@codenkay/video-nsgplayer-core 5.0.0 → 5.1.0

package/dist/index.d.cts

@@ -136,6 +136,16 @@ type StreamingConfig = {
         backBufferLength?: number;
         fatalRecoveryLimit?: number;
     };
+    /**
+     * Same-origin BFF proxy for playlists, segments, and keys.
+     * The playback API rejects the browser Origin and does not send CORS
+     * headers, so cross-origin media URLs must be rewritten before fetch.
+     * The builder is not called for URLs that are already on the page origin.
+     */
+    mediaProxyUrlBuilder?: (ctx: {
+        url: string;
+        videoId?: string;
+    }) => string;
     /**
      * Same-origin BFF proxy for `enc.key` (preferred in production when the
      * server IP is allowlisted by the CDN / Cloudflare).
@@ -205,6 +215,7 @@ type PlayerConfig = Required<{
     streaming: {
         engine: "hls";
         hls: Required<NonNullable<StreamingConfig["hls"]>>;
+        mediaProxyUrlBuilder?: StreamingConfig["mediaProxyUrlBuilder"];
         keyProxyUrlBuilder?: StreamingConfig["keyProxyUrlBuilder"];
         getKeyAccessToken?: StreamingConfig["getKeyAccessToken"];
         keyProxyMaxFailures?: StreamingConfig["keyProxyMaxFailures"];
@@ -320,6 +331,7 @@ type PlayerConfigPartial = Partial<{
     streaming: {
         engine?: "hls";
         hls?: Partial<PlayerConfig["streaming"]["hls"]>;
+        mediaProxyUrlBuilder?: PlayerConfig["streaming"]["mediaProxyUrlBuilder"];
         keyProxyUrlBuilder?: PlayerConfig["streaming"]["keyProxyUrlBuilder"];
         getKeyAccessToken?: PlayerConfig["streaming"]["getKeyAccessToken"];
         keyProxyMaxFailures?: PlayerConfig["streaming"]["keyProxyMaxFailures"];
@@ -440,6 +452,7 @@ type HlsEngineOptions = {
     startPosition?: number;
     volume?: number;
     videoId?: string;
+    mediaProxyUrlBuilder?: StreamingConfig["mediaProxyUrlBuilder"];
     keyProxyUrlBuilder?: StreamingConfig["keyProxyUrlBuilder"];
     getKeyAccessToken?: StreamingConfig["getKeyAccessToken"];
     keyProxyMaxFailures?: StreamingConfig["keyProxyMaxFailures"];
@@ -480,6 +493,7 @@ declare class HlsEngine {
     private applyStartPositionAndAutoplay;
     private bindMediaEvents;
     updateAuthParams(): void;
+    private playbackRequestUrl;
     resumeAfterAuthRenew(): void;
     setQuality(selection: QualitySelection): void;
     getQuality(): QualitySelection;
@@ -716,6 +730,7 @@ type HlsModuleLike = object;
 declare const KEY_PROXY_MAX_FAILURES = 2;
 type AuthParamsLoaderOptions = {
     videoId?: string;
+    mediaProxyUrlBuilder?: StreamingConfig["mediaProxyUrlBuilder"];
     keyProxyUrlBuilder?: StreamingConfig["keyProxyUrlBuilder"];
     getKeyAccessToken?: StreamingConfig["getKeyAccessToken"];
     /** Override max BFF key failures before permanent browser fallback (default 2). */
@@ -737,6 +752,13 @@ declare function rewriteHlsRequestUrl(rawUrl: string, store: AuthParamsStore, op
  */
 declare function createAuthParamsLoader(HlsModule: HlsModuleLike, store: AuthParamsStore, options?: AuthParamsLoaderOptions): HlsLoaderConstructor;
 
+/**
+ * True for legacy `/hls-web-live/` playlists and current `/live/` playlists.
+ * A same-origin proxy URL is live when its `url` query points at one of those paths.
+ */
+declare function isLivePlaylistUrl(value: string): boolean;
+declare function isSameOriginHttpUrl(value: string, baseOrigin: string): boolean;
+
 declare function redactValue(key: string, value: unknown, seen?: WeakSet<object>, depth?: number): unknown;
 /**
  * Redacts sensitive fields. Cycle-safe and depth-capped.
@@ -744,4 +766,4 @@ declare function redactValue(key: string, value: unknown, seen?: WeakSet<object>
  */
 declare function redactObject(obj: Record<string, unknown>, seen?: WeakSet<object>, depth?: number): Record<string, unknown>;
 
