@invonetwork/web-sdk 1.1.0 → 1.2.0

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to `@invonetwork/web-sdk` are documented here. This project
 [Semantic Versioning](https://semver.org/). Releases are managed with
 [changesets](https://github.com/changesets/changesets).
 
+## [1.2.0] — 2026-07-01
+
+Two more server-side capabilities on `InvoServer`.
+
+- **Phone-share OTP handshake** — `phoneShareInitiate` / `phoneShareApprove` / `phoneShareStatus`
+  resolve a `409 PHONE_SHARE_APPROVAL_REQUIRED`. Unauthenticated (phone-owner-driven — no game
+  secret, no player token), relayed by a partner backend; after approve, re-issue the identical
+  original request (the grant is server-side + auto-consumed). Adds
+  `InvoError.isPhoneShareAlreadyApproved`.
+- **Server-side `getDestinations`** — game-secret variant of the browser
+  `InvoClient.getDestinations`; pass `{ sourceGameId, direction }` (default `"transfer"`), rows
+  share the same `DestinationGame` shape.
+
 ## [1.1.0] — 2026-07-01
 
 Four additive server-side flows on `InvoServer` (the SMS-PIN / claim-code / status /

package/README.md

@@ -495,6 +495,8 @@ Helpers:
 | `.retryAfter` | seconds to back off on a 429 throttle |
 | `.isEnrollmentAuthorizationRequired` | first-enrollment needs the OTP grant → `enrollmentBegin`/`enrollmentVerify` |
 | `.isEnrollmentProofRequired` | another method exists → prove it via `linkDevice` |
+| `.isPhoneShareApprovalRequired` | a new-account phone needs owner approval → run the `phoneShare*` handshake, then retry |
+| `.isPhoneShareAlreadyApproved` | phone-share was already approved (e.g. from a `/reject`) |
 
 Client-side guards (bad amount, missing idempotency key, `rail:"steam"` on `purchaseCurrency`, item validation) throw `InvoError` with `.status === 0` **before** any network call. Notable backend codes: `SDK_TOKEN_EXPIRED`, `TENANT_NOT_MIGRATED`, `WEBAUTHN_NOT_ENABLED_FOR_TENANT`, `WEBAUTHN_UV_REQUIRED`, `ENROLLMENT_REQUIRES_PROOF`, `WRONG_RAIL_ENDPOINT`, `flow_paused`.
 
@@ -534,6 +536,8 @@ try {
 | `claimTransfer(input)` / `claimCurrency(input)` | `ClaimResult` — redeem a claim code (`needsAccountSelection` + `candidates` on a multi-account phone) |
 | `getTransferStatus(txnId)` / `getSendStatus(txnId)` | `TransactionStatusResult` — poll outbound state (`verificationState`) |
 | `getGuardianApprovalStatus(txnId)` | `GuardianApprovalStatusResult` — poll a guardian hold to resolution (`state`) |
+| `getDestinations({ sourceGameId, direction? })` | `DestinationsResult` — server-side (game-secret) destinations; same rows as the browser variant |
+| `phoneShareInitiate({ phone, email })` / `phoneShareApprove({ approvalId, otp })` / `phoneShareStatus({ phone, email })` | phone-share OTP handshake (unauthenticated) to resolve a `PHONE_SHARE_APPROVAL_REQUIRED` (409); then re-issue the original request |
 | `iterateItemPurchaseHistory({ playerEmail, pageSize? })` | async iterator over all history rows |
 | `verifyWebhook(rawBody, signatureHeader, secret \| secrets, opts?)` | typed `InvoWebhookEvent` (throws on bad signature) |
 | `verifyWebhookAsync(...)` | same as `verifyWebhook`, Web Crypto (edge/Workers/Deno/Bun) |

package/dist/{chunk-ZVKWDXSL.js → chunk-P65XQ6VF.js}

@@ -40,6 +40,10 @@ var InvoError = class _InvoError extends Error {
   get isPhoneShareApprovalRequired() {
     return this.code === "PHONE_SHARE_APPROVAL_REQUIRED";
   }
+  /** True if the phone-share (phone, requesting_email) pair was already approved. */
+  get isPhoneShareAlreadyApproved() {
+    return this.code === "PHONE_SHARE_ALREADY_APPROVED";
+  }
   /** True if an idempotency-keyed request was a duplicate (item purchase → 409). */
   get isDuplicateRequest() {
     return this.code === "DUPLICATE_REQUEST" || this.status === 409 && /duplicate/i.test(this.message);
@@ -260,6 +264,49 @@ function retryAfterMs(parsed, headers) {
   return void 0;
 }
 
-export { Http, InvoError, assertSecureBaseUrl };
-//# sourceMappingURL=chunk-ZVKWDXSL.js.map
-//# sourceMappingURL=chunk-ZVKWDXSL.js.map
+// src/shared/destinations.ts
+function toDestinationGame(row) {
+  const s = (k) => row[k] === void 0 || row[k] === null ? void 0 : String(row[k]);
+  return {
+    gameId: row["game_id"] ?? "",
+    gameName: String(row["game_name"] ?? ""),
+    tenantType: s("tenant_type"),
+    developerName: s("developer_name"),
+    publisherName: s("publisher_name"),
+    genre: s("genre"),
+    platform: s("platform"),
+    gameStatus: s("game_status"),
+    gameIcon: s("game_icon"),
+    gamePoster: s("game_poster"),
+    gameUrl: s("game_url"),
+    gameDescription: s("game_description"),
+    currencyName: String(row["currency_name"] ?? ""),
+    currencySymbol: String(row["currency_symbol"] ?? ""),
+    currencySymbolUrl: s("currency_symbol_url"),
+    minimumTransfer: String(row["minimum_transfer"] ?? ""),
+    maximumTransfer: String(row["maximum_transfer"] ?? ""),
+    raw: row
+  };
+}
+function toDestinationsResult(raw, direction) {
+  const games = Array.isArray(raw["available_games"]) ? raw["available_games"] : [];
+  return {
+    status: String(raw["status"] ?? ""),
+    sourceGameId: raw["source_game_id"] ?? "",
+    sourceGameName: String(raw["source_game_name"] ?? ""),
+    sourceGameIcon: raw["source_game_icon"],
+    sourceCurrencyName: String(raw["source_currency_name"] ?? ""),
+    sourceCurrencyIcon: raw["source_currency_icon"],
+    universalTransfers: raw["universal_transfers"] === true,
+    transferMode: String(raw["transfer_mode"] ?? ""),
+    availableGames: games.map(toDestinationGame),
+    totalDestinations: Number(raw["total_destinations"] ?? games.length),
+    direction: String(raw["direction"] ?? direction),
+    linkedGameIds: Array.isArray(raw["linked_game_ids"]) ? raw["linked_game_ids"] : void 0,
+    raw
+  };
+}
+
+export { Http, InvoError, assertSecureBaseUrl, toDestinationsResult };
+//# sourceMappingURL=chunk-P65XQ6VF.js.map
+//# sourceMappingURL=chunk-P65XQ6VF.js.map

package/dist/index.cjs

@@ -42,6 +42,10 @@ var InvoError = class _InvoError extends Error {
   get isPhoneShareApprovalRequired() {
     return this.code === "PHONE_SHARE_APPROVAL_REQUIRED";
   }
+  /** True if the phone-share (phone, requesting_email) pair was already approved. */
+  get isPhoneShareAlreadyApproved() {
+    return this.code === "PHONE_SHARE_ALREADY_APPROVED";
+  }
   /** True if an idempotency-keyed request was a duplicate (item purchase → 409). */
   get isDuplicateRequest() {
     return this.code === "DUPLICATE_REQUEST" || this.status === 409 && /duplicate/i.test(this.message);
@@ -343,6 +347,49 @@ function assertionToJSON(cred) {
   };
 }
 
