@longsightgroup/qti3-core 0.9.0 → 0.9.2

package/README.md

@@ -109,6 +109,45 @@ The delivery redaction and server-scoring APIs are library APIs in `0.5.x`. CLI
 for delivery-safe XML generation and server-style scoring are not part of this release
 line yet.
 
+### Secure adaptive turns
+
+Adaptive item delivery should run each submitted turn against authoritative XML on the
+server, preserving prior `qti3.attempt-state.v1` between turns:
+
+```ts
+import { processQtiAdaptiveItemTurn } from "@longsightgroup/qti3-core";
+
+const turn = processQtiAdaptiveItemTurn({
+  itemXml: authoritativeItemXml,
+  priorState: savedAttemptState,
+  trustedResponses: { RESPONSE: "A" },
+});
+
+if (!turn.ok) {
+  throw new Error(turn.diagnostics.map((item) => item.message).join("; "));
+}
+
+store(turn.state);
+sendToCandidate(turn.candidateSafeXml, turn.state);
+```
+
+Deliver both artifacts to the player on each adaptive turn:
+
+- `candidateSafeXml` — server-materialized presentation for the current turn (outcome-visible feedback, secrets stripped)
+- `state` — authoritative `qti3.attempt-state.v1` with trusted responses, outcomes, and interaction state
+
+```ts
+await player.loadXml(turn.candidateSafeXml);
+player.restore(turn.state);
+```
+
+Refresh turns with no new submission still return updated materialized XML derived from restored outcomes, so a resume flow should load both values again even when the candidate does not submit a new response.
+
+The static delivery redactor still fails closed for adaptive response processing. Use
+`processQtiAdaptiveItemTurn()` when a host needs a server-materialized candidate view
+and updated authoritative outcomes for the next adaptive turn. The low-level adaptive-turn
+redactor is internal to the core package; hosts should not call it directly.
+
 ## Scope
 
 - Parse QTI XML into a typed item model.

package/dist/adaptive-turn-materializer.d.ts

@@ -0,0 +1,14 @@
+import { type QtiDeliverySecurityAnalysis } from "./delivery-redaction.js";
+import type { QtiDiagnostic, QtiValue } from "./types.js";
+export interface QtiAdaptiveCandidateMaterializationInput {
+    itemXml: string;
+    outcomes: Record<string, QtiValue>;
+}
+export interface QtiAdaptiveCandidateMaterializationResult {
+    ok: boolean;
+    diagnostics: QtiDiagnostic[];
+    analysis: QtiDeliverySecurityAnalysis;
+    xml?: string | undefined;
+}
+export declare function materializeAdaptiveCandidateView(input: QtiAdaptiveCandidateMaterializationInput): QtiAdaptiveCandidateMaterializationResult;
+//# sourceMappingURL=adaptive-turn-materializer.d.ts.map

package/dist/adaptive-turn-materializer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adaptive-turn-materializer.d.ts","sourceRoot":"","sources":["../src/adaptive-turn-materializer.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,2BAA2B,EAEjC,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAW1D,MAAM,WAAW,wCAAwC;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,yCAAyC;IACxD,EAAE,EAAE,OAAO,CAAC;IACZ,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,QAAQ,EAAE,2BAA2B,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B;AAED,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,wCAAwC,GAC9C,yCAAyC,CAE3C"}

