@looplay/sdk 0.8.8 → 0.8.10

package/README.md

@@ -35,7 +35,6 @@ import { LooplayIframeAuth } from '@looplay/sdk';
 
 export const looplayAuth = new LooplayIframeAuth({
   appId: 'YOUR_APP_ID', // from your creator dashboard — required
-  apiUrl: 'https://api.looplay.gg',
 });
 ```
 
@@ -64,10 +63,11 @@ backward compatibility, but you should set one regardless).
 import { LooplayIframeAuth } from '@looplay/sdk';
 
 // 1. Initialize the SDK
+// apiUrl and parentOrigin are automatically configured:
+// - parentOrigin defaults to import.meta.env.VITE_PARENT_ORIGIN (or document.referrer)
+// - apiUrl defaults to import.meta.env.VITE_API_URL (or 'https://api.looplay.gg')
 export const looplayAuth = new LooplayIframeAuth({
   appId: 'YOUR_APP_ID', // from your creator dashboard
-  apiUrl: 'https://api.looplay.gg', // required for standalone builds; optional inside the iframe
-  parentOrigin: import.meta.env.VITE_PARENT_ORIGIN, // restrict the accepted postMessage origin
   
   // Optional: Auto-request rewarded ads after match activity
   autoRequestAds: {
@@ -309,7 +309,6 @@ directly, no bundler needed:
 <script>
   const looplayAuth = new LooplaySDK.LooplayIframeAuth({
     appId: 'YOUR_APP_ID',
-    apiUrl: 'https://api.looplay.gg',
   });
   looplayAuth.init();
   looplayAuth.initLifecycleTracking();
@@ -334,11 +333,13 @@ that's a separate opt-in browser bundle, only needed if you want
 </script>
 ```
 
-**Security note**: the origin check relies on `parentOrigin` (explicit option)
-or `document.referrer`. Referrer can be stripped by `Referrer-Policy`, browser
-privacy settings, or extensions — when that happens the check is skipped and
-`LooplayIframeAuth` logs a `console.warn`. Always pass `parentOrigin` explicitly
-in production embeds instead of relying on the referrer fallback.
+**Security note**: the origin check relies on `parentOrigin` (explicit option
+or `import.meta.env.VITE_PARENT_ORIGIN`), falling back to `document.referrer`.
+Referrer can be stripped by `Referrer-Policy`, browser privacy settings, or
+extensions — when that happens and no `parentOrigin` or `VITE_PARENT_ORIGIN` is configured,
+the check is skipped and `LooplayIframeAuth` logs a `console.warn`. Configure
+`VITE_PARENT_ORIGIN` in your environment or pass `parentOrigin` explicitly
+in production embeds instead of relying solely on the referrer fallback.
 
 **Lifecycle**: call `dispose()` when tearing down (route change, HMR, test
 cleanup) to remove the `message` listener and clear subscribers:

package/dist/looplay-sdk.cjs.js

@@ -1,5 +1,6 @@
 'use strict';
 
+var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
 // src/errors.ts
 var LooplaySDKError = class extends Error {
   constructor(message) {
@@ -139,8 +140,45 @@ var LooplayAuth = class {
   }
 };
 
+// src/constants.ts
+var DEFAULT_API_URL = "https://miniapp-api.looplay.gg";
+function resolveEnvParentOrigin() {
+  try {
+    if (typeof ({ url: (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('looplay-sdk.cjs.js', document.baseURI).href)) }) !== "undefined" && undefined?.VITE_PARENT_ORIGIN) {
+      const val = undefined.VITE_PARENT_ORIGIN;
+      if (typeof val === "string" && val.trim().length > 0) return val.trim();
+    }
+  } catch {
+  }
+  try {
+    if (typeof process !== "undefined" && process.env?.VITE_PARENT_ORIGIN) {
+      const val = process.env.VITE_PARENT_ORIGIN;
+      if (typeof val === "string" && val.trim().length > 0) return val.trim();
+    }
+  } catch {
+  }
+  return void 0;
+}
+function resolveEnvApiUrl() {
+  try {
+    if (typeof ({ url: (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('looplay-sdk.cjs.js', document.baseURI).href)) }) !== "undefined" && undefined) {
+      const val = undefined.VITE_API_URL ?? undefined.VITE_LOOPLAY_API_URL;
+      if (typeof val === "string" && val.trim().length > 0) return val.trim();
+    }
+  } catch {
+  }
+  try {
+    if (typeof process !== "undefined" && process.env) {
+      const val = process.env.VITE_API_URL ?? process.env.VITE_LOOPLAY_API_URL;
+      if (typeof val === "string" && val.trim().length > 0) return val.trim();
+    }
+  } catch {
+  }
+  return void 0;
+}
+
 // src/version.ts
-var LOOPLAY_SDK_VERSION = "0.8.5";
+var LOOPLAY_SDK_VERSION = "0.8.10";
 
