coursecode 0.1.53 → 0.1.54

package/framework/js/utilities/access-control.js

@@ -1,29 +1,12 @@
 /**
- * Access Control - validates client tokens for multi-tenant CDN hosting
+ * Access Control compatibility helper for multi-tenant CDN hosting.
  * 
- * Checks URL params (clientId, token) against course config.
- * Used by external hosting modes (scorm*-proxy, cmi5-remote).
+ * Real authorization must happen at the CDN/backend before course files are
+ * served. This module deliberately refuses the legacy browser-token design.
  */
 
 import { courseConfig } from '../../../course/course-config.js';
 
-/**
- * Constant-time string comparison to prevent timing side-channel attacks.
- * Returns false for mismatched lengths without leaking which byte differs.
- * @param {string} a
- * @param {string} b
- * @returns {boolean}
- */
-function timingSafeEqual(a, b) {
-    if (typeof a !== 'string' || typeof b !== 'string') return false;
-    if (a.length !== b.length) return false;
-    let mismatch = 0;
-    for (let i = 0; i < a.length; i++) {
-        mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
-    }
-    return mismatch === 0;
-}
-
 /**
  * Validate access based on URL token
  * @returns {{ valid: boolean, clientId: string | null, error: string | null }}
@@ -31,45 +14,28 @@ function timingSafeEqual(a, b) {
 export function validateAccess() {
     const accessControl = courseConfig.accessControl;
 
-    // If no access control clients configured, allow all
-    if (!accessControl?.clients) {
+    if (!accessControl) {
         return { valid: true, clientId: null, error: null };
     }
 
-    const params = new URLSearchParams(window.location.search);
-    const clientId = params.get('clientId');
-    const token = params.get('token');
-
-    // Missing credentials
-    if (!clientId || !token) {
+    if (accessControl.clients) {
         return {
             valid: false,
             clientId: null,
-            error: 'Missing clientId or token'
+            error: 'Legacy browser-side accessControl.clients is insecure and unsupported. Move credentials to .coursecode/access-control.json.'
         };
     }
 
-    // Unknown client
-    const client = accessControl.clients?.[clientId];
-    if (!client) {
+    if (accessControl.enforcement !== 'server') {
         return {
             valid: false,
-            clientId,
-            error: `Unknown client: ${clientId}`
-        };
-    }
-
-    // Invalid token (constant-time comparison)
-    if (!timingSafeEqual(client.token, token)) {
-        return {
-            valid: false,
-            clientId,
-            error: 'Invalid token'
+            clientId: null,
+            error: "External access control must use enforcement: 'server'"
         };
     }
 
-    // Success
-    return { valid: true, clientId, error: null };
+    // Reaching this JavaScript means the server/CDN already authorized delivery.
+    return { valid: true, clientId: null, error: null };
 }
 
 /**

package/framework/js/utilities/data-reporter.js

@@ -40,6 +40,16 @@ let _courseId = null;
 
 const DEFAULT_BATCH_SIZE = 10;
 const DEFAULT_FLUSH_INTERVAL = 30000; // 30 seconds
+const INITIAL_RETRY_DELAY = 1000;
+const MAX_RETRY_DELAY = 30000;
+let retryDelay = INITIAL_RETRY_DELAY;
+
+function scheduleFlush(delay) {
+    if (flushTimer) return;
+    flushTimer = setTimeout(() => {
+        flush();
+    }, delay);
+}
 
 /**
  * Queue a record for batched sending
@@ -69,9 +79,7 @@ function queueRecord(type, data) {
     // Schedule flush on timer if not already scheduled
     if (!flushTimer) {
         const interval = _config.flushInterval || DEFAULT_FLUSH_INTERVAL;
-        flushTimer = setTimeout(() => {
-            flush();
-        }, interval);
+        scheduleFlush(interval);
     }
 }
 
