thMenu

Full-parity operator app: orders, KDS, menu/products, inventory, reservations, rooms, finance, marketing, AI

Mirrors the iOS admin feature set; Play Store deployment, Android 8+

Top-banner KPI widget on the KDS tab showing orders-served, avg prep time, and pending count, computed

Assign KDS screens to stations/printers, per-station category/type filtering, device-specific order routing

Daily sales summary, tender breakdown, net sales, tax summary, one-tap EOD close

Orders-per-hour heatmap with category breakdown and peak-hour identification

Enable Lightning/stablecoin (USDC/USDT) settlement with exchange-rate display and payment confirmation

Standalone Apple Watch app for floor staff receiving APNs pushes (waiter_call, bill_request, order_ready

Swipe-to-acknowledge pending calls via idempotency-keyed HTTP PATCH to the resolve endpoint; failed acks

WidgetKit smart-stack complication shows pending count, orders-served, and avg ack latency on the watch face;

Distinct vibration vocabulary

WatchConnectivity relays the bearer token from the paired iPhone admin app, or standalone PIN/QR magic-link

Android-Wear equivalent to the watchOS app: persistent waiter-call/bill/order-ready queue, per-call detail

Shift KPI metrics and a watch-face Tile refreshing every 60s, plus an ongoing-activity indicator while the

Three distinct vibration waveforms per push kind, a vibration-test preview, and a mute-all toggle

Swipe-acknowledge with idempotency-keyed PATCH and a DataStore retry queue + offline-queue review screen

WearableListenerService relays bearer + restaurant_id from the paired Android phone, or standalone QR

Full affiliate dashboard, coupons, earnings, payouts, KYC upload, settings, notifications, deep-link auth;

Mirrors the iOS affiliate app; Hilt DI, multipart KYC upload (kind+meta+image), FCM registration

Generates a platform-specific QR linking to the affiliate's coupon landing page; copyable/shareable and

Token-based ES256 JWT push to Apple for iOS/watchOS staff and affiliate apps; 50-min token cache, dead-token

OAuth2/RS256 Firebase Cloud Messaging for Android staff and affiliate apps with auto token rotation and

ES256 VAPID-signed Web Push to admin browsers and customers (order-ready); urgency:high, ~10-min TTL

Fans out APNs + FCM + Web Push to all of a profile's registered devices, filters by muted topics, and prunes

Per-platform (iOS/Android/web) token storage with muted-topic preferences and dead-token sweep on expired

Per-topic mute toggles (orders, waiter calls, low-stock, reviews), delivery windows, and quiet hours, synced

Fires on successful customer order POST ("new order from table N, total $X") across native + web

Fires when an order moves to 'ready'; auto-collapses same-order updates

Customer-side VAPID push when their order becomes ready; opt-in on the order-details page

Fires when a customer cancels within the 90-second window

Customer "Call Waiter" fires a per-table push to smartwatch + staff phone + admin web with haptic vocabulary

Customer "Get Bill" fires a per-table push to smartwatch, phone, and web

Push with points amount when an order credits loyalty points

Restaurant-driven promotional push (e.g., happy hour) as a one-off or targeted campaign

AI-predicted 3-day stockout alert, once/day/restaurant when confidence ≥ 50%

Per-restaurant push to owner smartwatch/phone/web on a new booking

High-priority owner push when an AI agent (ChatGPT/Claude) places an order via the MCP bridge

APNs/FCM push with amount when a Wise transfer settles

APNs/FCM + email alert with support escalation on a bounced Wise transfer (AML hold, insufficient balance

5-second D1 polling pushes pending order counts, waiter calls, bill requests, and ready orders to the admin

Free, account-less push for Point-of-Authority alerts; default fallback when POA_EMAIL is unset, with

Resend email + ntfy.sh for survival-critical alerts (backup failure, cron errors, domain expiry)

Loyalty-card barcode refreshes pushed to all devices holding the pass when balance changes

Public-facing digital menu via QR or direct URL with categories, products, and images

Shopping cart for selecting products with modifiers and quantities before payment

Place → pending → confirmed → preparing → ready → served with real-time status updates; server-side canonical

Per-product modifier groups (size, toppings, extras) with per-option price deltas stored as a JSON snapshot

