@curless/hotel-storefront 0.26.2 → 0.27.0

package/dist/state.js

@@ -18,10 +18,23 @@ import { dirname, join } from 'node:path';
 // rewrite its file on every tool call - so the last half second before a crash
 // can be lost. A clean stop (`flush`, on SIGTERM) loses nothing.
 const WRITE_DELAY_MS = 500;
+/**
+ * The most one store may write, in characters of JSON.
+ *
+ * ⚠️ PAST IT, NOTHING IS WRITTEN AND SOMEBODY IS TOLD. Unbounded guest fields
+ * once grew the bookings file past what `JSON.stringify` can make at all; the
+ * write threw, a line went to a log nobody reads, and every booking from then
+ * on lived only in memory until the next deploy forgot it (2026-10-05 audit).
+ * Now an over-size snapshot leaves the last good file where it is, the store
+ * says it is in trouble, and the demo stops taking bookings it could not keep.
+ */
+export const MAX_STATE_CHARS = 32 * 1024 * 1024;
 export class StateFile {
     path;
     timer;
     snapshot;
+    /** Why the last write did not happen - cleared by the next one that does. */
+    trouble;
     constructor(path) {
         this.path = path;
     }
@@ -78,18 +91,31 @@ export class StateFile {
         if (!this.snapshot)
             return;
         try {
+            const text = JSON.stringify(this.snapshot());
+            if (text.length > MAX_STATE_CHARS) {
+                this.fail(`${text.length} characters, over the ${MAX_STATE_CHARS} a store may write`);
+                return;
+            }
             mkdirSync(dirname(this.path), { recursive: true });
             const tmp = `${this.path}.${process.pid}.tmp`;
             // ⚠️ OWNER-ONLY. These files hold names, emails and phone numbers.
-            writeFileSync(tmp, JSON.stringify(this.snapshot()), { mode: 0o600 });
+            writeFileSync(tmp, text, { mode: 0o600 });
             chmodSync(tmp, 0o600);
             renameSync(tmp, this.path);
+            this.trouble = undefined;
         }
         catch (err) {
             // A full disk must not take the conversation down with it: the state is
-            // still right in memory, and the next change tries again.
-            console.error(`[state] could not write ${this.path}: ${err.message}`);
+            // still right in memory, and the next change tries again - but until one
+            // does, the store says so (see `trouble`).
+            this.fail(err.message);
+        }
+    }
+    fail(why) {
+        if (this.trouble !== why) {
+            console.error(`[state] NEEDS A PERSON: ${this.path} was not written - ${why}`);
         }
+        this.trouble = why;
     }
 }
 /** Where the stores of one deployment keep their files - or nothing, when it has no directory. */
@@ -114,5 +140,9 @@ export class StateDir {
         for (const f of this.files)
             f.flush();
     }
+    /** The stores whose last write did not happen, and why - for `/healthz/detail`. */
+    troubles() {
+        return Object.fromEntries(this.files.filter((f) => f.trouble).map((f) => [f.path, f.trouble ?? '']));
+    }
 }
 //# sourceMappingURL=state.js.map

package/dist/state.js.map

@@ -1 +1 @@
-{"version":3,"file":"state.js","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,8EAA8E;AAC9E,iCAAiC;AACjC,EAAE;AACF,4EAA4E;AAC5E,gFAAgF;AAChF,4EAA4E;AAC5E,+EAA+E;AAC/E,2EAA2E;AAC3E,8CAA8C;AAC9C,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,yEAAyE;AACzE,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,iEAAiE;AAEjE,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,MAAM,OAAO,SAAS;IAIC;IAHb,KAAK,CAA4C;IACjD,QAAQ,CAA8B;IAE9C,YAAqB,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAErC;;;;;;OAMG;IACH,IAAI;QACF,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,CAAC,WAAW;QAC/B,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,YAAY,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACnD,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,gEAAgE;YAClE,CAAC;YACD,OAAO,CAAC,KAAK,CACX,WAAW,IAAI,CAAC,IAAI,mBAAoB,GAAa,CAAC,OAAO,cAAc,KAAK,EAAE,CACnF,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,kGAAkG;IAClG,IAAI,CAAC,QAAuB;QAC1B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,wCAAwC;IACxC,OAAO;QACL,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QACvB,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,cAAc,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IACvB,CAAC;IAED,wCAAwC;IACxC,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO;QACxB,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAEO,KAAK;QACX,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC3B,IAAI,CAAC;YACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;YAC9C,mEAAmE;YACnE,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACrE,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACtB,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,0DAA0D;YAC1D,OAAO,CAAC,KAAK,CAAC,2BAA2B,IAAI,CAAC,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;CACF;AAED,kGAAkG;AAClG,MAAM,OAAO,QAAQ;IAGE;IAFJ,KAAK,GAAgB,EAAE,CAAC;IAEzC,YAAqB,GAAuB;QAAvB,QAAG,GAAH,GAAG,CAAoB;IAAG,CAAC;IAEhD,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC;IAChC,CAAC;IAED,IAAI,CAAC,IAAY;QACf,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,+DAA+D;IAC/D,KAAK;QACH,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK;YAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACxC,CAAC;CACF"}
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,8EAA8E;AAC9E,iCAAiC;AACjC,EAAE;AACF,4EAA4E;AAC5E,gFAAgF;AAChF,4EAA4E;AAC5E,+EAA+E;AAC/E,2EAA2E;AAC3E,8CAA8C;AAC9C,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,yEAAyE;AACzE,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,iEAAiE;AAEjE,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEhD,MAAM,OAAO,SAAS;IAMC;IALb,KAAK,CAA4C;IACjD,QAAQ,CAA8B;IAC9C,6EAA6E;IAC7E,OAAO,CAAqB;IAE5B,YAAqB,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAErC;;;;;;OAMG;IACH,IAAI;QACF,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,CAAC,WAAW;QAC/B,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,YAAY,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACnD,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,gEAAgE;YAClE,CAAC;YACD,OAAO,CAAC,KAAK,CACX,WAAW,IAAI,CAAC,IAAI,mBAAoB,GAAa,CAAC,OAAO,cAAc,KAAK,EAAE,CACnF,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,kGAAkG;IAClG,IAAI,CAAC,QAAuB;QAC1B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,wCAAwC;IACxC,OAAO;QACL,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QACvB,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,cAAc,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IACvB,CAAC;IAED,wCAAwC;IACxC,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO;QACxB,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAEO,KAAK;QACX,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC3B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7C,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;gBAClC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,yBAAyB,eAAe,oBAAoB,CAAC,CAAC;gBACtF,OAAO;YACT,CAAC;YACD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;YAC9C,mEAAmE;YACnE,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1C,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACtB,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,yEAAyE;YACzE,2CAA2C;YAC3C,IAAI,CAAC,IAAI,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,GAAW;QACtB,IAAI,IAAI,CAAC,OAAO,KAAK,GAAG,EAAE,CAAC;YACzB,OAAO,CAAC,KAAK,CAAC,2BAA2B,IAAI,CAAC,IAAI,sBAAsB,GAAG,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC;IACrB,CAAC;CACF;AAED,kGAAkG;AAClG,MAAM,OAAO,QAAQ;IAGE;IAFJ,KAAK,GAAgB,EAAE,CAAC;IAEzC,YAAqB,GAAuB;QAAvB,QAAG,GAAH,GAAG,CAAoB;IAAG,CAAC;IAEhD,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC;IAChC,CAAC;IAED,IAAI,CAAC,IAAY;QACf,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,+DAA+D;IAC/D,KAAK;QACH,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK;YAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACxC,CAAC;IAED,mFAAmF;IACnF,QAAQ;QACN,OAAO,MAAM,CAAC,WAAW,CACvB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAC1E,CAAC;IACJ,CAAC;CACF"}

package/dist/tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EAOzB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAI7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAgBhD,OAAO,EAIL,KAAK,SAAS,EAGf,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAYV,eAAe,EAIhB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAkExD,+GAA+G;AAC/G,eAAO,MAAM,WAAW,IAAI,CAAC;AAE7B;;;;GAIG;AACH,eAAO,MAAM,UAAU,GACrB,GAAG,SAAS,EACZ,GAAG,UAAU,EACb,OAAM,mBAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IACC,CAAC;AAEjD,mEAAmE;AACnE,eAAO,MAAM,aAAa,GAAI,GAAG,SAAS,EAAE,MAAM,mBAAmB,KAAG,GAAG,CAAC,MAAM,CAM9E,CAAC;AAqqBL,eAAO,MAAM,kBAAkB,GAAI,GAAG,SAAS,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAoNtE,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG;IACrB,OAAO,EAAE,YAAY,CAAC;IACtB;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC9B,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;IACrB,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,0FAA0F;IAC1F,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4FAA4F;IAC5F,EAAE,CAAC,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAssB/E;;;;GAIG;AACH,eAAO,MAAM,eAAe,IAAI,CAAC;AAyJjC;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ,GAAI,MAAM,QAAQ,KAAG,UAMzC,CAAC;AAEF,eAAO,MAAM,UAAU,GACrB,MAAM,QAAQ,EACd,MAAM,MAAM,EACZ,SAAS,OAAO,EAChB,KAAK,WAAW,KACf,OAAO,CAAC,UAAU,CAMpB,CAAC"}
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EAQzB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAI7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAgBhD,OAAO,EAIL,KAAK,SAAS,EAGf,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAYV,eAAe,EAIhB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAkExD,+GAA+G;AAC/G,eAAO,MAAM,WAAW,IAAI,CAAC;AAE7B;;;;GAIG;AACH,eAAO,MAAM,UAAU,GACrB,GAAG,SAAS,EACZ,GAAG,UAAU,EACb,OAAM,mBAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IACC,CAAC;AAEjD,mEAAmE;AACnE,eAAO,MAAM,aAAa,GAAI,GAAG,SAAS,EAAE,MAAM,mBAAmB,KAAG,GAAG,CAAC,MAAM,CAM9E,CAAC;AAqqBL,eAAO,MAAM,kBAAkB,GAAI,GAAG,SAAS,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAoNtE,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG;IACrB,OAAO,EAAE,YAAY,CAAC;IACtB;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC9B,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;IACrB,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,0FAA0F;IAC1F,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4FAA4F;IAC5F,EAAE,CAAC,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAkvB/E;;;;GAIG;AACH,eAAO,MAAM,eAAe,IAAI,CAAC;AAyJjC;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ,GAAI,MAAM,QAAQ,KAAG,UAMzC,CAAC;AAEF,eAAO,MAAM,UAAU,GACrB,MAAM,QAAQ,EACd,MAAM,MAAM,EACZ,SAAS,OAAO,EAChB,KAAK,WAAW,KACf,OAAO,CAAC,UAAU,CAMpB,CAAC"}

package/dist/tools.js

@@ -1,4 +1,4 @@
-import { DEFAULT_PAGE, FULL_CAPABILITIES, LASTING_REQUESTS, MAX_PAGE, REQUEST_KINDS, REQUEST_NOTE_MAX, } from './backend.js';
+import { DEFAULT_PAGE, FULL_CAPABILITIES, LASTING_REQUESTS, MAX_PAGE, REQUEST_KINDS, REQUEST_NOTE_MAX, guestTooLong, } from './backend.js';
 import { isDay, nights as nightsBetween } from './dates.js';
 import { FACILITIES } from './facilities.js';
 import { DESCRIPTION_MAX, POLICY_MAX, hotelText } from './fence.js';
@@ -1340,14 +1340,17 @@ const dateFlex = (dates, stay) => {
 const identity = (deps, ctx, key, args = {}) => {
     const email = str(args.email);
     const member = deps.members.read(key);
+    const own = tripKey(ctx.session, deps.vocab.brand);
     return {
-        // ⚠️ THE CONVERSATION, NOT THE CONNECTION. A card's calls arrive on a
-        // different connection from the conversation's (see trip-ids.ts), so a
-        // booking filed under the raw session was one the card itself could not
-        // find: "Cancel this booking" on the confirmation it had just drawn
-        // answered that no booking matched (2026-09-28 audit). `key` is the trip
-        // key, which the card names and the conversation shares.
-        sessionId: key,
+        // ⚠️ THE CALLER'S OWN SESSION, NEVER THE TRIP IT NAMED. This was the trip
+        // key, so that the card - on a connection of its own - could cancel what
+        // the conversation booked. But a trip id travels in every card answer, and
+        // it opened every booking of that conversation, names and emails and all,
+        // from any connection or none (2026-10-05 audit). A trip id is for the
+        // trip; a booking opens by its conversation, or by its code AND email,
+        // which is what the card now sends.
+        sessionId: own,
+        ...(key !== own ? { tripOwner: key } : {}),
         ...(email ? { email } : {}),
         // ⚠️ THE MEMBER BUYS A RATE, NOT A LOOKUP. `listBookings` and the
         // cancellation tools still key on the conversation and on the email the
@@ -1391,6 +1394,29 @@ const remember = (deps, k, amount) => {
         m.delete(oldest);
     }
 };
+/**
+ * What a backend's refusal says, for the guest - or, when the failure is the
+ * code's own, a sentence that says nothing about the code.
+ *
+ * ⚠️ A REFUSAL IS WORDS FOR THE GUEST; A FAULT IS NOT. Every backend refuses
+ * with a plain Error, or one carrying a `code`, and those words are written to
+ * be read back ("Nothing was booked: ..."). A TypeError's words - "Cannot read
+ * properties of null" - were read back too (2026-10-05 audit); they go to the
+ * log now.
+ */
+const guestWords = (err, fault = 'That could not be done just now - nothing was changed. Try again in a moment.') => {
+    const e = err;
+    if (e instanceof Error && (typeof e.code === 'string' || e.constructor === Error))
+        return e.message;
+    console.error('[tools] failed:', err);
+    return fault;
+};
+/**
+ * A booking's own fault sentence. ⚠️ IT CANNOT SAY "NOTHING WAS CHANGED": the
+ * fault may come after the backend has booked (华住's review, 2026-10-05), and
+ * a guest told nothing happened books again.
+ */
+const BOOKING_FAULT = 'It is not certain whether that booked - list the bookings before asking for it again.';
 /** Said when a lookup has missed too often - see limits.ts. */
 const TOO_MANY_TRIES = 'Too many codes and emails that did not match, so looking a booking up by email is paused for a quarter of an hour. Check the code and the email on the confirmation, then try again.';
 /**
@@ -1401,8 +1427,19 @@ const TOO_MANY_TRIES = 'Too many codes and emails that did not match, so looking
  * email; after a few, lookups by email wait (limits.ts). A lookup of this
  * conversation's own booking, with no email, is never counted and never waits.
  */
-const guarded = async (deps, key, who, run) => {
-    const keys = who.email ? [`lookup|${key}`, `email|${who.email.trim().toLowerCase()}`] : [];
+const guarded = async (deps, ctx, who, code, run) => {
+    // ⚠️ NOT ONLY THE CONVERSATION. Counted against the conversation alone, a
+    // guesser started a new one - or sent none - after every five (2026-10-05
+    // audit). So also against the CODE, which stops "I know the code, let me
+    // guess the email", and the network address, which stops the rest.
+    const keys = who.email
+        ? [
+            `lookup|${who.sessionId}`,
+            `email|${who.email.trim().toLowerCase()}`,
+            ...(code ? [`code|${code.trim().toLowerCase()}`] : []),
+            ...(ctx.ip ? [`ip|${ctx.ip}`] : []),
+        ]
+        : [];
     if (keys.length && deps.misses?.blocked(keys))
         return { found: null, tooMany: true };
     const found = await run();
@@ -2353,7 +2390,7 @@ const answerTool = async (deps, name, rawArgs, ctx) => {
         const code = str(args.booking);
         const who = identity(deps, ctx, key, args);
         const { found, tooMany } = code
-            ? await guarded(deps, key, who, () => deps.backend.findBooking(code, who))
+            ? await guarded(deps, ctx, who, code, () => deps.backend.findBooking(code, who))
             : { found: null, tooMany: false };
         const booked = found && (found.status === 'requested' || found.status === 'confirmed') ? found : undefined;
         if (code && found && !booked) {
@@ -2548,6 +2585,8 @@ const answerTool = async (deps, name, rawArgs, ctx) => {
             !guest.name && 'a name',
             !guest.email.includes('@') && 'an email',
             phoneNeeded && phone.replace(/\D/g, '').length < 6 && 'a phone number',
+            // Too long is as unusable as missing - see GUEST_LIMITS.
+            ...guestTooLong({ ...guest, phone }),
         ].filter((x) => typeof x === 'string');
         if (missing.length) {
             const said = missing.length > 1
@@ -2674,14 +2713,15 @@ const answerTool = async (deps, name, rawArgs, ctx) => {
             };
         }
         catch (err) {
+            const words = guestWords(err, BOOKING_FAULT);
             return {
                 structured: {
                     view: 'error',
                     ...common(deps, key),
                     error: 'not-bookable',
-                    detail: err.message,
+                    detail: words,
                 },
-                text: err.message,
+                text: words,
             };
         }
     }
@@ -2691,7 +2731,7 @@ const answerTool = async (deps, name, rawArgs, ctx) => {
         // Elsewhere, only with the code AND the email - see `listBookings`.
         const code = str(args.booking);
         const { found: there, tooMany } = code && str(args.email)
-            ? await guarded(deps, key, who, () => deps.backend.findBooking(code, who))
+            ? await guarded(deps, ctx, who, code, () => deps.backend.findBooking(code, who))
             : { found: null, tooMany: false };
         const bookings = there && !here.some((b) => b.id === there.id) ? [there, ...here] : here;
         // ⚠️ A MISS IS SAID EVEN WHEN THERE IS SOMETHING TO LIST. With two
@@ -2737,7 +2777,7 @@ const answerTool = async (deps, name, rawArgs, ctx) => {
             ...(str(args.extra) ? { extra: str(args.extra) } : {}),
             ...(typeof args.quantity === 'number' ? { quantity: args.quantity } : {}),
         };
-        const { found: preview, tooMany } = await guarded(deps, key, who, () => deps.backend.previewChange(ref, change, who));
+        const { found: preview, tooMany } = await guarded(deps, ctx, who, ref, () => deps.backend.previewChange(ref, change, who));
         if (!preview) {
             return {
                 structured: {
@@ -2859,13 +2899,13 @@ const answerTool = async (deps, name, rawArgs, ctx) => {
             };
         }
         catch (err) {
-            return { ...asPreview, text: err.message };
+            return { ...asPreview, text: guestWords(err) };
         }
     }
     if (name === t.previewCancellation || name === t.cancelBooking) {
         const ref = str(args.booking);
         const who = identity(deps, ctx, key, args);
-        const { found: preview, tooMany } = await guarded(deps, key, who, () => deps.backend.previewCancellation(ref, who));
+        const { found: preview, tooMany } = await guarded(deps, ctx, who, ref, () => deps.backend.previewCancellation(ref, who));
         if (!preview) {
             return {
                 structured: {
@@ -3051,7 +3091,12 @@ const answerTool = async (deps, name, rawArgs, ctx) => {
         const surname = str(args.surname);
         // Counted like a booking lookup - see limits.ts. A number and a surname
         // read a tier, a point balance and saved preferences.
-        const tries = [`signin|${key}`, `member|${number.replace(/\s+/g, '').toUpperCase()}`];
+        const tries = [
+            `signin|${key}`,
+            `member|${number.replace(/\s+/g, '').toUpperCase()}`,
+            // The network too, as for bookings - see `guarded`.
+            ...(ctx.ip ? [`ip|${ctx.ip}`] : []),
+        ];
         if (deps.misses?.blocked(tries)) {
             return {
                 structured: {