@danceiny/gotry 0.0.1-rc.8 → 0.2.0-rc.27

package/dist/src/booking-surface/startup.js

@@ -0,0 +1,168 @@
+/** Production composition entry for GoTry's BFF-only Booking Copilot server. */
+import { mkdirSync } from 'node:fs';
+import { isAbsolute, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { ensureLedger } from '../state-ledger.js';
+import { buildDshPlannerEnvironment, createDshEmbeddedBookingPlanner, } from './dsh-planner.js';
+import { BookingCopilotTaskRuntime } from './runtime.js';
+import { BOOKING_COPILOT_INGRESS_MODES } from './contracts.js';
+import { startBookingCopilotServer, } from './server.js';
+const DEFAULT_DEPENDENCIES = {
+    ensureLedger,
+    runtimeFactory: (ledger) => new BookingCopilotTaskRuntime(ledger),
+    createPlanner: createDshEmbeddedBookingPlanner,
+    startServer: startBookingCopilotServer,
+};
+function parsePort(raw) {
+    if (raw === undefined || raw === '')
+        return 3_082;
+    const value = Number(raw);
+    if (!Number.isSafeInteger(value) || value < 0 || value > 65_535)
+        throw new Error('booking_copilot_invalid_port');
+    return value;
+}
+/** Operator-tunable planner deadline; the bounds mirror the planner's own validation. */
+function parsePlannerTurnTimeout(raw) {
+    if (raw === undefined || raw.trim() === '')
+        return undefined;
+    const value = Number(raw);
+    if (!Number.isSafeInteger(value) || value < 1 || value > 120_000) {
+        throw new Error('booking_copilot_planner_timeout_invalid');
+    }
+    return value;
+}
+export function resolveBookingCopilotStartupConfig(env = process.env) {
+    const apiKey = env.GOTRY_BOOKING_COPILOT_API_KEY ?? '';
+    if (!apiKey)
+        throw new Error('booking_copilot_api_key_required');
+    const stateRoot = env.GOTRY_BOOKING_COPILOT_STATE_ROOT ?? '';
+    if (!stateRoot)
+        throw new Error('booking_copilot_state_root_required');
+    if (!isAbsolute(stateRoot))
+        throw new Error('booking_copilot_state_root_must_be_absolute');
+    const artifactId = env.GOTRY_BOOKING_COPILOT_ARTIFACT_ID || undefined;
+    if (artifactId !== undefined && !/^[0-9a-f]{40}$/.test(artifactId)) {
+        throw new Error('booking_copilot_artifact_id_invalid');
+    }
+    const rawIngressMode = env.GOTRY_BOOKING_COPILOT_INGRESS_MODE;
+    const ingressMode = rawIngressMode === undefined || rawIngressMode === '' ? 'bff-bound-turn-only' : rawIngressMode;
+    if (!BOOKING_COPILOT_INGRESS_MODES.includes(ingressMode)) {
+        throw new Error('booking_copilot_ingress_mode_invalid');
+    }
+    return {
+        apiKey,
+        stateRoot,
+        host: env.GOTRY_BOOKING_COPILOT_HOST || '127.0.0.1',
+        port: parsePort(env.GOTRY_BOOKING_COPILOT_PORT),
+        artifactId,
+        plannerTurnTimeoutMs: parsePlannerTurnTimeout(env.GOTRY_BOOKING_COPILOT_PLANNER_TIMEOUT_MS),
+        ingressMode: ingressMode,
+    };
+}
+async function closeAll(server, planner, ledger) {
+    const failures = [];
+    for (const close of [
+        server ? () => server.close() : undefined,
+        planner ? () => planner.close() : undefined,
+        ledger ? () => Promise.resolve(ledger.close()) : undefined,
+    ]) {
+        if (!close)
+            continue;
+        try {
+            await close();
+        }
+        catch (error) {
+            failures.push(error);
+        }
+    }
+    if (failures.length === 1)
+        throw failures[0];
+    if (failures.length > 1)
+        throw new AggregateError(failures, 'booking_copilot_shutdown_failed');
+}
+/**
+ * Boot one process-scoped dsh core and task-scoped sessions behind the typed
+ * HTTP/SSE server. Only the HTTP layer receives the BFF deployment key.
