@lessonkit/lxpack 1.3.0 → 1.4.0

package/dist/index.cjs

@@ -57,6 +57,7 @@ __export(index_exports, {
   validateLessonkitProject: () => validateLessonkitProject,
   validatePackageInputs: () => validatePackageInputs,
   validateProjectPaths: () => validateProjectPaths,
+  validateReactManifestParity: () => validateReactManifestParity,
   writeLxpackProject: () => writeLxpackProject
 });
 module.exports = __toCommonJS(index_exports);
@@ -374,6 +375,10 @@ var validateMcqLike = (assessment, path, issues) => {
   } else if (trimmedChoices.length && !trimmedChoices.includes(assessment.answer.trim())) {
     issues.push({ path: `${path}.answer`, message: "answer must match a choice" });
   }
+  const uniqueChoices = new Set(trimmedChoices);
+  if (trimmedChoices.length !== uniqueChoices.size) {
+    issues.push({ path: `${path}.choices`, message: "choices must be unique" });
+  }
 };
 function countStarDelimitedBlanks(template) {
   const matches = template.match(/\*[^*]+\*/g);
@@ -641,15 +646,8 @@ function assessmentDescriptorToLxpack(assessment) {
   if (kind === "fillInBlanks") {
     return null;
   }
-  if (kind === "findHotspot" && assessment.kind === "findHotspot") {
-    return mcqToLxpack({
-      kind: "mcq",
-      checkId: assessment.checkId,
-      question: assessment.question,
-      choices: [assessment.correctTargetId, "other"],
-      answer: assessment.correctTargetId,
-      passingScore: assessment.passingScore
-    });
+  if (kind === "findHotspot") {
+    return null;
   }
   if (kind === "findMultipleHotspots") {
     return null;
@@ -663,6 +661,20 @@ function extractAssessments(descriptor) {
   return (descriptor.assessments ?? []).map(assessmentDescriptorToLxpack).filter((a) => a !== null);
 }
 
+// src/descriptor/validateInjectableAssessments.ts
+function validateInjectableAssessments(descriptor) {
+  const issues = [];
+  (descriptor.assessments ?? []).forEach((assessment, index) => {
+    if (assessmentDescriptorToLxpack(assessment) === null) {
+      issues.push({
+        path: `assessments[${index}]`,
+        message: `assessment kind "${assessment.kind ?? "mcq"}" (checkId "${assessment.checkId}") is not injected into LMS shell quizzes`
+      });
+    }
+  });
+  return issues;
+}
+
 // src/descriptor/validateForTarget.ts
 var LMS_SHELL_TARGETS = /* @__PURE__ */ new Set([
   "scorm12",
@@ -677,20 +689,21 @@ function validateDescriptorForExportTarget(descriptor, target) {
     const activityIri = descriptor.tracking?.xapi?.activityIri?.trim();
     if (!activityIri) {
       issues.push({
-        path: "course.tracking.xapi.activityIri",
+        path: "tracking.xapi.activityIri",
         message: "tracking.xapi.activityIri is required for xapi and cmi5 export targets"
       });
+    } else if (!/^https:\/\/.+/i.test(activityIri)) {
+      issues.push({
+        path: "tracking.xapi.activityIri",
+        message: "tracking.xapi.activityIri must be an HTTPS URL for xapi and cmi5 export targets"
+      });
     }
   }
   if (LMS_SHELL_TARGETS.has(target)) {
-    (descriptor.assessments ?? []).forEach((assessment, index) => {
-      if (assessmentDescriptorToLxpack(assessment) === null) {
-        issues.push({
-          path: `assessments[${index}]`,
-          message: `assessment kind "${assessment.kind ?? "mcq"}" (checkId "${assessment.checkId}") is not injected into LMS shell quizzes for target "${target}"`
-        });
-      }
-    });
+    issues.push(...validateInjectableAssessments(descriptor).map((issue) => ({
+      ...issue,
+      message: `${issue.message} for target "${target}"`
+    })));
   }
   return issues;
 }
@@ -718,8 +731,122 @@ function validateDescriptorForTarget(input, target) {
   return result;
 }
 
-// src/validateProjectPaths.ts
