@adcp/sdk 14.1.0 → 14.3.0

package/dist/lib/validation/schema-validator.js

@@ -29,6 +29,7 @@ var import_schema_loader = require('./schema-loader.js');
 var import_version = require('../version.js');
 var import_hints = require('./hints.js');
 var import_envelope_status_compat = require('../utils/envelope-status-compat.js');
+var import_diagnostic_limits = require('./diagnostic-limits.js');
 const OK = Object.freeze({ valid: true, issues: [], variant: "skipped" });
 function extractSchemaId(schemaPath, rootSchema, registeredIds) {
   if (schemaPath.startsWith("#") || schemaPath === "") {
@@ -80,6 +81,59 @@ function resolveSchemaPath(rootSchema, schemaPath) {
   }
   return cursor;
 }
+function* expandNotErrors(errors, rootSchema, payload) {
+  for (const error of errors) {
+    const rule = error.keyword === "not" ? resolveSchemaPath(rootSchema, error.schemaPath) : void 0;
+    const branches = rule && typeof rule === "object" ? rule.anyOf : void 0;
+    if (!Array.isArray(branches) || branches.length === 0 || Object.keys(rule).length !== 1) {
+      yield error;
+      continue;
+    }
+    let instance = payload;
+    if (error.instancePath) {
+      for (const encoded of error.instancePath.slice(1).split("/")) {
+        const key = encoded.replace(/~1/g, "/").replace(/~0/g, "~");
+        if (instance == null || typeof instance !== "object" || !Object.hasOwn(instance, key)) {
+          instance = void 0;
+          break;
+        }
+        instance = instance[key];
+      }
+    }
+    const keys = /* @__PURE__ */ new Set();
+    let opaqueBranch = false;
+    if (instance != null && typeof instance === "object" && !Array.isArray(instance)) {
+      for (const branch of branches) {
+        if (branch == null || typeof branch !== "object" || Object.keys(branch).length !== 1 || !Array.isArray(branch.required) || branch.required.length !== 1 || typeof branch.required[0] !== "string") {
+          opaqueBranch = true;
+          continue;
+        }
+        const key = branch.required[0];
+        if (Object.hasOwn(instance, key) && instance[key] !== void 0) keys.add(key);
+      }
+    }
+    if (keys.size === 0) {
+      yield error;
+      continue;
+    }
+    for (const key of keys) {
+      yield {
+        ...error,
+        instancePath: `${error.instancePath}/${key.replace(/~/g, "~0").replace(/\//g, "~1")}`,
+        message: `${key} cannot be set here`
+      };
+    }
+    if (opaqueBranch) yield error;
+  }
+}
+function formatValidationIssues(errors, ctx, payload) {
+  function* formatted() {
+    for (const error of expandNotErrors(compactUnionErrors(errors, ctx.rootSchema), ctx.rootSchema, payload)) {
+      yield enrichWithVariants(formatIssue(error, ctx), ctx.rootSchema);
+    }
+  }
+  return ctx.toolName === "sync_accounts" ? [...formatted()] : (0, import_diagnostic_limits.boundValidationIssues)(formatted());
+}
 function compactUnionErrors(errors, rootSchema) {
   if (errors.length === 0) return [...errors];
   const errorsByOneOfPath = /* @__PURE__ */ new Map();
@@ -249,10 +303,9 @@ function validateRequest(toolName, payload, version) {
   if (valid) return { valid: true, issues: [], variant: "request", ...rootSchemaId && { schemaId: rootSchemaId } };
   const registeredIds = (0, import_schema_loader.getRegisteredSchemaIds)(version);
   const ctx = { rootSchema, registeredIds, toolName };
-  const compacted = compactUnionErrors(validator.errors ?? [], rootSchema);
   return {
     valid: false,
-    issues: compacted.map((e) => formatIssue(e, ctx)).map((i) => enrichWithVariants(i, rootSchema)),
+    issues: formatValidationIssues(validator.errors ?? [], ctx, payload),
     variant: "request",
     ...rootSchemaId && { schemaId: rootSchemaId }
   };
@@ -314,10 +367,9 @@ function validateResponse(toolName, payload, version) {
   }
   const registeredIds = (0, import_schema_loader.getRegisteredSchemaIds)(version);
   const ctx = { rootSchema, registeredIds, toolName };
-  const compacted = compactUnionErrors(effective.errors ?? [], rootSchema);
   return {
     valid: false,
-    issues: compacted.map((e) => formatIssue(e, ctx)).map((i) => enrichWithVariants(i, rootSchema)),
+    issues: formatValidationIssues(effective.errors ?? [], ctx, normalizedPayload),
     variant: usedVariant,
     ...rootSchemaId && { schemaId: rootSchemaId },
     ...fallbackFields

