See what we're building to help your business thrive. We're constantly innovating to bring you the best POS experience possible.
Latest features now available
Customer-facing contract page now renders dates in the viewer's browser timezone (IANA name passed via ?tz= query) instead of falling back to the server's UTC — so a PT-evening operator no longer sees tomorrow's date as 'today'. The PDF generator (agreementPdfService) follows the same Location > Tenant > UTC priority. E-signature inputs are disabled with an amber 'Please scroll through the entire agreement above to enable signing' banner until the customer reaches the bottom of #contractContent (or instantly when the contract fits without scrolling); banner flips green on unlock, signAgreement() re-checks the gate at submit time so devtools can't bypass it. New GET /api/marina/agreements/:id/signing-record endpoint returns the structured compliance audit (signer, IP, X-Forwarded-For, user-agent, browser/OS/device, screen resolution, timezone, language, optional geolocation, server-issued sessionId, SHA-256 signatureHash, consent text). Customer-facing e-signature defaults to Type with cursive fonts; Draw is one tap away. Rich-text formatting (strong/h1-3/ul/ol/a/blockquote) renders correctly inside .contract-content (Tailwind preflight stripped them).
The marina onboarding wizard's contract step now actually uses the ContractTemplate the operator selects. Adds contractTemplateId + mergeFieldValues fields on RentalAgreement (previously the wizard captured them but the server silently dropped them). The customer-facing /api/public/marina/agreement/:token endpoint populates the chosen template, auto-resolves the standard merge fields (business_name, customer_name, date_signed, mooring_number, lease dates, rate, vessel info, etc.), layers operator-supplied overrides on top, and returns the resolved HTML/text in a new contract block. The customer page (public/js/marina-agreement.js) renders the resolved template content; agreements with no template attached fall back to the existing hardcoded summary so legacy links keep working.
Generic customer-facing prompt orchestrator that routes tip selection, receipt-method capture, and (planned) survey responses to whichever surface the cashier has paired — Stripe SmartReader (collect_inputs sequence), TendPOS Tap-to-Pay device (planned Stage 3), or the cashier's tablet (local sheet). Wired into the native iOS POS house-account checkout: tip-before-auth → existing PIN/signature/selection auth → receipt-after-approval, charging the house account with subtotal+tip and firing the receipt service with the chosen email/sms/print/none method. Six new endpoints under /api/customer-interaction/* plus a new CustomerInteractionRequest model with a 5-minute TTL and pending → completed/cancelled/expired/failed state machine. Stage 1.5 brings web-POS parity for the same flow; Stage 2 extends to cash + card payment methods; Stage 3 adds Socket.IO push to the Terminal app for the Tap-to-Pay surface.
Expanded the customer portal at /{slug}/myaccount from a read-mostly dashboard into a full self-service surface. PR1 (profile): new PATCH /api/customer/account/me (cross-tenant CustomerAccount fields) and PATCH /api/customer/portal/:slug/me (per-tenant Customer fields including marketingOptIn). Address CRUD + saved-card CRUD (Stripe SetupIntent flow with Elements card-entry UI) mirrored onto the new portal route family. PR2 (vessels + appointments + maintenance + receipts): proper Vessel CRUD with ownerType='customer' enforcement and a 409 VESSEL_IN_USE guard on DELETE that refuses while the vessel is attached to a non-terminal RentalAgreement. Salon appointment self-cancel with status + start-time gates. Property maintenance edit + cancel for resident-initiated requests still in submitted/acknowledged status. Receipt PDF download endpoint streams transactional receipt PDFs via the existing receiptService.generatePDF, RLS-scoped to the requesting customer. PR3 (house-account self-pay — real money): three new endpoints (/balance, /transactions, /pay) gated by customer.houseAccount.enabled. /pay charges a saved card via customerPaymentService.chargePaymentMethod, decrements currentBalance, recomputes availableCredit, and writes a HouseAccountTransaction (type='payment', metadata.source='customer-self-pay') for the audit trail — idempotency-keyed to make flaky retries safe (returns alreadyApplied:true when the same key shows up twice), server-enforced max=currentBalance to prevent OVERPAYMENT. New SPA module account.js (~500 LOC) with /profile, /addresses, /payment-methods, /house-account sub-routes. Vessel CRUD UI inside marina module, salon cancel button on appointment detail, maintenance Cancel link on each row, PDF download link on every transaction in retail+restaurant orders. Stripe.js loaded async from customer-account.html. 20 new self-service tests (profile, vessel-CRUD-with-active-agreement-guard, salon-cancel guards, maintenance-cancel guards, house-account self-pay including idempotency + overpayment + decline, receipt-PDF including cross-customer RLS, address CRUD round-trip). Plus 5 endpoints already documented for the existing 18 portal endpoints — total customer-portal endpoint count now 32 → 55.
Closes out the customer-portal project for real. Fixed three bugs I flagged in my own post-mortem: marina request-modification was using sendCustomerEmail (wrong helper, wrong mode) and reading tenant.email (field doesn't exist — actual field is tenant.contact.email); salon/rebook was generating appointmentNumber manually but Appointment has a pre-save hook (src/models/salon/Appointment.js:276) that handles it. Added escapeForHtml on the email-body customer description to prevent stored XSS through the marina notification email. Did a full XSS audit on every innerHTML path in the customer-portal modules — every customer-supplied field is escapeHtml-wrapped (the audit also surfaced unescaped pre-existing interpolations in customers.js admin code, flagged for separate cleanup). Extracted CustomerPortalUtils — escapeHtml/fmtMoney/fmtDate/fmtDateTime/statusPill/errorPanel — out of every vertical module, eliminating ~250 LOC of duplication across 7 module files. New jsdom browser test suite (21 tests) loads the SPA in jsdom and verifies util edge cases, registry register/findById/forVerticals, localStorage token round-trip, module dashboardTile + page renderers (including an explicit XSS-attempt-in-data test confirming <script> gets escaped). New PDF content test (10 tests) uses pdf-parse to decode the generated buffer and assert that agreement number, customer name, slip, vessel, lease totals, and signature all appear in the rendered output — catches schema-mismatch bugs the prior magic-bytes test missed. Deleted 5 orphaned files (customerRecognitionService, sharedCustomerController, routes/sharedCustomers, migrate-to-shared-customers, root-level test_shared_customers.js); kept GlobalCustomer + CustomerTenantRelationship models because loyaltyService imports them (a pre-existing bug — the loyalty system queries a relationship that's never created — flagged as separate follow-up). Total portal test count: 167 across 9 suites. ALL portal endpoint behavior now verified end-to-end: request shape (route tests), response shape (route tests), shape-on-the-wire (SPA tests with mocked fetch), PDF content (parse-and-assert tests), browser-side rendering (jsdom tests).
