Developer docs

CDN

Where the JavaScript SDK is served from, the two path shapes and their cache lifetimes, SRI hashes, and how releases reach your page.

The JavaScript SDK is served from https://cdn.bookdineplay.com. Every release publishes the same file under two paths with different promises: an exact version that never changes, and a major-line alias that always points at the newest release of that line.

The two paths

Path Content Cache Integrity hash
sdk/<version>/bookdineplay.js exactly that release, forever one year, immutable (max-age=31536000, immutable) published next to it as sdk/<version>/sri.txt
sdk/v<major>/bookdineplay.js the newest release of that major line five minutes (max-age=300) none — its content changes by design

The current line is 0.x, so the alias is sdk/v0/bookdineplay.js. When a 1.0.0 ships, sdk/v1/ appears and sdk/v0/ keeps serving the last 0.x release — an alias never jumps to a new major line.

Which one to use

  • The alias when you want fixes without touching your page. The Quickstart and the WordPress plugin use it. Worst case after a release: five minutes of visitors on the previous version.
  • An exact version when your security policy requires byte-level pinning, or when you have tested a theme against one release and want it to stay that way. You upgrade by editing the tag.

Pinning an exact version

Copy the version's hash from sdk/<version>/sri.txt — it is also attached to the GitHub release — and add it as the integrity attribute:

<script
  src="https://cdn.bookdineplay.com/sdk/<version>/bookdineplay.js"
  integrity="<hash from sdk/<version>/sri.txt>"
  crossorigin="anonymous"></script>

The hash is sha384-…, computed from the very bytes uploaded, so it can never disagree with what the CDN serves. crossorigin="anonymous" is required for the browser to check it. Never put an integrity attribute on the alias URL: the first release after yours changes the bytes, the check fails, and the widget silently stops loading.

Versions and releases

Every release of BookDinePlay tags vX.Y.Z on GitHub and publishes the SDK to the CDN, BookDinePlay.Sdk and BookDinePlay.Shared to NuGet, and the WordPress plugin zip to the release. A prerelease such as 0.7.0-beta.1 is published only under its exact version path — it never moves an alias. window.BookDinePlay.version is the SDK's version string.

Cross-origin and caching details

  • Responses under /sdk/ carry Access-Control-Allow-Origin: *, so pinned loads with crossorigin work from any site.
  • The CDN sits behind Azure Front Door; cache lifetimes above are what your browser and intermediate caches honour. A deploy of the alias is visible everywhere within those five minutes.
  • Nothing on the CDN is personalized or keyed: it serves one static file per path, and your publishable key only ever travels to api.bookdineplay.com.

Next steps