coursecode 0.1.52 → 0.1.54

package/README.md

@@ -1,26 +1,29 @@
 # CourseCode
 
-**Open-source, local-first course authoring built for AI tools like Claude Code, Codex, Cursor, and [CourseCode Desktop](https://coursecodedesktop.com) — no coding required to start, full code control when you need it.**
+**Open-source, local-first course authoring with no vendor lock-in. Built for AI tools like Claude Code, Codex, Cursor, and [CourseCode Desktop](https://coursecodedesktop.com). No coding required to start, full code control when you need it.**
 
-CourseCode creates real project files you can inspect, version, and edit directly — with a predictable, file-based workflow instead of a black-box GUI. Built-in MCP integration means your AI assistant connects directly to your course project.
+CourseCode creates real project files you can inspect, version, and edit directly instead of relying on restrictive graphical editing tools. Built-in MCP integration means your AI assistant connects directly to your course project and understands the framework immediately.
 
-Bring your own PDFs, Word docs, or PowerPoints, use AI to accelerate authoring, and deploy to any LMS format without vendor lock-in or subscriptions.
+Bring your own PDFs, Word docs, or other reference documents, use AI to accelerate authoring, and deploy to any LMS without vendor lock-in or subscriptions.
 
 ## View the demo
 
 - [View the live CourseCode demo course](https://preview.coursecodecloud.com/preview/coursecode-demo/nTfJU2qvp23P0mguxrrGFZr4FlXfM03N)
 
-## Explore the ecosystem
+## CourseCode ecosystem
 
 - [Build SCORM courses with the framework](https://coursecodeframework.com/scorm/)
 - [Use CourseCode Desktop if you prefer a GUI](https://coursecodedesktop.com/scorm/)
 - [Use CourseCode Cloud for hosted delivery](https://coursecodecloud.com)
 
+> CourseCode Framework is a standalone tool. Desktop and Cloud are optional. 
+
 ## Features
 
 - **MCP integration**: Works with Claude Code, Codex, Cursor, CourseCode Desktop, and any MCP-capable AI tool — previews, screenshots, linting, and testing without manual file sharing
 - **No coding required to start**: Describe what you want and let AI help build slides, interactions, and structure
-- **Full LMS integration**: SCORM 1.2, SCORM 2004, cmi5, and LTI with complete tracking records
+- **Course modernization**: Use existing SCORM courses, PowerPoints, PDFs, Word docs, scripts, and SME notes as source material for upgraded courses
+- **LMS integration**: SCORM 1.2, SCORM 2004, and cmi5 packaging, plus an LTI 1.3 browser contract for trusted server-backed launches
 - **AI-assisted authoring workflow**: Structured guides and MCP tools for faster course development
 - **Rich UI components**: Images, video, accordions, tabs, and custom sandboxed HTML/JS embeds
 - **Rich interactions**: Multiple choice, drag-drop, fill-in-the-blank, matching, sequencing, and more
@@ -41,12 +44,14 @@ Bring your own PDFs, Word docs, or PowerPoints, use AI to accelerate authoring,
 
 ### Required
 
-Install [Node.js](https://nodejs.org/) (v18 or later), then run:
+Install [Node.js](https://nodejs.org/) (v20.19 or later), then run:
 
 ```bash
 npm install -g coursecode
 ```
 
+Learner courses support Chrome 111+, Edge 111+, Firefox 114+, and Safari 16.4+. SCORM compatibility describes LMS communication and packaging; it does not imply Internet Explorer support.
+
 ### Recommended
 
 - A code or text editor — [VS Code](https://code.visualstudio.com/), [Cursor](https://cursor.com/), or similar

package/bin/cli.js

@@ -210,6 +210,7 @@ program
   .option('-p, --password <password>', 'Require password to access preview (export only)')
   .option('--title <title>', 'Custom title (default: course title)')
   .option('--port <port>', 'Preview server port (default: 4173)', '4173')
+  .option('--host <host>', 'Preview bind address (default: 127.0.0.1)', '127.0.0.1')
   .option('--skip-build', 'Skip build step for export (use existing dist folder)')
   .option('--nojekyll', 'Add .nojekyll file (required for GitHub Pages)')
   .option('--no-content', 'Exclude course content viewer from preview toolbar')

package/framework/css/components/loading.css

@@ -24,9 +24,17 @@
    
    ============================================================================ */
 
-/* Loading indicator - overlay that covers the content area */
+/* Hide shell chrome until course-config-derived layout attributes are applied. */
+html[data-course-loading="true"] .course-header,
+html[data-course-loading="true"] .sidebar,
+html[data-course-loading="true"] .sidebar-backdrop,
+html[data-course-loading="true"] .app-footer {
+  display: none;
+}
+
+/* Loading indicator - overlay that covers the full shell during startup */
 #loading {
-  position: absolute;
+  position: fixed;
   top: 0;
   left: 0;
   right: 0;
@@ -42,7 +50,7 @@
     radial-gradient(circle at 20% 50%, var(--color-secondary-alpha-05) 0%, transparent 50%),
     radial-gradient(circle at 80% 80%, var(--color-primary-alpha-10) 0%, transparent 50%);
   color: var(--text-muted);
-  z-index: 100;
+  z-index: var(--z-overlay);
 }
 
 /* Loading text styling */

package/framework/docs/COURSE_AUTHORING_GUIDE.md

@@ -35,6 +35,8 @@
 | `coursecode test-data` | Test data reporting webhook configuration |
 | `coursecode mcp` | Start MCP server for AI agent integration |
 
+When upgrading a project created before the Vite 8/browser-policy migration, run `coursecode upgrade --configs` and then `npm install`. The command backs up customized Vite/ESLint files, installs the managed Vite 8 dependency ranges, and removes the retired IE11 legacy plugin. Review the `.backup` files before deleting them.
+
 **Format options** (for local `dev`, `build`, `preview` — not needed for cloud-deployed courses):
 ```bash
 coursecode build --format scorm1.2   # Build for SCORM 1.2 LMS
@@ -105,10 +107,13 @@ coursecode preview                    # Open http://localhost:4173
 | Option | Description |
 |--------|-------------|
 | `--port <port>` | Preview server port (default: 4173) |
+| `--host <host>` | Bind address (default: `127.0.0.1`; use another address only for deliberate LAN access) |
 | `--title <title>` | Custom browser title |
 | `--no-content` | Disable course content viewer |
 | `-f, --format <format>` | LMS format: `scorm2004`, `scorm1.2`, `cmi5`, or `lti` |
 
+Live preview includes source-editing endpoints, so it binds to loopback by default and protects mutations with a per-process token. Treat `--host 0.0.0.0` as deliberate developer-machine access, not as a deployment mode.
+
 ### Static Export
 
 Generate a self-contained folder for stakeholder sharing (Netlify, GitHub Pages, etc.):
@@ -283,17 +288,14 @@ Deploy courses to a CDN for instant updates without re-uploading to the LMS.
 format: 'scorm1.2-proxy',
 externalUrl: 'https://cdn.example.com/my-course',
 accessControl: {
-    clients: {
-        'acme-corp': { token: 'abc123' },
-        'globex': { token: 'def456' }
-    }
+    enforcement: 'server'
 }
 ```
 
 **Generate tokens:**
 ```bash
 coursecode token                  # Generate random token
-coursecode token --add acme-corp  # Add client with token to config
+coursecode token --add acme-corp  # Store token in .coursecode/access-control.json
 ```
 
 **Build:**
@@ -302,7 +304,7 @@ coursecode build  # Creates dist/ + *_<client>_proxy.zip per client
 ```
 
 **Deploy:**
-1. Upload `dist/` to CDN (GitHub Pages, Vercel, Netlify, etc.)
+1. Upload `dist/` behind a CDN/backend that validates the generated client credentials before serving any file
 2. Upload client-specific proxy ZIP to each client's LMS
 3. Future updates: just redeploy to CDN—no LMS re-upload needed
 

package/framework/docs/FRAMEWORK_GUIDE.md

@@ -37,18 +37,20 @@ npm run preview
 # - Content viewer for course review
 ```
 