Closes the customer-portal project. (1) Marina-agreement PDF: new agreementPdfService uses pdfkit (already a project dep) to generate a one-page summary on demand — header with marina + agreement number, customer + slip + vessel, lease terms, payment status, signature block. Streamed directly with attachment Content-Disposition; SPA fetches with auth then triggers a blob-URL download (anchor href can't carry the Bearer token). 2 new RLS-tested route tests verifying %PDF- magic bytes + 404 for non-owned agreements. (2) Admin-portal Portal Accounts tab on the Customers page (#customers) — table with email, name, last-login, linked-at, loyalty points, lifetime spend; live-search box wired to the existing GET /api/customer-accounts endpoint. Tenant staff can now see who's registered for their portal without leaving the admin app. Total portal endpoint count: 32. Total portal+operator test coverage: 136 across 7 suites.
Customers can now do things, not just read. (1) Property maintenance request submission — customer fills a form on /maintenance, server validates active lease, creates a MaintenanceRequest scoped to (tenant, customer) via the PropTenant link, fires logger.info for ops visibility. (2) Automotive vehicle-add — customer adds a vehicle to their profile from /vehicles, plate + VIN uppercased server-side, schema requires at least one identifying field. (3) Salon rebook from history — customer picks a completed appointment + a future date/time; server clones services + stylist as a NEW Appointment in 'pending' status that operator confirms before scheduling. (4) Marina request-modification — customer submits structured change request (date_change/rate_change/vessel_change/slip_change/terminate/other), server appends to agreement.internalNotes for staff visibility AND best-effort emails the marina. (5) Marina resend-payment-email — re-sends the original tokenized agreement link via sendMooringRentalInvoice. (6) Operator-side GET /api/customer-accounts — tenant staff sees every CustomerAccount with a verified tenantLink to their tenant + the linked Customer's loyalty stats joined inline; gated by customers:read permission. SPA shell now supports afterRender hooks on module routes (so forms can attach handlers post-render) + a public refresh() helper for re-rendering after successful writes. 11 new portal-route tests + 5 new operator-route tests + 1 new test suite. Total portal endpoint count: 31 across 7 verticals + tenant operator endpoint. Total portal+operator test coverage: 134 across 7 suites.
Three more vertical modules + the missing UX gap from earlier phases. (1) Retail module: order history + loyalty (points balance, lifetime spend, avg order value pulled from Customer's denormalized fields). (2) Property-management module: lease history + maintenance requests, with the right Customer→PropTenant indirection (Lease.tenants[] references PropTenant, which has the customerId link to our Customer model). (3) Automotive module: vehicles on file + work orders (with the right actual.total/estimate.total fallback) + inspection history. (4) Self-register: when verifyMagicLink consumes a tenant-pinned link and no Customer exists at that tenant for the email, we now auto-create one — the magic-link click already proves email ownership, so this is a legitimate sign-up path. Without it, customers who registered at /{tenant}/myaccount/register without an existing tenant profile got authenticated but had no tenantLink, leaving them stuck with an empty dashboard. 9 new endpoints (2 retail + 2 property + 3 automotive + the auto-Customer-create path) + 6 new tests bringing portal coverage to 118 tests across 6 suites. Total portal endpoint count: 22 across 7 verticals.
Three new vertical modules ship as drop-ins through the existing registry — proves the architecture from Phase 1 (vertical-pluggable shell) actually works. (1) Salon: /api/customer/portal/:slug/salon/appointments + /:id detail; module renders next-appointment dashboard tile + chronological appointment list with stylist/services/totals. (2) Restaurant family (registers for restaurant + cafe + bar + bakery + fine-dining + casual-dining + quick-service — all share the module): /restaurant/reservations + /restaurant/orders endpoints; module shows next reservation tile + recent orders; orders pull last 50 Transaction records (status: completed/refunded). Note: handles the historical Reservation.customer-not-customerId field naming. (3) Fitness: /fitness/classes + /fitness/membership; module shows membership status pill + next class tile, /classes page lists chronological bookings with waitlist position when applicable, /membership page shows plan + dates + auto-renew. 6 new RLS-tested endpoints, 6 new route tests bringing portal coverage to 111 tests across 6 suites.
Builds out the marina vertical's customer-portal surface from dashboard stub to fully usable. New /api/customer/portal/:slug/* API (NOT the legacy /v1/public/customer/portal — keeps the new portal independent of the legacy CustomerAuth model): /me (merged account+tenant+customer profile), /vessels (customer-owned only — excludes fleet boats), /marina/agreements (list with status pill + slip + vessel + pricing summary), /marina/agreements/:id (detail with documents + payment + signature state), /marina/launches (chronological history with status pills), /marina/billing (per-agreement total/paid/owed + summary totals — synthesized from RentalAgreement.payment so we don't fan out to Transaction/Invoice the customer doesn't own copies of). All endpoints gated by requireCustomerAccountForSubdomain — RLS-tested so customer A cannot see customer B's records, even at the same tenant. SPA shell now supports dynamicRoutes (regex-based pattern matching) so modules can register parameterized URLs like /agreements/:id. Marina module dashboard tile redesigned: 3-stat grid (active agreements, vessels, owed amount with amber accent when >$0). 9 new route tests covering shape correctness, cross-tenant isolation, and RLS — total portal test count now 105 across 6 suites.
