coursecode 0.1.52 → 0.1.54

package/lib/upgrade.js

@@ -113,6 +113,46 @@ export function addMissingRuntimeDependencies(projectPkg, templatePkg) {
   return added;
 }
 
+const OBSOLETE_MANAGED_DEV_DEPENDENCIES = ['@vitejs/plugin-legacy'];
+
+/**
+ * Synchronize the build tooling that accompanies a replaced template config.
+ * This only runs with `coursecode upgrade --configs`, keeping the default
+ * framework-only upgrade from changing a project's custom build stack.
+ */
+export function syncManagedBuildTooling(projectPkg, templatePkg) {
+  const projectDevDeps = { ...(projectPkg.devDependencies || {}) };
+  const templateDevDeps = templatePkg.devDependencies || {};
+  const updated = [];
+  const removed = [];
+
+  for (const [name, version] of Object.entries(templateDevDeps)) {
+    if (projectDevDeps[name] !== version) {
+      projectDevDeps[name] = version;
+      updated.push(`${name}@${version}`);
+    }
+  }
+
+  for (const name of OBSOLETE_MANAGED_DEV_DEPENDENCIES) {
+    if (projectDevDeps[name]) {
+      delete projectDevDeps[name];
+      removed.push(name);
+    }
+  }
+
+  projectPkg.devDependencies = Object.fromEntries(
+    Object.entries(projectDevDeps).sort(([a], [b]) => a.localeCompare(b))
+  );
+
+  const nodeEngine = templatePkg.engines?.node;
+  const engineUpdated = Boolean(nodeEngine && projectPkg.engines?.node !== nodeEngine);
+  if (engineUpdated) {
+    projectPkg.engines = { ...(projectPkg.engines || {}), node: nodeEngine };
+  }
+
+  return { updated, removed, engineUpdated };
+}
+
 export async function upgrade(options = {}) {
   const cwd = process.cwd();
   const rcPath = path.join(cwd, '.coursecoderc.json');
@@ -175,7 +215,8 @@ export async function upgrade(options = {}) {
     if (options.configs) {
       dryRunMsg += `
    - vite.config.js (replace, backup original)
-   - eslint.config.js (replace, backup original)`;
+   - eslint.config.js (replace, backup original)
+   - package.json (sync managed Vite/ESLint tooling and remove plugin-legacy)`;
     }
 
     dryRunMsg += `
@@ -266,10 +307,18 @@ export async function upgrade(options = {}) {
   // the project's existing version ranges.
   const pkgPath = path.join(cwd, 'package.json');
   let addedRuntimeDeps = [];
+  let toolingChanges = null;
   if (fs.existsSync(pkgPath)) {
     const projectPkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
     addedRuntimeDeps = addMissingRuntimeDependencies(projectPkg, templatePkg);
-    if (addedRuntimeDeps.length > 0) {
+    if (options.configs) {
+      toolingChanges = syncManagedBuildTooling(projectPkg, templatePkg);
+    }
+    const packageChanged = addedRuntimeDeps.length > 0 ||
+      toolingChanges?.updated.length > 0 ||
+      toolingChanges?.removed.length > 0 ||
+      toolingChanges?.engineUpdated;
+    if (packageChanged) {
       fs.writeFileSync(pkgPath, JSON.stringify(projectPkg, null, 2) + '\n');
     }
   }
@@ -290,6 +339,31 @@ export async function upgrade(options = {}) {
    Run npm install to update node_modules and your lockfile.`;
   }
 
+  if (toolingChanges && (
+    toolingChanges.updated.length > 0 ||
+    toolingChanges.removed.length > 0 ||
+    toolingChanges.engineUpdated
+  )) {
+    successMsg += `
+
+   Managed build tooling synchronized for the new config:`;
+    if (toolingChanges.updated.length > 0) {
+      successMsg += `
+   - Updated: ${toolingChanges.updated.join(', ')}`;
+    }
+    if (toolingChanges.removed.length > 0) {
+      successMsg += `
+   - Removed: ${toolingChanges.removed.join(', ')}`;
+    }
+    if (toolingChanges.engineUpdated) {
+      successMsg += `
+   - Updated Node engine requirement to ${templatePkg.engines.node}`;
+    }
+    successMsg += `
+
+   Run npm install to update node_modules and your lockfile.`;
+  }
+
   if (configUpdates.length > 0) {
     successMsg += `
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coursecode",
-  "version": "0.1.52",
+  "version": "0.1.54",
   "description": "Multi-format course authoring framework with CLI tools (SCORM 2004, SCORM 1.2, cmi5, LTI 1.3)",
   "type": "module",
   "bin": {
@@ -57,20 +57,21 @@
     "build:scorm12": "LMS_FORMAT=scorm1.2 npx vite build --config vite.framework-dev.config.js",
     "build:cmi5": "LMS_FORMAT=cmi5 npx vite build --config vite.framework-dev.config.js",
     "build:lti": "LMS_FORMAT=lti npx vite build --config vite.framework-dev.config.js",
-    "package": "npm run lint && PACKAGE=true npx vite build --config vite.framework-dev.config.js",
-    "package:scorm2004": "npm run lint && LMS_FORMAT=scorm2004 PACKAGE=true npx vite build --config vite.framework-dev.config.js",
-    "package:scorm12": "npm run lint && LMS_FORMAT=scorm1.2 PACKAGE=true npx vite build --config vite.framework-dev.config.js",
-    "package:cmi5": "npm run lint && LMS_FORMAT=cmi5 PACKAGE=true npx vite build --config vite.framework-dev.config.js",
-    "package:lti": "npm run lint && LMS_FORMAT=lti PACKAGE=true npx vite build --config vite.framework-dev.config.js",
+    "package": "npm run lint && npm run test:coverage && PACKAGE=true npx vite build --config vite.framework-dev.config.js",
+    "package:scorm2004": "npm run lint && npm run test:coverage && LMS_FORMAT=scorm2004 PACKAGE=true npx vite build --config vite.framework-dev.config.js",
+    "package:scorm12": "npm run lint && npm run test:coverage && LMS_FORMAT=scorm1.2 PACKAGE=true npx vite build --config vite.framework-dev.config.js",
+    "package:cmi5": "npm run lint && npm run test:coverage && LMS_FORMAT=cmi5 PACKAGE=true npx vite build --config vite.framework-dev.config.js",
+    "package:lti": "npm run lint && npm run test:coverage && LMS_FORMAT=lti PACKAGE=true npx vite build --config vite.framework-dev.config.js",
     "test": "vitest run --config tests/vitest.config.js",
     "test:e2e": "vitest run --config tests/vitest.e2e.config.js",
-    "test:all": "npm test && npm run test:e2e",
+    "test:drivers": "vitest run --config tests/vitest.e2e.scorm2004.config.js && vitest run --config tests/vitest.e2e.scorm12.config.js && vitest run --config tests/vitest.e2e.cmi5.config.js && vitest run --config tests/vitest.e2e.lti.config.js",
+    "test:all": "npm test && npm run test:e2e && npm run test:drivers",
     "test:cloud": "vitest run --config tests/vitest.cloud.config.js",
     "test:watch": "vitest --config tests/vitest.config.js",
     "test:coverage": "vitest run --config tests/vitest.config.js --coverage",
-    "prerelease:check": "npm run lint && npm run lint:responsive && npm run lint:responsive:structure && npm run build",
-    "prerelease:check:full": "npm run prerelease:check && npm run smoke:responsive -- --profile=expanded",
-    "prepublishOnly": "echo '📦 Preparing coursecode for npm...'"
+    "prerelease:check": "npm run lint && npm run lint:responsive && npm run lint:responsive:structure && npm run test:coverage && npm run build",
+    "prerelease:check:full": "npm run prerelease:check && npm run test:e2e && npm run test:drivers && npm run smoke:responsive -- --profile=expanded",
+    "prepublishOnly": "npm run prerelease:check"
   },
   "repository": {
     "type": "git",
@@ -98,34 +99,40 @@
   },
   "homepage": "https://github.com/course-code-framework/coursecode/blob/main/framework/docs/USER_GUIDE.md",
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.19.0"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0",
-    "acorn": "^8.15.0",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "acorn": "^8.17.0",
     "archiver": "^7.0.1",
     "commander": "^14.0.3",
     "lz-string": "^1.5.0",
-    "mammoth": "^1.8.0",
+    "mammoth": "^1.12.0",
     "marked": "^17.0.6",
     "marked-gfm-heading-id": "^4.1.4",
     "node-pptx-parser": "^1.0.1",
-    "pdf2json": "^4.0.2",
+    "pdf2json": "^4.0.3",
     "pdf2md": "^1.0.2",
-    "puppeteer-core": "^24.42.0",
+    "puppeteer-core": "^24.43.1",
     "win-ca": "^3.5.1",
-    "ws": "^8.18.0"
+    "ws": "^8.21.0"
   },
   "devDependencies": {
-    "@vitejs/plugin-legacy": "^7.2.1",
-    "@vitest/coverage-v8": "^4.1.5",
+    "@vitest/coverage-v8": "^4.1.10",
     "@xapi/cmi5": "^1.4.0",
-    "eslint": "^10.2.1",
-    "globals": "^17.5.0",
-    "jose": "^6.2.2",
+    "eslint": "^10.6.0",
+    "globals": "^17.7.0",
     "pptxgenjs": "^4.0.1",
-    "vite": "~7.2.2",
-    "vite-plugin-static-copy": "^3.4.0",
-    "vitest": "^4.1.5"
+    "vite": "~8.1.4",
+    "vite-plugin-static-copy": "^4.1.1",
+    "vitest": "^4.1.10"
+  },
+  "overrides": {
+    "uuid": "^11.1.1"
+  },
+  "pnpm": {
+    "overrides": {
+      "uuid": "^11.1.1"
+    }
   }
 }