-export { type AccessibilityConfig, type AnalyticsConfig, type AuthConfig, AuthManager, AuthParamsStore, type AuthToken, type AuthTokenProviderContext, type BufferedRange, type ControlsConfig, type CreateVideoPlayerOptions, DEFAULT_CONTROLS, DEFAULT_LIVE_EDGE_TOLERANCE_SECONDS, DEFAULT_PLAYER_BEHAVIOR, DEFAULT_PLAYER_CONFIG, DEFAULT_THEME, DEFAULT_WATERMARK, type DebugConfig, EventEmitter, type HlsLoaderConstructor, type HlsModuleLike, type HlsQualityLevel, type HlsSupportMode, KEY_PROXY_MAX_FAILURES, type LiveMediaSnapshot, type LoggingConfig, PACKAGE_VERSION, PLAYBACK_RATES, type PlayIconPreset, type PlaybackCredentialConfig, type PlaybackRate, type PlaybackSource, type PlaybackSourceContext, PlaybackSourceManager, type PlayerAudioTrack, type PlayerBehaviorConfig, type PlayerConfig, type PlayerDiagnostics, type PlayerError, PlayerErrorCode, type PlayerEventMap, type PlayerSkipSeconds, type PlayerState, type PlayerTextTrack, type PlayerZoomLevel, type QualitySelection, RefreshManager, SECRET_SCAN_MAX_DEPTH, type SeekToLiveResult, type StreamingConfig, type TextTrackSelection, type ThemeConfig, type VideoPlayer, type WatermarkConfig, assertNoSecretsInConfig, createAuthParamsLoader, createPlayerError, createVideoPlayer, getLiveEdgeTime, isAtLiveEdge, isEncryptionKeyUrl, isPlainObject, mergePlayerConfig, redactObject, redactSensitive, redactValue, resolveBuiltinHlsLoader, rewriteHlsRequestUrl, seekToLiveEdge, themeToCssVars };
+export { type AccessibilityConfig, type AnalyticsConfig, type AuthConfig, AuthManager, AuthParamsStore, type AuthToken, type AuthTokenProviderContext, type BufferedRange, type ControlsConfig, type CreateVideoPlayerOptions, DEFAULT_CONTROLS, DEFAULT_LIVE_EDGE_TOLERANCE_SECONDS, DEFAULT_PLAYER_BEHAVIOR, DEFAULT_PLAYER_CONFIG, DEFAULT_THEME, DEFAULT_WATERMARK, type DebugConfig, EventEmitter, type HlsLoaderConstructor, type HlsModuleLike, type HlsQualityLevel, type HlsSupportMode, KEY_PROXY_MAX_FAILURES, type LiveMediaSnapshot, type LoggingConfig, PACKAGE_VERSION, PLAYBACK_RATES, type PlayIconPreset, type PlaybackCredentialConfig, type PlaybackRate, type PlaybackSource, type PlaybackSourceContext, PlaybackSourceManager, type PlayerAudioTrack, type PlayerBehaviorConfig, type PlayerConfig, type PlayerDiagnostics, type PlayerError, PlayerErrorCode, type PlayerEventMap, type PlayerSkipSeconds, type PlayerState, type PlayerTextTrack, type PlayerZoomLevel, type QualitySelection, RefreshManager, SECRET_SCAN_MAX_DEPTH, type SeekToLiveResult, type StreamingConfig, type TextTrackSelection, type ThemeConfig, type VideoPlayer, type WatermarkConfig, assertNoSecretsInConfig, createAuthParamsLoader, createPlayerError, createVideoPlayer, getLiveEdgeTime, isAtLiveEdge, isEncryptionKeyUrl, isLivePlaylistUrl, isPlainObject, isSameOriginHttpUrl, mergePlayerConfig, redactObject, redactSensitive, redactValue, resolveBuiltinHlsLoader, rewriteHlsRequestUrl, seekToLiveEdge, themeToCssVars };

package/dist/index.d.ts

@@ -136,6 +136,16 @@ type StreamingConfig = {
         backBufferLength?: number;
         fatalRecoveryLimit?: number;
     };
+    /**
+     * Same-origin BFF proxy for playlists, segments, and keys.
+     * The playback API rejects the browser Origin and does not send CORS
+     * headers, so cross-origin media URLs must be rewritten before fetch.
+     * The builder is not called for URLs that are already on the page origin.
+     */
+    mediaProxyUrlBuilder?: (ctx: {
+        url: string;
+        videoId?: string;
+    }) => string;
     /**
      * Same-origin BFF proxy for `enc.key` (preferred in production when the
      * server IP is allowlisted by the CDN / Cloudflare).
@@ -205,6 +215,7 @@ type PlayerConfig = Required<{
     streaming: {
         engine: "hls";
         hls: Required<NonNullable<StreamingConfig["hls"]>>;
+        mediaProxyUrlBuilder?: StreamingConfig["mediaProxyUrlBuilder"];
         keyProxyUrlBuilder?: StreamingConfig["keyProxyUrlBuilder"];
         getKeyAccessToken?: StreamingConfig["getKeyAccessToken"];
         keyProxyMaxFailures?: StreamingConfig["keyProxyMaxFailures"];
@@ -320,6 +331,7 @@ type PlayerConfigPartial = Partial<{
     streaming: {
         engine?: "hls";
         hls?: Partial<PlayerConfig["streaming"]["hls"]>;
+        mediaProxyUrlBuilder?: PlayerConfig["streaming"]["mediaProxyUrlBuilder"];
         keyProxyUrlBuilder?: PlayerConfig["streaming"]["keyProxyUrlBuilder"];
         getKeyAccessToken?: PlayerConfig["streaming"]["getKeyAccessToken"];
         keyProxyMaxFailures?: PlayerConfig["streaming"]["keyProxyMaxFailures"];
@@ -440,6 +452,7 @@ type HlsEngineOptions = {
     startPosition?: number;
     volume?: number;
     videoId?: string;
+    mediaProxyUrlBuilder?: StreamingConfig["mediaProxyUrlBuilder"];
     keyProxyUrlBuilder?: StreamingConfig["keyProxyUrlBuilder"];
     getKeyAccessToken?: StreamingConfig["getKeyAccessToken"];
     keyProxyMaxFailures?: StreamingConfig["keyProxyMaxFailures"];
@@ -480,6 +493,7 @@ declare class HlsEngine {
     private applyStartPositionAndAutoplay;
     private bindMediaEvents;
     updateAuthParams(): void;
+    private playbackRequestUrl;
     resumeAfterAuthRenew(): void;
     setQuality(selection: QualitySelection): void;
     getQuality(): QualitySelection;
@@ -716,6 +730,7 @@ type HlsModuleLike = object;
 declare const KEY_PROXY_MAX_FAILURES = 2;
 type AuthParamsLoaderOptions = {
     videoId?: string;
+    mediaProxyUrlBuilder?: StreamingConfig["mediaProxyUrlBuilder"];
     keyProxyUrlBuilder?: StreamingConfig["keyProxyUrlBuilder"];
     getKeyAccessToken?: StreamingConfig["getKeyAccessToken"];
     /** Override max BFF key failures before permanent browser fallback (default 2). */
@@ -737,6 +752,13 @@ declare function rewriteHlsRequestUrl(rawUrl: string, store: AuthParamsStore, op
  */
 declare function createAuthParamsLoader(HlsModule: HlsModuleLike, store: AuthParamsStore, options?: AuthParamsLoaderOptions): HlsLoaderConstructor;
 
+/**
+ * True for legacy `/hls-web-live/` playlists and current `/live/` playlists.
+ * A same-origin proxy URL is live when its `url` query points at one of those paths.
+ */
+declare function isLivePlaylistUrl(value: string): boolean;
+declare function isSameOriginHttpUrl(value: string, baseOrigin: string): boolean;
+
 declare function redactValue(key: string, value: unknown, seen?: WeakSet<object>, depth?: number): unknown;
 /**
  * Redacts sensitive fields. Cycle-safe and depth-capped.
@@ -744,4 +766,4 @@ declare function redactValue(key: string, value: unknown, seen?: WeakSet<object>
  */
 declare function redactObject(obj: Record<string, unknown>, seen?: WeakSet<object>, depth?: number): Record<string, unknown>;
 
