Third-party service configuration (Stripe keys, Mapbox tokens, etc.).

Best-guess location of the current request, inferred from the Cloudflare edge geo-IP. Used to prefill optional location fields like the create-business country. All fields null in non-Cloudflare runtimes.

The currently authenticated user and their passkeys.

Look up a pending co-guardian invitation by its secret token, to preview who invited the viewer and to which household before accepting. Returns null for an unknown, expired, or already-resolved token.

Look up a business-ownership claim by its secret token, to preview the pre-built business (and the platform it was migrated from) before the visitor signs in to take ownership. Returns null for an unknown token, and a non-redeemable preview for an expired/claimed/revoked one.

Public discovery feed of activities across visible businesses. When near (or, when omitted, the request's inferred location) yields a country, results are gated to businesses in that country and ordered nearest-first by the business's geocoded location. With no location signal at all, falls back to newest-first across every visible business.

metadata filters the feed to activities carrying matching well-known metadata values (skill level, age range, …). An activity matches an entry when any value stored under that key is in the entry's values; multiple entries are AND-ed together.

Open, bookable increments for a structure: booking activity within the [from, to] window — the activity's weekly windows minus the assigned resource's commitments, honoring its booking notice + advance window. Each slot is one increment; customers compose a longer booking from a contiguous run (bounded by minIncrements/maxIncrements). Empty when the activity isn't bookable or the appointments feature is off.

The start of the earliest open booking increment strictly after after (scanning forward up to a bounded horizon), so a booking calendar can jump the customer to the next day/week that actually has availability. Null when there's none within the horizon, the activity isn't bookable, or the appointments feature is off.

Matches the viewer has recorded, newest first. Cursor-paginated; default page size 50, clamped to [1, 100]. Sort order is startedAt DESC, id ASC.

Look up a single purchase the viewer owns (as buyer or gift-card redeemer), used by the account purchase-detail page. Returns null when the viewer is unauthenticated or does not own the purchase.

Read-only preview of what a customer would be charged at checkout for a product or activity, with optional discountCode and giftCardCode applied. Used by checkout UIs to show line totals as the customer types. Returns per-field errors (invalid code, conditions not met, expired, etc.) instead of throwing.

Quote the tax that would apply for a hypothetical purchase given the buyer's destination address. Used by the public checkout to show a tax line before the buyer commits to the payment. Returns zero tax (no error) when the seller has tax collection disabled or when the destination is in a jurisdiction the seller doesn't collect for.

Global search across Sessions' public surfaces, used by the Cmd-K Go menu's contextual results. Today returns matching businesses; the result type will grow over time to surface favorite instructors, activities, and other public entities alongside without breaking the field name. Each list is capped at first (default 5, max 10); matches are case-insensitive substring matches on the entity's primary text columns. Returns empty lists for an empty query.

The active debug-mode claim for the current session, or null if debug mode has not been unlocked. Drives the developer Debug Panel UI.

GitHub pull request associated with a preview branch name, used by the debug panel to show PR title/number alongside the branch slug. Returns null when no PR matches the branch or when server-side GitHub lookup is not configured.

Validate a pending OAuth authorization request and return what the consent screen needs: the requesting app's presentation, the scopes it's asking for, and the businesses the signed-in viewer may connect. The error field is set (and request null) for an unknown client, an unregistered redirect URI, or an otherwise invalid request — the consent page renders an error state. Requires an authenticated viewer.