@modulus-learning/lti 0.0.0-stage → 0.11.1

package/dist/access-token.js

@@ -0,0 +1 @@
+export {};

package/dist/constants.d.ts

@@ -0,0 +1,24 @@
+export declare const SCOPE_AGS_LINEITEM = "https://purl.imsglobal.org/spec/lti-ags/scope/lineitem";
+export declare const SCOPE_AGS_LINEITEM_READONLY = "https://purl.imsglobal.org/spec/lti-ags/scope/lineitem.readonly";
+export declare const SCOPE_AGS_SCORE = "https://purl.imsglobal.org/spec/lti-ags/scope/score";
+export declare const SCOPE_AGS_RESULT_READONLY = "https://purl.imsglobal.org/spec/lti-ags/scope/result.readonly";
+export declare const SCOPE_NRPS_CONTEXT_MEMBERSHIP_READONLY = "https://purl.imsglobal.org/spec/lti-nrps/scope/contextmembership.readonly";
+export declare const SCOPE_REG_REGISTRATION_READONLY = "https://purl.imsglobal.org/spec/lti-reg/scope/registration.readonly";
+export declare const CLAIM_MESSAGE_TYPE = "https://purl.imsglobal.org/spec/lti/claim/message_type";
+export declare const CLAIM_VERSION = "https://purl.imsglobal.org/spec/lti/claim/version";
+export declare const CLAIM_DEPLOYMENT_ID = "https://purl.imsglobal.org/spec/lti/claim/deployment_id";
+export declare const CLAIM_TARGET_LINK_URI = "https://purl.imsglobal.org/spec/lti/claim/target_link_uri";
+export declare const CLAIM_RESOURCE_LINK = "https://purl.imsglobal.org/spec/lti/claim/resource_link";
+export declare const CLAIM_ROLES = "https://purl.imsglobal.org/spec/lti/claim/roles";
+export declare const CLAIM_CUSTOM = "https://purl.imsglobal.org/spec/lti/claim/custom";
+export declare const CLAIM_AGS_ENDPOINT = "https://purl.imsglobal.org/spec/lti-ags/claim/endpoint";
+export declare const CLAIM_DEEP_LINKING_SETTINGS = "https://purl.imsglobal.org/spec/lti-dl/claim/deep_linking_settings";
+export declare const CLAIM_DEEP_LINKING_DATA = "https://purl.imsglobal.org/spec/lti-dl/claim/data";
+export declare const CLAIM_DEEP_LINKING_CONTENT = "https://purl.imsglobal.org/spec/lti-dl/claim/content_items";
+export declare const CLAIM_DEEP_LINKING_MSG = "https://purl.imsglobal.org/spec/lti-dl/claim/msg";
+export declare const CLAIM_DEEP_LINKING_LOG = "https://purl.imsglobal.org/spec/lti-dl/claim/log";
+export declare const CLAIM_DEEP_LINKING_ERRORMSG = "https://purl.imsglobal.org/spec/lti-dl/claim/errormsg";
+export declare const CLAIM_DEEP_LINKING_ERRORLOG = "https://purl.imsglobal.org/spec/lti-dl/claim/errorlog";
+export declare const TOOL_CONFIGURATION = "https://purl.imsglobal.org/spec/lti-tool-configuration";
+export declare const PLATFORM_CONFIGURATION = "https://purl.imsglobal.org/spec/lti-platform-configuration";
+//# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,kBAAkB,2DAA2D,CAAA;AAC1F,eAAO,MAAM,2BAA2B,oEAC2B,CAAA;AACnE,eAAO,MAAM,eAAe,wDAAwD,CAAA;AACpF,eAAO,MAAM,yBAAyB,kEAC2B,CAAA;AACjE,eAAO,MAAM,sCAAsC,8EAC0B,CAAA;AAC7E,eAAO,MAAM,+BAA+B,wEAC2B,CAAA;AAGvE,eAAO,MAAM,kBAAkB,2DAA2D,CAAA;AAC1F,eAAO,MAAM,aAAa,sDAAsD,CAAA;AAChF,eAAO,MAAM,mBAAmB,4DAA4D,CAAA;AAC5F,eAAO,MAAM,qBAAqB,8DAA8D,CAAA;AAChG,eAAO,MAAM,mBAAmB,4DAA4D,CAAA;AAC5F,eAAO,MAAM,WAAW,oDAAoD,CAAA;AAC5E,eAAO,MAAM,YAAY,qDAAqD,CAAA;AAC9E,eAAO,MAAM,kBAAkB,2DAA2D,CAAA;AAC1F,eAAO,MAAM,2BAA2B,uEAC8B,CAAA;AACtE,eAAO,MAAM,uBAAuB,sDAAsD,CAAA;AAC1F,eAAO,MAAM,0BAA0B,+DACuB,CAAA;AAC9D,eAAO,MAAM,sBAAsB,qDAAqD,CAAA;AACxF,eAAO,MAAM,sBAAsB,qDAAqD,CAAA;AACxF,eAAO,MAAM,2BAA2B,0DAA0D,CAAA;AAClG,eAAO,MAAM,2BAA2B,0DAA0D,CAAA;AAGlG,eAAO,MAAM,kBAAkB,2DAA2D,CAAA;AAC1F,eAAO,MAAM,sBAAsB,+DAA+D,CAAA"}