+// src/validateReactParity.ts
+var import_node_fs2 = require("fs");
 var import_node_path2 = require("path");
+var SCANNABLE_EXTENSIONS = [".tsx", ".ts", ".jsx", ".js"];
+function collectSourceUnderSrc(projectRoot) {
+  const srcDir = (0, import_node_path2.join)(projectRoot, "src");
+  if (!(0, import_node_fs2.existsSync)(srcDir)) return [];
+  const results = [];
+  const walk = (dir) => {
+    for (const entry of (0, import_node_fs2.readdirSync)(dir)) {
+      const abs = (0, import_node_path2.join)(dir, entry);
+      if ((0, import_node_fs2.statSync)(abs).isDirectory()) {
+        walk(abs);
+      } else if (SCANNABLE_EXTENSIONS.some((ext) => entry.endsWith(ext))) {
+        results.push((0, import_node_path2.relative)(projectRoot, abs));
+      }
+    }
+  };
+  walk(srcDir);
+  return results;
+}
+function readAppSources(projectRoot, appSources) {
+  return appSources.map((rel) => (0, import_node_path2.join)(projectRoot, rel)).filter((abs) => (0, import_node_fs2.existsSync)(abs)).map((abs) => (0, import_node_fs2.readFileSync)(abs, "utf8")).join("\n");
+}
+function stripComments(source) {
+  return source.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/\/\/[^\n]*/g, " ");
+}
+function idPropPatterns(prop, id) {
+  return [
+    `${prop}="${id}"`,
+    `${prop}='${id}'`,
+    `${prop}={'${id}'}`,
+    `${prop}={"${id}"}`,
+    `${prop}={\`${id}\`}`
+  ];
+}
+function extractStringConstants(source) {
+  const stripped = stripComments(source);
+  const map = /* @__PURE__ */ new Map();
+  const re = /(?:export\s+)?(?:const|let|var)\s+(\w+)\s*=\s*(["'`])((?:\\.|(?!\2).)*)\2/g;
+  for (const match of stripped.matchAll(re)) {
+    map.set(match[1], match[3]);
+  }
+  return map;
+}
+function idUsedViaConstant(stripped, prop, id, constants) {
+  for (const [name, value] of constants) {
+    if (value !== id) continue;
+    const jsxPatterns = [
+      `${prop}={${name}}`,
+      `${prop}={ ${name} }`,
+      `${prop}={${name} }`,
+      `${prop}={ ${name}}`
+    ];
+    if (jsxPatterns.some((p) => stripped.includes(p))) return true;
+    const objPatterns = [`${prop}: ${name}`, `${prop}:${name}`];
+    if (objPatterns.some((p) => stripped.includes(p))) return true;
+  }
+  return false;
+}
+function courseIdPresent(source, courseId) {
+  const stripped = stripComments(source);
+  if (idPropPatterns("courseId", courseId).some((p) => stripped.includes(p))) return true;
+  return idUsedViaConstant(stripped, "courseId", courseId, extractStringConstants(source));
+}
+function checkIdPresent(source, checkId) {
+  const stripped = stripComments(source);
+  if (idPropPatterns("checkId", checkId).some((p) => stripped.includes(p))) return true;
+  return idUsedViaConstant(stripped, "checkId", checkId, extractStringConstants(source));
+}
+var ID_SYNC_DOC = "https://lessonkit.readthedocs.io/en/latest/guides/react-developers/quickstart.html#keep-react-ids-in-sync-with-lessonkitjson";
+function parityHint(message) {
+  return `${message} See ${ID_SYNC_DOC}`;
+}
+function validateReactManifestParity(opts) {
+  const appSources = opts.appSources ?? collectSourceUnderSrc(opts.projectRoot);
+  const source = readAppSources(opts.projectRoot, appSources);
+  const hasDescriptorIds = Boolean(opts.descriptor.courseId) || (opts.descriptor.assessments?.length ?? 0) > 0;
+  if (!source.trim()) {
+    return [
+      {
+        path: appSources.length > 0 ? appSources.join(", ") : "src/",
+        message: hasDescriptorIds ? "React app source not found for ID parity check" : "React app source not found for ID parity check",
+        severity: hasDescriptorIds ? "error" : "warning"
+      }
+    ];
+  }
+  const issues = [];
+  const courseId = opts.descriptor.courseId;
+  if (!courseIdPresent(source, courseId)) {