TendPOS-wide customer portal at app.tendpos.com/{tenant-slug}/myaccount. One login per customer regardless of how many tenants they're a customer of — a marina slip at Marina A and a hair appointment at Salon B share a single account with a tenant-aware switcher. New CustomerAccount model layers above the existing tenant-scoped Customer (tenantLinks[] reference Customer._id, no replacement migration required). Auth: bcrypt-hashed magic-link tokens (default), optional cross-tenant password, 30-day refresh tokens, JWT access tokens. 10 endpoints under /api/customer/account/* (register, request-link, verify-link, login, set-password, refresh, logout, me, tenants/confirm-links, handoff/exchange) plus a public /api/public/tenant/:slug/brand for the SPA shell to render tenant chrome. Bridging middleware (requireCustomerAccountForSubdomain) lets the existing /api/v1/public/customer/portal/:subdomain/* surface (~17 endpoints) accept new sessions without rewriting handlers. Vertical-pluggable module registry — marina ships first with Vessels-on-file dashboard tile + /vessels list page (other verticals drop in as files in public/js/customer-account/modules/). Marina-agreement activation now mints a one-shot handoff token and surfaces a portalUrl in the sign/pay response; the customer-facing page redirects to /myaccount?handoff=email:token, the SPA exchanges it for a session and lands the customer on the dashboard with the agreement's Customer auto-linked. 85 unit tests across 4 suites — 27 model + 27 service + 15 middleware + 16 routes (covering email enumeration shield, single-use tokens, wrong-purpose rejection, stale-link 410, cross-tenant link spoofing rejection).
Closes the loop on the LAN failover system with five surface-level improvements: (1) Super-admin Admin Portal dashboard at /lan-coordinators.html showing every coordinator across every tenant with heartbeat health buckets (healthy <90s, stale <36min, dead) plus tenant adoption stats; backed by GET /api/admin/lan-coordinators + /stats. (2) POS Settings → LAN Failover Coordinator screen rewritten for the auto-elect-first world — explains that auto-election is the default and the toggle is a manual override; status badges distinguish auto-elected from manually-pinned coordinators. (3) Feature config plumbed (pos.lanFailover at tier 0, all plans) so the feature appears in the Admin plan-feature matrix. (4) electionManager + posLanRelay converted from TS-only to JS+d.ts pattern matching the rest of the LAN module, plus 23 new unit tests covering claim/heartbeat/demote dispatch + relay skip conditions + publish payload shape. (5) README mention + cross-doc cleanup (CLAUDE.md, LAN_FAILOVER.md). 154 LAN-related unit tests across 9 suites — 35 backend service + 23 orchestrator + 19 routes + 19 auth + 13 bonjour + 10 sync + 12 election + 11 relay + 12 admin shaper.
Three layers of polish on top of the original LAN failover so the kitchen never notices the cloud went down. (1) Auto-election: every native POS calls POST /api/pos-auth/lan-coordinators/auto-elect on boot — first one at a location wins, the rest sit as hot standbys. If the active coordinator dies (battery, force-quit, network unplug), any standby takes over within ~90s via atomic stale-heartbeat takeover. Manual designations from the Settings toggle are still respected as sticky. (2) Every-POS relay: secondary POS devices (not just the coordinator) publish their newly-rung-up orders to the coordinator over LAN via posLanRelay so KDS sees orders from EVERY POS during an outage, not just the coordinator's. Existing offline transaction queue still handles cloud sync — both upsert by the same _id so the result is idempotent. (3) Sub-1s failover: orchestrator now subscribes to @react-native-community/netinfo for OS connectivity events AND exposes markCloudFailure()/markCloudSuccess() so any real fetch outcome triggers an immediate (throttled) recheck. orderService wraps every cloud-bound call so a single failed fetchOrders flips us into LAN mode within one request instead of waiting for the next 30s health-check poll. New backend pieces: Device.lanCoordinator.{electedAuto, lastHeartbeatAt}, electCoordinator() with stale-takeover, recordHeartbeat() with stillCoordinator response. 19 new unit tests on top of the original 100 (35 service + 23 orchestrator + same 64 elsewhere = 119 total).
When the cloud goes down, the kitchen keeps getting orders. One POS per location is designated the LAN coordinator — it runs an embedded HTTP server (port 3030, advertised over Bonjour as _tendpos-lan._tcp) that mirrors the small subset of cloud KDS endpoints needed during an outage. KDS native apps run a connection orchestrator that pings cloud + LAN every few seconds and transparently routes fetchOrders/bumpItem/bumpOrder to the coordinator when the cloud is unreachable. Auth uses HMAC-SHA256 LAN tokens minted from a per-tenant secret that devices cache on every cloud connect — coordinator verifies offline, no cloud round-trip needed. Every bump KDS performs and every order the coordinator created locally during the outage gets queued in SQLite; sync worker drains the queue back to cloud once it returns (orders first so bumps don't 404, then bumps in chronological order). Operator designates the coordinator from POS Settings → LAN Failover Coordinator; KDS shows the active mode in a status pill in the header. 81 unit tests across the backend service, HMAC, state machine, route handlers, mDNS picker, and sync worker.
Closes every deferred item from the four-domain consistency series. Adds Tenant.subscription.status state machine (trialing → active → past_due → suspended → cancelled) with canonical subscriptionService and trial-conversion cascade. Plus four follow-up PRs: marina booking refunds cascade to Transaction; Transaction.payments[].idempotencyKey field with auto-derivation for Stripe/Square/Terminal flows; Stripe webhook payment_intent.succeeded/charge.refunded routed through paymentService with idempotent retry-safety; Square sync sets idempotency from tenderId; House Account refund path implemented (credits customer balance + creates HAT credit row). Five state machines now exist in the codebase, each with the same canonical-service + invariants + cascade pattern. STATE_MACHINE_PATTERN.md is the recipe future devs use to add domain six.
Transaction.status (plus payments[] and refunds[]) is now a strict state machine with one canonical writer (paymentService) and pre-save invariants enforcing sums consistency (refunds <= paid, completed ⇒ paid >= total, refunded ⇒ refunds >= total, cancelled ⇒ no completed payments). All four POS payment + refund callsites now go through the service: card + cash confirm, POS payment, POS refund. Cascades fire automatically: completion fires accounting auto-post + commission calc; refund fires accounting reversal + inventory restock + recipe deduction reversal. Closes the four-domain consistency series (Mooring, Invoice, RentalAgreement, Payment) — every money-flow record across the codebase now writes through a canonical service with cascade-firing instead of inline mutation. Includes the codebase-wide STATE_MACHINE_PATTERN.md recipe so future devs can apply the same pattern to new domains.
