@curless/hotel-storefront 0.23.2 → 0.24.1

package/dist/legal.js

@@ -1,3 +1,4 @@
+import { FULL_CAPABILITIES } from './backend.js';
 // The pages a directory review asks for, and a guest may actually read.
 //
 // Written from the CONFIG rather than fixed text, for the same reason the tool
@@ -34,10 +35,22 @@ const footer = (config) => {
     <br><a href="./docs">What this does</a> · <a href="./privacy">Privacy</a> · <a href="./terms">Terms</a>
   </div>`;
 };
-/** True while the rooms come from a demonstration file. Said on every page, first. */
-const demoBanner = (config) => config.data.source === 'api'
+/**
+ * Where the rooms come from: a demonstration file, a simulated copy of the
+ * group's system (a test deployment), or the group's own system. Every page
+ * that says who holds a booking asks this, never `data.source` alone - an api
+ * source can be the simulation.
+ */
+const sourceOf = (c) => c.data.source !== 'api' ? 'demo' : c.data.api?.sandbox ? 'sandbox' : 'live';
+/** Said on every page, first, unless the rooms are the group's own. */
+const demoBanner = (config) => sourceOf(config) === 'live'
     ? ''
-    : `<p><strong>This is a demonstration.</strong> The ${esc(config.brand)} properties named here are real, but
+    : sourceOf(config) === 'sandbox'
+        ? `<p><strong>This is a test environment.</strong> It answers from a simulated copy of
+       ${esc(config.brand)}'s booking system, not from ${esc(config.brand)}: the hotels, rates, rooms and fees
+       were invented for testing, and nothing booked through it is a ${esc(config.brand)} reservation.
+       No room is held and no money changes hands.</p>`
+        : `<p><strong>This is a demonstration.</strong> The ${esc(config.brand)} properties named here are real, but
        every rate, room count, add-on price and cancellation fee it answers with was made up for the demo.
        Nothing booked through it reserves a real room, and no money changes hands.</p>`;
 /**
@@ -48,22 +61,40 @@ const demoBanner = (config) => config.data.source === 'api'
  * that say what this connector is are where that belongs - not in a comment in
  * a data file. `operator` is who built it; the brand is not them.
  */
-const marksNotice = (config) => `<h2>Names and pictures</h2>
+const marksNotice = (config) => sourceOf(config) === 'sandbox'
+    ? `<h2>Names</h2>
+   <p>${esc(config.brand)} and the names of its brands belong to ${esc(config.brand)}. They are used here to
+      test a booking connector for ${esc(config.brand)} against a simulated copy of its distribution system,
+      before it is connected to the real one; the hotels shown are invented. This connector is operated by
+      ${esc(config.legal.operator ?? 'Curless')}; it is not ${esc(config.brand)} and does not speak for it.</p>`
+    : sourceOf(config) === 'live'
+        ? `<h2>Names and pictures</h2>
+   <p>${esc(config.brand)}, the names of its properties and the photographs shown on the card belong to
+      ${esc(config.brand)}, and come from its own distribution system. This connector is operated by
+      ${esc(config.legal.operator ?? 'Curless')}, which sells ${esc(config.brand)}'s rooms as a distributor;
+      it is not ${esc(config.brand)}.</p>`
+        : `<h2>Names and pictures</h2>
    <p>${esc(config.brand)}, the names of its properties and the photographs shown on the card belong to
       ${esc(config.brand)}. They are used here to demonstrate a booking connector against the group's real
       property list. This connector is operated by ${esc(config.legal.operator ?? 'Curless')} and is not
       ${esc(config.brand)}, not affiliated with it, and not endorsed by it.</p>`;
-export const docsPage = (config) => shell('What this connector does', config.brand, `<h1>${esc(config.brand)} ${esc(config.naming?.nounPlural ?? 'hotels')}</h1>
+export const docsPage = (config, caps = FULL_CAPABILITIES) => shell('What this connector does', config.brand, `<h1>${esc(config.brand)} ${esc(config.naming?.nounPlural ?? 'hotels')}</h1>
      <p>An MCP connector that lets an AI assistant look up ${esc(config.brand)} properties, price a stay on
-        given nights, put rooms and add-ons into a trip, and ask for those rooms to be held.</p>
+        given nights, put ${caps.extras ? 'rooms and add-ons' : 'rooms'} into a trip, and ${caps.booking === 'pay-at-hotel'
+    ? 'book those rooms, to be paid at the hotel'
+    : 'ask for those rooms to be held'}.</p>
      ${demoBanner(config)}
      <h2>What it can do</h2>
      <ul>
        <li>List the ${esc(config.naming?.nounPlural ?? 'hotels')} in a city — all of them, not a pick.</li>
        <li>Show one property's rooms for specific nights, with the stay total including taxes and fees,
            the cancellation terms, and how many rooms are left.</li>
-       <li>Build a trip of room nights and add-ons, and price it.</li>
-       <li>Request a booking: the rooms are held and a confirmation code is issued.</li>
+       <li>Build a trip of room nights${caps.extras ? ' and add-ons' : ''}, and price it.</li>
+       <li>${sourceOf(config) === 'sandbox'
+    ? 'Book: each stay becomes a reservation in the simulated system, with its own confirmation code.'
+    : caps.booking === 'pay-at-hotel'
+        ? `Book: each stay becomes ${esc(config.brand)}'s own reservation, with its own confirmation code, paid at the hotel.`
+        : 'Request a booking: the rooms are held and a confirmation code is issued.'}</li>
        <li>Show what cancelling would cost before anything is cancelled, then cancel.</li>
        <li>Answer from the property's own published policies.</li>
      </ul>
@@ -77,7 +108,7 @@ export const docsPage = (config) => shell('What this connector does', config.bra
            cancellation fee is shown with the rule it came from.</li>
      </ul>
      ${footer(config)}`);
-export const privacyPage = (config, imageHosts = []) => shell('Privacy', config.brand, `<h1>Privacy</h1>
+export const privacyPage = (config, imageHosts = [], caps = FULL_CAPABILITIES) => shell('Privacy', config.brand, `<h1>Privacy</h1>
      ${demoBanner(config)}
      <h2>What this connector holds</h2>
      <ul>
@@ -87,18 +118,21 @@ export const privacyPage = (config, imageHosts = []) => shell('Privacy', config.
        <li><strong>A booking you request</strong> — the name and email you gave, a phone number if you
            gave one, the room requests (a bed type, a floor, a quiet, connecting or accessible room, an
            early check-in or a late arrival), your arrival time and any note, the dates, rooms and price,
-           and the reason if you give one for cancelling. ${config.data.source === 'api'
-    ? `It is passed to ${esc(config.brand)}, who keep the booking.`
-    : 'In this demonstration it is kept in memory for as long as this process runs, and nothing is written to disk; once there are many, bookings that are over are forgotten first.'}</li>
+           and the reason if you give one for cancelling. ${sourceOf(config) === 'sandbox'
+    ? `In this test environment it is sent to a simulated copy of ${esc(config.brand)}'s system that ${esc(config.legal.operator ?? 'Curless')} runs on the same server - never to ${esc(config.brand)} - and both keep it until 90 days after the check-out date, so that the booking can be found and cancelled from the conversation.`
