@invonetwork/web-sdk 0.2.1 → 0.4.0

package/dist/chunk-EEWOAUXO.js

@@ -0,0 +1,249 @@
+// src/shared/errors.ts
+var InvoError = class _InvoError extends Error {
+  constructor(args) {
+    super(args.message);
+    this.name = "InvoError";
+    this.code = args.code;
+    this.status = args.status;
+    this.body = args.body ?? null;
+    this.requestId = args.requestId;
+    Object.setPrototypeOf(this, _InvoError.prototype);
+  }
+  /** True if this is the "recipient isn't passkey-enrolled, fall back to claim code" signal. */
+  get isReceiverNotEnrolled() {
+    return this.code === "receiver_not_enrolled_use_claim_code" || /receiver_not_enrolled_use_claim_code/i.test(this.message);
+  }
+  /** True if the session/SDK token has expired and the caller should re-mint + retry. */
+  get isTokenExpired() {
+    return this.code === "SDK_TOKEN_EXPIRED";
+  }
+  /**
+   * True if an item purchase failed because the player's balance was too low (§4.8 → 400).
+   * The backend carries `required_amount` + `current_balance` on the body for the UI.
+   * Gated to status 400 so the `429 insufficient_balance_blocked` abuse throttle (which
+   * is a rate-limit, not a top-up condition) is NOT misclassified as this.
+   */
+  get isInsufficientBalance() {
+    if (this.status !== 400) return false;
+    const b = this.bodyObject();
+    return this.code === "INSUFFICIENT_BALANCE" || "required_amount" in b || /insufficient[_ ]balance/i.test(this.message);
+  }
+  /** True if an idempotency-keyed request was a duplicate (item purchase → 409). */
+  get isDuplicateRequest() {
+    return this.code === "DUPLICATE_REQUEST" || this.status === 409 && /duplicate/i.test(this.message);
+  }
+  /** Seconds to wait before retrying, when the backend throttled the call (429 `retry_after`). */
+  get retryAfter() {
+    const v = this.bodyObject()["retry_after"];
+    const n = typeof v === "string" ? Number(v) : v;
+    return typeof n === "number" && Number.isFinite(n) && n >= 0 ? n : void 0;
+  }
+  /** `body` as a plain object, or `{}` if it's a string/number/null (non-JSON responses).
+   *  The `in` operator throws on primitives, so callers must go through this. */
+  bodyObject() {
+    return this.body && typeof this.body === "object" ? this.body : {};
+  }
+};
+function errorFromResponse(status, body, requestId) {
+  let message = `INVO request failed (HTTP ${status})`;
+  let code;
+  if (body && typeof body === "object") {
+    const b = body;
+    if (typeof b["code"] === "string") code = b["code"];
+    if (typeof b["error"] === "string") message = b["error"];
+    else if (typeof b["message"] === "string") message = b["message"];
+  } else if (typeof body === "string" && body.trim()) {
+    message = body;
+  }
+  return new InvoError({ message, code, status, body, requestId });
+}
+
+// src/shared/http.ts
+var DEFAULT_TIMEOUT = 3e4;
+var MAX_RETRY_AFTER_MS = 2e4;
+function assertSecureBaseUrl(baseUrl) {
+  let u;
+  try {
+    u = new URL(baseUrl);
+  } catch {
+    throw new Error(`Invalid baseUrl: ${baseUrl}`);
+  }
+  const isLocal = u.hostname === "localhost" || u.hostname === "127.0.0.1" || u.hostname === "[::1]";
+  if (u.protocol === "https:" || u.protocol === "http:" && isLocal) return;
+  throw new Error(
+    `baseUrl must use https:// (got "${u.protocol}//"). Plaintext would expose the token/secret on the wire.`
+  );
+}
+var _Http = class _Http {
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
+    this.timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT;
+    const f = opts.fetchImpl ?? globalThis.fetch;
+    if (typeof f !== "function") {
+      throw new Error(
+        "No fetch implementation available. Use Node >=18, or pass `fetch` in the config."