package/template/course/course-config.js

@@ -92,13 +92,15 @@
  * EXTERNAL HOSTING (CDN deployment with proxy packages):
  *   format: 'scorm1.2-proxy' | 'scorm2004-proxy' | 'cmi5-remote'
  *   externalUrl: 'https://cdn.example.com/courses/my-course'  // Where course is hosted
- *   accessControl: {
- *     clients: {
- *       'acme-corp': { token: 'generated-token-here' },
- *       'globex': { token: 'another-token-here' }
- *     }
- *   }
- *   Generate tokens: coursecode token --add <clientId>
+ *   accessControl: { enforcement: 'server' }
+ *   Client tokens are stored outside course source in the gitignored file
+ *   .coursecode/access-control.json (created by coursecode token --add <clientId>).
+ *   The CDN/backend MUST validate credentials before serving index.html/assets.
+ *
+ * LMS PACKAGE MASTERY (optional):
+ *   lms: { masteryScore: 80 }  // 0-100; omitted by default
+ *   Only set this when the whole package has one LMS-level threshold. Individual
+ *   assessment passing scores remain in their assessment settings.
  *   Build output: One package per client (e.g., acme-corp_proxy.zip)
  *
  * CLOUD DEPLOYMENT:

package/template/package.json

@@ -4,6 +4,9 @@
   "private": true,
   "type": "module",
   "description": "CourseCode project",
+  "engines": {
+    "node": ">=20.19.0"
+  },
   "scripts": {
     "dev": "vite build --mode development --watch",
     "build": "npm run lint && vite build",
@@ -13,16 +16,22 @@
   },
   "dependencies": {
     "@xapi/cmi5": "^1.4.0",
-    "jose": "^6.2.2",
     "lz-string": "^1.5.0",
     "marked": "^17.0.6",
     "marked-gfm-heading-id": "^4.1.4"
   },
   "devDependencies": {
-    "@vitejs/plugin-legacy": "~7.2.1",
     "archiver": "^7.0.1",
     "eslint": "^9.39.4",
-    "vite": "~7.2.2",
-    "vite-plugin-static-copy": "^3.4.0"
+    "vite": "~8.1.4",
+    "vite-plugin-static-copy": "^4.1.1"
+  },
+  "overrides": {
+    "uuid": "^11.1.1"
+  },
+  "pnpm": {
+    "overrides": {
+      "uuid": "^11.1.1"
+    }
   }
 }

package/template/vite.config.js

@@ -1,5 +1,4 @@
 import { defineConfig } from 'vite';
-import legacy from '@vitejs/plugin-legacy';
 import { viteStaticCopy } from 'vite-plugin-static-copy';
 import path from 'path';
 import { fileURLToPath, pathToFileURL } from 'url';
@@ -10,10 +9,12 @@ let contentDiscoveryPlugin;
 let createStandardPackage;
 let createExternalPackagesForClients;
 let validateExternalHostingConfig;
+let loadExternalAccessConfig;
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const ROOT_DIR = path.resolve(__dirname);
 const DIST_DIR = path.join(ROOT_DIR, 'dist');
+const SUPPORTED_BROWSER_TARGETS = ['chrome111', 'edge111', 'firefox114', 'safari16.4'];
 
