@missing-elements/h5p-offline-player 0.1.0 → 0.1.2

package/NOTICE.md

@@ -0,0 +1,83 @@
+# Third-party notices
+
+`@missing-elements/h5p-offline-player` is published under `(MIT AND GPL-3.0-only)`. The
+parenthesis is deliberate: the player's own code is MIT, and the package also ships code that is
+not. This file says which is which.
+
+## The player's own code — MIT
+
+`dist/h5p-player.js`, `dist/h5p-sw.js`, `dist/h5p-sw-mount.js`, `types/` and everything under
+`src/` and `scripts/` in the repository: MIT, see [LICENSE](LICENSE).
+
+## zip.js — BSD-3-Clause
+
+The three scripts in `dist/` bundle [zip.js](https://github.com/gildas-lormeau/zip.js) as the
+archive reader. They are minified with legal comments removed, so its notice does not survive
+into the files themselves and is reproduced here instead, as its licence requires:
+
+```
+BSD 3-Clause License
+
+Copyright (c) 2023, Gildas Lormeau
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+```
+
+## The H5P runtime in `dist/frame-assets/` — GPL-3.0
+
+`dist/frame-assets/` is the runtime the element loads inside its frame, copied unmodified from
+[h5p-standalone](https://github.com/tunapanda/h5p-standalone) 3.8.2. h5p-standalone's own
+code is MIT (Copyright (c) 2015 Tunapanda), but `frame.bundle.js` is built from the H5P core
+scripts in its `vendor/h5p/js/` — `h5p.js`, `h5p-event-dispatcher.js`, `h5p-x-api.js`,
+`h5p-x-api-event.js`, `h5p-content-type.js`, `h5p-confirmation-dialog.js`, `request-queue.js`,
+`h5p-action-bar.js`, `h5p-tooltip.js` — which come from
+[h5p/h5p-php-library](https://github.com/h5p/h5p-php-library), licensed under the
+**GNU General Public License v3.0**. The core stylesheet (`styles/h5p.css`, `styles/h5p-fonts.css`),
+the `h5p-*` icon fonts and `images/` come from the same repository. Upstream confirmed this in
+[tunapanda/h5p-standalone#188](https://github.com/tunapanda/h5p-standalone/issues/188); its npm
+metadata still says MIT.
+
+The full licence text is in [licenses/GPL-3.0.txt](licenses/GPL-3.0.txt) and, so that it travels
+with the files, in `dist/frame-assets/LICENSE.txt`; `dist/frame-assets/NOTICE.txt` lists the
+files. Keep both beside the directory when you copy or serve it. Corresponding source:
+<https://github.com/tunapanda/h5p-standalone/tree/v3.8.2> (`src/` and `vendor/h5p/`).
+h5p-standalone does not record which h5p-php-library revision `vendor/h5p/` was taken from.
+
+Also inside `dist/frame-assets/`:
+
+- jQuery 3.5.1, in `frame.bundle.js` — MIT, Copyright JS Foundation and other contributors,
+  <https://jquery.org/license>.
+- regenerator-runtime, in `main.bundle.js` — MIT, see `main.bundle.js.LICENSE.txt`.
+- Inter, `fonts/inter/` — SIL Open Font License 1.1, see `fonts/inter/LICENSE.txt`.
+- Open Sans, `fonts/open-sans/` — SIL Open Font License 1.1, see `fonts/open-sans/OFL.txt`.
+
+## What this means for a site
+
+A site that serves `frame-assets/` to browsers is distributing GPL-3.0 code, with what that
+entails for keeping the notices and making the source available; the notice and the tag above
+are what it needs. Whether the copyleft reaches the page around the player is a legal question
+this file does not answer: the element and its workers exchange only messages and HTTP with the
+runtime, while the small boot script runs in the same document and calls its API.

package/README.md

@@ -1,5 +1,8 @@
 # @missing-elements/h5p-offline-player
 
+[![npm](https://img.shields.io/npm/v/%40missing-elements%2Fh5p-offline-player)](https://www.npmjs.com/package/@missing-elements/h5p-offline-player)
+[![licence](https://img.shields.io/npm/l/%40missing-elements%2Fh5p-offline-player)](LICENSE)
+
 > **Not production ready.** This is an early release under active development. The API, the
 > worker protocol and the cache layout can still change between versions, and the browser
 > coverage is Chromium first. Try it, report what breaks, but do not put it in front of learners
@@ -22,10 +25,6 @@ The player is three things: the element (`h5p-player.js`, an ES module), a Servi
 has to be served from **your own origin**, because browsers refuse to register a worker from
 anywhere else. The other two can come from your bundle or from a CDN.
 
