@invonetwork/web-sdk 1.0.0 → 1.2.0

package/dist/server.js

@@ -1,5 +1,5 @@
-import { InvoError, assertSecureBaseUrl, Http } from './chunk-D3XBTH4C.js';
-export { InvoError } from './chunk-D3XBTH4C.js';
+import { InvoError, assertSecureBaseUrl, Http, toDestinationsResult } from './chunk-P65XQ6VF.js';
+export { InvoError } from './chunk-P65XQ6VF.js';
 import { createHmac } from 'crypto';
 
 var DEFAULT_TOLERANCE_SEC = 300;
@@ -161,7 +161,7 @@ async function hmacHexSubtle(secret, message) {
 }
 
 // src/server.ts
-var DEFAULT_UA = "invonetwork-web-sdk/1.0.0 (+https://invo.network)";
+var DEFAULT_UA = "invonetwork-web-sdk/1.2.0 (+https://invo.network)";
 var MAX_USD_AMOUNT = 999.99;
 var MAX_ITEM_PRICE = 999999.99;
 function invalidInput(label, value, why) {
@@ -223,6 +223,75 @@ function toInboundPendingItem(row) {
     raw: row
   };
 }
+function toSmsVerifyResult(raw) {
+  return {
+    status: String(raw["status"] ?? ""),
+    transactionId: String(raw["transaction_id"] ?? ""),
+    claimCode: raw["claim_code"],
+    newBalance: raw["new_balance"] ?? null,
+    orderId: raw["order_id"],
+    raw
+  };
+}
+function toClaimResult(raw) {
+  const status = String(raw["status"] ?? "");
+  return {
+    status,
+    transactionId: raw["transaction_id"],
+    newBalance: raw["new_balance"] ?? null,
+    currencyName: raw["currency_name"],
+    orderId: raw["order_id"],
+    needsAccountSelection: status === "needs_account_selection",
+    candidates: Array.isArray(raw["candidates"]) ? raw["candidates"] : void 0,
+    raw
+  };
+}
+function toTransactionStatus(raw) {
+  return {
+    transactionId: String(raw["transaction_id"] ?? ""),
+    transactionType: String(raw["transaction_type"] ?? ""),
+    transactionStatus: String(raw["transaction_status"] ?? ""),
+    verificationState: String(raw["verification_state"] ?? ""),
+    amount: raw["amount"] ?? null,
+    netAmount: raw["net_amount"] ?? null,
+    currencyId: raw["currency_id"] ?? "",
+    orderId: raw["order_id"],
+    toPhone: raw["to_phone"],
+    toIdentityId: raw["to_identity_id"] ?? null,
+    raw
+  };
+}
+function toGuardianApprovalStatus(raw) {
+  const approval = raw["approval"] ?? {};
+  return {
+    state: String(approval["state"] ?? ""),
+    approvalId: approval["approval_id"],
+    transactionId: approval["transaction_id"],
+    expiresAt: approval["expires_at"],
+    decidedAt: approval["decided_at"],
+    decisionSource: approval["decision_source"],
+    actionDescription: approval["action_description"],
+    raw
+  };
+}
+function toPhoneShareInitiateResult(raw) {
+  return {
+    approvalId: raw["approval_id"],
+    codeSent: typeof raw["code_sent"] === "boolean" ? raw["code_sent"] : void 0,
+    expiresAt: raw["expires_at"],
+    alreadyApproved: typeof raw["already_approved"] === "boolean" ? raw["already_approved"] : void 0,
+    raw
+  };
+}
+function toPhoneShareApproveResult(raw) {
+  return {
+    approvalId: raw["approval_id"],
+    approved: typeof raw["approved"] === "boolean" ? raw["approved"] : void 0,
+    alreadyApproved: typeof raw["already_approved"] === "boolean" ? raw["already_approved"] : void 0,
+    expiresAt: raw["expires_at"],
+    raw
+  };
+}
 function toCurrencyBalance(row) {
   return {
     currencyId: row["currency_id"] ?? "",
@@ -669,6 +738,227 @@ var InvoServer = class {
       raw
     };
   }
+  /**
+   * Complete a TRANSFER's SMS-PIN step (un-enrolled fallback). NOT idempotent —
+   * each attempt is counted server-side, so this is never auto-retried. A bad PIN
+   * throws a 400 InvoError carrying `attempts_remaining` on `err.body`; a blocked
+   * recipient throws 429 (`sms_verification_blocked`).
