@invonetwork/web-sdk 0.3.0 → 0.4.1

package/CHANGELOG.md

@@ -1,96 +1,122 @@
-# Changelog
-
-All notable changes to `@invonetwork/web-sdk` are documented here. This project follows
-[Semantic Versioning](https://semver.org/).
-
-## [0.3.0] — 2026-06-30
-
-Additive release — new server capabilities plus transport resilience/observability.
-
-- **Webhook verification** (`/server`): `verifyWebhook(rawBody, signatureHeader, secret | secrets, opts?)`
-  — constant-time HMAC-SHA256 over `${t}.${rawBody}`, 5-minute replay window,
-  multi-secret rotation; returns a typed `InvoWebhookEvent` discriminated union
-  (`purchase.*`, `item.purchased`, `transfer.*`, `payout.status_changed`, `webhook.test`).
-  Throws `InvoError` (`WEBHOOK_SIGNATURE_INVALID` / `WEBHOOK_TIMESTAMP_EXPIRED` /
-  `WEBHOOK_MALFORMED` / `WEBHOOK_SECRET_MISSING`). Server-only; the browser bundle
-  stays crypto-free. Independently security-audited.
-- **`getPlayerBalance({ playerEmail | playerId })`** (`/server`): typed `player` / `balances` / `summary`.
-- **Automatic retries**: network errors/timeouts, `429` (honoring `retry_after`), and
-  `5xx` are retried with exponential backoff + jitter. New config `maxRetries`
-  (default 2, `0` disables) and `retryBaseDelayMs` (default 250).
-- **Observability hooks**: optional `onRequest` / `onResponse` / `onError` on both
-  entries (best-effort/non-throwing); `InvoError.requestId` carries the backend
-  request id for support/tracing.
-- **Typed reads**: `confirmPayment` → `ConfirmPaymentResult`; `getOrderDetails` /
-  `getItemOrderDetails` → `OrderDetailsResult`; `getItemPurchaseHistory` →
-  `ItemHistoryResult` (previously untyped `Record`). All keep `raw`.
-- **Light validation**: `mintPlayerToken` and `createCheckout` require a non-blank
-  `playerEmail` (throws `INVALID_INPUT` before the network call).
-- **License**: `package.json` `license` is now `SEE LICENSE IN LICENSE` (was
-  `UNLICENSED`); `LICENSE` rewritten as an explicit install-and-use grant for
-  building INVO integrations.
-
-## [0.2.1] — 2026-06-30
-
-Docs only — no code change (republished so the npm page README is current).
-
-- Rewrote the README into a complete integration/deployment guide: capability
-  overview, architecture, deployment prerequisites, per-flow sections (currency
-  purchase, item purchase, sends, transfers, passkeys), webhooks, errors, and a
-  full API reference for both entries.
-- Added INVO console onboarding: `https://console.invo.network` (production) and
-  `https://dev.console.invo.network` (testing/sandbox), mapped to their API base URLs.
-
-## [0.2.0] — 2026-06-30
-
-Adds **item purchase** (spend existing game currency on an in-game item, §4.8) — an
-additive, server-only surface.
-
-- `InvoServer` (`/server`): `purchaseItem`, `getItemPurchaseHistory`, `getItemOrderDetails`.
-  - Server-side, game-secret auth — no passkey, no real money, no payment rail (it's a
-    balance debit). Grant the item off the `item.purchased` webhook.
-  - Client-side guards: required fields (trim-checked), `itemQuantity` integer `1..1000`,
-    prices `> 0` and `<= 999999.99` (magnitude-safe 2-decimal check), and
-    `totalPrice == unitPrice × itemQuantity (±0.01)` compared in integer cents.
-  - Load-bearing response fields (`transaction_id`, `order_id`) throw `INVALID_RESPONSE`
-    if missing on a 200.
-- `InvoError` helpers: `isInsufficientBalance` (gated to 400; not the `429` throttle),
-  `isDuplicateRequest` (409), `retryAfter` (numeric or string `retry_after`); all
-  null-safe against non-JSON error bodies.
-- Independently audited (2 agents) against handoff doc §4.8/§6/§8; contract verified,
-  error-classification edge cases fixed.
-
-## [0.1.0] — 2026-06-30
-
-Initial scaffold.
-
-- `InvoServer` (`/server`): `mintPlayerToken`, `initiateSend`, `initiateTransfer`,
-  `createCheckout`, `purchaseCurrency`, `confirmPayment`, `getOrderDetails`.
-  - Client-side purchase guards (§4.7): USD amount `0 < x ≤ 999.99`, required
-    `purchaseReference`, and `rail:"steam"` rejected before the network call
-    (`INVALID_INPUT` / `MISSING_PURCHASE_REFERENCE` / `WRONG_RAIL_ENDPOINT`).
-- `InvoClient` (browser): `enrollPasskey`, `approveSend`/`approveTransfer`,
-  `confirmReceiptSend`/`confirmReceiptTransfer`, and `linkDevice` for the
