# Vendored hls.js

`hls.mjs` is **hls.js 1.6.16**, checked in rather than installed.

## Why it is here and not in `package.json`

Chromium cannot play an HLS playlist natively, so seeking inside a live Jellyfin transcode needs a player
library. `bunfig.toml` freezes installs (`frozenLockfile = true`) specifically so that adding a package is a
deliberate act with a reviewed lockfile diff — see `platform/CLAUDE.md` → "Installs are frozen", and the
2026-08-04 npm cache-package worm that prompted it.

Vendoring makes the trade explicit instead of implicit:

- **No install-time code.** A committed file has no `preinstall`/`postinstall` hook, which is the exact vector
  that compromise used. hls.js's own tarball has no install script either — but a future version of it, or of
  anything it might later depend on, could.
- **No transitive tree.** hls.js 1.6.16 publishes `dependencies: {}`, `peerDependencies: {}` and
  `optionalDependencies: {}`, so nothing is being skipped by not resolving it. Its *build-time* devDependencies
  do reach the affected packages (eslint 8 → file-entry-cache → flat-cache → keyv), but this artifact was
  published 2026-04-13, months before those versions existed.
- **It is reviewable.** One unminified file in the diff. That is the point; do not replace it with a minified
  build to save bytes.

The upstream `.d.ts` is *not* vendored — it imports a tree of internal type modules, which would undo the one
file rule. `hls.d.mts` next to it declares the API this player actually uses, by hand.

## Provenance

| | |
|---|---|
| Package | `hls.js@1.6.16` |
| Published | 2026-04-13 |
| Tarball | `https://registry.npmjs.org/hls.js/-/hls.js-1.6.16.tgz` |
| Tarball sha512 | `VSIRpLfRwlAAdGL4wiTucx2ScRipo0ed1FBatWkyt832jC4CReKstga6yIhYVwGu9LOBjuX9wzmRMeQdBJtzEA==` (matches the registry's published `dist.integrity`) |
| Extracted from | `package/dist/hls.mjs` |
| Local change | the trailing `//# sourceMappingURL=hls.mjs.map` line removed — the map is not vendored, and leaving the reference makes devtools 404 |
| `hls.mjs` sha256 | `45a4bb55e5346bf9284fa7e46b6fac7d62dce5b90394dcba9747d471940fea6e` as published; `ca442f1f963ff66607a242cc7be227b243770d86bfc3251bf675f8a342dfe798` as committed here (the two differ only by that removed line) |
| Licence | Apache-2.0 — `hls.LICENSE` |

## Updating it

```sh
V=1.6.17
curl -sO https://registry.npmjs.org/hls.js/-/hls.js-$V.tgz
# compare the sha512 against `curl -s https://registry.npmjs.org/hls.js/$V | jq -r .dist.integrity`
tar xzf hls.js-$V.tgz package/dist/hls.mjs package/LICENSE
```

Copy `package/dist/hls.mjs` over this one, drop the `sourceMappingURL` line, update the table above, and read
the diff. A version bump that arrives with a diff you did not read is the thing this directory exists to
prevent.