package/dist/constants.js

@@ -0,0 +1,26 @@
+// Scopes
+export const SCOPE_AGS_LINEITEM = 'https://purl.imsglobal.org/spec/lti-ags/scope/lineitem';
+export const SCOPE_AGS_LINEITEM_READONLY = 'https://purl.imsglobal.org/spec/lti-ags/scope/lineitem.readonly';
+export const SCOPE_AGS_SCORE = 'https://purl.imsglobal.org/spec/lti-ags/scope/score';
+export const SCOPE_AGS_RESULT_READONLY = 'https://purl.imsglobal.org/spec/lti-ags/scope/result.readonly';
+export const SCOPE_NRPS_CONTEXT_MEMBERSHIP_READONLY = 'https://purl.imsglobal.org/spec/lti-nrps/scope/contextmembership.readonly';
+export const SCOPE_REG_REGISTRATION_READONLY = 'https://purl.imsglobal.org/spec/lti-reg/scope/registration.readonly';
+// Claims
+export const CLAIM_MESSAGE_TYPE = 'https://purl.imsglobal.org/spec/lti/claim/message_type';
+export const CLAIM_VERSION = 'https://purl.imsglobal.org/spec/lti/claim/version';
+export const CLAIM_DEPLOYMENT_ID = 'https://purl.imsglobal.org/spec/lti/claim/deployment_id';
+export const CLAIM_TARGET_LINK_URI = 'https://purl.imsglobal.org/spec/lti/claim/target_link_uri';
+export const CLAIM_RESOURCE_LINK = 'https://purl.imsglobal.org/spec/lti/claim/resource_link';
+export const CLAIM_ROLES = 'https://purl.imsglobal.org/spec/lti/claim/roles';
+export const CLAIM_CUSTOM = 'https://purl.imsglobal.org/spec/lti/claim/custom';
+export const CLAIM_AGS_ENDPOINT = 'https://purl.imsglobal.org/spec/lti-ags/claim/endpoint';
+export const CLAIM_DEEP_LINKING_SETTINGS = 'https://purl.imsglobal.org/spec/lti-dl/claim/deep_linking_settings';
+export const CLAIM_DEEP_LINKING_DATA = 'https://purl.imsglobal.org/spec/lti-dl/claim/data';
+export const CLAIM_DEEP_LINKING_CONTENT = 'https://purl.imsglobal.org/spec/lti-dl/claim/content_items';
+export const CLAIM_DEEP_LINKING_MSG = 'https://purl.imsglobal.org/spec/lti-dl/claim/msg';
+export const CLAIM_DEEP_LINKING_LOG = 'https://purl.imsglobal.org/spec/lti-dl/claim/log';
+export const CLAIM_DEEP_LINKING_ERRORMSG = 'https://purl.imsglobal.org/spec/lti-dl/claim/errormsg';
+export const CLAIM_DEEP_LINKING_ERRORLOG = 'https://purl.imsglobal.org/spec/lti-dl/claim/errorlog';
+// CONFIG
+export const TOOL_CONFIGURATION = 'https://purl.imsglobal.org/spec/lti-tool-configuration';
+export const PLATFORM_CONFIGURATION = 'https://purl.imsglobal.org/spec/lti-platform-configuration';