+    : sourceOf(config) === 'live'
+        ? `It is sent to ${esc(config.brand)}, who make and keep the reservation - the name, the email, the phone number, the dates, the rooms and the requests, which reach the hotel's desk. This connector also keeps a copy on its own server, until 90 days after the check-out date, so that the booking can be found and cancelled from the conversation: ${esc(config.brand)}'s system does not give back the email a booking was made with.`
+        : 'In this demonstration it is kept in memory for as long as this process runs, and nothing is written to disk; once there are many, bookings that are over are forgotten first.'}</li>
        <li><strong>Who can open a booking.</strong> The conversation it was made in — and anyone who
            gives its confirmation code together with the email it was made with, as a front desk would
-           ask. That pair lets the booking be read, changed or cancelled, from another conversation too,
+           ask. That pair lets the booking be read, ${caps.changes ? 'changed ' : ''}or cancelled, from another conversation too,
            so keep them as you would any booking confirmation. The email alone opens nothing.</li>
        <li><strong>A session id</strong>, issued by this connector when the assistant connects. The
-           conversation's trip, bookings and sign-in are filed under it; it identifies a conversation,
+           conversation's trip, bookings${caps.members ? ' and sign-in' : ''} are filed under it; it identifies a conversation,
            not a person, and is never shown in an answer. The card gets a separate random id for the
            trip it is showing, so the card and the conversation reach the same one.</li>
-       <li><strong>A membership sign-in</strong> — the membership number and surname you gave, and the
+       ${caps.members
+    ? `<li><strong>A membership sign-in</strong> — the membership number and surname you gave, and the
            name, tier and points they match — for this conversation, and forgotten two hours after it
            was last used.</li>
        <li><strong>Room preferences you asked to have remembered</strong> — only if you are signed in as a
@@ -106,19 +140,20 @@ export const privacyPage = (config, imageHosts = []) => shell('Privacy', config.
            the kind of room you prefer — a bed type, a floor, a quiet or connecting room — against the
            membership number, and nothing else: never an accessible room (that is asked for on each
            stay that needs it), a note, a name, an email, an arrival time or a card. It comes back the
-           next time that membership signs in, and "forget my preferences" removes it. ${config.data.source === 'api'
-    ? `It is kept on the membership's own profile with ${esc(config.brand)}.`
-    : 'In this demonstration it is kept in memory and does not survive a restart.'}</li>
-       <li><strong>Wrong guesses</strong> — a confirmation code and email, or a membership number and
-           surname, that did not match — counted for a quarter of an hour, so that neither pair can be
+           next time that membership signs in, and "forget my preferences" removes it. ${sourceOf(config) === 'live'
+        ? `It is kept on the membership's own profile with ${esc(config.brand)}.`
+        : 'In this demonstration it is kept in memory and does not survive a restart.'}</li>`
+    : ''}
+       <li><strong>Wrong guesses</strong> — a confirmation code and email${caps.members ? ', or a membership number and surname,' : ''} that did not match — counted for a quarter of an hour, so that neither pair can be
            guessed at. After a few, that kind of lookup waits.</li>
      </ul>
      <h2>What it does not hold</h2>
      <ul>
        <li>No card numbers, and no payment details of any kind — it has nowhere to put them
            and never asks.</li>
-       <li>No account and no password. The only thing kept about you from one conversation to the next
-           is the room preferences above, and only when you asked.</li>
+       <li>No account and no password. ${caps.members
+    ? 'The only thing kept about you from one conversation to the next is the room preferences above, and only when you asked.'
+    : 'Nothing is kept about you from one conversation to the next except a booking you made, as above.'}</li>
        <li>No advertising or analytics identifiers, and nothing is sold or shared.</li>
      </ul>
      ${imageHosts.length
@@ -138,19 +173,25 @@ export const privacyPage = (config, imageHosts = []) => shell('Privacy', config.
     : ''}
      ${marksNotice(config)}
      ${footer(config)}`);
-export const termsPage = (config) => shell('Terms', config.brand, `<h1>Terms</h1>
+export const termsPage = (config, caps = FULL_CAPABILITIES) => shell('Terms', config.brand, `<h1>Terms</h1>
      ${demoBanner(config)}
      <h2>What this is</h2>
      <p>A connector operated by ${esc(config.legal.operator ?? 'Curless')} that an AI assistant uses on
-        your behalf. ${config.data.source === 'api'
-    ? `The rooms, rates and policies come from ${esc(config.brand)}; the booking is between you and them.`
-    : 'The rates and availability it shows are demonstration values and do not reserve anything.'}</p>
+        your behalf. ${sourceOf(config) === 'sandbox'
+    ? 'The hotels, rates and availability it shows come from a simulated booking system, for testing, and do not reserve anything.'
+    : sourceOf(config) === 'live'
+        ? `The rooms, rates and policies come from ${esc(config.brand)}; the booking is between you and them.`
+        : 'The rates and availability it shows are demonstration values and do not reserve anything.'}</p>
      <h2>Bookings</h2>
-     <p>${config.payment?.mode === 'wallet'
-    ? 'A booking is confirmed once payment completes. Until then the rooms are held only.'
-    : 'A booking request holds rooms; it takes no payment and is not a confirmed reservation. The hold lapses at the time stated on the confirmation.'} Cancellation terms are the property's own, and are shown in full before anything is cancelled.</p>
+     <p>${sourceOf(config) === 'sandbox'
+    ? `In this test environment a booking is made in a simulated copy of ${esc(config.brand)}'s system: it reserves no room, and nothing is paid.`
+    : config.payment?.mode === 'wallet'
+        ? 'A booking is confirmed once payment completes. Until then the rooms are held only.'
+        : caps.booking === 'pay-at-hotel'
+            ? `A booking is ${esc(config.brand)}'s own reservation, made in your name and paid at the hotel under its terms; this connector takes no payment. A booking whose confirmation has not come back from ${esc(config.brand)} is said to be waiting until it has.`
+            : 'A booking request holds rooms; it takes no payment and is not a confirmed reservation. The hold lapses at the time stated on the confirmation.'} Cancellation terms are the property's own, and are shown in full before anything is cancelled.</p>
      <h2>No warranty</h2>
-     <p>This connector is provided as is. ${config.data.source === 'api'
+     <p>This connector is provided as is. ${sourceOf(config) === 'live'
     ? 'Rates and availability can change between a quote and a booking.'
     : 'Nothing it shows is a rate anyone can book.'}</p>
      ${marksNotice(config)}