Free-text per-item notes ("no onions") surfaced on the KDS receipt

Customer-visible 25-min prep timer from 'preparing' to 'ready' (target_ready_at), 30s polling, green pulse on

Customer adds/modifies tip after placement, server-capped by tip_max_percent (default 50%)

Customer cancels pending orders within 90s with atomic race-check, loyalty-earn reversal, and shadowban

Admin partial/full refunds tracked cumulatively in refunded_amount_cents with OCC race-guard (409)

Client-generated UUID Idempotency-Key cached 24h; duplicate POSTs return the cached response

UPDATEs filter on prior status/timestamp; 409 on race; atomic retries across orders/refunds/waitlist/sessions

Order total with per-rate tax-breakdown JSON, tax-inclusive vs exclusive, currency snapshot

Customer shares live order status to other phones via the native OS share sheet or clipboard

Splits an order 2–8 ways; each payer sees their portion via a unique link with per-payer payment recording

Real-time SSE/poll order queue with status transitions (pending → confirmed → preparing → ready → served)

Multiple KDS stations per restaurant, each with a 4–6 digit PIN and per-station category filtering

Atomic kitchen transitions with `AND status=<prev>` race-check and optional per-status button labels

All orders grouped by status; drill into items/totals/customer; manual partial refunds, tip adjuster

Staff create orders table → category → product → qty → confirm; idempotency-keyed POST; handles phone/cash

Persistent per-customer tab across multiple orders with running balance and per-item tracking

Raw ESC/POS byte builder (32/42/48/56 char widths) with CP857 Turkish encoding for receipts

Browser transport layer for ESC/POS communication via Web Serial, USB, and Bluetooth

Discover, pair, and test printers with model/width/encoding selection

Specialized ESC/POS kitchen printout: restaurant, table, items, qty, notes, modifiers, elapsed time

Customer-facing thermal receipt: restaurant, table, items, unit price, total, payment method, timestamp

Real-time kitchen wait time shown to customers from current queue depth and historical prep patterns

Atomic inventory decrement on order placement unpublishes products at stock ≤ 0 and pushes an owner alert

Diamond-only room records by number/floor with per-room QR codes for guest ordering

Guest scans the room QR and orders against room_id (mutually exclusive with table_id); receipt prints room #

Room orders collect guest_name, language preference, and optional VIP tier / group code from the PMS

REST + HMAC-SHA256 signed push-pull for room-service: guest check-in/check-out, folio posting/reversal, order

RESTful API for hotel PMS adapters with HMAC-SHA256 + timestamp auth and OpenAPI-codegen support

Admin tab to create/rotate API keys, manage IP allowlist, and scope permissions (rooms:read/write

Daily cron validates connection health and pages POA if an active adapter is silent > 24h (in-room ordering

Hook point for binding hotel/resort OTA bookings to room-service flows

Dedicated full-screen kiosk ordering with simplified cart, payment, and completion for unattended devices;

Register and manage kiosk devices from the developer/integrations surface

Customer checkout sessions + payment intents for agent orders; SCA/3D-Secure, metadata attribution, refund

Restaurant payouts & commission splits (restaurant keeps subtotal share, platform commission); webhook-driven

Manages all plan tiers; subscription lifecycle hooks, trial window, grace period, and tier-downgrade feature

24h idempotency-key cache on Stripe calls + dead-letter queue with daily retry-backoff cron and super-admin

Processes subscription.updated + checkout.session.completed idempotently via a webhook-events table

Client-side tokenization → worker payment with SCA/step-up verification, minor-unit amounts, and receipt URL

One-way Square catalog sync (items, modifiers, categories, taxes) into thMenu, auto-creating products with

OAuth connection syncing menu items, inventory, modifiers; sale relay with locale-aware decimal parsing

02:00 UTC cron fetches each auto-sync POS catalog, transforms to thMenu schema, merges idempotently

Bi-directional sync: thMenu orders pushed to the POS for fulfillment, inventory pulled back

Standards-compliant OAuth2 + PKCE for Square/Lightspeed with refresh-token rotation, family-revoke on

01:00 UTC proactive token rotation before expiry; logs failures to a dead-letter table; weekly reconnect

Every-30-min retry of failed POS syncs from the dead-letter queue with exponential backoff and poison-row