package/dist/contract.d.ts

@@ -0,0 +1,125 @@
+/**
+ * The LMS adapter contract: everything core needs from the one LMS an
+ * installation is connected to, as neutral values. Core calls the adapter;
+ * the adapter never calls into core.
+ *
+ * See specs/2026-10-25-canvas-lti-package-extraction-spec.md. Launch
+ * verification, the OIDC request and token exchange still live in core; they
+ * move behind the adapter in a later increment.
+ */
+import type { PlatformMessage } from './messages/platform-originating/platform-message.js';
+import type { AccessTokenSource, LtiAgsClient, LtiLogger, LtiRegistration } from './score.js';
+/** Incremented on any change to what an adapter must provide or what core assumes. */
+export declare const LMS_CONTRACT_VERSION = 1;
+export type LmsCapabilities = {
+    /** Course-designer content selection (LTI deep linking). */
+    deepLinking: boolean;
+    /** Launches carry an academic term, used to scope progress. */
+    termMetadata: boolean;
+    /** The adapter can generate the LMS-side registration configuration. */
+    registrationConfig: boolean;
+};
+/** How usable a vendor-supplied field was, for fallback diagnostics. */
+export type FieldQuality = 'missing' | 'empty' | 'unexpanded' | 'malformed' | 'usable';
+/** An academic term as the LMS reports it; core maps it to an opaque scope. */
+export type NormalizedTerm = {
+    external_id: string;
+    name?: string;
+    starts_at?: Date;
+    ends_at?: Date;
+};
+export type TermInspection = {
+    term?: NormalizedTerm;
+    quality: Record<'term_id' | 'name' | 'starts_at' | 'ends_at', FieldQuality>;
+};
+/** What a verified launch means, in neutral terms. Core applies the policy. */
+export type LaunchInterpretation = {
+    /** Whether the launch's roles make the user an instructor for Modulus. */
+    isInstructor: boolean;
+    /** The launch's academic term, with field-quality diagnostics. */
+    term: TermInspection;
+    /**
+     * The vendor's own assignment-cutoff value, consulted only when the standard
+     * `ResourceLink.available.endDateTime` custom field is not usable.
+     */
+    cutoffFallback?: unknown;
+};
+/** Endpoints an LMS registration needs, derived from its issuer. */
+export type RegistrationEndpoints = {
+    authorization_endpoint: string;
+    token_endpoint: string;
+    jwks_uri: string;
+    authorization_server: string;
+};
+export type RegistrationConfigInput = {
+    /** The installation's public base URL. */
+    baseUrl: string;
+    /** The installation's host name. */
+    host: string;
+    /** The tool's public signing key, as published at its JWKS endpoint. */
+    publicJwk: unknown;
+    title?: string;
+    description?: string;
+    tool_id?: string;
+    platform?: string;
+};
+/**
+ * Concurrency pacing for one registration's score passback. Core asks for the
+ * current target, never exceeds its own configured cap, and reports each
+ * response's scheduling signal and each hard rate limit.
+ */
+export interface SchedulingPolicy {
+    /** The concurrency the policy currently allows (core caps it). */
+    target(): number;
+    /** Observe a response's scheduling signal (opaque to core). */
+    record(signal: unknown): void;
+    /** Return to a cold start, e.g. after a rate limit or an incident. */
+    reset(): void;
+}
+/** Core's score-submission settings that a score client and its policy use. */
+export type ScoreClientSettings = {
+    /** Abort a platform request after this long. */
+    requestTimeoutSeconds: number;
+    /** Core's concurrency cap for one registration. */
+    maxConcurrentSubmissions: number;
+    /** Quota the policy keeps in reserve. */
+    quotaReserveRequests: number;
+    /** How long quota readings stay relevant. */
+    quotaWindowMs: number;
+    /** The minimum interval between concurrency increases. */
+    quotaRampIntervalMs: number;
+};
+export type ScoreClientDeps = {
+    registration: LtiRegistration;
+    accessTokens: AccessTokenSource;
+    logger: LtiLogger;
+    settings: ScoreClientSettings;
+};
+/** A registration-bound score client and its scheduling policy. */
+export type LmsScoreClient = {
+    client: LtiAgsClient;
+    scheduling: SchedulingPolicy;
+};
+export interface LmsAdapter {
+    /** Stable adapter identifier, e.g. `canvas`. */
+    readonly id: string;
+    /** The contract version the adapter implements; core refuses a mismatch. */
+    readonly contractVersion: number;
+    readonly capabilities: LmsCapabilities;
+    /** Interpret a verified launch's claims. */
+    interpretLaunch(launch: PlatformMessage): LaunchInterpretation;
+    /**
+     * Custom fields the adapter adds to every deep-link content item, typically
+     * the LMS's substitution variables. Core's own `modulus_*` fields always win.
+     */
+    deepLinkCustomFields(): Record<string, string>;
+    /** The endpoints a registration for `issuer` uses. */
+    registrationEndpoints(issuer: string): RegistrationEndpoints;
+    /** The LMS-side registration configuration, as JSON (capability `registrationConfig`). */
+    registrationConfig?(input: RegistrationConfigInput): string;
+    /** A score client bound to one registration. */
+    createScoreClient(deps: ScoreClientDeps): LmsScoreClient;
+}
+/** Fail fast when an adapter implements a different contract version. */
+export declare const assertLmsAdapter: (adapter: LmsAdapter) => LmsAdapter;
+//# sourceMappingURL=contract.d.ts.map

