Chobble Tickets

decryptedPasswordHash: string

dataKey: CryptoKey,

Activate a user by wrapping the data key with their KEK

addDays(

dateStr: string,

days: number

Add days to a YYYY-MM-DD date string

addEventLink(

booking: EventBooking

Add a new event link for an existing attendee with atomic capacity check. Does NOT create a new attendee or touch PII — just inserts an event_attendees row.

addPendingWork(p: Promise<unknown>): void

Queue a promise that must complete before the response is sent

addQueryLogEntry(

durationMs: number

Record a query (no-op when logging is disabled)

aesGcmDecryptRaw(

iv: Uint8Array,

ciphertext: Uint8Array,

AES-GCM decrypt raw data, returning the decrypted ArrayBuffer

aesGcmEncryptRaw(

data: BufferSource,

): Promise<{ iv: Uint8Array; ciphertext: Uint8Array; }>

AES-GCM encrypt raw data, returning IV and ciphertext bytes

appendIframeParam(url: string): string

Append iframe=true query param to a URL when in iframe mode

applyDemoOverrides(

form: FormParams,

acquire: () => R | Promise<R>,

): FormParams

Replace form field values with demo data when demo mode is active. Only replaces fields that are present and non-empty in the form. Mutates and returns the same URLSearchParams for chaining.

Assign events to a group by updating their group_id.

asString(value: unknown): string

Narrow an unknown value to string, defaulting to "" if not a string. Replaces typeof x === "string" ? x : "" at type boundaries.

base64ToBase64Url(b64: string): string

Convert standard base64 to base64url (no padding). Works on both strings and Uint8Array (bytes are first encoded to base64).

bracket<R>(

release: (r: R) => void | Promise<void>

Resource management pattern (like Haskell's bracket or try-with-resources). Ensures cleanup happens even if the operation throws.

buildAttendeeInsert(enc: EncryptedAttendeeData)

Build an INSERT statement for the attendees table from encrypted fields.

buildCapacityCheckedInsert(

booking: EventBooking,

attendeeIdExpr?: string,

attendeeIdArg?: number

buildInputKeyMap(columns: string[]): Record<string, string>

Build a capacity-checked INSERT into event_attendees.

buildCheckinUrl(token: string): string

Build the check-in URL for a single ticket token

buildEmbedSnippets(url: string): EmbedSnippets

Build embed snippets (script and iframe variants) for a ticket URL

buildFlashCookie(

Build a flash cookie containing a success or error message, keyed by ID

buildFrameAncestors(hosts: string[]): string | null

Build a frame-ancestors CSP value from allowed embed hosts. Returns null if the list is empty (allow embedding from anywhere).

buildInfoLines(data: SvgTicketData): string[]

Build info lines from ticket data (non-PII event and booking details)

Build input key mapping from DB columns snake_case DB column → camelCase input key

buildItemsMetadata(intent: CheckoutIntent): Record<string, string>

Build checkout metadata from a CheckoutIntent (converts items to compact form).

buildMetadata(intent: MetadataInput): Record<string, string>

Build checkout session metadata from booking data (items already compact).

buildPiiBlob(info: ContactInfo & { payment_id: string; ticket_token: string; }): string

Build a PII blob JSON from contact fields

buildPkpass(

Build a complete .pkpass file as a Uint8Array (ZIP archive)

buildSessionCookie(

options?: { maxAge?: number; }

buildSubdomainRecordName(subdomain: string): string

Build the full subdomain record name (user choice + suffix). e.g. "myevent" + ".tickets" → "myevent.tickets"

buildSvgTicketData(

entry: EmailEntry,

): SvgTicketData

Build SVG ticket data from an email entry (non-PII only)

buildTemplateData(

currency: string,

ticketUrl: string

): TemplateData

Build the data object exposed to Liquid templates

buildTicketAttachments(

): Promise<EmailAttachment[]>

Generate SVG ticket attachments for all entries

buildTicketUrl(entries: TokenEntry[]): string

buildWebhookPayload(

items: BatchAvailabilityItem[],

): WebhookPayload

Build a consolidated webhook payload from registration entries

checkBatchAvailability(

checkCapacityResult(result: { rowsAffected: number; }): UpdateEventLinkResult

Wrapper for test mocking - delegates to attendeesApi at runtime

Check a capacity-guarded write result and invalidate cache on success

checkSubdomainAvailable(subdomain: string)

Check whether a bunny subdomain is available.

chunk(size: number)

Split an array into chunks of a given size

clearFlashCookie(id: string): string

Clear a keyed flash cookie (set after reading)

clearLoginAttempts(ip: string): Promise<void>

Clear login attempts for an IP (on successful login)

clearSessionCookie(): string

clearSessionTokens(sessionId: string): Promise<void>

Clear stored ticket tokens for a session (after redirect has consumed them)

collectionCache<T>(

fetchAll: () => Promise<T[]>,

): CollectionCache<T>

Create an in-memory collection cache with TTL. Loads all items via fetchAll on first access or after invalidation/expiry, then serves from memory until the TTL expires or invalidate() is called. Accepts an optional clock function for testing.

compact<T>(array: (T | null | undefined)[]): T[]

Remove null and undefined values from array

computeGroupSlugIndex(slug: string): Promise<string>

Compute slug index from slug for blind index lookup

computeHmacSha256(

secret: string

computeTicketTokenIndex(token: string): Promise<string>

Compute HMAC-SHA256 using Web Crypto API, returning raw ArrayBuffer

computeSlugIndex(slug: string): Promise<string>

Compute slug index from slug for blind index lookup

Compute ticket token index using HMAC for blind lookups Similar to slug_index for events - allows lookup without decrypting

constantTimeEqual(

createAttendeeAtomic(input: AttendeeInput): Promise<CreateAttendeeResult>

Constant-time string comparison to prevent timing attacks Always iterates over the longer string and XORs the lengths so that different-length inputs don't leak via an early return.

contactFields(unnamed 0: ContactInfo): ContactInfo

Extract ContactInfo fields from an object

Wrapper for test mocking - delegates to attendeesApi at runtime

createInvitedUser(

adminLevel: AdminLevel,

inviteCodeHash: string,

inviteExpiry: string

createManifest(files: Record<string, Uint8Array>): string

Create an invited user (no password yet, has invite code)

Create manifest.json mapping filenames to SHA-1 hashes

createRequestTimer(): (() => number)

Create a request timer for measuring duration

createSeeds(

eventCount: number,

attendeesPerEvent: number

): Promise<SeedResult>

Create seed events and attendees using efficient batch writes. Encrypts all data before inserting, matching production behavior. Assigns random ticket quantities (1-4) per attendee without overselling.

createSession(

csrfToken: string,

expires: number,

userId: number

createTypeGuard<T extends string>(values: readonly T[])

Create a new session with CSRF token, wrapped data key, and user ID Token is hashed before storage for security

Create a type guard from a readonly array of string literal values

createUser(

passwordHash: string,

adminLevel: AdminLevel

createWithClient<Client>(getClient: () => Client | null | Promise<Client | null>)

Create a new user with encrypted fields

Create a withClient helper that runs an operation with a lazily-resolved client. Returns null if the client is not available or the operation fails.

dateToStartEnd(date: string | null): { startAt: string | null; endAt: string | null; }

Convert nullable date to start_at/end_at (null-safe wrapper around dateToRange)

daysAgo(utcIso: string): number | null

Compute how many days ago an event started, relative to today in the configured timezone. Returns null if the event date is today or in the future, or if the date is empty/invalid. For past events, returns a positive integer (1 = yesterday).

decodeKeyBytes(keyString: string): Uint8Array

decrypt(encrypted: string): Promise<string>

Decrypt a string value encrypted with encrypt() Expects format: enc:1:$base64iv:$base64ciphertext

decryptAdminLevel(user: User): Promise<AdminLevel>

Decrypt a user's admin level

decryptAttendeeFields(

row: Attendee,

): Promise<Attendee>

Decrypt attendee fields from the PII blob. Requires migration to be complete (admin is gated behind migration). When paidEvent is false, payment_id and refunded are skipped.

decryptAttendeeOrNull(

row: Attendee | null,

Decrypt a single raw attendee, handling null input. Used when attendee is fetched via batch query.

decryptAttendeePII(

Decrypt attendee PII using the private key Used in admin views after obtaining private key from session

decryptAttendees(

rows: Attendee[],

decryptBytes(encrypted: Uint8Array): Promise<Uint8Array>

): Promise<Attendee[]>

Decrypt a list of raw attendees (all fields). Used when attendees are fetched via batch query.

Decrypt binary data encrypted with encryptBytes(). Expects ENCB binary format: magic + version + IV + ciphertext.

decryptPiiBlob(

{ name: string; email: string; phone: string; address: string; special_instructions: string; payment_id: string; ticket_token: string; }

paidEvent: boolean

): Promise<

Decrypt a PII blob and extract all contact fields

decryptSessionTokens(encryptedTokens: string): Promise<string>

Decrypt the ticket_tokens field from a processed payment record. Returns the plaintext token string (e.g. "tok1+tok2") or empty string.

decryptUsername(user: User): Promise<string>

Decrypt a user's username

decryptWithKey(

Decrypt data with a symmetric key

defineIdTable<Row, Input = Row>(

schema: TableSchema<Row>

defineTable<Row, Input = Row>(config: { name: string; primaryKey: keyof Row & string; schema: TableSchema<Row>; }): Table<Row, Input>

Helper for tables whose primary key column is id.

Define a table with CRUD operations

deleteAllEventStorageFiles(events: ReadonlyArray<EventWithStorage>): Promise<void>

Delete all storage files (images and attachments) for a list of events

deleteAllSessions(): Promise<void>

Delete all sessions (used when password is changed)

deleteAllStaleReservations(): Promise<number>

Delete all stale reservations (unfinalized and older than STALE_RESERVATION_MS). Called from admin event views to clean up abandoned checkouts.

deleteAttendee(attendeeId: number): Promise<void>

Delete an attendee and all its event links, payments, and answers.

deleteByField(

Delete rows matching a field value

deleteByFieldBatch(deletes: Array<{ table: string; field: string; value: InValue; }>): Promise<void>

Delete rows from multiple tables in a single batch transaction

deleteEvent(eventId: number): Promise<void>

Delete an event and all its attendees in a single database round-trip. Uses write batch to cascade: processed_payments → attendees → event. Reduces 3 sequential HTTP round-trips to 1.

deleteEventStorageFiles(

event: EventWithStorage,

reason: string

deleteOtherSessions(currentToken: string): Promise<void>

Delete the image and attachment files for a single event

deleteFile(filename: string): Promise<void>

Delete a file, routing to local or Bunny based on config.

Delete all sessions except the current one Token is hashed before database comparison

deleteSession(token: string): Promise<void>

Delete a session by token Token is hashed before database lookup

deleteStaleReservation(sessionId: string): Promise<void>

Delete a stale reservation to allow retry

deleteUser(userId: number): Promise<void>

Delete a user and all their sessions and API keys

deployScriptCode(code: string): Promise<BunnyApiResult>

Upload and publish new script code to Bunny CDN.

deriveKEK(passwordHash: string): Promise<CryptoKey>

Derive a Key Encryption Key (KEK) from password hash and DB_ENCRYPTION_KEY Uses PBKDF2 with the password hash as input and DB_ENCRYPTION_KEY as salt

detectIframeMode(url: string): void

Detect iframe mode from a request URL and store it for the current request

detectImageType(data: Uint8Array): string | null

Detect the actual image type from magic bytes. Returns the MIME type if matched, null otherwise.

downloadImage(filename: string): Promise<Uint8Array | null>

Download and decrypt a file. Returns the decrypted bytes, or null if the file does not exist.

downloadRaw(filename: string): Promise<Uint8Array | null>

Download raw bytes from storage. Returns null if the file does not exist.

enableQueryLog(): void

Enable query logging and clear previous entries

encrypt(plaintext: string): Promise<string>

Encrypt a string value using AES-256-GCM via Web Crypto API Returns format: enc:1:$base64iv:$base64ciphertext Note: ciphertext includes auth tag appended (Web Crypto API does this automatically)

encryptAttendeeFields(input: EncryptInput): Promise<EncryptedAttendeeData | null>

Encrypt attendee fields into a PII blob, returning null if key not configured

encryptAttendeePII(

Encrypt attendee PII using the public key from settings This can be called without authentication (for public ticket forms)

encryptBytes(data: Uint8Array): Promise<Uint8Array>

Encrypt binary data with AES-256-GCM using compact binary format. Output: ENCB + version byte + 12-byte IV + ciphertext (with GCM auth tag). Overhead is only 33 bytes (vs ~76% bloat in the legacy text format).

Shared encrypted name column for tables that store a display name.

encryptPiiBlob(

blobJson: string,

Encrypt a PII blob JSON string with the public key

encryptWithKey(

metadata: Record<string, string>,

Encrypt data with a symmetric key (for wrapping private key with DATA_KEY)

enforceMetadataLimits(

maxValueLength: number

): Record<string, string>

Enforce metadata value length limits for a payment provider.

errorMessage(err: unknown): string

Extract a human-readable message from an unknown caught value

eventDateToCalendarDate(utcIso: string): string | null

Convert a UTC ISO datetime to a YYYY-MM-DD calendar date in the given timezone. Returns null if the input is empty or invalid. Used by the calendar view to map standard event dates to calendar days.

eventSupportsDirectCheckout(event: Pick<EventWithCount, "id" | "fields">): Promise<boolean>

Whether this event can send QR code scanners directly to checkout. True when no extra contact fields or questions are required.

executeBatch(statements: Array<{ sql: string; args: InValue[]; }>): Promise<void>

Execute multiple write statements, discarding results.

extractSessionMetadata(metadata: SessionMetadata): ValidatedPaymentSession["metadata"]

Normalize validated session metadata into the canonical SessionMetadata shape.

extractSvgContent(svg: string): string

Extract the inner content of an SVG element (strip the outer <svg> wrapper)

extractViewBox(svg: string): { width: number; height: number; }

Extract the viewBox from an SVG element to compute its coordinate space

filter<T>(predicate: (item: T) => boolean)

Curried filter

finalizeSession(

sessionId: string,

ticketTokens?: string[]

Finalize a reserved session with the created attendee ID (second phase)

flatMap<T, U>(fn: (item: T) => U[])

Curried flatMap

flushPendingWork(): Promise<void>

Await all queued work. Call before returning the response.

formatCurrency(minorUnits: number | string): string

Format an amount in minor units (pence/cents) as a currency string. e.g. formatCurrency(1050) → "£10.50" (when currency is GBP)

formatDateLabel(dateStr: string): string

Format a YYYY-MM-DD date for display. Returns "Monday 15 March 2026"

formatDatetimeInTz(

Format a UTC ISO datetime string for display in the given timezone. Returns e.g. "Monday 15 June 2026 at 14:00 BST"

formatDatetimeLabel(iso: string): string

Format an ISO datetime string for display in the given timezone. Returns e.g. "Monday 15 June 2026 at 14:00 BST"

formatDatetimeShort(iso: string): string

Compact ISO datetime formatter for table cells. Returns e.g. "07/04/2026 14:00" in the configured timezone.

formatDatetimeShortInTz(

Compact format for table cells: "yyyy-MM-dd HH:mm" in the given timezone. Delegates to the browser-compatible formatIsoForPreview helper so the same formatting runs on the server and in the admin JS bundle.

formatErrorMessage(context: ErrorContext): string

Format an error context into a human-readable activity log message

formatPrefixed(

...parts: Uint8Array[]

generateAttachmentFilename(originalName: string): string

Format IV + ciphertext as a prefixed base64 string

formatRequestError(

Format an error detail string with request context and error message

fromBase64(base64: string): Uint8Array

Convert base64 string to Uint8Array

Generate a random CDN filename preserving the original name for readability

generateDataKey(): Promise<CryptoKey>

Generate a random 256-bit symmetric key for data encryption

generateImageFilename(detectedType: string): string

Generate a random filename with the correct extension

generateKeyPair(): Promise<{ publicKey: string; privateKey: string; }>

Generate an RSA key pair for asymmetric encryption Returns { publicKey, privateKey } as exportable JWK strings

generatePassJson(

): Record<string, unknown>

Build the pass.json content from pass data and signing credentials

generateQrSvg(text: string): string

Generate an SVG string for a QR code encoding the given text. Returns a complete <svg> element suitable for inline embedding.

generateSecureToken(): string

Generate a cryptographically secure random token Uses Web Crypto API getRandomValues

generateSlug(): string

Generate a random slug with at least 2 digits and 2 letters. Uses Fisher-Yates shuffle on the fixed positions to avoid bias.

generateSvgTicket(data: SvgTicketData): Promise<string>

Generate a standalone SVG ticket with QR code and event/booking details. Returns a complete SVG document string.

generateTicketToken(): string

Generate a 5-byte uppercase hex ticket token for public ticket URLs

generateUniqueSlug(

computeIndex: (slug: string) => Promise<string>,

isTaken: (slug: string) => Promise<boolean>

): Promise<SlugWithIndex>

Generate a unique slug by retrying until one is not taken.

getActiveEventsByGroupId(groupId: number): Promise<EventWithCount[]>

Get active events in a group with attendee counts.

getActiveEventStats(events: EventWithCount[]): Promise<ActiveEventStats>

Get aggregated statistics for active events. Filters active events from the provided list, computes attendees (sum of quantities) from cached EventWithCount data, and queries ticket count and income (sum of price_paid) via a single aggregate.

getActiveHolidays(): Promise<Holiday[]>

Get active holidays (end_date >= today) for date computation (from cache). "today" is computed in the configured timezone.

getActivePaymentProvider(): Promise<PaymentProvider | null>

Resolve the active payment provider based on admin settings. Lazy-loads the provider module to avoid importing unused SDKs. Returns null if no provider is configured.

getAllActivityLog(limit?: number): Promise<ActivityLogEntry[]>

Get all activity log entries (most recent first)

getAllCacheStats(): CacheStat[]

Collect stats from all registered caches

getAllDailyEvents(): Promise<EventWithCount[]>

Get all daily events with attendee counts (from cache).

getAllEvents(): Promise<EventWithCount[]>

Get all events with attendee counts (from cache)

getAllGroups(): Promise<Group[]>

Get all groups, decrypted, ordered by id (from cache)

getAllHolidays(): Promise<Holiday[]>

Get all holidays, decrypted, ordered by start_date (from cache)

getAllSessions(): Promise<Session[]>

Get all sessions ordered by expiration (newest first)

getAllStandardEvents(): Promise<EventWithCount[]>

Get all standard events with attendee counts (from cache). Used by the calendar view to include one-time events on their scheduled date.

getAllUsers(): Promise<User[]>

Get all users (for admin user management page, from cache)

getAttendee(

id: number,

getAttendeesByEventIds(eventIds: number[]): Promise<Attendee[]>

Get an attendee by ID (decrypted) Requires private key for decryption - only available to authenticated sessions

getAttendeeRaw(id: number): Promise<Attendee | null>

Get an attendee by ID without decrypting PII Used for payment callbacks and webhooks where decryption is not needed Returns the attendee with encrypted fields (id, event_id, quantity are plaintext)

Get raw attendees for a set of event IDs. Used by the calendar to load attendees for standard events whose decrypted date matches the selected calendar date.

getAttendeesByTokens(tokens: string[]): Promise<(AttendeeWithBookings | null)[]>

Look up attendees by plaintext tokens, returning full booking data. Two queries: attendees by token index, then all event_attendees for those attendees. Returns results in the same order as input tokens (deduped). Bookings sorted by start_at then event_id for deterministic ordering.

getAttendeesRaw(eventId: number): Promise<Attendee[]>

Get attendees for an event without decrypting PII Used for tests and operations that don't need decrypted data

getAvailableDates(

event: Event,

getDailyEventAttendeesByDate(date: string): Promise<Attendee[]>

): string[]

Compute available booking dates for a daily event. Filters by bookable days of the week and excludes holidays. Returns sorted array of YYYY-MM-DD strings.

getBookingFee(): number

Get booking fee percentage from database. Returns 0 if not set.

getBunnyApiKey(): string

Get the Bunny CDN API key from environment

getBunnyDnsSubdomainSuffix(): string

Get the Bunny DNS subdomain suffix (e.g. ".tickets") from environment

getBunnyDnsZoneId(): string

Get the Bunny DNS zone ID from environment

getBunnyScriptId(): string

Get the Bunny Edge Script ID from environment

getCachedSession(): AuthSession | null | undefined

Return the cached session if already resolved, or undefined if not yet resolved

getCdnHostname(): Promise<CdnHostnameResult>

Get CDN hostname (delegates to bunnyCdnApi for testability).

getCurrentCsrfToken(): string

Get the most recently generated CSRF token (for synchronous JSX rendering)

getDailyEventAttendeeDates(): Promise<string[]>

Get distinct attendee dates for daily events. Used for the calendar date picker (lightweight, no attendee data).

