@ticketboothapp/booking 1.2.150 → 1.2.152

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ticketboothapp/booking",
-  "version": "1.2.150",
+  "version": "1.2.152",
   "private": false,
   "sideEffects": [
     "**/*.css",

package/src/components/booking/AdminChangeCheckoutDialogs.tsx

@@ -57,6 +57,7 @@ export function AdminChangeCheckoutDialogs({
         currency={currency}
         loading={loading}
         error={error}
+        reservationExpiration={adminChoiceData?.reservationExpiration}
         onPayNow={onPayNow}
         onConfirmWithoutPayment={onConfirmWithoutPayment}
         onCancel={onAdminPaymentChoiceCancel}

package/src/components/booking/AdminPaymentChoiceModal.tsx

@@ -1,7 +1,13 @@
 'use client';
 
+import { useEffect, useState } from 'react';
 import { formatCurrencyAmount } from '../../lib/currency';
 import type { Currency } from './CurrencySwitcher';
+import {
+  formatReservationHoldTime,
+  reservationHoldSecondsRemaining,
+  RESERVATION_HOLD_EXPIRED_MESSAGE,
+} from './reservation-hold';
 
 interface AdminPaymentChoiceModalProps {
   open: boolean;
@@ -9,6 +15,7 @@ interface AdminPaymentChoiceModalProps {
   currency: Currency;
   loading: boolean;
   error: string;
+  reservationExpiration?: string;
   onPayNow: () => void;
   onConfirmWithoutPayment: () => void;
   onCancel: () => void;
@@ -27,14 +34,27 @@ export function AdminPaymentChoiceModal({
   currency,
   loading,
   error,
+  reservationExpiration,
   onPayNow,
   onConfirmWithoutPayment,
   onCancel,
   description,
   payNowLabel,
 }: AdminPaymentChoiceModalProps) {
+  const [nowMs, setNowMs] = useState(() => Date.now());
+
+  useEffect(() => {
+    if (!open || !reservationExpiration) return;
+    setNowMs(Date.now());
+    const interval = window.setInterval(() => setNowMs(Date.now()), 1000);
+    return () => window.clearInterval(interval);
+  }, [open, reservationExpiration]);
+
   if (!open) return null;
 
+  const secondsRemaining = reservationHoldSecondsRemaining(reservationExpiration, nowMs);
+  const expired = secondsRemaining !== null && secondsRemaining <= 0;
+
   const modal = (
     <div
       className="booking-flow-root booking-flow-preflight fixed inset-0 z-[10050] flex items-center justify-center p-4 bg-black/50 pointer-events-auto"
@@ -68,6 +88,32 @@ export function AdminPaymentChoiceModal({
         </div>
 
         <div className="p-6 flex flex-col gap-3 flex-1 min-h-0">
+          {secondsRemaining !== null ? (
+            <div
+              className={`rounded-lg border p-3 text-sm ${
+                expired
+                  ? 'border-red-200 bg-red-50 text-red-800'
+                  : 'border-emerald-200 bg-emerald-50 text-emerald-800'
+              }`}
+              role={expired ? 'alert' : 'status'}
+              aria-live="polite"
+            >
+              {expired ? (
+                <>
+                  <p className="font-semibold">Reservation hold expired</p>
+                  <p className="mt-1">{RESERVATION_HOLD_EXPIRED_MESSAGE}</p>
+                </>
+              ) : (
+                <>
+                  <p className="font-semibold">
+                    Reservation held for {formatReservationHoldTime(secondsRemaining)}
+                  </p>
+                  <p className="mt-1">Complete payment or confirm the booking before the hold expires.</p>
+                </>
+              )}
+            </div>
+          ) : null}
+
           {error ? (
             <p className="text-sm text-red-600" role="alert">
               {error}
@@ -77,7 +123,7 @@ export function AdminPaymentChoiceModal({
           <button
             type="button"
             onClick={onPayNow}
-            disabled={loading}
+            disabled={loading || expired}
             className="w-full py-3 px-4 bg-emerald-600 text-white font-semibold rounded-lg hover:bg-emerald-700 disabled:opacity-50 disabled:cursor-not-allowed"
           >
             {loading ? 'Loading...' : `${payNowLabel ?? 'Pay now'} (${formatCurrencyAmount(totalAmount, currency)})`}
@@ -85,7 +131,7 @@ export function AdminPaymentChoiceModal({
           <button
             type="button"
             onClick={onConfirmWithoutPayment}
-            disabled={loading}
+            disabled={loading || expired}
             className="w-full py-3 px-4 border border-stone-300 text-stone-700 rounded-lg hover:bg-stone-50 font-medium disabled:opacity-50 disabled:cursor-not-allowed"
           >
             Confirm without payment
@@ -96,7 +142,7 @@ export function AdminPaymentChoiceModal({
             disabled={loading}
             className="w-full py-2 text-sm text-stone-500 hover:text-stone-700 font-medium disabled:opacity-50"
           >
-            Cancel
+            {expired ? 'Close and restart checkout' : 'Cancel'}
           </button>
         </div>
       </div>

