@streamlayer/feature-advertisement 1.1.1-rc.1350 → 1.1.1-rc.3.pda7fd93b

package/lib/classic/cjs/units/ssai-detector.js

@@ -23,6 +23,7 @@ require('core-js/modules/esnext.set.symmetric-difference.v2.js');
 require('core-js/modules/esnext.set.union.v2.js');
 require('core-js/modules/web.dom-collections.iterator.js');
 var classic = require('@streamlayer/sdk-web-logger/classic');
+var ssaiLog = require('./ssai-log.js');
 
 const log = classic.createLogger('ssai:detector');
 const RANGE_EXPIRY_MS = 10 * 60 * 1000;
@@ -536,16 +537,37 @@ const createSsaiDetector = options => {
   // Malformed tags persist in the manifest across refreshes; log each once.
   const seenDroppedKeys = new Set();
   const attachMode = player ? 'hls' : videoRef && manifestUrl ? 'manifest-poll' : 'none';
-  const recordDebugEvent = (type, detail, programMs) => {
+  /**
+   * The `[label]` a detector event's log line opens with — what KIND of thing
+   * happened, for a reader scanning a window: a manifest tag came in (`hls`), a
+   * break edge fired (`break`), or playback crossed a tracking marker (`beacon`).
+   */
+  const eventLabel = type => {
+    if (type.indexOf('progress:') === 0) return 'beacon';
+    if (type.indexOf('discovered') !== -1 || type === 'range-dropped') return 'hls';
+    return 'break';
+  };
+  /**
+   * One call per detector event, feeding both consumers at once: the capped
+   * ring buffer behind `getDebugSnapshot()` and the `ssaiq` narrative logger.
+   * `data` is whatever the detector already holds for the event — the parsed
+   * range, marker or break window — so a log reader sees exactly what the
+   * detector acted on, with no second parse of the manifest for its benefit.
+   */
+  const recordDebugEvent = (type, detail, programMs, data) => {
+    const at = programMs !== undefined ? programMs : currentProgramTimeMs();
     debugEvents.push({
       wallMs: Date.now(),
-      programMs: programMs !== undefined ? programMs : currentProgramTimeMs(),
+      programMs: at,
       type,
       detail
     });
     if (debugEvents.length > DEBUG_EVENTS_MAX) {
       debugEvents.splice(0, debugEvents.length - DEBUG_EVENTS_MAX);
     }
+    ssaiLog.ssaiq.info(_rollupPluginBabelHelpers.objectSpread2(_rollupPluginBabelHelpers.objectSpread2({}, data), {}, {
+      programMs: at
+    }), `[${eventLabel(type)}] ${type}${detail ? ` ${detail}` : ''}`);
   };
   const getVideo = () => {
     var _ref, _player$media2;
@@ -598,9 +620,6 @@ const createSsaiDetector = options => {
           }
           seenDroppedKeys.add(entry.key);
           recordDebugEvent('range-dropped', entry.detail);
-          log.warn({
-            detail: entry.detail
-          }, 'ssai DATERANGE dropped');
         }
         continue;
       }
@@ -608,7 +627,9 @@ const createSsaiDetector = options => {
         const existing = rangesById.get(entry.range.id);
         if (!existing) {
           changed = true;
-          recordDebugEvent('range-discovered', `${entry.range.creativeId} ${debugClock(entry.range.startMs)}+${entry.range.durationSec}s`);
+          recordDebugEvent('range-discovered', `${entry.range.creativeId} ${debugClock(entry.range.startMs)}+${entry.range.durationSec}s`, undefined, {
+            range: entry.range
+          });
           notifyAdDiscovered(entry.range.creativeId);
         } else if (existing.startMs !== entry.range.startMs || existing.endMs !== entry.range.endMs) {
           changed = true;
@@ -617,7 +638,9 @@ const createSsaiDetector = options => {
       } else if (entry.kind === 'marker') {
         if (!seenMarkerAdIds.has(entry.marker.adId)) {
           seenMarkerAdIds.add(entry.marker.adId);
-          recordDebugEvent('marker-ad-discovered', `${entry.marker.adId} ${entry.marker.event}@${debugClock(entry.marker.timeMs)}`);
+          recordDebugEvent('marker-ad-discovered', `${entry.marker.adId} ${entry.marker.event}@${debugClock(entry.marker.timeMs)}`, undefined, {
+            marker: entry.marker
+          });
           notifyAdDiscovered(entry.marker.adId);
         }
         const existing = markersById.get(entry.marker.id);
@@ -629,7 +652,9 @@ const createSsaiDetector = options => {
         const existing = adBreaksById.get(entry.window.id);
         if (!existing) {
           changed = true;
-          recordDebugEvent('adbreak-discovered', `${debugClock(entry.window.startMs)}-${debugClock(entry.window.endMs)}`);
+          recordDebugEvent('adbreak-discovered', `${debugClock(entry.window.startMs)}-${debugClock(entry.window.endMs)}`, undefined, {
+            window: entry.window
+          });
         } else if (existing.startMs !== entry.window.startMs || existing.endMs !== entry.window.endMs) {
           changed = true;
         }

