@invonetwork/web-sdk 0.1.0

package/dist/server.js

@@ -0,0 +1,222 @@
+import { assertSecureBaseUrl, Http, InvoError } from './chunk-KUQVVH2P.js';
+export { InvoError } from './chunk-KUQVVH2P.js';
+
+// src/server.ts
+var DEFAULT_UA = "invonetwork-web-sdk/0.1.0 (+https://invo.network)";
+var MAX_USD_AMOUNT = 999.99;
+function invalidAmount(usdAmount, why) {
+  return new InvoError({
+    message: `usdAmount ${why} (got ${JSON.stringify(usdAmount)}).`,
+    code: "INVALID_INPUT",
+    status: 0
+  });
+}
+function assertUsdAmount(usdAmount) {
+  let n;
+  if (typeof usdAmount === "number") {
+    n = usdAmount;
+    if (Number.isFinite(n) && Math.abs(n * 100 - Math.round(n * 100)) > 1e-9) {
+      throw invalidAmount(usdAmount, "must have at most 2 decimal places");
+    }
+  } else {
+    if (!/^\d+(\.\d{1,2})?$/.test(usdAmount)) {
+      throw invalidAmount(usdAmount, "must be a plain decimal USD value with at most 2 places");
+    }
+    n = Number(usdAmount);
+  }
+  if (!Number.isFinite(n) || n <= 0 || n > MAX_USD_AMOUNT) {
+    throw invalidAmount(usdAmount, `must be > 0 and <= ${MAX_USD_AMOUNT}`);
+  }
+}
+function requireField(value, field, raw) {
+  const s = value == null ? "" : String(value);
+  if (!s) {
+    throw new InvoError({
+      message: `INVO response was missing the required \`${field}\` field.`,
+      code: "INVALID_RESPONSE",
+      status: 0,
+      body: raw
+    });
+  }
+  return s;
+}
+var InvoServer = class {
+  constructor(config) {
+    if (!config.gameSecret) throw new Error("InvoServer requires a `gameSecret`.");
+    if (!config.baseUrl) throw new Error("InvoServer requires a `baseUrl`.");
+    assertSecureBaseUrl(config.baseUrl);
+    this.http = new Http({
+      baseUrl: config.baseUrl,
+      timeoutMs: config.timeoutMs,
+      fetchImpl: config.fetch,
+      userAgent: DEFAULT_UA
+      // must be a non-blocked UA (handoff doc §9)
+    });
+    this.auth = { kind: "game-secret", secret: config.gameSecret };
+  }
+  /** Mint a short-lived, game-scoped player token to hand to the browser InvoClient. */
+  async mintPlayerToken(input) {
+    const raw = await this.http.post(
+      "/api/sdk/player-token",
+      { player_email: input.playerEmail },
+      this.auth
+    );
+    return {
+      token: requireField(raw["token"], "token", raw),
+      expiresAt: String(raw["expires_at"] ?? ""),
+      identityId: String(raw["identity_id"] ?? "")
+    };
+  }
+  /** Initiate a cross-game currency SEND. Inspect result.verificationMethod. */
+  async initiateSend(input) {
+    const raw = await this.http.post(
+      "/api/currency-sends/initiate-send",
+      {
+        client_request_id: input.clientRequestId,
+        sender_player_name: input.senderPlayerName,
+        sender_player_email: input.senderPlayerEmail,
+        sender_player_phone: input.senderPlayerPhone,
+        receiver_player_email: input.receiverPlayerEmail,
+        receiver_player_phone: input.receiverPlayerPhone,
+        receiving_game_id: input.receivingGameId,
+        amount: input.amount
+      },
+      this.auth
+    );
+    return this.toInitiateResult(raw);
+  }
+  /** Initiate a cross-game TRANSFER. Inspect result.verificationMethod. */
+  async initiateTransfer(input) {
+    const raw = await this.http.post(
+      "/api/transfers/initiate-transfer",
+      {
+        client_request_id: input.clientRequestId,
+        source_player_name: input.sourcePlayerName,
+        source_player_email: input.sourcePlayerEmail,
+        source_player_phone: input.sourcePlayerPhone,
+        target_player_email: input.targetPlayerEmail,
+        target_player_phone: input.targetPlayerPhone,
+        target_game_id: input.targetGameId,
+        amount: input.amount
+      },
+      this.auth
+    );
+    return this.toInitiateResult(raw);
+  }
+  /** Create a hosted checkout session (the recommended purchase path). Open the
+   *  returned checkoutUrl in a WebView/redirect or an iframe; the INVO-hosted page
+   *  handles cards, saved cards, and 3-D Secure. Crediting is server-side via the
+   *  purchase.completed webhook. */
+  async createCheckout(input) {
+    assertUsdAmount(input.usdAmount);
+    const body = {
+      player_email: input.playerEmail,
+      usd_amount: input.usdAmount
+    };
+    if (input.rail) body["rail"] = input.rail;
+    if (input.successUrl) body["success_url"] = input.successUrl;
+    if (input.cancelUrl) body["cancel_url"] = input.cancelUrl;
+    if (input.metadata) body["metadata"] = input.metadata;
+    const raw = await this.http.post(
+      "/api/checkout/sessions",
+      body,
+      this.auth
+    );
+    return {
+      sessionId: String(raw["session_id"] ?? ""),
+      checkoutUrl: requireField(raw["checkout_url"], "checkout_url", raw),
+      expiresAt: String(raw["expires_at"] ?? ""),
+      raw
+    };
+  }
+  /**
+   * Direct purchase via the rail selector. Use when you need a specific rail.
+   * - rail "platform" (default): standard card. May return status "requires_action"
+   *   (run client-side 3-D Secure with clientSecret, then call confirmPayment).
+   * - rail "game": returns status "pending_payment" + paymentUrl (redirect the browser).
+   * - rail "steam": NOT a browser flow — the backend returns WRONG_RAIL_ENDPOINT.
+   */
+  async purchaseCurrency(input) {
+    assertUsdAmount(input.usdAmount);
+    if (!input.purchaseReference) {
+      throw new InvoError({
+        message: "purchaseReference is required (idempotency key for the purchase).",
+        code: "MISSING_PURCHASE_REFERENCE",
+        status: 0
+      });
+    }
+    if (input.rail === "steam") {
+      throw new InvoError({
+        message: 'rail "steam" is not a /purchase-currency flow \u2014 Steam uses the dedicated in-client Steam endpoints.',
+        code: "WRONG_RAIL_ENDPOINT",
+        status: 0
+      });
+    }
+    const body = {
+      player_email: input.playerEmail,
+      usd_amount: input.usdAmount,
+      purchase_reference: input.purchaseReference
+    };
+    if (input.rail) body["rail"] = input.rail;
+    if (input.paymentMethodId) body["payment_method_id"] = input.paymentMethodId;
+    if (input.savedCardId) body["saved_card_id"] = input.savedCardId;
+    if (input.playerName) body["player_name"] = input.playerName;
+    if (input.playerPhone) body["player_phone"] = input.playerPhone;
+    const raw = await this.http.post(
+      "/api/currency-purchases/purchase-currency",
+      body,
+      this.auth
+    );
+    return {
+      status: String(raw["status"] ?? ""),
+      clientSecret: raw["client_secret"],
+      paymentIntentId: raw["payment_intent_id"],
+      paymentUrl: raw["payment_url"],
+      transactionId: raw["transaction_id"],
+      orderId: raw["order_id"],
+      newBalance: raw["new_balance"] ?? null,
+      raw
+    };
+  }
+  /** Complete the Stripe-rail 3-D Secure step after the client finished card action. */
+  async confirmPayment(input) {
+    const body = { payment_intent_id: input.paymentIntentId };
+    if (input.orderId) body["order_id"] = input.orderId;
+    return this.http.post(
+      "/api/currency-purchases/confirm-payment",
+      body,
+      this.auth
+    );
+  }
+  /** Fetch purchase status (order + financial summary + timeline). */
+  async getOrderDetails(query) {
+    if (!query.orderId && !query.transactionId) {
+      throw new InvoError({
+        message: "getOrderDetails requires an `orderId` or `transactionId`.",
+        code: "INVALID_INPUT",
+        status: 0
+      });
+    }
+    const q = new URLSearchParams();
+    if (query.orderId) q.set("order_id", query.orderId);
+    if (query.transactionId) q.set("transaction_id", query.transactionId);
+    return this.http.get(
+      `/api/currency-purchases/order-details?${q.toString()}`,
+      this.auth
+    );
+  }
+  toInitiateResult(raw) {
+    const vm = raw["verification_method"];
+    const guardian = raw["guardian_approval"];
+    return {
+      transactionId: String(raw["transaction_id"] ?? ""),
+      verificationMethod: vm === "in_app" || vm === "sms" ? vm : void 0,
+      guardianApproval: guardian ?? void 0,
+      raw
+    };
+  }
+};
+
+export { InvoServer };
+//# sourceMappingURL=server.js.map
+//# sourceMappingURL=server.js.map

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "@invonetwork/web-sdk",
+  "version": "0.1.0",
+  "description": "INVO Web SDK — currency purchase + passkey (WebAuthn) verification for partner web platforms.",
+  "license": "UNLICENSED",
+  "private": false,
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Invo-Technologies/invo-web-sdk.git"
+  },
+  "homepage": "https://docs.invo.network",
+  "bugs": {
+    "url": "https://github.com/Invo-Technologies/invo-web-sdk/issues"
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=18"
+  },
+  "sideEffects": false,
+  "files": [
+    "dist",
+    "!dist/**/*.map",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js",
+      "require": "./dist/server.cjs"
+    }
+  },
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "clean": "rimraf dist",
+    "prepublishOnly": "npm run clean && npm run build"
+  },
+  "keywords": [
+    "invo",
+    "webauthn",
+    "passkey",
+    "payments",
+    "game-currency",
+    "sdk"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "rimraf": "^5.0.5",
+    "tsup": "^8.0.1",
+    "typescript": "^5.4.5",
+    "vitest": "^1.5.0"
+  }
+}