@looplay/sdk 0.6.0 → 0.8.1

package/dist/looplay-sdk.cjs.js

@@ -31,12 +31,6 @@ var NotAuthenticatedError = class extends LooplaySDKError {
     this.name = "NotAuthenticatedError";
   }
 };
-var MissingStoreError = class extends LooplaySDKError {
-  constructor(gameId) {
-    super(`Game ${gameId} has no storefront configured.`);
-    this.name = "MissingStoreError";
-  }
-};
 
 // src/auth/storage.ts
 var MemoryAuthStorage = class {
@@ -252,54 +246,49 @@ var ServiceClient = class {
     return this.http.request("POST", "/account/logout", { body });
   }
   // ─────────────────────────────────────────────────────────────────────────────
-  // Games
+  // Games — one SDK integration = one game, resolved on every call from the
+  // public `x-game-key` header (the game's `appId`). There is no multi-game
+  // catalog browsing here (list/search/detail across games) and no `:id`/
+  // `storeId` path segments — that's the app-facing surface, out of scope
+  // for this per-game SDK. Never use the creator-secret tier
+  // (`x-creator-key`/`x-game-secret`) from client/browser code — that would
+  // leak the secret to every player.
   // ─────────────────────────────────────────────────────────────────────────────
-  async listGames(query) {
-    return this.http.request("GET", "/sdk/games", { query });
-  }
-  async getGameDetail(gameId, bearerToken) {
-    return this.http.request("GET", `/sdk/games/${encodeURIComponent(gameId)}`, {
-      bearerToken
-    });
-  }
-  async listRecentPlayed(bearerToken, query) {
-    return this.http.request("GET", "/sdk/games/recent-play", { bearerToken, query });
-  }
-  async recordGameView(auth, gameId) {
-    await this.http.request("POST", `/sdk/games/${encodeURIComponent(gameId)}/views/record`, {
+  async recordGameView(gameKey, auth = {}) {
+    await this.http.request("POST", "/sdk/games/views/record", {
       ...auth,
-      headers: this.trackingHeaders(auth)
+      headers: { "x-game-key": gameKey, ...this.trackingHeaders(auth) }
     });
     return true;
   }
   /** Signs a fresh `attemptToken` — required by `completeGameplayAttempt`/`completeGameplayMatch`/`recordGameplayAction`. */
-  async startGameplayAttempt(auth, gameId, body = {}) {
-    return this.http.request("POST", `/sdk/games/${encodeURIComponent(gameId)}/attempts/start`, {
+  async startGameplayAttempt(gameKey, auth = {}, body = {}) {
+    return this.http.request("POST", "/sdk/games/attempts/start", {
       ...auth,
-      headers: this.trackingHeaders(auth),
+      headers: { "x-game-key": gameKey, ...this.trackingHeaders(auth) },
       body
     });
   }
-  async completeGameplayAttempt(auth, gameId, body) {
-    await this.http.request("POST", `/sdk/games/${encodeURIComponent(gameId)}/attempts/complete`, {
+  async completeGameplayAttempt(gameKey, auth, body) {
+    await this.http.request("POST", "/sdk/games/attempts/complete", {
       ...auth,
-      headers: this.trackingHeaders(auth),
+      headers: { "x-game-key": gameKey, ...this.trackingHeaders(auth) },
       body
     });
     return true;
   }
-  async completeGameplayMatch(auth, gameId, body) {
-    await this.http.request("POST", `/sdk/games/${encodeURIComponent(gameId)}/matches/complete`, {
+  async completeGameplayMatch(gameKey, auth, body) {
+    await this.http.request("POST", "/sdk/games/matches/complete", {
       ...auth,
-      headers: this.trackingHeaders(auth),
+      headers: { "x-game-key": gameKey, ...this.trackingHeaders(auth) },
       body
     });
     return true;
   }
-  async recordGameplayAction(auth, gameId, body) {
-    return this.http.request("POST", `/sdk/games/${encodeURIComponent(gameId)}/actions/record`, {
+  async recordGameplayAction(gameKey, auth, body) {
+    return this.http.request("POST", "/sdk/games/actions/record", {
       ...auth,
-      headers: this.trackingHeaders(auth),
+      headers: { "x-game-key": gameKey, ...this.trackingHeaders(auth) },
       body
     });
   }
@@ -319,104 +308,90 @@ var ServiceClient = class {
       "x-looplay-anon-token": auth.anonTrackingToken
     };
   }
-  // ─────────────────────────────────────────────────────────────────────────────
-  // Game store (JWT tier, keyed by `storeId`) — spend coin balance on offers
-  // (single asset or bundle) defined by the game's creator. Coin balance
-  // itself comes from getBalances()/getMyBalance(). Purchases require a
-  // signed `checkoutToken` from `createStoreCheckoutIntent` first.
