@acms-subir/core 0.3.19 → 0.3.20

package/src/lib/calendar/data.ts

@@ -6,7 +6,7 @@ import type { ContentRepository } from '../repo/types';
 import type { CalEvent, Calendar, Settings } from '../schema';
 import { eventIsListed, eventIsPublic, expandEvents, safeColor } from './events';
 import { expandVEvents, loadFeed, tzParts, type CalendarEvent, type CalendarWindow } from './ics';
-import { CALENDAR, eventUrl, resourceUrl } from './config';
+import { CALENDAR, eventUrl, resourceUrl, withoutPrivateFields } from './config';
 
 export interface ViewEvent extends CalendarEvent {
   url?: string;
@@ -63,6 +63,13 @@ export async function collectViewEvents(
   });
 
   const events: ViewEvent[] = [];
+  // public views (cards, sections, theme helpers) never carry private fields
+  const shown = new Map<string, CalEvent>();
+  const view = (e: CalEvent) => {
+    if (scope.audience === 'admin') return e;
+    if (!shown.has(e.id)) shown.set(e.id, withoutPrivateFields(e));
+    return shown.get(e.id)!;
+  };
   for (const o of expandEvents(natives, settings, win)) {
     const e = o.event;
     const cal = e.calendarIds.map((id) => byId.get(id)).find((c) => c && scoped.has(c.id));
@@ -77,11 +84,11 @@ export async function collectViewEvents(
       ref: e.id,
       url: eventUrl(e.slug) + on,
       color: cal ? safeColor(cal.color) : undefined,
-      cancelled: e.cancelled,
+      cancelled: o.cancelled,
       image: e.cover || undefined,
       imageAlt: e.coverAlt || undefined,
       calendarName: cal?.name,
-      event: e,
+      event: view(e),
     });
   }
 

package/src/lib/calendar/events.ts

@@ -116,6 +116,25 @@ export interface Occurrence {
   end: number;
   allDay: boolean;
   days: number;
+  // this occurrence's start as wall time ('YYYY-MM-DDTHH:mm' in the event's
+  // zone, 'YYYY-MM-DD' for all-day): what exdates and cancelledDates store
+  key: string;
+  // the whole event is cancelled, or just this date
+  cancelled: boolean;
+}
+
+/**
+ * The occurrence key for an occurrence start. Timed events use the event's
+ * own zone; all-day occurrences start at midnight in the display zone (how
+ * the expander places them), so their date is read there.
+ */
+export function occurrenceKey(e: Pick<CalEvent, 'allDay' | 'timezone'>, start: number, settings: Pick<Settings, 'timezone'>, displayTz = settings.timezone || 'UTC'): string {
+  if (e.allDay) {
+    const p = tzParts(start, displayTz || 'UTC');
+    return `${p.y}-${pad(p.m)}-${pad(p.d)}`;
+  }
+  const p = tzParts(start, eventTimeZone(e, settings));
+  return `${p.y}-${pad(p.m)}-${pad(p.d)}T${pad(p.hh)}:${pad(p.mm)}`;
 }
 
 export function expandEvents(events: CalEvent[], settings: Pick<Settings, 'timezone'>, win: CalendarWindow): Occurrence[] {
@@ -124,13 +143,26 @@ export function expandEvents(events: CalEvent[], settings: Pick<Settings, 'timez
     const tz = eventTimeZone(e, settings);
     const v = toVEvent(e, tz);
     if (!v) continue;
+    // ?? []: editor previews pass unsaved events that may lack the field
+    const cancelledDates = new Set(e.cancelledDates ?? []);
     for (const o of expandVEvents([v], tz, win, 0)) {
-      out.push({ event: e, start: o.start, end: o.end, allDay: o.allDay, days: o.days });
+      const key = occurrenceKey(e, o.start, settings, win.displayTz);
+      out.push({ event: e, start: o.start, end: o.end, allDay: o.allDay, days: o.days, key, cancelled: e.cancelled || cancelledDates.has(key) });
     }
   }
   return out.sort((a, b) => a.start - b.start || a.event.title.localeCompare(b.event.title));
 }
 
+// The occurrence of a series with this key (null when the series has no
+// such date: never generated, skipped by exdates, or the series moved)
+export function findOccurrence(e: CalEvent, key: string, settings: Pick<Settings, 'timezone'>, displayTz = settings.timezone || 'UTC'): Occurrence | null {
+  const w = parseWall(key);
+  if (!w || w.dateOnly !== e.allDay) return null;
+  const at = e.allDay ? zonedToUtc(w.y, w.m, w.d, 0, 0, 0, displayTz || 'UTC') : wallToMs(w, eventTimeZone(e, settings));
+  return expandEvents([e], settings, { displayTz, now: at, windowStartMs: at - DAY, windowEndMs: at + DAY })
+    .find((o) => o.key === key && o.start === at) ?? null;
+}
+
 // The occurrence to feature for an event: the next one that hasn't ended,
 // else the most recent. `on` ('YYYY-MM-DD') picks a specific day's instance
 // (links from the calendar grid carry it).
@@ -151,7 +183,8 @@ export function featuredOccurrence(e: CalEvent, settings: Pick<Settings, 'timezo
     const s = parseWall(e.start);
     const en = parseWall(e.end) ?? s;
     const days = e.allDay && s && en ? Math.round((wallMinutes(en) - wallMinutes(s)) / 1440) + 1 : 1;
-    return { event: e, start: startAt, end: endAt, allDay: e.allDay, days };
+    const key = occurrenceKey(e, startAt, settings, displayTz);
+    return { event: e, start: startAt, end: endAt, allDay: e.allDay, days, key, cancelled: e.cancelled || (e.cancelledDates ?? []).includes(key) };
   }
   const next = expandEvents([e], settings, { displayTz, now, windowStartMs: now, windowEndMs: now + 3 * 366 * DAY })[0];
   if (next) return next;