Get raw attendees for daily events on a specific date. Bounded query: only returns attendees matching the given date.

getDateAttendeeCount(

date: string

Get the total attendee quantity for a specific event + date

getDb(): Client

Get or create database client

getDecimalPlaces(currencyCode: string): number

Get the number of decimal places for a currency code

getEffectiveDomain(): string

Get the effective domain synchronously (must call loadEffectiveDomain first).

getEmailConfig(): EmailConfig | null

Read email config from DB settings. Falls back to business email for fromAddress. Returns null if not configured.

getEmbedHosts(): Promise<string[]>

Get allowed embed hosts from database (encrypted, parsed to array) Returns empty array if not configured (embedding allowed from anywhere)

getEncryptionKeyString(): string

Get the encryption key bytes from environment variable (sync validation only) Expects DB_ENCRYPTION_KEY to be a base64-encoded 256-bit (32 byte) key

getEnv(key: string): string | undefined

Get an environment variable value Checks process.env first (Bunny Edge), falls back to Deno.env (local dev)

getEvent(id: number): Promise<Event | null>

Get a single event by ID (from cache)

getEventActivityLog(

): Promise<ActivityLogEntry[]>

Get activity log entries for an event (most recent first)

getEventsByGroupId(groupId: number): Promise<EventWithCount[]>

Get all events in a group with attendee counts (including inactive).

getEventsBySlugsBatch(slugs: string[]): Promise<(EventWithCount | null)[]>

Get multiple events by slugs (from cache). Returns events in the same order as the input slugs. Missing or inactive events are returned as null.

getEventWithActivityLog(

): Promise<EventWithActivityLog | null>

Get event and its activity log in a single database round-trip. Uses batch API to reduce latency for remote databases.

getEventWithAttendeeRaw(

): Promise<EventWithAttendeeRaw | null>

attendeeId: number

Get event and a single attendee in a single database round-trip. Used for attendee management pages where we need both the event context and the specific attendee data.

getEventWithAttendeesRaw(id: number): Promise<EventWithAttendees | null>

Get event and all attendees in a single database round-trip. Uses batch API to execute both queries together, reducing latency for remote databases like Turso from 2 RTTs to 1. Computes attendee_count from the attendees array.

getEventWithCount(id: number): Promise<EventWithCount | null>

Get event with attendee count (from cache)

getEventWithCountBySlug(slug: string): Promise<EventWithCount | null>

Get event with attendee count by slug (from cache)

getGroupBySlugIndex(slugIndex: string): Promise<Group | null>

Get a single group by slug_index (from cache)

getGroupRemainingByEventId(

events: EventForGroupLookup[],

Per-event view of group remaining capacity. Daily events are dropped when date is null — their cap is per-date, so a cumulative count would misreport spots that other dates still have.

getGroupRemainingByGroupId(

groupIds: number[],

event: EventForGroupLookup,

Per-group remaining capacity. Groups with max_attendees <= 0 (no cap) are omitted from the map. With date = null, daily-event attendees count cumulatively — correct for booking-time enforcement after upstream date validation, misleading for display.

getGroupRemainingForEvent(

getMimeTypeFromFilename(filename: string): string | null

Returns undefined when no group cap applies: ungrouped, uncapped group, or daily event without a date.

getHostEmailConfig(): EmailConfig | null

Get host-level email config. Uses test override if set, otherwise reads env vars.

getIframeMode(): boolean

Get the current request's iframe mode

getImageProxyUrl(filename: string): string

Get the proxy URL path for serving a decrypted image. Images are encrypted on CDN, so they must be served through the proxy.

Get the MIME type for an image filename from its extension.

getNewestAttendeesRaw(limit: number): Promise<Attendee[]>

Get the newest attendees across all events without decrypting PII. Used for the admin dashboard to show recent registrations.

Get the next available booking date for a daily event. More efficient than getAvailableDates()[0] — stops at first match. Returns null if no bookable dates are available.

getPbkdf2Iterations(): number

getPrivateKeyFromSession(

sessionToken: string,

wrappedDataKey: string,

wrappedPrivateKey: string

getProcessedAttendeeId(sessionId: string): Promise<number | null>

Derive the private key from session credentials Used to decrypt attendee PII in admin views Results are cached per session token for 10 seconds

Get the attendee ID for an already-processed session Used to return success for idempotent webhook retries

getQueryLog(): QueryLogEntry[]

Return a snapshot of all logged queries

getQueryLogStartTime(): number

Return the start time recorded by enableQueryLog()

getRandomBytes(length: number): Uint8Array

Generate random bytes using Web Crypto API

getRequestId(): string

Get the current request ID, or empty string if outside request context

getSession(token: string): Promise<Session | null>

Get a session by token (with 10s TTL cache) Token is hashed for database lookup

getSessionCookieName(): string

getStorageBackend(): "bunny" | "local" | "none"

Returns which storage backend is active: "bunny", "local", or "none".

getUngroupedEvents(): Promise<EventWithCount[]>

Get ungrouped events (group_id = 0) with attendee counts.

getUserById(id: number): Promise<User | null>

Get a user by ID (from cache)

getUserByInviteCode(inviteCode: string): Promise<User | null>

Find a user by invite code hash Scans all users, decrypts invite_code_hash, and compares

getUserByUsername(username: string): Promise<User | null>

Look up a user by username (using blind index, from cache)

hasAvailableSpots(...args: Parameters<attendeesApi.hasAvailableSpots>): Promise<boolean>

Wrapper for test mocking - delegates to attendeesApi at runtime

hashInviteCode(code: string): Promise<string>

Hash an invite code using SHA-256

hashPassword(password: string): Promise<string>

Hash a password using PBKDF2 Returns format: pbkdf2:iterations:$base64salt:$base64hash

hashSessionToken(token: string): Promise<string>

Hash a session token using SHA-256 Used to store session lookups without exposing the actual token

hasPassword(user: User): Promise<boolean>

Check if a user has set their password (password_hash is non-empty encrypted value)

hasPendingWorkScope(): boolean

True when running inside a runWithPendingWork scope (i.e. a request).

hasRequiredSessionMetadata(metadata: Record<string, string | undefined> | null | undefined): metadata is SessionMetadata

Validate that session metadata contains required fields (name + items).

hmacHash(value: string): Promise<string>

HMAC-SHA256 hash using DB_ENCRYPTION_KEY Used for blind indexes and hashing limited keyspace values Returns deterministic output for same input (unlike encrypt)

hmacToBase64(buf: ArrayBuffer): string

Convert ArrayBuffer to base64 string

hmacToHex(buf: ArrayBuffer): string

Convert ArrayBuffer to hex string

hybridDecrypt(

Decrypt data using hybrid encryption Expects format: hyb:1:$base64WrappedKey:$base64iv:$base64ciphertext Results are cached in a bounded LRU (ciphertext -> plaintext)

hybridEncrypt(

publicKey: CryptoKey

Encrypt data using hybrid encryption (RSA + AES)

idAndEncryptedSlugSchema(

encrypt: EncryptFn,

decrypt: DecryptFn

algorithm: Parameters<SubtleCrypto["importKey"]>[2],

Shared columns for tables with encrypted slug + blind-index slug_index.

importHmacKey(): Promise<CryptoKey>

importKey(

usages: KeyUsage[]

importPrivateKey(jwkString: string): Promise<CryptoKey>

Import a CryptoKey from DB_ENCRYPTION_KEY.

Import a private key from JWK string

importPublicKey(jwkString: string): Promise<CryptoKey>

Import a public key from JWK string

incrementAttachmentDownloads(

values: Record<string, InValue | RawSql>

Increment the attachment download counter for an attendee. Uses atomic SQL increment to avoid race conditions.

initDb(): Promise<void>

Initialize database tables — idempotent, safe to call on every startup. Uses an advisory lock to prevent concurrent migrations.

inPlaceholders(values: readonly unknown[]): string

Build SQL placeholders for an IN clause, e.g. "?, ?, ?"

insert(

table: string,

Build an INSERT statement from a table name and column→value record.

invalidateEventsCache(): void

Invalidate the events cache (for testing or after writes).

invalidateGroupsCache(): void

Invalidate the groups cache (for testing or after writes).

invalidateHolidaysCache(): void

Invalidate the holidays cache (for testing or after writes).

invalidateUsersCache(): void

Invalidate the users cache (for testing or after writes).

isBunnyCdnEnabled(): boolean

Check if Bunny CDN pull zone management is enabled Requires both BUNNY_API_KEY and BUNNY_SCRIPT_ID to be set

isBunnyDnsEnabled(): boolean

Check if Bunny DNS subdomain feature is enabled. Requires BUNNY_API_KEY and BUNNY_DNS_ZONE_ID to be set.

isDemoMode(): boolean

Check if demo mode is enabled

isEmailProvider(value: string): value is EmailProvider

Type guard: checks if a string is a valid EmailProvider

isGroupSlugTaken(

excludeGroupId?: number

isPaidEvent(event: Pick<Event, "unit_price" | "can_pay_more">): boolean

Check if a group slug is already in use. Checks both events and groups for cross-table uniqueness.

isInviteExpired(user: User): Promise<boolean>

Check if a user's invite has expired. Callers should skip this for users who have already set a password.

isInviteValid(user: User): Promise<boolean>

Check if a user's invite is still valid (not expired, has invite code)

isLoginRateLimited(ip: string): Promise<boolean>

Check if IP is rate limited for login

isMaskSentinel(value: string): boolean

Whether an event can accept payments (has a price or allows pay-what-you-want)

isPaymentsEnabled(): boolean

Check if payments are enabled (any provider configured with valid keys)

isPaymentStatus(s: string): s is PaymentStatus

Type guard: check if a string is a valid PaymentStatus

isQueryLogEnabled(): boolean

Whether query logging is currently active

isReadOnly(): boolean

Check if the system is in read-only mode (READ_ONLY env var)

isReservationStale(processedAt: string): boolean

Check if a reservation is stale (abandoned by a crashed process)

isSecureMode(): boolean

isSessionProcessed(sessionId: string): Promise<ProcessedPayment | null>

Check if a payment session has already been processed

isSignedCsrfToken(token: string): boolean

Check whether a token uses the signed format

isSlugTaken(

lazyRef<T>(fn: () => T): [() => T, (value: T | null) => void]

Check if a slug is already in use (optionally excluding a specific event ID) Uses slug_index for lookup (blind index)

isStorageEnabled(): boolean

Check if image storage is enabled (Bunny CDN or local filesystem).

isUsernameTaken(username: string): Promise<boolean>

Check if a username is already taken

isValidBusinessEmail(email: string): boolean

Validates a basic email format: something@something.something

isValidDatetime(value: string): boolean

Check if a naive datetime-local string is a parseable datetime. Does not interpret timezone — purely a format check.

isValidPemCertificate(pem: string): boolean

Validate that a string is a parseable PEM certificate

isValidPemPrivateKey(pem: string): boolean

Validate that a string is a parseable PEM private key

isValidTimezone(tz: string): boolean

Validate that a string is a valid IANA timezone identifier.

Resettable lazy reference - like once() but can be reset for testing. Returns [get, set] tuple where set(null) resets to uncomputed state.

listFiles(prefix: string): Promise<string[]>

List files in storage matching a prefix

loadEffectiveDomain(requestUrl: string): string

Load the effective domain from DB, falling back to the request URL hostname.

loadSortedEvents(predicate: (e: EventWithCount) => boolean): Promise<{ events: EventWithCount[]; holidays: Holiday[]; }>

Load all events with holidays and return them sorted, filtered by predicate.

localToUtc(

naive: string,

): Promise<ActivityLogEntry>

Convert a naive datetime-local value (YYYY-MM-DDTHH:MM) to a UTC ISO string, interpreting the value as local time in the given timezone.

logActivity(

message: string,

event?: EventRef | null

Log an activity

logAndNotifyRegistration(entries: EmailEntry[]): Promise<void>

Log attendee registration and send consolidated webhook Used for single-event registrations

logDebug(

category: LogCategory,

message: string

Log a debug message with category prefix For detailed debugging during development

logError(context: ErrorContext): void

Log a classified error to console.error and persist to the activity log. Console output uses error codes and safe metadata (never PII). Activity log entry is encrypted and visible to admins on the log pages.

logErrorLocal(context: ErrorContext): void

Log a classified error to console.error only (no ntfy, no activity log). Use this where calling logError would cause infinite recursion (e.g. ntfy.ts).

logRequest(entry: RequestLogEntry): void

Log a completed request to console.debug Path is automatically redacted for privacy

map<T, U>(fn: (item: T) => U)

Curried map

mapParallel<T, U>(fn: (item: T) => Promise<U>)

Map over a promise-returning function in parallel (Promise.all)

markRefunded(

mergeEventFields(fieldSettings: EventFields[]): EventFields

Mark an attendee as refunded for a specific event. Keeps payment_id intact so payment details can still be viewed.

Determine which contact fields to collect for multiple events. Returns the union of all field settings, sorted by canonical CONTACT_FIELDS order.

normalizeBusinessEmail(email: string): string

Normalizes email: trim and lowercase

normalizeDatetime(

value: string,

Normalize datetime-local "YYYY-MM-DDTHH:MM" to full UTC ISO string. The input is interpreted as local time in the given timezone and converted to UTC.

normalizePhone(

phone: string,

prefix: string

Strip non-numeric characters from a phone number and normalize to +{prefix}{local}

normalizeSlug(input: string): string

Normalize a user-provided slug: trim, lowercase, replace spaces with hyphens

now(): Date

Current time as a Date

nowIso(): string

Full ISO-8601 timestamp for created/logged_at fields

nowMs(): number

Epoch milliseconds for numeric comparisons

once<T>(fn: () => T): (() => T)

Lazy evaluation - compute once on first call, cache forever. Use instead of let x = null; const getX = () => x ??= compute();

onEncryptionKeyChange(cb: () => void): void

padAuthToken(serial: string): string

Pad a serial number to meet Apple's minimum authenticationToken length. Uses "-" (not in uppercase hex charset) so padding is cleanly reversible.

parseEmbedHosts(input: string): string[]

Parse a comma-separated list of hosts into trimmed, lowercased entries. Filters out empty strings from trailing commas etc.

parseEncryptedPayload(

): { iv: Uint8Array; ciphertext: Uint8Array; }

Parse a prefixed encrypted payload into IV and ciphertext bytes. Validates the prefix and separator; throws on invalid format.

parseEventFields(fields: EventFields): ContactField[]

Parse a comma-separated fields string into individual ContactField names

parseFlashValue(value: string): { success?: string; error?: string; result?: string; }

Parse a flash cookie value into type, message, and optional result

parsePiiBlob(json: string): PiiBlob

Parse a PII blob JSON back into contact fields (defaults v to 1 for pre-versioned blobs)

pipe(...fns: Array<(arg: unknown) => unknown>): (value: unknown) => unknown

2 overloads

Compose functions left-to-right (pipe) Uses recursive conditional types for arbitrary-length type safety.

processBooking(

event: EventWithCount,

contact: ContactInfo,

quantity: number,

date: string | null,

baseUrl: string,

customUnitPrice?: number,

): Promise<BookingResult>

Process a single-event booking.

queryAll<T>(

queryAndMap<Row, Out>(toOut: (row: Row) => Promise<Out>)

args?: InValue[]

): Promise<T[]>

Query all rows, returning a typed array

Execute a SQL query and map result rows through an async transformer.

queryOne<T>(

args: InValue[]

Query single row, returning null if not found

randomChoice<T>(arr: readonly T[]): T

Pick a random element from an array

rawSql(expr: string): RawSql

Embed a raw SQL expression (e.g. last_insert_rowid())

recordFailedLogin(ip: string): Promise<boolean>

Record a failed login attempt Returns true if the account is now locked

redactPath(path: string): string

Redact dynamic segments from paths for privacy-safe logging Replaces:

reduce<T, U>(

Curried reduce

registerBunnySubdomain(subdomain: string)

registerCache(provider: CacheStatProvider): void

renderEmailContent(

): Promise<EmailContent>

Render all 3 parts (subject, html, text) using custom templates with fallback to defaults

renderMarkdown(text: string): string

Render markdown to HTML (block-level: paragraphs, lists, etc.). Raw HTML is escaped.

renderTemplate(

reserveSession(sessionId: string): Promise<ReserveSessionResult>

Render a single Liquid template string with the given data

requireEnv(key: string): string

Get a required environment variable, throwing if not set. Use this instead of getEnv(key) as string when the variable must exist.

Reserve a payment session for processing (first phase of two-phase lock) Inserts with NULL attendee_id to claim the session. Returns { reserved: true } if we claimed it, or { reserved: false, existing } if already claimed.

resetCacheRegistry(): void

Reset the registry (for testing)

resetDatabase(): Promise<void>

Reset the database by dropping all tables (reverse order for FK safety)

resetDemoMode(): void

Reset cached demo mode value (for testing and cache invalidation)

resetEffectiveDomain(): void

Reset effective domain cache (for testing).

resetEngine(): void

For testing: reset the engine (so filters can be re-registered after currency changes)

resetGroupEvents(groupId: number): Promise<void>

Reset group assignment on all events in a group.

resetHostEmailConfig(): void

For testing: reset host email config to read from env vars.

resetSessionCache(): void

Clear session cache (exported for testing)

resultRows<T>(result: ResultSet): T[]

Cast libsql ResultSet rows to a typed array (single centralized assertion)

runWithPendingWork<T>(fn: () => T): T

Run a function within a pending-work scope

runWithQueryLogContext<T>(fn: () => T): T

runWithRequestId<T>(fn: () => T): T

Run a function with a request-scoped random ID for log correlation

runWithSessionContext<T>(fn: () => T): T

Run a function within a session-memoization scope

runWithStorageConfig<T>(

config: StorageConfig,

fn: () => T

): T

Run fn with an isolated storage configuration (test-only).

safeAsync<T>(

fn: () => Promise<T>,

errorCode: ErrorCodeType

Safely execute async operation, returning null on error. Re-throws PaymentUserError so user-facing messages propagate.

secureCompare(

Constant-time string comparison to prevent timing attacks

sendEmail(

config: EmailConfig,

msg: EmailMessage

Send a single email via the configured provider. Logs errors, never throws. Returns HTTP status or undefined on non-HTTP errors.

sendNtfyError(code: string): Promise<void>

Send an error notification to the configured ntfy URL Returns a promise so callers can await delivery if needed. Delivery failures are logged locally (via logErrorLocal) but never throw.

sendRegistrationEmails(

Send registration confirmation + admin notification emails. Entries is an array because one registration can cover multiple events. Silently skips if email is not configured. Attaches one SVG ticket per entry to the confirmation email.

sendRegistrationWebhooks(

Send consolidated webhook to all unique webhook URLs for the given entries

sendTestEmail(

config: EmailConfig,

to: string

Send a test email to the business email address. Returns HTTP status or undefined on non-HTTP errors.

sendWebhook(

webhookUrl: string,

payload: WebhookPayload,

eventId?: number

Send a webhook payload to a URL Fires and forgets - errors are logged but don't block registration

setCachedSession(session: AuthSession | null): void

Store the resolved session in the current request scope

setDb(client: Client | null): void

Set database client (for testing)

setDemoModeForTest(enabled: boolean): void

Explicitly set demo mode on or off (for testing). Bypasses Deno.env to avoid races between parallel test workers.

setEffectiveDomainForTest(domain: string): void

Set effective domain directly (for testing).

setEncryptionKeyForTest(key: string | null): void

Explicitly set or clear the encryption key for testing. Bypasses Deno.env to avoid races between parallel test workers. Automatically clears all crypto caches (encryption, HMAC, and any registered via onEncryptionKeyChange).

setFastPbkdf2ForTest(fast: boolean | null): void

Explicitly enable/disable fast PBKDF2 for testing without env var races

setGroupEventsActive(

active: boolean

setHostEmailConfigForTest(config: EmailConfig | null): void

Set the active flag on every event in a group. Returns the number of events affected.

For testing: set host email config directly. Bypasses env vars to avoid races.

setRsaKeySizeForTest(size: number | null): void

Explicitly set RSA key size for testing without env var races

setSuppressDebugLogs(value: boolean | null): void

Set module-level debug log suppression (avoids env race in parallel tests).

setSuppressRequestLogs(value: boolean | null): void

Set module-level request log suppression (avoids env race in parallel tests).

setUserPassword(

Set a user's password (for invite flow)

sha1Hex(data: Uint8Array): string

Compute SHA-1 hex digest of a Uint8Array

signCsrfToken(): Promise<string>

Create a signed CSRF token: s1.{timestamp}.{nonce}.{hmac}

signManifest(

manifestData: string,

signingCertPem: string,

signingKeyPem: string,

wwdrCertPem: string

Sign the manifest with PKCS#7 detached signature

singleEventAnswerIds(

): Record<string, number[]> | undefined

Convert single-event answerIds to the per-event format used in metadata

sort<T>(comparator: (

a: T,

b: T

) => number)

Non-mutating sort with comparator

sortEvents<T extends Event>(

events: T[],

): T[]

Sort events in unified 3-tier order. Works with any Event subtype (Event, EventWithCount, etc.).

startOfHour(date: Date): Date

Round a date down to the start of the current hour for cache-stable signatures

symmetricDecrypt(

Decrypt a prefixed AES-GCM payload with the given key.

symmetricEncrypt(

toBookingItems(items: CheckoutIntent["items"]): BookingItem[]

Encrypt plaintext with an AES-GCM key, returning prefixed format: enc:1:$base64iv:$base64ciphertext

toBase64(bytes: Uint8Array): string

Convert Uint8Array to base64 string

Convert registration line items to compact booking items

toCamelCase(s: string): string

Convert snake_case to camelCase

toCheckoutResult(

sessionId: string | undefined,

url: string | undefined | null,

label: LogCategory

): CheckoutSessionResult

Convert a provider-specific checkout result to a CheckoutSessionResult. Returns null if session ID or URL is missing.

todayInTz(tz: string): string

Get today's date as YYYY-MM-DD in the given timezone.

toMajorUnits(minorUnits: number): string

Convert minor units to major units string for form display. e.g. toMajorUnits(1050) → "10.50" (for GBP)

toMinorUnits(majorUnits: number): number

Convert major units (decimal) to minor units (integer). e.g. toMinorUnits(10.50) → 1050 (for GBP)

toSnakeCase(s: string): string

Convert camelCase to snake_case

trackQuery<T>(

eventId: number | undefined,

fn: () => Promise<T>

): Promise<T>

Run an async DB operation and log it when tracking is active

trimAuthToken(authToken: string): string

Strip padding added by padAuthToken to recover the original serial number

tryDeleteFile(

filename: string,

detail: string

Try to delete a file from storage, logging errors on failure

ttlCache<K, V>(

): TtlCache<K, V>

Create a TTL (Time-To-Live) cache. Entries expire after ttlMs milliseconds. Accepts an optional clock function for testing.

unique<T>(array: T[]): T[]

Remove duplicate values (by reference/value equality)

uniqueBy<T>(fn: (item: T) => unknown)

Remove duplicates by a key function

unlinkAttendeeFromEvent(

): Promise<{ attendeeDeleted: boolean; }>

Remove a single event link for an attendee. If the attendee has no remaining event links, deletes the attendee entirely. Returns whether the attendee was fully deleted.

unwrapKey(

unwrappingKey: CryptoKey

Unwrap a symmetric key Expects format: wk:1:$base64iv:$base64wrapped

unwrapKeyWithToken(

Unwrap a key using a session token

updateAttendeePII(

input: UpdateAttendeePIIInput

Update an attendee's PII (name, email, phone, etc.) — shared across all event links. Caller must be authenticated admin (public key always exists after setup).

updateBusinessEmail(email: string): Promise<void>

Updates the business email in the database. Pass empty string to clear the business email. Email is encrypted at rest.

updateCheckedIn(

Update an attendee's checked_in status for a specific event. Caller must be authenticated admin (public key always exists after setup)

updateEventLink(

input: UpdateEventLinkInput

Update a single event link's quantity and date with atomic capacity check. Excludes this attendee's current row from the capacity calculation.

uploadAttachment(

Upload an attachment to Bunny storage. Encrypts the file bytes before uploading. Uses the provided filename (caller generates via generateAttachmentFilename). Returns the filename on success.

uploadImage(

detectedType: string

Upload an image to Bunny storage. Encrypts the image bytes before uploading. Returns the filename (without path) on success.

uploadRaw(

Upload raw bytes to storage, routing to local or Bunny based on config

utcToLocalInput(

validateAttachment(data: Uint8Array): AttachmentValidationResult

Convert a UTC ISO datetime string to a datetime-local input value (YYYY-MM-DDTHH:MM) in the given timezone. Used for pre-populating form inputs with timezone-adjusted values.

Validate an attachment file: check size only (any file type allowed).

validateCustomDomain(hostname: string): Promise<BunnyApiResult>

Validate a custom domain (delegates to bunnyCdnApi for testability).

validateEmbedHosts(input: string): string | null

Validate a comma-separated list of host patterns. Returns null if all valid, or the first error message.

validateEncryptionKey(): void

Validate encryption key is present and valid Call this on startup to fail fast if key is missing

validateGroupEventType(

eventType: EventType,

Validate that an event type is compatible with a group's existing events. Returns an error message if mismatched, null if OK. Pass excludeEventId to skip a specific event (for edit-self case).

validateHostPattern(host: string): string | null

Validate a single host pattern Returns null if valid, or an error message if invalid

validateImage(

contentType: string

): ImageValidationResult

Validate an image file: check MIME type, size, and magic bytes.

validatePrice(

Validate and convert a raw price string to minor units. Returns ok with 0 if raw is empty and minPrice is 0 (pay-what-you-want with no input). Returns error if raw is empty and minPrice > 0, or if parsed value is out of range.

validateSlug(slug: string): string | null

Validate a normalized slug. Returns error message or null.

validateTemplate(template: string): string | null

Validate a Liquid template by parsing it (no rendering). Returns null if valid, or an error message string if invalid.

verifyPassword(

password: string,

storedHash: string

Verify a password against a hash Uses constant-time comparison to prevent timing attacks

verifySignedCsrfToken(

maxAge?

Verify a signed CSRF token's signature and expiry

verifyUserPassword(

user: User,

table: Table<Row, Input>,

Verify a user's password (decrypt stored hash, then verify) Returns the decrypted password hash if valid (needed for KEK derivation)

withCacheInvalidation<Row, Input>(

invalidate: () => void

): Table<Row, Input>

Wrap a table so that insert, update, and deleteById automatically call an invalidation callback (e.g. cache invalidation). Eliminates the repeated spread-and-override pattern in groups/holidays/events.

withCheckoutError(op: () => Promise<CheckoutSessionResult>): Promise<CheckoutSessionResult>

Wrap a checkout operation, converting PaymentUserError to { error } result and swallowing unexpected errors as null. Used by both provider adapters.

withRequiredEmail(fields: EventFields): EventFields

Ensure "email" is included in an event fields setting

wrapKey(

wrappingKey: CryptoKey

Wrap a symmetric key with another key using AES-GCM Returns format: wk:1:$base64iv:$base64wrapped

wrapKeyWithToken(

wrapResourceForDemo<R, I, V extends FieldValues = FieldValues>(

Wrap a key using a session token (derives a wrapping key from the token)

resource: NamedResource<R, I, V>,

): NamedResource<R, I, V>

Wrap a named resource so create/update apply demo overrides to the form

writeClosesAt(v: string | null): Promise<string | null>

Encrypt closes_at for DB storage (null/empty → encrypted empty)

writeEventDate(v: string): Promise<string>

Encrypt event date for DB storage

Interfaces

ActivityLogEntry

Activity log entry

ApiKey

Attendee

Event

ActiveEventStats = { income: number; tickets: number; attendees: number; }

attendee_count: number

Group

Holiday

PaymentProvider

Payment provider interface.

checkoutCompletedEventType: string
The webhook event type name that indicates a completed checkout
createCheckoutSession(
intent: CheckoutIntent,
baseUrl: string
): Promise<CheckoutSessionResult>
Create a checkout session for one or more events. Returns a session ID and hosted checkout URL, or null on failure.
isPaymentRefunded(paymentReference: string): Promise<boolean>
Check if a payment has been refunded via the provider API. Used to refresh refund status from the edit attendee page.
refundPayment(paymentReference: string): Promise<boolean>
Refund a completed payment.
resolveWebhookSession(event: WebhookEvent): Promise<ValidatedPaymentSession | "skip" | null>
Resolve a validated session from a webhook event. Each provider knows how to extract/fetch session data from its own event structure, so the webhook handler stays provider-agnostic.
retrieveSession(sessionId: string): Promise<ValidatedPaymentSession | null>
Retrieve and validate a completed checkout session by ID. Returns the validated session or null if not found / invalid.
setupWebhookEndpoint(
secretKey: string,
webhookUrl: string,
existingEndpointId?: string | null
): Promise<WebhookSetupResult>
Set up a webhook endpoint for this provider. Some providers (e.g. Stripe) support programmatic creation.
type: PaymentProviderType
Provider identifier
verifyWebhookSignature(
payload: string,
signature: string,
webhookUrl: string,
payloadBytes: Uint8Array
): Promise<WebhookVerifyResult>
Verify a webhook request's signature and parse the event payload.

Session

Settings

Table

Table definition with CRUD operations

deleteById: (id: InValue) => Promise<void>
Delete a row by primary key
findAll: () => Promise<Row[]>
Find all rows
findById: (id: InValue) => Promise<Row | null>
Find a row by primary key
fromDb: (row: Row) => Promise<Row>
Transform a row from DB (apply read transforms)
inputKeyMap: Record<string, string>
insert: (input: Input) => Promise<Row>
Insert a new row, returns the created row
name: string
primaryKey: keyof Row & string
rowToInput: (
row: Row,
exclude?: readonly string[]
) => Partial<Input>
Build an Input object from an existing Row by copying the input-eligible columns and translating keys through inputKeyMap. Lets callers spread a row into a new insert without restating every field. Columns named in exclude are skipped — useful for auto-stamped fields like created.
schema: TableSchema<Row>
toDbValues: (input: Input | Partial<Input>) => Promise<Record<string, InValue>>
Transform input to DB values (apply write transforms and defaults)
update: (
id: InValue,
input: Partial<Input>
) => Promise<Row | null>
Update a row by primary key, returns updated row or null if not found

User

Type Aliases

Aggregated statistics for active events

ActivityLogInput = { eventId?: number | null; message: string; }

Activity log input for create

AdminEvent = Omit<EventWithCount, "slug_index">

Admin API event shape — all event fields except internal indices. Used by both admin JSON API and admin templates to ensure consistent field exposure. Snake_case keys match the DB schema.

AdminLevel = "owner" | "manager"

Admin role levels

AdminSession = { readonly adminLevel: AdminLevel; }

Session data needed by admin page templates

adminLevel: AdminLevel

AttachmentValidationError = "too_large"

Attachment validation error

AttachmentValidationResult =

{ valid: true; }
| { valid: false; error: AttachmentValidationError; }

Attachment validation result

AttendeeInput =

ContactFields
& { paymentId?: string; bookings: EventBooking[]; }

Input for creating an attendee atomically (one or more events)

AttendeeTableRow = { attendee: Attendee; eventId: number; eventName: string; }

A single row in the attendee table (attendee + parent event context)

AttendeeWithBookings = { id: number; created: string; ticket_token: string; ticket_token_index: string; pii_blob: string; bookings: EventAttendeeRow[]; }

An attendee with all their event bookings (for token resolution)

bookings: EventAttendeeRow[]
Per-event bookings, sorted by start_at then event_id
created: string
id: number
Base attendee fields (PII, token, created — shared across events)
pii_blob: string
ticket_token: string
ticket_token_index: string

BatchAvailabilityItem = { eventId: number; quantity: number; }

Item for batch availability check

BookingIntent =

ContactInfo
& { date: string | null; items: BookingItem[]; eventAnswerIds?: Record<string, number[]>; }

Processed booking intent extracted from payment session metadata

BookingItem = { e: number; q: number; p: number; }

Compact booking item stored in session metadata (serialized/deserialized as JSON)

BookingResult =

{ type: "success"; attendee: Attendee; }
| { type: "checkout"; checkoutUrl: string; }
| { type: "sold_out"; }
| { type: "checkout_failed"; error?: string; }
| { type: "creation_failed"; reason: "capacity_exceeded" | "encryption_error"; }

Booking result — callers map this to their response format

CacheStat = { readonly name: string; readonly entries: number; readonly capacity?: number; }

A single cache's stats snapshot

CheckoutIntent =

ContactInfo
& { date: string | null; items: CheckoutItem[]; eventAnswerIds?: Record<string, number[]>; }

Registration intent for checkout (one or more events)

CheckoutItem = { eventId: number; quantity: number; unitPrice: number; slug: string; name: string; }

Single item within a checkout

CheckoutSessionResult =

{ sessionId: string; checkoutUrl: string; }
| { error: string; }
| null

Result of creating a checkout session.

CollectionCache<T> = { getAll: () => Promise<T[]>; invalidate: () => void; size: () => number; }

Collection cache returned by collectionCache()

ColumnDef<T = unknown> = { generated?: boolean; default?: () => T; write?: (v: T) => Promise<T> | T; read?: (v: T) => Promise<T> | T; }

Column definition for a table

default: () => T
Default value generator (for created timestamps etc)
generated: boolean
Whether this column is auto-generated (like id)
read: (v: T) => Promise<T> | T
Transform value after reading from DB (e.g., decrypt)
write: (v: T) => Promise<T> | T
Transform value before writing to DB (e.g., encrypt)

ContactField = "email" | "phone" | "address" | "special_instructions"

Individual contact field name

ContactFields =

Pick<ContactInfo, "name" | "email">
& Partial<

Pick<ContactInfo, "phone" | "address" | "special_instructions">

Required name+email with optional phone/address/special_instructions from ContactInfo

ContactInfo = { name: string; email: string; phone: string; address: string; special_instructions: string; }

Attendee contact details — the core PII fields collected at registration

CreateAttendeeResult =

{ success: true; attendees: Attendee[]; }
| { success: false; reason: "capacity_exceeded" | "encryption_error"; }

Result of atomic attendee creation

DemoFieldMap = Record<string, readonly string[]>

Maps form field names to arrays of possible demo values

EmailAttachment = { filename: string; content: string; contentType: string; }

A base64-encoded email attachment

EmailConfig = { provider: EmailProvider; apiKey: string; fromAddress: string; }

EmailEntry = { event: EmailEvent; attendee: WebhookAttendee; }

Attendee + event pair for email rendering

EmailEvent =

WebhookEvent
& { date: string; location: string; purchase_only: boolean; assign_built_site: boolean; }

Event data needed for registration pipeline (extends webhook event with display + assignment fields)

EmailMessage = { to: string; subject: string; html: string; text: string; replyTo?: string; attachments?: EmailAttachment[]; }

EmailProvider = keyof PROVIDERS

Union of all supported email provider keys, derived from the PROVIDERS map

EmailTemplateFormat = "subject" | "html" | "text"

Valid email template formats

EmailTemplateType = "confirmation" | "admin"

Valid email template types

EmbedSnippets = { script: string; iframe: string; }

ErrorCodeType = (ErrorCode)[keyof ErrorCode]

ErrorContext = { code: ErrorCodeType; eventId?: number; attendeeId?: number; detail?: string; }

Error log context (privacy-safe metadata only)

attendeeId: number
Optional: attendee ID
code: ErrorCodeType
Error code for classification
detail: string
Optional: additional safe context
eventId: number
Optional: event ID (not slug)

EventAttendeeRow = { event_id: number; start_at: string | null; end_at: string | null; quantity: number; checked_in: number; refunded: number; price_paid: number; attachment_downloads: number; }

Row from event_attendees — per-event booking data

EventBooking = { eventId: number; quantity?: number; pricePaid?: number; date?: string | null; }

A single event booking within a multi-event attendee creation

EventFields = string

Contact fields setting for an event (comma-separated ContactField names, or empty for name-only). Alias kept for documentation; runtime enforcement happens in parseEventFields.

