@curless/hotel-storefront 0.24.4 → 0.26.0

package/dist/sessions.js

@@ -0,0 +1,96 @@
+import { randomUUID } from 'node:crypto';
+// The session ids this connector has issued - and only those are accepted.
+//
+// ⚠️ A SESSION ID WAS ANY STRING THE CALLER SENT. `initialize` issued one, but
+// every other call took whatever `Mcp-Session-Id` arrived, so a script could
+// be as many conversations as it liked: twelve made-up ids, one booking each,
+// emptied the Island Shangri-La for a month (2026-10-05 audit). Now an id this
+// connector never issued - or issued and has since forgotten - is answered
+// 404, which the protocol defines as "this session is gone, initialize again".
+//
+// This alone is not the fix for that attack (`initialize` hands out ids for
+// the asking); the demo-wide cap on held rooms is. What it does guarantee is
+// that a conversation's id is one we chose.
+//
+// ⚠️ KEPT ACROSS A RESTART, or every deploy would answer every open
+// conversation 404 - and a host that does not start over on a 404 shows its
+// guest an error instead. A call with NO session id is still answered: the
+// card's calls can arrive without one (trip-ids.ts).
+/** An id unused this long is forgotten; a conversation picked up after that starts a new session. */
+export const SESSION_TTL_MS = 30 * 86_400_000;
+/** Ids kept at once. Past it, the one unused for longest goes. */
+const MAX_SESSIONS = 100_000;
+/**
+ * How stale a "last used" may get before it is written down again. A session
+ * lives for a month; rewriting the file on every tool call to move its clock by
+ * a second would be most of what this server writes.
+ */
+const TOUCH_EVERY_MS = 60 * 60_000;
+export class Sessions {
+    now;
+    file;
+    /** Id → last used. Insertion order is use order: a touch re-inserts. */
+    seen = new Map();
+    sweptAt = 0;
+    constructor(now = () => Date.now(), file) {
+        this.now = now;
+        this.file = file;
+        const saved = file?.read();
+        for (const [id, at] of saved?.sessions ?? []) {
+            if (typeof id === 'string' && typeof at === 'number')
+                this.seen.set(id, at);
+        }
+        file?.bind(() => ({ sessions: [...this.seen] }));
+        this.sweep();
+    }
+    /** A new id, ours. */
+    issue() {
+        this.sweep();
+        const id = randomUUID();
+        this.seen.set(id, this.now());
+        while (this.seen.size > MAX_SESSIONS) {
+            const oldest = this.seen.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.seen.delete(oldest);
+        }
+        this.file?.changed();
+        return id;
+    }
+    /** Whether this is an id we issued and still keep - and, if so, that it was just used. */
+    known(id) {
+        const at = this.seen.get(id);
+        if (at === undefined)
+            return false;
+        const t = this.now();
+        if (t - at > SESSION_TTL_MS) {
+            this.seen.delete(id);
+            this.file?.changed();
+            return false;
+        }
+        if (t - at > TOUCH_EVERY_MS) {
+            this.seen.delete(id);
+            this.seen.set(id, t);
+            this.file?.changed();
+        }
+        return true;
+    }
+    get size() {
+        return this.seen.size;
+    }
+    /** At most once an hour: a walk over a hundred thousand ids is not free. */
+    sweep() {
+        const t = this.now();
+        if (t - this.sweptAt < TOUCH_EVERY_MS)
+            return;
+        this.sweptAt = t;
+        let gone = false;
+        for (const [id, at] of this.seen) {
+            if (t - at > SESSION_TTL_MS)
+                gone = this.seen.delete(id) || gone;
+        }
+        if (gone)
+            this.file?.changed();
+    }
+}
+//# sourceMappingURL=sessions.js.map

package/dist/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../src/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,2EAA2E;AAC3E,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,8EAA8E;AAC9E,+EAA+E;AAC/E,2EAA2E;AAC3E,+EAA+E;AAC/E,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,4CAA4C;AAC5C,EAAE;AACF,oEAAoE;AACpE,4EAA4E;AAC5E,2EAA2E;AAC3E,qDAAqD;AAErD,qGAAqG;AACrG,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,UAAU,CAAC;AAC9C,kEAAkE;AAClE,MAAM,YAAY,GAAG,OAAO,CAAC;AAC7B;;;;GAIG;AACH,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC;AAEnC,MAAM,OAAO,QAAQ;IAMA;IACA;IANnB,wEAAwE;IACvD,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,OAAO,GAAG,CAAC,CAAC;IAEpB,YACmB,MAAoB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EACpC,IAAgB;QADhB,QAAG,GAAH,GAAG,CAAiC;QACpC,SAAI,GAAJ,IAAI,CAAY;QAEjC,MAAM,KAAK,GAAG,IAAI,EAAE,IAAI,EAAqC,CAAC;QAC9D,KAAK,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;YAC7C,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED,sBAAsB;IACtB,KAAK;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,YAAY,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC7C,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM;YAChC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;QACrB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAC,EAAU;QACd,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACrB,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACxB,CAAC;IAED,4EAA4E;IACpE,KAAK;QACX,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,cAAc;YAAE,OAAO;QAC9C,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;QACjB,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,KAAK,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACjC,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc;gBAAE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;QACnE,CAAC;QACD,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;IACjC,CAAC;CACF"}

package/dist/state.d.ts

@@ -0,0 +1,32 @@
+export declare class StateFile {
+    readonly path: string;
+    private timer;
+    private snapshot;
+    constructor(path: string);
+    /**
+     * What was written last time, or undefined when there is nothing usable.
+     *
+     * ⚠️ A FILE THAT DOES NOT PARSE IS SET ASIDE, NOT OVERWRITTEN. Starting
+     * empty and writing over it would destroy the only copy of somebody's
+     * booking; renamed, a person can still look at it.
+     */
+    read<T>(): T | undefined;
+    /** What to write. The store hands over a function, so the write takes the state as it is THEN. */
+    bind(snapshot: () => unknown): void;
+    /** Something changed: write it soon. */
+    changed(): void;
+    /** Write now if anything is waiting. */
+    flush(): void;
+    private write;
+}
+/** Where the stores of one deployment keep their files - or nothing, when it has no directory. */
+export declare class StateDir {
+    readonly dir: string | undefined;
+    private readonly files;
+    constructor(dir: string | undefined);
+    get persisted(): boolean;
+    file(name: string): StateFile | undefined;
+    /** Everything still waiting, written now - on a clean stop. */
+    flush(): void;
+}
+//# sourceMappingURL=state.d.ts.map

package/dist/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAuBA,qBAAa,SAAS;IAIR,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHjC,OAAO,CAAC,KAAK,CAA4C;IACzD,OAAO,CAAC,QAAQ,CAA8B;gBAEzB,IAAI,EAAE,MAAM;IAEjC;;;;;;OAMG;IACH,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,SAAS;IAuBxB,kGAAkG;IAClG,IAAI,CAAC,QAAQ,EAAE,MAAM,OAAO,GAAG,IAAI;IAInC,wCAAwC;IACxC,OAAO,IAAI,IAAI;IAMf,wCAAwC;IACxC,KAAK,IAAI,IAAI;IAOb,OAAO,CAAC,KAAK;CAed;AAED,kGAAkG;AAClG,qBAAa,QAAQ;IAGP,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS;IAF5C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAmB;gBAEpB,GAAG,EAAE,MAAM,GAAG,SAAS;IAE5C,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;IAOzC,+DAA+D;IAC/D,KAAK,IAAI,IAAI;CAGd"}

