@wefunder/sdk 0.1.0-beta.1 → 0.1.0-beta.11

package/dist/index.cjs

@@ -25,29 +25,852 @@ __export(index_exports, {
   DEFAULT_AUTHORIZE_BASE_URL: () => DEFAULT_AUTHORIZE_BASE_URL,
   DEFAULT_OAUTH_BASE_URL: () => DEFAULT_OAUTH_BASE_URL,
   DEFAULT_TOKEN_BASE_URL: () => DEFAULT_TOKEN_BASE_URL,
-  DELIVERY_ID_HEADER: () => DELIVERY_ID_HEADER,
-  EVENT_HEADER: () => EVENT_HEADER,
+  DEFAULT_TOLERANCE_SECONDS: () => DEFAULT_TOLERANCE_SECONDS,
+  LEGACY_DELIVERY_ID_HEADER: () => LEGACY_DELIVERY_ID_HEADER,
+  LEGACY_EVENT_HEADER: () => LEGACY_EVENT_HEADER,
+  LEGACY_SIGNATURE_HEADER: () => LEGACY_SIGNATURE_HEADER,
+  LEGACY_TIMESTAMP_HEADER: () => LEGACY_TIMESTAMP_HEADER,
   REQUEST_ID_HEADER: () => REQUEST_ID_HEADER,
+  SANDBOX_AUTHORIZE_BASE_URL: () => SANDBOX_AUTHORIZE_BASE_URL,
   SIGNATURE_HEADER: () => SIGNATURE_HEADER,
-  TIMESTAMP_HEADER: () => TIMESTAMP_HEADER,
+  TokenManager: () => TokenManager,
+  WebhookSignatureError: () => WebhookSignatureError,
   Wefunder: () => Wefunder,
   WefunderAuthError: () => WefunderAuthError,
   WefunderError: () => WefunderError,
+  WefunderTokenPersistenceError: () => WefunderTokenPersistenceError,
+  checkWebhookSignature: () => checkWebhookSignature,
   clientCredentialsGrant: () => clientCredentialsGrant,
   collect: () => collect,
+  computeWebhookSignature: () => computeWebhookSignature,
   constructEvent: () => constructEvent,
+  constructEventFromRequest: () => constructEventFromRequest,
   createAuthorizationUrl: () => createAuthorizationUrl,
+  dispatchWebhook: () => dispatchWebhook,
   exchangeCode: () => exchangeCode,
   generatePkce: () => generatePkce,
   modeForToken: () => modeForToken,
   paginate: () => paginate,
+  parseSignatureHeader: () => parseSignatureHeader,
   refreshToken: () => refreshToken,
+  signWebhook: () => signWebhook,
   verifyWebhook: () => verifyWebhook
 });
 module.exports = __toCommonJS(index_exports);
 
-// src/client.ts
-var import_client_fetch2 = require("@hey-api/client-fetch");
+// src/generated/core/bodySerializer.gen.ts
+var jsonBodySerializer = {
+  bodySerializer: (body) => JSON.stringify(
+    body,
+    (_key, value) => typeof value === "bigint" ? value.toString() : value
+  )
+};
+
+// src/generated/core/params.gen.ts
+var extraPrefixesMap = {
+  $body_: "body",
+  $headers_: "headers",
+  $path_: "path",
+  $query_: "query"
+};
+var extraPrefixes = Object.entries(extraPrefixesMap);
+
+// src/generated/core/serverSentEvents.gen.ts
+function createSseClient({
+  onRequest,
+  onSseError,
+  onSseEvent,
+  responseTransformer,
+  responseValidator,
+  sseDefaultRetryDelay,
+  sseMaxRetryAttempts,
+  sseMaxRetryDelay,
+  sseSleepFn,
+  url,
+  ...options
+}) {
+  let lastEventId;
+  const sleep = sseSleepFn ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const createStream = async function* () {
+    let retryDelay = sseDefaultRetryDelay ?? 3e3;
+    let attempt = 0;
+    const signal = options.signal ?? new AbortController().signal;
+    while (true) {
+      if (signal.aborted) break;
+      attempt++;
+      const headers = options.headers instanceof Headers ? options.headers : new Headers(options.headers);
+      if (lastEventId !== void 0) {
+        headers.set("Last-Event-ID", lastEventId);
+      }
+      try {
+        const requestInit = {
+          redirect: "follow",
+          ...options,
+          body: options.serializedBody,
+          headers,
+          signal
+        };
+        let request = new Request(url, requestInit);
+        if (onRequest) {
+          request = await onRequest(url, requestInit);
+        }
+        const _fetch = options.fetch ?? globalThis.fetch;
+        const response = await _fetch(request);
+        if (!response.ok)
+          throw new Error(
+            `SSE failed: ${response.status} ${response.statusText}`
+          );
+        if (!response.body) throw new Error("No body in SSE response");
+        const reader = response.body.pipeThrough(new TextDecoderStream()).getReader();
+        let buffer = "";
+        const abortHandler = () => {
+          try {
+            reader.cancel();
+          } catch {
+          }
+        };
+        signal.addEventListener("abort", abortHandler);
+        try {
+          while (true) {
+            const { done, value } = await reader.read();
+            if (done) break;
+            buffer += value;
+            buffer = buffer.replace(/\r\n?/g, "\n");
+            const chunks = buffer.split("\n\n");
+            buffer = chunks.pop() ?? "";
+            for (const chunk of chunks) {
+              const lines = chunk.split("\n");
+              const dataLines = [];
+              let eventName;
+              for (const line of lines) {
+                if (line.startsWith("data:")) {
+                  dataLines.push(line.replace(/^data:\s*/, ""));
+                } else if (line.startsWith("event:")) {
+                  eventName = line.replace(/^event:\s*/, "");
+                } else if (line.startsWith("id:")) {
+                  lastEventId = line.replace(/^id:\s*/, "");
+                } else if (line.startsWith("retry:")) {
+                  const parsed = Number.parseInt(
+                    line.replace(/^retry:\s*/, ""),
+                    10
+                  );
+                  if (!Number.isNaN(parsed)) {
+                    retryDelay = parsed;
+                  }
+                }
+              }
+              let data;
+              let parsedJson = false;
+              if (dataLines.length) {
+                const rawData = dataLines.join("\n");
+                try {
+                  data = JSON.parse(rawData);
+                  parsedJson = true;
+                } catch {
+                  data = rawData;
+                }
+              }
+              if (parsedJson) {
+                if (responseValidator) {
+                  await responseValidator(data);
+                }
+                if (responseTransformer) {
+                  data = await responseTransformer(data);
+                }
+              }
+              onSseEvent?.({
+                data,
+                event: eventName,
+                id: lastEventId,
+                retry: retryDelay
+              });
+              if (dataLines.length) {
+                yield data;
+              }
+            }
+          }
+        } finally {
+          signal.removeEventListener("abort", abortHandler);
+          reader.releaseLock();
+        }
+        break;
+      } catch (error) {
+        onSseError?.(error);
+        if (sseMaxRetryAttempts !== void 0 && attempt >= sseMaxRetryAttempts) {
+          break;
+        }
+        const backoff = Math.min(
+          retryDelay * 2 ** (attempt - 1),
+          sseMaxRetryDelay ?? 3e4
+        );
+        await sleep(backoff);
+      }
+    }
+  };
+  const stream = createStream();
+  return { stream };
+}
+
+// src/generated/core/pathSerializer.gen.ts
+var separatorArrayExplode = (style) => {
+  switch (style) {
+    case "label":
+      return ".";
+    case "matrix":
+      return ";";
+    case "simple":
+      return ",";
+    default:
+      return "&";
+  }
+};
+var separatorArrayNoExplode = (style) => {
+  switch (style) {
+    case "form":
+      return ",";
+    case "pipeDelimited":
+      return "|";
+    case "spaceDelimited":
+      return "%20";
+    default:
+      return ",";
+  }
+};
+var separatorObjectExplode = (style) => {
+  switch (style) {
+    case "label":
+      return ".";
+    case "matrix":
+      return ";";
+    case "simple":
+      return ",";
+    default:
+      return "&";
+  }
+};
+var serializeArrayParam = ({
+  allowReserved,
+  explode,
+  name,
+  style,
+  value
+}) => {
+  if (!explode) {
+    const joinedValues2 = (allowReserved ? value : value.map((v) => encodeURIComponent(v))).join(separatorArrayNoExplode(style));
+    switch (style) {
+      case "label":
+        return `.${joinedValues2}`;
+      case "matrix":
+        return `;${name}=${joinedValues2}`;
+      case "simple":
+        return joinedValues2;
+      default:
+        return `${name}=${joinedValues2}`;
+    }
+  }
+  const separator = separatorArrayExplode(style);
+  const joinedValues = value.map((v) => {
+    if (style === "label" || style === "simple") {
+      return allowReserved ? v : encodeURIComponent(v);
+    }
+    return serializePrimitiveParam({
+      allowReserved,
+      name,
+      value: v
+    });
+  }).join(separator);
+  return style === "label" || style === "matrix" ? separator + joinedValues : joinedValues;
+};
+var serializePrimitiveParam = ({
+  allowReserved,
+  name,
+  value
+}) => {
+  if (value === void 0 || value === null) {
+    return "";
+  }
+  if (typeof value === "object") {
+    throw new Error(
+      "Deeply-nested arrays/objects aren\u2019t supported. Provide your own `querySerializer()` to handle these."