EventInput = { name: string; description?: string; date?: string; location?: string; slug: string; slugIndex: string; groupId?: number; maxAttendees: number; thankYouUrl?: string; unitPrice?: number; maxQuantity?: number; webhookUrl?: string; active?: boolean; fields?: EventFields; closesAt?: string; eventType?: EventType; bookableDays?: string[]; minimumDaysBefore?: number; maximumDaysAfter?: number; imageUrl?: string; attachmentUrl?: string; attachmentName?: string; nonTransferable?: boolean; canPayMore?: boolean; maxPrice: number; hidden?: boolean; purchaseOnly?: boolean; assignBuiltSite?: boolean; }

Event input fields for create/update (camelCase)

EventType = "standard" | "daily"

Event type: standard (one-time) or daily (date-based booking)

EventWithActivityLog = { event: EventWithCount; entries: ActivityLogEntry[]; }

Result type for event + activity log batch query

EventWithAttendeeRaw = { event: EventWithCount; attendeeRaw: Attendee | null; }

Result type for event + single attendee query

EventWithAttendees = { event: EventWithCount; attendeesRaw: Attendee[]; }

Result type for combined event + attendees query

GroupInput = { slug: string; slugIndex: string; name: string; description?: string; termsAndConditions?: string; maxAttendees?: number; hidden?: boolean; }

Group input fields for create/update (camelCase)

HolidayInput = { name: string; startDate: string; endDate: string; }

Holiday input fields for create/update (camelCase)

ImageValidationError = "too_large" | "invalid_type" | "invalid_content"

Image validation error

ImageValidationResult =

{ valid: true; detectedType: string; }
| { valid: false; error: ImageValidationError; }

Image validation result

InputFor<Row, Schema extends TableSchema<Row>> =

[K in RequiredInputKeys<Row, Schema>]: Row[K]
& [K in OptionalInputKeys<Row, Schema>]?: Row[K]

Derive Input type from Row type and Schema

LogCategory =

Log categories for debug logging

PassData = { serialNumber: string; organizationName: string; description: string; eventName: string; eventDate: string; eventLocation: string; attendeeDate: string | null; quantity: number; pricePaid: number; currencyCode: string; checkinUrl: string; webServiceURL: string; foregroundColor?: string; backgroundColor?: string; labelColor?: string; }

Data needed to generate a pass — maps to existing ticket/event data

attendeeDate: string | null
Selected date for daily/recurring events (null for one-off events)
backgroundColor: string
checkinUrl: string
Full URL encoded in the QR barcode
currencyCode: string
description: string
VoiceOver accessibility description for the pass
eventDate: string
ISO 8601 date used for relevantDate and secondary field
eventLocation: string
Venue shown in secondary field
eventName: string
Event name displayed in the primary field
foregroundColor: string
Optional pass colors (CSS rgb() format)
labelColor: string
organizationName: string
Platform/domain name shown on the pass header
pricePaid: number
quantity: number
Ticket quantity and price (in minor units, e.g. pence)
serialNumber: string
Unique token identifying this ticket
webServiceURL: string
Base URL for Apple Wallet web service (e.g. https://example.com)

PaymentStatus = "paid" | "unpaid" | "no_payment_required"

Supported payment provider identifiers

Valid payment status values

PiiBlob = { v: number; n: string; e: string; p: string; a: string; s: string; pi: string; t: string; }

Short keys used in the PII blob JSON to minimize encrypted payload size

PriceResult =

{ ok: true; price: number; }
| { ok: false; error: string; }

Result type for price validation

ProcessedPayment = { payment_session_id: string; attendee_id: number | null; processed_at: string; ticket_tokens: string; }

Processed payment record

QueryLogEntry = { sql: string; durationMs: number; }

A single logged query

RegistrationEntry = { event: WebhookEvent; attendee: WebhookAttendee; }

Registration entry: event + attendee pair

ReserveSessionResult =

{ reserved: true; }
| { reserved: false; existing: ProcessedPayment; }

Result of session reservation attempt

SeedResult = { eventsCreated: number; attendeesCreated: number; }

Result of a seed operation

SessionMetadata = { _origin: string; name: string; email: string; phone: string; address: string; special_instructions: string; items: string; date: string; answer_ids: string; }

Metadata attached to a validated payment session.

SettingsData = SpecificFields & StringSettingFields

Full settings snapshot type.

SigningCredentials = { passTypeId: string; teamId: string; signingCert: string; signingKey: string; wwdrCert: string; }

Apple Wallet signing credentials

SlugWithIndex = { slug: string; slugIndex: string; }

Slug-with-index pair

StringSettingKey = (PLAINTEXT_KEYS)[number] | (ENCRYPTED_KEYS)[number]

Union of all string-setting snapshot keys.

SvgTicketData =

Pick<

WalletPassData,

>
& { pricePaid: string; currency: string; purchaseOnly?: boolean; }

Non-PII ticket data for SVG rendering (extends shared wallet fields with display-formatted values)

TableSchema<Row> = [K in keyof Row]: ColumnDef<Row[K]>

Table schema definition Keys are DB column names (snake_case), values are column definitions

TemplateData = { entries: TemplateEntry[]; event_names: string; attendee: TemplateEntry["attendee"]; ticket_url: string; currency: string; }

Data object passed to Liquid templates

Theme = "light" | "dark"

UI theme

TtlCache<K, V> = { get: (key: K) => V | undefined; set: (

key: K,

value: V

) => void; clear: () => void; size: () => number; }

TTL cache returned by ttlCache()

UpdateAttendeePIIInput = { name: string; email: string; phone: string; address: string; special_instructions: string; payment_id: string; ticket_token: string; }

Input for updating attendee PII (shared across events)

address: string
email: string
name: string
payment_id: string
Decrypted payment_id for PII blob rebuild (from existing attendee)
phone: string
special_instructions: string
ticket_token: string
Decrypted ticket_token for PII blob rebuild (from existing attendee)

UpdateEventLinkInput = { quantity: number; date: string | null; }

Input for updating a single event link

UpdateEventLinkResult =

{ success: true; }
| { success: false; reason: "capacity_exceeded"; }

Result of updating an event link

ValidatedPaymentSession = { id: string; paymentStatus: PaymentStatus; paymentReference: string; amountTotal: number; metadata: SessionMetadata; }

A validated payment session returned after checkout completion

amountTotal: number
Total amount charged in smallest currency unit (cents), from the payment provider
id: string
metadata: SessionMetadata
paymentReference: string
paymentStatus: PaymentStatus

WebhookAttendee =

ContactInfo
& { id: number; quantity: number; payment_id: string; price_paid: string; ticket_token: string; date: string | null; }

Attendee data needed for webhook notifications

WebhookEvent = { id: string; type: string; data: { object: Record<string, unknown>; }; }

Provider-agnostic webhook event

WebhookPayload =

ContactInfo
& { event_type: "registration.completed"; price_paid: number | null; currency: string; payment_id: string | null; ticket_url: string; tickets: WebhookTicket[]; timestamp: string; business_email: string; }

Consolidated payload sent to webhook endpoints

WebhookPayloadEvent = { id: number; name: string; slug: string; webhook_url: string; max_attendees: number; attendee_count: number; unit_price: number; can_pay_more: boolean; }

Event data needed for webhook notifications

WebhookSetupResult =

{ success: true; endpointId: string; secret: string; }
| { success: false; error: string; }

Result of webhook endpoint setup

WebhookTicket = { event_name: string; event_slug: string; unit_price: number; quantity: number; date: string | null; ticket_token: string; }

Single ticket in the webhook payload

WebhookVerifyResult =

{ valid: true; event: WebhookEvent; }
| { valid: false; error: string; }

Result of webhook signature verification

Variables

activityLogTable

Activity log table definition message is encrypted - decrypted only for admin view

API_AVAILABILITY_EXAMPLE_JSON: string

Example availability response JSON

API_BOOK_FREE_EXAMPLE_JSON: string

Example free booking response JSON

API_BOOK_PAID_EXAMPLE_JSON: string

Example paid booking response JSON

API_BOOK_REQUEST_JSON: string

Example booking request body

API_EXAMPLE_EVENT: EventWithCount

Example event matching the webhook example data

API_EXAMPLE_PUBLIC_EVENT: PublicEvent

The example PublicEvent, produced by toPublicEvent

API_LIST_EXAMPLE_JSON: string

Example list response JSON

API_SINGLE_EXAMPLE_JSON: string

Example single-event response JSON

ATTACHMENT_ERROR_MESSAGES: Record<AttachmentValidationError, string>

User-facing messages for attachment validation errors

ATTENDEE_DEMO_FIELDS: DemoFieldMap

Attendee PII fields

ATTENDEE_JOIN_SELECT: string

SELECT clause for attendee + event_attendees JOINs (INNER JOIN context). Derives date from start_at for backward compatibility with the Attendee type.

ATTENDEE_LEFT_JOIN_SELECT: string

SELECT clause for LEFT JOIN context — COALESCEs nullable join columns so attendees with broken/missing event_attendees linkage still appear in results (with event_id=0 as an obvious corruption indicator).

attendeesApi: { checkBatchAvailability; createAttendeeAtomic; hasAvailableSpots; }

Stubbable API for testing atomic operations

bunnyCdnApi: { checkSubdomainAvailable; createEdgeScript; delay; deleteDnsRecord; deployScriptCode; findPullZoneId; getCdnHostname; getDnsZone; getEdgeScript; publishEdgeScript; registerBunnySubdomain; setEdgeScriptSecret; updatePullZone; validateCustomDomain; }

Stubbable API for testing

CAPACITY_EXCEEDED: { reason: "capacity_exceeded"; success: false; }

Shared failure result for capacity-exceeded

col: { boolean: (defaultValue: boolean) => ColumnDef<boolean>; converted: <App>(config: { default?: () => App; write: (v: App) => InValue; read: (raw: InValue) => App; }) => ColumnDef<App>; encrypted: <T>(

encrypt: ColumnTransform<T>,

decrypt: ColumnTransform<T>

) => ColumnDef<T>; encryptedNullable: <T>(def: ColumnDef<T>) => ColumnDef<T | null>; encryptedText: (

encrypt: ColumnTransform<string>,

decrypt: ColumnTransform<string>

) => ColumnDef<string>; generated: <T>() => ColumnDef<T>; simple: <T>() => ColumnDef<T>; transform: <T>(

write: (v: T) => Promise<T> | T,

read: (v: T) => Promise<T> | T

) => ColumnDef<T>; withDefault: <T>(defaultFn: () => T) => ColumnDef<T>; }

Helper to create column definitions

boolean: (defaultValue: boolean) => ColumnDef<boolean>
Boolean column stored as INTEGER 0/1 in the database
converted: <App>(config: { default?: () => App; write: (v: App) => InValue; read: (raw: InValue) => App; }) => ColumnDef<App>
Column with type conversion between app and DB representations
encrypted: <T>(
encrypt: ColumnTransform<T>,
decrypt: ColumnTransform<T>
) => ColumnDef<T>
Column with read/write transforms (e.g., for encryption)
encryptedNullable: <T>(def: ColumnDef<T>) => ColumnDef<T | null>
Wrap an existing encrypted column def to pass through null values
encryptedText: (
encrypt: ColumnTransform<string>,
decrypt: ColumnTransform<string>
) => ColumnDef<string>
Encrypted text column with empty-string default
generated: <T>() => ColumnDef<T>
Auto-generated column (like id)
simple: <T>() => ColumnDef<T>
Simple column with no special handling
transform: <T>(
write: (v: T) => Promise<T> | T,
read: (v: T) => Promise<T> | T
) => ColumnDef<T>
Column with custom transforms
withDefault: <T>(defaultFn: () => T) => ColumnDef<T>
Column with default value

CONFIG_KEYS: { APPLE_WALLET_PASS_TYPE_ID: string; APPLE_WALLET_SIGNING_CERT: string; APPLE_WALLET_SIGNING_KEY: string; APPLE_WALLET_TEAM_ID: string; APPLE_WALLET_WWDR_CERT: string; ATTENDEE_COLUMN_ORDER: string; BOOKING_FEE: string; BUNNY_SUBDOMAIN: string; BUSINESS_EMAIL: string; CONTACT_PAGE_TEXT: string; COUNTRY: string; CURRENT_TASK: string; CUSTOM_DOMAIN: string; CUSTOM_DOMAIN_LAST_VALIDATED: string; EMAIL_API_KEY: string; EMAIL_FROM_ADDRESS: string; EMAIL_PROVIDER: string; EMAIL_TPL_ADMIN_HTML: string; EMAIL_TPL_ADMIN_SUBJECT: string; EMAIL_TPL_ADMIN_TEXT: string; EMAIL_TPL_CONFIRMATION_HTML: string; EMAIL_TPL_CONFIRMATION_SUBJECT: string; EMAIL_TPL_CONFIRMATION_TEXT: string; EMBED_HOSTS: string; EVENT_COLUMN_ORDER: string; GOOGLE_WALLET_ISSUER_ID: string; GOOGLE_WALLET_SERVICE_ACCOUNT_EMAIL: string; GOOGLE_WALLET_SERVICE_ACCOUNT_KEY: string; HEADER_IMAGE_URL: string; HOMEPAGE_TEXT: string; LAST_PRUNED_LOGINS: string; LAST_PRUNED_PAYMENTS: string; LAST_PRUNED_SESSIONS: string; LAST_PRUNED_TOKENS: string; LATEST_SCRIPT_VERSION: string; LATEST_SCRIPT_VERSION_NAME: string; PAYMENT_PROVIDER: string; PUBLIC_KEY: string; SETUP_COMPLETE: string; SHOW_PUBLIC_API: string; SHOW_PUBLIC_SITE: string; SQUARE_ACCESS_TOKEN: string; SQUARE_LOCATION_ID: string; SQUARE_SANDBOX: string; SQUARE_WEBHOOK_SIGNATURE_KEY: string; STRIPE_SECRET_KEY: string; STRIPE_WEBHOOK_ENDPOINT_ID: string; STRIPE_WEBHOOK_SECRET: string; TERMS_AND_CONDITIONS: string; THEME: string; WEBSITE_TITLE: string; WRAPPED_PRIVATE_KEY: string; }

CONTACT_FIELDS: readonly ContactField[]

All valid contact field names (runtime array matching the ContactField union)

CSRF_INVALID_FORM_MESSAGE: "Invalid or expired form. Please try again."

Default message for invalid/expired CSRF form submissions

DAY_NAMES:

Day name lookup from Date.getUTCDay() index (Sunday=0)

DEFAULT_BOOKABLE_DAYS: string[]

Default bookable days (all days of the week)

DEFAULT_TIMEZONE: "Europe/London"

Default timezone when none is configured

DEMO_ADDRESSES:

DEMO_BANNER: "<div class=\"demo-banner\">Demo Mode — entered text is replaced with sample data</div>"

Demo addresses

Demo mode banner HTML

DEMO_EMAILS:

Demo email addresses

DEMO_EVENT_DESCRIPTIONS: readonly string[]

Demo event descriptions — rock-themed gig blurbs assembled from word pools. Like the names above, the list is procedurally generated but seeded so it stays deterministic across runs.

DEMO_EVENT_LOCATIONS: readonly string[]

Demo event locations — pretend rock-venue / festival listings. Procedurally generated from the venue word pools using a seeded PRNG.

DEMO_EVENT_NAMES: readonly string[]

Demo event names — pretend rock/heavy-metal band listings. Generated procedurally from a seeded PRNG so the list stays deterministic across runs (tests rely on this) but offers far more variety than a hand-curated list while staying on-theme.

DEMO_FIRST_NAMES:

"A collection of summer activities for the whole family"
| "Warm up with our winter programme of events"
| "Community-led activities open to all"
| "Fun activities for young people aged 11-18"
| "Help us raise money for local causes"
| "Stay active with our sports and fitness events"

Demo first names for seed data (combined with surnames for more variety)

DEMO_GROUP_DESCRIPTIONS:

Demo group descriptions

DEMO_GROUP_NAMES:

Demo group names

DEMO_HOLIDAY_NAMES:

Demo holiday names

DEMO_NAMES:

"Welcome to our community events page. Browse upcoming events and book your tickets online."
| "Find out about local events in our village. Everyone is welcome to attend!"
| "Your one-stop destination for community events and activities."

Demo attendee names (full names for demo mode overrides)

DEMO_PAGE_TEXT:

"+44 7700 900001"
| "+44 7700 900002"
| "+44 7700 900003"
| "+44 7700 900004"
| "+44 7700 900005"
| "+44 7700 900006"
| "+44 7700 900007"
| "+44 7700 900008"
| "+44 7700 900009"
| "+44 7700 900010"
| "+44 7700 900011"
| "+44 7700 900012"
| "+44 7700 900013"
| "+44 7700 900014"
| "+44 7700 900015"
| "+44 7700 900016"
| "+44 7700 900017"
| "+44 7700 900018"
| "+44 7700 900019"
| "+44 7700 900020"
| "+44 7700 900021"
| "+44 7700 900022"
| "+44 7700 900023"
| "+44 7700 900024"
| "+44 7700 900025"
| "+44 7700 900026"
| "+44 7700 900027"
| "+44 7700 900028"
| "+44 7700 900029"
| "+44 7700 900030"

Demo page text (homepage / contact)

DEMO_PHONES:

Demo phone numbers (UK format)

DEMO_SPECIAL_INSTRUCTIONS:

Demo special instructions

DEMO_SURNAMES:

"Tickets are non-refundable. Please arrive 15 minutes before the event start time."
| string
| "All attendees must follow the venue code of conduct. Photography may take place at this event."

Demo surnames for seed data (combined with first names for more variety)

DEMO_TERMS:

"Village Events"
| "Community Hub"
| "Parish Council Events"
| "Town Hall Bookings"

Demo terms and conditions

DEMO_WEBSITE_TITLES:

EXAMPLE_ATTENDEE: { address: string; date: string; email: string; name: string; payment_id: string; phone: string; price_paid: string; quantity: number; special_instructions: string; ticket_token: string; }

Demo website titles

DOMAIN_PATTERN: RegExp

Matches a valid hostname like "example.com" or "sub.example.com"

EMAIL_PROVIDER_LABELS: Record<EmailProvider, string>

Display labels for email providers — keys must match EmailProvider

ErrorCode: [K in keyof ErrorDefs]: ErrorDefs[K][0]

Error code strings for use in logError calls

errorCodeLabel: Record<ErrorCodeType, string>

Human-readable labels for error codes (shown in admin activity log)

EVENT_DEMO_FIELDS: DemoFieldMap

Event metadata fields

eventsTable

EXAMPLE_BUSINESS_EMAIL: "hello@example.com"

EXAMPLE_CURRENCY: "GBP"

EXAMPLE_EVENT: { name: string; slug: string; unit_price: number; }

Example inputs used by both the fixture and the test

executeBatchWithResults

Execute multiple write statements and return their ResultSets. Statements run in order within a single transaction (Turso batch API). Ideal for cascading deletes and multi-step writes.