+      );
+    }
+    this.fetchImpl = f;
+    this.userAgent = opts.userAgent;
+    this.maxRetries = Math.max(0, opts.maxRetries ?? 2);
+    this.retryBaseDelayMs = opts.retryBaseDelayMs ?? 250;
+    this.hooks = opts.hooks;
+  }
+  /**
+   * @param opts.idempotent - mark this POST safe to auto-retry (it carries an
+   *   idempotency key, or has no side effect). Default false: non-idempotent POSTs
+   *   (e.g. single-use WebAuthn assertions) are NEVER auto-retried.
+   */
+  async post(path, body, auth, opts) {
+    return this.request("POST", path, body, auth, opts?.idempotent ?? false, opts?.signal);
+  }
+  // GET is always idempotent → safe to retry.
+  async get(path, auth, opts) {
+    return this.request("GET", path, void 0, auth, true, opts?.signal);
+  }
+  authHeaders(auth) {
+    switch (auth.kind) {
+      case "game-secret":
+        return { "X-Game-Secret-Key": auth.secret };
+      case "bearer":
+        return { Authorization: `Bearer ${auth.token}` };
+      case "none":
+        return {};
+    }
+  }
+  async request(method, path, body, auth, idempotent, signal) {
+    const url = `${this.baseUrl}${path}`;
+    const headers = {
+      Accept: "application/json",
+      ...this.authHeaders(auth)
+    };
+    if (this.userAgent) headers["User-Agent"] = this.userAgent;
+    if (body !== void 0) headers["Content-Type"] = "application/json";
+    const payload = body !== void 0 ? JSON.stringify(body) : void 0;
+    for (let attempt = 0; ; attempt++) {
+      if (signal?.aborted) throw abortError(path);
+      const start = Date.now();
+      this.fire("onRequest", { method, url, attempt });
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+      const onAbort = () => controller.abort();
+      signal?.addEventListener("abort", onAbort, { once: true });
+      let res;
+      let networkError;
+      try {
+        res = await this.fetchImpl(url, { method, headers, body: payload, signal: controller.signal });
+      } catch (err) {
+        networkError = new InvoError({
+          message: err instanceof Error && err.name === "AbortError" ? `Request to ${path} timed out after ${this.timeoutMs}ms` : `Network error calling ${path}: ${err?.message ?? err}`,
+          status: 0,
+          body: null
+        });
+      } finally {
+        clearTimeout(timer);
+        signal?.removeEventListener("abort", onAbort);
+      }
+      if (networkError) {
+        if (signal?.aborted) throw abortError(path);
+        const willRetry = idempotent && attempt < this.maxRetries;
+        this.fire("onError", { method, url, attempt, error: networkError, willRetry });
+        if (willRetry) {
+          await sleep(this.backoff(attempt), signal);
+          continue;
+        }
+        throw networkError;
+      }
+      const requestId = pickRequestId(res.headers);
+      const text = await res.text();
+      let parsed = null;
+      if (text) {
+        try {
+          parsed = JSON.parse(text);
+        } catch {
+          parsed = text;
+        }
+      }
+      this.fire("onResponse", {
+        method,
+        url,
+        attempt,
+        status: res.status,
+        durationMs: Date.now() - start,
+        requestId
+      });
+      if (!res.ok) {
+        const err = errorFromResponse(res.status, parsed, requestId);
+        let wait;
+        if (idempotent && attempt < this.maxRetries && _Http.RETRIABLE_STATUS.has(res.status)) {
+          if (res.status === 429) {
+            const ra = retryAfterMs(parsed, res.headers);
+            wait = ra === void 0 ? this.backoff(attempt) : ra <= MAX_RETRY_AFTER_MS ? ra : void 0;
+          } else {
+            wait = this.backoff(attempt);
+          }
+        }
+        this.fire("onError", { method, url, attempt, error: err, willRetry: wait !== void 0 });
+        if (wait !== void 0) {
+          await sleep(wait, signal);
+          continue;
+        }
+        throw err;
+      }
+      return parsed ?? {};
+    }
+  }