-### Dependency Upgrade Policy
+### Build and Browser Compatibility Policy
 
-The framework intentionally stays on **Vite 7** for now:
+CourseCode uses Vite 8 and emits one standards-based ESM build. The supported learner-browser floor is intentionally fixed in both Vite configurations:
 
-- `vite@7.2.x`, `@vitejs/plugin-legacy@7.x`, and `vite-plugin-static-copy@3.x` are the compatible set used by the framework and course template.
-- SCORM itself does **not** require ES5 JavaScript. SCORM defines LMS runtime/API communication and package metadata, not the learner browser's ECMAScript level.
-- The legacy bundle path is still kept as compatibility insurance for unknown or older LMS launch environments, especially SCORM 1.2/2004 deployments that may use old embedded browsers or enterprise browser policies.
-- Vite 8 currently breaks that legacy path because Rolldown does not support the `system` output format used by `@vitejs/plugin-legacy` for SystemJS/ES5 fallback chunks.
-- Vite 7.3 has also shown a generated-course packaging regression with the legacy/post-build flow, where package validation can run before `dist/index.html` has been moved into place. Keep the template and framework dev dependency on `7.2.x` until that flow is reworked or verified against a newer Vite 7 patch.
-- Do not upgrade Vite, `@vitejs/plugin-legacy`, or `vite-plugin-static-copy` to their Vite 8 lines until CourseCode explicitly drops legacy browser fallback support or adds a separate verified legacy build pipeline.
+- Chrome 111+
+- Edge 111+
+- Firefox 114+
+- Safari 16.4+
 
-Other dependencies can be upgraded normally when their Node engine requirements and tests fit the framework. Keep `marked` on `17.x` while the public package requirement remains Node 18+, because `marked@18` requires Node 20+.
+SCORM 1.2 and SCORM 2004 define the LMS runtime/API contract; they do not require ES3, ES5, Internet Explorer, or a SystemJS bundle. CourseCode no longer generates an IE11 fallback with `@vitejs/plugin-legacy`. The framework's CSS design system depends heavily on custom properties, Grid, `color-mix()`, and other modern platform features that JavaScript transpilation cannot make reliable in IE11.
+
+Treat an older embedded LMS browser as a separate, explicitly tested customer requirement. Do not re-enable Babel/SystemJS as a general compatibility precaution: a legacy JavaScript bundle alone is not evidence that the complete course UI works in that engine.
+
+The framework and generated projects require **Node 20.19+**. Vite, `vite-plugin-static-copy`, and their lockfiles must be upgraded together and verified with a freshly generated project plus every LMS-format build.
 
 ### LMS Compatibility Warnings
 The preview server (stub player) includes an advanced diagnostic system that monitors API usage and data limits to detect potential issues before deployment to a real LMS.
@@ -124,7 +126,6 @@ dist/assets/
   cmi5-driver.js       ← Lazy chunk, only fetched if format = 'cmi5'
   lti-driver.js        ← Lazy chunk, only fetched if format = 'lti'
   proxy-driver.js      ← Lazy chunk, only fetched if format = '*-proxy'
-  jose.js              ← Lazy chunk, only fetched by lti-driver.js
 ```
 
 CourseCode delivery serves static assets by file extension, not stored upload metadata. Supported course asset types include HTML, JS, CSS, JSON/XML, common images/fonts/audio/video, PDF, `csv`, `vtt`, `wasm`, `gltf/glb`, and source maps; unknown extensions are served as `application/octet-stream`.
@@ -204,19 +205,14 @@ For hot-fixable courses, the framework supports **external hosting**: course con
 export const courseConfig = {
     format: 'scorm1.2-proxy',
     externalUrl: 'https://cdn.example.com/my-course',  // Required
-    accessControl: {  // Required for proxy/remote formats
-        clients: {
-            'acme-corp': { token: 'abc123' },
-            'globex': { token: 'def456' }
-        }
-    }
+    accessControl: { enforcement: 'server' }
 };
 ```
 
 **Generate tokens:**
 ```bash
 coursecode token                  # Generate random token
-coursecode token --add acme-corp  # Add client to config
+coursecode token --add acme-corp  # Store client in .coursecode/access-control.json
 ```
 