GROUP_DEMO_FIELDS: DemoFieldMap

Group name and description fields

groupsTable

Groups table with CRUD operations — writes auto-invalidate the cache

HOLIDAY_DEMO_FIELDS: DemoFieldMap

Holiday name field

holidaysTable

Holidays table with CRUD operations — writes auto-invalidate the cache

IMAGE_ERROR_MESSAGES: Record<ImageValidationError, string>

User-facing messages for image validation errors

isAdminLevel

Type guard: check if a string is a valid AdminLevel

isContactField

Type guard: check if an arbitrary string is a valid ContactField

isEventType

Type guard: check if an arbitrary string is a valid EventType

isPaymentProvider

Type guard: check if a string is a valid PaymentProviderType

joinStrings

Join an array of strings into a single string (curried reduce shorthand). Replaces the common pattern: reduce((acc: string, s: string) => acc + s, "")

LATEST_UPDATE: "add token rate-limit table with window_start/last_attempt"

MASK_SENTINEL: "••••••••"

MAX_ATTACHMENT_SIZE

Maximum attachment file size in bytes (default: 25MB)

MAX_EMAIL_TEMPLATE_LENGTH: 51200

MAX_WEBSITE_TITLE_LENGTH: 128

paymentsApi: { getConfiguredProvider: () => PaymentProviderType | null; }

Stubbable API for internal calls (testable via spyOn, like stripeApi/squareApi)

getConfiguredProvider: () => PaymentProviderType | null

PII_BLOB_VERSION: 1

Current PII blob schema version

queryBatch

Execute multiple read queries in a single round-trip using Turso batch API.

SCHEMA_HASH

SCHEMA_TABLE_NAMES: string[]

Ordered table names — matches FK dependency order (parents before children)

SEED_MAX_ATTENDEES: 100000

Max attendees per seeded event

settings: { appleWallet; email: { get apiKey(): string; get fromAddress(): string; get hasApiKey(): boolean; get provider(): string; template(

format: EmailTemplateFormat

): string; templateSet(type: EmailTemplateType): { subject: string; html: string; text: string; }; }; getCachedRaw; googleWallet; invalidateCache; loadAll; setRaw; setup: { clearCache; complete; isComplete; }; square: { get accessToken(): string; get hasToken(): boolean; get locationId(): string; get sandbox(): boolean; get webhookSignatureKey(): string; }; stripe: { get hasKey(): boolean; get keyMode(): "test" | "live" | null; get secretKey(): string; get webhookEndpointId(): string; get webhookSecret(): string; }; update: { appleWallet; attendeeColumnOrder; bookingFee: (v: string) => Promise<void>; bunnySubdomain; businessEmail; clearPaymentProvider: () => Promise<void>; contactPageText; country: (v: string) => Promise<void>; currentTask; customDomain; customDomainLastValidated: () => Promise<void>; email: { apiKey; fromAddress; provider; template: (

format: EmailTemplateFormat,

content: string

) => Promise<void>; }; embedHosts; eventColumnOrder; googleWallet; headerImageUrl; homepageText; lastPrunedLogins; lastPrunedPayments; lastPrunedSessions; lastPrunedTokens; latestScriptVersion; latestScriptVersionName; paymentProvider: (v: PaymentProviderType) => Promise<void>; showPublicApi; showPublicSite; square: { accessToken; locationId; sandbox; webhookSignatureKey; }; stripe: { secretKey; webhookConfig: (config: { secret: string; endpointId: string; }) => Promise<void>; }; terms; theme: (v: Theme) => Promise<void>; websiteTitle; }; updateUserPassword; withCurrentTask; get attendeeColumnOrder(): string; get bookingFee(): string; get bunnySubdomain(): string; get businessEmail(): string; clearTestOverride(...keys: (keyof SettingsData)[]): void; clearTestOverrides(): void; get contactPageText(): string; get country(): string; get currency(): string; get currentTask(): string; get customDomain(): string; get customDomainLastValidated(): string; get embedHosts(): string; get eventColumnOrder(): string; get headerImageUrl(): string; get homepageText(): string; get lastPrunedLogins(): string; get lastPrunedPayments(): string; get lastPrunedSessions(): string; get lastPrunedTokens(): string; get latestScriptVersion(): string; get latestScriptVersionName(): string; get paymentProvider(): PaymentProviderType | null; get phonePrefix(): string; get publicKey(): string; setForTest(overrides: Partial<SettingsData>): void; get showPublicApi(): boolean; get showPublicSite(): boolean; get terms(): string; get theme(): Theme; get timezone(): string; get websiteTitle(): string; get wrappedPrivateKey(): string; }

SETTINGS_CACHE_TTL_MS: 60000

SITE_CONTACT_DEMO_FIELDS: DemoFieldMap

Site contact page fields

SITE_HOME_DEMO_FIELDS: DemoFieldMap

Site homepage fields

SQUARE_METADATA_MAX_VALUE_LENGTH: 255

Square metadata constraint: each value max 255 characters

STALE_RESERVATION_MS

Threshold for abandoned payment reservations in ms (default: 300000 = 5 min)

STRIPE_METADATA_MAX_VALUE_LENGTH: 500

Stripe metadata constraint: each value max 500 characters

TERMS_DEMO_FIELDS: DemoFieldMap

Terms and conditions field

usersApi: { activateUser; createInvitedUser; createUser; decryptAdminLevel; decryptUsername; deleteUser; getAllUsers; getUserById; getUserByInviteCode; getUserByUsername; hashInviteCode; hasPassword; invalidateUsersCache; isInviteExpired; isInviteValid; isUsernameTaken; setUserPassword; verifyUserPassword; }

Stubbable API for testing

VALID_EMAIL_PROVIDERS: ReadonlySet<EmailProvider>

Valid provider names, derived from the PROVIDERS map

WALLET_ICONS: Record<string, Uint8Array>

Decoded icon files for inclusion in .pkpass bundles

WEBHOOK_EXAMPLE_JSON: string

Pretty-printed JSON for embedding in documentation

WEBHOOK_EXAMPLE_PAYLOAD: WebhookPayload

The example payload, matching what buildWebhookPayload would produce

docs/database.ts

Database client, ORM abstractions, and entity tables.

Functions

activateUser(

decryptedPasswordHash: string

dataKey: CryptoKey,

Activate a user by wrapping the data key with their KEK

addEventLink(

booking: EventBooking

Add a new event link for an existing attendee with atomic capacity check. Does NOT create a new attendee or touch PII — just inserts an event_attendees row.

addQueryLogEntry(

durationMs: number

Record a query (no-op when logging is disabled)

Assign events to a group by updating their group_id.

buildAttendeeInsert(enc: EncryptedAttendeeData)

Build an INSERT statement for the attendees table from encrypted fields.

buildCapacityCheckedInsert(

booking: EventBooking,

attendeeIdExpr?: string,

attendeeIdArg?: number

buildInputKeyMap(columns: string[]): Record<string, string>

Build a capacity-checked INSERT into event_attendees.

Build input key mapping from DB columns snake_case DB column → camelCase input key

buildPiiBlob(info: ContactInfo & { payment_id: string; ticket_token: string; }): string

Build a PII blob JSON from contact fields

checkBatchAvailability(

items: BatchAvailabilityItem[],

checkCapacityResult(result: { rowsAffected: number; }): UpdateEventLinkResult

Wrapper for test mocking - delegates to attendeesApi at runtime

Check a capacity-guarded write result and invalidate cache on success

clearLoginAttempts(ip: string): Promise<void>

Clear login attempts for an IP (on successful login)

clearSessionTokens(sessionId: string): Promise<void>

Clear stored ticket tokens for a session (after redirect has consumed them)

computeGroupSlugIndex(slug: string): Promise<string>

Compute slug index from slug for blind index lookup

computeSlugIndex(slug: string): Promise<string>

Compute slug index from slug for blind index lookup

contactFields(unnamed 0: ContactInfo): ContactInfo

Extract ContactInfo fields from an object

createAttendeeAtomic(input: AttendeeInput): Promise<CreateAttendeeResult>

Wrapper for test mocking - delegates to attendeesApi at runtime

createInvitedUser(

adminLevel: AdminLevel,

inviteCodeHash: string,

inviteExpiry: string

Create an invited user (no password yet, has invite code)

createSession(

csrfToken: string,

expires: number,

userId: number

Create a new session with CSRF token, wrapped data key, and user ID Token is hashed before storage for security

createUser(

passwordHash: string,

adminLevel: AdminLevel

dateToStartEnd(date: string | null): { startAt: string | null; endAt: string | null; }

Create a new user with encrypted fields

Convert nullable date to start_at/end_at (null-safe wrapper around dateToRange)

decryptAdminLevel(user: User): Promise<AdminLevel>

Decrypt a user's admin level

decryptAttendeeFields(

row: Attendee,

): Promise<Attendee>

Decrypt attendee fields from the PII blob. Requires migration to be complete (admin is gated behind migration). When paidEvent is false, payment_id and refunded are skipped.

decryptAttendeeOrNull(

row: Attendee | null,

Decrypt a single raw attendee, handling null input. Used when attendee is fetched via batch query.

decryptAttendees(

rows: Attendee[],

): Promise<Attendee[]>

Decrypt a list of raw attendees (all fields). Used when attendees are fetched via batch query.

decryptPiiBlob(

{ name: string; email: string; phone: string; address: string; special_instructions: string; payment_id: string; ticket_token: string; }

paidEvent: boolean

): Promise<

Decrypt a PII blob and extract all contact fields

decryptSessionTokens(encryptedTokens: string): Promise<string>

Decrypt the ticket_tokens field from a processed payment record. Returns the plaintext token string (e.g. "tok1+tok2") or empty string.

decryptUsername(user: User): Promise<string>

Decrypt a user's username

defineIdTable<Row, Input = Row>(

schema: TableSchema<Row>

defineTable<Row, Input = Row>(config: { name: string; primaryKey: keyof Row & string; schema: TableSchema<Row>; }): Table<Row, Input>

Helper for tables whose primary key column is id.

Define a table with CRUD operations

deleteAllSessions(): Promise<void>

Delete all sessions (used when password is changed)

deleteAllStaleReservations(): Promise<number>

Delete all stale reservations (unfinalized and older than STALE_RESERVATION_MS). Called from admin event views to clean up abandoned checkouts.

deleteAttendee(attendeeId: number): Promise<void>

Delete an attendee and all its event links, payments, and answers.

deleteByField(

Delete rows matching a field value

deleteByFieldBatch(deletes: Array<{ table: string; field: string; value: InValue; }>): Promise<void>

Delete rows from multiple tables in a single batch transaction

deleteEvent(eventId: number): Promise<void>

Delete an event and all its attendees in a single database round-trip. Uses write batch to cascade: processed_payments → attendees → event. Reduces 3 sequential HTTP round-trips to 1.

deleteOtherSessions(currentToken: string): Promise<void>

Delete all sessions except the current one Token is hashed before database comparison

deleteSession(token: string): Promise<void>

Delete a session by token Token is hashed before database lookup

deleteStaleReservation(sessionId: string): Promise<void>

Delete a stale reservation to allow retry

deleteUser(userId: number): Promise<void>

Delete a user and all their sessions and API keys

enableQueryLog(): void

Enable query logging and clear previous entries

encryptAttendeeFields(input: EncryptInput): Promise<EncryptedAttendeeData | null>

Encrypt attendee fields into a PII blob, returning null if key not configured

Shared encrypted name column for tables that store a display name.

encryptPiiBlob(

blobJson: string,

executeBatch(statements: Array<{ sql: string; args: InValue[]; }>): Promise<void>

Encrypt a PII blob JSON string with the public key

Execute multiple write statements, discarding results.

finalizeSession(

sessionId: string,

ticketTokens?: string[]

getActiveEventsByGroupId(groupId: number): Promise<EventWithCount[]>

Finalize a reserved session with the created attendee ID (second phase)

Get active events in a group with attendee counts.

getActiveEventStats(events: EventWithCount[]): Promise<ActiveEventStats>

getActiveHolidays(): Promise<Holiday[]>

Get active holidays (end_date >= today) for date computation (from cache). "today" is computed in the configured timezone.

getAllActivityLog(limit?: number): Promise<ActivityLogEntry[]>

Get all activity log entries (most recent first)

getAllDailyEvents(): Promise<EventWithCount[]>

Get all daily events with attendee counts (from cache).

getAllEvents(): Promise<EventWithCount[]>

Get all events with attendee counts (from cache)

getAllGroups(): Promise<Group[]>

Get all groups, decrypted, ordered by id (from cache)

getAllHolidays(): Promise<Holiday[]>

Get all holidays, decrypted, ordered by start_date (from cache)

getAllSessions(): Promise<Session[]>

Get all sessions ordered by expiration (newest first)

getAllStandardEvents(): Promise<EventWithCount[]>

Get all standard events with attendee counts (from cache). Used by the calendar view to include one-time events on their scheduled date.

getAllUsers(): Promise<User[]>

Get all users (for admin user management page, from cache)

getAttendee(

id: number,

getAttendeesByEventIds(eventIds: number[]): Promise<Attendee[]>

Get an attendee by ID (decrypted) Requires private key for decryption - only available to authenticated sessions

getAttendeeRaw(id: number): Promise<Attendee | null>

Get an attendee by ID without decrypting PII Used for payment callbacks and webhooks where decryption is not needed Returns the attendee with encrypted fields (id, event_id, quantity are plaintext)

Get raw attendees for a set of event IDs. Used by the calendar to load attendees for standard events whose decrypted date matches the selected calendar date.

getAttendeesByTokens(tokens: string[]): Promise<(AttendeeWithBookings | null)[]>

getAttendeesRaw(eventId: number): Promise<Attendee[]>

Get attendees for an event without decrypting PII Used for tests and operations that don't need decrypted data

getDailyEventAttendeeDates(): Promise<string[]>

Get distinct attendee dates for daily events. Used for the calendar date picker (lightweight, no attendee data).

getDailyEventAttendeesByDate(date: string): Promise<Attendee[]>

Get raw attendees for daily events on a specific date. Bounded query: only returns attendees matching the given date.

getDateAttendeeCount(

date: string

Get the total attendee quantity for a specific event + date

getDb(): Client

Get or create database client

getEvent(id: number): Promise<Event | null>

Get a single event by ID (from cache)

getEventActivityLog(

): Promise<ActivityLogEntry[]>

Get activity log entries for an event (most recent first)

getEventsByGroupId(groupId: number): Promise<EventWithCount[]>

Get all events in a group with attendee counts (including inactive).

getEventsBySlugsBatch(slugs: string[]): Promise<(EventWithCount | null)[]>

Get multiple events by slugs (from cache). Returns events in the same order as the input slugs. Missing or inactive events are returned as null.

getEventWithActivityLog(

): Promise<EventWithActivityLog | null>

Get event and its activity log in a single database round-trip. Uses batch API to reduce latency for remote databases.

getEventWithAttendeeRaw(

): Promise<EventWithAttendeeRaw | null>

attendeeId: number

Get event and a single attendee in a single database round-trip. Used for attendee management pages where we need both the event context and the specific attendee data.

getEventWithAttendeesRaw(id: number): Promise<EventWithAttendees | null>

getEventWithCount(id: number): Promise<EventWithCount | null>

Get event with attendee count (from cache)

getEventWithCountBySlug(slug: string): Promise<EventWithCount | null>

Get event with attendee count by slug (from cache)

getGroupBySlugIndex(slugIndex: string): Promise<Group | null>

Get a single group by slug_index (from cache)

getGroupRemainingByEventId(

events: EventForGroupLookup[],

Per-event view of group remaining capacity. Daily events are dropped when date is null — their cap is per-date, so a cumulative count would misreport spots that other dates still have.

getGroupRemainingByGroupId(

groupIds: number[],

event: EventForGroupLookup,

getGroupRemainingForEvent(

getNewestAttendeesRaw(limit: number): Promise<Attendee[]>

Returns undefined when no group cap applies: ungrouped, uncapped group, or daily event without a date.