Bitcoin Lightning / USDC / ETH / USDT instant checkout via charge QR codes; webhook-driven order status;

Dynamic loyalty/voucher .pkpass passes with dynamic barcode and annual cert-renewal check cron

JWT-issued dynamic loyalty/voucher passes (Android equivalent of Apple Wallet)

One-click payment via Apple Wallet and Google Pay

Operator toggles for Lightning/stablecoin acceptance and custom payment-gateway configs

View Stripe/Square transactions, refund amounts, payout schedule, and gateway configs

Multi-currency affiliate payouts: transfer quotes, recipients, transfers, webhook status updates, and

Getir Restoran API + OAuth2 client-credentials: menu push to the merchant portal and order pull

Turkish aggregator webhook receiver with aggregator_order_id idempotency and order relay into the KDS

Trendyol Go partner API with webhook-driven order import into the KDS

LLaMA 3.1 8B generates a 2-sentence menu description from name/category/price with sanitized input

Populates nutrition (kcal/fat/carbs/protein/salt), ingredients, and EU-14 allergen whitelist with a 7-day KV

One-prompt full menu structure (categories, products, descriptions, suggested prices, allergens, portions)

Detects duplicate/inactive products, inconsistent naming, typos, and low performers as culling candidates

Analyzes 30-day unit sales/revenue against anonymized cross-restaurant category medians; returns suggested

Suggests seasonal/themed recipes from available ingredients, cuisine, and dietary trends with allergen tags

Generates daily/weekly specials + marketing copy from ingredients, seasonality, and trends, with suggested

Suggests staff shift patterns from historical volume, peak hours, reservations, availability, and labor cost

Context-aware food/beverage translation of names + descriptions to 20 languages, preserving HTML markup

Auto-drafts professional owner replies to Google/Yelp reviews with selectable tone and apology templates for

Generates a 200-word SEO-optimized restaurant bio from cuisine, location, specialties, and founding story

Predicts 7/14/30-day order volume, revenue, and popular items from history, seasonality, and external signals

Cron-generated narrative reports (3–5 paragraphs) comparing YoY/WoW revenue/AOV/top products/funnels with 3–5

Natural-language menu search ("vegetarian pasta?", "what's gluten-free?") returning 3–5 matched products with

Cart-aware 3–5 product suggestions using menu context + cart contents + exclude list, anchored to primary

2–4 complementary items (pairings, add-ons, desserts, beverages, starters) classified by upsell_type from the

Web Speech API → LLaMA parses intent → matches products → returns cart items with ambiguity flags; localized

Pairing suggestions for ordered dishes by flavor profile, cuisine, and wine list, with price tier and

Customers submit dish ideas (name, description, cuisine hint); admin triages by status

Batch review of customer feedback for profanity/spam with bulk delete + flag

Per-restaurant daily caps (500 voice / 200–300 light) shared across recommend/chat/upsells/pairing/voice via

Strips zero-width/bidi/invisible chars, neutralizes injection keywords (ignore/disregard/system/jailbreak)

Cron classifies feedback + Google reviews as positive/neutral/negative/critical with themes

BGE-base-en-v1.5 (768-dim) embeddings power /api/search with daily blog re-embed and keyword fallback

Agent-driven order placement via MCP: start_order_session, place_order, cancel_order, get_order_status

Mints agent_session_id + customer_confirm_url (30-min TTL); checks the restaurant's agent_enabled flag

Atomically inserts order + items, validates products, snapshots currency, decrements stock, auto-86s on zero;

Atomically cancels with ownership + session-TTL checks, OCC race-guard, and loyalty-earn reversal

Polls status + ETA + items; 30s cache; scope orders:read

Inserts a bill_request, triggers admin push, can pre-populate total for split-bill UI

Inserts a waiter_call, triggers admin + smartwatch push with vibration vocabulary; optional note

Public menu schema (no scope) returning categories + products + prices + allergens

Returns loyalty balance + tier + next-tier threshold; scope loyalty:read

Atomically reserves/claims a promo discount, checks max-uses + per-customer limit; scope orders:write

Per-agent-session hourly order rate limit (default 10/hr, per-restaurant override), auto-shadowban after 5

HTML email blasts to subscriber lists with status tracking (draft/queued/sending/sent/failed) and delivery

Reusable branded HTML templates with custom sender name and reply-to

Subscriber list with status (subscribed/unsubscribed/bounced/complained), source tracking, and per-subscriber

Trigger-based multi-step lifecycle emails (signup/first_order/birthday/reservation_complete, Day-1/7/30

Checkout email capture with admin-configured list and one-click unsubscribe

Broadcast campaigns to customer segments (by loyalty tier/purchase history) with coupon bundles, scheduling

Featured menu banners with custom colors, badge text, images, date windows, and sort order

Sticky in-menu banners ("Happy Hour 5-7pm") with custom color/icon/text and scheduled date ranges /

Admin-created codes with percent/fixed discounts, min-order amounts, usage caps, per-customer redemption

Checkout application with server-side validation, usage-cap enforcement, spend-floor check, and per-IP

Points per order with redemption for discounts/rewards; atomic balance-check guards, reward-stock inventory

Customer email/phone account creation with tier-based earning rates and visit history

Bronze/Silver/Gold/Platinum classification by spend/visit thresholds with tier-specific earn rates and redeem

Daily cron auto-promotes tiers based on cumulative 90-day spend; applies bonus boosts and loyalty discounts

12-month expiry with daily 11:00 UTC sweep that writes counter-entries, decrements balance, and notifies

Manual point delta (positive/negative) with optional admin notes for the audit trail

Admin view of all members: email/phone/name, points balance, lifetime points/spend, visit count, last visit

Customer wallet showing lifetime points, balance, tier, earned-this-period, and redeemable rewards inventory

AI generation of social posts, email templates, and promo copy plus customer segmentation/campaign

Monday cron auto-promotes low-stock items to featured status to reduce waste and clear inventory

AI-suggested or manual time-limited specials with a "Today's Special" badge and auto-rotation

Manual flag to highlight/promote menu items, visually emphasized on the customer menu

Customer bookmarks favorite dishes via localStorage with cross-restaurant resolution via an email profile;

Customer date/time-slot booking with party size, guest name/email/phone, and notes; admin day-view calendar

Status transitions (pending → confirmed → seated/no-show/completed) with sortable upcoming/history views

Cancel via confirmation-code link with atomic race-check (status='pending')

Unique per-reservation code for reference, status checking, and cancellation

Customer .ics export with reservation details for calendar import

Admin marks no-show for policy enforcement

Per-restaurant max party size enforced at booking (default 50)

Twilio SMS with party size + time + cancel URL plus a confirmation email

Partial UNIQUE index enforcing one pending/confirmed reservation per (restaurant, table, time-window)

Multiple customers scan the same table QR to form a session (session_token, join_code, host_device_id); host

Self-service queue join (party size, phone, notes) with admin status transitions (waiting → notified →

Twilio SMS when a table becomes available; plus confirmation SMS + email when a slot opens

Estimated wait from party size, table-turnover history, and current queue depth

Real-time KPI cards (24h revenue, order count, AOV, completion rate), 30-day revenue trend, hourly heatmap

Order volume, revenue, AOV, payment-method breakdown, refund tracking, cumulative refund ledger, cancellation

Classifies products A (top ~80% revenue) / B / C from 30-day history with cumulative revenue share, rank

Setup validator: image presence, description completeness, allergen coverage, pricing consistency, featured

Geospatial heatmap of successful QR scans (floor-map overlay with density zones) showing customer origin and

Time-of-day × day-of-week order-volume visualization to identify peaks and slow periods

Daily narrative (DoD/WoW metrics, at-risk customers, top loyalty member, 3 action CTAs) + weekly deep-dive

Admin-set daily/weekly/monthly revenue/order/customer goals with progress visualization and variance analysis

Public endpoint exposing restaurant popularity by hour for customer decision-making

End-of-shift cash & card totals with variance detection, refund summary, pending items, tip column, and

Monthly/quarterly P&L: revenue, tax collected, refunds, net taxable income; downloadable CSV for accountants

Product-level cost-of-goods with automated margin calculation and monthly P&L reporting; recipes link

Every-30-min D1/R2/Supabase latency & availability probe feeding 7/30/90-day trends and the public /status

Owner/admin/manager/kitchen/server/cashier/KDS roles with granular permission gates (view_orders