-> The package is being published to npm. Until it lands, build it from source: `git clone`,
-> `npm install`, `npm run build`, and serve `dist/` where the snippets below say the package's
-> files go.
-
 **A · With a bundler** (Vite, webpack 5, Rollup):
 
 ```bash
@@ -85,7 +84,9 @@ reads the archive in place and answers the H5P runtime's requests out of it:
 - the archive's **central directory** is read over HTTP `Range` requests, so a 300 MB package
   costs a few kilobytes before it starts;
 - **large spans are pulled by several connections at once** and reassembled in order, because a
-  single connection is often capped well below the link;
+  single connection is often capped well below the link — the first one streams straight into
+  the inflate, and the others open once it flows, so a slow link still sees its first bytes
+  within a second or two;
 - **small entries and scripts** are inflated once into a Cache API store;
 - **large stored media** is sliced straight out of the archive — never extracted, never stored;
 - **large deflated media** is inflated into 8 MB chunks by a page-side worker, and served
@@ -212,7 +213,7 @@ Properties: `src`, `file` (a `File` from a picker — setting it loads), `pkgId`
 | `progress` | Download or extraction progress, `fraction` 0–1 (or `null` when the total is unknown) |
 | `resize` | The content's height changed |
 | `statechange` | `state` changed |
-| `error` | `code`: `no-cors`, `no-worker`, `network`, `quota`, `bad-archive`, `runtime` |
+| `error` | `code`: `no-cors`, `no-worker`, `network`, `quota`, `bad-archive`, `runtime`. A `runtime` error after `ready` leaves `state` at `ready`: the content threw but is still running |
 
 ```js
 const player = document.querySelector('h5p-player')
@@ -234,6 +235,10 @@ no "open in another browser" banner. Those belong to the host page, built out of
 - `h5p-sw.js` is served from the site's own origin — browsers reject cross-origin Service Worker
   registration. With a bundler this is automatic. Frame assets may come from a CDN.
 - Package URLs send CORS headers. `Range` support is optional but avoids a full download first.
+- Storage is optional on a host that honours `Range`, and for a file picked from disk: the
+  player caches what fits and serves the rest straight from the archive. A host without `Range`
+  makes it a requirement — the whole archive has to be stored — and a package larger than the
+  room the browser gives the site is refused with `error: quota`, naming the size it needed.
 
 Integration details, including bundler-specific setup and single-worker hosts, are in
 [h5p-player-setup.md](h5p-player-setup.md). The design is in
@@ -269,5 +274,19 @@ Working on the code? Start with [AGENTS.md](AGENTS.md).
 
 ## Licence
 
-MIT. Bundles [h5p-standalone](https://github.com/tunapanda/h5p-standalone) (MIT) as the runtime
-and [zip.js](https://github.com/gildas-lormeau/zip.js) (BSD-3-Clause) as the archive reader.
+The player's own code — the element, the two workers, the scripts — is MIT, see
+[LICENSE](LICENSE). The package as published is not MIT alone, and its `license` field says so:
+`(MIT AND GPL-3.0-only)`.
+
+- `dist/frame-assets/` is the H5P core runtime, copied unmodified from
+  [h5p-standalone](https://github.com/tunapanda/h5p-standalone). h5p-standalone's own code is
+  MIT, but its `frame.bundle.js`, stylesheet and icon fonts come from
+  [h5p-php-library](https://github.com/h5p/h5p-php-library), which is **GPL-3.0**; upstream
+  confirms it in [issue #188](https://github.com/tunapanda/h5p-standalone/issues/188) while
+  its npm metadata still says MIT. The directory carries its own `LICENSE.txt` and `NOTICE.txt`.
+  Keep them with it when you copy or serve it: a site serving these files is distributing GPL
+  code. Whether the copyleft reaches the page around the player is a legal question, not one
+  this README answers.
+- The three scripts in `dist/` bundle [zip.js](https://github.com/gildas-lormeau/zip.js)
+  (BSD-3-Clause). Minification strips its notice from the files, so
+  [NOTICE.md](NOTICE.md) reproduces it.

package/dist/VERSION

@@ -1 +1 @@
-0.1.0
+0.1.2