eb-player 2.1.1 → 2.1.3

package/dist/build/ebplayer.bundle.js

@@ -4,7 +4,7 @@
     (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.EBPlayer = {}));
 })(this, (function (exports) { 'use strict';
 
-    var __EB_PLAYER_VERSION__ = "2.1.1";
+    var __EB_PLAYER_VERSION__ = "2.1.3";
 
     /**
      * Finite State Machine for player playback state transitions.
@@ -5119,6 +5119,7 @@
             this.retryInterval = retryInterval;
             this.expirationMarginInSeconds = expirationMarginInSeconds;
             this.lastTokenResponse = null;
+            this.sourceUrl = null;
             this.resetAttemptCounterTimeout = null;
             this.inFlightFetch = null;
         }
@@ -5437,8 +5438,17 @@
                     }
                     break;
             }
+            // Query-param tokens (easy_b/venom/bunny) carry a prefix-scoped `token_path`
+            // and share one grant across manifests and segments, so the grant must be
+            // minted against the asset-level source URL rather than whichever URL
+            // triggered this refresh. Akamai's path-segment mechanic is scoped
+            // differently and is deliberately left on the requested URL.
+            const sharesPrefixScopedGrant = this.tokenType === TOKEN_TYPES.EASY_B
+                || this.tokenType === TOKEN_TYPES.VENOM
+                || this.tokenType === TOKEN_TYPES.BUNNY;
+            const fetchSrc = (sharesPrefixScopedGrant && this.sourceUrl) ? this.sourceUrl : srcUrl.toString();
             try {
-                const tokenResponse = await this.fetchToken({ src: srcUrl.toString() });
+                const tokenResponse = await this.fetchToken({ src: fetchSrc });
                 if (tokenResponse === null) {
                     return url;
                 }
@@ -5759,33 +5769,39 @@
      * Segment (fragment) CDN token signing — shared primitive.
      *
      * Extends CDN token signing from manifests to segments, behind an opt-in flag
-     * (`EngineSettings.signSegmentsWithCdnToken`). Each segment is signed with the
-     * grant carried by its OWN parent playlist — read from `context.frag.baseurl`,
-     * the object hls.js itself parsed that fragment from — never from any store,
-     * cache, or shared manager state. This makes cross-rendition mis-signing
-     * structurally impossible rather than merely unlikely.
-     *
-     * CRITICAL: this module must never acquire or refresh a token. It only reads
-     * data already present on the fragment context handed to it by hls.js. Any
-     * acquisition call here would reintroduce the single-slot cache reuse in
-     * `CDNTokenManager.lastTokenResponse`, which hands one rendition's grant to
-     * another — the exact failure this design forbids.
-     *
-     * Token expiry model (CDN-04, D-07): a segment carries whatever grant its
-     * parent playlist carried when hls.js parsed it. Live playlists reload on
-     * their own cadence, so their fragments pick up refreshed grants with no
-     * refresh machinery here — reload IS the refresh path. VOD playlists are
-     * parsed exactly once by hls.js 1.6.10 (its level controller only
-     * (re)requests a playlist it has none of, or one that is live), so a VOD
-     * asset's segment grants are frozen at first parse for the asset's entire
-     * duration. If a token's lifetime is shorter than the asset's duration, later
-     * segments will be rejected by the edge and surface through the existing
-     * error/retry path. This is an accepted operational constraint — the token
-     * service's lifetime must exceed the longest VOD asset — not an oversight;
-     * D-07 chose reload-cadence refresh and CONTEXT.md defers a proactive
-     * near-expiry refresh path with a named revisit condition (a real asset shown
-     * to outlive its grant). No timer, interval, or scheduled re-fetch belongs in
-     * this module.
+     * (`EngineSettings.signSegmentsWithCdnToken`). The fast path signs each segment
+     * with the grant carried by its OWN parent playlist — read from
+     * `context.frag.baseurl`, the object hls.js itself parsed that fragment from.
+     *
+     * Token expiry model (CDN-04, D-07, revised):
+     *
+     * `frag.baseurl` is a string frozen at the moment hls.js parsed the level
+     * playlist. Live playlists reload on their own cadence, so their fragments pick
+     * up refreshed grants for free — reload IS the refresh path. VOD playlists are
+     * parsed exactly once by hls.js 1.6.10 (its level controller only (re)requests a
+     * playlist it has none of, or one that is live), so for VOD that string never
+     * changes. Pure transfer alone therefore pins a VOD asset's segments to the
+     * first grant for the asset's entire duration, and every segment 403s once that
+     * grant lapses — the condition CONTEXT.md named as D-07's revisit trigger, since
+     * observed in production (a ~294s grant against a ~26min asset).
