Fix multi-image selection when mime type is missing

- Remove default_locale and primary_join_token columns from event list
- Add read-only join link field to event edit form
- Add missing translations for used/remaining photos and join link
- Fix array-to-string conversion error in join link modal

.beads/.gitignore

@@ -10,6 +10,13 @@ daemon.lock
 daemon.log
 daemon.pid
 bd.sock
+sync-state.json
+.sync.lock
+last-touched
+sync_base.jsonl
+.sync.lock
+last-touched
+sync_base.jsonl
 
 # Local version tracking (prevents upgrade notification spam after git ops)
 .local_version
@@ -18,6 +25,10 @@ bd.sock
 db.sqlite
 bd.db
 
+# Worktree redirect file (contains relative path to main repo's .beads/)
+# Must not be committed as paths would be wrong in other clones
+redirect
+
 # Merge artifacts (temporary files from 3-way merge)
 beads.base.jsonl
 beads.base.meta.json
@@ -26,7 +37,8 @@ beads.left.meta.json
 beads.right.jsonl
 beads.right.meta.json
 
-# Keep JSONL exports and config (source of truth for git)
+# NOTE: Do NOT add negation patterns (e.g., !issues.jsonl) here.
-!issues.jsonl
+# They would override fork protection in .git/info/exclude, allowing
-!metadata.json
+# contributors to accidentally commit upstream issue databases.
-!config.json
+# The JSONL files (issues.jsonl, interactions.jsonl) and config files
+# are tracked by git by default since no pattern above ignores them.

.beads/config.yaml

@@ -42,7 +42,7 @@
 # This setting persists across clones (unlike database config which is gitignored).
 # Can also use BEADS_SYNC_BRANCH env var for local override.
 # If not set, bd sync will require you to run 'bd config set sync.branch <branch>'.
-# sync-branch: "beads-sync"
+sync-branch: "beads-sync"
 
 # Multi-repo configuration (experimental - bd-307)
 # Allows hydrating from multiple repositories and routing writes to the correct JSONL
@@ -59,4 +59,4 @@
 # - linear.url
 # - linear.api-key
 # - github.org
-# - github.repo
+# - github.repo

.beads/interactions.jsonl

@@ -0,0 +1,11 @@
+{"id":"--stealth-d39","title":"Superadmin control surface spec and access matrix","description":"Define the minimal superadmin control surface, permissions, and mapping to tenant/guest responsibilities. Document scope and non-goals.","status":"closed","priority":2,"issue_type":"task","created_at":"2026-01-01T14:16:06.994379577+01:00","updated_at":"2026-01-01T14:20:43.080701114+01:00","closed_at":"2026-01-01T14:20:43.080701114+01:00","close_reason":"Duplicate of fotospiel-app-ihd after beads re-init"}
+{"id":"fotospiel-app-097","title":"Tenant announcements / release notes","description":"Broadcast announcements to tenants/admins with targeting and scheduling.","status":"open","priority":3,"issue_type":"feature","created_at":"2026-01-01T14:20:21.68206312+01:00","updated_at":"2026-01-01T14:20:21.68206312+01:00"}
+{"id":"fotospiel-app-arp","title":"Guest policy settings (toggles, rate limits, retention defaults)","description":"Global guest feature toggles, rate limits, and retention defaults. Settings page + persistence.","status":"open","priority":2,"issue_type":"feature","created_at":"2026-01-01T14:18:52.931017783+01:00","updated_at":"2026-01-01T14:18:52.931017783+01:00"}
+{"id":"fotospiel-app-bit","title":"Superadmin control surface roadmap","description":"Roadmap to implement practical superadmin control over tenant admin + guest experience. Tracks lifecycle, moderation, policies, ops health, compliance, audit, announcements, integrations.","status":"open","priority":1,"issue_type":"epic","created_at":"2026-01-01T14:21:01.852988935+01:00","updated_at":"2026-01-01T14:21:01.852988935+01:00","dependencies":[{"issue_id":"fotospiel-app-bit","depends_on_id":"fotospiel-app-ihd","type":"blocks","created_at":"2026-01-01T14:21:14.445938122+01:00","created_by":"soeren"},{"issue_id":"fotospiel-app-bit","depends_on_id":"fotospiel-app-wde","type":"blocks","created_at":"2026-01-01T14:21:16.788922347+01:00","created_by":"soeren"},{"issue_id":"fotospiel-app-bit","depends_on_id":"fotospiel-app-hbt","type":"blocks","created_at":"2026-01-01T14:21:18.300493488+01:00","created_by":"soeren"},{"issue_id":"fotospiel-app-bit","depends_on_id":"fotospiel-app-arp","type":"blocks","created_at":"2026-01-01T14:21:20.731646568+01:00","created_by":"soeren"},{"issue_id":"fotospiel-app-bit","depends_on_id":"fotospiel-app-tym","type":"blocks","created_at":"2026-01-01T14:21:23.219093242+01:00","created_by":"soeren"},{"issue_id":"fotospiel-app-bit","depends_on_id":"fotospiel-app-sbs","type":"blocks","created_at":"2026-01-01T14:21:24.67996941+01:00","created_by":"soeren"},{"issue_id":"fotospiel-app-bit","depends_on_id":"fotospiel-app-iyc","type":"blocks","created_at":"2026-01-01T14:21:27.027185624+01:00","created_by":"soeren"},{"issue_id":"fotospiel-app-bit","depends_on_id":"fotospiel-app-097","type":"blocks","created_at":"2026-01-01T14:21:29.668197239+01:00","created_by":"soeren"},{"issue_id":"fotospiel-app-bit","depends_on_id":"fotospiel-app-lqp","type":"blocks","created_at":"2026-01-01T14:21:31.238481004+01:00","created_by":"soeren"}]}
+{"id":"fotospiel-app-hbt","title":"Moderation queue for guest content","description":"Queue for flagged guest content (photos, feedback). Bulk actions to hide/delete/resolve with audit.","status":"open","priority":1,"issue_type":"feature","created_at":"2026-01-01T14:18:37.777772819+01:00","updated_at":"2026-01-01T14:18:37.777772819+01:00"}
+{"id":"fotospiel-app-ihd","title":"Superadmin control surface spec and access matrix","description":"Define the minimal superadmin control surface, permissions, and mapping to tenant/guest responsibilities. Document scope and non-goals.","status":"open","priority":2,"issue_type":"task","created_at":"2026-01-01T14:18:10.789147344+01:00","updated_at":"2026-01-01T14:18:10.789147344+01:00"}
+{"id":"fotospiel-app-iyc","title":"Superadmin audit log for admin actions","description":"Audit trail for superadmin actions without PII payloads.","status":"open","priority":2,"issue_type":"feature","created_at":"2026-01-01T14:20:19.043695952+01:00","updated_at":"2026-01-01T14:20:19.043695952+01:00"}
+{"id":"fotospiel-app-lqp","title":"Integrations health (Paddle/RevenueCat/webhooks)","description":"Health/status dashboard for payment and webhook integrations.","status":"open","priority":3,"issue_type":"feature","created_at":"2026-01-01T14:20:25.197673148+01:00","updated_at":"2026-01-01T14:20:25.197673148+01:00"}
+{"id":"fotospiel-app-sbs","title":"Compliance tools: data export + retention overrides","description":"GDPR-compliant export requests and retention override workflows for tenants/events.","status":"open","priority":3,"issue_type":"feature","created_at":"2026-01-01T14:20:16.530289009+01:00","updated_at":"2026-01-01T14:20:16.530289009+01:00"}
+{"id":"fotospiel-app-tym","title":"Ops health dashboard (queues, storage, upload pipeline)","description":"Superadmin ops dashboard showing queue backlog, failed jobs, storage thresholds, and upload pipeline health.","status":"open","priority":2,"issue_type":"feature","created_at":"2026-01-01T14:20:04.991351193+01:00","updated_at":"2026-01-01T14:20:04.991351193+01:00"}
+{"id":"fotospiel-app-wde","title":"Tenant lifecycle controls (status, limits, suspend/grace)","description":"Superadmin controls for tenant status, grace periods, and hard limits (uploads/storage/events). Includes UI, policy checks, and audit events.","status":"open","priority":1,"issue_type":"feature","created_at":"2026-01-01T14:18:23.062036821+01:00","updated_at":"2026-01-01T14:18:23.062036821+01:00"}

.beads/metadata.json

@@ -1,4 +1,5 @@
 {
   "database": "beads.db",
-  "jsonl_export": "interactions.jsonl"
+  "jsonl_export": "issues.jsonl",
+  "last_bd_version": "0.49.0"
 }

.env.example

@@ -97,6 +97,11 @@ GOOGLE_CLIENT_ID=
 GOOGLE_CLIENT_SECRET=
 GOOGLE_REDIRECT_URI=${APP_URL}/checkout/auth/google/callback
 
+# Facebook OAuth (Checkout comfort login)
+FACEBOOK_CLIENT_ID=
+FACEBOOK_CLIENT_SECRET=
+FACEBOOK_REDIRECT_URI=${APP_URL}/checkout/auth/facebook/callback
+
 VITE_APP_NAME="${APP_NAME}"
 VITE_ENABLE_TENANT_SWITCHER=false
 REVENUECAT_WEBHOOK_SECRET=
@@ -112,14 +117,22 @@ PAYPAL_CLIENT_ID=
 PAYPAL_SECRET=
 PAYPAL_SANDBOX=true
 
-# Paddle Billing
+# Lemon Squeezy Billing
-PADDLE_SANDBOX=true
+LEMONSQUEEZY_STORE_ID=284860
-PADDLE_API_KEY=
+LEMONSQUEEZY_API_KEY=
-PADDLE_CLIENT_ID=
+LEMONSQUEEZY_WEBHOOK_SECRET=
-PADDLE_WEBHOOK_SECRET=
+LEMONSQUEEZY_WEBHOOK_EVENTS=
-PADDLE_PUBLIC_KEY=
+LEMONSQUEEZY_TEST_MODE=false
-PADDLE_BASE_URL=
+LEMONSQUEEZY_BASE_URL=https://api.lemonsqueezy.com/v1
-PADDLE_CONSOLE_URL=
+LEMONSQUEEZY_GIFT_VARIANT_STARTER=
+LEMONSQUEEZY_GIFT_VARIANT_STARTER_USD=
+LEMONSQUEEZY_GIFT_VARIANT_STARTER_GBP=
+LEMONSQUEEZY_GIFT_VARIANT_STANDARD=
+LEMONSQUEEZY_GIFT_VARIANT_STANDARD_USD=
+LEMONSQUEEZY_GIFT_VARIANT_STANDARD_GBP=
+LEMONSQUEEZY_GIFT_VARIANT_PREMIUM=
+LEMONSQUEEZY_GIFT_VARIANT_PREMIUM_USD=
+LEMONSQUEEZY_GIFT_VARIANT_PREMIUM_GBP=
 
 # Sanctum / SPA auth
 SANCTUM_STATEFUL_DOMAINS=localhost,localhost:3000
@@ -187,5 +200,9 @@ STORAGE_QUEUE_PENDING_EVENT_MINUTES=8
 STORAGE_QUEUE_FAILED_EVENT_THRESHOLD=2
 STORAGE_QUEUE_FAILED_EVENT_MINUTES=30
 STORAGE_QUEUE_GUEST_ALERT_TTL=30
+STORAGE_CHECKSUM_VALIDATION=true
+STORAGE_CHECKSUM_ALERT_WINDOW_MINUTES=60
+STORAGE_CHECKSUM_WARNING=1
+STORAGE_CHECKSUM_CRITICAL=5
 
 

.gitignore

@@ -12,7 +12,10 @@ fotospiel-tenant-app
 /resources/js/wayfinder
 /storage/*.key
 /storage/pail
+/C:\\wwwroot\\fotospiel-app\\storage\\app/
 /vendor
+/clients/photobooth-uploader/**/bin
+/clients/photobooth-uploader/**/obj
 .env
 .env.backup
 .env.production
@@ -23,11 +26,9 @@ Homestead.yaml
 npm-debug.log
 yarn-error.log
 /auth.json
-/.fleet
-/.idea
-/.nova
 /.vscode
-/.zed
-tools/git-askpass.ps1
-podman-compose.dev.yml
 test-results
+GEMINI.md
+.beads/.sync.lock
+.beads/daemon-error
+.beads/sync_base.jsonl

.tamagui/prompt.md

@@ -337,8 +337,8 @@ Tokens are design system values that can be referenced using the `$` prefix.
 
 ### Color Tokens
 
-- `accent`: #FFB6C1
+- `accent`: #3D5AFE
-- `accentSoft`: #FFE5EC
+- `accentSoft`: #E8ECFF
 - `blue10Dark`: hsl(209, 100%, 60.6%)
 - `blue10Light`: hsl(208, 100%, 47.3%)
 - `blue11Dark`: hsl(210, 100%, 66.1%)
@@ -363,8 +363,8 @@ Tokens are design system values that can be referenced using the `$` prefix.
 - `blue8Light`: hsl(206, 81.9%, 65.3%)
 - `blue9Dark`: hsl(206, 100%, 50.0%)
 - `blue9Light`: hsl(206, 100%, 50.0%)
-- `border`: #F2E4DA
+- `border`: #F3D6C9
-- `danger`: #E04848
+- `danger`: #EF4444
 - `gray10Dark`: hsl(0, 0%, 49.4%)
 - `gray10Light`: hsl(0, 0%, 52.3%)
 - `gray11Dark`: hsl(0, 0%, 62.8%)
@@ -413,7 +413,7 @@ Tokens are design system values that can be referenced using the `$` prefix.
 - `green8Light`: hsl(151, 40.2%, 54.1%)
 - `green9Dark`: hsl(151, 55.0%, 41.5%)
 - `green9Light`: hsl(151, 55.0%, 41.5%)
-- `muted`: #F4ECE8
+- `muted`: #FFF6F0
 - `orange10Dark`: hsl(24, 100%, 58.5%)
 - `orange10Light`: hsl(24, 100%, 46.5%)
 - `orange11Dark`: hsl(24, 100%, 62.2%)
@@ -462,7 +462,7 @@ Tokens are design system values that can be referenced using the `$` prefix.
 - `pink8Light`: hsl(323, 60.3%, 72.4%)
 - `pink9Dark`: hsl(322, 65.0%, 54.5%)
 - `pink9Light`: hsl(322, 65.0%, 54.5%)
-- `primary`: #FF5A5F
+- `primary`: #FF5C5C
 - `purple10Dark`: hsl(273, 57.3%, 59.1%)
 - `purple10Light`: hsl(272, 46.8%, 50.3%)
 - `purple11Dark`: hsl(275, 80.0%, 71.0%)
@@ -511,10 +511,10 @@ Tokens are design system values that can be referenced using the `$` prefix.
 - `red8Light`: hsl(359, 69.5%, 74.3%)
 - `red9Dark`: hsl(358, 75.0%, 59.0%)
 - `red9Light`: hsl(358, 75.0%, 59.0%)
-- `success`: #06D6A0
+- `success`: #22C55E
 - `surface`: #ffffff
-- `text`: #1F2937
+- `text`: #0B132B
-- `warning`: #F5C542
+- `warning`: #FBBF24
 - `yellow10Dark`: hsl(54, 100%, 68.0%)
 - `yellow10Light`: hsl(50, 100%, 48.5%)
 - `yellow11Dark`: hsl(48, 100%, 47.0%)

.tamagui/tamaguibutton-components.config.cjs

@@ -118,319 +118,8 @@ var isWindowDefined = typeof window < "u";
 var isClient = isWeb && isWindowDefined;
 var isChrome = typeof navigator < "u" && /Chrome/.test(navigator.userAgent || "");
 var isWebTouchable = isClient && ("ontouchstart" in window || navigator.maxTouchPoints > 0);
-var isAndroid = false;
 var isIos = process.env.TEST_NATIVE_PLATFORM === "ios";
 
-// node_modules/@tamagui/helpers/dist/esm/validStyleProps.mjs
-var textColors = {
-  color: true,
-  textDecorationColor: true,
-  textShadowColor: true
-};
-var tokenCategories = {
-  radius: {
-    borderRadius: true,
-    borderTopLeftRadius: true,
-    borderTopRightRadius: true,
-    borderBottomLeftRadius: true,
-    borderBottomRightRadius: true,
-    // logical
-    borderStartStartRadius: true,
-    borderStartEndRadius: true,
-    borderEndStartRadius: true,
-    borderEndEndRadius: true
-  },
-  size: {
-    width: true,
-    height: true,
-    minWidth: true,
-    minHeight: true,
-    maxWidth: true,
-    maxHeight: true,
-    blockSize: true,
-    minBlockSize: true,
-    maxBlockSize: true,
-    inlineSize: true,
-    minInlineSize: true,
-    maxInlineSize: true
-  },
-  zIndex: {
-    zIndex: true
-  },
-  color: {
-    backgroundColor: true,
-    borderColor: true,
-    borderBlockStartColor: true,
-    borderBlockEndColor: true,
-    borderBlockColor: true,
-    borderBottomColor: true,
-    borderInlineColor: true,
-    borderInlineStartColor: true,
-    borderInlineEndColor: true,
-    borderTopColor: true,
-    borderLeftColor: true,
-    borderRightColor: true,
-    borderEndColor: true,
-    borderStartColor: true,
-    shadowColor: true,
-    ...textColors,
-    outlineColor: true,
-    caretColor: true
-  }
-};
-var stylePropsUnitless = {
-  WebkitLineClamp: true,
-  animationIterationCount: true,
-  aspectRatio: true,
-  borderImageOutset: true,
-  borderImageSlice: true,
-  borderImageWidth: true,
-  columnCount: true,
-  flex: true,
-  flexGrow: true,
-  flexOrder: true,
-  flexPositive: true,
-  flexShrink: true,
-  flexNegative: true,
-  fontWeight: true,
-  gridRow: true,
-  gridRowEnd: true,
-  gridRowGap: true,
-  gridRowStart: true,
-  gridColumn: true,
-  gridColumnEnd: true,
-  gridColumnGap: true,
-  gridColumnStart: true,
-  gridTemplateColumns: true,
-  gridTemplateAreas: true,
-  lineClamp: true,
-  opacity: true,
-  order: true,
-  orphans: true,
-  tabSize: true,
-  widows: true,
-  zIndex: true,
-  zoom: true,
-  scale: true,
-  scaleX: true,
-  scaleY: true,
-  scaleZ: true,
-  shadowOpacity: true
-};
-var stylePropsTransform = {
-  x: true,
-  y: true,
-  scale: true,
-  perspective: true,
-  scaleX: true,
-  scaleY: true,
-  skewX: true,
-  skewY: true,
-  matrix: true,
-  rotate: true,
-  rotateY: true,
-  rotateX: true,
-  rotateZ: true
-};
-var stylePropsView = {
-  backfaceVisibility: true,
-  borderBottomEndRadius: true,
-  borderBottomStartRadius: true,
-  borderBottomWidth: true,
-  borderLeftWidth: true,
-  borderRightWidth: true,
-  borderBlockWidth: true,
-  borderBlockEndWidth: true,
-  borderBlockStartWidth: true,
-  borderInlineWidth: true,
-  borderInlineEndWidth: true,
-  borderInlineStartWidth: true,
-  borderStyle: true,
-  borderBlockStyle: true,
-  borderBlockEndStyle: true,
-  borderBlockStartStyle: true,
-  borderInlineStyle: true,
-  borderInlineEndStyle: true,
-  borderInlineStartStyle: true,
-  borderTopEndRadius: true,
-  borderTopStartRadius: true,
-  borderTopWidth: true,
-  borderWidth: true,
-  transform: true,
-  transformOrigin: true,
-  alignContent: true,
-  alignItems: true,
-  alignSelf: true,
-  borderEndWidth: true,
-  borderStartWidth: true,
-  bottom: true,
-  display: true,
-  end: true,
-  flexBasis: true,
-  flexDirection: true,
-  flexWrap: true,
-  gap: true,
-  columnGap: true,
-  rowGap: true,
-  justifyContent: true,
-  left: true,
-  margin: true,
-  marginBlock: true,
-  marginBlockEnd: true,
-  marginBlockStart: true,
-  marginInline: true,
-  marginInlineStart: true,
-  marginInlineEnd: true,
-  marginBottom: true,
-  marginEnd: true,
-  marginHorizontal: true,
-  marginLeft: true,
-  marginRight: true,
-  marginStart: true,
-  marginTop: true,
-  marginVertical: true,
-  overflow: true,
-  padding: true,
-  paddingBottom: true,
-  paddingInline: true,
-  paddingBlock: true,
-  paddingBlockStart: true,
-  paddingInlineEnd: true,
-  paddingInlineStart: true,
-  paddingEnd: true,
-  paddingHorizontal: true,
-  paddingLeft: true,
-  paddingRight: true,
-  paddingStart: true,
-  paddingTop: true,
-  paddingVertical: true,
-  position: true,
-  right: true,
-  start: true,
-  top: true,
-  inset: true,
-  insetBlock: true,
-  insetBlockEnd: true,
-  insetBlockStart: true,
-  insetInline: true,
-  insetInlineEnd: true,
-  insetInlineStart: true,
-  direction: true,
-  shadowOffset: true,
-  shadowRadius: true,
-  ...tokenCategories.color,
-  ...tokenCategories.radius,
-  ...tokenCategories.size,
-  ...tokenCategories.radius,
-  ...stylePropsTransform,
-  ...stylePropsUnitless,
-  boxShadow: true,
-  filter: true,
-  // RN 0.77+ style props (set REACT_NATIVE_PRE_77=1 for older RN)
-  ...!process.env.REACT_NATIVE_PRE_77 && {
-    boxSizing: true,
-    mixBlendMode: true,
-    outlineColor: true,
-    outlineSpread: true,
-    outlineStyle: true,
-    outlineWidth: true
-  },
-  // RN doesn't support specific border styles per-edge
-  transition: true,
-  textWrap: true,
-  backdropFilter: true,
-  WebkitBackdropFilter: true,
-  background: true,
-  backgroundAttachment: true,
-  backgroundBlendMode: true,
-  backgroundClip: true,
-  backgroundColor: true,
-  backgroundImage: true,
-  backgroundOrigin: true,
-  backgroundPosition: true,
-  backgroundRepeat: true,
-  backgroundSize: true,
-  borderBottomStyle: true,
-  borderImage: true,
-  borderLeftStyle: true,
-  borderRightStyle: true,
-  borderTopStyle: true,
-  caretColor: true,
-  clipPath: true,
-  contain: true,
-  containerType: true,
-  content: true,
-  cursor: true,
-  float: true,
-  mask: true,
-  maskBorder: true,
-  maskBorderMode: true,
-  maskBorderOutset: true,
-  maskBorderRepeat: true,
-  maskBorderSlice: true,
-  maskBorderSource: true,
-  maskBorderWidth: true,
-  maskClip: true,
-  maskComposite: true,
-  maskImage: true,
-  maskMode: true,
-  maskOrigin: true,
-  maskPosition: true,
-  maskRepeat: true,
-  maskSize: true,
-  maskType: true,
-  objectFit: true,
-  objectPosition: true,
-  outlineOffset: true,
-  overflowBlock: true,
-  overflowInline: true,
-  overflowX: true,
-  overflowY: true,
-  pointerEvents: true,
-  scrollbarWidth: true,
-  textEmphasis: true,
-  touchAction: true,
-  transformStyle: true,
-  userSelect: true,
-  willChange: true,
-  ...isAndroid ? {
-    elevationAndroid: true
-  } : {}
-};
-var stylePropsFont = {
-  fontFamily: true,
-  fontSize: true,
-  fontStyle: true,
-  fontWeight: true,
-  fontVariant: true,
-  letterSpacing: true,
-  lineHeight: true,
-  textTransform: true
-};
-var stylePropsTextOnly = {
-  ...stylePropsFont,
-  textAlign: true,
-  textDecorationLine: true,
-  textDecorationStyle: true,
-  ...textColors,
-  textShadowOffset: true,
-  textShadowRadius: true,
-  userSelect: true,
-  selectable: true,
-  verticalAlign: true,
-  whiteSpace: true,
-  wordWrap: true,
-  textOverflow: true,
-  textDecorationDistance: true,
-  cursor: true,
-  WebkitLineClamp: true,
-  WebkitBoxOrient: true
-};
-var stylePropsText = {
-  ...stylePropsView,
-  ...stylePropsTextOnly
-};
-
 // node_modules/@tamagui/helpers/dist/esm/withStaticProperties.mjs
 var import_react2 = __toESM(require("react"), 1);
 var Decorated = Symbol();
@@ -755,7 +444,10 @@ var SizableText2 = (0, import_web4.styled)(import_web4.Text, {
   }
 });
 SizableText2.staticConfig.variants.fontFamily = {
-  "...": /* @__PURE__ */ __name((_val, extras) => {
+  "...": /* @__PURE__ */ __name((val, extras) => {
+    if (val === "inherit") return {
+      fontFamily: "inherit"
+    };
     const sizeProp = extras.props.size, fontSizeProp = extras.props.fontSize, size = sizeProp === "$true" && fontSizeProp ? fontSizeProp : extras.props.size || "$true";
     return getFontSized(size, extras);
   }, "...")

.tamagui/tamaguitext-components.config.cjs

@@ -112,7 +112,10 @@ var SizableText2 = (0, import_web2.styled)(import_web2.Text, {
   }
 });
 SizableText2.staticConfig.variants.fontFamily = {
-  "...": /* @__PURE__ */ __name((_val, extras) => {
+  "...": /* @__PURE__ */ __name((val, extras) => {
+    if (val === "inherit") return {
+      fontFamily: "inherit"
+    };
     const sizeProp = extras.props.size, fontSizeProp = extras.props.fontSize, size = sizeProp === "$true" && fontSizeProp ? fontSizeProp : extras.props.size || "$true";
     return getFontSized(size, extras);
   }, "...")

AGENTS.md

@@ -27,18 +27,20 @@ This repository hosts a multi-tenant event photo platform (Laravel 12, PHP 8.3,
 - Languages/Frameworks: PHP 8.2+ (Laravel 12), TypeScript/JavaScript (React 19/Vite 7/Tailwind 4), Filament 4.
 - Dev Commands: composer, npm, vite, artisan, PHPUnit, Pint/ESLint, Docker/Compose (for dev), Playwright, Vitest, TypeScript.
 
-- Libraries: simplesoftwareio/simple-qrcode for server-side QR generation; Paddle API client (custom service) for payments; dompdf for PDF generation; spatie/laravel-translatable for i18n; minishlink/web-push for web push; firebase/php-jwt for JWT; Sentry (Laravel + Vite); Stripe (PHP + JS); Tamagui (design system); i18next (frontend i18n); vite-plugin-pwa for PWA builds.
+- Libraries: simplesoftwareio/simple-qrcode for server-side QR generation; Lemon Squeezy API client (custom service) for payments; dompdf for PDF generation; spatie/laravel-translatable for i18n; minishlink/web-push for web push; firebase/php-jwt for JWT; Sentry (Laravel + Vite); Stripe (PHP + JS); Tamagui (design system); i18next (frontend i18n); vite-plugin-pwa for PWA builds.
-- Payment Systems: Paddle (subscriptions and one-time payments), RevenueCat (mobile app subscriptions), Stripe (legacy/integration use).
+- Payment Systems: Lemon Squeezy (subscriptions and one-time payments), RevenueCat (mobile app subscriptions), Stripe (legacy/integration use).
 - PWA Technologies: React 19, Vite 7, Capacitor (iOS), Trusted Web Activity (Android), Service Workers, Background Sync.
 
 ## Repo Structure (high-level)
 - docs/archive/prp/ — split PRP (authoritative). Start at docs/archive/prp/README.md.
-- docs/process/changes/ — session change logs.
+- .beads/ — bd issue tracker data (source of truth for backlog and progress).
-- docs/process/todo/ — prioritized backlog items (replaces single TODO.md file).
 - resources/js/guest/ — Guest PWA source (React 19, offline-first, installable).
 - resources/js/admin/ — Tenant Admin PWA source (React 19, Capacitor/TWA ready).
 - resources/js/pages/ — Inertia pages (React).
 - docs/archive/README.md — historical PRP context.
+- Marketing frontend language files:
+  - Source translations: `resources/lang/{de,en}/marketing.php` and `resources/lang/{de,en}/marketing.json`.
+  - Runtime i18next JSON served to the frontend: `public/lang/{de,en}/marketing.json` (must stay in sync with the source files).
 
 ## Standard Workflows
 - Coding tasks (Codegen Agent):
@@ -48,7 +50,7 @@ This repository hosts a multi-tenant event photo platform (Laravel 12, PHP 8.3,
   4) Update docs when public surfaces change (PRP, docs/*).
   5) Propose follow-ups as Issues if out of scope.
 - Issue hygiene (Ops Agent):
-  - Import docs/process/todo/ tasks as Issues with label TODO; group by Milestone (e.g., Now, Security & Compliance).
+  - Track backlog and follow-ups in bd; avoid duplicates by checking existing titles before creating new issues.
   - Avoid duplicates by checking existing titles.
 - Releases (Ops Agent):
   - Tag with semantic version; generate changelog from commits/PRs; ensure legal pages and migration notes are updated.
@@ -59,7 +61,7 @@ This repository hosts a multi-tenant event photo platform (Laravel 12, PHP 8.3,
 #### Billing & Packages
 - package:check-status — check event package status.
 - packages:migrate-legacy — migrate legacy package purchases.
-- paddle:sync-packages — sync packages with Paddle (push/pull/queue/dry-run).
+- lemonsqueezy:sync-packages — sync packages with Lemon Squeezy (push/pull/queue/dry-run).
 - coupons:export — export coupon redemptions.
 - checkout:send-reminders — send abandoned checkout reminders (dry-run supported).
 
@@ -94,7 +96,7 @@ This repository hosts a multi-tenant event photo platform (Laravel 12, PHP 8.3,
 - metrics:package-limits — inspect/reset package limit metrics (routes/console.php).
 - inspire — inspiring quote (routes/console.php).
 - Public APIs for Guest PWA: stats/photos endpoints with ETag; likes; uploads; see docs/archive/prp/03-api.md.
-- Payment Integration: Paddle webhooks, RevenueCat mobile subscriptions.
+- Payment Integration: Lemon Squeezy webhooks, RevenueCat mobile subscriptions.
 
 ## PWA Architecture
 - Guest PWA: Offline-first photo sharing app for event attendees (installable, background sync, no account required).
@@ -130,7 +132,7 @@ The Laravel Boost guidelines are specifically curated by Laravel maintainers for
 ## Foundational Context
 This application is a Laravel application and its main Laravel ecosystems package & versions are below. You are an expert with them all. Ensure you abide by these specific packages & versions.
 
-- php - 8.3.24
+- php - 8.3.6
 - filament/filament (FILAMENT) - v4
 - inertiajs/inertia-laravel (INERTIA) - v2
 - laravel/framework (LARAVEL) - v12
@@ -152,7 +154,7 @@ This application is a Laravel application and its main Laravel ecosystems packag
 - prettier (PRETTIER) - v3
 
 ## Conventions
-- You must follow all existing code conventions used in this application. When creating or editing a file, check sibling files for the correct structure, approach, naming.
+- You must follow all existing code conventions used in this application. When creating or editing a file, check sibling files for the correct structure, approach, and naming.
 - Use descriptive names for variables and methods. For example, `isRegisteredForDiscounts`, not `discount()`.
 - Check for existing components to reuse before writing a new one.
 
@@ -160,7 +162,7 @@ This application is a Laravel application and its main Laravel ecosystems packag
 - Do not create verification scripts or tinker when tests cover that functionality and prove it works. Unit and feature tests are more important.
 
 ## Application Structure & Architecture
-- Stick to existing directory structure - don't create new base folders without approval.
+- Stick to existing directory structure; don't create new base folders without approval.
 - Do not change the application's dependencies without approval.
 
 ## Frontend Bundling
@@ -172,17 +174,16 @@ This application is a Laravel application and its main Laravel ecosystems packag
 ## Documentation Files
 - You must only create documentation files if explicitly requested by the user.
 
-
 === boost rules ===
 
 ## Laravel Boost
 - Laravel Boost is an MCP server that comes with powerful tools designed specifically for this application. Use them.
 
 ## Artisan
-- Use the `list-artisan-commands` tool when you need to call an Artisan command to double check the available parameters.
+- Use the `list-artisan-commands` tool when you need to call an Artisan command to double-check the available parameters.
 
 ## URLs
-- Whenever you share a project URL with the user you should use the `get-absolute-url` tool to ensure you're using the correct scheme, domain / IP, and port.
+- Whenever you share a project URL with the user, you should use the `get-absolute-url` tool to ensure you're using the correct scheme, domain/IP, and port.
 
 ## Tinker / Debugging
 - You should use the `tinker` tool when you need to execute PHP to debug code or query Eloquent models directly.
@@ -193,22 +194,21 @@ This application is a Laravel application and its main Laravel ecosystems packag
 - Only recent browser logs will be useful - ignore old logs.
 
 ## Searching Documentation (Critically Important)
-- Boost comes with a powerful `search-docs` tool you should use before any other approaches. This tool automatically passes a list of installed packages and their versions to the remote Boost API, so it returns only version-specific documentation specific for the user's circumstance. You should pass an array of packages to filter on if you know you need docs for particular packages.
+- Boost comes with a powerful `search-docs` tool you should use before any other approaches when dealing with Laravel or Laravel ecosystem packages. This tool automatically passes a list of installed packages and their versions to the remote Boost API, so it returns only version-specific documentation for the user's circumstance. You should pass an array of packages to filter on if you know you need docs for particular packages.
-- The 'search-docs' tool is perfect for all Laravel related packages, including Laravel, Inertia, Livewire, Filament, Tailwind, Pest, Nova, Nightwatch, etc.
+- The `search-docs` tool is perfect for all Laravel-related packages, including Laravel, Inertia, Livewire, Filament, Tailwind, Pest, Nova, Nightwatch, etc.
-- You must use this tool to search for Laravel-ecosystem documentation before falling back to other approaches.
+- You must use this tool to search for Laravel ecosystem documentation before falling back to other approaches.
 - Search the documentation before making code changes to ensure we are taking the correct approach.
-- Use multiple, broad, simple, topic based queries to start. For example: `['rate limiting', 'routing rate limiting', 'routing']`.
+- Use multiple, broad, simple, topic-based queries to start. For example: `['rate limiting', 'routing rate limiting', 'routing']`.
-- Do not add package names to queries - package information is already shared. For example, use `test resource table`, not `filament 4 test resource table`.
+- Do not add package names to queries; package information is already shared. For example, use `test resource table`, not `filament 4 test resource table`.
 
 ### Available Search Syntax
 - You can and should pass multiple queries at once. The most relevant results will be returned first.
 
-1. Simple Word Searches with auto-stemming - query=authentication - finds 'authenticate' and 'auth'
+1. Simple Word Searches with auto-stemming - query=authentication - finds 'authenticate' and 'auth'.
-2. Multiple Words (AND Logic) - query=rate limit - finds knowledge containing both "rate" AND "limit"
+2. Multiple Words (AND Logic) - query=rate limit - finds knowledge containing both "rate" AND "limit".
-3. Quoted Phrases (Exact Position) - query="infinite scroll" - Words must be adjacent and in that order
+3. Quoted Phrases (Exact Position) - query="infinite scroll" - words must be adjacent and in that order.
-4. Mixed Queries - query=middleware "rate limit" - "middleware" AND exact phrase "rate limit"
+4. Mixed Queries - query=middleware "rate limit" - "middleware" AND exact phrase "rate limit".
-5. Multiple Queries - queries=["authentication", "middleware"] - ANY of these terms
+5. Multiple Queries - queries=["authentication", "middleware"] - ANY of these terms.
-
 
 === php rules ===
 
@@ -219,7 +219,7 @@ This application is a Laravel application and its main Laravel ecosystems packag
 ### Constructors
 - Use PHP 8 constructor property promotion in `__construct()`.
     - <code-snippet>public function __construct(public GitHub $github) { }</code-snippet>
-- Do not allow empty `__construct()` methods with zero parameters.
+- Do not allow empty `__construct()` methods with zero parameters unless the constructor is private.
 
 ### Type Declarations
 - Always use explicit return type declarations for methods and functions.
@@ -233,7 +233,7 @@ protected function isAccessible(User $user, ?string $path = null): bool
 </code-snippet>
 
 ## Comments
-- Prefer PHPDoc blocks over comments. Never use comments within the code itself unless there is something _very_ complex going on.
+- Prefer PHPDoc blocks over inline comments. Never use comments within the code itself unless there is something very complex going on.
 
 ## PHPDoc Blocks
 - Add useful array shape type definitions for arrays when appropriate.
@@ -241,32 +241,22 @@ protected function isAccessible(User $user, ?string $path = null): bool
 ## Enums
 - Typically, keys in an Enum should be TitleCase. For example: `FavoritePerson`, `BestLake`, `Monthly`.
 
-
-=== herd rules ===
-
-## Laravel Herd
-
-- The application is served by Laravel Herd and will be available at: https?://[kebab-case-project-dir].test. Use the `get-absolute-url` tool to generate URLs for the user to ensure valid URLs.
-- You must not run any commands to make the site available via HTTP(s). It is _always_ available through Laravel Herd.
-
-
 === tests rules ===
 
 ## Test Enforcement
 
 - Every change must be programmatically tested. Write a new test or update an existing test, then run the affected tests to make sure they pass.
-- Run the minimum number of tests needed to ensure code quality and speed. Use `php artisan test` with a specific filename or filter.
+- Run the minimum number of tests needed to ensure code quality and speed. Use `php artisan test --compact` with a specific filename or filter.
-
 
 === inertia-laravel/core rules ===
 
-## Inertia Core
+## Inertia
 
-- Inertia.js components should be placed in the `resources/js/pages` directory unless specified differently in the JS bundler (vite.config.js).
+- Inertia.js components should be placed in the `resources/js/Pages` directory unless specified differently in the JS bundler (`vite.config.js`).
 - Use `Inertia::render()` for server-side routing instead of traditional Blade views.
-- Use `search-docs` for accurate guidance on all things Inertia.
+- Use the `search-docs` tool for accurate guidance on all things Inertia.
 
-<code-snippet lang="php" name="Inertia::render Example">
+<code-snippet name="Inertia Render Example" lang="php">
 // routes/web.php example
 Route::get('/users', function () {
     return Inertia::render('Users/Index', [
@@ -275,28 +265,26 @@ Route::get('/users', function () {
 });
 </code-snippet>
 
-
 === inertia-laravel/v2 rules ===
 
 ## Inertia v2
 
-- Make use of all Inertia features from v1 & v2. Check the documentation before making any changes to ensure we are taking the correct approach.
+- Make use of all Inertia features from v1 and v2. Check the documentation before making any changes to ensure we are taking the correct approach.
 
 ### Inertia v2 New Features
-- Polling
+- Deferred props.
-- Prefetching
+- Infinite scrolling using merging props and `WhenVisible`.
-- Deferred props
+- Lazy loading data on scroll.
-- Infinite scrolling using merging props and `WhenVisible`
+- Polling.
-- Lazy loading data on scroll
+- Prefetching.
 
 ### Deferred Props & Empty States
-- When using deferred props on the frontend, you should add a nice empty state with pulsing / animated skeleton.
+- When using deferred props on the frontend, you should add a nice empty state with pulsing/animated skeleton.
 
 ### Inertia Form General Guidance
-- The recommended way to build forms when using Inertia is with the `<Form>` component - a useful example is below. Use `search-docs` with a query of `form component` for guidance.
+- The recommended way to build forms when using Inertia is with the `<Form>` component - a useful example is below. Use the `search-docs` tool with a query of `form component` for guidance.
-- Forms can also be built using the `useForm` helper for more programmatic control, or to follow existing conventions. Use `search-docs` with a query of `useForm helper` for guidance.
+- Forms can also be built using the `useForm` helper for more programmatic control, or to follow existing conventions. Use the `search-docs` tool with a query of `useForm helper` for guidance.
-- `resetOnError`, `resetOnSuccess`, and `setDefaultsOnSuccess` are available on the `<Form>` component. Use `search-docs` with a query of 'form component resetting' for guidance.
+- `resetOnError`, `resetOnSuccess`, and `setDefaultsOnSuccess` are available on the `<Form>` component. Use the `search-docs` tool with a query of `form component resetting` for guidance.
-
 
 === laravel/core rules ===
 
@@ -308,7 +296,7 @@ Route::get('/users', function () {
 
 ### Database
 - Always use proper Eloquent relationship methods with return type hints. Prefer relationship methods over raw queries or manual joins.
-- Use Eloquent models and relationships before suggesting raw database queries
+- Use Eloquent models and relationships before suggesting raw database queries.
 - Avoid `DB::`; prefer `Model::query()`. Generate code that leverages Laravel's ORM capabilities rather than bypassing them.
 - Generate code that prevents N+1 query problems by using eager loading.
 - Use Laravel's query builder for very complex database operations.
@@ -343,52 +331,56 @@ Route::get('/users', function () {
 ### Vite Error
 - If you receive an "Illuminate\Foundation\ViteException: Unable to locate file in Vite manifest" error, you can run `npm run build` or ask the user to run `npm run dev` or `composer run dev`.
 
-
 === laravel/v12 rules ===
 
 ## Laravel 12
 
-- Use the `search-docs` tool to get version specific documentation.
+- Use the `search-docs` tool to get version-specific documentation.
 - This project upgraded from Laravel 10 without migrating to the new streamlined Laravel file structure.
-- This is **perfectly fine** and recommended by Laravel. Follow the existing structure from Laravel 10. We do not to need migrate to the new Laravel structure unless the user explicitly requests that.
+- This is **perfectly fine** and recommended by Laravel. Follow the existing structure from Laravel 10. We do not need to migrate to the new Laravel structure unless the user explicitly requests it.
-
 
+### Laravel 10 Structure
+- Middleware typically lives in `app/Http/Middleware/` and service providers in `app/Providers/`.
+- There is no `bootstrap/app.php` application configuration in a Laravel 10 structure:
+    - Middleware registration happens in `app/Http/Kernel.php`
+    - Exception handling is in `app/Exceptions/Handler.php`
+    - Console commands and schedule register in `app/Console/Kernel.php`
+    - Rate limits likely exist in `RouteServiceProvider` or `app/Http/Kernel.php`
 
 ### Database
 - When modifying a column, the migration must include all of the attributes that were previously defined on the column. Otherwise, they will be dropped and lost.
-- Laravel 11 allows limiting eagerly loaded records natively, without external packages: `$query->latest()->limit(10);`.
+- Laravel 12 allows limiting eagerly loaded records natively, without external packages: `$query->latest()->limit(10);`.
 
 ### Models
 - Casts can and likely should be set in a `casts()` method on a model rather than the `$casts` property. Follow existing conventions from other models.
 
-
 === wayfinder/core rules ===
 
 ## Laravel Wayfinder
 
-Wayfinder generates TypeScript functions and types for Laravel controllers and routes which you can import into your client side code. It provides type safety and automatic synchronization between backend routes and frontend code.
+Wayfinder generates TypeScript functions and types for Laravel controllers and routes which you can import into your client-side code. It provides type safety and automatic synchronization between backend routes and frontend code.
 
 ### Development Guidelines
-- Always use `search-docs` to check wayfinder correct usage before implementing any features.
+- Always use the `search-docs` tool to check Wayfinder correct usage before implementing any features.
-- Always Prefer named imports for tree-shaking (e.g., `import { show } from '@/actions/...'`)
+- Always prefer named imports for tree-shaking (e.g., `import { show } from '@/actions/...'`).
-- Avoid default controller imports (prevents tree-shaking)
+- Avoid default controller imports (prevents tree-shaking).
-- Run `php artisan wayfinder:generate` after route changes if Vite plugin isn't installed
+- Run `php artisan wayfinder:generate` after route changes if Vite plugin isn't installed.
 
 ### Feature Overview
-- Form Support: Use `.form()` with `--with-form` flag for HTML form attributes — `<form {...store.form()}>` → `action="/posts" method="post"`
+- Form Support: Use `.form()` with `--with-form` flag for HTML form attributes — `<form {...store.form()}>` → `action="/posts" method="post"`.
-- HTTP Methods: Call `.get()`, `.post()`, `.patch()`, `.put()`, `.delete()` for specific methods — `show.head(1)` → `{ url: "/posts/1", method: "head" }`
+- HTTP Methods: Call `.get()`, `.post()`, `.patch()`, `.put()`, `.delete()` for specific methods — `show.head(1)` → `{ url: "/posts/1", method: "head" }`.
-- Invokable Controllers: Import and invoke directly as functions. For example, `import StorePost from '@/actions/.../StorePostController'; StorePost()`
+- Invokable Controllers: Import and invoke directly as functions. For example, `import StorePost from '@/actions/.../StorePostController'; StorePost()`.
-- Named Routes: Import from `@/routes/` for non-controller routes. For example, `import { show } from '@/routes/post'; show(1)` for route name `post.show`
+- Named Routes: Import from `@/routes/` for non-controller routes. For example, `import { show } from '@/routes/post'; show(1)` for route name `post.show`.
-- Parameter Binding: Detects route keys (e.g., `{post:slug}`) and accepts matching object properties — `show("my-post")` or `show({ slug: "my-post" })`
+- Parameter Binding: Detects route keys (e.g., `{post:slug}`) and accepts matching object properties — `show("my-post")` or `show({ slug: "my-post" })`.
-- Query Merging: Use `mergeQuery` to merge with `window.location.search`, set values to `null` to remove — `show(1, { mergeQuery: { page: 2, sort: null } })`
+- Query Merging: Use `mergeQuery` to merge with `window.location.search`, set values to `null` to remove — `show(1, { mergeQuery: { page: 2, sort: null } })`.
-- Query Parameters: Pass `{ query: {...} }` in options to append params — `show(1, { query: { page: 1 } })` → `"/posts/1?page=1"`
+- Query Parameters: Pass `{ query: {...} }` in options to append params — `show(1, { query: { page: 1 } })` → `"/posts/1?page=1"`.
-- Route Objects: Functions return `{ url, method }` shaped objects — `show(1)` → `{ url: "/posts/1", method: "get" }`
+- Route Objects: Functions return `{ url, method }` shaped objects — `show(1)` → `{ url: "/posts/1", method: "get" }`.
-- URL Extraction: Use `.url()` to get URL string — `show.url(1)` → `"/posts/1"`
+- URL Extraction: Use `.url()` to get URL string — `show.url(1)` → `"/posts/1"`.
 
 ### Example Usage
 
 <code-snippet name="Wayfinder Basic Usage" lang="typescript">
-    // Import controller methods (tree-shakable)
+    // Import controller methods (tree-shakable)...
     import { show, store, update } from '@/actions/App/Http/Controllers/PostController'
 
     // Get route object with URL and method...
@@ -406,7 +398,6 @@ Wayfinder generates TypeScript functions and types for Laravel controllers and r
     postShow(1) // { url: "/posts/1", method: "get" }
 </code-snippet>
 
-
 ### Wayfinder + Inertia
 If your application uses the `<Form>` component from Inertia, you can use Wayfinder to generate form action and method automatically.
 <code-snippet name="Wayfinder Form Component (React)" lang="typescript">
@@ -415,14 +406,14 @@ If your application uses the `<Form>` component from Inertia, you can use Wayfin
 
 </code-snippet>
 
-
 === livewire/core rules ===
 
-## Livewire Core
+## Livewire
-- Use the `search-docs` tool to find exact version specific documentation for how to write Livewire & Livewire tests.
+
-- Use the `php artisan make:livewire [Posts\CreatePost]` artisan command to create new components
+- Use the `search-docs` tool to find exact version-specific documentation for how to write Livewire and Livewire tests.
+- Use the `php artisan make:livewire [Posts\CreatePost]` Artisan command to create new components.
 - State should live on the server, with the UI reflecting it.
-- All Livewire requests hit the Laravel backend, they're like regular HTTP requests. Always validate form data, and run authorization checks in Livewire actions.
+- All Livewire requests hit the Laravel backend; they're like regular HTTP requests. Always validate form data and run authorization checks in Livewire actions.
 
 ## Livewire Best Practices
 - Livewire components require a single root element.
@@ -439,15 +430,14 @@ If your application uses the `<Form>` component from Inertia, you can use Wayfin
 
 - Prefer lifecycle hooks like `mount()`, `updatedFoo()` for initialization and reactive side effects:
 
-<code-snippet name="Lifecycle hook examples" lang="php">
+<code-snippet name="Lifecycle Hook Examples" lang="php">
     public function mount(User $user) { $this->user = $user; }
     public function updatedSearch() { $this->resetPage(); }
 </code-snippet>
 
-
 ## Testing Livewire
 
-<code-snippet name="Example Livewire component test" lang="php">
+<code-snippet name="Example Livewire Component Test" lang="php">
     Livewire::test(Counter::class)
         ->assertSet('count', 0)
         ->call('increment')
@@ -456,19 +446,17 @@ If your application uses the `<Form>` component from Inertia, you can use Wayfin
         ->assertStatus(200);
 </code-snippet>
 
-
+<code-snippet name="Testing Livewire Component Exists on Page" lang="php">
-    <code-snippet name="Testing a Livewire component exists within a page" lang="php">
+    $this->get('/posts/create')
-        $this->get('/posts/create')
+    ->assertSeeLivewire(CreatePost::class);
-        ->assertSeeLivewire(CreatePost::class);
+</code-snippet>
-    </code-snippet>
-
 
 === livewire/v3 rules ===
 
 ## Livewire 3
 
 ### Key Changes From Livewire 2
-- These things changed in Livewire 2, but may not have been updated in this application. Verify this application's setup to ensure you conform with application conventions.
+- These things changed in Livewire 3, but may not have been updated in this application. Verify this application's setup to ensure you conform with application conventions.
     - Use `wire:model.live` for real-time updates, `wire:model` is now deferred by default.
     - Components now use the `App\Livewire` namespace (not `App\Http\Livewire`).
     - Use `$this->dispatch()` to dispatch events (not `emit` or `dispatchBrowserEvent`).
@@ -478,13 +466,13 @@ If your application uses the `<Form>` component from Inertia, you can use Wayfin
 - `wire:show`, `wire:transition`, `wire:cloak`, `wire:offline`, `wire:target` are available for use. Use the documentation to find usage examples.
 
 ### Alpine
-- Alpine is now included with Livewire, don't manually include Alpine.js.
+- Alpine is now included with Livewire; don't manually include Alpine.js.
 - Plugins included with Alpine: persist, intersect, collapse, and focus.
 
 ### Lifecycle Hooks
 - You can listen for `livewire:init` to hook into Livewire initialization, and `fail.status === 419` for the page expiring:
 
-<code-snippet name="livewire:load example" lang="js">
+<code-snippet name="Livewire Init Hook Example" lang="js">
 document.addEventListener('livewire:init', function () {
     Livewire.hook('request', ({ fail }) => {
         if (fail && fail.status === 419) {
@@ -498,7 +486,6 @@ document.addEventListener('livewire:init', function () {
 });
 </code-snippet>
 
-
 === pint/core rules ===
 
 ## Laravel Pint Code Formatter
@@ -506,24 +493,22 @@ document.addEventListener('livewire:init', function () {
 - You must run `vendor/bin/pint --dirty` before finalizing changes to ensure your code matches the project's expected style.
 - Do not run `vendor/bin/pint --test`, simply run `vendor/bin/pint` to fix any formatting issues.
 
-
 === phpunit/core rules ===
 
-## PHPUnit Core
+## PHPUnit
 
 - This application uses PHPUnit for testing. All tests must be written as PHPUnit classes. Use `php artisan make:test --phpunit {name}` to create a new test.
 - If you see a test using "Pest", convert it to PHPUnit.
 - Every time a test has been updated, run that singular test.
 - When the tests relating to your feature are passing, ask the user if they would like to also run the entire test suite to make sure everything is still passing.
 - Tests should test all of the happy paths, failure paths, and weird paths.
-- You must not remove any tests or test files from the tests directory without approval. These are not temporary or helper files, these are core to the application.
+- You must not remove any tests or test files from the tests directory without approval. These are not temporary or helper files; these are core to the application.
 
 ### Running Tests
 - Run the minimal number of tests, using an appropriate filter, before finalizing.
-- To run all tests: `php artisan test`.
+- To run all tests: `php artisan test --compact`.
-- To run all tests in a file: `php artisan test tests/Feature/ExampleTest.php`.
+- To run all tests in a file: `php artisan test --compact tests/Feature/ExampleTest.php`.
-- To filter on a particular test name: `php artisan test --filter=testName` (recommended after making a change to a related file).
+- To filter on a particular test name: `php artisan test --compact --filter=testName` (recommended after making a change to a related file).
-
 
 === inertia-react/core rules ===
 
@@ -538,10 +523,9 @@ import { Link } from '@inertiajs/react'
 
 </code-snippet>
 
-
 === inertia-react/v2/forms rules ===
 
-## Inertia + React Forms
+## Inertia v2 + React Forms
 
 <code-snippet name="`<Form>` Component Example" lang="react">
 
@@ -576,39 +560,37 @@ export default () => (
 
 </code-snippet>
 
-
 === tailwindcss/core rules ===
 
-## Tailwind Core
+## Tailwind CSS
 
-- Use Tailwind CSS classes to style HTML, check and use existing tailwind conventions within the project before writing your own.
+- Use Tailwind CSS classes to style HTML; check and use existing Tailwind conventions within the project before writing your own.
-- Offer to extract repeated patterns into components that match the project's conventions (i.e. Blade, JSX, Vue, etc..)
+- Offer to extract repeated patterns into components that match the project's conventions (i.e. Blade, JSX, Vue, etc.).
-- Think through class placement, order, priority, and defaults - remove redundant classes, add classes to parent or child carefully to limit repetition, group elements logically
+- Think through class placement, order, priority, and defaults. Remove redundant classes, add classes to parent or child carefully to limit repetition, and group elements logically.
 - You can use the `search-docs` tool to get exact examples from the official documentation when needed.
 
 ### Spacing
-- When listing items, use gap utilities for spacing, don't use margins.
+- When listing items, use gap utilities for spacing; don't use margins.
-
-    <code-snippet name="Valid Flex Gap Spacing Example" lang="html">
-        <div class="flex gap-8">
-            <div>Superior</div>
-            <div>Michigan</div>
-            <div>Erie</div>
-        </div>
-    </code-snippet>
 
+<code-snippet name="Valid Flex Gap Spacing Example" lang="html">
+    <div class="flex gap-8">
+        <div>Superior</div>
+        <div>Michigan</div>
+        <div>Erie</div>
+    </div>
+</code-snippet>
 
 ### Dark Mode
 - If existing pages and components support dark mode, new pages and components must support dark mode in a similar way, typically using `dark:`.
 
-
 === tailwindcss/v4 rules ===
 
-## Tailwind 4
+## Tailwind CSS 4
 
-- Always use Tailwind CSS v4 - do not use the deprecated utilities.
+- Always use Tailwind CSS v4; do not use the deprecated utilities.
 - `corePlugins` is not supported in Tailwind v4.
 - In Tailwind v4, configuration is CSS-first using the `@theme` directive — no separate `tailwind.config.js` file is needed.
+
 <code-snippet name="Extending Theme in CSS" lang="css">
 @theme {
   --color-brand: oklch(0.72 0.11 178);
@@ -624,9 +606,8 @@ export default () => (
    + @import "tailwindcss";
 </code-snippet>
 
-
 ### Replaced Utilities
-- Tailwind v4 removed deprecated utilities. Do not use the deprecated option - use the replacement.
+- Tailwind v4 removed deprecated utilities. Do not use the deprecated option; use the replacement.
 - Opacity values are still numeric.
 
 | Deprecated |	Replacement |
@@ -642,6 +623,134 @@ export default () => (
 | overflow-ellipsis | text-ellipsis |
 | decoration-slice | box-decoration-slice |
 | decoration-clone | box-decoration-clone |
+
+=== filament/filament rules ===
+
+## Filament
+
+- Filament is used by this application. Follow existing conventions for how and where it's implemented.
+- Filament is a Server-Driven UI (SDUI) framework for Laravel that lets you define user interfaces in PHP using structured configuration objects. Built on Livewire, Alpine.js, and Tailwind CSS.
+- Use the `search-docs` tool for official documentation on Artisan commands, code examples, testing, relationships, and idiomatic practices.
+
+### Artisan
+
+- Use Filament-specific Artisan commands to create files. Find them with `list-artisan-commands` or `php artisan --help`.
+- Inspect required options and always pass `--no-interaction`.
+
+### Patterns
+
+Use static `make()` methods to initialize components. Most configuration methods accept a `Closure` for dynamic values.
+
+Use `Get $get` to read other form field values for conditional logic:
+
+<code-snippet name="Conditional form field" lang="php">
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\TextInput;
+use Filament\Schemas\Components\Utilities\Get;
+
+Select::make('type')
+    ->options(CompanyType::class)
+    ->required()
+    ->live(),
+
+TextInput::make('company_name')
+    ->required()
+    ->visible(fn (Get $get): bool => $get('type') === 'business'),
+</code-snippet>
+
+Use `state()` with a `Closure` to compute derived column values:
+
+<code-snippet name="Computed table column" lang="php">
+use Filament\Tables\Columns\TextColumn;
+
+TextColumn::make('full_name')
+    ->state(fn (User $record): string => "{$record->first_name} {$record->last_name}"),
+</code-snippet>
+
+Actions encapsulate a button with optional modal form and logic:
+
+<code-snippet name="Action with modal form" lang="php">
+use Filament\Actions\Action;
+use Filament\Forms\Components\TextInput;
+
+Action::make('updateEmail')
+    ->form([
+        TextInput::make('email')->email()->required(),
+    ])
+    ->action(fn (array $data, User $record): void => $record->update($data)),
+</code-snippet>
+
+### Testing
+
+Authenticate before testing panel functionality. Filament uses Livewire, so use `livewire()` or `Livewire::test()`:
+
+<code-snippet name="Filament Table Test" lang="php">
+    livewire(ListUsers::class)
+        ->assertCanSeeTableRecords($users)
+        ->searchTable($users->first()->name)
+        ->assertCanSeeTableRecords($users->take(1))
+        ->assertCanNotSeeTableRecords($users->skip(1));
+</code-snippet>
+
+<code-snippet name="Filament Create Resource Test" lang="php">
+    livewire(CreateUser::class)
+        ->fillForm([
+            'name' => 'Test',
+            'email' => 'test@example.com',
+        ])
+        ->call('create')
+        ->assertNotified()
+        ->assertRedirect();
+
+    assertDatabaseHas(User::class, [
+        'name' => 'Test',
+        'email' => 'test@example.com',
+    ]);
+</code-snippet>
+
+<code-snippet name="Testing Validation" lang="php">
+    livewire(CreateUser::class)
+        ->fillForm([
+            'name' => null,
+            'email' => 'invalid-email',
+        ])
+        ->call('create')
+        ->assertHasFormErrors([
+            'name' => 'required',
+            'email' => 'email',
+        ])
+        ->assertNotNotified();
+</code-snippet>
+
+<code-snippet name="Calling Actions" lang="php">
+    use Filament\Actions\DeleteAction;
+    use Filament\Actions\Testing\TestAction;
+
+    livewire(EditUser::class, ['record' => $user->id])
+        ->callAction(DeleteAction::class)
+        ->assertNotified()
+        ->assertRedirect();
+
+    livewire(ListUsers::class)
+        ->callAction(TestAction::make('promote')->table($user), [
+            'role' => 'admin',
+        ])
+        ->assertNotified();
+</code-snippet>
+
+### Common Mistakes
+
+**Commonly Incorrect Namespaces:**
+- Form fields (TextInput, Select, etc.): `Filament\Forms\Components\`
+- Infolist entries (for read-only views) (TextEntry, IconEntry, etc.): `Filament\Forms\Components\`
+- Layout components (Grid, Section, Fieldset, Tabs, Wizard, etc.): `Filament\Schemas\Components\`
+- Schema utilities (Get, Set, etc.): `Filament\Schemas\Components\Utilities\`
+- Actions: `Filament\Actions\` (no `Filament\Tables\Actions\` etc.)
+- Icons: `Filament\Support\Icons\Heroicon` enum (e.g., `Heroicon::PencilSquare`)
+
+**Recent breaking changes to Filament:**
+- File visibility is `private` by default. Use `->visibility('public')` for public access.
+- `Grid`, `Section`, and `Fieldset` no longer span all columns by default.
 </laravel-boost-guidelines>
 
 ## Issue Tracking

Dockerfile

@@ -100,6 +100,8 @@ COPY . .
 COPY --from=vendor /var/www/html/vendor ./vendor
 COPY --from=node_builder /var/www/html/public/build ./public/build
 
+RUN php artisan vendor:publish --tag=livewire:assets --force --no-interaction
+
 RUN php artisan config:clear \
    && php artisan config:cache \
    && php artisan route:clear \

app/Console/Commands/AiEditsBackfillStorageCommand.php

@@ -0,0 +1,144 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\AiEditOutput;
+use App\Models\AiEditRequest;
+use App\Services\AiEditing\AiEditOutputStorageService;
+use Illuminate\Console\Command;
+use Illuminate\Database\Eloquent\Builder;
+
+class AiEditsBackfillStorageCommand extends Command
+{
+    protected $signature = 'ai-edits:backfill-storage
+        {--request-id= : Restrict backfill to one AI edit request id}
+        {--limit=200 : Maximum outputs to process}
+        {--pretend : Dry run without writing changes}';
+
+    protected $description = 'Backfill local storage paths for AI outputs that only have provider URLs.';
+
+    public function __construct(private readonly AiEditOutputStorageService $outputStorage)
+    {
+        parent::__construct();
+    }
+
+    public function handle(): int
+    {
+        $limit = max(1, (int) $this->option('limit'));
+        $requestId = $this->normalizeRequestId($this->option('request-id'));
+        $pretend = (bool) $this->option('pretend');
+
+        $query = AiEditOutput::query()
+            ->with('request')
+            ->whereNotNull('provider_url')
+            ->where(function (Builder $builder): void {
+                $builder
+                    ->whereNull('storage_path')
+                    ->orWhere('storage_path', '');
+            })
+            ->orderBy('id');
+
+        if ($requestId !== null) {
+            $query->where('request_id', $requestId);
+        }
+
+        $candidateCount = (clone $query)->count();
+        $outputs = $query->limit($limit)->get();
+
+        if ($outputs->isEmpty()) {
+            $this->info('No AI outputs require storage backfill.');
+
+            return self::SUCCESS;
+        }
+
+        $this->line(sprintf(
+            'AI output backfill candidates: %d (processing up to %d).',
+            $candidateCount,
+            $limit
+        ));
+
+        if ($pretend) {
+            $this->table(
+                ['Output ID', 'Request ID', 'Provider URL'],
+                $outputs->map(static fn (AiEditOutput $output): array => [
+                    (string) $output->id,
+                    (string) $output->request_id,
+                    (string) $output->provider_url,
+                ])->all()
+            );
+
+            $this->info('Pretend mode enabled. No records were changed.');
+
+            return self::SUCCESS;
+        }
+
+        $processed = 0;
+        $stored = 0;
+        $failed = 0;
+
+        foreach ($outputs as $output) {
+            $processed++;
+
+            $request = $output->request;
+            if (! $request instanceof AiEditRequest) {
+                $failed++;
+                $this->warn(sprintf('Output %d skipped: missing request relation.', $output->id));
+
+                continue;
+            }
+
+            $persisted = $this->outputStorage->persist($request, [
+                'provider_url' => $output->provider_url,
+                'provider_asset_id' => $output->provider_asset_id,
+                'storage_disk' => $output->storage_disk,
+                'storage_path' => $output->storage_path,
+                'mime_type' => $output->mime_type,
+                'width' => $output->width,
+                'height' => $output->height,
+                'bytes' => $output->bytes,
+                'checksum' => $output->checksum,
+                'metadata' => $output->metadata,
+            ]);
+
+            $output->forceFill([
+                'provider_url' => $persisted['provider_url'] ?? $output->provider_url,
+                'storage_disk' => $persisted['storage_disk'] ?? $output->storage_disk,
+                'storage_path' => $persisted['storage_path'] ?? $output->storage_path,
+                'mime_type' => $persisted['mime_type'] ?? $output->mime_type,
+                'width' => array_key_exists('width', $persisted) ? $persisted['width'] : $output->width,
+                'height' => array_key_exists('height', $persisted) ? $persisted['height'] : $output->height,
+                'bytes' => array_key_exists('bytes', $persisted) ? $persisted['bytes'] : $output->bytes,
+                'checksum' => $persisted['checksum'] ?? $output->checksum,
+                'metadata' => is_array($persisted['metadata'] ?? null) ? $persisted['metadata'] : $output->metadata,
+            ])->save();
+
+            $storagePath = trim((string) ($output->storage_path ?? ''));
+            if ($storagePath !== '') {
+                $stored++;
+            } else {
+                $failed++;
+                $this->warn(sprintf('Output %d could not be persisted locally.', $output->id));
+            }
+        }
+
+        $this->info(sprintf(
+            'AI output backfill complete: processed=%d stored=%d failed=%d.',
+            $processed,
+            $stored,
+            $failed
+        ));
+
+        return self::SUCCESS;
+    }
+
+    private function normalizeRequestId(mixed $value): ?int
+    {
+        if (! is_numeric($value)) {
+            return null;
+        }
+
+        $requestId = (int) $value;
+
+        return $requestId > 0 ? $requestId : null;
+    }
+}

app/Console/Commands/AiEditsPruneCommand.php

@@ -0,0 +1,69 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\AiEditRequest;
+use App\Models\AiUsageLedger;
+use Illuminate\Console\Command;
+use Illuminate\Database\Eloquent\Builder;
+
+class AiEditsPruneCommand extends Command
+{
+    protected $signature = 'ai-edits:prune
+        {--request-days= : Override AI request retention days}
+        {--ledger-days= : Override usage ledger retention days}
+        {--pretend : Report counts without deleting data}';
+
+    protected $description = 'Prune stale AI edit requests and usage ledgers based on retention settings.';
+
+    public function handle(): int
+    {
+        $requestRetentionDays = max(1, (int) ($this->option('request-days') ?: config('ai-editing.retention.request_days', 90)));
+        $ledgerRetentionDays = max(1, (int) ($this->option('ledger-days') ?: config('ai-editing.retention.usage_ledger_days', 365)));
+        $pretend = (bool) $this->option('pretend');
+
+        $requestCutoff = now()->subDays($requestRetentionDays);
+        $ledgerCutoff = now()->subDays($ledgerRetentionDays);
+
+        $requestQuery = AiEditRequest::query()
+            ->where(function (Builder $query) use ($requestCutoff): void {
+                $query->where(function (Builder $completedQuery) use ($requestCutoff): void {
+                    $completedQuery->whereNotNull('completed_at')
+                        ->where('completed_at', '<=', $requestCutoff);
+                })->orWhere(function (Builder $expiredQuery): void {
+                    $expiredQuery->whereNotNull('expires_at')
+                        ->where('expires_at', '<=', now());
+                });
+            });
+        $ledgerQuery = AiUsageLedger::query()
+            ->where('recorded_at', '<=', $ledgerCutoff);
+
+        $requestCount = (clone $requestQuery)->count();
+        $ledgerCount = (clone $ledgerQuery)->count();
+
+        $this->line(sprintf(
+            'AI prune candidates -> requests: %d (<= %s), ledgers: %d (<= %s)',
+            $requestCount,
+            $requestCutoff->toDateString(),
+            $ledgerCount,
+            $ledgerCutoff->toDateString()
+        ));
+
+        if ($pretend) {
+            $this->info('Pretend mode enabled. No records were deleted.');
+
+            return self::SUCCESS;
+        }
+
+        $deletedRequests = $requestQuery->delete();
+        $deletedLedgers = $ledgerQuery->delete();
+
+        $this->info(sprintf(
+            'Pruned AI data -> requests: %d, ledgers: %d.',
+            $deletedRequests,
+            $deletedLedgers
+        ));
+
+        return self::SUCCESS;
+    }
+}

app/Console/Commands/AiEditsRecoverStuckCommand.php

@@ -0,0 +1,179 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Jobs\PollAiEditRequest;
+use App\Jobs\ProcessAiEditRequest;
+use App\Models\AiEditRequest;
+use App\Services\AiEditing\AiEditingRuntimeConfig;
+use Illuminate\Console\Command;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Support\Collection;
+
+class AiEditsRecoverStuckCommand extends Command
+{
+    protected $signature = 'ai-edits:recover-stuck
+        {--minutes=30 : Minimum age in minutes for queued/processing requests}
+        {--requeue : Re-dispatch stuck requests back to the queue}
+        {--fail : Mark stuck requests as failed}';
+
+    protected $description = 'Inspect stuck AI edit requests and optionally recover them by requeueing or failing.';
+
+    public function __construct(private readonly AiEditingRuntimeConfig $runtimeConfig)
+    {
+        parent::__construct();
+    }
+
+    public function handle(): int
+    {
+        $minutes = max(1, (int) $this->option('minutes'));
+        $shouldRequeue = (bool) $this->option('requeue');
+        $shouldFail = (bool) $this->option('fail');
+
+        if ($shouldRequeue && $shouldFail) {
+            $this->error('Use either --requeue or --fail, not both.');
+
+            return self::FAILURE;
+        }
+
+        $cutoff = now()->subMinutes($minutes);
+        $requests = AiEditRequest::query()
+            ->with([
+                'event:id,slug,name',
+                'providerRuns' => function (HasMany $query): void {
+                    $query->select(['id', 'request_id', 'provider_task_id', 'attempt'])
+                        ->orderByDesc('attempt');
+                },
+            ])
+            ->whereIn('status', [AiEditRequest::STATUS_QUEUED, AiEditRequest::STATUS_PROCESSING])
+            ->where(function (Builder $query) use ($cutoff): void {
+                $query
+                    ->where(function (Builder $queuedQuery) use ($cutoff): void {
+                        $queuedQuery->whereNull('started_at')
+                            ->whereNotNull('queued_at')
+                            ->where('queued_at', '<=', $cutoff);
+                    })
+                    ->orWhere(function (Builder $processingQuery) use ($cutoff): void {
+                        $processingQuery->whereNotNull('started_at')
+                            ->where('started_at', '<=', $cutoff);
+                    })
+                    ->orWhere(function (Builder $fallbackQuery) use ($cutoff): void {
+                        $fallbackQuery->whereNull('queued_at')
+                            ->whereNull('started_at')
+                            ->where('updated_at', '<=', $cutoff);
+                    });
+            })
+            ->orderBy('updated_at')
+            ->get();
+
+        if ($requests->isEmpty()) {
+            $this->info(sprintf('No stuck AI edit requests older than %d minute(s).', $minutes));
+
+            return self::SUCCESS;
+        }
+
+        $this->table(
+            ['ID', 'Event', 'Status', 'Queued/Started', 'Latest task'],
+            $requests->map(function (AiEditRequest $request): array {
+                $latestTaskId = $this->latestProviderTaskId($request) ?? '-';
+                $eventLabel = (string) ($request->event?->name ?: $request->event?->slug ?: $request->event_id);
+                $ageSource = $request->started_at ?: $request->queued_at ?: $request->updated_at;
+
+                return [
+                    (string) $request->id,
+                    $eventLabel,
+                    $request->status,
+                    $ageSource?->toIso8601String() ?? '-',
+                    $latestTaskId,
+                ];
+            })->all()
+        );
+
+        if (! $shouldRequeue && ! $shouldFail) {
+            $this->info('Dry-run only. Use --requeue to dispatch recovery jobs or --fail to terminate stuck requests.');
+
+            return self::SUCCESS;
+        }
+
+        if ($shouldFail) {
+            $count = $this->markAsFailed($requests);
+            $this->info(sprintf('Marked %d AI edit request(s) as failed.', $count));
+
+            return self::SUCCESS;
+        }
+
+        [$processDispatches, $pollDispatches] = $this->requeueRequests($requests);
+        $this->info(sprintf(
+            'Recovered %d stuck AI edit request(s): %d process dispatch(es), %d poll dispatch(es).',
+            $processDispatches + $pollDispatches,
+            $processDispatches,
+            $pollDispatches
+        ));
+
+        return self::SUCCESS;
+    }
+
+    /**
+     * @return array{0:int,1:int}
+     */
+    private function requeueRequests(Collection $requests): array
+    {
+        $queueName = $this->runtimeConfig->queueName();
+        $processDispatches = 0;
+        $pollDispatches = 0;
+
+        foreach ($requests as $request) {
+            if ($request->status === AiEditRequest::STATUS_QUEUED) {
+                ProcessAiEditRequest::dispatch($request->id)->onQueue($queueName);
+                $processDispatches++;
+
+                continue;
+            }
+
+            $providerTaskId = $this->latestProviderTaskId($request);
+            if ($providerTaskId !== null) {
+                PollAiEditRequest::dispatch($request->id, $providerTaskId, 1)->onQueue($queueName);
+                $pollDispatches++;
+
+                continue;
+            }
+
+            ProcessAiEditRequest::dispatch($request->id)->onQueue($queueName);
+            $processDispatches++;
+        }
+
+        return [$processDispatches, $pollDispatches];
+    }
+
+    private function markAsFailed(Collection $requests): int
+    {
+        $updated = 0;
+        $now = now();
+
+        foreach ($requests as $request) {
+            $request->forceFill([
+                'status' => AiEditRequest::STATUS_FAILED,
+                'failure_code' => 'operator_recovery_marked_failed',
+                'failure_message' => 'Marked as failed by ai-edits:recover-stuck.',
+                'completed_at' => $now,
+            ])->save();
+
+            $updated++;
+        }
+
+        return $updated;
+    }
+
+    private function latestProviderTaskId(AiEditRequest $request): ?string
+    {
+        foreach ($request->providerRuns as $run) {
+            $taskId = trim((string) ($run->provider_task_id ?? ''));
+            if ($taskId !== '') {
+                return $taskId;
+            }
+        }
+
+        return null;
+    }
+}

app/Console/Commands/AttachDemoEvent.php

@@ -7,7 +7,6 @@ use App\Models\Tenant;
 use App\Models\User;
 use Illuminate\Console\Attributes\AsCommand;
 use Illuminate\Console\Command;
-use Illuminate\Support\Facades\DB;
 
 #[AsCommand(name: 'tenant:attach-demo-event')]
 class AttachDemoEvent extends Command
@@ -25,10 +24,12 @@ class AttachDemoEvent extends Command
     {
         if (! \Illuminate\Support\Facades\Schema::hasTable('events')) {
             $this->error("Table 'events' does not exist. Run: php artisan migrate");
+
             return self::FAILURE;
         }
         if (! \Illuminate\Support\Facades\Schema::hasColumn('events', 'tenant_id')) {
             $this->error("Column 'events.tenant_id' does not exist. Add it and rerun. Suggested: create a migration to add a nullable foreignId to tenants.");
+
             return self::FAILURE;
         }
         $tenant = null;
@@ -45,6 +46,7 @@ class AttachDemoEvent extends Command
         }
         if (! $tenant) {
             $this->error('Tenant not found. Provide --tenant-slug or a user with tenant_id via --tenant-email.');
+
             return self::FAILURE;
         }
 
@@ -67,12 +69,14 @@ class AttachDemoEvent extends Command
 
         if (! $event) {
             $this->error('Event not found. Provide --event-id or --event-slug.');
+
             return self::FAILURE;
         }
 
         // Idempotent update
         if ((int) $event->tenant_id === (int) $tenant->id) {
             $this->info("Event #{$event->id} already attached to tenant #{$tenant->id} ({$tenant->slug}).");
+
             return self::SUCCESS;
         }
 
@@ -80,6 +84,7 @@ class AttachDemoEvent extends Command
         $event->save();
 
         $this->info("Attached event #{$event->id} ({$event->slug}) to tenant #{$tenant->id} ({$tenant->slug}).");
+
         return self::SUCCESS;
     }
 }

app/Console/Commands/BackfillThumbnails.php

@@ -10,22 +10,27 @@ use Illuminate\Support\Facades\Storage;
 class BackfillThumbnails extends Command
 {
     protected $signature = 'media:backfill-thumbnails {--limit=500}';
+
     protected $description = 'Generate thumbnails for photos missing thumbnail_path or where thumbnail equals original.';
 
     public function handle(): int
     {
         $limit = (int) $this->option('limit');
         $rows = DB::table('photos')
-            ->select(['id','event_id','file_path','thumbnail_path'])
+            ->select(['id', 'event_id', 'file_path', 'thumbnail_path'])
             ->orderBy('id')
             ->limit($limit)
             ->get();
         $count = 0;
         foreach ($rows as $r) {
-            $orig = $this->relativeFromUrl((string)$r->file_path);
+            $orig = $this->relativeFromUrl((string) $r->file_path);
-            $thumb = (string)($r->thumbnail_path ?? '');
+            $thumb = (string) ($r->thumbnail_path ?? '');
-            if ($thumb && $thumb !== $r->file_path) continue; // already set to different thumb
+            if ($thumb && $thumb !== $r->file_path) {
-            if (! $orig) continue;
+                continue;
+            } // already set to different thumb
+            if (! $orig) {
+                continue;
+            }
             $baseName = pathinfo($orig, PATHINFO_FILENAME);
             $destRel = "events/{$r->event_id}/photos/thumbs/{$baseName}_thumb.jpg";
             $made = ImageHelper::makeThumbnailOnDisk('public', $orig, $destRel, 640, 82);
@@ -39,6 +44,7 @@ class BackfillThumbnails extends Command
             }
         }
         $this->info("Done. Thumbnails generated: {$count}");
+
         return self::SUCCESS;
     }
 
@@ -49,6 +55,7 @@ class BackfillThumbnails extends Command
         if (str_starts_with($p, '/storage/')) {
             return substr($p, strlen('/storage/'));
         }
+
         return null;
     }
 }

app/Console/Commands/DispatchStorageArchiveCommand.php

@@ -5,6 +5,7 @@ namespace App\Console\Commands;
 use App\Console\Concerns\InteractsWithCacheLocks;
 use App\Jobs\ArchiveEventMediaAssets;
 use App\Models\Event;
+use App\Services\Compliance\RetentionOverrideService;
 use Illuminate\Console\Command;
 use Illuminate\Contracts\Cache\Lock;
 use Illuminate\Support\Facades\Log;
@@ -37,6 +38,7 @@ class DispatchStorageArchiveCommand extends Command
         $maxDispatch = max(1, (int) config('storage-monitor.archive.max_dispatch', 100));
         $eventId = $this->option('event');
         $dispatched = 0;
+        $overrides = app(RetentionOverrideService::class);
 
         try {
             $query = Event::query()
@@ -57,12 +59,16 @@ class DispatchStorageArchiveCommand extends Command
                 });
             }
 
-            $query->chunkById($chunkSize, function ($events) use (&$dispatched, $maxDispatch, $eventLockTtl) {
+            $query->chunkById($chunkSize, function ($events) use (&$dispatched, $maxDispatch, $eventLockTtl, $overrides) {
                 foreach ($events as $event) {
                     if ($dispatched >= $maxDispatch) {
                         return false;
                     }
 
+                    if ($overrides->eventOnHold($event)) {
+                        continue;
+                    }
+
                     $eventLock = $this->acquireCommandLock('storage:archive-event-'.$event->id, $eventLockTtl);
                     if ($eventLock === false) {
                         Log::channel('storage-jobs')->info('Archive dispatch skipped due to in-flight lock', [

app/Console/Commands/DispatchTenantAnnouncements.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Services\TenantAnnouncements\TenantAnnouncementService;
+use Illuminate\Console\Command;
+
+class DispatchTenantAnnouncements extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'tenant-announcements:dispatch';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Dispatch scheduled tenant announcements and queue email notifications';
+
+    /**
+     * Execute the console command.
+     */
+    public function handle(TenantAnnouncementService $service): int
+    {
+        $result = $service->process();
+
+        $this->info(sprintf(
+            'Announcements: %d activated, %d archived, %d emails queued.',
+            $result['activated'],
+            $result['archived'],
+            $result['queued'],
+        ));
+
+        return Command::SUCCESS;
+    }
+}

app/Console/Commands/LemonSqueezyRegisterWebhooks.php

@@ -0,0 +1,130 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Services\LemonSqueezy\LemonSqueezyClient;
+use Illuminate\Console\Command;
+use Illuminate\Support\Arr;
+use Illuminate\Support\Facades\Log;
+
+class LemonSqueezyRegisterWebhooks extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'lemonsqueezy:webhooks:register
+        {--url= : Destination URL for Lemon Squeezy webhooks}
+        {--events=* : Override event types to subscribe}
+        {--secret= : Override the webhook signing secret}
+        {--test-mode : Register the webhook in test mode}
+        {--dry-run : Output payload without creating the destination}';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Register Lemon Squeezy webhook notification settings.';
+
+    /**
+     * Execute the console command.
+     */
+    public function handle(LemonSqueezyClient $client): int
+    {
+        $destination = (string) ($this->option('url') ?: $this->defaultWebhookUrl());
+
+        if ($destination === '') {
+            $this->error('Webhook destination URL is required. Use --url=...');
+
+            return self::FAILURE;
+        }
+
+        $events = collect((array) $this->option('events'))
+            ->filter()
+            ->map(fn ($event) => trim((string) $event))
+            ->filter()
+            ->values()
+            ->all();
+
+        if ($events === []) {
+            $events = config('lemonsqueezy.webhook_events', []);
+        }
+
+        if ($events === [] || ! is_array($events)) {
+            $this->error('No webhook events configured. Set config(lemonsqueezy.webhook_events) or pass --events.');
+
+            return self::FAILURE;
+        }
+
+        $secret = (string) ($this->option('secret') ?: config('lemonsqueezy.webhook_secret'));
+        if ($secret === '') {
+            $this->error('Webhook signing secret is required. Set LEMONSQUEEZY_WEBHOOK_SECRET or pass --secret.');
+
+            return self::FAILURE;
+        }
+
+        $storeId = (string) config('lemonsqueezy.store_id');
+        if ($storeId === '') {
+            $this->error('Lemon Squeezy store id is required. Set LEMONSQUEEZY_STORE_ID.');
+
+            return self::FAILURE;
+        }
+
+        $testMode = (bool) $this->option('test-mode') || (bool) config('lemonsqueezy.test_mode', false);
+
+        $attributes = array_filter([
+            'url' => $destination,
+            'events' => $events,
+            'secret' => $secret,
+            'test_mode' => $testMode ? true : null,
+        ], static fn ($value) => $value !== null && $value !== '');
+
+        $payload = [
+            'data' => [
+                'type' => 'webhooks',
+                'attributes' => $attributes,
+                'relationships' => [
+                    'store' => [
+                        'data' => [
+                            'type' => 'stores',
+                            'id' => $storeId,
+                        ],
+                    ],
+                ],
+            ],
+        ];
+
+        if ((bool) $this->option('dry-run')) {
+            $this->line(json_encode($payload, JSON_PRETTY_PRINT));
+
+            return self::SUCCESS;
+        }
+
+        $response = $client->post('/webhooks', $payload);
+        $data = Arr::get($response, 'data', $response);
+        $id = Arr::get($data, 'id');
+
+        Log::channel('lemonsqueezy-sync')->info('Lemon Squeezy webhook registered', [
+            'webhook_id' => $id,
+            'destination' => $destination,
+            'test_mode' => $testMode,
+        ]);
+
+        $this->info('Lemon Squeezy webhook registered.');
+
+        if ($id) {
+            $this->line('ID: '.$id);
+        }
+
+        return self::SUCCESS;
+    }
+
+    protected function defaultWebhookUrl(): string
+    {
+        $base = rtrim((string) config('app.url'), '/');
+
+        return $base !== '' ? $base.'/lemonsqueezy/webhook' : '';
+    }
+}

app/Console/Commands/LemonSqueezySyncPackages.php

@@ -2,22 +2,23 @@
 
 namespace App\Console\Commands;
 
-use App\Jobs\PullPackageFromPaddle;
+use App\Jobs\PullPackageFromLemonSqueezy;
-use App\Jobs\SyncPackageToPaddle;
+use App\Jobs\SyncPackageToLemonSqueezy;
 use App\Models\Package;
 use Illuminate\Console\Command;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Str;
 
-class PaddleSyncPackages extends Command
+class LemonSqueezySyncPackages extends Command
 {
-    protected $signature = 'paddle:sync-packages
+    protected $signature = 'lemonsqueezy:sync-packages
         {--package=* : Limit sync to the given package IDs or slugs}
-        {--dry-run : Generate payload snapshots without calling Paddle}
+        {--dry-run : Generate payload snapshots without calling Lemon Squeezy}
-        {--pull : Fetch remote Paddle state instead of pushing local changes}
+        {--pull : Fetch remote Lemon Squeezy state instead of pushing local changes}
+        {--allow-unmapped : Allow sync when packages are missing Lemon Squeezy product/variant IDs}
         {--queue : Dispatch jobs onto the queue instead of running synchronously}';
 
-    protected $description = 'Synchronise local packages with Paddle products and prices.';
+    protected $description = 'Synchronise local packages with Lemon Squeezy products and variants.';
 
     public function handle(): int
     {
@@ -32,6 +33,13 @@ class PaddleSyncPackages extends Command
         $dryRun = (bool) $this->option('dry-run');
         $pull = (bool) $this->option('pull');
         $queue = (bool) $this->option('queue');
+        $allowUnmapped = (bool) $this->option('allow-unmapped');
+
+        if (! $pull && ! $allowUnmapped && ! $this->hasPackageFilter()) {
+            if (! $this->guardUnmappedPackages($packages)) {
+                return self::FAILURE;
+            }
+        }
 
         $packages->each(function (Package $package) use ($dryRun, $pull, $queue) {
             if ($pull) {
@@ -44,7 +52,7 @@ class PaddleSyncPackages extends Command
         });
 
         $this->info(sprintf(
-            'Queued %d package %s for Paddle %s.',
+            'Queued %d package %s for Lemon Squeezy %s.',
             $packages->count(),
             Str::plural('entry', $packages->count()),
             $pull ? 'pull' : 'sync'
@@ -82,6 +90,42 @@ class PaddleSyncPackages extends Command
         return $query->orderByDesc('id')->get();
     }
 
+    protected function hasPackageFilter(): bool
+    {
+        return collect((array) $this->option('package'))->filter()->isNotEmpty();
+    }
+
+    protected function guardUnmappedPackages(Collection $packages): bool
+    {
+        $unmapped = $packages->filter(fn (Package $package) => blank($package->lemonsqueezy_product_id) || blank($package->lemonsqueezy_variant_id));
+
+        if ($unmapped->isEmpty()) {
+            return true;
+        }
+
+        $this->error('Unmapped Lemon Squeezy package IDs detected. Resolve mappings or pass --allow-unmapped.');
+        $this->table(
+            ['ID', 'Slug', 'Missing'],
+            $unmapped->map(function (Package $package): array {
+                $missing = [];
+                if (blank($package->lemonsqueezy_product_id)) {
+                    $missing[] = 'product_id';
+                }
+                if (blank($package->lemonsqueezy_variant_id)) {
+                    $missing[] = 'variant_id';
+                }
+
+                return [
+                    $package->id,
+                    $package->slug,
+                    implode(', ', $missing),
+                ];
+            })->values()->all()
+        );
+
+        return false;
+    }
+
     protected function dispatchSyncJob(Package $package, bool $dryRun, bool $queue): void
     {
         $context = [
@@ -89,26 +133,26 @@ class PaddleSyncPackages extends Command
         ];
 
         if ($queue) {
-            SyncPackageToPaddle::dispatch($package->id, $context);
+            SyncPackageToLemonSqueezy::dispatch($package->id, $context);
             $this->line(sprintf('> queued sync for package #%d (%s)', $package->id, $package->slug));
 
             return;
         }
 
-        SyncPackageToPaddle::dispatchSync($package->id, $context);
+        SyncPackageToLemonSqueezy::dispatchSync($package->id, $context);
         $this->line(sprintf('> synced package #%d (%s)', $package->id, $package->slug));
     }
 
     protected function dispatchPullJob(Package $package, bool $queue): void
     {
         if ($queue) {
-            PullPackageFromPaddle::dispatch($package->id);
+            PullPackageFromLemonSqueezy::dispatch($package->id);
             $this->line(sprintf('> queued pull for package #%d (%s)', $package->id, $package->slug));
 
             return;
         }
 
-        PullPackageFromPaddle::dispatchSync($package->id);
+        PullPackageFromLemonSqueezy::dispatchSync($package->id);
         $this->line(sprintf('> pulled package #%d (%s)', $package->id, $package->slug));
     }
 }

app/Console/Commands/MigrateLegacyPurchases.php

@@ -4,15 +4,15 @@ namespace App\Console\Commands;
 
 use App\Models\PackagePurchase;
 use App\Models\Tenant;
-use App\Models\User;
 use App\Models\TenantPackage;
+use App\Models\User;
 use Illuminate\Console\Command;
 use Illuminate\Support\Facades\Hash;
-use Illuminate\Support\Facades\DB;
 
 class MigrateLegacyPurchases extends Command
 {
     protected $signature = 'packages:migrate-legacy';
+
     protected $description = 'Migrate legacy purchases to new system with temp tenants';
 
     public function handle()
@@ -21,19 +21,20 @@ class MigrateLegacyPurchases extends Command
 
         if ($legacyPurchases->isEmpty()) {
             $this->info('No legacy purchases found.');
+
             return 0;
         }
 
         $this->info("Found {$legacyPurchases->count()} legacy purchases.");
 
         foreach ($legacyPurchases as $purchase) {
-            if (!$purchase->user_id) {
+            if (! $purchase->user_id) {
                 // Create temp user if no user
                 $tempUser = User::create([
-                    'name' => 'Legacy User ' . $purchase->id,
+                    'name' => 'Legacy User '.$purchase->id,
-                    'email' => 'legacy' . $purchase->id . '@fotospiel.local',
+                    'email' => 'legacy'.$purchase->id.'@fotospiel.local',
                     'password' => Hash::make('legacy'),
-                    'username' => 'legacy' . $purchase->id,
+                    'username' => 'legacy'.$purchase->id,
                     'first_name' => 'Legacy',
                     'last_name' => 'User',
                     'address' => 'Legacy Address',
@@ -43,7 +44,7 @@ class MigrateLegacyPurchases extends Command
 
                 $tempTenant = Tenant::create([
                     'user_id' => $tempUser->id,
-                    'name' => 'Legacy Tenant ' . $purchase->id,
+                    'name' => 'Legacy Tenant '.$purchase->id,
                     'status' => 'active',
                 ]);
 
@@ -73,6 +74,7 @@ class MigrateLegacyPurchases extends Command
         }
 
         $this->info('Legacy migration completed.');
+
         return 0;
     }
-}
+}

app/Console/Commands/MonitorStorageCommand.php

@@ -46,6 +46,12 @@ class MonitorStorageCommand extends Command
 
             $assetStats = $this->buildAssetStatistics();
             $thresholds = $this->capacityThresholds();
+            $checksumConfig = $this->checksumAlertConfig();
+            $checksumWindowMinutes = $checksumConfig['window_minutes'];
+            $checksumThresholds = $checksumConfig['thresholds'];
+            $checksumMismatches = $checksumConfig['enabled'] && $checksumWindowMinutes > 0
+                ? $this->checksumMismatchCounts($checksumWindowMinutes)
+                : [];
             $alerts = [];
             $snapshotTargets = [];
 
@@ -78,6 +84,7 @@ class MonitorStorageCommand extends Command
                     ];
                 }
 
+                $targetChecksumMismatches = $checksumMismatches[$target->id] ?? 0;
                 $snapshotTargets[] = [
                     'id' => $target->id,
                     'key' => $target->key,
@@ -85,13 +92,35 @@ class MonitorStorageCommand extends Command
                     'is_hot' => (bool) $target->is_hot,
                     'capacity' => $capacity,
                     'assets' => $assets,
+                    'checksum_mismatches' => [
+                        'count' => $targetChecksumMismatches,
+                        'window_minutes' => $checksumWindowMinutes,
+                    ],
                 ];
             }
 
+            if ($checksumConfig['enabled'] && $checksumWindowMinutes > 0) {
+                $totalMismatches = array_sum($checksumMismatches);
+                $checksumSeverity = $this->determineChecksumSeverity($totalMismatches, $checksumThresholds);
+
+                if ($checksumSeverity !== 'ok') {
+                    $alerts[] = [
+                        'type' => 'checksum_mismatch',
+                        'severity' => $checksumSeverity,
+                        'count' => $totalMismatches,
+                        'window_minutes' => $checksumWindowMinutes,
+                    ];
+                }
+            }
+
             $snapshot = [
                 'generated_at' => now()->toIso8601String(),
                 'targets' => $snapshotTargets,
                 'alerts' => $alerts,
+                'checksum' => [
+                    'window_minutes' => $checksumWindowMinutes,
+                    'mismatch_total' => array_sum($checksumMismatches),
+                ],
             ];
 
             $ttlMinutes = max(1, (int) config('storage-monitor.monitor.cache_minutes', 15));
@@ -191,4 +220,62 @@ class MonitorStorageCommand extends Command
 
         return 'ok';
     }
+
+    private function checksumAlertConfig(): array
+    {
+        $enabled = (bool) config('storage-monitor.checksum_validation.enabled', true);
+        $windowMinutes = max(0, (int) config('storage-monitor.checksum_validation.alert_window_minutes', 60));
+        $warning = (int) config('storage-monitor.checksum_validation.thresholds.warning', 1);
+        $critical = (int) config('storage-monitor.checksum_validation.thresholds.critical', 5);
+
+        if ($warning > $critical && $critical > 0) {
+            [$warning, $critical] = [$critical, $warning];
+        }
+
+        return [
+            'enabled' => $enabled,
+            'window_minutes' => $windowMinutes,
+            'thresholds' => [
+                'warning' => $warning,
+                'critical' => $critical,
+            ],
+        ];
+    }
+
+    private function checksumMismatchCounts(int $windowMinutes): array
+    {
+        $query = EventMediaAsset::query()
+            ->selectRaw('media_storage_target_id, COUNT(*) as total_count')
+            ->where('status', 'failed')
+            ->where('meta->checksum_status', 'mismatch');
+
+        if ($windowMinutes > 0) {
+            $query->where('updated_at', '>=', now()->subMinutes($windowMinutes));
+        }
+
+        return $query->groupBy('media_storage_target_id')
+            ->get()
+            ->mapWithKeys(fn ($row) => [(int) $row->media_storage_target_id => (int) $row->total_count])
+            ->all();
+    }
+
+    private function determineChecksumSeverity(int $count, array $thresholds): string
+    {
+        $warning = (int) ($thresholds['warning'] ?? 1);
+        $critical = (int) ($thresholds['critical'] ?? 5);
+
+        if ($count <= 0) {
+            return 'ok';
+        }
+
+        if ($critical > 0 && $count >= $critical) {
+            return 'critical';
+        }
+
+        if ($warning > 0 && $count >= $warning) {
+            return 'warning';
+        }
+
+        return 'ok';
+    }
 }

app/Console/Commands/ProcessTenantRetention.php

@@ -5,6 +5,7 @@ namespace App\Console\Commands;
 use App\Jobs\AnonymizeAccount;
 use App\Models\Tenant;
 use App\Notifications\InactiveTenantDeletionWarning;
+use App\Services\Compliance\RetentionOverrideService;
 use Carbon\Carbon;
 use Illuminate\Console\Command;
 use Illuminate\Support\Facades\Notification;
@@ -27,7 +28,13 @@ class ProcessTenantRetention extends Command
             ->withMax('purchases as last_purchase_activity', 'purchased_at')
             ->withMax('photos as last_photo_activity', 'created_at')
             ->chunkById(100, function ($tenants) use ($warningThreshold, $deletionThreshold) {
+                $overrides = app(RetentionOverrideService::class);
+
                 foreach ($tenants as $tenant) {
+                    if ($overrides->tenantOnHold($tenant)) {
+                        continue;
+                    }
+
                     $lastActivity = $this->determineLastActivity($tenant);
 
                     if (! $lastActivity) {

app/Console/Commands/SeedDemoSwitcherTenants.php

@@ -26,7 +26,7 @@ class SeedDemoSwitcherTenants extends Command
 {
     protected $signature = 'demo:seed-switcher {--with-photos : Download sample photos from Pexels} {--photos-per-event=18 : Target photos per event when downloading} {--cleanup : Remove demo switcher tenants/events/photos instead of seeding}';
 
-    protected $description = 'Seeds demo tenants used by the DevTenantSwitcher (endcustomer + reseller profiles)';
+    protected $description = 'Seeds demo tenants used by the DevTenantSwitcher (endcustomer + partner profiles)';
 
     public function __construct(private EventStorageManager $eventStorageManager)
     {
@@ -52,7 +52,7 @@ class SeedDemoSwitcherTenants extends Command
 
         DB::transaction(function () use ($packages, $eventTypes) {
             $this->seedCustomerStandardEmpty($packages, $eventTypes);
-            $this->seedCustomerStarterWedding($packages, $eventTypes);
+            $this->seedCustomerStandardWedding($packages, $eventTypes);
             $this->seedResellerActive($packages, $eventTypes);
             $this->seedResellerFull($packages, $eventTypes);
         });
@@ -129,7 +129,7 @@ class SeedDemoSwitcherTenants extends Command
         $slugs = [
             'starter' => 'Starter',
             'standard' => 'Standard',
-            's-small-reseller' => 'Reseller S',
+            's-small-reseller' => 'Partner Start',
         ];
 
         $packages = [];
@@ -165,10 +165,10 @@ class SeedDemoSwitcherTenants extends Command
     {
         $tenant = $this->upsertTenant(
             slug: 'demo-standard-empty',
-            name: 'Demo Standard (ohne Event)',
+            name: 'Demo Starter (ohne Event)',
             contactEmail: 'standard-empty@demo.fotospiel',
             attributes: [
-                'subscription_tier' => 'standard',
+                'subscription_tier' => 'starter',
                 'subscription_status' => 'active',
             ],
         );
@@ -176,9 +176,9 @@ class SeedDemoSwitcherTenants extends Command
         $this->upsertAdmin($tenant, 'standard-empty@demo.fotospiel');
 
         TenantPackage::updateOrCreate(
-            ['tenant_id' => $tenant->id, 'package_id' => $packages['standard']->id],
+            ['tenant_id' => $tenant->id, 'package_id' => $packages['starter']->id],
             [
-                'price' => $packages['standard']->price,
+                'price' => $packages['starter']->price,
                 'purchased_at' => Carbon::now()->subDays(1),
                 'expires_at' => Carbon::now()->addMonths(12),
                 'used_events' => 0,
@@ -186,26 +186,37 @@ class SeedDemoSwitcherTenants extends Command
             ]
         );
 
-        $this->comment('Seeded Standard tenant without events.');
+        $this->comment('Seeded Starter tenant without events.');
     }
 
-    private function seedCustomerStarterWedding(array $packages, array $eventTypes): void
+    private function seedCustomerStandardWedding(array $packages, array $eventTypes): void
     {
         $tenant = $this->upsertTenant(
             slug: 'demo-starter-wedding',
-            name: 'Demo Starter Wedding',
+            name: 'Demo Standard Wedding',
             contactEmail: 'starter-wedding@demo.fotospiel',
             attributes: [
-                'subscription_tier' => 'starter',
+                'subscription_tier' => 'standard',
                 'subscription_status' => 'active',
             ],
         );
 
         $this->upsertAdmin($tenant, 'starter-wedding@demo.fotospiel');
 
+        TenantPackage::updateOrCreate(
+            ['tenant_id' => $tenant->id, 'package_id' => $packages['standard']->id],
+            [
+                'price' => $packages['standard']->price,
+                'purchased_at' => Carbon::now()->subDays(1),
+                'expires_at' => Carbon::now()->addMonths(12),
+                'used_events' => 1,
+                'active' => true,
+            ]
+        );
+
         $event = $this->upsertEvent(
             tenant: $tenant,
-            package: $packages['starter'],
+            package: $packages['standard'],
             eventType: $eventTypes['wedding'] ?? null,
             attributes: [
                 'name' => ['de' => 'Hochzeit Mia & Jonas', 'en' => 'Wedding Mia & Jonas'],
@@ -221,17 +232,18 @@ class SeedDemoSwitcherTenants extends Command
 
     private function seedResellerActive(array $packages, array $eventTypes): void
     {
+        $eventPackage = $this->resolveIncludedPackage($packages['s-small-reseller'], $packages);
         $tenant = $this->upsertTenant(
             slug: 'demo-reseller-active',
-            name: 'Demo Reseller Active',
+            name: 'Demo Partner Active',
-            contactEmail: 'reseller-active@demo.fotospiel',
+            contactEmail: 'partner-active@demo.fotospiel',
             attributes: [
                 'subscription_tier' => 'reseller',
                 'subscription_status' => 'active',
             ],
         );
 
-        $this->upsertAdmin($tenant, 'reseller-active@demo.fotospiel');
+        $this->upsertAdmin($tenant, 'partner-active@demo.fotospiel');
 
         TenantPackage::updateOrCreate(
             ['tenant_id' => $tenant->id, 'package_id' => $packages['s-small-reseller']->id],
@@ -268,7 +280,7 @@ class SeedDemoSwitcherTenants extends Command
         foreach ($events as $index => $config) {
             $event = $this->upsertEvent(
                 tenant: $tenant,
-                package: $packages['standard'],
+                package: $eventPackage,
                 eventType: $config['type'],
                 attributes: [
                     'name' => $config['name'],
@@ -285,17 +297,18 @@ class SeedDemoSwitcherTenants extends Command
 
     private function seedResellerFull(array $packages, array $eventTypes): void
     {
+        $eventPackage = $this->resolveIncludedPackage($packages['s-small-reseller'], $packages);
         $tenant = $this->upsertTenant(
             slug: 'demo-reseller-full',
-            name: 'Demo Reseller Voll',
+            name: 'Demo Partner Voll',
-            contactEmail: 'reseller-full@demo.fotospiel',
+            contactEmail: 'partner-full@demo.fotospiel',
             attributes: [
                 'subscription_tier' => 'reseller',
                 'subscription_status' => 'active',
             ],
         );
 
-        $this->upsertAdmin($tenant, 'reseller-full@demo.fotospiel');
+        $this->upsertAdmin($tenant, 'partner-full@demo.fotospiel');
 
