@invonetwork/web-sdk 1.0.0 → 1.2.0

package/dist/server.cjs

@@ -40,6 +40,14 @@ var InvoError = class _InvoError extends Error {
     const b = this.bodyObject();
     return this.code === "INSUFFICIENT_BALANCE" || "required_amount" in b || /insufficient[_ ]balance/i.test(this.message);
   }
+  /** True if a claim needs phone-share approval before it can complete (claim → 409). */
+  get isPhoneShareApprovalRequired() {
+    return this.code === "PHONE_SHARE_APPROVAL_REQUIRED";
+  }
+  /** True if the phone-share (phone, requesting_email) pair was already approved. */
+  get isPhoneShareAlreadyApproved() {
+    return this.code === "PHONE_SHARE_ALREADY_APPROVED";
+  }
   /** True if an idempotency-keyed request was a duplicate (item purchase → 409). */
   get isDuplicateRequest() {
     return this.code === "DUPLICATE_REQUEST" || this.status === 409 && /duplicate/i.test(this.message);
@@ -259,6 +267,49 @@ function retryAfterMs(parsed, headers) {
   }
   return void 0;
 }
+
+// src/shared/destinations.ts
+function toDestinationGame(row) {
+  const s = (k) => row[k] === void 0 || row[k] === null ? void 0 : String(row[k]);
+  return {
+    gameId: row["game_id"] ?? "",
+    gameName: String(row["game_name"] ?? ""),
+    tenantType: s("tenant_type"),
+    developerName: s("developer_name"),
+    publisherName: s("publisher_name"),
+    genre: s("genre"),
+    platform: s("platform"),
+    gameStatus: s("game_status"),
+    gameIcon: s("game_icon"),
+    gamePoster: s("game_poster"),
+    gameUrl: s("game_url"),
+    gameDescription: s("game_description"),
+    currencyName: String(row["currency_name"] ?? ""),
+    currencySymbol: String(row["currency_symbol"] ?? ""),
+    currencySymbolUrl: s("currency_symbol_url"),
+    minimumTransfer: String(row["minimum_transfer"] ?? ""),
+    maximumTransfer: String(row["maximum_transfer"] ?? ""),
+    raw: row
+  };
+}
+function toDestinationsResult(raw, direction) {
+  const games = Array.isArray(raw["available_games"]) ? raw["available_games"] : [];
+  return {
+    status: String(raw["status"] ?? ""),
+    sourceGameId: raw["source_game_id"] ?? "",
+    sourceGameName: String(raw["source_game_name"] ?? ""),
+    sourceGameIcon: raw["source_game_icon"],
+    sourceCurrencyName: String(raw["source_currency_name"] ?? ""),
+    sourceCurrencyIcon: raw["source_currency_icon"],
+    universalTransfers: raw["universal_transfers"] === true,
+    transferMode: String(raw["transfer_mode"] ?? ""),
+    availableGames: games.map(toDestinationGame),
+    totalDestinations: Number(raw["total_destinations"] ?? games.length),
+    direction: String(raw["direction"] ?? direction),
+    linkedGameIds: Array.isArray(raw["linked_game_ids"]) ? raw["linked_game_ids"] : void 0,
+    raw
+  };
+}
 var DEFAULT_TOLERANCE_SEC = 300;
 var ENCODER = new TextEncoder();
 function toBytes(body) {
@@ -418,7 +469,7 @@ async function hmacHexSubtle(secret, message) {
 }
 
 // src/server.ts
-var DEFAULT_UA = "invonetwork-web-sdk/1.0.0 (+https://invo.network)";
+var DEFAULT_UA = "invonetwork-web-sdk/1.2.0 (+https://invo.network)";
 var MAX_USD_AMOUNT = 999.99;
 var MAX_ITEM_PRICE = 999999.99;
 function invalidInput(label, value, why) {
@@ -480,6 +531,75 @@ function toInboundPendingItem(row) {
     raw: row
   };
 }
+function toSmsVerifyResult(raw) {
+  return {
+    status: String(raw["status"] ?? ""),
+    transactionId: String(raw["transaction_id"] ?? ""),
+    claimCode: raw["claim_code"],
+    newBalance: raw["new_balance"] ?? null,
+    orderId: raw["order_id"],
+    raw
+  };
+}
+function toClaimResult(raw) {
+  const status = String(raw["status"] ?? "");
+  return {
+    status,
+    transactionId: raw["transaction_id"],
+    newBalance: raw["new_balance"] ?? null,
+    currencyName: raw["currency_name"],
+    orderId: raw["order_id"],
+    needsAccountSelection: status === "needs_account_selection",
+    candidates: Array.isArray(raw["candidates"]) ? raw["candidates"] : void 0,
