@invonetwork/web-sdk 0.1.0

package/dist/index.js

@@ -0,0 +1,239 @@
+import { assertSecureBaseUrl, Http, InvoError } from './chunk-KUQVVH2P.js';
+export { InvoError } from './chunk-KUQVVH2P.js';
+
+// src/shared/webauthn.ts
+function b64urlToBuffer(value) {
+  const pad = value.length % 4 === 0 ? "" : "=".repeat(4 - value.length % 4);
+  const b64 = value.replace(/-/g, "+").replace(/_/g, "/") + pad;
+  const bin = atob(b64);
+  const bytes = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
+  return bytes.buffer;
+}
+function bufferToB64url(buf) {
+  const bytes = new Uint8Array(buf);
+  let bin = "";
+  for (let i = 0; i < bytes.length; i++) bin += String.fromCharCode(bytes[i]);
+  return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function descriptorsToBinary(list) {
+  return (list ?? []).map((d) => {
+    const out = {
+      id: b64urlToBuffer(d.id),
+      type: d.type
+    };
+    if (d.transports) out.transports = d.transports;
+    return out;
+  });
+}
+function toCreationOptions(json) {
+  const opts = {
+    ...json,
+    challenge: b64urlToBuffer(json["challenge"]),
+    user: {
+      ...json["user"],
+      id: b64urlToBuffer(json["user"].id)
+    }
+  };
+  if (json["excludeCredentials"]) {
+    opts.excludeCredentials = descriptorsToBinary(json["excludeCredentials"]);
+  }
+  return opts;
+}
+function toRequestOptions(json) {
+  const opts = {
+    ...json,
+    challenge: b64urlToBuffer(json["challenge"])
+  };
+  if (json["allowCredentials"]) {
+    opts.allowCredentials = descriptorsToBinary(json["allowCredentials"]);
+  }
+  return opts;
+}
+function registrationToJSON(cred) {
+  const r = cred.response;
+  return {
+    id: cred.id,
+    rawId: bufferToB64url(cred.rawId),
+    type: cred.type,
+    authenticatorAttachment: cred.authenticatorAttachment ?? void 0,
+    clientExtensionResults: cred.getClientExtensionResults(),
+    response: {
+      clientDataJSON: bufferToB64url(r.clientDataJSON),
+      attestationObject: bufferToB64url(r.attestationObject),
+      transports: typeof r.getTransports === "function" ? r.getTransports() : void 0
+    }
+  };
+}
+function assertionToJSON(cred) {
+  const r = cred.response;
+  return {
+    id: cred.id,
+    rawId: bufferToB64url(cred.rawId),
+    type: cred.type,
+    authenticatorAttachment: cred.authenticatorAttachment ?? void 0,
+    clientExtensionResults: cred.getClientExtensionResults(),
+    response: {
+      clientDataJSON: bufferToB64url(r.clientDataJSON),
+      authenticatorData: bufferToB64url(r.authenticatorData),
+      signature: bufferToB64url(r.signature),
+      userHandle: r.userHandle ? bufferToB64url(r.userHandle) : null
+    }
+  };
+}
+
+// src/index.ts
+var InvoClient = class {
+  constructor(config) {
+    if (!config.token) throw new Error("InvoClient requires a player `token`.");
+    if (!config.baseUrl) throw new Error("InvoClient requires a `baseUrl`.");
+    assertSecureBaseUrl(config.baseUrl);
+    this.http = new Http({
+      baseUrl: config.baseUrl,
+      timeoutMs: config.timeoutMs,
+      fetchImpl: config.fetch
+      // Browser: do NOT set User-Agent (forbidden header); the browser's own UA is fine.
