@invonetwork/web-sdk 0.2.1 → 0.4.0

package/CHANGELOG.md

@@ -1,7 +1,53 @@
 # Changelog
 
 All notable changes to `@invonetwork/web-sdk` are documented here. This project follows
-[Semantic Versioning](https://semver.org/).
+[Semantic Versioning](https://semver.org/). Releases are managed with
+[changesets](https://github.com/changesets/changesets).
+
+## [0.4.0] — 2026-06-30
+
+Additive release — more server reads, edge-ready webhooks, cancellation, and tooling.
+
+- **`getInboundPending({ playerEmail | playerPhone })`** — live, unclaimed inbound
+  sends/transfers for a player (the source of truth behind the "you have X to collect"
+  badge; pairs with `transfer.claim_pending`).
+- **`verifyWebhookAsync`** — Web Crypto variant of `verifyWebhook` that runs on
+  Cloudflare Workers / Deno / Vercel+Netlify Edge / Bun / browsers; and
+  **`createWebhookHandler`** — a zero-dep Fetch-API `(Request) => Promise<Response>`
+  webhook route handler (Next.js App Router, Workers, Deno, Hono, Bun).
+- **`iterateItemPurchaseHistory`** — async iterator that pages through a player's
+  full item-purchase history.
+- **Per-call `AbortSignal`** — every method accepts an optional `{ signal }`; an
+  aborted call throws `InvoError` code `ABORTED` and is never retried.
+- **Tooling**: ESLint (+ lint in CI), changesets release automation, `SECURITY.md`,
+  and `CODEOWNERS`.
+
+## [0.3.0] — 2026-06-30
+
+Additive release — new server capabilities plus transport resilience/observability.
+
+- **Webhook verification** (`/server`): `verifyWebhook(rawBody, signatureHeader, secret | secrets, opts?)`
+  — constant-time HMAC-SHA256 over `${t}.${rawBody}`, 5-minute replay window,
+  multi-secret rotation; returns a typed `InvoWebhookEvent` discriminated union
+  (`purchase.*`, `item.purchased`, `transfer.*`, `payout.status_changed`, `webhook.test`).
+  Throws `InvoError` (`WEBHOOK_SIGNATURE_INVALID` / `WEBHOOK_TIMESTAMP_EXPIRED` /
+  `WEBHOOK_MALFORMED` / `WEBHOOK_SECRET_MISSING`). Server-only; the browser bundle
+  stays crypto-free. Independently security-audited.
+- **`getPlayerBalance({ playerEmail | playerId })`** (`/server`): typed `player` / `balances` / `summary`.
+- **Automatic retries**: network errors/timeouts, `429` (honoring `retry_after`), and
+  `5xx` are retried with exponential backoff + jitter. New config `maxRetries`
+  (default 2, `0` disables) and `retryBaseDelayMs` (default 250).
+- **Observability hooks**: optional `onRequest` / `onResponse` / `onError` on both
+  entries (best-effort/non-throwing); `InvoError.requestId` carries the backend
+  request id for support/tracing.
+- **Typed reads**: `confirmPayment` → `ConfirmPaymentResult`; `getOrderDetails` /
+  `getItemOrderDetails` → `OrderDetailsResult`; `getItemPurchaseHistory` →
+  `ItemHistoryResult` (previously untyped `Record`). All keep `raw`.
+- **Light validation**: `mintPlayerToken` and `createCheckout` require a non-blank
+  `playerEmail` (throws `INVALID_INPUT` before the network call).
+- **License**: `package.json` `license` is now `SEE LICENSE IN LICENSE` (was
+  `UNLICENSED`); `LICENSE` rewritten as an explicit install-and-use grant for
+  building INVO integrations.
 
 ## [0.2.1] — 2026-06-30
 
@@ -53,6 +99,7 @@ Initial scaffold.
 - Contracts extracted + auditor-verified against the INVO backend.
 
 ### Hardening (independent red-team pass)
+
 - **Guardian/minor `202` path no longer mismapped to `verificationMethod:"sms"`** —
   `initiateSend`/`initiateTransfer` now return `verificationMethod: undefined` and a
   `guardianApproval` block on the guardian path, so callers don't route into the

package/LICENSE

@@ -1,17 +1,18 @@
-Copyright (c) 2026 Invo Tech Inc. All rights reserved.
-
-This software and associated documentation files (the "Software") are the
-proprietary and confidential property of Invo Tech Inc. ("INVO"). The Software
-is licensed, not sold, for use solely in connection with integrating the INVO
-platform under a separate written agreement with INVO.
-
-Without a valid agreement with INVO, you may not use, copy, modify, merge,
-publish, distribute, sublicense, or sell copies of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED. IN NO EVENT SHALL INVO BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER
-LIABILITY ARISING FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE.
-
-NOTE: Licensing for a partner-distributed SDK is a business decision — if INVO
-prefers a permissive license (e.g. MIT/Apache-2.0) so partners can freely
-vendor the package, replace this file and the "license" field in package.json.
+Copyright (c) 2026 Invo Tech Inc. All rights reserved.
+
+This software and associated documentation files (the "Software") are the
+proprietary property of Invo Tech Inc. ("INVO"). The Software is licensed, not
+sold.
+
+GRANT. INVO grants you a non-exclusive, non-transferable, royalty-free license to
+install and use the Software, in unmodified form, solely to build and operate
+integrations with the INVO platform, subject to INVO's developer terms at
+https://invo.network.
+
+RESTRICTIONS. Except as expressly permitted above, you may not copy, modify,
+distribute, sublicense, sell, or create derivative works of the Software, or
+remove any proprietary notices, without INVO's prior written consent.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED. IN NO EVENT SHALL INVO BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER
+LIABILITY ARISING FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE.