@marcohefti/request-network-api-contracts 0.6.2 → 0.7.1

package/README.md

@@ -22,8 +22,8 @@ pnpm add -D @marcohefti/request-network-api-contracts
 
 ## Contents
 
-- `specs/openapi/` – auto-generated REST contract and metadata (fetched from the Request API).
-- `specs/webhooks/` – manually curated webhook schema reference.
+- `specs/openapi/` – separate normalized Request API and Auth API contracts, source metadata, and release manifest.
+- `specs/webhooks/` – manually curated webhook schema and current/legacy event manifest.
 - `fixtures/webhooks/*.json` – canonical webhook payloads used across SDK test suites.
 - `docs/` – release log, update instructions, and parity notes.
 
@@ -38,36 +38,25 @@ pnpm add -D @marcohefti/request-network-api-contracts
 
 ## Updating the spec
 
-Use the TypeScript client's tooling to refresh the contracts in-place. From the TypeScript client repository, run:
+Refresh both upstream documents from this repository:
 
 ```bash
-pnpm prepare:spec
-```
-
-This downloads the latest OpenAPI document into the contracts package's `specs/openapi/`, refreshes metadata, and regenerates the TypeScript/Zod outputs. Then verify the contracts package:
-
-```bash
-cd ../request-network-api-contracts
+npm run sync:openapi
+npm run sync:webhooks
 npm run verify
 ```
 
-The `verify` script sanity-checks file sizes and presence before committing updates across both packages.
-
-### Local schema drift patching
+`sync:openapi` fetches and normalizes the production Request and Auth APIs, applies only documented compatibility patches,
+and records raw/normalized hashes. Client code generation remains the responsibility of each client repository.
 
-`prepare:spec` now applies a local compatibility patch before regeneration to cover known upstream schema drift (for example `fees[].amount = null` and `fees[].type = "protocol"` in runtime payloads). Reapply the patch without refetching via:
+Webhook fee items preserve their required `type`, `amount`, and `currency` fields while accepting additional
+provider-supplied fields. This follows an authenticated `payment.confirmed` payload that included an unmodeled fee
+extension. A nullable fee `amount` is a compatibility inference from the related Request API fee schema, not a field
+independently confirmed by that webhook payload.
 
-```bash
-cd ../request-network-api-client-ts
-pnpm patch:openapi
-```
-
-This keeps contracts as the source of truth inside this workspace while upstream OpenAPI catches up.
-
-## Future work
+### Local schema drift patching
 
-- [ ] Publish webhook fixture guidelines and add validation to ensure both SDKs reference the same payload set.
-- [ ] Provide a version manifest so SDKs can pin contract revisions.
-- [ ] Document Git submodule workflow for post-split repositories.
+See `docs/OPENAPI-0.31.0-AUDIT.md` for the operation inventory and the evidence behind nullable-union, fee-drift,
+Secure-Payment-response, and Auth webhook-security patches.
 
 See `docs/OVERVIEW.md` for deeper architectural context.