 // src/apps/http.ts
 function getFetchFn(fetchOverride) {
@@ -166,8 +204,9 @@ var HttpClient = class {
   baseUrl;
   fetchFn;
   defaultHeaders;
-  constructor(options) {
-    this.baseUrl = options.baseUrl.replace(/\/$/, "");
+  constructor(options = {}) {
+    const rawBaseUrl = typeof options.baseUrl === "string" && options.baseUrl.trim().length > 0 ? options.baseUrl.trim() : resolveEnvApiUrl() ?? DEFAULT_API_URL;
+    this.baseUrl = rawBaseUrl.replace(/\/$/, "");
     this.fetchFn = getFetchFn(options.fetch);
     this.defaultHeaders = {
       "x-looplay-sdk-version": LOOPLAY_SDK_VERSION,
@@ -463,10 +502,11 @@ var ApiClient = class {
   playSession;
   playSessionPromiseKey;
   playSessionPromise;
-  constructor(options) {
-    if (!options.baseUrl) throw new MissingBaseUrlError();
+  constructor(options = {}) {
+    const baseUrl = typeof options.baseUrl === "string" && options.baseUrl.trim().length > 0 ? options.baseUrl.trim() : resolveEnvApiUrl() ?? DEFAULT_API_URL;
+    if (!baseUrl) throw new MissingBaseUrlError();
     this.raw = new ServiceClient({
-      baseUrl: options.baseUrl,
+      baseUrl,
       fetch: options.fetch,
       defaultHeaders: options.defaultHeaders
     });
@@ -691,18 +731,21 @@ var LooplaySDK = class {
   gameId;
   initialized = false;
   constructor(options = {}) {
-    const { auth, baseUrl, fetch, defaultHeaders } = options;
+    const {
+      auth,
+      fetch,
+      defaultHeaders
+    } = options;
+    const baseUrl = typeof options.baseUrl === "string" && options.baseUrl.trim().length > 0 ? options.baseUrl.trim() : resolveEnvApiUrl() ?? DEFAULT_API_URL;
     if (auth) {
       this.auth = new LooplayAuth(auth);
     }
-    if (baseUrl) {
-      this.api = new ApiClient({
-        baseUrl,
-        fetch,
-        defaultHeaders,
-        getAccessToken: async () => this.auth?.getAccessToken()
-      });
-    }
+    this.api = new ApiClient({
+      baseUrl,
+      fetch,
+      defaultHeaders,
+      getAccessToken: async () => this.auth?.getAccessToken()
+    });
   }
   async init(params) {
     this.gameId = params.gameId;
@@ -964,7 +1007,8 @@ var LooplayIframeAuth = class {
     return this.state.jwt;
   }
   getApiUrl() {
-    return this.state.apiUrl ?? this.options.apiUrl ?? null;
+    const raw = toOptionalString(this.state.apiUrl) ?? toOptionalString(this.options.apiUrl) ?? resolveEnvApiUrl() ?? DEFAULT_API_URL;
+    return raw.trim();
   }
   /** Resolves to the configured `appId`, falling back to whatever the parent pushed as `gameId`. */
   getGameId() {
@@ -1339,7 +1383,12 @@ ${gameId}`;
     }
   }
   resolveParentOrigin() {
-    if (this.options.parentOrigin) return this.options.parentOrigin;
+    if (this.options.parentOrigin) {
+      const opt = toOptionalString(this.options.parentOrigin);
+      if (opt) return opt;
+    }
+    const envOrigin = resolveEnvParentOrigin();
+    if (envOrigin) return envOrigin;
     if (typeof document === "undefined" || !document.referrer) return null;
     try {
       return new URL(document.referrer).origin;
@@ -1383,6 +1432,7 @@ ${gameId}`;
 
 exports.ApiClient = ApiClient;
 exports.BrowserLocalStorageAuthStorage = BrowserLocalStorageAuthStorage;
+exports.DEFAULT_API_URL = DEFAULT_API_URL;
 exports.HttpClient = HttpClient;
 exports.HttpError = HttpError;
 exports.LOOPLAY_SDK_VERSION = LOOPLAY_SDK_VERSION;
@@ -1397,5 +1447,7 @@ exports.NotAuthenticatedError = NotAuthenticatedError;
 exports.NotInitializedError = NotInitializedError;
 exports.ServiceClient = ServiceClient;
 exports.TelegramAuthProvider = TelegramAuthProvider;
+exports.resolveEnvApiUrl = resolveEnvApiUrl;
+exports.resolveEnvParentOrigin = resolveEnvParentOrigin;
 //# sourceMappingURL=looplay-sdk.cjs.js.map
 //# sourceMappingURL=looplay-sdk.cjs.js.map