@oddin-gg/havik-player 2.11.1 → 2.13.0

package/README.md

@@ -208,8 +208,9 @@ A ready-to-host template lives in the repo at [`embed/index.html`](embed/index.h
 > top-level iframe nav.
 
 The injected config also takes `analytics`, forwarded to the managed player.
-Set it when `baseUrl` is not a `feed` host, or QoE beacons stay off. See
-[Analytics](#analytics-qoe-beacons).
+A server from v0.10.0 names the beacons host itself, so this is only needed
+against an older server when `baseUrl` is not a `feed` host. There, without
+it, QoE beacons stay off. See [Analytics](#analytics-qoe-beacons).
 
 ```js
 window.HAVIK_EMBED_CONFIG = {
@@ -226,9 +227,11 @@ so the query string is not allowed to set one.
 
 That has a consequence worth knowing before you pick a Mode C path.
 `mountEmbed` passes its config to the embed page as query parameters, so it
-cannot carry `analytics` either. If your `baseUrl` is not a `feed` host and
-you need beacons, host the embed page yourself and inject the config. A
-`mountEmbed` integration on a non-feed base has no way to turn analytics on.
+cannot carry `analytics` either. Against a server from v0.10.0 that does not
+matter: the server names the beacons host. Against an older server, if your
+`baseUrl` is not a `feed` host and you need beacons, host the embed page
+yourself and inject the config. There, a `mountEmbed` integration on a non-feed
+base has no way to turn analytics on.
 
 ---
 
@@ -345,9 +348,28 @@ suspended (OS sleep, a frozen tab) for that long. The suspension gap never
 goes below five minutes, whatever `idleMs` is. The next `play()` reloads the
 stream as a fresh session.
 
-### If your `baseUrl` is not a `feed` host, set `analytics.endpoint`
+### Where beacons go
 
-By default the beacons host is derived from `baseUrl` by hostname convention:
+The streams server names the beacons host. From havik-streams v0.10.0, the
+playback response carries it beside the `sid`. The SDK posts there whatever
+your `baseUrl` is, including your own CDN or gateway hostname. You configure
+nothing. The server's host also wins over `analytics.endpoint`: a differing
+value is ignored, with one `console.warn` saying so. Only `analytics: false`
+turns beacons off.
+
+If your page sets a Content-Security-Policy, allow the beacons host in
+`connect-src`: `https://beacons.oddin-video.gg` in production and
+`https://beacons-dev.oddin-video.gg` in integration. If the policy blocks it,
+playback is unaffected. The SDK prints one `console.warn` naming the origin to
+add, and emits a non-fatal [`warning`](docs/API.md#player-events) event with
+the same sentence. It then sends no more beacons from that page.
+
+### Against an older server: if your `baseUrl` is not a `feed` host, set `analytics.endpoint`
+
+A server before v0.10.0 does not name the host. The SDK then falls back to the
+rules below, exactly as before.
+
+The beacons host is derived from `baseUrl` by hostname convention:
 `feed.<domain>` becomes `beacons.<domain>`, and `feed-dev.<domain>` becomes
 `beacons-dev.<domain>`. The rule is deliberately narrow. It maps only hosts
 whose first label is `feed` or `feed-*`. **Any other `baseUrl` derives nothing,