@lessonkit/lxpack 1.3.1 → 1.4.0

package/README.md

@@ -4,14 +4,14 @@
 [![Documentation](https://readthedocs.org/projects/lessonkit/badge/?version=latest)](https://lessonkit.readthedocs.io/en/latest/reference/packaging.html)
 [![License](https://img.shields.io/github/license/eddiethedean/lessonkit)](https://github.com/eddiethedean/lessonkit/blob/main/LICENSE)
 
-Package Vite SPAs for LMS delivery — SCORM 1.2/2004, standalone, xAPI, and cmi5 via [`@lxpack/api`](https://www.npmjs.com/package/@lxpack/api).
+Package Vite SPAs for LMS delivery — SCORM 1.2/2004, standalone, xAPI, and cmi5. `@lessonkit/lxpack` bundles [`@lxpack/*`](https://www.npmjs.com/org/lxpack) as direct dependencies (no separate `@lxpack/api` install).
 
 Requires Node.js **18+**.
 
 ## Install
 
 ```bash
-npm install @lessonkit/lxpack @lxpack/api
+npm install @lessonkit/lxpack
 ```
 
 ## Usage

package/dist/bridge.d.cts

@@ -1,4 +1,4 @@
-import { TelemetryEvent, CheckId, LessonId } from '@lessonkit/core';
+import { LmsBridgeMode, TelemetryEvent, CheckId, LessonId } from '@lessonkit/core';
 import { LxpackBridgeV1, LxpackBridgeSubmitAssessmentPayload } from '@lxpack/spa-bridge';
 export { DEFAULT_BRIDGE_PASSING_SCORE, LXPACK_BRIDGE_VERSIONS, LxpackBridgeSubmitAssessmentPayload, LxpackBridgeV1, createLxpackBridgeHost, getLxpackBridge, normalizePassingThreshold, normalizeScore, supportedBridgeVersions } from '@lxpack/spa-bridge';
 import { mapLessonkitTelemetryToBridgeAction } from '@lxpack/tracking-schema';
@@ -21,7 +21,8 @@ declare function normalizeAssessmentPassingScore(opts?: {
     passingScore?: number;
     maxScore?: number;
 }): number;
-type LxpackBridgeMode = "auto" | "off";
+/** @deprecated Use `LmsBridgeMode` from `@lessonkit/core`. */
+type LxpackBridgeMode = LmsBridgeMode;
 /** Apply a mapped bridge action to an LXPack bridge instance. */
 declare function dispatchBridgeAction(bridge: LxpackBridgeV1, action: ReturnType<typeof mapLessonkitTelemetryToBridgeAction>): void;
 declare function forwardTelemetryToBridge(event: TelemetryEvent, mode?: LxpackBridgeMode, parentWindow?: Window): void;

package/dist/bridge.d.ts

@@ -1,4 +1,4 @@
-import { TelemetryEvent, CheckId, LessonId } from '@lessonkit/core';
+import { LmsBridgeMode, TelemetryEvent, CheckId, LessonId } from '@lessonkit/core';
 import { LxpackBridgeV1, LxpackBridgeSubmitAssessmentPayload } from '@lxpack/spa-bridge';
 export { DEFAULT_BRIDGE_PASSING_SCORE, LXPACK_BRIDGE_VERSIONS, LxpackBridgeSubmitAssessmentPayload, LxpackBridgeV1, createLxpackBridgeHost, getLxpackBridge, normalizePassingThreshold, normalizeScore, supportedBridgeVersions } from '@lxpack/spa-bridge';
 import { mapLessonkitTelemetryToBridgeAction } from '@lxpack/tracking-schema';
@@ -21,7 +21,8 @@ declare function normalizeAssessmentPassingScore(opts?: {
     passingScore?: number;
     maxScore?: number;
 }): number;
-type LxpackBridgeMode = "auto" | "off";
+/** @deprecated Use `LmsBridgeMode` from `@lessonkit/core`. */
+type LxpackBridgeMode = LmsBridgeMode;
 /** Apply a mapped bridge action to an LXPack bridge instance. */
 declare function dispatchBridgeAction(bridge: LxpackBridgeV1, action: ReturnType<typeof mapLessonkitTelemetryToBridgeAction>): void;
 declare function forwardTelemetryToBridge(event: TelemetryEvent, mode?: LxpackBridgeMode, parentWindow?: Window): void;

package/dist/index.cjs

@@ -375,6 +375,10 @@ var validateMcqLike = (assessment, path, issues) => {
   } else if (trimmedChoices.length && !trimmedChoices.includes(assessment.answer.trim())) {
     issues.push({ path: `${path}.answer`, message: "answer must match a choice" });
   }
+  const uniqueChoices = new Set(trimmedChoices);
+  if (trimmedChoices.length !== uniqueChoices.size) {
+    issues.push({ path: `${path}.choices`, message: "choices must be unique" });
+  }
 };
 function countStarDelimitedBlanks(template) {
   const matches = template.match(/\*[^*]+\*/g);
@@ -642,15 +646,8 @@ function assessmentDescriptorToLxpack(assessment) {
   if (kind === "fillInBlanks") {
     return null;
   }
-  if (kind === "findHotspot" && assessment.kind === "findHotspot") {
-    return mcqToLxpack({
-      kind: "mcq",
-      checkId: assessment.checkId,
-      question: assessment.question,
-      choices: [assessment.correctTargetId, "other"],
-      answer: assessment.correctTargetId,
-      passingScore: assessment.passingScore
-    });
+  if (kind === "findHotspot") {
+    return null;
   }
   if (kind === "findMultipleHotspots") {
     return null;
@@ -664,6 +661,20 @@ function extractAssessments(descriptor) {
   return (descriptor.assessments ?? []).map(assessmentDescriptorToLxpack).filter((a) => a !== null);
 }
 
