@codenkay/video-nsgplayer-core 3.0.1 → 3.0.4

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## 3.0.4
+
+### Patch Changes
+
+- Preserve "use client" in React/UI builds, forward analytics, intermittent watermark, Angular Ivy packaging, and packaging metadata.
+
+## 3.0.3
+
+- Browser-direct AES keys: after signed-query CORS/network failure, retry once
+  with `getKeyAccessToken` Bearer before XHR (needed when AUTH_MODE=browser and
+  Appextech enables CORS + Authorization on `enc.key`).
+- Clearer KEY_LOAD_ERROR message distinguishing BFF vs browser-direct CORS.
+
+## 3.0.2
+
+- Fix pack/build regression on AES `enc.key`: do **not** statically import
+  `XhrLoader` from `hls.js` (second module copy after npm pack broke key loads).
+- Resolve builtin loader via same-module `DefaultConfig` + composition unwrap
+  (`Symbol` stash / WeakMap) so nested wrappers never replace real XhrLoader.
+- Key auth order: BFF (≤2) → **signed-query without Bearer** → Bearer only on
+  401/403. Query-only fetch uses no custom headers (CORS simple request).
+- `keyProxyMaxFailures` circuit breaker retained.
+
 ## 3.0.1
 
 - Permanent AES key path: dedicated key loader with **session circuit breaker**

package/dist/index.cjs

@@ -213,7 +213,7 @@ var AuthManager = class {
 
 // src/config/defaults.ts
 var PLAYBACK_RATES = [0.5, 0.75, 1, 1.25, 1.5, 2];
-var PACKAGE_VERSION = "3.0.1";
+var PACKAGE_VERSION = "3.0.3";
 var DEFAULT_PLAYER_BEHAVIOR = {
   autoplay: true,
   startMuted: true,
@@ -237,7 +237,8 @@ var DEFAULT_CONTROLS = {
   showSkip: true,
   showLive: true,
   seekCueDurationMs: 720,
-  keyboardShortcuts: true
+  keyboardShortcuts: true,
+  persistQualityPreference: false
 };
 var DEFAULT_THEME = {
   playIconPreset: "triangle",
@@ -833,9 +834,12 @@ function seekToLiveEdge(media, options) {
 }
 
