eb-player 2.0.21 → 2.1.0

package/dist/build/ebplayer.bundle.js

@@ -4,7 +4,7 @@
     (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.EBPlayer = {}));
 })(this, (function (exports) { 'use strict';
 
-    var __EB_PLAYER_VERSION__ = "2.0.21";
+    var __EB_PLAYER_VERSION__ = "2.1.0";
 
     /**
      * Finite State Machine for player playback state transitions.
@@ -3992,7 +3992,15 @@
             // sequential-await interaction: fixing G-07-9 alone would otherwise
             // install this listener only after the intro, behind the very click
             // that started it).
-            const gesturePromise = config.autoplay ? null : this.waitForUserGesture(video, signal);
+            //
+            // WR-01: wired to localController.signal, not the outer signal. The outer
+            // abort already propagates into localController (above), so this still
+            // covers player disposal — but it additionally lets completeAdLeg() settle
+            // a still-pending gesture wait. Without it, an ad leg completed by the
+            // watchdog, an AD_ERROR or ALL_ADS_COMPLETED before any click leaves this
+            // promise unsettled forever: init() never resolves and the capture-phase
+            // click listener stays attached to .eb-player.
+            const gesturePromise = config.autoplay ? null : this.waitForUserGesture(video, localController.signal);
             // G-07-9: the decision is derived from configuration, not from the
             // PlayerState intro-playing flag. An async function body runs
             // synchronously up to its first await, so reading that flag here would
@@ -5747,6 +5755,153 @@
         };
     }
 