package/dist/contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../src/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qDAAqD,CAAA;AAC1F,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAE7F,sFAAsF;AACtF,eAAO,MAAM,oBAAoB,IAAI,CAAA;AAErC,MAAM,MAAM,eAAe,GAAG;IAC5B,4DAA4D;IAC5D,WAAW,EAAE,OAAO,CAAA;IACpB,+DAA+D;IAC/D,YAAY,EAAE,OAAO,CAAA;IACrB,wEAAwE;IACxE,kBAAkB,EAAE,OAAO,CAAA;CAC5B,CAAA;AAED,wEAAwE;AACxE,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,OAAO,GAAG,YAAY,GAAG,WAAW,GAAG,QAAQ,CAAA;AAEtF,+EAA+E;AAC/E,MAAM,MAAM,cAAc,GAAG;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,IAAI,CAAA;IAChB,OAAO,CAAC,EAAE,IAAI,CAAA;CACf,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,CAAC,EAAE,cAAc,CAAA;IACrB,OAAO,EAAE,MAAM,CAAC,SAAS,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,EAAE,YAAY,CAAC,CAAA;CAC5E,CAAA;AAED,+EAA+E;AAC/E,MAAM,MAAM,oBAAoB,GAAG;IACjC,0EAA0E;IAC1E,YAAY,EAAE,OAAO,CAAA;IACrB,kEAAkE;IAClE,IAAI,EAAE,cAAc,CAAA;IACpB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAA;CACzB,CAAA;AAED,oEAAoE;AACpE,MAAM,MAAM,qBAAqB,GAAG;IAClC,sBAAsB,EAAE,MAAM,CAAA;IAC9B,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,oBAAoB,EAAE,MAAM,CAAA;CAC7B,CAAA;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAA;IACf,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,wEAAwE;IACxE,SAAS,EAAE,OAAO,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kEAAkE;IAClE,MAAM,IAAI,MAAM,CAAA;IAChB,+DAA+D;IAC/D,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAA;IAC7B,sEAAsE;IACtE,KAAK,IAAI,IAAI,CAAA;CACd;AAED,+EAA+E;AAC/E,MAAM,MAAM,mBAAmB,GAAG;IAChC,gDAAgD;IAChD,qBAAqB,EAAE,MAAM,CAAA;IAC7B,mDAAmD;IACnD,wBAAwB,EAAE,MAAM,CAAA;IAChC,yCAAyC;IACzC,oBAAoB,EAAE,MAAM,CAAA;IAC5B,6CAA6C;IAC7C,aAAa,EAAE,MAAM,CAAA;IACrB,0DAA0D;IAC1D,mBAAmB,EAAE,MAAM,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,EAAE,eAAe,CAAA;IAC7B,YAAY,EAAE,iBAAiB,CAAA;IAC/B,MAAM,EAAE,SAAS,CAAA;IACjB,QAAQ,EAAE,mBAAmB,CAAA;CAC9B,CAAA;AAED,mEAAmE;AACnE,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,YAAY,CAAA;IACpB,UAAU,EAAE,gBAAgB,CAAA;CAC7B,CAAA;AAED,MAAM,WAAW,UAAU;IACzB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAA;IAEtC,4CAA4C;IAC5C,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,oBAAoB,CAAA;IAE9D;;;OAGG;IACH,oBAAoB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAE9C,sDAAsD;IACtD,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,qBAAqB,CAAA;IAE5D,0FAA0F;IAC1F,kBAAkB,CAAC,CAAC,KAAK,EAAE,uBAAuB,GAAG,MAAM,CAAA;IAE3D,gDAAgD;IAChD,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,cAAc,CAAA;CACzD;AAED,yEAAyE;AACzE,eAAO,MAAM,gBAAgB,YAAa,UAAU,KAAG,UAOtD,CAAA"}

package/dist/contract.js

@@ -0,0 +1,18 @@
+/**
+ * The LMS adapter contract: everything core needs from the one LMS an
+ * installation is connected to, as neutral values. Core calls the adapter;
+ * the adapter never calls into core.
+ *
+ * See specs/2026-10-25-canvas-lti-package-extraction-spec.md. Launch
+ * verification, the OIDC request and token exchange still live in core; they
+ * move behind the adapter in a later increment.
+ */
+/** Incremented on any change to what an adapter must provide or what core assumes. */
+export const LMS_CONTRACT_VERSION = 1;
+/** Fail fast when an adapter implements a different contract version. */
+export const assertLmsAdapter = (adapter) => {
+    if (adapter.contractVersion !== LMS_CONTRACT_VERSION) {
+        throw new Error(`LMS adapter "${adapter.id}" implements contract version ${adapter.contractVersion}; this build requires ${LMS_CONTRACT_VERSION}`);
+    }
+    return adapter;
+};

package/dist/cutoff.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The assignment cutoff a launch carries. The standard LTI substitution
+ * variable comes first — Modulus's deep-link content items map
+ * `$ResourceLink.available.endDateTime` to the custom field of the same name —
+ * and an adapter's own fallback is consulted only when it is not usable.
+ */
+export declare const STANDARD_CUTOFF_FIELD = "ResourceLink.available.endDateTime";
+/** The first value that is a `Date.parse`-able string, as a `Date`. */
+export declare const firstDate: (values: unknown[]) => Date | undefined;
+export declare const effectiveCutoff: (custom: Record<string, unknown>, adapterFallback: unknown) => Date | undefined;
+//# sourceMappingURL=cutoff.d.ts.map

package/dist/cutoff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cutoff.d.ts","sourceRoot":"","sources":["../src/cutoff.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,uCAAuC,CAAA;AAEzE,uEAAuE;AACvE,eAAO,MAAM,SAAS,WAAY,OAAO,EAAE,KAAG,IAAI,GAAG,SASpD,CAAA;AAED,eAAO,MAAM,eAAe,WAClB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,mBACd,OAAO,KACvB,IAAI,GAAG,SAAwE,CAAA"}

