@invonetwork/web-sdk 0.2.1 → 0.3.0

package/CHANGELOG.md

@@ -3,6 +3,33 @@
 All notable changes to `@invonetwork/web-sdk` are documented here. This project follows
 [Semantic Versioning](https://semver.org/).
 
+## [0.3.0] — 2026-06-30
+
+Additive release — new server capabilities plus transport resilience/observability.
+
+- **Webhook verification** (`/server`): `verifyWebhook(rawBody, signatureHeader, secret | secrets, opts?)`
+  — constant-time HMAC-SHA256 over `${t}.${rawBody}`, 5-minute replay window,
+  multi-secret rotation; returns a typed `InvoWebhookEvent` discriminated union
+  (`purchase.*`, `item.purchased`, `transfer.*`, `payout.status_changed`, `webhook.test`).
+  Throws `InvoError` (`WEBHOOK_SIGNATURE_INVALID` / `WEBHOOK_TIMESTAMP_EXPIRED` /
+  `WEBHOOK_MALFORMED` / `WEBHOOK_SECRET_MISSING`). Server-only; the browser bundle
+  stays crypto-free. Independently security-audited.
+- **`getPlayerBalance({ playerEmail | playerId })`** (`/server`): typed `player` / `balances` / `summary`.
+- **Automatic retries**: network errors/timeouts, `429` (honoring `retry_after`), and
+  `5xx` are retried with exponential backoff + jitter. New config `maxRetries`
+  (default 2, `0` disables) and `retryBaseDelayMs` (default 250).
+- **Observability hooks**: optional `onRequest` / `onResponse` / `onError` on both
+  entries (best-effort/non-throwing); `InvoError.requestId` carries the backend
+  request id for support/tracing.
+- **Typed reads**: `confirmPayment` → `ConfirmPaymentResult`; `getOrderDetails` /
+  `getItemOrderDetails` → `OrderDetailsResult`; `getItemPurchaseHistory` →
+  `ItemHistoryResult` (previously untyped `Record`). All keep `raw`.
+- **Light validation**: `mintPlayerToken` and `createCheckout` require a non-blank
+  `playerEmail` (throws `INVALID_INPUT` before the network call).
+- **License**: `package.json` `license` is now `SEE LICENSE IN LICENSE` (was
+  `UNLICENSED`); `LICENSE` rewritten as an explicit install-and-use grant for
+  building INVO integrations.
+
 ## [0.2.1] — 2026-06-30
 
 Docs only — no code change (republished so the npm page README is current).

package/LICENSE

@@ -1,17 +1,18 @@
-Copyright (c) 2026 Invo Tech Inc. All rights reserved.
-
-This software and associated documentation files (the "Software") are the
-proprietary and confidential property of Invo Tech Inc. ("INVO"). The Software
-is licensed, not sold, for use solely in connection with integrating the INVO
-platform under a separate written agreement with INVO.
-
-Without a valid agreement with INVO, you may not use, copy, modify, merge,
-publish, distribute, sublicense, or sell copies of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED. IN NO EVENT SHALL INVO BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER
-LIABILITY ARISING FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE.
-
-NOTE: Licensing for a partner-distributed SDK is a business decision — if INVO
-prefers a permissive license (e.g. MIT/Apache-2.0) so partners can freely
-vendor the package, replace this file and the "license" field in package.json.
+Copyright (c) 2026 Invo Tech Inc. All rights reserved.
+
+This software and associated documentation files (the "Software") are the
+proprietary property of Invo Tech Inc. ("INVO"). The Software is licensed, not
+sold.
+
+GRANT. INVO grants you a non-exclusive, non-transferable, royalty-free license to
+install and use the Software, in unmodified form, solely to build and operate
+integrations with the INVO platform, subject to INVO's developer terms at
+https://invo.network.
+
+RESTRICTIONS. Except as expressly permitted above, you may not copy, modify,
+distribute, sublicense, sell, or create derivative works of the Software, or
+remove any proprietary notices, without INVO's prior written consent.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED. IN NO EVENT SHALL INVO BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER
+LIABILITY ARISING FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE.