coursecode 0.1.52 → 0.1.54

package/framework/js/drivers/proxy-driver.js

@@ -28,7 +28,7 @@ export class ProxyDriver {
 
         // Origin of the parent proxy frame (set during initialize)
         // Used for postMessage origin validation
-        this._parentOrigin = '*'; // Fallback — overridden with real origin when available
+        this._parentOrigin = null;
 
         // Pre-fetched cache populated during initialize()
         this._cache = {
@@ -94,11 +94,14 @@ export class ProxyDriver {
                 const referrerUrl = new URL(document.referrer);
                 this._parentOrigin = referrerUrl.origin;
                 logger.debug('ProxyDriver: Parent origin from referrer:', this._parentOrigin);
-            } else {
-                logger.warn('ProxyDriver: No document.referrer available — using wildcard origin. Some LMS strip the Referer header.');
+            } else if (window.location.ancestorOrigins?.[0]) {
+                this._parentOrigin = new URL(window.location.ancestorOrigins[0]).origin;
             }
         } catch {
-            logger.warn('ProxyDriver: Could not parse document.referrer — using wildcard origin');
+            this._parentOrigin = null;
+        }
+        if (!this._parentOrigin) {
+            throw new Error('ProxyDriver: Cannot determine parent origin; refusing insecure wildcard postMessage transport');
         }
 
         try {
@@ -419,7 +422,7 @@ export class ProxyDriver {
         }
 
         // Validate origin when we have a known parent origin
-        if (this._parentOrigin !== '*' && event.origin !== this._parentOrigin) {
+        if (event.source !== window.parent || event.origin !== this._parentOrigin) {
             logger.warn('ProxyDriver: Rejected message from unexpected origin:', event.origin);
             return;
         }

package/framework/js/main.js

@@ -219,6 +219,8 @@ window.addEventListener('click', (event) => {
 });
 
 function reportInitializationError(error) {
+    document.documentElement.removeAttribute('data-course-loading');
+
     // Store error in AppState if initialized (defensive - AppState might not be initialized yet)
     try {
         if (AppState.isInitialized()) {
@@ -346,10 +348,8 @@ function applyThemeVariants() {
     // Apply course layout from config (before theme variants)
     // Layouts: 'article' (default), 'traditional', 'focused', 'presentation', 'canvas'
     const layout = courseConfig.layout || 'article';
-    if (!html.hasAttribute('data-layout')) {
-        html.setAttribute('data-layout', layout);
-        logger.debug(`[Layout] Applied data-layout="${layout}" from course config`);
-    }
+    html.setAttribute('data-layout', layout);
+    logger.debug(`[Layout] Applied data-layout="${layout}" from course config`);
 
     // Apply sidebar enabled state from config
     // For 'traditional' layout, sidebar is always enabled
@@ -422,20 +422,9 @@ async function initializeCourseApplication() {
         // 0c. Initialize course channel (if configured) - pub/sub transport for course-to-course comms
         initCourseChannel(courseConfig);
 
-        // 0d. Validate access control (for external hosting / multi-tenant CDN)
-        // This MUST run early before any LMS initialization to reject unauthorized clients
-        if (courseConfig.accessControl?.clients) {
-            const { validateAccess, showUnauthorizedScreen } = await import('./utilities/access-control.js');
-            const accessResult = validateAccess();
-            if (!accessResult.valid) {
-                logger.warn('[AccessControl] Access denied:', accessResult.error);
-                showUnauthorizedScreen(accessResult.error);
-                return; // Halt initialization
-            }
-            if (accessResult.clientId) {
-                logger.debug(`[AccessControl] Client authorized: ${accessResult.clientId}`);
-            }
-        }
+        // External-hosting authorization is enforced before delivery by the
+        // configured CDN/backend. Browser-side token comparison is not a
+        // security boundary and is intentionally not performed here.
 
         // 0e. Initialize breakpoint manager (must be early - before components render)
         // Applies responsive .bp-* classes to <html> based on viewport width

package/framework/js/utilities/access-control.js

@@ -1,29 +1,12 @@
 /**
- * Access Control - validates client tokens for multi-tenant CDN hosting
+ * Access Control compatibility helper for multi-tenant CDN hosting.
  * 
- * Checks URL params (clientId, token) against course config.
- * Used by external hosting modes (scorm*-proxy, cmi5-remote).
+ * Real authorization must happen at the CDN/backend before course files are
+ * served. This module deliberately refuses the legacy browser-token design.
  */
 
 import { courseConfig } from '../../../course/course-config.js';
 
-/**
- * Constant-time string comparison to prevent timing side-channel attacks.
- * Returns false for mismatched lengths without leaking which byte differs.
- * @param {string} a
- * @param {string} b
- * @returns {boolean}
- */
-function timingSafeEqual(a, b) {
-    if (typeof a !== 'string' || typeof b !== 'string') return false;
-    if (a.length !== b.length) return false;
-    let mismatch = 0;
-    for (let i = 0; i < a.length; i++) {
-        mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
-    }
-    return mismatch === 0;
-}
-
 /**
  * Validate access based on URL token
  * @returns {{ valid: boolean, clientId: string | null, error: string | null }}
@@ -31,45 +14,28 @@ function timingSafeEqual(a, b) {
 export function validateAccess() {
     const accessControl = courseConfig.accessControl;
 
-    // If no access control clients configured, allow all
-    if (!accessControl?.clients) {
+    if (!accessControl) {
         return { valid: true, clientId: null, error: null };
     }
 
-    const params = new URLSearchParams(window.location.search);
-    const clientId = params.get('clientId');
-    const token = params.get('token');
-
-    // Missing credentials
-    if (!clientId || !token) {
+    if (accessControl.clients) {
         return {
             valid: false,
             clientId: null,
-            error: 'Missing clientId or token'
+            error: 'Legacy browser-side accessControl.clients is insecure and unsupported. Move credentials to .coursecode/access-control.json.'
         };
     }
 
-    // Unknown client
-    const client = accessControl.clients?.[clientId];
-    if (!client) {
+    if (accessControl.enforcement !== 'server') {
         return {
             valid: false,
-            clientId,
-            error: `Unknown client: ${clientId}`
-        };
-    }
-
-    // Invalid token (constant-time comparison)
-    if (!timingSafeEqual(client.token, token)) {
-        return {
-            valid: false,
-            clientId,
-            error: 'Invalid token'
+            clientId: null,
+            error: "External access control must use enforcement: 'server'"
         };
     }
 
-    // Success
-    return { valid: true, clientId, error: null };
+    // Reaching this JavaScript means the server/CDN already authorized delivery.
+    return { valid: true, clientId: null, error: null };
 }
 
 /**

package/framework/js/utilities/data-reporter.js

@@ -40,6 +40,16 @@ let _courseId = null;
 
 const DEFAULT_BATCH_SIZE = 10;
 const DEFAULT_FLUSH_INTERVAL = 30000; // 30 seconds
+const INITIAL_RETRY_DELAY = 1000;
+const MAX_RETRY_DELAY = 30000;
+let retryDelay = INITIAL_RETRY_DELAY;
+
+function scheduleFlush(delay) {
+    if (flushTimer) return;
+    flushTimer = setTimeout(() => {
+        flush();
+    }, delay);
+}
 
 /**
  * Queue a record for batched sending
@@ -69,9 +79,7 @@ function queueRecord(type, data) {
     // Schedule flush on timer if not already scheduled
     if (!flushTimer) {
         const interval = _config.flushInterval || DEFAULT_FLUSH_INTERVAL;
-        flushTimer = setTimeout(() => {
-            flush();
-        }, interval);
+        scheduleFlush(interval);
     }
 }
 
@@ -102,16 +110,21 @@ async function flush() {
         });
 
         if (response.ok) {
+            retryDelay = INITIAL_RETRY_DELAY;
             logger.debug(`[DataReporter] Batch sent successfully (${records.length} records)`);
         } else {
             logger.warn(`[DataReporter] Failed to send batch: ${response.status}`);
             // Re-queue failed records at front of batch
             batch.unshift(...records);
+            scheduleFlush(retryDelay);
+            retryDelay = Math.min(retryDelay * 2, MAX_RETRY_DELAY);
         }
     } catch (e) {
         logger.warn(`[DataReporter] Network error sending batch: ${e.message}`);
         // Re-queue failed records
         batch.unshift(...records);
+        scheduleFlush(retryDelay);
+        retryDelay = Math.min(retryDelay * 2, MAX_RETRY_DELAY);
     }
 }
 

