@lessonkit/lxpack 1.2.0 → 1.3.1

package/dist/index.js

@@ -134,6 +134,14 @@ function parseAssessmentDescriptor(raw) {
       correctTargetIds: Array.isArray(raw.correctTargetIds) ? raw.correctTargetIds.filter((id) => typeof id === "string") : []
     };
   }
+  if (typeof kind === "string" && kind !== "mcq" && kind !== "trueFalse" && kind !== "fillInBlanks" && kind !== "findHotspot" && kind !== "findMultipleHotspots") {
+    return {
+      kind,
+      ...base,
+      choices: [],
+      answer: ""
+    };
+  }
   return {
     kind: kind === "mcq" ? "mcq" : void 0,
     ...base,
@@ -183,10 +191,11 @@ function parseCourseDescriptorInput(input) {
 
 // src/descriptor/validateCourse.ts
 import { validateId as validateId3 } from "@lessonkit/core";
+import { validateTheme } from "@lessonkit/themes";
 
 // src/spaPath.ts
-import { realpathSync } from "fs";
-import { isAbsolute, relative, resolve, sep, win32 } from "path";
+import { existsSync, realpathSync } from "fs";
+import { isAbsolute, join, relative, resolve, sep, win32 } from "path";
 function resolveComparablePath(p) {
   if (/^[a-zA-Z]:[/\\]/.test(p)) {
     return win32.resolve(p);
@@ -212,6 +221,28 @@ function assertResolvedPathUnderRoot(root, target) {
     throw new Error(`unsafe path escapes project root: ${target}`);
   }
 }
+function resolveExistingPathUnderRoot(rootReal, rootResolved, targetResolved) {
+  const rel = relative(rootResolved, targetResolved);
+  if (rel.startsWith("..") || rel.includes(`..${sep}`)) {
+    throw new Error(`unsafe path escapes project root: ${targetResolved}`);
+  }
+  const segments = rel.split(/[/\\]/).filter((s) => s.length > 0 && s !== ".");
+  let current = rootReal;
+  for (const segment of segments) {
+    const next = join(current, segment);
+    if (existsSync(next)) {
+      try {
+        current = realpathSync(next);
+      } catch {
+        current = next;
+      }
+    } else {
+      current = next;
+    }
+    assertResolvedPathUnderRoot(rootReal, current);
+  }
+  return current;
+}
 function assertRealPathUnderRoot(root, target) {
   const rootResolved = resolveComparablePath(root);
   const targetResolved = resolveComparablePath(target);
@@ -221,17 +252,12 @@ function assertRealPathUnderRoot(root, target) {
   } catch {
     rootReal = rootResolved;
   }
-  let targetCheck;
   try {
-    targetCheck = realpathSync(targetResolved);
+    const targetCheck = realpathSync(targetResolved);
+    assertResolvedPathUnderRoot(rootReal, targetCheck);
   } catch {
-    const rel = relative(rootResolved, targetResolved);
-    if (rel.startsWith("..") || rel.includes(`..${sep}`)) {
-      throw new Error(`unsafe path escapes project root: ${target}`);
-    }
-    targetCheck = resolve(rootReal, rel);
+    resolveExistingPathUnderRoot(rootReal, rootResolved, targetResolved);
   }
-  assertResolvedPathUnderRoot(rootReal, targetCheck);
 }
 function normalizePathForComparison(p) {
   const resolved = resolveComparablePath(p);
@@ -272,7 +298,12 @@ function themeToLxpackRuntime(input) {
 // src/descriptor/validateAssessments.ts
 import { validateId as validateId2 } from "@lessonkit/core";
 var validateMcqLike = (assessment, path, issues) => {
-  if (!("choices" in assessment) || !("answer" in assessment) || typeof assessment.answer !== "string") {
+  if (!("choices" in assessment) || !Array.isArray(assessment.choices)) {
+    issues.push({ path: `${path}.choices`, message: "choices is required for mcq" });
+    return;
+  }
+  if (!("answer" in assessment) || typeof assessment.answer !== "string") {
+    issues.push({ path: `${path}.answer`, message: "answer is required for mcq" });
     return;
   }
   const trimmedChoices = assessment.choices.map((c) => c.trim()).filter((c) => c.length > 0);
@@ -285,6 +316,22 @@ var validateMcqLike = (assessment, path, issues) => {
     issues.push({ path: `${path}.answer`, message: "answer must match a choice" });
   }
 };
+function countStarDelimitedBlanks(template) {
+  const matches = template.match(/\*[^*]+\*/g);
+  return matches?.length ?? 0;
+}
+function maxAchievableAssessmentScore(assessment) {
+  const kind = assessment.kind ?? "mcq";
+  if (kind === "fillInBlanks" && assessment.kind === "fillInBlanks") {
+    const explicit = assessment.blanks?.filter((b) => b?.id?.trim() && b?.answer?.trim()).length ?? 0;
+    if (explicit > 0) return explicit;
+    return countStarDelimitedBlanks(assessment.template ?? "");
+  }
+  if (kind === "findMultipleHotspots" && assessment.kind === "findMultipleHotspots") {
+    return assessment.correctTargetIds?.map((id) => id.trim()).filter((id) => id.length > 0).length ?? 0;
+  }
+  return 1;
+}
 var ASSESSMENT_VALIDATORS = {
   mcq: validateMcqLike,
   trueFalse: (assessment, path, issues) => {
@@ -297,9 +344,33 @@ var ASSESSMENT_VALIDATORS = {
       issues.push({ path: `${path}.template`, message: "template is required for fillInBlanks" });
     }
   },
-  findHotspot: () => {
+  findHotspot: (assessment, path, issues) => {
+    if (assessment.kind !== "findHotspot") return;
+    if (!assessment.src?.trim()) {
+      issues.push({ path: `${path}.src`, message: "src is required for findHotspot" });
+    }
+    if (!assessment.alt?.trim()) {
+      issues.push({ path: `${path}.alt`, message: "alt is required for findHotspot" });
+    }
+    if (!assessment.correctTargetId?.trim()) {
+      issues.push({ path: `${path}.correctTargetId`, message: "correctTargetId is required for findHotspot" });
+    }
   },
-  findMultipleHotspots: () => {
+  findMultipleHotspots: (assessment, path, issues) => {
+    if (assessment.kind !== "findMultipleHotspots") return;
+    if (!assessment.src?.trim()) {
+      issues.push({ path: `${path}.src`, message: "src is required for findMultipleHotspots" });
+    }
+    if (!assessment.alt?.trim()) {
+      issues.push({ path: `${path}.alt`, message: "alt is required for findMultipleHotspots" });
+    }
+    const ids = assessment.correctTargetIds?.map((id) => id.trim()).filter((id) => id.length > 0) ?? [];
+    if (!ids.length) {
+      issues.push({
+        path: `${path}.correctTargetIds`,
+        message: "at least one non-empty correctTargetId is required for findMultipleHotspots"
+      });
+    }
   }
 };
 function validateAssessmentEntry(assessment, index, issues, checkIds) {
@@ -315,14 +386,38 @@ function validateAssessmentEntry(assessment, index, issues, checkIds) {
   if (!assessment.question?.trim()) {
     issues.push({ path: `${path}.question`, message: "question is required" });
   }
+  const knownKinds = Object.keys(ASSESSMENT_VALIDATORS);
+  if (assessment.kind !== void 0 && assessment.kind !== "mcq" && !knownKinds.includes(assessment.kind)) {
+    issues.push({
+      path: `${path}.kind`,
+      message: `unknown kind; use one of: ${knownKinds.join(", ")}`
+    });
+    return;
+  }
   const kind = assessment.kind ?? "mcq";
-  ASSESSMENT_VALIDATORS[kind](assessment, path, issues);
+  const validator = ASSESSMENT_VALIDATORS[kind];
+  if (!validator) {
+    issues.push({
+      path: `${path}.kind`,
+      message: `unknown kind; use one of: ${knownKinds.join(", ")}`
+    });
+    return;
+  }
+  validator(assessment, path, issues);
   const passingScore = assessment.passingScore;
   if (passingScore !== void 0 && !(Number.isFinite(passingScore) && passingScore > 0)) {
     issues.push({
       path: `${path}.passingScore`,
       message: "passingScore must be greater than 0 (absolute point threshold)"
     });
+  } else if (passingScore !== void 0) {
+    const maxAchievable = maxAchievableAssessmentScore(assessment);
+    if (maxAchievable > 0 && passingScore > maxAchievable) {
+      issues.push({
+        path: `${path}.passingScore`,
+        message: `passingScore cannot exceed achievable score (${maxAchievable}) for this assessment kind`
+      });
+    }
   }
 }
 