package/lib/classic/cjs/units/ssai-log.js

@@ -0,0 +1,23 @@
+'use strict';
+
+var classic = require('@streamlayer/sdk-web-logger/classic');
+
+/**
+ * `ssaiq` — the SSAI ad NARRATIVE log: one line per thing that happens to a
+ * server-stitched ad, in the order it happens. The manifest tag the playout
+ * published, the metadata round trip it triggers, the break the SDK opens from
+ * it, and every beacon fired against it.
+ *
+ * Named for the Quortex/Synamedia DAI integration it was built for, but it is
+ * the path itself that is logged, so a StreamLayer-dialect stream tells the same
+ * story. Detector internals — clock sources, poll ticks, fold bookkeeping — stay
+ * on `ssai:*`, where `SL_DEBUG` can reach them without filling a demo window.
+ *
+ * A host publishes it to the page with `SL_LOG_EVENTS=ssaiq` (see
+ * `sdk-web-logger`); the demo's log window renders exactly that.
+ */
+// Explicit type: the inferred pino type is not nameable across package
+// boundaries (TS2742) when this file is compiled on its own.
+const ssaiq = classic.createLogger('ssaiq');
+
+exports.ssaiq = ssaiq;

package/lib/classic/cjs/units/ssai-providers.js

@@ -4,6 +4,8 @@ var _rollupPluginBabelHelpers = require('../_virtual/_rollupPluginBabelHelpers.j
 require('core-js/modules/es.error.cause.js');
 require('core-js/modules/es.array.iterator.js');
 require('core-js/modules/es.promise.js');
+require('core-js/modules/es.regexp.exec.js');
+require('core-js/modules/es.string.replace.js');
 require('core-js/modules/esnext.iterator.constructor.js');
 require('core-js/modules/esnext.iterator.filter.js');
 require('core-js/modules/esnext.iterator.find.js');
@@ -12,9 +14,82 @@ require('core-js/modules/web.dom-collections.iterator.js');
 require('core-js/modules/web.dom-exception.stack.js');
 var classic = require('@streamlayer/sdk-web-logger/classic');
 var vastClient = require('@dailymotion/vast-client');
+var ssaiLog = require('./ssai-log.js');
 
