@wefunder/sdk 0.1.0-beta.3 → 0.1.0-beta.5

package/README.md

@@ -102,10 +102,10 @@ const wf = new Wefunder({
 
 OAuth uses two hosts, independently overridable:
 
-- **authorize host** — the browser consent redirect (`createAuthorizationUrl`). Defaults to `https://wefunder.com/oauth`.
-- **token host** — `/token` + refresh (`fromClientCredentials`, `exchangeCode`, refresh). Defaults to `https://wefunder.com/oauth` today; it will move to `https://api.wefunder.com/oauth` when Wefunder's edge gateway ships. Override via `tokenBaseUrl` (or set both at once with `oauthBaseUrl`).
+- **token host** — `/token` + refresh (`fromClientCredentials`, `exchangeCode`, refresh). Defaults to `https://api.wefunder.com/oauth`. The edge gateway routes by the credential's mode (a `pk_test_` grant mints in sandbox, `pk_live_` in live), so one host serves both. Override via `tokenBaseUrl` (or set both with `oauthBaseUrl`).
+- **authorize host** — the browser consent redirect (`createAuthorizationUrl`). Picked from the `client_id`: `pk_test_` → `https://oauth.wefunder-sandbox.com/oauth` (sandbox consent), otherwise `https://wefunder.com/oauth` (live). Override via `authorizeBaseUrl`.
 
-The **API base** is `WefunderOptions.baseUrl` (default `https://api.wefunder.com/api/v2`). When Wefunder ships version-free URLs, the canonical base drops `/api/v2`; the current path stays as a back-compat alias, so no change is required on your side.
+The **API base** is `WefunderOptions.baseUrl` (default `https://api.wefunder.com`, version-free). The API version is pinned by the `Wefunder-Version` header, not the path; `/api/v2` remains a working back-compat alias.
 
 ## Pagination
 

package/dist/index.cjs

@@ -28,6 +28,7 @@ __export(index_exports, {
   DELIVERY_ID_HEADER: () => DELIVERY_ID_HEADER,
   EVENT_HEADER: () => EVENT_HEADER,
   REQUEST_ID_HEADER: () => REQUEST_ID_HEADER,
+  SANDBOX_AUTHORIZE_BASE_URL: () => SANDBOX_AUTHORIZE_BASE_URL,
   SIGNATURE_HEADER: () => SIGNATURE_HEADER,
   TIMESTAMP_HEADER: () => TIMESTAMP_HEADER,
   Wefunder: () => Wefunder,
@@ -880,13 +881,6 @@ function backoffMs(attempt, opts, random) {
   const jitter = exp * 0.5 * random();
   return Math.min(exp + jitter, opts.maxDelayMs);
 }
-function withBearer(input, init, token) {
-  const headers = new Headers(
-    init?.headers ?? (input instanceof Request ? input.headers : void 0)
-  );
-  headers.set("Authorization", `Bearer ${token}`);
-  return { ...init, headers };
-}
 function createFetch(deps) {
   const baseFetch = deps.fetch ?? fetch;
   const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
@@ -900,21 +894,37 @@ function createFetch(deps) {
   return async function wrappedFetch(input, init) {
     const method = methodOf(input, init);
     const idempotent = IDEMPOTENT.has(method);
+    const isRequest = input instanceof Request;
     let refreshed = false;
     let attempt = 0;
+    let retryToken;
+    const dispatch = (authToken) => {
+      if (isRequest) {
+        const fresh = input.clone();
+        if (authToken === void 0) return baseFetch(fresh);
+        const headers = new Headers(fresh.headers);
+        headers.set("Authorization", `Bearer ${authToken}`);
+        return baseFetch(new Request(fresh, { headers }));
+      }
+      const nextInit = authToken === void 0 ? init : (() => {
+        const headers = new Headers(init?.headers);
+        headers.set("Authorization", `Bearer ${authToken}`);
+        return { ...init, headers };
+      })();
+      return baseFetch(input, nextInit);
+    };
     for (; ; ) {
       let response;
       let networkError;
       try {
-        response = await baseFetch(input, init);
+        response = await dispatch(retryToken);
       } catch (err) {
         networkError = err;
       }
-      const replayable = !(input instanceof Request && input.bodyUsed);
-      if (response?.status === 401 && !refreshed && replayable && deps.tokenManager?.canRefresh) {
+      if (response?.status === 401 && !refreshed && deps.tokenManager?.canRefresh) {
         refreshed = true;
         const next = await deps.tokenManager.refresh();
-        init = withBearer(input, init, next.accessToken);
+        retryToken = next.accessToken;
         continue;
       }
       if (response?.status === 429 && attempt < retry.maxRetries) {
@@ -937,10 +947,11 @@ function createFetch(deps) {
 // src/oauth.ts
 var import_node_crypto = require("crypto");
 var DEFAULT_AUTHORIZE_BASE_URL = "https://wefunder.com/oauth";
-var DEFAULT_TOKEN_BASE_URL = "https://wefunder.com/oauth";
+var SANDBOX_AUTHORIZE_BASE_URL = "https://oauth.wefunder-sandbox.com/oauth";
+var DEFAULT_TOKEN_BASE_URL = "https://api.wefunder.com/oauth";
 var DEFAULT_OAUTH_BASE_URL = DEFAULT_AUTHORIZE_BASE_URL;
-function resolveAuthorizeBase(o) {
-  return o.authorizeBaseUrl ?? o.oauthBaseUrl ?? DEFAULT_AUTHORIZE_BASE_URL;
+function defaultAuthorizeBase(clientId) {
+  return clientId.startsWith("pk_test_") ? SANDBOX_AUTHORIZE_BASE_URL : DEFAULT_AUTHORIZE_BASE_URL;
 }
 function resolveTokenBase(o) {
   return o.tokenBaseUrl ?? o.oauthBaseUrl ?? DEFAULT_TOKEN_BASE_URL;
@@ -980,7 +991,7 @@ function generatePkce() {
   return { codeVerifier, codeChallenge, codeChallengeMethod: "S256" };
 }
 function createAuthorizationUrl(opts) {
-  const base = resolveAuthorizeBase(opts);
+  const base = opts.authorizeBaseUrl ?? opts.oauthBaseUrl ?? defaultAuthorizeBase(opts.clientId);
   const q = new URLSearchParams({
     response_type: "code",
     client_id: opts.clientId,
@@ -1494,7 +1505,7 @@ var revokePartnerInvite = (options) => (options.client ?? client).delete({
 });
 
 // src/client.ts
-var DEFAULT_API_BASE_URL = "https://api.wefunder.com/api/v2";
+var DEFAULT_API_BASE_URL = "https://api.wefunder.com";
 var DEFAULT_API_VERSION = "2025-01-15";
 function modeForToken(token) {
   if (token.startsWith("at_live_")) return "live";
@@ -1719,6 +1730,7 @@ function constructEvent(payload, headers, secret, opts) {
   DELIVERY_ID_HEADER,
   EVENT_HEADER,
   REQUEST_ID_HEADER,
+  SANDBOX_AUTHORIZE_BASE_URL,
   SIGNATURE_HEADER,
   TIMESTAMP_HEADER,
   Wefunder,