@@ -356,13 +451,23 @@ function validateCourseDescriptor(input) {
     });
   }
   if (input.theme?.theme) {
-    try {
-      themeToLxpackRuntime({ preset: themePreset, theme: input.theme.theme });
-    } catch (err) {
-      issues.push({
-        path: "theme.theme",
-        message: err instanceof Error ? err.message : "invalid custom theme"
-      });
+    const themeResult = validateTheme(input.theme.theme);
+    if (!themeResult.ok) {
+      for (const issue of themeResult.issues) {
+        issues.push({
+          path: issue.path ? `theme.theme.${issue.path}` : "theme.theme",
+          message: issue.message
+        });
+      }
+    } else {
+      try {
+        themeToLxpackRuntime({ preset: themePreset, theme: themeResult.theme });
+      } catch (err) {
+        issues.push({
+          path: "theme.theme",
+          message: err instanceof Error ? err.message : "invalid custom theme"
+        });
+      }
     }
   }
   const completionThreshold = input.tracking?.completion?.threshold;
@@ -433,19 +538,102 @@ function validateCourseDescriptor(input) {
   return issues;
 }
 
+// src/assessments.ts
+function slugChoiceId(text, index) {
+  const base = text.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 32);
+  const stem = base.length ? base : "choice";
+  return `${stem}-${index + 1}`;
+}
+function mcqToLxpack(assessment) {
+  const choices = assessment.choices.map((text, index) => {
+    const id = slugChoiceId(text, index);
+    return {
+      id,
+      text,
+      correct: text === assessment.answer
+    };
+  });
+  return {
+    id: assessment.checkId,
+    passingScore: assessment.passingScore ?? 1,
+    questions: [
+      {
+        id: "q1",
+        prompt: assessment.question,
+        choices
+      }
+    ]
+  };
+}
+function assessmentDescriptorToLxpack(assessment) {
+  const kind = assessment.kind ?? "mcq";
+  if (kind === "trueFalse" && assessment.kind === "trueFalse") {
+    const choices = ["True", "False"];
+    const answerText = assessment.answer ? "True" : "False";
+    return mcqToLxpack({
+      kind: "mcq",
+      checkId: assessment.checkId,
+      question: assessment.question,
+      choices,
+      answer: answerText,
+      passingScore: assessment.passingScore
+    });
+  }
+  if (kind === "fillInBlanks") {
+    return null;
+  }
+  if (kind === "findHotspot" && assessment.kind === "findHotspot") {
+    return mcqToLxpack({
+      kind: "mcq",
+      checkId: assessment.checkId,
+      question: assessment.question,
+      choices: [assessment.correctTargetId, "other"],
+      answer: assessment.correctTargetId,
+      passingScore: assessment.passingScore
+    });
+  }
+  if (kind === "findMultipleHotspots") {
+    return null;
+  }
+  if ("choices" in assessment && "answer" in assessment && typeof assessment.answer === "string") {
+    return mcqToLxpack(assessment);
+  }
+  return null;
+}
+function extractAssessments(descriptor) {
+  return (descriptor.assessments ?? []).map(assessmentDescriptorToLxpack).filter((a) => a !== null);
+}
+
 // src/descriptor/validateForTarget.ts
+var LMS_SHELL_TARGETS = /* @__PURE__ */ new Set([
+  "scorm12",
+  "scorm2004",
+  "standalone",
+  "xapi",
+  "cmi5"
+]);
 function validateDescriptorForExportTarget(descriptor, target) {
-  if (target !== "xapi" && target !== "cmi5") return [];
-  const activityIri = descriptor.tracking?.xapi?.activityIri?.trim();
-  if (!activityIri) {
-    return [
-      {
+  const issues = [];
+  if (target === "xapi" || target === "cmi5") {
+    const activityIri = descriptor.tracking?.xapi?.activityIri?.trim();
+    if (!activityIri) {
+      issues.push({
         path: "course.tracking.xapi.activityIri",
         message: "tracking.xapi.activityIri is required for xapi and cmi5 export targets"
+      });
+    }
+  }
+  if (LMS_SHELL_TARGETS.has(target)) {
+    (descriptor.assessments ?? []).forEach((assessment, index) => {
+      if (assessmentDescriptorToLxpack(assessment) === null) {
+        issues.push({
+          path: `assessments[${index}]`,
+          message: `assessment kind "${assessment.kind ?? "mcq"}" (checkId "${assessment.checkId}") is not injected into LMS shell quizzes for target "${target}"`
+        });
       }
-    ];
+    });
   }
-  return [];
+  return issues;
 }
 
 // src/validateDescriptor.ts
@@ -471,6 +659,112 @@ function validateDescriptorForTarget(input, target) {
   return result;
 }
 
