@missing-elements/h5p-embed 1.1.0 → 1.2.0

package/README.md

@@ -2,6 +2,8 @@
 
 Writes the H5P embed page as a static site for a player domain of your own. Any site then embeds
 a package with an iframe and one script line. No H5P server, no backend, no third-party service.
+With `--scorm`, it writes one package as a SCORM zip instead, for an LMS to play and grade (see
+[A SCORM package, for an LMS](#a-scorm-package-for-an-lms)).
 
 Needs Node 22 or later. Write `@latest`: without it, npm on an older Node quietly installs the
 last version that supported it, which writes a player from before 1.0.
@@ -35,6 +37,7 @@ a subdomain shares your site's cookies.
 | `--default-libraries <sources>` | The `libraries` value for addresses that name none: `pack` or URLs. Checked against `--packages`. Default: none, so exports without libraries are refused unless the address asks |
 | `--no-libraries` | Leave out the library pack, 13.8 MB in `libraries/`, one archive per library, of which a learner's browser fetches only those a package needs; `libraries=pack` then fetches them from jsDelivr, where allowed |
 | `--force` | Write into a non-empty folder, replacing only this tool's files |
+| `--scorm <package.h5p> [zip]` | Write a SCORM 1.2 package of one `.h5p` instead of the site; see [A SCORM package, for an LMS](#a-scorm-package-for-an-lms) |
 | `-h`, `--help` / `-v`, `--version` | |
 
 Origins are `https://host.example`, comma or space separated, no path or trailing slash;
@@ -77,7 +80,7 @@ To update, run the command again with `--force` and redeploy.
 
 | Parameter | Effect |
 |---|---|
-| `src=<url>` | The package, required. Encode `&`, `#`, `+`, `%` and spaces |
+| `src=<url>` | The package, required: an `http` or `https` URL, or a path on the player domain. Encode `&`, `#`, `+`, `%` and spaces |
 | `libraries=pack`, `<url>` or `none` | Where libraries come from; several are tried in order. `pack` is this domain's copy, or jsDelivr's without one: a package gets the libraries it lacks from it, and those it carries at the pack's newer versions. `none` turns off `--default-libraries` |
 | `refresh-libraries=off` | Play the libraries a package carries as exported; `pack` then only fills gaps |
 | `frame`, `copyright`, `export`, `icon`, `reporting` | H5P's action bar and its buttons |
@@ -122,6 +125,45 @@ Whatever `xapi=` says, the frame also posts to its parent:
 { context: 'h5p-offline-player', action: 'error', code, message }  // code 'refused', 'no-src' or the load's
 ```
 
+## A SCORM package, for an LMS
+
+```bash
+npx @missing-elements/h5p-embed@latest --scorm course.h5p     # writes ./course.scorm.zip
+```
+
+writes one package as a SCORM 1.2 zip: the package, the player and the H5P runtime, and a launch
+page that reports to the LMS. Add it to a course as a SCORM activity, in Moodle or another LMS that
+takes SCORM 1.2, and the LMS records:
+
+- the score out of 100, and `passed` or `failed` when the content says whether it was passed,
+  `completed` when it does not. The content's last result counts, as on an H5P site;
+- the time spent in each session;
+- the learner's place: the content's saved state goes into `cmi.suspend_data`, and the next
+  launch continues from it. SCORM 1.2 keeps 4,096 characters, enough for a quiz; a larger state is
+  not saved.
+
+Moodle records the score as the grade, out of the activity's maximum grade, so leave that at 100,
+its default.
+
+An export from h5p.com or h5p.org, which leaves the libraries out, works as well: the zip carries
+the ones it needs from the library pack, and only those. For a quiz with formulas, that is 11
+libraries, 4 MB, most of it the formula renderer. A package that carries its libraries, as exports
+from Lumi and the H5P plugins of Moodle, WordPress and Drupal do, plays with its own. One that needs
+a library neither it nor the pack has, or a newer version than the pack's, is refused, with what is
+missing named.
+
+The package plays trusted: its own code runs on the LMS's origin, as every SCORM package's does.
+The LMS has to be served over https, since the player needs its Service Worker, and Moodle has to
+serve files by path, which it does by default (`slasharguments`).
+
+Content that reports no result of its own, an Accordion or a Virtual Tour, stays `incomplete`:
+complete such an activity on viewing it instead. Replacing the zip with one written from another
+`.h5p`, or with other libraries from the pack, starts learners over, since their saved state
+belongs to what it was saved in.
+
+Checked in Moodle 4.5: the score reaches the gradebook, and a learner who leaves halfway continues
+there on the next launch. Other LMSs have not been tried yet.
+
 ## As a library
 
 ```js
@@ -138,7 +180,9 @@ export, which `libraries=pack` then plays from) or `packBase` (the folder of a c
 `@missing-elements/h5p-runtime` export, for a bundled element) and `askInOwnFrame` (default
 `true`; `false` plays a package from another origin as it is when a same-origin page frames it).
 `librariesPack`, the URL of a whole `libraries.h5p`, still works, as a bundle that only fills gaps.
-Both entries ship with TypeScript declarations.
+`buildScorm` from `@missing-elements/h5p-embed/scorm` is `--scorm`: it takes `h5p`, `out` and
+`force`, and returns the zip's path, its title, size, the `libraries` it carries from the pack,
+and `build`, the stamp saved state is kept against. Every entry ships with TypeScript declarations.
 
 ```js
 import '@missing-elements/h5p-offline-player'
@@ -154,7 +198,8 @@ startEmbed({ runtime, pack, defaultLibraries: 'pack' })
 
 The site sets no cookies and sends nothing anywhere of its own. Learners' browsers contact your
 player domain, the package hosts and, only for `pack` on a site built with `--no-libraries`,
-`cdn.jsdelivr.net`. What the player stores and
+`cdn.jsdelivr.net`. A SCORM package contacts nothing but the LMS it was uploaded to, which gets the
+score, the result, the time spent and the learner's saved state. What the player stores and
 sends, for a privacy notice or a GDPR review:
 [Privacy and data protection](https://github.com/missing-elements/h5p-offline-player/blob/main/docs/privacy.md).
 
@@ -164,4 +209,6 @@ MIT. The written folder also carries
 [`@missing-elements/h5p-runtime`](https://www.npmjs.com/package/@missing-elements/h5p-runtime)
 under the GPL-3.0, as `frame-assets/` with its `LICENSE.txt` and `NOTICE.txt`, and, unless
 `--no-libraries`, the hub's libraries under their own licences, listed in `libraries.txt`. The
-folder's `NOTICE.txt` says which file is what.
+folder's `NOTICE.txt` says which file is what. A SCORM zip carries the runtime the same way, the
+package under its own licences, and any libraries from the pack as the folder does; its
+`NOTICE.txt` says the same.

package/bin/h5p-embed.mjs

@@ -1,15 +1,22 @@
 #!/usr/bin/env node
 import { readFileSync } from 'node:fs'
-import { relative } from 'node:path'
+import { basename, extname, relative } from 'node:path'
 import { parseArgs } from 'node:util'
 import { EmbedError, buildSite } from '../lib/build.mjs'
+import { buildScorm } from '../lib/scorm.mjs'
 
 const USAGE = `Usage: h5p-embed [folder] [options]
+       h5p-embed --scorm <package.h5p> [zip] [--force]
 
 Writes the H5P embed page as a static site, ready to deploy to a player domain of your own.