+     *
+     * So when the inherited grant is inside the manager's expiry margin, this module
+     * now defers to the shared grant via `updateUrlWithTokenParams` rather than
+     * copying a dead string.
+     *
+     * Why sharing a grant across renditions is safe (supersedes this module's
+     * previous prohibition): the token service derives `token_path` from the
+     * directory of the URL it signs, and `token_path` is a PREFIX scope. An
+     * asset-level grant returns 200 on every rendition beneath it — verified live
+     * across all four renditions of a real asset. The hazard this module previously
+     * guarded against — one rendition's grant handed to another — is real ONLY for a
+     * rendition-scoped grant, and that is prevented at its source by
+     * `CDNTokenManager.sourceUrl`, which pins acquisition of the shared grant to the
+     * asset-level source URL. The invariant is therefore "the shared grant must be
+     * asset-level", not "segments must never refresh".
+     *
+     * Still true: no timer, interval, or scheduled re-fetch belongs in this module.
+     * Refresh here is demand-driven, on the load that needs it.
      */
     // ---------------------------------------------------------------------------
     // Supported token-type family (D-03) — query-param tokens only. Akamai's
@@ -5851,6 +5867,23 @@
             return segmentUrl;
         }
     }
+    /**
+     * Reads the `expires` value off a parent playlist URL, or null when the URL
+     * carries no token at all or cannot be parsed. Used to decide between the pure
+     * transfer fast path and a shared-grant refresh.
+     */
+    function readPlaylistGrantExpiry(parentPlaylistUrl) {
+        try {
+            const playlistUrl = new URL(parentPlaylistUrl);
+            const token = playlistUrl.searchParams.get('token');
+            if (!token)
+                return { hasToken: false, expires: null };
+            return { hasToken: true, expires: playlistUrl.searchParams.get('expires') };
+        }
+        catch {
+            return { hasToken: false, expires: null };
+        }
+    }
     /**
      * Returns a loader constructor extending `BaseLoader`: construct the base,
      * bind the inherited `load`, then assign an own `load` property that reads
@@ -5905,8 +5938,36 @@
                     originalLoad(context, loadConfig, callbacks);
                     return;
                 }
-                context.url = signSegmentUrlFromPlaylist(context.url, baseUrl);
-                originalLoad(context, loadConfig, callbacks);
+                const { hasToken, expires } = readPlaylistGrantExpiry(baseUrl);
+                // Parent playlist carried no grant: nothing to transfer, and nothing to
+                // refresh — an unsigned playlist means this path is not token-protected.
+                if (!hasToken) {
+                    originalLoad(context, loadConfig, callbacks);
+                    return;
+                }
+                // Fast path: the inherited grant is still good. Pure synchronous transfer,
+                // no manager involvement, no network.
+                if (!tokenSource.isTokenExpired(expires)) {
+                    context.url = signSegmentUrlFromPlaylist(context.url, baseUrl);
+                    originalLoad(context, loadConfig, callbacks);
+                    return;
+                }
+                // Inherited grant is expired or inside the expiry margin. For VOD this is
+                // terminal — hls.js will never re-parse the playlist, so the frozen
+                // baseurl can never recover on its own. Defer to the shared asset-level
+                // grant, which `CDNTokenManager.sourceUrl` keeps broad enough to cover
+                // this segment.
+                tokenSource.updateUrlWithTokenParams({ url: context.url })
+                    .then((updatedUrl) => {
+                    context.url = updatedUrl;
+                    originalLoad(context, loadConfig, callbacks);
+                })
+                    .catch(() => {
+                    // Token error: fall back to the inherited grant rather than emitting an
+                    // unsigned request, and let the edge's 403 drive hls.js's own retry.
+                    context.url = signSegmentUrlFromPlaylist(context.url, baseUrl);
+                    originalLoad(context, loadConfig, callbacks);
+                });
             };
         }
         function SegmentTokenLoader(loaderConfig) {
@@ -5937,6 +5998,17 @@
      * CRITICAL: Call applyDiscontinuityWorkaround BEFORE driver.attachMedia/loadSource (Pitfall 4).
      * CRITICAL: Never call driver.startLoad() from video 'play' event handler (Pitfall 3).