+// src/validateReactParity.ts
+import { readFileSync, existsSync as existsSync2, readdirSync, statSync } from "fs";
+import { join as join2, relative as relative2 } from "path";
+var SCANNABLE_EXTENSIONS = [".tsx", ".ts", ".jsx", ".js"];
+function collectSourceUnderSrc(projectRoot) {
+  const srcDir = join2(projectRoot, "src");
+  if (!existsSync2(srcDir)) return [];
+  const results = [];
+  const walk = (dir) => {
+    for (const entry of readdirSync(dir)) {
+      const abs = join2(dir, entry);
+      if (statSync(abs).isDirectory()) {
+        walk(abs);
+      } else if (SCANNABLE_EXTENSIONS.some((ext) => entry.endsWith(ext))) {
+        results.push(relative2(projectRoot, abs));
+      }
+    }
+  };
+  walk(srcDir);
+  return results;
+}
+function readAppSources(projectRoot, appSources) {
+  return appSources.map((rel) => join2(projectRoot, rel)).filter((abs) => existsSync2(abs)).map((abs) => readFileSync(abs, "utf8")).join("\n");
+}
+function stripComments(source) {
+  return source.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/\/\/[^\n]*/g, " ");
+}
+function idPropPatterns(prop, id) {
+  return [
+    `${prop}="${id}"`,
+    `${prop}='${id}'`,
+    `${prop}={'${id}'}`,
+    `${prop}={"${id}"}`,
+    `${prop}={\`${id}\`}`
+  ];
+}
+function extractStringConstants(source) {
+  const stripped = stripComments(source);
+  const map = /* @__PURE__ */ new Map();
+  const re = /(?:export\s+)?(?:const|let|var)\s+(\w+)\s*=\s*(["'`])((?:\\.|(?!\2).)*)\2/g;
+  for (const match of stripped.matchAll(re)) {
+    map.set(match[1], match[3]);
+  }
+  return map;
+}
+function idUsedViaConstant(stripped, prop, id, constants) {
+  for (const [name, value] of constants) {
+    if (value !== id) continue;
+    const jsxPatterns = [
+      `${prop}={${name}}`,
+      `${prop}={ ${name} }`,
+      `${prop}={${name} }`,
+      `${prop}={ ${name}}`
+    ];
+    if (jsxPatterns.some((p) => stripped.includes(p))) return true;
+    const objPatterns = [`${prop}: ${name}`, `${prop}:${name}`];
+    if (objPatterns.some((p) => stripped.includes(p))) return true;
+  }
+  return false;
+}
+function courseIdPresent(source, courseId) {
+  const stripped = stripComments(source);
+  if (idPropPatterns("courseId", courseId).some((p) => stripped.includes(p))) return true;
+  return idUsedViaConstant(stripped, "courseId", courseId, extractStringConstants(source));
+}
+function checkIdPresent(source, checkId) {
+  const stripped = stripComments(source);
+  if (idPropPatterns("checkId", checkId).some((p) => stripped.includes(p))) return true;
+  return idUsedViaConstant(stripped, "checkId", checkId, extractStringConstants(source));
+}
+function validateReactManifestParity(opts) {
+  const appSources = opts.appSources ?? collectSourceUnderSrc(opts.projectRoot);
+  const source = readAppSources(opts.projectRoot, appSources);
+  const hasDescriptorIds = Boolean(opts.descriptor.courseId) || (opts.descriptor.assessments?.length ?? 0) > 0;
+  if (!source.trim()) {
+    return [
+      {
+        path: appSources.length > 0 ? appSources.join(", ") : "src/",
+        message: hasDescriptorIds ? "React app source not found for ID parity check" : "React app source not found for ID parity check",
+        severity: hasDescriptorIds ? "error" : "warning"
+      }
+    ];
+  }
+  const issues = [];
+  const courseId = opts.descriptor.courseId;
+  if (!courseIdPresent(source, courseId)) {
+    issues.push({
+      path: "course.courseId",
+      message: `React app source does not reference courseId="${courseId}" from lessonkit.json`,
+      severity: "error"
+    });
+  }
+  for (const assessment of opts.descriptor.assessments ?? []) {
+    const checkId = assessment.checkId;
+    if (!checkId) continue;
+    if (!checkIdPresent(source, checkId)) {
+      issues.push({
+        path: `assessments.checkId:${checkId}`,
+        message: `React app source missing checkId="${checkId}" declared in lessonkit.json`,
+        severity: "error"
+      });
+    }
+  }
+  return issues;
+}
+
 // src/validateProjectPaths.ts
 import { isAbsolute as isAbsolute2, resolve as resolve2 } from "path";
 function validatePathField(value, fieldPath, projectRoot, issues) {
@@ -534,72 +828,6 @@ function mapLessonkitIds(descriptor) {
   return { courseId, lessonIds, checkIds };
 }
 
-// src/assessments.ts
-function slugChoiceId(text, index) {
-  const base = text.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 32);
-  const stem = base.length ? base : "choice";
-  return `${stem}-${index + 1}`;
-}
-function mcqToLxpack(assessment) {
-  const choices = assessment.choices.map((text, index) => {
-    const id = slugChoiceId(text, index);
-    return {
-      id,
-      text,
-      correct: text === assessment.answer
-    };
-  });
-  return {
-    id: assessment.checkId,
-    passingScore: assessment.passingScore ?? 1,
-    questions: [
-      {
-        id: "q1",
-        prompt: assessment.question,
-        choices
-      }
-    ]
-  };
-}
-function assessmentDescriptorToLxpack(assessment) {
-  const kind = assessment.kind ?? "mcq";
-  if (kind === "trueFalse" && assessment.kind === "trueFalse") {
-    const choices = ["True", "False"];
-    const answerText = assessment.answer ? "True" : "False";
-    return mcqToLxpack({
-      kind: "mcq",
-      checkId: assessment.checkId,
-      question: assessment.question,
-      choices,
-      answer: answerText,
-      passingScore: assessment.passingScore
-    });
-  }
-  if (kind === "fillInBlanks") {
-    return null;
-  }
-  if (kind === "findHotspot" && assessment.kind === "findHotspot") {
-    return mcqToLxpack({
-      kind: "mcq",
-      checkId: assessment.checkId,
-      question: assessment.question,
-      choices: [assessment.correctTargetId, "other"],
-      answer: assessment.correctTargetId,
-      passingScore: assessment.passingScore
-    });
-  }
-  if (kind === "findMultipleHotspots") {
-    return null;
-  }
-  if ("choices" in assessment && "answer" in assessment && typeof assessment.answer === "string") {
-    return mcqToLxpack(assessment);
-  }
-  return null;
-}
-function extractAssessments(descriptor) {
-  return (descriptor.assessments ?? []).map(assessmentDescriptorToLxpack).filter((a) => a !== null);
-}
-
 // src/interchange.ts
 function mapDescriptorTracking(tracking) {
   if (!tracking) return void 0;
@@ -660,12 +888,12 @@ function descriptorToInterchange(descriptor) {
 }
 
 // src/writeProject.ts
-import { join as join2, resolve as resolve4 } from "path";
+import { join as join4, resolve as resolve4 } from "path";
 import { materializeLessonkitProject } from "@lxpack/validators";
 
 // src/spaDirs.ts
 import { access } from "fs/promises";
-import { join, resolve as resolve3 } from "path";
+import { join as join3, resolve as resolve3 } from "path";
 async function resolveSpaDirs(options) {
   const { descriptor, spaDistDir, lessonSpaDirs, projectRoot } = options;
   const spaLessons = resolveSpaLessons(descriptor);
@@ -682,9 +910,9 @@ async function resolveSpaDirs(options) {
       throw new Error(`spaDistDir not found: ${srcDist}`);
     }
     try {
-      await access(join(srcDist, "index.html"));
+      await access(join3(srcDist, "index.html"));
     } catch {
-      throw new Error(`spaDistDir must contain index.html: ${join(srcDist, "index.html")}`);
+      throw new Error(`spaDistDir must contain index.html: ${join3(srcDist, "index.html")}`);
     }
     const lessonId = spaLessons[0]?.id ?? /* v8 ignore next */
     "main";
@@ -707,10 +935,10 @@ async function resolveSpaDirs(options) {
       throw new Error(`lessonSpaDirs path not found for lesson "${lesson.id}": ${resolved}`);
     }
     try {
-      await access(join(resolved, "index.html"));
+      await access(join3(resolved, "index.html"));
     } catch {
       throw new Error(
-        `lessonSpaDirs must contain index.html for lesson "${lesson.id}": ${join(resolved, "index.html")}`
+        `lessonSpaDirs must contain index.html for lesson "${lesson.id}": ${join3(resolved, "index.html")}`
       );
     }
     dirs[lesson.id] = resolved;
@@ -747,13 +975,13 @@ async function writeLxpackProject(options) {
   const courseDir = materialized.courseDir;
   return {
     outDir: courseDir,
-    courseYamlPath: join2(courseDir, "course.yaml"),
-    lessonkitJsonPath: join2(courseDir, "lessonkit.json")
+    courseYamlPath: join4(courseDir, "course.yaml"),
+    lessonkitJsonPath: join4(courseDir, "lessonkit.json")
   };
 }
 
 // src/packageCourse.ts
-import { resolve as resolve6 } from "path";
+import { resolve as resolve7 } from "path";
 import * as fsp3 from "fs/promises";
 import {
   buildCourse,
@@ -761,48 +989,75 @@ import {
 } from "@lxpack/api";
 
 // src/packaging/validateInputs.ts
-import { isAbsolute as isAbsolute3, join as join3, resolve as resolve5, win32 as win322 } from "path";
+import { isAbsolute as isAbsolute3, join as join5, resolve as resolve5, win32 as win322 } from "path";
 function validatePackageInputs(options) {
   const { target, output, outputBaseDir } = options;
   const outDir = resolve5(options.outDir);
-  const projectRoot = options.projectRoot ? resolve5(options.projectRoot) : void 0;
-  if (projectRoot) {
-    try {
-      assertRealPathUnderRoot(projectRoot, outDir);
-    } catch (err) {
-      return {
-        ok: false,
-        courseDir: outDir,
-        target,
-        issues: [
-          {
-            path: "outDir",
-            message: (
-              /* v8 ignore next */
-              err instanceof Error ? err.message : String(err)
-            )
-          }
-        ]
-      };
-    }
+  if (!options.projectRoot) {
+    return {
+      ok: false,
+      courseDir: outDir,
+      target,
+      issues: [{ path: "projectRoot", message: "projectRoot is required for packageLessonkitCourse" }]
+    };
   }
-  if (outputBaseDir && !isSafeRelativeSpaPath(outputBaseDir)) {
+  const projectRoot = resolve5(options.projectRoot);
+  try {
+    assertRealPathUnderRoot(projectRoot, outDir);
+  } catch (err) {
     return {
       ok: false,
       courseDir: outDir,
       target,
-      issues: [{ path: "outputBaseDir", message: `unsafe outputBaseDir: ${outputBaseDir}` }]
+      issues: [
+        {
+          path: "outDir",
+          message: (
+            /* v8 ignore next */
+            err instanceof Error ? err.message : String(err)
+          )
+        }
+      ]
     };
   }
-  if (output && !projectRoot && !isSafeRelativeSpaPath(output)) {
+  if (outputBaseDir && !isSafeRelativeSpaPath(outputBaseDir)) {
     return {
       ok: false,
       courseDir: outDir,
       target,
-      issues: [{ path: "output", message: `unsafe output: ${output}` }]
+      issues: [{ path: "outputBaseDir", message: `unsafe outputBaseDir: ${outputBaseDir}` }]
     };
   }
-  if (projectRoot && outputBaseDir) {
+  if (output && !isSafeRelativeSpaPath(output)) {
+    if (isAbsolute3(output)) {
+      try {
+        assertRealPathUnderRoot(projectRoot, resolve5(output));
+      } catch (err) {
+        return {
+          ok: false,
+          courseDir: outDir,
+          target,
+          issues: [
+            {
+              path: "output",
+              message: (
+                /* v8 ignore next */
+                err instanceof Error ? err.message : `unsafe output: ${output}`
+              )
+            }
+          ]
+        };
+      }
+    } else {
+      return {
+        ok: false,
+        courseDir: outDir,
+        target,
+        issues: [{ path: "output", message: `unsafe output: ${output}` }]
+      };
+    }
+  }
+  if (outputBaseDir) {
     const resolvedOutputBase = resolve5(projectRoot, outputBaseDir);
     try {
       assertRealPathUnderRoot(projectRoot, resolvedOutputBase);
@@ -823,8 +1078,8 @@ function validatePackageInputs(options) {
       };
     }
   }
-  if (projectRoot && output) {
-    const resolvedOutput = resolve5(projectRoot, output);
+  if (output) {
+    const resolvedOutput = isAbsolute3(output) ? resolve5(output) : resolve5(projectRoot, output);
     try {
       assertRealPathUnderRoot(projectRoot, resolvedOutput);
     } catch (err) {
@@ -861,23 +1116,23 @@ function remapArtifactPaths(stagingRoot, outDir, artifactPath) {
   if (!artifactPath) return void 0;
   const resolved = resolveComparablePath(artifactPath);
   if (!isResolvedPathUnderRoot(stagingRoot, resolved)) {
-    return artifactPath;
+    throw new Error(`${artifactPath} is outside the staging directory`);
   }
   const rel = relativePathUnderRoot(stagingRoot, resolved);
   if (rel.startsWith("..") || isAbsolute3(rel)) {
-    return artifactPath;
+    throw new Error(`${artifactPath} is outside the staging directory`);
   }
   if (!rel) return outDir;
   if (/^[a-zA-Z]:[/\\]/.test(outDir)) {
     return win322.join(outDir, rel.replace(/\//g, win322.sep));
   }
-  return join3(outDir, rel);
+  return join5(outDir, rel);
 }
 