package/src/lib/calendar/ics-write.ts

@@ -3,9 +3,11 @@
 // events are written in UTC (unambiguous everywhere); recurring timed events
 // keep their wall clock with TZID=<IANA zone> so a weekly 10am stays at 10am
 // across DST — Google, Apple and Outlook all resolve IANA zone ids. All-day
-// events are VALUE=DATE with the RFC's exclusive DTEND.
+// events are VALUE=DATE with the RFC's exclusive DTEND. A single cancelled
+// date of a series is an override VEVENT (same UID, RECURRENCE-ID) with
+// STATUS:CANCELLED, so calendar apps strike that one date.
 import type { CalEvent, Calendar } from '../schema';
-import { addWallDays, eventInstants, eventTimeZone, locationLine, parseWall, type Wall } from './events';
+import { addWallDays, eventInstants, eventTimeZone, findOccurrence, locationLine, parseWall, type Wall } from './events';
 import { zonedToUtc } from './ics';
 import { cleanRrule, rruleMap } from './rrule';
 
@@ -99,10 +101,32 @@ export function eventToVevent(e: CalEvent, siteTz: string, opts: FeedOptions): s
   const cats = e.calendarIds.map((id) => opts.calendars?.get(id)?.name).filter((n): n is string => Boolean(n));
   if (cats.length) lines.push(`CATEGORIES:${cats.map(escapeText).join(',')}`);
   if (e.cancelled) lines.push('STATUS:CANCELLED');
-  lines.push(`LAST-MODIFIED:${utcStamp(e.updatedAt)}`, `SEQUENCE:${Math.max(0, Math.floor((e.updatedAt - e.createdAt) / 1000)) % 2147483647}`, 'END:VEVENT');
+  const stamps = [`LAST-MODIFIED:${utcStamp(e.updatedAt)}`, `SEQUENCE:${Math.max(0, Math.floor((e.updatedAt - e.createdAt) / 1000)) % 2147483647}`];
+  lines.push(...stamps, 'END:VEVENT');
+  if (rule && !e.cancelled) lines.push(...cancelledOverrides(e, s, en, tz, siteTz, url, opts, stamps));
   return lines;
 }
 
+// one override per cancelled date that is still part of the series (keys
+// left behind by a moved series are ignored)
+function cancelledOverrides(e: CalEvent, s: Wall, en: Wall, tz: string, siteTz: string, url: string, opts: FeedOptions, stamps: string[]): string[] {
+  const out: string[] = [];
+  const toMin = (w: Wall) => Date.UTC(w.y, w.m - 1, w.d, w.hh, w.mm) / 60_000;
+  const lenMin = e.allDay ? (toMin({ ...en, hh: 0, mm: 0 }) - toMin({ ...s, hh: 0, mm: 0 })) + 1440 : Math.max(0, toMin(en) - toMin(s));
+  for (const key of [...new Set(e.cancelledDates ?? [])].sort()) {
+    const w = parseWall(key);
+    if (!w || !findOccurrence(e, key, { timezone: siteTz }, siteTz || 'UTC')) continue;
+    const endAt = new Date((toMin(w) + lenMin) * 60_000);
+    const end: Wall = { y: endAt.getUTCFullYear(), m: endAt.getUTCMonth() + 1, d: endAt.getUTCDate(), hh: endAt.getUTCHours(), mm: endAt.getUTCMinutes(), dateOnly: w.dateOnly };
+    const when = e.allDay
+      ? [`RECURRENCE-ID;VALUE=DATE:${dateValue(w)}`, `DTSTART;VALUE=DATE:${dateValue(w)}`, `DTEND;VALUE=DATE:${dateValue(end)}`]
+      : [`RECURRENCE-ID;TZID=${tz}:${localValue(w)}`, `DTSTART;TZID=${tz}:${localValue(w)}`, `DTEND;TZID=${tz}:${localValue(end)}`];
+    out.push('BEGIN:VEVENT', `UID:${e.id}@${opts.host}`, `DTSTAMP:${utcStamp(opts.now ?? Date.now())}`, ...when,
+      `SUMMARY:${escapeText(e.title || 'Untitled event')}`, `URL:${url}`, 'STATUS:CANCELLED', ...stamps, 'END:VEVENT');
+  }
+  return out;
+}
+
 export function buildFeed(events: CalEvent[], siteTz: string, opts: FeedOptions): string {
   const lines = [
     'BEGIN:VCALENDAR',

package/src/lib/calendar/schedule.ts

@@ -3,13 +3,15 @@
 // save/apply path as the event editor, so hooks, feeds, search and webhooks
 // see the same changes. A move applies at once, even on a published event —
 // the editor's "stage until Update" flow is for content edits, not dates.
+// Cancelling one date of a series applies at once too, without touching any
+// staged edits.
 import type { ContentRepository } from '../repo/types';
 import type { CalEvent } from '../schema';
 import { EventLocation, slugify } from '../schema';
 import { defaultPlaceLocation } from '../maps/places';
 import { ApiError } from '../api';
-import { applyEventUpdate, saveEvent, type SaveHooks } from '../content-service';
-import { addWallDays, formatWall, parseWall } from './events';
+import { applyEventUpdate, eventSideEffects, saveEvent, type SaveHooks } from '../content-service';
+import { addWallDays, findOccurrence, formatWall, parseWall } from './events';
 import { rruleMap, WEEKDAY_CODES, weekdayOf } from './rrule';
 import { eventDeleted } from './hooks';
 import { waitUntilFrom } from '../webhooks';
@@ -104,10 +106,15 @@ export async function moveSeries(repo: ContentRepository, id: string, days: numb
   if (!e) throw new ApiError(404, 'Event not found.');
   if (!Number.isInteger(days) || Math.abs(days) > 3660) throw new ApiError(400, 'Pick a day to move it to.');
   const start = shift(e.start, days);
-  const event = await saveNow(repo, e, {
+  let event = await saveNow(repo, e, {
     start, end: shift(e.end, days), allDay: e.allDay,
     ...(e.rrule ? { rrule: shiftRrule(e.rrule, days, start), exdates: e.exdates.map((x) => shift(x, days)) } : {}),
   }, hooks);
+  // cancelled dates move with the series, like skipped ones
+  if (e.rrule && e.cancelledDates.length) {
+    await repo.setEventCancelledDates(id, e.cancelledDates.map((x) => shift(x, days)));
+    event = (await repo.getEvent(id))!;
+  }
   return { event, undo: { kind: 'series', id, days: -days } };
 }
 
@@ -135,7 +142,9 @@ export async function moveOccurrence(repo: ContentRepository, id: string, occurr
   const copy = await repo.createEvent({
     title: e.title, slug: await uniqueSlug(repo, e.title), start: formatWall(newStart), end: endStr, allDay: e.allDay,
     timezone: e.timezone, status: 'draft', excerpt: e.excerpt, bodyJson: e.bodyJson, bodyHtml: e.bodyHtml, cover: e.cover, coverAlt: e.coverAlt,
-    location: e.location, cta: e.cta, calendarIds: e.calendarIds, fields: e.fields, tags: e.tags, cancelled: e.cancelled, rsvp: e.rsvp,
+    location: e.location, cta: e.cta, calendarIds: e.calendarIds, fields: e.fields, tags: e.tags,
+    // a cancelled date stays cancelled on its new day
+    cancelled: e.cancelled || e.cancelledDates.includes(occurrence), rsvp: e.rsvp,
     template: e.template, featured: false,
   });
   const event = live(e.status) ? await saveEvent(repo, copy.id, { status: 'published' }, hooks) : copy;
@@ -156,6 +165,38 @@ export async function undoMove(repo: ContentRepository, undo: MoveUndo, hooks: S
   if (series) await saveNow(repo, series, { exdates: series.exdates.filter((x) => x !== undo.occurrence) }, hooks);
 }
 
+// ---- cancel one date ----------------------------------------------------------
+// The date stays on the calendar struck through ("Cancelled"), its room holds
+// are released, and feeds mark it STATUS:CANCELLED. These do no permission
+// checks: callers (admin actions, site code through @acms-subir/core/server)
+// decide who may do this.
+
+async function setOccurrenceCancelled(repo: ContentRepository, id: string, key: string, cancel: boolean, hooks: SaveHooks, now = Date.now()): Promise<CalEvent> {
+  const e = await repo.getEvent(id);
+  if (!e) throw new ApiError(404, 'Event not found.');
+  if (!e.rrule) throw new ApiError(400, 'Only a repeating event has single dates to cancel. Cancel the whole event instead.');
+  const settings = await repo.getSettings();
+  const o = typeof key === 'string' && key.length <= 20 ? findOccurrence(e, key, settings) : null;
+  if (!o) throw new ApiError(400, 'That date isn’t part of this event.');
+  if (o.start <= now) throw new ApiError(400, 'That date has already started or passed.');
+  const has = e.cancelledDates.includes(key);
+  if (has === cancel) return e; // already so: nothing to change
+  await repo.setEventCancelledDates(id, cancel ? [...e.cancelledDates, key].sort() : e.cancelledDates.filter((x) => x !== key));
+  const after = (await repo.getEvent(id))!;
+  await eventSideEffects(repo, hooks, e, after);
+  return after;
+}
+
+/** Cancel one date of a repeating event, at once (also on a published event). Idempotent. */
+export function cancelOccurrence(repo: ContentRepository, id: string, key: string, hooks: SaveHooks, now?: number): Promise<CalEvent> {
+  return setOccurrenceCancelled(repo, id, key, true, hooks, now);
+}
+
+/** Undo cancelOccurrence for one date. Idempotent. */
+export function restoreOccurrence(repo: ContentRepository, id: string, key: string, hooks: SaveHooks, now?: number): Promise<CalEvent> {
+  return setOccurrenceCancelled(repo, id, key, false, hooks, now);
+}
+
 export async function duplicateEvent(repo: ContentRepository, id: string): Promise<CalEvent> {
   const e = await repo.getEvent(id);
   if (!e) throw new ApiError(404, 'Event not found.');

package/src/lib/calendar/seo.ts

@@ -17,7 +17,7 @@ export function isoWithOffset(ms: number, tz: string): string {
 
 const isMeetingUrl = (u: string) => /zoom\.us|meet\.google|teams\.microsoft|webex|whereby|jit\.si|youtube\.com\/live|twitch\.tv/i.test(u);
 
