security: scrub proprietary references from public repo + harden internal-refs guard

package.json

@@ -34,7 +34,7 @@
   "pnpm": {
     "onlyBuiltDependencies": [],
     "overrides": {
-      "hono": ">=4.12.16",
+      "hono": ">=4.12.25",
       "ip-address": ">=10.1.1",
       "fast-uri": ">=3.1.2",
       "vite": "^8.0.16",

packages/adapters/duffel/PARITY_ROADMAP.md

@@ -1,17 +1,15 @@
-# @otaip/adapter-duffel — product parity roadmap (REMINDER)
+# @otaip/adapter-duffel — product coverage roadmap
 
-**Why this file exists (owner directive, 2026-05-26):** Aviare is building Duffel
-product integrations (Payments/Cards, Stays, Cars) against its own code. Those MUST
-land here in the shared `@otaip/adapter-duffel` too, so we don't reimplement Duffel
-plumbing per-consumer. Until each is built here, this file is the standing reminder
-+ the place to paste the concrete build spec captured from the Aviare implementation.
+**Goal:** `@otaip/adapter-duffel` should cover all Duffel products, so downstream
+consumers never have to reimplement Duffel plumbing. This file tracks which
+products are implemented in this adapter and what is still missing.
 
-**Rule:** when a Duffel product integration is finished in Aviare, append its full
-spec to the matching section below — Duffel API resource paths, search→book flow,
-request/response (wire) shapes, mapper logic, env/auth, and gotchas — enough that
-this adapter can be built from the doc alone, without re-deriving anything.
+**Rule:** when a Duffel product integration is implemented here, document its
+full spec in the matching section below — Duffel API resource paths, the
+search→book flow, request/response (wire) shapes, mapper logic, env/auth, and
+gotchas — enough that the adapter can be built from the doc alone.
 
-Duffel products (confirmed in docs: https://duffel.com/docs/api/overview/welcome):
+Duffel products (per https://duffel.com/docs/api/overview/welcome):
 Flights, Stays, Cars, Payments.
 
 ---
@@ -22,20 +20,18 @@ Flights, Stays, Cars, Payments.
 
 ## 2. Payments / Cards — 🟡 PARTIAL → finish
 - Orders are created via `DuffelOrderBridge`, but **paying** for the order is not
-  wired here (Aviare currently pays via Stripe Issuing, which we are replacing with
-  Duffel).
+  wired here yet.
 - **TODO:** add the Duffel **pay-for-order** flow (balance payment / `payments`)
   and, if used, **Duffel Cards** (virtual card issuing to pay suppliers).
-- **Paste here when built in Aviare:** the Duffel payment resource path(s), the
-  order-create-with-payment vs hold-then-pay sequence, payment object shape
+- **Document when built:** the Duffel payment resource path(s), the
+  order-create-with-payment vs hold-then-pay sequence, the payment object shape
   (`type: balance` etc.), and how the order confirmation/ticket numbers come back.
 
 ## 3. Stays (hotels) — ❌ NOT STARTED
-- No Stays code in this adapter. Aviare hotels currently go through Hotelbeds
-  (blocked on certification) — Duffel Stays is the unblock.
+- No Stays code in this adapter yet.
 - **TODO:** add a `DuffelStaysAdapter` (search + rates + book) mirroring
   `DuffelAdapter`, with a stays mapper + types, and extend `capabilities.ts`.
-- **Paste here when built in Aviare:** `/stays/...` resource paths, the
+- **Document when built:** `/stays/...` resource paths, the
   search → rates → quote → book flow, wire shapes, mapper, gotchas.
 
 ## 4. Cars (car hire) — 🟡 SCAFFOLDED → finish
@@ -45,10 +41,5 @@ Flights, Stays, Cars, Payments.
   Duffel) is not implemented/exported, and `capabilities.ts` doesn't advertise cars.
 - **TODO:** implement `DuffelCarsAdapter` using the existing types + mapper; wire
   search → quote → book; export it; update capabilities.
-- **Paste here when built in Aviare:** `/cars/...` resource paths, the
+- **Document when built:** `/cars/...` resource paths, the
   search→quote→book flow, how it uses the existing `cars-types`/`cars-mapper`, gotchas.
-
----
-
-_Tracking the Aviare side: builds happen in `aviare` (orchestrator package + tools +
-UI cards), then get mirrored here. Keep the two in sync._

scripts/check-no-internal-refs.sh

@@ -36,6 +36,10 @@ ci_patterns=(
   'generate_v06'
   'v0_6_'
   '018_routing_disambiguation'
+  # Proprietary commercial-layer product names — must never appear in the
+  # public OTAIP repo.
+  'aviare'
+  'mitto'
 )
 
 # Backward-framing tell-words (case-insensitive). The grep cannot reason about