package/docs/OPENAPI-0.31.0-AUDIT.md

@@ -0,0 +1,91 @@
+# Request API 0.31.0 and Auth API 0.14.0 Audit
+
+Audit date: 2026-09-03  
+Contracts release: 0.7.0  
+Scope: Request Network REST APIs only; the legacy Request SDK is excluded.
+
+## Result
+
+The production Request API grew from 42 operations in 0.16.1 to 82 operations in 0.31.0. The audited delta is 42 added,
+14 schema-changed, 2 removed, and 26 unchanged operations. The separate Auth API 0.14.0 contributes 26 operations on a
+different host and remains a separate contract to avoid path and credential collisions.
+
+Only the production hosts are supported runtime defaults. The raw Request API document also advertises staging and local
+servers; those values are retained in the normalized source for provenance but are not supported environments.
+
+## Added Request API operations
+
+| Domain | Count | Operations |
+| --- | ---: | --- |
+| Orchestrators | 18 | create orchestrator; link/list/unlink Client IDs; create hosted link intent; create/list/update/disable fee configs; create/get/update/remove branding; create/list/test/deactivate/reactivate webhooks |
+| Secure Payments | 9 | create payout and batch-payout links; get token calldata; preview fees; record intent, multicall intent, and user event; refresh bridge transaction; broadcast Tron transaction |
+| Secure Payment multicall | 2 | create and read multicall payout links |
+| Commerce payments | 7 | generate/execute authorization, capture, and void plus payment status |
+| Journey | 3 | create journey, record journey event, read journey |
+| Health/export/history | 3 | health, dashboard request export, wallet transaction history |
+
+The exact method/path/operation IDs are the 42 operations present in the checked-in 0.31.0 document and absent from the
+0.16.1 release. `npm run verify` locks the complete inventory at 82 operations so additions or removals cannot be silent.
+
+## Changed existing operations
+
+All 14 operations whose normalized operation object changed were reviewed:
+
+| Operations | Reviewed impact |
+| --- | --- |
+| `ClientIdV2Controller_create_v2`, `ClientIdV2Controller_update_v2` | Client-ID fee, domain, and access-policy request/response changes. |
+| `PaymentV2Controller_searchPayments_v2` | Expanded amounts, currencies, networks, fee detail, and pagination response data. |
+| `PayoutV2Controller_payBatchRequest_v2` | Batch transaction and request metadata shape changed. |
+| `RequestControllerV1_getPaymentCalldata_v1`, `RequestControllerV1_getRequestPaymentRoutes_v1`, `RequestControllerV1_getRequestStatus_v1` | Legacy v1 calldata, route, status, and fee schemas changed; retained only for existing consumers. |
+| `RequestControllerV2_getPaymentCalldata_v2`, `RequestControllerV2_getRequestPaymentRoutes_v2`, `RequestControllerV2_getRequestStatus_v2`, `RequestControllerV2_listRequests_v2` | Current request status/routes/calldata expanded; list is Client-ID scoped when wallet is omitted and exposes Client ID/Secure Payment state. |
+| `SecurePaymentController_createSecurePayment_v2`, `SecurePaymentController_findSecurePayment_v2`, `SecurePaymentController_getSecurePaymentByToken_v2` | Request fields expanded, but upstream response schemas regressed to fee-plan-only objects; compatibility schemas preserve the documented and observed hosted-payment responses. |
+
+The remaining 26 pre-existing operations compare unchanged after canonical JSON ordering.
+
+## Removed operations
+
+The obsolete payment-intent send operations are intentionally absent:
+
+- `RequestControllerV1_sendPaymentIntent_v1` — `POST /v1/request/{paymentIntentId}/send`
+- `RequestControllerV2_sendPaymentIntent_v2` — `POST /v2/request/payment-intents/{paymentIntentId}`
+
+## Auth API ownership
+
+Auth API 0.14.0 is stored separately as `request-network-auth-openapi.json` and uses
+`https://auth.request.network`. Its 26 operations cover:
+
+- wallet-session registration, login/logout, challenge, and verification (5);
+- Client ID CRUD (5);
+- hosted Client-ID link validation/completion and linked KYT update (3);
+- payee destination lifecycle and lookup (7);
+- platform webhook registration/list/test/toggle/delete (5); and
+- health (1).
+
+The upstream Auth document names `session_token` without declaring its security scheme and omits the working `x-client-id`
+alternative from platform webhook operations. Production probes verified Client-ID-scoped webhook create/list/test/delete.
+The normalized contract declares both alternatives only for those five webhook operations.
+
+## Explicit compatibility patches
+
+The normalized specs declare every patch in `x-contract-patches`; metadata records raw and normalized SHA-256 values.
+
+| Patch | Evidence and behavior |
+| --- | --- |
+| `oas30-nullable-unions` | Both upstream documents declare OpenAPI 3.0 but use JSON Schema `type: [T, null]`. Two-member null unions are converted to `type: T` plus `nullable: true`. Verification rejects remaining type arrays. |
+| `runtime-fee-drift` | Production payload evidence includes fee type `protocol` and nullable fee amounts while the upstream schema omits them. The tolerant enum/nullability patch remains active. |
+| `secure-payment-response-shapes` | The upstream 0.31.0 document incorrectly substitutes a fee-plan snapshot for several hosted-payment responses. Public Secure Payments examples and a redacted production create probe establish `requestIds`, `securePaymentUrl`, and `token`; the fee snapshot is represented as optional `feePlan`. |
+| `platform-webhook-client-id-auth` | A production probe verified `x-client-id` for platform webhook management despite incomplete Auth OpenAPI security annotations. |
+
+## Webhook catalogue
+
+The webhook contract 0.2.0 adds the current platform/orchestrator events `client_id.linked`, `kyt.screening.completed`,
+`secure_payment.user_event`, and `secure_payment.access_rejected`. Its manifest defines recipients and distinguishes the
+current six-event catalogue from retained legacy fixtures. Fixtures are checked against the event registry during
+`npm run verify`.
+
+Sources:
+
+- https://api.request.network/open-api/openapi.json
+- https://auth.request.network/open-api/openapi.json
+- https://docs.request.network/api-reference/webhooks
+- https://docs.request.network/api-reference/secure-payments