Get the newest attendees across all events without decrypting PII. Used for the admin dashboard to show recent registrations.

getProcessedAttendeeId(sessionId: string): Promise<number | null>

Get the attendee ID for an already-processed session Used to return success for idempotent webhook retries

getQueryLog(): QueryLogEntry[]

Return a snapshot of all logged queries

getQueryLogStartTime(): number

Return the start time recorded by enableQueryLog()

getSession(token: string): Promise<Session | null>

Get a session by token (with 10s TTL cache) Token is hashed for database lookup

getUngroupedEvents(): Promise<EventWithCount[]>

Get ungrouped events (group_id = 0) with attendee counts.

getUserById(id: number): Promise<User | null>

Get a user by ID (from cache)

getUserByInviteCode(inviteCode: string): Promise<User | null>

Find a user by invite code hash Scans all users, decrypts invite_code_hash, and compares

getUserByUsername(username: string): Promise<User | null>

Look up a user by username (using blind index, from cache)

hasAvailableSpots(...args: Parameters<attendeesApi.hasAvailableSpots>): Promise<boolean>

Wrapper for test mocking - delegates to attendeesApi at runtime

hashInviteCode(code: string): Promise<string>

Hash an invite code using SHA-256

hasPassword(user: User): Promise<boolean>

Check if a user has set their password (password_hash is non-empty encrypted value)

idAndEncryptedSlugSchema(

encrypt: EncryptFn,

decrypt: DecryptFn

Shared columns for tables with encrypted slug + blind-index slug_index.

incrementAttachmentDownloads(

values: Record<string, InValue | RawSql>

Increment the attachment download counter for an attendee. Uses atomic SQL increment to avoid race conditions.

initDb(): Promise<void>

Initialize database tables — idempotent, safe to call on every startup. Uses an advisory lock to prevent concurrent migrations.

inPlaceholders(values: readonly unknown[]): string

Build SQL placeholders for an IN clause, e.g. "?, ?, ?"

insert(

table: string,

Build an INSERT statement from a table name and column→value record.

invalidateEventsCache(): void

Invalidate the events cache (for testing or after writes).

invalidateGroupsCache(): void

Invalidate the groups cache (for testing or after writes).

invalidateHolidaysCache(): void

Invalidate the holidays cache (for testing or after writes).

invalidateUsersCache(): void

Invalidate the users cache (for testing or after writes).

isGroupSlugTaken(

excludeGroupId?: number

isSessionProcessed(sessionId: string): Promise<ProcessedPayment | null>

Check if a group slug is already in use. Checks both events and groups for cross-table uniqueness.

isInviteExpired(user: User): Promise<boolean>

Check if a user's invite has expired. Callers should skip this for users who have already set a password.

isInviteValid(user: User): Promise<boolean>

Check if a user's invite is still valid (not expired, has invite code)

isLoginRateLimited(ip: string): Promise<boolean>

Check if IP is rate limited for login

isMaskSentinel(value: string): boolean

isQueryLogEnabled(): boolean

Whether query logging is currently active

isReservationStale(processedAt: string): boolean

Check if a reservation is stale (abandoned by a crashed process)

Check if a payment session has already been processed

isSlugTaken(

): Promise<ActivityLogEntry>

Check if a slug is already in use (optionally excluding a specific event ID) Uses slug_index for lookup (blind index)

isUsernameTaken(username: string): Promise<boolean>

Check if a username is already taken

logActivity(

message: string,

event?: EventRef | null

Log an activity

markRefunded(

Mark an attendee as refunded for a specific event. Keeps payment_id intact so payment details can still be viewed.

parsePiiBlob(json: string): PiiBlob

Parse a PII blob JSON back into contact fields (defaults v to 1 for pre-versioned blobs)

queryAll<T>(

queryAndMap<Row, Out>(toOut: (row: Row) => Promise<Out>)

args?: InValue[]

): Promise<T[]>

Query all rows, returning a typed array

Execute a SQL query and map result rows through an async transformer.

queryOne<T>(

args: InValue[]

reserveSession(sessionId: string): Promise<ReserveSessionResult>

Query single row, returning null if not found

rawSql(expr: string): RawSql

Embed a raw SQL expression (e.g. last_insert_rowid())

recordFailedLogin(ip: string): Promise<boolean>

Record a failed login attempt Returns true if the account is now locked

registerCache(provider: CacheStatProvider): void

resetDatabase(): Promise<void>

Reset the database by dropping all tables (reverse order for FK safety)

resetGroupEvents(groupId: number): Promise<void>

Reset group assignment on all events in a group.

resetSessionCache(): void

Clear session cache (exported for testing)

resultRows<T>(result: ResultSet): T[]

Cast libsql ResultSet rows to a typed array (single centralized assertion)

runWithQueryLogContext<T>(fn: () => T): T

setDb(client: Client | null): void

Set database client (for testing)

setGroupEventsActive(

active: boolean

Set the active flag on every event in a group. Returns the number of events affected.

setUserPassword(

Set a user's password (for invite flow)

toCamelCase(s: string): string

Convert snake_case to camelCase

toSnakeCase(s: string): string

Convert camelCase to snake_case

trackQuery<T>(

fn: () => Promise<T>

): Promise<T>

Run an async DB operation and log it when tracking is active

unlinkAttendeeFromEvent(

): Promise<{ attendeeDeleted: boolean; }>

Remove a single event link for an attendee. If the attendee has no remaining event links, deletes the attendee entirely. Returns whether the attendee was fully deleted.

updateAttendeePII(

input: UpdateAttendeePIIInput

Update an attendee's PII (name, email, phone, etc.) — shared across all event links. Caller must be authenticated admin (public key always exists after setup).

updateCheckedIn(

Update an attendee's checked_in status for a specific event. Caller must be authenticated admin (public key always exists after setup)

updateEventLink(

input: UpdateEventLinkInput

Update a single event link's quantity and date with atomic capacity check. Excludes this attendee's current row from the capacity calculation.

validateGroupEventType(

eventType: EventType,

Validate that an event type is compatible with a group's existing events. Returns an error message if mismatched, null if OK. Pass excludeEventId to skip a specific event (for edit-self case).

verifyUserPassword(

user: User,

table: Table<Row, Input>,

Verify a user's password (decrypt stored hash, then verify) Returns the decrypted password hash if valid (needed for KEK derivation)

withCacheInvalidation<Row, Input>(

invalidate: () => void

): Table<Row, Input>

writeClosesAt(v: string | null): Promise<string | null>

Encrypt closes_at for DB storage (null/empty → encrypted empty)

writeEventDate(v: string): Promise<string>

Encrypt event date for DB storage

Interfaces

ActivityLogEntry

Activity log entry

Table

Table definition with CRUD operations

deleteById: (id: InValue) => Promise<void>
Delete a row by primary key
findAll: () => Promise<Row[]>
Find all rows
findById: (id: InValue) => Promise<Row | null>
Find a row by primary key
fromDb: (row: Row) => Promise<Row>
Transform a row from DB (apply read transforms)
inputKeyMap: Record<string, string>
insert: (input: Input) => Promise<Row>
Insert a new row, returns the created row
name: string
primaryKey: keyof Row & string
rowToInput: (
row: Row,
exclude?: readonly string[]
) => Partial<Input>
Build an Input object from an existing Row by copying the input-eligible columns and translating keys through inputKeyMap. Lets callers spread a row into a new insert without restating every field. Columns named in exclude are skipped — useful for auto-stamped fields like created.
schema: TableSchema<Row>
toDbValues: (input: Input | Partial<Input>) => Promise<Record<string, InValue>>
Transform input to DB values (apply write transforms and defaults)
update: (
id: InValue,
input: Partial<Input>
) => Promise<Row | null>
Update a row by primary key, returns updated row or null if not found

Type Aliases

ActiveEventStats = { income: number; tickets: number; attendees: number; }

Aggregated statistics for active events

ActivityLogInput = { eventId?: number | null; message: string; }

Activity log input for create

AttendeeInput =

ContactFields
& { paymentId?: string; bookings: EventBooking[]; }

Input for creating an attendee atomically (one or more events)

AttendeeWithBookings = { id: number; created: string; ticket_token: string; ticket_token_index: string; pii_blob: string; bookings: EventAttendeeRow[]; }

An attendee with all their event bookings (for token resolution)

bookings: EventAttendeeRow[]
Per-event bookings, sorted by start_at then event_id
created: string
id: number
Base attendee fields (PII, token, created — shared across events)
pii_blob: string
ticket_token: string
ticket_token_index: string

BatchAvailabilityItem = { eventId: number; quantity: number; }

Item for batch availability check

ColumnDef<T = unknown> = { generated?: boolean; default?: () => T; write?: (v: T) => Promise<T> | T; read?: (v: T) => Promise<T> | T; }

Column definition for a table

default: () => T
Default value generator (for created timestamps etc)
generated: boolean
Whether this column is auto-generated (like id)
read: (v: T) => Promise<T> | T
Transform value after reading from DB (e.g., decrypt)
write: (v: T) => Promise<T> | T
Transform value before writing to DB (e.g., encrypt)

CreateAttendeeResult =

{ success: true; attendees: Attendee[]; }
| { success: false; reason: "capacity_exceeded" | "encryption_error"; }

Result of atomic attendee creation

EmailTemplateFormat = "subject" | "html" | "text"

Valid email template formats

EmailTemplateType = "confirmation" | "admin"

Valid email template types

EventAttendeeRow = { event_id: number; start_at: string | null; end_at: string | null; quantity: number; checked_in: number; refunded: number; price_paid: number; attachment_downloads: number; }

Row from event_attendees — per-event booking data

EventBooking = { eventId: number; quantity?: number; pricePaid?: number; date?: string | null; }

A single event booking within a multi-event attendee creation

Event input fields for create/update (camelCase)

EventWithActivityLog = { event: EventWithCount; entries: ActivityLogEntry[]; }

Result type for event + activity log batch query

EventWithAttendeeRaw = { event: EventWithCount; attendeeRaw: Attendee | null; }

Result type for event + single attendee query

EventWithAttendees = { event: EventWithCount; attendeesRaw: Attendee[]; }

Result type for combined event + attendees query

GroupInput = { slug: string; slugIndex: string; name: string; description?: string; termsAndConditions?: string; maxAttendees?: number; hidden?: boolean; }

Group input fields for create/update (camelCase)

HolidayInput = { name: string; startDate: string; endDate: string; }

Holiday input fields for create/update (camelCase)

InputFor<Row, Schema extends TableSchema<Row>> =

[K in RequiredInputKeys<Row, Schema>]: Row[K]
& [K in OptionalInputKeys<Row, Schema>]?: Row[K]

Derive Input type from Row type and Schema

ProcessedPayment = { payment_session_id: string; attendee_id: number | null; processed_at: string; ticket_tokens: string; }

Processed payment record

QueryLogEntry = { sql: string; durationMs: number; }

A single logged query

ReserveSessionResult =

{ reserved: true; }
| { reserved: false; existing: ProcessedPayment; }

Result of session reservation attempt

SettingsData = SpecificFields & StringSettingFields

Full settings snapshot type.

StringSettingKey = (PLAINTEXT_KEYS)[number] | (ENCRYPTED_KEYS)[number]

Union of all string-setting snapshot keys.

TableSchema<Row> = [K in keyof Row]: ColumnDef<Row[K]>

Table schema definition Keys are DB column names (snake_case), values are column definitions

UpdateAttendeePIIInput = { name: string; email: string; phone: string; address: string; special_instructions: string; payment_id: string; ticket_token: string; }

Input for updating attendee PII (shared across events)

address: string
email: string
name: string
payment_id: string
Decrypted payment_id for PII blob rebuild (from existing attendee)
phone: string
special_instructions: string
ticket_token: string
Decrypted ticket_token for PII blob rebuild (from existing attendee)

UpdateEventLinkInput = { quantity: number; date: string | null; }

Input for updating a single event link

UpdateEventLinkResult =

{ success: true; }
| { success: false; reason: "capacity_exceeded"; }

Result of updating an event link

Variables

activityLogTable

Activity log table definition message is encrypted - decrypted only for admin view

ATTENDEE_JOIN_SELECT: string

SELECT clause for attendee + event_attendees JOINs (INNER JOIN context). Derives date from start_at for backward compatibility with the Attendee type.

ATTENDEE_LEFT_JOIN_SELECT: string

attendeesApi: { checkBatchAvailability; createAttendeeAtomic; hasAvailableSpots; }

Stubbable API for testing atomic operations

CAPACITY_EXCEEDED: { reason: "capacity_exceeded"; success: false; }

Shared failure result for capacity-exceeded

encrypt: ColumnTransform<T>,

decrypt: ColumnTransform<T>

) => ColumnDef<T>; encryptedNullable: <T>(def: ColumnDef<T>) => ColumnDef<T | null>; encryptedText: (

encrypt: ColumnTransform<string>,

decrypt: ColumnTransform<string>

) => ColumnDef<string>; generated: <T>() => ColumnDef<T>; simple: <T>() => ColumnDef<T>; transform: <T>(

write: (v: T) => Promise<T> | T,

read: (v: T) => Promise<T> | T

) => ColumnDef<T>; withDefault: <T>(defaultFn: () => T) => ColumnDef<T>; }

Helper to create column definitions

boolean: (defaultValue: boolean) => ColumnDef<boolean>
Boolean column stored as INTEGER 0/1 in the database
converted: <App>(config: { default?: () => App; write: (v: App) => InValue; read: (raw: InValue) => App; }) => ColumnDef<App>
Column with type conversion between app and DB representations
encrypted: <T>(
encrypt: ColumnTransform<T>,
decrypt: ColumnTransform<T>
) => ColumnDef<T>
Column with read/write transforms (e.g., for encryption)
encryptedNullable: <T>(def: ColumnDef<T>) => ColumnDef<T | null>
Wrap an existing encrypted column def to pass through null values
encryptedText: (
encrypt: ColumnTransform<string>,
decrypt: ColumnTransform<string>
) => ColumnDef<string>
Encrypted text column with empty-string default
generated: <T>() => ColumnDef<T>
Auto-generated column (like id)
simple: <T>() => ColumnDef<T>
Simple column with no special handling
transform: <T>(
write: (v: T) => Promise<T> | T,
read: (v: T) => Promise<T> | T
) => ColumnDef<T>
Column with custom transforms
withDefault: <T>(defaultFn: () => T) => ColumnDef<T>
Column with default value

DEFAULT_BOOKABLE_DAYS: string[]

Default bookable days (all days of the week)

eventsTable

executeBatchWithResults

Execute multiple write statements and return their ResultSets. Statements run in order within a single transaction (Turso batch API). Ideal for cascading deletes and multi-step writes.

groupsTable

Groups table with CRUD operations — writes auto-invalidate the cache

holidaysTable

Holidays table with CRUD operations — writes auto-invalidate the cache

LATEST_UPDATE: "add token rate-limit table with window_start/last_attempt"

MASK_SENTINEL: "••••••••"

MAX_EMAIL_TEMPLATE_LENGTH: 51200

MAX_WEBSITE_TITLE_LENGTH: 128

PII_BLOB_VERSION: 1

Current PII blob schema version

queryBatch

Execute multiple read queries in a single round-trip using Turso batch API.

SCHEMA_HASH

SCHEMA_TABLE_NAMES: string[]

Ordered table names — matches FK dependency order (parents before children)

settings: { appleWallet; email: { get apiKey(): string; get fromAddress(): string; get hasApiKey(): boolean; get provider(): string; template(

format: EmailTemplateFormat

format: EmailTemplateFormat,

content: string

SETTINGS_CACHE_TTL_MS: 60000

STALE_RESERVATION_MS

Threshold for abandoned payment reservations in ms (default: 300000 = 5 min)

Stubbable API for testing

docs/crypto.ts

Encryption, hashing, CSRF protection, and secure operations.

Functions

aesGcmDecryptRaw(

iv: Uint8Array,

ciphertext: Uint8Array,

AES-GCM decrypt raw data, returning the decrypted ArrayBuffer

aesGcmEncryptRaw(

data: BufferSource,

): Promise<{ iv: Uint8Array; ciphertext: Uint8Array; }>

AES-GCM encrypt raw data, returning IV and ciphertext bytes

base64ToBase64Url(b64: string): string

Convert standard base64 to base64url (no padding). Works on both strings and Uint8Array (bytes are first encoded to base64).

computeHmacSha256(

secret: string

computeTicketTokenIndex(token: string): Promise<string>

Compute HMAC-SHA256 using Web Crypto API, returning raw ArrayBuffer

Compute ticket token index using HMAC for blind lookups Similar to slug_index for events - allows lookup without decrypting

constantTimeEqual(

Constant-time string comparison to prevent timing attacks Always iterates over the longer string and XORs the lengths so that different-length inputs don't leak via an early return.

decodeKeyBytes(keyString: string): Uint8Array

decrypt(encrypted: string): Promise<string>

Decrypt a string value encrypted with encrypt() Expects format: enc:1:$base64iv:$base64ciphertext

decryptAttendeePII(

decryptBytes(encrypted: Uint8Array): Promise<Uint8Array>

Decrypt attendee PII using the private key Used in admin views after obtaining private key from session

Decrypt binary data encrypted with encryptBytes(). Expects ENCB binary format: magic + version + IV + ciphertext.

decryptWithKey(

Decrypt data with a symmetric key

deriveKEK(passwordHash: string): Promise<CryptoKey>

Derive a Key Encryption Key (KEK) from password hash and DB_ENCRYPTION_KEY Uses PBKDF2 with the password hash as input and DB_ENCRYPTION_KEY as salt

encrypt(plaintext: string): Promise<string>

Encrypt a string value using AES-256-GCM via Web Crypto API Returns format: enc:1:$base64iv:$base64ciphertext Note: ciphertext includes auth tag appended (Web Crypto API does this automatically)

encryptAttendeePII(

Encrypt attendee PII using the public key from settings This can be called without authentication (for public ticket forms)

encryptBytes(data: Uint8Array): Promise<Uint8Array>

encryptWithKey(

Encrypt data with a symmetric key (for wrapping private key with DATA_KEY)

formatPrefixed(

...parts: Uint8Array[]

generateKeyPair(): Promise<{ publicKey: string; privateKey: string; }>

Format IV + ciphertext as a prefixed base64 string

fromBase64(base64: string): Uint8Array

Convert base64 string to Uint8Array

generateDataKey(): Promise<CryptoKey>

Generate a random 256-bit symmetric key for data encryption

Generate an RSA key pair for asymmetric encryption Returns { publicKey, privateKey } as exportable JWK strings

generateSecureToken(): string

Generate a cryptographically secure random token Uses Web Crypto API getRandomValues

generateTicketToken(): string

Generate a 5-byte uppercase hex ticket token for public ticket URLs

getCurrentCsrfToken(): string

Get the most recently generated CSRF token (for synchronous JSX rendering)

getEncryptionKeyString(): string

Get the encryption key bytes from environment variable (sync validation only) Expects DB_ENCRYPTION_KEY to be a base64-encoded 256-bit (32 byte) key

getPbkdf2Iterations(): number

getPrivateKeyFromSession(

sessionToken: string,

wrappedDataKey: string,

wrappedPrivateKey: string

Derive the private key from session credentials Used to decrypt attendee PII in admin views Results are cached per session token for 10 seconds

getRandomBytes(length: number): Uint8Array

Generate random bytes using Web Crypto API

hashPassword(password: string): Promise<string>

Hash a password using PBKDF2 Returns format: pbkdf2:iterations:$base64salt:$base64hash

hashSessionToken(token: string): Promise<string>

Hash a session token using SHA-256 Used to store session lookups without exposing the actual token

hmacHash(value: string): Promise<string>

HMAC-SHA256 hash using DB_ENCRYPTION_KEY Used for blind indexes and hashing limited keyspace values Returns deterministic output for same input (unlike encrypt)

hmacToBase64(buf: ArrayBuffer): string

Convert ArrayBuffer to base64 string

hmacToHex(buf: ArrayBuffer): string

Convert ArrayBuffer to hex string

hybridDecrypt(

Decrypt data using hybrid encryption Expects format: hyb:1:$base64WrappedKey:$base64iv:$base64ciphertext Results are cached in a bounded LRU (ciphertext -> plaintext)

hybridEncrypt(

publicKey: CryptoKey

algorithm: Parameters<SubtleCrypto["importKey"]>[2],

Encrypt data using hybrid encryption (RSA + AES)

importHmacKey(): Promise<CryptoKey>

importKey(

usages: KeyUsage[]

importPrivateKey(jwkString: string): Promise<CryptoKey>

Import a CryptoKey from DB_ENCRYPTION_KEY.

Import a private key from JWK string

importPublicKey(jwkString: string): Promise<CryptoKey>

Import a public key from JWK string

isSignedCsrfToken(token: string): boolean

Check whether a token uses the signed format

onEncryptionKeyChange(cb: () => void): void

parseEncryptedPayload(

): { iv: Uint8Array; ciphertext: Uint8Array; }

Parse a prefixed encrypted payload into IV and ciphertext bytes. Validates the prefix and separator; throws on invalid format.

secureCompare(

Constant-time string comparison to prevent timing attacks

setEncryptionKeyForTest(key: string | null): void

setFastPbkdf2ForTest(fast: boolean | null): void

Explicitly enable/disable fast PBKDF2 for testing without env var races

setRsaKeySizeForTest(size: number | null): void

Explicitly set RSA key size for testing without env var races

signCsrfToken(): Promise<string>

Create a signed CSRF token: s1.{timestamp}.{nonce}.{hmac}

symmetricDecrypt(

Decrypt a prefixed AES-GCM payload with the given key.

symmetricEncrypt(

Encrypt plaintext with an AES-GCM key, returning prefixed format: enc:1:$base64iv:$base64ciphertext

toBase64(bytes: Uint8Array): string

Convert Uint8Array to base64 string

unwrapKey(

unwrappingKey: CryptoKey

Unwrap a symmetric key Expects format: wk:1:$base64iv:$base64wrapped

unwrapKeyWithToken(

Unwrap a key using a session token

validateEncryptionKey(): void

Validate encryption key is present and valid Call this on startup to fail fast if key is missing

verifyPassword(

password: string,

storedHash: string

Verify a password against a hash Uses constant-time comparison to prevent timing attacks

verifySignedCsrfToken(

maxAge?