4–6 digit PIN login for KDS/floor staff with PBKDF2 200k-iter hashing, per-credential 16-byte salt, atomic D1

PIN-based clock-in/out with shift duration, breaks, labor-cost calculation, overtime auto-flag, and KDS token

Recurring/one-off shift calendar with staff assignment, date-range scheduling, per-restaurant timezone

Structured shift-to-shift notes (open orders, issues, incidents, inventory notes) with confirmation and

Daily tip aggregation with per-staff distribution rules, role/shift-based shares, manual override

24-month rolling retention of staff actions (logins, PIN/password changes, permission changes, refunds

5-second poll of waiter calls, bill requests, low-stock, reviews, reservations, allergen incidents, and shift

Customer "Call Waiter" button creates a waiter_calls record and pushes to staff watches + admin web;

Staff view/prioritize/acknowledge calls from dashboard or smartwatch with response-time tracking

Customer "Get Bill" creates a bill_requests record with a closure state machine; bill freeze blocks new

Staff confirm receipt and completion from dashboard or smartwatch

Real-time feed of all actions (order created, refund, staff login, menu edit), searchable and filterable

Configure guest Wi-Fi and social login (Google/Facebook) for customer self-service waiter-call access on the

Per-day-of-week operating hours (with breaks) that disable ordering outside hours, plus a holiday-mode toggle

Full menu CRUD: create/edit/delete items, bulk restock CSV, allergen tagging, tax-rate override, AI nutrition

Product groupings (appetizers/mains/desserts/drinks) with drag-reorder and optional parent nesting

Full product lifecycle: name, description, price, image, availability, prep time, allergens, ingredients

Recipe ingredient list with per-unit COGS and margin % calculation

CSV import/export with POS mapping (Square item ID, Lightspeed SKU) for batch updates

Apply percentage markup/markdown to multiple products with preview before commit

Log manual restocks with quantity and timestamp for inventory reconciliation

Upload multiple product photos (angles, ingredients, prep shots) with a gallery viewer; on-device

Calories, macros, allergens populated by AI or manually, with per-item tax rates

EU-14 allergen list on products; customer allergy input surfaces cart warnings; incident log

Per-product stock tracking with auto-86 at ≤ 0, owner notifications, and availability status

Detailed log of all stock adjustments (reconcile, fulfillment, waste, spoilage, transfers) with reason codes

04:30 UTC 7-day backfill closing D1_MENU stock-decrement vs D1_OPS ledger drift from transient order-POST

AI 14-day stockout forecast (depletion rate + confidence) alerting when days-until-stockout < 3 with

02:30 UTC recompute of product COGS from recipes, detecting margin drops > 10% and surfacing admin alerts

Demand-based price optimization (time-of-day, day-of-week, capacity/surge multipliers) with confidence scores

Multi-rate tax config with per-product overrides and restaurant default, tax-inclusive vs added toggle

Installable customer menu + admin dashboard with Service Worker offline support, network-first mutations

Orders/feedback queued offline and replayed by the Service Worker on reconnect, with an offline indicator and

TR/EN/AR/ES/FR/DE/IT/PT/EL/TH/VI/JA/ZH-Hans/ZH-Hant/KO/RU/NL/SV/PL and more, with Arabic/Hebrew RTL mirroring

System-theme detection + manual toggle persisted to localStorage

Aria labels, semantic HTML, keyboard navigation, focus-visible, and 44×44 touch targets

iOS AASA + Android assetlinks.json route web links into native apps (order/loyalty/feedback), with web

Color picker, font selection, logo/cover, and layout toggle (grid vs list) applied across the menu and web

Upload interior/dish gallery photos with captions for the menu header and landing page

Configurable Instagram/TikTok/Facebook/LinkedIn links on the menu footer with safeHref validation

Guest Wi-Fi SSID + password shown in the menu footer

Pulls Google Business reviews (rating, author, date, AI sentiment) onto the public menu and admin dashboard

Aggregated timeline of thMenu feedback + Google reviews + TripAdvisor stubs with sentiment/source filters and

5★ + category + 280-char message after served, with once-per-order dedup, entity-encoding, and per-IP

All feedback with sentiment chips, date-range and source filtering, and critical-alert push

Customer-submitted dish ideas queued for admin triage with status and admin notes