         TenantPackage::updateOrCreate(
             ['tenant_id' => $tenant->id, 'package_id' => $packages['s-small-reseller']->id],
@@ -319,7 +332,7 @@ class SeedDemoSwitcherTenants extends Command
         foreach ($eventConfigs as $index => $config) {
             $event = $this->upsertEvent(
                 tenant: $tenant,
-                package: $packages['standard'],
+                package: $eventPackage,
                 eventType: $config['type'],
                 attributes: [
                     'name' => $config['name'],
@@ -346,8 +359,8 @@ class SeedDemoSwitcherTenants extends Command
             'settings' => [
                 'branding' => [
                     'logo_url' => null,
-                    'primary_color' => '#1D4ED8',
+                    'primary_color' => '#FF5A5F',
-                    'secondary_color' => '#0F172A',
+                    'secondary_color' => '#FFF8F5',
                     'font_family' => 'Inter, sans-serif',
                 ],
                 'features' => [
@@ -424,6 +437,19 @@ class SeedDemoSwitcherTenants extends Command
         return $event;
     }
 
+    private function resolveIncludedPackage(Package $resellerPackage, array $packages): Package
+    {
+        $includedSlug = $resellerPackage->included_package_slug;
+
+        if ($includedSlug && isset($packages[$includedSlug])) {
+            return $packages[$includedSlug];
+        }
+
+        $fallback = $packages['starter'] ?? $packages['standard'] ?? null;
+
+        return $fallback ?? $resellerPackage;
+    }
+
     private function fallbackEventType(): ?EventType
     {
         $fallback = EventType::first();

app/Console/Commands/SendAbandonedCheckoutReminders.php

@@ -62,7 +62,7 @@ class SendAbandonedCheckoutReminders extends Command
                     if ($this->shouldSendReminder($checkout, $stage)) {
                         $resumeUrl = $this->generateResumeUrl($checkout);
 
-                        if (!$isDryRun) {
+                        if (! $isDryRun) {
                             $mailLocale = $checkout->user->preferred_locale ?? config('app.locale');
 
                             Mail::to($checkout->user)
@@ -86,8 +86,8 @@ class SendAbandonedCheckoutReminders extends Command
                         $totalProcessed++;
                     }
                 } catch (Throwable $e) {
-                    Log::error("Failed to send {$stage} reminder for checkout {$checkout->id}: " . $e->getMessage());
+                    Log::error("Failed to send {$stage} reminder for checkout {$checkout->id}: ".$e->getMessage());
-                    $this->error("   ❌ Failed to process checkout {$checkout->id}: " . $e->getMessage());
+                    $this->error("   ❌ Failed to process checkout {$checkout->id}: ".$e->getMessage());
                 }
             }
         }
@@ -98,7 +98,7 @@ class SendAbandonedCheckoutReminders extends Command
             ->count();
 
         if ($oldCheckouts > 0) {
-            if (!$isDryRun) {
+            if (! $isDryRun) {
                 AbandonedCheckoutModel::where('abandoned_at', '<', now()->subDays(30))
                     ->where('converted', false)
                     ->delete();
@@ -108,10 +108,10 @@ class SendAbandonedCheckoutReminders extends Command
             }
         }
 
-        $this->info("✅ Reminder process completed!");
+        $this->info('✅ Reminder process completed!');
         $this->info("   Processed: {$totalProcessed} checkouts");
 
-        if (!$isDryRun) {
+        if (! $isDryRun) {
             $this->info("   Sent: {$totalSent} reminder emails");
         } else {
             $this->info("   Would send: {$totalSent} reminder emails");
@@ -131,12 +131,12 @@ class SendAbandonedCheckoutReminders extends Command
         }
 
         // User existiert noch?
-        if (!$checkout->user) {
+        if (! $checkout->user) {
             return false;
         }
 
         // Package existiert noch?
-        if (!$checkout->package) {
+        if (! $checkout->package) {
             return false;
         }
 

app/Console/Commands/SyncGoogleFonts.php

@@ -12,7 +12,7 @@ use Illuminate\Support\Str;
 
 class SyncGoogleFonts extends Command
 {
-    protected $signature = 'fonts:sync-google {--count=50 : Number of popular fonts to fetch} {--weights=400,700 : Comma separated numeric font weights to download} {--italic : Also download italic variants where available} {--force : Re-download files even if they exist} {--path= : Optional custom output directory (defaults to public/fonts/google)} {--family= : Download specific family name(s), comma separated (case-insensitive)} {--category= : Filter by category, comma separated (e.g. sans-serif,serif)} {--prune : Remove local font families not included in this sync} {--dry-run : Show what would be downloaded without writing files}';
+    protected $signature = 'fonts:sync-google {--count=50 : Number of popular fonts to fetch} {--weights=400,700 : Comma separated numeric font weights to download} {--italic : Also download italic variants where available} {--force : Re-download files even if they exist} {--path= : Optional custom output directory (defaults to public/fonts/google)} {--family= : Download specific family name(s), comma separated (case-insensitive)} {--category= : Filter by category, comma separated (e.g. sans-serif,serif)} {--prune : Remove local font families not included in this sync} {--dry-run : Show what would be downloaded without writing files} {--from-disk : Rebuild manifest + CSS from existing font files without downloading}';
 
     protected $description = 'Download the most popular Google Fonts to the local public/fonts/google directory and generate a manifest + CSS file.';
 
@@ -20,6 +20,17 @@ class SyncGoogleFonts extends Command
 
     public function handle(): int
     {
+        $dryRun = (bool) $this->option('dry-run');
+        $fromDisk = (bool) $this->option('from-disk');
+        $pathOption = $this->option('path');
+        $basePath = $pathOption
+            ? (Str::startsWith($pathOption, DIRECTORY_SEPARATOR) ? $pathOption : base_path($pathOption))
+            : public_path('fonts/google');
+
+        if ($fromDisk) {
+            return $this->syncFromDisk($basePath, $dryRun);
+        }
+
         $apiKey = config('services.google_fonts.key');
 
         if (! $apiKey) {
@@ -32,16 +43,10 @@ class SyncGoogleFonts extends Command
         $weights = $this->prepareWeights($this->option('weights'));
         $includeItalic = (bool) $this->option('italic');
         $force = (bool) $this->option('force');
-        $dryRun = (bool) $this->option('dry-run');
         $families = $this->normalizeFamilyOption($this->option('family'));
         $categories = $this->prepareCategories($this->option('category'));
         $prune = (bool) $this->option('prune');
 
-        $pathOption = $this->option('path');
-        $basePath = $pathOption
-            ? (Str::startsWith($pathOption, DIRECTORY_SEPARATOR) ? $pathOption : base_path($pathOption))
-            : public_path('fonts/google');
-
         if (count($families)) {
             $label = count($families) > 1 ? 'families' : 'family';
             $this->info(sprintf('Fetching Google Font %s "%s" (weights: %s, italic: %s)...', $label, implode(', ', $families), implode(', ', $weights), $includeItalic ? 'yes' : 'no'));
@@ -206,6 +211,204 @@ class SyncGoogleFonts extends Command
         return self::SUCCESS;
     }
 
+    private function syncFromDisk(string $basePath, bool $dryRun): int
+    {
+        if (! File::isDirectory($basePath)) {
+            $this->error(sprintf('Font directory not found: %s', $basePath));
+
+            return self::FAILURE;
+        }
+
+        if ($this->option('prune')) {
+            $this->warn('Ignoring --prune when rebuilding from disk.');
+        }
+
+        $fonts = $this->buildManifestFromDisk($basePath);
+
+        if (! count($fonts)) {
+            $this->warn('No fonts found on disk.');
+        }
+
+        if ($dryRun) {
+            $this->info(sprintf('Dry run complete: %d font families would be written to %s', count($fonts), $basePath));
+
+            return self::SUCCESS;
+        }
+
+        $this->writeManifest($basePath, $fonts);
+        $this->writeCss($basePath, $fonts);
+        Cache::forget('fonts:manifest');
+
+        $this->info(sprintf('Rebuilt manifest for %d font families from %s', count($fonts), $basePath));
+
+        return self::SUCCESS;
+    }
+
+    /**
+     * @return array<int, array<string, mixed>>
+     */
+    private function buildManifestFromDisk(string $basePath): array
+    {
+        $directories = File::directories($basePath);
+        $fonts = [];
+
+        foreach ($directories as $dir) {
+            $slug = basename($dir);
+            $files = collect(File::files($dir))
+                ->filter(function (\SplFileInfo $file) {
+                    $extension = strtolower($file->getExtension());
+
+                    return in_array($extension, ['woff2', 'woff', 'otf', 'ttf'], true);
+                })
+                ->values();
+
+            if (! $files->count()) {
+                continue;
+            }
+
+            $variantsByKey = [];
+            foreach ($files as $file) {
+                $filename = $file->getFilename();
+                $extension = strtolower($file->getExtension());
+                $style = $this->extractStyleFromFilename($filename);
+                $weight = $this->extractWeightFromFilename($filename);
+                $variantKey = $this->buildVariantKey($weight, $style);
+                $priority = $this->extensionPriority($extension);
+                $relativePath = sprintf('/fonts/google/%s/%s', $slug, $filename);
+
+                $existing = $variantsByKey[$variantKey] ?? null;
+                if ($existing && ($existing['priority'] ?? 0) >= $priority) {
+                    continue;
+                }
+
+                $variantsByKey[$variantKey] = [
+                    'variant' => $variantKey,
+                    'weight' => $weight,
+                    'style' => $style,
+                    'url' => $relativePath,
+                    'priority' => $priority,
+                ];
+            }
+
+            if (! count($variantsByKey)) {
+                continue;
+            }
+
+            $variants = array_values(array_map(function (array $variant) {
+                unset($variant['priority']);
+
+                return $variant;
+            }, $variantsByKey));
+
+            usort($variants, function (array $left, array $right) {
+                $weightCompare = ($left['weight'] ?? 400) <=> ($right['weight'] ?? 400);
+                if ($weightCompare !== 0) {
+                    return $weightCompare;
+                }
+
+                return strcmp((string) ($left['style'] ?? 'normal'), (string) ($right['style'] ?? 'normal'));
+            });
+
+            $fonts[] = [
+                'family' => $this->familyFromSlug($slug),
+                'slug' => $slug,
+                'category' => null,
+                'variants' => $variants,
+            ];
+        }
+
+        usort($fonts, fn (array $left, array $right) => strcmp((string) $left['family'], (string) $right['family']));
+
+        return $fonts;
+    }
+
+    private function familyFromSlug(string $slug): string
+    {
+        $parts = array_filter(explode('-', $slug), fn ($part) => $part !== '');
+
+        $words = array_map(function (string $part) {
+            if (is_numeric($part)) {
+                return $part;
+            }
+
+            if (strlen($part) <= 3) {
+                return strtoupper($part);
+            }
+
+            return ucfirst(strtolower($part));
+        }, $parts);
+
+        return trim(implode(' ', $words));
+    }
+
+    private function extractStyleFromFilename(string $filename): string
+    {
+        $lower = strtolower($filename);
+
+        return str_contains($lower, 'italic') || str_contains($lower, 'oblique') ? 'italic' : 'normal';
+    }
+
+    private function extractWeightFromFilename(string $filename): int
+    {
+        if (preg_match('/(?:^|[^0-9])(100|200|300|400|500|600|700|800|900)(?:[^0-9]|$)/', $filename, $matches)) {
+            return (int) $matches[1];
+        }
+
+        $lower = strtolower($filename);
+        $weightMap = [
+            'thin' => 100,
+            'extralight' => 200,
+            'ultralight' => 200,
+            'light' => 300,
+            'regular' => 400,
+            'book' => 400,
+            'medium' => 500,
+            'semibold' => 600,
+            'demibold' => 600,
+            'bold' => 700,
+            'extrabold' => 800,
+            'ultrabold' => 800,
+            'black' => 900,
+            'heavy' => 900,
+        ];
+
+        foreach ($weightMap as $label => $weight) {
+            if (str_contains($lower, $label)) {
+                return $weight;
+            }
+        }
+
+        return 400;
+    }
+
+    private function buildVariantKey(int $weight, string $style): string
+    {
+        if ($weight === 400 && $style === 'normal') {
+            return 'regular';
+        }
+
+        if ($weight === 400 && $style === 'italic') {
+            return 'italic';
+        }
+
+        if ($style === 'italic') {
+            return $weight.'italic';
+        }
+
+        return (string) $weight;
+    }
+
+    private function extensionPriority(string $extension): int
+    {
+        return match ($extension) {
+            'woff2' => 4,
+            'woff' => 3,
+            'otf' => 2,
+            'ttf' => 1,
+            default => 0,
+        };
+    }
+
     /**
      * @return array<int, string>
      */

app/Enums/DataExportScope.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace App\Enums;
+
+enum DataExportScope: string
+{
+    case USER = 'user';
+    case TENANT = 'tenant';
+    case EVENT = 'event';
+
+    public function label(): string
+    {
+        return match ($this) {
+            self::USER => __('User'),
+            self::TENANT => __('Tenant'),
+            self::EVENT => __('Event'),
+        };
+    }
+}

app/Enums/PackageType.php

@@ -6,4 +6,4 @@ enum PackageType: string
 {
     case ENDCUSTOMER = 'endcustomer';
     case RESELLER = 'reseller';
-}
+}

app/Enums/PhotoLiveStatus.php

@@ -0,0 +1,12 @@
+<?php
+
+namespace App\Enums;
+
+enum PhotoLiveStatus: string
+{
+    case NONE = 'none';
+    case PENDING = 'pending';
+    case APPROVED = 'approved';
+    case REJECTED = 'rejected';
+    case EXPIRED = 'expired';
+}

app/Enums/RetentionOverrideScope.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace App\Enums;
+
+enum RetentionOverrideScope: string
+{
+    case TENANT = 'tenant';
+    case EVENT = 'event';
+
+    public function label(): string
+    {
+        return match ($this) {
+            self::TENANT => __('Tenant'),
+            self::EVENT => __('Event'),
+        };
+    }
+}

app/Enums/TenantAnnouncementAudience.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace App\Enums;
+
+enum TenantAnnouncementAudience: string
+{
+    case ALL = 'all';
+    case TENANTS = 'tenants';
+    case SEGMENTS = 'segments';
+
+    public function label(): string
+    {
+        return match ($this) {
+            self::ALL => __('Alle Tenants'),
+            self::TENANTS => __('Ausgewählte Tenants'),
+            self::SEGMENTS => __('Segmente'),
+        };
+    }
+}

app/Enums/TenantAnnouncementDeliveryStatus.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace App\Enums;
+
+enum TenantAnnouncementDeliveryStatus: string
+{
+    case QUEUED = 'queued';
+    case FAILED = 'failed';
+    case SKIPPED = 'skipped';
+
+    public function label(): string
+    {
+        return match ($this) {
+            self::QUEUED => __('Warteschlange'),
+            self::FAILED => __('Fehlgeschlagen'),
+            self::SKIPPED => __('Übersprungen'),
+        };
+    }
+}

app/Enums/TenantAnnouncementSegment.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace App\Enums;
+
+enum TenantAnnouncementSegment: string
+{
+    case ACTIVE_PACKAGE = 'active_package';
+    case ACTIVE_STATUS = 'active_status';
+
+    public function label(): string
+    {
+        return match ($this) {
+            self::ACTIVE_PACKAGE => __('Aktives Paket'),
+            self::ACTIVE_STATUS => __('Aktiv (nicht gesperrt/gelöscht)'),
+        };
+    }
+}

app/Enums/TenantAnnouncementStatus.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace App\Enums;
+
+enum TenantAnnouncementStatus: string
+{
+    case DRAFT = 'draft';
+    case SCHEDULED = 'scheduled';
+    case ACTIVE = 'active';
+    case ARCHIVED = 'archived';
+
+    public function label(): string
+    {
+        return match ($this) {
+            self::DRAFT => __('Entwurf'),
+            self::SCHEDULED => __('Geplant'),
+            self::ACTIVE => __('Aktiv'),
+            self::ARCHIVED => __('Archiviert'),
+        };
+    }
+}

app/Exports/EventPurchaseExporter.php

@@ -5,8 +5,6 @@ namespace App\Exports;
 use App\Models\EventPurchase;
 use Filament\Actions\Exports\Exporter;
 use Filament\Actions\Exports\Models\Export;
-use Illuminate\Database\Eloquent\Builder;
-use Illuminate\Support\Collection;
 
 class EventPurchaseExporter extends Exporter
 {
@@ -28,11 +26,10 @@ class EventPurchaseExporter extends Exporter
         ];
     }
 
-
     public static function getCompletedNotificationBody(Export $export): string
     {
         $body = "Your Event Purchases export has completed and is ready for download. {$export->successful_rows} purchases were exported.";
 
         return $body;
     }
-}
+}

app/Filament/Blog/Resources/CategoryResource.php

@@ -6,6 +6,7 @@ use App\Filament\Blog\Resources\CategoryResource\Pages;
 use App\Filament\Blog\Traits\HasContentEditor;
 use App\Filament\Clusters\RareAdmin\RareAdminCluster;
 use App\Models\BlogCategory;
+use App\Services\Audit\SuperAdminAuditLogger;
 use Filament\Actions\BulkActionGroup;
 use Filament\Actions\DeleteBulkAction;
 use Filament\Actions\EditAction;
@@ -24,6 +25,7 @@ use Filament\Tables\Columns\IconColumn;
 use Filament\Tables\Columns\TextColumn;
 use Filament\Tables\Table;
 use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Collection;
 use Illuminate\Database\Eloquent\SoftDeletingScope;
 use Illuminate\Support\Str;
 
@@ -116,38 +118,25 @@ class CategoryResource extends Resource
         $data['description_de'] = $descArray['de'] ?? '';
         $data['description_en'] = $descArray['en'] ?? '';
 
-        \Illuminate\Support\Facades\Log::info('BeforeFill Description Extraction:', [
-            'descJson' => $descJson,
-            'descArray' => $descArray,
-            'description_de' => $data['description_de'],
-            'description_en' => $data['description_en'],
-        ]);
-
         return $data;
     }
 
     public static function mutateFormDataBeforeCreate(array $data): array
     {
-        \Illuminate\Support\Facades\Log::info('mutateFormDataBeforeCreate Input Data:', ['data' => $data]);
-
         $nameData = [
             'de' => $data['name_de'] ?? '',
             'en' => $data['name_en'] ?? '',
         ];
         $data['name'] = json_encode($nameData);
-        \Illuminate\Support\Facades\Log::info('mutateFormDataBeforeCreate Name JSON:', ['name' => $nameData]);
 
         $descData = [
             'de' => $data['description_de'] ?? '',
             'en' => $data['description_en'] ?? '',
         ];
         $data['description'] = json_encode($descData);
-        \Illuminate\Support\Facades\Log::info('mutateFormDataBeforeCreate Description JSON:', ['description' => $descData]);
 
         unset($data['name_de'], $data['name_en'], $data['description_de'], $data['description_en']);
 
-        \Illuminate\Support\Facades\Log::info('mutateFormDataBeforeCreate Final Data:', $data);
-
         return $data;
     }
 
@@ -185,11 +174,28 @@ class CategoryResource extends Resource
                 //
             ])
             ->actions([
-                EditAction::make(),
+                EditAction::make()
+                    ->after(fn (array $data, BlogCategory $record) => app(SuperAdminAuditLogger::class)->recordModelMutation(
+                        'updated',
+                        $record,
+                        SuperAdminAuditLogger::fieldsMetadata($data),
+                        static::class
+                    )),
             ])
             ->bulkActions([
                 BulkActionGroup::make([
-                    DeleteBulkAction::make(),
+                    DeleteBulkAction::make()
+                        ->after(function (Collection $records): void {
+                            $logger = app(SuperAdminAuditLogger::class);
+
+                            foreach ($records as $record) {
+                                $logger->recordModelMutation(
+                                    'deleted',
+                                    $record,
+                                    source: static::class
+                                );
+                            }
+                        }),
                 ]),
             ]);
     }

app/Filament/Blog/Resources/CategoryResource/Pages/CreateCategory.php

@@ -3,9 +3,9 @@
 namespace App\Filament\Blog\Resources\CategoryResource\Pages;
 
 use App\Filament\Blog\Resources\CategoryResource;
-use Filament\Resources\Pages\CreateRecord;
+use App\Filament\Resources\Pages\AuditedCreateRecord;
 
-class CreateCategory extends CreateRecord
+class CreateCategory extends AuditedCreateRecord
 {
     protected static string $resource = CategoryResource::class;
 
@@ -30,4 +30,4 @@ class CreateCategory extends CreateRecord
 
         $this->record = static::getResource()::getModel()::create($data);
     }
-}
+}

app/Filament/Blog/Resources/CategoryResource/Pages/EditCategory.php

@@ -3,17 +3,23 @@
 namespace App\Filament\Blog\Resources\CategoryResource\Pages;
 
 use App\Filament\Blog\Resources\CategoryResource;
+use App\Filament\Resources\Pages\AuditedEditRecord;
+use App\Services\Audit\SuperAdminAuditLogger;
 use Filament\Actions;
-use Filament\Resources\Pages\EditRecord;
 
-class EditCategory extends EditRecord
+class EditCategory extends AuditedEditRecord
 {
     protected static string $resource = CategoryResource::class;
 
     protected function getHeaderActions(): array
     {
         return [
-            Actions\DeleteAction::make(),
+            Actions\DeleteAction::make()
+                ->after(fn ($record) => app(SuperAdminAuditLogger::class)->recordModelMutation(
+                    'deleted',
+                    $record,
+                    source: static::class
+                )),
         ];
     }
 
@@ -24,7 +30,7 @@ class EditCategory extends EditRecord
             'description_de' => 'nullable|string',
             'name_en' => 'nullable|string|max:255',
             'description_en' => 'nullable|string',
-            'slug' => 'required|string|max:255|unique:blog_categories,slug,' . $this->record->id,
+            'slug' => 'required|string|max:255|unique:blog_categories,slug,'.$this->record->id,
             'is_visible' => 'boolean',
         ];
     }
@@ -40,12 +46,13 @@ class EditCategory extends EditRecord
     public function save(bool $shouldRedirect = true, bool $shouldSendSavedNotification = true): void
     {
         $state = $this->form->getState();
-        \Illuminate\Support\Facades\Log::info('EditCategory Save - Full State:', $state);
 
         $data = $state['data'] ?? $state;
 
         $data = \App\Filament\Blog\Resources\CategoryResource::mutateFormDataBeforeSave($data);
 
         $this->record->update($data);
+
+        parent::afterSave();
     }
-}
+}

app/Filament/Blog/Resources/CategoryResource/Pages/ListCategories.php

@@ -16,4 +16,4 @@ class ListCategories extends ListRecords
             Actions\CreateAction::make(),
         ];
     }
-}
+}

app/Filament/Blog/Resources/PostResource.php

@@ -7,6 +7,7 @@ use App\Filament\Blog\Traits\HasContentEditor;
 use App\Filament\Clusters\RareAdmin\RareAdminCluster;
 use App\Models\BlogCategory;
 use App\Models\BlogPost;
+use App\Services\Audit\SuperAdminAuditLogger;
 use Filament\Actions\BulkActionGroup;
 use Filament\Actions\DeleteAction;
 use Filament\Actions\DeleteBulkAction;
@@ -29,6 +30,7 @@ use Filament\Tables\Columns\TextColumn;
 use Filament\Tables\Filters\TernaryFilter;
 use Filament\Tables\Table;
 use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Collection;
 use Illuminate\Database\Eloquent\SoftDeletingScope;
 use Illuminate\Support\Str;
 
@@ -77,9 +79,10 @@ class PostResource extends Resource
                                     ->label('Inhalt')
                                     ->required()
                                     ->columnSpanFull(),
-                                TextInput::make('excerpt.de')
+                                Textarea::make('excerpt.de')
                                     ->label('Auszug')
-                                    ->maxLength(255),
+                                    ->maxLength(65535)
+                                    ->columnSpanFull(),
                                 TextInput::make('meta_title.de')
                                     ->label('Meta-Titel')
                                     ->maxLength(255),
@@ -97,9 +100,10 @@ class PostResource extends Resource
                                 MarkdownEditor::make('content.en')
                                     ->label('Inhalt')
                                     ->columnSpanFull(),
-                                TextInput::make('excerpt.en')
+                                Textarea::make('excerpt.en')
                                     ->label('Auszug')
-                                    ->maxLength(255),
+                                    ->maxLength(65535)
+                                    ->columnSpanFull(),
                                 TextInput::make('meta_title.en')
                                     ->label('Meta-Titel')
                                     ->maxLength(255),
@@ -119,9 +123,10 @@ class PostResource extends Resource
                             ->unique(BlogPost::class, 'slug', ignoreRecord: true)
                             ->maxLength(255)
                             ->columnSpanFull(),
-                        FileUpload::make('featured_image')
+                        FileUpload::make('banner')
                             ->label('Featured Image')
                             ->image()
+                            ->disk('public')
                             ->directory('blog')
                             ->visibility('public'),
                         Select::make('blog_category_id')
@@ -243,11 +248,27 @@ class PostResource extends Resource
             ->actions([
                 DeleteAction::make()
                     ->icon('heroicon-o-trash')
-                    ->label(''),
+                    ->label('')
+                    ->after(fn (BlogPost $record) => app(SuperAdminAuditLogger::class)->recordModelMutation(
+                        'deleted',
+                        $record,
+                        source: static::class
+                    )),
             ])
             ->bulkActions([
                 BulkActionGroup::make([
-                    DeleteBulkAction::make(),
+                    DeleteBulkAction::make()
+                        ->after(function (Collection $records): void {
+                            $logger = app(SuperAdminAuditLogger::class);
+
+                            foreach ($records as $record) {
+                                $logger->recordModelMutation(
+                                    'deleted',
+                                    $record,
+                                    source: static::class
+                                );
+                            }
+                        }),
                 ]),
             ]);
     }

app/Filament/Blog/Resources/PostResource/Pages/CreatePost.php

@@ -3,9 +3,9 @@
 namespace App\Filament\Blog\Resources\PostResource\Pages;
 
 use App\Filament\Blog\Resources\PostResource;
-use Filament\Resources\Pages\CreateRecord;
+use App\Filament\Resources\Pages\AuditedCreateRecord;
 
-class CreatePost extends CreateRecord
+class CreatePost extends AuditedCreateRecord
 {
     protected static string $resource = PostResource::class;
-}
+}

app/Filament/Blog/Resources/PostResource/Pages/EditPost.php

@@ -3,10 +3,11 @@
 namespace App\Filament\Blog\Resources\PostResource\Pages;
 
 use App\Filament\Blog\Resources\PostResource;
+use App\Filament\Resources\Pages\AuditedEditRecord;
+use App\Services\Audit\SuperAdminAuditLogger;
 use Filament\Actions;
-use Filament\Resources\Pages\EditRecord;
 
-class EditPost extends EditRecord
+class EditPost extends AuditedEditRecord
 {
     protected static string $resource = PostResource::class;
 
@@ -14,7 +15,12 @@ class EditPost extends EditRecord
     {
         return [
             Actions\ViewAction::make(),
-            Actions\DeleteAction::make(),
+            Actions\DeleteAction::make()
+                ->after(fn ($record) => app(SuperAdminAuditLogger::class)->recordModelMutation(
+                    'deleted',
+                    $record,
+                    source: static::class
+                )),
         ];
     }
 

app/Filament/Blog/Resources/PostResource/Pages/ListPosts.php

@@ -16,4 +16,4 @@ class ListPosts extends ListRecords
             Actions\CreateAction::make(),
         ];
     }
-}
+}

app/Filament/Blog/Resources/PostResource/Pages/ViewPost.php

@@ -8,4 +8,4 @@ use Filament\Resources\Pages\ViewRecord;
 class ViewPost extends ViewRecord
 {
     protected static string $resource = PostResource::class;
-}
+}

app/Filament/Blog/Traits/HasContentEditor.php

@@ -26,4 +26,4 @@ trait HasContentEditor
                 'h3',
             ]));
     }
-}
+}

app/Filament/Clusters/DailyOps/Pages/JoinTokenAnalyticsDashboard.php

@@ -0,0 +1,127 @@
+<?php
+
+namespace App\Filament\Clusters\DailyOps\Pages;
+
+use App\Filament\Clusters\DailyOps\DailyOpsCluster;
+use App\Filament\Widgets\JoinTokenOverviewWidget;
+use App\Filament\Widgets\JoinTokenTopTokensWidget;
+use App\Filament\Widgets\JoinTokenTrendWidget;
+use App\Models\Event;
+use BackedEnum;
+use Filament\Forms\Components\Select;
+use Filament\Pages\Dashboard;
+use Filament\Pages\Dashboard\Concerns\HasFiltersForm;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+use UnitEnum;
+
+class JoinTokenAnalyticsDashboard extends Dashboard
+{
+    use HasFiltersForm;
+
+    protected static ?string $cluster = DailyOpsCluster::class;
+
+    protected static string $routePath = 'join-token-analytics';
+
+    protected static null|string|BackedEnum $navigationIcon = 'heroicon-o-chart-bar';
+
+    protected static null|string|UnitEnum $navigationGroup = null;
+
+    protected static ?int $navigationSort = 12;
+
+    public static function getNavigationGroup(): UnitEnum|string|null
+    {
+        return __('admin.nav.security');
+    }
+
+    public static function getNavigationLabel(): string
+    {
+        return __('admin.join_token_analytics.navigation.label');
+    }
+
+    public function getHeading(): string
+    {
+        return __('admin.join_token_analytics.heading');
+    }
+
+    public function getSubheading(): ?string
+    {
+        return __('admin.join_token_analytics.subheading');
+    }
+
+    public function getColumns(): int|array
+    {
+        return 1;
+    }
+
+    public function getWidgets(): array
+    {
+        return [
+            JoinTokenOverviewWidget::class,
+            JoinTokenTrendWidget::class,
+            JoinTokenTopTokensWidget::class,
+        ];
+    }
+
+    public function filtersForm(Schema $schema): Schema
+    {
+        return $schema
+            ->components([
+                Section::make()
+                    ->schema([
+                        Select::make('range')
+                            ->label(__('admin.join_token_analytics.filters.range'))
+                            ->options(trans('admin.join_token_analytics.filters.range_options'))
+                            ->default('24h')
+                            ->native(false),
+                        Select::make('event_id')
+                            ->label(__('admin.join_token_analytics.filters.event'))
+                            ->placeholder(__('admin.join_token_analytics.filters.event_placeholder'))
+                            ->searchable()
+                            ->getSearchResultsUsing(fn (string $search): array => $this->searchEvents($search))
+                            ->getOptionLabelUsing(fn ($value): ?string => $this->resolveEventLabel($value))
+                            ->native(false),
+                    ])
+                    ->columns(2),
+            ]);
+    }
+
+    private function searchEvents(string $search): array
+    {
+        return Event::query()
+            ->with('tenant')
+            ->when($search !== '', function ($query) use ($search) {
+                $query->where('slug', 'like', "%{$search}%")
+                    ->orWhere('name->de', 'like', "%{$search}%")
+                    ->orWhere('name->en', 'like', "%{$search}%");
+            })
+            ->orderByDesc('date')
+            ->limit(25)
+            ->get()
+            ->mapWithKeys(fn (Event $event) => [$event->id => $this->formatEventLabel($event)])
+            ->all();
+    }
+
+    private function resolveEventLabel(mixed $value): ?string
+    {
+        if (! is_numeric($value)) {
+            return null;
+        }
+
+        $event = Event::query()
+            ->with('tenant')
+            ->find((int) $value);
+
+        return $event ? $this->formatEventLabel($event) : null;
+    }
+
+    private function formatEventLabel(Event $event): string
+    {
+        $locale = app()->getLocale();
+        $name = $event->name[$locale] ?? $event->name['de'] ?? $event->name['en'] ?? $event->slug ?? __('admin.common.unnamed');
+        $tenant = $event->tenant?->name ?? __('admin.common.unnamed');
+        $date = $event->date?->format('Y-m-d');
+
+        return $date ? "{$name} ({$tenant}) {$date}" : "{$name} ({$tenant})";
+    }
+}

app/Filament/Clusters/DailyOps/Resources/Photos/Pages/CreatePhoto.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Filament\Clusters\DailyOps\Resources\Photos\Pages;
+
+use App\Filament\Clusters\DailyOps\Resources\Photos\PhotoResource;
+use Filament\Resources\Pages\CreateRecord;
+
+class CreatePhoto extends CreateRecord
+{
+    protected static string $resource = PhotoResource::class;
+}

app/Filament/Clusters/DailyOps/Resources/Photos/Pages/EditPhoto.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Filament\Clusters\DailyOps\Resources\Photos\Pages;
+
+use App\Filament\Clusters\DailyOps\Resources\Photos\PhotoResource;
+use App\Filament\Resources\Pages\AuditedEditRecord;
+use App\Services\Audit\SuperAdminAuditLogger;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\ViewAction;
+
+class EditPhoto extends AuditedEditRecord
+{
+    protected static string $resource = PhotoResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            ViewAction::make(),
+            DeleteAction::make()
+                ->after(fn ($record) => app(SuperAdminAuditLogger::class)->recordModelMutation(
+                    'deleted',
+                    $record,
+                    source: static::class
+                )),
+        ];
+    }
+}

app/Filament/Clusters/DailyOps/Resources/Photos/Pages/ListPhotos.php

@@ -0,0 +1,16 @@
+<?php
+
+namespace App\Filament\Clusters\DailyOps\Resources\Photos\Pages;
+
+use App\Filament\Clusters\DailyOps\Resources\Photos\PhotoResource;
+use Filament\Resources\Pages\ListRecords;
+
+class ListPhotos extends ListRecords
+{
+    protected static string $resource = PhotoResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [];
+    }
+}

app/Filament/Clusters/DailyOps/Resources/Photos/Pages/ViewPhoto.php

@@ -0,0 +1,16 @@
+<?php
+
+namespace App\Filament\Clusters\DailyOps\Resources\Photos\Pages;
+
+use App\Filament\Clusters\DailyOps\Resources\Photos\PhotoResource;
+use Filament\Resources\Pages\ViewRecord;
+
+class ViewPhoto extends ViewRecord
+{
+    protected static string $resource = PhotoResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [];
+    }
+}

app/Filament/Clusters/DailyOps/Resources/Photos/PhotoResource.php

@@ -0,0 +1,84 @@
+<?php
+
+namespace App\Filament\Clusters\DailyOps\Resources\Photos;
+
+use App\Filament\Clusters\DailyOps\DailyOpsCluster;
+use App\Filament\Clusters\DailyOps\Resources\Photos\Pages\ListPhotos;
+use App\Filament\Clusters\DailyOps\Resources\Photos\Pages\ViewPhoto;
+use App\Filament\Clusters\DailyOps\Resources\Photos\Schemas\PhotoForm;
+use App\Filament\Clusters\DailyOps\Resources\Photos\Schemas\PhotoInfolist;
+use App\Filament\Clusters\DailyOps\Resources\Photos\Tables\PhotosTable;
+use App\Models\Photo;
+use BackedEnum;
+use Filament\Resources\Resource;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use UnitEnum;
+
+class PhotoResource extends Resource
+{
+    protected static ?string $model = Photo::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedShieldCheck;
+
+    protected static ?string $cluster = DailyOpsCluster::class;
+
+    protected static ?string $slug = 'moderation-queue';
+
+    protected static ?string $recordTitleAttribute = 'id';
+
+    protected static ?int $navigationSort = 20;
+
+    public static function canCreate(): bool
+    {
+        return false;
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return PhotoForm::configure($schema);
+    }
+
+    public static function infolist(Schema $schema): Schema
+    {
+        return PhotoInfolist::configure($schema);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return PhotosTable::configure($table);
+    }
+
+    public static function getEloquentQuery(): Builder
+    {
+        return parent::getEloquentQuery()
+            ->with(['event.tenant', 'moderator']);
+    }
+
+    public static function getNavigationLabel(): string
+    {
+        return __('admin.moderation.navigation.label');
+    }
+
+    public static function getNavigationGroup(): UnitEnum|string|null
+    {
+        return __('admin.nav.curation');
+    }
+
+    public static function getRelations(): array
+    {
+        return [
+            //
+        ];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListPhotos::route('/'),
+            'view' => ViewPhoto::route('/{record}'),
+        ];
+    }
+}

app/Filament/Clusters/DailyOps/Resources/Photos/Schemas/PhotoForm.php

@@ -0,0 +1,74 @@
+<?php
+
+namespace App\Filament\Clusters\DailyOps\Resources\Photos\Schemas;
+
+use Filament\Forms\Components\DateTimePicker;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\Textarea;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Schemas\Schema;
+
+class PhotoForm
+{
+    public static function configure(Schema $schema): Schema
+    {
+        return $schema
+            ->components([
+                Select::make('event_id')
+                    ->relationship('event', 'name')
+                    ->required(),
+                Select::make('emotion_id')
+                    ->relationship('emotion', 'name'),
+                Select::make('task_id')
+                    ->relationship('task', 'title'),
+                TextInput::make('guest_name')
+                    ->required(),
+                TextInput::make('file_path')
+                    ->required(),
+                TextInput::make('thumbnail_path')
+                    ->required(),
+                TextInput::make('likes_count')
+                    ->required()
+                    ->numeric()
+                    ->default(0),
+                Toggle::make('is_featured')
+                    ->required(),
+                Textarea::make('metadata')
+                    ->columnSpanFull(),
+                TextInput::make('tenant_id')
+                    ->numeric(),
+                Select::make('media_asset_id')
+                    ->relationship('mediaAsset', 'id'),
+                TextInput::make('security_scan_status')
+                    ->required()
+                    ->default('pending'),
+                Textarea::make('security_scan_message')
+                    ->columnSpanFull(),
+                DateTimePicker::make('security_scanned_at'),
+                Textarea::make('security_meta')
+                    ->columnSpanFull(),
+                TextInput::make('ingest_source')
+                    ->required()
+                    ->default('guest_pwa'),
+                TextInput::make('filename'),
+                TextInput::make('original_name'),
+                TextInput::make('mime_type'),
+                TextInput::make('size')
+                    ->numeric(),
+                TextInput::make('width')
+                    ->numeric(),
+                TextInput::make('height')
+                    ->numeric(),
+                TextInput::make('status')
+                    ->required()
+                    ->default('pending'),
+                TextInput::make('uploader_id')
+                    ->numeric(),
+                TextInput::make('ip_address'),
+                Textarea::make('user_agent')
+                    ->columnSpanFull(),
+                TextInput::make('created_by_device_id'),
+            ]);
+    }
+}

app/Filament/Clusters/DailyOps/Resources/Photos/Schemas/PhotoInfolist.php

@@ -0,0 +1,109 @@
+<?php
+
+namespace App\Filament\Clusters\DailyOps\Resources\Photos\Schemas;
+
+use App\Models\Photo;
+use Filament\Infolists\Components\ImageEntry;
+use Filament\Infolists\Components\TextEntry;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+
+class PhotoInfolist
+{
+    public static function configure(Schema $schema): Schema
+    {
+        return $schema
+            ->components([
+                Section::make(__('admin.moderation.sections.photo'))
+                    ->columns(3)
+                    ->schema([
+                        ImageEntry::make('thumbnail_path')
+                            ->label(__('admin.moderation.fields.photo'))
+                            ->disk('public')
+                            ->visibility('public')
+                            ->getStateUsing(fn (Photo $record) => $record->thumbnail_path ?: $record->file_path)
+                            ->columnSpanFull(),
+                        TextEntry::make('event.name')
+                            ->label(__('admin.moderation.fields.event'))
+                            ->placeholder('—'),
+                        TextEntry::make('event.tenant.name')
+                            ->label(__('admin.moderation.fields.tenant'))
+                            ->placeholder('—'),
+                        TextEntry::make('guest_name')
+                            ->label(__('admin.moderation.fields.uploader'))
+                            ->placeholder('—'),
+                        TextEntry::make('created_at')
+                            ->label(__('admin.moderation.fields.uploaded_at'))
+                            ->since()
+                            ->placeholder('—'),
+                        TextEntry::make('ingest_source')
+                            ->label(__('admin.moderation.fields.ingest_source'))
+                            ->formatStateUsing(fn (?string $state) => match ($state) {
+                                Photo::SOURCE_GUEST_PWA => __('admin.moderation.ingest_sources.guest_pwa'),
+                                Photo::SOURCE_TENANT_ADMIN => __('admin.moderation.ingest_sources.tenant_admin'),
+                                Photo::SOURCE_PHOTOBOOTH => __('admin.moderation.ingest_sources.photobooth'),
+                                Photo::SOURCE_SPARKBOOTH => __('admin.moderation.ingest_sources.sparkbooth'),
+                                Photo::SOURCE_UNKNOWN => __('admin.moderation.ingest_sources.unknown'),
+                                default => '—',
+                            }),
+                    ]),
+                Section::make(__('admin.moderation.sections.moderation'))
+                    ->columns(2)
+                    ->schema([
+                        TextEntry::make('status')
+                            ->label(__('admin.moderation.fields.status'))
+                            ->badge()
+                            ->color(fn (?string $state) => match ($state) {
+                                'approved' => 'success',
+                                'rejected' => 'danger',
+                                'hidden' => 'gray',
+                                default => 'warning',
+                            })
+                            ->formatStateUsing(fn (?string $state) => match ($state) {
+                                'pending' => __('admin.moderation.status.pending'),
+                                'approved' => __('admin.moderation.status.approved'),
+                                'rejected' => __('admin.moderation.status.rejected'),
+                                'hidden' => __('admin.moderation.status.hidden'),
+                                default => '—',
+                            }),
+                        TextEntry::make('moderator.name')
+                            ->label(__('admin.moderation.fields.moderated_by'))
+                            ->placeholder('—'),
+                        TextEntry::make('moderated_at')
+                            ->label(__('admin.moderation.fields.moderated_at'))
+                            ->dateTime()
+                            ->placeholder('—'),
+                        TextEntry::make('moderation_notes')
+                            ->label(__('admin.moderation.fields.moderation_notes'))
+                            ->placeholder('—')
+                            ->columnSpanFull(),
+                        TextEntry::make('security_scan_status')
+                            ->label(__('admin.moderation.fields.security_scan_status'))
+                            ->badge()
+                            ->color(fn (?string $state) => match ($state) {
+                                'clean', 'skipped', 'stripped' => 'success',
+                                'infected' => 'danger',
+                                'error' => 'warning',
+                                default => 'gray',
+                            })
+                            ->formatStateUsing(fn (?string $state) => match ($state) {
+                                'pending' => __('admin.moderation.security_scan.pending'),
+                                'clean' => __('admin.moderation.security_scan.clean'),
+                                'infected' => __('admin.moderation.security_scan.infected'),
+                                'skipped' => __('admin.moderation.security_scan.skipped'),
+                                'stripped' => __('admin.moderation.security_scan.stripped'),
+                                'error' => __('admin.moderation.security_scan.error'),
+                                default => '—',
+                            }),
+                        TextEntry::make('security_scan_message')
+                            ->label(__('admin.moderation.fields.security_scan_message'))
+                            ->placeholder('—')
+                            ->columnSpanFull(),
+                        TextEntry::make('security_scanned_at')
+                            ->label(__('admin.moderation.fields.security_scanned_at'))
+                            ->dateTime()
+                            ->placeholder('—'),
+                    ]),
+            ]);
+    }
+}

app/Filament/Clusters/DailyOps/Resources/Photos/Tables/PhotosTable.php

@@ -0,0 +1,292 @@
+<?php
+
+namespace App\Filament\Clusters\DailyOps\Resources\Photos\Tables;
+
+use App\Models\Event;
+use App\Models\Photo;
+use App\Models\Tenant;
+use App\Services\Audit\SuperAdminAuditLogger;
+use Filament\Actions\Action;
+use Filament\Actions\BulkAction;
+use Filament\Actions\BulkActionGroup;
+use Filament\Actions\ViewAction;
+use Filament\Facades\Filament;
+use Filament\Forms\Components\DatePicker;
+use Filament\Forms\Components\Textarea;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables;
+use Filament\Tables\Columns\ImageColumn;
+use Filament\Tables\Filters\Filter;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Collection;
+
+class PhotosTable
+{
+    public static function configure(Table $table): Table
+    {
+        return $table
+            ->defaultSort('created_at', 'desc')
+            ->columns([
+                ImageColumn::make('thumbnail_path')
+                    ->label(__('admin.moderation.table.photo'))
+                    ->disk('public')
+                    ->visibility('public')
+                    ->circular()
+                    ->getStateUsing(fn (Photo $record) => $record->thumbnail_path ?: $record->file_path),
+                Tables\Columns\TextColumn::make('event.name')
+                    ->label(__('admin.moderation.table.event'))
+                    ->searchable()
+                    ->limit(30),
+                Tables\Columns\TextColumn::make('event.tenant.name')
+                    ->label(__('admin.moderation.table.tenant'))
+                    ->limit(30),
+                Tables\Columns\TextColumn::make('guest_name')
+                    ->label(__('admin.moderation.table.uploader'))
+                    ->searchable()
+                    ->limit(20),
+                Tables\Columns\TextColumn::make('status')
+                    ->label(__('admin.moderation.table.status'))
+                    ->badge()
+                    ->color(fn (?string $state) => match ($state) {
+                        'approved' => 'success',
+                        'rejected' => 'danger',
+                        'hidden' => 'gray',
+                        default => 'warning',
+                    })
+                    ->formatStateUsing(fn (?string $state) => self::statusLabels()[$state] ?? '—')
+                    ->sortable(),
+                Tables\Columns\TextColumn::make('security_scan_status')
+                    ->label(__('admin.moderation.table.security_scan'))
+                    ->badge()
+                    ->color(fn (?string $state) => match ($state) {
+                        'clean', 'skipped', 'stripped' => 'success',
+                        'infected' => 'danger',
+                        'error' => 'warning',
+                        default => 'gray',
+                    })
+                    ->formatStateUsing(fn (?string $state) => self::securityScanLabels()[$state] ?? '—')
+                    ->toggleable(),
+                Tables\Columns\TextColumn::make('ingest_source')
+                    ->label(__('admin.moderation.table.ingest_source'))
+                    ->badge()
+                    ->color('gray')
+                    ->formatStateUsing(fn (?string $state) => self::ingestSourceLabels()[$state] ?? '—')
+                    ->toggleable(),
+                Tables\Columns\TextColumn::make('created_at')
+                    ->label(__('admin.moderation.table.uploaded_at'))
+                    ->since()
+                    ->sortable(),
+                Tables\Columns\TextColumn::make('moderator.name')
+                    ->label(__('admin.moderation.table.moderated_by'))
+                    ->placeholder('—')
+                    ->toggleable(isToggledHiddenByDefault: true),
+                Tables\Columns\TextColumn::make('moderated_at')
+                    ->label(__('admin.moderation.table.moderated_at'))
+                    ->since()
+                    ->placeholder('—')
+                    ->toggleable(isToggledHiddenByDefault: true),
+            ])
+            ->filters([
+                SelectFilter::make('status')
+                    ->label(__('admin.moderation.filters.status'))
+                    ->options(self::statusLabels())
+                    ->default('pending'),
+                SelectFilter::make('ingest_source')
+                    ->label(__('admin.moderation.filters.ingest_source'))
+                    ->options(self::ingestSourceLabels())
+                    ->default(Photo::SOURCE_GUEST_PWA),
+                SelectFilter::make('security_scan_status')
+                    ->label(__('admin.moderation.filters.security_scan_status'))
+                    ->options(self::securityScanLabels()),
+                SelectFilter::make('tenant_id')
+                    ->label(__('admin.common.tenant'))
+                    ->options(fn () => Tenant::query()->orderBy('name')->pluck('name', 'id')->toArray())
+                    ->searchable(),
+                SelectFilter::make('event_id')
+                    ->label(__('admin.common.event'))
+                    ->options(fn () => Event::query()->orderBy('name')->pluck('name', 'id')->toArray())
+                    ->searchable(),
+                Filter::make('created_at')
+                    ->label(__('admin.moderation.filters.uploaded_at'))
+                    ->form([
+                        DatePicker::make('from')->label(__('admin.common.from')),
+                        DatePicker::make('until')->label(__('admin.common.until')),
+                    ])
+                    ->query(function (Builder $query, array $data): Builder {
+                        return $query
+                            ->when(
+                                $data['from'] ?? null,
+                                fn (Builder $query, string $date): Builder => $query->whereDate('created_at', '>=', $date)
+                            )
+                            ->when(
+                                $data['until'] ?? null,
+                                fn (Builder $query, string $date): Builder => $query->whereDate('created_at', '<=', $date)
+                            );
+                    }),
+            ])
+            ->recordActions([
+                ViewAction::make(),
+                Action::make('approve')
+                    ->label(__('admin.moderation.actions.approve'))
+                    ->color('success')
+                    ->icon(Heroicon::OutlinedCheckCircle)
+                    ->visible(fn (Photo $record) => $record->status === 'pending')
+                    ->form([
+                        self::moderationNotesField(false),
+                    ])
+                    ->requiresConfirmation()
+                    ->action(fn (Photo $record, array $data) => self::applyModeration($record, 'approved', $data['moderation_notes'] ?? null)),
+                Action::make('reject')
+                    ->label(__('admin.moderation.actions.reject'))
+                    ->color('danger')
+                    ->icon(Heroicon::OutlinedXCircle)
+                    ->visible(fn (Photo $record) => $record->status === 'pending')
+                    ->form([
+                        self::moderationNotesField(true),
+                    ])
+                    ->requiresConfirmation()
+                    ->action(fn (Photo $record, array $data) => self::applyModeration($record, 'rejected', $data['moderation_notes'] ?? null)),
+                Action::make('hide')
+                    ->label(__('admin.moderation.actions.hide'))
+                    ->color('gray')
+                    ->icon(Heroicon::OutlinedEyeSlash)
+                    ->visible(fn (Photo $record) => $record->status !== 'hidden')
+                    ->form([
+                        self::moderationNotesField(false),
+                    ])
+                    ->requiresConfirmation()
+                    ->action(fn (Photo $record, array $data) => self::applyModeration($record, 'hidden', $data['moderation_notes'] ?? null)),
+            ])
+            ->toolbarActions([
+                BulkActionGroup::make([
+                    BulkAction::make('approve')
+                        ->label(__('admin.moderation.actions.approve_selected'))
+                        ->icon(Heroicon::OutlinedCheckCircle)
+                        ->color('success')
+                        ->form([
+                            self::moderationNotesField(false),
+                        ])
+                        ->requiresConfirmation()
+                        ->action(fn (Collection $records, array $data) => self::applyModerationToRecords($records, 'approved', $data['moderation_notes'] ?? null)),
+                    BulkAction::make('reject')
+                        ->label(__('admin.moderation.actions.reject_selected'))
+                        ->icon(Heroicon::OutlinedXCircle)
+                        ->color('danger')
+                        ->form([
+                            self::moderationNotesField(true),
+                        ])
+                        ->requiresConfirmation()
+                        ->action(fn (Collection $records, array $data) => self::applyModerationToRecords($records, 'rejected', $data['moderation_notes'] ?? null)),
+                    BulkAction::make('hide')
+                        ->label(__('admin.moderation.actions.hide_selected'))
+                        ->icon(Heroicon::OutlinedEyeSlash)
+                        ->color('gray')
+                        ->form([
+                            self::moderationNotesField(false),
+                        ])
+                        ->requiresConfirmation()
+                        ->action(fn (Collection $records, array $data) => self::applyModerationToRecords($records, 'hidden', $data['moderation_notes'] ?? null)),
+                ]),
+            ]);
+    }
+
+    private static function moderationNotesField(bool $required): Textarea
+    {
+        return Textarea::make('moderation_notes')
+            ->label(__('admin.moderation.fields.moderation_notes'))
+            ->maxLength(1000)
+            ->rows(3)
+            ->required($required);
+    }
+
+    private static function applyModeration(Photo $record, string $status, ?string $notes): void
+    {
+        $record->update([
+            'status' => $status,
+            'moderation_notes' => $notes,
+            'moderated_at' => now(),
+            'moderated_by' => Filament::auth()->id(),
+        ]);
+
+        app(SuperAdminAuditLogger::class)->record(
+            'photo.'.$status,
+            $record,
+            SuperAdminAuditLogger::fieldsMetadata([
+                'status',
+                'moderation_notes',
+                'moderated_at',
+                'moderated_by',
+            ]),
+            source: self::class
+        );
+    }
+
+    private static function applyModerationToRecords(Collection $records, string $status, ?string $notes): int
+    {
+        $moderatedAt = now();
+        $moderatedBy = Filament::auth()->id();
+
+        $updated = Photo::query()
+            ->whereIn('id', $records->pluck('id'))
+            ->where('status', 'pending')
+            ->update([
+                'status' => $status,
+                'moderation_notes' => $notes,
+                'moderated_at' => $moderatedAt,
+                'moderated_by' => $moderatedBy,
+            ]);
+
+        $logger = app(SuperAdminAuditLogger::class);
+
+        foreach ($records as $record) {
+            $logger->record(
+                'photo.'.$status,
+                $record,
+                SuperAdminAuditLogger::fieldsMetadata([
+                    'status',
+                    'moderation_notes',
+                    'moderated_at',
+                    'moderated_by',
+                ]),
+                source: self::class
+            );
+        }
+
+        return $updated;
+    }
+
+    private static function statusLabels(): array
+    {
+        return [
+            'pending' => __('admin.moderation.status.pending'),
+            'approved' => __('admin.moderation.status.approved'),
+            'rejected' => __('admin.moderation.status.rejected'),
+            'hidden' => __('admin.moderation.status.hidden'),
+        ];
+    }
+
+    private static function ingestSourceLabels(): array
+    {
+        return [
+            Photo::SOURCE_GUEST_PWA => __('admin.moderation.ingest_sources.guest_pwa'),
+            Photo::SOURCE_TENANT_ADMIN => __('admin.moderation.ingest_sources.tenant_admin'),
+            Photo::SOURCE_PHOTOBOOTH => __('admin.moderation.ingest_sources.photobooth'),
+            Photo::SOURCE_SPARKBOOTH => __('admin.moderation.ingest_sources.sparkbooth'),
+            Photo::SOURCE_UNKNOWN => __('admin.moderation.ingest_sources.unknown'),
+        ];
+    }
+
+    private static function securityScanLabels(): array
+    {
+        return [
+            'pending' => __('admin.moderation.security_scan.pending'),
+            'clean' => __('admin.moderation.security_scan.clean'),
+            'infected' => __('admin.moderation.security_scan.infected'),
+            'skipped' => __('admin.moderation.security_scan.skipped'),
+            'stripped' => __('admin.moderation.security_scan.stripped'),
+            'error' => __('admin.moderation.security_scan.error'),
+        ];
+    }
+}

app/Filament/Clusters/DailyOps/Resources/TenantCheckoutHealths/Pages/ListTenantCheckoutHealths.php

@@ -0,0 +1,16 @@
+<?php
+
+namespace App\Filament\Clusters\DailyOps\Resources\TenantCheckoutHealths\Pages;
+
+use App\Filament\Clusters\DailyOps\Resources\TenantCheckoutHealths\TenantCheckoutHealthResource;
+use Filament\Resources\Pages\ListRecords;
+
+class ListTenantCheckoutHealths extends ListRecords
+{
+    protected static string $resource = TenantCheckoutHealthResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [];
+    }
+}

app/Filament/Clusters/DailyOps/Resources/TenantCheckoutHealths/Tables/TenantCheckoutHealthTable.php

@@ -0,0 +1,267 @@
+<?php
+
+namespace App\Filament\Clusters\DailyOps\Resources\TenantCheckoutHealths\Tables;
+
+use App\Filament\Clusters\DailyOps\Resources\TenantCheckoutHealths\TenantCheckoutHealthResource;
+use App\Models\CheckoutSession;
+use App\Models\Tenant;
+use Filament\Forms\Components\TextInput;
+use Filament\Tables\Columns\IconColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\Filter;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Support\Carbon;
+
+class TenantCheckoutHealthTable
+{
+    public static function configure(Table $table): Table
+    {
+        return $table
+            ->columns([
+                TextColumn::make('name')
+                    ->label(__('admin.common.tenant'))
+                    ->searchable()
+                    ->sortable(),
+                TextColumn::make('slug')
+                    ->label(__('admin.common.slug'))
+                    ->searchable()
+                    ->toggleable(isToggledHiddenByDefault: true),
+                TextColumn::make('contact_email')
+                    ->label(__('admin.tenants.fields.contact_email'))
+                    ->searchable()
+                    ->toggleable(isToggledHiddenByDefault: true),
+                TextColumn::make('subscription_status')
+                    ->label('Subscription')
+                    ->badge()
+                    ->color(fn (?string $state) => match ($state) {
+                        'active' => 'success',
+                        'suspended' => 'warning',
+                        'expired' => 'danger',
+                        'free' => 'gray',
+                        default => 'gray',
+                    }),
+                TextColumn::make('active_reseller_package')
+                    ->label('Active package')
+                    ->getStateUsing(fn (Tenant $record) => $record->activeResellerPackage?->package?->name ?? '—')
+                    ->badge()
+                    ->color(fn (string $state) => $state === '—' ? 'gray' : 'success')
+                    ->toggleable(isToggledHiddenByDefault: true),
+                IconColumn::make('status_mismatch')
+                    ->label('Status mismatch')
+                    ->boolean()
+                    ->getStateUsing(fn (Tenant $record) => self::hasStatusMismatch($record)),
+                TextColumn::make('last_checkout_transaction_at')
+                    ->label('Last transaction')
+                    ->badge()
+                    ->color(fn (?Carbon $state) => self::transactionAgeColor($state))
+                    ->getStateUsing(fn (Tenant $record) => $record->last_checkout_transaction_at
+                        ? Carbon::parse($record->last_checkout_transaction_at)
+                        : null)
+                    ->formatStateUsing(fn (?Carbon $state) => $state?->diffForHumans() ?? '—')
+                    ->toggleable(isToggledHiddenByDefault: true),
+                TextColumn::make('checkout_transaction_count_window')
+                    ->label('Transactions (30d)')
+                    ->default('0')
+                    ->sortable()
+                    ->toggleable(),
+                TextColumn::make('checkout_transaction_total_window')
+                    ->label('Total (30d)')
+                    ->default(0)
+                    ->money('EUR')
+                    ->sortable()
+                    ->toggleable(),
+                TextColumn::make('checkout_refund_count_window')
+                    ->label('Refunds (30d)')
+                    ->badge()
+                    ->color(fn (?int $state) => $state && $state > 0 ? 'danger' : 'gray')
+                    ->default('0')
+                    ->sortable()
+                    ->toggleable(isToggledHiddenByDefault: true),
+                TextColumn::make('checkout_refund_total_window')
+                    ->label('Refund total (30d)')
+                    ->default(0)
+                    ->money('EUR')
+                    ->sortable()
+                    ->toggleable(isToggledHiddenByDefault: true),
+                TextColumn::make('checkout_requires_action_count')
+                    ->label('Checkout action required')
+                    ->badge()
+                    ->color(fn (?int $state) => $state && $state > 0 ? 'warning' : 'gray')
+                    ->default('0')
+                    ->sortable()
+                    ->toggleable(isToggledHiddenByDefault: true),
+                TextColumn::make('checkout_processing_count')
+                    ->label('Checkout processing')
+                    ->badge()
+                    ->color(fn (?int $state) => $state && $state > 0 ? 'warning' : 'gray')
+                    ->default('0')
+                    ->sortable()
+                    ->toggleable(isToggledHiddenByDefault: true),
+                TextColumn::make('checkout_expired_count')
+                    ->label('Checkout expired')
+                    ->badge()
+                    ->color(fn (?int $state) => $state && $state > 0 ? 'danger' : 'gray')
+                    ->default('0')
+                    ->sortable()
+                    ->toggleable(isToggledHiddenByDefault: true),
+                TextColumn::make('checkout_transaction_count')
+                    ->label('Transactions (all)')
+                    ->default('0')
+                    ->sortable()
+                    ->toggleable(isToggledHiddenByDefault: true),
+                TextColumn::make('checkout_transaction_total')
+                    ->label('Total (all)')
+                    ->default(0)
+                    ->money('EUR')
+                    ->sortable()
+                    ->toggleable(isToggledHiddenByDefault: true),
+            ])
+            ->filters([
+                Filter::make('status_mismatch')
+                    ->label('Status mismatch')
+                    ->indicator('Status mismatch')
+                    ->query(fn (Builder $query) => self::applyStatusMismatchFilter($query)),
+                Filter::make('active_package')
+                    ->label('Active package')
+                    ->indicator('Active package')
+                    ->query(fn (Builder $query) => $query->whereHas('activeResellerPackage', function (Builder $query) {
+                        $query->where('active', true)
+                            ->where(function (Builder $query) {
+                                $query->whereNull('expires_at')
+                                    ->orWhere('expires_at', '>=', now());
+                            });
+                    })),
+                Filter::make('not_suspended_or_deleted')
+                    ->label('Not suspended/deleted')
+                    ->indicator('Not suspended/deleted')
+                    ->query(fn (Builder $query) => $query
+                        ->where('is_suspended', false)
+                        ->whereNull('pending_deletion_at')
+                        ->whereNull('anonymized_at')),
+                Filter::make('checkout_transaction_stale')
+                    ->label('Stale transactions')
+                    ->indicator('Stale transactions')
+                    ->query(function (Builder $query): Builder {
+                        $cutoff = now()->subDays(TenantCheckoutHealthResource::TRANSACTION_WINDOW_DAYS);
+                        $provider = TenantCheckoutHealthResource::provider();
+
+                        return $query
+                            ->whereHas('purchases', fn (Builder $query) => $query->where('provider', $provider))
+                            ->whereDoesntHave('purchases', fn (Builder $query) => $query
+                                ->where('provider', $provider)
+                                ->where('purchased_at', '>=', $cutoff));
+                    }),
+                Filter::make('checkout_attention')
+                    ->label('Checkout attention')
+                    ->indicator('Checkout attention')
+                    ->query(fn (Builder $query) => $query->whereHas('checkoutSessions', function (Builder $query) {
+                        $query->where('provider', TenantCheckoutHealthResource::provider())
+                            ->where(function (Builder $query) {
+                                $query->whereIn('status', [
+                                    CheckoutSession::STATUS_REQUIRES_CUSTOMER_ACTION,
+                                    CheckoutSession::STATUS_PROCESSING,
+                                ])
+                                    ->orWhere(function (Builder $query) {
+                                        $query->whereNotIn('status', [
+                                            CheckoutSession::STATUS_COMPLETED,
+                                            CheckoutSession::STATUS_CANCELLED,
+                                        ])
+                                            ->whereNotNull('expires_at')
+                                            ->where('expires_at', '<', now());
+                                    });
+                            });
+                    })),
+                Filter::make('refund_spike')
+                    ->label('Refund spike (30d)')
+                    ->form([
+                        TextInput::make('min_refunds')
+                            ->label('Minimum refunds')
+                            ->numeric()
+                            ->default(1)
+                            ->minValue(1),
+                    ])
+                    ->indicateUsing(function (array $data): ?string {
+                        $min = (int) ($data['min_refunds'] ?? 0);
+
+                        return $min > 0 ? "Refunds >= {$min} (30d)" : null;
+                    })
+                    ->query(function (Builder $query, array $data): Builder {
+                        $min = (int) ($data['min_refunds'] ?? 0);
+
+                        if ($min < 1) {
+                            return $query;
+                        }
+
+                        $cutoff = now()->subDays(TenantCheckoutHealthResource::TRANSACTION_WINDOW_DAYS);
+                        $provider = TenantCheckoutHealthResource::provider();
+
+                        return $query->whereHas('purchases', fn (Builder $query) => $query
+                            ->where('provider', $provider)
+                            ->where('refunded', true)
+                            ->where('purchased_at', '>=', $cutoff), '>=', $min);
+                    }),
+                SelectFilter::make('subscription_status')
+                    ->label('Subscription')
+                    ->options([
+                        'active' => 'Active',
+                        'suspended' => 'Suspended',
+                        'expired' => 'Expired',
+                        'free' => 'Free',
+                    ]),
+            ])
+            ->actions([]);
+    }
+
+    private static function hasStatusMismatch(Tenant $record): bool
+    {
+        $hasActivePackage = (bool) ($record->has_active_reseller_package ?? $record->activeResellerPackage);
+        $status = (string) ($record->subscription_status ?? '');
+        $expiresAt = $record->subscription_expires_at;
+
+        if ($status === 'active' && ! $hasActivePackage) {
+            return true;
+        }
+
+        if ($status !== 'active' && $hasActivePackage) {
+            return true;
+        }
+
+        if ($status === 'active' && $expiresAt && $expiresAt->isPast()) {
+            return true;
+        }
+
+        return false;
+    }
+
+    private static function applyStatusMismatchFilter(Builder $query): Builder
+    {
+        return $query->where(function (Builder $query) {
+            $query->where(function (Builder $query) {
+                $query->where('subscription_status', 'active')
+                    ->whereDoesntHave('activeResellerPackage');
+            })->orWhere(function (Builder $query) {
+                $query->where('subscription_status', '!=', 'active')
+                    ->whereHas('activeResellerPackage');
+            })->orWhere(function (Builder $query) {
+                $query->where('subscription_status', 'active')
+                    ->whereNotNull('subscription_expires_at')
+                    ->where('subscription_expires_at', '<', now());
+            });
+        });
+    }
+
+    private static function transactionAgeColor(?Carbon $state): string
+    {
+        if (! $state) {
+            return 'gray';
+        }
+
+        if ($state->lt(now()->subDays(TenantCheckoutHealthResource::TRANSACTION_WINDOW_DAYS))) {
+            return 'danger';
+        }
+
+        return 'success';
+    }
+}

app/Filament/Clusters/DailyOps/Resources/TenantCheckoutHealths/TenantCheckoutHealthResource.php

@@ -0,0 +1,121 @@
+<?php
+
+namespace App\Filament\Clusters\DailyOps\Resources\TenantCheckoutHealths;
+
+use App\Filament\Clusters\DailyOps\DailyOpsCluster;
+use App\Filament\Clusters\DailyOps\Resources\TenantCheckoutHealths\Pages\ListTenantCheckoutHealths;
+use App\Filament\Clusters\DailyOps\Resources\TenantCheckoutHealths\Tables\TenantCheckoutHealthTable;
+use App\Models\CheckoutSession;
+use App\Models\Tenant;
+use BackedEnum;
+use Filament\Resources\Resource;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use UnitEnum;
+
+class TenantCheckoutHealthResource extends Resource
+{
+    public const TRANSACTION_WINDOW_DAYS = 30;
+
+    public const DEFAULT_PROVIDER = CheckoutSession::PROVIDER_PAYPAL;
+
+    protected static ?string $model = Tenant::class;
+
+    protected static string|BackedEnum|null $navigationIcon = 'heroicon-o-credit-card';
+
+    protected static ?string $cluster = DailyOpsCluster::class;
+
+    protected static ?string $slug = 'checkout-health';
+
+    protected static ?int $navigationSort = 20;
+
+    public static function table(Table $table): Table
+    {
+        return TenantCheckoutHealthTable::configure($table);
+    }
+
+    public static function canCreate(): bool
+    {
+        return false;
+    }
+
+    public static function getNavigationLabel(): string
+    {
+        return __('admin.checkout_health.navigation.label');
+    }
+
+    public static function getNavigationGroup(): UnitEnum|string|null
+    {
+        return __('admin.nav.billing');
+    }
+
+    public static function getEloquentQuery(): Builder
+    {
+        $provider = static::provider();
+        $windowStart = now()->subDays(self::TRANSACTION_WINDOW_DAYS);
+
+        return parent::getEloquentQuery()
+            ->with(['activeResellerPackage.package'])
+            ->withExists('activeResellerPackage as has_active_reseller_package')
+            ->withCount([
+                'purchases as checkout_transaction_count' => fn (Builder $query) => $query
+                    ->where('provider', $provider)
+                    ->where('refunded', false),
+                'purchases as checkout_transaction_count_window' => fn (Builder $query) => $query
+                    ->where('provider', $provider)
+                    ->where('refunded', false)
+                    ->where('purchased_at', '>=', $windowStart),
+                'purchases as checkout_refund_count_window' => fn (Builder $query) => $query
+                    ->where('provider', $provider)
+                    ->where('refunded', true)
+                    ->where('purchased_at', '>=', $windowStart),
+                'checkoutSessions as checkout_requires_action_count' => fn (Builder $query) => $query
+                    ->where('provider', $provider)
+                    ->where('status', CheckoutSession::STATUS_REQUIRES_CUSTOMER_ACTION),
+                'checkoutSessions as checkout_processing_count' => fn (Builder $query) => $query
+                    ->where('provider', $provider)
+                    ->where('status', CheckoutSession::STATUS_PROCESSING),
+                'checkoutSessions as checkout_expired_count' => fn (Builder $query) => $query
+                    ->where('provider', $provider)
+                    ->whereNotIn('status', [
+                        CheckoutSession::STATUS_COMPLETED,
+                        CheckoutSession::STATUS_CANCELLED,
+                    ])
+                    ->whereNotNull('expires_at')
+                    ->where('expires_at', '<', now()),
+            ])
+            ->withSum([
+                'purchases as checkout_transaction_total' => fn (Builder $query) => $query
+                    ->where('provider', $provider)
+                    ->where('refunded', false),
+            ], 'price')
+            ->withSum([
+                'purchases as checkout_transaction_total_window' => fn (Builder $query) => $query
+                    ->where('provider', $provider)
+                    ->where('refunded', false)
+                    ->where('purchased_at', '>=', $windowStart),
+            ], 'price')
+            ->withSum([
+                'purchases as checkout_refund_total_window' => fn (Builder $query) => $query
+                    ->where('provider', $provider)
+                    ->where('refunded', true)
+                    ->where('purchased_at', '>=', $windowStart),
+            ], 'price')
+            ->withMax([
+                'purchases as last_checkout_transaction_at' => fn (Builder $query) => $query
+                    ->where('provider', $provider),
+            ], 'purchased_at');
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListTenantCheckoutHealths::route('/'),
+        ];
+    }
+
+    public static function provider(): string
+    {
+        return (string) config('checkout.default_provider', self::DEFAULT_PROVIDER);
+    }
+}

app/Filament/Clusters/RareAdmin/Resources/SuperAdminActionLogs/Pages/ManageSuperAdminActionLogs.php

