@peektravel/app-utilities 0.8.0 → 0.8.2

package/dist/index.d.cts

@@ -896,6 +896,14 @@ interface CreateBookingInput {
      * invalid checkbox value fails creation before any quote is made.
      */
     customQuestionAnswers?: CustomQuestionAnswerInput[];
+    /**
+     * When `true`, creation fails if any of the activity's required custom
+     * questions (per-guest questions excluded) is left unanswered. Because this
+     * enforces coverage against the activity's questions, it forces custom-question
+     * validation to run even when `customQuestionAnswers` is empty or omitted.
+     * Default: `false`.
+     */
+    requireRequiredQuestions?: boolean;
     /** Suppress the customer confirmation email. Default: false. */
     skipCustomerEmail?: boolean;
     /** Clone the quote from an existing order. */
@@ -1268,8 +1276,9 @@ declare class BookingService {
      *
      * @throws {Error} when `activityId`, `availabilityTimeId`, a ticket
      * `resourceOptionId`/positive `quantity`, or the guest `name` is missing; when
-     * `markAsPaid` is set without an `idempotencyKey`; or when the quote/order
-     * mutations fail.
+     * `markAsPaid` is set without an `idempotencyKey`; when
+     * `requireRequiredQuestions` is set and a required custom question is left
+     * unanswered; or when the quote/order mutations fail.
      */
     create(input: CreateBookingInput): Promise<CreatedBooking>;
     /**
@@ -2291,6 +2300,7 @@ declare class RestClient$1 {
      *
      * @throws {AdminAccountRequiredError} on HTTP 418
      * @throws {RateLimitError} on HTTP 429 after retries are exhausted
+     * @throws {CngPermissionError} on HTTP 403 (app missing a permission)
      * @throws {CngApiError} on any other non-2xx response
      */
     get<T>(path: string): Promise<T>;
@@ -2312,23 +2322,30 @@ declare class RestClient$1 {
  *
  * `CngAccessService.getAllActivities()` returns these as a flat list.
  *
- * NOTE: field mapping is a best-guess placeholder until the real
- * `commerce-config/products` response shape is confirmed — see
- * `internal/cng/products/product-queries.ts`.
+ * Mapped from the `app-registry/products` REST payload — see
+ * `internal/cng/products/product-queries.ts`. That payload carries no
+ * product-type discriminator and no sub-options, so `type` is always
+ * {@link ACTIVITY_PRODUCT_TYPE} and `tickets` is always empty.
  */
 interface Activity {
     /** Stable unique identifier for the activity. */
     productId: string;
     /** Human-readable display name. */
     name: string;
-    /** Product type reported by CNG (e.g. `"ACTIVITY"`). */
+    /**
+     * Product type. Always {@link ACTIVITY_PRODUCT_TYPE} — the CNG products
+     * payload has no type discriminator. Kept for parity with the Peek `Product`.
+     */
     type: string;
     /**
-     * Display color as a hex string (e.g. `"#1A2B3C"`). Empty string when no
-     * color is set.
+     * Display color as a hex string (e.g. `"#1A2B3C"`), from the product's
+     * access-control color. Empty string when no color is set.
      */
     color: string;
-    /** The bookable sub-options (tickets) of this activity. */
+    /**
+     * The bookable sub-options (tickets) of this activity. Always empty — CNG
+     * exposes no tickets on the products endpoint today.
+     */
     tickets: ActivityTicket[];
 }
 /** A single bookable sub-option (ticket) of an {@link Activity}. */
@@ -2855,15 +2872,6 @@ declare function parseInstallWebhook(token: string, body: unknown, secret: strin
  */
 declare function verifyInstallWebhook(token: string, secret: string): InstallWebhookClaims;
 
-/**
- * Typed errors thrown by the package. Each mirrors a failure mode of the Peek
- * GraphQL gateway (or the CNG REST gateway) so callers can branch on the error
- * type rather than parsing messages.
- *
- * `AdminAccountRequiredError` and `RateLimitError` are shared by all gateways.
- * `PeekGraphQLError` is Peek-only; `CngApiError` is CNG-only; `AcmeApiError` is
- * ACME-only.
- */
 /**
  * Thrown when the gateway responds with HTTP 418, indicating the install is not
  * permitted to perform the request because an admin account is required.
@@ -2938,6 +2946,32 @@ declare class CngApiError extends Error {
     readonly body: unknown;
     constructor(statusCode: number, body: unknown, message?: string);
 }
+/**
+ * Thrown when the CNG REST gateway responds with HTTP 403 because the app lacks
+ * a permission the endpoint requires (e.g. `products:read`). This is an
+ * **expected** failure for a misconfigured install — not a bug — so the
+ * transport logs it at `warn` rather than `error` and leaves presentation to the
+ * caller, which can branch on the type and surface the missing permission
+ * however its UI prefers.
+ *
+ * The permission names the gateway named are on
+ * {@link CngPermissionError.permissions} (empty when the body does not name
+ * any), so a caller can render them without re-parsing the raw body. Thrown in
+ * place of {@link CngApiError} for 403s only; every other non-2xx status still
+ * throws `CngApiError`.
+ */
+declare class CngPermissionError extends Error {
+    /** The HTTP status that triggered this error. */
+    readonly statusCode = 403;
+    /**
+     * The permissions the gateway reported as missing, e.g. `["products:read"]`.
+     * Empty when the response body did not name any.
+     */
+    readonly permissions: string[];
+    /** The raw response body (parsed JSON when possible, otherwise text). */
+    readonly body: unknown;
+    constructor(permissions: string[], body: unknown, message?: string);
+}
 /**
  * Thrown when the ACME REST gateway returns a non-2xx response that is not one
  * of the specifically-handled statuses (418/429). The offending status is
@@ -2953,4 +2987,4 @@ declare class AcmeApiError extends Error {
     constructor(statusCode: number, body: unknown, message?: string);
 }
 
