[alekswebnet]

Closes #24.

The README is now a short router, 55 lines where it was 116, and each part's detail is a page in docs/, as it was written, with the sentences that were out of date fixed.

What changes

• README.md says what the site serves (a table of paths, with each one's source and page), how the three /h5p/ pages divide the work between the chats that use them, how to run the site, how it is built and deployed, and what it pins and how a pin moves.
• docs/pdfjs-viewer.md, docs/h5p-build-page.md (with the type files, and the measurements under their own heading), docs/h5p-bundles.md and docs/h5p-skill.md hold the old README's sections, moved with their text. Their links now resolve from docs/.
• Fixed where the text was behind:
  • embed-my.github.io's /build is a redirect that keeps the fragment, no longer "becomes".
  • The skill page also lists the build tool and every bundle, and SKILL.md sends a chat that has its text alone there first (0.9.1).
  • The type files are served twice, under /h5p/build/types/ and /h5p/skill/references/types/, from the same package.
  • The bundles' sizes: the largest is H5P.KewArCode's, 8.4 MB, and a container's (Branching Scenario's) 7.7 MB.
  • pnpm typecheck is listed, and what each pinned package moves.
  • Three sentences cubic found wrong, which came from the old README, are corrected: "Nothing leaves the browser" is now "The source is not uploaded" (the browser fetches the web addresses a source names), the Try button rewrites the first https://missing-elements.github.io of a snippet to the origin the docs run on (localUrl), and GitHub Pages cannot send a Content-Security-Policy header, where it was said to send no headers.
• The build page's source editor (#27) is written up in docs/h5p-build-page.md, as A JSON editor on the build page, where the textarea only shows the source #27 makes it. Its two files are named there, not linked, so no link depends on the order the two merge in; the section is true once A JSON editor on the build page, where the textarea only shows the source #27 is in.

Checked

Every claim that stayed was read against the source: the commands and ports, the workflows, the pins in package.json, .github/dependabot.yml, pnpm-workspace.yaml, the #source= fragment, the Try buttons, the player's h5p/ sub-scope, and the live site (the embed-my redirect and its /bundles/, the bundle sizes from index.json). Of the old README's 38 blocks, 17 are in the new files word for word and 21 are headings, links, tables or sentences edited as above. Every relative link and anchor in the new files resolves. No code changes.

[cubic-dev-ai]

1 issue found across 5 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="docs/h5p-build-page.md">

<violation number="1" location="docs/h5p-build-page.md:5">
P2: The build fetches media from source URLs in the visitor's browser, so those requests leave the browser. Replace “Nothing leaves the browser” with a source-upload guarantee and disclose the remote fetch.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: The build fetches media from source URLs in the visitor's browser, so those requests leave the browser. Replace “Nothing leaves the browser” with a source-upload guarantee and disclose the remote fetch.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At docs/h5p-build-page.md, line 5:

<comment>The build fetches media from source URLs in the visitor's browser, so those requests leave the browser. Replace “Nothing leaves the browser” with a source-upload guarantee and disclose the remote fetch.</comment>

<file context>
@@ -0,0 +1,41 @@
+
+`/h5p/build/` is for an AI chat that wrote a source with the [h5p-author skill](https://github.com/missing-elements/h5p-offline-player/tree/main/skills/h5p-author) but cannot build it. ChatGPT's sandbox reaches npm only through OpenAI's own mirror, which was reported refusing every install from July 2026, so `npx @missing-elements/h5p-author` does not run there, and the skill hands over the source and this page's address instead. The page builds with `@missing-elements/h5p-author/browser`, the same build as the command's, and lists every problem at once by its path, ready to copy back into the chat with [the type files](#the-type-files) that chat lacked. Its libraries are `@missing-elements/h5p-libraries/install`'s pack, one part per library, so a build fetches only the parts its package needs and carries the editor libraries an H5P site's upload check asks for. The package then plays in the player on the page, and downloads from it. Why it exists, and what was measured to build it this way: [design/author.md](https://github.com/missing-elements/h5p-offline-player/blob/main/design/author.md) of h5p-offline-player, under *Where `npx` cannot install, a page builds*.
+
+Nothing leaves the browser. A link can carry the source in its fragment, which no server sees: `/h5p/build/#source=<base64url>`, the bytes being the source's JSON as UTF-8, or that JSON compressed with raw deflate (Node's `zlib.deflateRawSync`, Python's `zlib.compressobj(wbits=-15)`) to keep the link short. A linked source is built at once, unless it names files of its own, which only the person can choose. A source that names a picture by web address gets it only where that host allows CORS.
+
+| File | What it holds |
</file context>

Suggested change

Nothing leaves the browser. A link can carry the source in its fragment, which no server sees: `/h5p/build/#source=<base64url>`, the bytes being the source's JSON as UTF-8, or that JSON compressed with raw deflate (Node's `zlib.deflateRawSync`, Python's `zlib.compressobj(wbits=-15)`) to keep the link short. A linked source is built at once, unless it names files of its own, which only the person can choose. A source that names a picture by web address gets it only where that host allows CORS.

The source is not uploaded. A link can carry the source in its fragment, which no server sees: `/h5p/build/#source=<base64url>`, the bytes being the source's JSON as UTF-8, or that JSON compressed with raw deflate (Node's `zlib.deflateRawSync`, Python's `zlib.compressobj(wbits=-15)`) to keep the link short. A linked source is built at once, unless it names files of its own, which only the person can choose. A source that names a picture by web address sends a request to that host, and gets it only where that host allows CORS.