+// src/descriptor/validateInjectableAssessments.ts
+function validateInjectableAssessments(descriptor) {
+  const issues = [];
+  (descriptor.assessments ?? []).forEach((assessment, index) => {
+    if (assessmentDescriptorToLxpack(assessment) === null) {
+      issues.push({
+        path: `assessments[${index}]`,
+        message: `assessment kind "${assessment.kind ?? "mcq"}" (checkId "${assessment.checkId}") is not injected into LMS shell quizzes`
+      });
+    }
+  });
+  return issues;
+}
+
 // src/descriptor/validateForTarget.ts
 var LMS_SHELL_TARGETS = /* @__PURE__ */ new Set([
   "scorm12",
@@ -678,20 +689,21 @@ function validateDescriptorForExportTarget(descriptor, target) {
     const activityIri = descriptor.tracking?.xapi?.activityIri?.trim();
     if (!activityIri) {
       issues.push({
-        path: "course.tracking.xapi.activityIri",
+        path: "tracking.xapi.activityIri",
         message: "tracking.xapi.activityIri is required for xapi and cmi5 export targets"
       });
+    } else if (!/^https:\/\/.+/i.test(activityIri)) {
+      issues.push({
+        path: "tracking.xapi.activityIri",
+        message: "tracking.xapi.activityIri must be an HTTPS URL for xapi and cmi5 export targets"
+      });
     }
   }
   if (LMS_SHELL_TARGETS.has(target)) {
-    (descriptor.assessments ?? []).forEach((assessment, index) => {
-      if (assessmentDescriptorToLxpack(assessment) === null) {
-        issues.push({
-          path: `assessments[${index}]`,
-          message: `assessment kind "${assessment.kind ?? "mcq"}" (checkId "${assessment.checkId}") is not injected into LMS shell quizzes for target "${target}"`
-        });
-      }
-    });
+    issues.push(...validateInjectableAssessments(descriptor).map((issue) => ({
+      ...issue,
+      message: `${issue.message} for target "${target}"`
+    })));
   }
   return issues;
 }
@@ -789,6 +801,10 @@ function checkIdPresent(source, checkId) {
   if (idPropPatterns("checkId", checkId).some((p) => stripped.includes(p))) return true;
   return idUsedViaConstant(stripped, "checkId", checkId, extractStringConstants(source));
 }
+var ID_SYNC_DOC = "https://lessonkit.readthedocs.io/en/latest/guides/react-developers/quickstart.html#keep-react-ids-in-sync-with-lessonkitjson";
+function parityHint(message) {
+  return `${message} See ${ID_SYNC_DOC}`;
+}
 function validateReactManifestParity(opts) {
   const appSources = opts.appSources ?? collectSourceUnderSrc(opts.projectRoot);
   const source = readAppSources(opts.projectRoot, appSources);
@@ -807,7 +823,9 @@ function validateReactManifestParity(opts) {
   if (!courseIdPresent(source, courseId)) {
     issues.push({
       path: "course.courseId",
-      message: `React app source does not reference courseId="${courseId}" from lessonkit.json`,
+      message: parityHint(
+        `React app source does not reference courseId="${courseId}" from lessonkit.json.`
+      ),
       severity: "error"
     });
   }
@@ -817,7 +835,9 @@ function validateReactManifestParity(opts) {
     if (!checkIdPresent(source, checkId)) {
       issues.push({
         path: `assessments.checkId:${checkId}`,
-        message: `React app source missing checkId="${checkId}" declared in lessonkit.json`,
+        message: parityHint(
+          `React app source missing checkId="${checkId}" declared in lessonkit.json.`
+        ),
         severity: "error"
       });
     }
@@ -948,7 +968,7 @@ function descriptorToInterchange(descriptor) {
 }
 
 // src/writeProject.ts
-var import_node_path5 = require("path");
+var import_node_path6 = require("path");
 var import_validators = require("@lxpack/validators");
 
 // src/spaDirs.ts
@@ -1006,6 +1026,59 @@ async function resolveSpaDirs(options) {
   return dirs;
 }
 
+// src/spaDistValidation.ts
+var import_promises2 = require("fs/promises");
+var import_node_fs3 = require("fs");
+var import_node_path5 = require("path");
+async function assertSpaDistContentsSafe(spaDirs, projectRoot) {
+  for (const [label, dir] of Object.entries(spaDirs)) {
+    const dirResolved = resolveComparablePath(dir);
+    const dirStat = await (0, import_promises2.lstat)(dirResolved);
+    if (dirStat.isSymbolicLink()) {
+      throw new Error(`spa dist for "${label}" cannot be a symlink: ${dir}`);
+    }
+    let rootReal;
+    try {
+      rootReal = (0, import_node_fs3.realpathSync)(dirResolved);
+    } catch {
+      throw new Error(`spa dist for "${label}" is not readable: ${dir}`);
+    }
+    if (projectRoot) {
+      assertRealPathUnderRoot(projectRoot, dir);
+    }
+    assertResolvedPathUnderRoot(rootReal, rootReal);
+    await walkDistDir(rootReal, rootReal, label);
+  }
+}
+async function walkDistDir(rootReal, current, label) {
+  let entries;
+  try {
+    entries = await (0, import_promises2.readdir)(current, { withFileTypes: true });
+  } catch (err) {
+    throw new Error(
+      `spa dist for "${label}" is not readable: ${err instanceof Error ? err.message : String(err)}`,
+      { cause: err }
+    );
+  }
+  for (const entry of entries) {
+    const entryPath = (0, import_node_path5.join)(current, entry.name);
+    const stat2 = await (0, import_promises2.lstat)(entryPath);
+    if (stat2.isSymbolicLink()) {
+      throw new Error(`spa dist for "${label}" contains symlink: ${entryPath}`);
+    }
+    let entryReal;
+    try {
+      entryReal = (0, import_node_fs3.realpathSync)(entryPath);
+    } catch {
+      entryReal = entryPath;
+    }
+    assertResolvedPathUnderRoot(rootReal, entryReal);
+    if (stat2.isDirectory()) {
+      await walkDistDir(rootReal, entryPath, label);
+    }
+  }
+}
+
 // src/writeProject.ts
 async function writeLxpackProject(options) {
   const validation = validateDescriptor(options.descriptor);
@@ -1015,11 +1088,16 @@ async function writeLxpackProject(options) {
     );
   }
   const descriptor = validation.descriptor;
-  const outDir = (0, import_node_path5.resolve)(options.outDir);
+  const injectableIssues = validateInjectableAssessments(descriptor);
+  if (injectableIssues.length > 0) {
+    throw new Error(injectableIssues.map((i) => `${i.path}: ${i.message}`).join("; "));
+  }
+  const outDir = (0, import_node_path6.resolve)(options.outDir);
   if (options.projectRoot) {
-    assertRealPathUnderRoot((0, import_node_path5.resolve)(options.projectRoot), outDir);
+    assertRealPathUnderRoot((0, import_node_path6.resolve)(options.projectRoot), outDir);
   }
   const spaDirs = await resolveSpaDirs({ ...options, descriptor });
+  await assertSpaDistContentsSafe(spaDirs, options.projectRoot);
   const interchange = descriptorToInterchange(descriptor);
   const materialized = await (0, import_validators.materializeLessonkitProject)({
     interchange,
@@ -1035,21 +1113,21 @@ async function writeLxpackProject(options) {
   const courseDir = materialized.courseDir;
   return {
     outDir: courseDir,
-    courseYamlPath: (0, import_node_path5.join)(courseDir, "course.yaml"),
-    lessonkitJsonPath: (0, import_node_path5.join)(courseDir, "lessonkit.json")
+    courseYamlPath: (0, import_node_path6.join)(courseDir, "course.yaml"),
+    lessonkitJsonPath: (0, import_node_path6.join)(courseDir, "lessonkit.json")
   };
 }
 
