@wavebirdai/api 0.1.0-beta.7 → 0.1.0-beta.9

package/README.md

@@ -9,7 +9,7 @@ You need a saved Wavebird Test project and placement in Dashboard, a Server Test
 1. Install the package and generate the route files for your app directory:
 
    ```sh
-   npm install @wavebirdai/api@0.1.0-beta.6
+   npm install @wavebirdai/api@0.1.0-beta.9
    ./node_modules/.bin/wavebird-next init --lang ts --root . --app-dir src/app
    ```
 
@@ -70,7 +70,7 @@ You need a saved Wavebird Test project and placement in Dashboard, a Server Test
 5. Validate in Test: confirm the saved format and size, consent and GPC behavior, No-Fill, Stop/abort, and late responses. The generation result must continue independently of the ad path. Move to another package version or Live only through your normal project approval process.
 
 JavaScript and TypeScript use this same package. Complete Next.js JavaScript and TypeScript examples are included in `node_modules/@wavebirdai/api/examples/next-js` and `node_modules/@wavebirdai/api/examples/next-ts`. For other frameworks, use the explicit `@wavebirdai/api/server` and `@wavebirdai/api/browser` exports described below. The [REST reference](https://wavebird.ai/api/reference/endpoints) covers integrations without this package. The established [`wavebird`](https://www.npmjs.com/package/wavebird) SDK is a separate package.
-
+
 ## Server and browser boundary
 
 `@wavebirdai/api/server` exports `createPublisherServer`. Configure it with server-only Project ID, Server Test or production Key, preference signing secret, the publisher's real request authorization function, exact `publicOrigins`, and the saved project/placement values shown in the dashboard. The origin list is required. The package compares the browser Origin with a configured public origin whose host matches the route Host, even when Next.js or a proxy gives the route an internal URL. `localhost` and `127.0.0.1` are separate origins, and each port and scheme must match exactly; HTTP loopback is available only with a Server Test Key. A production key also requires its separately approved project and Wavebird server authority. Omit `bidfloor` and `bidfloorCurrency` to inherit saved pricing. An explicit override supplies both a nonnegative amount, including zero, and a three-letter currency; the API validates it against the saved project. It returns authenticated `placementPOST`, `consentGET`, `consentPOST`, and `withGeneration` handlers, plus the server-only `reportGeneration(jobId, event)` method. The helper constructs the existing `/v1/placements`, `/v1/consent`, and `/v1/jobs/{id}/generation/{event}` requests; it does not introduce a new Wavebird protocol. The Wavebird API remains authoritative for saved scope, creative formats, duration, fallback, and financial classification.

package/dist/browser.js

@@ -20,12 +20,19 @@ function loadRenderer(url) {
 
 export function createPublisherAds(options) {
   const target = options.target;
-  if (!target || !options.userId || !options.conversationId) throw new Error("Application container and session are required");
+  const requiredText = value => typeof value === "string" && value.trim().length > 0;
+  if (!target || !requiredText(options.userId) || !requiredText(options.conversationId))
+    throw new Error("Application container and session are required");
   if (!["chat", "code", "image", "voice", "agent"].includes(options.jobType)) throw new Error("publisher_job_invalid");
+  if (typeof options.clientId !== "string" || !options.clientId.startsWith("wbproj_"))
+    throw new Error("publisher_project_invalid");
+  if (typeof options.surfaceId !== "string" || !/^[A-Za-z0-9_-]{1,128}$/.test(options.surfaceId))
+    throw new Error("publisher_placement_invalid");
   const turnBinding = options.turnBinding === true;
   const validId = value => typeof value === "string" && /^[A-Za-z0-9_-]{1,128}$/.test(value);
   if (turnBinding && !validId(options.sessionId)) throw new Error("publisher_trusted_session_required");
-  const timing = options.timing || "during", consentMode = options.consentMode || "wavebird_consent";
+  const timing = options.timing === undefined ? "during" : options.timing;
+  const consentMode = options.consentMode === undefined ? "wavebird_consent" : options.consentMode;
   if (!["before", "during", "after"].includes(timing) || !["wavebird_consent", "own_cmp"].includes(consentMode)) throw new Error("Invalid publisher configuration");
   let binding = { userId: options.userId, conversationId: options.conversationId,
     sessionId: turnBinding ? options.sessionId : crypto.randomUUID() };
@@ -64,7 +71,8 @@ export function createPublisherAds(options) {
   const prepare = () => { if (!disposed && sponsor) void sponsor.prepare().catch(() => {}); };
   function setConversation(next) {
     if (disposed) return;
-    if (!next.userId || !next.conversationId) throw new Error("Application session is required");
+    if (!requiredText(next?.userId) || !requiredText(next?.conversationId))
+      throw new Error("Application session is required");
     if (turnBinding && !validId(next.sessionId)) throw new Error("publisher_trusted_session_required");
     if (next.userId === binding.userId && next.conversationId === binding.conversationId &&
         (!turnBinding || next.sessionId === binding.sessionId)) return;