+    );
+  }
+  return `${name}=${allowReserved ? value : encodeURIComponent(value)}`;
+};
+var serializeObjectParam = ({
+  allowReserved,
+  explode,
+  name,
+  style,
+  value,
+  valueOnly
+}) => {
+  if (value instanceof Date) {
+    return valueOnly ? value.toISOString() : `${name}=${value.toISOString()}`;
+  }
+  if (style !== "deepObject" && !explode) {
+    let values = [];
+    Object.entries(value).forEach(([key, v]) => {
+      values = [
+        ...values,
+        key,
+        allowReserved ? v : encodeURIComponent(v)
+      ];
+    });
+    const joinedValues2 = values.join(",");
+    switch (style) {
+      case "form":
+        return `${name}=${joinedValues2}`;
+      case "label":
+        return `.${joinedValues2}`;
+      case "matrix":
+        return `;${name}=${joinedValues2}`;
+      default:
+        return joinedValues2;
+    }
+  }
+  const separator = separatorObjectExplode(style);
+  const joinedValues = Object.entries(value).map(
+    ([key, v]) => serializePrimitiveParam({
+      allowReserved,
+      name: style === "deepObject" ? `${name}[${key}]` : key,
+      value: v
+    })
+  ).join(separator);
+  return style === "label" || style === "matrix" ? separator + joinedValues : joinedValues;
+};
+
+// src/generated/core/utils.gen.ts
+var PATH_PARAM_RE = /\{[^{}]+\}/g;
+var defaultPathSerializer = ({
+  path,
+  url: _url
+}) => {
+  let url = _url;
+  const matches = _url.match(PATH_PARAM_RE);
+  if (matches) {
+    for (const match of matches) {
+      let explode = false;
+      let name = match.substring(1, match.length - 1);
+      let style = "simple";
+      if (name.endsWith("*")) {
+        explode = true;
+        name = name.substring(0, name.length - 1);
+      }
+      if (name.startsWith(".")) {
+        name = name.substring(1);
+        style = "label";
+      } else if (name.startsWith(";")) {
+        name = name.substring(1);
+        style = "matrix";
+      }
+      const value = path[name];
+      if (value === void 0 || value === null) {
+        continue;
+      }
+      if (Array.isArray(value)) {
+        url = url.replace(
+          match,
+          serializeArrayParam({ explode, name, style, value })
+        );
+        continue;
+      }
+      if (typeof value === "object") {
+        url = url.replace(
+          match,
+          serializeObjectParam({
+            explode,
+            name,
+            style,
+            value,
+            valueOnly: true
+          })
+        );
+        continue;
+      }
+      if (style === "matrix") {
+        url = url.replace(
+          match,
+          `;${serializePrimitiveParam({
+            name,
+            value
+          })}`
+        );
+        continue;
+      }
+      const replaceValue = encodeURIComponent(
+        style === "label" ? `.${value}` : value
+      );
+      url = url.replace(match, replaceValue);
+    }
+  }
+  return url;
+};
+var getUrl = ({
+  baseUrl,
+  path,
+  query,
+  querySerializer,
+  url: _url
+}) => {
+  const pathUrl = _url.startsWith("/") ? _url : `/${_url}`;
+  let url = (baseUrl ?? "") + pathUrl;
+  if (path) {
+    url = defaultPathSerializer({ path, url });
+  }
+  let search = query ? querySerializer(query) : "";
+  if (search.startsWith("?")) {
+    search = search.substring(1);
+  }
+  if (search) {
+    url += `?${search}`;
+  }
+  return url;
+};
+function getValidRequestBody(options) {
+  const hasBody = options.body !== void 0;
+  const isSerializedBody = hasBody && options.bodySerializer;
+  if (isSerializedBody) {
+    if ("serializedBody" in options) {
+      const hasSerializedBody = options.serializedBody !== void 0 && options.serializedBody !== "";
+      return hasSerializedBody ? options.serializedBody : null;
+    }
+    return options.body !== "" ? options.body : null;
+  }
+  if (hasBody) {
+    return options.body;
+  }
+  return void 0;
+}
+
+// src/generated/core/auth.gen.ts
+var getAuthToken = async (auth, callback) => {
+  const token = typeof callback === "function" ? await callback(auth) : callback;
+  if (!token) {
+    return;
+  }
+  if (auth.scheme === "bearer") {
+    return `Bearer ${token}`;
+  }
+  if (auth.scheme === "basic") {
+    return `Basic ${btoa(token)}`;
+  }
+  return token;
+};
+
+// src/generated/client/utils.gen.ts
+var createQuerySerializer = ({
+  parameters = {},
+  ...args
+} = {}) => {
+  const querySerializer = (queryParams) => {
+    const search = [];
+    if (queryParams && typeof queryParams === "object") {
+      for (const name in queryParams) {
+        const value = queryParams[name];
+        if (value === void 0 || value === null) {
+          continue;
+        }
+        const options = parameters[name] || args;
+        if (Array.isArray(value)) {
+          const serializedArray = serializeArrayParam({
+            allowReserved: options.allowReserved,
+            explode: true,
+            name,
+            style: "form",
+            value,
+            ...options.array
+          });
+          if (serializedArray) search.push(serializedArray);
+        } else if (typeof value === "object") {
+          const serializedObject = serializeObjectParam({
+            allowReserved: options.allowReserved,
+            explode: true,
+            name,
+            style: "deepObject",
+            value,
+            ...options.object
+          });
+          if (serializedObject) search.push(serializedObject);
+        } else {
+          const serializedPrimitive = serializePrimitiveParam({
+            allowReserved: options.allowReserved,
+            name,
+            value
+          });
+          if (serializedPrimitive) search.push(serializedPrimitive);
+        }
+      }
+    }
+    return search.join("&");
+  };
+  return querySerializer;
+};
+var getParseAs = (contentType) => {
+  if (!contentType) {
+    return "stream";
+  }
+  const cleanContent = contentType.split(";")[0]?.trim();
+  if (!cleanContent) {
+    return;
+  }
+  if (cleanContent.startsWith("application/json") || cleanContent.endsWith("+json")) {
+    return "json";
+  }
+  if (cleanContent === "multipart/form-data") {
+    return "formData";
+  }
+  if (["application/", "audio/", "image/", "video/"].some(
+    (type) => cleanContent.startsWith(type)
+  )) {
+    return "blob";
+  }
+  if (cleanContent.startsWith("text/")) {
+    return "text";
+  }
+  return;
+};
+var checkForExistence = (options, name) => {
+  if (!name) {
+    return false;
+  }
+  if (options.headers.has(name) || options.query?.[name] || options.headers.get("Cookie")?.includes(`${name}=`)) {
+    return true;
+  }
+  return false;
+};
+async function setAuthParams(options) {
+  for (const auth of options.security ?? []) {
+    if (checkForExistence(options, auth.name)) {
+      continue;
+    }
+    const token = await getAuthToken(auth, options.auth);
+    if (!token) {
+      continue;
+    }
+    const name = auth.name ?? "Authorization";
+    switch (auth.in) {
+      case "query":
+        if (!options.query) {
+          options.query = {};
+        }
+        options.query[name] = token;
+        break;
+      case "cookie":
+        options.headers.append("Cookie", `${name}=${token}`);
+        break;
+      case "header":
+      default:
+        options.headers.set(name, token);
+        break;
+    }
+  }
+}
+var buildUrl = (options) => getUrl({
+  baseUrl: options.baseUrl,
+  path: options.path,
+  query: options.query,
+  querySerializer: typeof options.querySerializer === "function" ? options.querySerializer : createQuerySerializer(options.querySerializer),
+  url: options.url
+});
+var mergeConfigs = (a, b) => {
+  const config = { ...a, ...b };
+  if (config.baseUrl?.endsWith("/")) {
+    config.baseUrl = config.baseUrl.substring(0, config.baseUrl.length - 1);
+  }
+  config.headers = mergeHeaders(a.headers, b.headers);
+  return config;
+};
+var headersEntries = (headers) => {
+  const entries = [];
+  headers.forEach((value, key) => {
+    entries.push([key, value]);
+  });
+  return entries;
+};
+var mergeHeaders = (...headers) => {
+  const mergedHeaders = new Headers();
+  for (const header of headers) {
+    if (!header) {
+      continue;
+    }
+    const iterator = header instanceof Headers ? headersEntries(header) : Object.entries(header);
+    for (const [key, value] of iterator) {
+      if (value === null) {
+        mergedHeaders.delete(key);
+      } else if (Array.isArray(value)) {
+        for (const v of value) {
+          mergedHeaders.append(key, v);
+        }
+      } else if (value !== void 0) {
+        mergedHeaders.set(
+          key,
+          typeof value === "object" ? JSON.stringify(value) : value
+        );
+      }
+    }
+  }
+  return mergedHeaders;
+};
+var Interceptors = class {
+  fns = [];
+  clear() {
+    this.fns = [];
+  }
+  eject(id) {
+    const index = this.getInterceptorIndex(id);
+    if (this.fns[index]) {
+      this.fns[index] = null;
+    }
+  }
+  exists(id) {
+    const index = this.getInterceptorIndex(id);
+    return Boolean(this.fns[index]);
+  }
+  getInterceptorIndex(id) {
+    if (typeof id === "number") {
+      return this.fns[id] ? id : -1;
+    }
+    return this.fns.indexOf(id);
+  }
+  update(id, fn) {
+    const index = this.getInterceptorIndex(id);
+    if (this.fns[index]) {
+      this.fns[index] = fn;
+      return id;
+    }
+    return false;
+  }
+  use(fn) {
+    this.fns.push(fn);
+    return this.fns.length - 1;
+  }
+};
+var createInterceptors = () => ({
+  error: new Interceptors(),
+  request: new Interceptors(),
+  response: new Interceptors()
+});
+var defaultQuerySerializer = createQuerySerializer({
+  allowReserved: false,
+  array: {
+    explode: true,
+    style: "form"
+  },
+  object: {
+    explode: true,
+    style: "deepObject"
+  }
+});
+var defaultHeaders = {
+  "Content-Type": "application/json"
+};
+var createConfig = (override = {}) => ({
+  ...jsonBodySerializer,
+  headers: defaultHeaders,
+  parseAs: "auto",
+  querySerializer: defaultQuerySerializer,
+  ...override
+});
+
+// src/generated/client/client.gen.ts
+var createClient = (config = {}) => {
+  let _config = mergeConfigs(createConfig(), config);
+  const getConfig = () => ({ ..._config });
+  const setConfig = (config2) => {
+    _config = mergeConfigs(_config, config2);
+    return getConfig();
+  };
+  const interceptors = createInterceptors();
+  const beforeRequest = async (options) => {
+    const opts = {
+      ..._config,
+      ...options,
+      fetch: options.fetch ?? _config.fetch ?? globalThis.fetch,
+      headers: mergeHeaders(_config.headers, options.headers),
+      serializedBody: void 0
+    };
+    if (opts.security) {
+      await setAuthParams(opts);
+    }
+    if (opts.requestValidator) {
