DineGlobe

Register

Not submitted yet.

Sign in with credentials

Not submitted yet.

Request a one-time token

Not submitted yet.

Consume a token

Not submitted yet.

Sign in (issues a session)

Not submitted yet.

Check a session

Not submitted yet.

Revoke a session

Not submitted yet.

Create an organization

Not submitted yet.

Assign a membership

Not submitted yet.

Remove a membership

Not submitted yet.

Transfer ownership

Not submitted yet.

Invite staff by email

Not submitted yet.

Accept an invitation

Not submitted yet.

Change a member's role

Not submitted yet.

Create a venue (born DRAFT, private)

Not submitted yet.

Rename the public address

Not submitted yet.

Resolve a public address (no session)

Not submitted yet.

Upload an image (quarantined, re-encoded)

Not submitted yet.

Authorized download

Not submitted yet.

Retention cleanup

Not submitted yet.

Request publication review

Not submitted yet.

Public profile (no session)

Not submitted yet.

Sitemap (published venues only)

Not submitted yet.

Save an area

Not submitted yet.

Save a resource

Not submitted yet.

Place a resource (list layout editor)

Not submitted yet.

Read the layout (list view)

Not submitted yet.

Save a combination

Not submitted yet.

List combinations

Not submitted yet.

Save an offering

Not submitted yet.

List offerings

Not submitted yet.

Publish the complete weekly set

Full-set publish: rows keeping their scheduleId update, rows without one are created, rows absent from the array are removed.

Not submitted yet.

List published schedules

Not submitted yet.

Save a date exception

Not submitted yet.

Resolve a venue day (slot preview)

Not submitted yet.

Publish a policy version

Immutable once published — edit by retiring and publishing again. Deposits are configuration only; nothing is charged in V1.

Not submitted yet.

List policy versions

Not submitted yet.

Retire a version

Not submitted yet.

Resolve policy + cancellation preview

The exact server-side pair the booking flow will run: resolve the most specific active rule for a candidate booking, then quote its cancellation at a chosen instant.

Not submitted yet.

Read advisory availability

Not submitted yet.

Select the best physical fit

Not submitted yet.

Book (free instant or request)

Attempt 460370ca… key 9a390cd5… (regenerates on “New attempt”; the same key replays the same booking)

Not submitted yet.

Approve or decline a pending request

Submit requests in the DEV-019 panel first. Approval re-runs the full availability checks — a sold slot conflicts honestly (the request stays pending for a decline).

Not submitted yet.

Expire overdue requests (one venue)

A request expires at the earlier of its 24h review deadline and service start; the binding side is the recorded reason. Replaying the sweep expires nothing twice. (The outbox worker owns the schedule from DEV-029.)

Not submitted yet.

Book through the DEV-019 panel first. The edit replaces the old/new allocation in one transaction; any failure leaves the original booking exactly as it was.

Not submitted yet.

Cancels on the ACCEPTED policy snapshot; the quote rides the booking.cancelled event as the refund-intent payload. Retrying the same request key replays the same outcome.

Not submitted yet.

Marks a confirmed booking a no-show only once the ACCEPTED policy grace window has elapsed; the allocation is released, actual table occupancy is not.

Not submitted yet.

Reconfirmation request — stamps the first request and queues a booking.reminder event at the new version.

Not submitted yet.

Records the guest reconfirmation (staff-entered until capability sessions, DEV-023) — requires a prior request.

Not submitted yet.

Issue a management link (rotates!)

Not submitted yet.

Exchange a fragment (one-time)

Not submitted yet.

Request access by email + code

Not submitted yet.

Not submitted yet.

Not submitted yet.

Not submitted yet.

Phone / walk-in booking

Not submitted yet.

Move party to another table

Not submitted yet.

Issue / rotate a check-in pass

Host and above. Rotates: the issued pass is the only live one.

Not submitted yet.

Scanner — scan and commit arrival

Door and above. Manual fallback: the DEV-024 arrival form takes the confirmation code and count without a pass.