package/dist/lib/validation/schema-validator.mjs

@@ -2,6 +2,7 @@ import { getValidator, getRegisteredSchemaIds } from "./schema-loader.mjs";
 import { parseAdcpMajorVersion } from "../version.mjs";
 import { findHint } from "./hints.mjs";
 import { injectLegacyEnvelopeStatus } from "../utils/envelope-status-compat.mjs";
+import { boundValidationIssues } from "./diagnostic-limits.mjs";
 const OK = Object.freeze({ valid: true, issues: [], variant: "skipped" });
 function extractSchemaId(schemaPath, rootSchema, registeredIds) {
   if (schemaPath.startsWith("#") || schemaPath === "") {
@@ -53,6 +54,59 @@ function resolveSchemaPath(rootSchema, schemaPath) {
   }
   return cursor;
 }
+function* expandNotErrors(errors, rootSchema, payload) {
+  for (const error of errors) {
+    const rule = error.keyword === "not" ? resolveSchemaPath(rootSchema, error.schemaPath) : void 0;
+    const branches = rule && typeof rule === "object" ? rule.anyOf : void 0;
+    if (!Array.isArray(branches) || branches.length === 0 || Object.keys(rule).length !== 1) {
+      yield error;
+      continue;
+    }
+    let instance = payload;
+    if (error.instancePath) {
+      for (const encoded of error.instancePath.slice(1).split("/")) {
+        const key = encoded.replace(/~1/g, "/").replace(/~0/g, "~");
+        if (instance == null || typeof instance !== "object" || !Object.hasOwn(instance, key)) {
+          instance = void 0;
+          break;
+        }
+        instance = instance[key];
+      }
+    }
+    const keys = /* @__PURE__ */ new Set();
+    let opaqueBranch = false;
+    if (instance != null && typeof instance === "object" && !Array.isArray(instance)) {
+      for (const branch of branches) {
+        if (branch == null || typeof branch !== "object" || Object.keys(branch).length !== 1 || !Array.isArray(branch.required) || branch.required.length !== 1 || typeof branch.required[0] !== "string") {
+          opaqueBranch = true;
+          continue;
+        }
+        const key = branch.required[0];
+        if (Object.hasOwn(instance, key) && instance[key] !== void 0) keys.add(key);
+      }
+    }
+    if (keys.size === 0) {
+      yield error;
+      continue;
+    }
+    for (const key of keys) {
+      yield {
+        ...error,
+        instancePath: `${error.instancePath}/${key.replace(/~/g, "~0").replace(/\//g, "~1")}`,
+        message: `${key} cannot be set here`
+      };
+    }
+    if (opaqueBranch) yield error;
+  }
+}
+function formatValidationIssues(errors, ctx, payload) {
+  function* formatted() {
+    for (const error of expandNotErrors(compactUnionErrors(errors, ctx.rootSchema), ctx.rootSchema, payload)) {
+      yield enrichWithVariants(formatIssue(error, ctx), ctx.rootSchema);
+    }
+  }
+  return ctx.toolName === "sync_accounts" ? [...formatted()] : boundValidationIssues(formatted());
+}
 function compactUnionErrors(errors, rootSchema) {
   if (errors.length === 0) return [...errors];
   const errorsByOneOfPath = /* @__PURE__ */ new Map();
@@ -222,10 +276,9 @@ function validateRequest(toolName, payload, version) {
   if (valid) return { valid: true, issues: [], variant: "request", ...rootSchemaId && { schemaId: rootSchemaId } };
   const registeredIds = getRegisteredSchemaIds(version);
   const ctx = { rootSchema, registeredIds, toolName };
-  const compacted = compactUnionErrors(validator.errors ?? [], rootSchema);
   return {
     valid: false,
-    issues: compacted.map((e) => formatIssue(e, ctx)).map((i) => enrichWithVariants(i, rootSchema)),
+    issues: formatValidationIssues(validator.errors ?? [], ctx, payload),
     variant: "request",
     ...rootSchemaId && { schemaId: rootSchemaId }
   };
@@ -287,10 +340,9 @@ function validateResponse(toolName, payload, version) {
   }
   const registeredIds = getRegisteredSchemaIds(version);
   const ctx = { rootSchema, registeredIds, toolName };
-  const compacted = compactUnionErrors(effective.errors ?? [], rootSchema);
   return {
     valid: false,
-    issues: compacted.map((e) => formatIssue(e, ctx)).map((i) => enrichWithVariants(i, rootSchema)),
+    issues: formatValidationIssues(effective.errors ?? [], ctx, normalizedPayload),
     variant: usedVariant,
     ...rootSchemaId && { schemaId: rootSchemaId },
     ...fallbackFields

