@invonetwork/web-sdk 0.8.0 → 1.1.0

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { C as ClientConfig, a as CallOptions, A as ApproveResult, b as ConfirmReceiptResult, L as LinkDeviceResult, P as PendingCollectResult, D as DestinationsQuery, c as DestinationsResult, B as BalanceResult, E as EnrollmentBeginResult, d as EnrollmentVerifyResult } from './types-DLSCxpoT.js';
-export { e as BalanceRow, f as DestinationGame, I as InvoError, g as InvoErrorInfo, h as InvoHooks, i as InvoRequestInfo, j as InvoResponseInfo, k as PendingCollectItem, R as Rail, V as VerificationMethod } from './types-DLSCxpoT.js';
+import { C as ClientConfig, a as CallOptions, A as ApproveResult, b as ConfirmReceiptResult, L as LinkDeviceResult, P as PendingCollectResult, D as DestinationsQuery, c as DestinationsResult, B as BalanceResult, E as EnrollmentBeginResult, d as EnrollmentVerifyResult } from './types-CPt_5_Aw.js';
+export { e as BalanceRow, f as DestinationGame, I as InvoError, g as InvoErrorInfo, h as InvoHooks, i as InvoRequestInfo, j as InvoResponseInfo, k as PendingCollectItem, R as Rail, V as VerificationMethod } from './types-CPt_5_Aw.js';
 
 declare class InvoClient {
     private readonly http;

package/dist/index.js

@@ -1,5 +1,5 @@
-import { assertSecureBaseUrl, Http, InvoError } from './chunk-D3XBTH4C.js';
-export { InvoError } from './chunk-D3XBTH4C.js';
+import { assertSecureBaseUrl, Http, InvoError } from './chunk-ZVKWDXSL.js';
+export { InvoError } from './chunk-ZVKWDXSL.js';
 
 // src/shared/webauthn.ts
 function b64urlToBuffer(value) {

package/dist/server.cjs

@@ -40,6 +40,10 @@ var InvoError = class _InvoError extends Error {
     const b = this.bodyObject();
     return this.code === "INSUFFICIENT_BALANCE" || "required_amount" in b || /insufficient[_ ]balance/i.test(this.message);
   }
+  /** True if a claim needs phone-share approval before it can complete (claim → 409). */
+  get isPhoneShareApprovalRequired() {
+    return this.code === "PHONE_SHARE_APPROVAL_REQUIRED";
+  }
   /** True if an idempotency-keyed request was a duplicate (item purchase → 409). */
   get isDuplicateRequest() {
     return this.code === "DUPLICATE_REQUEST" || this.status === 409 && /duplicate/i.test(this.message);
@@ -418,7 +422,7 @@ async function hmacHexSubtle(secret, message) {
 }
 
