@fzgame/sdk 0.0.0-stage → 0.3.1

package/dist/index.js

@@ -0,0 +1,144 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  APP_KEY_HEADER: () => APP_KEY_HEADER,
+  APP_SECRET_HEADER: () => APP_SECRET_HEADER,
+  SdkConfigError: () => SdkConfigError,
+  SdkNotInitializedError: () => SdkNotInitializedError,
+  createSdkClient: () => createSdkClient,
+  fetchClient: () => fetchClient,
+  initializeSDK: () => initializeSDK,
+  resolveGameURL: () => resolveGameURL
+});
+module.exports = __toCommonJS(src_exports);
+
+// src/sdk.ts
+var import_openapi_fetch = __toESM(require("openapi-fetch"));
+var APP_KEY_HEADER = "x-app-key";
+var APP_SECRET_HEADER = "x-app-secret";
+var SdkNotInitializedError = class extends Error {
+  constructor() {
+    super("Call initializeSDK() or createSdkClient() before the first request");
+    this.name = "SdkNotInitializedError";
+  }
+};
+var SdkConfigError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SdkConfigError";
+  }
+};
+function resolveApiUrl(apiUrl) {
+  const trimmed = (apiUrl ?? "").trim().replace(/\/+$/, "");
+  if (!trimmed) {
+    throw new SdkConfigError("apiUrl is required, for example https://api.example.com");
+  }
+  return trimmed;
+}
+function withTimeout(fetchImpl, timeoutMs) {
+  const base = fetchImpl ?? globalThis.fetch;
+  if (!timeoutMs || timeoutMs <= 0) return base;
+  return (input, init) => {
+    const caller = init?.signal ?? (input instanceof Request ? input.signal : void 0);
+    const deadline = AbortSignal.timeout(timeoutMs);
+    return base(input, { ...init, signal: caller ? AbortSignal.any([caller, deadline]) : deadline });
+  };
+}
+function authMiddleware({ appKey, appSecret }) {
+  return {
+    async onRequest({ request }) {
+      if (!appKey && !appSecret) return request;
+      const next = new Request(request);
+      if (appKey) next.headers.set(APP_KEY_HEADER, appKey);
+      if (appSecret) next.headers.set(APP_SECRET_HEADER, appSecret);
+      return next;
+    }
+  };
+}
+function createSdkClient(options) {
+  const client = (0, import_openapi_fetch.default)({
+    baseUrl: resolveApiUrl(options.apiUrl),
+    fetch: withTimeout(options.fetch, options.timeoutMs)
+  });
+  client.use(authMiddleware(options));
+  return client;
+}
+var active = null;
+var activeApiUrl = null;
+var fetchClient = new Proxy({}, {
+  get(_target, property) {
+    if (typeof property === "symbol") return void 0;
+    if (!active) throw new SdkNotInitializedError();
+    const value = active[property];
+    return typeof value === "function" ? value.bind(active) : value;
+  }
+});
+function initializeSDK(options) {
+  activeApiUrl = resolveApiUrl(options.apiUrl);
+  active = createSdkClient(options);
+  return active;
+}
+function resolveGameURL(gameInstance, playerAccessToken, options = {}) {
+  const entryPoint = gameInstance?.resolvedUrl;
+  if (!entryPoint) {
+    throw new SdkConfigError("gameInstance.resolvedUrl is required to build a play URL");
+  }
+  const token = playerAccessToken?.trim();
+  if (!token) {
+    throw new SdkConfigError("playerAccessToken is required");
+  }
+  const apiUrl = options.apiUrl?.trim() || activeApiUrl;
+  if (!apiUrl) {
+    throw new SdkConfigError("apiUrl is required: call initializeSDK() first, or pass { apiUrl }");
+  }
+  const url = new URL(entryPoint);
+  url.searchParams.set("apiUrl", resolveApiUrl(apiUrl));
+  url.searchParams.set("gameInstanceId", gameInstance.id);
+  url.searchParams.set("playerAccessToken", token);
+  const config = options.config ?? gameInstance.overrides;
+  if (config && Object.keys(config).length) {
+    url.searchParams.set("gameSetting", JSON.stringify(config));
+  }
+  return url.toString();
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  APP_KEY_HEADER,
+  APP_SECRET_HEADER,
+  SdkConfigError,
+  SdkNotInitializedError,
+  createSdkClient,
+  fetchClient,
+  initializeSDK,
+  resolveGameURL
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/sdk.ts"],"sourcesContent":["export {\n  APP_KEY_HEADER,\n  APP_SECRET_HEADER,\n  SdkConfigError,\n  SdkNotInitializedError,\n  createSdkClient,\n  fetchClient,\n  initializeSDK,\n  resolveGameURL,\n} from './sdk'\nexport type { GameInstance, InitOptions, ResolveGameUrlOptions } from './sdk'\nexport type { components, operations, paths } from './types/schema'\n","import createClient, { type Client, type Middleware } from 'openapi-fetch'\n\nimport type { components, paths } from './types/schema'\n\n/** Header names the server reads app credentials from (`apps/server/src/auth/auth.guard.ts`). */\nexport const APP_KEY_HEADER = 'x-app-key'\nexport const APP_SECRET_HEADER = 'x-app-secret'\n\nexport type InitOptions = {\n  /** Base URL of the API, without a trailing slash. */\n  apiUrl: string\n  /** Sent as `x-app-key`: the app's `id`, which the auth guard looks the app up by. */\n  appKey?: string\n  /** Sent as `x-app-secret`: one of the app's credential `clientSecret` values. */\n  appSecret?: string\n  /** Abort a request after this many milliseconds. `0` or unset means no timeout. */\n  timeoutMs?: number\n  /** Override the fetch implementation, for a Node polyfill or a test. */\n  fetch?: typeof globalThis.fetch\n}\n\n/** Thrown when a request is made before any credentials were configured. */\nexport class SdkNotInitializedError extends Error {\n  constructor() {\n    super('Call initializeSDK() or createSdkClient() before the first request')\n    this.name = 'SdkNotInitializedError'\n  }\n}\n\nexport class SdkConfigError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'SdkConfigError'\n  }\n}\n\nfunction resolveApiUrl(apiUrl: string | undefined): string {\n  const trimmed = (apiUrl ?? '').trim().replace(/\\/+$/, '')\n  if (!trimmed) {\n    throw new SdkConfigError('apiUrl is required, for example https://api.example.com')\n  }\n  return trimmed\n}\n\nfunction withTimeout(\n  fetchImpl: typeof globalThis.fetch | undefined,\n  timeoutMs: number | undefined,\n): typeof globalThis.fetch {\n  const base = fetchImpl ?? globalThis.fetch\n  if (!timeoutMs || timeoutMs <= 0) return base\n  return (input, init) => {\n    // openapi-fetch calls fetch(request) with no init and folds the caller's\n    // signal into the request, so look both places before combining.\n    const caller = init?.signal ?? (input instanceof Request ? input.signal : undefined)\n    const deadline = AbortSignal.timeout(timeoutMs)\n    // `any` keeps the caller's cancellation working: the deadline must not\n    // replace a signal the caller uses for reasons of its own.