@looplay/sdk 0.7.0 → 0.8.2

package/dist/looplay-sdk.cjs.js

@@ -334,10 +334,64 @@ var ServiceClient = class {
       headers: { "x-game-key": gameKey }
     });
   }
-  // No purchase route is reachable from client/browser code — spending coin
-  // balance always requires the creator+game secret pair
-  // (`x-creator-key`/`x-game-secret`), called from the game's own backend.
-  // This SDK intentionally never wires that tier up.
+  // ─────────────────────────────────────────────────────────────────────────────
+  // Self-serve purchase (public tier) — same trust level as tracking: public
+  // `x-game-key` + the purchasing player's own bearer token, no backend or
+  // secret pair required. Safe to call directly from client/browser code —
+  // `checkoutToken` (short-lived, server-signed) plays the same role as
+  // `attemptToken` on the tracking routes. `ApiClient.purchaseStoreOffer`
+  // wraps this pair for you.
+  // ─────────────────────────────────────────────────────────────────────────────
+  /** Signs a `checkoutToken` for one purchase — required by `purchaseMyStoreOffer`. */
+  async createMyStoreCheckoutIntent(gameKey, bearerToken, body, trackingSessionId) {
+    return this.http.request("POST", "/sdk/games/store/checkout-intent/me", {
+      bearerToken,
+      headers: { "x-game-key": gameKey, "x-game-tracking-session-id": trackingSessionId },
+      body
+    });
+  }
+  async purchaseMyStoreOffer(gameKey, bearerToken, body, trackingSessionId) {
+    return this.http.request("POST", "/sdk/games/store/purchase/me", {
+      bearerToken,
+      headers: { "x-game-key": gameKey, "x-game-tracking-session-id": trackingSessionId },
+      body
+    });
+  }
+  // ─────────────────────────────────────────────────────────────────────────────
+  // Server-to-server (secret pair) — moves real coin balance. Requires the
+  // creator+game *secret* pair (`x-creator-key`/`x-game-secret`), distinct
+  // from the public `x-game-key` used everywhere above. Call these ONLY
+  // from your own backend (e.g. a Node service holding the secret pair) —
+  // never from client/browser code, or the secret is exposed to every
+  // player. `ApiClient` deliberately does not expose these — it auto-injects
+  // a *player's* access token for browser-facing calls and has no concept
+  // of your creator secret. Prefer the self-serve tier above unless you
+  // specifically need to initiate a purchase from your backend without the
+  // player present.
+  // ─────────────────────────────────────────────────────────────────────────────
+  /** Signs a `checkoutToken` for one purchase — required by `purchaseGameStoreOffer`. */
+  async createGameStoreCheckoutIntent(auth, body) {
+    return this.http.request("POST", "/sdk/games/store/checkout-intent", {
+      bearerToken: auth.bearerToken,
+      headers: {
+        "x-creator-key": auth.creatorKey,
+        "x-game-secret": auth.gameSecret,
+        "x-game-tracking-session-id": auth.trackingSessionId
+      },
+      body
+    });
+  }
+  async purchaseGameStoreOffer(auth, body) {
+    return this.http.request("POST", "/sdk/games/store/purchase", {
+      bearerToken: auth.bearerToken,
+      headers: {
+        "x-creator-key": auth.creatorKey,
+        "x-game-secret": auth.gameSecret,
+        "x-game-tracking-session-id": auth.trackingSessionId
+      },
+      body
+    });
+  }
   // ─────────────────────────────────────────────────────────────────────────────
   // Balance
   // ─────────────────────────────────────────────────────────────────────────────
@@ -416,6 +470,11 @@ var ApiClient = class {
   unsafeRaw() {
     return this.raw;
   }
+  // Real-time (balance_change / store_purchase_completed WebSocket events)
+  // deliberately lives outside this class — import `WsClient` from
+  // '@looplay/sdk/realtime' and construct it with the same `getAccessToken`
+  // you passed here. Keeps the socket.io-client dependency (and its bundle
+  // weight) out of every consumer that doesn't need real-time updates.
   async requireToken() {
     const token = await this.getAccessToken?.();
     if (!token) throw new NotAuthenticatedError();
@@ -554,10 +613,27 @@ var ApiClient = class {
     const token = await this.requireToken();
     return this.raw.listMyStorePurchases(token, gameKey);
   }
-  // There is no purchaseStoreOffer() here by design — spending coin balance
-  // requires the creator+game secret pair, which must be called from the
-  // game's own backend, never from this client-side SDK. Implement a
-  // checkout endpoint on your backend that calls gbs-service directly.
+  /**
+   * Spends coin balance to purchase a store offer — signs a checkout intent
+   * first, then redeems it, mirroring the gameplay attempt flow above.
+   * Self-serve: only the player's own access token is used, no secret pair
+   * required, safe to call directly from the game client. Also see
+   * `onStorePurchase` to react to the result in real time from any tab.
+   */
+  async purchaseStoreOffer(gameKey, offerCode, opts) {
+    const token = await this.requireToken();
+    const intent = await this.raw.createMyStoreCheckoutIntent(gameKey, token, {
+      offerCode,
+      requestId: opts?.requestId,
+      quantity: opts?.quantity
+    });
+    return this.raw.purchaseMyStoreOffer(gameKey, token, {
+      offerCode: intent.offerCode,
+      requestId: intent.requestId,
+      quantity: intent.quantity,
+      checkoutToken: intent.checkoutToken
+    });
+  }
   async getMyProfile() {
     const token = await this.requireToken();
     return this.raw.getMyProfile(token);