@wefunder/sdk 0.1.0-beta.7 → 0.1.0-beta.9

package/dist/index.cjs

@@ -25,24 +25,33 @@ __export(index_exports, {
   DEFAULT_AUTHORIZE_BASE_URL: () => DEFAULT_AUTHORIZE_BASE_URL,
   DEFAULT_OAUTH_BASE_URL: () => DEFAULT_OAUTH_BASE_URL,
   DEFAULT_TOKEN_BASE_URL: () => DEFAULT_TOKEN_BASE_URL,
-  DELIVERY_ID_HEADER: () => DELIVERY_ID_HEADER,
-  EVENT_HEADER: () => EVENT_HEADER,
+  DEFAULT_TOLERANCE_SECONDS: () => DEFAULT_TOLERANCE_SECONDS,
+  LEGACY_DELIVERY_ID_HEADER: () => LEGACY_DELIVERY_ID_HEADER,
+  LEGACY_EVENT_HEADER: () => LEGACY_EVENT_HEADER,
+  LEGACY_SIGNATURE_HEADER: () => LEGACY_SIGNATURE_HEADER,
+  LEGACY_TIMESTAMP_HEADER: () => LEGACY_TIMESTAMP_HEADER,
   REQUEST_ID_HEADER: () => REQUEST_ID_HEADER,
   SANDBOX_AUTHORIZE_BASE_URL: () => SANDBOX_AUTHORIZE_BASE_URL,
   SIGNATURE_HEADER: () => SIGNATURE_HEADER,
-  TIMESTAMP_HEADER: () => TIMESTAMP_HEADER,
+  WebhookSignatureError: () => WebhookSignatureError,
   Wefunder: () => Wefunder,
   WefunderAuthError: () => WefunderAuthError,
   WefunderError: () => WefunderError,
+  checkWebhookSignature: () => checkWebhookSignature,
   clientCredentialsGrant: () => clientCredentialsGrant,
   collect: () => collect,
+  computeWebhookSignature: () => computeWebhookSignature,
   constructEvent: () => constructEvent,
+  constructEventFromRequest: () => constructEventFromRequest,
   createAuthorizationUrl: () => createAuthorizationUrl,
+  dispatchWebhook: () => dispatchWebhook,
   exchangeCode: () => exchangeCode,
   generatePkce: () => generatePkce,
   modeForToken: () => modeForToken,
   paginate: () => paginate,
+  parseSignatureHeader: () => parseSignatureHeader,
   refreshToken: () => refreshToken,
+  signWebhook: () => signWebhook,
   verifyWebhook: () => verifyWebhook
 });
 module.exports = __toCommonJS(index_exports);
@@ -1179,21 +1188,36 @@ var sdk_gen_exports = {};
 __export(sdk_gen_exports, {
   approveSyndicateMember: () => approveSyndicateMember,
   closeSyndicateDeal: () => closeSyndicateDeal,
+  createInstallation: () => createInstallation,
+  createInstallationToken: () => createInstallationToken,
   createIntent: () => createIntent,
   createPartnerInvite: () => createPartnerInvite,
+  createWebhookEndpoint: () => createWebhookEndpoint,
   createWebhookSubscription: () => createWebhookSubscription,
+  deleteWebhookEndpoint: () => deleteWebhookEndpoint,
   deleteWebhookSubscription: () => deleteWebhookSubscription,
   demoteSyndicateMember: () => demoteSyndicateMember,
   exportSyndicateMembersCsv: () => exportSyndicateMembersCsv,
   finalizeSyndicateDeal: () => finalizeSyndicateDeal,
+  followCompany: () => followCompany,
   getAttributionMe: () => getAttributionMe,
   getAttributionStats: () => getAttributionStats,
+  getCompany: () => getCompany,
+  getCompanyDisclosures: () => getCompanyDisclosures,
+  getCompanyPitch: () => getCompanyPitch,
+  getCompanyUpdate: () => getCompanyUpdate,
   getCurrentUser: () => getCurrentUser,
+  getInstallation: () => getInstallation,
   getIntent: () => getIntent,
+  getInvestment: () => getInvestment,
   getOffering: () => getOffering,
+  getOfferingStats: () => getOfferingStats,
+  getPortfolio: () => getPortfolio,
   getSyndicate: () => getSyndicate,
   getSyndicateDeal: () => getSyndicateDeal,
+  getSyndicatePortfolio: () => getSyndicatePortfolio,
   getSyndicateStatistics: () => getSyndicateStatistics,
+  getWebhookEndpoint: () => getWebhookEndpoint,
   getWebhookSubscription: () => getWebhookSubscription,
   hideSyndicateMember: () => hideSyndicateMember,
   inviteSyndicateMember: () => inviteSyndicateMember,
@@ -1201,19 +1225,30 @@ __export(sdk_gen_exports, {
   listAttributedInvestments: () => listAttributedInvestments,
   listAttributionCampaigns: () => listAttributionCampaigns,
   listCampaigns: () => listCampaigns,
+  listCompanyQuestions: () => listCompanyQuestions,
+  listCompanyUpdates: () => listCompanyUpdates,
   listConnectedApps: () => listConnectedApps,
+  listEligibleInstallTargets: () => listEligibleInstallTargets,
+  listFollowedCompanies: () => listFollowedCompanies,