 // src/server.ts
-var DEFAULT_UA = "invonetwork-web-sdk/0.8.0 (+https://invo.network)";
+var DEFAULT_UA = "invonetwork-web-sdk/1.1.0 (+https://invo.network)";
 var MAX_USD_AMOUNT = 999.99;
 var MAX_ITEM_PRICE = 999999.99;
 function invalidInput(label, value, why) {
@@ -480,6 +484,57 @@ function toInboundPendingItem(row) {
     raw: row
   };
 }
+function toSmsVerifyResult(raw) {
+  return {
+    status: String(raw["status"] ?? ""),
+    transactionId: String(raw["transaction_id"] ?? ""),
+    claimCode: raw["claim_code"],
+    newBalance: raw["new_balance"] ?? null,
+    orderId: raw["order_id"],
+    raw
+  };
+}
+function toClaimResult(raw) {
+  const status = String(raw["status"] ?? "");
+  return {
+    status,
+    transactionId: raw["transaction_id"],
+    newBalance: raw["new_balance"] ?? null,
+    currencyName: raw["currency_name"],
+    orderId: raw["order_id"],
+    needsAccountSelection: status === "needs_account_selection",
+    candidates: Array.isArray(raw["candidates"]) ? raw["candidates"] : void 0,
+    raw
+  };
+}
+function toTransactionStatus(raw) {
+  return {
+    transactionId: String(raw["transaction_id"] ?? ""),
+    transactionType: String(raw["transaction_type"] ?? ""),
+    transactionStatus: String(raw["transaction_status"] ?? ""),
+    verificationState: String(raw["verification_state"] ?? ""),
+    amount: raw["amount"] ?? null,
+    netAmount: raw["net_amount"] ?? null,
+    currencyId: raw["currency_id"] ?? "",
+    orderId: raw["order_id"],
+    toPhone: raw["to_phone"],
+    toIdentityId: raw["to_identity_id"] ?? null,
+    raw
+  };
+}
+function toGuardianApprovalStatus(raw) {
+  const approval = raw["approval"] ?? {};
+  return {
+    state: String(approval["state"] ?? ""),
+    approvalId: approval["approval_id"],
+    transactionId: approval["transaction_id"],
+    expiresAt: approval["expires_at"],
+    decidedAt: approval["decided_at"],
+    decisionSource: approval["decision_source"],
+    actionDescription: approval["action_description"],
+    raw
+  };
+}
 function toCurrencyBalance(row) {
   return {
     currencyId: row["currency_id"] ?? "",
@@ -926,6 +981,132 @@ var InvoServer = class {
       raw
     };
   }
+  /**
+   * Complete a TRANSFER's SMS-PIN step (un-enrolled fallback). NOT idempotent —
+   * each attempt is counted server-side, so this is never auto-retried. A bad PIN
+   * throws a 400 InvoError carrying `attempts_remaining` on `err.body`; a blocked
+   * recipient throws 429 (`sms_verification_blocked`).
+   */
+  async verifySmsTransfer(transactionId, smsPin, opts) {
+    if (typeof transactionId !== "string" || !transactionId.trim()) {
+      throw invalidInput("transactionId", transactionId, "is required");
+    }
+    if (typeof smsPin !== "string" || !smsPin.trim()) {
+      throw invalidInput("smsPin", smsPin, "is required");
+    }
+    const raw = await this.http.post(
+      "/api/transfers/verify-sms",
+      { transaction_id: transactionId, sms_pin: smsPin },
+      this.auth,
+      { signal: opts?.signal }
+      // NOT idempotent — attempts are counted; never auto-retried
+    );
+    return toSmsVerifyResult(raw);
+  }
+  /** Complete a SEND's SMS-PIN step (un-enrolled fallback). See verifySmsTransfer. */
+  async verifySmsSend(transactionId, smsPin, opts) {
+    if (typeof transactionId !== "string" || !transactionId.trim()) {
+      throw invalidInput("transactionId", transactionId, "is required");
+    }
+    if (typeof smsPin !== "string" || !smsPin.trim()) {
+      throw invalidInput("smsPin", smsPin, "is required");
+    }
+    const raw = await this.http.post(
+      "/api/currency-sends/verify-sms",
+      { transaction_id: transactionId, sms_pin: smsPin },
+      this.auth,
+      { signal: opts?.signal }
+      // NOT idempotent — attempts are counted; never auto-retried
+    );
+    return toSmsVerifyResult(raw);
+  }
+  /**
+   * Claim an inbound TRANSFER by its claim code, crediting one of this game's currencies.
+   * NOT idempotent. A 200 may come back as `needsAccountSelection` (the recipient phone
+   * maps to >1 of your players) — inspect `result.candidates` and re-submit with
+   * `targetPlayerId`. Errors surface via InvoError (404 unknown code, 403 phone mismatch,
+   * 400 not-claimable/expired/wrong-value, 409 `err.isPhoneShareApprovalRequired`, …).
+   */
+  async claimTransfer(input, opts) {
+    const body = {
+      claim_code: input.claimCode,
+      target_player_name: input.targetPlayerName,
+      target_player_email: input.targetPlayerEmail,
+      target_player_phone: input.targetPlayerPhone,
+      target_currency_id: input.targetCurrencyId
+    };
+    if (input.targetPlayerId != null) body["target_player_id"] = input.targetPlayerId;
+    const raw = await this.http.post(
+      "/api/transfers/claim-transfer",
+      body,
+      this.auth,
+      { signal: opts?.signal }
+      // NOT idempotent — never auto-retried
+    );
+    return toClaimResult(raw);
+  }
+  /**
+   * Claim an inbound SEND by its claim code. NOT idempotent. May return
+   * `needsAccountSelection` (multi-account phone) — re-submit with `receiverPlayerId`.
+   * See claimTransfer for the error surface.
+   */
+  async claimCurrency(input, opts) {
+    const body = {
+      claim_code: input.claimCode,
+      receiver_player_name: input.receiverPlayerName,
+      receiver_player_email: input.receiverPlayerEmail,
+      receiver_player_phone: input.receiverPlayerPhone
+    };
+    if (input.receiverPlayerId != null) body["receiver_player_id"] = input.receiverPlayerId;
+    const raw = await this.http.post(
+      "/api/currency-sends/claim-currency",
+      body,
+      this.auth,
+      { signal: opts?.signal }
+      // NOT idempotent — never auto-retried
+    );
+    return toClaimResult(raw);
+  }
+  /** Read a TRANSFER's status (verification_state + amounts + destination). */
+  async getTransferStatus(transactionId, opts) {
+    if (typeof transactionId !== "string" || !transactionId.trim()) {
+      throw invalidInput("transactionId", transactionId, "is required");
+    }
+    const raw = await this.http.get(
+      `/api/transfers/${encodeURIComponent(transactionId)}/status`,
+      this.auth,
+      { signal: opts?.signal }
+    );
+    return toTransactionStatus(raw);
+  }
+  /** Read a SEND's status (adds fees, game names, claim_info, … on `raw`). */
+  async getSendStatus(transactionId, opts) {
+    if (typeof transactionId !== "string" || !transactionId.trim()) {
+      throw invalidInput("transactionId", transactionId, "is required");
+    }
+    const raw = await this.http.get(
+      `/api/currency-sends/${encodeURIComponent(transactionId)}/status`,
+      this.auth,
+      { signal: opts?.signal }
+    );
+    return toTransactionStatus(raw);
+  }
+  /**
+   * Poll a transaction's guardian approval status (minor/guardian flow). The retry
+   * layer already retries the 503 (`{status:"unavailable"}`) for this idempotent GET;
+   * a missing approval throws a 404 InvoError (`{status:"not_found"}`).
+   */
+  async getGuardianApprovalStatus(transactionId, opts) {
+    if (typeof transactionId !== "string" || !transactionId.trim()) {
+      throw invalidInput("transactionId", transactionId, "is required");
+    }
+    const raw = await this.http.get(
+      `/api/transactions/${encodeURIComponent(transactionId)}/approval-status`,
+      this.auth,
+      { signal: opts?.signal }
+    );
+    return toGuardianApprovalStatus(raw);
+  }
   toInitiateResult(raw) {
     const vm = raw["verification_method"];
     const guardian = raw["guardian_approval"];

package/dist/server.d.cts

@@ -1,5 +1,5 @@
-import { I as InvoError, S as ServerConfig, a as CallOptions, l as PlayerToken, m as InitiateSendInput, n as InitiateResult, o as InitiateTransferInput, p as CreateCheckoutInput, q as CreateCheckoutResult, r as PurchaseInput, s as PurchaseResult, t as ConfirmPaymentResult, O as OrderDetailsResult, u as PurchaseItemInput, v as PurchaseItemResult, w as ItemHistoryQuery, x as ItemHistoryResult, y as ItemOrderQuery, z as PlayerBalanceQuery, F as PlayerBalanceResult, G as InboundPendingQuery, H as InboundPendingResult, J as LinkedIdentitiesQuery, K as LinkedIdentitiesResult } from './types-DLSCxpoT.cjs';
-export { M as CurrencyBalance, N as InboundPendingItem, g as InvoErrorInfo, h as InvoHooks, i as InvoRequestInfo, j as InvoResponseInfo, Q as LinkedIdentityEmail, R as Rail, V as VerificationMethod } from './types-DLSCxpoT.cjs';
+import { I as InvoError, S as ServerConfig, a as CallOptions, l as PlayerToken, m as InitiateSendInput, n as InitiateResult, o as InitiateTransferInput, p as CreateCheckoutInput, q as CreateCheckoutResult, r as PurchaseInput, s as PurchaseResult, t as ConfirmPaymentResult, O as OrderDetailsResult, u as PurchaseItemInput, v as PurchaseItemResult, w as ItemHistoryQuery, x as ItemHistoryResult, y as ItemOrderQuery, z as PlayerBalanceQuery, F as PlayerBalanceResult, G as InboundPendingQuery, H as InboundPendingResult, J as LinkedIdentitiesQuery, K as LinkedIdentitiesResult, M as SmsVerifyResult, N as ClaimTransferInput, Q as ClaimResult, T as ClaimCurrencyInput, U as TransactionStatusResult, W as GuardianApprovalStatusResult } from './types-CPt_5_Aw.cjs';
+export { X as CurrencyBalance, Y as InboundPendingItem, g as InvoErrorInfo, h as InvoHooks, i as InvoRequestInfo, j as InvoResponseInfo, Z as LinkedIdentityEmail, R as Rail, V as VerificationMethod } from './types-CPt_5_Aw.cjs';
 
 interface VerifyWebhookOptions {
     /** Max age of the signed timestamp, in seconds. Default 300 (5 min). */
@@ -225,7 +225,40 @@ declare class InvoServer {
      * ⚠️ Returns first-party PII (emails/phones) — never expose this to the browser.
      */
     getLinkedIdentities(query: LinkedIdentitiesQuery, opts?: CallOptions): Promise<LinkedIdentitiesResult>;
+    /**
+     * Complete a TRANSFER's SMS-PIN step (un-enrolled fallback). NOT idempotent —
+     * each attempt is counted server-side, so this is never auto-retried. A bad PIN
+     * throws a 400 InvoError carrying `attempts_remaining` on `err.body`; a blocked
+     * recipient throws 429 (`sms_verification_blocked`).
+     */
+    verifySmsTransfer(transactionId: string, smsPin: string, opts?: CallOptions): Promise<SmsVerifyResult>;
+    /** Complete a SEND's SMS-PIN step (un-enrolled fallback). See verifySmsTransfer. */
+    verifySmsSend(transactionId: string, smsPin: string, opts?: CallOptions): Promise<SmsVerifyResult>;
+    /**
+     * Claim an inbound TRANSFER by its claim code, crediting one of this game's currencies.
+     * NOT idempotent. A 200 may come back as `needsAccountSelection` (the recipient phone
+     * maps to >1 of your players) — inspect `result.candidates` and re-submit with
+     * `targetPlayerId`. Errors surface via InvoError (404 unknown code, 403 phone mismatch,
+     * 400 not-claimable/expired/wrong-value, 409 `err.isPhoneShareApprovalRequired`, …).
+     */
+    claimTransfer(input: ClaimTransferInput, opts?: CallOptions): Promise<ClaimResult>;
+    /**
+     * Claim an inbound SEND by its claim code. NOT idempotent. May return
+     * `needsAccountSelection` (multi-account phone) — re-submit with `receiverPlayerId`.
+     * See claimTransfer for the error surface.
+     */
+    claimCurrency(input: ClaimCurrencyInput, opts?: CallOptions): Promise<ClaimResult>;
+    /** Read a TRANSFER's status (verification_state + amounts + destination). */
+    getTransferStatus(transactionId: string, opts?: CallOptions): Promise<TransactionStatusResult>;
+    /** Read a SEND's status (adds fees, game names, claim_info, … on `raw`). */
+    getSendStatus(transactionId: string, opts?: CallOptions): Promise<TransactionStatusResult>;
+    /**
+     * Poll a transaction's guardian approval status (minor/guardian flow). The retry
+     * layer already retries the 503 (`{status:"unavailable"}`) for this idempotent GET;
+     * a missing approval throws a 404 InvoError (`{status:"not_found"}`).
+     */
+    getGuardianApprovalStatus(transactionId: string, opts?: CallOptions): Promise<GuardianApprovalStatusResult>;
     private toInitiateResult;
 }
 