+// src/shared/destinations.ts
+function toDestinationGame(row) {
+  const s = (k) => row[k] === void 0 || row[k] === null ? void 0 : String(row[k]);
+  return {
+    gameId: row["game_id"] ?? "",
+    gameName: String(row["game_name"] ?? ""),
+    tenantType: s("tenant_type"),
+    developerName: s("developer_name"),
+    publisherName: s("publisher_name"),
+    genre: s("genre"),
+    platform: s("platform"),
+    gameStatus: s("game_status"),
+    gameIcon: s("game_icon"),
+    gamePoster: s("game_poster"),
+    gameUrl: s("game_url"),
+    gameDescription: s("game_description"),
+    currencyName: String(row["currency_name"] ?? ""),
+    currencySymbol: String(row["currency_symbol"] ?? ""),
+    currencySymbolUrl: s("currency_symbol_url"),
+    minimumTransfer: String(row["minimum_transfer"] ?? ""),
+    maximumTransfer: String(row["maximum_transfer"] ?? ""),
+    raw: row
+  };
+}
+function toDestinationsResult(raw, direction) {
+  const games = Array.isArray(raw["available_games"]) ? raw["available_games"] : [];
+  return {
+    status: String(raw["status"] ?? ""),
+    sourceGameId: raw["source_game_id"] ?? "",
+    sourceGameName: String(raw["source_game_name"] ?? ""),
+    sourceGameIcon: raw["source_game_icon"],
+    sourceCurrencyName: String(raw["source_currency_name"] ?? ""),
+    sourceCurrencyIcon: raw["source_currency_icon"],
+    universalTransfers: raw["universal_transfers"] === true,
+    transferMode: String(raw["transfer_mode"] ?? ""),
+    availableGames: games.map(toDestinationGame),
+    totalDestinations: Number(raw["total_destinations"] ?? games.length),
+    direction: String(raw["direction"] ?? direction),
+    linkedGameIds: Array.isArray(raw["linked_game_ids"]) ? raw["linked_game_ids"] : void 0,
+    raw
+  };
+}
+
 // src/index.ts
 function toPendingCollectItem(row) {
   return {
@@ -371,29 +418,6 @@ function toBalanceRow(row) {
     raw: row
   };
 }
-function toDestinationGame(row) {
-  const s = (k) => row[k] === void 0 || row[k] === null ? void 0 : String(row[k]);
-  return {
-    gameId: row["game_id"] ?? "",
-    gameName: String(row["game_name"] ?? ""),
-    tenantType: s("tenant_type"),
-    developerName: s("developer_name"),
-    publisherName: s("publisher_name"),
-    genre: s("genre"),
-    platform: s("platform"),
-    gameStatus: s("game_status"),
-    gameIcon: s("game_icon"),
-    gamePoster: s("game_poster"),
-    gameUrl: s("game_url"),
-    gameDescription: s("game_description"),
-    currencyName: String(row["currency_name"] ?? ""),
-    currencySymbol: String(row["currency_symbol"] ?? ""),
-    currencySymbolUrl: s("currency_symbol_url"),
-    minimumTransfer: String(row["minimum_transfer"] ?? ""),
-    maximumTransfer: String(row["maximum_transfer"] ?? ""),
-    raw: row
-  };
-}
 var InvoClient = class {
   constructor(config) {
     if (!config.token) throw new Error("InvoClient requires a player `token`.");
@@ -514,22 +538,7 @@ var InvoClient = class {
         `/api/sdk/destinations?direction=${encodeURIComponent(direction)}`,
         opts?.signal
       );
-      const games = Array.isArray(raw["available_games"]) ? raw["available_games"] : [];
-      return {
-        status: String(raw["status"] ?? ""),
-        sourceGameId: raw["source_game_id"] ?? "",
-        sourceGameName: String(raw["source_game_name"] ?? ""),
-        sourceGameIcon: raw["source_game_icon"],
-        sourceCurrencyName: String(raw["source_currency_name"] ?? ""),
-        sourceCurrencyIcon: raw["source_currency_icon"],
-        universalTransfers: raw["universal_transfers"] === true,
-        transferMode: String(raw["transfer_mode"] ?? ""),
-        availableGames: games.map(toDestinationGame),
-        totalDestinations: Number(raw["total_destinations"] ?? games.length),
-        direction: String(raw["direction"] ?? direction),
-        linkedGameIds: Array.isArray(raw["linked_game_ids"]) ? raw["linked_game_ids"] : void 0,
-        raw
-      };
+      return toDestinationsResult(raw, direction);
     });
   }
   /**

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { C as ClientConfig, a as CallOptions, A as ApproveResult, b as ConfirmReceiptResult, L as LinkDeviceResult, P as PendingCollectResult, D as DestinationsQuery, c as DestinationsResult, B as BalanceResult, E as EnrollmentBeginResult, d as EnrollmentVerifyResult } from './types-CPt_5_Aw.cjs';
-export { e as BalanceRow, f as DestinationGame, I as InvoError, g as InvoErrorInfo, h as InvoHooks, i as InvoRequestInfo, j as InvoResponseInfo, k as PendingCollectItem, R as Rail, V as VerificationMethod } from './types-CPt_5_Aw.cjs';
+import { C as ClientConfig, a as CallOptions, A as ApproveResult, b as ConfirmReceiptResult, L as LinkDeviceResult, P as PendingCollectResult, D as DestinationsQuery, c as DestinationsResult, B as BalanceResult, E as EnrollmentBeginResult, d as EnrollmentVerifyResult } from './types-DTAmriOB.cjs';
+export { e as BalanceRow, f as DestinationGame, I as InvoError, g as InvoErrorInfo, h as InvoHooks, i as InvoRequestInfo, j as InvoResponseInfo, k as PendingCollectItem, R as Rail, V as VerificationMethod } from './types-DTAmriOB.cjs';
 
 declare class InvoClient {
     private readonly http;

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { C as ClientConfig, a as CallOptions, A as ApproveResult, b as ConfirmReceiptResult, L as LinkDeviceResult, P as PendingCollectResult, D as DestinationsQuery, c as DestinationsResult, B as BalanceResult, E as EnrollmentBeginResult, d as EnrollmentVerifyResult } from './types-CPt_5_Aw.js';
-export { e as BalanceRow, f as DestinationGame, I as InvoError, g as InvoErrorInfo, h as InvoHooks, i as InvoRequestInfo, j as InvoResponseInfo, k as PendingCollectItem, R as Rail, V as VerificationMethod } from './types-CPt_5_Aw.js';
+import { C as ClientConfig, a as CallOptions, A as ApproveResult, b as ConfirmReceiptResult, L as LinkDeviceResult, P as PendingCollectResult, D as DestinationsQuery, c as DestinationsResult, B as BalanceResult, E as EnrollmentBeginResult, d as EnrollmentVerifyResult } from './types-DTAmriOB.js';
+export { e as BalanceRow, f as DestinationGame, I as InvoError, g as InvoErrorInfo, h as InvoHooks, i as InvoRequestInfo, j as InvoResponseInfo, k as PendingCollectItem, R as Rail, V as VerificationMethod } from './types-DTAmriOB.js';
 
 declare class InvoClient {
     private readonly http;

package/dist/index.js

@@ -1,5 +1,5 @@
-import { assertSecureBaseUrl, Http, InvoError } from './chunk-ZVKWDXSL.js';
-export { InvoError } from './chunk-ZVKWDXSL.js';
+import { assertSecureBaseUrl, Http, toDestinationsResult, InvoError } from './chunk-P65XQ6VF.js';
+export { InvoError } from './chunk-P65XQ6VF.js';
 