-export { ACTIVITY_PRODUCT_TYPE, ADD_ON_PRODUCT_TYPE, type AccessOptions, type AccountUser, AccountUserService, type AccountUserServiceOptions, AcmeAccessService, type AcmeAccessServiceConfig, type AcmeActivity, type AcmeActivityTicket, AcmeApiError, AcmeProductService, type Activity, type ActivityOverrides, type ActivityTicket, type AddAddonInput, AdminAccountRequiredError, type Agent, type AssignGuideResult, type AssignedActivity, type AssignedResource, type Availability, AvailabilityService, type AvailabilityTime, type AvailabilityTimesQuery, type Booking, type BookingAddon, type BookingAddonMoney, type BookingAddonOption, type BookingAddons, type BookingAddonsMutationResult, type BookingPaymentsOnFile, type BookingReadOptions, type BookingSearchBy, BookingService, type BookingServiceOptions, type BookingTimeRangeSearch, type CancelBookingResult, type Channel, type ClearOverridesInput, CngAccessService, type CngAccessServiceConfig, CngApiError, CngProductService, type CreateBookingGuest, type CreateBookingInput, type CreateBookingTicket, type CreateEngineInput, type CreatePromoCodeInput, type CreatedBooking, type CreatedPricingEngine, type CreatedPromoCode, type CustomQuestion, type CustomQuestionAnswer, type CustomQuestionAnswerInput, type CustomQuestionOption, type DailyNote, DailyNoteService, type Duration, type Guest, type GuestMetadata, type Guide, type GuideAssignment, INSTALL_STATUSES, type InstallAccessConfig, type InstallAccessService, type InstallAccessTarget, type InstallStatus, type InstallWebhook, type InstallWebhookAccount, type InstallWebhookClaims, type InvoiceLinkResult, type Logger, type MakePaymentInput, type MakePaymentResult, type Membership, type MembershipPurchaseInput, MembershipService, type NoteMode, type Payment, type PaymentSource, PeekAccessService, type PeekAccessServiceConfig, type PeekAuthTokenClaims, type PeekAuthTokenUser, PeekGraphQLError, PeekHttpError, type PeekPlatform, PiiAccessDisabledError, type Price, type PricingActivityContext, type PricingEngine, type PricingMoney, type PricingNamedRef, type PricingOverride, type PricingOverrideFilter, PricingService, type Product, type ProductMeetingLocation, ProductService, type ProductServiceOptions, type ProductTicket, type PromoCode, type PromoCodeFixedAmount, PromoCodeService, type PromoCodeServiceOptions, type PurchasedMembership, RENTAL_PRODUCT_TYPE, RateLimitError, type RefundInput, type RefundResult, ResellerService, type ResolvedOverride, type ResolvedPricingOverride, type ResolvedResourceOption, type Resource, type ResourceOptionOverride, type ResourceOptionQuantity, type ResourcePool, type ResourcePoolAccountUser, type ResourcePoolAssignment, type ResourcePoolMode, ResourcePoolService, type Review, ReviewService, type Ticket, type Timeslot, type TimeslotFilter, TimeslotService, type UpdateEngineInput, type UpdateTimeslotResult, type UpsertOverridesInput, type UpsertOverridesResult, type Waiver, createAccessServiceForInstall, noopLogger, parseBookingWebhook, parseInstallWebhook, parseWaiverWebhook, verifyInstallWebhook };
+export { ACTIVITY_PRODUCT_TYPE, ADD_ON_PRODUCT_TYPE, type AccessOptions, type AccountUser, AccountUserService, type AccountUserServiceOptions, AcmeAccessService, type AcmeAccessServiceConfig, type AcmeActivity, type AcmeActivityTicket, AcmeApiError, AcmeProductService, type Activity, type ActivityOverrides, type ActivityTicket, type AddAddonInput, AdminAccountRequiredError, type Agent, type AssignGuideResult, type AssignedActivity, type AssignedResource, type Availability, AvailabilityService, type AvailabilityTime, type AvailabilityTimesQuery, type Booking, type BookingAddon, type BookingAddonMoney, type BookingAddonOption, type BookingAddons, type BookingAddonsMutationResult, type BookingPaymentsOnFile, type BookingReadOptions, type BookingSearchBy, BookingService, type BookingServiceOptions, type BookingTimeRangeSearch, type CancelBookingResult, type Channel, type ClearOverridesInput, CngAccessService, type CngAccessServiceConfig, CngApiError, CngPermissionError, CngProductService, type CreateBookingGuest, type CreateBookingInput, type CreateBookingTicket, type CreateEngineInput, type CreatePromoCodeInput, type CreatedBooking, type CreatedPricingEngine, type CreatedPromoCode, type CustomQuestion, type CustomQuestionAnswer, type CustomQuestionAnswerInput, type CustomQuestionOption, type DailyNote, DailyNoteService, type Duration, type Guest, type GuestMetadata, type Guide, type GuideAssignment, INSTALL_STATUSES, type InstallAccessConfig, type InstallAccessService, type InstallAccessTarget, type InstallStatus, type InstallWebhook, type InstallWebhookAccount, type InstallWebhookClaims, type InvoiceLinkResult, type Logger, type MakePaymentInput, type MakePaymentResult, type Membership, type MembershipPurchaseInput, MembershipService, type NoteMode, type Payment, type PaymentSource, PeekAccessService, type PeekAccessServiceConfig, type PeekAuthTokenClaims, type PeekAuthTokenUser, PeekGraphQLError, PeekHttpError, type PeekPlatform, PiiAccessDisabledError, type Price, type PricingActivityContext, type PricingEngine, type PricingMoney, type PricingNamedRef, type PricingOverride, type PricingOverrideFilter, PricingService, type Product, type ProductMeetingLocation, ProductService, type ProductServiceOptions, type ProductTicket, type PromoCode, type PromoCodeFixedAmount, PromoCodeService, type PromoCodeServiceOptions, type PurchasedMembership, RENTAL_PRODUCT_TYPE, RateLimitError, type RefundInput, type RefundResult, ResellerService, type ResolvedOverride, type ResolvedPricingOverride, type ResolvedResourceOption, type Resource, type ResourceOptionOverride, type ResourceOptionQuantity, type ResourcePool, type ResourcePoolAccountUser, type ResourcePoolAssignment, type ResourcePoolMode, ResourcePoolService, type Review, ReviewService, type Ticket, type Timeslot, type TimeslotFilter, TimeslotService, type UpdateEngineInput, type UpdateTimeslotResult, type UpsertOverridesInput, type UpsertOverridesResult, type Waiver, createAccessServiceForInstall, noopLogger, parseBookingWebhook, parseInstallWebhook, parseWaiverWebhook, verifyInstallWebhook };