 **Build outputs:**
@@ -224,9 +220,10 @@ coursecode token --add acme-corp  # Add client to config
 - `*_acme-corp_proxy.zip`, `*_globex_proxy.zip` — One package per client
 
 **Access Control:**
-- Tokens are injected into URLs: `https://cdn.example.com/my-course?clientId=acme-corp&token=abc123`
-- Runtime validation in `access-control.js` blocks unauthorized access
-- To disable a client: remove from config → redeploy CDN
+- Tokens are stored in the gitignored `.coursecode/access-control.json`, never in learner-facing course source.
+- Tokens are injected into client package URLs: `https://cdn.example.com/my-course?clientId=acme-corp&token=...`.
+- The CDN/backend **must validate credentials before serving `index.html` or assets**. Browser-side checks are not access control.
+- To disable a client, remove it from the access file and revoke it at the delivery layer.
 
 **Architecture:**
 - **Proxy formats**: LMS loads a lightweight proxy (proxy.html + bridge) that iframes the CDN-hosted course. The bridge relays `postMessage` calls to the LMS SCORM API via pipwerks.
@@ -236,11 +233,15 @@ coursecode token --add acme-corp  # Add client to config
 | File | Purpose |
 |------|---------|
 | `framework/js/drivers/proxy-driver.js` | Course-side postMessage LMSDriver |
-| `framework/js/utilities/access-control.js` | Token validation + unauthorized screen |
+| `.coursecode/access-control.json` | Gitignored build-time client credentials |
 | `lib/proxy-templates/proxy.html` | Proxy package entry point |
 | `lib/proxy-templates/scorm-bridge.js` | postMessage ↔ pipwerks bridge |
 | `lib/token.js` | CLI token generator |
 
+### LTI Trust Boundary
+
+LTI 1.3 requires a trusted server backend. The backend performs OIDC state/nonce, issuer, audience, signature, and deployment validation; holds the tool private key; exchanges OAuth client credentials; persists learner state; and proxies AGS score writes. The browser driver only consumes server-validated launch claims and calls same-origin state/AGS proxy endpoints. Direct browser `id_token` processing is intentionally rejected.
+
 **Preview mode**: Proxy/remote suffixes are stripped (e.g., `scorm1.2-proxy` → `scorm1.2`) so the stub LMS works normally.
 
 ---

package/framework/docs/USER_GUIDE.md

@@ -66,7 +66,7 @@ A complete guide to creating interactive e-learning courses with AI assistance.
 ### What You'll Need
 
 **Required:**
-- [Node.js](https://nodejs.org/) (version 18 or later)
+- [Node.js](https://nodejs.org/) (version 20.19 or later)
 
 **Recommended:**
 - A text editor like [VS Code](https://code.visualstudio.com/) or [Notepad++](https://notepad-plus-plus.org/)
@@ -648,10 +648,14 @@ An LMS (Learning Management System) is the platform your organization uses to de
 | **SCORM 1.2** | Oldest standard, most compatible. | Older systems, or when you're unsure |
 | **LTI** | Integration standard, not a package format. | LMS platforms that use LTI (Canvas, Blackboard) |
 
+> **LTI requires a backend:** A production LTI 1.3 launch is not a static ZIP. A trusted server must complete OIDC/JWT validation, hold the private key, persist learner state, and proxy AGS score writes. The CourseCode browser driver intentionally rejects raw `id_token` launches.
+
 **Not sure which to pick?** Ask your LMS administrator. If they don't know, try **SCORM 1.2** — it works with almost everything.
 
 > **SCORM 1.2 caveat:** SCORM 1.2 has a strict ~4KB suspend data limit. CourseCode uses a strict storage mode to fit within that limit, which can reduce how much interaction UI state is restored across slides on resume.
 
+> **Browser support:** CourseCode learner packages support Chrome 111+, Edge 111+, Firefox 114+, and Safari 16.4+. SCORM format selection does not change that browser floor. Internet Explorer and other non-ESM webviews are not supported.
+
 > **Using CourseCode Cloud?** You don't need to choose a format. Cloud-deployed courses use a universal build — the cloud generates the correct format automatically when you download a ZIP for your LMS. The format setting in `course-config.js` only applies to local `coursecode build` commands.
 