+    /**
+     * Segment (fragment) CDN token signing — shared primitive.
+     *
+     * Extends CDN token signing from manifests to segments, behind an opt-in flag
+     * (`EngineSettings.signSegmentsWithCdnToken`). Each segment is signed with the
+     * grant carried by its OWN parent playlist — read from `context.frag.baseurl`,
+     * the object hls.js itself parsed that fragment from — never from any store,
+     * cache, or shared manager state. This makes cross-rendition mis-signing
+     * structurally impossible rather than merely unlikely.
+     *
+     * CRITICAL: this module must never acquire or refresh a token. It only reads
+     * data already present on the fragment context handed to it by hls.js. Any
+     * acquisition call here would reintroduce the single-slot cache reuse in
+     * `CDNTokenManager.lastTokenResponse`, which hands one rendition's grant to
+     * another — the exact failure this design forbids.
+     *
+     * Token expiry model (CDN-04, D-07): a segment carries whatever grant its
+     * parent playlist carried when hls.js parsed it. Live playlists reload on
+     * their own cadence, so their fragments pick up refreshed grants with no
+     * refresh machinery here — reload IS the refresh path. VOD playlists are
+     * parsed exactly once by hls.js 1.6.10 (its level controller only
+     * (re)requests a playlist it has none of, or one that is live), so a VOD
+     * asset's segment grants are frozen at first parse for the asset's entire
+     * duration. If a token's lifetime is shorter than the asset's duration, later
+     * segments will be rejected by the edge and surface through the existing
+     * error/retry path. This is an accepted operational constraint — the token
+     * service's lifetime must exceed the longest VOD asset — not an oversight;
+     * D-07 chose reload-cadence refresh and CONTEXT.md defers a proactive
+     * near-expiry refresh path with a named revisit condition (a real asset shown
+     * to outlive its grant). No timer, interval, or scheduled re-fetch belongs in
+     * this module.
+     */
+    // ---------------------------------------------------------------------------
+    // Supported token-type family (D-03) — query-param tokens only. Akamai's
+    // path-segment mechanic (`appendAkamaiTokenParams`) is a different shape and
+    // deliberately not extended here.
+    // ---------------------------------------------------------------------------
+    const SEGMENT_SIGNING_TOKEN_TYPES = Object.freeze([
+        TOKEN_TYPES.EASY_B,
+        TOKEN_TYPES.VENOM,
+        TOKEN_TYPES.BUNNY
+    ]);
+    /**
+     * Builds the single diagnostic string used for every unsupported-token-type
+     * case. Names the flag and the offending token type (or says none is
+     * configured) and lists the supported ones. Never includes a token value.
+     */
+    function segmentSigningUnsupportedMessage(tokenType) {
+        const supported = SEGMENT_SIGNING_TOKEN_TYPES.join(', ');
+        const described = tokenType === undefined ? 'no token type configured' : `token type "${tokenType}"`;
+        return `signSegmentsWithCdnToken: segment signing is not supported for ${described}. Supported token types: ${supported}.`;
+    }
+    /**
+     * A fresh, all-zero `LoaderStats`-shaped object for the fail-loud path's
+     * `onError` call. hls.js's own error-handling code reads fields off this
+     * object (e.g. `stats.loaded`); passing `undefined` risks a `TypeError`
+     * inside hls.js itself instead of the clean error this module intends to
+     * produce. Returns a new object per call — never shared/mutated state — so
+     * nothing downstream can observe stale values from a previous failed load.
+     */
+    function createEmptySegmentLoaderStats() {
+        return {
+            aborted: false,
+            loaded: 0,
+            total: 0,
+            retry: 0,
+            chunkCount: 0,
+            bwEstimate: 0,
+            loading: { start: 0, first: 0, end: 0 },
+            parsing: { start: 0, end: 0 },
+            buffering: { start: 0, first: 0, end: 0 }
+        };
+    }
+    /**
+     * Pure transfer: reads `token`, `expires` and `token_path` off the parent
+     * playlist URL's query string and reapplies them to the segment URL via the
+     * same static primitive that signs manifests, so a signed segment URL is
+     * shaped exactly like a signed manifest URL. Returns the segment URL
+     * unchanged when the playlist carries no token, or when either URL cannot be
+     * parsed (a thrown exception inside a loader is a dead player, not a signing
+     * failure).
+     */
+    function signSegmentUrlFromPlaylist(segmentUrl, parentPlaylistUrl) {
+        try {
+            const playlistUrl = new URL(parentPlaylistUrl);
+            const token = playlistUrl.searchParams.get('token');
+            if (!token)
+                return segmentUrl;
+            const expires = playlistUrl.searchParams.get('expires');
+            const tokenPath = playlistUrl.searchParams.get('token_path');
+            return CDNTokenManager.appendTokenParams(segmentUrl, token, expires, tokenPath);
+        }
+        catch {
+            return segmentUrl;
+        }
+    }
+    /**
+     * Returns a loader class extending `BaseLoader`, built exactly like the
+     * existing playlist loader: call `super()`, bind the inherited `load`, then
+     * assign an own `load` property that reads `context.frag?.baseurl`.
+     *
+     * `tokenSource` is captured by closure — never stored on `this` and never
+     * used to acquire or refresh a token.
+     */
+    function createSegmentTokenLoaderClass(BaseLoader, tokenSource) {
+        // WR-02: the "unsupported token type" diagnostic is logged to the console
+        // at most once per loader CLASS — i.e. once per engine session that calls
+        // createSegmentTokenLoaderClass, since hls.js constructs a fresh loader
