Merge branch 'feat/ci-e2e-jobs'

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -0,0 +1,129 @@
+# Checks every push and pull request: backend tests, frontend lint/typecheck/build, and
+# the Playwright end-to-end tests. Pushing a version tag (v1.2.3) also deploys, once the
+# DEPLOY_* secrets are set (Repository → Settings → Actions → Secrets).
+#
+# Needs a Gitea Actions runner with the "ubuntu-latest" label (Docker), e.g. act_runner:
+# https://docs.gitea.com/usage/actions/act-runner
+name: CI
+
+on:
+  push:
+    branches: ["**"]
+    tags: ["v*"]
+  pull_request:
+
+env:
+  NODE_VERSION: "20"
+  # Throwaway values for the test database and tokens — never production secrets.
+  JWT_SECRET: ci-only-jwt-secret-not-for-production
+  DATABASE_URL: postgresql://postgres:postgres@postgres:5432/events_ci
+  E2E_DATABASE_URL: postgresql://postgres:postgres@postgres:5432/events_ci_e2e
+
+jobs:
+  backend:
+    name: Backend tests
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: events_ci
+        options: >-
+          --health-cmd "pg_isready -U postgres" --health-interval 5s --health-timeout 5s --health-retries 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: npm
+          cache-dependency-path: backend/package-lock.json
+      - run: npm ci
+        working-directory: backend
+      - name: Migrations apply cleanly
+        run: npx prisma migrate deploy
+        working-directory: backend
+      - run: npm test
+        working-directory: backend
+
+  frontend:
+    name: Frontend lint, typecheck, build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+      - run: npm ci
+        working-directory: frontend
+      - run: npx eslint src
+        working-directory: frontend
+      - run: npx tsc --noEmit -p .
+        working-directory: frontend
+      - run: npm run build
+        working-directory: frontend
+        env:
+          NEXT_PUBLIC_API_URL: http://localhost:5000
+          NEXT_TELEMETRY_DISABLED: "1"
+
+  e2e:
+    name: End-to-end tests
+    runs-on: ubuntu-latest
+    needs: [backend, frontend]
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: events_ci
+        options: >-
+          --health-cmd "pg_isready -U postgres" --health-interval 5s --health-timeout 5s --health-retries 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+      - run: npm ci
+      - run: npm ci
+        working-directory: backend
+      - run: npm ci
+        working-directory: frontend
+      - run: npx playwright install --with-deps chromium
+      - run: npx playwright test
+        env:
+          CI: "true"
+      - name: Keep the report when tests fail
+        if: failure()
+        uses: actions/upload-artifact@v3
+        with:
+          name: playwright-report
+          path: |
+            e2e/report
+            e2e/test-results
+          retention-days: 7
+
+  deploy:
+    name: Deploy tagged release
+    runs-on: ubuntu-latest
+    needs: [backend, frontend, e2e]
+    if: startsWith(github.ref, 'refs/tags/v')
+    steps:
+      - name: Deploy over SSH (skipped until DEPLOY_HOST is set)
+        env:
+          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          if [ -z "$DEPLOY_HOST" ]; then
+            echo "DEPLOY_HOST isn't set — skipping the deploy."
+            exit 0
+          fi
+          mkdir -p ~/.ssh
+          echo "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+          ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=accept-new "$DEPLOY_USER@$DEPLOY_HOST" \
+            "cd '${DEPLOY_PATH:-~/hope-events}' && bash scripts/deploy.sh '$TAG'"

.gitignore

@@ -39,4 +39,9 @@ hope-events-deployment-setup.txt
 
 # runtime data stores (mutated by the running app, not source)
 backend/data/scheduled-emails.json
-backend/data/banner.json
+backend/data/banner.json
+# end-to-end tests
+e2e/.data/
+e2e/report/
+e2e/test-results/
+frontend/.next-e2e/

CHANGELOG.md

@@ -7,6 +7,116 @@ and this project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [1.34.0] - 2026-10-22
+
+### Added
+
+- **Background jobs page** (Admin → Site Settings → Background jobs): every scheduled job with its schedule, next run and last 10 runs (start, finish, result or error), and a "Run now" button (recorded in the audit log).
+- **End-to-end tests** with Playwright (`npm run test:e2e`): they start their own backend and frontend against a separate, freshly seeded database and cover the public pages, free and paid registration through payment, ticket, check-in and cashup, multi-day check-in with the attendance register and certificates, creating a multi-session event in the wizard, the self-service kiosk, and the jobs page.
+- **CI workflow** (`.gitea/workflows/ci.yml`): backend tests, frontend lint, typecheck and build, and the end-to-end tests on every push and pull request. It runs once a Gitea Actions runner is registered.
+- **Deploy script** (`scripts/deploy.sh <tag>`): backs up the database, checks out the tag, installs, migrates, builds and reloads PM2, going back to the previous version if a step fails before the reload. CI runs it over SSH for `v*` tags once the `DEPLOY_*` secrets are set.
+
+### Changed
+
+- Timed background jobs (daily summary, waitlist, feedback, session reminders and certificates, consent, analytics rollup, backup, temp cleanup) now run on a job queue in Postgres (pg-boss) instead of in-process timers. Each runs once per schedule even with more than one server process, failed runs are retried, and a slow run never overlaps the next. Schedules are cron, in `APP_TIMEZONE` (Africa/Johannesburg by default) rather than the server's clock; change one with `JOB_SCHEDULE_<NAME>`, or turn all jobs off with `JOBS_ENABLED=false`. The existing `*_ENABLED` flags still work; the old `*_JOB_INTERVAL_MS` settings are replaced by the schedules. If the queue can't start, the jobs run on timers as before.
+- The server lets a running job finish before it stops or restarts.
+
+### Fixed
+
+- At the door, the Check-In tab counted every past session's check-in on a multi-day ticket, so from the second session the ticket showed as fully used. It now counts only today's session.
+
+## [1.33.0] - 2026-10-22
+
+### Added
+
+- **Multi-day events.** An event can run over several sessions, e.g. every Wednesday 18:30–20:30 for 5 weeks. In the event wizard choose "Multiple sessions", create the dates from a repeat pattern (daily or weekly, every N, on chosen weekdays, for a number of sessions or until a date), then edit any session's label, times or location, add one-off dates, or cancel a session (kept for history). People register and pay once and get one ticket for every session.
+- The event page shows the schedule (past sessions greyed out, the next one highlighted, cancelled ones struck through). Event cards show "5 sessions · Wed 4 Nov – Wed 2 Dec", and multi-day events stay listed until their last session, sorted by their next one. Calendar files have one entry per session. Ticket PDFs, printed tickets and the ticket email give the session range.
+- **Late joining**: a multi-day event closes registration when its first session starts, unless late joining is on (until session N, set per event). Late joiners pay full price, a pro-rata price for the sessions still to come (rounded to the nearest R10, at least R10), or a fixed late price — main tickets only, and never more than the normal price. The event and registration pages say when the late price applies.
+- **Per-session check-in**: a multi-day ticket is checked in once per session. The scanner uses today's session (staff can pick another), shows the session on the confirm screen, and says "Already checked in for Week 3 at 18:42" on a second scan. Each event chooses whether check-in is open the whole day of a session (the default) or only from 2 hours before it until it ends. Offline mode downloads the list for today's session, and synced scans count for the session at their scan time.
+- **Session reminders**: optional per event — 1 hour, 3 hours and/or 1 day before each session, by email and/or WhatsApp (each person's notification preference still applies). Off by default.
+- **Attendance register** (Dashboard → Attendance): attendees × sessions with ticks, totals per session, completion, search and filters (completed, not completed, missed the last two sessions), and Excel/PDF export. Supervisors can tick someone present or absent, recorded in the audit log. Also works for single-date events (one "Checked in" column).
+- **Completion certificates**: optional per event, in the wizard's new Attendance step. Four designs (Classic, Modern, Church, Kids) with the site logo and colour, your title and wording ({name}, {event}, {sessionsAttended}, {totalSessions}, {endDate}), an optional signature name, role and image, and who qualifies (every session, at least N sessions, or at least N%). "Preview certificate" shows a sample. Certificates are issued automatically when the event ends (and can be sent automatically), or from the attendance register: issue now, issue to one person anyway, send, download all as one PDF, or revoke. People download theirs under My Certificates on My Events. Each has a code and QR code that anyone can check on the public page `/certificates/verify/<code>`, which shows only the name, event and dates.
+- Saving an event where sessions moved or were cancelled offers a "Message attendees" link, since registrants aren't told automatically.
+- A background job every 5 minutes sends due session reminders and issues certificates (`SESSION_JOBS_ENABLED=false` to turn it off). The church's timezone for "today" defaults to Africa/Johannesburg (`APP_TIMEZONE` to change).
+
+### Changed
+
+- The event wizard has a ninth step, Attendance, for late joining, check-in window, session reminders and certificates.
+
+## [1.32.0] - 2026-10-22
+
+### Added
+
+- Event cards on the home page and events list show a diagonal "Early bird" ribbon in the top-right corner while the event has an early-bird tier running (deadline not passed and places left on that tier). It isn't shown when the event is sold out, registration is closed or not open yet, or the event is contact-only.
+
+## [1.31.1] - 2026-10-22
+
+### Added
+
+- Settings → Organisation has a "Google Search Console verification" field. Paste the HTML tag from Search Console and the site outputs it on every page, so each deployment can verify its own domain without uploading a file.
+
+## [1.31.0] - 2026-10-22
+
+### Added
+
+- The registration funnel's traffic source works without tagged links: visits from Facebook, Instagram, Google, X, LinkedIn and other sites are recognised from where the visitor came from (and Facebook's/Google's click ids). Links without a tag used to count as "direct". WhatsApp still only shows from tagged links (`?utm_source=whatsapp`), since it doesn't pass that on.
+- The event page's Share button shares the link tagged `?utm_source=share`, and Save QR encodes it tagged `?utm_source=qr`, so those visits show separately.
+- Event pages tell search engines about the event in Google's event format (schema.org `Event`): name, dates, venue, picture, organiser, ticket prices in Rand and whether it's sold out. Google can then show events with their date, venue and ticket link in search results and in its event listings. Contact-only events are listed without tickets.
+
+### Changed
+
+- Event pages, the events list and the home page tell search engines their one official address, so `?utm_source=…`, `?src=…` and alias links all count towards the same page in search rankings. Shared event links also carry the event's address.
+
+## [1.30.1] - 2026-10-22
+
+### Changed
+
+- All tickets now share the design of the tickets printed from the user dashboard: rounded white cards with a light border and soft shadow, the date beside the event name, and the QR code in the middle. This covers the PDF sent by email and WhatsApp (now 6 per page, so the QR codes are bigger) and printing from Event Tickets (staff) and At the door (supervisor). Printed names are now escaped, so a name with `<` or `&` prints correctly.
+
+## [1.30.0] - 2026-10-22
+
+### Added
+
+- The register form asks for an optional **Donation amount** under the ticket options. Pick a suggested amount (worked out from the ticket total), enter a custom amount (min R15), or choose None. The donation shows in the total and is paid in the same Yoco checkout as the tickets. It's recorded as a separate donation to the event, so it never counts towards the registration's balance.
+
+### Fixed
+
+- Event pages with a waitlist crashed with "Attempted to call soldOutLines() from the server". The sold-out helper now lives in `lib/waitlist.ts` so the server page can call it.
+
+## [1.29.1] - 2026-10-21
+
+### Changed
+
+- The Coupon codes page matches the Bundle deals page and works on phones. Codes show as cards with the discount, events, uses, restrictions, dates and limits. On phones, the edit form and the list of uses open full-width from the bottom, and the discount type is picked from three buttons.
+- The coupons list hides codes that are off, expired or used up unless you tick "Show codes that are off, expired or used up". Search also matches event names.
+- When creating or editing a code, the Events list shows upcoming events only, soonest first, with a search box and a "Show past events" option. Past events already on the code stay listed so they can be unticked.
+
+## [1.29.0] - 2026-10-21
+
+Run `npm run prisma:deploy` in the backend when deploying. This release adds a migration.
+
+### Added
+
+- Bundle deals now come in four types, chosen when you create one:
+  - **Exact set**: these tickets in these numbers for one price, e.g. 2 adults + 3 kids for R220. This is how bundles worked before.
+  - **Pick any**: any mix of the qualifying tickets for a set price, e.g. any 4 of Adult or Child for R250, so 2 + 2 and 4 + 0 both count.
+  - **Buy X get Y free**: in every set of qualifying tickets the cheapest are free, e.g. buy 3, get 1 free.
+  - **Group discount**: from a group size up, every qualifying ticket costs less (a price per ticket or a percentage off), e.g. 10+ tickets: R70 each. It applies once, to the whole group, and never makes a ticket dearer.
+- The deals list and the "Complete bundle" cards on the register form, at the door, manual registration and the kiosk describe each type in one line, e.g. "Any 4 of Adult, Child for R250". For a group discount the button reads "Complete group" and adds the tickets still needed.
+- `npm run set-demo`: Family Fun Day also has a pick-any deal, "Lunch for four" (any 4 lunch packs for R220).
+
+## [1.28.3] - 2026-10-21
+
+### Fixed
+
+- Bundle deals edit form: each ticket row's quantity box filled the whole row, which pushed the ticket picker off the side and added a sideways scrollbar. The quantity box is narrow again, with the ticket picker beside it.
+
+## [1.28.2] - 2026-10-21
+
+### Changed
+
+- The Bundle deals page has a new layout that works on phones. It shows upcoming events only, soonest first, with a "Show past events" option. Bundles show as cards with their tickets, price, saving, uses and dates. On a phone, the edit form opens full-width from the bottom, and its price section shows the standard price, the bundle price and the saving side by side.
+
 ## [1.28.1] - 2026-10-21
 
 ### Added

FEATURES.md

@@ -56,7 +56,9 @@ Four roles, each including everything the roles below it can do:
   and in-progress events, and a "Join Us" button (becomes "My Dashboard" when
   logged in).
 - **Events list** (`/events`) — event cards with picture, dates, location,
-  price, and a Register / Sold Out / Contact us button.
+  price, and a Register / Sold Out / Contact us button. A diagonal "Early bird"
+  ribbon in the top-right corner while an early-bird tier is running and
+  registration is open.
 - **Event detail** (`/events/[id]`) — description, ticket options with
   variant and early-bird pricing, low-stock and sold-out badges, downloadable
   attachments, embedded Google Map with "Directions" link, and an
@@ -77,14 +79,33 @@ Four roles, each including everything the roles below it can do:
 
 ## Events
 
-Created and edited by supervisors through a 6-step wizard: **Basic Details →
-Items & Pricing → Sections → Form → Visibility → Attachments**.
+Created and edited by supervisors through a 9-step wizard: **Basic Details →
+Items & Pricing → Sections → Form → Visibility → Notifications → Attachments →
+Feedback → Attendance**.
 
 - **Basic details** — title, description, start/end dates, registration
   deadline, picture (upload or URL), location (defaults to the org's address),
   contact person.
 - **Contact-only events** — for things like baptisms: shown publicly with a
   "Contact us" popup instead of registration, with no tickets.
+- **Multi-day events (sessions)** — one event on several dates, e.g. every
+  Wednesday 18:30–20:30 for 5 weeks. A repeat pattern (daily/weekly, every N,
+  chosen weekdays, a number of sessions or an end date) creates the sessions,
+  which can then be edited one by one (label, times, location), added to, or
+  cancelled (kept for history; one with check-ins can't be deleted). People
+  register and pay once and get one ticket. The event page shows the schedule
+  with the next session highlighted; cards show "5 sessions · Wed 4 Nov – Wed
+  2 Dec" and stay listed until the last session. Calendar files get one entry
+  per session. Saving moved or cancelled sessions offers to message attendees.
+- **Late joining** (multi-day) — registration closes when the first session
+  starts, or later (until session N) with late joining on. Late joiners pay
+  full price, a pro-rata price for the sessions left (rounded to the nearest
+  R10), or a fixed late price — main tickets only.
+- **Completion certificates** — optional per event: four designs (Classic,
+  Modern, Church, Kids), custom wording with placeholders, signature name/role/
+  image, and a completion rule (every session, at least N sessions, or N%).
+  Issued automatically when the event ends; each has a code and QR code checked
+  on a public verify page.
 - **Ticket options** — multiple options per event (e.g. Adult, Child, Dinner,
   T-shirt), each with a price and optional **stock limit**. One option is marked
   as the main ticket, which is what gets checked in at the door.
@@ -240,6 +261,15 @@ Items & Pricing → Sections → Form → Visibility → Attachments**.
   and remaining quantity.
 - **Check-in confirmation** — holders get an email/WhatsApp saying how many were
   checked in and how many remain.
+- **Per-session check-in** — multi-day tickets are checked in once per session.
+  The scanner uses today's session (or one picked from a list). Check-in is open
+  the whole day of a session, or only from 2 hours before it until it ends, per
+  event. Optional reminders (1 h / 3 h / 1 day before each session) by email
+  and/or WhatsApp.
+- **Attendance register** — attendees × sessions with ticks, totals per session,
+  completion, filters (completed, missed the last two), Excel/PDF export.
+  Supervisors can tick someone present or absent (audit-logged), and issue,
+  send, download or revoke certificates.
 - **Scan stats** — recent scans and per-event scan counts.
 - **Offline scanning** — while online, a staff member locks an event section (or the
   whole event) to their device and downloads its tickets. They can then keep scanning
@@ -344,7 +374,7 @@ logout controls. Disconnected sessions are recovered automatically.
 - **Dashboard** — KPIs (active events, revenue, donations, registrations,
   tickets sold, each vs. the previous month), revenue trend chart, top events,
   and recent scans. Tiles link to the matching report.
-- **Manage events** — the 6-step event wizard, ticket options, variants,
+- **Manage events** — the 9-step event wizard, ticket options, variants,
   sections, form and attachments.
 - **At the door** — search by name/phone/ticket ID, walk-in registration,
   payments, a **Check-In** tab for redeeming main tickets by quantity, and
@@ -499,16 +529,25 @@ falling back to a general guide.
 
 ## Background jobs
 
+Timed jobs run on a job queue in Postgres (pg-boss, `backend/src/jobs/index.js`): each
+runs once per schedule even with several server processes, every run is recorded,
+failed runs are retried twice, and a slow run never overlaps the next. Admin → Site
+Settings → Background jobs shows each job's schedule, next run and last 10 runs, with
+"Run now". Times are in `APP_TIMEZONE` (default Africa/Johannesburg). Change a schedule
+with `JOB_SCHEDULE_<NAME>` (cron); `JOBS_ENABLED=false` turns them all off. If the queue
+can't start, the same jobs run on in-process timers.
+
 | Job | Schedule |
 |-----|----------|
-| Scheduled email/WhatsApp worker | Polls every 30 s (`SCHEDULED_EMAILS_INTERVAL_MS`) and purges sent jobs after 24 h |
-| Daily event summary email | 07:00 daily |
-| Waitlist: expire unclaimed offers, offer freed places | Every 10 minutes (`WAITLIST_JOB_ENABLED=false` to disable) |
-| Funnel analytics: roll raw visit rows older than 90 days into daily totals | Daily (`ANALYTICS_ROLLUP_ENABLED=false` to disable) |
-| Post-event feedback forms and their 3-day reminder | Every 15 minutes (`FEEDBACK_JOB_ENABLED=false` to disable) |
-| Parental consent reminders, and deleting medical details after events | 09:00 daily (`CONSENT_JOBS_ENABLED=false` to disable) |
-| Database backup (`pg_dump`, gzipped, 14-day retention) | 02:00 daily (`BACKUP_ENABLED=false` to disable) |
-| Temp file cleanup (files older than 7 days in `/temp`) | Daily |
+| Scheduled email/WhatsApp worker | Polls every 30 s (`SCHEDULED_EMAILS_INTERVAL_MS`) and purges sent jobs after 24 h (not on the queue) |
+| `daily-summary` — daily event summary email | 07:00 daily (`DAILY_SUMMARY_ENABLED=false` to disable) |
+| `waitlist` — expire unclaimed offers, offer freed places | Every 10 minutes (`WAITLIST_JOB_ENABLED=false`) |
+| `feedback` — post-event feedback forms and their 3-day reminder | Every 15 minutes (`FEEDBACK_JOB_ENABLED=false`) |
+| `sessions` — session reminders, and certificates for events that ended in the last 14 days | Every 5 minutes (`SESSION_JOBS_ENABLED=false`) |
+| `consent` — parental consent reminders, and deleting medical details after events | 09:00 daily (`CONSENT_JOBS_ENABLED=false`) |
+| `analytics-rollup` — roll raw visit rows older than 90 days into daily totals | 04:15 daily (`ANALYTICS_ROLLUP_ENABLED=false`) |
+| `backup` — database backup (`pg_dump`, gzipped, 14-day retention) | 02:00 daily (`BACKUP_ENABLED=false`) |
+| `temp-cleanup` — temp files older than 7 days in `/temp` | 03:00 daily |
 
 ---
 
@@ -520,7 +559,16 @@ falling back to a general guide.
   set.
 - Unhandled promise rejections are logged and don't crash the server.
 - Backend status page (`/`) and built-in API docs page (`/docs`).
-- Jest tests for early-bird tranche pricing and donation balances.
+- **Tests** — Jest unit tests in `backend/tests` (`npm test`), and Playwright
+  end-to-end tests in `e2e/` (`npm run test:e2e`) that start their own backend and
+  frontend against a separate, freshly seeded database: public pages, free and paid
+  registration through to check-in and cashup, multi-day check-in, the attendance
+  register and certificates, the event wizard, the kiosk, and the admin jobs page.
+- **CI** — `.gitea/workflows/ci.yml` runs the backend tests, frontend lint/typecheck/
+  build and the end-to-end tests on every push (needs a Gitea Actions runner). A `v*`
+  tag also deploys over SSH with `scripts/deploy.sh` once the `DEPLOY_*` secrets are set:
+  it backs up the database, checks out the tag, migrates, builds and reloads PM2, and
+  goes back to the previous version if a step fails before the reload.
 - Versioning via git tags and [CHANGELOG.md](./CHANGELOG.md).
 
 ---
@@ -541,9 +589,10 @@ falling back to a general guide.
 | `/setup` | First run | Setup wizard |
 | `/consent/[token]` | Parent/guardian | Give or decline parental consent |
 | `/waitlist/claim/[token]` | Public | Claim a waitlist place |
+| `/certificates/verify/[code]` | Public | Check a completion certificate |
 | `/self-service` | Supervisor-unlocked | Kiosk |
 | `/set-banner` | Supervisor | Site banner |
 | `/dashboard/user` (+ `/payments`, `/donate`, `/forms`, `/profile`, `/reset-password`) | User | My Events |
 | `/dashboard/staff` (+ `/ticket-scanning`, `/event-tickets`) | Staff | Staff tools |
-| `/dashboard/supervisor` (+ `/events`, `/event-options`, `/at-the-door`, `/manual`, `/manual-registration`, `/payments`, `/coupons`, `/waitlist`, `/consent`, `/offline-scans`, `/allocations`, `/email-attendees`, `/whatsapp-attendees`, `/forms`, `/reports`) | Supervisor | Supervisor tools |
+| `/dashboard/supervisor` (+ `/events`, `/event-options`, `/at-the-door`, `/manual`, `/manual-registration`, `/payments`, `/coupons`, `/waitlist`, `/attendance`, `/consent`, `/offline-scans`, `/allocations`, `/email-attendees`, `/whatsapp-attendees`, `/forms`, `/reports`) | Supervisor | Supervisor tools |
 | `/dashboard/admin` (+ `/users`, `/registrations`, `/forms`, `/cashup`, `/cashup/[id]`, `/audit-log`, `/settings`) | Admin | Admin tools |

README.md

@@ -81,8 +81,26 @@ Documentation: see Frontend README for environment and scripts.
   - npm run dev
   - Next.js dev server runs at http://localhost:3000 by default; if it conflicts with backend, it will pick another port (e.g., 3001). Ensure NEXT_PUBLIC_API_URL points to the backend port.
 
+## Tests
+
+- Backend unit tests: `cd backend && npm test`
+- End-to-end tests (Playwright), from the repo root:
+  - once: `npm install` and `npx playwright install chromium`
+  - `npm run test:e2e`
+  - They start their own backend (port 5100) and frontend (port 3100) against a separate
+    database — `backend/.env`'s `DATABASE_URL` with `_e2e` added to the name, or
+    `E2E_DATABASE_URL` — which is dropped, recreated and seeded on every run. Your own dev
+    servers and database aren't touched. The database user needs permission to create
+    databases.
+- CI: `.gitea/workflows/ci.yml` runs all of the above on every push once a Gitea Actions
+  runner is registered. Pushing a `v*` tag also deploys with `scripts/deploy.sh` when the
+  `DEPLOY_HOST`, `DEPLOY_USER`, `DEPLOY_SSH_KEY` (and optional `DEPLOY_PATH`) secrets are set.
+
 ## Deployment
 
+To update a running install to a release: `bash scripts/deploy.sh v1.34.0` on the server
+(backs up the database, migrates, builds, reloads PM2).
+
 ### Backend Deployment
 
 1. Provision a PostgreSQL database and set DATABASE_URL.

backend/API_DOCUMENTATION.md

@@ -21,6 +21,7 @@ Tokens are issued by `POST /api/users/login`.
 - [Coupons](#coupons)
 - [Parental consent](#parental-consent)
 - [Waitlist](#waitlist)
+- [Multi-day events & attendance](#multi-day-events--attendance)
 - [Offline scanning](#offline-scanning)
 - [Ticket transfer](#ticket-transfer)
 - [Rooms & groups](#rooms--groups)
@@ -28,6 +29,7 @@ Tokens are issued by `POST /api/users/login`.
 - [Post-event feedback](#post-event-feedback)
 - [Registration funnel](#registration-funnel)
 - [Impersonation](#impersonation)
+- [Background jobs](#background-jobs)
 - [Payments](#payments)
 - [Tickets](#tickets)
 - [Broadcasts (Email)](#broadcasts-email)
@@ -285,6 +287,22 @@ For unauthenticated (guest) registration on events with `requiresAuth: false`:
 
 ---
 
+## Background jobs
+
+Timed jobs run on a pg-boss queue in Postgres (schema `pgboss`, created on first start) —
+see `backend/src/jobs/index.js`.
+
+| Method | Path | Auth | Description |
+|--------|------|------|-------------|
+| GET | `/api/admin/jobs` | admin | `{ mode: "queue" \| "timers" \| "off", timezone, jobs: [{ name, label, cron, enabled, envFlag, nextRun, recent: [{ state, startedOn, completedOn, output }] }] }` |
+| POST | `/api/admin/jobs/:name/run` | admin | Run a job now: `{ queued: true, id }` (or `{ queued: false, output }` in timer mode). Audit-logged as `job_run_manual` |
+
+Env: `JOBS_ENABLED=false` turns every job off; each job's own flag (`WAITLIST_JOB_ENABLED`, …)
+turns it off; `JOB_SCHEDULE_<NAME>` (e.g. `JOB_SCHEDULE_DAILY_SUMMARY="0 6 * * *"`) changes its
+cron schedule; times are in `APP_TIMEZONE` (default Africa/Johannesburg).
+
+---
+
 ## Impersonation
 
 | Method | Path | Auth | Description |
@@ -330,7 +348,7 @@ Data handling:
 Notes:
 - New field types `rating` (answers `"1"`–`"5"`) and `multiple_choice` (`options`: array of strings). They can be used on attendee forms too.
 - Only HMACs of link tokens are stored, and a reminder issues a new link.
-- A job every 15 minutes (`FEEDBACK_JOB_ENABLED`, `FEEDBACK_JOB_INTERVAL_MS`) sends due forms, and sends one reminder 3 days later to people who haven't answered.
+- A job every 15 minutes (`feedback` job; `FEEDBACK_JOB_ENABLED`, `JOB_SCHEDULE_FEEDBACK`) sends due forms, and sends one reminder 3 days later to people who haven't answered.
 
 ## Sponsor a spot
 
@@ -422,6 +440,53 @@ How syncing works:
 - Check-in messages are sent after the sync.
 - Locks, releases, force-releases and syncs are written to the admin audit log.
 
+## Multi-day events & attendance
+
+An event with `scheduleType: "sessions"` runs on several dates (e.g. every Wednesday for
+5 weeks). People register and pay once and get one ticket; check-in is per session.
+`startDate`/`endDate` always follow the first and last active session.
+
+Create/update fields (`POST`/`PUT /api/events`):
+
+| Field | Notes |
+|-------|-------|
+| `scheduleType` | `single` (default) or `sessions`. Switching back to `single` is refused once there are session check-ins |
+| `sessions` | `[{ id?, label?, startsAt, endsAt, location?, cancelled? }]` — the full list. Rows left out are deleted (refused when they have check-ins — send `cancelled: true` instead). The event and its sessions save together, so a refused change saves nothing |
+| `lateJoinEnabled`, `lateJoinUntilSessionIndex` | Registration stays open until that session (index into the sent list, sorted by start) starts; otherwise it closes when the first session starts |
+| `latePricing`, `lateFixedPrice` | `full`, `prorata` (price × sessions left ÷ sessions, nearest R10, at least R10) or `fixed` (only ever lowers the price). Main tickets only |
+| `checkInWindow` | `whole_day` (default — any time on the session's date, in `APP_TIMEZONE`, default Africa/Johannesburg) or `session_only` (2 h before start until the end) |
+| `sessionReminders` | `null` (off) or `{ offsets: [60 \| 180 \| 1440], channels: ["email", "whatsapp"] }` |
+| `certificatesEnabled`, `certificateConfig` | `{ template: classic \| modern \| church \| kids, title, body ({name} {event} {sessionsAttended} {totalSessions} {endDate}), signatureName, signatureRole, signatureImage, rule: { type: all \| count \| percent, value }, sendOnIssue }` |
+
+Responses for events include `sessions[]` (with `cancelled` and `hasCheckIns`),
+`registrationClosesAt`, `nextSession` and `lateJoin: { active, mode, sessionsLeft, totalSessions, fixedPrice }`.
+`PUT` also returns `sessionChanges: { added, moved, cancelled, restored, removed }`.
+
+Scanning: `GET /api/tickets/scan-preview/:qr?sessionId=` and `POST /api/tickets/scan/:qr`
+(`{ sessionId? }`) default to today's session and return `session` plus `remaining` for it;
+`sessionError` / 400 `NO_SESSION` when no session is open for check-in. Offline snapshots
+are for the session running when downloaded; synced scans count for the session at their scan time.
+
+| Method | Path | Auth | Description |
+|--------|------|------|-------------|
+| GET | `/api/attendance/:eventId` | staff+ | Register: `columns` (sessions), `rows` (one per main ticket: `checkIns` per session, `attended`, `total`, `completed`, `certificate`), `totals` |
+| GET | `/api/attendance/:eventId/export?format=xlsx\|pdf` | staff+ | Download the register |
+| POST | `/api/attendance/:eventId/mark` | supervisor+ | `{ ticketId, sessionId, present }` — single-date events use `sessionId: "event"` |
+| POST | `/api/attendance/:eventId/certificates` | supervisor+ | Issue now to everyone eligible, or `{ ticketId }` for one (even if not eligible) |
+| POST | `/api/attendance/:eventId/certificates/send` | supervisor+ | Send unsent certificates, or `{ certificateId }` |
+| GET | `/api/attendance/:eventId/certificates.pdf` | supervisor+ | All certificates in one PDF |
+| POST | `/api/attendance/certificates/preview` | supervisor+ | Sample PDF: `{ title, config }` |
+| POST | `/api/attendance/certificates/:id/revoke` | supervisor+ | Revoke (never re-issued automatically) |
+| GET | `/api/attendance/certificates/mine` | user+ | My certificates |
+| GET | `/api/attendance/certificates/:id/pdf` | user+ | Download one (its person, the booker, or a supervisor) |
+| GET | `/api/attendance/certificates/verify/:code` | public | `{ valid, revoked?, name, event, completedOn, issuedAt }` |
+
+A job every 5 minutes (`sessions` job; `SESSION_JOBS_ENABLED`, `JOB_SCHEDULE_SESSIONS`) sends due session
+reminders (each once; when several are due at once only the closest is sent) and issues
+certificates for events with certificates on that ended in the last 14 days.
+
+---
+
 ## Waitlist
 
 Events with `waitlistEnabled` (plus `waitlistOfferHours`, default 24, and `waitlistPartialOffers`, default true) take a queue for sold-out lines.
@@ -440,7 +505,7 @@ Events with `waitlistEnabled` (plus `waitlistOfferHours`, default 24, and `waitl
 How offers work:
 - Places held for a live offer count as taken everywhere stock is counted: `availableCount`, `isSoldOut` and registration stock checks.
 - Offers are made automatically when places free up: a cancellation, a smaller booking, or a raised stock limit.
-- A job every 10 minutes (`WAITLIST_JOB_ENABLED`, `WAITLIST_JOB_INTERVAL_MS`) expires unclaimed offers and re-offers.
+- A job every 10 minutes (`waitlist` job; `WAITLIST_JOB_ENABLED`, `JOB_SCHEDULE_WAITLIST`) expires unclaimed offers and re-offers.
 - Claiming means registering with `POST /api/registrations` plus `waitlistToken`. The token stands in for logging in, and the held places are released to the claimer.
 - Manual registration and adding places to an existing booking are now checked against stock too.
 

backend/DEMO_DATA.md

@@ -68,7 +68,7 @@ The data is generated from a fixed seed, so every run looks the same.
 | When (from today) | Event | Shows off |
 |---|---|---|
 | ~1½ weeks, Sat 07:30 | **Men's Breakfast: Built to Last** | **Sold out** (60 places), 5 people on the **waitlist**, card / cash / EFT payments recorded by staff, 2 cancelled registrations |
-| ~2½ weeks, Sat 10:00 | **Family Fun Day** | Adult and child tickets with a **bundle deal** (Family deal: 2 adults + 3 kids for R220 instead of R280, used by about a third of registrations), a non-ticket **add-on** (lunch pack), a fixed-amount **coupon** (`FUNDAY20`), entry and food-stall check-in sections |
+| ~2½ weeks, Sat 10:00 | **Family Fun Day** | Adult and child tickets with a **bundle deal** (Family deal: 2 adults + 3 kids for R220 instead of R280, used by about a third of registrations) and a **pick-any** deal (Lunch for four: any 4 lunch packs for R220), a non-ticket **add-on** (lunch pack), a fixed-amount **coupon** (`FUNDAY20`), entry and food-stall check-in sections |
 | ~5 weeks, Fri–Sat | **Rooted Women's Conference** | Two **early-bird tiers** (one already expired, one still open) plus a Saturday-only ticket, T-shirt **variants** (S–XXL), a **required sign-up form** (dietary needs, workshop choice, prayer requests), a 20% **group coupon** (`ROOTED20`) used by 4 registrations |
 | ~7 weeks, Mon–Thu | **Ignite Summer Camp** | **Named attendees** (campers aged 12–17), signed **parental consent**, gender collected, **deposits and part-payments**, campers placed in boys' and girls' **cabins** with staff leaders, **sponsor-a-spot** donations towards a 10-spot goal |
 | ~8 weeks, Sun 19:00 | **Carols by Candlelight** | A **free event** with group tickets (1–6 people), plus general **donations** |

backend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "event-management-backend",
-  "version": "1.28.1",
+  "version": "1.34.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "event-management-backend",
-      "version": "1.28.1",
+      "version": "1.34.0",
       "hasInstallScript": true,
       "dependencies": {
         "@prisma/adapter-pg": "^7.10.1",
@@ -15,6 +15,7 @@
         "axios": "^1.11.0",
         "bcryptjs": "^2.4.3",
         "cors": "^2.8.5",
+        "cron-parser": "^4.9.0",
         "dotenv": "^16.3.1",
         "exceljs": "^4.4.0",
         "express": "^4.18.2",
@@ -25,6 +26,7 @@
         "node-fetch": "^2.7.0",
         "nodemailer": "^10.0.16",
         "pdfkit": "^0.17.1",
+        "pg-boss": "^10.4.2",
         "qrcode": "^1.5.4",
         "raw-body": "^3.0.0",
         "uuid": "^11.1.1"
@@ -1615,9 +1617,6 @@
         "arm"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1639,9 +1638,6 @@
         "arm"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1663,9 +1659,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1687,9 +1680,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1711,9 +1701,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1735,9 +1722,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2707,9 +2691,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2724,9 +2705,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2741,9 +2719,6 @@
         "loong64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2758,9 +2733,6 @@
         "loong64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2775,9 +2747,6 @@
         "ppc64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2792,9 +2761,6 @@
         "riscv64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2809,9 +2775,6 @@
         "riscv64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2826,9 +2789,6 @@
         "s390x"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2843,9 +2803,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2860,9 +2817,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4143,6 +4097,19 @@
         "node": ">= 10"
       }
     },
+    "node_modules/cron-parser": {
+      "version": "4.9.0",
+      "resolved": "https://registry.npmjs.org/cron-parser/-/cron-parser-4.9.0.tgz",
+      "integrity": "sha512-p0SaNjrHOnQeR8/VnfGbmg9te2kfyYSQ7Sc/j/6DtPL3JQvKxmjO9TSjNFpujqV3vEYYBvNNvXSxzyksBWAx1Q==",
+      "deprecated": "v4 is no longer maintained, upgrade to v5",
+      "license": "MIT",
+      "dependencies": {
+        "luxon": "^3.2.1"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
     "node_modules/cross-spawn": {
       "version": "7.0.6",
       "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
@@ -7134,6 +7101,15 @@
         "url": "https://github.com/sponsors/wellwelwel"
       }
     },
+    "node_modules/luxon": {
+      "version": "3.7.2",
+      "resolved": "https://registry.npmjs.org/luxon/-/luxon-3.7.2.tgz",
+      "integrity": "sha512-vtEhXh/gNjI9Yg1u4jX/0YVPMvxzHuGgCm6tC5kZyb08yjGWGnqAjGJvcXbqQR2P3MyMEFnRbpcdFS6PBcLqew==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/magic-string": {
       "version": "0.30.21",
       "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
@@ -7761,6 +7737,20 @@
         }
       }
     },
+    "node_modules/pg-boss": {
+      "version": "10.4.2",
+      "resolved": "https://registry.npmjs.org/pg-boss/-/pg-boss-10.4.2.tgz",
+      "integrity": "sha512-AttEWOtSzn53av8OnCMWEanwRBvjkZCE1y5nLrZnwvkkMnlZ5XpWDpZ7sKI/BYjvi2OVieMX37arD2ACgJ750w==",
+      "license": "MIT",
+      "dependencies": {
+        "cron-parser": "^4.9.0",
+        "pg": "^8.16.3",
+        "serialize-error": "^8.1.0"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
     "node_modules/pg-cloudflare": {
       "version": "1.4.1",
       "resolved": "https://registry.npmjs.org/pg-cloudflare/-/pg-cloudflare-1.4.1.tgz",
@@ -8526,6 +8516,33 @@
       "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "license": "MIT"
     },
+    "node_modules/serialize-error": {
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/serialize-error/-/serialize-error-8.1.0.tgz",
+      "integrity": "sha512-3NnuWfM6vBYoy5gZFvHiYsVbafvI9vZv/+jlIigFn4oP4zjNPK3LhcY0xSCgeb1a5L8jO71Mit9LlNoi2UfDDQ==",
+      "license": "MIT",
+      "dependencies": {
+        "type-fest": "^0.20.2"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/serialize-error/node_modules/type-fest": {
+      "version": "0.20.2",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.20.2.tgz",
+      "integrity": "sha512-Ne+eE4r0/iWnpAxD852z3A+N0Bt5RN//NjJwRd2VFHEmrywxf5vsZlh4R6lixl6B+wz/8d+maTSAkN1FIkI3LQ==",
+      "license": "(MIT OR CC0-1.0)",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/serve-static": {
       "version": "1.16.2",
       "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.16.2.tgz",

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "event-management-backend",
-  "version": "1.28.1",
+  "version": "1.34.0",
   "description": "Event Management System Backend",
   "main": "src/index.js",
   "scripts": {
@@ -23,6 +23,7 @@
     "axios": "^1.11.0",
     "bcryptjs": "^2.4.3",
     "cors": "^2.8.5",
+    "cron-parser": "^4.9.0",
     "dotenv": "^16.3.1",
     "exceljs": "^4.4.0",
     "express": "^4.18.2",
@@ -33,6 +34,7 @@
     "node-fetch": "^2.7.0",
     "nodemailer": "^10.0.16",
     "pdfkit": "^0.17.1",
+    "pg-boss": "^10.4.2",
     "qrcode": "^1.5.4",
     "raw-body": "^3.0.0",
     "uuid": "^11.1.1"

backend/prisma/migrations/20261021141045_add_bundle_kinds/migration.sql

@@ -0,0 +1,12 @@
+-- CreateEnum
+CREATE TYPE "BundleKind" AS ENUM ('exact', 'mix', 'free', 'group');
+
+-- CreateEnum
+CREATE TYPE "BundleGroupPricing" AS ENUM ('per_ticket', 'percent');
+
+-- AlterTable
+ALTER TABLE "EventBundle" ADD COLUMN     "freeCount" INTEGER,
+ADD COLUMN     "groupPricing" "BundleGroupPricing",
+ADD COLUMN     "kind" "BundleKind" NOT NULL DEFAULT 'exact',
+ADD COLUMN     "setSize" INTEGER;
+

backend/prisma/migrations/20261022120410_add_event_sessions/migration.sql

@@ -0,0 +1,132 @@
+-- CreateEnum
+CREATE TYPE "ScheduleType" AS ENUM ('single', 'sessions');
+
+-- CreateEnum
+CREATE TYPE "AttendanceMode" AS ENUM ('whole', 'pick');
+
+-- CreateEnum
+CREATE TYPE "LatePricing" AS ENUM ('full', 'prorata', 'fixed');
+
+-- CreateEnum
+CREATE TYPE "CheckInWindow" AS ENUM ('whole_day', 'session_only');
+
+-- AlterEnum
+-- This migration adds more than one value to an enum.
+-- With PostgreSQL versions 11 and earlier, this is not possible
+-- in a single migration. This can be worked around by creating
+-- multiple migrations, each migration adding only one value to
+-- the enum.
+
+
+ALTER TYPE "AdminAuditAction" ADD VALUE 'event_sessions_changed';
+ALTER TYPE "AdminAuditAction" ADD VALUE 'attendance_marked';
+ALTER TYPE "AdminAuditAction" ADD VALUE 'attendance_unmarked';
+ALTER TYPE "AdminAuditAction" ADD VALUE 'certificate_issued';
+ALTER TYPE "AdminAuditAction" ADD VALUE 'certificate_revoked';
+
+-- AlterTable
+ALTER TABLE "Event" ADD COLUMN     "attendanceMode" "AttendanceMode" NOT NULL DEFAULT 'whole',
+ADD COLUMN     "certificateConfig" JSONB,
+ADD COLUMN     "certificatesEnabled" BOOLEAN NOT NULL DEFAULT false,
+ADD COLUMN     "checkInWindow" "CheckInWindow" NOT NULL DEFAULT 'whole_day',
+ADD COLUMN     "lateFixedPrice" DOUBLE PRECISION,
+ADD COLUMN     "lateJoinEnabled" BOOLEAN NOT NULL DEFAULT false,
+ADD COLUMN     "lateJoinUntilSessionId" TEXT,
+ADD COLUMN     "latePricing" "LatePricing" NOT NULL DEFAULT 'full',
+ADD COLUMN     "scheduleType" "ScheduleType" NOT NULL DEFAULT 'single',
+ADD COLUMN     "sessionReminders" JSONB;
+
+-- AlterTable
+ALTER TABLE "TicketUsage" ADD COLUMN     "manual" BOOLEAN NOT NULL DEFAULT false,
+ADD COLUMN     "sessionId" TEXT;
+
+-- CreateTable
+CREATE TABLE "EventSession" (
+    "id" TEXT NOT NULL,
+    "eventId" TEXT NOT NULL,
+    "label" TEXT,
+    "startsAt" TIMESTAMP(3) NOT NULL,
+    "endsAt" TIMESTAMP(3) NOT NULL,
+    "location" TEXT,
+    "cancelledAt" TIMESTAMP(3),
+    "order" INTEGER NOT NULL DEFAULT 0,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "EventSession_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "SessionReminderLog" (
+    "id" TEXT NOT NULL,
+    "sessionId" TEXT NOT NULL,
+    "offset" INTEGER NOT NULL,
+    "sent" INTEGER NOT NULL DEFAULT 0,
+    "sentAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "SessionReminderLog_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "Certificate" (
+    "id" TEXT NOT NULL,
+    "eventId" TEXT NOT NULL,
+    "ticketId" TEXT NOT NULL,
+    "userId" TEXT,
+    "name" TEXT NOT NULL,
+    "code" TEXT NOT NULL,
+    "sessionsAttended" INTEGER NOT NULL DEFAULT 0,
+    "totalSessions" INTEGER NOT NULL DEFAULT 0,
+    "manual" BOOLEAN NOT NULL DEFAULT false,
+    "issuedById" TEXT,
+    "issuedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "emailedAt" TIMESTAMP(3),
+    "revokedAt" TIMESTAMP(3),
+
+    CONSTRAINT "Certificate_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "EventSession_eventId_startsAt_idx" ON "EventSession"("eventId", "startsAt");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "SessionReminderLog_sessionId_offset_key" ON "SessionReminderLog"("sessionId", "offset");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "Certificate_code_key" ON "Certificate"("code");
+
+-- CreateIndex
+CREATE INDEX "Certificate_userId_idx" ON "Certificate"("userId");
+
+-- CreateIndex
+CREATE INDEX "Certificate_ticketId_idx" ON "Certificate"("ticketId");
+
+-- CreateIndex
+CREATE INDEX "Certificate_issuedById_idx" ON "Certificate"("issuedById");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "Certificate_eventId_ticketId_key" ON "Certificate"("eventId", "ticketId");
+
+-- CreateIndex
+CREATE INDEX "TicketUsage_sessionId_idx" ON "TicketUsage"("sessionId");
+
+-- AddForeignKey
+ALTER TABLE "TicketUsage" ADD CONSTRAINT "TicketUsage_sessionId_fkey" FOREIGN KEY ("sessionId") REFERENCES "EventSession"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "EventSession" ADD CONSTRAINT "EventSession_eventId_fkey" FOREIGN KEY ("eventId") REFERENCES "Event"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "SessionReminderLog" ADD CONSTRAINT "SessionReminderLog_sessionId_fkey" FOREIGN KEY ("sessionId") REFERENCES "EventSession"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "Certificate" ADD CONSTRAINT "Certificate_eventId_fkey" FOREIGN KEY ("eventId") REFERENCES "Event"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "Certificate" ADD CONSTRAINT "Certificate_ticketId_fkey" FOREIGN KEY ("ticketId") REFERENCES "Ticket"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "Certificate" ADD CONSTRAINT "Certificate_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "Certificate" ADD CONSTRAINT "Certificate_issuedById_fkey" FOREIGN KEY ("issuedById") REFERENCES "User"("id") ON DELETE SET NULL ON UPDATE CASCADE;

backend/prisma/migrations/20261022150000_add_job_run_audit_action/migration.sql

@@ -0,0 +1,2 @@
+-- AlterEnum
+ALTER TYPE "AdminAuditAction" ADD VALUE 'job_run_manual';

backend/prisma/schema.prisma

@@ -119,6 +119,8 @@ model User {
 
   twoFactorChallenges TwoFactorChallenge[]
   trustedDevices      TrustedDevice[]
+  certificates        Certificate[]
+  certificatesIssued  Certificate[] @relation("CertificateIssuedBy")
 }
 
 model Event {
@@ -199,6 +201,28 @@ model Event {
   scanLocks        ScanLock[]
   bundles          EventBundle[]
 
+  // Multi-day events: `sessions` is one event running on several dates (e.g. every
+  // Wednesday for 5 weeks). startDate/endDate are kept in sync with the first session's
+  // start and the last session's end (see utils/sessions.js), so code that only reads
+  // them keeps working.
+  scheduleType           ScheduleType   @default(single)
+  attendanceMode         AttendanceMode @default(whole)
+  // Late joining: registration stays open until session `lateJoinUntilSessionId` starts
+  // (otherwise it closes when the first session starts). Late pricing applies to main
+  // tickets only.
+  lateJoinEnabled        Boolean        @default(false)
+  lateJoinUntilSessionId String?
+  latePricing            LatePricing    @default(full)
+  lateFixedPrice         Float?
+  checkInWindow          CheckInWindow  @default(whole_day)
+  // null = off; { offsets: [minutes before start], channels: ["email", "whatsapp"] }
+  sessionReminders       Json?
+  certificatesEnabled    Boolean        @default(false)
+  // { template, title, body, signatureName, signatureRole, signatureImage, rule: { type, value } }
+  certificateConfig      Json?
+  sessions               EventSession[]
+  certificates           Certificate[]
+
   @@index([createdById])
   @@index([closedById])
   @@index([reopenedById])
@@ -398,6 +422,7 @@ model Ticket {
   usages               TicketUsage[]
   transfers            TicketTransfer[]
   transferRequests     TicketTransferRequest[]
+  certificates         Certificate[]
 
   @@index([holderUserId])
   @@index([eventId])
@@ -418,6 +443,11 @@ model TicketUsage {
   offline          Boolean   @default(false)
   scanLockId       String?
   syncedAt         DateTime?
+  // Multi-day events: the session this check-in counts for (null on single-date events).
+  sessionId        String?
+  session          EventSession? @relation(fields: [sessionId], references: [id], onDelete: Restrict)
+  // Ticked present by a supervisor from the attendance register, not scanned.
+  manual           Boolean   @default(false)
   ticket           Ticket    @relation(fields: [ticketId], references: [id], onDelete: Restrict)
   scannedBy        User      @relation(fields: [scannedById], references: [id], onDelete: Restrict)
   scanLock         ScanLock? @relation(fields: [scanLockId], references: [id], onDelete: SetNull)
@@ -425,6 +455,7 @@ model TicketUsage {
   @@index([ticketId])
   @@index([scannedAt])
   @@index([scannedById, scannedAt])
+  @@index([sessionId])
 }
 
 model PasswordReset {
@@ -518,6 +549,12 @@ enum AdminAuditAction {
   yoco_config_updated
   yoco_webhook_registered
   yoco_webhook_deleted
+  event_sessions_changed
+  attendance_marked
+  attendance_unmarked
+  certificate_issued
+  certificate_revoked
+  job_run_manual
 }
 
 // Append-only audit trail for admin/supervisor-initiated actions with money or
@@ -914,29 +951,52 @@ model CouponRedemption {
 
 // ─── Bundle deals ─────────────────────────────────────────────────────────────
 
-// A set of tickets sold together for one price, e.g. 5 Adult + 3 Child for R500.
-// Applied automatically, as many times as a registration's items allow, and only
-// when it beats what the items would cost anyway (see utils/bundles.js).
+// How a bundle is made up (see utils/bundles.js):
+// exact: these tickets in these numbers, for `price`, e.g. 5 Adult + 3 Child for R500
+// mix:   any `setSize` of the qualifying tickets, for `price`
+// free:  any `setSize` of the qualifying tickets, the cheapest `freeCount` free
+// group: `setSize` or more qualifying tickets, all at `price` each (or `price`% off)
+enum BundleKind {
+  exact
+  mix
+  free
+  group
+}
+
+enum BundleGroupPricing {
+  per_ticket
+  percent
+}
+
+// Tickets sold together at a better price. Applied automatically, as many times as a
+// registration's items allow (a group discount once), and only when it beats what the
+// items would cost anyway (see utils/bundles.js).
 model EventBundle {
-  id          String               @id @default(uuid())
-  eventId     String
-  name        String
-  description String?
-  price       Float
-  isActive    Boolean              @default(true)
-  validFrom   DateTime?
-  validUntil  DateTime?
-  order       Int                  @default(0)
-  createdAt   DateTime             @default(now())
-  updatedAt   DateTime             @updatedAt
-  event       Event                @relation(fields: [eventId], references: [id], onDelete: Cascade)
-  items       EventBundleItem[]
-  uses        RegistrationBundle[]
+  id           String               @id @default(uuid())
+  eventId      String
+  name         String
+  description  String?
+  kind         BundleKind           @default(exact)
+  // exact/mix: the set's price. group: the per-ticket price, or the percentage off.
+  price        Float
+  setSize      Int?
+  freeCount    Int?
+  groupPricing BundleGroupPricing?
+  isActive     Boolean              @default(true)
+  validFrom    DateTime?
+  validUntil   DateTime?
+  order        Int                  @default(0)
+  createdAt    DateTime             @default(now())
+  updatedAt    DateTime             @updatedAt
+  event        Event                @relation(fields: [eventId], references: [id], onDelete: Cascade)
+  items        EventBundleItem[]
+  uses         RegistrationBundle[]
 
   @@index([eventId])
 }
 
-// One line of a bundle. variantId null = any variant of the option.
+// One line of a bundle: for exact bundles a ticket and how many; for the others a
+// qualifying ticket (quantity unused). variantId null = any variant of the option.
 model EventBundleItem {
   id            String         @id @default(uuid())
   bundleId      String
@@ -1368,3 +1428,85 @@ model OfflineSyncReport {
   @@index([scanLockId])
   @@index([reviewedById])
 }
+
+enum ScheduleType {
+  single
+  sessions
+}
+
+enum AttendanceMode {
+  whole
+  pick
+}
+
+enum LatePricing {
+  full
+  prorata
+  fixed
+}
+
+enum CheckInWindow {
+  whole_day
+  session_only
+}
+
+// One date/time of a multi-day event.
+model EventSession {
+  id          String    @id @default(uuid())
+  eventId     String
+  label       String?
+  startsAt    DateTime
+  endsAt      DateTime
+  location    String?
+  // Cancelled sessions are kept (they may have check-ins) but hidden from the schedule
+  // and left out of attendance totals.
+  cancelledAt DateTime?
+  order       Int       @default(0)
+  createdAt   DateTime  @default(now())
+  updatedAt   DateTime  @updatedAt
+  event       Event     @relation(fields: [eventId], references: [id], onDelete: Cascade)
+  usages      TicketUsage[]
+  reminders   SessionReminderLog[]
+
+  @@index([eventId, startsAt])
+}
+
+// Which session reminders have gone out, so the job sends each one once.
+model SessionReminderLog {
+  id        String       @id @default(uuid())
+  sessionId String
+  // Minutes before the session start this reminder is for.
+  offset    Int
+  sent      Int          @default(0)
+  sentAt    DateTime     @default(now())
+  session   EventSession @relation(fields: [sessionId], references: [id], onDelete: Cascade)
+
+  @@unique([sessionId, offset])
+}
+
+// A completion certificate for one ticket (one person).
+model Certificate {
+  id          String    @id @default(uuid())
+  eventId     String
+  ticketId    String
+  userId      String?
+  name        String
+  // Short code printed on the certificate and checked on the public verify page.
+  code        String    @unique
+  sessionsAttended Int  @default(0)
+  totalSessions    Int  @default(0)
+  manual      Boolean   @default(false)
+  issuedById  String?
+  issuedAt    DateTime  @default(now())
+  emailedAt   DateTime?
+  revokedAt   DateTime?
+  event       Event     @relation(fields: [eventId], references: [id], onDelete: Cascade)
+  ticket      Ticket    @relation(fields: [ticketId], references: [id], onDelete: Cascade)
+  user        User?     @relation(fields: [userId], references: [id], onDelete: SetNull)
+  issuedBy    User?     @relation("CertificateIssuedBy", fields: [issuedById], references: [id], onDelete: SetNull)
+
+  @@unique([eventId, ticketId])
+  @@index([userId])
+  @@index([ticketId])
+  @@index([issuedById])
+}

backend/scripts/set-demo.js

@@ -243,9 +243,9 @@ function addSection(event, name, options) {
   return section;
 }
 
-/** A bundle deal: items are [option, quantity] pairs. */
+/** A bundle deal: items are [option, quantity] pairs (quantity 1 for pick-any and the other kinds). */
 function addBundle(event, data, items) {
-  const bundle = add('eventBundle', { id: uuidv4(), eventId: event.id, description: null, isActive: true, validFrom: null, validUntil: null, order: 0, createdAt: addTime(NOW, -30 * DAY), updatedAt: NOW, ...data });
+  const bundle = add('eventBundle', { id: uuidv4(), eventId: event.id, description: null, kind: 'exact', setSize: null, freeCount: null, groupPricing: null, isActive: true, validFrom: null, validUntil: null, order: 0, createdAt: addTime(NOW, -30 * DAY), updatedAt: NOW, ...data });
   for (const [option, quantity] of items) add('eventBundleItem', { id: uuidv4(), bundleId: bundle.id, eventOptionId: option.id, variantId: null, quantity });
   return bundle;
 }
@@ -454,6 +454,7 @@ function buildFamilyFunDay(people) {
   const child = addOption(event, { name: 'Child (3–12)', price: 40 });
   const lunch = addOption(event, { name: 'Lunch pack', price: 65, isMainTicket: false });
   addBundle(event, { name: 'Family deal', price: 220, description: 'Two adults and three kids, R60 less than buying them separately.' }, [[adult, 2], [child, 3]]);
+  addBundle(event, { name: 'Lunch for four', kind: 'mix', setSize: 4, price: 220, description: 'Any four lunch packs for R220.' }, [[lunch, 1]]);
 
   add('coupon', {
     id: uuidv4(), code: 'FUNDAY20', description: 'R20 off for first-time visitors', type: 'fixed', value: 20,

backend/src/controllers/attendanceController.js

@@ -0,0 +1,397 @@
+const ExcelJS = require('exceljs');
+const PDFDocument = require('pdfkit');
+const prisma = require('../config/db');
+const { safeErrorMessage } = require('../utils/errorUtils');
+const { logAdminAction } = require('../utils/adminAudit');
+const { getClientIp } = require('../utils/requestUtils');
+const sessionsUtil = require('../utils/sessions');
+const certificates = require('../utils/certificates');
+
+const SUPERVISORS = ['admin', 'supervisor'];
+const fail = (res, error) => res.status(error.statusCode || (res.statusCode === 200 ? 400 : res.statusCode)).json({ message: safeErrorMessage(error) });
+const notFound = (msg) => Object.assign(new Error(msg), { statusCode: 404 });
+const badRequest = (msg) => Object.assign(new Error(msg), { statusCode: 400 });
+
+// Single-date events have no sessions; the register treats the event itself as one
+// column with this id (its check-ins have no sessionId).
+const WHOLE_EVENT = 'event';
+
+/**
+ * The attendance register for an event: columns (sessions), one row per main ticket with
+ * check-ins per session, and certificate status.
+ */
+async function buildRegister(eventId) {
+  const event = await prisma.event.findUnique({
+    where: { id: eventId },
+    include: { sessions: { orderBy: { startsAt: 'asc' } } },
+  });
+  if (!event) throw notFound('Event not found');
+  const multi = event.scheduleType === 'sessions';
+  const active = sessionsUtil.activeSessions(event.sessions);
+  const columns = multi
+    ? event.sessions.map(s => ({
+      id: s.id, label: s.cancelledAt ? (s.label || 'Session') : sessionsUtil.sessionLabel(s, event.sessions),
+      startsAt: s.startsAt, endsAt: s.endsAt, cancelled: !!s.cancelledAt,
+    }))
+    : [{ id: WHOLE_EVENT, label: 'Checked in', startsAt: event.startDate, endsAt: event.endDate, cancelled: false }];
+
+  const tickets = await prisma.ticket.findMany({
+    where: { eventId, registrationOption: { eventOption: { isMainTicket: true }, registration: { status: { not: 'cancelled' } } } },
+    include: {
+      attendee: { select: { name: true } },
+      holder: { select: { name: true } },
+      user: { select: { name: true, email: true, phoneNumber: true } },
+      usages: { select: { quantityRedeemed: true, sessionId: true, manual: true } },
+      registrationOption: { select: { eventOption: { select: { name: true } }, variant: { select: { name: true } } } },
+      certificates: { select: { id: true, code: true, issuedAt: true, revokedAt: true, manual: true, emailedAt: true } },
+    },
+    orderBy: { createdAt: 'asc' },
+  });
+
+  const activeIds = new Set(active.map(s => s.id));
+  const config = sessionsUtil.normalizeCertificateConfig(event.certificateConfig);
+  const rows = tickets.map(t => {
+    const bySession = {};
+    for (const u of t.usages) {
+      const key = multi ? u.sessionId : WHOLE_EVENT;
+      if (!key) continue;
+      bySession[key] = (bySession[key] || 0) + (u.quantityRedeemed || 1);
+    }
+    const attended = multi ? Object.keys(bySession).filter(k => activeIds.has(k)).length : (bySession[WHOLE_EVENT] ? 1 : 0);
+    const total = multi ? active.length : 1;
+    const cert = t.certificates[0] || null;
+    return {
+      ticketId: t.id,
+      name: t.attendee?.name || t.holder?.name || t.user?.name || '',
+      bookedBy: t.attendee || t.holder ? t.user?.name || '' : '',
+      email: t.user?.email || '',
+      phone: t.user?.phoneNumber || '',
+      option: t.registrationOption?.eventOption?.name || '',
+      variant: t.registrationOption?.variant?.name || null,
+      quantity: t.quantity || 1,
+      checkIns: bySession,
+      attended,
+      total,
+      completed: sessionsUtil.completionMet(config.rule, attended, total),
+      certificate: cert,
+    };
+  }).sort((a, b) => a.name.localeCompare(b.name));
+
+  const totals = Object.fromEntries(columns.map(c => [c.id, rows.reduce((n, r) => n + (r.checkIns[c.id] ? 1 : 0), 0)]));
+  return {
+    event: {
+      id: event.id, title: event.title, scheduleType: event.scheduleType, startDate: event.startDate, endDate: event.endDate,
+      cashupStatus: event.cashupStatus, certificatesEnabled: event.certificatesEnabled, certificateConfig: config,
+    },
+    columns,
+    rows,
+    totals,
+  };
+}
+
+// @desc    Attendance register (sessions × attendees)
+// @route   GET /api/attendance/:eventId
+// @access  Private/Staff
+const getRegister = async (req, res) => {
+  try {
+    res.json(await buildRegister(req.params.eventId));
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    Tick someone present or absent for a session (e.g. let in without a scan)
+// @route   POST /api/attendance/:eventId/mark   body: { ticketId, sessionId, present }
+// @access  Private/Supervisor
+const markAttendance = async (req, res) => {
+  try {
+    const { eventId } = req.params;
+    const { ticketId, present } = req.body || {};
+    const sessionKey = String(req.body?.sessionId || '');
+    const ticket = await prisma.ticket.findUnique({ where: { id: String(ticketId || '') }, include: { usages: true, event: { select: { scheduleType: true, cashupStatus: true } } } });
+    if (!ticket || ticket.eventId !== eventId) throw notFound('Ticket not found for this event');
+    if (ticket.event.cashupStatus === 'closed') throw badRequest('This event is closed — reopen it to change attendance.');
+    const multi = ticket.event.scheduleType === 'sessions';
+    let sessionId = null;
+    if (multi) {
+      const session = await prisma.eventSession.findUnique({ where: { id: sessionKey } });
+      if (!session || session.eventId !== eventId) throw notFound('Session not found for this event');
+      if (session.cancelledAt) throw badRequest('That session was cancelled');
+      sessionId = session.id;
+    } else if (sessionKey !== WHOLE_EVENT) {
+      throw badRequest('This event has no sessions');
+    }
+
+    const forSession = ticket.usages.filter(u => (u.sessionId || null) === sessionId);
+    if (present === true) {
+      const redeemed = forSession.reduce((s, u) => s + (u.quantityRedeemed || 1), 0);
+      const left = (ticket.quantity || 1) - redeemed;
+      if (left > 0) {
+        await prisma.ticketUsage.create({ data: { ticketId: ticket.id, scannedById: req.user.id, quantityRedeemed: left, sessionId, manual: true } });
+        if (!multi) await prisma.ticket.update({ where: { id: ticket.id }, data: { isUsed: true, updatedAt: new Date() } });
+      }
+    } else {
+      if (forSession.length > 0) {
+        await prisma.ticketUsage.deleteMany({ where: { id: { in: forSession.map(u => u.id) } } });
+        if (!multi) await prisma.ticket.update({ where: { id: ticket.id }, data: { isUsed: false, updatedAt: new Date() } });
+      }
+    }
+    logAdminAction({
+      actorId: req.user.id, actorRole: req.user.role,
+      action: present === true ? 'attendance_marked' : 'attendance_unmarked',
+      targetType: 'Ticket', targetId: ticket.id,
+      metadata: { eventId, sessionId, removedScans: present === true ? 0 : forSession.length },
+      ip: getClientIp(req),
+    });
+    res.json({ ok: true });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+function registerFileName(reg, ext) {
+  return `Attendance - ${reg.event.title}`.replace(/[^a-z0-9 -]/gi, '').slice(0, 80) + `.${ext}`;
+}
+
+function fmtColumnDate(d) {
+  return new Date(d).toLocaleDateString('en-GB', { timeZone: sessionsUtil.TIMEZONE, day: 'numeric', month: 'short' });
+}
+
+// @desc    Download the attendance register as Excel or PDF
+// @route   GET /api/attendance/:eventId/export?format=xlsx|pdf
+// @access  Private/Staff
+const exportRegister = async (req, res) => {
+  try {
+    const reg = await buildRegister(req.params.eventId);
+    const cols = reg.columns.filter(c => !c.cancelled);
+    if (req.query.format === 'pdf') {
+      const doc = new PDFDocument({ size: 'A4', layout: 'landscape', margin: 36 });
+      res.setHeader('Content-Type', 'application/pdf');
+      res.setHeader('Content-Disposition', `attachment; filename="${registerFileName(reg, 'pdf')}"`);
+      doc.pipe(res);
+      doc.font('Helvetica-Bold').fontSize(16).text(`Attendance — ${reg.event.title}`);
+      doc.font('Helvetica').fontSize(9).fillColor('#64748b').text(`${reg.rows.length} attendee(s) · printed ${new Date().toLocaleString('en-GB', { timeZone: sessionsUtil.TIMEZONE })}`);
+      doc.moveDown(0.6);
+      const nameW = 170;
+      const totalW = 50;
+      const usable = doc.page.width - 72 - nameW - totalW;
+      const colW = Math.max(28, Math.min(70, usable / Math.max(1, cols.length)));
+      // Header height fits the longest session label.
+      const headText = (c) => `${c.label}\n${fmtColumnDate(c.startsAt)}`;
+      doc.font('Helvetica-Bold').fontSize(8);
+      const headH = Math.max(12, ...cols.map(c => doc.heightOfString(headText(c), { width: colW - 2 })));
+      const header = () => {
+        const y = doc.y;
+        doc.font('Helvetica-Bold').fontSize(8).fillColor('#1e293b').text('Name', 36, y + headH - 10, { width: nameW });
+        cols.forEach((c, i) => doc.text(headText(c), 36 + nameW + i * colW, y, { width: colW - 2, align: 'center' }));
+        doc.text('Total', 36 + nameW + cols.length * colW, y + headH - 10, { width: totalW, align: 'center' });
+        doc.y = y + headH + 6;
+        doc.moveTo(36, doc.y - 3).lineTo(doc.page.width - 36, doc.y - 3).lineWidth(0.5).strokeColor('#cbd5e1').stroke();
+        doc.y += 2;
+      };
+      // The built-in PDF fonts have no ✓, so the tick is drawn.
+      const tick = (cx, cy) => {
+        doc.save().lineWidth(1.4).strokeColor('#15803d')
+          .moveTo(cx - 3.5, cy).lineTo(cx - 1, cy + 2.8).lineTo(cx + 4, cy - 3).stroke().restore();
+      };
+      header();
+      for (const r of reg.rows) {
+        if (doc.y > doc.page.height - 50) { doc.addPage(); header(); }
+        const y = doc.y;
+        doc.font('Helvetica').fontSize(8.5).fillColor('#1e293b').text(r.name + (r.quantity > 1 ? ` (×${r.quantity})` : ''), 36, y, { width: nameW, ellipsis: true, lineBreak: false });
+        cols.forEach((c, i) => {
+          const qty = r.checkIns[c.id] || 0;
+          const x = 36 + nameW + i * colW;
+          if (qty && r.quantity <= 1) tick(x + (colW - 2) / 2, y + 4);
+          else doc.fillColor(qty ? '#15803d' : '#cbd5e1').text(qty ? String(qty) : '·', x, y, { width: colW - 2, align: 'center', lineBreak: false });
+        });
+        doc.fillColor('#1e293b').text(`${r.attended}/${r.total}`, 36 + nameW + cols.length * colW, y, { width: totalW, align: 'center', lineBreak: false });
+        doc.y = y + 14;
+      }
+      doc.moveDown(0.5);
+      const y = doc.y;
+      doc.font('Helvetica-Bold').fontSize(8.5).text('Present', 36, y, { width: nameW });
+      cols.forEach((c, i) => doc.text(String(reg.totals[c.id] || 0), 36 + nameW + i * colW, y, { width: colW - 2, align: 'center', lineBreak: false }));
+      doc.end();
+      return;
+    }
+
+    const wb = new ExcelJS.Workbook();
+    const ws = wb.addWorksheet('Attendance');
+    ws.addRow(['Name', 'Booked by', 'Ticket', 'Email', 'Phone', 'Places', ...cols.map(c => `${c.label} (${fmtColumnDate(c.startsAt)})`), 'Attended', 'Completed', 'Certificate']);
+    ws.getRow(1).font = { bold: true };
+    for (const r of reg.rows) {
+      ws.addRow([
+        r.name, r.bookedBy, r.variant ? `${r.option} — ${r.variant}` : r.option, r.email, r.phone, r.quantity,
+        ...cols.map(c => r.checkIns[c.id] ? (r.quantity > 1 ? r.checkIns[c.id] : '✓') : ''),
+        `${r.attended}/${r.total}`, r.completed ? 'Yes' : 'No',
+        r.certificate && !r.certificate.revokedAt ? r.certificate.code : '',
+      ]);
+    }
+    ws.addRow([]);
+    ws.addRow(['Present', '', '', '', '', '', ...cols.map(c => reg.totals[c.id] || 0)]).font = { bold: true };
+    ws.columns.forEach((col, i) => { col.width = i < 5 ? 22 : 14; });
+    res.setHeader('Content-Type', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet');
+    res.setHeader('Content-Disposition', `attachment; filename="${registerFileName(reg, 'xlsx')}"`);
+    await wb.xlsx.write(res);
+    res.end();
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// ─── Certificates (supervisor) ────────────────────────────────────────────────
+
+async function assertCertificatesOn(eventId) {
+  const event = await prisma.event.findUnique({ where: { id: eventId }, select: { id: true, title: true, endDate: true, certificatesEnabled: true, certificateConfig: true } });
+  if (!event) throw notFound('Event not found');
+  if (!event.certificatesEnabled) throw badRequest('Certificates are switched off for this event (Edit event → Attendance).');
+  return event;
+}
+
+// @desc    Issue certificates now — to everyone eligible, or one ticket (even if not eligible)
+// @route   POST /api/attendance/:eventId/certificates   body: { ticketId? }
+// @access  Private/Supervisor
+const issueCertificates = async (req, res) => {
+  try {
+    await assertCertificatesOn(req.params.eventId);
+    const created = req.body?.ticketId
+      ? [await certificates.issueManual(req.params.eventId, String(req.body.ticketId), req.user.id)]
+      : await certificates.issueEligible(req.params.eventId, { issuedById: req.user.id });
+    for (const c of created) {
+      logAdminAction({ actorId: req.user.id, actorRole: req.user.role, action: 'certificate_issued', targetType: 'Certificate', targetId: c.id, metadata: { eventId: req.params.eventId, ticketId: c.ticketId, manual: !!req.body?.ticketId }, ip: getClientIp(req) });
+    }
+    res.json({ issued: created.length });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    Revoke a certificate (the automatic job won't issue it again)
+// @route   POST /api/attendance/certificates/:id/revoke
+// @access  Private/Supervisor
+const revokeCertificate = async (req, res) => {
+  try {
+    const cert = await prisma.certificate.findUnique({ where: { id: req.params.id } });
+    if (!cert) throw notFound('Certificate not found');
+    await prisma.certificate.update({ where: { id: cert.id }, data: { revokedAt: new Date() } });
+    logAdminAction({ actorId: req.user.id, actorRole: req.user.role, action: 'certificate_revoked', targetType: 'Certificate', targetId: cert.id, metadata: { eventId: cert.eventId, ticketId: cert.ticketId }, ip: getClientIp(req) });
+    res.json({ ok: true });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    Email/WhatsApp certificates that haven't been sent yet (or one, again)
+// @route   POST /api/attendance/:eventId/certificates/send   body: { certificateId? }
+// @access  Private/Supervisor
+const sendCertificatesHandler = async (req, res) => {
+  try {
+    await assertCertificatesOn(req.params.eventId);
+    const where = req.body?.certificateId
+      ? { id: String(req.body.certificateId), eventId: req.params.eventId }
+      : { eventId: req.params.eventId, emailedAt: null };
+    const ids = (await prisma.certificate.findMany({ where: { ...where, revokedAt: null }, select: { id: true } })).map(c => c.id);
+    const sent = await certificates.sendCertificates(ids);
+    res.json({ sent, skipped: ids.length - sent });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    All of an event's certificates in one PDF (one page each)
+// @route   GET /api/attendance/:eventId/certificates.pdf
+// @access  Private/Supervisor
+const downloadEventCertificates = async (req, res) => {
+  try {
+    const event = await assertCertificatesOn(req.params.eventId);
+    const certs = await prisma.certificate.findMany({ where: { eventId: event.id, revokedAt: null }, orderBy: { name: 'asc' } });
+    if (certs.length === 0) throw badRequest('No certificates have been issued for this event yet.');
+    const pdf = await certificates.renderCertificatesPdf(certs, event);
+    res.setHeader('Content-Type', 'application/pdf');
+    res.setHeader('Content-Disposition', `attachment; filename="${`Certificates - ${event.title}`.replace(/[^a-z0-9 -]/gi, '').slice(0, 80)}.pdf"`);
+    res.send(pdf);
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    Sample certificate with the editor's (unsaved) settings
+// @route   POST /api/attendance/certificates/preview   body: { title, config }
+// @access  Private/Supervisor
+const previewCertificate = async (req, res) => {
+  try {
+    const event = { title: String(req.body?.title || 'Your event').slice(0, 200), endDate: new Date() };
+    const pdf = await certificates.renderCertificatesPdf([certificates.sampleCertificate()], event, req.body?.config || {});
+    res.setHeader('Content-Type', 'application/pdf');
+    res.setHeader('Content-Disposition', 'inline; filename="certificate-preview.pdf"');
+    res.send(pdf);
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// ─── Certificates (attendees, public) ─────────────────────────────────────────
+
+// @desc    The logged-in user's certificates
+// @route   GET /api/attendance/certificates/mine
+// @access  Private
+const myCertificates = async (req, res) => {
+  try {
+    const certs = await prisma.certificate.findMany({
+      where: { revokedAt: null, OR: [{ userId: req.user.id }, { ticket: { userId: req.user.id } }] },
+      include: { event: { select: { id: true, title: true, endDate: true } } },
+      orderBy: { issuedAt: 'desc' },
+    });
+    res.json(certs.map(c => ({ id: c.id, code: c.code, name: c.name, issuedAt: c.issuedAt, sessionsAttended: c.sessionsAttended, totalSessions: c.totalSessions, event: c.event })));
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    Download one certificate (its person, the booker, or a supervisor)
+// @route   GET /api/attendance/certificates/:id/pdf
+// @access  Private
+const downloadCertificate = async (req, res) => {
+  try {
+    const cert = await prisma.certificate.findUnique({
+      where: { id: req.params.id },
+      include: { ticket: { select: { userId: true } }, event: { select: { id: true, title: true, endDate: true, certificateConfig: true } } },
+    });
+    const allowed = cert && (SUPERVISORS.includes(req.user.role) || cert.userId === req.user.id || cert.ticket?.userId === req.user.id);
+    if (!allowed || cert.revokedAt) throw notFound('Certificate not found');
+    const pdf = await certificates.renderCertificatesPdf([cert], cert.event);
+    res.setHeader('Content-Type', 'application/pdf');
+    res.setHeader('Content-Disposition', `attachment; filename="${`Certificate - ${cert.event.title}`.replace(/[^a-z0-9 -]/gi, '').slice(0, 80)}.pdf"`);
+    res.send(pdf);
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+// @desc    Check a certificate code (public verify page). Shows only name, event and date.
+// @route   GET /api/attendance/certificates/verify/:code
+// @access  Public
+const verifyCertificate = async (req, res) => {
+  try {
+    const code = String(req.params.code || '').trim().toUpperCase().slice(0, 20);
+    const cert = await prisma.certificate.findUnique({ where: { code }, include: { event: { select: { title: true, endDate: true } } } });
+    if (!cert) return res.json({ valid: false });
+    res.json({
+      valid: !cert.revokedAt,
+      revoked: !!cert.revokedAt,
+      name: cert.name,
+      event: cert.event.title,
+      completedOn: cert.event.endDate,
+      issuedAt: cert.issuedAt,
+    });
+  } catch (error) {
+    fail(res, error);
+  }
+};
+
+module.exports = {
+  getRegister, markAttendance, exportRegister,
+  issueCertificates, revokeCertificate, sendCertificatesHandler, downloadEventCertificates, previewCertificate,
+  myCertificates, downloadCertificate, verifyCertificate,
+};

backend/src/controllers/bundleController.js

@@ -2,11 +2,13 @@ const prisma = require('../config/db');
 const { safeErrorMessage } = require('../utils/errorUtils');
 const { logAdminAction } = require('../utils/adminAudit');
 const { getClientIp } = require('../utils/requestUtils');
-const { describeBundleItems, isBundleAvailable } = require('../utils/bundles');
+const { KINDS, describeBundle, describeBundleItems, isBundleAvailable } = require('../utils/bundles');
 const { previewBundles } = require('../utils/coupons');
 const { basketBuyer, priceBasket } = require('./couponController');
 
 const round2 = (n) => Math.round(Number(n || 0) * 100) / 100;
+const fmtR = (n) => `R${Number(n || 0).toFixed(2).replace(/\.00$/, '')}`;
+const GROUP_PRICING = ['per_ticket', 'percent'];
 
 const optionalDate = (v, label) => {
   if (v === undefined) return undefined;
@@ -16,13 +18,37 @@ const optionalDate = (v, label) => {
   return d;
 };
 