package/dist/adaptive-turn-materializer.js

@@ -0,0 +1,56 @@
+import { FORBIDDEN_DELIVERY_SECRET_ELEMENT_NAMES, isDeclarationDefaultValue, redactDeliveryXml, } from "./delivery-redaction.js";
+import { qtiValueToString } from "./value-format.js";
+const UNSUPPORTED_MATERIALIZATION_ELEMENT_NAMES = new Set([
+    "template-processing",
+    "set-correct-response",
+]);
+const FEEDBACK_ELEMENT_NAMES = new Set(["feedback-inline", "feedback-block", "modal-feedback"]);
+export function materializeAdaptiveCandidateView(input) {
+    return redactDeliveryXml(input.itemXml, adaptiveMaterializationPolicy(input.outcomes));
+}
+function shouldPreserveFeedback(node, outcomes) {
+    if (node.attributes["show-hide"] === "hide")
+        return false;
+    const identifier = node.attributes.identifier;
+    const outcomeIdentifier = node.attributes["outcome-identifier"];
+    if (!identifier || !outcomeIdentifier)
+        return false;
+    const outcome = outcomes[outcomeIdentifier] ?? null;
+    if (Array.isArray(outcome))
+        return outcome.includes(identifier);
+    return qtiValueToString(outcome) === identifier;
+}
+function isFeedbackElement(normalizedName) {
+    return FEEDBACK_ELEMENT_NAMES.has(normalizedName);
+}
+function adaptiveMaterializationPolicy(outcomes) {
+    return {
+        isForbiddenElement(node, normalizedName) {
+            if (isFeedbackElement(normalizedName))
+                return !shouldPreserveFeedback(node, outcomes);
+            return (FORBIDDEN_DELIVERY_SECRET_ELEMENT_NAMES.has(normalizedName) ||
+                isDeclarationDefaultValue(node, normalizedName));
+        },
+        unsupportedFinding(node, normalizedName) {
+            if (!UNSUPPORTED_MATERIALIZATION_ELEMENT_NAMES.has(normalizedName))
+                return null;
+            return {
+                kind: "unsupported-secure-delivery-element",
+                qtiName: node.name,
+                localName: node.localName,
+                message: `${node.name} is not supported by adaptive candidate materialization v1.`,
+                source: node.source,
+            };
+        },
+        diagnosticCodeForFinding,
+        forbiddenElementMessage(node) {
+            return `${node.name} exposes answer keys, scoring, mapping, feedback, or solution information during adaptive delivery.`;
+        },
+    };
+}
+function diagnosticCodeForFinding(kind) {
+    return kind === "unsupported-secure-delivery-element"
+        ? "adaptiveTurn.materialization.unsupported"
+        : "adaptiveTurn.materialization.forbiddenElement";
+}
+//# sourceMappingURL=adaptive-turn-materializer.js.map

package/dist/adaptive-turn-materializer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adaptive-turn-materializer.js","sourceRoot":"","sources":["../src/adaptive-turn-materializer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uCAAuC,EACvC,yBAAyB,EACzB,iBAAiB,GAIlB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAGrD,MAAM,yCAAyC,GAAG,IAAI,GAAG,CAAC;IACxD,qBAAqB;IACrB,sBAAsB;CACvB,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAchG,MAAM,UAAU,gCAAgC,CAC9C,KAA+C;IAE/C,OAAO,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,6BAA6B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAa,EAAE,QAAkC;IAC/E,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;IAC9C,MAAM,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAChE,IAAI,CAAC,UAAU,IAAI,CAAC,iBAAiB;QAAE,OAAO,KAAK,CAAC;IAEpD,MAAM,OAAO,GAAG,QAAQ,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC;IACpD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAChE,OAAO,gBAAgB,CAAC,OAAO,CAAC,KAAK,UAAU,CAAC;AAClD,CAAC;AAED,SAAS,iBAAiB,CAAC,cAAsB;IAC/C,OAAO,sBAAsB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,6BAA6B,CACpC,QAAkC;IAElC,OAAO;QACL,kBAAkB,CAAC,IAAI,EAAE,cAAc;YACrC,IAAI,iBAAiB,CAAC,cAAc,CAAC;gBAAE,OAAO,CAAC,sBAAsB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACtF,OAAO,CACL,uCAAuC,CAAC,GAAG,CAAC,cAAc,CAAC;gBAC3D,yBAAyB,CAAC,IAAI,EAAE,cAAc,CAAC,CAChD,CAAC;QACJ,CAAC;QACD,kBAAkB,CAAC,IAAI,EAAE,cAAc;YACrC,IAAI,CAAC,yCAAyC,CAAC,GAAG,CAAC,cAAc,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChF,OAAO;gBACL,IAAI,EAAE,qCAAqC;gBAC3C,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,6DAA6D;gBAClF,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC;QACJ,CAAC;QACD,wBAAwB;QACxB,uBAAuB,CAAC,IAAI;YAC1B,OAAO,GAAG,IAAI,CAAC,IAAI,qGAAqG,CAAC;QAC3H,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAoC;IACpE,OAAO,IAAI,KAAK,qCAAqC;QACnD,CAAC,CAAC,0CAA0C;QAC5C,CAAC,CAAC,+CAA+C,CAAC;AACtD,CAAC"}