package/dist/index.d.ts

@@ -896,6 +896,14 @@ interface CreateBookingInput {
      * invalid checkbox value fails creation before any quote is made.
      */
     customQuestionAnswers?: CustomQuestionAnswerInput[];
+    /**
+     * When `true`, creation fails if any of the activity's required custom
+     * questions (per-guest questions excluded) is left unanswered. Because this
+     * enforces coverage against the activity's questions, it forces custom-question
+     * validation to run even when `customQuestionAnswers` is empty or omitted.
+     * Default: `false`.
+     */
+    requireRequiredQuestions?: boolean;
     /** Suppress the customer confirmation email. Default: false. */
     skipCustomerEmail?: boolean;
     /** Clone the quote from an existing order. */
@@ -1268,8 +1276,9 @@ declare class BookingService {
      *
      * @throws {Error} when `activityId`, `availabilityTimeId`, a ticket
      * `resourceOptionId`/positive `quantity`, or the guest `name` is missing; when
-     * `markAsPaid` is set without an `idempotencyKey`; or when the quote/order
-     * mutations fail.
+     * `markAsPaid` is set without an `idempotencyKey`; when
+     * `requireRequiredQuestions` is set and a required custom question is left
+     * unanswered; or when the quote/order mutations fail.
      */
     create(input: CreateBookingInput): Promise<CreatedBooking>;
     /**
@@ -2291,6 +2300,7 @@ declare class RestClient$1 {
      *
      * @throws {AdminAccountRequiredError} on HTTP 418
      * @throws {RateLimitError} on HTTP 429 after retries are exhausted
+     * @throws {CngPermissionError} on HTTP 403 (app missing a permission)
      * @throws {CngApiError} on any other non-2xx response
      */
     get<T>(path: string): Promise<T>;
@@ -2312,23 +2322,30 @@ declare class RestClient$1 {
  *
  * `CngAccessService.getAllActivities()` returns these as a flat list.
  *
- * NOTE: field mapping is a best-guess placeholder until the real
- * `commerce-config/products` response shape is confirmed — see
- * `internal/cng/products/product-queries.ts`.
+ * Mapped from the `app-registry/products` REST payload — see
+ * `internal/cng/products/product-queries.ts`. That payload carries no
+ * product-type discriminator and no sub-options, so `type` is always
+ * {@link ACTIVITY_PRODUCT_TYPE} and `tickets` is always empty.
  */
 interface Activity {
     /** Stable unique identifier for the activity. */
     productId: string;
     /** Human-readable display name. */
     name: string;
-    /** Product type reported by CNG (e.g. `"ACTIVITY"`). */
+    /**
+     * Product type. Always {@link ACTIVITY_PRODUCT_TYPE} — the CNG products
+     * payload has no type discriminator. Kept for parity with the Peek `Product`.
+     */
     type: string;
     /**
-     * Display color as a hex string (e.g. `"#1A2B3C"`). Empty string when no
-     * color is set.
+     * Display color as a hex string (e.g. `"#1A2B3C"`), from the product's
+     * access-control color. Empty string when no color is set.
      */
     color: string;
-    /** The bookable sub-options (tickets) of this activity. */
+    /**
+     * The bookable sub-options (tickets) of this activity. Always empty — CNG
+     * exposes no tickets on the products endpoint today.
+     */
     tickets: ActivityTicket[];
 }
 /** A single bookable sub-option (ticket) of an {@link Activity}. */
@@ -2855,15 +2872,6 @@ declare function parseInstallWebhook(token: string, body: unknown, secret: strin
  */
 declare function verifyInstallWebhook(token: string, secret: string): InstallWebhookClaims;
 
-/**
- * Typed errors thrown by the package. Each mirrors a failure mode of the Peek
- * GraphQL gateway (or the CNG REST gateway) so callers can branch on the error
- * type rather than parsing messages.
- *
- * `AdminAccountRequiredError` and `RateLimitError` are shared by all gateways.
- * `PeekGraphQLError` is Peek-only; `CngApiError` is CNG-only; `AcmeApiError` is
- * ACME-only.
- */
 /**
  * Thrown when the gateway responds with HTTP 418, indicating the install is not
  * permitted to perform the request because an admin account is required.
@@ -2938,6 +2946,32 @@ declare class CngApiError extends Error {
     readonly body: unknown;
     constructor(statusCode: number, body: unknown, message?: string);
 }
+/**
+ * Thrown when the CNG REST gateway responds with HTTP 403 because the app lacks
+ * a permission the endpoint requires (e.g. `products:read`). This is an
+ * **expected** failure for a misconfigured install — not a bug — so the
+ * transport logs it at `warn` rather than `error` and leaves presentation to the
+ * caller, which can branch on the type and surface the missing permission
+ * however its UI prefers.
+ *
+ * The permission names the gateway named are on
+ * {@link CngPermissionError.permissions} (empty when the body does not name
+ * any), so a caller can render them without re-parsing the raw body. Thrown in
+ * place of {@link CngApiError} for 403s only; every other non-2xx status still
+ * throws `CngApiError`.
+ */
+declare class CngPermissionError extends Error {
+    /** The HTTP status that triggered this error. */
+    readonly statusCode = 403;
+    /**
+     * The permissions the gateway reported as missing, e.g. `["products:read"]`.
+     * Empty when the response body did not name any.
+     */
+    readonly permissions: string[];
+    /** The raw response body (parsed JSON when possible, otherwise text). */
+    readonly body: unknown;
+    constructor(permissions: string[], body: unknown, message?: string);
+}
 /**
  * Thrown when the ACME REST gateway returns a non-2xx response that is not one
  * of the specifically-handled statuses (418/429). The offending status is
@@ -2953,4 +2987,4 @@ declare class AcmeApiError extends Error {
     constructor(statusCode: number, body: unknown, message?: string);
 }
 