 // src/packageCourse.ts
-var import_node_path9 = require("path");
+var import_node_path10 = require("path");
 var fsp3 = __toESM(require("fs/promises"), 1);
 var import_api2 = require("@lxpack/api");
 
 // src/packaging/validateInputs.ts
-var import_node_path6 = require("path");
+var import_node_path7 = require("path");
 function validatePackageInputs(options) {
   const { target, output, outputBaseDir } = options;
-  const outDir = (0, import_node_path6.resolve)(options.outDir);
+  const outDir = (0, import_node_path7.resolve)(options.outDir);
   if (!options.projectRoot) {
     return {
       ok: false,
@@ -1058,7 +1136,7 @@ function validatePackageInputs(options) {
       issues: [{ path: "projectRoot", message: "projectRoot is required for packageLessonkitCourse" }]
     };
   }
-  const projectRoot = (0, import_node_path6.resolve)(options.projectRoot);
+  const projectRoot = (0, import_node_path7.resolve)(options.projectRoot);
   try {
     assertRealPathUnderRoot(projectRoot, outDir);
   } catch (err) {
@@ -1086,9 +1164,9 @@ function validatePackageInputs(options) {
     };
   }
   if (output && !isSafeRelativeSpaPath(output)) {
-    if ((0, import_node_path6.isAbsolute)(output)) {
+    if ((0, import_node_path7.isAbsolute)(output)) {
       try {
-        assertRealPathUnderRoot(projectRoot, (0, import_node_path6.resolve)(output));
+        assertRealPathUnderRoot(projectRoot, (0, import_node_path7.resolve)(output));
       } catch (err) {
         return {
           ok: false,
@@ -1115,7 +1193,7 @@ function validatePackageInputs(options) {
     }
   }
   if (outputBaseDir) {
-    const resolvedOutputBase = (0, import_node_path6.resolve)(projectRoot, outputBaseDir);
+    const resolvedOutputBase = (0, import_node_path7.resolve)(projectRoot, outputBaseDir);
     try {
       assertRealPathUnderRoot(projectRoot, resolvedOutputBase);
     } catch (err) {
@@ -1136,7 +1214,7 @@ function validatePackageInputs(options) {
     }
   }
   if (output) {
-    const resolvedOutput = (0, import_node_path6.isAbsolute)(output) ? (0, import_node_path6.resolve)(output) : (0, import_node_path6.resolve)(projectRoot, output);
+    const resolvedOutput = (0, import_node_path7.isAbsolute)(output) ? (0, import_node_path7.resolve)(output) : (0, import_node_path7.resolve)(projectRoot, output);
     try {
       assertRealPathUnderRoot(projectRoot, resolvedOutput);
     } catch (err) {
@@ -1176,20 +1254,20 @@ function remapArtifactPaths(stagingRoot, outDir, artifactPath) {
     throw new Error(`${artifactPath} is outside the staging directory`);
   }
   const rel = relativePathUnderRoot(stagingRoot, resolved);
-  if (rel.startsWith("..") || (0, import_node_path6.isAbsolute)(rel)) {
+  if (rel.startsWith("..") || (0, import_node_path7.isAbsolute)(rel)) {
     throw new Error(`${artifactPath} is outside the staging directory`);
   }
   if (!rel) return outDir;
   if (/^[a-zA-Z]:[/\\]/.test(outDir)) {
-    return import_node_path6.win32.join(outDir, rel.replace(/\//g, import_node_path6.win32.sep));
+    return import_node_path7.win32.join(outDir, rel.replace(/\//g, import_node_path7.win32.sep));
   }
-  return (0, import_node_path6.join)(outDir, rel);
+  return (0, import_node_path7.join)(outDir, rel);
 }
 
 // src/packaging/promote.ts
 var fsp = __toESM(require("fs/promises"), 1);
 var import_node_crypto = require("crypto");
-var import_node_path7 = require("path");
+var import_node_path8 = require("path");
 async function pathExists(path) {
   try {
     await fsp.access(path);
@@ -1209,9 +1287,9 @@ async function renameOrCopy(from, to) {
   }
 }
 function promoteLockPath(outDir) {
-  const parent = (0, import_node_path7.dirname)(outDir);
-  const hash = (0, import_node_crypto.createHash)("sha256").update((0, import_node_path7.resolve)(outDir)).digest("hex").slice(0, 16);
-  return (0, import_node_path7.join)(parent, `.lk-promote-lock-${hash}`);
+  const parent = (0, import_node_path8.dirname)(outDir);
+  const hash = (0, import_node_crypto.createHash)("sha256").update((0, import_node_path8.resolve)(outDir)).digest("hex").slice(0, 16);
+  return (0, import_node_path8.join)(parent, `.lk-promote-lock-${hash}`);
 }
 var STALE_LOCK_TTL_MS = 5 * 60 * 1e3;
 async function isStalePromoteLock(lockPath) {
@@ -1234,7 +1312,7 @@ async function isStalePromoteLock(lockPath) {
 }
 async function withPromoteLock(outDir, fn) {
   const lockPath = promoteLockPath(outDir);
-  await fsp.mkdir((0, import_node_path7.dirname)(outDir), { recursive: true });
+  await fsp.mkdir((0, import_node_path8.dirname)(outDir), { recursive: true });
   let lockHandle;
   for (let attempt = 0; attempt < 200; attempt++) {
     try {
@@ -1286,11 +1364,11 @@ async function assertNoLegacyPromoteArtifacts(outDir) {
 async function promoteStagingToOutDir(stagingDir, outDir) {
   return withPromoteLock(outDir, async () => {
     await assertNoLegacyPromoteArtifacts(outDir);
-    const parent = (0, import_node_path7.dirname)(outDir);
-    const tmpPromote = await fsp.mkdtemp((0, import_node_path7.join)(parent, ".lk-promote-"));
+    const parent = (0, import_node_path8.dirname)(outDir);
+    const tmpPromote = await fsp.mkdtemp((0, import_node_path8.join)(parent, ".lk-promote-"));
     await renameOrCopy(stagingDir, tmpPromote);
     const hadOutDir = await pathExists(outDir);
-    const backup = hadOutDir ? await fsp.mkdtemp((0, import_node_path7.join)(parent, ".lk-backup-")) : void 0;
+    const backup = hadOutDir ? await fsp.mkdtemp((0, import_node_path8.join)(parent, ".lk-backup-")) : void 0;
     if (hadOutDir && backup) {
       await renameOrCopy(outDir, backup);
     }
@@ -1301,7 +1379,7 @@ async function promoteStagingToOutDir(stagingDir, outDir) {
         try {
           await renameOrCopy(backup, outDir);
         } catch (restoreError) {
-          const failedPromote2 = (0, import_node_path7.join)(parent, `.lk-failed-promote-${(0, import_node_crypto.randomUUID)()}`);
+          const failedPromote2 = (0, import_node_path8.join)(parent, `.lk-failed-promote-${(0, import_node_crypto.randomUUID)()}`);
           try {
             await renameOrCopy(tmpPromote, failedPromote2);
           } catch {
@@ -1313,7 +1391,8 @@ async function promoteStagingToOutDir(stagingDir, outDir) {
           const promoteMsg = promoteError instanceof Error ? promoteError.message : String(promoteError);
           const restoreMsg = restoreError instanceof Error ? restoreError.message : String(restoreError);
           throw new Error(
-            `[lessonkit/lxpack] promote failed (${promoteMsg}) and could not restore ${outDir} (${restoreMsg}). Recovery: previous output may be in ${backup}; staged package may be in ${failedPromote2}.`
+            `[lessonkit/lxpack] promote failed (${promoteMsg}) and could not restore ${outDir} (${restoreMsg}). Recovery: previous output may be in ${backup}; staged package may be in ${failedPromote2}.`,
+            { cause: restoreError }
           );
         }
       } else {
@@ -1331,7 +1410,7 @@ async function promoteStagingToOutDir(stagingDir, outDir) {
         }
         throw promoteError;
       }
-      const failedPromote = (0, import_node_path7.join)(parent, `.lk-failed-promote-${(0, import_node_crypto.randomUUID)()}`);
+      const failedPromote = (0, import_node_path8.join)(parent, `.lk-failed-promote-${(0, import_node_crypto.randomUUID)()}`);
       try {
         await renameOrCopy(tmpPromote, failedPromote);
       } catch {
@@ -1353,16 +1432,17 @@ async function promoteStagingToOutDir(stagingDir, outDir) {
 
 // src/packaging/staging.ts
 var fsp2 = __toESM(require("fs/promises"), 1);
-var import_node_path8 = require("path");
+var import_node_path9 = require("path");
 var import_node_os = require("os");
 var import_api = require("@lxpack/api");
 async function buildStagingPackage(options) {
   const { target, output, dir, outputBaseDir, descriptor, ...writeOpts } = options;
-  const stagingDir = await fsp2.mkdtemp((0, import_node_path8.join)((0, import_node_os.tmpdir)(), "lessonkit-lxpack-"));
+  const stagingDir = await fsp2.mkdtemp((0, import_node_path9.join)((0, import_node_os.tmpdir)(), "lessonkit-lxpack-"));
   try {
     let spaDirs;
     try {
       spaDirs = await resolveSpaDirs({ ...writeOpts, descriptor });
+      await assertSpaDistContentsSafe(spaDirs, writeOpts.projectRoot);
     } catch (err) {
       return {
         ok: false,
@@ -1375,10 +1455,21 @@ async function buildStagingPackage(options) {
         ]
       };
     }
+    const injectableIssues = validateInjectableAssessments(descriptor);
+    if (injectableIssues.length > 0) {
+      return {
+        ok: false,
+        stagingDir,
+        issues: injectableIssues.map((i) => ({
+          path: i.path,
+          message: i.message
+        }))
+      };
+    }
     const interchange = descriptorToInterchange(descriptor);
     const outputBase = outputBaseDir ?? ".lxpack/out";
-    await fsp2.mkdir((0, import_node_path8.join)(stagingDir, outputBase), { recursive: true });
-    const defaultOutput = output ?? (dir ? (0, import_node_path8.join)(outputBase, target) : (0, import_node_path8.join)(outputBase, `course-${target}.zip`));
+    await fsp2.mkdir((0, import_node_path9.join)(stagingDir, outputBase), { recursive: true });
+    const defaultOutput = output ?? (dir ? (0, import_node_path9.join)(outputBase, target) : (0, import_node_path9.join)(outputBase, `course-${target}.zip`));
     const build = await (0, import_api.packageLessonkit)({
       interchange,
       spaDirs,
@@ -1418,7 +1509,7 @@ async function buildStagingPackage(options) {
   }
 }
 async function ensureOutDirParent(outDir) {
-  await fsp2.mkdir((0, import_node_path8.dirname)(outDir), { recursive: true });
+  await fsp2.mkdir((0, import_node_path9.dirname)(outDir), { recursive: true });
 }
 
 // src/packaging/issueSeverity.ts
@@ -1433,13 +1524,13 @@ function findPackagingErrorIssues(issues) {
 // src/packageCourse.ts
 async function validateLessonkitProject(options) {
   return (0, import_api2.validateCourse)({
-    courseDir: (0, import_node_path9.resolve)(options.courseDir),
+    courseDir: (0, import_node_path10.resolve)(options.courseDir),
     target: options.target
   });
 }
 async function buildLessonkitProject(options) {
   const buildOptions = {
-    courseDir: (0, import_node_path9.resolve)(options.courseDir),
+    courseDir: (0, import_node_path10.resolve)(options.courseDir),
     target: options.target,
     output: options.output,
     dir: options.dir,
@@ -1470,7 +1561,7 @@ async function packageLessonkitCourse(options) {
   if (!descriptorValidation.ok) {
     return {
       ok: false,
-      courseDir: (0, import_node_path9.resolve)(writeOpts.outDir),
+      courseDir: (0, import_node_path10.resolve)(writeOpts.outDir),
       target,
       issues: descriptorValidation.issues.map((i) => ({
         path: i.path,
@@ -1498,18 +1589,6 @@ async function packageLessonkitCourse(options) {
       };
     }
   }
-  const nonInjectableAssessments = (descriptor.assessments ?? []).map((assessment, index) => ({ assessment, index })).filter(({ assessment }) => assessmentDescriptorToLxpack(assessment) === null);
-  if (nonInjectableAssessments.length > 0) {
-    return {
-      ok: false,
-      courseDir: outDir,
-      target,
-      issues: nonInjectableAssessments.map(({ assessment, index }) => ({
-        path: `assessments[${index}]`,
-        message: `assessment kind "${assessment.kind ?? "mcq"}" (checkId "${assessment.checkId}") is not injected into LMS shell quizzes for target "${target}"`
-      }))
-    };
-  }
   const staged = await buildStagingPackage({
     ...writeOpts,
     descriptor,

package/dist/index.d.cts

@@ -1,4 +1,5 @@
-import { CheckId, CourseId, LessonId } from '@lessonkit/core';
+import { McqAssessmentProps, CheckId, CourseId, LessonId } from '@lessonkit/core';
+export { LmsBridgeMode, McqAssessmentProps } from '@lessonkit/core';
 import { ThemePresetName, LessonkitThemeV1 } from '@lessonkit/themes';
 import { ExportTarget, BuildCourseResult, ValidateCourseResult } from '@lxpack/api';
 export { ExportTarget } from '@lxpack/api';
@@ -14,14 +15,8 @@ type LessonDescriptor = {
     /** Built SPA folder relative to the LXPack project root (`per-lesson-spa` only). */
     spaPath?: string;
 };
-type McqAssessmentDescriptor = {
-    kind?: "mcq";
-    checkId: CheckId;
-    question: string;
-    choices: string[];
-    answer: string;
-    passingScore?: number;
-};
+/** @deprecated Use `McqAssessmentProps` from `@lessonkit/core`. */
+type McqAssessmentDescriptor = McqAssessmentProps;
 type TrueFalseAssessmentDescriptor = {
     kind: "trueFalse";
     checkId: CheckId;
@@ -235,6 +230,8 @@ type BuildStagingPackageResult = {
 declare function buildStagingPackage(options: BuildStagingPackageOptions): Promise<BuildStagingPackageResult>;
 declare function ensureOutDirParent(outDir: string): Promise<void>;
 