-export { type AccessibilityConfig, type AnalyticsConfig, type AuthConfig, AuthManager, AuthParamsStore, type AuthToken, type AuthTokenProviderContext, type BufferedRange, type ControlsConfig, type CreateVideoPlayerOptions, DEFAULT_CONTROLS, DEFAULT_LIVE_EDGE_TOLERANCE_SECONDS, DEFAULT_PLAYER_BEHAVIOR, DEFAULT_PLAYER_CONFIG, DEFAULT_THEME, DEFAULT_WATERMARK, type DebugConfig, EventEmitter, type HlsLoaderConstructor, type HlsModuleLike, type HlsQualityLevel, type HlsSupportMode, KEY_PROXY_MAX_FAILURES, type LiveMediaSnapshot, type LoggingConfig, PACKAGE_VERSION, PLAYBACK_RATES, type PlayIconPreset, type PlaybackCredentialConfig, type PlaybackRate, type PlaybackSource, type PlaybackSourceContext, PlaybackSourceManager, type PlayerAudioTrack, type PlayerBehaviorConfig, type PlayerConfig, type PlayerDiagnostics, type PlayerError, PlayerErrorCode, type PlayerEventMap, type PlayerSkipSeconds, type PlayerState, type PlayerTextTrack, type PlayerZoomLevel, type QualitySelection, RefreshManager, SECRET_SCAN_MAX_DEPTH, type SeekToLiveResult, type StreamingConfig, type TextTrackSelection, type ThemeConfig, type VideoPlayer, type WatermarkConfig, assertNoSecretsInConfig, createAuthParamsLoader, createPlayerError, createVideoPlayer, getLiveEdgeTime, isAtLiveEdge, isEncryptionKeyUrl, isPlainObject, mergePlayerConfig, redactObject, redactSensitive, redactValue, resolveBuiltinHlsLoader, rewriteHlsRequestUrl, seekToLiveEdge, themeToCssVars };
+export { type AccessibilityConfig, type AnalyticsConfig, type AuthConfig, AuthManager, AuthParamsStore, type AuthToken, type AuthTokenProviderContext, type BufferedRange, type ControlsConfig, type CreateVideoPlayerOptions, DEFAULT_CONTROLS, DEFAULT_LIVE_EDGE_TOLERANCE_SECONDS, DEFAULT_PLAYER_BEHAVIOR, DEFAULT_PLAYER_CONFIG, DEFAULT_THEME, DEFAULT_WATERMARK, type DebugConfig, EventEmitter, type HlsLoaderConstructor, type HlsModuleLike, type HlsQualityLevel, type HlsSupportMode, KEY_PROXY_MAX_FAILURES, type LiveMediaSnapshot, type LoggingConfig, PACKAGE_VERSION, PLAYBACK_RATES, type PlayIconPreset, type PlaybackCredentialConfig, type PlaybackRate, type PlaybackSource, type PlaybackSourceContext, PlaybackSourceManager, type PlayerAudioTrack, type PlayerBehaviorConfig, type PlayerConfig, type PlayerDiagnostics, type PlayerError, PlayerErrorCode, type PlayerEventMap, type PlayerSkipSeconds, type PlayerState, type PlayerTextTrack, type PlayerZoomLevel, type QualitySelection, RefreshManager, SECRET_SCAN_MAX_DEPTH, type SeekToLiveResult, type StreamingConfig, type TextTrackSelection, type ThemeConfig, type VideoPlayer, type WatermarkConfig, assertNoSecretsInConfig, createAuthParamsLoader, createPlayerError, createVideoPlayer, getLiveEdgeTime, isAtLiveEdge, isEncryptionKeyUrl, isLivePlaylistUrl, isPlainObject, isSameOriginHttpUrl, mergePlayerConfig, redactObject, redactSensitive, redactValue, resolveBuiltinHlsLoader, rewriteHlsRequestUrl, seekToLiveEdge, themeToCssVars };