package/src/components/booking/PrivateShuttleBookingFlow.tsx

@@ -33,6 +33,7 @@ import {
   getPrivateShuttleAvailabilityOptionId,
   privateShuttleBookingCutoffMessage,
   privateShuttleStartTimeAllowed,
+  resolveHydratedPrivateShuttleAvailability,
 } from './private-shuttle-availability';
 import { usePrivateShuttleAvailability } from './use-private-shuttle-availability';
 import type {
@@ -263,6 +264,15 @@ export function PrivateShuttleBookingFlow({
   };
   const selectedOptionConfig = activeOptions.find((opt) => opt.optionId === selectedOption);
   const privateShuttleConfig = selectedOptionConfig?.privateShuttleConfig;
+  const effectiveSelectedAvailability = useMemo(
+    () =>
+      resolveHydratedPrivateShuttleAvailability(
+        selectedAvailability,
+        selectedDate ? (availabilitiesByDate[selectedDate] ?? []) : [],
+        selectedOption,
+      ),
+    [availabilitiesByDate, selectedAvailability, selectedDate, selectedOption],
+  );
   const selectedPickupLocation = useMemo(
     () =>
       pickupLocationId ? product.pickupLocations?.find((loc) => loc.id === pickupLocationId) : null,
@@ -290,7 +300,7 @@ export function PrivateShuttleBookingFlow({
   }, [draftItineraryDestinations]);
 
   const suggestedStartTimes = useMemo(() => {
-    const times = selectedAvailability?.suggestedStartTimes || privateShuttleConfig?.suggestedStartTimes || [];
+    const times = effectiveSelectedAvailability?.suggestedStartTimes || privateShuttleConfig?.suggestedStartTimes || [];
     if (isAdmin || !selectedDate) return times;
     return times.filter((time) =>
       privateShuttleStartTimeAllowed(
@@ -307,7 +317,7 @@ export function PrivateShuttleBookingFlow({
     companyTimezone,
     isAdmin,
     privateShuttleConfig?.suggestedStartTimes,
-    selectedAvailability?.suggestedStartTimes,
+    effectiveSelectedAvailability?.suggestedStartTimes,
     selectedDate,
   ]);
   const {
@@ -338,7 +348,7 @@ export function PrivateShuttleBookingFlow({
     selectedOption,
     selectedDate,
     selectedStartTime,
-    selectedAvailability,
+    selectedAvailability: effectiveSelectedAvailability,
     selectedOptionConfig,
     activeOptions,
     availabilitiesByDate,
@@ -469,8 +479,8 @@ export function PrivateShuttleBookingFlow({
   // When availability changes, clip passenger count to new vacancies (e.g. user switched date/option).
   // Don't run when passengerCount changes—allows special request for more than vacancies.
   useEffect(() => {
-    if (!selectedAvailability) return;
-    const vacancies = selectedAvailability.vacancies || 0;
+    if (!effectiveSelectedAvailability) return;
+    const vacancies = effectiveSelectedAvailability.vacancies || 0;
     const minP = 1;
     setIsSpecialRequestMode(false);
     setSpecialRequestInputValue('');
@@ -478,7 +488,7 @@ export function PrivateShuttleBookingFlow({
       if (prev <= vacancies) return Math.max(minP, prev);
       return Math.max(minP, vacancies);
     });
-  }, [selectedAvailability]);
+  }, [effectiveSelectedAvailability]);
 
   useEffect(() => {
     if (selectedOption) {
@@ -561,7 +571,7 @@ export function PrivateShuttleBookingFlow({
   };
 
   const handlePassengerCountChange = (count: number) => {
-    const max = selectedAvailability?.vacancies || 0;
+    const max = effectiveSelectedAvailability?.vacancies || 0;
     const min = 1;
     setPassengerCount(Math.max(min, max > 0 ? Math.min(max, count) : count));
     setError('');
@@ -642,7 +652,7 @@ export function PrivateShuttleBookingFlow({
     selectedOption,
     selectedDate,
     selectedStartTime,
-    selectedAvailability,
+    selectedAvailability: effectiveSelectedAvailability,
     companyTimezone,
     bookingCutoffNow,
     bookingCutoffMinutes,
@@ -793,12 +803,12 @@ export function PrivateShuttleBookingFlow({
             onOptionSelect={handleOptionSelect}
           />
 
-          {selectedOption && selectedAvailability && (
+          {selectedOption && effectiveSelectedAvailability && (
             <PrivateShuttlePassengerSection
               passengerCount={passengerCount}
               resourceCount={resourceCount}
               billableResourceCount={billableResourceCount}
-              maxVacancies={selectedAvailability.vacancies || 0}
+              maxVacancies={effectiveSelectedAvailability.vacancies || 0}
               isSpecialRequestMode={isSpecialRequestMode}
               specialRequestInputValue={specialRequestInputValue}
               onPassengerCountChange={handlePassengerCountChange}
@@ -808,7 +818,7 @@ export function PrivateShuttleBookingFlow({
             />
           )}
 