 The folder defaults to ./h5p-player.
 
+With --scorm, writes a SCORM 1.2 package of one .h5p instead, for an LMS to play and grade: the
+player, the package and the libraries it does not carry, from the library pack, in one zip. The
+zip defaults to ./<package>.scorm.zip.
+
 Options:
+  --scorm <package.h5p>  write a SCORM package of this .h5p rather than the site
   --packages <origins>   play packages, and fetch library bundles, only from these origins
                          (comma or space separated; this site's own is always allowed). Add
                          any host a package URL redirects to, and https://cdn.jsdelivr.net for
@@ -21,7 +28,8 @@ Options:
                          it still plays an export with no libraries: pack or URLs, as the
                          parameter. Default: none, such exports are refused unless the address asks
   --no-libraries         leave out the 13.7 MB library pack; libraries=pack then fetches it from jsDelivr
-  --force                write into a folder that is not empty, replacing only this tool's files
+  --force                write into a folder that is not empty, replacing only this tool's files;
+                         with --scorm, replace the zip
   -h, --help             show this
   -v, --version          print the version`
 
@@ -30,6 +38,7 @@ try {
   args = parseArgs({
     allowPositionals: true,
     options: {
+      scorm: { type: 'string' },
       packages: { type: 'string', multiple: true },
       ancestors: { type: 'string', multiple: true },
       'default-libraries': { type: 'string' },
@@ -54,12 +63,50 @@ if (values.version) {
   process.exit(0)
 }
 if (positionals.length > 1) {
-  console.error(`h5p-embed: one folder at most, got ${positionals.length}\n\n${USAGE}`)
+  console.error(`h5p-embed: one ${values.scorm !== undefined ? 'zip' : 'folder'} at most, got ${positionals.length}\n\n${USAGE}`)
   process.exit(2)
 }
 
 const megabytes = (bytes) => `${(bytes / 1024 / 1024).toFixed(1)} MB`
 
+/** Where a written file or folder is, said from here when it is below here. */
+const shown = (path) => {
+  const below = relative(process.cwd(), path)
+  return below === '' ? '.' : below.startsWith('..') ? path : below
+}
+
+// `--scorm=` with no package still means a SCORM package, refused for naming none.
+if (values.scorm !== undefined) {
+  // The site's options shape a site; a SCORM package has no hosts, framers or library sources.
+  const siteOnly = ['packages', 'ancestors', 'default-libraries', 'no-libraries'].filter((name) => values[name] !== undefined)
+  if (siteOnly.length > 0) {
+    console.error(`h5p-embed: ${siteOnly.map((name) => `--${name}`).join(', ')} not with --scorm, which writes a package, not a site\n\n${USAGE}`)
+    process.exit(2)
+  }
+  try {
+    const zip = await buildScorm({
+      h5p: values.scorm,
+      out: positionals[0] ?? `${basename(values.scorm, extname(values.scorm))}.scorm.zip`,
+      force: values.force ?? false
+    })
+    const count = zip.libraries.length
+    const supplied = count > 0 ? `, the H5P runtime and ${count} ${count === 1 ? 'library' : 'libraries'} from the library pack, which it does not carry` : ' and the H5P runtime'
+    console.log(`Wrote ${shown(zip.out)} (${megabytes(zip.size)}): "${zip.title}" as a SCORM 1.2 package,
+with the player ${zip.version}${supplied}.
+
+Add it to a course as a SCORM package. The LMS gets the content's score and whether it passed,
+when the content reports them, and the time spent; the learner's place is kept between sessions.
+The LMS must be served over https, as the player's Service Worker needs.`)
+  } catch (error) {
+    if (error instanceof EmbedError) {
+      console.error(`h5p-embed: ${error.message}`)
+      process.exit(1)
+    }
+    throw error
+  }
+  process.exit(0)
+}
+
 try {
   const site = await buildSite({
     out: positionals[0] ?? 'h5p-player',
@@ -69,8 +116,7 @@ try {
     defaultLibraries: values['default-libraries'] ?? null,
     force: values.force ?? false
   })
-  const below = relative(process.cwd(), site.out)
-  const folder = below === '' ? '.' : below.startsWith('..') ? site.out : below
+  const folder = shown(site.out)
   const parts = [`the player ${site.version}`, 'the H5P runtime', site.libraries ? 'the library pack' : null].filter(Boolean)
   console.log(`Wrote ${folder}/ (${megabytes(site.size)}): the embed page, ${parts.join(', ')}.`)
   console.log(`Packages from: ${site.packages ? `this site, ${site.packages.join(', ')}` : 'any https host'}.`)

package/lib/build.mjs

@@ -20,15 +20,19 @@ const SITE = fileURLToPath(new URL('../site', import.meta.url))
 
 /** The page's own files, copied as they are; `index.html` is written, not copied. */
 const PAGE_FILES = ['embed.js', 'embed.css', 'main.js', 'resizer.js']
-/** The player's files, by the names the element looks for beside itself. */
-const PLAYER_FILES = ['h5p-player.js', 'h5p-sw.js', 'h5p-jobs.js']
+/**
+ * The player's files, by the names the element looks for beside itself.
+ * @internal
+ */
+export const PLAYER_FILES = ['h5p-player.js', 'h5p-sw.js', 'h5p-jobs.js']
 
 /**
  * Where an installed package's file is, or a message that says which one is missing.
+ * @internal
  * @param {string} specifier
  * @param {string} hint
  */
-function installed(specifier, hint) {
+export function installed(specifier, hint) {
   try {
     return require.resolve(specifier)
   } catch {
@@ -304,8 +308,8 @@ function notice({ version, libraries }) {
   Caddyfile, nginx.conf, .htaccess, _headers, vercel.json
                     the same headers for five kinds of host; use the one yours reads
   h5p-player.js, h5p-sw.js, h5p-jobs.js
-                    @missing-elements/h5p-offline-player ${version}: MIT. The two workers also
-                    carry zip.js, BSD-3-Clause, its licence in each file's header.
+                    @missing-elements/h5p-offline-player ${version}: MIT. The Service Worker,
+                    h5p-sw.js, also carries zip.js, BSD-3-Clause, its licence in its header.
   frame-assets/     @missing-elements/h5p-runtime, the H5P core runtime: GPL-3.0-only. Its
                     LICENSE.txt and NOTICE.txt say what it is and where its source is; keep them
                     with it.

