@codenkay/video-nsgplayer-core 0.1.5 → 1.0.0

package/CHANGELOG.md

@@ -1,27 +1,53 @@
 # Changelog
 
+## 1.0.0
+
+### Major Changes
+
+- Fix minor errors
+
+### Minor Changes
+
+- 1a4dc9b: Initial public SDK packages: core createVideoPlayer API with dual auth/playback lifecycles, React and Angular adapters, full PlayerConfig parity with demo settings.
+
+## 0.1.8
+
+- Fix Firefox `InternalError: too much recursion` from nested hls.js loaders:
+  `createAuthParamsLoader` now **composes** a builtin `XhrLoader`/`FetchLoader`
+  instead of `extends DefaultConfig.loader` (which could nest `super.load()` after
+  HMR / repeated mounts if DefaultConfig was polluted).
+- `resolveBuiltinHlsLoader()` walks past any wrapper classes to the builtin loader.
+
+## 0.1.7
+
+- Fix false AES key fatal: remove the post-publish gate that required
+  `getKeyAccessToken` or `keyProxyUrlBuilder` even when CDN `enc.key` only needs
+  signed query params (same auth as segments — pre-0.1.5 behavior).
+- Load `enc.key` via signed query + XHR by default; use browser `fetch` + Bearer
+  only when `streaming.getKeyAccessToken` returns a token; use BFF when
+  `keyProxyUrlBuilder` is set.
+- Clearer key-load errors that report HTTP/network cause instead of a configure prompt.
+
+## 0.1.6
+
+- Fix false "Playback refresh failed": `PlayerError` is not an `Error`, so refresh failures lost their real message.
+- Do not treat HLS key CORS/`status 0` as signed-URL expiry (that caused renew loops). Only 401/403 trigger auth recovery.
+
 ## 0.1.5
 
-- Add `streaming.getKeyAccessToken` for browser-direct AES `enc.key` loads with `Authorization: Bearer` (needed when Cloudflare blocks server/BFF fetches to Appextech).
-- Clearer key-load guidance when neither key proxy nor browser Bearer is configured.
+- Add `streaming.getKeyAccessToken` for browser-direct AES `enc.key` loads with `Authorization: Bearer`.
 
 ## 0.1.4
 
-- Fix stall after segments return 200: wait for `MANIFEST_PARSED` before autoplay/seek.
-- Only trigger signed-URL auth recovery on HTTP 401/403 (not every network blip).
-- Require/surface `streaming.keyProxyUrlBuilder` when AES `enc.key` load fails (Appextech VOD needs same-origin BFF + API Bearer).
-- Clear sticky `renewing` state after successful credential refresh.
+- Fix stall after segments return 200; renew only on 401/403; clear sticky renewing state.
 
 ## 0.1.3
 
-- Fix CDN **403 on child HLS playlists/segments** (`stream_N.m3u8`, `.ts`, keys): hls.js now uses an auth-params loader that re-applies signed `token`/`expires` query params on every request, not only the master playlist.
-- Preserve optional `streaming.keyProxyUrlBuilder` through config merge.
+- Re-apply signed query params on every HLS child request (fix CDN 403).
 
 ## 0.1.2
 
-- Fix `InternalError: too much recursion` / stack overflow in `assertNoSecretsInConfig` when `createVideoPlayer` options include an `HTMLVideoElement` mount or credential callbacks.
-- Secret scanning is now plain-object only, iterative, depth-capped, and does not deep-walk `mount` / `auth` / `playback`.
-- Harden `redactObject` against circular graphs.
+- Fix `too much recursion` in secret config scanning.
 
 ## 0.1.1
 

package/dist/index.cjs

@@ -51,11 +51,13 @@ __export(index_exports, {
   createVideoPlayer: () => createVideoPlayer,
   getLiveEdgeTime: () => getLiveEdgeTime,
   isAtLiveEdge: () => isAtLiveEdge,
+  isEncryptionKeyUrl: () => isEncryptionKeyUrl,
   isPlainObject: () => isPlainObject,
   mergePlayerConfig: () => mergePlayerConfig,
   redactObject: () => redactObject,
   redactSensitive: () => redactSensitive,
   redactValue: () => redactValue,
+  resolveBuiltinHlsLoader: () => resolveBuiltinHlsLoader,
   rewriteHlsRequestUrl: () => rewriteHlsRequestUrl,
   seekToLiveEdge: () => seekToLiveEdge,
   themeToCssVars: () => themeToCssVars
@@ -210,7 +212,7 @@ var AuthManager = class {
 