-          {selectedOption && selectedAvailability && passengerCount > 0 && (
+          {selectedOption && effectiveSelectedAvailability && passengerCount > 0 && (
             <PrivateShuttleStartTimeSection
               suggestedStartTimes={suggestedStartTimes}
               selectedStartTime={selectedStartTime}

package/src/components/booking/PrivateShuttleCheckoutDialogs.tsx

@@ -57,6 +57,7 @@ export function PrivateShuttleCheckoutDialogs({
         currency={currency}
         loading={loading}
         error={error}
+        reservationExpiration={adminChoiceData?.reservationExpiration}
         description={
           adminChoiceData?.isDepositPayment
             ? 'Pay the deposit now, or confirm without payment. The customer can pay the deposit or remaining balance from the Manage Booking page.'

package/src/components/booking/StandardBookingCheckoutDialogs.tsx

@@ -57,6 +57,7 @@ export function StandardBookingCheckoutDialogs({
         currency={currency}
         loading={loading}
         error={error}
+        reservationExpiration={adminChoiceData?.reservationExpiration}
         onPayNow={onPayNow}
         onConfirmWithoutPayment={onConfirmWithoutPayment}
         onCancel={onAdminPaymentChoiceCancel}

package/src/components/booking/private-shuttle-availability.ts

@@ -87,6 +87,41 @@ export function getPrivateShuttleAvailabilityCacheKey(availability: Availability
   return `${availability.dateTime}-${getPrivateShuttleAvailabilityOptionId(availability)}`;
 }
 
+/**
+ * Calendar results are summary-only. Once the selected day is hydrated, prefer the
+ * matching detailed availability so pricing uses its authoritative dynamic adjustments.
+ */
+export function resolveHydratedPrivateShuttleAvailability(
+  selected: Availability | null,
+  availabilitiesForSelectedDate: Availability[],
+  selectedOptionId: string,
+): Availability | null {
+  if (!selected) return null;
+  const selectedAvailabilityId = selected.availabilityId?.trim();
+  const selectedOption = selectedOptionId.trim();
+  const hydrated = availabilitiesForSelectedDate.find((candidate) => {
+    if (
+      selectedAvailabilityId &&
+      candidate.availabilityId?.trim() !== selectedAvailabilityId
+    ) {
+      return false;
+    }
+    return (
+      !selectedOption ||
+      getPrivateShuttleAvailabilityOptionId(candidate) === selectedOption
+    );
+  });
+  return hydrated ?? selected;
+}
+
+export function privateShuttlePriceChanged(
+  displayedTotal: number,
+  authoritativeTotal: number,
+): boolean {
+  if (!Number.isFinite(displayedTotal) || !Number.isFinite(authoritativeTotal)) return true;
+  return Math.round(displayedTotal * 100) !== Math.round(authoritativeTotal * 100);
+}
+
 export function getResourceRate(availability: Availability | undefined | null) {
   return availability?.rates?.find((r) => r.rateId === 'RESOURCE' || r.category === 'RESOURCE');
 }

package/src/components/booking/private-shuttle-checkout-controller.ts

@@ -47,6 +47,10 @@ import {
   type PrivateShuttleCheckoutModalData,
 } from './private-shuttle-payment-choice-runner';
 import { BOOKING_FLOW_ABANDON_EVENT } from '../../providers/booking-dialog-provider';
+import {
+  reservationHoldHasExpired,
+  RESERVATION_HOLD_EXPIRED_MESSAGE,
+} from './reservation-hold';
 
 export interface UsePrivateShuttleCheckoutControllerParams {
   selectedOption: string;
@@ -676,6 +680,10 @@ export function usePrivateShuttleCheckoutController({
   const handleConfirmWithoutPayment = async () => {
     const choice = adminChoiceData;
     if (!choice) return;
+    if (reservationHoldHasExpired(choice.reservationExpiration)) {
+      setError(RESERVATION_HOLD_EXPIRED_MESSAGE);
+      return;
+    }
     setLoading(true);
     setError('');
     try {
@@ -718,6 +726,10 @@ export function usePrivateShuttleCheckoutController({
   const handlePayNow = () => {
     const choice = adminChoiceData;
     if (!choice) return;
+    if (reservationHoldHasExpired(choice.reservationExpiration)) {
+      setError(RESERVATION_HOLD_EXPIRED_MESSAGE);
+      return;
+    }
     setShowAdminPaymentChoice(false);
     setCheckoutClientSecret(choice.clientSecret);
     setCheckoutModalData(buildPrivateShuttlePayNowCheckoutModalData(choice, lastName.trim()));
@@ -726,6 +738,7 @@ export function usePrivateShuttleCheckoutController({
   };
 