+    raw
+  };
+}
+function toTransactionStatus(raw) {
+  return {
+    transactionId: String(raw["transaction_id"] ?? ""),
+    transactionType: String(raw["transaction_type"] ?? ""),
+    transactionStatus: String(raw["transaction_status"] ?? ""),
+    verificationState: String(raw["verification_state"] ?? ""),
+    amount: raw["amount"] ?? null,
+    netAmount: raw["net_amount"] ?? null,
+    currencyId: raw["currency_id"] ?? "",
+    orderId: raw["order_id"],
+    toPhone: raw["to_phone"],
+    toIdentityId: raw["to_identity_id"] ?? null,
+    raw
+  };
+}
+function toGuardianApprovalStatus(raw) {
+  const approval = raw["approval"] ?? {};
+  return {
+    state: String(approval["state"] ?? ""),
+    approvalId: approval["approval_id"],
+    transactionId: approval["transaction_id"],
+    expiresAt: approval["expires_at"],
+    decidedAt: approval["decided_at"],
+    decisionSource: approval["decision_source"],
+    actionDescription: approval["action_description"],
+    raw
+  };
+}
+function toPhoneShareInitiateResult(raw) {
+  return {
+    approvalId: raw["approval_id"],
+    codeSent: typeof raw["code_sent"] === "boolean" ? raw["code_sent"] : void 0,
+    expiresAt: raw["expires_at"],
+    alreadyApproved: typeof raw["already_approved"] === "boolean" ? raw["already_approved"] : void 0,
+    raw
+  };
+}
+function toPhoneShareApproveResult(raw) {
+  return {
+    approvalId: raw["approval_id"],
+    approved: typeof raw["approved"] === "boolean" ? raw["approved"] : void 0,
+    alreadyApproved: typeof raw["already_approved"] === "boolean" ? raw["already_approved"] : void 0,
+    expiresAt: raw["expires_at"],
+    raw
+  };
+}
 function toCurrencyBalance(row) {
   return {
     currencyId: row["currency_id"] ?? "",
@@ -926,6 +1046,227 @@ var InvoServer = class {
       raw
     };
   }
+  /**
+   * Complete a TRANSFER's SMS-PIN step (un-enrolled fallback). NOT idempotent —
+   * each attempt is counted server-side, so this is never auto-retried. A bad PIN
+   * throws a 400 InvoError carrying `attempts_remaining` on `err.body`; a blocked
+   * recipient throws 429 (`sms_verification_blocked`).
+   */
+  async verifySmsTransfer(transactionId, smsPin, opts) {
+    if (typeof transactionId !== "string" || !transactionId.trim()) {
+      throw invalidInput("transactionId", transactionId, "is required");
+    }
+    if (typeof smsPin !== "string" || !smsPin.trim()) {
+      throw invalidInput("smsPin", smsPin, "is required");
+    }
+    const raw = await this.http.post(
+      "/api/transfers/verify-sms",
+      { transaction_id: transactionId, sms_pin: smsPin },
+      this.auth,
+      { signal: opts?.signal }
+      // NOT idempotent — attempts are counted; never auto-retried
+    );
+    return toSmsVerifyResult(raw);
+  }
+  /** Complete a SEND's SMS-PIN step (un-enrolled fallback). See verifySmsTransfer. */
+  async verifySmsSend(transactionId, smsPin, opts) {
+    if (typeof transactionId !== "string" || !transactionId.trim()) {
+      throw invalidInput("transactionId", transactionId, "is required");
+    }
+    if (typeof smsPin !== "string" || !smsPin.trim()) {
+      throw invalidInput("smsPin", smsPin, "is required");
+    }
+    const raw = await this.http.post(
+      "/api/currency-sends/verify-sms",
+      { transaction_id: transactionId, sms_pin: smsPin },
+      this.auth,
+      { signal: opts?.signal }
+      // NOT idempotent — attempts are counted; never auto-retried
+    );
+    return toSmsVerifyResult(raw);
+  }
+  /**
+   * Claim an inbound TRANSFER by its claim code, crediting one of this game's currencies.
+   * NOT idempotent. A 200 may come back as `needsAccountSelection` (the recipient phone
+   * maps to >1 of your players) — inspect `result.candidates` and re-submit with
+   * `targetPlayerId`. Errors surface via InvoError (404 unknown code, 403 phone mismatch,
+   * 400 not-claimable/expired/wrong-value, 409 `err.isPhoneShareApprovalRequired`, …).