package/dist/server.js

@@ -7,6 +7,9 @@ const PREFERENCE_TTL = 30 * 24 * 60 * 60;
 const MAX_PUBLISHER_BODY_BYTES = 16 * 1024;
 const MAX_WAVEBIRD_RESPONSE_BYTES = 256 * 1024;
 const MAX_PARALLEL_WAVEBIRD_REQUESTS = 2;
+const MAX_ALLOWED_SIZES = 8;
+const MAX_SIZE_EDGE = 4096;
+const MAX_ENVELOPE_EDGE = 8192;
 const ID = /^[A-Za-z0-9_-]{1,128}$/;
 const JOB_ID = /^job_[A-Za-z0-9_-]{1,128}$/;
 const PLACEMENT_KEY = /^[a-z0-9][a-z0-9_-]{0,63}$/;
@@ -39,11 +42,15 @@ function normalizeOptions(options) {
   if (options.gdprApplies !== undefined && typeof options.gdprApplies !== "boolean") throw new Error("publisher_gdpr_invalid");
   if (!Array.isArray(options.allowedFormats) || options.allowedFormats.length === 0 || options.allowedFormats.some(value => !["banner", "native", "clip"].includes(value))) throw new Error("publisher_formats_invalid");
   if (!["above", "below", "sidebar", "between"].includes(options.positionHint)) throw new Error("publisher_position_invalid");
-  if (!Array.isArray(options.allowedSizes) || options.allowedSizes.length === 0 || options.allowedSizes.some(size => !size || typeof size !== "object" || Object.keys(size).some(key => !["width", "height", "formats"].includes(key)) || !Number.isSafeInteger(size.width) || !Number.isSafeInteger(size.height) || size.width < 1 || size.height < 1 ||
+  if (!Array.isArray(options.allowedSizes) || options.allowedSizes.length === 0 || options.allowedSizes.length > MAX_ALLOWED_SIZES || options.allowedSizes.some(size => !size || typeof size !== "object" || Object.keys(size).some(key => !["width", "height", "formats"].includes(key)) || !Number.isSafeInteger(size.width) || !Number.isSafeInteger(size.height) || size.width < 1 || size.height < 1 || size.width > MAX_SIZE_EDGE || size.height > MAX_SIZE_EDGE ||
     (size.formats !== undefined && (!Array.isArray(size.formats) || size.formats.length === 0 || size.formats.some(format => !options.allowedFormats.includes(format)))))) throw new Error("publisher_sizes_invalid");
+  if (new Set(options.allowedSizes.map(size => `${size.width}x${size.height}`)).size !== options.allowedSizes.length)
+    throw new Error("publisher_sizes_invalid");
   const maxWidth = options.maxWidth === undefined ? options.allowedSizes.reduce((max, size) => Math.max(max, size.width), 0) : options.maxWidth;
   const maxHeight = options.maxHeight === undefined ? options.allowedSizes.reduce((max, size) => Math.max(max, size.height), 0) : options.maxHeight;
-  if (!Number.isSafeInteger(maxWidth) || maxWidth < 1 || !Number.isSafeInteger(maxHeight) || maxHeight < 1) throw new Error("publisher_envelope_invalid");
+  if (!Number.isSafeInteger(maxWidth) || maxWidth < 1 || maxWidth > MAX_ENVELOPE_EDGE ||
+      !Number.isSafeInteger(maxHeight) || maxHeight < 1 || maxHeight > MAX_ENVELOPE_EDGE)
+    throw new Error("publisher_envelope_invalid");
   const eligibleSizes = options.allowedSizes.filter(size => size.width <= maxWidth && size.height <= maxHeight);
   const hasFloor = Object.hasOwn(options, "bidfloor");
   const hasCurrency = Object.hasOwn(options, "bidfloorCurrency");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wavebirdai/api",
-  "version": "0.1.0-beta.7",
+  "version": "0.1.0-beta.9",
   "private": false,
   "type": "module",
   "description": "Integrate Banner, Native, and Clip placements into authenticated chat apps with server-side keys, consent, and generation lifecycle handling",