 ### Standard Deployment
@@ -669,7 +673,7 @@ This creates a ZIP file in `dist/` that you upload directly to your LMS. Every t
 
 For teams that update courses frequently or serve multiple LMS clients, CourseCode supports **CDN deployment**. Instead of uploading the full course to each LMS, you:
 
-1. Host the course on a CDN (like Netlify, Vercel, or GitHub Pages)
+1. Host the course behind a CDN/backend that can authorize every course file
 2. Upload a tiny proxy package (~15KB) to each LMS
 3. The proxy loads the course from the CDN at runtime
 
@@ -678,7 +682,7 @@ For teams that update courses frequently or serve multiple LMS clients, CourseCo
 - **Multi-tenant** — one CDN deployment serves multiple LMS clients, each with their own access token
 - **Smaller LMS packages** — faster upload and launch times
 
-CDN deployment uses special format variants (`scorm1.2-proxy`, `scorm2004-proxy`, `cmi5-remote`). Ask your AI assistant to set this up — it involves configuring an external URL and access tokens in `course-config.js`.
+CDN deployment uses special format variants (`scorm1.2-proxy`, `scorm2004-proxy`, `cmi5-remote`). Configure `accessControl: { enforcement: 'server' }` in `course-config.js`; client credentials are stored separately in the gitignored `.coursecode/access-control.json`.
 
 Generate and add client tokens with:
 
@@ -687,6 +691,8 @@ coursecode token --add client-a
 coursecode token --add client-b
 ```
 
+These commands create build-time credentials only. Your CDN/backend must validate them before serving `index.html`, JavaScript, or assets. Static hosts without request authorization cannot protect course content.
+
 Then build your proxy/remote package and deploy:
 
 ```bash

package/framework/index.html

@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html lang="en">
+<html lang="en" data-course-loading="true">
 
 <head>
   <meta charset="UTF-8" />
@@ -7,7 +7,7 @@
   <meta name="viewport" content="width=device-width, initial-scale=1" />
   <meta name="description" id="page-description" content="" />
   <link rel="stylesheet" href="css/framework.css" />
-  <link rel="stylesheet" href="../template/course/theme.css" />
+  <link rel="stylesheet" href="../course/theme.css" />
   <!-- Skip link is styled via framework.css for accessibility -->
 </head>
 

package/framework/js/app/AppUI.js

@@ -174,6 +174,7 @@ export function initAppUI() {
  * Hides the loading indicator after the course has finished initializing.
  */
 export function hideLoadingIndicator() {
+    document.documentElement.removeAttribute('data-course-loading');
     if (loadingIndicator) {
         loadingIndicator.style.display = 'none';
         AppState.setLoadingVisible(false);
@@ -613,4 +614,4 @@ function _lockApplicationForExit() {
     closeSidebar();
     hideModal(); // Hide any active modal
     showModal('postExit'); // Show the final "safe to close" modal
-}
+}

package/framework/js/core/event-bus.js

@@ -110,11 +110,12 @@ class EventBus {
    * @returns {boolean} True if event had listeners
    */
   emit(event, data) {
-    if (!this.events[event] || this.events[event].length === 0) {
-      return false;
-    }
+    // log:error is the logger transport itself; treating it as another source
+    // error would recursively call logger.error().
+    const isErrorEvent = event.endsWith(':error') && event !== 'log:error';
+    const hasListeners = Boolean(this.events[event]?.length);
 
-    const isErrorEvent = event.endsWith(':error');
+    if (!isErrorEvent && !hasListeners) return false;
 
     // Re-entrancy guard — if we're already inside an :error emit,
     // suppress to prevent infinite cascade
@@ -132,6 +133,8 @@ class EventBus {
         logger.error(`[EventBus Error] ${event}:`, safeStringify(data));
       }
 