Not submitted yet.

Join the queue (public)

Not submitted yet.

Make a ready offer (host)

Not submitted yet.

Accept an offer (staff or the party's queue session)

Not submitted yet.

Withdraw an offer (host)

Not submitted yet.

Expire overdue offers (host)

Not submitted yet.

Exchange a queue token (one-time)

Not submitted yet.

Delivery outcomes (host)

Not submitted yet.

Retry a failed message (manager)

Not submitted yet.

Preview a template (manager, never sends)

Not submitted yet.

Save reminder settings (manager)

Not submitted yet.

Settings & gate truth (host)

Not submitted yet.

Begin provider-hosted onboarding (owner)

Credentials live with the provider. The URL below is shown once and never stored; the country/route gate runs before any provider call.

Not submitted yet.

Refresh capability truth (owner)

Stores the provider’s account state and states whether a paid offering may be activated. Capability loss and account closure are reported as they are — never papered over.

Not submitted yet.

Start / recover hosted checkout (host+)

The hold and its attempt committed at booking; this only opens the provider’s hosted page. A retry after a timeout recovers the SAME checkout — never a second charge. Payment is confirmed only by provider reconciliation, never by this page or the browser return.

Not submitted yet.

Expire lapsed holds (host+)

Releases expired paid holds under the venue lock: attempt EXPIRED, allocations released, booking.expired queued. Booking mutations run this sweep opportunistically too — an empty sweep is normal.

Not submitted yet.

Ingest a signed event

The webhook endpoint simulator. The signature is verified on the RAW body before anything is parsed or stored; a valid event is stored once — redelivery answers an idempotent DUPLICATE. A stored receipt is PENDING truth: money effects belong to reconciliation.

Not submitted yet.

View inbox (host+)

Newest receipt envelopes for one venue — safe references and processing checkpoints only. The encrypted payloads never leave the database.

Not submitted yet.

Reconcile one attempt

Drains the pending verified events about this attempt into money truth. A live hold becomes CONFIRMED with the guest confirmation; late money after a dead hold schedules a full compensation refund — the booking never resurrects. Replaying a settled attempt is a safe no-op.

Not submitted yet.

Sweep account window

The worker sweep, staff-fired: every pending verified event for the venue live provider account, oldest first. Unknown provider objects land in the FAILED exception queue with their code — nothing is dropped silently.

Not submitted yet.

Refund intent queue (host+)

Demands for money back on this venue bookings — system compensation for late money, and (from DEV-034) staff-initiated refunds with their approval workflow. REQUESTED rows await that workflow; nothing here calls a provider.

Not submitted yet.

Request a refund

Finance/Manager with fresh MFA, against a RECONCILED CAPTURE. The refundable balance (captured net minus settled refunds, open disputes and pending intents) bounds the amount under the venue lock. At/below the configured threshold the intent is born approved; above it (or with no threshold) it awaits an ownership-tier decision.

Not submitted yet.

Decide (ownership tier)

APPROVED releases the intent for execution; DECLINED cancels it. The decision row is immutable evidence and the approver is never the requester — an owner cannot approve their own refund.

Not submitted yet.

Delegation threshold

Owner/ORG_ADMIN only: refunds at/below this amount act on the delegated authority of the requester. Empty means NO threshold — the fail-closed default where every human refund needs a decision.

Not submitted yet.

Run refund sweep

The worker pass, staff-fired: approved and system intents move to the provider under the stable refund key. PENDING stays visibly pending; a hard refusal fails terminally for manual resolution — never a second collection.

Not submitted yet.

Reconcile one refund

Repairs a pending refund from the provider truth: settled means SUCCEEDED with its ledger row (never duplicated); still-pending stays pending with a reconciliation stamp.

Not submitted yet.

Reservation payment status

The money view of one booking: reservation and payment badges are separate, receipts carry the provider effect ids, and a refund pending at the provider reads PENDING — never Refunded.

Not submitted yet.

