeeNamesEditor, AttendeeEntries, TicketDelivery, attendeesPayload, consentDetailsMissing } from "@/components/shared/AttendeeNamesEditor";
 import { UserPlus, CreditCard } from "lucide-react";

 // ─── Pricing helpers ─────────────────────────────────────────────────────────
@@ -224,7 +224,9 @@ export default function ManualRegistrationPage() {
  const [attendeeEntries, setAttendeeEntries] = useState<AttendeeEntries>({});
  const [delivery, setDelivery] = useState<TicketDelivery>("payer");
  const manualQtyFor = (optionId: string, variantId: string | null) => quantities[variantId ? `${optionId}::${variantId}` : optionId] || 0;
-  const selectedEventAllowsNames = !!events.find(ev => ev.id === selectedEventId)?.allowNamedAttendees;
+  const selectedEv = events.find(ev => ev.id === selectedEventId);
+  const selectedIsYouth = !!selectedEv?.requiresParentalConsent;
+  const selectedEventAllowsNames = !!selectedEv?.allowNamedAttendees || selectedIsYouth;
  const [pickedUserId, setPickedUserId] = useState<string | null>(null);

  const selectUser = (u: any) => {
@@ -307,6 +309,10 @@ export default function ManualRegistrationPage() {
        return { eventOptionId, quantity, ...(variantId ? { variantId } : {}) };
      });
    if (opts.length === 0) { setError("Please select at least one ticket option."); return; }
+    if (selectedIsYouth) {
+      const missing = consentDetailsMissing(options, manualQtyFor, attendeeEntries, selectedEv.startDate);
+      if (missing) { setError(missing); return; }
+    }

    try {
      setSubmitting(true);
@@ -322,7 +328,7 @@ export default function ManualRegistrationPage() {
          user: guest,
          notificationPreference: resolvedPref,
          ...(coupon ? { couponCode: coupon.code } : {}),
-          ...(selectedEventAllowsNames && namingOthers && attendeesPayload(options, manualQtyFor, attendeeEntries).length > 0
+          ...(selectedEventAllowsNames && (namingOthers || selectedIsYouth) && attendeesPayload(options, manualQtyFor, attendeeEntries).length > 0
            ? { attendees: attendeesPayload(options, manualQtyFor, attendeeEntries), ticketDelivery: delivery }
            : {}),
        }
@@ -617,6 +623,8 @@ export default function ManualRegistrationPage() {
            delivery={delivery}
            onDeliveryChange={setDelivery}
            payerLabel="the person registering"
+            consentEventStart={selectedIsYouth ? selectedEv.startDate : undefined}
+            collectGender={!!selectedEv?.collectGender}
          />
        </div>
      )}
@@ -0,0 +1,163 @@
+"use client";
+
+import React, { useCallback, useEffect, useMemo, useState } from "react";
+import { useAuth } from "@/hooks/useAuth";
+import { useRouter } from "next/navigation";
+import { apiFetch } from "@/lib/api";
+import { formatDate } from "@/lib/date";
+import { useDismissingState } from "@/hooks/useDismissingState";
+import { WifiOff, Unlock, CheckCircle2 } from "lucide-react";
+
+type Lock = { id: string; sectionName: string | null; deviceName: string | null; user: { name: string }; lockedAt: string; snapshotAt: string | null; lastSyncAt: string | null };
+type Report = {
+  id: string; accepted: number; duplicates: number; afterForceRelease: boolean; createdAt: string; reviewedAt: string | null;
+  reviewedBy: { name: string } | null;
+  conflicts: { clientScanId: string; qrCode: string; qty: number; redeemed: number; scannedAt: string; reason: string; message: string }[];
+  scanLock: Lock;
+};
+
+const when = (iso: string | null) => (iso ? new Date(iso).toLocaleString() : "—");
+
+export default function OfflineScansPage() {
+  const { user, loading, token } = useAuth();
+  const router = useRouter();
+  const canView = useMemo(() => user?.role === "admin" || user?.role === "supervisor", [user]);
+
+  useEffect(() => {
+    if (loading) return;
+    if (!user) router.replace("/login");
+  }, [user, loading, router]);
+
+  const [events, setEvents] = useState<any[]>([]);
+  const [eventId, setEventId] = useState("");
+  const [locks, setLocks] = useState<Lock[]>([]);
+  const [reports, setReports] = useState<Report[]>([]);
+  const [onlyOpen, setOnlyOpen] = useState(true);
+  const [error, setError] = useDismissingState<string | null>(null);
+  const [info, setInfo] = useDismissingState<string | null>(null);
+
+  useEffect(() => {
+    if (!token || !canView) return;
+    apiFetch<any[]>("/api/events/all?includePast=true", { authToken: token })
+      .then(evs => {
+        const recent = (evs || []).filter(e => new Date(e.endDate).getTime() > Date.now() - 14 * 864e5);
+        setEvents(recent);
+        if (recent.length && !eventId) setEventId(recent[0].id);
+      })
+      .catch(e => setError(e?.message || "Failed to load events"));
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [token, canView]);
+
+  const load = useCallback(async () => {
+    if (!token || !eventId) return;
+    try {
+      const [l, r] = await Promise.all([
+        apiFetch<Lock[]>(`/api/scan-locks?eventId=${encodeURIComponent(eventId)}`, { authToken: token }),
+        apiFetch<Report[]>(`/api/scan-locks/reports?eventId=${encodeURIComponent(eventId)}${onlyOpen ? "&unreviewed=true" : ""}`, { authToken: token }),
+      ]);
+      setLocks(l);
+      setReports(r.filter(x => !onlyOpen || x.conflicts.length > 0 || x.afterForceRelease));
+    } catch (e: any) {
+      setError(e?.message || "Failed to load offline scanning");
+    }
+  }, [token, eventId, onlyOpen, setError]);
+  useEffect(() => { load(); }, [load]);
+
+  const forceRelease = async (l: Lock) => {
+    try {
+      const res = await apiFetch<{ message: string }>(`/api/scan-locks/${l.id}/force-release`, { method: "POST", authToken: token! });
+      setInfo(res.message);
+      load();
+    } catch (e: any) { setError(e?.message || "Failed"); }
+  };
+  const review = async (r: Report) => {
+    try {
+      await apiFetch(`/api/scan-locks/reports/${r.id}/review`, { method: "POST", authToken: token! });
+      load();
+    } catch (e: any) { setError(e?.message || "Failed"); }
+  };
+
+  return (
+    <div className="max-w-5xl mx-auto w-full p-6">
+      <div className="flex items-center gap-3 mb-4">
+        <div className="w-10 h-10 rounded-xl bg-brand-50 flex items-center justify-center shrink-0">
+          <WifiOff className="w-5 h-5 text-brand-600" />
+        </div>
+        <div>
+          <button className="text-xs text-brand-600 hover:underline" onClick={() => router.push("/dashboard")}>← Back to dashboard</button>
+          <h1 className="text-2xl font-semibold text-gray-900 mt-0.5">Offline scanning</h1>
+          <p className="text-sm text-gray-500">Devices scanning without a connection, and their synced scans</p>
+        </div>
+      </div>
+
+      {!canView && <div className="p-3 border rounded bg-yellow-50 text-yellow-800 text-sm mb-4">You need supervisor access to manage offline scanning.</div>}
+      {error && <div className="mb-3 p-3 border rounded bg-red-50 text-red-800 text-sm">{error}</div>}
+      {info && <div className="mb-3 p-3 border rounded bg-green-50 text-green-800 text-sm">{info}</div>}
+
+      {canView && (
+        <div className="space-y-4">
+          <div className="flex flex-wrap items-end gap-3">
+            <div>
+              <label className="block text-xs text-gray-600 mb-1">Event</label>
+              <select className="border rounded-lg px-3 py-2 text-sm min-w-[16rem]" value={eventId} onChange={e => setEventId(e.target.value)}>
+                {events.map(ev => <option key={ev.id} value={ev.id}>{ev.title} ({formatDate(new Date(ev.startDate))})</option>)}
+              </select>
+            </div>
+            <label className="flex items-center gap-2 text-sm text-gray-700 pb-2">
+              <input type="checkbox" checked={onlyOpen} onChange={e => setOnlyOpen(e.target.checked)} /> Only reports that need review
+            </label>
+          </div>
+
+          <section className="border rounded-xl p-4 bg-white shadow-sm">
+            <h2 className="font-semibold mb-2">Locked sections</h2>
+            {locks.length === 0 ? <p className="text-sm text-gray-500">No device is scanning offline for this event.</p> : (
+              <ul className="divide-y">
+                {locks.map(l => (
+                  <li key={l.id} className="py-2 flex items-center justify-between gap-3 text-sm">
+                    <div>
+                      <div className="font-medium">{l.sectionName || "Whole event"} — {l.user.name}{l.deviceName ? ` on ${l.deviceName}` : ""}</div>
+                      <div className="text-xs text-gray-500">Locked {when(l.lockedAt)} · list downloaded {when(l.snapshotAt)} · last sync {when(l.lastSyncAt)}</div>
+                    </div>
+                    <button onClick={() => forceRelease(l)} className="inline-flex items-center gap-1 px-2.5 py-1 text-xs rounded border hover:bg-gray-50 shrink-0" title="For a lost or flat device. If it reconnects later, its scans still sync and are flagged here.">
+                      <Unlock className="w-3.5 h-3.5" /> Force release
+                    </button>
+                  </li>
+                ))}
+              </ul>
+            )}
+          </section>
+
+          <section className="border rounded-xl p-4 bg-white shadow-sm">
+            <h2 className="font-semibold mb-2">Sync reports</h2>
+            {reports.length === 0 ? <p className="text-sm text-gray-500">{onlyOpen ? "Nothing needs review." : "No offline scans have been synced for this event."}</p> : (
+              <div className="space-y-3">
+                {reports.map(r => (
+                  <div key={r.id} className={`border rounded-lg p-3 ${r.reviewedAt ? "opacity-60" : ""}`}>
+                    <div className="flex items-center justify-between gap-3 text-sm">
+                      <div>
+                        <span className="font-medium">{when(r.createdAt)}</span> — {r.scanLock.user?.name}{r.scanLock.deviceName ? ` on ${r.scanLock.deviceName}` : ""}{r.scanLock.sectionName ? `, ${r.scanLock.sectionName}` : ""}
+                        <div className="text-xs text-gray-500">{r.accepted} scan(s) recorded{r.duplicates ? ` · ${r.duplicates} already synced` : ""}{r.afterForceRelease ? " · synced after the lock was force-released" : ""}</div>
+                      </div>
+                      {r.reviewedAt
+                        ? <span className="text-xs text-gray-500 inline-flex items-center gap-1"><CheckCircle2 className="w-3.5 h-3.5" /> Reviewed by {r.reviewedBy?.name}</span>
+                        : <button onClick={() => review(r)} className="px-2.5 py-1 text-xs rounded bg-brand-600 text-white hover:bg-brand-700 shrink-0">Mark reviewed</button>}
+                    </div>
+                    {r.conflicts.length > 0 && (
+                      <ul className="mt-2 text-xs space-y-1">
+                        {r.conflicts.map(c => (
+                          <li key={c.clientScanId} className="text-red-800">
+                            {new Date(c.scannedAt).toLocaleTimeString()} · ticket {String(c.qrCode).slice(0, 8)}… · {c.message}{c.redeemed ? ` (recorded ${c.redeemed} of ${c.qty})` : " (not recorded)"}
+                          </li>
+                        ))}
+                      </ul>
+                    )}
+                  </div>
+                ))}
+              </div>
+            )}
+          </section>
+        </div>
+      )}
+    </div>
+  );
+}
@@ -8,7 +8,7 @@ import { useStableState } from "@/hooks/useStableState";
 import { useVisiblePolling } from "@/hooks/useVisiblePolling";
 import {
  Calendar, Banknote, Gift, Users, Ticket, QrCode, DoorOpen, Wallet,
-  UserPlus, FileText, MessageCircle, BarChart2, Mail, TicketPercent,
+  UserPlus, FileText, MessageCircle, BarChart2, Mail, TicketPercent, ShieldCheck, ListChecks, WifiOff, BedDouble, Filter,
 } from "lucide-react";
 import { StatCard, StatCardRow } from "@/components/shared/StatCard";
 import { QuickActionTile, QuickActionGrid } from "@/components/shared/QuickActionTile";
@@ -24,6 +24,10 @@ const QUICK_ACTIONS = [
  { href: "/dashboard/supervisor/manual", label: "Manual registration", description: "Register a guest and issue tickets", icon: UserPlus },
  { href: "/dashboard/supervisor/events", label: "Manage events", description: "Create, edit, and update ticket types", icon: Calendar },
  { href: "/dashboard/supervisor/payments", label: "Payments & donations", description: "Manual payments and assignment", icon: Wallet },
+  { href: "/dashboard/supervisor/allocations", label: "Rooms & groups", description: "Put attendees into rooms, groups or buses", icon: BedDouble },
+  { href: "/dashboard/supervisor/offline-scans", label: "Offline scanning", description: "Devices scanning offline and their synced scans", icon: WifiOff },
+  { href: "/dashboard/supervisor/waitlist", label: "Waitlist", description: "People waiting for sold-out tickets", icon: ListChecks },
+  { href: "/dashboard/supervisor/consent", label: "Parental consent", description: "Youth events: consent status and medical list", icon: ShieldCheck },
  { href: "/dashboard/supervisor/coupons", label: "Coupon codes", description: "Discounts for staff, leaders and promotions", icon: TicketPercent },
  { href: "/dashboard/staff/ticket-scanning", label: "Open scanner", description: "Use your device camera to validate tickets", icon: QrCode },
  { href: "/dashboard/supervisor/at-the-door", label: "At the door", description: "Walk-ins, payments, ticket printing", icon: DoorOpen },
@@ -35,6 +39,7 @@ const QUICK_ACTIONS = [