-/** What the items would cost separately at the standard (variant or option) price. */
-function standardValue(bundle) {
-  return round2((bundle.items || []).reduce((s, i) => {
-    const variant = i.variantId ? (i.eventOption?.variants || []).find(v => v.id === i.variantId) : null;
-    const price = variant && variant.price !== null && variant.price !== undefined ? variant.price : i.eventOption?.price;
-    return s + Number(price || 0) * Number(i.quantity || 0);
-  }, 0));
+/** Standard (variant or option) price of one unit of an item. */
+function itemPrice(i) {
+  const variant = i.variantId ? (i.eventOption?.variants || []).find(v => v.id === i.variantId) : null;
+  return Number((variant && variant.price !== null && variant.price !== undefined ? variant.price : i.eventOption?.price) || 0);
+}
+
+/**
+ * What the deal is worth at standard prices: `standardValue` is what an exact set costs
+ * separately (or the dearest pick-any set); `savingText` is a short "save …" line, or
+ * null when the headline already says it.
+ */
+function valueOf(bundle) {
+  const kind = bundle.kind || 'exact';
+  const items = bundle.items || [];
+  const dearest = items.reduce((m, i) => Math.max(m, itemPrice(i)), 0);
+  const price = Number(bundle.price || 0);
+  if (kind === 'exact') {
+    const standard = round2(items.reduce((s, i) => s + itemPrice(i) * Number(i.quantity || 0), 0));
+    return { standardValue: standard, savingText: standard - price > 0.005 ? `save ${fmtR(standard - price)}` : null };
+  }
+  if (kind === 'mix') {
+    const standard = round2(dearest * Number(bundle.setSize || 0));
+    return { standardValue: standard, savingText: standard - price > 0.005 ? `save up to ${fmtR(standard - price)}` : null };
+  }
+  if (kind === 'free') {
+    return { standardValue: null, savingText: dearest > 0 ? `save up to ${fmtR(dearest * Number(bundle.freeCount || 0))} a set` : null };
+  }
+  if (bundle.groupPricing === 'per_ticket' && dearest - price > 0.005) {
+    return { standardValue: null, savingText: `save up to ${fmtR(dearest - price)} a ticket` };
+  }
+  return { standardValue: null, savingText: null };
 }
 
 // Items with prices loaded, so the standard value can be shown next to the bundle price.
@@ -41,16 +67,20 @@ function shape(bundle, now = new Date()) {
     ...bundle,
     items,
     summary: describeBundleItems(bundle),
-    standardValue: standardValue(bundle),
+    headline: describeBundle(bundle),
+    ...valueOf(bundle),
     available: isBundleAvailable(bundle, now),
   };
 }
 
+const PRICING_FIELDS = ['kind', 'price', 'setSize', 'freeCount', 'groupPricing', 'items'];
+
 /**
  * Turns a create/update body into Prisma data plus the item list. On update, fields
- * left out of the body are left alone. Items must belong to the bundle's event.
+ * left out of the body are left alone; when any pricing field is sent, the bundle as a
+ * whole (saved values plus the new ones) is checked. Items must belong to the event.
  */
-async function parseBundleBody(body, eventId, { isCreate }) {
+async function parseBundleBody(body, eventId, { isCreate, current = null }) {
   const data = {};
   if (isCreate || body.name !== undefined) {
     const name = String(body.name || '').trim();
@@ -58,11 +88,6 @@ async function parseBundleBody(body, eventId, { isCreate }) {
     if (name.length > 80) throw new Error('Keep the name under 80 characters');
     data.name = name;
   }
-  if (isCreate || body.price !== undefined) {
-    const price = Number(body.price);
-    if (!(price >= 0) || body.price === '' || body.price === null) throw new Error('Enter the bundle price (zero or more)');
-    data.price = round2(price);
-  }
   if (body.description !== undefined) data.description = body.description ? String(body.description).trim() : null;
   if (body.isActive !== undefined) data.isActive = !!body.isActive;
   if (body.order !== undefined) data.order = Number.isInteger(Number(body.order)) ? Number(body.order) : 0;
@@ -73,31 +98,61 @@ async function parseBundleBody(body, eventId, { isCreate }) {
   if (validFrom && validUntil && validFrom > validUntil) throw new Error('"Available from" must be before "Available until"');
 
   let items;
-  if (isCreate || body.items !== undefined) {
-    const raw = Array.isArray(body.items) ? body.items : [];
-    // The same option/variant twice becomes one line.
-    const merged = new Map();
-    for (const it of raw) {
-      if (!it || !it.eventOptionId) continue;
-      const quantity = Number(it.quantity);
-      if (!Number.isInteger(quantity) || quantity < 1) throw new Error('Each item needs a quantity of at least 1');
-      const key = `${it.eventOptionId}::${it.variantId || ''}`;
-      const prev = merged.get(key);
-      merged.set(key, { eventOptionId: it.eventOptionId, variantId: it.variantId || null, quantity: (prev?.quantity || 0) + quantity });
-    }
-    items = [...merged.values()];
-    if (items.length === 0) throw new Error('Add at least one ticket to the bundle');
-    if (items.reduce((s, i) => s + i.quantity, 0) < 2) throw new Error('A bundle needs at least two tickets in it');
+  if (!isCreate && !PRICING_FIELDS.some(f => body[f] !== undefined)) return { data, items };
 
-    const options = await prisma.eventOption.findMany({
-      where: { id: { in: items.map(i => i.eventOptionId) } },
-      select: { id: true, eventId: true, variants: { select: { id: true } } },
-    });
-    for (const i of items) {
-      const row = options.find(o => o.id === i.eventOptionId);
-      if (!row || row.eventId !== eventId) throw new Error('One of the tickets isn\'t part of this event');
-      if (i.variantId && !row.variants.some(v => v.id === i.variantId)) throw new Error('One of the selected variants no longer exists');
-    }
+  const pick = (f) => (body[f] !== undefined ? body[f] : current?.[f]);
+  const kind = pick('kind') || 'exact';
+  if (!KINDS.includes(kind)) throw new Error('Unknown bundle type');
+  data.kind = kind;
+
+  const rawItems = body.items !== undefined ? body.items : (current?.items || []);
+  // The same option/variant twice becomes one line.
+  const merged = new Map();
+  for (const it of Array.isArray(rawItems) ? rawItems : []) {
+    if (!it || !it.eventOptionId) continue;
+    const quantity = kind === 'exact' ? Number(it.quantity) : 1;
+    if (!Number.isInteger(quantity) || quantity < 1) throw new Error('Each ticket needs a quantity of at least 1');
+    const key = `${it.eventOptionId}::${it.variantId || ''}`;
+    const prev = merged.get(key);
+    merged.set(key, { eventOptionId: it.eventOptionId, variantId: it.variantId || null, quantity: kind === 'exact' ? (prev?.quantity || 0) + quantity : 1 });
+  }
+  items = [...merged.values()];
+  if (items.length === 0) throw new Error(kind === 'exact' ? 'Add at least one ticket to the bundle' : 'Choose at least one qualifying ticket');
+
+  const price = Number(pick('price'));
+  const setSize = Number(pick('setSize'));
+  const freeCount = Number(pick('freeCount'));
+  const groupPricing = pick('groupPricing');
+  const priceGiven = pick('price') !== '' && pick('price') !== null && pick('price') !== undefined;
+
+  if (kind === 'exact') {
+    if (items.reduce((s, i) => s + i.quantity, 0) < 2) throw new Error('A bundle needs at least two tickets in it');
+    if (!priceGiven || !(price >= 0)) throw new Error('Enter the bundle price (zero or more)');
+    Object.assign(data, { price: round2(price), setSize: null, freeCount: null, groupPricing: null });
+  } else if (kind === 'mix') {
+    if (!Number.isInteger(setSize) || setSize < 2) throw new Error('A pick-any bundle needs at least 2 tickets per set');
+    if (!priceGiven || !(price >= 0)) throw new Error('Enter the price for the set (zero or more)');
+    Object.assign(data, { price: round2(price), setSize, freeCount: null, groupPricing: null });
+  } else if (kind === 'free') {
+    if (!Number.isInteger(freeCount) || freeCount < 1) throw new Error('At least one ticket must be free');
+    if (!Number.isInteger(setSize) || setSize <= freeCount) throw new Error('Buy at least one ticket to get the free ones');
+    Object.assign(data, { price: 0, setSize, freeCount, groupPricing: null });
+  } else {
+    if (!Number.isInteger(setSize) || setSize < 2) throw new Error('A group needs at least 2 tickets');
+    if (!GROUP_PRICING.includes(groupPricing)) throw new Error('Choose a price per ticket or a percentage off');
+    if (groupPricing === 'percent' && !(price > 0 && price <= 100)) throw new Error('Enter a percentage between 1 and 100');
+    if (groupPricing === 'per_ticket' && (!priceGiven || !(price >= 0))) throw new Error('Enter the price per ticket (zero or more)');
+    Object.assign(data, { price: round2(price), setSize, freeCount: null, groupPricing });
+  }
+
+  const options = await prisma.eventOption.findMany({
+    where: { id: { in: items.map(i => i.eventOptionId) } },
+    select: { id: true, eventId: true, variants: { select: { id: true } } },
+  });
+  for (const i of items) {
+    const row = options.find(o => o.id === i.eventOptionId);
+    if (!row || row.eventId !== eventId) throw new Error('One of the tickets isn\'t part of this event');
+    if (i.variantId && !row.variants.some(v => v.id === i.variantId)) throw new Error('One of the selected variants no longer exists');
   }
   return { data, items };
 }
@@ -155,7 +210,7 @@ const createBundle = async (req, res) => {
     logAdminAction({
       actorId: req.user.id, actorRole: req.user.role, action: 'bundle_created',
       targetType: 'EventBundle', targetId: bundle.id,
-      metadata: { eventId: event.id, name: bundle.name, price: bundle.price, items: describeBundleItems(bundle) },
+      metadata: { eventId: event.id, name: bundle.name, kind: bundle.kind, deal: describeBundle(bundle) },
       ip: getClientIp(req),
     });
     res.status(201).json({ ...shape(bundle), uses: 0, registrations: 0, totalDiscount: 0 });
@@ -170,11 +225,11 @@ const createBundle = async (req, res) => {
 // @access  Private/Supervisor
 const updateBundle = async (req, res) => {
   try {
-    const existing = await prisma.eventBundle.findUnique({ where: { id: req.params.id } });
+    const existing = await prisma.eventBundle.findUnique({ where: { id: req.params.id }, include: { items: true } });
     if (!existing) { res.status(404); throw new Error('Bundle not found'); }
     let parsed;
     try {
-      parsed = await parseBundleBody(req.body || {}, existing.eventId, { isCreate: false });
+      parsed = await parseBundleBody(req.body || {}, existing.eventId, { isCreate: false, current: existing });
     } catch (e) { res.status(400); throw e; }
     const bundle = await prisma.eventBundle.update({
       where: { id: existing.id },
@@ -259,8 +314,9 @@ async function publicBundlesForEvent(eventId) {
   return bundles.filter(b => isBundleAvailable(b, now)).map(b => {
     const s = shape(b, now);
     return {
-      id: s.id, name: s.name, description: s.description, price: s.price, validUntil: s.validUntil,
-      summary: s.summary, standardValue: s.standardValue,
+      id: s.id, name: s.name, description: s.description, validUntil: s.validUntil,
+      kind: s.kind, price: s.price, setSize: s.setSize, freeCount: s.freeCount, groupPricing: s.groupPricing,
+      summary: s.summary, headline: s.headline, standardValue: s.standardValue, savingText: s.savingText,
       items: s.items.map(i => ({ eventOptionId: i.eventOptionId, variantId: i.variantId, quantity: i.quantity })),
     };
   });

backend/src/controllers/couponController.js

@@ -4,7 +4,7 @@ const { logAdminAction } = require('../utils/adminAudit');
 const { getClientIp } = require('../utils/requestUtils');
 const { normalizeCode, previewCoupon, buildCouponLines, describeCoupon, countCouponUses } = require('../utils/coupons');
 const { resolveOptionPrice, resolveVariantTierPrice } = require('../utils/pricing');
-const { describeBundleItems } = require('../utils/bundles');
+const { describeBundle } = require('../utils/bundles');
 
 const TYPES = ['percent', 'fixed', 'comp'];
 const ROLES = ['user', 'staff', 'supervisor', 'admin'];
@@ -355,7 +355,7 @@ const listRedemptions = async (req, res) => {
         uses: b.count,
         discountAmount: b.discount,
         createdAt: b.registration.createdAt,
-        summary: `${describeBundleItems(b.bundle)} for R${Number(b.bundle.price).toFixed(2)}`,
+        summary: describeBundle(b.bundle),
         coupon: { id: b.bundleId, code: b.bundle.name },
         user: b.registration.user,
         appliedBy: null,

backend/src/controllers/eventController.js

@@ -7,6 +7,74 @@ const crypto = require('crypto');
 const { assertEventOpen } = require('../utils/cashupUtils');
 const { logAdminAction } = require('../utils/adminAudit');
 const { getClientIp } = require('../utils/requestUtils');
+const sessionsUtil = require('../utils/sessions');
+
+const SESSIONS_INCLUDE = { orderBy: { startsAt: 'asc' }, include: { _count: { select: { usages: true } } } };
+
+// Adds the multi-day schedule to an event for API responses: sessions (cancelled ones
+// flagged), when registration closes, the next session, and late-joiner pricing.
+function withSchedule(ev) {
+  const sessions = (ev.sessions || []).map(({ _count, ...s }) => ({ ...s, cancelled: !!s.cancelledAt, hasCheckIns: (_count?.usages || 0) > 0 }));
+  const active = sessionsUtil.activeSessions(sessions);
+  const now = new Date();
+  return {
+    ...ev,
+    sessions,
+    registrationClosesAt: sessionsUtil.registrationClosesAt(ev, sessions),
+    nextSession: ev.scheduleType === 'sessions' ? active.find(s => new Date(s.endsAt) > now) || null : null,
+    lateJoin: ev.scheduleType === 'sessions' ? sessionsUtil.lateInfo(ev, sessions, now) : null,
+  };
+}
+
+// The schedule/attendance fields of an event from a create/update body. `current` is the
+// saved event on update (unsent fields keep their value).
+function scheduleData(body, current = {}) {
+  const has = (k) => body[k] !== undefined;
+  const data = {};
+  if (has('scheduleType')) data.scheduleType = body.scheduleType === 'sessions' ? 'sessions' : 'single';
+  if (has('checkInWindow')) data.checkInWindow = body.checkInWindow === 'session_only' ? 'session_only' : 'whole_day';
+  if (has('lateJoinEnabled')) data.lateJoinEnabled = body.lateJoinEnabled === true;
+  if (has('latePricing')) data.latePricing = ['prorata', 'fixed'].includes(body.latePricing) ? body.latePricing : 'full';
+  if (has('lateFixedPrice')) {
+    const n = parseFloat(body.lateFixedPrice);
+    data.lateFixedPrice = body.lateFixedPrice === null || body.lateFixedPrice === '' || isNaN(n) ? null : Math.max(0, n);
+  }
+  if (has('sessionReminders')) data.sessionReminders = sessionsUtil.normalizeReminders(body.sessionReminders) ?? null;
+  if (has('certificatesEnabled')) data.certificatesEnabled = body.certificatesEnabled === true;
+  if (has('certificateConfig')) data.certificateConfig = sessionsUtil.normalizeCertificateConfig(body.certificateConfig);
+  const latePricing = data.latePricing ?? current.latePricing;
+  const lateFixedPrice = data.lateFixedPrice !== undefined ? data.lateFixedPrice : current.lateFixedPrice;
+  if (latePricing === 'fixed' && (lateFixedPrice === null || lateFixedPrice === undefined) && (data.lateJoinEnabled ?? current.lateJoinEnabled)) {
+    throw sessionsUtil.sessionError('Enter the fixed late price, or choose another late price option');
+  }
+  return data;
+}
+
+/**
+ * Saves the session list and the "late joining until" session after an event is created
+ * or updated, inside the caller's transaction (`tx`) so a refused change saves nothing.
+ * `lateJoinUntilSessionIndex` points into the sent session list (sorted by start).
+ * @returns {Promise<object|null>} the change counts, or null when nothing was sent
+ */
+async function saveSchedule(tx, eventId, body) {
+  sessionsUtil.forgetSchedule(eventId);
+  if (body.scheduleType === 'single') {
+    const used = await tx.ticketUsage.count({ where: { session: { eventId } } });
+    if (used > 0) throw sessionsUtil.sessionError("This event already has session check-ins, so it can't go back to a single date.");
+    await tx.eventSession.deleteMany({ where: { eventId } });
+    await tx.event.update({ where: { id: eventId }, data: { lateJoinUntilSessionId: null } });
+    return null;
+  }
+  if (!Array.isArray(body.sessions)) return null;
+  const { sessions, changes } = await sessionsUtil.syncEventSessions(tx, eventId, body.sessions);
+  if (body.lateJoinUntilSessionIndex !== undefined) {
+    const idx = parseInt(body.lateJoinUntilSessionIndex, 10);
+    const ordered = [...sessions].sort((a, b) => a.order - b.order);
+    const until = Number.isInteger(idx) && ordered[idx] && !ordered[idx].cancelledAt ? ordered[idx].id : null;
+    await tx.event.update({ where: { id: eventId }, data: { lateJoinUntilSessionId: until } });
+  }
+  return changes;
+}
 
 // Helper to convert stored picture path/URL to an absolute, externally reachable URL based on the incoming request
 function toAbsoluteUrl(req, url) {
@@ -81,7 +149,14 @@ const createEvent = async (req, res) => {
       contactPhone: contactPhone || null,
       contactEmail: contactEmail || null,
       location: location || null,
+      ...scheduleData(req.body),
     };
+    if (data.scheduleType === 'sessions') {
+      // Check the sessions before anything is saved; the dates come from them.
+      const bounds = sessionsUtil.scheduleBounds(sessionsUtil.normalizeSessionsInput(req.body.sessions).filter(s => !s.cancelled));
+      data.startDate = bounds.startDate;
+      data.endDate = bounds.endDate;
+    }
 
     const logEventCreate = (createdEvent) => logAdminAction({
       actorId: req.user?.id,
@@ -96,6 +171,7 @@ const createEvent = async (req, res) => {
     try {
       const event = await prisma.event.create({ data });
       logEventCreate(event);
+      if (data.scheduleType === 'sessions') await prisma.$transaction(tx => saveSchedule(tx, event.id, req.body));
 
       // Automatically create a main ticket (event option) with the event price — contact-only
       // events have no bookable options, so there's nothing to auto-create for them.
@@ -151,7 +227,7 @@ const createEvent = async (req, res) => {
         return res.status(400).json({ message: 'Failed to save event form/fields', detail: msg, hint: 'Ensure Prisma migrations are applied and Prisma Client is regenerated, then restart the server.' });
       }
 
-      return res.status(201).json(event);
+      return res.status(201).json(withSchedule(await prisma.event.findUnique({ where: { id: event.id }, include: { sessions: SESSIONS_INCLUDE } })));
     } catch (err) {
       // Gracefully handle environments where migration isn't applied yet
       const msg = String(err?.message || '');
@@ -186,10 +262,49 @@ const createEvent = async (req, res) => {
       throw err;
     }
   } catch (error) {
-    res.status(400).json({ message: error.message });
+    res.status(error.statusCode || 400).json({ message: error.message });
   }
 };
 
+// Map of eventId → when its early bird ends, for events with at least one early-bird
+// tier still running: deadline not passed and (no stock limit, or places left, counted
+// across tranches the same way as utils/pricing.js). The date is the latest deadline
+// among the running tiers.
+async function earlyBirdEndsByEvent(events) {
+  const now = new Date();
+  const running = [];
+  for (const ev of events) {
+    for (const opt of ev.eventOptions || []) {
+      for (const tier of opt.earlyBirdTiers || []) {
+        if (new Date(tier.deadline) > now) running.push({ eventId: ev.id, tier });
+      }
+    }
+  }
+
+  const limitedIds = running.filter(r => r.tier.stockLimit > 0).map(r => r.tier.id);
+  const sold = new Map();
+  if (limitedIds.length > 0) {
+    const totals = await prisma.registrationOptionTranche.groupBy({
+      by: ['appliedTierId'],
+      where: {
+        appliedTierId: { in: limitedIds },
+        registrationOption: { registration: { status: { not: 'cancelled' } } }
+      },
+      _sum: { quantity: true }
+    });
+    for (const t of totals) sold.set(t.appliedTierId, t._sum?.quantity || 0);
+  }
+
+  const ends = new Map();
+  for (const { eventId, tier } of running) {
+    if (tier.stockLimit > 0 && (sold.get(tier.id) || 0) >= tier.stockLimit) continue;
+    const deadline = new Date(tier.deadline);
+    const current = ends.get(eventId);
+    if (!current || deadline > current) ends.set(eventId, deadline);
+  }
+  return ends;
+}
+
 // @desc    Get all events
 // @route   GET /api/events
 // @access  Public
@@ -207,7 +322,7 @@ const getEvents = async (req, res) => {
           goLiveAt: { lte: new Date() },
           endDate: { gte: new Date() }
         },
-        include: { eventOptions: eventOptionsInclude }
+        include: { eventOptions: eventOptionsInclude, sessions: SESSIONS_INCLUDE }
       });
     } catch (e) {
       // Fallback if goLiveAt/isHidden not available yet (pre-migration)
@@ -220,9 +335,12 @@ const getEvents = async (req, res) => {
       });
     }
 
+    const earlyBirdEnds = await earlyBirdEndsByEvent(events).catch(() => new Map());
+
     // Compute isSoldOut per event: true when every option that has a stock limit
     // is fully sold out. Events with no limited options are never sold out.
     const withStock = await Promise.all(events.map(async ev => {
+      const earlyBirdEndsAt = earlyBirdEnds.get(ev.id) || null;
       try {
         const limitedOpts = (ev.eventOptions || []).filter(o => (o.stockLimit || 0) > 0);
         let isSoldOut = false;
@@ -231,9 +349,9 @@ const getEvents = async (req, res) => {
           const soldCounts = await Promise.all(limitedOpts.map(opt => takenCount({ eventOptionId: opt.id })));
           isSoldOut = limitedOpts.every((opt, i) => soldCounts[i] >= opt.stockLimit);
         }
-        return { ...ev, picture: toAbsoluteUrl(req, ev.picture), isSoldOut };
+        return withSchedule({ ...ev, picture: toAbsoluteUrl(req, ev.picture), isSoldOut, earlyBirdEndsAt });
       } catch {
-        return { ...ev, picture: toAbsoluteUrl(req, ev.picture), isSoldOut: false };
+        return withSchedule({ ...ev, picture: toAbsoluteUrl(req, ev.picture), isSoldOut: false, earlyBirdEndsAt });
       }
     }));
 
@@ -251,11 +369,12 @@ const getAllEvents = async (req, res) => {
     const canIncludeTiers = !!(prisma && prisma.earlyBirdTier && typeof prisma.earlyBirdTier.findMany === 'function');
     const events = await prisma.event.findMany({
       include: {
-        eventOptions: canIncludeTiers ? { include: { earlyBirdTiers: true } } : true
+        eventOptions: canIncludeTiers ? { include: { earlyBirdTiers: true } } : true,
+        sessions: SESSIONS_INCLUDE,
       }
     });
 
-    const mapped = events.map(ev => ({
+    const mapped = events.map(ev => withSchedule({
       ...ev,
       picture: toAbsoluteUrl(req, ev.picture),
     }));
@@ -292,12 +411,13 @@ const getEventsAll = async (req, res) => {
       where,
       include: {
         eventOptions: optionInclude ? { include: optionInclude } : true,
-        form: { include: { fields: true } }
+        form: { include: { fields: true } },
+        sessions: SESSIONS_INCLUDE,
       },
       orderBy: { startDate: 'asc' }
     });
 
-    const mapped = events.map(ev => ({
+    const mapped = events.map(ev => withSchedule({
       ...ev,
       picture: toAbsoluteUrl(req, ev.picture),
     }));
@@ -320,7 +440,7 @@ const getEventById = async (req, res) => {
     const optionInclude = canIncludeTiers
       ? { earlyBirdTiers: true, ...(canIncludeVariants ? { variants: { orderBy: { order: 'asc' } } } : {}) }
       : undefined;
-    const includeObj = { eventOptions: optionInclude ? { include: optionInclude } : true };
+    const includeObj = { eventOptions: optionInclude ? { include: optionInclude } : true, sessions: SESSIONS_INCLUDE };
 
     // Staff/supervisor/admin need the creator + notify-recipient list to populate the
     // event edit screen's Notifications step; public callers don't need this.
@@ -448,7 +568,8 @@ const getEventById = async (req, res) => {
       // Non-fatal: fall back to options without stock info
     }
 
-    const mapped = {
+    if (!event.sessions) event.sessions = await prisma.eventSession.findMany({ where: { eventId }, ...SESSIONS_INCLUDE }).catch(() => []);
+    const mapped = withSchedule({
       ...event,
       eventOptions: eventOptionsWithStock,
       picture: toAbsoluteUrl(req, event.picture),
@@ -458,7 +579,7 @@ const getEventById = async (req, res) => {
       })),
       form,
       bundles: await require('./bundleController').publicBundlesForEvent(eventId).catch(() => []),
-    };
+    });
     res.json(mapped);
   } catch (error) {
     res.status(res.statusCode === 200 ? 400 : res.statusCode).json({ message: error.message });
@@ -473,7 +594,7 @@ const getEventIcs = async (req, res) => {
     const eventId = req.params.id;
     const event = await prisma.event.findUnique({
       where: { id: eventId },
-      select: { id: true, title: true, description: true, startDate: true, endDate: true, location: true, isActive: true, goLiveAt: true },
+      select: { id: true, title: true, description: true, startDate: true, endDate: true, location: true, isActive: true, goLiveAt: true, scheduleType: true, sessions: { orderBy: { startsAt: 'asc' } } },
     });
 
     if (!event) {
@@ -583,10 +704,36 @@ const updateEvent = async (req, res) => {
       location: location !== undefined ? (location || null) : event.location,
       updatedAt: new Date(),
       redirectUrl: redirectUrl !== undefined ? redirectUrl : event.redirectUrl,
+      ...scheduleData(req.body, event),
     };
+    // A multi-session event's dates come from its sessions (set by saveSchedule).
+    if ((data.scheduleType ?? event.scheduleType) === 'sessions') {
+      data.startDate = event.startDate;
+      data.endDate = event.endDate;
+      if (Array.isArray(req.body.sessions)) sessionsUtil.normalizeSessionsInput(req.body.sessions);
+      else if (event.scheduleType !== 'sessions') throw sessionsUtil.sessionError('Add the sessions for a multi-session event');
+    }
 
     try {
-      const updatedEvent = await prisma.event.update({ where: { id: req.params.id }, data });
+      // Event fields and sessions save together: a refused schedule change saves nothing.
+      const scheduleBody = data.scheduleType === 'single' && event.scheduleType === 'sessions' ? { scheduleType: 'single' } : req.body;
+      let updatedEvent;
+      let sessionChanges;
+      await prisma.$transaction(async (tx) => {
+        updatedEvent = await tx.event.update({ where: { id: req.params.id }, data });
+        sessionChanges = updatedEvent.scheduleType === 'sessions' || scheduleBody.scheduleType === 'single'
+          ? await saveSchedule(tx, updatedEvent.id, scheduleBody)
+          : null;
+      });
+      sessionsUtil.forgetSchedule(updatedEvent.id);
+      if (sessionChanges && Object.values(sessionChanges).some(n => n > 0)) {
+        logAdminAction({
+          actorId: req.user.id, actorRole: req.user.role, action: 'event_sessions_changed',
+          targetType: 'Event', targetId: updatedEvent.id, metadata: sessionChanges, ip: getClientIp(req),
+        });
+      }
+      updatedEvent = withSchedule(await prisma.event.findUnique({ where: { id: updatedEvent.id }, include: { sessions: SESSIONS_INCLUDE } }));
+      updatedEvent.sessionChanges = sessionChanges;
 
 
       // Upsert form if provided

backend/src/controllers/jobsController.js

@@ -0,0 +1,34 @@
+const prisma = require('../config/db');
+const { safeErrorMessage } = require('../utils/errorUtils');
+const { logAdminAction } = require('../utils/adminAudit');
+const { getClientIp } = require('../utils/requestUtils');
+const jobs = require('../jobs');
+
+// @desc    Background jobs: schedule, next run and the last 10 runs of each
+// @route   GET /api/admin/jobs
+// @access  Private/Admin
+const listJobs = async (req, res) => {
+  try {
+    res.json(await jobs.jobStatus(prisma));
+  } catch (error) {
+    res.status(500).json({ message: safeErrorMessage(error) });
+  }
+};
+
+// @desc    Run a background job now
+// @route   POST /api/admin/jobs/:name/run
+// @access  Private/Admin
+const runJobNow = async (req, res) => {
+  try {
+    const result = await jobs.runNow(req.params.name);
+    logAdminAction({
+      actorId: req.user.id, actorRole: req.user.role, action: 'job_run_manual',
+      targetType: 'Job', targetId: req.params.name, metadata: { queued: result.queued }, ip: getClientIp(req),
+    });
+    res.json(result);
+  } catch (error) {
+    res.status(error.statusCode || 500).json({ message: safeErrorMessage(error) });
+  }
+};
+
+module.exports = { listJobs, runJobNow };

backend/src/controllers/paymentController.js

@@ -935,7 +935,9 @@ function checkoutLineItems(registration) {
 
 // Internal helper: create a Yoco checkout for a registration and return { checkoutId, redirectUrl, amount }
 // Does NOT check user authorization — callers are responsible for ensuring the user owns the registration.
-async function createRegistrationCheckoutInternal(registrationId, userId, { successUrl, cancelUrl, failureUrl } = {}) {
+// donationAmount (optional) is added on top as its own line; the webhook splits it off into a
+// separate donation payment using the amount carried in the checkout metadata.
+async function createRegistrationCheckoutInternal(registrationId, userId, { successUrl, cancelUrl, failureUrl, donationAmount = 0 } = {}) {
   const registration = await prisma.registration.findUnique({
     where: { id: registrationId },
     include: {
@@ -961,7 +963,8 @@ async function createRegistrationCheckoutInternal(registrationId, userId, { succ
 
   if (remainingAmount <= 0) throw new Error('This registration is already paid in full');
 
-  const amountInCents = Math.round(remainingAmount * 100);
+  const donationInCents = Math.round((Number(donationAmount) || 0) * 100);
+  const amountInCents = Math.round(remainingAmount * 100) + donationInCents;
   const idempotencyKey = `reg_${registrationId}_${amountInCents}_${Date.now()}`;
   const lineItems = checkoutLineItems(registration);
 
@@ -974,11 +977,17 @@ async function createRegistrationCheckoutInternal(registrationId, userId, { succ
     });
   }
   // Paying full remaining — no "Partial Payment" line needed
+  if (donationInCents > 0) {
+    lineItems.push({ displayName: 'Donation', quantity: 1, pricingDetails: { price: donationInCents } });
+  }
 
   const checkoutData = {
     amount: amountInCents,
     currency: 'ZAR',
-    metadata: { registrationId, userId, eventId: registration.eventId, eventTitle: registration.event.title, type: 'registration_payment' },
+    metadata: {
+      registrationId, userId, eventId: registration.eventId, eventTitle: registration.event.title, type: 'registration_payment',
+      ...(donationInCents > 0 ? { donationAmount: (donationInCents / 100).toFixed(2) } : {})
+    },
     successUrl,
     cancelUrl,
     failureUrl,
@@ -999,7 +1008,7 @@ async function createRegistrationCheckoutInternal(registrationId, userId, { succ
   return {
     checkoutId: response.data.id,
     redirectUrl: response.data.redirectUrl,
-    amount: remainingAmount,
+    amount: amountInCents / 100,
     registration: { id: registration.id, eventId: registration.eventId, eventTitle: registration.event.title }
   };
 }
@@ -1009,7 +1018,7 @@ async function createRegistrationCheckoutInternal(registrationId, userId, { succ
 // @access  Private
 const createYocoCheckout = async (req, res) => {
   try {
-    const { registrationId, eventId, amount, successUrl, cancelUrl, failureUrl } = req.body;
+    const { registrationId, eventId, amount, donationAmount, successUrl, cancelUrl, failureUrl } = req.body;
     const userId = req.user.id;
 
     // Validate required parameters for either registration payment or donation
@@ -1096,7 +1105,15 @@ const createYocoCheckout = async (req, res) => {
         return res.status(200).json({ checkoutId: response.data.id, redirectUrl: response.data.redirectUrl, amount: charge, registration: { id: registration.id, eventId: registration.eventId, eventTitle: registration.event.title } });
       }
 
-      const result = await createRegistrationCheckoutInternal(registrationId, userId, { successUrl, cancelUrl, failureUrl });
+      // Optional donation added at registration ("Donation amount" on the register form)
+      let donation = 0;
+      if (donationAmount !== undefined && donationAmount !== null && donationAmount !== '') {
+        donation = Math.round(parseFloat(donationAmount) * 100) / 100;
+        if (!(donation >= 0) || donation > 100000) { res.status(400); throw new Error('Invalid donation amount'); }
+        if (donation > 0 && donation < 15) { res.status(400); throw new Error('Minimum donation is R15'); }
+      }
+
+      const result = await createRegistrationCheckoutInternal(registrationId, userId, { successUrl, cancelUrl, failureUrl, donationAmount: donation });
       return res.status(200).json(result);
     }
 

backend/src/controllers/registrationController.js

@@ -52,6 +52,7 @@ const ACTIVE_COUPONS_INCLUDE = {
   select: { id: true, discountAmount: true, createdAt: true, coupon: { select: { id: true, code: true, type: true, value: true, description: true } } },
 };
 const { BUNDLE_APPS_INCLUDE } = require('../utils/bundles');
+const { registrationClosesAt } = require('../utils/sessions');
 
 /**
  * Coupon lines for options that haven't been saved yet, so a code can be checked
@@ -121,7 +122,7 @@ const createRegistration = async (req, res) => {
       : true;
     const event = await prisma.event.findUnique({
       where: { id: eventId },
-      include: { eventOptions: optionInclude ? { include: optionInclude } : true }
+      include: { eventOptions: optionInclude ? { include: optionInclude } : true, sessions: true }
     });
 
     if (!event) {
@@ -207,11 +208,10 @@ const createRegistration = async (req, res) => {
       }
     }
 
-    // Enforce registration cutoff for public registrations
+    // Enforce registration cutoff for public registrations (multi-day events close when
+    // the first session starts, or later with late joining — see utils/sessions.js).
     const now = new Date();
-    const end = new Date(event.endDate);
-    const deadline = event.registrationDeadline ? new Date(event.registrationDeadline) : null;
-    if ((deadline && now >= deadline) || now >= end) {
+    if (now >= registrationClosesAt(event, event.sessions)) {
       res.status(400);
       throw new Error('Registration is closed for this event');
     }

backend/src/controllers/settingsController.js

@@ -21,6 +21,8 @@ const PUBLIC_KEYS = [
   // the admin re-saves the Branding tab).
   'primary_color', 'secondary_color', 'accent_color', 'logo_url', 'favicon_url',
   'setup_complete', 'app_base_url',
+  // Google Search Console "HTML tag" code, output as a meta tag on every page
+  'google_site_verification',
   // Legal pages
   'legal_operator_name', 'legal_io_name', 'legal_io_email',
   'legal_website_url', 'legal_effective_date',

backend/src/controllers/ticketController.js

@@ -102,7 +102,7 @@ const getUserTickets = async (req, res) => {
           },
         },
         user: { select: { id: true, name: true } },
-        event: true,
+        event: { include: { sessions: { where: { cancelledAt: null }, orderBy: { startsAt: 'asc' } } } },
         transferRequests: { where: { status: 'pending' }, select: { id: true, toName: true, expiresAt: true } },
         usages: {
           include: {
@@ -268,6 +268,7 @@ const getScanPreview = async (req, res) => {
         ov.name              AS "variantName",
         e.id                 AS "evId",
         e.title              AS "eventTitle",
+        e."scheduleType"     AS "scheduleType",
         u.id                 AS "userId",
         u.name               AS "userName",
         a.name               AS "attendeeName",
@@ -275,7 +276,8 @@ const getScanPreview = async (req, res) => {
           json_agg(
             json_build_object(
               'quantityRedeemed', tu."quantityRedeemed",
-              'scannedAt',        tu."scannedAt"
+              'scannedAt',        tu."scannedAt",
+              'sessionId',        tu."sessionId"
             )
           ) FILTER (WHERE tu.id IS NOT NULL),
           '[]'::json
@@ -303,12 +305,33 @@ const getScanPreview = async (req, res) => {
     const r = rows[0];
     const { consentStatusForTickets } = require('../utils/consent');
     const consentStatus = (await consentStatusForTickets([r.id])).get(r.id) || 'not_required';
+    const usages = r.usages || [];
+    // Multi-day events: check-in is per session, so what's left is counted for the
+    // session this scan is for (the one picked, or today's).
+    let remaining = Number(r.quantity) - usages.reduce((s, u) => s + (u.quantityRedeemed || 1), 0);
+    let session = null;
+    let sessionError = null;
+    if (r.scheduleType === 'sessions') {
+      const sessionsUtil = require('../utils/sessions');
+      const schedule = await sessionsUtil.eventSchedule(r.eventId);
+      const found = sessionsUtil.scanSession(schedule, schedule.sessions, req.query.sessionId || null);
+      sessionError = found.error;
+      if (found.session) {
+        session = { id: found.session.id, label: sessionsUtil.sessionLabel(found.session, schedule.sessions) };
+        remaining = Number(r.quantity) - sessionsUtil.redeemedForSession(usages, found.session.id);
+      } else {
+        remaining = 0;
+      }
+    }
     res.json({
       id:       r.id,
       quantity: Number(r.quantity),
       isUsed:   r.isUsed,
       eventId:  r.eventId,
       consentStatus,
+      remaining,
+      session,
+      sessionError,
       registrationOption: {
         id: r.registrationOptionId,
         eventOption: { id: r.eventOptionId, name: r.eventOptionName },
@@ -317,7 +340,7 @@ const getScanPreview = async (req, res) => {
       event:  { id: r.evId,   title: r.eventTitle },
       user:   { id: r.userId, name:  r.userName   },
       attendee: r.attendeeName ? { name: r.attendeeName } : null,
-      usages: r.usages || []
+      usages
     });
   } catch (error) {
     res.status(res.statusCode === 200 ? 400 : res.statusCode).json({ message: safeErrorMessage(error) });
@@ -337,6 +360,7 @@ const scanTicket = async (req, res) => {
         t."isUsed",
         t."eventId",
         e.title              AS "eventTitle",
+        e."scheduleType"     AS "scheduleType",
         eo.id                AS "eventOptionId",
         eo.name              AS "eventOptionName",
         eo."isMainTicket"    AS "isMainTicket",
@@ -345,7 +369,8 @@ const scanTicket = async (req, res) => {
             json_build_object(
               'id',               tu.id,
               'quantityRedeemed', tu."quantityRedeemed",
-              'scannedAt',        tu."scannedAt"
+              'scannedAt',        tu."scannedAt",
+              'sessionId',        tu."sessionId"
             )
           ) FILTER (WHERE tu.id IS NOT NULL),
           '[]'::json
@@ -405,11 +430,35 @@ const scanTicket = async (req, res) => {
       return res.status(423).json({ message: `${scope} is offline-locked by ${lock.user?.name || 'another device'}${lock.deviceName ? ` on ${lock.deviceName}` : ''}. Scan it on that device, or ask a supervisor to release the lock.`, code: 'SCAN_LOCKED' });
     }
 
+    // Multi-day events: the check-in is for one session (the one picked, or today's), and
+    // what's left is counted per session.
+    let session = null;
+    let sessionsUtil = null;
+    let schedule = null;
+    if (r.scheduleType === 'sessions') {
+      sessionsUtil = require('../utils/sessions');
+      schedule = await sessionsUtil.eventSchedule(ticket.eventId);
+      const found = sessionsUtil.scanSession(schedule, schedule.sessions, String(req.body?.sessionId || req.query?.sessionId || '').trim() || null);
+      if (!found.session) return res.status(400).json({ message: found.error, code: 'NO_SESSION', ticket });
+      session = found.session;
+    }
+
     // Compute how many have already been redeemed
-    const totalRedeemed = (ticket.usages || []).reduce((s, u) => s + (u.quantityRedeemed || 1), 0);
+    const totalRedeemed = session
+      ? sessionsUtil.redeemedForSession(ticket.usages, session.id)
+      : (ticket.usages || []).reduce((s, u) => s + (u.quantityRedeemed || 1), 0);
     const remaining = (ticket.quantity || 1) - totalRedeemed;
 
     if (remaining <= 0) {
+      if (session) {
+        const last = (ticket.usages || []).filter(u => u.sessionId === session.id).sort((a, b) => new Date(b.scannedAt) - new Date(a.scannedAt))[0];
+        const at = last ? new Date(last.scannedAt).toLocaleTimeString('en-ZA', { timeZone: sessionsUtil.TIMEZONE, hour: '2-digit', minute: '2-digit' }) : '';
+        return res.status(403).json({
+          message: `Already checked in for ${sessionsUtil.sessionLabel(session, schedule.sessions)}${at ? ` at ${at}` : ''}`,
+          ticket,
+          remaining: 0
+        });
+      }
       return res.status(403).json({
         message: 'Ticket has already been fully used',
         ticket,
@@ -452,11 +501,13 @@ const scanTicket = async (req, res) => {
           ticketId: ticket.id,
           scannedById: req.user.id,
           quantityRedeemed: qtyToRedeem,
+          sessionId: session ? session.id : null,
         }
       }),
+      // A multi-session ticket is never "used up" — it's checked in again next session.
       prisma.ticket.update({
         where: { id: ticket.id },
-        data: { isUsed: fullyUsed, updatedAt: new Date() }
+        data: { isUsed: session ? false : fullyUsed, updatedAt: new Date() }
       })
     ]);
 
@@ -468,8 +519,10 @@ const scanTicket = async (req, res) => {
         .catch(e => console.error('Failed to send check-in notification:', e));
     }
 
+    const sessionPart = session ? ` for ${sessionsUtil.sessionLabel(session, schedule.sessions)}` : '';
     res.json({
-      message: `Ticket scanned successfully (${qtyToRedeem} of ${ticket.quantity || 1} redeemed${newRemaining > 0 ? `, ${newRemaining} remaining` : ''})`,
+      message: `Ticket scanned successfully${sessionPart} (${qtyToRedeem} of ${ticket.quantity || 1} redeemed${newRemaining > 0 ? `, ${newRemaining} remaining` : ''})`,
+      session: session ? { id: session.id, label: sessionsUtil.sessionLabel(session, schedule.sessions) } : null,
       ticketUsage,
       ticket,
       qtyRedeemed: qtyToRedeem,
@@ -494,7 +547,7 @@ const getTicketsByEvent = async (req, res) => {
         registrationOption: { include: { eventOption: true, variant: true, registration: { select: { id: true } } } },
         user: { select: { id: true, name: true, email: true, phoneNumber: true } },
         attendee: { select: { id: true, name: true, email: true, phone: true } },
-        event: { select: { id: true, title: true, startDate: true, requiresParentalConsent: true, allowTicketTransfer: true, collectGender: true } },
+        event: { select: { id: true, title: true, startDate: true, requiresParentalConsent: true, allowTicketTransfer: true, collectGender: true, scheduleType: true, sessions: { where: { cancelledAt: null }, orderBy: { startsAt: 'asc' }, select: { id: true, label: true, startsAt: true, endsAt: true } } } },
         usages: { include: { scannedBy: { select: { id: true, name: true, email: true } } } }
       },
       orderBy: { createdAt: 'desc' },
@@ -845,6 +898,67 @@ function allocationLabel(attendee) {
     .join(' · ');
 }
 
+// One ticket card on the PDF, matching the printed design in frontend/src/lib/ticketPrint.ts.
+function drawTicketCard(doc, { x, y, w, h }, ticket, qrDataUrl, buyerName) {
+  const pad = 12; const radius = 9;
+  const innerW = w - pad * 2;
+  const gray700 = '#374151'; const gray500 = '#6b7280';
+
+  doc.save();
+  doc.roundedRect(x, y + 1.5, w, h, radius).fillOpacity(0.06).fill('#000000');
+  doc.restore();
+  doc.save();
+  doc.roundedRect(x, y, w, h, radius).lineWidth(0.75).fillAndStroke('#ffffff', '#e5e7eb');
+  doc.restore();
+
+  // Event title, with the date on the right of the same line
+  let cy = y + pad;
+  const eventDate = ticket.event.startDate ? new Date(ticket.event.startDate) : null;
+  const dateStr = require('../utils/sessions').ticketDateText(ticket.event)
+    || (eventDate ? new Intl.DateTimeFormat('en-GB', { day: '2-digit', month: 'long', year: 'numeric' }).format(eventDate) : '');
+  doc.font('Helvetica').fontSize(9);
+  const dateW = dateStr ? doc.widthOfString(dateStr) : 0;
+  if (dateStr) doc.fillColor(gray500).text(dateStr, x + w - pad - dateW, cy + 1, { width: dateW, lineBreak: false });
+  const titleW = innerW - (dateStr ? dateW + 8 : 0);
+  doc.font('Helvetica-Bold').fontSize(11).fillColor('#111827');
+  doc.text(ticket.event.title, x + pad, cy, { width: titleW });
+  cy += doc.heightOfString(ticket.event.title, { width: titleW }) + 4;
+
+  // Ticket type
+  const variantSuffix = ticket.registrationOption.variant ? ` — ${ticket.registrationOption.variant.name}` : '';
+  const type = `${ticket.registrationOption.eventOption.name}${variantSuffix}`;
+  doc.font('Helvetica').fontSize(10).fillColor(gray700).text(type, x + pad, cy, { width: innerW });
+  cy += doc.heightOfString(type, { width: innerW }) + 2;
+
+  // Name (named ticket) or quantity, value in bold
+  doc.font('Helvetica').fontSize(9).fillColor(gray700)
+    .text(ticket.attendee ? 'Name: ' : 'Qty: ', x + pad, cy, { continued: true })
+    .font('Helvetica-Bold').text(ticket.attendee ? ticket.attendee.name : String(ticket.quantity || 1));
+  cy += 12;
+  const groupLabel = allocationLabel(ticket.attendee);
+  if (groupLabel) {
+    doc.font('Helvetica').fontSize(9).fillColor(gray500).text(groupLabel, x + pad, cy, { width: innerW });
+    cy += doc.heightOfString(groupLabel, { width: innerW }) + 2;
+  }
+
+  // Footer lines are measured first so the QR code takes the remaining space
+  const footer = [`Ticket ID: ${ticket.id}`, ...(buyerName ? [`Purchased by: ${buyerName}`] : [])];
+  doc.font('Helvetica').fontSize(8.5);
+  const footerH = footer.reduce((sum, line) => sum + doc.heightOfString(line, { width: innerW }) + 2, 0);
+  const qrSpace = (y + h - pad - footerH) - (cy + 6) - 6;
+  const qrSize = Math.max(60, Math.min(130, qrSpace));
+  const qrY = cy + 6 + Math.max(0, (qrSpace - qrSize) / 2);
+  doc.image(qrDataUrl, x + (w - qrSize) / 2, qrY, { width: qrSize, height: qrSize });
+
+  let fy = y + h - pad - footerH;
+  doc.fillColor(gray500);
+  for (const line of footer) {
+    doc.text(line, x + pad, fy, { width: innerW, align: 'center' });
+    fy += doc.heightOfString(line, { width: innerW }) + 2;
+  }
+  doc.fillColor('#000000');
+}
+
 // Internal helper used by both emailTickets and sendTicketsTo
 async function emailTicketsInternal(req, res, userOverride) {
   const { ticketIds, registrationId } = req.body;
@@ -865,7 +979,7 @@ async function emailTicketsInternal(req, res, userOverride) {
   }
 
   const ticketInclude = {
-    event: true,
+    event: { include: { sessions: { where: { cancelledAt: null }, orderBy: { startsAt: 'asc' } } } },
     registrationOption: { include: { eventOption: true, variant: true, registration: { select: { ticketDelivery: true } } } },
     attendee: { include: { allocations: { where: { set: { showOnTicket: true } }, include: { group: { select: { name: true } }, set: { select: { name: true, order: true } } } } } },
     user: { select: { name: true } },
@@ -951,32 +1065,22 @@ async function emailTicketsInternal(req, res, userOverride) {
   const doc = new PDFDocument({ size: 'A4', margin: 20 });
   const writeStream = fs.createWriteStream(tempFilePath);
   doc.pipe(writeStream);
-  const pageWidth = doc.page.width - 40; const pageHeight = doc.page.height - 40;
-  const ticketsPerRow = 2; const ticketsPerColumn = 4;
-  const ticketWidth = pageWidth / ticketsPerRow; const ticketHeight = pageHeight / ticketsPerColumn;
+  // Same card design as the printed tickets (frontend/src/lib/ticketPrint.ts): rounded white
+  // cards with a light border and soft shadow, two columns, three rows per page.
+  const margin = 20; const gap = 12;
+  const ticketsPerRow = 2; const ticketsPerColumn = 3;
+  const ticketWidth = (doc.page.width - margin * 2 - gap * (ticketsPerRow - 1)) / ticketsPerRow;
+  const ticketHeight = (doc.page.height - margin * 2 - gap * (ticketsPerColumn - 1)) / ticketsPerColumn;
   const qrCodes = await Promise.all(tickets.map(ticket => new Promise((resolve, reject) => {
-    QRCode.toDataURL(ticket.qrCode, (err, url) => err ? reject(err) : resolve({ ticketId: ticket.id, qrDataUrl: url }));
+    QRCode.toDataURL(ticket.qrCode, { margin: 1, width: 400 }, (err, url) => err ? reject(err) : resolve({ ticketId: ticket.id, qrDataUrl: url }));
   })));
   const qrCodeMap = qrCodes.reduce((map, item) => { map[item.ticketId] = item.qrDataUrl; return map; }, {});
   let ticketIndex = 0;
   for (const ticket of tickets) {
-    const row = Math.floor(ticketIndex % ticketsPerColumn);
-    const col = Math.floor((ticketIndex / ticketsPerColumn) % ticketsPerRow);
-    const x = col * ticketWidth + 20; const y = row * ticketHeight + 20;
-    doc.rect(x, y, ticketWidth, ticketHeight).stroke();
-    doc.font('Helvetica-Bold').fontSize(12).text(ticket.event.title, x + 10, y + 10, { width: ticketWidth - 20 });
-    doc.font('Helvetica').fontSize(10);
-    const variantSuffix = ticket.registrationOption.variant ? ` — ${ticket.registrationOption.variant.name}` : '';
-    doc.text(`Ticket Type: ${ticket.registrationOption.eventOption.name}${variantSuffix}`, x + 10, y + 30, { width: ticketWidth - 20 });
-    const groupLabel = allocationLabel(ticket.attendee);
-    doc.text(ticket.attendee ? `Name: ${ticket.attendee.name}${groupLabel ? ` · ${groupLabel}` : ''}` : `Qty: ${ticket.quantity || 1}`, x + 10, y + 45, { width: ticketWidth - 20 });
-    const eventDate = new Date(ticket.event.startDate);
-    doc.text(`Date: ${new Intl.DateTimeFormat('en-GB', { day: '2-digit', month: 'long', year: 'numeric' }).format(eventDate)}`, x + 10, y + 60, { width: ticketWidth - 20 });
-    doc.text(`Purchased by: ${ticket.user?.name || user.name}`, x + 10, y + 75, { width: ticketWidth - 20 });
-    const qrCodeSize = Math.min(ticketWidth, ticketHeight) * 0.45;
-    const qrX = x + (ticketWidth - qrCodeSize) / 2; const qrY = y + 90;
-    doc.image(qrCodeMap[ticket.id], qrX, qrY, { width: qrCodeSize, height: qrCodeSize });
-    doc.fontSize(8).text(`Ticket ID: ${ticket.id}`, x + 10, qrY + qrCodeSize + 5, { width: ticketWidth - 20, align: 'center' });
+    const slot = ticketIndex % (ticketsPerRow * ticketsPerColumn);
+    const x = margin + (slot % ticketsPerRow) * (ticketWidth + gap);
+    const y = margin + Math.floor(slot / ticketsPerRow) * (ticketHeight + gap);
+    drawTicketCard(doc, { x, y, w: ticketWidth, h: ticketHeight }, ticket, qrCodeMap[ticket.id], ticket.user?.name || user.name);
     ticketIndex++;
     if (ticketIndex % (ticketsPerRow * ticketsPerColumn) === 0 && ticketIndex < tickets.length) doc.addPage();
   }
@@ -984,9 +1088,9 @@ async function emailTicketsInternal(req, res, userOverride) {
   await new Promise((resolve, reject) => { writeStream.on('finish', resolve); writeStream.on('error', reject); });
 
   const eventTitle = tickets[0].event.title;
-  const eventDate = tickets[0].event.startDate
+  const eventDate = require('../utils/sessions').ticketDateText(tickets[0].event, 'long') || (tickets[0].event.startDate
     ? new Date(tickets[0].event.startDate).toLocaleDateString('en-GB', { weekday: 'long', day: 'numeric', month: 'long', year: 'numeric' })
-    : '';
+    : '');
   const pdfFilename = `tickets-${eventTitle.replace(/[^a-z0-9]/gi, '_').toLowerCase()}.pdf`;
   const sentChannels = [];
 

backend/src/controllers/webhookController.js

@@ -314,11 +314,18 @@ const handlePaymentSucceeded = async (webhookData) => {
       } catch (e) { /* ignore — payment will fail below if still null */ }
     }
 
+    // A registration checkout can carry a donation on top (metadata.donationAmount). It's
+    // recorded as its own donation payment so it never counts towards the registration.
+    const grossAmount = amount / 100; // Convert cents to your currency unit
+    const donationPart = registration?.id
+      ? Math.min(Math.max(Number(metadata?.donationAmount) || 0, 0), grossAmount)
+      : 0;
+
     // Create payment record
     const payment = await prisma.payment.create({
       data: {
         id: uuidv4(), // Generate a UUID for the payment
-        amount: amount / 100, // Convert cents to your currency unit
+        amount: Math.round((grossAmount - donationPart) * 100) / 100,
         method: method.type, // The type of payment from the webhook
         status: status === 'succeeded' ? 'completed' : status,
         externalId: yocoPaymentId,
@@ -358,6 +365,24 @@ const handlePaymentSucceeded = async (webhookData) => {
       }
     });
     
+    let donationPayment = null;
+    if (donationPart > 0) {
+      donationPayment = await prisma.payment.create({
+        data: {
+          id: uuidv4(),
+          amount: donationPart,
+          method: method.type,
+          status: status === 'succeeded' ? 'completed' : status,
+          userId: resolvedUserId,
+          recordedById: resolvedUserId,
+          registrationId: null,
+          eventId: registration.eventId,
+          isDonation: true,
+          originalPaymentId: payment.id,
+        }
+      });
+    }
+
     // If this payment is for a registration, update the registration status
     let updatedRegistration = null;
     let generatedTickets = [];
@@ -392,6 +417,7 @@ const handlePaymentSucceeded = async (webhookData) => {
 
     // Send emails: payment confirmation first, then tickets (guarantees order)
     const _whPaymentId = payment.id;
+    const _whDonationId = donationPayment?.id;
     const _whUserId = registration?.userId;
     const _whRegId = registration?.id;
     const _whTicketsGenerated = generatedTickets.length > 0;
@@ -402,6 +428,14 @@ const handlePaymentSucceeded = async (webhookData) => {
       } catch (e) {
         console.error('Failed to send webhook payment emails:', e);
       }
+      if (_whDonationId) {
+        try {
+          const { sendPaymentEmails } = require('../utils/notifications');
+          await sendPaymentEmails(_whDonationId);
+        } catch (e) {
+          console.error('Failed to send webhook donation emails:', e);
+        }
+      }
       if (_whTicketsGenerated && _whUserId && _whRegId) {
         const mockReq = { user: { id: _whUserId }, body: { registrationId: _whRegId } };
         const mockRes = { status: () => mockRes, json: () => {} };

backend/src/index.js

@@ -185,6 +185,7 @@ app.use('/api/scan-locks', require('./routes/scanLockRoutes'));
 app.use('/api/allocations', require('./routes/allocationRoutes'));
 app.use('/api/sponsorships', require('./routes/sponsorshipRoutes'));
 app.use('/api/feedback', require('./routes/feedbackRoutes'));
+app.use('/api/attendance', require('./routes/attendanceRoutes'));
 app.use('/api/analytics', require('./routes/analyticsRoutes'));
 app.use('/api/backups', backupRoutes);
 app.use('/api/yoco', yocoRoutes);
@@ -546,7 +547,7 @@ app.get('/docs', async (req, res) => {
         responses:[
           { status:201, desc:'Created', body:{ id:'ev-uuid-new', title:'Camp 2025', createdAt:'2024-11-01T09:00:00.000Z' }},
         ]},
-      { method:'PUT', path:'/api/events/:id', auth:'supervisor+', desc:'Update an event',
+      { method:'PUT', path:'/api/events/:id', auth:'supervisor+', desc:'Update an event. Multi-day events send scheduleType:"sessions" with the full sessions list (rows left out are deleted; ones with check-ins must be cancelled instead), plus lateJoinEnabled, lateJoinUntilSessionIndex, latePricing, lateFixedPrice, checkInWindow, sessionReminders, certificatesEnabled and certificateConfig. The response includes sessionChanges.',
         pathParams:{ ':id':'Event UUID' },
         request:{ body:{ title:'Camp 2025 Updated', price:500 }},
         responses:[{ status:200, desc:'Updated', body:{ id:'ev-uuid-...', title:'Camp 2025 Updated', price:500 }}]},
@@ -660,6 +661,8 @@ app.get('/docs', async (req, res) => {
 
     { title: 'Impersonation', base: '/api/admin', endpoints: [
       { method:'GET', path:'/api/admin/audit-log', auth:'admin', desc:'Paginated admin/supervisor audit trail (?page, limit, actorId, action, from, to)' },
+      { method:'GET', path:'/api/admin/jobs', auth:'admin', desc:'Background jobs: queue mode, timezone, and each job schedule, next run and last 10 runs' },
+      { method:'POST', path:'/api/admin/jobs/:name/run', auth:'admin', desc:'Run a background job now (queued for a worker); audit-logged' },
       { method:'POST', path:'/api/admin/impersonate/:userId', auth:'admin (2FA)', desc:'View the site as a user — read-only token, 30 minutes, audited', request:{ body:{ reason:'Ticket not showing in My Events' }}, responses:[{ status:201, desc:'Started', body:{ token:'jwt…', session:{ id:'sess-uuid', expiresAt:'2025-07-10T08:45:00.000Z' }}}, { status:403, desc:'Not allowed', body:{ message:"Admins can't be impersonated." }}]},
       { method:'POST', path:'/api/admin/impersonate/end', auth:'impersonation token', desc:'End the impersonation session' },
       { method:'POST', path:'/api/admin/impersonate/log', auth:'impersonation token', desc:'Record a page viewed during the session' },
@@ -739,6 +742,20 @@ app.get('/docs', async (req, res) => {
       { method:'POST', path:'/api/waitlist/:id/move', auth:'supervisor+', desc:'Move up or down the queue', request:{ body:{ direction:'up' }} },
       { method:'POST', path:'/api/waitlist/:id/remove', auth:'supervisor+', desc:'Take someone off the waitlist' },
     ]},
+    { title: 'Attendance & certificates', base: '/api/attendance', endpoints: [
+      { method:'GET', path:'/api/attendance/:eventId', auth:'staff+', desc:'Attendance register: sessions (columns), one row per main ticket with check-ins per session, completion and certificate',
+        responses:[{ status:200, desc:'Register', body:{ event:{ id:'ev-uuid-...', scheduleType:'sessions' }, columns:[{ id:'ses-uuid-...', label:'Week 1', startsAt:'2026-11-04T16:30:00.000Z', cancelled:false }], rows:[{ ticketId:'t-uuid-...', name:'Thandi', checkIns:{ 'ses-uuid-...':1 }, attended:1, total:5, completed:false, certificate:null }], totals:{ 'ses-uuid-...':12 } }}]},
+      { method:'GET', path:'/api/attendance/:eventId/export?format=xlsx|pdf', auth:'staff+', desc:'Download the register as Excel or PDF' },
+      { method:'POST', path:'/api/attendance/:eventId/mark', auth:'supervisor+', desc:'Mark a ticket present/absent for a session (single-date events use sessionId "event")', request:{ body:{ ticketId:'t-uuid-...', sessionId:'ses-uuid-...', present:true }} },
+      { method:'POST', path:'/api/attendance/:eventId/certificates', auth:'supervisor+', desc:'Issue certificates now to everyone eligible, or to one ticket (even if not eligible)', request:{ body:{ ticketId:'t-uuid-... (optional)' }} },
+      { method:'POST', path:'/api/attendance/:eventId/certificates/send', auth:'supervisor+', desc:'Email/WhatsApp unsent certificates, or one again', request:{ body:{ certificateId:'(optional)' }} },
+      { method:'GET', path:'/api/attendance/:eventId/certificates.pdf', auth:'supervisor+', desc:'All of an event\'s certificates in one PDF' },
+      { method:'POST', path:'/api/attendance/certificates/preview', auth:'supervisor+', desc:'Sample certificate PDF with unsaved settings', request:{ body:{ title:'Alpha Course', config:{ template:'classic' } }} },
+      { method:'POST', path:'/api/attendance/certificates/:id/revoke', auth:'supervisor+', desc:'Revoke a certificate (never re-issued automatically)' },
+      { method:'GET', path:'/api/attendance/certificates/mine', auth:'user+', desc:'My certificates' },
+      { method:'GET', path:'/api/attendance/certificates/:id/pdf', auth:'user+', desc:'Download a certificate (its person, the booker, or a supervisor)' },
+      { method:'GET', path:'/api/attendance/certificates/verify/:code', auth:'public', desc:'Check a certificate code — name, event and dates only', responses:[{ status:200, desc:'Result', body:{ valid:true, name:'Thandi Mokoena', event:'Alpha Course', completedOn:'2026-12-02T18:30:00.000Z' }}] },
+    ]},
     { title: 'Parental consent', base: '/api/consent', endpoints: [
       { method:'GET', path:'/api/consent/:token', auth:'public', desc:'Consent page data for a parent/guardian (the link token is the credential; rate-limited)',
         responses:[{ status:200, desc:'Success', body:{ status:'pending', attendeeName:'Sam Smith', consentText:'I give permission…', event:{ title:'Youth Camp' }, collect:{ medical:true, emergency:true, photo:true } }}, { status:404, desc:'Unknown or replaced link', body:{ message:'This consent link is not valid.' }}]},
@@ -772,7 +789,7 @@ app.get('/docs', async (req, res) => {
         request:{ body:{ eventId:'ev-uuid-...', options:[{ eventOptionId:'opt-adult', quantity:5 }, { eventOptionId:'opt-child', quantity:3 }] }},
         responses:[{ status:200, desc:'Success', body:{ subtotal:550, bundleDiscount:50, bundles:[{ bundleId:'bnd-uuid-...', name:'Family deal', count:1, discount:50 }], total:500 }}]},
       { method:'GET', path:'/api/bundles/event/:eventId', auth:'supervisor+', desc:'An event\'s bundles with uses and total discount given' },
-      { method:'POST', path:'/api/bundles/event/:eventId', auth:'supervisor+', desc:'Create a bundle. items: [{ eventOptionId, variantId?, quantity }] (variantId left out = any variant).',
+      { method:'POST', path:'/api/bundles/event/:eventId', auth:'supervisor+', desc:'Create a bundle. kind: exact (items with quantities, price for the set) | mix (any setSize of the items for price) | free (any setSize, cheapest freeCount free) | group (setSize or more of the items: groupPricing per_ticket price each, or percent off). items: [{ eventOptionId, variantId?, quantity }] (variantId left out = any variant; quantity only for exact).',
         request:{ body:{ name:'Family deal', price:500, items:[{ eventOptionId:'opt-adult', quantity:5 }, { eventOptionId:'opt-child', quantity:3 }], validUntil:null }}},
       { method:'PUT', path:'/api/bundles/:id', auth:'supervisor+', desc:'Edit a bundle or switch it off ({ isActive:false }). Registrations keep a bundle they already have.' },
       { method:'DELETE', path:'/api/bundles/:id', auth:'supervisor+', desc:'Delete a bundle; one that has been used is switched off instead' },
@@ -1430,199 +1447,9 @@ app.listen(PORT, () => {
     console.warn('[attachments sync] Not scheduled:', e?.message || e);
   }
 