RentalAgreement.status (plus payment.status and signature.signed) is now a strict state machine with one canonical writer (rentalAgreementService) and pre-save invariants enforcing payment/signature consistency. Closes the third leg of the Invoice ↔ Agreement ↔ Mooring triangle: signing or paying an agreement now fires the mooring transition cascade so the slip transitions in lockstep (assigned → paid once signed + paid). Cancelling an agreement cascades to both the mooring (releases the slip) and any linked invoice (cancels it, unless already paid). The lease-expiry cron now goes through markExpired so the same cascade fires whether a lease ends naturally, gets cancelled by an operator, or is killed mid-onboarding. Eight callsites refactored: cron job, mooring release, onboarding cancel, contract creation, invoice linkage, public sign endpoint, public pay endpoint, controller cancel.
Invoice.status is now a strict state machine with one canonical writer (invoiceService) and pre-save invariants enforcing paidAmount/status consistency (paid ⇒ paidAmount=total, partial ⇒ 0
Mooring.status is now a strict state machine with one canonical writer. Six states (vacant / assigned / paid / occupied / maintenance / unavailable) replace the loose available/reserved/occupied trio. assigned = committed but unpaid; paid = paid + slip held but no vessel in it; occupied = paid AND a vessel was actually launched into the slip. All five flows that previously wrote status directly (long-term agreements, short-term reservations, vessel launches, onboarding wizard, orphan cleanup) now go through mooringService — the schema's pre-save invariant validator catches drift if anything tries to bypass. New currentReservationId field tracks short-term holds. Auto-migration maps existing rows by reading each mooring's live refs. Daily lease-expiry cron at 02:30 finds expired-but-still-paid slips and recomputes them to vacant. UI labels updated everywhere (Vacant / Assigned (hold) / Paid (no vessel) / Occupied / Maintenance / Unavailable) with a shared color palette across the moorings table, map, and modals.
Marina rental agreements created via the onboarding flow are now visible to operators in a dedicated Marina Agreements page (the generic Contracts page only listed Contract-model docs). Stats by status (pending / active / completed / cancelled), search by customer or mooring, per-row View detail modal + Cancel action wired to the existing API. Plus: cancelling an onboarding session now cascades to cancel its linked rental agreement — previously, agreements created at the contract step but never paid sat in pending_signature/pending_payment forever, invisible to the queue and zombie-Pending in any list.
The vessel registration input is now a compact state pill + single 6-character text field instead of three side-by-side controls. Tapping the pill opens a search-filterable modal listing the user's last 4 picked states pinned at the top, then the full alphabetical list of states + US territories (AS, GU, MP, PR, VI). Tapping any row in the modal auto-accepts and closes — no extra Done step. The most-recently-picked state is remembered in browser localStorage and pre-selected on the next vessel entry, so a marina that books mostly in-state vessels stops re-picking on every entry. Body field strictly accepts 4 digits + 2 letters (compact 1234AB form), auto-uppercases, and refuses to save half-typed values. Same component is shared by the customer portal, admin wizard, Fleet page, and launch wizard.
Every place in the codebase that captures or displays a US state vessel registration number now uses a single canonical XX NNNN LL format (e.g. CF 1234 AB). A reusable 3-field input component (state dropdown / 4-digit numeric / 2-letter alpha, auto-uppercased) replaced the scattered free-text inputs in the customer portal, the admin onboarding wizard, the Fleet page, and the launch wizard. State dropdown lists all 50 states + DC using the OFFICIAL boat-registration prefixes — including the 10 historical quirks where the prefix is not the postal code (CF for California, MS for Massachusetts, MC for Michigan, MI for Mississippi, etc.). Schema-level Mongoose setters on Vessel and RentalAgreement.vessel normalize every write through any caller. Unparseable input (USCG-documented vessels, foreign numbers, legacy unstructured) passes through untouched so we never destroy data we don't understand. Auto-migration backfills every existing row.
Marina staff can now click any completed step in the onboarding wizard's stepper to jump back and edit prior data without losing position. The Continue button becomes Save Changes when viewing a prior step, and a Back to {current step} button appears to return without saving. Server-side merges saved data so empty form submits are safe (no-op). The awaiting_payment lockout that previously blocked all interaction is gone — operators see a banner instead and can continue editing. Customer / slip / vessel changes still require a new session (those re-run booking validations).
Customers completing the marina onboarding portal now see a chooser at the top of the vessel step listing every customer-owned vessel they already have on file — pick one and the form pre-populates from the existing record. The status gate that blocked vessel updates after sign+pay is gone, so the vessel step works no matter where the marina places it in their portalStepOrder (e.g. after Payment). Vessel data lives only on the agreement during the flow and is not committed to the customer's profile until the agreement reaches active (signed + paid) — at that moment the system materializes a Vessel record under the customer's profile (ownerType: customer) and links it back to the agreement. Failures log only and never block activation; marina staff can backfill from the admin UI.
Marina operators now configure the customer-facing vessel form per location. Each of 14 fields (name, type, length, beam, draft, registration, make, model, year, hull color, fuel type, insurance provider/policy/expiry) can be set to Required, Optional, or Hidden. Type is now a dropdown driven by a configurable list of vessel types (add/remove tags in the same Locations modal — leave empty to use the default Sailboat/Powerboat/Yacht/etc. list). Customer form auto-renders only the visible fields, marks required ones with *, and validates against the per-location config; the server enforces required fields and silently drops hidden ones. Vessel-fits-mooring length/beam/draft checks only fire when the field is actually collected, so hiding Beam implicitly opts out of beam enforcement at booking. Defaults preserve the pre-config form so existing tenants see no change until they opt in.
Marina multi-location operators can now customize the customer-facing onboarding experience per location. Two drag-to-reorder lists live under Admin → Locations → edit: portal step order (summary/payment/vessel/contract/documents) and invoice email section order (greeting/reservation/invoice/payment link/due date/what's next/closing). Section only appears when the location has 'marina' in its verticals. Stored on Location.settings.marina; default orders are persisted as null so future platform-level default changes propagate automatically. Customer portal and invoice email both iterate the configured order, drop unknown keys, and append any missing keys at the end — so stale or incomplete configs still render every step.