-export function eventJsonLd(e: CalEvent, o: Pick<Occurrence, 'start' | 'end' | 'allDay'>, settings: Settings, origin: string, pageUrl: string) {
+export function eventJsonLd(e: CalEvent, o: Pick<Occurrence, 'start' | 'end' | 'allDay'> & { cancelled?: boolean }, settings: Settings, origin: string, pageUrl: string) {
   const tz = eventTimeZone(e, settings);
   const date = (ms: number) => {
     const p = tzParts(ms, tz);
@@ -39,7 +39,7 @@ export function eventJsonLd(e: CalEvent, o: Pick<Occurrence, 'start' | 'end' | '
     ...(e.excerpt || e.seoDesc ? { description: e.seoDesc || e.excerpt } : {}),
     startDate: o.allDay ? date(o.start) : isoWithOffset(o.start, tz),
     endDate: o.allDay ? date(o.end - 86_400_000) : isoWithOffset(o.end, tz),
-    eventStatus: e.cancelled ? 'https://schema.org/EventCancelled' : 'https://schema.org/EventScheduled',
+    eventStatus: e.cancelled || o.cancelled ? 'https://schema.org/EventCancelled' : 'https://schema.org/EventScheduled',
     eventAttendanceMode: online && place
       ? 'https://schema.org/MixedEventAttendanceMode'
       : online ? 'https://schema.org/OnlineEventAttendanceMode' : 'https://schema.org/OfflineEventAttendanceMode',

package/src/lib/content-service.ts

@@ -35,7 +35,9 @@ export type PostSave = Parameters<ContentRepository['updatePost']>[1];
 export type PageSave = Omit<Parameters<ContentRepository['updatePage']>[1], 'blocks'>;
 // location may be partial: missing pin fields are filled from the current
 // location (see mergeLocationInput) — older clients send name/address/url only
-export type EventSave = Partial<Omit<CalEvent, 'id' | 'draft' | 'startAt' | 'endAt' | 'createdAt' | 'updatedAt' | 'sourceUid' | 'publishedAt' | 'location'>> & {
+// cancelledDates is left out: single dates are cancelled at once through
+// cancelOccurrence/restoreOccurrence (lib/calendar/schedule.ts), never staged
+export type EventSave = Partial<Omit<CalEvent, 'id' | 'draft' | 'startAt' | 'endAt' | 'createdAt' | 'updatedAt' | 'sourceUid' | 'publishedAt' | 'location' | 'cancelledDates'>> & {
   location?: Partial<EventLocation>;
 };
 type EventClean = Omit<EventSave, 'location'> & { location?: EventLocation };
@@ -200,7 +202,7 @@ export async function cleanEventInput(repo: ContentRepository, data: EventSave,
   return out;
 }
 
-async function eventSideEffects(repo: ContentRepository, hooks: SaveHooks, before: CalEvent, after: CalEvent, applied = false) {
+export async function eventSideEffects(repo: ContentRepository, hooks: SaveHooks, before: CalEvent, after: CalEvent, applied = false) {
   const settings = await repo.getSettings();
   await eventChanged(repo, before, after, {
     origin: siteOrigin(settings, hooks.url), waitUntil: waitUntilFrom(hooks.locals), applied, onRedirect: hooks.onRedirect,

package/src/lib/mobile/calendar.ts

@@ -2,7 +2,7 @@ import { z } from 'zod';
 import type { ContentRepository } from '../repo/types';
 import type { BookingLink, CalEvent, Calendar, Resource, Settings } from '../schema';
 import { ApiError } from '../api';
-import { CALENDAR, bookingsEnabled, resourceUrl, bookingLinkUrl } from '../calendar/config';
+import { CALENDAR, bookingsEnabled, resourceUrl, bookingLinkUrl, publicEventFields } from '../calendar/config';
 import { calendarToJson, eventToJson } from '../calendar/api';
 import { eventIsListed, eventIsPublic, expandEvents } from '../calendar/events';
 import { availabilityContext } from '../booking/service';
@@ -54,6 +54,7 @@ export async function listEvents(repo: ContentRepository, url: URL) {
     locale, timezone: settings.timezone || 'UTC', from: new Date(from).toISOString(), to: new Date(to).toISOString(),
     occurrences: occurrences.slice(start, start + q.limit).map(o => ({
       id: `${o.event.id}:${o.start}`, start: new Date(o.start).toISOString(), end: new Date(o.end).toISOString(), allDay: o.allDay,
+      cancelled: o.cancelled,
       event: publicEventDto(o.event, origin, publicCalendars, settings.timezone, locale),
     })),
     pagination: { page: q.page, limit: q.limit, nextPage: occurrences.length > start + q.limit ? q.page + 1 : null },
@@ -63,8 +64,8 @@ export async function listEvents(repo: ContentRepository, url: URL) {
 export function publicEventDto(e: CalEvent, origin: string, publicCalendars: Map<string, Calendar>, siteTz: string, locale: string | null) {
   const event = eventToJson(e, origin, publicCalendars, siteTz);
   event.url = localizedUrl(event.url, origin, locale);
-  // Only configured public event fields; no undeclared imported metadata.
-  event.fields = Object.fromEntries(CALENDAR.eventFields.filter(f => Object.hasOwn(e.fields, f.key)).map(f => [f.key, e.fields[f.key]]));
+  // Only configured public event fields; no undeclared imported metadata, no private fields.
+  event.fields = publicEventFields(e.fields);
   event.image = safeUrl(e.cover, origin);
   event.cta = { ...event.cta, href: localizedUrl(safeUrl(event.cta.href, origin, true), origin, locale) };
   return event;