+      await opts.requestValidator(opts);
+    }
+    if (opts.body !== void 0 && opts.bodySerializer) {
+      opts.serializedBody = opts.bodySerializer(opts.body);
+    }
+    if (opts.body === void 0 || opts.serializedBody === "") {
+      opts.headers.delete("Content-Type");
+    }
+    const resolvedOpts = opts;
+    const url = buildUrl(resolvedOpts);
+    return { opts: resolvedOpts, url };
+  };
+  const request = async (options) => {
+    const throwOnError = options.throwOnError ?? _config.throwOnError;
+    const responseStyle = options.responseStyle ?? _config.responseStyle;
+    let request2;
+    let response;
+    try {
+      const { opts, url } = await beforeRequest(options);
+      const requestInit = {
+        redirect: "follow",
+        ...opts,
+        body: getValidRequestBody(opts)
+      };
+      request2 = new Request(url, requestInit);
+      for (const fn of interceptors.request.fns) {
+        if (fn) {
+          request2 = await fn(request2, opts);
+        }
+      }
+      const _fetch = opts.fetch;
+      response = await _fetch(request2);
+      for (const fn of interceptors.response.fns) {
+        if (fn) {
+          response = await fn(response, request2, opts);
+        }
+      }
+      const result = {
+        request: request2,
+        response
+      };
+      if (response.ok) {
+        const parseAs = (opts.parseAs === "auto" ? getParseAs(response.headers.get("Content-Type")) : opts.parseAs) ?? "json";
+        if (response.status === 204 || response.headers.get("Content-Length") === "0") {
+          let emptyData;
+          switch (parseAs) {
+            case "arrayBuffer":
+            case "blob":
+            case "text":
+              emptyData = await response[parseAs]();
+              break;
+            case "formData":
+              emptyData = new FormData();
+              break;
+            case "stream":
+              emptyData = response.body;
+              break;
+            case "json":
+            default:
+              emptyData = {};
+              break;
+          }
+          return opts.responseStyle === "data" ? emptyData : {
+            data: emptyData,
+            ...result
+          };
+        }
+        let data;
+        switch (parseAs) {
+          case "arrayBuffer":
+          case "blob":
+          case "formData":
+          case "text":
+            data = await response[parseAs]();
+            break;
+          case "json": {
+            const text = await response.text();
+            data = text ? JSON.parse(text) : {};
+            break;
+          }
+          case "stream":
+            return opts.responseStyle === "data" ? response.body : {
+              data: response.body,
+              ...result
+            };
+        }
+        if (parseAs === "json") {
+          if (opts.responseValidator) {
+            await opts.responseValidator(data);
+          }
+          if (opts.responseTransformer) {
+            data = await opts.responseTransformer(data);
+          }
+        }
+        return opts.responseStyle === "data" ? data : {
+          data,
+          ...result
+        };
+      }
+      const textError = await response.text();
+      let jsonError;
+      try {
+        jsonError = JSON.parse(textError);
+      } catch {
+      }
+      throw jsonError ?? textError;
+    } catch (error) {
+      let finalError = error;
+      for (const fn of interceptors.error.fns) {
+        if (fn) {
+          finalError = await fn(
+            finalError,
+            response,
+            request2,
+            options
+          );
+        }
+      }
+      finalError = finalError || {};
+      if (throwOnError) {
+        throw finalError;
+      }
+      return responseStyle === "data" ? void 0 : {
+        error: finalError,
+        request: request2,
+        response
+      };
+    }
+  };
+  const makeMethodFn = (method) => (options) => request({ ...options, method });
+  const makeSseFn = (method) => async (options) => {
+    const { opts, url } = await beforeRequest(options);
+    return createSseClient({
+      ...opts,
+      body: opts.body,
+      method,
+      onRequest: async (url2, init) => {
+        let request2 = new Request(url2, init);
+        for (const fn of interceptors.request.fns) {
+          if (fn) {
+            request2 = await fn(request2, opts);
+          }
+        }
+        return request2;
+      },
+      serializedBody: getValidRequestBody(opts),
+      url
+    });
+  };
+  const _buildUrl = (options) => buildUrl({ ..._config, ...options });
+  return {
+    buildUrl: _buildUrl,
+    connect: makeMethodFn("CONNECT"),
+    delete: makeMethodFn("DELETE"),
+    get: makeMethodFn("GET"),
+    getConfig,
+    head: makeMethodFn("HEAD"),
+    interceptors,
+    options: makeMethodFn("OPTIONS"),
+    patch: makeMethodFn("PATCH"),
+    post: makeMethodFn("POST"),
+    put: makeMethodFn("PUT"),
+    request,
+    setConfig,
+    sse: {
+      connect: makeSseFn("CONNECT"),
+      delete: makeSseFn("DELETE"),
+      get: makeSseFn("GET"),
+      head: makeSseFn("HEAD"),
+      options: makeSseFn("OPTIONS"),
+      patch: makeSseFn("PATCH"),
+      post: makeSseFn("POST"),
+      put: makeSseFn("PUT"),
+      trace: makeSseFn("TRACE")
+    },
+    trace: makeMethodFn("TRACE")
+  };
+};
 
 // src/http.ts
 var IDEMPOTENT = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
@@ -69,13 +892,6 @@ function backoffMs(attempt, opts, random) {
   const jitter = exp * 0.5 * random();
   return Math.min(exp + jitter, opts.maxDelayMs);
 }
-function withBearer(input, init, token) {
-  const headers = new Headers(
-    init?.headers ?? (input instanceof Request ? input.headers : void 0)
-  );
-  headers.set("Authorization", `Bearer ${token}`);
-  return { ...init, headers };
-}
 function createFetch(deps) {
   const baseFetch = deps.fetch ?? fetch;
   const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
@@ -89,21 +905,37 @@ function createFetch(deps) {
   return async function wrappedFetch(input, init) {
     const method = methodOf(input, init);
     const idempotent = IDEMPOTENT.has(method);
+    const isRequest = input instanceof Request;
     let refreshed = false;
     let attempt = 0;
+    let retryToken;
+    const dispatch = (authToken) => {
+      if (isRequest) {
+        const fresh = input.clone();
+        if (authToken === void 0) return baseFetch(fresh);
+        const headers = new Headers(fresh.headers);
+        headers.set("Authorization", `Bearer ${authToken}`);
+        return baseFetch(new Request(fresh, { headers }));
+      }
+      const nextInit = authToken === void 0 ? init : (() => {
+        const headers = new Headers(init?.headers);
+        headers.set("Authorization", `Bearer ${authToken}`);
+        return { ...init, headers };
+      })();
+      return baseFetch(input, nextInit);
+    };
     for (; ; ) {
       let response;
       let networkError;
       try {
-        response = await baseFetch(input, init);
+        response = await dispatch(retryToken);
       } catch (err) {
         networkError = err;
       }
-      const replayable = !(input instanceof Request && input.bodyUsed);
-      if (response?.status === 401 && !refreshed && replayable && deps.tokenManager?.canRefresh) {
+      if (response?.status === 401 && !refreshed && deps.tokenManager?.canRefresh) {
         refreshed = true;
         const next = await deps.tokenManager.refresh();
-        init = withBearer(input, init, next.accessToken);
+        retryToken = next.accessToken;
         continue;
       }
       if (response?.status === 429 && attempt < retry.maxRetries) {
@@ -126,10 +958,11 @@ function createFetch(deps) {
 // src/oauth.ts
 var import_node_crypto = require("crypto");
 var DEFAULT_AUTHORIZE_BASE_URL = "https://wefunder.com/oauth";
-var DEFAULT_TOKEN_BASE_URL = "https://wefunder.com/oauth";
+var SANDBOX_AUTHORIZE_BASE_URL = "https://oauth.wefunder-sandbox.com/oauth";
+var DEFAULT_TOKEN_BASE_URL = "https://api.wefunder.com/oauth";
 var DEFAULT_OAUTH_BASE_URL = DEFAULT_AUTHORIZE_BASE_URL;
-function resolveAuthorizeBase(o) {
-  return o.authorizeBaseUrl ?? o.oauthBaseUrl ?? DEFAULT_AUTHORIZE_BASE_URL;
+function defaultAuthorizeBase(clientId) {
+  return clientId.startsWith("pk_test_") ? SANDBOX_AUTHORIZE_BASE_URL : DEFAULT_AUTHORIZE_BASE_URL;
 }
 function resolveTokenBase(o) {
   return o.tokenBaseUrl ?? o.oauthBaseUrl ?? DEFAULT_TOKEN_BASE_URL;
@@ -169,7 +1002,7 @@ function generatePkce() {
   return { codeVerifier, codeChallenge, codeChallengeMethod: "S256" };
 }
 function createAuthorizationUrl(opts) {
-  const base = resolveAuthorizeBase(opts);
+  const base = opts.authorizeBaseUrl ?? opts.oauthBaseUrl ?? defaultAuthorizeBase(opts.clientId);
   const q = new URLSearchParams({
     response_type: "code",
     client_id: opts.clientId,
@@ -243,6 +1076,20 @@ var WefunderAuthError = class extends WefunderError {
 };
 
 // src/token-manager.ts
+var WefunderTokenPersistenceError = class extends Error {
+  tokens;
+  constructor(tokens, cause) {
+    super(
+      `Token store failed to save the rotated token set: ${cause instanceof Error ? cause.message : String(cause)}`,
+      { cause }
+    );
+    this.name = "WefunderTokenPersistenceError";
+    this.tokens = tokens;
+  }
+};
+function sameTokenSet(a, b) {
+  return a.accessToken === b.accessToken && a.refreshToken === b.refreshToken;
+}
 var TokenManager = class {
   #tokens;
   #clientId;
@@ -255,6 +1102,7 @@ var TokenManager = class {
   #now;
   #leeway;
   #inflight;
+  #pending;
   constructor(opts) {
     this.#tokens = opts.tokens;
     this.#clientId = opts.clientId;
@@ -267,15 +1115,40 @@ var TokenManager = class {
     this.#now = opts.now ?? Date.now;
     this.#leeway = opts.expiryLeewayMs ?? 3e4;
   }
+  /** The durable, in-use token set. A rotated set that could not be persisted sits in `pendingTokens`. */
   get current() {
     return this.#tokens;
   }
   /** True if the manager can recover an expired token (rotate a refresh token or re-mint). */
   get canRefresh() {
-    return Boolean(this.#tokens.refreshToken && this.#clientId || this.#reMint);
+    return Boolean(
+      this.#tokens.refreshToken && this.#clientId || this.#reMint
+    );
+  }
+  /** A rotated set awaiting a successful `store.save` (see `WefunderTokenPersistenceError`). */
+  get pendingTokens() {
+    return this.#pending;
   }
-  /** Returns a valid access token, refreshing proactively if it's expired/near-expiry. */
+  /**
+   * Tell the manager you persisted `tokens` (the set from a `WefunderTokenPersistenceError`)
+   * yourself. Publishes it only if it is still the pending set — a stale acknowledgment (the
