@invonetwork/web-sdk 0.7.0 → 0.8.0

package/CHANGELOG.md

@@ -4,6 +4,21 @@ All notable changes to `@invonetwork/web-sdk` are documented here. This project
 [Semantic Versioning](https://semver.org/). Releases are managed with
 [changesets](https://github.com/changesets/changesets).
 
+## [0.8.0] — 2026-07-01
+
+Completes the **discovery layer** for send/transfer UIs.
+
+- **`InvoClient.getBalance()`** (browser, player-token, `GET /api/sdk/balance`) — the
+  player's balances for the token's game: `balances[]` (`currencyId`, `currencyName`,
+  `currencySymbol`/`currencySymbolUrl` (nullable), `availableBalance`/`reservedBalance`/
+  `totalBalance` as decimal strings) plus `totalValue` / `currencyCount` / `hasFunds`. A
+  player who hasn't transacted here yet returns an empty `balances` array (a `200`, not an
+  error); `404 GAME_NOT_FOUND` throws.
+- **`InvoServer.getLinkedIdentities({ playerEmail | playerPhone })`** (server-only,
+  game-secret) — a player's linked wallet identities (game-scoped). Provide one identifier
+  (phone wins if both); no in-game match returns `notFound: true` with empty `emails`
+  instead of throwing. **Returns first-party PII — never expose to the browser.**
+
 ## [0.7.0] — 2026-07-01
 
 Start of the **discovery layer** for send/transfer UIs.

package/README.md

@@ -2,7 +2,7 @@
 
 First-party TypeScript SDK for integrating **INVO** into partner **web** platforms (storefronts, web games, dashboards). It wraps INVO's web money flows behind a typed, versioned API — the web analog of the Unity/Unreal plugins.
 
-> **Status:** `v0.7.0`, published on npm. The backend it wraps is **live** on sandbox + production, so you can build and test against sandbox today.
+> **Status:** `v0.8.0`, published on npm. The backend it wraps is **live** on sandbox + production, so you can build and test against sandbox today.
 > Canonical partner reference: **https://docs.invo.network/docs/currency-purchase** and **https://docs.invo.network/docs/game-developer-integration**.
 
 ## What it does
@@ -258,6 +258,13 @@ const { availableGames, sourceCurrencyName } = await client.getDestinations({ di
 // each: { gameId, gameName, gameIcon, currencyName, currencySymbol, minimumTransfer, maximumTransfer, … }
 ```
 
+**What do I have? (browser, v0.8.0+)** — `client.getBalance()` returns the player's balances for this game (amounts are decimal strings; rows carry `currencySymbol`/`currencySymbolUrl`). A player who hasn't transacted here yet returns an empty `balances` array (show 0.00) — not an error:
+
+```ts
+const { balances, hasFunds, totalValue } = await client.getBalance();
+// each: { currencyId, currencyName, currencySymbol, availableBalance, reservedBalance, totalBalance }
+```
+
 ```ts
 // 1. SERVER — initiate, then branch on how the sender must verify
 const t = await server.initiateTransfer({
@@ -480,6 +487,7 @@ try {
 | `getItemOrderDetails({ orderId? \| transactionId? \| clientRequestId? })` | `{ order, financialSummary, statusTimeline, raw }` |
 | `getPlayerBalance({ playerEmail? \| playerId? })` | `{ player, balances, summary, raw }` |
 | `getInboundPending({ playerEmail? \| playerPhone? })` | `{ inboundPending, raw }` — live unclaimed inbound sends/transfers |
+| `getLinkedIdentities({ playerEmail? \| playerPhone? })` | `{ walletUserId, primaryEmail, primaryPhone, isMinor, emails, notFound, raw }` — **server-only** (returns PII) |
 | `iterateItemPurchaseHistory({ playerEmail, pageSize? })` | async iterator over all history rows |
 | `verifyWebhook(rawBody, signatureHeader, secret \| secrets, opts?)` | typed `InvoWebhookEvent` (throws on bad signature) |
 | `verifyWebhookAsync(...)` | same as `verifyWebhook`, Web Crypto (edge/Workers/Deno/Bun) |
@@ -498,6 +506,7 @@ Every method also accepts an optional final `{ signal }` (`AbortSignal`) for can
 | `linkDevice(linkId)` | `{ status, raw }` |
 | `getPendingCollect()` | `{ pending, raw }` — the player's own pending-to-collect list (player-token) |
 | `getDestinations({ direction? })` | `{ availableGames, sourceGameName, transferMode, … }` — where the player can send/transfer, metadata inline |
+| `getBalance()` | `{ gameId, gameName, balances, totalValue, currencyCount, hasFunds, raw }` — the player's balances for this game |
 
 Every method throws `InvoError` on failure and takes an optional final `{ signal }`. Full inline types ship with the package.
 

