@voyantjs/bookings 0.74.2 → 0.75.0

package/dist/checkout-capability.d.ts

@@ -2,15 +2,29 @@ import type { Context } from "hono";
 export declare const CHECKOUT_CAPABILITY_COOKIE = "voyant_checkout_session";
 export declare const CHECKOUT_CAPABILITY_HEADER = "X-Voyant-Checkout-Capability";
 export declare const CHECKOUT_CAPABILITY_SCOPE = "booking-checkout-session";
+export declare const GUEST_BOOKING_ACCESS_COOKIE = "voyant_guest_booking";
+export declare const GUEST_BOOKING_ACCESS_HEADER = "X-Voyant-Guest-Booking-Access";
+export declare const GUEST_BOOKING_ACCESS_SCOPE = "guest-booking";
 export declare const checkoutCapabilityActions: readonly ["session:read", "session:update", "session:reprice", "session:finalize", "payment:read", "payment:start"];
 export type CheckoutCapabilityAction = (typeof checkoutCapabilityActions)[number];
+export declare const guestBookingAccessActions: readonly ["overview:read", "payment:read", "payment:start"];
+export type GuestBookingAccessAction = (typeof guestBookingAccessActions)[number];
 export declare function resolveCheckoutCapabilitySecret(env: Record<string, string | undefined>): string;
 export declare function resolveCheckoutCapabilityTtlSeconds(env: Record<string, string | undefined>): number;
+export declare function resolveGuestBookingAccessSecret(env: Record<string, string | undefined>): string;
+export declare function resolveGuestBookingAccessTtlSeconds(env: Record<string, string | undefined>): number;
 export declare function issueCheckoutCapability(bookingId: string, env: Record<string, string | undefined>): Promise<{
     token: string;
     payload: import("@voyantjs/hono").PublicCapabilityPayload;
     expiresAt: Date;
 }>;
+export declare function issueGuestBookingAccess(bookingId: string, env: Record<string, string | undefined>): Promise<{
+    token: string;
+    payload: import("@voyantjs/hono").PublicCapabilityPayload;
+    expiresAt: Date;
+}>;
 export declare function requireCheckoutCapability(c: Context, bookingId: string, action: CheckoutCapabilityAction, env: Record<string, string | undefined>): Promise<import("@voyantjs/hono").PublicCapabilityPayload>;
+export declare function requireGuestBookingAccess(c: Context, bookingId: string, action: GuestBookingAccessAction, env: Record<string, string | undefined>): Promise<import("@voyantjs/hono").PublicCapabilityPayload>;
 export declare function checkoutCapabilityCookie(token: string, expiresAt: Date): string;
+export declare function guestBookingAccessCookie(token: string, expiresAt: Date): string;
 //# sourceMappingURL=checkout-capability.d.ts.map

package/dist/checkout-capability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checkout-capability.d.ts","sourceRoot":"","sources":["../src/checkout-capability.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAEnC,eAAO,MAAM,0BAA0B,4BAA4B,CAAA;AACnE,eAAO,MAAM,0BAA0B,iCAAiC,CAAA;AACxE,eAAO,MAAM,yBAAyB,6BAA6B,CAAA;AAEnE,eAAO,MAAM,yBAAyB,qHAO5B,CAAA;AAEV,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAA;AAKjF,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,UAQtF;AAED,wBAAgB,mCAAmC,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,UAQ1F;AAED,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;;;;GASxC;AAED,wBAAsB,yBAAyB,CAC7C,CAAC,EAAE,OAAO,EACV,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,wBAAwB,EAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,6DAiBxC;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,UAOtE"}
+{"version":3,"file":"checkout-capability.d.ts","sourceRoot":"","sources":["../src/checkout-capability.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAEnC,eAAO,MAAM,0BAA0B,4BAA4B,CAAA;AACnE,eAAO,MAAM,0BAA0B,iCAAiC,CAAA;AACxE,eAAO,MAAM,yBAAyB,6BAA6B,CAAA;AACnE,eAAO,MAAM,2BAA2B,yBAAyB,CAAA;AACjE,eAAO,MAAM,2BAA2B,kCAAkC,CAAA;AAC1E,eAAO,MAAM,0BAA0B,kBAAkB,CAAA;AAEzD,eAAO,MAAM,yBAAyB,qHAO5B,CAAA;AAEV,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEjF,eAAO,MAAM,yBAAyB,6DAA8D,CAAA;AAEpG,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAA;AAOjF,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,UAQtF;AAED,wBAAgB,mCAAmC,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,UAQ1F;AAED,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,UAMtF;AAED,wBAAgB,mCAAmC,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,UAQ1F;AAED,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;;;;GASxC;AAED,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;;;;GASxC;AAED,wBAAsB,yBAAyB,CAC7C,CAAC,EAAE,OAAO,EACV,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,wBAAwB,EAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,6DAiBxC;AAED,wBAAsB,yBAAyB,CAC7C,CAAC,EAAE,OAAO,EACV,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,wBAAwB,EAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,6DAiBxC;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,UAOtE;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,UAOtE"}

package/dist/checkout-capability.js

@@ -2,6 +2,9 @@ import { createPublicCapabilityToken, extractPublicCapabilityToken, serializePub
 export const CHECKOUT_CAPABILITY_COOKIE = "voyant_checkout_session";
 export const CHECKOUT_CAPABILITY_HEADER = "X-Voyant-Checkout-Capability";
 export const CHECKOUT_CAPABILITY_SCOPE = "booking-checkout-session";
+export const GUEST_BOOKING_ACCESS_COOKIE = "voyant_guest_booking";
+export const GUEST_BOOKING_ACCESS_HEADER = "X-Voyant-Guest-Booking-Access";
+export const GUEST_BOOKING_ACCESS_SCOPE = "guest-booking";
 export const checkoutCapabilityActions = [
     "session:read",
     "session:update",
@@ -10,8 +13,11 @@ export const checkoutCapabilityActions = [
     "payment:read",
     "payment:start",
 ];
+export const guestBookingAccessActions = ["overview:read", "payment:read", "payment:start"];
 const DEFAULT_TTL_SECONDS = 30 * 60;
 const MAX_TTL_SECONDS = 2 * 60 * 60;
+const DEFAULT_GUEST_ACCESS_TTL_SECONDS = 30 * 60;
+const MAX_GUEST_ACCESS_TTL_SECONDS = 2 * 60 * 60;
 export function resolveCheckoutCapabilitySecret(env) {
     return (env.VOYANT_CHECKOUT_CAPABILITY_SECRET ??
         env.CHECKOUT_CAPABILITY_SECRET ??
@@ -27,6 +33,19 @@ export function resolveCheckoutCapabilityTtlSeconds(env) {
     }
     return Math.min(Math.floor(parsed), MAX_TTL_SECONDS);
 }
+export function resolveGuestBookingAccessSecret(env) {
+    return (env.VOYANT_GUEST_BOOKING_ACCESS_SECRET ??
+        env.GUEST_BOOKING_ACCESS_SECRET ??
+        resolveCheckoutCapabilitySecret(env));
+}
+export function resolveGuestBookingAccessTtlSeconds(env) {
+    const raw = env.VOYANT_GUEST_BOOKING_ACCESS_TTL_SECONDS ?? env.GUEST_BOOKING_ACCESS_TTL_SECONDS;
+    const parsed = raw ? Number(raw) : DEFAULT_GUEST_ACCESS_TTL_SECONDS;
+    if (!Number.isFinite(parsed) || parsed <= 0) {
+        return DEFAULT_GUEST_ACCESS_TTL_SECONDS;
+    }
+    return Math.min(Math.floor(parsed), MAX_GUEST_ACCESS_TTL_SECONDS);
+}
 export async function issueCheckoutCapability(bookingId, env) {
     return createPublicCapabilityToken({
         secret: resolveCheckoutCapabilitySecret(env),
@@ -36,6 +55,15 @@ export async function issueCheckoutCapability(bookingId, env) {
         ttlSeconds: resolveCheckoutCapabilityTtlSeconds(env),
     });
 }
+export async function issueGuestBookingAccess(bookingId, env) {
+    return createPublicCapabilityToken({
+        secret: resolveGuestBookingAccessSecret(env),
+        scope: GUEST_BOOKING_ACCESS_SCOPE,
+        subjectId: bookingId,
+        actions: [...guestBookingAccessActions],
+        ttlSeconds: resolveGuestBookingAccessTtlSeconds(env),
+    });
+}
 export async function requireCheckoutCapability(c, bookingId, action, env) {
     const token = extractPublicCapabilityToken(c, {
         headerName: CHECKOUT_CAPABILITY_HEADER,
@@ -51,6 +79,21 @@ export async function requireCheckoutCapability(c, bookingId, action, env) {
         action,
     });
 }
+export async function requireGuestBookingAccess(c, bookingId, action, env) {
+    const token = extractPublicCapabilityToken(c, {
+        headerName: GUEST_BOOKING_ACCESS_HEADER,
+        cookieName: GUEST_BOOKING_ACCESS_COOKIE,
+    });
+    if (!token) {
+        throw new UnauthorizedApiError("Missing guest booking access capability");
+    }
+    return verifyPublicCapabilityToken(token, {
+        secret: resolveGuestBookingAccessSecret(env),
+        scope: GUEST_BOOKING_ACCESS_SCOPE,
+        subjectId: bookingId,
+        action,
+    });
+}
 export function checkoutCapabilityCookie(token, expiresAt) {
     return serializePublicCapabilityCookie({
         name: CHECKOUT_CAPABILITY_COOKIE,
@@ -59,3 +102,11 @@ export function checkoutCapabilityCookie(token, expiresAt) {
         path: "/v1/public",
     });
 }
+export function guestBookingAccessCookie(token, expiresAt) {
+    return serializePublicCapabilityCookie({
+        name: GUEST_BOOKING_ACCESS_COOKIE,
+        token,
+        expiresAt,
+        path: "/v1/public",
+    });
+}

package/dist/index.d.ts

@@ -30,5 +30,5 @@ export { bookingTravelerBedPreferenceSchema, bookingTravelerDietarySchema, booki
 export type { Booking, BookingActivity, BookingAllocation, BookingDocument, BookingFulfillment, BookingGroup, BookingGroupMember, BookingItem, BookingItemTraveler, BookingNote, BookingPiiAccessLog, BookingPriceOverride, BookingRedemptionEvent, BookingSessionState, BookingStaffAssignment, BookingSupplierStatus, BookingTraveler, NewBooking, NewBookingActivity, NewBookingAllocation, NewBookingDocument, NewBookingFulfillment, NewBookingGroup, NewBookingGroupMember, NewBookingItem, NewBookingItemTraveler, NewBookingNote, NewBookingPiiAccessLog, NewBookingRedemptionEvent, NewBookingSessionState, NewBookingStaffAssignment, NewBookingSupplierStatus, NewBookingTraveler, } from "./schema.js";
 export { bookingActivityLog, bookingAllocations, bookingDocuments, bookingFulfillments, bookingGroupKindEnum, bookingGroupMemberRoleEnum, bookingGroupMembers, bookingGroups, bookingItems, bookingItemTravelers, bookingNotes, bookingPiiAccessLog, bookingRedemptionEvents, bookingSessionStates, bookingStaffAssignments, bookingSupplierStatuses, bookings, bookingTravelers, } from "./schema.js";
 export { type PublicBookingsServiceResolvers, publicBookingsService, resolveSessionPricingSnapshot, } from "./service-public.js";
-export { addBookingGroupMemberSchema, bookingGroupKindSchema, bookingGroupListQuerySchema, bookingGroupMemberRoleSchema, bookingListQuerySchema, bookingPriceOverrideSchema, cancelBookingSchema, completeBookingSchema, confirmBookingSchema, convertProductSchema, createBookingSchema, createTravelerWithTravelDetailsSchema, expireBookingSchema, expireStaleBookingsSchema, extendBookingHoldSchema, insertBookingAllocationSchema, insertBookingDocumentSchema, insertBookingFulfillmentSchema, insertBookingGroupSchema, insertBookingItemSchema, insertBookingItemTravelerSchema, insertBookingNoteSchema, insertBookingSchema, insertBookingTravelerDocumentSchema, insertSupplierStatusSchema, insertTravelerSchema, internalBookingOverviewLookupQuerySchema, overrideBookingStatusSchema, pricingPreviewSchema, publicBookingOverviewLookupQuerySchema, publicBookingSessionMutationSchema, publicBookingSessionRepriceItemSchema, publicBookingSessionRepriceResultSchema, publicBookingSessionRepriceSummarySchema, publicBookingSessionStateSchema, publicCreateBookingSessionSchema, publicRepriceBookingSessionSchema, publicUpdateBookingSessionSchema, publicUpsertBookingSessionStateSchema, recordBookingRedemptionSchema, reserveBookingFromTransactionSchema, reserveBookingSchema, sharingGroupsForSlotQuerySchema, startBookingSchema, updateBookingAllocationSchema, updateBookingFulfillmentSchema, updateBookingGroupSchema, updateBookingItemSchema, updateBookingSchema, updateSupplierStatusSchema, updateTravelerSchema, updateTravelerWithTravelDetailsSchema, upsertTravelerTravelDetailsSchema, } from "./validation.js";
+export { addBookingGroupMemberSchema, bookingGroupKindSchema, bookingGroupListQuerySchema, bookingGroupMemberRoleSchema, bookingListQuerySchema, bookingPriceOverrideSchema, cancelBookingSchema, completeBookingSchema, confirmBookingSchema, convertProductSchema, createBookingSchema, createTravelerWithTravelDetailsSchema, expireBookingSchema, expireStaleBookingsSchema, extendBookingHoldSchema, insertBookingAllocationSchema, insertBookingDocumentSchema, insertBookingFulfillmentSchema, insertBookingGroupSchema, insertBookingItemSchema, insertBookingItemTravelerSchema, insertBookingNoteSchema, insertBookingSchema, insertBookingTravelerDocumentSchema, insertSupplierStatusSchema, insertTravelerSchema, internalBookingOverviewLookupQuerySchema, overrideBookingStatusSchema, pricingPreviewSchema, publicBookingOverviewAccessQuerySchema, publicBookingOverviewLookupQuerySchema, publicBookingSessionMutationSchema, publicBookingSessionRepriceItemSchema, publicBookingSessionRepriceResultSchema, publicBookingSessionRepriceSummarySchema, publicBookingSessionStateSchema, publicCreateBookingSessionSchema, publicGuestBookingAccessSchema, publicGuestBookingLookupResponseSchema, publicGuestBookingLookupSchema, publicRepriceBookingSessionSchema, publicUpdateBookingSessionSchema, publicUpsertBookingSessionStateSchema, recordBookingRedemptionSchema, reserveBookingFromTransactionSchema, reserveBookingSchema, sharingGroupsForSlotQuerySchema, startBookingSchema, updateBookingAllocationSchema, updateBookingFulfillmentSchema, updateBookingGroupSchema, updateBookingItemSchema, updateBookingSchema, updateSupplierStatusSchema, updateTravelerSchema, updateTravelerWithTravelDetailsSchema, upsertTravelerTravelDetailsSchema, } from "./validation.