 async function loadBuildUtils() {
   if (
@@ -21,7 +22,8 @@ async function loadBuildUtils() {
     contentDiscoveryPlugin &&
     createStandardPackage &&
     createExternalPackagesForClients &&
-    validateExternalHostingConfig
+    validateExternalHostingConfig &&
+    loadExternalAccessConfig
   ) {
     return;
   }
@@ -31,7 +33,8 @@ async function loadBuildUtils() {
     ({
       createStandardPackage,
       createExternalPackagesForClients,
-      validateExternalHostingConfig
+      validateExternalHostingConfig,
+      loadExternalAccessConfig
     } = await import('coursecode/build-packaging'));
     ({ default: contentDiscoveryPlugin } = await import('coursecode/vite-plugin-content-discovery'));
   } catch {
@@ -43,7 +46,8 @@ async function loadBuildUtils() {
     ({
       createStandardPackage,
       createExternalPackagesForClients,
-      validateExternalHostingConfig
+      validateExternalHostingConfig,
+      loadExternalAccessConfig
     } = await import(toUrl('build-packaging.js')));
     ({ default: contentDiscoveryPlugin } = await import(toUrl('vite-plugin-content-discovery.js')));
   }
@@ -89,6 +93,34 @@ function validatePackage(format = 'scorm2004') {
     warnings.push('No assets directory found');
   }
 
+  // Authoring inputs must never be published with the learner runtime.
+  const forbiddenCoursePaths = [
+    'course/course-config.js',
+    'course/references',
+    'course/slides',
+    'course/assessments',
+    'course/theme.css'
+  ];
+  for (const relativePath of forbiddenCoursePaths) {
+    if (fs.existsSync(path.join(DIST_DIR, relativePath))) {
+      errors.push(`Authoring source leaked into package: ${relativePath}`);
+    }
+  }
+
+  const invalidCopyLayouts = [
+    '.vite',
+    'schemas',
+    'common/schemas',
+    'course/course',
+    'course/template',
+    'js/vendor/framework'
+  ];
+  for (const relativePath of invalidCopyLayouts) {
+    if (fs.existsSync(path.join(DIST_DIR, relativePath))) {
+      errors.push(`Static-copy output has an unexpected nested source path: ${relativePath}`);
+    }
+  }
+
   // Validate manifest/tool config content by format
   if (format === 'cmi5') {
     // cmi5: Validate cmi5.xml structure
@@ -142,6 +174,12 @@ async function loadCourseConfig() {
   const module = await import(configUrl);
   const config = module.courseConfig || module.default || {};
 
+  const masteryScore = config.lms?.masteryScore;
+  if (masteryScore !== undefined && (!Number.isFinite(masteryScore) || masteryScore < 0 || masteryScore > 100)) {
+    throw new Error('lms.masteryScore must be a number between 0 and 100');
+  }
+
+  const lmsFormat = process.env.LMS_FORMAT || config.format || 'cmi5';
   return {
     title: config.metadata?.title || 'SCORM Course',
     description: config.metadata?.description || 'SCORM 2004 4th Edition Course',
@@ -151,9 +189,10 @@ async function loadCourseConfig() {
     windowWidth: config.environment?.window?.width || 1024,
     windowHeight: config.environment?.window?.height || 768,
     // LMS format: CLI override (env var) takes precedence over config file
-    lmsFormat: process.env.LMS_FORMAT || config.format || 'cmi5',
-    externalUrl: config.externalUrl || null,
-    accessControl: config.accessControl || null,
+    lmsFormat,
+    externalUrl: process.env.LTI_EXTERNAL_URL || config.externalUrl || null,
+    masteryScore: masteryScore ?? null,
+    accessControl: loadExternalAccessConfig(ROOT_DIR, config),
     galleryConfig: config.navigation?.documentGallery || null
   };
 }
@@ -184,14 +223,31 @@ function scanDistFiles() {
   return files;
 }
 