+  listInstallations: () => listInstallations,
   listIntents: () => listIntents,
   listInvestments: () => listInvestments,
+  listMyCompanies: () => listMyCompanies,
   listOfferings: () => listOfferings,
   listPartnerInvites: () => listPartnerInvites,
+  listPortfolioPositions: () => listPortfolioPositions,
   listSyndicateDealInvestors: () => listSyndicateDealInvestors,
   listSyndicateDeals: () => listSyndicateDeals,
   listSyndicateMemberInvestments: () => listSyndicateMemberInvestments,
   listSyndicateMembers: () => listSyndicateMembers,
+  listSyndicatePortfolioPositions: () => listSyndicatePortfolioPositions,
   listSyndicates: () => listSyndicates,
+  listWebhookEndpoints: () => listWebhookEndpoints,
   listWebhookSubscriptions: () => listWebhookSubscriptions,
+  previewIntent: () => previewIntent,
   promoteSyndicateMember: () => promoteSyndicateMember,
   reactivateWebhookSubscription: () => reactivateWebhookSubscription,
+  reenableWebhookEndpoint: () => reenableWebhookEndpoint,
   regenerateWebhookSecret: () => regenerateWebhookSecret,
   registerAsPartner: () => registerAsPartner,
   removeSyndicateMember: () => removeSyndicateMember,
@@ -1221,10 +1256,16 @@ __export(sdk_gen_exports, {
   resendSyndicateInvite: () => resendSyndicateInvite,
   restoreSyndicateMember: () => restoreSyndicateMember,
   revokeConnectedApp: () => revokeConnectedApp,
+  revokeInstallation: () => revokeInstallation,
   revokePartnerInvite: () => revokePartnerInvite,
+  rotateWebhookEndpointSecret: () => rotateWebhookEndpointSecret,
+  searchCompanies: () => searchCompanies,
+  testWebhookEndpoint: () => testWebhookEndpoint,
   testWebhookSubscription: () => testWebhookSubscription,
+  unfollowCompany: () => unfollowCompany,
   updateSyndicate: () => updateSyndicate,
-  updateSyndicateMember: () => updateSyndicateMember
+  updateSyndicateMember: () => updateSyndicateMember,
+  updateWebhookEndpoint: () => updateWebhookEndpoint
 });
 
 // src/generated/client.gen.ts
@@ -1232,6 +1273,12 @@ var client = createClient(createConfig());
 
 // src/generated/sdk.gen.ts
 var listOfferings = (options) => (options?.client ?? client).get({
+  querySerializer: {
+    parameters: {
+      industry: { array: { explode: false } },
+      business_model: { array: { explode: false } }
+    }
+  },
   security: [{ scheme: "bearer", type: "http" }],
   url: "/explore",
   ...options
@@ -1241,16 +1288,97 @@ var getOffering = (options) => (options.client ?? client).get({
   url: "/offerings/{external_id}",
   ...options
 });
+var getCompanyDisclosures = (options) => (options.client ?? client).get({
+  querySerializer: {
+    parameters: { sections: { array: { explode: false } } }
+  },
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/companies/{id}/disclosures",
+  ...options
+});
+var getCompanyPitch = (options) => (options.client ?? client).get({
+  querySerializer: {
+    parameters: { sections: { array: { explode: false } } }
+  },
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/companies/{id}/pitch",
+  ...options
+});
+var listCompanyUpdates = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/companies/{id}/updates",
+  ...options
+});
+var getCompanyUpdate = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/companies/{id}/updates/{update_id}",
+  ...options
+});
+var listCompanyQuestions = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/companies/{id}/questions",
+  ...options
+});
+var searchCompanies = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/companies/search",
+  ...options
+});
+var getCompany = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/companies/{id}",
+  ...options
+});
 var getCurrentUser = (options) => (options?.client ?? client).get({
   security: [{ scheme: "bearer", type: "http" }],
   url: "/users/me",
   ...options
 });
+var listMyCompanies = (options) => (options?.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/users/me/companies",
+  ...options
+});
+var listFollowedCompanies = (options) => (options?.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/users/me/follows",
+  ...options
+});
+var unfollowCompany = (options) => (options.client ?? client).delete({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/users/me/follows/{company_id}",
+  ...options
+});
+var followCompany = (options) => (options.client ?? client).put({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/users/me/follows/{company_id}",
+  ...options
+});
 var listInvestments = (options) => (options?.client ?? client).get({
   security: [{ scheme: "bearer", type: "http" }],
   url: "/investments",
   ...options
 });
+var getInvestment = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/investments/{id}",
+  ...options
+});
+var getOfferingStats = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/offerings/{offering_id}/stats",
+  ...options
+});
+var getPortfolio = (options) => (options?.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/portfolio",
+  ...options
+});
+var listPortfolioPositions = (options) => (options?.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/portfolio/positions",
+  ...options
+});
 var listCampaigns = (options) => (options?.client ?? client).get({
   security: [{ scheme: "bearer", type: "http" }],
   url: "/campaigns",
@@ -1372,6 +1500,16 @@ var getSyndicateStatistics = (options) => (options.client ?? client).get({
   url: "/syndicates/{syndicate_id}/statistics",
   ...options
 });
+var getSyndicatePortfolio = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/syndicates/{syndicate_id}/portfolio",
+  ...options
+});
+var listSyndicatePortfolioPositions = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/syndicates/{syndicate_id}/portfolio/positions",
+  ...options
+});
 var closeSyndicateDeal = (options) => (options.client ?? client).post({
   security: [{ scheme: "bearer", type: "http" }],
   url: "/syndicates/{syndicate_id}/deals/{fundraise_id}/close",
@@ -1382,6 +1520,15 @@ var finalizeSyndicateDeal = (options) => (options.client ?? client).post({
   url: "/syndicates/{syndicate_id}/deals/{fundraise_id}/finalize",
   ...options
 });
+var previewIntent = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/intents/preview",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
 var listIntents = (options) => (options?.client ?? client).get({
   security: [{ scheme: "bearer", type: "http" }],
   url: "/intents",
@@ -1426,6 +1573,96 @@ var listAttributedInvestments = (options) => (options.client ?? client).get({
   url: "/campaigns/{campaign_id}/attribution/investments",
   ...options
 });
+var listInstallations = (options) => (options?.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/installations",
+  ...options
+});
+var createInstallation = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/installations",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var listEligibleInstallTargets = (options) => (options?.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/installations/eligible",
+  ...options
+});
+var revokeInstallation = (options) => (options.client ?? client).delete({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/installations/{external_id}",
+  ...options
+});
+var getInstallation = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/installations/{external_id}",
+  ...options
+});
+var createInstallationToken = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/installations/{external_id}/tokens",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var listWebhookEndpoints = (options) => (options?.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/webhook_endpoints",
+  ...options
+});
+var createWebhookEndpoint = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/webhook_endpoints",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var deleteWebhookEndpoint = (options) => (options.client ?? client).delete({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/webhook_endpoints/{external_id}",
+  ...options
+});
+var getWebhookEndpoint = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/webhook_endpoints/{external_id}",
+  ...options
+});
+var updateWebhookEndpoint = (options) => (options.client ?? client).patch({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/webhook_endpoints/{external_id}",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var rotateWebhookEndpointSecret = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/webhook_endpoints/{external_id}/rotate_secret",
+  ...options
+});
+var reenableWebhookEndpoint = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/webhook_endpoints/{external_id}/reenable",
+  ...options
+});
+var testWebhookEndpoint = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/webhook_endpoints/{external_id}/test",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
 var listWebhookSubscriptions = (options) => (options.client ?? client).get({
   security: [{ scheme: "bearer", type: "http" }],
   url: "/campaigns/{campaign_id}/attribution/webhooks",
@@ -1643,10 +1880,27 @@ var Wefunder = class _Wefunder {
       getOffering({ client: this.#client, path: { external_id: externalId } })
     )
   };
+  /**
+   * Investments (`read:investments`). `list` is a bootstrap listing; pass `updated_since`
+   * or a saved `cursor` for sync mode (`meta.mode === "delta"`). Persist `meta.next_cursor`
+   * from your last page — it is always present — and resume from it next time.
+   */
   investments = {
     list: this.#page(listInvestments),
-    all: () => paginate((cursor) => this.investments.list({ cursor })),
-    collect: () => collect((cursor) => this.investments.list({ cursor }))
+    all: (query) => paginate((cursor) => this.investments.list({ ...query, cursor })),
+    collect: (query) => collect((cursor) => this.investments.list({ ...query, cursor })),
+    /** The current record (not the published projection) for one investment (`inv_…`). */
+    get: (id) => this.#unwrapData(getInvestment({ client: this.#client, path: { id } }))
+  };
+  portfolio = {
+    get: (query) => this.#unwrapData(getPortfolio({ client: this.#client, query })),
+    positions: {
+      list: this.#page(
+        listPortfolioPositions
+      ),
+      all: (query) => paginate((cursor) => this.portfolio.positions.list({ ...query, cursor })),
+      collect: (query) => collect((cursor) => this.portfolio.positions.list({ ...query, cursor }))
+    }
   };
   campaigns = {
     list: this.#page(listCampaigns),
@@ -1666,17 +1920,76 @@ var Wefunder = class _Wefunder {
   attribution = {
     me: () => this.#unwrapData(getAttributionMe({ client: this.#client }))
   };
+  /**
+   * Webhook endpoints (`/webhook_endpoints`, scopes `read:webhooks` / `write:webhooks`).
+   * Endpoints belong to your application and are managed through the LIVE API —
+   * create sandbox receivers there with `mode: "test"`; they're mirrored into
+   * sandbox. The signing `secret` is returned ONLY by `create` and `rotateSecret`.
+   * Verify deliveries with `constructEvent` (see the webhooks module).
+   */
+  webhookEndpoints = {
+    /** All of your app's endpoints (secret omitted). `meta.quota` is the per-app limit. */
+    list: () => this.#unwrap(listWebhookEndpoints({ client: this.#client })),
+    get: (id) => this.#unwrapData(
+      getWebhookEndpoint({ client: this.#client, path: { external_id: id } })
+    ),
+    /** Store `attributes.secret` from the result — it is never shown again. */
+    create: (input) => this.#unwrapData(createWebhookEndpoint({ client: this.#client, body: input })),
+    /** `events` replaces the subscription list wholesale (no merge); omit to leave unchanged. */
+    update: (id, input) => this.#unwrapData(
+      updateWebhookEndpoint({ client: this.#client, path: { external_id: id }, body: input })
+    ),
+    /** Stops deliveries immediately. Removal is permanent — create a new endpoint to resume. */
+    remove: (id) => this.#unwrapData(
+      deleteWebhookEndpoint({ client: this.#client, path: { external_id: id } })
+    ),
+    /**
+     * New secret (shown once). The old one keeps signing for a 24h overlap — deliveries
+     * carry a `v1` for both, and `constructEvent` accepts either.
+     */
+    rotateSecret: (id) => this.#unwrapData(
+      rotateWebhookEndpointSecret({ client: this.#client, path: { external_id: id } })
+    ),
+    /** Recover an auto-disabled endpoint after fixing your server. Idempotent. */
+    reenable: (id) => this.#unwrapData(
+      reenableWebhookEndpoint({ client: this.#client, path: { external_id: id } })
+    ),
+    /**
+     * POST a real, signed example event at the endpoint (production envelope + signature)
+     * and report the outcome inline. Defaults to the endpoint's first subscribed event.
+     * Doesn't affect delivery health. Rate-limited to 10/min per endpoint.
+     */
+    test: (id, event) => this.#unwrapData(
+      testWebhookEndpoint({
+        client: this.#client,
+        path: { external_id: id },
+        body: event ? { event } : void 0
+      })
+    )
+  };
 };
 
 // src/webhooks.ts
 var import_node_crypto2 = require("crypto");
-var SIGNATURE_HEADER = "x-wefunder-signature";
-var TIMESTAMP_HEADER = "x-wefunder-timestamp";
-var EVENT_HEADER = "x-wefunder-event";
-var DELIVERY_ID_HEADER = "x-wefunder-delivery-id";
-function computeSignature(secret, timestamp, payload) {
-  const mac = (0, import_node_crypto2.createHmac)("sha256", secret).update(`${timestamp}.${payload}`).digest("hex");
-  return `sha256=${mac}`;
+var SIGNATURE_HEADER = "wefunder-signature";
+var DEFAULT_TOLERANCE_SECONDS = 300;
+var LEGACY_SIGNATURE_HEADER = "x-wefunder-signature";
+var LEGACY_TIMESTAMP_HEADER = "x-wefunder-timestamp";
+var LEGACY_EVENT_HEADER = "x-wefunder-event";
+var LEGACY_DELIVERY_ID_HEADER = "x-wefunder-delivery-id";
+var WebhookSignatureError = class extends Error {
+  reason;
+  constructor(reason, message) {
+    super(message);
+    this.name = "WebhookSignatureError";
+    this.reason = reason;
+  }
+};
+function bodyBuffer(payload) {
+  return typeof payload === "string" ? Buffer.from(payload, "utf8") : Buffer.from(payload);
+}
+function computeWebhookSignature(secret, timestamp, payload) {
+  return (0, import_node_crypto2.createHmac)("sha256", secret).update(`${timestamp}.`).update(bodyBuffer(payload)).digest("hex");
 }
 function constantTimeEqual(a, b) {
   const ab = Buffer.from(a);
@@ -1684,42 +1997,142 @@ function constantTimeEqual(a, b) {
   if (ab.length !== bb.length) return false;
   return (0, import_node_crypto2.timingSafeEqual)(ab, bb);
 }
+function parseSignatureHeader(header) {
+  let timestamp;
+  const signatures = [];
+  for (const part of header.split(",")) {
+    const eq = part.indexOf("=");
+    if (eq < 0) continue;
+    const key = part.slice(0, eq).trim();
+    const value = part.slice(eq + 1).trim();
+    if (key === "t") {
+      if (!/^\d+$/.test(value)) return null;
+      timestamp = Number(value);
+    } else if (key === "v1" && value) {
+      signatures.push(value);
+    }
+  }
+  if (timestamp === void 0 || signatures.length === 0) return null;
+  return { timestamp, signatures };
+}
+function signWebhook(opts) {
+  const t = opts.timestamp ?? Math.floor(Date.now() / 1e3);
+  const secrets = [opts.secret, ...opts.additionalSecrets ?? []];
+  const entries = secrets.map((s) => `v1=${computeWebhookSignature(s, t, opts.payload)}`);
+  return [`t=${t}`, ...entries].join(",");
+}
+function checkWebhookSignature(opts) {
+  const parsed = parseSignatureHeader(opts.header);
+  if (!parsed) return "malformed_header";
+  const tolerance = opts.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS;
+  if (tolerance > 0) {
+    const nowSec = (opts.now ?? Date.now)() / 1e3;
+    if (Math.abs(nowSec - parsed.timestamp) > tolerance) return "timestamp_out_of_tolerance";
+  }
+  const expected = computeWebhookSignature(opts.secret, parsed.timestamp, opts.payload);
+  return parsed.signatures.some((sig) => constantTimeEqual(sig, expected)) ? null : "signature_mismatch";
+}
 function verifyWebhook(opts) {
-  const tolerance = opts.toleranceSeconds ?? 300;
-  const now = (opts.now ?? Date.now)();
+  if ("header" in opts) return checkWebhookSignature(opts) === null;
+  return verifyLegacyWebhook(opts);
+}
+function verifyLegacyWebhook(opts) {
+  const tolerance = opts.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS;
   const ts = Number(opts.timestamp);
   if (!Number.isFinite(ts)) return false;
-  if (tolerance > 0 && Math.abs(now / 1e3 - ts) > tolerance) return false;
-  const expected = computeSignature(opts.secret, opts.timestamp, opts.payload);
+  if (tolerance > 0 && Math.abs((opts.now ?? Date.now)() / 1e3 - ts) > tolerance) return false;
+  const expected = `sha256=${computeWebhookSignature(opts.secret, opts.timestamp, opts.payload)}`;
   return constantTimeEqual(opts.signature, expected);
 }
-function constructEvent(payload, headers, secret, opts) {
-  const get = (name) => {
-    if (headers instanceof Headers) return headers.get(name) ?? void 0;
-    const v = headers[name] ?? headers[name.toLowerCase()];
+function headerGetter(headers) {
+  if (typeof headers === "string") {
+    return (name) => name === SIGNATURE_HEADER ? headers : void 0;
+  }
+  if (headers instanceof Headers) return (name) => headers.get(name) ?? void 0;
+  return (name) => {
+    let v = headers[name];
+    if (v === void 0) {
+      const hit = Object.keys(headers).find((k) => k.toLowerCase() === name);
+      if (hit) v = headers[hit];
+    }
     return Array.isArray(v) ? v[0] : v;
   };
-  const signature = get(SIGNATURE_HEADER);
-  const timestamp = get(TIMESTAMP_HEADER);
-  if (!signature || !timestamp) {
-    throw new Error("Missing X-Wefunder-Signature or X-Wefunder-Timestamp header");
-  }
-  const ok = verifyWebhook({
-    payload,
-    signature,
-    timestamp,
-    secret,
-    toleranceSeconds: opts?.toleranceSeconds,
-    now: opts?.now
-  });
-  if (!ok) throw new Error("Webhook signature verification failed");
+}
+function constructEvent(payload, headers, secret, opts) {
+  const get = headerGetter(headers);
+  const header = get(SIGNATURE_HEADER);
+  if (!header) {
+    const legacySig = get(LEGACY_SIGNATURE_HEADER);
+    const legacyTs = get(LEGACY_TIMESTAMP_HEADER);
+    if (legacySig && legacyTs) return constructLegacyEvent(payload, get, legacySig, legacyTs, secret, opts);
+    throw new WebhookSignatureError("missing_header", describeFailure("missing_header"));
+  }
+  const failure = checkWebhookSignature({ payload, header, secret, ...opts });
+  if (failure) throw new WebhookSignatureError(failure, describeFailure(failure));
+  const parsed = parseSignatureHeader(header);
+  const env = parseEnvelope(payload);
   return {
-    event: get(EVENT_HEADER) ?? "",
-    deliveryId: get(DELIVERY_ID_HEADER) ?? "",
-    timestamp: Number(timestamp),
-    data: JSON.parse(payload)
+    id: String(env.id ?? ""),
+    event: String(env.event ?? ""),
+    created_at: String(env.created_at ?? ""),
+    mode: env.mode === "test" ? "test" : "live",
+    data: env.data,
+    timestamp: parsed.timestamp
   };
 }
+function constructLegacyEvent(payload, get, signature, timestamp, secret, opts) {
+  if (!verifyLegacyWebhook({ payload, signature, timestamp, secret, ...opts })) {
+    throw new WebhookSignatureError("signature_mismatch", describeFailure("signature_mismatch"));
+  }
+  const env = parseEnvelope(payload);
+  return {
+    id: String(env.id ?? get(LEGACY_DELIVERY_ID_HEADER) ?? ""),
+    event: String(env.event ?? get(LEGACY_EVENT_HEADER) ?? ""),
+    created_at: String(env.created_at ?? ""),
+    mode: env.mode === "test" ? "test" : "live",
+    data: env.data ?? env,
+    timestamp: Number(timestamp)
+  };
+}
+function parseEnvelope(payload) {
+  try {
+    const parsed = JSON.parse(bodyBuffer(payload).toString("utf8"));
+    if (parsed === null || typeof parsed !== "object") throw new Error("not an object");
+    return parsed;
+  } catch {
+    throw new WebhookSignatureError("invalid_payload", describeFailure("invalid_payload"));
+  }
+}
+function describeFailure(reason) {
+  switch (reason) {
+    case "missing_header":
+      return "Missing Wefunder-Signature header";
+    case "malformed_header":
+      return "Wefunder-Signature header is malformed (expected t=<unix>,v1=<hex>)";
+    case "timestamp_out_of_tolerance":
+      return "Webhook timestamp is outside the replay tolerance";
+    case "signature_mismatch":
+      return "Webhook signature verification failed";
+    case "invalid_payload":
+      return "Webhook body is not a JSON object";
+  }
+}
+async function constructEventFromRequest(request, secret, opts) {
+  const payload = await request.text();
+  return constructEvent(payload, request.headers, secret, opts);
+}
+async function dispatchWebhook(event, handlers) {
+  const specific = event.event === "default" ? void 0 : handlers[event.event];
+  if (specific) {
+    await specific(event);
+    return true;
+  }
+  if (handlers.default) {
+    await handlers.default(event);
+    return true;
+  }
+  return false;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   DEFAULT_API_BASE_URL,
@@ -1727,24 +2140,33 @@ function constructEvent(payload, headers, secret, opts) {
   DEFAULT_AUTHORIZE_BASE_URL,
   DEFAULT_OAUTH_BASE_URL,
   DEFAULT_TOKEN_BASE_URL,
-  DELIVERY_ID_HEADER,
-  EVENT_HEADER,
+  DEFAULT_TOLERANCE_SECONDS,
+  LEGACY_DELIVERY_ID_HEADER,
+  LEGACY_EVENT_HEADER,
+  LEGACY_SIGNATURE_HEADER,
+  LEGACY_TIMESTAMP_HEADER,
   REQUEST_ID_HEADER,
   SANDBOX_AUTHORIZE_BASE_URL,
   SIGNATURE_HEADER,
-  TIMESTAMP_HEADER,
+  WebhookSignatureError,
   Wefunder,
   WefunderAuthError,
   WefunderError,
+  checkWebhookSignature,
   clientCredentialsGrant,
   collect,
+  computeWebhookSignature,
   constructEvent,
+  constructEventFromRequest,
   createAuthorizationUrl,
+  dispatchWebhook,
   exchangeCode,
   generatePkce,
   modeForToken,
   paginate,
+  parseSignatureHeader,
   refreshToken,
+  signWebhook,
   verifyWebhook
 });
 //# sourceMappingURL=index.cjs.map