-  // Schedule daily summaries at 07:00 local time (configurable)
-  try {
-    const enabled = String(process.env.DAILY_SUMMARY_ENABLED || 'true').toLowerCase() !== 'false';
-    if (enabled) {
-      const { sendDailyEventSummaries } = require('./utils/notifications');
-      function msUntilNext(hour, minute) {
-        const now = new Date();
-        const next = new Date(now);
-        next.setHours(hour, minute, 0, 0);
-        if (next <= now) {
-          next.setDate(next.getDate() + 1);
-        }
-        return next.getTime() - now.getTime();
-      }
-      async function scheduleNext() {
-        const delay = msUntilNext(7, 0);
-        setTimeout(async () => {
-          try {
-            console.log('[daily summaries] Running daily event summaries...');
-            await sendDailyEventSummaries(new Date());
-            console.log('[daily summaries] Completed sending daily event summaries.');
-          } catch (e) {
-            console.error('[daily summaries] Failed:', e?.message || e);
-          } finally {
-            // Schedule next run
-            scheduleNext();
-          }
-        }, delay);
-      }
-      scheduleNext();
-      console.log('[daily summaries] Scheduler initialized (07:00 local time). Set DAILY_SUMMARY_ENABLED=false to disable.');
-    } else {
-      console.log('[daily summaries] Scheduler disabled by env DAILY_SUMMARY_ENABLED=false');
-    }
-  } catch (e) {
-    console.warn('[daily summaries] Not scheduled:', e?.message || e);
-  }
-
-  // Waitlist job — expire unclaimed offers and offer any free places to the next people.
-  try {
-    const enabled = String(process.env.WAITLIST_JOB_ENABLED || 'true').toLowerCase() !== 'false';
-    if (enabled) {
-      const { runWaitlistJob } = require('./utils/waitlist');
-      const everyMs = parseInt(process.env.WAITLIST_JOB_INTERVAL_MS || String(10 * 60 * 1000), 10);
-      setInterval(async () => {
-        try {
-          const r = await runWaitlistJob();
-          if (r.expired || r.offers) console.log(`[waitlist] ${r.expired} event(s) with expired offers, ${r.offers} new offer(s).`);
-        } catch (e) {
-          console.warn('[waitlist] Job failed:', e?.message || e);
-        }
-      }, everyMs);
-      console.log(`[waitlist] Job every ${Math.round(everyMs / 60000)} min.`);
-    } else {
-      console.log('[waitlist] Job disabled by env WAITLIST_JOB_ENABLED=false');
-    }
-  } catch (e) {
-    console.warn('[waitlist] Not scheduled:', e?.message || e);
-  }
-
-  // Funnel analytics — once a day, roll raw rows older than 90 days into daily totals.
-  try {
-    const enabled = String(process.env.ANALYTICS_ROLLUP_ENABLED || 'true').toLowerCase() !== 'false';
-    if (enabled) {
-      const { rollupOldEvents } = require('./utils/analytics');
-      const run = async () => {
-        try {
-          const n = await rollupOldEvents();
-          if (n) console.log(`[analytics] Rolled up ${n} session(s) older than 90 days.`);
-        } catch (e) {
-          console.warn('[analytics] Rollup failed:', e?.message || e);
-        }
-      };
-      setTimeout(run, 5 * 60 * 1000);
-      setInterval(run, 24 * 60 * 60 * 1000);
-      console.log('[analytics] Rollup daily.');
-    } else {
-      console.log('[analytics] Rollup disabled by env ANALYTICS_ROLLUP_ENABLED=false');
-    }
-  } catch (e) {
-    console.warn('[analytics] Not scheduled:', e?.message || e);
-  }
-
-  // Feedback job — send post-event feedback forms at their send time, and the one
-  // reminder 3 days later.
-  try {
-    const enabled = String(process.env.FEEDBACK_JOB_ENABLED || 'true').toLowerCase() !== 'false';
-    if (enabled) {
-      const { runFeedbackJob } = require('./utils/feedback');
-      const everyMs = parseInt(process.env.FEEDBACK_JOB_INTERVAL_MS || String(15 * 60 * 1000), 10);
-      setInterval(async () => {
-        try {
-          const r = await runFeedbackJob();
-          if (r.sent || r.reminded) console.log(`[feedback] ${r.sent} invite(s), ${r.reminded} reminder(s) sent.`);
-        } catch (e) {
-          console.warn('[feedback] Job failed:', e?.message || e);
-        }
-      }, everyMs);
-      console.log(`[feedback] Job every ${Math.round(everyMs / 60000)} min.`);
-    } else {
-      console.log('[feedback] Job disabled by env FEEDBACK_JOB_ENABLED=false');
-    }
-  } catch (e) {
-    console.warn('[feedback] Not scheduled:', e?.message || e);
-  }
-
-  // Daily parental-consent job — reminders for unanswered requests, and purging
-  // medical/emergency details a set number of days after each event.
-  try {
-    const enabled = String(process.env.CONSENT_JOBS_ENABLED || 'true').toLowerCase() !== 'false';
-    if (enabled) {
-      const { sendConsentReminders, purgeConsentMedicalData } = require('./utils/consent');
-      const runConsentJobs = async () => {
-        try {
-          const reminded = await sendConsentReminders(new Date());
-          const purged = await purgeConsentMedicalData(new Date());
-          if (reminded || purged) console.log(`[consent] Sent ${reminded} reminder(s), purged medical details on ${purged} request(s).`);
-        } catch (e) {
-          console.warn('[consent] Daily job failed:', e?.message || e);
-        }
-      };
-      const scheduleConsent = () => {
-        const now = new Date();
-        const next = new Date(now);
-        next.setHours(9, 0, 0, 0);
-        if (next <= now) next.setDate(next.getDate() + 1);
-        setTimeout(async () => { await runConsentJobs(); scheduleConsent(); }, next.getTime() - now.getTime());
-      };
-      scheduleConsent();
-      console.log('[consent] Scheduler initialized (09:00 local time).');
-    } else {
-      console.log('[consent] Scheduler disabled by env CONSENT_JOBS_ENABLED=false');
-    }
-  } catch (e) {
-    console.warn('[consent] Not scheduled:', e?.message || e);
-  }
-
-  // Daily temp-file cleanup — removes files older than 7 days from /temp
-  try {
-    const { cleanupTempFiles } = require('./utils/cleanupTemp');
-    function scheduleTempCleanup() {
-      const now = new Date();
-      const next = new Date(now);
-      next.setHours(3, 0, 0, 0); // Run at 03:00 local time (low-traffic window)
-      if (next <= now) next.setDate(next.getDate() + 1);
-      setTimeout(() => {
-        try {
-          const result = cleanupTempFiles();
-          if (result.deleted > 0 || result.errors > 0) {
-            console.log(`[temp cleanup] Deleted ${result.deleted} file(s), ${result.errors} error(s).`);
-          }
-        } catch (e) {
-          console.warn('[temp cleanup] Failed:', e?.message || e);
-        } finally {
-          scheduleTempCleanup();
-        }
-      }, next.getTime() - now.getTime());
-    }
-    scheduleTempCleanup();
-    console.log('[temp cleanup] Scheduler initialized (03:00 local time, files older than 7 days).');
-  } catch (e) {
-    console.warn('[temp cleanup] Not scheduled:', e?.message || e);
-  }
-
-  // Nightly database backup at 02:00 local time (before the 03:00 temp cleanup)
-  try {
-    const enabled = String(process.env.BACKUP_ENABLED || 'true').toLowerCase() !== 'false';
-    if (enabled) {
-      const { runBackup } = require('./utils/backupUtils');
-      function scheduleNightlyBackup() {
-        const now = new Date();
-        const next = new Date(now);
-        next.setHours(2, 0, 0, 0);
-        if (next <= now) next.setDate(next.getDate() + 1);
-        setTimeout(async () => {
-          try {
-            const result = await runBackup();
-            console.log(`[backup] Completed: ${result.filename}`);
-          } catch (e) {
-            console.error('[backup] Failed:', e?.message || e);
-          } finally {
-            scheduleNightlyBackup();
-          }
-        }, next.getTime() - now.getTime());
-      }
-      scheduleNightlyBackup();
-      console.log('[backup] Scheduler initialized (02:00 local time). Set BACKUP_ENABLED=false to disable.');
-    } else {
-      console.log('[backup] Scheduler disabled by env BACKUP_ENABLED=false');
-    }
-  } catch (e) {
-    console.warn('[backup] Not scheduled:', e?.message || e);
-  }
+  // Timed background jobs (daily summary, waitlist, feedback, sessions, consent, analytics,
+  // backup, temp cleanup) run on the pg-boss job queue — see src/jobs/index.js.
+  require('./jobs').startJobs().catch(e => console.warn('[jobs] Not started:', e?.message || e));
 
   // Scheduled emails worker (polling)
   try {
@@ -1684,6 +1511,14 @@ app.listen(PORT, () => {
 // Log unhandled promise rejections without killing the server, since a single
 // missed .catch() on fire-and-forget notification code (email/WhatsApp sends)
 // would otherwise take the whole app down.
+// On restart/stop (PM2 sends SIGINT), let a running background job finish first.
+for (const signal of ['SIGINT', 'SIGTERM']) {
+  process.once(signal, async () => {
+    try { await require('./jobs').stopJobs(); } catch { /* exiting anyway */ }
+    process.exit(0);
+  });
+}
+
 process.on('unhandledRejection', (err) => {
   console.error('UNHANDLED REJECTION!', err?.name, err?.message);
   console.error(err?.stack || err);

backend/src/jobs/index.js

@@ -0,0 +1,267 @@
+/**
+ * Background jobs — one registry, run by pg-boss (a job queue stored in Postgres).
+ *
+ * Why a queue instead of setInterval:
+ * - Schedules live in the database, so a job runs once per schedule even when more than
+ *   one backend process is running (PM2 cluster, two servers on one database).
+ * - Every run is recorded (state, start/end, result or error), shown on the admin
+ *   Background jobs page, which can also run a job straight away.
+ * - A run that fails is retried, and a slow run never overlaps the next one.
+ *
+ * Each job can be switched off with its env flag (e.g. WAITLIST_JOB_ENABLED=false), and
+ * its schedule changed with JOB_SCHEDULE_<NAME> (cron, e.g. JOB_SCHEDULE_WAITLIST="*\/5 * * * *").
+ * JOBS_ENABLED=false turns all of them off (used by the end-to-end tests).
+ * If the queue can't start (e.g. the database user can't create the pgboss schema), the
+ * same jobs run on in-process timers instead, as before.
+ */
+
+const cronParser = require('cron-parser');
+
+const TIMEZONE = process.env.APP_TIMEZONE || 'Africa/Johannesburg';
+const SCHEMA = 'pgboss';
+
+const JOBS = [
+  {
+    name: 'daily-summary', label: 'Daily event summary email', cron: '0 7 * * *', env: 'DAILY_SUMMARY_ENABLED',
+    run: async () => { await require('../utils/notifications').sendDailyEventSummaries(new Date()); return { sent: true }; },
+  },
+  {
+    name: 'waitlist', label: 'Waitlist: expire offers, offer freed places', cron: '*/10 * * * *', env: 'WAITLIST_JOB_ENABLED',
+    run: () => require('../utils/waitlist').runWaitlistJob(),
+  },
+  {
+    name: 'feedback', label: 'Post-event feedback forms and reminders', cron: '*/15 * * * *', env: 'FEEDBACK_JOB_ENABLED',
+    run: () => require('../utils/feedback').runFeedbackJob(),
+  },
+  {
+    name: 'sessions', label: 'Session reminders and certificates', cron: '*/5 * * * *', env: 'SESSION_JOBS_ENABLED',
+    run: async () => {
+      const reminders = await require('../utils/sessionReminders').runSessionReminderJob();
+      const certificates = await require('../utils/certificates').runCertificateJob();
+      return { reminders, certificates };
+    },
+  },
+  {
+    name: 'consent', label: 'Parental consent reminders and medical-detail deletion', cron: '0 9 * * *', env: 'CONSENT_JOBS_ENABLED',
+    run: async () => {
+      const { sendConsentReminders, purgeConsentMedicalData } = require('../utils/consent');
+      return { reminded: await sendConsentReminders(new Date()), purged: await purgeConsentMedicalData(new Date()) };
+    },
+  },
+  {
+    name: 'analytics-rollup', label: 'Funnel analytics: roll up visits older than 90 days', cron: '15 4 * * *', env: 'ANALYTICS_ROLLUP_ENABLED',
+    run: async () => ({ rolledUp: await require('../utils/analytics').rollupOldEvents() }),
+  },
+  {
+    name: 'backup', label: 'Database backup', cron: '0 2 * * *', env: 'BACKUP_ENABLED',
+    run: async () => ({ file: (await require('../utils/backupUtils').runBackup()).filename }),
+  },
+  {
+    name: 'temp-cleanup', label: 'Delete temp files older than 7 days', cron: '0 3 * * *', env: null,
+    run: async () => require('../utils/cleanupTemp').cleanupTempFiles(),
+  },
+];
+
+const flag = (name, def = true) => {
+  const v = process.env[name];
+  return v === undefined || v === '' ? def : String(v).toLowerCase() !== 'false';
+};
+
+/** Whether a job is switched on (JOBS_ENABLED and its own flag). */
+function isEnabled(job) {
+  return flag('JOBS_ENABLED') && (!job.env || flag(job.env));
+}
+
+/** A job's cron schedule, with any JOB_SCHEDULE_<NAME> override (checked). */
+function cronFor(job) {
+  const override = process.env[`JOB_SCHEDULE_${job.name.toUpperCase().replace(/-/g, '_')}`];
+  if (override) {
+    try {
+      cronParser.parseExpression(override, { tz: TIMEZONE });
+      return override;
+    } catch {
+      console.warn(`[jobs] Ignoring invalid schedule for ${job.name}: "${override}"`);
+    }
+  }
+  return job.cron;
+}
+
+/** When a cron schedule next fires after `from`. */
+function nextRun(cron, from = new Date()) {
+  return cronParser.parseExpression(cron, { tz: TIMEZONE, currentDate: from }).next().toDate();
+}
+
+function summarize(result) {
+  try {
+    const s = JSON.stringify(result ?? null);
+    return s.length > 300 ? `${s.slice(0, 300)}…` : s;
+  } catch {
+    return '';
+  }
+}
+
+/** True when a job's result says nothing happened (all zeros/false/empty). */
+function isNoop(value) {
+  if (value === null || value === undefined || value === 0 || value === false || value === '') return true;
+  if (Array.isArray(value)) return value.length === 0;
+  if (typeof value === 'object') return Object.values(value).every(isNoop);
+  return false;
+}
+
+async function runJob(job) {
+  const started = Date.now();
+  const result = await job.run();
+  // Quiet when nothing happened, like the old timers.
+  if (!isNoop(result)) console.log(`[jobs] ${job.name} done in ${Date.now() - started} ms: ${summarize(result)}`);
+  return result ?? null;
+}
+
+// ─── Runner ───────────────────────────────────────────────────────────────────
+
+let boss = null;
+let mode = 'off'; // 'queue' | 'timers' | 'off'
+const timers = new Map();
+// Timer mode keeps its own short history so the admin page still has something to show.
+const timerHistory = new Map();
+
+function startTimers(jobs) {
+  mode = 'timers';
+  for (const job of jobs) {
+    const cron = cronFor(job);
+    const scheduleNext = () => {
+      const delay = Math.max(1000, nextRun(cron).getTime() - Date.now());
+      timers.set(job.name, setTimeout(async () => {
+        const entry = { state: 'active', startedOn: new Date(), completedOn: null, output: null };
+        try {
+          entry.output = await runJob(job);
+          entry.state = 'completed';
+        } catch (e) {
+          entry.state = 'failed';
+          entry.output = { message: e?.message || String(e) };
+          console.warn(`[jobs] ${job.name} failed:`, e?.message || e);
+        } finally {
+          entry.completedOn = new Date();
+          timerHistory.set(job.name, [entry, ...(timerHistory.get(job.name) || [])].slice(0, 10));
+          scheduleNext();
+        }
+      }, Math.min(delay, 2 ** 31 - 1)));
+    };
+    scheduleNext();
+  }
+  console.log(`[jobs] Running ${jobs.length} job(s) on in-process timers.`);
+}
+
+/**
+ * Starts the background jobs. Call once after the server is listening.
+ * @returns {Promise<'queue'|'timers'|'off'>}
+ */
+async function startJobs() {
+  const enabled = JOBS.filter(isEnabled);
+  if (!flag('JOBS_ENABLED')) {
+    console.log('[jobs] All background jobs disabled by env JOBS_ENABLED=false');
+    mode = 'off';
+    return mode;
+  }
+  try {
+    const PgBoss = require('pg-boss');
+    boss = new PgBoss({ connectionString: process.env.DATABASE_URL, schema: SCHEMA, application_name: 'hope-events-jobs' });
+    boss.on('error', (e) => console.warn('[jobs] Queue error:', e?.message || e));
+    await boss.start();
+    const existing = new Set((await boss.getQueues()).map(q => q.name));
+    for (const job of JOBS) {
+      if (!existing.has(job.name)) {
+        // stately: at most one waiting and one running, so a slow run never piles up.
+        await boss.createQueue(job.name, { policy: 'stately', retryLimit: 2, retryDelay: 60, expireInSeconds: 60 * 60 });
+      }
+      if (isEnabled(job)) {
+        await boss.schedule(job.name, cronFor(job), null, { tz: TIMEZONE });
+        await boss.work(job.name, async () => {
+          try {
+            return await runJob(job);
+          } catch (e) {
+            console.warn(`[jobs] ${job.name} failed:`, e?.message || e);
+            throw e; // recorded as failed, and retried
+          }
+        });
+      } else {
+        await boss.unschedule(job.name).catch(() => {});
+      }
+    }
+    mode = 'queue';
+    const off = JOBS.filter(j => !isEnabled(j)).map(j => j.name);
+    console.log(`[jobs] Job queue started: ${enabled.map(j => j.name).join(', ')}${off.length ? ` (off: ${off.join(', ')})` : ''}.`);
+  } catch (e) {
+    console.warn('[jobs] Job queue unavailable, falling back to timers:', e?.message || e);
+    if (boss) { try { await boss.stop({ graceful: false }); } catch { /* ignore */ } }
+    boss = null;
+    startTimers(enabled);
+  }
+  return mode;
+}
+
+async function stopJobs() {
+  for (const t of timers.values()) clearTimeout(t);
+  timers.clear();
+  if (boss) {
+    await boss.stop({ graceful: true, timeout: 10000 }).catch(() => {});
+    boss = null;
+  }
+  mode = 'off';
+}
+
+/** Runs a job now (admin "Run now"). Queue mode: queued for a worker; timer mode: inline. */
+async function runNow(name) {
+  const job = JOBS.find(j => j.name === name);
+  if (!job) {
+    const err = new Error('Unknown job');
+    err.statusCode = 404;
+    throw err;
+  }
+  if (mode === 'queue' && isEnabled(job)) {
+    const id = await boss.send(job.name, null, { singletonKey: `${job.name}-manual` });
+    return { queued: true, id };
+  }
+  const output = await runJob(job);
+  const entry = { state: 'completed', startedOn: new Date(), completedOn: new Date(), output };
+  timerHistory.set(job.name, [entry, ...(timerHistory.get(job.name) || [])].slice(0, 10));
+  return { queued: false, output };
+}
+
+/** Each job with its schedule, next run and recent runs, for the admin page. */
+async function jobStatus(prisma) {
+  const recent = new Map();
+  if (mode === 'queue') {
+    const rows = await prisma.$queryRawUnsafe(`
+      SELECT name, state, created_on AS "createdOn", started_on AS "startedOn", completed_on AS "completedOn", output
+      FROM (
+        SELECT name, state, created_on, started_on, completed_on, output,
+               row_number() OVER (PARTITION BY name ORDER BY created_on DESC) AS rn
+        FROM (
+          SELECT name, state::text, created_on, started_on, completed_on, output FROM ${SCHEMA}.job
+          UNION ALL
+          SELECT name, state::text, created_on, started_on, completed_on, output FROM ${SCHEMA}.archive
+        ) all_jobs
+        WHERE name = ANY($1::text[])
+      ) ranked
+      WHERE rn <= 10
+      ORDER BY "createdOn" DESC`, JOBS.map(j => j.name));
+    for (const r of rows) recent.set(r.name, [...(recent.get(r.name) || []), r]);
+  } else {
+    for (const [name, list] of timerHistory) recent.set(name, list);
+  }
+  return {
+    mode,
+    timezone: TIMEZONE,
+    jobs: JOBS.map(job => {
+      const cron = cronFor(job);
+      const enabled = isEnabled(job);
+      return {
+        name: job.name, label: job.label, cron, enabled, envFlag: job.env,
+        nextRun: enabled && mode !== 'off' ? nextRun(cron) : null,
+        recent: recent.get(job.name) || [],
+      };
+    }),
+  };
+}
+
+module.exports = { JOBS, TIMEZONE, isEnabled, cronFor, nextRun, isNoop, startJobs, stopJobs, runNow, jobStatus };

backend/src/routes/adminRoutes.js

@@ -2,9 +2,12 @@ const express = require('express');
 const router = express.Router();
 const { listAuditLog } = require('../controllers/adminAuditController');
 const { startImpersonation, endImpersonation, logPageView, currentImpersonation, listSessions } = require('../controllers/impersonationController');
+const { listJobs, runJobNow } = require('../controllers/jobsController');
 const { protect, admin } = require('../middleware/authMiddleware');
 
 router.get('/audit-log', protect, admin, listAuditLog);
+router.get('/jobs', protect, admin, listJobs);
+router.post('/jobs/:name/run', protect, admin, runJobNow);
 router.get('/impersonation-sessions', protect, admin, listSessions);
 // Called with the impersonation token itself (which belongs to the viewed user).
 router.post('/impersonate/end', protect, endImpersonation);

backend/src/routes/attendanceRoutes.js

@@ -0,0 +1,25 @@
+const express = require('express');
+const router = express.Router();
+const {
+  getRegister, markAttendance, exportRegister,
+  issueCertificates, revokeCertificate, sendCertificatesHandler, downloadEventCertificates, previewCertificate,
+  myCertificates, downloadCertificate, verifyCertificate,
+} = require('../controllers/attendanceController');
+const { protect, staff, supervisor } = require('../middleware/authMiddleware');
+
+// Certificates — fixed paths first so they aren't taken as an :eventId
+router.get('/certificates/verify/:code', verifyCertificate);
+router.get('/certificates/mine', protect, myCertificates);
+router.post('/certificates/preview', protect, supervisor, previewCertificate);
+router.get('/certificates/:id/pdf', protect, downloadCertificate);
+router.post('/certificates/:id/revoke', protect, supervisor, revokeCertificate);
+
+// Attendance register
+router.get('/:eventId', protect, staff, getRegister);
+router.get('/:eventId/export', protect, staff, exportRegister);
+router.post('/:eventId/mark', protect, supervisor, markAttendance);
+router.post('/:eventId/certificates', protect, supervisor, issueCertificates);
+router.post('/:eventId/certificates/send', protect, supervisor, sendCertificatesHandler);
+router.get('/:eventId/certificates.pdf', protect, supervisor, downloadEventCertificates);
+
+module.exports = router;

backend/src/utils/bundles.js

@@ -1,14 +1,21 @@
 /**
- * Bundle deals — a set of tickets sold together for one price, e.g. 5 Adult + 3 Child
- * for R500.
+ * Bundle deals — tickets sold together at a better price. Four kinds:
+ * - exact: these tickets in these numbers for a set price, e.g. 5 Adult + 3 Child for R500.
+ * - mix:   any `setSize` of the qualifying tickets for a set price, e.g. any 4 for R250.
+ * - free:  any `setSize` qualifying tickets with the cheapest `freeCount` free, e.g.
+ *          buy 3 get 1 free (setSize 4, freeCount 1).
+ * - group: `setSize` or more qualifying tickets, all of them at `price` each
+ *          (groupPricing per_ticket) or `price`% off (percent).
  *
  * Rules:
- * - Applied automatically: no code needed. A bundle applies as many times as the
- *   registration's items allow; leftover items are charged as usual.
- * - Best price wins: each application only counts when the bundle price beats what its
- *   items cost at the prices actually charged (early-bird, staff price), so a bundle
- *   never makes anything dearer. The most expensive matching units go into a bundle
- *   first, and when several bundles compete the one saving the most is applied first.
+ * - Applied automatically: no code needed. exact, mix and free apply as many times as
+ *   the registration's items allow; leftover items are charged as usual. A group
+ *   discount applies once, to every qualifying ticket.
+ * - Best price wins: a bundle only counts when it beats what its items cost at the
+ *   prices actually charged (early-bird, staff price), so it never makes anything
+ *   dearer. A group discount never raises a ticket's price. The most expensive matching
+ *   units go into a bundle first, and when several bundles compete the one saving the
+ *   most is applied first.
  * - A bundle item with no variant matches any variant of its option.
  * - Coupons are worked out after bundles, on what's left: bundled units are passed on
  *   to the coupon code at their share of the bundle price (see utils/coupons.js).
@@ -21,60 +28,127 @@
 const prisma = require('../config/db');
 
 const round2 = (n) => Math.round(Number(n || 0) * 100) / 100;
+const fmtR = (n) => `R${Number(n || 0).toFixed(2).replace(/\.00$/, '')}`;
 
-/** Whether a bundle can be offered right now (switched on, within its dates, has items). */
+const KINDS = ['exact', 'mix', 'free', 'group'];
+
+/** Whether a bundle's settings make sense (bad rows are skipped, never applied). */
+function isBundleUsable(bundle) {
+  const items = (bundle?.items || []).filter(i => i && i.eventOptionId);
+  if (items.length === 0 || !(Number(bundle.price) >= 0)) return false;
+  const kind = bundle.kind || 'exact';
+  const size = Number(bundle.setSize);
+  if (kind === 'exact') return items.some(i => Number(i.quantity) > 0);
+  if (!Number.isInteger(size) || size < 1) return false;
+  if (kind === 'free') return Number.isInteger(Number(bundle.freeCount)) && bundle.freeCount >= 1 && bundle.freeCount < size;
+  if (kind === 'group' && bundle.groupPricing === 'percent') return Number(bundle.price) > 0 && Number(bundle.price) <= 100;
+  return KINDS.includes(kind);
+}
+
+/** Whether a bundle can be offered right now (switched on, within its dates, set up properly). */
 function isBundleAvailable(bundle, now = new Date()) {
   if (!bundle || !bundle.isActive) return false;
   if (bundle.validFrom && now < new Date(bundle.validFrom)) return false;
   if (bundle.validUntil && now > new Date(bundle.validUntil)) return false;
-  return (bundle.items || []).some(i => Number(i.quantity) > 0);
+  return isBundleUsable(bundle);
 }
 
 const itemMatches = (item, line) => item.eventOptionId === line.eventOptionId && (!item.variantId || item.variantId === line.variantId);
+const qualifies = (bundle, line) => (bundle.items || []).some(i => itemMatches(i, line));
+
+/** Takes up to `need` units from matching pool lines, dearest first. Mutates `left`. */
+function takeDearest(pool, left, need, matches) {
+  const takes = [];
+  const candidates = pool
+    .map((p, index) => ({ p, index }))
+    .filter(({ p, index }) => left[index] > 0 && matches(p.line))
+    .sort((a, b) => b.p.line.unitPrice - a.p.line.unitPrice);
+  for (const { p, index } of candidates) {
+    if (need === 0) break;
+    const q = Math.min(need, left[index]);
+    left[index] -= q;
+    need -= q;
+    takes.push({ index, quantity: q, unitPrice: p.line.unitPrice });
+  }
+  return need > 0 ? null : takes;
+}
+
+// Every unit at the same share of a set price.
+const atSetPrice = (takes, price) => {
+  const charged = takes.reduce((s, t) => s + t.quantity * t.unitPrice, 0);
+  const ratio = charged > 0 ? price / charged : 0;
+  return { charged, takes: takes.map(t => ({ ...t, newPrice: t.unitPrice * ratio })) };
+};
 
 /**
  * Works out one application of `bundle` against what's left in `pool`, without changing
- * it. Returns { takes: [{ index, quantity }], charged, saving } or null if the items
- * aren't there.
+ * it. Returns { takes: [{ index, quantity, newPrice }], saving } or null when the
+ * bundle can't apply.
  */
 function tryBundle(bundle, pool) {
   const left = pool.map(p => p.remaining);
-  const takes = [];
-  let charged = 0;
-  // Variant-specific items first, so an "any variant" item can't use up the units a
-  // specific one needs.
-  const items = [...bundle.items].filter(i => Number(i.quantity) > 0).sort((a, b) => (b.variantId ? 1 : 0) - (a.variantId ? 1 : 0));
-  for (const item of items) {
-    let need = Number(item.quantity);
-    const candidates = pool
-      .map((p, index) => ({ p, index }))
-      .filter(({ p, index }) => left[index] > 0 && itemMatches(item, p.line))
-      .sort((a, b) => b.p.line.unitPrice - a.p.line.unitPrice);
-    for (const { p, index } of candidates) {
-      if (need === 0) break;
-      const q = Math.min(need, left[index]);
-      left[index] -= q;
-      need -= q;
-      charged += q * p.line.unitPrice;
-      takes.push({ index, quantity: q });
+  const kind = bundle.kind || 'exact';
+  const price = Number(bundle.price || 0);
+  let priced;
+
+  if (kind === 'exact') {
+    // Variant-specific items first, so an "any variant" item can't use up the units a
+    // specific one needs.
+    const items = [...bundle.items].filter(i => Number(i.quantity) > 0).sort((a, b) => (b.variantId ? 1 : 0) - (a.variantId ? 1 : 0));
+    const takes = [];
+    for (const item of items) {
+      const got = takeDearest(pool, left, Number(item.quantity), line => itemMatches(item, line));
+      if (!got) return null;
+      takes.push(...got);
     }
-    if (need > 0) return null;
+    priced = atSetPrice(takes, price);
+  } else if (kind === 'mix' || kind === 'free') {
+    const takes = takeDearest(pool, left, Number(bundle.setSize), line => qualifies(bundle, line));
+    if (!takes) return null;
+    if (kind === 'mix') {
+      priced = atSetPrice(takes, price);
+    } else {
+      // The cheapest freeCount units cost nothing; split takes so only those are free.
+      let free = Number(bundle.freeCount);
+      const out = [];
+      for (const t of [...takes].sort((a, b) => a.unitPrice - b.unitPrice)) {
+        const f = Math.min(free, t.quantity);
+        free -= f;
+        if (f > 0) out.push({ ...t, quantity: f, newPrice: 0 });
+        if (t.quantity - f > 0) out.push({ ...t, quantity: t.quantity - f, newPrice: t.unitPrice });
+      }
+      priced = { charged: takes.reduce((s, t) => s + t.quantity * t.unitPrice, 0), takes: out };
+    }
+  } else if (kind === 'group') {
+    const total = pool.reduce((s, p, i) => s + (qualifies(bundle, p.line) ? left[i] : 0), 0);
+    if (total < Number(bundle.setSize)) return null;
+    const takes = takeDearest(pool, left, total, line => qualifies(bundle, line));
+    const pct = Math.min(100, Math.max(0, price)) / 100;
+    priced = {
+      charged: takes.reduce((s, t) => s + t.quantity * t.unitPrice, 0),
+      takes: takes.map(t => ({ ...t, newPrice: bundle.groupPricing === 'percent' ? t.unitPrice * (1 - pct) : Math.min(t.unitPrice, price) })),
+    };
+  } else {
+    return null;
   }
-  return { takes, charged, saving: charged - Number(bundle.price || 0) };
+
+  const after = priced.takes.reduce((s, t) => s + t.quantity * t.newPrice, 0);
+  return { takes: priced.takes, saving: priced.charged - after };
 }
 
 /**
  * Applies bundles to coupon-style lines (see coupons.js buildCouponLines). Pure.
  *
- * @param {Array} bundles - [{ id, name, price, items: [{ eventOptionId, variantId?, quantity }] }]
+ * @param {Array} bundles - [{ id, name, kind, price, setSize, freeCount, groupPricing,
+ *                          items: [{ eventOptionId, variantId?, quantity }] }]
  *                          already filtered to the ones this registration may use
  * @param {Array} lines   - [{ eventOptionId, variantId, quantity, unitPrice, basePrice }]
  * @returns {{ discount: number, applications: Array<{ bundleId, name, count, discount }>, lines: Array }}
- *          `lines` are the input lines with bundled units split out at their share of the
- *          bundle price (flagged `bundled: true`), ready for the coupon calculation.
+ *          `lines` are the input lines with bundled units split out at their bundle
+ *          price (flagged `bundled: true`), ready for the coupon calculation.
  */
 function applyBundles(bundles, lines) {
-  const usable = (bundles || []).filter(b => (b.items || []).some(i => Number(i.quantity) > 0) && Number(b.price) >= 0);
+  const usable = (bundles || []).filter(isBundleUsable);
   const pool = (lines || []).map(line => ({ line, remaining: Number(line.quantity || 0), bundled: [] }));
   const byBundle = new Map();
 
@@ -83,15 +157,16 @@ function applyBundles(bundles, lines) {
   for (let round = 0; round < maxRounds; round++) {
     let best = null;
     for (const bundle of usable) {
+      // A group discount covers every qualifying ticket in one go, so it applies once.
+      if (bundle.kind === 'group' && byBundle.has(bundle.id)) continue;
       const attempt = tryBundle(bundle, pool);
       if (attempt && attempt.saving > 0.005 && (!best || attempt.saving > best.attempt.saving + 0.0001)) best = { bundle, attempt };
     }
     if (!best) break;
     const { bundle, attempt } = best;
-    const ratio = attempt.charged > 0 ? Number(bundle.price) / attempt.charged : 0;
     for (const t of attempt.takes) {
       pool[t.index].remaining -= t.quantity;
-      pool[t.index].bundled.push({ quantity: t.quantity, ratio });
+      pool[t.index].bundled.push({ quantity: t.quantity, unitPrice: t.newPrice });
     }
     const entry = byBundle.get(bundle.id) || { bundleId: bundle.id, name: bundle.name, count: 0, discount: 0 };
     entry.count += 1;
@@ -104,18 +179,35 @@ function applyBundles(bundles, lines) {
   for (const p of pool) {
     if (p.remaining > 0) outLines.push({ ...p.line, quantity: p.remaining });
     for (const b of p.bundled) {
-      const unitPrice = p.line.unitPrice * b.ratio;
-      outLines.push({ ...p.line, quantity: b.quantity, unitPrice, basePrice: unitPrice, bundled: true });
+      outLines.push({ ...p.line, quantity: b.quantity, unitPrice: b.unitPrice, basePrice: b.unitPrice, bundled: true });
     }
   }
   return { discount: round2(applications.reduce((s, a) => s + a.discount, 0)), applications, lines: outLines };
 }
 
-/** "5 × Adult + 3 × Child (Large)" — needs items[].eventOption / variant names loaded. */
+const itemLabel = (i) => `${i.eventOption?.name || 'ticket'}${i.variant?.name ? ` (${i.variant.name})` : ''}`;
+
+/** "5 × Adult + 3 × Child (Large)", or for the other kinds "Adult, Child". Needs names loaded. */
 function describeBundleItems(bundle) {
-  return (bundle?.items || [])
-    .map(i => `${i.quantity} × ${i.eventOption?.name || 'ticket'}${i.variant?.name ? ` (${i.variant.name})` : ''}`)
-    .join(' + ');
+  const items = bundle?.items || [];
+  if ((bundle?.kind || 'exact') === 'exact') return items.map(i => `${i.quantity} × ${itemLabel(i)}`).join(' + ');
+  return items.map(itemLabel).join(', ');
+}
+
+/**
+ * The deal in one line, e.g. "2 × Adult + 3 × Child for R220", "Any 4 of Adult, Child
+ * for R250", "Buy 3, get 1 free: Adult, Child", "10+ tickets (Adult, Child): R70 each".
+ */
+function describeBundle(bundle) {
+  const kind = bundle?.kind || 'exact';
+  const items = describeBundleItems(bundle);
+  const price = Number(bundle?.price || 0);
+  if (kind === 'mix') return `Any ${bundle.setSize} of ${items} for ${fmtR(price)}`;
+  if (kind === 'free') return `Buy ${bundle.setSize - bundle.freeCount}, get ${bundle.freeCount} free: ${items}`;
+  if (kind === 'group') {
+    return `${bundle.setSize}+ tickets (${items}): ${bundle.groupPricing === 'percent' ? `${price}% off` : `${fmtR(price)} each`}`;
+  }
+  return `${items} for ${fmtR(price)}`;
 }
 
 // ─── Database helpers ─────────────────────────────────────────────────────────
@@ -134,7 +226,7 @@ const BUNDLE_APPS_INCLUDE = { select: { id: true, bundleId: true, count: true, d
 async function loadBundlesFor(eventId, { keepIds = [], now = new Date() } = {}, db = prisma) {
   if (!eventId) return [];
   const bundles = await db.eventBundle.findMany({ where: { eventId }, include: BUNDLE_INCLUDE, orderBy: [{ order: 'asc' }, { createdAt: 'asc' }] });
-  return bundles.filter(b => isBundleAvailable(b, now) || (keepIds.includes(b.id) && (b.items || []).length > 0));
+  return bundles.filter(b => isBundleAvailable(b, now) || (keepIds.includes(b.id) && isBundleUsable(b)));
 }
 
 /** Replaces a registration's RegistrationBundle rows when the applications changed. */
@@ -150,9 +242,12 @@ async function saveBundleApplications(registrationId, existing, applications, db
 }
 
 module.exports = {
+  KINDS,
+  isBundleUsable,
   isBundleAvailable,
   applyBundles,
   describeBundleItems,
+  describeBundle,
   loadBundlesFor,
   saveBundleApplications,
   BUNDLE_INCLUDE,

backend/src/utils/certificates.js

@@ -0,0 +1,358 @@
+/**
+ * Completion certificates — optional per event (Event.certificatesEnabled).
+ *
+ * Rules:
+ * - One certificate per main ticket (one person). Add-on tickets never get one.
+ * - Eligible when the ticket's attendance meets the event's completion rule
+ *   (multi-day: sessions attended out of sessions held; single date: checked in).
+ * - Issued automatically once the event has ended, or by a supervisor at any time
+ *   ("Issue now" for everyone eligible, or one person manually even if not eligible).
+ * - A revoked certificate stays revoked: the automatic job never re-issues it.
+ * - Each certificate has a short code that the public verify page checks.
+ */
+
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const PDFDocument = require('pdfkit');
+const QRCode = require('qrcode');
+const prisma = require('../config/db');
+const { activeSessions, completionMet, normalizeCertificateConfig, attendanceBySession, TIMEZONE } = require('./sessions');
+
+const CODE_ALPHABET = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
+const AUTO_ISSUE_DAYS = 14;
+
+/** A random code like "K7M2Q-9XRTB" (no 0/O/1/I to avoid misreading). */
+function newCode() {
+  const bytes = crypto.randomBytes(10);
+  const chars = Array.from(bytes, b => CODE_ALPHABET[b % CODE_ALPHABET.length]).join('');
+  return `${chars.slice(0, 5)}-${chars.slice(5)}`;
+}
+
+/** Fills {name}, {event}, {sessionsAttended}, {totalSessions}, {endDate} in certificate text. */
+function fillPlaceholders(text, values) {
+  return String(text || '').replace(/\{(name|event|sessionsAttended|totalSessions|endDate)\}/g, (_, k) => String(values[k] ?? ''));
+}
+
+function fmtLongDate(d) {
+  return new Date(d).toLocaleDateString('en-GB', { timeZone: TIMEZONE, day: 'numeric', month: 'long', year: 'numeric' });
+}
+
+function ticketName(t) {
+  return t.attendee?.name || t.holder?.name || t.user?.name || 'Attendee';
+}
+
+/**
+ * Attendance per main ticket of an event: [{ ticket, attended, total }]. Multi-day events
+ * count sessions attended (cancelled sessions left out); single-date events count 1 when
+ * checked in.
+ */
+async function attendanceForCertificates(eventId) {
+  const event = await prisma.event.findUnique({ where: { id: eventId }, include: { sessions: true } });
+  if (!event) return { event: null, rows: [] };
+  const tickets = await prisma.ticket.findMany({
+    where: { eventId, registrationOption: { eventOption: { isMainTicket: true }, registration: { status: { not: 'cancelled' } } } },
+    include: {
+      attendee: { select: { name: true } },
+      holder: { select: { id: true, name: true } },
+      user: { select: { id: true, name: true } },
+      usages: { select: { quantityRedeemed: true, sessionId: true } },
+    },
+  });
+  if (event.scheduleType === 'sessions') {
+    const active = activeSessions(event.sessions);
+    const activeIds = new Set(active.map(s => s.id));
+    const bySession = await attendanceBySession(eventId);
+    return {
+      event,
+      rows: tickets.map(t => {
+        const m = bySession.get(t.id) || new Map();
+        const attended = [...m.entries()].filter(([sid, qty]) => activeIds.has(sid) && qty > 0).length;
+        return { ticket: t, attended, total: active.length };
+      }),
+    };
+  }
+  return { event, rows: tickets.map(t => ({ ticket: t, attended: t.usages.length > 0 ? 1 : 0, total: 1 })) };
+}
+
+/**
+ * Issues certificates for everyone who meets the completion rule and doesn't have one yet
+ * (revoked ones are left alone). Returns the new certificates.
+ */
+async function issueEligible(eventId, { issuedById = null } = {}) {
+  const { event, rows } = await attendanceForCertificates(eventId);
+  if (!event || !event.certificatesEnabled) return [];
+  const config = normalizeCertificateConfig(event.certificateConfig);
+  const existing = new Set((await prisma.certificate.findMany({ where: { eventId }, select: { ticketId: true } })).map(c => c.ticketId));
+  const created = [];
+  for (const r of rows) {
+    if (existing.has(r.ticket.id) || !completionMet(config.rule, r.attended, r.total)) continue;
+    try {
+      created.push(await prisma.certificate.create({
+        data: {
+          eventId, ticketId: r.ticket.id, userId: r.ticket.holderUserId || r.ticket.userId,
+          name: ticketName(r.ticket), code: newCode(), sessionsAttended: r.attended, totalSessions: r.total,
+          issuedById,
+        },
+      }));
+    } catch (e) {
+      if (e?.code !== 'P2002') throw e; // issued at the same moment by the job — fine
+    }
+  }
+  return created;
+}
+
+/** Issues (or re-issues a revoked) certificate for one ticket, eligible or not. */
+async function issueManual(eventId, ticketId, issuedById) {
+  const { event, rows } = await attendanceForCertificates(eventId);
+  const r = rows.find(x => x.ticket.id === ticketId);
+  if (!event || !r) {
+    const err = new Error('Ticket not found for this event');
+    err.statusCode = 404;
+    throw err;
+  }
+  const data = { name: ticketName(r.ticket), sessionsAttended: r.attended, totalSessions: r.total, manual: true, issuedById, revokedAt: null, issuedAt: new Date() };
+  return prisma.certificate.upsert({
+    where: { eventId_ticketId: { eventId, ticketId } },
+    create: { eventId, ticketId, userId: r.ticket.holderUserId || r.ticket.userId, code: newCode(), ...data },
+    update: data,
+  });
+}
+
+// ─── PDF ──────────────────────────────────────────────────────────────────────
+
+const PAGE = { size: 'A4', layout: 'landscape', margin: 0 };
+
+function hexToRgb(hex) {
+  const m = /^#?([0-9a-f]{6})$/i.exec(String(hex || '').trim());
+  if (!m) return [30, 58, 95];
+  const n = parseInt(m[1], 16);
+  return [(n >> 16) & 255, (n >> 8) & 255, n & 255];
+}
+
+function lighten(hex, amount) {
+  const [r, g, b] = hexToRgb(hex);
+  const mix = (c) => Math.round(c + (255 - c) * amount);
+  return `#${[mix(r), mix(g), mix(b)].map(c => c.toString(16).padStart(2, '0')).join('')}`;
+}
+
+function uploadPath(url) {
+  if (!url || /^https?:\/\//i.test(url)) return null;
+  const p = path.join(__dirname, '..', '..', 'public', String(url).replace(/^\//, ''));
+  return fs.existsSync(p) ? p : null;
+}
+
+function safeImage(doc, file, x, y, opts) {
+  if (!file) return false;
+  try { doc.image(file, x, y, opts); return true; } catch { return false; }
+}
+
+// Shared bottom block: signature (left), date (middle), verification QR + code (right).
+function drawFooter(doc, { cert, config, branding, qr, color, font, bold, y }) {
+  const W = doc.page.width;
+  const colW = 200;
+  const sigX = 90;
+  const sigImg = uploadPath(config.signatureImage);
+  if (sigImg) safeImage(doc, sigImg, sigX + 20, y - 46, { fit: [160, 42] });
+  doc.moveTo(sigX, y).lineTo(sigX + colW, y).lineWidth(0.8).strokeColor('#94a3b8').stroke();
+  doc.font(bold).fontSize(11).fillColor('#1e293b').text(config.signatureName || branding.name, sigX, y + 6, { width: colW, align: 'center' });
+  if (config.signatureRole) doc.font(font).fontSize(9).fillColor('#64748b').text(config.signatureRole, sigX, y + 21, { width: colW, align: 'center' });
+
+  const dateX = W / 2 - colW / 2;
+  doc.moveTo(dateX, y).lineTo(dateX + colW, y).lineWidth(0.8).strokeColor('#94a3b8').stroke();
+  doc.font(bold).fontSize(11).fillColor('#1e293b').text(fmtLongDate(cert.issuedAt), dateX, y + 6, { width: colW, align: 'center' });
+  doc.font(font).fontSize(9).fillColor('#64748b').text('Date', dateX, y + 21, { width: colW, align: 'center' });
+
+  const qrSize = 64;
+  const qrX = W - 90 - qrSize;
+  safeImage(doc, qr, qrX, y - 50, { width: qrSize });
+  doc.font(font).fontSize(7.5).fillColor('#64748b').text(`Verify: ${cert.code}`, qrX - 40, y + 18, { width: qrSize + 80, align: 'center' });
+  doc.fillColor(color);
+}
+
+function drawTemplate(doc, template, ctx) {
+  const { cert, config, branding, event, title, body } = ctx;
+  const W = doc.page.width;
+  const H = doc.page.height;
+  const color = branding.brandColor;
+  const logo = branding.logoPath;
+
+  if (template === 'modern') {
+    doc.rect(0, 0, W, H).fill('#ffffff');
+    doc.rect(0, 0, 28, H).fill(color);
+    doc.rect(28, 0, 6, H).fill(lighten(color, 0.6));
+    const x = 90;
+    safeImage(doc, logo, x, 70, { fit: [120, 50] });
+    doc.font('Helvetica').fontSize(11).fillColor(color).text(branding.name.toUpperCase(), x, 150, { characterSpacing: 2 });
+    doc.font('Helvetica-Bold').fontSize(36).fillColor('#0f172a').text(title, x, 175, { width: W - x - 80 });
+    doc.font('Helvetica').fontSize(13).fillColor('#64748b').text('Presented to', x, 260);
+    doc.font('Helvetica-Bold').fontSize(32).fillColor(color).text(cert.name, x, 280, { width: W - x - 80 });
+    doc.font('Helvetica').fontSize(14).fillColor('#334155').text(body, x, 340, { width: W - x - 140, lineGap: 5 });
+    drawFooter(doc, { ...ctx, color, font: 'Helvetica', bold: 'Helvetica-Bold', y: H - 80 });
+    return;
+  }
+
+  if (template === 'church') {
+    doc.rect(0, 0, W, H).fill(lighten(color, 0.94));
+    doc.rect(30, 30, W - 60, H - 60).lineWidth(1).strokeColor(lighten(color, 0.4)).stroke();
+    const hasLogo = safeImage(doc, logo, W / 2 - 50, 55, { fit: [100, 70], align: 'center' });
+    const top = hasLogo ? 150 : 115;
+    doc.font('Times-Italic').fontSize(14).fillColor(color).text(branding.name, 0, top, { width: W, align: 'center' });
+    doc.font('Times-Bold').fontSize(34).fillColor('#1e293b').text(title, 60, top + 26, { width: W - 120, align: 'center' });
+    doc.moveTo(W / 2 - 60, top + 74).lineTo(W / 2 + 60, top + 74).lineWidth(1.5).strokeColor(color).stroke();
+    doc.font('Times-Italic').fontSize(14).fillColor('#475569').text('This is to certify that', 0, top + 88, { width: W, align: 'center' });
+    doc.font('Times-Bold').fontSize(30).fillColor(color).text(cert.name, 60, top + 110, { width: W - 120, align: 'center' });
+    doc.font('Times-Roman').fontSize(14).fillColor('#334155').text(body, 120, top + 162, { width: W - 240, align: 'center', lineGap: 5 });
+    drawFooter(doc, { ...ctx, color, font: 'Times-Roman', bold: 'Times-Bold', y: H - 85 });
+    return;
+  }
+
+  if (template === 'kids') {
+    const bright = ['#f59e0b', '#ec4899', '#22c55e', '#3b82f6', '#a855f7'];
+    doc.rect(0, 0, W, H).fill('#fffdf5');
+    doc.roundedRect(22, 22, W - 44, H - 44, 28).lineWidth(10).strokeColor(color).stroke();
+    // Confetti dots around the edge.
+    let seed = parseInt(cert.code.replace(/[^A-Z0-9]/g, '').slice(0, 6), 36) || 7;
+    const rnd = () => { seed = (seed * 9301 + 49297) % 233280; return seed / 233280; };
+    // Confetti in the top band and down the sides — never over the text or the footer.
+    for (let i = 0; i < 46; i++) {
+      const top = rnd() < 0.45;
+      const x = top ? 50 + rnd() * (W - 100) : (rnd() < 0.5 ? 48 + rnd() * 45 : W - 93 + rnd() * 45);
+      const y = top ? 48 + rnd() * 50 : 110 + rnd() * (H - 260);
+      doc.circle(x, y, 3 + rnd() * 5).fill(bright[i % bright.length]);
+    }
+    safeImage(doc, logo, W / 2 - 40, 100, { fit: [80, 50], align: 'center' });
+    doc.font('Helvetica-Bold').fontSize(38).fillColor(color).text(title, 100, 165, { width: W - 200, align: 'center' });
+    doc.font('Helvetica-Bold').fontSize(15).fillColor('#f59e0b').text('Well done,', 0, 230, { width: W, align: 'center' });
+    doc.font('Helvetica-Bold').fontSize(36).fillColor('#1e293b').text(cert.name, 100, 250, { width: W - 200, align: 'center' });
+    doc.font('Helvetica').fontSize(15).fillColor('#334155').text(body, 130, 310, { width: W - 260, align: 'center', lineGap: 5 });
+    drawFooter(doc, { ...ctx, color, font: 'Helvetica', bold: 'Helvetica-Bold', y: H - 90 });
+    return;
+  }
+
+  // classic
+  doc.rect(0, 0, W, H).fill('#fffefa');
+  doc.rect(24, 24, W - 48, H - 48).lineWidth(3).strokeColor(color).stroke();
+  doc.rect(34, 34, W - 68, H - 68).lineWidth(0.8).strokeColor(color).stroke();
+  for (const [cx, cy] of [[34, 34], [W - 34, 34], [34, H - 34], [W - 34, H - 34]]) {
+    doc.circle(cx, cy, 6).fill(color);
+  }
+  safeImage(doc, logo, W / 2 - 45, 70, { fit: [90, 55], align: 'center' });
+  doc.font('Times-Bold').fontSize(38).fillColor('#1e293b').text(title.toUpperCase(), 60, 150, { width: W - 120, align: 'center', characterSpacing: 1.5 });
+  doc.font('Times-Italic').fontSize(14).fillColor('#64748b').text('This certificate is proudly presented to', 0, 212, { width: W, align: 'center' });
+  doc.font('Times-BoldItalic').fontSize(34).fillColor(color).text(cert.name, 60, 236, { width: W - 120, align: 'center' });
+  doc.moveTo(W / 2 - 170, 284).lineTo(W / 2 + 170, 284).lineWidth(0.8).strokeColor('#cbd5e1').stroke();
+  doc.font('Times-Roman').fontSize(14).fillColor('#334155').text(body, 120, 300, { width: W - 240, align: 'center', lineGap: 5 });
+  doc.font('Times-Italic').fontSize(11).fillColor('#64748b').text(branding.name, 0, H - 132, { width: W, align: 'center' });
+  drawFooter(doc, { ...ctx, color, font: 'Times-Roman', bold: 'Times-Bold', y: H - 85 });
+  void event;
+}
+
+/**
+ * Renders certificates (one page each) to a PDF Buffer.
+ * @param {object[]} certs - Certificate rows ({ name, code, issuedAt, sessionsAttended, totalSessions })
+ * @param {object} event - { title, endDate, certificateConfig }
+ * @param {object} [configOverride] - certificate settings to use instead (editor preview)
+ */
+async function renderCertificatesPdf(certs, event, configOverride = null) {
+  const { getBranding } = require('./pdfDocs');
+  const branding = await getBranding();
+  const config = normalizeCertificateConfig(configOverride || event.certificateConfig);
+  const doc = new PDFDocument({ ...PAGE, autoFirstPage: false, info: { Title: `${config.title} — ${event.title}` } });
+  const chunks = [];
+  doc.on('data', c => chunks.push(c));
+  const done = new Promise((resolve, reject) => { doc.on('end', resolve); doc.on('error', reject); });
+
+  for (const cert of certs) {
+    doc.addPage(PAGE);
+    const values = { name: cert.name, event: event.title, sessionsAttended: cert.sessionsAttended, totalSessions: cert.totalSessions, endDate: fmtLongDate(event.endDate) };
+    const qrData = await QRCode.toDataURL(`${branding.url}/certificates/verify/${encodeURIComponent(cert.code)}`, { margin: 0, width: 200 });
+    const qr = Buffer.from(qrData.split(',')[1], 'base64');
+    drawTemplate(doc, config.template, {
+      cert, config, branding, event, qr,
+      title: fillPlaceholders(config.title, values),
+      body: fillPlaceholders(config.body, values),
+    });
+  }
+  doc.end();
+  await done;
+  return Buffer.concat(chunks);
+}
+
+/** A sample certificate for the event editor's preview button. */
+function sampleCertificate() {
+  return { name: 'Thandi Mokoena', code: 'SAMPL-E2026', issuedAt: new Date(), sessionsAttended: 5, totalSessions: 5 };
+}
+
+// ─── Sending ──────────────────────────────────────────────────────────────────
+
+/** Emails (and WhatsApps, per preference) each certificate to its person. Returns how many went out. */
+async function sendCertificates(certIds) {
+  const { sendMail, emailWrapper, ctaButton, getOrg } = require('./email');
+  const { shouldEmail, waPdf, waPdfAny } = require('./notify');
+  const certs = await prisma.certificate.findMany({
+    where: { id: { in: certIds }, revokedAt: null },
+    include: {
+      event: { select: { id: true, title: true, endDate: true, certificateConfig: true } },
+      user: { select: { id: true, name: true, email: true, phoneNumber: true, notificationPreference: true } },
+    },
+  });
+  const org = getOrg();
+  let sent = 0;
+  for (const cert of certs) {
+    const user = cert.user;
+    if (!user) continue;
+    try {
+      const pdf = await renderCertificatesPdf([cert], cert.event);
+      const filename = `Certificate - ${cert.event.title}`.replace(/[^a-z0-9 -]/gi, '').slice(0, 80) + '.pdf';
+      const hasEmail = user.email && !user.email.endsWith('@guest.local') && !user.email.endsWith('@deleted.invalid');
+      const jobs = [];
+      if (hasEmail && shouldEmail(user)) {
+        const html = emailWrapper(`
+          <p>Hi ${user.name?.split(' ')[0] || 'there'},</p>
+          <p>Congratulations on completing <strong>${cert.event.title}</strong>! Your certificate for <strong>${cert.name}</strong> is attached.</p>
+          ${ctaButton('View my events', `${org.url}/dashboard/user`)}
+          <p style="font-size:13px;color:#64748b">Anyone can check it at ${org.url}/certificates/verify/${cert.code}</p>`, { preheader: `Your certificate for ${cert.event.title}` });
+        jobs.push(sendMail({ to: user.email, subject: `Your certificate — ${cert.event.title}`, html, text: `Congratulations on completing ${cert.event.title}! Your certificate is attached.`, attachments: [{ filename, content: pdf, contentType: 'application/pdf' }] }));
+      }
+      const { tempDir } = require('./pdfDocs');
+      const tmp = path.join(tempDir(), `certificate-${cert.id}.pdf`);
+      fs.writeFileSync(tmp, pdf);
+      const caption = `🎓 Your certificate for ${cert.event.title}`;
+      jobs.push(hasEmail ? waPdf(user, tmp, filename, caption) : waPdfAny(user, tmp, filename, caption));
+      await Promise.all(jobs);
+      await prisma.certificate.update({ where: { id: cert.id }, data: { emailedAt: new Date() } });
+      sent += 1;
+    } catch (e) {
+      console.warn('[certificates] Send failed:', e?.message || e);
+    }
+  }
+  return sent;
+}
+
+/**
+ * Background job: for events with certificates on that ended within the last 14 days,
+ * issue certificates to everyone eligible, and send them when the event says so.
+ */
+async function runCertificateJob(now = new Date()) {
+  const since = new Date(now.getTime() - AUTO_ISSUE_DAYS * 24 * 60 * 60 * 1000);
+  const events = await prisma.event.findMany({
+    where: { certificatesEnabled: true, endDate: { lte: now, gte: since } },
+    select: { id: true, certificateConfig: true },
+  });
+  let issued = 0;
+  let sent = 0;
+  for (const ev of events) {
+    const created = await issueEligible(ev.id);
+    issued += created.length;
+    if (created.length && normalizeCertificateConfig(ev.certificateConfig).sendOnIssue) {
+      sent += await sendCertificates(created.map(c => c.id));
+    }
+  }
+  return { issued, sent };
+}
+
+module.exports = {
+  newCode, fillPlaceholders, attendanceForCertificates, issueEligible, issueManual,
+  renderCertificatesPdf, sampleCertificate, sendCertificates, runCertificateJob,
+};

backend/src/utils/email.js

@@ -423,6 +423,7 @@ function buildAccountClosedEmail({ name, dataDeleted }) {
 module.exports = {
   sendMail,
   isSmtpConfigured,
+  getOrg,
   emailWrapper,
   ctaButton,
   fallbackLink,

backend/src/utils/icsUtils.js

@@ -1,4 +1,4 @@
-const { createEvent } = require('ics');
+const { createEvent, createEvents } = require('ics');
 
 // Event.startDate/endDate are stored as true UTC instants (the admin event form's
 // datetime-local input is parsed in the browser's local time before being sent as an
@@ -9,26 +9,46 @@ function toUtcArray(date) {
   return [d.getUTCFullYear(), d.getUTCMonth() + 1, d.getUTCDate(), d.getUTCHours(), d.getUTCMinutes()];
 }
 
-/**
- * Build an RFC 5545 .ics file (as a string) for a single event.
- *
- * @param {object} event - Prisma Event row: title, description?, startDate, endDate, location?
- * @param {string} eventUrl - absolute URL to the event's public page
- * @returns {string}
- */
-function buildEventIcs(event, eventUrl) {
-  const { error, value } = createEvent({
-    title: event.title,
-    start: toUtcArray(event.startDate),
-    end: toUtcArray(event.endDate),
+function icsEntry(event, eventUrl, { start, end, title, location }) {
+  return {
+    title,
+    start: toUtcArray(start),
+    end: toUtcArray(end),
     startInputType: 'utc',
     endInputType: 'utc',
     startOutputType: 'utc',
     endOutputType: 'utc',
-    location: event.location || undefined,
+    location: location || event.location || undefined,
     description: event.description || undefined,
     url: eventUrl,
-  });
+  };
+}
+
+/**
+ * Build an RFC 5545 .ics file (as a string) for an event. A multi-session event gets one
+ * calendar entry per session that isn't cancelled (not a repeat rule, so moved or skipped
+ * sessions are exact).
+ *
+ * @param {object} event - Prisma Event row: title, description?, startDate, endDate, location?,
+ *   scheduleType?, sessions?[]
+ * @param {string} eventUrl - absolute URL to the event's public page
+ * @returns {string}
+ */
+function buildEventIcs(event, eventUrl) {
+  const sessions = event.scheduleType === 'sessions'
+    ? (event.sessions || []).filter(s => !s.cancelledAt).sort((a, b) => new Date(a.startsAt) - new Date(b.startsAt))
+    : [];
+  if (sessions.length > 0) {
+    const { error, value } = createEvents(sessions.map((s, i) => icsEntry(event, eventUrl, {
+      start: s.startsAt,
+      end: s.endsAt,
+      title: `${event.title} — ${s.label || `Session ${i + 1}`}`,
+      location: s.location,
+    })));
+    if (error) throw error;
+    return value;
+  }
+  const { error, value } = createEvent(icsEntry(event, eventUrl, { start: event.startDate, end: event.endDate, title: event.title }));
   if (error) throw error;
   return value;
 }

backend/src/utils/pdfDocs.js

@@ -387,4 +387,4 @@ async function generateInvoicePdf(registration, { paymentUrl = null, totalDue =
   return { filePath, filename };
 }
 
-module.exports = { generateReceiptPdf, generateInvoicePdf, buildLineItems, couponDiscountLine, bundleDiscountLine, discountLines, getBranding, docNumber };
+module.exports = { generateReceiptPdf, generateInvoicePdf, buildLineItems, couponDiscountLine, bundleDiscountLine, discountLines, getBranding, docNumber, tempDir };

backend/src/utils/pricing.js

@@ -30,6 +30,7 @@
  */
 
 const prisma = require('../config/db');
+const { withLatePrice } = require('./sessions');
 
 const STAFF_ROLES = ['staff', 'supervisor', 'admin'];
 
@@ -91,8 +92,9 @@ function getEffectiveUnitPrice(eventOption, referenceTime, atTime) {
  * @param {object|null} user - buyer ({ role }); Staff and above may get the staff price
  * @returns {Promise<{ price: number, tierId: string|null }>}
  */
+// Late joiners on a multi-day event pay a lower main-ticket price (utils/sessions.js).
 async function resolveOptionPrice(option, requestedQty = 1, user = null) {
-  return withStaffPrice(await resolveOptionTierPrice(option, requestedQty), staffPriceFor(option, null, user));
+  return withLatePrice(option, withStaffPrice(await resolveOptionTierPrice(option, requestedQty), staffPriceFor(option, null, user)));
 }
 
 async function resolveOptionTierPrice(option, requestedQty) {
@@ -147,7 +149,7 @@ async function resolveOptionTierPrice(option, requestedQty) {
  * @returns {Promise<{ price: number, tierId: string|null }>}
  */
 async function resolveVariantTierPrice(option, variantId, requestedQty = 1, user = null) {
-  return withStaffPrice(await resolveVariantOnlyTierPrice(option, variantId, requestedQty), staffPriceFor(option, variantId, user));
+  return withLatePrice(option, withStaffPrice(await resolveVariantOnlyTierPrice(option, variantId, requestedQty), staffPriceFor(option, variantId, user)));
 }
 
 async function resolveVariantOnlyTierPrice(option, variantId, requestedQty) {

backend/src/utils/scanLocks.js

@@ -14,6 +14,8 @@
  *   up, outside the locked scope, consent not given — goes into an OfflineSyncReport.
  * - A supervisor can force-release a lock (lost phone). If that device syncs later its
  *   scans are still recorded, and the report is flagged.
+ * - Multi-day events: the snapshot counts what's left for the session running when it was
+ *   downloaded, and each synced scan counts for the session at its scan time.
  */
 
 const prisma = require('../config/db');
@@ -53,6 +55,7 @@ function lockCovers(lock, { sectionId = null, optionId }) {
 function judgeSyncedScan(ticket, qty) {
   if (!ticket) return { redeem: 0, conflict: 'not_found' };
   if (ticket.transferred) return { redeem: 0, conflict: 'transferred' };
+  if (ticket.noSession) return { redeem: 0, conflict: 'no_session' };
   if (ticket.cancelled) return { redeem: 0, conflict: 'cancelled' };
   if (!ticket.inScope) return { redeem: 0, conflict: 'wrong_scope' };
   if (ticket.remaining <= 0) return { redeem: 0, conflict: 'already_used' };
@@ -69,6 +72,7 @@ const CONFLICT_TEXT = {
   already_used: 'Ticket had already been fully used',
   partly_used: 'Fewer places were left than were checked in offline',
   consent: 'Checked in without parental consent',
+  no_session: 'Scanned on a day (or at a time) with no session open for check-in',
 };
 
