@peektravel/app-utilities 0.5.2 → 0.5.4

package/dist/index.d.cts

@@ -1797,6 +1797,36 @@ interface PeekAuthTokenClaims {
     /** Authenticated user context. */
     user: PeekAuthTokenUser;
 }
+/** The Peek account an install belongs to, as reported on an install webhook. */
+interface InstallWebhookAccount {
+    /** Peek account ID that owns the install. */
+    id: string;
+}
+/**
+ * Claims returned by `verifyInstallWebhook` — the decoded, signature-verified
+ * install-status webhook token.
+ *
+ * Shares the `app_registry_v2` token family with {@link PeekAuthTokenClaims},
+ * but is emitted by the app registry itself for install lifecycle events
+ * (installed / uninstalled / status changed) rather than for a user session —
+ * so {@link InstallWebhookClaims.user} is `null` for system-initiated events
+ * that no user triggered.
+ */
+interface InstallWebhookClaims {
+    /** Install ID — the JWT subject (`sub`). Peek-assigned UUID. */
+    installId: string;
+    /** The account the install belongs to. */
+    account: InstallWebhookAccount;
+    /** Install lifecycle status (e.g. `"installed"`, `"uninstalled"`). */
+    status: string;
+    /** App display version at time of issuance. Empty string when absent. */
+    displayVersion: string;
+    /**
+     * The user that triggered the event, or `null` for system-initiated events
+     * (the whole point of a distinct type from {@link PeekAuthTokenClaims}).
+     */
+    user: PeekAuthTokenUser | null;
+}
 
 /**
  * Configuration for a {@link PeekAccessService} instance. Extends the shared
@@ -2054,8 +2084,6 @@ declare class RestClient$1 {
      * @throws {CngApiError} on any other non-2xx response
      */
     get<T>(path: string): Promise<T>;
-    /** Reads the response body as JSON, falling back to raw text when unparseable. */
-    private parseBody;
     private endpoint;
     private buildHeaders;
 }
@@ -2183,8 +2211,6 @@ declare class RestClient {
      * @throws {AcmeApiError} on any other non-2xx response
      */
     get<T>(path: string): Promise<T>;
-    /** Reads the response body as JSON, falling back to raw text when unparseable. */
-    private parseBody;
     private endpoint;
     private buildHeaders;
 }
@@ -2366,6 +2392,29 @@ interface Waiver {
  */
 declare function parseWaiverWebhook(payload: unknown, options?: AccessOptions): Waiver;
 
+/**
+ * Verifies an install-status webhook token and returns its clean claims.
+ *
+ * Validates the HMAC signature (with `secret`), the token expiry, the
+ * `"app_registry_v2"` issuer, and the `"Joken"` audience — the same checks as
+ * {@link PeekAccessService.verifyPeekAuthToken} — then maps the payload to
+ * {@link InstallWebhookClaims}, tolerating a `null` `user` (system events).
+ * Throws from the `jsonwebtoken` library on any verification failure, so callers
+ * can branch on the error kind:
+ *
+ * - `JsonWebTokenError` — signature invalid, wrong issuer/audience, or malformed
+ * - `TokenExpiredError` — past `exp`
+ * - `NotBeforeError` — before `nbf`
+ *
+ * @param token the raw JWT delivered by the install webhook (no `Bearer` prefix)
+ * @param secret the app's HMAC signing secret (the `jwtSecret` you construct
+ *   `PeekAccessService` with)
+ * @throws {JsonWebTokenError} signature invalid or token malformed
+ * @throws {TokenExpiredError} token has expired
+ * @throws {NotBeforeError} token not yet valid
+ */
+declare function verifyInstallWebhook(token: string, secret: string): InstallWebhookClaims;
+
 /**
  * Typed errors thrown by the package. Each mirrors a failure mode of the Peek
  * GraphQL gateway (or the CNG REST gateway) so callers can branch on the error
@@ -2402,6 +2451,28 @@ declare class PeekGraphQLError extends Error {
     readonly graphqlErrors: unknown[];
     constructor(graphqlErrors: unknown[], message?: string);
 }
+/**
+ * Thrown when the Peek GraphQL gateway returns a non-2xx HTTP response that is
+ * not one of the specifically-handled statuses (418/429) and does not carry a
+ * GraphQL `errors` array. This is the transport-level failure — a `401`
+ * (auth/secret wrong), `404` (wrong app id / not provisioned), `5xx`, etc. —
+ * as opposed to {@link PeekGraphQLError}, which is a resolver-level failure
+ * reported inside an otherwise-successful HTTP response.
+ *
+ * The offending status is preserved on {@link PeekHttpError.statusCode}, the
+ * request URL on {@link PeekHttpError.url}, and the raw response body (parsed
+ * JSON when possible, otherwise the raw text) on {@link PeekHttpError.body} — so
+ * callers can tell "which config is wrong" without disassembling the bundle.
+ */
+declare class PeekHttpError extends Error {
+    /** The HTTP status that triggered this error. */
+    readonly statusCode: number;
+    /** The request URL that produced the failing response. */
+    readonly url: string;
+    /** The raw response body (parsed JSON when possible, otherwise text). */
+    readonly body: unknown;
+    constructor(statusCode: number, url: string, body: unknown, message?: string);
+}
 /**
  * Thrown when a payment or booking-modification operation is called on an
  * access service that was constructed without `fullCustomerAccess` (PII access
@@ -2442,4 +2513,4 @@ declare class AcmeApiError extends Error {
     constructor(statusCode: number, body: unknown, message?: string);
 }
 