package/dist/index.cjs

@@ -355,6 +355,18 @@ function toPendingCollectItem(row) {
     raw: row
   };
 }
+function toBalanceRow(row) {
+  return {
+    currencyId: row["currency_id"] ?? "",
+    currencyName: String(row["currency_name"] ?? ""),
+    currencySymbol: row["currency_symbol"] ?? null,
+    currencySymbolUrl: row["currency_symbol_url"] ?? null,
+    availableBalance: String(row["available_balance"] ?? ""),
+    reservedBalance: String(row["reserved_balance"] ?? ""),
+    totalBalance: String(row["total_balance"] ?? ""),
+    raw: row
+  };
+}
 function toDestinationGame(row) {
   const s = (k) => row[k] === void 0 || row[k] === null ? void 0 : String(row[k]);
   return {
@@ -516,6 +528,28 @@ var InvoClient = class {
       };
     });
   }
+  /**
+   * The player's balances for the token's game (browser, player-token). Amounts are
+   * decimal strings. A player who hasn't transacted here yet returns `200` with an empty
+   * `balances` array (show 0.00) — not an error; a `404 GAME_NOT_FOUND` (bad game/token)
+   * throws. Rows include the currency symbol + icon URL (each may be null).
+   */
+  async getBalance(opts) {
+    return this.withTokenRetry(async () => {
+      const raw = await this.get("/api/sdk/balance", opts?.signal);
+      const rows = Array.isArray(raw["balances"]) ? raw["balances"] : [];
+      const summary = raw["summary"] ?? {};
+      return {
+        gameId: raw["game_id"] ?? "",
+        gameName: String(raw["game_name"] ?? ""),
+        balances: rows.map(toBalanceRow),
+        totalValue: String(summary["total_value"] ?? "0"),
+        currencyCount: Number(summary["currency_count"] ?? rows.length),
+        hasFunds: summary["has_funds"] === true,
+        raw
+      };
+    });
+  }
   /**
    * First-enrollment OTP grant (§4.2). When `enrollPasskey()` throws
    * `ENROLLMENT_REQUIRES_AUTHORIZATION` (`err.isEnrollmentAuthorizationRequired`), call

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { C as ClientConfig, a as CallOptions, A as ApproveResult, b as ConfirmReceiptResult, L as LinkDeviceResult, P as PendingCollectResult, D as DestinationsQuery, c as DestinationsResult, E as EnrollmentBeginResult, d as EnrollmentVerifyResult } from './types-Bi_NMSkN.cjs';
-export { e as DestinationGame, I as InvoError, f as InvoErrorInfo, g as InvoHooks, h as InvoRequestInfo, i as InvoResponseInfo, j as PendingCollectItem, R as Rail, V as VerificationMethod } from './types-Bi_NMSkN.cjs';
+import { C as ClientConfig, a as CallOptions, A as ApproveResult, b as ConfirmReceiptResult, L as LinkDeviceResult, P as PendingCollectResult, D as DestinationsQuery, c as DestinationsResult, B as BalanceResult, E as EnrollmentBeginResult, d as EnrollmentVerifyResult } from './types-DLSCxpoT.cjs';
+export { e as BalanceRow, f as DestinationGame, I as InvoError, g as InvoErrorInfo, h as InvoHooks, i as InvoRequestInfo, j as InvoResponseInfo, k as PendingCollectItem, R as Rail, V as VerificationMethod } from './types-DLSCxpoT.cjs';
 
 declare class InvoClient {
     private readonly http;
@@ -45,6 +45,13 @@ declare class InvoClient {
      * Source game is the token's own game. Player-token (browser).
      */
     getDestinations(query?: DestinationsQuery, opts?: CallOptions): Promise<DestinationsResult>;
+    /**
+     * The player's balances for the token's game (browser, player-token). Amounts are
+     * decimal strings. A player who hasn't transacted here yet returns `200` with an empty
+     * `balances` array (show 0.00) — not an error; a `404 GAME_NOT_FOUND` (bad game/token)
+     * throws. Rows include the currency symbol + icon URL (each may be null).
+     */
+    getBalance(opts?: CallOptions): Promise<BalanceResult>;
     /**
      * First-enrollment OTP grant (§4.2). When `enrollPasskey()` throws
      * `ENROLLMENT_REQUIRES_AUTHORIZATION` (`err.isEnrollmentAuthorizationRequired`), call
@@ -74,4 +81,4 @@ declare class InvoClient {
     private confirmReceipt;
 }
 