-export { CallOptions, ConfirmPaymentResult, CreateCheckoutInput, CreateCheckoutResult, InboundPendingQuery, InboundPendingResult, InitiateResult, InitiateSendInput, InitiateTransferInput, InvoError, InvoServer, type InvoWebhookEvent, ItemHistoryQuery, ItemHistoryResult, ItemOrderQuery, type ItemPurchasedData, LinkedIdentitiesQuery, LinkedIdentitiesResult, OrderDetailsResult, PlayerBalanceQuery, PlayerBalanceResult, PlayerToken, type PurchaseCompletedData, type PurchaseEventData, PurchaseInput, PurchaseItemInput, PurchaseItemResult, PurchaseResult, ServerConfig, type TransferEventData, type VerifyWebhookOptions, type WebhookHandlerOptions, createWebhookHandler, verifyWebhook, verifyWebhookAsync };
+export { CallOptions, ClaimCurrencyInput, ClaimResult, ClaimTransferInput, ConfirmPaymentResult, CreateCheckoutInput, CreateCheckoutResult, GuardianApprovalStatusResult, InboundPendingQuery, InboundPendingResult, InitiateResult, InitiateSendInput, InitiateTransferInput, InvoError, InvoServer, type InvoWebhookEvent, ItemHistoryQuery, ItemHistoryResult, ItemOrderQuery, type ItemPurchasedData, LinkedIdentitiesQuery, LinkedIdentitiesResult, OrderDetailsResult, PlayerBalanceQuery, PlayerBalanceResult, PlayerToken, type PurchaseCompletedData, type PurchaseEventData, PurchaseInput, PurchaseItemInput, PurchaseItemResult, PurchaseResult, ServerConfig, SmsVerifyResult, TransactionStatusResult, type TransferEventData, type VerifyWebhookOptions, type WebhookHandlerOptions, createWebhookHandler, verifyWebhook, verifyWebhookAsync };

package/dist/server.d.ts

@@ -1,5 +1,5 @@
-import { I as InvoError, S as ServerConfig, a as CallOptions, l as PlayerToken, m as InitiateSendInput, n as InitiateResult, o as InitiateTransferInput, p as CreateCheckoutInput, q as CreateCheckoutResult, r as PurchaseInput, s as PurchaseResult, t as ConfirmPaymentResult, O as OrderDetailsResult, u as PurchaseItemInput, v as PurchaseItemResult, w as ItemHistoryQuery, x as ItemHistoryResult, y as ItemOrderQuery, z as PlayerBalanceQuery, F as PlayerBalanceResult, G as InboundPendingQuery, H as InboundPendingResult, J as LinkedIdentitiesQuery, K as LinkedIdentitiesResult } from './types-DLSCxpoT.js';
-export { M as CurrencyBalance, N as InboundPendingItem, g as InvoErrorInfo, h as InvoHooks, i as InvoRequestInfo, j as InvoResponseInfo, Q as LinkedIdentityEmail, R as Rail, V as VerificationMethod } from './types-DLSCxpoT.js';
+import { I as InvoError, S as ServerConfig, a as CallOptions, l as PlayerToken, m as InitiateSendInput, n as InitiateResult, o as InitiateTransferInput, p as CreateCheckoutInput, q as CreateCheckoutResult, r as PurchaseInput, s as PurchaseResult, t as ConfirmPaymentResult, O as OrderDetailsResult, u as PurchaseItemInput, v as PurchaseItemResult, w as ItemHistoryQuery, x as ItemHistoryResult, y as ItemOrderQuery, z as PlayerBalanceQuery, F as PlayerBalanceResult, G as InboundPendingQuery, H as InboundPendingResult, J as LinkedIdentitiesQuery, K as LinkedIdentitiesResult, M as SmsVerifyResult, N as ClaimTransferInput, Q as ClaimResult, T as ClaimCurrencyInput, U as TransactionStatusResult, W as GuardianApprovalStatusResult } from './types-CPt_5_Aw.js';
+export { X as CurrencyBalance, Y as InboundPendingItem, g as InvoErrorInfo, h as InvoHooks, i as InvoRequestInfo, j as InvoResponseInfo, Z as LinkedIdentityEmail, R as Rail, V as VerificationMethod } from './types-CPt_5_Aw.js';
 
