@curless/hotel-storefront 0.43.0 → 0.44.0

package/dist/tools.js

@@ -908,6 +908,20 @@ const CANCEL_SCHEMA = {
         rule: STR,
         freeUntil: STR,
         cancellable: BOOL,
+        /**
+         * What was paid here in advance and what cancelling now gives back of it -
+         * only on a booking paid by card or UnionPay that can be cancelled (`PaidFacts`).
+         */
+        payment: {
+            type: 'object',
+            properties: {
+                method: { enum: ['card', 'unionpay'] },
+                amount: STR,
+                refund: { enum: ['all', 'part', 'none'] },
+                refundAmount: STR,
+            },
+            required: ['method', 'amount', 'refund'],
+        },
         /** The terms as facts, for the card to say in the guest's language (`CancellationPreview`). */
         feeIsCap: BOOL,
         reason: STR,
@@ -1418,6 +1432,19 @@ const bookingForCard = (b) => ({
     quote: quoteForCard(b.quote),
     ...(b.payment ? { payment: { ...b.payment, amount: formatMoney(b.payment.amount) } } : {}),
 });
+const paidFactsOf = (booked, preview) => {
+    const p = booked?.payment;
+    if (!p || p.status !== 'paid' || !preview.cancellable)
+        return undefined;
+    const back = preview.refund.minor;
+    const refund = back <= 0 ? 'none' : back >= p.amount.minor ? 'all' : 'part';
+    return {
+        method: p.method,
+        amount: formatMoney(p.amount),
+        refund,
+        ...(refund === 'part' ? { refundAmount: formatMoney(preview.refund) } : {}),
+    };
+};
 /**
  * A booking paid in advance, as the guest is told it - where its money stands.
  * Undefined for any other booking.
@@ -1483,7 +1510,12 @@ const paidLine = (deps, b, fee) => {
                 // and not read yet (audit, P0-D) - what is said is what is to be done.
                 return unionpay
                     ? `**Not booked yet.** ${amount} is to be confirmed on UnionPay's page by ${p.payByLocal ?? p.payBy} hotel time${p.url ? `: ${p.url}` : ''}. Once UnionPay issues its one-time card, the stay is booked with ${h.name}, who charges that card; not confirmed by then, nothing is booked or charged.`
-                    : `**Not booked yet.** ${amount} is to be paid on the card page by ${p.payByLocal ?? p.payBy} hotel time: ${p.url}. Once it is paid the stay is booked with ${h.name}, and ${deps.tools.listBookings} shows it; unpaid by then, the page closes and nothing is booked or charged.`;
+                    : p.url
+                        ? `**Not booked yet.** ${amount} is to be paid on the card page by ${p.payByLocal ?? p.payBy} hotel time: ${p.url}. Once it is paid the stay is booked with ${h.name}, and ${deps.tools.listBookings} shows it; unpaid by then, the page closes and nothing is booked or charged.`
+                        : // ⚠️ NO LINK IS NOT "undefined" (2026-10-21 re-audit, T2-6): a card
+                            // page that was closed and could not be opened again leaves a stay
+                            // waiting with nowhere to pay it. Say so, and that it lapses.
+                            `**Not booked yet.** ${amount} is to be paid on the card page by ${p.payByLocal ?? p.payBy} hotel time, but the page's link is not available just now - ask again later (${deps.tools.listBookings} shows where it stands). Nothing is booked or charged until it is paid; if no page comes by then, the stay lapses and can be asked for again.`;
             case 'issued':
                 return `Confirmed on UnionPay: ${h.name} is being asked to book it now, and ${deps.tools.listBookings} shows when it has. If ${h.name} does not take it, the one-time card is not charged.`;
             case 'paid':
@@ -3940,8 +3972,18 @@ const answerTool = async (deps, name, rawArgs, ctx) => {
         // each call opens UnionPay's card page or its confirmation through the
         // gateway - fifty of them used up its key's limit for every guest. A
         // guest's own card takes a press, a "continue" and a reopen at most.
+        //
+        // ⚠️ THE STAY'S COUNT IS KEPT PER CODE AND EMAIL, NEVER PER CODE (2026-10-21
+        // re-audit, T2-11). The count is made BEFORE the backend checks the email,
+        // so with the code alone as its key anyone who knew only a code - one is
+        // printed on a confirmation, or read over a shoulder - could ask five times
+        // with any email and use up the stay's quarter of an hour, and the guest's
+        // own press was refused as "too many". Keyed with the email asked, a wrong
+        // email counts against itself: the guest's pair is the guest's alone. The
+        // conversation and the address are counted as before. (The backend counts
+        // a stay's asks too, but only once the pair has matched.)
         const tries = [
-            `unionpay|booking|${code.trim().toLowerCase()}`,
+            `unionpay|booking|${code.trim().toLowerCase()}|${email.trim().toLowerCase()}`,
             `unionpay|session|${who.sessionId}`,
             ...(ctx.ip ? [`ip|unionpay|${ctx.ip}`] : []),
         ];
@@ -4201,6 +4243,8 @@ const answerTool = async (deps, name, rawArgs, ctx) => {
                 ...(booked?.quote.lines.some((l) => l.kind === 'extra') ? { addOnsFree: true } : {}),
             }
             : {};
+        // Money already paid here, and what comes back: see `paidFactsOf`.
+        const paid = paidFactsOf(booked, preview);
         const asPreview = {
             structured: {
                 view: 'cancellation-preview',
@@ -4236,6 +4280,9 @@ const answerTool = async (deps, name, rawArgs, ctx) => {
                 rule: preview.rule,
                 freeUntil: preview.freeUntil,
                 cancellable: preview.cancellable,
+                // What was paid and what comes back - the half of `rule` the card does
+                // not show once it says the terms from the facts below.
+                ...(paid ? { payment: paid } : {}),
                 // The terms as facts, so the card can say them in the guest's language
                 // instead of showing `rule` as the backend wrote it. Money becomes a
                 // string here like `fee`; `free` is a step whose fee is nothing, so the