-export { ApproveResult, CallOptions, ClientConfig, ConfirmReceiptResult, DestinationsQuery, DestinationsResult, EnrollmentBeginResult, EnrollmentVerifyResult, InvoClient, LinkDeviceResult, PendingCollectResult };
+export { ApproveResult, BalanceResult, CallOptions, ClientConfig, ConfirmReceiptResult, DestinationsQuery, DestinationsResult, EnrollmentBeginResult, EnrollmentVerifyResult, InvoClient, LinkDeviceResult, PendingCollectResult };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { C as ClientConfig, a as CallOptions, A as ApproveResult, b as ConfirmReceiptResult, L as LinkDeviceResult, P as PendingCollectResult, D as DestinationsQuery, c as DestinationsResult, E as EnrollmentBeginResult, d as EnrollmentVerifyResult } from './types-Bi_NMSkN.js';
-export { e as DestinationGame, I as InvoError, f as InvoErrorInfo, g as InvoHooks, h as InvoRequestInfo, i as InvoResponseInfo, j as PendingCollectItem, R as Rail, V as VerificationMethod } from './types-Bi_NMSkN.js';
+import { C as ClientConfig, a as CallOptions, A as ApproveResult, b as ConfirmReceiptResult, L as LinkDeviceResult, P as PendingCollectResult, D as DestinationsQuery, c as DestinationsResult, B as BalanceResult, E as EnrollmentBeginResult, d as EnrollmentVerifyResult } from './types-DLSCxpoT.js';
+export { e as BalanceRow, f as DestinationGame, I as InvoError, g as InvoErrorInfo, h as InvoHooks, i as InvoRequestInfo, j as InvoResponseInfo, k as PendingCollectItem, R as Rail, V as VerificationMethod } from './types-DLSCxpoT.js';
 
 declare class InvoClient {
     private readonly http;
@@ -45,6 +45,13 @@ declare class InvoClient {
      * Source game is the token's own game. Player-token (browser).
      */
     getDestinations(query?: DestinationsQuery, opts?: CallOptions): Promise<DestinationsResult>;
+    /**
+     * The player's balances for the token's game (browser, player-token). Amounts are
+     * decimal strings. A player who hasn't transacted here yet returns `200` with an empty
+     * `balances` array (show 0.00) — not an error; a `404 GAME_NOT_FOUND` (bad game/token)
+     * throws. Rows include the currency symbol + icon URL (each may be null).
+     */
+    getBalance(opts?: CallOptions): Promise<BalanceResult>;
     /**
      * First-enrollment OTP grant (§4.2). When `enrollPasskey()` throws
      * `ENROLLMENT_REQUIRES_AUTHORIZATION` (`err.isEnrollmentAuthorizationRequired`), call
@@ -74,4 +81,4 @@ declare class InvoClient {
     private confirmReceipt;
 }
 
-export { ApproveResult, CallOptions, ClientConfig, ConfirmReceiptResult, DestinationsQuery, DestinationsResult, EnrollmentBeginResult, EnrollmentVerifyResult, InvoClient, LinkDeviceResult, PendingCollectResult };
+export { ApproveResult, BalanceResult, CallOptions, ClientConfig, ConfirmReceiptResult, DestinationsQuery, DestinationsResult, EnrollmentBeginResult, EnrollmentVerifyResult, InvoClient, LinkDeviceResult, PendingCollectResult };

package/dist/index.js

@@ -98,6 +98,18 @@ function toPendingCollectItem(row) {
     raw: row
   };
 }
+function toBalanceRow(row) {
+  return {
+    currencyId: row["currency_id"] ?? "",
+    currencyName: String(row["currency_name"] ?? ""),
+    currencySymbol: row["currency_symbol"] ?? null,
+    currencySymbolUrl: row["currency_symbol_url"] ?? null,
+    availableBalance: String(row["available_balance"] ?? ""),
+    reservedBalance: String(row["reserved_balance"] ?? ""),
+    totalBalance: String(row["total_balance"] ?? ""),
+    raw: row
+  };
+}
 function toDestinationGame(row) {
   const s = (k) => row[k] === void 0 || row[k] === null ? void 0 : String(row[k]);
   return {
@@ -259,6 +271,28 @@ var InvoClient = class {
       };
     });
   }
+  /**
+   * The player's balances for the token's game (browser, player-token). Amounts are
+   * decimal strings. A player who hasn't transacted here yet returns `200` with an empty
+   * `balances` array (show 0.00) — not an error; a `404 GAME_NOT_FOUND` (bad game/token)
+   * throws. Rows include the currency symbol + icon URL (each may be null).
+   */
+  async getBalance(opts) {
+    return this.withTokenRetry(async () => {
+      const raw = await this.get("/api/sdk/balance", opts?.signal);
+      const rows = Array.isArray(raw["balances"]) ? raw["balances"] : [];
+      const summary = raw["summary"] ?? {};
+      return {
+        gameId: raw["game_id"] ?? "",
+        gameName: String(raw["game_name"] ?? ""),
+        balances: rows.map(toBalanceRow),
+        totalValue: String(summary["total_value"] ?? "0"),
+        currencyCount: Number(summary["currency_count"] ?? rows.length),
+        hasFunds: summary["has_funds"] === true,
+        raw
+      };
+    });
+  }
   /**
    * First-enrollment OTP grant (§4.2). When `enrollPasskey()` throws
    * `ENROLLMENT_REQUIRES_AUTHORIZATION` (`err.isEnrollmentAuthorizationRequired`), call