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAEvD,OAAO,EAEL,KAAK,0BAA0B,EAEhC,MAAM,oBAAoB,CAAA;AAI3B,OAAO,EACL,kCAAkC,EAClC,2BAA2B,EAC3B,2BAA2B,EAC3B,qCAAqC,GACtC,MAAM,iCAAiC,CAAA;AACxC,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,uBAAuB,EACvB,KAAK,sCAAsC,GAC5C,MAAM,UAAU,CAAA;AACjB,OAAO,EACL,KAAK,gBAAgB,EACrB,oBAAoB,EACpB,WAAW,EACX,WAAW,EACX,YAAY,EACZ,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,qBAAqB,EACrB,qBAAqB,EACrB,iCAAiC,EACjC,kCAAkC,EAClC,kBAAkB,EAClB,oCAAoC,EACpC,oCAAoC,GACrC,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,KAAK,6BAA6B,EAClC,oBAAoB,EACpB,KAAK,uBAAuB,EAC5B,yBAAyB,EACzB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,mBAAmB,EACnB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,KAAK,2BAA2B,EAChC,2BAA2B,GAC5B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,KAAK,4BAA4B,EACjC,KAAK,6BAA6B,EAClC,uBAAuB,GACxB,MAAM,kBAAkB,CAAA;AAEzB,eAAO,MAAM,eAAe,EAAE,kBAK7B,CAAA;AAED,eAAO,MAAM,gBAAgB;;CAE5B,CAAA;AAED,eAAO,MAAM,cAAc,EAAE,MAI5B,CAAA;AAED,MAAM,WAAW,yBAA0B,SAAQ,0BAA0B;CAAG;AAEhF,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,yBAA8B,GAAG,UAAU,CAiB5F;AAED,eAAO,MAAM,kBAAkB,EAAE,UAAuC,CAAA;AAExE,YAAY,EACV,4BAA4B,EAC5B,mBAAmB,EACnB,0BAA0B,EAC1B,2BAA2B,EAC3B,yBAAyB,EACzB,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,mCAAmC,EACnC,wBAAwB,GACzB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EAAE,+BAA+B,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AACjF,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxD,YAAY,EACV,4BAA4B,EAC5B,sBAAsB,EACtB,uBAAuB,EACvB,2BAA2B,EAC3B,oCAAoC,EACpC,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,kCAAkC,EAClC,4BAA4B,EAC5B,6BAA6B,EAC7B,uCAAuC,EACvC,uCAAuC,EACvC,4BAA4B,EAC5B,uCAAuC,EACvC,0CAA0C,EAC1C,2BAA2B,GAC5B,MAAM,4BAA4B,CAAA;AACnC,YAAY,EACV,OAAO,EACP,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,YAAY,EACZ,kBAAkB,EAClB,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,eAAe,EACf,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,sBAAsB,EACtB,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,mBAAmB,EACnB,aAAa,EACb,YAAY,EACZ,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,QAAQ,EACR,gBAAgB,GACjB,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,KAAK,8BAA8B,EACnC,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,2BAA2B,EAC3B,sBAAsB,EACtB,2BAA2B,EAC3B,4BAA4B,EAC5B,sBAAsB,EACtB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,qCAAqC,EACrC,mBAAmB,EACnB,yBAAyB,EACzB,uBAAuB,EACvB,6BAA6B,EAC7B,2BAA2B,EAC3B,8BAA8B,EAC9B,wBAAwB,EACxB,uBAAuB,EACvB,+BAA+B,EAC/B,uBAAuB,EACvB,mBAAmB,EACnB,mCAAmC,EACnC,0BAA0B,EAC1B,oBAAoB,EACpB,wCAAwC,EACxC,2BAA2B,EAC3B,oBAAoB,EACpB,sCAAsC,EACtC,kCAAkC,EAClC,qCAAqC,EACrC,uCAAuC,EACvC,wCAAwC,EACxC,+BAA+B,EAC/B,gCAAgC,EAChC,iCAAiC,EACjC,gCAAgC,EAChC,qCAAqC,EACrC,6BAA6B,EAC7B,mCAAmC,EACnC,oBAAoB,EACpB,+BAA+B,EAC/B,kBAAkB,EAClB,6BAA6B,EAC7B,8BAA8B,EAC9B,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,0BAA0B,EAC1B,oBAAoB,EACpB,qCAAqC,EACrC,iCAAiC,GAClC,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAEvD,OAAO,EAEL,KAAK,0BAA0B,EAEhC,MAAM,oBAAoB,CAAA;AAI3B,OAAO,EACL,kCAAkC,EAClC,2BAA2B,EAC3B,2BAA2B,EAC3B,qCAAqC,GACtC,MAAM,iCAAiC,CAAA;AACxC,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,uBAAuB,EACvB,KAAK,sCAAsC,GAC5C,MAAM,UAAU,CAAA;AACjB,OAAO,EACL,KAAK,gBAAgB,EACrB,oBAAoB,EACpB,WAAW,EACX,WAAW,EACX,YAAY,EACZ,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,qBAAqB,EACrB,qBAAqB,EACrB,iCAAiC,EACjC,kCAAkC,EAClC,kBAAkB,EAClB,oCAAoC,EACpC,oCAAoC,GACrC,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,KAAK,6BAA6B,EAClC,oBAAoB,EACpB,KAAK,uBAAuB,EAC5B,yBAAyB,EACzB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,mBAAmB,EACnB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,KAAK,2BAA2B,EAChC,2BAA2B,GAC5B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,KAAK,4BAA4B,EACjC,KAAK,6BAA6B,EAClC,uBAAuB,GACxB,MAAM,kBAAkB,CAAA;AAEzB,eAAO,MAAM,eAAe,EAAE,kBAK7B,CAAA;AAED,eAAO,MAAM,gBAAgB;;CAE5B,CAAA;AAED,eAAO,MAAM,cAAc,EAAE,MAI5B,CAAA;AAED,MAAM,WAAW,yBAA0B,SAAQ,0BAA0B;CAAG;AAEhF,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,yBAA8B,GAAG,UAAU,CAiB5F;AAED,eAAO,MAAM,kBAAkB,EAAE,UAAuC,CAAA;AAExE,YAAY,EACV,4BAA4B,EAC5B,mBAAmB,EACnB,0BAA0B,EAC1B,2BAA2B,EAC3B,yBAAyB,EACzB,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,mCAAmC,EACnC,wBAAwB,GACzB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EAAE,+BAA+B,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AACjF,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxD,YAAY,EACV,4BAA4B,EAC5B,sBAAsB,EACtB,uBAAuB,EACvB,2BAA2B,EAC3B,oCAAoC,EACpC,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,kCAAkC,EAClC,4BAA4B,EAC5B,6BAA6B,EAC7B,uCAAuC,EACvC,uCAAuC,EACvC,4BAA4B,EAC5B,uCAAuC,EACvC,0CAA0C,EAC1C,2BAA2B,GAC5B,MAAM,4BAA4B,CAAA;AACnC,YAAY,EACV,OAAO,EACP,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,YAAY,EACZ,kBAAkB,EAClB,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,eAAe,EACf,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,sBAAsB,EACtB,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,mBAAmB,EACnB,aAAa,EACb,YAAY,EACZ,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,QAAQ,EACR,gBAAgB,GACjB,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,KAAK,8BAA8B,EACnC,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,2BAA2B,EAC3B,sBAAsB,EACtB,2BAA2B,EAC3B,4BAA4B,EAC5B,sBAAsB,EACtB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,qCAAqC,EACrC,mBAAmB,EACnB,yBAAyB,EACzB,uBAAuB,EACvB,6BAA6B,EAC7B,2BAA2B,EAC3B,8BAA8B,EAC9B,wBAAwB,EACxB,uBAAuB,EACvB,+BAA+B,EAC/B,uBAAuB,EACvB,mBAAmB,EACnB,mCAAmC,EACnC,0BAA0B,EAC1B,oBAAoB,EACpB,wCAAwC,EACxC,2BAA2B,EAC3B,oBAAoB,EACpB,sCAAsC,EACtC,sCAAsC,EACtC,kCAAkC,EAClC,qCAAqC,EACrC,uCAAuC,EACvC,wCAAwC,EACxC,+BAA+B,EAC/B,gCAAgC,EAChC,8BAA8B,EAC9B,sCAAsC,EACtC,8BAA8B,EAC9B,iCAAiC,EACjC,gCAAgC,EAChC,qCAAqC,EACrC,6BAA6B,EAC7B,mCAAmC,EACnC,oBAAoB,EACpB,+BAA+B,EAC/B,kBAAkB,EAClB,6BAA6B,EAC7B,8BAA8B,EAC9B,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,0BAA0B,EAC1B,oBAAoB,EACpB,qCAAqC,EACrC,iCAAiC,GAClC,MAAM,iBAAiB,CAAA"}

package/dist/index.js

@@ -44,4 +44,4 @@ export { publicBookingRoutes } from "./routes-public.js";
 export { bookingTravelerBedPreferenceSchema, bookingTravelerDietarySchema, bookingTravelerIdentitySchema, bookingTravelerTravelDetailInsertSchema, bookingTravelerTravelDetailSelectSchema, bookingTravelerTravelDetails, bookingTravelerTravelDetailUpdateSchema, decryptedBookingTravelerTravelDetailSchema, travelerAllocationMapSchema, } from "./schema/travel-details.js";
 export { bookingActivityLog, bookingAllocations, bookingDocuments, bookingFulfillments, bookingGroupKindEnum, bookingGroupMemberRoleEnum, bookingGroupMembers, bookingGroups, bookingItems, bookingItemTravelers, bookingNotes, bookingPiiAccessLog, bookingRedemptionEvents, bookingSessionStates, bookingStaffAssignments, bookingSupplierStatuses, bookings, bookingTravelers, } from "./schema.js";
 export { publicBookingsService, resolveSessionPricingSnapshot, } from "./service-public.js";
-export { addBookingGroupMemberSchema, bookingGroupKindSchema, bookingGroupListQuerySchema, bookingGroupMemberRoleSchema, bookingListQuerySchema, bookingPriceOverrideSchema, cancelBookingSchema, completeBookingSchema, confirmBookingSchema, convertProductSchema, createBookingSchema, createTravelerWithTravelDetailsSchema, expireBookingSchema, expireStaleBookingsSchema, extendBookingHoldSchema, insertBookingAllocationSchema, insertBookingDocumentSchema, insertBookingFulfillmentSchema, insertBookingGroupSchema, insertBookingItemSchema, insertBookingItemTravelerSchema, insertBookingNoteSchema, insertBookingSchema, insertBookingTravelerDocumentSchema, insertSupplierStatusSchema, insertTravelerSchema, internalBookingOverviewLookupQuerySchema, overrideBookingStatusSchema, pricingPreviewSchema, publicBookingOverviewLookupQuerySchema, publicBookingSessionMutationSchema, publicBookingSessionRepriceItemSchema, publicBookingSessionRepriceResultSchema, publicBookingSessionRepriceSummarySchema, publicBookingSessionStateSchema, publicCreateBookingSessionSchema, publicRepriceBookingSessionSchema, publicUpdateBookingSessionSchema, publicUpsertBookingSessionStateSchema, recordBookingRedemptionSchema, reserveBookingFromTransactionSchema, reserveBookingSchema, sharingGroupsForSlotQuerySchema, startBookingSchema, updateBookingAllocationSchema, updateBookingFulfillmentSchema, updateBookingGroupSchema, updateBookingItemSchema, updateBookingSchema, updateSupplierStatusSchema, updateTravelerSchema, updateTravelerWithTravelDetailsSchema, upsertTravelerTravelDetailsSchema, } from "./validation.js";
+export { addBookingGroupMemberSchema, bookingGroupKindSchema, bookingGroupListQuerySchema, bookingGroupMemberRoleSchema, bookingListQuerySchema, bookingPriceOverrideSchema, cancelBookingSchema, completeBookingSchema, confirmBookingSchema, convertProductSchema, createBookingSchema, createTravelerWithTravelDetailsSchema, expireBookingSchema, expireStaleBookingsSchema, extendBookingHoldSchema, insertBookingAllocationSchema, insertBookingDocumentSchema, insertBookingFulfillmentSchema, insertBookingGroupSchema, insertBookingItemSchema, insertBookingItemTravelerSchema, insertBookingNoteSchema, insertBookingSchema, insertBookingTravelerDocumentSchema, insertSupplierStatusSchema, insertTravelerSchema, internalBookingOverviewLookupQuerySchema, overrideBookingStatusSchema, pricingPreviewSchema, publicBookingOverviewAccessQuerySchema, publicBookingOverviewLookupQuerySchema, publicBookingSessionMutationSchema, publicBookingSessionRepriceItemSchema, publicBookingSessionRepriceResultSchema, publicBookingSessionRepriceSummarySchema, publicBookingSessionStateSchema, publicCreateBookingSessionSchema, publicGuestBookingAccessSchema, publicGuestBookingLookupResponseSchema, publicGuestBookingLookupSchema, publicRepriceBookingSessionSchema, publicUpdateBookingSessionSchema, publicUpsertBookingSessionStateSchema, recordBookingRedemptionSchema, reserveBookingFromTransactionSchema, reserveBookingSchema, sharingGroupsForSlotQuerySchema, startBookingSchema, updateBookingAllocationSchema, updateBookingFulfillmentSchema, updateBookingGroupSchema, updateBookingItemSchema, updateBookingSchema, updateSupplierStatusSchema, updateTravelerSchema, updateTravelerWithTravelDetailsSchema, upsertTravelerTravelDetailsSchema, } from "./validation.js";

package/dist/routes-public.d.ts

@@ -578,6 +578,101 @@ export declare const publicBookingRoutes: import("hono/hono-base").HonoBase<Env,
             status: import("hono/utils/http-status").ContentfulStatusCode;
         };
     };
-}, "/", "/overview">;
+} & {
+    "/guest-lookup": {
+        $post: {
+            input: {};
+            output: {
+                error: string;
+            };
+            outputFormat: "json";
+            status: 404;
+        } | {
+            input: {};
+            output: {
+                error: string;
+            };
+            outputFormat: "json";
+            status: 429;
+        } | {
+            input: {};
+            output: {
+                data: {
+                    overview: {
+                        bookingId: string;
+                        bookingNumber: string;
+                        status: "expired" | "cancelled" | "completed" | "draft" | "on_hold" | "awaiting_payment" | "confirmed" | "in_progress";
+                        sellCurrency: string;
+                        sellAmountCents: number | null;
+                        startDate: string | null;
+                        endDate: string | null;
+                        pax: number | null;
+                        confirmedAt: string | null;
+                        cancelledAt: string | null;
+                        completedAt: string | null;
+                        travelers: {
+                            id: string;
+                            participantType: "other" | "traveler" | "occupant";
+                            firstName: string;
+                            lastName: string;
+                            isPrimary: boolean;
+                        }[];
+                        items: {
+                            id: string;
+                            title: string;
+                            description: string | null;
+                            itemType: "service" | "other" | "unit" | "extra" | "fee" | "tax" | "discount" | "adjustment" | "accommodation" | "transport";
+                            status: "expired" | "cancelled" | "draft" | "on_hold" | "confirmed" | "fulfilled";
+                            serviceDate: string | null;
+                            startsAt: string | null;
+                            endsAt: string | null;
+                            quantity: number;
+                            sellCurrency: string;
+                            unitSellAmountCents: number | null;
+                            totalSellAmountCents: number | null;
+                            costCurrency: string | null;
+                            unitCostAmountCents: number | null;
+                            totalCostAmountCents: number | null;
+                            notes: string | null;
+                            productId: string | null;
+                            optionId: string | null;
+                            optionUnitId: string | null;
+                            pricingCategoryId: string | null;
+                            travelerLinks: {
+                                id: string;
+                                travelerId: string;
+                                role: string;
+                                isPrimary: boolean;
+                            }[];
+                        }[];
+                        documents: {
+                            id: string;
+                            travelerId: string | null;
+                            type: "visa" | "other" | "insurance" | "health" | "passport_copy";
+                            fileName: string;
+                            fileUrl: string;
+                        }[];
+                        fulfillments: {
+                            id: string;
+                            bookingItemId: string | null;
+                            travelerId: string | null;
+                            fulfillmentType: "other" | "voucher" | "ticket" | "pdf" | "qr_code" | "barcode" | "mobile";
+                            deliveryChannel: "api" | "email" | "other" | "download" | "wallet";
+                            status: "failed" | "pending" | "issued" | "reissued" | "revoked";
+                            artifactUrl: string | null;
+                        }[];
+                    };
+                    guestBookingAccess: {
+                        token: string;
+                        expiresAt: string;
+                        actions: ("payment:read" | "payment:start" | "overview:read")[];
+                    };
+                };
+            };
+            outputFormat: "json";
+            status: import("hono/utils/http-status").ContentfulStatusCode;
+        };
+    };
+}, "/", "/guest-lookup">;
 export type PublicBookingRoutes = typeof publicBookingRoutes;
 //# sourceMappingURL=routes-public.d.ts.map

package/dist/routes-public.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes-public.d.ts","sourceRoot":"","sources":["../src/routes-public.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,KAAK,GAAG,EAA2B,MAAM,oBAAoB,CAAA;AAyFtE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;+BA0BsC,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAqJxE,CAAA;AAEJ,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAA"}
+{"version":3,"file":"routes-public.d.ts","sourceRoot":"","sources":["../src/routes-public.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,KAAK,GAAG,EAA2B,MAAM,oBAAoB,CAAA;AAyKtE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;+BA0BsC,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAsLxE,CAAA;AAEJ,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAA"}