   const handleAdminPaymentChoiceCancel = () => {
+    cancelPendingReservation();
     setShowAdminPaymentChoice(false);
     setAdminChoiceData(null);
     setError('');

package/src/components/booking/private-shuttle-reservation-runner.ts

@@ -16,7 +16,10 @@ import {
 } from '../../lib/booking/source-metadata';
 import { quotePublicNewBookingV2ForCheckout } from '../../lib/pricing-v2-shadow';
 import type { Currency } from './CurrencySwitcher';
-import { findMergedPrivateShuttleAvailability } from './private-shuttle-availability';
+import {
+  findMergedPrivateShuttleAvailability,
+  privateShuttlePriceChanged,
+} from './private-shuttle-availability';
 
 type PrivateShuttleBookingItem = { category: 'RESOURCE'; count: number };
 export type PrivateShuttleAddOnSelection = { addOnId: string; variantId?: string; quantity?: number };
@@ -213,6 +216,21 @@ export async function reservePrivateShuttleForCheckout({
     },
   });
 
+  const authoritativeTotal =
+    pricingV2Quote?.quote?.amountToCharge ??
+    pricingV2Quote?.quote?.payableTotal ??
+    pricingV2Quote?.quote?.totalAmount;
+  if (
+    typeof authoritativeTotal === 'number' &&
+    privateShuttlePriceChanged(totalPrice, authoritativeTotal)
+  ) {
+    return {
+      kind: 'blocked',
+      message:
+        'Pricing was refreshed. Please review the updated total and continue to payment again.',
+    };
+  }
+
   const reservation = await createReservation({
     productId: selectedOption,
     dateTime: selectedDate,

package/src/components/booking/reservation-hold.ts

@@ -0,0 +1,27 @@
+export const RESERVATION_HOLD_EXPIRED_MESSAGE =
+  'This reservation hold has expired. Close this window and restart checkout to get current availability and pricing.';
+
+export function reservationHoldSecondsRemaining(
+  reservationExpiration: string | undefined,
+  nowMs: number = Date.now(),
+): number | null {
+  if (!reservationExpiration) return null;
+  const expirationMs = Date.parse(reservationExpiration);
+  if (!Number.isFinite(expirationMs)) return 0;
+  return Math.max(0, Math.ceil((expirationMs - nowMs) / 1000));
+}
+
+export function reservationHoldHasExpired(
+  reservationExpiration: string | undefined,
+  nowMs: number = Date.now(),
+): boolean {
+  const remaining = reservationHoldSecondsRemaining(reservationExpiration, nowMs);
+  return remaining !== null && remaining <= 0;
+}
+
+export function formatReservationHoldTime(seconds: number): string {
+  const safeSeconds = Math.max(0, Math.floor(seconds));
+  const minutes = Math.floor(safeSeconds / 60);
+  const remainder = safeSeconds % 60;
+  return `${minutes}:${String(remainder).padStart(2, '0')}`;
+}

package/src/components/booking/standard-booking-checkout-controller.ts

@@ -42,6 +42,10 @@ import {
   type StandardCheckoutModalData,
 } from './standard-booking-payment-choice-runner';
 import { BOOKING_FLOW_ABANDON_EVENT } from '../../providers/booking-dialog-provider';
+import {
+  reservationHoldHasExpired,
+  RESERVATION_HOLD_EXPIRED_MESSAGE,
+} from './reservation-hold';
 
 export interface UseStandardBookingCheckoutControllerParams {
   selectedAvailability: Availability | null;
@@ -590,6 +594,10 @@ export function useStandardBookingCheckoutController({
   const handleConfirmWithoutPayment = async () => {
     const choice = adminChoiceData;
     if (!choice) return;
+    if (reservationHoldHasExpired(choice.reservationExpiration)) {
+      setError(RESERVATION_HOLD_EXPIRED_MESSAGE);
+      return;
+    }
     setLoading(true);
     setError('');
     try {
@@ -634,6 +642,10 @@ export function useStandardBookingCheckoutController({
   const handlePayNow = () => {
     const choice = adminChoiceData;
     if (!choice) return;
+    if (reservationHoldHasExpired(choice.reservationExpiration)) {
+      setError(RESERVATION_HOLD_EXPIRED_MESSAGE);
+      return;
+    }
     setShowAdminPaymentChoice(false);
     setCheckoutClientSecret(choice.clientSecret);
     setCheckoutModalData(buildStandardPayNowCheckoutModalData(choice, lastName.trim()));
@@ -642,6 +654,7 @@ export function useStandardBookingCheckoutController({
   };
 
   const handleAdminPaymentChoiceCancel = () => {
+    cancelPendingReservation();
     setShowAdminPaymentChoice(false);
     setAdminChoiceData(null);
     setError('');

package/src/components/booking/useAdminChangeCheckoutController.ts

@@ -62,6 +62,10 @@ import {
   confirmFreeAdminCustomerChange,
   quoteAdminCustomerChangeForCheckout,
 } from './admin-change-customer-quote-runner';
+import {
+  reservationHoldHasExpired,
+  RESERVATION_HOLD_EXPIRED_MESSAGE,
+} from './reservation-hold';
 
 type AdminCustomReceiptLine = { label: string; amountInput: string; amountSign?: number };
 