@@ -102,16 +110,21 @@ async function flush() {
         });
 
         if (response.ok) {
+            retryDelay = INITIAL_RETRY_DELAY;
             logger.debug(`[DataReporter] Batch sent successfully (${records.length} records)`);
         } else {
             logger.warn(`[DataReporter] Failed to send batch: ${response.status}`);
             // Re-queue failed records at front of batch
             batch.unshift(...records);
+            scheduleFlush(retryDelay);
+            retryDelay = Math.min(retryDelay * 2, MAX_RETRY_DELAY);
         }
     } catch (e) {
         logger.warn(`[DataReporter] Network error sending batch: ${e.message}`);
         // Re-queue failed records
         batch.unshift(...records);
+        scheduleFlush(retryDelay);
+        retryDelay = Math.min(retryDelay * 2, MAX_RETRY_DELAY);
     }
 }
 

package/framework/version.json

@@ -1,63 +1,39 @@
 {
-  "version": "0.1.0",
-  "name": "SCORM 2004 4th Edition Framework",
-  "description": "Production-ready SCORM framework with modular architecture and advanced features",
-  "released": "2025-11-07",
-  "scorm_version": "SCORM 2004 4th Edition",
+  "version": "0.1.54",
+  "name": "CourseCode Framework",
+  "description": "Multi-format course authoring and learner runtime framework",
+  "released": "2026-07-10",
+  "formats": [
+    "SCORM 2004 4th Edition",
+    "SCORM 1.2",
+    "cmi5",
+    "LTI 1.3"
+  ],
   "compatibility": {
-    "minimum_course_version": "0.1.0",
+    "node": ">=20.19.0",
+    "learner_browsers": {
+      "chrome": ">=111",
+      "edge": ">=111",
+      "firefox": ">=114",
+      "safari": ">=16.4"
+    },
     "breaking_changes": [
-      "StateManager now owns all SCORM persistence; PersistenceManager removed"
+      "Internet Explorer and non-ESM learner webviews are no longer supported",
+      "LTI 1.3 production launches require a trusted server backend",
+      "External-hosting access control requires server-side enforcement"
     ]
   },
-  "components": {
-    "core": [
-      "pipwerks.js",
-      "runtime.js",
-      "event-bus.js",
-      "course-app.js",
-      "accessibility-enhancements.js"
-    ],
-    "managers": [
-      "state-manager.js",
-      "navigation-manager.js",
-      "objective-manager.js",
-      "interaction-manager.js",
-      "accessibility-manager.js",
-      "assessment-manager.js"
-    ],
-    "utilities": [
-      "utilities.js",
-      "feedback-system.js"
-    ],
-    "components": [
-      "ui-components/index.js",
-      "ui-components/modal.js",
-      "ui-components/dropdown.js",
-      "ui-components/notifications.js",
-      "ui-components/tabs.js",
-      "interactions/"
-    ]
+  "build": {
+    "vite": "8.1",
+    "javascript": "ES modules"
   },
-  "features": [
-    "SCORM 2004 4th Edition compliant",
-    "Sequential assessment navigator",
-    "Interactive question types (multiple-choice, fill-in, numeric, hotspot, drag-drop, true-false)",
-    "SCORM-based state persistence",
-    "Accessibility features (WCAG 2.1 AA)",
-    "Adaptive feedback system",
-    "Course gating and navigation rules",
-    "Time tracking and analytics",
-    "Offline mode support",
-    "Assessment security features"
-  ],
   "upgrade": {
-    "instructions": "See UPGRADE_GUIDE.md for detailed upgrade instructions",
+    "instructions": "Run coursecode upgrade --configs, then npm install",
     "backup_recommended": true,
     "test_before_deployment": true
   },
   "support": {
-    "documentation": "https://github.com/svincent/scorm-template",
-    "issues": "https://github.com/svincent/scorm-template/issues"
+    "documentation": "https://github.com/course-code-framework/coursecode/blob/main/framework/docs/USER_GUIDE.md",
+    "issues": "https://github.com/course-code-framework/coursecode/issues"
   }
 }

package/lib/build-packaging.d.ts

@@ -2,6 +2,10 @@ export function stampFormat(html: string, format: string): string
 export function stampFormatInHtml(htmlPath: string, format: string): void
 
 export function validateExternalHostingConfig(config: Record<string, unknown>): void
+export function loadExternalAccessConfig(rootDir: string, courseConfig: Record<string, any>): {
+  enforcement: string | null
+  clients: Record<string, { token: string }>
+}
 
 export function createStandardPackage(options: {
   rootDir: string

package/lib/build-packaging.js

@@ -17,6 +17,7 @@ import { generateManifest } from './manifest/manifest-factory.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 const PACKAGE_ROOT = path.resolve(__dirname, '..');
+const DEFAULT_ACCESS_FILE = path.join('.coursecode', 'access-control.json');
 
 function sanitizeTitle(title) {
     return String(title || 'course')
@@ -55,9 +56,45 @@ export function validateExternalHostingConfig(config) {
         throw new Error(`${config.lmsFormat} format requires 'externalUrl' in course-config.js`);
     }
 
+    if (config.accessControl?.enforcement !== 'server') {
+        throw new Error(`${config.lmsFormat} requires accessControl.enforcement = 'server'. Browser-only token checks are not secure.`);
+    }
+
     if (!config.accessControl?.clients || Object.keys(config.accessControl.clients).length === 0) {
-        throw new Error(`${config.lmsFormat} format requires 'accessControl.clients' in course-config.js. Use 'coursecode token --add <client>' to add clients.`);
+        throw new Error(`${config.lmsFormat} requires client credentials in .coursecode/access-control.json. Run: coursecode token --add <client>`);
+    }
+}
+
+/**
+ * Load external-hosting credentials from a non-published, gitignored file.
+ * Secrets in course-config.js are rejected because that module is bundled into
+ * learner-facing JavaScript.
+ */
+export function loadExternalAccessConfig(rootDir, courseConfig) {
+    if (courseConfig.accessControl?.clients) {
+        throw new Error(
+            'accessControl.clients must not be stored in course/course-config.js because it is bundled for learners. ' +
+            'Move credentials with: coursecode token --add <client>'
+        );
+    }
+
+    const accessFile = process.env.COURSECODE_ACCESS_FILE
+        ? path.resolve(rootDir, process.env.COURSECODE_ACCESS_FILE)
+        : path.join(rootDir, DEFAULT_ACCESS_FILE);
+
+    let secrets = {};
+    if (fs.existsSync(accessFile)) {
+        try {
+            secrets = JSON.parse(fs.readFileSync(accessFile, 'utf-8'));
+        } catch (error) {
+            throw new Error(`Invalid external access file ${accessFile}: ${error.message}`);
+        }
     }
+
+    return {
+        enforcement: courseConfig.accessControl?.enforcement || null,
+        clients: secrets.clients || {}
+    };
 }
 
 /**
@@ -126,7 +163,7 @@ export async function createProxyPackage({ rootDir, config, clientId = null, tok
         const externalUrl = withClientCredentials(config.externalUrl, clientId, token);
 
         let proxyHtml = fs.readFileSync(path.join(templatesDir, 'proxy.html'), 'utf-8');
-        proxyHtml = proxyHtml.replace('{{EXTERNAL_URL}}', externalUrl);
+        proxyHtml = proxyHtml.replace('{{EXTERNAL_URL_JSON}}', JSON.stringify(externalUrl));
         fs.writeFileSync(path.join(proxyDir, 'proxy.html'), proxyHtml);
 
         fs.copyFileSync(path.join(templatesDir, 'scorm-bridge.js'), path.join(proxyDir, 'scorm-bridge.js'));

package/lib/cloud.js

@@ -4,7 +4,7 @@
  * Implements the CLI → Cloud integration spec:
  *   login, logout, whoami, courses, deploy, status
  *
- * Zero external dependencies — uses Node 18+ built-in fetch, crypto, readline.
+ * Zero external dependencies — uses Node 20.19+ built-in fetch, crypto, readline.
  */
 
 import crypto from 'crypto';

package/lib/course-writer.js

@@ -14,6 +14,7 @@
 import fs from 'fs';
 import path from 'path';
 import { pathToFileURL } from 'url';
+import { parse } from 'acorn';
 