package/dist/cutoff.js

@@ -0,0 +1,19 @@
+/**
+ * The assignment cutoff a launch carries. The standard LTI substitution
+ * variable comes first — Modulus's deep-link content items map
+ * `$ResourceLink.available.endDateTime` to the custom field of the same name —
+ * and an adapter's own fallback is consulted only when it is not usable.
+ */
+export const STANDARD_CUTOFF_FIELD = 'ResourceLink.available.endDateTime';
+/** The first value that is a `Date.parse`-able string, as a `Date`. */
+export const firstDate = (values) => {
+    for (const value of values) {
+        if (typeof value === 'string') {
+            const timestamp = Date.parse(value);
+            if (!Number.isNaN(timestamp)) {
+                return new Date(timestamp);
+            }
+        }
+    }
+};
+export const effectiveCutoff = (custom, adapterFallback) => firstDate([custom[STANDARD_CUTOFF_FIELD], adapterFallback]);

package/dist/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * `@modulus-learning/lti` — shared LTI 1.3 vocabulary and the LMS adapter
+ * contract. No core, database, host framework, or vendor dependency.
+ */
+export * from './access-token.js';
+export * from './constants.js';
+export * from './contract.js';
+export * from './cutoff.js';
+export * from './login.js';
+export * from './messages/platform-originating/base-message.js';
+export * from './messages/platform-originating/deep-linking-request.js';
+export * from './messages/platform-originating/platform-message.js';
+export * from './messages/platform-originating/resource-link-launch-request.js';
+export * from './messages/tool-originating/deep-linking-response.js';
+export * from './score.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,mBAAmB,CAAA;AACjC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,iDAAiD,CAAA;AAC/D,cAAc,yDAAyD,CAAA;AACvE,cAAc,qDAAqD,CAAA;AACnE,cAAc,iEAAiE,CAAA;AAC/E,cAAc,sDAAsD,CAAA;AACpE,cAAc,YAAY,CAAA"}

package/dist/index.js

@@ -0,0 +1,15 @@
+/**
+ * `@modulus-learning/lti` — shared LTI 1.3 vocabulary and the LMS adapter
+ * contract. No core, database, host framework, or vendor dependency.
+ */
+export * from './access-token.js';
+export * from './constants.js';
+export * from './contract.js';
+export * from './cutoff.js';
+export * from './login.js';
+export * from './messages/platform-originating/base-message.js';
+export * from './messages/platform-originating/deep-linking-request.js';
+export * from './messages/platform-originating/platform-message.js';
+export * from './messages/platform-originating/resource-link-launch-request.js';
+export * from './messages/tool-originating/deep-linking-response.js';
+export * from './score.js';

package/dist/login.d.ts

@@ -0,0 +1,60 @@
+import { z } from 'zod';
+/**
+ * The data sent from platform to tool in an init login request.
+ *
+ * https://www.imsglobal.org/spec/security/v1p0/#step-1-third-party-initiated-login
+ * https://www.imsglobal.org/spec/lti/v1p3#additional-login-parameters
+ */
+export declare const initLoginRequestSchema: z.ZodObject<{
+    iss: z.ZodString;
+    login_hint: z.ZodString;
+    target_link_uri: z.ZodString;
+    lti_message_hint: z.ZodOptional<z.ZodString>;
+    lti_deployment_id: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type InitLoginRequest = z.infer<typeof initLoginRequestSchema>;
+/**
+ * The data used to construct the response to an init login request.  The actual
+ * response is an HTTP redirect to the given redirect_url, with a Set-Cookie
+ * header based on the given 'state' value.
+ */
+export interface AuthenticationRedirect {
+    redirectUrl: string;
+    stateId: string;
+    stateValue: string;
+}
+/**
+ * The parameters sent from tool to platform in response to an init login
+ * request. This data is bundled into the query string of the redirect_url of an
+ * AuthRedirect.
+ *
+ * https://www.imsglobal.org/spec/security/v1p0/#step-2-authentication-request
+ * https://www.imsglobal.org/spec/lti/v1p3#lti_message_hint-login-parameter
+ */
+export declare const authenticationRequestSchema: z.ZodObject<{
+    scope: z.ZodLiteral<"openid">;
+    response_type: z.ZodLiteral<"id_token">;
+    client_id: z.ZodString;
+    redirect_uri: z.ZodString;
+    login_hint: z.ZodString;
+    state: z.ZodString;
+    response_mode: z.ZodLiteral<"form_post">;
+    nonce: z.ZodString;
+    prompt: z.ZodLiteral<"none">;
+    lti_message_hint: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type AuthenticationRequest = z.infer<typeof authenticationRequestSchema>;
+/**
+ * The response the platform sends back to the tool in response to an
+ * AuthRedirect (on success)
+ *
+ * TODO: Canvas returns a few other values, including 'authenticity_token' and
+ * 'lti_storage_target'.  Do we have a use for them?
+ */
+export declare const authenticationResponseSchema: z.ZodObject<{
+    id_token: z.ZodString;
+    state: z.ZodString;
+}, z.core.$strip>;
+export type AuthenticationResponse = z.infer<typeof authenticationResponseSchema>;
+//# sourceMappingURL=login.d.ts.map

package/dist/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB;;;;;;;iBAOjC,CAAA;AAEF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAErE;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;GAOG;AAEH,eAAO,MAAM,2BAA2B;;;;;;;;;;;iBAWtC,CAAA;AAEF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAE/E;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAA;AAEF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAA"}

