tessera-learn 0.2.3 → 0.3.0

package/src/plugin/cli.ts

@@ -34,6 +34,27 @@ export function splitCourseArg(rest: string[]): {
   return { course: undefined, flags: rest };
 }
 
+type CourseCommand = (
+  courseRoot: string,
+  workspaceRoot: string,
+  flags: string[],
+) => number | Promise<number>;
+
+const COURSE_COMMANDS: Record<string, CourseCommand> = {
+  dev: async (courseRoot, workspaceRoot) =>
+    (await import('./build-commands.js')).runDev(courseRoot, workspaceRoot),
+  export: async (courseRoot, workspaceRoot) =>
+    (await import('./build-commands.js')).runBuild(courseRoot, workspaceRoot),
+  validate: (courseRoot) => runValidate(courseRoot),
+  a11y: (courseRoot, workspaceRoot, flags) =>
+    runA11y(courseRoot, workspaceRoot, flags),
+  check: (courseRoot, workspaceRoot, flags) => {
+    const validateCode = runValidate(courseRoot, { showA11yTip: false });
+    if (validateCode !== 0) return validateCode;
+    return runA11y(courseRoot, workspaceRoot, flags);
+  },
+};
+
 export async function main(
   argv: string[],
   cwd: string = process.cwd(),
@@ -43,56 +64,34 @@ export async function main(
   if (sub === 'new') return runNew(rest[0], cwd);
   if (sub === 'duplicate') return runDuplicate(rest[0], rest[1], cwd);
 
-  switch (sub) {
-    case 'dev':
-    case 'export':
-    case 'validate':
-    case 'a11y':
-    case 'check': {
-      if (rest.includes('--help') || rest.includes('-h')) {
-        console.log(USAGE);
-        return 0;
-      }
-      const { course, flags } = splitCourseArg(rest);
-      const resolved = resolveCourse(cwd, course);
-      if (!resolved.ok) {
-        console.error(`[tessera] ${resolved.error}`);
-        return 1;
-      }
-      const { courseRoot, workspaceRoot } = resolved;
-
-      switch (sub) {
-        case 'dev': {
-          const { runDev } = await import('./build-commands.js');
-          return runDev(courseRoot, workspaceRoot);
-        }
-        case 'export': {
-          const { runBuild } = await import('./build-commands.js');
-          return runBuild(courseRoot, workspaceRoot);
-        }
-        case 'validate':
-          return runValidate(courseRoot);
-        case 'check': {
-          const validateCode = runValidate(courseRoot, { showA11yTip: false });
-          if (validateCode !== 0) return validateCode;
-          return runA11y(courseRoot, workspaceRoot, flags);
-        }
-        case 'a11y':
-          return runA11y(courseRoot, workspaceRoot, flags);
-      }
-      return 0;
-    }
-    case '--help':
-    case '-h':
+  if (sub !== undefined && Object.hasOwn(COURSE_COMMANDS, sub)) {
+    if (rest.includes('--help') || rest.includes('-h')) {
       console.log(USAGE);
       return 0;
-    case undefined:
-      console.error(`No command given.\n\n${USAGE}`);
-      return 1;
-    default:
-      console.error(`Unknown command: ${sub}\n\n${USAGE}`);
+    }
+    const { course, flags } = splitCourseArg(rest);
+    const resolved = resolveCourse(cwd, course);
+    if (!resolved.ok) {
+      console.error(`[tessera] ${resolved.error}`);
       return 1;
+    }
+    return COURSE_COMMANDS[sub](
+      resolved.courseRoot,
+      resolved.workspaceRoot,
+      flags,
+    );
+  }
+
+  if (sub === '--help' || sub === '-h') {
+    console.log(USAGE);
+    return 0;
+  }
+  if (sub === undefined) {
+    console.error(`No command given.\n\n${USAGE}`);
+    return 1;
   }
+  console.error(`Unknown command: ${sub}\n\n${USAGE}`);
+  return 1;
 }
 
