@wavebirdai/api 0.1.0-beta.14 → 0.1.0-beta.15

package/README.md

@@ -22,7 +22,7 @@ Use Node.js 20 or later on your server.
 2. **Install the package.** Run this in your app's terminal, in the folder containing `package.json`:
 
    ```sh
-   npm install @wavebirdai/api@0.1.0-beta.14
+   npm install @wavebirdai/api@0.1.0-beta.15
    ```
 
 3. **Save the Server ENV from Overview, Integration step 2.** The key-only download is not the full configuration. Keep `WAVEBIRD_SECRET_KEY` and the stable, project-specific `WAVEBIRD_PREFERENCE_SECRET` out of browser code and Git. Include the saved `WAVEBIRD_PUBLIC_ORIGINS`.

package/dist/server.js

@@ -388,21 +388,39 @@ export function createPublisherServer(inputOptions) {
     const headers = { "Cache-Control": "no-store", Vary: "Cookie, Sec-GPC" };
     if (!validOrigin(request, options, false)) return response("invalid_origin", 403, headers);
     if (gpc(request)) return Response.json({ preference: null }, { headers });
+    const revision = {};
+    if (options.sessionIdForRequest) {
+      let sessionId;
+      try { sessionId = await journalCall(() => options.sessionIdForRequest(request)); }
+      catch { return response("publisher_session_unavailable", 503, headers); }
+      if (!ID.test(sessionId || "")) return response("publisher_session_unavailable", 401, headers);
+      try {
+        const query = new URLSearchParams({ client_id: options.clientId, session_id: sessionId });
+        const result = await consentFetch(`${options.base}/consent?${query}`, {
+          method: "GET", headers: { Authorization: `Bearer ${options.secretKey}` }, cache: "no-store"
+        });
+        const state = await result.json();
+        if (!result.ok || !Number.isSafeInteger(state.current_revision) || state.current_revision < 0 ||
+            state.current_revision >= Number.MAX_SAFE_INTEGER) throw new Error("consent_revision_unavailable");
+        revision.current_revision = state.current_revision;
+      } catch { return response("consent_revision_unavailable", 503, headers); }
+    }
+    const preferenceResponse = value => Response.json({ ...value, ...revision }, { headers });
     try {
       const value = (request.headers.get("cookie") || "").split(";").map(value => value.trim())
         .find(value => value.startsWith(cookieName + "="))?.slice(cookieName.length + 1) || "";
       if (value.length > 2048) throw new Error("preference_invalid");
       const [payload, signature, extra] = value.split(".");
-      if (!payload || !signature || extra || !/^[A-Za-z0-9_-]+$/.test(payload) || !/^[A-Za-z0-9_-]+$/.test(signature)) return Response.json({ preference: null }, { headers });
-      if (!await crypto.subtle.verify("HMAC", await preferenceKey(), Buffer.from(signature, "base64url"), new TextEncoder().encode(payload))) return Response.json({ preference: null }, { headers });
+      if (!payload || !signature || extra || !/^[A-Za-z0-9_-]+$/.test(payload) || !/^[A-Za-z0-9_-]+$/.test(signature)) return preferenceResponse({ preference: null });
+      if (!await crypto.subtle.verify("HMAC", await preferenceKey(), Buffer.from(signature, "base64url"), new TextEncoder().encode(payload))) return preferenceResponse({ preference: null });
       const record = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
       const now = Date.now();
       if (Object.entries(scope(request)).some(([key, value]) => record[key] !== value) ||
         !["granted", "denied", "withdrawn"].includes(record.state) || !Number.isSafeInteger(record.issued_at) ||
         !Number.isSafeInteger(record.expires_at) || record.issued_at > now || record.expires_at <= now ||
-        record.expires_at - record.issued_at !== PREFERENCE_TTL * 1000) return Response.json({ preference: null }, { headers });
-      return Response.json({ preference: { state: record.state, expires_at: record.expires_at } }, { headers });
-    } catch { return Response.json({ preference: null, error: "preference_unavailable" }, { headers }); }
+        record.expires_at - record.issued_at !== PREFERENCE_TTL * 1000) return preferenceResponse({ preference: null });
+      return preferenceResponse({ preference: { state: record.state, expires_at: record.expires_at } });
+    } catch { return preferenceResponse({ preference: null, error: "preference_unavailable" }); }
   }
   async function consentPOST(request) {
     if (!await authorized(request)) return response("authentication_required", 401);