package/dist/routes-public.js

@@ -1,10 +1,10 @@
 import { idempotencyKey, parseJsonBody, parseQuery, UnauthorizedApiError } from "@voyantjs/hono";
 import { Hono } from "hono";
-import { checkoutCapabilityActions, checkoutCapabilityCookie, issueCheckoutCapability, requireCheckoutCapability, } from "./checkout-capability.js";
+import { checkoutCapabilityActions, checkoutCapabilityCookie, guestBookingAccessActions, guestBookingAccessCookie, issueCheckoutCapability, issueGuestBookingAccess, requireCheckoutCapability, requireGuestBookingAccess, } from "./checkout-capability.js";
 import { BOOKING_ROUTE_RUNTIME_CONTAINER_KEY, buildBookingRouteRuntime, } from "./route-runtime.js";
 import { getRuntimeEnv, notFound } from "./routes-shared.js";
 import { publicBookingsService } from "./service-public.js";
-import { publicBookingOverviewLookupQuerySchema, publicBookingSessionMutationSchema, publicCreateBookingSessionSchema, publicRepriceBookingSessionSchema, publicUpdateBookingSessionSchema, publicUpsertBookingSessionStateSchema, } from "./validation-public.js";
+import { publicBookingOverviewAccessQuerySchema, publicBookingSessionMutationSchema, publicCreateBookingSessionSchema, publicGuestBookingLookupSchema, publicRepriceBookingSessionSchema, publicUpdateBookingSessionSchema, publicUpsertBookingSessionStateSchema, } from "./validation-public.js";
 function hasSessionResult(result) {
     return "session" in result;
 }
@@ -38,6 +38,16 @@ function attachCheckoutCapability(session, issued) {
         },
     };
 }
+function attachGuestBookingAccess(overview, issued) {
+    return {
+        overview,
+        guestBookingAccess: {
+            token: issued.token,
+            expiresAt: issued.expiresAt.toISOString(),
+            actions: [...guestBookingAccessActions],
+        },
+    };
+}
 async function requireSessionCapability(c, action) {
     const sessionId = c.req.param("sessionId");
     if (!sessionId) {
@@ -51,6 +61,57 @@ function sessionCapability(action) {
         await next();
     };
 }
+function guestBookingLookupLimit(env) {
+    const raw = env.VOYANT_GUEST_BOOKING_LOOKUP_LIMIT_PER_MINUTE ?? env.GUEST_BOOKING_LOOKUP_LIMIT_PER_MINUTE;
+    const parsed = raw ? Number(raw) : 10;
+    if (!Number.isFinite(parsed) || parsed <= 0) {
+        return 10;
+    }
+    return Math.min(Math.floor(parsed), 100);
+}
+function clientIp(c) {
+    return (c.req.header("CF-Connecting-IP") ??
+        c.req.header("X-Real-IP") ??
+        c.req.header("X-Forwarded-For")?.split(",")[0]?.trim() ??
+        "unknown");
+}
+async function enforceGuestBookingLookupRateLimit(c, bookingCode) {
+    const kv = c.env?.RATE_LIMIT;
+    if (!kv)
+        return null;
+    const now = new Date();
+    const pad = (value) => String(value).padStart(2, "0");
+    const windowKey = `${now.getUTCFullYear()}${pad(now.getUTCMonth() + 1)}${pad(now.getUTCDate())}${pad(now.getUTCHours())}${pad(now.getUTCMinutes())}`;
+    const key = [
+        "lim",
+        "guest-booking-lookup",
+        clientIp(c),
+        bookingCode.trim().toLowerCase(),
+        windowKey,
+    ].join(":");
+    const limit = guestBookingLookupLimit(getRuntimeEnv(c));
+    const raw = await kv.get(key);
+    let current = 0;
+    if (raw) {
+        try {
+            current = Number(JSON.parse(raw).count || 0);
+        }
+        catch {
+            current = 0;
+        }
+    }
+    const nextCount = current + 1;
+    await kv.put(key, JSON.stringify({ count: nextCount }), { expirationTtl: 120 });
+    const resetIn = 60000 - (now.getUTCSeconds() * 1000 + now.getUTCMilliseconds());
+    c.header("X-RateLimit-Limit", String(limit));
+    c.header("X-RateLimit-Remaining", String(Math.max(0, limit - nextCount)));
+    c.header("X-RateLimit-Reset", String(Date.now() + resetIn));
+    if (nextCount <= limit) {
+        return null;
+    }
+    c.header("Retry-After", "60");
+    return c.json({ error: "Too Many Requests" }, 429);
+}
 function getRouteRuntime(c) {
     const container = c.var.container;
     try {
@@ -148,6 +209,38 @@ export const publicBookingRoutes = new Hono()
     return c.json({ data: result.session });
 })
     .get("/overview", async (c) => {
-    const overview = await publicBookingsService.getOverview(c.get("db"), await parseQuery(c, publicBookingOverviewLookupQuerySchema));
-    return overview ? c.json({ data: overview }) : notFound(c, "Booking overview not found");
+    const query = await parseQuery(c, publicBookingOverviewAccessQuerySchema);
+    const overview = query.email
+        ? await publicBookingsService.getOverview(c.get("db"), {
+            bookingId: query.bookingId,
+            bookingNumber: query.bookingNumber,
+            bookingCode: query.bookingCode,
+            email: query.email,
+        })
+        : await publicBookingsService.getOverviewByGuestAccess(c.get("db"), query);
+    if (!overview) {
+        if (!query.email) {
+            throw new UnauthorizedApiError("Missing guest booking access capability");
+        }
+        return notFound(c, "Booking overview not found");
+    }
+    if (!query.email) {
+        await requireGuestBookingAccess(c, overview.bookingId, "overview:read", getRuntimeEnv(c));
+    }
+    return c.json({ data: overview });
+})
+    .post("/guest-lookup", async (c) => {
+    const input = await parseJsonBody(c, publicGuestBookingLookupSchema);
+    const rateLimited = await enforceGuestBookingLookupRateLimit(c, input.bookingCode);
+    if (rateLimited)
+        return rateLimited;
+    const overview = await publicBookingsService.getOverview(c.get("db"), input);
+    if (!overview) {
+        return notFound(c, "Booking overview not found");
+    }
+    const capability = await issueGuestBookingAccess(overview.bookingId, getRuntimeEnv(c));
+    c.header("Set-Cookie", guestBookingAccessCookie(capability.token, capability.expiresAt), {
+        append: true,
+    });
+    return c.json({ data: attachGuestBookingAccess(overview, capability) });
 });

package/dist/service-public.d.ts

@@ -1,6 +1,6 @@
 import type { PostgresJsDatabase } from "drizzle-orm/postgres-js";
 import type { ResolveBookingBillingPerson, ResolveBookingTravelerPerson } from "./route-runtime.js";
-import type { InternalBookingOverviewLookupQuery, PublicBookingOverviewLookupQuery, PublicBookingSessionMutationInput, PublicBookingSessionRepriceInput, PublicCreateBookingSessionInput, PublicUpdateBookingSessionInput, PublicUpsertBookingSessionStateInput } from "./validation-public.js";
+import type { InternalBookingOverviewLookupQuery, PublicBookingOverviewAccessQuery, PublicBookingOverviewLookupQuery, PublicBookingSessionMutationInput, PublicBookingSessionRepriceInput, PublicCreateBookingSessionInput, PublicUpdateBookingSessionInput, PublicUpsertBookingSessionStateInput } from "./validation-public.js";
 /**
  * Optional resolver bundle for storefront/public booking flows. When
  * supplied, billing-contact + traveler payloads are run through the
@@ -761,6 +761,70 @@ export declare const publicBookingsService: {
             artifactUrl: string | null;
         }[];
     } | null>;
+    getOverviewByGuestAccess(db: PostgresJsDatabase, query: PublicBookingOverviewAccessQuery): Promise<{
+        bookingId: string;
+        bookingNumber: string;
+        status: "expired" | "cancelled" | "completed" | "draft" | "on_hold" | "awaiting_payment" | "confirmed" | "in_progress";
+        sellCurrency: string;
+        sellAmountCents: number | null;
+        startDate: string | null;
+        endDate: string | null;
+        pax: number | null;
+        confirmedAt: string | null;
+        cancelledAt: string | null;
+        completedAt: string | null;
+        travelers: {
+            id: string;
+            participantType: "other" | "traveler" | "occupant";
+            firstName: string;
+            lastName: string;
+            isPrimary: boolean;
+        }[];
+        items: {
+            id: string;
+            title: string;
+            description: string | null;
+            itemType: "service" | "other" | "unit" | "extra" | "fee" | "tax" | "discount" | "adjustment" | "accommodation" | "transport";
+            status: "expired" | "cancelled" | "draft" | "on_hold" | "confirmed" | "fulfilled";
+            serviceDate: string | null;
+            startsAt: string | null;
+            endsAt: string | null;
+            quantity: number;
+            sellCurrency: string;
+            unitSellAmountCents: number | null;
+            totalSellAmountCents: number | null;
+            costCurrency: string | null;
+            unitCostAmountCents: number | null;
+            totalCostAmountCents: number | null;
+            notes: string | null;
+            productId: string | null;
+            optionId: string | null;
+            optionUnitId: string | null;
+            pricingCategoryId: string | null;
+            travelerLinks: {
+                id: string;
+                travelerId: string;
+                role: string;
+                isPrimary: boolean;
+            }[];
+        }[];
+        documents: {
+            id: string;
+            travelerId: string | null;
+            type: "visa" | "other" | "insurance" | "health" | "passport_copy";
+            fileName: string;
+            fileUrl: string;
+        }[];
+        fulfillments: {
+            id: string;
+            bookingItemId: string | null;
+            travelerId: string | null;
+            fulfillmentType: "other" | "voucher" | "ticket" | "pdf" | "qr_code" | "barcode" | "mobile";
+            deliveryChannel: "api" | "email" | "other" | "download" | "wallet";
+            status: "failed" | "pending" | "issued" | "reissued" | "revoked";
+            artifactUrl: string | null;
+        }[];
+    } | null>;
     getOverviewByLookup(db: PostgresJsDatabase, query: InternalBookingOverviewLookupQuery): Promise<{
         bookingId: string;
         bookingNumber: string;