package/dist/server.cjs

@@ -418,7 +418,7 @@ async function hmacHexSubtle(secret, message) {
 }
 
 // src/server.ts
-var DEFAULT_UA = "invonetwork-web-sdk/0.4.0 (+https://invo.network)";
+var DEFAULT_UA = "invonetwork-web-sdk/0.8.0 (+https://invo.network)";
 var MAX_USD_AMOUNT = 999.99;
 var MAX_ITEM_PRICE = 999999.99;
 function invalidInput(label, value, why) {
@@ -458,6 +458,13 @@ function toOrderDetails(raw) {
     raw
   };
 }
+function toLinkedEmail(row) {
+  return {
+    email: String(row["email"] ?? ""),
+    primary: row["primary"] === true,
+    verifiedAt: row["verified_at"] ?? null
+  };
+}
 function toInboundPendingItem(row) {
   return {
     transactionId: String(row["transaction_id"] ?? ""),
@@ -877,6 +884,48 @@ var InvoServer = class {
     const rows = Array.isArray(raw["inbound_pending"]) ? raw["inbound_pending"] : [];
     return { inboundPending: rows.map(toInboundPendingItem), raw };
   }
+  /**
+   * Look up a player's linked wallet identities (SERVER-only, game-secret). Game-scoped:
+   * returns wallet members that also have a Player row on this game. Provide a `playerEmail`
+   * or `playerPhone` (phone wins if both). No in-game match (backend 404) returns
+   * `notFound: true` with empty `emails` — not an error.
+   *
+   * ⚠️ Returns first-party PII (emails/phones) — never expose this to the browser.
+   */
+  async getLinkedIdentities(query, opts) {
+    const phone = typeof query.playerPhone === "string" && query.playerPhone.trim() ? query.playerPhone.trim() : "";
+    const email = typeof query.playerEmail === "string" && query.playerEmail.trim() ? query.playerEmail.trim() : "";
+    if (!phone && !email) {
+      throw invalidInput("query", query, "requires a playerEmail or playerPhone");
+    }
+    const q = new URLSearchParams();
+    if (phone) q.set("player_phone", phone);
+    else q.set("player_email", email);
+    let raw;
+    try {
+      raw = await this.http.get(
+        `/api/wallet/identities?${q.toString()}`,
+        this.auth,
+        { signal: opts?.signal }
+      );
+    } catch (e) {
+      if (e instanceof InvoError && e.status === 404) {
+        const raw404 = e.body && typeof e.body === "object" ? e.body : {};
+        return { walletUserId: null, primaryEmail: "", primaryPhone: "", isMinor: false, emails: [], notFound: true, raw: raw404 };
+      }
+      throw e;
+    }
+    const emails = Array.isArray(raw["emails"]) ? raw["emails"].map(toLinkedEmail) : [];
+    return {
+      walletUserId: raw["wallet_user_id"] ?? null,
+      primaryEmail: String(raw["primary_email"] ?? ""),
+      primaryPhone: String(raw["primary_phone"] ?? ""),
+      isMinor: raw["is_minor"] === true,
+      emails,
+      notFound: false,
+      raw
+    };
+  }
   toInitiateResult(raw) {
     const vm = raw["verification_method"];
     const guardian = raw["guardian_approval"];

package/dist/server.d.cts

@@ -1,5 +1,5 @@
-import { I as InvoError, S as ServerConfig, a as CallOptions, k as PlayerToken, l as InitiateSendInput, m as InitiateResult, n as InitiateTransferInput, o as CreateCheckoutInput, p as CreateCheckoutResult, q as PurchaseInput, r as PurchaseResult, s as ConfirmPaymentResult, O as OrderDetailsResult, t as PurchaseItemInput, u as PurchaseItemResult, v as ItemHistoryQuery, w as ItemHistoryResult, x as ItemOrderQuery, y as PlayerBalanceQuery, z as PlayerBalanceResult, B as InboundPendingQuery, F as InboundPendingResult } from './types-Bi_NMSkN.cjs';
-export { G as CurrencyBalance, H as InboundPendingItem, f as InvoErrorInfo, g as InvoHooks, h as InvoRequestInfo, i as InvoResponseInfo, R as Rail, V as VerificationMethod } from './types-Bi_NMSkN.cjs';
+import { I as InvoError, S as ServerConfig, a as CallOptions, l as PlayerToken, m as InitiateSendInput, n as InitiateResult, o as InitiateTransferInput, p as CreateCheckoutInput, q as CreateCheckoutResult, r as PurchaseInput, s as PurchaseResult, t as ConfirmPaymentResult, O as OrderDetailsResult, u as PurchaseItemInput, v as PurchaseItemResult, w as ItemHistoryQuery, x as ItemHistoryResult, y as ItemOrderQuery, z as PlayerBalanceQuery, F as PlayerBalanceResult, G as InboundPendingQuery, H as InboundPendingResult, J as LinkedIdentitiesQuery, K as LinkedIdentitiesResult } from './types-DLSCxpoT.cjs';
+export { M as CurrencyBalance, N as InboundPendingItem, g as InvoErrorInfo, h as InvoHooks, i as InvoRequestInfo, j as InvoResponseInfo, Q as LinkedIdentityEmail, R as Rail, V as VerificationMethod } from './types-DLSCxpoT.cjs';
 