-export { ACTIVITY_PRODUCT_TYPE, ADD_ON_PRODUCT_TYPE, type AccessOptions, type AccountUser, AccountUserService, type AccountUserServiceOptions, AcmeAccessService, type AcmeAccessServiceConfig, type AcmeActivity, type AcmeActivityTicket, AcmeApiError, AcmeProductService, type Activity, type ActivityOverrides, type ActivityTicket, type AddAddonInput, AdminAccountRequiredError, type Agent, type AssignGuideResult, type AssignedActivity, type AssignedResource, type Availability, AvailabilityService, type AvailabilityTime, type AvailabilityTimesQuery, type Booking, type BookingAddon, type BookingAddonMoney, type BookingAddonOption, type BookingAddons, type BookingAddonsMutationResult, type BookingPaymentsOnFile, type BookingReadOptions, type BookingSearchBy, BookingService, type BookingServiceOptions, type BookingTimeRangeSearch, type CancelBookingResult, type Channel, type ClearOverridesInput, CngAccessService, type CngAccessServiceConfig, CngApiError, CngProductService, type CreateBookingGuest, type CreateBookingInput, type CreateBookingTicket, type CreateEngineInput, type CreatePromoCodeInput, type CreatedBooking, type CreatedPricingEngine, type CreatedPromoCode, type CustomQuestion, type CustomQuestionAnswer, type CustomQuestionAnswerInput, type CustomQuestionOption, type DailyNote, DailyNoteService, type Duration, type Guest, type GuestMetadata, type Guide, type GuideAssignment, INSTALL_STATUSES, type InstallAccessConfig, type InstallAccessService, type InstallAccessTarget, type InstallStatus, type InstallWebhook, type InstallWebhookAccount, type InstallWebhookClaims, type InvoiceLinkResult, type Logger, type MakePaymentInput, type MakePaymentResult, type Membership, type MembershipPurchaseInput, MembershipService, type NoteMode, type Payment, type PaymentSource, PeekAccessService, type PeekAccessServiceConfig, type PeekAuthTokenClaims, type PeekAuthTokenUser, PeekGraphQLError, PeekHttpError, type PeekPlatform, PiiAccessDisabledError, type Price, type PricingActivityContext, type PricingEngine, type PricingMoney, type PricingNamedRef, type PricingOverride, type PricingOverrideFilter, PricingService, type Product, type ProductMeetingLocation, ProductService, type ProductServiceOptions, type ProductTicket, type PromoCode, type PromoCodeFixedAmount, PromoCodeService, type PromoCodeServiceOptions, type PurchasedMembership, RENTAL_PRODUCT_TYPE, RateLimitError, type RefundInput, type RefundResult, ResellerService, type ResolvedOverride, type ResolvedPricingOverride, type ResolvedResourceOption, type Resource, type ResourceOptionOverride, type ResourceOptionQuantity, type ResourcePool, type ResourcePoolAccountUser, type ResourcePoolAssignment, type ResourcePoolMode, ResourcePoolService, type Review, ReviewService, type Ticket, type Timeslot, type TimeslotFilter, TimeslotService, type UpdateEngineInput, type UpdateTimeslotResult, type UpsertOverridesInput, type UpsertOverridesResult, type Waiver, createAccessServiceForInstall, noopLogger, parseBookingWebhook, parseInstallWebhook, parseWaiverWebhook, verifyInstallWebhook };