package/lib/scorm.mjs

@@ -0,0 +1,548 @@
+import { createHash } from 'node:crypto'
+import { createReadStream, createWriteStream, openAsBlob } from 'node:fs'
+import { readdir, readFile, rename, rm, stat } from 'node:fs/promises'
+import { basename, dirname, extname, join, resolve, sep } from 'node:path'
+import { Writable } from 'node:stream'
+import { fileURLToPath } from 'node:url'
+import { BlobReader, TextReader, TextWriter, ZipReader, ZipWriter, configure } from '@zip.js/zip.js'
+import { EmbedError, PLAYER_FILES, installed } from './build.mjs'
+
+/**
+ * Writes a SCORM 1.2 package that plays one `.h5p` in an LMS and reports its result there: the
+ * launch page and its bridge to the LMS's API, the player, the H5P runtime and the package, in
+ * one zip a teacher uploads as a SCORM activity. The LMS serves the files from its own origin,
+ * under a path of the package's own, so the player's Service Worker registers there, scoped to
+ * that path, and nothing is fetched from anywhere else.
+ *
+ * The package plays trusted, as every SCORM package runs its own code on the LMS's origin, with the
+ * libraries it carries. What it does not carry, as an export from h5p.com or h5p.org carries none,
+ * comes from the library pack, written into the zip: only the parts it needs. One that needs a
+ * library neither has is refused here rather than in front of a learner. Checked against Moodle 4.5
+ * on 2026-10-28: the worker registered under `pluginfile.php`, the package was read by ranges, and
+ * the score reached the gradebook.
+ */
+
+configure({ useWebWorkers: false })
+
+const SCORM = fileURLToPath(new URL('../scorm', import.meta.url))
+const SITE = fileURLToPath(new URL('../site', import.meta.url))
+
+/** What the zip calls the package; the launch page plays it by this name. */
+const PACKAGE = 'package.h5p'
+/** Where the zip keeps the library pack's parts it carries, as the embed site does. */
+const LIBRARIES = 'libraries'
+
+/**
+ * A dependency as `h5p.json` and every `library.json` list them, or nothing for an entry that is
+ * not one.
+ * @param {unknown} json
+ * @returns {{ machineName: string, major: number, minor: number }[]}
+ */
+function dependenciesIn(json) {
+  const list = /** @type {{ preloadedDependencies?: unknown }} */ (json ?? {}).preloadedDependencies
+  if (!Array.isArray(list)) return []
+  return list.flatMap((dependency) => {
+    const major = Number(dependency?.majorVersion)
+    const minor = Number(dependency?.minorVersion)
+    return typeof dependency?.machineName === 'string' && Number.isInteger(major) && Number.isInteger(minor)
+      ? [{ machineName: dependency.machineName, major, minor }]
+      : []
+  })
+}
+
+/**
+ * The folder that serves a dependency, by the player's own rule: its versioned or bare name when
+ * that folder has a `library.json`, else the lowest versioned folder of the same major with a
+ * minor at least as high (`reachableFolder` in the player's `package-reader.ts`).
+ * @internal
+ * @param {{ machineName: string, major: number, minor: number }} dependency
+ * @param {ReadonlySet<string>} names the archive's entry names
+ * @returns {string | undefined}
+ */
+export function servingFolder({ machineName, major, minor }, names) {
+  const own = [`${machineName}-${major}.${minor}`, machineName].find((folder) => names.has(`${folder}/library.json`))
+  if (own) return own
+  let best
+  for (const name of names) {
+    const match = /^(.+)-(\d+)\.(\d+)\/library\.json$/.exec(name)
+    if (!match || match[1] !== machineName || Number(match[2]) !== major || Number(match[3]) < minor) continue
+    if (!best || Number(match[3]) < best.minor) best = { folder: `${match[1]}-${match[2]}.${match[3]}`, minor: Number(match[3]) }
+  }
+  return best?.folder
+}
+
+/**
+ * What the content asks for, and what those libraries need in turn, that no folder in `names`
+ * serves: the player refuses such a package when it opens it, and the deep walk is the one it makes
+ * before the runtime boots (`missingDependencies`). The sub-content the parameters name counts
+ * too, which the player finds missing only when the runtime reaches it.
+ * @param {{ machineName: string, major: number, minor: number }[]} roots
+ * @param {ReadonlySet<string>} names
+ * @param {(name: string) => Promise<unknown>} read a `library.json` among `names`, parsed
+ * @returns {Promise<{ machineName: string, major: number, minor: number }[]>}
+ */
+async function missingLibraries(roots, names, read) {
+  /** @type {Map<string, { machineName: string, major: number, minor: number }>} */
+  const missing = new Map()
+  const seen = new Set()
+  let level = roots
+  while (level.length > 0) {
+    const next = []
+    for (const dependency of level) {
+      const key = `${dependency.machineName} ${dependency.major}.${dependency.minor}`
+      if (seen.has(key)) continue
+      seen.add(key)
+      const folder = servingFolder(dependency, names)
+      if (!folder) missing.set(key, dependency)
+      else next.push(...dependenciesIn(await read(`${folder}/library.json`)))
+    }
+    level = next
+  }
+  return [...missing].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)).map(([, dependency]) => dependency)
+}
+
+/*
+ * The library pack's part of the work: which of its parts the package needs. These follow the
+ * player's own functions, named on each, so that the element, planning from the zip's index,
+ * asks for exactly the parts the zip carries; keep them in step.
+ */
+
+/**
+ * The sub-content libraries the parameters name, by each object's `library` string, as
+ * `"H5P.MultiChoice 1.16"`: what a full export's `h5p.json` lists and a stripped one's does not.
+ * The player's `librariesNamedIn`.
+ * @param {unknown} params
+ * @returns {{ machineName: string, major: number, minor: number }[]}
+ */
+function librariesNamedIn(params) {
+  /** @type {Map<string, { machineName: string, major: number, minor: number }>} */
+  const found = new Map()
+  /** @param {unknown} value @param {number} depth */
+  const walk = (value, depth) => {
+    if (depth > 64 || !value || typeof value !== 'object') return
+    if (Array.isArray(value)) {
+      for (const item of value) walk(item, depth + 1)
+      return
+    }
+    const library = /** @type {{ library?: unknown }} */ (value).library
+    if (typeof library === 'string') {
+      const match = /^([A-Za-z0-9_.-]+) (\d+)\.(\d+)$/.exec(library)
+      if (match && !found.has(match[1])) found.set(match[1], { machineName: match[1], major: Number(match[2]), minor: Number(match[3]) })
+    }
+    for (const child of Object.values(value)) walk(child, depth + 1)
+  }
+  walk(params, 0)
+  return [...found.values()]
+}
+
+/**
+ * An addon's patterns, under `addTo.content.types[].text.regex`, PHP's `/…/flags` made
+ * JavaScript's; one JavaScript cannot read, or with a flag it has no counterpart for, is left out.
+ * The player's `addonPatterns`.
+ * @param {unknown} addTo
+ * @returns {RegExp[]}
+ */
+function addonPatterns(addTo) {
+  const types = /** @type {{ content?: { types?: unknown } } | null | undefined} */ (addTo)?.content?.types
+  if (!Array.isArray(types)) return []
+  const patterns = []
+  for (const type of types) {
+    const source = type?.text?.regex
+    if (typeof source !== 'string' || source.length < 2) continue
+    const delimiter = source[0]
+    if (/[\p{L}\p{N}\\\s([{<]/u.test(delimiter)) continue
+    const end = source.lastIndexOf(delimiter)
+    const flags = source.slice(end + 1)
+    if (end < 1 || /[^imsu]/.test(flags)) continue
+    try {
+      patterns.push(new RegExp(source.slice(1, end), flags))
+    } catch {
+      // PCRE that JavaScript does not read.
+    }
+  }
+  return patterns
+}
+
+/**
+ * Whether a string anywhere in the parameters matches one of the patterns. The player's
+ * `textMatches`.
+ * @param {unknown} params
+ * @param {RegExp[]} patterns
+ */
+function textMatches(params, patterns) {
+  /** @param {unknown} value @param {number} depth @returns {boolean} */
+  const walk = (value, depth) => {
+    if (typeof value === 'string') return patterns.some((pattern) => pattern.test(value))
+    if (depth > 64 || !value || typeof value !== 'object') return false
+    return Object.values(value).some((child) => walk(child, depth + 1))
+  }
+  return patterns.length > 0 && walk(params, 0)
+}
+
+/**
+ * The library folders the package carries, each as its `library.json` says: the player's
+ * `ownLibraries` once every `library.json` is at hand. One that does not parse, or a folder named
+ * for another library, is left out.
+ * @param {Iterable<string>} names
+ * @param {(name: string) => Promise<unknown>} read
+ */
+async function ownLibraries(names, read) {
+  /** @param {unknown} part */
+  const version = (part) => (typeof part === 'number' && Number.isInteger(part) && part >= 0 ? part : typeof part === 'string' && /^\d+$/.test(part) ? Number(part) : null)
+  const libraries = []
+  for (const name of names) {
+    const slash = name.indexOf('/')
+    if (slash < 0 || name.slice(slash + 1) !== 'library.json') continue
+    const folder = name.slice(0, slash)
+    const library = /** @type {{ machineName?: unknown, majorVersion?: unknown, minorVersion?: unknown } | null} */ (await read(name).catch(() => null))
+    const major = version(library?.majorVersion)
+    const minor = version(library?.minorVersion)
+    const machineName = library?.machineName
+    if (typeof machineName !== 'string' || major === null || minor === null) continue
+    const versioned = /^(.+)-(\d+)\.(\d+)$/.exec(folder)
+    if (versioned ? versioned[1] !== machineName || Number(versioned[2]) !== major : folder !== machineName) continue
+    libraries.push({ folder, machineName, major, minor, dependencies: dependenciesIn(library) })
+  }
+  return libraries
+}
+
+/**
+ * The library pack's index, its `parts/index.json`, as the plan reads it. `entry` is the library's
+ * own record, which the zip's index repeats.
+ * @param {unknown} index
+ */
+function packLibraries(index) {
+  const list = /** @type {{ libraries?: unknown } | null} */ (index)?.libraries
+  return (Array.isArray(list) ? list : []).flatMap((entry) => {
+    const { folder, machineName, majorVersion, minorVersion, sha256, addTo } = entry ?? {}
+    return typeof folder === 'string' && typeof machineName === 'string' && Number.isInteger(majorVersion) && Number.isInteger(minorVersion) && typeof sha256 === 'string'
+      ? [{ folder, machineName, major: Number(majorVersion), minor: Number(minorVersion), sha256, dependencies: dependenciesIn(entry), addTo, entry: /** @type {object} */ (entry) }]
+      : []
+  })
+}
+
+/**
+ * The parts of the library pack the package needs, and the folders of its own they replace: the
+ * player's `planPack` (`sw/pack-plan.ts`) as the launch page has the element run it, filling gaps
+ * with nothing attached before (`refresh-libraries="off"`).
+ * - What the content asks for, and the package carries at that major and at no lower minor, plays
+ *   from the package. Anything else comes from the pack, which has one version of each major, and
+ *   so does whatever a part needs; an older minor the package carries gives way to the part.
+ * - Once anything comes from the pack, so do the addons whose pattern matches a string in the
+ *   parameters: H5P.MathDisplay, for LaTeX.
+ * @param {object} input
+ * @param {Awaited<ReturnType<typeof ownLibraries>>} input.own
+ * @param {{ machineName: string, major: number, minor: number }[]} input.roots what `h5p.json`
+ *   declares and the parameters name as sub-content
+ * @param {unknown} input.params
+ * @param {ReturnType<typeof packLibraries>} input.pack
+ */
+function planParts({ own, roots, params, pack }) {
+  const byLibrary = new Map(pack.map((library) => [`${library.machineName} ${library.major}`, library]))
+  /** @type {Map<string, ReturnType<typeof packLibraries>[number]>} */
+  const planned = new Map()
+  /** @type {string[]} */
+  const superseded = []
+  let carried = own
+  const queue = [...roots]
+  const seen = new Set()
+
+  /**
+   * @param {{ machineName: string, major: number, minor: number }} version
+   * @param {{ machineName: string, major: number, minor: number }} dependency
+   */
+  const satisfies = (version, dependency) =>
+    version.machineName === dependency.machineName && version.major === dependency.major && version.minor >= dependency.minor
+  /** @param {ReturnType<typeof packLibraries>[number]} library */
+  const plan = (library) => {
+    if (planned.has(library.folder)) return
+    planned.set(library.folder, library)
+    queue.push(...library.dependencies)
+  }
+  const follow = () => {
+    for (let next = queue.shift(); next; next = queue.shift()) {
+      const dependency = next
+      const key = `${dependency.machineName} ${dependency.major}.${dependency.minor}`
+      if (seen.has(key)) continue
+      seen.add(key)
+      const ownVersion = carried.find((library) => satisfies(library, dependency))
+      if (ownVersion) {
+        queue.push(...ownVersion.dependencies)
+        continue
+      }
+      if ([...planned.values()].some((library) => satisfies(library, dependency))) continue
+      const candidate = byLibrary.get(`${dependency.machineName} ${dependency.major}`)
+      if (!candidate || candidate.minor < dependency.minor) continue
+      const older = carried.find((library) => library.machineName === dependency.machineName && library.major === dependency.major)
+      if (older) {
+        carried = carried.filter((library) => library !== older)
+        superseded.push(older.folder)
+      }
+      plan(candidate)
+    }
+  }
+
+  follow()
+  if (planned.size > 0) {
+    for (const addon of pack) {
+      if (addon.addTo === undefined || carried.some((library) => library.machineName === addon.machineName)) continue
+      if (textMatches(params, addonPatterns(addon.addTo))) plan(addon)
+    }
+    follow()
+  }
+  return { parts: [...planned.values()].sort((a, b) => (a.folder < b.folder ? -1 : a.folder > b.folder ? 1 : 0)), superseded }
+}
+
+/** @param {string} text */
+const escapeXml = (text) =>
+  text.replace(/[&<>"']/g, (char) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&apos;' })[char] ?? char)
+
+/** @param {string} text */
+const escapeHtml = (text) => text.replace(/[&<>"]/g, (char) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' })[char] ?? char)
+
+/**
+ * The page's language: `h5p.json`'s `defaultLanguage` when it is a language tag, else English.
+ * @param {unknown} value
+ */
+function languageTag(value) {
+  return typeof value === 'string' && /^[a-z]{2,3}(?:-[a-z0-9]{1,8})*$/i.test(value) ? value : 'en'
+}
+
+/**
+ * The manifest, SCORM 1.2's: one organisation with one item, played by one SCO, the launch page.