+function removeHiddenBuildArtifacts(dir) {
+  if (!fs.existsSync(dir)) return;
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const fullPath = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      removeHiddenBuildArtifacts(fullPath);
+    } else if (entry.name === '.DS_Store' || entry.name === '.gitkeep' || entry.name.startsWith('._')) {
+      fs.rmSync(fullPath, { force: true });
+    }
+  }
+}
+
 /**
  * SCORM post-build plugin
  */
-function scormPostBuild(isDev) {
+function scormPostBuild(isDev, { isWatchBuild }) {
+  let initialBuild = true;
   return {
     name: 'scorm-post-build',
     enforce: 'post',
     buildStart() {
+      if (initialBuild && isWatchBuild && fs.existsSync(DIST_DIR)) {
+        fs.rmSync(DIST_DIR, { recursive: true, force: true });
+      }
+      initialBuild = false;
       if (isDev) console.log('🔨 Building...');
     },
     closeBundle: async () => {
@@ -199,6 +255,7 @@ function scormPostBuild(isDev) {
         // Move index.html to root
         const indexSource = path.join(DIST_DIR, 'framework', 'index.html');
         const indexDest = path.join(DIST_DIR, 'index.html');
+        removeHiddenBuildArtifacts(DIST_DIR);
 
         // Load course config once for meta tag injection and manifest generation
         const config = await loadCourseConfig();
@@ -267,6 +324,7 @@ function scormPostBuild(isDev) {
 export default defineConfig(async ({ mode }) => {
   await loadBuildUtils();
   const isDev = mode === 'development';
+  const isWatchBuild = process.argv.includes('--watch');
   const courseConfig = await loadCourseConfig();
 
   return {
@@ -292,18 +350,20 @@ export default defineConfig(async ({ mode }) => {
 
     build: {
       outDir: 'dist',
-      emptyOutDir: !isDev,
-      manifest: true,
+      emptyOutDir: !isWatchBuild,
+      // Stable browser contract for LMS launches. SCORM defines the LMS API,
+      // not an obsolete browser requirement; IE11/SystemJS is unsupported.
+      target: SUPPORTED_BROWSER_TARGETS,
       // LMS environments (SCORM/cmi5) can be restrictive with dynamic imports,
       // so we intentionally keep main.js as a single chunk
       chunkSizeWarningLimit: 600,
-      rollupOptions: {
+      rolldownOptions: {
         input: {
           main: path.resolve(__dirname, 'framework/index.html')
         },
         // All drivers are bundled as lazy chunks in the universal build.
-        // jose is dynamically imported by lti-driver.js only when LTI format
-        // is selected at runtime, so it's safe to include in all builds.
+        // LTI OIDC/JWT validation remains server-side, so no browser crypto
+        // verification dependency is required here.
         output: {
           entryFileNames: 'assets/[name].js',
           chunkFileNames: 'assets/[name].js',
@@ -316,26 +376,19 @@ export default defineConfig(async ({ mode }) => {
       // Content discovery - generates manifest at build time
       contentDiscoveryPlugin({ galleryConfig: courseConfig.galleryConfig }),
 
-      ...(!isDev ? [
-        legacy({
-          targets: ['ie >= 11'],
-          renderLegacyChunks: true,
-          modernPolyfills: true,
-          ignoreBrowserslistConfig: true
-        })
-      ] : []),
-
       viteStaticCopy({
         targets: [
-          { src: 'schemas/*.{xml,xsd,dtd}', dest: '.' },
-          { src: 'schemas/common/*', dest: 'common' },
-          { src: 'course', dest: '.' },
-          { src: 'framework/js/vendor/**/*', dest: 'js/vendor' }
+          { src: 'schemas/*.{xml,xsd,dtd}', dest: '.', rename: { stripBase: 1 } },
+          { src: 'schemas/common/*', dest: 'common', rename: { stripBase: 2 } },
+          // Publish runtime assets only. Never ship authoring references,
+          // configuration source, assessment source, or hidden project files.
+          { src: 'course/assets', dest: 'course', rename: { stripBase: 1 } },
+          { src: 'framework/js/vendor/**/*', dest: 'js/vendor', rename: { stripBase: 3 } }
         ],
         watch: isDev ? { rerun: true } : undefined
       }),
 
-      scormPostBuild(isDev)
+      scormPostBuild(isDev, { isWatchBuild })
     ]
   };
 });