Finance transactions

Settled ledger rows by TRANSACTION date and currency (never the service date). Totals aggregate per currency only — mixed currencies are never summed. The pending queue lists every unresolved refund demand: awaiting decisions, pending at the provider, and failed escalations.

Not submitted yet.

Guest search

Venue-scoped contact hints: exact email or phone, or a name fragment. Your role decides the projection — service roles see decrypted note categories and tags, Door sees arrival counts only, finance and read-only roles see identity only.

Not submitted yet.

Add a guest note

Bodies are encrypted at rest and audited as field names only. The optional reservation link must belong to this same guest in this venue. Host-or-above write authority required.

Not submitted yet.

Record consent evidence

An explicit staff attestation, appended to the ledger — a change of mind is a new row, never a rewrite. The raw attestation text is hashed; booking is not marketing consent and nothing here grants it implicitly.

Not submitted yet.

Open a privacy case

Staff intake for a venue-guest subject. Leave the verification method empty to record only (RECEIVED) — identity verification is its own stamped act, and a matching email verifies nothing.

Not submitted yet.

Verify a case

The verification act on a RECEIVED case: method, instant and verifier are stamped together — verification proportionate to the data's risk.

Not submitted yet.

Execute a verified deletion

Removes unnecessary PII (service notes, tag assignments, profile contact) while the justified minimum survives by name — financial references, future bookings, consent evidence, the audit trail — and every active hold is explained. Each removal writes an append-only tombstone.

Not submitted yet.

Apply a legal hold

A reason and a future review date are both required — a hold is bounded by law, never a blanket never-delete switch.

Not submitted yet.

Release a hold

An explicit release event stamps released_at; the hold row itself is retained evidence and is never deleted or rewritten.

Not submitted yet.

Approve and run a retention sweep

Approves a venue-scoped schedule version for one data class, then sweeps against it — obligations (future bookings, open refunds) and active holds are held back and counted, never silently deleted.

Not submitted yet.

Reapply the deletion ledger

After a backup restore: every tombstone executed after the checkpoint (the backup's instant) is reasserted before the restored data serves anyone. Idempotent by construction.

Not submitted yet.

Stage an import (the dry run)

Paste the CSV and name which header each canonical field maps to. Rows validate against typed rules and the advisory availability read — conflicts and duplicates become explicit rejected rows. Nothing is booked until the commit below.

Not submitted yet.

Commit a staged import

Every valid row books through the same allocator as live intake — a conflict that appeared since the dry run fails that row with its code; a repeated external id can never become a second booking. Rerunning a completed commit replays its stable summary.

Not submitted yet.

Render a venue export

Future bookings to formula-escaped CSV, encrypted at rest with a bounded download window (24h). The purpose is audited verbatim — an export is a deliberate, attributable act.

Not submitted yet.

Verify an export download

Rechecks the export grant against live membership (never the requester's stored identity) and the expiry window. The panel returns a shape probe only — header and byte count, not the file.

Not submitted yet.

Aggregates only — no guest personal data is queried or returned. The service cohort keys on business dates; the money cohort is a separate settled-transaction window with per-currency totals that are never combined across currencies.

Not submitted yet.

Queue a service-sheet PDF

The PII-bearing floor sheet (guest names, decrypted notes, placements) renders through the bounded text-only PDF writer — no browser, no outbound fetch, no executable structure. Hosts may name the CURRENT venue-local service date only.

Not submitted yet.

Queue a metrics CSV

The DEV-039 aggregates as formula-escaped CSV (every cell rides the DEV-038 escaper). Manager/Finance/Read-only/ownership tier.

Not submitted yet.

Render now (worker simulation)

One tick of the durable worker: renders the QUEUED job into the private artifact tree and performs the guarded QUEUED to READY transition. A replay converges; a permanent failure dead-letters with its code.

Not submitted yet.

Verify an artifact download

Rechecks the kind's permission against live membership (never the stored requester), the host current-service-date bound and the 24h window. Returns a shape probe — name, type, byte count, header — never the bytes.

Not submitted yet.