-export { ACTIVITY_PRODUCT_TYPE, ADD_ON_PRODUCT_TYPE, type AccessOptions, type AccountUser, AccountUserService, type AccountUserServiceOptions, AcmeAccessService, type AcmeAccessServiceConfig, type AcmeActivity, type AcmeActivityTicket, AcmeApiError, AcmeProductService, type Activity, type ActivityOverrides, type ActivityTicket, type AddAddonInput, AdminAccountRequiredError, type Agent, type AssignGuideResult, type AssignedActivity, type AssignedResource, type Availability, AvailabilityService, type AvailabilityTime, type AvailabilityTimesQuery, type Booking, type BookingAddon, type BookingAddonMoney, type BookingAddonOption, type BookingAddons, type BookingAddonsMutationResult, type BookingPaymentsOnFile, type BookingReadOptions, type BookingSearchBy, BookingService, type BookingServiceOptions, type BookingTimeRangeSearch, type CancelBookingResult, type Channel, type ClearOverridesInput, CngAccessService, type CngAccessServiceConfig, CngApiError, CngProductService, type CreateBookingGuest, type CreateBookingInput, type CreateBookingTicket, type CreateEngineInput, type CreatePromoCodeInput, type CreatedBooking, type CreatedPricingEngine, type CreatedPromoCode, type CustomQuestionAnswer, type DailyNote, DailyNoteService, type Duration, type Guest, type GuestMetadata, type Guide, type GuideAssignment, type InvoiceLinkResult, type Logger, type MakePaymentInput, type MakePaymentResult, type Membership, type MembershipPurchaseInput, MembershipService, type NoteMode, type Payment, type PaymentSource, PeekAccessService, type PeekAccessServiceConfig, type PeekAuthTokenClaims, type PeekAuthTokenUser, PeekGraphQLError, type PeekPlatform, PiiAccessDisabledError, type Price, type PricingActivityContext, type PricingEngine, type PricingMoney, type PricingNamedRef, type PricingOverride, type PricingOverrideFilter, PricingService, type Product, ProductService, type ProductServiceOptions, type ProductTicket, type PromoCode, type PromoCodeFixedAmount, PromoCodeService, type PromoCodeServiceOptions, type PurchasedMembership, RENTAL_PRODUCT_TYPE, RateLimitError, type RefundInput, type RefundResult, ResellerService, type ResolvedOverride, type ResolvedPricingOverride, type ResolvedResourceOption, type Resource, type ResourceOptionOverride, type ResourceOptionQuantity, type ResourcePool, type ResourcePoolAccountUser, type ResourcePoolAssignment, type ResourcePoolMode, ResourcePoolService, type Review, ReviewService, type Ticket, type Timeslot, type TimeslotFilter, TimeslotService, type UpdateEngineInput, type UpdateTimeslotResult, type UpsertOverridesInput, type UpsertOverridesResult, type Waiver, noopLogger, parseBookingWebhook, parseWaiverWebhook };
+export { ACTIVITY_PRODUCT_TYPE, ADD_ON_PRODUCT_TYPE, type AccessOptions, type AccountUser, AccountUserService, type AccountUserServiceOptions, AcmeAccessService, type AcmeAccessServiceConfig, type AcmeActivity, type AcmeActivityTicket, AcmeApiError, AcmeProductService, type Activity, type ActivityOverrides, type ActivityTicket, type AddAddonInput, AdminAccountRequiredError, type Agent, type AssignGuideResult, type AssignedActivity, type AssignedResource, type Availability, AvailabilityService, type AvailabilityTime, type AvailabilityTimesQuery, type Booking, type BookingAddon, type BookingAddonMoney, type BookingAddonOption, type BookingAddons, type BookingAddonsMutationResult, type BookingPaymentsOnFile, type BookingReadOptions, type BookingSearchBy, BookingService, type BookingServiceOptions, type BookingTimeRangeSearch, type CancelBookingResult, type Channel, type ClearOverridesInput, CngAccessService, type CngAccessServiceConfig, CngApiError, CngProductService, type CreateBookingGuest, type CreateBookingInput, type CreateBookingTicket, type CreateEngineInput, type CreatePromoCodeInput, type CreatedBooking, type CreatedPricingEngine, type CreatedPromoCode, type CustomQuestionAnswer, type DailyNote, DailyNoteService, type Duration, type Guest, type GuestMetadata, type Guide, type GuideAssignment, type InstallWebhookAccount, type InstallWebhookClaims, type InvoiceLinkResult, type Logger, type MakePaymentInput, type MakePaymentResult, type Membership, type MembershipPurchaseInput, MembershipService, type NoteMode, type Payment, type PaymentSource, PeekAccessService, type PeekAccessServiceConfig, type PeekAuthTokenClaims, type PeekAuthTokenUser, PeekGraphQLError, PeekHttpError, type PeekPlatform, PiiAccessDisabledError, type Price, type PricingActivityContext, type PricingEngine, type PricingMoney, type PricingNamedRef, type PricingOverride, type PricingOverrideFilter, PricingService, type Product, ProductService, type ProductServiceOptions, type ProductTicket, type PromoCode, type PromoCodeFixedAmount, PromoCodeService, type PromoCodeServiceOptions, type PurchasedMembership, RENTAL_PRODUCT_TYPE, RateLimitError, type RefundInput, type RefundResult, ResellerService, type ResolvedOverride, type ResolvedPricingOverride, type ResolvedResourceOption, type Resource, type ResourceOptionOverride, type ResourceOptionQuantity, type ResourcePool, type ResourcePoolAccountUser, type ResourcePoolAssignment, type ResourcePoolMode, ResourcePoolService, type Review, ReviewService, type Ticket, type Timeslot, type TimeslotFilter, TimeslotService, type UpdateEngineInput, type UpdateTimeslotResult, type UpsertOverridesInput, type UpsertOverridesResult, type Waiver, noopLogger, parseBookingWebhook, parseWaiverWebhook, verifyInstallWebhook };