 type OverviewMetric = { thisMonth: number; lastMonth: number; pctChange: number | null };
 type Overview = {
+  funnel?: { views: number; paid: number; conversion: number | null } | null;
  activeEvents: number;
  registrations: OverviewMetric;
  ticketsSold: OverviewMetric;
@@ -114,12 +119,15 @@ export default function SupervisorDashboardPage() {
        </div>
      )}

-      <StatCardRow>
+      <StatCardRow cols={overview?.funnel ? 6 : 5}>
        <StatCard icon={Calendar} label="Active events" value={overview ? formatCount(overview.activeEvents) : "—"} tone="brand" href="/dashboard/supervisor/events" linkLabel="View all events" />
        <StatCard icon={Banknote} label="Revenue (past month)" value={overview ? formatRand(overview.revenue.thisMonth) : "—"} tone="green" href={`${REPORTS_URL}?report=revenue&range=trailing_month`} linkLabel="View report" delta={overview ? { value: overview.revenue.pctChange } : undefined} />
        <StatCard icon={Gift} label="Donations (past month)" value={overview ? formatRand(overview.donations.thisMonth) : "—"} tone="rose" href={`${REPORTS_URL}?report=donations&range=trailing_month`} linkLabel="View report" delta={overview ? { value: overview.donations.pctChange } : undefined} />
        <StatCard icon={Users} label="Registrations (past month)" value={overview ? formatCount(overview.registrations.thisMonth) : "—"} tone="blue" href={`${REPORTS_URL}?report=regStatus&range=trailing_month`} linkLabel="View report" delta={overview ? { value: overview.registrations.pctChange } : undefined} />
        <StatCard icon={Ticket} label="Tickets sold (past month)" value={overview ? formatCount(overview.ticketsSold.thisMonth) : "—"} tone="amber" href={`${REPORTS_URL}?report=usage&range=trailing_month`} linkLabel="View report" delta={overview ? { value: overview.ticketsSold.pctChange } : undefined} />
+        {overview?.funnel && (
+          <StatCard icon={Filter} label="Conversion (past month)" value={overview.funnel.conversion != null ? `${overview.funnel.conversion}%` : "—"} tone="violet" href={`${REPORTS_URL}?report=funnel&range=trailing_month`} linkLabel={`${overview.funnel.paid} of ${overview.funnel.views} visits`} />
+        )}
      </StatCardRow>

      <div className="border rounded-xl p-4 bg-white shadow-sm my-6">
@@ -832,7 +832,7 @@ function PaymentsContent() {
                return (
                  <li key={p.id} className={`border rounded p-2 ${isRefund ? 'bg-red-50' : ''}`}>
                    <div className="flex justify-between">
-                      <div className={`font-medium ${isRefund ? 'text-red-700' : ''}`}>{isRefund ? '-' : ''}R {Math.abs(amt).toFixed(2)} {p.isDonation ? <span className="text-xs text-emerald-700">(donation)</span> : null} {isRefund ? <span className="text-xs text-red-700">(refund)</span> : null}</div>
+                      <div className={`font-medium ${isRefund ? 'text-red-700' : ''}`}>{isRefund ? '-' : ''}R {Math.abs(amt).toFixed(2)} {p.isDonation ? <span className="text-xs text-emerald-700">({p.isSponsorship ? 'sponsorship' : 'donation'})</span> : null} {isRefund ? <span className="text-xs text-red-700">(refund)</span> : null}</div>
                      <div className="text-xs text-gray-500">{new Date(p.createdAt).toLocaleString()}</div>
                    </div>
                    <div className="text-xs text-gray-600">Method: {p.method || 'payment'}</div>
@@ -1171,6 +1171,7 @@ function DonationAssignSection({ payments, allUsers, registrations, regOutstandi
  const [paymentId, setPaymentId] = useState<string>("");
  const [amountStr, setAmountStr] = useState<string>("");
  const [assigning, setAssigning] = useState(false);
+  const [sponsorshipsOnly, setSponsorshipsOnly] = useState(false);
  const [err, setErr] = useState<string | null>(null);

  useEffect(() => { setRegistrationId(""); setPaymentId(""); }, [userId]);
@@ -1219,10 +1220,11 @@ function DonationAssignSection({ payments, allUsers, registrations, regOutstandi
    return payments.filter((p: any) => {
      if (!p.isDonation || p.registrationId) return false;
      if (String(p.eventId) !== String(eventId)) return false;
+      if (sponsorshipsOnly && !p.isSponsorship) return false;
      const remaining = (p.amount || 0) - (legsById.get(p.id) || 0);
      return remaining > 0.000001;
    });
-  }, [payments, selectedRegistration, legsById]);
+  }, [payments, selectedRegistration, legsById, sponsorshipsOnly]);

  const selectedDonation = useMemo(
    () => payments.find((p: any) => String(p.id) === String(paymentId)),
@@ -1306,12 +1308,19 @@ function DonationAssignSection({ payments, allUsers, registrations, regOutstandi
          <option value="">Select donation…</option>
          {donationsForEvent.map((p: any) => {
            const remaining = (p.amount || 0) - (legsById.get(p.id) || 0);
-            const label = `R ${remaining.toFixed(2)} of R ${(p.amount || 0).toFixed(2)} left — ${p.user?.name || p.userId || 'Donor'} — #${String(p.id).slice(0,8)}`;
+            const donor = p.isSponsorship ? `Sponsorship: ${p.sponsorAnonymous ? 'anonymous' : (p.sponsorName || p.user?.name || 'sponsor')}` : (p.user?.name || p.userId || 'Donor');
+            const label = `R ${remaining.toFixed(2)} of R ${(p.amount || 0).toFixed(2)} left — ${donor} — #${String(p.id).slice(0,8)}`;
            return <option key={p.id} value={p.id} title={label}>{label}</option>;
          })}
        </select>
+        <label className="flex items-center gap-2 text-xs text-gray-600 cursor-pointer">
+          <input type="checkbox" checked={sponsorshipsOnly} onChange={e => { setSponsorshipsOnly(e.target.checked); setPaymentId(""); }} /> Only the sponsorship pool
+        </label>
        {registrationId && donationsForEvent.length === 0 && (
-          <div className="text-xs text-gray-500">No donations with a remaining balance for this event.</div>
+          <div className="text-xs text-gray-500">No {sponsorshipsOnly ? "sponsorships" : "donations"} with a remaining balance for this event.</div>
+        )}
+        {selectedDonation?.isSponsorship && selectedDonation.sponsorMessage && (
+          <div className="text-xs text-rose-800 bg-rose-50 rounded p-2">Sponsor&apos;s message: “{selectedDonation.sponsorMessage}”</div>
        )}

        {selectedDonation && (
@@ -0,0 +1,190 @@
+"use client";
+
+import React, { useCallback, useEffect, useMemo, useState } from "react";
+import { useAuth } from "@/hooks/useAuth";
+import { useRouter, useSearchParams } from "next/navigation";
+import { apiFetch } from "@/lib/api";
+import { formatDate } from "@/lib/date";
+import { useDismissingState } from "@/hooks/useDismissingState";
+import { ListChecks, ArrowUp, ArrowDown } from "lucide-react";
+import { Table, TableHeader, TableBody, TableRow, TableHead, TableCell } from "@/components/ui/table";
+
+type Entry = {
+  id: string;
+  position: number;
+  quantity: number;
+  offeredQuantity: number | null;
+  offerExpiresAt: string | null;
+  status: "waiting" | "offered" | "claimed" | "expired" | "removed" | "left";
+  createdAt: string;
+  eventOption: { name: string };
+  variant: { name: string } | null;
+  user: { name: string; email: string; phoneNumber: string | null };
+};
+
+const STATUS: Record<Entry["status"], { label: string; cls: string }> = {
+  waiting: { label: "Waiting", cls: "bg-gray-100 text-gray-700" },
+  offered: { label: "Offered", cls: "bg-amber-100 text-amber-800" },
+  claimed: { label: "Claimed", cls: "bg-green-100 text-green-800" },
+  expired: { label: "Offer expired", cls: "bg-red-100 text-red-800" },
+  removed: { label: "Removed", cls: "bg-gray-100 text-gray-500" },
+  left: { label: "Left", cls: "bg-gray-100 text-gray-500" },
+};
+
+export default function WaitlistPage() {
+  const { user, loading, token } = useAuth();
+  const router = useRouter();
+  const search = useSearchParams();
+  const canView = useMemo(() => ["admin", "supervisor", "staff"].includes(user?.role || ""), [user]);
+  const canManage = user?.role === "admin" || user?.role === "supervisor";
+
+  useEffect(() => {
+    if (loading) return;
+    if (!user) router.replace("/login");
+  }, [user, loading, router]);
+
+  const [events, setEvents] = useState<any[]>([]);
+  const [eventId, setEventId] = useState(search.get("eventId") || "");
+  const [entries, setEntries] = useState<Entry[]>([]);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useDismissingState<string | null>(null);
+  const [info, setInfo] = useDismissingState<string | null>(null);
+
+  useEffect(() => {
+    if (!token || !canView) return;
+    apiFetch<any[]>("/api/events/all", { authToken: token })
+      .then(evs => {
+        const withList = (evs || []).filter(e => e.waitlistEnabled);
+        setEvents(withList);
+        if (!eventId && withList.length) setEventId(withList[0].id);
+      })
+      .catch(e => setError(e?.message || "Failed to load events"));
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [token, canView]);
+
+  const load = useCallback(async () => {
+    if (!token || !eventId) return;
+    setBusy(true);
+    try {
+      setEntries(await apiFetch<Entry[]>(`/api/waitlist/events/${encodeURIComponent(eventId)}`, { authToken: token }));
+    } catch (e: any) {
+      setError(e?.message || "Failed to load the waitlist");
+    } finally {
+      setBusy(false);
+    }
+  }, [token, eventId, setError]);
+  useEffect(() => { load(); }, [load]);
+
+  const act = async (path: string, body?: any) => {
+    setBusy(true);
+    try {
+      const res = await apiFetch<{ message?: string }>(path, { method: "POST", authToken: token!, body });
+      if (res?.message) setInfo(res.message);
+      await load();
+    } catch (e: any) {
+      setError(e?.message || "Something went wrong");
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  const waitingCount = entries.filter(e => e.status === "waiting").length;
+  const selected = events.find(e => e.id === eventId);
+
+  return (
+    <div className="max-w-6xl mx-auto w-full p-6">
+      <div className="flex items-center gap-3 mb-4">
+        <div className="w-10 h-10 rounded-xl bg-brand-50 flex items-center justify-center shrink-0">
+          <ListChecks className="w-5 h-5 text-brand-600" />
+        </div>
+        <div>
+          <button className="text-xs text-brand-600 hover:underline" onClick={() => router.push("/dashboard")}>← Back to dashboard</button>
+          <h1 className="text-2xl font-semibold text-gray-900 mt-0.5">Waitlist</h1>
+          <p className="text-sm text-gray-500">People waiting for sold-out tickets</p>
+        </div>
+      </div>
+
+      {!canView && <div className="p-3 border rounded bg-yellow-50 text-yellow-800 text-sm mb-4">You need staff access to view the waitlist.</div>}
+      {error && <div className="mb-3 p-3 border rounded bg-red-50 text-red-800 text-sm">{error}</div>}
+      {info && <div className="mb-3 p-3 border rounded bg-green-50 text-green-800 text-sm">{info}</div>}
+
+      {canView && (
+        <div className="border rounded-xl p-4 bg-white shadow-sm">
+          <div className="flex flex-wrap items-end gap-3 mb-4">
+            <div>
+              <label className="block text-xs text-gray-600 mb-1">Event</label>
+              <select className="border rounded-lg px-3 py-2 text-sm min-w-[16rem]" value={eventId} onChange={e => setEventId(e.target.value)}>
+                {events.length === 0 && <option value="">No events with a waitlist</option>}
+                {events.map(ev => <option key={ev.id} value={ev.id}>{ev.title} ({formatDate(new Date(ev.startDate))})</option>)}
+              </select>
+            </div>
+            {selected && (
+              <p className="text-xs text-gray-500">
+                {waitingCount} waiting · offers are held for {selected.waitlistOfferHours} hours · {selected.waitlistPartialOffers ? "partial offers on" : "only whole requests offered"}.
+                Turn the waitlist on or off in the event&apos;s Visibility step.
+              </p>
+            )}
+          </div>
+
+          <div className="overflow-x-auto">
+            <Table>
+              <TableHeader>
+                <TableRow>
+                  <TableHead>#</TableHead>
+                  <TableHead>Person</TableHead>
+                  <TableHead>Ticket</TableHead>
+                  <TableHead>Qty</TableHead>
+                  <TableHead>Joined</TableHead>
+                  <TableHead>Status</TableHead>
+                  {canManage && <TableHead className="text-right">Actions</TableHead>}
+                </TableRow>
+              </TableHeader>
+              <TableBody>
+                {entries.map((e, i) => {
+                  const st = STATUS[e.status];
+                  const active = e.status === "waiting" || e.status === "offered";
+                  return (
+                    <TableRow key={e.id} className={active ? "" : "opacity-60"}>
+                      <TableCell className="text-sm text-gray-500">{i + 1}</TableCell>
+                      <TableCell>
+                        <div className="text-sm font-medium">{e.user.name}</div>
+                        <div className="text-xs text-gray-500">{[e.user.email, e.user.phoneNumber].filter(Boolean).join(" · ")}</div>
+                      </TableCell>
+                      <TableCell className="text-sm">{e.eventOption.name}{e.variant ? ` (${e.variant.name})` : ""}</TableCell>
+                      <TableCell className="text-sm">{e.quantity}{e.status === "offered" && e.offeredQuantity !== e.quantity ? ` (${e.offeredQuantity} offered)` : ""}</TableCell>
+                      <TableCell className="text-xs text-gray-600">{formatDate(new Date(e.createdAt))}</TableCell>
+                      <TableCell>
+                        <span className={`text-xs px-2 py-0.5 rounded-full font-medium ${st.cls}`}>{st.label}</span>
+                        {e.status === "offered" && e.offerExpiresAt && <div className="text-xs text-gray-500 mt-1">until {new Date(e.offerExpiresAt).toLocaleString()}</div>}
+                      </TableCell>
+                      {canManage && (
+                        <TableCell className="text-right whitespace-nowrap">
+                          {e.status === "waiting" && (
+                            <>
+                              <button disabled={busy} onClick={() => act(`/api/waitlist/${e.id}/move`, { direction: "up" })} className="p-1 rounded border hover:bg-gray-50 mr-1" aria-label="Move up"><ArrowUp className="w-3.5 h-3.5" /></button>
+                              <button disabled={busy} onClick={() => act(`/api/waitlist/${e.id}/move`, { direction: "down" })} className="p-1 rounded border hover:bg-gray-50 mr-1" aria-label="Move down"><ArrowDown className="w-3.5 h-3.5" /></button>
+                            </>
+                          )}
+                          {(e.status === "waiting" || e.status === "expired") && (
+                            <button disabled={busy} onClick={() => act(`/api/waitlist/${e.id}/offer`)} className="px-2 py-1 text-xs rounded bg-brand-600 text-white hover:bg-brand-700 mr-1" title="Offer now, even if no place has freed up">Offer place</button>
+                          )}
+                          {active && (
+                            <button disabled={busy} onClick={() => act(`/api/waitlist/${e.id}/remove`)} className="px-2 py-1 text-xs rounded border hover:bg-gray-50">Remove</button>
+                          )}
+                        </TableCell>
+                      )}
+                    </TableRow>
+                  );
+                })}
+                {!busy && entries.length === 0 && (
+                  <TableRow><TableCell colSpan={7} className="text-center text-sm text-gray-500 py-8">{eventId ? "Nobody is on the waitlist." : "Pick an event."}</TableCell></TableRow>
+                )}
+              </TableBody>
+            </Table>
+          </div>
+          <p className="text-xs text-gray-500 mt-3">When places free up (a cancellation, a smaller booking, or a higher stock limit), the next people are offered them automatically. &quot;Offer place&quot; sends an offer straight away, even if it means going over the stock limit.</p>
+        </div>
+      )}
+    </div>
+  );
+}
@@ -6,6 +6,7 @@ import { useRouter, useSearchParams } from "next/navigation";
 import { apiFetch, fetchAllUsers } from "@/lib/api";
 import { useDismissingState } from "@/hooks/useDismissingState";
 import { MessageCircle, Users, Zap, Send, Clock, type LucideIcon } from "lucide-react";
+import { AllocationGroupFilter } from "@/components/shared/AllocationGroupFilter";

