v0.5.0

Four packages ship together in this release: @missing-elements/h5p-offline-player 0.5.0,
and three that are new or follow it — @missing-elements/h5p-runtime 0.1.0,
@missing-elements/h5p-libraries 0.1.0 and @missing-elements/h5p-verify 0.1.1.
h5p-normalize and h5p-cmi5 are unchanged.

The player is MIT, and the H5P runtime is a package of its own

The H5P core runtime the frame loads is GPL-3.0. Up to 0.4 the player shipped it under
dist/frame-assets/ and was published as (MIT AND GPL-3.0-only). From 0.5 the player carries
none of it: the runtime, its stylesheet and fonts, and the script that boots it inside the frame
are @missing-elements/h5p-runtime, under the GPL, and the player's package is MIT alone.
The element and its workers exchange HTTP and postMessage with the runtime and nothing else.
What serving the runtime entails is in that package's NOTICE.md.

This is a breaking change for every setup. The element no longer finds the runtime by
itself; tell it where the runtime is:

• Setup A, with a bundler. Install the runtime and hand its export to the element before
  setting src:

  npm install @missing-elements/h5p-offline-player @missing-elements/h5p-runtime

  import '@missing-elements/h5p-offline-player'
  import { runtime } from '@missing-elements/h5p-runtime'
  
  document.querySelector('h5p-player').runtime = runtime

• Setup B, no build step. Add assets-base pointing at the runtime on the CDN:

  <h5p-player src="…" sw="/h5p-sw.js"
              assets-base="https://cdn.jsdelivr.net/npm/@missing-elements/h5p-runtime/dist/"></h5p-player>

• A served dist/. Copy the runtime package's dist/ to frame-assets/ beside
  h5p-player.js, which is where the element looks when told nothing. Keep LICENSE.txt and
  NOTICE.txt with it.

Without one of these the frame requests frame-assets/… beside the element's own script,
404s, and never reaches ready.

New on the element: the runtime property (the runtime package's export; wins over
assets-base). assets-base now means "the directory the runtime's dist/ is served from".
FrameAssets gained bootJs; a record written by an older element has none, and the worker
then looks for frame-boot.js beside main.bundle.js. The player names the runtime as an
optional peer dependency, so a package manager says when the two are out of step.

A published library bundle, and libraries as an ordered list

Exports from h5p.com and h5p.org carry no libraries. The pack the installable app carried for
them is now @missing-elements/h5p-libraries: the H5P hub's runtime libraries for every
content type it serves, 98 libraries from 52 content types, about 10 MB, with libraries.txt
listing each one's licence and authors. From jsDelivr it is versioned and sent with CORS; with
a bundler, import libraries from '@missing-elements/h5p-libraries/libraries.h5p?url'.

libraries takes several sources separated by spaces, tried in order. The recommended value
is the bundle with the hub behind it:

<h5p-player src="stripped.h5p"
            libraries="https://cdn.jsdelivr.net/npm/@missing-elements/h5p-libraries@0/libraries.h5p hub"></h5p-player>

The hub is asked only for what the bundle lacks — a newer minor, a content type added since —
and a source that cannot be reached is passed over while another remains. A single hub or a
single URL works as before. The reason: the only hub host that sends CORS is the one H5P Group
has superseded, so a site that depended on libraries="hub" alone depended on it staying up.
Full account in docs/libraries.md.

The demo's /embed page takes libraries=pack for the site's own copy of the bundle.

Also in this release

• Embed My. Setup C now points at Embed My, a separate service
  built on the player that writes the iframe snippet with a live preview; the README, the setup
  guide and the demo name its page and sizing script, and a new agent skill, h5p-embed-my,
  covers embedding through it. The demo's /embed and /resizer.js remain for sites that
  frame this origin.
• iOS and Safari are supported without a version floor; the "before 26, untested" wording
  is gone from the docs. A framed player that fails on an earlier release is a bug to report.
• The demo site sends nothing to any analytics endpoint; analytics.js is removed.
• h5p-verify 0.1.1 serves the runtime from its own package; it needs
  @missing-elements/h5p-runtime installed beside the player, which npm does for you.

For contributors

• packages/runtime/: scripts/build.mjs (the former sync-h5p-assets) vendors h5p-standalone
  into dist/, builds src/frame-boot.ts and writes the generated index.js. The player's
  sync:assets builds it and copies dist/ to public/frame-assets/.
• packages/libraries/: the pack and libraries.txt, committed; pnpm libraries rebuilds them
  (was pnpm demo:libraries).
• The player's dist/ has no frame-assets/; h5p-standalone is the runtime's dependency now,
  not the player's. scripts/copy-frame-assets.mjs and the virtual:h5p-frame-boot plugin are
  gone, and the frame document emits <script nonce src> for the boot script.
• The boot script's JSON block and the messages it posts are now a contract between two packages.
  A change to either side means a change to the other, and a player release names the runtime
  versions it works with.