+   */
+  async verifySmsTransfer(transactionId, smsPin, opts) {
+    if (typeof transactionId !== "string" || !transactionId.trim()) {
+      throw invalidInput("transactionId", transactionId, "is required");
+    }
+    if (typeof smsPin !== "string" || !smsPin.trim()) {
+      throw invalidInput("smsPin", smsPin, "is required");
+    }
+    const raw = await this.http.post(
+      "/api/transfers/verify-sms",
+      { transaction_id: transactionId, sms_pin: smsPin },
+      this.auth,
+      { signal: opts?.signal }
+      // NOT idempotent — attempts are counted; never auto-retried
+    );
+    return toSmsVerifyResult(raw);
+  }
+  /** Complete a SEND's SMS-PIN step (un-enrolled fallback). See verifySmsTransfer. */
+  async verifySmsSend(transactionId, smsPin, opts) {
+    if (typeof transactionId !== "string" || !transactionId.trim()) {
+      throw invalidInput("transactionId", transactionId, "is required");
+    }
+    if (typeof smsPin !== "string" || !smsPin.trim()) {
+      throw invalidInput("smsPin", smsPin, "is required");
+    }
+    const raw = await this.http.post(
+      "/api/currency-sends/verify-sms",
+      { transaction_id: transactionId, sms_pin: smsPin },
+      this.auth,
+      { signal: opts?.signal }
+      // NOT idempotent — attempts are counted; never auto-retried
+    );
+    return toSmsVerifyResult(raw);
+  }
+  /**
+   * Claim an inbound TRANSFER by its claim code, crediting one of this game's currencies.
+   * NOT idempotent. A 200 may come back as `needsAccountSelection` (the recipient phone
+   * maps to >1 of your players) — inspect `result.candidates` and re-submit with
+   * `targetPlayerId`. Errors surface via InvoError (404 unknown code, 403 phone mismatch,
+   * 400 not-claimable/expired/wrong-value, 409 `err.isPhoneShareApprovalRequired`, …).
+   */
+  async claimTransfer(input, opts) {
+    const body = {
+      claim_code: input.claimCode,
+      target_player_name: input.targetPlayerName,
+      target_player_email: input.targetPlayerEmail,
+      target_player_phone: input.targetPlayerPhone,
+      target_currency_id: input.targetCurrencyId
+    };
+    if (input.targetPlayerId != null) body["target_player_id"] = input.targetPlayerId;
+    const raw = await this.http.post(
+      "/api/transfers/claim-transfer",
+      body,
+      this.auth,
+      { signal: opts?.signal }
+      // NOT idempotent — never auto-retried
+    );
+    return toClaimResult(raw);
+  }
+  /**
+   * Claim an inbound SEND by its claim code. NOT idempotent. May return
+   * `needsAccountSelection` (multi-account phone) — re-submit with `receiverPlayerId`.
+   * See claimTransfer for the error surface.
+   */
+  async claimCurrency(input, opts) {
+    const body = {
+      claim_code: input.claimCode,
+      receiver_player_name: input.receiverPlayerName,
+      receiver_player_email: input.receiverPlayerEmail,
+      receiver_player_phone: input.receiverPlayerPhone
+    };
+    if (input.receiverPlayerId != null) body["receiver_player_id"] = input.receiverPlayerId;
+    const raw = await this.http.post(
+      "/api/currency-sends/claim-currency",
+      body,
+      this.auth,
+      { signal: opts?.signal }
+      // NOT idempotent — never auto-retried
+    );
+    return toClaimResult(raw);
+  }
+  /** Read a TRANSFER's status (verification_state + amounts + destination). */
+  async getTransferStatus(transactionId, opts) {
+    if (typeof transactionId !== "string" || !transactionId.trim()) {
+      throw invalidInput("transactionId", transactionId, "is required");
+    }
+    const raw = await this.http.get(
+      `/api/transfers/${encodeURIComponent(transactionId)}/status`,
+      this.auth,
+      { signal: opts?.signal }
+    );
+    return toTransactionStatus(raw);
+  }
+  /** Read a SEND's status (adds fees, game names, claim_info, … on `raw`). */
+  async getSendStatus(transactionId, opts) {
+    if (typeof transactionId !== "string" || !transactionId.trim()) {
+      throw invalidInput("transactionId", transactionId, "is required");
+    }
+    const raw = await this.http.get(
+      `/api/currency-sends/${encodeURIComponent(transactionId)}/status`,
+      this.auth,
+      { signal: opts?.signal }
+    );
+    return toTransactionStatus(raw);
+  }
+  /**
+   * Poll a transaction's guardian approval status (minor/guardian flow). The retry
+   * layer already retries the 503 (`{status:"unavailable"}`) for this idempotent GET;
+   * a missing approval throws a 404 InvoError (`{status:"not_found"}`).