+/** LessonKit-owned alias for LMS export targets (maps to `@lxpack/api` `ExportTarget`). */
+type LessonkitExportTarget = ExportTarget;
 type ValidateLessonkitProjectOptions = {
     courseDir: string;
     target?: ExportTarget;
@@ -325,4 +322,4 @@ type ParseManifestResult = {
 declare function parseLessonkitManifest(raw: unknown, label?: string, projectRoot?: string): ParseManifestResult;
 declare function loadLessonkitManifestFromFile(readJson: () => Promise<unknown>, label?: string, projectRoot?: string): Promise<ParseManifestResult>;
 
-export { type AssessmentDescriptor, type BuildLessonkitProjectOptions, type BuildStagingPackageOptions, type BuildStagingPackageResult, type DescriptorValidationIssue, type DescriptorValidationResult, type FillInBlanksAssessmentDescriptor, type LessonDescriptor, type LessonkitCourseDescriptor, type LessonkitManifest, type LessonkitManifestPaths, type LxpackInjectedAssessment, type LxpackRuntimeTheme, type ManifestParseIssue, type MappedLessonkitIds, type McqAssessmentDescriptor, type PackageLessonkitCourseOptions, type PackageLessonkitCourseResult, type PackageValidationIssue, type ParseManifestResult, type ProjectPathsInput, type ReactParityIssue, type SpaLayout, type SpaLessonEntry, type TrueFalseAssessmentDescriptor, type ValidateLessonkitProjectOptions, type ValidatePackageInputsResult, type ValidationIssue, type WriteLxpackProjectOptions, type WriteLxpackProjectResult, assessmentDescriptorToLxpack, buildLessonkitProject, buildStagingPackage, descriptorToInterchange, ensureOutDirParent, extractAssessments, loadLessonkitManifestFromFile, mapLessonkitIds, packageLessonkitCourse, parseLessonkitManifest, promoteStagingToOutDir, remapArtifactPaths, resolveSafePackageOutputOverride, resolveSpaLessons, themeToLxpackRuntime, validateDescriptor, validateDescriptorForTarget, validateLessonkitProject, validatePackageInputs, validateProjectPaths, validateReactManifestParity, writeLxpackProject };
+export { type AssessmentDescriptor, type BuildLessonkitProjectOptions, type BuildStagingPackageOptions, type BuildStagingPackageResult, type DescriptorValidationIssue, type DescriptorValidationResult, type FillInBlanksAssessmentDescriptor, type LessonDescriptor, type LessonkitCourseDescriptor, type LessonkitExportTarget, type LessonkitManifest, type LessonkitManifestPaths, type LxpackInjectedAssessment, type LxpackRuntimeTheme, type ManifestParseIssue, type MappedLessonkitIds, type McqAssessmentDescriptor, type PackageLessonkitCourseOptions, type PackageLessonkitCourseResult, type PackageValidationIssue, type ParseManifestResult, type ProjectPathsInput, type ReactParityIssue, type SpaLayout, type SpaLessonEntry, type TrueFalseAssessmentDescriptor, type ValidateLessonkitProjectOptions, type ValidatePackageInputsResult, type ValidationIssue, type WriteLxpackProjectOptions, type WriteLxpackProjectResult, assessmentDescriptorToLxpack, buildLessonkitProject, buildStagingPackage, descriptorToInterchange, ensureOutDirParent, extractAssessments, loadLessonkitManifestFromFile, mapLessonkitIds, packageLessonkitCourse, parseLessonkitManifest, promoteStagingToOutDir, remapArtifactPaths, resolveSafePackageOutputOverride, resolveSpaLessons, themeToLxpackRuntime, validateDescriptor, validateDescriptorForTarget, validateLessonkitProject, validatePackageInputs, validateProjectPaths, validateReactManifestParity, writeLxpackProject };

package/dist/index.d.ts

@@ -1,4 +1,5 @@
-import { CheckId, CourseId, LessonId } from '@lessonkit/core';
+import { McqAssessmentProps, CheckId, CourseId, LessonId } from '@lessonkit/core';
+export { LmsBridgeMode, McqAssessmentProps } from '@lessonkit/core';
 import { ThemePresetName, LessonkitThemeV1 } from '@lessonkit/themes';
 import { ExportTarget, BuildCourseResult, ValidateCourseResult } from '@lxpack/api';
 export { ExportTarget } from '@lxpack/api';
@@ -14,14 +15,8 @@ type LessonDescriptor = {
     /** Built SPA folder relative to the LXPack project root (`per-lesson-spa` only). */
     spaPath?: string;
 };
-type McqAssessmentDescriptor = {
-    kind?: "mcq";
-    checkId: CheckId;
-    question: string;
-    choices: string[];
-    answer: string;
-    passingScore?: number;
-};
+/** @deprecated Use `McqAssessmentProps` from `@lessonkit/core`. */
+type McqAssessmentDescriptor = McqAssessmentProps;
 type TrueFalseAssessmentDescriptor = {
     kind: "trueFalse";
     checkId: CheckId;
@@ -235,6 +230,8 @@ type BuildStagingPackageResult = {
 declare function buildStagingPackage(options: BuildStagingPackageOptions): Promise<BuildStagingPackageResult>;
 declare function ensureOutDirParent(outDir: string): Promise<void>;
 
+/** LessonKit-owned alias for LMS export targets (maps to `@lxpack/api` `ExportTarget`). */
+type LessonkitExportTarget = ExportTarget;
 type ValidateLessonkitProjectOptions = {
     courseDir: string;
     target?: ExportTarget;
@@ -325,4 +322,4 @@ type ParseManifestResult = {
 declare function parseLessonkitManifest(raw: unknown, label?: string, projectRoot?: string): ParseManifestResult;
 declare function loadLessonkitManifestFromFile(readJson: () => Promise<unknown>, label?: string, projectRoot?: string): Promise<ParseManifestResult>;
 
