@sorisdk/web-audio 0.6.1 → 0.6.3

package/README.md

@@ -13,7 +13,96 @@ Public integration guide: https://docs.soriapi.com/ko/integration/web
 - An ephemeral key issued by your server
 - Microphone permission granted by the user
 
-## Installation
+## Standalone CDN
+
+For a browser application that does not use npm or a bundler, import the
+versioned standalone module directly. No package installation, Vite/webpack
+configuration, or Node-based asset server is required:
+
+```html
+<script type="module">
+  import { AudioRecognizer } from
+    "https://cdn.iplateia.com/web/sorisdk/v0.6.3/sori-web-audio.mjs";
+
+  const recognizer = new AudioRecognizer({
+    appId: "YOUR_APP_ID",
+    ephemeralKey: async () => {
+      const response = await fetch("/api/ephemeral-key", {
+        method: "POST"
+      });
+
+      if (!response.ok) {
+        throw new Error(`Ephemeral key request failed: HTTP ${response.status}`);
+      }
+
+      const { ephemeral_key } = await response.json();
+      return ephemeral_key;
+    }
+  });
+
+  recognizer.on("campaign", (event) => {
+    console.log(event.campaign);
+  });
+
+  await recognizer.start();
+</script>
+```
+
+Static URL imports are valid inside `<script type="module">`. Dynamic
+`await import("https://cdn.iplateia.com/web/sorisdk/v0.6.3/sori-web-audio.mjs")`
+is an optional alternative when the SDK should be loaded conditionally.
+
+Pin an exact version in production. Do not construct a mutable `latest` URL.
+The module loads its versioned WASM assets and the shared
+`https://cdn.iplateia.com/web/sorisdk/model.pack` automatically.
+
+The standalone module removes the frontend build/server requirement, but it
+does not remove the trusted server requirement for ephemeral credentials.
+Provide a backend or serverless endpoint for the `ephemeralKey` callback, and
+never place a long-lived application secret in browser code.
+
+The application operator is responsible for protecting that endpoint with the
+authentication or anonymous-user verification appropriate to the product,
+plus per-user/IP/session rate limits, issuance quotas, and abuse monitoring. A
+public endpoint that returns a reusable key to every POST request can let an
+anonymous caller consume recognition quota. CORS is required when the endpoint
+is on a different origin, but CORS is not authentication and does not stop
+scripts, bots, or non-browser clients from calling the endpoint.
+
+Production billing and abuse protection must also rely on server-enforced key
+expiry, app/session scope, revocation, and usage quotas. Do not treat the word
+“ephemeral” or secrecy of a browser-visible key as the security boundary.
+
+For a strict Content Security Policy, allow WebAssembly compilation with
+`'wasm-unsafe-eval'`, allow `https://cdn.iplateia.com` in `script-src` and
+`connect-src`, and add the SORI API plus ephemeral-key endpoint origins to
+`connect-src`. For example:
+
+```text
+script-src 'self' 'wasm-unsafe-eval' https://cdn.iplateia.com;
+connect-src 'self' https://cdn.iplateia.com https://console.soriapi.com;
+```
+
+If the module script is inline as in the example above, authorize that script
+with a nonce or hash (or move it into an allowed external script) instead of
+adding `'unsafe-inline'`.
+
+An import map can give the standalone URL the npm package name:
+
+```html
+<script type="importmap">
+{
+  "imports": {
+    "@sorisdk/web-audio": "https://cdn.iplateia.com/web/sorisdk/v0.6.3/sori-web-audio.mjs"
+  }
+}
+</script>
+<script type="module">
+  import { AudioRecognizer } from "@sorisdk/web-audio";
+</script>
+```
+
+## npm installation
 
 ```bash
 npm install @sorisdk/web-audio

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sorisdk/web-audio",
-  "version": "0.6.1",
+  "version": "0.6.3",
   "description": "Web SDK for browser-based audio recognition with SORI API",
   "type": "module",
   "main": "./dist/index.js",
@@ -34,8 +34,8 @@
   "license": "SEE LICENSE IN LICENSE.md",
   "homepage": "https://docs.soriapi.com/ko/integration/web",
   "dependencies": {
-    "@sorisdk/afpgen": "0.6.1",
-    "@sorisdk/matcher": "0.6.1"
+    "@sorisdk/matcher": "0.6.3",
+    "@sorisdk/afpgen": "0.6.3"
   },
   "devDependencies": {
     "tsup": "^8.5.1",
@@ -45,6 +45,8 @@
   "scripts": {
     "build:wasm": "node ../../scripts/build-wasm-package.mjs web-audio",
     "build": "tsup src/index.ts --format esm --dts && pnpm run build:wasm && node ../../scripts/write-default-loader.mjs packages/web-audio ./generated/window.js",
+    "build:standalone": "pnpm --dir ../afpgen build && pnpm --dir ../matcher build && pnpm run build && vite build --config vite.standalone.config.ts && node ../../scripts/write-standalone-manifest.mjs && node ../../scripts/check-standalone-distribution.mjs",
+    "check:standalone": "node ../../scripts/check-standalone-distribution.mjs",
     "test": "vitest run",
     "test:watch": "vitest"
   }