+ * Every file is listed, which Moodle does not need and some LMSs do.
+ * @param {{ identifier: string, title: string, files: string[] }} manifest
+ */
+function manifestXml({ identifier, title, files }) {
+  const name = escapeXml(title)
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<manifest identifier="${identifier}" version="1.0"
+  xmlns="http://www.imsproject.org/xsd/imscp_rootv1p1p2"
+  xmlns:adlcp="http://www.adlnet.org/xsd/adlcp_rootv1p2">
+  <metadata>
+    <schema>ADL SCORM</schema>
+    <schemaversion>1.2</schemaversion>
+  </metadata>
+  <organizations default="organization">
+    <organization identifier="organization">
+      <title>${name}</title>
+      <item identifier="item" identifierref="sco" isvisible="true">
+        <title>${name}</title>
+      </item>
+    </organization>
+  </organizations>
+  <resources>
+    <resource identifier="sco" type="webcontent" adlcp:scormtype="sco" href="index.html">
+${files.map((file) => `      <file href="${escapeXml(file)}"/>`).join('\n')}
+    </resource>
+  </resources>
+</manifest>
+`
+}
+
+/** @param {{ version: string, source: string, pack: string | null }} zip `pack`, the library pack's version when the zip carries parts of it */
+function notice({ version, source, pack }) {
+  return `This is a SCORM 1.2 package written by @missing-elements/h5p-embed. It plays ${source} in an
+LMS and reports its score, its result and the time spent, and keeps the learner's place.
+
+  imsmanifest.xml   the package's manifest
+  index.html, scorm.js, embed.css
+                    the launch page and its bridge to the LMS: MIT
+  h5p-player.js, h5p-sw.js, h5p-jobs.js
+                    @missing-elements/h5p-offline-player ${version}: MIT. The Service Worker,
+                    h5p-sw.js, also carries zip.js, BSD-3-Clause, its licence in its header.
+  frame-assets/     @missing-elements/h5p-runtime, the H5P core runtime: GPL-3.0-only. Its
+                    LICENSE.txt and NOTICE.txt say what it is and where its source is; keep them
+                    with it.
+  ${PACKAGE}       the H5P package, its content and libraries under their own licences, which its
+                    h5p.json and each library's library.json name.
+${
+  pack
+    ? `  ${LIBRARIES}/        @missing-elements/h5p-libraries ${pack}, the H5P hub's libraries: those the package
+                    needs and does not carry, one archive per library and index.json, each under
+                    its own licence, listed in libraries.txt.
+`
+    : ''
+}
+https://github.com/missing-elements/h5p-offline-player/tree/main/packages/embed
+`
+}
+
+/**
+ * A file's SHA-256, read as a stream.
+ * @param {string} file
+ */
+function sha256(file) {
+  return new Promise((done, fail) => {
+    const hash = createHash('sha256')
+    createReadStream(file)
+      .on('data', (chunk) => hash.update(chunk))
+      .on('error', fail)
+      .on('end', () => done(hash.digest('hex')))
+  })
+}
+
+/**
+ * Every file under a folder, as zip paths relative to it, sorted.
+ * @param {string} dir
+ */
+async function filesUnder(dir) {
+  const files = []
+  for (const name of await readdir(dir, { recursive: true })) {
+    if ((await stat(join(dir, name))).isFile()) files.push(name.split(sep).join('/'))
+  }
+  return files.sort()
+}
+
+/**
+ * What `buildScorm` wrote, for a summary.
+ * @typedef {object} BuiltScorm
+ * @property {string} out the zip, as an absolute path
+ * @property {string} title the package's title, as the LMS lists it: `h5p.json`'s, or the file's name
+ * @property {string} version the player's version, as its `dist/VERSION` says
+ * @property {string[]} libraries the folders of the libraries the zip carries from the library
+ *   pack, for a package that does not carry them itself; none for one that does
+ * @property {string} build the first 16 hex digits of the package's SHA-256, or, with libraries
+ *   from the pack, of one over its and theirs: a learner's saved place is kept against it, and
+ *   handed back only to the same package playing with the same libraries
+ * @property {number} size the zip's size in bytes
+ */
+
+/**
+ * Writes a SCORM 1.2 zip that plays `h5p` in an LMS, with the parts of the library pack it needs
+ * and does not carry. Refuses a package that needs a library neither it nor the pack has, and a
+ * file already at `out` unless `force`.
+ *
+ * @param {object} options
+ * @param {string} options.h5p the package to wrap
+ * @param {string} options.out the zip to write
+ * @param {boolean} [options.force] replace a file already at `out`
+ * @returns {Promise<BuiltScorm>}
+ */
+export async function buildScorm({ h5p, out, force = false }) {
+  if (!h5p) throw new EmbedError('No package given.')
+  if (!out) throw new EmbedError('No output file given.')
+  const source = resolve(h5p)
+  const target = resolve(out)
+  if (source === target) throw new EmbedError(`${out} is the package itself. Name another file to write.`)
+  const sourceInfo = await stat(source).catch(() => null)
+  if (!sourceInfo?.isFile()) throw new EmbedError(`No such file: ${h5p}`)
+  const targetInfo = await stat(target).catch(() => null)
+  if (targetInfo?.isDirectory()) throw new EmbedError(`${out} is a folder. Name the zip to write.`)
+  if (targetInfo && !force) throw new EmbedError(`${out} exists. Pass --force to replace it.`)
+
+  const packDir = dirname(installed('@missing-elements/h5p-libraries/parts/index.json', 'Reinstall this package.'))
+  const pack = packLibraries(JSON.parse(await readFile(join(packDir, 'index.json'), 'utf8')))
+
+  // What the package declares and carries, and what the pack adds, read before anything is written.
+  /** @type {any} `h5p.json`, parsed */
+  let manifest
+  /** @type {ReturnType<typeof planParts>} */
+  let plan
+  let reader
+  try {
+    reader = new ZipReader(new BlobReader(await openAsBlob(source)))
+    // One unsafe name does not refuse the package, as it does not in the player, which leaves that
+    // entry out.
+    const entries = await reader.getEntries({ filenameValidation: 'tolerant' })
+    const byName = new Map(entries.filter((entry) => !entry.directory).map((entry) => [entry.filename, entry]))
+    /** @param {string} name */
+    const readJson = async (name) => {
+      const entry = byName.get(name)
+      if (!entry?.getData) throw new EmbedError(`${basename(h5p)} has no ${name}: it is not an H5P package.`)
+      const text = await entry.getData(new TextWriter())
+      try {
+        return JSON.parse(text)
+      } catch {
+        throw new EmbedError(`${basename(h5p)}: ${name} is not JSON.`)
+      }
+    }
+    manifest = await readJson('h5p.json')
+    if (dependenciesIn(manifest).length === 0) {
+      throw new EmbedError(`${basename(h5p)}: h5p.json names no libraries, so there is nothing to play.`)
+    }
+    const params = await readJson('content/content.json')
+    const roots = [...dependenciesIn(manifest), ...librariesNamedIn(params)]
+    plan = planParts({ own: await ownLibraries(byName.keys(), readJson), roots, params, pack })
+
+    // Held to its libraries as the player holds it once the parts are attached: the folders they
+    // replace withheld, and each part's `library.json` naming what its record in the index does.