Verify a signed CSRF token's signature and expiry

wrapKey(

wrappingKey: CryptoKey

Wrap a symmetric key with another key using AES-GCM Returns format: wk:1:$base64iv:$base64wrapped

wrapKeyWithToken(

CSRF_INVALID_FORM_MESSAGE: "Invalid or expired form. Please try again."

Wrap a key using a session token (derives a wrapping key from the token)

Variables

Default message for invalid/expired CSRF form submissions

docs/payments.ts

Payment processing with Stripe and Square.

Classes

PaymentUserError(message: string)

Error subclass for user-facing payment validation errors (e.g. invalid phone number). These propagate through safeAsync so the message can be shown to the user.

Functions

buildItemsMetadata(intent: CheckoutIntent): Record<string, string>

Build checkout metadata from a CheckoutIntent (converts items to compact form).

buildMetadata(intent: MetadataInput): Record<string, string>

Build checkout session metadata from booking data (items already compact).

createWithClient<Client>(getClient: () => Client | null | Promise<Client | null>)

Create a withClient helper that runs an operation with a lazily-resolved client. Returns null if the client is not available or the operation fails.

enforceMetadataLimits(

metadata: Record<string, string>,

maxValueLength: number

): Record<string, string>

Enforce metadata value length limits for a payment provider.

errorMessage(err: unknown): string

Extract a human-readable message from an unknown caught value

extractSessionMetadata(metadata: SessionMetadata): ValidatedPaymentSession["metadata"]

Normalize validated session metadata into the canonical SessionMetadata shape.

getActivePaymentProvider(): Promise<PaymentProvider | null>

Resolve the active payment provider based on admin settings. Lazy-loads the provider module to avoid importing unused SDKs. Returns null if no provider is configured.

hasRequiredSessionMetadata(metadata: Record<string, string | undefined> | null | undefined): metadata is SessionMetadata

Validate that session metadata contains required fields (name + items).

isPaymentStatus(s: string): s is PaymentStatus

Type guard: check if a string is a valid PaymentStatus

processBooking(

event: EventWithCount,

contact: ContactInfo,

quantity: number,

date: string | null,

baseUrl: string,

customUnitPrice?: number,

): Promise<BookingResult>

Process a single-event booking.

safeAsync<T>(

fn: () => Promise<T>,

errorCode: ErrorCodeType

Safely execute async operation, returning null on error. Re-throws PaymentUserError so user-facing messages propagate.

singleEventAnswerIds(

): Record<string, number[]> | undefined

Convert single-event answerIds to the per-event format used in metadata

toBookingItems(items: CheckoutIntent["items"]): BookingItem[]

Convert registration line items to compact booking items

toCheckoutResult(

sessionId: string | undefined,

url: string | undefined | null,

label: LogCategory

): CheckoutSessionResult

Convert a provider-specific checkout result to a CheckoutSessionResult. Returns null if session ID or URL is missing.

withCheckoutError(op: () => Promise<CheckoutSessionResult>): Promise<CheckoutSessionResult>

Wrap a checkout operation, converting PaymentUserError to { error } result and swallowing unexpected errors as null. Used by both provider adapters.

Interfaces

PaymentProvider

Payment provider interface.

checkoutCompletedEventType: string
The webhook event type name that indicates a completed checkout
createCheckoutSession(
intent: CheckoutIntent,
baseUrl: string
): Promise<CheckoutSessionResult>
Create a checkout session for one or more events. Returns a session ID and hosted checkout URL, or null on failure.
isPaymentRefunded(paymentReference: string): Promise<boolean>
Check if a payment has been refunded via the provider API. Used to refresh refund status from the edit attendee page.
refundPayment(paymentReference: string): Promise<boolean>
Refund a completed payment.
resolveWebhookSession(event: WebhookEvent): Promise<ValidatedPaymentSession | "skip" | null>
Resolve a validated session from a webhook event. Each provider knows how to extract/fetch session data from its own event structure, so the webhook handler stays provider-agnostic.
retrieveSession(sessionId: string): Promise<ValidatedPaymentSession | null>
Retrieve and validate a completed checkout session by ID. Returns the validated session or null if not found / invalid.
setupWebhookEndpoint(
secretKey: string,
webhookUrl: string,
existingEndpointId?: string | null
): Promise<WebhookSetupResult>
Set up a webhook endpoint for this provider. Some providers (e.g. Stripe) support programmatic creation.
type: PaymentProviderType
Provider identifier
verifyWebhookSignature(
payload: string,
signature: string,
webhookUrl: string,
payloadBytes: Uint8Array
): Promise<WebhookVerifyResult>
Verify a webhook request's signature and parse the event payload.

Type Aliases

BookingIntent =

ContactInfo
& { date: string | null; items: BookingItem[]; eventAnswerIds?: Record<string, number[]>; }

Processed booking intent extracted from payment session metadata

BookingItem = { e: number; q: number; p: number; }

Compact booking item stored in session metadata (serialized/deserialized as JSON)

BookingResult =

Booking result — callers map this to their response format

CheckoutIntent =

ContactInfo
& { date: string | null; items: CheckoutItem[]; eventAnswerIds?: Record<string, number[]>; }

Registration intent for checkout (one or more events)

CheckoutItem = { eventId: number; quantity: number; unitPrice: number; slug: string; name: string; }

Single item within a checkout

CheckoutSessionResult =

{ sessionId: string; checkoutUrl: string; }
| { error: string; }
| null

Result of creating a checkout session.

Supported payment provider identifiers

PaymentStatus = "paid" | "unpaid" | "no_payment_required"

Supported payment provider identifiers

Valid payment status values

SessionMetadata = { _origin: string; name: string; email: string; phone: string; address: string; special_instructions: string; items: string; date: string; answer_ids: string; }

Metadata attached to a validated payment session.

ValidatedPaymentSession = { id: string; paymentStatus: PaymentStatus; paymentReference: string; amountTotal: number; metadata: SessionMetadata; }

A validated payment session returned after checkout completion

amountTotal: number
Total amount charged in smallest currency unit (cents), from the payment provider
id: string
metadata: SessionMetadata
paymentReference: string
paymentStatus: PaymentStatus

WebhookEvent = { id: string; type: string; data: { object: Record<string, unknown>; }; }

Provider-agnostic webhook event

WebhookSetupResult =

{ success: true; endpointId: string; secret: string; }
| { success: false; error: string; }

Result of webhook endpoint setup

WebhookVerifyResult =

{ valid: true; event: WebhookEvent; }
| { valid: false; error: string; }

Result of webhook signature verification

Variables

paymentsApi: { getConfiguredProvider: () => PaymentProviderType | null; }

Stubbable API for internal calls (testable via spyOn, like stripeApi/squareApi)

getConfiguredProvider: () => PaymentProviderType | null

SQUARE_METADATA_MAX_VALUE_LENGTH: 255

Square metadata constraint: each value max 255 characters

STRIPE_METADATA_MAX_VALUE_LENGTH: 500

Stripe metadata constraint: each value max 500 characters

docs/email.ts

Email sending, templates, and notifications.

Functions

buildSvgTicketData(

entry: EmailEntry,

): SvgTicketData

Build SVG ticket data from an email entry (non-PII only)

buildTemplateData(

currency: string,

ticketUrl: string

): TemplateData

Build the data object exposed to Liquid templates

buildTicketAttachments(

): Promise<EmailAttachment[]>

Generate SVG ticket attachments for all entries

getEmailConfig(): EmailConfig | null

Read email config from DB settings. Falls back to business email for fromAddress. Returns null if not configured.

getHostEmailConfig(): EmailConfig | null

Get host-level email config. Uses test override if set, otherwise reads env vars.

isEmailProvider(value: string): value is EmailProvider

Type guard: checks if a string is a valid EmailProvider

isValidBusinessEmail(email: string): boolean

Validates a basic email format: something@something.something

normalizeBusinessEmail(email: string): string

Normalizes email: trim and lowercase

renderEmailContent(

): Promise<EmailContent>

Render all 3 parts (subject, html, text) using custom templates with fallback to defaults

renderTemplate(

Render a single Liquid template string with the given data

resetEngine(): void

For testing: reset the engine (so filters can be re-registered after currency changes)

resetHostEmailConfig(): void

For testing: reset host email config to read from env vars.

sendEmail(

config: EmailConfig,

msg: EmailMessage

Send a single email via the configured provider. Logs errors, never throws. Returns HTTP status or undefined on non-HTTP errors.

sendNtfyError(code: string): Promise<void>

Send an error notification to the configured ntfy URL Returns a promise so callers can await delivery if needed. Delivery failures are logged locally (via logErrorLocal) but never throw.

sendRegistrationEmails(

sendTestEmail(

setHostEmailConfigForTest(config: EmailConfig | null): void

Send a test email to the business email address. Returns HTTP status or undefined on non-HTTP errors.

For testing: set host email config directly. Bypasses env vars to avoid races.

updateBusinessEmail(email: string): Promise<void>

Updates the business email in the database. Pass empty string to clear the business email. Email is encrypted at rest.

validateTemplate(template: string): string | null

Validate a Liquid template by parsing it (no rendering). Returns null if valid, or an error message string if invalid.

Type Aliases

EmailAttachment = { filename: string; content: string; contentType: string; }

A base64-encoded email attachment

EmailConfig = { provider: EmailProvider; apiKey: string; fromAddress: string; }

EmailEntry = { event: EmailEvent; attendee: WebhookAttendee; }

Attendee + event pair for email rendering

EmailEvent =

WebhookEvent
& { date: string; location: string; purchase_only: boolean; assign_built_site: boolean; }

Event data needed for registration pipeline (extends webhook event with display + assignment fields)

EmailMessage = { to: string; subject: string; html: string; text: string; replyTo?: string; attachments?: EmailAttachment[]; }

EmailProvider = keyof PROVIDERS

Union of all supported email provider keys, derived from the PROVIDERS map

TemplateData = { entries: TemplateEntry[]; event_names: string; attendee: TemplateEntry["attendee"]; ticket_url: string; currency: string; }

Data object passed to Liquid templates

Variables

EMAIL_PROVIDER_LABELS: Record<EmailProvider, string>

Display labels for email providers — keys must match EmailProvider

VALID_EMAIL_PROVIDERS: ReadonlySet<EmailProvider>

Valid provider names, derived from the PROVIDERS map

docs/tickets.ts

Ticket generation: QR codes, SVG tickets, and Apple Wallet passes.

Functions

buildCheckinUrl(token: string): string

Build the check-in URL for a single ticket token

buildInfoLines(data: SvgTicketData): string[]

Build info lines from ticket data (non-PII event and booking details)

buildPkpass(

createManifest(files: Record<string, Uint8Array>): string

Build a complete .pkpass file as a Uint8Array (ZIP archive)

buildTicketUrl(entries: TokenEntry[]): string

Create manifest.json mapping filenames to SHA-1 hashes

eventSupportsDirectCheckout(event: Pick<EventWithCount, "id" | "fields">): Promise<boolean>

Whether this event can send QR code scanners directly to checkout. True when no extra contact fields or questions are required.

extractSvgContent(svg: string): string

Extract the inner content of an SVG element (strip the outer <svg> wrapper)

extractViewBox(svg: string): { width: number; height: number; }

Extract the viewBox from an SVG element to compute its coordinate space

generatePassJson(

): Record<string, unknown>

Build the pass.json content from pass data and signing credentials

generateQrSvg(text: string): string

Generate an SVG string for a QR code encoding the given text. Returns a complete <svg> element suitable for inline embedding.

generateSvgTicket(data: SvgTicketData): Promise<string>

Generate a standalone SVG ticket with QR code and event/booking details. Returns a complete SVG document string.

isValidPemCertificate(pem: string): boolean

Validate that a string is a parseable PEM certificate

isValidPemPrivateKey(pem: string): boolean

Validate that a string is a parseable PEM private key

padAuthToken(serial: string): string

Pad a serial number to meet Apple's minimum authenticationToken length. Uses "-" (not in uppercase hex charset) so padding is cleanly reversible.

sha1Hex(data: Uint8Array): string

Compute SHA-1 hex digest of a Uint8Array

signManifest(

manifestData: string,

signingCertPem: string,

signingKeyPem: string,

wwdrCertPem: string

SigningCredentials = { passTypeId: string; teamId: string; signingCert: string; signingKey: string; wwdrCert: string; }

Sign the manifest with PKCS#7 detached signature

trimAuthToken(authToken: string): string

Strip padding added by padAuthToken to recover the original serial number

Type Aliases

Data needed to generate a pass — maps to existing ticket/event data

attendeeDate: string | null
Selected date for daily/recurring events (null for one-off events)
backgroundColor: string
checkinUrl: string
Full URL encoded in the QR barcode
currencyCode: string
description: string
VoiceOver accessibility description for the pass
eventDate: string
ISO 8601 date used for relevantDate and secondary field
eventLocation: string
Venue shown in secondary field
eventName: string
Event name displayed in the primary field
foregroundColor: string
Optional pass colors (CSS rgb() format)
labelColor: string
organizationName: string
Platform/domain name shown on the pass header
pricePaid: number
quantity: number
Ticket quantity and price (in minor units, e.g. pence)
serialNumber: string
Unique token identifying this ticket
webServiceURL: string
Base URL for Apple Wallet web service (e.g. https://example.com)

Apple Wallet signing credentials

SvgTicketData =

Pick<

WalletPassData,

>
& { pricePaid: string; currency: string; purchaseOnly?: boolean; }

Non-PII ticket data for SVG rendering (extends shared wallet fields with display-formatted values)

Variables

WALLET_ICONS: Record<string, Uint8Array>

Decoded icon files for inclusion in .pkpass bundles

docs/events.ts

Event management: fields, sorting, and availability.

Functions

addDays(

dateStr: string,

days: number

Add days to a YYYY-MM-DD date string

daysAgo(utcIso: string): number | null

eventDateToCalendarDate(utcIso: string): string | null

Convert a UTC ISO datetime to a YYYY-MM-DD calendar date in the given timezone. Returns null if the input is empty or invalid. Used by the calendar view to map standard event dates to calendar days.

formatDateLabel(dateStr: string): string

Format a YYYY-MM-DD date for display. Returns "Monday 15 March 2026"

formatDatetimeLabel(iso: string): string

Format an ISO datetime string for display in the given timezone. Returns e.g. "Monday 15 June 2026 at 14:00 BST"

formatDatetimeShort(iso: string): string

Compact ISO datetime formatter for table cells. Returns e.g. "07/04/2026 14:00" in the configured timezone.

getAvailableDates(

event: Event,

loadSortedEvents(predicate: (e: EventWithCount) => boolean): Promise<{ events: EventWithCount[]; holidays: Holiday[]; }>

): string[]

Compute available booking dates for a daily event. Filters by bookable days of the week and excludes holidays. Returns sorted array of YYYY-MM-DD strings.

Get the next available booking date for a daily event. More efficient than getAvailableDates()[0] — stops at first match. Returns null if no bookable dates are available.

Load all events with holidays and return them sorted, filtered by predicate.

mergeEventFields(fieldSettings: EventFields[]): EventFields

Determine which contact fields to collect for multiple events. Returns the union of all field settings, sorted by canonical CONTACT_FIELDS order.

normalizeDatetime(

value: string,

Normalize datetime-local "YYYY-MM-DDTHH:MM" to full UTC ISO string. The input is interpreted as local time in the given timezone and converted to UTC.

parseEventFields(fields: EventFields): ContactField[]

Parse a comma-separated fields string into individual ContactField names

sortEvents<T extends Event>(

events: T[],

): T[]

Sort events in unified 3-tier order. Works with any Event subtype (Event, EventWithCount, etc.).

startOfHour(date: Date): Date

Round a date down to the start of the current hour for cache-stable signatures

withRequiredEmail(fields: EventFields): EventFields

Ensure "email" is included in an event fields setting

Interfaces

attendee_count: number

attendee_count: number

Variables

DAY_NAMES:

Day name lookup from Date.getUTCDay() index (Sunday=0)

docs/config.ts

Configuration, environment, and session context.

Functions

buildFlashCookie(

Build a flash cookie containing a success or error message, keyed by ID

buildSessionCookie(

options?: { maxAge?: number; }

createTypeGuard<T extends string>(values: readonly T[])

clearFlashCookie(id: string): string

Clear a keyed flash cookie (set after reading)

clearSessionCookie(): string

Create a type guard from a readonly array of string literal values

getBookingFee(): number

Get booking fee percentage from database. Returns 0 if not set.

getBunnyApiKey(): string

Get the Bunny CDN API key from environment

getBunnyDnsSubdomainSuffix(): string

Get the Bunny DNS subdomain suffix (e.g. ".tickets") from environment

getBunnyDnsZoneId(): string

Get the Bunny DNS zone ID from environment

getBunnyScriptId(): string

Get the Bunny Edge Script ID from environment

getCachedSession(): AuthSession | null | undefined

Return the cached session if already resolved, or undefined if not yet resolved

getEffectiveDomain(): string

Get the effective domain synchronously (must call loadEffectiveDomain first).

getEmbedHosts(): Promise<string[]>

Get allowed embed hosts from database (encrypted, parsed to array) Returns empty array if not configured (embedding allowed from anywhere)

getEnv(key: string): string | undefined

Get an environment variable value Checks process.env first (Bunny Edge), falls back to Deno.env (local dev)

getSessionCookieName(): string

isBunnyCdnEnabled(): boolean

Check if Bunny CDN pull zone management is enabled Requires both BUNNY_API_KEY and BUNNY_SCRIPT_ID to be set

isBunnyDnsEnabled(): boolean

Check if Bunny DNS subdomain feature is enabled. Requires BUNNY_API_KEY and BUNNY_DNS_ZONE_ID to be set.

isPaidEvent(event: Pick<Event, "unit_price" | "can_pay_more">): boolean

Whether an event can accept payments (has a price or allows pay-what-you-want)

isPaymentsEnabled(): boolean

Check if payments are enabled (any provider configured with valid keys)

isReadOnly(): boolean

Check if the system is in read-only mode (READ_ONLY env var)

isSecureMode(): boolean

loadEffectiveDomain(requestUrl: string): string

Load the effective domain from DB, falling back to the request URL hostname.

parseFlashValue(value: string): { success?: string; error?: string; result?: string; }

Parse a flash cookie value into type, message, and optional result

requireEnv(key: string): string

Get a required environment variable, throwing if not set. Use this instead of getEnv(key) as string when the variable must exist.

resetEffectiveDomain(): void

Reset effective domain cache (for testing).

runWithSessionContext<T>(fn: () => T): T

Run a function within a session-memoization scope

setCachedSession(session: AuthSession | null): void

Store the resolved session in the current request scope

setEffectiveDomainForTest(domain: string): void

Set effective domain directly (for testing).

