@oddin-gg/havik-player 1.8.2 → 1.8.3

package/embed/index.html

@@ -0,0 +1,31 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta name="referrer" content="no-referrer" />
+    <title>Havik Player</title>
+  </head>
+  <body>
+    <!--
+      Reference hosted iframe embed page (Mode C) — this file is a TEMPLATE, not a
+      production page. Before deploying:
+        1) PIN a version + add Subresource Integrity on the script below, e.g.
+           src=".../@oddin-gg/havik-player@X.Y.Z/dist/havik-player.global.js"
+           integrity="sha384-…" crossorigin="anonymous"
+           (the unpinned URL below tracks `latest` and auto-upgrades — do not ship it).
+           Done for you in the published copies: the copy inside each npm release
+           (node_modules/@oddin-gg/havik-player/embed/index.html) and the copy
+           attached to each GitHub release are pinned to that release, with the
+           integrity hash computed from the exact published bundle. Only this
+           repo copy is unpinned.
+        2) INJECT config server-side as window.HAVIK_EMBED_CONFIG (baseUrl, matchUrn,
+           apiKey, parentOrigin). When injected, the URL query string is IGNORED for
+           security; the api-key must NOT travel in the query in production.
+    -->
+    <script src="https://cdn.jsdelivr.net/npm/@oddin-gg/havik-player@1.8.3/dist/havik-player.global.js" integrity="sha384-A11YCQWq/mFKKcKOSAMkGXO1IRXkDxGXJvKLdXywEybTAOdk22p5k1Lo26bknt+i" crossorigin="anonymous"></script>
+    <script>
+      HavikPlayer.bootEmbed();
+    </script>
+  </body>
+</html>

package/examples/vanilla.html

@@ -8,8 +8,11 @@
   <body>
     <video id="player" controls playsinline muted style="width: 100%; max-width: 960px; background: #000"></video>
 
-    <!-- In production, pin a version + add Subresource Integrity (see README). -->
-    <script src="https://cdn.jsdelivr.net/npm/@oddin-gg/havik-player/dist/havik-player.global.js"></script>
+    <!-- The repo copy of this file tracks `latest` for convenience; the copy
+         shipped in each npm release is pinned to that release with Subresource
+         Integrity, injected at publish time (scripts/inject-sri.mjs). In
+         production, always use a pinned + SRI'd tag like the released copy. -->
+    <script src="https://cdn.jsdelivr.net/npm/@oddin-gg/havik-player@1.8.3/dist/havik-player.global.js" integrity="sha384-A11YCQWq/mFKKcKOSAMkGXO1IRXkDxGXJvKLdXywEybTAOdk22p5k1Lo26bknt+i" crossorigin="anonymous"></script>
     <script>
       (async () => {
         const player = await HavikPlayer.createPlayer({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oddin-gg/havik-player",
-  "version": "1.8.2",
+  "version": "1.8.3",
   "description": "Havik HTML5 player SDK — LL-HLS + DRM playback for Oddin live streams (managed, bring-your-own-player, and iframe-embed modes).",
   "type": "module",
   "sideEffects": false,
@@ -45,6 +45,7 @@
     "dist/index.d.cts",
     "dist/havik-player.global.js",
     "dist/havik-player.global.js.map",
+    "embed",
     "examples",
     "README.md",
     "LICENSE",
@@ -67,6 +68,8 @@
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
     "test:conformance": "playwright test -c conformance/playwright.config.ts",
+    "build:crossbrowser": "vite build --config crossbrowser/vite.config.ts",
+    "test:crossbrowser": "npm run build:crossbrowser && playwright test -c crossbrowser/playwright.config.ts",
     "verify:ssr": "node scripts/verify-ssr.mjs",
     "publint": "publint",
     "size": "size-limit",