+   * manager has since rotated again) is a no-op and returns false, so an older save can never
+   * publish a newer, unsaved set.
+   */
+  async markPersisted(tokens) {
+    const pending = this.#pending;
+    if (!pending || !sameTokenSet(pending, tokens)) return false;
+    this.#pending = void 0;
+    this.#tokens = pending;
+    return true;
+  }
+  /**
+   * Returns a valid access token, refreshing proactively if it's expired/near-expiry. If a
+   * rotated set is pending persistence, the save is retried first — no request uses an
+   * undurable token.
+   */
   async getAccessToken() {
+    if (this.#pending) await this.refresh();
     const { expiresAt } = this.#tokens;
     if (expiresAt !== void 0 && this.#now() >= expiresAt - this.#leeway && this.canRefresh) {
       await this.refresh();
@@ -289,6 +1162,14 @@ var TokenManager = class {
    */
   async refresh() {
     if (this.#inflight) return this.#inflight;
+    if (this.#pending) {
+      this.#inflight = this.#publishPending();
+      try {
+        return await this.#inflight;
+      } finally {
+        this.#inflight = void 0;
+      }
+    }
     const strategy = this.#recoveryStrategy();
     if (!strategy) {
       throw new WefunderAuthError(
@@ -296,11 +1177,8 @@ var TokenManager = class {
       );
     }
     this.#inflight = (async () => {
-      const next = await strategy();
-      this.#tokens = next;
-      await this.#store?.save(next);
-      await this.#onTokenRefresh?.(next);
-      return next;
+      this.#pending = await strategy();
+      return this.#publishPending();
     })();
     try {
       return await this.#inflight;
@@ -308,6 +1186,22 @@ var TokenManager = class {
       this.#inflight = void 0;
     }
   }
+  // Persist BEFORE publishing: no caller may use the rotated token until it is durable, and a
+  // failed save must not leave the process working in memory but unable to reconnect after a
+  // restart. On failure the set stays pending and WefunderTokenPersistenceError is thrown; the
+  // next call retries the save.
+  async #publishPending() {
+    const tokens = this.#pending;
+    try {
+      await this.#store?.save(tokens);
+      await this.#onTokenRefresh?.(tokens);
+    } catch (err) {
+      throw new WefunderTokenPersistenceError(tokens, err);
+    }
+    this.#pending = void 0;
+    this.#tokens = tokens;
+    return tokens;
+  }
   // Pick the recovery strategy: refresh_token rotation, else cc re-mint, else none.
   #recoveryStrategy() {
     const refreshTokenValue = this.#tokens.refreshToken;
@@ -357,21 +1251,36 @@ var sdk_gen_exports = {};
 __export(sdk_gen_exports, {
   approveSyndicateMember: () => approveSyndicateMember,
   closeSyndicateDeal: () => closeSyndicateDeal,
+  createInstallation: () => createInstallation,
+  createInstallationToken: () => createInstallationToken,
   createIntent: () => createIntent,
   createPartnerInvite: () => createPartnerInvite,
+  createWebhookEndpoint: () => createWebhookEndpoint,
   createWebhookSubscription: () => createWebhookSubscription,
+  deleteWebhookEndpoint: () => deleteWebhookEndpoint,
   deleteWebhookSubscription: () => deleteWebhookSubscription,
   demoteSyndicateMember: () => demoteSyndicateMember,
   exportSyndicateMembersCsv: () => exportSyndicateMembersCsv,
   finalizeSyndicateDeal: () => finalizeSyndicateDeal,
+  followCompany: () => followCompany,
   getAttributionMe: () => getAttributionMe,
   getAttributionStats: () => getAttributionStats,
+  getCompany: () => getCompany,
+  getCompanyDisclosures: () => getCompanyDisclosures,
+  getCompanyPitch: () => getCompanyPitch,
+  getCompanyUpdate: () => getCompanyUpdate,
   getCurrentUser: () => getCurrentUser,
+  getInstallation: () => getInstallation,
   getIntent: () => getIntent,
+  getInvestment: () => getInvestment,
   getOffering: () => getOffering,
+  getOfferingStats: () => getOfferingStats,
+  getPortfolio: () => getPortfolio,
   getSyndicate: () => getSyndicate,
   getSyndicateDeal: () => getSyndicateDeal,
+  getSyndicatePortfolio: () => getSyndicatePortfolio,
   getSyndicateStatistics: () => getSyndicateStatistics,
+  getWebhookEndpoint: () => getWebhookEndpoint,
   getWebhookSubscription: () => getWebhookSubscription,
   hideSyndicateMember: () => hideSyndicateMember,
   inviteSyndicateMember: () => inviteSyndicateMember,
@@ -379,19 +1288,31 @@ __export(sdk_gen_exports, {
   listAttributedInvestments: () => listAttributedInvestments,
   listAttributionCampaigns: () => listAttributionCampaigns,
   listCampaigns: () => listCampaigns,
+  listCompanyInvestmentChanges: () => listCompanyInvestmentChanges,
+  listCompanyQuestions: () => listCompanyQuestions,
+  listCompanyUpdates: () => listCompanyUpdates,
   listConnectedApps: () => listConnectedApps,
+  listEligibleInstallTargets: () => listEligibleInstallTargets,
+  listFollowedCompanies: () => listFollowedCompanies,
+  listInstallations: () => listInstallations,
   listIntents: () => listIntents,
   listInvestments: () => listInvestments,
+  listMyCompanies: () => listMyCompanies,
   listOfferings: () => listOfferings,
   listPartnerInvites: () => listPartnerInvites,
+  listPortfolioPositions: () => listPortfolioPositions,
   listSyndicateDealInvestors: () => listSyndicateDealInvestors,
   listSyndicateDeals: () => listSyndicateDeals,
   listSyndicateMemberInvestments: () => listSyndicateMemberInvestments,
   listSyndicateMembers: () => listSyndicateMembers,
+  listSyndicatePortfolioPositions: () => listSyndicatePortfolioPositions,
   listSyndicates: () => listSyndicates,
+  listWebhookEndpoints: () => listWebhookEndpoints,
   listWebhookSubscriptions: () => listWebhookSubscriptions,
+  previewIntent: () => previewIntent,
   promoteSyndicateMember: () => promoteSyndicateMember,
   reactivateWebhookSubscription: () => reactivateWebhookSubscription,
+  reenableWebhookEndpoint: () => reenableWebhookEndpoint,
   regenerateWebhookSecret: () => regenerateWebhookSecret,
   registerAsPartner: () => registerAsPartner,
   removeSyndicateMember: () => removeSyndicateMember,
@@ -399,628 +1320,500 @@ __export(sdk_gen_exports, {
   resendSyndicateInvite: () => resendSyndicateInvite,
   restoreSyndicateMember: () => restoreSyndicateMember,
   revokeConnectedApp: () => revokeConnectedApp,
+  revokeInstallation: () => revokeInstallation,
   revokePartnerInvite: () => revokePartnerInvite,
+  rotateWebhookEndpointSecret: () => rotateWebhookEndpointSecret,
+  searchCompanies: () => searchCompanies,
+  testWebhookEndpoint: () => testWebhookEndpoint,
   testWebhookSubscription: () => testWebhookSubscription,
+  unfollowCompany: () => unfollowCompany,
   updateSyndicate: () => updateSyndicate,
-  updateSyndicateMember: () => updateSyndicateMember
+  updateSyndicateMember: () => updateSyndicateMember,
+  updateWebhookEndpoint: () => updateWebhookEndpoint
 });
 
 // src/generated/client.gen.ts
-var import_client_fetch = require("@hey-api/client-fetch");
-var client = (0, import_client_fetch.createClient)((0, import_client_fetch.createConfig)());
+var client = createClient(
+  createConfig({ baseUrl: "https://api.wefunder.com" })
+);
 
 // src/generated/sdk.gen.ts
-var listOfferings = (options) => {
-  return (options?.client ?? client).get({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/explore",
-    ...options
-  });
-};
-var getOffering = (options) => {
-  return (options.client ?? client).get({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/offerings/{external_id}",
-    ...options
-  });
-};
-var getCurrentUser = (options) => {
-  return (options?.client ?? client).get({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/users/me",
-    ...options
-  });
-};
-var listInvestments = (options) => {
-  return (options?.client ?? client).get({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/investments",
-    ...options
-  });
-};
-var listCampaigns = (options) => {
-  return (options?.client ?? client).get({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/campaigns",
-    ...options
-  });
-};
-var listSyndicates = (options) => {
-  return (options?.client ?? client).get({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/syndicates",
-    ...options
-  });
-};
-var getSyndicate = (options) => {
-  return (options.client ?? client).get({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/syndicates/{syndicate_id}",
-    ...options
-  });
-};
-var updateSyndicate = (options) => {
-  return (options.client ?? client).patch({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/syndicates/{syndicate_id}",
-    ...options,
-    headers: {
-      "Content-Type": "application/json",
-      ...options?.headers
-    }
-  });
-};
-var listSyndicateMembers = (options) => {
-  return (options.client ?? client).get({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/syndicates/{syndicate_id}/members",
-    ...options
-  });
-};
-var inviteSyndicateMember = (options) => {
-  return (options.client ?? client).post({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/syndicates/{syndicate_id}/members/invite",
-    ...options,
-    headers: {
-      "Content-Type": "application/json",
-      ...options?.headers
-    }
-  });
-};
-var removeSyndicateMember = (options) => {
-  return (options.client ?? client).delete({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/syndicates/{syndicate_id}/members/{member_id}",
-    ...options
-  });
-};
-var updateSyndicateMember = (options) => {
-  return (options.client ?? client).patch({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/syndicates/{syndicate_id}/members/{member_id}",
-    ...options,
-    headers: {
-      "Content-Type": "application/json",
-      ...options?.headers
-    }
-  });
-};
-var approveSyndicateMember = (options) => {
-  return (options.client ?? client).post({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/syndicates/{syndicate_id}/members/{member_id}/approve",
-    ...options
-  });
-};
-var hideSyndicateMember = (options) => {
-  return (options.client ?? client).post({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/syndicates/{syndicate_id}/members/{member_id}/hide",
-    ...options
-  });
-};
-var promoteSyndicateMember = (options) => {
-  return (options.client ?? client).post({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/syndicates/{syndicate_id}/members/{member_id}/promote",
-    ...options
-  });
-};
-var demoteSyndicateMember = (options) => {
-  return (options.client ?? client).post({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/syndicates/{syndicate_id}/members/{member_id}/demote",
-    ...options
-  });
-};
-var restoreSyndicateMember = (options) => {
-  return (options.client ?? client).post({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/syndicates/{syndicate_id}/members/{member_id}/restore",