 // import.meta.main is true only when this module is the program entry point,

package/src/plugin/csp.ts

@@ -0,0 +1,59 @@
+// Baseline Content-Security-Policy for web exports, as a per-directive object so
+// course.config.js can extend individual directives (union, never replace).
+// 'unsafe-inline' stays because Vite injects an inline modulepreload polyfill and
+// Svelte ships scoped <style>. blob: on frame/worker-src needs prior script
+// execution, so it adds no attacker capability; data: is intentionally absent
+// from frame-src (a classic XSS-escalation vector).
+export const WEB_CSP_BASELINE: Record<string, string[]> = {
+  'default-src': ["'self'"],
+  'img-src': ["'self'", 'data:', 'https:'],
+  'media-src': ["'self'", 'blob:', 'data:', 'https:'],
+  'style-src': ["'self'", "'unsafe-inline'"],
+  'script-src': ["'self'", "'unsafe-inline'"],
+  'font-src': ["'self'", 'data:'],
+  'connect-src': ["'self'", 'https:'],
+  'frame-src': ["'self'", 'blob:', 'https:'],
+  'worker-src': ["'self'", 'blob:'],
+  'object-src': ["'none'"],
+  'base-uri': ["'self'"],
+};
+
+// Reject the separators (whitespace ends a source, ';' ends a directive, ','
+// ends a policy) so a stray char can't inject directives when sources are joined,
+// plus " < > so a source can't break out of the content="..." meta attribute.
+const CSP_DIRECTIVE = /^[a-zA-Z][a-zA-Z-]*$/;
+const CSP_SOURCE = /^[^\s;,"<>]+$/;
+
+export function isCspOverrides(v: unknown): v is Record<string, string[]> {
+  return (
+    typeof v === 'object' &&
+    v !== null &&
+    !Array.isArray(v) &&
+    Object.entries(v).every(
+      ([directive, sources]) =>
+        CSP_DIRECTIVE.test(directive) &&
+        Array.isArray(sources) &&
+        sources.every((s) => typeof s === 'string' && CSP_SOURCE.test(s)),
+    )
+  );
+}
+
+// Malformed input falls back to the baseline unchanged — validation surfaces the
+// warning separately.
+export function buildCsp(overrides?: unknown): string {
+  const merged = new Map(
+    Object.entries(WEB_CSP_BASELINE).map(([k, v]) => [k, [...v]]),
+  );
+  if (isCspOverrides(overrides)) {
+    for (const [directive, sources] of Object.entries(overrides)) {
+      const existing = merged.get(directive) ?? [];
+      for (const src of sources) {
+        if (!existing.includes(src)) existing.push(src);
+      }
+      merged.set(directive, existing);
+    }
+  }
+  return [...merged]
+    .map(([directive, sources]) => `${directive} ${sources.join(' ')}`)
+    .join('; ');
+}

package/src/plugin/duplicate-cli.ts

@@ -1,8 +1,43 @@
-import { cpSync, existsSync } from 'node:fs';
+import { cpSync, existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
 import { basename, join, relative } from 'node:path';
 import { resolveCourse } from './course-root.js';
 import { validateProjectName } from './project-name.js';
 