+ */
+export async function startBookingCopilotFromEnvironment(env = process.env, dependencies = DEFAULT_DEPENDENCIES) {
+    const config = resolveBookingCopilotStartupConfig(env);
+    const activeDependencies = dependencies;
+    const hasIngressBinding = Boolean(activeDependencies.ingressBinding);
+    const hasPrincipal = Boolean(activeDependencies.principal);
+    if (hasIngressBinding !== hasPrincipal)
+        throw new Error('booking_copilot_ingress_binding_pair_required');
+    const ingressPair = hasIngressBinding && hasPrincipal;
+    if (ingressPair && env.GOTRY_BOOKING_COPILOT_INGRESS_MODE !== undefined && config.ingressMode === 'bff-bound-turn-only') {
+        throw new Error('booking_copilot_ingress_mode_conflict');
+    }
+    if (!ingressPair && config.ingressMode === 'bff-ingress-binding')
+        throw new Error('booking_copilot_ingress_binding_required');
+    if (ingressPair && (typeof activeDependencies.ingressBinding?.bind !== 'function'
+        || typeof activeDependencies.principal?.subject !== 'string' || activeDependencies.principal.subject.length === 0 || activeDependencies.principal.subject.length > 256
+        || typeof activeDependencies.principal?.scope !== 'string' || activeDependencies.principal.scope.length === 0 || activeDependencies.principal.scope.length > 256)) {
+        throw new Error('booking_copilot_ingress_binding_invalid');
+    }
+    const activeIngressMode = ingressPair ? 'bff-ingress-binding' : 'bff-bound-turn-only';
+    mkdirSync(config.stateRoot, { recursive: true });
+    let ledger;
+    let planner;
+    let server;
+    try {
+        ledger = dependencies.ensureLedger(config.stateRoot);
+        const plannerOptions = {
+            stateRoot: config.stateRoot,
+            env: buildDshPlannerEnvironment(env),
+            ...(config.plannerTurnTimeoutMs === undefined ? {} : { turnTimeoutMs: config.plannerTurnTimeoutMs }),
+        };
+        const runtime = activeDependencies.runtimeFactory(ledger);
+        planner = await activeDependencies.createPlanner(plannerOptions);
+        server = await activeDependencies.startServer({
+            apiKey: config.apiKey, runtime, plannerFactory: planner.plannerFactory,
+            ...(ingressPair ? { ingressBinding: activeDependencies.ingressBinding, principal: activeDependencies.principal } : {}),
+            ingressMode: activeIngressMode,
+            host: config.host, port: config.port, artifactId: config.artifactId,
+        });
+    }
+    catch (error) {
+        try {
+            await closeAll(server, planner, ledger);
+        }
+        catch (cleanupError) {
+            throw new AggregateError([error, cleanupError], 'booking_copilot_startup_and_cleanup_failed');
+        }
+        throw error;
+    }
+    let closed = false;
+    return {
+        port: server.port,
+        async close() {
+            if (closed)
+                return;
+            closed = true;
+            await closeAll(server, planner, ledger);
+        },
+    };
+}
+async function runCli() {
+    const handle = await startBookingCopilotFromEnvironment();
+    process.stderr.write(`[gotry-booking-copilot] listening on http://127.0.0.1:${handle.port}/a2a/booking-copilot/turn\n`);
+    let stopping = false;
+    const stop = () => {
+        if (stopping)
+            return;
+        stopping = true;
+        void handle.close().then(() => process.exit(0), (error) => {
+            process.stderr.write(`[gotry-booking-copilot] shutdown failed: ${error instanceof Error ? error.message : String(error)}\n`);
+            process.exit(1);
+        });
+    };
+    process.once('SIGINT', stop);
+    process.once('SIGTERM', stop);
+}
+const invokedPath = process.argv[1] ? resolve(process.argv[1]) : '';
+if (invokedPath === fileURLToPath(import.meta.url)) {
+    runCli().catch((error) => {
+        process.stderr.write(`[gotry-booking-copilot] startup failed: ${error instanceof Error ? error.message : String(error)}\n`);
+        process.exit(1);
+    });
+}

package/dist/src/booking-surface/validation.js

@@ -0,0 +1,261 @@
+import { readFileSync } from 'node:fs';
+import { Ajv2020 } from 'ajv/dist/2020.js';
+import { BOOKING_READ_ACTION_KINDS, BOOKING_BLOCKER_CODES, BOOKING_GAP_CODES } from './contracts.js';
+const schema = JSON.parse(readFileSync(new URL('../../../schemas/booking.surface.schema.json', import.meta.url), 'utf8'));
+const intentSchema = JSON.parse(readFileSync(new URL('../../../schemas/booking.intent.schema.json', import.meta.url), 'utf8'));
+/** Canonical schema bytes (single source of truth) for prompt/tool derivations elsewhere. */
+export const bookingSurfaceSchema = schema;
+const ajv = new Ajv2020({ allErrors: true, strict: true });
+ajv.addSchema(schema);
+const validate = ajv.compile(schema);
+const validateActionCanonical = ajv.compile({ $ref: `${schema.$id}#/$defs/Action` });
+const validateBlockerCanonical = ajv.compile({ $ref: `${schema.$id}#/$defs/Blocker` });
+const validateApprovalCanonical = ajv.compile({ $ref: `${schema.$id}#/$defs/Approval` });
+const validateEventCanonical = ajv.compile({ $ref: `${schema.$id}#/$defs/Event` });
+const validateIntentCanonical = ajv.compile(intentSchema);
+const kinds = new Set(BOOKING_READ_ACTION_KINDS);
+const codes = new Set(BOOKING_BLOCKER_CODES);
+const gapCodes = new Set(BOOKING_GAP_CODES);
+const safeOpaque = (value) => typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9:._-]*$/.test(value);
+const safeRequestKey = (value) => typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9:._-]{7,127}$/.test(value) && !secret.test(value);
+const secret = /(?:Bearer\s+\S|\bsk-(?!ill(?:s)?\b)[A-Za-z0-9_-]{12,}|\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)/i;
+// `.example` is reserved for documentation, so these identifiers cannot be a
+// real mailbox. Do not allowlist lookalikes on routable domains.
+const technicalEmail = /^(?:schema|version)@[a-z0-9-]+\.example$/i;
+const currencyAmount = /\b(?:[A-Z]{3}\s*\d+(?:\.\d+)?|\d+(?:\.\d+)?\s*[A-Z]{3})\b/;
+const rfc3339DateTime = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,9}))?(Z|([+-])(\d{2}):(\d{2}))$/;
+export function isBookingDateTime(value) {
+    if (typeof value !== 'string')
+        return false;
+    const match = rfc3339DateTime.exec(value);
+    if (!match)
+        return false;
+    const [, yearText, monthText, dayText, hourText, minuteText, secondText] = match;
+    const year = Number(yearText);
+    const month = Number(monthText);
+    const day = Number(dayText);
+    const hour = Number(hourText);
+    const minute = Number(minuteText);
+    const second = Number(secondText);
+    const offsetHour = match[9] === undefined ? 0 : Number(match[9]);
+    const offsetMinute = match[10] === undefined ? 0 : Number(match[10]);
+    if (month < 1 || month > 12 || hour > 23 || minute > 59 || second > 59 || offsetHour > 23 || offsetMinute > 59)
+        return false;
+    const daysInMonth = new Date(Date.UTC(year, month, 0)).getUTCDate();
+    if (day < 1 || day > daysInMonth)
+        return false;
+    return !Number.isNaN(Date.parse(value));
+}
+function normalizedWords(value) {
+    return value.normalize('NFKC').replace(/[^\p{L}\p{N}.]+/gu, ' ').trim();
+}
+function hasSupplierCost(value) {
+    const normalized = normalizedWords(value);
+    const lower = normalized.toLowerCase();
+    return (/\b(?:supplier|vendor|internal)\b/.test(lower) &&
+        /\b(?:cost|rate|price)\b/.test(lower) &&
+        currencyAmount.test(normalized.toUpperCase()));
+}
+function hasInternationalPhone(value) {
+    const normalized = value.normalize('NFKC');
+    for (const plusIndex of normalized.split('').flatMap((char, index) => char === '+' ? [index] : [])) {
+        let digits = '';
+        for (const char of normalized.slice(plusIndex + 1, plusIndex + 48)) {
+            if (/\d/u.test(char))
+                digits += char;
+            else if (/\p{L}|@/u.test(char))
+                break;
+            if (digits.length > 15)
+                break;
+        }
+        if (/^[1-9]\d{7,14}$/.test(digits))
+            return true;
+    }
+    return false;
+}
+function hasPaymentCard(value) {
+    const normalized = value.normalize('NFKC');
+    const candidates = normalized.match(/(?:\d[ -]?){12,18}\d/g) ?? [];
+    const explicitlyLabeled = /\b(?:card|payment|visa|mastercard)\b/i.test(normalized);
+    return candidates.some((candidate) => (explicitlyLabeled || /[ -]/.test(candidate)) && luhn(candidate));
+}
+function hasSensitiveText(value, opts = {}) {
+    const normalized = value.normalize('NFKC');
+    if (normalized.includes('@') && !technicalEmail.test(normalized.trim()))
+        return true;
+    return secret.test(normalized) || hasInternationalPhone(normalized) || hasSupplierCost(normalized) || (!opts.allowOpaqueNumericId && hasPaymentCard(normalized));
+}
+function luhn(value) { const digits = value.replaceAll(/\D/g, ''); if (digits.length < 13 || digits.length > 19)
+    return false; let sum = 0; for (let i = digits.length - 1, parity = 0; i >= 0; i--, parity++) {
+    let n = Number(digits[i]);
+    if (parity % 2 === 1) {
+        n *= 2;
+        if (n > 9)
+            n -= 9;
+    }
+    sum += n;
+} return sum % 10 === 0; }
+const opaqueFieldNames = new Set([
+    'eventId', 'taskId', 'contextRef', 'actionId', 'hotelRef', 'offerRef', 'offerVersionRef', 'checkedOfferVersionRef', 'currentOfferVersionRef', 'verifiedOfferRef',
+    'orderRef', 'searchSessionRef', 'handoffRef', 'questionId', 'blockerId', 'approvalId',
+    'sourceActionId', 'targetActionId', 'sourceTurnId', 'turnId', 'requestKey', 'taskHandle',
+    'nonce', 'deliveryNonce', 'optionDigest', 'sourceReceiptDigest', 'valueDigest',
+]);
+function isOpaqueFieldPath(path) {
+    const clean = path.replace(/\[\]$/g, '');
+    const field = clean.split('.').at(-1);
+    return field ? opaqueFieldNames.has(field) || field.endsWith('Ref') || field.endsWith('Refs') : false;
+}
+const scan = (v, path = '$') => typeof v === 'string'
+    ? hasSensitiveText(v, { allowOpaqueNumericId: isOpaqueFieldPath(path) })
+    : Array.isArray(v)
+        ? v.some((child) => scan(child, `${path}[]`))
+        : !!v && typeof v === 'object'
+            ? Object.entries(v).some(([k, x]) => /cost|price/i.test(k) ? /supplier|internal|wholesale/i.test(String(x)) : scan(x, `${path}.${k}`))
+            : false;
+export function isSafeBookingRequestKey(value) { return safeRequestKey(value); }
+function errors(v) { return (v.errors ?? []).map(e => `${e.instancePath || '$'}: ${e.message ?? e.keyword}`); }
+function workspaceErrors(workspace, path) {
+    const e = [];
+    if (!workspace || typeof workspace !== 'object' || Array.isArray(workspace))
+        return e;
+    const loadedOffers = Array.isArray(workspace.loadedOffers) ? workspace.loadedOffers : [];
+    const offerRefs = loadedOffers.map((offer) => offer?.offerRef).filter((ref) => typeof ref === 'string');
+    const offerVersionRefs = loadedOffers.map((offer) => offer?.offerVersionRef).filter((ref) => typeof ref === 'string');
+    if (new Set(offerRefs).size !== offerRefs.length)
+        e.push(`${path}.loadedOffers: duplicate offerRef`);
+    if (new Set(offerVersionRefs).size !== offerVersionRefs.length)
+        e.push(`${path}.loadedOffers: duplicate offerVersionRef`);
+    const shortlisted = Array.isArray(workspace.shortlistedOfferRefs) ? workspace.shortlistedOfferRefs : [];
+    if (shortlisted.some((ref) => typeof ref !== 'string' || !loadedOffers.some((offer) => offer?.offerRef === ref))) {
+        e.push(`${path}.shortlistedOfferRefs: every ref must be a loaded offer`);
+    }
+    if (workspace.selectedOfferRef !== undefined && !loadedOffers.some((offer) => offer?.offerRef === workspace.selectedOfferRef)) {
+        e.push(`${path}.selectedOfferRef: loaded offer required`);
+    }
+    const verified = workspace.verifiedOffer;
+    if (verified !== undefined) {
+        if (!loadedOffers.some((offer) => offer?.offerRef === verified.offerRef && offer?.offerVersionRef === verified.offerVersionRef))
+            e.push(`${path}.verifiedOffer: loaded offer version required`);
+        if (!safeOpaque(verified.verifiedOfferRef) || !isBookingDateTime(verified.expiresAt))
+            e.push(`${path}.verifiedOffer: safe ref and parseable expiry required`);
+    }
+    return e;
+}
+function cross(value) {
+    const e = [];
+    if (scan(value))
+        e.push('$: unsafe PII/payment/supplier-cost/credential text');
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return e;
+    const x = value;
+    const semantic = x.kind === 'action.receipt.continuation' ? x.receipt : x;
+    if (x.workspace && x.kind !== 'user.turn.ingress')
+        e.push(...workspaceErrors(x.workspace, '$.workspace'));
+    if (x.schemaVersion === 'booking.surface' && Array.isArray(x.loadedOffers))
+        e.push(...workspaceErrors(x, '$'));
+    if (x.kind === 'user.turn.ingress') {
+        if (!safeRequestKey(x.requestKey))
+            e.push('$.requestKey: safe opaque request key required');
+        const workspace = x.workspace;
+        e.push(...workspaceErrors(workspace, '$.workspace'));
+        const visibleHotels = Array.isArray(workspace?.visibleHotels) ? workspace.visibleHotels : [];
+        const loadedOffers = Array.isArray(workspace?.loadedOffers) ? workspace.loadedOffers : [];
+        if (workspace?.focusedHotelRef !== undefined && !visibleHotels.some((hotel) => hotel?.hotelRef === workspace.focusedHotelRef))
+            e.push('$.workspace.focusedHotelRef: visible hotel required');
+        const selectedOffer = workspace?.selectedOfferRef === undefined ? undefined : loadedOffers.find((offer) => offer?.offerRef === workspace.selectedOfferRef);
+        if (workspace?.selectedOfferRef !== undefined && !selectedOffer)
+            e.push('$.workspace.selectedOfferRef: loaded offer required');
+        if (selectedOffer && !visibleHotels.some((hotel) => hotel?.hotelRef === selectedOffer.hotelRef))
+            e.push('$.workspace.selectedOfferRef: offer hotel must be visible');
+    }
+    if (semantic !== x && semantic?.resultContract?.hardCriteriaMet === true && semantic.resultContract.blockers?.length)
+        e.push('$.receipt.resultContract: hardCriteriaMet cannot coexist with blockers');
+    if (kinds.has(x.kind)) {
+        const allowed = {
+            'search.patch': ['patch'], 'search.run': [], 'results.view.patch': ['patch'],
+            'hotel.focus': ['hotelRef'], 'hotel.select': ['hotelRef'],
+            'offers.query': ['hotelRefs', 'criteria'], 'offers.view.patch': ['hotelRef', 'criteria'],
+            'offers.compare': ['offerRefs', 'requestedCount'], 'offer.select': ['offerRef', 'offerVersionRef'],
+            'offer.check': ['offerRef', 'offerVersionRef'], 'checkout.prepare': ['offerRef', 'offerVersionRef', 'verifiedOfferRef'], 'order.observe': ['orderRef'],
+        };
+        const input = x.input;
+        if (!input || typeof input !== 'object' || Array.isArray(input) || Object.keys(input).some(k => !allowed[x.kind].includes(k)))
+            e.push('$.input: closed kind-specific input required');
+    }
+    if (x.kind === 'action.receipt' && x.resultContract?.hardCriteriaMet === true && x.resultContract.blockers?.length)
+        e.push('$.resultContract: hardCriteriaMet cannot coexist with blockers');
+    if (x.kind === 'user.turn' && Array.isArray(x.request?.approval))
+        e.push('$.request.approval: at most one approval');
+    if (x.kind === 'action.receipt' || x.kind === 'action.receipt.continuation') {
+        const r = x.kind === 'action.receipt.continuation' ? x.receipt : x;
+        if (r?.resultContract?.gapCodes?.some((code) => !gapCodes.has(String(code))))
+            e.push('$.resultContract.gapCodes: unregistered gap code');
+        const observation = r?.observation;
+        if (observation?.kind === 'offer.availability') {
+            if (r.status === 'applied' && (observation.available !== true || !observation.verifiedOfferRef || observation.currentOfferVersionRef !== observation.checkedOfferVersionRef || observation.changedFactRefs?.length || observation.gapCodes?.length))
+                e.push('$.observation: applied availability requires unchanged checked/current version, verified ref, and no gaps');
+            if (r.status === 'applied' && (r.resultContract?.outcome !== 'complete' || r.resultContract?.hardCriteriaMet !== true || r.resultContract?.gapCodes?.length || r.resultContract?.blockers?.length))
+                e.push('$.resultContract: applied availability requires complete hard-criteria result without gaps or blockers');
+            if (r.status === 'changed' && (observation.available !== true || !observation.currentOfferVersionRef || observation.currentOfferVersionRef === observation.checkedOfferVersionRef || !observation.changedFactRefs?.length || observation.verifiedOfferRef))
+                e.push('$.observation: changed availability requires available replacement current version without verified ref');
+            if ((r.status === 'unavailable' || r.status === 'no_match') && (observation.available !== false || observation.currentOfferVersionRef || observation.verifiedOfferRef))
+                e.push('$.observation: negative availability must not expose current or verified version');
+            if (r.status !== 'applied' && observation.verifiedOfferRef)
+                e.push('$.observation: only applied availability may expose verified ref');
+        }
+    }
+    const blocker = x.blocker ?? x.question?.blocker;
+    if (blocker && !/^(searchDraft|results|offers|checkout)(\.[A-Za-z][A-Za-z0-9_]*){0,3}$/.test(blocker.criterionPath ?? ''))
+        e.push('$.blocker.criterionPath: closed criterion path required');
+    if (blocker?.evidence?.factRefs && new Set(blocker.evidence.factRefs).size !== blocker.evidence.factRefs.length)
+        e.push('$.blocker.evidence.factRefs: unique refs required');
+    if (x.kind === 'question' && blocker && Array.isArray(x.question?.approvalOptions)) {
+        for (const [i, option] of x.question.approvalOptions.entries()) {
+            const result = validateApprovalAgainstBlocker(option?.approval, blocker);
+            if (!result.ok)
+                e.push(...result.errors.map(error => `$.question.approvalOptions[${i}].${error.slice(2)}`));
+            if (option?.approval?.taskId !== x.taskId)
+                e.push(`$.question.approvalOptions[${i}].approval.taskId: must match event`);
+            if (option?.approval?.contextRef !== x.contextRef)
+                e.push(`$.question.approvalOptions[${i}].approval.contextRef: must match event`);
+        }
+    }
+    if (kinds.has(String(x.kind)) && x.relaxationApprovalRef) {
+        const ref = x.relaxationApprovalRef;
+        if (ref.contextRef !== x.contextRef)
+            e.push('$.relaxationApprovalRef.contextRef: must match action');
+        if (ref.sourceRevision !== x.expectedRevision)
+            e.push('$.relaxationApprovalRef.sourceRevision: must equal action revision');
+        if (ref.targetActionKind !== x.kind)
+            e.push('$.relaxationApprovalRef.targetActionKind: must match action kind');
+        if (ref.targetActionId !== x.actionId)
+            e.push('$.relaxationApprovalRef.targetActionId: must match action id');
+        // Expiry and one-time consumption are runtime concerns; validation checks only structure/binding.
+        if (!safeOpaque(ref.nonce) || !isBookingDateTime(ref.expiresAt))
+            e.push('$.relaxationApprovalRef: invalid expiry or nonce');
+    }
+    if (x.kind === 'question' && (!Array.isArray(x.question?.approvalOptions) || x.question.approvalOptions.length < 1 || x.question.approvalOptions.length > 2))
+        e.push('$.question.approvalOptions: one or two options required');
+    return e;
+}
+export function validateBookingSurface(value) { const ok = validate(value); const e = ok ? [] : errors(validate); e.push(...cross(value)); return e.length ? { ok: false, errors: e } : { ok: true }; }
+function fromCanonical(fn, value) { const ok = fn(value); const e = ok ? [] : errors(fn); e.push(...cross(value)); return e.length ? { ok: false, errors: e } : { ok: true }; }
+export function validateBookingReadAction(value) { return fromCanonical(validateActionCanonical, value); }
+export function validateCriterionBlocker(value) { return fromCanonical(validateBlockerCanonical, value); }
+export function validateRelaxationApproval(value) { return fromCanonical(validateApprovalCanonical, value); }
+export function validateBookingSurfaceEvent(value) { return fromCanonical(validateEventCanonical, value); }
+export function validateBookingIntentProjection(value) { return fromCanonical(validateIntentCanonical, value); }
+export function validateApprovalAgainstBlocker(approval, blocker) {
+    const a = approval;
+    const b = blocker;
+    const blockerResult = validateCriterionBlocker(b);
+    if (!blockerResult.ok)
+        return blockerResult;
+    const approvalResult = validateRelaxationApproval(a);
+    if (!approvalResult.ok)
+        return approvalResult;
+    const fields = ['blockerId', 'sourceActionId', 'sourceReceiptDigest', 'scope', 'code', 'criterionPath', 'valueDigest'];
+    const mismatches = fields.filter(field => a[field] !== b?.[field]);
+    return mismatches.length ? { ok: false, errors: mismatches.map(field => `$.${field}: approval does not match blocker`) } : { ok: true };
+}

package/dist/src/bridge.js

@@ -1,34 +1,41 @@
+/**
+ * GoTry 桥接工具集(纯 Node 版,无 Python 依赖):
+ *   - ensureStateDir: 状态目录创建
+ *   - recordLatency: 延迟日志追加
+ *   - readJson / writeJson: JSON 文件安全读写
+ *
+ * 历史:曾有 callFeasibilityEngine 用 spawn(.venv/bin/python) 起 Python CLI,
+ * 作为 TS 求解的回退路径。D-7 切轨后 unified solveChoiceSegment 是唯一求解入口,
+ * Python oracle 路径于 v0.0.1-rc.2 移除——npm 一键分发不再需要 Python 运行时依赖。
+ */
 import { appendFile, mkdir, readFile, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
+/** 状态目录:动机画像 / wish pool 的落盘位置(红线 6:用户数据可见、可编辑、可删除) */
 export async function ensureStateDir(root) {
     const dir = join(root, 'gotry-state');
-    await mkdir(dir, {
-        recursive: true
-    });
+    await mkdir(dir, { recursive: true });
     return dir;
 }
+/** JSON 安全读取:文件不存在返回 fallback,解析失败抛错 */
 export async function readJson(path, fallback) {
     try {
         const text = await readFile(path, 'utf-8');
         return JSON.parse(text);
-    } catch (e) {
-        if (e.code === 'ENOENT') return fallback;
+    }
+    catch (e) {
+        if (e.code === 'ENOENT')
+            return fallback;
         throw e;
     }
 }
+/** JSON 原子写入 */
 export async function writeJson(path, value) {
     const tmp = `${path}.tmp`;
     await writeFile(tmp, JSON.stringify(value, null, 2), 'utf-8');
     const { rename } = await import('node:fs/promises');
     await rename(tmp, path);
 }
+/** 桥接延迟日志(追加式;T5 成本工程的度量数据源之一) */
 export async function recordLatency(logPath, latencyMs, kind) {
-    await appendFile(logPath, JSON.stringify({
-        ts: new Date().toISOString(),
-        kind,
-        latencyMs
-    }) + '\n');
+    await appendFile(logPath, JSON.stringify({ ts: new Date().toISOString(), kind, latencyMs }) + '\n');
 }
-
-
-//# sourceURL=/Users/bytedance/work/gotry/ts/src/bridge.ts

package/dist/src/companions.js

@@ -0,0 +1,86 @@
+/**
+ * 同行人档案(memory-design M5 层,P2):同行人及其约束(行动/健康/偏好)的持久化。
+ *
+ * 立场(memory-design §1):
+ *  - 溯源 P0:每条约束伴 evidence(用户原话),追加不删史;
+ *  - 约束只进排序与行程结构建议,永不进硬过滤;
+ *  - **负面清单守卫**:证件号/电话/地址等敏感字段拒收入库(需要时后端从登录态
+ *    填充,fail-closed)——health 存的是「高血压/晕车」这类行为约束,不是病历;
+ *  - upsert 合并语义同 mergeProfile:追加不删史/同内容幂等。
+ */
+/** 负面清单:命中即拒收(红线 6 + 隐私立场) */
+const SENSITIVE_PATTERNS = [
+    { re: /\d{15,17}[Xx]?/, label: '疑似证件号/卡号' },
+    { re: /1[3-9]\d{9}/, label: '疑似手机号' },
+    { re: /(护照|身份证|证件号|通行证)\s*号?\s*[:：]?\s*\w+/i, label: '证件信息' },
+];
+/** 守门:内容命中负面清单 → 返回拒收理由;否则 null */
+export function sensitiveViolation(text) {
+    for (const { re, label } of SENSITIVE_PATTERNS) {
+        if (re.test(text))
+            return `负面清单拒收:${label}不入库(需要时由后端从登录态填充)`;
+    }
+    return null;
+}
+/** 稳定主键:label 去空白 */
+export function companionId(label) {
+    return label.replace(/\s+/g, '');
+}
+function mergeStrArray(oldArr, newArr) {
+    const a = oldArr ?? [];
+    let added = false;
+    for (const x of newArr ?? []) {
+        if (!a.includes(x)) {
+            a.push(x);
+            added = true;
+        }
+    }
+    return { merged: a, added };
+}
+/**
+ * upsert 合并(纯函数,不改入参):同 companion_id 按 label 归并——
+ * constraints 逐字段取新值(新值覆盖旧行为约束,追加数组项),evidence 追加不删史,
+ * 全量无新增 → 幂等 no-op(appended:false)。
+ */
+export function upsertCompanion(profiles, patch) {
+    if (!patch.label?.trim())
+        return { profiles, appended: false, companionId: '', reason: 'label 必填' };
+    const violation = sensitiveViolation(JSON.stringify(patch));
+    if (violation)
+        return { profiles, appended: false, companionId: '', reason: violation };
+    const id = companionId(patch.label);
+    const existing = profiles.find(p => p.companion_id === id);
+    if (!existing) {
+        const full = {
+            schema: 'companion_profile.v1',
+            companion_id: id,
+            label: patch.label.trim(),
+            constraints: {
+                mobility: patch.constraints.mobility,
+                health: patch.constraints.health ? [...patch.constraints.health] : undefined,
+                prefs: patch.constraints.prefs ? [...patch.constraints.prefs] : undefined,
+            },
+            evidence: [patch.evidence],
+            ts: new Date().toISOString(),
+        };
+        return { profiles: [...profiles, full], appended: true, companionId: id };
+    }
+    const mergedConstraints = {
+        mobility: patch.constraints.mobility ?? existing.constraints.mobility,
+        health: mergeStrArray(existing.constraints.health, patch.constraints.health).merged,
+        prefs: mergeStrArray(existing.constraints.prefs, patch.constraints.prefs).merged,
+    };
+    const ev = mergeStrArray(existing.evidence, [patch.evidence]);
+    const healthLen = mergedConstraints.health?.length ?? 0;
+    const prefsLen = mergedConstraints.prefs?.length ?? 0;
+    const changed = mergedConstraints.mobility !== existing.constraints.mobility ||
+        healthLen !== (existing.constraints.health?.length ?? 0) ||
+        prefsLen !== (existing.constraints.prefs?.length ?? 0) ||
+        ev.added;
+    if (!changed)
+        return { profiles, appended: false, companionId: id };
+    const next = profiles.map(p => p.companion_id === id
+        ? { ...p, constraints: mergedConstraints, evidence: ev.merged, ts: new Date().toISOString() }
+        : p);
+    return { profiles: next, appended: true, companionId: id };
+}

package/dist/src/contracts.js

@@ -1,64 +1,42 @@
+/**
+ * Stage 1 契约层(S1,docs/design/stage1-top-down-design.md §2)——顶层数据与工具面契约。
+ *
+ * 自顶向下纪律:本文件是唯一权威契约。实现(mock 循环/求解器挂载/真 LLM)都向这里对齐;
+ * 契约变更需走设计文档升版,不随实现漂移。
+ * 责任铁律:LLM 只做问句组织/翻译/解释;判定与算术永远是确定性组件。
+ */
+/** 工具注册表:名字 → IO 类型(dsh 插件按此生成 parameters/output schema) */
 export const TOOL_CONTRACTS = {
     'gotry_interview_next': {},
     'gotry_spec_extract': {},
     'gotry_solve': {},
     'gotry_render': {},
-    'gotry_wish_pool_add': {}
+    'gotry_wish_pool_add': {},
 };
+// ---- wire schema(dsh 注册用的 JSON Schema 面;type:'json' 根 + 关键字段文档) ----
 export const TRIP_STATE_JSON_SCHEMA = {
     type: 'object',
     additionalProperties: false,
     properties: {
         calendar: {
-            type: 'object',
-            additionalProperties: true,
-            description: '年份与已断言的星期映射;一次断言终身使用,冲突必须显式指出'
+            type: 'object', additionalProperties: true,
+            description: '年份与已断言的星期映射;一次断言终身使用,冲突必须显式指出',
         },
         profile: {
-            type: 'object',
-            additionalProperties: true,
-            description: 'workWindow(带 evidence)/companions/budgetTier/bookedResources/motivation'
-        },
-        spec: {
-            type: 'json',
-            description: '统一行程模型 JourneySpec(见 unified.ts)'
-        },
-        solve: {
-            type: 'json',
-            description: '求解结果(锚点/排除/红旗/建议)'
+            type: 'object', additionalProperties: true,
+            description: 'workWindow(带 evidence)/companions/budgetTier/bookedResources/motivation',
         },
+        spec: { type: 'json', description: '统一行程模型 JourneySpec(见 unified.ts)' },
+        solve: { type: 'json', description: '求解结果(锚点/排除/红旗/建议)' },
         gates: {
             type: 'array',
             description: '待决问题,只能是选择题',
             items: {
-                type: 'object',
-                additionalProperties: true,
-                properties: {
-                    id: {
-                        type: 'string'
-                    },
-                    question: {
-                        type: 'string'
-                    }
-                }
-            }
+                type: 'object', additionalProperties: true,
+                properties: { id: { type: 'string' }, question: { type: 'string' } },
+            },
         },
-        wishes: {
-            type: 'array',
-            description: '「下一次出发」清单',
-            items: {
-                type: 'object',
-                additionalProperties: true
-            }
-        }
+        wishes: { type: 'array', description: '「下一次出发」清单', items: { type: 'object', additionalProperties: true } },
     },
-    required: [
-        'calendar',
-        'profile',
-        'gates',
-        'wishes'
-    ]
+    required: ['calendar', 'profile', 'gates', 'wishes'],
 };
-
-
-//# sourceURL=/Users/bytedance/work/gotry/ts/src/contracts.ts