+export { ACTIVITY_PRODUCT_TYPE, ADD_ON_PRODUCT_TYPE, type AccessOptions, type AccountUser, AccountUserService, type AccountUserServiceOptions, AcmeAccessService, type AcmeAccessServiceConfig, type AcmeActivity, type AcmeActivityTicket, AcmeApiError, AcmeProductService, type Activity, type ActivityOverrides, type ActivityTicket, type AddAddonInput, AdminAccountRequiredError, type Agent, type AssignGuideResult, type AssignedActivity, type AssignedResource, type Availability, AvailabilityService, type AvailabilityTime, type AvailabilityTimesQuery, type Booking, type BookingAddon, type BookingAddonMoney, type BookingAddonOption, type BookingAddons, type BookingAddonsMutationResult, type BookingPaymentsOnFile, type BookingReadOptions, type BookingSearchBy, BookingService, type BookingServiceOptions, type BookingTimeRangeSearch, type CancelBookingResult, type Channel, type ClearOverridesInput, CngAccessService, type CngAccessServiceConfig, CngApiError, CngPermissionError, CngProductService, type CreateBookingGuest, type CreateBookingInput, type CreateBookingTicket, type CreateEngineInput, type CreatePromoCodeInput, type CreatedBooking, type CreatedPricingEngine, type CreatedPromoCode, type CustomQuestion, type CustomQuestionAnswer, type CustomQuestionAnswerInput, type CustomQuestionOption, type DailyNote, DailyNoteService, type Duration, type Guest, type GuestMetadata, type Guide, type GuideAssignment, INSTALL_STATUSES, type InstallAccessConfig, type InstallAccessService, type InstallAccessTarget, type InstallStatus, type InstallWebhook, type InstallWebhookAccount, type InstallWebhookClaims, type InvoiceLinkResult, type Logger, type MakePaymentInput, type MakePaymentResult, type Membership, type MembershipPurchaseInput, MembershipService, type NoteMode, type Payment, type PaymentSource, PeekAccessService, type PeekAccessServiceConfig, type PeekAuthTokenClaims, type PeekAuthTokenUser, PeekGraphQLError, PeekHttpError, type PeekPlatform, PiiAccessDisabledError, type Price, type PricingActivityContext, type PricingEngine, type PricingMoney, type PricingNamedRef, type PricingOverride, type PricingOverrideFilter, PricingService, type Product, type ProductMeetingLocation, ProductService, type ProductServiceOptions, type ProductTicket, type PromoCode, type PromoCodeFixedAmount, PromoCodeService, type PromoCodeServiceOptions, type PurchasedMembership, RENTAL_PRODUCT_TYPE, RateLimitError, type RefundInput, type RefundResult, ResellerService, type ResolvedOverride, type ResolvedPricingOverride, type ResolvedResourceOption, type Resource, type ResourceOptionOverride, type ResourceOptionQuantity, type ResourcePool, type ResourcePoolAccountUser, type ResourcePoolAssignment, type ResourcePoolMode, ResourcePoolService, type Review, ReviewService, type Ticket, type Timeslot, type TimeslotFilter, TimeslotService, type UpdateEngineInput, type UpdateTimeslotResult, type UpsertOverridesInput, type UpsertOverridesResult, type Waiver, createAccessServiceForInstall, noopLogger, parseBookingWebhook, parseInstallWebhook, parseWaiverWebhook, verifyInstallWebhook };