-  // ─────────────────────────────────────────────────────────────────────────────
-  async getStoreByStoreId(storeId) {
-    return this.http.request("GET", `/sdk/games/store/${encodeURIComponent(storeId)}`);
+  /** Public storefront (sections + offers) for the integration's game. Read-only. */
+  async getStore(gameKey) {
+    return this.http.request("GET", "/sdk/games/store/current", {
+      headers: { "x-game-key": gameKey }
+    });
   }
-  async listMyStorePurchasesByStoreId(bearerToken, storeId) {
-    return this.http.request("GET", `/sdk/games/store/${encodeURIComponent(storeId)}/purchases/me`, {
-      bearerToken
+  /** Public catalog of purchasable/ownable assets for the game. Read-only. */
+  async listGameAssets(gameKey) {
+    return this.http.request("GET", "/sdk/games/store/assets", {
+      headers: { "x-game-key": gameKey }
     });
   }
-  async createStoreCheckoutIntent(bearerToken, body, trackingSessionId) {
-    return this.http.request("POST", "/sdk/games/store/by-store-id/checkout-intent", {
+  /** Assets the authenticated player already owns for this game. */
+  async listMyGameAssets(bearerToken, gameKey) {
+    return this.http.request("GET", "/sdk/games/store/assets/me", {
       bearerToken,
-      headers: { "x-game-tracking-session-id": trackingSessionId },
-      body
+      headers: { "x-game-key": gameKey }
     });
   }
-  async purchaseStoreOffer(bearerToken, body, trackingSessionId) {
-    return this.http.request("POST", "/sdk/games/store/by-store-id/purchase", {
+  /** The authenticated player's past store purchases for this game. */
+  async listMyStorePurchases(bearerToken, gameKey) {
+    return this.http.request("GET", "/sdk/games/store/purchases/me", {
       bearerToken,
-      headers: { "x-game-tracking-session-id": trackingSessionId },
-      body
+      headers: { "x-game-key": gameKey }
     });
   }
   // ─────────────────────────────────────────────────────────────────────────────
-  // Runtime tier (`x-game-key`) — for a game embedding the SDK with its own
-  // public `appId`, without needing a resolved `gameId`/`storeId` first or a
-  // logged-in user (anonymous tracking still works via `TrackingAuth.anonId`).
-  // Never use the creator-secret tier (`x-creator-key`/`x-game-secret`) from
-  // client/browser code — that would leak the secret to every player.
+  // Self-serve purchase (public tier) — same trust level as tracking: public
+  // `x-game-key` + the purchasing player's own bearer token, no backend or
+  // secret pair required. Safe to call directly from client/browser code —
+  // `checkoutToken` (short-lived, server-signed) plays the same role as
+  // `attemptToken` on the tracking routes. `ApiClient.purchaseStoreOffer`
+  // wraps this pair for you.
