fortrip 0.2.1 → 0.3.1

package/dist/cli.js

@@ -17,6 +17,7 @@ var CliError = class extends Error {
   exitCode;
   details;
 };
+var notices = {};
 function usageError(message) {
   return new CliError(message, EXIT.usage);
 }
@@ -28,8 +29,8 @@ var VERSION = JSON.parse(
 ).version;
 
 // src/api.ts
-var LOGIN_HINT = "Run `npx fortrip login` first.";
-var REQUEST_TIMEOUT_MS = 12e4;
+var LOGIN_HINT = "Rerun the command to get a new sign-in link.";
+var REQUEST_TIMEOUT_MS = 15e4;
 async function request(apiUrl, path, {
   method = "GET",
   token,
@@ -52,41 +53,47 @@ async function request(apiUrl, path, {
       signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
     });
   } catch (error) {
-    throw new CliError(
-      `Could not reach ${apiUrl}: ${error.message}`,
-      EXIT.error
-    );
+    throw transportError(apiUrl, error);
+  }
+  let text;
+  try {
+    text = await response.text();
+  } catch (error) {
+    throw transportError(apiUrl, error, response.status);
   }
-  const text = await response.text();
   let parsed = null;
   try {
     parsed = text ? JSON.parse(text) : {};
   } catch {
     parsed = null;
   }
-  const isObject = parsed !== null && typeof parsed === "object";
-  return {
-    status: response.status,
-    body: isObject ? parsed : { error: `Unexpected ${response.status} response`, raw: text.slice(0, 200) },
-    headers: response.headers
-  };
+  const isObject2 = parsed !== null && typeof parsed === "object";
+  const result = isObject2 ? parsed : { error: `Unexpected ${response.status} response`, raw: text.slice(0, 200) };
+  if (response.status >= 500 && !(isObject2 && text)) result.retryable = true;
+  return { status: response.status, body: result, headers: response.headers };
+}
+function transportError(apiUrl, error, status) {
+  const message = error?.name === "TimeoutError" ? `No response from ${apiUrl} within ${REQUEST_TIMEOUT_MS / 1e3} s` : `Could not reach ${apiUrl}: ${error?.message ?? String(error)}`;
+  return new CliError(message, EXIT.error, {
+    ...status !== void 0 ? { status } : {},
+    retryable: true
+  });
 }
 function unwrap(response) {
   const { status, body, headers } = response;
   if (status >= 200 && status < 300 && body.success === true) return body.data;
   const { success: _success, error, message, ...rest } = body;
   const text = typeof error === "string" ? error : typeof message === "string" ? message : `Request failed with status ${status}`;
-  const details = { status, ...rest };
+  const retryAfter = Number(headers.get("retry-after"));
+  const details = {
+    status,
+    ...rest,
+    ...Number.isFinite(retryAfter) && retryAfter > 0 ? { retryAfterSeconds: retryAfter } : {}
+  };
   if (status === 401) {
     throw new CliError(`${text}. ${LOGIN_HINT}`, EXIT.unauthenticated, details);
   }
-  if (status === 429) {
-    const retryAfter = Number(headers.get("retry-after"));
-    throw new CliError(text, EXIT.rateLimited, {
-      ...details,
-      ...Number.isFinite(retryAfter) && retryAfter > 0 ? { retryAfterSeconds: retryAfter } : {}
-    });
-  }
+  if (status === 429) throw new CliError(text, EXIT.rateLimited, details);
   if (status === 400) throw new CliError(text, EXIT.usage, details);
   if (status >= 300 && status < 400) {
     throw new CliError(
@@ -102,12 +109,29 @@ function unwrap(response) {
 import { readFileSync as readFileSync2 } from "fs";
 import { parseArgs } from "util";
 var BODY_OPTION = { body: { type: "string" } };
+var CURRENCY_OPTION = { currency: { type: "string" } };
 function parse(argv, options) {
+  let parsed;
   try {
-    return parseArgs({ args: argv, options, allowPositionals: true, strict: true });
+    parsed = parseArgs({
+      args: argv,
+      options,
+      allowPositionals: true,
+      strict: true,
+      tokens: true
+    });
   } catch (error) {
     throw usageError(error.message);
   }
+  const seen = /* @__PURE__ */ new Set();
+  for (const token of parsed.tokens) {
+    if (token.kind !== "option" || options[token.name]?.multiple) continue;
+    if (seen.has(token.name)) {
+      throw usageError(`--${token.name} was given more than once`);
+    }
+    seen.add(token.name);
+  }
+  return parsed;
 }
 function baseBody(values) {
   const raw = values.body;
@@ -141,12 +165,31 @@ function nums(flag, values) {
   if (!values?.length) return void 0;
   return values.flatMap((value) => value.split(",")).map((value) => num(flag, value.trim()));
 }
+function id(flag, value) {
+  if (value === void 0) return void 0;
+  const parsed = Number(value.trim());
+  if (!/^\d+$/.test(value.trim()) || !Number.isSafeInteger(parsed)) {
+    throw usageError(`--${flag} must be a numeric id, got "${value}"`);
+  }
+  return parsed;
+}
+function ids(flag, values) {
+  if (!values?.length) return void 0;
+  return values.flatMap((value) => value.split(",")).map((value) => id(flag, value));
+}
 function str(value) {
   return typeof value === "string" ? value : void 0;
 }
 function list(value) {
   return Array.isArray(value) && value.length ? value : void 0;
