Vision Donate

Transform any landscape terminal into an automated giving station. Built on the Vision design system, this high-contrast, card-only donation flow is optimized for speed, allowing patrons to choose a preset amount, optionally cover processing fees, enter a receipt method, and pay in under ten seconds.

Six-Stage Frictionless Flow

Guides donors from a welcoming attract loop to custom or preset amount selection, receipt delivery, secure payment, and a heartfelt thank-you screen.

Fee Coverage Toggle

Allows generous donors to instantly add calculated card-processing fees to their total so 100% of their intended gift goes to the cause.

Built for Accessibility

Features ultra-large touch targets, high contrast, active press feedback, and large-format keypad digits designed for users of all ages and abilities.

Inactivity Watchdog

Automatically resets to the idle attract screen after 60 seconds of inactivity to protect privacy and ensure the kiosk is ready for the next donor.

1. v2.2.0Live
   Sep 14, 2026 · 10:12 PM

   Install-day knobs: cause name, attract copy, logo placement, ask-for-receipt toggle. Theme tokens (font-heading/body), Final mark design-exception. Theme knobs already worked; merchants can now rebrand copy and checkout options without code.

2. v2.1.0
   Sep 9, 2026 · 10:39 PM

   Added a dedicated staff gate interface allowing team members to sign in using their Merchant Hub user profiles and PINs. - Staff picker and masked keypad for entering Merchant Hub PINs - Staff list scoped to current outlet without displaying emails - Automatic timeout to close abandoned staff login screens - Built-in rate limiting and lockout protections on failed PIN entries

3. v2.0.0
   Sep 9, 2026 · 3:05 PM

   Rework for command-frame 0.6.0. MONEY - minorUnits now resolves from getContext (context -> cart entity -> ISO-4217 exponent) with NO literal fallback. The old hardcoded 10^2 was the live path on the amount screen, where the cart is empty: a 0-decimal currency turned a Y1000 preset into a Y100000 charge. - One money scale, not two. A disagreement between the two host-authoritative sources takes the kiosk out of service rather than rendering $25.00 on one screen and $2500 on the next. - An unrecognised currency code now refuses service instead of assuming 2 decimals. - Formatting uses the host's thousandSeparator, decimalSeparator and currencyPrefix/Suffix; a figure is never left unlabelled. - Removed a round2() that truncated 3-decimal currencies (1.234 -> 1.23). - Every cart mutation's success is checked. A host answering {success:false} to addCartFee previously let a donor consent to $26.03 while the host was tendered 2500. - QUOTE INVARIANT: the built cart is verified against the quote, and the tender is refused unless the balance due equals the figure the donor was shown. PAYMENT AND DECLINE - Success gates on saleFinalized, so a partial capture no longer shows "Thank you". - Any unfinished tender attempts voidOrder and reports from its outcome. Three honest decline states replace one message that claimed "No charge was made" on three different code paths, two of which could not know that. - An ordinary decline is now recognised from the host's own report without calling voidOrder at all. - Retry rebuilds the cart and genuinely re-fires; a ref latch and attempt counter close a double-charge window. - The unconfirmed-decline screen has no donor controls and is excluded from the idle watchdog, so an abandoned kiosk cannot self-reset over a possible charge. STAFF AUTH - Removed the invented PIN entirely (a plaintext column in a station-syncing table with a '1234' fallback, then the same idea in the secrets vault). The gate is now Final's own authenticateUser credential challenge; this app never sees, stores or compares a PIN. AVAILABILITY - Every host call has a deadline in one place. Three separate hangs each used to brick the kiosk with no visible fault. - The payment screen gained a staff door once a card read is overdue; it previously had no exit for anybody. - A journey token stops an abandoned donation writing to the screen or the host cart. THEME AND QA - Deleted the :root token override; the Vision palette comes from the theme knobs. bg-scrim, rounded-control, brand-mark fills untouched. - Stable data-test attributes throughout, plus a stage anchor on the root. Verified across five independent adversarial rounds. Device QA has never run - see manifest.md for the publish blockers, chiefly addCustomSale's unstated price unit.</changelog>

4. v1.2.0
   Sep 8, 2026 · 3:39 PM

   Upgraded payment processing reliability, staff authentication, and donor flow states. - Added specific decline screens and an out-of-service state for unknown currencies - Introduced secure PIN enrollment and lockout screens for staff access - Prevented duplicate charges with stricter tender completion and voiding controls - Added offline checks before attempting to send digital donation receipts

5. v1.1.1
   Aug 13, 2026 · 5:56 PM

   Republished v1.1.1 with no functional changes.