 // src/shared/webauthn.ts
 function b64urlToBuffer(value) {
@@ -110,29 +110,6 @@ function toBalanceRow(row) {
     raw: row
   };
 }
-function toDestinationGame(row) {
-  const s = (k) => row[k] === void 0 || row[k] === null ? void 0 : String(row[k]);
-  return {
-    gameId: row["game_id"] ?? "",
-    gameName: String(row["game_name"] ?? ""),
-    tenantType: s("tenant_type"),
-    developerName: s("developer_name"),
-    publisherName: s("publisher_name"),
-    genre: s("genre"),
-    platform: s("platform"),
-    gameStatus: s("game_status"),
-    gameIcon: s("game_icon"),
-    gamePoster: s("game_poster"),
-    gameUrl: s("game_url"),
-    gameDescription: s("game_description"),
-    currencyName: String(row["currency_name"] ?? ""),
-    currencySymbol: String(row["currency_symbol"] ?? ""),
-    currencySymbolUrl: s("currency_symbol_url"),
-    minimumTransfer: String(row["minimum_transfer"] ?? ""),
-    maximumTransfer: String(row["maximum_transfer"] ?? ""),
-    raw: row
-  };
-}
 var InvoClient = class {
   constructor(config) {
     if (!config.token) throw new Error("InvoClient requires a player `token`.");
@@ -253,22 +230,7 @@ var InvoClient = class {
         `/api/sdk/destinations?direction=${encodeURIComponent(direction)}`,
         opts?.signal
       );
-      const games = Array.isArray(raw["available_games"]) ? raw["available_games"] : [];
-      return {
-        status: String(raw["status"] ?? ""),
-        sourceGameId: raw["source_game_id"] ?? "",
-        sourceGameName: String(raw["source_game_name"] ?? ""),
-        sourceGameIcon: raw["source_game_icon"],
-        sourceCurrencyName: String(raw["source_currency_name"] ?? ""),
-        sourceCurrencyIcon: raw["source_currency_icon"],
-        universalTransfers: raw["universal_transfers"] === true,
-        transferMode: String(raw["transfer_mode"] ?? ""),
-        availableGames: games.map(toDestinationGame),
-        totalDestinations: Number(raw["total_destinations"] ?? games.length),
-        direction: String(raw["direction"] ?? direction),
-        linkedGameIds: Array.isArray(raw["linked_game_ids"]) ? raw["linked_game_ids"] : void 0,
-        raw
-      };
+      return toDestinationsResult(raw, direction);
     });
   }
   /**

package/dist/server.cjs

@@ -44,6 +44,10 @@ var InvoError = class _InvoError extends Error {
   get isPhoneShareApprovalRequired() {
     return this.code === "PHONE_SHARE_APPROVAL_REQUIRED";
   }
+  /** True if the phone-share (phone, requesting_email) pair was already approved. */
+  get isPhoneShareAlreadyApproved() {
+    return this.code === "PHONE_SHARE_ALREADY_APPROVED";
+  }
   /** True if an idempotency-keyed request was a duplicate (item purchase → 409). */
   get isDuplicateRequest() {
     return this.code === "DUPLICATE_REQUEST" || this.status === 409 && /duplicate/i.test(this.message);
@@ -263,6 +267,49 @@ function retryAfterMs(parsed, headers) {
   }
   return void 0;
 }
+
+// src/shared/destinations.ts
+function toDestinationGame(row) {
+  const s = (k) => row[k] === void 0 || row[k] === null ? void 0 : String(row[k]);
+  return {
+    gameId: row["game_id"] ?? "",
+    gameName: String(row["game_name"] ?? ""),
+    tenantType: s("tenant_type"),
+    developerName: s("developer_name"),
+    publisherName: s("publisher_name"),
+    genre: s("genre"),
+    platform: s("platform"),
+    gameStatus: s("game_status"),
+    gameIcon: s("game_icon"),
+    gamePoster: s("game_poster"),
+    gameUrl: s("game_url"),
+    gameDescription: s("game_description"),
+    currencyName: String(row["currency_name"] ?? ""),
+    currencySymbol: String(row["currency_symbol"] ?? ""),
+    currencySymbolUrl: s("currency_symbol_url"),
+    minimumTransfer: String(row["minimum_transfer"] ?? ""),
+    maximumTransfer: String(row["maximum_transfer"] ?? ""),
+    raw: row
+  };
+}
+function toDestinationsResult(raw, direction) {
+  const games = Array.isArray(raw["available_games"]) ? raw["available_games"] : [];
+  return {
+    status: String(raw["status"] ?? ""),
+    sourceGameId: raw["source_game_id"] ?? "",
+    sourceGameName: String(raw["source_game_name"] ?? ""),
+    sourceGameIcon: raw["source_game_icon"],
+    sourceCurrencyName: String(raw["source_currency_name"] ?? ""),
+    sourceCurrencyIcon: raw["source_currency_icon"],
+    universalTransfers: raw["universal_transfers"] === true,
+    transferMode: String(raw["transfer_mode"] ?? ""),
+    availableGames: games.map(toDestinationGame),
+    totalDestinations: Number(raw["total_destinations"] ?? games.length),
+    direction: String(raw["direction"] ?? direction),
+    linkedGameIds: Array.isArray(raw["linked_game_ids"]) ? raw["linked_game_ids"] : void 0,
+    raw
+  };
+}
 var DEFAULT_TOLERANCE_SEC = 300;
 var ENCODER = new TextEncoder();
 function toBytes(body) {
@@ -422,7 +469,7 @@ async function hmacHexSubtle(secret, message) {
 }
 
