eb-player 2.1.2 → 2.1.4

package/dist/build/ebplayer.bundle.js

@@ -4,7 +4,7 @@
     (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.EBPlayer = {}));
 })(this, (function (exports) { 'use strict';
 
-    var __EB_PLAYER_VERSION__ = "2.1.2";
+    var __EB_PLAYER_VERSION__ = "2.1.4";
 
     /**
      * Finite State Machine for player playback state transitions.
@@ -4397,8 +4397,9 @@
      * Mount order:
      *   1. CSS vars / data-theme applied to container
      *   2. Config-derived state (isRtl, isRadio) set
-     *   3. SkinRoot connected (needs DOM) — creates video element and ads container
-     *   4. AutoHideController + KeyboardController wired
+     *   3. SkinRoot connected (needs DOM) — creates the video element on every
+     *      mount, including noUi; the ads container is only rendered in UI mode
+     *   4. AutoHideController + KeyboardController wired (UI mode only)
      *   5. Integrations initialized (need skin DOM for ads)
      *
      * Dispose order (reverse of mount):
@@ -4483,21 +4484,32 @@
             // Set config-derived state flags
             this.state.isRtl = this.config.lang === 'ar';
             this.state.isRadio = this.config.radio === true;
-            // Step 3: Create SkinRoot (unless noUi mode)
+            // Step 3: Create SkinRoot. This runs on EVERY mount, including noUi —
+            // SkinRoot is the only creator of the <video> element, and its own
+            // template() already branches to a headless template that renders just
+            // the bare element (see renderNoUiTemplate() in skin-root.ts). This block
+            // used to be gated on `!this.config.noUi`, which left that headless
+            // branch unreachable from the real player: a noUi mount produced an
+            // empty container, no <video> was ever handed to the engine, and
+            // therefore start() issued no CDN token, no manifest and no segment
+            // request at all.
+            const skinRoot = new SkinRoot();
+            this.skinRoot = skinRoot;
+            skinRoot.connect(container, this.state, this.bus, this.config, this.i18n);
+            // Sync initial muted/volume from the actual video element so UI matches
+            // reality. The volumechange event only fires on *changes*, not on initial
+            // attribute values set during element creation. The browser is the source
+            // of truth — it may override the muted attribute based on autoplay policy.
+            const videoEl = skinRoot.getVideoElement();
+            if (videoEl !== null) {
+                this.state.muted = videoEl.muted;
+                this.state.volume = videoEl.volume;
+            }
+            // Step 4: Wire activity and keyboard controllers — chrome-only, so they
+            // stay gated on noUi (D-03). AutoHide drives visibility for controls that
+            // don't exist headlessly; Keyboard would claim page-level key handling
+            // that a headless integrator expects to own itself.
             if (!this.config.noUi) {
-                const skinRoot = new SkinRoot();
-                this.skinRoot = skinRoot;
-                skinRoot.connect(container, this.state, this.bus, this.config, this.i18n);
-                // Sync initial muted/volume from the actual video element so UI matches
-                // reality. The volumechange event only fires on *changes*, not on initial
-                // attribute values set during element creation. The browser is the source
-                // of truth — it may override the muted attribute based on autoplay policy.
-                const videoEl = skinRoot.getVideoElement();
-                if (videoEl !== null) {
-                    this.state.muted = videoEl.muted;
-                    this.state.volume = videoEl.volume;
-                }
-                // Step 4: Wire activity and keyboard controllers
                 new AutoHideController(container, this.state, this.signal);
                 new KeyboardController(container, this.state, this.bus, this.config, this.signal);
             }
@@ -4592,12 +4604,16 @@
                 const playlistManager = new PlaylistManager();
                 playlistManager.init(config, state, bus, signal);
             }
-            // AdsManager: skip when config.ad is undefined (D-09)
+            // AdsManager: skip when config.ad is undefined (D-09), or when no ads
+            // container exists — the headless template (D-04) renders none, so a
+            // noUi mount must not construct AdsManager at all, not merely skip
+            // init(). Constructing it unconditionally on skinRoot !== null would
+            // regress now that SkinRoot is created in noUi mode too (D-01).
             if (config.ad && this.skinRoot !== null) {
-                const adsManager = new AdsManager();
                 const video = this.skinRoot.getVideoElement();
                 const adsContainer = this.skinRoot.getAdsContainer();
                 if (video !== null && adsContainer !== null) {
+                    const adsManager = new AdsManager();
                     adsManager.init(config, state, bus, video, adsContainer, signal).catch((error) => {
                         console.error('EBPlayer: AdsManager init failed:', error);
                     });
@@ -5119,6 +5135,7 @@
             this.retryInterval = retryInterval;
             this.expirationMarginInSeconds = expirationMarginInSeconds;
             this.lastTokenResponse = null;
+            this.sourceUrl = null;
             this.resetAttemptCounterTimeout = null;
             this.inFlightFetch = null;
         }
@@ -5437,8 +5454,17 @@
                     }
                     break;
             }
+            // Query-param tokens (easy_b/venom/bunny) carry a prefix-scoped `token_path`
+            // and share one grant across manifests and segments, so the grant must be
+            // minted against the asset-level source URL rather than whichever URL
+            // triggered this refresh. Akamai's path-segment mechanic is scoped
+            // differently and is deliberately left on the requested URL.
+            const sharesPrefixScopedGrant = this.tokenType === TOKEN_TYPES.EASY_B
+                || this.tokenType === TOKEN_TYPES.VENOM
+                || this.tokenType === TOKEN_TYPES.BUNNY;
+            const fetchSrc = (sharesPrefixScopedGrant && this.sourceUrl) ? this.sourceUrl : srcUrl.toString();
             try {
-                const tokenResponse = await this.fetchToken({ src: srcUrl.toString() });
+                const tokenResponse = await this.fetchToken({ src: fetchSrc });
                 if (tokenResponse === null) {
                     return url;
                 }
@@ -5759,33 +5785,39 @@
      * Segment (fragment) CDN token signing — shared primitive.
      *
      * Extends CDN token signing from manifests to segments, behind an opt-in flag
-     * (`EngineSettings.signSegmentsWithCdnToken`). Each segment is signed with the
-     * grant carried by its OWN parent playlist — read from `context.frag.baseurl`,
-     * the object hls.js itself parsed that fragment from — never from any store,
-     * cache, or shared manager state. This makes cross-rendition mis-signing
-     * structurally impossible rather than merely unlikely.
-     *
-     * CRITICAL: this module must never acquire or refresh a token. It only reads
-     * data already present on the fragment context handed to it by hls.js. Any
-     * acquisition call here would reintroduce the single-slot cache reuse in
-     * `CDNTokenManager.lastTokenResponse`, which hands one rendition's grant to
-     * another — the exact failure this design forbids.
-     *
-     * Token expiry model (CDN-04, D-07): a segment carries whatever grant its
-     * parent playlist carried when hls.js parsed it. Live playlists reload on
-     * their own cadence, so their fragments pick up refreshed grants with no
-     * refresh machinery here — reload IS the refresh path. VOD playlists are
-     * parsed exactly once by hls.js 1.6.10 (its level controller only
-     * (re)requests a playlist it has none of, or one that is live), so a VOD
-     * asset's segment grants are frozen at first parse for the asset's entire
-     * duration. If a token's lifetime is shorter than the asset's duration, later
-     * segments will be rejected by the edge and surface through the existing
-     * error/retry path. This is an accepted operational constraint — the token
-     * service's lifetime must exceed the longest VOD asset — not an oversight;
-     * D-07 chose reload-cadence refresh and CONTEXT.md defers a proactive
-     * near-expiry refresh path with a named revisit condition (a real asset shown
-     * to outlive its grant). No timer, interval, or scheduled re-fetch belongs in
-     * this module.
+     * (`EngineSettings.signSegmentsWithCdnToken`). The fast path signs each segment
+     * with the grant carried by its OWN parent playlist — read from
+     * `context.frag.baseurl`, the object hls.js itself parsed that fragment from.
+     *
+     * Token expiry model (CDN-04, D-07, revised):
+     *
+     * `frag.baseurl` is a string frozen at the moment hls.js parsed the level
+     * playlist. Live playlists reload on their own cadence, so their fragments pick
+     * up refreshed grants for free — reload IS the refresh path. VOD playlists are
+     * parsed exactly once by hls.js 1.6.10 (its level controller only (re)requests a
+     * playlist it has none of, or one that is live), so for VOD that string never
+     * changes. Pure transfer alone therefore pins a VOD asset's segments to the
+     * first grant for the asset's entire duration, and every segment 403s once that
+     * grant lapses — the condition CONTEXT.md named as D-07's revisit trigger, since
+     * observed in production (a ~294s grant against a ~26min asset).
+     *
+     * So when the inherited grant is inside the manager's expiry margin, this module
+     * now defers to the shared grant via `updateUrlWithTokenParams` rather than
+     * copying a dead string.
