@invonetwork/web-sdk 0.4.1 → 0.4.2

package/CHANGELOG.md

@@ -4,6 +4,25 @@ All notable changes to `@invonetwork/web-sdk` are documented here. This project
 [Semantic Versioning](https://semver.org/). Releases are managed with
 [changesets](https://github.com/changesets/changesets).
 
+## [0.4.2] — 2026-06-30
+
+Fixes from an independent line-by-line audit against the live backend.
+
+- **`linkDevice` now works.** `device/link/webauthn/begin` returns a wrapped
+  `{ link_id, options }` body (challenge nested under `options`) and binds the
+  challenge to a server-generated `link_id`. The client now unwraps `options` and
+  echoes the server's `link_id` to `/complete` (it previously threw on an undefined
+  challenge and sent the wrong id).
+- **`InvoError.code` is now populated for the direct purchase rail + guardian flows.**
+  `errorFromResponse` reads `error_code` (SecureErrorHandler + `/purchase-currency`)
+  in addition to `code`, and promotes known no-code tokens (`flow_paused`,
+  `spending_limit_exceeded`, `receiver_not_enrolled_use_claim_code`) to `.code`. Fixes
+  `isDuplicateRequest` on the direct rail.
+- **Guardian/minor routing.** The 202 guardian body also carries
+  `verification_method:"sms"`; the SDK now suppresses it (reports
+  `verificationMethod: undefined`) so a guardian-pending minor isn't routed into the
+  SMS-PIN UI. README example reordered to branch on `guardianApproval` first.
+
 ## [0.4.1] — 2026-06-30
 
 Docs only — replaced the README's internal-leaking "Deployment prerequisites"

package/README.md

@@ -260,10 +260,11 @@ const t = await server.initiateTransfer({
 });
 // (initiateSend uses sender*/receiver* + receivingGameId instead)
 
+// Check guardianApproval FIRST — the guardian path takes precedence.
 switch (true) {
+  case !!t.guardianApproval:                  // minor/guardian path (HTTP 202) → pending approval, no PIN UI
   case t.verificationMethod === "in_app":     // sender is passkey-enrolled → approve in the browser
   case t.verificationMethod === "sms":        // not enrolled, a PIN was sent → show a PIN-entry fallback
-  case !!t.guardianApproval:                  // minor/guardian path (HTTP 202) → do NOT show the PIN UI
 }
 
