@peektravel/app-utilities 0.9.0 → 0.9.2

package/docs/webhooks.md

@@ -301,14 +301,17 @@ event**, so persist them alongside `installId`/`accountId`:
 - **`timezone`** — the account's IANA zone (e.g. `America/New_York`). Downstream
   date/time handling for the install (scheduling, day boundaries, display) needs
   the account's own zone, not the server's.
-- **`apiUrl`** — the **app endpoint URL** the registry serves this install from.
-  Use it **as given** for this install's API calls: hit it unmodified, do not
-  decompose it or append your own app id. If the registry tags traffic with an
-  app id in the path, that is the registry's concern and opaque to you. Store it
-  and pass it as the access service's **`apiUrl`** (for Peek it is the sole
-  request URL; for CNG/ACME it is the base and the REST path is appended) — or
-  hand the whole install to `createAccessServiceForInstall` (below), which wires
-  it for you.
+- **`apiUrl`** — the **base API URL** the registry serves this install from.
+  Store it and pass it straight through as the access service's **`apiUrl`**: do
+  not decompose it or append your own app id. Each service class appends its own
+  backoffice slug (e.g. `peek_backoffice_api-v1`) when it makes a call, so a Peek
+  GraphQL call POSTs to `<base>/peek_backoffice_api-v1` and a CNG/ACME REST call
+  hits `<base>/<slug>/<path>`. If the URL you pass already carries this platform's
+  slug (dashes or underscores) it is stripped back to the base; a URL carrying a
+  *different* platform's slug makes the constructor throw. If the registry tags
+  traffic with an app id in the path, that is the registry's concern and opaque to
+  you. Or hand the whole install to `createAccessServiceForInstall` (below), which
+  wires it for you.
 
 Both default to `""` when a delivery omits them, so treat empty as "not
 reported" and keep any value you previously stored.

package/llms.txt

@@ -22,7 +22,7 @@ const peek = new PeekAccessService({
   installId,   // JWT subject
   jwtSecret,   // HMAC secret signing the JWT
   issuer,      // app name (JWT issuer)
-  apiUrl,      // the install webhook's apiUrl — the app endpoint, used as given
+  apiUrl,      // the install webhook's apiUrl — the base API URL; each service appends its own backoffice slug
   // optional: gatewayKey, tokenTtlSeconds, tokenRefreshLeewaySeconds,
   // retryDelaysMs, logger, fetch, itemOptionsPageSize,
   // accessOptions: { fullCustomerAccess: false }  // default — see "Access options / PII"
@@ -30,10 +30,15 @@ const peek = new PeekAccessService({
 ```
 
 Targeting an install by URL: pass the install webhook's `apiUrl` as the config
-`apiUrl` — for Peek it is the **sole** request URL (every call POSTs to it,
-unmodified); for CNG/ACME it is the base and the REST path is appended. No
-app-id/gateway segment is inserted (`appId` is unused). Any app id in the path is
-the registry's own traffic tag, opaque to callers. `createAccessServiceForInstall(install, config)`
+`apiUrl`. It is the install's **base API URL**; each service class appends its own
+backoffice slug (e.g. `peek_backoffice_api-v1`, from a small per-platform endpoint
+lookup) when it calls — so a Peek GraphQL call POSTs to `<base>/peek_backoffice_api-v1`
+and a CNG/ACME REST call hits `<base>/<slug>/<path>`. If the URL you pass already
+carries this platform's slug (dashes or underscores interchangeable) it is
+**stripped** back to the base; a URL carrying a *different* platform's slug is
+**rejected** (constructor throws). No app-id/gateway segment is inserted (`appId`
+is unused). Any app id in the path is the registry's own traffic tag, opaque to
+callers. `createAccessServiceForInstall(install, config)`
 builds the right service for `install.platform` (`peek`/`cng`/`acme`) wired to
 `install.apiUrl` in one call (throws on unknown/`null` platform). `appId` +
 `baseUrl` (and the hardcoded gateway default) are **`@deprecated`** — they
@@ -134,15 +139,22 @@ final authority and may still reject the request.
   `makePayment(input)`, `refund(input)`, `createInvoiceLink(id)`,
   `listAddons(id)`, `addAddon(id, {addonOptionId, quantity})`,
   `removeAddon(id, {addonOptionId, quantity})`, `create(input)`
+- `getReviewService()` — `getReviews(productId, reviewCount?, reviewOffset?)`
+  (single newest-first page of `Review`s, count 1–50, offset ≥ 0);
+  `getAllReviewSummaries()` → `ProductReviewSummary[]` (one per activity:
+  `avgRating` — decimal, `null` when no ratings — plus `countTotal` and per-star
+  `countOneStar`…`countFiveStar`). No PII; unaffected by `fullCustomerAccess`.
 
 ## Sibling accessors (CNG, ACME — REST, not GraphQL)
 
 Two brand-parallel accessors sit alongside `PeekAccessService` and share the same
 auth/transport/UI plumbing. Both are **REST** and deliberately minimal today
 (products only). Construct one per install, same config shape **minus `gatewayKey`**
-(`installId`, `jwtSecret`, `issuer`, `apiUrl`). With `apiUrl` set, it is the REST
-base and only the path is appended; the deprecated `baseUrl`/`appId` fall back to
-the app-registry installations API default. `createAccessServiceForInstall` routes
+(`installId`, `jwtSecret`, `issuer`, `apiUrl`). With `apiUrl` set, it is the base
+API URL and the product service appends its backoffice slug (`cng_backoffice_api-v1` /
+`acme_backoffice_api-v1`) and the REST path (`<base>/<slug>/<path>`); the
+deprecated `baseUrl`/`appId` fall back to the app-registry installations API
+default (`<baseUrl>/<appId>` as the base). `createAccessServiceForInstall` routes
 `platform` `"cng"`/`"acme"` to these.
 
 - `CngAccessService` — `getProductService().getAllActivities()` (short-form
@@ -183,6 +195,11 @@ stay internal.
   additionally enforces that every required (non-per-guest) custom question is
   answered — validation runs even when `customQuestionAnswers` is empty/omitted,
   and an unanswered required question fails creation before the quote.
+  `CreateBookingInput.acceptAllCustomQuestionIds?: boolean` (default `false`)
+  relaxes the id check: a `cq_…` id not in the activity's question list is
+  accepted as a plain text answer instead of failing creation (by-name answers
+  still must match). When every answer is by id (and no required check runs) the
+  questions fetch is skipped entirely.
 
 ## Errors
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peektravel/app-utilities",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "description": "GraphQL JS mapping utilities extracted from the Peek Pro Autopilot connector.",
   "license": "MIT",
   "repository": {