package/dist/index.js

@@ -242,6 +242,7 @@ var SKIP_DEEP_SCAN_KEYS = /* @__PURE__ */ new Set([
   "getsource",
   "refreshsource",
   "keyproxyurlbuilder",
+  "mediaproxyurlbuilder",
   "getkeyaccesstoken"
 ]);
 var SECRET_SCAN_MAX_DEPTH = 32;
@@ -326,6 +327,7 @@ function mergePlayerConfig(partial) {
         ...DEFAULT_PLAYER_CONFIG.streaming.hls,
         ...partial?.streaming?.hls
       },
+      mediaProxyUrlBuilder: partial?.streaming?.mediaProxyUrlBuilder,
       keyProxyUrlBuilder: partial?.streaming?.keyProxyUrlBuilder,
       getKeyAccessToken: partial?.streaming?.getKeyAccessToken,
       keyProxyMaxFailures: partial?.streaming?.keyProxyMaxFailures
@@ -767,6 +769,26 @@ function seekToLiveEdge(media, options) {
   return { moved: true, edge };
 }
 
+// src/streaming/mediaUrl.ts
+var LIVE_PLAYLIST_PATH = /\/(?:hls-web-live|live)\//i;
+function isLivePlaylistUrl(value) {
+  if (LIVE_PLAYLIST_PATH.test(value)) return true;
+  try {
+    const parsed = new URL(value, "http://localhost");
+    const inner = parsed.searchParams.get("url");
+    return Boolean(inner && LIVE_PLAYLIST_PATH.test(inner));
+  } catch {
+    return false;
+  }
+}
+function isSameOriginHttpUrl(value, baseOrigin) {
+  try {
+    return new URL(value, baseOrigin).origin === new URL(baseOrigin).origin;
+  } catch {
+    return false;
+  }
+}
+
 // src/streaming/authParamsLoader.ts
 var ENC_KEY_PATH_RE = /enc\.key$/i;
 var BUILTIN_LOADER_NAMES = /* @__PURE__ */ new Set(["XhrLoader", "FetchLoader"]);
@@ -836,8 +858,16 @@ function rewriteHlsRequestUrl(rawUrl, store, options = {}, baseOrigin = typeof l
       mobile: snapshot.mobile
     });
   }
-  if (!store.hasParams()) return parsed.toString();
-  return store.applyToUrl(rawUrl, baseOrigin);
+  const withAuth = store.hasParams() ? store.applyToUrl(rawUrl, baseOrigin) : parsed.toString();
+  return applyMediaProxy(withAuth, options, baseOrigin);
+}
+function applyMediaProxy(url, options, baseOrigin) {
+  if (!options.mediaProxyUrlBuilder) return url;
+  if (isSameOriginHttpUrl(url, baseOrigin)) return url;
+  return options.mediaProxyUrlBuilder({
+    url,
+    videoId: options.videoId
+  });
 }
 function createLoaderStats() {
   const now = performance.now();
@@ -868,12 +898,14 @@ function isProxyUpstreamBlocked(status, contentType, bodyHead, errorText) {
   return false;
 }
 async function fetchEncryptionKeyBytes(url, accessToken, signal) {
-  const headers = accessToken ? { Authorization: `Bearer ${accessToken}`, Accept: "*/*" } : void 0;
+  const pageOrigin = typeof location !== "undefined" ? location.origin : "http://localhost";
+  const sameOrigin = isSameOriginHttpUrl(url, pageOrigin);
+  const headers = !sameOrigin && accessToken ? { Authorization: `Bearer ${accessToken}`, Accept: "*/*" } : void 0;
   try {
     const response = await fetch(url, {
       method: "GET",
       ...headers ? { headers } : {},
-      credentials: "omit",
+      credentials: sameOrigin ? "same-origin" : "omit",
       cache: "no-store",
       signal
     });
@@ -1164,7 +1196,7 @@ function createAuthParamsLoader(HlsModule, store, options = {}) {
         const originalUrl = context.url;
         const isKey = isEncryptionKeyUrl(originalUrl);
         if (!isKey) {
-          if (store.hasParams()) {
+          if (store.hasParams() || options.mediaProxyUrlBuilder) {
             context.url = rewriteHlsRequestUrl(originalUrl, store, {
               ...options,
               keyProxyUrlBuilder: void 0
@@ -1289,7 +1321,7 @@ var HlsEngine = class {
     if (videoEl.canPlayType("application/vnd.apple.mpegurl")) {
       this.supportMode = "native";
       this.options.callbacks.onSupportMode?.("native");