 // 2. BROWSER — the sender approves with their passkey (give them t.transactionId + the player token)
@@ -280,7 +281,7 @@ try {
 }
 ```
 
-- **`verificationMethod`** (from initiate): `"in_app"` → passkey approve; `"sms"` → un-enrolled, PIN sent; `undefined` + `guardianApproval` → minor/guardian (HTTP 202), do **not** show the PIN UI.
+- **`verificationMethod`** (from initiate): `"in_app"` → passkey approve; `"sms"` → un-enrolled, PIN sent; `undefined` + `guardianApproval` → minor/guardian (HTTP 202), do **not** show the PIN UI. On the guardian path the SDK reports `verificationMethod: undefined` (even though the raw 202 body also carries `"sms"`) so `guardianApproval` wins — but branch on it first to be safe.
 - **Claim codes** are returned only by `approveTransfer`; they're the out-of-band fallback when the recipient isn't enrolled.
 - **`err.isReceiverNotEnrolled`** on `confirmReceipt*` is the explicit signal to switch to claim-code entry.
 - Transfer self-claim may be disabled for your tenant; if it is, surface the claim-code path instead.

package/dist/{chunk-EEWOAUXO.js → chunk-JOVATUDY.js}

@@ -50,8 +50,12 @@ function errorFromResponse(status, body, requestId) {
   if (body && typeof body === "object") {
     const b = body;
     if (typeof b["code"] === "string") code = b["code"];
+    else if (typeof b["error_code"] === "string") code = b["error_code"];
     if (typeof b["error"] === "string") message = b["error"];
     else if (typeof b["message"] === "string") message = b["message"];
+    if (!code && typeof b["error"] === "string" && /^(flow_paused|spending_limit_exceeded|receiver_not_enrolled_use_claim_code)$/.test(b["error"])) {
+      code = b["error"];
+    }
   } else if (typeof body === "string" && body.trim()) {
     message = body;
   }
@@ -245,5 +249,5 @@ function retryAfterMs(parsed, headers) {
 }
 
 export { Http, InvoError, assertSecureBaseUrl };
-//# sourceMappingURL=chunk-EEWOAUXO.js.map
-//# sourceMappingURL=chunk-EEWOAUXO.js.map
+//# sourceMappingURL=chunk-JOVATUDY.js.map
+//# sourceMappingURL=chunk-JOVATUDY.js.map

package/dist/index.cjs

@@ -52,8 +52,12 @@ function errorFromResponse(status, body, requestId) {
   if (body && typeof body === "object") {
     const b = body;
     if (typeof b["code"] === "string") code = b["code"];
+    else if (typeof b["error_code"] === "string") code = b["error_code"];
     if (typeof b["error"] === "string") message = b["error"];
     else if (typeof b["message"] === "string") message = b["message"];
+    if (!code && typeof b["error"] === "string" && /^(flow_paused|spending_limit_exceeded|receiver_not_enrolled_use_claim_code)$/.test(b["error"])) {
+      code = b["error"];
+    }
   } else if (typeof body === "string" && body.trim()) {
     message = body;
   }
@@ -399,16 +403,22 @@ var InvoClient = class {
    */
   async linkDevice(linkId, opts) {
     if (!linkId) throw new Error("linkDevice requires a `linkId`.");
+    this.assertWebAuthn();
     const signal = opts?.signal;
     return this.withTokenRetry(async () => {
-      const assertion = await this.runAssertion(
+      const begin = await this.post(
         "/api/sdk/device/link/webauthn/begin",
         { link_id: linkId },
         signal
       );
+      const cred = await navigator.credentials.get({
+        publicKey: toRequestOptions(begin.options),
+        signal
+      });
+      if (!cred) throw new Error("Passkey assertion was cancelled or returned no credential.");
       const raw = await this.post(
         "/api/sdk/device/link/webauthn/complete",
-        { link_id: linkId, webauthn_assertion: assertion },
+        { link_id: begin.link_id, webauthn_assertion: assertionToJSON(cred) },
         signal
       );
       return { status: String(raw["status"] ?? ""), raw };

package/dist/index.js

@@ -1,5 +1,5 @@
-import { assertSecureBaseUrl, Http, InvoError } from './chunk-EEWOAUXO.js';
-export { InvoError } from './chunk-EEWOAUXO.js';
+import { assertSecureBaseUrl, Http, InvoError } from './chunk-JOVATUDY.js';
+export { InvoError } from './chunk-JOVATUDY.js';
 
 // src/shared/webauthn.ts
 function b64urlToBuffer(value) {
@@ -154,16 +154,22 @@ var InvoClient = class {
    */
   async linkDevice(linkId, opts) {
     if (!linkId) throw new Error("linkDevice requires a `linkId`.");
+    this.assertWebAuthn();
     const signal = opts?.signal;
     return this.withTokenRetry(async () => {
-      const assertion = await this.runAssertion(
+      const begin = await this.post(
         "/api/sdk/device/link/webauthn/begin",
         { link_id: linkId },
         signal
       );
+      const cred = await navigator.credentials.get({
+        publicKey: toRequestOptions(begin.options),
+        signal
+      });
+      if (!cred) throw new Error("Passkey assertion was cancelled or returned no credential.");
       const raw = await this.post(
         "/api/sdk/device/link/webauthn/complete",
-        { link_id: linkId, webauthn_assertion: assertion },
+        { link_id: begin.link_id, webauthn_assertion: assertionToJSON(cred) },
         signal
       );
       return { status: String(raw["status"] ?? ""), raw };

package/dist/server.cjs

@@ -54,8 +54,12 @@ function errorFromResponse(status, body, requestId) {
   if (body && typeof body === "object") {
     const b = body;
     if (typeof b["code"] === "string") code = b["code"];
+    else if (typeof b["error_code"] === "string") code = b["error_code"];
     if (typeof b["error"] === "string") message = b["error"];
     else if (typeof b["message"] === "string") message = b["message"];
+    if (!code && typeof b["error"] === "string" && /^(flow_paused|spending_limit_exceeded|receiver_not_enrolled_use_claim_code)$/.test(b["error"])) {
+      code = b["error"];
+    }
   } else if (typeof body === "string" && body.trim()) {
     message = body;
   }
@@ -869,7 +873,7 @@ var InvoServer = class {
     const guardian = raw["guardian_approval"];
     return {
       transactionId: String(raw["transaction_id"] ?? ""),
-      verificationMethod: vm === "in_app" || vm === "sms" ? vm : void 0,
+      verificationMethod: guardian ? void 0 : vm === "in_app" || vm === "sms" ? vm : void 0,
       guardianApproval: guardian ?? void 0,
       raw
     };

package/dist/server.js

@@ -1,5 +1,5 @@
-import { InvoError, assertSecureBaseUrl, Http } from './chunk-EEWOAUXO.js';
-export { InvoError } from './chunk-EEWOAUXO.js';
+import { InvoError, assertSecureBaseUrl, Http } from './chunk-JOVATUDY.js';
+export { InvoError } from './chunk-JOVATUDY.js';
 import { createHmac } from 'crypto';
 
 var DEFAULT_TOLERANCE_SEC = 300;
@@ -624,7 +624,7 @@ var InvoServer = class {
     const guardian = raw["guardian_approval"];
     return {
       transactionId: String(raw["transaction_id"] ?? ""),
-      verificationMethod: vm === "in_app" || vm === "sms" ? vm : void 0,
+      verificationMethod: guardian ? void 0 : vm === "in_app" || vm === "sms" ? vm : void 0,
       guardianApproval: guardian ?? void 0,
       raw
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invonetwork/web-sdk",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "INVO Web SDK — currency purchase + passkey (WebAuthn) verification for partner web platforms.",
   "license": "SEE LICENSE IN LICENSE",
   "private": false,