Release v1.1.7: TLC UPDATE: ship-readiness polish, demo compatibility, and docs sync

[Bandonker]

This pull request introduces comprehensive video streaming support and significant improvements to documentation, CI/CD workflows, and security posture. The changes enable universal media streaming (audio and video), add new usage examples and documentation, and harden both the codebase and deployment guidance. CI/CD workflows are updated for better reliability, stricter linting, and improved artifact handling.

Feature and Documentation Enhancements:

• Added full video streaming support (MP4, WebM, M3U8/HLS) with new examples, a React video player component, and expanded documentation in the README.md and CHANGELOG.md. This includes API usage for video, adaptive streaming, and seeking.
  CI/CD Workflow Improvements:

• Hardened GitHub Actions workflows by adding explicit permissions, timeouts, stricter matrix and linting steps, and improved artifact handling in .github/workflows/ci.yml, .github/workflows/pr-validation.yml, and .github/workflows/publish.yml.

Security Posture and Hardening:

• Overhauled SECURITY.md to clarify current implemented controls (request validation, stream lifecycle cleanup, CORS, logging/telemetry), and explicitly list deferred hardening items (authentication, allowlists, rate limiting, SSRF controls). Added best practice code samples for URL validation and restrictive deployment.
  Changelog and Metadata:

• Updated CHANGELOG.md for version 1.1.7 to reflect new video features, documentation improvements, and package metadata changes.

Other Improvements:

• Enhanced package description, keywords, and .gitignore to better reflect new video capabilities and streamline development.

• Add legacy React example compatibility redirect (/examples/react-video-player.tsx -> /examples/react-example.tsx) across demo servers and smoke validation.
• Remove shim-based React demo wiring and use the package React hook export directly.
• Improve browser/client bundling safety for Node-only server imports and tighten export verification coverage.
• Expand demo tooling with dedicated build/serve/smoke scripts and refresh demo entry assets.
• Harden proxy behavior and tests around URL validation, request handling, timeout/redirect controls, and cleanup paths.
• Reduce noisy test console output while preserving assertions and overall coverage.
• Refresh workflow and packaging setup, including dependency/lockfile updates and publish-ready script alignment.
• Update README and related docs for current API, migration notes, security defaults, demo route map, release checklist, and contributor/support guidance.
• Keep release artifacts and examples aligned with the current project structure and compatibility expectations.
  This pull request introduces comprehensive improvements to CI/CD workflows, security documentation, and demo code, along with new features and documentation for video streaming support. The changes focus on strengthening build/test pipelines, clarifying security posture and best practices, and improving demo safety and usability.

CI/CD Workflow Enhancements

• Added explicit permissions to all workflow files (ci.yml, pr-validation.yml, publish.yml) for improved security; set contents: read for CI/PR validation and contents: write for publishing.
• Introduced linting and export validation steps, increased timeouts, and improved artifact handling in CI, PR validation, and publish workflows. Also switched test runs to use --runInBand for reliability.
• Enhanced package export validation to check for React and Vue builds/types, and added runtime subpath export verification scripts in PR validation.

Security Documentation and Best Practices

• Overhauled SECURITY.md to clarify which protections are implemented versus deferred, and provided best practice code snippets for URL whitelisting, restrictive proxy configuration, and scoped auto-start usage.

Demo Code Improvements

• Renamed proxy configuration option from proxyConfig to proxyServerConfig for consistency in both CLI and browser demos.
• Added HTML escaping and error message normalization to demo UI rendering, preventing potential injection and ensuring robust error display.

Feature and Documentation Additions

• Added comprehensive video streaming support (MP4, WebM, M3U8/HLS), React video player component, and expanded documentation in CHANGELOG.md and README.

These changes collectively improve build reliability, security clarity, demo safety, and feature coverage for media streaming.

[chatgpt-codex-connector]

To use Codex here, create an environment for this repo.