package/dist/adaptive-turn.d.ts

@@ -0,0 +1,23 @@
+import type { QtiAttemptStateV1, QtiDiagnostic, QtiValue } from "./types.js";
+import { type QtiTrustedItemParseOptions, type QtiTrustedResponseApplication, type QtiTrustedResponseInput } from "./trusted-item-session.js";
+export type QtiAdaptiveTurnResponseInput = QtiTrustedResponseInput;
+export interface QtiAdaptiveTurnInput extends QtiTrustedItemParseOptions, QtiTrustedResponseApplication {
+    itemXml: string;
+    /**
+     * Prior attempt state from a previous adaptive turn. Non-conforming values produce
+     * `adaptiveTurn.state.value` diagnostics instead of being silently accepted.
+     */
+    priorState?: unknown;
+}
+export interface QtiAdaptiveTurnResult {
+    ok: boolean;
+    diagnostics: QtiDiagnostic[];
+    state: QtiAttemptStateV1 | null;
+    responses: Record<string, QtiValue>;
+    outcomes: Record<string, QtiValue>;
+    score: number | null;
+    completionStatus: QtiValue;
+    candidateSafeXml?: string | undefined;
+}
+export declare function processQtiAdaptiveItemTurn(input: QtiAdaptiveTurnInput): QtiAdaptiveTurnResult;
+//# sourceMappingURL=adaptive-turn.d.ts.map

package/dist/adaptive-turn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adaptive-turn.d.ts","sourceRoot":"","sources":["../src/adaptive-turn.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,6BAA6B,EAClC,KAAK,uBAAuB,EAC7B,MAAM,2BAA2B,CAAC;AAEnC,MAAM,MAAM,4BAA4B,GAAG,uBAAuB,CAAC;AAEnE,MAAM,WAAW,oBACf,SAAQ,0BAA0B,EAAE,6BAA6B;IACjE,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACpC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,gBAAgB,EAAE,QAAQ,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,oBAAoB,GAAG,qBAAqB,CA0D7F"}

package/dist/adaptive-turn.js

@@ -0,0 +1,60 @@
+import { materializeAdaptiveCandidateView } from "./adaptive-turn-materializer.js";
+import { readPriorAttemptState, runTrustedItemSession, } from "./trusted-item-session.js";
+export function processQtiAdaptiveItemTurn(input) {
+    const priorStateResult = readPriorAttemptState(input.priorState, "adaptiveTurn");
+    if (priorStateResult.diagnostics.some((diagnostic) => diagnostic.severity === "error")) {
+        return failed(priorStateResult.diagnostics);
+    }
+    const sessionResult = runTrustedItemSession({
+        itemXml: input.itemXml,
+        diagnosticPrefix: "adaptiveTurn",
+        allowedUndeclaredResponseIdentifiers: input.allowedUndeclaredResponseIdentifiers,
+        priorState: priorStateResult.state,
+        submission: {
+            trustedResponses: input.trustedResponses,
+            trustedInteractionStates: input.trustedInteractionStates,
+        },
+        scoring: "onSubmission",
+        requireNumericScore: true,
+    });
+    if (!sessionResult.ok) {
+        return failed(sessionResult.diagnostics, sessionResult.state, sessionResult.outcomes, sessionResult.score);
+    }
+    const delivery = materializeAdaptiveCandidateView({
+        itemXml: input.itemXml,
+        outcomes: sessionResult.outcomes,
+    });
+    const deliveryDiagnostics = [...sessionResult.diagnostics, ...delivery.diagnostics];
+    if (!delivery.ok || !delivery.xml) {
+        return failed([
+            ...deliveryDiagnostics,
+            {
+                code: "adaptiveTurn.delivery.materialization",
+                severity: "error",
+                message: "Adaptive turn did not produce candidate-safe item XML.",
+            },
+        ], sessionResult.state, sessionResult.outcomes, sessionResult.score);
+    }
+    return {
+        ok: true,
+        diagnostics: deliveryDiagnostics,
+        state: sessionResult.state,
+        responses: sessionResult.responses,
+        outcomes: sessionResult.outcomes,
+        score: sessionResult.score,
+        completionStatus: sessionResult.outcomes.completionStatus ?? null,
+        candidateSafeXml: delivery.xml,
+    };
+}
+function failed(diagnostics, state = null, outcomes = {}, score = null) {
+    return {
+        ok: false,
+        diagnostics,
+        state,
+        responses: state?.responses ?? {},
+        outcomes,
+        score,
+        completionStatus: outcomes.completionStatus ?? null,
+    };
+}
+//# sourceMappingURL=adaptive-turn.js.map