 // Attendee with preference info
 type Attendee = { id: string; name: string; phone: string; pref: string };
@@ -402,6 +403,7 @@ function WhatsAppAttendeesPageInner() {
  const [message, setMessage] = useState("");
  const [messageDirty, setMessageDirty] = useState(false);
  const [status, setStatus] = useState<"any" | "paid" | "unpaid" | "partial_paid" | "cancelled">("any");
+  const [groupId, setGroupId] = useState("");
  const [attendees, setAttendees] = useState<Attendee[]>([]);
  const [selectedAttendeeIds, setSelectedAttendeeIds] = useState<string[]>([]);
  const [loadingAttendees, setLoadingAttendees] = useState(false);
@@ -449,7 +451,7 @@ function WhatsAppAttendeesPageInner() {

  const buildPayload = (dryRun?: boolean) => {
    const payload: any = {
-      filter: { status: status !== "any" ? status : undefined, attendeeIds: selectedAttendeeIds.length ? selectedAttendeeIds : undefined },
+      filter: { status: status !== "any" ? status : undefined, attendeeIds: selectedAttendeeIds.length ? selectedAttendeeIds : undefined, allocationGroupId: groupId || undefined },
      template: templateKey,
      dryRun: dryRun || undefined,
    };
@@ -499,7 +501,7 @@ function WhatsAppAttendeesPageInner() {
      const whenIso = new Date(scheduledAtLocal).toISOString();
      const payload: any = {
        message: message || undefined,
-        filter: { status: status !== "any" ? status : undefined, attendeeIds: selectedAttendeeIds.length ? selectedAttendeeIds : undefined },
+        filter: { status: status !== "any" ? status : undefined, attendeeIds: selectedAttendeeIds.length ? selectedAttendeeIds : undefined, allocationGroupId: groupId || undefined },
        template: templateKey, scheduledAt: whenIso,
      };
      const res = await apiFetch(`/api/events/${encodeURIComponent(eventId)}/whatsapp-attendees/schedule`, { method: "POST", authToken: token, body: payload });
@@ -715,6 +717,7 @@ function WhatsAppAttendeesPageInner() {
                  <option value="cancelled">Cancelled</option>
                </select>
              </div>
+              <AllocationGroupFilter token={token} eventId={eventId} value={groupId} onChange={setGroupId} />
            </div>

            {templateKey !== "tickets" ? (
@@ -1,4 +1,5 @@
 "use client";
+import { ExtraFieldInput, isExtraFieldType } from "@/components/shared/FormFieldExtras";
 import React, { Suspense, useEffect, useMemo, useState } from "react";
 import { useSearchParams, useRouter } from "next/navigation";
 import { useAuth } from "@/hooks/useAuth";
@@ -7,7 +8,7 @@ import { useDismissingState } from "@/hooks/useDismissingState";
 import { FileText } from "lucide-react";

 // Types for form fields
-type FormField = { id: string; type: 'yes_no'|'text'|'date'|'numeric'|'statement'|'paragraph'; label: string; isRequired?: boolean; helpText?: string|null };
+type FormField = { id: string; type: 'yes_no'|'text'|'date'|'numeric'|'statement'|'paragraph'|'rating'|'multiple_choice'; label: string; isRequired?: boolean; helpText?: string|null; options?: unknown };

 function FormsContent() {
  const search = useSearchParams();
@@ -198,7 +199,9 @@ function FormsContent() {
                    ) : (
                      <>
                        <label className="block text-xs text-gray-600 mb-1">{f.label}{f.isRequired ? ' *' : ''}</label>
-                        {f.type === 'yes_no' ? (
+                        {isExtraFieldType(f.type) ? (
+                          <ExtraFieldInput field={f} idPrefix={`a${idx}`} value={formsData[idx]?.[f.id] || ''} onChange={v => setFormsData(prev => ({ ...prev, [idx]: { ...(prev[idx]||{}), [f.id]: v } }))} />
+                        ) : f.type === 'yes_no' ? (
                          <select className="border rounded px-2 py-1 text-sm" value={formsData[idx]?.[f.id] || ''} onChange={e => setFormsData(prev => ({ ...prev, [idx]: { ...(prev[idx]||{}), [f.id]: e.target.value } }))}>
                            <option value="">Select</option>
                            <option value="yes">Yes</option>
@@ -9,6 +9,8 @@ import { QrImage } from "@/components/shared/QrImage";
 import { ApiImage } from "@/components/shared/ApiImage";
 import { useDismissingState } from "@/hooks/useDismissingState";
 import { AttendeesPanel } from "@/components/shared/AttendeesPanel";
+import { MyWaitlists } from "@/components/shared/MyWaitlists";
+import { TransferTicketModal, canOfferTransfer } from "@/components/shared/TransferTicketModal";
 import { ClipboardList, Calendar, Ticket, ChevronRight } from "lucide-react";

 // Helper formatters
@@ -533,6 +535,8 @@ export default function UserDashboardPage() {
    }
  };