+  /** Invoke an observability hook, swallowing any error it throws (best-effort). */
+  fire(name, info) {
+    const hook = this.hooks?.[name];
+    if (!hook) return;
+    try {
+      hook(info);
+    } catch {
+    }
+  }
+  /** Exponential backoff with full jitter: base * 2^attempt, randomized. */
+  backoff(attempt) {
+    const ceil = this.retryBaseDelayMs * 2 ** attempt;
+    return Math.floor(Math.random() * ceil) + this.retryBaseDelayMs;
+  }
+};
+/** HTTP statuses worth retrying — rate limit + transient gateway/server errors. */
+_Http.RETRIABLE_STATUS = /* @__PURE__ */ new Set([429, 500, 502, 503, 504]);
+var Http = _Http;
+function sleep(ms, signal) {
+  return new Promise((resolve) => {
+    if (signal?.aborted) return resolve();
+    const timer = setTimeout(done, ms);
+    const onAbort = () => done();
+    function done() {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function abortError(path) {
+  return new InvoError({ message: `Request to ${path} was aborted`, code: "ABORTED", status: 0 });
+}
+function pickRequestId(headers) {
+  if (!headers || typeof headers.get !== "function") return void 0;
+  return headers.get("x-invo-request-id") ?? headers.get("x-request-id") ?? void 0;
+}
+function retryAfterMs(parsed, headers) {
+  if (parsed && typeof parsed === "object") {
+    const v = parsed["retry_after"];
+    const n = typeof v === "string" ? Number(v) : v;
+    if (typeof n === "number" && Number.isFinite(n) && n >= 0) return n * 1e3;
+  }
+  const header = headers && typeof headers.get === "function" ? headers.get("retry-after") : null;
+  if (header) {
+    const n = Number(header);
+    if (Number.isFinite(n) && n >= 0) return n * 1e3;
+  }
+  return void 0;
+}
+
+export { Http, InvoError, assertSecureBaseUrl };
+//# sourceMappingURL=chunk-EEWOAUXO.js.map
+//# sourceMappingURL=chunk-EEWOAUXO.js.map

package/dist/index.cjs

@@ -8,6 +8,7 @@ var InvoError = class _InvoError extends Error {
     this.code = args.code;
     this.status = args.status;
     this.body = args.body ?? null;
+    this.requestId = args.requestId;
     Object.setPrototypeOf(this, _InvoError.prototype);
   }
   /** True if this is the "recipient isn't passkey-enrolled, fall back to claim code" signal. */
@@ -45,7 +46,7 @@ var InvoError = class _InvoError extends Error {
     return this.body && typeof this.body === "object" ? this.body : {};
   }
 };
-function errorFromResponse(status, body) {
+function errorFromResponse(status, body, requestId) {
   let message = `INVO request failed (HTTP ${status})`;
   let code;
   if (body && typeof body === "object") {
@@ -56,11 +57,12 @@ function errorFromResponse(status, body) {
   } else if (typeof body === "string" && body.trim()) {
     message = body;
   }
-  return new InvoError({ message, code, status, body });
+  return new InvoError({ message, code, status, body, requestId });
 }
 
 // src/shared/http.ts
 var DEFAULT_TIMEOUT = 3e4;
+var MAX_RETRY_AFTER_MS = 2e4;
 function assertSecureBaseUrl(baseUrl) {
   let u;
   try {
@@ -74,7 +76,7 @@ function assertSecureBaseUrl(baseUrl) {
     `baseUrl must use https:// (got "${u.protocol}//"). Plaintext would expose the token/secret on the wire.`
   );
 }
-var Http = class {
+var _Http = class _Http {
   constructor(opts) {
     this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
     this.timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT;
@@ -86,12 +88,21 @@ var Http = class {
     }
     this.fetchImpl = f;
     this.userAgent = opts.userAgent;
+    this.maxRetries = Math.max(0, opts.maxRetries ?? 2);
+    this.retryBaseDelayMs = opts.retryBaseDelayMs ?? 250;
+    this.hooks = opts.hooks;
   }
-  async post(path, body, auth) {
-    return this.request("POST", path, body, auth);
+  /**
+   * @param opts.idempotent - mark this POST safe to auto-retry (it carries an
+   *   idempotency key, or has no side effect). Default false: non-idempotent POSTs
+   *   (e.g. single-use WebAuthn assertions) are NEVER auto-retried.