package/dist/service-public.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-public.d.ts","sourceRoot":"","sources":["../src/service-public.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AASjE,OAAO,KAAK,EAEV,2BAA2B,EAC3B,4BAA4B,EAC7B,MAAM,oBAAoB,CAAA;AAY3B,OAAO,KAAK,EACV,kCAAkC,EAClC,gCAAgC,EAChC,iCAAiC,EACjC,gCAAgC,EAEhC,+BAA+B,EAC/B,+BAA+B,EAC/B,oCAAoC,EACrC,MAAM,wBAAwB,CAAA;AAG/B;;;;;;;GAOG;AACH,MAAM,WAAW,8BAA8B;IAC7C,oBAAoB,CAAC,EAAE,2BAA2B,CAAA;IAClD,qBAAqB,CAAC,EAAE,4BAA4B,CAAA;CACrD;AA8pBD;;;;;;;;;;;GAWG;AACH,wBAAsB,6BAA6B,CACjD,EAAE,EAAE,kBAAkB,EACtB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE;IACL,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC9B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7B,mHAAmH;IACnH,oBAAoB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;CAC3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAsKF;AAuJD,eAAO,MAAM,qBAAqB;sBAE1B,kBAAkB,SACf,+BAA+B,WAC7B,MAAM,cACJ,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAjHnC,MAAM;gCACE,MAAM;0BACZ,MAAM;+BACD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uBAkMH,kBAAkB,aAAa,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBArMhD,MAAM;4BACE,MAAM;sBACZ,MAAM;2BACD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAsMI,kBAAkB,aAAa,MAAM;;;;;;;;;;2BAUzD,kBAAkB,aACX,MAAM,SACV,oCAAoC,cAChC,8BAA8B,WAChC,MAAM;;;;;;;;;;;;;;;;sBA4CX,kBAAkB,aACX,MAAM,SACV,+BAA+B,WAC7B,MAAM,cACJ,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAvQnC,MAAM;gCACE,MAAM;0BACZ,MAAM;+BACD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uBA6XhB,kBAAkB,aACX,MAAM,SACV,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;wBAwC7B,MAAM;uBACP,MAAM;2BACF,MAAM,GAAG,IAAI;0BACd,MAAM,GAAG,IAAI;8BACT,MAAM,GAAG,IAAI;gCACX,MAAM,GAAG,IAAI;gCACb,MAAM,GAAG,IAAI;mCACV,MAAM,GAAG,IAAI;0BACtB,MAAM;6BACH,MAAM;qCACE,MAAM,GAAG,IAAI;sCACZ,MAAM,GAAG,IAAI;0BACzB,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAtbd,MAAM;gCACE,MAAM;0BACZ,MAAM;+BACD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uBAyqBhB,kBAAkB,aACX,MAAM,SACV,iCAAiC,WAC/B,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA/qBT,MAAM;gCACE,MAAM;0BACZ,MAAM;+BACD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sBAwrBhB,kBAAkB,aACX,MAAM,SACV,iCAAiC,WAC/B,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA9rBT,MAAM;gCACE,MAAM;0BACZ,MAAM;+BACD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAssBA,kBAAkB,SAAS,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAriCzE,MAAM;4BACE,MAAM;sBACZ,MAAM;2BACD,OAAO;;;;;;;;;;;;;;;;;;;;4BAsiCQ,kBAAkB,SAAS,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAziCnF,MAAM;4BACE,MAAM;sBACZ,MAAM;2BACD,OAAO;;;;;;;;;;;;;;;;;;;;CAyiCvB,CAAA"}
+{"version":3,"file":"service-public.d.ts","sourceRoot":"","sources":["../src/service-public.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AASjE,OAAO,KAAK,EAEV,2BAA2B,EAC3B,4BAA4B,EAC7B,MAAM,oBAAoB,CAAA;AAY3B,OAAO,KAAK,EACV,kCAAkC,EAClC,gCAAgC,EAChC,gCAAgC,EAChC,iCAAiC,EACjC,gCAAgC,EAEhC,+BAA+B,EAC/B,+BAA+B,EAC/B,oCAAoC,EACrC,MAAM,wBAAwB,CAAA;AAG/B;;;;;;;GAOG;AACH,MAAM,WAAW,8BAA8B;IAC7C,oBAAoB,CAAC,EAAE,2BAA2B,CAAA;IAClD,qBAAqB,CAAC,EAAE,4BAA4B,CAAA;CACrD;AAyqBD;;;;;;;;;;;GAWG;AACH,wBAAsB,6BAA6B,CACjD,EAAE,EAAE,kBAAkB,EACtB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE;IACL,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC9B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7B,mHAAmH;IACnH,oBAAoB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;CAC3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAsKF;AAuJD,eAAO,MAAM,qBAAqB;sBAE1B,kBAAkB,SACf,+BAA+B,WAC7B,MAAM,cACJ,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAjHnC,MAAM;gCACE,MAAM;0BACZ,MAAM;+BACD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uBAkMH,kBAAkB,aAAa,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBArMhD,MAAM;4BACE,MAAM;sBACZ,MAAM;2BACD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAsMI,kBAAkB,aAAa,MAAM;;;;;;;;;;2BAUzD,kBAAkB,aACX,MAAM,SACV,oCAAoC,cAChC,8BAA8B,WAChC,MAAM;;;;;;;;;;;;;;;;sBA4CX,kBAAkB,aACX,MAAM,SACV,+BAA+B,WAC7B,MAAM,cACJ,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAvQnC,MAAM;gCACE,MAAM;0BACZ,MAAM;+BACD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uBA6XhB,kBAAkB,aACX,MAAM,SACV,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;wBAwC7B,MAAM;uBACP,MAAM;2BACF,MAAM,GAAG,IAAI;0BACd,MAAM,GAAG,IAAI;8BACT,MAAM,GAAG,IAAI;gCACX,MAAM,GAAG,IAAI;gCACb,MAAM,GAAG,IAAI;mCACV,MAAM,GAAG,IAAI;0BACtB,MAAM;6BACH,MAAM;qCACE,MAAM,GAAG,IAAI;sCACZ,MAAM,GAAG,IAAI;0BACzB,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAtbd,MAAM;gCACE,MAAM;0BACZ,MAAM;+BACD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uBAyqBhB,kBAAkB,aACX,MAAM,SACV,iCAAiC,WAC/B,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA/qBT,MAAM;gCACE,MAAM;0BACZ,MAAM;+BACD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sBAwrBhB,kBAAkB,aACX,MAAM,SACV,iCAAiC,WAC/B,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA9rBT,MAAM;gCACE,MAAM;0BACZ,MAAM;+BACD,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAssBA,kBAAkB,SAAS,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAhjCzE,MAAM;4BACE,MAAM;sBACZ,MAAM;2BACD,OAAO;;;;;;;;;;;;;;;;;;;;iCAijCa,kBAAkB,SAAS,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBApjCtF,MAAM;4BACE,MAAM;sBACZ,MAAM;2BACD,OAAO;;;;;;;;;;;;;;;;;;;;4BAqjCQ,kBAAkB,SAAS,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAxjCnF,MAAM;4BACE,MAAM;sBACZ,MAAM;2BACD,OAAO;;;;;;;;;;;;;;;;;;;;CAwjCvB,CAAA"}

package/dist/service-public.js

@@ -341,7 +341,7 @@ async function buildOverviewSnapshot(db, query) {
     ]);
     const email = query.email?.trim().toLowerCase() ?? null;
     if (email) {
-        const authorized = participants.some((participant) => participant.email?.toLowerCase() === email);
+        const authorized = participants.some((participant) => constantTimeEqualString(participant.email?.trim().toLowerCase() ?? "", email));
         if (!authorized) {
             return null;
         }
@@ -417,6 +417,14 @@ async function buildOverviewSnapshot(db, query) {
         })),
     };
 }
+function constantTimeEqualString(left, right) {
+    let result = left.length ^ right.length;
+    const length = Math.max(left.length, right.length);
+    for (let index = 0; index < length; index += 1) {
+        result |= (left.charCodeAt(index) || 0) ^ (right.charCodeAt(index) || 0);
+    }
+    return result === 0;
+}
 function buildUnitWarnings(unit, quantity, sessionPax) {
     const warnings = [];
     if (!unit) {
@@ -1113,6 +1121,9 @@ export const publicBookingsService = {
     async getOverview(db, query) {
         return buildOverviewSnapshot(db, query);
     },
+    async getOverviewByGuestAccess(db, query) {
+        return buildOverviewSnapshot(db, query);
+    },
     async getOverviewByLookup(db, query) {
         return buildOverviewSnapshot(db, query);
     },