 // src/server.ts
-var DEFAULT_UA = "invonetwork-web-sdk/1.1.0 (+https://invo.network)";
+var DEFAULT_UA = "invonetwork-web-sdk/1.2.0 (+https://invo.network)";
 var MAX_USD_AMOUNT = 999.99;
 var MAX_ITEM_PRICE = 999999.99;
 function invalidInput(label, value, why) {
@@ -535,6 +582,24 @@ function toGuardianApprovalStatus(raw) {
     raw
   };
 }
+function toPhoneShareInitiateResult(raw) {
+  return {
+    approvalId: raw["approval_id"],
+    codeSent: typeof raw["code_sent"] === "boolean" ? raw["code_sent"] : void 0,
+    expiresAt: raw["expires_at"],
+    alreadyApproved: typeof raw["already_approved"] === "boolean" ? raw["already_approved"] : void 0,
+    raw
+  };
+}
+function toPhoneShareApproveResult(raw) {
+  return {
+    approvalId: raw["approval_id"],
+    approved: typeof raw["approved"] === "boolean" ? raw["approved"] : void 0,
+    alreadyApproved: typeof raw["already_approved"] === "boolean" ? raw["already_approved"] : void 0,
+    expiresAt: raw["expires_at"],
+    raw
+  };
+}
 function toCurrencyBalance(row) {
   return {
     currencyId: row["currency_id"] ?? "",
@@ -1107,6 +1172,101 @@ var InvoServer = class {
     );
     return toGuardianApprovalStatus(raw);
   }
+  /**
+   * List the games/tenants a player can send/transfer to FROM `sourceGameId`, with
+   * display metadata inline (name, icon, currency, min/max limits) — one call, no
+   * per-game lookup. SERVER variant (game-secret) of the browser `InvoClient.getDestinations`;
+   * the source game is passed explicitly rather than inferred from a player token. Rows
+   * share the browser shape. Idempotent (a POST read — safe to retry).
+   */
+  async getDestinations(query, opts) {
+    if (query.sourceGameId == null || String(query.sourceGameId).trim() === "") {
+      throw invalidInput("sourceGameId", query.sourceGameId, "is required");
+    }
+    const direction = query.direction ?? "transfer";
+    const path = direction === "send" ? "/api/currency-sends/available-destinations" : "/api/transfers/available-destinations";
+    const raw = await this.http.post(
+      path,
+      { source_game_id: query.sourceGameId },
+      this.auth,
+      { idempotent: true, signal: opts?.signal }
+      // a POST read — no side effect, safe to retry
+    );
+    return toDestinationsResult(raw, direction);
+  }
+  /**
+   * Phone-share OTP handshake — resolves a 409 `PHONE_SHARE_APPROVAL_REQUIRED`.
+   *
+   * These three endpoints are UNAUTHENTICATED (phone-owner-driven: no game secret,
+   * no player token) — a partner backend relays the handshake. The triggering 409
+   * carries `approval_id, expires_at, code_sent, existing_account_hints[], next_endpoint`.
+   *
+   * `phoneShareInitiate` is the fallback OTP send (use when the 409 didn't already
+   * dispatch a code). NOT idempotent — never auto-retried. OTP TTL ~10 min.
+   */
+  async phoneShareInitiate(input, opts) {
+    if (typeof input.phone !== "string" || !input.phone.trim()) {
+      throw invalidInput("phone", input.phone, "is required");
+    }
+    if (typeof input.email !== "string" || !input.email.trim()) {
+      throw invalidInput("email", input.email, "is required");
+    }
+    const raw = await this.http.post(
+      "/api/wallet/phone-share/initiate",
+      { phone: input.phone, email: input.email },
+      { kind: "none" },
+      // UNAUTHENTICATED — phone-owner-driven; send no auth header
+      { signal: opts?.signal }
+      // NOT idempotent — sends an OTP; never auto-retried
+    );
+    return toPhoneShareInitiateResult(raw);
+  }
+  /**
+   * Approve a phone-share with the OTP the phone owner received. On success the grant
+   * is stored server-side, keyed by (phone, requesting_email) and auto-consumed — the
+   * caller simply RE-ISSUES the identical original request. UNAUTHENTICATED. NOT
+   * idempotent (attempts are counted) — never auto-retried.
+   */
+  async phoneShareApprove(input, opts) {
+    if (typeof input.approvalId !== "string" || !input.approvalId.trim()) {
+      throw invalidInput("approvalId", input.approvalId, "is required");
+    }
+    if (typeof input.otp !== "string" || !input.otp.trim()) {
+      throw invalidInput("otp", input.otp, "is required");
+    }
+    const raw = await this.http.post(
+      "/api/wallet/phone-share/approve",
+      { approval_id: input.approvalId, otp: input.otp },
+      { kind: "none" },
+      // UNAUTHENTICATED — phone-owner-driven; send no auth header
+      { signal: opts?.signal }
+      // NOT idempotent — OTP attempts are counted; never auto-retried
+    );
+    return toPhoneShareApproveResult(raw);
+  }
+  /**
+   * Poll whether a phone-share (phone, requesting_email) pair is approved yet.
+   * UNAUTHENTICATED, idempotent GET. `approved:true` means the original request can
+   * be re-issued.
+   */
+  async phoneShareStatus(input, opts) {
+    if (typeof input.phone !== "string" || !input.phone.trim()) {
+      throw invalidInput("phone", input.phone, "is required");
+    }
+    if (typeof input.email !== "string" || !input.email.trim()) {
+      throw invalidInput("email", input.email, "is required");
+    }
+    const q = new URLSearchParams();
+    q.set("phone", input.phone);
+    q.set("email", input.email);
+    const raw = await this.http.get(
+      `/api/wallet/phone-share/status?${q.toString()}`,
+      { kind: "none" },
+      // UNAUTHENTICATED — phone-owner-driven; send no auth header
+      { signal: opts?.signal }
+    );
+    return { approved: raw["approved"] === true, raw };
+  }
   toInitiateResult(raw) {
     const vm = raw["verification_method"];
     const guardian = raw["guardian_approval"];

package/dist/server.d.cts

@@ -1,5 +1,5 @@
-import { I as InvoError, S as ServerConfig, a as CallOptions, l as PlayerToken, m as InitiateSendInput, n as InitiateResult, o as InitiateTransferInput, p as CreateCheckoutInput, q as CreateCheckoutResult, r as PurchaseInput, s as PurchaseResult, t as ConfirmPaymentResult, O as OrderDetailsResult, u as PurchaseItemInput, v as PurchaseItemResult, w as ItemHistoryQuery, x as ItemHistoryResult, y as ItemOrderQuery, z as PlayerBalanceQuery, F as PlayerBalanceResult, G as InboundPendingQuery, H as InboundPendingResult, J as LinkedIdentitiesQuery, K as LinkedIdentitiesResult, M as SmsVerifyResult, N as ClaimTransferInput, Q as ClaimResult, T as ClaimCurrencyInput, U as TransactionStatusResult, W as GuardianApprovalStatusResult } from './types-CPt_5_Aw.cjs';
-export { X as CurrencyBalance, Y as InboundPendingItem, g as InvoErrorInfo, h as InvoHooks, i as InvoRequestInfo, j as InvoResponseInfo, Z as LinkedIdentityEmail, R as Rail, V as VerificationMethod } from './types-CPt_5_Aw.cjs';
+import { I as InvoError, S as ServerConfig, a as CallOptions, l as PlayerToken, m as InitiateSendInput, n as InitiateResult, o as InitiateTransferInput, p as CreateCheckoutInput, q as CreateCheckoutResult, r as PurchaseInput, s as PurchaseResult, t as ConfirmPaymentResult, O as OrderDetailsResult, u as PurchaseItemInput, v as PurchaseItemResult, w as ItemHistoryQuery, x as ItemHistoryResult, y as ItemOrderQuery, z as PlayerBalanceQuery, F as PlayerBalanceResult, G as InboundPendingQuery, H as InboundPendingResult, J as LinkedIdentitiesQuery, K as LinkedIdentitiesResult, M as SmsVerifyResult, N as ClaimTransferInput, Q as ClaimResult, T as ClaimCurrencyInput, U as TransactionStatusResult, W as GuardianApprovalStatusResult, X as ServerDestinationsQuery, c as DestinationsResult, Y as PhoneShareContact, Z as PhoneShareInitiateResult, _ as PhoneShareApproveInput, $ as PhoneShareApproveResult, a0 as PhoneShareStatusResult } from './types-DTAmriOB.cjs';
+export { a1 as CurrencyBalance, f as DestinationGame, a2 as InboundPendingItem, g as InvoErrorInfo, h as InvoHooks, i as InvoRequestInfo, j as InvoResponseInfo, a3 as LinkedIdentityEmail, R as Rail, V as VerificationMethod } from './types-DTAmriOB.cjs';
 
 interface VerifyWebhookOptions {
     /** Max age of the signed timestamp, in seconds. Default 300 (5 min). */
@@ -258,7 +258,39 @@ declare class InvoServer {
      * a missing approval throws a 404 InvoError (`{status:"not_found"}`).
      */
     getGuardianApprovalStatus(transactionId: string, opts?: CallOptions): Promise<GuardianApprovalStatusResult>;
+    /**
+     * List the games/tenants a player can send/transfer to FROM `sourceGameId`, with
+     * display metadata inline (name, icon, currency, min/max limits) — one call, no
+     * per-game lookup. SERVER variant (game-secret) of the browser `InvoClient.getDestinations`;
+     * the source game is passed explicitly rather than inferred from a player token. Rows
+     * share the browser shape. Idempotent (a POST read — safe to retry).
+     */
+    getDestinations(query: ServerDestinationsQuery, opts?: CallOptions): Promise<DestinationsResult>;
+    /**
+     * Phone-share OTP handshake — resolves a 409 `PHONE_SHARE_APPROVAL_REQUIRED`.
+     *
+     * These three endpoints are UNAUTHENTICATED (phone-owner-driven: no game secret,
+     * no player token) — a partner backend relays the handshake. The triggering 409
+     * carries `approval_id, expires_at, code_sent, existing_account_hints[], next_endpoint`.
+     *
+     * `phoneShareInitiate` is the fallback OTP send (use when the 409 didn't already
+     * dispatch a code). NOT idempotent — never auto-retried. OTP TTL ~10 min.
+     */
+    phoneShareInitiate(input: PhoneShareContact, opts?: CallOptions): Promise<PhoneShareInitiateResult>;
+    /**
+     * Approve a phone-share with the OTP the phone owner received. On success the grant
+     * is stored server-side, keyed by (phone, requesting_email) and auto-consumed — the
+     * caller simply RE-ISSUES the identical original request. UNAUTHENTICATED. NOT
+     * idempotent (attempts are counted) — never auto-retried.
+     */
+    phoneShareApprove(input: PhoneShareApproveInput, opts?: CallOptions): Promise<PhoneShareApproveResult>;
+    /**
+     * Poll whether a phone-share (phone, requesting_email) pair is approved yet.
+     * UNAUTHENTICATED, idempotent GET. `approved:true` means the original request can
+     * be re-issued.
+     */
+    phoneShareStatus(input: PhoneShareContact, opts?: CallOptions): Promise<PhoneShareStatusResult>;
     private toInitiateResult;
 }
 