 // =============================================================================
 // PUBLIC API
@@ -22,6 +23,7 @@ import { pathToFileURL } from 'url';
 // In-memory write mutex to prevent concurrent writes from clobbering each other.
 // Each write() call chains onto the previous one, ensuring serial execution.
 let _writeQueue = Promise.resolve();
+let _configImportVersion = 0;
 
 /**
  * Unified write dispatcher
@@ -175,7 +177,9 @@ async function renameObjective(coursePath, oldId, newId) {
 
 async function loadConfig(coursePath) {
     const configFilePath = path.join(coursePath, 'course-config.js');
-    const configUrl = pathToFileURL(configFilePath).href + `?t=${Date.now()}`;
+    // Date.now() alone can collide across queued writes in the same
+    // millisecond, causing Node to return a stale ESM module instance.
+    const configUrl = pathToFileURL(configFilePath).href + `?v=${Date.now()}-${++_configImportVersion}`;
     const configModule = await import(configUrl);
     return configModule.courseConfig || configModule.default;
 }
@@ -183,13 +187,60 @@ async function loadConfig(coursePath) {
 async function saveConfig(coursePath, config) {
     const configFilePath = path.join(coursePath, 'course-config.js');
     const originalSource = fs.readFileSync(configFilePath, 'utf-8');
-    const headerComments = extractHeaderComments(originalSource);
-    const serialized = 'export const courseConfig = ' + serializeObject(config) + ';\n';
-    fs.writeFileSync(configFilePath, headerComments + '\n\n' + serialized, 'utf-8');
+    const ast = parse(originalSource, {
+        ecmaVersion: 'latest',
+        sourceType: 'module',
+        allowHashBang: true
+    });
+
+    let configInitializer = null;
+    for (const statement of ast.body) {
+        if (statement.type !== 'ExportNamedDeclaration' || statement.declaration?.type !== 'VariableDeclaration') continue;
+        const declarator = statement.declaration.declarations.find(item => item.id?.name === 'courseConfig');
+        if (declarator) {
+            configInitializer = declarator.init;
+            break;
+        }
+    }
+
+    if (!configInitializer || configInitializer.type !== 'ObjectExpression') {
+        throw new Error('course-config.js must export courseConfig as an object literal for visual editing');
+    }
+
+    const functionSources = new Map();
+    collectFunctionSources(configInitializer, config, originalSource, [], functionSources);
+    const serialized = serializeObject(config, 0, new WeakSet(), [], functionSources);
+    const updatedSource = originalSource.slice(0, configInitializer.start) +
+        serialized + originalSource.slice(configInitializer.end);
+    fs.writeFileSync(configFilePath, updatedSource, 'utf-8');
+}
+
+function collectFunctionSources(node, value, source, valuePath, output) {
+    if (!node || value === null || value === undefined) return;
+    if (typeof value === 'function') {
+        output.set(valuePath.join('.'), source.slice(node.start, node.end));
+        return;
+    }
+
+    if (node.type === 'ObjectExpression' && typeof value === 'object' && !Array.isArray(value)) {
+        for (const property of node.properties) {
+            if (property.type !== 'Property' || property.computed) continue;
+            const key = property.key.type === 'Identifier' ? property.key.name : String(property.key.value);
+            collectFunctionSources(property.value, value[key], source, [...valuePath, key], output);
+        }
+    } else if (node.type === 'ArrayExpression' && Array.isArray(value)) {
+        node.elements.forEach((element, index) => {
+            collectFunctionSources(element, value[index], source, [...valuePath, String(index)], output);
+        });
+    }
 }
 