@@ -690,6 +694,10 @@ export function useAdminChangeCheckoutController({
 
   const handleConfirmWithoutPayment = async () => {
     if (!adminChoiceData) return;
+    if (reservationHoldHasExpired(adminChoiceData.reservationExpiration)) {
+      setError(RESERVATION_HOLD_EXPIRED_MESSAGE);
+      return;
+    }
     setLoading(true);
     setError('');
     try {
@@ -771,6 +779,10 @@ export function useAdminChangeCheckoutController({
 
   const handlePayNow = () => {
     if (!adminChoiceData) return;
+    if (reservationHoldHasExpired(adminChoiceData.reservationExpiration)) {
+      setError(RESERVATION_HOLD_EXPIRED_MESSAGE);
+      return;
+    }
     setShowAdminPaymentChoice(false);
     setCheckoutClientSecret(adminChoiceData.clientSecret);
     setCheckoutModalData(buildAdminChangePayNowCheckoutModalData(adminChoiceData, lastName));
@@ -787,10 +799,11 @@ export function useAdminChangeCheckoutController({
   }, []);
 
   const handleAdminPaymentChoiceCancel = useCallback(() => {
+    cancelPendingReservation();
     setShowAdminPaymentChoice(false);
     setAdminChoiceData(null);
     setError('');
-  }, [setError]);
+  }, [cancelPendingReservation, setError]);
 
   return {
     showCheckoutModal,

package/src/hooks/useBookingSourceMetadataFromLocation.ts

@@ -1,21 +1,23 @@
 'use client';
 
 import { useMemo } from 'react';
-import { usePathname } from 'next/navigation';
+import { usePathname, useSearchParams } from 'next/navigation';
 import {
   buildBookingSourceMetadataFromLocation,
   type BookingSourceMetadata,
 } from '../lib/booking/source-metadata';
 
 /**
- * Re-reads URL-derived booking attribution when the **path** changes. Query-only updates on the
- * same path re-read on the next full navigation / remount (metadata reads live `window.location`).
+ * Re-reads URL-derived booking attribution when either the path or query changes. This is
+ * important after same-path checkout-return cleanup removes transient Stripe parameters.
  */
 export function useBookingSourceMetadataFromLocation(): Partial<BookingSourceMetadata> {
   const pathname = usePathname() ?? '';
+  const searchParams = useSearchParams();
+  const query = searchParams.toString();
 
   return useMemo(
     () => buildBookingSourceMetadataFromLocation(),
-    [pathname],
+    [pathname, query],
   );
 }

package/src/lib/booking/source-metadata.ts

@@ -49,6 +49,76 @@ export function isDedicatedPartnerBookingPortalHost(hostname: string): boolean {
   return h === 'booking.viaviamorainelake.com' || h === 'staging.booking.viaviamorainelake.com';
 }
 
+const STRIPE_REDIRECT_QUERY_KEYS = new Set([
+  'payment_intent',
+  'payment_intent_client_secret',
+  'setup_intent',
+  'setup_intent_client_secret',
+  'redirect_status',
+]);
+
+const CHECKOUT_RETURN_QUERY_KEYS = new Set([
+  'reservationref',
+  'reservation',
+  'bookingreference',
+  'ref',
+  'lastname',
+  'bookingdate',
+  'booking_complete',
+  'payment',
+  'dap_success',
+  'embed_manage',
+]);
+
+function normalizedQueryKey(key: string): string {
+  return key.trim().toLowerCase().replace(/-/g, '_');
+}
+
+function isSensitiveQueryKey(key: string): boolean {
+  const normalized = normalizedQueryKey(key);
+  const compact = normalized.replace(/_/g, '');
+  return (
+    STRIPE_REDIRECT_QUERY_KEYS.has(normalized) ||
+    ['secret', 'token', 'password', 'passwd', 'authorization'].some((term) =>
+      compact.includes(term),
+    )
+  );
+}
+
+/**
+ * Removes payment-return credentials and transient checkout identity from attribution URLs.
+ * Unknown non-sensitive query parameters remain available for configured partner attribution.
+ */
+export function sanitizeBookingSourceUrl(rawUrl: string | null | undefined): string | undefined {
+  const value = rawUrl?.trim();
+  if (!value) return undefined;
+
+  let url: URL;
+  try {
+    url = new URL(value);
+  } catch {
+    return undefined;
+  }
+
+  const originalKeys = Array.from(url.searchParams.keys()).map(normalizedQueryKey);
+  const isCheckoutReturn =
+    originalKeys.some((key) => STRIPE_REDIRECT_QUERY_KEYS.has(key)) ||
+    url.searchParams.get('embed_manage') === '1' ||
+    url.searchParams.get('booking_complete') === '1';
+
+  for (const key of Array.from(url.searchParams.keys())) {
+    const normalized = normalizedQueryKey(key);
+    if (
+      isSensitiveQueryKey(normalized) ||
+      (isCheckoutReturn && CHECKOUT_RETURN_QUERY_KEYS.has(normalized))
+    ) {
+      url.searchParams.delete(key);
+    }
+  }
+
+  return url.href;
+}
+
 function parseCookieMap(cookieString: string): Map<string, string> {
   const decodeCookieValue = (value: string): string => {
     try {
@@ -119,7 +189,9 @@ export function buildBookingSourceMetadataFromLocation(): Partial<BookingSourceM
     return {};
   }
 