-export { CallOptions, ClaimCurrencyInput, ClaimResult, ClaimTransferInput, ConfirmPaymentResult, CreateCheckoutInput, CreateCheckoutResult, GuardianApprovalStatusResult, InboundPendingQuery, InboundPendingResult, InitiateResult, InitiateSendInput, InitiateTransferInput, InvoError, InvoServer, type InvoWebhookEvent, ItemHistoryQuery, ItemHistoryResult, ItemOrderQuery, type ItemPurchasedData, LinkedIdentitiesQuery, LinkedIdentitiesResult, OrderDetailsResult, PlayerBalanceQuery, PlayerBalanceResult, PlayerToken, type PurchaseCompletedData, type PurchaseEventData, PurchaseInput, PurchaseItemInput, PurchaseItemResult, PurchaseResult, ServerConfig, SmsVerifyResult, TransactionStatusResult, type TransferEventData, type VerifyWebhookOptions, type WebhookHandlerOptions, createWebhookHandler, verifyWebhook, verifyWebhookAsync };
+export { CallOptions, ClaimCurrencyInput, ClaimResult, ClaimTransferInput, ConfirmPaymentResult, CreateCheckoutInput, CreateCheckoutResult, DestinationsResult, GuardianApprovalStatusResult, InboundPendingQuery, InboundPendingResult, InitiateResult, InitiateSendInput, InitiateTransferInput, InvoError, InvoServer, type InvoWebhookEvent, ItemHistoryQuery, ItemHistoryResult, ItemOrderQuery, type ItemPurchasedData, LinkedIdentitiesQuery, LinkedIdentitiesResult, OrderDetailsResult, PhoneShareApproveInput, PhoneShareApproveResult, PhoneShareContact, PhoneShareInitiateResult, PhoneShareStatusResult, PlayerBalanceQuery, PlayerBalanceResult, PlayerToken, type PurchaseCompletedData, type PurchaseEventData, PurchaseInput, PurchaseItemInput, PurchaseItemResult, PurchaseResult, ServerConfig, ServerDestinationsQuery, SmsVerifyResult, TransactionStatusResult, type TransferEventData, type VerifyWebhookOptions, type WebhookHandlerOptions, createWebhookHandler, verifyWebhook, verifyWebhookAsync };

package/dist/server.d.ts

@@ -1,5 +1,5 @@
-import { I as InvoError, S as ServerConfig, a as CallOptions, l as PlayerToken, m as InitiateSendInput, n as InitiateResult, o as InitiateTransferInput, p as CreateCheckoutInput, q as CreateCheckoutResult, r as PurchaseInput, s as PurchaseResult, t as ConfirmPaymentResult, O as OrderDetailsResult, u as PurchaseItemInput, v as PurchaseItemResult, w as ItemHistoryQuery, x as ItemHistoryResult, y as ItemOrderQuery, z as PlayerBalanceQuery, F as PlayerBalanceResult, G as InboundPendingQuery, H as InboundPendingResult, J as LinkedIdentitiesQuery, K as LinkedIdentitiesResult, M as SmsVerifyResult, N as ClaimTransferInput, Q as ClaimResult, T as ClaimCurrencyInput, U as TransactionStatusResult, W as GuardianApprovalStatusResult } from './types-CPt_5_Aw.js';
-export { X as CurrencyBalance, Y as InboundPendingItem, g as InvoErrorInfo, h as InvoHooks, i as InvoRequestInfo, j as InvoResponseInfo, Z as LinkedIdentityEmail, R as Rail, V as VerificationMethod } from './types-CPt_5_Aw.js';
+import { I as InvoError, S as ServerConfig, a as CallOptions, l as PlayerToken, m as InitiateSendInput, n as InitiateResult, o as InitiateTransferInput, p as CreateCheckoutInput, q as CreateCheckoutResult, r as PurchaseInput, s as PurchaseResult, t as ConfirmPaymentResult, O as OrderDetailsResult, u as PurchaseItemInput, v as PurchaseItemResult, w as ItemHistoryQuery, x as ItemHistoryResult, y as ItemOrderQuery, z as PlayerBalanceQuery, F as PlayerBalanceResult, G as InboundPendingQuery, H as InboundPendingResult, J as LinkedIdentitiesQuery, K as LinkedIdentitiesResult, M as SmsVerifyResult, N as ClaimTransferInput, Q as ClaimResult, T as ClaimCurrencyInput, U as TransactionStatusResult, W as GuardianApprovalStatusResult, X as ServerDestinationsQuery, c as DestinationsResult, Y as PhoneShareContact, Z as PhoneShareInitiateResult, _ as PhoneShareApproveInput, $ as PhoneShareApproveResult, a0 as PhoneShareStatusResult } from './types-DTAmriOB.js';
+export { a1 as CurrencyBalance, f as DestinationGame, a2 as InboundPendingItem, g as InvoErrorInfo, h as InvoHooks, i as InvoRequestInfo, j as InvoResponseInfo, a3 as LinkedIdentityEmail, R as Rail, V as VerificationMethod } from './types-DTAmriOB.js';
 
 interface VerifyWebhookOptions {
     /** Max age of the signed timestamp, in seconds. Default 300 (5 min). */
@@ -258,7 +258,39 @@ declare class InvoServer {
      * a missing approval throws a 404 InvoError (`{status:"not_found"}`).
      */
     getGuardianApprovalStatus(transactionId: string, opts?: CallOptions): Promise<GuardianApprovalStatusResult>;
+    /**
+     * List the games/tenants a player can send/transfer to FROM `sourceGameId`, with
+     * display metadata inline (name, icon, currency, min/max limits) — one call, no
+     * per-game lookup. SERVER variant (game-secret) of the browser `InvoClient.getDestinations`;
+     * the source game is passed explicitly rather than inferred from a player token. Rows
+     * share the browser shape. Idempotent (a POST read — safe to retry).
+     */
+    getDestinations(query: ServerDestinationsQuery, opts?: CallOptions): Promise<DestinationsResult>;
+    /**
+     * Phone-share OTP handshake — resolves a 409 `PHONE_SHARE_APPROVAL_REQUIRED`.
+     *
+     * These three endpoints are UNAUTHENTICATED (phone-owner-driven: no game secret,
+     * no player token) — a partner backend relays the handshake. The triggering 409
+     * carries `approval_id, expires_at, code_sent, existing_account_hints[], next_endpoint`.
+     *
+     * `phoneShareInitiate` is the fallback OTP send (use when the 409 didn't already
+     * dispatch a code). NOT idempotent — never auto-retried. OTP TTL ~10 min.
+     */
+    phoneShareInitiate(input: PhoneShareContact, opts?: CallOptions): Promise<PhoneShareInitiateResult>;
+    /**
+     * Approve a phone-share with the OTP the phone owner received. On success the grant
+     * is stored server-side, keyed by (phone, requesting_email) and auto-consumed — the
+     * caller simply RE-ISSUES the identical original request. UNAUTHENTICATED. NOT
+     * idempotent (attempts are counted) — never auto-retried.
+     */
+    phoneShareApprove(input: PhoneShareApproveInput, opts?: CallOptions): Promise<PhoneShareApproveResult>;
+    /**
+     * Poll whether a phone-share (phone, requesting_email) pair is approved yet.
+     * UNAUTHENTICATED, idempotent GET. `approved:true` means the original request can
+     * be re-issued.
+     */
+    phoneShareStatus(input: PhoneShareContact, opts?: CallOptions): Promise<PhoneShareStatusResult>;
     private toInitiateResult;
 }
 
-export { CallOptions, ClaimCurrencyInput, ClaimResult, ClaimTransferInput, ConfirmPaymentResult, CreateCheckoutInput, CreateCheckoutResult, GuardianApprovalStatusResult, InboundPendingQuery, InboundPendingResult, InitiateResult, InitiateSendInput, InitiateTransferInput, InvoError, InvoServer, type InvoWebhookEvent, ItemHistoryQuery, ItemHistoryResult, ItemOrderQuery, type ItemPurchasedData, LinkedIdentitiesQuery, LinkedIdentitiesResult, OrderDetailsResult, PlayerBalanceQuery, PlayerBalanceResult, PlayerToken, type PurchaseCompletedData, type PurchaseEventData, PurchaseInput, PurchaseItemInput, PurchaseItemResult, PurchaseResult, ServerConfig, SmsVerifyResult, TransactionStatusResult, type TransferEventData, type VerifyWebhookOptions, type WebhookHandlerOptions, createWebhookHandler, verifyWebhook, verifyWebhookAsync };
+export { CallOptions, ClaimCurrencyInput, ClaimResult, ClaimTransferInput, ConfirmPaymentResult, CreateCheckoutInput, CreateCheckoutResult, DestinationsResult, GuardianApprovalStatusResult, InboundPendingQuery, InboundPendingResult, InitiateResult, InitiateSendInput, InitiateTransferInput, InvoError, InvoServer, type InvoWebhookEvent, ItemHistoryQuery, ItemHistoryResult, ItemOrderQuery, type ItemPurchasedData, LinkedIdentitiesQuery, LinkedIdentitiesResult, OrderDetailsResult, PhoneShareApproveInput, PhoneShareApproveResult, PhoneShareContact, PhoneShareInitiateResult, PhoneShareStatusResult, PlayerBalanceQuery, PlayerBalanceResult, PlayerToken, type PurchaseCompletedData, type PurchaseEventData, PurchaseInput, PurchaseItemInput, PurchaseItemResult, PurchaseResult, ServerConfig, ServerDestinationsQuery, SmsVerifyResult, TransactionStatusResult, type TransferEventData, type VerifyWebhookOptions, type WebhookHandlerOptions, createWebhookHandler, verifyWebhook, verifyWebhookAsync };

package/dist/server.js

@@ -1,5 +1,5 @@
-import { InvoError, assertSecureBaseUrl, Http } from './chunk-ZVKWDXSL.js';
-export { InvoError } from './chunk-ZVKWDXSL.js';
+import { InvoError, assertSecureBaseUrl, Http, toDestinationsResult } from './chunk-P65XQ6VF.js';
+export { InvoError } from './chunk-P65XQ6VF.js';
 import { createHmac } from 'crypto';
 
 var DEFAULT_TOLERANCE_SEC = 300;
@@ -161,7 +161,7 @@ async function hmacHexSubtle(secret, message) {
 }
 
 // src/server.ts
-var DEFAULT_UA = "invonetwork-web-sdk/1.1.0 (+https://invo.network)";
+var DEFAULT_UA = "invonetwork-web-sdk/1.2.0 (+https://invo.network)";
 var MAX_USD_AMOUNT = 999.99;
 var MAX_ITEM_PRICE = 999999.99;
 function invalidInput(label, value, why) {
@@ -274,6 +274,24 @@ function toGuardianApprovalStatus(raw) {
     raw
   };
 }
+function toPhoneShareInitiateResult(raw) {
+  return {
+    approvalId: raw["approval_id"],
+    codeSent: typeof raw["code_sent"] === "boolean" ? raw["code_sent"] : void 0,
+    expiresAt: raw["expires_at"],
+    alreadyApproved: typeof raw["already_approved"] === "boolean" ? raw["already_approved"] : void 0,
+    raw
+  };
+}
+function toPhoneShareApproveResult(raw) {
+  return {
+    approvalId: raw["approval_id"],
+    approved: typeof raw["approved"] === "boolean" ? raw["approved"] : void 0,
+    alreadyApproved: typeof raw["already_approved"] === "boolean" ? raw["already_approved"] : void 0,
+    expiresAt: raw["expires_at"],
+    raw
+  };
+}
 function toCurrencyBalance(row) {
   return {
     currencyId: row["currency_id"] ?? "",
@@ -846,6 +864,101 @@ var InvoServer = class {
     );
     return toGuardianApprovalStatus(raw);
   }
+  /**
+   * List the games/tenants a player can send/transfer to FROM `sourceGameId`, with
+   * display metadata inline (name, icon, currency, min/max limits) — one call, no
+   * per-game lookup. SERVER variant (game-secret) of the browser `InvoClient.getDestinations`;
+   * the source game is passed explicitly rather than inferred from a player token. Rows
+   * share the browser shape. Idempotent (a POST read — safe to retry).
+   */
+  async getDestinations(query, opts) {
+    if (query.sourceGameId == null || String(query.sourceGameId).trim() === "") {
+      throw invalidInput("sourceGameId", query.sourceGameId, "is required");
+    }
+    const direction = query.direction ?? "transfer";
+    const path = direction === "send" ? "/api/currency-sends/available-destinations" : "/api/transfers/available-destinations";
+    const raw = await this.http.post(
+      path,
+      { source_game_id: query.sourceGameId },
+      this.auth,
+      { idempotent: true, signal: opts?.signal }
+      // a POST read — no side effect, safe to retry
+    );
+    return toDestinationsResult(raw, direction);
+  }
+  /**
+   * Phone-share OTP handshake — resolves a 409 `PHONE_SHARE_APPROVAL_REQUIRED`.
+   *
+   * These three endpoints are UNAUTHENTICATED (phone-owner-driven: no game secret,
+   * no player token) — a partner backend relays the handshake. The triggering 409
+   * carries `approval_id, expires_at, code_sent, existing_account_hints[], next_endpoint`.
+   *
+   * `phoneShareInitiate` is the fallback OTP send (use when the 409 didn't already
+   * dispatch a code). NOT idempotent — never auto-retried. OTP TTL ~10 min.
+   */
+  async phoneShareInitiate(input, opts) {
+    if (typeof input.phone !== "string" || !input.phone.trim()) {
+      throw invalidInput("phone", input.phone, "is required");
+    }
+    if (typeof input.email !== "string" || !input.email.trim()) {
+      throw invalidInput("email", input.email, "is required");
+    }
+    const raw = await this.http.post(
+      "/api/wallet/phone-share/initiate",
+      { phone: input.phone, email: input.email },
+      { kind: "none" },
+      // UNAUTHENTICATED — phone-owner-driven; send no auth header
+      { signal: opts?.signal }
+      // NOT idempotent — sends an OTP; never auto-retried
+    );
+    return toPhoneShareInitiateResult(raw);
+  }
+  /**
+   * Approve a phone-share with the OTP the phone owner received. On success the grant
+   * is stored server-side, keyed by (phone, requesting_email) and auto-consumed — the
+   * caller simply RE-ISSUES the identical original request. UNAUTHENTICATED. NOT
+   * idempotent (attempts are counted) — never auto-retried.
+   */
+  async phoneShareApprove(input, opts) {
+    if (typeof input.approvalId !== "string" || !input.approvalId.trim()) {
+      throw invalidInput("approvalId", input.approvalId, "is required");
+    }
+    if (typeof input.otp !== "string" || !input.otp.trim()) {
+      throw invalidInput("otp", input.otp, "is required");
+    }
+    const raw = await this.http.post(
+      "/api/wallet/phone-share/approve",
+      { approval_id: input.approvalId, otp: input.otp },
+      { kind: "none" },
+      // UNAUTHENTICATED — phone-owner-driven; send no auth header
+      { signal: opts?.signal }
+      // NOT idempotent — OTP attempts are counted; never auto-retried
+    );
+    return toPhoneShareApproveResult(raw);
+  }
+  /**
+   * Poll whether a phone-share (phone, requesting_email) pair is approved yet.
+   * UNAUTHENTICATED, idempotent GET. `approved:true` means the original request can
+   * be re-issued.
+   */
+  async phoneShareStatus(input, opts) {
+    if (typeof input.phone !== "string" || !input.phone.trim()) {
+      throw invalidInput("phone", input.phone, "is required");
+    }
+    if (typeof input.email !== "string" || !input.email.trim()) {
+      throw invalidInput("email", input.email, "is required");
+    }
+    const q = new URLSearchParams();
+    q.set("phone", input.phone);
+    q.set("email", input.email);
+    const raw = await this.http.get(
+      `/api/wallet/phone-share/status?${q.toString()}`,
+      { kind: "none" },
+      // UNAUTHENTICATED — phone-owner-driven; send no auth header
+      { signal: opts?.signal }
+    );
+    return { approved: raw["approved"] === true, raw };
+  }
   toInitiateResult(raw) {
     const vm = raw["verification_method"];
     const guardian = raw["guardian_approval"];