 // ─── Database helpers ─────────────────────────────────────────────────────────
@@ -123,7 +127,7 @@ async function snapshotFor(lock) {
       registrationOption: { registration: { status: { not: 'cancelled' } }, ...(optionIds ? { eventOptionId: { in: optionIds } } : {}) },
     },
     include: {
-      usages: { select: { quantityRedeemed: true } },
+      usages: { select: { quantityRedeemed: true, sessionId: true } },
       attendee: { select: { name: true } },
       user: { select: { name: true } },
       registrationOption: { include: { eventOption: { select: { id: true, name: true, isMainTicket: true } }, variant: { select: { name: true } } } },
@@ -133,10 +137,17 @@ async function snapshotFor(lock) {
   const consent = await consentStatusForTickets(tickets.map(t => t.id));
   const snapshotAt = new Date();
   await prisma.scanLock.update({ where: { id: lock.id }, data: { snapshotAt } });
+  const sessionsUtil = require('./sessions');
+  const schedule = await sessionsUtil.eventSchedule(lock.eventId);
+  const session = schedule?.scheduleType === 'sessions' ? sessionsUtil.currentSession(schedule.sessions, snapshotAt, schedule.checkInWindow) : null;
   return {
     snapshotAt,
+    session: session ? { id: session.id, label: sessionsUtil.sessionLabel(session, schedule.sessions) } : null,
+    noSessionToday: schedule?.scheduleType === 'sessions' && !session,
     tickets: tickets.map(t => {
-      const redeemed = t.usages.reduce((s, u) => s + (u.quantityRedeemed || 1), 0);
+      const redeemed = schedule?.scheduleType === 'sessions'
+        ? (session ? sessionsUtil.redeemedForSession(t.usages, session.id) : t.quantity || 1)
+        : t.usages.reduce((s, u) => s + (u.quantityRedeemed || 1), 0);
       return {
         id: t.id,
         qrCode: t.qrCode,
@@ -161,6 +172,9 @@ async function syncScans(lock, scans) {
   const optionIds = lock.section ? new Set(lock.section.allowedOptions.map(o => o.eventOptionId)) : null;
   const { consentStatusForTickets } = require('./consent');
   const checkIns = [];
+  const sessionsUtil = require('./sessions');
+  const schedule = await sessionsUtil.eventSchedule(lock.eventId);
+  const hasSessions = schedule?.scheduleType === 'sessions';
 
   for (const scan of (scans || []).slice(0, 2000)) {
     const clientScanId = String(scan?.clientScanId || '').slice(0, 100);
@@ -178,9 +192,14 @@ async function syncScans(lock, scans) {
       const { findTransferByOldCode } = require('./ticketTransfer');
       if (await findTransferByOldCode(scan.qrCode)) state = { transferred: true };
     } else if (ticket.eventId === lock.eventId) {
-      const redeemed = ticket.usages.reduce((s, u) => s + (u.quantityRedeemed || 1), 0);
+      const session = hasSessions ? sessionsUtil.currentSession(schedule.sessions, scannedAt, schedule.checkInWindow) : null;
+      const redeemed = session
+        ? sessionsUtil.redeemedForSession(ticket.usages, session.id)
+        : ticket.usages.reduce((s, u) => s + (u.quantityRedeemed || 1), 0);
       const consent = (await consentStatusForTickets([ticket.id])).get(ticket.id);
       state = {
+        sessionId: session?.id || null,
+        noSession: hasSessions && !session,
         remaining: (ticket.quantity || 1) - redeemed,
         cancelled: ticket.registrationOption.registration.status === 'cancelled',
         inScope: !optionIds || optionIds.has(ticket.registrationOption.eventOptionId),
@@ -190,9 +209,9 @@ async function syncScans(lock, scans) {
     const verdict = judgeSyncedScan(state, qty);
     if (verdict.redeem > 0) {
       await prisma.ticketUsage.create({
-        data: { ticketId: ticket.id, scannedById: lock.userId, scannedAt, quantityRedeemed: verdict.redeem, clientScanId, offline: true, scanLockId: lock.id, syncedAt: new Date() },
+        data: { ticketId: ticket.id, scannedById: lock.userId, scannedAt, quantityRedeemed: verdict.redeem, clientScanId, offline: true, scanLockId: lock.id, syncedAt: new Date(), sessionId: state.sessionId },
       });
-      await prisma.ticket.update({ where: { id: ticket.id }, data: { isUsed: state.remaining - verdict.redeem <= 0, updatedAt: new Date() } });
+      await prisma.ticket.update({ where: { id: ticket.id }, data: { isUsed: !hasSessions && state.remaining - verdict.redeem <= 0, updatedAt: new Date() } });
       results.accepted += 1;
       if (ticket.registrationOption.eventOption.isMainTicket) {
         checkIns.push({ ticketId: ticket.id, qty: verdict.redeem, total: (ticket.quantity || 1) - state.remaining + verdict.redeem, left: state.remaining - verdict.redeem });

backend/src/utils/sessionReminders.js

@@ -0,0 +1,123 @@
+/**
+ * Session reminders — optional per multi-day event (Event.sessionReminders), e.g. "3 h
+ * before" and "1 day before" each session, by email and/or WhatsApp.
+ *
+ * Rules:
+ * - Goes to everyone with a ticket for the event (the booker, and named attendees with
+ *   an account), skipping cancelled registrations. One message per person per session.
+ * - Each (session, offset) is sent once (SessionReminderLog). When several offsets are
+ *   already due — e.g. reminders were switched on 2 h before a session — only the
+ *   closest one is sent and the others are logged as skipped, so nobody gets two at once.
+ * - Cancelled sessions get no reminders. Email/WhatsApp follow each person's
+ *   notification preference.
+ */
+
+const prisma = require('../config/db');
+const { activeSessions, sessionLabel, TIMEZONE } = require('./sessions');
+
+const MAX_OFFSET_MIN = 1440;
+
+function fmtWhen(d) {
+  return new Date(d).toLocaleString('en-GB', { timeZone: TIMEZONE, weekday: 'long', day: 'numeric', month: 'long', hour: '2-digit', minute: '2-digit' });
+}
+
+/** People to remind for an event: Map userId → user. */
+async function recipientsFor(eventId) {
+  const tickets = await prisma.ticket.findMany({
+    where: { eventId, registrationOption: { registration: { status: { not: 'cancelled' } } } },
+    select: {
+      user: { select: { id: true, name: true, email: true, phoneNumber: true, notificationPreference: true, isActive: true } },
+      holder: { select: { id: true, name: true, email: true, phoneNumber: true, notificationPreference: true, isActive: true } },
+    },
+  });
+  const out = new Map();
+  for (const t of tickets) {
+    for (const u of [t.user, t.holder]) if (u && !out.has(u.id)) out.set(u.id, u);
+  }
+  return out;
+}
+
+async function sendReminder(user, event, session, sessions) {
+  const { sendMail, emailWrapper, ctaButton, getOrg } = require('./email');
+  const { shouldEmail, waText, waTextAny } = require('./notify');
+  const org = getOrg();
+  const label = sessionLabel(session, sessions);
+  const when = fmtWhen(session.startsAt);
+  const where = session.location || event.location || '';
+  const first = (user.name || '').split(' ')[0] || 'there';
+  const url = `${org.url}/events/${event.id}`;
+  const jobs = [];
+  const hasEmail = user.email && !user.email.endsWith('@guest.local') && !user.email.endsWith('@deleted.invalid');
+  if (hasEmail && shouldEmail(user)) {
+    const html = emailWrapper(`
+      <p>Hi ${first},</p>
+      <p>A reminder that <strong>${event.title} — ${label}</strong> is on <strong>${when}</strong>${where ? ` at <strong>${where}</strong>` : ''}.</p>
+      <p>Bring your ticket QR code (it's the same one for every session).</p>
+      ${ctaButton('View event', url)}`, { preheader: `${label} — ${when}` });
+    jobs.push(sendMail({ to: user.email, subject: `Reminder: ${event.title} — ${label}`, html, text: `Reminder: ${event.title} — ${label} is on ${when}${where ? ` at ${where}` : ''}. ${url}` }));
+  }
+  const wa = `⏰ *Reminder*\n\nHi ${first}, *${event.title} — ${label}* is on ${when}${where ? `\n📍 ${where}` : ''}.\n\nBring your ticket QR code — it's the same one for every session.\n${url}`;
+  jobs.push(hasEmail ? waText(user, wa) : waTextAny(user, wa));
+  await Promise.all(jobs);
+}
+
+/**
+ * Sends the reminders that are due. Returns { sessions, sent } counts.
+ */
+async function runSessionReminderJob(now = new Date()) {
+  // (Filtering a Json column on null is awkward in Prisma, so events without reminders
+  // are skipped below instead.)
+  const events = await prisma.event.findMany({
+    where: { scheduleType: 'sessions', isActive: true, endDate: { gte: now } },
+    include: {
+      sessions: {
+        where: { cancelledAt: null, startsAt: { gt: now, lte: new Date(now.getTime() + MAX_OFFSET_MIN * 60 * 1000) } },
+        include: { reminders: true },
+      },
+    },
+  });
+  let sessionsDone = 0;
+  let sent = 0;
+  for (const event of events) {
+    if (!event.sessionReminders || event.sessions.length === 0) continue;
+    const config = event.sessionReminders;
+    const offsets = (config.offsets || []).map(Number).filter(n => n > 0).sort((a, b) => a - b);
+    if (offsets.length === 0) continue;
+    const allSessions = await prisma.eventSession.findMany({ where: { eventId: event.id } });
+    let recipients = null;
+    for (const session of event.sessions) {
+      const minutesLeft = (new Date(session.startsAt) - now) / 60000;
+      const loggedOffsets = new Set(session.reminders.map(r => r.offset));
+      const due = offsets.filter(o => minutesLeft <= o && !loggedOffsets.has(o));
+      if (due.length === 0) continue;
+      // Claim every due offset first (unique per session+offset), so a second server
+      // process running the same job can't send them again.
+      const claimed = [];
+      for (const o of due) {
+        try {
+          await prisma.sessionReminderLog.create({ data: { sessionId: session.id, offset: o } });
+          claimed.push(o);
+        } catch (e) {
+          if (e?.code !== 'P2002') throw e;
+        }
+      }
+      if (!claimed.includes(due[0])) continue; // the closest one was claimed elsewhere
+      recipients = recipients || await recipientsFor(event.id);
+      let count = 0;
+      for (const user of recipients.values()) {
+        try {
+          await sendReminder(user, event, session, activeSessions(allSessions));
+          count += 1;
+        } catch (e) {
+          console.warn('[session reminders] Send failed:', e?.message || e);
+        }
+      }
+      await prisma.sessionReminderLog.update({ where: { sessionId_offset: { sessionId: session.id, offset: due[0] } }, data: { sent: count } });
+      sessionsDone += 1;
+      sent += count;
+    }
+  }
+  return { sessions: sessionsDone, sent };
+}
+
+module.exports = { runSessionReminderJob };

backend/src/utils/sessions.js

@@ -0,0 +1,340 @@
+/**
+ * Multi-day events — one event running on several dates ("sessions"), e.g. every
+ * Wednesday for 5 weeks.
+ *
+ * Rules:
+ * - Event.startDate/endDate always mirror the first active session's start and the last
+ *   active session's end, so everything that only reads those keeps working.
+ * - A cancelled session is kept (it may have check-ins) but is hidden from the schedule
+ *   and left out of totals. A session with check-ins can't be deleted, only cancelled.
+ * - Check-in is once per session. "Whole day" accepts a scan any time on the session's
+ *   date (in the church's timezone); "session only" from 2 h before the start until the end.
+ * - Registration closes when the first session starts, or — with late joining — when
+ *   session N starts. A registration deadline, if set, still wins when it's earlier.
+ * - Late pricing applies to main tickets only, for people registering after the first
+ *   session has started: pro-rata on the sessions left (nearest R10), or a fixed price.
+ */
+
+const prisma = require('../config/db');
+
+const TIMEZONE = process.env.APP_TIMEZONE || 'Africa/Johannesburg';
+const EARLY_CHECK_IN_MS = 2 * 60 * 60 * 1000;
+const MAX_SESSIONS = 200;
+const REMINDER_OFFSETS = [60, 180, 1440]; // minutes before start: 1 h, 3 h, 1 day
+const CERTIFICATE_TEMPLATES = ['classic', 'modern', 'church', 'kids'];
+
+function sessionError(message, statusCode = 400) {
+  const err = new Error(message);
+  err.statusCode = statusCode;
+  return err;
+}
+
+// ─── Pure helpers ─────────────────────────────────────────────────────────────
+
+/** 'YYYY-MM-DD' of a moment in the church's timezone. */
+function dayKey(date, timeZone = TIMEZONE) {
+  return new Intl.DateTimeFormat('en-CA', { timeZone, year: 'numeric', month: '2-digit', day: '2-digit' }).format(new Date(date));
+}
+
+/** Sessions that aren't cancelled, earliest first. */
+function activeSessions(sessions) {
+  return (sessions || [])
+    .filter(s => !s.cancelledAt)
+    .sort((a, b) => new Date(a.startsAt) - new Date(b.startsAt));
+}
+
+/** { startDate, endDate } covering the active sessions, or null when there are none. */
+function scheduleBounds(sessions) {
+  const active = activeSessions(sessions);
+  if (active.length === 0) return null;
+  const endDate = active.reduce((max, s) => (new Date(s.endsAt) > max ? new Date(s.endsAt) : max), new Date(active[0].endsAt));
+  return { startDate: new Date(active[0].startsAt), endDate };
+}
+
+/**
+ * Checks and tidies the sessions sent by the event editor.
+ * Each: { id?, label?, startsAt, endsAt, location?, cancelled? }.
+ */
+function normalizeSessionsInput(list) {
+  if (!Array.isArray(list)) throw sessionError('Sessions must be a list');
+  if (list.length > MAX_SESSIONS) throw sessionError(`An event can have at most ${MAX_SESSIONS} sessions`);
+  const out = list.map((s, i) => {
+    const startsAt = new Date(s?.startsAt);
+    const endsAt = new Date(s?.endsAt);
+    if (isNaN(startsAt) || isNaN(endsAt)) throw sessionError(`Session ${i + 1} needs a start and end date`);
+    if (endsAt <= startsAt) throw sessionError(`Session ${i + 1} must end after it starts`);
+    return {
+      id: s.id ? String(s.id) : null,
+      label: s.label ? String(s.label).trim().slice(0, 120) || null : null,
+      startsAt,
+      endsAt,
+      location: s.location ? String(s.location).trim().slice(0, 300) || null : null,
+      cancelled: s.cancelled === true,
+    };
+  });
+  out.sort((a, b) => a.startsAt - b.startsAt);
+  if (!out.some(s => !s.cancelled)) throw sessionError('A multi-session event needs at least one session that isn\'t cancelled');
+  return out;
+}
+
+/** Whether a check-in for `session` is allowed at `now`. */
+function sessionAcceptsCheckIn(session, now = new Date(), window = 'whole_day') {
+  if (!session || session.cancelledAt) return false;
+  const t = new Date(now);
+  if (window === 'session_only') {
+    return t >= new Date(new Date(session.startsAt).getTime() - EARLY_CHECK_IN_MS) && t <= new Date(session.endsAt);
+  }
+  const today = dayKey(t);
+  return today >= dayKey(session.startsAt) && today <= dayKey(session.endsAt);
+}
+
+/**
+ * The session a scan at `now` counts for, or null. On a day with more than one session:
+ * the one happening now (from 2 h before), else the next one today, else the last one.
+ */
+function currentSession(sessions, now = new Date(), window = 'whole_day') {
+  const t = new Date(now);
+  const open = activeSessions(sessions).filter(s => sessionAcceptsCheckIn(s, t, window));
+  if (open.length <= 1) return open[0] || null;
+  const running = open.find(s => t >= new Date(new Date(s.startsAt).getTime() - EARLY_CHECK_IN_MS) && t <= new Date(s.endsAt));
+  if (running) return running;
+  return open.find(s => new Date(s.startsAt) > t) || open[open.length - 1];
+}
+
+/** When public registration closes for an event (Date). */
+function registrationClosesAt(event, sessions) {
+  const deadline = event.registrationDeadline ? new Date(event.registrationDeadline) : null;
+  let closes = new Date(event.endDate);
+  if (event.scheduleType === 'sessions') {
+    const active = activeSessions(sessions);
+    if (active.length > 0) {
+      const until = event.lateJoinEnabled ? active.find(s => s.id === event.lateJoinUntilSessionId) : null;
+      closes = new Date((until || active[0]).startsAt);
+    }
+  }
+  return deadline && deadline < closes ? deadline : closes;
+}
+
+/**
+ * Late-joiner pricing state at `now`: active once the first session has started (for
+ * events with late joining and a late price). sessionsLeft counts sessions not yet started.
+ */
+function lateInfo(event, sessions, now = new Date()) {
+  const active = activeSessions(sessions);
+  const base = { active: false, mode: event.latePricing || 'full', sessionsLeft: active.length, totalSessions: active.length, fixedPrice: event.lateFixedPrice ?? null };
+  if (event.scheduleType !== 'sessions' || !event.lateJoinEnabled || active.length === 0) return base;
+  const t = new Date(now);
+  const sessionsLeft = active.filter(s => new Date(s.startsAt) > t).length;
+  const started = t >= new Date(active[0].startsAt);
+  const priced = base.mode === 'prorata' || (base.mode === 'fixed' && base.fixedPrice !== null);
+  return { ...base, sessionsLeft, active: started && priced };
+}
+
+/** A main ticket's price for a late joiner. Never more than the normal price. */
+function latePrice(price, info) {
+  if (!info || !info.active || !(price > 0)) return price;
+  if (info.mode === 'fixed') return Math.min(price, Math.max(0, Number(info.fixedPrice)));
+  if (info.mode === 'prorata') {
+    if (!info.totalSessions) return price;
+    const rounded = Math.round((price * info.sessionsLeft / info.totalSessions) / 10) * 10;
+    return Math.min(price, Math.max(10, rounded));
+  }
+  return price;
+}
+
+/** Whether `attended` of `total` sessions meets a certificate completion rule. */
+function completionMet(rule, attended, total) {
+  if (total <= 0 || attended <= 0) return false;
+  const type = rule?.type || 'all';
+  const value = Number(rule?.value) || 0;
+  if (type === 'count') return attended >= Math.min(Math.max(1, value), total);
+  if (type === 'percent') return attended / total * 100 >= Math.min(Math.max(1, value), 100) - 1e-9;
+  return attended >= total;
+}
+
+/** Cleans the reminder settings from the editor; null = off. */
+function normalizeReminders(input) {
+  if (!input || input.enabled === false) return null;
+  const offsets = [...new Set((input.offsets || []).map(Number).filter(n => REMINDER_OFFSETS.includes(n)))].sort((a, b) => b - a);
+  const channels = [...new Set((input.channels || []).filter(c => ['email', 'whatsapp'].includes(c)))];
+  if (offsets.length === 0 || channels.length === 0) return null;
+  return { offsets, channels };
+}
+
+/** Cleans the certificate settings from the editor. */
+function normalizeCertificateConfig(input) {
+  const c = input && typeof input === 'object' ? input : {};
+  const ruleType = ['all', 'count', 'percent'].includes(c.rule?.type) ? c.rule.type : 'all';
+  const str = (v, max) => (v ? String(v).trim().slice(0, max) : '');
+  return {
+    template: CERTIFICATE_TEMPLATES.includes(c.template) ? c.template : 'classic',
+    title: str(c.title, 120) || 'Certificate of Completion',
+    body: str(c.body, 1000) || 'This certifies that {name} has completed {event}, attending {sessionsAttended} of {totalSessions} sessions.',
+    signatureName: str(c.signatureName, 120),
+    signatureRole: str(c.signatureRole, 120),
+    signatureImage: str(c.signatureImage, 500),
+    rule: { type: ruleType, value: ruleType === 'all' ? null : Math.max(1, parseInt(c.rule?.value, 10) || 1) },
+    sendOnIssue: c.sendOnIssue === true,
+  };
+}
+
+// ─── Database helpers ─────────────────────────────────────────────────────────
+
+/**
+ * Saves the editor's session list for an event: updates rows it kept, creates new ones,
+ * deletes rows it dropped (refused when they have check-ins — cancel those instead), and
+ * moves Event.startDate/endDate to match. Run inside a transaction (`tx`).
+ * @returns {Promise<{ sessions, changes: { added, moved, cancelled, restored, removed } }>}
+ */
+async function syncEventSessions(tx, eventId, input) {
+  const wanted = normalizeSessionsInput(input);
+  const existing = await tx.eventSession.findMany({ where: { eventId }, include: { _count: { select: { usages: true } } } });
+  const byId = new Map(existing.map(s => [s.id, s]));
+  const changes = { added: 0, moved: 0, cancelled: 0, restored: 0, removed: 0 };
+
+  const keep = new Set(wanted.filter(w => w.id && byId.has(w.id)).map(w => w.id));
+  for (const s of existing) {
+    if (keep.has(s.id)) continue;
+    if (s._count.usages > 0) {
+      throw sessionError(`"${s.label || dayKey(s.startsAt)}" already has check-ins, so it can't be removed. Cancel it instead.`);
+    }
+    await tx.eventSession.delete({ where: { id: s.id } });
+    changes.removed += 1;
+  }
+
+  for (let i = 0; i < wanted.length; i++) {
+    const w = wanted[i];
+    const data = { label: w.label, startsAt: w.startsAt, endsAt: w.endsAt, location: w.location, order: i };
+    const old = w.id ? byId.get(w.id) : null;
+    if (old) {
+      const cancelledAt = w.cancelled ? (old.cancelledAt || new Date()) : null;
+      if (+old.startsAt !== +w.startsAt || +old.endsAt !== +w.endsAt) changes.moved += 1;
+      if (!old.cancelledAt && cancelledAt) changes.cancelled += 1;
+      if (old.cancelledAt && !cancelledAt) changes.restored += 1;
+      await tx.eventSession.update({ where: { id: old.id }, data: { ...data, cancelledAt } });
+    } else {
+      await tx.eventSession.create({ data: { ...data, eventId, cancelledAt: w.cancelled ? new Date() : null } });
+      changes.added += 1;
+    }
+  }
+
+  const sessions = await tx.eventSession.findMany({ where: { eventId }, orderBy: { startsAt: 'asc' } });
+  const bounds = scheduleBounds(sessions);
+  await tx.event.update({ where: { id: eventId }, data: { startDate: bounds.startDate, endDate: bounds.endDate } });
+  return { sessions, changes };
+}
+
+const SCHEDULE_SELECT = {
+  id: true, endDate: true, registrationDeadline: true, scheduleType: true, checkInWindow: true,
+  lateJoinEnabled: true, lateJoinUntilSessionId: true, latePricing: true, lateFixedPrice: true,
+  sessions: { orderBy: { startsAt: 'asc' } },
+};
+
+// Late pricing is looked up while pricing every option line, so keep each event's
+// schedule for a few seconds rather than querying it per line.
+const scheduleCache = new Map();
+const SCHEDULE_TTL_MS = 5000;
+
+async function eventSchedule(eventId) {
+  const hit = scheduleCache.get(eventId);
+  if (hit && hit.expires > Date.now()) return hit.value;
+  const value = await prisma.event.findUnique({ where: { id: eventId }, select: SCHEDULE_SELECT });
+  scheduleCache.set(eventId, { value, expires: Date.now() + SCHEDULE_TTL_MS });
+  if (scheduleCache.size > 500) scheduleCache.delete(scheduleCache.keys().next().value);
+  return value;
+}
+
+function forgetSchedule(eventId) {
+  scheduleCache.delete(eventId);
+}
+
+/** Label for a session in messages: its own label, else "Session N" by position. */
+function sessionLabel(session, sessions) {
+  if (session.label) return session.label;
+  const idx = activeSessions(sessions).findIndex(s => s.id === session.id);
+  return `Session ${idx >= 0 ? idx + 1 : ''}`.trim();
+}
+
+/**
+ * Which session a scan on a multi-session event counts for. `requestedId` is the session
+ * the scanner picked (optional — defaults to today's). Returns { session, error } with
+ * session null and an error message when check-in isn't possible now.
+ */
+function scanSession(event, sessions, requestedId = null, now = new Date()) {
+  const window = event.checkInWindow || 'whole_day';
+  if (requestedId) {
+    const session = (sessions || []).find(s => s.id === requestedId);
+    if (!session) return { session: null, error: 'That session isn\'t part of this event' };
+    if (session.cancelledAt) return { session: null, error: `${sessionLabel(session, sessions)} was cancelled` };
+    if (!sessionAcceptsCheckIn(session, now, window)) {
+      return { session: null, error: `Check-in for ${sessionLabel(session, sessions)} is only open ${window === 'session_only' ? 'from 2 hours before it starts until it ends' : 'on the day of the session'}` };
+    }
+    return { session, error: null };
+  }
+  const session = currentSession(sessions, now, window);
+  if (!session) {
+    const next = activeSessions(sessions).find(s => new Date(s.startsAt) > new Date(now));
+    return { session: null, error: next ? `No session today — the next one is ${sessionLabel(next, sessions)} on ${dayKey(next.startsAt)}` : 'All sessions of this event are over' };
+  }
+  return { session, error: null };
+}
+
+/**
+ * How a ticket shows an event's date. Multi-day events: "5 sessions · 04 Nov – 02 Dec"
+ * (short) or "Wednesday 4 November 2026 (first of 5 sessions — one ticket for all)" (long).
+ * Returns null for single-date events (callers keep their own date format).
+ */
+function ticketDateText(event, style = 'short') {
+  if (event?.scheduleType !== 'sessions') return null;
+  const active = activeSessions(event.sessions);
+  if (active.length === 0) return null;
+  const fmt = (d, opts) => new Date(d).toLocaleDateString('en-GB', { timeZone: TIMEZONE, ...opts });
+  if (style === 'long') {
+    const first = fmt(active[0].startsAt, { weekday: 'long', day: 'numeric', month: 'long', year: 'numeric' });
+    return active.length === 1 ? first : `${first} (first of ${active.length} sessions — one ticket for all)`;
+  }
+  const short = { day: '2-digit', month: 'short' };
+  return active.length === 1
+    ? fmt(active[0].startsAt, { day: '2-digit', month: 'long', year: 'numeric' })
+    : `${active.length} sessions · ${fmt(active[0].startsAt, short)} – ${fmt(active[active.length - 1].startsAt, short)}`;
+}
+
+/** Places already checked in for one session, from a ticket's usages. */
+function redeemedForSession(usages, sessionId) {
+  return (usages || []).filter(u => u.sessionId === sessionId).reduce((sum, u) => sum + (u.quantityRedeemed || 1), 0);
+}
+
+/** Applies late pricing to a resolved option price ({ price, tierId }). */
+async function withLatePrice(option, resolved) {
+  if (!option?.isMainTicket || !option.eventId || !(resolved.price > 0)) return resolved;
+  const event = await eventSchedule(option.eventId);
+  if (!event || event.scheduleType !== 'sessions') return resolved;
+  const price = latePrice(resolved.price, lateInfo(event, event.sessions));
+  return price === resolved.price ? resolved : { ...resolved, price };
+}
+
+/**
+ * Check-ins per ticket per session for an event: Map ticketId → Map sessionId → qty.
+ * Cancelled sessions are included; callers drop them when counting.
+ */
+async function attendanceBySession(eventId) {
+  const usages = await prisma.ticketUsage.findMany({
+    where: { ticket: { eventId }, sessionId: { not: null } },
+    select: { ticketId: true, sessionId: true, quantityRedeemed: true },
+  });
+  const out = new Map();
+  for (const u of usages) {
+    if (!out.has(u.ticketId)) out.set(u.ticketId, new Map());
+    const m = out.get(u.ticketId);
+    m.set(u.sessionId, (m.get(u.sessionId) || 0) + (u.quantityRedeemed || 1));
+  }
+  return out;
+}
+
+module.exports = {
+  TIMEZONE, MAX_SESSIONS, REMINDER_OFFSETS, CERTIFICATE_TEMPLATES, sessionError,
+  dayKey, activeSessions, scheduleBounds, normalizeSessionsInput, sessionAcceptsCheckIn, currentSession,
+  sessionLabel, scanSession, redeemedForSession, ticketDateText,
+  registrationClosesAt, lateInfo, latePrice, completionMet, normalizeReminders, normalizeCertificateConfig,
+  syncEventSessions, eventSchedule, forgetSchedule, withLatePrice, attendanceBySession,
+};

backend/tests/bundles.test.js

@@ -96,6 +96,92 @@ describe('applyBundles', () => {
   });
 });
 
+describe('pick any (mix)', () => {
+  const anyFour = { id: 'm', name: 'Any 4', kind: 'mix', price: 250, setSize: 4, items: [{ eventOptionId: 'adult' }, { eventOptionId: 'child' }] };
+
+  test('2 adults + 2 children or 4 adults both make a set', () => {
+    expect(applyBundles([anyFour], [line('adult', 2, 80), line('child', 2, 50)]).discount).toBe(10);
+    expect(applyBundles([anyFour], [line('adult', 4, 80)]).discount).toBe(70);
+  });
+
+  test('repeats, dearest tickets first, leftovers at full price', () => {
+    const r = applyBundles([anyFour], [line('adult', 5, 80), line('child', 4, 50)]);
+    // Set 1: 4 adults (320 → 250). Set 2: 1 adult + 3 children (230): no saving, so not applied.
+    expect(r.applications[0].count).toBe(1);
+    expect(r.discount).toBe(70);
+    expect(charged(r.lines)).toBeCloseTo(250 + 80 + 200, 6);
+  });
+
+  test('non-qualifying tickets are left alone', () => {
+    const r = applyBundles([anyFour], [line('adult', 2, 80), line('lunch', 5, 65)]);
+    expect(r.discount).toBe(0);
+  });
+});
+
+describe('buy X get Y free', () => {
+  const b3g1 = { id: 'f', name: 'Buy 3 get 1', kind: 'free', price: 0, setSize: 4, freeCount: 1, items: [{ eventOptionId: 'adult' }, { eventOptionId: 'child' }] };
+
+  test('the cheapest ticket in the set is free', () => {
+    const r = applyBundles([b3g1], [line('adult', 3, 80), line('child', 1, 50)]);
+    expect(r.discount).toBe(50);
+    expect(r.lines.find(l => l.unitPrice === 0)).toMatchObject({ eventOptionId: 'child', quantity: 1, bundled: true });
+  });
+
+  test('8 tickets make two sets', () => {
+    const r = applyBundles([b3g1], [line('adult', 8, 80)]);
+    expect(r.applications[0].count).toBe(2);
+    expect(r.discount).toBe(160);
+  });
+
+  test('three tickets get nothing', () => {
+    expect(applyBundles([b3g1], [line('adult', 3, 80)]).discount).toBe(0);
+  });
+
+  test('a free count that is not below the set size is ignored', () => {
+    expect(applyBundles([{ ...b3g1, freeCount: 4 }], [line('adult', 8, 80)]).discount).toBe(0);
+  });
+});
+
+describe('group discount', () => {
+  const tenPlus = { id: 'g', name: 'Groups', kind: 'group', price: 70, setSize: 10, groupPricing: 'per_ticket', items: [{ eventOptionId: 'adult' }, { eventOptionId: 'child' }] };
+
+  test('10+ qualifying tickets all get the group price, once, never dearer', () => {
+    const r = applyBundles([tenPlus], [line('adult', 8, 80), line('child', 4, 50)]);
+    // Adults 80 → 70 (8 × 10 = 80 saved); children already cheaper, unchanged.
+    expect(r.discount).toBe(80);
+    expect(r.applications).toEqual([{ bundleId: 'g', name: 'Groups', count: 1, discount: 80 }]);
+    expect(charged(r.lines)).toBeCloseTo(8 * 70 + 4 * 50, 6);
+  });
+
+  test('below the minimum: nothing', () => {
+    expect(applyBundles([tenPlus], [line('adult', 9, 80)]).discount).toBe(0);
+  });
+
+  test('percentage off everything in the group', () => {
+    const pct = { ...tenPlus, groupPricing: 'percent', price: 10 };
+    expect(applyBundles([pct], [line('adult', 10, 80), line('child', 2, 50)]).discount).toBe(90);
+  });
+
+  test('an exact bundle beats a group discount when it saves more', () => {
+    const r = applyBundles([family, tenPlus], [line('adult', 5, 80), line('child', 5, 50)]);
+    // Group: 5 × 10 = 50 saved. Family: 50 saved on 5A+3C, then group can't reach 10 again.
+    // Equal savings: the first found wins, either way the total is 50.
+    expect(r.discount).toBe(50);
+  });
+});
+
+describe('describeBundle', () => {
+  const { describeBundle } = require('../src/utils/bundles');
+  const names = [{ eventOptionId: 'a', quantity: 2, eventOption: { name: 'Adult' } }, { eventOptionId: 'c', quantity: 3, eventOption: { name: 'Child' } }];
+  test('one line per kind', () => {
+    expect(describeBundle({ kind: 'exact', price: 220, items: names })).toBe('2 × Adult + 3 × Child for R220');
+    expect(describeBundle({ kind: 'mix', price: 250, setSize: 4, items: names })).toBe('Any 4 of Adult, Child for R250');
+    expect(describeBundle({ kind: 'free', setSize: 4, freeCount: 1, items: names })).toBe('Buy 3, get 1 free: Adult, Child');
+    expect(describeBundle({ kind: 'group', price: 70, setSize: 10, groupPricing: 'per_ticket', items: names })).toBe('10+ tickets (Adult, Child): R70 each');
+    expect(describeBundle({ kind: 'group', price: 15, setSize: 10, groupPricing: 'percent', items: names })).toBe('10+ tickets (Adult, Child): 15% off');
+  });
+});
+
 describe('isBundleAvailable', () => {
   const now = new Date('2026-06-01T10:00:00Z');
   test('switched off, not started, ended and empty bundles are not available', () => {

backend/tests/jobs.test.js

@@ -0,0 +1,54 @@
+const { JOBS, isEnabled, cronFor, nextRun, isNoop } = require('../src/jobs');
+
+const job = (name) => JOBS.find(j => j.name === name);
+
+describe('job registry', () => {
+  const saved = { ...process.env };
+  afterEach(() => { process.env = { ...saved }; });
+
+  test('every job has a valid cron schedule and a unique name', () => {
+    const names = new Set();
+    for (const j of JOBS) {
+      expect(names.has(j.name)).toBe(false);
+      names.add(j.name);
+      expect(() => nextRun(j.cron)).not.toThrow();
+    }
+  });
+
+  test('a job is on unless its own flag or JOBS_ENABLED is false', () => {
+    delete process.env.WAITLIST_JOB_ENABLED;
+    delete process.env.JOBS_ENABLED;
+    expect(isEnabled(job('waitlist'))).toBe(true);
+    process.env.WAITLIST_JOB_ENABLED = 'false';
+    expect(isEnabled(job('waitlist'))).toBe(false);
+    process.env.WAITLIST_JOB_ENABLED = 'true';
+    process.env.JOBS_ENABLED = 'false';
+    expect(isEnabled(job('waitlist'))).toBe(false);
+    expect(isEnabled(job('temp-cleanup'))).toBe(false);
+  });
+
+  test('JOB_SCHEDULE_<NAME> overrides the schedule; an invalid one is ignored', () => {
+    process.env.JOB_SCHEDULE_ANALYTICS_ROLLUP = '30 5 * * *';
+    expect(cronFor(job('analytics-rollup'))).toBe('30 5 * * *');
+    process.env.JOB_SCHEDULE_ANALYTICS_ROLLUP = 'every tuesday';
+    const warn = jest.spyOn(console, 'warn').mockImplementation(() => {});
+    expect(cronFor(job('analytics-rollup'))).toBe(job('analytics-rollup').cron);
+    warn.mockRestore();
+  });
+
+  test('daily jobs fire at local (Johannesburg) time', () => {
+    // 07:00 SAST = 05:00 UTC
+    const next = nextRun('0 7 * * *', new Date('2026-11-04T06:00:00Z'));
+    expect(next.toISOString()).toBe('2026-11-05T05:00:00.000Z');
+    expect(nextRun('0 7 * * *', new Date('2026-11-04T04:00:00Z')).toISOString()).toBe('2026-11-04T05:00:00.000Z');
+  });
+
+  test('isNoop: quiet when nothing happened', () => {
+    expect(isNoop({ expired: 0, offers: 0 })).toBe(true);
+    expect(isNoop({ reminders: { sessions: 0, sent: 0 }, certificates: { issued: 0, sent: 0 } })).toBe(true);
+    expect(isNoop({ deleted: 0, errors: 0 })).toBe(true);
+    expect(isNoop(null)).toBe(true);
+    expect(isNoop({ sent: 3 })).toBe(false);
+    expect(isNoop({ file: 'backup.sql.gz' })).toBe(false);
+  });
+});

backend/tests/sessions.test.js

@@ -0,0 +1,270 @@
+const {
+  dayKey,
+  activeSessions,
+  scheduleBounds,
+  normalizeSessionsInput,
+  sessionAcceptsCheckIn,
+  currentSession,
+  registrationClosesAt,
+  lateInfo,
+  latePrice,
+  completionMet,
+  normalizeReminders,
+  normalizeCertificateConfig,
+  scanSession,
+  redeemedForSession,
+  sessionLabel,
+} = require('../src/utils/sessions');
+
+// Africa/Johannesburg is UTC+2 all year, so 16:30Z is 18:30 local.
+const wed = (day, h = 16, m = 30) => new Date(Date.UTC(2026, 10, day, h, m)); // November 2026
+const session = (id, day, extra = {}) => ({ id, startsAt: wed(day), endsAt: wed(day, 18, 30), cancelledAt: null, ...extra });
+// Five Wednesdays: 4, 11, 18, 25 Nov and 2 Dec (as day 32 → Date.UTC rolls over).
+const COURSE = [session('s1', 4), session('s2', 11), session('s3', 18), session('s4', 25), session('s5', 32)];
+
+describe('dayKey', () => {
+  test('uses the church timezone, not UTC', () => {
+    expect(dayKey(new Date('2026-11-04T23:30:00Z'))).toBe('2026-11-05'); // 01:30 local next day
+    expect(dayKey(new Date('2026-11-04T21:59:00Z'))).toBe('2026-11-04');
+  });
+});
+
+describe('activeSessions / scheduleBounds', () => {
+  test('drops cancelled sessions and sorts by start', () => {
+    const list = [session('b', 11), session('a', 4), session('c', 18, { cancelledAt: new Date() })];
+    expect(activeSessions(list).map(s => s.id)).toEqual(['a', 'b']);
+  });
+
+  test('bounds run from the first start to the last end', () => {
+    const b = scheduleBounds(COURSE);
+    expect(b.startDate).toEqual(wed(4));
+    expect(b.endDate).toEqual(wed(32, 18, 30));
+  });
+
+  test('a cancelled last session moves the end date back', () => {
+    const list = [...COURSE.slice(0, 4), { ...COURSE[4], cancelledAt: new Date() }];
+    expect(scheduleBounds(list).endDate).toEqual(wed(25, 18, 30));
+  });
+
+  test('no active sessions → null', () => {
+    expect(scheduleBounds([session('a', 4, { cancelledAt: new Date() })])).toBeNull();
+  });
+});
+
+describe('normalizeSessionsInput', () => {
+  test('sorts sessions and trims labels', () => {
+    const out = normalizeSessionsInput([
+      { startsAt: wed(11), endsAt: wed(11, 18), label: '  Week 2 ' },
+      { startsAt: wed(4), endsAt: wed(4, 18) },
+    ]);
+    expect(out.map(s => s.label)).toEqual([null, 'Week 2']);
+  });
+
+  test('rejects a session that ends before it starts', () => {
+    expect(() => normalizeSessionsInput([{ startsAt: wed(4, 18), endsAt: wed(4, 16) }])).toThrow(/must end after/);
+  });
+
+  test('rejects missing dates', () => {
+    expect(() => normalizeSessionsInput([{ startsAt: 'nope', endsAt: wed(4) }])).toThrow(/start and end/);
+  });
+
+  test('needs at least one session that is not cancelled', () => {
+    expect(() => normalizeSessionsInput([{ startsAt: wed(4), endsAt: wed(4, 18), cancelled: true }])).toThrow(/at least one/);
+    expect(() => normalizeSessionsInput([])).toThrow(/at least one/);
+  });
+});
+
+describe('check-in window', () => {
+  const s = session('s1', 4); // 18:30–20:30 local on 4 Nov
+
+  test('whole day accepts any time on the session date (local)', () => {
+    expect(sessionAcceptsCheckIn(s, new Date('2026-11-04T05:00:00Z'), 'whole_day')).toBe(true); // 07:00 local
+    expect(sessionAcceptsCheckIn(s, new Date('2026-11-04T21:30:00Z'), 'whole_day')).toBe(true); // 23:30 local
+    expect(sessionAcceptsCheckIn(s, new Date('2026-11-04T22:30:00Z'), 'whole_day')).toBe(false); // 00:30 next day
+  });
+
+  test('session only accepts from 2 h before start until the end', () => {
+    expect(sessionAcceptsCheckIn(s, new Date('2026-11-04T14:29:00Z'), 'session_only')).toBe(false);
+    expect(sessionAcceptsCheckIn(s, new Date('2026-11-04T14:30:00Z'), 'session_only')).toBe(true);
+    expect(sessionAcceptsCheckIn(s, new Date('2026-11-04T18:30:00Z'), 'session_only')).toBe(true);
+    expect(sessionAcceptsCheckIn(s, new Date('2026-11-04T18:31:00Z'), 'session_only')).toBe(false);
+  });
+
+  test('cancelled sessions never accept check-ins', () => {
+    expect(sessionAcceptsCheckIn({ ...s, cancelledAt: new Date() }, wed(4), 'whole_day')).toBe(false);
+  });
+});
+
+describe('currentSession', () => {
+  test('finds today\'s session', () => {
+    expect(currentSession(COURSE, new Date('2026-11-11T08:00:00Z')).id).toBe('s2');
+  });
+
+  test('null on a day without a session', () => {
+    expect(currentSession(COURSE, new Date('2026-11-12T08:00:00Z'))).toBeNull();
+  });
+
+  test('with two sessions in a day, picks the running one, else the next, else the last', () => {
+    const day = [
+      { id: 'am', startsAt: new Date('2026-11-07T07:00:00Z'), endsAt: new Date('2026-11-07T10:00:00Z'), cancelledAt: null },
+      { id: 'pm', startsAt: new Date('2026-11-07T14:00:00Z'), endsAt: new Date('2026-11-07T17:00:00Z'), cancelledAt: null },
+    ];
+    expect(currentSession(day, new Date('2026-11-07T08:00:00Z')).id).toBe('am');
+    expect(currentSession(day, new Date('2026-11-07T11:00:00Z')).id).toBe('pm'); // between: next one
+    expect(currentSession(day, new Date('2026-11-07T13:00:00Z')).id).toBe('pm'); // within 2 h of pm
+    expect(currentSession(day, new Date('2026-11-07T19:00:00Z')).id).toBe('pm'); // after both: last
+    expect(currentSession(day, new Date('2026-11-07T04:00:00Z')).id).toBe('am'); // before both: next
+  });
+});
+
+describe('registrationClosesAt', () => {
+  const base = { scheduleType: 'sessions', endDate: wed(32, 18, 30), registrationDeadline: null, lateJoinEnabled: false, lateJoinUntilSessionId: null };
+
+  test('single-date events close at the end date', () => {
+    expect(registrationClosesAt({ ...base, scheduleType: 'single' }, [])).toEqual(wed(32, 18, 30));
+  });
+
+  test('without late joining, closes when the first session starts', () => {
+    expect(registrationClosesAt(base, COURSE)).toEqual(wed(4));
+  });
+
+  test('with late joining, closes when the chosen session starts', () => {
+    expect(registrationClosesAt({ ...base, lateJoinEnabled: true, lateJoinUntilSessionId: 's3' }, COURSE)).toEqual(wed(18));
+  });
+
+  test('an earlier registration deadline wins', () => {
+    const deadline = new Date('2026-11-01T00:00:00Z');
+    expect(registrationClosesAt({ ...base, lateJoinEnabled: true, lateJoinUntilSessionId: 's3', registrationDeadline: deadline }, COURSE)).toEqual(deadline);
+  });
+
+  test('a cancelled "until" session falls back to the first session', () => {
+    const list = COURSE.map(s => (s.id === 's3' ? { ...s, cancelledAt: new Date() } : s));
+    expect(registrationClosesAt({ ...base, lateJoinEnabled: true, lateJoinUntilSessionId: 's3' }, list)).toEqual(wed(4));
+  });
+});
+
+describe('late pricing', () => {
+  const event = { scheduleType: 'sessions', lateJoinEnabled: true, latePricing: 'prorata', lateFixedPrice: null };
+
+  test('not active before the first session starts', () => {
+    expect(lateInfo(event, COURSE, wed(3)).active).toBe(false);
+  });
+
+  test('pro-rata on sessions not yet started, rounded to the nearest R10', () => {
+    const info = lateInfo(event, COURSE, wed(5)); // session 1 done → 4 of 5 left
+    expect(info).toMatchObject({ active: true, sessionsLeft: 4, totalSessions: 5 });
+    expect(latePrice(300, info)).toBe(240);
+    expect(latePrice(229, info)).toBe(180); // 183.2 → 180
+    expect(latePrice(232, info)).toBe(190); // 185.6 → 190
+  });
+
+  test('pro-rata never goes below R10 or above the normal price', () => {
+    const info = lateInfo(event, COURSE, wed(26)); // 1 of 5 left
+    expect(latePrice(15, info)).toBe(10); // 3 → 0 → at least R10
+    expect(latePrice(8, info)).toBe(8); // under R10 already: unchanged
+    expect(latePrice(0, info)).toBe(0);
+  });
+
+  test('a session in progress counts as started', () => {
+    const info = lateInfo(event, COURSE, new Date(wed(11).getTime() + 60_000));
+    expect(info.sessionsLeft).toBe(3);
+  });
+
+  test('fixed late price only ever lowers the price', () => {
+    const info = lateInfo({ ...event, latePricing: 'fixed', lateFixedPrice: 150 }, COURSE, wed(12));
+    expect(latePrice(300, info)).toBe(150);
+    expect(latePrice(100, info)).toBe(100);
+  });
+
+  test('full price, late joining off, or a fixed price without an amount → no change', () => {
+    expect(lateInfo({ ...event, latePricing: 'full' }, COURSE, wed(12)).active).toBe(false);
+    expect(lateInfo({ ...event, lateJoinEnabled: false }, COURSE, wed(12)).active).toBe(false);
+    expect(lateInfo({ ...event, latePricing: 'fixed', lateFixedPrice: null }, COURSE, wed(12)).active).toBe(false);
+    expect(latePrice(300, { active: false })).toBe(300);
+  });
+});
+
+describe('completionMet', () => {
+  test('all sessions (default)', () => {
+    expect(completionMet(undefined, 5, 5)).toBe(true);
+    expect(completionMet({ type: 'all' }, 4, 5)).toBe(false);
+  });
+
+  test('at least N sessions, capped at the total', () => {
+    expect(completionMet({ type: 'count', value: 4 }, 4, 5)).toBe(true);
+    expect(completionMet({ type: 'count', value: 4 }, 3, 5)).toBe(false);
+    expect(completionMet({ type: 'count', value: 10 }, 3, 3)).toBe(true);
+  });
+
+  test('at least N percent', () => {
+    expect(completionMet({ type: 'percent', value: 80 }, 4, 5)).toBe(true);
+    expect(completionMet({ type: 'percent', value: 80 }, 3, 5)).toBe(false);
+    expect(completionMet({ type: 'percent', value: 66 }, 2, 3)).toBe(true);
+  });
+
+  test('nobody completes without attending', () => {
+    expect(completionMet({ type: 'count', value: 1 }, 0, 5)).toBe(false);
+    expect(completionMet(undefined, 0, 0)).toBe(false);
+  });
+});
+
+describe('settings cleaning', () => {
+  test('reminders: off unless an offset and a channel are chosen', () => {
+    expect(normalizeReminders(null)).toBeNull();
+    expect(normalizeReminders({ offsets: [180], channels: [] })).toBeNull();
+    expect(normalizeReminders({ offsets: [180, 999, 1440], channels: ['email', 'sms'] })).toEqual({ offsets: [1440, 180], channels: ['email'] });
+  });
+
+  test('certificates: unknown template falls back to classic, rule is tidied', () => {
+    const c = normalizeCertificateConfig({ template: 'fancy', rule: { type: 'count', value: '3' } });
+    expect(c.template).toBe('classic');
+    expect(c.rule).toEqual({ type: 'count', value: 3 });
+    expect(c.title).toBe('Certificate of Completion');
+    expect(normalizeCertificateConfig({ rule: { type: 'all', value: 4 } }).rule).toEqual({ type: 'all', value: null });
+  });
+});
+
+describe('scanSession', () => {
+  const event = { checkInWindow: 'whole_day' };
+
+  test("defaults to today's session", () => {
+    expect(scanSession(event, COURSE, null, new Date('2026-11-18T09:00:00Z')).session.id).toBe('s3');
+  });
+
+  test('no session today: says when the next one is', () => {
+    const r = scanSession(event, COURSE, null, new Date('2026-11-12T09:00:00Z'));
+    expect(r.session).toBeNull();
+    expect(r.error).toMatch(/next one is Session 3 on 2026-11-18/);
+  });
+
+  test('after the last session: all over', () => {
+    expect(scanSession(event, COURSE, null, new Date('2026-12-10T09:00:00Z')).error).toMatch(/over/);
+  });
+
+  test('a picked session must be open now', () => {
+    expect(scanSession(event, COURSE, 's3', new Date('2026-11-18T09:00:00Z')).session.id).toBe('s3');
+    expect(scanSession(event, COURSE, 's4', new Date('2026-11-18T09:00:00Z')).error).toMatch(/only open on the day/);
+    expect(scanSession({ checkInWindow: 'session_only' }, COURSE, 's3', new Date('2026-11-18T09:00:00Z')).error).toMatch(/2 hours before/);
+  });
+
+  test('a cancelled or unknown session is refused', () => {
+    const list = COURSE.map(s => (s.id === 's3' ? { ...s, cancelledAt: new Date() } : s));
+    expect(scanSession(event, list, 's3', new Date('2026-11-18T09:00:00Z')).error).toMatch(/cancelled/);
+    expect(scanSession(event, COURSE, 'nope').error).toMatch(/isn't part/);
+  });
+});
+
+describe('redeemedForSession / sessionLabel', () => {
+  test("counts only that session's check-ins", () => {
+    const usages = [{ sessionId: 's1', quantityRedeemed: 2 }, { sessionId: 's2', quantityRedeemed: 1 }, { sessionId: 's1' }];
+    expect(redeemedForSession(usages, 's1')).toBe(3);
+    expect(redeemedForSession(usages, 's3')).toBe(0);
+  });
+
+  test('uses the label, else the position among active sessions', () => {
+    expect(sessionLabel({ id: 'x', label: 'Opening night' }, COURSE)).toBe('Opening night');
+    expect(sessionLabel(COURSE[2], COURSE)).toBe('Session 3');
+    const list = [{ ...COURSE[0], cancelledAt: new Date() }, ...COURSE.slice(1)];
+    expect(sessionLabel(list[2], list)).toBe('Session 2');
+  });
+});

e2e/fixtures.ts

@@ -0,0 +1,48 @@
+import { test as base, expect, type Page } from "@playwright/test";
+import fs from "fs";
+import path from "path";
+
+export type Role = "admin" | "supervisor" | "staff" | "user";
+export type Seed = {
+  users: Record<Role, { id: string; name: string; email: string; token: string }>;
+  events: { free: string; paid: string; course: string };
+  course: { sessions: { id: string; label: string }[]; ticketId: string; qrCode: string };
+};
+
+export const API = "http://localhost:5100";
+
+// Written by e2e/support/prepare-db.js when the e2e backend starts, so read lazily.
+let cached: Seed | null = null;
+export function seed(): Seed {
+  if (!cached) cached = JSON.parse(fs.readFileSync(path.join(__dirname, ".data", "seed.json"), "utf8")) as Seed;
+  return cached;
+}
+
+/** Signs the page in as a seeded user (the token goes where the app keeps it). */
+export async function loginAs(page: Page, role: Role) {
+  await page.addInitScript((token) => {
+    localStorage.setItem("hope_events_token", token);
+  }, seed().users[role].token);
+}
+
+export const test = base.extend({
+  page: async ({ page }, use) => {
+    // Skip the cookie notice so it never covers what the tests click.
+    await page.addInitScript(() => localStorage.setItem("hope_events_cookie_consent", "declined"));
+    await use(page);
+  },
+});
+
+/** Calls the e2e API as a seeded user. */
+export async function api<T = unknown>(page: Page, role: Role, method: string, url: string, body?: unknown): Promise<T> {
+  const res = await page.request.fetch(`${API}${url}`, {
+    method,
+    headers: { Authorization: `Bearer ${seed().users[role].token}`, "Content-Type": "application/json" },
+    data: body === undefined ? undefined : JSON.stringify(body),
+  });
+  const text = await res.text();
+  if (!res.ok()) throw new Error(`${method} ${url} → ${res.status()}: ${text}`);
+  return (text ? JSON.parse(text) : null) as T;
+}
+
+export { expect };

e2e/public.spec.ts

@@ -0,0 +1,28 @@
+import { test, expect, seed } from "./fixtures";
+
+test.describe("public pages", () => {
+  test("events list shows events, with the multi-day summary", async ({ page }) => {
+    await page.goto("/events");
+    await expect(page.getByRole("heading", { name: "All Events" })).toBeVisible();
+    await expect(page.getByText("E2E Free Evening")).toBeVisible();
+    const course = page.locator("div.border.rounded-xl", { hasText: "E2E Alpha Course" });
+    await expect(course.getByText(/5 sessions · /)).toBeVisible();
+  });
+
+  test("a multi-day event page shows the schedule and the late-joiner price", async ({ page }) => {
+    await page.goto(`/events/${seed().events.course}`);
+    await expect(page.getByRole("heading", { name: "E2E Alpha Course" })).toBeVisible();
+    const schedule = page.locator("div.rounded-xl", { has: page.getByRole("heading", { name: "Schedule" }) });
+    await expect(schedule.getByText("Week 1")).toBeVisible();
+    await expect(schedule.getByText("Week 5")).toBeVisible();
+    await expect(schedule.getByText("Next")).toBeVisible();
+    // Week 2 is in progress, so 3 of 5 are still to come: R300 × 3/5 = R180.
+    await expect(page.getByText(/3 of 5 sessions are still to come/).filter({ visible: true }).first()).toBeVisible();
+    await expect(page.getByText("R180.00").filter({ visible: true }).first()).toBeVisible();
+  });
+
+  test("an unknown certificate code is reported as not found", async ({ page }) => {
+    await page.goto("/certificates/verify/ABCDE-12345");
+    await expect(page.getByRole("heading", { name: "Certificate not found" })).toBeVisible();
+  });
+});

e2e/registration.spec.ts

@@ -0,0 +1,53 @@
+import { test, expect, seed, loginAs, api } from "./fixtures";
+
+type Registration = { id: string; status: string; eventId: string };
+type Ticket = { id: string; qrCode: string; eventId: string };
+
+type CashByUser = { rows: { userId: string | null; cash: { total: number; count: number } }[] };
+
+test.describe("registration → payment → ticket → check-in → cashup", () => {
+  test("a free event: register and get a ticket straight away", async ({ page }) => {
+    await loginAs(page, "user");
+    await page.goto(`/register/${seed().events.free}`);
+    await expect(page.getByText("E2E Free Evening").first()).toBeVisible();
+    await page.getByRole("button", { name: "+" }).first().click();
+    await page.getByRole("button", { name: "Register", exact: true }).click();
+    await page.waitForURL(/\/registration\/success/);
+
+    const tickets = await api<Ticket[]>(page, "user", "GET", "/api/tickets/mytickets");
+    expect(tickets.some((t) => t.eventId === seed().events.free)).toBe(true);
+  });
+
+  test("a paid event: pending until paid, then a ticket that checks in once", async ({ page }) => {
+    await loginAs(page, "user");
+    await page.goto(`/register/${seed().events.paid}`);
+    await page.getByRole("button", { name: "+" }).first().click();
+    await expect(page.getByText("Total: R150.00")).toBeVisible();
+    await page.getByRole("button", { name: "Register", exact: true }).click();
+    await page.waitForURL(/\/registration\/success/);
+
+    const regs = await api<Registration[]>(page, "user", "GET", "/api/registrations/myregistrations");
+    const reg = regs.find((r) => r.eventId === seed().events.paid);
+    expect(reg?.status).not.toBe("paid");
+    expect((await api<Ticket[]>(page, "user", "GET", "/api/tickets/mytickets")).some((t) => t.eventId === seed().events.paid)).toBe(false);
+
+    // A supervisor records the cash payment at the desk.
+    await api(page, "supervisor", "POST", "/api/payments", { amount: 150, method: "cash", registrationId: reg!.id, eventId: seed().events.paid, userId: seed().users.user.id });
+    const ticket = (await api<Ticket[]>(page, "user", "GET", "/api/tickets/mytickets")).find((t) => t.eventId === seed().events.paid);
+    expect(ticket).toBeTruthy();
+
+    // My Events shows it.
+    await page.goto("/dashboard/user");
+    await expect(page.getByText("E2E Paid Conference").first()).toBeVisible();
+
+    // Staff check it in; a second scan is refused.
+    await api(page, "staff", "POST", `/api/tickets/scan/${ticket!.qrCode}`, { qty: 1 });
+    await expect(api(page, "staff", "POST", `/api/tickets/scan/${ticket!.qrCode}`, { qty: 1 })).rejects.toThrow(/403.*fully used/);
+
+    // Cashup: the R150 cash is on the supervisor who took it.
+    const cash = await api<CashByUser>(page, "supervisor", "GET", `/api/cashups/event/${seed().events.paid}/cash-by-user`);
+    const mine = cash.rows.find((r) => r.userId === seed().users.supervisor.id);
+    expect(mine?.cash.total).toBe(150);
+    expect(mine?.cash.count).toBe(1);
+  });
+});

e2e/sessions.spec.ts

@@ -0,0 +1,51 @@
+import { test, expect, seed, loginAs, api } from "./fixtures";
+
+test.describe("multi-day events", () => {
+  test("check-in is once per session, and the register and certificates follow", async ({ page }) => {
+    const { course, events } = seed();
+
+    // Scanning today: Week 2.
+    const scan = await api<{ session: { label: string } }>(page, "staff", "POST", `/api/tickets/scan/${course.qrCode}`, { qty: 1 });
+    expect(scan.session.label).toBe("Week 2");
+    await expect(api(page, "staff", "POST", `/api/tickets/scan/${course.qrCode}`, { qty: 1 })).rejects.toThrow(/Already checked in for Week 2/);
+
+    // The register shows weeks 1 and 2 ticked.
+    await loginAs(page, "supervisor");
+    await page.goto(`/dashboard/supervisor/attendance?eventId=${events.course}`);
+    const row = page.locator("tr", { hasText: "Thandi Test" });
+    await expect(row.getByText("2/5")).toBeVisible();
+
+    // Tick week 3 by hand (e.g. let in without a scan), then untick it.
+    const week3 = row.locator("td").nth(3).getByRole("button");
+    await week3.click();
+    await expect(row.getByText("3/5")).toBeVisible();
+    await week3.click();
+    await expect(row.getByText("2/5")).toBeVisible();
+
+    // Two sessions meets the rule (at least 2), so a certificate can be issued now.
+    await page.getByRole("button", { name: "Issue now" }).click();
+    await expect(page.getByText("1 certificate issued.")).toBeVisible();
+    const code = (await row.locator("span.font-mono").innerText()).trim();
+    expect(code).toMatch(/^[A-Z0-9]{5}-[A-Z0-9]{5}$/);
+
+    // Anyone can check it.
+    await page.goto(`/certificates/verify/${code}`);
+    await expect(page.getByRole("heading", { name: "Valid certificate" })).toBeVisible();
+    await expect(page.getByText("Thandi Test")).toBeVisible();
+  });
+
+  test("the attendee sees their certificate on My Events", async ({ page }) => {
+    await loginAs(page, "user");
+    await page.goto("/dashboard/user");
+    await expect(page.getByRole("heading", { name: "My Certificates" })).toBeVisible();
+    await expect(page.getByText("E2E Alpha Course").first()).toBeVisible();
+  });
+
+  test("the scanner offers today's session for a multi-day event", async ({ page }) => {
+    await loginAs(page, "staff");
+    await page.goto("/dashboard/staff/ticket-scanning");
+    await page.locator("select").first().selectOption({ label: "E2E Alpha Course" });
+    await expect(page.locator("select", { has: page.locator("option", { hasText: "Today's session" }) })).toBeVisible();
+    await expect(page.getByText("Today's session (Week 2)")).toBeAttached();
+  });
+});

e2e/supervisor.spec.ts

@@ -0,0 +1,62 @@
+import { test, expect, seed, loginAs, api } from "./fixtures";
+
+type EventRow = { id: string; title: string; scheduleType?: string; sessions?: { cancelled?: boolean }[] };
+
+test.describe("supervisor tools", () => {
+  test("create a weekly multi-session event in the wizard", async ({ page }) => {
+    await loginAs(page, "supervisor");
+    await page.goto("/dashboard/supervisor/events");
+    await page.getByRole("button", { name: "+ Add Event" }).click();
+    await expect(page.getByRole("heading", { name: "New Event" })).toBeVisible();
+
+    await page.getByPlaceholder("Event title").fill("E2E Wizard Course");
+    await page.getByRole("button", { name: "Multiple sessions" }).click();
+    // The repeat pattern defaults to weekly, 18:30–20:30, 5 sessions from today.
+    await page.getByRole("button", { name: "Create sessions" }).click();
+    await expect(page.getByText(/^5 sessions — edit any date/)).toBeVisible();
+    await page.locator('input[type="number"][placeholder="0"]').first().fill("250");
+
+    // Through the remaining steps to Create Event.
+    const create = page.getByRole("button", { name: "Create Event" });
+    for (let i = 0; i < 15 && !(await create.isVisible()); i++) {
+      await page.getByRole("button", { name: "Next →" }).click();
+    }
+    await create.click();
+    await expect(page.getByRole("heading", { name: "New Event" })).toBeHidden();
+
+    const row = page.locator("li", { hasText: "E2E Wizard Course" });
+    await expect(row.getByText(/5 sessions · /)).toBeVisible();
+    const all = await api<EventRow[]>(page, "supervisor", "GET", "/api/events/all");
+    const created = all.find((e) => e.title === "E2E Wizard Course");
+    expect(created?.scheduleType).toBe("sessions");
+    expect(created?.sessions?.filter((s) => !s.cancelled)).toHaveLength(5);
+  });
+
+  test("self-service kiosk: a visitor registers for a free event", async ({ page }) => {
+    await page.goto("/self-service");
+    await page.getByPlaceholder("supervisor@example.com").fill(seed().users.supervisor.email);
+    await page.getByPlaceholder("••••••••").fill("E2e-password-123");
+    await page.getByRole("button", { name: "Sign In" }).click();
+    await expect(page.getByText("Signed in as supervisor")).toBeVisible();
+    const value = await page.locator("option", { hasText: "E2E Free Evening" }).getAttribute("value");
+    await page.locator("select").selectOption(value!);
+    await page.getByRole("button", { name: "Start Kiosk" }).click();
+
+    await expect(page.getByRole("heading", { name: "E2E Free Evening" })).toBeVisible();
+    await page.getByPlaceholder("john@example.com").fill("walkin@e2e.test");
+    await page.getByPlaceholder("+27 82 000 0000").fill("0820000099");
+    await page.getByPlaceholder("John Smith").fill("Walk In Visitor");
+    await page.getByRole("button", { name: "+" }).first().click();
+    await page.getByRole("button", { name: "Register", exact: true }).click();
+    await expect(page.getByRole("heading", { name: "You're Registered!" })).toBeVisible();
+  });
+
+  test("admin: background jobs page", async ({ page }) => {
+    await loginAs(page, "admin");
+    await page.goto("/dashboard/admin/settings?tab=jobs");
+    await expect(page.getByRole("heading", { name: "Background jobs" })).toBeVisible();
+    // The e2e backend runs with JOBS_ENABLED=false.
+    await expect(page.getByText(/All background jobs are switched off/)).toBeVisible();
+    await expect(page.getByText("Session reminders and certificates")).toBeVisible();
+  });
+});

e2e/support/db-url.js

@@ -0,0 +1,16 @@
+// The e2e database: E2E_DATABASE_URL, or backend/.env's DATABASE_URL with "_e2e" added
+// to the database name — always separate from the database you develop against.
+const path = require('path');
+
+function e2eDatabaseUrl() {
+  if (process.env.E2E_DATABASE_URL) return process.env.E2E_DATABASE_URL;
+  const backend = path.join(__dirname, '..', '..', 'backend');
+  require(require.resolve('dotenv', { paths: [backend] })).config({ path: path.join(backend, '.env'), quiet: true });
+  if (!process.env.DATABASE_URL) throw new Error('Set E2E_DATABASE_URL (or DATABASE_URL in backend/.env) for the e2e tests.');
+  const u = new URL(process.env.DATABASE_URL);
+  const name = u.pathname.replace(/^\//, '');
+  u.pathname = `/${name.endsWith('_e2e') ? name : `${name}_e2e`}`;
+  return u.toString();
+}
+
+module.exports = { e2eDatabaseUrl };

e2e/support/prepare-db.js

@@ -0,0 +1,137 @@
+/**
+ * Prepares the end-to-end test database, then exits. Run before the e2e backend starts
+ * (see playwright.config.ts): drops and recreates the database, applies the migrations,
+ * and seeds settings, users and events. Writes e2e/.data/seed.json with the ids and
+ * login tokens the tests use.
+ *
+ * Database: E2E_DATABASE_URL, or backend/.env's DATABASE_URL with "_e2e" added to the
+ * database name. It is always a separate database — never the one you develop against.
+ */
+const path = require('path');
+const fs = require('fs');
+const { execSync } = require('child_process');
+
+const root = path.join(__dirname, '..', '..');
+const backend = path.join(root, 'backend');
+const req = (m) => require(require.resolve(m, { paths: [backend] }));
+req('dotenv').config({ path: path.join(backend, '.env') });
+
+const { e2eDatabaseUrl } = require('./db-url');
+
+async function recreateDatabase(url) {
+  const { Client } = req('pg');
+  const target = new URL(url);
+  const dbName = decodeURIComponent(target.pathname.replace(/^\//, ''));
+  if (!/_e2e$|^e2e|test/i.test(dbName)) throw new Error(`Refusing to reset "${dbName}" — the e2e database name must contain "e2e" or "test".`);
+  const admin = new URL(url);
+  admin.pathname = '/postgres';
+  admin.search = '';
+  const client = new Client({ connectionString: admin.toString() });
+  await client.connect();
+  await client.query(`DROP DATABASE IF EXISTS "${dbName}" WITH (FORCE)`);
+  await client.query(`CREATE DATABASE "${dbName}"`);
+  await client.end();
+}
+
+async function seed(url) {
+  process.env.DATABASE_URL = url;
+  const prisma = require(path.join(backend, 'src/config/db'));
+  const { generateToken, hashPassword } = require(path.join(backend, 'src/config/auth'));
+  const { generateTicketsForRegistration } = require(path.join(backend, 'src/utils/ticketUtils'));
+
+  await prisma.appSetting.createMany({
+    data: [
+      { key: 'setup_complete', value: 'true' },
+      { key: 'org_name', value: 'E2E Church' },
+      { key: 'org_address', value: '1 Test Street, Pretoria' },
+    ],
+  });
+
+  const password = await hashPassword('E2e-password-123');
+  const mk = (role, name, email, phoneNumber) => prisma.user.create({
+    data: { name, email, phoneNumber, role, password, isActive: true, updatedAt: new Date() },
+  });
+  const users = {
+    admin: await mk('admin', 'Ada Admin', 'admin@e2e.test', '0820000001'),
+    supervisor: await mk('supervisor', 'Sam Supervisor', 'supervisor@e2e.test', '0820000002'),
+    staff: await mk('staff', 'Stan Staff', 'staff@e2e.test', '0820000003'),
+    user: await mk('user', 'Thandi Test', 'user@e2e.test', '0820000004'),
+  };
+
+  const D = 86400000;
+  const now = Date.now();
+  const at = (days, hourUtc = 16, minute = 30) => {
+    const d = new Date(now + days * D);
+    d.setUTCHours(hourUtc, minute, 0, 0);
+    return d;
+  };
+
+  const free = await prisma.event.create({
+    data: {
+      title: 'E2E Free Evening', description: 'A free evening for the tests.', startDate: at(1), endDate: at(1, 19),
+      price: 0, location: '1 Test Street, Pretoria', createdById: users.supervisor.id,
+      eventOptions: { create: [{ name: 'Entry', price: 0, isMainTicket: true }] },
+    },
+  });
+  const paid = await prisma.event.create({
+    data: {
+      title: 'E2E Paid Conference', description: 'A paid one-day conference.', startDate: at(3, 7), endDate: at(3, 15),
+      price: 150, location: '1 Test Street, Pretoria', createdById: users.supervisor.id,
+      eventOptions: { create: [{ name: 'Conference ticket', price: 150, isMainTicket: true }] },
+    },
+  });
+
+  // Multi-day: week 1 was a week ago, week 2 is in progress now, then three more weeks.
+  const todayStart = new Date(now - 30 * 60 * 1000);
+  const sessions = [-7, 0, 7, 14, 21].map((days, i) => {
+    const startsAt = new Date(todayStart.getTime() + days * D);
+    return { label: `Week ${i + 1}`, startsAt, endsAt: new Date(startsAt.getTime() + 90 * 60 * 1000), order: i };
+  });
+  const course = await prisma.event.create({
+    data: {
+      title: 'E2E Alpha Course', description: 'Five weekly evenings.', startDate: sessions[0].startsAt, endDate: sessions[4].endsAt,
+      price: 300, location: '1 Test Street, Pretoria', createdById: users.supervisor.id,
+      scheduleType: 'sessions', lateJoinEnabled: true, latePricing: 'prorata', checkInWindow: 'whole_day',
+      certificatesEnabled: true,
+      certificateConfig: { template: 'classic', title: 'Certificate of Completion', body: '{name} completed {event}.', rule: { type: 'count', value: 2 } },
+      sessions: { create: sessions },
+      eventOptions: { create: [{ name: 'Course ticket', price: 300, isMainTicket: true }] },
+    },
+    include: { sessions: { orderBy: { startsAt: 'asc' } }, eventOptions: true },
+  });
+  await prisma.event.update({ where: { id: course.id }, data: { lateJoinUntilSessionId: course.sessions[2].id } });
+
+  // Thandi is booked on the course and was checked in for week 1.
+  const reg = await prisma.registration.create({
+    data: {
+      userId: users.user.id, eventId: course.id, status: 'paid',
+      registrationOptions: { create: [{ eventOptionId: course.eventOptions[0].id, quantity: 1, priceSnapshot: 300, tranches: { create: [{ quantity: 1, priceSnapshot: 300 }] } }] },
+    },
+  });
+  await prisma.payment.create({ data: { amount: 300, method: 'cash', userId: users.user.id, registrationId: reg.id, eventId: course.id, recordedById: users.supervisor.id } });
+  await generateTicketsForRegistration(reg.id);
+  const ticket = await prisma.ticket.findFirst({ where: { eventId: course.id } });
+  await prisma.ticketUsage.create({ data: { ticketId: ticket.id, scannedById: users.staff.id, sessionId: course.sessions[0].id, scannedAt: course.sessions[0].startsAt } });
+
+  const out = {
+    users: Object.fromEntries(Object.entries(users).map(([k, u]) => [k, { id: u.id, name: u.name, email: u.email, token: generateToken(u.id, u.role, u.tokenVersion || 0) }])),
+    events: { free: free.id, paid: paid.id, course: course.id },
+    course: { sessions: course.sessions.map(s => ({ id: s.id, label: s.label })), ticketId: ticket.id, qrCode: ticket.qrCode },
+  };
+  fs.mkdirSync(path.join(root, 'e2e', '.data'), { recursive: true });
+  fs.writeFileSync(path.join(root, 'e2e', '.data', 'seed.json'), JSON.stringify(out, null, 2));
+  await prisma.$disconnect?.();
+}
+
+(async () => {
+  const url = e2eDatabaseUrl();
+  await recreateDatabase(url);
+  execSync('npx prisma migrate deploy', { cwd: backend, env: { ...process.env, DATABASE_URL: url }, stdio: 'ignore' });
+  await seed(url);
+  console.log('[e2e] Database ready:', new URL(url).pathname.slice(1));
+  process.exit(0);
+})().catch((e) => {
+  console.error('[e2e] Preparing the database failed:', e);
+  process.exit(1);
+});
+

frontend/next.config.ts

@@ -2,6 +2,9 @@ import type { NextConfig } from "next";
 import { withSentryConfig } from "@sentry/nextjs";
 
 const nextConfig: NextConfig = {
+  // The end-to-end tests run their own dev server; a separate build folder keeps it
+  // from clashing with one already running.
+  distDir: process.env.NEXT_DIST_DIR || ".next",
   images: {
     domains: ['images.unsplash.com'],
   },

frontend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "hope-events-frontend",
-  "version": "1.28.1",
+  "version": "1.34.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "hope-events-frontend",
-      "version": "1.28.1",
+      "version": "1.34.0",
       "dependencies": {
         "@dnd-kit/core": "^6.3.1",
         "@hookform/resolvers": "^5.2.1",

frontend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hope-events-frontend",
-  "version": "1.28.1",
+  "version": "1.34.0",
   "private": true,
   "scripts": {
     "dev": "next dev --turbopack",

frontend/src/app/certificates/verify/[code]/page.tsx

@@ -0,0 +1,61 @@
+import { Metadata } from "next";
+import { BadgeCheck, ShieldX } from "lucide-react";
+import { Navbar } from "@/components/layout/Navbar";
+import { Footer } from "@/components/layout/Footer";
+import { apiFetch } from "@/lib/api";
+import { formatDate } from "@/lib/date";
+
+export const dynamic = "force-dynamic";
+
+export const metadata: Metadata = {
+  title: "Verify a certificate",
+  robots: { index: false },
+};
+
+type Verification = { valid: boolean; revoked?: boolean; name?: string; event?: string; completedOn?: string; issuedAt?: string };
+
+// Public check for the QR code / code printed on a completion certificate. Shows only the
+// name, event and dates — nothing else about the person.
+export default async function VerifyCertificatePage({ params }: { params: Promise<{ code: string }> }) {
+  const { code } = await params;
+  let result: Verification = { valid: false };
+  try {
+    result = await apiFetch<Verification>(`/api/attendance/certificates/verify/${encodeURIComponent(code)}`, { nextOptions: { cache: "no-store" } });
+  } catch {
+    result = { valid: false };
+  }
+
+  return (
+    <div className="min-h-screen flex flex-col">
+      <Navbar />
+      <main className="flex-1 py-12 px-4 max-w-lg mx-auto w-full">
+        <div className="border rounded-xl p-6 bg-white shadow-sm text-center">
+          {result.valid ? (
+            <>
+              <BadgeCheck className="w-12 h-12 text-green-600 mx-auto mb-3" />
+              <h1 className="text-xl font-semibold text-gray-900">Valid certificate</h1>
+              <p className="text-gray-700 mt-3"><span className="font-semibold">{result.name}</span> completed</p>
+              <p className="text-lg font-medium text-brand-700 mt-1">{result.event}</p>
+              <p className="text-sm text-gray-500 mt-3">
+                {result.completedOn && <>Completed {formatDate(new Date(result.completedOn))} · </>}
+                {result.issuedAt && <>Issued {formatDate(new Date(result.issuedAt))}</>}
+              </p>
+            </>
+          ) : (
+            <>
+              <ShieldX className="w-12 h-12 text-red-500 mx-auto mb-3" />
+              <h1 className="text-xl font-semibold text-gray-900">{result.revoked ? "This certificate was withdrawn" : "Certificate not found"}</h1>
+              <p className="text-sm text-gray-500 mt-3">
+                {result.revoked
+                  ? "The organiser has withdrawn this certificate, so it's no longer valid."
+                  : "Check the code on the certificate and try again. Codes look like K7M2Q-9XRTB."}
+              </p>
+            </>
+          )}
+          <p className="text-xs text-gray-400 mt-6 font-mono">{decodeURIComponent(code).toUpperCase()}</p>
+        </div>
+      </main>
+      <Footer />
+    </div>
+  );
+}

frontend/src/app/dashboard/admin/page.tsx

@@ -8,7 +8,7 @@ import { useStableState } from "@/hooks/useStableState";
 import { useVisiblePolling } from "@/hooks/useVisiblePolling";
 import {
   Calendar, Banknote, Gift, Users, Ticket, QrCode, ClipboardList,
-  UserPlus, FileText, MessageCircle, BarChart2, Mail, Wallet, DoorOpen, History, TicketPercent, ShieldCheck, ListChecks, WifiOff, BedDouble, Filter,
+  UserPlus, FileText, MessageCircle, BarChart2, Mail, Wallet, DoorOpen, History, TicketPercent, ShieldCheck, ListChecks, WifiOff, BedDouble, Filter, ClipboardCheck,
 } from "lucide-react";
 import { StatCard, StatCardRow } from "@/components/shared/StatCard";
 import { QuickActionTile, QuickActionGrid } from "@/components/shared/QuickActionTile";
@@ -30,6 +30,7 @@ const QUICK_ACTIONS = [
   { href: "/dashboard/supervisor/payments", label: "Payments & donations", description: "Manual payments and assignment", icon: Wallet },
   { href: "/dashboard/supervisor/allocations", label: "Rooms & groups", description: "Put attendees into rooms, groups or buses", icon: BedDouble },
   { href: "/dashboard/supervisor/offline-scans", label: "Offline scanning", description: "Devices scanning offline and their synced scans", icon: WifiOff },
+  { href: "/dashboard/supervisor/attendance", label: "Attendance", description: "Who came to each session, and certificates", icon: ClipboardCheck },
   { href: "/dashboard/supervisor/waitlist", label: "Waitlist", description: "People waiting for sold-out tickets", icon: ListChecks },
   { href: "/dashboard/supervisor/consent", label: "Parental consent", description: "Youth events: consent status and medical list", icon: ShieldCheck },
   { href: "/dashboard/supervisor/coupons", label: "Coupon codes", description: "Discounts for staff, leaders and promotions", icon: TicketPercent },

frontend/src/app/dashboard/admin/settings/page.tsx

@@ -6,17 +6,18 @@ import { useSearchParams } from "next/navigation";
 import { apiFetch, ApiError, API_BASE, resolveToApiOrigin } from "@/lib/api";
 import { useSiteSettings } from "@/contexts/SiteSettingsContext";
 import { useDismissingState } from "@/hooks/useDismissingState";
-import { Building2, Palette, Bell, Mail, Scale, MessageCircle, CreditCard, DatabaseBackup, type LucideIcon } from "lucide-react";
+import { Building2, Palette, Bell, Mail, Scale, MessageCircle, CreditCard, DatabaseBackup, Timer, type LucideIcon } from "lucide-react";
 import { ColorPickerField } from "@/components/admin/ColorPickerField";
 import { BrandingPreviewPanel } from "@/components/admin/BrandingPreviewPanel";
 import { BackupsTab } from "@/components/admin/BackupsTab";
+import { JobsTab } from "@/components/admin/JobsTab";
 import { YocoTab } from "@/components/admin/YocoTab";
 import { extractDominantColors } from "@/lib/extractColors";
 import { mapsSearchUrl } from "@/lib/maps";
 import { errorMessage } from "@/lib/utils";
 import { BackLink } from "@/components/shared/BackLink";
 
-type TabId = "organisation" | "branding" | "notifications" | "email" | "legal" | "whatsapp" | "yoco" | "backups";
+type TabId = "organisation" | "branding" | "notifications" | "email" | "legal" | "whatsapp" | "yoco" | "backups" | "jobs";
 
 const TABS: { id: TabId; label: string; icon: LucideIcon }[] = [
   { id: "organisation",  label: "Organisation",  icon: Building2 },
@@ -27,11 +28,18 @@ const TABS: { id: TabId; label: string; icon: LucideIcon }[] = [
   { id: "whatsapp",      label: "WhatsApp",      icon: MessageCircle },
   { id: "yoco",          label: "Yoco",          icon: CreditCard },
   { id: "backups",       label: "Backups",       icon: DatabaseBackup },
+  { id: "jobs",          label: "Background jobs", icon: Timer },
 ];
 
 const inputCls =
   "w-full border rounded-lg px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-brand-400";
 
+/** The code from Search Console's verification meta tag; accepts the whole tag or just the code. */
+function googleVerificationCode(input: string): string {
+  const m = input.match(/content\s*=\s*["']([^"']*)["']/i);
+  return (m ? m[1] : input).trim();
+}
+
 function Field({
   label, hint, required, children,
 }: {
@@ -104,6 +112,7 @@ function SiteSettingsPageInner() {
   const [orgPhone, setOrgPhone] = useState("");
   const [orgAddress, setOrgAddress] = useState("");
   const [appBaseUrl, setAppBaseUrl] = useState("");
+  const [googleVerification, setGoogleVerification] = useState("");
 