package/framework/version.json

@@ -1,63 +1,39 @@
 {
-  "version": "0.1.0",
-  "name": "SCORM 2004 4th Edition Framework",
-  "description": "Production-ready SCORM framework with modular architecture and advanced features",
-  "released": "2025-11-07",
-  "scorm_version": "SCORM 2004 4th Edition",
+  "version": "0.1.54",
+  "name": "CourseCode Framework",
+  "description": "Multi-format course authoring and learner runtime framework",
+  "released": "2026-07-10",
+  "formats": [
+    "SCORM 2004 4th Edition",
+    "SCORM 1.2",
+    "cmi5",
+    "LTI 1.3"
+  ],
   "compatibility": {
-    "minimum_course_version": "0.1.0",
+    "node": ">=20.19.0",
+    "learner_browsers": {
+      "chrome": ">=111",
+      "edge": ">=111",
+      "firefox": ">=114",
+      "safari": ">=16.4"
+    },
     "breaking_changes": [
-      "StateManager now owns all SCORM persistence; PersistenceManager removed"
+      "Internet Explorer and non-ESM learner webviews are no longer supported",
+      "LTI 1.3 production launches require a trusted server backend",
+      "External-hosting access control requires server-side enforcement"
     ]
   },
-  "components": {
-    "core": [
-      "pipwerks.js",
-      "runtime.js",
-      "event-bus.js",
-      "course-app.js",
-      "accessibility-enhancements.js"
-    ],
-    "managers": [
-      "state-manager.js",
-      "navigation-manager.js",
-      "objective-manager.js",
-      "interaction-manager.js",
-      "accessibility-manager.js",
-      "assessment-manager.js"
-    ],
-    "utilities": [
-      "utilities.js",
-      "feedback-system.js"
-    ],
-    "components": [
-      "ui-components/index.js",
-      "ui-components/modal.js",
-      "ui-components/dropdown.js",
-      "ui-components/notifications.js",
-      "ui-components/tabs.js",
-      "interactions/"
-    ]
+  "build": {
+    "vite": "8.1",
+    "javascript": "ES modules"
   },
-  "features": [
-    "SCORM 2004 4th Edition compliant",
-    "Sequential assessment navigator",
-    "Interactive question types (multiple-choice, fill-in, numeric, hotspot, drag-drop, true-false)",
-    "SCORM-based state persistence",
-    "Accessibility features (WCAG 2.1 AA)",
-    "Adaptive feedback system",
-    "Course gating and navigation rules",
-    "Time tracking and analytics",
-    "Offline mode support",
-    "Assessment security features"
-  ],
   "upgrade": {
-    "instructions": "See UPGRADE_GUIDE.md for detailed upgrade instructions",
+    "instructions": "Run coursecode upgrade --configs, then npm install",
     "backup_recommended": true,
     "test_before_deployment": true
   },
   "support": {
-    "documentation": "https://github.com/svincent/scorm-template",
-    "issues": "https://github.com/svincent/scorm-template/issues"
+    "documentation": "https://github.com/course-code-framework/coursecode/blob/main/framework/docs/USER_GUIDE.md",
+    "issues": "https://github.com/course-code-framework/coursecode/issues"
   }
 }

package/lib/build-packaging.d.ts

@@ -2,6 +2,10 @@ export function stampFormat(html: string, format: string): string
 export function stampFormatInHtml(htmlPath: string, format: string): void
 
 export function validateExternalHostingConfig(config: Record<string, unknown>): void
+export function loadExternalAccessConfig(rootDir: string, courseConfig: Record<string, any>): {
+  enforcement: string | null
+  clients: Record<string, { token: string }>
+}
 
 export function createStandardPackage(options: {
   rootDir: string

package/lib/build-packaging.js

@@ -17,6 +17,7 @@ import { generateManifest } from './manifest/manifest-factory.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 const PACKAGE_ROOT = path.resolve(__dirname, '..');
+const DEFAULT_ACCESS_FILE = path.join('.coursecode', 'access-control.json');
 
 function sanitizeTitle(title) {
     return String(title || 'course')
@@ -55,9 +56,45 @@ export function validateExternalHostingConfig(config) {
         throw new Error(`${config.lmsFormat} format requires 'externalUrl' in course-config.js`);
     }
 