\n    return base(input, { ...init, signal: caller ? AbortSignal.any([caller, deadline]) : deadline })\n  }\n}\n\n/**\n * App credentials travel in headers, not in the generated document: the server's\n * OpenAPI spec declares `securitySchemes: {}`, so nothing is typed for this and\n * the client has to attach them.\n */\nfunction authMiddleware({ appKey, appSecret }: InitOptions): Middleware {\n  return {\n    async onRequest({ request }) {\n      if (!appKey && !appSecret) return request\n      // A fresh Request owns mutable headers, unlike a request handed to a guarded fetch.\n      const next = new Request(request)\n      if (appKey) next.headers.set(APP_KEY_HEADER, appKey)\n      if (appSecret) next.headers.set(APP_SECRET_HEADER, appSecret)\n      return next\n    },\n  }\n}\n\n/**\n * A client with its own base URL and credentials. Use this when a process serves\n * more than one app: each client is independent, so one tenant's configuration\n * cannot overwrite another's.\n */\nexport function createSdkClient(options: InitOptions): Client<paths> {\n  const client = createClient<paths>({\n    baseUrl: resolveApiUrl(options.apiUrl),\n    fetch: withTimeout(options.fetch, options.timeoutMs),\n  })\n  client.use(authMiddleware(options))\n  return client\n}\n\nlet active: Client<paths> | null = null\n/** The `apiUrl` of the process-wide client, so `resolveGameURL` can reuse it. */\nlet activeApiUrl: string | null = null\n\n/**\n * Process-wide client configured by `initializeSDK` or `<SDKInitializer>`.\n *\n * Before the first initialization every access throws `SdkNotInitializedError`,\n * so a mis-ordered import fails where it happens instead of sending a request to\n * a placeholder origin.\n */\nexport const fetchClient: Client<paths> = new Proxy({} as Client<paths>, {\n  get(_target, property) {\n    if (typeof property === 'symbol') return undefined\n    if (!active) throw new SdkNotInitializedError()\n    const value = (active as unknown as Record<string, unknown>)[property]\n    return typeof value === 'function'\n      ? (value as (...args: unknown[]) => unknown).bind(active)\n      : value\n  },\n})\n\n/** Configure the process-wide client and return it. */\nexport function initializeSDK(options: InitOptions): Client<paths> {\n  activeApiUrl = resolveApiUrl(options.apiUrl)\n  active = createSdkClient(options)\n  return active\n}\n\n/** A game instance from `GET /sdk/game-instances`, as generated from the OpenAPI document. */\nexport type GameInstance = components['schemas']['AppGameInstance']\n\nexport type ResolveGameUrlOptions = {\n  /** API base URL the frame calls. Defaults to the `apiUrl` passed to `initializeSDK`. */\n  apiUrl?: string\n  /** Config to hand the game as `gameSetting`. Defaults to the instance overrides. */\n  config?: Record<string, unknown> | null\n}\n\n/**\n * Build the URL the host loads in an iframe or webview from the game instance\n * and the token `POST /sdk/login` returned. It appends `apiUrl`,\n * `gameInstanceId`, `playerAccessToken`, and `gameSetting`.\n *\n * `apiUrl` defaults to the one given to `initializeSDK`. A caller that uses\n * `createSdkClient` instead must pass `{ apiUrl }`, because that client is not\n * the process-wide one.\n */\nexport function resolveGameURL(\n  gameInstance: GameInstance,\n  playerAccessToken: string,\n  options: ResolveGameUrlOptions = {},\n): string {\n  const entryPoint = gameInstance?.resolvedUrl\n  if (!entryPoint) {\n    throw new SdkConfigError('gameInstance.resolvedUrl is required to build a play URL')\n  }\n  const token = playerAccessToken?.trim()\n  if (!token) {\n    throw new SdkConfigError('playerAccessToken is required')\n  }\n  const apiUrl = options.apiUrl?.trim() || activeApiUrl\n  if (!apiUrl) {\n    throw new SdkConfigError('apiUrl is required: call initializeSDK() first, or pass { apiUrl }')\n  }\n\n  const url = new URL(entryPoint)\n  url.searchParams.set('apiUrl', resolveApiUrl(apiUrl))\n  url.searchParams.set('gameInstanceId', gameInstance.id)\n  url.searchParams.set('playerAccessToken', token)\n\n  const config = options.config ?? gameInstance.overrides\n  if (config && Object.keys(config).length) {\n    url.searchParams.set('gameSetting', JSON.stringify(config))\n  }\n  return url.toString()\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,2BAA2D;AAKpD,IAAM,iBAAiB;AACvB,IAAM,oBAAoB;AAgB1B,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,cAAc;AACZ,UAAM,oEAAoE;AAC1E,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,cAAc,QAAoC;AACzD,QAAM,WAAW,UAAU,IAAI,KAAK,EAAE,QAAQ,QAAQ,EAAE;AACxD,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,eAAe,yDAAyD;AAAA,EACpF;AACA,SAAO;AACT;AAEA,SAAS,YACP,WACA,WACyB;AACzB,QAAM,OAAO,aAAa,WAAW;AACrC,MAAI,CAAC,aAAa,aAAa,EAAG,QAAO;AACzC,SAAO,CAAC,OAAO,SAAS;AAGtB,UAAM,SAAS,MAAM,WAAW,iBAAiB,UAAU,MAAM,SAAS;AAC1E,UAAM,WAAW,YAAY,QAAQ,SAAS;AAG9C,WAAO,KAAK,OAAO,EAAE,GAAG,MAAM,QAAQ,SAAS,YAAY,IAAI,CAAC,QAAQ,QAAQ,CAAC,IAAI,SAAS,CAAC;AAAA,EACjG;AACF;AAOA,SAAS,eAAe,EAAE,QAAQ,UAAU,GAA4B;AACtE,SAAO;AAAA,IACL,MAAM,UAAU,EAAE,QAAQ,GAAG;AAC3B,UAAI,CAAC,UAAU,CAAC,UAAW,QAAO;AAElC,YAAM,OAAO,IAAI,QAAQ,OAAO;AAChC,UAAI,OAAQ,MAAK,QAAQ,IAAI,gBAAgB,MAAM;AACnD,UAAI,UAAW,MAAK,QAAQ,IAAI,mBAAmB,SAAS;AAC5D,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAOO,SAAS,gBAAgB,SAAqC;AACnE,QAAM,aAAS,qBAAAA,SAAoB;AAAA,IACjC,SAAS,cAAc,QAAQ,MAAM;AAAA,IACrC,OAAO,YAAY,QAAQ,OAAO,QAAQ,SAAS;AAAA,EACrD,CAAC;AACD,SAAO,IAAI,eAAe,OAAO,CAAC;AAClC,SAAO;AACT;AAEA,IAAI,SAA+B;AAEnC,IAAI,eAA8B;AAS3B,IAAM,cAA6B,IAAI,MAAM,CAAC,GAAoB;AAAA,EACvE,IAAI,SAAS,UAAU;AACrB,QAAI,OAAO,aAAa,SAAU,QAAO;AACzC,QAAI,CAAC,OAAQ,OAAM,IAAI,uBAAuB;AAC9C,UAAM,QAAS,OAA8C,QAAQ;AACrE,WAAO,OAAO,UAAU,aACnB,MAA0C,KAAK,MAAM,IACtD;AAAA,EACN;AACF,CAAC;AAGM,SAAS,cAAc,SAAqC;AACjE,iBAAe,cAAc,QAAQ,MAAM;AAC3C,WAAS,gBAAgB,OAAO;AAChC,SAAO;AACT;AAqBO,SAAS,eACd,cACA,mBACA,UAAiC,CAAC,GAC1B;AACR,QAAM,aAAa,cAAc;AACjC,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,eAAe,0DAA0D;AAAA,EACrF;AACA,QAAM,QAAQ,mBAAmB,KAAK;AACtC,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,eAAe,+BAA+B;AAAA,EAC1D;AACA,QAAM,SAAS,QAAQ,QAAQ,KAAK,KAAK;AACzC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,eAAe,oEAAoE;AAAA,EAC/F;AAEA,QAAM,MAAM,IAAI,IAAI,UAAU;AAC9B,MAAI,aAAa,IAAI,UAAU,cAAc,MAAM,CAAC;AACpD,MAAI,aAAa,IAAI,kBAAkB,aAAa,EAAE;AACtD,MAAI,aAAa,IAAI,qBAAqB,KAAK;AAE/C,QAAM,SAAS,QAAQ,UAAU,aAAa;AAC9C,MAAI,UAAU,OAAO,KAAK,MAAM,EAAE,QAAQ;AACxC,QAAI,aAAa,IAAI,eAAe,KAAK,UAAU,MAAM,CAAC;AAAA,EAC5D;AACA,SAAO,IAAI,SAAS;AACtB;","names":["createClient"]}