Customer-facing live chat on the menu app with operator support channel and stored transcripts

Order-ready/cancelled notifications with deep-link back to the order detail; subscription persistence with

Dashboard aggregating loyalty members + reservations + feedback into a searchable contact list with detail

Unified email/phone contact storage deduplicated across orders, reservations, loyalty, and feedback

Flags customers with no visit in 60+ days as churn risk for re-engagement

Arbitrary tags (VIP/regular/one-time) for segmentation

Opt-in per-restaurant-timezone daily email: revenue, orders, tips, top products, feedback rollup, new

Resend HTML email listing products with stock_qty ≤ threshold; 09:00 UTC, idempotency-guarded

Daily email of reorder-needed products with usage-velocity-based quantities and supplier links; 09:30 UTC

Hourly retry (5× exp backoff) of failed order/table_session/feedback webhook deliveries

NULLs the previous webhook signing secret 7 days after rotation to deterministically close the dual-secret

Daily R2 menu-images byte count reconciled against the D1 upload-quota counter to close delete-failure/legacy

Daily DoH CNAME re-resolution flipping is_verified=0 on mismatch to close domain takeover; 03:00 UTC

Daily 04:00 UTC batched retention prune across 16 datasets (orders 6mo, feedback 12mo, idempotency 14d

Records D1/R2/Supabase uptime/latency every 30 min for status trending

Every-30-min CF GraphQL 5xx-rate probe that pages POA and (opt-in) auto-disables via a feature flag on

Reads cron idempotency markers and pages POA if any job is silent > 90 min (cron stopped firing)

Sunday 02:00 UTC AES-256-GCM snapshot of all D1 DBs to R2 (PII tables skipped), with a daily 05:00 UTC

Daily PRAGMA table_info smoke check against EXPECTED schema, routing failures to Sentry

Hourly retry of failed Stripe webhook replays (refund rollbacks, tier downgrades, payout reversals) with

Daily 04:30 UTC snapshot of audit-trail metrics (logins, orders, refunds, privileged/access events) building

Daily 15:00 UTC re-embed of all blog posts (20 locales) into Vectorize for semantic search + RAG fallback

Every-30-min retry of failed demo-lead onboarding emails with exp backoff and super-admin escalation

Daily 14:00 UTC hard-delete of accounts past the 30-day grace period via an erase-tables allowlist with

Daily read-only scan of DSR requests queued > 25 days, paging POA before the 30-day legal deadline

Yearly Jan-1 reminder that annual affiliate-KYC encryption-key rotation is due

Crons claim a unique timestamp slot so re-runs silently skip side effects

Referral system: signup, commission tracking, payouts, 1099, anomaly detection across web-affiliate +

Email/password signup with anti-bot Turnstile, per-IP 24h rate limit (3/day) via daily-salted hash, and

Worker-managed ephemeral OTP (5-min TTL, scope-bound: payout_request/balance_check/kyc_approve) via cookie or

Total earned / pending / available / paid balances, commission rate, tier + referral code (copy), active

Monthly earnings bar chart, anonymized referred-restaurants list, and earnings filtered by status/date range

invoice.paid → resolves attribution → commission = subtotal × tier_rate (net of coupon, tax excluded);

Auto tier-up at 10/50/200 active customers; grandfathered pre-2026-05-30 affiliates stay at 20% lifetime;

Annual commissions split into 12 monthly release slices; refund clawback cancels unreleased slices first

Monthly-plan commissions held 15 days before moving pending → available, with atomic per-affiliate journaling

OTP-gated request (min $50) validating 15-day cooldown AND monthly cap (default 2/mo) atomically, capturing a

Super-admin approval creates a Wise quote/recipient/transfer; webhooks track pending →

Immutable ledger of every balance mutation (commission_released, payout_requested/settled, dormancy_forfeit

Daily 08:00 UTC journal SUM vs balance check flagging drift > $1 to Sentry (no auto-fix)

Daily 08:00 UTC reconciliation of Supabase balance vs D1_OPS canonical sum, logging drift only

Country, US-person flag, tax form, Wise recipient email, legal address, beneficiary name encrypted at rest

W-9/W-8BEN/tax-cert/ID/IBAN-proof upload (5MB, JPEG/PNG/HEIC/PDF), base64 + pgcrypto-encrypted; iOS/Android