 interface VerifyWebhookOptions {
     /** Max age of the signed timestamp, in seconds. Default 300 (5 min). */
@@ -225,7 +225,40 @@ declare class InvoServer {
      * ⚠️ Returns first-party PII (emails/phones) — never expose this to the browser.
      */
     getLinkedIdentities(query: LinkedIdentitiesQuery, opts?: CallOptions): Promise<LinkedIdentitiesResult>;
+    /**
+     * Complete a TRANSFER's SMS-PIN step (un-enrolled fallback). NOT idempotent —
+     * each attempt is counted server-side, so this is never auto-retried. A bad PIN
+     * throws a 400 InvoError carrying `attempts_remaining` on `err.body`; a blocked
+     * recipient throws 429 (`sms_verification_blocked`).
+     */
+    verifySmsTransfer(transactionId: string, smsPin: string, opts?: CallOptions): Promise<SmsVerifyResult>;
+    /** Complete a SEND's SMS-PIN step (un-enrolled fallback). See verifySmsTransfer. */
+    verifySmsSend(transactionId: string, smsPin: string, opts?: CallOptions): Promise<SmsVerifyResult>;
+    /**
+     * Claim an inbound TRANSFER by its claim code, crediting one of this game's currencies.
+     * NOT idempotent. A 200 may come back as `needsAccountSelection` (the recipient phone
+     * maps to >1 of your players) — inspect `result.candidates` and re-submit with
+     * `targetPlayerId`. Errors surface via InvoError (404 unknown code, 403 phone mismatch,
+     * 400 not-claimable/expired/wrong-value, 409 `err.isPhoneShareApprovalRequired`, …).
+     */
+    claimTransfer(input: ClaimTransferInput, opts?: CallOptions): Promise<ClaimResult>;
+    /**
+     * Claim an inbound SEND by its claim code. NOT idempotent. May return
+     * `needsAccountSelection` (multi-account phone) — re-submit with `receiverPlayerId`.
+     * See claimTransfer for the error surface.
+     */
+    claimCurrency(input: ClaimCurrencyInput, opts?: CallOptions): Promise<ClaimResult>;
+    /** Read a TRANSFER's status (verification_state + amounts + destination). */
+    getTransferStatus(transactionId: string, opts?: CallOptions): Promise<TransactionStatusResult>;
+    /** Read a SEND's status (adds fees, game names, claim_info, … on `raw`). */
+    getSendStatus(transactionId: string, opts?: CallOptions): Promise<TransactionStatusResult>;
+    /**
+     * Poll a transaction's guardian approval status (minor/guardian flow). The retry
+     * layer already retries the 503 (`{status:"unavailable"}`) for this idempotent GET;
+     * a missing approval throws a 404 InvoError (`{status:"not_found"}`).
+     */
+    getGuardianApprovalStatus(transactionId: string, opts?: CallOptions): Promise<GuardianApprovalStatusResult>;
     private toInitiateResult;
 }
 
-export { CallOptions, ConfirmPaymentResult, CreateCheckoutInput, CreateCheckoutResult, InboundPendingQuery, InboundPendingResult, InitiateResult, InitiateSendInput, InitiateTransferInput, InvoError, InvoServer, type InvoWebhookEvent, ItemHistoryQuery, ItemHistoryResult, ItemOrderQuery, type ItemPurchasedData, LinkedIdentitiesQuery, LinkedIdentitiesResult, OrderDetailsResult, PlayerBalanceQuery, PlayerBalanceResult, PlayerToken, type PurchaseCompletedData, type PurchaseEventData, PurchaseInput, PurchaseItemInput, PurchaseItemResult, PurchaseResult, ServerConfig, type TransferEventData, type VerifyWebhookOptions, type WebhookHandlerOptions, createWebhookHandler, verifyWebhook, verifyWebhookAsync };
+export { CallOptions, ClaimCurrencyInput, ClaimResult, ClaimTransferInput, ConfirmPaymentResult, CreateCheckoutInput, CreateCheckoutResult, GuardianApprovalStatusResult, InboundPendingQuery, InboundPendingResult, InitiateResult, InitiateSendInput, InitiateTransferInput, InvoError, InvoServer, type InvoWebhookEvent, ItemHistoryQuery, ItemHistoryResult, ItemOrderQuery, type ItemPurchasedData, LinkedIdentitiesQuery, LinkedIdentitiesResult, OrderDetailsResult, PlayerBalanceQuery, PlayerBalanceResult, PlayerToken, type PurchaseCompletedData, type PurchaseEventData, PurchaseInput, PurchaseItemInput, PurchaseItemResult, PurchaseResult, ServerConfig, SmsVerifyResult, TransactionStatusResult, type TransferEventData, type VerifyWebhookOptions, type WebhookHandlerOptions, createWebhookHandler, verifyWebhook, verifyWebhookAsync };

package/dist/server.js

@@ -1,5 +1,5 @@
-import { InvoError, assertSecureBaseUrl, Http } from './chunk-D3XBTH4C.js';
-export { InvoError } from './chunk-D3XBTH4C.js';
+import { InvoError, assertSecureBaseUrl, Http } from './chunk-ZVKWDXSL.js';
+export { InvoError } from './chunk-ZVKWDXSL.js';
 import { createHmac } from 'crypto';
 
 var DEFAULT_TOLERANCE_SEC = 300;
@@ -161,7 +161,7 @@ async function hmacHexSubtle(secret, message) {
 }
 