package/docs/web/generation.md

@@ -1,6 +1,6 @@
 # Connect generation to the displayed result
 
-These are connection helpers, not complete apps. Use the same installed `@wavebirdai/api@0.1.0-beta.14` as your server routes.
+These are connection helpers, not complete apps. Use the same installed `@wavebirdai/api@0.1.0-beta.15` as your server routes.
 
 - `ads` is the instance for this surface, returned by `createPublisherAds` or the generated component's `onReady` callback.
 - `sendExistingRequest` sends your existing authenticated model request. Merge the provided headers into its headers and preserve its body and abort signal. Call the route wrapped by `withGeneration`.

package/docs/web/nextjs.md

@@ -7,7 +7,7 @@ Use this path instead of copying Dashboard's route files. It supports an existin
 From the folder containing `package.json`:
 
 ```sh
-npm install @wavebirdai/api@0.1.0-beta.14 server-only
+npm install @wavebirdai/api@0.1.0-beta.15 server-only
 ./node_modules/.bin/wavebird-next init --lang ts --root . --app-dir src/app
 ```
 

package/docs/web/reference.md

@@ -1,6 +1,6 @@
 # Web integration reference
 
-Applies to `@wavebirdai/api@0.1.0-beta.14`. [Start with the integration steps](../../README.md#set-up-javascript-or-typescript).
+Applies to `@wavebirdai/api@0.1.0-beta.15`. [Start with the integration steps](../../README.md#set-up-javascript-or-typescript).
 
 
 `@wavebirdai/api/server` exports `createPublisherServer`. Configure it with server-only Project ID, Server Test or production Key, preference signing secret, the publisher's real request authorization function, exact `publicOrigins`, and the saved project/placement values shown in the dashboard. The origin list is required. The package compares the browser Origin with a configured public origin whose host matches the route Host, even when Next.js or a proxy gives the route an internal URL. `localhost` and `127.0.0.1` are separate origins, and each port and scheme must match exactly; HTTP loopback is available only with a Server Test Key. A production key also requires its separately approved project and wavebird server authority. Omit `bidfloor` and `bidfloorCurrency` to inherit saved pricing. An explicit override supplies both a nonnegative amount, including zero, and a three-letter currency; the API validates it against the saved project. It returns authenticated `placementPOST`, `consentGET`, `consentPOST`, and `withGeneration` handlers, plus the server-only `reportGeneration(jobId, event)` method. The helper constructs the existing `/v1/placements`, `/v1/consent`, and `/v1/jobs/{id}/generation/{event}` requests; it does not introduce a new wavebird protocol. The wavebird API remains authoritative for saved scope, creative formats, duration, fallback, and financial classification.
@@ -22,6 +22,8 @@ For `after`, resolve the generation consumer only after your app presents the re
 
 ## Troubleshooting
 
+With the trusted-session integration, consent restoration reads the current server revision before synchronizing the saved choice. Reloading does not reset consent revisions. An unavailable revision keeps ads disabled until consent can be synchronized; it does not block the model response.
+
 - **401:** check the app session and server authorization before changing the wavebird key.
 - **Origin rejected:** compare scheme, hostname and port with the saved project and server allowlist. `www.example.com` and `example.com` are separate origins.
 - **No-Fill or `no_fit`:** keep the model result usable. Check saved formats and the measured slot size. Do not stretch a creative to force it to fit.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wavebirdai/api",
-  "version": "0.1.0-beta.14",
+  "version": "0.1.0-beta.15",
   "private": false,
   "type": "module",
   "description": "JavaScript and TypeScript integration for wavebird Banner, Native and Clip ads, with consent and generation lifecycle handling.",

