@looplay/sdk 0.8.7 → 0.8.9

package/README.md

@@ -35,7 +35,6 @@ import { LooplayIframeAuth } from '@looplay/sdk';
 
 export const looplayAuth = new LooplayIframeAuth({
   appId: 'YOUR_APP_ID', // from your creator dashboard — required
-  apiUrl: 'https://api.looplay.gg',
 });
 ```
 
@@ -64,10 +63,11 @@ backward compatibility, but you should set one regardless).
 import { LooplayIframeAuth } from '@looplay/sdk';
 
 // 1. Initialize the SDK
+// apiUrl and parentOrigin are automatically configured:
+// - parentOrigin defaults to import.meta.env.VITE_PARENT_ORIGIN (or document.referrer)
+// - apiUrl defaults to import.meta.env.VITE_API_URL (or 'https://api.looplay.gg')
 export const looplayAuth = new LooplayIframeAuth({
   appId: 'YOUR_APP_ID', // from your creator dashboard
-  apiUrl: 'https://api.looplay.gg', // required for standalone builds; optional inside the iframe
-  parentOrigin: import.meta.env.VITE_PARENT_ORIGIN, // restrict the accepted postMessage origin
   
   // Optional: Auto-request rewarded ads after match activity
   autoRequestAds: {
@@ -309,7 +309,6 @@ directly, no bundler needed:
 <script>
   const looplayAuth = new LooplaySDK.LooplayIframeAuth({
     appId: 'YOUR_APP_ID',
-    apiUrl: 'https://api.looplay.gg',
   });
   looplayAuth.init();
   looplayAuth.initLifecycleTracking();
@@ -334,11 +333,13 @@ that's a separate opt-in browser bundle, only needed if you want
 </script>
 ```
 
-**Security note**: the origin check relies on `parentOrigin` (explicit option)
-or `document.referrer`. Referrer can be stripped by `Referrer-Policy`, browser
-privacy settings, or extensions — when that happens the check is skipped and
-`LooplayIframeAuth` logs a `console.warn`. Always pass `parentOrigin` explicitly
-in production embeds instead of relying on the referrer fallback.
+**Security note**: the origin check relies on `parentOrigin` (explicit option
+or `import.meta.env.VITE_PARENT_ORIGIN`), falling back to `document.referrer`.
+Referrer can be stripped by `Referrer-Policy`, browser privacy settings, or
+extensions — when that happens and no `parentOrigin` or `VITE_PARENT_ORIGIN` is configured,
+the check is skipped and `LooplayIframeAuth` logs a `console.warn`. Configure
+`VITE_PARENT_ORIGIN` in your environment or pass `parentOrigin` explicitly
+in production embeds instead of relying solely on the referrer fallback.
 
 **Lifecycle**: call `dispose()` when tearing down (route change, HMR, test
 cleanup) to remove the `message` listener and clear subscribers:

package/dist/looplay-sdk.cjs.js

@@ -1,5 +1,6 @@
 'use strict';
 
+var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
 // src/errors.ts
 var LooplaySDKError = class extends Error {
   constructor(message) {
@@ -684,6 +685,43 @@ var ApiClient = class {
   }
 };
 
+// src/constants.ts
+var DEFAULT_API_URL = "https://miniapp-api.looplay.gg";
+function resolveEnvParentOrigin() {
+  try {
+    if (typeof ({ url: (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('looplay-sdk.cjs.js', document.baseURI).href)) }) !== "undefined" && undefined?.VITE_PARENT_ORIGIN) {
+      const val = undefined.VITE_PARENT_ORIGIN;
+      if (typeof val === "string" && val.trim().length > 0) return val.trim();
+    }
+  } catch {
+  }
+  try {
+    if (typeof process !== "undefined" && process.env?.VITE_PARENT_ORIGIN) {
+      const val = process.env.VITE_PARENT_ORIGIN;
+      if (typeof val === "string" && val.trim().length > 0) return val.trim();
+    }
+  } catch {
+  }
+  return void 0;
+}
+function resolveEnvApiUrl() {
+  try {
+    if (typeof ({ url: (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('looplay-sdk.cjs.js', document.baseURI).href)) }) !== "undefined" && undefined) {
+      const val = undefined.VITE_API_URL ?? undefined.VITE_LOOPLAY_API_URL;
+      if (typeof val === "string" && val.trim().length > 0) return val.trim();
+    }
+  } catch {
+  }
+  try {
+    if (typeof process !== "undefined" && process.env) {
+      const val = process.env.VITE_API_URL ?? process.env.VITE_LOOPLAY_API_URL;
+      if (typeof val === "string" && val.trim().length > 0) return val.trim();
+    }
+  } catch {
+  }
+  return void 0;
+}
+
 // src/looplay-sdk.ts
 var LooplaySDK = class {
   auth;
@@ -691,7 +729,12 @@ var LooplaySDK = class {
   gameId;
   initialized = false;
   constructor(options = {}) {
-    const { auth, baseUrl, fetch, defaultHeaders } = options;
+    const {
+      auth,
+      baseUrl = resolveEnvApiUrl() ?? DEFAULT_API_URL,
+      fetch,
+      defaultHeaders
+    } = options;
     if (auth) {
       this.auth = new LooplayAuth(auth);
     }
@@ -776,9 +819,23 @@ var LooplaySDK = class {
     if (!this.api) throw new MissingBaseUrlError();
     await this.api.listGameAssets(params.gameId);
   }
+  /**
+   * Best-effort self-report — must never block init(). A missing/misconfigured
+   * whitelist (a separate setup step from SDK integration) makes the backend
+   * reject this call; if that rejection propagated, the whole init() would
+   * reject too and every other SDK method would throw NotInitializedError,
+   * breaking a game over what's really just an unfinished onboarding step.
+   */
   async detectIntegration(params) {
     if (!this.api) return;
-    await this.api.detectIntegration(params.gameId);
+    try {
+      await this.api.detectIntegration(params.gameId);
+    } catch (error) {
+      console.warn(
+        "[LooplaySDK] detectIntegration failed (SDK will still initialize) \u2014 check that this game has a whitelisted origin/domain configured:",
+        error
+      );
+    }
   }
 };
 