-  interchangeable-methods flow (§4.6).
-  - Optional `refreshToken` hook: transparently re-mints and retries once on
-    `SDK_TOKEN_EXPIRED` (§11.2).
-- Shared: typed `InvoError`, isomorphic HTTP client, WebAuthn JSON⇄binary helpers.
-- Tests: HTTP layer, server request mapping + purchase guards, browser client
-  flows (enroll/approve/link/token-refresh), and WebAuthn serialization.
-- Contracts extracted + auditor-verified against the INVO backend.
-
-### Hardening (independent red-team pass)
-- **Guardian/minor `202` path no longer mismapped to `verificationMethod:"sms"`** —
-  `initiateSend`/`initiateTransfer` now return `verificationMethod: undefined` and a
-  `guardianApproval` block on the guardian path, so callers don't route into the
-  PIN UI by mistake (§4.3).
-- `usdAmount` validation tightened: rejects non-plain-decimal strings
-  (`"0x10"`, `"1e2"`, whitespace) and >2 decimal places before any network call.
-- Load-bearing response fields (`token`, `checkout_url`) now throw `INVALID_RESPONSE`
-  instead of silently surfacing as empty strings.
-- `getOrderDetails` requires at least one of `orderId`/`transactionId`.
-- Token refresh now re-runs the **whole** passkey ceremony on `SDK_TOKEN_EXPIRED`
-  (never replays a single-use assertion) and single-flights concurrent refreshes.
-- `baseUrl` must be `https://` (localhost exempt) so the token/secret can't travel
-  in cleartext.
-- Published tarball excludes sourcemaps (no proprietary source shipped).
+# Changelog
+
+All notable changes to `@invonetwork/web-sdk` are documented here. This project follows
+[Semantic Versioning](https://semver.org/). Releases are managed with
+[changesets](https://github.com/changesets/changesets).
+
+## [0.4.1] — 2026-06-30
+
+Docs only — replaced the README's internal-leaking "Deployment prerequisites"
+(backend flag names, DB columns, gating mechanics) with a partner-facing
+"Before you go live"; republished so the npm page README is current.
+
+## [0.4.0] — 2026-06-30
+
+Additive release — more server reads, edge-ready webhooks, cancellation, and tooling.
+
+- **`getInboundPending({ playerEmail | playerPhone })`** — live, unclaimed inbound
+  sends/transfers for a player (the source of truth behind the "you have X to collect"
+  badge; pairs with `transfer.claim_pending`).
+- **`verifyWebhookAsync`** — Web Crypto variant of `verifyWebhook` that runs on
+  Cloudflare Workers / Deno / Vercel+Netlify Edge / Bun / browsers; and
+  **`createWebhookHandler`** — a zero-dep Fetch-API `(Request) => Promise<Response>`
+  webhook route handler (Next.js App Router, Workers, Deno, Hono, Bun).
+- **`iterateItemPurchaseHistory`** — async iterator that pages through a player's
+  full item-purchase history.
+- **Per-call `AbortSignal`** — every method accepts an optional `{ signal }`; an
+  aborted call throws `InvoError` code `ABORTED` and is never retried.
+- **Tooling**: ESLint (+ lint in CI), changesets release automation, `SECURITY.md`,
+  and `CODEOWNERS`.
+
+## [0.3.0] — 2026-06-30
+
+Additive release — new server capabilities plus transport resilience/observability.
+
+- **Webhook verification** (`/server`): `verifyWebhook(rawBody, signatureHeader, secret | secrets, opts?)`
+  — constant-time HMAC-SHA256 over `${t}.${rawBody}`, 5-minute replay window,
+  multi-secret rotation; returns a typed `InvoWebhookEvent` discriminated union
+  (`purchase.*`, `item.purchased`, `transfer.*`, `payout.status_changed`, `webhook.test`).
+  Throws `InvoError` (`WEBHOOK_SIGNATURE_INVALID` / `WEBHOOK_TIMESTAMP_EXPIRED` /
+  `WEBHOOK_MALFORMED` / `WEBHOOK_SECRET_MISSING`). Server-only; the browser bundle
+  stays crypto-free. Independently security-audited.
+- **`getPlayerBalance({ playerEmail | playerId })`** (`/server`): typed `player` / `balances` / `summary`.
+- **Automatic retries**: network errors/timeouts, `429` (honoring `retry_after`), and
+  `5xx` are retried with exponential backoff + jitter. New config `maxRetries`
+  (default 2, `0` disables) and `retryBaseDelayMs` (default 250).
+- **Observability hooks**: optional `onRequest` / `onResponse` / `onError` on both
+  entries (best-effort/non-throwing); `InvoError.requestId` carries the backend
+  request id for support/tracing.
+- **Typed reads**: `confirmPayment` → `ConfirmPaymentResult`; `getOrderDetails` /
+  `getItemOrderDetails` → `OrderDetailsResult`; `getItemPurchaseHistory` →
+  `ItemHistoryResult` (previously untyped `Record`). All keep `raw`.
+- **Light validation**: `mintPlayerToken` and `createCheckout` require a non-blank
+  `playerEmail` (throws `INVALID_INPUT` before the network call).
+- **License**: `package.json` `license` is now `SEE LICENSE IN LICENSE` (was
+  `UNLICENSED`); `LICENSE` rewritten as an explicit install-and-use grant for
+  building INVO integrations.
+
+## [0.2.1] — 2026-06-30
+
+Docs only — no code change (republished so the npm page README is current).
+
+- Rewrote the README into a complete integration/deployment guide: capability
+  overview, architecture, deployment prerequisites, per-flow sections (currency
+  purchase, item purchase, sends, transfers, passkeys), webhooks, errors, and a
+  full API reference for both entries.
+- Added INVO console onboarding: `https://console.invo.network` (production) and
+  `https://dev.console.invo.network` (testing/sandbox), mapped to their API base URLs.
+
+## [0.2.0] — 2026-06-30
+
+Adds **item purchase** (spend existing game currency on an in-game item, §4.8) — an
+additive, server-only surface.
+
+- `InvoServer` (`/server`): `purchaseItem`, `getItemPurchaseHistory`, `getItemOrderDetails`.
+  - Server-side, game-secret auth — no passkey, no real money, no payment rail (it's a
+    balance debit). Grant the item off the `item.purchased` webhook.
+  - Client-side guards: required fields (trim-checked), `itemQuantity` integer `1..1000`,
+    prices `> 0` and `<= 999999.99` (magnitude-safe 2-decimal check), and
+    `totalPrice == unitPrice × itemQuantity (±0.01)` compared in integer cents.
+  - Load-bearing response fields (`transaction_id`, `order_id`) throw `INVALID_RESPONSE`
+    if missing on a 200.
+- `InvoError` helpers: `isInsufficientBalance` (gated to 400; not the `429` throttle),
+  `isDuplicateRequest` (409), `retryAfter` (numeric or string `retry_after`); all
+  null-safe against non-JSON error bodies.
+- Independently audited (2 agents) against handoff doc §4.8/§6/§8; contract verified,
+  error-classification edge cases fixed.
+
+## [0.1.0] — 2026-06-30
+
+Initial scaffold.
+
+- `InvoServer` (`/server`): `mintPlayerToken`, `initiateSend`, `initiateTransfer`,
+  `createCheckout`, `purchaseCurrency`, `confirmPayment`, `getOrderDetails`.
+  - Client-side purchase guards (§4.7): USD amount `0 < x ≤ 999.99`, required
+    `purchaseReference`, and `rail:"steam"` rejected before the network call
+    (`INVALID_INPUT` / `MISSING_PURCHASE_REFERENCE` / `WRONG_RAIL_ENDPOINT`).
+- `InvoClient` (browser): `enrollPasskey`, `approveSend`/`approveTransfer`,
+  `confirmReceiptSend`/`confirmReceiptTransfer`, and `linkDevice` for the
+  interchangeable-methods flow (§4.6).
+  - Optional `refreshToken` hook: transparently re-mints and retries once on
+    `SDK_TOKEN_EXPIRED` (§11.2).
+- Shared: typed `InvoError`, isomorphic HTTP client, WebAuthn JSON⇄binary helpers.
+- Tests: HTTP layer, server request mapping + purchase guards, browser client
+  flows (enroll/approve/link/token-refresh), and WebAuthn serialization.
+- Contracts extracted + auditor-verified against the INVO backend.
+
+### Hardening (independent red-team pass)
+
+- **Guardian/minor `202` path no longer mismapped to `verificationMethod:"sms"`** —
+  `initiateSend`/`initiateTransfer` now return `verificationMethod: undefined` and a
+  `guardianApproval` block on the guardian path, so callers don't route into the
+  PIN UI by mistake (§4.3).
+- `usdAmount` validation tightened: rejects non-plain-decimal strings
+  (`"0x10"`, `"1e2"`, whitespace) and >2 decimal places before any network call.
+- Load-bearing response fields (`token`, `checkout_url`) now throw `INVALID_RESPONSE`
+  instead of silently surfacing as empty strings.
+- `getOrderDetails` requires at least one of `orderId`/`transactionId`.
+- Token refresh now re-runs the **whole** passkey ceremony on `SDK_TOKEN_EXPIRED`
+  (never replays a single-use assertion) and single-flights concurrent refreshes.
+- `baseUrl` must be `https://` (localhost exempt) so the token/secret can't travel
+  in cleartext.
+- Published tarball excludes sourcemaps (no proprietary source shipped).