 // src/packaging/promote.ts
 import * as fsp from "fs/promises";
-import { randomUUID } from "crypto";
-import { dirname, join as join4 } from "path";
+import { createHash, randomUUID } from "crypto";
+import { dirname, join as join6, resolve as resolve6 } from "path";
 async function pathExists(path) {
   try {
     await fsp.access(path);
@@ -896,6 +1151,69 @@ async function renameOrCopy(from, to) {
     await fsp.rm(from, { recursive: true, force: true });
   }
 }
+function promoteLockPath(outDir) {
+  const parent = dirname(outDir);
+  const hash = createHash("sha256").update(resolve6(outDir)).digest("hex").slice(0, 16);
+  return join6(parent, `.lk-promote-lock-${hash}`);
+}
+var STALE_LOCK_TTL_MS = 5 * 60 * 1e3;
+async function isStalePromoteLock(lockPath) {
+  try {
+    const content = await fsp.readFile(lockPath, "utf8");
+    const pid = Number.parseInt(content.trim(), 10);
+    if (Number.isFinite(pid) && pid > 0) {
+      try {
+        process.kill(pid, 0);
+        return false;
+      } catch {
+        return true;
+      }
+    }
+    const stat2 = await fsp.stat(lockPath);
+    return Date.now() - stat2.mtimeMs > STALE_LOCK_TTL_MS;
+  } catch {
+    return true;
+  }
+}
+async function withPromoteLock(outDir, fn) {
+  const lockPath = promoteLockPath(outDir);
+  await fsp.mkdir(dirname(outDir), { recursive: true });
+  let lockHandle;
+  for (let attempt = 0; attempt < 200; attempt++) {
+    try {
+      lockHandle = await fsp.open(lockPath, "wx");
+      await lockHandle.writeFile(`${process.pid}
+`, "utf8");
+      break;
+    } catch (err) {
+      const code = err && typeof err === "object" && "code" in err ? String(err.code) : "";
+      if (code !== "EEXIST") throw err;
+      if (await isStalePromoteLock(lockPath)) {
+        await fsp.rm(lockPath, { force: true }).catch(
+          /* v8 ignore next */
+          () => void 0
+        );
+        continue;
+      }
+      await new Promise((resolveWait) => setTimeout(resolveWait, 25));
+    }
+  }
+  if (!lockHandle) {
+    throw new Error(`[lessonkit/lxpack] timed out acquiring promote lock for ${outDir}`);
+  }
+  try {
+    return await fn();
+  } finally {
+    await lockHandle.close().catch(
+      /* v8 ignore next */
+      () => void 0
+    );
+    await fsp.rm(lockPath, { force: true }).catch(
+      /* v8 ignore next */
+      () => void 0
+    );
+  }
+}
 async function assertNoLegacyPromoteArtifacts(outDir) {
   const legacyTmp = `${outDir}.tmp-promote`;
   const legacyBak = `${outDir}.bak`;
@@ -909,45 +1227,57 @@ async function assertNoLegacyPromoteArtifacts(outDir) {
   }
 }
 async function promoteStagingToOutDir(stagingDir, outDir) {
-  await assertNoLegacyPromoteArtifacts(outDir);
-  const parent = dirname(outDir);
-  const tmpPromote = await fsp.mkdtemp(join4(parent, ".lk-promote-"));
-  await renameOrCopy(stagingDir, tmpPromote);
-  const hadOutDir = await pathExists(outDir);
-  const backup = hadOutDir ? await fsp.mkdtemp(join4(parent, ".lk-backup-")) : void 0;
-  if (hadOutDir && backup) {
-    await renameOrCopy(outDir, backup);
-  }
-  try {
-    await renameOrCopy(tmpPromote, outDir);
-  } catch (promoteError) {
+  return withPromoteLock(outDir, async () => {
+    await assertNoLegacyPromoteArtifacts(outDir);
+    const parent = dirname(outDir);
+    const tmpPromote = await fsp.mkdtemp(join6(parent, ".lk-promote-"));
+    await renameOrCopy(stagingDir, tmpPromote);
+    const hadOutDir = await pathExists(outDir);
+    const backup = hadOutDir ? await fsp.mkdtemp(join6(parent, ".lk-backup-")) : void 0;
     if (hadOutDir && backup) {
-      try {
-        await renameOrCopy(backup, outDir);
-      } catch (restoreError) {
-        const failedPromote2 = join4(parent, `.lk-failed-promote-${randomUUID()}`);
+      await renameOrCopy(outDir, backup);
+    }
+    try {
+      await renameOrCopy(tmpPromote, outDir);
+    } catch (promoteError) {
+      if (hadOutDir && backup) {
+        try {
+          await renameOrCopy(backup, outDir);
+        } catch (restoreError) {
+          const failedPromote2 = join6(parent, `.lk-failed-promote-${randomUUID()}`);
+          try {
+            await renameOrCopy(tmpPromote, failedPromote2);
+          } catch {
+            await fsp.rm(tmpPromote, { recursive: true, force: true }).catch(
+              /* v8 ignore next */
+              () => void 0
+            );
+          }
+          const promoteMsg = promoteError instanceof Error ? promoteError.message : String(promoteError);
+          const restoreMsg = restoreError instanceof Error ? restoreError.message : String(restoreError);
+          throw new Error(
+            `[lessonkit/lxpack] promote failed (${promoteMsg}) and could not restore ${outDir} (${restoreMsg}). Recovery: previous output may be in ${backup}; staged package may be in ${failedPromote2}.`
+          );
+        }
+      } else {
         try {
-          await renameOrCopy(tmpPromote, failedPromote2);
-        } catch {
+          await renameOrCopy(tmpPromote, stagingDir);
+        } catch (restoreError) {
+          console.warn(
+            `[lessonkit/lxpack] failed to restore ${stagingDir} after promote error:`,
+            restoreError instanceof Error ? restoreError.message : restoreError
+          );
           await fsp.rm(tmpPromote, { recursive: true, force: true }).catch(
             /* v8 ignore next */
             () => void 0
           );
         }
-        const promoteMsg = promoteError instanceof Error ? promoteError.message : String(promoteError);
-        const restoreMsg = restoreError instanceof Error ? restoreError.message : String(restoreError);
-        throw new Error(
-          `[lessonkit/lxpack] promote failed (${promoteMsg}) and could not restore ${outDir} (${restoreMsg}). Recovery: previous output may be in ${backup}; staged package may be in ${failedPromote2}.`
-        );
+        throw promoteError;
       }
-    } else {
+      const failedPromote = join6(parent, `.lk-failed-promote-${randomUUID()}`);
       try {
-        await renameOrCopy(tmpPromote, stagingDir);
-      } catch (restoreError) {
-        console.warn(
-          `[lessonkit/lxpack] failed to restore ${stagingDir} after promote error:`,
-          restoreError instanceof Error ? restoreError.message : restoreError
-        );
+        await renameOrCopy(tmpPromote, failedPromote);
+      } catch {
         await fsp.rm(tmpPromote, { recursive: true, force: true }).catch(
           /* v8 ignore next */
           () => void 0
@@ -955,33 +1285,23 @@ async function promoteStagingToOutDir(stagingDir, outDir) {
       }
       throw promoteError;
     }
-    const failedPromote = join4(parent, `.lk-failed-promote-${randomUUID()}`);
-    try {
-      await renameOrCopy(tmpPromote, failedPromote);
-    } catch {
-      await fsp.rm(tmpPromote, { recursive: true, force: true }).catch(
+    if (backup) {
+      await fsp.rm(backup, { recursive: true, force: true }).catch(
         /* v8 ignore next */
         () => void 0
       );
     }
-    throw promoteError;
-  }
-  if (backup) {
-    await fsp.rm(backup, { recursive: true, force: true }).catch(
-      /* v8 ignore next */
-      () => void 0
-    );
-  }
+  });
 }
 