 const log = classic.createLogger('ssai:provider');
 const DEFAULT_CREATIVE_API_BASE = 'https://hls.next.streamlayer.io/api/creatives/';
+/**
+ * One creative-metadata round trip, on the narrative log: the request the SDK
+ * made and the body the ad service answered with, verbatim. This is the half of
+ * the story the manifest cannot tell — the ad's identity comes from the playout,
+ * its content comes from here.
+ */
+const fetchCreativeJson = /*#__PURE__*/function () {
+  var _ref = _rollupPluginBabelHelpers.asyncToGenerator(function* (providerId, url, signal) {
+    var _raw, _raw2, _raw3;
+    // `adApiBase` is customer infrastructure and may carry a key in its query;
+    // the request uses the URL as given, the log gets it with such values masked.
+    const shown = maskUrlSecrets(url);
+    ssaiLog.ssaiq.info({
+      provider: providerId,
+      url: shown
+    }, `[GET] → ${shown}`);
+    let response;
+    try {
+      response = yield fetch(url, {
+        signal
+      });
+    } catch (error) {
+      // An abort is the SDK cancelling its own request (break ended, creative
+      // changed) — a note, not a failure.
+      if ((error === null || error === void 0 ? void 0 : error.name) === 'AbortError') {
+        ssaiLog.ssaiq.debug({
+          provider: providerId,
+          url: shown
+        }, `[GET] ✗ aborted ${shown}`);
+      } else {
+        ssaiLog.ssaiq.warn({
+          provider: providerId,
+          url: shown,
+          error: String(error)
+        }, `[GET] ✗ ${shown}`);
+      }
+      throw error;
+    }
+    if (!response.ok) {
+      ssaiLog.ssaiq.warn({
+        provider: providerId,
+        url: shown,
+        status: response.status
+      }, `[GET] ✗ ${response.status} ${shown}`);
+      throw new Error(`${providerId} creative request failed: ${response.status}`);
+    }
+    let raw;
+    try {
+      raw = yield response.json();
+    } catch (error) {
+      // A 200 with a body that is not JSON would otherwise leave the log looking
+      // like a request still in flight.
+      ssaiLog.ssaiq.warn({
+        provider: providerId,
+        url: shown,
+        error: String(error)
+      }, `[GET] ✗ ${response.status} ${shown} — not JSON`);
+      throw error;
+    }
+    ssaiLog.ssaiq.info({
+      provider: providerId,
+      status: response.status,
+      body: raw
+    }, `[GET] ← ${response.status} ad metadata — ${((_raw = raw) === null || _raw === void 0 ? void 0 : _raw.advertiser) || ((_raw2 = raw) === null || _raw2 === void 0 ? void 0 : _raw2.title) || ((_raw3 = raw) === null || _raw3 === void 0 ? void 0 : _raw3.creativeId) || 'ad'}`);
+    return raw;
+  });
+  return function fetchCreativeJson(_x, _x2, _x3) {
+    return _ref.apply(this, arguments);
+  };
+}();
+/** `?apiKey=…` → `?apiKey=«redacted»`, for URLs that go on a screen. Regex, not `URL`: this ships to 2016 TV engines. */
+const maskUrlSecrets = url => url.replace(/([?&][^=&]*(?:token|secret|password|key|authorization)[^=&]*=)[^&]*/gi, '$1«redacted»');
 /**
  * Shared low-level beacon helper. Prefers `navigator.sendBeacon` and falls back
  * to a no-cors `fetch`. Used by the default impression path and available to
@@ -107,21 +182,14 @@ const createStreamLayerProvider = (config = {}) => {
   return {
     id: 'streamlayer',
     resolve: function () {
-      var _ref = _rollupPluginBabelHelpers.asyncToGenerator(function* (creativeId, signal) {
-        const url = buildCreativeUrl(creativeApiBase, creativeId);
-        const response = yield fetch(url, {
-          signal
-        });
-        if (!response.ok) {
-          throw new Error(`creative request failed: ${response.status}`);
-        }
-        const raw = yield response.json();
+      var _ref2 = _rollupPluginBabelHelpers.asyncToGenerator(function* (creativeId, signal) {
+        const raw = yield fetchCreativeJson('streamlayer', buildCreativeUrl(creativeApiBase, creativeId), signal);
         return mapApiResponse(_rollupPluginBabelHelpers.objectSpread2(_rollupPluginBabelHelpers.objectSpread2({}, raw), {}, {
           creativeId: raw.creativeId || creativeId
         }));
       });
-      return function resolve(_x, _x2) {
-        return _ref.apply(this, arguments);
+      return function resolve(_x4, _x5) {
+        return _ref2.apply(this, arguments);
       };
     }(),
     fireImpression: fireDefaultImpression
@@ -168,23 +236,17 @@ const createQuortexProvider = (config = {}) => {
   return {
     id: 'quortex',
     resolve: function () {
-      var _ref2 = _rollupPluginBabelHelpers.asyncToGenerator(function* (adId, signal) {
+      var _ref3 = _rollupPluginBabelHelpers.asyncToGenerator(function* (adId, signal) {
         if (!adApiBase) {
           throw new Error('quortex provider is missing `adApiBase`');
         }
-        const response = yield fetch(buildQuortexUrl(adApiBase, tenantName, adId), {
-          signal
-        });
-        if (!response.ok) {
-          throw new Error(`quortex creative request failed: ${response.status}`);
-        }
-        const raw = yield response.json();
+        const raw = yield fetchCreativeJson('quortex', buildQuortexUrl(adApiBase, tenantName, adId), signal);
         return mapApiResponse(_rollupPluginBabelHelpers.objectSpread2(_rollupPluginBabelHelpers.objectSpread2({}, raw), {}, {
           creativeId: raw.creativeId || adId
         }));
       });
-      return function resolve(_x3, _x4) {
-        return _ref2.apply(this, arguments);
+      return function resolve(_x6, _x7) {
+        return _ref3.apply(this, arguments);
       };
     }(),
     fireImpression: fireDefaultImpression
@@ -192,7 +254,7 @@ const createQuortexProvider = (config = {}) => {
 };
 // --- VAST provider ---------------------------------------------------------
 const mapVastResponse = /*#__PURE__*/function () {
-  var _ref3 = _rollupPluginBabelHelpers.asyncToGenerator(function* (creativeId, signal) {
+  var _ref4 = _rollupPluginBabelHelpers.asyncToGenerator(function* (creativeId, signal) {
     var _validAd$advertiser$f;
     const vastClient$1 = new vastClient.VASTClient();
     const parsedVAST = yield vastClient$1.get(creativeId, {
@@ -243,8 +305,8 @@ const mapVastResponse = /*#__PURE__*/function () {
       companion
     };
   });
-  return function mapVastResponse(_x5, _x6) {
-    return _ref3.apply(this, arguments);
+  return function mapVastResponse(_x8, _x9) {
+    return _ref4.apply(this, arguments);
   };
 }();
 /**