-  const currentUrl = new URL(window.location.href);
+  const sanitizedPageUrl = sanitizeBookingSourceUrl(window.location.href);
+  if (!sanitizedPageUrl) return {};
+  const currentUrl = new URL(sanitizedPageUrl);
   const params = currentUrl.searchParams;
   const partnerMatch = currentUrl.pathname.match(/^\/partner\/([^/]+)/i);
   const onPartnerEmbedPath = isPublicPartnerMarketingPath(currentUrl.pathname);
@@ -135,7 +207,7 @@ export function buildBookingSourceMetadataFromLocation(): Partial<BookingSourceM
     pageUrl: currentUrl.href,
     pagePath: currentUrl.pathname,
     pageQuery: currentUrl.search || undefined,
-    referrerUrl: document.referrer || undefined,
+    referrerUrl: sanitizeBookingSourceUrl(document.referrer),
     utmSource: params.get('utm_source') || undefined,
     utmMedium: params.get('utm_medium') || undefined,
     utmCampaign: params.get('utm_campaign') || undefined,

package/src/lib/booking-api.ts

@@ -17,7 +17,11 @@ import {
   normalizeBookingProductId,
 } from './booking/normalize-booking-product-id';
 import { ENV } from './env';
-import { DEFAULT_BOOKING_SOURCE, type BookingSourceMetadata } from './booking/source-metadata';
+import {
+  DEFAULT_BOOKING_SOURCE,
+  sanitizeBookingSourceUrl,
+  type BookingSourceMetadata,
+} from './booking/source-metadata';
 
 const API_BASE = ENV.API_URL;
 
@@ -64,6 +68,9 @@ function getUserFacingMessage(endpoint: string): string {
       return 'Unable to hold your booking right now. Please try again.';
     case '/checkout/payment-intent':
       return 'Unable to continue to payment right now. Please try again.';
+    case '/checkout/confirm-booking-without-payment':
+    case '/1/partner/confirm-booking-without-payment':
+      return 'Unable to confirm this booking right now. Please try again or restart checkout.';
     default:
       return 'Something went wrong while loading booking details. Please try again.';
   }
@@ -105,7 +112,7 @@ function reportBookingClientTelemetryEvent(
     traceparent,
     ...(traceId ? { traceId } : {}),
     apiBase: API_BASE,
-    pageUrl: window.location.href,
+    pageUrl: sanitizeBookingSourceUrl(window.location.href) ?? window.location.origin,
     userAgent: window.navigator.userAgent,
     online: window.navigator.onLine,
     occurredAt: new Date().toISOString(),
@@ -182,7 +189,11 @@ function createUserError(
   bookingApiErrorCode?: string
 ): BookingClientError {
   const supportCode = buildSupportCode(endpoint, errorClass);
-  const userMessage = `${getUserFacingMessage(endpoint)} (${supportCode})`;
+  const userMessage = bookingApiErrorCode === 'RESERVATION_EXPIRED'
+    ? 'This reservation hold has expired. Close this window and restart checkout to get current availability and pricing.'
+    : bookingApiErrorCode === 'RESERVATION_NOT_ACTIVE'
+      ? 'This reservation has already been completed or closed. Refresh before trying again.'
+      : `${getUserFacingMessage(endpoint)} (${supportCode})`;
   const error = new Error(userMessage) as BookingClientError;
   error.debugMessage = debugMessage;
   if (bookingApiErrorCode) error.bookingApiErrorCode = bookingApiErrorCode;
@@ -424,7 +435,7 @@ function getBrowserDiagnostics(): Record<string, number | string | boolean> {
     siteOrigin: window.location.origin,
     siteProtocol: window.location.protocol,
     isSecureContext: window.isSecureContext,
-    referrer: document.referrer || '',
+    referrer: sanitizeBookingSourceUrl(document.referrer) ?? '',
   };
 }
 