+    if (config.accessControl?.enforcement !== 'server') {
+        throw new Error(`${config.lmsFormat} requires accessControl.enforcement = 'server'. Browser-only token checks are not secure.`);
+    }
+
     if (!config.accessControl?.clients || Object.keys(config.accessControl.clients).length === 0) {
-        throw new Error(`${config.lmsFormat} format requires 'accessControl.clients' in course-config.js. Use 'coursecode token --add <client>' to add clients.`);
+        throw new Error(`${config.lmsFormat} requires client credentials in .coursecode/access-control.json. Run: coursecode token --add <client>`);
+    }
+}
+
+/**
+ * Load external-hosting credentials from a non-published, gitignored file.
+ * Secrets in course-config.js are rejected because that module is bundled into
+ * learner-facing JavaScript.
+ */
+export function loadExternalAccessConfig(rootDir, courseConfig) {
+    if (courseConfig.accessControl?.clients) {
+        throw new Error(
+            'accessControl.clients must not be stored in course/course-config.js because it is bundled for learners. ' +
+            'Move credentials with: coursecode token --add <client>'
+        );
+    }
+
+    const accessFile = process.env.COURSECODE_ACCESS_FILE
+        ? path.resolve(rootDir, process.env.COURSECODE_ACCESS_FILE)
+        : path.join(rootDir, DEFAULT_ACCESS_FILE);
+
+    let secrets = {};
+    if (fs.existsSync(accessFile)) {
+        try {
+            secrets = JSON.parse(fs.readFileSync(accessFile, 'utf-8'));
+        } catch (error) {
+            throw new Error(`Invalid external access file ${accessFile}: ${error.message}`);
+        }
     }
+
+    return {
+        enforcement: courseConfig.accessControl?.enforcement || null,
+        clients: secrets.clients || {}
+    };
 }
 
 /**
@@ -126,7 +163,7 @@ export async function createProxyPackage({ rootDir, config, clientId = null, tok
         const externalUrl = withClientCredentials(config.externalUrl, clientId, token);
 
         let proxyHtml = fs.readFileSync(path.join(templatesDir, 'proxy.html'), 'utf-8');
-        proxyHtml = proxyHtml.replace('{{EXTERNAL_URL}}', externalUrl);
+        proxyHtml = proxyHtml.replace('{{EXTERNAL_URL_JSON}}', JSON.stringify(externalUrl));
         fs.writeFileSync(path.join(proxyDir, 'proxy.html'), proxyHtml);
 
         fs.copyFileSync(path.join(templatesDir, 'scorm-bridge.js'), path.join(proxyDir, 'scorm-bridge.js'));

package/lib/cloud.js

@@ -4,7 +4,7 @@
  * Implements the CLI → Cloud integration spec:
  *   login, logout, whoami, courses, deploy, status
  *
- * Zero external dependencies — uses Node 18+ built-in fetch, crypto, readline.
+ * Zero external dependencies — uses Node 20.19+ built-in fetch, crypto, readline.
  */
 
 import crypto from 'crypto';

package/lib/course-writer.js

@@ -14,6 +14,7 @@
 import fs from 'fs';
 import path from 'path';
 import { pathToFileURL } from 'url';
+import { parse } from 'acorn';
 
 // =============================================================================
 // PUBLIC API
@@ -22,6 +23,7 @@ import { pathToFileURL } from 'url';
 // In-memory write mutex to prevent concurrent writes from clobbering each other.
 // Each write() call chains onto the previous one, ensuring serial execution.
 let _writeQueue = Promise.resolve();
+let _configImportVersion = 0;
 
 /**
  * Unified write dispatcher
@@ -175,7 +177,9 @@ async function renameObjective(coursePath, oldId, newId) {
 