package/dist/lib/version.d.mts

@@ -1,7 +1,7 @@
 /**
  * AdCP SDK library version
  */
-export declare const LIBRARY_VERSION = "14.1.0";
+export declare const LIBRARY_VERSION = "14.3.0";
 /**
  * AdCP specification version this library is built for
  */
@@ -33,10 +33,10 @@ export type AdcpVersion = (typeof COMPATIBLE_ADCP_VERSIONS)[number];
  * Full version information
  */
 export declare const VERSION_INFO: {
-    readonly library: "14.1.0";
+    readonly library: "14.3.0";
     readonly adcp: "3.2.1";
     readonly compatibleVersions: readonly ["v2.5", "v2.6", "v3", "3.0.0", "3.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.5", "3.0.6", "3.0.7", "3.0.8", "3.0.9", "3.0.10", "3.0.11", "3.0.12", "3.0.13", "3.0.14", "3.0.15", "3.0.16", "3.0.17", "3.0.18", "3.0.19", "3.0.20", "3.0.21", "3.0.22", "3.0.23", "3.0.24", "3.0.25", "3.1.0", "3.1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6", "3.1.7", "3.1.8", "3.1.9", "3.1.10", "3.1.11", "3.1.12", "3.1.13", "3.1.14", "3.1.15", "3.1.16", "3.1.17", "3.1.18", "3.1.19", "3.1.20", "3.1.21", "3.1.22", "3.1.23", "3.1.24", "3.2.1", "3.2"];
-    readonly generatedAt: "2026-10-04T03:18:45.725Z";
+    readonly generatedAt: "2026-10-06T16:34:47.947Z";
 };
 /**
  * Get the AdCP specification version this library is built for

package/dist/lib/version.d.ts

@@ -1,7 +1,7 @@
 /**
  * AdCP SDK library version
  */
-export declare const LIBRARY_VERSION = "14.1.0";
+export declare const LIBRARY_VERSION = "14.3.0";
 /**
  * AdCP specification version this library is built for
  */
@@ -33,10 +33,10 @@ export type AdcpVersion = (typeof COMPATIBLE_ADCP_VERSIONS)[number];
  * Full version information
  */
 export declare const VERSION_INFO: {
-    readonly library: "14.1.0";
+    readonly library: "14.3.0";
     readonly adcp: "3.2.1";
     readonly compatibleVersions: readonly ["v2.5", "v2.6", "v3", "3.0.0", "3.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.5", "3.0.6", "3.0.7", "3.0.8", "3.0.9", "3.0.10", "3.0.11", "3.0.12", "3.0.13", "3.0.14", "3.0.15", "3.0.16", "3.0.17", "3.0.18", "3.0.19", "3.0.20", "3.0.21", "3.0.22", "3.0.23", "3.0.24", "3.0.25", "3.1.0", "3.1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6", "3.1.7", "3.1.8", "3.1.9", "3.1.10", "3.1.11", "3.1.12", "3.1.13", "3.1.14", "3.1.15", "3.1.16", "3.1.17", "3.1.18", "3.1.19", "3.1.20", "3.1.21", "3.1.22", "3.1.23", "3.1.24", "3.2.1", "3.2"];
-    readonly generatedAt: "2026-10-04T03:18:45.725Z";
+    readonly generatedAt: "2026-10-06T16:34:47.947Z";
 };
 /**
  * Get the AdCP specification version this library is built for

package/dist/lib/version.js

@@ -31,7 +31,7 @@ __export(version_exports, {
   toReleasePrecisionVersion: () => toReleasePrecisionVersion
 });
 module.exports = __toCommonJS(version_exports);
-const LIBRARY_VERSION = "14.1.0";
+const LIBRARY_VERSION = "14.3.0";
 const ADCP_VERSION = "3.2.1";
 const ADCP_MAJOR_VERSION = 3;
 const COMPATIBLE_ADCP_VERSIONS = [
@@ -95,10 +95,10 @@ const COMPATIBLE_ADCP_VERSIONS = [
   "3.2"
 ];
 const VERSION_INFO = {
-  library: "14.1.0",
+  library: "14.3.0",
   adcp: "3.2.1",
   compatibleVersions: COMPATIBLE_ADCP_VERSIONS,
-  generatedAt: "2026-10-04T03:18:45.725Z"
+  generatedAt: "2026-10-06T16:34:47.947Z"
 };
 function getAdcpVersion() {
   return ADCP_VERSION;