+     *
+     * Why sharing a grant across renditions is safe (supersedes this module's
+     * previous prohibition): the token service derives `token_path` from the
+     * directory of the URL it signs, and `token_path` is a PREFIX scope. An
+     * asset-level grant returns 200 on every rendition beneath it — verified live
+     * across all four renditions of a real asset. The hazard this module previously
+     * guarded against — one rendition's grant handed to another — is real ONLY for a
+     * rendition-scoped grant, and that is prevented at its source by
+     * `CDNTokenManager.sourceUrl`, which pins acquisition of the shared grant to the
+     * asset-level source URL. The invariant is therefore "the shared grant must be
+     * asset-level", not "segments must never refresh".
+     *
+     * Still true: no timer, interval, or scheduled re-fetch belongs in this module.
+     * Refresh here is demand-driven, on the load that needs it.
      */
     // ---------------------------------------------------------------------------
     // Supported token-type family (D-03) — query-param tokens only. Akamai's
@@ -5851,6 +5883,23 @@
             return segmentUrl;
         }
     }
+    /**
+     * Reads the `expires` value off a parent playlist URL, or null when the URL
+     * carries no token at all or cannot be parsed. Used to decide between the pure
+     * transfer fast path and a shared-grant refresh.
+     */
+    function readPlaylistGrantExpiry(parentPlaylistUrl) {
+        try {
+            const playlistUrl = new URL(parentPlaylistUrl);
+            const token = playlistUrl.searchParams.get('token');
+            if (!token)
+                return { hasToken: false, expires: null };
+            return { hasToken: true, expires: playlistUrl.searchParams.get('expires') };
+        }
+        catch {
+            return { hasToken: false, expires: null };
+        }
+    }
     /**
      * Returns a loader constructor extending `BaseLoader`: construct the base,
      * bind the inherited `load`, then assign an own `load` property that reads
@@ -5905,8 +5954,36 @@
                     originalLoad(context, loadConfig, callbacks);
                     return;
                 }
-                context.url = signSegmentUrlFromPlaylist(context.url, baseUrl);
-                originalLoad(context, loadConfig, callbacks);
+                const { hasToken, expires } = readPlaylistGrantExpiry(baseUrl);
+                // Parent playlist carried no grant: nothing to transfer, and nothing to
+                // refresh — an unsigned playlist means this path is not token-protected.
+                if (!hasToken) {
+                    originalLoad(context, loadConfig, callbacks);
+                    return;
+                }
+                // Fast path: the inherited grant is still good. Pure synchronous transfer,
+                // no manager involvement, no network.
+                if (!tokenSource.isTokenExpired(expires)) {
+                    context.url = signSegmentUrlFromPlaylist(context.url, baseUrl);
+                    originalLoad(context, loadConfig, callbacks);
+                    return;
+                }
+                // Inherited grant is expired or inside the expiry margin. For VOD this is
+                // terminal — hls.js will never re-parse the playlist, so the frozen
+                // baseurl can never recover on its own. Defer to the shared asset-level
+                // grant, which `CDNTokenManager.sourceUrl` keeps broad enough to cover
+                // this segment.
+                tokenSource.updateUrlWithTokenParams({ url: context.url })
+                    .then((updatedUrl) => {
+                    context.url = updatedUrl;
+                    originalLoad(context, loadConfig, callbacks);
+                })
+                    .catch(() => {
+                    // Token error: fall back to the inherited grant rather than emitting an
+                    // unsigned request, and let the edge's 403 drive hls.js's own retry.
+                    context.url = signSegmentUrlFromPlaylist(context.url, baseUrl);
+                    originalLoad(context, loadConfig, callbacks);
+                });
             };
         }
         function SegmentTokenLoader(loaderConfig) {
@@ -6279,6 +6356,11 @@
             // stream URL is loaded rather than config.src which always points at the main stream.
             let src = this.loadSourceUrl || config.src || '';
             if (this.tokenManager && src) {
+                // Pin shared-grant acquisition to the asset-level source URL before the
+                // first fetch. The token service scopes `token_path` to the directory of
+                // the URL it signs, so a grant minted against a level playlist (as an ABR
+                // switch would trigger) is rendition-scoped and 403s on every sibling.
+                this.tokenManager.sourceUrl = src;
                 src = await this.tokenManager.updateUrlWithTokenParams({ url: src });
                 // Guard: abort if detached during token URL update
                 if (this.detached) {
@@ -7465,10 +7547,11 @@
      * (20s) so that more precise, better-logged inner mechanism wins first in a
      * live player — this is the outer safety net, not the primary signal. Covers
      * two cases the inner mechanism cannot: an AdsManager that was never
-     * constructed at all (noUi:true, or a null ads container — lifecycle.ts
-     * skips the branch that would create one), and an AdsManager that obtained
-     * its manager from the loader (disarming its own bound) whose creative then
-     * never reached the screen.