package/docs/OVERVIEW.md

@@ -5,7 +5,7 @@
 Centralise the Request Network REST contracts and test fixtures in one place so
 all language clients stay in sync:
 
-- **OpenAPI spec** - canonical JSON used to generate DTOs, schema validators,
+- **OpenAPI specs** - separate Request API and Auth API JSON used to generate DTOs, schema validators,
   and parity tests.
 - **OpenAPI metadata** - etag/fetched-at/source info to track when the spec
   last changed.
@@ -26,7 +26,9 @@ Git dependency.
 │   ├── README.md                     # explains generated vs manual assets
 │   ├── openapi/
 │   │   ├── request-network-openapi.json
-│   │   └── request-network-openapi.meta.json
+│   │   ├── request-network-auth-openapi.json
+│   │   ├── *.meta.json
+│   │   └── manifest.json
 │   └── webhooks/
 │       └── request-network-webhooks.json
 ├── fixtures/
@@ -51,10 +53,9 @@ Git dependency.
 
 ## Update Workflow
 
-1. Refresh the OpenAPI spec (see `docs/UPDATE-WORKFLOW.md` for details). When
-   you maintain the TypeScript client alongside this package, that typically
-   means running its `pnpm run prepare:spec` task so the latest OpenAPI
-   document and metadata land in `specs/openapi/`.
+1. Refresh both OpenAPI specs with `npm run sync:openapi` (see
+   `docs/UPDATE-WORKFLOW.md`). The contracts repository owns fetch,
+   normalization, patch provenance, and release metadata.
 2. Update webhook fixtures in `fixtures/webhooks/` when Request publishes new
    payloads. Pair every new fixture with test coverage in each SDK.
 3. Run `npm run verify` from this repository to confirm the expected files are
@@ -65,8 +66,4 @@ Git dependency.
 5. Append an entry to `docs/UPDATES.md` capturing the date, upstream
    reference, and required SDK follow-up.
 
-## Related Backlog Tasks
-
-- **Track contract versioning** - provide a manifest so SDKs can pin/compare revisions.
-- **Webhook fixture parity automation** - ensure both SDKs validate against the shared payload set.
-- **Document submodule workflow** - outline how downstream repositories should consume this package post-split.
+The package is product-neutral: it contains no connector, WooCommerce, or CamelPay behavior.

package/docs/PUBLISHING.md

@@ -10,13 +10,13 @@ Use this checklist when preparing a release.
 
 - [x] `package.json` metadata is correct:
   - `name: "@marcohefti/request-network-api-contracts"`
-  - `version` bumped according to the changes (0.5.x for the initial public line).
+  - `version` bumped according to the reviewed compatibility change.
   - `"private": false` and `"license": "MIT"`.
   - `"files"` includes `specs`, `fixtures`, `docs`, and `README.md`.
 - [x] `README.md` and `docs/OVERVIEW.md` describe the current contents (OpenAPI,
       webhooks, fixtures) and how SDKs should consume them.
-- [x] OpenAPI spec and metadata are refreshed via the TypeScript client’s tooling
-      (see `docs/UPDATE-WORKFLOW.md` step 1).
+- [x] Request/Auth OpenAPI specs, metadata, and manifest are refreshed through
+      this repository (see `docs/UPDATE-WORKFLOW.md` step 1).
 - [x] Webhook schema (`specs/webhooks/request-network-webhooks.json`) and
       fixtures under `fixtures/webhooks/**` reflect the latest published webhook
       events.
@@ -27,8 +27,8 @@ Use this checklist when preparing a release.
 
 - [x] `docs/UPDATES.md` records the latest contract update (date, summary,
       upstream source, required SDK follow-up).
-- [ ] Tag strategy documented (e.g., `v0.x.y` for contract updates, semantic
-      version bumps when contracts introduce breaking changes for SDKs).
+- [x] Tags use `v0.x.y`; breaking pre-1.0 client-contract changes increment the
+      minor version.
 