package/dist/{types-CPt_5_Aw.d.cts → types-DTAmriOB.d.cts}

@@ -39,6 +39,8 @@ declare class InvoError extends Error {
     get isInsufficientBalance(): boolean;
     /** True if a claim needs phone-share approval before it can complete (claim → 409). */
     get isPhoneShareApprovalRequired(): boolean;
+    /** True if the phone-share (phone, requesting_email) pair was already approved. */
+    get isPhoneShareAlreadyApproved(): boolean;
     /** True if an idempotency-keyed request was a duplicate (item purchase → 409). */
     get isDuplicateRequest(): boolean;
     /** Seconds to wait before retrying, when the backend throttled the call (429 `retry_after`). */
@@ -407,6 +409,14 @@ interface DestinationsQuery {
     /** "transfer" | "send". Defaults "transfer" (the set is identical for both today). */
     direction?: "transfer" | "send";
 }
+/** Server-side (game-secret) destinations query. Unlike the browser variant, the
+ *  source game isn't inferred from a player token — pass it explicitly. */
+interface ServerDestinationsQuery {
+    /** The game the player is sending/transferring FROM. */
+    sourceGameId: string | number;
+    /** "transfer" | "send". Defaults "transfer" (the set is identical for both today). */
+    direction?: "transfer" | "send";
+}
 /** A game/tenant this player can send/transfer to, with display metadata inline. */
 interface DestinationGame {
     gameId: string | number;
@@ -535,5 +545,53 @@ interface GuardianApprovalStatusResult {
     actionDescription?: string;
     raw: Record<string, unknown>;
 }
+/**
+ * A phone + requesting-email pair identifying a phone-share approval. Used to send
+ * the fallback OTP and to poll status. The server-side grant is keyed by this pair.
+ */
+interface PhoneShareContact {
+    /** The phone number whose owner must approve the share. */
+    phone: string;
+    /** The email of the account requesting to use that phone (requesting_email). */
+    email: string;
+}
+/** Result of `phoneShareInitiate` (fallback OTP send). Known fields are surfaced;
+ *  everything else stays on `raw`. */
+interface PhoneShareInitiateResult {
+    /** The approval id to pass back to `phoneShareApprove`. */
+    approvalId?: string;
+    /** Whether the backend actually dispatched an OTP. */
+    codeSent?: boolean;
+    /** When the OTP / approval expires (ISO). OTP TTL is ~10 min. */
+    expiresAt?: string;
+    /** true when the (phone, email) pair was already approved — no OTP needed. */
+    alreadyApproved?: boolean;
+    raw: Record<string, unknown>;
+}
+/** Input for `phoneShareApprove`. */
+interface PhoneShareApproveInput {
+    /** The `approval_id` from the 409 body or from `phoneShareInitiate`. */
+    approvalId: string;
+    /** The one-time code the phone owner received. */
+    otp: string;
+}
+/** Result of `phoneShareApprove`. Known fields are surfaced; the rest stays on `raw`.
+ *  On success the grant is stored server-side, so the caller simply re-issues the
+ *  identical original request (the grant is auto-consumed). */
+interface PhoneShareApproveResult {
+    approvalId?: string;
+    /** true once the share is approved. */
+    approved?: boolean;
+    /** true when the pair was already approved before this call. */
+    alreadyApproved?: boolean;
+    expiresAt?: string;
+    raw: Record<string, unknown>;
+}
+/** Result of `phoneShareStatus` (idempotent GET). */
+interface PhoneShareStatusResult {
+    /** true when the (phone, email) pair is approved and the original request can be re-issued. */
+    approved: boolean;
+    raw: Record<string, unknown>;
+}
 
-export { type ApproveResult as A, type BalanceResult as B, type ClientConfig as C, type DestinationsQuery as D, type EnrollmentBeginResult as E, type PlayerBalanceResult as F, type InboundPendingQuery as G, type InboundPendingResult as H, InvoError as I, type LinkedIdentitiesQuery as J, type LinkedIdentitiesResult as K, type LinkDeviceResult as L, type SmsVerifyResult as M, type ClaimTransferInput as N, type OrderDetailsResult as O, type PendingCollectResult as P, type ClaimResult as Q, type Rail as R, type ServerConfig as S, type ClaimCurrencyInput as T, type TransactionStatusResult as U, type VerificationMethod as V, type GuardianApprovalStatusResult as W, type CurrencyBalance as X, type InboundPendingItem as Y, type LinkedIdentityEmail as Z, type CallOptions as a, type ConfirmReceiptResult as b, type DestinationsResult as c, type EnrollmentVerifyResult as d, type BalanceRow as e, type DestinationGame as f, type InvoErrorInfo as g, type InvoHooks as h, type InvoRequestInfo as i, type InvoResponseInfo as j, type PendingCollectItem as k, type PlayerToken as l, type InitiateSendInput as m, type InitiateResult as n, type InitiateTransferInput as o, type CreateCheckoutInput as p, type CreateCheckoutResult as q, type PurchaseInput as r, type PurchaseResult as s, type ConfirmPaymentResult as t, type PurchaseItemInput as u, type PurchaseItemResult as v, type ItemHistoryQuery as w, type ItemHistoryResult as x, type ItemOrderQuery as y, type PlayerBalanceQuery as z };
+export { type PhoneShareApproveResult as $, type ApproveResult as A, type BalanceResult as B, type ClientConfig as C, type DestinationsQuery as D, type EnrollmentBeginResult as E, type PlayerBalanceResult as F, type InboundPendingQuery as G, type InboundPendingResult as H, InvoError as I, type LinkedIdentitiesQuery as J, type LinkedIdentitiesResult as K, type LinkDeviceResult as L, type SmsVerifyResult as M, type ClaimTransferInput as N, type OrderDetailsResult as O, type PendingCollectResult as P, type ClaimResult as Q, type Rail as R, type ServerConfig as S, type ClaimCurrencyInput as T, type TransactionStatusResult as U, type VerificationMethod as V, type GuardianApprovalStatusResult as W, type ServerDestinationsQuery as X, type PhoneShareContact as Y, type PhoneShareInitiateResult as Z, type PhoneShareApproveInput as _, type CallOptions as a, type PhoneShareStatusResult as a0, type CurrencyBalance as a1, type InboundPendingItem as a2, type LinkedIdentityEmail as a3, type ConfirmReceiptResult as b, type DestinationsResult as c, type EnrollmentVerifyResult as d, type BalanceRow as e, type DestinationGame as f, type InvoErrorInfo as g, type InvoHooks as h, type InvoRequestInfo as i, type InvoResponseInfo as j, type PendingCollectItem as k, type PlayerToken as l, type InitiateSendInput as m, type InitiateResult as n, type InitiateTransferInput as o, type CreateCheckoutInput as p, type CreateCheckoutResult as q, type PurchaseInput as r, type PurchaseResult as s, type ConfirmPaymentResult as t, type PurchaseItemInput as u, type PurchaseItemResult as v, type ItemHistoryQuery as w, type ItemHistoryResult as x, type ItemOrderQuery as y, type PlayerBalanceQuery as z };