 // src/config/defaults.ts
 var PLAYBACK_RATES = [0.5, 0.75, 1, 1.25, 1.5, 2];
-var PACKAGE_VERSION = "0.1.5";
+var PACKAGE_VERSION = "0.1.8";
 var DEFAULT_PLAYER_BEHAVIOR = {
   autoplay: true,
   startMuted: true,
@@ -470,23 +472,25 @@ function isPlainObject2(value) {
   const proto = Object.getPrototypeOf(value);
   return proto === Object.prototype || proto === null;
 }
-function redactValue(key, value, seen = /* @__PURE__ */ new WeakSet(), depth = 0) {
-  if (SENSITIVE_KEYS.test(key)) return "[REDACTED]";
-  if (typeof value === "string") {
-    if (/^https?:\/\//i.test(value) && /[?&](token|expires)=/i.test(value)) {
-      try {
-        const url = new URL(value);
-        for (const param of ["token", "expires", "signature", "sig"]) {
-          if (url.searchParams.has(param)) {
-            url.searchParams.set(param, "[REDACTED]");
-          }
-        }
-        return url.toString();
-      } catch {
-        return "[REDACTED_URL]";
+function redactStringUrl(value) {
+  if (!/^https?:\/\//i.test(value) || !/[?&](token|expires)=/i.test(value)) {
+    return value;
+  }
+  try {
+    const url = new URL(value);
+    for (const param of ["token", "expires", "signature", "sig"]) {
+      if (url.searchParams.has(param)) {
+        url.searchParams.set(param, "[REDACTED]");
       }
     }
+    return url.toString();
+  } catch {
+    return "[REDACTED_URL]";
   }
+}
+function redactValue(key, value, seen = /* @__PURE__ */ new WeakSet(), depth = 0) {
+  if (SENSITIVE_KEYS.test(key)) return "[REDACTED]";
+  if (typeof value === "string") return redactStringUrl(value);
   if (Array.isArray(value)) {
     if (depth >= REDACT_MAX_DEPTH || seen.has(value)) return "[REDACTED_CYCLE]";
     seen.add(value);
@@ -753,10 +757,11 @@ var RefreshManager = class {
       this.options.logger.debug("Playback source renewed", { reason });
     } catch (error) {
       this.consecutiveFailures += 1;
-      const message = error instanceof Error ? error.message : "Playback refresh failed";
+      const message = refreshErrorMessage(error);
       this.options.logger.warn("Playback refresh failed", {
         reason,
-        failure: this.consecutiveFailures
+        failure: this.consecutiveFailures,
+        message
       });
       if (this.consecutiveFailures >= this.options.renewMaxRetries) {
         this.options.onFatal?.(message);
@@ -776,6 +781,13 @@ var RefreshManager = class {
     }
   }
 };
+function refreshErrorMessage(error) {
+  if (error instanceof Error && error.message) return error.message;
+  if (error && typeof error === "object" && "message" in error && typeof error.message === "string" && error.message) {
+    return error.message;
+  }
+  return "Playback refresh failed";
+}
 
 // src/playback/liveEdge.ts
 var DEFAULT_LIVE_EDGE_TOLERANCE_SECONDS = 3;
@@ -819,7 +831,9 @@ function seekToLiveEdge(media, options) {
 }
 
 // src/streaming/authParamsLoader.ts
+var import_hls = require("hls.js");
 var ENC_KEY_PATH_RE = /enc\.key$/i;
+var BUILTIN_LOADER_NAMES = /* @__PURE__ */ new Set(["XhrLoader", "FetchLoader"]);
 function isEncryptionKeyUrl(rawUrl, baseOrigin = typeof location !== "undefined" ? location.origin : "http://localhost") {
   try {
     return ENC_KEY_PATH_RE.test(new URL(rawUrl, baseOrigin).pathname);
@@ -827,6 +841,27 @@ function isEncryptionKeyUrl(rawUrl, baseOrigin = typeof location !== "undefined"
     return /enc\.key/i.test(rawUrl);
   }
 }
+function resolveBuiltinHlsLoader(HlsClass) {
+  if (typeof import_hls.XhrLoader === "function") {
+    return import_hls.XhrLoader;
+  }
+  const start = HlsClass.DefaultConfig.loader;
+  let current = start;
+  const seen = /* @__PURE__ */ new Set();
+  while (current && !seen.has(current)) {
+    seen.add(current);
+    const name = typeof current.name === "string" ? current.name : "";
+    if (BUILTIN_LOADER_NAMES.has(name)) {
+      return current;
+    }
+    const parentCtor = Object.getPrototypeOf(current.prototype)?.constructor;
+    if (!parentCtor || parentCtor === Object || parentCtor === Function) {
+      break;
+    }
+    current = parentCtor;
+  }
+  return start;
+}
 function rewriteHlsRequestUrl(rawUrl, store, options = {}, baseOrigin = typeof location !== "undefined" ? location.origin : "http://localhost") {
   if (!rawUrl) return rawUrl;
   const parsed = new URL(rawUrl, baseOrigin);
@@ -845,28 +880,145 @@ function rewriteHlsRequestUrl(rawUrl, store, options = {}, baseOrigin = typeof l
   if (!store.hasParams()) return parsed.toString();
   return store.applyToUrl(rawUrl, baseOrigin);
 }
+function createLoaderStats() {
+  const now = performance.now();
+  return {
+    aborted: false,
+    loaded: 0,
+    retry: 0,
+    total: 0,
+    chunkCount: 0,
+    bwEstimate: 0,
+    loading: { start: now, first: 0, end: 0 },
+    parsing: { start: 0, end: 0 },
+    buffering: { start: 0, first: 0, end: 0 }
+  };
+}
+async function loadEncryptionKeyWithFetch(context, callbacks, accessToken, signal) {
+  const stats = createLoaderStats();
+  stats.loading.first = performance.now();
+  const headers = {
+    Accept: "*/*",
+    ...context.headers
+  };
+  if (accessToken) {
+    headers.Authorization = `Bearer ${accessToken}`;
+  }
+  const response = await fetch(context.url, {
+    method: "GET",
+    headers,
+    credentials: "omit",
+    cache: "no-store",
+    signal
+  });
+  if (!response.ok) {
+    callbacks.onError(
+      {
+        code: response.status,
+        text: response.statusText || `enc.key HTTP ${response.status}`
+      },
+      context,
+      response,
+      stats
+    );
+    return;
+  }
+  const data = await response.arrayBuffer();
+  const end = performance.now();
+  stats.loading.end = end;
+  stats.loaded = data.byteLength;
+  stats.total = data.byteLength;
+  const head = new TextDecoder().decode(data.slice(0, 32));
+  if (/<!DOCTYPE|<html/i.test(head)) {
+    callbacks.onError(
+      {
+        code: 403,
+        text: "enc.key returned HTML (CDN challenge/block), not an AES key"
+      },
+      context,
+      response,
+      stats
+    );
+    return;
+  }
+  callbacks.onSuccess(
+    {
+      url: response.url || context.url,
+      data,
+      code: response.status
+    },
+    stats,
+    context,
+    response
+  );
+}
 function createAuthParamsLoader(HlsClass, store, options = {}) {
-  const BaseLoader = HlsClass.DefaultConfig.loader;
-  return class AuthParamsLoader extends BaseLoader {
+  const BaseLoader = resolveBuiltinHlsLoader(HlsClass);
+  return class AuthParamsLoader {
+    constructor(config) {
+      this.keyAbort = null;
+      this.inner = new BaseLoader(config);
+      this.stats = this.inner.stats;
+    }
+    abort() {
+      this.keyAbort?.abort();
+      this.keyAbort = null;
+      this.inner.abort?.();
+    }
+    destroy() {
+      this.keyAbort?.abort();
+      this.keyAbort = null;
+      this.inner.destroy();
+    }
     load(context, config, callbacks) {
-      if (context.url) {
-        try {
-          const originalUrl = context.url;
-          const isKey = isEncryptionKeyUrl(originalUrl);
-          context.url = rewriteHlsRequestUrl(originalUrl, store, options);
-          if (isKey && !options.keyProxyUrlBuilder && options.getKeyAccessToken) {
-            const accessToken = options.getKeyAccessToken();
-            if (accessToken) {
-              context.headers = {
-                ...context.headers ?? {},
-                Authorization: `Bearer ${accessToken}`
-              };
-            }
+      if (!context.url) {
+        this.inner.load(context, config, callbacks);
+        return;
+      }
+      try {
+        const originalUrl = context.url;
+        const isKey = isEncryptionKeyUrl(originalUrl);
+        const usingKeyProxy = Boolean(
+          isKey && options.keyProxyUrlBuilder && options.videoId
+        );
+        context.url = rewriteHlsRequestUrl(originalUrl, store, options);
+        if (usingKeyProxy) {
+          this.inner.load(context, config, callbacks);
+          return;
+        }
+        if (isKey && typeof options.getKeyAccessToken === "function") {
+          const accessToken = options.getKeyAccessToken() ?? null;
+          if (accessToken) {
+            this.keyAbort?.abort();
+            this.keyAbort = new AbortController();
+            const timeoutMs = typeof config?.timeout === "number" && config.timeout > 0 ? config.timeout : 2e4;
+            const timer = setTimeout(() => this.keyAbort?.abort(), timeoutMs);
+            void loadEncryptionKeyWithFetch(
+              context,
+              callbacks,
+              accessToken,
+              this.keyAbort.signal
+            ).catch((error) => {
+              const stats = createLoaderStats();
+              const aborted = error instanceof DOMException && error.name === "AbortError";
+              callbacks.onError(
+                {
+                  code: 0,
+                  text: aborted ? "enc.key fetch aborted/timeout" : error instanceof Error ? error.message : "enc.key fetch failed"
+                },
+                context,
+                null,
+                stats
+              );
+            }).finally(() => {
+              clearTimeout(timer);
+            });
+            return;
           }
-        } catch {
         }
+      } catch {
       }
-      super.load(context, config, callbacks);
+      this.inner.load(context, config, callbacks);
     }
   };
 }
@@ -957,19 +1109,24 @@ var HlsEngine = class {
   }
   handleHlsError(Hls, data) {
     if (this.destroyed) return;
-    const { callbacks, hlsConfig, keyProxyUrlBuilder, getKeyAccessToken } = this.options;
+    const { callbacks, hlsConfig } = this.options;
     const status = data.response?.code;
-    if (data.details === Hls.ErrorDetails.KEY_LOAD_ERROR && !keyProxyUrlBuilder && !getKeyAccessToken) {
-      callbacks.onFatalError?.(
-        "Encryption key load failed. Configure streaming.getKeyAccessToken (browser Bearer) or streaming.keyProxyUrlBuilder (Cloudflare-allowlisted BFF) for Appextech AES-encrypted HLS."
-      );
-      return;
+    const authFailure = isAuthHttpStatus(status);
+    if (data.details === Hls.ErrorDetails.KEY_LOAD_ERROR) {
+      if (authFailure) {
+        callbacks.onAuthRecoveryNeeded?.("key_error");
+        if (!data.fatal) return;
+      } else if (!data.fatal) {
+        callbacks.onFatalError?.(
+          status ? `Encryption key load failed (HTTP ${status}).` : "Encryption key load failed (network/CORS). Ensure signed query params are applied, or use keyProxyUrlBuilder / getKeyAccessToken when the key host requires API Bearer."
+        );
+        return;
+      }
     }
-    const authFailure = isAuthHttpStatus(status) || data.details === Hls.ErrorDetails.KEY_LOAD_ERROR && (status === void 0 || status === 0 || isAuthHttpStatus(status));
     if (!data.fatal) {
-      if (authFailure && data.type === Hls.ErrorTypes.NETWORK_ERROR && (data.details === Hls.ErrorDetails.FRAG_LOAD_ERROR || data.details === Hls.ErrorDetails.LEVEL_LOAD_ERROR || data.details === Hls.ErrorDetails.KEY_LOAD_ERROR)) {
+      if (authFailure && data.type === Hls.ErrorTypes.NETWORK_ERROR && (data.details === Hls.ErrorDetails.FRAG_LOAD_ERROR || data.details === Hls.ErrorDetails.LEVEL_LOAD_ERROR)) {
         callbacks.onAuthRecoveryNeeded?.(
-          data.details === Hls.ErrorDetails.KEY_LOAD_ERROR ? "key_error" : data.details === Hls.ErrorDetails.LEVEL_LOAD_ERROR ? "level_error" : "frag_error"
+          data.details === Hls.ErrorDetails.LEVEL_LOAD_ERROR ? "level_error" : "frag_error"
         );
       }
       return;
@@ -1198,6 +1355,11 @@ function createVideoPlayer(options) {
         volume: config.player.volume,
         videoId: options.videoId,
         keyProxyUrlBuilder: config.streaming.keyProxyUrlBuilder,
+        // Optional: browser Bearer for Video API–origin enc.key (CORS-dependent).
+        // CDN keys use signed query via the auth loader (no Bearer) — same as
+        // segments. Apps can pass getKeyAccessToken or rely on keyProxyUrlBuilder.
+        // When unset, defaults to AuthManager token only if explicitly requested
+        // via streaming.getKeyAccessToken; otherwise query-signed XHR.
         getKeyAccessToken: config.streaming.getKeyAccessToken,
         hlsConfig: config.streaming.hls,
         logger,
@@ -1513,11 +1675,13 @@ function createVideoPlayer(options) {
   createVideoPlayer,
   getLiveEdgeTime,
   isAtLiveEdge,
+  isEncryptionKeyUrl,
   isPlainObject,
   mergePlayerConfig,
   redactObject,
   redactSensitive,
   redactValue,
+  resolveBuiltinHlsLoader,
   rewriteHlsRequestUrl,
   seekToLiveEdge,
   themeToCssVars