+      if (!hasListeners) return false;
+
       // Create a copy of listeners to avoid issues if listeners modify the array
       const listeners = [...this.events[event]];
       const onceListeners = [];
@@ -170,10 +173,22 @@ class EventBus {
    * @returns {Promise} Resolves when all listeners have been called
    */
   async emitAsync(event, data) {
-    if (!this.events[event] || this.events[event].length === 0) {
-      return false;
+    const isErrorEvent = event.endsWith(':error') && event !== 'log:error';
+    const hasListeners = Boolean(this.events[event]?.length);
+    if (!isErrorEvent && !hasListeners) return false;
+
+    if (isErrorEvent) {
+      if (this._emittingError) {
+        logger.warn(`[EventBus] Suppressed recursive error event: ${event}`);
+        return false;
+      }
+      this._emittingError = true;
+      logger.error(`[EventBus Error] ${event}:`, safeStringify(data));
+      this._emittingError = false;
     }
 
+    if (!hasListeners) return false;
+
     const listeners = [...this.events[event]];
     const onceListeners = [];
 

package/framework/js/drivers/lti-driver.js

@@ -4,14 +4,14 @@
  * Extends HttpDriverBase for shared mock state, suspend data, and semantic interface.
  *
  * LTI 1.3 launch flow:
- * 1. Platform redirects to tool with id_token (JWT) via OIDC
- * 2. Driver validates JWT using platform's JWKS endpoint
- * 3. State persistence via host-provided state endpoint
- * 4. Score reporting via AGS (Assignment and Grade Services)
+ * 1. A trusted same-origin backend completes OIDC and validates the launch
+ * 2. The backend injects validated display claims into the launch HTML
+ * 3. State persistence uses a same-origin authenticated endpoint
+ * 4. Score reporting uses a same-origin AGS proxy endpoint
  *
  * This driver adds:
- * - JWT validation and claims extraction
- * - AGS score passback on terminate
+ * - Validated-claim extraction from trusted launch HTML
+ * - AGS score passback through a server-side proxy on terminate
  * - State persistence via host endpoint
  * - Emergency save via sendBeacon
  */
@@ -19,8 +19,6 @@
 import { HttpDriverBase } from './http-driver-base.js';
 import { logger } from '../utilities/logger.js';
 
-// jose is dynamically imported in initialize() to avoid bundling for non-LTI builds
-
 // =============================================================================
 // LTI Driver Class
 // =============================================================================
@@ -33,9 +31,7 @@ export class LtiDriver extends HttpDriverBase {
         this._claims = null;
 
         // AGS endpoint (from JWT claims)
-        this._agsEndpoint = null;
-        this._agsLineItemUrl = null;
-        this._accessToken = null;
+        this._agsProxyEndpoint = null;
 
         // Host state endpoint for suspend_data persistence
         this._stateEndpoint = null;
@@ -86,7 +82,7 @@ export class LtiDriver extends HttpDriverBase {
             return true;
         }
 
-        // Check for LTI launch parameters
+        // Check for a server-validated LTI launch context
         if (!this._hasLaunchParameters()) {
             if (import.meta.env.DEV) {
                 logger.info('[LtiDriver] No LTI launch parameters. Using localStorage mock.');
@@ -96,10 +92,10 @@ export class LtiDriver extends HttpDriverBase {
                 this._logMockStatement('initialized', { verb: 'initialized' });
                 return true;
             }
-            throw new Error('[LtiDriver] No LTI launch context detected. Expected <meta name="lms-format" content="lti"> or id_token/state URL parameters.');
+            throw new Error('[LtiDriver] No trusted LTI launch context detected. LTI requires a server-side OIDC backend that injects cc-lti-claims.');
         }
 
-        // Production mode: validate JWT and extract claims
+        // Production mode: consume the server-validated launch session
         try {
             await this._processLaunch();
             await this._prefetchState();
@@ -255,63 +251,33 @@ export class LtiDriver extends HttpDriverBase {
     _hasLaunchParameters() {
         if (typeof window === 'undefined') return false;
 