 }
+function currency(values, base, env) {
+  const flag = str(values.currency)?.trim().toUpperCase();
+  if (flag === "") throw usageError("--currency must not be empty");
+  if (flag) return flag;
+  if (base.currency !== void 0) return void 0;
+  return env.FORTRIP_CURRENCY?.trim().toUpperCase() || void 0;
+}
 function merge(base, overrides) {
   const body = { ...base };
   for (const [key, value] of Object.entries(overrides)) {
@@ -156,6 +199,7 @@ function merge(base, overrides) {
 }
 var SEARCH_OPTIONS = {
   ...BODY_OPTION,
+  ...CURRENCY_OPTION,
   query: { type: "string", short: "q" },
   "city-code": { type: "string" },
   near: { type: "string" },
@@ -170,7 +214,8 @@ var SEARCH_OPTIONS = {
   page: { type: "string" },
   "page-size": { type: "string" }
 };
-function searchBody(values) {
+function searchBody(values, env = process.env) {
+  const base = baseBody(values);
   let near;
   const nearRaw = str(values.near);
   if (nearRaw !== void 0) {
@@ -184,9 +229,9 @@ function searchBody(values) {
       radiusKm: num("near", radiusKm)
     };
   }
-  return merge(baseBody(values), {
+  return merge(base, {
     query: str(values.query),
-    cityCode: num("city-code", str(values["city-code"])),
+    cityCode: id("city-code", str(values["city-code"])),
     near,
     checkIn: str(values["check-in"]),
     checkOut: str(values["check-out"]),
@@ -197,18 +242,19 @@ function searchBody(values) {
     priceMax: num("price-max", str(values["price-max"])),
     sortBy: str(values.sort),
     page: num("page", str(values.page)),
-    pageSize: num("page-size", str(values["page-size"]))
+    pageSize: num("page-size", str(values["page-size"])),
+    currency: currency(values, base, env)
   });
 }
 var HOTEL_OPTIONS = {
   "with-rooms": { type: "boolean" }
 };
 function hotelPath(positionals, values) {
-  const [id, ...extra] = positionals;
-  if (!id || extra.length || !/^\d+$/.test(id)) {
+  const [id2, ...extra] = positionals;
+  if (!id2 || extra.length || !/^\d+$/.test(id2)) {
     throw usageError("Usage: fortrip hotel <hotelId> [--with-rooms]");
   }
-  return `/api/huizhi/hotels/${id}${values["with-rooms"] ? "?include=rooms" : ""}`;
+  return `/api/huizhi/hotels/${id2}${values["with-rooms"] ? "?include=rooms" : ""}`;
 }
 var STAY_OPTIONS = {
   "check-in": { type: "string" },
@@ -217,17 +263,18 @@ var STAY_OPTIONS = {
   adults: { type: "string" },
   "child-age": { type: "string", multiple: true }
 };
-function stayFields(values, base) {
+function stayFields(values, base, defaults = {}) {
   return {
     checkIn: str(values["check-in"]),
     checkOut: str(values["check-out"]),
-    rooms: num("rooms", str(values.rooms)) ?? (base.rooms === void 0 ? 1 : void 0),
-    adults: num("adults", str(values.adults)) ?? (base.adults === void 0 ? 2 : void 0),
+    rooms: num("rooms", str(values.rooms)) ?? (base.rooms === void 0 ? defaults.rooms : void 0),
+    adults: num("adults", str(values.adults)) ?? (base.adults === void 0 ? defaults.adults : void 0),
     childrenAges: nums("child-age", list(values["child-age"]))
   };
 }
 var RATES_OPTIONS = {
   ...BODY_OPTION,
+  ...CURRENCY_OPTION,
   ...STAY_OPTIONS,
   hotel: { type: "string", multiple: true },
   nationality: { type: "string" },
@@ -236,18 +283,19 @@ var RATES_OPTIONS = {
   "include-unbookable": { type: "boolean" },
   "max-rooms": { type: "string" }
 };
-function ratesBody(values) {
+function ratesBody(values, env = process.env) {
   const base = baseBody(values);
   return merge(base, {
-    hotelIds: nums("hotel", list(values.hotel)),
-    ...stayFields(values, base),
+    hotelIds: ids("hotel", list(values.hotel)),
+    ...stayFields(values, base, { rooms: 1, adults: 2 }),
     nationality: str(values.nationality)?.toUpperCase(),
     boardCodes: list(values.board)?.flatMap(
       (code) => code.split(",").map((part) => part.trim().toUpperCase())
     ),
     freeCancellation: values["free-cancellation"] ? true : void 0,
     bookableOnly: values["include-unbookable"] ? false : void 0,
-    maxRoomsPerHotel: num("max-rooms", str(values["max-rooms"]))
+    maxRoomsPerHotel: num("max-rooms", str(values["max-rooms"])),
+    currency: currency(values, base, env)
   });
 }
 var BOOK_OPTIONS = {
@@ -278,8 +326,8 @@ function parseGuest(value) {
 }
 function bookBody(values) {
   const base = baseBody(values);
-  return merge(base, {
-    hotelId: num("hotel", str(values.hotel)),
+  const body = merge(base, {
+    hotelId: id("hotel", str(values.hotel)),
     roomId: str(values["room-id"]),
     ratePlanCode: str(values["rate-plan"]),
     ...stayFields(values, base),
@@ -289,11 +337,18 @@ function bookBody(values) {
     contactEmail: str(values["contact-email"]),
     specialRequests: str(values["special-requests"])
   });
+  const missing = ["rooms", "adults"].filter((key) => body[key] === void 0);
+  if (missing.length) {
+    throw usageError(
+      `book needs ${missing.map((key) => `--${key}`).join(" and ")}, the same per-room values used in rates`
+    );
+  }
+  return body;
 }
 