   // ─────────────────────────────────────────────────────────────────────────────
-  async recordGameViewForGameKey(gameKey, auth = {}) {
-    await this.http.request("POST", "/sdk/games/runtime/views/record", {
-      ...auth,
-      headers: { "x-game-key": gameKey, ...this.trackingHeaders(auth) }
-    });
-    return true;
-  }
-  async startGameplayAttemptForGameKey(gameKey, auth = {}, body = {}) {
-    return this.http.request("POST", "/sdk/games/runtime/attempts/start", {
-      ...auth,
-      headers: { "x-game-key": gameKey, ...this.trackingHeaders(auth) },
+  /** Signs a `checkoutToken` for one purchase — required by `purchaseMyStoreOffer`. */
+  async createMyStoreCheckoutIntent(gameKey, bearerToken, body, trackingSessionId) {
+    return this.http.request("POST", "/sdk/games/store/checkout-intent/me", {
+      bearerToken,
+      headers: { "x-game-key": gameKey, "x-game-tracking-session-id": trackingSessionId },
       body
     });
   }
-  async completeGameplayAttemptForGameKey(gameKey, auth = {}, body) {
-    await this.http.request("POST", "/sdk/games/runtime/attempts/complete", {
-      ...auth,
-      headers: { "x-game-key": gameKey, ...this.trackingHeaders(auth) },
+  async purchaseMyStoreOffer(gameKey, bearerToken, body, trackingSessionId) {
+    return this.http.request("POST", "/sdk/games/store/purchase/me", {
+      bearerToken,
+      headers: { "x-game-key": gameKey, "x-game-tracking-session-id": trackingSessionId },
       body
     });
-    return true;
   }
-  async completeGameplayMatchForGameKey(gameKey, auth = {}, body) {
-    await this.http.request("POST", "/sdk/games/runtime/matches/complete", {
-      ...auth,
-      headers: { "x-game-key": gameKey, ...this.trackingHeaders(auth) },
+  // ─────────────────────────────────────────────────────────────────────────────
+  // Server-to-server (secret pair) — moves real coin balance. Requires the
+  // creator+game *secret* pair (`x-creator-key`/`x-game-secret`), distinct
+  // from the public `x-game-key` used everywhere above. Call these ONLY
+  // from your own backend (e.g. a Node service holding the secret pair) —
+  // never from client/browser code, or the secret is exposed to every
+  // player. `ApiClient` deliberately does not expose these — it auto-injects
+  // a *player's* access token for browser-facing calls and has no concept
+  // of your creator secret. Prefer the self-serve tier above unless you
+  // specifically need to initiate a purchase from your backend without the
+  // player present.
+  // ─────────────────────────────────────────────────────────────────────────────
+  /** Signs a `checkoutToken` for one purchase — required by `purchaseGameStoreOffer`. */
+  async createGameStoreCheckoutIntent(auth, body) {
+    return this.http.request("POST", "/sdk/games/store/checkout-intent", {
+      bearerToken: auth.bearerToken,
+      headers: {
+        "x-creator-key": auth.creatorKey,
+        "x-game-secret": auth.gameSecret,
+        "x-game-tracking-session-id": auth.trackingSessionId
+      },
       body
     });
-    return true;
   }
-  async recordGameplayActionForGameKey(gameKey, auth = {}, body) {
-    return this.http.request("POST", "/sdk/games/runtime/actions/record", {
-      ...auth,
-      headers: { "x-game-key": gameKey, ...this.trackingHeaders(auth) },
+  async purchaseGameStoreOffer(auth, body) {
+    return this.http.request("POST", "/sdk/games/store/purchase", {
+      bearerToken: auth.bearerToken,
+      headers: {
+        "x-creator-key": auth.creatorKey,
+        "x-game-secret": auth.gameSecret,
+        "x-game-tracking-session-id": auth.trackingSessionId
+      },
       body
     });
   }
-  async getStoreForGameKey(gameKey) {
-    return this.http.request("GET", "/sdk/games/store/current", {
-      headers: { "x-game-key": gameKey }
-    });
-  }
-  async listGameAssetsForGameKey(gameKey) {
-    return this.http.request("GET", "/sdk/games/store/assets", {
-      headers: { "x-game-key": gameKey }
-    });
-  }
-  async listMyOwnedAssetsForGameKey(bearerToken, gameKey) {
-    return this.http.request("GET", "/sdk/games/store/assets/me", {
-      bearerToken,
-      headers: { "x-game-key": gameKey }
-    });
-  }
-  async listMyStorePurchasesForGameKey(bearerToken, gameKey) {
-    return this.http.request("GET", "/sdk/games/store/purchases/me", {
-      bearerToken,
-      headers: { "x-game-key": gameKey }
-    });
-  }
-  // No public/anonymous purchase route exists for the runtime tier —
-  // purchases move real coin balance and always require the JWT tier
-  // (createStoreCheckoutIntent/purchaseStoreOffer above) or the
-  // creator-secret tier, which this SDK intentionally never wires up.