+    issues.push({
+      path: "course.courseId",
+      message: parityHint(
+        `React app source does not reference courseId="${courseId}" from lessonkit.json.`
+      ),
+      severity: "error"
+    });
+  }
+  for (const assessment of opts.descriptor.assessments ?? []) {
+    const checkId = assessment.checkId;
+    if (!checkId) continue;
+    if (!checkIdPresent(source, checkId)) {
+      issues.push({
+        path: `assessments.checkId:${checkId}`,
+        message: parityHint(
+          `React app source missing checkId="${checkId}" declared in lessonkit.json.`
+        ),
+        severity: "error"
+      });
+    }
+  }
+  return issues;
+}
+
+// src/validateProjectPaths.ts
+var import_node_path3 = require("path");
 function validatePathField(value, fieldPath, projectRoot, issues) {
   if (!isSafeRelativeSpaPath(value)) {
     issues.push({
@@ -729,7 +856,7 @@ function validatePathField(value, fieldPath, projectRoot, issues) {
     return;
   }
   try {
-    assertRealPathUnderRoot(projectRoot, (0, import_node_path2.resolve)(projectRoot, value));
+    assertRealPathUnderRoot(projectRoot, (0, import_node_path3.resolve)(projectRoot, value));
   } catch {
     issues.push({
       path: fieldPath,
@@ -739,7 +866,7 @@ function validatePathField(value, fieldPath, projectRoot, issues) {
 }
 function validateProjectPaths(projectRoot, paths) {
   const issues = [];
-  const root = (0, import_node_path2.resolve)(projectRoot);
+  const root = (0, import_node_path3.resolve)(projectRoot);
   if (paths.spaDistDir?.trim()) {
     validatePathField(paths.spaDistDir.trim(), "paths.spaDistDir", root, issues);
   }
@@ -752,20 +879,20 @@ function validateProjectPaths(projectRoot, paths) {
   return issues;
 }
 function resolveSafePackageOutputOverride(projectRoot, override) {
-  const root = (0, import_node_path2.resolve)(projectRoot);
+  const root = (0, import_node_path3.resolve)(projectRoot);
   const trimmed = override.trim();
   if (!trimmed) {
     throw new Error("output override must be a non-empty path");
   }
-  if ((0, import_node_path2.isAbsolute)(trimmed)) {
-    const resolved2 = (0, import_node_path2.resolve)(trimmed);
+  if ((0, import_node_path3.isAbsolute)(trimmed)) {
+    const resolved2 = (0, import_node_path3.resolve)(trimmed);
     assertRealPathUnderRoot(root, resolved2);
     return resolved2;
   }
   if (!isSafeRelativeSpaPath(trimmed)) {
     throw new Error(`unsafe output path: ${override}`);
   }
-  const resolved = (0, import_node_path2.resolve)(root, trimmed);
+  const resolved = (0, import_node_path3.resolve)(root, trimmed);
   assertRealPathUnderRoot(root, resolved);
   return resolved;
 }
@@ -841,21 +968,21 @@ function descriptorToInterchange(descriptor) {
 }
 
 // src/writeProject.ts
-var import_node_path4 = require("path");
+var import_node_path6 = require("path");
 var import_validators = require("@lxpack/validators");
 
 // src/spaDirs.ts
 var import_promises = require("fs/promises");
-var import_node_path3 = require("path");
+var import_node_path4 = require("path");
 async function resolveSpaDirs(options) {
   const { descriptor, spaDistDir, lessonSpaDirs, projectRoot } = options;
   const spaLessons = resolveSpaLessons(descriptor);
   if (descriptor.layout === "single-spa") {
     const spaDistRelative = spaDistDir ?? descriptor.spaDistDir ?? /* v8 ignore next */
     "dist";
-    const srcDist = projectRoot ? (0, import_node_path3.resolve)(projectRoot, spaDistRelative) : (0, import_node_path3.resolve)(spaDistRelative);
+    const srcDist = projectRoot ? (0, import_node_path4.resolve)(projectRoot, spaDistRelative) : (0, import_node_path4.resolve)(spaDistRelative);
     if (projectRoot) {
-      assertRealPathUnderRoot((0, import_node_path3.resolve)(projectRoot), srcDist);