package/dist/{types-CPt_5_Aw.d.ts → types-DTAmriOB.d.ts}

@@ -39,6 +39,8 @@ declare class InvoError extends Error {
     get isInsufficientBalance(): boolean;
     /** True if a claim needs phone-share approval before it can complete (claim → 409). */
     get isPhoneShareApprovalRequired(): boolean;
+    /** True if the phone-share (phone, requesting_email) pair was already approved. */
+    get isPhoneShareAlreadyApproved(): boolean;
     /** True if an idempotency-keyed request was a duplicate (item purchase → 409). */
     get isDuplicateRequest(): boolean;
     /** Seconds to wait before retrying, when the backend throttled the call (429 `retry_after`). */
@@ -407,6 +409,14 @@ interface DestinationsQuery {
     /** "transfer" | "send". Defaults "transfer" (the set is identical for both today). */
     direction?: "transfer" | "send";
 }
+/** Server-side (game-secret) destinations query. Unlike the browser variant, the
+ *  source game isn't inferred from a player token — pass it explicitly. */
+interface ServerDestinationsQuery {
+    /** The game the player is sending/transferring FROM. */
+    sourceGameId: string | number;
+    /** "transfer" | "send". Defaults "transfer" (the set is identical for both today). */
+    direction?: "transfer" | "send";
+}
 /** A game/tenant this player can send/transfer to, with display metadata inline. */
 interface DestinationGame {
     gameId: string | number;
@@ -535,5 +545,53 @@ interface GuardianApprovalStatusResult {
     actionDescription?: string;
     raw: Record<string, unknown>;
 }
+/**
+ * A phone + requesting-email pair identifying a phone-share approval. Used to send
+ * the fallback OTP and to poll status. The server-side grant is keyed by this pair.
+ */
+interface PhoneShareContact {
+    /** The phone number whose owner must approve the share. */
+    phone: string;
+    /** The email of the account requesting to use that phone (requesting_email). */
+    email: string;
+}
+/** Result of `phoneShareInitiate` (fallback OTP send). Known fields are surfaced;
+ *  everything else stays on `raw`. */
+interface PhoneShareInitiateResult {
+    /** The approval id to pass back to `phoneShareApprove`. */
+    approvalId?: string;
+    /** Whether the backend actually dispatched an OTP. */
+    codeSent?: boolean;
+    /** When the OTP / approval expires (ISO). OTP TTL is ~10 min. */
+    expiresAt?: string;
+    /** true when the (phone, email) pair was already approved — no OTP needed. */
+    alreadyApproved?: boolean;
+    raw: Record<string, unknown>;
+}
+/** Input for `phoneShareApprove`. */
+interface PhoneShareApproveInput {
+    /** The `approval_id` from the 409 body or from `phoneShareInitiate`. */
+    approvalId: string;
+    /** The one-time code the phone owner received. */
+    otp: string;
+}
+/** Result of `phoneShareApprove`. Known fields are surfaced; the rest stays on `raw`.
+ *  On success the grant is stored server-side, so the caller simply re-issues the
+ *  identical original request (the grant is auto-consumed). */
+interface PhoneShareApproveResult {
+    approvalId?: string;
+    /** true once the share is approved. */
+    approved?: boolean;
+    /** true when the pair was already approved before this call. */
+    alreadyApproved?: boolean;
+    expiresAt?: string;
+    raw: Record<string, unknown>;
+}
+/** Result of `phoneShareStatus` (idempotent GET). */
+interface PhoneShareStatusResult {
+    /** true when the (phone, email) pair is approved and the original request can be re-issued. */
+    approved: boolean;
+    raw: Record<string, unknown>;
+}
 
-export { type ApproveResult as A, type BalanceResult as B, type ClientConfig as C, type DestinationsQuery as D, type EnrollmentBeginResult as E, type PlayerBalanceResult as F, type InboundPendingQuery as G, type InboundPendingResult as H, InvoError as I, type LinkedIdentitiesQuery as J, type LinkedIdentitiesResult as K, type LinkDeviceResult as L, type SmsVerifyResult as M, type ClaimTransferInput as N, type OrderDetailsResult as O, type PendingCollectResult as P, type ClaimResult as Q, type Rail as R, type ServerConfig as S, type ClaimCurrencyInput as T, type TransactionStatusResult as U, type VerificationMethod as V, type GuardianApprovalStatusResult as W, type CurrencyBalance as X, type InboundPendingItem as Y, type LinkedIdentityEmail as Z, type CallOptions as a, type ConfirmReceiptResult as b, type DestinationsResult as c, type EnrollmentVerifyResult as d, type BalanceRow as e, type DestinationGame as f, type InvoErrorInfo as g, type InvoHooks as h, type InvoRequestInfo as i, type InvoResponseInfo as j, type PendingCollectItem as k, type PlayerToken as l, type InitiateSendInput as m, type InitiateResult as n, type InitiateTransferInput as o, type CreateCheckoutInput as p, type CreateCheckoutResult as q, type PurchaseInput as r, type PurchaseResult as s, type ConfirmPaymentResult as t, type PurchaseItemInput as u, type PurchaseItemResult as v, type ItemHistoryQuery as w, type ItemHistoryResult as x, type ItemOrderQuery as y, type PlayerBalanceQuery as z };
+export { type PhoneShareApproveResult as $, type ApproveResult as A, type BalanceResult as B, type ClientConfig as C, type DestinationsQuery as D, type EnrollmentBeginResult as E, type PlayerBalanceResult as F, type InboundPendingQuery as G, type InboundPendingResult as H, InvoError as I, type LinkedIdentitiesQuery as J, type LinkedIdentitiesResult as K, type LinkDeviceResult as L, type SmsVerifyResult as M, type ClaimTransferInput as N, type OrderDetailsResult as O, type PendingCollectResult as P, type ClaimResult as Q, type Rail as R, type ServerConfig as S, type ClaimCurrencyInput as T, type TransactionStatusResult as U, type VerificationMethod as V, type GuardianApprovalStatusResult as W, type ServerDestinationsQuery as X, type PhoneShareContact as Y, type PhoneShareInitiateResult as Z, type PhoneShareApproveInput as _, type CallOptions as a, type PhoneShareStatusResult as a0, type CurrencyBalance as a1, type InboundPendingItem as a2, type LinkedIdentityEmail as a3, type ConfirmReceiptResult as b, type DestinationsResult as c, type EnrollmentVerifyResult as d, type BalanceRow as e, type DestinationGame as f, type InvoErrorInfo as g, type InvoHooks as h, type InvoRequestInfo as i, type InvoResponseInfo as j, type PendingCollectItem as k, type PlayerToken as l, type InitiateSendInput as m, type InitiateResult as n, type InitiateTransferInput as o, type CreateCheckoutInput as p, type CreateCheckoutResult as q, type PurchaseInput as r, type PurchaseResult as s, type ConfirmPaymentResult as t, type PurchaseItemInput as u, type PurchaseItemResult as v, type ItemHistoryQuery as w, type ItemHistoryResult as x, type ItemOrderQuery as y, type PlayerBalanceQuery as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invonetwork/web-sdk",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "INVO Web SDK — currency purchase + passkey (WebAuthn) verification for partner web platforms.",
   "license": "SEE LICENSE IN LICENSE",
   "private": false,