-      videoEl.src = this.options.authParams.applyToUrl(playbackUrl);
+      videoEl.src = this.playbackRequestUrl(playbackUrl);
       this.bindMediaEvents();
       this.bindNativeTextTracks();
       this.options.callbacks.onStateChange?.("ready");
@@ -1314,6 +1346,7 @@ var HlsEngine = class {
     } = this.options;
     const loader = createAuthParamsLoader(Hls, authParams, {
       videoId,
+      mediaProxyUrlBuilder: this.options.mediaProxyUrlBuilder,
       keyProxyUrlBuilder,
       getKeyAccessToken,
       keyProxyMaxFailures: this.options.keyProxyMaxFailures
@@ -1342,7 +1375,7 @@ var HlsEngine = class {
       loader
     });
     this.hls.attachMedia(videoEl);
-    this.hls.loadSource(authParams.applyToUrl(playbackUrl));
+    this.hls.loadSource(this.playbackRequestUrl(playbackUrl));
     this.hls.on(Hls.Events.MANIFEST_PARSED, (_event, data) => {
       if (this.destroyed) return;
       this.qualities = (data.levels ?? []).map((level, index) => ({
@@ -1520,13 +1553,20 @@ var HlsEngine = class {
     if (this.supportMode === "native" && this.options.videoEl) {
       const time = this.options.videoEl.currentTime;
       const wasPaused = this.options.videoEl.paused;
-      this.options.videoEl.src = this.options.authParams.applyToUrl(
-        this.options.playbackUrl
-      );
+      this.options.videoEl.src = this.playbackRequestUrl(this.options.playbackUrl);
       this.options.videoEl.currentTime = time;
       if (!wasPaused) void this.options.videoEl.play();
     }
   }
+  playbackRequestUrl(playbackUrl) {
+    return rewriteHlsRequestUrl(playbackUrl, this.options.authParams, {
+      videoId: this.options.videoId,
+      mediaProxyUrlBuilder: this.options.mediaProxyUrlBuilder,
+      keyProxyUrlBuilder: this.options.keyProxyUrlBuilder,
+      getKeyAccessToken: this.options.getKeyAccessToken,
+      keyProxyMaxFailures: this.options.keyProxyMaxFailures
+    });
+  }
   resumeAfterAuthRenew() {
     this.networkRecoveryCount = 0;
     this.hls?.startLoad();
@@ -1791,7 +1831,7 @@ function createVideoPlayer(options) {
         const source = {
           url: options.sourceUrl,
           expiresAt: Date.now() + 24 * 60 * 60 * 1e3,
-          live: /\/hls-web-live\//i.test(options.sourceUrl)
+          live: isLivePlaylistUrl(options.sourceUrl)
         };
         sourceManager.applyDirectSource(source);
         playbackUrl = source.url;
@@ -1821,6 +1861,7 @@ function createVideoPlayer(options) {
         startPosition: config.player.startPosition,
         volume: config.player.volume,
         videoId: options.videoId,
+        mediaProxyUrlBuilder: config.streaming.mediaProxyUrlBuilder,
         keyProxyUrlBuilder: config.streaming.keyProxyUrlBuilder,
         // Enterprise AES key auth (see authParamsLoader):
         // 1) keyProxyUrlBuilder BFF — max 2 failures then circuit
@@ -2152,6 +2193,7 @@ function createVideoPlayer(options) {
         streaming: {
           engine: "hls",
           hls: { ...config.streaming.hls, ...partial?.streaming?.hls },
+          mediaProxyUrlBuilder: partial?.streaming?.mediaProxyUrlBuilder ?? config.streaming.mediaProxyUrlBuilder,
           keyProxyUrlBuilder: partial?.streaming?.keyProxyUrlBuilder ?? config.streaming.keyProxyUrlBuilder,
           getKeyAccessToken: partial?.streaming?.getKeyAccessToken ?? config.streaming.getKeyAccessToken ?? (() => authManager.getAccessToken()),
           keyProxyMaxFailures: partial?.streaming?.keyProxyMaxFailures ?? config.streaming.keyProxyMaxFailures
@@ -2199,7 +2241,9 @@ export {
   getLiveEdgeTime,
   isAtLiveEdge,
   isEncryptionKeyUrl,
+  isLivePlaylistUrl,
   isPlainObject,
+  isSameOriginHttpUrl,
   mergePlayerConfig,
   redactObject,
   redactSensitive,