package/src/lib/mobile/schemas.ts

@@ -28,18 +28,18 @@ export const Page = ContentSummary.extend({
 });
 export const Event = CalEvent.pick({
   id: true, slug: true, title: true, excerpt: true, status: true, cancelled: true, featured: true, start: true, end: true,
-  allDay: true, timezone: true, rrule: true, exdates: true, location: true, cta: true, tags: true, fields: true,
+  allDay: true, timezone: true, rrule: true, exdates: true, cancelledDates: true, location: true, cta: true, tags: true, fields: true,
 }).extend({ rsvp: CalEvent.shape.rsvp.optional(), url: str, icsUrl: str, repeats: str, image: str, imageAlt: str, updatedAt: date,
   calendars: z.array(z.object({ id: str, slug: str, name: str, color: str })),
 });
 export const Events = z.object({ locale, timezone: str, from: date, to: date, pagination: Pagination,
-  occurrences: z.array(z.object({ id: str, start: date, end: date, allDay: bool, event: Event })),
+  occurrences: z.array(z.object({ id: str, start: date, end: date, allDay: bool, cancelled: bool, event: Event })),
 });
 const Snippet = z.object({ text: str, highlights: z.array(z.object({ start: z.number().int(), end: z.number().int() })) });
 const ContentHit = ContentSummary.extend({ snippet: Snippet });
 export const SearchResults = z.object({ locale, query: str,
   posts: z.array(ContentHit), pages: z.array(ContentHit),
-  events: z.array(z.object({ snippet: Snippet, occurrence: z.object({ start: date, end: date, allDay: bool }).nullable(), event: Event })),
+  events: z.array(z.object({ snippet: Snippet, occurrence: z.object({ start: date, end: date, allDay: bool, cancelled: bool }).nullable(), event: Event })),
   more: z.object({ posts: bool, pages: bool, events: bool }),
 });
 const Icon = z.object({ type: z.enum(['svg', 'image', 'emoji']), value: str }).nullable();

package/src/lib/mobile/search.ts

@@ -86,7 +86,7 @@ export async function search(repo: ContentRepository, url: URL) {
       return {
         snippet: plainSnippet(snippet),
         // the next occurrence, or the latest one when the event is over
-        occurrence: o ? { start: iso(o.start), end: iso(o.end), allDay: o.allDay } : null,
+        occurrence: o ? { start: iso(o.start), end: iso(o.end), allDay: o.allDay, cancelled: o.cancelled } : null,
         event: publicEventDto(e, origin, listed, settings.timezone, locale),
       };
     }),

package/src/lib/repo/migrations.ts

@@ -655,9 +655,20 @@ export const MIGRATIONS: Migration[] = [
     `DROP TRIGGER content_version_settings_update`,
     ...contentVersionTriggers('settings', [...CONTENT_VERSION_COLUMNS.settings, 'links_verified', 'links_avatar_shape', 'links_avatar_fit', 'links_avatar_scale']),
   ] },
+  // one cancelled date of a repeating event (CalEvent.cancelledDates)
+  { version: 55, statements: [
+    `ALTER TABLE events ADD COLUMN cancelled_dates TEXT NOT NULL DEFAULT '[]'`,
+    `DROP TRIGGER content_version_events_update`,
+    // [insert, delete, update]: only the update trigger names columns
+    contentVersionTriggers('events', [...CONTENT_VERSION_COLUMNS.events, 'cancelled_dates'])[2],
+  ] },
 ];
 
 // Current cache coverage; keep earlier migration inputs frozen for upgrade compatibility.
-export const CURRENT_CONTENT_VERSION_COLUMNS = { ...CONTENT_VERSION_COLUMNS, settings: [...CONTENT_VERSION_COLUMNS.settings, 'links_verified', 'links_avatar_shape', 'links_avatar_fit', 'links_avatar_scale'] };
+export const CURRENT_CONTENT_VERSION_COLUMNS = {
+  ...CONTENT_VERSION_COLUMNS,
+  settings: [...CONTENT_VERSION_COLUMNS.settings, 'links_verified', 'links_avatar_shape', 'links_avatar_fit', 'links_avatar_scale'],
+  events: [...CONTENT_VERSION_COLUMNS.events, 'cancelled_dates'],
+};
 
 export const LATEST_VERSION = MIGRATIONS[MIGRATIONS.length - 1].version;