Built a single source of truth (locationResolver) that every vertical-scoped create path now runs through. Validates that a supplied locationId belongs to the tenant and carries the required vertical ('marina', 'salon', etc. or the restaurant family bar/cafe/bakery/etc.), auto-resolves for single-vertical-location tenants, or surfaces a clear 400 when multi-location tenants need to pick. Applied to 22 controllers across marina/salon/automotive/fitness/restaurant. Admin UI pickers added to every vertical-scoped modal (marina moorings, salon appointments, fitness class/schedule/membership/trainer, automotive work order/inspection) — picker shows only when the tenant has ≥2 same-vertical locations. Wizard step-0 picker scopes marina onboarding to a specific location for multi-marina tenants. Two auto-migrations (mooring-specific + generic) backfill legacy locationless records.
The marina onboarding portal now supports saved payment methods per location. Tenants toggle 'Allow saved payment methods' per-location in the admin UI; when enabled, the customer-facing portal shows a 'Save this payment method' checkbox that persists the card/ACH method on a Stripe Customer for reuse on the next booking. Returning customers see a saved-methods picker above the Payment Element (with a 'Use a different method' fallback). Same portal also picks up location-specific branding (name + logo from Location.settings.receiptTemplate) + sends invoice emails under the location's name instead of the tenant umbrella.
The customer onboarding portal's Bank Transfer option now uses Stripe's Payment Element for ACH — polished UI with the labeled-check helper image, manual routing/account entry, and Financial Connections for instant bank linking. PaymentIntent scoping sends only the method the customer actually selected (prevents Stripe Link from offering both Card and Bank tabs). Suppresses Link wallet upsells and 'will be saved to Link' nag unless the customer explicitly opts to save. Also fixed: payment-intent endpoint was a stub, click handlers weren't wired on method cards, billing fields now pre-filled from the customer record and hidden so operators don't re-type name/email.
Typing a full customer name like 'Luke Johnston' in the onboarding wizard used to return 'No customers found' because the backend $or only regexed the whole query against each single field — 'Luke Johnston' never appears inside firstName or lastName alone. Backend now splits multi-token queries and matches firstName+lastName across tokens in either order. Also hid the add-customer form until the operator clicks 'Add <query> as a new customer' from the no-results state, pre-filling first/last name from the query.
Processing fees collected through the marina onboarding wizard used to commingle into general sales revenue on the P&L, making it hard for tenant accountants to see how much was booked as merchant fee income vs. mooring revenue. Added a new Merchant Fee Income system account (4060) seeded for every tenant via auto-migration. The accounting auto-post service now detects service_fee line items (by explicit itemType or SKU prefix SVC-) and credits them to this account on sale; refunds proportionally reverse both accounts. Also added direct-payment fee parity — the flat/percentage fee picker that previously only appeared in the invoice flow now works for cash, card, check, and bank transfer too. A new Marina > Fee Report page aggregates fee revenue with breakdowns by fee, method, and day (CSV export included).
The Fleet page used to show both marina-owned rental assets and customer-owned boats stored at the marina in one undifferentiated list. Vessels now carry an ownerType flag (fleet/customer) plus an explicit customerId link. The Fleet tab shows only marina-owned assets by default; a new Customer Vessels tab shows customer-owned boats; an All tab keeps the combined view for reporting. Creation paths from the onboarding wizard and launch intake auto-classify new vessels as customer-owned so they never clutter Fleet again. A one-shot migration script reclassifies existing records and deletes the 'TBD — Pending customer info' stubs the old wizard left orphaned.
Closed the three remaining gaps in Stripe's Terminal go-live checklist. ConnectionTokens are now location-scoped from the paired device's JWT so a token for one site can't drive readers at another. Every Terminal transaction auto-captures the Stripe charge receipt URL + id onto Transaction.payments[].stripe for chargeback dispute defense. A new daily 03:00 UTC reconciliation job scans each tenant's Terminal PaymentIntents from the last 14 days, flags stuck (has transaction row) vs orphan (no transaction row) records, and surfaces them via a new POST /api/terminal/reconcile endpoint — detects collected-but-unsaved charges before they auto-void.
Every Stripe SDK instance is now built through a single factory (`stripeClientFactory`) that pins the API version platform-wide (`2026-02-25.clover`) and resolves direct-vs-Connect keys in one place. Consolidated ~55 scattered `require('stripe')(secretKey)` call sites, making SDK upgrades and API version bumps low-risk. Also bumps the Stripe Node SDK from v14 to v22.
Deleting a TerminalDevice now also unregisters its Stripe reader so the hardware returns to the registration screen. When a reader gets stuck (e.g. device deleted before Stripe unregistered), the new orphan endpoints surface a portal banner listing the stuck readers with an Unpair button — single click to release all of them.
`/marina-booking/
Register Stripe-certified hardware (WisePOS E, Stripe S700, BBPOS WisePad 3 / Chipper 2X, Verifone P400) directly from the portal using the 3-word code shown on the device, and route POS checkouts to the reader via stripe.terminal.readers.processPaymentIntent. Runs alongside the existing TendPOS Tap to Pay app pairing — both flows share the same TerminalDevice list.
Tri-state control over whether Connect destination-charge refunds also return the platform's application fee to the customer. Global default lives in Admin super-admin settings; each tenant can override (Inherit / Refund fee / Keep fee) from the Admin portal tenant detail page. Applied automatically by every refund route through paymentGatewayService.resolveRefundApplicationFeePolicy.
Clicking any event in the marina calendar opens a detail modal with inline Start / Reschedule / Cancel / Refund / Email Customer / Complete actions scoped to the booking's type and status. Cancel prompts to also refund when the booking has a paid balance; refunds return to the customer's original card automatically via Stripe.
Starting a public-booked launch from the calendar opens the existing 4-step launch wizard with vessel, customer, and fees pre-filled. Payments recorded on the launch roll onto the booking so the calendar's Total / Paid / Amount due stays in sync. LaunchRecord and StorageRetrieval now carry bi-directional references.
Calendar, Launch Queue, and Boat Rentals collapsed into a single Bookings entry with tabbed views. Each sub-page lazy-mounts on first click; the last-viewed tab persists across reloads.