package/dist/index.mjs

@@ -0,0 +1,100 @@
+// src/sdk.ts
+import createClient from "openapi-fetch";
+var APP_KEY_HEADER = "x-app-key";
+var APP_SECRET_HEADER = "x-app-secret";
+var SdkNotInitializedError = class extends Error {
+  constructor() {
+    super("Call initializeSDK() or createSdkClient() before the first request");
+    this.name = "SdkNotInitializedError";
+  }
+};
+var SdkConfigError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SdkConfigError";
+  }
+};
+function resolveApiUrl(apiUrl) {
+  const trimmed = (apiUrl ?? "").trim().replace(/\/+$/, "");
+  if (!trimmed) {
+    throw new SdkConfigError("apiUrl is required, for example https://api.example.com");
+  }
+  return trimmed;
+}
+function withTimeout(fetchImpl, timeoutMs) {
+  const base = fetchImpl ?? globalThis.fetch;
+  if (!timeoutMs || timeoutMs <= 0) return base;
+  return (input, init) => {
+    const caller = init?.signal ?? (input instanceof Request ? input.signal : void 0);
+    const deadline = AbortSignal.timeout(timeoutMs);
+    return base(input, { ...init, signal: caller ? AbortSignal.any([caller, deadline]) : deadline });
+  };
+}
+function authMiddleware({ appKey, appSecret }) {
+  return {
+    async onRequest({ request }) {
+      if (!appKey && !appSecret) return request;
+      const next = new Request(request);
+      if (appKey) next.headers.set(APP_KEY_HEADER, appKey);
+      if (appSecret) next.headers.set(APP_SECRET_HEADER, appSecret);
+      return next;
+    }
+  };
+}
+function createSdkClient(options) {
+  const client = createClient({
+    baseUrl: resolveApiUrl(options.apiUrl),
+    fetch: withTimeout(options.fetch, options.timeoutMs)
+  });
+  client.use(authMiddleware(options));
+  return client;
+}
+var active = null;
+var activeApiUrl = null;
+var fetchClient = new Proxy({}, {
+  get(_target, property) {
+    if (typeof property === "symbol") return void 0;
+    if (!active) throw new SdkNotInitializedError();
+    const value = active[property];
+    return typeof value === "function" ? value.bind(active) : value;
+  }
+});
+function initializeSDK(options) {
+  activeApiUrl = resolveApiUrl(options.apiUrl);
+  active = createSdkClient(options);
+  return active;
+}
+function resolveGameURL(gameInstance, playerAccessToken, options = {}) {
+  const entryPoint = gameInstance?.resolvedUrl;
+  if (!entryPoint) {
+    throw new SdkConfigError("gameInstance.resolvedUrl is required to build a play URL");
+  }
+  const token = playerAccessToken?.trim();
+  if (!token) {
+    throw new SdkConfigError("playerAccessToken is required");
+  }
+  const apiUrl = options.apiUrl?.trim() || activeApiUrl;
+  if (!apiUrl) {
+    throw new SdkConfigError("apiUrl is required: call initializeSDK() first, or pass { apiUrl }");
+  }
+  const url = new URL(entryPoint);
+  url.searchParams.set("apiUrl", resolveApiUrl(apiUrl));
+  url.searchParams.set("gameInstanceId", gameInstance.id);
+  url.searchParams.set("playerAccessToken", token);
+  const config = options.config ?? gameInstance.overrides;
+  if (config && Object.keys(config).length) {
+    url.searchParams.set("gameSetting", JSON.stringify(config));
+  }
+  return url.toString();
+}
+export {
+  APP_KEY_HEADER,
+  APP_SECRET_HEADER,
+  SdkConfigError,
+  SdkNotInitializedError,
+  createSdkClient,
+  fetchClient,
+  initializeSDK,
+  resolveGameURL
+};
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sdk.ts"],"sourcesContent":["import createClient, { type Client, type Middleware } from 'openapi-fetch'\n\nimport type { components, paths } from './types/schema'\n\n/** Header names the server reads app credentials from (`apps/server/src/auth/auth.guard.ts`). */\nexport const APP_KEY_HEADER = 'x-app-key'\nexport const APP_SECRET_HEADER = 'x-app-secret'\n\nexport type InitOptions = {\n  /** Base URL of the API, without a trailing slash. */\n  apiUrl: string\n  /** Sent as `x-app-key`: the app's `id`, which the auth guard looks the app up by. */\n  appKey?: string\n  /** Sent as `x-app-secret`: one of the app's credential `clientSecret` values. */\n  appSecret?: string\n  /** Abort a request after this many milliseconds. `0` or unset means no timeout. */\n  timeoutMs?: number\n  /** Override the fetch implementation, for a Node polyfill or a test. */\n  fetch?: typeof globalThis.fetch\n}\n\n/** Thrown when a request is made before any credentials were configured. */\nexport class SdkNotInitializedError extends Error {\n  constructor() {\n    super('Call initializeSDK() or createSdkClient() before the first request')\n    this.name = 'SdkNotInitializedError'\n  }\n}\n\nexport class SdkConfigError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'SdkConfigError'\n  }\n}\n\nfunction resolveApiUrl(apiUrl: string | undefined): string {\n  const trimmed = (apiUrl ?? '').trim().replace(/\\/+$/, '')\n  if (!trimmed) {\n    throw new SdkConfigError('apiUrl is required, for example https://api.example.com')\n  }\n  return trimmed\n}\n\nfunction withTimeout(\n  fetchImpl: typeof globalThis.fetch | undefined,\n  timeoutMs: number | undefined,\n): typeof globalThis.fetch {\n  const base = fetchImpl ?? globalThis.fetch\n  if (!timeoutMs || timeoutMs <= 0) return base\n  return (input, init) => {\n    // openapi-fetch calls fetch(request) with no init and folds the caller's\n    // signal into the request, so look both places before combining.\n    const caller = init?.signal ?? (input instanceof Request ? input.signal : undefined)\n    const deadline = AbortSignal.timeout(timeoutMs)\n    // `any` keeps the caller's cancellation working: the deadline must not\n    // replace a signal the caller uses for reasons of its own.\n    return base(input, { ...init, signal: caller ? AbortSignal.any([caller, deadline]) : deadline })\n  }\n}\n\n/**\n * App credentials travel in headers, not in the generated document: the server's\n * OpenAPI spec declares `securitySchemes: {}`, so nothing is typed for this and\n * the client has to attach them.