package/dist/index.d.ts

@@ -1797,6 +1797,36 @@ interface PeekAuthTokenClaims {
     /** Authenticated user context. */
     user: PeekAuthTokenUser;
 }
+/** The Peek account an install belongs to, as reported on an install webhook. */
+interface InstallWebhookAccount {
+    /** Peek account ID that owns the install. */
+    id: string;
+}
+/**
+ * Claims returned by `verifyInstallWebhook` — the decoded, signature-verified
+ * install-status webhook token.
+ *
+ * Shares the `app_registry_v2` token family with {@link PeekAuthTokenClaims},
+ * but is emitted by the app registry itself for install lifecycle events
+ * (installed / uninstalled / status changed) rather than for a user session —
+ * so {@link InstallWebhookClaims.user} is `null` for system-initiated events
+ * that no user triggered.
+ */
+interface InstallWebhookClaims {
+    /** Install ID — the JWT subject (`sub`). Peek-assigned UUID. */
+    installId: string;
+    /** The account the install belongs to. */
+    account: InstallWebhookAccount;
+    /** Install lifecycle status (e.g. `"installed"`, `"uninstalled"`). */
+    status: string;
+    /** App display version at time of issuance. Empty string when absent. */
+    displayVersion: string;
+    /**
+     * The user that triggered the event, or `null` for system-initiated events
+     * (the whole point of a distinct type from {@link PeekAuthTokenClaims}).
+     */
+    user: PeekAuthTokenUser | null;
+}
 