package/dist/login.js

@@ -0,0 +1,46 @@
+import { z } from 'zod';
+/**
+ * The data sent from platform to tool in an init login request.
+ *
+ * https://www.imsglobal.org/spec/security/v1p0/#step-1-third-party-initiated-login
+ * https://www.imsglobal.org/spec/lti/v1p3#additional-login-parameters
+ */
+export const initLoginRequestSchema = z.object({
+    iss: z.string(),
+    login_hint: z.string(),
+    target_link_uri: z.string(),
+    lti_message_hint: z.string().optional(),
+    lti_deployment_id: z.string().optional(),
+    client_id: z.string().optional(),
+});
+/**
+ * The parameters sent from tool to platform in response to an init login
+ * request. This data is bundled into the query string of the redirect_url of an
+ * AuthRedirect.
+ *
+ * https://www.imsglobal.org/spec/security/v1p0/#step-2-authentication-request
+ * https://www.imsglobal.org/spec/lti/v1p3#lti_message_hint-login-parameter
+ */
+export const authenticationRequestSchema = z.object({
+    scope: z.literal('openid'),
+    response_type: z.literal('id_token'),
+    client_id: z.string(),
+    redirect_uri: z.string(),
+    login_hint: z.string(),
+    state: z.string(),
+    response_mode: z.literal('form_post'),
+    nonce: z.string(),
+    prompt: z.literal('none'),
+    lti_message_hint: z.string().optional(),
+});
+/**
+ * The response the platform sends back to the tool in response to an
+ * AuthRedirect (on success)
+ *
+ * TODO: Canvas returns a few other values, including 'authenticity_token' and
+ * 'lti_storage_target'.  Do we have a use for them?
+ */
+export const authenticationResponseSchema = z.object({
+    id_token: z.string(),
+    state: z.string(),
+});

package/dist/messages/platform-originating/base-message.d.ts

@@ -0,0 +1,26 @@
+import { z } from 'zod';
+export declare const baseMessageSchema: z.ZodObject<{
+    iss: z.ZodString;
+    aud: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
+    sub: z.ZodString;
+    exp: z.ZodNumber;
+    iat: z.ZodNumber;
+    nonce: z.ZodString;
+    azp: z.ZodOptional<z.ZodString>;
+    given_name: z.ZodOptional<z.ZodString>;
+    family_name: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodString>;
+    locale: z.ZodOptional<z.ZodString>;
+    "https://purl.imsglobal.org/spec/lti/claim/version": z.ZodLiteral<"1.3.0">;
+    "https://purl.imsglobal.org/spec/lti/claim/deployment_id": z.ZodString;
+    "https://purl.imsglobal.org/spec/lti/claim/target_link_uri": z.ZodString;
+    "https://purl.imsglobal.org/spec/lti/claim/roles": z.ZodArray<z.ZodString>;
+    "https://purl.imsglobal.org/spec/lti-ags/claim/endpoint": z.ZodOptional<z.ZodObject<{
+        lineitems: z.ZodOptional<z.ZodString>;
+        lineitem: z.ZodOptional<z.ZodString>;
+        scope: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    "https://purl.imsglobal.org/spec/lti/claim/custom": z.ZodPrefault<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>>>;
+}, z.core.$strip>;
+//# sourceMappingURL=base-message.d.ts.map

package/dist/messages/platform-originating/base-message.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-message.d.ts","sourceRoot":"","sources":["../../../src/messages/platform-originating/base-message.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAWvB,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;iBA8C5B,CAAA"}

package/dist/messages/platform-originating/base-message.js

@@ -0,0 +1,44 @@
+import { z } from 'zod';
+import { CLAIM_AGS_ENDPOINT, CLAIM_CUSTOM, CLAIM_DEPLOYMENT_ID, CLAIM_ROLES, CLAIM_TARGET_LINK_URI, CLAIM_VERSION, } from '../../constants.js';
+export const baseMessageSchema = z.object({
+    // Core claims
+    // https://www.imsglobal.org/spec/security/v1p0/#id-token
+    // TODO: sub is apparently optional in case of anonymous resource link request messages?
+    // https://www.imsglobal.org/spec/lti/v1p3/#anonymous-launch-case
+    iss: z.string(),
+    aud: z.union([z.string(), z.array(z.string())]),
+    sub: z.string(),
+    exp: z.number(),
+    iat: z.number(),
+    nonce: z.string(),
+    azp: z.optional(z.string()),
+    // Potentially lots of additional openid-style claims about the user.  For
+    // some additional possibilities, see
+    // https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims
+    given_name: z.optional(z.string()),
+    family_name: z.optional(z.string()),
+    name: z.optional(z.string()),
+    email: z.optional(z.string()),
+    locale: z.optional(z.string()),
+    // LTI claims
+    [CLAIM_VERSION]: z.literal('1.3.0'),
+    [CLAIM_DEPLOYMENT_ID]: z.string(),
+    [CLAIM_TARGET_LINK_URI]: z.string(),
+    [CLAIM_ROLES]: z.array(z.string()),
+    [CLAIM_AGS_ENDPOINT]: z.optional(z.object({
+        lineitems: z.string().optional(),
+        lineitem: z.string().optional(),
+        scope: z.string().array(),
+    })),
+    [CLAIM_CUSTOM]: z.record(z.string(), z.union([z.string(), z.boolean()]).nullable()).prefault({}),
+    // TODO: Lots more go here, possibly including
+    // https://purl.imsglobal.org/spec/lti/claim/lis
+    // https://purl.imsglobal.org/spec/lti/claim/context
+    // https://purl.imsglobal.org/spec/lti/claim/tool_platform
+    // https://purl.imsglobal.org/spec/lti/claim/launch_presentation
+    // https://purl.imsglobal.org/spec/lti/claim/custom
+    // https://purl.imsglobal.org/spec/lti-bo/claim/basicoutcome
+    // https://purl.imsglobal.org/spec/lti/claim/ext
+    // https://purl.imsglobal.org/spec/lti-nrps/claim/namesroleservice
+    // And a few canvas-specific ones...
+});