 interface VerifyWebhookOptions {
     /** Max age of the signed timestamp, in seconds. Default 300 (5 min). */
@@ -216,7 +216,16 @@ declare class InvoServer {
      * `transfer.claim_pending` webhook (the webhook is the wake-up; this is the list).
      */
     getInboundPending(query: InboundPendingQuery, opts?: CallOptions): Promise<InboundPendingResult>;
+    /**
+     * Look up a player's linked wallet identities (SERVER-only, game-secret). Game-scoped:
+     * returns wallet members that also have a Player row on this game. Provide a `playerEmail`
+     * or `playerPhone` (phone wins if both). No in-game match (backend 404) returns
+     * `notFound: true` with empty `emails` — not an error.
+     *
+     * ⚠️ Returns first-party PII (emails/phones) — never expose this to the browser.
+     */
+    getLinkedIdentities(query: LinkedIdentitiesQuery, opts?: CallOptions): Promise<LinkedIdentitiesResult>;
     private toInitiateResult;
 }
 
-export { CallOptions, ConfirmPaymentResult, CreateCheckoutInput, CreateCheckoutResult, InboundPendingQuery, InboundPendingResult, InitiateResult, InitiateSendInput, InitiateTransferInput, InvoError, InvoServer, type InvoWebhookEvent, ItemHistoryQuery, ItemHistoryResult, ItemOrderQuery, type ItemPurchasedData, OrderDetailsResult, PlayerBalanceQuery, PlayerBalanceResult, PlayerToken, type PurchaseCompletedData, type PurchaseEventData, PurchaseInput, PurchaseItemInput, PurchaseItemResult, PurchaseResult, ServerConfig, type TransferEventData, type VerifyWebhookOptions, type WebhookHandlerOptions, createWebhookHandler, verifyWebhook, verifyWebhookAsync };
+export { CallOptions, ConfirmPaymentResult, CreateCheckoutInput, CreateCheckoutResult, InboundPendingQuery, InboundPendingResult, InitiateResult, InitiateSendInput, InitiateTransferInput, InvoError, InvoServer, type InvoWebhookEvent, ItemHistoryQuery, ItemHistoryResult, ItemOrderQuery, type ItemPurchasedData, LinkedIdentitiesQuery, LinkedIdentitiesResult, OrderDetailsResult, PlayerBalanceQuery, PlayerBalanceResult, PlayerToken, type PurchaseCompletedData, type PurchaseEventData, PurchaseInput, PurchaseItemInput, PurchaseItemResult, PurchaseResult, ServerConfig, type TransferEventData, type VerifyWebhookOptions, type WebhookHandlerOptions, createWebhookHandler, verifyWebhook, verifyWebhookAsync };

package/dist/server.d.ts

@@ -1,5 +1,5 @@
-import { I as InvoError, S as ServerConfig, a as CallOptions, k as PlayerToken, l as InitiateSendInput, m as InitiateResult, n as InitiateTransferInput, o as CreateCheckoutInput, p as CreateCheckoutResult, q as PurchaseInput, r as PurchaseResult, s as ConfirmPaymentResult, O as OrderDetailsResult, t as PurchaseItemInput, u as PurchaseItemResult, v as ItemHistoryQuery, w as ItemHistoryResult, x as ItemOrderQuery, y as PlayerBalanceQuery, z as PlayerBalanceResult, B as InboundPendingQuery, F as InboundPendingResult } from './types-Bi_NMSkN.js';
-export { G as CurrencyBalance, H as InboundPendingItem, f as InvoErrorInfo, g as InvoHooks, h as InvoRequestInfo, i as InvoResponseInfo, R as Rail, V as VerificationMethod } from './types-Bi_NMSkN.js';
+import { I as InvoError, S as ServerConfig, a as CallOptions, l as PlayerToken, m as InitiateSendInput, n as InitiateResult, o as InitiateTransferInput, p as CreateCheckoutInput, q as CreateCheckoutResult, r as PurchaseInput, s as PurchaseResult, t as ConfirmPaymentResult, O as OrderDetailsResult, u as PurchaseItemInput, v as PurchaseItemResult, w as ItemHistoryQuery, x as ItemHistoryResult, y as ItemOrderQuery, z as PlayerBalanceQuery, F as PlayerBalanceResult, G as InboundPendingQuery, H as InboundPendingResult, J as LinkedIdentitiesQuery, K as LinkedIdentitiesResult } from './types-DLSCxpoT.js';
+export { M as CurrencyBalance, N as InboundPendingItem, g as InvoErrorInfo, h as InvoHooks, i as InvoRequestInfo, j as InvoResponseInfo, Q as LinkedIdentityEmail, R as Rail, V as VerificationMethod } from './types-DLSCxpoT.js';
 
 interface VerifyWebhookOptions {
     /** Max age of the signed timestamp, in seconds. Default 300 (5 min). */
@@ -216,7 +216,16 @@ declare class InvoServer {
      * `transfer.claim_pending` webhook (the webhook is the wake-up; this is the list).
      */
     getInboundPending(query: InboundPendingQuery, opts?: CallOptions): Promise<InboundPendingResult>;
+    /**
+     * Look up a player's linked wallet identities (SERVER-only, game-secret). Game-scoped:
+     * returns wallet members that also have a Player row on this game. Provide a `playerEmail`
+     * or `playerPhone` (phone wins if both). No in-game match (backend 404) returns
+     * `notFound: true` with empty `emails` — not an error.
+     *
+     * ⚠️ Returns first-party PII (emails/phones) — never expose this to the browser.
+     */
+    getLinkedIdentities(query: LinkedIdentitiesQuery, opts?: CallOptions): Promise<LinkedIdentitiesResult>;
     private toInitiateResult;
 }
 
-export { CallOptions, ConfirmPaymentResult, CreateCheckoutInput, CreateCheckoutResult, InboundPendingQuery, InboundPendingResult, InitiateResult, InitiateSendInput, InitiateTransferInput, InvoError, InvoServer, type InvoWebhookEvent, ItemHistoryQuery, ItemHistoryResult, ItemOrderQuery, type ItemPurchasedData, OrderDetailsResult, PlayerBalanceQuery, PlayerBalanceResult, PlayerToken, type PurchaseCompletedData, type PurchaseEventData, PurchaseInput, PurchaseItemInput, PurchaseItemResult, PurchaseResult, ServerConfig, type TransferEventData, type VerifyWebhookOptions, type WebhookHandlerOptions, createWebhookHandler, verifyWebhook, verifyWebhookAsync };
+export { CallOptions, ConfirmPaymentResult, CreateCheckoutInput, CreateCheckoutResult, InboundPendingQuery, InboundPendingResult, InitiateResult, InitiateSendInput, InitiateTransferInput, InvoError, InvoServer, type InvoWebhookEvent, ItemHistoryQuery, ItemHistoryResult, ItemOrderQuery, type ItemPurchasedData, LinkedIdentitiesQuery, LinkedIdentitiesResult, OrderDetailsResult, PlayerBalanceQuery, PlayerBalanceResult, PlayerToken, type PurchaseCompletedData, type PurchaseEventData, PurchaseInput, PurchaseItemInput, PurchaseItemResult, PurchaseResult, ServerConfig, type TransferEventData, type VerifyWebhookOptions, type WebhookHandlerOptions, createWebhookHandler, verifyWebhook, verifyWebhookAsync };

package/dist/server.js

@@ -161,7 +161,7 @@ async function hmacHexSubtle(secret, message) {
 }
 
 // src/server.ts
-var DEFAULT_UA = "invonetwork-web-sdk/0.4.0 (+https://invo.network)";
+var DEFAULT_UA = "invonetwork-web-sdk/0.8.0 (+https://invo.network)";
 var MAX_USD_AMOUNT = 999.99;
 var MAX_ITEM_PRICE = 999999.99;
 function invalidInput(label, value, why) {
@@ -201,6 +201,13 @@ function toOrderDetails(raw) {
     raw
   };
 }
+function toLinkedEmail(row) {
+  return {
+    email: String(row["email"] ?? ""),
+    primary: row["primary"] === true,
+    verifiedAt: row["verified_at"] ?? null
+  };
+}
 function toInboundPendingItem(row) {
   return {
     transactionId: String(row["transaction_id"] ?? ""),
@@ -620,6 +627,48 @@ var InvoServer = class {
     const rows = Array.isArray(raw["inbound_pending"]) ? raw["inbound_pending"] : [];
     return { inboundPending: rows.map(toInboundPendingItem), raw };
   }
+  /**
+   * Look up a player's linked wallet identities (SERVER-only, game-secret). Game-scoped:
+   * returns wallet members that also have a Player row on this game. Provide a `playerEmail`
+   * or `playerPhone` (phone wins if both). No in-game match (backend 404) returns
+   * `notFound: true` with empty `emails` — not an error.
+   *
+   * ⚠️ Returns first-party PII (emails/phones) — never expose this to the browser.
+   */
+  async getLinkedIdentities(query, opts) {
+    const phone = typeof query.playerPhone === "string" && query.playerPhone.trim() ? query.playerPhone.trim() : "";
+    const email = typeof query.playerEmail === "string" && query.playerEmail.trim() ? query.playerEmail.trim() : "";
+    if (!phone && !email) {
+      throw invalidInput("query", query, "requires a playerEmail or playerPhone");
+    }
+    const q = new URLSearchParams();
+    if (phone) q.set("player_phone", phone);
+    else q.set("player_email", email);
+    let raw;
+    try {
+      raw = await this.http.get(
+        `/api/wallet/identities?${q.toString()}`,
+        this.auth,
+        { signal: opts?.signal }
+      );
+    } catch (e) {
+      if (e instanceof InvoError && e.status === 404) {
+        const raw404 = e.body && typeof e.body === "object" ? e.body : {};
+        return { walletUserId: null, primaryEmail: "", primaryPhone: "", isMinor: false, emails: [], notFound: true, raw: raw404 };
+      }
+      throw e;
+    }
+    const emails = Array.isArray(raw["emails"]) ? raw["emails"].map(toLinkedEmail) : [];
+    return {
+      walletUserId: raw["wallet_user_id"] ?? null,
+      primaryEmail: String(raw["primary_email"] ?? ""),
+      primaryPhone: String(raw["primary_phone"] ?? ""),
+      isMinor: raw["is_minor"] === true,
+      emails,
+      notFound: false,
+      raw
+    };
+  }
   toInitiateResult(raw) {
     const vm = raw["verification_method"];
     const guardian = raw["guardian_approval"];

