@oddin-gg/havik-player 2.16.3 → 2.16.5

package/docs/API.md

@@ -1115,6 +1115,18 @@ play DRM. The built-in error card still offers Retry (it re-resolves and re-atta
 which can recover a transient license failure); an unsupported device will simply fail
 the same way again.
 
+One license `403` is handled before it reaches you: when the signed license URL the
+player holds carries an `exp` that has already passed. The `licenseRefreshMs` timer
+could not run because the tab was hidden long enough for the browser to freeze it, or
+the machine slept, so the next license request after refocus goes out with a stale
+signature and the server rejects it. That is the signature's lifetime, not an
+entitlement decision, so the player re-resolves and re-attaches once on its own (the
+same path as Retry), emitting the `FORBIDDEN` error as a `warning` instead of ending
+the session. A second `403` before a key is usable on the fresh URL is fatal as usual.
+The check is made on the viewer's clock and covers Widevine (hls.js) only: a device
+clock more than ~10 minutes slow still sees the plain fatal `FORBIDDEN`, and FairPlay
+(Safari) keeps its existing fatal path.
+
 ```ts
 import { PlaybackError } from '@oddin-gg/havik-player';
 try {

package/embed/index.html

@@ -28,7 +28,7 @@
            beacons endpoint can be derived and QoE analytics is silently off.
            `analytics` is honoured from the injected config only, never the query.
     -->
-    <script src="https://cdn.jsdelivr.net/npm/@oddin-gg/havik-player@2.16.3/dist/havik-player.global.js" integrity="sha384-W2+heG4rUFFDjEtZhecaS++NHDHR5NyWUPv37LZdD9aWIEbyRiYFoUAqMjBIKJcV" crossorigin="anonymous"></script>
+    <script src="https://cdn.jsdelivr.net/npm/@oddin-gg/havik-player@2.16.5/dist/havik-player.global.js" integrity="sha384-SRvsbTOrE/wt0jWSx8K2zJPfMs/b/gAlXVXO1Sp9pCBtvYq8SZODzx54ZbCUrZdq" crossorigin="anonymous"></script>
     <script>
       HavikPlayer.bootEmbed();
     </script>

package/examples/vanilla.html

@@ -12,7 +12,7 @@
          shipped in each npm release is pinned to that release with Subresource
          Integrity, injected at publish time (scripts/inject-sri.mjs). In
          production, always use a pinned + SRI'd tag like the released copy. -->
-    <script src="https://cdn.jsdelivr.net/npm/@oddin-gg/havik-player@2.16.3/dist/havik-player.global.js" integrity="sha384-W2+heG4rUFFDjEtZhecaS++NHDHR5NyWUPv37LZdD9aWIEbyRiYFoUAqMjBIKJcV" crossorigin="anonymous"></script>
+    <script src="https://cdn.jsdelivr.net/npm/@oddin-gg/havik-player@2.16.5/dist/havik-player.global.js" integrity="sha384-SRvsbTOrE/wt0jWSx8K2zJPfMs/b/gAlXVXO1Sp9pCBtvYq8SZODzx54ZbCUrZdq" crossorigin="anonymous"></script>
     <script>
       (async () => {
         const player = await HavikPlayer.createPlayer({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oddin-gg/havik-player",
-  "version": "2.16.3",
+  "version": "2.16.5",
   "description": "Havik HTML5 player SDK — LL-HLS + DRM playback for Oddin live streams (managed, bring-your-own-player, and iframe-embed modes).",
   "type": "module",
   "sideEffects": false,