 // src/server.ts
-var DEFAULT_UA = "invonetwork-web-sdk/0.8.0 (+https://invo.network)";
+var DEFAULT_UA = "invonetwork-web-sdk/1.1.0 (+https://invo.network)";
 var MAX_USD_AMOUNT = 999.99;
 var MAX_ITEM_PRICE = 999999.99;
 function invalidInput(label, value, why) {
@@ -223,6 +223,57 @@ function toInboundPendingItem(row) {
     raw: row
   };
 }
+function toSmsVerifyResult(raw) {
+  return {
+    status: String(raw["status"] ?? ""),
+    transactionId: String(raw["transaction_id"] ?? ""),
+    claimCode: raw["claim_code"],
+    newBalance: raw["new_balance"] ?? null,
+    orderId: raw["order_id"],
+    raw
+  };
+}
+function toClaimResult(raw) {
+  const status = String(raw["status"] ?? "");
+  return {
+    status,
+    transactionId: raw["transaction_id"],
+    newBalance: raw["new_balance"] ?? null,
+    currencyName: raw["currency_name"],
+    orderId: raw["order_id"],
+    needsAccountSelection: status === "needs_account_selection",
+    candidates: Array.isArray(raw["candidates"]) ? raw["candidates"] : void 0,
+    raw
+  };
+}
+function toTransactionStatus(raw) {
+  return {
+    transactionId: String(raw["transaction_id"] ?? ""),
+    transactionType: String(raw["transaction_type"] ?? ""),
+    transactionStatus: String(raw["transaction_status"] ?? ""),
+    verificationState: String(raw["verification_state"] ?? ""),
+    amount: raw["amount"] ?? null,
+    netAmount: raw["net_amount"] ?? null,
+    currencyId: raw["currency_id"] ?? "",
+    orderId: raw["order_id"],
+    toPhone: raw["to_phone"],
+    toIdentityId: raw["to_identity_id"] ?? null,
+    raw
+  };
+}
+function toGuardianApprovalStatus(raw) {
+  const approval = raw["approval"] ?? {};
+  return {
+    state: String(approval["state"] ?? ""),
+    approvalId: approval["approval_id"],
+    transactionId: approval["transaction_id"],
+    expiresAt: approval["expires_at"],
+    decidedAt: approval["decided_at"],
+    decisionSource: approval["decision_source"],
+    actionDescription: approval["action_description"],
+    raw
+  };
+}
 function toCurrencyBalance(row) {
   return {
     currencyId: row["currency_id"] ?? "",
@@ -669,6 +720,132 @@ var InvoServer = class {
       raw
     };
   }
+  /**
+   * Complete a TRANSFER's SMS-PIN step (un-enrolled fallback). NOT idempotent —
+   * each attempt is counted server-side, so this is never auto-retried. A bad PIN
+   * throws a 400 InvoError carrying `attempts_remaining` on `err.body`; a blocked
+   * recipient throws 429 (`sms_verification_blocked`).
+   */
+  async verifySmsTransfer(transactionId, smsPin, opts) {
+    if (typeof transactionId !== "string" || !transactionId.trim()) {
+      throw invalidInput("transactionId", transactionId, "is required");
+    }
+    if (typeof smsPin !== "string" || !smsPin.trim()) {
+      throw invalidInput("smsPin", smsPin, "is required");
+    }
+    const raw = await this.http.post(
+      "/api/transfers/verify-sms",
+      { transaction_id: transactionId, sms_pin: smsPin },
+      this.auth,
+      { signal: opts?.signal }
+      // NOT idempotent — attempts are counted; never auto-retried
+    );
+    return toSmsVerifyResult(raw);
+  }
+  /** Complete a SEND's SMS-PIN step (un-enrolled fallback). See verifySmsTransfer. */
+  async verifySmsSend(transactionId, smsPin, opts) {
+    if (typeof transactionId !== "string" || !transactionId.trim()) {
+      throw invalidInput("transactionId", transactionId, "is required");
+    }
+    if (typeof smsPin !== "string" || !smsPin.trim()) {
+      throw invalidInput("smsPin", smsPin, "is required");
+    }
+    const raw = await this.http.post(
+      "/api/currency-sends/verify-sms",
+      { transaction_id: transactionId, sms_pin: smsPin },
+      this.auth,
+      { signal: opts?.signal }
+      // NOT idempotent — attempts are counted; never auto-retried