@@ -0,0 +1,16 @@
+<?php
+
+namespace App\Filament\Clusters\RareAdmin\Resources\SuperAdminActionLogs\Pages;
+
+use App\Filament\Clusters\RareAdmin\Resources\SuperAdminActionLogs\SuperAdminActionLogResource;
+use Filament\Resources\Pages\ManageRecords;
+
+class ManageSuperAdminActionLogs extends ManageRecords
+{
+    protected static string $resource = SuperAdminActionLogResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [];
+    }
+}

app/Filament/Clusters/RareAdmin/Resources/SuperAdminActionLogs/SuperAdminActionLogResource.php

@@ -0,0 +1,123 @@
+<?php
+
+namespace App\Filament\Clusters\RareAdmin\Resources\SuperAdminActionLogs;
+
+use App\Filament\Clusters\RareAdmin\RareAdminCluster;
+use App\Filament\Clusters\RareAdmin\Resources\SuperAdminActionLogs\Pages\ManageSuperAdminActionLogs;
+use App\Models\SuperAdminActionLog;
+use BackedEnum;
+use Filament\Resources\Resource;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Table;
+use UnitEnum;
+
+class SuperAdminActionLogResource extends Resource
+{
+    protected static ?string $model = SuperAdminActionLog::class;
+
+    protected static ?string $cluster = RareAdminCluster::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedClipboardDocumentList;
+
+    protected static ?int $navigationSort = 95;
+
+    protected static ?string $recordTitleAttribute = 'action';
+
+    public static function getNavigationGroup(): UnitEnum|string|null
+    {
+        return __('admin.nav.infrastructure');
+    }
+
+    public static function getNavigationLabel(): string
+    {
+        return 'Audit log';
+    }
+
+    public static function canCreate(): bool
+    {
+        return false;
+    }
+
+    public static function canEdit($record): bool
+    {
+        return false;
+    }
+
+    public static function canDelete($record): bool
+    {
+        return false;
+    }
+
+    public static function canDeleteAny(): bool
+    {
+        return false;
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return $schema
+            ->components([
+                //
+            ]);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return $table
+            ->recordTitleAttribute('action')
+            ->columns([
+                TextColumn::make('action')
+                    ->badge()
+                    ->searchable()
+                    ->sortable(),
+                TextColumn::make('actor.fullName')
+                    ->label('Actor')
+                    ->sortable()
+                    ->searchable(),
+                TextColumn::make('subject_type')
+                    ->label('Subject')
+                    ->formatStateUsing(fn (?string $state) => $state ? class_basename($state) : '—')
+                    ->searchable()
+                    ->toggleable(),
+                TextColumn::make('subject_id')
+                    ->label('Subject ID')
+                    ->sortable()
+                    ->toggleable(),
+                TextColumn::make('metadata')
+                    ->label('Fields')
+                    ->formatStateUsing(function ($state): string {
+                        if (! is_array($state)) {
+                            return '—';
+                        }
+
+                        $fields = $state['fields'] ?? [];
+
+                        return $fields ? implode(', ', $fields) : '—';
+                    })
+                    ->toggleable(isToggledHiddenByDefault: true)
+                    ->wrap(),
+                TextColumn::make('source')
+                    ->label('Source')
+                    ->limit(40)
+                    ->toggleable(isToggledHiddenByDefault: true),
+                TextColumn::make('occurred_at')
+                    ->label('Timestamp')
+                    ->dateTime()
+                    ->sortable(),
+            ])
+            ->filters([
+                //
+            ])
+            ->recordActions([])
+            ->toolbarActions([]);
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ManageSuperAdminActionLogs::route('/'),
+        ];
+    }
+}

app/Filament/Clusters/WeeklyOps/Resources/TaskCollections/Pages/CreateTaskCollection.php

@@ -0,0 +1,16 @@
+<?php
+
+namespace App\Filament\Clusters\WeeklyOps\Resources\TaskCollections\Pages;
+
+use App\Filament\Clusters\WeeklyOps\Resources\TaskCollections\TaskCollectionResource;
+use App\Filament\Resources\Pages\AuditedCreateRecord;
+
+class CreateTaskCollection extends AuditedCreateRecord
+{
+    protected static string $resource = TaskCollectionResource::class;
+
+    protected function mutateFormDataBeforeCreate(array $data): array
+    {
+        return TaskCollectionResource::normalizeData($data);
+    }
+}

app/Filament/Clusters/WeeklyOps/Resources/TaskCollections/Pages/EditTaskCollection.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Filament\Clusters\WeeklyOps\Resources\TaskCollections\Pages;
+
+use App\Filament\Clusters\WeeklyOps\Resources\TaskCollections\TaskCollectionResource;
+use App\Filament\Resources\Pages\AuditedEditRecord;
+use App\Services\Audit\SuperAdminAuditLogger;
+use Filament\Actions;
+
+class EditTaskCollection extends AuditedEditRecord
+{
+    protected static string $resource = TaskCollectionResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            Actions\DeleteAction::make()
+                ->after(fn ($record) => app(SuperAdminAuditLogger::class)->recordModelMutation(
+                    'deleted',
+                    $record,
+                    source: static::class
+                )),
+        ];
+    }
+
+    protected function mutateFormDataBeforeSave(array $data): array
+    {
+        return TaskCollectionResource::normalizeData($data, $this->record);
+    }
+}

app/Filament/Clusters/WeeklyOps/Resources/TaskCollections/Pages/ListTaskCollections.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace App\Filament\Clusters\WeeklyOps\Resources\TaskCollections\Pages;
+
+use App\Filament\Clusters\WeeklyOps\Resources\TaskCollections\TaskCollectionResource;
+use Filament\Actions;
+use Filament\Resources\Pages\ListRecords;
+
+class ListTaskCollections extends ListRecords
+{
+    protected static string $resource = TaskCollectionResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            Actions\CreateAction::make(),
+        ];
+    }
+}

app/Filament/Clusters/WeeklyOps/Resources/TaskCollections/RelationManagers/TasksRelationManager.php

@@ -0,0 +1,127 @@
+<?php
+
+namespace App\Filament\Clusters\WeeklyOps\Resources\TaskCollections\RelationManagers;
+
+use App\Models\Task;
+use Filament\Actions\AttachAction;
+use Filament\Actions\BulkActionGroup;
+use Filament\Actions\DetachAction;
+use Filament\Actions\DetachBulkAction;
+use Filament\Resources\RelationManagers\RelationManager;
+use Filament\Tables\Columns\IconColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Collection;
+use Illuminate\Support\Arr;
+
+class TasksRelationManager extends RelationManager
+{
+    protected static string $relationship = 'tasks';
+
+    protected static ?string $inverseRelationship = 'taskCollections';
+
+    public function table(Table $table): Table
+    {
+        return $table
+            ->columns([
+                TextColumn::make('title')
+                    ->label(__('admin.tasks.table.title'))
+                    ->getStateUsing(fn (Task $record) => $this->formatTaskTitle($record->title))
+                    ->searchable(['title->de', 'title->en'])
+                    ->limit(60),
+                TextColumn::make('emotion.name')
+                    ->label(__('admin.tasks.fields.emotion'))
+                    ->getStateUsing(function (Task $record) {
+                        $value = optional($record->emotion)->name;
+                        if (is_array($value)) {
+                            $locale = app()->getLocale();
+
+                            return $value[$locale] ?? ($value['de'] ?? ($value['en'] ?? ''));
+                        }
+
+                        return (string) ($value ?? '');
+                    })
+                    ->sortable(),
+                TextColumn::make('difficulty')
+                    ->label(__('admin.tasks.fields.difficulty.label'))
+                    ->badge(),
+                IconColumn::make('is_active')
+                    ->label(__('admin.tasks.table.is_active'))
+                    ->boolean(),
+                TextColumn::make('sort_order')
+                    ->label(__('admin.tasks.table.sort_order'))
+                    ->sortable(),
+            ])
+            ->headerActions([
+                AttachAction::make()
+                    ->recordTitle(fn (Task $record) => $this->formatTaskTitle($record->title))
+                    ->recordSelectOptionsQuery(fn (Builder $query): Builder => $query->whereNull('tenant_id'))
+                    ->multiple()
+                    ->after(function (array $data): void {
+                        $collection = $this->getOwnerRecord();
+                        $recordIds = Arr::wrap($data['recordId'] ?? []);
+
+                        if ($recordIds === []) {
+                            return;
+                        }
+
+                        $collection->reassignTasks($recordIds);
+                    }),
+            ])
+            ->recordActions([
+                DetachAction::make()
+                    ->after(function (?Task $record): void {
+                        if (! $record) {
+                            return;
+                        }
+
+                        $collectionId = $this->getOwnerRecord()->getKey();
+
+                        if ($record->collection_id === $collectionId) {
+                            $record->update(['collection_id' => null]);
+                        }
+                    }),
+            ])
+            ->toolbarActions([
+                BulkActionGroup::make([
+                    DetachBulkAction::make()
+                        ->after(function (Collection $records): void {
+                            $collectionId = $this->getOwnerRecord()->getKey();
+
+                            $ids = $records
+                                ->filter(fn (Task $record) => $record->collection_id === $collectionId)
+                                ->pluck('id')
+                                ->all();
+
+                            if ($ids === []) {
+                                return;
+                            }
+
+                            Task::query()
+                                ->whereIn('id', $ids)
+                                ->update(['collection_id' => null]);
+                        }),
+                ]),
+            ]);
+    }
+
+    /**
+     * @param  array<string, string>|string|null  $value
+     */
+    protected function formatTaskTitle(array|string|null $value): string
+    {
+        if (is_array($value)) {
+            $locale = app()->getLocale();
+
+            return $value[$locale]
+                ?? ($value['de'] ?? ($value['en'] ?? Arr::first($value) ?? ''));
+        }
+
+        if (is_string($value)) {
+            return $value;
+        }
+
+        return '';
+    }
+}

app/Filament/Clusters/WeeklyOps/Resources/TaskCollections/TaskCollectionResource.php

@@ -0,0 +1,280 @@
+<?php
+
+namespace App\Filament\Clusters\WeeklyOps\Resources\TaskCollections;
+
+use App\Filament\Clusters\WeeklyOps\Resources\TaskCollections\Pages\CreateTaskCollection;
+use App\Filament\Clusters\WeeklyOps\Resources\TaskCollections\Pages\EditTaskCollection;
+use App\Filament\Clusters\WeeklyOps\Resources\TaskCollections\Pages\ListTaskCollections;
+use App\Filament\Clusters\WeeklyOps\Resources\TaskCollections\RelationManagers\TasksRelationManager;
+use App\Filament\Clusters\WeeklyOps\WeeklyOpsCluster;
+use App\Models\EventType;
+use App\Models\TaskCollection;
+use App\Services\Audit\SuperAdminAuditLogger;
+use BackedEnum;
+use Filament\Actions;
+use Filament\Forms\Components\MarkdownEditor;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Resources\Resource;
+use Filament\Schemas\Components\Tabs as SchemaTabs;
+use Filament\Schemas\Components\Tabs\Tab as SchemaTab;
+use Filament\Schemas\Schema;
+use Filament\Tables\Columns\IconColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Collection;
+use Illuminate\Support\Arr;
+use Illuminate\Support\Str;
+use UnitEnum;
+
+class TaskCollectionResource extends Resource
+{
+    protected static ?string $model = TaskCollection::class;
+
+    protected static BackedEnum|string|null $navigationIcon = 'heroicon-o-rectangle-stack';
+
+    protected static ?string $cluster = WeeklyOpsCluster::class;
+
+    protected static ?string $recordTitleAttribute = 'name';
+
+    protected static ?int $navigationSort = 31;
+
+    public static function form(Schema $schema): Schema
+    {
+        return $schema
+            ->schema([
+                TextInput::make('slug')
+                    ->label(__('admin.common.slug'))
+                    ->maxLength(255)
+                    ->unique(ignoreRecord: true)
+                    ->required(),
+                Select::make('event_type_id')
+                    ->relationship('eventType', 'name')
+                    ->getOptionLabelFromRecordUsing(fn (EventType $record) => is_array($record->name) ? ($record->name['de'] ?? $record->name['en'] ?? __('admin.common.unnamed')) : $record->name)
+                    ->searchable()
+                    ->preload()
+                    ->label(__('admin.task_collections.fields.event_type_optional')),
+                SchemaTabs::make('content_tabs')
+                    ->label(__('admin.task_collections.fields.content_localization'))
+                    ->tabs([
+                        SchemaTab::make(__('admin.common.german'))
+                            ->icon('heroicon-o-language')
+                            ->schema([
+                                TextInput::make('name_translations.de')
+                                    ->label(__('admin.task_collections.fields.name_de'))
+                                    ->required(),
+                                MarkdownEditor::make('description_translations.de')
+                                    ->label(__('admin.task_collections.fields.description_de'))
+                                    ->columnSpanFull(),
+                            ]),
+                        SchemaTab::make(__('admin.common.english'))
+                            ->icon('heroicon-o-language')
+                            ->schema([
+                                TextInput::make('name_translations.en')
+                                    ->label(__('admin.task_collections.fields.name_en'))
+                                    ->required(),
+                                MarkdownEditor::make('description_translations.en')
+                                    ->label(__('admin.task_collections.fields.description_en'))
+                                    ->columnSpanFull(),
+                            ]),
+                    ])
+                    ->columnSpanFull(),
+                Toggle::make('is_default')
+                    ->label(__('admin.task_collections.fields.is_default'))
+                    ->default(false),
+                TextInput::make('position')
+                    ->label(__('admin.task_collections.fields.position'))
+                    ->numeric()
+                    ->default(0),
+            ])
+            ->columns(2);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return $table
+            ->columns([
+                TextColumn::make('id')
+                    ->label('#')
+                    ->sortable(),
+                TextColumn::make('name')
+                    ->label(__('admin.task_collections.table.name'))
+                    ->getStateUsing(fn (TaskCollection $record) => static::formatTranslation($record->name_translations))
+                    ->searchable(['name_translations->de', 'name_translations->en'])
+                    ->limit(60),
+                TextColumn::make('eventType.name')
+                    ->label(__('admin.task_collections.table.event_type'))
+                    ->getStateUsing(function (TaskCollection $record) {
+                        $value = optional($record->eventType)->name;
+
+                        if (is_array($value)) {
+                            $locale = app()->getLocale();
+
+                            return $value[$locale] ?? ($value['de'] ?? ($value['en'] ?? ''));
+                        }
+
+                        return (string) ($value ?? '');
+                    })
+                    ->toggleable(),
+                TextColumn::make('slug')
+                    ->label(__('admin.task_collections.table.slug'))
+                    ->toggleable()
+                    ->searchable(),
+                IconColumn::make('is_default')
+                    ->label(__('admin.task_collections.table.is_default'))
+                    ->boolean(),
+                TextColumn::make('position')
+                    ->label(__('admin.task_collections.table.position'))
+                    ->sortable(),
+                TextColumn::make('tasks_count')
+                    ->label(__('admin.task_collections.table.tasks'))
+                    ->sortable(),
+                TextColumn::make('events_count')
+                    ->label(__('admin.task_collections.table.events'))
+                    ->sortable(),
+            ])
+            ->filters([
+                SelectFilter::make('event_type_id')
+                    ->label(__('admin.task_collections.table.event_type'))
+                    ->relationship(
+                        'eventType',
+                        'name',
+                        fn (Builder $query): Builder => $query->orderBy('name->de')
+                    )
+                    ->getOptionLabelFromRecordUsing(fn (EventType $record) => is_array($record->name) ? ($record->name['de'] ?? $record->name['en'] ?? __('admin.common.unnamed')) : $record->name),
+                SelectFilter::make('is_default')
+                    ->label(__('admin.task_collections.table.is_default'))
+                    ->options([
+                        '1' => __('admin.common.yes'),
+                        '0' => __('admin.common.no'),
+                    ]),
+            ])
+            ->recordActions([
+                Actions\EditAction::make()
+                    ->mutateDataUsing(fn (array $data, TaskCollection $record): array => static::normalizeData($data, $record))
+                    ->after(fn (array $data, TaskCollection $record) => app(SuperAdminAuditLogger::class)->recordModelMutation(
+                        'updated',
+                        $record,
+                        SuperAdminAuditLogger::fieldsMetadata($data),
+                        static::class
+                    )),
+                Actions\DeleteAction::make()
+                    ->after(fn (TaskCollection $record) => app(SuperAdminAuditLogger::class)->recordModelMutation(
+                        'deleted',
+                        $record,
+                        source: static::class
+                    )),
+            ])
+            ->bulkActions([
+                Actions\DeleteBulkAction::make()
+                    ->after(function (Collection $records): void {
+                        $logger = app(SuperAdminAuditLogger::class);
+
+                        foreach ($records as $record) {
+                            $logger->recordModelMutation(
+                                'deleted',
+                                $record,
+                                source: static::class
+                            );
+                        }
+                    }),
+            ]);
+    }
+
+    public static function getNavigationLabel(): string
+    {
+        return __('admin.task_collections.menu');
+    }
+
+    public static function getNavigationGroup(): UnitEnum|string|null
+    {
+        return __('admin.nav.curation');
+    }
+
+    public static function getEloquentQuery(): Builder
+    {
+        return parent::getEloquentQuery()
+            ->whereNull('tenant_id')
+            ->with('eventType')
+            ->withCount(['tasks', 'events']);
+    }
+
+    /**
+     * @param  array<string, mixed>  $data
+     */
+    public static function normalizeData(array $data, ?TaskCollection $record = null): array
+    {
+        $data['tenant_id'] = null;
+        $data['slug'] = static::resolveSlug($data, $record);
+
+        return $data;
+    }
+
+    /**
+     * @param  array<string, mixed>  $data
+     */
+    protected static function resolveSlug(array $data, ?TaskCollection $record = null): string
+    {
+        $rawSlug = trim((string) ($data['slug'] ?? ''));
+        $translations = Arr::wrap($data['name_translations'] ?? []);
+        $fallbackName = (string) ($translations['en'] ?? $translations['de'] ?? '');
+
+        $base = $rawSlug !== '' ? $rawSlug : $fallbackName;
+        $slugBase = Str::slug($base) ?: 'collection';
+
+        $query = TaskCollection::query()->where('slug', $slugBase);
+
+        if ($record) {
+            $query->whereKeyNot($record->getKey());
+        }
+
+        if (! $query->exists()) {
+            return $slugBase;
+        }
+
+        do {
+            $candidate = $slugBase.'-'.Str::random(4);
+            $candidateQuery = TaskCollection::query()->where('slug', $candidate);
+
+            if ($record) {
+                $candidateQuery->whereKeyNot($record->getKey());
+            }
+        } while ($candidateQuery->exists());
+
+        return $candidate;
+    }
+
+    /**
+     * @param  array<string, string>|null  $translations
+     */
+    protected static function formatTranslation(?array $translations): string
+    {
+        if (! is_array($translations)) {
+            return '';
+        }
+
+        $locale = app()->getLocale();
+
+        return $translations[$locale]
+            ?? ($translations['de'] ?? ($translations['en'] ?? Arr::first($translations) ?? ''));
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListTaskCollections::route('/'),
+            'create' => CreateTaskCollection::route('/create'),
+            'edit' => EditTaskCollection::route('/{record}/edit'),
+        ];
+    }
+
+    public static function getRelations(): array
+    {
+        return [
+            TasksRelationManager::class,
+        ];
+    }
+}

app/Filament/Resources/AiStyles/AiStyleResource.php

@@ -0,0 +1,305 @@
+<?php
+
+namespace App\Filament\Resources\AiStyles;
+
+use App\Filament\Clusters\RareAdmin\RareAdminCluster;
+use App\Filament\Resources\AiStyles\Pages\ManageAiStyles;
+use App\Models\AiStyle;
+use App\Services\AiEditing\RunwareModelSearchService;
+use App\Services\Audit\SuperAdminAuditLogger;
+use BackedEnum;
+use Filament\Actions;
+use Filament\Forms\Components\KeyValue;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\Textarea;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Resources\Resource;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Components\Utilities\Get;
+use Filament\Schemas\Components\Utilities\Set;
+use Filament\Schemas\Schema;
+use Filament\Tables;
+use Filament\Tables\Table;
+use UnitEnum;
+
+class AiStyleResource extends Resource
+{
+    protected static ?string $model = AiStyle::class;
+
+    protected static ?string $cluster = RareAdminCluster::class;
+
+    protected static BackedEnum|string|null $navigationIcon = 'heroicon-o-paint-brush';
+
+    protected static UnitEnum|string|null $navigationGroup = null;
+
+    protected static ?int $navigationSort = 31;
+
+    public static function getNavigationGroup(): UnitEnum|string|null
+    {
+        return __('admin.nav.platform');
+    }
+
+    public static function getNavigationLabel(): string
+    {
+        return 'AI Styles';
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return $schema->schema([
+            Section::make('Style Basics')
+                ->schema([
+                    TextInput::make('key')
+                        ->required()
+                        ->maxLength(120)
+                        ->unique(ignoreRecord: true),
+                    TextInput::make('name')
+                        ->required()
+                        ->maxLength(120),
+                    TextInput::make('version')
+                        ->numeric()
+                        ->default(1)
+                        ->disabled()
+                        ->dehydrated(false)
+                        ->helperText('Auto-increments when core style configuration changes.'),
+                    TextInput::make('category')
+                        ->maxLength(50),
+                    TextInput::make('sort')
+                        ->numeric()
+                        ->default(0)
+                        ->required(),
+                    Toggle::make('is_active')
+                        ->default(true),
+                    Toggle::make('is_premium')
+                        ->default(false),
+                    Toggle::make('requires_source_image')
+                        ->default(true),
+                ])
+                ->columns(3),
+            Section::make('Provider Binding')
+                ->schema([
+                    Select::make('provider')
+                        ->options([
+                            'runware' => 'runware.ai',
+                        ])
+                        ->required()
+                        ->default('runware'),
+                    Select::make('provider_model')
+                        ->label('Runware model (AIR)')
+                        ->searchable()
+                        ->getSearchResultsUsing(static fn (string $search): array => app(RunwareModelSearchService::class)->searchOptions($search))
+                        ->getOptionLabelUsing(static fn (mixed $value): ?string => app(RunwareModelSearchService::class)->labelForModel($value))
+                        ->helperText('Start typing to search models from runware.ai.')
+                        ->native(false)
+                        ->live()
+                        ->afterStateUpdated(static function (Set $set, ?string $state): void {
+                            self::applySelectedRunwareModel($set, $state);
+                        }),
+                ])
+                ->columns(2),
+            Section::make('Runware Generation')
+                ->schema([
+                    TextInput::make('metadata.runware.generation.width')
+                        ->label('Width')
+                        ->numeric()
+                        ->minValue(64)
+                        ->maxValue(4096)
+                        ->step(64)
+                        ->helperText(static fn (Get $get): ?string => self::dimensionConstraintHint($get, 'width')),
+                    TextInput::make('metadata.runware.generation.height')
+                        ->label('Height')
+                        ->numeric()
+                        ->minValue(64)
+                        ->maxValue(4096)
+                        ->step(64)
+                        ->helperText(static fn (Get $get): ?string => self::dimensionConstraintHint($get, 'height')),
+                    TextInput::make('metadata.runware.generation.steps')
+                        ->label('Steps')
+                        ->numeric()
+                        ->minValue(1)
+                        ->maxValue(150)
+                        ->helperText(static fn (Get $get): ?string => self::rangeConstraintHint($get, 'steps')),
+                    TextInput::make('metadata.runware.generation.cfg_scale')
+                        ->label('CFG Scale')
+                        ->numeric()
+                        ->minValue(0)
+                        ->maxValue(30)
+                        ->step(0.1)
+                        ->helperText(static fn (Get $get): ?string => self::rangeConstraintHint($get, 'cfg_scale')),
+                    TextInput::make('metadata.runware.generation.strength')
+                        ->label('Strength')
+                        ->numeric()
+                        ->minValue(0)
+                        ->maxValue(1)
+                        ->step(0.01)
+                        ->helperText(static fn (Get $get): ?string => self::rangeConstraintHint($get, 'strength')),
+                    Select::make('metadata.runware.generation.output_format')
+                        ->label('Output format')
+                        ->options([
+                            'JPG' => 'JPG',
+                            'PNG' => 'PNG',
+                            'WEBP' => 'WEBP',
+                        ])
+                        ->default('JPG')
+                        ->native(false),
+                    Select::make('metadata.runware.generation.delivery_method')
+                        ->label('Delivery method')
+                        ->options([
+                            'async' => 'async (queue + poll)',
+                            'sync' => 'sync',
+                        ])
+                        ->default('async')
+                        ->native(false),
+                ])
+                ->columns(3),
+            Section::make('Prompts')
+                ->schema([
+                    Textarea::make('description')
+                        ->rows(2),
+                    Textarea::make('prompt_template')
+                        ->rows(5),
+                    Textarea::make('negative_prompt_template')
+                        ->rows(4),
+                ]),
+            Section::make('Metadata')
+                ->schema([
+                    KeyValue::make('metadata')
+                        ->nullable(),
+                ]),
+        ]);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return $table
+            ->defaultSort('sort')
+            ->columns([
+                Tables\Columns\TextColumn::make('key')
+                    ->searchable()
+                    ->copyable(),
+                Tables\Columns\TextColumn::make('name')
+                    ->searchable(),
+                Tables\Columns\TextColumn::make('version')
+                    ->sortable()
+                    ->toggleable(),
+                Tables\Columns\TextColumn::make('provider')
+                    ->badge(),
+                Tables\Columns\TextColumn::make('provider_model')
+                    ->toggleable(),
+                Tables\Columns\IconColumn::make('is_active')
+                    ->boolean(),
+                Tables\Columns\IconColumn::make('is_premium')
+                    ->boolean(),
+                Tables\Columns\TextColumn::make('sort')
+                    ->sortable(),
+                Tables\Columns\TextColumn::make('updated_at')
+                    ->since()
+                    ->toggleable(),
+            ])
+            ->filters([
+                Tables\Filters\TernaryFilter::make('is_active'),
+                Tables\Filters\TernaryFilter::make('is_premium'),
+            ])
+            ->actions([
+                Actions\EditAction::make()
+                    ->after(fn (array $data, AiStyle $record) => app(SuperAdminAuditLogger::class)->recordModelMutation(
+                        'updated',
+                        $record,
+                        SuperAdminAuditLogger::fieldsMetadata(array_keys($data)),
+                        static::class
+                    )),
+                Actions\DeleteAction::make()
+                    ->after(fn (AiStyle $record) => app(SuperAdminAuditLogger::class)->recordModelMutation(
+                        'deleted',
+                        $record,
+                        source: static::class
+                    )),
+            ])
+            ->bulkActions([
+                Actions\DeleteBulkAction::make(),
+            ]);
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ManageAiStyles::route('/'),
+        ];
+    }
+
+    private static function applySelectedRunwareModel(Set $set, ?string $air): void
+    {
+        if (! is_string($air) || trim($air) === '') {
+            return;
+        }
+
+        $model = app(RunwareModelSearchService::class)->findByAir($air);
+        if (! is_array($model)) {
+            return;
+        }
+
+        $set('metadata.runware.model.air', $model['air']);
+        $set('metadata.runware.model.name', $model['name']);
+        $set('metadata.runware.model.architecture', $model['architecture']);
+        $set('metadata.runware.model.category', $model['category']);
+
+        foreach ((array) ($model['constraints'] ?? []) as $key => $value) {
+            $set("metadata.runware.constraints.{$key}", $value);
+        }
+
+        self::setIfNumeric($set, 'metadata.runware.generation.width', $model['defaults']['width'] ?? null);
+        self::setIfNumeric($set, 'metadata.runware.generation.height', $model['defaults']['height'] ?? null);
+        self::setIfNumeric($set, 'metadata.runware.generation.steps', $model['defaults']['steps'] ?? null);
+        self::setIfNumeric($set, 'metadata.runware.generation.cfg_scale', $model['defaults']['cfg_scale'] ?? null);
+    }
+
+    private static function setIfNumeric(Set $set, string $path, mixed $value): void
+    {
+        if (is_numeric($value)) {
+            $set($path, $value);
+        }
+    }
+
+    private static function dimensionConstraintHint(Get $get, string $dimension): ?string
+    {
+        $min = $get("metadata.runware.constraints.min_{$dimension}");
+        $max = $get("metadata.runware.constraints.max_{$dimension}");
+        $step = $get("metadata.runware.constraints.{$dimension}_step");
+
+        if (! is_numeric($min) && ! is_numeric($max) && ! is_numeric($step)) {
+            return null;
+        }
+
+        $parts = [];
+        if (is_numeric($min) || is_numeric($max)) {
+            $parts[] = sprintf(
+                'Model range: %s - %s',
+                is_numeric($min) ? (string) (int) $min : '?',
+                is_numeric($max) ? (string) (int) $max : '?'
+            );
+        }
+
+        if (is_numeric($step) && (int) $step > 0) {
+            $parts[] = sprintf('Step: %d', (int) $step);
+        }
+
+        return $parts !== [] ? implode(' | ', $parts) : null;
+    }
+
+    private static function rangeConstraintHint(Get $get, string $field): ?string
+    {
+        $min = $get("metadata.runware.constraints.min_{$field}");
+        $max = $get("metadata.runware.constraints.max_{$field}");
+
+        if (! is_numeric($min) && ! is_numeric($max)) {
+            return null;
+        }
+
+        return sprintf(
+            'Model range: %s - %s',
+            is_numeric($min) ? trim((string) $min) : '?',
+            is_numeric($max) ? trim((string) $max) : '?'
+        );
+    }
+}

app/Filament/Resources/AiStyles/Pages/ManageAiStyles.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Filament\Resources\AiStyles\Pages;
+
+use App\Filament\Resources\AiStyles\AiStyleResource;
+use App\Services\Audit\SuperAdminAuditLogger;
+use Filament\Actions;
+use Filament\Resources\Pages\ManageRecords;
+
+class ManageAiStyles extends ManageRecords
+{
+    protected static string $resource = AiStyleResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            Actions\CreateAction::make()
+                ->after(fn (array $data, $record) => app(SuperAdminAuditLogger::class)->recordModelMutation(
+                    'created',
+                    $record,
+                    SuperAdminAuditLogger::fieldsMetadata(array_keys($data)),
+                    static::class
+                )),
+        ];
+    }
+}

app/Filament/Resources/Coupons/Pages/CreateCoupon.php

@@ -3,15 +3,17 @@
 namespace App\Filament\Resources\Coupons\Pages;
 
 use App\Filament\Resources\Coupons\CouponResource;
-use App\Jobs\SyncCouponToPaddle;
+use App\Filament\Resources\Pages\AuditedCreateRecord;
-use Filament\Resources\Pages\CreateRecord;
+use App\Jobs\SyncCouponToLemonSqueezy;
 
-class CreateCoupon extends CreateRecord
+class CreateCoupon extends AuditedCreateRecord
 {
     protected static string $resource = CouponResource::class;
 
     protected function afterCreate(): void
     {
-        SyncCouponToPaddle::dispatch($this->record);
+        parent::afterCreate();
+
+        SyncCouponToLemonSqueezy::dispatch($this->record);
     }
 }

app/Filament/Resources/Coupons/Pages/EditCoupon.php

@@ -3,14 +3,15 @@
 namespace App\Filament\Resources\Coupons\Pages;
 
 use App\Filament\Resources\Coupons\CouponResource;
-use App\Jobs\SyncCouponToPaddle;
+use App\Filament\Resources\Pages\AuditedEditRecord;
+use App\Jobs\SyncCouponToLemonSqueezy;
+use App\Services\Audit\SuperAdminAuditLogger;
 use Filament\Actions\DeleteAction;
 use Filament\Actions\ForceDeleteAction;
 use Filament\Actions\RestoreAction;
 use Filament\Actions\ViewAction;
-use Filament\Resources\Pages\EditRecord;
 
-class EditCoupon extends EditRecord
+class EditCoupon extends AuditedEditRecord
 {
     protected static string $resource = CouponResource::class;
 