   // ── Branding ──
   const [primaryColor, setPrimaryColor] = useState("#4F46E5");
@@ -153,6 +162,7 @@ function SiteSettingsPageInner() {
         setOrgPhone(s.org_phone || "");
         setOrgAddress(s.org_address || "");
         setAppBaseUrl(s.app_base_url || "");
+        setGoogleVerification(s.google_site_verification || "");
         // primary_color falls back to the legacy accent_color value (which used
         // to be "the one brand color" before this 3-color system existed).
         // accent_color is only trusted as the NEW tertiary color once
@@ -209,6 +219,7 @@ function SiteSettingsPageInner() {
     org_phone:    orgPhone.trim(),
     org_address:  orgAddress.trim(),
     app_base_url: appBaseUrl.trim(),
+    google_site_verification: googleVerificationCode(googleVerification),
   });
 
   const uploadBrandingAsset = async (file: File, kind: "logo" | "favicon"): Promise<string> => {
@@ -432,6 +443,10 @@ function SiteSettingsPageInner() {
               <input className={inputCls} placeholder="https://events.yourchurch.org"
                 value={appBaseUrl} onChange={e => setAppBaseUrl(e.target.value)} />
             </Field>
+            <Field label="Google Search Console verification" hint="In Search Console, add this site as a URL-prefix property and choose the HTML tag method. Paste the tag (or just its content code) here and save, then click Verify in Search Console. Leave it set to stay verified.">
+              <input className={inputCls} placeholder='<meta name="google-site-verification" content="..." />'
+                value={googleVerification} onChange={e => setGoogleVerification(e.target.value)} />
+            </Field>
             <SaveBar saving={saving} onSave={saveOrganisation} result={result} />
           </div>
         )}
@@ -692,6 +707,7 @@ function SiteSettingsPageInner() {
 
         {/* ── Backups ───────────────────────────────────────────────────────── */}
         {activeTab === "backups" && <BackupsTab active={activeTab === "backups"} />}
+        {activeTab === "jobs" && <JobsTab active={activeTab === "jobs"} />}
       </div>
 
       {activeTab === "branding" && (

frontend/src/app/dashboard/staff/event-tickets/page.tsx

@@ -6,6 +6,7 @@ import { apiFetch } from "@/lib/api";
 import { useDismissingState } from "@/hooks/useDismissingState";
 import { useRouter, useSearchParams } from "next/navigation";
 import { formatDate } from "@/lib/date";
+import { printTicketCards } from "@/lib/ticketPrint";
 import { QrImage } from "@/components/shared/QrImage";
 import { Ticket } from "lucide-react";
 import { errorMessage } from "@/lib/utils";
@@ -142,96 +143,7 @@ function EventTicketsContent() {
     return list;
   }, [tickets, eventId, selectedUserId, selectedVariantId]);
 
-  // Printing helpers
-  const buildTicketHtmlCard = (t: TicketRecord) => {
-    const eventTitle = t.event?.title || t.eventId || "Event";
-    const eventDate = t.event?.startDate ? new Date(t.event.startDate) : null;
-    const optBase = t.registrationOption?.eventOption?.name || "Ticket";
-    const optVariant = t.registrationOption?.variant?.name;
-    const type = optVariant ? `${optBase} — ${optVariant}` : optBase;
-    const qty = t.quantity || 1;
-    const holder = t.attendee?.name ? `${t.attendee.name}${t.user?.name ? ` (booked by ${t.user.name})` : ""}` : (t.user?.name || t.userId || "");
-    const qrSrc = `https://api.qrserver.com/v1/create-qr-code/?size=140x140&data=${encodeURIComponent(
-        t.qrCode || t.id
-    )}`;
-    const dateStr = eventDate ? formatDate(eventDate) : "";
-    return `
-      <div class="ticket">
-        <div class="evt">${eventTitle}</div>
-        ${dateStr ? `<div class="date">${dateStr}</div>` : ""}
-        <div class="type">${type}</div>
-        <div class="qty">Qty: <strong>${qty}</strong></div>
-        <div class="qrwrap"><img src="${qrSrc}" alt="QR" /></div>
-        <div class="meta">ID: ${t.id}</div>
-        ${holder ? `<div class="meta">${holder}</div>` : ""}
-      </div>
-    `;
-  };
-
-  const openPrintWindow = (pagesHtml: string) => {
-    const w = window.open("", "_blank");
-    if (!w) return;
-    w.document.write(`<!doctype html><html><head><title>Tickets</title>
-      <style>
-        @page { size: A4; margin: 10mm; }
-        * { box-sizing: border-box; }
-        body { font-family: Arial, Helvetica, sans-serif; margin: 0; padding: 0; }
-        .page {
-          display: grid;
-          grid-template-columns: repeat(2, 1fr);
-          grid-template-rows: repeat(4, 1fr);
-          height: 277mm;
-          gap: 6mm;
-          page-break-after: always;
-          break-after: page;
-        }
-        .page:last-child { page-break-after: avoid; break-after: avoid; }
-        .ticket { border: 1px solid #000; padding: 5mm; display: flex; flex-direction: column; justify-content: space-between; overflow: hidden; }
-        .evt { font-weight: bold; font-size: 14px; }
-        .type { font-size: 12px; margin-top: 2mm; }
-        .qty { font-size: 11px; margin-top: 1mm; }
-        .date { font-size: 10px; color: #555; margin-top: 1mm; }
-        .qrwrap { display: flex; justify-content: center; margin: 2mm 0; }
-        .qrwrap img { width: 30mm; height: 30mm; }
-        .meta { font-size: 10px; text-align: center; }
-      </style>
-    </head><body>
-      ${pagesHtml}
-      <script>
-        (function(){
-          function printWhenReady(){
-            var imgs = Array.prototype.slice.call(document.images);
-            if(imgs.length === 0){ window.print(); return; }
-            var remaining = imgs.length;
-            function done(){ remaining--; if(remaining <= 0){ setTimeout(function(){ window.print(); }, 100); } }
-            imgs.forEach(function(img){
-              if (img.complete) { done(); }
-              else {
-                img.addEventListener('load', done, { once: true });
-                img.addEventListener('error', done, { once: true });
-              }
-            });
-          }
-          if (document.readyState === 'complete') printWhenReady();
-          else window.addEventListener('load', printWhenReady);
-        })();
-      </script>
-    </body></html>`);
-    w.document.close();
-    w.focus();
-  };
-
-  const printTickets = (ticketList: TicketRecord[]) => {
-    if (!ticketList || ticketList.length === 0) return;
-    // Chunk into pages of 8 (2 columns × 4 rows per A4 sheet)
-    const PAGE_SIZE = 8;
-    const pages: string[] = [];
-    for (let i = 0; i < ticketList.length; i += PAGE_SIZE) {
-      const chunk = ticketList.slice(i, i + PAGE_SIZE);
-      pages.push(`<div class="page">${chunk.map(buildTicketHtmlCard).join("")}</div>`);
-    }
-    openPrintWindow(pages.join(""));
-  };
+  const printTickets = (ticketList: TicketRecord[]) => printTicketCards(ticketList, (t) => t.user?.name);
 
   return (
       <div className="max-w-6xl mx-auto w-full p-6">

frontend/src/app/dashboard/staff/page.tsx

@@ -6,7 +6,7 @@ import { useRouter } from "next/navigation";
 import { apiFetch } from "@/lib/api";
 import { useStableState } from "@/hooks/useStableState";
 import { useVisiblePolling } from "@/hooks/useVisiblePolling";
-import { QrCode, Ticket, Activity, UserCheck, Clock, Users } from "lucide-react";
+import { QrCode, Ticket, Activity, UserCheck, Clock, Users, ClipboardCheck } from "lucide-react";
 import { StatCard, StatCardRow } from "@/components/shared/StatCard";
 import { QuickActionTile, QuickActionGrid } from "@/components/shared/QuickActionTile";
 import type { DashboardStats, RecentScan, ScanStats } from "@/types";
@@ -15,6 +15,7 @@ const QUICK_ACTIONS = [
   { href: "/dashboard/staff/ticket-scanning", label: "Scan tickets", description: "Use your device camera to validate tickets", icon: QrCode },
   { href: "/dashboard/staff/event-tickets", label: "Event tickets & printing", description: "Browse event tickets and print lists", icon: Ticket },
   { href: "/dashboard/staff/my-groups", label: "My groups", description: "Rooms and groups you lead", icon: Users },
+  { href: "/dashboard/supervisor/attendance", label: "Attendance", description: "Who came to each session of an event", icon: ClipboardCheck },
 ] as const;
 
 export default function StaffDashboardPage() {

frontend/src/app/dashboard/staff/ticket-scanning/page.tsx

@@ -11,6 +11,7 @@ import { OfflineScanPanel } from "@/components/scanner/OfflineScanPanel";
 import type { SnapshotTicket } from "@/lib/offlineScan";
 import { errorMessage } from "@/lib/utils";
 import type { Event, RecentScan, ScanStats, Section } from "@/types";
+import { activeSessions, currentSessionLabel, formatSessionWhen, sessionLabel } from "@/lib/sessions";
 import { BackLink } from "@/components/shared/BackLink";
 
 // GET /api/tickets/scan-preview/:qr — just the fields the confirm step needs. Offline
@@ -30,6 +31,10 @@ type ScanTicket = {
   attendee?: { name: string } | null;
   user?: { name?: string; email?: string } | null;
   usages?: { id: string; scannedAt: string; quantityRedeemed?: number }[];
+  // Multi-day events: the session this scan counts for, and what's left for it.
+  remaining?: number;
+  session?: { id: string; label: string } | null;
+  sessionError?: string | null;
 };
 
 export default function TicketScanningPage() {
@@ -73,6 +78,8 @@ export default function TicketScanningPage() {
   const [sections, setSections] = useState<Section[]>([]);
   const [selectedSectionId, setSelectedSectionId] = useState<string>("all");
   const [loadingSections, setLoadingSections] = useState(false);
+  // Multi-day events: "auto" = today's session (the server picks it).
+  const [selectedSessionId, setSelectedSessionId] = useState<string>("auto");
 
   // All events from API (including past); frontend filters to 12h window or all past
   useEffect(() => {
@@ -100,6 +107,11 @@ export default function TicketScanningPage() {
     });
   }, [allEvents, includePastEvents]);
 
+  const selectedEvent = useMemo(() => allEvents.find(ev => ev.id === selectedEventId) || null, [allEvents, selectedEventId]);
+  const eventSessions = useMemo(() => selectedEvent?.scheduleType === "sessions" ? activeSessions(selectedEvent.sessions) : [], [selectedEvent]);
+  useEffect(() => { setSelectedSessionId("auto"); }, [selectedEventId]);
+  const sessionParam = selectedEventId !== "all" && selectedSessionId !== "auto" ? selectedSessionId : null;
+
   useEffect(() => {
     (async () => {
       if (!token || !selectedEventId || selectedEventId === "all") {
@@ -136,7 +148,7 @@ export default function TicketScanningPage() {
   useEffect(() => {
     if (isFirstFilterRender.current) { isFirstFilterRender.current = false; return; }
     scannerRef.current?.stop();
-  }, [selectedEventId, selectedSectionId]);
+  }, [selectedEventId, selectedSectionId, selectedSessionId]);
 
   async function handleResult(text: string) {
     setError(null);
@@ -177,7 +189,7 @@ export default function TicketScanningPage() {
       // Uses the lightweight scan-preview endpoint (only fetches fields needed for the confirm modal)
       let preview: ScanTicket;
       try {
-        preview = await apiFetch<ScanTicket>(`/api/tickets/scan-preview/${encodeURIComponent(text)}`, { authToken: token });
+        preview = await apiFetch<ScanTicket>(`/api/tickets/scan-preview/${encodeURIComponent(text)}${sessionParam ? `?sessionId=${encodeURIComponent(sessionParam)}` : ""}`, { authToken: token });
       } catch (pe) {
         setErrorModal(errorMessage(pe) || 'Failed to validate ticket');
         return;
@@ -208,13 +220,19 @@ export default function TicketScanningPage() {
         }
       }
 
-      // Compute remaining qty
+      // Multi-day events: no session open for check-in now (wrong day, cancelled…).
+      if (preview?.sessionError) {
+        setErrorModal(preview.sessionError);
+        return;
+      }
+
+      // Compute remaining qty (the server counts it per session for multi-day events)
       const ticketQty = preview?.quantity || 1;
       const totalRedeemed = (preview?.usages || []).reduce((s, u) => s + (u.quantityRedeemed || 1), 0);
-      const remaining = ticketQty - totalRedeemed;
+      const remaining = typeof preview?.remaining === "number" ? preview.remaining : ticketQty - totalRedeemed;
 
       if (remaining <= 0) {
-        setAlreadyUsedModal({ message: 'Ticket has already been fully used', ticket: preview });
+        setAlreadyUsedModal({ message: preview?.session ? `Already checked in for ${preview.session.label}` : 'Ticket has already been fully used', ticket: preview });
         return;
       }
 
@@ -236,7 +254,7 @@ export default function TicketScanningPage() {
     const baseName = ticket?.registrationOption?.eventOption?.name || "Ticket";
     const variantName = ticket?.registrationOption?.variant?.name;
     const optionName = variantName ? `${baseName} — ${variantName}` : baseName;
-    const eventTitle = ticket?.event?.title || 'Event';
+    const eventTitle = `${ticket?.event?.title || 'Event'}${ticket?.session ? ` — ${ticket.session.label}` : ''}`;
     const idPart = ticket?.id ? String(ticket.id).slice(0, 6) : '';
     const newRemaining = remaining - qty;
 
@@ -276,6 +294,7 @@ export default function TicketScanningPage() {
           qty,
           deviceId: offline.deviceId(),
           ...(selectedSectionId && selectedSectionId !== "all" ? { sectionId: selectedSectionId } : {}),
+          ...(ticket?.session ? { sessionId: ticket.session.id } : {}),
           ...(overrideConsent ? { overrideConsent: true } : {}),
         },
       });
@@ -378,6 +397,23 @@ export default function TicketScanningPage() {
             </div>
           )}
 
+          {eventSessions.length > 0 && (
+            <div className="flex flex-col sm:flex-row sm:items-center gap-2 mb-3">
+              <label className="text-sm text-gray-700 shrink-0">Session</label>
+              <select
+                className="border rounded px-3 py-2 w-full sm:w-72 max-w-full"
+                value={selectedSessionId}
+                onChange={(e) => setSelectedSessionId(e.target.value)}
+                disabled={!!offline.lock}
+              >
+                <option value="auto">Today&apos;s session{currentSessionLabel(selectedEvent) ? ` (${currentSessionLabel(selectedEvent)})` : ""}</option>
+                {eventSessions.map(s => (
+                  <option key={s.id} value={s.id}>{sessionLabel(s, selectedEvent?.sessions)} — {formatSessionWhen(s)}</option>
+                ))}
+              </select>
+            </div>
+          )}
+
           <OfflineScanPanel
             offline={offline}
             token={token}
@@ -467,6 +503,7 @@ export default function TicketScanningPage() {
             <div className="bg-gray-50 border rounded-lg p-4 mb-4 space-y-1 text-sm">
               <div><span className="font-medium">Ticket type:</span> {confirmModal.ticket?.registrationOption?.eventOption?.name || 'Ticket'}{confirmModal.ticket?.registrationOption?.variant?.name ? ` — ${confirmModal.ticket.registrationOption.variant.name}` : ''}</div>
               <div><span className="font-medium">Event:</span> {confirmModal.ticket?.event?.title || '—'}</div>
+              {confirmModal.ticket?.session && <div><span className="font-medium">Session:</span> {confirmModal.ticket.session.label}</div>}
               <div><span className="font-medium">Holder:</span> {confirmModal.ticket?.attendee?.name || confirmModal.ticket?.user?.name || confirmModal.ticket?.registrationOption?.registration?.user?.name || '—'}</div>
               {confirmModal.ticket?.attendee?.name && confirmModal.ticket?.user?.name && (
                 <div className="text-xs text-gray-500">Booked by {confirmModal.ticket.user.name}</div>

frontend/src/app/dashboard/supervisor/at-the-door/page.tsx

@@ -14,6 +14,8 @@ import { AttendeeNamesEditor, AttendeeEntries, TicketDelivery, attendeesPayload,
 import { DoorOpen, UserPlus, CreditCard, CheckSquare, Ticket, RotateCcw, type LucideIcon } from "lucide-react";
 import { errorMessage } from "@/lib/utils";
 import { optionUnitNow, variantUnitNow } from "@/lib/pricing";
+import { printTicketCards, ticketTypeLabel as ticketLabel } from "@/lib/ticketPrint";
+import { todaysSession } from "@/lib/sessions";
 import type { Event, EventOption, PublicBundle, Registration, Ticket as TicketRecord, UserSummary } from "@/types";
 
 type NewAttendee = { name: string; email: string | null; phone: string | null; notifPref: "email" | "whatsapp" | "both" };
@@ -87,12 +89,6 @@ function initQuantities(eventOptions: EventOption[]): Record<string, number> {
     return map;
 }
 
-function ticketLabel(t: TicketRecord): string {
-    const opt = t.registrationOption?.eventOption?.name || "Ticket";
-    const variant = t.registrationOption?.variant?.name;
-    return variant ? `${opt} — ${variant}` : opt;
-}
-
 export default function AtTheDoorPage() {
     const { user, loading, token } = useAuth();
     const router = useRouter();
@@ -915,61 +911,7 @@ function DoorTicketsPanel({ token, eventId }: { token: string | null; eventId: s
         }
     };
 
-    const print = (ticket: TicketRecord) => {
-        const w = window.open("", "_blank");
-        if (!w) return;
-        const eventTitle = ticket.event?.title || ticket.eventId || "Event";
-        const eventDate = ticket.event?.startDate ? new Date(ticket.event.startDate) : null;
-        const dateStr = eventDate ? eventDate.toLocaleDateString("en-ZA", { day: "numeric", month: "long", year: "numeric" }) : "";
-        const type = ticketLabel(ticket);
-        const qty = ticket.quantity || 1;
-        const holder = ticket.user?.name || ticket.userId || "";
-        const qrData = encodeURIComponent(ticket.qrCode || ticket.id);
-        const qrSrc = `https://api.qrserver.com/v1/create-qr-code/?size=220x220&data=${qrData}`;
-
-        w.document.write(`<!doctype html><html><head><title>Ticket</title>
-<style>
-  @page { size: A6; margin: 6mm; }
-  * { box-sizing: border-box; }
-  body { font-family: Arial, Helvetica, sans-serif; margin: 0; padding: 0; }
-  .ticket { border: 1.5px solid #222; border-radius: 3mm; padding: 5mm; height: calc(148mm - 12mm); display: flex; flex-direction: column; justify-content: space-between; }
-  .evt { font-weight: bold; font-size: 15pt; line-height: 1.2; }
-  .date { font-size: 10pt; color: #555; margin-top: 2mm; }
-  .type { font-size: 12pt; margin-top: 2mm; color: #222; }
-  .holder { font-size: 10pt; margin-top: 1mm; color: #555; }
-  .qty { font-size: 10pt; margin-top: 1mm; }
-  .qrwrap { display: flex; justify-content: center; align-items: center; flex: 1; }
-  .qrwrap img { width: 55mm; height: 55mm; display: block; }
-  .meta { font-size: 9pt; text-align: center; color: #666; word-break: break-all; }
-</style>
-</head><body>
-<div class="ticket">
-  <div>
-    <div class="evt">${eventTitle}</div>
-    ${dateStr ? `<div class="date">${dateStr}</div>` : ""}
-    <div class="type">${type}</div>
-    ${holder ? `<div class="holder">${holder}</div>` : ""}
-    <div class="qty">Qty: <strong>${qty}</strong></div>
-  </div>
-  <div class="qrwrap"><img src="${qrSrc}" alt="QR" /></div>
-  <div class="meta">${ticket.id}</div>
-</div>
-<script>
-(function(){
-  function go(){
-    var imgs=Array.prototype.slice.call(document.images);
-    if(!imgs.length){window.print();return;}
-    var n=imgs.length;
-    function done(){if(--n<=0)setTimeout(function(){window.print();},150);}
-    imgs.forEach(function(i){if(i.complete)done();else{i.addEventListener('load',done,{once:true});i.addEventListener('error',done,{once:true});}});
-  }
-  if(document.readyState==='complete')go();else window.addEventListener('load',go);
-})();
-</script>
-</body></html>`);
-        w.document.close();
-        w.focus();
-    };
+    const print = (ticket: TicketRecord) => printTicketCards([ticket], (t) => t.user?.name);
 
     return (
         <div className="border rounded-xl p-4 bg-white shadow-sm">
@@ -1104,10 +1046,14 @@ function DoorCheckInPanel({ token, eventId, registration, setError, setInfo }: {
         );
     }
 
+    // Multi-day events: check-in is per session, so only today's session's check-ins count.
+    const session = todaysSession(ticketsForEvent[0]?.event);
     const myTickets = ticketsForEvent
         .filter(t => t.registrationOption?.registration?.id === registration.id)
         .map(t => {
-            const totalRedeemed = (t.usages || []).reduce((s, u) => s + (u.quantityRedeemed || 1), 0);
+            const totalRedeemed = (t.usages || [])
+                .filter(u => !session || u.sessionId === session.id)
+                .reduce((s, u) => s + (u.quantityRedeemed || 1), 0);
             const remaining = (t.quantity || 1) - totalRedeemed;
             return { ...t, totalRedeemed, remaining };
         });
@@ -1139,7 +1085,7 @@ function DoorCheckInPanel({ token, eventId, registration, setError, setInfo }: {
     return (
         <div className="border rounded-xl p-6 bg-white shadow-sm">
 
-            <div className="text-xl font-semibold mb-4">Check-In</div>
+            <div className="text-xl font-semibold mb-4">Check-In{session ? <span className="ml-2 text-sm font-normal text-gray-500">{session.label || "Today's session"}</span> : null}</div>
 
             {/* ✅ User */}
             <div className="mb-4">

frontend/src/app/dashboard/supervisor/attendance/page.tsx

@@ -0,0 +1,291 @@
+"use client";
+
+import React, { Suspense, useCallback, useEffect, useMemo, useState } from "react";
+import { useRouter, useSearchParams } from "next/navigation";
+import { ClipboardCheck, Check, Download, FileSpreadsheet, FileText, Send, Award, Search, Ban } from "lucide-react";
+import { useAuth } from "@/hooks/useAuth";
+import { apiFetch, API_BASE } from "@/lib/api";
+import { useDismissingState } from "@/hooks/useDismissingState";
+import { errorMessage } from "@/lib/utils";
+import { formatDate } from "@/lib/date";
+import { fetchApiFile, saveBlob } from "@/lib/export";
+import type { AttendanceRegister, AttendanceRow, Event } from "@/types";
+import { BackLink } from "@/components/shared/BackLink";
+
+type Filter = "all" | "completed" | "not_completed" | "missed_recent";
+
+const colDate = new Intl.DateTimeFormat("en-GB", { weekday: "short", day: "numeric", month: "short" });
+
+function AttendancePageInner() {
+  const { user, loading, token } = useAuth();
+  const router = useRouter();
+  const search = useSearchParams();
+  const canView = ["admin", "supervisor", "staff"].includes(user?.role || "");
+  const canManage = user?.role === "admin" || user?.role === "supervisor";
+
+  useEffect(() => {
+    if (loading) return;
+    if (!user) router.replace("/login");
+  }, [user, loading, router]);
+
+  const [events, setEvents] = useState<Event[]>([]);
+  const [eventId, setEventId] = useState(search.get("eventId") || "");
+  const [reg, setReg] = useState<AttendanceRegister | null>(null);
+  const [busy, setBusy] = useState(false);
+  const [pending, setPending] = useState<string | null>(null);
+  const [query, setQuery] = useState("");
+  const [filter, setFilter] = useState<Filter>("all");
+  const [showCancelled, setShowCancelled] = useState(false);
+  const [error, setError] = useDismissingState<string | null>(null);
+  const [info, setInfo] = useDismissingState<string | null>(null);
+
+  useEffect(() => {
+    if (!token || !canView) return;
+    apiFetch<Event[]>("/api/events/all?includePast=true", { authToken: token })
+      .then(evs => {
+        // Multi-day events first (that's what the register is mostly for), newest first.
+        const list = (evs || []).filter(e => e.requiresRegistration !== false)
+          .sort((a, b) => Number(b.scheduleType === "sessions") - Number(a.scheduleType === "sessions") || new Date(b.startDate).getTime() - new Date(a.startDate).getTime());
+        setEvents(list);
+        if (!eventId && list.length) setEventId(list[0].id);
+      })
+      .catch(e => setError(errorMessage(e) || "Failed to load events"));
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [token, canView]);
+
+  const load = useCallback(async () => {
+    if (!token || !eventId) return;
+    setBusy(true);
+    try {
+      setReg(await apiFetch<AttendanceRegister>(`/api/attendance/${encodeURIComponent(eventId)}`, { authToken: token }));
+    } catch (e) {
+      setError(errorMessage(e) || "Failed to load the register");
+    } finally {
+      setBusy(false);
+    }
+  }, [token, eventId, setError]);
+  useEffect(() => { load(); }, [load]);
+
+  const columns = useMemo(() => (reg?.columns || []).filter(c => showCancelled || !c.cancelled), [reg, showCancelled]);
+  const multi = reg?.event.scheduleType === "sessions";
+  // Sessions already held (for "missed the last two").
+  const heldIds = useMemo(() => (reg?.columns || []).filter(c => !c.cancelled && new Date(c.startsAt).getTime() < Date.now()).map(c => c.id), [reg]);
+
+  const rows = useMemo(() => {
+    const q = query.trim().toLowerCase();
+    return (reg?.rows || []).filter(r => {
+      if (q && ![r.name, r.bookedBy, r.email, r.phone].some(v => v?.toLowerCase().includes(q))) return false;
+      if (filter === "completed") return r.completed;
+      if (filter === "not_completed") return !r.completed;
+      if (filter === "missed_recent") {
+        const lastTwo = heldIds.slice(-2);
+        return lastTwo.length > 0 && lastTwo.every(id => !r.checkIns[id]);
+      }
+      return true;
+    });
+  }, [reg, query, filter, heldIds]);
+
+  const toggle = async (row: AttendanceRow, sessionId: string) => {
+    if (!canManage || !token) return;
+    const present = !row.checkIns[sessionId];
+    const key = `${row.ticketId}:${sessionId}`;
+    setPending(key);
+    try {
+      await apiFetch(`/api/attendance/${eventId}/mark`, { method: "POST", authToken: token, body: { ticketId: row.ticketId, sessionId, present } });
+      const col = reg?.columns.find(c => c.id === sessionId);
+      setInfo(`${row.name || "Attendee"} marked ${present ? "present" : "absent"}${multi && col ? ` for ${col.label}` : ""}.`);
+      await load();
+    } catch (e) {
+      setError(errorMessage(e) || "Couldn't update attendance");
+    } finally {
+      setPending(null);
+    }
+  };
+
+  const post = async (path: string, body: object, done: (r: Record<string, number>) => string) => {
+    if (!token) return;
+    setBusy(true);
+    try {
+      const r = await apiFetch<Record<string, number>>(path, { method: "POST", authToken: token, body });
+      setInfo(done(r));
+      await load();
+    } catch (e) {
+      setError(errorMessage(e) || "Something went wrong");
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  const download = async (path: string, filename: string) => {
+    if (!token) return;
+    try {
+      saveBlob(await fetchApiFile(API_BASE, token, path), filename);
+    } catch (e) {
+      setError(errorMessage(e) || "Download failed");
+    }
+  };
+
+  const safeTitle = (reg?.event.title || "event").replace(/[^a-z0-9 -]/gi, "").slice(0, 60);
+  const certsOn = !!reg?.event.certificatesEnabled;
+  const issued = (reg?.rows || []).filter(r => r.certificate && !r.certificate.revokedAt).length;
+  const unsent = (reg?.rows || []).filter(r => r.certificate && !r.certificate.revokedAt && !r.certificate.emailedAt).length;
+  const completed = (reg?.rows || []).filter(r => r.completed).length;
+
+  return (
+    <div className="max-w-7xl mx-auto w-full p-6">
+      <div className="flex items-center gap-3 mb-4">
+        <div className="w-10 h-10 rounded-xl bg-brand-50 flex items-center justify-center shrink-0">
+          <ClipboardCheck className="w-5 h-5 text-brand-600" />
+        </div>
+        <div>
+          <BackLink href="/dashboard" />
+          <h1 className="text-2xl font-semibold text-gray-900 mt-0.5">Attendance</h1>
+          <p className="text-sm text-gray-500">Who came to each session, and completion certificates</p>
+        </div>
+      </div>
+
+      {!canView && <div className="p-3 border rounded bg-yellow-50 text-yellow-800 text-sm mb-4">You need staff access to view attendance.</div>}
+      {error && <div className="mb-3 p-3 border rounded bg-red-50 text-red-800 text-sm">{error}</div>}
+      {info && <div className="mb-3 p-3 border rounded bg-green-50 text-green-800 text-sm">{info}</div>}
+
+      {canView && (
+        <div className="border rounded-xl p-4 bg-white shadow-sm space-y-4">
+          <div className="flex flex-wrap items-end gap-3">
+            <div>
+              <label className="block text-xs text-gray-600 mb-1">Event</label>
+              <select className="border rounded-lg px-3 py-2 text-sm min-w-[16rem] max-w-full" value={eventId} onChange={e => setEventId(e.target.value)}>
+                {events.length === 0 && <option value="">No events</option>}
+                {events.map(ev => (
+                  <option key={ev.id} value={ev.id}>{ev.title} ({formatDate(new Date(ev.startDate))}{ev.scheduleType === "sessions" ? ` · ${(ev.sessions || []).filter(s => !s.cancelled).length} sessions` : ""})</option>
+                ))}
+              </select>
+            </div>
+            <div className="relative">
+              <Search className="w-4 h-4 text-gray-400 absolute left-2.5 top-1/2 -translate-y-1/2" />
+              <input className="border rounded-lg pl-8 pr-3 py-2 text-sm w-56" placeholder="Search name, email, phone" value={query} onChange={e => setQuery(e.target.value)} />
+            </div>
+            <select className="border rounded-lg px-3 py-2 text-sm" value={filter} onChange={e => setFilter(e.target.value as Filter)}>
+              <option value="all">Everyone</option>
+              <option value="completed">Completed</option>
+              <option value="not_completed">Not completed</option>
+              {multi && <option value="missed_recent">Missed the last two sessions</option>}
+            </select>
+            {multi && (reg?.columns || []).some(c => c.cancelled) && (
+              <label className="flex items-center gap-1.5 text-sm text-gray-600">
+                <input type="checkbox" checked={showCancelled} onChange={e => setShowCancelled(e.target.checked)} /> Show cancelled sessions
+              </label>
+            )}
+            <div className="ml-auto flex flex-wrap gap-2">
+              <button type="button" disabled={!reg} onClick={() => download(`/api/attendance/${eventId}/export?format=xlsx`, `Attendance - ${safeTitle}.xlsx`)} className="inline-flex items-center gap-1.5 px-3 py-2 text-sm rounded-lg border bg-white hover:bg-gray-50 disabled:opacity-50"><FileSpreadsheet className="w-4 h-4" /> Excel</button>
+              <button type="button" disabled={!reg} onClick={() => download(`/api/attendance/${eventId}/export?format=pdf`, `Attendance - ${safeTitle}.pdf`)} className="inline-flex items-center gap-1.5 px-3 py-2 text-sm rounded-lg border bg-white hover:bg-gray-50 disabled:opacity-50"><FileText className="w-4 h-4" /> PDF</button>
+            </div>
+          </div>
+
+          {reg && (
+            <div className="flex flex-wrap gap-2 text-xs">
+              <span className="px-2 py-1 rounded bg-gray-100 text-gray-700">{reg.rows.length} attendee{reg.rows.length === 1 ? "" : "s"}</span>
+              <span className="px-2 py-1 rounded bg-green-50 text-green-800">{completed} completed</span>
+              {certsOn && <span className="px-2 py-1 rounded bg-brand-50 text-brand-800">{issued} certificate{issued === 1 ? "" : "s"} issued</span>}
+              {!multi && <span className="px-2 py-1 rounded bg-gray-50 text-gray-500">Single-date event — one check-in column</span>}
+            </div>
+          )}
+
+          {reg && certsOn && canManage && (
+            <div className="flex flex-wrap items-center gap-2 p-3 rounded-lg bg-brand-50/50 border border-brand-100">
+              <Award className="w-4 h-4 text-brand-600" />
+              <span className="text-sm text-gray-700 mr-auto">Certificates are issued automatically when the event ends. You can also:</span>
+              <button type="button" disabled={busy} onClick={() => post(`/api/attendance/${eventId}/certificates`, {}, r => `${r.issued} certificate${r.issued === 1 ? "" : "s"} issued.`)} className="px-3 py-1.5 text-xs rounded bg-brand-600 text-white hover:bg-brand-700 disabled:opacity-50">Issue now</button>
+              <button type="button" disabled={busy || unsent === 0} onClick={() => post(`/api/attendance/${eventId}/certificates/send`, {}, r => `${r.sent} certificate${r.sent === 1 ? "" : "s"} sent${r.skipped ? `, ${r.skipped} couldn't be sent` : ""}.`)} className="inline-flex items-center gap-1 px-3 py-1.5 text-xs rounded border bg-white hover:bg-gray-50 disabled:opacity-50"><Send className="w-3.5 h-3.5" /> Send unsent ({unsent})</button>
+              <button type="button" disabled={issued === 0} onClick={() => download(`/api/attendance/${eventId}/certificates.pdf`, `Certificates - ${safeTitle}.pdf`)} className="inline-flex items-center gap-1 px-3 py-1.5 text-xs rounded border bg-white hover:bg-gray-50 disabled:opacity-50"><Download className="w-3.5 h-3.5" /> Download all</button>
+            </div>
+          )}
+
+          {busy && !reg && <p className="text-sm text-gray-500">Loading…</p>}
+          {reg && rows.length === 0 && <p className="text-sm text-gray-500 py-6 text-center">{reg.rows.length === 0 ? "No tickets for this event yet." : "Nobody matches."}</p>}
+
+          {reg && rows.length > 0 && (
+            <div className="overflow-x-auto border rounded-lg">
+              <table className="min-w-full text-sm">
+                <thead className="bg-gray-50 text-xs text-gray-600">
+                  <tr>
+                    <th className="sticky left-0 z-10 bg-gray-50 text-left font-medium px-3 py-2 min-w-[12rem]">Name</th>
+                    {columns.map(c => (
+                      <th key={c.id} className={`font-medium px-2 py-2 text-center whitespace-nowrap ${c.cancelled ? "text-gray-400 line-through" : ""}`}>
+                        <div>{c.label}</div>
+                        <div className="text-[10px] font-normal text-gray-400">{multi ? colDate.format(new Date(c.startsAt)) : ""}</div>
+                      </th>
+                    ))}
+                    <th className="font-medium px-2 py-2 text-center">Total</th>
+                    {certsOn && <th className="font-medium px-3 py-2 text-left">Certificate</th>}
+                  </tr>
+                </thead>
+                <tbody className="divide-y">
+                  {rows.map(r => (
+                    <tr key={r.ticketId} className="hover:bg-gray-50/60">
+                      <td className="sticky left-0 z-10 bg-white px-3 py-2">
+                        <div className="font-medium text-gray-900">{r.name || "—"}{r.quantity > 1 && <span className="ml-1 text-xs text-gray-500">×{r.quantity}</span>}</div>
+                        <div className="text-[11px] text-gray-500">{r.variant ? `${r.option} — ${r.variant}` : r.option}{r.bookedBy ? ` · booked by ${r.bookedBy}` : ""}</div>
+                      </td>
+                      {columns.map(c => {
+                        const qty = r.checkIns[c.id] || 0;
+                        const key = `${r.ticketId}:${c.id}`;
+                        const disabled = !canManage || c.cancelled || pending !== null || reg.event.cashupStatus === "closed";
+                        return (
+                          <td key={c.id} className="px-2 py-2 text-center">
+                            <button type="button" disabled={disabled} onClick={() => toggle(r, c.id)}
+                              title={canManage ? (qty ? "Present — click to mark absent" : "Absent — click to mark present") : undefined}
+                              className={`inline-flex items-center justify-center w-7 h-7 rounded-md border text-xs ${qty ? "bg-green-50 border-green-300 text-green-700" : "bg-white border-gray-200 text-gray-300"} ${disabled ? "cursor-default" : "hover:border-brand-400"} ${pending === key ? "opacity-50" : ""}`}>
+                              {qty ? (r.quantity > 1 ? qty : <Check className="w-4 h-4" />) : "·"}
+                            </button>
+                          </td>
+                        );
+                      })}
+                      <td className="px-2 py-2 text-center">
+                        <span className={`text-xs font-medium px-1.5 py-0.5 rounded ${r.completed ? "bg-green-50 text-green-800" : "text-gray-600"}`}>{r.attended}/{r.total}</span>
+                      </td>
+                      {certsOn && (
+                        <td className="px-3 py-2 whitespace-nowrap">
+                          {r.certificate && !r.certificate.revokedAt ? (
+                            <div className="flex items-center gap-2 text-xs">
+                              <span className="font-mono text-gray-700">{r.certificate.code}</span>
+                              <button type="button" className="text-brand-700 hover:underline" onClick={() => download(`/api/attendance/certificates/${r.certificate!.id}/pdf`, `Certificate - ${r.name}.pdf`)}>PDF</button>
+                              {canManage && <button type="button" className="text-brand-700 hover:underline" onClick={() => post(`/api/attendance/${eventId}/certificates/send`, { certificateId: r.certificate!.id }, x => (x.sent ? `Certificate sent to ${r.name}.` : `Couldn't send — ${r.name} has no email or WhatsApp on file.`))}>{r.certificate.emailedAt ? "Resend" : "Send"}</button>}
+                              {canManage && <button type="button" className="text-red-600 hover:underline inline-flex items-center gap-0.5" onClick={() => post(`/api/attendance/certificates/${r.certificate!.id}/revoke`, {}, () => `Certificate for ${r.name} revoked.`)}><Ban className="w-3 h-3" />Revoke</button>}
+                            </div>
+                          ) : canManage ? (
+                            <button type="button" className="text-xs text-brand-700 hover:underline" onClick={() => post(`/api/attendance/${eventId}/certificates`, { ticketId: r.ticketId }, () => `Certificate issued to ${r.name}.`)}>
+                              {r.certificate?.revokedAt ? "Re-issue" : r.completed ? "Issue" : "Issue anyway"}
+                            </button>
+                          ) : <span className="text-xs text-gray-400">—</span>}
+                        </td>
+                      )}
+                    </tr>
+                  ))}
+                </tbody>
+                <tfoot className="bg-gray-50 text-xs text-gray-600">
+                  <tr>
+                    <td className="sticky left-0 bg-gray-50 px-3 py-2 font-medium">Present</td>
+                    {columns.map(c => <td key={c.id} className="px-2 py-2 text-center font-medium">{c.cancelled ? "—" : reg.totals[c.id] || 0}</td>)}
+                    <td />
+                    {certsOn && <td />}
+                  </tr>
+                </tfoot>
+              </table>
+            </div>
+          )}
+          {reg && canManage && (
+            <p className="text-[11px] text-gray-400">Click a box to mark someone present or absent (e.g. they were let in without a scan). Changes are recorded in the audit log.</p>
+          )}
+        </div>
+      )}
+    </div>
+  );
+}
+
+export default function AttendancePage() {
+  return (
+    <Suspense fallback={null}>
+      <AttendancePageInner />
+    </Suspense>
+  );
+}

frontend/src/app/dashboard/supervisor/bundles/page.tsx

@@ -5,11 +5,10 @@ import { useAuth } from "@/hooks/useAuth";
 import { useRouter } from "next/navigation";
 import { apiFetch } from "@/lib/api";
 import { useDismissingState } from "@/hooks/useDismissingState";
-import { Gift, Plus, X, Trash2 } from "lucide-react";
-import { Table, TableHeader, TableBody, TableRow, TableHead, TableCell } from "@/components/ui/table";
+import { Gift, Plus, X, Trash2, Pencil, Power, CalendarClock } from "lucide-react";
 import { errorMessage } from "@/lib/utils";
 import { BackLink } from "@/components/shared/BackLink";
-import type { EventBundle } from "@/types";
+import type { BundleGroupPricing, BundleKind, EventBundle } from "@/types";
 
 type OptionLite = { id: string; name: string; price: number; variants?: { id: string; name: string; price?: number | null }[] };
 type EventLite = { id: string; title: string; startDate: string; endDate?: string; eventOptions: OptionLite[] };
@@ -18,7 +17,11 @@ type ItemDraft = { eventOptionId: string; variantId: string | null; quantity: st
 type Draft = {
   name: string;
   description: string;
+  kind: BundleKind;
   price: string;
+  setSize: string;
+  freeCount: string;
+  groupPricing: BundleGroupPricing;
   items: ItemDraft[];
   validFrom: string;
   validUntil: string;
@@ -26,7 +29,7 @@ type Draft = {
 };
 
 const blankDraft = (options: OptionLite[]): Draft => ({
-  name: "", description: "", price: "",
+  name: "", description: "", kind: "exact", price: "", setSize: "4", freeCount: "1", groupPricing: "per_ticket",
   items: options.slice(0, 2).map(o => ({ eventOptionId: o.id, variantId: null, quantity: "1" })),
   validFrom: "", validUntil: "", isActive: true,
 });
@@ -40,14 +43,27 @@ const toLocalInput = (iso: string | null | undefined) => {
 };
 
 const draftFromBundle = (b: EventBundle): Draft => ({
-  name: b.name, description: b.description || "", price: String(b.price),
+  name: b.name, description: b.description || "", kind: b.kind || "exact",
+  price: b.kind === "free" ? "" : String(b.price),
+  setSize: b.setSize ? String(b.setSize) : "4", freeCount: b.freeCount ? String(b.freeCount) : "1",
+  groupPricing: b.groupPricing || "per_ticket",
   items: b.items.map(i => ({ eventOptionId: i.eventOptionId, variantId: i.variantId || null, quantity: String(i.quantity) })),
   validFrom: toLocalInput(b.validFrom), validUntil: toLocalInput(b.validUntil), isActive: b.isActive,
 });
 
 const fmtDate = (iso: string | null | undefined) => (iso ? new Date(iso).toLocaleDateString(undefined, { day: "numeric", month: "short", year: "numeric" }) : "");
 const fmtRand = (n: number) => `R ${(n || 0).toFixed(2)}`;
-const inputCls = "w-full border rounded-lg px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-brand-400";
+// fieldCls has no width, for fields sized by their row (inputCls is full width).
+const fieldCls = "border rounded-lg px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-brand-400";
+const inputCls = `w-full ${fieldCls}`;
+const isPast = (ev: EventLite) => new Date(ev.endDate || ev.startDate).getTime() < Date.now();
+
+const KIND_INFO: Record<BundleKind, { label: string; hint: string; example: string }> = {
+  exact: { label: "Exact set", hint: "These tickets in these numbers", example: "2 adults + 3 kids for R220" },
+  mix: { label: "Pick any", hint: "Any mix of the chosen tickets", example: "Any 4 tickets for R250" },
+  free: { label: "Buy X get Y free", hint: "Cheapest ones in each set are free", example: "Buy 3, get 1 free" },
+  group: { label: "Group discount", hint: "A lower price from a group size up", example: "10+ tickets: R70 each" },
+};
 
 /** Standard price of one unit of an item (variant price, else the option's). */
 function unitPrice(options: OptionLite[], item: { eventOptionId: string; variantId: string | null }) {
@@ -75,7 +91,8 @@ export default function BundlesPage() {
     if (!user) router.replace("/login");
   }, [user, loading, router]);
 
-  const [events, setEvents] = useState<EventLite[]>([]);
+  const [allEvents, setAllEvents] = useState<EventLite[]>([]);
+  const [showPast, setShowPast] = useState(false);
   const [eventId, setEventId] = useState("");
   const [bundles, setBundles] = useState<EventBundle[]>([]);
   const [fetching, setFetching] = useState(false);
@@ -86,20 +103,27 @@ export default function BundlesPage() {
   useEffect(() => {
     if (!token || !canView) return;
     apiFetch<EventLite[]>("/api/events/all?includePast=true", { authToken: token })
-      .then(list => {
-        const sorted = (list || []).slice().sort((a, b) => new Date(b.startDate).getTime() - new Date(a.startDate).getTime());
-        setEvents(sorted);
-        // Start on the next upcoming event, the one most likely to need a deal.
-        const upcoming = sorted.filter(e => new Date(e.endDate || e.startDate).getTime() >= Date.now());
-        setEventId(prev => prev || (upcoming[upcoming.length - 1] || sorted[0])?.id || "");
-      })
+      .then(list => setAllEvents(list || []))
       .catch(e => setError(errorMessage(e) || "Failed to load events"));
   }, [token, canView, setError]);
 
+  // Upcoming events soonest first; past ones (when shown) after them, most recent first.
+  const events = useMemo(() => {
+    const upcoming = allEvents.filter(e => !isPast(e)).sort((a, b) => new Date(a.startDate).getTime() - new Date(b.startDate).getTime());
+    const past = allEvents.filter(isPast).sort((a, b) => new Date(b.startDate).getTime() - new Date(a.startDate).getTime());
+    return showPast ? [...upcoming, ...past] : upcoming;
+  }, [allEvents, showPast]);
+
+  // Keep the picked event while it's in the list; otherwise start on the next upcoming one.
+  useEffect(() => {
+    if (!events.some(e => e.id === eventId)) setEventId(events[0]?.id || "");
+  }, [events, eventId]);
+
   const event = events.find(e => e.id === eventId) || null;
+  const options = event?.eventOptions || [];
 
   const load = useCallback(async () => {
-    if (!token || !eventId) return;
+    if (!token || !eventId) { setBundles([]); return; }
     setFetching(true);
     try {
       setBundles(await apiFetch<EventBundle[]>(`/api/bundles/event/${eventId}`, { authToken: token }) || []);
@@ -133,9 +157,12 @@ export default function BundlesPage() {
     }
   };
 
+  const startNew = () => setEditing({ id: null, draft: blankDraft(options) });
+  const canAdd = !!event && options.length > 0;
+
   return (
-    <div className="max-w-6xl mx-auto w-full p-6">
-      <div className="flex items-center justify-between gap-3 mb-4 flex-wrap">
+    <div className="max-w-6xl mx-auto w-full p-4 sm:p-6">
+      <div className="flex flex-col sm:flex-row sm:items-center sm:justify-between gap-3 mb-4">
         <div className="flex items-center gap-3">
           <div className="w-10 h-10 rounded-xl bg-brand-50 flex items-center justify-center shrink-0">
             <Gift className="w-5 h-5 text-brand-600" />
@@ -143,14 +170,14 @@ export default function BundlesPage() {
           <div>
             <BackLink href="/dashboard" />
             <h1 className="text-2xl font-semibold text-gray-900 mt-0.5">Bundle deals</h1>
-            <p className="text-sm text-gray-500">Sell a set of tickets together for one price, e.g. 5 adults + 3 children for R500</p>
+            <p className="text-sm text-gray-500">Tickets sold together for one price</p>
           </div>
         </div>
-        {canView && event && (
+        {canView && (
           <button
-            onClick={() => setEditing({ id: null, draft: blankDraft(event.eventOptions || []) })}
-            disabled={(event.eventOptions || []).length === 0}
-            className="inline-flex items-center gap-2 px-4 py-2 rounded-lg bg-brand-600 text-white text-sm font-medium hover:bg-brand-700 disabled:opacity-50"
+            onClick={startNew}
+            disabled={!canAdd}
+            className="inline-flex items-center justify-center gap-2 px-4 py-2 rounded-lg bg-brand-600 text-white text-sm font-medium hover:bg-brand-700 disabled:opacity-50 w-full sm:w-auto"
           >
             <Plus className="w-4 h-4" /> New bundle
           </button>
@@ -165,70 +192,56 @@ export default function BundlesPage() {
 
       {canView && (
         <div className="border rounded-xl p-4 bg-white shadow-sm">
-          <div className="mb-3 w-full sm:w-96">
-            <label className="block text-sm font-medium text-gray-700 mb-1">Event</label>
-            <select className={inputCls} value={eventId} onChange={e => setEventId(e.target.value)}>
-              {events.map(ev => <option key={ev.id} value={ev.id}>{ev.title} · {fmtDate(ev.startDate)}</option>)}
-            </select>
+          <div className="flex flex-col sm:flex-row sm:items-end gap-3 mb-4">
+            <div className="w-full sm:w-auto">
+              <label className="block text-xs text-gray-600 mb-1">Event</label>
+              <select className="border rounded-lg px-3 py-2 text-sm w-full sm:min-w-[20rem]" value={eventId} onChange={e => setEventId(e.target.value)}>
+                {events.length === 0 && <option value="">{showPast ? "No events" : "No upcoming events"}</option>}
+                {events.map(ev => (
+                  <option key={ev.id} value={ev.id}>{ev.title} ({fmtDate(ev.startDate)}){isPast(ev) ? " · past" : ""}</option>
+                ))}
+              </select>
+            </div>
+            <label className="flex items-center gap-2 text-sm text-gray-700 sm:pb-2">
+              <input type="checkbox" checked={showPast} onChange={e => setShowPast(e.target.checked)} /> Show past events
+            </label>
           </div>
-          <p className="text-xs text-gray-500 mb-3">
-            Bundles apply automatically, as many times as someone&apos;s tickets allow, and only when they&apos;re cheaper than the tickets
-            at today&apos;s prices (early-bird or staff prices included). Coupon codes come off afterwards.
-          </p>
 
-          <div className="overflow-x-auto">
-            <Table>
-              <TableHeader>
-                <TableRow>
-                  <TableHead>Bundle</TableHead>
-                  <TableHead>Price</TableHead>
-                  <TableHead>Used</TableHead>
-                  <TableHead>Available</TableHead>
-                  <TableHead>Status</TableHead>
-                  <TableHead className="text-right">Actions</TableHead>
-                </TableRow>
-              </TableHeader>
-              <TableBody>
-                {bundles.map(b => {
-                  const status = bundleStatus(b);
-                  const save = b.standardValue - b.price;
-                  return (
-                    <TableRow key={b.id}>
-                      <TableCell>
-                        <div className="font-semibold text-gray-900">{b.name}</div>
-                        <div className="text-xs text-gray-600">{b.summary}</div>
-                        {b.description && <div className="text-xs text-gray-500">{b.description}</div>}
-                      </TableCell>
-                      <TableCell className="text-sm">
-                        {fmtRand(b.price)}
-                        <div className={`text-xs ${save > 0 ? "text-green-700" : "text-amber-700"}`}>
-                          {save > 0 ? `Saves ${fmtRand(save)} on ${fmtRand(b.standardValue)}` : `No saving on ${fmtRand(b.standardValue)}`}
-                        </div>
-                      </TableCell>
-                      <TableCell className="text-sm">
-                        {b.uses || 0}× <span className="text-xs text-gray-500">on {b.registrations || 0} registration{b.registrations === 1 ? "" : "s"}</span>
-                        <div className="text-xs text-gray-500">{fmtRand(b.totalDiscount || 0)} given</div>
-                      </TableCell>
-                      <TableCell className="text-xs text-gray-600">
-                        {b.validFrom || b.validUntil ? `${b.validFrom ? fmtDate(b.validFrom) : "Now"} – ${b.validUntil ? fmtDate(b.validUntil) : "no end"}` : "Always"}
-                      </TableCell>
-                      <TableCell><span className={`text-xs px-2 py-0.5 rounded-full font-medium ${status.cls}`}>{status.label}</span></TableCell>
-                      <TableCell className="text-right whitespace-nowrap">
-                        <button className="px-2 py-1 text-xs rounded border hover:bg-gray-50 mr-1" onClick={() => setEditing({ id: b.id, draft: draftFromBundle(b) })}>Edit</button>
-                        <button className={`px-2 py-1 text-xs rounded text-white mr-1 ${b.isActive ? "bg-amber-500 hover:bg-amber-600" : "bg-green-600 hover:bg-green-700"}`} onClick={() => toggleActive(b)}>
-                          {b.isActive ? "Turn off" : "Turn on"}
-                        </button>
-                        <button className="px-2 py-1 text-xs rounded border text-red-700 hover:bg-red-50" onClick={() => remove(b)} aria-label={`Delete ${b.name}`}><Trash2 className="w-3.5 h-3.5" /></button>
-                      </TableCell>
-                    </TableRow>
-                  );
-                })}
-                {!fetching && bundles.length === 0 && (
-                  <TableRow><TableCell colSpan={6} className="text-center text-sm text-gray-500 py-8">{event ? "No bundle deals for this event yet." : "Choose an event."}</TableCell></TableRow>
-                )}
-              </TableBody>
-            </Table>
-          </div>
+          {event && options.length === 0 && (
+            <p className="text-sm text-gray-500 py-6 text-center">This event has no tickets yet. Add ticket options to the event first.</p>
+          )}
+
+          {event && options.length > 0 && !fetching && bundles.length === 0 && (
+            <div className="text-center py-10">
+              <div className="w-12 h-12 rounded-full bg-emerald-50 flex items-center justify-center mx-auto mb-3">
+                <Gift className="w-6 h-6 text-emerald-600" />
+              </div>
+              <p className="text-sm font-medium text-gray-900">No bundle deals for this event yet</p>
+              <p className="text-xs text-gray-500 mt-1 max-w-sm mx-auto">e.g. &quot;Family deal: 2 adults + 3 kids for R220&quot;. Buyers get it automatically when their tickets match.</p>
+              <button onClick={startNew} className="mt-4 inline-flex items-center gap-2 px-4 py-2 rounded-lg bg-brand-600 text-white text-sm font-medium hover:bg-brand-700">
+                <Plus className="w-4 h-4" /> Create a bundle
+              </button>
+            </div>
+          )}
+
+          {bundles.length > 0 && (
+            <div className="grid grid-cols-1 md:grid-cols-2 gap-3">
+              {bundles.map(b => (
+                <BundleCard
+                  key={b.id}
+                  bundle={b}
+                  onEdit={() => setEditing({ id: b.id, draft: draftFromBundle(b) })}
+                  onToggle={() => toggleActive(b)}
+                  onDelete={() => remove(b)}
+                />
+              ))}
+            </div>
+          )}
+
+          <p className="text-xs text-gray-500 mt-4">
+            Bundles apply automatically, as many times as someone&apos;s tickets allow, and only when cheaper than the tickets at the prices
+            actually charged (early-bird and staff prices included). Coupon codes come off afterwards.
+          </p>
         </div>
       )}
 
@@ -246,6 +259,76 @@ export default function BundlesPage() {
   );
 }
 
+function BundleCard({ bundle: b, onEdit, onToggle, onDelete }: { bundle: EventBundle; onEdit: () => void; onToggle: () => void; onDelete: () => void }) {
+  const status = bundleStatus(b);
+  const kind = b.kind || "exact";
+  const dates = b.validFrom || b.validUntil
+    ? `${b.validFrom ? fmtDate(b.validFrom) : "Now"} – ${b.validUntil ? fmtDate(b.validUntil) : "no end date"}`
+    : null;
+  return (
+    <div className={`border rounded-xl p-4 flex flex-col gap-3 ${b.isActive ? "bg-white" : "bg-gray-50"}`}>
+      <div className="flex items-start justify-between gap-3">
+        <div className="min-w-0">
+          <div className="font-semibold text-gray-900 break-words">{b.name}</div>
+          {b.description && <div className="text-xs text-gray-500 mt-0.5 break-words">{b.description}</div>}
+        </div>
+        <span className={`shrink-0 text-xs px-2 py-0.5 rounded-full font-medium ${status.cls}`}>{status.label}</span>
+      </div>
+
+      <div className="text-xs font-medium text-brand-700">{KIND_INFO[kind].label}{kind === "exact" ? "" : ` · ${kind === "group" ? "qualifying" : "any of"}:`}</div>
+
+      <div className="flex flex-wrap gap-1.5">
+        {b.items.map(i => (
+          <span key={i.id || `${i.eventOptionId}-${i.variantId}`} className="inline-flex items-center gap-1 rounded-full bg-emerald-50 text-emerald-800 border border-emerald-100 px-2.5 py-1 text-xs">
+            {kind === "exact" && <span className="font-semibold">{i.quantity} ×</span>} {i.eventOption?.name || "Ticket"}{i.variant ? ` (${i.variant.name})` : ""}
+          </span>
+        ))}
+      </div>
+
+      <div>
+        <div className="flex items-baseline flex-wrap gap-x-2 gap-y-0.5">
+          {kind === "exact" || kind === "mix" ? (
+            <>
+              <span className="text-xl font-semibold text-gray-900">{fmtRand(b.price)}</span>
+              <span className="text-sm text-gray-500">{kind === "mix" ? `for any ${b.setSize}` : "for the set"}</span>
+              {b.standardValue !== null && <span className="text-sm text-gray-400 line-through">{fmtRand(b.standardValue)}</span>}
+            </>
+          ) : kind === "free" ? (
+            <span className="text-xl font-semibold text-gray-900">Buy {(b.setSize || 0) - (b.freeCount || 0)}, get {b.freeCount} free</span>
+          ) : (
+            <>
+              <span className="text-xl font-semibold text-gray-900">{b.groupPricing === "percent" ? `${b.price}% off` : `${fmtRand(b.price)} each`}</span>
+              <span className="text-sm text-gray-500">from {b.setSize} tickets</span>
+            </>
+          )}
+        </div>
+        <div className={`text-xs font-medium ${b.savingText || kind === "free" || (kind === "group" && b.groupPricing === "percent") ? "text-green-700" : "text-amber-700"}`}>
+          {b.savingText || (kind === "free" || (kind === "group" && b.groupPricing === "percent") ? "" : "No saving at the standard prices")}
+        </div>
+      </div>
+
+      <div className="text-xs text-gray-600 space-y-0.5">
+        <div>
+          Used <strong>{b.uses || 0}×</strong> on {b.registrations || 0} registration{b.registrations === 1 ? "" : "s"} · {fmtRand(b.totalDiscount || 0)} given
+        </div>
+        {dates && <div className="flex items-center gap-1"><CalendarClock className="w-3.5 h-3.5" /> {dates}</div>}
+      </div>
+
+      <div className="flex flex-wrap gap-2 pt-1 border-t border-gray-100 mt-auto">
+        <button onClick={onEdit} className="inline-flex items-center gap-1.5 px-3 py-1.5 text-xs rounded-lg border hover:bg-gray-50 mt-2">
+          <Pencil className="w-3.5 h-3.5" /> Edit
+        </button>
+        <button onClick={onToggle} className={`inline-flex items-center gap-1.5 px-3 py-1.5 text-xs rounded-lg border mt-2 ${b.isActive ? "text-amber-700 border-amber-200 hover:bg-amber-50" : "text-green-700 border-green-200 hover:bg-green-50"}`}>
+          <Power className="w-3.5 h-3.5" /> {b.isActive ? "Turn off" : "Turn on"}
+        </button>
+        <button onClick={onDelete} className="inline-flex items-center gap-1.5 px-3 py-1.5 text-xs rounded-lg border text-red-700 border-red-200 hover:bg-red-50 mt-2 sm:ml-auto">
+          <Trash2 className="w-3.5 h-3.5" /> Delete
+        </button>
+      </div>
+    </div>
+  );
+}
+
 function BundleModal({ token, event, bundleId, initial, onClose, onSaved }: {
   token: string;
   event: EventLite;
@@ -261,8 +344,15 @@ function BundleModal({ token, event, bundleId, initial, onClose, onSaved }: {
   const options = event.eventOptions || [];
 
   const setItem = (i: number, patch: Partial<ItemDraft>) => set("items", d.items.map((it, j) => (j === i ? { ...it, ...patch } : it)));
-  const standardValue = d.items.reduce((s, it) => s + unitPrice(options, it) * (Number(it.quantity) || 0), 0);
-  const saving_ = standardValue - (Number(d.price) || 0);
+  const exact = d.kind === "exact";
+  const price = Number(d.price) || 0;
+  const size = Math.max(0, Math.floor(Number(d.setSize) || 0));
+  const free = Math.max(0, Math.floor(Number(d.freeCount) || 0));
+  const dearest = d.items.reduce((m, it) => Math.max(m, unitPrice(options, it)), 0);
+  // Exact: what the set costs separately. Pick any: the dearest possible set.
+  const standardValue = exact ? d.items.reduce((s, it) => s + unitPrice(options, it) * (Number(it.quantity) || 0), 0) : dearest * size;
+  const saving_ = standardValue - price;
+  const priceLabel = exact ? "Bundle price (R)" : d.kind === "mix" ? "Price for the set (R)" : d.groupPricing === "percent" ? "Percentage off (%)" : "Price per ticket (R)";
 
   const save = async (e: React.FormEvent) => {
     e.preventDefault();
@@ -272,8 +362,12 @@ function BundleModal({ token, event, bundleId, initial, onClose, onSaved }: {
       const body = {
         name: d.name.trim(),
         description: d.description.trim() || null,
-        price: Number(d.price),
-        items: d.items.map(it => ({ eventOptionId: it.eventOptionId, variantId: it.variantId, quantity: Number(it.quantity) })),
+        kind: d.kind,
+        price: d.kind === "free" ? 0 : Number(d.price),
+        setSize: exact ? null : Number(d.setSize),
+        freeCount: d.kind === "free" ? Number(d.freeCount) : null,
+        groupPricing: d.kind === "group" ? d.groupPricing : null,
+        items: d.items.map(it => ({ eventOptionId: it.eventOptionId, variantId: it.variantId, quantity: exact ? Number(it.quantity) : 1 })),
         validFrom: d.validFrom ? new Date(d.validFrom).toISOString() : null,
         validUntil: d.validUntil ? new Date(d.validUntil).toISOString() : null,
         isActive: d.isActive,
@@ -293,14 +387,17 @@ function BundleModal({ token, event, bundleId, initial, onClose, onSaved }: {
   };
 
   return (
-    <div className="fixed inset-0 z-50 bg-black/40 flex items-center justify-center p-4" onClick={onClose}>
-      <form onSubmit={save} className="bg-white rounded-xl shadow-xl w-full max-w-2xl max-h-[90vh] flex flex-col" onClick={e => e.stopPropagation()}>
-        <div className="flex items-center justify-between p-4 border-b">
-          <h2 className="font-semibold">{bundleId ? "Edit bundle" : "New bundle deal"} <span className="text-sm font-normal text-gray-500">· {event.title}</span></h2>
-          <button type="button" onClick={onClose} aria-label="Close"><X className="w-5 h-5 text-gray-500" /></button>
+    <div className="fixed inset-0 z-50 bg-black/40 flex items-end sm:items-center justify-center sm:p-4" onClick={onClose}>
+      <form onSubmit={save} className="bg-white w-full sm:max-w-2xl max-h-[92vh] sm:max-h-[90vh] rounded-t-2xl sm:rounded-xl shadow-xl flex flex-col" onClick={e => e.stopPropagation()}>
+        <div className="flex items-start justify-between gap-3 p-4 border-b">
+          <div className="min-w-0">
+            <h2 className="font-semibold">{bundleId ? "Edit bundle" : "New bundle deal"}</h2>
+            <p className="text-xs text-gray-500 truncate">{event.title}</p>
+          </div>
+          <button type="button" onClick={onClose} aria-label="Close" className="p-1 -m-1"><X className="w-5 h-5 text-gray-500" /></button>
         </div>
 
-        <div className="p-4 space-y-5 overflow-y-auto">
+        <div className="p-4 space-y-5 overflow-y-auto overflow-x-hidden overscroll-contain">
           <div className="grid grid-cols-1 sm:grid-cols-2 gap-4">
             <div>
               <label className="block text-sm font-medium text-gray-700 mb-1">Name</label>
@@ -308,76 +405,147 @@ function BundleModal({ token, event, bundleId, initial, onClose, onSaved }: {
               <p className="text-xs text-gray-500 mt-1">Shown to buyers and on receipts.</p>
             </div>
             <div>
-              <label className="block text-sm font-medium text-gray-700 mb-1">Description (optional)</label>
+              <label className="block text-sm font-medium text-gray-700 mb-1">Description <span className="font-normal text-gray-400">(optional)</span></label>
               <input className={inputCls} value={d.description} onChange={e => set("description", e.target.value)} placeholder="Bring the whole family" />
             </div>
           </div>
 
           <div>
-            <label className="block text-sm font-medium text-gray-700 mb-1">Tickets in the bundle</label>
+            <label className="block text-sm font-medium text-gray-700 mb-2">Type of deal</label>
+            <div className="grid grid-cols-2 gap-2">
+              {(Object.keys(KIND_INFO) as BundleKind[]).map(k => (
+                <button type="button" key={k} onClick={() => set("kind", k)} aria-pressed={d.kind === k}
+                  className={`text-left rounded-lg border p-2.5 transition-colors ${d.kind === k ? "border-brand-500 bg-brand-50 ring-1 ring-brand-500" : "hover:bg-gray-50"}`}>
+                  <div className="text-sm font-medium text-gray-900">{KIND_INFO[k].label}</div>
+                  <div className="text-xs text-gray-500">{KIND_INFO[k].hint}</div>
+                  <div className="text-[11px] text-gray-400 mt-0.5 hidden sm:block">e.g. {KIND_INFO[k].example}</div>
+                </button>
+              ))}
+            </div>
+          </div>
+
+          <div>
+            <label className="block text-sm font-medium text-gray-700 mb-2">{exact ? "Tickets in the bundle" : "Qualifying tickets"}</label>
+            {!exact && <p className="text-xs text-gray-500 -mt-1 mb-2">Any of these count towards the deal.</p>}
             <div className="space-y-2">
               {d.items.map((it, i) => {
                 const opt = options.find(o => o.id === it.eventOptionId);
+                const hasVariants = (opt?.variants || []).length > 0;
                 return (
-                  <div key={i} className="flex flex-wrap sm:flex-nowrap items-center gap-2">
-                    <input type="number" min="1" step="1" className={`${inputCls} w-20 shrink-0`} value={it.quantity} onChange={e => setItem(i, { quantity: e.target.value })} aria-label="Quantity" required />
-                    <span className="text-sm text-gray-500">×</span>
-                    <select className={`${inputCls} min-w-0`} value={it.eventOptionId} onChange={e => setItem(i, { eventOptionId: e.target.value, variantId: null })}>
-                      {options.map(o => <option key={o.id} value={o.id}>{o.name} ({fmtRand(o.price)})</option>)}
-                    </select>
-                    {(opt?.variants || []).length > 0 && (
-                      <select className={`${inputCls} min-w-0`} value={it.variantId || ""} onChange={e => setItem(i, { variantId: e.target.value || null })} aria-label="Variant">
-                        <option value="">Any variant</option>
+                  <div key={i} className="rounded-lg border bg-gray-50 p-2.5">
+                    <div className="flex items-center gap-2">
+                      {exact && (
+                        <>
+                          <input type="number" min="1" step="1" inputMode="numeric" className={`${fieldCls} w-16 shrink-0 px-2 bg-white text-center`} value={it.quantity} onChange={e => setItem(i, { quantity: e.target.value })} aria-label="Quantity" required />
+                          <span className="text-sm text-gray-500 shrink-0">×</span>
+                        </>
+                      )}
+                      <select className={`${fieldCls} min-w-0 flex-1 bg-white`} value={it.eventOptionId} onChange={e => setItem(i, { eventOptionId: e.target.value, variantId: null })} aria-label="Ticket">
+                        {options.map(o => <option key={o.id} value={o.id}>{o.name} ({fmtRand(o.price)})</option>)}
+                      </select>
+                      <button type="button" onClick={() => set("items", d.items.filter((_, j) => j !== i))} disabled={d.items.length <= 1}
+                        className="p-2 shrink-0 rounded-lg text-gray-400 hover:text-red-600 hover:bg-red-50 disabled:opacity-30 disabled:hover:bg-transparent" aria-label="Remove ticket">
+                        <Trash2 className="w-4 h-4" />
+                      </button>
+                    </div>
+                    {hasVariants && (
+                      <select className={`${inputCls} mt-2 bg-white`} value={it.variantId || ""} onChange={e => setItem(i, { variantId: e.target.value || null })} aria-label="Variant">
+                        <option value="">Any {opt?.name.toLowerCase()} variant</option>
                         {(opt?.variants || []).map(v => <option key={v.id} value={v.id}>{v.name}</option>)}
                       </select>
                     )}
-                    <button type="button" onClick={() => set("items", d.items.filter((_, j) => j !== i))} disabled={d.items.length <= 1}
-                      className="p-2 rounded border text-gray-500 hover:bg-gray-50 disabled:opacity-40" aria-label="Remove ticket">
-                      <X className="w-4 h-4" />
-                    </button>
                   </div>
                 );
               })}
             </div>
             <button type="button" onClick={() => set("items", [...d.items, { eventOptionId: options[0]?.id || "", variantId: null, quantity: "1" }])}
-              className="mt-2 inline-flex items-center gap-1 text-sm text-brand-700 hover:underline">
+              className="mt-2 inline-flex items-center gap-1 text-sm font-medium text-brand-700 hover:underline">
               <Plus className="w-4 h-4" /> Add a ticket type
             </button>
           </div>
 
-          <div className="grid grid-cols-1 sm:grid-cols-2 gap-4">
-            <div>
-              <label className="block text-sm font-medium text-gray-700 mb-1">Bundle price (R)</label>
-              <input type="number" min="0" step="0.01" className={inputCls} value={d.price} onChange={e => set("price", e.target.value)} required />
+          {!exact && (
+            <div className="grid grid-cols-2 gap-4">
+              <div>
+                <label className="block text-sm font-medium text-gray-700 mb-1">{d.kind === "group" ? "Minimum tickets" : "Tickets per set"}</label>
+                <input type="number" min={d.kind === "free" ? 2 : 2} step="1" inputMode="numeric" className={inputCls} value={d.setSize} onChange={e => set("setSize", e.target.value)} required />
+              </div>
+              {d.kind === "free" && (
+                <div>
+                  <label className="block text-sm font-medium text-gray-700 mb-1">Free in each set</label>
+                  <input type="number" min="1" step="1" inputMode="numeric" className={inputCls} value={d.freeCount} onChange={e => set("freeCount", e.target.value)} required />
+                </div>
+              )}
+              {d.kind === "group" && (
+                <div>
+                  <label className="block text-sm font-medium text-gray-700 mb-1">Group price</label>
+                  <select className={inputCls} value={d.groupPricing} onChange={e => set("groupPricing", e.target.value as BundleGroupPricing)}>
+                    <option value="per_ticket">Price per ticket</option>
+                    <option value="percent">Percentage off</option>
+                  </select>
+                </div>
+              )}
             </div>
-            <div className="flex items-end">
-              <div className={`text-sm ${saving_ > 0 ? "text-green-700" : "text-amber-700"}`}>
-                Separately: {fmtRand(standardValue)}
-                {d.price !== "" && (saving_ > 0 ? ` · saves ${fmtRand(saving_)}` : " · no saving at the standard price")}
+          )}
+
+          {d.kind === "free" ? (
+            <div className="rounded-lg bg-emerald-50 p-3 text-sm text-emerald-900">
+              {size > free && free > 0
+                ? <>Buy {size - free}, get {free} free. In every {size} qualifying tickets, the cheapest {free === 1 ? "one is" : `${free} are`} free.</>
+                : <span className="text-amber-700">The set needs more tickets than are free.</span>}
+            </div>
+          ) : (
+          <div>
+            <label className="block text-sm font-medium text-gray-700 mb-1">{priceLabel}</label>
+            <input type="number" min="0" max={d.kind === "group" && d.groupPricing === "percent" ? 100 : undefined} step="0.01" inputMode="decimal" className={`${inputCls} sm:max-w-[12rem]`} value={d.price} onChange={e => set("price", e.target.value)} required />
+            {d.kind === "group" ? (
+              <p className="text-xs text-gray-500 mt-2">
+                {size >= 2 ? `From ${size} qualifying tickets, every one of them ` : "Every qualifying ticket "}
+                {d.groupPricing === "percent" ? `gets ${d.price || "…"}% off.` : `costs ${d.price === "" ? "…" : fmtRand(price)} (tickets already cheaper stay as they are).`}
+              </p>
+            ) : (
+            <>
+            <div className="mt-2 grid grid-cols-3 gap-2 text-center">
+              <div className="rounded-lg bg-gray-50 p-2">
+                <div className="text-[11px] uppercase tracking-wide text-gray-500">{exact ? "Separately" : "Dearest set"}</div>
+                <div className="text-sm font-semibold text-gray-900">{fmtRand(standardValue)}</div>
+              </div>
+              <div className="rounded-lg bg-gray-50 p-2">
+                <div className="text-[11px] uppercase tracking-wide text-gray-500">Bundle</div>
+                <div className="text-sm font-semibold text-gray-900">{d.price === "" ? "—" : fmtRand(price)}</div>
+              </div>
+              <div className={`rounded-lg p-2 ${d.price !== "" && saving_ <= 0 ? "bg-amber-50" : "bg-emerald-50"}`}>
+                <div className="text-[11px] uppercase tracking-wide text-gray-500">Saving</div>
+                <div className={`text-sm font-semibold ${d.price !== "" && saving_ <= 0 ? "text-amber-700" : "text-emerald-700"}`}>{d.price === "" ? "—" : fmtRand(Math.max(0, saving_))}</div>
               </div>
             </div>
+            {d.price !== "" && saving_ <= 0 && <p className="text-xs text-amber-700 mt-1">The bundle isn&apos;t cheaper than the standard prices, so it won&apos;t apply unless prices change.</p>}
+            {!exact && <p className="text-xs text-gray-500 mt-1">The saving depends on which tickets are picked; it only applies when the set price is cheaper.</p>}
+            </>
+            )}
           </div>
+          )}
 
           <div className="grid grid-cols-1 sm:grid-cols-2 gap-4">
             <div>
-              <label className="block text-sm font-medium text-gray-700 mb-1">Available from</label>
+              <label className="block text-sm font-medium text-gray-700 mb-1">Available from <span className="font-normal text-gray-400">(optional)</span></label>
               <input type="datetime-local" className={inputCls} value={d.validFrom} onChange={e => set("validFrom", e.target.value)} />
             </div>
             <div>
-              <label className="block text-sm font-medium text-gray-700 mb-1">Available until</label>
+              <label className="block text-sm font-medium text-gray-700 mb-1">Available until <span className="font-normal text-gray-400">(optional)</span></label>
               <input type="datetime-local" className={inputCls} value={d.validUntil} onChange={e => set("validUntil", e.target.value)} />
             </div>
           </div>
 
-          <label className="flex items-center gap-2 text-sm text-gray-700">
-            <input type="checkbox" checked={d.isActive} onChange={e => set("isActive", e.target.checked)} /> On sale
+          <label className="flex items-start gap-2 text-sm text-gray-700">
+            <input type="checkbox" className="mt-0.5" checked={d.isActive} onChange={e => set("isActive", e.target.checked)} />
+            <span>On sale <span className="block text-xs text-gray-500">Registrations that already have this bundle keep it if you turn it off later.</span></span>
           </label>
-          <p className="text-xs text-gray-500 -mt-3">Registrations that already have this bundle keep it if you turn it off or change it later.</p>
 
           {error && <div className="p-3 border rounded bg-red-50 text-red-800 text-sm">{error}</div>}
         </div>
 
-        <div className="flex justify-end gap-3 p-4 border-t">
+        <div className="flex flex-col-reverse sm:flex-row sm:justify-end gap-2 sm:gap-3 p-4 border-t">
           <button type="button" onClick={onClose} className="px-4 py-2 rounded-lg bg-gray-100 text-sm font-medium hover:bg-gray-200">Cancel</button>
           <button type="submit" disabled={saving} className="px-4 py-2 rounded-lg bg-brand-600 text-white text-sm font-medium hover:bg-brand-700 disabled:opacity-50">
             {saving ? "Saving…" : bundleId ? "Save changes" : "Create bundle"}

frontend/src/app/dashboard/supervisor/coupons/page.tsx

@@ -5,8 +5,7 @@ import { useAuth } from "@/hooks/useAuth";
 import { useRouter } from "next/navigation";
 import { apiFetch } from "@/lib/api";
 import { useDismissingState } from "@/hooks/useDismissingState";
-import { TicketPercent, Plus, X, Search } from "lucide-react";
-import { Table, TableHeader, TableBody, TableRow, TableHead, TableCell } from "@/components/ui/table";
+import { TicketPercent, Plus, X, Search, Pencil, Power, Users, CalendarClock, ListChecks } from "lucide-react";
 import { errorMessage } from "@/lib/utils";
 import { BackLink } from "@/components/shared/BackLink";
 
@@ -17,6 +16,7 @@ type EventLite = {
   id: string;
   title: string;
   startDate: string;
+  endDate?: string;
   eventOptions: { id: string; name: string; variants?: { id: string; name: string }[] }[];
 };
 
@@ -122,17 +122,19 @@ function bodyFromDraft(d: Draft) {
   };
 }
 
-const fmtDate = (iso: string | null) => (iso ? new Date(iso).toLocaleDateString(undefined, { day: "numeric", month: "short", year: "numeric" }) : "");
+const fmtDate = (iso: string | null | undefined) => (iso ? new Date(iso).toLocaleDateString(undefined, { day: "numeric", month: "short", year: "numeric" }) : "");
 const fmtRand = (n: number) => `R ${(n || 0).toFixed(2)}`;
 const inputCls = "w-full border rounded-lg px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-brand-400";
+const isPast = (ev: EventLite) => new Date(ev.endDate || ev.startDate).getTime() < Date.now();
 
-function couponStatus(c: Coupon): { label: string; cls: string } {
+type Status = { key: "active" | "scheduled" | "off" | "expired" | "used"; label: string; cls: string };
+function couponStatus(c: Coupon): Status {
   const now = Date.now();
-  if (!c.active) return { label: "Off", cls: "bg-gray-100 text-gray-600" };
-  if (c.validUntil && new Date(c.validUntil).getTime() < now) return { label: "Expired", cls: "bg-gray-100 text-gray-600" };
-  if (c.validFrom && new Date(c.validFrom).getTime() > now) return { label: "Scheduled", cls: "bg-amber-100 text-amber-800" };
-  if (c.maxUses && c.uses >= c.maxUses) return { label: "Used up", cls: "bg-gray-100 text-gray-600" };
-  return { label: "Active", cls: "bg-green-100 text-green-800" };
+  if (!c.active) return { key: "off", label: "Off", cls: "bg-gray-100 text-gray-600" };
+  if (c.validUntil && new Date(c.validUntil).getTime() < now) return { key: "expired", label: "Expired", cls: "bg-gray-100 text-gray-600" };
+  if (c.maxUses && c.uses >= c.maxUses) return { key: "used", label: "Used up", cls: "bg-gray-100 text-gray-600" };
+  if (c.validFrom && new Date(c.validFrom).getTime() > now) return { key: "scheduled", label: "Scheduled", cls: "bg-amber-100 text-amber-800" };
+  return { key: "active", label: "Active", cls: "bg-green-100 text-green-800" };
 }
 
 export default function CouponsPage() {
@@ -151,7 +153,7 @@ export default function CouponsPage() {
   const [error, setError] = useDismissingState<string | null>(null);
   const [info, setInfo] = useDismissingState<string | null>(null);
   const [query, setQuery] = useState("");
-  const [showOff, setShowOff] = useState(false);
+  const [showInactive, setShowInactive] = useState(false);
 
   const [editing, setEditing] = useState<{ id: string | null; draft: Draft } | null>(null);
   const [viewing, setViewing] = useState<{ coupon: Coupon; redemptions: Redemption[] } | null>(null);
@@ -175,10 +177,17 @@ export default function CouponsPage() {
 
   useEffect(() => { if (token && canView) load(); }, [token, canView, load]);
 
+  // Codes that can still be used first; off, expired and used-up ones only when asked for.
   const visible = useMemo(() => {
     const q = query.trim().toLowerCase();
-    return coupons.filter(c => (showOff || c.active) && (!q || c.code.toLowerCase().includes(q) || (c.description || "").toLowerCase().includes(q)));
-  }, [coupons, query, showOff]);
+    const order: Record<Status["key"], number> = { active: 0, scheduled: 1, used: 2, expired: 3, off: 4 };
+    return coupons
+      .map(c => ({ c, status: couponStatus(c) }))
+      .filter(({ c, status }) => (showInactive || status.key === "active" || status.key === "scheduled")
+        && (!q || c.code.toLowerCase().includes(q) || (c.description || "").toLowerCase().includes(q) || c.events.some(e => e.event.title.toLowerCase().includes(q))))
+      .sort((a, b) => order[a.status.key] - order[b.status.key]);
+  }, [coupons, query, showInactive]);
+  const hiddenCount = coupons.filter(c => !["active", "scheduled"].includes(couponStatus(c).key)).length;
 
   const toggleActive = async (c: Coupon) => {
     try {
@@ -199,9 +208,11 @@ export default function CouponsPage() {
     }
   };
 
+  const startNew = () => setEditing({ id: null, draft: blankDraft() });
+
   return (
-    <div className="max-w-6xl mx-auto w-full p-6">
-      <div className="flex items-center justify-between gap-3 mb-4 flex-wrap">
+    <div className="max-w-6xl mx-auto w-full p-4 sm:p-6">
+      <div className="flex flex-col sm:flex-row sm:items-center sm:justify-between gap-3 mb-4">
         <div className="flex items-center gap-3">
           <div className="w-10 h-10 rounded-xl bg-brand-50 flex items-center justify-center shrink-0">
             <TicketPercent className="w-5 h-5 text-brand-600" />
@@ -214,8 +225,8 @@ export default function CouponsPage() {
         </div>
         {canView && (
           <button
-            onClick={() => setEditing({ id: null, draft: blankDraft() })}
-            className="inline-flex items-center gap-2 px-4 py-2 rounded-lg bg-brand-600 text-white text-sm font-medium hover:bg-brand-700"
+            onClick={startNew}
+            className="inline-flex items-center justify-center gap-2 px-4 py-2 rounded-lg bg-brand-600 text-white text-sm font-medium hover:bg-brand-700 w-full sm:w-auto"
           >
             <Plus className="w-4 h-4" /> New code
           </button>
@@ -230,72 +241,46 @@ export default function CouponsPage() {
 
       {canView && (
         <div className="border rounded-xl p-4 bg-white shadow-sm">
-          <div className="flex flex-wrap items-center gap-3 mb-3">
-            <div className="relative w-full sm:w-64">
+          <div className="flex flex-col sm:flex-row sm:items-center gap-3 mb-4">
+            <div className="relative w-full sm:w-72">
               <Search className="w-4 h-4 text-gray-400 absolute left-2.5 top-2.5" />
-              <input className={`${inputCls} pl-8`} placeholder="Search codes" value={query} onChange={e => setQuery(e.target.value)} />
+              <input className={`${inputCls} pl-8`} placeholder="Search codes or events" value={query} onChange={e => setQuery(e.target.value)} />
             </div>
             <label className="flex items-center gap-2 text-sm text-gray-700">
-              <input type="checkbox" checked={showOff} onChange={e => setShowOff(e.target.checked)} /> Show codes that are off
+              <input type="checkbox" checked={showInactive} onChange={e => setShowInactive(e.target.checked)} />
+              Show codes that are off, expired or used up{hiddenCount > 0 ? ` (${hiddenCount})` : ""}
             </label>
           </div>
 
-          <div className="overflow-x-auto">
-            <Table>
-              <TableHeader>
-                <TableRow>
-                  <TableHead>Code</TableHead>
-                  <TableHead>Discount</TableHead>
-                  <TableHead>Events</TableHead>
-                  <TableHead>Uses</TableHead>
-                  <TableHead>Valid</TableHead>
-                  <TableHead>Status</TableHead>
-                  <TableHead className="text-right">Actions</TableHead>
-                </TableRow>
-              </TableHeader>
-              <TableBody>
-                {visible.map(c => {
-                  const status = couponStatus(c);
-                  return (
-                    <TableRow key={c.id}>
-                      <TableCell>
-                        <div className="font-mono font-semibold text-gray-900">{c.code}</div>
-                        {c.description && <div className="text-xs text-gray-500">{c.description}</div>}
-                        {(c.restrictRoles.length > 0 || c.allowedUsers.length > 0 || c.restrictDomain) && (
-                          <div className="text-xs text-amber-700 mt-0.5">
-                            Restricted: {c.allowedUsers.length ? `${c.allowedUsers.length} person${c.allowedUsers.length === 1 ? "" : "s"}` : c.restrictRoles.length ? c.restrictRoles.join(", ") : `@${c.restrictDomain}`}
-                          </div>
-                        )}
-                      </TableCell>
-                      <TableCell>
-                        <div>{c.summary}</div>
-                        {c.options.length > 0 && <div className="text-xs text-gray-500">{c.options.map(o => o.eventOption.name + (o.variant ? ` (${o.variant.name})` : "")).join(", ")}</div>}
-                      </TableCell>
-                      <TableCell className="text-sm">{c.events.length ? c.events.map(e => e.event.title).join(", ") : <span className="text-gray-500">All events</span>}</TableCell>
-                      <TableCell className="text-sm">
-                        {c.uses}{c.maxUses ? ` / ${c.maxUses}` : ""}
-                        <div className="text-xs text-gray-500">{fmtRand(c.totalDiscount)} given</div>
-                      </TableCell>
-                      <TableCell className="text-xs text-gray-600">
-                        {c.validFrom || c.validUntil ? `${c.validFrom ? fmtDate(c.validFrom) : "Now"} – ${c.validUntil ? fmtDate(c.validUntil) : "no end"}` : "Always"}
-                      </TableCell>
-                      <TableCell><span className={`text-xs px-2 py-0.5 rounded-full font-medium ${status.cls}`}>{status.label}</span></TableCell>
-                      <TableCell className="text-right whitespace-nowrap">
-                        <button className="px-2 py-1 text-xs rounded border hover:bg-gray-50 mr-1" onClick={() => openUses(c)}>Uses</button>
-                        <button className="px-2 py-1 text-xs rounded border hover:bg-gray-50 mr-1" onClick={() => setEditing({ id: c.id, draft: draftFromCoupon(c) })}>Edit</button>
-                        <button className={`px-2 py-1 text-xs rounded text-white ${c.active ? "bg-amber-500 hover:bg-amber-600" : "bg-green-600 hover:bg-green-700"}`} onClick={() => toggleActive(c)}>
-                          {c.active ? "Turn off" : "Turn on"}
-                        </button>
-                      </TableCell>
-                    </TableRow>
-                  );
-                })}
-                {!fetching && visible.length === 0 && (
-                  <TableRow><TableCell colSpan={7} className="text-center text-sm text-gray-500 py-8">No coupon codes yet.</TableCell></TableRow>
-                )}
-              </TableBody>
-            </Table>
-          </div>
+          {!fetching && visible.length === 0 && (
+            <div className="text-center py-10">
+              <div className="w-12 h-12 rounded-full bg-brand-50 flex items-center justify-center mx-auto mb-3">
+                <TicketPercent className="w-6 h-6 text-brand-600" />
+              </div>
+              <p className="text-sm font-medium text-gray-900">{coupons.length === 0 ? "No coupon codes yet" : "No codes match"}</p>
+              <p className="text-xs text-gray-500 mt-1 max-w-sm mx-auto">e.g. &quot;STAFF50&quot;: 50% off for staff, or &quot;WELCOME20&quot;: R20 off for first-time visitors.</p>
+              {coupons.length === 0 && (
+                <button onClick={startNew} className="mt-4 inline-flex items-center gap-2 px-4 py-2 rounded-lg bg-brand-600 text-white text-sm font-medium hover:bg-brand-700">
+                  <Plus className="w-4 h-4" /> Create a code
+                </button>
+              )}
+            </div>
+          )}
+
+          {visible.length > 0 && (
+            <div className="grid grid-cols-1 md:grid-cols-2 gap-3">
+              {visible.map(({ c, status }) => (
+                <CouponCard
+                  key={c.id}
+                  coupon={c}
+                  status={status}
+                  onUses={() => openUses(c)}
+                  onEdit={() => setEditing({ id: c.id, draft: draftFromCoupon(c) })}
+                  onToggle={() => toggleActive(c)}
+                />
+              ))}
+            </div>
+          )}
         </div>
       )}
 
@@ -311,47 +296,119 @@ export default function CouponsPage() {
       )}
 
       {viewing && (
-        <div className="fixed inset-0 z-50 bg-black/40 flex items-center justify-center p-4" onClick={() => setViewing(null)}>
-          <div className="bg-white rounded-xl shadow-xl w-full max-w-2xl max-h-[85vh] flex flex-col" onClick={e => e.stopPropagation()}>
-            <div className="flex items-center justify-between p-4 border-b">
-              <h2 className="font-semibold">Uses of <span className="font-mono">{viewing.coupon.code}</span></h2>
-              <button onClick={() => setViewing(null)} aria-label="Close"><X className="w-5 h-5 text-gray-500" /></button>
-            </div>
-            <div className="p-4 overflow-y-auto">
-              {viewing.redemptions.length === 0 ? (
-                <p className="text-sm text-gray-500">This code hasn&apos;t been used yet.</p>
-              ) : (
-                <Table>
-                  <TableHeader>
-                    <TableRow><TableHead>Person</TableHead><TableHead>Event</TableHead><TableHead>Discount</TableHead><TableHead>When</TableHead></TableRow>
-                  </TableHeader>
-                  <TableBody>
-                    {viewing.redemptions.map(r => (
-                      <TableRow key={r.id} className={r.releasedAt ? "opacity-60" : ""}>
-                        <TableCell>
-                          <div className="text-sm">{r.user.name}</div>
-                          <div className="text-xs text-gray-500">{r.user.email}</div>
-                          {r.appliedBy && <div className="text-xs text-gray-500">Applied by {r.appliedBy.name}</div>}
-                        </TableCell>
-                        <TableCell className="text-sm">{r.registration.event.title}</TableCell>
-                        <TableCell className="text-sm">
-                          {fmtRand(r.discountAmount)}
-                          {r.releasedAt && <div className="text-xs text-gray-500">Released (cancelled)</div>}
-                        </TableCell>
-                        <TableCell className="text-xs text-gray-600">{fmtDate(r.createdAt)}</TableCell>
-                      </TableRow>
-                    ))}
-                  </TableBody>
-                </Table>
-              )}
-            </div>
-          </div>
-        </div>
+        <Sheet title={<>Uses of <span className="font-mono">{viewing.coupon.code}</span></>} onClose={() => setViewing(null)}>
+          {viewing.redemptions.length === 0 ? (
+            <p className="text-sm text-gray-500">This code hasn&apos;t been used yet.</p>
+          ) : (
+            <ul className="divide-y">
+              {viewing.redemptions.map(r => (
+                <li key={r.id} className={`py-2.5 flex items-start justify-between gap-3 ${r.releasedAt ? "opacity-60" : ""}`}>
+                  <div className="min-w-0">
+                    <div className="text-sm font-medium text-gray-900 truncate">{r.user.name}</div>
+                    <div className="text-xs text-gray-500 truncate">{r.user.email}</div>
+                    <div className="text-xs text-gray-500">{r.registration.event.title} · {fmtDate(r.createdAt)}</div>
+                    {r.appliedBy && <div className="text-xs text-gray-500">Applied by {r.appliedBy.name}</div>}
+                  </div>
+                  <div className="text-right shrink-0">
+                    <div className="text-sm font-semibold">{fmtRand(r.discountAmount)}</div>
+                    {r.releasedAt && <div className="text-xs text-gray-500">Released (cancelled)</div>}
+                  </div>
+                </li>
+              ))}
+            </ul>
+          )}
+        </Sheet>
       )}
     </div>
   );
 }
 
+/** A dialog that slides up full-width on phones and sits centred on bigger screens. */
+function Sheet({ title, subtitle, onClose, children, footer, onSubmit }: {
+  title: React.ReactNode;
+  subtitle?: React.ReactNode;
+  onClose: () => void;
+  children: React.ReactNode;
+  footer?: React.ReactNode;
+  onSubmit?: (e: React.FormEvent) => void;
+}) {
+  const Box = onSubmit ? "form" : "div";
+  return (
+    <div className="fixed inset-0 z-50 bg-black/40 flex items-end sm:items-center justify-center sm:p-4" onClick={onClose}>
+      <Box onSubmit={onSubmit} className="bg-white w-full sm:max-w-2xl max-h-[92vh] sm:max-h-[90vh] rounded-t-2xl sm:rounded-xl shadow-xl flex flex-col" onClick={e => e.stopPropagation()}>
+        <div className="flex items-start justify-between gap-3 p-4 border-b">
+          <div className="min-w-0">
+            <h2 className="font-semibold">{title}</h2>
+            {subtitle && <p className="text-xs text-gray-500 truncate">{subtitle}</p>}
+          </div>
+          <button type="button" onClick={onClose} aria-label="Close" className="p-1 -m-1"><X className="w-5 h-5 text-gray-500" /></button>
+        </div>
+        <div className="p-4 overflow-y-auto overflow-x-hidden overscroll-contain">{children}</div>
+        {footer && <div className="flex flex-col-reverse sm:flex-row sm:justify-end gap-2 sm:gap-3 p-4 border-t">{footer}</div>}
+      </Box>
+    </div>
+  );
+}
+
+function CouponCard({ coupon: c, status, onUses, onEdit, onToggle }: { coupon: Coupon; status: Status; onUses: () => void; onEdit: () => void; onToggle: () => void }) {
+  const restricted = c.allowedUsers.length
+    ? `${c.allowedUsers.length} ${c.allowedUsers.length === 1 ? "person" : "people"}`
+    : c.restrictRoles.length ? c.restrictRoles.map(r => (r === "user" ? "members" : r)).join(", ") : c.restrictDomain ? `@${c.restrictDomain}` : null;
+  const dates = c.validFrom || c.validUntil ? `${c.validFrom ? fmtDate(c.validFrom) : "Now"} – ${c.validUntil ? fmtDate(c.validUntil) : "no end date"}` : null;
+  const limits = [
+    c.maxUses ? `${c.maxUses} uses in total` : null,
+    c.maxUsesPerUser ? `${c.maxUsesPerUser} per person` : null,
+    c.minQuantity ? `min ${c.minQuantity} tickets` : null,
+  ].filter(Boolean).join(" · ");
+  const live = status.key === "active" || status.key === "scheduled";
+
+  return (
+    <div className={`border rounded-xl p-4 flex flex-col gap-3 ${live ? "bg-white" : "bg-gray-50"}`}>
+      <div className="flex items-start justify-between gap-3">
+        <div className="min-w-0">
+          <div className="font-mono font-semibold text-gray-900 break-all">{c.code}</div>
+          {c.description && <div className="text-xs text-gray-500 mt-0.5 break-words">{c.description}</div>}
+        </div>
+        <span className={`shrink-0 text-xs px-2 py-0.5 rounded-full font-medium ${status.cls}`}>{status.label}</span>
+      </div>
+
+      <div className="flex items-baseline flex-wrap gap-x-2 gap-y-0.5">
+        <span className="text-xl font-semibold text-gray-900">{c.summary}</span>
+        {c.options.length > 0 && (
+          <span className="text-xs text-gray-500">on {c.options.map(o => o.eventOption.name + (o.variant ? ` (${o.variant.name})` : "")).join(", ")}</span>
+        )}
+      </div>
+
+      <div className="flex flex-wrap gap-1.5">
+        {c.events.length === 0
+          ? <span className="rounded-full bg-gray-100 text-gray-700 px-2.5 py-1 text-xs">All events</span>
+          : c.events.map(e => (
+            <span key={e.eventId} className="rounded-full bg-brand-50 text-brand-800 border border-brand-100 px-2.5 py-1 text-xs break-words">{e.event.title}</span>
+          ))}
+      </div>
+
+      <div className="text-xs text-gray-600 space-y-0.5">
+        <div>Used <strong>{c.uses}{c.maxUses ? ` / ${c.maxUses}` : ""}×</strong> · {fmtRand(c.totalDiscount)} given</div>
+        {restricted && <div className="flex items-center gap-1 text-amber-700"><Users className="w-3.5 h-3.5 shrink-0" /> Only for {restricted}</div>}
+        {dates && <div className="flex items-center gap-1"><CalendarClock className="w-3.5 h-3.5 shrink-0" /> {dates}</div>}
+        {limits && <div>{limits}</div>}
+      </div>
+
+      <div className="flex flex-wrap gap-2 pt-1 border-t border-gray-100 mt-auto">
+        <button onClick={onUses} className="inline-flex items-center gap-1.5 px-3 py-1.5 text-xs rounded-lg border hover:bg-gray-50 mt-2">
+          <ListChecks className="w-3.5 h-3.5" /> Uses
+        </button>
+        <button onClick={onEdit} className="inline-flex items-center gap-1.5 px-3 py-1.5 text-xs rounded-lg border hover:bg-gray-50 mt-2">
+          <Pencil className="w-3.5 h-3.5" /> Edit
+        </button>
+        <button onClick={onToggle} className={`inline-flex items-center gap-1.5 px-3 py-1.5 text-xs rounded-lg border mt-2 sm:ml-auto ${c.active ? "text-amber-700 border-amber-200 hover:bg-amber-50" : "text-green-700 border-green-200 hover:bg-green-50"}`}>
+          <Power className="w-3.5 h-3.5" /> {c.active ? "Turn off" : "Turn on"}
+        </button>
+      </div>
+    </div>
+  );
+}
+
 function CouponModal({ token, events, couponId, initial, onClose, onSaved }: {
   token: string;
   events: EventLite[];
@@ -365,8 +422,22 @@ function CouponModal({ token, events, couponId, initial, onClose, onSaved }: {
   const [error, setError] = useState<string | null>(null);
   const [userQuery, setUserQuery] = useState("");
   const [userResults, setUserResults] = useState<{ id: string; name: string; email: string }[]>([]);
+  const [eventQuery, setEventQuery] = useState("");
+  const [showPast, setShowPast] = useState(false);
   const set = <K extends keyof Draft>(key: K, value: Draft[K]) => setD(prev => ({ ...prev, [key]: value }));
 
+  // Upcoming events soonest first. Past events only when asked for, but ones already
+  // picked always stay in the list so they can be unticked.
+  const eventChoices = useMemo(() => {
+    const q = eventQuery.trim().toLowerCase();
+    const upcoming = events.filter(e => !isPast(e)).sort((a, b) => new Date(a.startDate).getTime() - new Date(b.startDate).getTime());
+    const past = events.filter(isPast).sort((a, b) => new Date(b.startDate).getTime() - new Date(a.startDate).getTime());
+    return [...upcoming, ...past]
+      .filter(e => showPast || !isPast(e) || d.eventIds.includes(e.id))
+      .filter(e => !q || e.title.toLowerCase().includes(q));
+  }, [events, eventQuery, showPast, d.eventIds]);
+  const pastCount = events.filter(isPast).length;
+
   // Ticket options only make sense within the chosen events.
   const scopedEvents = useMemo(() => events.filter(e => d.eventIds.includes(e.id)), [events, d.eventIds]);
 
@@ -415,184 +486,200 @@ function CouponModal({ token, events, couponId, initial, onClose, onSaved }: {
     }
   };
 
+  const label = "block text-sm font-medium text-gray-700 mb-1";
+  const optional = <span className="font-normal text-gray-400">(optional)</span>;
+
   return (
-    <div className="fixed inset-0 z-50 bg-black/40 flex items-center justify-center p-4" onClick={onClose}>
-      <form onSubmit={save} className="bg-white rounded-xl shadow-xl w-full max-w-2xl max-h-[90vh] flex flex-col" onClick={e => e.stopPropagation()}>
-        <div className="flex items-center justify-between p-4 border-b">
-          <h2 className="font-semibold">{couponId ? "Edit code" : "New coupon code"}</h2>
-          <button type="button" onClick={onClose} aria-label="Close"><X className="w-5 h-5 text-gray-500" /></button>
-        </div>
-
-        <div className="p-4 space-y-5 overflow-y-auto">
-          <div className="grid grid-cols-1 sm:grid-cols-2 gap-4">
-            <div>
-              <label className="block text-sm font-medium text-gray-700 mb-1">Code</label>
-              <input className={`${inputCls} font-mono uppercase`} value={d.code} onChange={e => set("code", e.target.value.toUpperCase().replace(/[^A-Z0-9_-]/g, ""))} placeholder="STAFF50" required maxLength={32} />
-              <p className="text-xs text-gray-500 mt-1">Letters, numbers, - and _. Not case-sensitive when entered.</p>
-            </div>
-            <div>
-              <label className="block text-sm font-medium text-gray-700 mb-1">Description (internal)</label>
-              <input className={inputCls} value={d.description} onChange={e => set("description", e.target.value)} placeholder="Staff discount for Camp 2026" />
-            </div>
-          </div>
-
-          <div className="grid grid-cols-1 sm:grid-cols-3 gap-4">
-            <div>
-              <label className="block text-sm font-medium text-gray-700 mb-1">Discount type</label>
-              <select className={inputCls} value={d.type} onChange={e => set("type", e.target.value as CouponType)}>
-                <option value="percent">Percentage</option>
-                <option value="fixed">Fixed amount (R)</option>
-                <option value="comp">Free (100%)</option>
-              </select>
-            </div>
-            {d.type !== "comp" && (
-              <div>
-                <label className="block text-sm font-medium text-gray-700 mb-1">{d.type === "percent" ? "Percent off" : "Amount off (R)"}</label>
-                <input type="number" min="0" step={d.type === "percent" ? "1" : "0.01"} max={d.type === "percent" ? 100 : undefined} className={inputCls} value={d.value} onChange={e => set("value", e.target.value)} required />
-              </div>
-            )}
-            <div className="flex items-end">
-              <label className="flex items-start gap-2 text-sm text-gray-700">
-                <input type="checkbox" className="mt-0.5" checked={d.stackEarlyBird} onChange={e => set("stackEarlyBird", e.target.checked)} />
-                <span>Also apply on top of early-bird prices <span className="block text-xs text-gray-500">Off: the better of the two prices wins.</span></span>
-              </label>
-            </div>
-          </div>
-
-          <div>
-            <label className="block text-sm font-medium text-gray-700 mb-1">Events</label>
-            <p className="text-xs text-gray-500 mb-2">Leave all unticked for every event.</p>
-            <div className="max-h-40 overflow-y-auto border rounded-lg divide-y">
-              {events.map(ev => (
-                <label key={ev.id} className="flex items-center gap-2 px-3 py-2 text-sm">
-                  <input type="checkbox" checked={d.eventIds.includes(ev.id)} onChange={() => toggleEvent(ev.id)} />
-                  <span>{ev.title}</span>
-                  <span className="text-xs text-gray-500 ml-auto">{fmtDate(ev.startDate)}</span>
-                </label>
-              ))}
-              {events.length === 0 && <p className="px-3 py-2 text-sm text-gray-500">No events.</p>}
-            </div>
-          </div>
-
-          {scopedEvents.length > 0 && (
-            <div>
-              <label className="block text-sm font-medium text-gray-700 mb-1">Only these tickets / items</label>
-              <p className="text-xs text-gray-500 mb-2">Leave all unticked to discount the whole registration.</p>
-              <div className="space-y-2">
-                {scopedEvents.map(ev => (
-                  <div key={ev.id} className="border rounded-lg p-3">
-                    <div className="text-xs font-semibold text-gray-600 mb-1">{ev.title}</div>
-                    {ev.eventOptions.map(o => (
-                      <div key={o.id}>
-                        <label className="flex items-center gap-2 text-sm">
-                          <input type="checkbox" checked={d.options.some(s => scopeKey(s) === scopeKey({ eventOptionId: o.id, variantId: null }))} onChange={() => toggleScope(o.id, null)} />
-                          {o.name}{(o.variants || []).length > 0 && <span className="text-xs text-gray-500">(all variants)</span>}
-                        </label>
-                        {(o.variants || []).map(v => (
-                          <label key={v.id} className="flex items-center gap-2 text-sm ml-6">
-                            <input type="checkbox" checked={d.options.some(s => scopeKey(s) === scopeKey({ eventOptionId: o.id, variantId: v.id }))} onChange={() => toggleScope(o.id, v.id)} />
-                            {v.name}
-                          </label>
-                        ))}
-                      </div>
-                    ))}
-                  </div>
-                ))}
-              </div>
-            </div>
-          )}
-
-          <div className="grid grid-cols-1 sm:grid-cols-2 gap-4">
-            <div>
-              <label className="block text-sm font-medium text-gray-700 mb-1">Valid from</label>
-              <input type="datetime-local" className={inputCls} value={d.validFrom} onChange={e => set("validFrom", e.target.value)} />
-            </div>
-            <div>
-              <label className="block text-sm font-medium text-gray-700 mb-1">Valid until</label>
-              <input type="datetime-local" className={inputCls} value={d.validUntil} onChange={e => set("validUntil", e.target.value)} />
-            </div>
-          </div>
-
-          <div className="grid grid-cols-1 sm:grid-cols-3 gap-4">
-            <div>
-              <label className="block text-sm font-medium text-gray-700 mb-1">Max total uses</label>
-              <input type="number" min="1" className={inputCls} value={d.maxUses} onChange={e => set("maxUses", e.target.value)} placeholder="Unlimited" />
-            </div>
-            <div>
-              <label className="block text-sm font-medium text-gray-700 mb-1">Max uses per person</label>
-              <input type="number" min="1" className={inputCls} value={d.maxUsesPerUser} onChange={e => set("maxUsesPerUser", e.target.value)} placeholder="Unlimited" />
-            </div>
-            <div>
-              <label className="block text-sm font-medium text-gray-700 mb-1">Minimum tickets</label>
-              <input type="number" min="1" className={inputCls} value={d.minQuantity} onChange={e => set("minQuantity", e.target.value)} placeholder="None" />
-            </div>
-          </div>
-
-          <div>
-            <label className="block text-sm font-medium text-gray-700 mb-1">Who can use it</label>
-            <select className={inputCls} value={d.restrictTo} onChange={e => set("restrictTo", e.target.value as Draft["restrictTo"])}>
-              <option value="anyone">Anyone with the code</option>
-              <option value="roles">People with certain roles</option>
-              <option value="users">Specific people</option>
-              <option value="domain">An email domain</option>
-            </select>
-            {d.restrictTo !== "anyone" && (
-              <p className="text-xs text-gray-500 mt-1">Restricted codes need the person to be logged in (or registered by staff), so they can&apos;t be shared in group chats.</p>
-            )}
-
-            {d.restrictTo === "roles" && (
-              <div className="flex flex-wrap gap-4 mt-2">
-                {(["user", "staff", "supervisor", "admin"] as Role[]).map(r => (
-                  <label key={r} className="flex items-center gap-2 text-sm capitalize">
-                    <input type="checkbox" checked={d.restrictRoles.includes(r)} onChange={() => set("restrictRoles", d.restrictRoles.includes(r) ? d.restrictRoles.filter(x => x !== r) : [...d.restrictRoles, r])} />
-                    {r === "user" ? "Member" : r}
-                  </label>
-                ))}
-              </div>
-            )}
-
-            {d.restrictTo === "domain" && (
-              <input className={`${inputCls} mt-2`} value={d.restrictDomain} onChange={e => set("restrictDomain", e.target.value)} placeholder="church.org" required />
-            )}
-
-            {d.restrictTo === "users" && (
-              <div className="mt-2">
-                <div className="flex flex-wrap gap-2 mb-2">
-                  {d.users.map(u => (
-                    <span key={u.id} className="inline-flex items-center gap-1 text-xs bg-brand-50 text-brand-800 rounded-full px-2 py-1">
-                      {u.name}
-                      <button type="button" onClick={() => set("users", d.users.filter(x => x.id !== u.id))} aria-label={`Remove ${u.name}`}><X className="w-3 h-3" /></button>
-                    </span>
-                  ))}
-                </div>
-                <input className={inputCls} value={userQuery} onChange={e => setUserQuery(e.target.value)} placeholder="Search by name, email or phone" />
-                {userResults.length > 0 && (
-                  <div className="border rounded-lg mt-1 divide-y max-h-40 overflow-y-auto">
-                    {userResults.filter(r => !d.users.some(u => u.id === r.id)).map(r => (
-                      <button type="button" key={r.id} className="w-full text-left px-3 py-2 text-sm hover:bg-gray-50" onClick={() => { set("users", [...d.users, r]); setUserQuery(""); }}>
-                        {r.name} <span className="text-xs text-gray-500">{r.email}</span>
-                      </button>
-                    ))}
-                  </div>
-                )}
-              </div>
-            )}
-          </div>
-
-          <label className="flex items-center gap-2 text-sm text-gray-700">
-            <input type="checkbox" checked={d.active} onChange={e => set("active", e.target.checked)} /> Active
-          </label>
-
-          {error && <div className="p-3 border rounded bg-red-50 text-red-800 text-sm">{error}</div>}
-        </div>
-
-        <div className="flex justify-end gap-3 p-4 border-t">
+    <Sheet
+      title={couponId ? "Edit code" : "New coupon code"}
+      onClose={onClose}
+      onSubmit={save}
+      footer={(
+        <>
           <button type="button" onClick={onClose} className="px-4 py-2 rounded-lg bg-gray-100 text-sm font-medium hover:bg-gray-200">Cancel</button>
           <button type="submit" disabled={saving} className="px-4 py-2 rounded-lg bg-brand-600 text-white text-sm font-medium hover:bg-brand-700 disabled:opacity-50">
             {saving ? "Saving…" : couponId ? "Save changes" : "Create code"}
           </button>
+        </>
+      )}
+    >
+      <div className="space-y-5">
+        <div className="grid grid-cols-1 sm:grid-cols-2 gap-4">
+          <div>
+            <label className={label}>Code</label>
+            <input className={`${inputCls} font-mono uppercase`} value={d.code} onChange={e => set("code", e.target.value.toUpperCase().replace(/[^A-Z0-9_-]/g, ""))} placeholder="STAFF50" required maxLength={32} />
+            <p className="text-xs text-gray-500 mt-1">Letters, numbers, - and _. Not case-sensitive when entered.</p>
+          </div>
+          <div>
+            <label className={label}>Description {optional}</label>
+            <input className={inputCls} value={d.description} onChange={e => set("description", e.target.value)} placeholder="Staff discount for Camp 2026" />
+            <p className="text-xs text-gray-500 mt-1">Only staff see this.</p>
+          </div>
         </div>
-      </form>
-    </div>
+
+        <div>
+          <label className="block text-sm font-medium text-gray-700 mb-2">Discount</label>
+          <div className="grid grid-cols-3 gap-2">
+            {([["percent", "Percentage", "e.g. 20% off"], ["fixed", "Amount off", "e.g. R50 off"], ["comp", "Free", "100% off"]] as [CouponType, string, string][]).map(([t, name, hint]) => (
+              <button type="button" key={t} onClick={() => set("type", t)} aria-pressed={d.type === t}
+                className={`text-left rounded-lg border p-2.5 transition-colors ${d.type === t ? "border-brand-500 bg-brand-50 ring-1 ring-brand-500" : "hover:bg-gray-50"}`}>
+                <div className="text-sm font-medium text-gray-900">{name}</div>
+                <div className="text-xs text-gray-500">{hint}</div>
+              </button>
+            ))}
+          </div>
+          {d.type !== "comp" && (
+            <div className="mt-3 sm:max-w-[12rem]">
+              <label className={label}>{d.type === "percent" ? "Percent off" : "Amount off (R)"}</label>
+              <input type="number" min="0" inputMode="decimal" step={d.type === "percent" ? "1" : "0.01"} max={d.type === "percent" ? 100 : undefined} className={inputCls} value={d.value} onChange={e => set("value", e.target.value)} required />
+            </div>
+          )}
+          <label className="mt-3 flex items-start gap-2 text-sm text-gray-700">
+            <input type="checkbox" className="mt-0.5" checked={d.stackEarlyBird} onChange={e => set("stackEarlyBird", e.target.checked)} />
+            <span>Also apply on top of early-bird prices <span className="block text-xs text-gray-500">Off: the better of the two prices wins.</span></span>
+          </label>
+        </div>
+
+        <div>
+          <label className={label}>Events</label>
+          <p className="text-xs text-gray-500 mb-2">
+            {d.eventIds.length === 0 ? "None picked: the code works for every event." : `${d.eventIds.length} picked. The code only works for ${d.eventIds.length === 1 ? "this event" : "these events"}.`}
+          </p>
+          <div className="flex flex-col sm:flex-row sm:items-center gap-2 mb-2">
+            <div className="relative flex-1">
+              <Search className="w-4 h-4 text-gray-400 absolute left-2.5 top-2.5" />
+              <input className={`${inputCls} pl-8`} placeholder="Find an event" value={eventQuery} onChange={e => setEventQuery(e.target.value)} />
+            </div>
+            {pastCount > 0 && (
+              <label className="flex items-center gap-2 text-sm text-gray-700 shrink-0">
+                <input type="checkbox" checked={showPast} onChange={e => setShowPast(e.target.checked)} /> Show past events
+              </label>
+            )}
+          </div>
+          <div className="max-h-48 overflow-y-auto border rounded-lg divide-y">
+            {eventChoices.map(ev => (
+              <label key={ev.id} className={`flex items-center gap-2 px-3 py-2 text-sm ${d.eventIds.includes(ev.id) ? "bg-brand-50/60" : ""}`}>
+                <input type="checkbox" checked={d.eventIds.includes(ev.id)} onChange={() => toggleEvent(ev.id)} />
+                <span className="min-w-0 flex-1 truncate">{ev.title}</span>
+                <span className="text-xs text-gray-500 shrink-0">{fmtDate(ev.startDate)}{isPast(ev) ? " · past" : ""}</span>
+              </label>
+            ))}
+            {eventChoices.length === 0 && <p className="px-3 py-2 text-sm text-gray-500">{eventQuery ? "No events match." : "No upcoming events."}</p>}
+          </div>
+        </div>
+
+        {scopedEvents.length > 0 && (
+          <div>
+            <label className={label}>Only these tickets / items {optional}</label>
+            <p className="text-xs text-gray-500 mb-2">Leave all unticked to discount the whole registration.</p>
+            <div className="space-y-2">
+              {scopedEvents.map(ev => (
+                <div key={ev.id} className="border rounded-lg p-3 bg-gray-50">
+                  <div className="text-xs font-semibold text-gray-600 mb-1">{ev.title}</div>
+                  {ev.eventOptions.map(o => (
+                    <div key={o.id}>
+                      <label className="flex items-center gap-2 text-sm py-0.5">
+                        <input type="checkbox" checked={d.options.some(s => scopeKey(s) === scopeKey({ eventOptionId: o.id, variantId: null }))} onChange={() => toggleScope(o.id, null)} />
+                        {o.name}{(o.variants || []).length > 0 && <span className="text-xs text-gray-500">(all variants)</span>}
+                      </label>
+                      {(o.variants || []).map(v => (
+                        <label key={v.id} className="flex items-center gap-2 text-sm ml-6 py-0.5">
+                          <input type="checkbox" checked={d.options.some(s => scopeKey(s) === scopeKey({ eventOptionId: o.id, variantId: v.id }))} onChange={() => toggleScope(o.id, v.id)} />
+                          {v.name}
+                        </label>
+                      ))}
+                    </div>
+                  ))}
+                </div>
+              ))}
+            </div>
+          </div>
+        )}
+
+        <div className="grid grid-cols-1 sm:grid-cols-2 gap-4">
+          <div>
+            <label className={label}>Valid from {optional}</label>
+            <input type="datetime-local" className={inputCls} value={d.validFrom} onChange={e => set("validFrom", e.target.value)} />
+          </div>
+          <div>
+            <label className={label}>Valid until {optional}</label>
+            <input type="datetime-local" className={inputCls} value={d.validUntil} onChange={e => set("validUntil", e.target.value)} />
+          </div>
+        </div>
+
+        <div className="grid grid-cols-1 sm:grid-cols-3 gap-4">
+          <div>
+            <label className={label}>Max total uses</label>
+            <input type="number" min="1" inputMode="numeric" className={inputCls} value={d.maxUses} onChange={e => set("maxUses", e.target.value)} placeholder="Unlimited" />
+          </div>
+          <div>
+            <label className={label}>Max uses per person</label>
+            <input type="number" min="1" inputMode="numeric" className={inputCls} value={d.maxUsesPerUser} onChange={e => set("maxUsesPerUser", e.target.value)} placeholder="Unlimited" />
+          </div>
+          <div>
+            <label className={label}>Minimum tickets</label>
+            <input type="number" min="1" inputMode="numeric" className={inputCls} value={d.minQuantity} onChange={e => set("minQuantity", e.target.value)} placeholder="None" />
+          </div>
+        </div>
+
+        <div>
+          <label className={label}>Who can use it</label>
+          <select className={inputCls} value={d.restrictTo} onChange={e => set("restrictTo", e.target.value as Draft["restrictTo"])}>
+            <option value="anyone">Anyone with the code</option>
+            <option value="roles">People with certain roles</option>
+            <option value="users">Specific people</option>
+            <option value="domain">An email domain</option>
+          </select>
+          {d.restrictTo !== "anyone" && (
+            <p className="text-xs text-gray-500 mt-1">Restricted codes need the person to be logged in (or registered by staff), so they can&apos;t be shared in group chats.</p>
+          )}
+
+          {d.restrictTo === "roles" && (
+            <div className="flex flex-wrap gap-x-4 gap-y-2 mt-2">
+              {(["user", "staff", "supervisor", "admin"] as Role[]).map(r => (
+                <label key={r} className="flex items-center gap-2 text-sm capitalize">
+                  <input type="checkbox" checked={d.restrictRoles.includes(r)} onChange={() => set("restrictRoles", d.restrictRoles.includes(r) ? d.restrictRoles.filter(x => x !== r) : [...d.restrictRoles, r])} />
+                  {r === "user" ? "Member" : r}
+                </label>
+              ))}
+            </div>
+          )}
+
+          {d.restrictTo === "domain" && (
+            <input className={`${inputCls} mt-2`} value={d.restrictDomain} onChange={e => set("restrictDomain", e.target.value)} placeholder="church.org" required />
+          )}
+
+          {d.restrictTo === "users" && (
+            <div className="mt-2">
+              <div className="flex flex-wrap gap-2 mb-2">
+                {d.users.map(u => (
+                  <span key={u.id} className="inline-flex items-center gap-1 text-xs bg-brand-50 text-brand-800 rounded-full px-2 py-1">
+                    {u.name}
+                    <button type="button" onClick={() => set("users", d.users.filter(x => x.id !== u.id))} aria-label={`Remove ${u.name}`}><X className="w-3 h-3" /></button>
+                  </span>
+                ))}
+              </div>
+              <input className={inputCls} value={userQuery} onChange={e => setUserQuery(e.target.value)} placeholder="Search by name, email or phone" />
+              {userResults.length > 0 && (
+                <div className="border rounded-lg mt-1 divide-y max-h-40 overflow-y-auto">
+                  {userResults.filter(r => !d.users.some(u => u.id === r.id)).map(r => (
+                    <button type="button" key={r.id} className="w-full text-left px-3 py-2 text-sm hover:bg-gray-50" onClick={() => { set("users", [...d.users, r]); setUserQuery(""); }}>
+                      {r.name} <span className="text-xs text-gray-500">{r.email}</span>
+                    </button>
+                  ))}
+                </div>
+              )}
+            </div>
+          )}
+        </div>
+
+        <label className="flex items-start gap-2 text-sm text-gray-700">
+          <input type="checkbox" className="mt-0.5" checked={d.active} onChange={e => set("active", e.target.checked)} />
+          <span>Active <span className="block text-xs text-gray-500">Discounts already given keep their amount if you turn it off later.</span></span>
+        </label>
+
+        {error && <div className="p-3 border rounded bg-red-50 text-red-800 text-sm">{error}</div>}
+      </div>
+    </Sheet>
   );
 }

frontend/src/app/dashboard/supervisor/events/page.tsx

@@ -4,7 +4,7 @@ import React, { useCallback, useEffect, useLayoutEffect, useMemo, useRef, useSta
 import { createPortal } from "react-dom";
 import { useAuth } from "@/hooks/useAuth";
 import { useRouter } from "next/navigation";
-import { apiFetch } from "@/lib/api";
+import { apiFetch, API_BASE } from "@/lib/api";
 import { ApiImage } from "@/components/shared/ApiImage";
 import { useDismissingState } from "@/hooks/useDismissingState";
 import { useSiteSettings } from "@/contexts/SiteSettingsContext";
@@ -13,6 +13,12 @@ import { ChoicesEditor } from "@/components/shared/FormFieldExtras";
 import { errorMessage } from "@/lib/utils";
 import type { Event, EventAttachment, EventFormField, EventOption, Paginated, Section } from "@/types";
 import { BackLink } from "@/components/shared/BackLink";
+import {
+  SessionsEditor, AttendanceSettings, keyed, sortSessions, sessionsProblem, defaultCertificate,
+  type KeyedSession, type AttendanceDraft,
+} from "@/components/events/ScheduleEditor";
+import { toSessionDraft, scheduleSummary } from "@/lib/sessions";
+import { fetchApiFile, openBlob } from "@/lib/export";
 
 // ─── helpers ────────────────────────────────────────────────────────────────
 
@@ -803,8 +809,8 @@ function NotifyRecipientsManager({ eventId, creator, initialRecipients }: { even
 
 // ─── steps ───────────────────────────────────────────────────────────────────
 
-const STEPS = ["Basic Details", "Items & Pricing", "Sections", "Form", "Visibility", "Notifications", "Attachments", "Feedback"] as const;
-type StepIdx = 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7;
+const STEPS = ["Basic Details", "Items & Pricing", "Sections", "Form", "Visibility", "Notifications", "Attachments", "Feedback", "Attendance"] as const;
+type StepIdx = 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8;
 const PRICING_SUBSTEPS = ["Options", "Variants", "Early Birds"] as const;
 type PricingSubstep = 0 | 1 | 2;
 
@@ -819,6 +825,7 @@ interface EventDraft {
   waitlistEnabled: boolean; waitlistOfferHours: string; waitlistPartialOffers: boolean;
   allowTicketTransfer: boolean; collectGender: boolean;
   allowSponsorships: boolean; sponsorshipGoalSpots: string; showSponsorshipProgress: boolean;
+  scheduleType: "single" | "sessions";
 }
 
 const blankDraft = (location = ""): EventDraft => ({
@@ -832,8 +839,12 @@ const blankDraft = (location = ""): EventDraft => ({
   waitlistEnabled: false, waitlistOfferHours: "24", waitlistPartialOffers: true,
   allowTicketTransfer: true, collectGender: false,
   allowSponsorships: false, sponsorshipGoalSpots: "", showSponsorshipProgress: true,
+  scheduleType: "single",
 });
 
+// "YYYY-MM-DDTHH:MM" (local) → ISO
+const isoOf = (local: string) => new Date(local).toISOString();
+
 const blankOptions = (): OptionDraft[] => [
   { name: "Ticket", price: "", isMainTicket: true, stockLimit: "0", earlyBirdTiers: [], variants: [] }
 ];
@@ -874,8 +885,35 @@ function EventModal({ mode, event: ev, onClose, onSuccess }: EventModalProps) {
     allowSponsorships: !!ev.allowSponsorships, sponsorshipGoalSpots: ev.sponsorshipGoalSpots ? String(ev.sponsorshipGoalSpots) : "", showSponsorshipProgress: ev.showSponsorshipProgress !== false,
     contactName: ev.contactName || "", contactPhone: ev.contactPhone || "", contactEmail: ev.contactEmail || "",
     location: ev.location || "",
+    scheduleType: ev.scheduleType === "sessions" ? "sessions" : "single",
   } : blankDraft(settings.org_address || ""));
 
+  // ── multi-day schedule + attendance settings ──
+  const [sessions, setSessions] = useState<KeyedSession[]>(() => (ev?.sessions || []).map(s => keyed(toSessionDraft(s))));
+  const [attendance, setAttendance] = useState<AttendanceDraft>(() => ({
+    lateJoinEnabled: !!ev?.lateJoinEnabled,
+    lateJoinUntilKey: ev?.lateJoinUntilSessionId || "",
+    latePricing: ev?.latePricing || "full",
+    lateFixedPrice: ev?.lateFixedPrice !== null && ev?.lateFixedPrice !== undefined ? String(ev.lateFixedPrice) : "",
+    checkInWindow: ev?.checkInWindow || "whole_day",
+    remindersEnabled: !!ev?.sessionReminders,
+    reminderOffsets: ev?.sessionReminders?.offsets || [180],
+    reminderChannels: ev?.sessionReminders?.channels || ["email", "whatsapp"],
+    certificatesEnabled: !!ev?.certificatesEnabled,
+    certificate: { ...defaultCertificate(), ...(ev?.certificateConfig || {}) },
+  }));
+  const updAttendance = (patch: Partial<AttendanceDraft>) => setAttendance(a => ({ ...a, ...patch }));
+  const multi = draft.scheduleType === "sessions";
+  // A multi-session event's dates come from its sessions.
+  const scheduleBounds = useMemo(() => {
+    const active = sortSessions(sessions).filter(s => !s.cancelled && s.startsAt && s.endsAt);
+    if (!active.length) return null;
+    const end = active.reduce((m, s) => (s.endsAt > m ? s.endsAt : m), active[0].endsAt);
+    return { start: active[0].startsAt, end };
+  }, [sessions]);
+  // Shown after saving when sessions moved or were cancelled, to offer telling registrants.
+  const [changedNotice, setChangedNotice] = useState<{ eventId: string; moved: number; cancelled: number } | null>(null);
+
   // ── options (with per-variant tiers) ──
   const [options, setOptions] = useState<OptionDraft[]>(() => {
     if (!ev?.eventOptions?.length) return blankOptions();
@@ -951,8 +989,9 @@ function EventModal({ mode, event: ev, onClose, onSuccess }: EventModalProps) {
         { type: "text", label: "What could we do better?", isRequired: false, helpText: "" },
       ] });
     }
-    if (on && !fbSettings.sendAt && draft.endDate) {
-      const next = new Date(draft.endDate);
+    const endForFeedback = multi ? scheduleBounds?.end : draft.endDate;
+    if (on && !fbSettings.sendAt && endForFeedback) {
+      const next = new Date(endForFeedback);
       next.setDate(next.getDate() + 1);
       next.setHours(9, 0, 0, 0);
       setFbSettings(s => ({ ...s, sendAt: toLocalDT(next) }));
@@ -1176,16 +1215,35 @@ function EventModal({ mode, event: ev, onClose, onSuccess }: EventModalProps) {
 
   const handleSave = async () => {
     if (!draft.title.trim()) { setError("Title is required"); setStep(0); return; }
-    if (!draft.startDate || !draft.endDate) { setError("Start and end dates are required"); setStep(0); return; }
+    if (multi) {
+      const problem = sessionsProblem(sessions);
+      if (problem) { setError(problem); setStep(0); return; }
+      if (attendance.lateJoinEnabled && !attendance.lateJoinUntilKey) { setError("Choose until which session late joining is allowed"); setStep(8); return; }
+      if (attendance.lateJoinEnabled && attendance.latePricing === "fixed" && attendance.lateFixedPrice.trim() === "") { setError("Enter the fixed late price"); setStep(8); return; }
+    } else if (!draft.startDate || !draft.endDate) { setError("Start and end dates are required"); setStep(0); return; }
     if (mode === "create" && draft.requiresRegistration) {
       if (isPriceInvalid(draft.price)) { setError("Base price is required (enter 0 for a free event)"); setStep(0); return; }
       if (options.some(o => isPriceInvalid(o.price))) { setError("Every option needs a price (enter 0 for a free option)"); setStep(1); setPricingSubstep(0); return; }
     }
     setSaving(true); setError(null);
     try {
+      const sortedSessions = sortSessions(sessions);
       const body: Record<string, unknown> = {
         title: draft.title.trim(), description: draft.description || undefined,
-        startDate: new Date(draft.startDate).toISOString(), endDate: new Date(draft.endDate).toISOString(),
+        startDate: multi && scheduleBounds ? isoOf(scheduleBounds.start) : new Date(draft.startDate).toISOString(),
+        endDate: multi && scheduleBounds ? isoOf(scheduleBounds.end) : new Date(draft.endDate).toISOString(),
+        scheduleType: draft.scheduleType,
+        ...(multi ? {
+          sessions: sortedSessions.map(s => ({ id: s.id, label: s.label.trim() || null, startsAt: isoOf(s.startsAt), endsAt: isoOf(s.endsAt), location: s.location.trim() || null, cancelled: s.cancelled })),
+          lateJoinEnabled: attendance.lateJoinEnabled,
+          lateJoinUntilSessionIndex: attendance.lateJoinEnabled ? sortedSessions.findIndex(s => s.key === attendance.lateJoinUntilKey) : -1,
+          latePricing: attendance.latePricing,
+          lateFixedPrice: attendance.latePricing === "fixed" ? attendance.lateFixedPrice : null,
+          checkInWindow: attendance.checkInWindow,
+          sessionReminders: attendance.remindersEnabled ? { offsets: attendance.reminderOffsets, channels: attendance.reminderChannels } : null,
+        } : {}),
+        certificatesEnabled: attendance.certificatesEnabled,
+        certificateConfig: attendance.certificate,
         registrationDeadline: draft.registrationDeadline ? new Date(draft.registrationDeadline).toISOString() : undefined,
         goLiveAt: draft.goLiveAt ? new Date(draft.goLiveAt).toISOString() : undefined,
         price: draft.requiresRegistration ? (draft.price ? parseFloat(draft.price) : 0) : 0,
@@ -1212,13 +1270,16 @@ function EventModal({ mode, event: ev, onClose, onSuccess }: EventModalProps) {
         location: draft.location.trim(),
       };
 
+      let notice: { eventId: string; moved: number; cancelled: number } | null = null;
       if (mode === "edit") {
         body.isActive = draft.isActive;
         if (!ev) throw new Error("No event loaded to save");
-        await apiFetch(`/api/events/${ev.id}`, { method: "PUT", authToken: token || undefined, body });
+        const saved = await apiFetch<Event & { sessionChanges?: { moved: number; cancelled: number } | null }>(`/api/events/${ev.id}`, { method: "PUT", authToken: token || undefined, body });
         await saveOptions(ev.id);
         // Form is saved inside saveOptions for edit mode; avoid double call
         await saveFeedback(ev.id);
+        const ch = saved?.sessionChanges;
+        if (ch && (ch.moved > 0 || ch.cancelled > 0)) notice = { eventId: ev.id, moved: ch.moved, cancelled: ch.cancelled };
       } else {
         if (formDef.isRequired || formDef.fields.length > 0) {
           body.form = { isRequired: !!formDef.isRequired, fields: formDef.fields.filter(f => f.label?.trim()).map((f, i) => ({ type: f.type, label: f.label, isRequired: !!f.isRequired, order: i, helpText: f.helpText || null, options: f.type === "multiple_choice" ? cleanChoices(f.options) : undefined })) };
@@ -1247,7 +1308,9 @@ function EventModal({ mode, event: ev, onClose, onSuccess }: EventModalProps) {
         }
       }
 
-      onSuccess(); onClose();
+      onSuccess();
+      if (notice) setChangedNotice(notice);
+      else onClose();
     } catch (e) {
       setError(errorMessage(e) || "Failed to save event");
     } finally {
@@ -1282,7 +1345,7 @@ function EventModal({ mode, event: ev, onClose, onSuccess }: EventModalProps) {
   const isOnLastSubstep = step !== 1 || pricingSubstep === 2;
   // Basic Details step requires title, start/end dates, and a base price before moving on
   // (mirrors handleSave's own checks). Base price is only compulsory when creating a new event.
-  const basicDetailsIncomplete = step === 0 && (!draft.title.trim() || !draft.startDate || !draft.endDate || (mode === "create" && draft.requiresRegistration && isPriceInvalid(draft.price)));
+  const basicDetailsIncomplete = step === 0 && (!draft.title.trim() || (multi ? !!sessionsProblem(sessions) : (!draft.startDate || !draft.endDate)) || (mode === "create" && draft.requiresRegistration && isPriceInvalid(draft.price)));
   // Items & Pricing: every option needs a valid price before leaving the step (checked across
   // all pricing substeps so switching to Variants/Early Birds can't be used to skip the gate).
   // Not applicable to contact-only events, which have no ticket options at all.
@@ -1339,6 +1402,18 @@ function EventModal({ mode, event: ev, onClose, onSuccess }: EventModalProps) {
             </div>
           )}
           {error && <div className="p-3 border rounded bg-red-50 text-red-700 text-sm">{error}</div>}
+          {changedNotice && (
+            <div className="p-3 border rounded bg-amber-50 border-amber-200 text-amber-900 text-sm space-y-2">
+              <p>
+                Saved. You {[changedNotice.moved ? `moved ${changedNotice.moved} session${changedNotice.moved === 1 ? "" : "s"}` : "", changedNotice.cancelled ? `cancelled ${changedNotice.cancelled}` : ""].filter(Boolean).join(" and ")}.
+                Tickets and calendar files show the new schedule, but people who registered aren&apos;t told automatically.
+              </p>
+              <div className="flex gap-2">
+                <a href={`/dashboard/supervisor/email-attendees?eventId=${changedNotice.eventId}`} className="px-3 py-1.5 text-xs rounded bg-brand-600 text-white hover:bg-brand-700">Message attendees</a>
+                <button type="button" onClick={onClose} className="px-3 py-1.5 text-xs rounded border bg-white hover:bg-gray-50">Done</button>
+              </div>
+            </div>
+          )}
 
           {/* ── Step 0: Basic Details ── */}
           {step === 0 && (
@@ -1351,10 +1426,26 @@ function EventModal({ mode, event: ev, onClose, onSuccess }: EventModalProps) {
                 <label className="block text-xs text-gray-600 mb-1">Description</label>
                 <textarea className="w-full border rounded px-3 py-2 text-sm" rows={3} value={draft.description} onChange={e => upd({ description: e.target.value })} />
               </div>
+              <div>
+                <div className="block text-xs text-gray-600 mb-1">When <span className="text-red-500">*</span></div>
+                <div className="inline-flex rounded-lg border p-0.5 bg-gray-50">
+                  {([["single", "One date"], ["sessions", "Multiple sessions"]] as const).map(([v, label]) => (
+                    <button key={v} type="button" onClick={() => upd({ scheduleType: v })}
+                      className={`px-3 py-1.5 text-xs rounded-md ${draft.scheduleType === v ? "bg-white shadow-sm text-brand-700 font-medium" : "text-gray-600 hover:text-gray-900"}`}>{label}</button>
+                  ))}
+                </div>
+                {multi && <p className="text-[10px] text-gray-400 mt-1">One registration and one ticket for every session, e.g. every Wednesday for 5 weeks. Check-in is per session.</p>}
+              </div>
+              {multi ? (
+                <SessionsEditor sessions={sessions} onChange={setSessions} defaultLocation={draft.location} />
+              ) : (
+                <div className="grid sm:grid-cols-2 gap-3">
+                  <DTInput label="Start" required value={draft.startDate} onChange={v => upd({ startDate: v })} />
+                  <DTInput label="End" required value={draft.endDate} onChange={v => upd({ endDate: v })} />
+                </div>
+              )}
               <div className="grid sm:grid-cols-2 gap-3">
-                <DTInput label="Start" required value={draft.startDate} onChange={v => upd({ startDate: v })} />
-                <DTInput label="End" required value={draft.endDate} onChange={v => upd({ endDate: v })} />
-                <DTInput label="Registration Deadline (optional)" value={draft.registrationDeadline} onChange={v => upd({ registrationDeadline: v })} />
+                <DTInput label="Registration Deadline (optional)" value={draft.registrationDeadline} onChange={v => upd({ registrationDeadline: v })} hint={multi ? "Registration closes when the first session starts unless late joining is on (Attendance step)" : undefined} />
                 <DTInput label="Go Live At (optional)" value={draft.goLiveAt} onChange={v => upd({ goLiveAt: v })} hint="Leave blank to show immediately" />
               </div>
               <div>
@@ -1431,6 +1522,22 @@ function EventModal({ mode, event: ev, onClose, onSuccess }: EventModalProps) {
             </div>
           )}
 
+          {/* ── Step 8: Attendance (late joining, check-in, reminders, certificates) ── */}
+          {step === 8 && (
+            <AttendanceSettings
+              value={attendance}
+              onChange={updAttendance}
+              multi={multi}
+              sessions={sessions}
+              mainPrice={parseFloat(options.find(o => o.isMainTicket)?.price || draft.price || "0") || 0}
+              uploadButton={(onUploaded) => <UploadImageButton onUploaded={onUploaded} label="Upload" />}
+              onPreview={async () => {
+                if (!token) return;
+                openBlob(await fetchApiFile(API_BASE, token, "/api/attendance/certificates/preview", { method: "POST", body: { title: draft.title || "Your event", config: attendance.certificate } }));
+              }}
+            />
+          )}
+
           {/* ── Step 2: Sections ── */}
           {step === 2 && (
             <div>
@@ -1714,7 +1821,7 @@ function EventCard({ ev, onEdit }: { ev: Event; onEdit: () => void }) {
           {isClosed && <span className="text-[10px] px-1.5 py-0.5 rounded bg-rose-50 text-rose-700">Closed</span>}
         </div>
         <div className="text-xs text-gray-500 mt-0.5">
-          {ev.startDate ? new Date(ev.startDate).toLocaleDateString() : ""}{ev.endDate ? ` – ${new Date(ev.endDate).toLocaleDateString()}` : ""}
+          {scheduleSummary(ev) || <>{ev.startDate ? new Date(ev.startDate).toLocaleDateString() : ""}{ev.endDate ? ` – ${new Date(ev.endDate).toLocaleDateString()}` : ""}</>}
           {ev.price != null ? <span className="ml-2">R{Number(ev.price).toFixed(0)}</span> : ""}
         </div>
       </div>

frontend/src/app/dashboard/supervisor/page.tsx

@@ -8,7 +8,7 @@ import { useStableState } from "@/hooks/useStableState";
 import { useVisiblePolling } from "@/hooks/useVisiblePolling";
 import {
   Calendar, Banknote, Gift, Users, Ticket, QrCode, DoorOpen, Wallet,
-  UserPlus, FileText, MessageCircle, BarChart2, Mail, TicketPercent, ShieldCheck, ListChecks, WifiOff, BedDouble, Filter,
+  UserPlus, FileText, MessageCircle, BarChart2, Mail, TicketPercent, ShieldCheck, ListChecks, WifiOff, BedDouble, Filter, ClipboardCheck,
 } from "lucide-react";
 import { StatCard, StatCardRow } from "@/components/shared/StatCard";
 import { QuickActionTile, QuickActionGrid } from "@/components/shared/QuickActionTile";
@@ -27,6 +27,7 @@ const QUICK_ACTIONS = [
   { href: "/dashboard/supervisor/payments", label: "Payments & donations", description: "Manual payments and assignment", icon: Wallet },
   { href: "/dashboard/supervisor/allocations", label: "Rooms & groups", description: "Put attendees into rooms, groups or buses", icon: BedDouble },
   { href: "/dashboard/supervisor/offline-scans", label: "Offline scanning", description: "Devices scanning offline and their synced scans", icon: WifiOff },
+  { href: "/dashboard/supervisor/attendance", label: "Attendance", description: "Who came to each session, and certificates", icon: ClipboardCheck },
   { href: "/dashboard/supervisor/waitlist", label: "Waitlist", description: "People waiting for sold-out tickets", icon: ListChecks },
   { href: "/dashboard/supervisor/consent", label: "Parental consent", description: "Youth events: consent status and medical list", icon: ShieldCheck },
   { href: "/dashboard/supervisor/coupons", label: "Coupon codes", description: "Discounts for staff, leaders and promotions", icon: TicketPercent },

frontend/src/app/dashboard/user/page.tsx

@@ -4,6 +4,7 @@ import { useAuth } from "@/hooks/useAuth";
 import { apiFetch, createFullPaymentCheckout } from "@/lib/api";
 import { useRouter } from "next/navigation";
 import { formatDate } from "@/lib/date";
+import { printTicketCards } from "@/lib/ticketPrint";
 import { formatPaymentMethod } from "@/lib/paymentMethod";
 import { QrImage } from "@/components/shared/QrImage";
 import { ApiImage } from "@/components/shared/ApiImage";
@@ -15,6 +16,7 @@ import { ClipboardList, Calendar, Ticket, ChevronRight } from "lucide-react";
 import { errorMessage } from "@/lib/utils";
 import { registrationOptionUnitPrice } from "@/lib/pricing";
 import { BundleSavings } from "@/components/shared/BundleDeals";
+import { MyCertificates } from "@/components/events/MyCertificates";
 import type { Event, EventOption, Payment, Registration, RegistrationOption, Ticket as TicketRecord } from "@/types";
 
 // Helper formatters
@@ -345,83 +347,7 @@ export default function UserDashboardPage() {
     }
   };
 
-  // Print helpers
-  const buildTicketHtmlCard = (t: TicketRecord, buyerName?: string) => {
-    const eventTitle = t.event?.title || t.eventId || "Event";
-    const eventDate = t.event?.startDate ? new Date(t.event.startDate) : null;
-    const optionName = t.registrationOption?.eventOption?.name || "Ticket";
-    const variantName = t.registrationOption?.variant?.name;
-    const type = variantName ? `${optionName} — ${variantName}` : optionName;
-    const qty = t.quantity || 1;
-    const qrSrc = `https://api.qrserver.com/v1/create-qr-code/?size=160x160&data=${encodeURIComponent(t.qrCode || t.id)}`;
-    const dateStr = eventDate ? formatDate(eventDate) : '';
-    return `
-      <div class="ticket">
-        <div class="row between">
-          <div class="evt">${eventTitle}</div>
-          ${dateStr ? `<div class="date">${dateStr}</div>` : ''}
-        </div>
-        <div class="type">${type}</div>
-        ${t.attendee?.name ? `<div class="qty">Name: <strong>${t.attendee.name}</strong></div>` : `<div class="qty">Qty: <strong>${qty}</strong></div>`}
-        <div class="qrwrap"><img src="${qrSrc}" alt="QR" /></div>
-        <div class="meta">Ticket ID: ${t.id}</div>
-        ${buyerName ? `<div class="meta">Purchased by: ${buyerName}</div>` : ''}
-      </div>
-    `;
-  };
-
-  const openPrintWindow = (title: string, cardsHtml: string) => {
-    const w = window.open("", "_blank");
-    if (!w) return;
-    w.document.write(`<!doctype html><html><head><title>${title}</title>
-      <style>
-        *{box-sizing:border-box}
-        body{font-family:Arial,Helvetica,sans-serif;margin:0;padding:16px;background:#f7f7f7}
-        .grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(260px,1fr));gap:16px}
-        .ticket{background:#fff;border:1px solid #e5e7eb;border-radius:12px;padding:14px;box-shadow:0 1px 3px rgba(0,0,0,0.06);break-inside:avoid;page-break-inside:avoid}
-        .evt{font-weight:700;font-size:14px}
-        .type{margin-top:4px;color:#374151}
-        .qty{margin-top:2px;font-size:12px;color:#374151}
-        .date{color:#6b7280;font-size:12px}
-        .row{display:flex;gap:8px;align-items:center}
-        .between{justify-content:space-between}
-        .qrwrap{display:flex;justify-content:center;align-items:center;margin:10px 0}
-        .qrwrap img{width:160px;height:160px}
-        .meta{font-size:12px;color:#6b7280;text-align:center;margin-top:6px}
-        @media print { body{background:#fff} .print-hidden{display:none !important} }
-      </style>
-    </head><body>
-      <h2 class="print-hidden" style="margin:8px 0 16px 0;font-size:18px">${title}</h2>
-      <div class="grid">${cardsHtml}</div>
-      <script>
-        (function(){
-          function printWhenReady(){
-            var imgs = Array.prototype.slice.call(document.images);
-            if(imgs.length === 0){ window.print(); return; }
-            var remaining = imgs.length;
-            function done(){ remaining--; if(remaining <= 0){ setTimeout(function(){ window.print(); }, 200); } }
-            imgs.forEach(function(img){
-              if (img.complete) { done(); }
-              else {
-                img.addEventListener('load', done, { once: true });
-                img.addEventListener('error', done, { once: true });
-              }
-            });
-          }
-          if (document.readyState === 'complete') printWhenReady();
-          else window.addEventListener('load', printWhenReady);
-        })();
-      </script>
-    </body></html>`);
-    w.document.close();
-    w.focus();
-  };
-
-  const printTickets = (ticketList: TicketRecord[]) => {
-    if (!ticketList || ticketList.length === 0) return;
-    const cards = ticketList.map(t => buildTicketHtmlCard(t, user?.name)).join("");
-    openPrintWindow(`Tickets (${ticketList.length})`, cards);
-  };
+  const printTickets = (ticketList: TicketRecord[]) => printTicketCards(ticketList, () => user?.name);
 