package/lib/classic/index.js

@@ -1,6 +1,7 @@
 import { Advertisement } from './advertisement.js';
 export { isFullbleedVideoTemplate } from './units/external-pause-ad.js';
 export { INSIGHT_BODY_MAX_LENGTH } from './units/pause-ad-card.js';
+export { selectSponsorLogo } from './units/sponsor-logo.js';
 export { gam } from './units/gam.js';
 export { createCompanionTracker, createVastTracker, resolveVastTrackerTarget } from './units/vast-tracker.js';
 import 'core-js/modules/es.array.iterator.js';

package/lib/classic/units/ad-macros.js

@@ -0,0 +1,113 @@
+import 'core-js/modules/es.regexp.exec.js';
+import 'core-js/modules/es.string.replace.js';
+
+/**
+ * Ad-tag macro substitution, for every ad server — not just GAM.
+ *
+ * Studio stores a programmatic tag verbatim (`gamRawUrl`, returned untouched by
+ * `processGamAdvertisement`), so whatever macros the ad server's own tag builder emitted reach the
+ * SDK literal. `gam()` used to fill only the GAM `[placeholder]` token, and only for
+ * `pubads.g.doubleclick.net` — every other vendor's tag went out with its macros unexpanded.
+ *
+ * That is not inert. Measured against the ADITION tag on event 11089
+ * (`…/banner?…&ts=[timestamp]&clickurl=[clickmacro]`): ADITION prepends the value of `clickurl` to
+ * its own redi URL, so a literal `[clickmacro]` came back inside `<CompanionClickThrough>` as
+ * `[clickmacro]https%3A%2F%2Fad1…` — a broken click-through. Sending `clickurl=` empty answers with
+ * a valid redi URL.
+ *
+ * **Two sources.** The cache buster is the SDK's own. The consent family — `${GDPR}` and
+ * `${GDPR_CONSENT_<gvlid>}`, IAB TCF, where the id is the vendor's Global Vendor List entry (39 is
+ * ADITION / Virtual Minds) — and the click macro come from the host app (`AdTagParams`, set through
+ * the `adTagParams` option or `sdk.setAdTagParams`). The SDK never reads a CMP and never guesses
+ * consent: a value the host did not pass goes out EMPTY, which ad servers read as "unknown" — never
+ * as `gdpr=0`. Empty rather than literal because a literal is not inert either: ADITION copied
+ * `${GDPR}` into its own redirect URL (`gdpr%3D%24%7BGDPR%7D`). See
+ * `docs/wiki/programmatic-ads-macros.md`.
+ *
+ * An unknown macro is left exactly as configured, which is what keeps the GAM `[placeholder]`
+ * tokens for the PAL path (`gam.ts` fills those per parameter, not per token).
+ */
+/**
+ * All three spellings in the wild — `[NAME]` (IAB / SpotX), `${NAME}` (Google) and bare `{NAME}` —
+ * each with its delimiters either literal or PERCENT-ENCODED.
+ *
+ * Neither half of that is theoretical. ADITION emitted `[timestamp]` / `[clickmacro]` for the
+ * campaign on event 11089 and `{CACHEBUSTER}` / `{GDPR}` for the one on 6203 — same ad server, same
+ * advertiser, different tag builder. And Studio stores the 6203 tag as `ts=%7BCACHEBUSTER%7D`, so
+ * matching only literal braces made the whole substitution a silent no-op on it: an unexpanded
+ * macro raises no error and the ad server still answers 200. `searchParams.get()` decodes on read,
+ * which is what hides the encoding from anyone inspecting the parsed URL.
+ *
+ * The `$` is optional rather than a fourth branch — an unowned `${NAME}` still returns its full
+ * matched text, `$` included, so the brace forms cannot corrupt each other.
+ */