package/src/browser.js

@@ -20,12 +20,19 @@ function loadRenderer(url) {
 
 export function createPublisherAds(options) {
   const target = options.target;
-  if (!target || !options.userId || !options.conversationId) throw new Error("Application container and session are required");
+  const requiredText = value => typeof value === "string" && value.trim().length > 0;
+  if (!target || !requiredText(options.userId) || !requiredText(options.conversationId))
+    throw new Error("Application container and session are required");
   if (!["chat", "code", "image", "voice", "agent"].includes(options.jobType)) throw new Error("publisher_job_invalid");
+  if (typeof options.clientId !== "string" || !options.clientId.startsWith("wbproj_"))
+    throw new Error("publisher_project_invalid");
+  if (typeof options.surfaceId !== "string" || !/^[A-Za-z0-9_-]{1,128}$/.test(options.surfaceId))
+    throw new Error("publisher_placement_invalid");
   const turnBinding = options.turnBinding === true;
   const validId = value => typeof value === "string" && /^[A-Za-z0-9_-]{1,128}$/.test(value);
   if (turnBinding && !validId(options.sessionId)) throw new Error("publisher_trusted_session_required");
-  const timing = options.timing || "during", consentMode = options.consentMode || "wavebird_consent";
+  const timing = options.timing === undefined ? "during" : options.timing;
+  const consentMode = options.consentMode === undefined ? "wavebird_consent" : options.consentMode;
   if (!["before", "during", "after"].includes(timing) || !["wavebird_consent", "own_cmp"].includes(consentMode)) throw new Error("Invalid publisher configuration");
   let binding = { userId: options.userId, conversationId: options.conversationId,
     sessionId: turnBinding ? options.sessionId : crypto.randomUUID() };
@@ -64,7 +71,8 @@ export function createPublisherAds(options) {
   const prepare = () => { if (!disposed && sponsor) void sponsor.prepare().catch(() => {}); };
   function setConversation(next) {
     if (disposed) return;
-    if (!next.userId || !next.conversationId) throw new Error("Application session is required");
+    if (!requiredText(next?.userId) || !requiredText(next?.conversationId))
+      throw new Error("Application session is required");
     if (turnBinding && !validId(next.sessionId)) throw new Error("publisher_trusted_session_required");
     if (next.userId === binding.userId && next.conversationId === binding.conversationId &&
         (!turnBinding || next.sessionId === binding.sessionId)) return;

package/src/server.js

@@ -7,6 +7,9 @@ const PREFERENCE_TTL = 30 * 24 * 60 * 60;
 const MAX_PUBLISHER_BODY_BYTES = 16 * 1024;
 const MAX_WAVEBIRD_RESPONSE_BYTES = 256 * 1024;
 const MAX_PARALLEL_WAVEBIRD_REQUESTS = 2;
+const MAX_ALLOWED_SIZES = 8;
+const MAX_SIZE_EDGE = 4096;
+const MAX_ENVELOPE_EDGE = 8192;
 const ID = /^[A-Za-z0-9_-]{1,128}$/;
 const JOB_ID = /^job_[A-Za-z0-9_-]{1,128}$/;
 const PLACEMENT_KEY = /^[a-z0-9][a-z0-9_-]{0,63}$/;
@@ -39,11 +42,15 @@ function normalizeOptions(options) {
   if (options.gdprApplies !== undefined && typeof options.gdprApplies !== "boolean") throw new Error("publisher_gdpr_invalid");
   if (!Array.isArray(options.allowedFormats) || options.allowedFormats.length === 0 || options.allowedFormats.some(value => !["banner", "native", "clip"].includes(value))) throw new Error("publisher_formats_invalid");
   if (!["above", "below", "sidebar", "between"].includes(options.positionHint)) throw new Error("publisher_position_invalid");
-  if (!Array.isArray(options.allowedSizes) || options.allowedSizes.length === 0 || options.allowedSizes.some(size => !size || typeof size !== "object" || Object.keys(size).some(key => !["width", "height", "formats"].includes(key)) || !Number.isSafeInteger(size.width) || !Number.isSafeInteger(size.height) || size.width < 1 || size.height < 1 ||
+  if (!Array.isArray(options.allowedSizes) || options.allowedSizes.length === 0 || options.allowedSizes.length > MAX_ALLOWED_SIZES || options.allowedSizes.some(size => !size || typeof size !== "object" || Object.keys(size).some(key => !["width", "height", "formats"].includes(key)) || !Number.isSafeInteger(size.width) || !Number.isSafeInteger(size.height) || size.width < 1 || size.height < 1 || size.width > MAX_SIZE_EDGE || size.height > MAX_SIZE_EDGE ||
     (size.formats !== undefined && (!Array.isArray(size.formats) || size.formats.length === 0 || size.formats.some(format => !options.allowedFormats.includes(format)))))) throw new Error("publisher_sizes_invalid");
+  if (new Set(options.allowedSizes.map(size => `${size.width}x${size.height}`)).size !== options.allowedSizes.length)
+    throw new Error("publisher_sizes_invalid");
   const maxWidth = options.maxWidth === undefined ? options.allowedSizes.reduce((max, size) => Math.max(max, size.width), 0) : options.maxWidth;
   const maxHeight = options.maxHeight === undefined ? options.allowedSizes.reduce((max, size) => Math.max(max, size.height), 0) : options.maxHeight;
-  if (!Number.isSafeInteger(maxWidth) || maxWidth < 1 || !Number.isSafeInteger(maxHeight) || maxHeight < 1) throw new Error("publisher_envelope_invalid");
+  if (!Number.isSafeInteger(maxWidth) || maxWidth < 1 || maxWidth > MAX_ENVELOPE_EDGE ||
+      !Number.isSafeInteger(maxHeight) || maxHeight < 1 || maxHeight > MAX_ENVELOPE_EDGE)
+    throw new Error("publisher_envelope_invalid");
   const eligibleSizes = options.allowedSizes.filter(size => size.width <= maxWidth && size.height <= maxHeight);
   const hasFloor = Object.hasOwn(options, "bidfloor");
   const hasCurrency = Object.hasOwn(options, "bidfloorCurrency");