@@ -568,7 +579,7 @@ async function collectNetworkFailureProbeResults(
           correlationId,
           traceparent,
           apiBase: API_BASE,
-          pageUrl: window.location.href,
+          pageUrl: sanitizeBookingSourceUrl(window.location.href) ?? window.location.origin,
           userAgent: window.navigator.userAgent,
           online: window.navigator.onLine,
           occurredAt: new Date().toISOString(),
@@ -2576,7 +2587,12 @@ export async function confirmBookingWithoutPayment(
       httpStatus: res.status,
       errorCode: isApiErrorPayload(err) ? err.errorCode : undefined,
     });
-    throw createUserError(endpoint, 'HTTP', debugMessage);
+    throw createUserError(
+      endpoint,
+      'HTTP',
+      debugMessage,
+      isApiErrorPayload(err) ? err.errorCode : undefined,
+    );
   }
   const data = await parseJsonSafely(res);
   const appError = toAppLevelErrorMessage(endpoint, data, 'Failed to confirm booking');
@@ -2587,7 +2603,12 @@ export async function confirmBookingWithoutPayment(
       message: appError,
       errorCode: isApiErrorPayload(data) ? data.errorCode : undefined,
     });
-    throw createUserError(endpoint, 'APP_ERROR_200', appError);
+    throw createUserError(
+      endpoint,
+      'APP_ERROR_200',
+      appError,
+      isApiErrorPayload(data) ? data.errorCode : undefined,
+    );
   }
   logBookingSourceDebug('response', '/checkout/confirm-booking-without-payment', data);
   return ((data as { data?: ConfirmBookingWithoutPaymentResponse } | null)?.data ??
@@ -2632,7 +2653,12 @@ export async function confirmPartnerBookingWithoutPayment(
       httpStatus: res.status,
       errorCode: isApiErrorPayload(err) ? err.errorCode : undefined,
     });
-    throw createUserError(endpoint, 'HTTP', debugMessage);
+    throw createUserError(
+      endpoint,
+      'HTTP',
+      debugMessage,
+      isApiErrorPayload(err) ? err.errorCode : undefined,
+    );
   }
   const data = await parseJsonSafely(res);
   const appError = toAppLevelErrorMessage(endpoint, data, 'Failed to confirm booking');
@@ -2643,7 +2669,12 @@ export async function confirmPartnerBookingWithoutPayment(
       message: appError,
       errorCode: isApiErrorPayload(data) ? data.errorCode : undefined,
     });
-    throw createUserError(endpoint, 'APP_ERROR_200', appError);
+    throw createUserError(
+      endpoint,
+      'APP_ERROR_200',
+      appError,
+      isApiErrorPayload(data) ? data.errorCode : undefined,
+    );
   }
   logBookingSourceDebug('response', endpoint, data);
   return ((data as { data?: ConfirmBookingWithoutPaymentResponse } | null)?.data ??

package/src/providers/booking-dialog-provider.tsx

@@ -17,6 +17,7 @@ import {
   normalizeBookingProductId,
 } from '../lib/booking/normalize-booking-product-id';
 import { useBookingHostOptional } from '../runtime/BookingHostContext';
+import { sanitizeBookingSourceUrl } from '../lib/booking/source-metadata';
 
 /** Filter IDs for the product grid. Must match BookingProductGrid FILTER_IDS. */
 export type ProductGridFilterId =
@@ -87,8 +88,8 @@ export function BookingDialogProvider({ children }: BookingDialogProviderProps)
         correlationId,
         originalProductId: original,
         sanitizedProductId: sanitized,
-        pageUrl: window.location.href,
-        referrer: document.referrer || null,
+        pageUrl: sanitizeBookingSourceUrl(window.location.href) ?? window.location.origin,
+        referrer: sanitizeBookingSourceUrl(document.referrer) ?? null,
         userAgent: window.navigator.userAgent,
         occurredAt: new Date().toISOString(),
         stack: new Error('Suspicious booking productId input').stack ?? null,

package/test/change-booking-helpers.test.ts

@@ -8,6 +8,17 @@ import { buildCheckoutModalSummaryFromPricingV2Quote } from '../src/components/b
 import type { ChangeQuoteUiSlice } from '../src/lib/booking/change-flow-pricing';
 import type { ChangeBookingQuoteResponse } from '../src/lib/booking-api';
 import { buildAdminChangeQuoteRequestKey } from '../src/components/booking/admin-change-quote-request-key';
+import {
+  applyResourceAdjustments,
+  privateShuttlePriceChanged,
+  resolveHydratedPrivateShuttleAvailability,
+} from '../src/components/booking/private-shuttle-availability';
+import { sanitizeBookingSourceUrl } from '../src/lib/booking/source-metadata';
+import {
+  formatReservationHoldTime,
+  reservationHoldHasExpired,
+  reservationHoldSecondsRemaining,
+} from '../src/components/booking/reservation-hold';
 
 function quote(overrides: Partial<ChangeBookingQuoteResponse>): ChangeBookingQuoteResponse {
   return {
@@ -36,6 +47,53 @@ function test(name: string, fn: () => void): void {
   }
 }
 