+    });
+    this.auth = { kind: "bearer", token: config.token };
+    this.refreshToken = config.refreshToken;
+  }
+  assertWebAuthn() {
+    if (typeof navigator === "undefined" || !navigator.credentials) {
+      throw new Error("WebAuthn is not available in this environment (browser required).");
+    }
+  }
+  /** Enroll a passkey for the token's identity (register/begin -> create() -> register/complete). */
+  async enrollPasskey() {
+    this.assertWebAuthn();
+    return this.withTokenRetry(async () => {
+      const options = await this.post(
+        "/api/sdk/webauthn/register/begin"
+      );
+      const cred = await navigator.credentials.create({
+        publicKey: toCreationOptions(options)
+      });
+      if (!cred) throw new Error("Passkey creation was cancelled or returned no credential.");
+      const raw = await this.post(
+        "/api/sdk/webauthn/register/complete",
+        { credential: registrationToJSON(cred) }
+      );
+      return { status: String(raw["status"] ?? ""), device: raw["device"] ?? null, raw };
+    });
+  }
+  /** Approve a SEND with the player's passkey. */
+  async approveSend(transactionId) {
+    return this.approve("send", transactionId);
+  }
+  /** Approve a TRANSFER with the player's passkey (returns the sender's claim code). */
+  async approveTransfer(transactionId) {
+    return this.approve("transfers", transactionId);
+  }
+  /** Recipient self-claims a SEND with their passkey. */
+  async confirmReceiptSend(transactionId) {
+    return this.confirmReceipt("send", transactionId);
+  }
+  /** Recipient self-claims a TRANSFER with their passkey. */
+  async confirmReceiptTransfer(transactionId) {
+    return this.confirmReceipt("transfers", transactionId);
+  }
+  /**
+   * Interchangeable methods (§4.6): prove an *already-enrolled* method (e.g. the
+   * INVO app device key) to authorize adding a new partner passkey. The returned
+   * single-use grant lets a subsequent enrollPasskey() succeed instead of being
+   * blocked with ENROLLMENT_REQUIRES_PROOF.
+   *
+   * begin -> navigator.credentials.get() -> complete with { link_id, webauthn_assertion }.
+   */
+  async linkDevice(linkId) {
+    if (!linkId) throw new Error("linkDevice requires a `linkId`.");
+    return this.withTokenRetry(async () => {
+      const assertion = await this.runAssertion("/api/sdk/device/link/webauthn/begin", {
+        link_id: linkId
+      });
+      const raw = await this.post(
+        "/api/sdk/device/link/webauthn/complete",
+        { link_id: linkId, webauthn_assertion: assertion }
+      );
+      return { status: String(raw["status"] ?? ""), raw };
+    });
+  }
+  // --- internals ---
+  /** POST with the current player token. Token-expiry retry is handled one level
+   *  up by withTokenRetry (which re-runs the whole ceremony, not a single call). */
+  async post(path, body) {
+    return this.http.post(path, body, this.auth);
+  }
+  /**
+   * Run a whole flow, retrying it ONCE if any call fails with SDK_TOKEN_EXPIRED
+   * and a `refreshToken` hook is configured. We re-run the entire begin→get→
+   * complete ceremony (not just the failed call) so the retry always uses a fresh,
+   * unconsumed challenge — never replaying a single-use WebAuthn assertion (§4.4).
+   * The refresh is single-flighted so concurrent expiries trigger one re-mint.