@@ -950,7 +1007,7 @@ var LooplayIframeAuth = class {
     return this.state.jwt;
   }
   getApiUrl() {
-    return this.state.apiUrl ?? this.options.apiUrl ?? null;
+    return this.state.apiUrl ?? this.options.apiUrl ?? resolveEnvApiUrl() ?? DEFAULT_API_URL;
   }
   /** Resolves to the configured `appId`, falling back to whatever the parent pushed as `gameId`. */
   getGameId() {
@@ -1152,12 +1209,13 @@ var LooplayIframeAuth = class {
   }
   /**
    * Idempotent; auto-emits GAME_STARTED exactly once per distinct auth
-   * session (bearer or anonymous), and self-reports SDK integration the
-   * same way the standalone `LooplaySDK.init()` does — without this, games
-   * embedded via iframe never trigger the active detect call, only the
-   * passive heartbeat that tracking calls leave behind (which doesn't fire
-   * at all while the game is still IN_REVIEW/not LIVE, since tracking is
-   * blocked until then).
+   * session (bearer or anonymous). SDK integration self-reporting for the
+   * iframe path lives in `detectIntegrationOnce()` (fired from `setState()`
+   * on every auth/config change, not gated behind lifecycle tracking being
+   * enabled at all) — without it, games embedded via iframe would never
+   * trigger the active detect call, only the passive heartbeat that
+   * tracking calls leave behind (which doesn't fire while the game is still
+   * IN_REVIEW/not LIVE, since tracking is blocked until then).
    */
   initLifecycleTracking() {
     if (this.lifecycleTrackingInitialized || typeof window === "undefined")
@@ -1168,11 +1226,6 @@ var LooplayIframeAuth = class {
       const key = this.getTrackingKey();
       if (!key || this.lastGameStartedKey === key) return;
       this.lastGameStartedKey = key;
-      const gameId = this.getGameId();
-      if (gameId) {
-        this.debug("auto detectIntegration dispatch", { gameId });
-        void this.getClient().detectIntegration(gameId).catch(() => void 0);
-      }
       this.debug("auto GAME_STARTED dispatch");
       void this.emitGameEvent("GAME_STARTED");
     });
@@ -1330,6 +1383,8 @@ ${gameId}`;
   }
   resolveParentOrigin() {
     if (this.options.parentOrigin) return this.options.parentOrigin;
+    const envOrigin = resolveEnvParentOrigin();
+    if (envOrigin) return envOrigin;
     if (typeof document === "undefined" || !document.referrer) return null;
     try {
       return new URL(document.referrer).origin;
@@ -1373,6 +1428,7 @@ ${gameId}`;
 
 exports.ApiClient = ApiClient;
 exports.BrowserLocalStorageAuthStorage = BrowserLocalStorageAuthStorage;
+exports.DEFAULT_API_URL = DEFAULT_API_URL;
 exports.HttpClient = HttpClient;
 exports.HttpError = HttpError;
 exports.LOOPLAY_SDK_VERSION = LOOPLAY_SDK_VERSION;
@@ -1387,5 +1443,7 @@ exports.NotAuthenticatedError = NotAuthenticatedError;
 exports.NotInitializedError = NotInitializedError;
 exports.ServiceClient = ServiceClient;
 exports.TelegramAuthProvider = TelegramAuthProvider;
+exports.resolveEnvApiUrl = resolveEnvApiUrl;
+exports.resolveEnvParentOrigin = resolveEnvParentOrigin;
 //# sourceMappingURL=looplay-sdk.cjs.js.map
 //# sourceMappingURL=looplay-sdk.cjs.js.map