+   */
+  async getGuardianApprovalStatus(transactionId, opts) {
+    if (typeof transactionId !== "string" || !transactionId.trim()) {
+      throw invalidInput("transactionId", transactionId, "is required");
+    }
+    const raw = await this.http.get(
+      `/api/transactions/${encodeURIComponent(transactionId)}/approval-status`,
+      this.auth,
+      { signal: opts?.signal }
+    );
+    return toGuardianApprovalStatus(raw);
+  }
+  /**
+   * List the games/tenants a player can send/transfer to FROM `sourceGameId`, with
+   * display metadata inline (name, icon, currency, min/max limits) — one call, no
+   * per-game lookup. SERVER variant (game-secret) of the browser `InvoClient.getDestinations`;
+   * the source game is passed explicitly rather than inferred from a player token. Rows
+   * share the browser shape. Idempotent (a POST read — safe to retry).
+   */
+  async getDestinations(query, opts) {
+    if (query.sourceGameId == null || String(query.sourceGameId).trim() === "") {
+      throw invalidInput("sourceGameId", query.sourceGameId, "is required");
+    }
+    const direction = query.direction ?? "transfer";
+    const path = direction === "send" ? "/api/currency-sends/available-destinations" : "/api/transfers/available-destinations";
+    const raw = await this.http.post(
+      path,
+      { source_game_id: query.sourceGameId },
+      this.auth,
+      { idempotent: true, signal: opts?.signal }
+      // a POST read — no side effect, safe to retry
+    );
+    return toDestinationsResult(raw, direction);
+  }
+  /**
+   * Phone-share OTP handshake — resolves a 409 `PHONE_SHARE_APPROVAL_REQUIRED`.
+   *
+   * These three endpoints are UNAUTHENTICATED (phone-owner-driven: no game secret,
+   * no player token) — a partner backend relays the handshake. The triggering 409
+   * carries `approval_id, expires_at, code_sent, existing_account_hints[], next_endpoint`.
+   *
+   * `phoneShareInitiate` is the fallback OTP send (use when the 409 didn't already
+   * dispatch a code). NOT idempotent — never auto-retried. OTP TTL ~10 min.
+   */
+  async phoneShareInitiate(input, opts) {
+    if (typeof input.phone !== "string" || !input.phone.trim()) {
+      throw invalidInput("phone", input.phone, "is required");
+    }
+    if (typeof input.email !== "string" || !input.email.trim()) {
+      throw invalidInput("email", input.email, "is required");
+    }
+    const raw = await this.http.post(
+      "/api/wallet/phone-share/initiate",
+      { phone: input.phone, email: input.email },
+      { kind: "none" },
+      // UNAUTHENTICATED — phone-owner-driven; send no auth header
+      { signal: opts?.signal }
+      // NOT idempotent — sends an OTP; never auto-retried
+    );
+    return toPhoneShareInitiateResult(raw);
+  }
+  /**
+   * Approve a phone-share with the OTP the phone owner received. On success the grant
+   * is stored server-side, keyed by (phone, requesting_email) and auto-consumed — the
+   * caller simply RE-ISSUES the identical original request. UNAUTHENTICATED. NOT
+   * idempotent (attempts are counted) — never auto-retried.