package/dist/{types-Bi_NMSkN.d.cts → types-DLSCxpoT.d.cts}

@@ -357,6 +357,50 @@ interface PendingCollectResult {
     pending: PendingCollectItem[];
     raw: Record<string, unknown>;
 }
+interface BalanceRow {
+    currencyId: string | number;
+    currencyName: string;
+    /** Short symbol (may be null). */
+    currencySymbol: string | null;
+    /** Icon URL (may be null). */
+    currencySymbolUrl: string | null;
+    /** Decimal strings (parseFloat as needed). */
+    availableBalance: string;
+    reservedBalance: string;
+    totalBalance: string;
+    raw: Record<string, unknown>;
+}
+interface BalanceResult {
+    gameId: string | number;
+    gameName: string;
+    /** Empty for a player who hasn't transacted on this game yet (a 200, not an error). */
+    balances: BalanceRow[];
+    /** Sum of total_balance across rows (decimal string). */
+    totalValue: string;
+    currencyCount: number;
+    hasFunds: boolean;
+    raw: Record<string, unknown>;
+}
+interface LinkedIdentitiesQuery {
+    /** Provide one; phone wins if both are given. */
+    playerEmail?: string;
+    playerPhone?: string;
+}
+interface LinkedIdentityEmail {
+    email: string;
+    primary: boolean;
+    verifiedAt: string | null;
+}
+interface LinkedIdentitiesResult {
+    walletUserId: string | null;
+    primaryEmail: string;
+    primaryPhone: string;
+    isMinor: boolean;
+    emails: LinkedIdentityEmail[];
+    /** true when there was no in-game match (backend 404) — treat as "no linked identities". */
+    notFound: boolean;
+    raw: Record<string, unknown>;
+}
 interface DestinationsQuery {
     /** "transfer" | "send". Defaults "transfer" (the set is identical for both today). */
     direction?: "transfer" | "send";
@@ -416,4 +460,4 @@ interface LinkDeviceResult {
     raw: Record<string, unknown>;
 }
 
-export { type ApproveResult as A, type InboundPendingQuery as B, type ClientConfig as C, type DestinationsQuery as D, type EnrollmentBeginResult as E, type InboundPendingResult as F, type CurrencyBalance as G, type InboundPendingItem as H, InvoError as I, type LinkDeviceResult as L, type OrderDetailsResult as O, type PendingCollectResult as P, type Rail as R, type ServerConfig as S, type VerificationMethod as V, type CallOptions as a, type ConfirmReceiptResult as b, type DestinationsResult as c, type EnrollmentVerifyResult as d, type DestinationGame as e, type InvoErrorInfo as f, type InvoHooks as g, type InvoRequestInfo as h, type InvoResponseInfo as i, type PendingCollectItem as j, type PlayerToken as k, type InitiateSendInput as l, type InitiateResult as m, type InitiateTransferInput as n, type CreateCheckoutInput as o, type CreateCheckoutResult as p, type PurchaseInput as q, type PurchaseResult as r, type ConfirmPaymentResult as s, type PurchaseItemInput as t, type PurchaseItemResult as u, type ItemHistoryQuery as v, type ItemHistoryResult as w, type ItemOrderQuery as x, type PlayerBalanceQuery as y, type PlayerBalanceResult as z };
+export { type ApproveResult as A, type BalanceResult as B, type ClientConfig as C, type DestinationsQuery as D, type EnrollmentBeginResult as E, type PlayerBalanceResult as F, type InboundPendingQuery as G, type InboundPendingResult as H, InvoError as I, type LinkedIdentitiesQuery as J, type LinkedIdentitiesResult as K, type LinkDeviceResult as L, type CurrencyBalance as M, type InboundPendingItem as N, type OrderDetailsResult as O, type PendingCollectResult as P, type LinkedIdentityEmail as Q, type Rail as R, type ServerConfig as S, type VerificationMethod as V, type CallOptions as a, type ConfirmReceiptResult as b, type DestinationsResult as c, type EnrollmentVerifyResult as d, type BalanceRow as e, type DestinationGame as f, type InvoErrorInfo as g, type InvoHooks as h, type InvoRequestInfo as i, type InvoResponseInfo as j, type PendingCollectItem as k, type PlayerToken as l, type InitiateSendInput as m, type InitiateResult as n, type InitiateTransferInput as o, type CreateCheckoutInput as p, type CreateCheckoutResult as q, type PurchaseInput as r, type PurchaseResult as s, type ConfirmPaymentResult as t, type PurchaseItemInput as u, type PurchaseItemResult as v, type ItemHistoryQuery as w, type ItemHistoryResult as x, type ItemOrderQuery as y, type PlayerBalanceQuery as z };