package/dist/lib/version.mjs

@@ -1,4 +1,4 @@
-const LIBRARY_VERSION = "14.1.0";
+const LIBRARY_VERSION = "14.3.0";
 const ADCP_VERSION = "3.2.1";
 const ADCP_MAJOR_VERSION = 3;
 const COMPATIBLE_ADCP_VERSIONS = [
@@ -62,10 +62,10 @@ const COMPATIBLE_ADCP_VERSIONS = [
   "3.2"
 ];
 const VERSION_INFO = {
-  library: "14.1.0",
+  library: "14.3.0",
   adcp: "3.2.1",
   compatibleVersions: COMPATIBLE_ADCP_VERSIONS,
-  generatedAt: "2026-10-04T03:18:45.725Z"
+  generatedAt: "2026-10-06T16:34:47.947Z"
 };
 function getAdcpVersion() {
   return ADCP_VERSION;

package/dist/lib/webhooks/index.d.mts

@@ -28,6 +28,8 @@ export interface VerifyWebhookRequestOptions {
     timestamp?: WebhookHeaderValue;
     /** Allowed absolute timestamp skew in seconds. Defaults to 300. */
     skewSeconds?: number;
+    /** Alias shared with preflight; takes precedence when both are provided. */
+    maxSkewSeconds?: number;
     /** Current unix time in seconds. Defaults to `Date.now() / 1000`. */
     now?: () => number;
 }
@@ -50,3 +52,25 @@ export type VerifyWebhookRequestResult = {
  * `@adcp/sdk/signing/server`.
  */
 export declare function verifyWebhookRequest(options: VerifyWebhookRequestOptions): VerifyWebhookRequestResult;
+/** Input for a secret-less check of the deprecated HMAC webhook profile. */
+export type PreflightWebhookRequest = Pick<VerifyWebhookRequestOptions, 'headers' | 'signature' | 'timestamp'>;
+export interface PreflightWebhookRequestOptions {
+    /** Current unix time in seconds. */
+    now?: () => number;
+    /** Allowed absolute timestamp skew; defaults to 300 seconds. */
+    maxSkewSeconds?: number;
+    /** Alias shared with verifyWebhookRequest. */
+    skewSeconds?: number;
+}
+export type PreflightWebhookRequestResult = {
+    ok: true;
+    signature: string;
+    timestamp: number;
+    checkedAt: number;
+} | {
+    ok: false;
+    reason: Exclude<VerifyWebhookFailureReason, 'missing_secret' | 'bad_signature'>;
+    message: string;
+};
+/** Validate headers and freshness before looking up a secret. Success does not authenticate the request. */
+export declare function preflightWebhookRequest(request: PreflightWebhookRequest, options?: PreflightWebhookRequestOptions): PreflightWebhookRequestResult;

package/dist/lib/webhooks/index.d.ts

@@ -28,6 +28,8 @@ export interface VerifyWebhookRequestOptions {
     timestamp?: WebhookHeaderValue;
     /** Allowed absolute timestamp skew in seconds. Defaults to 300. */
     skewSeconds?: number;
+    /** Alias shared with preflight; takes precedence when both are provided. */
+    maxSkewSeconds?: number;
     /** Current unix time in seconds. Defaults to `Date.now() / 1000`. */
     now?: () => number;
 }
@@ -50,3 +52,25 @@ export type VerifyWebhookRequestResult = {
  * `@adcp/sdk/signing/server`.
  */
 export declare function verifyWebhookRequest(options: VerifyWebhookRequestOptions): VerifyWebhookRequestResult;
+/** Input for a secret-less check of the deprecated HMAC webhook profile. */
+export type PreflightWebhookRequest = Pick<VerifyWebhookRequestOptions, 'headers' | 'signature' | 'timestamp'>;
+export interface PreflightWebhookRequestOptions {
+    /** Current unix time in seconds. */
+    now?: () => number;
+    /** Allowed absolute timestamp skew; defaults to 300 seconds. */
+    maxSkewSeconds?: number;
+    /** Alias shared with verifyWebhookRequest. */
+    skewSeconds?: number;
+}
+export type PreflightWebhookRequestResult = {
+    ok: true;
+    signature: string;
+    timestamp: number;
+    checkedAt: number;
+} | {
+    ok: false;
+    reason: Exclude<VerifyWebhookFailureReason, 'missing_secret' | 'bad_signature'>;
+    message: string;
+};
+/** Validate headers and freshness before looking up a secret. Success does not authenticate the request. */
+export declare function preflightWebhookRequest(request: PreflightWebhookRequest, options?: PreflightWebhookRequestOptions): PreflightWebhookRequestResult;