+   */
+  async claimTransfer(input, opts) {
+    const body = {
+      claim_code: input.claimCode,
+      target_player_name: input.targetPlayerName,
+      target_player_email: input.targetPlayerEmail,
+      target_player_phone: input.targetPlayerPhone,
+      target_currency_id: input.targetCurrencyId
+    };
+    if (input.targetPlayerId != null) body["target_player_id"] = input.targetPlayerId;
+    const raw = await this.http.post(
+      "/api/transfers/claim-transfer",
+      body,
+      this.auth,
+      { signal: opts?.signal }
+      // NOT idempotent — never auto-retried
+    );
+    return toClaimResult(raw);
+  }
+  /**
+   * Claim an inbound SEND by its claim code. NOT idempotent. May return
+   * `needsAccountSelection` (multi-account phone) — re-submit with `receiverPlayerId`.
+   * See claimTransfer for the error surface.
+   */
+  async claimCurrency(input, opts) {
+    const body = {
+      claim_code: input.claimCode,
+      receiver_player_name: input.receiverPlayerName,
+      receiver_player_email: input.receiverPlayerEmail,
+      receiver_player_phone: input.receiverPlayerPhone
+    };
+    if (input.receiverPlayerId != null) body["receiver_player_id"] = input.receiverPlayerId;
+    const raw = await this.http.post(
+      "/api/currency-sends/claim-currency",
+      body,
+      this.auth,
+      { signal: opts?.signal }
+      // NOT idempotent — never auto-retried
+    );
+    return toClaimResult(raw);
+  }
+  /** Read a TRANSFER's status (verification_state + amounts + destination). */
+  async getTransferStatus(transactionId, opts) {
+    if (typeof transactionId !== "string" || !transactionId.trim()) {
+      throw invalidInput("transactionId", transactionId, "is required");
+    }
+    const raw = await this.http.get(
+      `/api/transfers/${encodeURIComponent(transactionId)}/status`,
+      this.auth,
+      { signal: opts?.signal }
+    );
+    return toTransactionStatus(raw);
+  }
+  /** Read a SEND's status (adds fees, game names, claim_info, … on `raw`). */
+  async getSendStatus(transactionId, opts) {
+    if (typeof transactionId !== "string" || !transactionId.trim()) {
+      throw invalidInput("transactionId", transactionId, "is required");
+    }
+    const raw = await this.http.get(
+      `/api/currency-sends/${encodeURIComponent(transactionId)}/status`,
+      this.auth,
+      { signal: opts?.signal }
+    );
+    return toTransactionStatus(raw);
+  }
+  /**
+   * Poll a transaction's guardian approval status (minor/guardian flow). The retry
+   * layer already retries the 503 (`{status:"unavailable"}`) for this idempotent GET;
+   * a missing approval throws a 404 InvoError (`{status:"not_found"}`).
+   */
+  async getGuardianApprovalStatus(transactionId, opts) {
+    if (typeof transactionId !== "string" || !transactionId.trim()) {
+      throw invalidInput("transactionId", transactionId, "is required");
+    }
+    const raw = await this.http.get(
+      `/api/transactions/${encodeURIComponent(transactionId)}/approval-status`,
+      this.auth,
+      { signal: opts?.signal }
+    );
+    return toGuardianApprovalStatus(raw);
+  }
+  /**
+   * List the games/tenants a player can send/transfer to FROM `sourceGameId`, with
+   * display metadata inline (name, icon, currency, min/max limits) — one call, no
+   * per-game lookup. SERVER variant (game-secret) of the browser `InvoClient.getDestinations`;
+   * the source game is passed explicitly rather than inferred from a player token. Rows
+   * share the browser shape. Idempotent (a POST read — safe to retry).
+   */
+  async getDestinations(query, opts) {
+    if (query.sourceGameId == null || String(query.sourceGameId).trim() === "") {
+      throw invalidInput("sourceGameId", query.sourceGameId, "is required");
+    }
+    const direction = query.direction ?? "transfer";
+    const path = direction === "send" ? "/api/currency-sends/available-destinations" : "/api/transfers/available-destinations";
+    const raw = await this.http.post(
+      path,
+      { source_game_id: query.sourceGameId },
+      this.auth,
+      { idempotent: true, signal: opts?.signal }
+      // a POST read — no side effect, safe to retry
+    );
+    return toDestinationsResult(raw, direction);
+  }
+  /**
+   * Phone-share OTP handshake — resolves a 409 `PHONE_SHARE_APPROVAL_REQUIRED`.
+   *
+   * These three endpoints are UNAUTHENTICATED (phone-owner-driven: no game secret,
+   * no player token) — a partner backend relays the handshake. The triggering 409
+   * carries `approval_id, expires_at, code_sent, existing_account_hints[], next_endpoint`.
+   *
+   * `phoneShareInitiate` is the fallback OTP send (use when the 409 didn't already
+   * dispatch a code). NOT idempotent — never auto-retried. OTP TTL ~10 min.
+   */
+  async phoneShareInitiate(input, opts) {
+    if (typeof input.phone !== "string" || !input.phone.trim()) {
+      throw invalidInput("phone", input.phone, "is required");
+    }
+    if (typeof input.email !== "string" || !input.email.trim()) {
+      throw invalidInput("email", input.email, "is required");
+    }
+    const raw = await this.http.post(
+      "/api/wallet/phone-share/initiate",
+      { phone: input.phone, email: input.email },
+      { kind: "none" },
+      // UNAUTHENTICATED — phone-owner-driven; send no auth header
+      { signal: opts?.signal }
+      // NOT idempotent — sends an OTP; never auto-retried
+    );
+    return toPhoneShareInitiateResult(raw);
+  }
+  /**
+   * Approve a phone-share with the OTP the phone owner received. On success the grant
+   * is stored server-side, keyed by (phone, requesting_email) and auto-consumed — the
+   * caller simply RE-ISSUES the identical original request. UNAUTHENTICATED. NOT
+   * idempotent (attempts are counted) — never auto-retried.
+   */
+  async phoneShareApprove(input, opts) {
+    if (typeof input.approvalId !== "string" || !input.approvalId.trim()) {
+      throw invalidInput("approvalId", input.approvalId, "is required");
+    }
+    if (typeof input.otp !== "string" || !input.otp.trim()) {
+      throw invalidInput("otp", input.otp, "is required");
+    }
+    const raw = await this.http.post(
+      "/api/wallet/phone-share/approve",
+      { approval_id: input.approvalId, otp: input.otp },
+      { kind: "none" },
+      // UNAUTHENTICATED — phone-owner-driven; send no auth header
+      { signal: opts?.signal }
+      // NOT idempotent — OTP attempts are counted; never auto-retried
+    );
+    return toPhoneShareApproveResult(raw);
+  }
+  /**
+   * Poll whether a phone-share (phone, requesting_email) pair is approved yet.
+   * UNAUTHENTICATED, idempotent GET. `approved:true` means the original request can
+   * be re-issued.
+   */
+  async phoneShareStatus(input, opts) {
+    if (typeof input.phone !== "string" || !input.phone.trim()) {
+      throw invalidInput("phone", input.phone, "is required");
+    }
+    if (typeof input.email !== "string" || !input.email.trim()) {
+      throw invalidInput("email", input.email, "is required");
+    }
+    const q = new URLSearchParams();
+    q.set("phone", input.phone);
+    q.set("email", input.email);
+    const raw = await this.http.get(
+      `/api/wallet/phone-share/status?${q.toString()}`,
+      { kind: "none" },
+      // UNAUTHENTICATED — phone-owner-driven; send no auth header
+      { signal: opts?.signal }
+    );
+    return { approved: raw["approved"] === true, raw };
+  }
   toInitiateResult(raw) {
     const vm = raw["verification_method"];
     const guardian = raw["guardian_approval"];

package/dist/server.d.cts

@@ -1,5 +1,5 @@
-import { I as InvoError, S as ServerConfig, a as CallOptions, l as PlayerToken, m as InitiateSendInput, n as InitiateResult, o as InitiateTransferInput, p as CreateCheckoutInput, q as CreateCheckoutResult, r as PurchaseInput, s as PurchaseResult, t as ConfirmPaymentResult, O as OrderDetailsResult, u as PurchaseItemInput, v as PurchaseItemResult, w as ItemHistoryQuery, x as ItemHistoryResult, y as ItemOrderQuery, z as PlayerBalanceQuery, F as PlayerBalanceResult, G as InboundPendingQuery, H as InboundPendingResult, J as LinkedIdentitiesQuery, K as LinkedIdentitiesResult } from './types-DLSCxpoT.cjs';
-export { M as CurrencyBalance, N as InboundPendingItem, g as InvoErrorInfo, h as InvoHooks, i as InvoRequestInfo, j as InvoResponseInfo, Q as LinkedIdentityEmail, R as Rail, V as VerificationMethod } from './types-DLSCxpoT.cjs';