package/dist/adaptive-turn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adaptive-turn.js","sourceRoot":"","sources":["../src/adaptive-turn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AAEnF,OAAO,EACL,qBAAqB,EACrB,qBAAqB,GAItB,MAAM,2BAA2B,CAAC;AAyBnC,MAAM,UAAU,0BAA0B,CAAC,KAA2B;IACpE,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IACjF,IAAI,gBAAgB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,OAAO,CAAC,EAAE,CAAC;QACvF,OAAO,MAAM,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,aAAa,GAAG,qBAAqB,CAAC;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gBAAgB,EAAE,cAAc;QAChC,oCAAoC,EAAE,KAAK,CAAC,oCAAoC;QAChF,UAAU,EAAE,gBAAgB,CAAC,KAAK;QAClC,UAAU,EAAE;YACV,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;SACzD;QACD,OAAO,EAAE,cAAc;QACvB,mBAAmB,EAAE,IAAI;KAC1B,CAAC,CAAC;IACH,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;QACtB,OAAO,MAAM,CACX,aAAa,CAAC,WAAW,EACzB,aAAa,CAAC,KAAK,EACnB,aAAa,CAAC,QAAQ,EACtB,aAAa,CAAC,KAAK,CACpB,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,gCAAgC,CAAC;QAChD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,aAAa,CAAC,QAAQ;KACjC,CAAC,CAAC;IACH,MAAM,mBAAmB,GAAG,CAAC,GAAG,aAAa,CAAC,WAAW,EAAE,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpF,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QAClC,OAAO,MAAM,CACX;YACE,GAAG,mBAAmB;YACtB;gBACE,IAAI,EAAE,uCAAuC;gBAC7C,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,wDAAwD;aAClE;SACF,EACD,aAAa,CAAC,KAAK,EACnB,aAAa,CAAC,QAAQ,EACtB,aAAa,CAAC,KAAK,CACpB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,WAAW,EAAE,mBAAmB;QAChC,KAAK,EAAE,aAAa,CAAC,KAAK;QAC1B,SAAS,EAAE,aAAa,CAAC,SAAS;QAClC,QAAQ,EAAE,aAAa,CAAC,QAAQ;QAChC,KAAK,EAAE,aAAa,CAAC,KAAK;QAC1B,gBAAgB,EAAE,aAAa,CAAC,QAAQ,CAAC,gBAAgB,IAAI,IAAI;QACjE,gBAAgB,EAAE,QAAQ,CAAC,GAAG;KAC/B,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CACb,WAA4B,EAC5B,QAAkC,IAAI,EACtC,WAAqC,EAAE,EACvC,QAAuB,IAAI;IAE3B,OAAO;QACL,EAAE,EAAE,KAAK;QACT,WAAW;QACX,KAAK;QACL,SAAS,EAAE,KAAK,EAAE,SAAS,IAAI,EAAE;QACjC,QAAQ;QACR,KAAK;QACL,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,IAAI,IAAI;KACpD,CAAC;AACJ,CAAC"}

package/dist/asset-url.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"asset-url.d.ts","sourceRoot":"","sources":["../src/asset-url.ts"],"names":[],"mappings":"AAAA,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAQ3D"}
+{"version":3,"file":"asset-url.d.ts","sourceRoot":"","sources":["../src/asset-url.ts"],"names":[],"mappings":"AAAA,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAS3D"}

package/dist/asset-url.js

@@ -1,5 +1,6 @@
 export function isResolvableAssetUrl(value) {
     return (!value.startsWith("#") &&
+        !value.startsWith("/") &&
         !value.startsWith("data:") &&
         !value.startsWith("blob:") &&
         !value.startsWith("http://") &&

package/dist/asset-url.js.map

@@ -1 +1 @@
-{"version":3,"file":"asset-url.js","sourceRoot":"","sources":["../src/asset-url.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,OAAO,CACL,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QACtB,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;QAC1B,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;QAC1B,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QAC5B,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAC9B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"asset-url.js","sourceRoot":"","sources":["../src/asset-url.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,OAAO,CACL,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QACtB,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QACtB,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;QAC1B,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;QAC1B,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QAC5B,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAC9B,CAAC;AACJ,CAAC"}