 function setNestedProperty(obj, propPath, value) {
     const parts = propPath.split('.');
+    const forbidden = new Set(['__proto__', 'prototype', 'constructor']);
+    if (parts.some(part => !part || forbidden.has(part))) {
+        throw new Error('Invalid configuration property path');
+    }
     let current = obj;
     for (let i = 0; i < parts.length - 1; i++) {
         if (current[parts[i]] === undefined) {
@@ -211,48 +262,62 @@ function findStructureItem(structure, id) {
     return null;
 }
 
-function extractHeaderComments(source) {
-    const lines = source.split('\n');
-    const commentLines = [];
-    for (const line of lines) {
-        const trimmed = line.trim();
-        if (trimmed.startsWith('/**') || trimmed.startsWith('*') || trimmed.startsWith('*/') || trimmed === '') {
-            commentLines.push(line);
-        } else {
-            break;
-        }
-    }
-    while (commentLines.length > 0 && commentLines[commentLines.length - 1].trim() === '') {
-        commentLines.pop();
-    }
-    return commentLines.join('\n');
-}
-
-function serializeObject(obj, indent = 0) {
+function serializeObject(obj, indent = 0, ancestors = new WeakSet(), valuePath = [], functionSources = new Map()) {
     const spaces = '    '.repeat(indent);
     const innerSpaces = '    '.repeat(indent + 1);
     
     if (obj === null) return 'null';
     if (obj === undefined) return 'undefined';
     if (typeof obj === 'boolean') return String(obj);
-    if (typeof obj === 'number') return String(obj);
-    if (typeof obj === 'string') return `'${obj.replace(/\\/g, '\\\\').replace(/'/g, "\\'")}'`;
-    if (typeof obj === 'function') return obj.toString();
+    if (typeof obj === 'number') {
+        if (!Number.isFinite(obj)) throw new Error('courseConfig cannot contain NaN or Infinity');
+        return String(obj);
+    }
+    if (typeof obj === 'string') return JSON.stringify(obj).replace(/\u2028/g, '\\u2028').replace(/\u2029/g, '\\u2029');
+    if (typeof obj === 'function') return functionSources.get(valuePath.join('.')) || obj.toString();
+    if (typeof obj !== 'object') throw new Error(`Unsupported courseConfig value type: ${typeof obj}`);
+
+    if (ancestors.has(obj)) throw new Error('courseConfig cannot contain circular references');
+    ancestors.add(obj);
     
     if (Array.isArray(obj)) {
-        if (obj.length === 0) return '[]';
-        const items = obj.map(item => innerSpaces + serializeObject(item, indent + 1));
+        if (obj.length === 0) {
+            ancestors.delete(obj);
+            return '[]';
+        }
+        const items = obj.map((item, index) => innerSpaces + serializeObject(
+            item,
+            indent + 1,
+            ancestors,
+            [...valuePath, String(index)],
+            functionSources
+        ));
+        ancestors.delete(obj);
         return '[\n' + items.join(',\n') + '\n' + spaces + ']';
     }
+
+    const prototype = Object.getPrototypeOf(obj);
+    if (prototype !== Object.prototype && prototype !== null) {
+        ancestors.delete(obj);
+        throw new Error(`Unsupported courseConfig object type: ${obj.constructor?.name || 'unknown'}`);
+    }
     
     const entries = Object.entries(obj);
-    if (entries.length === 0) return '{}';
+    if (entries.length === 0) {
+        ancestors.delete(obj);
+        return '{}';
+    }
     