+// The top-level `id` property as scaffolders write it: the key (bare or quoted)
+// first on its own line, then its value. Anchoring to line start keeps `id:`
+// inside a comment or a string value from matching, and CourseConfig has no
+// nested `id`, so the first match is always the course identity.
+const ID_LINE =
+  /^([ \t]*'?id'?[ \t]*:[ \t]*)('(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"|`(?:[^`\\]|\\.)*`|[^\n,}]*)/m;
+const DEFAULT_OBJECT = /export\s+default\s*\{/;
+
+// A verbatim copy inherits the source's `id`; mint a fresh one so the duplicate
+// is a distinct course (own storage key + LRS activity id).
+function reidentifyCourse(courseRoot: string): void {
+  const configPath = join(courseRoot, 'course.config.js');
+  if (!existsSync(configPath)) return;
+  const text = readFileSync(configPath, 'utf-8');
+  const newId = `'urn:uuid:${randomUUID()}'`;
+
+  if (ID_LINE.test(text)) {
+    writeFileSync(configPath, text.replace(ID_LINE, `$1${newId}`));
+    return;
+  }
+  const obj = DEFAULT_OBJECT.exec(text);
+  if (obj) {
+    const at = obj.index + obj[0].length;
+    writeFileSync(
+      configPath,
+      `${text.slice(0, at)}\n  id: ${newId},${text.slice(at)}`,
+    );
+    return;
+  }
+  console.warn(
+    `[tessera duplicate] Could not set a unique id in ${configPath} — the copy shares the source's identity. Add a unique "id" manually.`,
+  );
+}
+
 const HELP =
   'Usage: tessera duplicate <source> <new>\n\n' +
   'Copy courses/<source>/ to courses/<new>/ within the current workspace.';
@@ -62,6 +97,7 @@ export function runDuplicate(
     recursive: true,
     filter: (src) => src === srcDir || !skip(src),
   });
+  reidentifyCourse(destDir);
 
   const rel = relative(workspaceRoot, destDir);
   const srcRel = relative(workspaceRoot, srcDir);

package/src/plugin/export.ts

@@ -10,11 +10,13 @@ import { createWriteStream } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { ZipArchive } from 'archiver';
 import { slugify } from '../runtime/slugify.js';
+import { courseIdentity } from '../runtime/types.js';
 
 // ---------- Types ----------
 
 interface ExportConfig {
   title: string;
+  id?: string;
   description?: string;
   version?: string;
   scoring?: { passingScore?: number };
@@ -24,6 +26,8 @@ interface ExportConfig {
 
 // ---------- Helpers ----------
 
+const UNTITLED_TITLE = 'Untitled Course';
+
 function escapeXml(str: string): string {
   return str
     .replace(/&/g, '&')
@@ -40,11 +44,14 @@ function collectFiles(dir: string, base: string = ''): string[] {
   const files: string[] = [];
   if (!existsSync(dir)) return files;
 
-  for (const entry of readdirSync(dir)) {
-    const fullPath = resolve(dir, entry);
-    const relPath = base ? `${base}/${entry}` : entry;
-    if (statSync(fullPath).isDirectory()) {
-      files.push(...collectFiles(fullPath, relPath));
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const relPath = base ? `${base}/${entry.name}` : entry.name;
+    // Dirent is lstat-based; stat symlinks so a symlinked dir still recurses.
+    const isDir = entry.isSymbolicLink()
+      ? statSync(resolve(dir, entry.name)).isDirectory()
+      : entry.isDirectory();
+    if (isDir) {
+      files.push(...collectFiles(resolve(dir, entry.name), relPath));
     } else {
       files.push(relPath);
     }
@@ -68,6 +75,13 @@ function stableUrn(kind: 'course' | 'au', seed: string): string {
   return `urn:tessera:${kind}:${h.slice(0, 32)}`;
 }
 
+// AU activity id, derived from the course id so re-exports don't orphan LRS
+// records. Shared by the cmi5 and tincan manifests.
+function auIdFor(config: ExportConfig): string {
+  const id = courseIdentity(config);
+  return stableUrn('au', id ? `${id}#au` : 'tessera-au');
+}
+
 function formatSize(bytes: number): string {
   if (bytes < 1024) return `${bytes} B`;
   if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
@@ -115,7 +129,7 @@ export function generateScormManifest(
   distDir: string,
 ): string {
   const dialect = SCORM_DIALECTS[version];
-  const title = escapeXml(config.title || 'Tessera Course');
+  const title = escapeXml(config.title || UNTITLED_TITLE);
   const files = collectFiles(distDir);
   const fileElements = files
     .map((f) => `      <file href="${escapeXml(f)}" />`)
@@ -147,27 +161,16 @@ ${fileElements}
 </manifest>`;
 }
 