package/dist/messages/platform-originating/deep-linking-request.d.ts

@@ -0,0 +1,40 @@
+import { z } from 'zod';
+export declare const deepLinkingRequestSchema: z.ZodObject<{
+    iss: z.ZodString;
+    aud: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
+    sub: z.ZodString;
+    exp: z.ZodNumber;
+    iat: z.ZodNumber;
+    nonce: z.ZodString;
+    azp: z.ZodOptional<z.ZodString>;
+    given_name: z.ZodOptional<z.ZodString>;
+    family_name: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodString>;
+    locale: z.ZodOptional<z.ZodString>;
+    "https://purl.imsglobal.org/spec/lti/claim/version": z.ZodLiteral<"1.3.0">;
+    "https://purl.imsglobal.org/spec/lti/claim/deployment_id": z.ZodString;
+    "https://purl.imsglobal.org/spec/lti/claim/target_link_uri": z.ZodString;
+    "https://purl.imsglobal.org/spec/lti/claim/roles": z.ZodArray<z.ZodString>;
+    "https://purl.imsglobal.org/spec/lti-ags/claim/endpoint": z.ZodOptional<z.ZodObject<{
+        lineitems: z.ZodOptional<z.ZodString>;
+        lineitem: z.ZodOptional<z.ZodString>;
+        scope: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    "https://purl.imsglobal.org/spec/lti/claim/custom": z.ZodPrefault<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>>>;
+    "https://purl.imsglobal.org/spec/lti/claim/message_type": z.ZodLiteral<"LtiDeepLinkingRequest">;
+    "https://purl.imsglobal.org/spec/lti-dl/claim/deep_linking_settings": z.ZodObject<{
+        deep_link_return_url: z.ZodString;
+        accept_types: z.ZodArray<z.ZodString>;
+        accept_presentation_document_targets: z.ZodArray<z.ZodString>;
+        accept_media_types: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+        accept_multiple: z.ZodPrefault<z.ZodBoolean>;
+        accept_lineitem: z.ZodOptional<z.ZodBoolean>;
+        auto_create: z.ZodPrefault<z.ZodBoolean>;
+        title: z.ZodOptional<z.ZodString>;
+        text: z.ZodOptional<z.ZodString>;
+        data: z.ZodOptional<z.ZodAny>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type DeepLinkingRequest = z.infer<typeof deepLinkingRequestSchema>;
+//# sourceMappingURL=deep-linking-request.d.ts.map

package/dist/messages/platform-originating/deep-linking-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deep-linking-request.d.ts","sourceRoot":"","sources":["../../../src/messages/platform-originating/deep-linking-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AASvB,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkBnC,CAAA;AAEF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAA"}

package/dist/messages/platform-originating/deep-linking-request.js

@@ -0,0 +1,26 @@
+import { z } from 'zod';
+import { CLAIM_DEEP_LINKING_SETTINGS, CLAIM_MESSAGE_TYPE } from '../../constants.js';
+import { baseMessageSchema } from './base-message.js';
+// Same claims as a resource link launch request, except the
+// CLAIM_MESSAGE_TYPE must be 'LtiDeepLinkingRequest', and
+// CLAIM_DEEP_LINKING_SETTINGS must be present.
+// https://www.imsglobal.org/spec/lti-dl/v2p0#deep-linking-request-message
+export const deepLinkingRequestSchema = baseMessageSchema.extend({
+    [CLAIM_MESSAGE_TYPE]: z.literal('LtiDeepLinkingRequest'),
+    [CLAIM_DEEP_LINKING_SETTINGS]: z.object({
+        deep_link_return_url: z.string(),
+        accept_types: z.array(z.string()),
+        accept_presentation_document_targets: z.array(z.string()),
+        accept_media_types: z.optional(z.union([z.string(), z.array(z.string())])),
+        accept_multiple: z.boolean().prefault(false),
+        // Don't add a default for accept_lineitem -- if not specified, we can't
+        // assume either true or false:
+        // https://www.imsglobal.org/spec/lti-dl/v2p0#deep-linking-settings
+        accept_lineitem: z.optional(z.boolean()),
+        auto_create: z.boolean().prefault(false),
+        title: z.optional(z.string()),
+        text: z.optional(z.string()),
+        data: z.optional(z.any()),
+        // TODO: Any canvas specific entries?
+    }),
+});