-    ...options
-  });
-};
-var resendSyndicateInvite = (options) => {
-  return (options.client ?? client).post({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/syndicates/{syndicate_id}/members/{member_id}/resend_invite",
-    ...options
-  });
-};
-var reorderSyndicateMembers = (options) => {
-  return (options.client ?? client).post({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/syndicates/{syndicate_id}/members/reorder",
-    ...options,
-    headers: {
-      "Content-Type": "application/json",
-      ...options?.headers
-    }
-  });
-};
-var exportSyndicateMembersCsv = (options) => {
-  return (options.client ?? client).post({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/syndicates/{syndicate_id}/members/export_csv",
-    ...options
-  });
-};
-var listSyndicateDeals = (options) => {
-  return (options.client ?? client).get({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/syndicates/{syndicate_id}/deals",
-    ...options
-  });
-};
-var getSyndicateDeal = (options) => {
-  return (options.client ?? client).get({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/syndicates/{syndicate_id}/deals/{fundraise_id}",
-    ...options
-  });
-};
-var listSyndicateDealInvestors = (options) => {
-  return (options.client ?? client).get({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/syndicates/{syndicate_id}/deals/{fundraise_id}/investors",
-    ...options
-  });
-};
-var listSyndicateMemberInvestments = (options) => {
-  return (options.client ?? client).get({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/syndicates/{syndicate_id}/members/{member_id}/investments",
-    ...options
-  });
-};
-var getSyndicateStatistics = (options) => {
-  return (options.client ?? client).get({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/syndicates/{syndicate_id}/statistics",
-    ...options
-  });
-};
-var closeSyndicateDeal = (options) => {
-  return (options.client ?? client).post({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/syndicates/{syndicate_id}/deals/{fundraise_id}/close",
-    ...options
-  });
-};
-var finalizeSyndicateDeal = (options) => {
-  return (options.client ?? client).post({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/syndicates/{syndicate_id}/deals/{fundraise_id}/finalize",
-    ...options
-  });
-};
-var listIntents = (options) => {
-  return (options?.client ?? client).get({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/intents",
-    ...options
-  });
-};
-var createIntent = (options) => {
-  return (options.client ?? client).post({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/intents",
-    ...options,
-    headers: {
-      "Content-Type": "application/json",
-      ...options?.headers
+var listOfferings = (options) => (options?.client ?? client).get({
+  querySerializer: {
+    parameters: {
+      industry: { array: { explode: false } },
+      business_model: { array: { explode: false } }
     }
-  });
-};
-var getIntent = (options) => {
-  return (options.client ?? client).get({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/intents/{intent_id}",
-    ...options
-  });
-};
-var listActivity = (options) => {
-  return (options?.client ?? client).get({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/activity",
-    ...options
-  });
-};
-var listConnectedApps = (options) => {
-  return (options?.client ?? client).get({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/connected-apps",
-    ...options
-  });
-};
-var revokeConnectedApp = (options) => {
-  return (options.client ?? client).delete({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/connected-apps/{app_id}",
-    ...options
-  });
-};
-var getAttributionStats = (options) => {
-  return (options.client ?? client).get({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/campaigns/{campaign_id}/attribution/stats",
-    ...options
-  });
-};
-var listAttributedInvestments = (options) => {
-  return (options.client ?? client).get({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/campaigns/{campaign_id}/attribution/investments",
-    ...options
-  });
-};
-var listWebhookSubscriptions = (options) => {
-  return (options.client ?? client).get({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/campaigns/{campaign_id}/attribution/webhooks",
-    ...options
-  });
-};
-var createWebhookSubscription = (options) => {
-  return (options.client ?? client).post({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/campaigns/{campaign_id}/attribution/webhooks",
-    ...options,
-    headers: {
-      "Content-Type": "application/json",
-      ...options?.headers
-    }
-  });
-};
-var deleteWebhookSubscription = (options) => {
-  return (options.client ?? client).delete({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/campaigns/{campaign_id}/attribution/webhooks/{webhook_id}",
-    ...options
-  });
-};
-var getWebhookSubscription = (options) => {
-  return (options.client ?? client).get({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/campaigns/{campaign_id}/attribution/webhooks/{webhook_id}",
-    ...options
-  });
-};
-var testWebhookSubscription = (options) => {
-  return (options.client ?? client).post({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/campaigns/{campaign_id}/attribution/webhooks/{webhook_id}/test",
-    ...options
-  });
-};
-var regenerateWebhookSecret = (options) => {
-  return (options.client ?? client).post({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/campaigns/{campaign_id}/attribution/webhooks/{webhook_id}/regenerate_secret",
-    ...options
-  });
-};
-var reactivateWebhookSubscription = (options) => {
-  return (options.client ?? client).post({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/campaigns/{campaign_id}/attribution/webhooks/{webhook_id}/reactivate",
-    ...options
-  });
-};
-var getAttributionMe = (options) => {
-  return (options?.client ?? client).get({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/attribution/me",
-    ...options
-  });
-};
-var listAttributionCampaigns = (options) => {
-  return (options?.client ?? client).get({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/attribution/campaigns",
-    ...options
-  });
-};
-var registerAsPartner = (options) => {
-  return (options.client ?? client).post({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/attribution/partners/register",
-    ...options,
-    headers: {
-      "Content-Type": "application/json",
-      ...options?.headers
-    }
-  });
-};
-var listPartnerInvites = (options) => {
-  return (options?.client ?? client).get({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/attribution/invites",
-    ...options
-  });
-};
-var createPartnerInvite = (options) => {
-  return (options.client ?? client).post({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/attribution/invites",
-    ...options,
-    headers: {
-      "Content-Type": "application/json",
-      ...options?.headers
-    }
-  });
-};
-var revokePartnerInvite = (options) => {
-  return (options.client ?? client).delete({
-    security: [
-      {
-        scheme: "bearer",
-        type: "http"
-      }
-    ],
-    url: "/attribution/invites/{token}",
-    ...options
-  });
-};
+  },
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/explore",
+  ...options
+});
+var getOffering = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/offerings/{external_id}",
+  ...options
+});
+var getCompanyDisclosures = (options) => (options.client ?? client).get({
+  querySerializer: {
+    parameters: { sections: { array: { explode: false } } }
+  },
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/companies/{id}/disclosures",
+  ...options
+});
+var getCompanyPitch = (options) => (options.client ?? client).get({
+  querySerializer: {
+    parameters: { sections: { array: { explode: false } } }
+  },
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/companies/{id}/pitch",
+  ...options
+});
+var listCompanyUpdates = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/companies/{id}/updates",
+  ...options
+});
+var getCompanyUpdate = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/companies/{id}/updates/{update_id}",
+  ...options
+});
+var listCompanyQuestions = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/companies/{id}/questions",
+  ...options
+});
+var searchCompanies = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/companies/search",
+  ...options
+});
+var getCompany = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/companies/{id}",
+  ...options
+});
+var getCurrentUser = (options) => (options?.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/users/me",
+  ...options
+});
+var listMyCompanies = (options) => (options?.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/users/me/companies",
+  ...options
+});
+var listFollowedCompanies = (options) => (options?.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/users/me/follows",
+  ...options
+});
+var unfollowCompany = (options) => (options.client ?? client).delete({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/users/me/follows/{company_id}",
+  ...options
+});
+var followCompany = (options) => (options.client ?? client).put({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/users/me/follows/{company_id}",
+  ...options
+});
+var listInvestments = (options) => (options?.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/investments",
+  ...options
+});
+var getInvestment = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/investments/{id}",
+  ...options
+});
+var getOfferingStats = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/offerings/{offering_id}/stats",
+  ...options
+});
+var listCompanyInvestmentChanges = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/companies/{company_id}/investments/changes",
+  ...options
+});
+var getPortfolio = (options) => (options?.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/portfolio",
+  ...options
+});
+var listPortfolioPositions = (options) => (options?.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/portfolio/positions",
+  ...options
+});
+var listCampaigns = (options) => (options?.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/campaigns",
+  ...options
+});
+var listSyndicates = (options) => (options?.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/syndicates",
+  ...options
+});
+var getSyndicate = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/syndicates/{syndicate_id}",
+  ...options
+});
+var updateSyndicate = (options) => (options.client ?? client).patch({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/syndicates/{syndicate_id}",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var listSyndicateMembers = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/syndicates/{syndicate_id}/members",