package/dist/{types-Bi_NMSkN.d.ts → types-DLSCxpoT.d.ts}

@@ -357,6 +357,50 @@ interface PendingCollectResult {
     pending: PendingCollectItem[];
     raw: Record<string, unknown>;
 }
+interface BalanceRow {
+    currencyId: string | number;
+    currencyName: string;
+    /** Short symbol (may be null). */
+    currencySymbol: string | null;
+    /** Icon URL (may be null). */
+    currencySymbolUrl: string | null;
+    /** Decimal strings (parseFloat as needed). */
+    availableBalance: string;
+    reservedBalance: string;
+    totalBalance: string;
+    raw: Record<string, unknown>;
+}
+interface BalanceResult {
+    gameId: string | number;
+    gameName: string;
+    /** Empty for a player who hasn't transacted on this game yet (a 200, not an error). */
+    balances: BalanceRow[];
+    /** Sum of total_balance across rows (decimal string). */
+    totalValue: string;
+    currencyCount: number;
+    hasFunds: boolean;
+    raw: Record<string, unknown>;
+}
+interface LinkedIdentitiesQuery {
+    /** Provide one; phone wins if both are given. */
+    playerEmail?: string;
+    playerPhone?: string;
+}
+interface LinkedIdentityEmail {
+    email: string;
+    primary: boolean;
+    verifiedAt: string | null;
+}
+interface LinkedIdentitiesResult {
+    walletUserId: string | null;
+    primaryEmail: string;
+    primaryPhone: string;
+    isMinor: boolean;
+    emails: LinkedIdentityEmail[];
+    /** true when there was no in-game match (backend 404) — treat as "no linked identities". */
+    notFound: boolean;
+    raw: Record<string, unknown>;
+}
 interface DestinationsQuery {
     /** "transfer" | "send". Defaults "transfer" (the set is identical for both today). */
     direction?: "transfer" | "send";
@@ -416,4 +460,4 @@ interface LinkDeviceResult {
     raw: Record<string, unknown>;
 }
 
-export { type ApproveResult as A, type InboundPendingQuery as B, type ClientConfig as C, type DestinationsQuery as D, type EnrollmentBeginResult as E, type InboundPendingResult as F, type CurrencyBalance as G, type InboundPendingItem as H, InvoError as I, type LinkDeviceResult as L, type OrderDetailsResult as O, type PendingCollectResult as P, type Rail as R, type ServerConfig as S, type VerificationMethod as V, type CallOptions as a, type ConfirmReceiptResult as b, type DestinationsResult as c, type EnrollmentVerifyResult as d, type DestinationGame as e, type InvoErrorInfo as f, type InvoHooks as g, type InvoRequestInfo as h, type InvoResponseInfo as i, type PendingCollectItem as j, type PlayerToken as k, type InitiateSendInput as l, type InitiateResult as m, type InitiateTransferInput as n, type CreateCheckoutInput as o, type CreateCheckoutResult as p, type PurchaseInput as q, type PurchaseResult as r, type ConfirmPaymentResult as s, type PurchaseItemInput as t, type PurchaseItemResult as u, type ItemHistoryQuery as v, type ItemHistoryResult as w, type ItemOrderQuery as x, type PlayerBalanceQuery as y, type PlayerBalanceResult as z };
+export { type ApproveResult as A, type BalanceResult as B, type ClientConfig as C, type DestinationsQuery as D, type EnrollmentBeginResult as E, type PlayerBalanceResult as F, type InboundPendingQuery as G, type InboundPendingResult as H, InvoError as I, type LinkedIdentitiesQuery as J, type LinkedIdentitiesResult as K, type LinkDeviceResult as L, type CurrencyBalance as M, type InboundPendingItem as N, type OrderDetailsResult as O, type PendingCollectResult as P, type LinkedIdentityEmail as Q, type Rail as R, type ServerConfig as S, type VerificationMethod as V, type CallOptions as a, type ConfirmReceiptResult as b, type DestinationsResult as c, type EnrollmentVerifyResult as d, type BalanceRow as e, type DestinationGame as f, type InvoErrorInfo as g, type InvoHooks as h, type InvoRequestInfo as i, type InvoResponseInfo as j, type PendingCollectItem as k, type PlayerToken as l, type InitiateSendInput as m, type InitiateResult as n, type InitiateTransferInput as o, type CreateCheckoutInput as p, type CreateCheckoutResult as q, type PurchaseInput as r, type PurchaseResult as s, type ConfirmPaymentResult as t, type PurchaseItemInput as u, type PurchaseItemResult as v, type ItemHistoryQuery as w, type ItemHistoryResult as x, type ItemOrderQuery as y, type PlayerBalanceQuery as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invonetwork/web-sdk",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "INVO Web SDK — currency purchase + passkey (WebAuthn) verification for partner web platforms.",
   "license": "SEE LICENSE IN LICENSE",
   "private": false,