package/dist/state.js

@@ -0,0 +1,118 @@
+import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+// What survives a restart: one JSON file per store, in the deployment's state
+// directory (`HOTEL_STATE_DIR`).
+//
+// ⚠️ A DEPLOY USED TO FORGET EVERY GUEST. Bookings, trips, sign-ins and the
+// session ids themselves were in memory, and this connector ships several times
+// a day: a guest told "held until 18:00, SL-7K2M4P" asked to cancel after a
+// deploy and was told no booking matched - and the lookup with their email was
+// then counted as a wrong guess (2026-10-05 audit). Now every store writes
+// itself here, and reads itself back on boot.
+//
+// ⚠️ NO DIRECTORY, NO DISK. Without one the stores stay in memory exactly as
+// before, so a local run or a test writes nothing anywhere. And the directory
+// is never the brand's repository: that is mounted read-only on the box.
+//
+// Writes are coalesced - a trip id touched on every tool call would otherwise
+// rewrite its file on every tool call - so the last half second before a crash
+// can be lost. A clean stop (`flush`, on SIGTERM) loses nothing.
+const WRITE_DELAY_MS = 500;
+export class StateFile {
+    path;
+    timer;
+    snapshot;
+    constructor(path) {
+        this.path = path;
+    }
+    /**
+     * What was written last time, or undefined when there is nothing usable.
+     *
+     * ⚠️ A FILE THAT DOES NOT PARSE IS SET ASIDE, NOT OVERWRITTEN. Starting
+     * empty and writing over it would destroy the only copy of somebody's
+     * booking; renamed, a person can still look at it.
+     */
+    read() {
+        let text;
+        try {
+            text = readFileSync(this.path, 'utf8');
+        }
+        catch {
+            return undefined; // none yet
+        }
+        try {
+            return JSON.parse(text);
+        }
+        catch (err) {
+            const aside = `${this.path}.corrupt-${Date.now()}`;
+            try {
+                renameSync(this.path, aside);
+            }
+            catch {
+                // Unreadable and unmovable: starting empty is all that is left.
+            }
+            console.error(`[state] ${this.path} did not parse (${err.message}); kept as ${aside}`);
+            return undefined;
+        }
+    }
+    /** What to write. The store hands over a function, so the write takes the state as it is THEN. */
+    bind(snapshot) {
+        this.snapshot = snapshot;
+    }
+    /** Something changed: write it soon. */
+    changed() {
+        if (this.timer)
+            return;
+        this.timer = setTimeout(() => this.flush(), WRITE_DELAY_MS);
+        this.timer.unref?.();
+    }
+    /** Write now if anything is waiting. */
+    flush() {
+        if (!this.timer)
+            return;
+        clearTimeout(this.timer);
+        this.timer = undefined;
+        this.write();
+    }
+    write() {
+        if (!this.snapshot)
+            return;
+        try {
+            mkdirSync(dirname(this.path), { recursive: true });
+            const tmp = `${this.path}.${process.pid}.tmp`;
+            // ⚠️ OWNER-ONLY. These files hold names, emails and phone numbers.
+            writeFileSync(tmp, JSON.stringify(this.snapshot()), { mode: 0o600 });
+            chmodSync(tmp, 0o600);
+            renameSync(tmp, this.path);
+        }
+        catch (err) {
+            // A full disk must not take the conversation down with it: the state is
+            // still right in memory, and the next change tries again.
+            console.error(`[state] could not write ${this.path}: ${err.message}`);
+        }
+    }
+}
+/** Where the stores of one deployment keep their files - or nothing, when it has no directory. */
+export class StateDir {
+    dir;
+    files = [];
+    constructor(dir) {
+        this.dir = dir;
+    }
+    get persisted() {
+        return this.dir !== undefined;
+    }
+    file(name) {
+        if (!this.dir)
+            return undefined;
+        const f = new StateFile(join(this.dir, name));
+        this.files.push(f);
+        return f;
+    }
+    /** Everything still waiting, written now - on a clean stop. */
+    flush() {
+        for (const f of this.files)
+            f.flush();
+    }
+}
+//# sourceMappingURL=state.js.map