+      assertRealPathUnderRoot((0, import_node_path4.resolve)(projectRoot), srcDist);
     }
     try {
       await (0, import_promises.access)(srcDist);
@@ -863,9 +990,9 @@ async function resolveSpaDirs(options) {
       throw new Error(`spaDistDir not found: ${srcDist}`);
     }
     try {
-      await (0, import_promises.access)((0, import_node_path3.join)(srcDist, "index.html"));
+      await (0, import_promises.access)((0, import_node_path4.join)(srcDist, "index.html"));
     } catch {
-      throw new Error(`spaDistDir must contain index.html: ${(0, import_node_path3.join)(srcDist, "index.html")}`);
+      throw new Error(`spaDistDir must contain index.html: ${(0, import_node_path4.join)(srcDist, "index.html")}`);
     }
     const lessonId = spaLessons[0]?.id ?? /* v8 ignore next */
     "main";
@@ -878,9 +1005,9 @@ async function resolveSpaDirs(options) {
     if (!src) {
       throw new Error(`lessonSpaDirs missing build output for lesson "${lesson.id}"`);
     }
-    const resolved = projectRoot ? (0, import_node_path3.resolve)(projectRoot, src) : (0, import_node_path3.resolve)(src);
+    const resolved = projectRoot ? (0, import_node_path4.resolve)(projectRoot, src) : (0, import_node_path4.resolve)(src);
     if (projectRoot) {
-      assertRealPathUnderRoot((0, import_node_path3.resolve)(projectRoot), resolved);
+      assertRealPathUnderRoot((0, import_node_path4.resolve)(projectRoot), resolved);
     }
     try {
       await (0, import_promises.access)(resolved);
@@ -888,10 +1015,10 @@ async function resolveSpaDirs(options) {
       throw new Error(`lessonSpaDirs path not found for lesson "${lesson.id}": ${resolved}`);
     }
     try {
-      await (0, import_promises.access)((0, import_node_path3.join)(resolved, "index.html"));
+      await (0, import_promises.access)((0, import_node_path4.join)(resolved, "index.html"));
     } catch {
       throw new Error(
-        `lessonSpaDirs must contain index.html for lesson "${lesson.id}": ${(0, import_node_path3.join)(resolved, "index.html")}`
+        `lessonSpaDirs must contain index.html for lesson "${lesson.id}": ${(0, import_node_path4.join)(resolved, "index.html")}`
       );
     }
     dirs[lesson.id] = resolved;
@@ -899,6 +1026,59 @@ async function resolveSpaDirs(options) {
   return dirs;
 }
 
+// src/spaDistValidation.ts
+var import_promises2 = require("fs/promises");
+var import_node_fs3 = require("fs");
+var import_node_path5 = require("path");
+async function assertSpaDistContentsSafe(spaDirs, projectRoot) {
+  for (const [label, dir] of Object.entries(spaDirs)) {
+    const dirResolved = resolveComparablePath(dir);
+    const dirStat = await (0, import_promises2.lstat)(dirResolved);
+    if (dirStat.isSymbolicLink()) {
+      throw new Error(`spa dist for "${label}" cannot be a symlink: ${dir}`);
+    }
+    let rootReal;
+    try {
+      rootReal = (0, import_node_fs3.realpathSync)(dirResolved);
+    } catch {
+      throw new Error(`spa dist for "${label}" is not readable: ${dir}`);
+    }
+    if (projectRoot) {
+      assertRealPathUnderRoot(projectRoot, dir);
+    }
+    assertResolvedPathUnderRoot(rootReal, rootReal);
+    await walkDistDir(rootReal, rootReal, label);
+  }
+}
+async function walkDistDir(rootReal, current, label) {
+  let entries;
+  try {
+    entries = await (0, import_promises2.readdir)(current, { withFileTypes: true });
+  } catch (err) {
+    throw new Error(
+      `spa dist for "${label}" is not readable: ${err instanceof Error ? err.message : String(err)}`,
+      { cause: err }
+    );
+  }
+  for (const entry of entries) {
+    const entryPath = (0, import_node_path5.join)(current, entry.name);
+    const stat2 = await (0, import_promises2.lstat)(entryPath);