+  const [transferTarget, setTransferTarget] = useState<any | null>(null);
+
  // Re-fetch registrations and tickets after something on one changes (attendee names).
  const reloadAfterAttendees = async () => {
    if (!token) return;
@@ -871,6 +875,12 @@ export default function UserDashboardPage() {
        )}
      </section>

+      {token && (
+        <div className="mb-6">
+          <MyWaitlists token={token} onMessage={setInfo} />
+        </div>
+      )}
+
      <div className="grid lg:grid-cols-2 gap-6">
      <section className="mb-8 border rounded-xl p-5 bg-white shadow-sm">
        <div className="flex items-center gap-2 mb-3">
@@ -985,6 +995,11 @@ export default function UserDashboardPage() {
                  <div className="text-xs font-medium text-blue-700 bg-blue-50 rounded px-2 py-0.5 inline-block">
                    {t.attendee?.name ? <>For: {t.attendee.name}</> : <>Qty: {t.quantity || 1}</>}
                  </div>
+                  {(t.attendee?.allocations || []).length > 0 && (
+                    <div className="text-xs text-violet-800 bg-violet-50 rounded px-2 py-0.5 inline-block ml-1">
+                      {[...t.attendee.allocations].sort((a: any, b: any) => (a.set?.order || 0) - (b.set?.order || 0)).map((a: any) => `${a.set.name}: ${a.group.name}`).join(" · ")}
+                    </div>
+                  )}
                  {t.userId && user?.id && t.userId !== user.id && t.user?.name && (
                    <div className="text-xs text-gray-500">Booked by {t.user.name}</div>
                  )}
@@ -996,6 +1011,9 @@ export default function UserDashboardPage() {
                      <button onClick={() => whatsappTickets([t.id])} className="px-3 py-1.5 text-sm bg-green-600 text-white rounded hover:bg-green-700 shadow-sm focus:outline-none focus:ring-2 focus:ring-green-500 focus:ring-offset-1">WhatsApp</button>
                    )}
                    <button onClick={() => printTickets([t])} className="px-3 py-1.5 text-sm rounded bg-gray-100 hover:bg-gray-200 text-gray-800 shadow-sm focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-1">Print</button>
+                    {canOfferTransfer(t, t.event) && (
+                      <button onClick={() => setTransferTarget(t)} className="px-3 py-1.5 text-sm rounded border border-gray-300 hover:bg-gray-100 text-gray-800 shadow-sm focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-1" title="Give this ticket to someone else">Transfer</button>
+                    )}
                  </div>
                </li>
              );
@@ -1005,6 +1023,16 @@ export default function UserDashboardPage() {
      </section>
      </div>

+      {transferTarget && token && (
+        <TransferTicketModal
+          ticket={transferTarget}
+          event={transferTarget.event}
+          token={token}
+          onClose={() => setTransferTarget(null)}
+          onDone={(msg) => { setTransferTarget(null); setInfo(msg); reloadAfterAttendees(); }}
+        />
+      )}
+
      {activeReg && (
        <div className="fixed inset-0 bg-black/40 flex items-center justify-center z-50" onClick={() => { setEditMode(false); setEditError(null); setShowCancelConfirm(false); setActiveRegId(null); }}>
          <div className="bg-white rounded-lg shadow-lg max-w-xl w-full mx-4 p-5 max-h-[90vh] overflow-y-auto" onClick={e => e.stopPropagation()}>
@@ -5,6 +5,9 @@ import { Footer } from "@/components/layout/Footer";
 import ClientActions from "@/app/events/[id]/ClientActions";
 import { ContactButton } from "@/components/events/ContactButton";
 import { LocationMap } from "@/components/events/LocationMap";
+import { JoinWaitlistButton, soldOutLines } from "@/components/events/JoinWaitlistButton";
+import { SponsorSpot } from "@/components/events/SponsorSpot";
+import { FunnelTracker } from "@/components/events/FunnelTracker";
 import { Calendar, Ticket, Paperclip, Sparkles } from "lucide-react";

 export const revalidate = 60;
@@ -40,6 +43,8 @@ type Event = {
  contactPhone?: string | null;
  contactEmail?: string | null;
  location?: string | null;
+  waitlistEnabled?: boolean;
+  allowSponsorships?: boolean;
 };

 import { apiFetch, ApiError, resolveToApiOrigin } from "@/lib/api";
@@ -93,6 +98,14 @@ function RegisterCta({ event }: { event: Event }) {
    );
  }
  if (eventSoldOut) {
+    if (event.waitlistEnabled) {
+      return (
+        <div className="space-y-2">
+          <div className="text-center text-sm font-medium text-red-700">Sold out</div>
+          <JoinWaitlistButton eventId={event.id} lines={soldOutLines(event.eventOptions || [])} guestsAllowed={event.requiresAuth === false} />
+        </div>
+      );
+    }
    return (
      <button disabled className="w-full bg-red-50 text-red-700 border border-red-200 px-4 py-2.5 rounded-lg cursor-not-allowed font-medium">
        Sold Out
@@ -154,6 +167,7 @@ export default async function EventDetailPage({ params }: { params: Promise<{ id
    <div className="min-h-screen flex flex-col">
      <Navbar />
      <main className="flex-1 py-8 px-4 max-w-6xl mx-auto w-full">
+        <FunnelTracker eventId={event.id} stage="view" />
        <div className="grid lg:grid-cols-3 gap-8">
          <div className="lg:col-span-2 space-y-6">
            {event.picture ? (
@@ -212,6 +226,7 @@ export default async function EventDetailPage({ params }: { params: Promise<{ id
              <div className="mt-4">
                <RegisterCta event={event} />
              </div>
+              {event.allowSponsorships && <SponsorSpot eventId={event.id} eventTitle={event.title} />}
            </div>
          </div>