+import { I as InvoError, S as ServerConfig, a as CallOptions, l as PlayerToken, m as InitiateSendInput, n as InitiateResult, o as InitiateTransferInput, p as CreateCheckoutInput, q as CreateCheckoutResult, r as PurchaseInput, s as PurchaseResult, t as ConfirmPaymentResult, O as OrderDetailsResult, u as PurchaseItemInput, v as PurchaseItemResult, w as ItemHistoryQuery, x as ItemHistoryResult, y as ItemOrderQuery, z as PlayerBalanceQuery, F as PlayerBalanceResult, G as InboundPendingQuery, H as InboundPendingResult, J as LinkedIdentitiesQuery, K as LinkedIdentitiesResult, M as SmsVerifyResult, N as ClaimTransferInput, Q as ClaimResult, T as ClaimCurrencyInput, U as TransactionStatusResult, W as GuardianApprovalStatusResult, X as ServerDestinationsQuery, c as DestinationsResult, Y as PhoneShareContact, Z as PhoneShareInitiateResult, _ as PhoneShareApproveInput, $ as PhoneShareApproveResult, a0 as PhoneShareStatusResult } from './types-DTAmriOB.cjs';
+export { a1 as CurrencyBalance, f as DestinationGame, a2 as InboundPendingItem, g as InvoErrorInfo, h as InvoHooks, i as InvoRequestInfo, j as InvoResponseInfo, a3 as LinkedIdentityEmail, R as Rail, V as VerificationMethod } from './types-DTAmriOB.cjs';
 
 interface VerifyWebhookOptions {
     /** Max age of the signed timestamp, in seconds. Default 300 (5 min). */
@@ -225,7 +225,72 @@ declare class InvoServer {
      * ⚠️ Returns first-party PII (emails/phones) — never expose this to the browser.
      */
     getLinkedIdentities(query: LinkedIdentitiesQuery, opts?: CallOptions): Promise<LinkedIdentitiesResult>;
+    /**
+     * Complete a TRANSFER's SMS-PIN step (un-enrolled fallback). NOT idempotent —
+     * each attempt is counted server-side, so this is never auto-retried. A bad PIN
+     * throws a 400 InvoError carrying `attempts_remaining` on `err.body`; a blocked
+     * recipient throws 429 (`sms_verification_blocked`).
+     */
+    verifySmsTransfer(transactionId: string, smsPin: string, opts?: CallOptions): Promise<SmsVerifyResult>;
+    /** Complete a SEND's SMS-PIN step (un-enrolled fallback). See verifySmsTransfer. */
+    verifySmsSend(transactionId: string, smsPin: string, opts?: CallOptions): Promise<SmsVerifyResult>;
+    /**
+     * Claim an inbound TRANSFER by its claim code, crediting one of this game's currencies.
+     * NOT idempotent. A 200 may come back as `needsAccountSelection` (the recipient phone
+     * maps to >1 of your players) — inspect `result.candidates` and re-submit with
+     * `targetPlayerId`. Errors surface via InvoError (404 unknown code, 403 phone mismatch,
+     * 400 not-claimable/expired/wrong-value, 409 `err.isPhoneShareApprovalRequired`, …).
+     */
+    claimTransfer(input: ClaimTransferInput, opts?: CallOptions): Promise<ClaimResult>;
+    /**
+     * Claim an inbound SEND by its claim code. NOT idempotent. May return
+     * `needsAccountSelection` (multi-account phone) — re-submit with `receiverPlayerId`.
+     * See claimTransfer for the error surface.
+     */
+    claimCurrency(input: ClaimCurrencyInput, opts?: CallOptions): Promise<ClaimResult>;
+    /** Read a TRANSFER's status (verification_state + amounts + destination). */
+    getTransferStatus(transactionId: string, opts?: CallOptions): Promise<TransactionStatusResult>;
+    /** Read a SEND's status (adds fees, game names, claim_info, … on `raw`). */
+    getSendStatus(transactionId: string, opts?: CallOptions): Promise<TransactionStatusResult>;
+    /**
+     * Poll a transaction's guardian approval status (minor/guardian flow). The retry
+     * layer already retries the 503 (`{status:"unavailable"}`) for this idempotent GET;
+     * a missing approval throws a 404 InvoError (`{status:"not_found"}`).
+     */
+    getGuardianApprovalStatus(transactionId: string, opts?: CallOptions): Promise<GuardianApprovalStatusResult>;
+    /**
+     * List the games/tenants a player can send/transfer to FROM `sourceGameId`, with
+     * display metadata inline (name, icon, currency, min/max limits) — one call, no
+     * per-game lookup. SERVER variant (game-secret) of the browser `InvoClient.getDestinations`;
+     * the source game is passed explicitly rather than inferred from a player token. Rows
+     * share the browser shape. Idempotent (a POST read — safe to retry).