+const MACRO_PATTERN = /(?:\[|%5B)([a-z0-9_]+)(?:\]|%5D)|(?:\$|%24)?(?:\{|%7B)([a-z0-9_]+)(?:\}|%7D)/gi;
+/**
+ * Every host value lands inside a query-string VALUE, so it is encoded exactly once. That matters
+ * most for the click URL, which carries its own `?`/`&`: sent raw it re-opens the tag's query, the
+ * way the malformed 6203 tag did (`clickurl` truncated, every following parameter duplicated).
+ */
+const hostValue = value => value ? encodeURIComponent(value) : '';
+const gdprConsent = ({
+  params
+}) => hostValue(params === null || params === void 0 ? void 0 : params.tcString);
+/**
+ * Macro name (lower-cased) → the value this SDK sends for it.
+ *
+ * `clickurl` / `clickmacro` take the host's click tracker, which the ad server PREPENDS to its own
+ * redirect — so the viewer's click passes host tracker → vendor redirect → landing page. The SDK
+ * does not fire that tracker itself; it would count the click twice. Without one it is empty, the
+ * documented "no player tracker" value. VAST click beacons are reported separately by
+ * `useSidebarVastTracker`.
+ */
+const MACRO_VALUES = {
+  // One family, one value: every name here means "make this request unique so nothing caches it".
+  // Epoch milliseconds satisfies that for all of them, and keeps the value already shipped for
+  // `timestamp` unchanged. (IAB defines `[CACHEBUSTING]` as a random 8-digit number and
+  // `[TIMESTAMP]` as ISO-8601, but those describe VAST *tracking* URLs; this substitution only
+  // ever touches the ad REQUEST url, where every ad server documents the parameter as a number.)
+  timestamp: ({
+    now
+  }) => String(now),
+  cachebuster: ({
+    now
+  }) => String(now),
+  cachebusting: ({
+    now
+  }) => String(now),
+  clickmacro: ({
+    params
+  }) => hostValue(params === null || params === void 0 ? void 0 : params.clickUrl),
+  clickurl: ({
+    params
+  }) => hostValue(params === null || params === void 0 ? void 0 : params.clickUrl),
+  // `1` / `0` only from an explicit boolean — an absent value is unknown, not "does not apply".
+  gdpr: ({
+    params
+  }) => (params === null || params === void 0 ? void 0 : params.gdprApplies) === undefined ? '' : params.gdprApplies ? '1' : '0',
+  gdpr_consent: gdprConsent
+};
+/** `GDPR_CONSENT_<gvlid>`: the vendor id names whose tag this is; the value is the same TC string. */
+const GDPR_CONSENT_FOR_VENDOR = /^gdpr_consent_\d+$/;
+const resolveMacro = name => {
+  var _MACRO_VALUES$name;
+  return (_MACRO_VALUES$name = MACRO_VALUES[name]) !== null && _MACRO_VALUES$name !== void 0 ? _MACRO_VALUES$name : GDPR_CONSENT_FOR_VENDOR.test(name) ? gdprConsent : undefined;
+};
+/**
+ * Fill the macros this SDK knows in an ad-tag URL. One timestamp per call, so a tag naming the macro
+ * twice stays self-consistent. `params` is read as given — the caller passes the host's CURRENT
+ * values at request time.
+ */
+const substituteAdTagMacros = (url, params) => {
+  const now = Date.now();
+  return url.replace(MACRO_PATTERN, (match, bracketed, braced) => {
+    var _ref;
+    const value = resolveMacro(((_ref = bracketed !== null && bracketed !== void 0 ? bracketed : braced) !== null && _ref !== void 0 ? _ref : '').toLowerCase());
+    return value ? value({
+      now,
+      params
+    }) : match;
+  });
+};
+
+export { substituteAdTagMacros };