@@ -225,6 +240,7 @@ export default async function EventDetailPage({ params }: { params: Promise<{ id
              <div className="mt-4">
                <RegisterCta event={event} />
              </div>
+              {event.allowSponsorships && <SponsorSpot eventId={event.id} eventTitle={event.title} />}
            </div>
          </div>
        </div>
@@ -0,0 +1,130 @@
+"use client";
+import React, { useEffect, useState } from "react";
+import { useParams } from "next/navigation";
+import { Navbar } from "@/components/layout/Navbar";
+import { Footer } from "@/components/layout/Footer";
+import { apiFetch } from "@/lib/api";
+import { formatDate } from "@/lib/date";
+import { MessageSquareHeart, CheckCircle2 } from "lucide-react";
+import { ExtraFieldInput, isExtraFieldType } from "@/components/shared/FormFieldExtras";
+
+type Field = { id: string; type: string; label: string; isRequired: boolean; helpText: string | null; options: unknown };
+type FeedbackInfo = {
+  event: { title: string; startDate: string };
+  name: string;
+  intro: string | null;
+  anonymous: boolean;
+  responded: boolean;
+  fields: Field[];
+};
+
+const inputCls = "w-full border rounded-lg px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-brand-400";
+
+/** Public page an attendee opens from their post-event feedback email or WhatsApp. */
+export default function FeedbackPage() {
+  const params = useParams<{ token: string }>();
+  const token = params?.token;
+  const [info, setInfo] = useState<FeedbackInfo | null>(null);
+  const [loadError, setLoadError] = useState<string | null>(null);
+  const [answers, setAnswers] = useState<Record<string, string>>({});
+  const [error, setError] = useState<string | null>(null);
+  const [busy, setBusy] = useState(false);
+  const [done, setDone] = useState(false);
+
+  useEffect(() => {
+    if (!token) return;
+    apiFetch<FeedbackInfo>(`/api/feedback/public/${encodeURIComponent(token)}`)
+      .then(setInfo)
+      .catch(e => setLoadError(e?.message || "This feedback link isn't valid."));
+  }, [token]);
+
+  const set = (id: string, v: string) => setAnswers(prev => ({ ...prev, [id]: v }));
+  const submit = async (e: React.FormEvent) => {
+    e.preventDefault();
+    setBusy(true);
+    setError(null);
+    try {
+      await apiFetch(`/api/feedback/public/${encodeURIComponent(token!)}`, { method: "POST", body: { answers } });
+      setDone(true);
+    } catch (err: any) {
+      setError(err?.message || "Couldn't send your feedback");
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  return (
+    <div className="min-h-screen flex flex-col bg-gray-50">
+      <Navbar />
+      <main className="flex-1 max-w-2xl w-full mx-auto p-4 sm:p-6">
+        <div className="flex items-center gap-3 mb-4">
+          <div className="w-10 h-10 rounded-xl bg-brand-50 flex items-center justify-center shrink-0">
+            <MessageSquareHeart className="w-5 h-5 text-brand-600" />
+          </div>
+          <div>
+            <h1 className="text-2xl font-semibold text-gray-900">{info ? `How was ${info.event.title}?` : "Feedback"}</h1>
+            {info && <p className="text-sm text-gray-500">{formatDate(new Date(info.event.startDate))}</p>}
+          </div>
+        </div>
+
+        {loadError && <div className="p-4 border rounded-xl bg-white text-sm text-gray-700">{loadError}</div>}
+
+        {info && (done || info.responded) && (
+          <div className="p-5 border rounded-xl bg-white shadow-sm flex items-start gap-3">
+            <CheckCircle2 className="w-6 h-6 text-green-600 shrink-0" />
+            <div>
+              <div className="font-semibold">Thank you{info.name ? `, ${info.name.split(" ")[0]}` : ""}!</div>
+              <p className="text-sm text-gray-600">{done ? "Your feedback has been sent." : "You've already given feedback for this event."} It really helps us plan the next one.</p>
+            </div>
+          </div>
+        )}
+
+        {info && !done && !info.responded && (
+          <form onSubmit={submit} className="p-5 border rounded-xl bg-white shadow-sm space-y-5">
+            {info.intro && <p className="text-sm text-gray-700 whitespace-pre-line">{info.intro}</p>}
+            <p className="text-xs text-gray-500">{info.anonymous ? "Your answers are anonymous — they aren't linked to your name." : `Answering as ${info.name}.`}</p>
+            {info.fields.map(f => (
+              <div key={f.id}>
+                {f.type === "statement" ? (
+                  <p className="text-sm text-gray-700 whitespace-pre-line">{f.label}</p>
+                ) : f.type === "paragraph" ? (
+                  <div className="text-sm text-gray-700">
+                    <div className="font-medium mb-1">{f.label}</div>
+                    {f.helpText && <div className="whitespace-pre-line">{f.helpText}</div>}
+                  </div>
+                ) : (
+                  <>
+                    <label className="block text-sm font-medium text-gray-800 mb-1.5">{f.label}{f.isRequired && <span className="text-red-500"> *</span>}</label>
+                    {isExtraFieldType(f.type) ? (
+                      <ExtraFieldInput field={f} value={answers[f.id] || ""} onChange={v => set(f.id, v)} />
+                    ) : f.type === "yes_no" ? (
+                      <div className="flex gap-4 text-sm">
+                        {["yes", "no"].map(v => (
+                          <label key={v} className="flex items-center gap-1.5 cursor-pointer">
+                            <input type="radio" name={f.id} checked={answers[f.id] === v} onChange={() => set(f.id, v)} /> {v === "yes" ? "Yes" : "No"}
+                          </label>
+                        ))}
+                      </div>
+                    ) : f.type === "numeric" ? (
+                      <input type="number" className={`${inputCls} sm:w-40`} value={answers[f.id] || ""} onChange={e => set(f.id, e.target.value)} />
+                    ) : f.type === "date" ? (
+                      <input type="date" className={`${inputCls} sm:w-48`} value={answers[f.id] || ""} onChange={e => set(f.id, e.target.value)} />
+                    ) : (
+                      <textarea className={inputCls} rows={3} value={answers[f.id] || ""} onChange={e => set(f.id, e.target.value)} maxLength={4000} />
+                    )}
+                    {f.helpText && <p className="text-xs text-gray-500 mt-1">{f.helpText}</p>}
+                  </>
+                )}
+              </div>
+            ))}
+            {error && <div className="p-2 rounded bg-red-50 text-red-800 text-sm">{error}</div>}
+            <button type="submit" disabled={busy} className="px-4 py-2 rounded-lg bg-brand-600 text-white hover:bg-brand-700 disabled:opacity-50 font-medium">
+              {busy ? "Sending…" : "Send feedback"}
+            </button>
+          </form>
+        )}
+      </main>
+      <Footer />
+    </div>
+  );
+}
@@ -1,4 +1,5 @@
 "use client";
+import { ExtraFieldInput, isExtraFieldType } from "@/components/shared/FormFieldExtras";
 import React, { Suspense, useEffect, useMemo, useState } from "react";
 import { useSearchParams, useRouter } from "next/navigation";
 import { useAuth } from "@/hooks/useAuth";
@@ -8,7 +9,7 @@ import { Footer } from "@/components/layout/Footer";
 import { FileText } from "lucide-react";

 // Types for form fields
-type FormField = { id: string; type: 'yes_no'|'text'|'date'|'numeric'|'statement'|'paragraph'; label: string; isRequired?: boolean; helpText?: string|null };
+type FormField = { id: string; type: 'yes_no'|'text'|'date'|'numeric'|'statement'|'paragraph'|'rating'|'multiple_choice'; label: string; isRequired?: boolean; helpText?: string|null; options?: unknown };

 function FormsContent() {
  const search = useSearchParams();
@@ -249,7 +250,9 @@ function FormsContent() {
                    ) : (
                      <>
                        <label className="block text-xs text-gray-600 mb-1">{f.label}{f.isRequired ? ' *' : ''}</label>
-                        {f.type === 'yes_no' ? (
+                        {isExtraFieldType(f.type) ? (
+                          <ExtraFieldInput field={f} idPrefix={`a${idx}`} value={formsData[idx]?.[f.id] || ''} onChange={v => setFormsData(prev => ({ ...prev, [idx]: { ...(prev[idx]||{}), [f.id]: v } }))} />
+                        ) : f.type === 'yes_no' ? (
                          <select className="border rounded px-2 py-1 text-sm" value={formsData[idx]?.[f.id] || ''} onChange={e => setFormsData(prev => ({ ...prev, [idx]: { ...(prev[idx]||{}), [f.id]: e.target.value } }))}>
                            <option value="">Select</option>
                            <option value="yes">Yes</option>
@@ -8,6 +8,8 @@ import { ToastProvider } from "@/components/shared/ToastProvider";
 import { BannerBar } from "@/components/shared/BannerBar";
 import { SetupGuard } from "@/components/shared/SetupGuard";
 import HelpFab from "@/components/shared/HelpFab";
+import { CookieConsent } from "@/components/shared/CookieConsent";
+import { ImpersonationBanner } from "@/components/shared/ImpersonationBanner";
 import { API_BASE, resolveToApiOrigin } from "@/lib/api";
 import { buildThemeCssVars } from "@/lib/colorScale";
 import { appUrl } from "@/lib/siteConfig";
@@ -93,9 +95,11 @@ export default async function RootLayout({ children }: { children: React.ReactNo
                    <AuthProvider>
                        <ToastProvider>
                            <SetupGuard />
+                            <ImpersonationBanner />
                            <BannerBar />
                            {children}
                            <HelpFab />
+                            <CookieConsent />
                        </ToastProvider>
                    </AuthProvider>
                </SiteSettingsProvider>
@@ -192,6 +192,7 @@ function Section({
        ],
        cookies: [
            "This website uses browser localStorage to store your login session token and user interface preferences (such as dismissed notifications). No third-party cookies, tracking pixels, or analytics tools are used.",
+            "If you choose \"Allow\" on the cookie notice, we also keep a random, anonymous visit identifier so we can count, in our own statistics, how many visitors view an event, start registering, and complete a registration. We record only that step, where the visit came from (for example a short link) and the type of device — never your name, IP address or browsing history. Detailed records are combined into daily totals after 90 days. If you choose \"No thanks\", nothing is counted.",
            "You can clear your browser's local storage at any time through your browser settings, which will log you out of the site.",
        ],
        security: [
@@ -0,0 +1,17 @@
+import type { MetadataRoute } from "next";
+
+// Lets staff "Add to home screen" and open the ticket scanner like an app (it also
+// works offline once offline mode has been enabled — see public/sw.js).
+export default function manifest(): MetadataRoute.Manifest {
+  return {
+    name: "Ticket scanner",
+    short_name: "Scanner",
+    description: "Scan event tickets, online or offline",
+    start_url: "/dashboard/staff/ticket-scanning",
+    scope: "/",
+    display: "standalone",
+    background_color: "#ffffff",
+    theme_color: "#4F46E5",
+    icons: [{ src: "/favicon.ico", sizes: "any", type: "image/x-icon" }],
+  };
+}
@@ -4,7 +4,9 @@ import React, { useEffect, useMemo, useState } from "react";
 import { useAuth } from "@/hooks/useAuth";
 import { apiFetch } from "@/lib/api";
 import { CouponCodeField, AppliedCoupon } from "@/components/shared/CouponCodeField";
-import { AttendeeNamesEditor, AttendeeEntries, TicketDelivery, attendeesPayload } from "@/components/shared/AttendeeNamesEditor";
+import { AttendeeNamesEditor, AttendeeEntries, TicketDelivery, attendeesPayload, consentDetailsMissing } from "@/components/shared/AttendeeNamesEditor";
+import { JoinWaitlistButton } from "@/components/events/JoinWaitlistButton";
+import { analyticsSessionId } from "@/lib/analytics";

 // Tiered low-stock threshold — mirrors events/[id]/page.tsx
 function lowStockThreshold(stockLimit: number): number {
@@ -42,8 +44,13 @@ type Event = {
  form?: { isRequired: boolean; fields?: any[] } | null;
  requiresAuth?: boolean;
  allowNamedAttendees?: boolean;
+  requiresParentalConsent?: boolean;
+  collectGender?: boolean;
+  waitlistEnabled?: boolean;
 };