package/dist/legal.js.map

@@ -1 +1 @@
-{"version":3,"file":"legal.js","sourceRoot":"","sources":["../src/legal.ts"],"names":[],"mappings":"AAEA,wEAAwE;AACxE,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,gFAAgF;AAChF,wDAAwD;AAExD,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,KAAa,EAAE,IAAY,EAAU,EAAE,CAAC;;;SAG7D,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;;;;;;;;;;;;;;6BAcN,IAAI;CAChC,CAAC;AAEF,MAAM,GAAG,GAAG,CAAC,CAAU,EAAU,EAAE,CACjC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CACxC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAC/F,CAAC;AAEJ,MAAM,MAAM,GAAG,CAAC,MAAmB,EAAU,EAAE;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,SAAS,CAAC;IACpD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC;IAC7C,OAAO;kBACS,GAAG,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,sBAAsB,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;MACpG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;MAC3D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;;SAEvE,CAAC;AACV,CAAC,CAAC;AAEF,sFAAsF;AACtF,MAAM,UAAU,GAAG,CAAC,MAAmB,EAAU,EAAE,CACjD,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK;IAC1B,CAAC,CAAC,EAAE;IACJ,CAAC,CAAC,oDAAoD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;;uFAEY,CAAC;AAExF;;;;;;;GAOG;AACH,MAAM,WAAW,GAAG,CAAC,MAAmB,EAAU,EAAE,CAClD;QACM,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;QACjB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;qDAC4B,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,SAAS,CAAC;QACpF,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,uDAAuD,CAAC;AAEjF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,MAAmB,EAAU,EAAE,CACtD,KAAK,CACH,0BAA0B,EAC1B,MAAM,CAAC,KAAK,EACZ,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,QAAQ,CAAC;6DACb,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;;OAEvE,UAAU,CAAC,MAAM,CAAC;;;sBAGH,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,QAAQ,CAAC;;;;;;;;;;qBAWvD,MAAM,CAAC,OAAO,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,cAC1E,cACE,MAAM,CAAC,OAAO,EAAE,IAAI,KAAK,QAAQ;IAC/B,CAAC,CAAC,0EAA0E;IAC5E,CAAC,CAAC,+FACN;;;;;OAKA,MAAM,CAAC,MAAM,CAAC,EAAE,CACpB,CAAC;AAEJ,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAmB,EAAE,aAAuB,EAAE,EAAU,EAAE,CACpF,KAAK,CACH,SAAS,EACT,MAAM,CAAC,KAAK,EACZ;OACG,UAAU,CAAC,MAAM,CAAC;;;;;;;;;4DAUZ,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK;IAC1B,CAAC,CAAC,mBAAmB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB;IAC/D,CAAC,CAAC,+KACN;;;;;;;;;;;;;;;;;yFAkBE,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK;IAC1B,CAAC,CAAC,mDAAmD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG;IACzE,CAAC,CAAC,4EACN;;;;;;;;;;;;;OAcJ,UAAU,CAAC,MAAM;IACf,CAAC,CAAC;2EACgE,UAAU;SAC7E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC;SAChE,IAAI,CACH,IAAI,CACL;sEAC8D;IAC7D,CAAC,CAAC,EACN;;;;;OAME,MAAM,CAAC,KAAK,CAAC,YAAY;IACvB,CAAC,CAAC,mEAAmE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;8BACjE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW;IACjG,CAAC,CAAC,EACN;OACE,WAAW,CAAC,MAAM,CAAC;OACnB,MAAM,CAAC,MAAM,CAAC,EAAE,CACpB,CAAC;AAEJ,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAAmB,EAAU,EAAE,CACvD,KAAK,CACH,OAAO,EACP,MAAM,CAAC,KAAK,EACZ;OACG,UAAU,CAAC,MAAM,CAAC;;kCAES,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,SAAS,CAAC;uBAE/D,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK;IAC1B,CAAC,CAAC,2CAA2C,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC;IACtG,CAAC,CAAC,2FACN;;UAGD,MAAM,CAAC,OAAO,EAAE,IAAI,KAAK,QAAQ;IAC/B,CAAC,CAAC,oFAAoF;IACtF,CAAC,CAAC,gJACN;;4CAGE,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK;IAC1B,CAAC,CAAC,kEAAkE;IACpE,CAAC,CAAC,6CACN;OACE,WAAW,CAAC,MAAM,CAAC;OACnB,MAAM,CAAC,MAAM,CAAC,EAAE,CACpB,CAAC"}
+{"version":3,"file":"legal.js","sourceRoot":"","sources":["../src/legal.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAG3E,wEAAwE;AACxE,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,gFAAgF;AAChF,wDAAwD;AAExD,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,KAAa,EAAE,IAAY,EAAU,EAAE,CAAC;;;SAG7D,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;;;;;;;;;;;;;;6BAcN,IAAI;CAChC,CAAC;AAEF,MAAM,GAAG,GAAG,CAAC,CAAU,EAAU,EAAE,CACjC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CACxC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAC/F,CAAC;AAEJ,MAAM,MAAM,GAAG,CAAC,MAAmB,EAAU,EAAE;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,SAAS,CAAC;IACpD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC;IAC7C,OAAO;kBACS,GAAG,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,sBAAsB,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;MACpG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;MAC3D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;;SAEvE,CAAC;AACV,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,QAAQ,GAAG,CAAC,CAAc,EAA+B,EAAE,CAC/D,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;AAE9E,uEAAuE;AACvE,MAAM,UAAU,GAAG,CAAC,MAAmB,EAAU,EAAE,CACjD,QAAQ,CAAC,MAAM,CAAC,KAAK,MAAM;IACzB,CAAC,CAAC,EAAE;IACJ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,SAAS;QAC9B,CAAC,CAAC;SACC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;uEACH,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;uDACjC;QACjD,CAAC,CAAC,oDAAoD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;;uFAEU,CAAC;AAExF;;;;;;;GAOG;AACH,MAAM,WAAW,GAAG,CAAC,MAAmB,EAAU,EAAE,CAClD,QAAQ,CAAC,MAAM,CAAC,KAAK,SAAS;IAC5B,CAAC,CAAC;QACE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;qCAC/C,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;;QAE9C,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,SAAS,CAAC,eAAe,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC;IAC5G,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,MAAM;QAC3B,CAAC,CAAC;QACA,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;QACjB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;QACjB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,SAAS,CAAC,iBAAiB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;kBAC/D,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO;QACpC,CAAC,CAAC;QACA,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;QACjB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;qDAC4B,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,SAAS,CAAC;QACpF,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,uDAAuD,CAAC;AAEjF,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,MAAmB,EACnB,OAA4B,iBAAiB,EACrC,EAAE,CACV,KAAK,CACH,0BAA0B,EAC1B,MAAM,CAAC,KAAK,EACZ,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,QAAQ,CAAC;6DACb,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;4BAClD,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,qBAC7D,IAAI,CAAC,OAAO,KAAK,cAAc;IAC7B,CAAC,CAAC,2CAA2C;IAC7C,CAAC,CAAC,gCACN;OACD,UAAU,CAAC,MAAM,CAAC;;;sBAGH,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,QAAQ,CAAC;;;wCAGxB,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE;aAEhE,QAAQ,CAAC,MAAM,CAAC,KAAK,SAAS;IAC5B,CAAC,CAAC,gGAAgG;IAClG,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,cAAc;QAC/B,CAAC,CAAC,2BAA2B,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,wEAAwE;QACtH,CAAC,CAAC,0EACR;;;;;;qBAOE,MAAM,CAAC,OAAO,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,cAC1E,cACE,MAAM,CAAC,OAAO,EAAE,IAAI,KAAK,QAAQ;IAC/B,CAAC,CAAC,0EAA0E;IAC5E,CAAC,CAAC,+FACN;;;;;OAKA,MAAM,CAAC,MAAM,CAAC,EAAE,CACpB,CAAC;AAEJ,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,MAAmB,EACnB,aAAuB,EAAE,EACzB,OAA4B,iBAAiB,EACrC,EAAE,CACV,KAAK,CACH,SAAS,EACT,MAAM,CAAC,KAAK,EACZ;OACG,UAAU,CAAC,MAAM,CAAC;;;;;;;;;4DAUZ,QAAQ,CAAC,MAAM,CAAC,KAAK,SAAS;IAC5B,CAAC,CAAC,8DAA8D,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,SAAS,CAAC,uCAAuC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,mIAAmI;IACrU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,MAAM;QAC3B,CAAC,CAAC,iBAAiB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,uTAAuT,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,iEAAiE;QAC7a,CAAC,CAAC,+KACR;;;sDAG2C,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;;;0CAG1C,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE;;;SAInE,IAAI,CAAC,OAAO;IACV,CAAC,CAAC;;;;;;;;yFASA,QAAQ,CAAC,MAAM,CAAC,KAAK,MAAM;QACzB,CAAC,CAAC,mDAAmD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG;QACzE,CAAC,CAAC,4EACN,OAAO;IACP,CAAC,CAAC,EACN;2EACoE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC,EAAE;;;;;;;yCAQ7H,IAAI,CAAC,OAAO;IACV,CAAC,CAAC,yHAAyH;IAC3H,CAAC,CAAC,kGACN;;;OAIA,UAAU,CAAC,MAAM;IACf,CAAC,CAAC;2EACgE,UAAU;SAC7E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC;SAChE,IAAI,CACH,IAAI,CACL;sEAC8D;IAC7D,CAAC,CAAC,EACN;;;;;OAME,MAAM,CAAC,KAAK,CAAC,YAAY;IACvB,CAAC,CAAC,mEAAmE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;8BACjE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW;IACjG,CAAC,CAAC,EACN;OACE,WAAW,CAAC,MAAM,CAAC;OACnB,MAAM,CAAC,MAAM,CAAC,EAAE,CACpB,CAAC;AAEJ,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,MAAmB,EACnB,OAA4B,iBAAiB,EACrC,EAAE,CACV,KAAK,CACH,OAAO,EACP,MAAM,CAAC,KAAK,EACZ;OACG,UAAU,CAAC,MAAM,CAAC;;kCAES,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,SAAS,CAAC;uBAE/D,QAAQ,CAAC,MAAM,CAAC,KAAK,SAAS;IAC5B,CAAC,CAAC,6HAA6H;IAC/H,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,MAAM;QAC3B,CAAC,CAAC,2CAA2C,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC;QACtG,CAAC,CAAC,2FACR;;UAGD,QAAQ,CAAC,MAAM,CAAC,KAAK,SAAS;IAC5B,CAAC,CAAC,qEAAqE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,sDAAsD;IAC9I,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,KAAK,QAAQ;QACjC,CAAC,CAAC,oFAAoF;QACtF,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,cAAc;YAC/B,CAAC,CAAC,gBAAgB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,qKAAqK,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC;YAC/P,CAAC,CAAC,gJACV;;4CAGE,QAAQ,CAAC,MAAM,CAAC,KAAK,MAAM;IACzB,CAAC,CAAC,kEAAkE;IACpE,CAAC,CAAC,6CACN;OACE,WAAW,CAAC,MAAM,CAAC;OACnB,MAAM,CAAC,MAAM,CAAC,EAAE,CACpB,CAAC"}

