officer
a7f1a71785
Eighth plugin out, and the second resurrection: like soulseek, hono.ts carried the router import and its mount commented out since 2026-08-13, with the permission reduced to api: [], so the server booted clean while every panel request 404'd. jellyfin_servers was also absent from the drizzle barrel, so bun db:push would have dropped it. Easier than soulseek in one specific way: mountPrefix derives /jellyfin from the appName, which is exactly what the router already hardcoded, so no frontend call site needed repointing. Soulseek needed 47 because its appName and its old prefix differed. The frontend also already routed through one helper, so there were five call sites rather than forty-seven. Self-contained, unlike transmission and soulseek: jellyfin_servers is a registry this plugin owns outright — label, URL, encrypted token, one active — because more than one Jellyfin is a thing someone has, and more than one Transmission is not. Carries its own .prettierignore for the vendored hls.mjs, rather than leaving a stale rule behind in the platform naming a path that no longer exists.
2.8 KiB
Vendored hls.js
hls.mjs is hls.js 1.6.16, checked in rather than installed.
Why it is here and not in package.json
Chromium cannot play an HLS playlist natively, so seeking inside a live Jellyfin transcode needs a player
library. bunfig.toml freezes installs (frozenLockfile = true) specifically so that adding a package is a
deliberate act with a reviewed lockfile diff — see platform/CLAUDE.md → "Installs are frozen", and the
2026-08-04 npm cache-package worm that prompted it.
Vendoring makes the trade explicit instead of implicit:
- No install-time code. A committed file has no
preinstall/postinstallhook, which is the exact vector that compromise used. hls.js's own tarball has no install script either — but a future version of it, or of anything it might later depend on, could. - No transitive tree. hls.js 1.6.16 publishes
dependencies: {},peerDependencies: {}andoptionalDependencies: {}, so nothing is being skipped by not resolving it. Its build-time devDependencies do reach the affected packages (eslint 8 → file-entry-cache → flat-cache → keyv), but this artifact was published 2026-04-13, months before those versions existed. - It is reviewable. One unminified file in the diff. That is the point; do not replace it with a minified build to save bytes.
The upstream .d.ts is not vendored — it imports a tree of internal type modules, which would undo the one
file rule. hls.d.mts next to it declares the API this player actually uses, by hand.
Provenance
| Package | hls.js@1.6.16 |
| Published | 2026-04-13 |
| Tarball | https://registry.npmjs.org/hls.js/-/hls.js-1.6.16.tgz |
| Tarball sha512 | VSIRpLfRwlAAdGL4wiTucx2ScRipo0ed1FBatWkyt832jC4CReKstga6yIhYVwGu9LOBjuX9wzmRMeQdBJtzEA== (matches the registry's published dist.integrity) |
| Extracted from | package/dist/hls.mjs |
| Local change | the trailing //# sourceMappingURL=hls.mjs.map line removed — the map is not vendored, and leaving the reference makes devtools 404 |
hls.mjs sha256 |
45a4bb55e5346bf9284fa7e46b6fac7d62dce5b90394dcba9747d471940fea6e as published; ca442f1f963ff66607a242cc7be227b243770d86bfc3251bf675f8a342dfe798 as committed here (the two differ only by that removed line) |
| Licence | Apache-2.0 — hls.LICENSE |
Updating it
V=1.6.17
curl -sO https://registry.npmjs.org/hls.js/-/hls.js-$V.tgz
# compare the sha512 against `curl -s https://registry.npmjs.org/hls.js/$V | jq -r .dist.integrity`
tar xzf hls.js-$V.tgz package/dist/hls.mjs package/LICENSE
Copy package/dist/hls.mjs over this one, drop the sourceMappingURL line, update the table above, and read
the diff. A version bump that arrives with a diff you did not read is the thing this directory exists to
prevent.