@oddin-gg/havik-player 2.8.0 → 2.9.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/docs/API.md CHANGED
@@ -948,15 +948,16 @@ api-key. Otherwise (dev/demo) config comes from the query string. The postMessag
948
948
  **fails closed**: with no `parentOrigin`, the embed neither accepts commands nor posts
949
949
  events.
950
950
 
951
- | Field | Type | Default | Description |
952
- | -------------- | ----------------------------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
953
- | `baseUrl` | `string` | — | **Required.** API base URL. |
954
- | `matchUrn` | `string` | — | **Required.** Match to play. |
955
- | `apiKey` | `string` | — | **Required.** Inject server‑side in production; query param is dev‑only. |
956
- | `parentOrigin` | `string` | — | Origin to post events to and accept commands from. **Set this in production** (`mountEmbed` sets it automatically). When absent, the iframe posts to `*` and skips the inbound origin check. |
957
- | `autoplay` | `boolean` | `true` | Start playback once ready. |
958
- | `muted` | `boolean` | `true` | Start muted (recommended for autoplay). |
959
- | `waitForLive` | [`WaitForLive`](#waitforlive) | `true` | Arm and auto‑play at go‑live. |
951
+ | Field | Type | Default | Description |
952
+ | -------------- | ---------------------------------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
953
+ | `baseUrl` | `string` | — | **Required.** API base URL. |
954
+ | `matchUrn` | `string` | — | **Required.** Match to play. |
955
+ | `apiKey` | `string` | — | **Required.** Inject server‑side in production; query param is dev‑only. |
956
+ | `parentOrigin` | `string` | — | Origin to post events to and accept commands from. **Set this in production** (`mountEmbed` sets it automatically). When absent, the iframe posts to `*` and skips the inbound origin check. |
957
+ | `autoplay` | `boolean` | `true` | Start playback once ready. |
958
+ | `muted` | `boolean` | `true` | Start muted (recommended for autoplay). |
959
+ | `waitForLive` | [`WaitForLive`](#waitforlive) | `true` | Arm and auto‑play at go‑live. |
960
+ | `analytics` | `boolean \| { endpoint?: string }` | `true` | QoE beacons, forwarded verbatim to [`createPlayer`](#createplayer). **Injected config only** — never read from the query string, so a link cannot redirect a session's beacons. Set `{ endpoint }` when `baseUrl` is not a `feed[-dev].<domain>` host, since nothing can be derived and analytics is otherwise off. ⚠️ [`mountEmbed`](#mountembed) configures the page via query string, so it cannot carry this: a `mountEmbed` integration on a non-feed `baseUrl` has no way to enable beacons and must self-host the embed page instead. |
960
961
 
961
962
  <a id="frametohost"></a>
962
963
  <a id="hosttoframe"></a>
package/embed/index.html CHANGED
@@ -22,8 +22,13 @@
22
22
  2) INJECT config server-side as window.HAVIK_EMBED_CONFIG (baseUrl, matchUrn,
23
23
  apiKey, parentOrigin). When injected, the URL query string is IGNORED for
24
24
  security; the api-key must NOT travel in the query in production.
25
+ 3) If baseUrl is NOT a feed[-dev].<domain> host (your own CDN or gateway
26
+ fronts the streams API), also inject
27
+ analytics: { endpoint: 'https://beacons[-dev].<domain>' } — otherwise no
28
+ beacons endpoint can be derived and QoE analytics is silently off.
29
+ `analytics` is honoured from the injected config only, never the query.
25
30
  -->
26
- <script src="https://cdn.jsdelivr.net/npm/@oddin-gg/havik-player@2.8.0/dist/havik-player.global.js" integrity="sha384-3wwFxlZvuLLFtcjEtRI9dqqHXLOgurt0RsZ6ifTHhyiC0LMJnbijjgvp9dJTbDiW" crossorigin="anonymous"></script>
31
+ <script src="https://cdn.jsdelivr.net/npm/@oddin-gg/havik-player@2.9.0/dist/havik-player.global.js" integrity="sha384-5V0pran43W6WqIOavxGbPUnt6qcuOrXuS2bH0nm/Wv0KIyP2aZFr8ecmpvsDQU9j" crossorigin="anonymous"></script>
27
32
  <script>
28
33
  HavikPlayer.bootEmbed();
29
34
  </script>
@@ -12,7 +12,7 @@
12
12
  shipped in each npm release is pinned to that release with Subresource
13
13
  Integrity, injected at publish time (scripts/inject-sri.mjs). In
14
14
  production, always use a pinned + SRI'd tag like the released copy. -->
15
- <script src="https://cdn.jsdelivr.net/npm/@oddin-gg/havik-player@2.8.0/dist/havik-player.global.js" integrity="sha384-3wwFxlZvuLLFtcjEtRI9dqqHXLOgurt0RsZ6ifTHhyiC0LMJnbijjgvp9dJTbDiW" crossorigin="anonymous"></script>
15
+ <script src="https://cdn.jsdelivr.net/npm/@oddin-gg/havik-player@2.9.0/dist/havik-player.global.js" integrity="sha384-5V0pran43W6WqIOavxGbPUnt6qcuOrXuS2bH0nm/Wv0KIyP2aZFr8ecmpvsDQU9j" crossorigin="anonymous"></script>
16
16
  <script>
17
17
  (async () => {
18
18
  const player = await HavikPlayer.createPlayer({
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@oddin-gg/havik-player",
3
- "version": "2.8.0",
3
+ "version": "2.9.0",
4
4
  "description": "Havik HTML5 player SDK — LL-HLS + DRM playback for Oddin live streams (managed, bring-your-own-player, and iframe-embed modes).",
5
5
  "type": "module",
6
6
  "sideEffects": false,