package/dist/delivery-redaction.d.ts

@@ -0,0 +1,50 @@
+import type { QtiDiagnostic, QtiSourceLocation } from "./types.js";
+import { type XmlNode } from "./xml.js";
+export declare const DEFAULT_VALUE_DECLARATION_ELEMENT_NAMES: Set<string>;
+export declare const FORBIDDEN_DELIVERY_SECRET_ELEMENT_NAMES: Set<string>;
+export type QtiDeliverySecurityFindingKind = "forbidden-delivery-element" | "unsupported-secure-delivery-element" | "unsupported-adaptive-response-processing";
+export interface QtiDeliverySecurityFinding {
+    kind: QtiDeliverySecurityFindingKind;
+    qtiName: string;
+    localName: string;
+    message: string;
+    source?: QtiSourceLocation | undefined;
+}
+export interface QtiDeliverySecurityAnalysis {
+    diagnostics: QtiDiagnostic[];
+    findings: QtiDeliverySecurityFinding[];
+    /** True when this exact XML contains no known answer/scoring/feedback delivery leaks. */
+    deliverySafe: boolean;
+    /** True when secure-delivery redaction can be attempted for this XML. */
+    secureDeliverySupported: boolean;
+}
+export interface ParsedDeliveryXml {
+    root: XmlNode | undefined;
+    diagnostics: QtiDiagnostic[];
+}
+export interface DeliveryRedactionPolicy {
+    isForbiddenElement(node: XmlNode, normalizedName: string): boolean;
+    unsupportedFinding?(node: XmlNode, normalizedName: string, nodes: readonly XmlNode[]): QtiDeliverySecurityFinding | null;
+    diagnosticCodeForFinding(kind: QtiDeliverySecurityFindingKind): string;
+    forbiddenElementMessage(node: XmlNode): string;
+}
+export interface RedactedDeliveryXmlResult {
+    ok: boolean;
+    diagnostics: QtiDiagnostic[];
+    analysis: QtiDeliverySecurityAnalysis;
+    xml?: string | undefined;
+}
+export declare function parseDeliveryXml(xml: string): ParsedDeliveryXml;
+export declare function analyzeDeliveryXml(parsed: ParsedDeliveryXml, policy: DeliveryRedactionPolicy): QtiDeliverySecurityAnalysis;
+export declare function redactDeliveryXml(xml: string, policy: DeliveryRedactionPolicy): RedactedDeliveryXmlResult;
+export declare function readRedactionRanges(nodes: readonly XmlNode[], shouldRedact: (node: XmlNode, normalizedName: string) => boolean): RedactionRange[];
+export declare function sourceRangeFor(node: XmlNode): RedactionRange[];
+export declare function removeSourceRanges(xml: string, ranges: readonly RedactionRange[]): string;
+export declare function normalizedQtiElementName(localName: string): string;
+export declare function parseXmlBoolean(value: string | undefined): boolean | undefined;
+export declare function isDeclarationDefaultValue(node: XmlNode, normalizedName: string): boolean;
+export interface RedactionRange {
+    startOffset: number;
+    endOffset: number;
+}
+//# sourceMappingURL=delivery-redaction.d.ts.map

package/dist/delivery-redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery-redaction.d.ts","sourceRoot":"","sources":["../src/delivery-redaction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,EAA6B,KAAK,OAAO,EAAE,MAAM,UAAU,CAAC;AAEnE,eAAO,MAAM,uCAAuC,aAIlD,CAAC;AAEH,eAAO,MAAM,uCAAuC,aAOlD,CAAC;AAEH,MAAM,MAAM,8BAA8B,GACtC,4BAA4B,GAC5B,qCAAqC,GACrC,0CAA0C,CAAC;AAE/C,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,8BAA8B,CAAC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,QAAQ,EAAE,0BAA0B,EAAE,CAAC;IACvC,yFAAyF;IACzF,YAAY,EAAE,OAAO,CAAC;IACtB,yEAAyE;IACzE,uBAAuB,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B,WAAW,EAAE,aAAa,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,uBAAuB;IACtC,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;IACnE,kBAAkB,CAAC,CACjB,IAAI,EAAE,OAAO,EACb,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,SAAS,OAAO,EAAE,GACxB,0BAA0B,GAAG,IAAI,CAAC;IACrC,wBAAwB,CAAC,IAAI,EAAE,8BAA8B,GAAG,MAAM,CAAC;IACvE,uBAAuB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;CAChD;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,OAAO,CAAC;IACZ,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,QAAQ,EAAE,2BAA2B,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,CA8B/D;AAED,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,iBAAiB,EACzB,MAAM,EAAE,uBAAuB,GAC9B,2BAA2B,CA2C7B;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,uBAAuB,GAC9B,yBAAyB,CAuC3B;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,SAAS,OAAO,EAAE,EACzB,YAAY,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,KAAK,OAAO,GAC/D,cAAc,EAAE,CAOlB;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,EAAE,CAI9D;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAQzF;AAED,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAGlE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAM9E;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAOxF;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/dist/delivery-redaction.js

