@oddin-gg/havik-player 2.16.5 → 2.16.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (10) hide show
  1. package/dist/havik-player.global.js +2 -2
  2. package/dist/havik-player.global.js.map +1 -1
  3. package/dist/index.cjs +2 -2
  4. package/dist/index.cjs.map +1 -1
  5. package/dist/index.js +263 -223
  6. package/dist/index.js.map +1 -1
  7. package/docs/API.md +14 -12
  8. package/embed/index.html +1 -1
  9. package/examples/vanilla.html +1 -1
  10. package/package.json +1 -1
package/docs/API.md CHANGED
@@ -243,7 +243,7 @@ player.on('error', (e) => console.error(e.code, e.httpStatus, e.message));
243
243
  | `debug` | `boolean` | `false` | Turn on hls.js's internal console logging: fragment/part scheduling, ABR switches, EME key sessions and license traffic. For diagnosing a playback problem with Oddin support; leave it off in production (it logs on every fragment, and the EME lines include license request/response metadata). hls.js engine only. `hlsConfig.debug` still wins if you set both. |
244
244
  | `hlsConfig` | `Partial<HlsConfig>` | — | Escape hatch for advanced hls.js tuning. |
245
245
  | `statsIntervalMs` | `number` | `2000` | How often `'stats'` is emitted. |
246
- | `licenseRefreshMs` | `number` | `480000` (8 min) | How often to silently re-resolve playback so the signed DRM license URL the player would use next stays inside its signature lifetime (~10 min). Refreshes the URL, not the license: it cannot extend a license the CDM already holds, so a session that outlasts its license still ends with a fatal [`DRM_CLIENT`](#errors) error. `0` disables. |
246
+ | `licenseRefreshMs` | `number` | `480000` (8 min) | How often to silently re-resolve playback so the signed DRM license URL the player would use next stays inside its signature lifetime (~10 min). Refreshes the URL, not the license: it cannot extend a license the CDM already holds, so a session that outlasts its license still ends with a fatal [`DRM_CLIENT`](#errors) error. `0` disables the timer only: a lapsed URL is still refreshed on refocus and before a license request (Widevine on hls.js; the native FairPlay engine has neither check). |
247
247
  | `poster` | `string` | — | Poster image shown before playback starts. |
248
248
  | `startLevel` | `number` | `-1` | Initial rendition index (`-1` = auto). With auto, ABR starts on a conservative, sustainable rendition (~360p) and ramps up as bandwidth allows; see [Low‑latency & adaptive bitrate](#low-latency--adaptive-bitrate). |
249
249
  | `maxBitrate` | `number` | — | Cap ABR to renditions at/below this bitrate (bps). |
@@ -1115,17 +1115,19 @@ play DRM. The built-in error card still offers Retry (it re-resolves and re-atta
1115
1115
  which can recover a transient license failure); an unsupported device will simply fail
1116
1116
  the same way again.
1117
1117
 
1118
- One license `403` is handled before it reaches you: when the signed license URL the
1119
- player holds carries an `exp` that has already passed. The `licenseRefreshMs` timer
1120
- could not run because the tab was hidden long enough for the browser to freeze it, or
1121
- the machine slept, so the next license request after refocus goes out with a stale
1122
- signature and the server rejects it. That is the signature's lifetime, not an
1123
- entitlement decision, so the player re-resolves and re-attaches once on its own (the
1124
- same path as Retry), emitting the `FORBIDDEN` error as a `warning` instead of ending
1125
- the session. A second `403` before a key is usable on the fresh URL is fatal as usual.
1126
- The check is made on the viewer's clock and covers Widevine (hls.js) only: a device
1127
- clock more than ~10 minutes slow still sees the plain fatal `FORBIDDEN`, and FairPlay
1128
- (Safari) keeps its existing fatal path.
1118
+ A lapsed signed license URL is handled before it reaches you. The `licenseRefreshMs`
1119
+ timer cannot run while the browser has the tab frozen (a long-hidden tab, a machine
1120
+ that slept), so the URL the player holds can carry an `exp` that has already passed.
1121
+ Two checks keep that from becoming a `403`: on refocus, a lapsed URL is refreshed at
1122
+ once; and right before any Widevine license request, the player checks the held URL's
1123
+ `exp` and mints a fresh one first when it has lapsed (the request waits for the
1124
+ re-resolve, nothing else does). Should a stale request still reach the server (a
1125
+ refresh that failed, a viewer clock far behind), its `403` is recovered once by a
1126
+ re-resolve and re-attach (the same path as Retry), surfaced as a `warning` instead of
1127
+ ending the session; a second `403` before a key is usable on the fresh URL is fatal as
1128
+ usual. All three checks run on the viewer's clock and cover Widevine (hls.js) only: a
1129
+ device clock more than ~10 minutes slow still sees the plain fatal `FORBIDDEN`, and
1130
+ FairPlay (Safari) keeps its existing fatal path.
1129
1131
 
1130
1132
  ```ts
1131
1133
  import { PlaybackError } from '@oddin-gg/havik-player';
package/embed/index.html CHANGED
@@ -28,7 +28,7 @@
28
28
  beacons endpoint can be derived and QoE analytics is silently off.
29
29
  `analytics` is honoured from the injected config only, never the query.
30
30
  -->
31
- <script src="https://cdn.jsdelivr.net/npm/@oddin-gg/havik-player@2.16.5/dist/havik-player.global.js" integrity="sha384-SRvsbTOrE/wt0jWSx8K2zJPfMs/b/gAlXVXO1Sp9pCBtvYq8SZODzx54ZbCUrZdq" crossorigin="anonymous"></script>
31
+ <script src="https://cdn.jsdelivr.net/npm/@oddin-gg/havik-player@2.16.7/dist/havik-player.global.js" integrity="sha384-ixD93oDo0BWNU+OvGQ7kPAyC473FRI6yzGnSARB6sP+UI6kBivpDrn7YALfwbj20" crossorigin="anonymous"></script>
32
32
  <script>
33
33
  HavikPlayer.bootEmbed();
34
34
  </script>
package/examples/vanilla.html CHANGED
@@ -12,7 +12,7 @@
12
12
  shipped in each npm release is pinned to that release with Subresource
13
13
  Integrity, injected at publish time (scripts/inject-sri.mjs). In
14
14
  production, always use a pinned + SRI'd tag like the released copy. -->
15
- <script src="https://cdn.jsdelivr.net/npm/@oddin-gg/havik-player@2.16.5/dist/havik-player.global.js" integrity="sha384-SRvsbTOrE/wt0jWSx8K2zJPfMs/b/gAlXVXO1Sp9pCBtvYq8SZODzx54ZbCUrZdq" crossorigin="anonymous"></script>
15
+ <script src="https://cdn.jsdelivr.net/npm/@oddin-gg/havik-player@2.16.7/dist/havik-player.global.js" integrity="sha384-ixD93oDo0BWNU+OvGQ7kPAyC473FRI6yzGnSARB6sP+UI6kBivpDrn7YALfwbj20" crossorigin="anonymous"></script>
16
16
  <script>
17
17
  (async () => {
18
18
  const player = await HavikPlayer.createPlayer({
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@oddin-gg/havik-player",
3
- "version": "2.16.5",
3
+ "version": "2.16.7",
4
4
  "description": "Havik HTML5 player SDK — LL-HLS + DRM playback for Oddin live streams (managed, bring-your-own-player, and iframe-embed modes).",
5
5
  "type": "module",
6
6
  "sideEffects": false,