package/dist/lib.d.ts

@@ -16,10 +16,15 @@ export { loadHotelData, parseHotelData } from './data.js';
 export { loadConfig, buildServer, widgetMeta, imageDomainsOf, CARD_URI, CARD_MIME, VERSION, } from './server.js';
 export { createDemoHotels } from './demo-hotels.js';
 export { toolNames } from './config.js';
+export { buildTools, withheldTools } from './tools.js';
 export { resolveBrand, DEMO_NOTE } from './vocab.js';
-export { MAX_PAGE } from './backend.js';
-export type { HotelBackend } from './backend.js';
-export type { HotelConfig, ToolNames } from './config.js';
+export { FULL_CAPABILITIES, MAX_PAGE } from './backend.js';
+export type { BackendCapabilities, HotelBackend } from './backend.js';
+export type { ApiSource, HotelConfig, ToolNames } from './config.js';
+export { HUAZHU_CAPABILITIES, createHuazhuHotels } from './huazhu/backend.js';
+export { checkHuazhu } from './huazhu/check.js';
+export { HuazhuClient, HuazhuRefusal, HuazhuUnreachable } from './huazhu/client.js';
+export { describePolicy, parseCancelPolicy } from './huazhu/cancel-policy.js';
 export type { ResolvedBrand, Vocabulary } from './vocab.js';
 export type { Booking, Extra, Hotel, HotelDetail, HotelPolicy, Identity, Member, Money, Quote, Room, Stay, TripLine, } from './types.js';
 //# sourceMappingURL=lib.d.ts.map

package/dist/lib.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lib.d.ts","sourceRoot":"","sources":["../src/lib.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EACL,UAAU,EACV,WAAW,EACX,UAAU,EACV,cAAc,EACd,QAAQ,EACR,SAAS,EACT,OAAO,GACR,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,YAAY,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC1D,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC5D,YAAY,EACV,OAAO,EACP,KAAK,EACL,KAAK,EACL,WAAW,EACX,WAAW,EACX,QAAQ,EACR,MAAM,EACN,KAAK,EACL,KAAK,EACL,IAAI,EACJ,IAAI,EACJ,QAAQ,GACT,MAAM,YAAY,CAAC"}
+{"version":3,"file":"lib.d.ts","sourceRoot":"","sources":["../src/lib.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EACL,UAAU,EACV,WAAW,EACX,UAAU,EACV,cAAc,EACd,QAAQ,EACR,SAAS,EACT,OAAO,GACR,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC3D,YAAY,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACtE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAErE,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9E,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC5D,YAAY,EACV,OAAO,EACP,KAAK,EACL,KAAK,EACL,WAAW,EACX,WAAW,EACX,QAAQ,EACR,MAAM,EACN,KAAK,EACL,KAAK,EACL,IAAI,EACJ,IAAI,EACJ,QAAQ,GACT,MAAM,YAAY,CAAC"}

package/dist/lib.js

@@ -16,6 +16,13 @@ export { loadHotelData, parseHotelData } from './data.js';
 export { loadConfig, buildServer, widgetMeta, imageDomainsOf, CARD_URI, CARD_MIME, VERSION, } from './server.js';
 export { createDemoHotels } from './demo-hotels.js';
 export { toolNames } from './config.js';
+// What a deployment offers, for a brand repository checking its own config.
+export { buildTools, withheldTools } from './tools.js';
 export { resolveBrand, DEMO_NOTE } from './vocab.js';
-export { MAX_PAGE } from './backend.js';
+export { FULL_CAPABILITIES, MAX_PAGE } from './backend.js';
+// A group's own booking system, for a brand repository's own checks.
+export { HUAZHU_CAPABILITIES, createHuazhuHotels } from './huazhu/backend.js';
+export { checkHuazhu } from './huazhu/check.js';
+export { HuazhuClient, HuazhuRefusal, HuazhuUnreachable } from './huazhu/client.js';
+export { describePolicy, parseCancelPolicy } from './huazhu/cancel-policy.js';
 //# sourceMappingURL=lib.js.map

package/dist/lib.js.map

@@ -1 +1 @@
-{"version":3,"file":"lib.js","sourceRoot":"","sources":["../src/lib.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EACL,UAAU,EACV,WAAW,EACX,UAAU,EACV,cAAc,EACd,QAAQ,EACR,SAAS,EACT,OAAO,GACR,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"lib.js","sourceRoot":"","sources":["../src/lib.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EACL,UAAU,EACV,WAAW,EACX,UAAU,EACV,cAAc,EACd,QAAQ,EACR,SAAS,EACT,OAAO,GACR,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,4EAA4E;AAC5E,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAG3D,qEAAqE;AACrE,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/server.d.ts

