#10 feat: a build page for h5p-author sources

Closes #9

What

/build: a source an AI chat wrote with the h5p-author skill becomes a .h5p in the user's browser. It's for a chat whose sandbox cannot install the build tool, as in ChatGPT.

• Source in: pasted (a Markdown code fence around it is fine), opened from a .json file, or carried by the link: /build#source=<base64url>, holding the JSON or the JSON compressed with raw deflate. The fragment is never sent to a server. A linked source builds at once, unless it names files of its own.
• Build: @missing-elements/h5p-author/browser, the same build as the command's. Its libraries come from @missing-elements/h5p-libraries/install's pack, which Vite emits here one part per library. A build fetches only the parts its package needs, and the package carries the editor libraries an H5P site's upload check wants.
• Problems: listed by path. Copy the problems for the chat puts them on the clipboard as text the chat can act on.
• Files the source names by name (pictures, recordings) are chosen by the user and matched by file name. Web addresses are fetched where the host allows CORS.
• Out: the package plays in <h5p-player> on the page, and Download <title>.h5p saves it.

Files: build.html, src/build-page.ts (the wiring), src/build-source.ts (no DOM: the fragment, the named files, the chat text, the file name), src/build.css, and vite.config.ts gains the page as a second input under the same CSP. The README has a section on the page.

Dependencies

Brought up to date so the page plays with the pack the author package pins: player 1.1.1 → 1.5.1, embed 1.1.0 → 1.7.0, libraries ^1.0.0 → 1.1.0, runtime 1.0.0 → 1.0.1, plus @missing-elements/h5p-author 0.5.0. pnpm resolves one copy of each. This makes Dependabot's #6 and #7 unnecessary. src/h5p-page.ts is unchanged.

Testing

• pnpm typecheck, pnpm build, pnpm e2e: 10 passed, the 6 existing player tests and 4 new ones in e2e/build.spec.ts:
  • a pasted, fenced source builds, plays and downloads as rivers.h5p, a zip that carries H5PEditor.*, with nothing fetched off the origin;
  • a source with problems lists each by path, and the copied text is checked; non-JSON text is one problem;
  • a link builds at once, both deflated and plain;
  • a source naming pictures/delta.png waits for the file, then builds with it (1 media file).
  • Every test fails on a console error, a page error or a CSP report.
• The skill's own one-liner (node -e … deflateRawSync … base64url) on a True/False source made a 255-character link, which built and played on the local build with no errors.
• Screenshots at 390 px light and 1280 px dark: no horizontal scroll.

Not verified: the deployed page on GitHub Pages, and ChatGPT itself opening a link (expected to work, since it's an ordinary link).

Order

Deploy this before the skill change in missing-elements/h5p-offline-player (SKILL.md step 3) reaches users, or the skill's link will 404.