-export { type AssessmentDescriptor, type BuildLessonkitProjectOptions, type BuildStagingPackageOptions, type BuildStagingPackageResult, type DescriptorValidationIssue, type DescriptorValidationResult, type FillInBlanksAssessmentDescriptor, type LessonDescriptor, type LessonkitCourseDescriptor, type LessonkitManifest, type LessonkitManifestPaths, type LxpackInjectedAssessment, type LxpackRuntimeTheme, type ManifestParseIssue, type MappedLessonkitIds, type McqAssessmentDescriptor, type PackageLessonkitCourseOptions, type PackageLessonkitCourseResult, type PackageValidationIssue, type ParseManifestResult, type ProjectPathsInput, type ReactParityIssue, type SpaLayout, type SpaLessonEntry, type TrueFalseAssessmentDescriptor, type ValidateLessonkitProjectOptions, type ValidatePackageInputsResult, type ValidationIssue, type WriteLxpackProjectOptions, type WriteLxpackProjectResult, assessmentDescriptorToLxpack, buildLessonkitProject, buildStagingPackage, descriptorToInterchange, ensureOutDirParent, extractAssessments, loadLessonkitManifestFromFile, mapLessonkitIds, packageLessonkitCourse, parseLessonkitManifest, promoteStagingToOutDir, remapArtifactPaths, resolveSafePackageOutputOverride, resolveSpaLessons, themeToLxpackRuntime, validateDescriptor, validateDescriptorForTarget, validateLessonkitProject, validatePackageInputs, validateProjectPaths, validateReactManifestParity, writeLxpackProject };
+export { type AssessmentDescriptor, type BuildLessonkitProjectOptions, type BuildStagingPackageOptions, type BuildStagingPackageResult, type DescriptorValidationIssue, type DescriptorValidationResult, type FillInBlanksAssessmentDescriptor, type LessonDescriptor, type LessonkitCourseDescriptor, type LessonkitExportTarget, type LessonkitManifest, type LessonkitManifestPaths, type LxpackInjectedAssessment, type LxpackRuntimeTheme, type ManifestParseIssue, type MappedLessonkitIds, type McqAssessmentDescriptor, type PackageLessonkitCourseOptions, type PackageLessonkitCourseResult, type PackageValidationIssue, type ParseManifestResult, type ProjectPathsInput, type ReactParityIssue, type SpaLayout, type SpaLessonEntry, type TrueFalseAssessmentDescriptor, type ValidateLessonkitProjectOptions, type ValidatePackageInputsResult, type ValidationIssue, type WriteLxpackProjectOptions, type WriteLxpackProjectResult, assessmentDescriptorToLxpack, buildLessonkitProject, buildStagingPackage, descriptorToInterchange, ensureOutDirParent, extractAssessments, loadLessonkitManifestFromFile, mapLessonkitIds, packageLessonkitCourse, parseLessonkitManifest, promoteStagingToOutDir, remapArtifactPaths, resolveSafePackageOutputOverride, resolveSpaLessons, themeToLxpackRuntime, validateDescriptor, validateDescriptorForTarget, validateLessonkitProject, validatePackageInputs, validateProjectPaths, validateReactManifestParity, writeLxpackProject };

package/dist/index.js

@@ -315,6 +315,10 @@ var validateMcqLike = (assessment, path, issues) => {
   } else if (trimmedChoices.length && !trimmedChoices.includes(assessment.answer.trim())) {
     issues.push({ path: `${path}.answer`, message: "answer must match a choice" });
   }
+  const uniqueChoices = new Set(trimmedChoices);
+  if (trimmedChoices.length !== uniqueChoices.size) {
+    issues.push({ path: `${path}.choices`, message: "choices must be unique" });
+  }
 };
 function countStarDelimitedBlanks(template) {
   const matches = template.match(/\*[^*]+\*/g);
@@ -582,15 +586,8 @@ function assessmentDescriptorToLxpack(assessment) {
   if (kind === "fillInBlanks") {
     return null;
   }
-  if (kind === "findHotspot" && assessment.kind === "findHotspot") {
-    return mcqToLxpack({
-      kind: "mcq",
-      checkId: assessment.checkId,
-      question: assessment.question,
-      choices: [assessment.correctTargetId, "other"],
-      answer: assessment.correctTargetId,
-      passingScore: assessment.passingScore
-    });
+  if (kind === "findHotspot") {
+    return null;
   }
   if (kind === "findMultipleHotspots") {
     return null;
@@ -604,6 +601,20 @@ function extractAssessments(descriptor) {
   return (descriptor.assessments ?? []).map(assessmentDescriptorToLxpack).filter((a) => a !== null);
 }
 
+// src/descriptor/validateInjectableAssessments.ts
+function validateInjectableAssessments(descriptor) {
+  const issues = [];
+  (descriptor.assessments ?? []).forEach((assessment, index) => {
+    if (assessmentDescriptorToLxpack(assessment) === null) {
+      issues.push({
+        path: `assessments[${index}]`,
+        message: `assessment kind "${assessment.kind ?? "mcq"}" (checkId "${assessment.checkId}") is not injected into LMS shell quizzes`
+      });
+    }
+  });
+  return issues;
+}
+
 // src/descriptor/validateForTarget.ts
 var LMS_SHELL_TARGETS = /* @__PURE__ */ new Set([
   "scorm12",
@@ -618,20 +629,21 @@ function validateDescriptorForExportTarget(descriptor, target) {
     const activityIri = descriptor.tracking?.xapi?.activityIri?.trim();
     if (!activityIri) {
       issues.push({
-        path: "course.tracking.xapi.activityIri",
+        path: "tracking.xapi.activityIri",
         message: "tracking.xapi.activityIri is required for xapi and cmi5 export targets"
       });
+    } else if (!/^https:\/\/.+/i.test(activityIri)) {
+      issues.push({
+        path: "tracking.xapi.activityIri",
+        message: "tracking.xapi.activityIri must be an HTTPS URL for xapi and cmi5 export targets"
+      });
     }
   }
   if (LMS_SHELL_TARGETS.has(target)) {
-    (descriptor.assessments ?? []).forEach((assessment, index) => {
-      if (assessmentDescriptorToLxpack(assessment) === null) {
-        issues.push({
-          path: `assessments[${index}]`,
-          message: `assessment kind "${assessment.kind ?? "mcq"}" (checkId "${assessment.checkId}") is not injected into LMS shell quizzes for target "${target}"`
-        });
-      }
-    });
+    issues.push(...validateInjectableAssessments(descriptor).map((issue) => ({
+      ...issue,
+      message: `${issue.message} for target "${target}"`
+    })));
   }
   return issues;
 }
@@ -729,6 +741,10 @@ function checkIdPresent(source, checkId) {
   if (idPropPatterns("checkId", checkId).some((p) => stripped.includes(p))) return true;
   return idUsedViaConstant(stripped, "checkId", checkId, extractStringConstants(source));
 }
+var ID_SYNC_DOC = "https://lessonkit.readthedocs.io/en/latest/guides/react-developers/quickstart.html#keep-react-ids-in-sync-with-lessonkitjson";
+function parityHint(message) {
+  return `${message} See ${ID_SYNC_DOC}`;
+}
 function validateReactManifestParity(opts) {
   const appSources = opts.appSources ?? collectSourceUnderSrc(opts.projectRoot);
   const source = readAppSources(opts.projectRoot, appSources);
@@ -747,7 +763,9 @@ function validateReactManifestParity(opts) {
   if (!courseIdPresent(source, courseId)) {
     issues.push({
       path: "course.courseId",
-      message: `React app source does not reference courseId="${courseId}" from lessonkit.json`,
+      message: parityHint(
+        `React app source does not reference courseId="${courseId}" from lessonkit.json.`
+      ),
       severity: "error"
     });
   }
@@ -757,7 +775,9 @@ function validateReactManifestParity(opts) {
     if (!checkIdPresent(source, checkId)) {
       issues.push({
         path: `assessments.checkId:${checkId}`,
-        message: `React app source missing checkId="${checkId}" declared in lessonkit.json`,
+        message: parityHint(
+          `React app source missing checkId="${checkId}" declared in lessonkit.json.`
+        ),
         severity: "error"
       });
     }
@@ -888,7 +908,7 @@ function descriptorToInterchange(descriptor) {
 }
 