@@ -0,0 +1,176 @@
+import { descendants, parseXmlTree } from "./xml.js";
+export const DEFAULT_VALUE_DECLARATION_ELEMENT_NAMES = new Set([
+    "response-declaration",
+    "outcome-declaration",
+    "template-declaration",
+]);
+export const FORBIDDEN_DELIVERY_SECRET_ELEMENT_NAMES = new Set([
+    "correct-response",
+    "mapping",
+    "area-mapping",
+    "match-table",
+    "interpolation-table",
+    "response-processing",
+]);
+export function parseDeliveryXml(xml) {
+    let parsed;
+    try {
+        parsed = parseXmlTree(xml);
+    }
+    catch (error) {
+        return {
+            root: undefined,
+            diagnostics: [
+                {
+                    code: "xml.parse",
+                    severity: "error",
+                    message: error instanceof Error ? error.message : String(error),
+                },
+            ],
+        };
+    }
+    const diagnostics = parsed.errors.map((error) => ({
+        code: "xml.parse",
+        severity: "error",
+        message: error.message,
+    }));
+    if (!parsed.root) {
+        diagnostics.push({
+            code: "xml.empty",
+            severity: "error",
+            message: "No XML root element was found.",
+        });
+    }
+    return { root: parsed.root, diagnostics };
+}
+export function analyzeDeliveryXml(parsed, policy) {
+    const diagnostics = [...parsed.diagnostics];
+    const findings = [];
+    if (parsed.root) {
+        const nodes = [parsed.root, ...descendants(parsed.root, () => true)];
+        for (const node of nodes) {
+            const normalizedName = normalizedQtiElementName(node.localName);
+            if (policy.isForbiddenElement(node, normalizedName)) {
+                findings.push({
+                    kind: "forbidden-delivery-element",
+                    qtiName: node.name,
+                    localName: node.localName,
+                    message: policy.forbiddenElementMessage(node),
+                    source: node.source,
+                });
+            }
+            const unsupportedFinding = policy.unsupportedFinding?.(node, normalizedName, nodes);
+            if (unsupportedFinding)
+                findings.push(unsupportedFinding);
+        }
+    }
+    diagnostics.push(...findings.map((finding) => findingToDiagnostic(finding, (kind) => policy.diagnosticCodeForFinding(kind))));
+    const parseOk = parsed.diagnostics.every((diagnostic) => diagnostic.severity !== "error");
+    return {
+        diagnostics,
+        findings,
+        deliverySafe: parseOk && !findings.some((finding) => finding.kind === "forbidden-delivery-element"),
+        secureDeliverySupported: parseOk &&
+            !findings.some((finding) => finding.kind === "unsupported-secure-delivery-element" ||
+                finding.kind === "unsupported-adaptive-response-processing"),
+    };
+}
+export function redactDeliveryXml(xml, policy) {
+    const parsed = parseDeliveryXml(xml);
+    const analysis = analyzeDeliveryXml(parsed, policy);
+    if (!analysis.secureDeliverySupported) {
+        return {
+            ok: false,
+            diagnostics: analysis.diagnostics,
+            analysis,
+        };
+    }
+    if (!parsed.root) {
+        return {
+            ok: false,
+            diagnostics: parsed.diagnostics,
+            analysis,
+        };
+    }
+    const redactionRanges = readRedactionRanges([parsed.root, ...descendants(parsed.root, () => true)], (node, normalizedName) => policy.isForbiddenElement(node, normalizedName));
+    const redactedXml = removeSourceRanges(xml, redactionRanges);
+    const redactedAnalysis = analyzeDeliveryXml(parseDeliveryXml(redactedXml), policy);
+    if (!redactedAnalysis.deliverySafe || !redactedAnalysis.secureDeliverySupported) {
+        return {
+            ok: false,
+            diagnostics: [...analysis.diagnostics, ...redactedAnalysis.diagnostics],
+            analysis: redactedAnalysis,
+        };
+    }
+    return {
+        ok: true,
+        xml: redactedXml,
+        diagnostics: redactedAnalysis.diagnostics,
+        analysis: redactedAnalysis,
+    };
+}
+export function readRedactionRanges(nodes, shouldRedact) {
+    const ranges = nodes.flatMap((node) => {
+        const normalizedName = normalizedQtiElementName(node.localName);
+        if (!shouldRedact(node, normalizedName))
+            return [];
+        return sourceRangeFor(node);
+    });
+    return mergeSourceRanges(ranges);
+}
+export function sourceRangeFor(node) {
+    const endOffset = node.sourceRange.endOffset;
+    if (node.sourceRange.startOffset < 0 || endOffset === undefined)
+        return [];
+    return [{ startOffset: node.sourceRange.startOffset, endOffset }];
+}
+export function removeSourceRanges(xml, ranges) {
+    let output = "";
+    let cursor = 0;
+    for (const range of ranges) {
+        output += xml.slice(cursor, range.startOffset);
+        cursor = range.endOffset;
+    }
+    return output + xml.slice(cursor);
+}
+export function normalizedQtiElementName(localName) {
+    const lower = localName.toLowerCase();
+    return lower.startsWith("qti-") ? lower.slice("qti-".length) : lower;
+}
+export function parseXmlBoolean(value) {
+    if (value === undefined)
+        return undefined;
+    const normalized = value.trim().toLowerCase();
+    if (normalized === "true" || normalized === "1")
+        return true;
+    if (normalized === "false" || normalized === "0")
+        return false;
+    return undefined;
+}
+export function isDeclarationDefaultValue(node, normalizedName) {
+    return (normalizedName === "default-value" &&
+        DEFAULT_VALUE_DECLARATION_ELEMENT_NAMES.has(normalizedQtiElementName(node.parent?.localName ?? "")));
+}
+function mergeSourceRanges(ranges) {
+    const sorted = [...ranges].sort((left, right) => left.startOffset - right.startOffset);
+    const merged = [];
+    for (const range of sorted) {
+        const last = merged.at(-1);
+        if (last && range.startOffset <= last.endOffset) {
+            last.endOffset = Math.max(last.endOffset, range.endOffset);
+            continue;
+        }
+        merged.push({ ...range });
+    }
+    return merged;
+}
+function findingToDiagnostic(finding, diagnosticCodeForFinding) {
+    return {
+        code: diagnosticCodeForFinding(finding.kind),
+        severity: "error",
+        message: finding.message,
+        path: finding.source?.path,
+        source: finding.source,
+    };
+}
+//# sourceMappingURL=delivery-redaction.js.map