+  ...options
+});
+var inviteSyndicateMember = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/syndicates/{syndicate_id}/members/invite",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var removeSyndicateMember = (options) => (options.client ?? client).delete({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/syndicates/{syndicate_id}/members/{member_id}",
+  ...options
+});
+var updateSyndicateMember = (options) => (options.client ?? client).patch({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/syndicates/{syndicate_id}/members/{member_id}",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var approveSyndicateMember = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/syndicates/{syndicate_id}/members/{member_id}/approve",
+  ...options
+});
+var hideSyndicateMember = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/syndicates/{syndicate_id}/members/{member_id}/hide",
+  ...options
+});
+var promoteSyndicateMember = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/syndicates/{syndicate_id}/members/{member_id}/promote",
+  ...options
+});
+var demoteSyndicateMember = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/syndicates/{syndicate_id}/members/{member_id}/demote",
+  ...options
+});
+var restoreSyndicateMember = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/syndicates/{syndicate_id}/members/{member_id}/restore",
+  ...options
+});
+var resendSyndicateInvite = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/syndicates/{syndicate_id}/members/{member_id}/resend_invite",
+  ...options
+});
+var reorderSyndicateMembers = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/syndicates/{syndicate_id}/members/reorder",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var exportSyndicateMembersCsv = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/syndicates/{syndicate_id}/members/export_csv",
+  ...options
+});
+var listSyndicateDeals = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/syndicates/{syndicate_id}/deals",
+  ...options
+});
+var getSyndicateDeal = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/syndicates/{syndicate_id}/deals/{fundraise_id}",
+  ...options
+});
+var listSyndicateDealInvestors = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/syndicates/{syndicate_id}/deals/{fundraise_id}/investors",
+  ...options
+});
+var listSyndicateMemberInvestments = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/syndicates/{syndicate_id}/members/{member_id}/investments",
+  ...options
+});
+var getSyndicateStatistics = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/syndicates/{syndicate_id}/statistics",
+  ...options
+});
+var getSyndicatePortfolio = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/syndicates/{syndicate_id}/portfolio",
+  ...options
+});
+var listSyndicatePortfolioPositions = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/syndicates/{syndicate_id}/portfolio/positions",
+  ...options
+});
+var closeSyndicateDeal = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/syndicates/{syndicate_id}/deals/{fundraise_id}/close",
+  ...options
+});
+var finalizeSyndicateDeal = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/syndicates/{syndicate_id}/deals/{fundraise_id}/finalize",
+  ...options
+});
+var previewIntent = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/intents/preview",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var listIntents = (options) => (options?.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/intents",
+  ...options
+});
+var createIntent = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/intents",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var getIntent = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/intents/{intent_id}",
+  ...options
+});
+var listActivity = (options) => (options?.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/activity",
+  ...options
+});
+var listConnectedApps = (options) => (options?.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/connected-apps",
+  ...options
+});
+var revokeConnectedApp = (options) => (options.client ?? client).delete({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/connected-apps/{app_id}",
+  ...options
+});
+var getAttributionStats = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/campaigns/{campaign_id}/attribution/stats",
+  ...options
+});
+var listAttributedInvestments = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/campaigns/{campaign_id}/attribution/investments",
+  ...options
+});
+var listInstallations = (options) => (options?.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/installations",
+  ...options
+});
+var createInstallation = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/installations",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var listEligibleInstallTargets = (options) => (options?.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/installations/eligible",
+  ...options
+});
+var revokeInstallation = (options) => (options.client ?? client).delete({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/installations/{external_id}",
+  ...options
+});
+var getInstallation = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/installations/{external_id}",
+  ...options
+});
+var createInstallationToken = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/installations/{external_id}/tokens",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var listWebhookEndpoints = (options) => (options?.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/webhook_endpoints",
+  ...options
+});
+var createWebhookEndpoint = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/webhook_endpoints",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var deleteWebhookEndpoint = (options) => (options.client ?? client).delete({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/webhook_endpoints/{external_id}",
+  ...options
+});
+var getWebhookEndpoint = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/webhook_endpoints/{external_id}",
+  ...options
+});
+var updateWebhookEndpoint = (options) => (options.client ?? client).patch({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/webhook_endpoints/{external_id}",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var rotateWebhookEndpointSecret = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/webhook_endpoints/{external_id}/rotate_secret",
+  ...options
+});
+var reenableWebhookEndpoint = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/webhook_endpoints/{external_id}/reenable",
+  ...options
+});
+var testWebhookEndpoint = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/webhook_endpoints/{external_id}/test",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var listWebhookSubscriptions = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/campaigns/{campaign_id}/attribution/webhooks",
+  ...options
+});
+var createWebhookSubscription = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/campaigns/{campaign_id}/attribution/webhooks",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var deleteWebhookSubscription = (options) => (options.client ?? client).delete({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/campaigns/{campaign_id}/attribution/webhooks/{webhook_id}",
+  ...options
+});
+var getWebhookSubscription = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/campaigns/{campaign_id}/attribution/webhooks/{webhook_id}",
+  ...options
+});
+var testWebhookSubscription = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/campaigns/{campaign_id}/attribution/webhooks/{webhook_id}/test",
+  ...options
+});
+var regenerateWebhookSecret = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/campaigns/{campaign_id}/attribution/webhooks/{webhook_id}/regenerate_secret",
+  ...options
+});
+var reactivateWebhookSubscription = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/campaigns/{campaign_id}/attribution/webhooks/{webhook_id}/reactivate",
+  ...options
+});
+var getAttributionMe = (options) => (options?.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/attribution/me",
+  ...options
+});
+var listAttributionCampaigns = (options) => (options?.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/attribution/campaigns",
+  ...options
+});
+var registerAsPartner = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/attribution/partners/register",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var listPartnerInvites = (options) => (options?.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/attribution/invites",
+  ...options
+});
+var createPartnerInvite = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/attribution/invites",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var revokePartnerInvite = (options) => (options.client ?? client).delete({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/attribution/invites/{token}",
+  ...options
+});
 
 // src/client.ts
-var DEFAULT_API_BASE_URL = "https://api.wefunder.com/api/v2";
+var DEFAULT_API_BASE_URL = "https://api.wefunder.com";
 var DEFAULT_API_VERSION = "2025-01-15";
 function modeForToken(token) {
   if (token.startsWith("at_live_")) return "live";
@@ -1067,7 +1860,7 @@ var Wefunder = class _Wefunder {
       random: opts.random,
       retry: opts.retry
     });
-    this.#client = (0, import_client_fetch2.createClient)({
+    this.#client = createClient({
       baseUrl: opts.baseUrl ?? DEFAULT_API_BASE_URL,
       headers: { "Wefunder-Version": opts.apiVersion ?? DEFAULT_API_VERSION },
       auth: () => this.#tokens.getAccessToken(),
@@ -1101,12 +1894,22 @@ var Wefunder = class _Wefunder {
     });
   }
   /** The live token set (e.g. to persist after construction). */
+  /** A rotated set awaiting a successful save (see `WefunderTokenPersistenceError`). */
+  get pendingTokens() {
+    return this.#tokens.pendingTokens;
+  }
+  /** Acknowledge an out-of-band save of `tokens`; false if that set is no longer pending. */
+  markPersisted(tokens) {
+    return this.#tokens.markPersisted(tokens);
+  }
   get tokens() {
     return this.#tokens.current;
   }
   // ---- unwrap: turn the {data,error,response} result into data-or-throw ----
   async #unwrap(p) {
     const { data, error, response } = await p;
+    if (error instanceof WefunderTokenPersistenceError || error instanceof WefunderError)
+      throw error;
     if (response && response.ok && error === void 0) return data;
     const status = response?.status ?? 0;
     const env = error ?? {};
@@ -1115,7 +1918,10 @@ var Wefunder = class _Wefunder {
       type: env.error?.type ?? "api_error",
       message: env.error?.message ?? response?.statusText ?? "Request failed",
       // X-Wf-Request-Id header is primary (present even on non-JSON edge errors).
