@wefunder/sdk 0.1.0-beta.4 → 0.1.0-beta.5

package/README.md

@@ -102,10 +102,10 @@ const wf = new Wefunder({
 
 OAuth uses two hosts, independently overridable:
 
-- **authorize host** — the browser consent redirect (`createAuthorizationUrl`). Defaults to `https://wefunder.com/oauth`.
-- **token host** — `/token` + refresh (`fromClientCredentials`, `exchangeCode`, refresh). Defaults to `https://wefunder.com/oauth` today; it will move to `https://api.wefunder.com/oauth` when Wefunder's edge gateway ships. Override via `tokenBaseUrl` (or set both at once with `oauthBaseUrl`).
+- **token host** — `/token` + refresh (`fromClientCredentials`, `exchangeCode`, refresh). Defaults to `https://api.wefunder.com/oauth`. The edge gateway routes by the credential's mode (a `pk_test_` grant mints in sandbox, `pk_live_` in live), so one host serves both. Override via `tokenBaseUrl` (or set both with `oauthBaseUrl`).
+- **authorize host** — the browser consent redirect (`createAuthorizationUrl`). Picked from the `client_id`: `pk_test_` → `https://oauth.wefunder-sandbox.com/oauth` (sandbox consent), otherwise `https://wefunder.com/oauth` (live). Override via `authorizeBaseUrl`.
 
-The **API base** is `WefunderOptions.baseUrl` (default `https://api.wefunder.com/api/v2`). When Wefunder ships version-free URLs, the canonical base drops `/api/v2`; the current path stays as a back-compat alias, so no change is required on your side.
+The **API base** is `WefunderOptions.baseUrl` (default `https://api.wefunder.com`, version-free). The API version is pinned by the `Wefunder-Version` header, not the path; `/api/v2` remains a working back-compat alias.
 
 ## Pagination
 

package/dist/index.cjs

@@ -28,6 +28,7 @@ __export(index_exports, {
   DELIVERY_ID_HEADER: () => DELIVERY_ID_HEADER,
   EVENT_HEADER: () => EVENT_HEADER,
   REQUEST_ID_HEADER: () => REQUEST_ID_HEADER,
+  SANDBOX_AUTHORIZE_BASE_URL: () => SANDBOX_AUTHORIZE_BASE_URL,
   SIGNATURE_HEADER: () => SIGNATURE_HEADER,
   TIMESTAMP_HEADER: () => TIMESTAMP_HEADER,
   Wefunder: () => Wefunder,
@@ -946,10 +947,11 @@ function createFetch(deps) {
 // src/oauth.ts
 var import_node_crypto = require("crypto");
 var DEFAULT_AUTHORIZE_BASE_URL = "https://wefunder.com/oauth";
-var DEFAULT_TOKEN_BASE_URL = "https://wefunder.com/oauth";
+var SANDBOX_AUTHORIZE_BASE_URL = "https://oauth.wefunder-sandbox.com/oauth";
+var DEFAULT_TOKEN_BASE_URL = "https://api.wefunder.com/oauth";
 var DEFAULT_OAUTH_BASE_URL = DEFAULT_AUTHORIZE_BASE_URL;
-function resolveAuthorizeBase(o) {
-  return o.authorizeBaseUrl ?? o.oauthBaseUrl ?? DEFAULT_AUTHORIZE_BASE_URL;
+function defaultAuthorizeBase(clientId) {
+  return clientId.startsWith("pk_test_") ? SANDBOX_AUTHORIZE_BASE_URL : DEFAULT_AUTHORIZE_BASE_URL;
 }
 function resolveTokenBase(o) {
   return o.tokenBaseUrl ?? o.oauthBaseUrl ?? DEFAULT_TOKEN_BASE_URL;
@@ -989,7 +991,7 @@ function generatePkce() {
   return { codeVerifier, codeChallenge, codeChallengeMethod: "S256" };
 }
 function createAuthorizationUrl(opts) {
-  const base = resolveAuthorizeBase(opts);
+  const base = opts.authorizeBaseUrl ?? opts.oauthBaseUrl ?? defaultAuthorizeBase(opts.clientId);
   const q = new URLSearchParams({
     response_type: "code",
     client_id: opts.clientId,
@@ -1503,7 +1505,7 @@ var revokePartnerInvite = (options) => (options.client ?? client).delete({
 });
 
 // src/client.ts
-var DEFAULT_API_BASE_URL = "https://api.wefunder.com/api/v2";
+var DEFAULT_API_BASE_URL = "https://api.wefunder.com";
 var DEFAULT_API_VERSION = "2025-01-15";
 function modeForToken(token) {
   if (token.startsWith("at_live_")) return "live";
@@ -1728,6 +1730,7 @@ function constructEvent(payload, headers, secret, opts) {
   DELIVERY_ID_HEADER,
   EVENT_HEADER,
   REQUEST_ID_HEADER,
+  SANDBOX_AUTHORIZE_BASE_URL,
   SIGNATURE_HEADER,
   TIMESTAMP_HEADER,
   Wefunder,