package/dist/delivery-redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery-redaction.js","sourceRoot":"","sources":["../src/delivery-redaction.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAgB,MAAM,UAAU,CAAC;AAEnE,MAAM,CAAC,MAAM,uCAAuC,GAAG,IAAI,GAAG,CAAC;IAC7D,sBAAsB;IACtB,qBAAqB;IACrB,sBAAsB;CACvB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uCAAuC,GAAG,IAAI,GAAG,CAAC;IAC7D,kBAAkB;IAClB,SAAS;IACT,cAAc;IACd,aAAa;IACb,qBAAqB;IACrB,qBAAqB;CACtB,CAAC,CAAC;AA+CH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,MAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,SAAS;YACf,WAAW,EAAE;gBACX;oBACE,IAAI,EAAE,WAAW;oBACjB,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAChE;aACF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAoB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjE,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC,CAAC;IACJ,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjB,WAAW,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,gCAAgC;SAC1C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,MAAyB,EACzB,MAA+B;IAE/B,MAAM,WAAW,GAAG,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAiC,EAAE,CAAC;IAElD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QACrE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,cAAc,GAAG,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAChE,IAAI,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;gBACpD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,4BAA4B;oBAClC,OAAO,EAAE,IAAI,CAAC,IAAI;oBAClB,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,OAAO,EAAE,MAAM,CAAC,uBAAuB,CAAC,IAAI,CAAC;oBAC7C,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,EAAE,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;YACpF,IAAI,kBAAkB;gBAAE,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,WAAW,CAAC,IAAI,CACd,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAC1B,mBAAmB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAC9E,CACF,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAE1F,OAAO;QACL,WAAW;QACX,QAAQ;QACR,YAAY,EACV,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,4BAA4B,CAAC;QACvF,uBAAuB,EACrB,OAAO;YACP,CAAC,QAAQ,CAAC,IAAI,CACZ,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,IAAI,KAAK,qCAAqC;gBACtD,OAAO,CAAC,IAAI,KAAK,0CAA0C,CAC9D;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,GAAW,EACX,MAA+B;IAE/B,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ,CAAC,uBAAuB,EAAE,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,mBAAmB,CACzC,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,EACtD,CAAC,IAAI,EAAE,cAAc,EAAE,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,cAAc,CAAC,CAC1E,CAAC;IACF,MAAM,WAAW,GAAG,kBAAkB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAC7D,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;IACnF,IAAI,CAAC,gBAAgB,CAAC,YAAY,IAAI,CAAC,gBAAgB,CAAC,uBAAuB,EAAE,CAAC;QAChF,OAAO;YACL,EAAE,EAAE,KAAK;YACT,WAAW,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,GAAG,gBAAgB,CAAC,WAAW,CAAC;YACvE,QAAQ,EAAE,gBAAgB;SAC3B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,GAAG,EAAE,WAAW;QAChB,WAAW,EAAE,gBAAgB,CAAC,WAAW;QACzC,QAAQ,EAAE,gBAAgB;KAC3B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,KAAyB,EACzB,YAAgE;IAEhE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACpC,MAAM,cAAc,GAAG,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChE,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,cAAc,CAAC;YAAE,OAAO,EAAE,CAAC;QACnD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC;IAC7C,IAAI,IAAI,CAAC,WAAW,CAAC,WAAW,GAAG,CAAC,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC3E,OAAO,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,MAAiC;IAC/E,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAC/C,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IACtC,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAyB;IACvD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC/D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAAa,EAAE,cAAsB;IAC7E,OAAO,CACL,cAAc,KAAK,eAAe;QAClC,uCAAuC,CAAC,GAAG,CACzC,wBAAwB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC,CACvD,CACF,CAAC;AACJ,CAAC;AAOD,SAAS,iBAAiB,CAAC,MAAiC;IAC1D,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;IACvF,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,IAAI,IAAI,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAChD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAC3D,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAmC,EACnC,wBAA0E;IAE1E,OAAO;QACL,IAAI,EAAE,wBAAwB,CAAC,OAAO,CAAC,IAAI,CAAC;QAC5C,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;AACJ,CAAC"}