package/dist/index.js

@@ -185,6 +185,13 @@ function resolveAccessOptions(options) {
 }
 
 // src/errors.ts
+var FORBIDDEN_STATUS = 403;
+var PERMISSION_MESSAGE_PREFIX = "CNG request forbidden: the app is missing the required permission";
+var PERMISSION_MESSAGE_UNKNOWN = "CNG request forbidden: the app is missing a required permission";
+function buildPermissionMessage(permissions) {
+  if (permissions.length === 0) return PERMISSION_MESSAGE_UNKNOWN;
+  return `${PERMISSION_MESSAGE_PREFIX}${permissions.length > 1 ? "s" : ""}: ${permissions.join(", ")}`;
+}
 var AdminAccountRequiredError = class extends Error {
   /** The HTTP status that triggered this error. */
   statusCode = 418;
@@ -248,6 +255,23 @@ var CngApiError = class extends Error {
     this.body = body;
   }
 };
+var CngPermissionError = class extends Error {
+  /** The HTTP status that triggered this error. */
+  statusCode = FORBIDDEN_STATUS;
+  /**
+   * The permissions the gateway reported as missing, e.g. `["products:read"]`.
+   * Empty when the response body did not name any.
+   */
+  permissions;
+  /** The raw response body (parsed JSON when possible, otherwise text). */
+  body;
+  constructor(permissions, body, message) {
+    super(message ?? buildPermissionMessage(permissions));
+    this.name = "CngPermissionError";
+    this.permissions = permissions;
+    this.body = body;
+  }
+};
 var AcmeApiError = class extends Error {
   /** The HTTP status that triggered this error. */
   statusCode;
@@ -1059,6 +1083,7 @@ var errInvalidCheckbox = (v, id) => `Checkbox answer for question "${id}" must b
 var errUnknownOptionId = (v, id) => `No option matches id "${v}" for question "${id}"`;
 var errNoOptionMatch = (v, id) => `No option matches "${v}" for question "${id}"`;
 var errAmbiguousOption = (v, id) => `Option "${v}" matches more than one option for question "${id}"`;
+var errMissingRequired = (text, id) => `Custom question "${text}" (${id}) is required but was not answered`;
 function normalize(value) {
   return value.toLowerCase().replace(/[^a-z0-9]/g, "");
 }
@@ -1123,8 +1148,20 @@ function resolveOne(answer, questions) {
       throw new Error(errUnsupportedType(question.questionType, question.id));
   }
 }
-function resolveCustomQuestionAnswers(answers, questions) {
-  return answers.map((answer) => resolveOne(answer, questions));
+function resolveCustomQuestionAnswers(answers, questions, options) {
+  const resolved = answers.map((answer) => resolveOne(answer, questions));
+  if (options?.requireRequired) {
+    assertRequiredAnswered(resolved, questions);
+  }
+  return resolved;
+}
+function assertRequiredAnswered(resolved, questions) {
+  const answered = new Set(resolved.map((answer) => answer.questionId));
+  for (const question of questions) {
+    if (question.isRequired && !question.perGuest && !answered.has(question.id)) {
+      throw new Error(errMissingRequired(question.questionText, question.id));
+    }
+  }
 }
 
 // src/internal/peek/bookings/booking-service.ts
@@ -1641,8 +1678,9 @@ ${note}`;
    *
    * @throws {Error} when `activityId`, `availabilityTimeId`, a ticket
    * `resourceOptionId`/positive `quantity`, or the guest `name` is missing; when
-   * `markAsPaid` is set without an `idempotencyKey`; or when the quote/order
-   * mutations fail.
+   * `markAsPaid` is set without an `idempotencyKey`; when
+   * `requireRequiredQuestions` is set and a required custom question is left
+   * unanswered; or when the quote/order mutations fail.
    */
   async create(input) {
     validateCreateInput(input);
@@ -1722,15 +1760,22 @@ ${note}`;
    * against; throws on the first unmatched/ambiguous/invalid answer.
    */
   async buildQuestionAnswers(input) {
-    const answers = input.customQuestionAnswers;
-    if (!answers || answers.length === 0) {
+    const answers = input.customQuestionAnswers ?? [];
+    const requireRequired = input.requireRequiredQuestions ?? false;
+    if (answers.length === 0 && !requireRequired) {
       return null;
     }
     const questions = await this.deps.productService.getCustomQuestions(
       input.activityId
     );
-    return resolveCustomQuestionAnswers(answers, questions).map((resolved) => ({
-      ...resolved,
+    const resolved = resolveCustomQuestionAnswers(answers, questions, {
+      requireRequired
+    });
+    if (resolved.length === 0) {
+      return null;
+    }
+    return resolved.map((answer) => ({
+      ...answer,
       refid: randomUUID()
     }));
   }
@@ -4113,7 +4158,7 @@ var PeekAccessService = class {
 
 // src/internal/cng/endpoints.ts
 var CNG_EXTENDABLE_SLUG = "cng_backoffice_api-v1";
-var PRODUCTS_PATH = "api/v2/commerce-config/products";
+var PRODUCTS_PATH = "api/v2/app-registry/products?active=1";
 