 // src/streaming/authParamsLoader.ts
-var import_hls = require("hls.js");
 var ENC_KEY_PATH_RE = /enc\.key$/i;
 var BUILTIN_LOADER_NAMES = /* @__PURE__ */ new Set(["XhrLoader", "FetchLoader"]);
+var BUILTIN_LOADER_REF = /* @__PURE__ */ Symbol.for(
+  "@codenkay/video-nsgplayer-core/builtin-hls-loader"
+);
+var builtinLoaderByHls = /* @__PURE__ */ new WeakMap();
 var KEY_PROXY_MAX_FAILURES = 2;
 function isEncryptionKeyUrl(rawUrl, baseOrigin = typeof location !== "undefined" ? location.origin : "http://localhost") {
   try {
@@ -844,18 +848,35 @@ function isEncryptionKeyUrl(rawUrl, baseOrigin = typeof location !== "undefined"
     return /enc\.key/i.test(rawUrl);
   }
 }
-function resolveBuiltinHlsLoader(HlsClass) {
-  if (typeof import_hls.XhrLoader === "function") {
-    return import_hls.XhrLoader;
+function isBuiltinLoaderName(name) {
+  return BUILTIN_LOADER_NAMES.has(name);
+}
+function rememberBuiltin(HlsClass, loader) {
+  if (isBuiltinLoaderName(typeof loader.name === "string" ? loader.name : "")) {
+    builtinLoaderByHls.set(HlsClass, loader);
   }
+  return loader;
+}
+function getStashedBuiltinLoader(loader) {
+  return loader[BUILTIN_LOADER_REF];
+}
+function resolveBuiltinHlsLoader(HlsModule) {
+  const HlsClass = HlsModule;
+  const cached = builtinLoaderByHls.get(HlsClass);
+  if (cached) return cached;
   const start = HlsClass.DefaultConfig.loader;
   let current = start;
   const seen = /* @__PURE__ */ new Set();
   while (current && !seen.has(current)) {
     seen.add(current);
     const name = typeof current.name === "string" ? current.name : "";
-    if (BUILTIN_LOADER_NAMES.has(name)) {
-      return current;
+    if (isBuiltinLoaderName(name)) {
+      return rememberBuiltin(HlsClass, current);
+    }
+    const stashed = getStashedBuiltinLoader(current);
+    if (stashed) {
+      current = stashed;
+      continue;
     }
     const parentCtor = Object.getPrototypeOf(current.prototype)?.constructor;
     if (!parentCtor || parentCtor === Object || parentCtor === Function) {
@@ -863,7 +884,8 @@ function resolveBuiltinHlsLoader(HlsClass) {
     }
     current = parentCtor;
   }
-  return start;
+  const fallback = builtinLoaderByHls.get(HlsClass);
+  return fallback ?? start;
 }
 function rewriteHlsRequestUrl(rawUrl, store, options = {}, baseOrigin = typeof location !== "undefined" ? location.origin : "http://localhost") {
   if (!rawUrl) return rawUrl;
@@ -911,67 +933,82 @@ function isProxyUpstreamBlocked(status, contentType, bodyHead, errorText) {
   }
   return false;
 }
-async function loadEncryptionKeyWithFetch(context, callbacks, accessToken, signal) {
-  const stats = createLoaderStats();
-  stats.loading.first = performance.now();
-  const headers = {
-    Accept: "*/*",
-    ...context.headers
-  };
-  if (accessToken) {
-    headers.Authorization = `Bearer ${accessToken}`;
-  }
-  const response = await fetch(context.url, {
-    method: "GET",
-    headers,
-    credentials: "omit",
-    cache: "no-store",
-    signal
-  });
-  if (!response.ok) {
-    callbacks.onError(
-      {
-        code: response.status,
-        text: response.statusText || `enc.key HTTP ${response.status}`
-      },
-      context,
+async function fetchEncryptionKeyBytes(url, accessToken, signal) {
+  const headers = accessToken ? { Authorization: `Bearer ${accessToken}`, Accept: "*/*" } : void 0;
+  try {
+    const response = await fetch(url, {
+      method: "GET",
+      ...headers ? { headers } : {},
+      credentials: "omit",
+      cache: "no-store",
+      signal
+    });
+    if (!response.ok) {
+      return {
+        ok: false,
+        status: response.status,
+        text: response.statusText || `enc.key HTTP ${response.status}`,
+        cors: false,
+        response
+      };
+    }
+    const data = await response.arrayBuffer();
+    const head = new TextDecoder().decode(data.slice(0, 32));
+    if (/<!DOCTYPE|<html/i.test(head)) {
+      return {
+        ok: false,
+        status: 403,
+        text: "enc.key returned HTML (CDN challenge/block), not an AES key",
+        cors: false,
+        response
+      };
+    }
+    return {
+      ok: true,
+      data,
       response,
-      stats
-    );
-    return;
+      url: response.url || url
+    };
+  } catch (error) {
+    if (error instanceof DOMException && error.name === "AbortError") {
+      return {
+        ok: false,
+        status: 0,
+        text: "enc.key fetch aborted/timeout",
+        cors: false,
+        response: null
+      };
+    }
+    const cors = error instanceof TypeError || error instanceof Error && /Failed to fetch|NetworkError|CORS/i.test(error.message);
+    return {
+      ok: false,
+      status: 0,
+      text: error instanceof Error ? error.message : "enc.key fetch failed",
+      cors,
+      response: null
+    };
   }
-  const data = await response.arrayBuffer();
+}
+function reportKeySuccess(context, callbacks, result) {
+  const stats = createLoaderStats();
   const end = performance.now();
+  stats.loading.first = stats.loading.start;
   stats.loading.end = end;
-  stats.loaded = data.byteLength;
-  stats.total = data.byteLength;
-  const head = new TextDecoder().decode(data.slice(0, 32));
-  if (/<!DOCTYPE|<html/i.test(head)) {
-    callbacks.onError(
-      {
-        code: 403,
-        text: "enc.key returned HTML (CDN challenge/block), not an AES key"
-      },
-      context,
-      response,
-      stats
-    );
-    return;
-  }
+  stats.loaded = result.data.byteLength;
+  stats.total = result.data.byteLength;
   callbacks.onSuccess(
     {
-      url: response.url || context.url,
-      data,
-      code: response.status
+      url: result.url,
+      data: result.data,
+      code: result.response.status
     },
     stats,
     context,
-    response
+    result.response
   );
 }
 async function loadEncryptionKeyEnterprise(context, callbacks, plan, signal, state) {
   const stats = createLoaderStats();
-  stats.loading.first = performance.now();
   const canTryProxy = Boolean(plan.proxyUrl) && !state.circuitOpen && state.proxyFailures < plan.maxProxyFailures;
   if (canTryProxy && plan.proxyUrl) {
     while (!state.circuitOpen && state.proxyFailures < plan.maxProxyFailures && !signal.aborted) {
@@ -1042,47 +1079,71 @@ async function loadEncryptionKeyEnterprise(context, callbacks, plan, signal, sta
     }
     state.circuitOpen = true;
   }
-  if (plan.accessToken) {
-    try {
-      await loadEncryptionKeyWithFetch(
+  const queryResult = await fetchEncryptionKeyBytes(
+    plan.signedKeyUrl,
+    null,
+    signal
+  );
+  if (queryResult.ok) {
+    reportKeySuccess(
+      { ...context, url: plan.signedKeyUrl },
+      callbacks,
+      queryResult
+    );
+    return "ok";
+  }
+  const needsBearer = Boolean(plan.accessToken) && (queryResult.status === 401 || queryResult.status === 403 || // Browser-direct: opaque CORS/network on unsigned GET — try Bearer once
+  // Appextech allows ACAO + Authorization (AUTH_MODE=browser, no BFF).
+  queryResult.cors || queryResult.status === 0);
+  if (needsBearer && plan.accessToken) {
+    const bearerResult = await fetchEncryptionKeyBytes(
+      plan.signedKeyUrl,
+      plan.accessToken,
+      signal
+    );
+    if (bearerResult.ok) {
+      reportKeySuccess(
         { ...context, url: plan.signedKeyUrl },
         callbacks,
-        plan.accessToken,
-        signal
-      );
-      return "ok";
-    } catch (error) {
-      if (error instanceof DOMException && error.name === "AbortError") {
-        callbacks.onError(
-          { code: 0, text: "enc.key fetch aborted/timeout" },
-          { ...context, url: plan.signedKeyUrl },
-          null,
-          stats
-        );
-        return "ok";
-      }
-      if (error instanceof TypeError || error instanceof Error && /Failed to fetch|NetworkError|CORS/i.test(error.message)) {
-        return "try_xhr";
-      }
-      callbacks.onError(
-        {
-          code: 0,
-          text: error instanceof Error ? error.message : "enc.key Bearer fetch failed"
-        },
-        { ...context, url: plan.signedKeyUrl },
-        null,
-        stats
+        bearerResult
       );
       return "ok";
     }
+    if (bearerResult.cors || bearerResult.status === 0) {
+      return "try_xhr";
+    }
+    callbacks.onError(
+      {
+        code: bearerResult.status,
+        text: bearerResult.text
+      },
+      { ...context, url: plan.signedKeyUrl },
+      bearerResult.response,
+      stats
+    );
+    return "ok";
+  }
+  if (queryResult.cors || queryResult.status === 0) {
+    return "try_xhr";
   }
-  return "try_xhr";
+  callbacks.onError(
+    {
+      code: queryResult.status,
+      text: queryResult.text
+    },
+    { ...context, url: plan.signedKeyUrl },
+    queryResult.response,
+    stats
+  );
+  return "ok";
 }
-function createAuthParamsLoader(HlsClass, store, options = {}) {
+function createAuthParamsLoader(HlsModule, store, options = {}) {
+  const HlsClass = HlsModule;
   const BaseLoader = resolveBuiltinHlsLoader(HlsClass);
+  rememberBuiltin(HlsClass, BaseLoader);
   const maxProxyFailures = typeof options.keyProxyMaxFailures === "number" && options.keyProxyMaxFailures >= 0 ? options.keyProxyMaxFailures : KEY_PROXY_MAX_FAILURES;
   const keyProxyState = { proxyFailures: 0, circuitOpen: false };
-  return class AuthParamsLoader {
+  class AuthParamsLoader {
     constructor(config) {
       this.context = null;
       this.keyAbort = null;
@@ -1166,7 +1227,13 @@ function createAuthParamsLoader(HlsClass, store, options = {}) {
       }
       this.inner.load(context, config, callbacks);
     }
-  };
+  }
+  Object.defineProperty(AuthParamsLoader, BUILTIN_LOADER_REF, {
+    value: BaseLoader,
+    enumerable: false,
+    configurable: false
+  });
+  return AuthParamsLoader;
 }
 