+    if (stat2.isSymbolicLink()) {
+      throw new Error(`spa dist for "${label}" contains symlink: ${entryPath}`);
+    }
+    let entryReal;
+    try {
+      entryReal = (0, import_node_fs3.realpathSync)(entryPath);
+    } catch {
+      entryReal = entryPath;
+    }
+    assertResolvedPathUnderRoot(rootReal, entryReal);
+    if (stat2.isDirectory()) {
+      await walkDistDir(rootReal, entryPath, label);
+    }
+  }
+}
+
 // src/writeProject.ts
 async function writeLxpackProject(options) {
   const validation = validateDescriptor(options.descriptor);
@@ -908,11 +1088,16 @@ async function writeLxpackProject(options) {
     );
   }
   const descriptor = validation.descriptor;
-  const outDir = (0, import_node_path4.resolve)(options.outDir);
+  const injectableIssues = validateInjectableAssessments(descriptor);
+  if (injectableIssues.length > 0) {
+    throw new Error(injectableIssues.map((i) => `${i.path}: ${i.message}`).join("; "));
+  }
+  const outDir = (0, import_node_path6.resolve)(options.outDir);
   if (options.projectRoot) {
-    assertRealPathUnderRoot((0, import_node_path4.resolve)(options.projectRoot), outDir);
+    assertRealPathUnderRoot((0, import_node_path6.resolve)(options.projectRoot), outDir);
   }
   const spaDirs = await resolveSpaDirs({ ...options, descriptor });
+  await assertSpaDistContentsSafe(spaDirs, options.projectRoot);
   const interchange = descriptorToInterchange(descriptor);
   const materialized = await (0, import_validators.materializeLessonkitProject)({
     interchange,
@@ -928,21 +1113,21 @@ async function writeLxpackProject(options) {
   const courseDir = materialized.courseDir;
   return {
     outDir: courseDir,
-    courseYamlPath: (0, import_node_path4.join)(courseDir, "course.yaml"),
-    lessonkitJsonPath: (0, import_node_path4.join)(courseDir, "lessonkit.json")
+    courseYamlPath: (0, import_node_path6.join)(courseDir, "course.yaml"),
+    lessonkitJsonPath: (0, import_node_path6.join)(courseDir, "lessonkit.json")
   };
 }
 
 // src/packageCourse.ts
-var import_node_path8 = require("path");
+var import_node_path10 = require("path");
 var fsp3 = __toESM(require("fs/promises"), 1);
 var import_api2 = require("@lxpack/api");
 
 // src/packaging/validateInputs.ts
-var import_node_path5 = require("path");
+var import_node_path7 = require("path");
 function validatePackageInputs(options) {
   const { target, output, outputBaseDir } = options;
-  const outDir = (0, import_node_path5.resolve)(options.outDir);
+  const outDir = (0, import_node_path7.resolve)(options.outDir);
   if (!options.projectRoot) {
     return {
       ok: false,
@@ -951,7 +1136,7 @@ function validatePackageInputs(options) {
       issues: [{ path: "projectRoot", message: "projectRoot is required for packageLessonkitCourse" }]
     };
   }
-  const projectRoot = (0, import_node_path5.resolve)(options.projectRoot);
+  const projectRoot = (0, import_node_path7.resolve)(options.projectRoot);
   try {
     assertRealPathUnderRoot(projectRoot, outDir);
   } catch (err) {
@@ -979,9 +1164,9 @@ function validatePackageInputs(options) {
     };
   }
   if (output && !isSafeRelativeSpaPath(output)) {
-    if ((0, import_node_path5.isAbsolute)(output)) {
+    if ((0, import_node_path7.isAbsolute)(output)) {
       try {
-        assertRealPathUnderRoot(projectRoot, (0, import_node_path5.resolve)(output));
+        assertRealPathUnderRoot(projectRoot, (0, import_node_path7.resolve)(output));
       } catch (err) {
         return {
           ok: false,
@@ -1008,7 +1193,7 @@ function validatePackageInputs(options) {
     }
   }
   if (outputBaseDir) {
-    const resolvedOutputBase = (0, import_node_path5.resolve)(projectRoot, outputBaseDir);
+    const resolvedOutputBase = (0, import_node_path7.resolve)(projectRoot, outputBaseDir);
     try {
       assertRealPathUnderRoot(projectRoot, resolvedOutputBase);
     } catch (err) {
@@ -1029,7 +1214,7 @@ function validatePackageInputs(options) {
     }
   }
   if (output) {
-    const resolvedOutput = (0, import_node_path5.isAbsolute)(output) ? (0, import_node_path5.resolve)(output) : (0, import_node_path5.resolve)(projectRoot, output);
+    const resolvedOutput = (0, import_node_path7.isAbsolute)(output) ? (0, import_node_path7.resolve)(output) : (0, import_node_path7.resolve)(projectRoot, output);
     try {
       assertRealPathUnderRoot(projectRoot, resolvedOutput);
     } catch (err) {
@@ -1069,20 +1254,20 @@ function remapArtifactPaths(stagingRoot, outDir, artifactPath) {
     throw new Error(`${artifactPath} is outside the staging directory`);
   }
   const rel = relativePathUnderRoot(stagingRoot, resolved);
-  if (rel.startsWith("..") || (0, import_node_path5.isAbsolute)(rel)) {
+  if (rel.startsWith("..") || (0, import_node_path7.isAbsolute)(rel)) {
     throw new Error(`${artifactPath} is outside the staging directory`);
   }
   if (!rel) return outDir;
   if (/^[a-zA-Z]:[/\\]/.test(outDir)) {
-    return import_node_path5.win32.join(outDir, rel.replace(/\//g, import_node_path5.win32.sep));
+    return import_node_path7.win32.join(outDir, rel.replace(/\//g, import_node_path7.win32.sep));
   }
-  return (0, import_node_path5.join)(outDir, rel);
+  return (0, import_node_path7.join)(outDir, rel);
 }
 
 // src/packaging/promote.ts
 var fsp = __toESM(require("fs/promises"), 1);
 var import_node_crypto = require("crypto");
-var import_node_path6 = require("path");
+var import_node_path8 = require("path");
 async function pathExists(path) {
   try {
     await fsp.access(path);
@@ -1102,31 +1287,32 @@ async function renameOrCopy(from, to) {
   }
 }
 function promoteLockPath(outDir) {
-  const parent = (0, import_node_path6.dirname)(outDir);
-  const hash = (0, import_node_crypto.createHash)("sha256").update((0, import_node_path6.resolve)(outDir)).digest("hex").slice(0, 16);
-  return (0, import_node_path6.join)(parent, `.lk-promote-lock-${hash}`);
+  const parent = (0, import_node_path8.dirname)(outDir);
+  const hash = (0, import_node_crypto.createHash)("sha256").update((0, import_node_path8.resolve)(outDir)).digest("hex").slice(0, 16);
+  return (0, import_node_path8.join)(parent, `.lk-promote-lock-${hash}`);
 }
 var STALE_LOCK_TTL_MS = 5 * 60 * 1e3;
 async function isStalePromoteLock(lockPath) {
   try {
-    const stat2 = await fsp.stat(lockPath);
-    if (Date.now() - stat2.mtimeMs > STALE_LOCK_TTL_MS) return true;
     const content = await fsp.readFile(lockPath, "utf8");
     const pid = Number.parseInt(content.trim(), 10);
-    if (!Number.isFinite(pid) || pid <= 0) return true;
-    try {
-      process.kill(pid, 0);
-      return false;
-    } catch {
-      return true;
+    if (Number.isFinite(pid) && pid > 0) {
+      try {
+        process.kill(pid, 0);
+        return false;
+      } catch {
+        return true;
+      }
     }
+    const stat2 = await fsp.stat(lockPath);
+    return Date.now() - stat2.mtimeMs > STALE_LOCK_TTL_MS;
   } catch {
     return true;
   }
 }
 async function withPromoteLock(outDir, fn) {
   const lockPath = promoteLockPath(outDir);
-  await fsp.mkdir((0, import_node_path6.dirname)(outDir), { recursive: true });
+  await fsp.mkdir((0, import_node_path8.dirname)(outDir), { recursive: true });
   let lockHandle;
   for (let attempt = 0; attempt < 200; attempt++) {
     try {
@@ -1178,11 +1364,11 @@ async function assertNoLegacyPromoteArtifacts(outDir) {
 async function promoteStagingToOutDir(stagingDir, outDir) {
   return withPromoteLock(outDir, async () => {
     await assertNoLegacyPromoteArtifacts(outDir);
-    const parent = (0, import_node_path6.dirname)(outDir);
-    const tmpPromote = await fsp.mkdtemp((0, import_node_path6.join)(parent, ".lk-promote-"));
+    const parent = (0, import_node_path8.dirname)(outDir);
+    const tmpPromote = await fsp.mkdtemp((0, import_node_path8.join)(parent, ".lk-promote-"));
     await renameOrCopy(stagingDir, tmpPromote);
     const hadOutDir = await pathExists(outDir);
-    const backup = hadOutDir ? await fsp.mkdtemp((0, import_node_path6.join)(parent, ".lk-backup-")) : void 0;
+    const backup = hadOutDir ? await fsp.mkdtemp((0, import_node_path8.join)(parent, ".lk-backup-")) : void 0;
     if (hadOutDir && backup) {
       await renameOrCopy(outDir, backup);
     }
@@ -1193,7 +1379,7 @@ async function promoteStagingToOutDir(stagingDir, outDir) {
         try {
           await renameOrCopy(backup, outDir);
         } catch (restoreError) {
-          const failedPromote2 = (0, import_node_path6.join)(parent, `.lk-failed-promote-${(0, import_node_crypto.randomUUID)()}`);
+          const failedPromote2 = (0, import_node_path8.join)(parent, `.lk-failed-promote-${(0, import_node_crypto.randomUUID)()}`);
           try {
             await renameOrCopy(tmpPromote, failedPromote2);
           } catch {
@@ -1205,7 +1391,8 @@ async function promoteStagingToOutDir(stagingDir, outDir) {
           const promoteMsg = promoteError instanceof Error ? promoteError.message : String(promoteError);
           const restoreMsg = restoreError instanceof Error ? restoreError.message : String(restoreError);
           throw new Error(
-            `[lessonkit/lxpack] promote failed (${promoteMsg}) and could not restore ${outDir} (${restoreMsg}). Recovery: previous output may be in ${backup}; staged package may be in ${failedPromote2}.`
+            `[lessonkit/lxpack] promote failed (${promoteMsg}) and could not restore ${outDir} (${restoreMsg}). Recovery: previous output may be in ${backup}; staged package may be in ${failedPromote2}.`,
+            { cause: restoreError }
           );
         }
       } else {
@@ -1223,7 +1410,7 @@ async function promoteStagingToOutDir(stagingDir, outDir) {
         }
         throw promoteError;
       }
-      const failedPromote = (0, import_node_path6.join)(parent, `.lk-failed-promote-${(0, import_node_crypto.randomUUID)()}`);
+      const failedPromote = (0, import_node_path8.join)(parent, `.lk-failed-promote-${(0, import_node_crypto.randomUUID)()}`);
       try {
         await renameOrCopy(tmpPromote, failedPromote);
       } catch {
@@ -1245,16 +1432,17 @@ async function promoteStagingToOutDir(stagingDir, outDir) {
 
 // src/packaging/staging.ts
 var fsp2 = __toESM(require("fs/promises"), 1);
-var import_node_path7 = require("path");
+var import_node_path9 = require("path");
 var import_node_os = require("os");
 var import_api = require("@lxpack/api");
 async function buildStagingPackage(options) {
   const { target, output, dir, outputBaseDir, descriptor, ...writeOpts } = options;
-  const stagingDir = await fsp2.mkdtemp((0, import_node_path7.join)((0, import_node_os.tmpdir)(), "lessonkit-lxpack-"));
+  const stagingDir = await fsp2.mkdtemp((0, import_node_path9.join)((0, import_node_os.tmpdir)(), "lessonkit-lxpack-"));
   try {
     let spaDirs;
     try {
       spaDirs = await resolveSpaDirs({ ...writeOpts, descriptor });
+      await assertSpaDistContentsSafe(spaDirs, writeOpts.projectRoot);
     } catch (err) {
       return {
         ok: false,
@@ -1267,10 +1455,21 @@ async function buildStagingPackage(options) {
         ]
       };
     }
+    const injectableIssues = validateInjectableAssessments(descriptor);
+    if (injectableIssues.length > 0) {
+      return {
+        ok: false,
+        stagingDir,