@@ -16,7 +16,7 @@ export declare const PROTOCOL_VERSION = "2025-06-18";
  * number. Found by reading the boot banner of a container that had just been
  * deployed (2026-09-22): seventeen tools listed, and "0.7.0" above them.
  */
-export declare const VERSION = "0.23.2";
+export declare const VERSION = "0.24.1";
 /**
  * The card's resource URI.
  *
@@ -25,7 +25,7 @@ export declare const VERSION = "0.23.2";
  * connector went storefront-v35 → v40 in a single day of UI work for exactly
  * this reason.
  */
-export declare const CARD_URI = "ui://curless/hotel/booking-v39.html";
+export declare const CARD_URI = "ui://curless/hotel/booking-v40.html";
 /**
  * ⚠️ `text/html;profile=mcp-app`, not `text/html+skybridge`. The MIME is how a
  * host recognises this resource as a card at all; the plausible near-miss made
@@ -41,10 +41,10 @@ export declare const CARD_MIME = "text/html;profile=mcp-app";
  */
 export declare const UI_META: {
     readonly ui: {
-        readonly resourceUri: "ui://curless/hotel/booking-v39.html";
+        readonly resourceUri: "ui://curless/hotel/booking-v40.html";
     };
-    readonly 'ui/resourceUri': "ui://curless/hotel/booking-v39.html";
-    readonly 'openai/outputTemplate': "ui://curless/hotel/booking-v39.html";
+    readonly 'ui/resourceUri': "ui://curless/hotel/booking-v40.html";
+    readonly 'openai/outputTemplate': "ui://curless/hotel/booking-v40.html";
     readonly 'openai/widgetAccessible': true;
 };
 /**
@@ -63,20 +63,22 @@ export declare const widgetMeta: (imageDomains: string[]) => {
         csp: {
             resourceDomains: string[];
         };
-        resourceUri: "ui://curless/hotel/booking-v39.html";
+        resourceUri: "ui://curless/hotel/booking-v40.html";
     };
     'openai/widgetCSP': {
         connect_domains: never[];
         resource_domains: string[];
     };
-    'ui/resourceUri': "ui://curless/hotel/booking-v39.html";
-    'openai/outputTemplate': "ui://curless/hotel/booking-v39.html";
+    'ui/resourceUri': "ui://curless/hotel/booking-v40.html";
+    'openai/outputTemplate': "ui://curless/hotel/booking-v40.html";
     'openai/widgetAccessible': true;
 };
 /** The trip snapshot that rides beside every answer, for the card's header. */
 export declare const TRIP_META_KEY = "curless/trip";
 export type BuiltServer = {
     app: Hono;
+    /** Settled once there is something to answer with - see `Made.ready`. */
+    ready: () => Promise<void>;
     brand: ResolvedBrand;
     deps: ToolDeps;
     trips: TripStore;
@@ -89,6 +91,16 @@ export type ServerOptions = {
     configPath?: string;
     publicUrl?: string;
     now?: () => number;
+    /** How the group's own API is reached - a test's fake, or the platform's fetch. */
+    fetch?: typeof fetch;
+    /** Where the group's API credentials are read from. Default `process.env`. */
+    env?: Record<string, string | undefined>;
+    /**
+     * The work an API backend does on its own clock: keeping the hotel list
+     * current, and following up bookings whose outcome is not known yet. Off in
+     * tests. Default on.
+     */
+    background?: boolean;
 };
 export declare const buildServer: (opts: ServerOptions) => BuiltServer;
 /**

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgB,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAK/C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAE,KAAK,QAAQ,EAA8C,MAAM,YAAY,CAAC;AACvF,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,SAAS,EAAW,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,KAAK,aAAa,EAAgB,MAAM,YAAY,CAAC;AAS9D,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAC7C;;;;;;;;;GASG;AACH,eAAO,MAAM,OAAO,WAAW,CAAC;AAEhC;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,wCAAwC,CAAC;AAC9D;;;;;GAKG;AACH,eAAO,MAAM,SAAS,8BAA8B,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,OAAO;;;;;;;CAKV,CAAC;AAEX;;;;;;;;;;GAUG;AACH,eAAO,MAAM,UAAU,GAAI,cAAc,MAAM,EAAE;;;;;;;;;;;;;;CAI/C,CAAC;AAEH,+EAA+E;AAC/E,eAAO,MAAM,aAAa,iBAAiB,CAAC;AAE5C,MAAM,MAAM,WAAW,GAAG;IACxB,GAAG,EAAE,IAAI,CAAC;IACV,KAAK,EAAE,aAAa,CAAC;IACrB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,WAAW,CAAC;IACpB,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,CAAC;AAEF,eAAO,MAAM,WAAW,GAAI,MAAM,aAAa,KAAG,WAoQjD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,GACzB,QAAQ;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAAE,EAAE,KAC9D,MAAM,EAIR,CAAC;AAWF,yFAAyF;AACzF,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,KAAG;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAGlF,CAAC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgB,IAAI,EAAE,MAAM,MAAM,CAAC;AAG1C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAS/C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EACL,KAAK,QAAQ,EAKd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,SAAS,EAAW,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,KAAK,aAAa,EAAgB,MAAM,YAAY,CAAC;AAS9D,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAC7C;;;;;;;;;GASG;AACH,eAAO,MAAM,OAAO,WAAW,CAAC;AAEhC;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,wCAAwC,CAAC;AAC9D;;;;;GAKG;AACH,eAAO,MAAM,SAAS,8BAA8B,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,OAAO;;;;;;;CAKV,CAAC;AAEX;;;;;;;;;;GAUG;AACH,eAAO,MAAM,UAAU,GAAI,cAAc,MAAM,EAAE;;;;;;;;;;;;;;CAI/C,CAAC;AAEH,+EAA+E;AAC/E,eAAO,MAAM,aAAa,iBAAiB,CAAC;AAE5C,MAAM,MAAM,WAAW,GAAG;IACxB,GAAG,EAAE,IAAI,CAAC;IACV,yEAAyE;IACzE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,KAAK,EAAE,aAAa,CAAC;IACrB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,WAAW,CAAC;IACpB,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,mFAAmF;IACnF,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,8EAA8E;IAC9E,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAkHF,eAAO,MAAM,WAAW,GAAI,MAAM,aAAa,KAAG,WAsQjD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,GACzB,QAAQ;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAAE,EAAE,KAC9D,MAAM,EAIR,CAAC;AAWF,yFAAyF;AACzF,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,KAAG;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAGlF,CAAC"}