+    const parts = new Map(plan.parts.map((part) => [`${part.folder}/library.json`, part.entry]))
+    const withheld = new Set(plan.superseded)
+    const names = new Set([...byName.keys()].filter((name) => !withheld.has(name.split('/')[0])))
+    for (const name of parts.keys()) names.add(name)
+    const missing = await missingLibraries(roots, names, async (name) => parts.get(name) ?? readJson(name))
+    if (missing.length > 0) {
+      const packed = new Map(pack.map((library) => [`${library.machineName} ${library.major}`, library]))
+      const listed = missing.map(({ machineName, major, minor }) => {
+        const older = packed.get(`${machineName} ${major}`)
+        return `${machineName} ${major}.${minor}${older ? ` (the pack has ${older.major}.${older.minor})` : ''}`
+      })
+      throw new EmbedError(
+        `${basename(h5p)} needs libraries that neither it nor the library pack carries: ${listed.join(', ')}. ` +
+          'Export the package with its libraries, as Lumi and the H5P plugins of Moodle, WordPress and Drupal do.'
+      )
+    }
+  } catch (error) {
+    if (error instanceof EmbedError) throw error
+    throw new EmbedError(`${basename(h5p)} could not be read as a zip archive: ${error instanceof Error ? error.message : error}`)
+  } finally {
+    await reader?.close()
+  }
+
+  // Control characters, which XML refuses, read as spaces: a title pasted in can carry one.
+  const named = typeof manifest.title === 'string' ? manifest.title.replace(/[\x00-\x1f\x7f]+/g, ' ').trim() : ''
+  const title = named || basename(h5p, extname(h5p))
+  // The learner's saved place is kept against the libraries too, as the player keeps it against
+  // the revision: a zip written with others starts learners over, as a refreshed package does.
+  const hashes = [await sha256(source), ...plan.parts.map((part) => part.sha256)]
+  const build = (hashes.length === 1 ? hashes[0] : createHash('sha256').update(hashes.join('\n')).digest('hex')).slice(0, 16)
+  const player = dirname(installed('@missing-elements/h5p-offline-player/dist/h5p-player.js', 'Run `pnpm build` in the workspace, or reinstall this package.'))
+  const runtime = dirname(installed('@missing-elements/h5p-runtime/dist/h5p.css', 'Run `pnpm build` in the workspace, or reinstall this package.'))
+  const version = (await readFile(join(player, 'VERSION'), 'utf8').catch(() => 'unknown')).trim()
+  const packVersion = plan.parts.length > 0 ? String(JSON.parse(await readFile(join(dirname(packDir), 'package.json'), 'utf8')).version) : null
+
+  const page = (await readFile(join(SCORM, 'index.html'), 'utf8'))
+    .replace('%LANG%', languageTag(manifest.defaultLanguage))
+    // A function, so that a title's `$&` or `$'` is written as it is rather than read as a pattern.
+    .replace('%TITLE%', () => escapeHtml(title))
+    .replace('%BUILD%', build)
+    // The element plans from the zip's index what the writer planned, and plays the package's own
+    // libraries as they are.
+    .replace('%LIBRARIES%', packVersion ? ` libraries="pack" pack-base="./${LIBRARIES}/" refresh-libraries="off"` : '')
+  /** @type {[string, { text: string } | { file: string }][]} zip path, and what it holds */
+  const files = [
+    ['index.html', { text: page }],
+    ['scorm.js', { file: join(SCORM, 'scorm.js') }],
+    ['embed.css', { file: join(SITE, 'embed.css') }],
+    ...PLAYER_FILES.map((name) => /** @type {[string, { file: string }]} */ ([name, { file: join(player, name) }])),
+    ...(await filesUnder(runtime)).map((name) => /** @type {[string, { file: string }]} */ ([`frame-assets/${name}`, { file: join(runtime, name) }])),
+    [PACKAGE, { file: source }]
+  ]
+  if (packVersion) {
+    files.push([`${LIBRARIES}/index.json`, { text: `${JSON.stringify({ libraries: plan.parts.map((part) => part.entry) }, null, 2)}\n` }])
+    for (const part of plan.parts) files.push([`${LIBRARIES}/${part.folder}.h5p`, { file: join(packDir, `${part.folder}.h5p`) }])
+    files.push(['libraries.txt', { file: join(dirname(packDir), 'libraries.txt') }])
+  }
+  files.push(['NOTICE.txt', { text: notice({ version, source: basename(h5p), pack: packVersion }) }])
+  const xml = manifestXml({ identifier: `h5p-${build}`, title, files: ['imsmanifest.xml', ...files.map(([name]) => name)] })
+
+  // Written beside the target and renamed into place, so a failure leaves no half-written zip.
+  const partial = `${target}.${process.pid}.partial`
+  try {
+    const zip = new ZipWriter(Writable.toWeb(createWriteStream(partial)))
+    await zip.add('imsmanifest.xml', new TextReader(xml))
+    for (const [name, content] of files) {
+      // The package, the pack's parts and the fonts are compressed already.
+      const level = name.endsWith('.h5p') || name.endsWith('.woff2') ? 0 : 6
+      await zip.add(name, 'text' in content ? new TextReader(content.text) : new BlobReader(await openAsBlob(content.file)), { level })
+    }
+    await zip.close()
+    await rename(partial, target)
+  } catch (error) {
+    await rm(partial, { force: true })
+    throw error
+  }
+
+  return { out: target, title, version, libraries: plan.parts.map((part) => part.folder), build, size: (await stat(target)).size }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@missing-elements/h5p-embed",
-  "version": "1.1.0",
-  "description": "Self-hosted H5P embeds: writes the H5P embed page as a static site for a player domain of your own, then any site frames it with an iframe and one script line. No H5P server, no third-party service; optional allowlists for package hosts and embedding sites.",
+  "version": "1.2.0",
+  "description": "Self-hosted H5P embeds: writes the H5P embed page as a static site for a player domain of your own, then any site frames it with an iframe and one script line; or wraps one .h5p as a SCORM 1.2 package an LMS plays and grades. No H5P server, no third-party service; optional allowlists for package hosts and embedding sites.",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -24,6 +24,10 @@
       "types": "./types/lib/build.d.mts",
       "default": "./lib/build.mjs"
     },
+    "./scorm": {
+      "types": "./types/lib/scorm.d.mts",
+      "default": "./lib/scorm.mjs"
+    },
     "./embed.js": {
       "types": "./types/site/embed.d.ts",
       "default": "./site/embed.js"
@@ -35,6 +39,7 @@
   "files": [
     "bin",
     "lib",
+    "scorm",
     "site",
     "types"
   ],
@@ -47,16 +52,19 @@
     "embed",
     "static-site",
     "elearning",
+    "scorm",
+    "lms",
+    "moodle",
     "cli"
   ],
   "dependencies": {
+    "@zip.js/zip.js": "^2.24.0",
     "@missing-elements/h5p-libraries": "^1.0.0",
-    "@missing-elements/h5p-runtime": "^1.0.0",
-    "@missing-elements/h5p-offline-player": "^1.1.1"
+    "@missing-elements/h5p-offline-player": "^1.1.1",
+    "@missing-elements/h5p-runtime": "^1.0.0"
   },
   "devDependencies": {
     "@types/node": "^26.6.5",
-    "@zip.js/zip.js": "^2.24.0",
     "playwright": "^1.64.1",
     "typescript": "^7.0.2",
     "vitest": "^5.0.5"

package/scorm/index.html

@@ -0,0 +1,21 @@
+<!doctype html>
+<html lang="%LANG%">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>%TITLE%</title>
+    <meta name="h5p-package-build" content="%BUILD%" />
+    <link rel="stylesheet" href="./embed.css" />
+    <script type="module" src="./h5p-player.js"></script>
+    <script type="module" src="./scorm.js"></script>
+  </head>
+
+  <body>
+    <div class="loader" id="loader" role="status">
+      <span class="spinner" aria-hidden="true"></span>
+      <span class="loader-text">Loading…</span>
+    </div>
+    <h5p-player%LIBRARIES%></h5p-player>
+    <p class="notice error" id="notice" role="alert" hidden></p>
+  </body>
+</html>

package/scorm/scorm.js

@@ -0,0 +1,176 @@
+/**
+ * The launch page's script in a SCORM 1.2 package `h5p-embed --scorm` writes: it finds the LMS's
+ * API, opens the session, and plays the package beside this page. The LMS hears what the content
+ * reports: its score and whether it passed when it finishes, the time spent, and the state it
+ * saves, which comes back on the next launch so the learner continues where they left off.
