@missing-elements/h5p-embed 1.0.0 → 1.0.1

package/README.md

@@ -65,7 +65,8 @@ The headers themselves, for a host not listed:
 |---|---|
 | every path | `Content-Security-Policy` (the policy the command prints, with `frame-ancestors` from `--ancestors`), `X-Content-Type-Options: nosniff`, `Referrer-Policy: strict-origin-when-cross-origin` |
 | `/h5p-sw.js` | `Cache-Control: no-cache`, so an update reaches learners on their next visit |
-| `/frame-assets/*`, `/resizer.js`, `/libraries/*` | `Cache-Control: public, max-age=3600, stale-while-revalidate=86400` |
+| `/frame-assets/*`, `/libraries/*` | `Cache-Control: no-cache`: the runtime and the library pack keep their file names between versions, so a copy from before an update must not be used after it |
+| `/resizer.js` | `Cache-Control: public, max-age=3600, stale-while-revalidate=86400` |
 
 To update, run the command again with `--force` and redeploy.
 

package/lib/build.mjs

@@ -137,6 +137,13 @@ export function contentSecurityPolicy({ packages = null, ancestors = null, meta
 /** Header rules, one set for every host format: the policy everywhere, and the caching that matters. */
 function headerRules(csp) {
   const revalidate = 'public, max-age=3600, stale-while-revalidate=86400'
+  // Asked again on every load, a 304 when nothing changed. The runtime's files keep their names
+  // from one version to the next, and the worker's version decides which it needs: kept for an
+  // hour, the runtime of the version before ran under the new worker after an update, and every
+  // play failed until the hour was out (0.10 to 1.0, measured, #49). The pack the same way, for
+  // whatever reads it with the browser's defaults: the element itself asks for its index
+  // revalidated and for its parts past the HTTP cache, so for it the header changes nothing.
+  const current = 'no-cache'
   return [
     {
       path: '/*',
@@ -148,9 +155,9 @@ function headerRules(csp) {
     },
     // The worker is checked on every load, so an update reaches learners on their next visit.
     { path: '/h5p-sw.js', headers: { 'Cache-Control': 'no-cache' } },
-    { path: '/frame-assets/*', headers: { 'Cache-Control': revalidate } },
+    { path: '/frame-assets/*', headers: { 'Cache-Control': current } },
     { path: '/resizer.js', headers: { 'Cache-Control': revalidate } },
-    { path: '/libraries/*', headers: { 'Cache-Control': revalidate } }
+    { path: '/libraries/*', headers: { 'Cache-Control': current } }
   ]
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@missing-elements/h5p-embed",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Self-hosted H5P embeds: writes the H5P embed page as a static site for a player domain of your own, then any site frames it with an iframe and one script line. No H5P server, no third-party service; optional allowlists for package hosts and embedding sites.",
   "license": "MIT",
   "repository": {
@@ -43,9 +43,9 @@
     "cli"
   ],
   "dependencies": {
-    "@missing-elements/h5p-offline-player": "^1.0.0",
-    "@missing-elements/h5p-runtime": "^1.0.0",
-    "@missing-elements/h5p-libraries": "^1.0.0"
+    "@missing-elements/h5p-libraries": "^1.0.0",
+    "@missing-elements/h5p-offline-player": "^1.0.1",
+    "@missing-elements/h5p-runtime": "^1.0.0"
   },
   "devDependencies": {
     "@types/node": "^26.6.5",