 // src/writeProject.ts
-import { join as join4, resolve as resolve4 } from "path";
+import { join as join5, resolve as resolve4 } from "path";
 import { materializeLessonkitProject } from "@lxpack/validators";
 
 // src/spaDirs.ts
@@ -946,6 +966,59 @@ async function resolveSpaDirs(options) {
   return dirs;
 }
 
+// src/spaDistValidation.ts
+import { lstat, readdir } from "fs/promises";
+import { realpathSync as realpathSync2 } from "fs";
+import { join as join4 } from "path";
+async function assertSpaDistContentsSafe(spaDirs, projectRoot) {
+  for (const [label, dir] of Object.entries(spaDirs)) {
+    const dirResolved = resolveComparablePath(dir);
+    const dirStat = await lstat(dirResolved);
+    if (dirStat.isSymbolicLink()) {
+      throw new Error(`spa dist for "${label}" cannot be a symlink: ${dir}`);
+    }
+    let rootReal;
+    try {
+      rootReal = realpathSync2(dirResolved);
+    } catch {
+      throw new Error(`spa dist for "${label}" is not readable: ${dir}`);
+    }
+    if (projectRoot) {
+      assertRealPathUnderRoot(projectRoot, dir);
+    }
+    assertResolvedPathUnderRoot(rootReal, rootReal);
+    await walkDistDir(rootReal, rootReal, label);
+  }
+}
+async function walkDistDir(rootReal, current, label) {
+  let entries;
+  try {
+    entries = await readdir(current, { withFileTypes: true });
+  } catch (err) {
+    throw new Error(
+      `spa dist for "${label}" is not readable: ${err instanceof Error ? err.message : String(err)}`,
+      { cause: err }
+    );
+  }
+  for (const entry of entries) {
+    const entryPath = join4(current, entry.name);
+    const stat2 = await lstat(entryPath);
+    if (stat2.isSymbolicLink()) {
+      throw new Error(`spa dist for "${label}" contains symlink: ${entryPath}`);
+    }
+    let entryReal;
+    try {
+      entryReal = realpathSync2(entryPath);
+    } catch {
+      entryReal = entryPath;
+    }
+    assertResolvedPathUnderRoot(rootReal, entryReal);
+    if (stat2.isDirectory()) {
+      await walkDistDir(rootReal, entryPath, label);
+    }
+  }
+}
+
 // src/writeProject.ts
 async function writeLxpackProject(options) {
   const validation = validateDescriptor(options.descriptor);
@@ -955,11 +1028,16 @@ async function writeLxpackProject(options) {
     );
   }
   const descriptor = validation.descriptor;
+  const injectableIssues = validateInjectableAssessments(descriptor);
+  if (injectableIssues.length > 0) {
+    throw new Error(injectableIssues.map((i) => `${i.path}: ${i.message}`).join("; "));
+  }
   const outDir = resolve4(options.outDir);
   if (options.projectRoot) {
     assertRealPathUnderRoot(resolve4(options.projectRoot), outDir);
   }
   const spaDirs = await resolveSpaDirs({ ...options, descriptor });
+  await assertSpaDistContentsSafe(spaDirs, options.projectRoot);
   const interchange = descriptorToInterchange(descriptor);
   const materialized = await materializeLessonkitProject({
     interchange,
@@ -975,8 +1053,8 @@ async function writeLxpackProject(options) {
   const courseDir = materialized.courseDir;
   return {
     outDir: courseDir,
-    courseYamlPath: join4(courseDir, "course.yaml"),
-    lessonkitJsonPath: join4(courseDir, "lessonkit.json")
+    courseYamlPath: join5(courseDir, "course.yaml"),
+    lessonkitJsonPath: join5(courseDir, "lessonkit.json")
   };
 }
 
@@ -989,7 +1067,7 @@ import {
 } from "@lxpack/api";
 
 // src/packaging/validateInputs.ts
-import { isAbsolute as isAbsolute3, join as join5, resolve as resolve5, win32 as win322 } from "path";
+import { isAbsolute as isAbsolute3, join as join6, resolve as resolve5, win32 as win322 } from "path";
 function validatePackageInputs(options) {
   const { target, output, outputBaseDir } = options;
   const outDir = resolve5(options.outDir);
@@ -1126,13 +1204,13 @@ function remapArtifactPaths(stagingRoot, outDir, artifactPath) {
   if (/^[a-zA-Z]:[/\\]/.test(outDir)) {
     return win322.join(outDir, rel.replace(/\//g, win322.sep));
   }
-  return join5(outDir, rel);
+  return join6(outDir, rel);
 }
 