package/dist/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,8EAA8E;AAC9E,iCAAiC;AACjC,EAAE;AACF,4EAA4E;AAC5E,gFAAgF;AAChF,4EAA4E;AAC5E,+EAA+E;AAC/E,2EAA2E;AAC3E,8CAA8C;AAC9C,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,yEAAyE;AACzE,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,iEAAiE;AAEjE,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,MAAM,OAAO,SAAS;IAIC;IAHb,KAAK,CAA4C;IACjD,QAAQ,CAA8B;IAE9C,YAAqB,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAErC;;;;;;OAMG;IACH,IAAI;QACF,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,CAAC,WAAW;QAC/B,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,YAAY,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACnD,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,gEAAgE;YAClE,CAAC;YACD,OAAO,CAAC,KAAK,CACX,WAAW,IAAI,CAAC,IAAI,mBAAoB,GAAa,CAAC,OAAO,cAAc,KAAK,EAAE,CACnF,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,kGAAkG;IAClG,IAAI,CAAC,QAAuB;QAC1B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,wCAAwC;IACxC,OAAO;QACL,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QACvB,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,cAAc,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IACvB,CAAC;IAED,wCAAwC;IACxC,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO;QACxB,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAEO,KAAK;QACX,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC3B,IAAI,CAAC;YACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;YAC9C,mEAAmE;YACnE,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACrE,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACtB,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,0DAA0D;YAC1D,OAAO,CAAC,KAAK,CAAC,2BAA2B,IAAI,CAAC,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;CACF;AAED,kGAAkG;AAClG,MAAM,OAAO,QAAQ;IAGE;IAFJ,KAAK,GAAgB,EAAE,CAAC;IAEzC,YAAqB,GAAuB;QAAvB,QAAG,GAAH,GAAG,CAAoB;IAAG,CAAC;IAEhD,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC;IAChC,CAAC;IAED,IAAI,CAAC,IAAY;QACf,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,+DAA+D;IAC/D,KAAK;QACH,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK;YAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACxC,CAAC;CACF"}

package/dist/tools.d.ts

@@ -774,6 +774,8 @@ export type ToolContext = {
      * cart was empty. See trip-ids.ts.
      */
     tripKey?: string;
+    /** The client's network address, as the edge proxy saw it - for the booking limits only. */
+    ip?: string;
 };
 export type ToolAnswer = {
     structured: Record<string, unknown>;
@@ -785,5 +787,16 @@ export type ToolAnswer = {
  * read better as hotels, grouped by city.
  */
 export declare const CITY_PICKER_MIN = 4;
+/**
+ * The answer when the card names a trip this connector no longer knows.
+ *
+ * ⚠️ SAID, NOT PAPERED OVER. An unknown id used to fall back to the card's own
+ * connection - a DIFFERENT trip from the conversation's - and the card took
+ * that trip's id as its own. Rooms added on the card then went into a trip the
+ * assistant could not see, and "book it" was answered "the trip is empty"
+ * (2026-10-05 audit). The way back is the conversation's own trip, which the
+ * assistant's next answer hands the card.
+ */
+export declare const tripGone: (deps: ToolDeps) => ToolAnswer;
 export declare const handleTool: (deps: ToolDeps, name: string, rawArgs: unknown, ctx: ToolContext) => Promise<ToolAnswer>;
 //# sourceMappingURL=tools.d.ts.map

package/dist/tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EAOzB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAI7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAgBhD,OAAO,EAGL,KAAK,SAAS,EAGf,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAYV,eAAe,EAIhB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAkExD,+GAA+G;AAC/G,eAAO,MAAM,WAAW,IAAI,CAAC;AAE7B;;;;GAIG;AACH,eAAO,MAAM,UAAU,GACrB,GAAG,SAAS,EACZ,GAAG,UAAU,EACb,OAAM,mBAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IACC,CAAC;AAEjD,mEAAmE;AACnE,eAAO,MAAM,aAAa,GAAI,GAAG,SAAS,EAAE,MAAM,mBAAmB,KAAG,GAAG,CAAC,MAAM,CAM9E,CAAC;AAipBL,eAAO,MAAM,kBAAkB,GAAI,GAAG,SAAS,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAoNtE,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG;IACrB,OAAO,EAAE,YAAY,CAAC;IACtB;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC9B,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;IACrB,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,0FAA0F;IAC1F,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAwrB/E;;;;GAIG;AACH,eAAO,MAAM,eAAe,IAAI,CAAC;AAyJjC,eAAO,MAAM,UAAU,GACrB,MAAM,QAAQ,EACd,MAAM,MAAM,EACZ,SAAS,OAAO,EAChB,KAAK,WAAW,KACf,OAAO,CAAC,UAAU,CAMpB,CAAC"}
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EAOzB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAI7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAgBhD,OAAO,EAIL,KAAK,SAAS,EAGf,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAYV,eAAe,EAIhB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAkExD,+GAA+G;AAC/G,eAAO,MAAM,WAAW,IAAI,CAAC;AAE7B;;;;GAIG;AACH,eAAO,MAAM,UAAU,GACrB,GAAG,SAAS,EACZ,GAAG,UAAU,EACb,OAAM,mBAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IACC,CAAC;AAEjD,mEAAmE;AACnE,eAAO,MAAM,aAAa,GAAI,GAAG,SAAS,EAAE,MAAM,mBAAmB,KAAG,GAAG,CAAC,MAAM,CAM9E,CAAC;AAqqBL,eAAO,MAAM,kBAAkB,GAAI,GAAG,SAAS,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAoNtE,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG;IACrB,OAAO,EAAE,YAAY,CAAC;IACtB;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC9B,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;IACrB,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,0FAA0F;IAC1F,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4FAA4F;IAC5F,EAAE,CAAC,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAssB/E;;;;GAIG;AACH,eAAO,MAAM,eAAe,IAAI,CAAC;AAyJjC;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ,GAAI,MAAM,QAAQ,KAAG,UAMzC,CAAC;AAEF,eAAO,MAAM,UAAU,GACrB,MAAM,QAAQ,EACd,MAAM,MAAM,EACZ,SAAS,OAAO,EAChB,KAAK,WAAW,KACf,OAAO,CAAC,UAAU,CAMpB,CAAC"}

package/dist/tools.js

@@ -5,7 +5,7 @@ import { DESCRIPTION_MAX, POLICY_MAX, hotelText } from './fence.js';
 import { formatMoney, money, multiplyMoney, toMinor } from './money.js';
 import { MAX_COMPARED, MAX_CONS, MAX_DAYS, MAX_ITEMS_PER_DAY, MAX_MOMENTS, MAX_PROS, buildItinerary, compareHotels, } from './present.js';
 import { regionOf } from './regions.js';
-import { MAX_EXTRA_QUANTITY, MAX_ROOMS_PER_LINE, clampCount, tripKey, } from './trip.js';
+import { MAX_EXTRA_QUANTITY, MAX_ROOMS_PER_LINE, TRIP_TTL_MS, clampCount, tripKey, } from './trip.js';
 import { DEMO_NOTE } from './vocab.js';
 // The eleven things a guest can do: find hotels, look at one on dates, see what
 // else it offers, build a trip, ask for the rooms, and deal with a booking they
@@ -114,6 +114,23 @@ const forCapabilities = (tools, n, v, caps) => {
             }
         }
         if (t.name === n.requestBooking) {
+            if (caps.requiresPhone) {
+                const schema = out.inputSchema;
+                out = {
+                    ...out,
+                    inputSchema: {
+                        ...schema,
+                        properties: {
+                            ...(schema.properties ?? {}),
+                            phone: {
+                                type: 'string',
+                                description: "The guest's phone number, for the hotel to reach them",
+                            },
+                        },
+                        required: [...new Set([...(schema.required ?? []), 'phone'])],
+                    },
+                };
+            }
             if (!caps.members)
                 out = { ...out, inputSchema: without(out.inputSchema, 'rememberRequests') };
             if (caps.booking === 'pay-at-hotel') {
@@ -982,11 +999,21 @@ const common = (deps, key) => ({
         ? Object.fromEntries(Object.entries(deps.tools).filter(([, name]) => deps.offered?.has(name)))
         : deps.tools,
     bookingMode: (deps.backend.capabilities ?? FULL_CAPABILITIES).booking,
+    ...((deps.backend.capabilities ?? FULL_CAPABILITIES).requiresPhone
+        ? { phoneRequired: true }
+        : {}),
     ...(deps.vocab.sandbox ? { sandbox: true } : {}),
     vocab: { noun: deps.vocab.noun, nounPlural: deps.vocab.nounPlural },
     ...(deps.vocab.demo ? { demo: true, demoNote: DEMO_NOTE } : { demo: false }),
     ...(key ? memberBadge(deps, key) : {}),
 });
+/**
+ * When a room stops being free to cancel, the way a guest reads it: the
+ * hotel's own clock when the backend knows it, else the instant in UTC - never
+ * the date alone (see `atHotelTime`).
+ */
+const freeUntilText = (r) => r.freeCancellationLocal ??
+    `${(r.freeCancellationUntil ?? '').slice(0, 16).replace('T', ' ')} UTC`;
 /** One line of a trip, flattened for the card. Prices are strings: the card never does arithmetic. */
 const quoteForCard = (quote) => ({
     lines: quote.lines.map((l) => ({
@@ -1328,6 +1355,8 @@ const identity = (deps, ctx, key, args = {}) => {
         // checks, not authentication, and it must never become a way to read
         // somebody else's booking.
         ...(member ? { member } : {}),
+        // Only a booking limit reads it - see `Identity.ip`.
+        ...(ctx.ip ? { ip: ctx.ip } : {}),
     };
 };
 /**
@@ -1682,6 +1711,23 @@ const suggestionsFor = async (deps, d) => {
     })
         .slice(0, 3);
 };
+/**
+ * The answer when the card names a trip this connector no longer knows.
+ *
+ * ⚠️ SAID, NOT PAPERED OVER. An unknown id used to fall back to the card's own
+ * connection - a DIFFERENT trip from the conversation's - and the card took
+ * that trip's id as its own. Rooms added on the card then went into a trip the
+ * assistant could not see, and "book it" was answered "the trip is empty"
+ * (2026-10-05 audit). The way back is the conversation's own trip, which the
+ * assistant's next answer hands the card.
+ */
+export const tripGone = (deps) => {
+    const detail = `The trip this card was showing is no longer kept - a trip is kept for ${TRIP_TTL_MS / 3_600_000} hours after its last change. Ask the assistant to show the trip again.`;
+    return {
+        structured: { view: 'error', ...common(deps), error: 'trip-gone', detail },
+        text: detail,
+    };
+};
 export const handleTool = async (deps, name, rawArgs, ctx) => {
     const answer = await answerTool(deps, name, rawArgs, ctx);
     const suggestions = await suggestionsFor(deps, answer.structured).catch(() => []);
@@ -2166,6 +2212,13 @@ const answerTool = async (deps, name, rawArgs, ctx) => {
             // string, not by anyone looking at it.
             ...(r.publicNightly ? { publicNightly: formatMoney(r.publicNightly) } : {}),
             ...(r.publicStayTotal ? { publicStayTotal: formatMoney(r.publicStayTotal) } : {}),
+            // ⚠️ AND STRUCK THROUGH FOR AS MANY ROOMS AS THE PRICE BESIDE IT. One
+            // room's public rate drawn over two rooms' member rate put a "was" price
+            // BELOW the price a member pays (2026-10-05 audit).
+            ...(r.publicStayTotal && roomsWanted > 1
+                ? { publicRoomsTotal: formatMoney(multiplyMoney(r.publicStayTotal, roomsWanted)) }
+                : {}),
+            ...(r.freeCancellationUntil ? { freeCancellationLocal: freeUntilText(r) } : {}),
         }));
         return {
             structured: {
@@ -2178,7 +2231,7 @@ const answerTool = async (deps, name, rawArgs, ctx) => {
             },
             text: [
                 `**${h.name}** · ${enough.length} room ${enough.length === 1 ? 'type' : 'types'} for ${stay.checkIn} to ${stay.checkOut}, ${stay.guests} guests${roomsWanted > 1 ? `, ${roomsWanted} rooms` : ''}.`,
-                ...enough.map((r) => `- ${r.name} — ${formatMoney(r.nightly)} a night, ${formatMoney(r.stayTotal)} for the stay incl. taxes and fees${roomsWanted > 1 ? ` (${formatMoney(multiplyMoney(r.stayTotal, roomsWanted))} for ${roomsWanted} rooms)` : ''}${r.freeCancellationUntil ? `, free to cancel until ${r.freeCancellationUntil.slice(0, 10)}` : r.refundable ? ', the free cancellation window has closed - cancelling now has a fee' : ', non-refundable'}`),
+                ...enough.map((r) => `- ${r.name} — ${formatMoney(r.nightly)} a night, ${formatMoney(r.stayTotal)} for the stay incl. taxes and fees${roomsWanted > 1 ? ` (${formatMoney(multiplyMoney(r.stayTotal, roomsWanted))} for ${roomsWanted} rooms)` : ''}${r.freeCancellationUntil ? `, free to cancel until ${freeUntilText(r)}` : r.refundable ? ', the free cancellation window has closed - cancelling now has a fee' : ', non-refundable'}`),
                 flex.text,
                 deps.vocab.demo ? DEMO_NOTE : '',
             ]
@@ -2259,7 +2312,7 @@ const answerTool = async (deps, name, rawArgs, ctx) => {
                     : rooms.length
                         ? [
                             `Rooms for ${stay.checkIn} to ${stay.checkOut}, ${stay.guests} guests${roomsWanted > 1 ? `, ${roomsWanted} rooms` : ''}:`,
-                            ...rooms.map((r) => `- ${r.name} · sleeps ${r.sleeps}${r.breakfast ? ' · breakfast' : ''} · ${formatMoney(r.stayTotal)} for the stay incl. taxes and fees${r.freeCancellationUntil ? `, free to cancel until ${r.freeCancellationUntil.slice(0, 10)}` : r.refundable ? '' : ', non-refundable'}`),
+                            ...rooms.map((r) => `- ${r.name} · sleeps ${r.sleeps}${r.breakfast ? ' · breakfast' : ''} · ${formatMoney(r.stayTotal)} for the stay incl. taxes and fees${r.freeCancellationUntil ? `, free to cancel until ${freeUntilText(r)}` : r.refundable ? '' : ', non-refundable'}`),
                         ].join('\n')
                         : (detail.noRooms ?? `No room type here has ${roomsWanted} left for those nights.`),
                 extras.length
@@ -2487,11 +2540,22 @@ const answerTool = async (deps, name, rawArgs, ctx) => {
             };
         }
         const guest = { name: str(args.name), email: str(args.email) };
-        const missing = [!guest.name && 'a name', !guest.email.includes('@') && 'an email'].filter((x) => typeof x === 'string');
+        // A phone where the backend needs one: a booking paid at the hotel and
+        // guaranteed by nobody, which the hotel has to be able to follow up.
+        const phoneNeeded = !!(deps.backend.capabilities ?? FULL_CAPABILITIES).requiresPhone;
+        const phone = str(args.phone);
+        const missing = [
+            !guest.name && 'a name',
+            !guest.email.includes('@') && 'an email',
+            phoneNeeded && phone.replace(/\D/g, '').length < 6 && 'a phone number',
+        ].filter((x) => typeof x === 'string');
         if (missing.length) {
+            const said = missing.length > 1
+                ? `${missing.slice(0, -1).join(', ')} and ${missing.at(-1)}`
+                : (missing[0] ?? '');
             return {
                 structured: { view: 'needs-guest', ...common(deps, key), missing },
-                text: `The booking needs ${missing.join(' and ')}. Ask the guest for ${missing.length > 1 ? 'them' : 'it'} - do not use a name or email you know from anywhere else.`,
+                text: `The booking needs ${said}. Ask the guest for ${missing.length > 1 ? 'them' : 'it'} - do not use a ${phoneNeeded ? 'name, email or phone number' : 'name or email'} you know from anywhere else.`,
             };
         }
         const { requests, dropped } = readRequests(args);