+     * constructed at all (a headless player renders no ads container, so the
+     * ads branch in lifecycle.ts is still skipped for that reason (D-04) — this
+     * backstop applies unchanged to noUi + ad configurations), and an AdsManager
+     * that obtained its manager from the loader (disarming its own bound) whose
+     * creative then never reached the screen.
      */
     const MAIN_OPEN_FALLBACK_MS = 30000;
     // ---------------------------------------------------------------------------
@@ -7503,7 +7586,13 @@
         // so the config-level swap is legitimate for that field only). NEVER mutate
         // `mergedConfig.muted` — it is consumed only at video element creation in
         // skin-root.ts:141/318 and is a no-op for runtime mute.
-        const originalMuted = mergedConfig.muted ?? false;
+        //
+        // `mergedConfig.muted` is typed `boolean` (required, non-optional) on
+        // PlayerConfig, and DEFAULT_CONFIG.muted is the boolean literal `true` —
+        // mergeConfig()'s deepMerge always falls back to the base value for an
+        // undefined override (see config.ts), so this field can never be nullish
+        // through the real merge. No `?? false` fallback needed.
+        const originalMuted = mergedConfig.muted;
         const originalManager = mergedConfig.manager;
         const originalStartAt = mergedConfig.startAt;
         const controller = new PlayerController(runtimeConfig);
@@ -7682,6 +7771,21 @@
         controller.bus.on('error-fatal', () => {
             inst.p2p?.stop();
         }, { signal: controller.signal });
+        // Fail loud when mount() produced no video element (D-06). Without one,
+        // engine.setVideo() is skipped inside open() (see the `video !== null`
+        // guard above), so no engine ever attaches media and nothing is requested
+        // at all — no CDN token, no manifest, no segments. No watchdog covers
+        // this: the load-never-started watchdog lives inside the engine and is
+        // only armed once a driver exists. state.error (not a bus emit) is the
+        // channel here because start() has not returned the reference yet, so no
+        // consumer can have subscribed to the bus at this point, whereas the
+        // reactive state store is readable at any time afterwards.
+        if (video === null) {
+            const message = 'EBPlayer: no <video> element found in the container after mount() — playback cannot start.';
+            console.error(message);
+            controller.state.error = message;
+            return reference;
+        }
         // Phase 7/8 — pre-main leg orchestration.
         // When mergedConfig.preroll is set, open the intro stream first, then on
         // bus 'intro-stream-complete' (emitted by IntroStreamManager on video.ended,
@@ -7718,9 +7822,11 @@
             // same tick. complete() is idempotent, so on the normal ordering (intro
             // already finished) this is a no-op; the listener is already torn down.
             controller.bus.emit('force-intro-complete');
-            if (video !== null) {
-                video.muted = originalMuted;
-            }
+            // D-06: `video` is guaranteed non-null here — the guard above (line ~415)
+            // already returned early when mount() produced no <video>, and `video`
+            // is a `const`, so TypeScript's control-flow narrowing carries the
+            // non-null guarantee into this closure without a redundant re-check.
+            video.muted = originalMuted;
             controller.state.muted = originalMuted;
             // CR-05: keep mergedConfig.manager and controller.config.manager in sync.
             // start() builds mergedConfig and PlayerController builds its own merged
@@ -7805,7 +7911,9 @@
                 return;
             deferredPlaybackStarted = true;
             const engine = inst.engine;
-            if (engine === null || video === null)
+            // D-06: `video === null` is unreachable here — see the comment on the
+            // equivalent guard in openMainStream() above.
+            if (engine === null)
                 return;
             // Honor the user's click intent. CommandHandler's earlier bus.on('play')
             // listener fired before us with no source attached, so its video.play()
@@ -7875,9 +7983,9 @@
             }, { signal: controller.signal });
             // Force runtime mute off for the intro pass — applied to the LIVE <video>
             // element and PlayerState, NOT to mergedConfig.muted (no-op for runtime).
-            if (video !== null) {
-                video.muted = false;
-            }
+            // D-06: `video` is guaranteed non-null here — see the comment on the
+            // equivalent restore in openMainStream() above.
+            video.muted = false;
             controller.state.muted = false;
             // Skip P2P attach for the intro stream (D-08); restored before main open.
             // CR-05: keep the dual-merged configs in sync (see openMainStream).