+   */
+  async withTokenRetry(run) {
+    try {
+      return await run();
+    } catch (err) {
+      if (err instanceof InvoError && err.isTokenExpired && await this.tryRefresh()) {
+        return await run();
+      }
+      throw err;
+    }
+  }
+  async tryRefresh() {
+    if (!this.refreshToken) return false;
+    if (!this.refreshInFlight) {
+      this.refreshInFlight = Promise.resolve(this.refreshToken()).finally(() => {
+        this.refreshInFlight = void 0;
+      });
+    }
+    const fresh = await this.refreshInFlight;
+    if (!fresh) return false;
+    this.auth = { kind: "bearer", token: fresh };
+    return true;
+  }
+  async runAssertion(beginPath, beginBody) {
+    this.assertWebAuthn();
+    const options = await this.post(beginPath, beginBody);
+    const cred = await navigator.credentials.get({
+      publicKey: toRequestOptions(options)
+    });
+    if (!cred) throw new Error("Passkey assertion was cancelled or returned no credential.");
+    return assertionToJSON(cred);
+  }
+  async approve(flow, transactionId) {
+    const id = encodeURIComponent(transactionId);
+    return this.withTokenRetry(async () => {
+      const assertion = await this.runAssertion(`/api/sdk/${flow}/${id}/approve/webauthn/begin`);
+      const raw = await this.post(
+        `/api/sdk/${flow}/${id}/approve`,
+        { webauthn_assertion: assertion }
+      );
+      return {
+        status: String(raw["status"] ?? ""),
+        next: String(raw["next"] ?? ""),
+        transactionId: String(raw["transaction_id"] ?? transactionId),
+        claimCode: raw["claim_code"],
+        claimCodeExpiresAt: raw["claim_code_expires_at"],
+        raw
+      };
+    });
+  }
+  async confirmReceipt(flow, transactionId) {
+    const id = encodeURIComponent(transactionId);
+    return this.withTokenRetry(async () => {
+      const assertion = await this.runAssertion(
+        `/api/sdk/${flow}/${id}/confirm-receipt/webauthn/begin`
+      );
+      const raw = await this.post(
+        `/api/sdk/${flow}/${id}/confirm-receipt`,
+        { webauthn_assertion: assertion }
+      );
+      return { status: String(raw["status"] ?? ""), raw };
+    });
+  }
+};
+
+export { InvoClient };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/server.cjs

@@ -0,0 +1,340 @@
+'use strict';
+
+// src/shared/errors.ts
+var InvoError = class _InvoError extends Error {
+  constructor(args) {
+    super(args.message);
+    this.name = "InvoError";
+    this.code = args.code;
+    this.status = args.status;
+    this.body = args.body ?? null;
+    Object.setPrototypeOf(this, _InvoError.prototype);
+  }
+  /** True if this is the "recipient isn't passkey-enrolled, fall back to claim code" signal. */
+  get isReceiverNotEnrolled() {
+    return this.code === "receiver_not_enrolled_use_claim_code" || /receiver_not_enrolled_use_claim_code/i.test(this.message);
+  }
+  /** True if the session/SDK token has expired and the caller should re-mint + retry. */
+  get isTokenExpired() {
+    return this.code === "SDK_TOKEN_EXPIRED";
+  }
+};
+function errorFromResponse(status, body) {
+  let message = `INVO request failed (HTTP ${status})`;
+  let code;
+  if (body && typeof body === "object") {
+    const b = body;
+    if (typeof b["code"] === "string") code = b["code"];
+    if (typeof b["error"] === "string") message = b["error"];
+    else if (typeof b["message"] === "string") message = b["message"];
+  } else if (typeof body === "string" && body.trim()) {
+    message = body;
+  }
+  return new InvoError({ message, code, status, body });
+}
+
+// src/shared/http.ts
+var DEFAULT_TIMEOUT = 3e4;
+function assertSecureBaseUrl(baseUrl) {
+  let u;
+  try {
+    u = new URL(baseUrl);
+  } catch {
+    throw new Error(`Invalid baseUrl: ${baseUrl}`);
+  }
+  const isLocal = u.hostname === "localhost" || u.hostname === "127.0.0.1" || u.hostname === "[::1]";
+  if (u.protocol === "https:" || u.protocol === "http:" && isLocal) return;
+  throw new Error(
+    `baseUrl must use https:// (got "${u.protocol}//"). Plaintext would expose the token/secret on the wire.`
+  );
+}
+var Http = class {
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
+    this.timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT;
+    const f = opts.fetchImpl ?? globalThis.fetch;
+    if (typeof f !== "function") {
+      throw new Error(
+        "No fetch implementation available. Use Node >=18, or pass `fetch` in the config."
+      );
+    }
+    this.fetchImpl = f;
+    this.userAgent = opts.userAgent;
+  }
+  async post(path, body, auth) {
+    return this.request("POST", path, body, auth);
+  }
+  async get(path, auth) {
+    return this.request("GET", path, void 0, auth);
+  }
+  authHeaders(auth) {
+    switch (auth.kind) {
+      case "game-secret":
+        return { "X-Game-Secret-Key": auth.secret };
+      case "bearer":
+        return { Authorization: `Bearer ${auth.token}` };
+      case "none":
+        return {};
+    }
+  }
+  async request(method, path, body, auth) {
+    const url = `${this.baseUrl}${path}`;
+    const headers = {
+      Accept: "application/json",
+      ...this.authHeaders(auth)
+    };
+    if (this.userAgent) headers["User-Agent"] = this.userAgent;
+    if (body !== void 0) headers["Content-Type"] = "application/json";
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    let res;
+    try {
+      res = await this.fetchImpl(url, {
+        method,
+        headers,
+        body: body !== void 0 ? JSON.stringify(body) : void 0,
+        signal: controller.signal
+      });
+    } catch (err) {
+      throw new InvoError({
+        message: err instanceof Error && err.name === "AbortError" ? `Request to ${path} timed out after ${this.timeoutMs}ms` : `Network error calling ${path}: ${err?.message ?? err}`,
+        status: 0,
+        body: null
+      });
+    } finally {
+      clearTimeout(timer);
+    }
+    const text = await res.text();
+    let parsed = null;
+    if (text) {
+      try {
+        parsed = JSON.parse(text);
+      } catch {
+        parsed = text;
+      }
+    }
+    if (!res.ok) throw errorFromResponse(res.status, parsed);
+    return parsed ?? {};
+  }
+};
+
+// src/server.ts
+var DEFAULT_UA = "invonetwork-web-sdk/0.1.0 (+https://invo.network)";
+var MAX_USD_AMOUNT = 999.99;
+function invalidAmount(usdAmount, why) {
+  return new InvoError({
+    message: `usdAmount ${why} (got ${JSON.stringify(usdAmount)}).`,
+    code: "INVALID_INPUT",
+    status: 0
+  });
+}
+function assertUsdAmount(usdAmount) {
+  let n;
+  if (typeof usdAmount === "number") {
+    n = usdAmount;
+    if (Number.isFinite(n) && Math.abs(n * 100 - Math.round(n * 100)) > 1e-9) {
+      throw invalidAmount(usdAmount, "must have at most 2 decimal places");
+    }
+  } else {
+    if (!/^\d+(\.\d{1,2})?$/.test(usdAmount)) {
+      throw invalidAmount(usdAmount, "must be a plain decimal USD value with at most 2 places");
+    }
+    n = Number(usdAmount);
+  }
+  if (!Number.isFinite(n) || n <= 0 || n > MAX_USD_AMOUNT) {
+    throw invalidAmount(usdAmount, `must be > 0 and <= ${MAX_USD_AMOUNT}`);
+  }
+}
+function requireField(value, field, raw) {
+  const s = value == null ? "" : String(value);
+  if (!s) {
+    throw new InvoError({
+      message: `INVO response was missing the required \`${field}\` field.`,
+      code: "INVALID_RESPONSE",
+      status: 0,
+      body: raw
+    });
+  }
+  return s;
+}
+var InvoServer = class {
+  constructor(config) {
+    if (!config.gameSecret) throw new Error("InvoServer requires a `gameSecret`.");
+    if (!config.baseUrl) throw new Error("InvoServer requires a `baseUrl`.");
+    assertSecureBaseUrl(config.baseUrl);
+    this.http = new Http({
+      baseUrl: config.baseUrl,
+      timeoutMs: config.timeoutMs,
+      fetchImpl: config.fetch,
+      userAgent: DEFAULT_UA
+      // must be a non-blocked UA (handoff doc §9)
+    });
+    this.auth = { kind: "game-secret", secret: config.gameSecret };
+  }
+  /** Mint a short-lived, game-scoped player token to hand to the browser InvoClient. */
+  async mintPlayerToken(input) {
+    const raw = await this.http.post(
+      "/api/sdk/player-token",
+      { player_email: input.playerEmail },
+      this.auth
+    );
+    return {
+      token: requireField(raw["token"], "token", raw),
+      expiresAt: String(raw["expires_at"] ?? ""),
+      identityId: String(raw["identity_id"] ?? "")
+    };
+  }
+  /** Initiate a cross-game currency SEND. Inspect result.verificationMethod. */
+  async initiateSend(input) {
+    const raw = await this.http.post(
+      "/api/currency-sends/initiate-send",
+      {
+        client_request_id: input.clientRequestId,
+        sender_player_name: input.senderPlayerName,
+        sender_player_email: input.senderPlayerEmail,
+        sender_player_phone: input.senderPlayerPhone,
+        receiver_player_email: input.receiverPlayerEmail,
+        receiver_player_phone: input.receiverPlayerPhone,
+        receiving_game_id: input.receivingGameId,
+        amount: input.amount
+      },
+      this.auth
+    );
+    return this.toInitiateResult(raw);
+  }
+  /** Initiate a cross-game TRANSFER. Inspect result.verificationMethod. */
+  async initiateTransfer(input) {
+    const raw = await this.http.post(
+      "/api/transfers/initiate-transfer",
+      {
+        client_request_id: input.clientRequestId,
+        source_player_name: input.sourcePlayerName,
+        source_player_email: input.sourcePlayerEmail,
+        source_player_phone: input.sourcePlayerPhone,
+        target_player_email: input.targetPlayerEmail,
+        target_player_phone: input.targetPlayerPhone,
+        target_game_id: input.targetGameId,
+        amount: input.amount
+      },
+      this.auth
+    );
+    return this.toInitiateResult(raw);
+  }
+  /** Create a hosted checkout session (the recommended purchase path). Open the
+   *  returned checkoutUrl in a WebView/redirect or an iframe; the INVO-hosted page
+   *  handles cards, saved cards, and 3-D Secure. Crediting is server-side via the
+   *  purchase.completed webhook. */
+  async createCheckout(input) {
+    assertUsdAmount(input.usdAmount);
+    const body = {
+      player_email: input.playerEmail,
+      usd_amount: input.usdAmount
+    };
+    if (input.rail) body["rail"] = input.rail;
+    if (input.successUrl) body["success_url"] = input.successUrl;
+    if (input.cancelUrl) body["cancel_url"] = input.cancelUrl;
+    if (input.metadata) body["metadata"] = input.metadata;
+    const raw = await this.http.post(
+      "/api/checkout/sessions",
+      body,
+      this.auth
+    );
+    return {
+      sessionId: String(raw["session_id"] ?? ""),
+      checkoutUrl: requireField(raw["checkout_url"], "checkout_url", raw),
+      expiresAt: String(raw["expires_at"] ?? ""),
+      raw
+    };
+  }
+  /**
+   * Direct purchase via the rail selector. Use when you need a specific rail.
+   * - rail "platform" (default): standard card. May return status "requires_action"
+   *   (run client-side 3-D Secure with clientSecret, then call confirmPayment).
+   * - rail "game": returns status "pending_payment" + paymentUrl (redirect the browser).
+   * - rail "steam": NOT a browser flow — the backend returns WRONG_RAIL_ENDPOINT.
+   */
+  async purchaseCurrency(input) {
+    assertUsdAmount(input.usdAmount);
+    if (!input.purchaseReference) {
+      throw new InvoError({
+        message: "purchaseReference is required (idempotency key for the purchase).",
+        code: "MISSING_PURCHASE_REFERENCE",
+        status: 0
+      });
+    }
+    if (input.rail === "steam") {
+      throw new InvoError({
+        message: 'rail "steam" is not a /purchase-currency flow \u2014 Steam uses the dedicated in-client Steam endpoints.',
+        code: "WRONG_RAIL_ENDPOINT",
+        status: 0
+      });
+    }
+    const body = {
+      player_email: input.playerEmail,
+      usd_amount: input.usdAmount,
+      purchase_reference: input.purchaseReference
+    };
+    if (input.rail) body["rail"] = input.rail;
+    if (input.paymentMethodId) body["payment_method_id"] = input.paymentMethodId;
+    if (input.savedCardId) body["saved_card_id"] = input.savedCardId;
+    if (input.playerName) body["player_name"] = input.playerName;
+    if (input.playerPhone) body["player_phone"] = input.playerPhone;
+    const raw = await this.http.post(
+      "/api/currency-purchases/purchase-currency",
+      body,
+      this.auth
+    );
+    return {
+      status: String(raw["status"] ?? ""),
+      clientSecret: raw["client_secret"],
+      paymentIntentId: raw["payment_intent_id"],
+      paymentUrl: raw["payment_url"],
+      transactionId: raw["transaction_id"],
+      orderId: raw["order_id"],
+      newBalance: raw["new_balance"] ?? null,
+      raw
+    };
+  }
+  /** Complete the Stripe-rail 3-D Secure step after the client finished card action. */
+  async confirmPayment(input) {
+    const body = { payment_intent_id: input.paymentIntentId };
+    if (input.orderId) body["order_id"] = input.orderId;
+    return this.http.post(
+      "/api/currency-purchases/confirm-payment",
+      body,
+      this.auth
+    );
+  }
+  /** Fetch purchase status (order + financial summary + timeline). */
+  async getOrderDetails(query) {
+    if (!query.orderId && !query.transactionId) {
+      throw new InvoError({
+        message: "getOrderDetails requires an `orderId` or `transactionId`.",
+        code: "INVALID_INPUT",
+        status: 0
+      });
+    }
+    const q = new URLSearchParams();
+    if (query.orderId) q.set("order_id", query.orderId);
+    if (query.transactionId) q.set("transaction_id", query.transactionId);
+    return this.http.get(
+      `/api/currency-purchases/order-details?${q.toString()}`,
+      this.auth
+    );
+  }
+  toInitiateResult(raw) {
+    const vm = raw["verification_method"];
+    const guardian = raw["guardian_approval"];
+    return {
+      transactionId: String(raw["transaction_id"] ?? ""),
+      verificationMethod: vm === "in_app" || vm === "sms" ? vm : void 0,
+      guardianApproval: guardian ?? void 0,
+      raw
+    };
+  }
+};
+
+exports.InvoError = InvoError;
+exports.InvoServer = InvoServer;
+//# sourceMappingURL=server.cjs.map
+//# sourceMappingURL=server.cjs.map

package/dist/server.d.cts

@@ -0,0 +1,42 @@
+import { S as ServerConfig, P as PlayerToken, b as InitiateSendInput, c as InitiateResult, d as InitiateTransferInput, e as CreateCheckoutInput, f as CreateCheckoutResult, g as PurchaseInput, h as PurchaseResult } from './errors-B7rVID2r.cjs';
+export { I as InvoError, R as Rail, V as VerificationMethod } from './errors-B7rVID2r.cjs';
+
+declare class InvoServer {
+    private readonly http;
+    private readonly auth;
+    constructor(config: ServerConfig);
+    /** Mint a short-lived, game-scoped player token to hand to the browser InvoClient. */
+    mintPlayerToken(input: {
+        playerEmail: string;
+    }): Promise<PlayerToken>;
+    /** Initiate a cross-game currency SEND. Inspect result.verificationMethod. */
+    initiateSend(input: InitiateSendInput): Promise<InitiateResult>;
+    /** Initiate a cross-game TRANSFER. Inspect result.verificationMethod. */
+    initiateTransfer(input: InitiateTransferInput): Promise<InitiateResult>;
+    /** Create a hosted checkout session (the recommended purchase path). Open the
+     *  returned checkoutUrl in a WebView/redirect or an iframe; the INVO-hosted page
+     *  handles cards, saved cards, and 3-D Secure. Crediting is server-side via the
+     *  purchase.completed webhook. */
+    createCheckout(input: CreateCheckoutInput): Promise<CreateCheckoutResult>;
+    /**
+     * Direct purchase via the rail selector. Use when you need a specific rail.
+     * - rail "platform" (default): standard card. May return status "requires_action"
+     *   (run client-side 3-D Secure with clientSecret, then call confirmPayment).
+     * - rail "game": returns status "pending_payment" + paymentUrl (redirect the browser).
+     * - rail "steam": NOT a browser flow — the backend returns WRONG_RAIL_ENDPOINT.
+     */
+    purchaseCurrency(input: PurchaseInput): Promise<PurchaseResult>;
+    /** Complete the Stripe-rail 3-D Secure step after the client finished card action. */
+    confirmPayment(input: {
+        paymentIntentId: string;
+        orderId?: string;
+    }): Promise<Record<string, unknown>>;
+    /** Fetch purchase status (order + financial summary + timeline). */
+    getOrderDetails(query: {
+        orderId?: string;
+        transactionId?: string;
+    }): Promise<Record<string, unknown>>;
+    private toInitiateResult;
+}
+
+export { CreateCheckoutInput, CreateCheckoutResult, InitiateResult, InitiateSendInput, InitiateTransferInput, InvoServer, PlayerToken, PurchaseInput, PurchaseResult, ServerConfig };

package/dist/server.d.ts

@@ -0,0 +1,42 @@
+import { S as ServerConfig, P as PlayerToken, b as InitiateSendInput, c as InitiateResult, d as InitiateTransferInput, e as CreateCheckoutInput, f as CreateCheckoutResult, g as PurchaseInput, h as PurchaseResult } from './errors-B7rVID2r.js';
+export { I as InvoError, R as Rail, V as VerificationMethod } from './errors-B7rVID2r.js';
+
+declare class InvoServer {
+    private readonly http;
+    private readonly auth;
+    constructor(config: ServerConfig);
+    /** Mint a short-lived, game-scoped player token to hand to the browser InvoClient. */
+    mintPlayerToken(input: {
+        playerEmail: string;
+    }): Promise<PlayerToken>;
+    /** Initiate a cross-game currency SEND. Inspect result.verificationMethod. */
+    initiateSend(input: InitiateSendInput): Promise<InitiateResult>;
+    /** Initiate a cross-game TRANSFER. Inspect result.verificationMethod. */
+    initiateTransfer(input: InitiateTransferInput): Promise<InitiateResult>;
+    /** Create a hosted checkout session (the recommended purchase path). Open the
+     *  returned checkoutUrl in a WebView/redirect or an iframe; the INVO-hosted page
+     *  handles cards, saved cards, and 3-D Secure. Crediting is server-side via the
+     *  purchase.completed webhook. */
+    createCheckout(input: CreateCheckoutInput): Promise<CreateCheckoutResult>;
+    /**
+     * Direct purchase via the rail selector. Use when you need a specific rail.
+     * - rail "platform" (default): standard card. May return status "requires_action"
+     *   (run client-side 3-D Secure with clientSecret, then call confirmPayment).
+     * - rail "game": returns status "pending_payment" + paymentUrl (redirect the browser).
+     * - rail "steam": NOT a browser flow — the backend returns WRONG_RAIL_ENDPOINT.
+     */
+    purchaseCurrency(input: PurchaseInput): Promise<PurchaseResult>;
+    /** Complete the Stripe-rail 3-D Secure step after the client finished card action. */
+    confirmPayment(input: {
+        paymentIntentId: string;
+        orderId?: string;
+    }): Promise<Record<string, unknown>>;
+    /** Fetch purchase status (order + financial summary + timeline). */
+    getOrderDetails(query: {
+        orderId?: string;
+        transactionId?: string;
+    }): Promise<Record<string, unknown>>;
+    private toInitiateResult;
+}
+
+export { CreateCheckoutInput, CreateCheckoutResult, InitiateResult, InitiateSendInput, InitiateTransferInput, InvoServer, PlayerToken, PurchaseInput, PurchaseResult, ServerConfig };