 // src/auth.ts
-import { hostname } from "os";
-import { setTimeout as sleep } from "timers/promises";
+import { hostname as hostname2 } from "os";
+import { setTimeout as sleep2 } from "timers/promises";
 
 // src/browser.ts
 import { spawn } from "child_process";
@@ -309,10 +364,31 @@ function openBrowser(url) {
 }
 
 // src/credentials.ts
-import { chmod, mkdir, readFile, rm, writeFile } from "fs/promises";
-import { homedir } from "os";
-import { dirname, join } from "path";
+import { randomBytes } from "crypto";
+import { readlinkSync } from "fs";
+import {
+  chmod,
+  lstat,
+  mkdir,
+  readdir,
+  readFile,
+  rename,
+  rm,
+  stat,
+  writeFile
+} from "fs/promises";
+import { homedir, hostname } from "os";
+import { basename, dirname, join } from "path";
+import { setTimeout as sleep } from "timers/promises";
 var DEFAULT_API_URL = "https://fortrip.ai";
+var CREDENTIALS_LOCK_STALE_MS = 1e4;
+var LOGIN_LOCK_STALE_MS = REQUEST_TIMEOUT_MS + 3e4;
+var TAKEOVER_STALE_MS = 2e3;
+var READ_RETRY_MS = [20, 50, 100, 200, 300, 400];
+var LEFT_EMPTY_MS = 2e3;
+var LOCK_WAIT_MS = 3e4;
+var SAVE_CHECK_MS = 200;
+var RENAME_RETRY_MS = [20, 50, 100, 200, 300, 400, 500, 500];
 function credentialsPath(env = process.env) {
   const base = env.XDG_CONFIG_HOME || join(homedir(), ".config");
   return join(base, "fortrip", "credentials.json");
@@ -331,27 +407,300 @@ function resolveApiUrl(env = process.env) {
   }
   return url.origin;
 }
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isLogin(value) {
+  return isObject(value) && typeof value.deviceCode === "string" && typeof value.userCode === "string" && typeof value.loginUrl === "string" && typeof value.expiresAt === "string";
+}
+function parse2(text) {
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  if (!isObject(raw)) return null;
+  const { tokens, pending, pendingLogins, ...other } = raw;
+  const logins = {};
+  const add = (apiUrl, login2) => {
+    const list2 = logins[apiUrl] ??= [];
+    if (isLogin(login2) && !list2.some((known) => known.deviceCode === login2.deviceCode)) {
+      list2.push(login2);
+    }
+  };
+  for (const [apiUrl, list2] of Object.entries(isObject(pendingLogins) ? pendingLogins : {})) {
+    for (const login2 of Array.isArray(list2) ? list2 : []) add(apiUrl, login2);
+  }
+  for (const [apiUrl, login2] of Object.entries(isObject(pending) ? pending : {})) {
+    for (const each of Array.isArray(login2) ? login2 : [login2]) add(apiUrl, each);
+  }
+  return {
+    tokens: isObject(tokens) ? tokens : {},
+    logins,
+    other
+  };
+}
+function serialize({ tokens, logins, other }) {
+  const pending = {};
+  const pendingLogins = {};
+  for (const [apiUrl, list2] of Object.entries(logins)) {
+    const live = list2.filter((login2) => !isExpired(login2));
+    const newest = live.at(-1);
+    if (!newest) continue;
+    pendingLogins[apiUrl] = live;
+    pending[apiUrl] = newest;
+  }
+  return `${JSON.stringify({ ...other, tokens, pending, pendingLogins }, null, 2)}
+`;
+}
+async function readText(path) {
+  try {
+    return await readFile(path, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
 async function readCredentials(path) {
+  for (let attempt = 0; ; attempt++) {
+    const text = await readText(path);
+    if (text === null) return { text, credentials: emptyCredentials() };
+    const credentials = parse2(text);
+    if (credentials) return { text, credentials };
+    if (text === "" && await isLeftEmpty(path)) {
+      return { text, credentials: emptyCredentials() };
+    }
+    const delay = READ_RETRY_MS[attempt];
+    if (delay === void 0) {
+      throw text === "" ? new CliError(`${path} is being written by another program; retry.`, EXIT.error, {
+        retryable: true
+      }) : new CliError(
+        `${path} isn't valid JSON. Move it away (for example to ${basename(path)}.broken) and sign in again.`,
+        EXIT.error,
+        { file: path }
+      );
+    }
+    await sleep(delay);
+  }
+}
+function emptyCredentials() {
+  return { tokens: {}, logins: {}, other: {} };
+}
+async function isLeftEmpty(path) {
+  const info = await stat(path).catch(() => null);
+  return info !== null && info.size === 0 && Date.now() - info.mtimeMs > LEFT_EMPTY_MS;
+}
+async function updateCredentials(env, change) {
+  const path = credentialsPath(env);
+  await withLock(path, async () => {
+    const recovered = await readRecovered(path);
+    for (let attempt = 0; ; attempt++) {
+      const { text, credentials } = await readCredentials(path);
+      for (const { tokens } of recovered) mergeTokens(credentials, tokens);
+      change(credentials);
+      const next = serialize(credentials);
+      if (next === text || await replace(path, next, text)) break;
+      if (attempt === 20) {
+        throw new CliError(`${path} keeps changing; retry.`, EXIT.error, {
+          retryable: true
+        });
+      }
+      await sleep(Math.random() * 20);
+    }
+    for (const { file } of recovered) await rm(file, { force: true });
+  });
+}
+function mergeTokens(credentials, tokens) {
+  for (const [apiUrl, token] of Object.entries(tokens)) {