+   */
+  async phoneShareApprove(input, opts) {
+    if (typeof input.approvalId !== "string" || !input.approvalId.trim()) {
+      throw invalidInput("approvalId", input.approvalId, "is required");
+    }
+    if (typeof input.otp !== "string" || !input.otp.trim()) {
+      throw invalidInput("otp", input.otp, "is required");
+    }
+    const raw = await this.http.post(
+      "/api/wallet/phone-share/approve",
+      { approval_id: input.approvalId, otp: input.otp },
+      { kind: "none" },
+      // UNAUTHENTICATED — phone-owner-driven; send no auth header
+      { signal: opts?.signal }
+      // NOT idempotent — OTP attempts are counted; never auto-retried
+    );
+    return toPhoneShareApproveResult(raw);
+  }
+  /**
+   * Poll whether a phone-share (phone, requesting_email) pair is approved yet.
+   * UNAUTHENTICATED, idempotent GET. `approved:true` means the original request can
+   * be re-issued.
+   */
+  async phoneShareStatus(input, opts) {
+    if (typeof input.phone !== "string" || !input.phone.trim()) {
+      throw invalidInput("phone", input.phone, "is required");
+    }
+    if (typeof input.email !== "string" || !input.email.trim()) {
+      throw invalidInput("email", input.email, "is required");
+    }
+    const q = new URLSearchParams();
+    q.set("phone", input.phone);
+    q.set("email", input.email);
+    const raw = await this.http.get(
+      `/api/wallet/phone-share/status?${q.toString()}`,
+      { kind: "none" },
+      // UNAUTHENTICATED — phone-owner-driven; send no auth header
+      { signal: opts?.signal }
+    );
+    return { approved: raw["approved"] === true, raw };
+  }
   toInitiateResult(raw) {
     const vm = raw["verification_method"];
     const guardian = raw["guardian_approval"];

package/dist/{types-DLSCxpoT.d.cts → types-DTAmriOB.d.cts}

@@ -37,6 +37,10 @@ declare class InvoError extends Error {
      * is a rate-limit, not a top-up condition) is NOT misclassified as this.
      */
     get isInsufficientBalance(): boolean;
+    /** True if a claim needs phone-share approval before it can complete (claim → 409). */
+    get isPhoneShareApprovalRequired(): boolean;
+    /** True if the phone-share (phone, requesting_email) pair was already approved. */
+    get isPhoneShareAlreadyApproved(): boolean;
     /** True if an idempotency-keyed request was a duplicate (item purchase → 409). */
     get isDuplicateRequest(): boolean;
     /** Seconds to wait before retrying, when the backend throttled the call (429 `retry_after`). */
@@ -405,6 +409,14 @@ interface DestinationsQuery {
     /** "transfer" | "send". Defaults "transfer" (the set is identical for both today). */
     direction?: "transfer" | "send";
 }
+/** Server-side (game-secret) destinations query. Unlike the browser variant, the
+ *  source game isn't inferred from a player token — pass it explicitly. */
+interface ServerDestinationsQuery {
+    /** The game the player is sending/transferring FROM. */
+    sourceGameId: string | number;
+    /** "transfer" | "send". Defaults "transfer" (the set is identical for both today). */
+    direction?: "transfer" | "send";
+}
 /** A game/tenant this player can send/transfer to, with display metadata inline. */
 interface DestinationGame {
     gameId: string | number;
@@ -459,5 +471,127 @@ interface LinkDeviceResult {
     status: string;
     raw: Record<string, unknown>;
 }
+interface SmsVerifyResult {
+    /** "success" on a completed verification. */
+    status: string;
+    transactionId: string;
+    /** The recipient claim code, when the completion issued one. */
+    claimCode?: string;
+    /** Canonical balance AFTER completion, when the backend returned it. */
+    newBalance?: string | number | null;
+    orderId?: string;
+    raw: Record<string, unknown>;
+}
+interface ClaimTransferInput {
+    claimCode: string;
+    targetPlayerName: string;
+    targetPlayerEmail: string;
+    targetPlayerPhone: string;
+    /** Which of this game's currencies to credit. */
+    targetCurrencyId: string | number;
+    /** Re-submit with this after a `needsAccountSelection` result to disambiguate a
+     *  phone that maps to more than one of your players. */
+    targetPlayerId?: string | number;
+}
+interface ClaimCurrencyInput {
+    claimCode: string;
+    receiverPlayerName: string;
+    receiverPlayerEmail: string;
+    receiverPlayerPhone: string;
+    /** Re-submit with this after a `needsAccountSelection` result (multi-account phone). */
+    receiverPlayerId?: string | number;
+}
+interface ClaimResult {
+    /** "success" on completion, or "needs_account_selection" (see `needsAccountSelection`). */
+    status: string;
+    transactionId?: string;
+    newBalance?: string | number | null;
+    currencyName?: string;
+    orderId?: string;
+    /**
+     * true when a 200 came back as `status:"needs_account_selection"` (the recipient
+     * phone maps to more than one of your players). NOT an error — re-submit the claim
+     * with `targetPlayerId` (transfer) / `receiverPlayerId` (send) from `candidates`.