+        issues: injectableIssues.map((i) => ({
+          path: i.path,
+          message: i.message
+        }))
+      };
+    }
     const interchange = descriptorToInterchange(descriptor);
     const outputBase = outputBaseDir ?? ".lxpack/out";
-    await fsp2.mkdir((0, import_node_path7.join)(stagingDir, outputBase), { recursive: true });
-    const defaultOutput = output ?? (dir ? (0, import_node_path7.join)(outputBase, target) : (0, import_node_path7.join)(outputBase, `course-${target}.zip`));
+    await fsp2.mkdir((0, import_node_path9.join)(stagingDir, outputBase), { recursive: true });
+    const defaultOutput = output ?? (dir ? (0, import_node_path9.join)(outputBase, target) : (0, import_node_path9.join)(outputBase, `course-${target}.zip`));
     const build = await (0, import_api.packageLessonkit)({
       interchange,
       spaDirs,
@@ -1310,7 +1509,7 @@ async function buildStagingPackage(options) {
   }
 }
 async function ensureOutDirParent(outDir) {
-  await fsp2.mkdir((0, import_node_path7.dirname)(outDir), { recursive: true });
+  await fsp2.mkdir((0, import_node_path9.dirname)(outDir), { recursive: true });
 }
 
 // src/packaging/issueSeverity.ts
@@ -1325,13 +1524,13 @@ function findPackagingErrorIssues(issues) {
 // src/packageCourse.ts
 async function validateLessonkitProject(options) {
   return (0, import_api2.validateCourse)({
-    courseDir: (0, import_node_path8.resolve)(options.courseDir),
+    courseDir: (0, import_node_path10.resolve)(options.courseDir),
     target: options.target
   });
 }
 async function buildLessonkitProject(options) {
   const buildOptions = {
-    courseDir: (0, import_node_path8.resolve)(options.courseDir),
+    courseDir: (0, import_node_path10.resolve)(options.courseDir),
     target: options.target,
     output: options.output,
     dir: options.dir,
@@ -1362,7 +1561,7 @@ async function packageLessonkitCourse(options) {
   if (!descriptorValidation.ok) {
     return {
       ok: false,
-      courseDir: (0, import_node_path8.resolve)(writeOpts.outDir),
+      courseDir: (0, import_node_path10.resolve)(writeOpts.outDir),
       target,
       issues: descriptorValidation.issues.map((i) => ({
         path: i.path,
@@ -1371,17 +1570,24 @@ async function packageLessonkitCourse(options) {
     };
   }
   const descriptor = descriptorValidation.descriptor;
-  const nonInjectableAssessments = (descriptor.assessments ?? []).map((assessment, index) => ({ assessment, index })).filter(({ assessment }) => assessmentDescriptorToLxpack(assessment) === null);
-  if (nonInjectableAssessments.length > 0) {
-    return {
-      ok: false,
-      courseDir: outDir,
-      target,
-      issues: nonInjectableAssessments.map(({ assessment, index }) => ({
-        path: `assessments[${index}]`,
-        message: `assessment kind "${assessment.kind ?? "mcq"}" (checkId "${assessment.checkId}") is not injected into LMS shell quizzes for target "${target}"`
-      }))
-    };
+  if (writeOpts.projectRoot) {
+    const parityIssues = validateReactManifestParity({
+      projectRoot: writeOpts.projectRoot,
+      descriptor
+    });
+    const parityErrors = parityIssues.filter((i) => i.severity === "error");
+    if (parityErrors.length > 0) {
+      return {
+        ok: false,
+        courseDir: outDir,
+        target,
+        issues: parityErrors.map((i) => ({
+          path: i.path,
+          message: i.message,
+          severity: i.severity
+        }))
+      };
+    }
   }
   const staged = await buildStagingPackage({
     ...writeOpts,
@@ -1675,5 +1881,6 @@ var import_validators2 = require("@lxpack/validators");
   validateLessonkitProject,
   validatePackageInputs,
   validateProjectPaths,
+  validateReactManifestParity,
   writeLxpackProject
 });