-export function generateSCORM12Manifest(
-  config: ExportConfig,
-  distDir: string,
-): string {
-  return generateScormManifest('1.2', config, distDir);
-}
-
-export function generateSCORM2004Manifest(
-  config: ExportConfig,
-  distDir: string,
-): string {
-  return generateScormManifest('2004', config, distDir);
-}
-
 export function generateCMI5Xml(config: ExportConfig): string {
-  const title = escapeXml(config.title || 'Tessera Course');
+  const title = escapeXml(config.title || UNTITLED_TITLE);
   const description = escapeXml(config.description || '');
-  // Derive stable IDs from the course title so they survive rebuilds without
+  // Derive stable IDs from the course id so they survive rebuilds without
   // orphaning existing learner records in the LRS.
-  const courseId = stableUrn('course', `tessera-course:${config.title || ''}`);
-  const auId = stableUrn('au', `tessera-au:${config.title || ''}`);
+  const courseId = stableUrn(
+    'course',
+    courseIdentity(config) || 'tessera-course',
+  );
+  const auId = auIdFor(config);
   // cmi5 §10.2.4 caps masteryScore at 4 decimals; avoid float drift like 0.7000000000000001.
   const masteryScore = Number(
     ((config.scoring?.passingScore ?? 70) / 100).toFixed(4),
@@ -195,6 +198,25 @@ export function generateCMI5Xml(config: ExportConfig): string {
 </courseStructure>`;
 }
 
+export function generateTincanXml(config: ExportConfig): string {
+  const title = escapeXml(config.title || UNTITLED_TITLE);
+  const description = escapeXml(config.description || '');
+  // Reuse the cmi5/SCORM stable-id scheme so re-exports don't orphan LRS records.
+  const auId = auIdFor(config);
+  // tincan.xml carries NO xAPI version — the version is set at runtime by the
+  // adapter's X-Experience-API-Version header, not declared in the manifest.
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<tincan xmlns="http://projecttincan.com/tincan.xsd">
+  <activities>
+    <activity id="${auId}" type="http://adlnet.gov/expapi/activities/course">
+      <name>${title}</name>
+      <description lang="en-US">${description}</description>
+      <launch lang="en-US">index.html</launch>
+    </activity>
+  </activities>
+</tincan>`;
+}
+
 // ---------- ZIP Packaging ----------
 
 export async function createZip(
@@ -238,7 +260,7 @@ function cleanOldZips(projectRoot: string, slug: string): void {
 
 /** Packaged (zipped) export targets: which manifest file to write and how. */
 const PACKAGED_EXPORTS: Record<
-  'scorm12' | 'scorm2004' | 'cmi5',
+  'scorm12' | 'scorm2004' | 'cmi5' | 'xapi',
   {
     manifestFile: string;
     label: string;
@@ -248,18 +270,25 @@ const PACKAGED_EXPORTS: Record<
   scorm12: {
     manifestFile: 'imsmanifest.xml',
     label: 'SCORM 1.2',
-    generate: generateSCORM12Manifest,
+    generate: (config, distDir) =>
+      generateScormManifest('1.2', config, distDir),
   },
   scorm2004: {
     manifestFile: 'imsmanifest.xml',
     label: 'SCORM 2004',
-    generate: generateSCORM2004Manifest,
+    generate: (config, distDir) =>
+      generateScormManifest('2004', config, distDir),
   },
   cmi5: {
     manifestFile: 'cmi5.xml',
     label: 'CMI5',
     generate: (config) => generateCMI5Xml(config),
   },
+  xapi: {
+    manifestFile: 'tincan.xml',
+    label: 'xAPI 1.0.3',
+    generate: (config) => generateTincanXml(config),
+  },
 };
 