+    const saved = credentials.tokens[apiUrl];
+    if (!saved || saved.createdAt < token.createdAt) credentials.tokens[apiUrl] = token;
+  }
+}
+function recoveryPrefix(path) {
+  return `${basename(path, ".json")}.recovered-`;
+}
+async function readRecovered(path) {
+  const prefix = recoveryPrefix(path);
+  const names = (await readdir(dirname(path)).catch(() => [])).filter((name) => name.startsWith(prefix) && name.endsWith(".json")).sort();
+  const recovered = [];
+  for (const name of names) {
+    const file = join(dirname(path), name);
+    const parsed = parse2(await readText(file).catch(() => null) ?? "");
+    if (parsed) recovered.push({ file, tokens: parsed.tokens });
+  }
+  return recovered;
+}
+async function loadRecoveredTokens(apiUrl, env = process.env) {
+  return (await readRecovered(credentialsPath(env))).flatMap(
+    ({ tokens }) => tokens[apiUrl] ? [tokens[apiUrl].accessToken] : []
+  );
+}
+async function replace(path, text, expected) {
+  const temp = `${path}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+  try {
+    await writeFile(temp, text, { mode: 384, flag: "wx" });
+    await chmod(temp, 384);
+    if (await readText(path) !== expected) {
+      await rm(temp, { force: true });
+      return false;
+    }
+    for (let attempt = 0; ; attempt++) {
+      try {
+        await rename(temp, path);
+        return true;
+      } catch (error) {
+        const delay = RENAME_RETRY_MS[attempt];
+        if (!isBusy(error) || delay === void 0) throw error;
+        await sleep(delay);
+      }
+    }
+  } catch (error) {
+    await rm(temp, { force: true });
+    const { code } = error;
+    throw new CliError(
+      `Could not write ${path}: ${error.message}`,
+      EXIT.error,
+      isBusy(error) ? { code, retryable: true } : { code }
+    );
+  }
+}
+function isBusy(error) {
+  const { code } = error;
+  return code === "EPERM" || code === "EACCES" || code === "EBUSY";
+}
+function isExpired(login2) {
+  return !(Date.parse(login2.expiresAt) > Date.now());
+}
+async function withLock(path, fn) {
+  await ensureDir(path);
+  const lock = `${path}.lock`;
+  const giveUpAt = Date.now() + LOCK_WAIT_MS;
+  let release;
+  while (!(release = await tryLock(lock, CREDENTIALS_LOCK_STALE_MS))) {
+    if (Date.now() > giveUpAt) {
+      throw new CliError(
+        `Timed out waiting for ${lock}. If no other fortrip command is running, delete it.`,
+        EXIT.error,
+        { retryable: true, lockFile: lock }
+      );
+    }
+    await sleep(10 + Math.random() * 40);
+  }
+  try {
+    await fn();
+  } finally {
+    await release();
+  }
+}
+async function ensureDir(path) {
+  const dir = dirname(path);
+  await mkdir(dir, { recursive: true, mode: 448 });
+  await chmod(dir, 448);
+}
+async function tryLoginLock(env = process.env) {
+  const path = credentialsPath(env);
+  await ensureDir(path);
+  return tryLock(`${path}.login-lock`, LOGIN_LOCK_STALE_MS);
+}
+var PID_NAMESPACE = (() => {
   try {
-    const parsed = JSON.parse(await readFile(path, "utf8"));
-    return { tokens: parsed?.tokens ?? {}, pending: parsed?.pending ?? {} };
+    return readlinkSync("/proc/self/ns/pid");
   } catch {
-    return { tokens: {}, pending: {} };
+    return "";
   }
+})();
+function newOwner() {
+  return JSON.stringify({
+    pid: process.pid,
+    host: hostname(),
+    pidns: PID_NAMESPACE,
+    id: randomBytes(8).toString("hex")
+  });
 }
-async function writeCredentials(path, file) {
-  if (Object.keys(file.tokens).length === 0 && Object.keys(file.pending).length === 0) {
-    await rm(path, { force: true });
-    return;
+async function tryLock(path, staleMs) {
+  const owner = newOwner();
+  if (await create(path, owner)) return releaser(path, owner);
+  const seen = await inspect(path);
+  if (!seen || !isAbandoned(path, seen, staleMs)) return null;
+  const guard = `${path}.takeover`;
+  const guardOwner = newOwner();
+  if (!await create(guard, guardOwner)) {
+    const held = await inspect(guard);
+    if (held && isAbandoned(guard, held, TAKEOVER_STALE_MS)) {
+      await rm(guard, { force: true });
+    }
+    return null;
+  }
+  try {
+    const current = await inspect(path);
+    if (current?.content === seen.content && current.mtimeMs === seen.mtimeMs) {
+      await rm(path, { force: true });
+    }
+  } finally {
+    await releaser(guard, guardOwner)();
+  }
+  return null;
+}
+async function create(path, content) {
+  try {
+    await writeFile(path, content, { flag: "wx", mode: 384 });
+    return true;
+  } catch (error) {
+    if (error.code === "EEXIST" || process.platform === "win32" && isBusy(error)) {
+      return false;
+    }
+    throw error;
+  }
+}
+function releaser(path, owner) {
+  return async () => {
+    try {
+      if (await readFile(path, "utf8") === owner) await rm(path, { force: true });
+    } catch {
+    }
+  };
+}
+async function inspect(path) {
+  const info = await lstat(path).catch(() => null);
+  if (!info) return null;
+  const content = await readFile(path, "utf8").catch(() => "");
+  return { content, mtimeMs: info.mtimeMs };
