@peektravel/app-utilities 0.7.0 → 0.7.1

package/docs/webhooks.md

@@ -195,10 +195,12 @@ App Store config. There is no GraphQL selection to paste.
 
 ## Step 2 — verify and parse the delivery
 
-Extract the JWT from the delivery (the request token, or the `Authorization`
-header with the `Bearer ` prefix stripped) and pass it — along with the JSON body
-and your app's signing secret (the same `jwtSecret` you construct
-`PeekAccessService` with) — to `parseInstallWebhook`:
+Peek delivers the signed token in the **`x-peek-auth` request header**. Pass that
+header value as-is, along with the JSON body and your app's signing secret (the
+same `jwtSecret` you construct `PeekAccessService` with — conventionally
+`PEEK_INTERNAL_SECRET`), to `parseInstallWebhook`. You do **not** need to strip a
+`Bearer ` prefix: `parseInstallWebhook` tolerates the header value with or
+without it.
 
 ```ts
 import { parseInstallWebhook, type InstallWebhook } from "@peektravel/app-utilities";
@@ -206,7 +208,9 @@ import { parseInstallWebhook, type InstallWebhook } from "@peektravel/app-utilit
 app.post("/webhooks/install", async (req, res) => {
   let event: InstallWebhook;
   try {
-    event = parseInstallWebhook(req.token, req.body, process.env.PEEK_INTERNAL_SECRET!);
+    // `x-peek-auth` carries the token (a `Bearer ` prefix, if any, is stripped for you):
+    const token = req.header("x-peek-auth") ?? "";
+    event = parseInstallWebhook(token, req.body, process.env.PEEK_INTERNAL_SECRET!);
   } catch {
     return res.sendStatus(401); // signature/issuer/audience/expiry failed
   }

package/llms.txt

@@ -196,9 +196,11 @@ an external system** (App Store config), not from code.
   are **nullable**: a value this version does not recognise maps to `null` (wire
   value kept on `rawStatus`) rather than being coerced, because Peek does not
   redeliver a 2xx and a coerced status silently drops a lifecycle transition. Give
-  both a `default:` branch that fails loudly. `secret` is the app's `jwtSecret`,
-  app-wide, so it verifies fine on a brand-new install before any record exists.
-  No query to register; just subscribe to the event.
+  both a `default:` branch that fails loudly. `token` is Peek's `x-peek-auth`
+  request header value — pass it as-is, a `Bearer ` prefix is stripped for you.
+  `secret` is the app's `jwtSecret`, app-wide, so it verifies fine on a brand-new
+  install before any record exists. No query to register; just subscribe to the
+  event.
   - **Deprecated / removed:** `verifyInstallWebhook(token, secret):
     InstallWebhookClaims` still verifies the token but is `@deprecated` — it reads
     only the token, missing the account name/platform/test flag. `parseInstallEvent`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peektravel/app-utilities",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "GraphQL JS mapping utilities extracted from the Peek Pro Autopilot connector.",
   "license": "MIT",
   "repository": {