 export async function runExport(

package/src/plugin/index.ts

@@ -10,7 +10,11 @@ import {
   cpSync,
   mkdirSync,
 } from 'node:fs';
-import { generateManifest, readCourseConfig } from './manifest.js';
+import {
+  generateManifest,
+  readCourseConfig,
+  type CourseConfigRead,
+} from './manifest.js';
 import type { Manifest } from './manifest.js';
 import type { CourseConfig } from '../runtime/types.js';
 import {
@@ -25,6 +29,7 @@ import {
   isIgnored,
   type A11ySettings,
 } from './validation.js';
+import { buildCsp } from './csp.js';
 import { runExport } from './export.js';
 import { tesseraLayoutPlugin } from './layout.js';
 import { tesseraQuizPlugin } from './quiz.js';
@@ -188,9 +193,10 @@ function tesseraEntryPlugin(): Plugin {
     // For build mode: write index.html so Rollup can find it
     buildStart() {
       if (isBuild) {
+        const read = readCourseConfig(projectRoot);
         writeFileSync(
           resolve(projectRoot, 'index.html'),
-          generateIndexHtml(readLanguage(projectRoot)),
+          generateIndexHtml(readLanguage(read), cspMeta(read)),
           'utf-8',
         );
       }
@@ -221,7 +227,9 @@ function tesseraEntryPlugin(): Plugin {
       return () => {
         server.middlewares.use(async (req, res, next) => {
           if (req.url === '/' || req.url === '/index.html') {
-            const html = generateIndexHtml(readLanguage(projectRoot));
+            const html = generateIndexHtml(
+              readLanguage(readCourseConfig(projectRoot)),
+            );
             const transformed = await server.transformIndexHtml(req.url, html);
             res.setHeader('Content-Type', 'text/html');
             res.statusCode = 200;
@@ -252,18 +260,35 @@ function tesseraEntryPlugin(): Plugin {
 // 'en' fallback applied here: the config default-merge runs later than buildStart.
 // Only a validated BCP-47 tag is interpolated into <html lang>, so a malformed
 // value (caught separately as a warning) can't ship a broken attribute.
-function readLanguage(projectRoot: string): string {
-  const read = readCourseConfig(projectRoot);
+function readLanguage(read: CourseConfigRead): string {
   const lang = read.ok ? read.config.language : undefined;
   return isPlausibleLanguageTag(lang) ? lang : 'en';
 }
 
-function generateIndexHtml(lang: string): string {
+// Fail closed on an unreadable config: cspMeta only emits for exactly 'web', so
+// an unknown standard withholds the CSP rather than guess the one mode it breaks.
+function readExportStandard(read: CourseConfigRead): string {
+  if (!read.ok) return 'unknown';
+  return read.config.export?.standard || 'web';
+}
+
+// Web export only — never on LMS packages (whose iframe JS bridges a meta CSP
+// could break) and never on the dev server (a meta connect-src would block
+// Vite's HMR websocket). `export.csp` extends the baseline per-directive, or
+// `false` drops the meta for deployments that set a CSP header themselves.
+function cspMeta(read: CourseConfigRead): string {
+  if (readExportStandard(read) !== 'web') return '';
+  const csp = read.ok ? read.config.export?.csp : undefined;
+  if (csp === false) return '';
+  return `\n  <meta http-equiv="Content-Security-Policy" content="${buildCsp(csp)}" />`;
+}
+
+function generateIndexHtml(lang: string, csp = ''): string {
   return `<!DOCTYPE html>
 <html lang="${lang}">
 <head>
   <meta charset="UTF-8" />
-  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />${csp}
   <title>Tessera Course</title>
 </head>
 <body>
@@ -326,6 +351,12 @@ function completionDefaults(mode: string | undefined): {
   if (mode === 'manual') {
     return { completion: { mode: 'manual' }, passingScore: 0 };
   }
+  if (mode === 'quiz') {
+    return {
+      completion: { mode: 'quiz' },
+      passingScore: DEFAULT_PASSING_SCORE,
+    };
+  }
   return {
     completion: {
       mode: 'percentage',
@@ -353,6 +384,21 @@ function tesseraConfigDefaultsPlugin(): Plugin {
   };
 }
 