-        // Cloud-hosted: engine handles OIDC server-side, signals via meta tag
-        const formatMeta = document.querySelector('meta[name="lms-format"]');
-        if (formatMeta?.content === 'lti') return true;
-
-        // Self-hosted: JWT params in URL from OIDC redirect
+        // Raw browser JWT handling is intentionally rejected. A browser cannot
+        // safely hold the tool private key or exchange AGS client credentials.
         const params = new URLSearchParams(window.location.search);
-        return Boolean(
-            params.get('id_token') ||
-            params.get('state') ||
-            window.location.hash.includes('id_token')
-        );
+        if (params.get('id_token') || params.get('state') || window.location.hash.includes('id_token')) {
+            return false;
+        }
+
+        return Boolean(document.querySelector('meta[name="cc-lti-claims"]')?.content);
     }
 
     async _processLaunch() {
         const params = new URLSearchParams(window.location.search);
-        const idToken = params.get('id_token');
-
-        // Cloud-hosted path: OIDC handled server-side, no JWT in URL
-        if (!idToken) {
-            this._claims = this._resolveCloudClaims();
-            this._stateEndpoint = this._resolveStateEndpoint();
-
-            const agsUrl = this._resolveCloudAgsEndpoint();
-            if (agsUrl) {
-                this._agsLineItemUrl = agsUrl;
-                logger.debug('[LtiDriver] Cloud AGS endpoint:', agsUrl);
-            }
-
-            logger.debug('[LtiDriver] Cloud-hosted launch. User:', this._claims?.sub || 'unknown');
-            return;
+        if (params.get('id_token') || params.get('state') || window.location.hash.includes('id_token')) {
+            throw new Error('Direct browser OIDC/JWT launches are not supported. Complete LTI OIDC on a trusted backend.');
         }
 
-        // Self-hosted path: validate JWT from URL params
-        const { jwtVerify, createRemoteJWKSet } = await import('jose');
-
-        const [headerB64] = idToken.split('.');
-        const header = JSON.parse(atob(headerB64));
+        this._claims = this._resolveCloudClaims();
+        this._validateLtiClaims(this._claims);
+        this._stateEndpoint = this._resolveTrustedSameOriginEndpoint(this._resolveStateEndpoint(), 'state');
 
-        const jwksUrl = this._getJwksUrl(header);
-        const JWKS = createRemoteJWKSet(new URL(jwksUrl));
-
-        const { payload } = await jwtVerify(idToken, JWKS, {
-            algorithms: ['RS256', 'ES256']
-        });
-
-        this._validateLtiClaims(payload);
-        this._claims = payload;
-
-        const agsEndpoint = payload['https://purl.imsglobal.org/spec/lti-ags/claim/endpoint'];
-        if (agsEndpoint) {
-            this._agsEndpoint = agsEndpoint.lineitems;
-            this._agsLineItemUrl = agsEndpoint.lineitem;
-            logger.debug('[LtiDriver] AGS endpoint configured:', this._agsEndpoint);
+        const agsUrl = this._resolveCloudAgsEndpoint();
+        if (agsUrl) {
+            this._agsProxyEndpoint = this._resolveTrustedSameOriginEndpoint(agsUrl, 'AGS proxy');
+            logger.debug('[LtiDriver] Same-origin AGS proxy configured:', this._agsProxyEndpoint);
         }
 
-        this._stateEndpoint = this._resolveStateEndpoint();
-        logger.debug('[LtiDriver] Launch processed. User:', payload.sub);
+        logger.debug('[LtiDriver] Server-validated launch. User:', this._claims?.sub || 'unknown');
     }
 
     _validateLtiClaims(claims) {
@@ -338,26 +304,24 @@ export class LtiDriver extends HttpDriverBase {
         }
     }
 
-    _getJwksUrl(_header) {
-        const meta = document.querySelector('meta[name="lti-jwks-url"]');
-        if (meta) return meta.content;
-
-        if (window.__LTI_CONFIG__?.jwksUrl) return window.__LTI_CONFIG__.jwksUrl;
-
-        throw new Error('JWKS URL not configured. Set via meta tag or window.__LTI_CONFIG__.');
-    }
-
     _resolveStateEndpoint() {
         const meta = document.querySelector('meta[name="lti-state-endpoint"]');
         if (meta) return meta.content;
 