package/dist/lib/webhooks/index.js

@@ -22,6 +22,7 @@ __export(webhooks_exports, {
   WholesaleFeedWebhookNotificationError: () => import_webhook_notification.WholesaleFeedWebhookNotificationError,
   normalizeWholesaleFeedWebhookNotification: () => import_webhook_notification.normalizeWholesaleFeedWebhookNotification,
   parseWholesaleFeedWebhookNotification: () => import_webhook_notification.parseWholesaleFeedWebhookNotification,
+  preflightWebhookRequest: () => preflightWebhookRequest,
   verifyWebhookRequest: () => verifyWebhookRequest
 });
 module.exports = __toCommonJS(webhooks_exports);
@@ -29,49 +30,73 @@ var import_crypto = require("crypto");
 __reExport(webhooks_exports, require('../notifications/account-change-recorded.js'), module.exports);
 var import_webhook_notification = require('../wholesale-feed-sync/webhook-notification.js');
 function verifyWebhookRequest(options) {
+  const preflight = preflightWebhookRequest(options, {
+    now: options.now,
+    maxSkewSeconds: options.maxSkewSeconds ?? options.skewSeconds
+  });
+  if (!preflight.ok) return preflight;
   const secret = options.secret ?? options.globalSecret;
   if (!secret) {
     return fail("missing_secret", "A webhook HMAC secret is required.");
   }
-  const signature = resolveHeader("x-adcp-signature", options.signature, options.headers);
-  if (signature.reason) return fail(signature.reason, signature.message);
-  const timestamp = resolveHeader("x-adcp-timestamp", options.timestamp, options.headers);
-  if (timestamp.reason) return fail(timestamp.reason, timestamp.message);
-  if (!signature.value || !timestamp.value) {
-    return fail("missing_headers", "Webhook is missing x-adcp-signature or x-adcp-timestamp.");
-  }
-  const parsedTimestamp = parseTimestamp(timestamp.value);
-  if (parsedTimestamp === void 0) {
-    return fail("invalid_timestamp", "x-adcp-timestamp must be an integer unix timestamp in seconds.");
-  }
-  const now = options.now ? Math.floor(options.now()) : Math.floor(Date.now() / 1e3);
-  const skewSeconds = options.skewSeconds ?? 300;
-  if (!Number.isFinite(skewSeconds) || skewSeconds < 0) {
-    return fail("invalid_timestamp", "skewSeconds must be a non-negative number.");
-  }
-  if (Math.abs(now - parsedTimestamp) > skewSeconds) {
-    return fail("stale_timestamp", `Webhook timestamp is outside the allowed ${skewSeconds}s skew window.`);
-  }
-  if (!/^sha256=[a-f0-9]{64}$/.test(signature.value)) {
-    return fail("malformed_signature", "x-adcp-signature must match sha256=<64 lowercase hex chars>.");
-  }
+  const { signature, timestamp: parsedTimestamp, checkedAt: now } = preflight;
   const hmac = (0, import_crypto.createHmac)("sha256", secret);
   hmac.update(String(parsedTimestamp), "utf8");
   hmac.update(".", "utf8");
   hmac.update(toBodyBytes(options.rawBody));
   const expected = `sha256=${hmac.digest("hex")}`;
   const expectedBytes = Buffer.from(expected, "utf8");
-  const actualBytes = Buffer.from(signature.value, "utf8");
+  const actualBytes = Buffer.from(signature, "utf8");
   if (actualBytes.length !== expectedBytes.length || !(0, import_crypto.timingSafeEqual)(actualBytes, expectedBytes)) {
     return fail("bad_signature", "Webhook HMAC signature does not match the request body and timestamp.");
   }
   return {
     ok: true,
-    signature: signature.value,
+    signature,
     timestamp: parsedTimestamp,
     verifiedAt: now
   };
 }
+function preflightWebhookRequest(request, options = {}) {
+  const signature = resolveHeader("x-adcp-signature", request.signature, request.headers);
+  if (signature.reason) return { ok: false, reason: signature.reason, message: signature.message };
+  const timestamp = resolveHeader("x-adcp-timestamp", request.timestamp, request.headers);
+  if (timestamp.reason) return { ok: false, reason: timestamp.reason, message: timestamp.message };
+  if (!signature.value || !timestamp.value)
+    return {
+      ok: false,
+      reason: "missing_headers",
+      message: "Webhook is missing x-adcp-signature or x-adcp-timestamp."
+    };
+  const parsedTimestamp = parseTimestamp(timestamp.value);
+  if (parsedTimestamp === void 0)
+    return {
+      ok: false,
+      reason: "invalid_timestamp",
+      message: "x-adcp-timestamp must be an integer unix timestamp in seconds."
+    };
+  const now = Math.floor(options.now ? options.now() : Date.now() / 1e3);
+  const skewSeconds = options.maxSkewSeconds ?? options.skewSeconds ?? 300;
+  if (!Number.isFinite(now) || !Number.isFinite(skewSeconds) || skewSeconds < 0)
+    return {
+      ok: false,
+      reason: "invalid_timestamp",
+      message: "Clock and skew must be finite; skew must be non-negative."
+    };
+  if (Math.abs(now - parsedTimestamp) > skewSeconds)
+    return {
+      ok: false,
+      reason: "stale_timestamp",
+      message: `Webhook timestamp is outside the allowed ${skewSeconds}s skew window.`
+    };
+  if (!/^sha256=[a-f0-9]{64}$/.test(signature.value))
+    return {
+      ok: false,
+      reason: "malformed_signature",
+      message: "x-adcp-signature must match sha256=<64 lowercase hex chars>."
+    };
+  return { ok: true, signature: signature.value, timestamp: parsedTimestamp, checkedAt: now };
+}
 function fail(reason, message) {
   return { ok: false, reason, message };
 }
@@ -148,6 +173,7 @@ function isHeaders(headers) {
   WholesaleFeedWebhookNotificationError,
   normalizeWholesaleFeedWebhookNotification,
   parseWholesaleFeedWebhookNotification,
+  preflightWebhookRequest,
   verifyWebhookRequest,
   ...require('../notifications/account-change-recorded.js')
 });