     const props = entries.map(([key, val]) => {
-        const keyStr = /^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(key) ? key : `'${key}'`;
-        return innerSpaces + keyStr + ': ' + serializeObject(val, indent + 1);
+        const keyStr = /^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(key) ? key : JSON.stringify(key);
+        return innerSpaces + keyStr + ': ' + serializeObject(
+            val,
+            indent + 1,
+            ancestors,
+            [...valuePath, key],
+            functionSources
+        );
     });
-    
+    ancestors.delete(obj);
     return '{\n' + props.join(',\n') + '\n' + spaces + '}';
 }
-

package/lib/manifest/cmi5-manifest.js

@@ -10,6 +10,8 @@
  * For cmi5-remote format, the AU URL is absolute (pointing to CDN).
  */
 
+import { escapeXmlAttribute, escapeXmlText } from './xml-utils.js';
+
 /**
  * Generates the cmi5 course structure XML.
  * @param {Object} config - Course configuration
@@ -23,39 +25,46 @@ export function generateCmi5Manifest(config, _files, options = {}) {
   const courseId = config.identifier ||
     `urn:coursecode:${config.title.replace(/[^a-zA-Z0-9]/g, '-').toLowerCase()}`;
 
-  // Calculate mastery score from passing percentage (convert percentage to 0-1 scale)
-  const masteryScore = config.passingScore ? (config.passingScore / 100).toFixed(2) : '0.8';
+  // Package-level mastery is optional. Do not invent a value from one
+  // assessment because a course can contain multiple thresholds.
+  const masteryAttribute = Number.isFinite(config.masteryScore)
+    ? ` masteryScore="${(config.masteryScore / 100).toFixed(2)}"`
+    : '';
 
   // AU identifier - derive from course ID
   const auId = `${courseId}/au/1`;
 
   // URL: absolute for cmi5-remote (use as-is), relative for standard cmi5
   const auUrl = options.externalUrl || 'index.html';
+  const escapedCourseId = escapeXmlAttribute(courseId);
+  const escapedAuId = escapeXmlAttribute(auId);
+  const escapedLanguage = escapeXmlAttribute(config.language);
+  const title = escapeXmlText(config.title);
+  const description = escapeXmlText(config.description);
 
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!-- cmi5 Course Structure - GENERATED FILE - DO NOT EDIT MANUALLY -->
 <courseStructure xmlns="https://w3id.org/xapi/profiles/cmi5/v1/CourseStructure.xsd">
 
-  <course id="${courseId}">
+  <course id="${escapedCourseId}">
     <title>
-      <langstring lang="${config.language}">${config.title}</langstring>
+      <langstring lang="${escapedLanguage}">${title}</langstring>
     </title>
     <description>
-      <langstring lang="${config.language}">${config.description}</langstring>
+      <langstring lang="${escapedLanguage}">${description}</langstring>
     </description>
   </course>
 
-  <au id="${auId}" moveOn="Completed" masteryScore="${masteryScore}" launchMethod="OwnWindow">
+  <au id="${escapedAuId}" moveOn="Completed"${masteryAttribute} launchMethod="OwnWindow">
     <title>
-      <langstring lang="${config.language}">${config.title}</langstring>
+      <langstring lang="${escapedLanguage}">${title}</langstring>
     </title>
     <description>
-      <langstring lang="${config.language}">${config.description}</langstring>
+      <langstring lang="${escapedLanguage}">${description}</langstring>
     </description>
-    <url>${auUrl}</url>
+    <url>${escapeXmlText(auUrl)}</url>
   </au>
 
 </courseStructure>
 `;
 }
-

package/lib/manifest/lti-tool-config.js

@@ -12,7 +12,21 @@
  * @returns {string} JSON string of tool configuration
  */
 export function generateLtiToolConfig(config, options = {}) {
-    const baseUrl = options.externalUrl || config.externalUrl || 'https://your-course-host.example.com';
+    const configuredUrl = options.externalUrl || config.externalUrl;
+    if (!configuredUrl) {
+        throw new Error('LTI builds require externalUrl for a trusted server-side OIDC/AGS backend');
+    }
+
+    let parsedBaseUrl;
+    try {
+        parsedBaseUrl = new URL(configuredUrl);
+    } catch {
+        throw new Error(`Invalid LTI externalUrl: ${configuredUrl}`);
+    }
+    if (!['https:', 'http:'].includes(parsedBaseUrl.protocol)) {
+        throw new Error('LTI externalUrl must use https (or http for local development)');
+    }
+    const baseUrl = parsedBaseUrl.toString().replace(/\/$/, '');
     const title = config.title || 'CourseCode Course';
     const description = config.description || '';
 
@@ -24,7 +38,6 @@ export function generateLtiToolConfig(config, options = {}) {
         'grant_types': ['implicit', 'client_credentials'],
         'initiate_login_uri': `${baseUrl}/lti/login`,
         'redirect_uris': [
-            `${baseUrl}/index.html`,
             `${baseUrl}/lti/launch`
         ],
         'client_name': title,
@@ -35,14 +48,14 @@ export function generateLtiToolConfig(config, options = {}) {
 
         // LTI-specific claims
         'https://purl.imsglobal.org/spec/lti-tool-configuration': {
-            'domain': new URL(baseUrl).hostname,
+            'domain': parsedBaseUrl.hostname,
             'description': description,
-            'target_link_uri': `${baseUrl}/index.html`,
+            'target_link_uri': `${baseUrl}/lti/launch`,
             'claims': ['iss', 'sub', 'name', 'given_name', 'family_name', 'email'],
             'messages': [
                 {
                     'type': 'LtiResourceLinkRequest',
-                    'target_link_uri': `${baseUrl}/index.html`,
+                    'target_link_uri': `${baseUrl}/lti/launch`,
                     'label': title
                 }
             ]

package/lib/manifest/scorm-12-manifest.js

@@ -8,6 +8,8 @@
  * - 4th Edition schema references
  */
 
+import { escapeXmlAttribute, escapeXmlText } from './xml-utils.js';
+
 /**
  * Generates the SCORM 1.2 manifest.
  * @param {Object} config - Course configuration
@@ -22,13 +24,18 @@ export function generateScorm12Manifest(config, files) {
         !f.startsWith('common/')
     );
 
-    const fileEntries = resourceFiles.map(f => `      <file href="${f}"/>`).join('\n');
+    const fileEntries = resourceFiles.map(f => `      <file href="${escapeXmlAttribute(f)}"/>`).join('\n');
+    const version = escapeXmlAttribute(config.version);
+    const title = escapeXmlText(config.title);
+    const masteryScore = Number.isFinite(config.masteryScore)
+        ? `\n        <adlcp:masteryscore>${config.masteryScore}</adlcp:masteryscore>`
+        : '';
 
     // SCORM 1.2 uses ADLCP 1.2 schema and doesn't include sequencing
     return `<?xml version="1.0" encoding="UTF-8"?>
 <!-- SCORM 1.2 manifest - GENERATED FILE - DO NOT EDIT MANUALLY -->
 <manifest identifier="${config.title.replace(/[^a-zA-Z0-9]/g, '-')}"
-          version="${config.version}"
+          version="${version}"
           xmlns="http://www.imsproject.org/xsd/imscp_rootv1p1p2"
           xmlns:adlcp="http://www.adlnet.org/xsd/adlcp_rootv1p2"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
@@ -43,10 +50,9 @@ export function generateScorm12Manifest(config, files) {
 
   <organizations default="org-1">
     <organization identifier="org-1">
-      <title>${config.title}</title>
+      <title>${title}</title>
       <item identifier="item-1" identifierref="res-1" isvisible="true">
-        <title>${config.title}</title>
-        <adlcp:masteryscore>80</adlcp:masteryscore>
+        <title>${title}</title>${masteryScore}
       </item>
     </organization>
   </organizations>