package/dist/validation-public.d.ts

@@ -199,7 +199,19 @@ export declare const publicRepriceBookingSessionSchema: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export declare const publicBookingOverviewLookupQuerySchema: z.ZodObject<{
-    bookingNumber: z.ZodString;
+    email: z.ZodString;
+    bookingId: z.ZodOptional<z.ZodString>;
+    bookingNumber: z.ZodOptional<z.ZodString>;
+    bookingCode: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const publicBookingOverviewAccessQuerySchema: z.ZodObject<{
+    email: z.ZodOptional<z.ZodString>;
+    bookingId: z.ZodOptional<z.ZodString>;
+    bookingNumber: z.ZodOptional<z.ZodString>;
+    bookingCode: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const publicGuestBookingLookupSchema: z.ZodObject<{
+    bookingCode: z.ZodString;
     email: z.ZodString;
 }, z.core.$strip>;
 export declare const internalBookingOverviewLookupQuerySchema: z.ZodObject<{
@@ -338,6 +350,15 @@ export declare const publicCheckoutCapabilitySchema: z.ZodObject<{
         "payment:start": "payment:start";
     }>>;
 }, z.core.$strip>;
+export declare const publicGuestBookingAccessSchema: z.ZodObject<{
+    token: z.ZodString;
+    expiresAt: z.ZodString;
+    actions: z.ZodArray<z.ZodEnum<{
+        "payment:read": "payment:read";
+        "payment:start": "payment:start";
+        "overview:read": "overview:read";
+    }>>;
+}, z.core.$strip>;
 export declare const publicBookingSessionSchema: z.ZodObject<{
     sessionId: z.ZodString;
     bookingNumber: z.ZodString;
@@ -890,13 +911,154 @@ export declare const publicBookingOverviewSchema: z.ZodObject<{
         artifactUrl: z.ZodNullable<z.ZodString>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
+export declare const publicGuestBookingLookupResponseSchema: z.ZodObject<{
+    overview: z.ZodObject<{
+        bookingId: z.ZodString;
+        bookingNumber: z.ZodString;
+        status: z.ZodEnum<{
+            expired: "expired";
+            cancelled: "cancelled";
+            completed: "completed";
+            draft: "draft";
+            on_hold: "on_hold";
+            awaiting_payment: "awaiting_payment";
+            confirmed: "confirmed";
+            in_progress: "in_progress";
+        }>;
+        sellCurrency: z.ZodString;
+        sellAmountCents: z.ZodNullable<z.ZodNumber>;
+        startDate: z.ZodNullable<z.ZodString>;
+        endDate: z.ZodNullable<z.ZodString>;
+        pax: z.ZodNullable<z.ZodNumber>;
+        confirmedAt: z.ZodNullable<z.ZodString>;
+        cancelledAt: z.ZodNullable<z.ZodString>;
+        completedAt: z.ZodNullable<z.ZodString>;
+        travelers: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            participantType: z.ZodEnum<{
+                other: "other";
+                traveler: "traveler";
+                occupant: "occupant";
+            }>;
+            firstName: z.ZodString;
+            lastName: z.ZodString;
+            isPrimary: z.ZodBoolean;
+        }, z.core.$strip>>;
+        items: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            title: z.ZodString;
+            description: z.ZodNullable<z.ZodString>;
+            itemType: z.ZodEnum<{
+                service: "service";
+                other: "other";
+                unit: "unit";
+                extra: "extra";
+                fee: "fee";
+                tax: "tax";
+                discount: "discount";
+                adjustment: "adjustment";
+                accommodation: "accommodation";
+                transport: "transport";
+            }>;
+            status: z.ZodEnum<{
+                expired: "expired";
+                cancelled: "cancelled";
+                draft: "draft";
+                on_hold: "on_hold";
+                confirmed: "confirmed";
+                fulfilled: "fulfilled";
+            }>;
+            serviceDate: z.ZodNullable<z.ZodString>;
+            startsAt: z.ZodNullable<z.ZodString>;
+            endsAt: z.ZodNullable<z.ZodString>;
+            quantity: z.ZodNumber;
+            sellCurrency: z.ZodString;
+            unitSellAmountCents: z.ZodNullable<z.ZodNumber>;
+            totalSellAmountCents: z.ZodNullable<z.ZodNumber>;
+            costCurrency: z.ZodNullable<z.ZodString>;
+            unitCostAmountCents: z.ZodNullable<z.ZodNumber>;
+            totalCostAmountCents: z.ZodNullable<z.ZodNumber>;
+            notes: z.ZodNullable<z.ZodString>;
+            productId: z.ZodNullable<z.ZodString>;
+            optionId: z.ZodNullable<z.ZodString>;
+            optionUnitId: z.ZodNullable<z.ZodString>;
+            pricingCategoryId: z.ZodNullable<z.ZodString>;
+            travelerLinks: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                travelerId: z.ZodString;
+                role: z.ZodEnum<{
+                    other: "other";
+                    traveler: "traveler";
+                    occupant: "occupant";
+                    beneficiary: "beneficiary";
+                }>;
+                isPrimary: z.ZodBoolean;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        documents: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            travelerId: z.ZodNullable<z.ZodString>;
+            type: z.ZodEnum<{
+                visa: "visa";
+                other: "other";
+                insurance: "insurance";
+                health: "health";
+                passport_copy: "passport_copy";
+            }>;
+            fileName: z.ZodString;
+            fileUrl: z.ZodString;
+        }, z.core.$strip>>;
+        fulfillments: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            bookingItemId: z.ZodNullable<z.ZodString>;
+            travelerId: z.ZodNullable<z.ZodString>;
+            fulfillmentType: z.ZodEnum<{
+                other: "other";
+                voucher: "voucher";
+                ticket: "ticket";
+                pdf: "pdf";
+                qr_code: "qr_code";
+                barcode: "barcode";
+                mobile: "mobile";
+            }>;
+            deliveryChannel: z.ZodEnum<{
+                api: "api";
+                email: "email";
+                other: "other";
+                download: "download";
+                wallet: "wallet";
+            }>;
+            status: z.ZodEnum<{
+                failed: "failed";
+                pending: "pending";
+                issued: "issued";
+                reissued: "reissued";
+                revoked: "revoked";
+            }>;
+            artifactUrl: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    guestBookingAccess: z.ZodObject<{
+        token: z.ZodString;
+        expiresAt: z.ZodString;
+        actions: z.ZodArray<z.ZodEnum<{
+            "payment:read": "payment:read";
+            "payment:start": "payment:start";
+            "overview:read": "overview:read";
+        }>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
 export type PublicCreateBookingSessionInput = z.infer<typeof publicCreateBookingSessionSchema>;
 export type PublicUpdateBookingSessionInput = z.infer<typeof publicUpdateBookingSessionSchema>;
 export type PublicBookingSessionMutationInput = z.infer<typeof publicBookingSessionMutationSchema>;
 export type PublicCheckoutCapability = z.infer<typeof publicCheckoutCapabilitySchema>;
+export type PublicGuestBookingAccess = z.infer<typeof publicGuestBookingAccessSchema>;
 export type PublicBookingSessionState = z.infer<typeof publicBookingSessionStateSchema>;
 export type PublicUpsertBookingSessionStateInput = z.infer<typeof publicUpsertBookingSessionStateSchema>;
 export type PublicBookingSessionRepriceInput = z.infer<typeof publicRepriceBookingSessionSchema>;
 export type PublicBookingOverviewLookupQuery = z.infer<typeof publicBookingOverviewLookupQuerySchema>;
+export type PublicBookingOverviewAccessQuery = z.infer<typeof publicBookingOverviewAccessQuerySchema>;
+export type PublicGuestBookingLookupInput = z.infer<typeof publicGuestBookingLookupSchema>;
+export type PublicGuestBookingLookupResponse = z.infer<typeof publicGuestBookingLookupResponseSchema>;
 export type InternalBookingOverviewLookupQuery = z.infer<typeof internalBookingOverviewLookupQuerySchema>;
 //# sourceMappingURL=validation-public.d.ts.map