package/dist/delivery-security.d.ts

@@ -1,23 +1,8 @@
-import type { QtiDiagnostic, QtiSourceLocation } from "./types.js";
-export type QtiDeliverySecurityFindingKind = "forbidden-delivery-element" | "unsupported-secure-delivery-element" | "unsupported-adaptive-response-processing";
-export interface QtiDeliverySecurityFinding {
-    kind: QtiDeliverySecurityFindingKind;
-    qtiName: string;
-    localName: string;
-    message: string;
-    source?: QtiSourceLocation | undefined;
-}
-export interface QtiDeliverySecurityAnalysis {
-    diagnostics: QtiDiagnostic[];
-    findings: QtiDeliverySecurityFinding[];
-    /** True when this exact XML contains no known answer/scoring/feedback delivery leaks. */
-    deliverySafe: boolean;
-    /** True when secure-delivery redaction can be attempted for this XML. */
-    secureDeliverySupported: boolean;
-}
+import { type QtiDeliverySecurityAnalysis } from "./delivery-redaction.js";
+export type { QtiDeliverySecurityAnalysis, QtiDeliverySecurityFinding, QtiDeliverySecurityFindingKind, } from "./delivery-redaction.js";
 export interface QtiDeliverySafeXmlResult {
     ok: boolean;
-    diagnostics: QtiDiagnostic[];
+    diagnostics: QtiDeliverySecurityAnalysis["diagnostics"];
     analysis: QtiDeliverySecurityAnalysis;
     xml?: string | undefined;
 }

package/dist/delivery-security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delivery-security.d.ts","sourceRoot":"","sources":["../src/delivery-security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AA0BnE,MAAM,MAAM,8BAA8B,GACtC,4BAA4B,GAC5B,qCAAqC,GACrC,0CAA0C,CAAC;AAE/C,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,8BAA8B,CAAC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,QAAQ,EAAE,0BAA0B,EAAE,CAAC;IACvC,yFAAyF;IACzF,YAAY,EAAE,OAAO,CAAC;IACtB,yEAAyE;IACzE,uBAAuB,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,QAAQ,EAAE,2BAA2B,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B;AAED,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,2BAA2B,CAGnF;AAkED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,wBAAwB,CAuC7E"}
+{"version":3,"file":"delivery-security.d.ts","sourceRoot":"","sources":["../src/delivery-security.ts"],"names":[],"mappings":"AAAA,OAAO,EASL,KAAK,2BAA2B,EAEjC,MAAM,yBAAyB,CAAC;AAGjC,YAAY,EACV,2BAA2B,EAC3B,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,yBAAyB,CAAC;AAcjC,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ,WAAW,EAAE,2BAA2B,CAAC,aAAa,CAAC,CAAC;IACxD,QAAQ,EAAE,2BAA2B,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B;AAED,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,2BAA2B,CAEnF;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,wBAAwB,CAE7E"}