-      requestId: requestIdFrom(response, env.error?.request_id ?? env.request_id),
+      requestId: requestIdFrom(
+        response,
+        env.error?.request_id ?? env.request_id
+      ),
       details: env.error?.details,
       remediation: env.error?.remediation
     });
@@ -1151,17 +1957,59 @@ var Wefunder = class _Wefunder {
     me: () => this.#unwrapData(getCurrentUser({ client: this.#client }))
   };
   offerings = {
-    list: this.#page(listOfferings),
+    list: this.#page(
+      listOfferings
+    ),
     all: (query) => paginate((cursor) => this.offerings.list({ ...query, cursor })),
     collect: (query) => collect((cursor) => this.offerings.list({ ...query, cursor })),
     get: (externalId) => this.#unwrapData(
-      getOffering({ client: this.#client, path: { external_id: externalId } })
+      getOffering({
+        client: this.#client,
+        path: { external_id: externalId }
+      })
     )
   };
+  /**
+   * Investments (`read:investments`). `list` is a bootstrap listing; pass `updated_since`
+   * or a saved `cursor` for sync mode (`meta.mode === "delta"`). Persist `meta.next_cursor`
+   * from your last page — it is always present — and resume from it next time.
+   */
   investments = {
-    list: this.#page(listInvestments),
-    all: () => paginate((cursor) => this.investments.list({ cursor })),
-    collect: () => collect((cursor) => this.investments.list({ cursor }))
+    list: this.#page(
+      listInvestments
+    ),
+    all: (query) => paginate(
+      (cursor) => this.investments.list({
+        ...query,
+        cursor
+      })
+    ),
+    collect: (query) => collect(
+      (cursor) => this.investments.list({
+        ...query,
+        cursor
+      })
+    ),
+    /** The current record (not the published projection) for one investment (`inv_…`). */
+    get: (id) => this.#unwrapData(
+      getInvestment({ client: this.#client, path: { id } })
+    )
+  };
+  portfolio = {
+    get: (query) => this.#unwrapData(
+      getPortfolio({ client: this.#client, query })
+    ),
+    positions: {
+      list: this.#page(
+        listPortfolioPositions
+      ),
+      all: (query) => paginate(
+        (cursor) => this.portfolio.positions.list({ ...query, cursor })
+      ),
+      collect: (query) => collect(
+        (cursor) => this.portfolio.positions.list({ ...query, cursor })
+      )
+    }
   };
   campaigns = {
     list: this.#page(listCampaigns),
@@ -1169,29 +2017,116 @@ var Wefunder = class _Wefunder {
     collect: () => collect((cursor) => this.campaigns.list({ cursor }))
   };
   syndicates = {
-    list: this.#page(listSyndicates),
-    all: () => paginate((cursor) => this.syndicates.list({ cursor })),
-    get: (id) => this.#unwrapData(getSyndicate({ client: this.#client, path: { id } }))
+    list: this.#page(
+      listSyndicates
+    ),
+    all: (query) => paginate((cursor) => this.syndicates.list({ ...query, cursor })),
+    get: (id) => this.#unwrapData(
+      getSyndicate({ client: this.#client, path: { id } })
+    )
   };
   intents = {
     list: this.#page(listIntents),
-    all: () => paginate((cursor) => this.intents.list({ cursor })),
-    get: (id) => this.#unwrapData(getIntent({ client: this.#client, path: { id } }))
+    all: (query) => paginate((cursor) => this.intents.list({ ...query, cursor })),
+    get: (id) => this.#unwrapData(
+      getIntent({ client: this.#client, path: { id } })
+    )
   };
   attribution = {
-    me: () => this.#unwrapData(getAttributionMe({ client: this.#client }))
+    me: () => this.#unwrapData(
+      getAttributionMe({ client: this.#client })
+    )
+  };
+  /**
+   * Webhook endpoints (`/webhook_endpoints`, scopes `read:webhooks` / `write:webhooks`).
+   * Endpoints belong to your application and are managed through the LIVE API —
+   * create sandbox receivers there with `mode: "test"`; they're mirrored into
+   * sandbox. The signing `secret` is returned ONLY by `create` and `rotateSecret`.
+   * Verify deliveries with `constructEvent` (see the webhooks module).
+   */
+  webhookEndpoints = {
+    /** All of your app's endpoints (secret omitted). `meta.quota` is the per-app limit. */
+    list: () => this.#unwrap(
+      listWebhookEndpoints({ client: this.#client })
+    ),
+    get: (id) => this.#unwrapData(
+      getWebhookEndpoint({
+        client: this.#client,
+        path: { external_id: id }
+      })
+    ),
+    /** Store `attributes.secret` from the result — it is never shown again. */
+    create: (input) => this.#unwrapData(
+      createWebhookEndpoint({ client: this.#client, body: input })
+    ),
+    /** `events` replaces the subscription list wholesale (no merge); omit to leave unchanged. */
+    update: (id, input) => this.#unwrapData(
+      updateWebhookEndpoint({
+        client: this.#client,
+        path: { external_id: id },
+        body: input
+      })
+    ),
+    /** Stops deliveries immediately. Removal is permanent — create a new endpoint to resume. */
+    remove: (id) => this.#unwrapData(
+      deleteWebhookEndpoint({
+        client: this.#client,
+        path: { external_id: id }
+      })
+    ),
+    /**
+     * New secret (shown once). The old one keeps signing for a 24h overlap — deliveries
+     * carry a `v1` for both, and `constructEvent` accepts either.
+     */
+    rotateSecret: (id) => this.#unwrapData(
+      rotateWebhookEndpointSecret({
+        client: this.#client,
+        path: { external_id: id }
+      })
+    ),
+    /** Recover an auto-disabled endpoint after fixing your server. Idempotent. */
+    reenable: (id) => this.#unwrapData(
+      reenableWebhookEndpoint({
+        client: this.#client,
+        path: { external_id: id }
+      })
+    ),
+    /**
+     * POST a real, signed example event at the endpoint (production envelope + signature)
+     * and report the outcome inline. Defaults to the endpoint's first subscribed event.
+     * Doesn't affect delivery health. Rate-limited to 10/min per endpoint.
+     */
+    test: (id, event) => this.#unwrapData(
+      testWebhookEndpoint({
+        client: this.#client,
+        path: { external_id: id },
+        body: event ? { event } : void 0
+      })
+    )
   };
 };
 
 // src/webhooks.ts
 var import_node_crypto2 = require("crypto");
-var SIGNATURE_HEADER = "x-wefunder-signature";
-var TIMESTAMP_HEADER = "x-wefunder-timestamp";
-var EVENT_HEADER = "x-wefunder-event";
-var DELIVERY_ID_HEADER = "x-wefunder-delivery-id";
-function computeSignature(secret, timestamp, payload) {
-  const mac = (0, import_node_crypto2.createHmac)("sha256", secret).update(`${timestamp}.${payload}`).digest("hex");
-  return `sha256=${mac}`;
+var SIGNATURE_HEADER = "wefunder-signature";
+var DEFAULT_TOLERANCE_SECONDS = 300;
+var LEGACY_SIGNATURE_HEADER = "x-wefunder-signature";
+var LEGACY_TIMESTAMP_HEADER = "x-wefunder-timestamp";
+var LEGACY_EVENT_HEADER = "x-wefunder-event";
+var LEGACY_DELIVERY_ID_HEADER = "x-wefunder-delivery-id";
+var WebhookSignatureError = class extends Error {
+  reason;
+  constructor(reason, message) {
+    super(message);
+    this.name = "WebhookSignatureError";
+    this.reason = reason;
+  }
+};
+function bodyBuffer(payload) {
+  return typeof payload === "string" ? Buffer.from(payload, "utf8") : Buffer.from(payload);
+}
+function computeWebhookSignature(secret, timestamp, payload) {
+  return (0, import_node_crypto2.createHmac)("sha256", secret).update(`${timestamp}.`).update(bodyBuffer(payload)).digest("hex");
 }
 function constantTimeEqual(a, b) {
   const ab = Buffer.from(a);
@@ -1199,42 +2134,142 @@ function constantTimeEqual(a, b) {
   if (ab.length !== bb.length) return false;
   return (0, import_node_crypto2.timingSafeEqual)(ab, bb);
 }
+function parseSignatureHeader(header) {
+  let timestamp;
+  const signatures = [];
+  for (const part of header.split(",")) {
+    const eq = part.indexOf("=");
+    if (eq < 0) continue;
+    const key = part.slice(0, eq).trim();
+    const value = part.slice(eq + 1).trim();
+    if (key === "t") {
+      if (!/^\d+$/.test(value)) return null;
+      timestamp = Number(value);
+    } else if (key === "v1" && value) {
+      signatures.push(value);
+    }
+  }
+  if (timestamp === void 0 || signatures.length === 0) return null;
+  return { timestamp, signatures };
+}
+function signWebhook(opts) {
+  const t = opts.timestamp ?? Math.floor(Date.now() / 1e3);
+  const secrets = [opts.secret, ...opts.additionalSecrets ?? []];
+  const entries = secrets.map((s) => `v1=${computeWebhookSignature(s, t, opts.payload)}`);
+  return [`t=${t}`, ...entries].join(",");
+}
+function checkWebhookSignature(opts) {
+  const parsed = parseSignatureHeader(opts.header);
+  if (!parsed) return "malformed_header";
+  const tolerance = opts.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS;
+  if (tolerance > 0) {
+    const nowSec = (opts.now ?? Date.now)() / 1e3;
+    if (Math.abs(nowSec - parsed.timestamp) > tolerance) return "timestamp_out_of_tolerance";
+  }
+  const expected = computeWebhookSignature(opts.secret, parsed.timestamp, opts.payload);
+  return parsed.signatures.some((sig) => constantTimeEqual(sig, expected)) ? null : "signature_mismatch";
+}
 function verifyWebhook(opts) {
-  const tolerance = opts.toleranceSeconds ?? 300;
-  const now = (opts.now ?? Date.now)();
+  if ("header" in opts) return checkWebhookSignature(opts) === null;
+  return verifyLegacyWebhook(opts);
+}
+function verifyLegacyWebhook(opts) {
+  const tolerance = opts.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS;
   const ts = Number(opts.timestamp);
   if (!Number.isFinite(ts)) return false;
-  if (tolerance > 0 && Math.abs(now / 1e3 - ts) > tolerance) return false;
-  const expected = computeSignature(opts.secret, opts.timestamp, opts.payload);
+  if (tolerance > 0 && Math.abs((opts.now ?? Date.now)() / 1e3 - ts) > tolerance) return false;
+  const expected = `sha256=${computeWebhookSignature(opts.secret, opts.timestamp, opts.payload)}`;
   return constantTimeEqual(opts.signature, expected);
 }
-function constructEvent(payload, headers, secret, opts) {
-  const get = (name) => {
-    if (headers instanceof Headers) return headers.get(name) ?? void 0;
-    const v = headers[name] ?? headers[name.toLowerCase()];
+function headerGetter(headers) {
+  if (typeof headers === "string") {
+    return (name) => name === SIGNATURE_HEADER ? headers : void 0;
+  }
+  if (headers instanceof Headers) return (name) => headers.get(name) ?? void 0;
+  return (name) => {
+    let v = headers[name];
+    if (v === void 0) {
+      const hit = Object.keys(headers).find((k) => k.toLowerCase() === name);
+      if (hit) v = headers[hit];
+    }
     return Array.isArray(v) ? v[0] : v;
   };
-  const signature = get(SIGNATURE_HEADER);
-  const timestamp = get(TIMESTAMP_HEADER);
-  if (!signature || !timestamp) {
-    throw new Error("Missing X-Wefunder-Signature or X-Wefunder-Timestamp header");
-  }
-  const ok = verifyWebhook({
-    payload,
-    signature,
-    timestamp,
-    secret,
-    toleranceSeconds: opts?.toleranceSeconds,
-    now: opts?.now
-  });
-  if (!ok) throw new Error("Webhook signature verification failed");
+}
+function constructEvent(payload, headers, secret, opts) {
+  const get = headerGetter(headers);
+  const header = get(SIGNATURE_HEADER);
+  if (!header) {
+    const legacySig = get(LEGACY_SIGNATURE_HEADER);
+    const legacyTs = get(LEGACY_TIMESTAMP_HEADER);
+    if (legacySig && legacyTs) return constructLegacyEvent(payload, get, legacySig, legacyTs, secret, opts);
+    throw new WebhookSignatureError("missing_header", describeFailure("missing_header"));
+  }
+  const failure = checkWebhookSignature({ payload, header, secret, ...opts });
+  if (failure) throw new WebhookSignatureError(failure, describeFailure(failure));
+  const parsed = parseSignatureHeader(header);
+  const env = parseEnvelope(payload);
   return {
-    event: get(EVENT_HEADER) ?? "",
-    deliveryId: get(DELIVERY_ID_HEADER) ?? "",
-    timestamp: Number(timestamp),
-    data: JSON.parse(payload)
+    id: String(env.id ?? ""),
+    event: String(env.event ?? ""),
+    created_at: String(env.created_at ?? ""),
+    mode: env.mode === "test" ? "test" : "live",
+    data: env.data,
+    timestamp: parsed.timestamp
   };
 }
+function constructLegacyEvent(payload, get, signature, timestamp, secret, opts) {
+  if (!verifyLegacyWebhook({ payload, signature, timestamp, secret, ...opts })) {
+    throw new WebhookSignatureError("signature_mismatch", describeFailure("signature_mismatch"));
+  }
+  const env = parseEnvelope(payload);
+  return {
+    id: String(env.id ?? get(LEGACY_DELIVERY_ID_HEADER) ?? ""),
+    event: String(env.event ?? get(LEGACY_EVENT_HEADER) ?? ""),
+    created_at: String(env.created_at ?? ""),
+    mode: env.mode === "test" ? "test" : "live",
+    data: env.data ?? env,
+    timestamp: Number(timestamp)
+  };
+}
+function parseEnvelope(payload) {
+  try {
+    const parsed = JSON.parse(bodyBuffer(payload).toString("utf8"));
+    if (parsed === null || typeof parsed !== "object") throw new Error("not an object");
+    return parsed;
+  } catch {
+    throw new WebhookSignatureError("invalid_payload", describeFailure("invalid_payload"));
+  }
+}
+function describeFailure(reason) {
+  switch (reason) {
+    case "missing_header":
+      return "Missing Wefunder-Signature header";
+    case "malformed_header":
+      return "Wefunder-Signature header is malformed (expected t=<unix>,v1=<hex>)";
+    case "timestamp_out_of_tolerance":
+      return "Webhook timestamp is outside the replay tolerance";
+    case "signature_mismatch":
+      return "Webhook signature verification failed";
+    case "invalid_payload":
+      return "Webhook body is not a JSON object";
+  }
+}
+async function constructEventFromRequest(request, secret, opts) {
+  const payload = await request.text();
+  return constructEvent(payload, request.headers, secret, opts);
+}
+async function dispatchWebhook(event, handlers) {
+  const specific = event.event === "default" ? void 0 : handlers[event.event];
+  if (specific) {
+    await specific(event);
+    return true;
+  }
+  if (handlers.default) {
+    await handlers.default(event);
+    return true;
+  }
+  return false;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   DEFAULT_API_BASE_URL,
@@ -1242,23 +2277,35 @@ function constructEvent(payload, headers, secret, opts) {
   DEFAULT_AUTHORIZE_BASE_URL,
   DEFAULT_OAUTH_BASE_URL,
   DEFAULT_TOKEN_BASE_URL,
-  DELIVERY_ID_HEADER,
-  EVENT_HEADER,
+  DEFAULT_TOLERANCE_SECONDS,
+  LEGACY_DELIVERY_ID_HEADER,
+  LEGACY_EVENT_HEADER,
+  LEGACY_SIGNATURE_HEADER,
+  LEGACY_TIMESTAMP_HEADER,
   REQUEST_ID_HEADER,
+  SANDBOX_AUTHORIZE_BASE_URL,
   SIGNATURE_HEADER,
-  TIMESTAMP_HEADER,
+  TokenManager,
+  WebhookSignatureError,
   Wefunder,
   WefunderAuthError,
   WefunderError,
+  WefunderTokenPersistenceError,
+  checkWebhookSignature,
   clientCredentialsGrant,
   collect,
+  computeWebhookSignature,
   constructEvent,
+  constructEventFromRequest,
   createAuthorizationUrl,
+  dispatchWebhook,
   exchangeCode,
   generatePkce,
   modeForToken,
   paginate,
+  parseSignatureHeader,
   refreshToken,
+  signWebhook,
   verifyWebhook
 });
 //# sourceMappingURL=index.cjs.map