+     */
+    needsAccountSelection: boolean;
+    /** Candidate accounts to disambiguate, present on a `needsAccountSelection` result. */
+    candidates?: Record<string, unknown>[];
+    raw: Record<string, unknown>;
+}
+/** `verification_state` ∈ awaiting | approved | completed | expired | failed | unknown. */
+interface TransactionStatusResult {
+    transactionId: string;
+    /** "transfer" | "send". */
+    transactionType: string;
+    transactionStatus: string;
+    verificationState: string;
+    amount: string | number | null;
+    netAmount: string | number | null;
+    currencyId: string | number;
+    orderId?: string;
+    toPhone?: string;
+    toIdentityId?: string | null;
+    /** Everything else (send fees, game names, claim_info, failure_reason, sender claim_code, …). */
+    raw: Record<string, unknown>;
+}
+/** `state` ∈ pending | approved | rejected | expired. */
+interface GuardianApprovalStatusResult {
+    state: string;
+    approvalId?: string;
+    transactionId?: string;
+    expiresAt?: string;
+    decidedAt?: string;
+    decisionSource?: string;
+    actionDescription?: string;
+    raw: Record<string, unknown>;
+}
+/**
+ * A phone + requesting-email pair identifying a phone-share approval. Used to send
+ * the fallback OTP and to poll status. The server-side grant is keyed by this pair.
+ */
+interface PhoneShareContact {
+    /** The phone number whose owner must approve the share. */
+    phone: string;
+    /** The email of the account requesting to use that phone (requesting_email). */
+    email: string;
+}
+/** Result of `phoneShareInitiate` (fallback OTP send). Known fields are surfaced;
+ *  everything else stays on `raw`. */
+interface PhoneShareInitiateResult {
+    /** The approval id to pass back to `phoneShareApprove`. */
+    approvalId?: string;
+    /** Whether the backend actually dispatched an OTP. */
+    codeSent?: boolean;
+    /** When the OTP / approval expires (ISO). OTP TTL is ~10 min. */
+    expiresAt?: string;
+    /** true when the (phone, email) pair was already approved — no OTP needed. */
+    alreadyApproved?: boolean;
+    raw: Record<string, unknown>;
+}
+/** Input for `phoneShareApprove`. */
+interface PhoneShareApproveInput {
+    /** The `approval_id` from the 409 body or from `phoneShareInitiate`. */
+    approvalId: string;
+    /** The one-time code the phone owner received. */
+    otp: string;
+}
+/** Result of `phoneShareApprove`. Known fields are surfaced; the rest stays on `raw`.
+ *  On success the grant is stored server-side, so the caller simply re-issues the
+ *  identical original request (the grant is auto-consumed). */
+interface PhoneShareApproveResult {
+    approvalId?: string;
+    /** true once the share is approved. */
+    approved?: boolean;
+    /** true when the pair was already approved before this call. */
+    alreadyApproved?: boolean;
+    expiresAt?: string;
+    raw: Record<string, unknown>;
+}
+/** Result of `phoneShareStatus` (idempotent GET). */
+interface PhoneShareStatusResult {
+    /** true when the (phone, email) pair is approved and the original request can be re-issued. */
+    approved: boolean;
+    raw: Record<string, unknown>;
+}
 
-export { type ApproveResult as A, type BalanceResult as B, type ClientConfig as C, type DestinationsQuery as D, type EnrollmentBeginResult as E, type PlayerBalanceResult as F, type InboundPendingQuery as G, type InboundPendingResult as H, InvoError as I, type LinkedIdentitiesQuery as J, type LinkedIdentitiesResult as K, type LinkDeviceResult as L, type CurrencyBalance as M, type InboundPendingItem as N, type OrderDetailsResult as O, type PendingCollectResult as P, type LinkedIdentityEmail as Q, type Rail as R, type ServerConfig as S, type VerificationMethod as V, type CallOptions as a, type ConfirmReceiptResult as b, type DestinationsResult as c, type EnrollmentVerifyResult as d, type BalanceRow as e, type DestinationGame as f, type InvoErrorInfo as g, type InvoHooks as h, type InvoRequestInfo as i, type InvoResponseInfo as j, type PendingCollectItem as k, type PlayerToken as l, type InitiateSendInput as m, type InitiateResult as n, type InitiateTransferInput as o, type CreateCheckoutInput as p, type CreateCheckoutResult as q, type PurchaseInput as r, type PurchaseResult as s, type ConfirmPaymentResult as t, type PurchaseItemInput as u, type PurchaseItemResult as v, type ItemHistoryQuery as w, type ItemHistoryResult as x, type ItemOrderQuery as y, type PlayerBalanceQuery as z };
+export { type PhoneShareApproveResult as $, type ApproveResult as A, type BalanceResult as B, type ClientConfig as C, type DestinationsQuery as D, type EnrollmentBeginResult as E, type PlayerBalanceResult as F, type InboundPendingQuery as G, type InboundPendingResult as H, InvoError as I, type LinkedIdentitiesQuery as J, type LinkedIdentitiesResult as K, type LinkDeviceResult as L, type SmsVerifyResult as M, type ClaimTransferInput as N, type OrderDetailsResult as O, type PendingCollectResult as P, type ClaimResult as Q, type Rail as R, type ServerConfig as S, type ClaimCurrencyInput as T, type TransactionStatusResult as U, type VerificationMethod as V, type GuardianApprovalStatusResult as W, type ServerDestinationsQuery as X, type PhoneShareContact as Y, type PhoneShareInitiateResult as Z, type PhoneShareApproveInput as _, type CallOptions as a, type PhoneShareStatusResult as a0, type CurrencyBalance as a1, type InboundPendingItem as a2, type LinkedIdentityEmail as a3, type ConfirmReceiptResult as b, type DestinationsResult as c, type EnrollmentVerifyResult as d, type BalanceRow as e, type DestinationGame as f, type InvoErrorInfo as g, type InvoHooks as h, type InvoRequestInfo as i, type InvoResponseInfo as j, type PendingCollectItem as k, type PlayerToken as l, type InitiateSendInput as m, type InitiateResult as n, type InitiateTransferInput as o, type CreateCheckoutInput as p, type CreateCheckoutResult as q, type PurchaseInput as r, type PurchaseResult as s, type ConfirmPaymentResult as t, type PurchaseItemInput as u, type PurchaseItemResult as v, type ItemHistoryQuery as w, type ItemHistoryResult as x, type ItemOrderQuery as y, type PlayerBalanceQuery as z };

package/dist/{types-DLSCxpoT.d.ts → types-DTAmriOB.d.ts}

@@ -37,6 +37,10 @@ declare class InvoError extends Error {
      * is a rate-limit, not a top-up condition) is NOT misclassified as this.