+test('admin payment choice countdown expires exactly at the reservation deadline', () => {
+  const expiration = '2026-07-16T15:46:44+00:00';
+  assert.equal(
+    reservationHoldSecondsRemaining(expiration, Date.parse('2026-07-16T15:46:34Z')),
+    10,
+  );
+  assert.equal(reservationHoldHasExpired(expiration, Date.parse('2026-07-16T15:46:43.999Z')), false);
+  assert.equal(reservationHoldHasExpired(expiration, Date.parse('2026-07-16T15:46:44Z')), true);
+  assert.equal(formatReservationHoldTime(604), '10:04');
+});
+
+test('malformed reservation expiration fails closed', () => {
+  assert.equal(reservationHoldSecondsRemaining('not-a-date', Date.now()), 0);
+  assert.equal(reservationHoldHasExpired('not-a-date', Date.now()), true);
+  assert.equal(reservationHoldHasExpired(undefined, Date.now()), false);
+});
+
+test('source attribution strips Stripe credentials and transient partner checkout identity', () => {
+  const sanitized = sanitizeBookingSourceUrl(
+    'https://staging.booking.viaviamorainelake.com/?partnerId=par_safe&agentId=agent_safe&agentName=Isadora+Buttonmoss&embed_manage=1&reservationRef=resRef_previous&lastName=Tauro&bookingDate=2026-07-16&payment_intent=pi_previous&payment_intent_client_secret=do_not_store&redirect_status=succeeded&tab=bookings',
+  );
+  assert.ok(sanitized);
+
+  const url = new URL(sanitized);
+  assert.equal(url.searchParams.get('partnerId'), 'par_safe');
+  assert.equal(url.searchParams.get('agentId'), 'agent_safe');
+  assert.equal(url.searchParams.get('agentName'), 'Isadora Buttonmoss');
+  assert.equal(url.searchParams.get('tab'), 'bookings');
+  assert.equal(url.searchParams.has('payment_intent_client_secret'), false);
+  assert.equal(url.searchParams.has('payment_intent'), false);
+  assert.equal(url.searchParams.has('reservationRef'), false);
+  assert.equal(url.searchParams.has('lastName'), false);
+  assert.equal(url.searchParams.has('embed_manage'), false);
+});
+
+test('source attribution preserves safe custom partner query keys but strips token-like keys', () => {
+  const sanitized = sanitizeBookingSourceUrl(
+    'https://viaviamorainelake.com/partner/example?utm_source=partner&custom_partner_key=safe-value&accessToken=do-not-store',
+  );
+  assert.ok(sanitized);
+
+  const url = new URL(sanitized);
+  assert.equal(url.searchParams.get('utm_source'), 'partner');
+  assert.equal(url.searchParams.get('custom_partner_key'), 'safe-value');
+  assert.equal(url.searchParams.has('accessToken'), false);
+});
+
 test('admin quote response display state cannot invalidate its request identity', () => {
   const selectedAvailability = {
     availabilityId: 'a_1',
@@ -69,6 +127,52 @@ test('admin quote response display state cannot invalidate its request identity'
   assert.equal(keyAfterResponse, keyBeforeResponse);
 });
 
+test('private shuttle pricing replaces the selected calendar summary with hydrated rate details', () => {
+  const selectedSummary = {
+    availabilityId: 'a_private',
+    productOptionId: 'po_private',
+    dateTime: '2026-07-22',
+    vacancies: 26,
+    currency: 'CAD',
+    isSummary: true,
+  };
+  const hydrated = {
+    ...selectedSummary,
+    dateTime: '2026-07-22T06:00:00+00:00',
+    isSummary: false,
+    rates: [
+      {
+        rateId: 'RESOURCE',
+        category: 'RESOURCE',
+        available: 26,
+        price: 2099.99,
+        priceByCurrency: { CAD: 2099.99 },
+        appliedAdjustments: [
+          {
+            type: 'dynamic',
+            id: 'private-shuttle-busy-season-surcharge',
+            name: 'Private Shuttle Busy Season Surcharge',
+            changeByCurrency: { CAD: 400 },
+          },
+        ],
+      },
+    ],
+  };
+
+  const resolved = resolveHydratedPrivateShuttleAvailability(
+    selectedSummary,
+    [hydrated],
+    'po_private',
+  );
+  assert.equal(resolved, hydrated);
+  assert.equal(applyResourceAdjustments(1699.99, resolved, 'CAD'), 2099.99);
+});
+
+test('private shuttle checkout detects a quote total that differs from the displayed total', () => {
+  assert.equal(privateShuttlePriceChanged(2247, 2681), true);
+  assert.equal(privateShuttlePriceChanged(2681, 2681.0), false);
+});
+
 test('routes customer change quote to paid checkout when amount is due', () => {
   const decision = evaluateChangeBookingQuoteForCheckout({
     quote: quote({