-        if (window.__LTI_CONFIG__?.stateEndpoint) return window.__LTI_CONFIG__.stateEndpoint;
-
         return '/api/lti/state';
     }
 
+    _resolveTrustedSameOriginEndpoint(value, label) {
+        if (!value) throw new Error(`Missing ${label} endpoint`);
+        const endpoint = new URL(value, window.location.origin);
+        if (endpoint.origin !== window.location.origin) {
+            throw new Error(`${label} endpoint must be same-origin so authentication remains server-controlled`);
+        }
+        return endpoint.toString();
+    }
+
     /**
-     * Resolves LTI claims from cloud-injected meta tags or config object.
+     * Resolves LTI claims from server-injected meta tags.
      * Used when OIDC is handled server-side (no JWT in URL).
      */
     _resolveCloudClaims() {
@@ -370,20 +334,16 @@ export class LtiDriver extends HttpDriverBase {
             }
         }
 
-        if (window.__LTI_CONFIG__?.claims) return window.__LTI_CONFIG__.claims;
-
-        throw new Error('[LtiDriver] Cloud LTI launch detected but no claims provided. Expected <meta name="cc-lti-claims"> or window.__LTI_CONFIG__.claims.');
+        throw new Error('[LtiDriver] LTI launch detected but no valid server-injected <meta name="cc-lti-claims"> was provided.');
     }
 
     /**
-     * Resolves AGS lineitem URL from cloud-injected meta tags or config object.
+     * Resolves the same-origin AGS proxy from a server-injected meta tag.
      */
     _resolveCloudAgsEndpoint() {
         const meta = document.querySelector('meta[name="cc-lti-ags"]');
         if (meta?.content) return meta.content;
 
-        if (window.__LTI_CONFIG__?.agsEndpoint) return window.__LTI_CONFIG__.agsEndpoint;
-
         return null;
     }
 
@@ -407,7 +367,7 @@ export class LtiDriver extends HttpDriverBase {
 
         try {
             const response = await fetch(`${this._stateEndpoint}?key=${encodeURIComponent(stateKey)}`, {
-                headers: this._getAuthHeaders()
+                credentials: 'same-origin'
             });
 
             if (response.ok) {
@@ -445,9 +405,9 @@ export class LtiDriver extends HttpDriverBase {
         const response = await fetch(this._stateEndpoint, {
             method: 'POST',
             headers: {
-                'Content-Type': 'application/json',
-                ...this._getAuthHeaders()
+                'Content-Type': 'application/json'
             },
+            credentials: 'same-origin',
             body: JSON.stringify(payload)
         });
 
@@ -460,19 +420,12 @@ export class LtiDriver extends HttpDriverBase {
         logger.debug('[LtiDriver] State persisted');
     }
 
-    _getAuthHeaders() {
-        if (this._accessToken) {
-            return { 'Authorization': `Bearer ${this._accessToken}` };
-        }
-        return {};
-    }
-
     // =========================================================================
     // Private: AGS Score Passback
     // =========================================================================
 
     async _postScore() {
-        if (!this._agsLineItemUrl || this._score === null) {
+        if (!this._agsProxyEndpoint || this._score === null) {
             return;
         }
 
@@ -487,16 +440,19 @@ export class LtiDriver extends HttpDriverBase {
                 gradingProgress: this._successStatus !== 'unknown' ? 'FullyGraded' : 'NotReady'
             };
 
-            const scoreUrl = `${this._agsLineItemUrl}/scores`;
-            await fetch(scoreUrl, {
+            const response = await fetch(this._agsProxyEndpoint, {
                 method: 'POST',
                 headers: {
-                    'Content-Type': 'application/vnd.ims.lis.v1.score+json',
-                    ...this._getAuthHeaders()
+                    'Content-Type': 'application/vnd.ims.lis.v1.score+json'
                 },
+                credentials: 'same-origin',
                 body: JSON.stringify(scorePayload)
             });
 
+            if (!response.ok) {
+                throw new Error(`AGS proxy rejected score: ${response.status} ${response.statusText || ''}`.trim());
+            }
+
             logger.debug('[LtiDriver] Score posted to AGS:', this._score);
 
         } catch (error) {