 /**
  * Configuration for a {@link PeekAccessService} instance. Extends the shared
@@ -2054,8 +2084,6 @@ declare class RestClient$1 {
      * @throws {CngApiError} on any other non-2xx response
      */
     get<T>(path: string): Promise<T>;
-    /** Reads the response body as JSON, falling back to raw text when unparseable. */
-    private parseBody;
     private endpoint;
     private buildHeaders;
 }
@@ -2183,8 +2211,6 @@ declare class RestClient {
      * @throws {AcmeApiError} on any other non-2xx response
      */
     get<T>(path: string): Promise<T>;
-    /** Reads the response body as JSON, falling back to raw text when unparseable. */
-    private parseBody;
     private endpoint;
     private buildHeaders;
 }
@@ -2366,6 +2392,29 @@ interface Waiver {
  */
 declare function parseWaiverWebhook(payload: unknown, options?: AccessOptions): Waiver;
 
+/**
+ * Verifies an install-status webhook token and returns its clean claims.
+ *
+ * Validates the HMAC signature (with `secret`), the token expiry, the
+ * `"app_registry_v2"` issuer, and the `"Joken"` audience — the same checks as
+ * {@link PeekAccessService.verifyPeekAuthToken} — then maps the payload to
+ * {@link InstallWebhookClaims}, tolerating a `null` `user` (system events).
+ * Throws from the `jsonwebtoken` library on any verification failure, so callers
+ * can branch on the error kind:
+ *
+ * - `JsonWebTokenError` — signature invalid, wrong issuer/audience, or malformed
+ * - `TokenExpiredError` — past `exp`
+ * - `NotBeforeError` — before `nbf`
+ *
+ * @param token the raw JWT delivered by the install webhook (no `Bearer` prefix)
+ * @param secret the app's HMAC signing secret (the `jwtSecret` you construct
+ *   `PeekAccessService` with)
+ * @throws {JsonWebTokenError} signature invalid or token malformed
+ * @throws {TokenExpiredError} token has expired
+ * @throws {NotBeforeError} token not yet valid
+ */
+declare function verifyInstallWebhook(token: string, secret: string): InstallWebhookClaims;
+
 /**
  * Typed errors thrown by the package. Each mirrors a failure mode of the Peek
  * GraphQL gateway (or the CNG REST gateway) so callers can branch on the error
@@ -2402,6 +2451,28 @@ declare class PeekGraphQLError extends Error {
     readonly graphqlErrors: unknown[];
     constructor(graphqlErrors: unknown[], message?: string);
 }
+/**
+ * Thrown when the Peek GraphQL gateway returns a non-2xx HTTP response that is
+ * not one of the specifically-handled statuses (418/429) and does not carry a
+ * GraphQL `errors` array. This is the transport-level failure — a `401`
+ * (auth/secret wrong), `404` (wrong app id / not provisioned), `5xx`, etc. —
+ * as opposed to {@link PeekGraphQLError}, which is a resolver-level failure
+ * reported inside an otherwise-successful HTTP response.
+ *
+ * The offending status is preserved on {@link PeekHttpError.statusCode}, the
+ * request URL on {@link PeekHttpError.url}, and the raw response body (parsed
+ * JSON when possible, otherwise the raw text) on {@link PeekHttpError.body} — so
+ * callers can tell "which config is wrong" without disassembling the bundle.
+ */
+declare class PeekHttpError extends Error {
+    /** The HTTP status that triggered this error. */
+    readonly statusCode: number;
+    /** The request URL that produced the failing response. */
+    readonly url: string;
+    /** The raw response body (parsed JSON when possible, otherwise text). */
+    readonly body: unknown;
+    constructor(statusCode: number, url: string, body: unknown, message?: string);
+}
 /**
  * Thrown when a payment or booking-modification operation is called on an
  * access service that was constructed without `fullCustomerAccess` (PII access
@@ -2442,4 +2513,4 @@ declare class AcmeApiError extends Error {
     constructor(statusCode: number, body: unknown, message?: string);
 }
 