@@ -19,14 +20,34 @@ class EditCoupon extends EditRecord
         return [
             ViewAction::make(),
             DeleteAction::make()
-                ->after(fn ($record) => SyncCouponToPaddle::dispatch($record, true)),
+                ->after(function ($record): void {
-            ForceDeleteAction::make(),
+                    app(SuperAdminAuditLogger::class)->recordModelMutation(
-            RestoreAction::make(),
+                        'deleted',
+                        $record,
+                        source: static::class
+                    );
+
+                    SyncCouponToLemonSqueezy::dispatch($record, true);
+                }),
+            ForceDeleteAction::make()
+                ->after(fn ($record) => app(SuperAdminAuditLogger::class)->recordModelMutation(
+                    'force_deleted',
+                    $record,
+                    source: static::class
+                )),
+            RestoreAction::make()
+                ->after(fn ($record) => app(SuperAdminAuditLogger::class)->recordModelMutation(
+                    'restored',
+                    $record,
+                    source: static::class
+                )),
         ];
     }
 
     protected function afterSave(): void
     {
-        SyncCouponToPaddle::dispatch($this->record);
+        parent::afterSave();
+
+        SyncCouponToLemonSqueezy::dispatch($this->record);
     }
 }

app/Filament/Resources/Coupons/Pages/ViewCoupon.php

@@ -3,6 +3,7 @@
 namespace App\Filament\Resources\Coupons\Pages;
 
 use App\Filament\Resources\Coupons\CouponResource;
+use App\Services\Audit\SuperAdminAuditLogger;
 use Filament\Actions\EditAction;
 use Filament\Resources\Pages\ViewRecord;
 
@@ -13,7 +14,13 @@ class ViewCoupon extends ViewRecord
     protected function getHeaderActions(): array
     {
         return [
-            EditAction::make(),
+            EditAction::make()
+                ->after(fn (array $data, $record) => app(SuperAdminAuditLogger::class)->recordModelMutation(
+                    'updated',
+                    $record,
+                    SuperAdminAuditLogger::fieldsMetadata($data),
+                    static::class
+                )),
         ];
     }
 }

app/Filament/Resources/Coupons/RelationManagers/RedemptionsRelationManager.php

@@ -7,6 +7,7 @@ use Filament\Schemas\Schema;
 use Filament\Tables\Columns\TextColumn;
 use Filament\Tables\Filters\SelectFilter;
 use Filament\Tables\Table;
+use Illuminate\Support\Str;
 
 class RedemptionsRelationManager extends RelationManager
 {
@@ -20,11 +21,35 @@ class RedemptionsRelationManager extends RelationManager
     public function table(Table $table): Table
     {
         return $table
-            ->recordTitleAttribute('paddle_transaction_id')
+            ->recordTitleAttribute('lemonsqueezy_order_id')
             ->columns([
                 TextColumn::make('tenant.name')
                     ->label(__('Tenant'))
                     ->searchable(),
+                TextColumn::make('ip_address')
+                    ->label(__('IP'))
+                    ->copyable()
+                    ->toggleable(isToggledHiddenByDefault: true),
+                TextColumn::make('device_id')
+                    ->label(__('Device'))
+                    ->copyable()
+                    ->toggleable(isToggledHiddenByDefault: true),
+                TextColumn::make('user_agent')
+                    ->label(__('User agent'))
+                    ->toggleable(isToggledHiddenByDefault: true)
+                    ->wrap(),
+                TextColumn::make('fraud_ip')
+                    ->label(__('IP reputation'))
+                    ->badge()
+                    ->formatStateUsing(fn ($state, $record) => self::formatReputation(data_get($record->metadata, 'fraud.ip')))
+                    ->color(fn ($state, $record) => self::riskColor(data_get($record->metadata, 'fraud.ip.risk')))
+                    ->toggleable(isToggledHiddenByDefault: true),
+                TextColumn::make('fraud_device')
+                    ->label(__('Device reputation'))
+                    ->badge()
+                    ->formatStateUsing(fn ($state, $record) => self::formatReputation(data_get($record->metadata, 'fraud.device')))
+                    ->color(fn ($state, $record) => self::riskColor(data_get($record->metadata, 'fraud.device.risk')))
+                    ->toggleable(isToggledHiddenByDefault: true),
                 TextColumn::make('user.name')
                     ->label(__('User'))
                     ->toggleable(isToggledHiddenByDefault: true),
@@ -40,7 +65,7 @@ class RedemptionsRelationManager extends RelationManager
                         'failed' => 'danger',
                         default => 'warning',
                     }),
-                TextColumn::make('paddle_transaction_id')
+                TextColumn::make('lemonsqueezy_order_id')
                     ->label(__('Transaction'))
                     ->copyable()
                     ->toggleable(isToggledHiddenByDefault: true),
@@ -69,4 +94,30 @@ class RedemptionsRelationManager extends RelationManager
             ->recordActions([])
             ->toolbarActions([]);
     }
+
+    /**
+     * @param  array{risk?: string, recent_failed?: int, recent_total?: int}|null  $snapshot
+     */
+    private static function formatReputation(?array $snapshot): string
+    {
+        if (! $snapshot) {
+            return '—';
+        }
+
+        $risk = Str::headline($snapshot['risk'] ?? 'unknown');
+        $failed = (int) ($snapshot['recent_failed'] ?? 0);
+        $total = (int) ($snapshot['recent_total'] ?? 0);
+
+        return sprintf('%s (%d/%d)', $risk, $failed, $total);
+    }
+
+    private static function riskColor(?string $risk): string
+    {
+        return match ($risk) {
+            'high' => 'danger',
+            'medium' => 'warning',
+            'low' => 'success',
+            default => 'gray',
+        };
+    }
 }

app/Filament/Resources/Coupons/Schemas/CouponForm.php

@@ -123,22 +123,22 @@ class CouponForm
                             ->nullable()
                             ->columnSpanFull(),
                     ]),
-                Section::make(__('Paddle sync'))
+                Section::make(__('Lemon Squeezy sync'))
                     ->columns(2)
                     ->schema([
-                        Select::make('paddle_mode')
+                        Select::make('lemonsqueezy_mode')
-                            ->label(__('Paddle mode'))
+                            ->label(__('Lemon Squeezy mode'))
                             ->options([
                                 'standard' => __('Standard'),
                                 'custom' => __('Custom (one-off)'),
                             ])
                             ->default('standard'),
-                        Placeholder::make('paddle_discount_id')
+                        Placeholder::make('lemonsqueezy_discount_id')
-                            ->label(__('Paddle Discount ID'))
+                            ->label(__('Lemon Squeezy Discount ID'))
-                            ->content(fn ($record) => $record?->paddle_discount_id ?? '—'),
+                            ->content(fn ($record) => $record?->lemonsqueezy_discount_id ?? '—'),
-                        Placeholder::make('paddle_last_synced_at')
+                        Placeholder::make('lemonsqueezy_last_synced_at')
                             ->label(__('Last synced'))
-                            ->content(fn ($record) => $record?->paddle_last_synced_at?->diffForHumans() ?? '—'),
+                            ->content(fn ($record) => $record?->lemonsqueezy_last_synced_at?->diffForHumans() ?? '—'),
                         Placeholder::make('redemptions_count')
                             ->label(__('Total redemptions'))
                             ->content(fn ($record) => number_format($record?->redemptions_count ?? 0)),

app/Filament/Resources/Coupons/Schemas/CouponInfolist.php

@@ -2,9 +2,11 @@
 
 namespace App\Filament\Resources\Coupons\Schemas;
 
+use App\Enums\CouponStatus;
+use App\Enums\CouponType;
 use Filament\Infolists\Components\KeyValueEntry;
-use Filament\Infolists\Components\Section;
 use Filament\Infolists\Components\TextEntry;
+use Filament\Schemas\Components\Section;
 use Filament\Schemas\Schema;
 use Illuminate\Support\Str;
 
@@ -22,11 +24,11 @@ class CouponInfolist
                         TextEntry::make('status')
                             ->label(__('Status'))
                             ->badge()
-                            ->formatStateUsing(fn ($state) => Str::headline($state)),
+                            ->formatStateUsing(fn ($state) => static::formatEnumState($state)),
                         TextEntry::make('type')
                             ->label(__('Discount type'))
                             ->badge()
-                            ->formatStateUsing(fn ($state) => Str::headline($state)),
+                            ->formatStateUsing(fn ($state) => static::formatEnumState($state)),
                         TextEntry::make('amount')
                             ->label(__('Amount'))
                             ->formatStateUsing(fn ($state, $record) => $record?->type?->value === 'percentage'
@@ -61,21 +63,38 @@ class CouponInfolist
                         TextEntry::make('description')->label(__('Description'))->columnSpanFull(),
                         KeyValueEntry::make('metadata')->label(__('Metadata'))->columnSpanFull(),
                     ]),
-                Section::make(__('Paddle'))
+                Section::make(__('Lemon Squeezy'))
                     ->columns(3)
                     ->schema([
-                        TextEntry::make('paddle_discount_id')
+                        TextEntry::make('lemonsqueezy_discount_id')
                             ->label(__('Discount ID'))
                             ->copyable()
                             ->placeholder('—'),
-                        TextEntry::make('paddle_last_synced_at')
+                        TextEntry::make('lemonsqueezy_last_synced_at')
                             ->label(__('Last synced'))
-                            ->state(fn ($record) => $record?->paddle_last_synced_at?->diffForHumans() ?? '—'),
+                            ->state(fn ($record) => $record?->lemonsqueezy_last_synced_at?->diffForHumans() ?? '—'),
-                        TextEntry::make('paddle_mode')
+                        TextEntry::make('lemonsqueezy_mode')
                             ->label(__('Mode'))
                             ->badge()
                             ->placeholder('standard'),
                     ]),
             ]);
     }
+
+    public static function formatEnumState(mixed $state): string
+    {
+        if ($state instanceof CouponType || $state instanceof CouponStatus) {
+            return $state->label();
+        }
+
+        if ($state instanceof \BackedEnum) {
+            return Str::headline($state->value);
+        }
+
+        if (is_string($state)) {
+            return Str::headline($state);
+        }
+
+        return '';
+    }
 }

app/Filament/Resources/Coupons/Tables/CouponsTable.php

@@ -4,7 +4,8 @@ namespace App\Filament\Resources\Coupons\Tables;
 
 use App\Enums\CouponStatus;
 use App\Enums\CouponType;
-use App\Jobs\SyncCouponToPaddle;
+use App\Jobs\SyncCouponToLemonSqueezy;
+use App\Services\Audit\SuperAdminAuditLogger;
 use Filament\Actions\Action;
 use Filament\Actions\BulkActionGroup;
 use Filament\Actions\DeleteBulkAction;
@@ -18,6 +19,7 @@ use Filament\Tables\Filters\SelectFilter;
 use Filament\Tables\Filters\TernaryFilter;
 use Filament\Tables\Filters\TrashedFilter;
 use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Collection;
 use Illuminate\Support\Str;
 
 class CouponsTable
@@ -38,7 +40,7 @@ class CouponsTable
                 TextColumn::make('type')
                     ->label(__('Type'))
                     ->badge()
-                    ->formatStateUsing(fn ($state) => Str::headline($state))
+                    ->formatStateUsing(fn ($state) => static::formatEnumState($state))
                     ->sortable(),
                 TextColumn::make('amount')
                     ->label(__('Amount'))
@@ -57,7 +59,7 @@ class CouponsTable
                     ->label(__('Status'))
                     ->badge()
                     ->sortable()
-                    ->formatStateUsing(fn ($state) => Str::headline($state)),
+                    ->formatStateUsing(fn ($state) => static::formatEnumState($state)),
                 TextColumn::make('starts_at')
                     ->label(__('Starts'))
                     ->date()
@@ -95,19 +97,75 @@ class CouponsTable
             ])
             ->recordActions([
                 ViewAction::make(),
-                EditAction::make(),
+                EditAction::make()
+                    ->after(fn (array $data, $record) => app(SuperAdminAuditLogger::class)->recordModelMutation(
+                        'updated',
+                        $record,
+                        SuperAdminAuditLogger::fieldsMetadata($data),
+                        static::class
+                    )),
                 Action::make('sync')
-                    ->label(__('Sync to Paddle'))
+                    ->label(__('Sync to Lemon Squeezy'))
                     ->icon('heroicon-m-arrow-path')
-                    ->action(fn ($record) => SyncCouponToPaddle::dispatch($record))
+                    ->action(fn ($record) => SyncCouponToLemonSqueezy::dispatch($record))
                     ->requiresConfirmation(),
             ])
             ->toolbarActions([
                 BulkActionGroup::make([
-                    DeleteBulkAction::make(),
+                    DeleteBulkAction::make()
-                    ForceDeleteBulkAction::make(),
+                        ->after(function (Collection $records): void {
-                    RestoreBulkAction::make(),
+                            $logger = app(SuperAdminAuditLogger::class);
+
+                            foreach ($records as $record) {
+                                $logger->recordModelMutation(
+                                    'deleted',
+                                    $record,
+                                    source: static::class
+                                );
+                            }
+                        }),
+                    ForceDeleteBulkAction::make()
+                        ->after(function (Collection $records): void {
+                            $logger = app(SuperAdminAuditLogger::class);
+
+                            foreach ($records as $record) {
+                                $logger->recordModelMutation(
+                                    'force_deleted',
+                                    $record,
+                                    source: static::class
+                                );
+                            }
+                        }),
+                    RestoreBulkAction::make()
+                        ->after(function (Collection $records): void {
+                            $logger = app(SuperAdminAuditLogger::class);
+
+                            foreach ($records as $record) {
+                                $logger->recordModelMutation(
+                                    'restored',
+                                    $record,
+                                    source: static::class
+                                );
+                            }
+                        }),
                 ]),
             ]);
     }
+
+    public static function formatEnumState(mixed $state): string
+    {
+        if ($state instanceof CouponType || $state instanceof CouponStatus) {
+            return $state->label();
+        }
+
+        if ($state instanceof \BackedEnum) {
+            return Str::headline($state->value);
+        }
+
+        if (is_string($state)) {
+            return Str::headline($state);
+        }
+
+        return '';
+    }
 }

app/Filament/Resources/DataExportResource.php

@@ -0,0 +1,78 @@
+<?php
+
+namespace App\Filament\Resources;
+
+use App\Filament\Clusters\RareAdmin\RareAdminCluster;
+use App\Filament\Resources\DataExportResource\Pages\CreateDataExport;
+use App\Filament\Resources\DataExportResource\Pages\ListDataExports;
+use App\Filament\Resources\DataExportResource\Schemas\DataExportForm;
+use App\Filament\Resources\DataExportResource\Tables\DataExportTable;
+use App\Models\DataExport;
+use BackedEnum;
+use Filament\Resources\Resource;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use UnitEnum;
+
+class DataExportResource extends Resource
+{
+    protected static ?string $model = DataExport::class;
+
+    protected static ?string $cluster = RareAdminCluster::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedArrowDownTray;
+
+    protected static UnitEnum|string|null $navigationGroup = null;
+
+    protected static ?int $navigationSort = 50;
+
+    public static function form(Schema $schema): Schema
+    {
+        return DataExportForm::configure($schema);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return DataExportTable::configure($table);
+    }
+
+    public static function getNavigationLabel(): string
+    {
+        return __('admin.data_exports.navigation.label');
+    }
+
+    public static function getNavigationGroup(): UnitEnum|string|null
+    {
+        return __('admin.nav.platform');
+    }
+
+    public static function getEloquentQuery(): Builder
+    {
+        return parent::getEloquentQuery()->with(['tenant', 'event', 'user']);
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListDataExports::route('/'),
+            'create' => CreateDataExport::route('/create'),
+        ];
+    }
+
+    public static function canEdit($record): bool
+    {
+        return false;
+    }
+
+    public static function canDelete($record): bool
+    {
+        return false;
+    }
+
+    public static function canDeleteAny(): bool
+    {
+        return false;
+    }
+}

app/Filament/Resources/DataExportResource/Pages/CreateDataExport.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Filament\Resources\DataExportResource\Pages;
+
+use App\Enums\DataExportScope;
+use App\Filament\Resources\DataExportResource;
+use App\Filament\Resources\Pages\AuditedCreateRecord;
+use App\Jobs\GenerateDataExport;
+use App\Models\DataExport;
+use Filament\Facades\Filament;
+
+class CreateDataExport extends AuditedCreateRecord
+{
+    protected static string $resource = DataExportResource::class;
+
+    protected function mutateFormDataBeforeCreate(array $data): array
+    {
+        $data['user_id'] = Filament::auth()->id();
+        $data['status'] = DataExport::STATUS_PENDING;
+
+        if (($data['scope'] ?? null) !== DataExportScope::EVENT->value) {
+            $data['event_id'] = null;
+        }
+
+        return $data;
+    }
+
+    protected function afterCreate(): void
+    {
+        parent::afterCreate();
+
+        GenerateDataExport::dispatch($this->record->id);
+    }
+}

app/Filament/Resources/DataExportResource/Pages/ListDataExports.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Filament\Resources\DataExportResource\Pages;
+
+use App\Filament\Resources\DataExportResource;
+use Filament\Actions\CreateAction;
+use Filament\Resources\Pages\ListRecords;
+
+class ListDataExports extends ListRecords
+{
+    protected static string $resource = DataExportResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            CreateAction::make()
+                ->label(__('admin.data_exports.actions.request')),
+        ];
+    }
+}

app/Filament/Resources/DataExportResource/Schemas/DataExportForm.php

@@ -0,0 +1,68 @@
+<?php
+
+namespace App\Filament\Resources\DataExportResource\Schemas;
+
+use App\Enums\DataExportScope;
+use App\Models\Event;
+use App\Models\Tenant;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\Toggle;
+use Filament\Forms\Get;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+
+class DataExportForm
+{
+    public static function configure(Schema $schema): Schema
+    {
+        return $schema->schema([
+            Section::make(__('admin.data_exports.sections.request'))
+                ->schema([
+                    Select::make('scope')
+                        ->label(__('admin.data_exports.fields.scope'))
+                        ->options([
+                            DataExportScope::TENANT->value => __('admin.data_exports.scope.tenant'),
+                            DataExportScope::EVENT->value => __('admin.data_exports.scope.event'),
+                        ])
+                        ->default(DataExportScope::TENANT->value)
+                        ->live()
+                        ->required(),
+                    Select::make('tenant_id')
+                        ->label(__('admin.data_exports.fields.tenant'))
+                        ->options(Tenant::query()->orderBy('name')->pluck('name', 'id'))
+                        ->searchable()
+                        ->preload()
+                        ->required()
+                        ->live(),
+                    Select::make('event_id')
+                        ->label(__('admin.data_exports.fields.event'))
+                        ->options(function (Get $get): array {
+                            $tenantId = $get('tenant_id');
+                            if (! $tenantId) {
+                                return [];
+                            }
+
+                            return Event::query()
+                                ->where('tenant_id', $tenantId)
+                                ->orderByDesc('date')
+                                ->get()
+                                ->mapWithKeys(function (Event $event): array {
+                                    $name = $event->name['de'] ?? $event->name['en'] ?? $event->slug;
+
+                                    return [$event->id => $name];
+                                })
+                                ->all();
+                        })
+                        ->searchable()
+                        ->preload()
+                        ->visible(fn (Get $get): bool => $get('scope') === DataExportScope::EVENT->value)
+                        ->required(fn (Get $get): bool => $get('scope') === DataExportScope::EVENT->value)
+                        ->dehydrated(fn (Get $get): bool => $get('scope') === DataExportScope::EVENT->value),
+                    Toggle::make('include_media')
+                        ->label(__('admin.data_exports.fields.include_media'))
+                        ->helperText(__('admin.data_exports.help.include_media')),
+                ])
+                ->columns(2),
+        ]);
+    }
+}

app/Filament/Resources/DataExportResource/Tables/DataExportTable.php

@@ -0,0 +1,139 @@
+<?php
+
+namespace App\Filament\Resources\DataExportResource\Tables;
+
+use App\Enums\DataExportScope;
+use App\Jobs\GenerateDataExport;
+use App\Models\DataExport;
+use App\Services\Audit\SuperAdminAuditLogger;
+use Filament\Actions\Action;
+use Filament\Tables\Columns\IconColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Table;
+use Illuminate\Support\Number;
+
+class DataExportTable
+{
+    public static function formatScope(DataExportScope|string|null $state): string
+    {
+        if ($state instanceof DataExportScope) {
+            $state = $state->value;
+        }
+
+        return $state ? __('admin.data_exports.scope.'.$state) : '—';
+    }
+
+    public static function configure(Table $table): Table
+    {
+        return $table
+            ->columns([
+                TextColumn::make('id')
+                    ->label(__('admin.data_exports.fields.id'))
+                    ->sortable(),
+                TextColumn::make('tenant.name')
+                    ->label(__('admin.data_exports.fields.tenant'))
+                    ->searchable(),
+                TextColumn::make('event.slug')
+                    ->label(__('admin.data_exports.fields.event'))
+                    ->toggleable()
+                    ->placeholder('—'),
+                TextColumn::make('scope')
+                    ->label(__('admin.data_exports.fields.scope'))
+                    ->badge()
+                    ->formatStateUsing(fn (DataExportScope|string|null $state): string => self::formatScope($state)),
+                TextColumn::make('status')
+                    ->label(__('admin.data_exports.fields.status'))
+                    ->badge()
+                    ->formatStateUsing(fn (string $state) => __('admin.data_exports.status.'.$state))
+                    ->color(fn (string $state) => match ($state) {
+                        DataExport::STATUS_READY => 'success',
+                        DataExport::STATUS_FAILED => 'danger',
+                        DataExport::STATUS_PROCESSING => 'warning',
+                        DataExport::STATUS_CANCELED => 'gray',
+                        default => 'gray',
+                    }),
+                IconColumn::make('include_media')
+                    ->label(__('admin.data_exports.fields.include_media'))
+                    ->boolean(),
+                TextColumn::make('size_bytes')
+                    ->label(__('admin.data_exports.fields.size'))
+                    ->formatStateUsing(fn (?int $state) => $state ? Number::fileSize($state) : '—')
+                    ->toggleable(),
+                TextColumn::make('created_at')
+                    ->label(__('admin.data_exports.fields.created_at'))
+                    ->since()
+                    ->sortable(),
+                TextColumn::make('expires_at')
+                    ->label(__('admin.data_exports.fields.expires_at'))
+                    ->since()
+                    ->toggleable(),
+            ])
+            ->filters([
+                SelectFilter::make('scope')
+                    ->label(__('admin.data_exports.fields.scope'))
+                    ->options([
+                        'tenant' => __('admin.data_exports.scope.tenant'),
+                        'event' => __('admin.data_exports.scope.event'),
+                        'user' => __('admin.data_exports.scope.user'),
+                    ]),
+                SelectFilter::make('status')
+                    ->label(__('admin.data_exports.fields.status'))
+                    ->options([
+                        DataExport::STATUS_PENDING => __('admin.data_exports.status.pending'),
+                        DataExport::STATUS_PROCESSING => __('admin.data_exports.status.processing'),
+                        DataExport::STATUS_READY => __('admin.data_exports.status.ready'),
+                        DataExport::STATUS_FAILED => __('admin.data_exports.status.failed'),
+                        DataExport::STATUS_CANCELED => __('admin.data_exports.status.canceled'),
+                    ]),
+            ])
+            ->actions([
+                Action::make('download')
+                    ->label(__('admin.data_exports.actions.download'))
+                    ->icon('heroicon-o-arrow-down-tray')
+                    ->url(fn (DataExport $record) => route('superadmin.data-exports.download', $record))
+                    ->openUrlInNewTab()
+                    ->visible(fn (DataExport $record): bool => $record->isReady() && ! $record->hasExpired()),
+                Action::make('retry')
+                    ->label(__('admin.data_exports.actions.retry'))
+                    ->icon('heroicon-o-arrow-path')
+                    ->color('warning')
+                    ->requiresConfirmation()
+                    ->visible(fn (DataExport $record): bool => $record->canRetry())
+                    ->action(function (DataExport $record): void {
+                        if (! $record->canRetry()) {
+                            return;
+                        }
+
+                        $record->resetForRetry();
+                        GenerateDataExport::dispatch($record->id);
+
+                        app(SuperAdminAuditLogger::class)->recordModelMutation(
+                            'updated',
+                            $record,
+                            source: self::class
+                        );
+                    }),
+                Action::make('cancel')
+                    ->label(__('admin.data_exports.actions.cancel'))
+                    ->icon('heroicon-o-x-circle')
+                    ->color('danger')
+                    ->requiresConfirmation()
+                    ->visible(fn (DataExport $record): bool => $record->canCancel())
+                    ->action(function (DataExport $record): void {
+                        if (! $record->canCancel()) {
+                            return;
+                        }
+
+                        $record->markCanceled();
+
+                        app(SuperAdminAuditLogger::class)->recordModelMutation(
+                            'updated',
+                            $record,
+                            source: self::class
+                        );
+                    }),
+            ])
+            ->bulkActions([]);
+    }
+}

app/Filament/Resources/EmotionResource.php

@@ -5,6 +5,7 @@ namespace App\Filament\Resources;
 use App\Filament\Clusters\WeeklyOps\WeeklyOpsCluster;
 use App\Filament\Resources\EmotionResource\Pages;
 use App\Models\Emotion;
+use App\Services\Audit\SuperAdminAuditLogger;
 use BackedEnum;
 use Filament\Actions;
 use Filament\Forms\Components\MarkdownEditor;
@@ -17,6 +18,7 @@ use Filament\Schemas\Components\Tabs\Tab as SchemaTab;
 use Filament\Schemas\Schema;
 use Filament\Tables;
 use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Collection;
 use UnitEnum;
 
 class EmotionResource extends Resource
@@ -116,10 +118,27 @@ class EmotionResource extends Resource
             ])
             ->filters([])
             ->actions([
-                Actions\EditAction::make(),
+                Actions\EditAction::make()
+                    ->after(fn (array $data, Emotion $record) => app(SuperAdminAuditLogger::class)->recordModelMutation(
+                        'updated',
+                        $record,
+                        SuperAdminAuditLogger::fieldsMetadata($data),
+                        static::class
+                    )),
             ])
             ->bulkActions([
-                Actions\DeleteBulkAction::make(),
+                Actions\DeleteBulkAction::make()
+                    ->after(function (Collection $records): void {
+                        $logger = app(SuperAdminAuditLogger::class);
+
+                        foreach ($records as $record) {
+                            $logger->recordModelMutation(
+                                'deleted',
+                                $record,
+                                source: static::class
+                            );
+                        }
+                    }),
             ]);
     }
 

app/Filament/Resources/EmotionResource/Pages/ImportEmotions.php

@@ -13,7 +13,9 @@ use Illuminate\Support\Facades\Storage;
 class ImportEmotions extends Page
 {
     protected static string $resource = EmotionResource::class;
+
     protected string $view = 'filament.resources.emotion-resource.pages.import-emotions';
+
     protected ?string $heading = null;
 
     public ?string $file = null;
@@ -36,6 +38,7 @@ class ImportEmotions extends Page
         $path = $this->form->getState()['file'] ?? null;
         if (! $path || ! Storage::disk('public')->exists($path)) {
             Notification::make()->danger()->title(__('admin.notifications.file_not_found'))->send();
+
             return;
         }
 

app/Filament/Resources/EmotionResource/Pages/ManageEmotions.php

@@ -3,6 +3,7 @@
 namespace App\Filament\Resources\EmotionResource\Pages;
 
 use App\Filament\Resources\EmotionResource;
+use App\Services\Audit\SuperAdminAuditLogger;
 use Filament\Actions;
 use Filament\Resources\Pages\ManageRecords;
 
@@ -13,7 +14,13 @@ class ManageEmotions extends ManageRecords
     protected function getHeaderActions(): array
     {
         return [
-            Actions\CreateAction::make(),
+            Actions\CreateAction::make()
+                ->after(fn (array $data, $record) => app(SuperAdminAuditLogger::class)->recordModelMutation(
+                    'created',
+                    $record,
+                    SuperAdminAuditLogger::fieldsMetadata($data),
+                    static::class
+                )),
             Actions\Action::make('import')
                 ->label(__('admin.common.import_csv'))
                 ->icon('heroicon-o-arrow-up-tray')

app/Filament/Resources/EventPurchaseResource.php

@@ -6,6 +6,7 @@ use App\Exports\EventPurchaseExporter;
 use App\Filament\Clusters\WeeklyOps\WeeklyOpsCluster;
 use App\Filament\Resources\EventPurchaseResource\Pages;
 use App\Models\EventPurchase;
+use App\Services\Audit\SuperAdminAuditLogger;
 use Filament\Actions\Action;
 use Filament\Actions\BulkActionGroup;
 use Filament\Actions\DeleteBulkAction;
@@ -23,6 +24,7 @@ use Filament\Tables\Filters\SelectFilter;
 use Filament\Tables\Filters\TernaryFilter;
 use Filament\Tables\Table;
 use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Collection;
 use Illuminate\Support\Facades\Log;
 
 class EventPurchaseResource extends Resource
@@ -174,11 +176,29 @@ class EventPurchaseResource extends Resource
                     ->action(function (EventPurchase $record) {
                         $record->update(['refunded_at' => now()]);
                         Log::info('Refund processed for purchase ID: '.$record->id);
+
+                        app(SuperAdminAuditLogger::class)->record(
+                            'event_purchase.refunded',
+                            $record,
+                            SuperAdminAuditLogger::fieldsMetadata(['refunded_at']),
+                            source: static::class
+                        );
                     }),
             ])
             ->bulkActions([
                 BulkActionGroup::make([
-                    DeleteBulkAction::make(),
+                    DeleteBulkAction::make()
+                        ->after(function (Collection $records): void {
+                            $logger = app(SuperAdminAuditLogger::class);
+
+                            foreach ($records as $record) {
+                                $logger->recordModelMutation(
+                                    'deleted',
+                                    $record,
+                                    source: static::class
+                                );
+                            }
+                        }),
                     ExportBulkAction::make()
                         ->label('Export CSV')
                         ->exporter(EventPurchaseExporter::class),

app/Filament/Resources/EventPurchaseResource/Pages/CreateEventPurchase.php

@@ -3,9 +3,9 @@
 namespace App\Filament\Resources\EventPurchaseResource\Pages;
 
 use App\Filament\Resources\EventPurchaseResource;
-use Filament\Resources\Pages\CreateRecord;
+use App\Filament\Resources\Pages\AuditedCreateRecord;
 
-class CreateEventPurchase extends CreateRecord
+class CreateEventPurchase extends AuditedCreateRecord
 {
     protected static string $resource = EventPurchaseResource::class;
-}
+}

app/Filament/Resources/EventPurchaseResource/Pages/EditEventPurchase.php

@@ -3,10 +3,11 @@
 namespace App\Filament\Resources\EventPurchaseResource\Pages;
 
 use App\Filament\Resources\EventPurchaseResource;
+use App\Filament\Resources\Pages\AuditedEditRecord;
+use App\Services\Audit\SuperAdminAuditLogger;
 use Filament\Actions;
-use Filament\Resources\Pages\EditRecord;
 
-class EditEventPurchase extends EditRecord
+class EditEventPurchase extends AuditedEditRecord
 {
     protected static string $resource = EventPurchaseResource::class;
 
@@ -14,7 +15,12 @@ class EditEventPurchase extends EditRecord
     {
         return [
             Actions\ViewAction::make(),
-            Actions\DeleteAction::make(),
+            Actions\DeleteAction::make()
+                ->after(fn ($record) => app(SuperAdminAuditLogger::class)->recordModelMutation(
+                    'deleted',
+                    $record,
+                    source: static::class
+                )),
         ];
     }
-}
+}

app/Filament/Resources/EventPurchaseResource/Pages/ListEventPurchases.php

@@ -16,4 +16,4 @@ class ListEventPurchases extends ListRecords
             Actions\CreateAction::make(),
         ];
     }
-}
+}

app/Filament/Resources/EventPurchaseResource/Pages/ViewEventPurchase.php

@@ -3,6 +3,7 @@
 namespace App\Filament\Resources\EventPurchaseResource\Pages;
 
 use App\Filament\Resources\EventPurchaseResource;
+use App\Services\Audit\SuperAdminAuditLogger;
 use Filament\Actions;
 use Filament\Resources\Pages\ViewRecord;
 