+}
+var firstSeen = /* @__PURE__ */ new Map();
+function isAbandoned(path, { content, mtimeMs }, staleMs) {
+  const now = Date.now();
+  if (now - mtimeMs > staleMs) return true;
+  const holder = parseOwner(content);
+  if (holder && holder.host === hostname() && holder.pidns === PID_NAMESPACE && !isRunning(holder.pid)) {
+    return true;
+  }
+  const first = firstSeen.get(path);
+  if (first?.content !== content || first.mtimeMs !== mtimeMs) {
+    firstSeen.set(path, { content, mtimeMs, at: now });
+    return false;
+  }
+  return now - first.at > staleMs;
+}
+function parseOwner(content) {
+  try {
+    const owner = JSON.parse(content);
+    return isObject(owner) && Number.isSafeInteger(owner.pid) && owner.pid > 0 && typeof owner.host === "string" && typeof owner.pidns === "string" ? owner : null;
+  } catch {
+    return null;
+  }
+}
+function isRunning(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
   }
-  await mkdir(dirname(path), { recursive: true, mode: 448 });
-  await writeFile(path, `${JSON.stringify(file, null, 2)}
-`, { mode: 384 });
-  await chmod(path, 384);
 }
 async function loadStoredToken(apiUrl, env = process.env) {
-  const file = await readCredentials(credentialsPath(env));
-  return file.tokens[apiUrl]?.accessToken ?? null;
+  const { credentials } = await readCredentials(credentialsPath(env));
+  return credentials.tokens[apiUrl]?.accessToken ?? null;
 }
 async function resolveToken(apiUrl, env = process.env) {
   const fromEnv = env.FORTRIP_TOKEN?.trim();
@@ -361,60 +710,205 @@ async function resolveToken(apiUrl, env = process.env) {
 }
 async function saveToken(apiUrl, accessToken, env = process.env) {
   const path = credentialsPath(env);
-  const file = await readCredentials(path);
-  file.tokens[apiUrl] = { accessToken, createdAt: (/* @__PURE__ */ new Date()).toISOString() };
-  delete file.pending[apiUrl];
-  await writeCredentials(path, file);
+  const token = { accessToken, createdAt: (/* @__PURE__ */ new Date()).toISOString() };
+  try {
+    for (let attempt = 0; ; attempt++) {
+      await updateCredentials(env, (credentials) => {
+        credentials.tokens[apiUrl] = token;
+        delete credentials.logins[apiUrl];
+      });
+      await sleep(SAVE_CHECK_MS);
+      const saved = (await readCredentials(path)).credentials.tokens[apiUrl];
+      if (saved && (saved.accessToken === accessToken || saved.createdAt > token.createdAt)) {
+        return;
+      }
+      if (attempt === 4) throw new Error("another program keeps overwriting it");
+    }
+  } catch (error) {
+    const kept = join(
+      dirname(path),
+      `${recoveryPrefix(path)}${Date.now()}-${randomBytes(3).toString("hex")}.json`
+    );
+    const content = `${JSON.stringify({ tokens: { [apiUrl]: token } }, null, 2)}
+`;
+    const saved = await writeFile(kept, content, { mode: 384, flag: "wx" }).then(
+      () => true,
+      () => false
+    );
+    throw new CliError(
+      saved ? `Signed in, but ${path} couldn't be updated (${error.message}). The sign-in is kept in ${kept} until the next successful save merges it back.` : `Signed in, but the sign-in couldn't be saved: ${error.message}`,
+      EXIT.error,
+      saved ? { recoveryFile: kept } : {}
+    );
+  }
 }
-async function deleteToken(apiUrl, env = process.env) {
-  const path = credentialsPath(env);
-  const file = await readCredentials(path);
-  delete file.tokens[apiUrl];
-  await writeCredentials(path, file);
+async function deleteToken(apiUrl, env = process.env, only) {
+  await updateCredentials(env, (credentials) => {
+    const saved = credentials.tokens[apiUrl]?.accessToken;
+    if (only === void 0 || saved !== void 0 && only.includes(saved)) {
+      delete credentials.tokens[apiUrl];
+    }
+  });
 }
-async function loadPendingLogin(apiUrl, env = process.env) {
-  const pending = (await readCredentials(credentialsPath(env))).pending[apiUrl];
-  return pending && Date.parse(pending.expiresAt) > Date.now() ? pending : null;
+async function loadPendingLogins(apiUrl, env = process.env) {
+  const { credentials } = await readCredentials(credentialsPath(env));
+  return (credentials.logins[apiUrl] ?? []).filter((login2) => !isExpired(login2));
 }
-async function savePendingLogin(apiUrl, pending, env = process.env) {
-  const path = credentialsPath(env);
-  const file = await readCredentials(path);
-  if (pending) file.pending[apiUrl] = pending;
-  else delete file.pending[apiUrl];
-  await writeCredentials(path, file);
+async function addPendingLogin(apiUrl, pending, env = process.env) {
+  await updateCredentials(env, (credentials) => {
+    credentials.logins[apiUrl] = [...credentials.logins[apiUrl] ?? [], pending];
+  });
+}
+async function updatePendingLogin(apiUrl, deviceCode, changes, env = process.env) {
+  await updateCredentials(env, (credentials) => {
+    const logins = credentials.logins[apiUrl];
+    if (!logins) return;
+    credentials.logins[apiUrl] = logins.flatMap(
+      (login2) => login2.deviceCode !== deviceCode ? [login2] : changes ? [{ ...login2, ...changes }] : []
+    );
+  });
 }
 