   // Upcoming events derived from registrations
   const upcomingEvents = useMemo(() => {
@@ -849,6 +775,8 @@ export default function UserDashboardPage() {
         </div>
       )}
 
+      <MyCertificates token={token} />
+
       <div className="grid lg:grid-cols-2 gap-6">
       <section className="mb-8 border rounded-xl p-5 bg-white shadow-sm">
         <div className="flex items-center gap-2 mb-3">

frontend/src/app/events/[id]/ClientActions.tsx

@@ -6,6 +6,12 @@ import { API_BASE } from "@/lib/api";
 
 type Props = { event: { id: string; title: string; description?: string | null } };
 
+// The event's own address tagged with where the link was handed out, so visits from it
+// show under that source in the funnel report (the page's canonical drops the tag for SEO).
+function taggedEventUrl(source: string): string {
+    return `${window.location.origin}${window.location.pathname}?utm_source=${source}`;
+}
+
 export default function ClientActions({ event }: Props) {
     return (
         <div className="flex gap-2">
@@ -15,7 +21,7 @@ export default function ClientActions({ event }: Props) {
                         await navigator.share({
                             title: event.title,
                             text: event.description ?? undefined,
-                            url: window.location.href,
+                            url: taggedEventUrl("share"),
                         });
                     } catch (err) {
                         console.error("Error sharing:", err);
@@ -29,7 +35,7 @@ export default function ClientActions({ event }: Props) {
             <button
                 onClick={async () => {
                     try {
-                        const url = window.location.href;
+                        const url = taggedEventUrl("qr");
                         const qrDataUrl = await QRCode.toDataURL(url);
                         const link = document.createElement("a");
                         link.href = qrDataUrl;

frontend/src/app/events/[id]/page.tsx

@@ -5,7 +5,8 @@ import { Footer } from "@/components/layout/Footer";
 import ClientActions from "@/app/events/[id]/ClientActions";
 import { ContactButton } from "@/components/events/ContactButton";
 import { LocationMap } from "@/components/events/LocationMap";
-import { JoinWaitlistButton, soldOutLines } from "@/components/events/JoinWaitlistButton";
+import { JoinWaitlistButton } from "@/components/events/JoinWaitlistButton";
+import { soldOutLines } from "@/lib/waitlist";
 import { SponsorSpot } from "@/components/events/SponsorSpot";
 import { FunnelTracker } from "@/components/events/FunnelTracker";
 import { Calendar, Ticket, Paperclip, Sparkles } from "lucide-react";
@@ -46,13 +47,22 @@ type Event = {
   waitlistEnabled?: boolean;
   allowSponsorships?: boolean;
   bundles?: PublicBundle[];
+  scheduleType?: "single" | "sessions";
+  sessions?: EventSession[];
+  registrationClosesAt?: string;
+  lateJoin?: LateJoinInfo | null;
 };
 
 import { apiFetch, ApiError, resolveToApiOrigin } from "@/lib/api";
 import { ApiImage } from "@/components/shared/ApiImage";
 import { formatDateTimeRange } from "@/lib/date";
 import { BundleOffers } from "@/components/shared/BundleDeals";
-import type { PublicBundle } from "@/types";
+import type { EventSession, LateJoinInfo, PublicBundle } from "@/types";
+import { latePrice, registrationClosesAt, scheduleSummary } from "@/lib/sessions";
+import { SessionSchedule } from "@/components/events/SessionSchedule";
+import { appUrl, appName } from "@/lib/siteConfig";
+import { getServerSettings } from "@/lib/serverSettings";
+import { eventJsonLd, jsonLdString } from "@/lib/eventSchema";
 
 // Tiered low-stock threshold: larger events use a smaller percentage.
 // Math.round avoids Math.ceil inflating the threshold (e.g. ceil(1.5)=2 made
@@ -78,11 +88,10 @@ function RegisterCta({ event }: { event: Event }) {
     );
   }
   const now = new Date();
-  const end = new Date(event.endDate);
-  const deadline = event.registrationDeadline ? new Date(event.registrationDeadline) : null;
   const goLive = event.goLiveAt ? new Date(event.goLiveAt) : null;
   const notYetOpen = goLive ? now < goLive : false;
-  const closed = (deadline ? now >= deadline : false) || now >= end;
+  // Multi-day events close when the first session starts (or later with late joining).
+  const closed = now >= registrationClosesAt(event);
   const limitedOpts = (event.eventOptions || []).filter(o => (o.stockLimit ?? 0) > 0);
   const eventSoldOut = limitedOpts.length > 0 && limitedOpts.every(o => o.availableCount !== undefined && o.availableCount <= 0);
 
@@ -146,10 +155,14 @@ export async function generateMetadata({ params }: { params: Promise<{ id: strin
   return {
     title: event.title,
     description,
+    // One address per event for search engines, however the page was reached
+    // (?utm_source=…, ?src=…, an alias link).
+    alternates: { canonical: `/events/${event.id}` },
     openGraph: {
       title: event.title,
       description,
       type: "website",
+      url: `/events/${event.id}`,
       ...(imageUrl ? { images: [{ url: imageUrl }] } : {}),
     },
     twitter: {
@@ -166,8 +179,18 @@ export default async function EventDetailPage({ params }: { params: Promise<{ id
   const event = await loadEvent(id);
   if (!event) notFound();
 
+  const settings = await getServerSettings();
+  const siteUrl = appUrl.replace(/\/$/, "");
+  const jsonLd = eventJsonLd(event, {
+    pageUrl: `${siteUrl}/events/${event.id}`,
+    imageUrl: event.picture ? resolveToApiOrigin(event.picture) : null,
+    organizerName: settings.org_name || appName,
+    siteUrl,
+  });
+
   return (
     <div className="min-h-screen flex flex-col">
+      <script type="application/ld+json" dangerouslySetInnerHTML={{ __html: jsonLdString(jsonLd) }} />
       <Navbar />
       <main className="flex-1 py-8 px-4 max-w-6xl mx-auto w-full">
         <FunnelTracker eventId={event.id} stage="view" />
@@ -185,7 +208,7 @@ export default async function EventDetailPage({ params }: { params: Promise<{ id
               <h1 className="text-3xl font-bold text-gray-900">{event.title}</h1>
               <p className="text-sm text-gray-500 flex items-center gap-1.5 mt-2">
                 <Calendar className="w-4 h-4 shrink-0" />
-                {formatDateTimeRange(event.startDate, event.endDate)}
+                {scheduleSummary(event) || formatDateTimeRange(event.startDate, event.endDate)}
               </p>
               <div className="mt-3">
                 <ClientActions event={event} />
@@ -194,6 +217,10 @@ export default async function EventDetailPage({ params }: { params: Promise<{ id
 
             <p className="text-gray-700 whitespace-pre-line">{event.description}</p>
 
+            {event.scheduleType === "sessions" && (event.sessions || []).length > 0 && (
+              <SessionSchedule sessions={event.sessions || []} defaultLocation={event.location} />
+            )}
+
             {event.location && (
               <div className="border rounded-xl p-5 bg-white shadow-sm">
                 <h2 className="text-base font-semibold text-gray-900 mb-3">Location</h2>
@@ -263,16 +290,24 @@ function TicketList({ event }: { event: Event }) {
       </div>
     );
   }
+  // Late joiners on a multi-day event pay a lower main-ticket price.
+  const late = event.lateJoin?.active ? event.lateJoin : null;
+  const forLate = (opt: EventOption, price: number) => (late && opt.isMainTicket ? latePrice(price, late) : price);
   return (
     <div className="space-y-2">
       <BundleOffers bundles={event.bundles} />
+      {late && (
+        <p className="text-xs text-brand-800 bg-brand-50 border border-brand-200 rounded-lg px-3 py-2">
+          Joining late? {late.sessionsLeft} of {late.totalSessions} sessions are still to come, so the ticket price below is {late.mode === "prorata" ? "for the sessions left" : "the late-joiner price"}.
+        </p>
+      )}
       {options.map((opt) => {
         const hasVariants = Array.isArray(opt.variants) && opt.variants.length > 0;
         const soldOut = (opt.stockLimit ?? 0) > 0 && opt.availableCount !== undefined && opt.availableCount <= 0;
         const nearlyOut = !soldOut && (opt.stockLimit ?? 0) > 0 && opt.availableCount !== undefined && opt.availableCount <= lowStockThreshold(opt.stockLimit ?? 0);
 
         if (hasVariants) {
-          const prices = opt.variants!.map((v) => v.price !== null && v.price !== undefined ? v.price : opt.price);
+          const prices = opt.variants!.map((v) => forLate(opt, v.price !== null && v.price !== undefined ? v.price : opt.price));
           const minPrice = Math.min(...prices);
           const maxPrice = Math.max(...prices);
           const priceLabel = minPrice === 0 && maxPrice === 0 ? "Free" : minPrice === maxPrice ? `R${minPrice.toFixed(2)}` : minPrice === 0 ? `Free – R${maxPrice.toFixed(2)}` : `From R${minPrice.toFixed(2)}`;
@@ -288,7 +323,7 @@ function TicketList({ event }: { event: Event }) {
               </div>
               <ul className="divide-y">
                 {opt.variants!.slice().sort((a, b) => (a.order ?? 0) - (b.order ?? 0)).map((v) => {
-                  const vPrice = v.price !== null && v.price !== undefined ? v.price : opt.price;
+                  const vPrice = forLate(opt, v.price !== null && v.price !== undefined ? v.price : opt.price);
                   const vSoldOut = (v.stockLimit ?? 0) > 0 && v.availableCount !== undefined && v.availableCount <= 0;
                   const vNearlyOut = !vSoldOut && (v.stockLimit ?? 0) > 0 && v.availableCount !== undefined && v.availableCount <= lowStockThreshold(v.stockLimit ?? 0);
                   return (
@@ -312,7 +347,7 @@ function TicketList({ event }: { event: Event }) {
         const activeTiers = (opt.earlyBirdTiers || [])
           .filter((t) => now < new Date(t.deadline))
           .sort((a, b) => a.price - b.price);
-        const displayPrice = activeTiers.length > 0 ? activeTiers[0].price : opt.price;
+        const displayPrice = forLate(opt, activeTiers.length > 0 ? activeTiers[0].price : opt.price);
 
         return (
           <div key={opt.id} className="flex items-center justify-between border rounded-lg px-3 py-2 text-sm text-gray-700">

frontend/src/app/events/page.tsx

@@ -10,6 +10,7 @@ export const revalidate = 60;
 export const metadata: Metadata = {
   title: "All Events",
   description: "Browse and register for upcoming events.",
+  alternates: { canonical: "/events" },
 };
 
 type Event = {
@@ -19,6 +20,8 @@ type Event = {
   startDate: string;
   endDate: string;
   registrationDeadline?: string | null;
+  // Multi-day events: listed by their next session, not their first.
+  nextSession?: { startsAt: string } | null;
   goLiveAt?: string;
   price: number;
   picture?: string;
@@ -34,7 +37,7 @@ export default async function EventsPage() {
         const t = new Date(e.endDate || e.startDate).getTime();
         return !isNaN(t) && t > now;
     });
-    const sorted = [...upcoming].sort((a, b) => new Date(a.startDate).getTime() - new Date(b.startDate).getTime());
+    const sorted = [...upcoming].sort((a, b) => new Date(a.nextSession?.startsAt || a.startDate).getTime() - new Date(b.nextSession?.startsAt || b.startDate).getTime());
 
   return (
     <div className="min-h-screen flex flex-col">

frontend/src/app/forms/page.tsx

@@ -18,6 +18,8 @@ function FormsContent() {
   const router = useRouter();
   const { token } = useAuth();
   const registrationId = search.get("registrationId");
+  // Donation chosen on the register form — passed through so the success page can add it to the payment.
+  const donationParam = search.get("donation") ? `&donation=${encodeURIComponent(search.get("donation")!)}` : "";
   // Set when a named attendee opens the link sent to them — show only their form.
   const onlyAttendeeId = search.get("attendeeId");
 
@@ -119,7 +121,7 @@ function FormsContent() {
       if (payload.length === 0) {
         // Nothing left to submit – still go to success page to continue the flow
         const totalDue = (registration?.registrationOptions || []).reduce((s, ro) => s + ((ro.eventOption?.price || 0) * (ro.quantity || 0)), 0);
-        router.push(`/registration/success?registrationId=${encodeURIComponent(registrationId)}${totalDue>0?`&totalDue=${encodeURIComponent(totalDue.toFixed(2))}`:''}`);
+        router.push(`/registration/success?registrationId=${encodeURIComponent(registrationId)}${totalDue>0?`&totalDue=${encodeURIComponent(totalDue.toFixed(2))}`:''}${donationParam}`);
         return;
       }
       await apiFetch(`/api/registrations/${encodeURIComponent(registrationId)}/forms/responses`, {
@@ -129,7 +131,7 @@ function FormsContent() {
       });
       // On success, redirect to the success page
       const totalDue = (registration?.registrationOptions || []).reduce((s, ro) => s + ((ro.eventOption?.price || 0) * (ro.quantity || 0)), 0);
-      router.push(`/registration/success?registrationId=${encodeURIComponent(registrationId)}${totalDue>0?`&totalDue=${encodeURIComponent(totalDue.toFixed(2))}`:''}`);
+      router.push(`/registration/success?registrationId=${encodeURIComponent(registrationId)}${totalDue>0?`&totalDue=${encodeURIComponent(totalDue.toFixed(2))}`:''}${donationParam}`);
     } catch (e) {
       setError(errorMessage(e) || 'Failed to submit forms');
     }
@@ -149,7 +151,7 @@ function FormsContent() {
       try {
         // Redirect to the success page
         const totalDue = (registration?.registrationOptions || []).reduce((s, ro) => s + ((ro.eventOption?.price || 0) * (ro.quantity || 0)), 0);
-        router.push(`/registration/success?registrationId=${encodeURIComponent(registrationId)}${totalDue>0?`&totalDue=${encodeURIComponent(totalDue.toFixed(2))}`:''}`);
+        router.push(`/registration/success?registrationId=${encodeURIComponent(registrationId)}${totalDue>0?`&totalDue=${encodeURIComponent(totalDue.toFixed(2))}`:''}${donationParam}`);
       } catch (e) {
         setError(errorMessage(e) || 'Failded to go to next step');
       }
@@ -163,7 +165,7 @@ function FormsContent() {
     try {
       // Redirect to the success page
       const totalDue = (registration?.registrationOptions || []).reduce((s, ro) => s + ((ro.eventOption?.price || 0) * (ro.quantity || 0)), 0);
-      router.push(`/registration/success?registrationId=${encodeURIComponent(registrationId)}${totalDue>0?`&totalDue=${encodeURIComponent(totalDue.toFixed(2))}`:''}`);
+      router.push(`/registration/success?registrationId=${encodeURIComponent(registrationId)}${totalDue>0?`&totalDue=${encodeURIComponent(totalDue.toFixed(2))}`:''}${donationParam}`);
     } catch (e) {
       setError(errorMessage(e) || 'Failded to skip');
     }

frontend/src/app/layout.tsx

@@ -2,40 +2,19 @@ import type { Metadata } from "next";
 import "./globals.css";
 import { AuthProvider } from "@/contexts/AuthContext";
 import { SiteSettingsProvider } from "@/contexts/SiteSettingsContext";
-import type { SiteSettings } from "@/contexts/SiteSettingsContext";
 import { ToastProvider } from "@/components/shared/ToastProvider";
 import { BannerBar } from "@/components/shared/BannerBar";
 import { SetupGuard } from "@/components/shared/SetupGuard";
 import HelpFab from "@/components/shared/HelpFab";
 import { CookieConsent } from "@/components/shared/CookieConsent";
 import { ImpersonationBanner } from "@/components/shared/ImpersonationBanner";
-import { API_BASE, resolveToApiOrigin } from "@/lib/api";
+import { resolveToApiOrigin } from "@/lib/api";
+import { getServerSettings } from "@/lib/serverSettings";
 import { buildThemeCssVars } from "@/lib/colorScale";
 import { appUrl } from "@/lib/siteConfig";
 
 const appName = process.env.NEXT_PUBLIC_APP_NAME || 'Cross Code';
 
-/**
- * Server-side settings fetch, shared by generateMetadata() and RootLayout()
- * below. Both call this with the identical URL + options so Next's per-request
- * fetch memoization dedupes them into a single network call. Degrades to `{}`
- * (static defaults everywhere downstream) if the backend is unreachable at
- * request time — intentional, not a bug: branding just isn't critical enough
- * to fail the whole page render over.
- */
-async function getServerSettings(): Promise<SiteSettings> {
-  // No API base configured: a relative fetch never settles during prerender and
-  // would time out every page, so skip straight to the defaults.
-  if (!API_BASE) return {};
-  try {
-    const res = await fetch(`${API_BASE}/api/settings`, { next: { revalidate: 60 } });
-    if (!res.ok) return {};
-    return await res.json();
-  } catch {
-    return {};
-  }
-}
-
 export async function generateMetadata(): Promise<Metadata> {
   const settings = await getServerSettings();
   const faviconUrl = settings.favicon_url ? resolveToApiOrigin(settings.favicon_url) : null;
@@ -63,6 +42,8 @@ export async function generateMetadata(): Promise<Metadata> {
       description,
       ...(logoUrl ? { images: [logoUrl] } : {}),
     },
+    // Per-deployment Search Console ownership check (Settings → Organisation).
+    ...(settings.google_site_verification ? { verification: { google: settings.google_site_verification } } : {}),
   };
 }
 

frontend/src/app/page.tsx

@@ -5,8 +5,13 @@ import { Footer } from "@/components/layout/Footer";
 import { JoinUsButton } from "@/components/home/JoinUsButton";
 import { appName } from "@/lib/siteConfig";
 import { API_BASE } from "@/lib/api";
+import type { Metadata } from "next";
 import { Calendar, ArrowRight, CalendarCheck, Users, Heart, ShieldCheck } from "lucide-react";
 
+export const metadata: Metadata = {
+  alternates: { canonical: "/" },
+};
+
 type Event = {
   id: string;
   title: string;
@@ -14,6 +19,8 @@ type Event = {
   startDate: string;
   endDate: string;
   registrationDeadline?: string | null;
+  // Multi-day events: listed by their next session, not their first.
+  nextSession?: { startsAt: string } | null;
   goLiveAt?: string;
   price: number;
   picture?: string;
@@ -50,7 +57,7 @@ export default async function HomePage() {
         const t = new Date(e.endDate || e.startDate).getTime();
         return !isNaN(t) && t > now;
     });
-    const sorted = [...upcoming].sort((a, b) => new Date(a.startDate).getTime() - new Date(b.startDate).getTime());
+    const sorted = [...upcoming].sort((a, b) => new Date(a.nextSession?.startsAt || a.startDate).getTime() - new Date(b.nextSession?.startsAt || b.startDate).getTime());
 
     return (
         <div className="min-h-screen flex flex-col">

frontend/src/app/register/[eventId]/RegisterForm.tsx

@@ -5,7 +5,8 @@ import { useAuth } from "@/hooks/useAuth";
 import { apiFetch } from "@/lib/api";
 import { CouponCodeField, AppliedCoupon } from "@/components/shared/CouponCodeField";
 import { BundleBuilder, BundleOffers, BundleSavings, useBundleQuote } from "@/components/shared/BundleDeals";
-import type { PublicBundle } from "@/types";
+import type { EventSession, LateJoinInfo, PublicBundle } from "@/types";
+import { latePrice, registrationClosesAt } from "@/lib/sessions";
 import { AttendeeNamesEditor, AttendeeEntries, TicketDelivery, attendeesPayload, consentDetailsMissing } from "@/components/shared/AttendeeNamesEditor";
 import { JoinWaitlistButton } from "@/components/events/JoinWaitlistButton";
 import { analyticsSessionId } from "@/lib/analytics";
@@ -52,8 +53,28 @@ export type RegisterEvent = {
   collectGender?: boolean;
   waitlistEnabled?: boolean;
   bundles?: PublicBundle[];
+  scheduleType?: "single" | "sessions";
+  sessions?: EventSession[];
+  registrationClosesAt?: string;
+  lateJoin?: LateJoinInfo | null;
 };
 
+// Late joiners on a multi-day event: show main tickets at the late price (the server
+// charges the same — see backend utils/sessions.js).
+function withLatePrices(event: RegisterEvent): RegisterEvent {
+  const late = event.lateJoin?.active ? event.lateJoin : null;
+  if (!late) return event;
+  return {
+    ...event,
+    eventOptions: (event.eventOptions || []).map(o => (!o.isMainTicket ? o : {
+      ...o,
+      price: latePrice(o.price, late),
+      earlyBirdTiers: (o.earlyBirdTiers || []).map(t => ({ ...t, price: latePrice(t.price, late) })),
+      variants: (o.variants || []).map(v => (v.price === null || v.price === undefined ? v : { ...v, price: latePrice(v.price, late) })),
+    })),
+  };
+}
+
 type WaitlistOffer = { eventOptionId: string; variantId: string | null; quantity: number; expiresAt: string; optionName: string; variantName: string | null };
 
 // Key format: "optionId" for no-variant options, "optionId:variantId" for variant options
@@ -257,6 +278,77 @@ function OptionCard({
   );
 }
 
+// Online donations have the same R15 minimum as the donate page and the backend.
+const MIN_DONATION = 15;
+
+// Suggested donations: 10/15/20/25% of the ticket total rounded up to the next R10 (at least R20),
+// topped up with fixed amounts when the percentages collapse on a small total.
+function donationPresets(total: number): number[] {
+  const out: number[] = [];
+  for (const pct of [0.10, 0.15, 0.20, 0.25]) {
+    const v = Math.max(20, Math.ceil((total * pct) / 10) * 10);
+    if (!out.includes(v)) out.push(v);
+  }
+  for (const v of [50, 100, 200]) {
+    if (out.length >= 3) break;
+    if (!out.includes(v) && v > out[out.length - 1]) out.push(v);
+  }
+  return out;
+}
+
+type DonationChoice = { kind: "none" } | { kind: "preset"; index: number } | { kind: "custom" };
+
+function DonationPicker({
+  presets,
+  choice,
+  onChoiceChange,
+  customAmount,
+  onCustomAmountChange,
+}: {
+  presets: number[];
+  choice: DonationChoice;
+  onChoiceChange: (c: DonationChoice) => void;
+  customAmount: string;
+  onCustomAmountChange: (v: string) => void;
+}) {
+  const btn = (active: boolean) =>
+    `px-3 py-2 rounded-lg border text-sm font-medium transition-colors ${active ? "bg-brand-600 border-brand-600 text-white" : "bg-white text-gray-700 hover:bg-gray-50"}`;
+  return (
+    <div className="border rounded-lg p-4 bg-white shadow-sm">
+      <div className="font-medium text-sm">Donation amount</div>
+      <p className="text-xs text-gray-500 mt-0.5 mb-3">Would you like to add a donation to support this event? It&apos;s added to your payment.</p>
+      <div className="flex flex-wrap gap-2">
+        {presets.map((amt, i) => (
+          <button key={i} type="button" className={btn(choice.kind === "preset" && choice.index === i)} onClick={() => onChoiceChange({ kind: "preset", index: i })}>
+            R{amt}
+          </button>
+        ))}
+        <button type="button" className={btn(choice.kind === "custom")} onClick={() => onChoiceChange({ kind: "custom" })}>
+          Custom
+        </button>
+        <button type="button" className={btn(choice.kind === "none")} onClick={() => onChoiceChange({ kind: "none" })}>
+          None
+        </button>
+      </div>
+      {choice.kind === "custom" && (
+        <div className="mt-3">
+          <input
+            type="number"
+            min={MIN_DONATION}
+            step="1"
+            inputMode="decimal"
+            autoFocus
+            placeholder={`Amount in Rand (min R${MIN_DONATION})`}
+            value={customAmount}
+            onChange={(e) => onCustomAmountChange(e.target.value)}
+            className="w-full sm:w-60 border rounded-lg px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-brand-400"
+          />
+        </div>
+      )}
+    </div>
+  );
+}
+
 export default function RegisterForm({ event: baseEvent }: { event: RegisterEvent }) {
   const { token, user } = useAuth();
   const eventId = baseEvent.id;
@@ -279,10 +371,11 @@ export default function RegisterForm({ event: baseEvent }: { event: RegisterEven
       .catch((e: unknown) => setOfferError(errorMessage(e) || "This waitlist link is not valid."));
   }, []);
   const event = useMemo<RegisterEvent>(() => {
-    if (!offer) return baseEvent;
+    const priced = withLatePrices(baseEvent);
+    if (!offer) return priced;
     return {
-      ...baseEvent,
-      eventOptions: (baseEvent.eventOptions || []).map(o => {
+      ...priced,
+      eventOptions: (priced.eventOptions || []).map(o => {
         if (o.id !== offer.eventOptionId) return o;
         return {
           ...o,
@@ -329,11 +422,11 @@ export default function RegisterForm({ event: baseEvent }: { event: RegisterEven
       const now = new Date();
       const end = event.endDate ? new Date(event.endDate) : null;
       const deadline = event.registrationDeadline ? new Date(event.registrationDeadline) : null;
-      if ((deadline && now >= deadline) || (end && now >= end)) {
+      if ((deadline && now >= deadline) || (end && now >= end) || now >= registrationClosesAt(event)) {
         window.location.replace('/events');
       }
     } catch {}
-  }, [event.endDate, event.registrationDeadline]);
+  }, [event]);
 
   const handleQtyChange = (key: string, val: number) => {
     setQuantities((q) => ({ ...q, [key]: val }));
@@ -367,6 +460,17 @@ export default function RegisterForm({ event: baseEvent }: { event: RegisterEven
   // a code, so its total wins.
   const payable = coupon ? coupon.total : bundleQuote ? bundleQuote.total : total;
 
+  // Optional donation on top of the tickets — paid in the same Yoco checkout and recorded
+  // as a separate donation payment. Only offered when there's something to pay online.
+  const [donationChoice, setDonationChoice] = useState<DonationChoice>({ kind: "none" });
+  const [customDonation, setCustomDonation] = useState("");
+  const presets = useMemo(() => donationPresets(total), [total]);
+  const showDonation = isLoggedIn && payable > 0 && !eventSoldOut;
+  const donation = !showDonation ? 0
+    : donationChoice.kind === "preset" ? (presets[donationChoice.index] ?? 0)
+    : donationChoice.kind === "custom" ? Math.max(0, Math.round((parseFloat(customDonation) || 0) * 100) / 100)
+    : 0;
+
   function buildItems() {
     const items: { eventOptionId: string; quantity: number; variantId?: string }[] = [];
     Object.entries(quantities).forEach(([key, qty]) => {
@@ -391,6 +495,11 @@ export default function RegisterForm({ event: baseEvent }: { event: RegisterEven
       const missing = consentDetailsMissing(event.eventOptions || [], qtyFor, attendeeEntries, event.startDate);
       if (missing) { setError(missing); return; }
     }
+    if (showDonation && donationChoice.kind === "custom" && donation > 0 && donation < MIN_DONATION) {
+      setError(`The minimum donation is R${MIN_DONATION}. Choose None to skip it.`);
+      return;
+    }
+    const donationParam = donation > 0 ? `&donation=${encodeURIComponent(donation.toFixed(2))}` : "";
 
     // Claim link without logging in: the link identifies the person.
     if (waitlistToken && !isLoggedIn) {
@@ -435,8 +544,8 @@ export default function RegisterForm({ event: baseEvent }: { event: RegisterEven
           const hasForm = !!(event?.form && Array.isArray(event.form.fields) && event.form.fields.length > 0);
           const due = res.totalDueComputed ?? payable;
           const next = hasForm
-            ? `/forms?registrationId=${encodeURIComponent(res.id)}`
-            : `/registration/success?registrationId=${encodeURIComponent(res.id)}&totalDue=${encodeURIComponent((due || 0).toFixed(2))}`;
+            ? `/forms?registrationId=${encodeURIComponent(res.id)}${donationParam}`
+            : `/registration/success?registrationId=${encodeURIComponent(res.id)}&totalDue=${encodeURIComponent((due || 0).toFixed(2))}${donationParam}`;
           if (res.couponError) {
             // The code ran out between checking and registering — the registration is
             // saved at full price, so say so before moving on.
@@ -573,6 +682,24 @@ export default function RegisterForm({ event: baseEvent }: { event: RegisterEven
         />
       )}
 
+      {showDonation && (
+        <div className="mt-3">
+          <DonationPicker
+            presets={presets}
+            choice={donationChoice}
+            onChoiceChange={setDonationChoice}
+            customAmount={customDonation}
+            onCustomAmountChange={setCustomDonation}
+          />
+        </div>
+      )}
+
+      {event.lateJoin?.active && (
+        <div className="mt-4 p-3 rounded-lg bg-brand-50 border border-brand-200 text-sm text-brand-900">
+          <strong>Joining late:</strong> {event.lateJoin.sessionsLeft} of {event.lateJoin.totalSessions} sessions are still to come, so main tickets are at the {event.lateJoin.mode === "prorata" ? "price for the sessions left" : "late-joiner price"}.
+        </div>
+      )}
+
       {(() => {
         // Collect all upcoming early-bird tiers across all options
         const now = new Date();
@@ -623,7 +750,10 @@ export default function RegisterForm({ event: baseEvent }: { event: RegisterEven
           {coupon && coupon.discount > 0 && (
             <div className="text-sm text-green-700">Code {coupon.code} −R{coupon.discount.toFixed(2)}</div>
           )}
-          <div className="text-lg font-semibold">Total: R{payable.toFixed(2)}</div>
+          {donation > 0 && (
+            <div className="text-sm text-gray-600">Donation +R{donation.toFixed(2)}</div>
+          )}
+          <div className="text-lg font-semibold">Total: R{(payable + donation).toFixed(2)}</div>
         </div>
         {eventSoldOut ? (
           <button disabled className="bg-red-50 text-red-700 border border-red-200 px-4 py-2 rounded cursor-not-allowed">

frontend/src/app/registration/success/page.tsx

@@ -21,6 +21,13 @@ function RegistrationSuccessContent() {
     return isNaN(n) ? 0 : n;
   }, [fallbackTotalParam]);
 
+  // Optional donation picked on the register form; added to the Yoco checkout as its own line.
+  const donationParam = search.get("donation");
+  const donation = React.useMemo(() => {
+    const n = donationParam ? Number(donationParam) : 0;
+    return isNaN(n) || n < 15 ? 0 : Math.round(n * 100) / 100;
+  }, [donationParam]);
+
   const [reg, setReg] = React.useState<Registration | null>(null);
   const [form, setForm] = React.useState<{ isRequired: boolean; fields: FormField[] } | null>(null);
   const [error, setError] = React.useState<string | null>(null);
@@ -81,7 +88,7 @@ function RegistrationSuccessContent() {
       setError(null);
       setPayLoading(true);
       const { createFullPaymentCheckout } = await import('@/lib/api');
-      const res = await createFullPaymentCheckout(token, registrationId);
+      const res = await createFullPaymentCheckout(token, registrationId, donation);
       if (res.priceUpdated) {
         // Early-bird price changed since registration — surface the new total and
         // reload the registration so the displayed totalDue reflects it, instead of redirecting.
@@ -123,7 +130,14 @@ function RegistrationSuccessContent() {
               <div className="text-sm">Please complete one form per main ticket to receive tickets. You can also do this later from your dashboard, but tickets cannot be generated until completed.</div>
             </div>
           ) : (totalDue > 0 || (!reg && fallbackTotalDue > 0)) ? (
-            <p className="text-gray-700 mb-6">Would you like to pay with Yoco now?</p>
+            <>
+              {donation > 0 && (
+                <p className="text-gray-700 mb-2">
+                  Thank you for adding a donation of <strong>R{donation.toFixed(2)}</strong>. It&apos;s included when you pay now.
+                </p>
+              )}
+              <p className="text-gray-700 mb-6">Would you like to pay with Yoco now?</p>
+            </>
           ) : null}
 
           <div className="flex flex-col sm:flex-row gap-3 mt-4">

frontend/src/components/admin/JobsTab.tsx

@@ -0,0 +1,143 @@
+"use client";
+
+import React, { useCallback, useEffect, useState } from "react";
+import { Timer, Play, RefreshCw } from "lucide-react";
+import { useAuth } from "@/hooks/useAuth";
+import { apiFetch } from "@/lib/api";
+import { useDismissingState } from "@/hooks/useDismissingState";
+import { errorMessage } from "@/lib/utils";
+
+type JobRun = { state: string; createdOn?: string; startedOn: string | null; completedOn: string | null; output: unknown };
+type JobInfo = { name: string; label: string; cron: string; enabled: boolean; envFlag: string | null; nextRun: string | null; recent: JobRun[] };
+type JobsResponse = { mode: "queue" | "timers" | "off"; timezone: string; jobs: JobInfo[] };
+
+const STATE: Record<string, string> = {
+  completed: "bg-green-50 text-green-800",
+  failed: "bg-red-50 text-red-700",
+  active: "bg-blue-50 text-blue-700",
+  created: "bg-gray-100 text-gray-600",
+  retry: "bg-amber-50 text-amber-800",
+  cancelled: "bg-gray-100 text-gray-500",
+};
+
+const when = (d: string | null) => (d ? new Date(d).toLocaleString("en-GB", { day: "numeric", month: "short", hour: "2-digit", minute: "2-digit" }) : "—");
+
+function describeCron(cron: string): string {
+  const m = /^\*\/(\d+) \* \* \* \*$/.exec(cron);
+  if (m) return `Every ${m[1]} minutes`;
+  const d = /^(\d+) (\d+) \* \* \*$/.exec(cron);
+  if (d) return `Daily at ${d[2].padStart(2, "0")}:${d[1].padStart(2, "0")}`;
+  return cron;
+}
+
+function outputText(run: JobRun): string {
+  if (run.output === null || run.output === undefined) return "";
+  if (typeof run.output === "object" && run.output && "message" in run.output && run.state === "failed") return String((run.output as { message: unknown }).message);
+  try { return JSON.stringify(run.output); } catch { return ""; }
+}
+
+// Settings → Background jobs: what runs when, the last runs of each job, and "Run now".
+export function JobsTab({ active }: { active: boolean }) {
+  const { token } = useAuth();
+  const [data, setData] = useState<JobsResponse | null>(null);
+  const [loading, setLoading] = useState(true);
+  const [running, setRunning] = useState<string | null>(null);
+  const [open, setOpen] = useState<string | null>(null);
+  const [message, setMessage] = useDismissingState<{ type: "ok" | "err"; text: string } | null>(null);
+
+  const load = useCallback(async () => {
+    if (!token) return;
+    setLoading(true);
+    try {
+      setData(await apiFetch<JobsResponse>("/api/admin/jobs", { authToken: token }));
+    } catch (e) {
+      setMessage({ type: "err", text: errorMessage(e) || "Failed to load background jobs" });
+    } finally {
+      setLoading(false);
+    }
+  }, [token, setMessage]);
+
+  useEffect(() => { if (active) load(); }, [active, load]);
+
+  const runNow = async (job: JobInfo) => {
+    if (!token) return;
+    setRunning(job.name);
+    try {
+      const r = await apiFetch<{ queued: boolean }>(`/api/admin/jobs/${job.name}/run`, { method: "POST", authToken: token });
+      setMessage({ type: "ok", text: r.queued ? `"${job.label}" queued — it starts within a few seconds.` : `"${job.label}" ran.` });
+      setTimeout(load, r.queued ? 4000 : 0);
+    } catch (e) {
+      setMessage({ type: "err", text: errorMessage(e) || "Couldn't run the job" });
+    } finally {
+      setRunning(null);
+    }
+  };
+
+  return (
+    <div className="space-y-4">
+      <div className="flex items-start justify-between gap-3">
+        <div>
+          <h2 className="text-lg font-semibold flex items-center gap-2"><Timer className="w-5 h-5 text-brand-600" /> Background jobs</h2>
+          <p className="text-sm text-gray-500 mt-0.5">
+            Tasks the server runs on a schedule ({data?.timezone || "local"} time). Each runs once per schedule, even with more than one server process, and failed runs are retried.
+          </p>
+        </div>
+        <button type="button" onClick={load} disabled={loading} className="inline-flex items-center gap-1.5 px-3 py-1.5 text-sm rounded border bg-white hover:bg-gray-50 disabled:opacity-50 shrink-0">
+          <RefreshCw className={`w-4 h-4 ${loading ? "animate-spin" : ""}`} /> Refresh
+        </button>
+      </div>
+
+      {message && <div className={`p-3 border rounded text-sm ${message.type === "ok" ? "bg-green-50 text-green-800" : "bg-red-50 text-red-700"}`}>{message.text}</div>}
+      {data?.mode === "timers" && (
+        <div className="p-3 border rounded bg-amber-50 text-amber-900 text-sm">The job queue couldn&apos;t start, so jobs are running on simple timers in this server process (no retries, history only since the last restart). Check the server log for &quot;[jobs]&quot;.</div>
+      )}
+      {data?.mode === "off" && (
+        <div className="p-3 border rounded bg-gray-50 text-gray-700 text-sm">All background jobs are switched off (JOBS_ENABLED=false).</div>
+      )}
+
+      <ul className="divide-y border rounded-lg">
+        {(data?.jobs || []).map(job => {
+          const last = job.recent[0];
+          return (
+            <li key={job.name} className="p-3">
+              <div className="flex flex-wrap items-center gap-2">
+                <div className="min-w-0 mr-auto">
+                  <div className="font-medium text-sm text-gray-900">{job.label}</div>
+                  <div className="text-xs text-gray-500">
+                    {job.enabled ? `${describeCron(job.cron)} · next ${when(job.nextRun)}` : `Off${job.envFlag ? ` (${job.envFlag}=false)` : ""}`}
+                  </div>
+                </div>
+                {last && (
+                  <button type="button" onClick={() => setOpen(open === job.name ? null : job.name)} className={`text-xs px-2 py-0.5 rounded ${STATE[last.state] || "bg-gray-100 text-gray-600"}`} title="Show recent runs">
+                    {last.state} · {when(last.completedOn || last.startedOn || last.createdOn || null)}
+                  </button>
+                )}
+                <button type="button" disabled={running !== null || data?.mode === "off"} onClick={() => runNow(job)}
+                  className="inline-flex items-center gap-1 px-2.5 py-1 text-xs rounded border border-brand-200 bg-brand-50 text-brand-700 hover:bg-brand-100 disabled:opacity-50">
+                  <Play className="w-3.5 h-3.5" /> {running === job.name ? "Starting…" : "Run now"}
+                </button>
+              </div>
+              {open === job.name && job.recent.length > 0 && (
+                <table className="mt-2 w-full text-xs">
+                  <thead className="text-gray-500"><tr><th className="text-left font-medium py-1">Started</th><th className="text-left font-medium">Finished</th><th className="text-left font-medium">State</th><th className="text-left font-medium">Result</th></tr></thead>
+                  <tbody>
+                    {job.recent.map((r, i) => (
+                      <tr key={i} className="border-t">
+                        <td className="py-1 pr-2 whitespace-nowrap">{when(r.startedOn)}</td>
+                        <td className="pr-2 whitespace-nowrap">{when(r.completedOn)}</td>
+                        <td className="pr-2"><span className={`px-1.5 py-0.5 rounded ${STATE[r.state] || ""}`}>{r.state}</span></td>
+                        <td className="font-mono text-[11px] text-gray-600 break-all">{outputText(r)}</td>
+                      </tr>
+                    ))}
+                  </tbody>
+                </table>
+              )}
+            </li>
+          );
+        })}
+        {!loading && data && data.jobs.length === 0 && <li className="p-3 text-sm text-gray-500">No jobs.</li>}
+      </ul>
+      <p className="text-xs text-gray-400">Change a schedule with the env var JOB_SCHEDULE_&lt;NAME&gt; (cron, e.g. JOB_SCHEDULE_WAITLIST=&quot;*/5 * * * *&quot;), or switch one off with its own flag.</p>
+    </div>
+  );
+}

frontend/src/components/events/EventCard.tsx

@@ -19,16 +19,44 @@ import { ContactButton } from "@/components/events/ContactButton";
    contactPhone?: string | null;
    contactEmail?: string | null;
    location?: string | null;
+   // Set by GET /api/events while an early-bird tier is still running.
+   earlyBirdEndsAt?: string | null;
+   scheduleType?: "single" | "sessions";
+   sessions?: EventSession[];
+   registrationClosesAt?: string;
 };
 
 import { formatDateTimeRange } from "@/lib/date";
+import { registrationClosesAt, scheduleSummary } from "@/lib/sessions";
+import type { EventSession } from "@/types";
 
 export const EventCard = ({ event }: { event: Event }) => {
-    const dateRange = formatDateTimeRange(event.startDate, event.endDate);
+    const dateRange = scheduleSummary(event) || formatDateTimeRange(event.startDate, event.endDate);
+
+    const now = new Date();
+    const goLive = event.goLiveAt ? new Date(event.goLiveAt) : null;
+    // Multi-day events close when the first session starts (or later with late joining).
+    const closesAt = registrationClosesAt(event);
+    const registrationOpen = event.requiresRegistration !== false
+      && !(goLive && now < goLive)
+      && now < closesAt;
+    const showEarlyBird = !!event.earlyBirdEndsAt && registrationOpen && !event.isSoldOut;
 
     return (
-        <div className="border rounded-xl overflow-hidden shadow-sm hover:shadow-md hover:border-brand-200 transition">
+        <div className="relative border rounded-xl overflow-hidden shadow-sm hover:shadow-md hover:border-brand-200 transition">
+            {showEarlyBird && (
+                <div className="pointer-events-none absolute top-0 right-0 z-10 h-32 w-32 overflow-hidden" aria-hidden="true">
+                    <div className="absolute top-[26px] -right-[38px] w-[150px] rotate-45 bg-amber-400 py-1 text-center text-xs font-bold uppercase tracking-wide text-amber-950 shadow-md">
+                        Early bird
+                    </div>
+                </div>
+            )}
             <a href={`/events/${event.id}`} className="block">
+                {showEarlyBird && (
+                    <span className="sr-only">
+                        Early bird pricing until {new Date(event.earlyBirdEndsAt!).toLocaleDateString("en-GB", { day: "numeric", month: "long" })}.
+                    </span>
+                )}
                 {event.picture ? (
                     <ApiImage src={event.picture} alt={event.title} className="h-48 w-full object-cover" />
                 ) : (
@@ -69,12 +97,8 @@ export const EventCard = ({ event }: { event: Event }) => {
                           />
                         );
                       }
-                      const now = new Date();
-                      const end = new Date(event.endDate);
-                      const deadline = event.registrationDeadline ? new Date(event.registrationDeadline) : null;
-                      const goLive = event.goLiveAt ? new Date(event.goLiveAt) : null;
                       const notYetOpen = goLive ? now < goLive : false;
-                      const closed = (deadline ? now >= deadline : false) || now >= end;
+                      const closed = now >= closesAt;
                       if (notYetOpen) {
                         return (
                           <button disabled className="flex-1 text-center text-sm text-gray-500 bg-gray-200 rounded-lg py-2 cursor-not-allowed" title="Registration not yet open">

frontend/src/components/events/JoinWaitlistButton.tsx

@@ -4,8 +4,9 @@ import React, { useState } from "react";
 import { ListPlus, X } from "lucide-react";
 import { apiFetch, ApiError } from "@/lib/api";
 import { useAuth } from "@/hooks/useAuth";
+import type { WaitlistLine } from "@/lib/waitlist";
 
-export type WaitlistLine = { eventOptionId: string; variantId?: string | null; label: string };
+export type { WaitlistLine };
 
 const inputCls = "w-full border rounded-lg px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-brand-400";
 
@@ -125,21 +126,3 @@ export function JoinWaitlistButton({ eventId, lines, guestsAllowed, initialLine,
 function keyOf(l?: WaitlistLine) {
   return l ? `${l.eventOptionId}::${l.variantId || ""}` : "";
 }
-
-/** The sold-out lines of an event, for the waitlist button. */
-export function soldOutLines(options: { id: string; name: string; stockLimit?: number; availableCount?: number | null; variants?: { id: string; name: string; stockLimit?: number; availableCount?: number | null }[] | null }[]): WaitlistLine[] {
-  const out: WaitlistLine[] = [];
-  for (const o of options || []) {
-    const optOut = (o.stockLimit ?? 0) > 0 && o.availableCount !== undefined && o.availableCount !== null && o.availableCount <= 0;
-    const variants = o.variants || [];
-    if (variants.length > 0) {
-      for (const v of variants) {
-        const vOut = (v.stockLimit ?? 0) > 0 && v.availableCount !== undefined && v.availableCount !== null && v.availableCount <= 0;
-        if (optOut || vOut) out.push({ eventOptionId: o.id, variantId: v.id, label: `${o.name} (${v.name})` });
-      }
-    } else if (optOut) {
-      out.push({ eventOptionId: o.id, label: o.name });
-    }
-  }
-  return out;
-}

frontend/src/components/events/MyCertificates.tsx

@@ -0,0 +1,59 @@
+"use client";
+
+import React, { useEffect, useState } from "react";
+import { Award, Download } from "lucide-react";
+import { apiFetch, API_BASE } from "@/lib/api";
+import { fetchApiFile, saveBlob } from "@/lib/export";
+import { formatDate } from "@/lib/date";
+import { errorMessage } from "@/lib/utils";
+import type { MyCertificate } from "@/types";
+
+// Completion certificates on My Events. Hidden until the person has one.
+export function MyCertificates({ token }: { token: string | null }) {
+  const [certs, setCerts] = useState<MyCertificate[]>([]);
+  const [error, setError] = useState<string | null>(null);
+
+  useEffect(() => {
+    if (!token) return;
+    apiFetch<MyCertificate[]>("/api/attendance/certificates/mine", { authToken: token })
+      .then(list => setCerts(Array.isArray(list) ? list : []))
+      .catch(() => setCerts([]));
+  }, [token]);
+
+  if (certs.length === 0) return null;
+
+  const download = async (c: MyCertificate) => {
+    if (!token) return;
+    setError(null);
+    try {
+      saveBlob(await fetchApiFile(API_BASE, token, `/api/attendance/certificates/${c.id}/pdf`), `Certificate - ${c.event.title.replace(/[^a-z0-9 -]/gi, "")}.pdf`);
+    } catch (e) {
+      setError(errorMessage(e) || "Download failed");
+    }
+  };
+
+  return (
+    <section className="mb-6 border rounded-xl p-5 bg-white shadow-sm">
+      <div className="flex items-center gap-2 mb-3">
+        <Award className="w-5 h-5 text-brand-600" />
+        <h2 className="text-lg font-semibold text-gray-900">My Certificates</h2>
+      </div>
+      {error && <div className="mb-3 p-2 border rounded bg-red-50 text-red-700 text-sm">{error}</div>}
+      <ul className="divide-y">
+        {certs.map(c => (
+          <li key={c.id} className="flex flex-wrap items-center justify-between gap-2 py-2.5">
+            <div className="min-w-0">
+              <div className="font-medium text-gray-900">{c.event.title}</div>
+              <div className="text-xs text-gray-500">
+                {c.name} · {c.totalSessions > 1 ? `${c.sessionsAttended} of ${c.totalSessions} sessions · ` : ""}issued {formatDate(new Date(c.issuedAt))}
+              </div>
+            </div>
+            <button type="button" onClick={() => download(c)} className="inline-flex items-center gap-1.5 px-3 py-1.5 text-sm rounded-lg border border-brand-200 bg-brand-50 text-brand-700 hover:bg-brand-100">
+              <Download className="w-4 h-4" /> Download
+            </button>
+          </li>
+        ))}
+      </ul>
+    </section>
+  );
+}

frontend/src/components/events/ScheduleEditor.tsx

@@ -0,0 +1,425 @@
+"use client";
+
+import React, { useMemo, useState } from "react";
+import { CalendarDays, Plus, RotateCcw, Trash2, Ban, FileText, Repeat } from "lucide-react";
+import type { CertificateConfig, CertificateTemplate } from "@/types";
+import {
+  generateSessions, formatSessionWhen, CERTIFICATE_TEMPLATES, REMINDER_OPTIONS, DEFAULT_CERTIFICATE_BODY,
+  type SessionDraft, type SessionPattern,
+} from "@/lib/sessions";
+
+// ─── Sessions (Basic Details step) ────────────────────────────────────────────
+
+const WEEKDAYS = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"];
+const newKey = () => Math.random().toString(36).slice(2, 10);
+
+export type KeyedSession = SessionDraft & { key: string };
+
+export function keyed(s: SessionDraft): KeyedSession {
+  return { ...s, key: s.id || newKey() };
+}
+
+function todayISO() {
+  const d = new Date();
+  return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, "0")}-${String(d.getDate()).padStart(2, "0")}`;
+}
+
+/** Sorts by start; rows still missing a date go last. */
+export function sortSessions(list: KeyedSession[]): KeyedSession[] {
+  return [...list].sort((a, b) => (a.startsAt || "9999").localeCompare(b.startsAt || "9999"));
+}
+
+/** Problems that block saving, or null. */
+export function sessionsProblem(list: KeyedSession[]): string | null {
+  if (!list.some(s => !s.cancelled)) return "Add at least one session";
+  for (const [i, s] of sortSessions(list).entries()) {
+    if (!s.startsAt || !s.endsAt) return `Session ${i + 1} needs a start and end`;
+    if (new Date(s.endsAt) <= new Date(s.startsAt)) return `Session ${i + 1} must end after it starts`;
+  }
+  return null;
+}
+
+function PatternBuilder({ onGenerate }: { onGenerate: (rows: SessionDraft[], mode: "replace" | "add") => void }) {
+  const [p, setP] = useState<SessionPattern>(() => ({
+    frequency: "weekly", interval: 1, weekdays: [new Date().getDay()], startDate: todayISO(),
+    startTime: "18:30", endTime: "20:30", endsBy: "count", count: 5, until: "",
+  }));
+  const set = (patch: Partial<SessionPattern>) => setP(x => ({ ...x, ...patch }));
+  const preview = useMemo(() => generateSessions(p), [p]);
+  const toggleDay = (d: number) => set({ weekdays: p.weekdays.includes(d) ? p.weekdays.filter(x => x !== d) : [...p.weekdays, d] });
+
+  return (
+    <div className="border rounded-lg p-3 bg-brand-50/40 space-y-3">
+      <div className="flex items-center gap-2 text-sm font-medium text-gray-800"><Repeat className="w-4 h-4 text-brand-600" /> Repeat pattern</div>
+      <div className="grid sm:grid-cols-3 gap-2">
+        <label className="text-xs text-gray-600">Repeats
+          <select className="mt-1 w-full border rounded px-2 py-1.5 text-sm" value={p.frequency} onChange={e => set({ frequency: e.target.value as SessionPattern["frequency"] })}>
+            <option value="weekly">Weekly</option>
+            <option value="daily">Daily</option>
+          </select>
+        </label>
+        <label className="text-xs text-gray-600">Every
+          <div className="mt-1 flex items-center gap-1.5">
+            <input type="number" min={1} max={12} className="w-16 border rounded px-2 py-1.5 text-sm" value={p.interval} onChange={e => set({ interval: Math.max(1, parseInt(e.target.value) || 1) })} />
+            <span className="text-sm text-gray-600">{p.frequency === "weekly" ? (p.interval === 1 ? "week" : "weeks") : (p.interval === 1 ? "day" : "days")}</span>
+          </div>
+        </label>
+        <label className="text-xs text-gray-600">First date
+          <input type="date" className="mt-1 w-full border rounded px-2 py-1.5 text-sm" value={p.startDate} onChange={e => set({ startDate: e.target.value })} />
+        </label>
+      </div>
+      {p.frequency === "weekly" && (
+        <div>
+          <div className="text-xs text-gray-600 mb-1">On</div>
+          <div className="flex flex-wrap gap-1">
+            {WEEKDAYS.map((d, i) => (
+              <button key={d} type="button" onClick={() => toggleDay(i)}
+                className={`px-2.5 py-1 text-xs rounded-full border ${p.weekdays.includes(i) ? "bg-brand-600 text-white border-brand-600" : "bg-white text-gray-700 border-gray-200 hover:bg-gray-50"}`}>{d}</button>
+            ))}
+          </div>
+        </div>
+      )}
+      <div className="grid grid-cols-2 sm:grid-cols-4 gap-2">
+        <label className="text-xs text-gray-600">From
+          <input type="time" className="mt-1 w-full border rounded px-2 py-1.5 text-sm" value={p.startTime} onChange={e => set({ startTime: e.target.value })} />
+        </label>
+        <label className="text-xs text-gray-600">To
+          <input type="time" className="mt-1 w-full border rounded px-2 py-1.5 text-sm" value={p.endTime} onChange={e => set({ endTime: e.target.value })} />
+        </label>
+        <label className="text-xs text-gray-600">Ends
+          <select className="mt-1 w-full border rounded px-2 py-1.5 text-sm" value={p.endsBy} onChange={e => set({ endsBy: e.target.value as SessionPattern["endsBy"] })}>
+            <option value="count">After a number of sessions</option>
+            <option value="until">On a date</option>
+          </select>
+        </label>
+        {p.endsBy === "count" ? (
+          <label className="text-xs text-gray-600">Sessions
+            <input type="number" min={1} max={200} className="mt-1 w-full border rounded px-2 py-1.5 text-sm" value={p.count} onChange={e => set({ count: Math.max(1, Math.min(200, parseInt(e.target.value) || 1)) })} />
+          </label>
+        ) : (
+          <label className="text-xs text-gray-600">Last date
+            <input type="date" className="mt-1 w-full border rounded px-2 py-1.5 text-sm" value={p.until} onChange={e => set({ until: e.target.value })} />
+          </label>
+        )}
+      </div>
+      <div className="flex flex-wrap items-center justify-between gap-2">
+        <p className="text-xs text-gray-500">
+          {preview.length === 0 ? "Pick the dates and times to see the sessions." : `${preview.length} session${preview.length === 1 ? "" : "s"}: ${formatSessionWhen({ startsAt: preview[0].startsAt, endsAt: preview[0].endsAt })}${preview.length > 1 ? ` … ${formatSessionWhen({ startsAt: preview[preview.length - 1].startsAt, endsAt: preview[preview.length - 1].endsAt })}` : ""}`}
+        </p>
+        <div className="flex gap-2">
+          <button type="button" disabled={!preview.length} onClick={() => onGenerate(preview, "add")} className="px-3 py-1.5 text-xs rounded border border-gray-200 bg-white hover:bg-gray-50 disabled:opacity-50">Add to list</button>
+          <button type="button" disabled={!preview.length} onClick={() => onGenerate(preview, "replace")} className="px-3 py-1.5 text-xs rounded bg-brand-600 text-white hover:bg-brand-700 disabled:opacity-50">Create sessions</button>
+        </div>
+      </div>
+    </div>
+  );
+}
+
+export function SessionsEditor({ sessions, onChange, defaultLocation }: { sessions: KeyedSession[]; onChange: (s: KeyedSession[]) => void; defaultLocation?: string }) {
+  const [showPattern, setShowPattern] = useState(sessions.length === 0);
+  const sorted = sortSessions(sessions);
+  const activeCount = sessions.filter(s => !s.cancelled).length;
+  const update = (key: string, patch: Partial<KeyedSession>) => onChange(sessions.map(s => (s.key === key ? { ...s, ...patch } : s)));
+  const remove = (key: string) => onChange(sessions.filter(s => s.key !== key));
+
+  const generate = (rows: SessionDraft[], mode: "replace" | "add") => {
+    const fresh = rows.map(keyed);
+    // Saved sessions with check-ins can't be removed, so "replace" keeps them.
+    const kept = mode === "replace" ? sessions.filter(s => s.hasCheckIns) : sessions;
+    onChange(sortSessions([...kept, ...fresh]));
+    setShowPattern(false);
+  };
+
+  const addOne = () => {
+    const last = sorted[sorted.length - 1];
+    const base = last?.startsAt ? new Date(last.startsAt) : new Date();
+    const dur = last?.startsAt && last?.endsAt ? new Date(last.endsAt).getTime() - new Date(last.startsAt).getTime() : 2 * 60 * 60 * 1000;
+    const start = new Date(base.getTime() + (last ? 7 * 24 * 60 * 60 * 1000 : 0));
+    const p = (n: number) => String(n).padStart(2, "0");
+    const fmt = (d: Date) => `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())}T${p(d.getHours())}:${p(d.getMinutes())}`;
+    onChange([...sessions, keyed({ label: "", startsAt: fmt(start), endsAt: fmt(new Date(start.getTime() + dur)), location: "", cancelled: false })]);
+  };
+
+  let position = 0;
+  return (
+    <div className="space-y-3">
+      {showPattern
+        ? <PatternBuilder onGenerate={generate} />
+        : (
+          <button type="button" onClick={() => setShowPattern(true)} className="inline-flex items-center gap-1.5 text-xs text-brand-700 hover:underline">
+            <Repeat className="w-3.5 h-3.5" /> Create sessions from a repeat pattern
+          </button>
+        )}
+
+      {sorted.length > 0 && (
+        <div className="border rounded-lg divide-y">
+          <div className="px-3 py-2 text-xs text-gray-500 bg-gray-50 rounded-t-lg">
+            {activeCount} session{activeCount === 1 ? "" : "s"} — edit any date, add a label, or cancel one (e.g. a public holiday).
+          </div>
+          {sorted.map((s) => {
+            if (!s.cancelled) position += 1;
+            return (
+              <div key={s.key} className={`p-3 space-y-2 ${s.cancelled ? "bg-gray-50" : ""}`}>
+                <div className="flex items-center gap-2">
+                  <span className={`text-xs font-semibold w-6 shrink-0 ${s.cancelled ? "text-gray-400" : "text-brand-700"}`}>{s.cancelled ? "—" : position}</span>
+                  <input className={`flex-1 min-w-0 border rounded px-2 py-1 text-sm ${s.cancelled ? "line-through text-gray-400" : ""}`} placeholder={s.cancelled ? "Cancelled" : `Session ${position} (optional label)`}
+                    value={s.label} onChange={e => update(s.key, { label: e.target.value })} disabled={s.cancelled} />
+                  {s.cancelled ? (
+                    <button type="button" onClick={() => update(s.key, { cancelled: false })} className="inline-flex items-center gap-1 text-xs px-2 py-1 rounded border bg-white hover:bg-gray-50" title="Restore this session">
+                      <RotateCcw className="w-3.5 h-3.5" /> Restore
+                    </button>
+                  ) : s.id ? (
+                    <button type="button" onClick={() => update(s.key, { cancelled: true })} className="inline-flex items-center gap-1 text-xs px-2 py-1 rounded border border-amber-200 bg-amber-50 text-amber-800 hover:bg-amber-100" title="Cancel this session (kept for history)">
+                      <Ban className="w-3.5 h-3.5" /> Cancel
+                    </button>
+                  ) : null}
+                  {!s.hasCheckIns && (
+                    <button type="button" onClick={() => remove(s.key)} className="p-1.5 rounded text-gray-400 hover:text-red-600 hover:bg-red-50" title="Remove">
+                      <Trash2 className="w-4 h-4" />
+                    </button>
+                  )}
+                </div>
+                {!s.cancelled && (
+                  <div className="grid sm:grid-cols-3 gap-2 pl-8">
+                    <label className="text-[11px] text-gray-500">Starts
+                      <input type="datetime-local" className="mt-0.5 w-full border rounded px-2 py-1 text-sm" value={s.startsAt} onChange={e => {
+                        const v = e.target.value;
+                        // Keep the session's length when the start moves.
+                        const len = s.startsAt && s.endsAt ? new Date(s.endsAt).getTime() - new Date(s.startsAt).getTime() : 0;
+                        const p2 = (n: number) => String(n).padStart(2, "0");
+                        const end = v && len > 0 ? new Date(new Date(v).getTime() + len) : null;
+                        update(s.key, { startsAt: v, ...(end ? { endsAt: `${end.getFullYear()}-${p2(end.getMonth() + 1)}-${p2(end.getDate())}T${p2(end.getHours())}:${p2(end.getMinutes())}` } : {}) });
+                      }} />
+                    </label>
+                    <label className="text-[11px] text-gray-500">Ends
+                      <input type="datetime-local" className="mt-0.5 w-full border rounded px-2 py-1 text-sm" value={s.endsAt} onChange={e => update(s.key, { endsAt: e.target.value })} />
+                    </label>
+                    <label className="text-[11px] text-gray-500">Location (optional)
+                      <input className="mt-0.5 w-full border rounded px-2 py-1 text-sm" placeholder={defaultLocation || "Event location"} value={s.location} onChange={e => update(s.key, { location: e.target.value })} />
+                    </label>
+                  </div>
+                )}
+                {s.hasCheckIns && <p className="pl-8 text-[10px] text-gray-400">Has check-ins — it can be cancelled but not removed.</p>}
+              </div>
+            );
+          })}
+        </div>
+      )}
+
+      <button type="button" onClick={addOne} className="inline-flex items-center gap-1.5 px-3 py-1.5 text-xs rounded border border-gray-200 bg-white hover:bg-gray-50">
+        <Plus className="w-3.5 h-3.5" /> Add a date
+      </button>
+    </div>
+  );
+}
+
+// ─── Attendance step ──────────────────────────────────────────────────────────
+
+export type AttendanceDraft = {
+  lateJoinEnabled: boolean;
+  lateJoinUntilKey: string;
+  latePricing: "full" | "prorata" | "fixed";
+  lateFixedPrice: string;
+  checkInWindow: "whole_day" | "session_only";
+  remindersEnabled: boolean;
+  reminderOffsets: number[];
+  reminderChannels: ("email" | "whatsapp")[];
+  certificatesEnabled: boolean;
+  certificate: CertificateConfig;
+};
+
+export function defaultCertificate(): CertificateConfig {
+  return { template: "classic", title: "Certificate of Completion", body: DEFAULT_CERTIFICATE_BODY, signatureName: "", signatureRole: "", signatureImage: "", rule: { type: "all", value: null }, sendOnIssue: false };
+}
+
+function Toggle({ id, checked, onChange, title, children }: { id: string; checked: boolean; onChange: (v: boolean) => void; title: string; children?: React.ReactNode }) {
+  return (
+    <div className="flex items-start gap-2">
+      <input id={id} type="checkbox" className="mt-0.5" checked={checked} onChange={e => onChange(e.target.checked)} />
+      <label htmlFor={id} className="text-sm text-gray-800">
+        <span className="font-medium">{title}</span>
+        {children && <span className="block text-xs text-gray-500 mt-0.5">{children}</span>}
+      </label>
+    </div>
+  );
+}
+
+export function AttendanceSettings({ value, onChange, multi, sessions, mainPrice, onPreview, uploadButton }: {
+  value: AttendanceDraft;
+  onChange: (patch: Partial<AttendanceDraft>) => void;
+  multi: boolean;
+  sessions: KeyedSession[];
+  mainPrice: number;
+  onPreview: () => Promise<void>;
+  uploadButton: (onUploaded: (url: string) => void) => React.ReactNode;
+}) {
+  const [previewing, setPreviewing] = useState(false);
+  const [previewError, setPreviewError] = useState<string | null>(null);
+  const active = sortSessions(sessions).filter(s => !s.cancelled);
+  const cert = value.certificate;
+  const setCert = (patch: Partial<CertificateConfig>) => onChange({ certificate: { ...cert, ...patch } });
+  const total = active.length;
+  const examplePrice = mainPrice > 0 ? mainPrice : 300;
+  const example = total > 1
+    ? (() => {
+      const left = total - 1;
+      const v = Math.min(examplePrice, Math.max(10, Math.round((examplePrice * left / total) / 10) * 10));
+      return `e.g. R${examplePrice} with ${left} of ${total} sessions left → R${v}`;
+    })()
+    : null;
+
+  return (
+    <div className="space-y-5">
+      {multi && (
+        <section className="space-y-3">
+          <h3 className="text-sm font-semibold text-gray-900 flex items-center gap-1.5"><CalendarDays className="w-4 h-4 text-brand-600" /> Late joining</h3>
+          <Toggle id="late-join" checked={value.lateJoinEnabled} onChange={v => onChange({ lateJoinEnabled: v })} title="Let people join after the first session">
+            Without this, registration closes when the first session starts.
+          </Toggle>
+          {value.lateJoinEnabled && (
+            <div className="pl-6 space-y-3">
+              <label className="block text-xs text-gray-600">Registration stays open until the start of
+                <select className="mt-1 w-full border rounded px-2 py-1.5 text-sm" value={value.lateJoinUntilKey} onChange={e => onChange({ lateJoinUntilKey: e.target.value })}>
+                  <option value="">Choose a session…</option>
+                  {active.slice(1).map((s, i) => (
+                    <option key={s.key} value={s.key}>{s.label || `Session ${i + 2}`} — {s.startsAt ? formatSessionWhen(s) : "no date yet"}</option>
+                  ))}
+                </select>
+              </label>
+              <fieldset className="space-y-1.5">
+                <legend className="text-xs text-gray-600 mb-1">Price for late joiners (main tickets only)</legend>
+                {([
+                  ["full", "Full price"],
+                  ["prorata", "Pro-rata on the sessions left (rounded to the nearest R10)"],
+                  ["fixed", "A fixed late price"],
+                ] as const).map(([v, label]) => (
+                  <label key={v} className="flex items-center gap-2 text-sm">
+                    <input type="radio" name="late-pricing" checked={value.latePricing === v} onChange={() => onChange({ latePricing: v })} /> {label}
+                  </label>
+                ))}
+                {value.latePricing === "prorata" && example && <p className="text-xs text-gray-500 pl-6">{example}</p>}
+                {value.latePricing === "fixed" && (
+                  <div className="pl-6">
+                    <input type="number" min={0} step="1" className="w-32 border rounded px-2 py-1.5 text-sm" placeholder="R" value={value.lateFixedPrice} onChange={e => onChange({ lateFixedPrice: e.target.value })} />
+                    <p className="text-[10px] text-gray-400 mt-0.5">Only ever lowers the price — anyone whose normal price is already lower keeps it.</p>
+                  </div>
+                )}
+              </fieldset>
+            </div>
+          )}
+        </section>
+      )}
+
+      {multi && (
+        <section className="space-y-2">
+          <h3 className="text-sm font-semibold text-gray-900">Check-in</h3>
+          {([
+            ["whole_day", "Whole day", "Any time on the session's date — handy if someone was let in without being scanned."],
+            ["session_only", "Session time only", "From 2 hours before the session starts until it ends."],
+          ] as const).map(([v, title, hint]) => (
+            <label key={v} className="flex items-start gap-2 text-sm">
+              <input type="radio" name="checkin-window" className="mt-1" checked={value.checkInWindow === v} onChange={() => onChange({ checkInWindow: v })} />
+              <span><span className="font-medium">{title}</span><span className="block text-xs text-gray-500">{hint}</span></span>
+            </label>
+          ))}
+        </section>
+      )}
+
+      {multi && (
+        <section className="space-y-2">
+          <h3 className="text-sm font-semibold text-gray-900">Session reminders</h3>
+          <Toggle id="reminders" checked={value.remindersEnabled} onChange={v => onChange({ remindersEnabled: v })} title="Remind ticket holders before each session" />
+          {value.remindersEnabled && (
+            <div className="pl-6 grid sm:grid-cols-2 gap-3">
+              <div className="space-y-1">
+                <div className="text-xs text-gray-600">When</div>
+                {REMINDER_OPTIONS.map(o => (
+                  <label key={o.minutes} className="flex items-center gap-2 text-sm">
+                    <input type="checkbox" checked={value.reminderOffsets.includes(o.minutes)} onChange={e => onChange({ reminderOffsets: e.target.checked ? [...value.reminderOffsets, o.minutes] : value.reminderOffsets.filter(x => x !== o.minutes) })} /> {o.label}
+                  </label>
+                ))}
+              </div>
+              <div className="space-y-1">
+                <div className="text-xs text-gray-600">How</div>
+                {(["email", "whatsapp"] as const).map(c => (
+                  <label key={c} className="flex items-center gap-2 text-sm">
+                    <input type="checkbox" checked={value.reminderChannels.includes(c)} onChange={e => onChange({ reminderChannels: e.target.checked ? [...value.reminderChannels, c] : value.reminderChannels.filter(x => x !== c) })} /> {c === "email" ? "Email" : "WhatsApp"}
+                  </label>
+                ))}
+                <p className="text-[10px] text-gray-400">Each person&apos;s notification preference still applies.</p>
+              </div>
+            </div>
+          )}
+        </section>
+      )}
+
+      <section className="space-y-3">
+        <h3 className="text-sm font-semibold text-gray-900 flex items-center gap-1.5"><FileText className="w-4 h-4 text-brand-600" /> Certificates</h3>
+        <Toggle id="certificates" checked={value.certificatesEnabled} onChange={v => onChange({ certificatesEnabled: v })} title="Give completion certificates">
+          Issued automatically when the event ends to everyone who meets the rule below. You can also issue them from the attendance register.
+        </Toggle>
+        {value.certificatesEnabled && (
+          <div className="pl-6 space-y-3">
+            <div className="grid grid-cols-2 sm:grid-cols-4 gap-2">
+              {CERTIFICATE_TEMPLATES.map(t => (
+                <button key={t.id} type="button" onClick={() => setCert({ template: t.id as CertificateTemplate })}
+                  className={`text-left p-2 rounded-lg border ${cert.template === t.id ? "border-brand-500 ring-2 ring-brand-200 bg-brand-50" : "border-gray-200 hover:bg-gray-50"}`}>
+                  <span className="block text-sm font-medium">{t.name}</span>
+                  <span className="block text-[11px] text-gray-500">{t.blurb}</span>
+                </button>
+              ))}
+            </div>
+            <label className="block text-xs text-gray-600">Title
+              <input className="mt-1 w-full border rounded px-2 py-1.5 text-sm" value={cert.title} onChange={e => setCert({ title: e.target.value })} />
+            </label>
+            <label className="block text-xs text-gray-600">Wording
+              <textarea rows={3} className="mt-1 w-full border rounded px-2 py-1.5 text-sm" value={cert.body} onChange={e => setCert({ body: e.target.value })} />
+              <span className="block text-[10px] text-gray-400 mt-0.5">Fills in: {"{name}"}, {"{event}"}, {"{sessionsAttended}"}, {"{totalSessions}"}, {"{endDate}"}</span>
+            </label>
+            <div className="grid sm:grid-cols-2 gap-2">
+              <label className="text-xs text-gray-600">Signed by (optional)
+                <input className="mt-1 w-full border rounded px-2 py-1.5 text-sm" placeholder="e.g. Pastor John" value={cert.signatureName || ""} onChange={e => setCert({ signatureName: e.target.value })} />
+              </label>
+              <label className="text-xs text-gray-600">Their role (optional)
+                <input className="mt-1 w-full border rounded px-2 py-1.5 text-sm" placeholder="e.g. Senior Pastor" value={cert.signatureRole || ""} onChange={e => setCert({ signatureRole: e.target.value })} />
+              </label>
+            </div>
+            <div className="flex flex-wrap items-center gap-2 text-xs text-gray-600">
+              Signature image (optional):
+              {uploadButton(url => setCert({ signatureImage: url }))}
+              {cert.signatureImage && <button type="button" className="text-red-600 hover:underline" onClick={() => setCert({ signatureImage: "" })}>Remove</button>}
+            </div>
+            {multi ? (
+              <fieldset className="space-y-1.5">
+                <legend className="text-xs text-gray-600 mb-1">Who gets one</legend>
+                <label className="flex items-center gap-2 text-sm"><input type="radio" name="cert-rule" checked={cert.rule.type === "all"} onChange={() => setCert({ rule: { type: "all", value: null } })} /> Attended every session</label>
+                <label className="flex items-center gap-2 text-sm">
+                  <input type="radio" name="cert-rule" checked={cert.rule.type === "count"} onChange={() => setCert({ rule: { type: "count", value: Math.max(1, total - 1) } })} /> Attended at least
+                  <input type="number" min={1} className="w-16 border rounded px-2 py-0.5 text-sm" disabled={cert.rule.type !== "count"} value={cert.rule.type === "count" ? cert.rule.value ?? 1 : ""} onChange={e => setCert({ rule: { type: "count", value: Math.max(1, parseInt(e.target.value) || 1) } })} /> sessions
+                </label>
+                <label className="flex items-center gap-2 text-sm">
+                  <input type="radio" name="cert-rule" checked={cert.rule.type === "percent"} onChange={() => setCert({ rule: { type: "percent", value: 80 } })} /> Attended at least
+                  <input type="number" min={1} max={100} className="w-16 border rounded px-2 py-0.5 text-sm" disabled={cert.rule.type !== "percent"} value={cert.rule.type === "percent" ? cert.rule.value ?? 80 : ""} onChange={e => setCert({ rule: { type: "percent", value: Math.min(100, Math.max(1, parseInt(e.target.value) || 1)) } })} /> % of sessions
+                </label>
+              </fieldset>
+            ) : (
+              <p className="text-xs text-gray-500">Everyone who was checked in gets one.</p>
+            )}
+            <Toggle id="cert-send" checked={!!cert.sendOnIssue} onChange={v => setCert({ sendOnIssue: v })} title="Send certificates automatically">
+              Email/WhatsApp each certificate when it&apos;s issued. Otherwise people download theirs from My Events, and you can send them from the attendance register.
+            </Toggle>
+            <div>
+              <button type="button" disabled={previewing} onClick={async () => {
+                setPreviewing(true); setPreviewError(null);
+                try { await onPreview(); } catch (e) { setPreviewError(e instanceof Error ? e.message : "Couldn't make the preview"); } finally { setPreviewing(false); }
+              }} className="px-3 py-1.5 text-xs rounded border border-brand-200 bg-brand-50 text-brand-700 hover:bg-brand-100 disabled:opacity-50">
+                {previewing ? "Making preview…" : "Preview certificate"}
+              </button>
+              {previewError && <p className="text-xs text-red-600 mt-1">{previewError}</p>}
+            </div>
+          </div>
+        )}
+      </section>
+    </div>
+  );
+}

frontend/src/components/events/SessionSchedule.tsx

@@ -0,0 +1,39 @@
+import { CalendarDays, MapPin } from "lucide-react";
+import type { EventSession } from "@/types";
+import { activeSessions, formatSessionWhen, sessionLabel } from "@/lib/sessions";
+
+// The schedule of a multi-day event on its public page: past sessions greyed out,
+// cancelled ones struck through, and the next one highlighted.
+export function SessionSchedule({ sessions, defaultLocation }: { sessions: EventSession[]; defaultLocation?: string | null }) {
+  const now = Date.now();
+  const sorted = [...sessions].sort((a, b) => new Date(a.startsAt).getTime() - new Date(b.startsAt).getTime());
+  const next = activeSessions(sessions).find(s => new Date(s.endsAt).getTime() > now);
+  const count = activeSessions(sessions).length;
+
+  return (
+    <div className="border rounded-xl p-5 bg-white shadow-sm">
+      <div className="flex items-center gap-2 mb-3">
+        <CalendarDays className="w-4 h-4 text-gray-500" />
+        <h2 className="text-base font-semibold text-gray-900">Schedule</h2>
+        <span className="text-xs text-gray-500">· {count} session{count === 1 ? "" : "s"}, one ticket for all</span>
+      </div>
+      <ol className="space-y-1.5">
+        {sorted.map((s) => {
+          const cancelled = !!(s.cancelled || s.cancelledAt);
+          const past = !cancelled && new Date(s.endsAt).getTime() <= now;
+          const isNext = next?.id === s.id;
+          const place = s.location && s.location !== defaultLocation ? s.location : null;
+          return (
+            <li key={s.id} className={`flex flex-wrap items-baseline gap-x-3 gap-y-0.5 rounded-lg px-3 py-2 text-sm ${isNext ? "bg-brand-50 border border-brand-200" : "border border-transparent"} ${past ? "text-gray-400" : "text-gray-700"}`}>
+              <span className={`font-medium ${cancelled ? "line-through text-gray-400" : ""}`}>{cancelled ? (s.label || "Session") : sessionLabel(s, sessions)}</span>
+              <span className={cancelled ? "line-through text-gray-400" : ""}>{formatSessionWhen(s)}</span>
+              {cancelled && <span className="text-xs font-medium text-amber-700">Cancelled</span>}
+              {isNext && <span className="text-xs font-medium text-brand-700">Next</span>}
+              {place && !cancelled && <span className="flex items-center gap-1 text-xs text-gray-500"><MapPin className="w-3 h-3" />{place}</span>}
+            </li>
+          );
+        })}
+      </ol>
+    </div>
+  );
+}

frontend/src/components/scanner/OfflineScanPanel.tsx

@@ -73,7 +73,7 @@ export function OfflineScanPanel({ offline, token, eventId, eventTitle, sectionI
         {lock ? (
           <>
             <span className="text-gray-400">·</span>
-            <span className="font-medium text-amber-900">Offline mode: {lock.eventTitle}{lock.sectionName ? ` — ${lock.sectionName}` : " — whole event"}</span>
+            <span className="font-medium text-amber-900">Offline mode: {lock.eventTitle}{lock.sectionName ? ` — ${lock.sectionName}` : " — whole event"}{lock.sessionLabel ? ` · ${lock.sessionLabel}` : ""}</span>
             <span className="text-xs text-gray-600">Ticket list downloaded at {new Date(lock.snapshotAt).toLocaleTimeString()}</span>
             <span className="text-xs text-gray-600">· {pending} scan(s) waiting to sync</span>
             <div className="ml-auto flex gap-2">

frontend/src/components/scanner/useOfflineScanning.ts

@@ -88,8 +88,13 @@ export function useOfflineScanning(token: string | null) {
     const created = await apiFetch<{ id: string }>("/api/scan-locks", {
       method: "POST", authToken: token, body: { eventId, sectionId, deviceId: deviceId(), deviceName: deviceName() },
     });
-    const snap = await apiFetch<{ snapshotAt: string; tickets: SnapshotTicket[] }>(`/api/scan-locks/${created.id}/snapshot?deviceId=${encodeURIComponent(deviceId())}`, { authToken: token });
-    const next: OfflineLock = { lockId: created.id, eventId, eventTitle, sectionId, sectionName, snapshotAt: snap.snapshotAt };
+    const snap = await apiFetch<{ snapshotAt: string; tickets: SnapshotTicket[]; session?: { id: string; label: string } | null; noSessionToday?: boolean }>(`/api/scan-locks/${created.id}/snapshot?deviceId=${encodeURIComponent(deviceId())}`, { authToken: token });
+    // Multi-day events: the downloaded list is for today's session, so there must be one.
+    if (snap.noSessionToday) {
+      await apiFetch(`/api/scan-locks/${created.id}`, { method: "DELETE", authToken: token, body: { deviceId: deviceId() } }).catch(() => {});
+      throw new Error("There's no session of this event open for check-in today, so offline mode can't start.");
+    }
+    const next: OfflineLock = { lockId: created.id, eventId, eventTitle, sectionId, sectionName, snapshotAt: snap.snapshotAt, sessionLabel: snap.session?.label || null };
     await startOffline(next, snap.tickets);
     setLock(next);
     return snap.tickets.length;

frontend/src/components/shared/BundleDeals.tsx

@@ -54,18 +54,15 @@ export function BundleOffers({ bundles, className = "" }: { bundles?: PublicBund
     <div className={`rounded-lg border border-emerald-200 bg-emerald-50 p-3 text-sm text-emerald-900 ${className}`}>
       <div className="flex items-center gap-1.5 font-semibold"><Gift className="h-4 w-4" /> Bundle deals</div>
       <ul className="mt-1.5 space-y-1">
-        {bundles.map(b => {
-          const save = b.standardValue - b.price;
-          return (
-            <li key={b.id}>
-              <span className="font-medium">{b.name}:</span> {b.summary} for <span className="font-semibold">{fmt(b.price)}</span>
-              {save > 0.005 && <span className="text-emerald-700"> (save {fmt(save)})</span>}
-              {b.description && <span className="block text-xs text-emerald-800/80">{b.description}</span>}
-            </li>
-          );
-        })}
+        {bundles.map(b => (
+          <li key={b.id}>
+            <span className="font-medium">{b.name}:</span> {b.headline}
+            {b.savingText && <span className="text-emerald-700"> ({b.savingText})</span>}
+            {b.description && <span className="block text-xs text-emerald-800/80">{b.description}</span>}
+          </li>
+        ))}
       </ul>
-      <p className="mt-1.5 text-xs text-emerald-800/80">Picked automatically when your tickets match, as many times as they fit.</p>
+      <p className="mt-1.5 text-xs text-emerald-800/80">Applied automatically when your tickets match.</p>
     </div>
   );
 }
@@ -98,24 +95,49 @@ type BuilderOption = {
   availableCount?: number | null;
   variants?: { id: string; name: string; stockLimit?: number | null; availableCount?: number | null }[] | null;
 };
+type Qty = (optionId: string, variantId: string | null) => number;
+type Change = { optionId: string; variantId: string | null; quantity: number };
+
+const leftOf = (stockLimit?: number | null, availableCount?: number | null) => ((stockLimit ?? 0) > 0 && availableCount !== undefined && availableCount !== null ? availableCount : Infinity);
 