Four payout rails with IBAN + SWIFT/BIC + ACH routing + tax ID capture

Daily 13:00 UTC scan flagging US affiliates ≥ $600 YTD for 1099-NEC issuance, idempotent per (affiliate

Tracks 1099 lifecycle (issued/filed/sent_to_irs) with super-admin completion and audit email copy

Scans 6 signal types (coupon-without-click, dup-IP signup, rapid refund, self-purchase, same-IP peer cluster

Opt-in daily auto-suspend of affiliates with unresolved critical anomalies (severity ≥ 80)

Dismiss/suspend/ban with validated resolution enum, resolver UUID + timestamp, race-guard, and audit logging

Monthly scan of affiliates with 0 active customers for 365 days: 30-day notice, then suspend + forfeit unpaid

Suspended affiliate files an appeal; super-admin reviews; RPC resets the 12-month clock on approval; 60-day

Signed POST to the affiliate's URL on commission created/refunded/released with X-thMenu-Signature, 5s

7-day overlap signing with both current + previous secrets (X-thMenu-Signature + -Previous), then cron NULLs

Hourly retry (5× exp backoff) with unreachable endpoints flagged dead_letter for ops inspection

Auto-creates a Stripe promotion code (5% lifetime subscription discount) per affiliate referral link

Per-affiliate daily coupon-claim cap (default 100/day) via atomic UPSERT…WHERE used<cap to prevent oversell;

Registers shares in affiliate_clicks (affiliate_id, coupon_code, timestamp, ip_hash) feeding the conversion

Per-coupon clicks vs conversions (90-day active customers), click-to-conversion rate, attributed revenue, and

Distinct stripe_subscription_id with ≥1 non-clawed-back commission in the last 90 days; drives tier-up

Immutable commission snapshot (id, coupon, amount, status, plan tier/interval, invoice/subscription IDs

Paginated newest-first money-movement rows with operation-aware tone and localized copy

On invoice refund, claws back (refund/original × commission), cancelling future drip slices first; balance

Full clawback on charge.dispute.closed outcome=lost (closed disputes only), journaled separately from refunds

On Wise transfer refund/chargeback/cancel, reverse_affiliate_payout RPC re-credits the ledger

APNs/FCM push for payout processed/failed, tier-up, 1099, and anomaly events with per-kind mute toggles and

Branded banners, email templates, QR codes, and a sales playbook + objection-handling guide stored in R2

Curated promotion best practices, success stories, downloadable assets, and email templates

Forecasts anticipated earnings by month from the drip schedule + pending holds (static projection)

Records every action (profile_id, action, timestamp, daily-salted ip_hash, user_agent) with RLS default-deny

Signup IP hashed with a daily-rotating salt so the same IP doesn't correlate across days; reused by the

Name/email fuzzy match + account-creation proximity between subscription and customer metadata flags

Bearer-authed /api/affiliate/* endpoints: commission state, signup rate checks, OTP create/verify, device

SECURITY DEFINER RPCs (auth.uid()-filtered) returning profile fields and a unified alerts inbox (1099 +

Immutable log of every commission-rate change (auto-tier or admin override) with from/to rate, trigger, and

Magic-link OTP + password sign-in with auto-fill, forgot-password reset, and Turnstile signup

Operator-generated API keys for third-party integrations, rate-limited (60 req/min), with read/write scopes

Operator-defined webhooks for customer events (orders, feedback, reviews) with HMAC-SHA256 signing

Connect Square/Lightspeed/Toast, ESC-POS printer setup + test, kiosk registration, custom webhooks + delivery

OAuth apps revoke their own tokens; client-credentials validation (basic auth + body); refresh-token rotation

Staff log into web-admin via a company OAuth2 provider with PKCE flow

SAML 2.0 SSO with Okta, Azure AD, Google Workspace, and OneLogin via Supabase

Bring a custom domain (menu.myrestaurant.com) with auto-TLS and daily DoH CNAME re-verification to detect

Parent org manages multiple locations under one brand with shared branding and policies

Single account managing 5+ locations with shared billing/staff and location-scoped dashboards

Licensee deploys thMenu under their own brand/logo/domain/colors, removing thMenu branding

Generate printable menu/table/room QR codes as individual or batch PDFs with branding overlay and SRI