package/README.md

@@ -2,7 +2,7 @@
 
 First-party TypeScript SDK for integrating **INVO** into partner **web** platforms (storefronts, web games, dashboards). It wraps INVO's web money flows behind a typed, versioned API — the web analog of the Unity/Unreal plugins.
 
-> **Status:** `v0.3.0`, published on npm. The backend it wraps is **live** on sandbox + production, so you can build and test against sandbox today.
+> **Status:** `v0.4.0`, published on npm. The backend it wraps is **live** on sandbox + production, so you can build and test against sandbox today.
 > Canonical partner reference: **https://docs.invo.network/docs/currency-purchase** and **https://docs.invo.network/docs/game-developer-integration**.
 
 ## What it does
@@ -22,7 +22,7 @@ The **game secret stays on your server**; the browser only ever holds a short-li
 
 - [Install](#install)
 - [Architecture & the two entry points](#architecture--the-two-entry-points)
-- [Deployment prerequisites](#deployment-prerequisites)
+- [Before you go live](#before-you-go-live)
 - [Configuration](#configuration)
 - [Currency purchase (real money in)](#currency-purchase-real-money-in)
 - [Item purchase (spend game currency)](#item-purchase-spend-game-currency)
@@ -78,25 +78,16 @@ Build and test against the **dev console + sandbox** first, then switch to the *
 
 **Never import `/server` into browser code** — it carries the game secret. The two entries are built separately for exactly this reason.
 
-## Deployment prerequisites
+## Before you go live
 
-INVO provisions these per tenant before the flows go live (most are super_admin-only, set by INVO — coordinate with your INVO contact):
+INVO enables each flow for your tenant in the [console](#get-your-account--game-secret-invo-console). What you need to do:
 
-**For sends/transfers + passkeys**
-- `SDK_TRANSFER_VERIFICATION_ENABLED` (master) — on.
-- `SDK_WEBAUTHN_ENABLED` (master) — on.
-- `SDK_TRANSFER_CONFIRM_RECEIPT_ENABLED` — required for **transfer** self-claim.
-- Tenant migrated (`games.sdk_verification_enabled`).
-- **Per-tenant RP ID + origins** (`webauthn_rp_id`, `webauthn_origins`). There's no separate "webauthn on" flag — *the presence of a valid RP ID is the gate*. Until it's set, WebAuthn endpoints return `403 WEBAUTHN_NOT_ENABLED_FOR_TENANT`. **You must serve your integration from an origin listed in `webauthn_origins`,** or passkeys won't validate.
+- **Store the game secret server-side** and expose a small endpoint that calls `mintPlayerToken` so the browser can fetch/refresh its token. Never ship the secret to the browser.
+- **For passkeys (sends/transfers):** give INVO the **web origin(s)** you'll serve from. Passkeys only validate on approved origins — if a call returns `WEBAUTHN_NOT_ENABLED_FOR_TENANT`, your origins aren't set up yet; contact INVO. (Until enrolled, the sender falls back to the SMS-PIN path automatically.)
+- **For currency purchase:** card checkout works out of the box; ask INVO to enable the `game`/`steam` rails if you need them.
+- **For item purchase:** nothing extra — it's a currency-balance debit.
 
-**For currency purchase**
-- `platform` (card) rail is always on; `game`/`steam` rails are off by default and each gated by their own flag + per-game config.
-- Honors the platform `purchases` kill switch (`503 flow_paused` when paused).
-
-**For item purchase**
-- The game must be in `live` or `testing` state (else `403`). No passkey/payment flags involved — it's a balance debit.
-
-**On your side:** store the game secret in server-side config/secrets (never ship it to the browser), and expose a small endpoint that calls `mintPlayerToken` so the browser can fetch/refresh its token.
+If a flow isn't enabled for your tenant yet, calls return a clear `InvoError` (e.g. `TENANT_NOT_MIGRATED`, `WEBAUTHN_NOT_ENABLED_FOR_TENANT`, or `flow_paused`) — coordinate with your INVO contact to turn it on.
 
 ## Configuration
 
@@ -232,7 +223,7 @@ const item = await server.purchaseItem({
 - Client-side validation (missing fields, quantity outside `1..1000`, bad price, total ≠ unit×qty) throws `INVALID_INPUT` **before** any network call.
 - Fee split: **90% developer / 10% INVO** by default (per-partner override). Not guardian-gated.
 
-**Companion reads:** `server.getItemPurchaseHistory({ playerEmail, limit?, offset? })` and `server.getItemOrderDetails({ orderId | transactionId | clientRequestId })` (pass **exactly one** id — use `clientRequestId` for recovery: "did this purchase complete?").
+**Companion reads:** `server.getItemPurchaseHistory({ playerEmail, limit?, offset? })` and `server.getItemOrderDetails({ orderId | transactionId | clientRequestId })` (pass **exactly one** id — use `clientRequestId` for recovery: "did this purchase complete?"). To walk the full history, `for await (const row of server.iterateItemPurchaseHistory({ playerEmail }))` pages automatically.
 
 ---
 
@@ -292,7 +283,15 @@ try {
 - **`verificationMethod`** (from initiate): `"in_app"` → passkey approve; `"sms"` → un-enrolled, PIN sent; `undefined` + `guardianApproval` → minor/guardian (HTTP 202), do **not** show the PIN UI.
 - **Claim codes** are returned only by `approveTransfer`; they're the out-of-band fallback when the recipient isn't enrolled.
 - **`err.isReceiverNotEnrolled`** on `confirmReceipt*` is the explicit signal to switch to claim-code entry.
-- Transfer self-claim additionally requires `SDK_TRANSFER_CONFIRM_RECEIPT_ENABLED`; if it's off, surface the claim-code path.
+- Transfer self-claim may be disabled for your tenant; if it is, surface the claim-code path instead.
+
+**"You have X to collect"** — to render a collect badge, list a player's live, unclaimed inbound sends/transfers (the source of truth behind the `transfer.claim_pending` webhook):
+
+```ts
+const { inboundPending } = await server.getInboundPending({ playerEmail: "q@example.com" });
+// each row: { transactionId, flow, amount, netAmount, sourceGame, toPhone, toIdentityId, claimCodeExpiresAt }
+// match toPhone to the logged-in player (toIdentityId is null when the phone maps to >1 of your players)
+```
 
 ---
 
@@ -349,6 +348,22 @@ function handler(req, res) {
 
 `verifyWebhook` does constant-time HMAC-SHA256 over `${t}.${rawBody}`, enforces a 5-minute replay window, and accepts an **array of secrets** during rotation (`verifyWebhook(body, sig, [oldSecret, newSecret])`). It returns a typed `InvoWebhookEvent` (discriminate on `event_type`) and throws `InvoError` (`WEBHOOK_SIGNATURE_INVALID` / `WEBHOOK_TIMESTAMP_EXPIRED` / `WEBHOOK_MALFORMED` / `WEBHOOK_SECRET_MISSING`) on any failure. **De-dupe yourself on `X-Invo-Idempotency-Key`** — the SDK verifies, it doesn't track delivery.
 
+**Edge / serverless** (Cloudflare Workers, Deno, Vercel/Netlify Edge, Bun): `verifyWebhook` uses `node:crypto`, so use **`verifyWebhookAsync`** (Web Crypto) — same args/result, just `await` it — or the ready-made Fetch-API handler:
+
+```ts
+import { createWebhookHandler } from "@invonetwork/web-sdk/server";
+
+// Next.js App Router — app/invo/webhooks/route.ts
+export const POST = createWebhookHandler({
+  secret: process.env.INVO_WEBHOOK_SECRET!,
+  onEvent: async (event, { idempotencyKey }) => {
+    // de-dupe on idempotencyKey, then grant value. Throw to return 500 (Invo retries).
+  },
+});
+```
+
+`createWebhookHandler` returns `(request: Request) => Promise<Response>` and runs in Next.js, Workers, Deno, Hono, and Bun. Bad signature → `400`; a throwing `onEvent` → `500`.
+
 ### Event types
 
 | Event | Fires for | Use it to |
@@ -381,6 +396,7 @@ new InvoServer({
   > Note: hook payloads include the request `url`, which for some calls embeds a player email (e.g. balance-by-email). Tokens and the game secret are sent as headers and are **never** passed to hooks — but redact the `url` if you log hook payloads.
 
 - **Request ids.** `InvoError.requestId` carries the backend request id (from `x-invo-request-id` / `x-request-id`) — quote it in support tickets.
+- **Cancellation.** Every method takes an optional `{ signal }` (an `AbortSignal`) as its last argument — `server.getPlayerBalance({ playerEmail }, { signal })`. Aborting throws `InvoError` with `.code === "ABORTED"`, and an aborted call is never retried.
 
 ---
 
@@ -434,7 +450,13 @@ try {
 | `getItemPurchaseHistory({ playerEmail, limit?, offset? })` | `{ history, pagination, raw }` |
 | `getItemOrderDetails({ orderId? \| transactionId? \| clientRequestId? })` | `{ order, financialSummary, statusTimeline, raw }` |
 | `getPlayerBalance({ playerEmail? \| playerId? })` | `{ player, balances, summary, raw }` |
+| `getInboundPending({ playerEmail? \| playerPhone? })` | `{ inboundPending, raw }` — live unclaimed inbound sends/transfers |
+| `iterateItemPurchaseHistory({ playerEmail, pageSize? })` | async iterator over all history rows |
 | `verifyWebhook(rawBody, signatureHeader, secret \| secrets, opts?)` | typed `InvoWebhookEvent` (throws on bad signature) |
+| `verifyWebhookAsync(...)` | same as `verifyWebhook`, Web Crypto (edge/Workers/Deno/Bun) |
+| `createWebhookHandler({ secret, onEvent })` | `(Request) => Promise<Response>` webhook route handler |
+
+Every method also accepts an optional final `{ signal }` (`AbortSignal`) for cancellation.
 
 ### `InvoClient` (`@invonetwork/web-sdk`)
 

package/dist/{chunk-DV3WZGMH.js → chunk-EEWOAUXO.js}

@@ -96,11 +96,11 @@ var _Http = class _Http {
    *   (e.g. single-use WebAuthn assertions) are NEVER auto-retried.
    */
   async post(path, body, auth, opts) {
-    return this.request("POST", path, body, auth, opts?.idempotent ?? false);
+    return this.request("POST", path, body, auth, opts?.idempotent ?? false, opts?.signal);
   }
   // GET is always idempotent → safe to retry.
-  async get(path, auth) {
-    return this.request("GET", path, void 0, auth, true);
+  async get(path, auth, opts) {
+    return this.request("GET", path, void 0, auth, true, opts?.signal);
   }
   authHeaders(auth) {
     switch (auth.kind) {
@@ -112,7 +112,7 @@ var _Http = class _Http {
         return {};
     }
   }
-  async request(method, path, body, auth, idempotent) {
+  async request(method, path, body, auth, idempotent, signal) {
     const url = `${this.baseUrl}${path}`;
     const headers = {
       Accept: "application/json",
@@ -122,10 +122,13 @@ var _Http = class _Http {
     if (body !== void 0) headers["Content-Type"] = "application/json";
     const payload = body !== void 0 ? JSON.stringify(body) : void 0;
     for (let attempt = 0; ; attempt++) {
+      if (signal?.aborted) throw abortError(path);
       const start = Date.now();
       this.fire("onRequest", { method, url, attempt });
       const controller = new AbortController();
       const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+      const onAbort = () => controller.abort();
+      signal?.addEventListener("abort", onAbort, { once: true });
       let res;
       let networkError;
       try {
@@ -138,12 +141,14 @@ var _Http = class _Http {
         });
       } finally {
         clearTimeout(timer);
+        signal?.removeEventListener("abort", onAbort);
       }
       if (networkError) {
+        if (signal?.aborted) throw abortError(path);
         const willRetry = idempotent && attempt < this.maxRetries;
         this.fire("onError", { method, url, attempt, error: networkError, willRetry });
         if (willRetry) {
-          await sleep(this.backoff(attempt));
+          await sleep(this.backoff(attempt), signal);
           continue;
         }
         throw networkError;
@@ -179,7 +184,7 @@ var _Http = class _Http {
         }
         this.fire("onError", { method, url, attempt, error: err, willRetry: wait !== void 0 });
         if (wait !== void 0) {
-          await sleep(wait);
+          await sleep(wait, signal);
           continue;
         }
         throw err;
@@ -205,8 +210,21 @@ var _Http = class _Http {
 /** HTTP statuses worth retrying — rate limit + transient gateway/server errors. */
 _Http.RETRIABLE_STATUS = /* @__PURE__ */ new Set([429, 500, 502, 503, 504]);
 var Http = _Http;
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+function sleep(ms, signal) {
+  return new Promise((resolve) => {
+    if (signal?.aborted) return resolve();
+    const timer = setTimeout(done, ms);
+    const onAbort = () => done();
+    function done() {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function abortError(path) {
+  return new InvoError({ message: `Request to ${path} was aborted`, code: "ABORTED", status: 0 });
 }
 function pickRequestId(headers) {
   if (!headers || typeof headers.get !== "function") return void 0;
@@ -227,5 +245,5 @@ function retryAfterMs(parsed, headers) {
 }
 
 export { Http, InvoError, assertSecureBaseUrl };
-//# sourceMappingURL=chunk-DV3WZGMH.js.map
-//# sourceMappingURL=chunk-DV3WZGMH.js.map
+//# sourceMappingURL=chunk-EEWOAUXO.js.map
+//# sourceMappingURL=chunk-EEWOAUXO.js.map