@peektravel/app-utilities 0.7.2 → 0.7.3

package/docs/webhooks.md

@@ -265,9 +265,10 @@ The **JSON body is the source of the event data**; the fields it shares with the
 token (`installId`, `accountId`, `status`, `displayVersion`, `user`) fall back to
 the **verified token** when the body omits them. The token authenticates the
 whole delivery — only Peek can mint a valid one — so the body is trusted within a
-verified request. Unlike `verifyPeekAuthToken`, `user` is nullable: install
-lifecycle events are often system-initiated (no acting user), so the parser
-tolerates a missing `modified_by`/`user`.
+verified request. `user` is nullable here — as it is on `verifyPeekAuthToken` —
+because install lifecycle events are often system-initiated (no acting user), so
+the parser tolerates a missing `modified_by`/`user`, and every field inside a
+present `user` is itself nullable (a sentinel `""`/`"null"` id becomes `null`).
 
 > **Migrating from `verifyInstallWebhook` / `parseInstallEvent`?**
 > `verifyInstallWebhook(token, secret)` still works but is `@deprecated` — it

package/llms.txt

@@ -169,10 +169,11 @@ stay internal.
   418/429 with no GraphQL `errors` — e.g. 401/404/5xx; carries `.statusCode`,
   `.url`, and raw `.body`; surfaced before JSON parsing so non-JSON error pages
   keep their status), `PiiAccessDisabledError` (a payment/booking-modification op
-  was called without `fullCustomerAccess`), `InvalidPeekTokenError` (a
-  signature-valid `app_registry_v2` token whose `user` block has no `id`;
-  carries `.field`), and the REST-sibling `CngApiError` / `AcmeApiError` — all
-  importable; branch with `instanceof`.
+  was called without `fullCustomerAccess`), and the REST-sibling `CngApiError` /
+  `AcmeApiError` — all importable; branch with `instanceof`. Token claim
+  extraction never throws once the signature verifies: a missing `user` block
+  gives `user: null`, and each user field (including `id`, the person's own id —
+  not an account/partner id) is nullable, with `""`/`"null"` normalized to `null`.
 - Plain `Error` for validation/precondition failures thrown before any request.
 
 ## Webhooks (booking + waiver + install)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peektravel/app-utilities",
-  "version": "0.7.2",
+  "version": "0.7.3",
   "description": "GraphQL JS mapping utilities extracted from the Peek Pro Autopilot connector.",
   "license": "MIT",
   "repository": {