 ## Publishing Steps (Automated via GitHub Actions)
 
@@ -38,9 +38,8 @@ Publishing is fully automated using GitHub Actions and OIDC trusted publishers.
 
 1. Bump the version using npm:
    ```bash
-   npm version patch   # for bug fixes (0.5.1 -> 0.5.2)
-   npm version minor   # for new features (0.5.1 -> 0.6.0)
-   npm version major   # for breaking changes (0.5.1 -> 1.0.0)
+   npm version patch   # compatible contract corrections
+   npm version minor   # breaking pre-1.0 contract changes
    ```
 
 2. Push the tag to GitHub:

package/docs/UPDATE-WORKFLOW.md

@@ -1,26 +1,23 @@
 # Contracts Update Workflow
 
-Use this checklist whenever the Request Network API publishes contract changes. The TypeScript client's tooling writes new assets directly into this package. Follow the steps below to keep every SDK in sync.
+Use this checklist whenever either Request Network REST API publishes contract changes.
 
 ## 1. Refresh the OpenAPI spec
 
-- If you maintain the official TypeScript client alongside this package, run its
-  `pnpm run prepare:spec` task to download the latest OpenAPI document and
-  regenerate the generated types. That tooling is responsible for writing
-  `specs/openapi/request-network-openapi.json` and the corresponding
-  `.meta.json` file into this package.
-  - `prepare:spec` also applies local schema-drift patches before generation
-    (currently fee-shape compatibility for runtime payloads that return
-    `type: "protocol"` and nullable fee amounts).
-- If you are only using this repository, fetch the OpenAPI document directly
-  from the upstream Request API (`https://api.request.network/open-api/openapi.json`)
-  and update both the JSON and `.meta.json` files under `specs/openapi/`, then
-  run `pnpm --filter "./packages/request-network-api-client-ts" patch:openapi`
-  from the workspace root before regenerating client artifacts.
+- Run `npm run sync:openapi` in this repository.
+- Review both raw upstream sources against the prior release. Record added,
+  removed, and schema-changed operations in an audit document.
+- Review every compatibility patch. Remove one only when upstream contract and
+  production evidence agree.
+- Confirm `specs/openapi/manifest.json` names only production runtime hosts and
+  records both upstream versions, hashes, patch IDs, and compatible clients.
 
 ## 2. Update webhook schema (if needed)
 
-- Manually edit `specs/webhooks/request-network-webhooks.json` when Request publishes new webhook fields or events.
+- Update the fixture and `scripts/sync-webhooks.mjs`, then run
+  `npm run sync:webhooks` when Request publishes webhook fields or events.
+- Update `specs/webhooks/manifest.json` to classify current versus legacy events
+  and their platform/orchestrator recipients.
 - Keep any breaking changes coordinated across SDKs-update shared enums and validation helpers in the clients immediately after adjusting the schema.
 
 ## 3. Sync webhook fixtures
@@ -42,6 +39,6 @@ sizes for a quick sanity check.
 ## 5. Document and commit
 
 - Record the change in `docs/UPDATES.md` (date, summary, upstream source, required SDK follow-up).
-- Commit the updated contracts alongside regenerated client artefacts so downstream packages pick up the change in one review.
+- Release this contracts repository before regenerating and releasing clients.
 
 Repeat this workflow whenever the upstream API contract or webhook catalogue changes.

package/docs/UPDATES.md

@@ -12,6 +12,24 @@ change so SDK maintainers know when to regenerate code.
 -	**Notes:** Regeneration impact, required SDK updates, new fixtures
 