-export { ACTIVITY_PRODUCT_TYPE, ADD_ON_PRODUCT_TYPE, type AccessOptions, type AccountUser, AccountUserService, type AccountUserServiceOptions, AcmeAccessService, type AcmeAccessServiceConfig, type AcmeActivity, type AcmeActivityTicket, AcmeApiError, AcmeProductService, type Activity, type ActivityOverrides, type ActivityTicket, type AddAddonInput, AdminAccountRequiredError, type Agent, type AssignGuideResult, type AssignedActivity, type AssignedResource, type Availability, AvailabilityService, type AvailabilityTime, type AvailabilityTimesQuery, type Booking, type BookingAddon, type BookingAddonMoney, type BookingAddonOption, type BookingAddons, type BookingAddonsMutationResult, type BookingPaymentsOnFile, type BookingReadOptions, type BookingSearchBy, BookingService, type BookingServiceOptions, type BookingTimeRangeSearch, type CancelBookingResult, type Channel, type ClearOverridesInput, CngAccessService, type CngAccessServiceConfig, CngApiError, CngProductService, type CreateBookingGuest, type CreateBookingInput, type CreateBookingTicket, type CreateEngineInput, type CreatePromoCodeInput, type CreatedBooking, type CreatedPricingEngine, type CreatedPromoCode, type CustomQuestionAnswer, type DailyNote, DailyNoteService, type Duration, type Guest, type GuestMetadata, type Guide, type GuideAssignment, type InvoiceLinkResult, type Logger, type MakePaymentInput, type MakePaymentResult, type Membership, type MembershipPurchaseInput, MembershipService, type NoteMode, type Payment, type PaymentSource, PeekAccessService, type PeekAccessServiceConfig, type PeekAuthTokenClaims, type PeekAuthTokenUser, PeekGraphQLError, type PeekPlatform, PiiAccessDisabledError, type Price, type PricingActivityContext, type PricingEngine, type PricingMoney, type PricingNamedRef, type PricingOverride, type PricingOverrideFilter, PricingService, type Product, ProductService, type ProductServiceOptions, type ProductTicket, type PromoCode, type PromoCodeFixedAmount, PromoCodeService, type PromoCodeServiceOptions, type PurchasedMembership, RENTAL_PRODUCT_TYPE, RateLimitError, type RefundInput, type RefundResult, ResellerService, type ResolvedOverride, type ResolvedPricingOverride, type ResolvedResourceOption, type Resource, type ResourceOptionOverride, type ResourceOptionQuantity, type ResourcePool, type ResourcePoolAccountUser, type ResourcePoolAssignment, type ResourcePoolMode, ResourcePoolService, type Review, ReviewService, type Ticket, type Timeslot, type TimeslotFilter, TimeslotService, type UpdateEngineInput, type UpdateTimeslotResult, type UpsertOverridesInput, type UpsertOverridesResult, type Waiver, noopLogger, parseBookingWebhook, parseWaiverWebhook };
+export { ACTIVITY_PRODUCT_TYPE, ADD_ON_PRODUCT_TYPE, type AccessOptions, type AccountUser, AccountUserService, type AccountUserServiceOptions, AcmeAccessService, type AcmeAccessServiceConfig, type AcmeActivity, type AcmeActivityTicket, AcmeApiError, AcmeProductService, type Activity, type ActivityOverrides, type ActivityTicket, type AddAddonInput, AdminAccountRequiredError, type Agent, type AssignGuideResult, type AssignedActivity, type AssignedResource, type Availability, AvailabilityService, type AvailabilityTime, type AvailabilityTimesQuery, type Booking, type BookingAddon, type BookingAddonMoney, type BookingAddonOption, type BookingAddons, type BookingAddonsMutationResult, type BookingPaymentsOnFile, type BookingReadOptions, type BookingSearchBy, BookingService, type BookingServiceOptions, type BookingTimeRangeSearch, type CancelBookingResult, type Channel, type ClearOverridesInput, CngAccessService, type CngAccessServiceConfig, CngApiError, CngProductService, type CreateBookingGuest, type CreateBookingInput, type CreateBookingTicket, type CreateEngineInput, type CreatePromoCodeInput, type CreatedBooking, type CreatedPricingEngine, type CreatedPromoCode, type CustomQuestionAnswer, type DailyNote, DailyNoteService, type Duration, type Guest, type GuestMetadata, type Guide, type GuideAssignment, type InstallWebhookAccount, type InstallWebhookClaims, type InvoiceLinkResult, type Logger, type MakePaymentInput, type MakePaymentResult, type Membership, type MembershipPurchaseInput, MembershipService, type NoteMode, type Payment, type PaymentSource, PeekAccessService, type PeekAccessServiceConfig, type PeekAuthTokenClaims, type PeekAuthTokenUser, PeekGraphQLError, PeekHttpError, type PeekPlatform, PiiAccessDisabledError, type Price, type PricingActivityContext, type PricingEngine, type PricingMoney, type PricingNamedRef, type PricingOverride, type PricingOverrideFilter, PricingService, type Product, ProductService, type ProductServiceOptions, type ProductTicket, type PromoCode, type PromoCodeFixedAmount, PromoCodeService, type PromoCodeServiceOptions, type PurchasedMembership, RENTAL_PRODUCT_TYPE, RateLimitError, type RefundInput, type RefundResult, ResellerService, type ResolvedOverride, type ResolvedPricingOverride, type ResolvedResourceOption, type Resource, type ResourceOptionOverride, type ResourceOptionQuantity, type ResourcePool, type ResourcePoolAccountUser, type ResourcePoolAssignment, type ResourcePoolMode, ResourcePoolService, type Review, ReviewService, type Ticket, type Timeslot, type TimeslotFilter, TimeslotService, type UpdateEngineInput, type UpdateTimeslotResult, type UpsertOverridesInput, type UpsertOverridesResult, type Waiver, noopLogger, parseBookingWebhook, parseWaiverWebhook, verifyInstallWebhook };

package/dist/index.js

@@ -1,7 +1,5 @@
-import * as jwt from 'jsonwebtoken';
 import { randomUUID } from 'crypto';
-
-// src/peek-access-service.ts
+import * as jwt from 'jsonwebtoken';
 
 // src/internal/peek/gateway-endpoints.ts
 var SALES_ENDPOINT = "sales";
@@ -212,6 +210,21 @@ var PeekGraphQLError = class extends Error {
     this.graphqlErrors = graphqlErrors;
   }
 };
+var PeekHttpError = class extends Error {
+  /** The HTTP status that triggered this error. */
+  statusCode;
+  /** The request URL that produced the failing response. */
+  url;
+  /** The raw response body (parsed JSON when possible, otherwise text). */
+  body;
+  constructor(statusCode, url, body, message) {
+    super(message ?? `Peek request failed with HTTP ${statusCode}`);
+    this.name = "PeekHttpError";
+    this.statusCode = statusCode;
+    this.url = url;
+    this.body = body;
+  }
+};
 var PiiAccessDisabledError = class extends Error {
   /** The name of the operation that was blocked (e.g. `"makePayment"`). */
   operation;
@@ -1922,6 +1935,14 @@ function createTokenManager(config) {
 var RATE_LIMIT_STATUS = 429;
 var ADMIN_ACCOUNT_REQUIRED_STATUS = 418;
 var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+async function parseBody(response) {
+  const text = await response.text();
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
 async function requestWithRetry(http, url, init, label, onResponse) {
   const { retryDelaysMs, logger, fetchFn } = http;
   for (let attempt = 0; attempt <= retryDelaysMs.length; attempt++) {
@@ -1948,6 +1969,7 @@ async function requestWithRetry(http, url, init, label, onResponse) {
 }
 
 // src/internal/peek/graphql-client.ts
+var isObject = (value) => typeof value === "object" && value !== null;
 var GraphQLClient = class {
   constructor(options) {
     this.options = options;
@@ -1973,7 +1995,8 @@ var GraphQLClient = class {
       },
       endpointName,
       async (response) => {
-        const body = await response.json();
+        const raw = await parseBody(response);
+        const body = isObject(raw) ? raw : {};
         if (body.errors) {
           logger.error(`GraphQL errors for ${endpointName}`, {
             url,
@@ -1983,7 +2006,7 @@ var GraphQLClient = class {
         }
         if (!response.ok) {
           logger.error(`GraphQL request failed with HTTP ${response.status}`, { url });
-          throw new Error(`GraphQL request failed with HTTP ${response.status}`);
+          throw new PeekHttpError(response.status, url, raw);
         }
         return body;
       }
@@ -2005,6 +2028,24 @@ var GraphQLClient = class {
     return headers;
   }
 };
+var PEEK_TOKEN_ISSUER = "app_registry_v2";
+var PEEK_TOKEN_AUDIENCE = "Joken";
+function verifyPeekJwt(token, secret) {
+  return jwt.verify(token, secret, {
+    issuer: PEEK_TOKEN_ISSUER,
+    audience: PEEK_TOKEN_AUDIENCE
+  });
+}
+function mapPeekTokenUser(u) {
+  return {
+    email: u.email,
+    id: u.id,
+    isAdmin: u.is_admin,
+    locale: u.locale,
+    name: u.name,
+    platform: u.platform
+  };
+}
 
 // src/internal/peek/memberships/membership-converter.ts
 function fromMembershipsResponse(response) {
@@ -2473,10 +2514,17 @@ function fromTimeslotNode(node, productId) {
     durationMin: node.minuteLength ?? 0,
     date: node.date || "",
     startTime: node.start ?? null,
-    assignedResources: mapAssignedResources(node.inheritedResourceAllocations)
+    assignedResources: mapAssignedResources(selectResourceAllocations(node))
   };
 }
 var ACTIVE_ALLOCATION_STATUS = "ACTIVE";
+function selectResourceAllocations(node) {
+  const inherited = node.inheritedResourceAllocations;
+  if (Array.isArray(inherited) && inherited.length > 0) {
+    return inherited;
+  }
+  return node.resourceAllocations;
+}
 function mapAssignedResources(allocations) {
   if (!Array.isArray(allocations) || allocations.length === 0) {
     return [];
@@ -2563,9 +2611,24 @@ var TIMESLOTS_QUERY = `
           status
           date
           inheritedResourceAllocations {
+            id
+            status
+            quantity
+            resourcePool {
+              id
+              name
+              category
+              capacity
+              accountUser {
+                id
+              }
+            }
+          }
+          resourceAllocations {
             quantity
             status
             resourcePool {
+              id
               name
               category
               capacity
@@ -2601,9 +2664,24 @@ var TIMESLOT_BY_ID_QUERY = `
           status
           date
           inheritedResourceAllocations {
+            id
+            status
+            quantity
+            resourcePool {
+              id
+              name
+              category
+              capacity
+              accountUser {
+                id
+              }
+            }
+          }
+          resourceAllocations {
             quantity
             status
             resourcePool {
+              id
               name
               category
               capacity
@@ -3408,7 +3486,6 @@ var noopLogger = {
 // src/peek-access-service.ts
 var DEFAULT_BASE_URL = "https://apps.peekapis.com/backoffice-gql";
 var DEFAULT_V2_BASE_URL = "https://app-registry.peeklabs.com/installations-api";
-var PEEK_TOKEN_ISSUER = "app_registry_v2";
 var PeekAccessService = class {
   client;
   productServiceOptions;
@@ -3471,21 +3548,11 @@ var PeekAccessService = class {
    * @throws {NotBeforeError} token not yet valid
    */
   verifyPeekAuthToken(token) {
-    const payload = jwt.verify(token, this.jwtSecret, {
-      issuer: PEEK_TOKEN_ISSUER
-    });
-    const { user: u } = payload;
+    const payload = verifyPeekJwt(token, this.jwtSecret);
     return {
       installId: payload.sub,
       displayVersion: payload.display_version,
-      user: {
-        email: u.email,
-        id: u.id,
-        isAdmin: u.is_admin,
-        locale: u.locale,
-        name: u.name,
-        platform: u.platform
-      }
+      user: mapPeekTokenUser(payload.user)
     };
   }
   /**
@@ -3869,7 +3936,7 @@ var RestClient = class {
       { method: "GET", headers: this.buildHeaders() },
       path,
       async (response) => {
-        const body = await this.parseBody(response);
+        const body = await parseBody(response);
         if (!response.ok) {
           logger.error(`CNG request failed with HTTP ${response.status}`, { url });
           throw new CngApiError(response.status, body);
@@ -3878,15 +3945,6 @@ var RestClient = class {
       }
     );
   }
-  /** Reads the response body as JSON, falling back to raw text when unparseable. */
-  async parseBody(response) {
-    const text = await response.text();
-    try {
-      return JSON.parse(text);
-    } catch {
-      return text;
-    }
-  }
   endpoint(path) {
     const { baseUrl, appId, extendableSlug } = this.options;
     return `${baseUrl}/${appId}/${extendableSlug}/${path}`;
@@ -4009,7 +4067,7 @@ var RestClient2 = class {
       { method: "GET", headers: this.buildHeaders() },
       path,
       async (response) => {
-        const body = await this.parseBody(response);
+        const body = await parseBody(response);
         if (!response.ok) {
           logger.error(`ACME request failed with HTTP ${response.status}`, { url });
           throw new AcmeApiError(response.status, body);
@@ -4018,15 +4076,6 @@ var RestClient2 = class {
       }
     );
   }
-  /** Reads the response body as JSON, falling back to raw text when unparseable. */
-  async parseBody(response) {
-    const text = await response.text();
-    try {
-      return JSON.parse(text);
-    } catch {
-      return text;
-    }
-  }
   endpoint(path) {
     const { baseUrl, appId, extendableSlug } = this.options;
     return `${baseUrl}/${appId}/${extendableSlug}/${path}`;
@@ -4167,6 +4216,18 @@ function extractWaiverNode(payload) {
   return record;
 }
 