 /** Tickets of this item already in the basket. An "any variant" item counts every variant. */
-function itemHave(item: BundleItem, opt: BuilderOption | undefined, qty: (optionId: string, variantId: string | null) => number) {
+function itemHave(item: BundleItem, opt: BuilderOption | undefined, qty: Qty) {
   if (!opt) return 0;
   if (item.variantId) return qty(opt.id, item.variantId);
   const variants = opt.variants || [];
   return variants.length > 0 ? variants.reduce((s, v) => s + qty(opt.id, v.id), 0) : qty(opt.id, null);
 }
 
-const leftOf = (stockLimit?: number | null, availableCount?: number | null) => ((stockLimit ?? 0) > 0 && availableCount !== undefined && availableCount !== null ? availableCount : Infinity);
+/** Every basket line (option, or option + variant) that counts towards a bundle, without repeats. */
+function qualifyingKeys(bundle: PublicBundle, options: BuilderOption[]) {
+  const keys: { opt: BuilderOption; variantId: string | null }[] = [];
+  const seen = new Set<string>();
+  for (const item of bundle.items) {
+    const opt = options.find(o => o.id === item.eventOptionId);
+    if (!opt) continue;
+    const variants = opt.variants || [];
+    const ids = variants.length === 0 ? [null] : item.variantId ? [item.variantId] : variants.map(v => v.id);
+    for (const variantId of ids) {
+      const k = `${opt.id}::${variantId || ""}`;
+      if (!seen.has(k)) { seen.add(k); keys.push({ opt, variantId }); }
+    }
+  }
+  return keys;
+}
+
+/** Places left for one basket line, or Infinity. */
+function roomFor(opt: BuilderOption, variantId: string | null, qty: Qty) {
+  const variant = variantId ? (opt.variants || []).find(v => v.id === variantId) : null;
+  return Math.min(leftOf(opt.stockLimit, opt.availableCount), variant ? leftOf(variant.stockLimit, variant.availableCount) : Infinity) - qty(opt.id, variantId);
+}
 
 /**
- * Quantities that make up `sets` full bundles, or null when there aren't enough tickets
- * left. Only ever raises quantities. An "any variant" item tops up the variant already
- * picked most (or the first one with places left).
+ * Exact bundles: quantities that make up `sets` full sets, or null when there aren't
+ * enough tickets left. Only ever raises quantities. An "any variant" item tops up the
+ * variant already picked most (or the first one with places left).
  */
-function quantitiesForSets(bundle: PublicBundle, options: BuilderOption[], qty: (o: string, v: string | null) => number, sets: number) {
-  const changes: { optionId: string; variantId: string | null; quantity: number }[] = [];
+function exactChanges(bundle: PublicBundle, options: BuilderOption[], qty: Qty, sets: number): Change[] | null {
+  const changes: Change[] = [];
   for (const item of bundle.items) {
     const opt = options.find(o => o.id === item.eventOptionId);
     if (!opt) return null;
@@ -123,75 +145,128 @@ function quantitiesForSets(bundle: PublicBundle, options: BuilderOption[], qty:
     if (short <= 0) continue;
     let variantId = item.variantId || null;
     if (!variantId && (opt.variants || []).length > 0) {
-      const withRoom = (opt.variants || []).filter(v => leftOf(v.stockLimit, v.availableCount) - qty(opt.id, v.id) >= short);
-      const pick = withRoom.sort((a, b) => qty(opt.id, b.id) - qty(opt.id, a.id))[0];
+      const pick = (opt.variants || []).filter(v => roomFor(opt, v.id, qty) >= short).sort((a, b) => qty(opt.id, b.id) - qty(opt.id, a.id))[0];
       if (!pick) return null;
       variantId = pick.id;
     }
-    const current = qty(opt.id, variantId);
-    const variant = variantId ? (opt.variants || []).find(v => v.id === variantId) : null;
-    if (current + short > Math.min(leftOf(opt.stockLimit, opt.availableCount), variant ? leftOf(variant.stockLimit, variant.availableCount) : Infinity)) return null;
-    changes.push({ optionId: opt.id, variantId, quantity: current + short });
+    if (roomFor(opt, variantId, qty) < short) return null;
+    changes.push({ optionId: opt.id, variantId, quantity: qty(opt.id, variantId) + short });
   }
   return changes;
 }
 
+/** Pick-any and group bundles: add `count` tickets to the qualifying line picked most. */
+function topUpChange(bundle: PublicBundle, options: BuilderOption[], qty: Qty, count: number): Change[] | null {
+  if (count <= 0) return [];
+  const pick = qualifyingKeys(bundle, options)
+    .filter(k => roomFor(k.opt, k.variantId, qty) >= count)
+    .sort((a, b) => qty(b.opt.id, b.variantId) - qty(a.opt.id, a.variantId))[0];
+  if (!pick) return null;
+  return [{ optionId: pick.opt.id, variantId: pick.variantId, quantity: qty(pick.opt.id, pick.variantId) + count }];
+}
+
+const orList = (summary: string) => summary.replace(/, ([^,]*)$/, " or $1");
+const plural = (n: number, word: string) => `${n} ${word}${n === 1 ? "" : "s"}`;
+
+type Row = {
+  bundle: PublicBundle;
+  // Something from the bundle is in the basket.
+  touched: boolean;
+  // Full sets in the basket (for a group discount: 1 once it applies).
+  sets: number;
+  // A set (or the group) has been started but isn't complete.
+  partial: boolean;
+  // What's missing, in words.
+  missing: string;
+  // Quantities to complete it (partial) or add another set (complete); null = no room.
+  next: Change[] | null;
+  // false for a group discount once it applies: it has no "another one".
+  canAddMore: boolean;
+};
+
+function rowFor(bundle: PublicBundle, options: BuilderOption[], qty: Qty): Row {
+  const kind = bundle.kind || "exact";
+  if (kind === "exact") {
+    const have = bundle.items.map(item => {
+      const opt = options.find(o => o.id === item.eventOptionId);
+      return { item, opt, n: itemHave(item, opt, qty) };
+    });
+    const sets = Math.min(...have.map(h => Math.floor(h.n / h.item.quantity)));
+    // Tickets beyond the full sets mean the next set has been started.
+    const partial = have.some(h => h.n > sets * h.item.quantity);
+    const missing = have
+      .filter(h => h.n < (sets + 1) * h.item.quantity)
+      .map(h => {
+        const v = h.item.variantId ? (h.opt?.variants || []).find(x => x.id === h.item.variantId) : null;
+        return `${(sets + 1) * h.item.quantity - h.n} × ${h.opt?.name || "ticket"}${v ? ` (${v.name})` : ""}`;
+      })
+      .join(" and ");
+    return { bundle, touched: have.some(h => h.n > 0), sets, partial, missing, next: exactChanges(bundle, options, qty, sets + 1), canAddMore: true };
+  }
+
+  const size = Number(bundle.setSize) || 1;
+  const have = qualifyingKeys(bundle, options).reduce((s, k) => s + qty(k.opt.id, k.variantId), 0);
+  const names = orList(bundle.summary);
+  if (kind === "group") {
+    const short = Math.max(0, size - have);
+    return {
+      bundle, touched: have > 0, sets: short === 0 ? 1 : 0, partial: short > 0,
+      missing: `${plural(short, "more ticket")} (${names})`,
+      next: topUpChange(bundle, options, qty, short), canAddMore: false,
+    };
+  }
+  const sets = Math.floor(have / size);
+  const short = have % size === 0 ? size : size - (have % size);
+  return {
+    bundle, touched: have > 0, sets, partial: have % size > 0,
+    missing: `${plural(short, "more ticket")} (${names})`,
+    next: topUpChange(bundle, options, qty, short), canAddMore: true,
+  };
+}
+
 /**
- * On the register form: each bundle the basket has started on, with what's missing and a
- * "Complete bundle" button, then "+" to add another full set. Buttons set the ticket
- * quantities through `onSetQuantity`.
+ * On the register form, at the door, manual registration and the kiosk: each bundle the
+ * basket has started on, with what's missing and a "Complete" button, then "+" to add
+ * another full set. Buttons set the ticket quantities through `onSetQuantity`.
  */
 export function BundleBuilder({ bundles, options, qty, onSetQuantity, className = "" }: {
   bundles?: PublicBundle[] | null;
   options: BuilderOption[];
-  qty: (optionId: string, variantId: string | null) => number;
+  qty: Qty;
   onSetQuantity: (optionId: string, variantId: string | null, quantity: number) => void;
   className?: string;
 }) {
-  const rows = (bundles || []).map(bundle => {
-    const have = bundle.items.map(item => ({ item, opt: options.find(o => o.id === item.eventOptionId), n: itemHave(item, options.find(o => o.id === item.eventOptionId), qty) }));
-    const sets = Math.min(...have.map(h => Math.floor(h.n / h.item.quantity)));
-    const touched = have.some(h => h.n > 0);
-    // Tickets beyond the full sets mean the next set has been started.
-    const partial = have.some(h => h.n > sets * h.item.quantity);
-    const missing = partial ? have.filter(h => h.n < (sets + 1) * h.item.quantity).map(h => ({ ...h, short: (sets + 1) * h.item.quantity - h.n })) : [];
-    const next = quantitiesForSets(bundle, options, qty, sets + 1);
-    return { bundle, touched, sets, partial, missing, next };
-  }).filter(r => r.touched);
+  const rows = (bundles || []).map(b => rowFor(b, options, qty)).filter(r => r.touched);
   if (rows.length === 0) return null;
-
-  const apply = (changes: NonNullable<ReturnType<typeof quantitiesForSets>>) => changes.forEach(c => onSetQuantity(c.optionId, c.variantId, c.quantity));
-  const itemName = (item: BundleItem, opt?: BuilderOption) => {
-    const v = item.variantId ? (opt?.variants || []).find(x => x.id === item.variantId) : null;
-    return `${opt?.name || "ticket"}${v ? ` (${v.name})` : ""}`;
-  };
+  const apply = (changes: Change[]) => changes.forEach(c => onSetQuantity(c.optionId, c.variantId, c.quantity));
 
   return (
     <div className={`space-y-2 ${className}`}>
-      {rows.map(({ bundle, sets, partial, missing, next }) => {
-        const save = bundle.standardValue - bundle.price;
+      {rows.map(({ bundle, sets, partial, missing, next, canAddMore }) => {
+        const isGroup = bundle.kind === "group";
+        const done = isGroup ? `✓ Group price on all your ${orList(bundle.summary)} tickets` : `✓ ${sets > 1 ? `${sets} bundles` : "Bundle"} in your basket`;
         return (
           <div key={bundle.id} className="flex flex-wrap items-center justify-between gap-3 rounded-lg border border-emerald-200 bg-emerald-50 p-3 text-sm text-emerald-900">
-            <div className="min-w-0">
+            <div className="min-w-0 flex-1">
               <div className="flex items-center gap-1.5 font-semibold"><Gift className="h-4 w-4 shrink-0" /> {bundle.name}</div>
               <div className="text-xs text-emerald-800">
-                {bundle.summary} for {fmt(bundle.price)}{save > 0.005 ? ` (save ${fmt(save)})` : ""}
+                {bundle.headline}{bundle.savingText ? ` (${bundle.savingText})` : ""}
               </div>
               {partial ? (
                 <div className="text-xs text-emerald-800 mt-0.5">
-                  Add {missing.map(m => `${m.short} × ${itemName(m.item, m.opt)}`).join(" and ")} to {sets > 0 ? "complete another bundle" : "complete it"}.
+                  Add {missing} to {isGroup ? "get the group price" : sets > 0 ? "complete another bundle" : "complete it"}.
                 </div>
               ) : (
-                <div className="text-xs font-medium text-emerald-700 mt-0.5">✓ {sets > 1 ? `${sets} bundles` : "Bundle"} in your basket</div>
+                <div className="text-xs font-medium text-emerald-700 mt-0.5">{done}</div>
               )}
-              {!next && <div className="text-xs text-amber-700 mt-0.5">Not enough tickets left for {partial ? "this bundle" : "another one"}.</div>}
+              {!next && (partial || canAddMore) && <div className="text-xs text-amber-700 mt-0.5">Not enough tickets left for {partial ? "this bundle" : "another one"}.</div>}
             </div>
             {partial ? (
               <button type="button" onClick={() => next && apply(next)} disabled={!next}
                 className="shrink-0 rounded-md bg-emerald-600 px-3 py-1.5 text-xs font-semibold text-white hover:bg-emerald-700 disabled:opacity-50">
-                Complete bundle
+                {isGroup ? "Complete group" : "Complete bundle"}
               </button>
-            ) : (
+            ) : canAddMore ? (
               <div className="flex shrink-0 items-center gap-2">
                 <span className="text-xs font-medium">×{sets}</span>
                 <button type="button" onClick={() => next && apply(next)} disabled={!next} aria-label={`Add another ${bundle.name}`} title="Add another bundle"
@@ -199,7 +274,7 @@ export function BundleBuilder({ bundles, options, qty, onSetQuantity, className
                   +
                 </button>
               </div>
-            )}
+            ) : null}
           </div>
         );
       })}

frontend/src/content/help/dashboard-user.tsx

@@ -1,5 +1,5 @@
 import React from "react";
-import { Calendar, Ticket, CreditCard, HandHeart, Printer, CheckCircle2, ClipboardList, Clock, SquarePen, History, CheckSquare, Receipt, FileText, Users, ArrowRightLeft } from "lucide-react";
+import { Calendar, Ticket, CreditCard, HandHeart, Printer, CheckCircle2, ClipboardList, Clock, SquarePen, History, CheckSquare, Receipt, FileText, Users, ArrowRightLeft, Award, CalendarDays } from "lucide-react";
 import { GuideItem } from "@/components/shared/GuideItem";
 import type { HelpContent } from "./types";
 
@@ -60,6 +60,12 @@ export const dashboardUserHelpContent: HelpContent = {
             <GuideItem icon={Printer} title="Print, email, or WhatsApp" tone="green">
               Get your selected tickets onto your phone or paper before the event — as a printed page, an email, or a WhatsApp message.
             </GuideItem>
+            <GuideItem icon={CalendarDays} title="Events with several sessions" tone="brand">
+              For a course or event that runs on several dates, your one ticket works for every session — bring the same QR code each time. The event page shows the full schedule.
+            </GuideItem>
+            <GuideItem icon={Award} title="Certificates" tone="amber">
+              If an event gives completion certificates, yours appears under My Certificates once it&apos;s issued — usually after the last session. Download it as a PDF; it has a code anyone can check.
+            </GuideItem>
             <GuideItem icon={ArrowRightLeft} title="Transfer a ticket" tone="violet">
               Can&apos;t make it? Tap &quot;Transfer&quot; to offer your ticket to someone else before the event. Type their name and email and/or phone number — there&apos;s no searching for people — and we send them a link to accept it. Until they accept, the ticket is still yours (you&apos;ll see &quot;Waiting for … to accept&quot;, and can cancel). Once they accept, they get their own ticket with a new QR code, and the old code (and any screenshots of it) stops working. For a ticket covering several people, one place moves to them. You stay responsible for the booking and payment. A ticket can&apos;t be transferred once it has been scanned.
             </GuideItem>

frontend/src/content/help/registry.ts

@@ -25,6 +25,7 @@ import { supervisorCouponsHelpContent } from "./supervisor-coupons";
 import { supervisorBundlesHelpContent } from "./supervisor-bundles";
 import { supervisorConsentHelpContent } from "./supervisor-consent";
 import { supervisorWaitlistHelpContent } from "./supervisor-waitlist";
+import { supervisorAttendanceHelpContent } from "./supervisor-attendance";
 import { supervisorOfflineScansHelpContent } from "./supervisor-offline-scans";
 import { supervisorAllocationsHelpContent, staffMyGroupsHelpContent } from "./supervisor-allocations";
 import { supervisorEmailAttendeesHelpContent } from "./supervisor-email-attendees";
@@ -173,6 +174,11 @@ const REGISTRY: HelpRegistryEntry[] = [
     matches: pathname => pathname === "/dashboard/supervisor/waitlist",
     content: supervisorWaitlistHelpContent,
   },
+  {
+    slug: "supervisor-attendance",
+    matches: pathname => pathname === "/dashboard/supervisor/attendance",
+    content: supervisorAttendanceHelpContent,
+  },
   {
     slug: "supervisor-consent",
     matches: pathname => pathname === "/dashboard/supervisor/consent",

frontend/src/content/help/reports.tsx

@@ -29,7 +29,7 @@ export const reportsHelpContent: HelpContent = {
               Preview your report, adjust filters, and choose how you want the data to appear.
             </GuideItem>
             <GuideItem icon={Download} title="Export or email" tone="amber">
-              Export your report to Excel, PDF, or send it by email or WhatsApp. Tip: select several events in the Feedback summary to compare their ratings (e.g. Camp 2025 vs Camp 2026). The Registration funnel shows where people drop off between viewing an event and paying, by source (short links and utm_source links) and device. It counts only visitors who allowed cookies.
+              Export your report to Excel, PDF, or send it by email or WhatsApp. Tip: select several events in the Feedback summary to compare their ratings (e.g. Camp 2025 vs Camp 2026). The Registration funnel shows where people drop off between viewing an event and paying, by source and device. The source comes from short links and utm_source links, else the site the visitor came from (Facebook, Instagram, Google…). The event page&apos;s Share and Save QR buttons tag their links as &quot;share&quot; and &quot;qr&quot;. WhatsApp doesn&apos;t say where a click came from, so add ?utm_source=whatsapp to links you post there, or they show as &quot;direct&quot;. It counts only visitors who allowed cookies.
             </GuideItem>
           </div>
         </div>

frontend/src/content/help/site-settings.tsx

@@ -1,9 +1,9 @@
 import React from "react";
-import { Building2, Palette, Bell, Mail, Scale, MessageCircle, LayoutDashboard } from "lucide-react";
+import { Building2, Palette, Bell, Mail, Scale, MessageCircle, LayoutDashboard, Timer, Play } from "lucide-react";
 import { GuideItem } from "@/components/shared/GuideItem";
 import type { HelpContent } from "./types";
 
-/** Help content for Site Settings (/dashboard/admin/settings), matching its six tabs. */
+/** Help content for Site Settings (/dashboard/admin/settings). */
 export const siteSettingsHelpContent: HelpContent = {
   title: "Site Settings help",
   subtitle: "Configure your organisation, branding, email, WhatsApp, and legal pages.",
@@ -25,6 +25,9 @@ export const siteSettingsHelpContent: HelpContent = {
             <GuideItem icon={Building2} title="Site URL" tone="gray">
               The public URL of this site, used in email links like password resets and ticket delivery.
             </GuideItem>
+            <GuideItem icon={Building2} title="Google Search Console verification" tone="gray">
+              Proves to Google that you own this site, so you can see search traffic and submit <code>/sitemap.xml</code> in Search Console. Add the site there as a URL-prefix property (e.g. <code>https://events.yourchurch.org/</code>), pick the <strong>HTML tag</strong> method, paste the tag here and save, then click Verify. Each site has its own code. Google finds your events without this; it only unlocks the Search Console reports.
+            </GuideItem>
           </div>
         </div>
       ),
@@ -93,5 +96,24 @@ export const siteSettingsHelpContent: HelpContent = {
         </div>
       ),
     },
+    {
+      key: "jobs",
+      label: "Background jobs",
+      icon: Timer,
+      content: (
+        <div className="space-y-4">
+          <p>Tasks the server runs on a schedule: the daily summary email, waitlist offers, feedback forms, session reminders and certificates, consent reminders, analytics, the nightly backup and temp-file cleanup.</p>
+          <div className="space-y-4">
+            <GuideItem icon={Timer} title="Schedule and history" tone="brand">
+              Each job shows when it runs and when it runs next. Click a job&apos;s last result to see its last 10 runs — when they started and finished, and what they did (or the error). A failed run is retried twice.
+            </GuideItem>
+            <GuideItem icon={Play} title="Run now" tone="green">
+              Runs a job straight away, e.g. to send a feedback form without waiting. It&apos;s recorded in the audit log.
+            </GuideItem>
+          </div>
+          <p className="text-xs text-gray-500">Jobs run once per schedule even when more than one server process is running. Schedules and on/off switches are set by the server&apos;s environment variables.</p>
+        </div>
+      ),
+    },
   ],
 };

frontend/src/content/help/staff-ticket-scanning.tsx

@@ -1,5 +1,5 @@
 import React from "react";
-import { QrCode, Filter, CheckCircle2, ShieldAlert, WifiOff } from "lucide-react";
+import { QrCode, Filter, CheckCircle2, ShieldAlert, WifiOff, CalendarDays } from "lucide-react";
 import { GuideItem } from "@/components/shared/GuideItem";
 import type { HelpContent } from "./types";
 
@@ -22,6 +22,9 @@ export const staffTicketScanningHelpContent: HelpContent = {
             <GuideItem icon={WifiOff} title="Offline mode" tone="amber">
               Worried about the venue Wi-Fi? While you&apos;re online, pick the event and section and tap &quot;Enable offline mode&quot;. The section is locked to your device and its tickets are downloaded, so you can keep scanning with no connection. Scans sync automatically when you&apos;re back online. Tickets bought after the download won&apos;t be on your list — send those people to the door desk. Tap &quot;Release section&quot; when you&apos;re done. Tip: add this page to your home screen so it opens offline.
             </GuideItem>
+            <GuideItem icon={CalendarDays} title="Multi-session events" tone="brand">
+              A ticket for an event with several sessions is checked in once per session. The scanner uses today&apos;s session automatically (pick another under &quot;Session&quot; if you need to). Scanning the same ticket again for the same session shows &quot;Already checked in for …&quot;. Depending on the event, check-in is open the whole day of a session or only around its start time. Offline mode downloads the list for today&apos;s session.
+            </GuideItem>
             <GuideItem icon={ShieldAlert} title="Parental consent" tone="rose">
               On youth events, the confirm screen warns when a parent hasn&apos;t given consent yet (or declined). That person can&apos;t be checked in; a supervisor can override, and the override is recorded in the audit log.
             </GuideItem>

frontend/src/content/help/supervisor-attendance.tsx

@@ -0,0 +1,61 @@
+import React from "react";
+import { ClipboardCheck, MousePointerClick, Filter, FileSpreadsheet, Award, Send, Ban, ShieldCheck } from "lucide-react";
+import { GuideItem } from "@/components/shared/GuideItem";
+import type { HelpContent } from "./types";
+
+/** Help content for /dashboard/supervisor/attendance. */
+export const supervisorAttendanceHelpContent: HelpContent = {
+  title: "Attendance",
+  subtitle: "Who came to each session, and completion certificates.",
+  tabs: [
+    {
+      key: "register",
+      label: "The register",
+      icon: ClipboardCheck,
+      content: (
+        <div className="space-y-4">
+          <div className="space-y-4">
+            <GuideItem icon={ClipboardCheck} title="One row per person" tone="brand">
+              Every main ticket is a row, with a column for each session of a multi-day event (one &quot;Checked in&quot; column for a single-date event). A tick means they were scanned in for that session; a number is how many places of a group ticket were.
+            </GuideItem>
+            <GuideItem icon={MousePointerClick} title="Fixing a session" tone="green">
+              Supervisors can click a box to mark someone present (e.g. they were let in without a scan) or absent. Each change is recorded in the audit log. Closed events can&apos;t be changed.
+            </GuideItem>
+            <GuideItem icon={Filter} title="Finding people" tone="violet">
+              Search by name, email or phone. Filter to who completed, who didn&apos;t, or who missed the last two sessions — handy for a follow-up call.
+            </GuideItem>
+            <GuideItem icon={FileSpreadsheet} title="Export" tone="amber">
+              Download the register as Excel (with contact details) or a printable PDF. Cancelled sessions are left out.
+            </GuideItem>
+          </div>
+        </div>
+      ),
+    },
+    {
+      key: "certificates",
+      label: "Certificates",
+      icon: Award,
+      content: (
+        <div className="space-y-4">
+          <div className="space-y-4">
+            <GuideItem icon={Award} title="Turning them on" tone="brand">
+              In the event wizard&apos;s Attendance step: pick one of four designs, the wording, who signs it, and who qualifies (every session, at least N sessions, or at least N%). They&apos;re issued automatically when the event ends.
+            </GuideItem>
+            <GuideItem icon={MousePointerClick} title="Issuing now" tone="green">
+              &quot;Issue now&quot; gives one to everyone who already qualifies. Use &quot;Issue anyway&quot; on a row to give one to someone who doesn&apos;t meet the rule.
+            </GuideItem>
+            <GuideItem icon={Send} title="Sending" tone="violet">
+              People can always download theirs from My Events. &quot;Send unsent&quot; emails or WhatsApps the ones not sent yet (as each person prefers); the event can also send them automatically.
+            </GuideItem>
+            <GuideItem icon={Ban} title="Revoking" tone="rose">
+              A revoked certificate stops showing as valid and is never issued again automatically. You can re-issue it by hand.
+            </GuideItem>
+            <GuideItem icon={ShieldCheck} title="Checking one" tone="amber">
+              Each certificate has a code and QR code. Anyone can check it at /certificates/verify/&lt;code&gt;, which shows only the name, event and dates.
+            </GuideItem>
+          </div>
+        </div>
+      ),
+    },
+  ],
+};

frontend/src/content/help/supervisor-bundles.tsx

@@ -1,12 +1,12 @@
 import React from "react";
-import { Gift, Plus, Layers, BadgePercent, CalendarClock, TicketPercent, Repeat, BarChart2, Lock } from "lucide-react";
+import { Gift, Plus, Layers, BadgePercent, CalendarClock, TicketPercent, Repeat, BarChart2, Lock, Shuffle, Users } from "lucide-react";
 import { GuideItem } from "@/components/shared/GuideItem";
 import type { HelpContent } from "./types";
 
 /** Help content for /dashboard/supervisor/bundles. */
 export const supervisorBundlesHelpContent: HelpContent = {
   title: "Bundle deals",
-  subtitle: "Sell a set of tickets together for one price.",
+  subtitle: "Tickets sold together at a better price.",
   tabs: [
     {
       key: "create",
@@ -15,9 +15,19 @@ export const supervisorBundlesHelpContent: HelpContent = {
       content: (
         <div className="space-y-4">
           <div className="space-y-4">
-            <GuideItem icon={Gift} title="What's in it" tone="brand">
-              Pick the event, then add each ticket type and how many, e.g. 5 × Adult + 3 × Child, and the price for the lot. For options with variants (sizes, room types) choose one variant or &quot;Any variant&quot;.
+            <GuideItem icon={Gift} title="Exact set" tone="brand">
+              These tickets in these numbers for one price, e.g. 2 × Adult + 3 × Child for R220.
             </GuideItem>
+            <GuideItem icon={Shuffle} title="Pick any" tone="violet">
+              Any mix of the qualifying tickets, e.g. any 4 of Adult or Child for R250: 2 + 2 and 4 + 0 both count.
+            </GuideItem>
+            <GuideItem icon={TicketPercent} title="Buy X get Y free" tone="rose">
+              In every set of qualifying tickets the cheapest are free, e.g. buy 3, get 1 free (4 per set, 1 free).
+            </GuideItem>
+            <GuideItem icon={Users} title="Group discount" tone="blue">
+              From a group size up, every qualifying ticket gets a lower price or a percentage off, e.g. 10+ tickets: R70 each. Tickets already cheaper than the group price stay as they are.
+            </GuideItem>
+            <p className="text-xs text-gray-500">For options with variants (sizes, room types) choose one variant or &quot;Any variant&quot;.</p>
             <GuideItem icon={BadgePercent} title="The saving" tone="green">
               The form shows what the tickets cost separately at the standard price and how much the bundle saves. Buyers see the deal on the event page and when they register.
             </GuideItem>
@@ -36,7 +46,7 @@ export const supervisorBundlesHelpContent: HelpContent = {
         <div className="space-y-4">
           <div className="space-y-4">
             <GuideItem icon={Repeat} title="Automatic, as many times as fits" tone="brand">
-              No code needed. 10 adults + 6 children gets the 5 + 3 deal twice; anything left over is charged as usual. This works the same online, for manual registrations, at the door and on the kiosk.
+              No code needed. Exact, pick-any and buy-X-get-Y-free deals apply as many times as the tickets allow (10 adults + 6 children gets a 5 + 3 deal twice); anything left over is charged as usual. A group discount applies once, to every qualifying ticket. This works the same online, for manual registrations, at the door and on the kiosk, where a &quot;Complete bundle&quot; button tops up the tickets.
             </GuideItem>
             <GuideItem icon={BadgePercent} title="Best price wins" tone="green">
               A bundle only applies when it&apos;s cheaper than the tickets at the prices actually charged, early-bird and staff prices included, so it never makes anything dearer. If an event has several bundles, the one that saves the most is used first.

frontend/src/content/help/supervisor-event-options.tsx

@@ -20,7 +20,7 @@ export const supervisorEventOptionsHelpContent: HelpContent = {
           <p>Pick an event, then edit each option&apos;s name, price, and &quot;Main ticket&quot; flag directly in the list — changes save when you click away from the field. Use the form below the list to add a new option.</p>
           <div className="space-y-4">
             <GuideItem icon={Tag} title="Early-bird tiers" tone="amber">
-              Expand &quot;Manage early-bird tiers&quot; on an option to add deadline-and-price rows that apply automatically before the cutoff.
+              Expand &quot;Manage early-bird tiers&quot; on an option to add deadline-and-price rows that apply automatically before the cutoff. While a tier is running (before its deadline, with places left), the event&apos;s card on the home page and events list shows an &quot;Early bird&quot; ribbon in the top-right corner.
             </GuideItem>
           </div>
         </div>

frontend/src/content/help/supervisor-events.tsx

@@ -1,5 +1,5 @@
 import React from "react";
-import { Calendar, ListChecks, Layers, FileText, Eye, Bell, Paperclip, Lock, MessageSquareHeart } from "lucide-react";
+import { Calendar, ListChecks, Layers, FileText, Eye, Bell, Paperclip, Lock, MessageSquareHeart, CalendarDays, ClipboardCheck } from "lucide-react";
 import { GuideItem } from "@/components/shared/GuideItem";
 import type { HelpContent } from "./types";
 
@@ -34,6 +34,9 @@ export const supervisorEventsHelpContent: HelpContent = {
             <GuideItem icon={Calendar} title="Basic details" tone="brand">
               Title, description, start/end times, registration deadline, go-live time, base price, picture, and a custom URL alias.
             </GuideItem>
+            <GuideItem icon={CalendarDays} title="Multiple sessions" tone="brand">
+              Choose &quot;Multiple sessions&quot; for one event on several dates — e.g. every Wednesday 18:30–20:30 for 5 weeks. Use the repeat pattern to create the dates, then edit any of them, add a label (&quot;Week 1 — …&quot;), a different location, or an extra date. People register and pay once and get one ticket for every session. Cancel a session (e.g. a public holiday) rather than deleting it once people have been checked in. Registration closes when the first session starts unless you turn on late joining.
+            </GuideItem>
             <GuideItem icon={ListChecks} title="Items & pricing" tone="green">
               Ticket options and stock, variants of each option, and early-bird pricing tiers. An optional staff price is charged automatically to Staff and above when it&apos;s lower than the normal price.
             </GuideItem>
@@ -55,6 +58,9 @@ export const supervisorEventsHelpContent: HelpContent = {
             <GuideItem icon={MessageSquareHeart} title="Feedback" tone="violet">
               Send a feedback form automatically after the event: pick when (e.g. the morning after) and whether it goes to everyone who checked in or everyone registered. Questions can be star ratings, multiple choice, yes/no or text. Answers can be anonymous. Anyone who hasn&apos;t answered gets one reminder 3 days later. Results are in Reports → Feedback summary. Rating and multiple-choice questions can also be used on the attendee form.
             </GuideItem>
+            <GuideItem icon={ClipboardCheck} title="Attendance" tone="green">
+              For multi-session events: late joining (until which session, and a full, pro-rata or fixed late price for main tickets — pro-rata rounds to the nearest R10), the check-in window (the whole day of a session, or only from 2 hours before it until it ends), and reminders before each session. For any event: completion certificates — four designs, your wording and signature, and who qualifies. &quot;Preview certificate&quot; shows a sample.
+            </GuideItem>
           </div>
           <p className="text-xs text-gray-500">When creating a new event, later steps unlock as you complete the ones before them; editing an existing event lets you jump to any step freely.</p>
         </div>

frontend/src/contexts/SiteSettingsContext.tsx

@@ -18,6 +18,7 @@ export type SiteSettings = {
   logo_url?: string;
   favicon_url?: string;
   setup_complete?: string;
+  google_site_verification?: string;
   // Legal pages
   legal_operator_name?: string;
   legal_io_name?: string;

frontend/src/lib/analytics.ts

@@ -56,11 +56,45 @@ export function analyticsSessionId(): string | undefined {
   }
 }
 
-/** Where the visitor came from: ?utm_source=… or ?src=<short-link alias>. */
+// Referring sites we name ourselves; any other site is recorded by its hostname.
+const REFERRER_SOURCES: [RegExp, string][] = [
+  [/(^|\.)(facebook\.com|fb\.com|fb\.me)$/, "facebook"],
+  [/(^|\.)instagram\.com$/, "instagram"],
+  [/(^|\.)(whatsapp\.com|wa\.me)$/, "whatsapp"],
+  [/(^|\.)google\.[a-z.]+$/, "google"],
+  [/(^|\.)bing\.com$/, "bing"],
+  [/(^|\.)duckduckgo\.com$/, "duckduckgo"],
+  [/(^|\.)yahoo\.com$/, "yahoo"],
+  [/(^|\.)(twitter\.com|x\.com|t\.co)$/, "x"],
+  [/(^|\.)(linkedin\.com|lnkd\.in)$/, "linkedin"],
+  [/(^|\.)(youtube\.com|youtu\.be)$/, "youtube"],
+  [/(^|\.)tiktok\.com$/, "tiktok"],
+];
+
+/** The referring site as a source label; undefined when there's none or it's this site. */
+function sourceFromReferrer(): string | undefined {
+  try {
+    if (!document.referrer) return undefined;
+    const host = new URL(document.referrer).hostname.toLowerCase();
+    if (!host || host === window.location.hostname.toLowerCase()) return undefined;
+    for (const [re, label] of REFERRER_SOURCES) if (re.test(host)) return label;
+    return host.replace(/^www\./, "");
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Where the visitor came from: ?utm_source=… or ?src=<short-link alias> when the link
+ * says so, else the referring site (Facebook, Google, …), else Facebook's/Google's click
+ * ids. WhatsApp sends no referrer, so it's only known from a tagged link.
+ */
 function sourceFromUrl(): string | undefined {
   try {
     const p = new URLSearchParams(window.location.search);
-    return p.get("utm_source") || p.get("src") || undefined;
+    return p.get("utm_source") || p.get("src") || sourceFromReferrer()
+      || (p.has("fbclid") ? "facebook" : undefined)
+      || (p.has("gclid") ? "google" : undefined);
   } catch {
     return undefined;
   }

frontend/src/lib/api.ts

@@ -203,12 +203,13 @@ export function fetchAllPayments(token: string, params: Record<string, string> =
 // partial-amount checkouts are only ever created from the supervisor payments dashboard.
 export type CheckoutResponse = { redirectUrl?: string; priceUpdated?: boolean; newTotal?: number; message?: string };
 
-export function createFullPaymentCheckout(token: string, registrationId: string): Promise<CheckoutResponse> {
+export function createFullPaymentCheckout(token: string, registrationId: string, donationAmount?: number): Promise<CheckoutResponse> {
   return apiFetch<CheckoutResponse>("/api/payments/yoco-checkout", {
     method: "POST",
     authToken: token,
     body: {
       registrationId,
+      ...(donationAmount && donationAmount > 0 ? { donationAmount } : {}),
       successUrl: window.location.origin + "/payment/success",
       cancelUrl: window.location.origin + "/payment/cancel",
       failureUrl: window.location.origin + "/payment/failure",

frontend/src/lib/eventSchema.ts

@@ -0,0 +1,85 @@
+// schema.org Event data for an event page, so Google can show the event with its date,
+// venue and ticket link (event rich results / "events near me").
+// Checked with https://search.google.com/test/rich-results
+
+type SchemaOption = {
+  price: number;
+  stockLimit?: number;
+  availableCount?: number;
+  earlyBirdTiers?: { deadline: string; price: number }[];
+  variants?: { price: number | null; stockLimit?: number; availableCount?: number }[];
+};
+
+export type SchemaEvent = {
+  id: string;
+  title: string;
+  description?: string;
+  startDate: string;
+  endDate: string;
+  goLiveAt?: string;
+  picture?: string;
+  location?: string | null;
+  requiresRegistration?: boolean;
+  eventOptions?: SchemaOption[];
+};
+
+/** Today's price of each ticket (early-bird when one is open, else the variant/base price). */
+function currentPrices(options: SchemaOption[], now: Date): number[] {
+  const prices: number[] = [];
+  for (const o of options) {
+    if (o.variants && o.variants.length > 0) {
+      for (const v of o.variants) prices.push(v.price ?? o.price);
+      continue;
+    }
+    const open = (o.earlyBirdTiers || []).filter((t) => now < new Date(t.deadline)).map((t) => t.price);
+    prices.push(open.length > 0 ? Math.min(...open) : o.price);
+  }
+  return prices.filter((p) => Number.isFinite(p));
+}
+
+export function eventJsonLd(
+  event: SchemaEvent,
+  { pageUrl, imageUrl, organizerName, siteUrl }: { pageUrl: string; imageUrl: string | null; organizerName: string; siteUrl: string },
+) {
+  const now = new Date();
+  const options = event.eventOptions || [];
+  const limited = options.filter((o) => (o.stockLimit ?? 0) > 0);
+  const soldOut = limited.length > 0 && limited.every((o) => o.availableCount !== undefined && o.availableCount <= 0);
+
+  // Contact-only events (requiresRegistration false) have no tickets to offer.
+  let offers: Record<string, unknown> | undefined;
+  if (event.requiresRegistration !== false) {
+    const prices = options.length > 0 ? currentPrices(options, now) : [0];
+    const low = Math.min(...prices);
+    const high = Math.max(...prices);
+    offers = {
+      "@type": low === high ? "Offer" : "AggregateOffer",
+      ...(low === high ? { price: low.toFixed(2) } : { lowPrice: low.toFixed(2), highPrice: high.toFixed(2) }),
+      priceCurrency: "ZAR",
+      availability: soldOut ? "https://schema.org/SoldOut" : "https://schema.org/InStock",
+      url: `${siteUrl}/register/${event.id}`,
+      ...(event.goLiveAt ? { validFrom: new Date(event.goLiveAt).toISOString() } : {}),
+    };
+  }
+
+  return {
+    "@context": "https://schema.org",
+    "@type": "Event",
+    name: event.title,
+    ...(event.description ? { description: event.description.slice(0, 5000) } : {}),
+    startDate: new Date(event.startDate).toISOString(),
+    endDate: new Date(event.endDate).toISOString(),
+    eventStatus: "https://schema.org/EventScheduled",
+    eventAttendanceMode: "https://schema.org/OfflineEventAttendanceMode",
+    ...(event.location ? { location: { "@type": "Place", name: event.location, address: event.location } } : {}),
+    ...(imageUrl ? { image: [imageUrl] } : {}),
+    url: pageUrl,
+    organizer: { "@type": "Organization", name: organizerName, url: siteUrl },
+    ...(offers ? { offers } : {}),
+  };
+}
+
+/** JSON for a <script type="application/ld+json">, safe against "</script>" in event text. */
+export function jsonLdString(data: unknown): string {
+  return JSON.stringify(data).replace(/</g, "\\u003c");
+}

frontend/src/lib/export.ts

@@ -191,3 +191,37 @@ export function mailtoReport(subject: string, body: string) {
   const url = `mailto:?subject=${encodeURIComponent(subject)}&body=${encodeURIComponent(body)}`;
   window.location.href = url;
 }
+
+// Fetches a file (PDF, Excel…) from the API with the user's token.
+export async function fetchApiFile(apiBase: string, authToken: string, path: string, init: { method?: string; body?: unknown } = {}): Promise<Blob> {
+  const res = await fetch(`${apiBase}${path}`, {
+    method: init.method || 'GET',
+    headers: {
+      'Authorization': `Bearer ${authToken}`,
+      ...(init.body !== undefined ? { 'Content-Type': 'application/json' } : {}),
+    },
+    ...(init.body !== undefined ? { body: JSON.stringify(init.body) } : {}),
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => '');
+    let message = text;
+    try { message = JSON.parse(text)?.message || text; } catch { /* not JSON */ }
+    throw new Error(message || `Download failed (${res.status})`);
+  }
+  return res.blob();
+}
+
+export function saveBlob(blob: Blob, filename: string) {
+  const dl = document.createElement('a');
+  const objUrl = URL.createObjectURL(blob);
+  dl.href = objUrl;
+  dl.download = filename;
+  dl.click();
+  setTimeout(() => URL.revokeObjectURL(objUrl), 2000);
+}
+
+export function openBlob(blob: Blob) {
+  const objUrl = URL.createObjectURL(blob);
+  window.open(objUrl, '_blank');
+  setTimeout(() => URL.revokeObjectURL(objUrl), 60000);
+}

frontend/src/lib/offlineScan.ts

@@ -29,6 +29,8 @@ export type OfflineLock = {
   sectionId: string | null;
   sectionName: string | null;
   snapshotAt: string;
+  // Multi-day events: the session the downloaded ticket list is for.
+  sessionLabel?: string | null;
 };
 
 const DB_NAME = "hope-events-offline-scan";

frontend/src/lib/serverSettings.ts

@@ -0,0 +1,24 @@
+import type { SiteSettings } from "@/contexts/SiteSettingsContext";
+import { API_BASE } from "@/lib/api";
+
+/**
+ * Server-side settings fetch, shared by the root layout (generateMetadata and
+ * RootLayout) and server pages that need branding, e.g. the event page's organizer.
+ * Every caller uses the identical URL + options, so Next's per-request fetch
+ * memoization dedupes them into a single network call. Degrades to `{}`
+ * (static defaults everywhere downstream) if the backend is unreachable at
+ * request time — intentional, not a bug: branding just isn't critical enough
+ * to fail the whole page render over.
+ */
+export async function getServerSettings(): Promise<SiteSettings> {
+  // No API base configured: a relative fetch never settles during prerender and
+  // would time out every page, so skip straight to the defaults.
+  if (!API_BASE) return {};
+  try {
+    const res = await fetch(`${API_BASE}/api/settings`, { next: { revalidate: 60 } });
+    if (!res.ok) return {};
+    return await res.json();
+  } catch {
+    return {};
+  }
+}

frontend/src/lib/sessions.ts

@@ -0,0 +1,174 @@
+import type { Event, EventSession, LateJoinInfo } from "@/types";
+
+// Multi-day events — browser-side helpers. The rules live in backend utils/sessions.js;
+// latePrice below mirrors it so prices shown match what the server charges.
+
+export type SessionPattern = {
+  frequency: "daily" | "weekly";
+  interval: number;           // every N days/weeks
+  weekdays: number[];         // weekly only: 0 = Sunday … 6 = Saturday
+  startDate: string;          // YYYY-MM-DD (local)
+  startTime: string;          // HH:MM
+  endTime: string;            // HH:MM (an end before the start runs past midnight)
+  endsBy: "count" | "until";
+  count: number;
+  until: string;              // YYYY-MM-DD (local)
+};
+
+export type SessionDraft = {
+  id?: string;
+  label: string;
+  startsAt: string;           // datetime-local value (YYYY-MM-DDTHH:MM, local)
+  endsAt: string;
+  location: string;
+  cancelled: boolean;
+  hasCheckIns?: boolean;
+};
+
+const MAX_GENERATED = 200;
+
+function localDT(d: Date): string {
+  const p = (n: number) => String(n).padStart(2, "0");
+  return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())}T${p(d.getHours())}:${p(d.getMinutes())}`;
+}
+
+function atTime(day: Date, hhmm: string): Date {
+  const [h, m] = hhmm.split(":").map(Number);
+  const d = new Date(day);
+  d.setHours(h || 0, m || 0, 0, 0);
+  return d;
+}
+
+/** Turns a repeat pattern into session rows (local time). */
+export function generateSessions(p: SessionPattern): SessionDraft[] {
+  const [y, mo, d] = p.startDate.split("-").map(Number);
+  if (!y || !mo || !d || !p.startTime || !p.endTime) return [];
+  const first = new Date(y, mo - 1, d);
+  const until = p.endsBy === "until" && p.until ? (() => { const [uy, um, ud] = p.until.split("-").map(Number); return new Date(uy, um - 1, ud, 23, 59); })() : null;
+  const limit = p.endsBy === "count" ? Math.min(Math.max(1, p.count || 1), MAX_GENERATED) : MAX_GENERATED;
+  const interval = Math.max(1, p.interval || 1);
+  const weekdays = p.frequency === "weekly" ? (p.weekdays.length ? [...p.weekdays].sort() : [first.getDay()]) : [];
+
+  const out: SessionDraft[] = [];
+  const push = (day: Date) => {
+    const start = atTime(day, p.startTime);
+    let end = atTime(day, p.endTime);
+    if (end <= start) end = new Date(end.getTime() + 24 * 60 * 60 * 1000);
+    out.push({ label: "", startsAt: localDT(start), endsAt: localDT(end), location: "", cancelled: false });
+  };
+
+  if (p.frequency === "daily") {
+    for (let i = 0, day = new Date(first); out.length < limit; i++, day.setDate(day.getDate() + interval)) {
+      if (until && day > until) break;
+      push(day);
+      if (i > 5000) break;
+    }
+    return out;
+  }
+
+  // Weekly: walk week by week from the week containing the start date (weeks start Sunday).
+  const weekStart = new Date(first);
+  weekStart.setDate(first.getDate() - first.getDay());
+  for (let w = 0; out.length < limit && w < 1000; w += interval) {
+    for (const wd of weekdays) {
+      const day = new Date(weekStart);
+      day.setDate(weekStart.getDate() + w * 7 + wd);
+      if (day < first) continue;
+      if (until && day > until) return out;
+      if (out.length >= limit) return out;
+      push(day);
+    }
+  }
+  return out;
+}
+
+export function toSessionDraft(s: EventSession & { hasCheckIns?: boolean }): SessionDraft {
+  return { id: s.id, label: s.label || "", startsAt: localDT(new Date(s.startsAt)), endsAt: localDT(new Date(s.endsAt)), location: s.location || "", cancelled: !!(s.cancelled || s.cancelledAt), hasCheckIns: s.hasCheckIns };
+}
+
+/** Sessions that aren't cancelled, earliest first. */
+export function activeSessions<T extends { startsAt: string; cancelled?: boolean; cancelledAt?: string | null }>(sessions: T[] | undefined | null): T[] {
+  return (sessions || []).filter(s => !(s.cancelled || s.cancelledAt)).sort((a, b) => new Date(a.startsAt).getTime() - new Date(b.startsAt).getTime());
+}
+
+/** "Week 1" — the session's label, else its position among active sessions. */
+export function sessionLabel(session: EventSession, sessions: EventSession[] | undefined | null): string {
+  if (session.label) return session.label;
+  const idx = activeSessions(sessions).findIndex(s => s.id === session.id);
+  return `Session ${idx >= 0 ? idx + 1 : ""}`.trim();
+}
+
+const dayFmt = new Intl.DateTimeFormat("en-GB", { weekday: "short", day: "numeric", month: "short" });
+const timeFmt = new Intl.DateTimeFormat("en-GB", { hour: "2-digit", minute: "2-digit", hour12: false });
+
+/** "Wed 4 Nov, 18:30–20:30" */
+export function formatSessionWhen(s: { startsAt: string; endsAt: string }): string {
+  const start = new Date(s.startsAt);
+  const end = new Date(s.endsAt);
+  const sameDay = start.toDateString() === end.toDateString();
+  return sameDay
+    ? `${dayFmt.format(start)}, ${timeFmt.format(start)}–${timeFmt.format(end)}`
+    : `${dayFmt.format(start)} ${timeFmt.format(start)} – ${dayFmt.format(end)} ${timeFmt.format(end)}`;
+}
+
+/** "5 sessions · Wed 4 Nov – Wed 2 Dec" for event cards; null for single-date events. */
+export function scheduleSummary(event: Pick<Event, "scheduleType" | "sessions">): string | null {
+  if (event.scheduleType !== "sessions") return null;
+  const active = activeSessions(event.sessions);
+  if (active.length === 0) return null;
+  const first = dayFmt.format(new Date(active[0].startsAt));
+  const last = dayFmt.format(new Date(active[active.length - 1].startsAt));
+  return active.length === 1 ? `1 session · ${first}` : `${active.length} sessions · ${first} – ${last}`;
+}
+
+/** When public registration closes (falls back for older API responses). */
+export function registrationClosesAt(event: Pick<Event, "registrationClosesAt" | "registrationDeadline" | "endDate">): Date {
+  if (event.registrationClosesAt) return new Date(event.registrationClosesAt);
+  const end = new Date(event.endDate);
+  const deadline = event.registrationDeadline ? new Date(event.registrationDeadline) : null;
+  return deadline && deadline < end ? deadline : end;
+}
+
+/** A main ticket's price for a late joiner — same rule as the backend. */
+export function latePrice(price: number, info: LateJoinInfo | null | undefined): number {
+  if (!info || !info.active || !(price > 0)) return price;
+  if (info.mode === "fixed") return Math.min(price, Math.max(0, Number(info.fixedPrice)));
+  if (info.mode === "prorata") {
+    if (!info.totalSessions) return price;
+    const rounded = Math.round((price * info.sessionsLeft / info.totalSessions) / 10) * 10;
+    return Math.min(price, Math.max(10, rounded));
+  }
+  return price;
+}
+
+export const REMINDER_OPTIONS = [
+  { minutes: 60, label: "1 hour before" },
+  { minutes: 180, label: "3 hours before" },
+  { minutes: 1440, label: "1 day before" },
+] as const;
+
+export const CERTIFICATE_TEMPLATES = [
+  { id: "classic", name: "Classic", blurb: "Double border, serif type" },
+  { id: "modern", name: "Modern", blurb: "Clean, with a colour bar" },
+  { id: "church", name: "Church", blurb: "Logo-led and soft" },
+  { id: "kids", name: "Kids", blurb: "Bright and playful" },
+] as const;
+
+export const DEFAULT_CERTIFICATE_BODY = "This certifies that {name} has completed {event}, attending {sessionsAttended} of {totalSessions} sessions.";
+
+/** Label of the session open for check-in today (whole-day rule, browser time), or null. */
+export function currentSessionLabel(event: Pick<Event, "scheduleType" | "sessions"> | null | undefined): string | null {
+  if (!event || event.scheduleType !== "sessions") return null;
+  const today = new Date().toDateString();
+  const s = activeSessions(event.sessions).find(x => new Date(x.startsAt).toDateString() === today);
+  return s ? sessionLabel(s, event.sessions) : null;
+}
+
+/** The session of a multi-day event open for check-in today (browser's local day), or null. */
+export function todaysSession(event: Pick<Event, "scheduleType" | "sessions"> | null | undefined): EventSession | null {
+  if (!event || event.scheduleType !== "sessions") return null;
+  const today = new Date().toDateString();
+  const now = Date.now();
+  const list = activeSessions(event.sessions).filter(x => new Date(x.startsAt).toDateString() === today);
+  return list.find(s => now <= new Date(s.endsAt).getTime()) || list[list.length - 1] || null;
+}

frontend/src/lib/ticketPrint.ts

@@ -0,0 +1,92 @@
+import type { Ticket as TicketRecord } from "@/types";
+import { formatDate } from "@/lib/date";
+import { scheduleSummary } from "@/lib/sessions";
+
+// One ticket design for every printed ticket (user dashboard, staff event tickets, at the
+// door). The emailed/WhatsApp PDF in backend/src/controllers/ticketController.js mirrors it.
+
+function esc(s: string): string {
+  return s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[c]!));
+}
+
+export function ticketTypeLabel(t: TicketRecord): string {
+  const opt = t.registrationOption?.eventOption?.name || "Ticket";
+  const variant = t.registrationOption?.variant?.name;
+  return variant ? `${opt} — ${variant}` : opt;
+}
+
+/** A ticket card. `buyerName` adds a "Purchased by" line. */
+export function ticketCardHtml(t: TicketRecord, buyerName?: string | null): string {
+  const eventTitle = t.event?.title || t.eventId || "Event";
+  // Multi-day events: "5 sessions · Wed 4 Nov – Wed 2 Dec" — one ticket for every session.
+  const dateStr = (t.event && scheduleSummary(t.event)) || (t.event?.startDate ? formatDate(t.event.startDate) : "");
+  const qrSrc = `https://api.qrserver.com/v1/create-qr-code/?size=320x320&data=${encodeURIComponent(t.qrCode || t.id)}`;
+  return `
+    <div class="ticket">
+      <div class="row between">
+        <div class="evt">${esc(eventTitle)}</div>
+        ${dateStr ? `<div class="date">${esc(dateStr)}</div>` : ""}
+      </div>
+      <div class="type">${esc(ticketTypeLabel(t))}</div>
+      ${t.attendee?.name ? `<div class="qty">Name: <strong>${esc(t.attendee.name)}</strong></div>` : `<div class="qty">Qty: <strong>${t.quantity || 1}</strong></div>`}
+      <div class="qrwrap"><img src="${qrSrc}" alt="QR" /></div>
+      <div class="meta">Ticket ID: ${esc(t.id)}</div>
+      ${buyerName ? `<div class="meta">Purchased by: ${esc(buyerName)}</div>` : ""}
+    </div>
+  `;
+}
+
+/** Opens a print window with the given cards and prints once the QR images have loaded. */
+export function openTicketPrintWindow(title: string, cardsHtml: string) {
+  const w = window.open("", "_blank");
+  if (!w) return;
+  w.document.write(`<!doctype html><html><head><title>${esc(title)}</title>
+    <style>
+      *{box-sizing:border-box}
+      body{font-family:Arial,Helvetica,sans-serif;margin:0;padding:16px;background:#f7f7f7}
+      .grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(260px,1fr));gap:16px}
+      .ticket{background:#fff;border:1px solid #e5e7eb;border-radius:12px;padding:14px;box-shadow:0 1px 3px rgba(0,0,0,0.06);break-inside:avoid;page-break-inside:avoid}
+      .evt{font-weight:700;font-size:14px}
+      .type{margin-top:4px;color:#374151}
+      .qty{margin-top:2px;font-size:12px;color:#374151}
+      .date{color:#6b7280;font-size:12px}
+      .row{display:flex;gap:8px;align-items:center}
+      .between{justify-content:space-between}
+      .qrwrap{display:flex;justify-content:center;align-items:center;margin:10px 0}
+      .qrwrap img{width:160px;height:160px}
+      .meta{font-size:12px;color:#6b7280;text-align:center;margin-top:6px;word-break:break-all}
+      @media print { body{background:#fff} .print-hidden{display:none !important} }
+    </style>
+  </head><body>
+    <h2 class="print-hidden" style="margin:8px 0 16px 0;font-size:18px">${esc(title)}</h2>
+    <div class="grid">${cardsHtml}</div>
+    <script>
+      (function(){
+        function printWhenReady(){
+          var imgs = Array.prototype.slice.call(document.images);
+          if(imgs.length === 0){ window.print(); return; }
+          var remaining = imgs.length;
+          function done(){ remaining--; if(remaining <= 0){ setTimeout(function(){ window.print(); }, 200); } }
+          imgs.forEach(function(img){
+            if (img.complete) { done(); }
+            else {
+              img.addEventListener('load', done, { once: true });
+              img.addEventListener('error', done, { once: true });
+            }
+          });
+        }
+        if (document.readyState === 'complete') printWhenReady();
+        else window.addEventListener('load', printWhenReady);
+      })();
+    </script>
+  </body></html>`);
+  w.document.close();
+  w.focus();
+}
+
+/** Prints tickets in the shared design. */
+export function printTicketCards(tickets: TicketRecord[], buyerName?: (t: TicketRecord) => string | null | undefined) {
+  if (!tickets || tickets.length === 0) return;
+  const cards = tickets.map((t) => ticketCardHtml(t, buyerName?.(t))).join("");
+  openTicketPrintWindow(tickets.length === 1 ? "Ticket" : `Tickets (${tickets.length})`, cards);
+}

frontend/src/lib/waitlist.ts

@@ -0,0 +1,22 @@
+// Pure helpers shared by server and client components. Must not be "use client",
+// or server pages calling these get a client reference instead of the function.
+
+export type WaitlistLine = { eventOptionId: string; variantId?: string | null; label: string };
+
+/** The sold-out lines of an event, for the waitlist button. */
+export function soldOutLines(options: { id: string; name: string; stockLimit?: number; availableCount?: number | null; variants?: { id: string; name: string; stockLimit?: number; availableCount?: number | null }[] | null }[]): WaitlistLine[] {
+  const out: WaitlistLine[] = [];
+  for (const o of options || []) {
+    const optOut = (o.stockLimit ?? 0) > 0 && o.availableCount !== undefined && o.availableCount !== null && o.availableCount <= 0;
+    const variants = o.variants || [];
+    if (variants.length > 0) {
+      for (const v of variants) {
+        const vOut = (v.stockLimit ?? 0) > 0 && v.availableCount !== undefined && v.availableCount !== null && v.availableCount <= 0;
+        if (optOut || vOut) out.push({ eventOptionId: o.id, variantId: v.id, label: `${o.name} (${v.name})` });
+      }
+    } else if (optOut) {
+      out.push({ eventOptionId: o.id, label: o.name });
+    }
+  }
+  return out;
+}

frontend/src/types/index.ts

@@ -150,20 +150,122 @@ export type Event = {
   closedById?: string | null;
   reopenedAt?: string | null;
   reopenedById?: string | null;
+  // Multi-day events (see backend utils/sessions.js). startDate/endDate follow the sessions.
+  scheduleType?: "single" | "sessions";
+  attendanceMode?: "whole" | "pick";
+  sessions?: EventSession[];
+  nextSession?: EventSession | null;
+  // When public registration closes: the deadline, the first session (or session N with
+  // late joining), or the end date — whichever applies.
+  registrationClosesAt?: string;
+  lateJoinEnabled?: boolean;
+  lateJoinUntilSessionId?: string | null;
+  latePricing?: "full" | "prorata" | "fixed";
+  lateFixedPrice?: number | null;
+  lateJoin?: LateJoinInfo | null;
+  checkInWindow?: "whole_day" | "session_only";
+  sessionReminders?: { offsets: number[]; channels: ("email" | "whatsapp")[] } | null;
+  certificatesEnabled?: boolean;
+  certificateConfig?: CertificateConfig | null;
+  // Set by GET /api/events while an early-bird tier is still running.
+  earlyBirdEndsAt?: string | null;
+  isSoldOut?: boolean;
+};
+
+export type EventSession = {
+  id: string;
+  eventId?: string;
+  label?: string | null;
+  startsAt: string;
+  endsAt: string;
+  location?: string | null;
+  cancelledAt?: string | null;
+  cancelled?: boolean;
+  order?: number;
+};
+
+export type LateJoinInfo = {
+  active: boolean;
+  mode: "full" | "prorata" | "fixed";
+  sessionsLeft: number;
+  totalSessions: number;
+  fixedPrice: number | null;
+};
+
+export type CertificateTemplate = "classic" | "modern" | "church" | "kids";
+export type CertificateConfig = {
+  template: CertificateTemplate;
+  title: string;
+  body: string;
+  signatureName?: string;
+  signatureRole?: string;
+  signatureImage?: string;
+  rule: { type: "all" | "count" | "percent"; value: number | null };
+  sendOnIssue?: boolean;
+};
+
+// GET /api/attendance/:eventId
+export type AttendanceColumn = { id: string; label: string; startsAt: string; endsAt: string; cancelled: boolean };
+export type AttendanceRow = {
+  ticketId: string;
+  name: string;
+  bookedBy: string;
+  email: string;
+  phone: string;
+  option: string;
+  variant: string | null;
+  quantity: number;
+  checkIns: Record<string, number>;
+  attended: number;
+  total: number;
+  completed: boolean;
+  certificate: { id: string; code: string; issuedAt: string; revokedAt: string | null; manual: boolean; emailedAt: string | null } | null;
+};
+export type AttendanceRegister = {
+  event: Pick<Event, "id" | "title" | "scheduleType" | "startDate" | "endDate" | "cashupStatus" | "certificatesEnabled"> & { certificateConfig: CertificateConfig };
+  columns: AttendanceColumn[];
+  rows: AttendanceRow[];
+  totals: Record<string, number>;
+};
+
+// GET /api/attendance/certificates/mine
+export type MyCertificate = {
+  id: string;
+  code: string;
+  name: string;
+  issuedAt: string;
+  sessionsAttended: number;
+  totalSessions: number;
+  event: { id: string; title: string; endDate: string };
 };
 
 export type BundleItem = { id?: string; eventOptionId: string; variantId?: string | null; quantity: number; eventOption?: { id: string; name: string; price?: number } | null; variant?: { id: string; name: string } | null };
 
+// exact: these tickets in these numbers for a set price. mix: any setSize of the
+// qualifying tickets for a set price. free: any setSize, the cheapest freeCount free.
+// group: setSize or more qualifying tickets at price each (or price% off).
+export type BundleKind = "exact" | "mix" | "free" | "group";
+export type BundleGroupPricing = "per_ticket" | "percent";
+
 // A bundle deal as shown to buyers on the event page.
 export type PublicBundle = {
   id: string;
   name: string;
   description?: string | null;
+  kind: BundleKind;
   price: number;
+  setSize?: number | null;
+  freeCount?: number | null;
+  groupPricing?: BundleGroupPricing | null;
   validUntil?: string | null;
+  // The tickets: "5 × Adult + 3 × Child" (exact) or "Adult, Child" (the others).
   summary: string;
-  // What the items cost separately at the standard price.
-  standardValue: number;
+  // The deal in one line, e.g. "Any 4 of Adult, Child for R250".
+  headline: string;
+  // What an exact set (or the dearest pick-any set) costs at standard prices.
+  standardValue: number | null;
+  // e.g. "save R60", "save up to R10 a ticket"; null when the headline says it.
+  savingText: string | null;
   items: BundleItem[];
 };
 
@@ -426,7 +528,7 @@ export type Ticket = {
   transferRequests?: { id: string; toName: string; toEmail?: string | null; toPhone?: string | null; createdAt?: string }[];
   event?: Event;
   registrationOption?: RegistrationOption;
-  usages?: { id: string; scannedAt: string; quantityRedeemed?: number }[];
+  usages?: { id: string; scannedAt: string; quantityRedeemed?: number; sessionId?: string | null }[];
 };
 
 export type Payment = {