      */
     get isInsufficientBalance(): boolean;
+    /** True if a claim needs phone-share approval before it can complete (claim → 409). */
+    get isPhoneShareApprovalRequired(): boolean;
+    /** True if the phone-share (phone, requesting_email) pair was already approved. */
+    get isPhoneShareAlreadyApproved(): boolean;
     /** True if an idempotency-keyed request was a duplicate (item purchase → 409). */
     get isDuplicateRequest(): boolean;
     /** Seconds to wait before retrying, when the backend throttled the call (429 `retry_after`). */
@@ -405,6 +409,14 @@ interface DestinationsQuery {
     /** "transfer" | "send". Defaults "transfer" (the set is identical for both today). */
     direction?: "transfer" | "send";
 }
+/** Server-side (game-secret) destinations query. Unlike the browser variant, the
+ *  source game isn't inferred from a player token — pass it explicitly. */
+interface ServerDestinationsQuery {
+    /** The game the player is sending/transferring FROM. */
+    sourceGameId: string | number;
+    /** "transfer" | "send". Defaults "transfer" (the set is identical for both today). */
+    direction?: "transfer" | "send";
+}
 /** A game/tenant this player can send/transfer to, with display metadata inline. */
 interface DestinationGame {
     gameId: string | number;
@@ -459,5 +471,127 @@ interface LinkDeviceResult {
     status: string;
     raw: Record<string, unknown>;
 }
+interface SmsVerifyResult {
+    /** "success" on a completed verification. */
+    status: string;
+    transactionId: string;
+    /** The recipient claim code, when the completion issued one. */
+    claimCode?: string;
+    /** Canonical balance AFTER completion, when the backend returned it. */
+    newBalance?: string | number | null;
+    orderId?: string;
+    raw: Record<string, unknown>;
+}
+interface ClaimTransferInput {
+    claimCode: string;
+    targetPlayerName: string;
+    targetPlayerEmail: string;
+    targetPlayerPhone: string;
+    /** Which of this game's currencies to credit. */
+    targetCurrencyId: string | number;
+    /** Re-submit with this after a `needsAccountSelection` result to disambiguate a
+     *  phone that maps to more than one of your players. */
+    targetPlayerId?: string | number;
+}
+interface ClaimCurrencyInput {
+    claimCode: string;
+    receiverPlayerName: string;
+    receiverPlayerEmail: string;
+    receiverPlayerPhone: string;
+    /** Re-submit with this after a `needsAccountSelection` result (multi-account phone). */
+    receiverPlayerId?: string | number;
+}
+interface ClaimResult {
+    /** "success" on completion, or "needs_account_selection" (see `needsAccountSelection`). */
+    status: string;
+    transactionId?: string;
+    newBalance?: string | number | null;
+    currencyName?: string;
+    orderId?: string;
+    /**
+     * true when a 200 came back as `status:"needs_account_selection"` (the recipient
+     * phone maps to more than one of your players). NOT an error — re-submit the claim
+     * with `targetPlayerId` (transfer) / `receiverPlayerId` (send) from `candidates`.
+     */
+    needsAccountSelection: boolean;
+    /** Candidate accounts to disambiguate, present on a `needsAccountSelection` result. */
+    candidates?: Record<string, unknown>[];
+    raw: Record<string, unknown>;
+}
+/** `verification_state` ∈ awaiting | approved | completed | expired | failed | unknown. */
+interface TransactionStatusResult {
+    transactionId: string;
+    /** "transfer" | "send". */
+    transactionType: string;
+    transactionStatus: string;
+    verificationState: string;
+    amount: string | number | null;
+    netAmount: string | number | null;
+    currencyId: string | number;
+    orderId?: string;
+    toPhone?: string;
+    toIdentityId?: string | null;
+    /** Everything else (send fees, game names, claim_info, failure_reason, sender claim_code, …). */
+    raw: Record<string, unknown>;
+}
+/** `state` ∈ pending | approved | rejected | expired. */
+interface GuardianApprovalStatusResult {
+    state: string;
+    approvalId?: string;
+    transactionId?: string;
+    expiresAt?: string;
+    decidedAt?: string;
+    decisionSource?: string;
+    actionDescription?: string;
+    raw: Record<string, unknown>;
+}
+/**
+ * A phone + requesting-email pair identifying a phone-share approval. Used to send
+ * the fallback OTP and to poll status. The server-side grant is keyed by this pair.
+ */
+interface PhoneShareContact {
+    /** The phone number whose owner must approve the share. */
+    phone: string;
+    /** The email of the account requesting to use that phone (requesting_email). */
+    email: string;
+}
+/** Result of `phoneShareInitiate` (fallback OTP send). Known fields are surfaced;
+ *  everything else stays on `raw`. */
+interface PhoneShareInitiateResult {
+    /** The approval id to pass back to `phoneShareApprove`. */
+    approvalId?: string;
+    /** Whether the backend actually dispatched an OTP. */
+    codeSent?: boolean;
+    /** When the OTP / approval expires (ISO). OTP TTL is ~10 min. */
+    expiresAt?: string;
+    /** true when the (phone, email) pair was already approved — no OTP needed. */
+    alreadyApproved?: boolean;
+    raw: Record<string, unknown>;
+}
+/** Input for `phoneShareApprove`. */
+interface PhoneShareApproveInput {
+    /** The `approval_id` from the 409 body or from `phoneShareInitiate`. */
+    approvalId: string;
+    /** The one-time code the phone owner received. */
+    otp: string;
+}
+/** Result of `phoneShareApprove`. Known fields are surfaced; the rest stays on `raw`.
