flowchart LR PERSON["Resident"] --> CAL["Calendar service"] CAL --> RESEND["Resend<br/>transactional email"] CAL --> TURNSTILE["Turnstile<br/>bot check"] NOTION["Notion Events"] --> CAL CAL --> D1["D1<br/>first-party events"] ADMIN["RC Console policy service"] -. admin allow or deny .-> CAL CAL -. Internal feed only .-> N8N["n8n"]
Resend
Resend sends Programs magic links and renewal warnings. A signed webhook reports delivered, bounced, and complained outcomes. The service verifies the Svix signature, matches the provider message id to the relevant request or token, and records the result in D1.
The admin Tools area edits subject, headline, body, call to action, supporting prose, and the footer shared by all messages. Preview runs the real email generator with unsaved drafts. Templates and the shared footer keep version history.
Cloudflare Turnstile
The Programs page fetches the public site key from /api/turnstile-site-key. The subscription handler verifies the submitted token when TURNSTILE_SECRET is configured. If the integration is intentionally disabled, the form remains usable.
Notion and R2
The scheduled generator queries Notion events whose Include in External Feed field is enabled, builds a deterministic ICS document, and writes it to R2 only when content changes. The public feed-serving path reads that R2 object.
RC Console policy service
Cloudflare Access proves the identity on admin requests. The Calendar middleware then asks RC Console whether that identity’s current role permits the mapped action. The check is machine-to-machine and uses AUTHZ_SERVICE_TOKEN; failures deny the request.
Admin Kit
Calendar consumes the public admin-kit package for dropdowns, toggles, dialogs, toasts, and date/time controls. The package supplies behavior and token names; Calendar supplies its Neon Civic styling. See Admin Kit.
First-party D1 analytics
Product and security events are written to event_log. Resend outcomes also appear in email_events, while feed request details are kept in calendar_access_log. See Calendar Analytics.
n8n
n8n is used only for the legacy Internal calendar:
- Internal subscription requests forward to
/webhook/subs/new. /cal/internal.icsproxies to/webhook/rc-cal.
The Programs event generator and resident subscription flow do not depend on n8n.
Retired: Mixpanel
The former Mixpanel dual-write, browser tracking, configuration, and admin test endpoint have been removed. D1 is the only current analytics destination.