 async function loadConfig(coursePath) {
     const configFilePath = path.join(coursePath, 'course-config.js');
-    const configUrl = pathToFileURL(configFilePath).href + `?t=${Date.now()}`;
+    // Date.now() alone can collide across queued writes in the same
+    // millisecond, causing Node to return a stale ESM module instance.
+    const configUrl = pathToFileURL(configFilePath).href + `?v=${Date.now()}-${++_configImportVersion}`;
     const configModule = await import(configUrl);
     return configModule.courseConfig || configModule.default;
 }
@@ -183,13 +187,60 @@ async function loadConfig(coursePath) {
 async function saveConfig(coursePath, config) {
     const configFilePath = path.join(coursePath, 'course-config.js');
     const originalSource = fs.readFileSync(configFilePath, 'utf-8');
-    const headerComments = extractHeaderComments(originalSource);
-    const serialized = 'export const courseConfig = ' + serializeObject(config) + ';\n';
-    fs.writeFileSync(configFilePath, headerComments + '\n\n' + serialized, 'utf-8');
+    const ast = parse(originalSource, {
+        ecmaVersion: 'latest',
+        sourceType: 'module',
+        allowHashBang: true
+    });
+
+    let configInitializer = null;
+    for (const statement of ast.body) {
+        if (statement.type !== 'ExportNamedDeclaration' || statement.declaration?.type !== 'VariableDeclaration') continue;
+        const declarator = statement.declaration.declarations.find(item => item.id?.name === 'courseConfig');
+        if (declarator) {
+            configInitializer = declarator.init;
+            break;
+        }
+    }
+
+    if (!configInitializer || configInitializer.type !== 'ObjectExpression') {
+        throw new Error('course-config.js must export courseConfig as an object literal for visual editing');
+    }
+
+    const functionSources = new Map();
+    collectFunctionSources(configInitializer, config, originalSource, [], functionSources);
+    const serialized = serializeObject(config, 0, new WeakSet(), [], functionSources);
+    const updatedSource = originalSource.slice(0, configInitializer.start) +
+        serialized + originalSource.slice(configInitializer.end);
+    fs.writeFileSync(configFilePath, updatedSource, 'utf-8');
+}
+
+function collectFunctionSources(node, value, source, valuePath, output) {
+    if (!node || value === null || value === undefined) return;
+    if (typeof value === 'function') {
+        output.set(valuePath.join('.'), source.slice(node.start, node.end));
+        return;
+    }
+
+    if (node.type === 'ObjectExpression' && typeof value === 'object' && !Array.isArray(value)) {
+        for (const property of node.properties) {
+            if (property.type !== 'Property' || property.computed) continue;
+            const key = property.key.type === 'Identifier' ? property.key.name : String(property.key.value);
+            collectFunctionSources(property.value, value[key], source, [...valuePath, key], output);
+        }
+    } else if (node.type === 'ArrayExpression' && Array.isArray(value)) {
+        node.elements.forEach((element, index) => {
+            collectFunctionSources(element, value[index], source, [...valuePath, String(index)], output);
+        });
+    }
 }
 
 function setNestedProperty(obj, propPath, value) {
     const parts = propPath.split('.');
+    const forbidden = new Set(['__proto__', 'prototype', 'constructor']);
+    if (parts.some(part => !part || forbidden.has(part))) {
+        throw new Error('Invalid configuration property path');
+    }
     let current = obj;
     for (let i = 0; i < parts.length - 1; i++) {
         if (current[parts[i]] === undefined) {
@@ -211,48 +262,62 @@ function findStructureItem(structure, id) {
     return null;
 }
 
-function extractHeaderComments(source) {
-    const lines = source.split('\n');
-    const commentLines = [];
-    for (const line of lines) {
-        const trimmed = line.trim();
-        if (trimmed.startsWith('/**') || trimmed.startsWith('*') || trimmed.startsWith('*/') || trimmed === '') {
-            commentLines.push(line);
-        } else {
-            break;
-        }
-    }
-    while (commentLines.length > 0 && commentLines[commentLines.length - 1].trim() === '') {
-        commentLines.pop();
-    }
-    return commentLines.join('\n');
-}
-
-function serializeObject(obj, indent = 0) {
+function serializeObject(obj, indent = 0, ancestors = new WeakSet(), valuePath = [], functionSources = new Map()) {
     const spaces = '    '.repeat(indent);
     const innerSpaces = '    '.repeat(indent + 1);
     
     if (obj === null) return 'null';
     if (obj === undefined) return 'undefined';
     if (typeof obj === 'boolean') return String(obj);
-    if (typeof obj === 'number') return String(obj);
-    if (typeof obj === 'string') return `'${obj.replace(/\\/g, '\\\\').replace(/'/g, "\\'")}'`;
-    if (typeof obj === 'function') return obj.toString();
+    if (typeof obj === 'number') {
+        if (!Number.isFinite(obj)) throw new Error('courseConfig cannot contain NaN or Infinity');
+        return String(obj);
+    }
+    if (typeof obj === 'string') return JSON.stringify(obj).replace(/\u2028/g, '\\u2028').replace(/\u2029/g, '\\u2029');
+    if (typeof obj === 'function') return functionSources.get(valuePath.join('.')) || obj.toString();
+    if (typeof obj !== 'object') throw new Error(`Unsupported courseConfig value type: ${typeof obj}`);
+
+    if (ancestors.has(obj)) throw new Error('courseConfig cannot contain circular references');
+    ancestors.add(obj);
     