package/src/lib/repo/sql.ts

@@ -149,7 +149,7 @@ function rowToEvent(r: Row): CalEvent {
     seoTitle: r.seo_title ?? '', seoDesc: r.seo_desc ?? '', status: r.status,
     featured: Boolean(r.featured), tags: json(r.tags, []), template: r.template ?? '',
     start: r.starts, end: r.ends ?? '', allDay: Boolean(r.all_day), timezone: r.timezone ?? '',
-    rrule: r.rrule ?? '', exdates: json(r.exdates, []), cancelled: Boolean(r.cancelled),
+    rrule: r.rrule ?? '', exdates: json(r.exdates, []), cancelled: Boolean(r.cancelled), cancelledDates: json(r.cancelled_dates, []),
     location: json(r.location, {}), cta: json(r.cta, {}), calendarIds: json(r.calendar_ids, []),
     fields: json(r.fields, {}), sourceUid: r.source_uid ?? '', rsvp: json(r.rsvp, {}), roomHold: json(r.room_hold, {}),
     startAt: Number(r.start_at), endAt: Number(r.end_at), draft: parseDraft(r.draft), translations: parseTranslations(r.translations),
@@ -833,8 +833,8 @@ export class SqlRepository implements ContentRepository {
     await this.driver.run(
       `INSERT INTO events (id, slug, title, body_json, body_html, excerpt, cover, cover_alt, seo_title, seo_desc, status, featured, tags, template,
         starts, ends, all_day, timezone, rrule, exdates, cancelled, location, cta, calendar_ids, fields, source_uid, start_at, end_at,
-        published_at, scheduled_at, created_at, updated_at, rsvp, room_hold)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+        published_at, scheduled_at, created_at, updated_at, rsvp, room_hold, cancelled_dates)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
       [
         id, data.slug, data.title, data.bodyJson ?? '', data.bodyHtml ?? '', data.excerpt ?? '', data.cover ?? '', data.coverAlt ?? '',
         data.seoTitle ?? '', data.seoDesc ?? '', data.status ?? 'draft', data.featured ? 1 : 0, JSON.stringify(data.tags ?? []), data.template ?? '',
@@ -842,7 +842,7 @@ export class SqlRepository implements ContentRepository {
         data.cancelled ? 1 : 0, JSON.stringify(data.location ?? {}), JSON.stringify(data.cta ?? {}), JSON.stringify(data.calendarIds ?? []),
         JSON.stringify(data.fields ?? {}), data.sourceUid ?? '', startAt, endAt,
         data.publishedAt ?? (data.status === 'published' ? now : null), data.scheduledAt ?? null, now, now,
-        JSON.stringify(data.rsvp ?? {}), JSON.stringify(data.roomHold ?? {}),
+        JSON.stringify(data.rsvp ?? {}), JSON.stringify(data.roomHold ?? {}), JSON.stringify(data.cancelledDates ?? []),
       ]
     );
     await this.syncEventIndex(id);
@@ -867,7 +867,7 @@ export class SqlRepository implements ContentRepository {
       if (v !== undefined) { sets.push(`${col} = ?`); args.push(v); }
     }
     const jsonCols: Record<string, string> = {
-      tags: 'tags', exdates: 'exdates', location: 'location', cta: 'cta', calendarIds: 'calendar_ids', fields: 'fields', rsvp: 'rsvp', translations: 'translations', roomHold: 'room_hold',
+      tags: 'tags', exdates: 'exdates', cancelledDates: 'cancelled_dates', location: 'location', cta: 'cta', calendarIds: 'calendar_ids', fields: 'fields', rsvp: 'rsvp', translations: 'translations', roomHold: 'room_hold',
     };
     for (const [k, col] of Object.entries(jsonCols)) {
       const v = (data as Record<string, unknown>)[k];
@@ -927,6 +927,11 @@ export class SqlRepository implements ContentRepository {
     if (!draft) return;
     await this.updateEvent(id, pickEventDraft(draft));
   }
+  // per-date cancellations apply at once and never touch a staged draft
+  async setEventCancelledDates(id: string, dates: string[]) {
+    await this.ready;
+    await this.driver.run('UPDATE events SET cancelled_dates = ?, updated_at = ? WHERE id = ?', [JSON.stringify(dates), Date.now(), id]);
+  }
   async discardEventDraft(id: string) {
     await this.ready;
     await this.driver.run('UPDATE events SET draft = NULL WHERE id = ?', [id]);
@@ -1779,14 +1784,14 @@ export class SqlRepository implements ContentRepository {
       ...(content.events ?? []).map((e) => ({
         sql: `INSERT INTO events (id, slug, title, body_json, body_html, excerpt, cover, cover_alt, seo_title, seo_desc, status, featured, tags, template,
           starts, ends, all_day, timezone, rrule, exdates, cancelled, location, cta, calendar_ids, fields, source_uid, start_at, end_at,
-          draft, published_at, scheduled_at, created_at, updated_at, rsvp, room_hold)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+          draft, published_at, scheduled_at, created_at, updated_at, rsvp, room_hold, cancelled_dates)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
         args: [
           e.id, e.slug, e.title, e.bodyJson, e.bodyHtml, e.excerpt, e.cover, e.coverAlt, e.seoTitle, e.seoDesc, e.status, e.featured ? 1 : 0,
           JSON.stringify(e.tags), e.template, e.start, e.end, e.allDay ? 1 : 0, e.timezone, e.rrule, JSON.stringify(e.exdates),
           e.cancelled ? 1 : 0, JSON.stringify(e.location), JSON.stringify(e.cta), JSON.stringify(e.calendarIds), JSON.stringify(e.fields),
           e.sourceUid, e.startAt, e.endAt, e.draft ? JSON.stringify(e.draft) : null, e.publishedAt, e.scheduledAt, e.createdAt, e.updatedAt,
-          JSON.stringify(e.rsvp ?? {}), JSON.stringify(e.roomHold ?? {}),
+          JSON.stringify(e.rsvp ?? {}), JSON.stringify(e.roomHold ?? {}), JSON.stringify(e.cancelledDates ?? []),
         ],
       })),
       ...(content.forms ?? []).map(formInsert),

package/src/lib/repo/types.ts

@@ -45,7 +45,7 @@ export type EventUpdate = Partial<
     CalEvent,
     | 'title' | 'slug' | 'bodyJson' | 'bodyHtml' | 'excerpt' | 'cover' | 'coverAlt'
     | 'seoTitle' | 'seoDesc' | 'status' | 'featured' | 'tags' | 'template'
-    | 'start' | 'end' | 'allDay' | 'timezone' | 'rrule' | 'exdates' | 'cancelled'
+    | 'start' | 'end' | 'allDay' | 'timezone' | 'rrule' | 'exdates' | 'cancelled' | 'cancelledDates'
     | 'location' | 'cta' | 'calendarIds' | 'fields' | 'sourceUid' | 'rsvp' | 'translations' | 'roomHold'
     | 'publishedAt' | 'scheduledAt'
   >
@@ -143,6 +143,8 @@ export interface ContentRepository {
   saveEventDraft(id: string, data: Omit<EventUpdate, 'status' | 'scheduledAt' | 'publishedAt'>): Promise<void>;
   applyEventDraft(id: string): Promise<void>;
   discardEventDraft(id: string): Promise<void>;
+  /** replace an event's cancelled occurrence keys at once, keeping any staged draft */
+  setEventCancelledDates(id: string, dates: string[]): Promise<void>;
   deleteEvent(id: string): Promise<void>;
   // saved-place sync (lib/maps/places.ts): rewrite just the location of the
   // live row and/or the staged draft, leaving every other field — and the

package/src/lib/schema.ts

@@ -365,6 +365,10 @@ export const CalEvent = z.object({
   // a cancelled event stays visible (struck through) so people aren't left
   // wondering where it went; feeds emit STATUS:CANCELLED
   cancelled: z.boolean().default(false),
+  // occurrence keys (same format as exdates) of single dates that are
+  // cancelled: shown struck through, but they don't hold rooms. Keys that no
+  // longer match an occurrence (the series moved) are ignored.
+  cancelledDates: z.array(z.string()).default([]),
   location: EventLocation.default({}),
   cta: EventCta.default({}),
   calendarIds: z.array(z.string()).default([]),

package/src/lib/sections.ts

@@ -144,8 +144,8 @@ async function resolveSource(field: Extract<FieldDef, { type: 'source' }>, value
       return {
         title: e.title || 'Untitled event', url: lp(eventUrl(e.slug)), summary: e.excerpt, image: safeUrl(e.cover), imageAlt: e.coverAlt,
         location: locationLine(e.location), start: new Date(o.start).toISOString(), end: new Date(o.end).toISOString(),
-        allDay: o.allDay, cancelled: e.cancelled, when: f.range, date: f.date, time: f.time, month: f.month, day: f.day, weekday: f.weekday,
-        cta: e.cta.label && ctaHref && !e.cancelled ? { label: e.cta.label, href: ctaHref } : null,
+        allDay: o.allDay, cancelled: o.cancelled, when: f.range, date: f.date, time: f.time, month: f.month, day: f.day, weekday: f.weekday,
+        cta: e.cta.label && ctaHref && !o.cancelled ? { label: e.cta.label, href: ctaHref } : null,
       };
     });
   }

package/src/lib/sync/catalog.ts

@@ -125,6 +125,7 @@ const jsonFields = new Set([
   "rsvp",
   "roomHold",
   "exdates",
+  "cancelledDates",
   "amenities",
   "hours",
   "overrides",

package/src/pages/api/calendar/docs.ts

@@ -18,7 +18,7 @@ Errors: { "error": "message" } with 400 invalid · 401 no/invalid key · 403 mis
 ## Events
 
 GET  /api/calendar/events?from=YYYY-MM-DD&to=YYYY-MM-DD&calendar=<slug>&q=<text>&limit=200
-     → { timezone, from, to, occurrences: [{ id, start, end, allDay, event }] }  (repeats expanded)
+     → { timezone, from, to, occurrences: [{ id, start, end, allDay, cancelled, event }] }  (repeats expanded; cancelled: the whole event or just that date, listed in event.cancelledDates)
 GET  /api/calendar/events?expand=0      → { events: [...] }  (rules, not instances)
 GET  /api/calendar/events/<id|slug>
 POST /api/calendar/events                (events:write) → creates a DRAFT

package/src/pages/api/calendar/events/[id].ts

@@ -32,7 +32,7 @@ export const GET: APIRoute = async ({ request, locals, url, params }) => {
     const full = who ? hasScope(who, 'events:read') : false;
     if (!e || (!full && !eventIsPublic(e, map))) throw new ApiError(404, 'Event not found.');
     const view = full ? mergeEventDraft(e) : e;
-    return withCors(json({ event: { ...eventToJson(view, siteOrigin(settings, url), map, settings.timezone), ...(full ? { hasPendingDraft: Boolean(e.draft), bodyHtml: view.bodyHtml } : {}) } }));
+    return withCors(json({ event: { ...eventToJson(view, siteOrigin(settings, url), map, settings.timezone, { includePrivate: full }), ...(full ? { hasPendingDraft: Boolean(e.draft), bodyHtml: view.bodyHtml } : {}) } }));
   } catch (err) { return fail(err); }
 };
 

package/src/pages/api/calendar/events/index.ts

@@ -17,10 +17,11 @@ import { fail } from '../../../../lib/calendar/http';
 
 // Public read API for other sites, apps and lobby screens.
 //   GET /api/calendar/events?from=2026-10-01&to=2026-10-31&calendar=youth&q=night
-//   → { timezone, from, to, occurrences: [{ id, start, end, allDay, event }] }
+//   → { timezone, from, to, occurrences: [{ id, start, end, allDay, cancelled, event }] }
 //   GET /api/calendar/events?expand=0 → { events: [...] } (rules, not instances)
 // Anonymous callers see public calendars (and an unlisted one when asked by
-// slug). A key with events:read also sees private calendars.
+// slug). A key with events:read also sees private calendars and private
+// custom fields.
 const CORS = {
   'Access-Control-Allow-Origin': '*',
   'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
@@ -56,7 +57,7 @@ export const GET: APIRoute = async ({ request, locals, url }) => {
     if (q) events = events.filter((e) => `${e.title} ${e.excerpt} ${e.location.name}`.toLowerCase().includes(q));
 