-export { ACTIVITY_PRODUCT_TYPE, ADD_ON_PRODUCT_TYPE, AccountUserService, AcmeAccessService, AcmeApiError, AcmeProductService, AdminAccountRequiredError, AvailabilityService, BookingService, CngAccessService, CngApiError, CngProductService, DailyNoteService, MembershipService, PeekAccessService, PeekGraphQLError, PiiAccessDisabledError, PricingService, ProductService, PromoCodeService, RENTAL_PRODUCT_TYPE, RateLimitError, ResellerService, ResourcePoolService, ReviewService, TimeslotService, noopLogger, parseBookingWebhook, parseWaiverWebhook };
+// src/internal/peek/installs/install-webhook.ts
+function verifyInstallWebhook(token, secret) {
+  const payload = verifyPeekJwt(token, secret);
+  return {
+    installId: payload.sub ?? "",
+    account: { id: payload.account?.id ?? "" },
+    status: payload.status ?? "",
+    displayVersion: payload.display_version ?? "",
+    user: payload.user ? mapPeekTokenUser(payload.user) : null
+  };
+}
+
+export { ACTIVITY_PRODUCT_TYPE, ADD_ON_PRODUCT_TYPE, AccountUserService, AcmeAccessService, AcmeApiError, AcmeProductService, AdminAccountRequiredError, AvailabilityService, BookingService, CngAccessService, CngApiError, CngProductService, DailyNoteService, MembershipService, PeekAccessService, PeekGraphQLError, PeekHttpError, PiiAccessDisabledError, PricingService, ProductService, PromoCodeService, RENTAL_PRODUCT_TYPE, RateLimitError, ResellerService, ResourcePoolService, ReviewService, TimeslotService, noopLogger, parseBookingWebhook, parseWaiverWebhook, verifyInstallWebhook };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map