 // src/packaging/staging.ts
 import * as fsp2 from "fs/promises";
-import { dirname as dirname2, join as join5 } from "path";
+import { dirname as dirname2, join as join7 } from "path";
 import { tmpdir } from "os";
 import { packageLessonkit } from "@lxpack/api";
 async function buildStagingPackage(options) {
   const { target, output, dir, outputBaseDir, descriptor, ...writeOpts } = options;
-  const stagingDir = await fsp2.mkdtemp(join5(tmpdir(), "lessonkit-lxpack-"));
+  const stagingDir = await fsp2.mkdtemp(join7(tmpdir(), "lessonkit-lxpack-"));
   try {
     let spaDirs;
     try {
@@ -1000,8 +1320,8 @@ async function buildStagingPackage(options) {
     }
     const interchange = descriptorToInterchange(descriptor);
     const outputBase = outputBaseDir ?? ".lxpack/out";
-    await fsp2.mkdir(join5(stagingDir, outputBase), { recursive: true });
-    const defaultOutput = output ?? (dir ? join5(outputBase, target) : join5(outputBase, `course-${target}.zip`));
+    await fsp2.mkdir(join7(stagingDir, outputBase), { recursive: true });
+    const defaultOutput = output ?? (dir ? join7(outputBase, target) : join7(outputBase, `course-${target}.zip`));
     const build = await packageLessonkit({
       interchange,
       spaDirs,
@@ -1044,16 +1364,25 @@ async function ensureOutDirParent(outDir) {
   await fsp2.mkdir(dirname2(outDir), { recursive: true });
 }
 