+     */
+    getDestinations(query: ServerDestinationsQuery, opts?: CallOptions): Promise<DestinationsResult>;
+    /**
+     * Phone-share OTP handshake — resolves a 409 `PHONE_SHARE_APPROVAL_REQUIRED`.
+     *
+     * These three endpoints are UNAUTHENTICATED (phone-owner-driven: no game secret,
+     * no player token) — a partner backend relays the handshake. The triggering 409
+     * carries `approval_id, expires_at, code_sent, existing_account_hints[], next_endpoint`.
+     *
+     * `phoneShareInitiate` is the fallback OTP send (use when the 409 didn't already
+     * dispatch a code). NOT idempotent — never auto-retried. OTP TTL ~10 min.
+     */
+    phoneShareInitiate(input: PhoneShareContact, opts?: CallOptions): Promise<PhoneShareInitiateResult>;
+    /**
+     * Approve a phone-share with the OTP the phone owner received. On success the grant
+     * is stored server-side, keyed by (phone, requesting_email) and auto-consumed — the
+     * caller simply RE-ISSUES the identical original request. UNAUTHENTICATED. NOT
+     * idempotent (attempts are counted) — never auto-retried.
+     */
+    phoneShareApprove(input: PhoneShareApproveInput, opts?: CallOptions): Promise<PhoneShareApproveResult>;
+    /**
+     * Poll whether a phone-share (phone, requesting_email) pair is approved yet.
+     * UNAUTHENTICATED, idempotent GET. `approved:true` means the original request can
+     * be re-issued.
+     */
+    phoneShareStatus(input: PhoneShareContact, opts?: CallOptions): Promise<PhoneShareStatusResult>;
     private toInitiateResult;
 }
 
-export { CallOptions, ConfirmPaymentResult, CreateCheckoutInput, CreateCheckoutResult, InboundPendingQuery, InboundPendingResult, InitiateResult, InitiateSendInput, InitiateTransferInput, InvoError, InvoServer, type InvoWebhookEvent, ItemHistoryQuery, ItemHistoryResult, ItemOrderQuery, type ItemPurchasedData, LinkedIdentitiesQuery, LinkedIdentitiesResult, OrderDetailsResult, PlayerBalanceQuery, PlayerBalanceResult, PlayerToken, type PurchaseCompletedData, type PurchaseEventData, PurchaseInput, PurchaseItemInput, PurchaseItemResult, PurchaseResult, ServerConfig, type TransferEventData, type VerifyWebhookOptions, type WebhookHandlerOptions, createWebhookHandler, verifyWebhook, verifyWebhookAsync };
+export { CallOptions, ClaimCurrencyInput, ClaimResult, ClaimTransferInput, ConfirmPaymentResult, CreateCheckoutInput, CreateCheckoutResult, DestinationsResult, GuardianApprovalStatusResult, InboundPendingQuery, InboundPendingResult, InitiateResult, InitiateSendInput, InitiateTransferInput, InvoError, InvoServer, type InvoWebhookEvent, ItemHistoryQuery, ItemHistoryResult, ItemOrderQuery, type ItemPurchasedData, LinkedIdentitiesQuery, LinkedIdentitiesResult, OrderDetailsResult, PhoneShareApproveInput, PhoneShareApproveResult, PhoneShareContact, PhoneShareInitiateResult, PhoneShareStatusResult, PlayerBalanceQuery, PlayerBalanceResult, PlayerToken, type PurchaseCompletedData, type PurchaseEventData, PurchaseInput, PurchaseItemInput, PurchaseItemResult, PurchaseResult, ServerConfig, ServerDestinationsQuery, SmsVerifyResult, TransactionStatusResult, type TransferEventData, type VerifyWebhookOptions, type WebhookHandlerOptions, createWebhookHandler, verifyWebhook, verifyWebhookAsync };

package/dist/server.d.ts

@@ -1,5 +1,5 @@
-import { I as InvoError, S as ServerConfig, a as CallOptions, l as PlayerToken, m as InitiateSendInput, n as InitiateResult, o as InitiateTransferInput, p as CreateCheckoutInput, q as CreateCheckoutResult, r as PurchaseInput, s as PurchaseResult, t as ConfirmPaymentResult, O as OrderDetailsResult, u as PurchaseItemInput, v as PurchaseItemResult, w as ItemHistoryQuery, x as ItemHistoryResult, y as ItemOrderQuery, z as PlayerBalanceQuery, F as PlayerBalanceResult, G as InboundPendingQuery, H as InboundPendingResult, J as LinkedIdentitiesQuery, K as LinkedIdentitiesResult } from './types-DLSCxpoT.js';
-export { M as CurrencyBalance, N as InboundPendingItem, g as InvoErrorInfo, h as InvoHooks, i as InvoRequestInfo, j as InvoResponseInfo, Q as LinkedIdentityEmail, R as Rail, V as VerificationMethod } from './types-DLSCxpoT.js';
+import { I as InvoError, S as ServerConfig, a as CallOptions, l as PlayerToken, m as InitiateSendInput, n as InitiateResult, o as InitiateTransferInput, p as CreateCheckoutInput, q as CreateCheckoutResult, r as PurchaseInput, s as PurchaseResult, t as ConfirmPaymentResult, O as OrderDetailsResult, u as PurchaseItemInput, v as PurchaseItemResult, w as ItemHistoryQuery, x as ItemHistoryResult, y as ItemOrderQuery, z as PlayerBalanceQuery, F as PlayerBalanceResult, G as InboundPendingQuery, H as InboundPendingResult, J as LinkedIdentitiesQuery, K as LinkedIdentitiesResult, M as SmsVerifyResult, N as ClaimTransferInput, Q as ClaimResult, T as ClaimCurrencyInput, U as TransactionStatusResult, W as GuardianApprovalStatusResult, X as ServerDestinationsQuery, c as DestinationsResult, Y as PhoneShareContact, Z as PhoneShareInitiateResult, _ as PhoneShareApproveInput, $ as PhoneShareApproveResult, a0 as PhoneShareStatusResult } from './types-DTAmriOB.js';
+export { a1 as CurrencyBalance, f as DestinationGame, a2 as InboundPendingItem, g as InvoErrorInfo, h as InvoHooks, i as InvoRequestInfo, j as InvoResponseInfo, a3 as LinkedIdentityEmail, R as Rail, V as VerificationMethod } from './types-DTAmriOB.js';
 
 interface VerifyWebhookOptions {
     /** Max age of the signed timestamp, in seconds. Default 300 (5 min). */
@@ -225,7 +225,72 @@ declare class InvoServer {
      * ⚠️ Returns first-party PII (emails/phones) — never expose this to the browser.
      */
     getLinkedIdentities(query: LinkedIdentitiesQuery, opts?: CallOptions): Promise<LinkedIdentitiesResult>;
+    /**
+     * Complete a TRANSFER's SMS-PIN step (un-enrolled fallback). NOT idempotent —
+     * each attempt is counted server-side, so this is never auto-retried. A bad PIN
+     * throws a 400 InvoError carrying `attempts_remaining` on `err.body`; a blocked
+     * recipient throws 429 (`sms_verification_blocked`).
+     */
+    verifySmsTransfer(transactionId: string, smsPin: string, opts?: CallOptions): Promise<SmsVerifyResult>;
+    /** Complete a SEND's SMS-PIN step (un-enrolled fallback). See verifySmsTransfer. */
+    verifySmsSend(transactionId: string, smsPin: string, opts?: CallOptions): Promise<SmsVerifyResult>;
+    /**
+     * Claim an inbound TRANSFER by its claim code, crediting one of this game's currencies.
+     * NOT idempotent. A 200 may come back as `needsAccountSelection` (the recipient phone
+     * maps to >1 of your players) — inspect `result.candidates` and re-submit with
+     * `targetPlayerId`. Errors surface via InvoError (404 unknown code, 403 phone mismatch,
+     * 400 not-claimable/expired/wrong-value, 409 `err.isPhoneShareApprovalRequired`, …).
+     */
+    claimTransfer(input: ClaimTransferInput, opts?: CallOptions): Promise<ClaimResult>;
+    /**
+     * Claim an inbound SEND by its claim code. NOT idempotent. May return
+     * `needsAccountSelection` (multi-account phone) — re-submit with `receiverPlayerId`.
+     * See claimTransfer for the error surface.
+     */
+    claimCurrency(input: ClaimCurrencyInput, opts?: CallOptions): Promise<ClaimResult>;
+    /** Read a TRANSFER's status (verification_state + amounts + destination). */
+    getTransferStatus(transactionId: string, opts?: CallOptions): Promise<TransactionStatusResult>;
+    /** Read a SEND's status (adds fees, game names, claim_info, … on `raw`). */
+    getSendStatus(transactionId: string, opts?: CallOptions): Promise<TransactionStatusResult>;
+    /**
+     * Poll a transaction's guardian approval status (minor/guardian flow). The retry
+     * layer already retries the 503 (`{status:"unavailable"}`) for this idempotent GET;
+     * a missing approval throws a 404 InvoError (`{status:"not_found"}`).