Atlas primary elections and transient DB disconnects now produce fast 503 responses with a customer-facing 'Reconnecting…' page instead of 10–30 second hangs and opaque 500s. New /health/liveness and /health/readiness split the liveness probe (never hits DB) from the readiness probe (503 when disconnected). SystemSettings has stale-cache fallback so maintenance / payment config keep working through brief outages.
Every outgoing transactional email (booking confirmation / modification / cancellation, mooring invoices, trial, receipt, team-invite, usage warnings) now renders cleanly on phones. A shared responsive CSS block is injected at send time; no per-template changes required. Full-width CTA buttons with 44px+ tap targets, scaled headings, tightened padding under 600px.
Calendar day / week / month views now align on UTC calendar days (the same unit bookings are stored in) so an event scheduled for May 1 appears on May 1 for every viewer regardless of timezone. Public booking pages show clean 409 errors instead of opaque 500s when a slot is unavailable; the customer portal no longer produces a 401 console noise when session tokens go stale.
Tenant and POS staff can now manage customer-booked launches, haul-outs, and slip reservations end to end: reschedule with capacity validation, issue full or partial Stripe refunds, and resend confirmation / modification / cancellation emails. New tenant Launch Queue page shows today's bookings with one-tap start / complete / pay. POS gains a dedicated touch-friendly launch check-in view.
Shared FormatUtils helpers (browser + server) replace ad-hoc string transforms everywhere. Snake_case enums, ALL-CAPS badges, raw phone digits, and UTC-midnight dates are now rendered consistently as sentence case, (xxx) xxx-xxxx, and timezone-safe calendar dates across customer booking pages, tenant portal, admin dashboard, and transactional emails.
The customer booking config endpoint now returns the correct Stripe publishable key using three-tier precedence (tenant direct > Connect > empty) so Elements initializes against a real account. Scheduling-service conflicts (slot full, closed day, blocked date) return a 409 with a clear, customer-safe message instead of an opaque 500.
Pin a specific product variant (e.g., size tier) for each marina service type — launch, haul-out, transient slip. The configured product/variant drives both the customer-facing booking quote and post-payment transaction line items, with legacy launch-category service fees replaced by the product line.
Onboarding payment fees now create Transaction records for sales/tax/commission reporting. Fee revenue aggregation endpoint with breakdowns by fee name, payment method, and day. Configurable fee product linkage and per-fee tax handling.
Dynamic tenant-configurable payment methods with ad-hoc flat/percentage fees, drag-and-drop step reordering, session-level fee management, and inline invoice payment method configuration.
Staff members can view their employment type and dates, and request start/end date changes with manager approval workflow. Supports temporary, seasonal, and contractor employment types.
Comprehensive availability system with recurring weekly patterns, date-specific exceptions, and seasonal availability. Dynamically configurable by tenant managers.
Progressive Web App support for the Staff Portal with offline fallback, service worker caching, push notifications, security headers (HSTS, CSP, XSS protection), and environment-aware CORS.
Multi-transport printing for native POS — Bluetooth, Network/WiFi, AirPrint, Star Micronics, and Epson support with ESC/POS command library.
Live POS modal showing real-time terminal status during customer interactions — tipping, card tap, receipt selection with step-by-step updates.
Customizable idle screen with business name, logo, colors, and digital signage playlist integration.
POS checks live inventory from API before adding items to cart. Hard blocks when stock is zero and negative stock is disabled.
Products only appear at locations they are explicitly assigned to. Fixes across tenant portal and POS.
Real-time connection indicator in POS header shows terminal status with color-coded dot and text.
Live customer-facing cart on Terminal app showing items, modifiers, and totals as they are scanned at the POS. Replaces traditional pole displays.
Tip selection screen on Terminal app with preset percentages (15/18/20/25%), custom amount entry, and no-tip option. Integrates with POS transaction totals.
Post-payment receipt selection on Terminal app. Customers choose Email, SMS, Print, or None with 15-second auto-dismiss timeout.
Optional post-purchase satisfaction survey on Terminal app with 1-5 emoji ratings and feedback categories (speed, friendliness, cleanliness, quality, value).
Terminal app displays rotating signage content and promotional media during idle state. Supports images, videos, and loyalty QR codes.
Socket.IO real-time payment routing between web POS and Terminal apps. Instant payment request delivery and collection confirmations.
Dedicated Tap to Pay reader app for iPhone/Android. Pairs with terminal devices, receives payment requests, processes NFC card taps.
Assign default payment terminals to POS devices. Select terminal when opening register, switch mid-session from POS header.
Auto-generate add/remove/extra modifiers from recipe ingredients. Customers can say 'no croutons, extra cheese, add chicken' on POS and online ordering with NLP support.
Universal customer login/register for public-facing apps. Integrated into marina booking with vessel management, session persistence, and welcome-back auto-fill.
Unified scheduling calendar for marina operations — launches, haul-outs, and transient slip reservations with capacity management, availability checking, and multi-view calendar (day/week/month).
GPS-based geofencing for clock-in verification with configurable enforcement modes (warning, block, audit). Staff Portal clock-in can be enabled/disabled per tenant.
Override scheduling settings (time clock, geofencing, shift swaps, overtime, breaks) per location. Undefined fields inherit tenant defaults.
Tenant-level and per-location shift swap configuration: enable/disable swaps, require manager approval, allow giveaways/pickups, minimum advance notice.
Auto-calculate employee commissions on transactions with approval workflow, bulk payment processing, and Staff Portal earnings view.
Employee tip visibility with aggregated summaries, daily breakdowns, averages, and manager team reports in the Staff Portal.
Configurable employee discount rules with percentage or fixed amounts, clock-in requirements, category restrictions, and per-transaction caps.
Employee self-service portal for viewing schedules, clocking in/out, requesting time off, and swapping shifts. Runs as a dedicated app on port 3006 with mobile-first responsive design.
Bottom sheet for selecting product modifiers (add-ons, customizations) in the native POS app, matching the web POS flow. Supports single, multiple, quantity, and freeform modifier types.
Create, target, schedule, and track email marketing campaigns with reusable templates, audience segmentation, open/click tracking, A/B testing, and AI-powered content generation.
Full double-entry bookkeeping with chart of accounts, journal entries, accounting periods, auto-posting from POS transactions/invoices/purchase orders, financial reports (trial balance, income statement, balance sheet), and bank reconciliation.
Customer-facing AI chatbot for order inquiries, product recommendations, support, and FAQ handling. Hybrid REST + Socket.IO architecture with real-time messaging, guest/authenticated customer support, human escalation workflow, and embeddable chat widget.
Comprehensive e-commerce platform with customer portal (accounts, saved addresses, payment methods, order history), multi-carrier shipping (USPS, FedEx, UPS with rate calculation and label printing), marketplace sync (Shopify and WooCommerce bidirectional product/inventory/order sync), and customer-facing storefront PWA.
Self-service customer accounts with JWT authentication, saved addresses, Stripe payment method storage via SetupIntent, order history with reorder functionality, and customer-specific middleware for public routes.
Multi-carrier shipping with plugin architecture supporting USPS, FedEx, and UPS. Features shipping zones with rate rules, free shipping thresholds, shipment tracking with carrier events, and label generation.
Bidirectional sync with Shopify (GraphQL API, OAuth) and WooCommerce (REST API). Supports product/inventory/order sync, ID mapping for audit trails, webhook handlers for real-time updates, and location mapping.
Comprehensive POS hardware support via QZ Tray. Connect receipt printers (ESC/POS), cash drawers, barcode scanners, weighing scales, and label printers. Automatic receipt printing, drawer opening on cash payments, and barcode-driven product lookup.
Drag-and-drop dashboard widget arrangement with user preferences persistence. Hide/show widgets, rearrange layout, and reset to defaults. Preferences saved per-user for personalized admin experience.
Automate report delivery on daily, weekly, or monthly schedules. Configure recipients, delivery time, and frequency. HTML-formatted emails with report data and direct links to the Admin portal.
Six new visualization options in Report Builder: horizontal bar, stacked bar, donut, scatter, radar, and polar area charts. Enhanced data analysis with chart-specific configurations and constraints.
Live updating dashboard metrics via WebSocket. Automatic refresh when transactions complete with debounced updates, connection status indicator, delta updates to minimize bandwidth, and toast notifications for new transactions.
Unified AI business intelligence dashboard in Admin portal. Features four tabs: Daily Briefings with executive summaries and priorities, Sales Forecasts with confidence bands and product demand predictions, Customer Insights with churn risk distribution and RFM segmentation charts, and Anomaly Detection with severity-based alerts and suggested actions.
Drag-and-drop report creation with configurable metrics (revenue, transactions, AOV, items sold, tax, tips, discounts), dimensions (date, product, category, staff, location), multiple visualization types (table, bar, line, pie, area), and saved reports. Export to CSV supported.
Set business targets, track progress, and receive alerts when goals fall behind. Support for revenue, transactions, average order value, items sold, and new customer goals with hourly automatic progress updates.
Comprehensive push notification system across all TendPOS apps. Supports Web Push, FCM (Android), and APNs (iOS). Notification types include order updates, inventory alerts, staff messages, and system alerts. Features customizable templates, quiet hours, delivery analytics, and per-user preferences.
Progressive Web App support across all TendPOS applications. POS terminals can process transactions offline with automatic sync. KDS displays graceful offline state with auto-reconnect. All apps installable to home screen.
AI-powered customer analytics with RFM segmentation, churn prediction, customer lifetime value (CLV) calculation, engagement scoring, and actionable recommendations. Includes 11 RFM segments from Champions to Lost customers.
Complete digital signage solution with content management, playlists, multi-zone layouts, device registration, live data widgets, and analytics. Supports menu boards, promotions, and vertical-specific content.
37 customization options including email/SMS delivery, barcodes, QR codes, and multi-language support.
Complete tenant isolation with seamless login, multi-vertical support for Retail, Restaurant, and Marina.
Twilio-powered SMS, voice calling, push-to-talk, and webhook integrations for team communication.
Integrated payment processing with support for cash, card, house accounts, and split payments.
Comprehensive activity tracking with filtering, search, and dual-view modes for compliance and security.
Complete OpenAPI 3.0 specification with interactive Swagger UI for developers.
76 hyper-granular tax categories with AI auto-suggestion and jurisdiction-specific taxability research.
Complete US tax rate coverage with zero TaxJar API dependency. All 50 states covered via free state data: 7 individual state providers (CA, TX, FL, NY, WA, IL, PA), 3 regional providers (Southeast, Midwest, West), uniform rate states (9), and no-sales-tax states (5). Intelligent caching with Redis/MongoDB.
Multi-provider AI integration (Gemini, OpenAI, Anthropic, Groq) for automated descriptions and data enrichment.
Comprehensive label printing with visual template editor, QZ Tray integration for thermal printers, browser print fallback, default templates for all label types, auto-print rules, and print history.
11 discount types (percentage, fixed, BOGO, tiered, bundle, happy hour, etc.), coupon system with gift cards, bulk generation, auto-apply promotions, stacking rules, and comprehensive analytics.
Full/partial refunds, exchanges, store credit tracking with unique codes, manager approval workflow, restocking fees, and comprehensive return analytics.
Visual table layout, status tracking (available, occupied, reserved, cleaning), server assignment, split bills, reservations, wait lists, and floor plan management.
Real-time order display, prep timing, course management with fire controls, multiple station routing, expo view, bump functionality, priority orders, and kitchen analytics.
Points-based rewards with detailed history tracking, tiered memberships, birthday rewards, referral bonuses, point expiration, member exclusives, and comprehensive loyalty analytics.
Comprehensive vendor profiles with contact management, certifications tracking, payment terms, performance metrics, lead time tracking, and purchase history analytics.
Complete PO workflow with AI-powered invoice scanning, automatic product matching, multi-location receiving, receiving history, payment tracking, and vendor integration.
Real-time stock tracking, low stock alerts, reorder points, stock adjustments, inventory counts, cost tracking, and inventory valuation reports.
Simplified subscription management with feature bundles. Groups 47 features into logical bundles (core, vertical, addon). Auto-includes vertical-specific features, vertical-aware registration, and migration from legacy feature flags.