+// src/packaging/issueSeverity.ts
+function isPackagingErrorIssue(issue) {
+  const severity = issue.severity?.toLowerCase();
+  return severity === "error" || severity === "fatal";
+}
+function findPackagingErrorIssues(issues) {
+  return (issues ?? []).filter(isPackagingErrorIssue);
+}
+
 // src/packageCourse.ts
 async function validateLessonkitProject(options) {
   return validateCourse({
-    courseDir: resolve6(options.courseDir),
+    courseDir: resolve7(options.courseDir),
     target: options.target
   });
 }
 async function buildLessonkitProject(options) {
   const buildOptions = {
-    courseDir: resolve6(options.courseDir),
+    courseDir: resolve7(options.courseDir),
     target: options.target,
     output: options.output,
     dir: options.dir,
@@ -1084,7 +1413,7 @@ async function packageLessonkitCourse(options) {
   if (!descriptorValidation.ok) {
     return {
       ok: false,
-      courseDir: resolve6(writeOpts.outDir),
+      courseDir: resolve7(writeOpts.outDir),
       target,
       issues: descriptorValidation.issues.map((i) => ({
         path: i.path,
@@ -1093,6 +1422,37 @@ async function packageLessonkitCourse(options) {
     };
   }
   const descriptor = descriptorValidation.descriptor;
+  if (writeOpts.projectRoot) {
+    const parityIssues = validateReactManifestParity({
+      projectRoot: writeOpts.projectRoot,
+      descriptor
+    });
+    const parityErrors = parityIssues.filter((i) => i.severity === "error");
+    if (parityErrors.length > 0) {
+      return {
+        ok: false,
+        courseDir: outDir,
+        target,
+        issues: parityErrors.map((i) => ({
+          path: i.path,
+          message: i.message,
+          severity: i.severity
+        }))
+      };
+    }
+  }
+  const nonInjectableAssessments = (descriptor.assessments ?? []).map((assessment, index) => ({ assessment, index })).filter(({ assessment }) => assessmentDescriptorToLxpack(assessment) === null);
+  if (nonInjectableAssessments.length > 0) {
+    return {
+      ok: false,
+      courseDir: outDir,
+      target,
+      issues: nonInjectableAssessments.map(({ assessment, index }) => ({
+        path: `assessments[${index}]`,
+        message: `assessment kind "${assessment.kind ?? "mcq"}" (checkId "${assessment.checkId}") is not injected into LMS shell quizzes for target "${target}"`
+      }))
+    };
+  }
   const staged = await buildStagingPackage({
     ...writeOpts,
     descriptor,
@@ -1117,6 +1477,25 @@ async function packageLessonkitCourse(options) {
     };
   }
   const { stagingDir, build } = staged;
+  const buildErrorIssues = findPackagingErrorIssues(build.issues);
+  if (buildErrorIssues.length > 0) {
+    await fsp3.rm(stagingDir, { recursive: true, force: true }).catch(
+      /* v8 ignore next */
+      () => void 0
+    );
+    return {
+      ok: false,
+      courseDir: outDir,
+      target,
+      validation: { ok: false, manifest: build.manifest, issues: build.issues },
+      build,
+      issues: build.issues.filter((i) => findPackagingErrorIssues([i]).length > 0).map((i) => ({
+        path: i.path ?? "build",
+        message: i.message,
+        severity: i.severity
+      }))
+    };
+  }
   const stagingRoot = await fsp3.realpath(stagingDir);
   const artifactIssues = [
     validateArtifactInStaging(stagingRoot, staged.outputPath, "outputPath"),
@@ -1147,6 +1526,10 @@ async function packageLessonkitCourse(options) {
     await ensureOutDirParent(outDir);
     await promoteStagingToOutDir(stagingDir, outDir);
   } catch (err) {
+    await fsp3.rm(stagingDir, { recursive: true, force: true }).catch(
+      /* v8 ignore next */
+      () => void 0
+    );
     return {
       ok: false,
       courseDir: outDir,
@@ -1329,5 +1712,6 @@ export {
   validateLessonkitProject,
   validatePackageInputs,
   validateProjectPaths,
+  validateReactManifestParity,
   writeLxpackProject
 };