package/dist/server.js

@@ -2,14 +2,19 @@ import { randomUUID } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import { Hono } from 'hono';
+import { FULL_CAPABILITIES } from './backend.js';
 import { HOTEL_CARD_HTML } from './card.generated.js';
 import { loadHotelData } from './data.js';
 import { createDemoHotels } from './demo-hotels.js';
+import { createHuazhuHotels } from './huazhu/backend.js';
+import { BookingStore, Reconciler } from './huazhu/bookings.js';
+import { Catalog } from './huazhu/catalog.js';
+import { HuazhuClient } from './huazhu/client.js';
 import { docsPage, privacyPage, termsPage } from './legal.js';
 import { Misses } from './limits.js';
 import { MemberStore } from './members.js';
 import { buildInstructions, listTools, tripToolNames } from './surface.js';
-import { buildOutputSchemas, buildTools, handleTool } from './tools.js';
+import { buildOutputSchemas, buildTools, handleTool, withheldTools, } from './tools.js';
 import { TripIds } from './trip-ids.js';
 import { TripStore, tripKey } from './trip.js';
 import { resolveBrand } from './vocab.js';
@@ -30,7 +35,7 @@ export const PROTOCOL_VERSION = '2025-06-18';
  * number. Found by reading the boot banner of a container that had just been
  * deployed (2026-09-22): seventeen tools listed, and "0.7.0" above them.
  */
-export const VERSION = '0.23.2';
+export const VERSION = '0.24.1';
 /**
  * The card's resource URI.
  *
@@ -39,7 +44,7 @@ export const VERSION = '0.23.2';
  * connector went storefront-v35 → v40 in a single day of UI work for exactly
  * this reason.
  */
-export const CARD_URI = 'ui://curless/hotel/booking-v39.html';
+export const CARD_URI = 'ui://curless/hotel/booking-v40.html';
 /**
  * ⚠️ `text/html;profile=mcp-app`, not `text/html+skybridge`. The MIME is how a
  * host recognises this resource as a card at all; the plausible near-miss made
@@ -77,22 +82,108 @@ export const widgetMeta = (imageDomains) => ({
 });
 /** The trip snapshot that rides beside every answer, for the card's header. */
 export const TRIP_META_KEY = 'curless/trip';
+const makeBackend = (config, opts, now) => {
+    if (config.data.source === 'demo') {
+        const data = loadHotelData(config.data.file ?? 'data/hotels.json', opts.configPath);
+        const backend = createDemoHotels({
+            data,
+            now,
+            ...(config.data.holdMinutes ? { holdMs: config.data.holdMinutes * 60_000 } : {}),
+        });
+        const domains = imageDomainsOf(data.hotels);
+        return {
+            backend,
+            imageDomains: () => domains,
+            hotelCount: () => data.hotels.length,
+            health: () => ({}),
+            ready: () => Promise.resolve(),
+        };
+    }
+    const api = config.data.api;
+    if (!api)
+        throw new Error('data.source "api" needs data.api: which system, and where it answers');
+    if (api.provider !== 'huazhu') {
+        throw new Error(`hotel-storefront ${VERSION} does not know the "${String(api.provider)}" booking system`);
+    }
+    // ⚠️ THE NAMES OF WHAT IS MISSING, NEVER THE VALUES OF WHAT IS THERE.
+    const env = opts.env ?? process.env;
+    const prefix = api.envPrefix ?? 'HUAZHU';
+    const names = {
+        clientId: `${prefix}_CLIENT_ID`,
+        secret: `${prefix}_CLIENT_SECRET`,
+        distributorId: `${prefix}_DISTRIBUTOR_ID`,
+    };
+    const missing = Object.values(names).filter((n) => !env[n]);
+    if (missing.length) {
+        throw new Error(`${config.brand}: ${missing.join(', ')} ${missing.length === 1 ? 'is' : 'are'} not set - the credentials Huazhu issued go in the environment, never in the config`);
+    }
+    const client = new HuazhuClient({
+        baseUrl: api.baseUrl,
+        authUrl: api.authUrl,
+        credentials: {
+            clientId: String(env[names.clientId]),
+            secret: String(env[names.secret]),
+            distributorId: String(env[names.distributorId]),
+        },
+        ...(opts.fetch ? { fetch: opts.fetch } : {}),
+        now,
+    });
+    // ⚠️ THE BRAND'S REPOSITORY IS MOUNTED READ-ONLY on the box, beside this
+    // config - so where state is written can be moved out of it by the
+    // deployment (`HOTEL_STATE_DIR`) without the brand's config naming a path
+    // that only exists inside our container.
+    const stateDir = resolve(opts.configPath ? dirname(opts.configPath) : '.', env.HOTEL_STATE_DIR || api.stateDir);
+    const catalog = new Catalog({
+        client,
+        stateDir,
+        ...(api.hotels ? { only: api.hotels } : {}),
+        now,
+    });
+    const store = new BookingStore(stateDir, now);
+    const reconciler = new Reconciler(store, client, now);
+    const backend = createHuazhuHotels({
+        brand: config.brand,
+        client,
+        catalog,
+        store,
+        reconciler,
+        paymentType: api.paymentType ?? 'NGPL',
+        language: api.language ?? 'zh',
+        tz: api.timezone ?? 'Asia/Shanghai',
+        ...(api.allowTags ? { allowTags: api.allowTags } : {}),
+        now,
+    });
+    if (opts.background !== false) {
+        reconciler.start();
+        const keepCurrent = () => {
+            if (catalog.stale())
+                void catalog.sync();
+        };
+        keepCurrent();
+        setInterval(keepCurrent, 60 * 60_000).unref?.();
+    }
+    // The photographs' hosts, worked out again only when the list changed.
+    let domains;
+    return {
+        backend,
+        imageDomains: () => {
+            if (!domains || domains.size !== catalog.size) {
+                domains = { size: catalog.size, hosts: backend.imageDomains() };
+            }
+            return domains.hosts;
+        },
+        hotelCount: () => catalog.size,
+        health: () => backend.health(),
+        ready: () => (catalog.size > 0 && !catalog.stale() ? Promise.resolve() : catalog.sync()),
+    };
+};
 export const buildServer = (opts) => {
     const config = opts.config;
     const brand = resolveBrand(config);
     const now = opts.now ?? (() => Date.now());
-    if (config.data.source !== 'demo') {
-        // Named in the config type so the shape does not have to change when the
