@missing-elements/h5p-embed 0.8.1 → 1.0.1

package/README.md

@@ -65,7 +65,8 @@ The headers themselves, for a host not listed:
 |---|---|
 | every path | `Content-Security-Policy` (the policy the command prints, with `frame-ancestors` from `--ancestors`), `X-Content-Type-Options: nosniff`, `Referrer-Policy: strict-origin-when-cross-origin` |
 | `/h5p-sw.js` | `Cache-Control: no-cache`, so an update reaches learners on their next visit |
-| `/frame-assets/*`, `/resizer.js`, `/libraries/*` | `Cache-Control: public, max-age=3600, stale-while-revalidate=86400` |
+| `/frame-assets/*`, `/libraries/*` | `Cache-Control: no-cache`: the runtime and the library pack keep their file names between versions, so a copy from before an update must not be used after it |
+| `/resizer.js` | `Cache-Control: public, max-age=3600, stale-while-revalidate=86400` |
 
 To update, run the command again with `--force` and redeploy.
 
@@ -74,7 +75,7 @@ To update, run the command again with `--force` and redeploy.
 | Parameter | Effect |
 |---|---|
 | `src=<url>` | The package, required. Encode `&`, `#`, `+`, `%` and spaces |
-| `libraries=pack`, `<url>` or `none` | Where libraries come from; several are tried in order. `pack` is this domain's copy, or jsDelivr's without one: a package gets the libraries it lacks from it, and those it carries at the pack's newer versions. `hub` means `pack`; `none` turns off `--default-libraries` |
+| `libraries=pack`, `<url>` or `none` | Where libraries come from; several are tried in order. `pack` is this domain's copy, or jsDelivr's without one: a package gets the libraries it lacks from it, and those it carries at the pack's newer versions. `none` turns off `--default-libraries` |
 | `refresh-libraries=off` | Play the libraries a package carries as exported; `pack` then only fills gaps |
 | `frame`, `copyright`, `export`, `icon`, `reporting` | H5P's action bar and its buttons |
 | `fullscreen=off` | No fullscreen button |

package/lib/build.mjs

@@ -57,7 +57,7 @@ const PACK_CDN_ORIGIN = 'https://cdn.jsdelivr.net'
 