+   */
+  async post(path, body, auth, opts) {
+    return this.request("POST", path, body, auth, opts?.idempotent ?? false, opts?.signal);
   }
-  async get(path, auth) {
-    return this.request("GET", path, void 0, auth);
+  // GET is always idempotent → safe to retry.
+  async get(path, auth, opts) {
+    return this.request("GET", path, void 0, auth, true, opts?.signal);
   }
   authHeaders(auth) {
     switch (auth.kind) {
@@ -103,7 +114,7 @@ var Http = class {
         return {};
     }
   }
-  async request(method, path, body, auth) {
+  async request(method, path, body, auth, idempotent, signal) {
     const url = `${this.baseUrl}${path}`;
     const headers = {
       Accept: "application/json",
@@ -111,38 +122,129 @@ var Http = class {
     };
     if (this.userAgent) headers["User-Agent"] = this.userAgent;
     if (body !== void 0) headers["Content-Type"] = "application/json";
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
-    let res;
-    try {
-      res = await this.fetchImpl(url, {
+    const payload = body !== void 0 ? JSON.stringify(body) : void 0;
+    for (let attempt = 0; ; attempt++) {
+      if (signal?.aborted) throw abortError(path);
+      const start = Date.now();
+      this.fire("onRequest", { method, url, attempt });
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+      const onAbort = () => controller.abort();
+      signal?.addEventListener("abort", onAbort, { once: true });
+      let res;
+      let networkError;
+      try {
+        res = await this.fetchImpl(url, { method, headers, body: payload, signal: controller.signal });
+      } catch (err) {
+        networkError = new InvoError({
+          message: err instanceof Error && err.name === "AbortError" ? `Request to ${path} timed out after ${this.timeoutMs}ms` : `Network error calling ${path}: ${err?.message ?? err}`,
+          status: 0,
+          body: null
+        });
+      } finally {
+        clearTimeout(timer);
+        signal?.removeEventListener("abort", onAbort);
+      }
+      if (networkError) {
+        if (signal?.aborted) throw abortError(path);
+        const willRetry = idempotent && attempt < this.maxRetries;
+        this.fire("onError", { method, url, attempt, error: networkError, willRetry });
+        if (willRetry) {
+          await sleep(this.backoff(attempt), signal);
+          continue;
+        }
+        throw networkError;
+      }
+      const requestId = pickRequestId(res.headers);
+      const text = await res.text();
+      let parsed = null;
+      if (text) {
+        try {
+          parsed = JSON.parse(text);
+        } catch {
+          parsed = text;
+        }
+      }
+      this.fire("onResponse", {
         method,
-        headers,
-        body: body !== void 0 ? JSON.stringify(body) : void 0,
-        signal: controller.signal
-      });
-    } catch (err) {
-      throw new InvoError({
-        message: err instanceof Error && err.name === "AbortError" ? `Request to ${path} timed out after ${this.timeoutMs}ms` : `Network error calling ${path}: ${err?.message ?? err}`,
-        status: 0,
-        body: null
+        url,
+        attempt,
+        status: res.status,
+        durationMs: Date.now() - start,
+        requestId
       });