   // ─────────────────────────────────────────────────────────────────────────────
   // Balance
   // ─────────────────────────────────────────────────────────────────────────────
@@ -491,15 +466,15 @@ var ApiClient = class {
     this.getAccessToken = options.getAccessToken;
     this.getAnonymousId = options.getAnonymousId;
   }
-  /** Expose the underlying route-level client (requires manual bearerToken passing). */
+  /** Expose the underlying route-level client (requires manual bearerToken/gameKey passing). */
   unsafeRaw() {
     return this.raw;
   }
-  // Public endpoints
-  async listGames(query) {
-    return this.raw.listGames(query);
-  }
-  // Authenticated endpoints
+  // Real-time (balance_change / store_purchase_completed WebSocket events)
+  // deliberately lives outside this class — import `WsClient` from
+  // '@looplay/sdk/realtime' and construct it with the same `getAccessToken`
+  // you passed here. Keeps the socket.io-client dependency (and its bundle
+  // weight) out of every consumer that doesn't need real-time updates.
   async requireToken() {
     const token = await this.getAccessToken?.();
     if (!token) throw new NotAuthenticatedError();
@@ -555,15 +530,15 @@ var ApiClient = class {
    * swallow failures, unlike `ensureTrackingSession`, since these calls
    * are rejected outright without a valid token.
    */
-  async ensureGameplayAttempt(auth, gameId, attemptId) {
+  async ensureGameplayAttempt(gameKey, auth, attemptId) {
     const now = Date.now();
-    if (this.gameplayAttempt && this.gameplayAttempt.gameId === gameId && this.gameplayAttempt.attemptId === attemptId && this.gameplayAttempt.expiresAtMs > now + 1e4) {
+    if (this.gameplayAttempt && this.gameplayAttempt.gameKey === gameKey && this.gameplayAttempt.attemptId === attemptId && this.gameplayAttempt.expiresAtMs > now + 1e4) {
       return this.gameplayAttempt;
     }
     if (!this.gameplayAttemptPromise) {
-      this.gameplayAttemptPromise = this.raw.startGameplayAttempt(auth, gameId, { attemptId }).then((dto) => {
+      this.gameplayAttemptPromise = this.raw.startGameplayAttempt(gameKey, auth, { attemptId }).then((dto) => {
         this.gameplayAttempt = {
-          gameId,
+          gameKey,
           attemptId: dto.attemptId,
           attemptToken: dto.attemptToken,
           expiresAtMs: new Date(dto.expiresAt).getTime()
@@ -575,24 +550,13 @@ var ApiClient = class {
     }
     return this.gameplayAttemptPromise;
   }
-  async getGameDetail(gameId) {
-    const token = await this.getAccessToken?.();
-    return this.raw.getGameDetail(gameId, token);
-  }
-  async resolveStoreId(gameId) {
-    const detail = await this.getGameDetail(gameId);
-    const storeId = detail?.storeId;
-    if (!storeId) throw new MissingStoreError(gameId);
-    return storeId;
-  }
-  async listRecentPlayed(query) {
-    const token = await this.requireToken();
-    return this.raw.listRecentPlayed(token, query);
-  }
-  /** Call once when the game view opens, before any play/match tracking. */
-  async trackView(gameId) {
+  /**
+   * Call once when the game view opens, before any play/match tracking.
+   * `gameKey` is the game's public `appId`.
+   */
+  async trackView(gameKey) {
     const auth = await this.resolveTrackingAuth();
-    return this.raw.recordGameView(auth, gameId);
+    return this.raw.recordGameView(gameKey, auth);
   }
   /**
    * Starts a new play attempt and returns its id. Call when the user
@@ -605,22 +569,22 @@ var ApiClient = class {
     this.gameplayAttempt = void 0;
     return this.currentAttemptId;
   }
-  async trackPlay(gameId, playTimeSeconds) {
+  async trackPlay(gameKey, playTimeSeconds) {
     const auth = await this.resolveTrackingAuth();
     const attemptId = this.currentAttemptId ?? this.startAttempt();
-    const { attemptToken } = await this.ensureGameplayAttempt(auth, gameId, attemptId);
-    return this.raw.completeGameplayAttempt(auth, gameId, { playTimeSeconds, attemptId, attemptToken });
+    const { attemptToken } = await this.ensureGameplayAttempt(gameKey, auth, attemptId);
+    return this.raw.completeGameplayAttempt(gameKey, auth, { playTimeSeconds, attemptId, attemptToken });
   }
-  async trackMatch(gameId, body) {
+  async trackMatch(gameKey, body) {
     const auth = await this.resolveTrackingAuth();
     const attemptId = this.currentAttemptId ?? this.startAttempt();
-    const { attemptToken } = await this.ensureGameplayAttempt(auth, gameId, attemptId);
-    return this.raw.completeGameplayMatch(auth, gameId, { ...body, attemptId, attemptToken });
+    const { attemptToken } = await this.ensureGameplayAttempt(gameKey, auth, attemptId);
+    return this.raw.completeGameplayMatch(gameKey, auth, { ...body, attemptId, attemptToken });
   }
-  async emit(gameId, actionCode, opts) {
+  async emit(gameKey, actionCode, opts) {
     const auth = await this.resolveTrackingAuth();
     const attemptId = this.currentAttemptId ?? this.startAttempt();
-    const { attemptToken } = await this.ensureGameplayAttempt(auth, gameId, attemptId);
+    const { attemptToken } = await this.ensureGameplayAttempt(gameKey, auth, attemptId);
     const body = {
       attemptId,
       attemptToken,
@@ -629,33 +593,42 @@ var ApiClient = class {
       refId: opts?.refId,
       payload: opts?.payload
     };
-    return this.raw.recordGameplayAction(auth, gameId, body);
+    return this.raw.recordGameplayAction(gameKey, auth, body);
   }
-  /** Fetches the storefront (sections + offers) for `gameId`, defined by that game's creator. */
-  async getStore(gameId) {
-    const storeId = await this.resolveStoreId(gameId);
-    return this.raw.getStoreByStoreId(storeId);
+  /** Fetches the storefront (sections + offers) for the integration's game. Read-only, no auth required. */
+  async getStore(gameKey) {
+    return this.raw.getStore(gameKey);
   }
-  /** Purchase history for the authenticated player in `gameId`'s store. */
-  async listMyStorePurchases(gameId) {
-    const [token, storeId] = await Promise.all([this.requireToken(), this.resolveStoreId(gameId)]);
-    return this.raw.listMyStorePurchasesByStoreId(token, storeId);
+  /** Public catalog of purchasable/ownable assets for the game. Read-only, no auth required. */
+  async listGameAssets(gameKey) {
+    return this.raw.listGameAssets(gameKey);
+  }
+  /** Assets the authenticated player already owns for this game. */
+  async listMyGameAssets(gameKey) {
+    const token = await this.requireToken();
+    return this.raw.listMyGameAssets(token, gameKey);
+  }
+  /** Purchase history for the authenticated player in the game's store. */
+  async listMyStorePurchases(gameKey) {
+    const token = await this.requireToken();
+    return this.raw.listMyStorePurchases(token, gameKey);
   }
   /**
    * Spends coin balance to purchase a store offer — signs a checkout intent
    * first, then redeems it, mirroring the gameplay attempt flow above.
+   * Self-serve: only the player's own access token is used, no secret pair
+   * required, safe to call directly from the game client. Also see
+   * `onStorePurchase` to react to the result in real time from any tab.
    */
-  async purchaseStoreOffer(gameId, offerCode, opts) {
-    const [token, storeId] = await Promise.all([this.requireToken(), this.resolveStoreId(gameId)]);
-    const intent = await this.raw.createStoreCheckoutIntent(token, {
-      storeId,
+  async purchaseStoreOffer(gameKey, offerCode, opts) {
+    const token = await this.requireToken();
+    const intent = await this.raw.createMyStoreCheckoutIntent(gameKey, token, {
       offerCode,
       requestId: opts?.requestId,
       quantity: opts?.quantity
     });
-    return this.raw.purchaseStoreOffer(token, {
-      storeId,
-      offerCode,
+    return this.raw.purchaseMyStoreOffer(gameKey, token, {
+      offerCode: intent.offerCode,
       requestId: intent.requestId,
       quantity: intent.quantity,
       checkoutToken: intent.checkoutToken
@@ -791,9 +764,8 @@ var LooplaySDK = class {
   }
   async verifyGameId(params) {
     if ((params.verifyMode ?? "none") === "none") return;
-    if (!this.auth) throw new MissingAuthError();
     if (!this.api) throw new MissingBaseUrlError();
-    await this.api.getGameDetail(params.gameId);
+    await this.api.listGameAssets(params.gameId);
   }
 };
 
@@ -1356,7 +1328,6 @@ exports.LooplaySDKError = LooplaySDKError;
 exports.MemoryAuthStorage = MemoryAuthStorage;
 exports.MissingAuthError = MissingAuthError;
 exports.MissingBaseUrlError = MissingBaseUrlError;
-exports.MissingStoreError = MissingStoreError;
 exports.NotAuthenticatedError = NotAuthenticatedError;
 exports.NotInitializedError = NotInitializedError;
 exports.ServiceClient = ServiceClient;