AI-powered product modifier system with vertical-based templates, natural language parsing for orders ('extra hot with oat milk'), and variant-specific pricing matrix for food service verticals.
Complete back-of-house recipe system with ingredient costing, component batch tracking (FIFO expiration), recipe scaling, product-recipe linking for margin analysis, auto inventory deduction on sale, and ecosystem publishing.
Location-specific receipt templates, cash tendered tracking with change calculation, tip display, base price display for modifier items, freeform modifier text values, and modifier price alignment.
Tenant modifier groups with freeform text entry, quantity modifiers, variant-specific pricing matrix, AI natural language parsing, quick presets, and product-level overrides.
Enterprise-grade variant management with structured options (size, color, material), automatic variant generation, conditional dependencies, adaptive POS display, per-location inventory tracking, matrix editing, and admin template management.
Track variant inventory separately per business location with automated low stock alerts, inter-location transfers, location-specific reorder policies, transfer history, and per-location inventory reports.
ML-powered demand prediction with confidence intervals, optimal reorder point calculation, anomaly detection (spikes, drops, stockout risks), natural language business insights, and weekly proactive forecast generation.
Mooring availability calendar, seasonal pricing, utility tracking, reservations, and weather alerts.
AI-powered business insights, daily briefings, anomaly detection, natural language Q&A, and actionable recommendations for owners.
Real-time event notifications via HTTP callbacks for third-party integrations. Subscribe to transaction, order, inventory, customer, and product events with HMAC signature verification and automatic retries.
Comprehensive security management for enterprise customers: audit logging with 90-day retention, IP whitelist enforcement (allowlist/blocklist modes), mandatory 2FA by role with grace periods, account lockout after failed attempts, login history tracking, and security dashboard.
Customer waitlist for mooring availability with priority scoring, offer/accept/decline workflow, automatic matching when moorings become available, and conversion to reservations or agreements.
Complete fuel dock operations: fuel products with pricing history, tank inventory tracking with low-level alerts, pump meter management, fuel sales processing, delivery receiving, and fuel reports.
Indoor/outdoor boat storage with unit management, storage agreements, vessel retrieval scheduling, launch/return workflow, and integration with launch services.
Boat repair and maintenance work order management with technician assignments, time tracking, parts and labor line items, customer authorization, status workflow, and invoice generation.
Complete salon and spa management: appointment booking with calendar view, service catalog with add-ons and pricing, staff scheduling with PTO management, client profiles with preferences and color formula history, and commission tracking.
Complete automotive shop management: work orders with status workflow, vehicle tracking with VIN decoding, multi-point inspections with pass/fail/marginal statuses, service types with canned line items, technician assignment and workload tracking, parts and labor line items, and customer authorization workflow.
Complete property management solution: properties and units with occupancy tracking, tenant applications with approval workflow, lease management with renewals and terminations, rent collection with late fee tracking and bill generation, maintenance requests with priority and assignment workflow, and move-in/out inspections with condition reporting and deposit deductions.
Complete fitness facility management: membership plans with flexible pricing and benefits, member subscriptions with freeze/cancel/renew workflows, fitness class types with categories and capacity, weekly class scheduling with instructor assignment, class bookings with waitlist and check-in, facility access control with scan/manual check-in, and trainer profiles with certifications and ratings.
Complete online ordering for restaurants, cafes, and retail: public storefront API with location-specific slugs, tenant/location settings inheritance model, cart management with Redis caching, checkout with guest support, order workflow (pending/confirmed/preparing/ready/delivered), real-time Socket.IO updates, delivery zones with fees and minimums, order scheduling, order throttling, and KDS/transaction integration.
Customer-facing appointment scheduling for service verticals: public booking page with subdomain/slug resolution, multi-step booking flow (services → staff → date/time → details → confirm), staff availability and schedule integration, Redis-backed booking cart with 30-min TTL, guest checkout with access token tracking, configurable booking rules (advance days, minimum notice, same-day cutoff), deposit collection support, and email/SMS notifications.
Automated monitoring and notification system for tax rate changes across all 50 states: sync session management, rate comparison with previous/new values, change type detection (increase, decrease, new), insignificant change filtering, batch persistence to database, change history tracking with date filtering, and email notifications to affected tenants.
Enhanced POS terminal promotion experience: quick-select promo buttons with visual grid display, location and vertical-aware promotion filtering, real-time applied discount tracking, combined quick-select and manual code entry modal, promotion value formatting for all 11 types (percentage, fixed, BOGO, bundle, tiered, etc.), and seamless cart integration.
Full contract lifecycle management with templates, clauses, digital signatures, and automated renewals.
Tenants can process payments directly through their own Stripe account with admin approval, bypassing Stripe Connect platform fees.
Customers can reschedule, update vessel info, or cancel marina bookings via token-secured links. Automated email confirmations for all booking lifecycle events.
Track payouts per location with bank account management, pending balance monitoring, and per-location payout routing through Stripe.
In-app help center with searchable articles and interactive onboarding checklist that auto-detects setup progress for new tenants.
Per-location Stripe Connect accounts with independent bank accounts, payout settings, and statement descriptors for multi-location businesses.
Accept contactless card payments on iPhone and Android via Stripe Terminal. Supports Tap to Pay, BBPOS, Verifone, and Stripe Reader hardware.
Process credit and debit card payments directly from the POS terminal with Stripe Elements card form and real-time payment confirmation.
30-module permission system with consistent CRUD action names matching route authorization. All permissions assignable through the Roles UI.
Guided 8-step assignment flow with resume support, payment-blocking, per-tenant document policy, and CSV bulk import. Available in Admin portal and POS terminal.
In active development for Q1-Q2 2026
Planned for Q3-Q4 2026
Native iOS and Android apps for POS, manager dashboard, and customer loyalty access.
Predict sales trends, seasonal patterns, revenue projections, and growth opportunities using machine learning.
Smart pricing recommendations based on demand, competition analysis, inventory levels, and profit optimization.
2027 and beyond
Machine learning powered analytics and automated recommendations
Hands-free operation with natural language commands
Immersive training modules for staff onboarding
Multi-currency, multi-language, international compliance
We love hearing from our users. Your feedback helps shape the future of TendPOS.