+    );
+    return toSmsVerifyResult(raw);
+  }
+  /**
+   * Claim an inbound TRANSFER by its claim code, crediting one of this game's currencies.
+   * NOT idempotent. A 200 may come back as `needsAccountSelection` (the recipient phone
+   * maps to >1 of your players) — inspect `result.candidates` and re-submit with
+   * `targetPlayerId`. Errors surface via InvoError (404 unknown code, 403 phone mismatch,
+   * 400 not-claimable/expired/wrong-value, 409 `err.isPhoneShareApprovalRequired`, …).
+   */
+  async claimTransfer(input, opts) {
+    const body = {
+      claim_code: input.claimCode,
+      target_player_name: input.targetPlayerName,
+      target_player_email: input.targetPlayerEmail,
+      target_player_phone: input.targetPlayerPhone,
+      target_currency_id: input.targetCurrencyId
+    };
+    if (input.targetPlayerId != null) body["target_player_id"] = input.targetPlayerId;
+    const raw = await this.http.post(
+      "/api/transfers/claim-transfer",
+      body,
+      this.auth,
+      { signal: opts?.signal }
+      // NOT idempotent — never auto-retried
+    );
+    return toClaimResult(raw);
+  }
+  /**
+   * Claim an inbound SEND by its claim code. NOT idempotent. May return
+   * `needsAccountSelection` (multi-account phone) — re-submit with `receiverPlayerId`.
+   * See claimTransfer for the error surface.
+   */
+  async claimCurrency(input, opts) {
+    const body = {
+      claim_code: input.claimCode,
+      receiver_player_name: input.receiverPlayerName,
+      receiver_player_email: input.receiverPlayerEmail,
+      receiver_player_phone: input.receiverPlayerPhone
+    };
+    if (input.receiverPlayerId != null) body["receiver_player_id"] = input.receiverPlayerId;
+    const raw = await this.http.post(
+      "/api/currency-sends/claim-currency",
+      body,
+      this.auth,
+      { signal: opts?.signal }
+      // NOT idempotent — never auto-retried
+    );
+    return toClaimResult(raw);
+  }
+  /** Read a TRANSFER's status (verification_state + amounts + destination). */
+  async getTransferStatus(transactionId, opts) {
+    if (typeof transactionId !== "string" || !transactionId.trim()) {
+      throw invalidInput("transactionId", transactionId, "is required");
+    }
+    const raw = await this.http.get(
+      `/api/transfers/${encodeURIComponent(transactionId)}/status`,
+      this.auth,
+      { signal: opts?.signal }
+    );
+    return toTransactionStatus(raw);
+  }
+  /** Read a SEND's status (adds fees, game names, claim_info, … on `raw`). */
+  async getSendStatus(transactionId, opts) {
+    if (typeof transactionId !== "string" || !transactionId.trim()) {
+      throw invalidInput("transactionId", transactionId, "is required");
+    }
+    const raw = await this.http.get(
+      `/api/currency-sends/${encodeURIComponent(transactionId)}/status`,
+      this.auth,
+      { signal: opts?.signal }
+    );
+    return toTransactionStatus(raw);
+  }
+  /**
+   * Poll a transaction's guardian approval status (minor/guardian flow). The retry
+   * layer already retries the 503 (`{status:"unavailable"}`) for this idempotent GET;
+   * a missing approval throws a 404 InvoError (`{status:"not_found"}`).
+   */
+  async getGuardianApprovalStatus(transactionId, opts) {
+    if (typeof transactionId !== "string" || !transactionId.trim()) {
+      throw invalidInput("transactionId", transactionId, "is required");
+    }
+    const raw = await this.http.get(
+      `/api/transactions/${encodeURIComponent(transactionId)}/approval-status`,
+      this.auth,
+      { signal: opts?.signal }
+    );
+    return toGuardianApprovalStatus(raw);
+  }
   toInitiateResult(raw) {
     const vm = raw["verification_method"];
     const guardian = raw["guardian_approval"];