+ *
+ * Outside an LMS, with no API to find, it plays the package and reports nothing.
+ *
+ * @import { H5PPlayerElement, PlayerErrorDetail, PlayerStateChangeDetail, UserDataDetail } from '@missing-elements/h5p-offline-player'
+ */
+
+/**
+ * The SCORM 1.2 API, as far as this page calls it: every call takes and returns strings.
+ * @typedef {object} ScormApi
+ * @property {(empty: string) => string} LMSInitialize
+ * @property {(empty: string) => string} LMSFinish
+ * @property {(element: string) => string} LMSGetValue
+ * @property {(element: string, value: string) => string} LMSSetValue
+ * @property {(empty: string) => string} LMSCommit
+ */
+
+/** What SCORM 1.2 keeps of `cmi.suspend_data`: a `CMIString4096`. */
+const SUSPEND_DATA_LIMIT = 4096
+
+/**
+ * The `API` object an LMS puts in a window above the content, searched from `start` up to its top
+ * window (the run-time environment's discovery, 3.3.6.1).
+ * @param {Window | null} start
+ * @returns {ScormApi | null}
+ */
+function findApi(start) {
+  let win = start
+  for (let hops = 0; win && hops < 10; hops++) {
+    try {
+      const api = /** @type {{ API?: ScormApi }} */ (/** @type {unknown} */ (win)).API
+      if (api) return api
+    } catch {
+      // A window on another origin holds nothing this page can call.
+    }
+    if (win.parent === win) break
+    win = win.parent
+  }
+  return null
+}
+
+/**
+ * `cmi.core.session_time`'s format, a `CMITimespan`: hours, minutes and seconds to the hundredth.
+ * @param {number} ms
+ */
+function timespan(ms) {
+  const hundredths = Math.max(0, Math.round(ms / 10))
+  const hours = Math.floor(hundredths / 360000)
+  const minutes = Math.floor(hundredths / 6000) % 60
+  const seconds = (hundredths % 6000) / 100
+  return `${String(hours).padStart(2, '0')}:${String(minutes).padStart(2, '0')}:${seconds.toFixed(2).padStart(5, '0')}`
+}
+
+/**
+ * A `finished` statement's result as SCORM 1.2 records it: the score out of 100, and the status,
+ * `passed` or `failed` when the content says whether it was passed, `completed` when it does not.
+ * @param {{ score?: { scaled?: unknown, raw?: unknown, max?: unknown }, success?: unknown } | undefined} result
+ */
+function scormResult(result) {
+  const score = result?.score ?? {}
+  const scaled =
+    typeof score.scaled === 'number'
+      ? score.scaled
+      : typeof score.raw === 'number' && typeof score.max === 'number' && score.max > 0
+        ? score.raw / score.max
+        : null
+  return {
+    raw: scaled === null ? null : String(Math.round(Math.min(Math.max(scaled, 0), 1) * 10000) / 100),
+    status: result?.success === true ? 'passed' : result?.success === false ? 'failed' : 'completed'
+  }
+}
+
+/** The package's build, as the writer stamped it: what saved state is kept against. */
+const build = document.querySelector('meta[name="h5p-package-build"]')?.getAttribute('content') ?? ''
+const player = /** @type {H5PPlayerElement} */ (document.querySelector('h5p-player'))
+const loader = /** @type {HTMLElement} */ (document.getElementById('loader'))
+const notice = /** @type {HTMLElement} */ (document.getElementById('notice'))
+
+const api = findApi(window) ?? (window.opener ? findApi(window.opener) : null)
+const started = Date.now()
+/** Whether the LMS accepted the session; nothing is reported to one that did not. */
+const initialized = api ? String(api.LMSInitialize('')) === 'true' : false
+
+/** @param {string} element */
+const get = (element) => (initialized && api ? String(api.LMSGetValue(element)) : '')
+/** @param {string} element @param {string} value */
+const set = (element, value) => initialized && api !== null && String(api.LMSSetValue(element, value)) === 'true'
+const commit = () => initialized && api !== null && String(api.LMSCommit('')) === 'true'
+
+if (initialized) {
+  const status = get('cmi.core.lesson_status')
+  if (status === 'not attempted' || status === '') set('cmi.core.lesson_status', 'incomplete')
+}
+
+/*
+ * The learner's place. The content saves its state through the element (`resume="host"`), and
+ * the whole of it goes into `cmi.suspend_data`, stamped with the package's build so that a teacher
+ * who replaces the package does not hand its learners state saved against another one.
+ */
+
+/** @type {Map<string, { dataType: string, subContentId: string, data: string }>} */
+const saved = new Map()
+
+if (initialized) {
+  try {
+    const kept = JSON.parse(get('cmi.suspend_data') || 'null')
+    if (build && kept?.build === build && Array.isArray(kept.entries)) {
+      for (const [dataType, subContentId, data] of kept.entries) {
+        if (typeof data === 'string') saved.set(`${dataType}\n${subContentId}`, { dataType: String(dataType), subContentId: String(subContentId), data })
+      }
+    }
+  } catch {
+    // Not ours, or cut short by an LMS: the content starts over.
+  }
+  player.setAttribute('resume', 'host')
+  player.userData = [...saved.values()]
+}
+
+player.addEventListener('userdata', (event) => {
+  const { dataType, subContentId, data } = /** @type {CustomEvent<UserDataDetail>} */ (event).detail
+  const key = `${dataType}\n${subContentId}`
+  if (data === null) saved.delete(key)
+  else saved.set(key, { dataType, subContentId, data })
+  const value = JSON.stringify({ build, entries: [...saved.values()].map((entry) => [entry.dataType, entry.subContentId, entry.data]) })
+  // A state larger than SCORM 1.2 keeps is not saved, rather than saved cut short; the last one
+  // that fitted stays.