package/dist/validation-public.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validation-public.d.ts","sourceRoot":"","sources":["../src/validation-public.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAqBvB,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;iBAYlD,CAAA;AAEF,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoB/C,CAAA;AAEF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsB3C,CAAA;AAEF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAa3C,CAAA;AAEF,eAAO,MAAM,kCAAkC;;iBAE7C,CAAA;AAEF,eAAO,MAAM,+BAA+B;;;;;;;;;iBAS1C,CAAA;AAEF,eAAO,MAAM,qCAAqC;;;;;iBAKhD,CAAA;AAEF,eAAO,MAAM,0CAA0C;;;;;;iBAMrD,CAAA;AAEF,eAAO,MAAM,iCAAiC;;;;;;;;;;iBAI5C,CAAA;AAEF,eAAO,MAAM,sCAAsC;;;iBAGjD,CAAA;AAEF,eAAO,MAAM,wCAAwC;;;;;iBASjD,CAAA;AAEJ,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;iBAY7C,CAAA;AAEF,eAAO,MAAM,sCAAsC;;;;;;;;;;iBAKjD,CAAA;AAEF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsBzC,CAAA;AAEF,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;iBAc/C,CAAA;AAEF,eAAO,MAAM,mCAAmC;;;;;;iBAM9C,CAAA;AAEF,eAAO,MAAM,8BAA8B;;;;;;;;;;;iBAazC,CAAA;AAEF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsBrC,CAAA;AAEF,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;iBAchD,CAAA;AAEF,eAAO,MAAM,wCAAwC;;;;;;;;;;;;;;;;;;;;;;iBAQnD,CAAA;AAEF,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGlD,CAAA;AAEF,eAAO,MAAM,mCAAmC;;;;;;;;;;iBAM9C,CAAA;AAEF,eAAO,MAAM,mCAAmC;;;;;;;;;;;;iBAM9C,CAAA;AAEF,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAQjD,CAAA;AAEF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgBtC,CAAA;AAEF,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAA;AAC9F,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAA;AAC9F,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAA;AAClG,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAA;AACrF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAA;AACvF,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CACxD,OAAO,qCAAqC,CAC7C,CAAA;AACD,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAA;AAChG,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CACpD,OAAO,sCAAsC,CAC9C,CAAA;AACD,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CACtD,OAAO,wCAAwC,CAChD,CAAA"}
+{"version":3,"file":"validation-public.d.ts","sourceRoot":"","sources":["../src/validation-public.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAqBvB,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;iBAYlD,CAAA;AAEF,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoB/C,CAAA;AAEF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsB3C,CAAA;AAEF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAa3C,CAAA;AAEF,eAAO,MAAM,kCAAkC;;iBAE7C,CAAA;AAEF,eAAO,MAAM,+BAA+B;;;;;;;;;iBAS1C,CAAA;AAEF,eAAO,MAAM,qCAAqC;;;;;iBAKhD,CAAA;AAEF,eAAO,MAAM,0CAA0C;;;;;;iBAMrD,CAAA;AAEF,eAAO,MAAM,iCAAiC;;;;;;;;;;iBAI5C,CAAA;AAQF,eAAO,MAAM,sCAAsC;;;;;iBAO/C,CAAA;AAEJ,eAAO,MAAM,sCAAsC;;;;;iBAO/C,CAAA;AAEJ,eAAO,MAAM,8BAA8B;;;iBAGzC,CAAA;AAEF,eAAO,MAAM,wCAAwC;;;;;iBASjD,CAAA;AAEJ,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;iBAY7C,CAAA;AAEF,eAAO,MAAM,sCAAsC;;;;;;;;;;iBAKjD,CAAA;AAEF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsBzC,CAAA;AAEF,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;iBAc/C,CAAA;AAEF,eAAO,MAAM,mCAAmC;;;;;;iBAM9C,CAAA;AAEF,eAAO,MAAM,8BAA8B;;;;;;;;;;;iBAazC,CAAA;AAEF,eAAO,MAAM,8BAA8B;;;;;;;;iBAIzC,CAAA;AAEF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsBrC,CAAA;AAEF,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;iBAchD,CAAA;AAEF,eAAO,MAAM,wCAAwC;;;;;;;;;;;;;;;;;;;;;;iBAQnD,CAAA;AAEF,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGlD,CAAA;AAEF,eAAO,MAAM,mCAAmC;;;;;;;;;;iBAM9C,CAAA;AAEF,eAAO,MAAM,mCAAmC;;;;;;;;;;;;iBAM9C,CAAA;AAEF,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAQjD,CAAA;AAEF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgBtC,CAAA;AAEF,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGjD,CAAA;AAEF,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAA;AAC9F,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAA;AAC9F,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAA;AAClG,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAA;AACrF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAA;AACrF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAA;AACvF,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CACxD,OAAO,qCAAqC,CAC7C,CAAA;AACD,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAA;AAChG,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CACpD,OAAO,sCAAsC,CAC9C,CAAA;AACD,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CACpD,OAAO,sCAAsC,CAC9C,CAAA;AACD,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAA;AAC1F,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CACpD,OAAO,sCAAsC,CAC9C,CAAA;AACD,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CACtD,OAAO,wCAAwC,CAChD,CAAA"}

package/dist/validation-public.js

@@ -106,8 +106,29 @@ export const publicRepriceBookingSessionSchema = z.object({
     applyToSession: z.boolean().default(false),
     selections: z.array(publicBookingSessionRepriceSelectionSchema).min(1),
 });
-export const publicBookingOverviewLookupQuerySchema = z.object({
-    bookingNumber: z.string().min(1).max(50),
+const publicBookingOverviewLocatorShape = {
+    bookingId: z.string().min(1).max(50).optional(),
+    bookingNumber: z.string().min(1).max(50).optional(),
+    bookingCode: z.string().min(1).max(50).optional(),
+};
+export const publicBookingOverviewLookupQuerySchema = z
+    .object({
+    ...publicBookingOverviewLocatorShape,
+    email: z.string().email(),
+})
+    .refine((value) => Boolean(value.bookingId || value.bookingNumber || value.bookingCode), {
+    message: "Provide a bookingId, bookingNumber, or bookingCode",
+});
+export const publicBookingOverviewAccessQuerySchema = z
+    .object({
+    ...publicBookingOverviewLocatorShape,
+    email: z.string().email().optional(),
+})
+    .refine((value) => Boolean(value.bookingId || value.bookingNumber || value.bookingCode), {
+    message: "Provide a bookingId, bookingNumber, or bookingCode",
+});
+export const publicGuestBookingLookupSchema = z.object({
+    bookingCode: z.string().min(1).max(50),
     email: z.string().email(),
 });
 export const internalBookingOverviewLookupQuerySchema = z
@@ -196,6 +217,11 @@ export const publicCheckoutCapabilitySchema = z.object({
         "payment:start",
     ])),
 });
+export const publicGuestBookingAccessSchema = z.object({
+    token: z.string().min(1),
+    expiresAt: z.string(),
+    actions: z.array(z.enum(["overview:read", "payment:read", "payment:start"])),
+});
 export const publicBookingSessionSchema = z.object({
     sessionId: z.string(),
     bookingNumber: z.string(),
@@ -287,3 +313,7 @@ export const publicBookingOverviewSchema = z.object({
     documents: z.array(publicBookingOverviewDocumentSchema),
     fulfillments: z.array(publicBookingOverviewFulfillmentSchema),
 });
+export const publicGuestBookingLookupResponseSchema = z.object({
+    overview: publicBookingOverviewSchema,
+    guestBookingAccess: publicGuestBookingAccessSchema,
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voyantjs/bookings",
-  "version": "0.74.2",
+  "version": "0.75.0",
   "license": "Apache-2.0",
   "type": "module",
   "exports": {
@@ -79,15 +79,15 @@
     "drizzle-orm": "^0.45.2",
     "hono": "^4.12.10",
     "zod": "^4.3.6",
-    "@voyantjs/action-ledger": "0.74.2",
-    "@voyantjs/core": "0.74.2",
-    "@voyantjs/db": "0.74.2",
-    "@voyantjs/hono": "0.74.2",
-    "@voyantjs/utils": "0.74.2"
+    "@voyantjs/action-ledger": "0.75.0",
+    "@voyantjs/core": "0.75.0",
+    "@voyantjs/db": "0.75.0",
+    "@voyantjs/hono": "0.75.0",
+    "@voyantjs/utils": "0.75.0"
   },
   "devDependencies": {
     "typescript": "^6.0.2",
-    "@voyantjs/products": "0.74.2",
+    "@voyantjs/products": "0.75.0",
     "@voyantjs/voyant-typescript-config": "0.1.0"
   },
   "files": [