 // src/auth.ts
-async function requireToken(apiUrl) {
+var DEFAULT_INTERVAL_SECONDS = 5;
+var LOGIN_WAIT_MS = 3e4;
+var SHOWABLE_FOR_MS = 12e4;
+async function requireToken(apiUrl, options = {}) {
+  const started = (/* @__PURE__ */ new Date()).toISOString();
   const resolved = await resolveToken(apiUrl);
-  if (resolved) return resolved.token;
-  const pending = await loadPendingLogin(apiUrl);
-  if (pending) {
-    const result = await exchange(apiUrl, pending.deviceCode);
-    if (result.status === "ok") {
-      await saveToken(apiUrl, result.accessToken);
-      return result.accessToken;
+  if (resolved) return resolved;
+  return {
+    token: await finishOrStartLogin(apiUrl, { started, ...options }),
+    source: "file"
+  };
+}
+async function finishOrStartLogin(apiUrl, signIn) {
+  const giveUpAt = Date.now() + (signIn.loginWaitMs ?? LOGIN_WAIT_MS);
+  let release;
+  while (!(release = await tryLoginLock())) {
+    const saved = await savedToken(apiUrl, signIn);
+    if (saved) return saved;
+    if (Date.now() > giveUpAt) {
+      const pending = (await loadPendingLogins(apiUrl)).at(-1);
+      if (pending && isShowable(pending)) throw loginRequired(apiUrl, pending, signIn);
+      throw new CliError(
+        `Another fortrip command is still signing in to ${apiUrl}.`,
+        EXIT.error,
+        { retryable: true }
+      );
+    }
+    await sleep2(250);
+  }
+  try {
+    const approved = await pollPendingLogins(apiUrl, signIn);
+    if (approved) return approved;
+    let pending = (await loadPendingLogins(apiUrl)).at(-1);
+    if (!pending || !isShowable(pending)) {
+      const start = await startDeviceLogin(apiUrl);
+      const now = /* @__PURE__ */ new Date();
+      pending = {
+        deviceCode: start.deviceCode,
+        userCode: start.userCode,
+        loginUrl: start.verificationUriComplete,
+        expiresAt: new Date(now.getTime() + start.expiresIn * 1e3).toISOString(),
+        interval: start.interval,
+        checkedAt: now.toISOString()
+      };
+      await addPendingLogin(apiUrl, pending);
     }
-    if (result.status === "authorization_pending" || result.status === "slow_down") {
-      throw loginRequired(apiUrl, pending);
+    const saved = await savedToken(apiUrl, signIn);
+    if (saved) return saved;
+    throw loginRequired(apiUrl, pending, signIn);
+  } finally {
+    await release();
+  }
+}
+function isShowable(login2) {
+  return Date.parse(login2.expiresAt) - Date.now() >= SHOWABLE_FOR_MS;
+}
+async function savedToken(apiUrl, { rejected }) {
+  const saved = await loadStoredToken(apiUrl);
+  return saved !== rejected ? saved : null;
+}
+async function pollPendingLogins(apiUrl, signIn) {
+  const saved = await savedToken(apiUrl, signIn);
+  if (saved) return saved;
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  for (let login2 of await loadPendingLogins(apiUrl)) {
+    const { checkedAt } = login2;
+    if (checkedAt !== void 0 && checkedAt > signIn.started && checkedAt <= now) {
+      continue;
+    }
+    for (let attempt = 0; attempt < 2; attempt++) {
+      const wait = nextPollAt(login2) - Date.now();
+      if (wait > 0) await sleep2(wait);
+      const asked = (/* @__PURE__ */ new Date()).toISOString();
+      const result = await exchange(apiUrl, login2.deviceCode);
+      const lastPolledAt = (/* @__PURE__ */ new Date()).toISOString();
+      if (result.status === "ok") {
+        try {
+          await saveToken(apiUrl, result.accessToken);
+        } catch (error) {
+          notices.warning = error.message;
+          if (error instanceof CliError && error.details.recoveryFile) {
+            notices.recoveryFile = error.details.recoveryFile;
+          }
+        }
+        return result.accessToken;
+      }
+      if (result.status === "slow_down") {
+        const interval = result.interval ?? intervalOf(login2) + 5;
+        login2 = { ...login2, lastPolledAt, interval };
+        await updatePendingLogin(apiUrl, login2.deviceCode, { lastPolledAt, interval });
+        continue;
+      }
+      await updatePendingLogin(
+        apiUrl,
+        login2.deviceCode,
+        result.status === "authorization_pending" ? { lastPolledAt, checkedAt: asked } : null
+        // denied, expired or already redeemed
+      );
+      break;
     }
   }
-  const start = await startDeviceLogin(apiUrl);
-  const fresh = {
-    deviceCode: start.deviceCode,
-    userCode: start.userCode,
-    loginUrl: start.verificationUriComplete,
-    expiresAt: new Date(Date.now() + start.expiresIn * 1e3).toISOString()
-  };
-  await savePendingLogin(apiUrl, fresh);
-  throw loginRequired(apiUrl, fresh);
+  return savedToken(apiUrl, signIn);
+}
+function intervalOf(login2) {
+  const { interval } = login2;
+  return typeof interval === "number" && Number.isFinite(interval) ? Math.min(Math.max(interval, 0), 60) : DEFAULT_INTERVAL_SECONDS;
+}
+function nextPollAt(login2) {
+  const last = Date.parse(login2.lastPolledAt ?? "");
+  if (!Number.isFinite(last)) return 0;
+  return Math.min(last, Date.now()) + intervalOf(login2) * 1e3;
+}
+async function authorizedRequest(apiUrl, path, init = {}) {
+  const auth = await requireToken(apiUrl);
+  const response = await request(apiUrl, path, { ...init, token: auth.token });
+  if (response.status !== 401) return response;
+  if (auth.source === "env") {
+    throw new CliError(
+      `${apiUrl} didn't accept FORTRIP_TOKEN. If this keeps happening, the user should replace it, or unset it to sign in through the browser.`,
+      EXIT.unauthenticated,
+      { status: 401, tokenSource: "FORTRIP_TOKEN" }
+    );
+  }
+  const token = await finishOrStartLogin(apiUrl, {
+    started: (/* @__PURE__ */ new Date()).toISOString(),
+    rejected: auth.token
+  });
+  await request(apiUrl, "/api/cli/auth/revoke", { method: "POST", token: auth.token }).catch(
+    () => void 0
+  );
+  return request(apiUrl, path, { ...init, token });
 }
 async function login({
   apiUrl,
   openBrowser: shouldOpen,
   log,
-  wait = sleep
+  wait = sleep2
 }) {
+  await loadStoredToken(apiUrl);
   const start = await startDeviceLogin(apiUrl);
   log(`Confirm this code in your browser: ${start.userCode}`);
   log(`If the browser doesn't open, visit: ${start.verificationUriComplete}`);
@@ -478,9 +972,9 @@ async function exchange(apiUrl, deviceCode) {
       throw new CliError(`Unexpected login response ${poll.status}`, EXIT.error);
   }
 }
-function loginRequired(apiUrl, pending) {
+function loginRequired(apiUrl, pending, { rejected }) {
   return new CliError(
-    `Not logged in to ${apiUrl}. Ask the user to open loginUrl and approve, then rerun this command (or run \`npx fortrip login\` in a terminal).`,
+    rejected ? `${apiUrl} didn't accept the saved sign-in (it may have been revoked or expired, or the server had a passing problem). Ask the user to open loginUrl and approve, then rerun this command. The saved sign-in is kept until then.` : `Not logged in to ${apiUrl}. Ask the user to open loginUrl and approve, then rerun this command.`,
     EXIT.unauthenticated,
     {
       loginUrl: pending.loginUrl,
@@ -494,26 +988,34 @@ function loginRequired(apiUrl, pending) {
 }
 async function logout(apiUrl) {
   const token = await loadStoredToken(apiUrl);
-  if (!token) {
+  const recovered = await loadRecoveredTokens(apiUrl);
+  if (!token && !recovered.length) {
     throw new CliError(`Not logged in to ${apiUrl}.`, EXIT.unauthenticated);
   }
-  const response = await request(apiUrl, "/api/cli/auth/revoke", {
-    method: "POST",
-    token
-  });
-  if (response.status !== 401) unwrap(response);
-  await deleteToken(apiUrl);
+  if (token) {
+    const response = await request(apiUrl, "/api/cli/auth/revoke", {
+      method: "POST",
+      token
+    });
+    if (response.status !== 401) unwrap(response);
+  }
+  for (const kept of recovered) {
+    await request(apiUrl, "/api/cli/auth/revoke", { method: "POST", token: kept }).catch(
+      () => void 0
+    );
+  }
+  await deleteToken(apiUrl, process.env, [...token ? [token] : [], ...recovered]);
   return { loggedOut: true, apiUrl };
 }
 async function whoami(apiUrl, token) {
-  const resolved = token ?? await requireToken(apiUrl);
+  const path = "/api/cli/auth/whoami";
   const data = unwrap(
-    await request(apiUrl, "/api/cli/auth/whoami", { token: resolved })
+    token ? await request(apiUrl, path, { token }) : await authorizedRequest(apiUrl, path)
   );
   return { ...data, apiUrl };
 }
 function deviceLabel() {
-  return hostname().replace(/[^\w .@-]/g, "").slice(0, 64);
+  return hostname2().replace(/[^\w .@-]/g, "").slice(0, 64);
 }
 
 // src/guide.ts
@@ -530,50 +1032,150 @@ async function readGuide(topic = "main") {
 }
 
 // src/cli.ts
+var FLAGS = {
+  search: `  --query <text> | --city-code <n> | --near <lat,lng,km>
+  --check-in YYYY-MM-DD --check-out YYYY-MM-DD
+  [--star-min n] [--star-max n] [--facility <name>]... [--price-min n]
+  [--price-max n] [--sort recommended|price-asc|price-desc|star-desc|distance]
+  [--page n] [--page-size n] [--currency CNY|USD]`,
+  rates: `  --hotel <id>... --check-in YYYY-MM-DD --check-out YYYY-MM-DD
+  [--rooms 1] [--adults 2] [--child-age n]... [--nationality CN]
+  [--board BB]... [--free-cancellation] [--include-unbookable]
+  [--max-rooms n] [--currency CNY|USD]`,
+  book: `  --hotel <id> --room-id <id> --rate-plan <code>
+  --check-in YYYY-MM-DD --check-out YYYY-MM-DD --rooms <n> --adults <n>
+  [--child-age n]... --guest "First Last[:roomNo]"...
+  --contact-name <name> --contact-phone <phone> [--contact-email <email>]
+  [--special-requests <english text>]`
+};
+var BODY_NOTE = `Also takes --body '<json>' (or --body @file.json) with the raw request
+body; flags override its fields.`;
+var OCCUPANCY_NOTE = `--adults and --child-age are per room, and every room has the same
+occupancy: 2 rooms for 4 adults is --rooms 2 --adults 2. Limits: 1-8 rooms,
+1-8 adults and 0-8 children (aged 0-17) per room, 1-15 nights.`;
+var USAGE = {
+  login: `Usage: fortrip login [--no-browser]
+
+Signs in through the browser with a device code and waits up to 10 minutes
+for approval. Any other command starts the same login itself and exits 3
+with loginUrl instead of waiting; AI agents should rely on that.
+`,
+  logout: `Usage: fortrip logout
+
+Revokes the saved token on the server and deletes it locally.
+`,
+  whoami: `Usage: fortrip whoami
+
+Shows the signed-in account.
+`,
+  search: `Usage: fortrip search [options]
+
+Finds hotels with indicative prices: floors, not quotes.
+
+${FLAGS.search}
+
+${BODY_NOTE}
+`,
+  hotel: `Usage: fortrip hotel <hotelId> [--with-rooms]
+
+Static hotel detail: description, policies, facilities and photos;
+--with-rooms adds the room types.
+`,
+  rates: `Usage: fortrip rates [options]
+
+Live rooms and rates for up to 15 hotels; takes about 15 seconds.
+
+${FLAGS.rates}
+
+${OCCUPANCY_NOTE}
+
+Meal codes (--board, boardCode): RO room only, BB breakfast, HB breakfast +
+dinner, FB breakfast + lunch + dinner, BL lunch, BD dinner, HBBL breakfast +
+lunch, HBLD lunch + dinner, AI all inclusive. boardCount is how many guests
+per room the meal plan covers; fewer than --adults means not everyone gets
+the meals (BB with boardCount 1 for 2 adults is breakfast for 1 of 2).
+
+--nationality isn't sent with the booking: a rate restricted to that
+nationality may change or be refused at book.
+
+${BODY_NOTE}
+`,
+  book: `Usage: fortrip book [options]
+
+Creates the order and returns paymentUrl with the amount, currency, terms and
+stay. Show those to the user and get their confirmation, then give them
+paymentUrl exactly as returned. Payment happens only on that page: never ask
+for or pass on card details. Takes up to about 2 minutes; rerunning with the
+same flags returns the same order.
+
+${FLAGS.book}
+
+Use exactly the hotel, room, rate plan, dates, rooms, adults and child ages
+from rates. ${OCCUPANCY_NOTE} Guest names are 1-60 characters each,
+--contact-name up to 120, --contact-phone 3-40.
+
+${BODY_NOTE}
+`,
+  skill: `Usage: fortrip skill [planning]
+
+Prints the guide for AI agents (Markdown); planning covers flexible dates,
+budgets, split stays and several destinations.
+`
+};
 var HELP = `fortrip ${VERSION} \u2014 search, price and book Fortrip hotels
 