package/dist/{types-DLSCxpoT.d.cts → types-CPt_5_Aw.d.cts}

@@ -37,6 +37,8 @@ declare class InvoError extends Error {
      * is a rate-limit, not a top-up condition) is NOT misclassified as this.
      */
     get isInsufficientBalance(): boolean;
+    /** True if a claim needs phone-share approval before it can complete (claim → 409). */
+    get isPhoneShareApprovalRequired(): boolean;
     /** True if an idempotency-keyed request was a duplicate (item purchase → 409). */
     get isDuplicateRequest(): boolean;
     /** Seconds to wait before retrying, when the backend throttled the call (429 `retry_after`). */
@@ -459,5 +461,79 @@ interface LinkDeviceResult {
     status: string;
     raw: Record<string, unknown>;
 }
+interface SmsVerifyResult {
+    /** "success" on a completed verification. */
+    status: string;
+    transactionId: string;
+    /** The recipient claim code, when the completion issued one. */
+    claimCode?: string;
+    /** Canonical balance AFTER completion, when the backend returned it. */
+    newBalance?: string | number | null;
+    orderId?: string;
+    raw: Record<string, unknown>;
+}
+interface ClaimTransferInput {
+    claimCode: string;
+    targetPlayerName: string;
+    targetPlayerEmail: string;
+    targetPlayerPhone: string;
+    /** Which of this game's currencies to credit. */
+    targetCurrencyId: string | number;
+    /** Re-submit with this after a `needsAccountSelection` result to disambiguate a
+     *  phone that maps to more than one of your players. */
+    targetPlayerId?: string | number;
+}
+interface ClaimCurrencyInput {
+    claimCode: string;
+    receiverPlayerName: string;
+    receiverPlayerEmail: string;
+    receiverPlayerPhone: string;
+    /** Re-submit with this after a `needsAccountSelection` result (multi-account phone). */
+    receiverPlayerId?: string | number;
+}
+interface ClaimResult {
+    /** "success" on completion, or "needs_account_selection" (see `needsAccountSelection`). */
+    status: string;
+    transactionId?: string;
+    newBalance?: string | number | null;
+    currencyName?: string;
+    orderId?: string;
+    /**
+     * true when a 200 came back as `status:"needs_account_selection"` (the recipient
+     * phone maps to more than one of your players). NOT an error — re-submit the claim
+     * with `targetPlayerId` (transfer) / `receiverPlayerId` (send) from `candidates`.
+     */
+    needsAccountSelection: boolean;
+    /** Candidate accounts to disambiguate, present on a `needsAccountSelection` result. */
+    candidates?: Record<string, unknown>[];
+    raw: Record<string, unknown>;
+}
+/** `verification_state` ∈ awaiting | approved | completed | expired | failed | unknown. */
+interface TransactionStatusResult {
+    transactionId: string;
+    /** "transfer" | "send". */
+    transactionType: string;
+    transactionStatus: string;
+    verificationState: string;
+    amount: string | number | null;
+    netAmount: string | number | null;
+    currencyId: string | number;
+    orderId?: string;
+    toPhone?: string;
+    toIdentityId?: string | null;
+    /** Everything else (send fees, game names, claim_info, failure_reason, sender claim_code, …). */
+    raw: Record<string, unknown>;
+}
+/** `state` ∈ pending | approved | rejected | expired. */
+interface GuardianApprovalStatusResult {
+    state: string;
+    approvalId?: string;
+    transactionId?: string;
+    expiresAt?: string;
+    decidedAt?: string;
+    decisionSource?: string;
+    actionDescription?: string;
+    raw: Record<string, unknown>;
+}
 
-export { type ApproveResult as A, type BalanceResult as B, type ClientConfig as C, type DestinationsQuery as D, type EnrollmentBeginResult as E, type PlayerBalanceResult as F, type InboundPendingQuery as G, type InboundPendingResult as H, InvoError as I, type LinkedIdentitiesQuery as J, type LinkedIdentitiesResult as K, type LinkDeviceResult as L, type CurrencyBalance as M, type InboundPendingItem as N, type OrderDetailsResult as O, type PendingCollectResult as P, type LinkedIdentityEmail as Q, type Rail as R, type ServerConfig as S, type VerificationMethod as V, type CallOptions as a, type ConfirmReceiptResult as b, type DestinationsResult as c, type EnrollmentVerifyResult as d, type BalanceRow as e, type DestinationGame as f, type InvoErrorInfo as g, type InvoHooks as h, type InvoRequestInfo as i, type InvoResponseInfo as j, type PendingCollectItem as k, type PlayerToken as l, type InitiateSendInput as m, type InitiateResult as n, type InitiateTransferInput as o, type CreateCheckoutInput as p, type CreateCheckoutResult as q, type PurchaseInput as r, type PurchaseResult as s, type ConfirmPaymentResult as t, type PurchaseItemInput as u, type PurchaseItemResult as v, type ItemHistoryQuery as w, type ItemHistoryResult as x, type ItemOrderQuery as y, type PlayerBalanceQuery as z };
+export { type ApproveResult as A, type BalanceResult as B, type ClientConfig as C, type DestinationsQuery as D, type EnrollmentBeginResult as E, type PlayerBalanceResult as F, type InboundPendingQuery as G, type InboundPendingResult as H, InvoError as I, type LinkedIdentitiesQuery as J, type LinkedIdentitiesResult as K, type LinkDeviceResult as L, type SmsVerifyResult as M, type ClaimTransferInput as N, type OrderDetailsResult as O, type PendingCollectResult as P, type ClaimResult as Q, type Rail as R, type ServerConfig as S, type ClaimCurrencyInput as T, type TransactionStatusResult as U, type VerificationMethod as V, type GuardianApprovalStatusResult as W, type CurrencyBalance as X, type InboundPendingItem as Y, type LinkedIdentityEmail as Z, type CallOptions as a, type ConfirmReceiptResult as b, type DestinationsResult as c, type EnrollmentVerifyResult as d, type BalanceRow as e, type DestinationGame as f, type InvoErrorInfo as g, type InvoHooks as h, type InvoRequestInfo as i, type InvoResponseInfo as j, type PendingCollectItem as k, type PlayerToken as l, type InitiateSendInput as m, type InitiateResult as n, type InitiateTransferInput as o, type CreateCheckoutInput as p, type CreateCheckoutResult as q, type PurchaseInput as r, type PurchaseResult as s, type ConfirmPaymentResult as t, type PurchaseItemInput as u, type PurchaseItemResult as v, type ItemHistoryQuery as w, type ItemHistoryResult as x, type ItemOrderQuery as y, type PlayerBalanceQuery as z };