package/src/server.js

@@ -388,21 +388,39 @@ export function createPublisherServer(inputOptions) {
     const headers = { "Cache-Control": "no-store", Vary: "Cookie, Sec-GPC" };
     if (!validOrigin(request, options, false)) return response("invalid_origin", 403, headers);
     if (gpc(request)) return Response.json({ preference: null }, { headers });
+    const revision = {};
+    if (options.sessionIdForRequest) {
+      let sessionId;
+      try { sessionId = await journalCall(() => options.sessionIdForRequest(request)); }
+      catch { return response("publisher_session_unavailable", 503, headers); }
+      if (!ID.test(sessionId || "")) return response("publisher_session_unavailable", 401, headers);
+      try {
+        const query = new URLSearchParams({ client_id: options.clientId, session_id: sessionId });
+        const result = await consentFetch(`${options.base}/consent?${query}`, {
+          method: "GET", headers: { Authorization: `Bearer ${options.secretKey}` }, cache: "no-store"
+        });
+        const state = await result.json();
+        if (!result.ok || !Number.isSafeInteger(state.current_revision) || state.current_revision < 0 ||
+            state.current_revision >= Number.MAX_SAFE_INTEGER) throw new Error("consent_revision_unavailable");
+        revision.current_revision = state.current_revision;
+      } catch { return response("consent_revision_unavailable", 503, headers); }
+    }
+    const preferenceResponse = value => Response.json({ ...value, ...revision }, { headers });
     try {
       const value = (request.headers.get("cookie") || "").split(";").map(value => value.trim())
         .find(value => value.startsWith(cookieName + "="))?.slice(cookieName.length + 1) || "";
       if (value.length > 2048) throw new Error("preference_invalid");
       const [payload, signature, extra] = value.split(".");
-      if (!payload || !signature || extra || !/^[A-Za-z0-9_-]+$/.test(payload) || !/^[A-Za-z0-9_-]+$/.test(signature)) return Response.json({ preference: null }, { headers });
-      if (!await crypto.subtle.verify("HMAC", await preferenceKey(), Buffer.from(signature, "base64url"), new TextEncoder().encode(payload))) return Response.json({ preference: null }, { headers });
+      if (!payload || !signature || extra || !/^[A-Za-z0-9_-]+$/.test(payload) || !/^[A-Za-z0-9_-]+$/.test(signature)) return preferenceResponse({ preference: null });
+      if (!await crypto.subtle.verify("HMAC", await preferenceKey(), Buffer.from(signature, "base64url"), new TextEncoder().encode(payload))) return preferenceResponse({ preference: null });
       const record = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
       const now = Date.now();
       if (Object.entries(scope(request)).some(([key, value]) => record[key] !== value) ||
         !["granted", "denied", "withdrawn"].includes(record.state) || !Number.isSafeInteger(record.issued_at) ||
         !Number.isSafeInteger(record.expires_at) || record.issued_at > now || record.expires_at <= now ||
-        record.expires_at - record.issued_at !== PREFERENCE_TTL * 1000) return Response.json({ preference: null }, { headers });
-      return Response.json({ preference: { state: record.state, expires_at: record.expires_at } }, { headers });
-    } catch { return Response.json({ preference: null, error: "preference_unavailable" }, { headers }); }
+        record.expires_at - record.issued_at !== PREFERENCE_TTL * 1000) return preferenceResponse({ preference: null });
+      return preferenceResponse({ preference: { state: record.state, expires_at: record.expires_at } });
+    } catch { return preferenceResponse({ preference: null, error: "preference_unavailable" }); }
   }
   async function consentPOST(request) {
     if (!await authorized(request)) return response("authentication_required", 401);