 // src/packaging/promote.ts
 import * as fsp from "fs/promises";
 import { createHash, randomUUID } from "crypto";
-import { dirname, join as join6, resolve as resolve6 } from "path";
+import { dirname, join as join7, resolve as resolve6 } from "path";
 async function pathExists(path) {
   try {
     await fsp.access(path);
@@ -1154,7 +1232,7 @@ async function renameOrCopy(from, to) {
 function promoteLockPath(outDir) {
   const parent = dirname(outDir);
   const hash = createHash("sha256").update(resolve6(outDir)).digest("hex").slice(0, 16);
-  return join6(parent, `.lk-promote-lock-${hash}`);
+  return join7(parent, `.lk-promote-lock-${hash}`);
 }
 var STALE_LOCK_TTL_MS = 5 * 60 * 1e3;
 async function isStalePromoteLock(lockPath) {
@@ -1230,10 +1308,10 @@ async function promoteStagingToOutDir(stagingDir, outDir) {
   return withPromoteLock(outDir, async () => {
     await assertNoLegacyPromoteArtifacts(outDir);
     const parent = dirname(outDir);
-    const tmpPromote = await fsp.mkdtemp(join6(parent, ".lk-promote-"));
+    const tmpPromote = await fsp.mkdtemp(join7(parent, ".lk-promote-"));
     await renameOrCopy(stagingDir, tmpPromote);
     const hadOutDir = await pathExists(outDir);
-    const backup = hadOutDir ? await fsp.mkdtemp(join6(parent, ".lk-backup-")) : void 0;
+    const backup = hadOutDir ? await fsp.mkdtemp(join7(parent, ".lk-backup-")) : void 0;
     if (hadOutDir && backup) {
       await renameOrCopy(outDir, backup);
     }
@@ -1244,7 +1322,7 @@ async function promoteStagingToOutDir(stagingDir, outDir) {
         try {
           await renameOrCopy(backup, outDir);
         } catch (restoreError) {
-          const failedPromote2 = join6(parent, `.lk-failed-promote-${randomUUID()}`);
+          const failedPromote2 = join7(parent, `.lk-failed-promote-${randomUUID()}`);
           try {
             await renameOrCopy(tmpPromote, failedPromote2);
           } catch {
@@ -1256,7 +1334,8 @@ async function promoteStagingToOutDir(stagingDir, outDir) {
           const promoteMsg = promoteError instanceof Error ? promoteError.message : String(promoteError);
           const restoreMsg = restoreError instanceof Error ? restoreError.message : String(restoreError);
           throw new Error(
-            `[lessonkit/lxpack] promote failed (${promoteMsg}) and could not restore ${outDir} (${restoreMsg}). Recovery: previous output may be in ${backup}; staged package may be in ${failedPromote2}.`
+            `[lessonkit/lxpack] promote failed (${promoteMsg}) and could not restore ${outDir} (${restoreMsg}). Recovery: previous output may be in ${backup}; staged package may be in ${failedPromote2}.`,
+            { cause: restoreError }
           );
         }
       } else {
@@ -1274,7 +1353,7 @@ async function promoteStagingToOutDir(stagingDir, outDir) {
         }
         throw promoteError;
       }
-      const failedPromote = join6(parent, `.lk-failed-promote-${randomUUID()}`);
+      const failedPromote = join7(parent, `.lk-failed-promote-${randomUUID()}`);
       try {
         await renameOrCopy(tmpPromote, failedPromote);
       } catch {
@@ -1296,16 +1375,17 @@ async function promoteStagingToOutDir(stagingDir, outDir) {
 
 // src/packaging/staging.ts
 import * as fsp2 from "fs/promises";
-import { dirname as dirname2, join as join7 } from "path";
+import { dirname as dirname2, join as join8 } from "path";
 import { tmpdir } from "os";
 import { packageLessonkit } from "@lxpack/api";
 async function buildStagingPackage(options) {
   const { target, output, dir, outputBaseDir, descriptor, ...writeOpts } = options;
-  const stagingDir = await fsp2.mkdtemp(join7(tmpdir(), "lessonkit-lxpack-"));
+  const stagingDir = await fsp2.mkdtemp(join8(tmpdir(), "lessonkit-lxpack-"));
   try {
     let spaDirs;
     try {
       spaDirs = await resolveSpaDirs({ ...writeOpts, descriptor });
+      await assertSpaDistContentsSafe(spaDirs, writeOpts.projectRoot);
     } catch (err) {
       return {
         ok: false,
@@ -1318,10 +1398,21 @@ async function buildStagingPackage(options) {
         ]
       };
     }
+    const injectableIssues = validateInjectableAssessments(descriptor);
+    if (injectableIssues.length > 0) {
+      return {
+        ok: false,
+        stagingDir,
+        issues: injectableIssues.map((i) => ({
+          path: i.path,
+          message: i.message
+        }))
+      };
+    }
     const interchange = descriptorToInterchange(descriptor);
     const outputBase = outputBaseDir ?? ".lxpack/out";
-    await fsp2.mkdir(join7(stagingDir, outputBase), { recursive: true });
-    const defaultOutput = output ?? (dir ? join7(outputBase, target) : join7(outputBase, `course-${target}.zip`));
+    await fsp2.mkdir(join8(stagingDir, outputBase), { recursive: true });
+    const defaultOutput = output ?? (dir ? join8(outputBase, target) : join8(outputBase, `course-${target}.zip`));
     const build = await packageLessonkit({
       interchange,
       spaDirs,
@@ -1441,18 +1532,6 @@ async function packageLessonkitCourse(options) {
       };
     }
   }
-  const nonInjectableAssessments = (descriptor.assessments ?? []).map((assessment, index) => ({ assessment, index })).filter(({ assessment }) => assessmentDescriptorToLxpack(assessment) === null);
-  if (nonInjectableAssessments.length > 0) {
-    return {
-      ok: false,
-      courseDir: outDir,
-      target,
-      issues: nonInjectableAssessments.map(({ assessment, index }) => ({
-        path: `assessments[${index}]`,
-        message: `assessment kind "${assessment.kind ?? "mcq"}" (checkId "${assessment.checkId}") is not injected into LMS shell quizzes for target "${target}"`
-      }))
-    };
-  }
   const staged = await buildStagingPackage({
     ...writeOpts,
     descriptor,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lessonkit/lxpack",
-  "version": "1.3.1",
+  "version": "1.4.0",
   "private": false,
   "description": "LXPack export adapter for LessonKit courses (SCORM, standalone, xAPI, cmi5).",
   "license": "Apache-2.0",
@@ -55,15 +55,15 @@
     "lint": "echo \"(no lint configured yet)\""
   },
   "dependencies": {
-    "@lessonkit/core": "1.3.1",
-    "@lessonkit/themes": "1.3.1",
-    "@lxpack/api": "^0.6.2",
-    "@lxpack/spa-bridge": "^0.6.2",
-    "@lxpack/tracking-schema": "^0.6.2",
-    "@lxpack/validators": "^0.6.2"
+    "@lessonkit/core": "1.4.0",
+    "@lessonkit/themes": "1.4.0",
+    "@lxpack/api": "0.6.4",
+    "@lxpack/spa-bridge": "0.6.4",
+    "@lxpack/tracking-schema": "0.6.4",
+    "@lxpack/validators": "0.6.4"
   },
   "devDependencies": {
-    "@types/node": "^22.13.10",
+    "@types/node": "^25.9.2",
     "tsup": "^8.5.0",
     "typescript": "^5.8.3",
     "vitest": "^4.1.8"