+        // instance per fragment load and an instance-level flag would reset every
+        // load. `callbacks.onError` still fires on every load below, unguarded —
+        // hls.js needs the error signal each time to drive its own retry/fatal
+        // escalation; only the console spam is deduplicated.
+        let unsupportedTokenTypeLogged = false;
+        class SegmentTokenLoader extends BaseLoader {
+            constructor(loaderConfig) {
+                super(loaderConfig);
+                const originalLoad = this.load.bind(this);
+                this.load = function (context, loadConfig, callbacks) {
+                    // D-03/D-04: a token type outside the query-param family (akamai, or
+                    // none configured) must fail visibly rather than emit an unsigned
+                    // request. A silent passthrough here is the same undiagnosable 403
+                    // from the edge that D-04 forbids, so it gets the same treatment as
+                    // the akamai case: no delegation to the base loader, and a named
+                    // error surfaced through hls.js's own error callback.
+                    const tokenType = tokenSource.tokenType;
+                    if (!tokenType || !SEGMENT_SIGNING_TOKEN_TYPES.includes(tokenType)) {
+                        const message = segmentSigningUnsupportedMessage(tokenType);
+                        if (!unsupportedTokenTypeLogged) {
+                            unsupportedTokenTypeLogged = true;
+                            console.error(message);
+                        }
+                        callbacks.onError({ code: 0, text: message }, context, null, createEmptySegmentLoaderStats());
+                        return;
+                    }
+                    const baseUrl = context.frag?.baseurl;
+                    if (!baseUrl || !context.url) {
+                        originalLoad(context, loadConfig, callbacks);
+                        return;
+                    }
+                    context.url = signSegmentUrlFromPlaylist(context.url, baseUrl);
+                    originalLoad(context, loadConfig, callbacks);
+                };
+            }
+        }
+        return SegmentTokenLoader;
+    }
+
     /**
      * HlsEngine — HLS playback engine.
      *
@@ -5930,6 +6085,7 @@
             const hlsSafeSettings = { ...hlsEngineSettings };
             delete hlsSafeSettings['extraParamsCallback'];
             delete hlsSafeSettings['onCDNTokenError'];
+            delete hlsSafeSettings['signSegmentsWithCdnToken'];
             const driverConfig = {
                 autoStartLoad: !config.startAt,
                 enableWorker: true,
@@ -5973,6 +6129,12 @@
                     }
                 }
                 driverConfig.pLoader = PLoader;
+                // Opt-in (D-06): sign segment requests with the grant carried by their
+                // own parent playlist. Off by default so segment request shapes stay
+                // byte-identical to today's when the flag is unset.
+                if (config.engineSettings.signSegmentsWithCdnToken === true) {
+                    driverConfig.fLoader = createSegmentTokenLoaderClass(Hls.DefaultConfig.loader, tm);
+                }
             }
             // Inject custom ABR controller unless disabled
             if (!config.disableCustomAbr) {
@@ -6426,7 +6588,12 @@
      * Ported from component/engines/dash.js
      *
      * Extends BaseEngine to bridge dash.js MediaPlayer events to PlayerState.
-     * Uses CDN loader, CDNTokenManager, StallWatchdog, and DASH retry settings.
+     * Uses the CDN loader and StallWatchdog, plus DASH retry settings and ABR rules.
+     *
+     * CDN token signing (manifests and segments alike) is HLS-only by design —
+     * this engine has no `CDNTokenManager` integration at all (Phase 08.1 / D-05).
+     * DASH segments are `.m4s`, so nothing written for HLS's fragment-loader
+     * token signing should be assumed to generalise here.
      *
      * CRITICAL: driver instance is a private class field — NEVER stored in PlayerState.
      */
@@ -6867,18 +7034,30 @@
                 }
                 PLoader = SnapshotPLoader;
             }
+            // Build fLoader class with segment CDN token signing — opt-in (D-06), off by
+            // default so segment request shapes stay byte-identical to today's when the
+            // flag is unset. Reuses the shared factory built for the main engine's
+            // fragment loader (`segment-token-loader.ts`) rather than re-implementing the
+            // signing logic here. tokenManager is the same closure-captured reference
+            // used above for pLoader (Pitfall 6) — never read off `this`.
+            let FLoader;
+            if (tokenManager && this.config.engineSettings?.signSegmentsWithCdnToken === true) {
+                FLoader = createSegmentTokenLoaderClass(HlsConstructor.DefaultConfig.loader, tokenManager);
+            }
             // Strip player-specific keys that are NOT hls.js config options — they contain
             // non-serializable functions that cause DataCloneError when hls.js posts config to its worker.
             const rawSettings = { ...(this.config.engineSettings ?? {}) };
             delete rawSettings['extraParamsCallback'];
             delete rawSettings['onCDNTokenError'];
+            delete rawSettings['signSegmentsWithCdnToken'];
             const driverConfig = {
                 startLevel: 0,
                 enableWebVTT: false,
                 enableWorker: false,
                 maxBufferLength: 1,
                 ...rawSettings,
-                ...(PLoader ? { pLoader: PLoader } : {})
+                ...(PLoader ? { pLoader: PLoader } : {}),
+                ...(FLoader ? { fLoader: FLoader } : {})
             };
             const driver = new HlsConstructor(driverConfig);
             this.driver = driver;