      */
+    /**
+     * Bound for the "load never started" watchdog: hls.js's own manifest-loading
+     * budget (default manifestLoadingTimeOut 10 000 ms with one retry plus
+     * backoff) tops out around 21s before hls.js surfaces its own fatal network
+     * error, so 30s guarantees hls.js's own error path always wins first and
+     * this watchdog only ever sees the case hls.js is silent about — a
+     * StreamController parked in STOPPED with no error and no event. 30s also
+     * matches the existing MAIN_OPEN_FALLBACK_MS precedent in src/eb-player.ts
+     * and sits well below INTRO_MAX_DURATION_MS (90 000).
+     */
+    const LOAD_NEVER_STARTED_TIMEOUT_MS = 30000;
     // ---------------------------------------------------------------------------
     // HlsEngine
     // ---------------------------------------------------------------------------
@@ -5949,6 +6021,9 @@
             this.autoQuality = true;
             // Holds state reference for named driver event handlers
             this.eventState = null;
+            // Bound "load never started" watchdog timer — 0-initialized (not null) so
+            // clearTimeout(0) is a no-op, eliminating a null-guard phantom V8 branch.
+            this.loadNeverStartedTimer = 0;
             this.liveSyncDisabled = false;
         }
         getDriver() {
@@ -5982,6 +6057,7 @@
         }
         onDetach() {
             this.stopWatchdog();
+            this.clearLoadNeverStartedWatchdog();
             if (this.driver !== null) {
                 try {
                     this.driver.detachMedia();
@@ -6108,8 +6184,17 @@
             delete hlsSafeSettings['extraParamsCallback'];
             delete hlsSafeSettings['onCDNTokenError'];
             delete hlsSafeSettings['signSegmentsWithCdnToken'];
+            // Do NOT set an explicit auto-start disable here. hls.js starts loading
+            // segments on its own by default, and the resume position is already
+            // carried by startPosition below — hls.js honours it without any help.
+            // Nothing on the VOD path would ever restart a stopped loader: the only
+            // two startLoad() call sites in this file are recoverFromStall() (only
+            // reachable after playback has started) and the video 'play' listener
+            // (gated on state.isLive, so VOD never reaches it). Disabling auto-start
+            // here parks the StreamController in STOPPED forever for any non-zero
+            // resume position — no variant playlist, no segments, no error, no bus
+            // event, spinner forever.
             const driverConfig = {
-                autoStartLoad: !config.startAt,
                 enableWorker: true,
                 backBufferLength: 30,
                 ...hlsSafeSettings,
@@ -6191,6 +6276,11 @@
             this.driver = driver;
             // Pitfall 4: apply discontinuity workaround BEFORE attachMedia/loadSource
             applyDiscontinuityWorkaround(driver, Hls.Events);
+            // Hoisted once, used both for the retry wiring below and for gating the
+            // "load never started" watchdog — the intro pass already has its own
+            // bounds (INTRO_MAX_DURATION_MS, D-04 silent fall-through) and a second
+            // overlapping bound would only race them.
+            const isIntroPass = Boolean(config.preroll) && this.loadSourceUrl === config.preroll;
             // Wire retry handler — pass engine context so unrecoverable DRM errors
             // stop the stall watchdog (prevents useless reload loops) and surface to UI.
             // For the intro pass (loadSourceUrl matches config.preroll), also wire
@@ -6199,7 +6289,6 @@
             // This callback is intentionally NOT set for the main stream so transient
             // network blips still trigger the normal startLoad() recovery.
             if (config.retry) {
-                const isIntroPass = Boolean(config.preroll) && this.loadSourceUrl === config.preroll;
                 handleHlsRetry(driver, {
                     get chromecast_casting() { return state.isCasting; },
                     onUnrecoverableError: (message) => {
@@ -6251,6 +6340,11 @@
             // stream URL is loaded rather than config.src which always points at the main stream.
             let src = this.loadSourceUrl || config.src || '';
             if (this.tokenManager && src) {
+                // Pin shared-grant acquisition to the asset-level source URL before the
+                // first fetch. The token service scopes `token_path` to the directory of
+                // the URL it signs, so a grant minted against a level playlist (as an ABR
+                // switch would trigger) is rendition-scoped and 403s on every sibling.
+                this.tokenManager.sourceUrl = src;
                 src = await this.tokenManager.updateUrlWithTokenParams({ url: src });
                 // Guard: abort if detached during token URL update
                 if (this.detached) {
@@ -6266,6 +6360,8 @@
             this.resolveDriverReady();
             // Register driver event handlers
             this.registerDriverEvents(Hls, state);
+            // Arm the "load never started" watchdog — see LOAD_NEVER_STARTED_TIMEOUT_MS.