 /**
  * A `libraries` value for addresses that name none, checked against the site it goes into: the
- * tokens the page understands (`pack`, `hub`, `none`, https URLs), and with a host list, nothing
+ * tokens the page understands (`pack`, `none`, https URLs), and with a host list, nothing
  * the page would then refuse on every load. Returns the value normalised to single spaces.
  *
  * @param {string | null | undefined} value
@@ -74,19 +74,19 @@ export function parseDefaultLibraries(value, { packages = null, libraries = true
     return null
   }
   // An exact match on a parsed origin, not a substring of a URL. Without its own copy, `pack` is
-  // the copy on jsDelivr that the element names; `hub` has meant `pack` since player 0.6.
+  // the copy on jsDelivr that the element names.
   const cdnAllowed = !packages || packages.some((origin) => origin === PACK_CDN_ORIGIN)
   for (const token of tokens) {
-    if (token === 'pack' || token === 'hub') {
+    if (token === 'pack') {
       if (!libraries && !cdnAllowed) {
-        throw new EmbedError(`--default-libraries names ${token}, but the site has no pack (--no-libraries) and --packages does not list ${PACK_CDN_ORIGIN}.`)
+        throw new EmbedError(`--default-libraries names pack, but the site has no pack (--no-libraries) and --packages does not list ${PACK_CDN_ORIGIN}.`)
       }
     } else {
       let url
       try {
         url = new URL(token)
       } catch {
-        throw new EmbedError(`--default-libraries: not pack, hub, none or a URL: ${token}`)
+        throw new EmbedError(`--default-libraries: not pack, none or a URL: ${token}`)
       }
       if (url.protocol !== 'https:' && !['localhost', '127.0.0.1', '[::1]'].includes(url.hostname)) {
         throw new EmbedError(`--default-libraries: not an https URL: ${token}`)
@@ -137,6 +137,13 @@ export function contentSecurityPolicy({ packages = null, ancestors = null, meta
 /** Header rules, one set for every host format: the policy everywhere, and the caching that matters. */
 function headerRules(csp) {
   const revalidate = 'public, max-age=3600, stale-while-revalidate=86400'
+  // Asked again on every load, a 304 when nothing changed. The runtime's files keep their names
+  // from one version to the next, and the worker's version decides which it needs: kept for an
+  // hour, the runtime of the version before ran under the new worker after an update, and every
+  // play failed until the hour was out (0.10 to 1.0, measured, #49). The pack the same way, for
+  // whatever reads it with the browser's defaults: the element itself asks for its index
+  // revalidated and for its parts past the HTTP cache, so for it the header changes nothing.
+  const current = 'no-cache'
   return [
     {
       path: '/*',
@@ -148,9 +155,9 @@ function headerRules(csp) {
     },
     // The worker is checked on every load, so an update reaches learners on their next visit.
     { path: '/h5p-sw.js', headers: { 'Cache-Control': 'no-cache' } },
-    { path: '/frame-assets/*', headers: { 'Cache-Control': revalidate } },
+    { path: '/frame-assets/*', headers: { 'Cache-Control': current } },
     { path: '/resizer.js', headers: { 'Cache-Control': revalidate } },
-    { path: '/libraries/*', headers: { 'Cache-Control': revalidate } }
+    { path: '/libraries/*', headers: { 'Cache-Control': current } }
   ]
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@missing-elements/h5p-embed",
-  "version": "0.8.1",
+  "version": "1.0.1",
   "description": "Self-hosted H5P embeds: writes the H5P embed page as a static site for a player domain of your own, then any site frames it with an iframe and one script line. No H5P server, no third-party service; optional allowlists for package hosts and embedding sites.",
   "license": "MIT",
   "repository": {
@@ -43,9 +43,9 @@
     "cli"
   ],
   "dependencies": {
-    "@missing-elements/h5p-libraries": "^0.3.0",
-    "@missing-elements/h5p-runtime": "^0.2.5",
-    "@missing-elements/h5p-offline-player": "^0.10.0"
+    "@missing-elements/h5p-libraries": "^1.0.0",
+    "@missing-elements/h5p-offline-player": "^1.0.1",
+    "@missing-elements/h5p-runtime": "^1.0.0"
   },
   "devDependencies": {
     "@types/node": "^26.6.5",

package/site/embed.js

@@ -244,12 +244,10 @@ export function startEmbed({ packBase = null, pack = null, librariesPack = null,
     const sources = []
     if (value === 'none') return { value: '' }
     for (const token of value.split(/\s+/).filter(Boolean)) {
-      if (token === 'pack' || token === 'hub') {
+      if (token === 'pack') {
         // This site's copy of the pack, which the element was pointed at above; without one, the
         // element's own `pack`, the copy on jsDelivr, where that may be reached, so a snippet
-        // written for `pack` keeps playing after a rebuild with --no-libraries. `hub` has meant
-        // `pack` since player 0.6: the one H5P hub host that answers a browser serves a
-        // catalogue older than current exports need.
+        // written for `pack` keeps playing after a rebuild with --no-libraries.
         if (ownPack || (!librariesPack && permitted(PACK_CDN_ORIGIN))) sources.push('pack')
         else if (librariesPack) sources.push(librariesPack)
         else return { error: 'This player was set up without the library pack, so libraries=pack is not available here.' }

package/site/index.html

@@ -16,7 +16,7 @@
       <span class="spinner" aria-hidden="true"></span>
       <span class="loader-text">Loading…</span>
     </div>
-    <h5p-player auto-resize></h5p-player>
+    <h5p-player></h5p-player>
     <p class="notice" id="notice" hidden></p>
   </body>
 </html>