 Usage: fortrip <command> [options]
+       fortrip <command> --help
 
 Commands:
   login [--no-browser]        Sign in through the browser (device code)
   logout                      Revoke and forget the saved token
   whoami                      Show the signed-in account
-  search                      Find hotels with indicative prices (CNY)
+  search                      Find hotels with indicative prices
   hotel <hotelId>             Static hotel detail [--with-rooms]
-  rates                       Live rooms and rates (CNY) for up to 15 hotels
+  rates                       Live rooms and rates for up to 15 hotels
   book                        Create an order and get a payment link
   skill [planning]            Print the guide for AI agents (Markdown)
 
-search:  --query <text> | --city-code <n> | --near <lat,lng,km>
-         --check-in YYYY-MM-DD --check-out YYYY-MM-DD
-         [--star-min n] [--star-max n] [--facility <name>]... [--price-min n]
-         [--price-max n] [--sort recommended|price-asc|price-desc|star-desc|distance]
-         [--page n] [--page-size n]
-rates:   --hotel <id>... --check-in --check-out [--rooms 1] [--adults 2]
-         [--child-age n]... [--nationality CN] [--board BB]...
-         [--free-cancellation] [--include-unbookable] [--max-rooms n]
-book:    --hotel <id> --room-id <id> --rate-plan <code> --check-in --check-out
-         [--rooms 1] [--adults 2] [--child-age n]...
-         --guest "First Last[:roomNo]"... --contact-name <name>
-         --contact-phone <phone> [--contact-email <email>]
-         [--special-requests <english text>]
+search:
+${FLAGS.search}
+rates:
+${FLAGS.rates}
+book:
+${FLAGS.book}
 
 search, rates and book also take --body '<json>' (or --body @file.json) with
 the raw request body; flags override its fields.
 
+--adults and --child-age are per room: every room has the same occupancy
+(2 rooms for 4 adults is --rooms 2 --adults 2).
+
+search and rates ask for prices in --currency (CNY by default, or USD),
+converted at Stripe's rate or a fixed fallback rate; the response's currency
+and fx fields say which. book still charges the currency it returns (usually
+USD).
+
 Output is JSON on stdout; errors are JSON on stderr.
-Exit codes: 0 ok, 1 error, 2 invalid arguments, 3 not logged in, 4 rate limited.
+Exit codes: 0 ok, 1 error (retry once when stderr has "retryable": true),
+2 invalid arguments, 3 not logged in, 4 rate limited.
 
 Environment:
   FORTRIP_TOKEN    Use this token instead of the saved login (CI, sandboxes)
   FORTRIP_API_URL  API base URL (default https://fortrip.ai)
+  FORTRIP_CURRENCY Default --currency for search and rates
 `;
+var LINK_KEYS = ["paymentUrl", "statusUrl", "orderUrl"];
 async function run(argv) {
   const [command, ...rest] = argv;
   if (!command || command === "help" || command === "--help" || command === "-h") {
     process.stdout.write(HELP);
     return void 0;
   }
+  const usage = Object.hasOwn(USAGE, command) ? USAGE[command] : void 0;
+  if (usage && wantsHelp(rest)) {
+    process.stdout.write(usage);
+    return void 0;
+  }
   if (command === "--version" || command === "-v") {
     process.stdout.write(`${VERSION}
 `);
@@ -615,21 +1217,37 @@ async function run(argv) {
     }
     case "book": {
       const { values } = parse(rest, BOOK_OPTIONS);
-      const data = await call(
-        apiUrl,
-        "POST",
-        "/api/huizhi/bookings",
-        bookBody(values)
-      );
-      return absolutize(apiUrl, data, ["orderUrl", "statusUrl"]);
+      let data;
+      try {
+        data = await call(
+          apiUrl,
+          "POST",
+          "/api/huizhi/bookings",
+          bookBody(values)
+        );
+      } catch (error) {
+        if (!(error instanceof CliError)) throw error;
+        throw new CliError(
+          error.message,
+          error.exitCode,
+          absolutize(apiUrl, error.details, LINK_KEYS)
+        );
+      }
+      return paymentPage(absolutize(apiUrl, data, LINK_KEYS));
     }
     default:
       throw usageError(`Unknown command "${command}". Run \`fortrip --help\`.`);
   }
 }
 async function call(apiUrl, method, path, body) {
-  const token = await requireToken(apiUrl);
-  return unwrap(await request(apiUrl, path, { method, token, body }));
+  return unwrap(await authorizedRequest(apiUrl, path, { method, body }));
+}
+function wantsHelp(args) {
+  for (const arg of args) {
+    if (arg === "--") return false;
+    if (arg === "--help" || arg === "-h") return true;
+  }
+  return false;
 }
 function absolutize(apiUrl, data, keys) {
   const out = { ...data };
@@ -641,18 +1259,30 @@ function absolutize(apiUrl, data, keys) {
   }
   return out;
 }
+function paymentPage(data) {
+  const { paymentUrl, statusUrl } = data;
+  if (typeof statusUrl !== "string" || typeof paymentUrl !== "string") return data;
+  let host;
+  try {
+    host = new URL(paymentUrl).hostname;
+  } catch {
+    return data;
+  }
+  return host === "checkout.stripe.com" ? { ...data, paymentUrl: statusUrl } : data;
+}
 async function main() {
   try {
     const result = await run(process.argv.slice(2));
     if (result !== void 0) {
-      process.stdout.write(`${JSON.stringify(result, null, 2)}
+      const output = result && typeof result === "object" && !Array.isArray(result) ? { ...result, ...notices } : result;
+      process.stdout.write(`${JSON.stringify(output, null, 2)}
 `);
     }
     return EXIT.ok;
   } catch (error) {
     const failure = error instanceof CliError ? error : new CliError(error?.message ?? String(error), EXIT.error);
     process.stderr.write(
-      `${JSON.stringify({ error: failure.message, exitCode: failure.exitCode, ...failure.details }, null, 2)}
+      `${JSON.stringify({ error: failure.message, exitCode: failure.exitCode, ...failure.details, ...notices }, null, 2)}
 `
     );
     return failure.exitCode;