     if (Array.isArray(obj)) {
-        if (obj.length === 0) return '[]';
-        const items = obj.map(item => innerSpaces + serializeObject(item, indent + 1));
+        if (obj.length === 0) {
+            ancestors.delete(obj);
+            return '[]';
+        }
+        const items = obj.map((item, index) => innerSpaces + serializeObject(
+            item,
+            indent + 1,
+            ancestors,
+            [...valuePath, String(index)],
+            functionSources
+        ));
+        ancestors.delete(obj);
         return '[\n' + items.join(',\n') + '\n' + spaces + ']';
     }
+
+    const prototype = Object.getPrototypeOf(obj);
+    if (prototype !== Object.prototype && prototype !== null) {
+        ancestors.delete(obj);
+        throw new Error(`Unsupported courseConfig object type: ${obj.constructor?.name || 'unknown'}`);
+    }
     
     const entries = Object.entries(obj);
-    if (entries.length === 0) return '{}';
+    if (entries.length === 0) {
+        ancestors.delete(obj);
+        return '{}';
+    }
     
     const props = entries.map(([key, val]) => {
-        const keyStr = /^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(key) ? key : `'${key}'`;
-        return innerSpaces + keyStr + ': ' + serializeObject(val, indent + 1);
+        const keyStr = /^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(key) ? key : JSON.stringify(key);
+        return innerSpaces + keyStr + ': ' + serializeObject(
+            val,
+            indent + 1,
+            ancestors,
+            [...valuePath, key],
+            functionSources
+        );
     });
-    
+    ancestors.delete(obj);
     return '{\n' + props.join(',\n') + '\n' + spaces + '}';
 }
-

package/lib/manifest/cmi5-manifest.js

@@ -10,6 +10,8 @@
  * For cmi5-remote format, the AU URL is absolute (pointing to CDN).
  */
 
+import { escapeXmlAttribute, escapeXmlText } from './xml-utils.js';
+
 /**
  * Generates the cmi5 course structure XML.
  * @param {Object} config - Course configuration
@@ -23,39 +25,46 @@ export function generateCmi5Manifest(config, _files, options = {}) {
   const courseId = config.identifier ||
     `urn:coursecode:${config.title.replace(/[^a-zA-Z0-9]/g, '-').toLowerCase()}`;
 
-  // Calculate mastery score from passing percentage (convert percentage to 0-1 scale)
-  const masteryScore = config.passingScore ? (config.passingScore / 100).toFixed(2) : '0.8';
+  // Package-level mastery is optional. Do not invent a value from one
+  // assessment because a course can contain multiple thresholds.
+  const masteryAttribute = Number.isFinite(config.masteryScore)
+    ? ` masteryScore="${(config.masteryScore / 100).toFixed(2)}"`
+    : '';
 
   // AU identifier - derive from course ID
   const auId = `${courseId}/au/1`;
 
   // URL: absolute for cmi5-remote (use as-is), relative for standard cmi5
   const auUrl = options.externalUrl || 'index.html';
+  const escapedCourseId = escapeXmlAttribute(courseId);
+  const escapedAuId = escapeXmlAttribute(auId);
+  const escapedLanguage = escapeXmlAttribute(config.language);
+  const title = escapeXmlText(config.title);
+  const description = escapeXmlText(config.description);
 
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!-- cmi5 Course Structure - GENERATED FILE - DO NOT EDIT MANUALLY -->
 <courseStructure xmlns="https://w3id.org/xapi/profiles/cmi5/v1/CourseStructure.xsd">
 
-  <course id="${courseId}">
+  <course id="${escapedCourseId}">
     <title>
-      <langstring lang="${config.language}">${config.title}</langstring>
+      <langstring lang="${escapedLanguage}">${title}</langstring>
     </title>
     <description>
-      <langstring lang="${config.language}">${config.description}</langstring>
+      <langstring lang="${escapedLanguage}">${description}</langstring>
     </description>
   </course>
 
-  <au id="${auId}" moveOn="Completed" masteryScore="${masteryScore}" launchMethod="OwnWindow">
+  <au id="${escapedAuId}" moveOn="Completed"${masteryAttribute} launchMethod="OwnWindow">
     <title>
-      <langstring lang="${config.language}">${config.title}</langstring>
+      <langstring lang="${escapedLanguage}">${title}</langstring>
     </title>
     <description>
-      <langstring lang="${config.language}">${config.description}</langstring>
+      <langstring lang="${escapedLanguage}">${description}</langstring>
     </description>
-    <url>${auUrl}</url>
+    <url>${escapeXmlText(auUrl)}</url>
   </au>
 
 </courseStructure>
 `;
 }
-