+  if (value.length <= SUSPEND_DATA_LIMIT && set('cmi.suspend_data', value)) commit()
+})
+
+/*
+ * The result. The content's last `finished` is its result, as on an H5P site: a learner who
+ * retries replaces it.
+ */
+let finished = false
+
+player.addEventListener('finished', (event) => {
+  if (!initialized) return
+  const { raw, status } = scormResult(/** @type {CustomEvent<{ statement?: { result?: any } }>} */ (event).detail?.statement?.result)
+  if (raw !== null) {
+    set('cmi.core.score.min', '0')
+    set('cmi.core.score.max', '100')
+    set('cmi.core.score.raw', raw)
+  }
+  set('cmi.core.lesson_status', status)
+  set('cmi.core.session_time', timespan(Date.now() - started))
+  finished = true
+  commit()
+})
+
+// The session ends with the page. Unfinished, it is suspended, so the next launch resumes it.
+let ended = false
+addEventListener('pagehide', () => {
+  if (!initialized || ended || !api) return
+  ended = true
+  set('cmi.core.session_time', timespan(Date.now() - started))
+  set('cmi.core.exit', finished ? '' : 'suspend')
+  api.LMSFinish('')
+})
+
+player.addEventListener('statechange', (event) => {
+  const { state } = /** @type {CustomEvent<PlayerStateChangeDetail>} */ (event).detail
+  if (state === 'ready' || state === 'error') loader.hidden = true
+})
+
+player.addEventListener('error', (event) => {
+  // After `ready` the content is up and an error leaves it running.
+  if (player.state === 'ready') return
+  notice.textContent = /** @type {CustomEvent<PlayerErrorDetail>} */ (/** @type {unknown} */ (event)).detail.message
+  notice.hidden = false
+})
+
+player.setAttribute('src', new URL('./package.h5p', location.href).href)

package/site/embed.js

@@ -256,6 +256,22 @@ export function startEmbed({ packBase = null, pack = null, librariesPack = null,
     }
   }
 
+  /**
+   * A package's address as the element is given it: resolved against this page, and only when it
+   * is `http` or `https`. `null` for anything else, a `javascript:` or `data:` URL or text that is
+   * not a URL. The element gets the parsed URL's `href`, never the text, so `src` holds what was
+   * checked.
+   * @param {string} value
+   */
+  const packageUrl = (value) => {
+    try {
+      const url = new URL(value, location.href)
+      return url.protocol === 'http:' || url.protocol === 'https:' ? url : null
+    } catch {
+      return null
+    }
+  }
+
   const allowed = packages ? new Set(packages) : null
   /**
    * Whether this player was told it may fetch from `origin`. Always true without a list.
@@ -355,11 +371,12 @@ export function startEmbed({ packBase = null, pack = null, librariesPack = null,
     refuse('No package given. Add ?src=<url of a .h5p file> to the address.', 'no-src')
     return
   }
-  const origin = urlOrigin(src)
-  if (!origin) {
-    refuse('The package address is not a URL.')
+  const address = packageUrl(src)
+  if (!address) {
+    refuse('The package address is not an http or https URL.')
     return
   }
+  const { origin } = address
   if (!permitted(origin)) {
     refuse(`This player does not play packages from ${origin}.`)
     return
@@ -375,14 +392,14 @@ export function startEmbed({ packBase = null, pack = null, librariesPack = null,
   // A host on the list was vouched for when the site was set up, and in another site's frame the
   // storage is that site's own: those play as they are.
   if (origin === location.origin || allowed || !sharesOriginStorage()) {
-    start(src, sources.value)
+    start(address.href, sources.value)
     return
   }
 
   // Anything else from another origin would share this origin's storage. It plays untrusted, as
   // data with the library pack's code and none of its own, and waits for a click that names the
   // host only when it cannot play without its own, or there is no pack to play it with.
-  const host = new URL(src, location.href).host || origin
+  const { host } = address
   askToTrust = () => {
     loader.hidden = true
     const button = document.createElement('button')
@@ -393,7 +410,7 @@ export function startEmbed({ packBase = null, pack = null, librariesPack = null,
       loader.hidden = false
       player.untrusted = false
       player.removeAttribute('src')
-      start(src, sources.value)
+      start(address.href, sources.value)
     })
     say(
       `This package from ${host} plays only with its own scripts. They would run on this site and ` +
@@ -411,5 +428,5 @@ export function startEmbed({ packBase = null, pack = null, librariesPack = null,
     return
   }
   player.untrusted = true
-  start(src, sitesSources)
+  start(address.href, sitesSources)
 }

package/types/lib/scorm.d.mts

@@ -0,0 +1,58 @@
+export type BuiltScorm = {
+    /**
+     * the zip, as an absolute path
+     */
+    out: string;
+    /**
+     * the package's title, as the LMS lists it: `h5p.json`'s, or the file's name
+     */
+    title: string;
+    /**
+     * the player's version, as its `dist/VERSION` says
+     */
+    version: string;
+    /**
+     * the folders of the libraries the zip carries from the library
+     * pack, for a package that does not carry them itself; none for one that does
+     */
+    libraries: string[];
+    /**
+     * the first 16 hex digits of the package's SHA-256, or, with libraries
+     * from the pack, of one over its and theirs: a learner's saved place is kept against it, and
+     * handed back only to the same package playing with the same libraries
+     */
+    build: string;
+    /**
+     * the zip's size in bytes
+     */
+    size: number;
+};
+/**
+ * What `buildScorm` wrote, for a summary.
+ * @typedef {object} BuiltScorm
+ * @property {string} out the zip, as an absolute path
+ * @property {string} title the package's title, as the LMS lists it: `h5p.json`'s, or the file's name
+ * @property {string} version the player's version, as its `dist/VERSION` says
+ * @property {string[]} libraries the folders of the libraries the zip carries from the library
+ *   pack, for a package that does not carry them itself; none for one that does
+ * @property {string} build the first 16 hex digits of the package's SHA-256, or, with libraries
+ *   from the pack, of one over its and theirs: a learner's saved place is kept against it, and
+ *   handed back only to the same package playing with the same libraries
+ * @property {number} size the zip's size in bytes
+ */
+/**
+ * Writes a SCORM 1.2 zip that plays `h5p` in an LMS, with the parts of the library pack it needs
+ * and does not carry. Refuses a package that needs a library neither it nor the pack has, and a
+ * file already at `out` unless `force`.
+ *
+ * @param {object} options
+ * @param {string} options.h5p the package to wrap
+ * @param {string} options.out the zip to write
+ * @param {boolean} [options.force] replace a file already at `out`
+ * @returns {Promise<BuiltScorm>}
+ */
+export declare function buildScorm({ h5p, out, force }: {
+    h5p: string;
+    out: string;
+    force?: boolean;
+}): Promise<BuiltScorm>;