 ## History
+- **Date:** 2026-09-08
+- **Spec Version:** contracts 0.7.1
+- **Change Summary:** Opened `WebhookFeeItem` to provider-supplied extensions and made its string `amount` nullable;
+  the required `type`, `amount`, and `currency` fields remain unchanged. Added a synthetic null-amount/extension
+  regression fixture and guards that preserve the behavior through webhook regeneration.
+- **Source:** Authenticated `payment.confirmed` delivery (fee extension) and related Request API fee schema
+  (nullable amount).
+- **Notes:** The extra fee field is confirmed by the webhook delivery. Nullable webhook `amount` is an API-schema
+  compatibility inference, not an independently observed webhook field. Regenerate TS/PHP clients against 0.7.1.
+
+- **Date:** 2026-09-03
+- **Spec Version:** Request API 0.31.0; Auth API 0.14.0; contracts 0.7.0
+- **Change Summary:** Added the separate Auth contract, synchronized all 82 Request operations, removed two obsolete
+  payment-intent send operations, added contract provenance, and expanded the current webhook catalogue.
+- **Source:** https://api.request.network/open-api/openapi.json and https://auth.request.network/open-api/openapi.json
+- **Notes:** Breaking pre-1.0 contract update. Preserves documented fee/runtime drift, normalizes invalid OpenAPI 3.0 null
+  unions, and repairs known Secure Payment response/Auth webhook security defects. Requires TS/PHP clients 0.7.0+.
+
 - **Date:** 2026-03-10
 - **Spec Version:** 0.16.1 (`fetchedAt` 2026-03-10T07:48:56.668Z)
 - **Change Summary:** Refreshed the upstream Request API OpenAPI fetch metadata. The patched contract JSON stayed unchanged after reapplying the local fee-schema drift patch.

package/fixtures/webhooks/client-id-linked.json

@@ -0,0 +1,13 @@
+{
+  "event": "client_id.linked",
+  "clientId": "cli_PLATFORM_CLIENT_ID",
+  "orchestratorId": "01ARZ3NDEKTSV4RRFFQ69G5FAW",
+  "linkId": "01ARZ3NDEKTSV4RRFFQ69G5FAX",
+  "intentId": "01ARZ3NDEKTSV4RRFFQ69G5FAY",
+  "externalId": "merchant_123",
+  "destinationId": "0x742d35Cc6634C0532925a3b844Bc454e4438f44e@eip155:8453#B4FD67BB:0x833589fcd6edb6e08f4c7c32d4f71b54bda02913",
+  "destinationWalletAddress": "0x742d35cc6634c0532925a3b844bc454e4438f44e",
+  "chain": "base",
+  "currency": "USDC",
+  "timestamp": "2026-08-14T10:00:00.000Z"
+}

package/fixtures/webhooks/kyt-screening-completed.json

@@ -0,0 +1,13 @@
+{
+  "event": "kyt.screening.completed",
+  "paymentToken": "01KYM5CZ51K0N1KJ4F8S73BE3N",
+  "clientId": "cli_PLATFORM_CLIENT_ID",
+  "orchestratorId": "01ARZ3NDEKTSV4RRFFQ69G5FAW",
+  "walletAddress": "0x2e2e5c79f571ef1658d4c2d3684a1fe97dd30570",
+  "eoaAddress": "0x2e2e5c79f571ef1658d4c2d3684a1fe97dd30570",
+  "smartAccountAddress": null,
+  "status": "approved",
+  "provider": "hypernative",
+  "policyId": "11111111-1111-4111-8111-811111111111",
+  "timestamp": "2026-08-14T10:00:00.000Z"
+}

package/fixtures/webhooks/payment-confirmed-fee-extension.json

@@ -0,0 +1,15 @@
+{
+  "event": "payment.confirmed",
+  "requestId": "synthetic-payment-confirmed-fee-extension",
+  "timestamp": "2026-09-08T00:00:00Z",
+  "fees": [
+    {
+      "type": "network",
+      "amount": null,
+      "currency": "ETH",
+      "syntheticExtension": {
+        "fixture": "contract-regression"
+      }
+    }
+  ]
+}