+type WaitlistOffer = { eventOptionId: string; variantId: string | null; quantity: number; expiresAt: string; optionName: string; variantName: string | null };
+
 // Key format: "optionId" for no-variant options, "optionId:variantId" for variant options
 type QtyMap = Record<string, number>;

@@ -127,10 +134,12 @@ function OptionCard({
  opt,
  quantities,
  onQtyChange,
+  waitlist,
 }: {
  opt: EventOption;
  quantities: QtyMap;
  onQtyChange: (key: string, val: number) => void;
+  waitlist?: { eventId: string; guestsAllowed: boolean } | null;
 }) {
  const hasVariants = Array.isArray(opt.variants) && opt.variants.length > 0;
  const isSoldOut = (opt.stockLimit ?? 0) > 0 && opt.availableCount !== undefined && opt.availableCount <= 0;
@@ -154,7 +163,13 @@ function OptionCard({
          </div>
          <div className="flex items-center gap-2">
            {isSoldOut ? (
-              <span className="text-xs font-medium text-red-600 bg-red-50 border border-red-200 rounded px-1.5 py-0.5">Sold out</span>
+              <>
+                <span className="text-xs font-medium text-red-600 bg-red-50 border border-red-200 rounded px-1.5 py-0.5">Sold out</span>
+                {waitlist && (
+                  <JoinWaitlistButton compact eventId={waitlist.eventId} guestsAllowed={waitlist.guestsAllowed}
+                    lines={variants.map(v => ({ eventOptionId: opt.id, variantId: v.id, label: `${opt.name} (${v.name})` }))} />
+                )}
+              </>
            ) : (
              <StockBadge stockLimit={opt.stockLimit} availableCount={opt.availableCount} />
            )}
@@ -178,6 +193,10 @@ function OptionCard({
                  <span className="text-sm">{variant.name}</span>
                  <span className="text-xs text-gray-500">R{unitPrice.toFixed(2)}</span>
                  <StockBadge stockLimit={variant.stockLimit} availableCount={variant.availableCount} />
+                  {waitlist && variantSoldOut && !isSoldOut && (
+                    <JoinWaitlistButton compact eventId={waitlist.eventId} guestsAllowed={waitlist.guestsAllowed}
+                      lines={[{ eventOptionId: opt.id, variantId: variant.id, label: `${opt.name} (${variant.name})` }]} />
+                  )}
                </div>
                <QtyControl
                  value={qty}
@@ -218,6 +237,9 @@ function OptionCard({
            <span>R{price.toFixed(2)}</span>
          )}
          <StockBadge stockLimit={opt.stockLimit} availableCount={opt.availableCount} />
+          {waitlist && isSoldOut && (
+            <JoinWaitlistButton compact eventId={waitlist.eventId} guestsAllowed={waitlist.guestsAllowed} lines={[{ eventOptionId: opt.id, label: opt.name }]} />
+          )}
        </div>
      </div>
      <QtyControl
@@ -230,9 +252,41 @@ function OptionCard({
  );
 }

-export default function RegisterForm({ event }: { event: Event }) {
+export default function RegisterForm({ event: baseEvent }: { event: Event }) {
  const { token, user } = useAuth();
-  const eventId = event.id;
+  const eventId = baseEvent.id;
+
+  // A waitlist claim link (?waitlist=<token>): the places held for this person are
+  // added back to what's available, so they can choose them.
+  const [waitlistToken, setWaitlistToken] = useState<string | null>(null);
+  const [offer, setOffer] = useState<WaitlistOffer | null>(null);
+  const [offerError, setOfferError] = useState<string | null>(null);
+  useEffect(() => {
+    const t = new URLSearchParams(window.location.search).get("waitlist");
+    if (!t) return;
+    apiFetch<WaitlistOffer & { status: string }>(`/api/waitlist/claim/${encodeURIComponent(t)}`)
+      .then(res => {
+        if (res.status !== "offered") { setOfferError("This waitlist offer has expired."); return; }
+        setWaitlistToken(t);
+        setOffer(res);
+        setQuantities(q => ({ ...q, [res.variantId ? `${res.eventOptionId}:${res.variantId}` : res.eventOptionId]: res.quantity }));
+      })
+      .catch((e: any) => setOfferError(e?.message || "This waitlist link is not valid."));
+  }, []);
+  const event = useMemo<Event>(() => {
+    if (!offer) return baseEvent;
+    return {
+      ...baseEvent,
+      eventOptions: (baseEvent.eventOptions || []).map(o => {
+        if (o.id !== offer.eventOptionId) return o;
+        return {
+          ...o,
+          availableCount: o.availableCount !== undefined ? o.availableCount + offer.quantity : o.availableCount,
+          variants: (o.variants || []).map(v => v.id === offer.variantId && v.availableCount !== undefined ? { ...v, availableCount: v.availableCount + offer.quantity } : v),
+        };
+      }),
+    };
+  }, [baseEvent, offer]);

  const [quantities, setQuantities] = useState<QtyMap>(() => {
    const initial: QtyMap = {};
@@ -254,7 +308,8 @@ export default function RegisterForm({ event }: { event: Event }) {
  const [attendeeEntries, setAttendeeEntries] = useState<AttendeeEntries>({});
  const [delivery, setDelivery] = useState<TicketDelivery>("payer");
  const qtyFor = (optionId: string, variantId: string | null) => quantities[variantId ? `${optionId}:${variantId}` : optionId] || 0;
-  const namedAttendees = () => (event.allowNamedAttendees && namingOthers
+  const isYouthEvent = !!event.requiresParentalConsent;
+  const namedAttendees = () => ((event.allowNamedAttendees && namingOthers) || isYouthEvent
    ? attendeesPayload(event.eventOptions || [], qtyFor, attendeeEntries)
    : []);

@@ -327,6 +382,28 @@ export default function RegisterForm({ event }: { event: Event }) {
      setError("Select at least one ticket.");
      return;
    }
+    if (isYouthEvent) {
+      const missing = consentDetailsMissing(event.eventOptions || [], qtyFor, attendeeEntries, event.startDate);
+      if (missing) { setError(missing); return; }
+    }
+
+    // Claim link without logging in: the link identifies the person.
+    if (waitlistToken && !isLoggedIn) {
+      try {
+        setError(null);
+        setCreatingRegistration(true);
+        const res = await apiFetch<{ id: string; totalDueComputed?: number }>("/api/registrations", {
+          method: "POST",
+          body: { eventId, options: items, waitlistToken, analyticsSessionId: analyticsSessionId(), ...(namedAttendees().length > 0 ? { attendees: namedAttendees(), ticketDelivery: delivery } : {}) },
+        });
+        if (res?.id) window.location.href = `/registration/success?registrationId=${encodeURIComponent(res.id)}&totalDue=${encodeURIComponent((res.totalDueComputed ?? payable).toFixed(2))}`;
+      } catch (e: any) {
+        setError(e?.message || "Registration failed");
+      } finally {
+        setCreatingRegistration(false);
+      }
+      return;
+    }

    if (isLoggedIn) {
      if (!token) {
@@ -343,7 +420,9 @@ export default function RegisterForm({ event }: { event: Event }) {
            eventId,
            options: items,
            ...(coupon ? { couponCode: coupon.code } : {}),
+            analyticsSessionId: analyticsSessionId(),
            ...(namedAttendees().length > 0 ? { attendees: namedAttendees(), ticketDelivery: delivery } : {}),
+            ...(waitlistToken ? { waitlistToken } : {}),
          },
          authToken: token,
        });
@@ -386,6 +465,7 @@ export default function RegisterForm({ event }: { event: Event }) {
        method: "POST",
        body: {
          eventId, options: items, guestName: guestName.trim(), guestEmail: guestEmail.trim(), guestPhone: guestPhone.trim() || undefined,
+          analyticsSessionId: analyticsSessionId(),
          ...(namedAttendees().length > 0 ? { attendees: namedAttendees(), ticketDelivery: delivery } : {}),
        },
      });
@@ -430,13 +510,22 @@ export default function RegisterForm({ event }: { event: Event }) {
    <>
      <h1 className="text-2xl font-semibold mb-4">Register for {event.title}</h1>

-      {eventSoldOut && (
+      {offer && (
+        <div className="mb-4 p-4 border rounded-lg bg-green-50 border-green-200 text-sm text-green-900">
+          <strong>Your waitlist place:</strong> {offer.quantity} × {offer.optionName}{offer.variantName ? ` (${offer.variantName})` : ""} — held for you until {new Date(offer.expiresAt).toLocaleString()}.
+        </div>
+      )}
+      {offerError && (
+        <div className="mb-4 p-4 border rounded-lg bg-amber-50 border-amber-200 text-sm text-amber-900">{offerError}</div>
+      )}
+
+      {eventSoldOut && !event.waitlistEnabled && (
        <div className="mb-4 p-4 border rounded-lg bg-red-50 border-red-200 text-sm text-red-800 font-medium">
          This event is sold out. Registration is no longer available.
        </div>
      )}