 // src/streaming/HlsEngine.ts
@@ -1281,7 +1348,7 @@ var HlsEngine = class {
         if (!data.fatal) return;
       } else if (!data.fatal) {
         callbacks.onFatalError?.(
-          status ? `Encryption key load failed (HTTP ${status}).` : "Encryption key load failed (network/CORS). Ensure signed query params are applied, or use keyProxyUrlBuilder / getKeyAccessToken when the key host requires API Bearer."
+          status ? `Encryption key load failed (HTTP ${status}).` : "Encryption key load failed (network/CORS). For browser-direct mode the key host must allow CORS (and Authorization if Bearer is required). Otherwise use keyProxyUrlBuilder (same-origin BFF) when the server IP can reach Appextech."
         );
         return;
       }
@@ -1656,10 +1723,11 @@ function createVideoPlayer(options) {
         volume: config.player.volume,
         videoId: options.videoId,
         keyProxyUrlBuilder: config.streaming.keyProxyUrlBuilder,
-        // Enterprise AES key auth:
-        // 1) keyProxyUrlBuilder (same-origin BFF) when configured — max 2 failures
-        // 2) else getKeyAccessToken / AuthManager Bearer via browser fetch
-        // 3) else signed query + XHR (CDN hosts)
+        // Enterprise AES key auth (see authParamsLoader):
+        // 1) keyProxyUrlBuilder BFF — max 2 failures then circuit
+        // 2) signed-query fetch (no Bearer / no CORS preflight)
+        // 3) Bearer only on HTTP 401/403 when getKeyAccessToken is set
+        // 4) signed-query XHR fallback if fetch is CORS-blocked
         getKeyAccessToken: config.streaming.getKeyAccessToken ?? (() => authManager.getAccessToken()),
         keyProxyMaxFailures: config.streaming.keyProxyMaxFailures,
         hlsConfig: config.streaming.hls,