-    } finally {
-      clearTimeout(timer);
-    }
-    const text = await res.text();
-    let parsed = null;
-    if (text) {
-      try {
-        parsed = JSON.parse(text);
-      } catch {
-        parsed = text;
+      if (!res.ok) {
+        const err = errorFromResponse(res.status, parsed, requestId);
+        let wait;
+        if (idempotent && attempt < this.maxRetries && _Http.RETRIABLE_STATUS.has(res.status)) {
+          if (res.status === 429) {
+            const ra = retryAfterMs(parsed, res.headers);
+            wait = ra === void 0 ? this.backoff(attempt) : ra <= MAX_RETRY_AFTER_MS ? ra : void 0;
+          } else {
+            wait = this.backoff(attempt);
+          }
+        }
+        this.fire("onError", { method, url, attempt, error: err, willRetry: wait !== void 0 });
+        if (wait !== void 0) {
+          await sleep(wait, signal);
+          continue;
+        }
+        throw err;
       }
+      return parsed ?? {};
     }
-    if (!res.ok) throw errorFromResponse(res.status, parsed);
-    return parsed ?? {};
+  }
+  /** Invoke an observability hook, swallowing any error it throws (best-effort). */
+  fire(name, info) {
+    const hook = this.hooks?.[name];
+    if (!hook) return;
+    try {
+      hook(info);
+    } catch {
+    }
+  }
+  /** Exponential backoff with full jitter: base * 2^attempt, randomized. */
+  backoff(attempt) {
+    const ceil = this.retryBaseDelayMs * 2 ** attempt;
+    return Math.floor(Math.random() * ceil) + this.retryBaseDelayMs;
   }
 };
+/** HTTP statuses worth retrying — rate limit + transient gateway/server errors. */
+_Http.RETRIABLE_STATUS = /* @__PURE__ */ new Set([429, 500, 502, 503, 504]);
+var Http = _Http;
+function sleep(ms, signal) {
+  return new Promise((resolve) => {
+    if (signal?.aborted) return resolve();
+    const timer = setTimeout(done, ms);
+    const onAbort = () => done();
+    function done() {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function abortError(path) {
+  return new InvoError({ message: `Request to ${path} was aborted`, code: "ABORTED", status: 0 });
+}
+function pickRequestId(headers) {
+  if (!headers || typeof headers.get !== "function") return void 0;
+  return headers.get("x-invo-request-id") ?? headers.get("x-request-id") ?? void 0;
+}
+function retryAfterMs(parsed, headers) {
+  if (parsed && typeof parsed === "object") {
+    const v = parsed["retry_after"];
+    const n = typeof v === "string" ? Number(v) : v;
+    if (typeof n === "number" && Number.isFinite(n) && n >= 0) return n * 1e3;
+  }
+  const header = headers && typeof headers.get === "function" ? headers.get("retry-after") : null;
+  if (header) {
+    const n = Number(header);
+    if (Number.isFinite(n) && n >= 0) return n * 1e3;
+  }
+  return void 0;
+}
 
 // src/shared/webauthn.ts
 function b64urlToBuffer(value) {
@@ -234,7 +336,10 @@ var InvoClient = class {
     this.http = new Http({
       baseUrl: config.baseUrl,
       timeoutMs: config.timeoutMs,
-      fetchImpl: config.fetch
+      fetchImpl: config.fetch,
+      maxRetries: config.maxRetries,
+      retryBaseDelayMs: config.retryBaseDelayMs,
+      hooks: config.hooks
       // Browser: do NOT set User-Agent (forbidden header); the browser's own UA is fine.