 // src/models/cng/product.ts
 var ACTIVITY_PRODUCT_TYPE2 = "ACTIVITY";
@@ -4124,14 +4169,11 @@ function fromProductNodes(nodes) {
 }
 function fromProductNode(node) {
   return {
-    productId: node.id || "",
+    productId: node.id == null ? "" : String(node.id),
     name: node.name || "",
-    type: node.product_type || ACTIVITY_PRODUCT_TYPE2,
-    color: node.color_hex || "",
-    tickets: (node.tickets ?? []).map((ticket) => ({
-      id: ticket.id,
-      name: ticket.name
-    }))
+    type: ACTIVITY_PRODUCT_TYPE2,
+    color: node.access_control_color_hex || "",
+    tickets: []
   };
 }
 
@@ -4150,15 +4192,13 @@ var CngProductService = class {
    * ```
    */
   async getAllActivities() {
-    const body = await this.client.get(
-      PRODUCTS_PATH
-    );
-    const nodes = Array.isArray(body) ? body : body?.products ?? [];
-    return fromProductNodes(nodes ?? []);
+    const body = await this.client.get(PRODUCTS_PATH);
+    return fromProductNodes(body?.data ?? []);
   }
 };
 
 // src/internal/cng/rest-client.ts
+var PERMISSION_SEPARATOR = ": ";
 var RestClient = class {
   constructor(options) {
     this.options = options;
@@ -4171,6 +4211,7 @@ var RestClient = class {
    *
    * @throws {AdminAccountRequiredError} on HTTP 418
    * @throws {RateLimitError} on HTTP 429 after retries are exhausted
+   * @throws {CngPermissionError} on HTTP 403 (app missing a permission)
    * @throws {CngApiError} on any other non-2xx response
    */
   async get(path) {
@@ -4184,6 +4225,11 @@ var RestClient = class {
       path,
       async (response) => {
         const body = await parseBody(response);
+        if (response.status === FORBIDDEN_STATUS) {
+          const permissions = extractMissingPermissions(body);
+          logger.warn(`Missing permission for ${path} (HTTP 403)`, { url, permissions });
+          throw new CngPermissionError(permissions, body);
+        }
         if (!response.ok) {
           logger.error(`CNG request failed with HTTP ${response.status}`, { url });
           throw new CngApiError(response.status, body);
@@ -4204,6 +4250,12 @@ var RestClient = class {
     };
   }
 };
+function extractMissingPermissions(body) {
+  if (typeof body !== "object" || body === null) return [];
+  const raw = body.errors?.permission;
+  if (!Array.isArray(raw)) return [];
+  return raw.filter((entry) => typeof entry === "string").map((entry) => entry.split(PERMISSION_SEPARATOR).pop().trim()).filter((permission) => permission.length > 0);
+}
 
 // src/cng-access-service.ts
 var DEFAULT_BASE_URL2 = "https://app-registry.peeklabs.com/installations-api";
@@ -4548,6 +4600,6 @@ function verifyInstallWebhook(token, secret) {
   };
 }
 
-export { ACTIVITY_PRODUCT_TYPE, ADD_ON_PRODUCT_TYPE, AccountUserService, AcmeAccessService, AcmeApiError, AcmeProductService, AdminAccountRequiredError, AvailabilityService, BookingService, CngAccessService, CngApiError, CngProductService, DailyNoteService, INSTALL_STATUSES, MembershipService, PeekAccessService, PeekGraphQLError, PeekHttpError, PiiAccessDisabledError, PricingService, ProductService, PromoCodeService, RENTAL_PRODUCT_TYPE, RateLimitError, ResellerService, ResourcePoolService, ReviewService, TimeslotService, createAccessServiceForInstall, noopLogger, parseBookingWebhook, parseInstallWebhook, parseWaiverWebhook, verifyInstallWebhook };
+export { ACTIVITY_PRODUCT_TYPE, ADD_ON_PRODUCT_TYPE, AccountUserService, AcmeAccessService, AcmeApiError, AcmeProductService, AdminAccountRequiredError, AvailabilityService, BookingService, CngAccessService, CngApiError, CngPermissionError, CngProductService, DailyNoteService, INSTALL_STATUSES, MembershipService, PeekAccessService, PeekGraphQLError, PeekHttpError, PiiAccessDisabledError, PricingService, ProductService, PromoCodeService, RENTAL_PRODUCT_TYPE, RateLimitError, ResellerService, ResourcePoolService, ReviewService, TimeslotService, createAccessServiceForInstall, noopLogger, parseBookingWebhook, parseInstallWebhook, parseWaiverWebhook, verifyInstallWebhook };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map