@looplay/sdk 0.8.8 → 0.8.9

package/README.md

@@ -35,7 +35,6 @@ import { LooplayIframeAuth } from '@looplay/sdk';
 
 export const looplayAuth = new LooplayIframeAuth({
   appId: 'YOUR_APP_ID', // from your creator dashboard — required
-  apiUrl: 'https://api.looplay.gg',
 });
 ```
 
@@ -64,10 +63,11 @@ backward compatibility, but you should set one regardless).
 import { LooplayIframeAuth } from '@looplay/sdk';
 
 // 1. Initialize the SDK
+// apiUrl and parentOrigin are automatically configured:
+// - parentOrigin defaults to import.meta.env.VITE_PARENT_ORIGIN (or document.referrer)
+// - apiUrl defaults to import.meta.env.VITE_API_URL (or 'https://api.looplay.gg')
 export const looplayAuth = new LooplayIframeAuth({
   appId: 'YOUR_APP_ID', // from your creator dashboard
-  apiUrl: 'https://api.looplay.gg', // required for standalone builds; optional inside the iframe
-  parentOrigin: import.meta.env.VITE_PARENT_ORIGIN, // restrict the accepted postMessage origin
   
   // Optional: Auto-request rewarded ads after match activity
   autoRequestAds: {
@@ -309,7 +309,6 @@ directly, no bundler needed:
 <script>
   const looplayAuth = new LooplaySDK.LooplayIframeAuth({
     appId: 'YOUR_APP_ID',
-    apiUrl: 'https://api.looplay.gg',
   });
   looplayAuth.init();
   looplayAuth.initLifecycleTracking();
@@ -334,11 +333,13 @@ that's a separate opt-in browser bundle, only needed if you want
 </script>
 ```
 
-**Security note**: the origin check relies on `parentOrigin` (explicit option)
-or `document.referrer`. Referrer can be stripped by `Referrer-Policy`, browser
-privacy settings, or extensions — when that happens the check is skipped and
-`LooplayIframeAuth` logs a `console.warn`. Always pass `parentOrigin` explicitly
-in production embeds instead of relying on the referrer fallback.
+**Security note**: the origin check relies on `parentOrigin` (explicit option
+or `import.meta.env.VITE_PARENT_ORIGIN`), falling back to `document.referrer`.
+Referrer can be stripped by `Referrer-Policy`, browser privacy settings, or
+extensions — when that happens and no `parentOrigin` or `VITE_PARENT_ORIGIN` is configured,
+the check is skipped and `LooplayIframeAuth` logs a `console.warn`. Configure
+`VITE_PARENT_ORIGIN` in your environment or pass `parentOrigin` explicitly
+in production embeds instead of relying solely on the referrer fallback.
 
 **Lifecycle**: call `dispose()` when tearing down (route change, HMR, test
 cleanup) to remove the `message` listener and clear subscribers:

package/dist/looplay-sdk.cjs.js

@@ -1,5 +1,6 @@
 'use strict';
 
+var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
 // src/errors.ts
 var LooplaySDKError = class extends Error {
   constructor(message) {
@@ -684,6 +685,43 @@ var ApiClient = class {
   }
 };
 
+// src/constants.ts
+var DEFAULT_API_URL = "https://miniapp-api.looplay.gg";
+function resolveEnvParentOrigin() {
+  try {
+    if (typeof ({ url: (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('looplay-sdk.cjs.js', document.baseURI).href)) }) !== "undefined" && undefined?.VITE_PARENT_ORIGIN) {
+      const val = undefined.VITE_PARENT_ORIGIN;
+      if (typeof val === "string" && val.trim().length > 0) return val.trim();
+    }
+  } catch {
+  }
+  try {
+    if (typeof process !== "undefined" && process.env?.VITE_PARENT_ORIGIN) {
+      const val = process.env.VITE_PARENT_ORIGIN;
+      if (typeof val === "string" && val.trim().length > 0) return val.trim();
+    }
+  } catch {
+  }
+  return void 0;
+}
+function resolveEnvApiUrl() {
+  try {
+    if (typeof ({ url: (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('looplay-sdk.cjs.js', document.baseURI).href)) }) !== "undefined" && undefined) {
+      const val = undefined.VITE_API_URL ?? undefined.VITE_LOOPLAY_API_URL;
+      if (typeof val === "string" && val.trim().length > 0) return val.trim();
+    }
+  } catch {
+  }
+  try {
+    if (typeof process !== "undefined" && process.env) {
+      const val = process.env.VITE_API_URL ?? process.env.VITE_LOOPLAY_API_URL;
+      if (typeof val === "string" && val.trim().length > 0) return val.trim();
+    }
+  } catch {
+  }
+  return void 0;
+}
+
 // src/looplay-sdk.ts
 var LooplaySDK = class {
   auth;
@@ -691,7 +729,12 @@ var LooplaySDK = class {
   gameId;
   initialized = false;
   constructor(options = {}) {
-    const { auth, baseUrl, fetch, defaultHeaders } = options;
+    const {
+      auth,
+      baseUrl = resolveEnvApiUrl() ?? DEFAULT_API_URL,
+      fetch,
+      defaultHeaders
+    } = options;
     if (auth) {
       this.auth = new LooplayAuth(auth);
     }
@@ -964,7 +1007,7 @@ var LooplayIframeAuth = class {
     return this.state.jwt;
   }
   getApiUrl() {
-    return this.state.apiUrl ?? this.options.apiUrl ?? null;
+    return this.state.apiUrl ?? this.options.apiUrl ?? resolveEnvApiUrl() ?? DEFAULT_API_URL;
   }
   /** Resolves to the configured `appId`, falling back to whatever the parent pushed as `gameId`. */
   getGameId() {
@@ -1340,6 +1383,8 @@ ${gameId}`;
   }
   resolveParentOrigin() {
     if (this.options.parentOrigin) return this.options.parentOrigin;
+    const envOrigin = resolveEnvParentOrigin();
+    if (envOrigin) return envOrigin;
     if (typeof document === "undefined" || !document.referrer) return null;
     try {
       return new URL(document.referrer).origin;
@@ -1383,6 +1428,7 @@ ${gameId}`;
 
 exports.ApiClient = ApiClient;
 exports.BrowserLocalStorageAuthStorage = BrowserLocalStorageAuthStorage;
+exports.DEFAULT_API_URL = DEFAULT_API_URL;
 exports.HttpClient = HttpClient;
 exports.HttpError = HttpError;
 exports.LOOPLAY_SDK_VERSION = LOOPLAY_SDK_VERSION;
@@ -1397,5 +1443,7 @@ exports.NotAuthenticatedError = NotAuthenticatedError;
 exports.NotInitializedError = NotInitializedError;
 exports.ServiceClient = ServiceClient;
 exports.TelegramAuthProvider = TelegramAuthProvider;
+exports.resolveEnvApiUrl = resolveEnvApiUrl;
+exports.resolveEnvParentOrigin = resolveEnvParentOrigin;
 //# sourceMappingURL=looplay-sdk.cjs.js.map
 //# sourceMappingURL=looplay-sdk.cjs.js.map