package/dist/lib/webhooks/index.mjs

@@ -6,49 +6,73 @@ import {
   WholesaleFeedWebhookNotificationError
 } from "../wholesale-feed-sync/webhook-notification.mjs";
 function verifyWebhookRequest(options) {
+  const preflight = preflightWebhookRequest(options, {
+    now: options.now,
+    maxSkewSeconds: options.maxSkewSeconds ?? options.skewSeconds
+  });
+  if (!preflight.ok) return preflight;
   const secret = options.secret ?? options.globalSecret;
   if (!secret) {
     return fail("missing_secret", "A webhook HMAC secret is required.");
   }
-  const signature = resolveHeader("x-adcp-signature", options.signature, options.headers);
-  if (signature.reason) return fail(signature.reason, signature.message);
-  const timestamp = resolveHeader("x-adcp-timestamp", options.timestamp, options.headers);
-  if (timestamp.reason) return fail(timestamp.reason, timestamp.message);
-  if (!signature.value || !timestamp.value) {
-    return fail("missing_headers", "Webhook is missing x-adcp-signature or x-adcp-timestamp.");
-  }
-  const parsedTimestamp = parseTimestamp(timestamp.value);
-  if (parsedTimestamp === void 0) {
-    return fail("invalid_timestamp", "x-adcp-timestamp must be an integer unix timestamp in seconds.");
-  }
-  const now = options.now ? Math.floor(options.now()) : Math.floor(Date.now() / 1e3);
-  const skewSeconds = options.skewSeconds ?? 300;
-  if (!Number.isFinite(skewSeconds) || skewSeconds < 0) {
-    return fail("invalid_timestamp", "skewSeconds must be a non-negative number.");
-  }
-  if (Math.abs(now - parsedTimestamp) > skewSeconds) {
-    return fail("stale_timestamp", `Webhook timestamp is outside the allowed ${skewSeconds}s skew window.`);
-  }
-  if (!/^sha256=[a-f0-9]{64}$/.test(signature.value)) {
-    return fail("malformed_signature", "x-adcp-signature must match sha256=<64 lowercase hex chars>.");
-  }
+  const { signature, timestamp: parsedTimestamp, checkedAt: now } = preflight;
   const hmac = createHmac("sha256", secret);
   hmac.update(String(parsedTimestamp), "utf8");
   hmac.update(".", "utf8");
   hmac.update(toBodyBytes(options.rawBody));
   const expected = `sha256=${hmac.digest("hex")}`;
   const expectedBytes = Buffer.from(expected, "utf8");
-  const actualBytes = Buffer.from(signature.value, "utf8");
+  const actualBytes = Buffer.from(signature, "utf8");
   if (actualBytes.length !== expectedBytes.length || !timingSafeEqual(actualBytes, expectedBytes)) {
     return fail("bad_signature", "Webhook HMAC signature does not match the request body and timestamp.");
   }
   return {
     ok: true,
-    signature: signature.value,
+    signature,
     timestamp: parsedTimestamp,
     verifiedAt: now
   };
 }
+function preflightWebhookRequest(request, options = {}) {
+  const signature = resolveHeader("x-adcp-signature", request.signature, request.headers);
+  if (signature.reason) return { ok: false, reason: signature.reason, message: signature.message };
+  const timestamp = resolveHeader("x-adcp-timestamp", request.timestamp, request.headers);
+  if (timestamp.reason) return { ok: false, reason: timestamp.reason, message: timestamp.message };
+  if (!signature.value || !timestamp.value)
+    return {
+      ok: false,
+      reason: "missing_headers",
+      message: "Webhook is missing x-adcp-signature or x-adcp-timestamp."
+    };
+  const parsedTimestamp = parseTimestamp(timestamp.value);
+  if (parsedTimestamp === void 0)
+    return {
+      ok: false,
+      reason: "invalid_timestamp",
+      message: "x-adcp-timestamp must be an integer unix timestamp in seconds."
+    };
+  const now = Math.floor(options.now ? options.now() : Date.now() / 1e3);
+  const skewSeconds = options.maxSkewSeconds ?? options.skewSeconds ?? 300;
+  if (!Number.isFinite(now) || !Number.isFinite(skewSeconds) || skewSeconds < 0)
+    return {
+      ok: false,
+      reason: "invalid_timestamp",
+      message: "Clock and skew must be finite; skew must be non-negative."
+    };
+  if (Math.abs(now - parsedTimestamp) > skewSeconds)
+    return {
+      ok: false,
+      reason: "stale_timestamp",
+      message: `Webhook timestamp is outside the allowed ${skewSeconds}s skew window.`
+    };
+  if (!/^sha256=[a-f0-9]{64}$/.test(signature.value))
+    return {
+      ok: false,
+      reason: "malformed_signature",
+      message: "x-adcp-signature must match sha256=<64 lowercase hex chars>."
+    };
+  return { ok: true, signature: signature.value, timestamp: parsedTimestamp, checkedAt: now };
+}
 function fail(reason, message) {
   return { ok: false, reason, message };
 }
@@ -124,5 +148,6 @@ export {
   WholesaleFeedWebhookNotificationError,
   normalizeWholesaleFeedWebhookNotification,
   parseWholesaleFeedWebhookNotification,
+  preflightWebhookRequest,
   verifyWebhookRequest
 };

package/dist/lib/wholesale-feed-sync/index.d.mts

@@ -5,3 +5,5 @@ export { normalizeWholesaleFeedWebhookNotification, parseWholesaleFeedWebhookNot
 export type { WholesaleFeedSyncClient, WholesaleFeedSyncConfig, WholesaleFeedSyncEvents, WholesaleFeedSyncMode, WholesaleFeedSyncPersistedState, WholesaleFeedSyncPersistenceHooks, WholesaleFeedSyncState, ProductFilter, ResolvedCapabilities, SignalFilter, } from './types.mjs';
 export type { NormalizedWholesaleFeedWebhookNotification, WholesaleFeedWebhookAffectedEntityType, WholesaleFeedWebhookCacheScope, WholesaleFeedWebhookNotificationErrorCode, WholesaleFeedWebhookNotificationErrorDetails, WholesaleFeedWebhookNotificationType, } from './webhook-notification.mjs';
 export type { LegacyWholesaleFeedEvent, LegacyWholesaleFeedWebhook, LegacyWholesaleProduct, LegacyWholesaleSignal, } from './protocol-types.mjs';
+export { refreshWholesaleFeed, applyWholesaleFeedWebhook, InMemoryWholesaleFeedMirrorStore } from './mirror.mjs';
+export type { WholesaleFeedMirrorStore, WholesaleFeedMirrorScope, WholesaleFeedMirrorItem, WholesaleFeedMirrorSnapshot, WholesaleFeedMirrorCommit, WholesaleFeedRefreshOutcome, RefreshWholesaleFeedOptions, ApplyWholesaleFeedWebhookOptions, } from './mirror.mjs';

package/dist/lib/wholesale-feed-sync/index.d.ts

@@ -5,3 +5,5 @@ export { normalizeWholesaleFeedWebhookNotification, parseWholesaleFeedWebhookNot
 export type { WholesaleFeedSyncClient, WholesaleFeedSyncConfig, WholesaleFeedSyncEvents, WholesaleFeedSyncMode, WholesaleFeedSyncPersistedState, WholesaleFeedSyncPersistenceHooks, WholesaleFeedSyncState, ProductFilter, ResolvedCapabilities, SignalFilter, } from './types';
 export type { NormalizedWholesaleFeedWebhookNotification, WholesaleFeedWebhookAffectedEntityType, WholesaleFeedWebhookCacheScope, WholesaleFeedWebhookNotificationErrorCode, WholesaleFeedWebhookNotificationErrorDetails, WholesaleFeedWebhookNotificationType, } from './webhook-notification';
 export type { LegacyWholesaleFeedEvent, LegacyWholesaleFeedWebhook, LegacyWholesaleProduct, LegacyWholesaleSignal, } from './protocol-types';
+export { refreshWholesaleFeed, applyWholesaleFeedWebhook, InMemoryWholesaleFeedMirrorStore } from './mirror';
+export type { WholesaleFeedMirrorStore, WholesaleFeedMirrorScope, WholesaleFeedMirrorItem, WholesaleFeedMirrorSnapshot, WholesaleFeedMirrorCommit, WholesaleFeedRefreshOutcome, RefreshWholesaleFeedOptions, ApplyWholesaleFeedWebhookOptions, } from './mirror';

package/dist/lib/wholesale-feed-sync/index.js

@@ -18,23 +18,30 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var wholesale_feed_sync_exports = {};
 __export(wholesale_feed_sync_exports, {
+  InMemoryWholesaleFeedMirrorStore: () => import_mirror.InMemoryWholesaleFeedMirrorStore,
   WholesaleFeedSync: () => import_sync.WholesaleFeedSync,
   WholesaleFeedWebhookNotificationError: () => import_webhook_notification.WholesaleFeedWebhookNotificationError,
   WholesaleFeedWebhookRegistrationError: () => import_register.WholesaleFeedWebhookRegistrationError,
+  applyWholesaleFeedWebhook: () => import_mirror.applyWholesaleFeedWebhook,
   normalizeWholesaleFeedWebhookNotification: () => import_webhook_notification.normalizeWholesaleFeedWebhookNotification,
   parseWholesaleFeedWebhookNotification: () => import_webhook_notification.parseWholesaleFeedWebhookNotification,
+  refreshWholesaleFeed: () => import_mirror.refreshWholesaleFeed,
   registerWholesaleFeedWebhooks: () => import_register.registerWholesaleFeedWebhooks
 });
 module.exports = __toCommonJS(wholesale_feed_sync_exports);
 var import_sync = require('./sync.js');
 var import_register = require('./register.js');
 var import_webhook_notification = require('./webhook-notification.js');
+var import_mirror = require('./mirror.js');
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  InMemoryWholesaleFeedMirrorStore,
   WholesaleFeedSync,
   WholesaleFeedWebhookNotificationError,
   WholesaleFeedWebhookRegistrationError,
+  applyWholesaleFeedWebhook,
   normalizeWholesaleFeedWebhookNotification,
   parseWholesaleFeedWebhookNotification,
+  refreshWholesaleFeed,
   registerWholesaleFeedWebhooks
 });

package/dist/lib/wholesale-feed-sync/index.mjs

@@ -5,11 +5,15 @@ import {
   parseWholesaleFeedWebhookNotification,
   WholesaleFeedWebhookNotificationError
 } from "./webhook-notification.mjs";
+import { refreshWholesaleFeed, applyWholesaleFeedWebhook, InMemoryWholesaleFeedMirrorStore } from "./mirror.mjs";
 export {
+  InMemoryWholesaleFeedMirrorStore,
   WholesaleFeedSync,
   WholesaleFeedWebhookNotificationError,
   WholesaleFeedWebhookRegistrationError,
+  applyWholesaleFeedWebhook,
   normalizeWholesaleFeedWebhookNotification,
   parseWholesaleFeedWebhookNotification,
+  refreshWholesaleFeed,
   registerWholesaleFeedWebhooks
 };