\n */\nfunction authMiddleware({ appKey, appSecret }: InitOptions): Middleware {\n  return {\n    async onRequest({ request }) {\n      if (!appKey && !appSecret) return request\n      // A fresh Request owns mutable headers, unlike a request handed to a guarded fetch.\n      const next = new Request(request)\n      if (appKey) next.headers.set(APP_KEY_HEADER, appKey)\n      if (appSecret) next.headers.set(APP_SECRET_HEADER, appSecret)\n      return next\n    },\n  }\n}\n\n/**\n * A client with its own base URL and credentials. Use this when a process serves\n * more than one app: each client is independent, so one tenant's configuration\n * cannot overwrite another's.\n */\nexport function createSdkClient(options: InitOptions): Client<paths> {\n  const client = createClient<paths>({\n    baseUrl: resolveApiUrl(options.apiUrl),\n    fetch: withTimeout(options.fetch, options.timeoutMs),\n  })\n  client.use(authMiddleware(options))\n  return client\n}\n\nlet active: Client<paths> | null = null\n/** The `apiUrl` of the process-wide client, so `resolveGameURL` can reuse it. */\nlet activeApiUrl: string | null = null\n\n/**\n * Process-wide client configured by `initializeSDK` or `<SDKInitializer>`.\n *\n * Before the first initialization every access throws `SdkNotInitializedError`,\n * so a mis-ordered import fails where it happens instead of sending a request to\n * a placeholder origin.\n */\nexport const fetchClient: Client<paths> = new Proxy({} as Client<paths>, {\n  get(_target, property) {\n    if (typeof property === 'symbol') return undefined\n    if (!active) throw new SdkNotInitializedError()\n    const value = (active as unknown as Record<string, unknown>)[property]\n    return typeof value === 'function'\n      ? (value as (...args: unknown[]) => unknown).bind(active)\n      : value\n  },\n})\n\n/** Configure the process-wide client and return it. */\nexport function initializeSDK(options: InitOptions): Client<paths> {\n  activeApiUrl = resolveApiUrl(options.apiUrl)\n  active = createSdkClient(options)\n  return active\n}\n\n/** A game instance from `GET /sdk/game-instances`, as generated from the OpenAPI document. */\nexport type GameInstance = components['schemas']['AppGameInstance']\n\nexport type ResolveGameUrlOptions = {\n  /** API base URL the frame calls. Defaults to the `apiUrl` passed to `initializeSDK`. */\n  apiUrl?: string\n  /** Config to hand the game as `gameSetting`. Defaults to the instance overrides. */\n  config?: Record<string, unknown> | null\n}\n\n/**\n * Build the URL the host loads in an iframe or webview from the game instance\n * and the token `POST /sdk/login` returned. It appends `apiUrl`,\n * `gameInstanceId`, `playerAccessToken`, and `gameSetting`.\n *\n * `apiUrl` defaults to the one given to `initializeSDK`. A caller that uses\n * `createSdkClient` instead must pass `{ apiUrl }`, because that client is not\n * the process-wide one.\n */\nexport function resolveGameURL(\n  gameInstance: GameInstance,\n  playerAccessToken: string,\n  options: ResolveGameUrlOptions = {},\n): string {\n  const entryPoint = gameInstance?.resolvedUrl\n  if (!entryPoint) {\n    throw new SdkConfigError('gameInstance.resolvedUrl is required to build a play URL')\n  }\n  const token = playerAccessToken?.trim()\n  if (!token) {\n    throw new SdkConfigError('playerAccessToken is required')\n  }\n  const apiUrl = options.apiUrl?.trim() || activeApiUrl\n  if (!apiUrl) {\n    throw new SdkConfigError('apiUrl is required: call initializeSDK() first, or pass { apiUrl }')\n  }\n\n  const url = new URL(entryPoint)\n  url.searchParams.set('apiUrl', resolveApiUrl(apiUrl))\n  url.searchParams.set('gameInstanceId', gameInstance.id)\n  url.searchParams.set('playerAccessToken', token)\n\n  const config = options.config ?? gameInstance.overrides\n  if (config && Object.keys(config).length) {\n    url.searchParams.set('gameSetting', JSON.stringify(config))\n  }\n  return url.toString()\n}\n"],"mappings":";AAAA,OAAO,kBAAoD;AAKpD,IAAM,iBAAiB;AACvB,IAAM,oBAAoB;AAgB1B,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,cAAc;AACZ,UAAM,oEAAoE;AAC1E,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,cAAc,QAAoC;AACzD,QAAM,WAAW,UAAU,IAAI,KAAK,EAAE,QAAQ,QAAQ,EAAE;AACxD,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,eAAe,yDAAyD;AAAA,EACpF;AACA,SAAO;AACT;AAEA,SAAS,YACP,WACA,WACyB;AACzB,QAAM,OAAO,aAAa,WAAW;AACrC,MAAI,CAAC,aAAa,aAAa,EAAG,QAAO;AACzC,SAAO,CAAC,OAAO,SAAS;AAGtB,UAAM,SAAS,MAAM,WAAW,iBAAiB,UAAU,MAAM,SAAS;AAC1E,UAAM,WAAW,YAAY,QAAQ,SAAS;AAG9C,WAAO,KAAK,OAAO,EAAE,GAAG,MAAM,QAAQ,SAAS,YAAY,IAAI,CAAC,QAAQ,QAAQ,CAAC,IAAI,SAAS,CAAC;AAAA,EACjG;AACF;AAOA,SAAS,eAAe,EAAE,QAAQ,UAAU,GAA4B;AACtE,SAAO;AAAA,IACL,MAAM,UAAU,EAAE,QAAQ,GAAG;AAC3B,UAAI,CAAC,UAAU,CAAC,UAAW,QAAO;AAElC,YAAM,OAAO,IAAI,QAAQ,OAAO;AAChC,UAAI,OAAQ,MAAK,QAAQ,IAAI,gBAAgB,MAAM;AACnD,UAAI,UAAW,MAAK,QAAQ,IAAI,mBAAmB,SAAS;AAC5D,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAOO,SAAS,gBAAgB,SAAqC;AACnE,QAAM,SAAS,aAAoB;AAAA,IACjC,SAAS,cAAc,QAAQ,MAAM;AAAA,IACrC,OAAO,YAAY,QAAQ,OAAO,QAAQ,SAAS;AAAA,EACrD,CAAC;AACD,SAAO,IAAI,eAAe,OAAO,CAAC;AAClC,SAAO;AACT;AAEA,IAAI,SAA+B;AAEnC,IAAI,eAA8B;AAS3B,IAAM,cAA6B,IAAI,MAAM,CAAC,GAAoB;AAAA,EACvE,IAAI,SAAS,UAAU;AACrB,QAAI,OAAO,aAAa,SAAU,QAAO;AACzC,QAAI,CAAC,OAAQ,OAAM,IAAI,uBAAuB;AAC9C,UAAM,QAAS,OAA8C,QAAQ;AACrE,WAAO,OAAO,UAAU,aACnB,MAA0C,KAAK,MAAM,IACtD;AAAA,EACN;AACF,CAAC;AAGM,SAAS,cAAc,SAAqC;AACjE,iBAAe,cAAc,QAAQ,MAAM;AAC3C,WAAS,gBAAgB,OAAO;AAChC,SAAO;AACT;AAqBO,SAAS,eACd,cACA,mBACA,UAAiC,CAAC,GAC1B;AACR,QAAM,aAAa,cAAc;AACjC,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,eAAe,0DAA0D;AAAA,EACrF;AACA,QAAM,QAAQ,mBAAmB,KAAK;AACtC,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,eAAe,+BAA+B;AAAA,EAC1D;AACA,QAAM,SAAS,QAAQ,QAAQ,KAAK,KAAK;AACzC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,eAAe,oEAAoE;AAAA,EAC/F;AAEA,QAAM,MAAM,IAAI,IAAI,UAAU;AAC9B,MAAI,aAAa,IAAI,UAAU,cAAc,MAAM,CAAC;AACpD,MAAI,aAAa,IAAI,kBAAkB,aAAa,EAAE;AACtD,MAAI,aAAa,IAAI,qBAAqB,KAAK;AAE/C,QAAM,SAAS,QAAQ,UAAU,aAAa;AAC9C,MAAI,UAAU,OAAO,KAAK,MAAM,EAAE,QAAQ;AACxC,QAAI,aAAa,IAAI,eAAe,KAAK,UAAU,MAAM,CAAC;AAAA,EAC5D;AACA,SAAO,IAAI,SAAS;AACtB;","names":[]}

package/dist/react.d.mts

@@ -0,0 +1,11 @@
+import { InitOptions } from './index.mjs';
+import 'openapi-fetch';
+
+/**
+ * Configures the process-wide client from React. The effect depends on each
+ * value, so a rotated secret or a tenant switch takes effect instead of being
+ * dropped after the first render.
+ */
+declare function SDKInitializer({ apiUrl, appKey, appSecret, timeoutMs, fetch: fetchImpl }: InitOptions): null;
+
+export { SDKInitializer };

package/dist/react.d.ts

@@ -0,0 +1,11 @@
+import { InitOptions } from './index.js';
+import 'openapi-fetch';
+
+/**
+ * Configures the process-wide client from React. The effect depends on each
+ * value, so a rotated secret or a tenant switch takes effect instead of being
+ * dropped after the first render.
+ */
+declare function SDKInitializer({ apiUrl, appKey, appSecret, timeoutMs, fetch: fetchImpl }: InitOptions): null;
+
+export { SDKInitializer };

package/dist/react.js

@@ -0,0 +1,117 @@
+"use strict";
+"use client";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/react.tsx
+var react_exports = {};
+__export(react_exports, {
+  SDKInitializer: () => SDKInitializer
+});
+module.exports = __toCommonJS(react_exports);
+var import_react = require("react");
+
+// src/sdk.ts
+var import_openapi_fetch = __toESM(require("openapi-fetch"));
+var APP_KEY_HEADER = "x-app-key";
+var APP_SECRET_HEADER = "x-app-secret";
+var SdkNotInitializedError = class extends Error {
+  constructor() {
+    super("Call initializeSDK() or createSdkClient() before the first request");
+    this.name = "SdkNotInitializedError";
+  }
+};
+var SdkConfigError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SdkConfigError";
+  }
+};
+function resolveApiUrl(apiUrl) {
+  const trimmed = (apiUrl ?? "").trim().replace(/\/+$/, "");
+  if (!trimmed) {
+    throw new SdkConfigError("apiUrl is required, for example https://api.example.com");
+  }
+  return trimmed;
+}
+function withTimeout(fetchImpl, timeoutMs) {
+  const base = fetchImpl ?? globalThis.fetch;
+  if (!timeoutMs || timeoutMs <= 0) return base;
+  return (input, init) => {
+    const caller = init?.signal ?? (input instanceof Request ? input.signal : void 0);
+    const deadline = AbortSignal.timeout(timeoutMs);
+    return base(input, { ...init, signal: caller ? AbortSignal.any([caller, deadline]) : deadline });
+  };
+}
+function authMiddleware({ appKey, appSecret }) {
+  return {
+    async onRequest({ request }) {
+      if (!appKey && !appSecret) return request;
+      const next = new Request(request);
+      if (appKey) next.headers.set(APP_KEY_HEADER, appKey);
+      if (appSecret) next.headers.set(APP_SECRET_HEADER, appSecret);
+      return next;
+    }
+  };
+}
+function createSdkClient(options) {
+  const client = (0, import_openapi_fetch.default)({
+    baseUrl: resolveApiUrl(options.apiUrl),
+    fetch: withTimeout(options.fetch, options.timeoutMs)
+  });
+  client.use(authMiddleware(options));
+  return client;
+}
+var active = null;
+var activeApiUrl = null;
+var fetchClient = new Proxy({}, {
+  get(_target, property) {
+    if (typeof property === "symbol") return void 0;
+    if (!active) throw new SdkNotInitializedError();
+    const value = active[property];
+    return typeof value === "function" ? value.bind(active) : value;
+  }
+});
+function initializeSDK(options) {
+  activeApiUrl = resolveApiUrl(options.apiUrl);
+  active = createSdkClient(options);
+  return active;
+}
+
+// src/react.tsx
+function SDKInitializer({ apiUrl, appKey, appSecret, timeoutMs, fetch: fetchImpl }) {
+  (0, import_react.useEffect)(() => {
+    initializeSDK({ apiUrl, appKey, appSecret, timeoutMs, fetch: fetchImpl });
+  }, [apiUrl, appKey, appSecret, timeoutMs, fetchImpl]);
+  return null;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SDKInitializer
+});
+//# sourceMappingURL=react.js.map

package/dist/react.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/react.tsx","../src/sdk.ts"],"sourcesContent":["'use client'\n\nimport { useEffect } from 'react'\n\nimport { initializeSDK, type InitOptions } from './sdk'\n\n/**\n * Configures the process-wide client from React. The effect depends on each\n * value, so a rotated secret or a tenant switch takes effect instead of being\n * dropped after the first render.\n */\nexport function SDKInitializer({ apiUrl, appKey, appSecret, timeoutMs, fetch: fetchImpl }: InitOptions) {\n  useEffect(() => {\n    initializeSDK({ apiUrl, appKey, appSecret, timeoutMs, fetch: fetchImpl })\n  }, [apiUrl, appKey, appSecret, timeoutMs, fetchImpl])\n\n  return null\n}\n","import createClient, { type Client, type Middleware } from 'openapi-fetch'\n\nimport type { components, paths } from './types/schema'\n\n/** Header names the server reads app credentials from (`apps/server/src/auth/auth.guard.ts`). */\nexport const APP_KEY_HEADER = 'x-app-key'\nexport const APP_SECRET_HEADER = 'x-app-secret'\n\nexport type InitOptions = {\n  /** Base URL of the API, without a trailing slash. */\n  apiUrl: string\n  /** Sent as `x-app-key`: the app's `id`, which the auth guard looks the app up by. */\n  appKey?: string\n  /** Sent as `x-app-secret`: one of the app's credential `clientSecret` values. */\n  appSecret?: string\n  /** Abort a request after this many milliseconds. `0` or unset means no timeout. */\n  timeoutMs?: number\n  /** Override the fetch implementation, for a Node polyfill or a test. */\n  fetch?: typeof globalThis.fetch\n}\n\n/** Thrown when a request is made before any credentials were configured. */\nexport class SdkNotInitializedError extends Error {\n  constructor() {\n    super('Call initializeSDK() or createSdkClient() before the first request')\n    this.name = 'SdkNotInitializedError'\n  }\n}\n\nexport class SdkConfigError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'SdkConfigError'\n  }\n}\n\nfunction resolveApiUrl(apiUrl: string | undefined): string {\n  const trimmed = (apiUrl ?? '').trim().replace(/\\/+$/, '')\n  if (!trimmed) {\n    throw new SdkConfigError('apiUrl is required, for example https://api.example.com')\n  }\n  return trimmed\n}\n\nfunction withTimeout(\n  fetchImpl: typeof globalThis.fetch | undefined,\n  timeoutMs: number | undefined,\n): typeof globalThis.fetch {\n  const base = fetchImpl ?? globalThis.fetch\n  if (!timeoutMs || timeoutMs <= 0) return base\n  return (input, init) => {\n    // openapi-fetch calls fetch(request) with no init and folds the caller's\n    // signal into the request, so look both places before combining.\n    const caller = init?.signal ?? (input instanceof Request ? input.signal : undefined)\n    const deadline = AbortSignal.timeout(timeoutMs)\n    // `any` keeps the caller's cancellation working: the deadline must not\n    // replace a signal the caller uses for reasons of its own.\n    return base(input, { ...init, signal: caller ? AbortSignal.any([caller, deadline]) : deadline })\n  }\n}\n\n/**\n * App credentials travel in headers, not in the generated document: the server's\n * OpenAPI spec declares `securitySchemes: {}`, so nothing is typed for this and\n * the client has to attach them.\n */\nfunction authMiddleware({ appKey, appSecret }: InitOptions): Middleware {\n  return {\n    async onRequest({ request }) {\n      if (!appKey && !appSecret) return request\n      // A fresh Request owns mutable headers, unlike a request handed to a guarded fetch.\n      const next = new Request(request)\n      if (appKey) next.headers.set(APP_KEY_HEADER, appKey)\n      if (appSecret) next.headers.set(APP_SECRET_HEADER, appSecret)\n      return next\n    },\n  }\n}\n\n/**\n * A client with its own base URL and credentials. Use this when a process serves\n * more than one app: each client is independent, so one tenant's configuration\n * cannot overwrite another's.\n */\nexport function createSdkClient(options: InitOptions): Client<paths> {\n  const client = createClient<paths>({\n    baseUrl: resolveApiUrl(options.apiUrl),\n    fetch: withTimeout(options.fetch, options.timeoutMs),\n  })\n  client.use(authMiddleware(options))\n  return client\n}\n\nlet active: Client<paths> | null = null\n/** The `apiUrl` of the process-wide client, so `resolveGameURL` can reuse it. */\nlet activeApiUrl: string | null = null\n\n/**\n * Process-wide client configured by `initializeSDK` or `<SDKInitializer>`.\n *\n * Before the first initialization every access throws `SdkNotInitializedError`,\n * so a mis-ordered import fails where it happens instead of sending a request to\n * a placeholder origin.\n */\nexport const fetchClient: Client<paths> = new Proxy({} as Client<paths>, {\n  get(_target, property) {\n    if (typeof property === 'symbol') return undefined\n    if (!active) throw new SdkNotInitializedError()\n    const value = (active as unknown as Record<string, unknown>)[property]\n    return typeof value === 'function'\n      ? (value as (...args: unknown[]) => unknown).bind(active)\n      : value\n  },\n})\n\n/** Configure the process-wide client and return it. */\nexport function initializeSDK(options: InitOptions): Client<paths> {\n  activeApiUrl = resolveApiUrl(options.apiUrl)\n  active = createSdkClient(options)\n  return active\n}\n\n/** A game instance from `GET /sdk/game-instances`, as generated from the OpenAPI document. */\nexport type GameInstance = components['schemas']['AppGameInstance']\n\nexport type ResolveGameUrlOptions = {\n  /** API base URL the frame calls. Defaults to the `apiUrl` passed to `initializeSDK`. */\n  apiUrl?: string\n  /** Config to hand the game as `gameSetting`. Defaults to the instance overrides. */\n  config?: Record<string, unknown> | null\n}\n\n/**\n * Build the URL the host loads in an iframe or webview from the game instance\n * and the token `POST /sdk/login` returned. It appends `apiUrl`,\n * `gameInstanceId`, `playerAccessToken`, and `gameSetting`.\n *\n * `apiUrl` defaults to the one given to `initializeSDK`. A caller that uses\n * `createSdkClient` instead must pass `{ apiUrl }`, because that client is not\n * the process-wide one.\n */\nexport function resolveGameURL(\n  gameInstance: GameInstance,\n  playerAccessToken: string,\n  options: ResolveGameUrlOptions = {},\n): string {\n  const entryPoint = gameInstance?.resolvedUrl\n  if (!entryPoint) {\n    throw new SdkConfigError('gameInstance.resolvedUrl is required to build a play URL')\n  }\n  const token = playerAccessToken?.trim()\n  if (!token) {\n    throw new SdkConfigError('playerAccessToken is required')\n  }\n  const apiUrl = options.apiUrl?.trim() || activeApiUrl\n  if (!apiUrl) {\n    throw new SdkConfigError('apiUrl is required: call initializeSDK() first, or pass { apiUrl }')\n  }\n\n  const url = new URL(entryPoint)\n  url.searchParams.set('apiUrl', resolveApiUrl(apiUrl))\n  url.searchParams.set('gameInstanceId', gameInstance.id)\n  url.searchParams.set('playerAccessToken', token)\n\n  const config = options.config ?? gameInstance.overrides\n  if (config && Object.keys(config).length) {\n    url.searchParams.set('gameSetting', JSON.stringify(config))\n  }\n  return url.toString()\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,mBAA0B;;;ACF1B,2BAA2D;AAKpD,IAAM,iBAAiB;AACvB,IAAM,oBAAoB;AAgB1B,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,cAAc;AACZ,UAAM,oEAAoE;AAC1E,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,cAAc,QAAoC;AACzD,QAAM,WAAW,UAAU,IAAI,KAAK,EAAE,QAAQ,QAAQ,EAAE;AACxD,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,eAAe,yDAAyD;AAAA,EACpF;AACA,SAAO;AACT;AAEA,SAAS,YACP,WACA,WACyB;AACzB,QAAM,OAAO,aAAa,WAAW;AACrC,MAAI,CAAC,aAAa,aAAa,EAAG,QAAO;AACzC,SAAO,CAAC,OAAO,SAAS;AAGtB,UAAM,SAAS,MAAM,WAAW,iBAAiB,UAAU,MAAM,SAAS;AAC1E,UAAM,WAAW,YAAY,QAAQ,SAAS;AAG9C,WAAO,KAAK,OAAO,EAAE,GAAG,MAAM,QAAQ,SAAS,YAAY,IAAI,CAAC,QAAQ,QAAQ,CAAC,IAAI,SAAS,CAAC;AAAA,EACjG;AACF;AAOA,SAAS,eAAe,EAAE,QAAQ,UAAU,GAA4B;AACtE,SAAO;AAAA,IACL,MAAM,UAAU,EAAE,QAAQ,GAAG;AAC3B,UAAI,CAAC,UAAU,CAAC,UAAW,QAAO;AAElC,YAAM,OAAO,IAAI,QAAQ,OAAO;AAChC,UAAI,OAAQ,MAAK,QAAQ,IAAI,gBAAgB,MAAM;AACnD,UAAI,UAAW,MAAK,QAAQ,IAAI,mBAAmB,SAAS;AAC5D,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAOO,SAAS,gBAAgB,SAAqC;AACnE,QAAM,aAAS,qBAAAA,SAAoB;AAAA,IACjC,SAAS,cAAc,QAAQ,MAAM;AAAA,IACrC,OAAO,YAAY,QAAQ,OAAO,QAAQ,SAAS;AAAA,EACrD,CAAC;AACD,SAAO,IAAI,eAAe,OAAO,CAAC;AAClC,SAAO;AACT;AAEA,IAAI,SAA+B;AAEnC,IAAI,eAA8B;AAS3B,IAAM,cAA6B,IAAI,MAAM,CAAC,GAAoB;AAAA,EACvE,IAAI,SAAS,UAAU;AACrB,QAAI,OAAO,aAAa,SAAU,QAAO;AACzC,QAAI,CAAC,OAAQ,OAAM,IAAI,uBAAuB;AAC9C,UAAM,QAAS,OAA8C,QAAQ;AACrE,WAAO,OAAO,UAAU,aACnB,MAA0C,KAAK,MAAM,IACtD;AAAA,EACN;AACF,CAAC;AAGM,SAAS,cAAc,SAAqC;AACjE,iBAAe,cAAc,QAAQ,MAAM;AAC3C,WAAS,gBAAgB,OAAO;AAChC,SAAO;AACT;;;AD7GO,SAAS,eAAe,EAAE,QAAQ,QAAQ,WAAW,WAAW,OAAO,UAAU,GAAgB;AACtG,8BAAU,MAAM;AACd,kBAAc,EAAE,QAAQ,QAAQ,WAAW,WAAW,OAAO,UAAU,CAAC;AAAA,EAC1E,GAAG,CAAC,QAAQ,QAAQ,WAAW,WAAW,SAAS,CAAC;AAEpD,SAAO;AACT;","names":["createClient"]}

package/dist/react.mjs

@@ -0,0 +1,83 @@
+"use client";
+
+// src/react.tsx
+import { useEffect } from "react";
+
+// src/sdk.ts
+import createClient from "openapi-fetch";
+var APP_KEY_HEADER = "x-app-key";
+var APP_SECRET_HEADER = "x-app-secret";
+var SdkNotInitializedError = class extends Error {
+  constructor() {
+    super("Call initializeSDK() or createSdkClient() before the first request");
+    this.name = "SdkNotInitializedError";
+  }
+};
+var SdkConfigError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SdkConfigError";
+  }
+};
+function resolveApiUrl(apiUrl) {
+  const trimmed = (apiUrl ?? "").trim().replace(/\/+$/, "");
+  if (!trimmed) {
+    throw new SdkConfigError("apiUrl is required, for example https://api.example.com");
+  }
+  return trimmed;
+}
+function withTimeout(fetchImpl, timeoutMs) {
+  const base = fetchImpl ?? globalThis.fetch;
+  if (!timeoutMs || timeoutMs <= 0) return base;
+  return (input, init) => {
+    const caller = init?.signal ?? (input instanceof Request ? input.signal : void 0);
+    const deadline = AbortSignal.timeout(timeoutMs);
+    return base(input, { ...init, signal: caller ? AbortSignal.any([caller, deadline]) : deadline });
+  };
+}
+function authMiddleware({ appKey, appSecret }) {
+  return {
+    async onRequest({ request }) {
+      if (!appKey && !appSecret) return request;
+      const next = new Request(request);
+      if (appKey) next.headers.set(APP_KEY_HEADER, appKey);
+      if (appSecret) next.headers.set(APP_SECRET_HEADER, appSecret);
+      return next;
+    }
+  };
+}
+function createSdkClient(options) {
+  const client = createClient({
+    baseUrl: resolveApiUrl(options.apiUrl),
+    fetch: withTimeout(options.fetch, options.timeoutMs)
+  });
+  client.use(authMiddleware(options));
+  return client;
+}
+var active = null;
+var activeApiUrl = null;
+var fetchClient = new Proxy({}, {
+  get(_target, property) {
+    if (typeof property === "symbol") return void 0;
+    if (!active) throw new SdkNotInitializedError();
+    const value = active[property];
+    return typeof value === "function" ? value.bind(active) : value;
+  }
+});
+function initializeSDK(options) {
+  activeApiUrl = resolveApiUrl(options.apiUrl);
+  active = createSdkClient(options);
+  return active;
+}
+
+// src/react.tsx
+function SDKInitializer({ apiUrl, appKey, appSecret, timeoutMs, fetch: fetchImpl }) {
+  useEffect(() => {
+    initializeSDK({ apiUrl, appKey, appSecret, timeoutMs, fetch: fetchImpl });
+  }, [apiUrl, appKey, appSecret, timeoutMs, fetchImpl]);
+  return null;
+}
+export {
+  SDKInitializer
+};
+//# sourceMappingURL=react.mjs.map

package/dist/react.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/react.tsx","../src/sdk.ts"],"sourcesContent":["'use client'\n\nimport { useEffect } from 'react'\n\nimport { initializeSDK, type InitOptions } from './sdk'\n\n/**\n * Configures the process-wide client from React. The effect depends on each\n * value, so a rotated secret or a tenant switch takes effect instead of being\n * dropped after the first render.\n */\nexport function SDKInitializer({ apiUrl, appKey, appSecret, timeoutMs, fetch: fetchImpl }: InitOptions) {\n  useEffect(() => {\n    initializeSDK({ apiUrl, appKey, appSecret, timeoutMs, fetch: fetchImpl })\n  }, [apiUrl, appKey, appSecret, timeoutMs, fetchImpl])\n\n  return null\n}\n","import createClient, { type Client, type Middleware } from 'openapi-fetch'\n\nimport type { components, paths } from './types/schema'\n\n/** Header names the server reads app credentials from (`apps/server/src/auth/auth.guard.ts`). */\nexport const APP_KEY_HEADER = 'x-app-key'\nexport const APP_SECRET_HEADER = 'x-app-secret'\n\nexport type InitOptions = {\n  /** Base URL of the API, without a trailing slash. */\n  apiUrl: string\n  /** Sent as `x-app-key`: the app's `id`, which the auth guard looks the app up by. */\n  appKey?: string\n  /** Sent as `x-app-secret`: one of the app's credential `clientSecret` values. */\n  appSecret?: string\n  /** Abort a request after this many milliseconds. `0` or unset means no timeout. */\n  timeoutMs?: number\n  /** Override the fetch implementation, for a Node polyfill or a test. */\n  fetch?: typeof globalThis.fetch\n}\n\n/** Thrown when a request is made before any credentials were configured. */\nexport class SdkNotInitializedError extends Error {\n  constructor() {\n    super('Call initializeSDK() or createSdkClient() before the first request')\n    this.name = 'SdkNotInitializedError'\n  }\n}\n\nexport class SdkConfigError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'SdkConfigError'\n  }\n}\n\nfunction resolveApiUrl(apiUrl: string | undefined): string {\n  const trimmed = (apiUrl ?? '').trim().replace(/\\/+$/, '')\n  if (!trimmed) {\n    throw new SdkConfigError('apiUrl is required, for example https://api.example.com')\n  }\n  return trimmed\n}\n\nfunction withTimeout(\n  fetchImpl: typeof globalThis.fetch | undefined,\n  timeoutMs: number | undefined,\n): typeof globalThis.fetch {\n  const base = fetchImpl ?? globalThis.fetch\n  if (!timeoutMs || timeoutMs <= 0) return base\n  return (input, init) => {\n    // openapi-fetch calls fetch(request) with no init and folds the caller's\n    // signal into the request, so look both places before combining.\n    const caller = init?.signal ?? (input instanceof Request ? input.signal : undefined)\n    const deadline = AbortSignal.timeout(timeoutMs)\n    // `any` keeps the caller's cancellation working: the deadline must not\n    // replace a signal the caller uses for reasons of its own.\n    return base(input, { ...init, signal: caller ? AbortSignal.any([caller, deadline]) : deadline })\n  }\n}\n\n/**\n * App credentials travel in headers, not in the generated document: the server's\n * OpenAPI spec declares `securitySchemes: {}`, so nothing is typed for this and\n * the client has to attach them.\n */\nfunction authMiddleware({ appKey, appSecret }: InitOptions): Middleware {\n  return {\n    async onRequest({ request }) {\n      if (!appKey && !appSecret) return request\n      // A fresh Request owns mutable headers, unlike a request handed to a guarded fetch.\n      const next = new Request(request)\n      if (appKey) next.headers.set(APP_KEY_HEADER, appKey)\n      if (appSecret) next.headers.set(APP_SECRET_HEADER, appSecret)\n      return next\n    },\n  }\n}\n\n/**\n * A client with its own base URL and credentials. Use this when a process serves\n * more than one app: each client is independent, so one tenant's configuration\n * cannot overwrite another's.\n */\nexport function createSdkClient(options: InitOptions): Client<paths> {\n  const client = createClient<paths>({\n    baseUrl: resolveApiUrl(options.apiUrl),\n    fetch: withTimeout(options.fetch, options.timeoutMs),\n  })\n  client.use(authMiddleware(options))\n  return client\n}\n\nlet active: Client<paths> | null = null\n/** The `apiUrl` of the process-wide client, so `resolveGameURL` can reuse it. */\nlet activeApiUrl: string | null = null\n\n/**\n * Process-wide client configured by `initializeSDK` or `<SDKInitializer>`.\n *\n * Before the first initialization every access throws `SdkNotInitializedError`,\n * so a mis-ordered import fails where it happens instead of sending a request to\n * a placeholder origin.\n */\nexport const fetchClient: Client<paths> = new Proxy({} as Client<paths>, {\n  get(_target, property) {\n    if (typeof property === 'symbol') return undefined\n    if (!active) throw new SdkNotInitializedError()\n    const value = (active as unknown as Record<string, unknown>)[property]\n    return typeof value === 'function'\n      ? (value as (...args: unknown[]) => unknown).bind(active)\n      : value\n  },\n})\n\n/** Configure the process-wide client and return it. */\nexport function initializeSDK(options: InitOptions): Client<paths> {\n  activeApiUrl = resolveApiUrl(options.apiUrl)\n  active = createSdkClient(options)\n  return active\n}\n\n/** A game instance from `GET /sdk/game-instances`, as generated from the OpenAPI document. */\nexport type GameInstance = components['schemas']['AppGameInstance']\n\nexport type ResolveGameUrlOptions = {\n  /** API base URL the frame calls. Defaults to the `apiUrl` passed to `initializeSDK`. */\n  apiUrl?: string\n  /** Config to hand the game as `gameSetting`. Defaults to the instance overrides. */\n  config?: Record<string, unknown> | null\n}\n\n/**\n * Build the URL the host loads in an iframe or webview from the game instance\n * and the token `POST /sdk/login` returned. It appends `apiUrl`,\n * `gameInstanceId`, `playerAccessToken`, and `gameSetting`.\n *\n * `apiUrl` defaults to the one given to `initializeSDK`. A caller that uses\n * `createSdkClient` instead must pass `{ apiUrl }`, because that client is not\n * the process-wide one.\n */\nexport function resolveGameURL(\n  gameInstance: GameInstance,\n  playerAccessToken: string,\n  options: ResolveGameUrlOptions = {},\n): string {\n  const entryPoint = gameInstance?.resolvedUrl\n  if (!entryPoint) {\n    throw new SdkConfigError('gameInstance.resolvedUrl is required to build a play URL')\n  }\n  const token = playerAccessToken?.trim()\n  if (!token) {\n    throw new SdkConfigError('playerAccessToken is required')\n  }\n  const apiUrl = options.apiUrl?.trim() || activeApiUrl\n  if (!apiUrl) {\n    throw new SdkConfigError('apiUrl is required: call initializeSDK() first, or pass { apiUrl }')\n  }\n\n  const url = new URL(entryPoint)\n  url.searchParams.set('apiUrl', resolveApiUrl(apiUrl))\n  url.searchParams.set('gameInstanceId', gameInstance.id)\n  url.searchParams.set('playerAccessToken', token)\n\n  const config = options.config ?? gameInstance.overrides\n  if (config && Object.keys(config).length) {\n    url.searchParams.set('gameSetting', JSON.stringify(config))\n  }\n  return url.toString()\n}\n"],"mappings":";;;AAEA,SAAS,iBAAiB;;;ACF1B,OAAO,kBAAoD;AAKpD,IAAM,iBAAiB;AACvB,IAAM,oBAAoB;AAgB1B,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,cAAc;AACZ,UAAM,oEAAoE;AAC1E,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,cAAc,QAAoC;AACzD,QAAM,WAAW,UAAU,IAAI,KAAK,EAAE,QAAQ,QAAQ,EAAE;AACxD,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,eAAe,yDAAyD;AAAA,EACpF;AACA,SAAO;AACT;AAEA,SAAS,YACP,WACA,WACyB;AACzB,QAAM,OAAO,aAAa,WAAW;AACrC,MAAI,CAAC,aAAa,aAAa,EAAG,QAAO;AACzC,SAAO,CAAC,OAAO,SAAS;AAGtB,UAAM,SAAS,MAAM,WAAW,iBAAiB,UAAU,MAAM,SAAS;AAC1E,UAAM,WAAW,YAAY,QAAQ,SAAS;AAG9C,WAAO,KAAK,OAAO,EAAE,GAAG,MAAM,QAAQ,SAAS,YAAY,IAAI,CAAC,QAAQ,QAAQ,CAAC,IAAI,SAAS,CAAC;AAAA,EACjG;AACF;AAOA,SAAS,eAAe,EAAE,QAAQ,UAAU,GAA4B;AACtE,SAAO;AAAA,IACL,MAAM,UAAU,EAAE,QAAQ,GAAG;AAC3B,UAAI,CAAC,UAAU,CAAC,UAAW,QAAO;AAElC,YAAM,OAAO,IAAI,QAAQ,OAAO;AAChC,UAAI,OAAQ,MAAK,QAAQ,IAAI,gBAAgB,MAAM;AACnD,UAAI,UAAW,MAAK,QAAQ,IAAI,mBAAmB,SAAS;AAC5D,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAOO,SAAS,gBAAgB,SAAqC;AACnE,QAAM,SAAS,aAAoB;AAAA,IACjC,SAAS,cAAc,QAAQ,MAAM;AAAA,IACrC,OAAO,YAAY,QAAQ,OAAO,QAAQ,SAAS;AAAA,EACrD,CAAC;AACD,SAAO,IAAI,eAAe,OAAO,CAAC;AAClC,SAAO;AACT;AAEA,IAAI,SAA+B;AAEnC,IAAI,eAA8B;AAS3B,IAAM,cAA6B,IAAI,MAAM,CAAC,GAAoB;AAAA,EACvE,IAAI,SAAS,UAAU;AACrB,QAAI,OAAO,aAAa,SAAU,QAAO;AACzC,QAAI,CAAC,OAAQ,OAAM,IAAI,uBAAuB;AAC9C,UAAM,QAAS,OAA8C,QAAQ;AACrE,WAAO,OAAO,UAAU,aACnB,MAA0C,KAAK,MAAM,IACtD;AAAA,EACN;AACF,CAAC;AAGM,SAAS,cAAc,SAAqC;AACjE,iBAAe,cAAc,QAAQ,MAAM;AAC3C,WAAS,gBAAgB,OAAO;AAChC,SAAO;AACT;;;AD7GO,SAAS,eAAe,EAAE,QAAQ,QAAQ,WAAW,WAAW,OAAO,UAAU,GAAgB;AACtG,YAAU,MAAM;AACd,kBAAc,EAAE,QAAQ,QAAQ,WAAW,WAAW,OAAO,UAAU,CAAC;AAAA,EAC1E,GAAG,CAAC,QAAQ,QAAQ,WAAW,WAAW,SAAS,CAAC;AAEpD,SAAO;AACT;","names":[]}

package/package.json

@@ -1,6 +1,93 @@
 {
   "name": "@fzgame/sdk",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.3.1",
+  "description": "Typed client for the FZ GameHub API, generated from the server's OpenAPI document",
+  "license": "ISC",
+  "author": "Fanzeal <developer@fanzeal.com>",
+  "main": "./dist/index.js",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.mts",
+        "default": "./dist/index.mjs"
+      },
+      "require": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      }
+    },
+    "./react": {
+      "import": {
+        "types": "./dist/react.d.mts",
+        "default": "./dist/react.mjs"
+      },
+      "require": {
+        "types": "./dist/react.d.ts",
+        "default": "./dist/react.js"
+      }
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": false,
+  "engines": {
+    "node": ">=18.17"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://bitbucket.org/fanzeal-intl/fz-gamehub.git",
+    "directory": "packages/sdk"
+  },
+  "homepage": "https://bitbucket.org/fanzeal-intl/fz-gamehub/src/main/packages/sdk",
+  "bugs": {
+    "url": "https://bitbucket.org/fanzeal-intl/fz-gamehub/issues"
+  },
+  "keywords": [
+    "fanzeal",
+    "gamehub",
+    "fzgame",
+    "sdk",
+    "openapi",
+    "client",
+    "typescript"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "compile": "openapi-typescript ../../apps/server/public/openapi-sdk.json -o ./src/types/schema.d.ts --empty-objects-unknown --root-types --root-types-no-schema-prefix --make-paths-enum && tsup",
+    "check-types": "tsc --noEmit",
+    "test": "vitest",
+    "test:run": "vitest run",
+    "smoke": "node scripts/smoke-npm-pack.mjs",
+    "lint": "eslint src/**/*.ts --ext .ts",
+    "format": "prettier --write src",
+    "prepack": "pnpm build",
+    "prepublishOnly": "pnpm check-types && pnpm test:run && pnpm build"
+  },
+  "dependencies": {
+    "openapi-fetch": "^0.15.0"
+  },
+  "peerDependencies": {
+    "react": ">=18.2 <20"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@fzgame/eslint-config": "workspace:*",
+    "@fzgame/typescript-config": "workspace:*",
+    "@types/react": "^18.2.0",
+    "openapi-typescript": "^6.7.6",
+    "tsup": "^8.5.1",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.3"
+  }
+}