@wvdsh/sdk-js 1.3.0 → 1.3.2

package/dist/index.d.ts

@@ -871,9 +871,11 @@ declare class WavedashSDK extends EventTarget {
     overlayManager: OverlayManager;
     private gameplayJwt;
     private gameplayJwtPromise;
+    private setupWarningTimeout;
     ugcHost: string;
     uploadsHost: string;
     constructor(sdkConfig: SDKConfig);
+    private clearSetupWarning;
     init(config?: WavedashConfig): boolean;
     /**
      * Signal that the game is ready to receive events (LobbyJoined, LobbyMessage, etc).
@@ -1137,8 +1139,12 @@ declare class WavedashSDK extends EventTarget {
      * fetcher wired into `ConvexClient.setAuth` and honors `forceRefresh` so the
      * server can invalidate a stale token.
      *
+     * Same-origin POST to /auth/refresh on the play domain — the
+     * gameplaySession cookie set by the play server during playKey exchange
+     * authenticates the request, so no cross-origin credentials handling needed.
+     *
      * Concurrent callers share a single in-flight fetch to avoid duplicate
-     * requests to the parent's gameplay-token endpoint.
+     * refresh round-trips.
      */
     private getAuthToken;
     /**

package/dist/index.js

@@ -3033,18 +3033,13 @@ var WavedashLogger = class {
 };
 
 // src/utils/parentOrigin.ts
-function deriveParentOrigin() {
-  if (typeof window === "undefined") return "";
-  const iframeHost = window.location.host;
-  const match = iframeHost.match(/^[\w-]+\.(builds|local)\.(.+)$/);
-  if (match) {
-    const parentDomain = match[2];
-    return `${window.location.protocol}//${parentDomain}`;
-  }
-  console.error(`Invalid iframe hostname pattern: ${iframeHost}`);
-  return "";
+var _parentOrigin = "";
+function setParentOrigin(origin) {
+  _parentOrigin = origin;
+}
+function getParentOrigin() {
+  return _parentOrigin;
 }
-var parentOrigin = deriveParentOrigin();
 
 // src/utils/iframeMessenger.ts
 var RESPONSE_TIMEOUT_MS = 15e3;
@@ -3052,7 +3047,7 @@ var IFrameMessenger = class {
   constructor() {
     // Arrow function automatically captures 'this' from the class instance
     this.handleMessage = (event) => {
-      if (event.origin !== parentOrigin) {
+      if (event.origin !== getParentOrigin()) {
         if (event.source !== window) {
           console.warn(`Ignored message from untrusted origin: ${event.origin}`);
         }
@@ -3097,12 +3092,14 @@ var IFrameMessenger = class {
     this.listeners.get(type)?.delete(listener);
   }
   postToParent(requestType, data) {
+    const parentOrigin = getParentOrigin();
     if (typeof window === "undefined" || !parentOrigin) return false;
     window.parent.postMessage({ type: requestType, ...data }, parentOrigin);
     return true;
   }
   async requestFromParent(requestType, data) {
     return new Promise((resolve, reject) => {
+      const parentOrigin = getParentOrigin();
       if (typeof window === "undefined" || !parentOrigin) {
         reject(new Error("Parent origin not found"));
         return;
@@ -3261,6 +3258,7 @@ var WavedashSDK = class extends EventTarget {
     this.engineInstance = null;
     this.gameplayJwt = null;
     this.gameplayJwtPromise = null;
+    this.setupWarningTimeout = null;
     // ==============
     // Event listening
     // ==============
@@ -3300,6 +3298,12 @@ var WavedashSDK = class extends EventTarget {
     ]);
     this.setupSessionEndListeners();
     this.launchParams = sdkConfig.launchParams ?? {};
+    this.setupWarningTimeout = setTimeout(() => {
+      this.setupWarningTimeout = null;
+      this.logger.warn(
+        "Wavedash.init(), Wavedash.loadComplete(), or Wavedash.updateLoadProgressZeroToOne() not called yet"
+      );
+    }, 1e4);
   }
   get initialized() {
     return this._initialized;
@@ -3307,6 +3311,12 @@ var WavedashSDK = class extends EventTarget {
   get eventsReady() {
     return this._eventsReady;
   }
+  clearSetupWarning() {
+    if (this.setupWarningTimeout !== null) {
+      clearTimeout(this.setupWarningTimeout);
+      this.setupWarningTimeout = null;
+    }
+  }
   // =============
   // Setup methods
   // =============
@@ -3409,11 +3419,13 @@ var WavedashSDK = class extends EventTarget {
       [["progress", vNumber]],
       [progress]
     );
+    this.clearSetupWarning();
     iframeMessenger.postToParent(IFRAME_MESSAGE_TYPE5.PROGRESS_UPDATE, {
       progress
     });
   }
   loadComplete() {
+    this.clearSetupWarning();
     if (this.gameFinishedLoading) return;
     this.gameFinishedLoading = true;
     this.heartbeatManager.start();
@@ -4160,8 +4172,12 @@ var WavedashSDK = class extends EventTarget {
    * fetcher wired into `ConvexClient.setAuth` and honors `forceRefresh` so the
    * server can invalidate a stale token.
    *
+   * Same-origin POST to /auth/refresh on the play domain — the
+   * gameplaySession cookie set by the play server during playKey exchange
+   * authenticates the request, so no cross-origin credentials handling needed.
+   *
    * Concurrent callers share a single in-flight fetch to avoid duplicate
-   * requests to the parent's gameplay-token endpoint.
+   * refresh round-trips.
    */
   getAuthToken(forceRefresh = false) {
     if (!forceRefresh && this.gameplayJwt) {
@@ -4171,14 +4187,12 @@ var WavedashSDK = class extends EventTarget {
       return this.gameplayJwtPromise;
     }
     const promise = (async () => {
-      const response = await fetch(
-        `${parentOrigin}/auth/gameplay_token/${this.gameCloudId}`,
-        {
-          credentials: "include"
-        }
-      );
+      const response = await fetch("/auth/refresh", {
+        method: "POST",
+        credentials: "same-origin"
+      });
       if (!response.ok) {
-        throw new Error(`Failed to fetch gameplay token: ${response.status}`);
+        throw new Error(`Failed to refresh gameplay token: ${response.status}`);
       }
       this.gameplayJwt = await response.text();
       return this.gameplayJwt;
@@ -4263,6 +4277,7 @@ function setupWavedashSDK() {
       `Wavedash SDK: failed to parse ?${UrlParams.SdkConfig}= as JSON: ${message}`
     );
   }
+  setParentOrigin(sdkConfig.parentOrigin);
   const sdk = new WavedashSDK(sdkConfig);
   window.Wavedash = sdk;
   window.WavedashJS = sdk;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wvdsh/sdk-js",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "type": "module",
   "description": "Wavedash JavaScript SDK",
   "main": "./dist/client.js",
@@ -49,7 +49,7 @@
     "typescript-eslint": "^8.52.0"
   },
   "dependencies": {
-    "@wvdsh/api": "^0.1.3",
+    "@wvdsh/api": "^0.1.9",
     "convex": "^1.34.0",
     "lodash.debounce": "^4.0.8"
   }