v1.4.0

includes/class-robotstxt-manager-core-client.php

@@ -361,6 +361,45 @@ class Robotstxt_Manager_Core_Client {
 		return $rows;
 	}
 
+	/**
+	 * Exchanges the account API key for a short-lived download token
+	 * (Core 1.9.0+ `POST /me/download-token`).
+	 *
+	 * @param string $slug Plugin slug the token may download.
+	 *
+	 * @return string Token string, or '' when unavailable (older Core, no
+	 *                key, inactive subscription, or transport error —
+	 *                callers fall back to the API-key flow).
+	 */
+	public function exchange_download_token( string $slug ): string {
+		if ( ! $this->has_api_key() ) {
+			return '';
+		}
+
+		$response = wp_remote_post(
+			$this->store_url . '/wp-json/' . self::REST_NAMESPACE . '/me/download-token',
+			array(
+				'headers' => array(
+					'Authorization' => 'Bearer ' . $this->api_key,
+					'Accept'        => 'application/json',
+					'Content-Type'  => 'application/json',
+				),
+				'body'    => (string) wp_json_encode( array( 'slug' => $slug ) ),
+				'timeout' => self::TIMEOUT,
+			)
+		);
+
+		if ( is_wp_error( $response ) || 200 !== (int) wp_remote_retrieve_response_code( $response ) ) {
+			return '';
+		}
+
+		$data = json_decode( wp_remote_retrieve_body( $response ), true );
+
+		$token = is_array( $data ) ? ( $data['token'] ?? '' ) : '';
+
+		return is_string( $token ) ? $token : '';
+	}
+
 	/**
 	 * Clears the cached subscriptions response (key change, manual refresh).
 	 *