     });
     this.auth = { kind: "bearer", token: config.token };
@@ -246,38 +351,43 @@ var InvoClient = class {
     }
   }
   /** Enroll a passkey for the token's identity (register/begin -> create() -> register/complete). */
-  async enrollPasskey() {
+  async enrollPasskey(opts) {
     this.assertWebAuthn();
+    const signal = opts?.signal;
     return this.withTokenRetry(async () => {
       const options = await this.post(
-        "/api/sdk/webauthn/register/begin"
+        "/api/sdk/webauthn/register/begin",
+        void 0,
+        signal
       );
       const cred = await navigator.credentials.create({
-        publicKey: toCreationOptions(options)
+        publicKey: toCreationOptions(options),
+        signal
       });
       if (!cred) throw new Error("Passkey creation was cancelled or returned no credential.");
       const raw = await this.post(
         "/api/sdk/webauthn/register/complete",
-        { credential: registrationToJSON(cred) }
+        { credential: registrationToJSON(cred) },
+        signal
       );
       return { status: String(raw["status"] ?? ""), device: raw["device"] ?? null, raw };
     });
   }
   /** Approve a SEND with the player's passkey. */
-  async approveSend(transactionId) {
-    return this.approve("send", transactionId);
+  async approveSend(transactionId, opts) {
+    return this.approve("send", transactionId, opts);
   }
   /** Approve a TRANSFER with the player's passkey (returns the sender's claim code). */
-  async approveTransfer(transactionId) {
-    return this.approve("transfers", transactionId);
+  async approveTransfer(transactionId, opts) {
+    return this.approve("transfers", transactionId, opts);
   }
   /** Recipient self-claims a SEND with their passkey. */
-  async confirmReceiptSend(transactionId) {
-    return this.confirmReceipt("send", transactionId);
+  async confirmReceiptSend(transactionId, opts) {
+    return this.confirmReceipt("send", transactionId, opts);
   }
   /** Recipient self-claims a TRANSFER with their passkey. */
-  async confirmReceiptTransfer(transactionId) {
-    return this.confirmReceipt("transfers", transactionId);
+  async confirmReceiptTransfer(transactionId, opts) {
+    return this.confirmReceipt("transfers", transactionId, opts);
   }
   /**
    * Interchangeable methods (§4.6): prove an *already-enrolled* method (e.g. the
@@ -287,15 +397,19 @@ var InvoClient = class {
    *
    * begin -> navigator.credentials.get() -> complete with { link_id, webauthn_assertion }.
    */
-  async linkDevice(linkId) {
+  async linkDevice(linkId, opts) {
     if (!linkId) throw new Error("linkDevice requires a `linkId`.");
+    const signal = opts?.signal;
     return this.withTokenRetry(async () => {
-      const assertion = await this.runAssertion("/api/sdk/device/link/webauthn/begin", {
-        link_id: linkId
-      });
+      const assertion = await this.runAssertion(
+        "/api/sdk/device/link/webauthn/begin",
+        { link_id: linkId },
+        signal
+      );
       const raw = await this.post(
         "/api/sdk/device/link/webauthn/complete",
-        { link_id: linkId, webauthn_assertion: assertion }
+        { link_id: linkId, webauthn_assertion: assertion },
+        signal
       );
       return { status: String(raw["status"] ?? ""), raw };
     });
@@ -303,8 +417,8 @@ var InvoClient = class {
   // --- internals ---
   /** POST with the current player token. Token-expiry retry is handled one level
    *  up by withTokenRetry (which re-runs the whole ceremony, not a single call). */
-  async post(path, body) {
-    return this.http.post(path, body, this.auth);
+  async post(path, body, signal) {
+    return this.http.post(path, body, this.auth, { signal });
   }
   /**
    * Run a whole flow, retrying it ONCE if any call fails with SDK_TOKEN_EXPIRED
@@ -335,22 +449,29 @@ var InvoClient = class {
     this.auth = { kind: "bearer", token: fresh };
     return true;
   }
-  async runAssertion(beginPath, beginBody) {
+  async runAssertion(beginPath, beginBody, signal) {
     this.assertWebAuthn();
-    const options = await this.post(beginPath, beginBody);
+    const options = await this.post(beginPath, beginBody, signal);
     const cred = await navigator.credentials.get({
-      publicKey: toRequestOptions(options)
+      publicKey: toRequestOptions(options),
+      signal
     });
     if (!cred) throw new Error("Passkey assertion was cancelled or returned no credential.");