-      {!isLoggedIn && !isGuestEligible && (
+      {!isLoggedIn && !isGuestEligible && !waitlistToken && (
        <div className="mb-4 p-4 border rounded-lg bg-amber-50 border-amber-200 text-sm text-amber-800">
          You need to <a href={`/login?redirect=/register/${eventId}`} className="font-semibold underline">log in</a> or <a href={`/register?redirect=/register/${eventId}`} className="font-semibold underline">create an account</a> to register for this event.
        </div>
@@ -483,6 +572,7 @@ export default function RegisterForm({ event }: { event: Event }) {
            opt={opt}
            quantities={quantities}
            onQtyChange={handleQtyChange}
+            waitlist={event.waitlistEnabled ? { eventId, guestsAllowed: event.requiresAuth === false } : null}
          />
        ))}
      </div>
@@ -505,7 +595,7 @@ export default function RegisterForm({ event }: { event: Event }) {
        );
      })()}

-      {event.allowNamedAttendees && !eventSoldOut && (isLoggedIn || showGuestForm) && (
+      {(event.allowNamedAttendees || isYouthEvent) && !eventSoldOut && (isLoggedIn || showGuestForm) && (
        <div className="mt-6">
          <AttendeeNamesEditor
            options={event.eventOptions || []}
@@ -516,6 +606,8 @@ export default function RegisterForm({ event }: { event: Event }) {
            onEntriesChange={setAttendeeEntries}
            delivery={delivery}
            onDeliveryChange={setDelivery}
+            consentEventStart={isYouthEvent ? event.startDate : undefined}
+            collectGender={!!event.collectGender}
          />
        </div>
      )}
@@ -544,7 +636,7 @@ export default function RegisterForm({ event }: { event: Event }) {
          ) : (
          <button
            onClick={submitRegistration}
-            disabled={creatingRegistration || (!isLoggedIn && !isGuestEligible)}
+            disabled={creatingRegistration || (!isLoggedIn && !isGuestEligible && !waitlistToken)}
            className="bg-brand-600 text-white px-4 py-2 rounded hover:bg-brand-700 disabled:opacity-60"
          >
            {creatingRegistration ? "Registering..." : "Register"}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
joshua	cd42ca375e	Merge branch 'feat/impersonate-user'	2026-10-19 18:25:10 +02:00
joshuaandClaude Opus 5.5	ccb4db919a	Bump to 1.23.0 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-19 18:25:08 +02:00
joshuaandClaude Opus 5.5	2b453b00e6	Add read-only admin impersonation Admins (with 2FA) can view the site as a non-admin user for up to 30 minutes, with a required reason and a "Viewing as" banner. It is strictly read-only: a guard mounted before every route refuses any write made with an impersonation token, protect/optionalAuth check the session is live, and GET handlers skip the price-refresh writes. Start, end, reason and every page/API call (including blocked attempts) are audited; optional email to the user. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CP62L9JxHomA36aYP1ekCe	2026-10-19 18:25:02 +02:00
joshua	fb8ce5f86d	Merge branch 'feat/funnel-stats'	2026-10-19 18:14:29 +02:00
joshuaandClaude Opus 5.5	4cd89b1a60	Bump to 1.22.0 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-19 18:14:24 +02:00
joshuaandClaude Opus 5.5	cc62f52ab3	Add registration funnel stats First-party, consent-based funnel tracking: a cookie notice asks once, and only visitors who allow it get an anonymous visit id. Event page views and registration starts are tracked from the browser; submit and paid come from the registration. Adds the Registration funnel report (conversion per stage, daily trend, by source/device/ticket option), a conversion tile on the supervisor/admin dashboards, short-link source tagging, and a daily rollup of raw rows older than 90 days. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CP62L9JxHomA36aYP1ekCe	2026-10-19 18:14:18 +02:00
joshua	238fcd6fd7	Merge branch 'feat/feedback-forms'	2026-10-19 15:28:48 +02:00
joshuaandClaude Opus 5.5	78b64329cc	Bump to 1.21.0 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-19 15:28:42 +02:00
joshuaandClaude Opus 5.5	afcc14cbb3	Add post-event feedback forms A Feedback step in the event wizard builds a survey that is sent at a chosen time to everyone who checked in (or everyone registered), with personal links and one reminder after 3 days. Answers can be anonymous. Adds rating (1-5 stars) and multiple-choice field types, also usable on attendee forms, and a Feedback summary report with response rate, average ratings, choice breakdowns, comments and event comparison. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-19 15:28:29 +02:00
joshua	1b92fae76c	Merge branch 'feat/sponsor-a-spot'	2026-10-19 15:04:40 +02:00
joshuaandClaude Opus 5.5	4c76c77005	Bump to 1.20.0 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-19 15:04:37 +02:00
joshuaandClaude Opus 5.5	93cff6099e	Add sponsor a spot Events can allow sponsorships: a "Sponsor a spot" button lets anyone (guests included) pay through Yoco for whole spots or a custom amount, anonymously or with a name and message. Payments land as event donations in a sponsorship pool that supervisors assign with the existing donation flow. Adds optional public progress towards a goal, a sponsor receipt and Automations thank-you, pool columns in the Donations report, and sponsorship labels/filter in Payments. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-19 15:04:29 +02:00
joshua	7bcaec6284	Merge branch 'feat/room-allocation'	2026-10-19 14:45:09 +02:00
joshuaandClaude Opus 5.5	2f4fd7c040	Bump to 1.19.0 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-19 14:45:06 +02:00
joshuaandClaude Opus 5.5	1516e104df	Add rooms & groups allocation Supervisors can split an event's named attendees into allocation sets (rooms, small groups, buses) with capacity, gender and leader per group, using a drag-and-drop board or auto-allocate (keep bookings together or split them). Adds printable group and master lists (medical view audited), the group on tickets and in My Events, messaging by group, a "My groups" page for leaders, and an optional per-event gender question for named attendees. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-19 14:44:58 +02:00
joshua	e9588aeba8	Merge branch 'feat/ticket-transfer'	2026-10-19 14:23:34 +02:00
joshuaandClaude Opus 5.5	83df90b531	Bump to 1.18.0 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-19 14:23:31 +02:00
joshuaandClaude Opus 5.5	87ffe3b84b	Add ticket transfer Payers and holders can hand a ticket to someone else before the event. The new holder gets a new QR code (and an inactive account with an activation link if they're new); the old code stops working and scans of it, online or in offline sync, say it was transferred. One place can be split off a shared group ticket. Transfers can be turned off per event (supervisors can always transfer from At the door), youth events need the new holder's own consent, and every transfer is audited. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-19 14:23:24 +02:00
joshua	9a4bf51ad4	Merge branch 'feat/offline-scanning'	2026-10-19 14:06:40 +02:00
joshuaandClaude Opus 5.5	d84663f901	Bump to 1.17.0 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-19 14:06:34 +02:00
joshuaandClaude Opus 5.5	be621c49a2	Add offline ticket scanning Staff can lock a section (or the whole event) to their device, download its tickets and keep scanning with no connection. Scans are queued in IndexedDB and synced idempotently when back online; conflicts go into a sync report for supervisors, who can also force-release a lost device. The server now validates scan sections and refuses scans in a scope locked to another device. Adds a web app manifest and a service worker for the scanner page. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-19 14:06:22 +02:00
joshua	edf7c3052b	Merge branch 'feat/waitlist'	2026-10-19 13:43:20 +02:00
joshuaandClaude Opus 5.5	f66968768f	Bump to 1.16.0 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-19 13:43:16 +02:00
joshuaandClaude Opus 5.5	2166f94247	Add waitlist for sold-out tickets Events can take a waitlist for sold-out lines. When places free up (cancellation, smaller booking, higher stock limit) the next person is offered them with a claim link and the places are held for a set time; unclaimed offers expire and move on, with optional partial offers. Stock is now counted in one place (utils/stock.js), including held places, and manual registrations and booking edits are now stock-checked. Adds a supervisor waitlist page, My Events waitlists, and the daily summary count. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-19 13:43:10 +02:00
joshua	bae9675485	Merge branch 'feat/parental-consent'	2026-10-19 13:25:02 +02:00
joshuaandClaude Opus 5.5	13fd3a4cbb	Bump to 1.15.0 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-19 13:24:57 +02:00
joshuaandClaude Opus 5.5	809b6a11d7	Add parental consent for youth events Youth events need a name and date of birth for every attendee, and a parent/guardian's details for under-18s. Parents get an email and WhatsApp link to a consent page that records the signed name, time, IP, device and exact consent text; medical and emergency details are stored encrypted. Tickets are issued but check-in is blocked until consent is given (supervisor override audited). A daily job sends reminders and purges medical details after the retention period. Adds a supervisor consent tracker, consent status and medical list reports, and clears consent data when an account is anonymised. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-19 13:24:44 +02:00