+            this.armLoadNeverStartedWatchdog(driver, Hls, src, isIntroPass);
             // Pause/resume loading on video pause/play to stop manifest refreshes
             // (and thus CDN token requests) while the player is paused.
             // Only applies to live streams where hls.js continuously refreshes the manifest.
@@ -6334,6 +6430,43 @@
             driver.on(Events.SUBTITLE_TRACKS_UPDATED, this._onSubtitleTracksUpdated.bind(this));
             driver.on(Events.SUBTITLE_TRACK_SWITCH, this._onSubtitleTrackSwitch.bind(this));
         }
+        // -------------------------------------------------------------------------
+        // "Load never started" watchdog
+        // -------------------------------------------------------------------------
+        /**
+         * Arms a one-shot bound that turns an unobservable hang into `state.error`
+         * + a typed bus event: hls.js emits neither when its StreamController
+         * never leaves STOPPED. Disarmed by the first FRAG_LOADING (proof that a
+         * fragment request was actually issued, whether or not playback was
+         * allowed to start — so autoplay-blocked playback never false-positives).
+         * Never armed for the intro pass — it already has its own bounds.
+         */
+        armLoadNeverStartedWatchdog(driver, Hls, src, isIntroPass) {
+            if (isIntroPass)
+                return;
+            driver.on(Hls.Events.FRAG_LOADING, this._onFragLoading.bind(this));
+            this.loadNeverStartedTimer = setTimeout(this._onLoadNeverStartedTimeout.bind(this, src), LOAD_NEVER_STARTED_TIMEOUT_MS);
+        }
+        clearLoadNeverStartedWatchdog() {
+            clearTimeout(this.loadNeverStartedTimer);
+            this.loadNeverStartedTimer = 0;
+        }
+        _onFragLoading() {
+            this.clearLoadNeverStartedWatchdog();
+        }
+        _onLoadNeverStartedTimeout(src) {
+            if (this.detached)
+                return;
+            // Two-signal live gate (mirrors _onLevelLoaded): a stream that never
+            // loaded a level detail never got its isLive set from the driver, so
+            // the config-level signal must also be checked.
+            if (this.state?.isLive === true || this.config?.isLive === true)
+                return;
+            if (this.state) {
+                this.state.error = 'HlsEngine: load never started — no fragment request was issued within the bound';
+            }
+            this.bus?.emit('load-never-started', { src });
+        }
         _onManifestLoaded(_event, data) {
             const state = this.eventState;
             const driver = this.driver;
@@ -7438,6 +7571,7 @@
         // skin-root.ts:141/318 and is a no-op for runtime mute.
         const originalMuted = mergedConfig.muted ?? false;
         const originalManager = mergedConfig.manager;
+        const originalStartAt = mergedConfig.startAt;
         const controller = new PlayerController(runtimeConfig);
         controller.mount(container);
         // Video element is available after mount() creates the skin DOM
@@ -7663,6 +7797,10 @@
             // during the intro pass. Synchronize both objects on every swap.
             mergedConfig.manager = originalManager;
             controller.config.manager = originalManager;
+            // Restore the viewer's resume position for the main asset — see the
+            // rationale comment at the intro-side swap below (CR-05 sync applies here too).
+            mergedConfig.startAt = originalStartAt;
+            controller.config.startAt = originalStartAt;
             // CR-03: clear any stale error that leaked from the intro/ad pass.
             // IntroStreamManager's silent fall-through (D-04) treats error-fatal as a
             // normal completion but leaves state.error populated with the intro
@@ -7811,6 +7949,13 @@
             // CR-05: keep the dual-merged configs in sync (see openMainStream).
             mergedConfig.manager = false;
             controller.config.manager = false;
+            // A viewer resume position belongs to the main asset only — applying it
+            // to a short intro clip seeks past the whole clip. This defect survives
+            // the startAt/autoStartLoad fix: after that fix, startPosition: 300 is
+            // still applied to the intro, which is still wrong, just differently
+            // wrong. Cleared here and restored in openMainStream() (CR-05 sync).
+            mergedConfig.startAt = undefined;
+            controller.config.startAt = undefined;
             reference.open(mergedConfig.preroll);
         }
         // D-02/D-08-02 (Phase 8): ad-only configuration — no intro stream, so this