-        // group's API lands - but a deployment that claims it today would answer
-        // with nothing, and silently.
-        throw new Error(`hotel-storefront ${VERSION} only implements data.source "demo"; the group's own API is the next step`);
-    }
-    const data = loadHotelData(config.data.file ?? 'data/hotels.json', opts.configPath);
-    const backend = createDemoHotels({
-        data,
-        now,
-        ...(config.data.holdMinutes ? { holdMs: config.data.holdMinutes * 60_000 } : {}),
-    });
+    const made = makeBackend(config, opts, now);
+    const { backend } = made;
+    const caps = backend.capabilities ?? FULL_CAPABILITIES;
     const trips = new TripStore(now);
     const members = new MemberStore(now);
     const tripIds = new TripIds(now);
@@ -108,15 +199,19 @@ export const buildServer = (opts) => {
         misses,
         ...(config.server.logoFile ? { logoUrl: `${publicUrl}/logo.png` } : {}),
     };
-    const TOOLS = buildTools(brand.tools, brand.vocab);
+    const TOOLS = buildTools(brand.tools, brand.vocab, caps);
+    const OFFERED = new Set(TOOLS.map((t) => t.name));
+    const WITHHELD = withheldTools(brand.tools, caps);
+    deps.offered = OFFERED;
     const OUTPUT_SCHEMAS = buildOutputSchemas(brand.tools);
     const TRIP_TOOLS = tripToolNames(brand);
     // A policy answer is TEXT for the model, not something to look at: drawing a
     // booking card over "can I bring a dog" puts a storefront in front of someone
     // who asked a question.
     const CARDLESS = new Set([brand.tools.policies, brand.tools.lookUp]);
-    const imageDomains = imageDomainsOf(data.hotels);
-    const META = widgetMeta(imageDomains);
+    // Worked out per answer: an API backend's photographs arrive with its hotel
+    // list, which is still filling in on a first boot.
+    const meta = () => widgetMeta(made.imageDomains());
     const app = new Hono();
     const file = (name) => {
         if (!name || !opts.configPath)
@@ -156,17 +251,18 @@ export const buildServer = (opts) => {
             })
             : c.notFound();
     });
-    app.get('/docs', (c) => c.html(docsPage(config)));
-    app.get('/privacy', (c) => c.html(privacyPage(config, imageDomains)));
-    app.get('/terms', (c) => c.html(termsPage(config)));
+    app.get('/docs', (c) => c.html(docsPage(config, caps)));
+    app.get('/privacy', (c) => c.html(privacyPage(config, made.imageDomains(), caps)));
+    app.get('/terms', (c) => c.html(termsPage(config, caps)));
     app.get('/healthz', (c) => c.json({
         ok: true,
         brand: config.brand,
         version: VERSION,
-        hotels: data.hotels.length,
+        hotels: made.hotelCount(),
         demo: brand.vocab.demo,
         trips: trips.size,
         signedIn: members.size,
+        ...made.health(),
     }));
     app.get('/', (c) => c.redirect('./docs', 302));
     app.get('/mcp', (c) => c.json({ name: config.server.name, transport: 'streamable-http', version: VERSION }));
@@ -212,7 +308,7 @@ export const buildServer = (opts) => {
                         : {}),
                 },
                 // How to BEHAVE, not just what the tools are - see surface.ts.
-                instructions: buildInstructions(brand),
+                instructions: buildInstructions(brand, caps),
             });
         }
         // ⚠️ The spec says a receiver MUST answer ping promptly. The shopping
@@ -224,7 +320,7 @@ export const buildServer = (opts) => {
             return c.body(null, 202);
         if (method === 'tools/list') {
             return ok(c, id, {
-                tools: listTools(TOOLS, OUTPUT_SCHEMAS, (name) => (CARDLESS.has(name) ? {} : META), TRIP_TOOLS),
+                tools: listTools(TOOLS, OUTPUT_SCHEMAS, (name) => (CARDLESS.has(name) ? {} : meta()), TRIP_TOOLS),
             });
         }
         if (method === 'resources/list') {
@@ -235,7 +331,7 @@ export const buildServer = (opts) => {
                         name: `${config.brand} booking`,
                         description: `Find ${brand.vocab.nounPlural}, price a stay, build a trip and request the rooms`,
                         mimeType: CARD_MIME,
-                        _meta: META,
+                        _meta: meta(),
                     },
                 ],
             });
@@ -252,12 +348,20 @@ export const buildServer = (opts) => {
             if (!uri.startsWith('ui://curless/hotel/'))
                 return fail(c, id, -32602, `unknown resource: ${uri}`);
             return ok(c, id, {
-                contents: [{ uri, mimeType: CARD_MIME, text: HOTEL_CARD_HTML, _meta: META }],
+                contents: [{ uri, mimeType: CARD_MIME, text: HOTEL_CARD_HTML, _meta: meta() }],
             });
         }
         if (method === 'tools/call') {
             const name = String(params?.name ?? '');
             const args = (params?.arguments ?? {});
+            // A tool this deployment does not offer is not listed, and is not
+            // answered either - a host holding an old tool list gets told so.
+            if (WITHHELD.has(name)) {
+                return ok(c, id, {
+                    content: [{ type: 'text', text: `${name} is not offered by this connector.` }],
+                    isError: true,
+                });
+            }
             const session = c.req.header('mcp-session-id') ?? `anon-${randomUUID()}`;
             // The card names its trip; the conversation is known by its session. See
             // trip-ids.ts for why both exist.
@@ -296,7 +400,7 @@ export const buildServer = (opts) => {
                                     quantity: l.quantity,
                                 }),
                         },
-                        ...(CARDLESS.has(name) ? {} : META),
+                        ...(CARDLESS.has(name) ? {} : meta()),
                     },
                 });
             }
@@ -306,7 +410,7 @@ export const buildServer = (opts) => {
         }
         return fail(c, id, -32601, `unknown method: ${method}`);
     });
-    return { app, brand, deps, trips, members, tripIds };
+    return { app, ready: made.ready, brand, deps, trips, members, tripIds };
 };
 /**
  * Every origin the card will try to load a picture from.