Links and status badges for Square, Lightspeed, Stripe, Wise, and Apple/Google Wallet

Operator & customer transactional emails (digests, alerts, payout status, password reset, billing, OTP, trial

SMS for waitlist alerts, reservation confirmations, and staff OTP

Operator configures the Google Review URL + Place lookup (address/hours/rating) with safeHref XSS prevention

Page views and events (order placed, feedback, loyalty redeemed, promo applied, waiter call, bill request)

Conversion pixel for ad ROI (order + affiliate-signup events) with query-param stripping to prevent pixel

TikTok conversion tracking (order + signup events) for restaurant campaigns

Auto-generated, discoverable REST API schema at /openapi.json

Machine-readable platform overview (product, features, pricing, auth) for LLM/AI search engines

Owner login with email/password or passwordless magic link

JWT-based auth for operators, affiliates, and super-admins with magic-link recovery, password reset, and RLS

HMAC-SHA256 signed JWTs for API access and Cloudflare worker middleware

Operators see only their restaurants, affiliates only their commissions/payouts, customers only their own

RFC 6238 authenticator-app 2FA required for super-admin login

Biometric gate for the admin app plus session management

State-changing endpoints require an X-CSRF-Token header verified against a secure cookie

script-src 'self' 'nonce-…' 'strict-dynamic' to prevent inline-script injection

5-min KV-backed per-IP limits (orders 100, staff 10, feedback 20) with fail-closed on sensitive routes

Per-isolate daily-salted SHA-256 IP-hash sliding windows on 14 menu endpoints

Detects repeat cancellations and suspicious IP patterns, silently blocking orders without an error

Flags impossible location changes between order timestamps

Whitelists http(s)/mailto/tel to prevent stored XSS via social_links, logo_url, cover_url, and review links

PBKDF2 200k iterations, per-credential 16-byte salt, transparent legacy re-hash on next login

Atomic UPSERT in pin_failures with a 30-min rotating window

Constant-time HMAC/PIN/Bearer comparison to prevent timing attacks

30-day deletion window from request, JSON data export, and 90-day order-anonymization grace; personal-data

GDPR-equivalent 30-day deletion, DSR, and consent logs with multi-jurisdictional cron logic

Owner-requested deletion with 30-day grace period and cascading PII erase via an allowlist

Tracks opt-in/opt-out for analytics/email/SMS persisted per session

Logs every user action (login, order status change, menu edit, staff delete) with a 90-day searchable archive

Staff log allergen cross-contact/injury/violation reports with photos/timestamp/location; 12mo PII NULL /

Worker + web error/exception logging with sourcemaps; RLS violations, webhook dead-letters, cron failures

Internal product analytics (feature usage, error rates, performance) with distinct user/session tracking

External health checks every 5 min on 5 endpoints with SMS alerts

Incident timeline, component status, and historical uptime at status.thmenu.com, updated via webhook

Customer-controllable-key AES-256-GCM encryption of weekly D1 backups

Yearly rotation of Stripe keys, POS OAuth secrets, and PMS signing keys with grace-period prune

Customizable privacy policy, terms, and in-house policies displayed in the menu footer

Metadata, currency, timezone, tip settings, and operational flags

Self-serve tier upgrade/downgrade, invoice view, and payment-method management

Centralized inbox for orders, refunds, staff alerts, and admin messages with mark-read state

TOTP-gated access to platform settings, affiliate controls, anomaly review, SOC2 evidence, 1099, and payouts

Paginated, searchable (email/name), sortable (status/rate/earnings/created) affiliate list with drill-down

Per-affiliate profile, commissions, payouts, anomalies, 1099; actions to adjust rate, lock/unlock tier

PATCH an individual affiliate's commission rate (bypasses auto-tier), setting auto_tier_locked=TRUE;

PATCH affiliate status (active↔suspended↔banned), preserving the earning ledger; RLS triggers block

Review/approve affiliate payout requests with manual notes and escalation

Review failed Stripe webhook events and manually replay after fixing rollback errors

Runtime zero-deploy toggles (affiliate.auto_tier_enabled, wise_payout_enabled, agent caps, platform toggles)

Affiliate commission defaults, feature flags, and rate-limit tuning with audit-logged writes