+ *  On success the grant is stored server-side, so the caller simply re-issues the
+ *  identical original request (the grant is auto-consumed). */
+interface PhoneShareApproveResult {
+    approvalId?: string;
+    /** true once the share is approved. */
+    approved?: boolean;
+    /** true when the pair was already approved before this call. */
+    alreadyApproved?: boolean;
+    expiresAt?: string;
+    raw: Record<string, unknown>;
+}
+/** Result of `phoneShareStatus` (idempotent GET). */
+interface PhoneShareStatusResult {
+    /** true when the (phone, email) pair is approved and the original request can be re-issued. */
+    approved: boolean;
+    raw: Record<string, unknown>;
+}
 
-export { type ApproveResult as A, type BalanceResult as B, type ClientConfig as C, type DestinationsQuery as D, type EnrollmentBeginResult as E, type PlayerBalanceResult as F, type InboundPendingQuery as G, type InboundPendingResult as H, InvoError as I, type LinkedIdentitiesQuery as J, type LinkedIdentitiesResult as K, type LinkDeviceResult as L, type CurrencyBalance as M, type InboundPendingItem as N, type OrderDetailsResult as O, type PendingCollectResult as P, type LinkedIdentityEmail as Q, type Rail as R, type ServerConfig as S, type VerificationMethod as V, type CallOptions as a, type ConfirmReceiptResult as b, type DestinationsResult as c, type EnrollmentVerifyResult as d, type BalanceRow as e, type DestinationGame as f, type InvoErrorInfo as g, type InvoHooks as h, type InvoRequestInfo as i, type InvoResponseInfo as j, type PendingCollectItem as k, type PlayerToken as l, type InitiateSendInput as m, type InitiateResult as n, type InitiateTransferInput as o, type CreateCheckoutInput as p, type CreateCheckoutResult as q, type PurchaseInput as r, type PurchaseResult as s, type ConfirmPaymentResult as t, type PurchaseItemInput as u, type PurchaseItemResult as v, type ItemHistoryQuery as w, type ItemHistoryResult as x, type ItemOrderQuery as y, type PlayerBalanceQuery as z };
+export { type PhoneShareApproveResult as $, type ApproveResult as A, type BalanceResult as B, type ClientConfig as C, type DestinationsQuery as D, type EnrollmentBeginResult as E, type PlayerBalanceResult as F, type InboundPendingQuery as G, type InboundPendingResult as H, InvoError as I, type LinkedIdentitiesQuery as J, type LinkedIdentitiesResult as K, type LinkDeviceResult as L, type SmsVerifyResult as M, type ClaimTransferInput as N, type OrderDetailsResult as O, type PendingCollectResult as P, type ClaimResult as Q, type Rail as R, type ServerConfig as S, type ClaimCurrencyInput as T, type TransactionStatusResult as U, type VerificationMethod as V, type GuardianApprovalStatusResult as W, type ServerDestinationsQuery as X, type PhoneShareContact as Y, type PhoneShareInitiateResult as Z, type PhoneShareApproveInput as _, type CallOptions as a, type PhoneShareStatusResult as a0, type CurrencyBalance as a1, type InboundPendingItem as a2, type LinkedIdentityEmail as a3, type ConfirmReceiptResult as b, type DestinationsResult as c, type EnrollmentVerifyResult as d, type BalanceRow as e, type DestinationGame as f, type InvoErrorInfo as g, type InvoHooks as h, type InvoRequestInfo as i, type InvoResponseInfo as j, type PendingCollectItem as k, type PlayerToken as l, type InitiateSendInput as m, type InitiateResult as n, type InitiateTransferInput as o, type CreateCheckoutInput as p, type CreateCheckoutResult as q, type PurchaseInput as r, type PurchaseResult as s, type ConfirmPaymentResult as t, type PurchaseItemInput as u, type PurchaseItemResult as v, type ItemHistoryQuery as w, type ItemHistoryResult as x, type ItemOrderQuery as y, type PlayerBalanceQuery as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invonetwork/web-sdk",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "INVO Web SDK — currency purchase + passkey (WebAuthn) verification for partner web platforms.",
   "license": "SEE LICENSE IN LICENSE",
   "private": false,