@invonetwork/web-sdk 1.2.0 → 1.2.1

package/CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to `@invonetwork/web-sdk` are documented here. This project
 [Semantic Versioning](https://semver.org/). Releases are managed with
 [changesets](https://github.com/changesets/changesets).
 
+## [1.2.1] — 2026-07-01
+
+**Fix — browser "Illegal invocation".** The SDK invoked its fetch as `this.fetchImpl(...)`,
+so the browser's native `fetch` ran with the wrong `this` and threw
+`TypeError: Illegal invocation` — breaking every browser `InvoClient` read
+(balance/destinations/pending) and the passkey ceremonies when using the default global
+`fetch` (retries then made it slow on top). The fetch impl is now bound to `globalThis`
+(harmless for a custom `fetch`). No API change. Node/tests were unaffected, which is why it
+slipped through — added a `this`-sensitive regression test.
+
 ## [1.2.0] — 2026-07-01
 
 Two more server-side capabilities on `InvoServer`.
@@ -73,7 +83,7 @@ Start of the **discovery layer** for send/transfer UIs.
 
 ## [0.6.0] — 2026-07-01
 
-Three additive browser flows the dashboard needed, built to the live backend contracts.
+Three additive browser flows for partner front-ends, built to the live backend contracts.
 
 - **`InvoClient.getPendingCollect()`** — the player's own pending-to-collect list
   (player-token `GET /api/sdk/transfers/pending`), PII-free. Each row's `kind`

package/README.md

@@ -117,6 +117,11 @@ const client = new InvoClient({
 
 The WebAuthn ceremony still runs in the browser (it must — it's `navigator.credentials`), but transport/auth stays behind your proxy. You keep the SDK's ceremony handling, token-refresh, typed holds, and error classifiers either way.
 
+**Running `InvoServer` in the proxy** (for the game-secret writes — initiate, checkout, purchase — so the secret leaves the browser): see the drop-in reference at [`examples/proxy-server.ts`](examples/proxy-server.ts). Its actor resolver is pluggable:
+
+- **Real partner** (one login = one player) — derive the acting player from your **session**.
+- **Trusted first-party rig** (an internal tool that impersonates arbitrary test players) — the caller names `playerEmail`, guarded by a shared-secret header (`INVO_PROXY_TRUSTED_SECRET`), the same trusted pattern as a `player_email` token minter. Never expose this mode to end-user browsers.
+
 > **Lowest-risk first step:** adopt just `linkDevice` (passkey ↔ app device interchange) — it's purely additive and needs no refactor. See [Passkeys](#passkeys-enroll-approve-link).
 
 ## Before you go live

package/dist/{chunk-P65XQ6VF.js → chunk-U3EDJUQI.js}

@@ -104,7 +104,7 @@ var _Http = class _Http {
         "No fetch implementation available. Use Node >=18, or pass `fetch` in the config."
       );
     }
-    this.fetchImpl = f;
+    this.fetchImpl = f.bind(globalThis);
     this.userAgent = opts.userAgent;
     this.maxRetries = Math.max(0, opts.maxRetries ?? 2);
     this.retryBaseDelayMs = opts.retryBaseDelayMs ?? 250;
@@ -308,5 +308,5 @@ function toDestinationsResult(raw, direction) {
 }
 
 export { Http, InvoError, assertSecureBaseUrl, toDestinationsResult };
-//# sourceMappingURL=chunk-P65XQ6VF.js.map
-//# sourceMappingURL=chunk-P65XQ6VF.js.map
+//# sourceMappingURL=chunk-U3EDJUQI.js.map
+//# sourceMappingURL=chunk-U3EDJUQI.js.map

package/dist/index.cjs

@@ -106,7 +106,7 @@ var _Http = class _Http {
         "No fetch implementation available. Use Node >=18, or pass `fetch` in the config."
       );
     }
-    this.fetchImpl = f;
+    this.fetchImpl = f.bind(globalThis);
     this.userAgent = opts.userAgent;
     this.maxRetries = Math.max(0, opts.maxRetries ?? 2);
     this.retryBaseDelayMs = opts.retryBaseDelayMs ?? 250;

package/dist/index.js

@@ -1,5 +1,5 @@
-import { assertSecureBaseUrl, Http, toDestinationsResult, InvoError } from './chunk-P65XQ6VF.js';
-export { InvoError } from './chunk-P65XQ6VF.js';
+import { assertSecureBaseUrl, Http, toDestinationsResult, InvoError } from './chunk-U3EDJUQI.js';
+export { InvoError } from './chunk-U3EDJUQI.js';
 
 // src/shared/webauthn.ts
 function b64urlToBuffer(value) {

package/dist/server.cjs

@@ -108,7 +108,7 @@ var _Http = class _Http {
         "No fetch implementation available. Use Node >=18, or pass `fetch` in the config."
       );
     }
-    this.fetchImpl = f;
+    this.fetchImpl = f.bind(globalThis);
     this.userAgent = opts.userAgent;
     this.maxRetries = Math.max(0, opts.maxRetries ?? 2);
     this.retryBaseDelayMs = opts.retryBaseDelayMs ?? 250;
@@ -469,7 +469,7 @@ async function hmacHexSubtle(secret, message) {
 }
 
 // src/server.ts
-var DEFAULT_UA = "invonetwork-web-sdk/1.2.0 (+https://invo.network)";
+var DEFAULT_UA = "invonetwork-web-sdk/1.2.1 (+https://invo.network)";
 var MAX_USD_AMOUNT = 999.99;
 var MAX_ITEM_PRICE = 999999.99;
 function invalidInput(label, value, why) {

package/dist/server.js

@@ -1,5 +1,5 @@
-import { InvoError, assertSecureBaseUrl, Http, toDestinationsResult } from './chunk-P65XQ6VF.js';
-export { InvoError } from './chunk-P65XQ6VF.js';
+import { InvoError, assertSecureBaseUrl, Http, toDestinationsResult } from './chunk-U3EDJUQI.js';
+export { InvoError } from './chunk-U3EDJUQI.js';
 import { createHmac } from 'crypto';
 
 var DEFAULT_TOLERANCE_SEC = 300;
@@ -161,7 +161,7 @@ async function hmacHexSubtle(secret, message) {
 }
 
 // src/server.ts
-var DEFAULT_UA = "invonetwork-web-sdk/1.2.0 (+https://invo.network)";
+var DEFAULT_UA = "invonetwork-web-sdk/1.2.1 (+https://invo.network)";
 var MAX_USD_AMOUNT = 999.99;
 var MAX_ITEM_PRICE = 999999.99;
 function invalidInput(label, value, why) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invonetwork/web-sdk",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "INVO Web SDK — currency purchase + passkey (WebAuthn) verification for partner web platforms.",
   "license": "SEE LICENSE IN LICENSE",
   "private": false,