+/** Fill runtime defaults into a parsed course.config.js. Exported for tests. */
+export function mergeCourseConfig(userConfig: Partial<CourseConfig>) {
+  const { completion, passingScore } = completionDefaults(
+    userConfig.completion?.mode,
+  );
+  return {
+    ...userConfig,
+    title: userConfig.title || 'Untitled Course',
+    navigation: { mode: 'free', ...userConfig.navigation },
+    completion: { ...completion, ...userConfig.completion },
+    scoring: { passingScore, ...userConfig.scoring },
+    export: { standard: 'web', ...userConfig.export },
+  };
+}
+
 function tesseraConfigPlugin(): Plugin {
   return virtualModule(
     'tessera:config',
@@ -362,18 +408,7 @@ function tesseraConfigPlugin(): Plugin {
       if (existsSync(configPath)) this.addWatchFile(configPath);
       const read = readCourseConfig(projectRoot);
       const userConfig: Partial<CourseConfig> = read.ok ? read.config : {};
-      const { completion, passingScore } = completionDefaults(
-        userConfig.completion?.mode,
-      );
-      const merged = {
-        title: userConfig.title || 'Untitled Course',
-        ...userConfig,
-        navigation: { mode: 'free', ...userConfig.navigation },
-        completion: { ...completion, ...userConfig.completion },
-        scoring: { passingScore, ...userConfig.scoring },
-        export: { standard: 'web', ...userConfig.export },
-      };
-      return `export default ${JSON.stringify(merged)};`;
+      return `export default ${JSON.stringify(mergeCourseConfig(userConfig))};`;
     },
   );
 }
@@ -611,7 +646,8 @@ function tesseraManifestPlugin(manifestRef: {
           value === Infinity ? 1e9 : value,
         );
         const b64 = Buffer.from(json).toString('base64');
-        return `export default JSON.parse(atob("${b64}"));`;
+        // atob yields Latin1 bytes; decode through UTF-8 or non-ASCII titles ship as mojibake.
+        return `export default JSON.parse(new TextDecoder().decode(Uint8Array.from(atob("${b64}"),(c)=>c.charCodeAt(0))));`;
       }
       return null;
     },
@@ -620,6 +656,55 @@ function tesseraManifestPlugin(manifestRef: {
 
 const VIRTUAL_ADAPTER_ID = 'virtual:tessera-adapter';
 
+// `takesApi`: SCORM detectors return the API object the constructor needs;
+// cmi5/xAPI ones return a boolean.
+const LMS_ADAPTER_GEN: Record<
+  'scorm12' | 'scorm2004' | 'cmi5' | 'xapi',
+  { adapter: string; module: string; detect: string; takesApi: boolean }
+> = {
+  scorm12: {
+    adapter: 'SCORM12Adapter',
+    module: 'scorm12',
+    detect: 'findSCORM12API',
+    takesApi: true,
+  },
+  scorm2004: {
+    adapter: 'SCORM2004Adapter',
+    module: 'scorm2004',
+    detect: 'findSCORM2004API',
+    takesApi: true,
+  },
+  cmi5: {
+    adapter: 'CMI5Adapter',
+    module: 'cmi5',
+    detect: 'hasCMI5LaunchParams',
+    takesApi: false,
+  },
+  xapi: {
+    adapter: 'XAPIAdapter',
+    module: 'xapi',
+    detect: 'hasXAPILaunchParams',
+    takesApi: false,
+  },
+};
+
+function generateLmsAdapterModule(
+  standard: keyof typeof LMS_ADAPTER_GEN,
+): string {
+  const { adapter, module, detect, takesApi } = LMS_ADAPTER_GEN[standard];
+  const guard = takesApi
+    ? `const api = ${detect}();\n  if (!api) throw missingApiError('${standard}');\n  return new ${adapter}(api);`
+    : `if (!${detect}()) throw missingApiError('${standard}');\n  return new ${adapter}();`;
+  return `
+import { ${adapter} } from 'tessera-learn/runtime/adapters/${module}.js';
+import { ${detect} } from 'tessera-learn/runtime/adapters/discovery.js';
+import { missingApiError } from 'tessera-learn/runtime/adapters/lms-error.js';
+export function createAdapter() {
+  ${guard}
+}
+`;
+}
+
 function tesseraAdapterPlugin(): Plugin {
   return virtualModule(
     'tessera:adapter',
@@ -641,47 +726,17 @@ function tesseraAdapterPlugin(): Plugin {
       // cmi5 adapters throw when their API is absent, so render with WebAdapter.
       if (isAuditBuild()) standard = 'web';
 
-      switch (standard) {
-        case 'scorm12':
-          return `
-import { SCORM12Adapter } from 'tessera-learn/runtime/adapters/scorm12.js';
-import { findSCORM12API } from 'tessera-learn/runtime/adapters/discovery.js';
-import { LMSAdapterError } from 'tessera-learn/runtime/adapters/index.js';
-export function createAdapter() {
-  const api = findSCORM12API();
-  if (!api) throw new LMSAdapterError('scorm12', 'Tessera: SCORM 1.2 API not found in window.parent/opener chain. Course must be launched from a SCORM 1.2 LMS.');
-  return new SCORM12Adapter(api);
-}
-`;
-        case 'scorm2004':
-          return `
-import { SCORM2004Adapter } from 'tessera-learn/runtime/adapters/scorm2004.js';
-import { findSCORM2004API } from 'tessera-learn/runtime/adapters/discovery.js';
-import { LMSAdapterError } from 'tessera-learn/runtime/adapters/index.js';
-export function createAdapter() {
-  const api = findSCORM2004API();
-  if (!api) throw new LMSAdapterError('scorm2004', 'Tessera: SCORM 2004 API not found in window.parent/opener chain. Course must be launched from a SCORM 2004 LMS.');
-  return new SCORM2004Adapter(api);
-}
-`;
-        case 'cmi5':
-          return `
-import { CMI5Adapter } from 'tessera-learn/runtime/adapters/cmi5.js';
-import { hasCMI5LaunchParams } from 'tessera-learn/runtime/adapters/discovery.js';
-import { LMSAdapterError } from 'tessera-learn/runtime/adapters/index.js';
-export function createAdapter() {
-  if (!hasCMI5LaunchParams()) throw new LMSAdapterError('cmi5', 'Tessera: cmi5 launch parameters not present on URL. Course must be launched from a cmi5-compliant LMS.');
-  return new CMI5Adapter();
-}
-`;
-        default:
-          return `
+      if (standard in LMS_ADAPTER_GEN) {
+        return generateLmsAdapterModule(
+          standard as keyof typeof LMS_ADAPTER_GEN,
+        );
+      }
+      return `
 import { WebAdapter } from 'tessera-learn/runtime/adapters/web.js';
-export function createAdapter(config) {
-  return new WebAdapter(config);
+export function createAdapter(config, options) {
+  return new WebAdapter(config, options && options.manifest);
 }
 `;
-      }
     },
   );
 }
@@ -711,9 +766,10 @@ function tesseraXAPISetupPlugin(): Plugin {
         hasXapi = read.config.xapi != null;
       }
 
-      // cmi5 needs the publisher regardless of explicit xapi config (cmi5
-      // adapter shares the publisher queue for its own LMS-required statements).
-      if (hasXapi || standard === 'cmi5') {
+      // The launch standards (cmi5, plain xAPI) own a publisher the runtime
+      // can share for `endpoint: 'lms'`, so wire the client regardless of
+      // explicit xapi config.
+      if (hasXapi || standard === 'cmi5' || standard === 'xapi') {
         return `export { buildXAPIClient } from 'tessera-learn/runtime/xapi/setup.js';`;
       }