     if (url.searchParams.get('expand') === '0') {
-      return withCors(json({ timezone: tz, events: events.map((e) => eventToJson(e, origin, map, settings.timezone)) }));
+      return withCors(json({ timezone: tz, events: events.map((e) => eventToJson(e, origin, map, settings.timezone, { includePrivate: full })) }));
     }
     const day = (param: string, fallback: number) => {
       const w = parseWall(url.searchParams.get(param) ?? '');
@@ -70,7 +71,7 @@ export const GET: APIRoute = async ({ request, locals, url }) => {
     const occ = expandEvents(events, settings, { displayTz: tz, now, windowStartMs: from, windowEndMs: to }).slice(0, limit);
     const cache = new Map<string, ReturnType<typeof eventToJson>>();
     const toJson = (id: string) => {
-      if (!cache.has(id)) cache.set(id, eventToJson(events.find((e) => e.id === id)!, origin, map, settings.timezone));
+      if (!cache.has(id)) cache.set(id, eventToJson(events.find((e) => e.id === id)!, origin, map, settings.timezone, { includePrivate: full }));
       return cache.get(id)!;
     };
     return withCors(json({
@@ -84,6 +85,7 @@ export const GET: APIRoute = async ({ request, locals, url }) => {
           start: o.allDay ? isoWithOffset(o.start, etz).slice(0, 10) : isoWithOffset(o.start, etz),
           end: o.allDay ? isoWithOffset(o.end - 86_400_000, etz).slice(0, 10) : isoWithOffset(o.end, etz),
           allDay: o.allDay,
+          cancelled: o.cancelled,
           event: toJson(o.event.id),
         };
       }),

package/src/pages/calendar/index.astro

@@ -166,7 +166,7 @@ const zoneName = fmt({ timeZoneName: 'long' }).formatToParts(now).find((p) => p.
     {view !== 'list' && comingUp.length > 0 && (
       <section class="pc-calpage-up">
         <h2>Coming up</h2>
-        <div class="pc-ev-cards" data-layout="grid" set:html={comingUp.map((v) => eventCardHtml({ event: v.event!, start: v.start, end: v.end, allDay: v.allDay, days: v.days }, settings, { showImage: true })).join('')} />
+        <div class="pc-ev-cards" data-layout="grid" set:html={comingUp.map((v) => eventCardHtml({ event: v.event!, start: v.start, end: v.end, allDay: v.allDay, days: v.days, cancelled: v.cancelled }, settings, { showImage: true })).join('')} />
       </section>
     )}
 

package/src/pages/events/[slug].astro

@@ -16,7 +16,7 @@ import { validateRequestSession } from '../../lib/auth/request';
 import { effectiveSettings } from '../../lib/designPreview';
 import { resolveDesign } from '../../lib/theme';
 import { siteOrigin } from '../../lib/seo';
-import { CALENDAR, eventUrl } from '../../lib/calendar/config';
+import { CALENDAR, eventUrl, withoutPrivateFields } from '../../lib/calendar/config';
 import { eventIsPublic, featuredOccurrence } from '../../lib/calendar/events';
 import { eventJsonLd } from '../../lib/calendar/seo';
 import { upcomingEvents } from '../../lib/calendar/cards';
@@ -31,7 +31,8 @@ if (!CALENDAR.enabled) return new Response(null, { status: 404, statusText: 'Not
 const repo = await getRepo(Astro.locals);
 const locale = requestLocale(Astro.url, Astro.locals);
 const rawEvent = await repo.getEventBySlug(Astro.params.slug ?? '');
-const event = rawEvent ? localizeDoc(rawEvent, locale) : null;
+// private custom fields never reach the page or a theme's event template
+const event = rawEvent ? withoutPrivateFields(localizeDoc(rawEvent, locale)) : null;
 const [rawSettings, allCalendars] = await Promise.all([repo.getSettings(), repo.listCalendars()]);
 const calMap = new Map(allCalendars.map((c) => [c.id, c]));
 const isAdmin = (await validateRequestSession(Astro.request, Astro.cookies, Astro.locals));
@@ -68,7 +69,7 @@ if (Astro.request.method === 'POST' && event.rsvp.enabled) {
 const formHtml = hiddenFields(await formVersion(definition), requestId) + `<input type="hidden" name="occurrence" value="${occurrence.start}">`;
 const taken = event.rsvp.enabled ? await seatsTaken(repo, event.id, occurrence.start) : 0;
 const rsvp = event.rsvp.enabled
-  ? { going: taken, left: event.rsvp.capacity ? Math.max(0, event.rsvp.capacity - taken) : null, maxSeats: event.rsvp.maxSeats, error: rsvpError, formHtml, fieldsHtml: renderFields(definition, formValues, 'event-registration'), values: coreValues, open: occurrence.end > now && !event.cancelled }
+  ? { going: taken, left: event.rsvp.capacity ? Math.max(0, event.rsvp.capacity - taken) : null, maxSeats: event.rsvp.maxSeats, error: rsvpError, formHtml, fieldsHtml: renderFields(definition, formValues, 'event-registration'), values: coreValues, open: occurrence.end > now && !occurrence.cancelled }
   : null;
 const calendars = event.calendarIds.map((id) => calMap.get(id)).filter((c): c is NonNullable<typeof c> => Boolean(c) && c!.visibility !== 'private');
 const html = highlightCodeHtml(await expandDynamicBlocks(event.bodyHtml, repo));