Interfaces

ApiKey

Attendee

Event

AttendeeTableRow = { attendee: Attendee; eventId: number; eventName: string; }

attendee_count: number

Group

Holiday

Session

Settings

User

Type Aliases

AdminEvent = Omit<EventWithCount, "slug_index">

Admin API event shape — all event fields except internal indices. Used by both admin JSON API and admin templates to ensure consistent field exposure. Snake_case keys match the DB schema.

AdminLevel = "owner" | "manager"

Admin role levels

AdminSession = { readonly adminLevel: AdminLevel; }

Session data needed by admin page templates

adminLevel: AdminLevel

A single row in the attendee table (attendee + parent event context)

ContactField = "email" | "phone" | "address" | "special_instructions"

Individual contact field name

ContactFields =

Pick<ContactInfo, "name" | "email">
& Partial<

Pick<ContactInfo, "phone" | "address" | "special_instructions">

Required name+email with optional phone/address/special_instructions from ContactInfo

ContactInfo = { name: string; email: string; phone: string; address: string; special_instructions: string; }

Attendee contact details — the core PII fields collected at registration

EventFields = string

Contact fields setting for an event (comma-separated ContactField names, or empty for name-only). Alias kept for documentation; runtime enforcement happens in parseEventFields.

EventType = "standard" | "daily"

Event type: standard (one-time) or daily (date-based booking)

PiiBlob = { v: number; n: string; e: string; p: string; a: string; s: string; pi: string; t: string; }

Supported payment provider identifiers

Short keys used in the PII blob JSON to minimize encrypted payload size

Theme = "light" | "dark"

UI theme

Variables

CONTACT_FIELDS: readonly ContactField[]

All valid contact field names (runtime array matching the ContactField union)

isAdminLevel

Type guard: check if a string is a valid AdminLevel

isContactField

Type guard: check if an arbitrary string is a valid ContactField

isEventType

Type guard: check if an arbitrary string is a valid EventType

isPaymentProvider

Type guard: check if a string is a valid PaymentProviderType

docs/utilities.ts

Shared utilities: FP helpers, formatting, slugs, caching, and logging.

Functions

addPendingWork(p: Promise<unknown>): void

Queue a promise that must complete before the response is sent

asString(value: unknown): string

Narrow an unknown value to string, defaulting to "" if not a string. Replaces typeof x === "string" ? x : "" at type boundaries.

bracket<R>(

acquire: () => R | Promise<R>,

release: (r: R) => void | Promise<void>

fetchAll: () => Promise<T[]>,

Resource management pattern (like Haskell's bracket or try-with-resources). Ensures cleanup happens even if the operation throws.

chunk(size: number)

Split an array into chunks of a given size

collectionCache<T>(

): CollectionCache<T>

compact<T>(array: (T | null | undefined)[]): T[]

Remove null and undefined values from array

createRequestTimer(): (() => number)

Create a request timer for measuring duration

filter<T>(predicate: (item: T) => boolean)

Curried filter

flatMap<T, U>(fn: (item: T) => U[])

Curried flatMap

flushPendingWork(): Promise<void>

Await all queued work. Call before returning the response.

formatCurrency(minorUnits: number | string): string

Format an amount in minor units (pence/cents) as a currency string. e.g. formatCurrency(1050) → "£10.50" (when currency is GBP)

formatDatetimeInTz(

Format a UTC ISO datetime string for display in the given timezone. Returns e.g. "Monday 15 June 2026 at 14:00 BST"

formatDatetimeShortInTz(

computeIndex: (slug: string) => Promise<string>,

formatErrorMessage(context: ErrorContext): string

Format an error context into a human-readable activity log message

formatRequestError(

Format an error detail string with request context and error message

generateSlug(): string

Generate a random slug with at least 2 digits and 2 letters. Uses Fisher-Yates shuffle on the fixed positions to avoid bias.

generateUniqueSlug(

isTaken: (slug: string) => Promise<boolean>

): Promise<SlugWithIndex>

Generate a unique slug by retrying until one is not taken.

getAllCacheStats(): CacheStat[]

Collect stats from all registered caches

getDecimalPlaces(currencyCode: string): number

Get the number of decimal places for a currency code

getRequestId(): string

Get the current request ID, or empty string if outside request context

hasPendingWorkScope(): boolean

True when running inside a runWithPendingWork scope (i.e. a request).

isValidDatetime(value: string): boolean

Check if a naive datetime-local string is a parseable datetime. Does not interpret timezone — purely a format check.

isValidTimezone(tz: string): boolean

Validate that a string is a valid IANA timezone identifier.

lazyRef<T>(fn: () => T): [() => T, (value: T | null) => void]

Resettable lazy reference - like once() but can be reset for testing. Returns [get, set] tuple where set(null) resets to uncomputed state.

localToUtc(

naive: string,

Convert a naive datetime-local value (YYYY-MM-DDTHH:MM) to a UTC ISO string, interpreting the value as local time in the given timezone.

logDebug(

category: LogCategory,

message: string

Log a debug message with category prefix For detailed debugging during development

logError(context: ErrorContext): void

logErrorLocal(context: ErrorContext): void

Log a classified error to console.error only (no ntfy, no activity log). Use this where calling logError would cause infinite recursion (e.g. ntfy.ts).

logRequest(entry: RequestLogEntry): void

Log a completed request to console.debug Path is automatically redacted for privacy

map<T, U>(fn: (item: T) => U)

Curried map

mapParallel<T, U>(fn: (item: T) => Promise<U>)

Map over a promise-returning function in parallel (Promise.all)

normalizePhone(

phone: string,

prefix: string

pipe(...fns: Array<(arg: unknown) => unknown>): (value: unknown) => unknown

Strip non-numeric characters from a phone number and normalize to +{prefix}{local}

normalizeSlug(input: string): string

Normalize a user-provided slug: trim, lowercase, replace spaces with hyphens

now(): Date

Current time as a Date

nowIso(): string

Full ISO-8601 timestamp for created/logged_at fields

nowMs(): number

Epoch milliseconds for numeric comparisons

once<T>(fn: () => T): (() => T)

Lazy evaluation - compute once on first call, cache forever. Use instead of let x = null; const getX = () => x ??= compute();

2 overloads

Compose functions left-to-right (pipe) Uses recursive conditional types for arbitrary-length type safety.

redactPath(path: string): string

Redact dynamic segments from paths for privacy-safe logging Replaces:

reduce<T, U>(

Curried reduce

registerCache(provider: CacheStatProvider): void

renderMarkdown(text: string): string

Render markdown to HTML (block-level: paragraphs, lists, etc.). Raw HTML is escaped.

resetCacheRegistry(): void

Reset the registry (for testing)

runWithPendingWork<T>(fn: () => T): T

Run a function within a pending-work scope

runWithRequestId<T>(fn: () => T): T

Run a function with a request-scoped random ID for log correlation

setSuppressDebugLogs(value: boolean | null): void

Set module-level debug log suppression (avoids env race in parallel tests).

setSuppressRequestLogs(value: boolean | null): void

Set module-level request log suppression (avoids env race in parallel tests).

sort<T>(comparator: (

a: T,

b: T

) => number)

Non-mutating sort with comparator

todayInTz(tz: string): string

Get today's date as YYYY-MM-DD in the given timezone.

toMajorUnits(minorUnits: number): string

Convert minor units to major units string for form display. e.g. toMajorUnits(1050) → "10.50" (for GBP)

toMinorUnits(majorUnits: number): number

Convert major units (decimal) to minor units (integer). e.g. toMinorUnits(10.50) → 1050 (for GBP)

ttlCache<K, V>(

): TtlCache<K, V>

Create a TTL (Time-To-Live) cache. Entries expire after ttlMs milliseconds. Accepts an optional clock function for testing.

unique<T>(array: T[]): T[]

Remove duplicate values (by reference/value equality)

uniqueBy<T>(fn: (item: T) => unknown)

Remove duplicates by a key function

utcToLocalInput(

CacheStat = { readonly name: string; readonly entries: number; readonly capacity?: number; }

Convert a UTC ISO datetime string to a datetime-local input value (YYYY-MM-DDTHH:MM) in the given timezone. Used for pre-populating form inputs with timezone-adjusted values.

validatePrice(

validateSlug(slug: string): string | null

Validate a normalized slug. Returns error message or null.

Type Aliases

A single cache's stats snapshot

CollectionCache<T> = { getAll: () => Promise<T[]>; invalidate: () => void; size: () => number; }

Collection cache returned by collectionCache()

ErrorCodeType = (ErrorCode)[keyof ErrorCode]

ErrorContext = { code: ErrorCodeType; eventId?: number; attendeeId?: number; detail?: string; }

Error log context (privacy-safe metadata only)

attendeeId: number
Optional: attendee ID
code: ErrorCodeType
Error code for classification
detail: string
Optional: additional safe context
eventId: number
Optional: event ID (not slug)

LogCategory =

Log categories for debug logging

PriceResult =

{ ok: true; price: number; }
| { ok: false; error: string; }

Result type for price validation

SlugWithIndex = { slug: string; slugIndex: string; }

Slug-with-index pair

TtlCache<K, V> = { get: (key: K) => V | undefined; set: (

key: K,

value: V

) => void; clear: () => void; size: () => number; }

TTL cache returned by ttlCache()

Variables

DEFAULT_TIMEZONE: "Europe/London"

Default timezone when none is configured

ErrorCode: [K in keyof ErrorDefs]: ErrorDefs[K][0]

Error code strings for use in logError calls

errorCodeLabel: Record<ErrorCodeType, string>

Human-readable labels for error codes (shown in admin activity log)

joinStrings

Join an array of strings into a single string (curried reduce shorthand). Replaces the common pattern: reduce((acc: string, s: string) => acc + s, "")

docs/embed.ts

Embeddable widget: iframe integration and CDN storage.

Functions

appendIframeParam(url: string): string

Append iframe=true query param to a URL when in iframe mode

buildEmbedSnippets(url: string): EmbedSnippets

Build embed snippets (script and iframe variants) for a ticket URL

buildFrameAncestors(hosts: string[]): string | null

Build a frame-ancestors CSP value from allowed embed hosts. Returns null if the list is empty (allow embedding from anywhere).

buildSubdomainRecordName(subdomain: string): string

Build the full subdomain record name (user choice + suffix). e.g. "myevent" + ".tickets" → "myevent.tickets"

checkSubdomainAvailable(subdomain: string)

Check whether a bunny subdomain is available.

deleteAllEventStorageFiles(events: ReadonlyArray<EventWithStorage>): Promise<void>

Delete all storage files (images and attachments) for a list of events

deleteEventStorageFiles(

event: EventWithStorage,

reason: string

deployScriptCode(code: string): Promise<BunnyApiResult>

Delete the image and attachment files for a single event

deleteFile(filename: string): Promise<void>

Delete a file, routing to local or Bunny based on config.

Upload and publish new script code to Bunny CDN.

detectIframeMode(url: string): void

Detect iframe mode from a request URL and store it for the current request

detectImageType(data: Uint8Array): string | null

Detect the actual image type from magic bytes. Returns the MIME type if matched, null otherwise.

downloadImage(filename: string): Promise<Uint8Array | null>

Download and decrypt a file. Returns the decrypted bytes, or null if the file does not exist.

downloadRaw(filename: string): Promise<Uint8Array | null>

Download raw bytes from storage. Returns null if the file does not exist.

generateAttachmentFilename(originalName: string): string

Generate a random CDN filename preserving the original name for readability

generateImageFilename(detectedType: string): string

Generate a random filename with the correct extension

getCdnHostname(): Promise<CdnHostnameResult>

Get CDN hostname (delegates to bunnyCdnApi for testability).

getIframeMode(): boolean

Get the current request's iframe mode

getImageProxyUrl(filename: string): string

Get the proxy URL path for serving a decrypted image. Images are encrypted on CDN, so they must be served through the proxy.

getMimeTypeFromFilename(filename: string): string | null

Get the MIME type for an image filename from its extension.

getStorageBackend(): "bunny" | "local" | "none"

Returns which storage backend is active: "bunny", "local", or "none".

isStorageEnabled(): boolean

Check if image storage is enabled (Bunny CDN or local filesystem).

listFiles(prefix: string): Promise<string[]>

List files in storage matching a prefix

parseEmbedHosts(input: string): string[]

Parse a comma-separated list of hosts into trimmed, lowercased entries. Filters out empty strings from trailing commas etc.

registerBunnySubdomain(subdomain: string)

runWithStorageConfig<T>(

config: StorageConfig,

fn: () => T

): T

Run fn with an isolated storage configuration (test-only).

tryDeleteFile(

filename: string,

eventId: number | undefined,

detail: string

Try to delete a file from storage, logging errors on failure

uploadAttachment(

Upload an attachment to Bunny storage. Encrypts the file bytes before uploading. Uses the provided filename (caller generates via generateAttachmentFilename). Returns the filename on success.

uploadImage(

detectedType: string

Upload an image to Bunny storage. Encrypts the image bytes before uploading. Returns the filename (without path) on success.

uploadRaw(

validateAttachment(data: Uint8Array): AttachmentValidationResult

Upload raw bytes to storage, routing to local or Bunny based on config

Validate an attachment file: check size only (any file type allowed).

validateCustomDomain(hostname: string): Promise<BunnyApiResult>

Validate a custom domain (delegates to bunnyCdnApi for testability).

validateEmbedHosts(input: string): string | null

Validate a comma-separated list of host patterns. Returns null if all valid, or the first error message.

validateHostPattern(host: string): string | null

Validate a single host pattern Returns null if valid, or an error message if invalid

validateImage(

{ valid: true; }
| { valid: false; error: AttachmentValidationError; }

contentType: string

): ImageValidationResult

Validate an image file: check MIME type, size, and magic bytes.

Type Aliases

AttachmentValidationError = "too_large"

Attachment validation error

AttachmentValidationResult =

Attachment validation result

EmbedSnippets = { script: string; iframe: string; }

ImageValidationError = "too_large" | "invalid_type" | "invalid_content"

Image validation error

ImageValidationResult =

{ valid: true; detectedType: string; }
| { valid: false; error: ImageValidationError; }

Image validation result

Variables

ATTACHMENT_ERROR_MESSAGES: Record<AttachmentValidationError, string>

User-facing messages for attachment validation errors

Stubbable API for testing

DOMAIN_PATTERN: RegExp

Matches a valid hostname like "example.com" or "sub.example.com"

IMAGE_ERROR_MESSAGES: Record<ImageValidationError, string>

User-facing messages for image validation errors

MAX_ATTACHMENT_SIZE

Maximum attachment file size in bytes (default: 25MB)

docs/webhooks.ts

Webhook delivery and API examples.

Functions

buildWebhookPayload(

logAndNotifyRegistration(entries: EmailEntry[]): Promise<void>

): WebhookPayload

Build a consolidated webhook payload from registration entries

Log attendee registration and send consolidated webhook Used for single-event registrations

sendRegistrationWebhooks(

Send consolidated webhook to all unique webhook URLs for the given entries

sendWebhook(

webhookUrl: string,

payload: WebhookPayload,

eventId?: number

RegistrationEntry = { event: WebhookEvent; attendee: WebhookAttendee; }

Send a webhook payload to a URL Fires and forgets - errors are logged but don't block registration

Type Aliases

Registration entry: event + attendee pair

WebhookAttendee =

ContactInfo
& { id: number; quantity: number; payment_id: string; price_paid: string; ticket_token: string; date: string | null; }

Attendee data needed for webhook notifications

WebhookPayload =

Consolidated payload sent to webhook endpoints

WebhookPayloadEvent = { id: number; name: string; slug: string; webhook_url: string; max_attendees: number; attendee_count: number; unit_price: number; can_pay_more: boolean; }

Event data needed for webhook notifications

WebhookTicket = { event_name: string; event_slug: string; unit_price: number; quantity: number; date: string | null; ticket_token: string; }

Single ticket in the webhook payload

Variables

API_AVAILABILITY_EXAMPLE_JSON: string

Example availability response JSON

API_BOOK_FREE_EXAMPLE_JSON: string

Example free booking response JSON

API_BOOK_PAID_EXAMPLE_JSON: string

Example paid booking response JSON

API_BOOK_REQUEST_JSON: string

Example booking request body

API_EXAMPLE_EVENT: EventWithCount

Example event matching the webhook example data

API_EXAMPLE_PUBLIC_EVENT: PublicEvent

The example PublicEvent, produced by toPublicEvent

API_LIST_EXAMPLE_JSON: string

Example list response JSON

API_SINGLE_EXAMPLE_JSON: string

Example single-event response JSON

EXAMPLE_BUSINESS_EMAIL: "hello@example.com"

EXAMPLE_CURRENCY: "GBP"

EXAMPLE_EVENT: { name: string; slug: string; unit_price: number; }

Example inputs used by both the fixture and the test

WEBHOOK_EXAMPLE_JSON: string

Pretty-printed JSON for embedding in documentation

WEBHOOK_EXAMPLE_PAYLOAD: WebhookPayload

The example payload, matching what buildWebhookPayload would produce

docs/demo.ts

Demo mode and seed data generation.

Functions

applyDemoOverrides(

form: FormParams,

attendeesPerEvent: number

): FormParams

Replace form field values with demo data when demo mode is active. Only replaces fields that are present and non-empty in the form. Mutates and returns the same URLSearchParams for chaining.

createSeeds(

eventCount: number,

): Promise<SeedResult>

isDemoMode(): boolean

Check if demo mode is enabled

randomChoice<T>(arr: readonly T[]): T

Pick a random element from an array

resetDemoMode(): void

Reset cached demo mode value (for testing and cache invalidation)

setDemoModeForTest(enabled: boolean): void

Explicitly set demo mode on or off (for testing). Bypasses Deno.env to avoid races between parallel test workers.

wrapResourceForDemo<R, I, V extends FieldValues = FieldValues>(

resource: NamedResource<R, I, V>,

): NamedResource<R, I, V>

Wrap a named resource so create/update apply demo overrides to the form

Type Aliases

DemoFieldMap = Record<string, readonly string[]>

Maps form field names to arrays of possible demo values

SeedResult = { eventsCreated: number; attendeesCreated: number; }

Result of a seed operation

Variables

ATTENDEE_DEMO_FIELDS: DemoFieldMap

Attendee PII fields

DEMO_ADDRESSES:

DEMO_BANNER: "<div class=\"demo-banner\">Demo Mode — entered text is replaced with sample data</div>"

Demo addresses

Demo mode banner HTML

DEMO_EMAILS: