@ketvietlab/ketsuite 0.1.2 → 0.1.5

package/dist/modules/website_form/routes.js

@@ -31,6 +31,8 @@ const sameOrigin = (req) => {
         return false;
     }
 };
+/** Every encoding a browser or client may use for a ticked consent box. */
+const CONSENT_GIVEN = new Set(['true', 'on', 'yes', '1']);
 export const routes = {
     '/website/forms/{id}/submit': {
         anonymous: true,
@@ -43,22 +45,54 @@ export const routes = {
                 const raw = await bodyOf(req);
                 const body = raw && typeof raw === 'object' && !Array.isArray(raw) ? raw : {};
                 const isJsonPayload = body.payload && typeof body.payload === 'object' && !Array.isArray(body.payload);
-                const reserved = new Set(['payload', 'consent', 'honeypot', 'source', 'submissionKey']);
+                // The version travels as a hidden input on a form-encoded post, so its
+                // transport name has to be reserved — otherwise it lands in the payload
+                // and is reported back as a field the form should not have.
+                //
+                // `_schemaVersion`, not `schemaVersion`: a form field name must start
+                // with a letter (see validateSchema), so a leading underscore is a name
+                // no form can declare. Reserving the bare name instead would have made
+                // a form with a `schemaVersion` question answer 409 for ever — its
+                // answer stripped from the payload and reparsed as a contract number.
+                const reserved = new Set([
+                    'payload',
+                    'consent',
+                    'honeypot',
+                    'source',
+                    'submissionKey',
+                    '_schemaVersion',
+                ]);
                 const payload = isJsonPayload
                     ? body.payload
                     : Object.fromEntries(Object.entries(body).filter(([key]) => !reserved.has(key)));
                 const remote = `${req.socket.remoteAddress ?? 'unknown'}:${String(req.headers['user-agent'] ?? '').slice(0, 200)}`;
+                // A form post carries strings. Only a well-formed version opts into the
+                // staleness check; anything else behaves as it did before versioning.
+                const declaredVersion = Number(body._schemaVersion);
+                const schemaVersion = Number.isInteger(declaredVersion) && declaredVersion > 0 ? declaredVersion : null;
                 const result = (await ctx.call('website_form.submitForm', {
                     formId: params.id,
                     payload,
-                    consent: body.consent === true || body.consent === 'true' || body.consent === '1',
+                    // A checked checkbox named `consent`, with no value attribute,
+                    // posts "on" — the HTML default. Rejecting it told a visitor who
+                    // had ticked the box that they must agree. (Spelling the tag out
+                    // here would trip the repository's autocomplete contract scan,
+                    // which reads source text rather than markup.)
+                    consent: CONSENT_GIVEN.has(typeof body.consent === 'boolean'
+                        ? String(body.consent)
+                        : String(body.consent ?? '').toLowerCase()),
                     honeypot: String(body.honeypot ?? ''),
                     source: String(body.source ?? req.headers.referer ?? url.pathname).slice(0, 2_048),
                     rateKey: remote,
                     submissionKey: String(req.headers['idempotency-key'] ?? body.submissionKey ?? '') || null,
+                    schemaVersion,
                 }, url, req));
                 const limited = result.errors?.some((error) => error.message === 'website_form.error.rateLimit');
-                return json(result, { status: result.ok ? 200 : limited ? 429 : 422 });
+                // 409, not 422: nothing is wrong with what the visitor typed, the form
+                // they typed it into moved. The client should reload, not edit.
+                const stale = result.errors?.some((error) => error.message === 'website_form.error.staleForm' ||
+                    error.message === 'website_form.error.consentVersionRequired');
+                return json(result, { status: result.ok ? 200 : limited ? 429 : stale ? 409 : 422 });
             }
             catch (error) {
                 const code = error instanceof Error ? error.message : 'invalid_request';

package/dist/modules/website_form/routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../../../../../../packages/ketsuite/src/modules/website_form/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAA;AAKxC,MAAM,MAAM,GAAG,KAAK,EAAE,GAAQ,EAAoB,EAAE;IAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAA;IAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,EAAE,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;IAC3F,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,CAAA;QAC9C,IAAI,IAAI,KAAK,CAAC,UAAU,CAAA;QACxB,IAAI,IAAI,GAAG,EAAE,GAAG,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;QAC1D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IACpE,IAAI,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACxE,IAAI,IAAI,CAAC,QAAQ,CAAC,mCAAmC,CAAC;QAAE,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAA;IAC3G,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;AAC3C,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,GAAQ,EAAW,EAAE;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;IAC/C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,MAAM,GAA+B;IAChD,4BAA4B,EAAE;QAC5B,SAAS,EAAE,IAAI;QACf,OAAO,EACL,CAAC,GAAiB,EAAS,EAAE,CAC7B,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;YACzB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAClG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC1F,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC7B,MAAM,IAAI,GACR,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAA+B,CAAC,CAAC,CAAC,EAAE,CAAA;gBAC/F,MAAM,aAAa,GACjB,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBAClF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAA;gBACvF,MAAM,OAAO,GAAG,aAAa;oBAC3B,CAAC,CAAC,IAAI,CAAC,OAAO;oBACd,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;gBAClF,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAA;gBAClH,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAC5B,yBAAyB,EACzB;oBACE,MAAM,EAAE,MAAM,CAAC,EAAE;oBACjB,OAAO;oBACP,OAAO,EAAE,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,KAAK,GAAG;oBACjF,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;oBACrC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;oBAClF,OAAO,EAAE,MAAM;oBACf,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,IAAI,IAAI;iBAC1F,EACD,GAAG,EACH,GAAG,CACJ,CAA2D,CAAA;gBAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,8BAA8B,CAAC,CAAA;gBAChG,OAAO,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;YACxE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAA;gBACvE,IAAI,IAAI,KAAK,mBAAmB;oBAAE,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;gBACnF,IAAI,IAAI,KAAK,wBAAwB;oBAAE,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;gBACxF,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YACtE,CAAC;QACH,CAAC;KACJ;CACF,CAAA"}
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../../../../../../packages/ketsuite/src/modules/website_form/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAA;AAKxC,MAAM,MAAM,GAAG,KAAK,EAAE,GAAQ,EAAoB,EAAE;IAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAA;IAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,EAAE,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;IAC3F,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,CAAA;QAC9C,IAAI,IAAI,KAAK,CAAC,UAAU,CAAA;QACxB,IAAI,IAAI,GAAG,EAAE,GAAG,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;QAC1D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IACpE,IAAI,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACxE,IAAI,IAAI,CAAC,QAAQ,CAAC,mCAAmC,CAAC;QAAE,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAA;IAC3G,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;AAC3C,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,GAAQ,EAAW,EAAE;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;IAC/C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,CAAA;AAED,2EAA2E;AAC3E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAA;AAEzD,MAAM,CAAC,MAAM,MAAM,GAA+B;IAChD,4BAA4B,EAAE;QAC5B,SAAS,EAAE,IAAI;QACf,OAAO,EACL,CAAC,GAAiB,EAAS,EAAE,CAC7B,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;YACzB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAClG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC1F,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC7B,MAAM,IAAI,GACR,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAA+B,CAAC,CAAC,CAAC,EAAE,CAAA;gBAC/F,MAAM,aAAa,GACjB,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBAClF,uEAAuE;gBACvE,wEAAwE;gBACxE,4DAA4D;gBAC5D,EAAE;gBACF,sEAAsE;gBACtE,wEAAwE;gBACxE,uEAAuE;gBACvE,mEAAmE;gBACnE,sEAAsE;gBACtE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;oBACvB,SAAS;oBACT,SAAS;oBACT,UAAU;oBACV,QAAQ;oBACR,eAAe;oBACf,gBAAgB;iBACjB,CAAC,CAAA;gBACF,MAAM,OAAO,GAAG,aAAa;oBAC3B,CAAC,CAAC,IAAI,CAAC,OAAO;oBACd,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;gBAClF,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAA;gBAClH,wEAAwE;gBACxE,sEAAsE;gBACtE,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;gBACnD,MAAM,aAAa,GACjB,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAA;gBACnF,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAC5B,yBAAyB,EACzB;oBACE,MAAM,EAAE,MAAM,CAAC,EAAE;oBACjB,OAAO;oBACP,+DAA+D;oBAC/D,iEAAiE;oBACjE,iEAAiE;oBACjE,+DAA+D;oBAC/D,+CAA+C;oBAC/C,OAAO,EAAE,aAAa,CAAC,GAAG,CACxB,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS;wBAC/B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;wBACtB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAC7C;oBACD,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;oBACrC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;oBAClF,OAAO,EAAE,MAAM;oBACf,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,IAAI,IAAI;oBACzF,aAAa;iBACd,EACD,GAAG,EACH,GAAG,CACJ,CAA2D,CAAA;gBAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,8BAA8B,CAAC,CAAA;gBAChG,uEAAuE;gBACvE,gEAAgE;gBAChE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAC/B,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,OAAO,KAAK,8BAA8B;oBAChD,KAAK,CAAC,OAAO,KAAK,2CAA2C,CAChE,CAAA;gBACD,OAAO,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;YACtF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAA;gBACvE,IAAI,IAAI,KAAK,mBAAmB;oBAAE,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;gBACnF,IAAI,IAAI,KAAK,wBAAwB;oBAAE,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;gBACxF,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YACtE,CAAC;QACH,CAAC;KACJ;CACF,CAAA"}

package/dist/modules/website_form_mail/index.d.ts

@@ -0,0 +1,36 @@
+import type { FnSpec } from '@ketvietlab/ketjs';
+/**
+ * Telling an operator a form submission arrived — without putting the
+ * submission in an email.
+ *
+ * `mail_transport` already owns the outbox: Delivery, retry, dead-letter and
+ * the provider events. This module is only the bridge, so `website_form` keeps
+ * no delivery state of its own and no second ledger appears.
+ *
+ * The notification says which form, on which site, when, and where to open it.
+ * It carries nothing the visitor typed, and that is a deliberate boundary
+ * rather than a default nobody chose:
+ *
+ *   - A Delivery stores an immutable body snapshot. Putting the payload in the
+ *     mail would persist contact data a second time, in another module, in a
+ *     row that cannot be edited or purged — while the submission itself is
+ *     under a retention policy that promises exactly that.
+ *   - `Form.notifyTo` is checked for the shape of an email address and nothing
+ *     else. Anyone who may edit a form may point it anywhere. With a bare
+ *     notification, doing so leaks that a form was submitted; with the payload,
+ *     it is a standing export of everyone's contact details.
+ *   - The consent notice a visitor agreed to does not mention an email copy,
+ *     and under the versioning contract, changing it to say so would
+ *     invalidate every page currently open.
+ *
+ * Widening this later is additive — a template may ask for more keys once
+ * SAFE_KEYS grows. Narrowing it is not: mail that has been sent cannot be
+ * recalled from a mailbox, a forward, or a provider's storage.
+ */
+/** Every key this bridge will ever put in a template context. */
+export declare const SAFE_KEYS: readonly ["siteTitle", "formName", "submissionId", "receivedAt", "adminUrl"];
+declare const functions: Record<string, FnSpec>;
+declare const _default: import("@ketvietlab/ketjs").KetModule;
+export default _default;
+export { functions };
+//# sourceMappingURL=index.d.ts.map

package/dist/modules/website_form_mail/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../packages/ketsuite/src/modules/website_form_mail/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAO,MAAM,EAAO,MAAM,mBAAmB,CAAA;AAGzD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,iEAAiE;AACjE,eAAO,MAAM,SAAS,8EAMX,CAAA;AAyCX,QAAA,MAAM,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAuCrC,CAAA;;;AAwBD,OAAO,EAAE,SAAS,EAAE,CAAA"}

package/dist/modules/website_form_mail/index.js

@@ -0,0 +1,137 @@
+import { defineModule, eq, from, KetError } from '@ketvietlab/ketjs';
+import { queueTemplate } from '../mail_transport/index.js';
+/**
+ * Telling an operator a form submission arrived — without putting the
+ * submission in an email.
+ *
+ * `mail_transport` already owns the outbox: Delivery, retry, dead-letter and
+ * the provider events. This module is only the bridge, so `website_form` keeps
+ * no delivery state of its own and no second ledger appears.
+ *
+ * The notification says which form, on which site, when, and where to open it.
+ * It carries nothing the visitor typed, and that is a deliberate boundary
+ * rather than a default nobody chose:
+ *
+ *   - A Delivery stores an immutable body snapshot. Putting the payload in the
+ *     mail would persist contact data a second time, in another module, in a
+ *     row that cannot be edited or purged — while the submission itself is
+ *     under a retention policy that promises exactly that.
+ *   - `Form.notifyTo` is checked for the shape of an email address and nothing
+ *     else. Anyone who may edit a form may point it anywhere. With a bare
+ *     notification, doing so leaks that a form was submitted; with the payload,
+ *     it is a standing export of everyone's contact details.
+ *   - The consent notice a visitor agreed to does not mention an email copy,
+ *     and under the versioning contract, changing it to say so would
+ *     invalidate every page currently open.
+ *
+ * Widening this later is additive — a template may ask for more keys once
+ * SAFE_KEYS grows. Narrowing it is not: mail that has been sent cannot be
+ * recalled from a mailbox, a forward, or a provider's storage.
+ */
+/** Every key this bridge will ever put in a template context. */
+export const SAFE_KEYS = Object.freeze([
+    'siteTitle',
+    'formName',
+    'submissionId',
+    'receivedAt',
+    'adminUrl',
+]);
+const effects = [
+    'read:website_form.Form',
+    'read:website_form.FormSubmission',
+    'read:website.Site',
+    'read:mail_transport.Template',
+    'read:mail_transport.Delivery',
+    'write:mail_transport.Delivery',
+    'write:mail_transport.DeliveryNotification',
+    'enqueue:mail_transport.deliver',
+];
+const fail = (code, message) => {
+    throw new KetError({ code, module: 'website_form_mail', message });
+};
+/** An http(s) origin, and only that: the link is built here, not accepted here. */
+const originOf = (value) => {
+    try {
+        const url = new URL(String(value));
+        if (url.protocol !== 'http:' && url.protocol !== 'https:')
+            throw new Error('scheme');
+        return url.origin;
+    }
+    catch {
+        return fail('E_WEBSITE_FORM_MAIL_URL', 'baseUrl must be an http(s) origin');
+    }
+};
+/**
+ * Build the context from the allowlist rather than from the record.
+ *
+ * Reading keys off the submission and deleting the unsafe ones would put the
+ * safety in a list that has to be kept in step with the schema. Building it the
+ * other way round means a field added to a form tomorrow cannot appear here.
+ */
+const safeContext = (values) => {
+    const context = {};
+    for (const key of SAFE_KEYS)
+        context[key] = values[key];
+    return context;
+};
+const functions = {
+    notifySubmission: {
+        input: { submissionId: 'id', templateId: 'id', baseUrl: 'text' },
+        output: { deliveryId: 'id', to: 'text' },
+        effects,
+        idempotent: true,
+        handler: (ctx, args) => ctx.tx(async (tx) => {
+            const S = tx.table('website_form.FormSubmission');
+            const submission = await tx.db.one(from(S).where(eq(S.id, args.submissionId)));
+            if (!submission)
+                return fail('E_WEBSITE_FORM_MAIL_SUBMISSION', 'form submission is missing or out of scope');
+            const F = tx.table('website_form.Form');
+            const form = (await tx.db.one(from(F).where(eq(F.id, submission.formId))));
+            if (!form)
+                return fail('E_WEBSITE_FORM_MAIL_FORM', 'the form that owns this submission is missing');
+            const to = String(form.notifyTo ?? '').trim();
+            if (!to)
+                return fail('E_WEBSITE_FORM_MAIL_DESTINATION', 'the form has nobody to notify');
+            const Site = tx.table('website.Site');
+            const site = await tx.db.one(from(Site).where(eq(Site.id, form.siteId)));
+            const origin = originOf(args.baseUrl);
+            const delivery = await queueTemplate(tx, {
+                // Derived from the submission, so a retry queues nothing new.
+                id: `website-form:${String(submission.id)}`,
+                templateId: String(args.templateId),
+                to: [{ address: to }],
+                context: safeContext({
+                    siteTitle: String(site?.title ?? ''),
+                    formName: String(form.name ?? ''),
+                    submissionId: String(submission.id),
+                    receivedAt: String(submission.createdAt ?? ''),
+                    adminUrl: `${origin}/admin/website/forms/${encodeURIComponent(String(form.id))}/submissions/${encodeURIComponent(String(submission.id))}`,
+                }),
+            });
+            return { deliveryId: delivery.id, to };
+        }),
+    },
+};
+export default defineModule({
+    name: 'website_form_mail',
+    version: '0.1.0',
+    title: 'Thông báo biểu mẫu',
+    summary: 'Báo cho người phụ trách khi có yêu cầu mới, không gửi kèm nội dung khách điền.',
+    category: 'Website',
+    messages: {
+        vi: {
+            'app.title': 'Thông báo biểu mẫu',
+            'app.summary': 'Báo cho người phụ trách khi có yêu cầu mới, không gửi kèm nội dung khách điền.',
+            'app.category': 'Website',
+        },
+        en: {
+            'app.title': 'Form notifications',
+            'app.summary': 'Tell the owner a request arrived, without mailing what the visitor wrote.',
+            'app.category': 'Website',
+        },
+    },
+    depends: ['website_form', 'mail_transport'],
+    functions,
+});
+export { functions };
+//# sourceMappingURL=index.js.map

package/dist/modules/website_form_mail/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../packages/ketsuite/src/modules/website_form_mail/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAEpE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,iEAAiE;AACjE,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;IACrC,WAAW;IACX,UAAU;IACV,cAAc;IACd,YAAY;IACZ,UAAU;CACF,CAAC,CAAA;AAEX,MAAM,OAAO,GAAG;IACd,wBAAwB;IACxB,kCAAkC;IAClC,mBAAmB;IACnB,8BAA8B;IAC9B,8BAA8B;IAC9B,+BAA+B;IAC/B,2CAA2C;IAC3C,gCAAgC;CACjC,CAAA;AAED,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,OAAe,EAAS,EAAE;IACpD,MAAM,IAAI,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,CAAA;AACpE,CAAC,CAAA;AAED,mFAAmF;AACnF,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAU,EAAE;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;QAClC,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAA;QACpF,OAAO,GAAG,CAAC,MAAM,CAAA;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,yBAAyB,EAAE,mCAAmC,CAAC,CAAA;IAC7E,CAAC;AACH,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,WAAW,GAAG,CAAC,MAAkD,EAA0B,EAAE;IACjG,MAAM,OAAO,GAA2B,EAAE,CAAA;IAC1C,KAAK,MAAM,GAAG,IAAI,SAAS;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACvD,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,SAAS,GAA2B;IACxC,gBAAgB,EAAE;QAChB,KAAK,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE;QAChE,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE;QACxC,OAAO;QACP,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,CAAC,GAAQ,EAAE,IAAI,EAAE,EAAE,CAC1B,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAClB,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAA;YACjD,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;YAC9E,IAAI,CAAC,UAAU;gBACb,OAAO,IAAI,CAAC,gCAAgC,EAAE,4CAA4C,CAAC,CAAA;YAE7F,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAA;YACvC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAe,CAAA;YACxF,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC,0BAA0B,EAAE,+CAA+C,CAAC,CAAA;YACnG,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YAC7C,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,iCAAiC,EAAE,+BAA+B,CAAC,CAAA;YAExF,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;YACrC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;YACxE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAErC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE;gBACvC,8DAA8D;gBAC9D,EAAE,EAAE,gBAAgB,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE;gBAC3C,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;gBACnC,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;gBACrB,OAAO,EAAE,WAAW,CAAC;oBACnB,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;oBACpC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;oBACjC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;oBACnC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC;oBAC9C,QAAQ,EAAE,GAAG,MAAM,wBAAwB,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,gBAAgB,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE;iBAC1I,CAAC;aACH,CAAC,CAAA;YACF,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,CAAA;QACxC,CAAC,CAAC;KACL;CACF,CAAA;AAED,eAAe,YAAY,CAAC;IAC1B,IAAI,EAAE,mBAAmB;IACzB,OAAO,EAAE,OAAO;IAChB,KAAK,EAAE,oBAAoB;IAC3B,OAAO,EAAE,gFAAgF;IACzF,QAAQ,EAAE,SAAS;IACnB,QAAQ,EAAE;QACR,EAAE,EAAE;YACF,WAAW,EAAE,oBAAoB;YACjC,aAAa,EAAE,gFAAgF;YAC/F,cAAc,EAAE,SAAS;SAC1B;QACD,EAAE,EAAE;YACF,WAAW,EAAE,oBAAoB;YACjC,aAAa,EAAE,2EAA2E;YAC1F,cAAc,EAAE,SAAS;SAC1B;KACF;IACD,OAAO,EAAE,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAC3C,SAAS;CACV,CAAC,CAAA;AAEF,OAAO,EAAE,SAAS,EAAE,CAAA"}

package/dist/modules/website_hospitality/channel-routes.d.ts

@@ -0,0 +1,2 @@
+export declare const channelRoutes: Record<string, import("@ketvietlab/ketjs").RouteEntry>;
+//# sourceMappingURL=channel-routes.d.ts.map

package/dist/modules/website_hospitality/channel-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-routes.d.ts","sourceRoot":"","sources":["../../../../../../packages/ketsuite/src/modules/website_hospitality/channel-routes.ts"],"names":[],"mappings":"AAwIA,eAAO,MAAM,aAAa,wDAwRzB,CAAA"}

package/dist/modules/website_hospitality/channel-routes.js

@@ -0,0 +1,355 @@
+import { channelCommandId, channelError, defineChannelRoute, routesOf } from '../channel_api/core.js';
+import { channelRealmContext } from '../channel_api/customer.js';
+const object = { type: 'object' };
+const envelope = { type: 'object', properties: { data: {}, error: {}, meta: object } };
+const positive = (value, fallback, maximum) => {
+    const number = Number(value);
+    return Number.isInteger(number) && number > 0 ? Math.min(number, maximum) : fallback;
+};
+const offsetOf = (cursor) => {
+    if (!cursor)
+        return 0;
+    try {
+        const parsed = JSON.parse(Buffer.from(cursor, 'base64url').toString('utf8'));
+        return Number.isInteger(parsed.offset) && Number(parsed.offset) >= 0 ? Number(parsed.offset) : 0;
+    }
+    catch {
+        return 0;
+    }
+};
+const cursorOf = (offset) => Buffer.from(JSON.stringify({ offset })).toString('base64url');
+const linksFor = async (ctx, url, req, siteId) => siteId
+    ? (await ctx.callUnchecked('website_hospitality.listChannelProperties', { siteId }, url, req))
+    : [];
+const media = (image) => {
+    if (!image || typeof image !== 'object')
+        return null;
+    const held = image;
+    return {
+        url: held.attachmentId ? `/files/${encodeURIComponent(String(held.attachmentId))}` : null,
+        category: held.category ?? null,
+        caption: held.caption ?? null,
+    };
+};
+const propertyView = (property, slug) => ({
+    id: String(property.id),
+    slug,
+    code: property.code,
+    name: property.publicName ?? property.name,
+    accommodationType: property.accommodationType,
+    timezone: property.timezone,
+    starRating: property.starRating,
+    address: {
+        line: property.addressLine ?? null,
+        locality: property.locality ?? null,
+        countryCode: property.countryCode ?? null,
+        latitude: property.latitude ?? null,
+        longitude: property.longitude ?? null,
+    },
+    description: property.description ?? null,
+    houseRules: property.houseRules ?? null,
+    childrenStayFree: property.childrenStayFree,
+    minimumGuestAge: property.minimumGuestAge ?? null,
+    primaryImage: media(property.primaryImage),
+    amenities: property.amenities ?? [],
+});
+const roomTypeView = (room) => ({
+    id: String(room.id),
+    propertyId: String(room.propertyId),
+    code: room.code,
+    name: room.publicName ?? room.name,
+    description: room.description ?? null,
+    capacity: {
+        default: room.defaultCapacity,
+        adults: room.maxAdults,
+        children: room.maxChildren,
+        infants: room.maxInfants,
+        extraBeds: room.maxExtraBeds,
+    },
+    sizeSqm: room.sizeSqm ?? null,
+    viewType: room.viewType ?? null,
+    sharedBathroom: room.sharedBathroom,
+    baseRate: String(room.baseRate),
+    primaryImage: media(room.primaryImage),
+    images: Array.isArray(room.images) ? room.images.map(media) : [],
+    amenities: room.amenities ?? [],
+    beds: room.beds ?? [],
+});
+const ratePlanView = (plan) => ({
+    id: String(plan.id),
+    roomTypeId: String(plan.roomTypeId),
+    code: plan.code,
+    name: plan.name,
+    amount: String(plan.amount),
+    mealPlan: plan.mealPlan ?? null,
+    isDefault: plan.isDefault === true,
+    minStay: Number(plan.minStay ?? 0) || null,
+    maxStay: Number(plan.maxStay ?? 0) || null,
+});
+const domainFailure = (ctx, url, req, result, status = 422) => {
+    const issues = Array.isArray(result?.errors)
+        ? (result.errors ?? [])
+        : [];
+    const first = issues[0] ?? {};
+    const messageKey = first.messageKey ?? 'channel_api.error.internal';
+    const code = first.code ? `hospitality_core.${first.code}` : 'hospitality_core.invalidRequest';
+    return {
+        status,
+        error: channelError(ctx, url, req, code, {
+            messageKey,
+            params: first.params ?? {},
+            fieldErrors: Object.fromEntries(issues
+                .filter((issue) => issue.field)
+                .map((issue) => [
+                String(issue.field),
+                {
+                    code: issue.code ? `hospitality_core.${issue.code}` : code,
+                    messageKey: issue.messageKey ?? messageKey,
+                    params: issue.params ?? {},
+                },
+            ])),
+        }),
+    };
+};
+/** A signed-in caller carries their own site; anyone else gets the one this host serves. */
+const siteOf = async (ctx, url, req, identity) => {
+    if (identity?.siteId)
+        return identity.siteId;
+    return (await channelRealmContext(ctx, url, req))?.siteId ?? null;
+};
+const missing = (ctx, url, req) => ({
+    status: 404,
+    error: channelError(ctx, url, req, 'hospitality_core.propertyNotFound', {
+        messageKey: 'hospitality_core.error.propertyNotFound',
+    }),
+});
+export const channelRoutes = routesOf(defineChannelRoute({
+    profile: 'customer',
+    method: 'GET',
+    path: 'hospitality/properties',
+    operationId: 'customer.hospitality.properties.list',
+    summary: 'List the properties published by the resolved customer site.',
+    auth: 'optional-customer',
+    capability: { key: 'website_hospitality.properties', action: 'read' },
+    responses: { '200': envelope },
+    handler: async (ctx, url, req, _params, request) => {
+        const siteId = await siteOf(ctx, url, req, request.identity);
+        const links = await linksFor(ctx, url, req, siteId);
+        const limit = positive(url.searchParams.get('limit'), 24, 100);
+        const offset = offsetOf(url.searchParams.get('cursor'));
+        const selected = links.slice(offset, offset + limit);
+        const properties = selected.length
+            ? (await ctx.callUnchecked('hospitality_core.listPropertyCatalog', { propertyIds: selected.map((link) => link.propertyId), active: true, limit, offset: 0 }, url, req))
+            : [];
+        const slugs = new Map(selected.map((link) => [link.propertyId, link.slug]));
+        return {
+            data: properties.map((property) => propertyView(property, slugs.get(String(property.id)) ?? String(property.id))),
+            nextCursor: offset + limit < links.length ? cursorOf(offset + limit) : null,
+        };
+    },
+}), defineChannelRoute({
+    profile: 'customer',
+    method: 'GET',
+    path: 'hospitality/properties/{slug}',
+    operationId: 'customer.hospitality.properties.get',
+    auth: 'optional-customer',
+    capability: { key: 'website_hospitality.properties', action: 'read' },
+    request: { params: { type: 'object', properties: { slug: { type: 'string' } }, required: ['slug'] } },
+    responses: { '200': envelope },
+    handler: async (ctx, url, req, params, request) => {
+        const siteId = await siteOf(ctx, url, req, request.identity);
+        const link = (await linksFor(ctx, url, req, siteId)).find((item) => item.slug === params.slug);
+        if (!link)
+            return missing(ctx, url, req);
+        const property = (await ctx.callUnchecked('hospitality_core.getPropertyCatalog', { id: link.propertyId }, url, req));
+        return property ? { data: propertyView(property, link.slug) } : missing(ctx, url, req);
+    },
+}), defineChannelRoute({
+    profile: 'customer',
+    method: 'GET',
+    path: 'hospitality/properties/{id}/room-types',
+    operationId: 'customer.hospitality.room_types.list',
+    auth: 'optional-customer',
+    capability: { key: 'website_hospitality.room_types', action: 'read' },
+    responses: { '200': envelope },
+    handler: async (ctx, url, req, params, request) => {
+        const siteId = await siteOf(ctx, url, req, request.identity);
+        if (!(await linksFor(ctx, url, req, siteId)).some((link) => link.propertyId === params.id))
+            return missing(ctx, url, req);
+        const rooms = (await ctx.callUnchecked('hospitality_core.listRoomTypeCatalog', {
+            propertyId: params.id,
+            active: true,
+            published: true,
+            limit: positive(url.searchParams.get('limit'), 50, 100),
+            offset: 0,
+        }, url, req));
+        return { data: rooms.map(roomTypeView) };
+    },
+}), defineChannelRoute({
+    profile: 'customer',
+    method: 'GET',
+    path: 'hospitality/properties/{id}/rate-plans',
+    operationId: 'customer.hospitality.rate_plans.list',
+    summary: 'List the sellable rate plans for a published property.',
+    auth: 'optional-customer',
+    capability: { key: 'website_hospitality.rate_plans', action: 'read' },
+    responses: { '200': envelope },
+    handler: async (ctx, url, req, params, request) => {
+        const siteId = await siteOf(ctx, url, req, request.identity);
+        if (!(await linksFor(ctx, url, req, siteId)).some((link) => link.propertyId === params.id))
+            return missing(ctx, url, req);
+        // Quotes hand back a ratePlanId, so a client that cannot enumerate plans
+        // can only ever take the default one.
+        const plans = (await ctx.callUnchecked('hospitality_core.listRatePlans', { propertyId: params.id, active: true }, url, req));
+        const roomTypeId = url.searchParams.get('roomTypeId');
+        return {
+            data: plans
+                .filter((plan) => plan.rateType === 'nightly')
+                .filter((plan) => !roomTypeId || String(plan.roomTypeId) === roomTypeId)
+                .map(ratePlanView),
+        };
+    },
+}), defineChannelRoute({
+    profile: 'customer',
+    method: 'POST',
+    path: 'hospitality/availability/search',
+    operationId: 'customer.hospitality.availability.search',
+    auth: 'optional-customer',
+    capability: { key: 'website_hospitality.availability', action: 'read' },
+    request: { body: object },
+    responses: { '200': envelope },
+    handler: async (ctx, url, req, _params, request) => {
+        const body = request.body;
+        const siteId = await siteOf(ctx, url, req, request.identity);
+        if (!(await linksFor(ctx, url, req, siteId)).some((link) => link.propertyId === body.propertyId))
+            return missing(ctx, url, req);
+        const result = (await ctx.callUnchecked('hospitality_core.quoteAvailability', {
+            propertyId: body.propertyId,
+            roomTypeId: body.roomTypeId || null,
+            checkIn: body.checkIn,
+            checkOut: body.checkOut,
+            adults: body.adults,
+            children: body.children ?? null,
+            infants: body.infants ?? null,
+            quantity: body.quantity ?? null,
+            ratePlanId: body.ratePlanId || null,
+        }, url, req));
+        return result.ok ? { data: result } : domainFailure(ctx, url, req, result);
+    },
+}), defineChannelRoute({
+    profile: 'customer',
+    method: 'POST',
+    path: 'hospitality/bookings',
+    operationId: 'customer.hospitality.bookings.create',
+    auth: 'customer',
+    capability: { key: 'website_hospitality.bookings', action: 'create' },
+    request: { body: object },
+    responses: { '201': envelope },
+    idempotent: true,
+    rateLimit: { action: 'hospitality.booking.create', limit: 20, windowMs: 60 * 60_000 },
+    handler: async (ctx, url, req, _params, request) => {
+        const identity = request.identity;
+        const key = String(req.headers['idempotency-key'] ?? '').trim();
+        if (!key)
+            return {
+                status: 400,
+                error: channelError(ctx, url, req, 'channel_api.idempotencyRequired', {
+                    messageKey: 'channel_api.error.idempotencyRequired',
+                }),
+            };
+        const body = request.body;
+        if (!(await linksFor(ctx, url, req, identity.siteId)).some((link) => link.propertyId === body.propertyId))
+            return missing(ctx, url, req);
+        const id = channelCommandId('channel', identity, key);
+        const input = {
+            id,
+            requestKey: key,
+            propertyId: body.propertyId,
+            roomTypeId: body.roomTypeId,
+            ratePlanId: body.ratePlanId || null,
+            partnerId: identity.account.partnerId,
+            checkIn: body.checkIn,
+            checkOut: body.checkOut,
+            adults: body.adults,
+            children: body.children ?? null,
+            infants: body.infants ?? null,
+            quantity: body.quantity ?? null,
+            channelRef: `customer:${identity.accountId}`,
+        };
+        const result = (await ctx.callUnchecked('hospitality_core.createOnlineReservation', input, url, req, {
+            idempotencyKey: key,
+            idempotencyNamespace: `customer:${identity.realmId}:${identity.accountId}:hospitality-booking`,
+        }));
+        return result.ok ? { status: 201, data: result } : domainFailure(ctx, url, req, result, 409);
+    },
+}), defineChannelRoute({
+    profile: 'customer',
+    method: 'GET',
+    // channel_api keys routes by path alone, so a GET cannot share
+    // "hospitality/bookings" with the create route. A distinct path is the
+    // contained fix; method-aware routing belongs to channel_api, not here.
+    path: 'hospitality/my-bookings',
+    operationId: 'customer.hospitality.bookings.list',
+    summary: 'List the bookings owned by the signed-in customer.',
+    auth: 'customer',
+    capability: { key: 'website_hospitality.bookings', action: 'read' },
+    responses: { '200': envelope },
+    handler: async (ctx, url, req, _params, request) => {
+        const identity = request.identity;
+        const limit = positive(url.searchParams.get('limit'), 24, 200);
+        const offset = offsetOf(url.searchParams.get('cursor'));
+        const links = await linksFor(ctx, url, req, identity.siteId);
+        // A customer session belongs to one site, so their history is scoped to
+        // the properties that site publishes rather than the whole company.
+        const rows = (await ctx.callUnchecked('hospitality_core.listPartnerReservations', {
+            partnerId: identity.account.partnerId,
+            propertyIds: links.map((link) => link.propertyId),
+            state: url.searchParams.get('state') || null,
+            limit: limit + 1,
+            offset,
+        }, url, req));
+        return {
+            data: rows.slice(0, limit),
+            nextCursor: rows.length > limit ? cursorOf(offset + limit) : null,
+        };
+    },
+}), defineChannelRoute({
+    profile: 'customer',
+    method: 'GET',
+    path: 'hospitality/bookings/{id}',
+    operationId: 'customer.hospitality.bookings.get',
+    auth: 'customer',
+    capability: { key: 'website_hospitality.bookings', action: 'read' },
+    responses: { '200': envelope },
+    handler: async (ctx, url, req, params, request) => {
+        const identity = request.identity;
+        const result = (await ctx.callUnchecked('hospitality_core.getPartnerReservation', { id: params.id, partnerId: identity.account.partnerId }, url, req));
+        return result.ok ? { data: result } : domainFailure(ctx, url, req, result, 404);
+    },
+}), defineChannelRoute({
+    profile: 'customer',
+    method: 'POST',
+    path: 'hospitality/bookings/{id}/cancel',
+    operationId: 'customer.hospitality.bookings.cancel',
+    summary: 'Cancel a booking the signed-in customer owns.',
+    auth: 'customer',
+    capability: { key: 'website_hospitality.bookings', action: 'cancel' },
+    request: { body: object },
+    responses: { '200': envelope },
+    idempotent: true,
+    handler: async (ctx, url, req, params, request) => {
+        const identity = request.identity;
+        const result = (await ctx.callUnchecked('hospitality_core.cancelPartnerReservation', {
+            id: params.id,
+            partnerId: identity.account.partnerId,
+            reason: request.body?.reason || null,
+        }, url, req));
+        if (result.ok)
+            return { data: result };
+        // Not owning the booking and no longer being allowed to cancel it are
+        // different answers; collapsing both to 409 hides which one happened.
+        const notOwned = result.errors?.some((issue) => issue.code === 'reservationNotOwned');
+        return domainFailure(ctx, url, req, result, notOwned ? 404 : 409);
+    },
+}));
+//# sourceMappingURL=channel-routes.js.map