package/dist/messages/platform-originating/platform-message.d.ts

@@ -0,0 +1,69 @@
+import { z } from 'zod';
+export declare const platformMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    iss: z.ZodString;
+    aud: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
+    sub: z.ZodString;
+    exp: z.ZodNumber;
+    iat: z.ZodNumber;
+    nonce: z.ZodString;
+    azp: z.ZodOptional<z.ZodString>;
+    given_name: z.ZodOptional<z.ZodString>;
+    family_name: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodString>;
+    locale: z.ZodOptional<z.ZodString>;
+    "https://purl.imsglobal.org/spec/lti/claim/version": z.ZodLiteral<"1.3.0">;
+    "https://purl.imsglobal.org/spec/lti/claim/deployment_id": z.ZodString;
+    "https://purl.imsglobal.org/spec/lti/claim/target_link_uri": z.ZodString;
+    "https://purl.imsglobal.org/spec/lti/claim/roles": z.ZodArray<z.ZodString>;
+    "https://purl.imsglobal.org/spec/lti-ags/claim/endpoint": z.ZodOptional<z.ZodObject<{
+        lineitems: z.ZodOptional<z.ZodString>;
+        lineitem: z.ZodOptional<z.ZodString>;
+        scope: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    "https://purl.imsglobal.org/spec/lti/claim/custom": z.ZodPrefault<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>>>;
+    "https://purl.imsglobal.org/spec/lti/claim/message_type": z.ZodLiteral<"LtiResourceLinkRequest">;
+    "https://purl.imsglobal.org/spec/lti/claim/resource_link": z.ZodObject<{
+        id: z.ZodString;
+        title: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    iss: z.ZodString;
+    aud: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
+    sub: z.ZodString;
+    exp: z.ZodNumber;
+    iat: z.ZodNumber;
+    nonce: z.ZodString;
+    azp: z.ZodOptional<z.ZodString>;
+    given_name: z.ZodOptional<z.ZodString>;
+    family_name: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodString>;
+    locale: z.ZodOptional<z.ZodString>;
+    "https://purl.imsglobal.org/spec/lti/claim/version": z.ZodLiteral<"1.3.0">;
+    "https://purl.imsglobal.org/spec/lti/claim/deployment_id": z.ZodString;
+    "https://purl.imsglobal.org/spec/lti/claim/target_link_uri": z.ZodString;
+    "https://purl.imsglobal.org/spec/lti/claim/roles": z.ZodArray<z.ZodString>;
+    "https://purl.imsglobal.org/spec/lti-ags/claim/endpoint": z.ZodOptional<z.ZodObject<{
+        lineitems: z.ZodOptional<z.ZodString>;
+        lineitem: z.ZodOptional<z.ZodString>;
+        scope: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    "https://purl.imsglobal.org/spec/lti/claim/custom": z.ZodPrefault<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>>>;
+    "https://purl.imsglobal.org/spec/lti/claim/message_type": z.ZodLiteral<"LtiDeepLinkingRequest">;
+    "https://purl.imsglobal.org/spec/lti-dl/claim/deep_linking_settings": z.ZodObject<{
+        deep_link_return_url: z.ZodString;
+        accept_types: z.ZodArray<z.ZodString>;
+        accept_presentation_document_targets: z.ZodArray<z.ZodString>;
+        accept_media_types: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+        accept_multiple: z.ZodPrefault<z.ZodBoolean>;
+        accept_lineitem: z.ZodOptional<z.ZodBoolean>;
+        auto_create: z.ZodPrefault<z.ZodBoolean>;
+        title: z.ZodOptional<z.ZodString>;
+        text: z.ZodOptional<z.ZodString>;
+        data: z.ZodOptional<z.ZodAny>;
+    }, z.core.$strip>;
+}, z.core.$strip>], "https://purl.imsglobal.org/spec/lti/claim/message_type">;
+export type PlatformMessage = z.infer<typeof platformMessageSchema>;
+//# sourceMappingURL=platform-message.d.ts.map

package/dist/messages/platform-originating/platform-message.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-message.d.ts","sourceRoot":"","sources":["../../../src/messages/platform-originating/platform-message.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAMvB,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6EAGhC,CAAA;AAEF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA"}

package/dist/messages/platform-originating/platform-message.js

@@ -0,0 +1,8 @@
+import { z } from 'zod';
+import { CLAIM_MESSAGE_TYPE } from '../../constants.js';
+import { deepLinkingRequestSchema } from './deep-linking-request.js';
+import { resourceLinkLaunchRequestSchema } from './resource-link-launch-request.js';
+export const platformMessageSchema = z.discriminatedUnion(CLAIM_MESSAGE_TYPE, [
+    resourceLinkLaunchRequestSchema,
+    deepLinkingRequestSchema,
+]);