@@ -13,7 +14,13 @@ class ViewEventPurchase extends ViewRecord
     protected function getHeaderActions(): array
     {
         return [
-            Actions\EditAction::make(),
+            Actions\EditAction::make()
+                ->after(fn (array $data, $record) => app(SuperAdminAuditLogger::class)->recordModelMutation(
+                    'updated',
+                    $record,
+                    SuperAdminAuditLogger::fieldsMetadata($data),
+                    static::class
+                )),
         ];
     }
-}
+}

app/Filament/Resources/EventResource.php

@@ -6,22 +6,29 @@ use App\Filament\Clusters\DailyOps\DailyOpsCluster;
 use App\Filament\Resources\EventResource\Pages;
 use App\Filament\Resources\EventResource\RelationManagers\EventPackagesRelationManager;
 use App\Models\Event;
+use App\Models\EventJoinToken;
 use App\Models\EventJoinTokenEvent;
 use App\Models\EventType;
 use App\Models\Tenant;
+use App\Services\Audit\SuperAdminAuditLogger;
+use App\Services\EventJoinTokenService;
 use App\Support\JoinTokenLayoutRegistry;
 use BackedEnum;
 use Carbon\Carbon;
 use Filament\Actions;
 use Filament\Forms\Components\DatePicker;
+use Filament\Forms\Components\DateTimePicker;
 use Filament\Forms\Components\KeyValue;
 use Filament\Forms\Components\Select;
 use Filament\Forms\Components\TextInput;
 use Filament\Forms\Components\Toggle;
+use Filament\Notifications\Notification;
 use Filament\Resources\Resource;
 use Filament\Schemas\Schema;
 use Filament\Tables;
 use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Collection;
+use Illuminate\Support\Arr;
 use UnitEnum;
 
 class EventResource extends Resource
@@ -58,19 +65,32 @@ class EventResource extends Resource
                 ->required()
                 ->unique(ignoreRecord: true)
                 ->maxLength(255),
+            TextInput::make('join_link_display')
+                ->label(__('admin.events.fields.join_link'))
+                ->afterStateHydrated(function (TextInput $component, ?Event $record) {
+                    if (! $record) {
+                        return;
+                    }
+                    $token = $record->joinTokens()->latest()->first();
+                    $component->state($token ? url('/e/'.$token->token) : '-');
+                })
+                ->readOnly()
+                ->dehydrated(false)
+                ->visibleOn('edit'),
             DatePicker::make('date')
                 ->label(__('admin.events.fields.date'))
                 ->required(),
             Select::make('event_type_id')
                 ->label(__('admin.events.fields.type'))
-                ->options(EventType::query()->pluck('name', 'id'))
+                ->options(fn () => EventType::all()->pluck('name.de', 'id'))
                 ->searchable(),
             Select::make('package_id')
                 ->label(__('admin.events.fields.package'))
                 ->options(\App\Models\Package::query()->where('type', 'endcustomer')->pluck('name', 'id'))
                 ->searchable()
                 ->preload()
-                ->required(),
+                ->required()
+                ->visibleOn('create'),
             TextInput::make('default_locale')
                 ->label(__('admin.events.fields.default_locale'))
                 ->default('de')
@@ -78,6 +98,10 @@ class EventResource extends Resource
             Toggle::make('is_active')
                 ->label(__('admin.events.fields.is_active'))
                 ->default(true),
+            Toggle::make('settings.marketing_demo')
+                ->label(__('admin.events.fields.marketing_demo'))
+                ->helperText(__('admin.events.fields.marketing_demo_help'))
+                ->default(false),
             KeyValue::make('settings')
                 ->label(__('admin.events.fields.settings'))
                 ->keyLabel(__('admin.common.key'))
@@ -94,13 +118,13 @@ class EventResource extends Resource
             ->columns([
                 Tables\Columns\TextColumn::make('id')->sortable(),
                 Tables\Columns\TextColumn::make('tenant.name')->label(__('admin.events.table.tenant'))->searchable(),
-                Tables\Columns\TextColumn::make('name.de')
+                Tables\Columns\TextColumn::make('name')
                     ->label(__('admin.events.fields.name'))
+                    ->formatStateUsing(fn (mixed $state): string => static::formatEventName($state))
                     ->limit(30),
                 Tables\Columns\TextColumn::make('slug')->searchable(),
                 Tables\Columns\TextColumn::make('date')->date(),
                 Tables\Columns\IconColumn::make('is_active')->boolean(),
-                Tables\Columns\TextColumn::make('default_locale'),
                 Tables\Columns\TextColumn::make('eventPackage.package.name')
                     ->label(__('admin.events.table.package'))
                     ->badge()
@@ -113,31 +137,30 @@ class EventResource extends Resource
                     ->badge()
                     ->color(fn ($state) => $state < 1 ? 'danger' : 'success')
                     ->getStateUsing(fn ($record) => $record->eventPackage?->remaining_photos ?? 0),
-                Tables\Columns\TextColumn::make('primary_join_token')
-                    ->label(__('admin.events.table.join'))
-                    ->getStateUsing(function ($record) {
-                        $token = $record->joinTokens()->latest()->first();
-
-                        return $token ? url('/e/'.$token->token) : __('admin.events.table.no_join_tokens');
-                    })
-                    ->description(function ($record) {
-                        $total = $record->joinTokens()->count();
-
-                        return $total > 0
-                            ? __('admin.events.table.join_tokens_total', ['count' => $total])
-                            : __('admin.events.table.join_tokens_missing');
-                    })
-                    ->copyable()
-                    ->copyMessage(__('admin.events.messages.join_link_copied')),
                 Tables\Columns\TextColumn::make('created_at')->since(),
             ])
             ->filters([])
             ->actions([
-                Actions\EditAction::make(),
+                Actions\EditAction::make()
+                    ->after(fn (array $data, Event $record) => app(SuperAdminAuditLogger::class)->recordModelMutation(
+                        'updated',
+                        $record,
+                        SuperAdminAuditLogger::fieldsMetadata($data),
+                        static::class
+                    )),
                 Actions\Action::make('toggle')
                     ->label(__('admin.events.actions.toggle_active'))
                     ->icon('heroicon-o-power')
-                    ->action(fn ($record) => $record->update(['is_active' => ! $record->is_active])),
+                    ->action(function (Event $record): void {
+                        $record->update(['is_active' => ! $record->is_active]);
+
+                        app(SuperAdminAuditLogger::class)->record(
+                            'event.toggled',
+                            $record,
+                            SuperAdminAuditLogger::fieldsMetadata(['is_active']),
+                            source: static::class
+                        );
+                    }),
                 Actions\Action::make('download_photos')
                     ->label(__('admin.events.actions.download_photos'))
                     ->icon('heroicon-o-arrow-down-tray')
@@ -150,7 +173,161 @@ class EventResource extends Resource
                     ->modalHeading(__('admin.events.modal.join_link_heading'))
                     ->modalSubmitActionLabel(__('admin.common.close'))
                     ->modalWidth('xl')
-                    ->modalContent(function ($record) {
+                    ->registerModalActions([
+                        Actions\Action::make('extend_join_token_expiry')
+                            ->label(__('admin.events.join_link.extend_expiry'))
+                            ->icon('heroicon-o-clock')
+                            ->color('warning')
+                            ->size('xs')
+                            ->modalHeading(function (Actions\Action $action, Event $record): string {
+                                $token = static::resolveJoinTokenFromAction($record, $action);
+
+                                return $token
+                                    ? __('admin.events.join_link.extend_expiry_heading', [
+                                        'label' => $token->label ?: __('admin.events.join_link.token_default', ['id' => $token->id]),
+                                    ])
+                                    : __('admin.events.join_link.extend_expiry_heading_fallback');
+                            })
+                            ->schema(function (Event $record): array {
+                                $minimumExpiry = app(EventJoinTokenService::class)->minimumExpiryForEvent($record);
+                                $rules = [
+                                    'date',
+                                    'after:now',
+                                ];
+
+                                if ($minimumExpiry) {
+                                    $rules[] = 'after_or_equal:'.$minimumExpiry->toDateTimeString();
+                                }
+
+                                return [
+                                    DateTimePicker::make('expires_at')
+                                        ->label(__('admin.events.join_link.extend_expiry_label'))
+                                        ->required()
+                                        ->seconds(false)
+                                        ->rules($rules)
+                                        ->helperText($minimumExpiry
+                                            ? __('admin.events.join_link.extend_expiry_min', [
+                                                'date' => $minimumExpiry->isoFormat('LLL'),
+                                            ])
+                                            : null),
+                                ];
+                            })
+                            ->fillForm(function (Actions\Action $action, Event $record): array {
+                                $token = static::resolveJoinTokenFromAction($record, $action);
+
+                                if (! $token) {
+                                    return [];
+                                }
+
+                                return [
+                                    'expires_at' => $token->expires_at,
+                                ];
+                            })
+                            ->action(function (array $data, Actions\Action $action, Event $record): void {
+                                $token = static::resolveJoinTokenFromAction($record, $action);
+
+                                if (! $token) {
+                                    Notification::make()
+                                        ->title(__('admin.events.join_link.extend_expiry_missing'))
+                                        ->danger()
+                                        ->send();
+
+                                    return;
+                                }
+
+                                $expiresAt = $data['expires_at'] ?? null;
+
+                                if (! $expiresAt) {
+                                    Notification::make()
+                                        ->title(__('admin.events.join_link.extend_expiry_missing_date'))
+                                        ->danger()
+                                        ->send();
+
+                                    return;
+                                }
+
+                                $resolvedExpiry = $expiresAt instanceof Carbon
+                                    ? $expiresAt
+                                    : Carbon::parse($expiresAt);
+
+                                $token->forceFill([
+                                    'expires_at' => $resolvedExpiry,
+                                ])->save();
+
+                                app(SuperAdminAuditLogger::class)->recordModelMutation(
+                                    'updated',
+                                    $token,
+                                    source: static::class
+                                );
+
+                                Notification::make()
+                                    ->title(__('admin.events.join_link.extend_expiry_success'))
+                                    ->success()
+                                    ->send();
+                            }),
+                        Actions\Action::make('set_demo_read_only')
+                            ->label(__('admin.events.join_link.demo_read_only_action'))
+                            ->icon('heroicon-o-lock-closed')
+                            ->color('gray')
+                            ->size('xs')
+                            ->modalHeading(function (Actions\Action $action, Event $record): string {
+                                $token = static::resolveJoinTokenFromAction($record, $action);
+
+                                return $token
+                                    ? __('admin.events.join_link.demo_read_only_heading', [
+                                        'label' => $token->label ?: __('admin.events.join_link.token_default', ['id' => $token->id]),
+                                    ])
+                                    : __('admin.events.join_link.demo_read_only_heading_fallback');
+                            })
+                            ->schema([
+                                Toggle::make('demo_read_only')
+                                    ->label(__('admin.events.join_link.demo_read_only_label'))
+                                    ->helperText(__('admin.events.join_link.demo_read_only_help')),
+                            ])
+                            ->fillForm(function (Actions\Action $action, Event $record): array {
+                                $token = static::resolveJoinTokenFromAction($record, $action);
+
+                                return [
+                                    'demo_read_only' => (bool) Arr::get($token?->metadata ?? [], 'demo_read_only', false),
+                                ];
+                            })
+                            ->action(function (array $data, Actions\Action $action, Event $record): void {
+                                $token = static::resolveJoinTokenFromAction($record, $action);
+
+                                if (! $token) {
+                                    Notification::make()
+                                        ->title(__('admin.events.join_link.demo_read_only_missing'))
+                                        ->danger()
+                                        ->send();
+
+                                    return;
+                                }
+
+                                $metadata = is_array($token->metadata) ? $token->metadata : [];
+                                $enabled = (bool) ($data['demo_read_only'] ?? false);
+
+                                if ($enabled) {
+                                    $metadata['demo_read_only'] = true;
+                                } else {
+                                    unset($metadata['demo_read_only']);
+                                }
+
+                                $token->metadata = empty($metadata) ? null : $metadata;
+                                $token->save();
+
+                                app(SuperAdminAuditLogger::class)->recordModelMutation(
+                                    'updated',
+                                    $token,
+                                    source: static::class
+                                );
+
+                                Notification::make()
+                                    ->title(__('admin.events.join_link.demo_read_only_success'))
+                                    ->success()
+                                    ->send();
+                            }),
+                    ])
+                    ->modalContent(function (Actions\Action $action, $record) {
                         $tokens = $record->joinTokens()
                             ->orderByDesc('created_at')
                             ->get();
@@ -220,6 +397,7 @@ class EventResource extends Resource
                                 'expires_at' => optional($token->expires_at)->toIso8601String(),
                                 'revoked_at' => optional($token->revoked_at)->toIso8601String(),
                                 'is_active' => $token->isActive(),
+                                'demo_read_only' => (bool) Arr::get($token->metadata ?? [], 'demo_read_only', false),
                                 'created_at' => optional($token->created_at)->toIso8601String(),
                                 'layouts' => $layouts,
                                 'layouts_url' => route('api.v1.tenant.events.join-tokens.layouts.index', [
@@ -239,11 +417,23 @@ class EventResource extends Resource
                         return view('filament.events.join-link', [
                             'event' => $record,
                             'tokens' => $tokens,
+                            'action' => $action,
                         ]);
                     }),
             ])
             ->bulkActions([
-                Actions\DeleteBulkAction::make(),
+                Actions\DeleteBulkAction::make()
+                    ->after(function (Collection $records): void {
+                        $logger = app(SuperAdminAuditLogger::class);
+
+                        foreach ($records as $record) {
+                            $logger->recordModelMutation(
+                                'deleted',
+                                $record,
+                                source: static::class
+                            );
+                        }
+                    }),
             ]);
     }
 
@@ -254,6 +444,43 @@ class EventResource extends Resource
         ];
     }
 
+    /**
+     * @param  array<string, mixed>|string|null  $name
+     */
+    private static function formatEventName(mixed $name): string
+    {
+        if (is_array($name)) {
+            $candidates = [
+                $name['de'] ?? null,
+                $name['en'] ?? null,
+                reset($name) ?: null,
+            ];
+
+            foreach ($candidates as $candidate) {
+                if (is_string($candidate) && $candidate !== '') {
+                    return $candidate;
+                }
+            }
+
+            return '';
+        }
+
+        return is_string($name) ? $name : '';
+    }
+
+    private static function resolveJoinTokenFromAction(Event $record, Actions\Action $action): ?EventJoinToken
+    {
+        $tokenId = $action->getArguments()['token_id'] ?? null;
+
+        if (! $tokenId) {
+            return null;
+        }
+
+        return $record->joinTokens()
+            ->whereKey($tokenId)
+            ->first();
+    }
+
     public static function getPages(): array
     {
         return [

app/Filament/Resources/EventResource/Pages/CreateEvent.php

@@ -3,9 +3,30 @@
 namespace App\Filament\Resources\EventResource\Pages;
 
 use App\Filament\Resources\EventResource;
-use Filament\Resources\Pages\CreateRecord;
+use App\Filament\Resources\Pages\AuditedCreateRecord;
 
-class CreateEvent extends CreateRecord
+class CreateEvent extends AuditedCreateRecord
 {
     protected static string $resource = EventResource::class;
+
+    public ?int $packageId = null;
+
+    protected function mutateFormDataBeforeCreate(array $data): array
+    {
+        $this->packageId = $data['package_id'] ?? null;
+        unset($data['package_id']);
+
+        return $data;
+    }
+
+    protected function afterCreate(): void
+    {
+        if ($this->packageId) {
+            $this->record->eventPackages()->create([
+                'package_id' => $this->packageId,
+            ]);
+        }
+
+        parent::afterCreate();
+    }
 }

app/Filament/Resources/EventResource/Pages/EditEvent.php

@@ -3,9 +3,9 @@
 namespace App\Filament\Resources\EventResource\Pages;
 
 use App\Filament\Resources\EventResource;
-use Filament\Resources\Pages\EditRecord;
+use App\Filament\Resources\Pages\AuditedEditRecord;
 
-class EditEvent extends EditRecord
+class EditEvent extends AuditedEditRecord
 {
     protected static string $resource = EventResource::class;
 }

app/Filament/Resources/EventResource/Pages/ManageWatermark.php

@@ -3,27 +3,41 @@
 namespace App\Filament\Resources\EventResource\Pages;
 
 use App\Filament\Resources\EventResource;
+use App\Services\Audit\SuperAdminAuditLogger;
 use Filament\Forms;
 use Filament\Notifications\Notification;
+use Filament\Resources\Pages\Concerns\InteractsWithRecord;
 use Filament\Resources\Pages\Page;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
 use Illuminate\Support\Arr;
 
 class ManageWatermark extends Page
 {
+    use InteractsWithRecord;
+
     protected static string $resource = EventResource::class;
 
     protected string $view = 'filament.resources.event-resource.pages.manage-watermark';
 
     public ?string $watermark_mode = 'base';
+
     public ?string $watermark_asset = null;
+
     public string $watermark_position = 'bottom-right';
+
     public float $watermark_opacity = 0.25;
+
     public float $watermark_scale = 0.2;
+
     public int $watermark_padding = 16;
+
     public bool $serve_originals = false;
 
-    public function mount(): void
+    public function mount(int|string $record): void
     {
+        $this->record = $this->resolveRecord($record);
+
         $event = $this->record;
         $settings = $event->settings ?? [];
         $watermark = Arr::get($settings, 'watermark', []);
@@ -37,67 +51,62 @@ class ManageWatermark extends Page
         $this->serve_originals = (bool) Arr::get($settings, 'watermark_serve_originals', false);
     }
 
-    protected function getForms(): array
+    public function form(Schema $schema): Schema
     {
-        return [
+        return $schema->schema([
-            'form' => $this->form(
+            Section::make(__('filament-watermark.heading'))
-                $this->makeForm()
+                ->schema([
-                    ->schema([
+                    Forms\Components\Select::make('watermark_mode')
-                        Forms\Components\Fieldset::make(__('filament-watermark.heading'))
+                        ->label(__('filament-watermark.mode.label'))
-                            ->schema([
+                        ->options([
-                                Forms\Components\Select::make('watermark_mode')
+                            'base' => __('filament-watermark.mode.base'),
-                                    ->label(__('filament-watermark.mode.label'))
+                            'custom' => __('filament-watermark.mode.custom'),
-                                    ->options([
+                            'off' => __('filament-watermark.mode.off'),
-                                        'base' => __('filament-watermark.mode.base'),
+                        ])
-                                        'custom' => __('filament-watermark.mode.custom'),
+                        ->required(),
-                                        'off' => __('filament-watermark.mode.off'),
+                    Forms\Components\FileUpload::make('watermark_asset')
-                                    ])
+                        ->label(__('filament-watermark.asset'))
-                                    ->required(),
+                        ->disk('public')
-                                Forms\Components\FileUpload::make('watermark_asset')
+                        ->directory('branding')
-                                    ->label(__('filament-watermark.asset'))
+                        ->preserveFilenames()
-                                    ->disk('public')
+                        ->image()
-                                    ->directory('branding')
+                        ->visible(fn (callable $get) => $get('watermark_mode') === 'custom'),
-                                    ->preserveFilenames()
+                    Forms\Components\Select::make('watermark_position')
-                                    ->image()
+                        ->label(__('filament-watermark.position'))
-                                    ->visible(fn (callable $get) => $get('watermark_mode') === 'custom'),
+                        ->options([
-                                Forms\Components\Select::make('watermark_position')
+                            'top-left' => 'Top Left',
-                                    ->label(__('filament-watermark.position'))
+                            'top-right' => 'Top Right',
-                                    ->options([
+                            'bottom-left' => 'Bottom Left',
-                                        'top-left' => 'Top Left',
+                            'bottom-right' => 'Bottom Right',
-                                        'top-right' => 'Top Right',
+                            'center' => 'Center',
-                                        'bottom-left' => 'Bottom Left',
+                        ])
-                                        'bottom-right' => 'Bottom Right',
+                        ->required(),
-                                        'center' => 'Center',
+                    Forms\Components\TextInput::make('watermark_opacity')
-                                    ])
+                        ->label(__('filament-watermark.opacity'))
-                                    ->required(),
+                        ->numeric()
-                                Forms\Components\TextInput::make('watermark_opacity')
+                        ->minValue(0)
-                                    ->label(__('filament-watermark.opacity'))
+                        ->maxValue(1)
-                                    ->numeric()
+                        ->step(0.05)
-                                    ->minValue(0)
+                        ->required(),
-                                    ->maxValue(1)
+                    Forms\Components\TextInput::make('watermark_scale')
-                                    ->step(0.05)
+                        ->label(__('filament-watermark.scale'))
-                                    ->required(),
+                        ->numeric()
-                                Forms\Components\TextInput::make('watermark_scale')
+                        ->minValue(0.05)
-                                    ->label(__('filament-watermark.scale'))
+                        ->maxValue(1)
-                                    ->numeric()
+                        ->step(0.05)
-                                    ->minValue(0.05)
+                        ->required(),
-                                    ->maxValue(1)
+                    Forms\Components\TextInput::make('watermark_padding')
-                                    ->step(0.05)
+                        ->label(__('filament-watermark.padding'))
-                                    ->required(),
+                        ->numeric()
-                                Forms\Components\TextInput::make('watermark_padding')
+                        ->minValue(0)
-                                    ->label(__('filament-watermark.padding'))
+                        ->required(),
-                                    ->numeric()
+                    Forms\Components\Toggle::make('serve_originals')
-                                    ->minValue(0)
+                        ->label(__('filament-watermark.serve_originals'))
-                                    ->required(),
+                        ->helperText('Nur Admin/Owner: falls aktiviert, werden Originale statt watermarked ausgeliefert.')
-                                Forms\Components\Toggle::make('serve_originals')
+                        ->default(false),
-                                    ->label(__('filament-watermark.serve_originals'))
+                ])
-                                    ->helperText('Nur Admin/Owner: falls aktiviert, werden Originale statt watermarked ausgeliefert.')
+                ->columns(2),
-                                    ->default(false),
+        ]);
-                            ])
-                            ->columns(2),
-                    ])
-            ),
-        ];
     }
 
     public function save(): void
@@ -133,6 +142,17 @@ class ManageWatermark extends Page
 
         $event->forceFill(['settings' => $settings])->save();
 
+        $changed = array_diff(array_keys($event->getChanges()), ['updated_at']);
+
+        if ($changed !== []) {
+            app(SuperAdminAuditLogger::class)->record(
+                'event.watermark_updated',
+                $event,
+                SuperAdminAuditLogger::fieldsMetadata($changed),
+                source: static::class
+            );
+        }
+
         Notification::make()
             ->title(__('filament-watermark.saved'))
             ->success()

app/Filament/Resources/EventResource/RelationManagers/EventPackagesRelationManager.php

@@ -3,23 +3,22 @@
 namespace App\Filament\Resources\EventResource\RelationManagers;
 
 use App\Models\EventPackage;
+use App\Services\Audit\SuperAdminAuditLogger;
 use Filament\Actions\BulkActionGroup;
 use Filament\Actions\CreateAction;
 use Filament\Actions\DeleteAction;
 use Filament\Actions\DeleteBulkAction;
 use Filament\Actions\EditAction;
-use Filament\Forms;
 use Filament\Forms\Components\DateTimePicker;
 use Filament\Forms\Components\Select;
 use Filament\Forms\Components\TextInput;
 use Filament\Resources\RelationManagers\RelationManager;
 use Filament\Schemas\Schema;
-use Filament\Tables;
 use Filament\Tables\Columns\TextColumn;
 use Filament\Tables\Table;
 use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Collection;
 use Illuminate\Database\Eloquent\Model;
-use Illuminate\Database\Eloquent\Relations\Relation;
 
 class EventPackagesRelationManager extends RelationManager
 {
@@ -59,6 +58,7 @@ class EventPackagesRelationManager extends RelationManager
     public function table(Table $table): Table
     {
         return $table
+            ->modifyQueryUsing(fn (Builder $query) => $query->with('package'))
             ->recordTitleAttribute('package.name')
             ->columns([
                 TextColumn::make('package.name')
@@ -93,15 +93,43 @@ class EventPackagesRelationManager extends RelationManager
             ])
             ->filters([])
             ->headerActions([
-                CreateAction::make(),
+                CreateAction::make()
+                    ->after(fn (array $data, EventPackage $record) => app(SuperAdminAuditLogger::class)->recordModelMutation(
+                        'created',
+                        $record,
+                        SuperAdminAuditLogger::fieldsMetadata($data),
+                        static::class
+                    )),
             ])
             ->actions([
-                EditAction::make(),
+                EditAction::make()
-                DeleteAction::make(),
+                    ->after(fn (array $data, EventPackage $record) => app(SuperAdminAuditLogger::class)->recordModelMutation(
+                        'updated',
+                        $record,
+                        SuperAdminAuditLogger::fieldsMetadata($data),
+                        static::class
+                    )),
+                DeleteAction::make()
+                    ->after(fn (EventPackage $record) => app(SuperAdminAuditLogger::class)->recordModelMutation(
+                        'deleted',
+                        $record,
+                        source: static::class
+                    )),
             ])
             ->bulkActions([
                 BulkActionGroup::make([
-                    DeleteBulkAction::make(),
+                    DeleteBulkAction::make()
+                        ->after(function (Collection $records): void {
+                            $logger = app(SuperAdminAuditLogger::class);
+
+                            foreach ($records as $record) {
+                                $logger->recordModelMutation(
+                                    'deleted',
+                                    $record,
+                                    source: static::class
+                                );
+                            }
+                        }),
                 ]),
             ]);
     }
@@ -119,9 +147,4 @@ class EventPackagesRelationManager extends RelationManager
     {
         return __('admin.events.relation_managers.event_packages.title');
     }
-
-    public function getTableQuery(): Builder|Relation
-    {
-        return parent::getTableQuery()->with('package');
-    }
 }

app/Filament/Resources/EventTypeResource.php

@@ -5,6 +5,7 @@ namespace App\Filament\Resources;
 use App\Filament\Clusters\WeeklyOps\WeeklyOpsCluster;
 use App\Filament\Resources\EventTypeResource\Pages;
 use App\Models\EventType;
+use App\Services\Audit\SuperAdminAuditLogger;
 use BackedEnum;
 use Filament\Actions;
 use Filament\Forms\Components\KeyValue;
@@ -16,6 +17,7 @@ use Filament\Schemas\Components\Tabs\Tab as SchemaTab;
 use Filament\Schemas\Schema;
 use Filament\Tables;
 use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Collection;
 use UnitEnum;
 
 class EventTypeResource extends Resource
@@ -104,10 +106,73 @@ class EventTypeResource extends Resource
             ])
             ->filters([])
             ->actions([
-                Actions\EditAction::make(),
+                Actions\EditAction::make()
+                    ->after(fn (array $data, EventType $record) => app(SuperAdminAuditLogger::class)->recordModelMutation(
+                        'updated',
+                        $record,
+                        SuperAdminAuditLogger::fieldsMetadata($data),
+                        static::class
+                    )),
+                Actions\DeleteAction::make()
+                    ->action(function (EventType $record, Actions\DeleteAction $action) {
+                        try {
+                            $record->delete();
+                        } catch (\Exception $e) {
+                            $isConstraint = ($e instanceof \Illuminate\Database\QueryException && ($e->getCode() == 23000 || ($e->errorInfo[0] ?? '') == 23000));
+
+                            if ($isConstraint) {
+                                \Filament\Notifications\Notification::make()
+                                    ->title(__('admin.common.error'))
+                                    ->body(__('admin.event_types.messages.delete_constraint_error'))
+                                    ->danger()
+                                    ->send();
+
+                                $action->halt();
+                            }
+
+                            throw $e;
+                        }
+                    })
+                    ->after(fn (EventType $record) => app(SuperAdminAuditLogger::class)->recordModelMutation(
+                        'deleted',
+                        $record,
+                        source: static::class
+                    )),
             ])
             ->bulkActions([
-                Actions\DeleteBulkAction::make(),
+                Actions\DeleteBulkAction::make()
+                    ->action(function (Collection $records, Actions\DeleteBulkAction $action) {
+                        $logger = app(SuperAdminAuditLogger::class);
+                        $deletedCount = 0;
+                        $failedCount = 0;
+
+                        foreach ($records as $record) {
+                            try {
+                                $record->delete();
+                                $logger->recordModelMutation('deleted', $record, source: static::class);
+                                $deletedCount++;
+                            } catch (\Exception $e) {
+                                $isConstraint = ($e instanceof \Illuminate\Database\QueryException && ($e->getCode() == 23000 || ($e->errorInfo[0] ?? '') == 23000));
+                                if ($isConstraint) {
+                                    $failedCount++;
+                                } else {
+                                    throw $e;
+                                }
+                            }
+                        }
+
+                        if ($failedCount > 0) {
+                            \Filament\Notifications\Notification::make()
+                                ->title(__('admin.common.error'))
+                                ->body(__('admin.event_types.messages.delete_constraint_error')." ($failedCount failed, $deletedCount deleted)")
+                                ->danger()
+                                ->send();
+
+                            if ($deletedCount === 0) {
+                                $action->halt();
+                            }
+                        }
+                    }),
             ]);
     }
 

app/Filament/Resources/EventTypeResource/Pages/ManageEventTypes.php

@@ -3,6 +3,7 @@
 namespace App\Filament\Resources\EventTypeResource\Pages;
 
 use App\Filament\Resources\EventTypeResource;
+use App\Services\Audit\SuperAdminAuditLogger;
 use Filament\Actions;
 use Filament\Resources\Pages\ManageRecords;
 
@@ -13,7 +14,13 @@ class ManageEventTypes extends ManageRecords
     protected function getHeaderActions(): array
     {
         return [
-            Actions\CreateAction::make(),
+            Actions\CreateAction::make()
+                ->after(fn (array $data, $record) => app(SuperAdminAuditLogger::class)->recordModelMutation(
+                    'created',
+                    $record,
+                    SuperAdminAuditLogger::fieldsMetadata($data),
+                    static::class
+                )),
         ];
     }
 }

app/Filament/Resources/GiftVoucherResource.php

@@ -5,6 +5,7 @@ namespace App\Filament\Resources;
 use App\Filament\Clusters\WeeklyOps\WeeklyOpsCluster;
 use App\Filament\Resources\GiftVoucherResource\Pages;
 use App\Models\GiftVoucher;
+use App\Services\Audit\SuperAdminAuditLogger;
 use App\Services\GiftVouchers\GiftVoucherService;
 use BackedEnum;
 use Carbon\Carbon;
@@ -62,8 +63,8 @@ class GiftVoucherResource extends Resource
                     ->label('Empfänger')
                     ->toggleable()
                     ->searchable(),
-                TextColumn::make('paddle_transaction_id')
+                TextColumn::make('lemonsqueezy_order_id')
-                    ->label('Paddle Tx')
+                    ->label('Lemon Squeezy Order')
                     ->toggleable()
                     ->copyable()
                     ->wrap(),
@@ -97,6 +98,13 @@ class GiftVoucherResource extends Resource
                     ->visible(fn (GiftVoucher $record): bool => $record->canBeRefunded())
                     ->action(function (GiftVoucher $record, GiftVoucherService $service): void {
                         $service->refund($record, 'customer_request');
+
+                        app(SuperAdminAuditLogger::class)->record(
+                            'gift_voucher.refunded',
+                            $record,
+                            SuperAdminAuditLogger::fieldsMetadata(['status', 'refunded_at']),
+                            source: static::class
+                        );
                     })
                     ->successNotificationTitle('Gutschein erstattet'),
                 Action::make('resend')
@@ -118,6 +126,13 @@ class GiftVoucherResource extends Resource
                             $record,
                             Carbon::parse($data['recipient_delivery_scheduled_at'])
                         );
+
+                        app(SuperAdminAuditLogger::class)->record(
+                            'gift_voucher.delivery_scheduled',
+                            $record,
+                            SuperAdminAuditLogger::fieldsMetadata($data),
+                            source: static::class
+                        );
                     })
                     ->visible(fn (GiftVoucher $record): bool => ! empty($record->recipient_email)),
                 Action::make('mark_redeemed')
@@ -136,6 +151,13 @@ class GiftVoucherResource extends Resource
                                 'manual_marked' => true,
                             ]),
                         ])->save();
+
+                        app(SuperAdminAuditLogger::class)->record(
+                            'gift_voucher.marked_redeemed',
+                            $record,
+                            SuperAdminAuditLogger::fieldsMetadata(['status', 'redeemed_at', 'metadata']),
+                            source: static::class
+                        );
                     })
                     ->successNotificationTitle('Als eingelöst markiert'),
             ]);

app/Filament/Resources/GiftVoucherResource/Pages/ListGiftVouchers.php

@@ -3,11 +3,12 @@
 namespace App\Filament\Resources\GiftVoucherResource\Pages;
 
 use App\Filament\Resources\GiftVoucherResource;
+use App\Services\Audit\SuperAdminAuditLogger;
 use App\Services\GiftVouchers\GiftVoucherService;
 use Filament\Actions\Action;
-use Filament\Resources\Pages\ListRecords;
-use Filament\Forms\Components\TextInput;
 use Filament\Forms\Components\Placeholder;
+use Filament\Forms\Components\TextInput;
+use Filament\Resources\Pages\ListRecords;
 use Illuminate\Support\Str;
 
 class ListGiftVouchers extends ListRecords
@@ -45,24 +46,40 @@ class ListGiftVouchers extends ListRecords
                 ])
                 ->action(function (array $data, GiftVoucherService $service): void {
                     $payload = [
-                        'id' => null,
+                        'meta' => [
-                        'metadata' => [
+                            'custom_data' => [
-                            'type' => 'gift_voucher',
+                                'type' => 'gift_voucher',
-                            'purchaser_email' => $data['purchaser_email'],
+                                'purchaser_email' => $data['purchaser_email'],
-                            'recipient_email' => $data['recipient_email'] ?? null,
+                                'recipient_email' => $data['recipient_email'] ?? null,
-                            'recipient_name' => $data['recipient_name'] ?? null,
+                                'recipient_name' => $data['recipient_name'] ?? null,
-                            'message' => $data['message'] ?? null,
+                                'message' => $data['message'] ?? null,
-                            'gift_code' => $data['code'] ?? null,
+                                'gift_code' => $data['code'] ?? null,
+                            ],
                         ],
-                        'currency_code' => $data['currency'] ?? 'EUR',
+                        'data' => [
-                        'totals' => [
+                            'id' => 'manual_'.Str::uuid(),
-                            'grand_total' => [
+                            'attributes' => [
-                                'amount' => (float) $data['amount'],
+                                'currency' => $data['currency'] ?? 'EUR',
+                                'total' => (float) $data['amount'] * 100,
+                                'user_email' => $data['purchaser_email'],
                             ],
                         ],
                     ];
 
-                    $service->issueFromPaddle($payload);
+                    $voucher = $service->issueFromLemonSqueezy($payload);
+
+                    app(SuperAdminAuditLogger::class)->recordModelMutation(
+                        'issued',
+                        $voucher,
+                        SuperAdminAuditLogger::fieldsMetadata([
+                            'amount',
+                            'currency',
+                            'status',
+                            'expires_at',
+                            'coupon_id',
+                        ]),
+                        source: static::class
+                    );
                 })
                 ->modalHeading('Geschenkgutschein ausstellen'),
         ];

app/Filament/Resources/LegalPageResource.php

@@ -5,6 +5,7 @@ namespace App\Filament\Resources;
 use App\Filament\Clusters\RareAdmin\RareAdminCluster;
 use App\Filament\Resources\LegalPageResource\Pages;
 use App\Models\LegalPage;
+use App\Services\Audit\SuperAdminAuditLogger;
 use BackedEnum;
 use Filament\Actions;
 use Filament\Forms\Components\DatePicker;
@@ -18,6 +19,7 @@ use Filament\Schemas\Components\Tabs\Tab as SchemaTab;
 use Filament\Schemas\Schema;
 use Filament\Tables;
 use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Collection;
 use UnitEnum;
 
 class LegalPageResource extends Resource
@@ -99,10 +101,27 @@ class LegalPageResource extends Resource
             ])
             ->filters([])
             ->actions([
-                Actions\EditAction::make(),
+                Actions\EditAction::make()
+                    ->after(fn (array $data, LegalPage $record) => app(SuperAdminAuditLogger::class)->recordModelMutation(
+                        'updated',
+                        $record,
+                        SuperAdminAuditLogger::fieldsMetadata($data),
+                        static::class
+                    )),
             ])
             ->bulkActions([
-                Actions\DeleteBulkAction::make(),
+                Actions\DeleteBulkAction::make()
+                    ->after(function (Collection $records): void {
+                        $logger = app(SuperAdminAuditLogger::class);
+
+                        foreach ($records as $record) {
+                            $logger->recordModelMutation(
+                                'deleted',
+                                $record,
+                                source: static::class
+                            );
+                        }
+                    }),
             ]);
     }