+     */
+    getGuardianApprovalStatus(transactionId: string, opts?: CallOptions): Promise<GuardianApprovalStatusResult>;
+    /**
+     * List the games/tenants a player can send/transfer to FROM `sourceGameId`, with
+     * display metadata inline (name, icon, currency, min/max limits) — one call, no
+     * per-game lookup. SERVER variant (game-secret) of the browser `InvoClient.getDestinations`;
+     * the source game is passed explicitly rather than inferred from a player token. Rows
+     * share the browser shape. Idempotent (a POST read — safe to retry).
+     */
+    getDestinations(query: ServerDestinationsQuery, opts?: CallOptions): Promise<DestinationsResult>;
+    /**
+     * Phone-share OTP handshake — resolves a 409 `PHONE_SHARE_APPROVAL_REQUIRED`.
+     *
+     * These three endpoints are UNAUTHENTICATED (phone-owner-driven: no game secret,
+     * no player token) — a partner backend relays the handshake. The triggering 409
+     * carries `approval_id, expires_at, code_sent, existing_account_hints[], next_endpoint`.
+     *
+     * `phoneShareInitiate` is the fallback OTP send (use when the 409 didn't already
+     * dispatch a code). NOT idempotent — never auto-retried. OTP TTL ~10 min.
+     */
+    phoneShareInitiate(input: PhoneShareContact, opts?: CallOptions): Promise<PhoneShareInitiateResult>;
+    /**
+     * Approve a phone-share with the OTP the phone owner received. On success the grant
+     * is stored server-side, keyed by (phone, requesting_email) and auto-consumed — the
+     * caller simply RE-ISSUES the identical original request. UNAUTHENTICATED. NOT
+     * idempotent (attempts are counted) — never auto-retried.
+     */
+    phoneShareApprove(input: PhoneShareApproveInput, opts?: CallOptions): Promise<PhoneShareApproveResult>;
+    /**
+     * Poll whether a phone-share (phone, requesting_email) pair is approved yet.
+     * UNAUTHENTICATED, idempotent GET. `approved:true` means the original request can
+     * be re-issued.
+     */
+    phoneShareStatus(input: PhoneShareContact, opts?: CallOptions): Promise<PhoneShareStatusResult>;
     private toInitiateResult;
 }
 
-export { CallOptions, ConfirmPaymentResult, CreateCheckoutInput, CreateCheckoutResult, InboundPendingQuery, InboundPendingResult, InitiateResult, InitiateSendInput, InitiateTransferInput, InvoError, InvoServer, type InvoWebhookEvent, ItemHistoryQuery, ItemHistoryResult, ItemOrderQuery, type ItemPurchasedData, LinkedIdentitiesQuery, LinkedIdentitiesResult, OrderDetailsResult, PlayerBalanceQuery, PlayerBalanceResult, PlayerToken, type PurchaseCompletedData, type PurchaseEventData, PurchaseInput, PurchaseItemInput, PurchaseItemResult, PurchaseResult, ServerConfig, type TransferEventData, type VerifyWebhookOptions, type WebhookHandlerOptions, createWebhookHandler, verifyWebhook, verifyWebhookAsync };
+export { CallOptions, ClaimCurrencyInput, ClaimResult, ClaimTransferInput, ConfirmPaymentResult, CreateCheckoutInput, CreateCheckoutResult, DestinationsResult, GuardianApprovalStatusResult, InboundPendingQuery, InboundPendingResult, InitiateResult, InitiateSendInput, InitiateTransferInput, InvoError, InvoServer, type InvoWebhookEvent, ItemHistoryQuery, ItemHistoryResult, ItemOrderQuery, type ItemPurchasedData, LinkedIdentitiesQuery, LinkedIdentitiesResult, OrderDetailsResult, PhoneShareApproveInput, PhoneShareApproveResult, PhoneShareContact, PhoneShareInitiateResult, PhoneShareStatusResult, PlayerBalanceQuery, PlayerBalanceResult, PlayerToken, type PurchaseCompletedData, type PurchaseEventData, PurchaseInput, PurchaseItemInput, PurchaseItemResult, PurchaseResult, ServerConfig, ServerDestinationsQuery, SmsVerifyResult, TransactionStatusResult, type TransferEventData, type VerifyWebhookOptions, type WebhookHandlerOptions, createWebhookHandler, verifyWebhook, verifyWebhookAsync };