     return assertionToJSON(cred);
   }
-  async approve(flow, transactionId) {
+  async approve(flow, transactionId, opts) {
     const id = encodeURIComponent(transactionId);
+    const signal = opts?.signal;
     return this.withTokenRetry(async () => {
-      const assertion = await this.runAssertion(`/api/sdk/${flow}/${id}/approve/webauthn/begin`);
+      const assertion = await this.runAssertion(
+        `/api/sdk/${flow}/${id}/approve/webauthn/begin`,
+        void 0,
+        signal
+      );
       const raw = await this.post(
         `/api/sdk/${flow}/${id}/approve`,
-        { webauthn_assertion: assertion }
+        { webauthn_assertion: assertion },
+        signal
       );
       return {
         status: String(raw["status"] ?? ""),
@@ -362,15 +483,19 @@ var InvoClient = class {
       };
     });
   }
-  async confirmReceipt(flow, transactionId) {
+  async confirmReceipt(flow, transactionId, opts) {
     const id = encodeURIComponent(transactionId);
+    const signal = opts?.signal;
     return this.withTokenRetry(async () => {
       const assertion = await this.runAssertion(
-        `/api/sdk/${flow}/${id}/confirm-receipt/webauthn/begin`
+        `/api/sdk/${flow}/${id}/confirm-receipt/webauthn/begin`,
+        void 0,
+        signal
       );
       const raw = await this.post(
         `/api/sdk/${flow}/${id}/confirm-receipt`,
-        { webauthn_assertion: assertion }
+        { webauthn_assertion: assertion },
+        signal
       );
       return { status: String(raw["status"] ?? ""), raw };
     });

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { C as ClientConfig, A as ApproveResult, a as ConfirmReceiptResult, L as LinkDeviceResult } from './errors-DV5QsftP.cjs';
-export { I as InvoError, R as Rail, V as VerificationMethod } from './errors-DV5QsftP.cjs';
+import { C as ClientConfig, a as CallOptions, A as ApproveResult, b as ConfirmReceiptResult, L as LinkDeviceResult } from './types-CBMLNwbe.cjs';
+export { I as InvoError, c as InvoErrorInfo, d as InvoHooks, e as InvoRequestInfo, f as InvoResponseInfo, R as Rail, V as VerificationMethod } from './types-CBMLNwbe.cjs';
 
 declare class InvoClient {
     private readonly http;
@@ -10,19 +10,19 @@ declare class InvoClient {
     constructor(config: ClientConfig);
     private assertWebAuthn;
     /** Enroll a passkey for the token's identity (register/begin -> create() -> register/complete). */
-    enrollPasskey(): Promise<{
+    enrollPasskey(opts?: CallOptions): Promise<{
         status: string;
         device: unknown;
         raw: Record<string, unknown>;
     }>;
     /** Approve a SEND with the player's passkey. */
-    approveSend(transactionId: string): Promise<ApproveResult>;
+    approveSend(transactionId: string, opts?: CallOptions): Promise<ApproveResult>;
     /** Approve a TRANSFER with the player's passkey (returns the sender's claim code). */
-    approveTransfer(transactionId: string): Promise<ApproveResult>;
+    approveTransfer(transactionId: string, opts?: CallOptions): Promise<ApproveResult>;
     /** Recipient self-claims a SEND with their passkey. */
-    confirmReceiptSend(transactionId: string): Promise<ConfirmReceiptResult>;
+    confirmReceiptSend(transactionId: string, opts?: CallOptions): Promise<ConfirmReceiptResult>;
     /** Recipient self-claims a TRANSFER with their passkey. */
-    confirmReceiptTransfer(transactionId: string): Promise<ConfirmReceiptResult>;
+    confirmReceiptTransfer(transactionId: string, opts?: CallOptions): Promise<ConfirmReceiptResult>;
     /**
      * Interchangeable methods (§4.6): prove an *already-enrolled* method (e.g. the
      * INVO app device key) to authorize adding a new partner passkey. The returned
@@ -31,7 +31,7 @@ declare class InvoClient {
      *
      * begin -> navigator.credentials.get() -> complete with { link_id, webauthn_assertion }.
      */
-    linkDevice(linkId: string): Promise<LinkDeviceResult>;
+    linkDevice(linkId: string, opts?: CallOptions): Promise<LinkDeviceResult>;
     /** POST with the current player token. Token-expiry retry is handled one level
      *  up by withTokenRetry (which re-runs the whole ceremony, not a single call). */
     private post;
@@ -49,4 +49,4 @@ declare class InvoClient {
     private confirmReceipt;
 }
 
-export { ApproveResult, ClientConfig, ConfirmReceiptResult, InvoClient, LinkDeviceResult };
+export { ApproveResult, CallOptions, ClientConfig, ConfirmReceiptResult, InvoClient, LinkDeviceResult };