package/fixtures/webhooks/payment-confirmed.json

@@ -1,18 +1,23 @@
 {
   "event": "payment.confirmed",
-  "requestId": "req_test123456789abcdef",
-  "requestID": "req_test123456789abcdef",
-  "paymentReference": "0x1234567890abcdef1234567890abcdef12345678",
-  "explorer": "https://scan.request.network/request/req_test123456789abcdef",
+  "requestId": "0151b394e3c482c5aebaa04eb04508a8db70595470760293f1b258ed96d1fafa93",
+  "requestID": "0151b394e3c482c5aebaa04eb04508a8db70595470760293f1b258ed96d1fafa93",
+  "paymentReference": "0x2c3366941274c34c",
+  "clientId": "cli_PLATFORM_CLIENT_ID",
+  "orchestratorId": "01ARZ3NDEKTSV4RRFFQ69G5FAW",
+  "explorer": "https://scan.request.network/request/0151b394e3c482c5aebaa04eb04508a8db70595470760293f1b258ed96d1fafa93",
   "amount": "100.0",
   "totalAmountPaid": "100.0",
   "expectedAmount": "100.0",
-  "timestamp": "2025-08-28T12:25:45.995Z",
+  "timestamp": "2025-10-03T14:30:00Z",
   "txHash": "0xabcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890",
+  "payerAddress": "0x92Fc3406Fc6BB7A76aC63b2E8b9d02b1B9C3e4d5",
+  "payerEoaAddress": "0x7A1F20C4D58E9B0A3C6D4E2F1B8A5C7D9E0F1234",
   "network": "ethereum",
   "currency": "USDC",
   "paymentCurrency": "USDC",
   "isCryptoToFiat": false,
+  "subStatus": "",
   "paymentProcessor": "request-network",
   "fees": [
     {

package/fixtures/webhooks/payment-failed.json

@@ -1,15 +1,9 @@
 {
   "event": "payment.failed",
-  "requestId": "req_fail1234567890",
-  "paymentReference": "0xfail1234567890abcdef1234567890abcdef1234",
-  "amount": "100.0",
-  "totalAmountPaid": "0.0",
-  "expectedAmount": "100.0",
-  "timestamp": "2025-08-28T18:25:45.995Z",
-  "paymentCurrency": "USDC",
-  "isCryptoToFiat": true,
-  "paymentProcessor": "request-network",
+  "requestId": "0151b394e3c482c5aebaa04eb04508a8db70595470760293f1b258ed96d1fafa93",
+  "requestID": "0151b394e3c482c5aebaa04eb04508a8db70595470760293f1b258ed96d1fafa93",
+  "paymentReference": "0x2c3366941274c34c",
+  "clientId": "cli_PLATFORM_CLIENT_ID",
   "subStatus": "insufficient_funds",
-  "failureReason": "Insufficient fiat liquidity",
-  "retryAfter": "2025-08-29T18:25:45.995Z"
+  "paymentProcessor": "request-network"
 }

package/fixtures/webhooks/secure-payment-access-rejected.json

@@ -0,0 +1,8 @@
+{
+  "event": "secure_payment.access_rejected",
+  "requestId": "0151b394e3c482c5aebaa04eb04508a8db70595470760293f1b258ed96d1fafa93",
+  "clientId": "cli_PLATFORM_CLIENT_ID",
+  "orchestratorId": "01ARZ3NDEKTSV4RRFFQ69G5FAW",
+  "attemptedPayerWalletAddress": "0x2e2e5c79f571ef1658d4c2d3684a1fe97dd30570",
+  "timestamp": "2026-08-10T10:05:00.000Z"
+}

package/fixtures/webhooks/secure-payment-user-event.json

@@ -0,0 +1,20 @@
+{
+  "event": "secure_payment.user_event",
+  "userEvent": "payment_approved_in_wallet",
+  "securePaymentToken": "spt_3fk29ax7",
+  "requestId": "01JD3E6JD46KY4KKV7X9V0MZ7W",
+  "requestIds": [
+    "01JD3E6JD46KY4KKV7X9V0MZ7W"
+  ],
+  "clientId": "cli_PLATFORM_CLIENT_ID",
+  "orchestratorId": "01ARZ3NDEKTSV4RRFFQ69G5FAW",
+  "occurredAt": "2026-08-05T14:03:21.512Z",
+  "timestamp": "2026-08-05T14:03:22.104Z",
+  "properties": {
+    "wallet_provider": "metamask",
+    "payment_submission_id": "0x6a4fe21b",
+    "payment_submission_id_type": "evm_tx_hash",
+    "selected_source_chain": "base",
+    "payment_type": "single"
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marcohefti/request-network-api-contracts",
-  "version": "0.6.2",
+  "version": "0.7.1",
   "private": false,
   "description": "Shared contracts for Request Network API clients (OpenAPI spec, webhook fixtures).",
   "license": "MIT",
@@ -18,9 +18,12 @@
     "specs",
     "fixtures",
     "docs",
+    "scripts",
     "README.md"
   ],
   "scripts": {
+    "sync:openapi": "node scripts/sync-openapi.mjs",
+    "sync:webhooks": "node scripts/sync-webhooks.mjs",
     "verify": "node scripts/verify.js"
   }
 }